Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-2036

USB device nodes are not always properly labeled with "usb_device_t"

Linking RHIVOS CVEs to...Migration: Automation ...Sync from "Extern...XMLWordPrintable

    • None
    • Moderate
    • rhel-security-selinux
    • ssg_security
    • None
    • False
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • None
    • If docs needed, set a value
    • None
    • 57,005

      Description of problem:

      We have transition rules to label /dev/bus/usb/XXX/YYY nodes appropriately with "usb_device_t".
      This is done in policy/modules/kernel/devices.if:
      -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
      filetrans_pattern($1, device_t, usb_device_t, chr_file, "000")
      filetrans_pattern($1, device_t, usb_device_t, chr_file, "001")
      filetrans_pattern($1, device_t, usb_device_t, chr_file, "002")
      :
      filetrans_pattern($1, device_t, usb_device_t, chr_file, "027")
      filetrans_pattern($1, device_t, usb_device_t, chr_file, "028")
      filetrans_pattern($1, device_t, usb_device_t, chr_file, "029")
      -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

      Unfortunately this hardcoded list is not sufficient, because some hardware devices are enumerated with numbers > 029, e.g.:
      -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
      $ grep 094 sos_commands/usb/lsusb
      Bus 001 Device 094: ID 0a5c:5842 Broadcom Corp.

      $ grep -w 94 sos_commands/usb/lsusb_-t

      __ Port 10: Dev 94, If 0, Class=Application Specific Interface, Driver=, 480M
      __ Port 10: Dev 94, If 1, Class=Chip/SmartCard, Driver=usbfs, 480M
      -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

      We need hence to add more device names, ideally a regex should be used, but I doubt this is supported at all.

      Version-Release number of selected component (if applicable):

      selinux-policy-3.14.3-117.el8.noarch
      Also applies to RHEL9, from sources of the policy

      How reproducible:

      Always on customer system

              rhn-support-zpytela Zdenek Pytela
              rhn-support-rmetrich Renaud Métrich
              Zdenek Pytela Zdenek Pytela
              Milos Malik Milos Malik
              Votes:
              0 Vote for this issue
              Watchers:
              7 Start watching this issue

                Created:
                Updated:
                Resolved: