Portage-related updates

PATCH Superseded Sven Vermeulen 2 participants 20 messages Aug 23, 2011 – Aug 30, 2011

Share & tools

Sven Vermeulen

author

2011-08-23 13:36 UTC #0 lore raw

v2 cover Portage-related updates

Replies to this e-mail will contain a set of Portage-related updates, many of these have been presented earlier (think layman support, emerge-webrsync, running Portage from cron, ...) but needed additional improvements (or even rewrites), hence the v2.

In short, the patch set contains:

 1  Introduce portage_dontaudit_use_fds
 2  Use portage_dontaudit_use_fds from load_policy_t
 3  Introduce rc_exec_t for /sbin/rc (instead of initrc_exec_t) for Gentoo
 4  Allow gcc-config to call /sbin/rc (no transition)
 5  Allow Gentoo's integrated run_init_t to call /sbin/rc (no transition)
 6  Allow sysadm_t to call /sbin/rc (no transition)
 7  Make portage_fetch_t a full application domain (instead of application type)
 8  Introduce portage_search_conf_dirs and portage_read_tmp_files
 9  Enhance gpg_t with portage_search_conf_dirs and portage_read_tmp_files
10  Allow cron to execute portage commands (incl. transition)
11  Allow portage to call GnuPG

Wkr,
Sven Vermeulen

Sven Vermeulen

author

2011-08-23 13:39 UTC #1 lore raw

PATCH v2 1/11 Introduce portage_dontaudit_use_fds

Support the interface to not audit portage_t:fd use (file descriptors, leaked or not)

Signed-off-by Sven Vermeulen <[email protected]>

---
 policy/modules/admin/portage.if |   19 +++++++++++++++++++
 1 files changed, 19 insertions(+), 0 deletions(-)

policy/modules/admin/portage.if +19 -0

index 08b361b..a1bfbaa 100644
@@ -293,3 +293,22 @@ interface(`portage_dontaudit_rw_tmp_files',`
 
 	dontaudit $1 portage_tmp_t:file rw_file_perms;
 ')
+
+########################################
+## <summary>
+##	Do not audit attempts to use
+##	portage file descriptors.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`portage_dontaudit_use_fds',`
+	gen_require(`
+		type portage_t;
+	')
+
+	dontaudit $1 portage_t:fds use;
+')

Signature · 1 line

1.7.3.4

Christopher J. PeBenito

2011-08-25 11:46 UTC #2 lore raw

PATCH 1/11 Introduce portage_dontaudit_use_fds

Quoted 2 lines · Sven Vermeulen

Support the interface to not audit portage_t:fd use (file descriptors, leaked or not)

Merged.

Quoted 32 lines

Signed-off-by Sven Vermeulen <[email protected]>

---
 policy/modules/admin/portage.if |   19 +++++++++++++++++++
 1 files changed, 19 insertions(+), 0 deletions(-)

policy/modules/admin/portage.if +19 -0

index 08b361b..a1bfbaa 100644
@@ -293,3 +293,22 @@ interface(`portage_dontaudit_rw_tmp_files',`
 
 	dontaudit $1 portage_tmp_t:file rw_file_perms;
 ')
+
+########################################
+## <summary>
+##	Do not audit attempts to use
+##	portage file descriptors.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`portage_dontaudit_use_fds',`
+	gen_require(`
+		type portage_t;
+	')
+
+	dontaudit $1 portage_t:fds use;
+')

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

Sven Vermeulen

author

2011-08-23 13:39 UTC #3 lore raw

PATCH v2 2/11 Do not audit the use of portage' filedescriptors from load_policy_t

In reply to Sven Vermeulen

During build and eventual activation of the base policy, the load_policy_t domain attempts to use a portage file descriptor. However, this serves no purpose (the loading is done correctly and everything is logged appropriately).

Hence, we dontaudit this use.

