Skip to content

Commit

Permalink
Allow virtqemud rw and setattr access to sev devices
Browse files Browse the repository at this point in the history
The commit addresses the following AVC denial:
type=AVC msg=audit(1732696476.040:1215): avc:  denied  { open } for  pid=27575 comm="rpc-virtqemud" path="/dev/sev" dev="tmpfs" ino=6 scontext=system_u:system_r:virtqemud_t:s0 tcontext=system_u:object_r:sev_device_t:s0 tclass=chr_file permissive=1

Resolves: RHEL-69128
  • Loading branch information
zpytela committed Dec 12, 2024
1 parent a7cd758 commit 204de2b
Show file tree
Hide file tree
Showing 2 changed files with 20 additions and 0 deletions.
2 changes: 2 additions & 0 deletions policy/modules/contrib/virt.te
Original file line number Diff line number Diff line change
Expand Up @@ -2214,6 +2214,8 @@ dev_relabel_all_dev_nodes(virtqemud_t)
dev_rw_kvm(virtqemud_t)
dev_rw_lvm_control(virtqemud_t)
dev_rw_vhost(virtqemud_t)
dev_rw_sev(virtqemud_t)
dev_setattr_sev(virtqemud_t)
dev_setattr_urand(virtqemud_t)
dev_unmount_fs(virtqemud_t)

Expand Down
18 changes: 18 additions & 0 deletions policy/modules/kernel/devices.if
Original file line number Diff line number Diff line change
Expand Up @@ -2974,6 +2974,24 @@ interface(`dev_rw_sev',`
rw_chr_files_pattern($1, device_t, sev_device_t)
')

########################################
## <summary>
## Settattr on sev devices.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`dev_setattr_sev',`
gen_require(`
type device_t, sev_device_t;
')

setattr_chr_files_pattern($1, device_t, sev_device_t)
')

######################################
## <summary>
## Read the lirc device.
Expand Down

0 comments on commit 204de2b

Please sign in to comment.