mirrors/passt
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

selinux: Define interfaces for libvirt and similar frameworks

Browse source 
Services running passt will commonly need to transition to its
domain, terminate it, connect and write to its socket.

The init_daemon_domain() macro now defines the default transition to
the passt_t domain, using the passt_exec_t type.

Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
This commit is contained in:
Stefano Brivio 2023-02-21 18:00:13 +00:00
parent 9136f74015
commit 4902447630
2 changed files with 27 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

26
contrib/selinux/passt.if
View file

@ -15,3 +15,29 @@ interface(`passt_read_data',`
allow $1 passt_t:dir { search add_name };
allow $1 passt_t:file { open read getattr };
')
interface(`passt_domtrans',`
gen_require(`
type passt_t, passt_exec_t;
')
corecmd_search_bin($1)
domtrans_pattern($1, passt_exec_t, passt_t)
')
interface(`passt_socket',`
gen_require(`
type passt_t;
')
allow $1 user_tmp_t:sock_file write;
allow $1 passt_t:unix_stream_socket connectto;
')
interface(`passt_kill',`
gen_require(`
type passt_t;
')
allow $1 passt_t:process { signal sigkill };
')

1
contrib/selinux/passt.te
View file

@ -56,6 +56,7 @@ type passt_t;
domain_type(passt_t);
type passt_exec_t;
files_type(passt_exec_t);
init_daemon_domain(passt_t, passt_exec_t)
type passt_log_t;
logging_log_file(passt_log_t);
type passt_pid_t;