Haveget support in (audio)entropyd
PATCH v3 1/1 Haveget support in (audio)entropyd
This patch set segregates the obvious audio-related privileges within entropyd_t (in the audioentropyd module) through the use of a SELinux boolean "entropyd_use_audio", enhances the entropyd_t with the privileges needed by haveged, and adds the proper file contexts for haveged support.
Comments always appreciated. This obsoletes the previous patch set titled "[PATCH/RFC v2] Haveget support in (audio)entropyd".
Changes since v2:
- Use optional_policy ( tunable_policy ( ... ) ) format. The other way around isn't supported
PATCH 1/3 Separate sound specific items from general entropyd_t definition
Introduce a tunable called "entropyd_use_audio". This boolean triggers the privileges that are specific for audio support (both device access as well as the alsa-specific ones).
The idea to use a boolean is to support other entropy management applications/daemons which use different sources (like haveged using the HAVEGE algorithm).
--- policy/modules/services/audioentropy.te | 27 ++++++++++++++++++++------- 1 files changed, 20 insertions(+), 7 deletions(-)
policy/modules/services/audioentropy.te +20 -7
@@ -5,6 +5,13 @@ policy_module(audioentropy, 1.6.0) # Declarations # +## <desc> +## <p> +## Allow the use of the audio devices as the source for the entropy feeds +## </p> +## </desc> +gen_tunable(entropyd_use_audio, false) + type entropyd_t; type entropyd_exec_t; init_daemon_domain(entropyd_t, entropyd_exec_t)
@@ -33,11 +40,6 @@ dev_read_urand(entropyd_t) dev_write_urand(entropyd_t) dev_read_rand(entropyd_t) dev_write_rand(entropyd_t) -dev_read_sound(entropyd_t) -# set sound card parameters such as -# sample format, number of channels -# and sample rate. -dev_write_sound(entropyd_t) files_read_etc_files(entropyd_t) files_read_usr_files(entropyd_t)
@@ -55,8 +57,19 @@ userdom_dontaudit_use_unpriv_user_fds(entropyd_t) userdom_dontaudit_search_user_home_dirs(entropyd_t) optional_policy(` - alsa_read_lib(entropyd_t) - alsa_read_rw_config(entropyd_t) + tunable_policy(`entropyd_use_audio',` + dev_read_sound(entropyd_t) + # set sound card parameters such as sample format, number of channels + # and sample rate. + dev_write_sound(entropyd_t) + ') +') + +optional_policy(` + tunable_policy(`entropyd_use_audio',` + alsa_read_lib(entropyd_t) + alsa_read_rw_config(entropyd_t) + ') ') optional_policy(`
Signature · 1 line
1.7.3.4
PATCH 2/3 Update entropyd_t with privileged needed for haveged
In reply to Sven VermeulenHaveged by itself requires a few additional privileges (create a unix socket and write access to some proc/sys/kernel files (like /proc/sys/kernel/random/write_wakeup_threshold).
--- policy/modules/services/audioentropy.te | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-)
policy/modules/services/audioentropy.te +2 -1
@@ -27,11 +27,12 @@ files_pid_file(entropyd_var_run_t) allow entropyd_t self:capability { dac_override ipc_lock sys_admin }; dontaudit entropyd_t self:capability sys_tty_config; allow entropyd_t self:process signal_perms; +allow entropyd_t self:unix_dgram_socket create_socket_perms; manage_files_pattern(entropyd_t, entropyd_var_run_t, entropyd_var_run_t) files_pid_filetrans(entropyd_t, entropyd_var_run_t, file) -kernel_read_kernel_sysctls(entropyd_t) +kernel_rw_kernel_sysctl(entropyd_t) kernel_list_proc(entropyd_t) kernel_read_proc_symlinks(entropyd_t)
Signature · 1 line
1.7.3.4
PATCH 3/3 Add file context rules for haveged
In reply to Sven VermeulenAdd file context rules for haveged within the audioentropyd module.
--- policy/modules/services/audioentropy.fc | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-)
policy/modules/services/audioentropy.fc +2 -0
@@ -2,5 +2,7 @@ # /usr # /usr/sbin/audio-entropyd -- gen_context(system_u:object_r:entropyd_exec_t,s0) +/usr/sbin/haveged -- gen_context(system_u:object_r:entropyd_exec_t,s0) /var/run/audio-entropyd\.pid -- gen_context(system_u:object_r:entropyd_var_run_t,s0) +/var/run/haveged\.pid -- gen_context(system_u:object_r:entropyd_var_run_t,s0)
Signature · 1 line
1.7.3.4