Numerous dontaudits

PATCH New Sven Vermeulen 2 participants 29 messages Mar 22, 2012 – Apr 23, 2012

Share & tools

Sven Vermeulen

author

2012-03-22 20:02 UTC #0 lore raw

cover Numerous dontaudits

This set includes quite a few dontaudit updates on the policy that we have running in Gentoo since the 20110726 policies and without feedback from users that they are incorrect or that I'm missing something.

Now handling dontaudits isn't easy, it's often much easier to find out why you need to allow something (as the application otherwise breaks) whereas finding denials that do not seem to have any influence on the system is a lot harder to pin down.

But still, I guess it's okay to bring out these dontaudits in refpolicy; either others can find flaws or confirm that they too dontaudit these settings.

Sven Vermeulen

author

2012-03-22 20:06 UTC #1 lore raw

PATCH 1/13 Adding dontaudit interfaces for files module

Signed-off-by Sven Vermeulen <[email protected]>

---
 policy/modules/kernel/files.if |   36 ++++++++++++++++++++++++++++++++++++
 1 files changed, 36 insertions(+), 0 deletions(-)

policy/modules/kernel/files.if +36 -0

index deb24b4..7df46ac 100644
@@ -1482,6 +1482,42 @@ interface(`files_dontaudit_list_all_mountpoints',`
 
 ########################################
 ## <summary>
+##     Do not audit write attempts on mount points.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain to ignore write attempts from
+##     </summary>
+## </param>
+#
+interface(`files_dontaudit_write_all_mountpoints',`
+	gen_require(`
+		attribute mountpoint;
+	')
+       
+	dontaudit $1 mountpoint:dir write;
+')     
+
+########################################
+## <summary>
+##     Do not audit setattr attempts on mount points.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain to ignore setattr attempts from
+##     </summary>
+## </param>
+#
+interface(`files_dontaudit_setattr_all_mountpoints',`
+	gen_require(`
+		attribute mountpoint;
+	')
+
+	dontaudit $1 mountpoint:dir setattr;
+')
+
+########################################
+## <summary>
 ##	List the contents of the root directory.
 ## </summary>
 ## <param name="domain">

Signature · 1 line

1.7.3.4

Christopher J. PeBenito

2012-04-20 20:10 UTC #2 lore raw

PATCH 1/13 Adding dontaudit interfaces for files module

Quoted 5 lines · Sven Vermeulen

Signed-off-by Sven Vermeulen <[email protected]>

---
 policy/modules/kernel/files.if |   36 ++++++++++++++++++++++++++++++++++++
 1 files changed, 36 insertions(+), 0 deletions(-)

Merged. There were whitespace errors, please be mindful. Moved the dontaudit_setattr up in the file.

Quoted 47 lines

policy/modules/kernel/files.if +36 -0

index deb24b4..7df46ac 100644
@@ -1482,6 +1482,42 @@ interface(`files_dontaudit_list_all_mountpoints',`
 
 ########################################
 ## <summary>
+##     Do not audit write attempts on mount points.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain to ignore write attempts from
+##     </summary>
+## </param>
+#
+interface(`files_dontaudit_write_all_mountpoints',`
+	gen_require(`
+		attribute mountpoint;
+	')
+       
+	dontaudit $1 mountpoint:dir write;
+')     
+
+########################################
+## <summary>
+##     Do not audit setattr attempts on mount points.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain to ignore setattr attempts from
+##     </summary>
+## </param>
+#
+interface(`files_dontaudit_setattr_all_mountpoints',`
+	gen_require(`
+		attribute mountpoint;
+	')
+
+	dontaudit $1 mountpoint:dir setattr;
+')
+
+########################################
+## <summary>
 ##	List the contents of the root directory.
 ## </summary>
 ## <param name="domain">

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

Sven Vermeulen

author

2012-03-22 20:07 UTC #3 lore raw

PATCH 2/13 Adding dontaudit on mozilla

In reply to Sven Vermeulen

Signed-off-by Sven Vermeulen <[email protected]>

---
 mozilla.te |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

mozilla.te +1 -0

index d3510c2..7bb89fe 100644
@@ -148,6 +148,7 @@ files_read_var_files(mozilla_t)
 files_read_var_symlinks(mozilla_t)
 files_dontaudit_getattr_boot_dirs(mozilla_t)
 
