@@ -114,13 +114,15 @@ template(`virt_driver_template',`
114114 gen_require(`
115115 attribute virt_driver_domain;
116116 attribute virt_driver_executable;
117+ attribute virt_driver_var_run;
117118 ')
118119
119120 type $1_t, virt_driver_domain;
121+
120122 type $1_exec_t, virt_driver_executable;
121123 init_daemon_domain($1_t, $1_exec_t)
122124
123- type $1_var_run_t;
125+ type $1_var_run_t, virt_driver_var_run ;
124126 files_pid_file($1_var_run_t)
125127
126128 ##################################
@@ -139,11 +141,11 @@ template(`virt_driver_template',`
139141 manage_files_pattern($1_t, $1_var_run_t, $1_var_run_t)
140142 manage_sock_files_pattern($1_t, virt_var_run_t, $1_var_run_t)
141143 files_pid_filetrans($1_t, $1_var_run_t, { dir file sock_file } )
142- filetrans_pattern($1_t, virt_var_run_t, $1_var_run_t, { dir file sock_file } )
143144
144145 read_files_pattern($1_t, virt_etc_t, virt_etc_t)
145146 manage_dirs_pattern($1_t, virt_etc_rw_t, virt_etc_rw_t)
146147 manage_files_pattern($1_t, virt_etc_rw_t, virt_etc_rw_t)
148+ filetrans_pattern($1_t, virt_etc_t, virt_etc_rw_t, dir)
147149
148150 allow virt_driver_domain virtqemud_t:unix_stream_socket connectto;
149151 read_files_pattern(virt_driver_domain, virtqemud_t, virtqemud_t)
@@ -157,13 +159,28 @@ template(`virt_driver_template',`
157159
158160 dev_read_sysfs($1_t)
159161
162+ files_read_non_security_files($1_t)
160163 init_read_utmp($1_t)
161164
162165 logging_send_syslog_msg($1_t)
163166
164167 miscfiles_read_generic_certs($1_t)
165168
169+ virt_manage_cache($1_t)
170+ virt_manage_pid_files($1_t)
171+ virt_stream_connect($1_t)
172+
173+ optional_policy(`
174+ dbus_system_bus_client($1_t)
175+ ')
176+
166177 optional_policy(`
178+ dnsmasq_filetrans_named_content_fromdir($1_t, $1_var_run_t)
179+ ')
180+
181+ optional_policy(`
182+ systemd_dbus_chat_logind($1_t)
183+ systemd_machined_stream_connect($1_t)
167184 systemd_write_inhibit_pipes($1_t)
168185 ')
169186')
@@ -202,6 +219,7 @@ interface(`virt_image',`
202219#
203220interface(`virt_getattr_exec',`
204221 gen_require(`
222+ attribute virt_driver_executable;
205223 type virtd_exec_t;
206224 ')
207225
@@ -239,6 +257,7 @@ interface(`virt_domtrans',`
239257#
240258interface(`virt_exec',`
241259 gen_require(`
260+ attribute virt_driver_executable;
242261 type virtd_exec_t;
243262 ')
244263
@@ -261,13 +280,33 @@ interface(`virt_stream_connect',`
261280 attribute virt_driver_domain;
262281 attribute virt_driver_var_run;
263282 type virtd_t, virt_var_run_t;
264- ')
283+ ')
265284
266285 files_search_pids($1)
267286 stream_connect_pattern($1, virt_var_run_t, virt_var_run_t, virtd_t)
268- stream_connect_pattern($1, virt_driver_var_run, virt_driver_var_run, virt_driver_domain)
287+ stream_connect_pattern($1, virt_driver_var_run, virt_driver_var_run, virt_driver_domain)
269288')
270289
290+ ########################################
291+ ## <summary>
292+ ## Read and write to virt_domain unix
293+ ## stream sockets.
294+ ## </summary>
295+ ## <param name="domain">
296+ ## <summary>
297+ ## Domain allowed access.
