[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/kernel/

[Jason Zaman]

commit:     2d3434d450e59823792bf8071e07cacf5c9e9fd4
Author:     Nicolas Iooss <nicolas.iooss <AT> m4x <DOT> org>
AuthorDate: Tue Dec 27 13:56:26 2016 +0000
Commit:     Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Sun Jan  1 16:26:28 2017 +0000
URL:        
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=2d3434d4

Allow searching /proc/sys/fs when using /proc/sys/fs/binfmt_misc

Interface fs_register_binary_executable_type allow registering
interpreters using a filesystem monted on /proc/sys/fs/binfmt_misc. In
order to access this filesystem, the process needs to search every
parent directory of the mountpoint.

Signed-off-by: Nicolas Iooss <nicolas.iooss <AT> m4x.org>

 policy/modules/kernel/filesystem.if |  2 ++
 policy/modules/kernel/kernel.if     | 19 +++++++++++++++++++
 2 files changed, 21 insertions(+)

diff --git a/policy/modules/kernel/filesystem.if 
b/policy/modules/kernel/filesystem.if
index 9471dbe..c85d805 100644
--- a/policy/modules/kernel/filesystem.if
+++ b/policy/modules/kernel/filesystem.if
@@ -612,6 +612,8 @@ interface(`fs_register_binary_executable_type',`
                type binfmt_misc_fs_t;
        ')
 
+       # binfmt_misc filesystem is usually mounted on /proc/sys/fs/binfmt_misc
+       kernel_search_fs_sysctls($1)
        rw_files_pattern($1, binfmt_misc_fs_t, binfmt_misc_fs_t)
 ')
 

diff --git a/policy/modules/kernel/kernel.if b/policy/modules/kernel/kernel.if
index 29709df..2c7ad0c 100644
--- a/policy/modules/kernel/kernel.if
+++ b/policy/modules/kernel/kernel.if
@@ -2005,6 +2005,25 @@ interface(`kernel_rw_kernel_sysctl',`
 
 ########################################
 ## <summary>
+##     Search filesystem sysctl directories.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+## <rolecap/>
+#
+interface(`kernel_search_fs_sysctls',`
+       gen_require(`
+               type proc_t, sysctl_t, sysctl_fs_t;
+       ')
+
+       search_dirs_pattern($1, { proc_t sysctl_t sysctl_fs_t }, sysctl_fs_t)
+')
+
+########################################
+## <summary>
 ##     Read filesystem sysctls.
 ## </summary>
 ## <param name="domain">