+fs_dontaudit_getattr_all_fs(mozilla_t)
 fs_search_auto_mountpoints(mozilla_t)
 fs_list_inotifyfs(mozilla_t)
 fs_rw_tmpfs_files(mozilla_t)

Signature · 1 line

1.7.3.4

Christopher J. PeBenito

2012-04-20 20:12 UTC #4 lore raw

PATCH 2/13 Adding dontaudit on mozilla

Quoted 11 lines · Sven Vermeulen

Signed-off-by Sven Vermeulen <[email protected]>
---
 mozilla.te |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)
mozilla.te +0 -0
index d3510c2..7bb89fe 100644

mozilla.te files_read_var_files(mozilla_t) · line 154

Quoted 7 lines

mozilla.te +1 -0

@@ -148,6 +148,7 @@ files_read_var_files(mozilla_t)
 files_read_var_symlinks(mozilla_t)
 files_dontaudit_getattr_boot_dirs(mozilla_t)
 
+fs_dontaudit_getattr_all_fs(mozilla_t)
 fs_search_auto_mountpoints(mozilla_t)
 fs_list_inotifyfs(mozilla_t)
 fs_rw_tmpfs_files(mozilla_t)

Merged.

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

Sven Vermeulen

author

2012-03-22 20:08 UTC #5 lore raw

PATCH 3/13 Adding dontaudit on mta

In reply to Sven Vermeulen

Signed-off-by Sven Vermeulen <[email protected]>

---
 mta.if |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

mta.if +2 -0

index 343cee3..509bcea 100644
@@ -174,6 +174,8 @@ interface(`mta_role',`
 	allow mta_user_agent $2:fd use;
 	allow mta_user_agent $2:process sigchld;
 	allow mta_user_agent $2:fifo_file { read write };
+
+	dontaudit mta_user_agent $1:unix_stream_socket rw_socket_perms;
 ')
 
 ########################################

Signature · 1 line

1.7.3.4

Christopher J. PeBenito

2012-04-20 20:10 UTC #6 lore raw

PATCH 3/13 Adding dontaudit on mta

Quoted 11 lines · Sven Vermeulen

Signed-off-by Sven Vermeulen <[email protected]>
---
 mta.if |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)
mta.if +0 -0
index 343cee3..509bcea 100644

mta.if interface(`mta_role',` · line 181

Quoted 8 lines

mta.if +2 -0

@@ -174,6 +174,8 @@ interface(`mta_role',`
 	allow mta_user_agent $2:fd use;
 	allow mta_user_agent $2:process sigchld;
 	allow mta_user_agent $2:fifo_file { read write };
+
+	dontaudit mta_user_agent $1:unix_stream_socket rw_socket_perms;
 ')
 
 ########################################

Does not work. $1 is a role.

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

Sven Vermeulen

author

2012-03-22 20:08 UTC #7 lore raw

PATCH 4/13 Adding dontaudits for portage domains

In reply to Sven Vermeulen

Signed-off-by Sven Vermeulen <[email protected]>

---
 portage.te |    6 ++++++
 1 files changed, 6 insertions(+), 0 deletions(-)

portage.te +6 -0

index 4735035..88eac51 100644
@@ -146,6 +146,8 @@ optional_policy(`
 allow portage_t self:process { setfscreate setexec };
 # - kill for mysql merging, at least
 allow portage_t self:capability { sys_nice kill setfcap };
+dontaudit portage_t self:capability { dac_read_search };
+dontaudit portage_t self:netlink_route_socket rw_netlink_socket_perms;
 
 # user post-sync scripts
 can_exec(portage_t, portage_conf_t)

@@ -161,6 +163,7 @@ rsync_entry_domtrans(portage_t, portage_fetch_t)
 allow portage_fetch_t portage_t:fd use;
 allow portage_fetch_t portage_t:fifo_file rw_file_perms;
 allow portage_fetch_t portage_t:process sigchld;
+dontaudit portage_fetch_t portage_devpts_t:chr_file { read write };
 
