|
 |
f07426 |
From 7c01aa69bcd52197af708b9e08ce3067624288ef Mon Sep 17 00:00:00 2001
|
|
|
f07426 |
From: Stefano Brivio <sbrivio@redhat.com>
|
|
|
f07426 |
Date: Mon, 6 Mar 2023 23:19:18 +0000
|
|
|
f07426 |
Subject: [PATCH 12/20] contrib/selinux: Let interface users set paths for log,
|
|
|
f07426 |
PID, socket files
|
|
|
f07426 |
|
|
|
f07426 |
Even libvirt itself will configure passt to write log, PID and socket
|
|
|
f07426 |
files to different locations depending on whether the domain is
|
|
|
f07426 |
started as root (/var/log/libvirt/...) or as a regular user
|
|
|
f07426 |
(/var/log/<PID>/libvirt/...), and user_tmp_t would only cover the
|
|
|
f07426 |
latter.
|
|
|
f07426 |
|
|
|
f07426 |
Create interfaces for log and PID files, so that callers can specify
|
|
|
f07426 |
different file contexts for those, and modify the interface for the
|
|
|
f07426 |
UNIX socket file to allow different paths as well.
|
|
|
f07426 |
|
|
|
f07426 |
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
|
|
|
f07426 |
Tested-by: Laine Stump <laine@redhat.com>
|
|
|
f07426 |
Reviewed-by: Laine Stump <laine@redhat.com>
|
|
|
f07426 |
(cherry picked from commit d361fe6e809bdf3539d764cfa5058f46ce51bcbf)
|
|
|
f07426 |
---
|
|
|
f07426 |
contrib/selinux/passt.if | 26 +++++++++++++++++++++++++-
|
|
|
f07426 |
1 file changed, 25 insertions(+), 1 deletion(-)
|
|
|
f07426 |
|
|
|
f07426 |
diff --git a/contrib/selinux/passt.if b/contrib/selinux/passt.if
|
|
|
f07426 |
index 893395b..6a6105c 100644
|
|
|
f07426 |
--- a/contrib/selinux/passt.if
|
|
|
f07426 |
+++ b/contrib/selinux/passt.if
|
|
|
f07426 |
@@ -30,8 +30,32 @@ interface(`passt_socket',`
|
|
|
f07426 |
type passt_t;
|
|
|
f07426 |
')
|
|
|
f07426 |
|
|
|
f07426 |
- allow $1 user_tmp_t:sock_file write;
|
|
|
f07426 |
+ allow $1 $2:sock_file write;
|
|
|
f07426 |
allow $1 passt_t:unix_stream_socket connectto;
|
|
|
f07426 |
+
|
|
|
f07426 |
+ allow passt_t $2:sock_file { create read write unlink };
|
|
|
f07426 |
+')
|
|
|
f07426 |
+
|
|
|
f07426 |
+interface(`passt_logfile',`
|
|
|
f07426 |
+ gen_require(`
|
|
|
f07426 |
+ type passt_t;
|
|
|
f07426 |
+ ')
|
|
|
f07426 |
+
|
|
|
f07426 |
+ logging_log_file($1);
|
|
|
f07426 |
+ allow passt_t $1:dir { search write add_name };
|
|
|
f07426 |
+ allow passt_t $1:file { create open read write };
|
|
|
f07426 |
+')
|
|
|
f07426 |
+
|
|
|
f07426 |
+interface(`passt_pidfile',`
|
|
|
f07426 |
+ gen_require(`
|
|
|
f07426 |
+ type passt_t;
|
|
|
f07426 |
+ ')
|
|
|
f07426 |
+
|
|
|
f07426 |
+ allow $1 $2:file { open read unlink };
|
|
|
f07426 |
+
|
|
|
f07426 |
+ files_pid_file($2);
|
|
|
f07426 |
+ allow passt_t $2:dir { search write add_name };
|
|
|
f07426 |
+ allow passt_t $2:file { create open write };
|
|
|
f07426 |
')
|
|
|
f07426 |
|
|
|
f07426 |
interface(`passt_kill',`
|
|
|
f07426 |
--
|
|
|
f07426 |
2.39.2
|
|
|
f07426 |
|