diff --git a/policy/modules/system/lvm.if b/policy/modules/system/lvm.if index 0666bb6..809cf34 100644 --- a/policy/modules/system/lvm.if +++ b/policy/modules/system/lvm.if @@ -21,6 +21,26 @@ interface(`lvm_domtrans',` ######################################## ## +## Execute lvm programs in the caller domain. +## +## +## +## The type of the process performing this action. +## +## +# +interface(`lvm_exec',` + gen_require(` + type lvm_exec_t; + ') + + corecmd_search_sbin($1) + can_exec($1, lvm_exec_t) + +') + +######################################## +## ## Execute lvm programs in the lvm domain. ## ## @@ -85,3 +105,22 @@ interface(`lvm_manage_config',` manage_dirs_pattern($1, lvm_etc_t, lvm_etc_t) manage_files_pattern($1, lvm_etc_t, lvm_etc_t) ') + +###################################### +## +## Execute a domain transition to run clvmd. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`lvm_domtrans_clvmd',` + gen_require(` + type clvmd_t, clvmd_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1,clvmd_exec_t,clvmd_t) +') diff --git a/policy/modules/system/lvm.te b/policy/modules/system/lvm.te index 8fcc7d3..69e65e4 100644 --- a/policy/modules/system/lvm.te +++ b/policy/modules/system/lvm.te @@ -1,5 +1,5 @@ -policy_module(lvm, 1.11.0) +policy_module(lvm, 1.11.1) ######################################## # @@ -10,6 +10,9 @@ type clvmd_t; type clvmd_exec_t; init_daemon_domain(clvmd_t, clvmd_exec_t) +type clvmd_initrc_exec_t; +init_script_file(clvmd_initrc_exec_t) + type clvmd_var_run_t; files_pid_file(clvmd_var_run_t) @@ -102,6 +105,7 @@ fs_getattr_all_fs(clvmd_t) fs_search_auto_mountpoints(clvmd_t) fs_dontaudit_list_tmpfs(clvmd_t) fs_dontaudit_read_removable_files(clvmd_t) +fs_rw_anon_inodefs_files(clvmd_t) storage_dontaudit_getattr_removable_dev(clvmd_t) storage_manage_fixed_disk(clvmd_t) @@ -168,7 +172,7 @@ allow lvm_t self:process { sigchld sigkill sigstop signull signal }; # LVM will complain a lot if it cannot set its priority. allow lvm_t self:process setsched; allow lvm_t self:file rw_file_perms; -allow lvm_t self:fifo_file rw_fifo_file_perms; +allow lvm_t self:fifo_file manage_fifo_file_perms; allow lvm_t self:unix_dgram_socket create_socket_perms; allow lvm_t self:netlink_kobject_uevent_socket create_socket_perms; @@ -214,6 +218,7 @@ kernel_read_kernel_sysctls(lvm_t) # it has no reason to need this kernel_dontaudit_getattr_core_if(lvm_t) kernel_use_fds(lvm_t) +kernel_search_debugfs(lvm_t) corecmd_exec_bin(lvm_t) corecmd_exec_shell(lvm_t) @@ -255,6 +260,10 @@ fs_list_tmpfs(lvm_t) fs_read_tmpfs_symlinks(lvm_t) fs_dontaudit_read_removable_files(lvm_t) fs_dontaudit_getattr_tmpfs_files(lvm_t) +fs_rw_anon_inodefs_files(lvm_t) + +mls_file_read_all_levels(lvm_t) +mls_file_write_to_clearance(lvm_t) selinux_get_fs_mount(lvm_t) selinux_validate_context(lvm_t) @@ -274,9 +283,12 @@ storage_dev_filetrans_fixed_disk(lvm_t) # Access raw devices and old /dev/lvm (c 109,0). Is this needed? storage_manage_fixed_disk(lvm_t) +term_use_all_terms(lvm_t) + init_use_fds(lvm_t) init_dontaudit_getattr_initctl(lvm_t) init_use_script_ptys(lvm_t) +init_read_script_state(lvm_t) logging_send_syslog_msg(lvm_t) @@ -313,7 +325,9 @@ optional_policy(` optional_policy(` dbus_system_bus_client(lvm_t) - hal_dbus_chat(lvm_t) + optional_policy(` + hal_dbus_chat(lvm_t) + ') ') optional_policy(` @@ -329,6 +343,10 @@ optional_policy(` ') optional_policy(` + virt_manage_images(lvm_t) +') + +optional_policy(` xen_append_log(lvm_t) xen_dontaudit_rw_unix_stream_sockets(lvm_t) ')