Allow domains that call userdom_tmp_role() to relabel generic user_tmp_t file objects.
PATCH 1/1 Allow domains that call userdom_tmp_role() to relabel generic user_tmp_t file objects.
I encountered this requirement when using poly-instantiation:
denied { relabelfrom } for pid=14189 comm="sshd" name="system_u:object_r:tmp_t:s0_domg472" dev=dm-3 ino=2884342 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:user_tmp_t:s0 tclass=dir
Athough in refpolicy sshd_t does not call userdom_tmp_role (Makes me wonder how refpolicy deals with poly-instantiation.
Nonetheless, to me it seems to make sense that if one give access to manage a type, you may also want to give relabel perms.
Oh, and it is untested (but i commited this to my branch and i will test it when i build a new version)
---
:100644 100644 42d4e8d... 72203a0... M policy/modules/system/userdomain.if
policy/modules/system/userdomain.if | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-)
policy/modules/system/userdomain.if +6 -0
@@ -303,6 +303,12 @@ interface(`userdom_manage_tmp_role',` manage_sock_files_pattern($2, user_tmp_t, user_tmp_t) manage_fifo_files_pattern($2, user_tmp_t, user_tmp_t) files_tmp_filetrans($2, user_tmp_t, { dir file lnk_file sock_file fifo_file }) + + relabel_dirs_pattern($2, user_tmp_t, user_tmp_t) + relabel_files_pattern($2, user_tmp_t, user_tmp_t) + relabel_lnk_files_pattern($2, user_tmp_t, user_tmp_t) + relabel_sock_files_pattern($2, user_tmp_t, user_tmp_t) + relabel_fifo_files_pattern($2, user_tmp_t, user_tmp_t) ') #######################################
Signature · 9 lines
1.7.1 -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 198 bytes Desc: not available Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20100706/d8fa78f7/attachment-0001.bin
PATCH 1/1 Allow domains that call userdom_tmp_role() to relabel generic user_tmp_t file objects.
Quoted 5 lines · Dominick Grift
I encountered this requirement when using poly-instantiation:
denied { relabelfrom } for pid=14189 comm="sshd" name="system_u:object_r:tmp_t:s0_domg472" dev=dm-3 ino=2884342 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:user_tmp_t:s0 tclass=dir
Athough in refpolicy
sshd_tdoes not calluserdom_tmp_role(Makes me wonder how refpolicy deals with poly-instantiation.
Not sure what you mean here, but sshd_t should never be calling userdom_tmp_role(). That interface is only for building user roles/user domains.
Quoted 1 line
Nonetheless, to me it seems to make sense that if one give access to manage a type, you may also want to give relabel perms.
NAK Relabeling is special. There are a few exceptions, but it should almost always be separate from manage permissions.
Quoted 32 lines
Oh, and it is untested (but i commited this to my branch and i will test it when i build a new version)
Signed-off-by Dominick Grift<[email protected]>---
:100644 100644 42d4e8d... 72203a0... M policy/modules/system/userdomain.ifpolicy/modules/system/userdomain.if | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-)policy/modules/system/userdomain.if +6
-0@@ -303,6 +303,12 @@ interface(`userdom_manage_tmp_role',` manage_sock_files_pattern($2, user_tmp_t, user_tmp_t) manage_fifo_files_pattern($2, user_tmp_t, user_tmp_t) files_tmp_filetrans($2, user_tmp_t, { dir file lnk_file sock_file fifo_file }) + + relabel_dirs_pattern($2, user_tmp_t, user_tmp_t) + relabel_files_pattern($2, user_tmp_t, user_tmp_t) + relabel_lnk_files_pattern($2, user_tmp_t, user_tmp_t) + relabel_sock_files_pattern($2, user_tmp_t, user_tmp_t) + relabel_fifo_files_pattern($2, user_tmp_t, user_tmp_t) ') #######################################_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 1/1 Allow domains that call userdom_tmp_role() to relabel generic user_tmp_t file objects.
