Introduce mutt policy
cover Introduce mutt policy
Please find in the following e-mails an initial policy for the mutt application (terminal e-mail client). The set of mails is structured as follows:
- the mutt definition (.te, .if, .fc)
- adding mutt_role to unprivuser, staff and sysadm
- update gpg.te to grant it rw access to mutt's tmp files
Comments are of course always appreciated.
Wkr,
Sven Vermeulen
PATCH 1/3 Initial policy for the mutt e-mail client
The mutt e-mail client is a terminal-based e-mail client. This is a first policy in an effort to support mutt within its own domain.
--- policy/modules/apps/mutt.fc | 6 +++ policy/modules/apps/mutt.if | 76 ++++++++++++++++++++++++++++++++++++++++++ policy/modules/apps/mutt.te | 77 +++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 159 insertions(+), 0 deletions(-) create mode 100644 policy/modules/apps/mutt.fc create mode 100644 policy/modules/apps/mutt.if create mode 100644 policy/modules/apps/mutt.te
policy/modules/apps/mutt.fc new file +6 -0
@@ -0,0 +1,6 @@ +HOME_DIR/\.mutt(/.*)? gen_context(system_u:object_r:mutt_home_t,s0) +HOME_DIR/\.muttrc -- gen_context(system_u:object_r:mutt_conf_t,s0) + +/etc/mutt(/.*)? gen_context(system_u:object_r:mutt_sys_conf_t,s0) + +/usr/bin/mutt -- gen_context(system_u:object_r:mutt_exec_t,s0)
policy/modules/apps/mutt.if new file +76 -0
76 lines not on this page · raw message
policy/modules/apps/mutt.te new file +77 -0
77 lines not on this page · raw message
Signature · 1 line
1.7.3.4
PATCH 1/3 Initial policy for the mutt e-mail client
Quoted 2 lines · Sven Vermeulen
The mutt e-mail client is a terminal-based e-mail client. This is a first policy in an effort to support mutt within its own domain.
In general it looks good; there are a couple comments below.
Quoted 77 lines
Signed-off-by Sven Vermeulen<[email protected]>--- policy/modules/apps/mutt.fc | 6 +++ policy/modules/apps/mutt.if | 76 ++++++++++++++++++++++++++++++++++++++++++ policy/modules/apps/mutt.te | 77 +++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 159 insertions(+), 0 deletions(-)create mode 100644 policy/modules/apps/mutt.fc
create mode 100644 policy/modules/apps/mutt.if
create mode 100644 policy/modules/apps/mutt.tepolicy/modules/apps/mutt.fc new file +6
-0@@ -0,0 +1,6 @@ +HOME_DIR/\.mutt(/.*)? gen_context(system_u:object_r:mutt_home_t,s0) +HOME_DIR/\.muttrc -- gen_context(system_u:object_r:mutt_conf_t,s0) + +/etc/mutt(/.*)? gen_context(system_u:object_r:mutt_sys_conf_t,s0) + +/usr/bin/mutt -- gen_context(system_u:object_r:mutt_exec_t,s0)policy/modules/apps/mutt.if new file +49
-0@@ -0,0 +1,76 @@ +##<summary>Mutt e-mail client</summary> + +####################################### +##<summary> +## The role for the mutt application. +##</summary> +##<param name="user_role"> +##<summary> +## The role associated with the user domain. +##</summary> +##</param> +##<param name="user_domain"> +##<summary> +## The type of the user domain. +##</summary> +##</param> +# +interface(`mutt_role',` + gen_require(` + type mutt_t, mutt_exec_t, mutt_home_t, mutt_conf_t, mutt_sys_conf_t; + type mutt_tmp_t; + ') + + ####################################### + # + # Declarations + # + + role $1 types mutt_t; + + ############################ + # + # Policy + # + + manage_dirs_pattern($2, mutt_home_t, mutt_home_t) + manage_files_pattern($2, mutt_home_t, mutt_home_t) + + manage_dirs_pattern($2, mutt_conf_t, mutt_conf_t) + manage_files_pattern($2, mutt_conf_t, mutt_conf_t) + + relabel_dirs_pattern($2, mutt_home_t, mutt_home_t) + relabel_files_pattern($2, mutt_home_t, mutt_home_t) + + relabel_dirs_pattern($2, mutt_conf_t, mutt_conf_t) + relabel_files_pattern($2, mutt_conf_t, mutt_conf_t) + + domtrans_pattern($2, mutt_exec_t, mutt_t) +
policy/modules/apps/mutt.if line 59
Quoted 10 lines
policy/modules/apps/mutt.if new file +10
-0+ allow $2 mutt_t:process signal; + ps_process_pattern($2, mutt_t) +') + +####################################### +##<summary> +## Allow other domains to read/write mutt's temporary files (used for instance +## for e-mail drafts) +##</summary> +##<param name="target_domain">
I'd prefer to keep this as "domain", for consistency, since there isn't something like a "source_domain" parameter.
policy/modules/apps/mutt.if line 61
Quoted 2 lines
policy/modules/apps/mutt.if new file +2
-0+##<summary> +## The type of the target domain that is allowed access.
"Domain allowed access."
policy/modules/apps/mutt.if line 73
Quoted 12 lines
policy/modules/apps/mutt.if new file +12
-0+##</summary> +##</param> +# +interface(`mutt_rw_tmp_files',` + gen_require(` + type mutt_tmp_t; + ') + + ############################ + # + # Policy + #
No need for this comment block.
