Attachment 860298 Details for Bug 1062386 – patch to add necessary permissions to qemu-guest-agent

[patch] patch to add necessary permissions to qemu-guest-agent

sepolicy-qemu-guest-agent.patch (text/plain), 1.36 KB, created by Marcelo Tosatti on 2014-02-06 19:13:23 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Marcelo Tosatti

Created: 2014-02-06 19:13:23 UTC

Size: 1.36 KB

patch

obsolete

>diff -u policy/modules/contrib/virt.te policy/modules/contrib/virt.te
>--- policy/modules/contrib/virt.te	2014-02-06 11:48:56.439395627 -0200
>+++ policy/modules/contrib/virt.te	2014-02-06 13:29:54.413314430 -0500
>@@ -8,6 +8,14 @@
> gen_require(`
>     class passwd rootok;
>     class passwd passwd;
>+    type clock_device_t;
>+    type adjtime_t;
>+    type virt_qemu_ga_t;
>+    type hwclock_exec_t;
>+    class capability audit_write;
>+    class file { execute read execute_no_trans write getattr open };
>+    class chr_file { read ioctl open };
>+    class netlink_audit_socket { nlmsg_relay create };
> ')
> 
> attribute virsh_transition_domain;
>@@ -1419,10 +1427,15 @@
> # virt_qemu_ga local policy
> #
> 
>-allow virt_qemu_ga_t self:capability { sys_admin sys_tty_config };
>+allow virt_qemu_ga_t self:capability { sys_admin sys_tty_config sys_time audit_write };
> 
> allow virt_qemu_ga_t self:fifo_file rw_fifo_file_perms;
> allow virt_qemu_ga_t self:unix_stream_socket create_stream_socket_perms;
>+allow virt_qemu_ga_t hwclock_exec_t:file { read execute open execute_no_trans };
>+allow virt_qemu_ga_t self:netlink_audit_socket { nlmsg_relay create };
>+allow virt_qemu_ga_t adjtime_t:file { read write getattr open };
>+allow virt_qemu_ga_t clock_device_t:chr_file { read ioctl open };
>+
> 
> allow virt_qemu_ga_t virt_qemu_ga_exec_t:dir search_dir_perms;
> can_exec(virt_qemu_ga_t, virt_qemu_ga_exec_t)

Actions: View | Diff

Attachments on bug 1062386: 860298