Signed-off-by Sven Vermeulen <[email protected]>

---
 policy/modules/system/selinuxutil.te |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)

policy/modules/system/selinuxutil.te +4 -0

index e252935..12dabe2 100644
@@ -199,6 +199,10 @@ ifdef(`hide_broken_symptoms',`
 	')
 ')
 
+optional_policy(`
+	portage_dontaudit_use_fds(load_policy_t)
+')
+
 ########################################
 #
 # Newrole local policy

Signature · 1 line

1.7.3.4

Christopher J. PeBenito

2011-08-25 11:47 UTC #4 lore raw

PATCH 2/11 Do not audit the use of portage' filedescriptors from load_policy_t

Quoted 6 lines · Sven Vermeulen

During build and eventual activation of the base policy, the load_policy_t domain attempts to use a portage file descriptor. However, this serves no purpose (the loading is done correctly and everything is logged appropriately).
Hence, we dontaudit this use.

Merged.

Quoted 20 lines

Signed-off-by Sven Vermeulen <[email protected]>

---
 policy/modules/system/selinuxutil.te |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)

policy/modules/system/selinuxutil.te +4 -0

index e252935..12dabe2 100644
@@ -199,6 +199,10 @@ ifdef(`hide_broken_symptoms',`
 	')
 ')
 
+optional_policy(`
+	portage_dontaudit_use_fds(load_policy_t)
+')
+
 ########################################
 #
 # Newrole local policy

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

Sven Vermeulen

author

2011-08-23 13:40 UTC #5 lore raw

PATCH v2 3/11 Introduce rc_exec_t as secundary entry file for initrc_t

In reply to Sven Vermeulen

Within Gentoo, the init system (openrc) uses a single binary (/sbin/rc) for all its functions, be it executing init scripts, managing runlevels, checking state, etc. This binary is not allowed to be labeled initrc_exec_t as that would trigger domain transitions where this isn't necessary (or even allowed).

A suggested solution is to use a separate type declaration for /sbin/rc (rc_exec_t) which transitions where necessary.

This patch includes support for the /sbin/rc rc_exec_t type and declares the init_rc_exec() interface which allows domains to execute the binary without transitioning.

Signed-off-by Sven Vermeulen <[email protected]>

---
 policy/modules/system/init.fc |    2 +-
 policy/modules/system/init.if |   23 ++++++++++++++++++++++-
 policy/modules/system/init.te |    4 ++++
 3 files changed, 27 insertions(+), 2 deletions(-)

policy/modules/system/init.fc +1 -1

index 354ce93..c2021e3 100644
@@ -38,7 +38,7 @@ ifdef(`distro_gentoo', `
 /sbin/upstart		--	gen_context(system_u:object_r:init_exec_t,s0)
 
 ifdef(`distro_gentoo', `
-/sbin/rc		--	gen_context(system_u:object_r:initrc_exec_t,s0)
+/sbin/rc		--	gen_context(system_u:object_r:rc_exec_t,s0)
 /sbin/runscript		--	gen_context(system_u:object_r:initrc_exec_t,s0)
 /sbin/runscript\.sh	--	gen_context(system_u:object_r:initrc_exec_t,s0)
 /sbin/runsvcscript\.sh	--	gen_context(system_u:object_r:initrc_exec_t,s0)

policy/modules/system/init.if +22 -1

index 94fd8dd..b8b3337 100644
@@ -455,6 +455,26 @@ interface(`init_exec',`
 
 ########################################
 ## <summary>
+##	Execute the rc program in the caller domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`init_rc_exec',`
+	gen_require(`
+		type rc_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	can_exec($1, rc_exec_t)
+')
+
+########################################
+## <summary>
 ##	Get the process group of init.
 ## </summary>
 ## <param name="domain">

