Extend the IRC domain to include IRSSI.

The tabs in irc.fc are weird because of Eclipse.
We can remove the irc_home_t stuff from irc.if once userdom_user_home_content is fixed to handle it.

Signed-off-by Dominick Grift <[email protected]>

---
:100644 100644 65ece18... 200a6cd... M policy/modules/apps/irc.fc
:100644 100644 4f9dc90... a638de0... M policy/modules/apps/irc.if
:100644 100644 66beb80... b1526ce... M policy/modules/apps/irc.te

 policy/modules/apps/irc.fc |   18 ++++++-------
 policy/modules/apps/irc.if |   29 ++++++++++++++++++---
 policy/modules/apps/irc.te |   59 +++++++++++++++++++++++++++++++++++--------
 3 files changed, 80 insertions(+), 26 deletions(-)

policy/modules/apps/irc.fc +8 -10

index 65ece18..200a6cd 100644
@@ -1,11 +1,9 @@
-#
-# /home
-#
-HOME_DIR/\.ircmotd	--	gen_context(system_u:object_r:irc_home_t,s0)
+HOME_DIR/\.ircmotd			--	gen_context(system_u:object_r:irc_home_t,s0)
+HOME_DIR/\.irssi(/.*)?			gen_context(system_u:object_r:irc_home_t,s0)
 
-#
-# /usr
-#
-/usr/bin/[st]irc	--	gen_context(system_u:object_r:irc_exec_t,s0)
-/usr/bin/ircII		--	gen_context(system_u:object_r:irc_exec_t,s0)
-/usr/bin/tinyirc	--	gen_context(system_u:object_r:irc_exec_t,s0)
+/etc/irssi.conf				--	gen_context(system_u:object_r:irc_etc_t,s0)
+
+/usr/bin/[st]irc			--	gen_context(system_u:object_r:irc_exec_t,s0)
+/usr/bin/ircII				--	gen_context(system_u:object_r:irc_exec_t,s0)
+/usr/bin/irssi				--	gen_context(system_u:object_r:irc_exec_t,s0)
+/usr/bin/tinyirc			--	gen_context(system_u:object_r:irc_exec_t,s0)

policy/modules/apps/irc.if +24 -5

index 4f9dc90..a638de0 100644
@@ -1,4 +1,4 @@
-## <summary>IRC client policy</summary>
+## <summary>IRC clients.</summary>
 
 ########################################
 ## <summary>

@@ -17,15 +17,34 @@
 #
 interface(`irc_role',`
 	gen_require(`
-		type irc_t, irc_exec_t;
+		type irc_t, irc_exec_t, irc_tmp_t;
+		type irc_home_t;
 	')
 
 	role $1 types irc_t;
 
-	# Transition from the user domain to the derived domain.
 	domtrans_pattern($2, irc_exec_t, irc_t)
 
-	# allow ps to show irc
 	ps_process_pattern($2, irc_t)
-	allow $2 irc_t:process signal;
+	allow $2 irc_t:process { ptrace signal_perms };
+
+	manage_dirs_pattern($2, irc_home_t, irc_home_t)
+	manage_files_pattern($2, irc_home_t, irc_home_t)
+	manage_lnk_files_pattern($2, irc_home_t, irc_home_t)
+
+	relabel_dirs_pattern($2, irc_home_t, irc_home_t)
+	relabel_files_pattern($2, irc_home_t, irc_home_t)
+	relabel_lnk_files_pattern($2, irc_home_t, irc_home_t)
+
+	manage_dirs_pattern($2, irc_tmp_t, irc_tmp_t)
+	manage_files_pattern($2, irc_tmp_t, irc_tmp_t)
+	manage_lnk_files_pattern($2, irc_tmp_t, irc_tmp_t)
+	manage_fifo_files_pattern($2, irc_tmp_t, irc_tmp_t)
+	manage_sock_files_pattern($2, irc_tmp_t, irc_tmp_t)
+
+	relabel_dirs_pattern($2, irc_tmp_t, irc_tmp_t)
+	relabel_files_pattern($2, irc_tmp_t, irc_tmp_t)
+	relabel_lnk_files_pattern($2, irc_tmp_t, irc_tmp_t)
+	relabel_fifo_files_pattern($2, irc_tmp_t, irc_tmp_t)
+	relabel_sock_files_pattern($2, irc_tmp_t, irc_tmp_t)
 ')

