Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Allow l2tpd_t access to netlink and sysfs #2317

Open
wants to merge 1 commit into
base: rawhide
Choose a base branch
from
Open

Allow l2tpd_t access to netlink and sysfs #2317

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions policy/modules/contrib/l2tp.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,12 +30,14 @@ allow l2tpd_t self:capability net_admin;
allow l2tpd_t self:process signal_perms;
allow l2tpd_t self:fifo_file rw_fifo_file_perms;
allow l2tpd_t self:netlink_socket create_socket_perms;
allow l2tpd_t self:netlink_generic_socket create_socket_perms;
allow l2tpd_t self:rawip_socket create_socket_perms;
allow l2tpd_t self:socket create_socket_perms;
allow l2tpd_t self:tcp_socket { accept listen };
allow l2tpd_t self:unix_dgram_socket sendto;
allow l2tpd_t self:unix_stream_socket { accept listen };
allow l2tpd_t self:pppox_socket create_socket_perms;
allow l2tpd_t sysfs_t:file { open read };
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This line is a subset of dev_read_sysfs() which actually is the correct way to access types from other modules.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry, my mistake.

I thought the same from reading the macro definition for dev_read_sysfs(), but during development I found I needed the extra "allow" line otherwise I was still hitting some access denials.

However I think I must have gotten my packages mixed up in the test environment as I've just re-tested from scratch without the "allow" and and everything is working. I'll remove this extra line.


read_files_pattern(l2tpd_t, l2tp_conf_t, l2tp_conf_t)

Expand Down Expand Up @@ -77,6 +79,7 @@ kernel_request_load_module(l2tpd_t)
corecmd_exec_bin(l2tpd_t)

dev_read_urand(l2tpd_t)
dev_read_sysfs(l2tpd_t)

term_setattr_generic_ptys(l2tpd_t)
term_use_generic_ptys(l2tpd_t)
Expand Down