Gentoo/Portage related updates

When users want to use NFS mounted portage tree, distfiles, packages and other locations, they need to use the proper context= mount option. However, in the majority of cases, the users use a single NFS mount. In such situation, context= cannot be used properly since it puts a label on the entire mount (whereas we would then need other labels depending on subdirectories).

Introducing a boolean "portage_allow_nfs" which, when set (default off), allows the necessary portage-related domains to manage files and directories with the nfs_t label.

Signed-off-by Sven Vermeulen<[email protected]>

---
  policy/modules/admin/portage.te |   29 +++++++++++++++++++++++++++++
  1 files changed, 29 insertions(+), 0 deletions(-)

policy/modules/admin/portage.te +0 -0

index d2ff138..a645c5d 100644

policy/modules/admin/portage.te +14 -0

  optional_policy(`
  	bootloader_domtrans(portage_t)
  ')

@@ -262,6 +277,13 @@ ifdef(`hide_broken_symptoms',`
  	dontaudit portage_fetch_t portage_cache_t:file read;
  ')
 
+tunable_policy(`portage_allow_nfs',`
+	fs_getattr_nfs(portage_fetch_t)
+	fs_manage_nfs_dirs(portage_fetch_t)
+	fs_manage_nfs_files(portage_fetch_t)
+	fs_manage_nfs_symlinks(portage_fetch_t)
+')
+
  ##########################################
  #
  # Portage sandbox domain

@@ -275,3 +297,10 @@ ifdef(`hide_broken_symptoms',`
  	dontaudit portage_sandbox_t portage_cache_t:dir { setattr };
  	dontaudit portage_sandbox_t portage_cache_t:file { setattr write };
  ')
+
+tunable_policy(`portage_allow_nfs',`
+	fs_getattr_nfs(portage_sandbox_t)
+	fs_manage_nfs_dirs(portage_sandbox_t)
+	fs_manage_nfs_files(portage_sandbox_t)
+	fs_manage_nfs_symlinks(portage_sandbox_t)
+')

Portage supports the notion of "live ebuilds", which are packages that, when installed, update a repository checkout on a specific location. This means that a few portage-related domains need to have manage_* privileges on that location whereas they usually have much more limited rights (when live ebuilds aren't used).

To support live ebuilds, we introduce another label called portage_srcrepo_t for those specific locations where the "higher" privileges are needed for, and grant the proper permissions on the compile domain (portage_sandbox_t) to manage the checkouts.

Signed-off-by Sven Vermeulen<[email protected]>

---
  policy/modules/admin/portage.fc |    3 +++
  policy/modules/admin/portage.if |    5 +++++
  policy/modules/admin/portage.te |    3 +++
  3 files changed, 11 insertions(+), 0 deletions(-)

policy/modules/admin/portage.fc +3 -0

index db46387..9097092 100644
@@ -12,6 +12,9 @@
  /usr/lib(64)?/portage/bin/regenworld --	gen_context(system_u:object_r:portage_exec_t,s0)
  /usr/lib(64)?/portage/bin/sandbox --	gen_context(system_u:object_r:portage_exec_t,s0)
 
+/usr/portage/distfiles/svn-src(/.*)?	gen_context(system_u:object_r:portage_srcrepo_t,s0)
+/usr/portage/distfiles/git-src(/.*)?	gen_context(system_u:object_r:portage_srcrepo_t,s0)
+/usr/portage/distfiles/cvs-src(/.*)?	gen_context(system_u:object_r:portage_srcrepo_t,s0)
  /usr/portage(/.*)?			gen_context(system_u:object_r:portage_ebuild_t,s0)
 
  /var/db/pkg(/.*)?			gen_context(system_u:object_r:portage_db_t,s0)

policy/modules/admin/portage.if +5 -0

index 0f27b1c..e327da3 100644
@@ -123,6 +123,11 @@ interface(`portage_compile_domain',`
  	manage_sock_files_pattern($1, portage_tmpfs_t, portage_tmpfs_t)
  	fs_tmpfs_filetrans($1, portage_tmpfs_t, { dir file lnk_file sock_file fifo_file })
 
+	# Support live ebuilds (-9999)
+	manage_dirs_pattern($1, portage_srcrepo_t, portage_srcrepo_t)
+	manage_files_pattern($1, portage_srcrepo_t, portage_srcrepo_t)
+	manage_lnk_files_pattern($1, portage_srcrepo_t, portage_srcrepo_t)
+
  	kernel_read_system_state($1)
  	kernel_read_network_state($1)
  	kernel_read_software_raid_state($1)

policy/modules/admin/portage.te +0 -0

index a645c5d..88c6d60 100644

Since the introduction of OpenRC (init system), a few changes are made on the general Gentoo related files and applications. gcc-config is one of them. It calls /sbin/rc (the main "entrypoint" for all OpenRC-related actions) which, with the current policy, wasn't allowed.