Quoted 10 lines · Christopher J. PeBenito
Quoted 5 lines · Dominick Grift
I encountered this requirement when using poly-instantiation:
denied { relabelfrom } for pid=14189 comm="sshd" name="system_u:object_r:tmp_t:s0_domg472" dev=dm-3 ino=2884342 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:user_tmp_t:s0 tclass=dir
Athough in refpolicy
sshd_tdoes not calluserdom_tmp_role(Makes me wonder how refpolicy deals with poly-instantiation.Not sure what you mean here, but
sshd_tshould never be callinguserdom_tmp_role(). That interface is only for building user roles/user domains.
pulseaudio.if: pulseaudio_role:
userdom_manage_home_role($1, pulseaudio_t) userdom_manage_tmp_role($1, pulseaudio_t) userdom_manage_tmpfs_role($1, pulseaudio_t)
wm.if: wm_role:
userdom_manage_home_role($2, $1_wm_t) userdom_manage_tmpfs_role($2, $1_wm_t) userdom_manage_tmp_role($2, $1_wm_t)
etc
Quoted 30 lines
Quoted 2 lines
Nonetheless, to me it seems to make sense that if one give access to manage a type, you may also want to give relabel perms.
NAK Relabeling is special. There are a few exceptions, but it should almost always be separate from manage permissions.
Quoted 24 lines
Oh, and it is untested (but i commited this to my branch and i will test it when i build a new version)
Signed-off-by Dominick Grift<[email protected]>---
:100644 100644 42d4e8d... 72203a0... M policy/modules/system/userdomain.ifpolicy/modules/system/userdomain.if | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-)policy/modules/system/userdomain.if +6
-0@@ -303,6 +303,12 @@ interface(`userdom_manage_tmp_role',` manage_sock_files_pattern($2, user_tmp_t, user_tmp_t) manage_fifo_files_pattern($2, user_tmp_t, user_tmp_t) files_tmp_filetrans($2, user_tmp_t, { dir file lnk_file sock_file fifo_file }) + + relabel_dirs_pattern($2, user_tmp_t, user_tmp_t) + relabel_files_pattern($2, user_tmp_t, user_tmp_t) + relabel_lnk_files_pattern($2, user_tmp_t, user_tmp_t) + relabel_sock_files_pattern($2, user_tmp_t, user_tmp_t) + relabel_fifo_files_pattern($2, user_tmp_t, user_tmp_t) ')
Quoted 14 lines
Quoted 8 lines
policy/modules/system/userdomain.if +0
-0#######################################_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicySignature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20100706/367574ad/attachment.bin
PATCH 1/1 Allow domains that call userdom_tmp_role() to relabel generic user_tmp_t file objects.
Quoted 18 lines · Dominick Grift
Quoted 10 lines · Christopher J. PeBenito
Quoted 5 lines · Dominick Grift
I encountered this requirement when using poly-instantiation:
denied { relabelfrom } for pid=14189 comm="sshd" name="system_u:object_r:tmp_t:s0_domg472" dev=dm-3 ino=2884342 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:user_tmp_t:s0 tclass=dir
Athough in refpolicy
sshd_tdoes not calluserdom_tmp_role(Makes me wonder how refpolicy deals with poly-instantiation.Not sure what you mean here, but
sshd_tshould never be callinguserdom_tmp_role(). That interface is only for building user roles/user domains.pulseaudio.if:
pulseaudio_role:
userdom_manage_home_role($1, pulseaudio_t)userdom_manage_tmp_role($1, pulseaudio_t)userdom_manage_tmpfs_role($1, pulseaudio_t)
Quoted 7 lines
wm.if:
wm_role:userdom_manage_home_role($2, $1_wm_t) userdom_manage_tmpfs_role($2, $1_wm_t) userdom_manage_tmp_role($2, $1_wm_t)etc
I'm already working on removing these.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 1/1 Allow domains that call userdom_tmp_role() to relabel generic user_tmp_t file objects.
Quoted 21 lines · Christopher J. PeBenito
Quoted 20 lines · Dominick Grift
Quoted 10 lines · Christopher J. PeBenito
Quoted 5 lines · Dominick Grift
I encountered this requirement when using poly-instantiation:
denied { relabelfrom } for pid=14189 comm="sshd" name="system_u:object_r:tmp_t:s0_domg472" dev=dm-3 ino=2884342 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:user_tmp_t:s0 tclass=dir
Athough in refpolicy
sshd_tdoes not calluserdom_tmp_role(Makes me wonder how refpolicy deals with poly-instantiation.Not sure what you mean here, but
sshd_tshould never be callinguserdom_tmp_role(). That interface is only for building user roles/user domains.pulseaudio.if:
pulseaudio_role:
userdom_manage_home_role($1, pulseaudio_t)userdom_manage_tmp_role($1, pulseaudio_t)userdom_manage_tmpfs_role($1, pulseaudio_t)wm.if:
wm_role:
Quoted 7 lines
Quoted 5 lines
userdom_manage_home_role($2, $1_wm_t) userdom_manage_tmpfs_role($2, $1_wm_t) userdom_manage_tmp_role($2, $1_wm_t)etc
I'm already working on removing these.
