Add more Debian support
cover Add more Debian support
Hi,
Please find here some patches to improve the support of debian.
Most of them are about adding file contexts. It also add support for rsyslog, the fact that /var/run/lock is a tmpfs mountpoint and some other changes.
Cheers
Laurent Bigonville
PATCH 1/13 Label /var/run/shm as tmpfs_t for Debian
From: Laurent Bigonville <[email protected]>
In Debian, /dev/shm is a symlink to /var/run/shm. Label that mountpoint the same way.
--- policy/modules/kernel/filesystem.fc | 5 +++++ 1 file changed, 5 insertions(+)
policy/modules/kernel/filesystem.fc +5 -0
@@ -14,3 +14,8 @@ # for systemd systems: /sys/fs/cgroup -d gen_context(system_u:object_r:cgroup_t,s0) /sys/fs/cgroup/.* <<none>> + +ifdef(`distro_debian',` +/var/run/shm -d gen_context(system_u:object_r:tmpfs_t,s0) +/var/run/shm/.* <<none>> +')
Signature · 1 line
1.7.10.4
PATCH 1/13 Label /var/run/shm as tmpfs_t for Debian
Quoted 13 lines · Laurent Bigonville
From: Laurent Bigonville <[email protected]>
In Debian,
/dev/shmis a symlink to/var/run/shm. Label that mountpoint the same way.--- policy/modules/kernel/filesystem.fc | 5 +++++ 1 file changed, 5 insertions(+)policy/modules/kernel/filesystem.fc +0
-0
policy/modules/kernel/filesystem.fc line 21
Quoted 8 lines
policy/modules/kernel/filesystem.fc +5
-0@@ -14,3 +14,8 @@ # for systemd systems: /sys/fs/cgroup -d gen_context(system_u:object_r:cgroup_t,s0) /sys/fs/cgroup/.* <<none>> + +ifdef(`distro_debian',` +/var/run/shm -d gen_context(system_u:object_r:tmpfs_t,s0) +/var/run/shm/.* <<none>> +')
Merged.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 2/13 Label /var/run/motd.dynamic as initrc_var_run_t
In reply to Laurent BigonvilleFrom: Laurent Bigonville <[email protected]>
--- policy/modules/kernel/files.fc | 1 + 1 file changed, 1 insertion(+)
policy/modules/kernel/files.fc +1 -0
@@ -269,4 +269,5 @@ ifndef(`distro_redhat',` ifdef(`distro_debian',` /var/run/motd -- gen_context(system_u:object_r:initrc_var_run_t,s0) +/var/run/motd.dynamic -- gen_context(system_u:object_r:initrc_var_run_t,s0) ')
Signature · 1 line
1.7.10.4
PATCH 2/13 Label /var/run/motd.dynamic as initrc_var_run_t
Quoted 2 lines · Laurent Bigonville
From: Laurent Bigonville <[email protected]>
Best to escape the period
Quoted 14 lines
--- policy/modules/kernel/files.fc | 1 + 1 file changed, 1 insertion(+)policy/modules/kernel/files.fc +1
-0@@ -269,4 +269,5 @@ ifndef(`distro_redhat',` ifdef(`distro_debian',` /var/run/motd -- gen_context(system_u:object_r:initrc_var_run_t,s0) +/var/run/motd.dynamic -- gen_context(system_u:object_r:initrc_var_run_t,s0) ')
PATCH v2 2/13 Label /var/run/motd.dynamic as initrc_var_run_t
In reply to Laurent BigonvilleFrom: Laurent Bigonville <[email protected]>
--- policy/modules/kernel/files.fc | 1 + 1 file changed, 1 insertion(+)
policy/modules/kernel/files.fc +1 -0
@@ -269,4 +269,5 @@ ifndef(`distro_redhat',` ifdef(`distro_debian',` /var/run/motd -- gen_context(system_u:object_r:initrc_var_run_t,s0) +/var/run/motd\.dynamic -- gen_context(system_u:object_r:initrc_var_run_t,s0) ')
Signature · 1 line
1.7.10.4
PATCH v2 2/13 Label /var/run/motd.dynamic as initrc_var_run_t
Quoted 11 lines · Laurent Bigonville
From: Laurent Bigonville <[email protected]>
--- policy/modules/kernel/files.fc | 1 + 1 file changed, 1 insertion(+)policy/modules/kernel/files.fc +0
-0
policy/modules/kernel/files.fc ifndef(`distro_redhat',` · line 273
Quoted 5 lines
policy/modules/kernel/files.fc +1
-0@@ -269,4 +269,5 @@ ifndef(`distro_redhat',` ifdef(`distro_debian',` /var/run/motd -- gen_context(system_u:object_r:initrc_var_run_t,s0) +/var/run/motd\.dynamic -- gen_context(system_u:object_r:initrc_var_run_t,s0) ')
Merged.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 3/13 Label /var/run/initctl as initctl_t
In reply to Laurent BigonvilleFrom: Laurent Bigonville <[email protected]>
In Debian, the initctl pipe has been moved from /dev/initctl to /run/initctl
--- policy/modules/system/init.fc | 1 + 1 file changed, 1 insertion(+)
policy/modules/system/init.fc +1 -0
@@ -51,6 +51,7 @@ ifdef(`distro_gentoo', ` # # /var # +/var/run/initctl -p gen_context(system_u:object_r:initctl_t,s0) /var/run/utmp -- gen_context(system_u:object_r:initrc_var_run_t,s0) /var/run/runlevel\.dir gen_context(system_u:object_r:initrc_var_run_t,s0) /var/run/random-seed -- gen_context(system_u:object_r:initrc_var_run_t,s0)
Signature · 1 line
1.7.10.4
PATCH 4/13 udev.if: Call files_search_pid instead of files_search_var_lib in udev_manage_pid_files
In reply to Laurent BigonvilleFrom: Laurent Bigonville <[email protected]>
udev_manage_pid_files is supposed to manage files that are located in /var/run, allow to search files in this directory instead of /var/lib
--- policy/modules/system/udev.if | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
policy/modules/system/udev.if +1 -1
@@ -296,7 +296,7 @@ interface(`udev_manage_pid_files',` type udev_var_run_t; ') - files_search_var_lib($1) + files_search_pids($1) manage_files_pattern($1, udev_var_run_t, udev_var_run_t) ')