298+ ## </summary>
299+ ## </param>
300+ #
301+ interface(`virt_rw_stream_sockets_virt_domain',`
302+ gen_require(`
303+ attribute virt_domain;
304+ ')
305+
306+ allow $1 virt_domain:unix_stream_socket { read write };
307+ ')
308+
309+
271310#######################################
272311## <summary>
273312## Connect to svirt process over a unix domain stream socket.
@@ -1252,7 +1291,7 @@ interface(`virt_signal',`
12521291#
12531292interface(`virt_signull',`
12541293 gen_require(`
1255- virt_driver_domain;
1294+ attribute virt_driver_domain;
12561295 type virtd_t;
12571296 ')
12581297
@@ -1402,6 +1441,43 @@ interface(`virt_dontaudit_read_chr_dev',`
14021441 dontaudit $1 virt_image_type:chr_file read_chr_file_perms;
14031442')
14041443
1444+ ########################################
1445+ ## <summary>
1446+ ## Make the specified type usable as a virt file type
1447+ ## </summary>
1448+ ## <param name="type">
1449+ ## <summary>
1450+ ## Type to be used as a virt file type
1451+ ## </summary>
1452+ ## </param>
1453+ #
1454+ interface(`virt_file_types',`
1455+ gen_require(`
1456+ attribute virt_file_type;
1457+ ')
1458+
1459+ typeattribute $1 virt_file_type;
1460+ ')
1461+
1462+ ########################################
1463+ ## <summary>
1464+ ## Make the specified type usable as a svirt file type
1465+ ## </summary>
1466+ ## <param name="type">
1467+ ## <summary>
1468+ ## Type to be used as a svirt file type
1469+ ## </summary>
1470+ ## </param>
1471+ #
1472+ interface(`svirt_file_types',`
1473+ gen_require(`
1474+ attribute svirt_file_type;
1475+ ')
1476+
1477+ typeattribute $1 svirt_file_type;
1478+ ')
1479+
1480+
14051481########################################
14061482## <summary>
14071483## Creates types and rules for a basic
@@ -1472,6 +1548,24 @@ template(`virt_sandbox_net_domain',`
14721548 typeattribute $1 sandbox_net_domain;
14731549')
14741550
1551+ ########################################
1552+ ## <summary>
1553+ ## Make the specified type usable as a virt system domain
1554+ ## </summary>
1555+ ## <param name="type">
1556+ ## <summary>
1557+ ## Type to be used as a virt system domain
1558+ ## </summary>
1559+ ## </param>
1560+ #
1561+ interface(`virt_system_domain_type',`
1562+ gen_require(`
1563+ attribute virt_system_domain;
1564+ ')
1565+
1566+ typeattribute $1 virt_system_domain;
1567+ ')
1568+
14751569########################################
14761570## <summary>
14771571## Execute a qemu_exec_t in the callers domain
@@ -1802,6 +1896,26 @@ interface(`virt_dgram_send',`
18021896 dgram_send_pattern($1, virt_var_run_t, virt_var_run_t, virtd_t)
18031897')
18041898
1899+ ########################################
1900+ ## <summary>
1901+ ## Manage svirt home files,dirs and sockfiles.
1902+ ## </summary>
1903+ ## <param name="domain">
1904+ ## <summary>
1905+ ## Domain allowed access.
1906+ ## </summary>
1907+ ## </param>
1908+ #
1909+ interface(`virt_svirt_manage_home',`
1910+ gen_require(`
1911+ type svirt_home_t;
1912+ ')
1913+
1914+ manage_files_pattern($1, svirt_home_t, svirt_home_t)
1915+ manage_dirs_pattern($1, svirt_home_t, svirt_home_t)
1916+ manage_sock_files_pattern($1, svirt_home_t, svirt_home_t)
1917+ ')
1918+
18051919########################################
18061920## <summary>
18071921## Manage svirt tmp files,dirs and sockfiles.
0 commit comments