: patch to allow readahead read init_t fifo files

PATCH New Guido Trentalancia 3 participants 5 messages Feb 16, 2011 – Feb 22, 2011

lore

Share & tools

lore

Guido Trentalancia

author

2011-02-16 06:00 UTC #0 lore raw

PATCH 1/34 : patch to allow readahead read init_t fifo files

This patch adds a new interface init_read_fifo_file() and uses it so that readahead can read init_t fifo files.

policy/modules/admin/readahead.te +1 -0

diff -pruN -x booleans.conf -x corenetwork.if -x corenetwork.te -x modules.conf refpolicy-git-02022011/policy/modules/admin/readahead.te refpolicy-git-02022011-new/policy/modules/admin/readahead.te
@@ -79,6 +79,7 @@ term_dontaudit_use_console(readahead_t)
 
 auth_dontaudit_read_shadow(readahead_t)
 
+init_read_fifo_file(readahead_t)
 init_use_fds(readahead_t)
 init_use_script_ptys(readahead_t)
 init_getattr_initctl(readahead_t)

policy/modules/system/init.if +18 -0

diff -pruN -x booleans.conf -x corenetwork.if -x corenetwork.te -x modules.conf refpolicy-git-02022011/policy/modules/system/init.if refpolicy-git-02022011-new/policy/modules/system/init.if
@@ -947,6 +947,24 @@ interface(`init_read_state',`
 
 ########################################
 ## <summary>
+##      Read init fifo file.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`init_read_fifo_file',`
+		gen_require(`
+		type init_t;
+	')
+
+	allow $1 init_t:fifo_file read_fifo_file_perms;
+')
+
+########################################
+## <summary>
 ##	Ptrace init
 ## </summary>
 ## <param name="domain">

Christopher J. PeBenito

2011-02-22 15:53 UTC #1 lore raw

PATCH 1/34 : patch to allow readahead read init_t fifo files

Quoted 2 lines · Guido Trentalancia

This patch adds a new interface init_read_fifo_file() and uses it so that readahead can read init_t fifo files.

This doesn't make sense to me. Its not run out of init; it shouldn't be inheriting unnamed pipes from init. It also makes me question the existing init_use_fds(readahead_t) rule in the policy.

Quoted 45 lines

diff -pruN -x booleans.conf -x corenetwork.if -x corenetwork.te -x modules.conf refpolicy-git-02022011/policy/modules/admin/readahead.te refpolicy-git-02022011-new/policy/modules/admin/readahead.te
policy/modules/admin/readahead.te +1 -0
@@ -79,6 +79,7 @@ term_dontaudit_use_console(readahead_t)
 
 auth_dontaudit_read_shadow(readahead_t)
 
+init_read_fifo_file(readahead_t)
 init_use_fds(readahead_t)
 init_use_script_ptys(readahead_t)
 init_getattr_initctl(readahead_t)
diff -pruN -x booleans.conf -x corenetwork.if -x corenetwork.te -x modules.conf refpolicy-git-02022011/policy/modules/system/init.if refpolicy-git-02022011-new/policy/modules/system/init.if
policy/modules/system/init.if +18 -0
@@ -947,6 +947,24 @@ interface(`init_read_state',`
 
 ########################################
 ## <summary>
+##      Read init fifo file.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`init_read_fifo_file',`
+		gen_require(`
+		type init_t;
+	')
+
+	allow $1 init_t:fifo_file read_fifo_file_perms;
+')
+
+########################################
+## <summary>
 ##	Ptrace init
 ## </summary>
 ## <param name="domain">
_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

Daniel J Walsh

2011-02-22 16:04 UTC #2 lore raw

PATCH 1/34 : patch to allow readahead read init_t fifo files

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Quoted 8 lines · Christopher J. PeBenito

Quoted 2 lines · Guido Trentalancia
This patch adds a new interface init_read_fifo_file() and uses it so that readahead can read init_t fifo files.
This doesn't make sense to me. Its not run out of init; it shouldn't be inheriting unnamed pipes from init. It also makes me question the existing init_use_fds(readahead_t) rule in the policy.

It is run by systemd now in F15
ls /lib/systemd/systemd-readahead-*
/lib/systemd/systemd-readahead-collect
/lib/systemd/systemd-readahead-replay

Quoted 41 lines

Quoted 41 lines
diff -pruN -x booleans.conf -x corenetwork.if -x corenetwork.te -x modules.conf refpolicy-git-02022011/policy/modules/admin/readahead.te refpolicy-git-02022011-new/policy/modules/admin/readahead.te
policy/modules/admin/readahead.te +1 -0
@@ -79,6 +79,7 @@ term_dontaudit_use_console(readahead_t)
 
 auth_dontaudit_read_shadow(readahead_t)
 