Signature · 1 line
1.7.10.4
PATCH 4/13 udev.if: Call files_search_pid instead of files_search_var_lib in udev_manage_pid_files
Quoted 13 lines · Laurent Bigonville
From: Laurent Bigonville <[email protected]>
udev_manage_pid_filesis supposed to manage files that are located in/var/run, allow to search files in this directory instead of/var/lib--- policy/modules/system/udev.if | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)policy/modules/system/udev.if +0
-0
policy/modules/system/udev.if interface(`udev_manage_pid_files',` · line 301
Quoted 7 lines
policy/modules/system/udev.if +1
-1@@ -296,7 +296,7 @@ interface(`udev_manage_pid_files',` type udev_var_run_t; ') - files_search_var_lib($1) + files_search_pids($1) manage_files_pattern($1, udev_var_run_t, udev_var_run_t) ')
Merged.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 5/13 Label executables in /usr/lib/NetworkManager/ as bin_t
In reply to Laurent BigonvilleFrom: Laurent Bigonville <[email protected]>
--- policy/modules/kernel/corecommands.fc | 1 + 1 file changed, 1 insertion(+)
policy/modules/kernel/corecommands.fc +1 -0
@@ -217,6 +217,7 @@ ifdef(`distro_gentoo',` /usr/lib/misc/sftp-server -- gen_context(system_u:object_r:bin_t,s0) /usr/lib/nagios/plugins(/.*)? gen_context(system_u:object_r:bin_t,s0) /usr/lib/netsaint/plugins(/.*)? gen_context(system_u:object_r:bin_t,s0) +/usr/lib/NetworkManager/nm\-.* -- gen_context(system_u:object_r:bin_t,s0) /usr/lib/news/bin(/.*)? gen_context(system_u:object_r:bin_t,s0) /usr/lib/nspluginwrapper/np.* gen_context(system_u:object_r:bin_t,s0) /usr/lib/portage/bin(/.*)? gen_context(system_u:object_r:bin_t,s0)
Signature · 1 line
1.7.10.4
PATCH 5/13 Label executables in /usr/lib/NetworkManager/ as bin_t
Quoted 11 lines · Laurent Bigonville
From: Laurent Bigonville <[email protected]>
--- policy/modules/kernel/corecommands.fc | 1 + 1 file changed, 1 insertion(+)policy/modules/kernel/corecommands.fc +0
-0
policy/modules/kernel/corecommands.fc ifdef(`distro_gentoo',` · line 223
Quoted 7 lines
policy/modules/kernel/corecommands.fc +1
-0@@ -217,6 +217,7 @@ ifdef(`distro_gentoo',` /usr/lib/misc/sftp-server -- gen_context(system_u:object_r:bin_t,s0) /usr/lib/nagios/plugins(/.*)? gen_context(system_u:object_r:bin_t,s0) /usr/lib/netsaint/plugins(/.*)? gen_context(system_u:object_r:bin_t,s0) +/usr/lib/NetworkManager/nm\-.* -- gen_context(system_u:object_r:bin_t,s0) /usr/lib/news/bin(/.*)? gen_context(system_u:object_r:bin_t,s0) /usr/lib/nspluginwrapper/np.* gen_context(system_u:object_r:bin_t,s0) /usr/lib/portage/bin(/.*)? gen_context(system_u:object_r:bin_t,s0)
Merged.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 6/13 Add support for rsyslog
In reply to Laurent BigonvilleFrom: Laurent Bigonville <[email protected]>
Allow sys_nice capability, setsched, allow to search in /var/spool and syslog_t domain to read network state files in /proc
squash! Add support for rsyslog
--- policy/modules/system/logging.te | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
policy/modules/system/logging.te +6 -2
@@ -353,13 +353,15 @@ optional_policy(` # chown fsetid for syslog-ng # sys_admin for the integrated klog of syslog-ng and metalog +# sys_nice for rsyslog # cjp: why net_admin! -allow syslogd_t self:capability { dac_override sys_resource sys_tty_config net_admin sys_admin chown fsetid }; +allow syslogd_t self:capability { dac_override sys_resource sys_tty_config net_admin sys_admin sys_nice chown fsetid }; dontaudit syslogd_t self:capability sys_tty_config; # setpgid for metalog # setrlimit for syslog-ng # getsched for syslog-ng -allow syslogd_t self:process { signal_perms setpgid setrlimit getsched }; +# setsched for rsyslog +allow syslogd_t self:process { signal_perms setpgid setrlimit getsched setsched }; # receive messages to be logged allow syslogd_t self:unix_dgram_socket create_socket_perms; allow syslogd_t self:unix_stream_socket create_stream_socket_perms;
@@ -377,6 +379,7 @@ files_pid_filetrans(syslogd_t, devlog_t, sock_file) # create/append log files. manage_files_pattern(syslogd_t, var_log_t, var_log_t) rw_fifo_files_pattern(syslogd_t, var_log_t, var_log_t) +files_search_spool(syslogd_t) # Allow access for syslog-ng allow syslogd_t var_log_t:dir { create setattr };
@@ -394,6 +397,7 @@ manage_files_pattern(syslogd_t, syslogd_var_run_t, syslogd_var_run_t) files_pid_filetrans(syslogd_t, syslogd_var_run_t, file) kernel_read_system_state(syslogd_t) +kernel_read_network_state(syslogd_t) kernel_read_kernel_sysctls(syslogd_t) kernel_read_proc_symlinks(syslogd_t) # Allow access to /proc/kmsg for syslog-ng
Signature · 1 line
1.7.10.4
PATCH 6/13 Add support for rsyslog
Quoted 6 lines · Laurent Bigonville
From: Laurent Bigonville <[email protected]>
Allow
sys_nicecapability, setsched, allow to search in/var/spoolandsyslog_tdomain to read network state files in /procsquash! Add support for rsyslog
Merged.
