fsadm (#1129)

* Changes needed for fsadm_t when sysadm_t is used instead of unconfined_t for
root

fowner capability is for btrfs subvol snapshot of subvols not owned by root

rw non auth dirs is for btrfs operations on dirs

sysipc info is for parted

Signed-off-by: Russell Coker <russell@coker.com.au>

Author: etbe

policy/modules/kernel/files.if

@@ -1599,6 +1599,24 @@ interface(`files_rw_non_auth_files',`
 	rw_files_pattern($1, non_auth_file_type, non_auth_file_type)
 ')
 
+########################################
+## <summary>
+##	rw non-authentication related dirs.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`files_rw_non_auth_dirs',`
+	gen_require(`
+		attribute non_auth_file_type;
+	')
+
+	allow $1 non_auth_file_type:dir rw_dir_perms;
+')
+
 ########################################
 ## <summary>
 ##	Manage non-authentication related

policy/modules/system/fstools.te

@@ -33,7 +33,7 @@ ifdef(`distro_gentoo',`
 #
 
 # ipc_lock is for losetup
-allow fsadm_t self:capability { dac_override dac_read_search ipc_lock sys_admin sys_rawio sys_resource sys_tty_config };
+allow fsadm_t self:capability { dac_override dac_read_search fowner ipc_lock sys_admin sys_rawio sys_resource sys_tty_config };
 dontaudit fsadm_t self:capability net_admin;
 allow fsadm_t self:process { dyntransition execstack getattr getcap getpgid getrlimit getsched getsession noatsecure rlimitinh setcap setkeycreate setpgid setsched setsockcreate share siginh signal_perms transition };
 allow fsadm_t self:fd use;
@@ -69,6 +69,7 @@ logging_log_filetrans(fsadm_t, fsadm_log_t, file)
 # Enable swapping to files
 allow fsadm_t swapfile_t:file rw_file_perms;
 
+kernel_get_sysvipc_info(fsadm_t)
 kernel_read_system_state(fsadm_t)
 kernel_read_kernel_sysctls(fsadm_t)
 kernel_request_load_module(fsadm_t)
@@ -120,6 +121,8 @@ files_manage_lost_found(fsadm_t)
 # Write to /etc/mtab.
 files_manage_etc_runtime_files(fsadm_t)
 files_etc_filetrans_etc_runtime(fsadm_t, file)
+# btrfs subvol snapshot.
+files_rw_non_auth_dirs(fsadm_t)
 
 fs_getattr_cgroup(fsadm_t)
 fs_getattr_dos_fs(fsadm_t)
@@ -208,6 +211,7 @@ optional_policy(`
 
 optional_policy(`
 	# for smartctl cron jobs
+	cron_rw_inherited_tmp_files(fsadm_t)
 	cron_system_entry(fsadm_t, fsadm_exec_t)
 ')