Skip to content

Commit 2cce9c3

Browse files
5umm3r155umm3r15
committed
Split virt policy, introduce virt_supplementary module
Separate the services from the original virt files that are not libvirt related and create virt_supplementary policy module.
1 parent 81b62ec commit 2cce9c3

File tree

6 files changed

+372
-302
lines changed

6 files changed

+372
-302
lines changed

‎virt.fc‎

Lines changed: 0 additions & 65 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,11 @@
11
HOME_DIR/\.libvirt(/.*)? gen_context(system_u:object_r:virt_home_t,s0)
22
HOME_DIR/\.libvirt/qemu(/.*)? gen_context(system_u:object_r:svirt_home_t,s0)
3-
HOME_DIR/\.virtinst(/.*)? gen_context(system_u:object_r:virt_home_t,s0)
43
HOME_DIR/\.cache/libvirt(/.*)? gen_context(system_u:object_r:virt_home_t,s0)
5-
HOME_DIR/\.cache/libvirt-sandbox(/.*)? gen_context(system_u:object_r:virt_home_t,s0)
6-
HOME_DIR/\.cache/gnome-boxes(/.*)? gen_context(system_u:object_r:virt_home_t,s0)
74
HOME_DIR/\.cache/libvirt/qemu(/.*)? gen_context(system_u:object_r:svirt_home_t,s0)
85
HOME_DIR/\.config/libvirt(/.*)? gen_context(system_u:object_r:virt_home_t,s0)
96
HOME_DIR/\.config/libvirt/qemu(/.*)? gen_context(system_u:object_r:svirt_home_t,s0)
107
HOME_DIR/VirtualMachines(/.*)? gen_context(system_u:object_r:virt_home_t,s0)
118
HOME_DIR/VirtualMachines/isos(/.*)? gen_context(system_u:object_r:virt_content_t,s0)
12-
HOME_DIR/\.local/share/gnome-boxes/images(/.*)? gen_context(system_u:object_r:svirt_home_t,s0)
139
HOME_DIR/\.local/share/libvirt/images(/.*)? gen_context(system_u:object_r:svirt_home_t,s0)
1410
HOME_DIR/\.local/share/libvirt/boot(/.*)? gen_context(system_u:object_r:svirt_home_t,s0)
1511

@@ -20,24 +16,13 @@ HOME_DIR/\.local/share/libvirt/boot(/.*)? gen_context(system_u:object_r:svirt_
2016
/etc/libvirt/.*/.* gen_context(system_u:object_r:virt_etc_rw_t,s0)
2117
/etc/rc\.d/init\.d/libvirtd -- gen_context(system_u:object_r:virtd_initrc_exec_t,s0)
2218
/etc/rc\.d/init\.d/virtlogd -- gen_context(system_u:object_r:virtlogd_initrc_exec_t,s0)
23-
/etc/xen -d gen_context(system_u:object_r:virt_etc_t,s0)
24-
/etc/xen/[^/]* -- gen_context(system_u:object_r:virt_etc_t,s0)
25-
/etc/xen/[^/]* -d gen_context(system_u:object_r:virt_etc_rw_t,s0)
26-
/etc/xen/.*/.* gen_context(system_u:object_r:virt_etc_rw_t,s0)
2719

2820
/usr/libexec/libvirt_lxc -- gen_context(system_u:object_r:virtd_lxc_exec_t,s0)
29-
/usr/libexec/qemu-bridge-helper gen_context(system_u:object_r:virt_bridgehelper_exec_t,s0)
30-
/usr/libexec/qemu-pr-helper -- gen_context(system_u:object_r:virtd_exec_t,s0)
3121

3222
/usr/sbin/libvirtd -- gen_context(system_u:object_r:virtd_exec_t,s0)
3323
/usr/sbin/virtlockd -- gen_context(system_u:object_r:virtlogd_exec_t,s0)
3424
/usr/sbin/virtlogd -- gen_context(system_u:object_r:virtlogd_exec_t,s0)
35-
/usr/bin/virt-who -- gen_context(system_u:object_r:virtd_exec_t,s0)
36-
/usr/bin/qemu-pr-helper -- gen_context(system_u:object_r:virtd_exec_t,s0)
3725
/usr/bin/virsh -- gen_context(system_u:object_r:virsh_exec_t,s0)
38-
/usr/sbin/condor_vm-gahp -- gen_context(system_u:object_r:virtd_exec_t,s0)
39-
/usr/sbin/xl -- gen_context(system_u:object_r:virsh_exec_t,s0)
40-
/usr/sbin/xm -- gen_context(system_u:object_r:virsh_exec_t,s0)
4126