Quoted 43 lines
--- policy/modules/system/logging.te | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)policy/modules/system/logging.te +6
-2@@ -353,13 +353,15 @@ optional_policy(` # chown fsetid for syslog-ng # sys_admin for the integrated klog of syslog-ng and metalog +# sys_nice for rsyslog # cjp: why net_admin! -allow syslogd_t self:capability { dac_override sys_resource sys_tty_config net_admin sys_admin chown fsetid }; +allow syslogd_t self:capability { dac_override sys_resource sys_tty_config net_admin sys_admin sys_nice chown fsetid }; dontaudit syslogd_t self:capability sys_tty_config; # setpgid for metalog # setrlimit for syslog-ng # getsched for syslog-ng -allow syslogd_t self:process { signal_perms setpgid setrlimit getsched }; +# setsched for rsyslog +allow syslogd_t self:process { signal_perms setpgid setrlimit getsched setsched }; # receive messages to be logged allow syslogd_t self:unix_dgram_socket create_socket_perms; allow syslogd_t self:unix_stream_socket create_stream_socket_perms;@@ -377,6 +379,7 @@ files_pid_filetrans(syslogd_t, devlog_t, sock_file) # create/append log files. manage_files_pattern(syslogd_t, var_log_t, var_log_t) rw_fifo_files_pattern(syslogd_t, var_log_t, var_log_t) +files_search_spool(syslogd_t) # Allow access for syslog-ng allow syslogd_t var_log_t:dir { create setattr };@@ -394,6 +397,7 @@ manage_files_pattern(syslogd_t, syslogd_var_run_t, syslogd_var_run_t) files_pid_filetrans(syslogd_t, syslogd_var_run_t, file) kernel_read_system_state(syslogd_t) +kernel_read_network_state(syslogd_t) kernel_read_kernel_sysctls(syslogd_t) kernel_read_proc_symlinks(syslogd_t) # Allow access to /proc/kmsg for syslog-ng
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 7/13 Label var_lock_t as a mountpoint in Debian
In reply to Laurent BigonvilleFrom: Laurent Bigonville <[email protected]>
In Debian, /var/lock is a symlink to /var/run/lock which is a tmpfs mount.
--- policy/modules/kernel/files.te | 4 ++++ 1 file changed, 4 insertions(+)
policy/modules/kernel/files.te +4 -0
@@ -232,3 +232,7 @@ allow files_unconfined_type file_type:filesystem *; tunable_policy(`allow_execmod',` allow files_unconfined_type file_type:file execmod; ') + +ifdef(`distro_debian',` + files_mountpoint(var_lock_t) +')
Signature · 1 line
1.7.10.4
PATCH 7/13 Label var_lock_t as a mountpoint in Debian
Is /var/run/lock a (tmpfs) mountpoint, or is /var/run a (tmpfs) mountpoint and the lock subdirectory just that - a subdirectory?
I've seen 5 distributions using /var/run as either be a tmpfs, or a symlink to /run which is a tmpfs.
Quoted 24 lines · Laurent Bigonville
From: Laurent Bigonville <[email protected]>
In Debian,
/var/lockis a symlink to/var/run/lockwhich is a tmpfs mount.--- policy/modules/kernel/files.te | 4 ++++ 1 file changed, 4 insertions(+)policy/modules/kernel/files.te +4
-1@@ -232,3 +232,7 @@ allow files_unconfined_type file_type:filesystem *; tunable_policy(`allow_execmod',` allow files_unconfined_type file_type:file execmod; ') + +ifdef(`distro_debian',` + files_mountpoint(var_lock_t) +') --1.7.10.4
Quoted 5 lines
_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://oss.tresys.com/pipermail/refpolicy/attachments/20130113/02f64557/attachment.html
PATCH 7/13 Label var_lock_t as a mountpoint in Debian
Quoted 7 lines · Sven Vermeulen
Is
/var/run/locka (tmpfs) mountpoint, or is/var/runa (tmpfs) mountpoint and the lock subdirectory just that - a subdirectory?I've seen 5 distributions using
/var/runas either be a tmpfs, or a symlink to /run which is a tmpfs.
