|
 |
b4b0268 |
diff -up serefpolicy-3.10.0/policy/modules/apps/qemu.te.qemu serefpolicy-3.10.0/policy/modules/apps/qemu.te
|
|
|
8872d3d |
--- serefpolicy-3.10.0/policy/modules/apps/qemu.te.qemu 2011-11-04 13:28:26.200380523 -0400
|
|
|
8872d3d |
+++ serefpolicy-3.10.0/policy/modules/apps/qemu.te 2011-11-04 13:28:27.042380389 -0400
|
|
|
b4b0268 |
@@ -40,9 +40,7 @@ gen_tunable(qemu_use_nfs, true)
|
|
|
b4b0268 |
## </desc>
|
|
|
b4b0268 |
gen_tunable(qemu_use_usb, true)
|
|
|
b4b0268 |
|
|
|
b4b0268 |
-type qemu_exec_t;
|
|
|
b4b0268 |
virt_domain_template(qemu)
|
|
|
b4b0268 |
-application_domain(qemu_t, qemu_exec_t)
|
|
|
b4b0268 |
role system_r types qemu_t;
|
|
|
b4b0268 |
|
|
|
b4b0268 |
########################################
|
|
|
b4b0268 |
diff -up serefpolicy-3.10.0/policy/modules/services/virt.if.qemu serefpolicy-3.10.0/policy/modules/services/virt.if
|
|
|
8872d3d |
--- serefpolicy-3.10.0/policy/modules/services/virt.if.qemu 2011-11-04 13:28:27.013380393 -0400
|
|
|
8872d3d |
+++ serefpolicy-3.10.0/policy/modules/services/virt.if 2011-11-04 13:28:27.044380389 -0400
|
|
|
b4b0268 |
@@ -16,10 +16,11 @@ template(`virt_domain_template',`
|
|
|
b4b0268 |
attribute virt_image_type, virt_domain;
|
|
|
b4b0268 |
attribute virt_tmpfs_type;
|
|
|
b4b0268 |
attribute virt_ptynode;
|
|
|
b4b0268 |
+ type qemu_exec_t;
|
|
|
b4b0268 |
')
|
|
|
b4b0268 |
|
|
|
b4b0268 |
type $1_t, virt_domain;
|
|
|
b4b0268 |
- domain_type($1_t)
|
|
|
b4b0268 |
+ application_domain($1_t, qemu_exec_t)
|
|
|
b4b0268 |
domain_user_exemption_target($1_t)
|
|
|
b4b0268 |
mls_rangetrans_target($1_t)
|
|
|
b4b0268 |
mcs_untrusted_proc($1_t)
|
|
|
b4b0268 |
@@ -848,3 +849,21 @@ template(`virt_lxc_domain_template',`
|
|
|
b4b0268 |
role system_r types $1_t;
|
|
|
b4b0268 |
')
|
|
|
b4b0268 |
|
|
|
b4b0268 |
+########################################
|
|
|
b4b0268 |
+## <summary>
|
|
|
b4b0268 |
+## Execute a qemu_exec_t in the callers domain
|
|
|
b4b0268 |
+## </summary>
|
|
|
b4b0268 |
+## <param name="domain">
|
|
|
b4b0268 |
+## <summary>
|
|
|
b4b0268 |
+## Domain allowed access.
|
|
|
b4b0268 |
+## </summary>
|
|
|
b4b0268 |
+## </param>
|
|
|
b4b0268 |
+#
|
|
|
b4b0268 |
+interface(`virt_exec_qemu',`
|
|
|
b4b0268 |
+ gen_require(`
|
|
|
b4b0268 |
+ type qemu_exec_t;
|
|
|
b4b0268 |
+ ')
|
|
|
b4b0268 |
+
|
|
|
b4b0268 |
+ can_exec($1, qemu_exec_t)
|
|
|
b4b0268 |
+')
|
|
|
b4b0268 |
+
|
|
|
b4b0268 |
diff -up serefpolicy-3.10.0/policy/modules/services/virt.te.qemu serefpolicy-3.10.0/policy/modules/services/virt.te
|
|
|
8872d3d |
--- serefpolicy-3.10.0/policy/modules/services/virt.te.qemu 2011-11-04 13:28:27.015380393 -0400
|
|
|
8872d3d |
+++ serefpolicy-3.10.0/policy/modules/services/virt.te 2011-11-04 13:30:30.832359916 -0400
|
|
|
26536c5 |
@@ -73,11 +73,14 @@ gen_tunable(virt_use_usb, true)
|
|
|
26536c5 |
|
|
|
26536c5 |
virt_domain_template(svirt)
|
|
|
26536c5 |
role system_r types svirt_t;
|
|
|
26536c5 |
+typealias svirt_t alias qemu_t;
|
|
|
26536c5 |
|
|
|
26536c5 |
attribute virt_domain;
|
|
|
b4b0268 |
attribute virt_image_type;
|
|
|
b4b0268 |
attribute virt_tmpfs_type;
|
|
|
b4b0268 |
|
|
|
b4b0268 |
+type qemu_exec_t;
|
|
|
b4b0268 |
+
|
|
|
b4b0268 |
type virt_cache_t alias svirt_cache_t;
|
|
|
b4b0268 |
files_type(virt_cache_t)
|
|
|
b4b0268 |
|
|
|
8872d3d |
@@ -275,6 +278,9 @@ allow virtd_t virt_domain:process { geta
|
|
|
b4b0268 |
allow virt_domain virtd_t:fd use;
|
|
|
b4b0268 |
dontaudit virt_domain virtd_t:unix_stream_socket { read write };
|
|
|
b4b0268 |
|
|
|
8f22f8e |
+can_exec(virtd_t, qemu_exec_t)
|
|
|
b4b0268 |
+can_exec(virt_domain, qemu_exec_t)
|
|
|
b4b0268 |
+
|
|
|
b4b0268 |
allow virtd_t qemu_var_run_t:file relabel_file_perms;
|
|
|
b4b0268 |
manage_dirs_pattern(virtd_t, qemu_var_run_t, qemu_var_run_t)
|
|
|
b4b0268 |
manage_files_pattern(virtd_t, qemu_var_run_t, qemu_var_run_t)
|
|
|
8872d3d |
@@ -643,11 +649,6 @@ optional_policy(`
|
|
|
b4b0268 |
')
|
|
|
b4b0268 |
|
|
|
b4b0268 |
optional_policy(`
|
|
|
8872d3d |
- qemu_entry_type(virt_domain)
|
|
|
8872d3d |
- qemu_exec(virt_domain)
|
|
|
b4b0268 |
-')
|
|
|
b4b0268 |
-
|
|
|
b4b0268 |
-optional_policy(`
|
|
|
8872d3d |
virt_read_config(virt_domain)
|
|
|
8872d3d |
virt_read_lib_files(virt_domain)
|
|
|
8872d3d |
virt_read_content(virt_domain)
|