4227
/usr/sbin/virtinterfaced -- gen_context(system_u:object_r:virtinterfaced_exec_t,s0)
4328
/usr/sbin/virtlxcd -- gen_context(system_u:object_r:virtd_lxc_exec_t,s0)
@@ -61,10 +46,8 @@ HOME_DIR/\.local/share/libvirt/boot(/.*)? gen_context(system_u:object_r:svirt_
6146
/var/lib/libvirt/lockd(/.*)? gen_context(system_u:object_r:virt_var_lockd_t,s0)
6247
/var/lib/libvirt/qemu(/.*)? gen_context(system_u:object_r:qemu_var_run_t,s0-mls_systemhigh)
6348

64-
/var/lock/xl -- gen_context(system_u:object_r:virt_log_t,s0)
6549
/var/log/log(/.*)? gen_context(system_u:object_r:virt_log_t,s0)
6650
/var/log/libvirt(/.*)? gen_context(system_u:object_r:virt_log_t,s0)
67-
/var/log/vdsm(/.*)? gen_context(system_u:object_r:virt_log_t,s0)
6851
/var/run/libvirtd\.pid -- gen_context(system_u:object_r:virt_var_run_t,s0)
6952
/var/run/virtlogd\.pid -- gen_context(system_u:object_r:virtlogd_var_run_t,s0)
7053
/var/run/virtlxcd\.pid -- gen_context(system_u:object_r:virt_lxc_var_run_t,s0)
@@ -112,57 +95,9 @@ HOME_DIR/\.local/share/libvirt/boot(/.*)? gen_context(system_u:object_r:svirt_
11295
/var/run/libvirt/virtvboxd-admin-sock -s gen_context(system_u:object_r:virtvboxd_var_run_t,s0)
11396
/var/run/libvirt/virtvboxd-sock -s gen_context(system_u:object_r:virtvboxd_var_run_t,s0)
11497
/var/run/libvirt/virtvboxd-sock-ro -s gen_context(system_u:object_r:virtvboxd_var_run_t,s0)
115-
/var/run/libvirt-sandbox(/.*)? gen_context(system_u:object_r:virt_lxc_var_run_t,s0)
116-
/var/run/vdsm(/.*)? gen_context(system_u:object_r:virt_var_run_t,s0)
117-
/var/run/qemu-pr-helper\.sock -s gen_context(system_u:object_r:virt_var_run_t,s0)
118-
119-
/var/vdsm(/.*)? gen_context(system_u:object_r:virt_var_run_t,s0)
120-
121-
# support for AEOLUS project
122-
/usr/bin/imagefactory -- gen_context(system_u:object_r:virtd_exec_t,s0)
123-
/usr/bin/imgfac\.py -- gen_context(system_u:object_r:virtd_exec_t,s0)
124-
/var/cache/oz(/.*)? gen_context(system_u:object_r:virt_cache_t,s0)
125-
/var/lib/imagefactory/images(/.*)? gen_context(system_u:object_r:virt_image_t,s0)
126-
/var/lib/oz(/.*)? gen_context(system_u:object_r:virt_var_lib_t,s0)
127-
/var/lib/oz/isos(/.*)? gen_context(system_u:object_r:virt_content_t,s0)
128-
/var/lib/vdsm(/.*)? gen_context(system_u:object_r:virt_content_t,s0)
129-
/var/lib/rkt/cas(/.*)? gen_context(system_u:object_r:container_file_t,s0)
130-
131-
# add support vios-proxy-*
132-
/usr/bin/vios-proxy-host -- gen_context(system_u:object_r:virtd_exec_t,s0)
133-
/usr/bin/vios-proxy-guest -- gen_context(system_u:object_r:virtd_exec_t,s0)
134-
135-
#support for vdsm
136-
/usr/share/vdsm/vdsm -- gen_context(system_u:object_r:virtd_exec_t,s0)
137-
/usr/share/vdsm/respawn -- gen_context(system_u:object_r:virtd_exec_t,s0)
138-
/usr/share/vdsm/supervdsmServer -- gen_context(system_u:object_r:virtd_exec_t,s0)
139-
/usr/share/vdsm/daemonAdapter -- gen_context(system_u:object_r:virtd_exec_t,s0)
140-
141-
# support for nova-stack
142-
/usr/bin/nova-compute -- gen_context(system_u:object_r:virtd_exec_t,s0)
143-
/usr/bin/qemu -- gen_context(system_u:object_r:qemu_exec_t,s0)
144-
/usr/bin/qemu-system-.* -- gen_context(system_u:object_r:qemu_exec_t,s0)
145-
/usr/bin/qemu-kvm -- gen_context(system_u:object_r:qemu_exec_t,s0)
146-
/usr/libexec/qemu.* -- gen_context(system_u:object_r:qemu_exec_t,s0)
147-
148-
/etc/qemu-ga/fsfreeze-hook.d(/.*)? gen_context(system_u:object_r:virt_qemu_ga_unconfined_exec_t,s0)
149-
/usr/libexec/qemu-ga/fsfreeze-hook.d(/.*)? gen_context(system_u:object_r:virt_qemu_ga_unconfined_exec_t,s0)
150-
/var/run/qemu-ga/fsfreeze-hook.d(/.*)? gen_context(system_u:object_r:virt_qemu_ga_unconfined_exec_t,s0)
151-
152-
/usr/libexec/qemu-ga(/.*)? gen_context(system_u:object_r:virt_qemu_ga_exec_t,s0)
153-
154-
/usr/lib/virt-sysprep/firstboot.sh -- gen_context(system_u:object_r:virtd_exec_t,s0)
15598

