1 |
commit: c7833ecb2f3fe1c42ec15a2245803980bcb5109f |
2 |
Author: Jason Zaman <jason <AT> perfinion <DOT> com> |
3 |
AuthorDate: Sat Jul 11 09:15:44 2015 +0000 |
4 |
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org> |
5 |
CommitDate: Thu Jul 30 16:41:27 2015 +0000 |
6 |
URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=c7833ecb |
7 |
|
8 |
Introduce lvm_admin interface |
9 |
|
10 |
policy/modules/roles/sysadm.te | 1 + |
11 |
policy/modules/system/lvm.if | 44 ++++++++++++++++++++++++++++++++++++++++++ |
12 |
2 files changed, 45 insertions(+) |
13 |
|
14 |
diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te |
15 |
index e0442db..1ee88cd 100644 |
16 |
--- a/policy/modules/roles/sysadm.te |
17 |
+++ b/policy/modules/roles/sysadm.te |
18 |
@@ -578,6 +578,7 @@ optional_policy(` |
19 |
') |
20 |
|
21 |
optional_policy(` |
22 |
+ lvm_admin(sysadm_t, sysadm_r) |
23 |
lvm_run(sysadm_t, sysadm_r) |
24 |
') |
25 |
|
26 |
|
27 |
diff --git a/policy/modules/system/lvm.if b/policy/modules/system/lvm.if |
28 |
index 58bc27f..86b223c 100644 |
29 |
--- a/policy/modules/system/lvm.if |
30 |
+++ b/policy/modules/system/lvm.if |
31 |
@@ -123,3 +123,47 @@ interface(`lvm_domtrans_clvmd',` |
32 |
corecmd_search_bin($1) |
33 |
domtrans_pattern($1, clvmd_exec_t, clvmd_t) |
34 |
') |
35 |
+ |
36 |
+###################################### |
37 |
+## <summary> |
38 |
+## All of the rules required to |
39 |
+## administrate an lvm environment. |
40 |
+## </summary> |
41 |
+## <param name="domain"> |
42 |
+## <summary> |
43 |
+## Domain allowed access. |
44 |
+## </summary> |
45 |
+## </param> |
46 |
+## <param name="role"> |
47 |
+## <summary> |
48 |
+## Role allowed access. |
49 |
+## </summary> |
50 |
+## </param> |
51 |
+# |
52 |
+interface(`lvm_admin',` |
53 |
+ gen_require(` |
54 |
+ type clvmd_t, clvmd_exec_t, clvmd_initrc_exec_t; |
55 |
+ type lvm_etc_t, lvm_lock_t, lvm_metadata_t; |
56 |
+ type lvm_var_lib_t, lvm_var_run_t, clvmd_var_run_t, lvm_tmp_t; |
57 |
+ ') |
58 |
+ |
59 |
+ allow $1 clvmd_t:process { ptrace signal_perms }; |
60 |
+ ps_process_pattern($1, clvmd_t) |
61 |
+ |
62 |
+ init_startstop_service($1, $2, clvmd_t, clvmd_initrc_exec_t) |
63 |
+ |
64 |
+ files_search_etc($1) |
65 |
+ admin_pattern($1, lvm_etc_t) |
66 |
+ |
67 |
+ files_search_locks($1) |
68 |
+ admin_pattern($1, lvm_lock_t) |
69 |
+ |
70 |
+ files_search_var_lib($1) |
71 |
+ admin_pattern($1, lvm_var_lib_t) |
72 |
+ |
73 |
+ files_search_pids($1) |
74 |
+ admin_pattern($1, { lvm_var_run_t clvmd_var_run_t }) |
75 |
+ |
76 |
+ files_search_tmp($1) |
77 |
+ admin_pattern($1, lvm_tmp_t) |
78 |
+') |