@@ -800,11 +820,12 @@ interface(`init_spec_domtrans_script',`
 #
 interface(`init_domtrans_script',`
 	gen_require(`
-		type initrc_t, initrc_exec_t;
+		type initrc_t, initrc_exec_t, rc_exec_t;
 	')
 
 	files_list_etc($1)
 	domtrans_pattern($1, initrc_exec_t, initrc_t)
+	domtrans_pattern($1, rc_exec_t, initrc_t)
 
 	ifdef(`enable_mcs',`
 		range_transition $1 initrc_exec_t:process s0;

policy/modules/system/init.te +4 -0

index 157e844..00586c6 100644
@@ -56,8 +56,10 @@ mls_trusted_object(initctl_t)
 
 type initrc_t, init_script_domain_type, init_run_all_scripts_domain;
 type initrc_exec_t, init_script_file_type;
+type rc_exec_t;
 domain_type(initrc_t)
 domain_entry_file(initrc_t, initrc_exec_t)
+domain_entry_file(initrc_t, rc_exec_t)
 role system_r types initrc_t;
 # should be part of the true block
 # of the below init_upstart tunable

@@ -381,6 +383,8 @@ auth_delete_pam_pid(initrc_t)
 auth_delete_pam_console_data(initrc_t)
 auth_use_nsswitch(initrc_t)
 
+init_rc_exec(initrc_t)
+
 libs_rw_ld_so_cache(initrc_t)
 libs_exec_lib_files(initrc_t)
 libs_exec_ld_so(initrc_t)

Signature · 1 line

1.7.3.4

Christopher J. PeBenito

2011-08-25 11:40 UTC #6 lore raw

PATCH 3/11 Introduce rc_exec_t as secundary entry file for initrc_t

Quoted 11 lines · Sven Vermeulen

Within Gentoo, the init system (openrc) uses a single binary (/sbin/rc) for all its functions, be it executing init scripts, managing runlevels, checking state, etc. This binary is not allowed to be labeled initrc_exec_t as that would trigger domain transitions where this isn't necessary (or even allowed).
A suggested solution is to use a separate type declaration for /sbin/rc (rc_exec_t) which transitions where necessary.
This patch includes support for the /sbin/rc rc_exec_t type and declares the init_rc_exec() interface which allows domains to execute the binary without transitioning.

I think the overall implementation is fine, except everything in this patch should be in distro_gentoo blocks, except for the init_rc_exec() implementation.

Quoted 89 lines

Signed-off-by Sven Vermeulen <[email protected]>

---
 policy/modules/system/init.fc |    2 +-
 policy/modules/system/init.if |   23 ++++++++++++++++++++++-
 policy/modules/system/init.te |    4 ++++
 3 files changed, 27 insertions(+), 2 deletions(-)

policy/modules/system/init.fc +1 -1

index 354ce93..c2021e3 100644
@@ -38,7 +38,7 @@ ifdef(`distro_gentoo', `
 /sbin/upstart		--	gen_context(system_u:object_r:init_exec_t,s0)
 
 ifdef(`distro_gentoo', `
-/sbin/rc		--	gen_context(system_u:object_r:initrc_exec_t,s0)
+/sbin/rc		--	gen_context(system_u:object_r:rc_exec_t,s0)
 /sbin/runscript		--	gen_context(system_u:object_r:initrc_exec_t,s0)
 /sbin/runscript\.sh	--	gen_context(system_u:object_r:initrc_exec_t,s0)
 /sbin/runsvcscript\.sh	--	gen_context(system_u:object_r:initrc_exec_t,s0)

policy/modules/system/init.if +22 -1

index 94fd8dd..b8b3337 100644
@@ -455,6 +455,26 @@ interface(`init_exec',`
 
 ########################################
 ## <summary>
+##	Execute the rc program in the caller domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`init_rc_exec',`
+	gen_require(`
+		type rc_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	can_exec($1, rc_exec_t)
+')
+
+########################################
+## <summary>
 ##	Get the process group of init.
 ## </summary>
 ## <param name="domain">