15699
/usr/lib/systemd/system/*virtlogd.* gen_context(system_u:object_r:virtlogd_unit_file_t,s0)
157100

158101
/usr/lib/systemd/system/virt.*\.service -- gen_context(system_u:object_r:virtd_unit_file_t,s0)
159102
/usr/lib/systemd/system/libvirt.*\.service -- gen_context(system_u:object_r:virtd_unit_file_t,s0)
160103
/usr/lib/systemd/system/.*xen.*\.service -- gen_context(system_u:object_r:virtd_unit_file_t,s0)
161-
162-
/usr/bin/qemu-ga -- gen_context(system_u:object_r:virt_qemu_ga_exec_t,s0)
163-
164-
/var/run/qemu-ga\.pid -- gen_context(system_u:object_r:virt_qemu_ga_var_run_t,s0)
165-
/var/run/qga\.state -- gen_context(system_u:object_r:virt_qemu_ga_var_run_t,s0)
166-
167-
/var/log/qemu-ga\.log.* -- gen_context(system_u:object_r:virt_qemu_ga_log_t,s0)
168-
/var/log/qemu-ga(/.*)? gen_context(system_u:object_r:virt_qemu_ga_log_t,s0)

‎virt.if‎

Lines changed: 2 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,8 @@ interface(`virt_stub_svirt_sandbox_file',`
6868
#
6969
template(`virt_domain_template',`
7070
gen_require(`
71-
attribute virt_image_type, virt_domain;
71+
attribute
72+
ge_type, virt_domain;
7273
attribute virt_tmpfs_type;
7374
attribute virt_ptynode;
7475
type qemu_exec_t;
@@ -244,22 +245,6 @@ interface(`virt_exec',`
244245
can_exec($1, virt_driver_executable)
245246
')
246247

247-
########################################
248-
## <summary>
249-
## Transition to virt_bridgehelper.
250-
## </summary>
251-
## <param name="domain">
252-
## <summary>
253-
## Domain allowed to transition.
254-
## </summary>
255-
## </param>
256-
interface(`virt_domtrans_bridgehelper',`
257-
gen_require(`
258-
type virt_bridgehelper_t, virt_bridgehelper_exec_t;
259-
')
260-
261-
domtrans_pattern($1, virt_bridgehelper_exec_t, virt_bridgehelper_t)
262-
')
263248

