diff options
| author |   Nicolas Iooss <nicolas.iooss@m4x.org> | 2017-04-15 20:23:34 +0200 |
|---|---|---|
| committer |   Jason Zaman <jason@perfinion.com> | 2017-05-07 23:49:16 +0800 |
| commit | 542af989565d81b90ef54fcb78d259fb7073bfba (patch) | |
| tree | 74a2628317eafe0f6867a7fb1b791db53a68eaf4 | |
| parent | unconfined: remove duplicated xserver_role (diff) | |
| download | hardened-refpolicy-542af989.tar.gz hardened-refpolicy-542af989.tar.bz2 hardened-refpolicy-542af989.zip | |
Synchronize file patterns for /usr/bin/mount... and /usr/sbin/mount...
mount.fc defines file contexts for /usr/bin/mount.*, /usr/bin/umount.*
and /usr/sbin/mount\.zfs. These patterns are not consistent for two
reasons:
- some distributions use /sbin/mount... for other file systems that zfs.
For example Debian uses /sbin/mount.ntfs-3g
(https://packages.debian.org/jessie/amd64/ntfs-3g/filelist)
- mount_exec_t type should only be applied to mount, umount, mount.$FS
and umount.udisks2, not mountpoint.
Replace the file patterns with ones that do not match mountpoint and
match every mount and umount programs in /usr/bin and /usr/sbin.
| -rw-r--r-- | policy/modules/system/mount.fc | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/policy/modules/system/mount.fc b/policy/modules/system/mount.fc index 39ea6f5ca..97e2596b1 100644 --- a/policy/modules/system/mount.fc +++ b/policy/modules/system/mount.fc @@ -1,8 +1,9 @@ /usr/bin/fusermount -- gen_context(system_u:object_r:mount_exec_t,s0) -/usr/bin/mount.* -- gen_context(system_u:object_r:mount_exec_t,s0) -/usr/bin/umount.* -- gen_context(system_u:object_r:mount_exec_t,s0) +/usr/bin/mount(\.[^/]+)? -- gen_context(system_u:object_r:mount_exec_t,s0) +/usr/bin/umount(\.[^/]+)? -- gen_context(system_u:object_r:mount_exec_t,s0) -/usr/sbin/mount\.zfs -- gen_context(system_u:object_r:mount_exec_t,s0) +/usr/sbin/mount(\.[^/]+)? -- gen_context(system_u:object_r:mount_exec_t,s0) +/usr/sbin/umount(\.[^/]+)? -- gen_context(system_u:object_r:mount_exec_t,s0) /usr/sbin/zfs -- gen_context(system_u:object_r:mount_exec_t,s0) /usr/sbin/zpool -- gen_context(system_u:object_r:mount_exec_t,s0) |