| 1 |
commit: a935b290f5ecc5e507a8a8c1d0e365ddc3e239f3 |
| 2 |
Author: Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be> |
| 3 |
AuthorDate: Wed Mar 4 15:16:24 2015 +0000 |
| 4 |
Commit: Sven Vermeulen <swift <AT> gentoo <DOT> org> |
| 5 |
CommitDate: Wed Mar 4 15:16:24 2015 +0000 |
| 6 |
URL: http://sources.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=a935b290 |
| 7 |
|
| 8 |
Allow kdevtmpfs to manage /dev |
| 9 |
|
| 10 |
The kdevtmpfs thread (running as kernel_t) is showing behavior regarding |
| 11 |
access and management of /dev. Of course, that is its main purpose (see |
| 12 |
the Linux kernel source code at drivers/base/devtmpfs.c). |
| 13 |
|
| 14 |
In bug #535992 is an example denial given: |
| 15 |
|
| 16 |
Jan 8 01:37:29 testbed kernel: [28549.831785] audit: type=1400 |
| 17 |
audit(1420702649.386:1263): avc: denied { setattr } for pid=47 |
| 18 |
comm="kdevtmpfs" name="dm-6" dev="devtmpfs" ino=10993394 |
| 19 |
scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:device_t |
| 20 |
tclass=blk_file permissive=1 |
| 21 |
|
| 22 |
During the LVM2 related testing something similar comes up: |
| 23 |
|
| 24 |
time->Wed Mar 4 15:43:29 2015 |
| 25 |
type=AVC msg=audit(1425480209.997:137): avc: denied { getattr } for |
| 26 |
pid=16 comm="kdevtmpfs" path="/dm-3" dev="devtmpfs" ino=11400 |
| 27 |
scontext=system_u:system_r:kernel_t:s0 |
| 28 |
tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file |
| 29 |
permissive=0 |
| 30 |
|
| 31 |
Although there is no error message available, given the function of |
| 32 |
kdevtmpfs and the "trusted" domain that kernel_t is, we grant it full |
| 33 |
manage rights on the device_node and device_t resources. |
| 34 |
|
| 35 |
X-Gentoo-Bug: 535992 |
| 36 |
X-Gentoo-Bug-URL: https://bugs.gentoo.org/show_bug.cgi?id=535992 |
| 37 |
|
| 38 |
policy/modules/kernel/kernel.te | 4 +++- |
| 39 |
1 file changed, 3 insertions(+), 1 deletion(-) |
| 40 |
|
| 41 |
diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te |
| 42 |
index 2639a5a..a48cf63 100644 |
| 43 |
--- a/policy/modules/kernel/kernel.te |
| 44 |
+++ b/policy/modules/kernel/kernel.te |
| 45 |
@@ -437,5 +437,7 @@ ifdef(`distro_gentoo',` |
| 46 |
# |
| 47 |
allow kernel_t unlabeled_t:dir search_dir_perms; |
| 48 |
|
| 49 |
- dev_setattr_generic_chr_files(kernel_t) |
| 50 |
+ # To support kdevtmpfs properly (its purpose is to manage the /dev tmpfs so grant it these rights) |
| 51 |
+ # See also bug 535992 |
| 52 |
+ dev_manage_all_dev_nodes(kernel_t) |
| 53 |
') |
Archives