264249
#######################################
265250
## <summary>

‎virt.te‎

Lines changed: 0 additions & 220 deletions
Original file line numberDiff line numberDiff line change
@@ -172,34 +172,13 @@ gen_tunable(virt_sandbox_use_mknod, false)
172172
## </desc>
173173
gen_tunable(virt_sandbox_use_all_caps, true)
174174

175-
## <desc>
176-
## <p>
177-
## Allow qemu-ga to read qemu-ga date.
178-
## </p>
179-
## </desc>
180-
gen_tunable(virt_read_qemu_ga_data, false)
181-
182-
## <desc>
183-
## <p>
184-
## Allow qemu-ga to manage qemu-ga date.
185-
## </p>
186-
## </desc>
187-
gen_tunable(virt_rw_qemu_ga_data, false)
188-
189175
## <desc>
190176
## <p>
191177
## Allow virtlockd read and lock block devices.
192178
## </p>
193179
## </desc>
194180
gen_tunable(virt_lockd_blk_devs, false)
195181

196-
## <desc>
197-
## <p>
198-
## Allow qemu-ga read all non-security file types.
199-
## </p>
200-
## </desc>
201-
gen_tunable(virt_qemu_ga_read_nonsecurity_files, false)
202-
203182
virt_domain_template(svirt)
204183
role system_r types svirt_t;
205184
typealias svirt_t alias qemu_t;
@@ -299,34 +278,6 @@ ifdef(`enable_mls',`
299278
init_ranged_daemon_domain(virtlogd_t, virtlogd_exec_t, s0 - mls_systemhigh)
300279
')
301280

302-
303-
type virt_bridgehelper_t, virt_system_domain;
304-
domain_type(virt_bridgehelper_t)
305-
306-
type virt_bridgehelper_exec_t, virt_file_type;
307-
domain_entry_file(virt_bridgehelper_t, virt_bridgehelper_exec_t)
308-
role system_r types virt_bridgehelper_t;
309-
310-
# policy for qemu_ga
311-
type virt_qemu_ga_t, virt_system_domain;
312-
type virt_qemu_ga_exec_t, virt_file_type;
313-
init_daemon_domain(virt_qemu_ga_t, virt_qemu_ga_exec_t)
314-
315-
type virt_qemu_ga_var_run_t, virt_file_type;
316-
files_pid_file(virt_qemu_ga_var_run_t)
317-
318-
type virt_qemu_ga_log_t, virt_file_type;
319-
logging_log_file(virt_qemu_ga_log_t)
320-
321-
type virt_qemu_ga_tmp_t, virt_file_type;
322-
files_tmp_file(virt_qemu_ga_tmp_t)
323-
324-
type virt_qemu_ga_data_t, virt_file_type;
325-
files_type(virt_qemu_ga_data_t)
326-
327-
type virt_qemu_ga_unconfined_exec_t, virt_file_type;
328-
application_executable_file(virt_qemu_ga_unconfined_exec_t)
329-
330281
# virtinterfaced
331282
virt_driver_template(virtinterfaced)
332283

@@ -1706,31 +1657,6 @@ tunable_policy(`virt_sandbox_use_audit',`
17061657

17071658
userdom_use_user_ptys(svirt_qemu_net_t)
17081659

1709-
########################################
1710-
#
1711-
# virt_bridgehelper local policy
1712-
#
1713-
1714-
allow virt_bridgehelper_t self:process { setcap getcap };
1715-
allow virt_bridgehelper_t self:capability { setpcap setgid setuid net_admin };
1716-
allow virt_bridgehelper_t self:tcp_socket create_stream_socket_perms;
1717-
allow virt_bridgehelper_t self:tun_socket create_socket_perms;
1718-
allow virt_bridgehelper_t self:unix_dgram_socket create_socket_perms;
1719-
1720-
allow virt_bridgehelper_t virt_domain:unix_stream_socket { read write };
1721-
1722-
manage_files_pattern(virt_bridgehelper_t, svirt_home_t, svirt_home_t)
1723-
1724-
kernel_read_network_state(virt_bridgehelper_t)
1725-
kernel_read_system_state(virt_bridgehelper_t)
1726-
1727-
dev_read_urand(virt_bridgehelper_t)
1728-
dev_read_rand(virt_bridgehelper_t)
1729-
dev_read_sysfs(virt_bridgehelper_t)
1730-
1731-
corenet_rw_tun_tap_dev(virt_bridgehelper_t)
1732-
1733-
userdom_use_inherited_user_ptys(virt_bridgehelper_t)
17341660

