From 7078e8b67a54629aa5b3b427bece3ade3760ff0d Mon Sep 17 00:00:00 2001
From: Daniel Micay <danielmicay@gmail.com>
Date: Mon, 8 Aug 2016 13:48:01 -0400
Subject: [PATCH] fine-grained policy for access to /proc/zoneinfo
Change-Id: Ica9a16311075f5cc3744d0e0833ed876e201029f
---
dumpstate.te | 1 +
file.te | 1 +
genfs_contexts | 1 +
lmkd.te | 2 ++
shell.te | 1 +
5 files changed, 6 insertions(+)
diff --git a/dumpstate.te b/dumpstate.te
index 08dcb4df4..4bb12c3e8 100644
--- a/dumpstate.te
+++ b/dumpstate.te
@@ -144,3 +144,4 @@ allow dumpstate debugfs_trace_marker:file getattr;
allow dumpstate atrace_exec:file rx_file_perms;
allow dumpstate proc_interrupts:file r_file_perms;
+allow dumpstate proc_zoneinfo:file r_file_perms;
diff --git a/file.te b/file.te
index 628c23717..02112efc6 100644
--- a/file.te
+++ b/file.te
@@ -22,6 +22,7 @@ type proc_sysrq, fs_type;
type proc_timer, fs_type;
type proc_uid_cputime_showstat, fs_type;
type proc_uid_cputime_removeuid, fs_type;
+type proc_zoneinfo, fs_type;
type selinuxfs, fs_type, mlstrustedobject;
type cgroup, fs_type, mlstrustedobject;
type sysfs, fs_type, sysfs_type, mlstrustedobject;
diff --git a/genfs_contexts b/genfs_contexts
index 57b967cbc..bb2fea90b 100644
--- a/genfs_contexts
+++ b/genfs_contexts
@@ -31,6 +31,7 @@ genfscon proc /timer_list u:object_r:proc_timer:s0
genfscon proc /timer_stats u:object_r:proc_timer:s0
genfscon proc /uid_cputime/show_uid_stat u:object_r:proc_uid_cputime_showstat:s0
genfscon proc /uid_cputime/remove_uid_range u:object_r:proc_uid_cputime_removeuid:s0
+genfscon proc /zoneinfo u:object_r:proc_zoneinfo:s0
# selinuxfs booleans can be individually labeled.
genfscon selinuxfs / u:object_r:selinuxfs:s0
diff --git a/lmkd.te b/lmkd.te
index 863fe07e5..ee731c577 100644
--- a/lmkd.te
+++ b/lmkd.te
@@ -32,6 +32,8 @@ allow lmkd cgroup:dir { remove_name rmdir };
# Set self to SCHED_FIFO
allow lmkd self:capability sys_nice;
+allow lmkd proc_zoneinfo:file r_file_perms;
+
### neverallow rules
# never honor LD_PRELOAD
diff --git a/shell.te b/shell.te
index afa4c91c8..b7b4e03ff 100644
--- a/shell.te
+++ b/shell.te
@@ -93,6 +93,7 @@ allow shell proc_interrupts:file r_file_perms;
allow shell proc_meminfo:file r_file_perms;
allow shell proc_stat:file r_file_perms;
allow shell proc_timer:file r_file_perms;
+allow shell proc_zoneinfo:file r_file_perms;
r_dir_file(shell, cgroup)
allow shell domain:dir { search open read getattr };
allow shell domain:{ file lnk_file } { open read getattr };
--
GitLab