Bug 2029392

Summary:	/dev/tmc_etr* have device_t
Product:	Red Hat Enterprise Linux 9	Reporter:	Jan Pazdziora (Red Hat) <jpazdziora>
Component:	selinux-policy	Assignee:	Zdenek Pytela <zpytela>
Status:	CLOSED ERRATA	QA Contact:	Milos Malik <mmalik>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	9.0	CC:	lvrabec, mmalik, omosnace, ssekidde
Target Milestone:	rc	Keywords:	AutoVerified, Triaged
Target Release:	9.0	Flags:	pm-rhel: mirror+
Hardware:	Unspecified
OS:	Linux
Whiteboard:
Fixed In Version:	selinux-policy-34.1.20-1.el9	Doc Type:	No Doc Update
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-05-17 15:50:02 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Jan Pazdziora (Red Hat) 2021-12-06 11:50:17 UTC

Description of problem:

On one ARM machine, we've observed /dev/tmc_etr0 and /dev/tmc_etr1 with device_t type.

Version-Release number of selected component (if applicable):

selinux-policy-34.1.18-1.el9.noarch

How reproducible:

Deterministic.

Steps to Reproduce:
1. ls -laZ /dev/tmc_etr* | grep device_t

Actual results:

crw-------. 1 root root system_u:object_r:device_t:s0 10, 124 Dec  6  2021 /dev/tmc_etr0
crw-------. 1 root root system_u:object_r:device_t:s0 10, 122 Dec  6  2021 /dev/tmc_etr1

Expected results:

No output.

Additional info:

Comment 2 Zdenek Pytela 2021-12-06 13:44:45 UTC

Ondrej,

Can you help me with understanding these devices purpose? Do we need a new type? I've found them in drivers/hwtracing/coresight:

tmc_etb
tmc_etf
tmc_etr
possibly also
etb
stm
tpiu

The request was for /dev/tmc_etr[0-9]+ only though.

Comment 3 Ondrej Mosnacek 2021-12-06 14:39:00 UTC

The devices seem to be intended for HW-level tracing and debugging of software (I guess mainly for low-level performance debugging) [1]. I can't see any suitable existing type in the policy - perhaps a new hwtracing_device_t would be best? (We could then reuse it for other devices coming from drivers/hwtracing if needed.)

[1] https://developer.arm.com/ip-products/system-ip/coresight-debug-and-trace

Comment 4 Zdenek Pytela 2021-12-15 12:19:19 UTC

I've submitted a Fedora PR to address the issue:
https://github.com/fedora-selinux/selinux-policy/pull/975

Please note only a new type was added for the devices, no actual access allowed for domains which do not have access to the device_node attribute.

Comment 15 errata-xmlrpc 2022-05-17 15:50:02 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (new packages: selinux-policy), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:3918