commit: 50e4d66472c4432731e166db3378006203f711e2
Author: Jason Zaman <jason <AT> perfinion <DOT> com>
AuthorDate: Wed Aug 26 06:19:58 2015 +0000
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Thu Aug 27 15:44:32 2015 +0000
URL:
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=50e4d664
Add policy for cgmanager
policy/modules/contrib/cgmanager.fc | 3 ++
policy/modules/contrib/cgmanager.if | 23 +++++++++++++
policy/modules/contrib/cgmanager.te | 66 +++++++++++++++++++++++++++++++++++++
3 files changed, 92 insertions(+)
diff --git a/policy/modules/contrib/cgmanager.fc
b/policy/modules/contrib/cgmanager.fc
new file mode 100644
index 0000000..8ea4a46
--- /dev/null
+++ b/policy/modules/contrib/cgmanager.fc
@@ -0,0 +1,3 @@
+/usr/sbin/cgmanager --
gen_context(system_u:object_r:cgmanager_exec_t,s0)
+/usr/sbin/cgproxy --
gen_context(system_u:object_r:cgmanager_exec_t,s0)
+/usr/sbin/cgm-release-agent --
gen_context(system_u:object_r:cgmanager_exec_t,s0)
diff --git a/policy/modules/contrib/cgmanager.if
b/policy/modules/contrib/cgmanager.if
new file mode 100644
index 0000000..ecadabd
--- /dev/null
+++ b/policy/modules/contrib/cgmanager.if
@@ -0,0 +1,23 @@
+## <summary>Control Group manager daemon.</summary>
+
+########################################
+## <summary>
+## Mark the domain as a cgmanager
+## client, and grant the stream
+## connect privs.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`cgmanager_stream_connect',`
+ gen_require(`
+ type cgmanager_t, cgmanager_cgroup_t;
+ ')
+
+ fs_search_cgroup_dirs($1)
+ list_dirs_pattern($1, cgmanager_cgroup_t, cgmanager_cgroup_t)
+ stream_connect_pattern($1, cgmanager_cgroup_t, cgmanager_cgroup_t,
cgmanager_t)
+')
diff --git a/policy/modules/contrib/cgmanager.te
b/policy/modules/contrib/cgmanager.te
new file mode 100644
index 0000000..5c32295
--- /dev/null
+++ b/policy/modules/contrib/cgmanager.te
@@ -0,0 +1,66 @@
+policy_module(cgmanager, 1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type cgmanager_t;
+type cgmanager_exec_t;
+init_daemon_domain(cgmanager_t, cgmanager_exec_t)
+
+type cgmanager_run_t;
+files_pid_file(cgmanager_run_t)
+
+type cgmanager_cgroup_t;
+files_type(cgmanager_cgroup_t)
+
+########################################
+#
+# CGManager local policy
+#
+
+allow cgmanager_t self:capability { sys_admin dac_override };
+allow cgmanager_t self:fifo_file rw_fifo_file_perms;
+
+manage_dirs_pattern(cgmanager_t, cgmanager_run_t, cgmanager_run_t)
+manage_files_pattern(cgmanager_t, cgmanager_run_t, cgmanager_run_t)
+manage_lnk_files_pattern(cgmanager_t, cgmanager_run_t, cgmanager_run_t)
+files_pid_filetrans(cgmanager_t, cgmanager_run_t, { file dir })
+allow cgmanager_t cgmanager_run_t:dir mounton;
+
+manage_dirs_pattern(cgmanager_t, cgmanager_cgroup_t, cgmanager_cgroup_t)
+manage_files_pattern(cgmanager_t, cgmanager_cgroup_t, cgmanager_cgroup_t)
+manage_sock_files_pattern(cgmanager_t, cgmanager_cgroup_t, cgmanager_cgroup_t)
+fs_cgroup_filetrans(cgmanager_t, cgmanager_cgroup_t, dir, "cgmanager")
+
+kernel_domtrans_to(cgmanager_t, cgmanager_exec_t)
+kernel_read_system_state(cgmanager_t)
+
+corecmd_exec_bin(cgmanager_t)
+can_exec(cgmanager_t, cgmanager_exec_t)
+
+domain_read_all_domains_state(cgmanager_t)
+
+files_read_etc_files(cgmanager_t)
+
+# cgmanager unmounts everything in its own mount namespace and mounts tmpfs on
some things
+files_mounton_all_mountpoints(cgmanager_t)
+files_unmount_all_file_type_fs(cgmanager_t)
+fs_unmount_xattr_fs(cgmanager_t)
+
+fs_manage_cgroup_dirs(cgmanager_t)
+fs_manage_cgroup_files(cgmanager_t)
+
+fs_getattr_tmpfs(cgmanager_t)
+
+fs_manage_tmpfs_dirs(cgmanager_t)
+fs_manage_tmpfs_files(cgmanager_t)
+
+fs_mount_cgroup(cgmanager_t)
+fs_mount_tmpfs(cgmanager_t)
+fs_mounton_tmpfs(cgmanager_t)
+fs_remount_cgroup(cgmanager_t)
+fs_remount_tmpfs(cgmanager_t)
+fs_unmount_cgroup(cgmanager_t)
+fs_unmount_tmpfs(cgmanager_t)
