Updates on master (non-contrib)

When starting postgresql, it fails with the (little saying) error message:
pg_ctl: could not start server

In the denials, we notice:

Nov 24 10:41:52 lerya kernel: [1628900.540506] type=1400

audit(1353750112.021:10143): avc: denied { connectto } for pid=20481 comm="pg_ctl" path="/run/postgresql/.s.PGSQL.5432" ipaddr=... scontext=system_u:system_r:postgresql_t tcontext=system_u:system_r:postgresql_t tclass=unix_stream_socket

Hence, allow postgresql to connect to its own stream socket.

Signed-off-by Sven Vermeulen <[email protected]>

---
 policy/modules/services/postgresql.te |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

policy/modules/services/postgresql.te +0 -0

index 0210aef..94b1a57 100644

If the /run/lock/lvm directory doesn't exist yet, running any of the LVM tools (like lvscan) will create this directory. Introduce a named file transition for the lock location when a directory named "lvm" is created and grant the necessary rights to create the directory.

Signed-off-by Sven Vermeulen <[email protected]>

---
 policy/modules/system/lvm.te |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

policy/modules/system/lvm.te +0 -0

index f8eeecd..a712d85 100644

Some cron daemons, including vixie-cron, support using the system logger for handling their logging events. Hence we allow syslogd_t to manage the cron logs, and put a file transition in place for the system logger when it creates the cron.log file.

Signed-off-by Sven Vermeulen <[email protected]>

---
 policy/modules/system/logging.te |    5 +++++
 1 files changed, 5 insertions(+), 0 deletions(-)

policy/modules/system/logging.te +0 -0

index 09b9a31..c75cd96 100644
@@ -490,6 +490,11 @@ optional_policy(`
 ')

The apache_manage_all_user_content interface has been deprecated and is now pointing towards apache_manage_all_content.

Signed-off-by Sven Vermeulen <[email protected]>

---
 policy/modules/admin/usermanage.te |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

policy/modules/admin/usermanage.te +0 -0

index 673180c..9721f3b 100644

Quoted 2 lines · Sven Vermeulen

The apache_manage_all_user_content interface has been deprecated and is now pointing towards apache_manage_all_content.

policy/modules/admin/usermanage.te ifdef(`distro_redhat',` · line 539

Quoted 6 lines

optional_policy(`

policy/modules/admin/usermanage.te +1 -1

-	apache_manage_all_user_content(useradd_t)
+	apache_manage_all_content(useradd_t)
 ')
 
 optional_policy(`

I disagree with this change. Useradd should only be creating user content, e.g. ~/public_html. This change would provide too much access.

Quoted 3 lines · Christopher J. PeBenito

Quoted 2 lines · Sven Vermeulen

The apache_manage_all_user_content interface has been deprecated and is now pointing towards apache_manage_all_content.

[...]

Quoted 9 lines

policy/modules/admin/usermanage.te ifdef(`distro_redhat',` · line 539

Quoted 6 lines

optional_policy(`

policy/modules/admin/usermanage.te +1 -1

-	apache_manage_all_user_content(useradd_t)
+	apache_manage_all_content(useradd_t)
 ')
 
 optional_policy(`

I disagree with this change. Useradd should only be creating user content, e.g. ~/public_html. This change would provide too much access.

You misunderstood me (or I expressed myself badly ;-)

This is currently the definition of apache_manage_all_user_content:

#v+
interface(apache_manage_all_user_content',
refpolicywarn(`$0($*) has been deprecated, use apache_manage_all_content() instead.') apache_manage_all_content($1)
')
#v-

All I did in the patch was replace the call to the (deprecated) function towards the newly pointed function, so that we don't get a deprecation notice at build time anymore.

Quoted 26 lines · Sven Vermeulen

Quoted 3 lines · Christopher J. PeBenito

Quoted 2 lines · Sven Vermeulen

The apache_manage_all_user_content interface has been deprecated and is now pointing towards apache_manage_all_content.

[...]

Quoted 9 lines

policy/modules/admin/usermanage.te ifdef(`distro_redhat',` · line 539

Quoted 6 lines

optional_policy(`

policy/modules/admin/usermanage.te +1 -1

-	apache_manage_all_user_content(useradd_t)
+	apache_manage_all_content(useradd_t)
 ')
 
 optional_policy(`

I disagree with this change. Useradd should only be creating user content, e.g. ~/public_html. This change would provide too much access.

