|
 |
f07426 |
From 80978901354b17cf3460d5d4451b48b59a9204ae Mon Sep 17 00:00:00 2001
|
|
|
f07426 |
From: Stefano Brivio <sbrivio@redhat.com>
|
|
|
f07426 |
Date: Fri, 10 Mar 2023 17:00:31 +0000
|
|
|
f07426 |
Subject: [PATCH 19/20] contrib/selinux: Split interfaces into smaller bits
|
|
|
f07426 |
|
|
|
f07426 |
...to fit accepted Fedora practices.
|
|
|
f07426 |
|
|
|
f07426 |
Link: https://github.com/fedora-selinux/selinux-policy/pull/1613
|
|
|
f07426 |
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
|
|
|
f07426 |
(cherry picked from commit 93105ea06619d4c199f8140f4b75ae359757dc6d)
|
|
|
f07426 |
---
|
|
|
f07426 |
contrib/selinux/passt.if | 71 ++++++++++++++++++++++++++++++++++------
|
|
|
f07426 |
1 file changed, 61 insertions(+), 10 deletions(-)
|
|
|
f07426 |
|
|
|
f07426 |
diff --git a/contrib/selinux/passt.if b/contrib/selinux/passt.if
|
|
|
f07426 |
index 3e37c5b..f7560a7 100644
|
|
|
f07426 |
--- a/contrib/selinux/passt.if
|
|
|
f07426 |
+++ b/contrib/selinux/passt.if
|
|
|
f07426 |
@@ -17,37 +17,88 @@ interface(`passt_domtrans',`
|
|
|
f07426 |
domtrans_pattern($1, passt_exec_t, passt_t)
|
|
|
f07426 |
')
|
|
|
f07426 |
|
|
|
f07426 |
-interface(`passt_socket',`
|
|
|
f07426 |
+interface(`passt_socket_dir',`
|
|
|
f07426 |
+ gen_require(`
|
|
|
f07426 |
+ type passt_t;
|
|
|
f07426 |
+ ')
|
|
|
f07426 |
+
|
|
|
f07426 |
+ allow passt_t $1:dir add_entry_dir_perms;
|
|
|
f07426 |
+')
|
|
|
f07426 |
+
|
|
|
f07426 |
+interface(`passt_socket_create',`
|
|
|
f07426 |
+ gen_require(`
|
|
|
f07426 |
+ type passt_t;
|
|
|
f07426 |
+ ')
|
|
|
f07426 |
+
|
|
|
f07426 |
+ allow passt_t $1:sock_file create;
|
|
|
f07426 |
+')
|
|
|
f07426 |
+
|
|
|
f07426 |
+interface(`passt_socket_use',`
|
|
|
f07426 |
gen_require(`
|
|
|
f07426 |
type passt_t;
|
|
|
f07426 |
')
|
|
|
f07426 |
|
|
|
f07426 |
- allow $1 $2:sock_file write;
|
|
|
f07426 |
allow $1 passt_t:unix_stream_socket connectto;
|
|
|
f07426 |
+ allow $1 $2:sock_file { read write };
|
|
|
f07426 |
+ allow passt_t $2:sock_file { read write };
|
|
|
f07426 |
+')
|
|
|
f07426 |
+
|
|
|
f07426 |
+interface(`passt_socket_delete',`
|
|
|
f07426 |
+ gen_require(`
|
|
|
f07426 |
+ type passt_t;
|
|
|
f07426 |
+ ')
|
|
|
f07426 |
+
|
|
|
f07426 |
+ allow $1 $2:sock_file unlink;
|
|
|
f07426 |
+')
|
|
|
f07426 |
+
|
|
|
f07426 |
+interface(`passt_logfile_dir',`
|
|
|
f07426 |
+ gen_require(`
|
|
|
f07426 |
+ type passt_t;
|
|
|
f07426 |
+ ')
|
|
|
f07426 |
|
|
|
f07426 |
- allow passt_t $2:sock_file { create read write unlink };
|
|
|
f07426 |
+ allow passt_t $1:dir add_entry_dir_perms;
|
|
|
f07426 |
')
|
|
|
f07426 |
|
|
|
f07426 |
-interface(`passt_logfile',`
|
|
|
f07426 |
+interface(`passt_logfile_use',`
|
|
|
f07426 |
gen_require(`
|
|
|
f07426 |
type passt_t;
|
|
|
f07426 |
')
|
|
|
f07426 |
|
|
|
f07426 |
logging_log_file($1);
|
|
|
f07426 |
- allow passt_t $1:dir { search write add_name };
|
|
|
f07426 |
allow passt_t $1:file { create open read write };
|
|
|
f07426 |
')
|
|
|
f07426 |
|
|
|
f07426 |
-interface(`passt_pidfile',`
|
|
|
f07426 |
+interface(`passt_pidfile_dir',`
|
|
|
f07426 |
+ gen_require(`
|
|
|
f07426 |
+ type passt_t;
|
|
|
f07426 |
+ ')
|
|
|
f07426 |
+
|
|
|
f07426 |
+ allow passt_t $1:dir add_entry_dir_perms;
|
|
|
f07426 |
+')
|
|
|
f07426 |
+
|
|
|
f07426 |
+interface(`passt_pidfile_write',`
|
|
|
f07426 |
+ gen_require(`
|
|
|
f07426 |
+ type passt_t;
|
|
|
f07426 |
+ ')
|
|
|
f07426 |
+
|
|
|
f07426 |
+ files_pid_file($1);
|
|
|
f07426 |
+ allow passt_t $1:file { create open write };
|
|
|
f07426 |
+')
|
|
|
f07426 |
+
|
|
|
f07426 |
+interface(`passt_pidfile_read',`
|
|
|
f07426 |
gen_require(`
|
|
|
f07426 |
type passt_t;
|
|
|
f07426 |
')
|
|
|
f07426 |
|
|
|
f07426 |
- allow $1 $2:file { open read unlink };
|
|
|
f07426 |
+ allow $1 $2:file { open read };
|
|
|
f07426 |
+')
|
|
|
f07426 |
+
|
|
|
f07426 |
+interface(`passt_pidfile_delete',`
|
|
|
f07426 |
+ gen_require(`
|
|
|
f07426 |
+ type passt_t;
|
|
|
f07426 |
+ ')
|
|
|
f07426 |
|
|
|
f07426 |
- files_pid_file($2);
|
|
|
f07426 |
- allow passt_t $2:dir { search write add_name };
|
|
|
f07426 |
- allow passt_t $2:file { create open write };
|
|
|
f07426 |
+ allow $1 $2:file unlink;
|
|
|
f07426 |
')
|
|
|
f07426 |
|
|
|
f07426 |
interface(`passt_kill',`
|
|
|
f07426 |
--
|
|
|
f07426 |
2.39.2
|
|
|
f07426 |
|