device (#939)

* device related patches

Signed-off-by: Russell Coker <[email protected]>

Author: etbe

policy/modules/services/devicekit.te

@@ -102,6 +102,7 @@ dev_getattr_mtrr_dev(devicekit_disk_t)
 dev_getattr_usbfs_dirs(devicekit_disk_t)
 dev_read_rand(devicekit_disk_t)
 dev_read_urand(devicekit_disk_t)
+dev_rw_lvm_control(devicekit_disk_t)
 dev_rw_sysfs(devicekit_disk_t)
 
 domain_getattr_all_pipes(devicekit_disk_t)
@@ -116,6 +117,7 @@ files_getattr_all_files(devicekit_disk_t)
 files_getattr_all_pipes(devicekit_disk_t)
 files_manage_boot_dirs(devicekit_disk_t)
 files_manage_mnt_dirs(devicekit_disk_t)
+files_mounton_mnt(devicekit_disk_t)
 files_read_etc_runtime_files(devicekit_disk_t)
 files_read_usr_files(devicekit_disk_t)
 files_watch_etc_dirs(devicekit_disk_t)
@@ -131,6 +133,9 @@ mls_file_read_all_levels(devicekit_disk_t)
 mls_file_write_to_clearance(devicekit_disk_t)
 
 mount_rw_runtime_files(devicekit_disk_t)
+mount_watch_runtime_dirs(devicekit_disk_t)
+mount_watch_runtime_files(devicekit_disk_t)
+mount_watch_runtime_files_reads(devicekit_disk_t)
 
 storage_raw_read_fixed_disk(devicekit_disk_t)
 storage_raw_write_fixed_disk(devicekit_disk_t)
@@ -204,7 +209,7 @@ optional_policy(`
 
 allow devicekit_power_t self:capability { dac_override net_admin sys_admin sys_nice sys_ptrace sys_tty_config };
 allow devicekit_power_t self:capability2 wake_alarm;
-allow devicekit_power_t self:process { getsched signal_perms };
+allow devicekit_power_t self:process { getsched setsched signal_perms };
 allow devicekit_power_t self:fifo_file rw_fifo_file_perms;
 allow devicekit_power_t self:unix_dgram_socket create_socket_perms;
 allow devicekit_power_t self:unix_stream_socket create_socket_perms;

policy/modules/system/mount.if

@@ -273,6 +273,24 @@ interface(`mount_watch_reads_runtime_files',`
 	allow $1 mount_runtime_t:file watch_reads;
 ')
 
+########################################
+## <summary>
+##	Watch mount runtime files reads.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`mount_watch_runtime_files_reads',`
+	gen_require(`
+		type mount_runtime_t;
+	')
+
+	allow $1 mount_runtime_t:file watch_reads;
+')
+
 ########################################
 ## <summary>
 ##     Getattr on mount_runtime_t files

policy/modules/system/udev.te

@@ -109,6 +109,7 @@ kernel_read_fs_sysctls(udev_t)
 #https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=235182
 kernel_rw_net_sysctls(udev_t)
 kernel_read_network_state(udev_t)
+kernel_read_psi(udev_t)
 kernel_read_software_raid_state(udev_t)
 kernel_dontaudit_search_unlabeled(udev_t)