[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Xen-devel] [refpolicy] [refpolicy SELinux PATCH 2/2] kernel/xen: Add map permission to the dev_rw_xen



On 10/09/2017 11:53 AM, Konrad Rzeszutek Wilk via refpolicy wrote:
From: Konrad Rzeszutek Wilk <konrad@xxxxxxxxxx>

type=AVC msg=audit(1504637347.487:280): avc:  denied  { map } for  pid=857 comm="xenconsoled" 
path="/dev/xen/privcmd" dev="devtmpfs" ino=16289 
scontext=system_u:system_r:xenconsoled_t:s0

Without this we can't use xenconsole (client) to
talk to xenconsoled (server).

Signed-off-by: Konrad Rzeszutek Wilk <konrad@xxxxxxxxxx>
---
  policy/modules/kernel/devices.if | 1 +
  1 file changed, 1 insertion(+)

diff --git a/policy/modules/kernel/devices.if b/policy/modules/kernel/devices.if
index 4c47709ff..c9071df8f 100644
--- a/policy/modules/kernel/devices.if
+++ b/policy/modules/kernel/devices.if
@@ -4984,6 +4984,7 @@ interface(`dev_rw_xen',`
        ')
rw_chr_files_pattern($1, device_t, xen_device_t)
+       allow $1 xen_device_t:chr_file map;
  ')
########################################

Merged.

--
Chris PeBenito

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
https://lists.xen.org/xen-devel

 


Rackspace

Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.