@@ -800,11 +820,12 @@ interface(`init_spec_domtrans_script',`
 #
 interface(`init_domtrans_script',`
 	gen_require(`
-		type initrc_t, initrc_exec_t;
+		type initrc_t, initrc_exec_t, rc_exec_t;
 	')
 
 	files_list_etc($1)
 	domtrans_pattern($1, initrc_exec_t, initrc_t)
+	domtrans_pattern($1, rc_exec_t, initrc_t)
 
 	ifdef(`enable_mcs',`
 		range_transition $1 initrc_exec_t:process s0;

policy/modules/system/init.te +4 -0

index 157e844..00586c6 100644
@@ -56,8 +56,10 @@ mls_trusted_object(initctl_t)
 
 type initrc_t, init_script_domain_type, init_run_all_scripts_domain;
 type initrc_exec_t, init_script_file_type;
+type rc_exec_t;
 domain_type(initrc_t)
 domain_entry_file(initrc_t, initrc_exec_t)
+domain_entry_file(initrc_t, rc_exec_t)
 role system_r types initrc_t;
 # should be part of the true block
 # of the below init_upstart tunable

@@ -381,6 +383,8 @@ auth_delete_pam_pid(initrc_t)
 auth_delete_pam_console_data(initrc_t)
 auth_use_nsswitch(initrc_t)
 
+init_rc_exec(initrc_t)
+
 libs_rw_ld_so_cache(initrc_t)
 libs_exec_lib_files(initrc_t)
 libs_exec_ld_so(initrc_t)

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

Sven Vermeulen

author

2011-08-25 20:11 UTC #7 lore raw

PATCH v2 3/11 Introduce rc_exec_t as secundary entry file for initrc_t

Quoted 3 lines · Christopher J. PeBenito

I think the overall implementation is fine, except everything in this patch should be in distro_gentoo blocks, except for the init_rc_exec() implementation.

Ok, I assume the exception also holds for the pure type definition (type rc_exec_t)? Since the init_rc_exec() interface requires it, I assume that I cannot just put that behind an ifdef(`distro_gentoo') one, right?

Wkr,
Sven Vermeulen

Christopher J. PeBenito

2011-08-30 12:20 UTC #8 lore raw

PATCH 3/11 Introduce rc_exec_t as secundary entry file for initrc_t

Quoted 10 lines · Sven Vermeulen

Quoted 3 lines · Christopher J. PeBenito
I think the overall implementation is fine, except everything in this patch should be in distro_gentoo blocks, except for the init_rc_exec() implementation.
Ok, I assume the exception also holds for the pure type definition (type rc_exec_t)? Since the init_rc_exec() interface requires it, I assume that I cannot just put that behind an ifdef(`distro_gentoo') one, right?

Thats fine.

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

Christopher J. PeBenito

2011-08-30 13:30 UTC #9 lore raw

PATCH 3/11 Introduce rc_exec_t as secundary entry file for initrc_t

Quoted 7 lines · Christopher J. PeBenito

Quoted 6 lines · Sven Vermeulen
Quoted 3 lines · Christopher J. PeBenito
I think the overall implementation is fine, except everything in this patch should be in distro_gentoo blocks, except for the init_rc_exec() implementation.

Quoted 6 lines

Quoted 4 lines
Ok, I assume the exception also holds for the pure type definition (type rc_exec_t)? Since the init_rc_exec() interface requires it, I assume that I cannot just put that behind an ifdef(`distro_gentoo') one, right?
Thats fine.

Actually, you can put the definition in the distro_gentoo. We already have examples of interfaces that reference types that are optionally declared.

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

Sven Vermeulen

author

2011-08-23 13:41 UTC #10 lore raw

PATCH v2 4/11 Allow gcc-config to execute /sbin/rc without transitioning

In reply to Sven Vermeulen

The gcc-config application uses some functions (from /etc/init.d/functions.sh) which are simple wrappers on top of /sbin/rc. Since this script is sourced and the functions executed from within gcc_config_t, we allow gcc-config to execute /sbin/rc without transitioning.

