Merge pull request SELinuxProject#807 from dsugar100/main

Additional permissions when fapolicyd.conf more strict

policy/modules/admin/fapolicyd.te

@@ -70,14 +70,16 @@ kernel_read_kernel_sysctls(fapolicyd_t)
 
 domain_read_all_domains_state(fapolicyd_t)
 
-files_read_all_files(fapolicyd_t)
+files_mmap_read_all_files(fapolicyd_t)
 files_read_all_symlinks(fapolicyd_t)
 files_runtime_filetrans(fapolicyd_t, fapolicyd_runtime_t, { file fifo_file })
 files_map_usr_files(fapolicyd_t)
 files_watch_all_mountpoints(fapolicyd_t)
 files_watch_all_mount_perm(fapolicyd_t)
+files_watch_all_mount_sb(fapolicyd_t)
 
 fs_getattr_xattr_fs(fapolicyd_t)
+fs_watch_all_fs(fapolicyd_t)
 
 logging_log_filetrans(fapolicyd_t, fapolicyd_log_t, file)
 logging_send_syslog_msg(fapolicyd_t)

policy/modules/kernel/files.if

@@ -736,6 +736,30 @@ interface(`files_read_all_files',`
 	')
 ')
 
+########################################
+## <summary>
+##	Read and memory map all files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`files_mmap_read_all_files',`
+	gen_require(`
+		attribute file_type;
+	')
+
+	allow $1 file_type:dir list_dir_perms;
+	mmap_read_files_pattern($1, file_type, file_type)
+
+	optional_policy(`
+		auth_read_shadow($1)
+		auth_map_shadow($1)
+	')
+')
+
 ########################################
 ## <summary>
 ##	Allow shared library text relocations in all files.
@@ -1950,6 +1974,24 @@ interface(`files_watch_all_mount_perm',`
 	allow $1 mountpoint:dir watch_with_perm;
 ')
 
+########################################
+## <summary>
+##	Watch all mount superblock changes
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`files_watch_all_mount_sb',`
+	gen_require(`
+		attribute mountpoint;
+	')
+
+	allow $1 mountpoint:dir watch_sb;
+')
+
 ########################################
 ## <summary>
 ##	Check if all mountpoints are writable.

policy/modules/kernel/filesystem.if

@@ -6674,6 +6674,25 @@ interface(`fs_relabelfrom_all_fs',`
 	allow $1 filesystem_type:filesystem relabelfrom;
 ')
 
+########################################
+## <summary>
+##	Watch all filesystems.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`fs_watch_all_fs',`
+	gen_require(`
+		attribute filesystem_type;
+	')
+
+	allow $1 filesystem_type:filesystem watch;
+')
+
 ########################################
 ## <summary>
 ##	Get the attributes of all directories