diff options
Diffstat (limited to 'policy/modules')
| -rw-r--r-- | policy/modules/kernel/devices.fc | 1 | ||||
| -rw-r--r-- | policy/modules/kernel/devices.if | 54 | ||||
| -rw-r--r-- | policy/modules/kernel/devices.te | 6 |
3 files changed, 61 insertions, 0 deletions
diff --git a/policy/modules/kernel/devices.fc b/policy/modules/kernel/devices.fc index fb301030..5d7d2a4c 100644 --- a/policy/modules/kernel/devices.fc +++ b/policy/modules/kernel/devices.fc @@ -134,6 +134,7 @@ ifdef(`distro_suse', ` ') /dev/vbi.* -c gen_context(system_u:object_r:v4l_device_t,s0) /dev/vbox.* -c gen_context(system_u:object_r:xserver_misc_device_t,s0) +/dev/vsock -c gen_context(system_u:object_r:vsock_device_t,s0) /dev/vfio/.+ -c gen_context(system_u:object_r:vfio_device_t,s0) /dev/vga_arbiter -c gen_context(system_u:object_r:xserver_misc_device_t,s0) /dev/vhci -c gen_context(system_u:object_r:vhost_device_t,s0) diff --git a/policy/modules/kernel/devices.if b/policy/modules/kernel/devices.if index aabc1b8e..930f164e 100644 --- a/policy/modules/kernel/devices.if +++ b/policy/modules/kernel/devices.if @@ -5558,6 +5558,60 @@ interface(`dev_rwx_vmware',` ######################################## ## <summary> +## Read the vsock device. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`dev_read_vsock',` + gen_require(` + type device_t, vsock_device_t; + ') + + read_chr_files_pattern($1, device_t, vsock_device_t) +') + +######################################## +## <summary> +## Write the vsock device. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`dev_write_vsock',` + gen_require(` + type device_t, vsock_device_t; + ') + + write_chr_files_pattern($1, device_t, vsock_device_t) +') + +######################################## +## <summary> +## Read and write the vsock device. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`dev_rw_vsock',` + gen_require(` + type device_t, vsock_device_t; + ') + + rw_chr_files_pattern($1, device_t, vsock_device_t) +') + +######################################## +## <summary> ## Read from watchdog devices. ## </summary> ## <param name="domain"> diff --git a/policy/modules/kernel/devices.te b/policy/modules/kernel/devices.te index c06a77ad..255a30b0 100644 --- a/policy/modules/kernel/devices.te +++ b/policy/modules/kernel/devices.te @@ -402,6 +402,12 @@ dev_node(vhost_device_t) type vmware_device_t; dev_node(vmware_device_t) +# +# vsock_device_t is the type for /dev/vsock +# +type vsock_device_t; +dev_node(vsock_device_t) + type watchdog_device_t; dev_node(watchdog_device_t) |