Signed-off-by Sven Vermeulen <[email protected]>

---
 policy/modules/admin/portage.te |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

policy/modules/admin/portage.te +1 -0

index 563c598..2794531 100644
@@ -103,6 +103,7 @@ files_search_pids(gcc_config_t)
 # the directory it is being run from
 files_list_all(gcc_config_t)
 
+init_rc_exec(gcc_config_t)
 # seems to be ok without this
 init_dontaudit_read_script_status_files(gcc_config_t)

Signature · 1 line

1.7.3.4

Sven Vermeulen

author

2011-08-23 13:41 UTC #11 lore raw

PATCH v2 5/11 Gentoo's integrated run_init support re-executes /sbin/rc

In reply to Sven Vermeulen

When an init script is launched, Gentoo's integrated run_init support will re-execute /sbin/rc (an all-in-one binary) for various functions. The run_init_t domain here should not be allowed to transition yet, so we allow it to execute /sbin/rc without transitioning.

Signed-off-by Sven Vermeulen <[email protected]>

---
 policy/modules/system/selinuxutil.te |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

policy/modules/system/selinuxutil.te +1 -0

index 12dabe2..ace2010 100644
@@ -406,6 +406,7 @@ ifndef(`direct_sysadm_daemon',`
 	ifdef(`distro_gentoo',`
 		# Gentoo integrated run_init:
 		init_script_file_entry_type(run_init_t)
+		init_rc_exec(run_init_t)
 	')
 ')

Signature · 1 line

1.7.3.4

Sven Vermeulen

author

2011-08-23 13:43 UTC #12 lore raw

PATCH v2 6/11 Allow the sysadm domain to execute /sbin/rc without transitioning

In reply to Sven Vermeulen

The /sbin/rc binary is used by the system administrator to manage runlevels (add/delete), check runlevel state, etc. all which do not require a transition to occur. Hence the /sbin/rc (now labeled rc_exec_t) is allowed to be executed without transitioning.

Signed-off-by Sven Vermeulen <[email protected]>

---
 policy/modules/roles/sysadm.te |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

policy/modules/roles/sysadm.te +1 -0

index 0f96353..00f8a57 100644
@@ -34,6 +34,7 @@ ubac_file_exempt(sysadm_t)
 ubac_fd_exempt(sysadm_t)
 
 init_exec(sysadm_t)
+init_rc_exec(sysadm_t)
 
 # Add/remove user home directories
 userdom_manage_user_home_dirs(sysadm_t)

Signature · 1 line

1.7.3.4

Sven Vermeulen

author

2011-08-23 13:43 UTC #13 lore raw

PATCH v2 7/11 Introduce portage_fetch_t as an application domain

In reply to Sven Vermeulen

Enhance portage_fetch_t from an application type to a domain. Introduce the proper portage_fetch_exec_t and add the necessary privileges to the domain definition to allow portage_fetch_t to be used by Portage management utilities like layman and emerge-webrsync.

Signed-off-by Sven Vermeulen <[email protected]>

---
 policy/modules/admin/portage.fc |    5 +++++
 policy/modules/admin/portage.te |   20 ++++++++++++++++++--
 2 files changed, 23 insertions(+), 2 deletions(-)

policy/modules/admin/portage.fc +5 -0

index 13dc979..41ce431 100644
@@ -3,12 +3,14 @@
 /etc/portage(/.*)?			gen_context(system_u:object_r:portage_conf_t,s0)
 
 /usr/bin/gcc-config		--	gen_context(system_u:object_r:gcc_config_exec_t,s0)
+/usr/bin/layman			--	gen_context(system_u:object_r:portage_fetch_exec_t,s0)
 /usr/bin/sandbox		--	gen_context(system_u:object_r:portage_exec_t,s0)
 
