From mboxrd@z Thu Jan  1 00:00:00 1970
Received: by passt.top (Postfix, from userid 1000)
	id 51B455A0270; Tue,  7 Mar 2023 00:28:39 +0100 (CET)
From: Stefano Brivio <sbrivio@redhat.com>
To: passt-dev@passt.top
Subject: [PATCH 4/4] contrib/selinux: Let interface users set paths for log, PID, socket files
Date: Tue,  7 Mar 2023 00:28:39 +0100
Message-Id: <20230306232839.1996920-5-sbrivio@redhat.com>
X-Mailer: git-send-email 2.39.2
In-Reply-To: <20230306232839.1996920-1-sbrivio@redhat.com>
References: <20230306232839.1996920-1-sbrivio@redhat.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Message-ID-Hash: B4ZV76BPBWYNFOSNCJIKHFRELIK4RDXK
X-Message-ID-Hash: B4ZV76BPBWYNFOSNCJIKHFRELIK4RDXK
X-MailFrom: sbrivio@passt.top
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: Laine Stump <laine@redhat.com>, Andrea Bolognani <abologna@redhat.com>
X-Mailman-Version: 3.3.8
Precedence: list
List-Id: Development discussion and patches for passt <passt-dev.passt.top>
Archived-At: <https://archives.passt.top/passt-dev/20230306232839.1996920-5-sbrivio@redhat.com/>
Archived-At: <https://passt.top/hyperkitty/list/passt-dev@passt.top/message/B4ZV76BPBWYNFOSNCJIKHFRELIK4RDXK/>
List-Archive: <https://archives.passt.top/passt-dev/>
List-Archive: <https://passt.top/hyperkitty/list/passt-dev@passt.top/>
List-Help: <mailto:passt-dev-request@passt.top?subject=help>
List-Owner: <mailto:passt-dev-owner@passt.top>
List-Post: <mailto:passt-dev@passt.top>
List-Subscribe: <mailto:passt-dev-join@passt.top>
List-Unsubscribe: <mailto:passt-dev-leave@passt.top>

Even libvirt itself will configure passt to write log, PID and socket
files to different locations depending on whether the domain is
started as root (/var/log/libvirt/...) or as a regular user
(/var/log/<PID>/libvirt/...), and user_tmp_t would only cover the
latter.

Create interfaces for log and PID files, so that callers can specify
different file contexts for those, and modify the interface for the
UNIX socket file to allow different paths as well.

Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
---
 contrib/selinux/passt.if | 26 +++++++++++++++++++++++++-
 1 file changed, 25 insertions(+), 1 deletion(-)

diff --git a/contrib/selinux/passt.if b/contrib/selinux/passt.if
index 893395b..6a6105c 100644
--- a/contrib/selinux/passt.if
+++ b/contrib/selinux/passt.if
@@ -30,8 +30,32 @@ interface(`passt_socket',`
 		type passt_t;
 	')
 
-	allow $1 user_tmp_t:sock_file write;
+	allow $1 $2:sock_file write;
 	allow $1 passt_t:unix_stream_socket connectto;
+
+	allow passt_t $2:sock_file { create read write unlink };
+')
+
+interface(`passt_logfile',`
+	gen_require(`
+		type passt_t;
+	')
+
+	logging_log_file($1);
+	allow passt_t $1:dir { search write add_name };
+	allow passt_t $1:file { create open read write };
+')
+
+interface(`passt_pidfile',`
+	gen_require(`
+		type passt_t;
+	')
+
+	allow $1 $2:file { open read unlink };
+
+	files_pid_file($2);
+	allow passt_t $2:dir { search write add_name };
+	allow passt_t $2:file { create open write };
 ')
 
 interface(`passt_kill',`
-- 
2.39.2