I am using a modified wm module that has these removed. You may want to see it. It is in my repository.
As for pulseaudio, removing it will break things and stop pa for functioning with SELinux.
Quoted 5 lines
Signature · 4 lines
-- Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20100706/9c700634/attachment.bin
PATCH 1/1 Allow domains that call userdom_tmp_role() to relabel generic user_tmp_t file objects.
Quoted 26 lines · Dominick Grift
Quoted 25 lines · Christopher J. PeBenito
Quoted 24 lines · Dominick Grift
Quoted 10 lines · Christopher J. PeBenito
Quoted 5 lines · Dominick Grift
I encountered this requirement when using poly-instantiation:
denied { relabelfrom } for pid=14189 comm="sshd" name="system_u:object_r:tmp_t:s0_domg472" dev=dm-3 ino=2884342 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:user_tmp_t:s0 tclass=dir
Athough in refpolicy
sshd_tdoes not calluserdom_tmp_role(Makes me wonder how refpolicy deals with poly-instantiation.Not sure what you mean here, but
sshd_tshould never be callinguserdom_tmp_role(). That interface is only for building user roles/user domains.pulseaudio.if:
pulseaudio_role:
userdom_manage_home_role($1, pulseaudio_t)userdom_manage_tmp_role($1, pulseaudio_t)userdom_manage_tmpfs_role($1, pulseaudio_t)wm.if:
wm_role:userdom_manage_home_role($2, $1_wm_t) userdom_manage_tmpfs_role($2, $1_wm_t) userdom_manage_tmp_role($2, $1_wm_t)
Quoted 7 lines
Quoted 3 lines
Quoted 1 line
etc
I'm already working on removing these.
I am using a modified wm module that has these removed. You may want to see it. It is in my repository.
As for pulseaudio, removing it will break things and stop pa for functioning with SELinux.
Well I'm not actually removing them, but replacing them.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 1/1 Allow domains that call userdom_tmp_role() to relabel generic user_tmp_t file objects.
In reply to Christopher J. PeBenitoQuoted 7 lines · Christopher J. PeBenito
Quoted 5 lines · Dominick Grift
I encountered this requirement when using poly-instantiation:
denied { relabelfrom } for pid=14189 comm="sshd" name="system_u:object_r:tmp_t:s0_domg472" dev=dm-3 ino=2884342 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:user_tmp_t:s0 tclass=dir
Athough in refpolicy
sshd_tdoes not calluserdom_tmp_role(Makes me wonder how refpolicy deals with poly-instantiation.
Quoted 8 lines
Not sure what you mean here, but
sshd_tshould never be callinguserdom_tmp_role(). That interface is only for building user roles/user domains.Quoted 1 line
Nonetheless, to me it seems to make sense that if one give access to manage a type, you may also want to give relabel perms.
NAK Relabeling is special. There are a few exceptions, but it should almost always be separate from manage permissions.
If that is so, then why are relabeling perms included with userdom_manage_home_role()? It does not appear consistent.
Quoted 25 lines
Quoted 25 lines
Oh, and it is untested (but i commited this to my branch and i will test it when i build a new version)
Signed-off-by Dominick Grift<[email protected]>---
:100644 100644 42d4e8d... 72203a0... M policy/modules/system/userdomain.ifpolicy/modules/system/userdomain.if | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-)policy/modules/system/userdomain.if +6
-0@@ -303,6 +303,12 @@ interface(`userdom_manage_tmp_role',` manage_sock_files_pattern($2, user_tmp_t, user_tmp_t) manage_fifo_files_pattern($2, user_tmp_t, user_tmp_t) files_tmp_filetrans($2, user_tmp_t, { dir file lnk_file sock_file fifo_file }) + + relabel_dirs_pattern($2, user_tmp_t, user_tmp_t) + relabel_files_pattern($2, user_tmp_t, user_tmp_t) + relabel_lnk_files_pattern($2, user_tmp_t, user_tmp_t) + relabel_sock_files_pattern($2, user_tmp_t, user_tmp_t) + relabel_fifo_files_pattern($2, user_tmp_t, user_tmp_t) ')
Quoted 14 lines
Quoted 8 lines
policy/modules/system/userdomain.if +0
-0#######################################_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicySignature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20100706/033188a2/attachment.bin