From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id D1FDC1396D0 for ; Sun, 10 Sep 2017 14:04:00 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 90DB91FC110; Sun, 10 Sep 2017 14:03:59 +0000 (UTC) Received: from smtp.gentoo.org (mail.gentoo.org [IPv6:2001:470:ea4a:1:5054:ff:fec7:86e4]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 69A571FC112 for ; Sun, 10 Sep 2017 14:03:59 +0000 (UTC) Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 4D58C341801 for ; Sun, 10 Sep 2017 14:03:57 +0000 (UTC) Received: from localhost.localdomain (localhost [IPv6:::1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id 4E885907F for ; Sun, 10 Sep 2017 14:03:54 +0000 (UTC) From: "Jason Zaman" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Jason Zaman" Message-ID: <1505049044.d9d2a067d727b222feb528d67103b4aec0e3c77a.perfinion@gentoo> Subject: [gentoo-commits] proj/hardened-refpolicy:next commit in: policy/modules/system/ X-VCS-Repository: proj/hardened-refpolicy X-VCS-Files: policy/modules/system/selinuxutil.te policy/modules/system/userdomain.if X-VCS-Directories: policy/modules/system/ X-VCS-Committer: perfinion X-VCS-Committer-Name: Jason Zaman X-VCS-Revision: d9d2a067d727b222feb528d67103b4aec0e3c77a X-VCS-Branch: next Date: Sun, 10 Sep 2017 14:03:54 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: 212ec362-a708-4582-95b4-43297fd5044a X-Archives-Hash: 610cdaf5f871350523c540ce9c6f503a commit: d9d2a067d727b222feb528d67103b4aec0e3c77a Author: Jason Zaman perfinion com> AuthorDate: Sun Sep 10 13:09:48 2017 +0000 Commit: Jason Zaman gentoo org> CommitDate: Sun Sep 10 13:10:44 2017 +0000 URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=d9d2a067 selinuxutil: allow semanage map perms policy/modules/system/selinuxutil.te | 4 +++- policy/modules/system/userdomain.if | 18 ++++++++++++++++++ 2 files changed, 21 insertions(+), 1 deletion(-) diff --git a/policy/modules/system/selinuxutil.te b/policy/modules/system/selinuxutil.te index 0629d437..35ba57c2 100644 --- a/policy/modules/system/selinuxutil.te +++ b/policy/modules/system/selinuxutil.te @@ -489,7 +489,7 @@ allow semanage_t policy_src_t:dir search; filetrans_pattern(semanage_t, selinux_config_t, semanage_store_t, dir, "modules") allow semanage_t semanage_tmp_t:dir manage_dir_perms; -allow semanage_t semanage_tmp_t:file { manage_file_perms mmap_file_perms }; +allow semanage_t semanage_tmp_t:file { manage_file_perms mmap_file_perms map }; files_tmp_filetrans(semanage_t, semanage_tmp_t, { file dir }) kernel_read_system_state(semanage_t) @@ -540,7 +540,9 @@ seutil_manage_default_contexts(semanage_t) # Handle pp files created in homedir and /tmp userdom_read_user_home_content_files(semanage_t) +userdom_mmap_user_home_content_files(semanage_t) userdom_read_user_tmp_files(semanage_t) +userdom_mmap_user_tmp_files(semanage_t) ifdef(`distro_debian',` files_read_var_lib_files(semanage_t) diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if index 16789a3c..88fdb823 100644 --- a/policy/modules/system/userdomain.if +++ b/policy/modules/system/userdomain.if @@ -2565,6 +2565,24 @@ interface(`userdom_read_user_tmp_files',` ######################################## ## +## Mmap user temporary files. +## +## +## +## Domain allowed access. +## +## +# +interface(`userdom_mmap_user_tmp_files',` + gen_require(` + type user_tmp_t; + ') + + allow $1 user_tmp_t:file map; +') + +######################################## +## ## Do not audit attempts to read users ## temporary files. ##