17351661
#######################################
17361662
#
@@ -1920,152 +1846,6 @@ allow virtvboxd_t self:netlink_route_socket { bind create getattr setopt };
19201846
allow virtvboxd_t self:unix_dgram_socket create;
19211847
allow virtvboxd_t virt_etc_t:dir search;
19221848

1923-
#######################################
1924-
#
1925-
# virt_qemu_ga local policy
1926-
#
1927-
1928-
allow virt_qemu_ga_t self:capability { sys_admin sys_time sys_tty_config };
1929-
1930-
allow virt_qemu_ga_t self:passwd passwd;
1931-
1932-
allow virt_qemu_ga_t self:fifo_file rw_fifo_file_perms;
1933-
allow virt_qemu_ga_t self:unix_stream_socket create_stream_socket_perms;
1934-
1935-
allow virt_qemu_ga_t virt_qemu_ga_exec_t:dir search_dir_perms;
1936-
can_exec(virt_qemu_ga_t, virt_qemu_ga_exec_t)
1937-
1938-
manage_dirs_pattern(virt_qemu_ga_t, virt_qemu_ga_tmp_t, virt_qemu_ga_tmp_t)
1939-
manage_files_pattern(virt_qemu_ga_t, virt_qemu_ga_tmp_t, virt_qemu_ga_tmp_t)
1940-
files_tmp_filetrans(virt_qemu_ga_t, virt_qemu_ga_tmp_t, { file dir })
1941-
1942-
manage_files_pattern(virt_qemu_ga_t, virt_qemu_ga_var_run_t, virt_qemu_ga_var_run_t)
1943-
manage_dirs_pattern(virt_qemu_ga_t, virt_qemu_ga_var_run_t, virt_qemu_ga_var_run_t)
1944-
files_pid_filetrans(virt_qemu_ga_t, virt_qemu_ga_var_run_t, { dir file } )
1945-
1946-
manage_dirs_pattern(virt_qemu_ga_t, virt_qemu_ga_log_t, virt_qemu_ga_log_t)
1947-
manage_files_pattern(virt_qemu_ga_t, virt_qemu_ga_log_t, virt_qemu_ga_log_t)
1948-
logging_log_filetrans(virt_qemu_ga_t, virt_qemu_ga_log_t, { dir file })
1949-
1950-
kernel_read_system_state(virt_qemu_ga_t)
1951-
kernel_read_network_state(virt_qemu_ga_t)
1952-
kernel_rw_kernel_sysctl(virt_qemu_ga_t)
1953-
1954-
corecmd_exec_shell(virt_qemu_ga_t)
1955-
corecmd_exec_bin(virt_qemu_ga_t)
1956-
1957-
clock_read_adjtime(virt_qemu_ga_t)
1958-
1959-
dev_getattr_apm_bios_dev(virt_qemu_ga_t)
1960-
dev_rw_sysfs(virt_qemu_ga_t)
1961-
dev_rw_realtime_clock(virt_qemu_ga_t)
1962-
1963-
files_list_all_mountpoints(virt_qemu_ga_t)
1964-
files_write_all_mountpoints(virt_qemu_ga_t)
1965-
1966-
fs_list_all(virt_qemu_ga_t)
1967-
fs_getattr_all_fs(virt_qemu_ga_t)
1968-
1969-
term_use_virtio_console(virt_qemu_ga_t)
1970-
term_use_all_ttys(virt_qemu_ga_t)
1971-
term_use_unallocated_ttys(virt_qemu_ga_t)
1972-
1973-
auth_use_nsswitch(virt_qemu_ga_t)
1974-
1975-
logging_send_syslog_msg(virt_qemu_ga_t)
1976-
logging_send_audit_msgs(virt_qemu_ga_t)
1977-
1978-
init_read_utmp(virt_qemu_ga_t)
1979-
1980-
modutils_exec_kmod(virt_qemu_ga_t)
1981-
1982-
sysnet_dns_name_resolve(virt_qemu_ga_t)
1983-
1984-
systemd_exec_systemctl(virt_qemu_ga_t)
1985-
