commit: a935b290f5ecc5e507a8a8c1d0e365ddc3e239f3
Author: Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Wed Mar 4 15:16:24 2015 +0000
Commit: Sven Vermeulen <swift <AT> gentoo <DOT> org>
CommitDate: Wed Mar 4 15:16:24 2015 +0000
URL:
http://sources.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=a935b290
Allow kdevtmpfs to manage /dev
The kdevtmpfs thread (running as kernel_t) is showing behavior regarding
access and management of /dev. Of course, that is its main purpose (see
the Linux kernel source code at drivers/base/devtmpfs.c).
In bug #535992 is an example denial given:
Jan 8 01:37:29 testbed kernel: [28549.831785] audit: type=1400
audit(1420702649.386:1263): avc: denied { setattr } for pid=47
comm="kdevtmpfs" name="dm-6" dev="devtmpfs" ino=10993394
scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:device_t
tclass=blk_file permissive=1
During the LVM2 related testing something similar comes up:
time->Wed Mar 4 15:43:29 2015
type=AVC msg=audit(1425480209.997:137): avc: denied { getattr } for
pid=16 comm="kdevtmpfs" path="/dm-3" dev="devtmpfs" ino=11400
scontext=system_u:system_r:kernel_t:s0
tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file
permissive=0
Although there is no error message available, given the function of
kdevtmpfs and the "trusted" domain that kernel_t is, we grant it full
manage rights on the device_node and device_t resources.
X-Gentoo-Bug: 535992
X-Gentoo-Bug-URL: https://bugs.gentoo.org/show_bug.cgi?id=535992
policy/modules/kernel/kernel.te | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te
index 2639a5a..a48cf63 100644
--- a/policy/modules/kernel/kernel.te
+++ b/policy/modules/kernel/kernel.te
@@ -437,5 +437,7 @@ ifdef(`distro_gentoo',`
#
allow kernel_t unlabeled_t:dir search_dir_perms;
- dev_setattr_generic_chr_files(kernel_t)
+ # To support kdevtmpfs properly (its purpose is to manage the /dev
tmpfs so grant it these rights)
+ # See also bug 535992
+ dev_manage_all_dev_nodes(kernel_t)
')
