commit: a979dd138209b265b8458e2ef901a61262570518
Author: Jason Zaman <jason <AT> perfinion <DOT> com>
AuthorDate: Wed Aug 26 06:02:55 2015 +0000
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Wed Aug 26 06:02:55 2015 +0000
URL:
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=a979dd13
introduce fs_cgroup_filetrans() interface
policy/modules/kernel/filesystem.if | 37 +++++++++++++++++++++++++++++++++++++
1 file changed, 37 insertions(+)
diff --git a/policy/modules/kernel/filesystem.if
b/policy/modules/kernel/filesystem.if
index b6b7063..4ddef7c 100644
--- a/policy/modules/kernel/filesystem.if
+++ b/policy/modules/kernel/filesystem.if
@@ -4988,3 +4988,40 @@ interface(`fs_unconfined',`
typeattribute $1 filesystem_unconfined_type;
')
+
+# gentoo specific under here but not allowed ifdef
+
+########################################
+## <summary>
+## Create an object in a cgroup tmpfs filesystem, with a private
+## type using a type transition.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+## <param name="private type">
+## <summary>
+## The type of the object to be created.
+## </summary>
+## </param>
+## <param name="object">
+## <summary>
+## The object class of the object being created.
+## </summary>
+## </param>
+## <param name="name" optional="true">
+## <summary>
+## The name of the object being created.
+## </summary>
+## </param>
+#
+interface(`fs_cgroup_filetrans',`
+ gen_require(`
+ type cgroup_t;
+ ')
+
+ allow $2 tmpfs_t:filesystem associate;
+ filetrans_pattern($1, cgroup_t, $2, $3, $4)
+')
