Skip to contentSkip to conversation

: patch to add sys_ptrace permission to the dbus module

PATCH New Guido Trentalancia 3 participants 4 messages Feb 16, 2011 – Feb 28, 2011

lore
Share & tools
lore

Guido Trentalancia

author
#0 lore raw

PATCH 29/34 : patch to add sys_ptrace permission to the dbus module

This patch adds self:capability sys_ptrace to the dbus module.

policy/modules/services/dbus.te +1 -1
@@ -52,7 +52,7 @@ ifdef(`enable_mls',`
 
 # dac_override: /var/run/dbus is owned by messagebus on Debian
 # cjp: dac_override should probably go in a distro_debian
-allow system_dbusd_t self:capability { dac_override setgid setpcap setuid };
+allow system_dbusd_t self:capability { dac_override setgid setpcap setuid sys_ptrace };
 dontaudit system_dbusd_t self:capability sys_tty_config;
 allow system_dbusd_t self:process { getattr getsched signal_perms setpgid getcap setcap };
 allow system_dbusd_t self:fifo_file rw_fifo_file_perms;
#1 lore raw

PATCH 29/34 : patch to add sys_ptrace permission to the dbus module

policy/modules/services/dbus.te ifdef(`enable_mls',` · line 58

Quoted 13 lines · Guido Trentalancia

This patch adds self:capability sys_ptrace to the dbus module.

policy/modules/services/dbus.te +1 -1
@@ -52,7 +52,7 @@ ifdef(`enable_mls',`
 
 # dac_override: /var/run/dbus is owned by messagebus on Debian
 # cjp: dac_override should probably go in a distro_debian
-allow system_dbusd_t self:capability { dac_override setgid setpcap setuid };
+allow system_dbusd_t self:capability { dac_override setgid setpcap setuid sys_ptrace };
 dontaudit system_dbusd_t self:capability sys_tty_config;
 allow system_dbusd_t self:process { getattr getsched signal_perms setpgid getcap setcap };
 allow system_dbusd_t self:fifo_file rw_fifo_file_perms;

I find this highly questionable. It needs justification.

Signature · 3 lines
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
#2 lore raw

PATCH 29/34 : patch to add sys_ptrace permission to the dbus module

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Quoted 7 lines · Christopher J. PeBenito
Quoted 6 lines · Guido Trentalancia

This patch adds self:capability sys_ptrace to the dbus module.

policy/modules/services/dbus.te +0 -0
@@ -52,7 +52,7 @@ ifdef(`enable_mls',`
Quoted 10 lines

policy/modules/services/dbus.te ifdef(`enable_mls',` · line 58

Quoted 7 lines
policy/modules/services/dbus.te +1 -1
 # dac_override: /var/run/dbus is owned by messagebus on Debian
 # cjp: dac_override should probably go in a distro_debian
-allow system_dbusd_t self:capability { dac_override setgid setpcap setuid };
+allow system_dbusd_t self:capability { dac_override setgid setpcap setuid sys_ptrace };
 dontaudit system_dbusd_t self:capability sys_tty_config;
 allow system_dbusd_t self:process { getattr getsched signal_perms setpgid getcap setcap };
 allow system_dbusd_t self:fifo_file rw_fifo_file_perms;

I find this highly questionable. It needs justification.

We do not have this in Fedora. Might be similar to policykit, examining /proc/PID/cmdline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk1rv9cACgkQrlYvE4MpobPFbwCfS+tg0VMnAtOwN8G67WnBPN1J xX0An1tydi5iEvayHq/QtiZPqLWtSEdf
=nXYv
-----END PGP SIGNATURE-----

author
#3 lore raw

PATCH 29/34 : patch to add sys_ptrace permission to the dbus module

In reply to Christopher J. PeBenito

Hello Christopher !

Quoted 7 lines · Christopher J. PeBenito
Quoted 6 lines · Guido Trentalancia

This patch adds self:capability sys_ptrace to the dbus module.

policy/modules/services/dbus.te +0 -0
@@ -52,7 +52,7 @@ ifdef(`enable_mls',`
Quoted 9 lines

policy/modules/services/dbus.te ifdef(`enable_mls',` · line 58

Quoted 7 lines
policy/modules/services/dbus.te +1 -1
 # dac_override: /var/run/dbus is owned by messagebus on Debian
 # cjp: dac_override should probably go in a distro_debian
-allow system_dbusd_t self:capability { dac_override setgid setpcap setuid };
+allow system_dbusd_t self:capability { dac_override setgid setpcap setuid sys_ptrace };
 dontaudit system_dbusd_t self:capability sys_tty_config;
 allow system_dbusd_t self:process { getattr getsched signal_perms setpgid getcap setcap };
 allow system_dbusd_t self:fifo_file rw_fifo_file_perms;

I find this highly questionable. It needs justification.

After testing with the latest dbus, there are even more:

+ sys_resource in capability
and
+ setrlimit in process.

What's the latest version of dbus that you have tested ?

Regards,

Guido