@@ -114,13 +114,15 @@ template(`virt_driver_template',`
114114 gen_require(`
115115 attribute virt_driver_domain;
116116 attribute virt_driver_executable;
117+ attribute virt_driver_var_run;
117118 ')
118119
119120 type $1_t, virt_driver_domain;
121+
120122 type $1_exec_t, virt_driver_executable;
121123 init_daemon_domain($1_t, $1_exec_t)
122124
123- type $1_var_run_t;
125+ type $1_var_run_t, virt_driver_var_run ;
124126 files_pid_file($1_var_run_t)
125127
126128 ##################################
@@ -139,11 +141,11 @@ template(`virt_driver_template',`
139141 manage_files_pattern($1_t, $1_var_run_t, $1_var_run_t)
140142 manage_sock_files_pattern($1_t, virt_var_run_t, $1_var_run_t)
141143 files_pid_filetrans($1_t, $1_var_run_t, { dir file sock_file } )
142- filetrans_pattern($1_t, virt_var_run_t, $1_var_run_t, { dir file sock_file } )
143144
144145 read_files_pattern($1_t, virt_etc_t, virt_etc_t)
145146 manage_dirs_pattern($1_t, virt_etc_rw_t, virt_etc_rw_t)
146147 manage_files_pattern($1_t, virt_etc_rw_t, virt_etc_rw_t)
148+ filetrans_pattern($1_t, virt_etc_t, virt_etc_rw_t, dir)
147149
148150 allow virt_driver_domain virtqemud_t:unix_stream_socket connectto;
149151 read_files_pattern(virt_driver_domain, virtqemud_t, virtqemud_t)
@@ -157,13 +159,28 @@ template(`virt_driver_template',`
157159
158160 dev_read_sysfs($1_t)
159161
162+ files_read_non_security_files($1_t)
160163 init_read_utmp($1_t)
161164
162165 logging_send_syslog_msg($1_t)
163166
164167 miscfiles_read_generic_certs($1_t)
165168
169+ virt_manage_cache($1_t)
170+ virt_manage_pid_files($1_t)
171+ virt_stream_connect($1_t)
172+
173+ optional_policy(`
174+ dbus_system_bus_client($1_t)
175+ ')
176+
177+ optional_policy(`
178+ dnsmasq_filetrans_named_content_fromdir($1_t, $1_var_run_t)
179+ ')
180+
166181 optional_policy(`
182+ systemd_dbus_chat_logind($1_t)
183+ systemd_machined_stream_connect($1_t)
167184 systemd_write_inhibit_pipes($1_t)
168185 ')
169186')
@@ -202,6 +219,7 @@ interface(`virt_image',`
202219#
203220interface(`virt_getattr_exec',`
204221 gen_require(`
222+ attribute virt_driver_executable;
205223 type virtd_exec_t;
206224 ')
207225
@@ -239,6 +257,7 @@ interface(`virt_domtrans',`
239257#
240258interface(`virt_exec',`
241259 gen_require(`
260+ attribute virt_driver_executable;
242261 type virtd_exec_t;
243262 ')
244263
@@ -261,13 +280,33 @@ interface(`virt_stream_connect',`
261280 attribute virt_driver_domain;
262281 attribute virt_driver_var_run;
263282 type virtd_t, virt_var_run_t;
264- ')
283+ ')
265284
266285 files_search_pids($1)
267286 stream_connect_pattern($1, virt_var_run_t, virt_var_run_t, virtd_t)
268- stream_connect_pattern($1, virt_driver_var_run, virt_driver_var_run, virt_driver_domain)
287+ stream_connect_pattern($1, virt_driver_var_run, virt_driver_var_run, virt_driver_domain)
288+ ')
289+
290+ ########################################
291+ ## <summary>
292+ ## Read and write to virt_domain unix
293+ ## stream sockets.
294+ ## </summary>
295+ ## <param name="domain">
296+ ## <summary>
297+ ## Domain allowed access.
298+ ## </summary>
299+ ## </param>
300+ #
301+ interface(`virt_rw_stream_sockets_virt_domain',`
302+ gen_require(`
303+ attribute virt_domain;
304+ ')
305+
306+ allow $1 virt_domain:unix_stream_socket { read write };
269307')
270308
309+
271310#######################################
272311## <summary>
273312## Connect to svirt process over a unix domain stream socket.
