Separate domtrans/run interfaces for portage_fetch
v2 cover Separate domtrans/run interfaces for portage_fetch
This revised patchset updates the portage interfaces to support portage_run_fetch and portage_domtrans_fetch, rather than including the support for portage_fetch_t in the regular portage_run and portage_domtrans interfaces.
I'm not sure how to best "mix" changes across refpolicy and refpolicy::contrib. If the patches are not correctly made, this was what I did:
- Make changes in contrib, then format-patch to generate patches
- Make changes in refpolicy, then format-patch to generate patches
I notice that git also supports "adding" the commits from contrib to the patches in the main refpolicy, but I'm not sure that's the idea behind it for refpolicy.
Changes since v1
----------------
- Removes the portage_fetch_t calls from portage_domtrans and portage_run
- Adds callers for portage_fetch_t (sysadm, unconfined and puppet for now)
PATCH v2 1/4 Separate domtrans/run interfaces for portage_fetch
Since the introduction of the portage_fetch_t domain, access to the domain was governed through the portage_domtrans and portage_run interfaces. To support calling portage only (but no fetch domain) or vice versa, the interfaces need to be split up.
In this patch, we introduce the interfaces portage_domtrans_fetch and portage_run_fetch which will be used later in the domains that need to call portage/layman/emerge-webrsync/...
The portage_domtrans and portage_run interfaces are updated not to include anything for portage_fetch_t anymore.
--- portage.if | 57 ++++++++++++++++++++++++++++++++++++++++++++++++++++----- 1 files changed, 52 insertions(+), 5 deletions(-)
portage.if +52 -5
@@ -16,15 +16,12 @@ interface(`portage_domtrans',` gen_require(` type portage_t, portage_exec_t; - type portage_fetch_t, portage_fetch_exec_t; ') files_search_usr($1) corecmd_search_bin($1) - # transition to portage domtrans_pattern($1, portage_exec_t, portage_t) - domtrans_pattern($1, portage_fetch_exec_t, portage_fetch_t) ') ########################################
@@ -46,11 +43,11 @@ interface(`portage_domtrans',` # interface(`portage_run',` gen_require(` - type portage_t, portage_fetch_t, portage_sandbox_t; + type portage_t, portage_sandbox_t; ') portage_domtrans($1) - role $2 types { portage_t portage_fetch_t portage_sandbox_t }; + role $2 types { portage_t portage_sandbox_t }; ') ########################################
@@ -213,6 +210,56 @@ interface(`portage_compile_domain',` ######################################## ## <summary> +## Execute tree management functions (fetching, layman, ...) +## in the portage_fetch_t domain. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed to transition. +## </summary> +## </param> +# +interface(`portage_domtrans_fetch',` + gen_require(` + type portage_fetch_t, portage_fetch_exec_t; + ') + + files_search_usr($1) + corecmd_search_bin($1) + + domtrans_pattern($1, portage_fetch_exec_t, portage_fetch_t) +') + +######################################## +## <summary> +## Execute tree management functions (fetching, layman, ...) +## in the portage_fetch_t domain, and allow the specified role +## the portage_fetch_t domain. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed to transition. +## </summary> +## </param> +## <param name="role"> +## <summary> +## The role to allow the portage_fetch domain. +## </summary> +## </param> +## <rolecap/> +# +interface(`portage_run_fetch',` + gen_require(` + type portage_fetch_t; + ') + + portage_domtrans_fetch($1) + role $2 types portage_fetch_t; +') + + +######################################## +## <summary> ## Execute gcc-config in the gcc_config domain. ## </summary> ## <param name="domain">
Signature · 1 line
1.7.3.4
PATCH v2 2/4 Allow puppet to call portage
In reply to Sven VermeulenPuppet is a configuration management and system management tool. Part of its job is to manage the package deployments on systems. As such, it needs the privilege to call and transition to the various portage domains.
--- puppet.te | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-)
puppet.te +6 -0
@@ -146,6 +146,12 @@ optional_policy(` ') optional_policy(` + portage_domtrans(puppet_t) + portage_domtrans_fetch(puppet_t) + portage_domtrans_gcc_config(puppet_t) +') + +optional_policy(` files_rw_var_files(puppet_t) rpm_domtrans(puppet_t)
Signature · 1 line
1.7.3.4
PATCH v2 3/4 Allow sysadm_t to call all portage related services
In reply to Sven VermeulenThe system administrator (in sysadm_t) is the only "user" domain that is allowed to call portage-related services. So it also gains the privilege to execute portage tree management functions (and as such transition to portage_fetch_t).
--- policy/modules/roles/sysadm.te | 1 + 1 files changed, 1 insertions(+), 0 deletions(-)
policy/modules/roles/sysadm.te +1 -0
@@ -253,6 +253,7 @@ optional_policy(` optional_policy(` portage_run(sysadm_t, sysadm_r) + portage_run_fetch(sysadm_t, sysadm_r) portage_run_gcc_config(sysadm_t, sysadm_r) ')
Signature · 1 line
1.7.3.4
PATCH v2 4/4 Allow unconfined users to call portage features
In reply to Sven VermeulenThe unconfined user is currently not allowed to call portage-related functions. However, in a targeted system (with unconfined domains enabled), users (including administrators) should be allowed to transition to the portage domain.
We position the portage-related calls outside the "ifdef(distro_gentoo)" as other distributions support Portage as well.
--- policy/modules/system/unconfined.te | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-)
policy/modules/system/unconfined.te +6 -0
@@ -150,6 +150,12 @@ optional_policy(` ') optional_policy(` + portage_run(unconfined_t, unconfined_r) + portage_run_fetch(unconfined_t, unconfined_r) + portage_run_gcc_config(unconfined_t, unconfined_r)A +') + +optional_policy(` prelink_run(unconfined_t, unconfined_r) ')
Signature · 1 line
1.7.3.4
PATCH v2 4/4 Allow unconfined users to call portage features
policy/modules/system/unconfined.te optional_policy(` · line 155
Quoted 11 lines · Sven Vermeulen
policy/modules/system/unconfined.te +3
-0@@ -150,6 +150,12 @@ optional_policy(` ') optional_policy(` + portage_run(unconfined_t, unconfined_r) + portage_run_fetch(unconfined_t, unconfined_r) + portage_run_gcc_config(unconfined_t, unconfined_r)A
You introduced an extra "A" here. I manually fixed it.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
v2 cover Separate domtrans/run interfaces for portage_fetch
In reply to Sven VermeulenQuoted 10 lines · Sven Vermeulen
This revised patchset updates the portage interfaces to support
portage_run_fetchandportage_domtrans_fetch, rather than including the support forportage_fetch_tin the regularportage_runandportage_domtransinterfaces.I'm not sure how to best "mix" changes across refpolicy and
refpolicy::contrib. If the patches are not correctly made, this was what I did:
- Make changes in contrib, then format-patch to generate patches
- Make changes in refpolicy, then format-patch to generate patches
I'm not sure what the best way is either. The way you did it is fine.
Quoted 9 lines
I notice that git also supports "adding" the commits from contrib to the patches in the main refpolicy, but I'm not sure that's the idea behind it for refpolicy.
Changes since v1
----------------- Removes the
portage_fetch_tcalls fromportage_domtransandportage_run
- Adds callers forportage_fetch_t(sysadm, unconfined and puppet for now)
Merged.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com