Introduce mutt policy
v2 cover Introduce mutt policy
lease find in the following e-mails an initial policy for the mutt application (terminal e-mail client). The set of mails contains:
- the mutt definition (.te, .if, .fc)
- adding mutt_role to unprivuser, staff and sysadm
- update gpg.te to grant it rw access to mutt's tmp files
Wrt to the previous attempt, the patch tackled most of the received comments (only the introduction of mutt_gpg_t as in Dominick's definition is withheld since I can't test it out here).
Wkr,
Sven Vermeulen
PATCH v2 1/3 Initial policy for the mutt e-mail client
The mutt e-mail client is a terminal-based e-mail client. It is rich in features (with many additional feature-patches lurking on the internet) so it is assumed that this policy will grow in the future.
--- mutt.fc | 10 ++++++ mutt.if | 68 ++++++++++++++++++++++++++++++++++++++++++ mutt.te | 100 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 178 insertions(+), 0 deletions(-) create mode 100644 mutt.fc create mode 100644 mutt.if create mode 100644 mutt.te
mutt.fc new file +10 -0
@@ -0,0 +1,10 @@ +HOME_DIR/\.mutt(/.*)? gen_context(system_u:object_r:mutt_home_t,s0) +HOME_DIR/\.muttrc -- gen_context(system_u:object_r:mutt_conf_t,s0) +HOME_DIR/\.mutt_cache -- gen_context(system_u:object_r:mutt_home_t,s0) +HOME_DIR/\.mutt_certificates -- gen_context(system_u:object_r:mutt_home_t,s0) + +/etc/Muttrc -- gen_context(system_u:object_r:mutt_etc_t,s0) +/etc/Muttrc\.local -- gen_context(system_u:object_r:mutt_etc_t,s0) +/etc/mutt(/.*)? gen_context(system_u:object_r:mutt_etc_t,s0) + +/usr/bin/mutt -- gen_context(system_u:object_r:mutt_exec_t,s0)
mutt.if new file +68 -0
68 lines not on this page · raw message
mutt.te new file +100 -0
100 lines not on this page · raw message
Signature · 1 line
1.7.3.4
PATCH v2 1/3 Initial policy for the mutt e-mail client
Quoted 36 lines · Sven Vermeulen
mutt.if new file +30
-0@@ -0,0 +1,68 @@ +## <summary>Mutt e-mail client</summary> + +####################################### +## <summary> +## The role for using the mutt application. +## </summary> +## <param name="role"> +## <summary> +## The role associated with the user domain. +## </summary> +## </param> +## <param name="domain"> +## <summary> +## The user domain. +## </summary> +## </param> +# +interface(`mutt_role',` + gen_require(` + type mutt_t, mutt_exec_t, mutt_home_t, mutt_conf_t, mutt_etc_t; + type mutt_tmp_t; + ') + + role $1 types mutt_t; + + domtrans_pattern($2, mutt_exec_t, mutt_t) + + allow $2 mutt_t:process { ptrace signal_perms }; + + manage_dirs_pattern($2, mutt_home_t, mutt_home_t)
mutt.if line 40
Quoted 10 lines
mutt.if new file +10
-0+ manage_files_pattern($2, mutt_home_t, mutt_home_t) + + manage_dirs_pattern($2, mutt_conf_t, mutt_conf_t) + manage_files_pattern($2, mutt_conf_t, mutt_conf_t) + + relabel_dirs_pattern($2, mutt_home_t, mutt_home_t) + relabel_files_pattern($2, mutt_home_t, mutt_home_t) + + relabel_dirs_pattern($2, mutt_conf_t, mutt_conf_t) + relabel_files_pattern($2, mutt_conf_t, mutt_conf_t)
This should be ordered by the type names, rather than the pattern name.
Quoted 54 lines
mutt.if new file +27
-0+ relabel_dirs_pattern($2, mutt_tmp_t, mutt_tmp_t) + relabel_files_pattern($2, mutt_tmp_t, mutt_tmp_t) + + ps_process_pattern($2, mutt_t) +') + +####################################### +## <summary> +## Allow other domains to handle mutt's temporary files (used for instance +## for e-mail drafts) +## </summary> +## <param name="domain"> +## <summary> +## The domain that is allowed read/write access to the temporary files +## </summary> +## </param> +# +interface(`mutt_rw_tmp_files',` + gen_require(` + type mutt_tmp_t; + ') + + # The use of rw_files_pattern here is not needed, since this incurs the open privilege as well + allow $1 mutt_tmp_t:dir search_dir_perms; + allow $1 mutt_tmp_t:file { read write }; + files_search_tmp($1) +')mutt.te new file +21
-0@@ -0,0 +1,100 @@ +policy_module(mutt, 1.0.0) + +############################ +# +# Declarations +# + +## <desc> +## <p> +## Be able to manage user files (needed to support attachment handling) +## </p> +## </desc> +gen_tunable(mutt_manage_user_content, false) + +type mutt_t; +type mutt_exec_t; +application_domain(mutt_t, mutt_exec_t) +ubac_constrained(mutt_t) + +type mutt_conf_t; +userdom_user_home_content(mutt_conf_t)
mutt.te line 31
Quoted 10 lines
mutt.te new file +10
-0+ +type mutt_etc_t; +files_config_file(mutt_etc_t) + +type mutt_home_t; +userdom_user_home_content(mutt_home_t) + +type mutt_tmp_t; +files_tmp_file(mutt_tmp_t) +ubac_constrained(mutt_tmp_t)
I put in a new userdom interface that replaces the above two calls.
Quoted 11 lines
mutt.te new file +11
-0+############################ +# +# Local Policy Rules +# + +allow mutt_t self:process signal_perms; +allow mutt_t self:fifo_file rw_fifo_file_perms; + +manage_dirs_pattern(mutt_t, mutt_home_t, mutt_home_t) +manage_files_pattern(mutt_t, mutt_home_t, mutt_home_t) +userdom_user_home_dir_filetrans(mutt_t, mutt_home_t, { dir file })
mutt.te line 53
Quoted 10 lines
mutt.te new file +10
-0+ +manage_dirs_pattern(mutt_t, mutt_tmp_t, mutt_tmp_t) +manage_files_pattern(mutt_t, mutt_tmp_t, mutt_tmp_t) +files_tmp_filetrans(mutt_t, mutt_tmp_t, { file dir }) + +read_files_pattern(mutt_t, mutt_etc_t, mutt_etc_t) + +read_files_pattern(mutt_t, mutt_conf_t, mutt_conf_t) + +
Extra whitespace, and out of order rules above.
Quoted 37 lines
mutt.te new file +37
-0+kernel_read_system_state(mutt_t) + +corecmd_exec_bin(mutt_t) +corecmd_exec_shell(mutt_t) + +corenet_all_recvfrom_netlabel(mutt_t) +corenet_all_recvfrom_unlabeled(mutt_t) +corenet_sendrecv_pop_client_packets(mutt_t) +corenet_sendrecv_smtp_client_packets(mutt_t) +corenet_tcp_bind_generic_node(mutt_t) +corenet_tcp_connect_pop_port(mutt_t) +corenet_tcp_connect_smtp_port(mutt_t) +corenet_tcp_sendrecv_generic_if(mutt_t) +corenet_tcp_sendrecv_generic_node(mutt_t) +corenet_tcp_sendrecv_pop_port(mutt_t) +corenet_tcp_sendrecv_smtp_port(mutt_t) + +dev_read_rand(mutt_t) +dev_read_urand(mutt_t) + +domain_use_interactive_fds(mutt_t) + +files_read_usr_files(mutt_t) + + +auth_use_nsswitch(mutt_t) + +miscfiles_read_localization(mutt_t) + +userdom_manage_xdg_cache_home(mutt_t) +userdom_read_xdg_config_home(mutt_t) +userdom_search_user_home_content(mutt_t) +userdom_use_user_terminals(mutt_t) + +optional_policy(` + gpg_domtrans(mutt_t) +')
mutt.te line 100
Quoted 10 lines
mutt.te new file +10
-0+ +tunable_policy(`mutt_manage_user_content',` + # Needed for handling attachments + userdom_manage_user_home_content_files(mutt_t) + userdom_manage_user_home_content_dirs(mutt_t) +') + +tunable_policy(`gentoo_try_dontaudit',` + kernel_dontaudit_search_sysctl(mutt_t) +')
Please remove the test rules.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH v2 2/3 Allow gpg to read/write mutt e-mail files (for signing)
In reply to Sven VermeulenThe mutt e-mail files are stored as mutt_tmp_t. As such, gpg needs to be able to read/write to mutt_tmp_t.