 /usr/lib(64)?/portage/bin/ebuild --	gen_context(system_u:object_r:portage_exec_t,s0)
 /usr/lib(64)?/portage/bin/emerge --	gen_context(system_u:object_r:portage_exec_t,s0)
 /usr/lib(64)?/portage/bin/quickpkg --	gen_context(system_u:object_r:portage_exec_t,s0)
 /usr/lib(64)?/portage/bin/ebuild\.sh --	gen_context(system_u:object_r:portage_exec_t,s0)
+/usr/lib(64)?/portage/bin/emerge-webrsync	--	gen_context(system_u:object_r:portage_fetch_exec_t,s0)
 /usr/lib(64)?/portage/bin/regenworld --	gen_context(system_u:object_r:portage_exec_t,s0)
 /usr/lib(64)?/portage/bin/sandbox --	gen_context(system_u:object_r:portage_exec_t,s0)

@@ -22,6 +24,9 @@
 /var/log/emerge\.log.*		--	gen_context(system_u:object_r:portage_log_t,s0)
 /var/log/emerge-fetch.log	--	gen_context(system_u:object_r:portage_log_t,s0)
 /var/log/portage(/.*)?			gen_context(system_u:object_r:portage_log_t,s0)
+/var/lib/layman(/.*)?			gen_context(system_u:object_r:portage_ebuild_t,s0)
 /var/lib/portage(/.*)?			gen_context(system_u:object_r:portage_cache_t,s0)
+/var/tmp/binpkgs(/.*)?			gen_context(system_u:object_r:portage_tmp_t,s0)
+/var/tmp/emerge-webrsync(/.*)?		gen_context(system_u:object_r:portage_tmp_t,s0)
 /var/tmp/portage(/.*)?			gen_context(system_u:object_r:portage_tmp_t,s0)
 /var/tmp/portage-pkg(/.*)?		gen_context(system_u:object_r:portage_tmp_t,s0)

policy/modules/admin/portage.te +18 -2

index 2794531..beeeb81 100644
@@ -34,7 +34,8 @@ corecmd_shell_entry_type(portage_sandbox_t)
 
 # portage package fetching domain
 type portage_fetch_t;
-application_type(portage_fetch_t)
+type portage_fetch_exec_t;
+application_domain(portage_fetch_t, portage_fetch_exec_t)
 corecmd_shell_entry_type(portage_fetch_t)
 rsync_entry_type(portage_fetch_t)

@@ -219,8 +220,10 @@ allow portage_fetch_t self:capability { dac_override fowner fsetid };
 allow portage_fetch_t self:process signal;
 allow portage_fetch_t self:unix_stream_socket create_socket_perms;
 allow portage_fetch_t self:tcp_socket create_stream_socket_perms;
+allow portage_fetch_t self:fifo_file rw_fifo_file_perms;
 
 allow portage_fetch_t portage_conf_t:dir list_dir_perms;
+
 read_files_pattern(portage_fetch_t, portage_conf_t, portage_conf_t)
 
 manage_dirs_pattern(portage_fetch_t, portage_ebuild_t, portage_ebuild_t)

@@ -240,9 +243,14 @@ kernel_read_system_state(portage_fetch_t)
 kernel_read_kernel_sysctls(portage_fetch_t)
 
 corecmd_exec_bin(portage_fetch_t)
+corecmd_exec_shell(portage_fetch_t)
 
 corenet_all_recvfrom_unlabeled(portage_fetch_t)
 corenet_all_recvfrom_netlabel(portage_fetch_t)
+corenet_sendrecv_http_client_packets(portage_fetch_t)
+corenet_sendrecv_http_cache_client_packets(portage_fetch_t)
+corenet_sendrecv_git_client_packets(portage_fetch_t)
+corenet_sendrecv_rsync_client_packets(portage_fetch_t)
 corenet_tcp_sendrecv_generic_if(portage_fetch_t)
 corenet_tcp_sendrecv_generic_node(portage_fetch_t)
 corenet_tcp_sendrecv_all_ports(portage_fetch_t)

