Allow access to sysfs files.
Due to a bug in Linux < 3.3, sysfs inodes can lose a security context
set via setfilecon/setxattr and revert to the base sysfs type if the
security context is set before setting owner or mode on the inode and
the inode is later evicted from memory and subsequently refreshed.
This was fixed in mainline Linux by commit
93518dd2ebafcc761a8637b2877008cfd748c202.
As a workaround, allow any domain that can write to any sysfs type
to also write to the base sysfs type in the grouper sepolicy and
anything that inherits from it.
Change-Id: I14b0530387edce1097387223f0def9b59e4292e0
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
5 files changed