commit: 542af989565d81b90ef54fcb78d259fb7073bfba Author: Nicolas Iooss <nicolas.iooss <AT> m4x <DOT> org> AuthorDate: Sat Apr 15 18:23:34 2017 +0000 Commit: Sven Vermeulen <swift <AT> gentoo <DOT> org> CommitDate: Sun May 7 15:49:16 2017 +0000 URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=542af989
Synchronize file patterns for /usr/bin/mount... and /usr/sbin/mount... mount.fc defines file contexts for /usr/bin/mount.*, /usr/bin/umount.* and /usr/sbin/mount\.zfs. These patterns are not consistent for two reasons: - some distributions use /sbin/mount... for other file systems that zfs. For example Debian uses /sbin/mount.ntfs-3g (https://packages.debian.org/jessie/amd64/ntfs-3g/filelist) - mount_exec_t type should only be applied to mount, umount, mount.$FS and umount.udisks2, not mountpoint. Replace the file patterns with ones that do not match mountpoint and match every mount and umount programs in /usr/bin and /usr/sbin. policy/modules/system/mount.fc | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/policy/modules/system/mount.fc b/policy/modules/system/mount.fc index 39ea6f5c..97e2596b 100644 --- a/policy/modules/system/mount.fc +++ b/policy/modules/system/mount.fc @@ -1,8 +1,9 @@ /usr/bin/fusermount -- gen_context(system_u:object_r:mount_exec_t,s0) -/usr/bin/mount.* -- gen_context(system_u:object_r:mount_exec_t,s0) -/usr/bin/umount.* -- gen_context(system_u:object_r:mount_exec_t,s0) +/usr/bin/mount(\.[^/]+)? -- gen_context(system_u:object_r:mount_exec_t,s0) +/usr/bin/umount(\.[^/]+)? -- gen_context(system_u:object_r:mount_exec_t,s0) -/usr/sbin/mount\.zfs -- gen_context(system_u:object_r:mount_exec_t,s0) +/usr/sbin/mount(\.[^/]+)? -- gen_context(system_u:object_r:mount_exec_t,s0) +/usr/sbin/umount(\.[^/]+)? -- gen_context(system_u:object_r:mount_exec_t,s0) /usr/sbin/zfs -- gen_context(system_u:object_r:mount_exec_t,s0) /usr/sbin/zpool -- gen_context(system_u:object_r:mount_exec_t,s0)