@@ -251,6 +259,7 @@ corenet_tcp_sendrecv_all_ports(portage_fetch_t)
 corenet_tcp_connect_all_reserved_ports(portage_fetch_t)
 corenet_tcp_connect_generic_port(portage_fetch_t)
 corenet_tcp_connect_http_cache_port(portage_fetch_t)
+corenet_tcp_connect_git_port(portage_fetch_t)
 
 dev_dontaudit_read_rand(portage_fetch_t)

@@ -258,11 +267,15 @@ domain_use_interactive_fds(portage_fetch_t)
 
 files_read_etc_files(portage_fetch_t)
 files_read_etc_runtime_files(portage_fetch_t)
-files_search_var(portage_fetch_t)
+files_read_usr_files(portage_fetch_t)
+files_search_var_lib(portage_fetch_t)
 files_dontaudit_search_pids(portage_fetch_t)
 
+logging_list_logs(portage_fetch_t)
+
 term_search_ptys(portage_fetch_t)
 
+
 miscfiles_read_localization(portage_fetch_t)
 
 sysnet_read_config(portage_fetch_t)

@@ -271,6 +284,9 @@ sysnet_dns_name_resolve(portage_fetch_t)
 userdom_use_user_terminals(portage_fetch_t)
 userdom_dontaudit_read_user_home_content_files(portage_fetch_t)
 
+
+rsync_exec(portage_fetch_t)
+
 ifdef(`hide_broken_symptoms',`
 	dontaudit portage_fetch_t portage_cache_t:file read;
 ')

Signature · 1 line

1.7.3.4

Sven Vermeulen

author

2011-08-23 13:44 UTC #14 lore raw

PATCH v2 8/11 Introduce search_conf_dirs and read_tmp_files interfaces for Portage

In reply to Sven Vermeulen

We add support for searching through portage' configuration file locations (which will be used in subsequent patches) for tools that provide additional features on top of Portage and which integrate with it. For instance, gpg (validating snapshots).

Signed-off-by Sven Vermeulen <[email protected]>

---
 policy/modules/admin/portage.if |   39 +++++++++++++++++++++++++++++++++++++++
 1 files changed, 39 insertions(+), 0 deletions(-)

policy/modules/admin/portage.if +39 -0

index a1bfbaa..4851e90 100644
@@ -258,6 +258,25 @@ interface(`portage_run_gcc_config',`
 
 ########################################
 ## <summary>
+##   Allow a domain search privileges through portage configuration
+##   file directories
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to allow search privileges
+##	</summary>
+## </param>
+#
+interface(`portage_search_conf_dirs',`
+	gen_require(`
+		type portage_conf_t;
+	')
+
+	allow $1 portage_conf_t:dir search_dir_perms;
+')
+
+########################################
+## <summary>
 ##	Do not audit attempts to search the
 ##	portage temporary directories.
 ## </summary>

@@ -277,6 +296,26 @@ interface(`portage_dontaudit_search_tmp',`
 
 ########################################
 ## <summary>
+##   Allow a domain to read portage_tmp_t files
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to allow read privileges
+##	</summary>
+## </param>
+#
+interface(`portage_read_tmp_files',`
+	gen_require(`
+		type portage_tmp_t;
+	')
+
+	allow $1 portage_tmp_t:dir list_dir_perms;
+	allow $1 portage_tmp_t:file read_file_perms;
+')
+
+
+########################################
+## <summary>
 ##	Do not audit attempts to read and write
 ##	the portage temporary files.
 ## </summary>

Signature · 1 line

1.7.3.4

Sven Vermeulen

author

2011-08-23 13:44 UTC #15 lore raw

PATCH v2 9/11 Support GnuPG integration in Portage

In reply to Sven Vermeulen

To support GnuPG integration in Portage (such as validating the signature of snapshots), we need to add portage_search_conf_dirs rights (have GnuPG find its keys in /etc/portage/gnupg) and portage_read_tmp_files (where the snapshot will be stored and later extracted).

