Add SELinux policy support for Userspace Resource Manager (URM) by varunsinghal29 · Pull Request #1097 · SELinuxProject/refpolicy

varunsinghal29 · 2026-03-25T13:16:01Z

Add SELinux policy definitions for the URM (Username Resource Manager) service, which manages CPU, IRQ, and cgroup resources per username for optimizing system performance.

Changes include:

urm.fc: File context definitions mapping:
- /usr/bin/urm binary to urm_exec_t
- /run/restune_sock runtime socket to urm_runtime_t
- /etc/urm(/.*)? configuration files to urm_config_t
urm.te: Type declarations for 3 types:
- urm_t: URM daemon process domain
- urm_exec_t: URM executable
- urm_config_t: URM configuration files under /etc/urm
- urm_runtime_t: URM runtime socket under /run
Policy rules include:
- Syslog access for logging
- sysfs read/write for CPU frequency scaling and IRQ affinity
- PM QoS access via /dev/cpu_dma_latency
- Kernel sysctl read/write for scheduler resource clamping
- System state read from /proc for resource monitoring
- Kernel module request for netlink connector
- IRQ sysctl read/write for per-username IRQ affinity management
- Cgroup file and directory management for resource group isolation
- Netlink connector socket for kernel-userspace communication
- Unix stream socket for client-server communication
- Runtime socket transition under /run for client communication
urm.if: Three interface definitions:
- urm_read_config(): allows domains to read URM configuration
  files under /etc/urm
- urm_rw_runtime_socket(): allows domains to read and write
  URM runtime socket under /run
- urm_unix_stream_socket_connectto(): allows domains to connect
  to URM via unix domain stream socket

Add SELinux policy definitions for the URM (Username Resource Manager) service, which manages CPU, IRQ, and cgroup resources per username for optimizing system performance. Changes include: - urm.fc: File context definitions mapping: - /usr/bin/urm binary to urm_exec_t - /run/restune_sock runtime socket to urm_runtime_t - /etc/urm directory entry to urm_etc_t - /etc/urm(/.*)? configuration files to urm_config_t - urm.te: Type declarations for 4 types: - urm_t: URM daemon process domain - urm_exec_t: URM executable - urm_config_t: URM configuration files under /etc/urm - urm_runtime_t: URM runtime socket under /run - urm_etc_t: URM top-level /etc/urm directory entry Policy rules include: - Syslog access for logging - sysfs read/write for CPU frequency scaling and IRQ affinity - PM QoS access via /dev/cpu_dma_latency - Kernel sysctl read/write for scheduler resource clamping - System state read from /proc for resource monitoring - Kernel module request for netlink connector - IRQ sysctl read/write for per-username IRQ affinity management - Cgroup file and directory management for resource group isolation - Netlink connector socket for kernel-userspace communication - Unix stream socket for client-server communication - Required capabilities: sys_admin, net_admin, dac_override, dac_read_search - urm.if: Three interface definitions: - urm_read_config(): allows domains to read URM configuration files under /etc/urm - urm_rw_runtime_socket(): allows domains to read and write URM runtime socket under /run - urm_unix_stream_socket_connectto(): allows domains to connect to URM via unix domain stream socket Signed-off-by: varusing <varusing@qti.qualcomm.com>

sasikuma-qti · 2026-03-26T03:39:39Z

@@ -0,0 +1,4 @@
+/usr/bin/urm           --      gen_context(system_u:object_r:urm_exec_t,s0)
+/run/restune_sock      -s      gen_context(system_u:object_r:urm_runtime_t,s0)
+/etc/urm               --      gen_context(system_u:object_r:urm_etc_t,s0)


This is not required, let /etc/urm use urm_config_t label

sasikuma-qti · 2026-03-26T03:43:43Z

+##      Domain allowed access.
+##      </summary>
+## </param>
+## <rolecap/>


This line is not required.