@@ -908,6 +947,24 @@ interface(`virt_manage_default_image_type',`
908947 read_lnk_files_pattern($1, virt_image_t, virt_image_t)
909948')
910949
950+ #######################################
951+ ## <summary>
952+ ## Get virtd services status
953+ ## </summary>
954+ ## <param name="domain">
955+ ## <summary>
956+ ## Domain allowed to transition.
957+ ## </summary>
958+ ## </param>
959+ #
960+ interface(`virtd_service_status',`
961+ gen_require(`
962+ type virtd_unit_file_t;
963+ ')
964+
965+ allow $1 virtd_unit_file_t:service status;
966+ ')
967+
911968########################################
912969## <summary>
913970## Execute virt server in the virt domain.
@@ -1252,7 +1309,7 @@ interface(`virt_signal',`
12521309#
12531310interface(`virt_signull',`
12541311 gen_require(`
1255- virt_driver_domain;
1312+ attribute virt_driver_domain;
12561313 type virtd_t;
12571314 ')
12581315
@@ -1402,6 +1459,43 @@ interface(`virt_dontaudit_read_chr_dev',`
14021459 dontaudit $1 virt_image_type:chr_file read_chr_file_perms;
14031460')
14041461
1462+ ########################################
1463+ ## <summary>
1464+ ## Make the specified type usable as a virt file type
1465+ ## </summary>
1466+ ## <param name="type">
1467+ ## <summary>
1468+ ## Type to be used as a virt file type
1469+ ## </summary>
1470+ ## </param>
1471+ #
1472+ interface(`virt_file_types',`
1473+ gen_require(`
1474+ attribute virt_file_type;
1475+ ')
1476+
1477+ typeattribute $1 virt_file_type;
1478+ ')
1479+
1480+ ########################################
1481+ ## <summary>
1482+ ## Make the specified type usable as a svirt file type
1483+ ## </summary>
1484+ ## <param name="type">
1485+ ## <summary>
1486+ ## Type to be used as a svirt file type
1487+ ## </summary>
1488+ ## </param>
1489+ #
1490+ interface(`svirt_file_types',`
1491+ gen_require(`
1492+ attribute svirt_file_type;
1493+ ')
1494+
1495+ typeattribute $1 svirt_file_type;
1496+ ')
1497+
1498+
14051499########################################
14061500## <summary>
14071501## Creates types and rules for a basic
@@ -1472,6 +1566,24 @@ template(`virt_sandbox_net_domain',`
14721566 typeattribute $1 sandbox_net_domain;
14731567')
14741568
1569+ ########################################
1570+ ## <summary>
1571+ ## Make the specified type usable as a virt system domain
1572+ ## </summary>
1573+ ## <param name="type">
1574+ ## <summary>
1575+ ## Type to be used as a virt system domain
1576+ ## </summary>
1577+ ## </param>
1578+ #
1579+ interface(`virt_system_domain_type',`
1580+ gen_require(`
1581+ attribute virt_system_domain;
1582+ ')
1583+
1584+ typeattribute $1 virt_system_domain;
1585+ ')
1586+
14751587########################################
14761588## <summary>
14771589## Execute a qemu_exec_t in the callers domain
@@ -1802,6 +1914,26 @@ interface(`virt_dgram_send',`
18021914 dgram_send_pattern($1, virt_var_run_t, virt_var_run_t, virtd_t)
18031915')
18041916
1917+ ########################################
1918+ ## <summary>
1919+ ## Manage svirt home files,dirs and sockfiles.
1920+ ## </summary>
1921+ ## <param name="domain">
1922+ ## <summary>
1923+ ## Domain allowed access.
1924+ ## </summary>
1925+ ## </param>
1926+ #
1927+ interface(`virt_svirt_manage_home',`
1928+ gen_require(`
1929+ type svirt_home_t;
1930+ ')
1931+
1932+ manage_files_pattern($1, svirt_home_t, svirt_home_t)
1933+ manage_dirs_pattern($1, svirt_home_t, svirt_home_t)
1934+ manage_sock_files_pattern($1, svirt_home_t, svirt_home_t)
1935+ ')
1936+
18051937########################################
18061938## <summary>
18071939## Manage svirt tmp files,dirs and sockfiles.
0 commit comments