They both are mountpoints in debian (/run and /run/lock)
At least that is what i saw from Laurents mount command output
Quoted 78 lines · Laurent Bigonville
Quoted 25 lines
From: Laurent Bigonville <[email protected]>
In Debian,
/var/lockis a symlink to/var/run/lockwhich is a tmpfs mount.--- policy/modules/kernel/files.te | 4 ++++ 1 file changed, 4 insertions(+)policy/modules/kernel/files.te +4
-1@@ -232,3 +232,7 @@ allow files_unconfined_type file_type:filesystem *; tunable_policy(`allow_execmod',` allow files_unconfined_type file_type:file execmod; ') + +ifdef(`distro_debian',` + files_mountpoint(var_lock_t) +') --1.7.10.4
Quoted 5 lines
_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicyIs
/var/run/locka (tmpfs) mountpoint, or is/var/runa (tmpfs) mountpoint and the lock subdirectory just that - a subdirectory?I've seen 5 distributions using
/var/runas either be a tmpfs, or a symlink to /run which is a tmpfs.On Sat, Jan 12, 2013 at 10:32 PM, Laurent Bigonville <[email protected]> wrote:
From: Laurent Bigonville <[email protected]> In Debian, /var/lock is a symlink to /var/run/lock which is a tmpfs mount. --- policy/modules/kernel/files.te | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/policy/modules/kernel/files.te b/policy/modules/kernel/files.te index 148d87a..a5554e8 100644 --- a/policy/modules/kernel/files.te +++ b/policy/modules/kernel/files.te @@ -232,3 +232,7 @@ allow files_unconfined_type file_type:filesystem *; tunable_policy(`allow_execmod',` allow files_unconfined_type file_type:file execmod; ') + +ifdef(`distro_debian',` + files_mountpoint(var_lock_t) +') -- 1.7.10.4 _______________________________________________ refpolicy mailing list refpolicy at oss.tresys.com http://oss.tresys.com/mailman/listinfo/refpolicy_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy
PATCH 7/13 Label var_lock_t as a mountpoint in Debian
Le Sun, 13 Jan 2013 21:03:05 +0100, Dominick Grift <[email protected]> a ?crit :
Quoted 12 lines · Sven Vermeulen
Quoted 7 lines
Is
/var/run/locka (tmpfs) mountpoint, or is/var/runa (tmpfs) mountpoint and the lock subdirectory just that - a subdirectory?I've seen 5 distributions using
/var/runas either be a tmpfs, or a symlink to /run which is a tmpfs.They both are mountpoints in debian (/run and
/run/lock)At least that is what i saw from Laurents mount command output
Indeed on all the wheezy/sid machines I've running ATM (well that mades 3, but they have been installed at different time), I have (output of mount|grep tmpfs):
udev on /dev type devtmpfs (rw,relatime,seclabel,size=10240k,nr_inodes=1016576,mode=755)
tmpfs on /run type tmpfs (rw,nosuid,noexec,relatime,seclabel,size=814752k,mode=755)
tmpfs on /run/lock type tmpfs (rw,nosuid,nodev,noexec,relatime,rootcontext=system_u:object_r:var_lock_t:s0,seclabel,size=5120k) tmpfs on /run/shm type tmpfs (rw,nosuid,nodev,noexec,relatime,rootcontext=system_u:object_r:tmpfs_t:s0,seclabel,size=1629480k)
and (ls -lad /var/*)
lrwxrwxrwx. 1 root root 4 oct 19 20:33 /var/run -> /run lrwxrwxrwx. 1 root root 9 oct 19 20:33 /var/lock -> /run/lock
Cheers
Laurent Bigonville
PATCH 7/13 Label var_lock_t as a mountpoint in Debian
In reply to Dominick Grift-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Quoted 63 lines · Dominick Grift
Quoted 7 lines · Sven Vermeulen
Is
/var/run/locka (tmpfs) mountpoint, or is/var/runa (tmpfs) mountpoint and the lock subdirectory just that - a subdirectory?I've seen 5 distributions using
/var/runas either be a tmpfs, or a symlink to /run which is a tmpfs.They both are mountpoints in debian (/run and
/run/lock)At least that is what i saw from Laurents mount command output
Quoted 50 lines
Quoted 14 lines · Laurent Bigonville
From: Laurent Bigonville <[email protected]>
In Debian,
/var/lockis a symlink to/var/run/lockwhich is a tmpfs
mount. --- policy/modules/kernel/files.te | 4 ++++ 1 file changed, 4
insertions(+)(quoted diff) +0
-0b/policy/modules/kernel/files.te index 148d87a..a5554e8 100644 --- a/policy/modules/kernel/files.te +++ b/policy/modules/kernel/files.te
(quoted diff) +0
-0@@ -232,3 +232,7 @@ allow files_unconfined_type file_type:filesystem *; tunable_policy(`allow_execmod',` allow files_unconfined_typefile_type:file execmod; ') + +ifdef(
distro_debian',+files_mountpoint(var_lock_t)+') -- 1.7.10.4Quoted 4 lines
_______________________________________________ refpolicy mailing list refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicyIs
/var/run/locka (tmpfs) mountpoint, or is/var/runa (tmpfs) mountpoint and the lock subdirectory just that - a subdirectory?I've seen 5 distributions using
/var/runas either be a tmpfs, or a symlink to /run which is a tmpfs.On Sat, Jan 12, 2013 at 10:32 PM, Laurent Bigonville <[email protected]>
wrote: From: Laurent Bigonville <[email protected]>In Debian,
/var/lockis a symlink to/var/run/lockwhich is a tmpfs
mount. --- policy/modules/kernel/files.te | 4 ++++ 1 file changed, 4
insertions(+)(quoted diff) +0
-0b/policy/modules/kernel/files.te index 148d87a..a5554e8 100644 --- a/policy/modules/kernel/files.te +++ b/policy/modules/kernel/files.te @@ -232,3 +232,7 @@ allow
files_unconfined_typefile_type:filesystem *; tunable_policy(allow_execmod',allowfiles_unconfined_typefile_type:file execmod; ') + +ifdef(distro_debian',+files_mountpoint(var_lock_t)+') -- 1.7.10.4_______________________________________________ refpolicy mailing list refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy
Quoted 8 lines
Quoted 3 lines
_______________________________________________ refpolicy mailing list refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy_______________________________________________ refpolicy mailing list refpolicy at oss.tresys.com http://oss.tresys.com/mailman/listinfo/refpolicy
I see no reason to wrap this in a ifdef block. -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iEYEARECAAYFAlD0N4UACgkQrlYvE4MpobOI8gCdG3IZQaI/q14VS9e/G8BkxjG7 RrYAoIIcGndvqlI7mmgDxA7snYhm7yXc
=4p6K
-----END PGP SIGNATURE-----
PATCH v2 7/13 Label var_lock_t as a mountpoint
In reply to Laurent BigonvilleFrom: Laurent Bigonville <[email protected]>
In Debian, /var/lock is a symlink to /var/run/lock which is a tmpfs mount.