 # transition to sandbox for compiling
 domain_trans(portage_t, portage_exec_t, portage_sandbox_t)

@@ -169,10 +172,12 @@ allow portage_sandbox_t portage_t:fd use;
 allow portage_sandbox_t portage_t:fifo_file rw_file_perms;
 allow portage_sandbox_t portage_t:process sigchld;
 allow portage_sandbox_t self:process ptrace;
+dontaudit portage_sandbox_t self:netlink_route_socket rw_netlink_socket_perms;
 
 # run scripts out of the build directory
 can_exec(portage_t, portage_tmp_t)
 
+kernel_dontaudit_request_load_module(portage_t)
 # merging baselayout will need this:
 kernel_write_proc_files(portage_t)

@@ -288,6 +293,7 @@ files_search_var_lib(portage_fetch_t)
 files_dontaudit_search_pids(portage_fetch_t)
 
 logging_list_logs(portage_fetch_t)
+logging_dontaudit_search_logs(portage_fetch_t)
 
 term_search_ptys(portage_fetch_t)

Signature · 1 line

1.7.3.4

Christopher J. PeBenito

2012-04-20 20:12 UTC #8 lore raw

PATCH 4/13 Adding dontaudits for portage domains

Quoted 5 lines · Sven Vermeulen

Signed-off-by Sven Vermeulen <[email protected]>
---
 portage.te |    6 ++++++
 1 files changed, 6 insertions(+), 0 deletions(-)

Merged.

Quoted 42 lines

portage.te +6 -0

index 4735035..88eac51 100644
@@ -146,6 +146,8 @@ optional_policy(`
 allow portage_t self:process { setfscreate setexec };
 # - kill for mysql merging, at least
 allow portage_t self:capability { sys_nice kill setfcap };
+dontaudit portage_t self:capability { dac_read_search };
+dontaudit portage_t self:netlink_route_socket rw_netlink_socket_perms;
 
 # user post-sync scripts
 can_exec(portage_t, portage_conf_t)

@@ -161,6 +163,7 @@ rsync_entry_domtrans(portage_t, portage_fetch_t)
 allow portage_fetch_t portage_t:fd use;
 allow portage_fetch_t portage_t:fifo_file rw_file_perms;
 allow portage_fetch_t portage_t:process sigchld;
+dontaudit portage_fetch_t portage_devpts_t:chr_file { read write };
 
 # transition to sandbox for compiling
 domain_trans(portage_t, portage_exec_t, portage_sandbox_t)

@@ -169,10 +172,12 @@ allow portage_sandbox_t portage_t:fd use;
 allow portage_sandbox_t portage_t:fifo_file rw_file_perms;
 allow portage_sandbox_t portage_t:process sigchld;
 allow portage_sandbox_t self:process ptrace;
+dontaudit portage_sandbox_t self:netlink_route_socket rw_netlink_socket_perms;
 
 # run scripts out of the build directory
 can_exec(portage_t, portage_tmp_t)
 
+kernel_dontaudit_request_load_module(portage_t)
 # merging baselayout will need this:
 kernel_write_proc_files(portage_t)

@@ -288,6 +293,7 @@ files_search_var_lib(portage_fetch_t)
 files_dontaudit_search_pids(portage_fetch_t)
 
 logging_list_logs(portage_fetch_t)
+logging_dontaudit_search_logs(portage_fetch_t)
 
 term_search_ptys(portage_fetch_t)

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

Sven Vermeulen

author

2012-03-22 20:09 UTC #9 lore raw

PATCH 5/6 Adding dontaudit for qemu

In reply to Sven Vermeulen

Signed-off-by Sven Vermeulen <[email protected]>

---
 qemu.te |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

qemu.te +1 -0

index 9cf9992..a75f91a 100644
@@ -49,6 +49,7 @@ role system_r types qemu_t;
 #
 # qemu local policy
 #
+dontaudit qemu_t self:socket create;
 
 storage_raw_write_removable_device(qemu_t)
 storage_raw_read_removable_device(qemu_t)

