Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Draft: Policies required for logind BPF-based hidraw revoke #1920

Draft
wants to merge 3 commits into
base: rawhide
Choose a base branch
from
Draft

Draft: Policies required for logind BPF-based hidraw revoke #1920

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
c1bcdb0
Allow logind to access usb devices
whot Oct 31, 2023
f887a45
Allow dbus to inherit usb devices
whot Oct 31, 2023
637d37c
Allow bpf for logind
whot Nov 1, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions policy/modules/contrib/dbus.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -103,6 +103,7 @@ dev_read_urand(system_dbusd_t)
dev_read_sysfs(system_dbusd_t)

dev_rw_inherited_input_dev(system_dbusd_t)
dev_rw_inherited_usb_dev(system_dbusd_t)
dev_rw_inherited_dri(system_dbusd_t)

files_read_var_lib_symlinks(system_dbusd_t)
Expand Down
19 changes: 19 additions & 0 deletions policy/modules/kernel/devices.if
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5479,6 +5479,25 @@ interface(`dev_rw_generic_usb_dev',`
rw_chr_files_pattern($1, device_t, usb_device_t)
')

########################################
## <summary>
## Read and write inherited USB devices.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`dev_rw_inherited_usb_dev',`
gen_require(`
type device_t, usb_device_t;
')

allow $1 device_t:dir search_dir_perms;
allow $1 usb_device_t:chr_file rw_inherited_chr_file_perms;
')

########################################
## <summary>
## Relabel generic the USB devices.
Expand Down
4 changes: 3 additions & 1 deletion policy/modules/system/systemd.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -249,7 +249,8 @@ files_type(systemd_pstore_var_lib_t)

# is for /run/user/$USER ($USER ownership is $USER:$USER)
allow systemd_logind_t self:capability { chown kill dac_read_search dac_override fowner sys_tty_config sys_admin };
allow systemd_logind_t self:capability2 block_suspend;
allow systemd_logind_t self:capability2 { block_suspend bpf };
allow systemd_logind_t self:bpf { prog_load prog_run };

# systemd-logind reads state from /sys/power, which changes output based on
# whether hibernations is available, which tries to take the lockdown state
Expand Down Expand Up @@ -304,6 +305,7 @@ dev_getattr_all_chr_files(systemd_logind_t)
dev_getattr_all_blk_files(systemd_logind_t)
dev_rw_sysfs(systemd_logind_t)
dev_rw_input_dev(systemd_logind_t)
dev_rw_generic_usb_dev(systemd_logind_t)
dev_rw_dri(systemd_logind_t)
dev_setattr_all_chr_files(systemd_logind_t)
dev_setattr_dri_dev(systemd_logind_t)
Expand Down