commit: 9ae80e8d3f13c18043f4e8306a4991824acec91a
Author: Jason Zaman <jason <AT> perfinion <DOT> com>
AuthorDate: Wed Aug 26 06:19:58 2015 +0000
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Wed Aug 26 06:36:59 2015 +0000
URL:
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=9ae80e8d
Add policy for cgmanager
policy/modules/contrib/cgmanager.fc | 3 ++
policy/modules/contrib/cgmanager.if | 21 ++++++++++
policy/modules/contrib/cgmanager.te | 76 +++++++++++++++++++++++++++++++++++++
3 files changed, 100 insertions(+)
diff --git a/policy/modules/contrib/cgmanager.fc
b/policy/modules/contrib/cgmanager.fc
new file mode 100644
index 0000000..8ea4a46
--- /dev/null
+++ b/policy/modules/contrib/cgmanager.fc
@@ -0,0 +1,3 @@
+/usr/sbin/cgmanager --
gen_context(system_u:object_r:cgmanager_exec_t,s0)
+/usr/sbin/cgproxy --
gen_context(system_u:object_r:cgmanager_exec_t,s0)
+/usr/sbin/cgm-release-agent --
gen_context(system_u:object_r:cgmanager_exec_t,s0)
diff --git a/policy/modules/contrib/cgmanager.if
b/policy/modules/contrib/cgmanager.if
new file mode 100644
index 0000000..ef04583
--- /dev/null
+++ b/policy/modules/contrib/cgmanager.if
@@ -0,0 +1,21 @@
+## <summary>Control Group manager daemon.</summary>
+
+########################################
+## <summary>
+## Mark the domain as a cgmanager client, automatically granting
+## the necessary privileges (connect to cgmanager and allow
+## cgmanager to inspect the process).
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`cgmanager_client_domain',`
+ gen_require(`
+ attribute cgmanager_client;
+ ')
+
+ typeattribute $1 cgmanager_client;
+')
diff --git a/policy/modules/contrib/cgmanager.te
b/policy/modules/contrib/cgmanager.te
new file mode 100644
index 0000000..d79f506
--- /dev/null
+++ b/policy/modules/contrib/cgmanager.te
@@ -0,0 +1,76 @@
+policy_module(cgmanager, 1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type cgmanager_t;
+type cgmanager_exec_t;
+init_daemon_domain(cgmanager_t, cgmanager_exec_t)
+
+type cgmanager_run_t;
+files_pid_file(cgmanager_run_t)
+
+type cgmanager_cgroup_t;
+files_type(cgmanager_cgroup_t)
+
+attribute cgmanager_client;
+
+########################################
+#
+# CGManager local policy
+#
+
+allow cgmanager_t self:capability { sys_admin dac_override };
+allow cgmanager_t self:fifo_file rw_fifo_file_perms;
+
+manage_dirs_pattern(cgmanager_t, cgmanager_run_t, cgmanager_run_t)
+manage_files_pattern(cgmanager_t, cgmanager_run_t, cgmanager_run_t)
+manage_lnk_files_pattern(cgmanager_t, cgmanager_run_t, cgmanager_run_t)
+files_pid_filetrans(cgmanager_t, cgmanager_run_t, { file dir })
+allow cgmanager_t cgmanager_run_t:dir mounton;
+
+manage_dirs_pattern(cgmanager_t, cgmanager_cgroup_t, cgmanager_cgroup_t)
+manage_files_pattern(cgmanager_t, cgmanager_cgroup_t, cgmanager_cgroup_t)
+manage_sock_files_pattern(cgmanager_t, cgmanager_cgroup_t, cgmanager_cgroup_t)
+fs_cgroup_filetrans(cgmanager_t, cgmanager_cgroup_t, dir, "cgmanager")
+
+kernel_domtrans_to(cgmanager_t, cgmanager_exec_t)
+kernel_read_system_state(cgmanager_t)
+
+corecmd_exec_bin(cgmanager_t)
+can_exec(cgmanager_t, cgmanager_exec_t)
+
+files_read_etc_files(cgmanager_t)
+
+# cgmanager unmounts everything in its own mount namespace and mounts tmpfs on
some things
+files_mounton_all_mountpoints(cgmanager_t)
+files_unmount_all_file_type_fs(cgmanager_t)
+fs_unmount_xattr_fs(cgmanager_t)
+
+fs_manage_cgroup_dirs(cgmanager_t)
+fs_manage_cgroup_files(cgmanager_t)
+
+fs_getattr_tmpfs(cgmanager_t)
+
+fs_manage_tmpfs_dirs(cgmanager_t)
+fs_manage_tmpfs_files(cgmanager_t)
+
+fs_mount_cgroup(cgmanager_t)
+fs_mount_tmpfs(cgmanager_t)
+fs_mounton_tmpfs(cgmanager_t)
+fs_remount_cgroup(cgmanager_t)
+fs_remount_tmpfs(cgmanager_t)
+fs_unmount_cgroup(cgmanager_t)
+fs_unmount_tmpfs(cgmanager_t)
+
+########################################
+#
+# CGManager client domains policy
+#
+
+fs_search_cgroup_dirs(cgmanager_client)
+list_dirs_pattern(cgmanager_client, cgmanager_cgroup_t, cgmanager_cgroup_t)
+stream_connect_pattern(cgmanager_client, cgmanager_cgroup_t,
cgmanager_cgroup_t, cgmanager_t)
+ps_process_pattern(cgmanager_t, cgmanager_client)