You misunderstood me (or I expressed myself badly ;-)

This is currently the definition of apache_manage_all_user_content:

#v+
interface(apache_manage_all_user_content',
refpolicywarn(`$0($*) has been deprecated, use apache_manage_all_content() instead.') apache_manage_all_content($1)
')
#v-

Quoted 3 lines

All I did in the patch was replace the call to the (deprecated) function towards the newly pointed function, so that we don't get a deprecation notice at build time anymore.

I didn't misunderstand. I think the interface should be un-deprecated.

Quoted 27 lines · Christopher J. PeBenito

Quoted 26 lines · Sven Vermeulen

Quoted 3 lines · Christopher J. PeBenito

Quoted 2 lines · Sven Vermeulen

The apache_manage_all_user_content interface has been deprecated and is now pointing towards apache_manage_all_content.

[...]

Quoted 9 lines

policy/modules/admin/usermanage.te ifdef(`distro_redhat',` · line 539

Quoted 6 lines

optional_policy(`

policy/modules/admin/usermanage.te +1 -1

-	apache_manage_all_user_content(useradd_t)
+	apache_manage_all_content(useradd_t)
 ')
 
 optional_policy(`

I disagree with this change. Useradd should only be creating user content, e.g. ~/public_html. This change would provide too much access.

You misunderstood me (or I expressed myself badly ;-)

This is currently the definition of apache_manage_all_user_content:

#v+
interface(apache_manage_all_user_content',
refpolicywarn(`$0($*) has been deprecated, use apache_manage_all_content() instead.') apache_manage_all_content($1)
')
#v-

Quoted 5 lines

Quoted 3 lines

All I did in the patch was replace the call to the (deprecated) function towards the newly pointed function, so that we don't get a deprecation notice at build time anymore.

I didn't misunderstand. I think the interface should be un-deprecated.

To further clarify, I think the interface should be un-deprecated and the original implementation restored. User content is the stuff in ~/public_html. Its not interchangeable with all content, which includes the static web pages and content from web apps.

Quoted 2 lines

To further clarify, I think the interface should be un-deprecated and the original implementation restored. User content is the stuff in ~/public_html. Its not interchangeable with all content, which includes the static web pages and content from web apps.

Yes, i guess i misunderstood this interface. Sven: will you create a patch for this or do i have to change it?

The htop utility will attempt to get the scheduling information of all processes. This information however does not seem to be needed for its information (no difference in output when allowed or not).

Signed-off-by Sven Vermeulen <[email protected]>

---
 policy/modules/kernel/domain.if     |   18 ++++++++++++++++++
 policy/modules/system/userdomain.if |    2 ++
 2 files changed, 20 insertions(+), 0 deletions(-)

policy/modules/kernel/domain.if +18 -0

index 6a1e4d1..caceae0 100644
@@ -889,6 +889,24 @@ interface(`domain_getpgid_all_domains',`
 
 ########################################
 ## <summary>
+##	Do not audit getting the scheduler information of all domains.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`domain_dontaudit_getsched_all_domains',`
+	gen_require(`
+		attribute domain;
+	')
+
+	dontaudit $1 domain:process getsched;
+')
+
+########################################
+## <summary>
 ##	Get the scheduler information of all domains.
 ## </summary>
 ## <param name="domain">

policy/modules/system/userdomain.if +0 -0

index 6d4424b..99ab865 100644

policy/modules/system/userdomain.if +1 -0

+
 	files_exec_etc_files($1_t)
 	files_search_locks($1_t)
 	# Check to see if cdrom is mounted

Quoted 3 lines

The htop utility will attempt to get the scheduling information of all processes. This information however does not seem to be needed for its information (no difference in output when allowed or not).

Quoted 7 lines

policy/modules/kernel/domain.if +7 -0

+interface(`domain_dontaudit_getsched_all_domains',`
+	gen_require(`
+		attribute domain;
+	')
+
+	dontaudit $1 domain:process getsched;
+')

policy/modules/system/userdomain.if template(`userdom_common_user_template',` · line 526

Quoted 7 lines

policy/modules/system/userdomain.if +1 -0

@@ -523,6 +523,8 @@ template(`userdom_common_user_template',`
 	dev_read_sound_mixer($1_t)
 	dev_write_sound_mixer($1_t)
 
+	domain_dontaudit_getsched_all_domains($1_t)

That is too coarse in my view.

