[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/system/, policy/modules/services/

["Jason Zaman" <perfinion@gentoo.org>]

commit:     79b0ec7e2d66dadd3570e99801632ac32cfe0147
Author:     Kenton Groombridge <me <AT> concord <DOT> sh>
AuthorDate: Sat Dec  4 18:43:43 2021 +0000
Commit:     Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Sun Jan 30 01:12:42 2022 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=79b0ec7e

container, iptables: dontaudit iptables rw on /ptmx

Signed-off-by: Kenton Groombridge <me <AT> concord.sh>
Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org>

 policy/modules/services/container.if | 19 +++++++++++++++++++
 policy/modules/system/iptables.te    |  5 +++++
 2 files changed, 24 insertions(+)

diff --git a/policy/modules/services/container.if b/policy/modules/services/container.if
index d7ad3e84..92b5a2f7 100644
--- a/policy/modules/services/container.if
+++ b/policy/modules/services/container.if
@@ -611,6 +611,25 @@ interface(`container_manage_sock_files',`
 	manage_sock_files_pattern($1, container_file_t, container_file_t)
 ')
 
+########################################
+## <summary>
+##	Do not audit attempts to read
+##	and write container chr files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`container_dontaudit_rw_chr_files',`
+	gen_require(`
+		type container_file_t;
+	')
+
+	dontaudit $1 container_file_t:chr_file rw_chr_file_perms;
+')
+
 ########################################
 ## <summary>
 ##	Allow the specified domain to

diff --git a/policy/modules/system/iptables.te b/policy/modules/system/iptables.te
index f61b8af1..39ce924d 100644
--- a/policy/modules/system/iptables.te
+++ b/policy/modules/system/iptables.te
@@ -105,6 +105,11 @@ ifdef(`hide_broken_symptoms',`
 	dev_dontaudit_write_mtrr(iptables_t)
 ')
 
+optional_policy(`
+	# iptables may try to rw /ptmx in a container
+	container_dontaudit_rw_chr_files(iptables_t)
+')
+
 optional_policy(`
 	fail2ban_append_log(iptables_t)
 ')