Signature · 1 line

1.7.3.4

Christopher J. PeBenito

2012-04-20 20:12 UTC #10 lore raw

PATCH 5/6 Adding dontaudit for qemu

Quoted 11 lines · Sven Vermeulen

Signed-off-by Sven Vermeulen <[email protected]>
---
 qemu.te |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)
qemu.te +0 -0
index 9cf9992..a75f91a 100644

qemu.te role system_r types qemu_t; · line 55

Quoted 7 lines

qemu.te +1 -0

@@ -49,6 +49,7 @@ role system_r types qemu_t;
 #
 # qemu local policy
 #
+dontaudit qemu_t self:socket create;
 
 storage_raw_write_removable_device(qemu_t)
 storage_raw_read_removable_device(qemu_t)

I'm more interesting in finding out what kind of socket this is, so we can create an appropriate object class.

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

Sven Vermeulen

author

2012-04-21 16:12 UTC #11 lore raw

PATCH 5/6 Adding dontaudit for qemu

Quoted 3 lines · Christopher J. PeBenito

Quoted 1 line
+dontaudit qemu_t self:socket create;
I'm more interesting in finding out what kind of socket this is, so we can create an appropriate object class.

Ok, trying to figure that out now. No luck with just querying though:

Apr 21 17:53:04 hpl kernel: [90637.251881] type=1400

audit(1335023584.573:457): avc: granted { create } for pid=28083 comm="qemu-system-x86" scontext=staff_u:sysadm_r:qemu_t tcontext=staff_u:sysadm_r:qemu_t tclass=socket

Doesn't give much. An lsof shows:

# lsof -p 28083
qemu-syst 28083 swift    8u     unix 0x0000000000000000         0t0
80203 socket
qemu-syst 28083 swift    9u     unix 0x0000000000000000         0t0
80204 /tmp/vde.28083-00003

but I don't know how to find out more about this socket. It is related to qemu's VDE networking virtualization (if I drop the "-net vde,vlan=0" I don't get the attempt to create a socket) but doesn't seem to be necessary.

/tmp/vde.28083-00003 is of type vde_tmp_t (cfr. patch/RFC regarding VDE support sent a while ago)

If anyone know of a good resource that I can read on debugging sockets, I'd love to hear about it.

Wkr,
Sven Vermeulen

Christopher J. PeBenito

2012-04-23 12:28 UTC #12 lore raw

PATCH 5/6 Adding dontaudit for qemu

Quoted 26 lines · Sven Vermeulen

Quoted 3 lines · Christopher J. PeBenito
Quoted 1 line
+dontaudit qemu_t self:socket create;
I'm more interesting in finding out what kind of socket this is, so we can create an appropriate object class.
Ok, trying to figure that out now. No luck with just querying though:
Apr 21 17:53:04 hpl kernel: [90637.251881] type=1400
audit(1335023584.573:457): avc: granted { create } for pid=28083 comm="qemu-system-x86" scontext=staff_u:sysadm_r:qemu_t tcontext=staff_u:sysadm_r:qemu_t tclass=socket
Doesn't give much. An lsof shows:
# lsof -p 28083
qemu-syst 28083 swift    8u     unix 0x0000000000000000         0t0
80203 socket
qemu-syst 28083 swift    9u     unix 0x0000000000000000         0t0
80204 /tmp/vde.28083-00003
but I don't know how to find out more about this socket. It is related to qemu's VDE networking virtualization (if I drop the "-net vde,vlan=0" I don't get the attempt to create a socket) but doesn't seem to be necessary.

Quoted 5 lines

/tmp/vde.28083-00003 is of type vde_tmp_t (cfr. patch/RFC regarding VDE support sent a while ago)
If anyone know of a good resource that I can read on debugging sockets, I'd love to hear about it.

The audit subsystem's messages might be more useful. The last time something like this came around, I ended up looking at the code itself. It shouldn't be too bad to grep through the code for socket() calls and see what the socket domain/type is.