policy/modules/apps/irc.te +0 -0

index 66beb80..b1526ce 100644

policy/modules/apps/irc.te +29 -11

 type irc_home_t;
 typealias irc_home_t alias { user_irc_home_t staff_irc_home_t sysadm_irc_home_t };
 typealias irc_home_t alias { auditadm_irc_home_t secadm_irc_home_t };

@@ -20,23 +31,28 @@ userdom_user_home_content(irc_home_t)
 type irc_tmp_t;
 typealias irc_tmp_t alias { user_irc_tmp_t staff_irc_tmp_t sysadm_irc_tmp_t };
 typealias irc_tmp_t alias { auditadm_irc_tmp_t secadm_irc_tmp_t };
-userdom_user_home_content(irc_tmp_t)
+files_tmp_file(irc_tmp_t)
+ubac_constrained(irc_tmp_t)
 
 ########################################
 #
 # Local policy
 #
 
+allow irc_t self:process { signal sigkill };
+allow irc_t self:fifo_file rw_fifo_file_perms;
+allow irc_t self:netlink_route_socket create_netlink_socket_perms;
 allow irc_t self:unix_stream_socket create_stream_socket_perms;
-allow irc_t self:tcp_socket create_socket_perms;
+allow irc_t self:tcp_socket create_stream_socket_perms;
 allow irc_t self:udp_socket create_socket_perms;
 
+allow irc_t irc_etc_t:file read_file_perms;
+
 manage_dirs_pattern(irc_t, irc_home_t, irc_home_t)
 manage_files_pattern(irc_t, irc_home_t, irc_home_t)
 manage_lnk_files_pattern(irc_t, irc_home_t, irc_home_t)
 userdom_user_home_dir_filetrans(irc_t, irc_home_t, { dir file lnk_file })
 
-# access files under /tmp
 manage_dirs_pattern(irc_t, irc_tmp_t, irc_tmp_t)
 manage_files_pattern(irc_t, irc_tmp_t, irc_tmp_t)
 manage_lnk_files_pattern(irc_t, irc_tmp_t, irc_tmp_t)

@@ -44,7 +60,9 @@ manage_fifo_files_pattern(irc_t, irc_tmp_t, irc_tmp_t)
 manage_sock_files_pattern(irc_t, irc_tmp_t, irc_tmp_t)
 files_tmp_filetrans(irc_t, irc_tmp_t, { file dir lnk_file sock_file fifo_file })
 
-kernel_read_proc_symlinks(irc_t)
+kernel_read_system_state(irc_t)
+
+corecmd_read_bin_symlinks(irc_t)
 
 corenet_all_recvfrom_unlabeled(irc_t)
 corenet_all_recvfrom_netlabel(irc_t)

@@ -52,12 +70,19 @@ corenet_tcp_sendrecv_generic_if(irc_t)
 corenet_udp_sendrecv_generic_if(irc_t)
 corenet_tcp_sendrecv_generic_node(irc_t)
 corenet_udp_sendrecv_generic_node(irc_t)
+corenet_tcp_bind_generic_node(irc_t)
+corenet_udp_bind_generic_node(irc_t)
 corenet_tcp_sendrecv_all_ports(irc_t)
 corenet_udp_sendrecv_all_ports(irc_t)
+corenet_tcp_connect_ircd_port(irc_t)
 corenet_sendrecv_ircd_client_packets(irc_t)
-# cjp: this seems excessive:
-corenet_tcp_connect_all_ports(irc_t)
-corenet_sendrecv_all_client_packets(irc_t)
+corenet_tcp_connect_http_cache_port(irc_t)
+corenet_sendrecv_http_cache_client_packets(irc_t)
+corenet_tcp_connect_gatekeeper_port(irc_t)
+corenet_sendrecv_gatekeeper_client_packets(irc_t)
+
+dev_read_urand(irc_t)
+dev_read_rand(irc_t)
 
 domain_use_interactive_fds(irc_t)
 