systemd_start_power_services(virt_qemu_ga_t)
1986-
systemd_dbus_chat_logind(virt_qemu_ga_t)
1987-
1988-
userdom_use_user_ptys(virt_qemu_ga_t)
1989-
1990-
usermanage_domtrans_passwd(virt_qemu_ga_t)
1991-
1992-
tunable_policy(`virt_qemu_ga_read_nonsecurity_files',`
1993-
files_read_non_security_files(virt_qemu_ga_t)
1994-
')
1995-
1996-
tunable_policy(`virt_read_qemu_ga_data',`
1997-
read_files_pattern(virt_qemu_ga_t, virt_qemu_ga_data_t, virt_qemu_ga_data_t)
1998-
read_lnk_files_pattern(virt_qemu_ga_t, virt_qemu_ga_data_t, virt_qemu_ga_data_t)
1999-
')
2000-
2001-
tunable_policy(`virt_rw_qemu_ga_data',`
2002-
manage_files_pattern(virt_qemu_ga_t, virt_qemu_ga_data_t, virt_qemu_ga_data_t)
2003-
manage_lnk_files_pattern(virt_qemu_ga_t, virt_qemu_ga_data_t, virt_qemu_ga_data_t)
2004-
manage_dirs_pattern(virt_qemu_ga_t, virt_qemu_ga_data_t, virt_qemu_ga_data_t)
2005-
')
2006-
2007-
optional_policy(`
2008-
bootloader_domtrans(virt_qemu_ga_t)
2009-
')
2010-
2011-
optional_policy(`
2012-
clock_domtrans(virt_qemu_ga_t)
2013-
')
2014-
2015-
optional_policy(`
2016-
dbus_system_bus_client(virt_qemu_ga_t)
2017-
')
2018-
2019-
optional_policy(`
2020-
cron_initrc_domtrans(virt_qemu_ga_t)
2021-
cron_domtrans(virt_qemu_ga_t)
2022-
')
2023-
2024-
optional_policy(`
2025-
devicekit_manage_pid_files(virt_qemu_ga_t)
2026-
devicekit_read_log_files(virt_qemu_ga_t)
2027-
')
2028-
2029-
optional_policy(`
2030-
fstools_domtrans(virt_qemu_ga_t)
2031-
')
2032-
2033-
optional_policy(`
2034-
rpm_dbus_chat(virt_qemu_ga_t)
2035-
')
2036-
2037-
optional_policy(`
2038-
shutdown_domtrans(virt_qemu_ga_t)
2039-
')
2040-
2041-
optional_policy(`
2042-
udev_read_pid_files(virt_qemu_ga_t)
2043-
')
2044-
2045-
#######################################
2046-
#
2047-
# qemu-ga unconfined hook script local policy
2048-
#
2049-
2050-
optional_policy(`
2051-
type virt_qemu_ga_unconfined_t;
2052-
domain_type(virt_qemu_ga_unconfined_t)
2053-
2054-
domain_entry_file(virt_qemu_ga_unconfined_t, virt_qemu_ga_unconfined_exec_t)
2055-
role system_r types virt_qemu_ga_unconfined_t;
2056-
2057-
domtrans_pattern(virt_qemu_ga_t, virt_qemu_ga_unconfined_exec_t, virt_qemu_ga_unconfined_t)
2058-
2059-
allow virt_qemu_ga_t virt_qemu_ga_unconfined_exec_t:dir search_dir_perms;
2060-
allow virt_qemu_ga_t virt_qemu_ga_unconfined_exec_t:dir read_file_perms;
2061-
allow virt_qemu_ga_t virt_qemu_ga_unconfined_exec_t:file ioctl;
2062-
2063-
init_domtrans_script(virt_qemu_ga_unconfined_t)
2064-
2065-
optional_policy(`
2066-
unconfined_domain(virt_qemu_ga_unconfined_t)
2067-
')
2068-
')
20691849

20701850
#######################################
20711851
#

0 commit comments

Comments
 (0)