Bug 885836
Summary: | Create a svirt_tcg_t type extending svirt_t to allow execmem | |||
---|---|---|---|---|
Product: | [Fedora] Fedora | Reporter: | Daniel Berrangé <berrange> | |
Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> | |
Status: | CLOSED CURRENTRELEASE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | |
Severity: | unspecified | Docs Contact: | ||
Priority: | unspecified | |||
Version: | rawhide | CC: | crobinso, dominick.grift, dwalsh, mgrepl | |
Target Milestone: | --- | |||
Target Release: | --- | |||
Hardware: | Unspecified | |||
OS: | Unspecified | |||
Whiteboard: | ||||
Fixed In Version: | Doc Type: | Bug Fix | ||
Doc Text: | Story Points: | --- | ||
Clone Of: | ||||
: | 885837 (view as bug list) | Environment: | ||
Last Closed: | 2013-04-01 18:38:55 UTC | Type: | Bug | |
Regression: | --- | Mount Type: | --- | |
Documentation: | --- | CRM: | ||
Verified Versions: | Category: | --- | ||
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
Cloudforms Team: | --- | Target Upstream Version: | ||
Embargoed: | ||||
Bug Depends On: | ||||
Bug Blocks: | 885837 |
Description
Daniel Berrangé
2012-12-10 18:36:59 UTC
Fixed in selinux-policy-3.11.1-62.fc18.noarch I switched to using your type svirt_tcg_t and updated the virtual_domain_context I will ask Miroslav to do a build. You can try this out on your machine now. # cat myvirt.te policy_module(myvirt,1.0) gen_require(` role system_r; ') virt_domain_template(svirt_tcg) role system_r types svirt_tcg_t; allow svirt_tcg_t self:process { execmem execstack }; corenet_udp_sendrecv_generic_if(svirt_tcg_t) corenet_udp_sendrecv_generic_node(svirt_tcg_t) corenet_udp_sendrecv_all_ports(svirt_tcg_t) corenet_udp_bind_generic_node(svirt_tcg_t) corenet_udp_bind_all_ports(svirt_tcg_t) corenet_tcp_bind_all_ports(svirt_tcg_t) corenet_tcp_connect_all_ports(svirt_tcg_t) # make -f /usr/share/selinux/devel/Makefile myvirt.pp # semodule -i myvirt.pp This seems to work ok when libvirtd is running 'virtd_t', but it doesn't work if libvirtd is 'unconfined_t'. IIRC, we put in a special case to allow a transition from unconfined_t -> svirt_t, so we need the same for svirt_tcg_t. Yup I got to fix the virt_transition_svirt interface to include all virt_domains, not just svirt_t. (In reply to comment #1) > Fixed in selinux-policy-3.11.1-62.fc18.noarch > > > I switched to using your type svirt_tcg_t and updated the > virtual_domain_context > Actually it doesn't look like virtual_domain_context was updated. There's a commit that claims it does just that, but: $ rpm -q selinux-policy-targeted selinux-policy-targeted-3.11.1-62.fc18.noarch $ cat /etc/selinux/targeted/contexts/virtual_domain_context system_u:system_r:svirt_t:s0 Please also make that change in F17 as well Yes, you are right. It is going to be fixed. Fixed in selinux-policy-3.11.1-65.fc18 |