diff options
| author |   Yi Zhao <yi.zhao@windriver.com> | 2024-08-30 11:46:34 +0800 |
|---|---|---|
| committer |   Jason Zaman <perfinion@gentoo.org> | 2024-09-21 15:28:29 -0700 |
| commit | c0cd142f78e3bf2ed7a83595f3bbee985b00234a (patch) | |
| tree | 3cc2a6e399f8732518fbef76bdf295c86944ee37 | |
| parent | systemd: add policy for systemd-nsresourced (diff) | |
| download | hardened-refpolicy-c0cd142f78e3bf2ed7a83595f3bbee985b00234a.tar.gz hardened-refpolicy-c0cd142f78e3bf2ed7a83595f3bbee985b00234a.tar.bz2 hardened-refpolicy-c0cd142f78e3bf2ed7a83595f3bbee985b00234a.zip | |
devices: add label vsock_device_t for /dev/vsock
Vsock is a Linux socket family designed to allow communication between a
VM and its hypervisor. Add a new label vsock_device_t for vsock device.
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Jason Zaman <perfinion@gentoo.org>
| -rw-r--r-- | policy/modules/kernel/devices.fc | 1 | ||||
| -rw-r--r-- | policy/modules/kernel/devices.if | 54 | ||||
| -rw-r--r-- | policy/modules/kernel/devices.te | 6 |
3 files changed, 61 insertions, 0 deletions
diff --git a/policy/modules/kernel/devices.fc b/policy/modules/kernel/devices.fc index fb301030..5d7d2a4c 100644 --- a/policy/modules/kernel/devices.fc +++ b/policy/modules/kernel/devices.fc @@ -134,6 +134,7 @@ ifdef(`distro_suse', ` ') /dev/vbi.* -c gen_context(system_u:object_r:v4l_device_t,s0) /dev/vbox.* -c gen_context(system_u:object_r:xserver_misc_device_t,s0) +/dev/vsock -c gen_context(system_u:object_r:vsock_device_t,s0) /dev/vfio/.+ -c gen_context(system_u:object_r:vfio_device_t,s0) /dev/vga_arbiter -c gen_context(system_u:object_r:xserver_misc_device_t,s0) /dev/vhci -c gen_context(system_u:object_r:vhost_device_t,s0) diff --git a/policy/modules/kernel/devices.if b/policy/modules/kernel/devices.if index aabc1b8e..930f164e 100644 --- a/policy/modules/kernel/devices.if +++ b/policy/modules/kernel/devices.if @@ -5558,6 +5558,60 @@ interface(`dev_rwx_vmware',` ######################################## ## <summary> +## Read the vsock device. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`dev_read_vsock',` + gen_require(` + type device_t, vsock_device_t; + ') + + read_chr_files_pattern($1, device_t, vsock_device_t) +') + +######################################## +## <summary> +## Write the vsock device. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`dev_write_vsock',` + gen_require(` + type device_t, vsock_device_t; + ') + + write_chr_files_pattern($1, device_t, vsock_device_t) +') + +######################################## +## <summary> +## Read and write the vsock device. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`dev_rw_vsock',` + gen_require(` + type device_t, vsock_device_t; + ') + + rw_chr_files_pattern($1, device_t, vsock_device_t) +') + +######################################## +## <summary> ## Read from watchdog devices. ## </summary> ## <param name="domain"> diff --git a/policy/modules/kernel/devices.te b/policy/modules/kernel/devices.te index c06a77ad..255a30b0 100644 --- a/policy/modules/kernel/devices.te +++ b/policy/modules/kernel/devices.te @@ -402,6 +402,12 @@ dev_node(vhost_device_t) type vmware_device_t; dev_node(vmware_device_t) +# +# vsock_device_t is the type for /dev/vsock +# +type vsock_device_t; +dev_node(vsock_device_t) + type watchdog_device_t; dev_node(watchdog_device_t) |