commit: ca3332b1b3ad6b6cc3b52bf8cff26e4407f93c92
Author: Russell Coker <russell <AT> coker <DOT> com <DOT> au>
AuthorDate: Fri Oct 6 10:48:52 2023 +0000
Commit: Kenton Groombridge <concord <AT> gentoo <DOT> org>
CommitDate: Fri Oct 6 15:31:45 2023 +0000
URL:
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=ca3332b1
Label checkarray as mdadm_exec_t, allow it to read/write temp files inherited
from cron, and dontaudit ps type operations from it
Signed-off-by: Russell Coker <russell <AT> coker.com.au>
Signed-off-by: Kenton Groombridge <concord <AT> gentoo.org>
policy/modules/kernel/corecommands.fc | 1 -
policy/modules/system/raid.fc | 2 ++
policy/modules/system/raid.te | 2 ++
3 files changed, 4 insertions(+), 1 deletion(-)
diff --git a/policy/modules/kernel/corecommands.fc
b/policy/modules/kernel/corecommands.fc
index da5db80a2..21ec61464 100644
--- a/policy/modules/kernel/corecommands.fc
+++ b/policy/modules/kernel/corecommands.fc
@@ -320,7 +320,6 @@ ifdef(`distro_debian',`
/usr/sbin/sesh --
gen_context(system_u:object_r:shell_exec_t,s0)
/usr/sbin/smrsh --
gen_context(system_u:object_r:shell_exec_t,s0)
-/usr/share/mdadm/checkarray -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/(.*/)?bin(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/share/ajaxterm/ajaxterm\.py.* -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/ajaxterm/qweb\.py.* -- gen_context(system_u:object_r:bin_t,s0)
diff --git a/policy/modules/system/raid.fc b/policy/modules/system/raid.fc
index 84f1ab02a..ca16bdfdf 100644
--- a/policy/modules/system/raid.fc
+++ b/policy/modules/system/raid.fc
@@ -11,6 +11,8 @@
/usr/bin/mdmpd -- gen_context(system_u:object_r:mdadm_exec_t,s0)
/usr/bin/raid-check -- gen_context(system_u:object_r:mdadm_exec_t,s0)
+/usr/share/mdadm/checkarray -- gen_context(system_u:object_r:mdadm_exec_t,s0)
+
# Systemd unit files
/usr/lib/systemd/system/[^/]*mdadm-.* --
gen_context(system_u:object_r:mdadm_unit_t,s0)
/usr/lib/systemd/system/[^/]*mdmon.* --
gen_context(system_u:object_r:mdadm_unit_t,s0)
diff --git a/policy/modules/system/raid.te b/policy/modules/system/raid.te
index 907facf8d..c8db38261 100644
--- a/policy/modules/system/raid.te
+++ b/policy/modules/system/raid.te
@@ -57,6 +57,7 @@ dev_read_realtime_clock(mdadm_t)
# create links in /dev/md
dev_create_generic_symlinks(mdadm_t)
+domain_dontaudit_search_all_domains_state(mdadm_t)
domain_use_interactive_fds(mdadm_t)
files_read_etc_files(mdadm_t)
@@ -95,6 +96,7 @@ userdom_dontaudit_search_user_home_content(mdadm_t)
optional_policy(`
cron_system_entry(mdadm_t, mdadm_exec_t)
+ cron_rw_inherited_tmp_files(mdadm_t)
')
optional_policy(`
