blob: 7bd14020eb06492aae6e673b48cfb3c042cc8932 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
|
From 5dbfff582a9c7745f8517adefb27c5f90653f8fa Mon Sep 17 00:00:00 2001
From: Wenzong Fan <wenzong.fan@windriver.com>
Date: Wed, 25 May 2016 03:16:24 -0400
Subject: [PATCH] policy/modules/services/rngd: fix security context for
rng-tools
* Fix security context for /etc/init.d/rng-tools
* Allow rngd_t to read sysfs
Fixes:
avc: denied { read } for pid=355 comm="rngd" name="cpu" dev="sysfs"
ino=36 scontext=system_u:system_r:rngd_t
tcontext=system_u:object_r:sysfs_t tclass=dir permissive=1
avc: denied { getsched } for pid=355 comm="rngd"
scontext=system_u:system_r:rngd_t tcontext=system_u:system_r:rngd_t
tclass=process permissive=1
avc: denied { setsched } for pid=355 comm="rngd"
scontext=system_u:system_r:rngd_t tcontext=system_u:system_r:rngd_t
tclass=process permissive=1
Upstream-Status: Inappropriate [embedded specific]
Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
---
policy/modules/services/rngd.fc | 1 +
policy/modules/services/rngd.te | 3 ++-
2 files changed, 3 insertions(+), 1 deletion(-)
diff --git a/policy/modules/services/rngd.fc b/policy/modules/services/rngd.fc
index 382c067f9..0ecc5acc4 100644
--- a/policy/modules/services/rngd.fc
+++ b/policy/modules/services/rngd.fc
@@ -1,4 +1,5 @@
/etc/rc\.d/init\.d/rngd -- gen_context(system_u:object_r:rngd_initrc_exec_t,s0)
+/etc/rc\.d/init\.d/rng-tools -- gen_context(system_u:object_r:rngd_initrc_exec_t,s0)
/usr/bin/rngd -- gen_context(system_u:object_r:rngd_exec_t,s0)
diff --git a/policy/modules/services/rngd.te b/policy/modules/services/rngd.te
index 4540e4ec7..48f08fb48 100644
--- a/policy/modules/services/rngd.te
+++ b/policy/modules/services/rngd.te
@@ -21,7 +21,7 @@ files_runtime_file(rngd_runtime_t)
#
allow rngd_t self:capability { ipc_lock sys_admin };
-allow rngd_t self:process signal;
+allow rngd_t self:process { signal getsched setsched };
allow rngd_t self:fifo_file rw_fifo_file_perms;
allow rngd_t self:unix_stream_socket { accept listen };
@@ -34,6 +34,7 @@ dev_read_rand(rngd_t)
dev_read_urand(rngd_t)
dev_rw_tpm(rngd_t)
dev_write_rand(rngd_t)
+dev_read_sysfs(rngd_t)
files_read_etc_files(rngd_t)
--
2.17.1
|
