commit: edf8cf3543282583fa5e07f644f07465d8fe7713
Author: Luis Ressel <aranea <AT> aixah <DOT> de>
AuthorDate: Mon Aug 11 22:24:15 2014 +0000
Commit: Sven Vermeulen <swift <AT> gentoo <DOT> org>
CommitDate: Tue Aug 19 20:06:47 2014 +0000
URL:
http://sources.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=edf8cf35
Add neccessary permissions for losetup
This allows losetup to bind mount_loopback_t files to loop devices.
---
policy/modules/kernel/kernel.te | 5 +++++
policy/modules/system/fstools.te | 5 +++++
2 files changed, 10 insertions(+)
diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te
index 4e39c2c..7178d93 100644
--- a/policy/modules/kernel/kernel.te
+++ b/policy/modules/kernel/kernel.te
@@ -300,6 +300,11 @@ ifdef(`distro_redhat',`
')
optional_policy(`
+ # loop devices
+ fstools_use_fds(kernel_t)
+')
+
+optional_policy(`
hotplug_search_config(kernel_t)
')
diff --git a/policy/modules/system/fstools.te b/policy/modules/system/fstools.te
index 5c77a4f..7ce8171 100644
--- a/policy/modules/system/fstools.te
+++ b/policy/modules/system/fstools.te
@@ -94,6 +94,8 @@ dev_rw_sysfs(fsadm_t)
dev_getattr_usbfs_dirs(fsadm_t)
# Access to /dev/mapper/control
dev_rw_lvm_control(fsadm_t)
+# for losetup
+dev_rw_loop_control(fsadm_t)
domain_use_interactive_fds(fsadm_t)
@@ -125,6 +127,9 @@ files_search_all(fsadm_t)
mls_file_read_all_levels(fsadm_t)
mls_file_write_all_levels(fsadm_t)
+# losetup: bind mount_loopback_t files to loop devices
+mount_rw_loopback_files(fsadm_t)
+
storage_raw_read_fixed_disk(fsadm_t)
storage_raw_write_fixed_disk(fsadm_t)
storage_raw_read_removable_device(fsadm_t)