--- policy/modules/kernel/files.te | 1 + 1 file changed, 1 insertion(+)
policy/modules/kernel/files.te +1 -0
@@ -173,6 +173,7 @@ files_mountpoint(var_lib_t) # type var_lock_t; files_lock_file(var_lock_t) +files_mountpoint(var_lock_t) # # var_run_t is the type of /var/run, usually
Signature · 1 line
1.7.10.4
PATCH v2 7/13 Label var_lock_t as a mountpoint
Quoted 13 lines · Laurent Bigonville
From: Laurent Bigonville <[email protected]>
In Debian,
/var/lockis a symlink to/var/run/lockwhich is a tmpfs mount.--- policy/modules/kernel/files.te | 1 + 1 file changed, 1 insertion(+)policy/modules/kernel/files.te +0
-0
policy/modules/kernel/files.te files_mountpoint(var_lib_t) · line 179
Quoted 7 lines
policy/modules/kernel/files.te +1
-0@@ -173,6 +173,7 @@ files_mountpoint(var_lib_t) # type var_lock_t; files_lock_file(var_lock_t) +files_mountpoint(var_lock_t) # # var_run_t is the type of /var/run, usually
Merged.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 8/13 Add mount_var_run_t type and allow mount_t domain to manage the files and directories
In reply to Laurent BigonvilleFrom: Laurent Bigonville <[email protected]>
In Debian, mount store some information (a utab file) under /var/run/mount directory.
This is inspired by the fedora policy.
--- policy/modules/system/mount.fc | 2 ++ policy/modules/system/mount.te | 8 ++++++++ 2 files changed, 10 insertions(+)
policy/modules/system/mount.fc +2 -0
@@ -2,3 +2,5 @@ /bin/umount.* -- gen_context(system_u:object_r:mount_exec_t,s0) /usr/bin/fusermount -- gen_context(system_u:object_r:mount_exec_t,s0) + +/var/run/mount(/.*)? gen_context(system_u:object_r:mount_var_run_t,s0)
policy/modules/system/mount.te +8 -0
@@ -26,6 +26,9 @@ files_type(mount_loopback_t) type mount_tmp_t; files_tmp_file(mount_tmp_t) +type mount_var_run_t; +files_pid_file(mount_var_run_t) + # causes problems with interfaces when # this is optionally declared in monolithic # policy--duplicate type declaration
@@ -49,6 +52,11 @@ can_exec(mount_t, mount_exec_t) files_tmp_filetrans(mount_t, mount_tmp_t, { file dir }) +create_dirs_pattern(mount_t, mount_var_run_t, mount_var_run_t) +create_files_pattern(mount_t, mount_var_run_t, mount_var_run_t) +rw_files_pattern(mount_t, mount_var_run_t, mount_var_run_t) +files_pid_filetrans(mount_t, mount_var_run_t, dir, "mount") + kernel_read_system_state(mount_t) kernel_read_kernel_sysctls(mount_t) kernel_dontaudit_getattr_core_if(mount_t)
Signature · 1 line
1.7.10.4
PATCH 8/13 Add mount_var_run_t type and allow mount_t domain to manage the files and directories
Quoted 6 lines · Laurent Bigonville
From: Laurent Bigonville <[email protected]>
In Debian, mount store some information (a utab file) under
/var/run/mountdirectory.This is inspired by the fedora policy.
Merged.
Quoted 42 lines
--- policy/modules/system/mount.fc | 2 ++ policy/modules/system/mount.te | 8 ++++++++ 2 files changed, 10 insertions(+)policy/modules/system/mount.fc +2
-0@@ -2,3 +2,5 @@ /bin/umount.* -- gen_context(system_u:object_r:mount_exec_t,s0) /usr/bin/fusermount -- gen_context(system_u:object_r:mount_exec_t,s0) + +/var/run/mount(/.*)? gen_context(system_u:object_r:mount_var_run_t,s0)policy/modules/system/mount.te +8
-0@@ -26,6 +26,9 @@ files_type(mount_loopback_t) type mount_tmp_t; files_tmp_file(mount_tmp_t) +type mount_var_run_t; +files_pid_file(mount_var_run_t) + # causes problems with interfaces when # this is optionally declared in monolithic # policy--duplicate type declaration@@ -49,6 +52,11 @@ can_exec(mount_t, mount_exec_t) files_tmp_filetrans(mount_t, mount_tmp_t, { file dir }) +create_dirs_pattern(mount_t, mount_var_run_t, mount_var_run_t) +create_files_pattern(mount_t, mount_var_run_t, mount_var_run_t) +rw_files_pattern(mount_t, mount_var_run_t, mount_var_run_t) +files_pid_filetrans(mount_t, mount_var_run_t, dir, "mount") + kernel_read_system_state(mount_t) kernel_read_kernel_sysctls(mount_t) kernel_dontaudit_getattr_core_if(mount_t)
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 9/13 Allow mount_t to set priority of kernel threads
In reply to Laurent BigonvilleFrom: Laurent Bigonville <[email protected]>
--- policy/modules/system/mount.te | 1 + 1 file changed, 1 insertion(+)
policy/modules/system/mount.te +1 -0
@@ -64,6 +64,7 @@ kernel_dontaudit_write_debugfs_dirs(mount_t) kernel_dontaudit_write_proc_dirs(mount_t) # To load binfmt_misc kernel module kernel_request_load_module(mount_t) +kernel_setsched(mount_t) # required for mount.smbfs corecmd_exec_bin(mount_t)
Signature · 1 line
1.7.10.4
PATCH 9/13 Allow mount_t to set priority of kernel threads
Quoted 11 lines · Laurent Bigonville
From: Laurent Bigonville <[email protected]>
--- policy/modules/system/mount.te | 1 + 1 file changed, 1 insertion(+)policy/modules/system/mount.te +0
-0
policy/modules/system/mount.te kernel_dontaudit_write_debugfs_dirs(mount_t) · line 70
Quoted 7 lines
policy/modules/system/mount.te +1
-0@@ -64,6 +64,7 @@ kernel_dontaudit_write_debugfs_dirs(mount_t) kernel_dontaudit_write_proc_dirs(mount_t) # To load binfmt_misc kernel module kernel_request_load_module(mount_t) +kernel_setsched(mount_t) # required for mount.smbfs corecmd_exec_bin(mount_t)
Any idea why this is required?