--- gpg.te | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-)
gpg.te +4 -0
@@ -147,6 +147,10 @@ optional_policy(` ') optional_policy(` + mutt_rw_tmp_files(gpg_t) +') + +optional_policy(` xserver_use_xdm_fds(gpg_t) xserver_rw_xdm_pipes(gpg_t) ')
Signature · 1 line
1.7.3.4
PATCH v2 3/3 Allow users, staff and sysadm to use mutt
In reply to Sven VermeulenAllow the end user domains to use the mutt application.
--- policy/modules/roles/staff.te | 4 ++++ policy/modules/roles/sysadm.te | 4 ++++ policy/modules/roles/unprivuser.te | 4 ++++ 3 files changed, 12 insertions(+), 0 deletions(-)
policy/modules/roles/staff.te +4 -0
@@ -129,6 +129,10 @@ ifndef(`distro_redhat',` ') optional_policy(` + mutt_role(staff_r, staff_t) + ') + + optional_policy(` pyzor_role(staff_r, staff_t) ')
policy/modules/roles/sysadm.te +4 -0
@@ -461,5 +461,9 @@ ifndef(`distro_redhat',` optional_policy(` java_role(sysadm_r, sysadm_t) ') + + optional_policy(` + mutt_role(sysadm_r, sysadm_t) + ') ')
policy/modules/roles/unprivuser.te +4 -0
@@ -106,6 +106,10 @@ ifndef(`distro_redhat',` ') optional_policy(` + mutt_role(user_r, user_t) + ') + + optional_policy(` postgresql_role(user_r, user_t) ')
Signature · 1 line
1.7.3.4
PATCH v2 3/3 Allow users, staff and sysadm to use mutt
policy/modules/roles/sysadm.te ifndef(`distro_redhat',` · line 468
Quoted 13 lines · Sven Vermeulen
policy/modules/roles/sysadm.te +4
-0@@ -461,5 +461,9 @@ ifndef(`distro_redhat',` optional_policy(` java_role(sysadm_r, sysadm_t) ') + + optional_policy(` + mutt_role(sysadm_r, sysadm_t) + ') ')
Does sysadm really need this? They should be using their staff role for that.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH v2 3/3 Allow users, staff and sysadm to use mutt
Quoted 16 lines · Christopher J. PeBenito
policy/modules/roles/sysadm.te ifndef(`distro_redhat',` · line 468
Quoted 13 lines · Sven Vermeulen
policy/modules/roles/sysadm.te +4
-0@@ -461,5 +461,9 @@ ifndef(`distro_redhat',` optional_policy(` java_role(sysadm_r, sysadm_t) ') + + optional_policy(` + mutt_role(sysadm_r, sysadm_t) + ') ')Does sysadm really need this? They should be using their staff role for that.
Need? Perhaps not (or not in a reference policy). I "need" it when I log on as root directly (which here means the SELinux root user which is immediately on the sysadm_r role) and need to read the local (system-generated) mails.
But I might be just too lazy to newrole here towards staff_r.
I'll drop it from the patch set.
Wkr,
Sven Vermeulen