@@ -70,22 +95,26 @@ fs_getattr_xattr_fs(irc_t)
 fs_search_auto_mountpoints(irc_t)
 
 term_use_controlling_term(irc_t)
-term_list_ptys(irc_t)
 
-# allow utmp access
 init_read_utmp(irc_t)
 init_dontaudit_lock_utmp(irc_t)
 
+miscfiles_read_certs(irc_t)
 miscfiles_read_localization(irc_t)
 
-# Inherit and use descriptors from newrole.
 seutil_use_newrole_fds(irc_t)
 
 sysnet_read_config(irc_t)
 
-# Write to the user domain tty.
 userdom_use_user_terminals(irc_t)
 
+tunable_policy(`irc_can_network',`
+	corenet_tcp_bind_all_unreserved_ports(irc_t)
+	corenet_sendrecv_all_server_packets(irc_t)
+	corenet_tcp_connect_all_ports(irc_t)
+	corenet_sendrecv_all_client_packets(irc_t)
+')
+
 tunable_policy(`use_nfs_home_dirs',`
 	fs_manage_nfs_dirs(irc_t)
 	fs_manage_nfs_files(irc_t)

@@ -99,5 +128,13 @@ tunable_policy(`use_samba_home_dirs',`
 ')
 
 optional_policy(`

policy/modules/apps/irc.te policy_module(irc, 2.1.0) · line 14

Quoted 7 lines

policy/modules/apps/irc.te +7 -0

+## <desc>
+##	<p>
+##	Allow IRC Clients to connect to any TCP port,
+##	and to bind TCP sockets to any unreserved port.
+##	</p>
+## </desc>
+gen_tunable(irc_can_network, false)

A more specific name would be better. Maybe irc_full_networking or something.

policy/modules/apps/irc.te typealias irc_t alias { auditadm_irc_t secadm_irc_t }; · line 24

Quoted 2 lines

policy/modules/apps/irc.te +2 -0

+type irc_etc_t;
+files_config_file(irc_etc_t)

Why is this necessary? From what I can tell, irc_t only reads it. Irc_t already can read etc_t files, so this seems unnecessary.

Quoted 6 lines

optional_policy(`

policy/modules/apps/irc.te +4 -0

+	automount_dontaudit_getattr_tmp_dirs(irc_t)
+')
+
+optional_policy(`
 	nis_use_ypbind(irc_t)

policy/modules/apps/irc.te tunable_policy(`use_samba_home_dirs',` · line 140

Quoted 5 lines

')

policy/modules/apps/irc.te +4 -0

+
+optional_policy(`
+	nscd_socket_use(irc_t)
+')

These two and the netlink_route socket earlier makes it look like its going towards auth_use_nsswitch().

policy/modules/apps/irc.te policy_module(irc, 2.1.0) · line 14

Quoted 7 lines

policy/modules/apps/irc.te +7 -0

+## <desc>
+##	<p>
+##	Allow IRC Clients to connect to any TCP port,
+##	and to bind TCP sockets to any unreserved port.
+##	</p>
+## </desc>
+gen_tunable(irc_can_network, false)

A more specific name would be better. Maybe irc_full_networking or something.

policy/modules/apps/irc.te typealias irc_t alias { auditadm_irc_t secadm_irc_t }; · line 24

Quoted 3 lines

policy/modules/apps/irc.te +2 -0

+type irc_etc_t;
+files_config_file(irc_etc_t)

Why is this necessary? From what I can tell, irc_t only reads it. Irc_t already can read etc_t files, so this seems unnecessary.