sasikuma-qti · 2026-03-26T03:50:42Z

+        gen_require(`
+                type urm_t, urm_runtime_t;
+        ')
+        aloow $1 urm_runtime_t:sock_file write;


This line is not required. The above interface urm_rw_runtime_socket can be used to get read, write permissions on urm_runtime_t sock_file.

sasikuma-qti · 2026-03-26T03:56:38Z

+# under /run for client communication
+#
+
+allow urm_t urm_runtime_t:sock_file manage_sock_file_perms;


This should go under above urm local policy section.

sasikuma-qti · 2026-03-26T03:58:01Z

+allow urm_t self:netlink_connector_socket { create_socket_perms read };
+allow urm_t self:unix_stream_socket { create connectto };
+dontaudit urm_t self: capability net_admin;
+


Above three lines also should go under urm local policy.

sasikuma-qti · 2026-03-26T04:03:15Z

+dev_rw_pmqos(urm_t)
+
+# Read kernel sysctls e.g. sched_util_clamp_min
+kernel_read_kernel_sysctls(urm_t)


use kernel_rw_kernel_sysctl here instead of kernel_read_kernel_sysctls, because I can see you need write permissions as well from below policy.

allow urm_t sysctl_kernel_t:file { read write open getattr };

sasikuma-qti · 2026-03-26T04:08:04Z

+# for per-username CPU scheduling resource management
+#
+
+allow urm_t sysctl_kernel_t:file { read write open getattr };


Remove this line, because using kernel_rw_kernel_sysctl will not require this policy.

sasikuma-qti · 2026-03-26T04:09:45Z

+# CPU frequency scaling settings
+#
+
+allow urm_t urm_config_t:file { read write open getattr };


This should go under above urm local policy section. Use rw_file_perms macro.

sasikuma-qti · 2026-03-26T04:11:05Z

+#
+
+allow urm_t urm_etc_t:dir { search write create execute };
+allow urm_t urm_etc_t:file { read write open getattr create };


The above two lines can be merged as single policy and it should go under urm local policy section. Use rw_files_pattern macro.

sasikuma-qti · 2026-03-26T04:16:22Z

+#
+type cgroup_t;
+allow urm_t cgroup_t:dir { add_name create write search read open getattr };
+allow urm_t cgroup_t:file { create write read open getattr };


Remove above three lines and use fs_create_cgroup_files(urm_t)

Add SELinux policy definitions for the URM (Username Resource Manager) service, which manages CPU, IRQ, and cgroup resources per username for optimizing system performance. Changes include: - urm.fc: File context definitions mapping: - /usr/bin/urm binary to urm_exec_t - /run/restune_sock runtime socket to urm_runtime_t - /etc/urm(/.*)? configuration files to urm_config_t - urm.te: Type declarations for 3 types: - urm_t: URM daemon process domain - urm_exec_t: URM executable - urm_config_t: URM configuration files under /etc/urm - urm_runtime_t: URM runtime socket under /run Policy rules include: - Syslog access for logging - sysfs read/write for CPU frequency scaling and IRQ affinity - PM QoS access via /dev/cpu_dma_latency - Kernel sysctl read/write for scheduler resource clamping - System state read from /proc for resource monitoring - Kernel module request for netlink connector - IRQ sysctl read/write for per-username IRQ affinity management - Cgroup file and directory management for resource group isolation - Netlink connector socket for kernel-userspace communication - Unix stream socket for client-server communication - Runtime socket transition under /run for client communication - urm.if: Three interface definitions: - urm_read_config(): allows domains to read URM configuration files under /etc/urm - urm_rw_runtime_socket(): allows domains to read and write URM runtime socket under /run - urm_unix_stream_socket_connectto(): allows domains to connect to URM via unix domain stream socket Signed-off-by: varusing <varusing@qti.qualcomm.com>

varunsinghal29 · 2026-04-15T17:58:35Z

we are still getting below avc denial error :