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 9/13 Allow mount_t to set priority of kernel threads
Le Wed, 23 Jan 2013 07:17:40 -0500,
"Christopher J. PeBenito" <[email protected]> a ?crit :
Quoted 17 lines · Laurent Bigonville
Quoted 16 lines
From: Laurent Bigonville <[email protected]>
--- policy/modules/system/mount.te | 1 + 1 file changed, 1 insertion(+)(quoted diff) +0
-0b/policy/modules/system/mount.te index 8fcd782..7a58d79 100644
policy/modules/system/mount.te +1
-0@@ -64,6 +64,7 @@ kernel_dontaudit_write_debugfs_dirs(mount_t) kernel_dontaudit_write_proc_dirs(mount_t) # To load binfmt_misc kernel module kernel_request_load_module(mount_t) +kernel_setsched(mount_t)
Quoted 5 lines
policy/modules/system/mount.te kernel_dontaudit_write_debugfs_dirs(mount_t) · line 70
Quoted 2 lines
policy/modules/system/mount.te +0
-0# required for mount.smbfs corecmd_exec_bin(mount_t)Any idea why this is required?
During (early) boot I get this AVC:
[ 8.452944] type=1400 audit(1358970896.236:59): avc: denied { setsched } for pid=1327 comm="mount" scontext=system_u:system_r:mount_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=processI'm not too sure why this is require, I see nothing in the code, it's maybe coming from a dep?
Cheers
Laurent Bigonville
PATCH 10/13 Allow mount_t to read module_deps_t files
In reply to Laurent BigonvilleFrom: Laurent Bigonville <[email protected]>
--- policy/modules/system/mount.te | 2 ++ 1 file changed, 2 insertions(+)
policy/modules/system/mount.te +2 -0
@@ -135,6 +135,8 @@ logging_send_syslog_msg(mount_t) miscfiles_read_localization(mount_t) +modutils_read_module_deps(mount_t) + sysnet_use_portmap(mount_t) seutil_read_config(mount_t)
Signature · 1 line
1.7.10.4
PATCH 10/13 Allow mount_t to read module_deps_t files
Quoted 11 lines · Laurent Bigonville
From: Laurent Bigonville <[email protected]>
--- policy/modules/system/mount.te | 2 ++ 1 file changed, 2 insertions(+)policy/modules/system/mount.te +0
-0
policy/modules/system/mount.te logging_send_syslog_msg(mount_t) · line 142
Quoted 8 lines
policy/modules/system/mount.te +2
-0@@ -135,6 +135,8 @@ logging_send_syslog_msg(mount_t) miscfiles_read_localization(mount_t) +modutils_read_module_deps(mount_t) + sysnet_use_portmap(mount_t) seutil_read_config(mount_t)
Any idea why this is required?
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 10/13 Allow mount_t to read module_deps_t files
Le Wed, 23 Jan 2013 07:17:43 -0500,
"Christopher J. PeBenito" <[email protected]> a ?crit :
Quoted 15 lines · Laurent Bigonville
Quoted 14 lines
From: Laurent Bigonville <[email protected]>
--- policy/modules/system/mount.te | 2 ++ 1 file changed, 2 insertions(+)(quoted diff) +0
-0b/policy/modules/system/mount.te index 7a58d79..d412797 100644
policy/modules/system/mount.te +0
-0@@ -135,6 +135,8 @@ logging_send_syslog_msg(mount_t) miscfiles_read_localization(mount_t)
Quoted 8 lines
policy/modules/system/mount.te logging_send_syslog_msg(mount_t) · line 142
Quoted 5 lines
policy/modules/system/mount.te +2
-0+modutils_read_module_deps(mount_t) + sysnet_use_portmap(mount_t) seutil_read_config(mount_t)Any idea why this is required?
Mmmh, I cannot reproduce this on my desktop, I'll retry tomorrow on my laptop.
BTW this is already in the fedora policy (in an optional_policy block) with the following commit message:
"Allow mount to read modutils_dep_t, probably a leak but not worth blocking"
Cheers
Laurent Bigonville
PATCH 10/13 Allow mount_t to read module_deps_t files
Le Wed, 23 Jan 2013 21:42:07 +0100,
Laurent Bigonville <[email protected]> a ?crit :
Quoted 22 lines
Le Wed, 23 Jan 2013 07:17:43 -0500,
"Christopher J. PeBenito" <[email protected]> a ?crit :Quoted 19 lines · Laurent Bigonville
Quoted 18 lines
From: Laurent Bigonville <[email protected]>
--- policy/modules/system/mount.te | 2 ++ 1 file changed, 2 insertions(+)(quoted diff) +0
-0b/policy/modules/system/mount.te index 7a58d79..d412797 100644
policy/modules/system/mount.te +2
-0@@ -135,6 +135,8 @@ logging_send_syslog_msg(mount_t) miscfiles_read_localization(mount_t) +modutils_read_module_deps(mount_t) + sysnet_use_portmap(mount_t)
Quoted 7 lines
Quoted 4 lines
policy/modules/system/mount.te logging_send_syslog_msg(mount_t) · line 142
Quoted 1 line
policy/modules/system/mount.te +0
-0seutil_read_config(mount_t)Any idea why this is required?
Mmmh, I cannot reproduce this on my desktop, I'll retry tomorrow on my laptop.
OK so I tried again, and I see these during early boot:
[ 32.330243] type=1400 audit(1359049424.759:27): avc: denied
{ read } for pid=2090 comm="mount" name="modules.dep" dev="dm-1" ino=4232 scontext=system_u:system_r:mount_t:s0
tcontext=system_u:object_r:modules_dep_t:s0 tclass=file [ 32.330265]
type=1400 audit(1359049424.759:27): avc: denied { open } for pid=2090 comm="mount" path="/lib/modules/3.7-trunk-amd64/modules.dep" dev="dm-1" ino=4232 scontext=system_u:system_r:mount_t:s0
tcontext=system_u:object_r:modules_dep_t:s0 tclass=file [ 32.330306]
type=1400 audit(1359049424.759:28): avc: denied { getattr } for pid=2090 comm="mount" path="/lib/modules/3.7-trunk-amd64/modules.dep" dev="dm-1" ino=4232 scontext=system_u:system_r:mount_t:s0 tcontext=system_u:object_r:modules_dep_t:s0 tclass=file
Cheers
Laurent Bigonville
PATCH 10/13 Allow mount_t to read module_deps_t files
This looks like an inherited file handle. What process is executing mount? Maybe auditallow rules on executing mount and opening the dep file will reveal what is going wrong.