Quoted 6 lines

optional_policy(`

policy/modules/apps/irc.te +4 -0

+	automount_dontaudit_getattr_tmp_dirs(irc_t)
+')
+
+optional_policy(`
 	nis_use_ypbind(irc_t)

policy/modules/apps/irc.te tunable_policy(`use_samba_home_dirs',` · line 140

Quoted 5 lines

')

policy/modules/apps/irc.te +4 -0

+
+optional_policy(`
+	nscd_socket_use(irc_t)
+')

These two and the netlink_route socket earlier makes it look like its going towards auth_use_nsswitch().

On 06/22/2010 09:49 PM, Christopher J. PeBenito wrote:

Some more arguments:

Quoted 11 lines

policy/modules/apps/irc.te policy_module(irc, 2.1.0) · line 14

Quoted 7 lines

policy/modules/apps/irc.te +7 -0

+## <desc>
+##	<p>
+##	Allow IRC Clients to connect to any TCP port,
+##	and to bind TCP sockets to any unreserved port.
+##	</p>
+## </desc>
+gen_tunable(irc_can_network, false)

A more specific name would be better. Maybe irc_full_networking or something.

irc_full_network sounds consistent. qemu uses a similar boolean "qemu_full_network"

Quoted 7 lines

policy/modules/apps/irc.te typealias irc_t alias { auditadm_irc_t secadm_irc_t }; · line 24

Quoted 3 lines

policy/modules/apps/irc.te +2 -0

+type irc_etc_t;
+files_config_file(irc_etc_t)

Why is this necessary? From what I can tell, irc_t only reads it. Irc_t already can read etc_t files, so this seems unnecessary.

Few arguments here:

1. possible sensitive data.

2. irc_admin()

3. mozilla also has a mozilla_etc_t and also has access to files_read_etc_files() afaik.

Quoted 6 lines

Quoted 6 lines

optional_policy(`

policy/modules/apps/irc.te +4 -0

+	automount_dontaudit_getattr_tmp_dirs(irc_t)
+')
+
+optional_policy(`
 	nis_use_ypbind(irc_t)

Quoted 9 lines

policy/modules/apps/irc.te tunable_policy(`use_samba_home_dirs',` · line 140

Quoted 5 lines

')

policy/modules/apps/irc.te +4 -0

+
+optional_policy(`
+	nscd_socket_use(irc_t)
+')

These two and the netlink_route socket earlier makes it look like its going towards auth_use_nsswitch().

Mozilla also has "automount_dontaudit_getattr_tmp_dirs", "nscd_socket_use" and "... self:netlink_route_socket r_netlink_socket_perms;", but does NOT have auth_use_nsswitch().

So either mozillas policy is wrong here too or it is unrelated.

Fact remains that irssi searches nscd pid directories, likely looking for the nscd.socket to connectto.

automount_dontaudit_getattr_tmp_dirs(irc_t) is in my view not specific to irc clients, but since the irc domain can own temporary objects, my opinion is that we should support it.

All in all, personally i would only change the boolean name and leave the rest unchanged.

Quoted 8 lines

Quoted 7 lines

policy/modules/apps/irc.te typealias irc_t alias { auditadm_irc_t secadm_irc_t }; · line 24

Quoted 3 lines

policy/modules/apps/irc.te +2 -0

+type irc_etc_t;
+files_config_file(irc_etc_t)

Why is this necessary? From what I can tell, irc_t only reads it. Irc_t already can read etc_t files, so this seems unnecessary.

Quoted 3 lines

Few arguments here:

1. possible sensitive data.

Such as?

Quoted 1 line

2. irc_admin()

I'm not really compelled by this. I don't think regular apps have admins.

Quoted 3 lines

3. mozilla also has a mozilla_etc_t and also has access to files_read_etc_files() afaik.

If anything, this just tells me that mozilla is wrong too.