This will also dontaudit legitimate access for processes needing this running in the user domain.

Lets say i have this app that depends on this permission for itself:

allow staff_t self:process { signal getsched };

Then this rule will silently hide that access

Quoted 10 lines

policy/modules/system/userdomain.if template(`userdom_common_user_template',` · line 526

Quoted 7 lines

policy/modules/system/userdomain.if +1 -0

@@ -523,6 +523,8 @@ template(`userdom_common_user_template',`
 	dev_read_sound_mixer($1_t)
 	dev_write_sound_mixer($1_t)
 
+	domain_dontaudit_getsched_all_domains($1_t)

That is too coarse in my view.

Quoted 8 lines

This will also dontaudit legitimate access for processes needing this running in the user domain.

Lets say i have this app that depends on this permission for itself:

allow staff_t self:process { signal getsched };

Then this rule will silently hide that access

I understand that, but the other method would be to create *_dontaudit_getsched for each and every possible module, and add it in the user domain definition fully loaded with optional_policy() statements.

And if the user domain doesn't need getsched itself, then running htop will generate denials anyhow for self (i.e. in your above example, you'll get denials for staff_t getsched on itself) so eventually you'll add in a staff_dontaudit_getsched() for that too?

Another alternative could be to run htop in its own domain, but that doesn't make sense imo...

Quoted 28 lines · Sven Vermeulen

Quoted 10 lines

policy/modules/system/userdomain.if template(`userdom_common_user_template',` · line 526

Quoted 7 lines

policy/modules/system/userdomain.if +1 -0

@@ -523,6 +523,8 @@ template(`userdom_common_user_template',`
 	dev_read_sound_mixer($1_t)
 	dev_write_sound_mixer($1_t)
 
+	domain_dontaudit_getsched_all_domains($1_t)

That is too coarse in my view.

Quoted 8 lines

This will also dontaudit legitimate access for processes needing this running in the user domain.

Lets say i have this app that depends on this permission for itself:

allow staff_t self:process { signal getsched };

Then this rule will silently hide that access

I understand that, but the other method would be to create *_dontaudit_getsched for each and every possible module, and add it in the user domain definition fully loaded with optional_policy() statements.

And if the user domain doesn't need getsched itself, then running htop will generate denials anyhow for self (i.e. in your above example, you'll get denials for staff_t getsched on itself) so eventually you'll add in a staff_dontaudit_getsched() for that too?

Quoted 2 lines

Another alternative could be to run htop in its own domain, but that doesn't make sense imo...

Chris, what is your take on this?

The stunnel init script reads the stunnel configuration to find out where to store and check for the PID file

Signed-off-by Sven Vermeulen <[email protected]>

---
 policy/modules/system/init.te |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)

policy/modules/system/init.te +0 -0

index 5f2a36a..a8f385b 100644

In many cases throughout the policy, domains require read/write privileges on inherited descriptors. In most cases, these are for files, where the domain needs the read-write permissions but of course no open privilege.

Instead of having to hard-code the permissions every time, this patch introduces the rw_inherited_file_perms to support simple calls for these inherited descriptors.

Signed-off-by Sven Vermeulen <[email protected]>

---
 policy/support/obj_perm_sets.spt |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

policy/support/obj_perm_sets.spt +0 -0

index 6e91317..48f0c7a 100644

Signed-off-by Sven Vermeulen <[email protected]>

---
 policy/modules/admin/usermanage.if |   36 ++++++++++++++++++++++++++++++++++++
 1 files changed, 36 insertions(+), 0 deletions(-)

policy/modules/admin/usermanage.if +29 -0

index 98b8b2d..99e3903 100644
@@ -140,6 +140,24 @@ interface(`usermanage_kill_passwd',`
 
 ########################################
 ## <summary>
+##	Check if the passwd binary is executable.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`usermanage_check_exec_passwd',`
+	gen_require(`
+		type passwd_exec_t;
+	')
+
+	allow $1 passwd_exec_t:file { execute getattr_file_perms };
+')
+
+########################################
+## <summary>
 ##	Execute passwd in the passwd domain, and
 ##	allow the specified role the passwd domain.
 ## </summary>

@@ -253,6 +271,24 @@ interface(`usermanage_domtrans_useradd',`
 
 ########################################
 ## <summary>
+##	Check if the useradd binaries are executable.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`usermanage_check_exec_useradd',`
+	gen_require(`
+		type useradd_exec_t;