From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) by finch.gentoo.org (Postfix) with ESMTP id 149BB59CA3 for ; Fri, 11 Mar 2016 17:20:28 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id AF9F221C039; Fri, 11 Mar 2016 17:20:18 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 00A6621C067 for ; Fri, 11 Mar 2016 17:20:16 +0000 (UTC) Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 23C89340B69 for ; Fri, 11 Mar 2016 17:20:16 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id 9AD66233D for ; Fri, 11 Mar 2016 17:20:11 +0000 (UTC) From: "Jason Zaman" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Jason Zaman" Message-ID: <1457716577.04ebf78c2f42dbdbb4cc5c79c10af95878a1438a.perfinion@gentoo> Subject: [gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/ X-VCS-Repository: proj/hardened-refpolicy X-VCS-Files: policy/modules/contrib/tboot.fc policy/modules/contrib/tboot.if policy/modules/contrib/tboot.te X-VCS-Directories: policy/modules/contrib/ X-VCS-Committer: perfinion X-VCS-Committer-Name: Jason Zaman X-VCS-Revision: 04ebf78c2f42dbdbb4cc5c79c10af95878a1438a X-VCS-Branch: master Date: Fri, 11 Mar 2016 17:20:11 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: 9728a7ea-f5cb-47c0-8c0c-b2db39c22376 X-Archives-Hash: 43575da10e5a3fdaefe51aed4fafac2f commit: 04ebf78c2f42dbdbb4cc5c79c10af95878a1438a Author: Luis Ressel aixah de> AuthorDate: Mon Mar 7 15:33:02 2016 +0000 Commit: Jason Zaman gentoo org> CommitDate: Fri Mar 11 17:16:17 2016 +0000 URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=04ebf78c New policy for tboot utilities tboot is an OSS project for using the features of Intel TXT. Some of its included utilities (might) need special permissions. For now, there's only a policy for txt-stat (it needs access to /dev/mem). policy/modules/contrib/tboot.fc | 1 + policy/modules/contrib/tboot.if | 46 +++++++++++++++++++++++++++++++++++++++++ policy/modules/contrib/tboot.te | 24 +++++++++++++++++++++ 3 files changed, 71 insertions(+) diff --git a/policy/modules/contrib/tboot.fc b/policy/modules/contrib/tboot.fc new file mode 100644 index 0000000..437e1d5 --- /dev/null +++ b/policy/modules/contrib/tboot.fc @@ -0,0 +1 @@ +/usr/sbin/txt-stat -- gen_context(system_u:object_r:txtstat_exec_t,s0) diff --git a/policy/modules/contrib/tboot.if b/policy/modules/contrib/tboot.if new file mode 100644 index 0000000..0ffe6d8 --- /dev/null +++ b/policy/modules/contrib/tboot.if @@ -0,0 +1,46 @@ +## Utilities for the tboot TXT module. + +######################################## +## +## Execute txt-stat in the txtstat domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`tboot_domtrans_txtstat',` + gen_require(` + type txtstat_t, txtstat_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, txtstat_exec_t, txtstat_t) +') + +######################################## +## +## Execute txt-stat in the txtstat domain, and +## allow the specified role the txtstat domain. +## +## +## +## Domain allowed to transition. +## +## +## +## +## The role to be allowed the txtstat domain. +## +## +# +interface(`tboot_run_txtstat',` + gen_require(` + type txtstat_t; + attribute_role txtstat_roles; + ') + + tboot_domtrans_txtstat($1) + roleattribute $2 txtstat_roles; +') diff --git a/policy/modules/contrib/tboot.te b/policy/modules/contrib/tboot.te new file mode 100644 index 0000000..4961a36 --- /dev/null +++ b/policy/modules/contrib/tboot.te @@ -0,0 +1,24 @@ +policy_module(tboot, 1.0.0) + +######################################## +# +# Declarations +# + +attribute_role txtstat_roles; +roleattribute system_r txtstat_roles; + +type txtstat_t; +type txtstat_exec_t; +application_domain(txtstat_t, txtstat_exec_t) +role txtstat_roles types txtstat_t; + +######################################## +# +# Local policy +# + +dev_read_raw_memory(txtstat_t) + +domain_use_interactive_fds(txtstat_t) +userdom_use_user_terminals(txtstat_t)