Quoted 16 lines

Quoted 15 lines

policy/modules/apps/irc.te tunable_policy(`use_samba_home_dirs',` · line 140

Quoted 11 lines

optional_policy(`

policy/modules/apps/irc.te +8 -0

+	automount_dontaudit_getattr_tmp_dirs(irc_t)
+')
+
+optional_policy(`
 	nis_use_ypbind(irc_t)
 ')
+
+optional_policy(`
+	nscd_socket_use(irc_t)
+')

These two and the netlink_route socket earlier makes it look like its going towards auth_use_nsswitch().

Quoted 3 lines

Mozilla also has "automount_dontaudit_getattr_tmp_dirs", "nscd_socket_use" and "... self:netlink_route_socket r_netlink_socket_perms;", but does NOT have auth_use_nsswitch().

I mean the nis_use_ypbind(), nscd_socket_use(), and netlink_route_socket perms. Mozilla does not have nis_use_ypbind(), so it doesn't seem to need auth_use_nsswitch() yet. Thats not the case here.

Quoted 12 lines

So either mozillas policy is wrong here too or it is unrelated.

Fact remains that irssi searches nscd pid directories, likely looking for the nscd.socket to connectto.

automount_dontaudit_getattr_tmp_dirs(irc_t) is in my view not specific to irc clients, but since the irc domain can own temporary objects, my opinion is that we should support it.

All in all, personally i would only change the boolean name and leave the rest unchanged.

Quoted 8 lines · Christopher J. PeBenito

Quoted 8 lines

Quoted 7 lines

policy/modules/apps/irc.te typealias irc_t alias { auditadm_irc_t secadm_irc_t }; · line 24

Quoted 3 lines

policy/modules/apps/irc.te +2 -0

+type irc_etc_t;
+files_config_file(irc_etc_t)

Why is this necessary? From what I can tell, irc_t only reads it. Irc_t already can read etc_t files, so this seems unnecessary.

Quoted 6 lines

Quoted 3 lines

Few arguments here:

1. possible sensitive data.

Such as?

For example: "proxy_password = "";"

Quoted 4 lines

Quoted 1 line

2. irc_admin()

I'm not really compelled by this. I don't think regular apps have admins.

Well this is a system-wide config in /etc/irssi.conf only an (irc) admin can set system-wide overrides.

Quoted 5 lines

Quoted 3 lines

3. mozilla also has a mozilla_etc_t and also has access to files_read_etc_files() afaik.

If anything, this just tells me that mozilla is wrong too.

That may indeed be wrong but i still believe irc_etc_t is the right thing to do for irc_t.

Quoted 23 lines

Quoted 16 lines

Quoted 6 lines

Quoted 6 lines

optional_policy(`

policy/modules/apps/irc.te +4 -0

+	automount_dontaudit_getattr_tmp_dirs(irc_t)
+')
+
+optional_policy(`
 	nis_use_ypbind(irc_t)

Quoted 9 lines

policy/modules/apps/irc.te tunable_policy(`use_samba_home_dirs',` · line 140

Quoted 5 lines

')

policy/modules/apps/irc.te +4 -0

+
+optional_policy(`
+	nscd_socket_use(irc_t)
+')

These two and the netlink_route socket earlier makes it look like its going towards auth_use_nsswitch().

Quoted 3 lines

Mozilla also has "automount_dontaudit_getattr_tmp_dirs", "nscd_socket_use" and "... self:netlink_route_socket r_netlink_socket_perms;", but does NOT have auth_use_nsswitch().

I mean the nis_use_ypbind(), nscd_socket_use(), and netlink_route_socket perms. Mozilla does not have nis_use_ypbind(), so it doesn't seem to need auth_use_nsswitch() yet. Thats not the case here.

I am not sure here. Like i said before; i do not have a nis nor ldap or nscd configuration. The netlink socket perms are confirmed to be required for irssi, and i can also confirm that irssi atleast searches nscd pid directories. I can only assume it does that to find the nscd.socket.

If you are not comfortable with adding auth_use_nsswitch(irc_t), then please add nscd_dontaudit_search_pid() and remove the nscd_socket_use and nis_use_ypbind.

