mirrors/passt
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

selinux: Switch to a more reasonable model for PID and socket files

Browse source 
Instead of restricting PID files to /var/run/passt.pid, which is a
single file and unlikely to be used, use the user_tmp_t type which
should cover any reasonable need.

Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
This commit is contained in:
Stefano Brivio 2023-02-21 18:03:49 +00:00
parent 4902447630
commit 01801b131f
2 changed files with 7 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
contrib/selinux/passt.fc
View file

@ -10,4 +10,3 @@
/usr/bin/passt(\.*)? system_u:object_r:passt_exec_t:s0
/tmp/passt\.pcap system_u:object_r:passt_log_t:s0
/var/run/passt\.pid system_u:object_r:passt_pid_t:s0

11
contrib/selinux/passt.te
View file

@ -19,6 +19,7 @@ require {
type user_home_dir_t;
type fs_t;
type tmp_t;
type user_tmp_t;
type tmpfs_t;
type root_t;
@ -59,8 +60,6 @@ files_type(passt_exec_t);
init_daemon_domain(passt_t, passt_exec_t)
type passt_log_t;
logging_log_file(passt_log_t);
type passt_pid_t;
files_pid_file(passt_pid_t);
type passt_etc_t;
files_config_file(passt_etc_t);
@ -83,8 +82,8 @@ allow passt_t tmp_t:dir { add_name mounton remove_name write };
allow passt_t tmpfs_t:filesystem mount;
allow passt_t fs_t:filesystem unmount;
manage_files_pattern(passt_t, passt_pid_t, passt_pid_t)
files_pid_filetrans(passt_t, passt_pid_t, file)
manage_files_pattern(passt_t, user_tmp_t, user_tmp_t)
files_pid_filetrans(passt_t, user_tmp_t, file)
allow passt_t console_device_t:chr_file { open write getattr ioctl };
allow passt_t user_devpts_t:chr_file { getattr read write ioctl };
@ -110,3 +109,7 @@ corenet_udp_bind_generic_node(passt_t)
allow passt_t passt_port_t:udp_socket { name_bind };
allow passt_t node_t:icmp_socket { name_bind node_bind };
allow passt_t self:icmp_socket { bind create setopt read write };
allow passt_t user_tmp_t:dir { add_name write };
allow passt_t user_tmp_t:file { create open };
allow passt_t user_tmp_t:sock_file { create read write unlink };