`type=AVC msg=audit(19.543:258): avc: denied { dac_read_search } for pid=828 comm="urm" capability=2 scontext=system_u:system_r:urm_t:s0 tcontext=system_u:system_r:urm_t:s0 tclass=capability permissive=0

type=AVC msg=audit(19.543:258): avc: denied { dac_override } for pid=828 comm="urm" capability=1 scontext=system_u:system_r:urm_t:s0 tcontext=system_u:system_r:urm_t:s0 tclass=capability permissive=0`

@sasikuma-qti can you please re-review latest changes and also suggest what we need to add to remove above avc denials.

Add SELinux policy definitions for the URM (Username Resource Manager) service, which manages CPU, IRQ, and cgroup resources per username for optimizing system performance. Changes include: - urm.fc: File context definitions mapping: - /usr/bin/urm binary to urm_exec_t - /run/restune_sock runtime socket to urm_runtime_t - /etc/urm(/.*)? configuration files to urm_config_t - urm.te: Type declarations for 4 types: - urm_t: URM daemon process domain - urm_exec_t: URM executable - urm_config_t: URM configuration files under /etc/urm - urm_runtime_t: URM runtime socket under /run Policy rules include: - Runtime socket management under /run for client communication - Netlink connector socket for kernel-userspace communication - Unix stream socket for client-server communication - Suppress spurious capability denials for net_admin, dac_override and dac_read_search - Config file read/write for per-username CPU frequency scaling settings e.g. scaling_max_freq.txt - Syslog access for logging - sysfs read/write for CPU frequency scaling and IRQ affinity - PM QoS access via /dev/cpu_dma_latency for power and latency management per username - Kernel sysctl read/write e.g. sched_util_clamp_min - System state read from /proc for per-username resource usage monitoring - Kernel module request for netlink connector - IRQ sysctl read/write for per-username IRQ affinity management via /proc/irq/*/smp_affinity - Cgroup file and directory management for per-username resource group isolation - All domain process state read from /proc/<pid> for per-username process resource monitoring - Runtime socket transition under /run for client communication - urm.if: Three interface definitions: - urm_read_config(): allows domains to read URM configuration files under /etc/urm - urm_rw_runtime_socket(): allows domains to read and write URM runtime socket under /run - urm_unix_stream_socket_connectto(): allows domains to connect to URM via unix domain stream socket Signed-off-by: varusing <varusing@qti.qualcomm.com>

varunsinghal29 · 2026-04-29T04:47:55Z

@sasikuma-qti changes done as per suggestion. Thanks
please re-review this PR.

sasikuma-qti · 2026-04-29T05:04:41Z

@pebenito / @yizhao1 - To review further.

pebenito

There is a lint issue.
Please follow the StyleGuide as there are issues
Can you provide a link to the project here as a comment, as I'm unsure what URM this refers to.

Add SELinux policy definitions for the URM (Username Resource Manager) service, which manages CPU, IRQ, and cgroup resources per username for optimizing system performance. Changes include: - urm.fc: File context definitions mapping: - /usr/bin/urm binary to urm_exec_t - /run/restune_sock runtime socket to urm_runtime_t - /etc/urm(/.*)? configuration files to urm_config_t - urm.te: Type declarations for 4 types: - urm_t: URM daemon process domain - urm_exec_t: URM executable - urm_config_t: URM configuration files under /etc/urm - urm_runtime_t: URM runtime socket under /run Policy rules include: - Runtime socket management under /run for client communication - Netlink connector socket for kernel-userspace communication - Unix stream socket for client-server communication - Suppress spurious capability denials for net_admin, dac_override and dac_read_search - Config file read/write for per-username CPU frequency scaling settings e.g. scaling_max_freq.txt - Syslog access for logging - sysfs read/write for CPU frequency scaling and IRQ affinity - PM QoS access via /dev/cpu_dma_latency for power and latency management per username - Kernel sysctl read/write e.g. sched_util_clamp_min - System state read from /proc for per-username resource usage monitoring - Kernel module request for netlink connector - IRQ sysctl read/write for per-username IRQ affinity management via /proc/irq/*/smp_affinity - Cgroup file and directory management for per-username resource group isolation - All domain process state read from /proc/<pid> for per-username process resource monitoring - Runtime socket transition under /run for client communication - urm.if: Two interface definitions: - urm_read_config(): allows domains to read URM configuration files under /etc/urm - urm_stream_connectto(): allows domains to connect to URM via unix domain stream socket Signed-off-by: varusing <varusing@qti.qualcomm.com>