For what it is worth: In my personal branch i decided to just add auth_use_nsswitch(irc_t).

Quoted 14 lines · Dominick Grift

Quoted 12 lines · Christopher J. PeBenito

Quoted 11 lines

Quoted 7 lines

policy/modules/apps/irc.te typealias irc_t alias { auditadm_irc_t secadm_irc_t }; · line 24

Quoted 3 lines

policy/modules/apps/irc.te +2 -0

+type irc_etc_t;
+files_config_file(irc_etc_t)

Why is this necessary? From what I can tell, irc_t only reads it. Irc_t already can read etc_t files, so this seems unnecessary.

Few arguments here:

1. possible sensitive data.

Quoted 4 lines

Quoted 2 lines

Such as?

For example: "proxy_password = "";"

Perhaps. Though I suspect its actually not that sensitive, and its probably easy to get through the app itself.

Quoted 7 lines

Quoted 4 lines

Quoted 1 line

2. irc_admin()

I'm not really compelled by this. I don't think regular apps have admins.

Well this is a system-wide config in /etc/irssi.conf only an (irc) admin can set system-wide overrides.

Quoted 32 lines

Quoted 5 lines

Quoted 3 lines

3. mozilla also has a mozilla_etc_t and also has access to files_read_etc_files() afaik.

If anything, this just tells me that mozilla is wrong too.

That may indeed be wrong but i still believe irc_etc_t is the right thing to do for irc_t.

Quoted 23 lines

Quoted 16 lines

Quoted 6 lines

Quoted 6 lines

optional_policy(`

policy/modules/apps/irc.te +4 -0

+	automount_dontaudit_getattr_tmp_dirs(irc_t)
+')
+
+optional_policy(`
 	nis_use_ypbind(irc_t)

Quoted 9 lines

policy/modules/apps/irc.te tunable_policy(`use_samba_home_dirs',` · line 140

Quoted 5 lines

')

policy/modules/apps/irc.te +4 -0

+
+optional_policy(`
+	nscd_socket_use(irc_t)
+')

These two and the netlink_route socket earlier makes it look like its going towards auth_use_nsswitch().

Quoted 3 lines

Mozilla also has "automount_dontaudit_getattr_tmp_dirs", "nscd_socket_use" and "... self:netlink_route_socket r_netlink_socket_perms;", but does NOT have auth_use_nsswitch().

I mean the nis_use_ypbind(), nscd_socket_use(), and netlink_route_socket perms. Mozilla does not have nis_use_ypbind(), so it doesn't seem to need auth_use_nsswitch() yet. Thats not the case here.

[...]

Quoted 6 lines

I am not sure here. Like i said before; i do not have a nis nor ldap or nscd configuration. The netlink socket perms are confirmed to be required for irssi, and i can also confirm that irssi atleast searches nscd pid directories. I can only assume it does that to find the nscd.socket.

Quoted 6 lines

If you are not comfortable with adding auth_use_nsswitch(irc_t), then please add nscd_dontaudit_search_pid() and remove the nscd_socket_use and nis_use_ypbind.

For what it is worth: In my personal branch i decided to just add auth_use_nsswitch(irc_t).

I think you misunderstand. I think auth_use_nsswitch(irc_t) _should_ be in there.

Quoted 25 lines · Christopher J. PeBenito

Quoted 10 lines · Dominick Grift

Quoted 8 lines · Christopher J. PeBenito

Quoted 8 lines

Quoted 7 lines

Review

Quoted 3 lines

(quoted diff) +2 -0

+type irc_etc_t;
+files_config_file(irc_etc_t)

Why is this necessary? From what I can tell, irc_t only reads it. Irc_t already can read etc_t files, so this seems unnecessary.

Quoted 8 lines

Quoted 6 lines

Quoted 3 lines

Few arguments here:

1. possible sensitive data.

Such as?

