commit: af8127d982e94211a2a717c9fb3249ef7456ee7a Author: Kenton Groombridge <me <AT> concord <DOT> sh> AuthorDate: Tue Mar 7 00:19:51 2023 +0000 Commit: Kenton Groombridge <concord <AT> gentoo <DOT> org> CommitDate: Fri Mar 31 17:11:32 2023 +0000 URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=af8127d9
fs, init: allow systemd-init to set the attributes of efivarfs files avc: denied { setattr } for pid=1 comm="systemd" name="LoaderSystemToken-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f" dev="efivarfs" ino=1049 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:efivarfs_t:s0 tclass=file permissive=0 Signed-off-by: Kenton Groombridge <me <AT> concord.sh> Signed-off-by: Kenton Groombridge <concord <AT> gentoo.org> policy/modules/kernel/filesystem.if | 20 ++++++++++++++++++++ policy/modules/system/init.te | 1 + 2 files changed, 21 insertions(+) diff --git a/policy/modules/kernel/filesystem.if b/policy/modules/kernel/filesystem.if index a1282cf40..528eeafc0 100644 --- a/policy/modules/kernel/filesystem.if +++ b/policy/modules/kernel/filesystem.if @@ -2439,6 +2439,26 @@ interface(`fs_read_efivarfs_files',` read_files_pattern($1, efivarfs_t, efivarfs_t) ') +####################################### +## <summary> +## Set the attributes of files in efivarfs +## - contains Linux Kernel configuration options for UEFI systems +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +## <rolecap/> +# +interface(`fs_setattr_efivarfs_files',` + gen_require(` + type efivarfs_t; + ') + + setattr_files_pattern($1, efivarfs_t, efivarfs_t) +') + ######################################## ## <summary> ## Create, read, write, and delete files diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te index 87d62741e..fca349587 100644 --- a/policy/modules/system/init.te +++ b/policy/modules/system/init.te @@ -464,6 +464,7 @@ ifdef(`init_systemd',` fs_relabel_tmpfs_chr_files(init_t) fs_relabel_tmpfs_fifo_files(init_t) fs_read_efivarfs_files(init_t) + fs_setattr_efivarfs_files(init_t) # for privatetmp functions fs_relabel_tmpfs_dirs(init_t) fs_relabel_tmpfs_files(init_t)