diff --git a/policy/modules/kernel/devices.fc b/policy/modules/kernel/devices.fc index 2268319..3b2da10 100644 --- a/policy/modules/kernel/devices.fc +++ b/policy/modules/kernel/devices.fc @@ -70,6 +70,7 @@ /dev/modem -c gen_context(system_u:object_r:modem_device_t,s0) /dev/mpu401.* -c gen_context(system_u:object_r:sound_device_t,s0) /dev/msr.* -c gen_context(system_u:object_r:cpu_device_t,s0) +/dev/net/vhost -c gen_context(system_u:object_r:vhost_device_t,s0) /dev/network_latency -c gen_context(system_u:object_r:netcontrol_device_t,s0) /dev/network_throughput -c gen_context(system_u:object_r:netcontrol_device_t,s0) /dev/noz.* -c gen_context(system_u:object_r:modem_device_t,s0) @@ -109,9 +110,11 @@ /dev/ub[a-c] -c gen_context(system_u:object_r:usb_device_t,s0) /dev/usb.+ -c gen_context(system_u:object_r:usb_device_t,s0) /dev/usblp.* -c gen_context(system_u:object_r:printer_device_t,s0) +/dev/usbmon.+ -c gen_context(system_u:object_r:usbmon_device_t,s0) ifdef(`distro_suse', ` /dev/usbscanner -c gen_context(system_u:object_r:scanner_device_t,s0) ') +/dev/vhost-net -c gen_context(system_u:object_r:vhost_device_t,s0) /dev/vbi.* -c gen_context(system_u:object_r:v4l_device_t,s0) /dev/vbox.* -c gen_context(system_u:object_r:xserver_misc_device_t,s0) /dev/vga_arbiter -c gen_context(system_u:object_r:xserver_misc_device_t,s0) @@ -152,6 +155,8 @@ ifdef(`distro_suse', ` /dev/mapper/control -c gen_context(system_u:object_r:lvm_control_t,s0) +/dev/mfpports/.* -c gen_context(system_u:object_r:printer_device_t,s0) + /dev/mvideo/.* -c gen_context(system_u:object_r:xserver_misc_device_t,s0) /dev/pts(/.*)? <> diff --git a/policy/modules/kernel/devices.if b/policy/modules/kernel/devices.if index 6bab252..b0d558e 100644 --- a/policy/modules/kernel/devices.if +++ b/policy/modules/kernel/devices.if @@ -2123,6 +2123,24 @@ interface(`dev_filetrans_lirc',` ######################################## ## +## Get the attributes of the lvm comtrol device. +## +## +## +## Domain allowed access. +## +## +# +interface(`dev_getattr_lvm_control',` + gen_require(` + type device_t, lvm_control_t; + ') + + getattr_chr_files_pattern($1, device_t, lvm_control_t) +') + +######################################## +## ## Read the lvm comtrol device. ## ## @@ -2678,6 +2696,7 @@ interface(`dev_dontaudit_write_mtrr',` type mtrr_device_t; ') + dontaudit $1 mtrr_device_t:file write; dontaudit $1 mtrr_device_t:chr_file write; ') @@ -3814,6 +3833,24 @@ interface(`dev_rw_generic_usb_dev',` ######################################## ## +## Read USB monitor devices. +## +## +## +## Domain allowed access. +## +## +# +interface(`dev_read_usbmon_dev',` + gen_require(` + type device_t, usbmon_device_t; + ') + + read_chr_files_pattern($1, device_t, usbmon_device_t) +') + +######################################## +## ## Mount a usbfs filesystem. ## ## @@ -4114,6 +4151,25 @@ interface(`dev_write_video_dev',` ######################################## ## +## Allow read/write the vhost net device +## +## +## +## Domain allowed access. +## +## +# +interface(`dev_rw_vhost',` + gen_require(` + type vhost_device_t; + ') + + list_dirs_pattern($1, vhost_device_t, vhost_device_t) + rw_files_pattern($1, vhost_device_t, vhost_device_t) +') + +######################################## +## ## Read and write VMWare devices. ## ## diff --git a/policy/modules/kernel/devices.te b/policy/modules/kernel/devices.te index ddc85e7..d3bafaf 100644 --- a/policy/modules/kernel/devices.te +++ b/policy/modules/kernel/devices.te @@ -1,5 +1,5 @@ -policy_module(devices, 1.10.0) +policy_module(devices, 1.10.1) ######################################## # @@ -239,6 +239,12 @@ type usb_device_t; dev_node(usb_device_t) # +# usb_device_t is the type for /dev/usbmon +# +type usbmon_device_t; +dev_node(usbmon_device_t) + +# # userio_device_t is the type for /dev/uio[0-9]+ # type userio_device_t; @@ -247,6 +253,12 @@ dev_node(userio_device_t) type v4l_device_t; dev_node(v4l_device_t) +# +# vhost_device_t is the type for /dev/vhost-net +# +type vhost_device_t; +dev_node(vhost_device_t) + # Type for vmware devices. type vmware_device_t; dev_node(vmware_device_t)