Stephen Smalley wrote:
> On Fri, 2006-10-13 at 17:12 +0100, Robin Bowes wrote:
>> Stephen Smalley wrote:
>>> The assertion is to prevent accidental granting of read access to a
>>> raw disk device. Is that truly required here?
>> Probably - the root disk of the guest O/S instance is an lvm partition,
>> e.g. /dev/vg01/lv_guest
>>
>>> To allow it, you need to use the interface for it, e.g.
>>> storage_raw_read_fixed_disk(xm_t) That interface is defined in
>>> kernel/storage.if. In addition to allowing the permission, it adds a
>>> type attribute to the type that excludes from the assertion.
>> So, what would that look like in the policy file?
>
> If you build using the devel makefile (e.g. make
> -f /usr/share/selinux/devel/Makefile or copy it over to where you are
> working on your module), then you can use the interface as I described,
> i.e. just put
> storage_raw_read_fixed_disk(xm_t)
> in your .te file.
>
> That Makefile will pull in the headers and expand it properly.
> Should handle the checkmodule and semodule_package side of things,
> leaving you with just running semodule -i to install it once built.
I'm actually doing this:
Use audit2allow to identify AVC denied msgs:
audit2allow -M local -l -i /var/log/audit/audit.log
Copy the contents of the local.te file produced by the command to xen.te
Compile and install the policy like this:
export SEAPP=xen
checkmodule -M -m -o ${SEAPP}.mod ${SEAPP}.te
semodule_package -o ${SEAPP}.pp -m ${SEAPP}.mod
semodule -i ${SEAPP}.pp
Will "storage_raw_read_fixed_disk(xm_t)" fit into the class/type/role
format used in the .te files? Or do I need to do something different?
Thanks for your help with this.
R.
--
fedora-selinux-list mailing list
fedora-selinux-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
