diff --git a/policy/modules/kernel/storage.if b/policy/modules/kernel/storage.if index 7522e6f..e500e21 100644 --- a/policy/modules/kernel/storage.if +++ b/policy/modules/kernel/storage.if @@ -171,6 +171,24 @@ interface(`storage_dontaudit_write_fixed_disk',` ######################################## ## +## Allow the caller to directly read and write to a fixed disk. +## This is extremly dangerous as it can bypass the +## SELinux protections for filesystem objects, and +## should only be used by trusted domains. +## +## +## +## Domain allowed access. +## +## +# +interface(`storage_raw_rw_fixed_disk',` + storage_raw_read_fixed_disk($1) + storage_raw_write_fixed_disk($1) +') + +######################################## +## ## Create, read, write, and delete fixed disk device nodes. ## ## diff --git a/policy/modules/kernel/storage.te b/policy/modules/kernel/storage.te index 2057aba..adcaeaf 100644 --- a/policy/modules/kernel/storage.te +++ b/policy/modules/kernel/storage.te @@ -1,5 +1,5 @@ -policy_module(storage,1.5.0) +policy_module(storage,1.5.1) ######################################## # diff --git a/policy/modules/system/logging.fc b/policy/modules/system/logging.fc index b797ef7..244c3a8 100644 --- a/policy/modules/system/logging.fc +++ b/policy/modules/system/logging.fc @@ -15,10 +15,10 @@ /usr/sbin/klogd -- gen_context(system_u:object_r:klogd_exec_t,s0) /usr/sbin/metalog -- gen_context(system_u:object_r:syslogd_exec_t,s0) -/usr/sbin/syslogd -- gen_context(system_u:object_r:syslogd_exec_t,s0) -ifdef(`distro_gentoo', ` +/usr/sbin/rklogd -- gen_context(system_u:object_r:klogd_exec_t,s0) +/usr/sbin/rsyslogd -- gen_context(system_u:object_r:syslogd_exec_t,s0) /usr/sbin/syslog-ng -- gen_context(system_u:object_r:syslogd_exec_t,s0) -') +/usr/sbin/syslogd -- gen_context(system_u:object_r:syslogd_exec_t,s0) ifdef(`distro_suse', ` /var/lib/stunnel/dev/log -s gen_context(system_u:object_r:devlog_t,s0) diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te index 5a81526..4e42f83 100644 --- a/policy/modules/system/logging.te +++ b/policy/modules/system/logging.te @@ -1,5 +1,5 @@ -policy_module(logging,1.9.0) +policy_module(logging,1.9.1) ######################################## #