Signed-off-by Sven Vermeulen <[email protected]>

---
 policy/modules/apps/gpg.te |    5 +++++
 1 files changed, 5 insertions(+), 0 deletions(-)

policy/modules/apps/gpg.te +5 -0

index 9050e8c..bde06f6 100644
@@ -147,6 +147,11 @@ optional_policy(`
 ')
 
 optional_policy(`
+	portage_search_conf_dirs(gpg_t)
+	portage_read_tmp_files(gpg_t)
+')
+
+optional_policy(`
 	xserver_use_xdm_fds(gpg_t)
 	xserver_rw_xdm_pipes(gpg_t)
 ')

Signature · 1 line

1.7.3.4

Sven Vermeulen

author

2011-08-23 13:46 UTC #16 lore raw

PATCH v2 10/11 Allow cron to execute portage commands

In reply to Sven Vermeulen

Many users use portage from within cron (for instance to update the portage tree or even automatically update their system). As such, we allow to run portage from the system_cronjob_t domain.

Signed-off-by Sven Vermeulen <[email protected]>

---
 policy/modules/services/cron.te |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)

policy/modules/services/cron.te +4 -0

index f22d27c..5ba27b7 100644
@@ -472,6 +472,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	portage_run(system_cronjob_t, system_r)
+')
+
+optional_policy(`
 	postfix_read_config(system_cronjob_t)
 ')

Signature · 1 line

1.7.3.4

Christopher J. PeBenito

2011-08-25 11:36 UTC #17 lore raw

PATCH 10/11 Allow cron to execute portage commands

Quoted 14 lines · Sven Vermeulen

Many users use portage from within cron (for instance to update the portage tree or even automatically update their system). As such, we allow to run portage from the system_cronjob_t domain.
Signed-off-by Sven Vermeulen <[email protected]>
---
 policy/modules/services/cron.te |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)
policy/modules/services/cron.te +0 -0
index f22d27c..5ba27b7 100644

policy/modules/services/cron.te optional_policy(` · line 480

Quoted 9 lines

policy/modules/services/cron.te +4 -0

@@ -472,6 +472,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	portage_run(system_cronjob_t, system_r)
+')
+
+optional_policy(`
 	postfix_read_config(system_cronjob_t)
 ')

This should be cron_system_entry() in portage.te.

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

Sven Vermeulen

author

2011-08-23 13:46 UTC #18 lore raw

PATCH v2 11/11 Allow portage to call GnuPG

In reply to Sven Vermeulen

Allow the portage domain to transition to the gpg_t domain (used for instance when validating signed manifests)

Signed-off-by Sven Vermeulen <[email protected]>

---
 policy/modules/admin/portage.te |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)

policy/modules/admin/portage.te +4 -0

index beeeb81..af2d00e 100644
@@ -192,6 +192,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	gpg_domtrans(portage_t)
+')
+
+optional_policy(`
 	modutils_domtrans_depmod(portage_t)
 	modutils_domtrans_update_mods(portage_t)
 	#dontaudit update_modules_t portage_tmp_t:dir search_dir_perms;

Signature · 1 line

1.7.3.4

Christopher J. PeBenito

2011-08-25 11:37 UTC #19 lore raw

PATCH 11/11 Allow portage to call GnuPG

Quoted 13 lines · Sven Vermeulen

Allow the portage domain to transition to the gpg_t domain (used for instance when validating signed manifests)
Signed-off-by Sven Vermeulen <[email protected]>
---
 policy/modules/admin/portage.te |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)
policy/modules/admin/portage.te +0 -0
index beeeb81..af2d00e 100644

policy/modules/admin/portage.te optional_policy(` · line 201

Quoted 10 lines

policy/modules/admin/portage.te +4 -0

@@ -192,6 +192,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	gpg_domtrans(portage_t)
+')
+
+optional_policy(`
 	modutils_domtrans_depmod(portage_t)
 	modutils_domtrans_update_mods(portage_t)
 	#dontaudit update_modules_t portage_tmp_t:dir search_dir_perms;

Is this really necessary? Gpg_t is oriented towards users; gpg_exec() doesn't work?

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com