Changeset 2722

Timestamp:

06/18/08 10:35:49 (4 months ago)

Author:

cpebenito

Message:

trunk: pull in most of dans vmware patch.

Files:

• trunk/policy/modules/apps/vmware.fc (modified) (2 diffs)
• trunk/policy/modules/apps/vmware.if (modified) (1 diff)
• trunk/policy/modules/apps/vmware.te (modified) (8 diffs)

trunk/policy/modules/apps/vmware.fc

@@ -29 +29 @@
-
-/usr/lib/vmware/config          --      gen_context(system_u:object_r:vmware_sys_conf_t,s0)
+/usr/lib/vmware/bin/vmplayer    --      gen_context(system_u:object_r:vmware_exec_t,s0)
-/usr/lib/vmware/bin/vmware-mks  --      gen_context(system_u:object_r:vmware_exec_t,s0)
-/usr/lib/vmware/bin/vmware-ui   --      gen_context(system_u:object_r:vmware_exec_t,s0)
+/usr/lib/vmware/bin/vmware-vmx  --      gen_context(system_u:object_r:vmware_host_exec_t,s0)
+
+ifdef(`distro_redhat',`
+/usr/lib/vmware-tools/sbin32/vmware.* -- gen_context(system_u:object_r:vmware_host_exec_t,s0)
+/usr/lib/vmware-tools/sbin64/vmware.* -- gen_context(system_u:object_r:vmware_host_exec_t,s0)
+')
-
-/usr/lib64/vmware/config        --      gen_context(system_u:object_r:vmware_sys_conf_t,s0)
-/usr/lib64/vmware/bin/vmware-mks --     gen_context(system_u:object_r:vmware_exec_t,s0)
-/usr/lib64/vmware/bin/vmware-ui --      gen_context(system_u:object_r:vmware_exec_t,s0)
+/usr/lib64/vmware/bin/vmplayer  --      gen_context(system_u:object_r:vmware_exec_t,s0)
+/usr/lib64/vmware/bin/vmware-vmx --     gen_context(system_u:object_r:vmware_host_exec_t,s0)
+
+/usr/sbin/vmware-guest.*        --      gen_context(system_u:object_r:vmware_host_exec_t,s0)
+/usr/sbin/vmware-serverd        --      gen_context(system_u:object_r:vmware_exec_t,s0)
-
-ifdef(`distro_gentoo',`
@@ -50 +62 @@
-/opt/vmware/(workstation|player)/bin/vmware --  gen_context(system_u:object_r:vmware_exec_t,s0)
-')
+
+/var/log/vmware.*               --      gen_context(system_u:object_r:vmware_log_t,s0)
+
+/var/run/vmnat.*                -s      gen_context(system_u:object_r:vmware_var_run_t,s0)
+/var/run/vmware.*                       gen_context(system_u:object_r:vmware_var_run_t,s0)

trunk/policy/modules/apps/vmware.if

@@ -203 +203 @@
-        allow $1 vmware_sys_conf_t:file append;
-')
+
+########################################
+## <summary>
+##      Append to VMWare log files.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`vmware_append_log',`
+        gen_require(`
+                type vmware_log_t;
+        ')
+
+        logging_search_logs($1)
+        append_files_pattern($1, vmware_log_t, vmware_log_t)
+')

trunk/policy/modules/apps/vmware.te

@@ -1 +1 @@
-
-1.5.2
+ 1.5.3
-
-########################################
@@ -16 +16 @@
-init_daemon_domain(vmware_host_t,vmware_host_exec_t)
-
+type vmware_log_t;
+logging_log_file(vmware_log_t)
+
-# Systemwide configuration files
-type vmware_sys_conf_t;
@@ -28 +31 @@
-#
-
-
+gid set
-dontaudit vmware_host_t self:capability sys_tty_config;
-allow vmware_host_t self:process signal_perms;
@@ -34 +37 @@
-allow vmware_host_t self:unix_stream_socket create_stream_socket_perms;
-allow vmware_host_t self:rawip_socket create_socket_perms;
+allow vmware_host_t self:tcp_socket create_socket_perms;
-
-# cjp: the ro and rw files should be split up
@@ -41 +45 @@
-manage_sock_files_pattern(vmware_host_t,vmware_var_run_t,vmware_var_run_t)
-files_pid_filetrans(vmware_host_t,vmware_var_run_t,{ file sock_file })
+
+manage_files_pattern(vmware_host_t, vmware_log_t, vmware_log_t) 
+logging_log_filetrans(vmware_host_t, vmware_log_t, { file dir })
-
-kernel_read_kernel_sysctls(vmware_host_t)
@@ -64 +71 @@
-
-dev_read_sysfs(vmware_host_t)
+dev_read_urand(vmware_host_t)
-dev_rw_vmware(vmware_host_t)
-
@@ -91 +99 @@
-sysadm_dontaudit_search_home_dirs(vmware_host_t)
-
+netutils_domtrans_ping(vmware_host_t)
+
-optional_policy(`
-        seutil_sigchld_newrole(vmware_host_t)
@@ -99 +109 @@
-        udev_read_db(vmware_host_t)
-')
-netutils_domtrans_ping(vmware_host_t)
-
-ifdef(`TODO',`
-# VMWare need access to pcmcia devices for network
-optional_policy(`
-allow kernel_t cardmgr_var_lib_t:dir { getattr search };
-allow kernel_t cardmgr_var_lib_t:file { getattr ioctl read };
-')
-# Vmware create network devices
-allow kernel_t self:capability net_admin;
-allow kernel_t self:netlink_route_socket { bind create getattr nlmsg_read nlmsg_write read write };
-allow kernel_t self:socket create;
-')