+init_read_fifo_file(readahead_t)
 init_use_fds(readahead_t)
 init_use_script_ptys(readahead_t)
 init_getattr_initctl(readahead_t)
diff -pruN -x booleans.conf -x corenetwork.if -x corenetwork.te -x modules.conf refpolicy-git-02022011/policy/modules/system/init.if refpolicy-git-02022011-new/policy/modules/system/init.if
policy/modules/system/init.if +18 -0
@@ -947,6 +947,24 @@ interface(`init_read_state',`
 
 ########################################
 ## <summary>
+##      Read init fifo file.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`init_read_fifo_file',`
+		gen_require(`
+		type init_t;
+	')
+
+	allow $1 init_t:fifo_file read_fifo_file_perms;
+')
+
+########################################
+## <summary>
 ##	Ptrace init
 ## </summary>
 ## <param name="domain">

Quoted 6 lines

Quoted 4 lines
_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk1j3pwACgkQrlYvE4MpobN3mACeJ/jPVTbHtHEjMNXeyXrQVnMx AZkAoIZxaKGGQuw5g+z7tIJkU2a8JfQw
=OmRJ
-----END PGP SIGNATURE-----

Guido Trentalancia

author

2011-02-22 17:35 UTC #3 lore raw

PATCH 1/34 : patch to allow readahead read init_t fifo files

Quoted 5 lines · Daniel J Walsh

Quoted 4 lines · Christopher J. PeBenito
Quoted 2 lines · Guido Trentalancia
This patch adds a new interface init_read_fifo_file() and uses it so that readahead can read init_t fifo files.

Quoted 8 lines

Quoted 4 lines
This doesn't make sense to me. Its not run out of init; it shouldn't be inheriting unnamed pipes from init. It also makes me question the existing init_use_fds(readahead_t) rule in the policy.
It is run by systemd now in F15
ls /lib/systemd/systemd-readahead-*
/lib/systemd/systemd-readahead-collect
/lib/systemd/systemd-readahead-replay

For your information, I am not using systemd. And I am not using readahead either. I did just install readahead (latest version) and test it very quickly and there was something being denied:

type=AVC msg=audit(1294704869.317:19776): avc: denied { read } for pid=2661 comm="readahead" path="pipe:[8853]" dev=pipefs ino=8853 scontext=system_u:system_r:readahead_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=fifo_file type=1400 audit(1294704824.813:3): avc: denied { read } for pid=1398 comm="readahead-colle" path="pipe:[3384]" dev=pipefs ino=3384 scontext=system_u:system_r:readahead_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=fifo_file

That's all I can add now.

Regards,

Guido

Daniel J Walsh

2011-02-22 19:56 UTC #4 lore raw

PATCH 1/34 : patch to allow readahead read init_t fifo files

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Quoted 28 lines · Guido Trentalancia

Quoted 5 lines · Daniel J Walsh
Quoted 4 lines · Christopher J. PeBenito
Quoted 2 lines · Guido Trentalancia
This patch adds a new interface init_read_fifo_file() and uses it so that readahead can read init_t fifo files.
Quoted 8 lines
Quoted 4 lines
This doesn't make sense to me. Its not run out of init; it shouldn't be inheriting unnamed pipes from init. It also makes me question the existing init_use_fds(readahead_t) rule in the policy.
It is run by systemd now in F15
ls /lib/systemd/systemd-readahead-*
/lib/systemd/systemd-readahead-collect
/lib/systemd/systemd-readahead-replay
For your information, I am not using systemd. And I am not using readahead either. I did just install readahead (latest version) and test it very quickly and there was something being denied:
type=AVC msg=audit(1294704869.317:19776): avc: denied { read } for pid=2661 comm="readahead" path="pipe:[8853]" dev=pipefs ino=8853 scontext=system_u:system_r:readahead_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=fifo_file type=1400 audit(1294704824.813:3): avc: denied { read } for pid=1398 comm="readahead-colle" path="pipe:[3384]" dev=pipefs ino=3384 scontext=system_u:system_r:readahead_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=fifo_file

Quoted 6 lines

That's all I can add now.
Regards,
Guido

Right this shows something we do not do a good job of handling in policy now. We do not handle the transitioning of open file descriptors down two levels. Let me explain.

We have domain "A_t" which opens up fifo_files to stdin, stdout, stderr, and transitions to "B_t". In the domtrans rules we allow B_t to use A_t:fifo_file read/write. But if B_t transitions to C_t, we do not pass the fifo_file down, we do not have a mechanism for saying allow C_t to read/write all file descriptors that have been passed to B_t. So what you are probably seeing is init_t:fifo_file handed to initrc_t which then hands them to readahead_t, and you end up with an AVC. -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk1kFPwACgkQrlYvE4MpobO4CwCgviuEU6qyLjmEQvSTFmoJxx8+ 5ssAniCS5FyhBfvaFT9/OmbYuSnS+iUQ
=m0/2
-----END PGP SIGNATURE-----