commit: cf36b3514d4db2806437cdd1ed63cd328f40a3e2
Author: Chris PeBenito <pebenito <AT> ieee <DOT> org>
AuthorDate: Mon Jun 5 00:30:25 2017 +0000
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Mon Jun 5 17:16:18 2017 +0000
URL:
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=cf36b351
cgmanager: Move lines
policy/modules/contrib/cgmanager.fc | 15 ++++++++-------
policy/modules/contrib/cgmanager.te | 26 ++++++++++++--------------
2 files changed, 20 insertions(+), 21 deletions(-)
diff --git a/policy/modules/contrib/cgmanager.fc
b/policy/modules/contrib/cgmanager.fc
index d53e92f5..d638d196 100644
--- a/policy/modules/contrib/cgmanager.fc
+++ b/policy/modules/contrib/cgmanager.fc
@@ -1,9 +1,10 @@
-/usr/sbin/cgmanager --
gen_context(system_u:object_r:cgmanager_exec_t,s0)
-/usr/sbin/cgproxy --
gen_context(system_u:object_r:cgmanager_exec_t,s0)
-/usr/sbin/cgm-release-agent --
gen_context(system_u:object_r:cgmanager_exec_t,s0)
+/sys/fs/cgroup/cgmanager(/.*)?
gen_context(system_u:object_r:cgmanager_cgroup_t,s0)
-/sys/fs/cgroup/cgmanager(/.*)?
gen_context(system_u:object_r:cgmanager_cgroup_t,s0)
+/run/cgmanager(/.*)?
gen_context(system_u:object_r:cgmanager_run_t,s0)
+/run/cgmanager.pid
gen_context(system_u:object_r:cgmanager_run_t,s0)
+/run/cgmanager/fs(/.*)? <<none>>
-/run/cgmanager(/.*)?
gen_context(system_u:object_r:cgmanager_run_t,s0)
-/run/cgmanager.pid
gen_context(system_u:object_r:cgmanager_run_t,s0)
-/run/cgmanager/fs(/.*)? <<none>>
+/usr/libexec/cgmanager/cgm-release-agent --
gen_context(system_u:object_r:cgmanager_exec_t,s0)
+
+/usr/sbin/cgmanager --
gen_context(system_u:object_r:cgmanager_exec_t,s0)
+/usr/sbin/cgproxy --
gen_context(system_u:object_r:cgmanager_exec_t,s0)
diff --git a/policy/modules/contrib/cgmanager.te
b/policy/modules/contrib/cgmanager.te
index 5c322954..c3cc5217 100644
--- a/policy/modules/contrib/cgmanager.te
+++ b/policy/modules/contrib/cgmanager.te
@@ -9,12 +9,12 @@ type cgmanager_t;
type cgmanager_exec_t;
init_daemon_domain(cgmanager_t, cgmanager_exec_t)
-type cgmanager_run_t;
-files_pid_file(cgmanager_run_t)
-
type cgmanager_cgroup_t;
files_type(cgmanager_cgroup_t)
+type cgmanager_run_t;
+files_pid_file(cgmanager_run_t)
+
########################################
#
# CGManager local policy
@@ -23,40 +23,38 @@ files_type(cgmanager_cgroup_t)
allow cgmanager_t self:capability { sys_admin dac_override };
allow cgmanager_t self:fifo_file rw_fifo_file_perms;
+manage_dirs_pattern(cgmanager_t, cgmanager_cgroup_t, cgmanager_cgroup_t)
+manage_files_pattern(cgmanager_t, cgmanager_cgroup_t, cgmanager_cgroup_t)
+manage_sock_files_pattern(cgmanager_t, cgmanager_cgroup_t, cgmanager_cgroup_t)
+fs_cgroup_filetrans(cgmanager_t, cgmanager_cgroup_t, dir, "cgmanager")
+
+can_exec(cgmanager_t, cgmanager_exec_t)
+
manage_dirs_pattern(cgmanager_t, cgmanager_run_t, cgmanager_run_t)
manage_files_pattern(cgmanager_t, cgmanager_run_t, cgmanager_run_t)
manage_lnk_files_pattern(cgmanager_t, cgmanager_run_t, cgmanager_run_t)
files_pid_filetrans(cgmanager_t, cgmanager_run_t, { file dir })
allow cgmanager_t cgmanager_run_t:dir mounton;
-manage_dirs_pattern(cgmanager_t, cgmanager_cgroup_t, cgmanager_cgroup_t)
-manage_files_pattern(cgmanager_t, cgmanager_cgroup_t, cgmanager_cgroup_t)
-manage_sock_files_pattern(cgmanager_t, cgmanager_cgroup_t, cgmanager_cgroup_t)
-fs_cgroup_filetrans(cgmanager_t, cgmanager_cgroup_t, dir, "cgmanager")
-
+# for the release agent
kernel_domtrans_to(cgmanager_t, cgmanager_exec_t)
kernel_read_system_state(cgmanager_t)
corecmd_exec_bin(cgmanager_t)
-can_exec(cgmanager_t, cgmanager_exec_t)
domain_read_all_domains_state(cgmanager_t)
files_read_etc_files(cgmanager_t)
-
# cgmanager unmounts everything in its own mount namespace and mounts tmpfs on
some things
files_mounton_all_mountpoints(cgmanager_t)
files_unmount_all_file_type_fs(cgmanager_t)
-fs_unmount_xattr_fs(cgmanager_t)
+fs_unmount_xattr_fs(cgmanager_t)
fs_manage_cgroup_dirs(cgmanager_t)
fs_manage_cgroup_files(cgmanager_t)
-
fs_getattr_tmpfs(cgmanager_t)
-
fs_manage_tmpfs_dirs(cgmanager_t)
fs_manage_tmpfs_files(cgmanager_t)
-
fs_mount_cgroup(cgmanager_t)
fs_mount_tmpfs(cgmanager_t)
fs_mounton_tmpfs(cgmanager_t)