Quoted 57 lines · Laurent Bigonville
Le Wed, 23 Jan 2013 21:42:07 +0100,
Laurent Bigonville <[email protected]> a ?crit :Quoted 22 lines
Le Wed, 23 Jan 2013 07:17:43 -0500,
"Christopher J. PeBenito" <[email protected]> a ?crit :Quoted 19 lines · Laurent Bigonville
Quoted 18 lines
From: Laurent Bigonville <[email protected]>
--- policy/modules/system/mount.te | 2 ++ 1 file changed, 2 insertions(+)(quoted diff) +0
-0b/policy/modules/system/mount.te index 7a58d79..d412797 100644
policy/modules/system/mount.te +2
-0@@ -135,6 +135,8 @@ logging_send_syslog_msg(mount_t) miscfiles_read_localization(mount_t) +modutils_read_module_deps(mount_t) + sysnet_use_portmap(mount_t)Quoted 6 lines
Quoted 4 lines
policy/modules/system/mount.te logging_send_syslog_msg(mount_t) · line 142
Quoted 1 line
policy/modules/system/mount.te +0
-0seutil_read_config(mount_t)Any idea why this is required?
Mmmh, I cannot reproduce this on my desktop, I'll retry tomorrow on
my
Quoted 1 line
laptop.
OK so I tried again, and I see these during early boot:
[ 32.330243] type=1400 audit(1359049424.759:27): avc: denied{ read } for pid=2090 comm="mount" name="modules.dep" dev="dm-1" ino=4232 scontext=system_u:system_r:mount_t:s0
tcontext=system_u:object_r:modules_dep_t:s0 tclass=file [ 32.330265]
type=1400 audit(1359049424.759:27): avc: denied { open } for pid=2090 comm="mount" path="/lib/modules/3.7-trunk-amd64/modules.dep" dev="dm-1" ino=4232 scontext=system_u:system_r:mount_t:s0
tcontext=system_u:object_r:modules_dep_t:s0 tclass=file [ 32.330306]
type=1400 audit(1359049424.759:28): avc: denied { getattr } for pid=2090 comm="mount" path="/lib/modules/3.7-trunk-amd64/modules.dep" dev="dm-1" ino=4232 scontext=system_u:system_r:mount_t:s0 tcontext=system_u:object_r:modules_dep_t:s0 tclass=fileCheers
Laurent Bigonville
_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy
Signature · 6 lines
My blog http://etbe.coker.com.au Sent from a Galaxy S3 Android phone with K-9 Mail. -------------- next part -------------- An HTML attachment was scrubbed... URL: http://oss.tresys.com/pipermail/refpolicy/attachments/20130130/959f2d83/attachment.html
PATCH 11/13 Add initrc_t to use block_suspend capability
In reply to Laurent BigonvilleFrom: Laurent Bigonville <[email protected]>
This is needed by nm-dispatcher.action witch is labeled as NetworkManager_initc_exec_t and is transitioned to initrc_t
--- policy/modules/system/init.te | 1 + 1 file changed, 1 insertion(+)
policy/modules/system/init.te +1 -0
@@ -226,6 +226,7 @@ optional_policy(` allow initrc_t self:process { getpgid setsched setpgid setrlimit getsched }; allow initrc_t self:capability ~{ sys_admin sys_module }; +allow initrc_t self:capability2 block_suspend; dontaudit initrc_t self:capability sys_module; # sysctl is triggering this allow initrc_t self:passwd rootok; allow initrc_t self:key manage_key_perms;
Signature · 1 line
1.7.10.4
PATCH 12/13 Label executables under /usr/lib/gnome-settings-daemon/ as bin_t
In reply to Laurent BigonvilleFrom: Laurent Bigonville <[email protected]>
On Debian, part of gnome-settings-daemon is installed in that directory
--- policy/modules/kernel/corecommands.fc | 1 + 1 file changed, 1 insertion(+)
policy/modules/kernel/corecommands.fc +1 -0
@@ -208,6 +208,7 @@ ifdef(`distro_gentoo',` /usr/lib/dpkg/.+ -- gen_context(system_u:object_r:bin_t,s0) /usr/lib/emacsen-common/.* gen_context(system_u:object_r:bin_t,s0) /usr/lib/gimp/.*/plug-ins(/.*)? gen_context(system_u:object_r:bin_t,s0) +/usr/lib/gnome-settings-daemon/.* gen_context(system_u:object_r:bin_t,s0) /usr/lib/gvfs/.* -- gen_context(system_u:object_r:bin_t,s0) /usr/lib/ipsec/.* -- gen_context(system_u:object_r:bin_t,s0) /usr/lib/kde4/libexec/.* -- gen_context(system_u:object_r:bin_t,s0)
Signature · 1 line
1.7.10.4
PATCH 12/13 Label executables under /usr/lib/gnome-settings-daemon/ as bin_t
Are all files in that location binaries to be executed?
Quoted 31 lines · Laurent Bigonville
From: Laurent Bigonville <[email protected]>
On Debian, part of gnome-settings-daemon is installed in that directory
--- policy/modules/kernel/corecommands.fc | 1 + 1 file changed, 1 insertion(+)policy/modules/kernel/corecommands.fc +1
-0@@ -208,6 +208,7 @@ ifdef(`distro_gentoo',` /usr/lib/dpkg/.+ -- gen_context(system_u:object_r:bin_t,s0) /usr/lib/emacsen-common/.* gen_context(system_u:object_r:bin_t,s0) /usr/lib/gimp/.*/plug-ins(/.*)? gen_context(system_u:object_r:bin_t,s0) +/usr/lib/gnome-settings-daemon/.*
gen_context(system_u:object_r:bin_t,s0)
/usr/lib/gvfs/.*--
gen_context(system_u:object_r:bin_t,s0)
/usr/lib/ipsec/.*--
gen_context(system_u:object_r:bin_t,s0)
/usr/lib/kde4/libexec/.*--
gen_context(system_u:object_r:bin_t,s0)
--
1.7.10.4
Quoted 5 lines
_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://oss.tresys.com/pipermail/refpolicy/attachments/20130113/cd5710dc/attachment.html
PATCH 12/13 Label executables under /usr/lib/gnome-settings-daemon/ as bin_t
Quoted 1 line · Sven Vermeulen
Are all files in that location binaries to be executed?
