From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) by finch.gentoo.org (Postfix) with ESMTP id CBEAA138CA3 for ; Wed, 4 Mar 2015 17:03:10 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id C052DE08DC; Wed, 4 Mar 2015 17:03:09 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 53EAFE08DC for ; Wed, 4 Mar 2015 17:03:09 +0000 (UTC) Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 51B003407D0 for ; Wed, 4 Mar 2015 17:03:08 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id 889B11308E for ; Wed, 4 Mar 2015 17:03:04 +0000 (UTC) From: "Sven Vermeulen" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Sven Vermeulen" Message-ID: <1425482184.a935b290f5ecc5e507a8a8c1d0e365ddc3e239f3.swift@gentoo> Subject: [gentoo-commits] proj/hardened-refpolicy:next commit in: policy/modules/kernel/ X-VCS-Repository: proj/hardened-refpolicy X-VCS-Files: policy/modules/kernel/kernel.te X-VCS-Directories: policy/modules/kernel/ X-VCS-Committer: swift X-VCS-Committer-Name: Sven Vermeulen X-VCS-Revision: a935b290f5ecc5e507a8a8c1d0e365ddc3e239f3 X-VCS-Branch: next Date: Wed, 4 Mar 2015 17:03:04 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: 7a5dae2e-dd98-4aca-8147-320ddeb93580 X-Archives-Hash: b4f1f4110a339ceb1280c5a40fdbc42b Message-ID: <20150304170304.zxmRspycXS6O_E9kCmjKDktEtyiFk3U_utCdy1BuPpg@z> commit: a935b290f5ecc5e507a8a8c1d0e365ddc3e239f3 Author: Sven Vermeulen siphos be> AuthorDate: Wed Mar 4 15:16:24 2015 +0000 Commit: Sven Vermeulen gentoo org> CommitDate: Wed Mar 4 15:16:24 2015 +0000 URL: http://sources.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=a935b290 Allow kdevtmpfs to manage /dev The kdevtmpfs thread (running as kernel_t) is showing behavior regarding access and management of /dev. Of course, that is its main purpose (see the Linux kernel source code at drivers/base/devtmpfs.c). In bug #535992 is an example denial given: Jan 8 01:37:29 testbed kernel: [28549.831785] audit: type=1400 audit(1420702649.386:1263): avc: denied { setattr } for pid=47 comm="kdevtmpfs" name="dm-6" dev="devtmpfs" ino=10993394 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 During the LVM2 related testing something similar comes up: time->Wed Mar 4 15:43:29 2015 type=AVC msg=audit(1425480209.997:137): avc: denied { getattr } for pid=16 comm="kdevtmpfs" path="/dm-3" dev="devtmpfs" ino=11400 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file permissive=0 Although there is no error message available, given the function of kdevtmpfs and the "trusted" domain that kernel_t is, we grant it full manage rights on the device_node and device_t resources. X-Gentoo-Bug: 535992 X-Gentoo-Bug-URL: https://bugs.gentoo.org/show_bug.cgi?id=535992 policy/modules/kernel/kernel.te | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te index 2639a5a..a48cf63 100644 --- a/policy/modules/kernel/kernel.te +++ b/policy/modules/kernel/kernel.te @@ -437,5 +437,7 @@ ifdef(`distro_gentoo',` # allow kernel_t unlabeled_t:dir search_dir_perms; - dev_setattr_generic_chr_files(kernel_t) + # To support kdevtmpfs properly (its purpose is to manage the /dev tmpfs so grant it these rights) + # See also bug 535992 + dev_manage_all_dev_nodes(kernel_t) ')