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

Sven Vermeulen

author

2012-03-22 20:10 UTC #13 lore raw

PATCH 6/13 Adding dontaudit interfaces in sysnet

In reply to Sven Vermeulen

Signed-off-by Sven Vermeulen <[email protected]>

---
 policy/modules/system/sysnetwork.if |   19 +++++++++++++++++++
 1 files changed, 19 insertions(+), 0 deletions(-)

policy/modules/system/sysnetwork.if +19 -0

index 363e98d..58a7d89 100644
@@ -66,6 +66,25 @@ interface(`sysnet_dontaudit_use_dhcpc_fds',`
 
 ########################################
 ## <summary>
+##	Do not audit attempts to read/write to the 
+##      dhcp unix stream socket descriptors.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`sysnet_dontaudit_rw_dhcpc_unix_stream_sockets',`
+	gen_require(`
+		type dhcpc_t;
+	')
+
+	dontaudit $1 dhcpc_t:unix_stream_socket { read write };
+')
+
+########################################
+## <summary>
 ##	Send a SIGCHLD signal to the dhcp client.
 ## </summary>
 ## <param name="domain">

Signature · 1 line

1.7.3.4

Christopher J. PeBenito

2012-04-20 20:11 UTC #14 lore raw

PATCH 6/13 Adding dontaudit interfaces in sysnet

Quoted 5 lines · Sven Vermeulen

Signed-off-by Sven Vermeulen <[email protected]>

---
 policy/modules/system/sysnetwork.if |   19 +++++++++++++++++++
 1 files changed, 19 insertions(+), 0 deletions(-)

Merged. Fixed whitespace.

Quoted 30 lines

policy/modules/system/sysnetwork.if +19 -0

index 363e98d..58a7d89 100644
@@ -66,6 +66,25 @@ interface(`sysnet_dontaudit_use_dhcpc_fds',`
 
 ########################################
 ## <summary>
+##	Do not audit attempts to read/write to the 
+##      dhcp unix stream socket descriptors.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`sysnet_dontaudit_rw_dhcpc_unix_stream_sockets',`
+	gen_require(`
+		type dhcpc_t;
+	')
+
+	dontaudit $1 dhcpc_t:unix_stream_socket { read write };
+')
+
+########################################
+## <summary>
 ##	Send a SIGCHLD signal to the dhcp client.
 ## </summary>
 ## <param name="domain">

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

Sven Vermeulen

author

2012-03-22 20:10 UTC #15 lore raw

PATCH 7/13 Adding dontaudits for xserver

In reply to Sven Vermeulen

Signed-off-by Sven Vermeulen <[email protected]>

---
 policy/modules/services/xserver.te |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

policy/modules/services/xserver.te +2 -0

index e92dddf..f5ffb79 100644
@@ -370,6 +370,8 @@ manage_files_pattern(xdm_t, xserver_log_t, xserver_log_t)
 manage_fifo_files_pattern(xdm_t, xserver_log_t, xserver_log_t)
 logging_log_filetrans(xdm_t, xserver_log_t, file)
 
+domain_dontaudit_search_all_domains_state(xserver_t)
+
 kernel_read_system_state(xdm_t)
 kernel_read_kernel_sysctls(xdm_t)
 kernel_read_net_sysctls(xdm_t)

Signature · 1 line

1.7.3.4

Christopher J. PeBenito

2012-04-20 20:11 UTC #16 lore raw

PATCH 7/13 Adding dontaudits for xserver

Quoted 11 lines · Sven Vermeulen

Signed-off-by Sven Vermeulen <[email protected]>
---
 policy/modules/services/xserver.te |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)
policy/modules/services/xserver.te +0 -0
index e92dddf..f5ffb79 100644

policy/modules/services/xserver.te manage_files_pattern(xdm_t, xserver_log_t, xserver_log_t) · line 377

Quoted 8 lines

policy/modules/services/xserver.te +2 -0

@@ -370,6 +370,8 @@ manage_files_pattern(xdm_t, xserver_log_t, xserver_log_t)
 manage_fifo_files_pattern(xdm_t, xserver_log_t, xserver_log_t)
 logging_log_filetrans(xdm_t, xserver_log_t, file)
 
+domain_dontaudit_search_all_domains_state(xserver_t)
+
 kernel_read_system_state(xdm_t)
 kernel_read_kernel_sysctls(xdm_t)
 kernel_read_net_sysctls(xdm_t)

This is in xdm_t's section. It it supposed to be xdm_t or is it supposed to be xserver_t? In either case, it needs to move.

