diff options
| author | Dominick Grift <dominick.grift@defensec.nl> | 2024-04-25 15:52:48 +0200 |
|---|---|---|
| committer | Dominick Grift <dominick.grift@defensec.nl> | 2024-04-25 16:15:03 +0200 |
| commit | 9da725c52e6a743a1c30257a85a9cf6ccc95042e (patch) | |
| tree | fdb3bbf4a4db4fdbeee70deb125d0bd11bb018b6 /src/dev/nodedev | |
| parent | d20cf3431293133299b5a1e0f41c32ec85f1a4a4 (diff) | |
| download | selinux-policy-9da725c52e6a743a1c30257a85a9cf6ccc95042e.tar.gz | |
adds a ttynodedev and TIOCLINUX filtering support
Signed-off-by: Dominick Grift <dominick.grift@defensec.nl>
Diffstat (limited to 'src/dev/nodedev')
| -rw-r--r-- | src/dev/nodedev/ttynodedev.cil | 42 |
1 files changed, 42 insertions, 0 deletions
diff --git a/src/dev/nodedev/ttynodedev.cil b/src/dev/nodedev/ttynodedev.cil index 00ac2ca..265a070 100644 --- a/src/dev/nodedev/ttynodedev.cil +++ b/src/dev/nodedev/ttynodedev.cil @@ -5,6 +5,48 @@ (filecon "/dev/tty" char nodedev_context) + (macro tioclinux_nodedev_chr_files ((type ARG1)) + (allowx ARG1 nodedev TIOCLINUX)) + + (macro tiocsti_nodedev_chr_files ((type ARG1)) + (allowx ARG1 nodedev TIOCSTI)) + (blockinherit .nodedev.template) (call .rbacsep.exempt.obj.type (nodedev))) + +;; TIOCLINUX, subcode=TIOCL_GETMOUSEREPORTING +(in after tty.append_nodedev_chr_files + (allowx ARG1 nodedev IOCTLCONSOLE_NOT_TIOCLINUX) + (allowx ARG1 nodedev IOCTLTTY_NOT_TIOCSTI) + (allowx ARG1 nodedev IOCTLVT)) + +(in after tty.appendinherited_nodedev_chr_files + (allowx ARG1 nodedev IOCTLCONSOLE_NOT_TIOCLINUX) + (allowx ARG1 nodedev IOCTLTTY_NOT_TIOCSTI) + (allowx ARG1 nodedev IOCTLVT)) + +(in after tty.manage_nodedev_chr_files + (allowx ARG1 nodedev IOCTLCONSOLE_NOT_TIOCLINUX) + (allowx ARG1 nodedev IOCTLTTY_NOT_TIOCSTI) + (allowx ARG1 nodedev IOCTLVT)) + +(in after tty.readwrite_nodedev_chr_files + (allowx ARG1 nodedev IOCTLCONSOLE_NOT_TIOCLINUX) + (allowx ARG1 nodedev IOCTLTTY_NOT_TIOCSTI) + (allowx ARG1 nodedev IOCTLVT)) + +(in after tty.readwriteinherited_nodedev_chr_files + (allowx ARG1 nodedev IOCTLCONSOLE_NOT_TIOCLINUX) + (allowx ARG1 nodedev IOCTLTTY_NOT_TIOCSTI) + (allowx ARG1 nodedev IOCTLVT)) + +(in after tty.write_nodedev_chr_files + (allowx ARG1 nodedev IOCTLCONSOLE_NOT_TIOCLINUX) + (allowx ARG1 nodedev IOCTLTTY_NOT_TIOCSTI) + (allowx ARG1 nodedev IOCTLVT)) + +(in after tty.writeinherited_nodedev_chr_files + (allowx ARG1 nodedev IOCTLCONSOLE_NOT_TIOCLINUX) + (allowx ARG1 nodedev IOCTLTTY_NOT_TIOCSTI) + (allowx ARG1 nodedev IOCTLVT)) |