varunsinghal29 · 2026-05-06T14:38:01Z

URM project link : https://github.com/qualcomm/userspace-resource-manager
https://qualcomm.github.io/userspace-resource-manager/

please re-view this PR. Thanks

pebenito · 2026-05-07T20:42:24Z

URM project link : https://github.com/qualcomm/userspace-resource-manager https://qualcomm.github.io/userspace-resource-manager/

Is URM used outside of Qualcomm Linux? If not, I'm reluctant to accept it upstream, as I think it should be kept in your repo. I'd still be happy to continue this review, regardless.

varunsinghal29 · 2026-05-11T06:34:36Z

@pebenito
No, however, URM will be included as part of Ubuntu/Debian, and the work is in progress.
Please consider these changes acceptable for now.

pebenito

Please review the style guide, as the lines in the .fc file and local policy block (.te) are out of order

pebenito · 2026-05-12T19:15:34Z

+interface(`urm_stream_connectto',`
+        gen_require(`
+                type urm_t, urm_runtime_t;
+        ')
+
+        allow $1 urm_runtime_t:sock_file rw_sock_file_perms;
+        stream_connect_pattern($1, urm_runtime_t, urm_runtime_t, urm_t)
+')


Nit: Please drop the "to" at the end of the interface name: urm_stream_connect. Also make sure there is a new line at the end of the file.

pebenito · 2026-05-12T19:16:25Z

+## <summary>
+##      Policy for the URM (Username-Resource-Manager) service.
+## </summary>
+


.te files don't support this xml snippet. Please remove.

sasikuma-qti suggested changes Mar 26, 2026

View reviewed changes

varunsinghal29 changed the title ~~Add SELinux policy support for Username Resource Manager (URM)~~ Add SELinux policy support for Userspace Resource Manager (URM) Apr 6, 2026

varunsinghal29 marked this pull request as ready for review April 16, 2026 04:59

varunsinghal29 requested a review from sasikuma-qti April 22, 2026 05:43

sasikuma-qti suggested changes Apr 27, 2026

View reviewed changes

Comment thread policy/modules/services/urm.te

Comment thread policy/modules/services/urm.te Outdated

varunsinghal29 requested a review from sasikuma-qti April 29, 2026 04:46

sasikuma-qti approved these changes Apr 29, 2026

View reviewed changes

pebenito requested changes Apr 29, 2026

View reviewed changes

Comment thread policy/modules/services/urm.if Outdated

varunsinghal29 requested review from pebenito and sasikuma-qti May 6, 2026 14:38

pebenito requested changes May 12, 2026

View reviewed changes

Conversation

varunsinghal29 commented Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

varunsinghal29 commented Apr 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

varunsinghal29 commented Apr 29, 2026

Uh oh!

sasikuma-qti commented Apr 29, 2026

Uh oh!

pebenito left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

varunsinghal29 commented May 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pebenito commented May 7, 2026

Uh oh!

varunsinghal29 commented May 11, 2026

Uh oh!

pebenito left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

varunsinghal29 commented Mar 25, 2026 •

edited

Loading

varunsinghal29 commented Apr 15, 2026 •

edited

Loading

varunsinghal29 commented May 6, 2026 •

edited

Loading