Also it needs a --
Quoted 87 lines · Laurent Bigonville
Quoted 32 lines
From: Laurent Bigonville <[email protected]>
On Debian, part of gnome-settings-daemon is installed in that directory
--- policy/modules/kernel/corecommands.fc | 1 + 1 file changed, 1 insertion(+)policy/modules/kernel/corecommands.fc +1
-0@@ -208,6 +208,7 @@ ifdef(`distro_gentoo',` /usr/lib/dpkg/.+ -- gen_context(system_u:object_r:bin_t,s0) /usr/lib/emacsen-common/.* gen_context(system_u:object_r:bin_t,s0) /usr/lib/gimp/.*/plug-ins(/.*)? gen_context(system_u:object_r:bin_t,s0) +/usr/lib/gnome-settings-daemon/.*
gen_context(system_u:object_r:bin_t,s0)
/usr/lib/gvfs/.*--
gen_context(system_u:object_r:bin_t,s0)
/usr/lib/ipsec/.*--
gen_context(system_u:object_r:bin_t,s0)
/usr/lib/kde4/libexec/.*--
gen_context(system_u:object_r:bin_t,s0)
--
1.7.10.4Quoted 5 lines
_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicyAre all files in that location binaries to be executed?
On Sat, Jan 12, 2013 at 10:32 PM, Laurent Bigonville <[email protected]> wrote:
From: Laurent Bigonville <[email protected]> On Debian, part of gnome-settings-daemon is installed in that directory --- policy/modules/kernel/corecommands.fc | 1 + 1 file changed, 1 insertion(+) diff --git a/policy/modules/kernel/corecommands.fc b/policy/modules/kernel/corecommands.fc index 097b2f0..7a5f35a 100644 --- a/policy/modules/kernel/corecommands.fc +++ b/policy/modules/kernel/corecommands.fc @@ -208,6 +208,7 @@ ifdef(`distro_gentoo',` /usr/lib/dpkg/.+ -- gen_context(system_u:object_r:bin_t,s0) /usr/lib/emacsen-common/.* gen_context(system_u:object_r:bin_t,s0) /usr/lib/gimp/.*/plug-ins(/.*)? gen_context(system_u:object_r:bin_t,s0) +/usr/lib/gnome-settings-daemon/.* gen_context(system_u:object_r:bin_t,s0) /usr/lib/gvfs/.* -- gen_context(system_u:object_r:bin_t,s0) /usr/lib/ipsec/.* -- gen_context(system_u:object_r:bin_t,s0) /usr/lib/kde4/libexec/.* -- gen_context(system_u:object_r:bin_t,s0) -- 1.7.10.4 _______________________________________________ refpolicy mailing list refpolicy at oss.tresys.com http://oss.tresys.com/mailman/listinfo/refpolicy_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy
PATCH 12/13 Label executables under /usr/lib/gnome-settings-daemon/ as bin_t
In reply to Sven VermeulenLe Sun, 13 Jan 2013 19:28:18 +0100,
Sven Vermeulen <[email protected]> a ?crit :
Quoted 1 line
Are all files in that location binaries to be executed?
Yes
apt-file search /usr/lib/gnome-settings-daemon/ command shows me that there are 23 files installed in that directory all by g-s-d and all being executables.
Cheers
Laurent Bigonville
PATCH v2 12/13 Label executables under /usr/lib/gnome-settings-daemon/ as bin_t
In reply to Laurent BigonvilleFrom: Laurent Bigonville <[email protected]>
On Debian, part of gnome-settings-daemon is installed in that directory
--- policy/modules/kernel/corecommands.fc | 1 + 1 file changed, 1 insertion(+)
policy/modules/kernel/corecommands.fc +1 -0
@@ -208,6 +208,7 @@ ifdef(`distro_gentoo',` /usr/lib/dpkg/.+ -- gen_context(system_u:object_r:bin_t,s0) /usr/lib/emacsen-common/.* gen_context(system_u:object_r:bin_t,s0) /usr/lib/gimp/.*/plug-ins(/.*)? gen_context(system_u:object_r:bin_t,s0) +/usr/lib/gnome-settings-daemon/.* -- gen_context(system_u:object_r:bin_t,s0) /usr/lib/gvfs/.* -- gen_context(system_u:object_r:bin_t,s0) /usr/lib/ipsec/.* -- gen_context(system_u:object_r:bin_t,s0) /usr/lib/kde4/libexec/.* -- gen_context(system_u:object_r:bin_t,s0)
Signature · 1 line
1.7.10.4
PATCH 13/13 Label nut drivers that are installed in /lib/nut on Debian as bin_t
In reply to Laurent BigonvilleFrom: Laurent Bigonville <[email protected]>
--- policy/modules/kernel/corecommands.fc | 1 + 1 file changed, 1 insertion(+)
policy/modules/kernel/corecommands.fc +1 -0
@@ -132,6 +132,7 @@ ifdef(`distro_debian',` # /lib # +/lib/nut/.* -- gen_context(system_u:object_r:bin_t,s0) /lib/readahead(/.*)? gen_context(system_u:object_r:bin_t,s0) /lib/security/pam_krb5/pam_krb5_storetmp -- gen_context(system_u:object_r:bin_t,s0) /lib/systemd/systemd.* -- gen_context(system_u:object_r:bin_t,s0)
Signature · 1 line
1.7.10.4