[gentoo-commits] proj/hardened-refpolicy:master commit in: /, policy/modules/kernel/

[gentoo-commits] proj/hardened-refpolicy:master commit in: /, policy/modules/kernel/

[Jason Zaman]

commit:     d3bc1b5412b7ca0c45c93fbe9226fac2f94bd7a6
Author:     Benstone Zhang <benstonezhang <AT> gmail <DOT> com>
AuthorDate: Wed May 28 07:00:28 2025 +0000
Commit:     Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Tue Jul 15 07:52:23 2025 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=d3bc1b54

filesystem: support bcachefs

Signed-off-by: Benstone Zhang <benstonezhang <AT> gmail.com>
Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org>

 Makefile                            | 4 ++--
 policy/modules/kernel/devices.fc    | 1 +
 policy/modules/kernel/filesystem.te | 1 +
 3 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/Makefile b/Makefile
index 9b979afd5..a482afe29 100644
--- a/Makefile
+++ b/Makefile
@@ -368,8 +368,8 @@ ifneq "$(filter xserver.te,$(base_mods) $(mod_mods))" ""
 endif
 
 # filesystems to be used in labeling targets
-filesystems = $(shell mount | grep -v "context=" | $(GREP) -v '\((|.*,)bind(,.*|)\)' | $(AWK) '/(ext[234]|btrfs| xfs| jfs).*rw/{print $$3}';)
-fs_names := "btrfs ext2 ext3 ext4 xfs jfs"
+filesystems = $(shell mount | grep -v "context=" | $(GREP) -v '\((|.*,)bind(,.*|)\)' | $(AWK) '/(ext[234]|bcachefs|btrfs| xfs| jfs).*rw/{print $$3}';)
+fs_names := "bcachefs btrfs ext2 ext3 ext4 xfs jfs"
 
 ########################################
 #

diff --git a/policy/modules/kernel/devices.fc b/policy/modules/kernel/devices.fc
index d476a293c..ab33cde0a 100644
--- a/policy/modules/kernel/devices.fc
+++ b/policy/modules/kernel/devices.fc
@@ -16,6 +16,7 @@
 /dev/audio.*		-c	gen_context(system_u:object_r:sound_device_t,s0)
 /dev/autofs.*		-c	gen_context(system_u:object_r:autofs_device_t,s0)
 /dev/beep		-c	gen_context(system_u:object_r:sound_device_t,s0)
+/dev/bcachefs[0-9]*-ctl	-c	gen_context(system_u:object_r:lvm_control_t,s0)
 /dev/btrfs-control	-c	gen_context(system_u:object_r:lvm_control_t,s0)
 /dev/cachefiles		-c	gen_context(system_u:object_r:cachefiles_device_t,s0)
 /dev/cec.*		-c	gen_context(system_u:object_r:v4l_device_t,s0)

diff --git a/policy/modules/kernel/filesystem.te b/policy/modules/kernel/filesystem.te
index f88203ca7..2fcbd3d95 100644
--- a/policy/modules/kernel/filesystem.te
+++ b/policy/modules/kernel/filesystem.te
@@ -23,6 +23,7 @@ sid fs gen_context(system_u:object_r:fs_t,s0)
 
 # Use xattrs for the following filesystem types.
 # Requires that a security xattr handler exist for the filesystem.
+fs_use_xattr bcachefs gen_context(system_u:object_r:fs_t,s0);
 fs_use_xattr btrfs gen_context(system_u:object_r:fs_t,s0);
 fs_use_xattr ceph gen_context(system_u:object_r:fs_t,s0);
 fs_use_xattr encfs gen_context(system_u:object_r:fs_t,s0);