commit: 7347bc35902aadb392283f6cca3449564162a4ba
Author: Russell Coker <russell <AT> coker <DOT> com <DOT> au>
AuthorDate: Wed Jun 18 14:39:42 2025 +0000
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Tue Jul 15 07:52:23 2025 +0000
URL:
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=7347bc35
device (#939)
* device related patches
Signed-off-by: Russell Coker <russell <AT> coker.com.au>
Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org>
policy/modules/services/devicekit.te | 7 ++++++-
policy/modules/system/mount.if | 18 ++++++++++++++++++
policy/modules/system/udev.te | 1 +
3 files changed, 25 insertions(+), 1 deletion(-)
diff --git a/policy/modules/services/devicekit.te
b/policy/modules/services/devicekit.te
index 1c86230c5..abc2b0b86 100644
--- a/policy/modules/services/devicekit.te
+++ b/policy/modules/services/devicekit.te
@@ -102,6 +102,7 @@ dev_getattr_mtrr_dev(devicekit_disk_t)
dev_getattr_usbfs_dirs(devicekit_disk_t)
dev_read_rand(devicekit_disk_t)
dev_read_urand(devicekit_disk_t)
+dev_rw_lvm_control(devicekit_disk_t)
dev_rw_sysfs(devicekit_disk_t)
domain_getattr_all_pipes(devicekit_disk_t)
@@ -116,6 +117,7 @@ files_getattr_all_files(devicekit_disk_t)
files_getattr_all_pipes(devicekit_disk_t)
files_manage_boot_dirs(devicekit_disk_t)
files_manage_mnt_dirs(devicekit_disk_t)
+files_mounton_mnt(devicekit_disk_t)
files_read_etc_runtime_files(devicekit_disk_t)
files_read_usr_files(devicekit_disk_t)
files_watch_etc_dirs(devicekit_disk_t)
@@ -131,6 +133,9 @@ mls_file_read_all_levels(devicekit_disk_t)
mls_file_write_to_clearance(devicekit_disk_t)
mount_rw_runtime_files(devicekit_disk_t)
+mount_watch_runtime_dirs(devicekit_disk_t)
+mount_watch_runtime_files(devicekit_disk_t)
+mount_watch_runtime_files_reads(devicekit_disk_t)
storage_raw_read_fixed_disk(devicekit_disk_t)
storage_raw_write_fixed_disk(devicekit_disk_t)
@@ -204,7 +209,7 @@ optional_policy(`
allow devicekit_power_t self:capability { dac_override net_admin sys_admin
sys_nice sys_ptrace sys_tty_config };
allow devicekit_power_t self:capability2 wake_alarm;
-allow devicekit_power_t self:process { getsched signal_perms };
+allow devicekit_power_t self:process { getsched setsched signal_perms };
allow devicekit_power_t self:fifo_file rw_fifo_file_perms;
allow devicekit_power_t self:unix_dgram_socket create_socket_perms;
allow devicekit_power_t self:unix_stream_socket create_socket_perms;
diff --git a/policy/modules/system/mount.if b/policy/modules/system/mount.if
index d425a5d76..4a084d56c 100644
--- a/policy/modules/system/mount.if
+++ b/policy/modules/system/mount.if
@@ -273,6 +273,24 @@ interface(`mount_watch_reads_runtime_files',`
allow $1 mount_runtime_t:file watch_reads;
')
+########################################
+## <summary>
+## Watch mount runtime files reads.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`mount_watch_runtime_files_reads',`
+ gen_require(`
+ type mount_runtime_t;
+ ')
+
+ allow $1 mount_runtime_t:file watch_reads;
+')
+
########################################
## <summary>
## Getattr on mount_runtime_t files
diff --git a/policy/modules/system/udev.te b/policy/modules/system/udev.te
index bf6b8b53e..3e956d6e8 100644
--- a/policy/modules/system/udev.te
+++ b/policy/modules/system/udev.te
@@ -109,6 +109,7 @@ kernel_read_fs_sysctls(udev_t)
#https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=235182
kernel_rw_net_sysctls(udev_t)
kernel_read_network_state(udev_t)
+kernel_read_psi(udev_t)
kernel_read_software_raid_state(udev_t)
kernel_dontaudit_search_unlabeled(udev_t)
