From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from pigeon.gentoo.org ([208.92.234.80] helo=lists.gentoo.org) by finch.gentoo.org with esmtp (Exim 4.60) (envelope-from ) id 1SjxfO-0000Do-Ib for garchives@archives.gentoo.org; Wed, 27 Jun 2012 19:12:42 +0000 Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 4B504E0859; Wed, 27 Jun 2012 19:12:14 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) by pigeon.gentoo.org (Postfix) with ESMTP id 1DE71E0859 for ; Wed, 27 Jun 2012 19:12:13 +0000 (UTC) Received: from hornbill.gentoo.org (hornbill.gentoo.org [94.100.119.163]) (using TLSv1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 78E451B4739 for ; Wed, 27 Jun 2012 19:12:13 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by hornbill.gentoo.org (Postfix) with ESMTP id 71044E5440 for ; Wed, 27 Jun 2012 19:12:11 +0000 (UTC) From: "Sven Vermeulen" To: gentoo-commits@lists.gentoo.org Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Sven Vermeulen" Message-ID: <1340648362.2a3789fcb7b26f16e4595ab4520a925af9dcabb3.SwifT@gentoo> Subject: [gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/system/ X-VCS-Repository: proj/hardened-refpolicy X-VCS-Files: policy/modules/system/udev.fc policy/modules/system/udev.if X-VCS-Directories: policy/modules/system/ X-VCS-Committer: SwifT X-VCS-Committer-Name: Sven Vermeulen X-VCS-Revision: 2a3789fcb7b26f16e4595ab4520a925af9dcabb3 X-VCS-Branch: master Date: Wed, 27 Jun 2012 19:12:11 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: quoted-printable X-Archives-Salt: 3155b09f-4ec3-47b6-a345-7151c86a945b X-Archives-Hash: 64668c2d537b10aa825c627ac46c8d61 commit: 2a3789fcb7b26f16e4595ab4520a925af9dcabb3 Author: Sven Vermeulen siphos be> AuthorDate: Mon Jun 25 18:19:22 2012 +0000 Commit: Sven Vermeulen siphos be> CommitDate: Mon Jun 25 18:19:22 2012 +0000 URL: http://git.overlays.gentoo.org/gitweb/?p=3Dproj/hardened-refp= olicy.git;a=3Dcommit;h=3D2a3789fc Support for udev in /run (using /run/udev) --- policy/modules/system/udev.fc | 1 + policy/modules/system/udev.if | 22 ++++++++++++++++++++++ 2 files changed, 23 insertions(+), 0 deletions(-) diff --git a/policy/modules/system/udev.fc b/policy/modules/system/udev.f= c index f2286ef..fb5a97d 100644 --- a/policy/modules/system/udev.fc +++ b/policy/modules/system/udev.fc @@ -33,6 +33,7 @@ ifdef(`distro_redhat',` /var/run/PackageKit/udev(/.*)? gen_context(system_u:object_r:udev_var_ru= n_t,s0) /var/run/udev -d gen_context(system_u:object_r:udev_var_run_t,s0) /var/run/udev/rules\.d(/.*)? gen_context(system_u:object_r:udev_tbl_t,s0= ) +/var/run/udev/data(/.*)? gen_context(system_u:object_r:udev_tbl_t,s0) =20 ifdef(`distro_debian',` /var/run/xen-hotplug -d gen_context(system_u:object_r:udev_var_run_t,s0) diff --git a/policy/modules/system/udev.if b/policy/modules/system/udev.i= f index c98bcec..46c8e82 100644 --- a/policy/modules/system/udev.if +++ b/policy/modules/system/udev.if @@ -249,6 +249,8 @@ interface(`udev_read_db',` allow $1 udev_tbl_t:dir list_dir_perms; read_files_pattern($1, udev_tbl_t, udev_tbl_t) read_lnk_files_pattern($1, udev_tbl_t, udev_tbl_t) + # Device table files are beneith /run/udev + udev_search_pids($1) ') =20 ######################################## @@ -295,6 +297,26 @@ interface(`udev_pid_filetrans_run_dirs',` =20 ######################################## ## +## Search through udev pid files and directories +## +## +## +## Domain allowed access. +## +## +# +interface(`udev_search_pids',` + gen_require(` + type udev_var_run_t; + ') + + files_search_var_lib($1) + search_dirs_pattern($1, udev_var_run_t, udev_var_run_t) +') + + +######################################## +## ## Create, read, write, and delete ## udev pid files. ##