For example: "proxy_password = "";"

Perhaps. Though I suspect its actually not that sensitive, and its probably easy to get through the app itself.

Quoted 2 lines

Quoted 2 lines

Quoted 1 line

2. irc_admin()

Quoted 5 lines

Quoted 5 lines

Quoted 2 lines

I'm not really compelled by this. I don't think regular apps have admins.

Well this is a system-wide config in /etc/irssi.conf only an (irc) admin can set system-wide overrides.

I'm still not compelled by the idea of an irc admin.

Quoted 44 lines

Quoted 33 lines

Quoted 6 lines

Quoted 4 lines

3. mozilla also has a mozilla_etc_t and also has access to files_read_etc_files() afaik.

If anything, this just tells me that mozilla is wrong too.

That may indeed be wrong but i still believe irc_etc_t is the right thing to do for irc_t.

Quoted 23 lines

Quoted 16 lines

Quoted 6 lines

Quoted 6 lines

optional_policy(`

(quoted diff) +4 -0

+	automount_dontaudit_getattr_tmp_dirs(irc_t)
+')
+
+optional_policy(`
 	nis_use_ypbind(irc_t)

Quoted 9 lines

Review

Quoted 5 lines

')

(quoted diff) +4 -0

+
+optional_policy(`
+	nscd_socket_use(irc_t)
+')

These two and the netlink_route socket earlier makes it look like its going towards auth_use_nsswitch().

Quoted 3 lines

Mozilla also has "automount_dontaudit_getattr_tmp_dirs", "nscd_socket_use" and "... self:netlink_route_socket r_netlink_socket_perms;", but does NOT have auth_use_nsswitch().

I mean the nis_use_ypbind(), nscd_socket_use(), and netlink_route_socket perms. Mozilla does not have nis_use_ypbind(), so it doesn't seem to need auth_use_nsswitch() yet. Thats not the case here.

[...]

Quoted 10 lines

I am not sure here. Like i said before; i do not have a nis nor ldap or nscd configuration. The netlink socket perms are confirmed to be required for irssi, and i can also confirm that irssi atleast searches nscd pid directories. I can only assume it does that to find the nscd.socket.

If you are not comfortable with adding auth_use_nsswitch(irc_t), then please add nscd_dontaudit_search_pid() and remove the nscd_socket_use and nis_use_ypbind.

Quoted 6 lines

Quoted 2 lines

For what it is worth: In my personal branch i decided to just add auth_use_nsswitch(irc_t).

I think you misunderstand. I think auth_use_nsswitch(irc_t) _should_ be in there.

Quoted 16 lines

Quoted 15 lines

policy/modules/apps/irc.te tunable_policy(`use_samba_home_dirs',` · line 140

Quoted 11 lines

optional_policy(`

policy/modules/apps/irc.te +8 -0

+	automount_dontaudit_getattr_tmp_dirs(irc_t)
+')
+
+optional_policy(`
 	nis_use_ypbind(irc_t)
 ')
+
+optional_policy(`
+	nscd_socket_use(irc_t)
+')

These two and the netlink_route socket earlier makes it look like its going towards auth_use_nsswitch().

Quoted 3 lines

Mozilla also has "automount_dontaudit_getattr_tmp_dirs", "nscd_socket_use" and "... self:netlink_route_socket r_netlink_socket_perms;", but does NOT have auth_use_nsswitch().

I mean the nis_use_ypbind(), nscd_socket_use(), and netlink_route_socket perms. Mozilla does not have nis_use_ypbind(), so it doesn't seem to need auth_use_nsswitch() yet. Thats not the case here.

Quoted 12 lines

So either mozillas policy is wrong here too or it is unrelated.

Fact remains that irssi searches nscd pid directories, likely looking for the nscd.socket to connectto.

automount_dontaudit_getattr_tmp_dirs(irc_t) is in my view not specific to irc clients, but since the irc domain can own temporary objects, my opinion is that we should support it.

All in all, personally i would only change the boolean name and leave the rest unchanged.