[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/kernel/

[Sven Vermeulen]

commit:     49a43dd34f9a50207ae012a26f3fe941a66ebdbc
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Fri Apr 11 18:01:42 2014 +0000
Commit:     Sven Vermeulen <swift <AT> gentoo <DOT> org>
CommitDate: Mon Apr 21 15:16:51 2014 +0000
URL:        
http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=49a43dd3

Dontaudit access on security_t file system at /sys/fs/selinux

Second part of the support of security_t under /sys/fs/selinux - when
asked not to audit getting attributes on the selinux file system, have
this propagate to the sysfs parts as well.

Signed-off-by: Sven Vermeulen <sven.vermeulen <AT> siphos.be>

---
 policy/modules/kernel/devices.if | 18 ++++++++++++++++++
 policy/modules/kernel/selinux.if |  4 ++--
 2 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/policy/modules/kernel/devices.if b/policy/modules/kernel/devices.if
index 60a3f46..1ae060c 100644
--- a/policy/modules/kernel/devices.if
+++ b/policy/modules/kernel/devices.if
@@ -3891,6 +3891,24 @@ interface(`dev_getattr_sysfs',`
 
 ########################################
 ## <summary>
+##     Do not audit getting the attributes of sysfs filesystem
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain to dontaudit access from
+##     </summary>
+## </param>
+#
+interface(`dev_dontaudit_getattr_sysfs',`
+       gen_require(`
+               type sysfs_t;
+       ')
+
+       dontaudit $1 sysfs_t:filesystem getattr;
+')
+
+########################################
+## <summary>
 ##     Search the sysfs directories.
 ## </summary>
 ## <param name="domain">

diff --git a/policy/modules/kernel/selinux.if b/policy/modules/kernel/selinux.if
index 31706ac..9192d23 100644
--- a/policy/modules/kernel/selinux.if
+++ b/policy/modules/kernel/selinux.if
@@ -94,7 +94,7 @@ interface(`selinux_dontaudit_get_fs_mount',`
        dontaudit $1 security_t:filesystem getattr;
 
        # Same for /sys/fs/selinux
-       dev_dontaudit_getattr_sysfs_fs($1)
+       dev_dontaudit_getattr_sysfs($1)
        dev_dontaudit_search_sysfs($1)
 
        # read /proc/filesystems to see if selinuxfs is supported
@@ -196,7 +196,7 @@ interface(`selinux_dontaudit_getattr_fs',`
 
        dontaudit $1 security_t:filesystem getattr;
 
-       dev_dontaudit_getattr_sysfs_fs($1)
+       dev_dontaudit_getattr_sysfs($1)
        dev_dontaudit_search_sysfs($1)
 ')