Allow gcc-config to call /sbin/rc (initrc_exec_t) without transitioning.

Signed-off-by Sven Vermeulen<[email protected]>

---
  policy/modules/admin/portage.te |    2 ++
  1 files changed, 2 insertions(+), 0 deletions(-)

policy/modules/admin/portage.te +2 -0

index 88c6d60..e555e41 100644
@@ -105,6 +105,8 @@ files_list_all(gcc_config_t)
 
  # seems to be ok without this
  init_dontaudit_read_script_status_files(gcc_config_t)
+# Since OpenRC, gcc-config calls rc (but transitioning isn't needed)
+init_exec_script_files(gcc_config_t)
 
  libs_read_lib_files(gcc_config_t)
  libs_domtrans_ldconfig(gcc_config_t)

Portage supports the use of proxy systems (which usually run on port 8080) for both the fetching of software archives as well as fetching binaries (in case of PORTAGE_BINHOST support).

Hence the introduction of the connect_http_port& connect_http_cache_port for portage_t (PORTAGE_BINHOST) and portage_fetch_t (software archives).

In the latter case, connect_http_port is already available through connect_all_reserved_ports.

Signed-off-by Sven Vermeulen<[email protected]>

---
  policy/modules/admin/portage.te |    5 +++++
  1 files changed, 5 insertions(+), 0 deletions(-)

policy/modules/admin/portage.te +5 -0

index e555e41..b11cdd2 100644
@@ -166,6 +166,10 @@ can_exec(portage_t, portage_tmp_t)
  # merging baselayout will need this:
  kernel_write_proc_files(portage_t)
 
+# allow emerge to fetch binpkgs from PORTAGE_BINHOST
+corenet_tcp_connect_http_port(portage_t)
+corenet_tcp_connect_http_cache_port(portage_t)
+
  domain_dontaudit_read_all_domains_state(portage_t)
 
  # modify any files in the system

@@ -258,6 +262,7 @@ corenet_tcp_sendrecv_all_ports(portage_fetch_t)
  # it occasionally comes up
  corenet_tcp_connect_all_reserved_ports(portage_fetch_t)
  corenet_tcp_connect_generic_port(portage_fetch_t)
+corenet_tcp_connect_http_cache_port(portage_fetch_t) # In case of cache server connections/proxy
 
  dev_dontaudit_read_rand(portage_fetch_t)
 

Quoted 4 lines · Sven Vermeulen

Portage supports the use of proxy systems (which usually run on port 8080) for both the fetching of software archives as well as fetching binaries (in case of PORTAGE_BINHOST support).

Quoted 5 lines

Hence the introduction of the connect_http_port& connect_http_cache_port for portage_t (PORTAGE_BINHOST) and portage_fetch_t (software archives).

In the latter case, connect_http_port is already available through connect_all_reserved_ports.

I presume portage is using wget to do this? Why can't we update portage to do setexeccon, like when it is doing when downloading source files?

Quoted 11 lines · Christopher J. PeBenito

Quoted 9 lines · Sven Vermeulen

Portage supports the use of proxy systems (which usually run on port 8080) for both the fetching of software archives as well as fetching binaries (in case of PORTAGE_BINHOST support).

Hence the introduction of the connect_http_port& connect_http_cache_port
for portage_t (PORTAGE_BINHOST) and portage_fetch_t (software archives).

In the latter case, connect_http_port is already available through connect_all_reserved_ports.

Quoted 2 lines

I presume portage is using wget to do this? Why can't we update portage to do setexeccon, like when it is doing when downloading source files?

You mean to have Portage transition to portage_fetch_t again so that the privileges on portage_t aren't necessary? I don't think that would be a problem.