Quoted 18 lines
policy/modules/apps/mutt.if new file +2
-0+ rw_files_pattern($1, mutt_tmp_t, mutt_tmp_t) +')policy/modules/apps/mutt.te new file +10
-0@@ -0,0 +1,77 @@ +policy_module(mutt, 1.0.0) + +############################ +# +# Declarations +# + +type mutt_t; +type mutt_exec_t; +application_domain(mutt_t, mutt_exec_t)
policy/modules/apps/mutt.te line 20
Quoted 10 lines
policy/modules/apps/mutt.te new file +10
-0+ubac_constrained(mutt_t) + +type mutt_conf_t; +userdom_user_home_content(mutt_conf_t) + +type mutt_home_t; +userdom_user_home_content(mutt_home_t) + +type mutt_sys_conf_t; +files_type(mutt_sys_conf_t)
files_config_file() seems more appropriate.
Quoted 12 lines
policy/modules/apps/mutt.te new file +12
-0+type mutt_tmp_t; +files_tmp_file(mutt_tmp_t) +ubac_constrained(mutt_tmp_t) + +############################ +# +# Local Policy Rules +# + +allow mutt_t self:process signal_perms; +allow mutt_t self:fifo_file { getattr read write }; +
policy/modules/apps/mutt.te line 42
Quoted 10 lines
policy/modules/apps/mutt.te new file +9
-0+manage_dirs_pattern(mutt_t, mutt_home_t, mutt_home_t) +manage_files_pattern(mutt_t, mutt_home_t, mutt_home_t) +userdom_user_home_dir_filetrans(mutt_t, mutt_home_t, dir) + +manage_dirs_pattern(mutt_t, mutt_tmp_t, mutt_tmp_t) +manage_files_pattern(mutt_t, mutt_tmp_t, mutt_tmp_t) +manage_fifo_files_pattern(mutt_t, mutt_tmp_t, mutt_tmp_t) +files_tmp_filetrans(mutt_t, mutt_tmp_t, { file dir }) +files_search_tmp(mutt_t)
This shouldn't be necessary due to the files_tmp_filetrans().
policy/modules/apps/mutt.te line 45
Quoted 4 lines
policy/modules/apps/mutt.te new file +3
-0+ +read_files_pattern(mutt_t, mutt_sys_conf_t, mutt_sys_conf_t) +read_files_pattern(mutt_t, mutt_conf_t, mutt_conf_t)
Excessive permissions since there are no mutt_conf_t dirs. A raw allow rule for reading the file should be sufficient.
Quoted 1 line
+search_dirs_pattern(mutt_t,
mutt_sys_conf_t,mutt_sys_conf_t)
This shouldn't be necessary due to the read_files_pattern(mutt_t, mutt_sys_conf_t, mutt_sys_conf_t).
Quoted 15 lines
policy/modules/apps/mutt.te new file +15
-0+ + +corecmd_exec_bin(mutt_t) +corecmd_exec_shell(mutt_t) + +corenet_sendrecv_pop_client_packets(mutt_t) +corenet_sendrecv_smtp_client_packets(mutt_t) +corenet_tcp_connect_pop_port(mutt_t) +corenet_tcp_connect_smtp_port(mutt_t) + +dev_read_rand(mutt_t) +dev_read_urand(mutt_t) + +domain_use_interactive_fds(mutt_t) +
policy/modules/apps/mutt.te line 71
Quoted 10 lines
policy/modules/apps/mutt.te new file +10
-0+files_read_usr_files(mutt_t) + + +auth_use_nsswitch(mutt_t) + +miscfiles_read_localization(mutt_t) + +# Allow the user to deal with e-mail attachments +userdom_manage_user_home_content_files(mutt_t) +userdom_search_user_home_content(mutt_t)
I'd prefer that this be tunable.
Quoted 6 lines
policy/modules/apps/mutt.te new file +6
-0+userdom_use_user_terminals(mutt_t) + +optional_policy(` + gpg_domtrans(mutt_t) +') +
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 2/3 Allow users, staff and sysadm to use mutt
In reply to Sven VermeulenAllow the end user domains to use the mutt application.
--- policy/modules/roles/staff.te | 4 ++++ policy/modules/roles/sysadm.te | 4 ++++ policy/modules/roles/unprivuser.te | 4 ++++ 3 files changed, 12 insertions(+), 0 deletions(-)
policy/modules/roles/staff.te +4 -0
@@ -125,6 +125,10 @@ ifndef(`distro_redhat',` ') optional_policy(` + mutt_role(staff_r, staff_t) + ') + + optional_policy(` pyzor_role(staff_r, staff_t) ')
policy/modules/roles/sysadm.te +4 -0
@@ -452,5 +452,9 @@ ifndef(`distro_redhat',` optional_policy(` java_role(sysadm_r, sysadm_t) ') + + optional_policy(` + mutt_role(sysadm_r, sysadm_t) + ') ')
policy/modules/roles/unprivuser.te +4 -0
@@ -102,6 +102,10 @@ ifndef(`distro_redhat',` ') optional_policy(` + mutt_role(user_r, user_t) + ') + + optional_policy(` postgresql_role(user_r, user_t) ')
Signature · 1 line
1.7.3.4
PATCH 3/3 Allow gpg to read/write mutt e-mail files (for signing)
In reply to Sven VermeulenThe mutt e-mail files are stored as mutt_tmp_t. As such, gpg needs to be able to read/write to mutt_tmp_t.
--- policy/modules/apps/gpg.te | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-)
policy/modules/apps/gpg.te +4 -0
@@ -147,6 +147,10 @@ optional_policy(` ') optional_policy(` + mutt_rw_tmp_files(gpg_t) +') + +optional_policy(` xserver_use_xdm_fds(gpg_t) xserver_rw_xdm_pipes(gpg_t) ')
Signature · 1 line
1.7.3.4