Allow virtd_t to use ptys created by svirt domains, this is needed in order to do...

diff --git a/policy/modules/services/virt.if b/policy/modules/services/virt.if
index 5c0a7a4d7213c808117396f539be87418ebde27d..411edf394f01d14efab09a7980577e5c57a5000f 100644 (file)
--- a/policy/modules/services/virt.if
+++ b/policy/modules/services/virt.if
@@ -15,6 +15,7 @@ template(`virt_domain_template',`
        gen_require(`
                attribute virt_image_type, virt_domain;
                attribute virt_tmpfs_type;
+               attribute virt_ptynode;
        ')
 
        type $1_t, virt_domain;
@@ -24,7 +25,7 @@ template(`virt_domain_template',`
        mcs_untrusted_proc($1_t)
        role system_r types $1_t;
 
-       type $1_devpts_t;
+       type $1_devpts_t, virt_ptynode;
        term_pty($1_devpts_t)
 
        type $1_tmp_t;

diff --git a/policy/modules/services/virt.te b/policy/modules/services/virt.te
index 4dec4ad2325d40bdbb79bbf12eae6d4e959e1a0f..a8367793fd662b7f8d0b5f60b67bd684d88c994b 100644 (file)
--- a/policy/modules/services/virt.te
+++ b/policy/modules/services/virt.te
@@ -6,6 +6,7 @@ policy_module(virt, 1.4.0)
 #
 
 attribute virsh_transition_domain;
+attribute virt_ptynode;
 
 ## <desc>
 ##     <p>
@@ -253,6 +254,7 @@ manage_blk_files_pattern(virtd_t, virt_image_type, virt_image_type)
 manage_lnk_files_pattern(virtd_t, virt_image_type, virt_image_type)
 allow virtd_t virt_image_type:file relabel_file_perms;
 allow virtd_t virt_image_type:blk_file relabel_blk_file_perms;
+allow virtd_t virt_ptynode:chr_file rw_term_perms;
 
 manage_dirs_pattern(virtd_t, virt_tmp_t, virt_tmp_t)
 manage_files_pattern(virtd_t, virt_tmp_t, virt_tmp_t)