Confine the pcm service

fedora-selinux · Oct 11, 2024 · 59a8b57 · 59a8b57
1 parent 8663090
commit 59a8b57
Show file tree

Hide file tree

Showing 4 changed files with 32 additions and 1 deletion.
diff --git a/dist/targeted/modules.conf b/dist/targeted/modules.conf
@@ -3022,9 +3022,17 @@ systemd-homed = module
 #
 iiosensorproxy = module
 
-# Layer: system
+# Layer: contrib
 # Module: powerprofiles
 #
 # Policy for power-profiles-daemon - power profiles handling over D-Bus
 #
 powerprofiles = module
+
+# Layer: contrib
+# Module: pcm
+#
+# Policy for pcm - Intel(r) Performance Counter Monitor
+#
+#
+pcm = module
diff --git a/policy/modules/contrib/pcm.fc b/policy/modules/contrib/pcm.fc
@@ -0,0 +1 @@
+/usr/sbin/pcm-sensor-server	--	gen_context(system_u:object_r:pcmsensor_exec_t,s0)
diff --git a/policy/modules/contrib/pcm.if b/policy/modules/contrib/pcm.if
@@ -0,0 +1 @@
+## <summary>Intel Performance Counter Monitor (PCM) Sensor Service</summary>
diff --git a/policy/modules/contrib/pcm.te b/policy/modules/contrib/pcm.te
@@ -0,0 +1,21 @@
+policy_module(pcm, 1.0)
+#policy_module(pcmsensor, 1.0)
+
+########################################
+#
+# Declarations
+#
+
+type pcmsensor_t;
+type pcmsensor_exec_t;
+init_daemon_domain(pcmsensor_t, pcmsensor_exec_t)
+
+#type pcmsensor_var_lib_t;
+#files_type(pcmsensor_var_lib_t);
+
+permissive pcmsensor_t;
+
+allow pcmsensor_t self:capability sys_resource;
+allow pcmsensor_t self:process { ptrace setrlimit };
+
+kernel_read_proc_files(pcmsensor_t)