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

Sven Vermeulen

author

2012-03-22 20:11 UTC #17 lore raw

PATCH 8/13 Do not audit usage of a leaked file descriptor

In reply to Sven Vermeulen

Signed-off-by Sven Vermeulen <[email protected]>

---
 dbus.if |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

dbus.if +2 -0

index 1a1becd..fb4bf82 100644
@@ -218,6 +218,8 @@ interface(`dbus_session_bus_client',`
 
 	# For connecting to the bus
 	allow $1 session_bus_type:unix_stream_socket connectto;
+
+	dontaudit $1 session_bus_type:fd use;
 ')
 
 ########################################

Signature · 1 line

1.7.3.4

Christopher J. PeBenito

2012-04-20 20:12 UTC #18 lore raw

PATCH 8/13 Do not audit usage of a leaked file descriptor

Quoted 11 lines · Sven Vermeulen

Signed-off-by Sven Vermeulen <[email protected]>
---
 dbus.if |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)
dbus.if +0 -0
index 1a1becd..fb4bf82 100644

dbus.if interface(`dbus_session_bus_client',` · line 225

Quoted 8 lines

dbus.if +2 -0

@@ -218,6 +218,8 @@ interface(`dbus_session_bus_client',`
 
 	# For connecting to the bus
 	allow $1 session_bus_type:unix_stream_socket connectto;
+
+	dontaudit $1 session_bus_type:fd use;
 ')
 
 ########################################

Merged.

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

Sven Vermeulen

author

2012-03-22 20:12 UTC #19 lore raw

PATCH 9/13 Do not audit rw on dhcp client unix_stream_sockets

In reply to Sven Vermeulen

Signed-off-by Sven Vermeulen <[email protected]>

---
 policy/modules/system/hostname.te |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

policy/modules/system/hostname.te +1 -0

index c310775..5307361 100644
@@ -51,6 +51,7 @@ logging_send_syslog_msg(hostname_t)
 
 miscfiles_read_localization(hostname_t)
 
+sysnet_dontaudit_rw_dhcpc_unix_stream_sockets(hostname_t)
 sysnet_read_config(hostname_t)
 sysnet_dns_name_resolve(hostname_t)

Signature · 1 line

1.7.3.4

Christopher J. PeBenito

2012-04-20 20:11 UTC #20 lore raw

PATCH 9/13 Do not audit rw on dhcp client unix_stream_sockets

Quoted 11 lines · Sven Vermeulen

Signed-off-by Sven Vermeulen <[email protected]>
---
 policy/modules/system/hostname.te |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)
policy/modules/system/hostname.te +0 -0
index c310775..5307361 100644

policy/modules/system/hostname.te logging_send_syslog_msg(hostname_t) · line 56

Quoted 6 lines

policy/modules/system/hostname.te +1 -0

@@ -51,6 +51,7 @@ logging_send_syslog_msg(hostname_t)
 
 miscfiles_read_localization(hostname_t)
 
+sysnet_dontaudit_rw_dhcpc_unix_stream_sockets(hostname_t)
 sysnet_read_config(hostname_t)
 sysnet_dns_name_resolve(hostname_t)

Merged.

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

Sven Vermeulen

author

2012-03-22 20:12 UTC #21 lore raw

PATCH 10/13 Adding dontaudits for mount

In reply to Sven Vermeulen

Signed-off-by Sven Vermeulen <[email protected]>

---
 policy/modules/system/mount.te |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)

policy/modules/system/mount.te +3 -1

index fba350b..57c2a00 100644
@@ -89,7 +89,8 @@ files_read_isid_type_files(mount_t)
 # For reading cert files
 files_read_usr_files(mount_t)
 files_list_mnt(mount_t)
-files_dontaudit_write_root_dirs(mount_t)
+files_dontaudit_write_all_mountpoints(mount_t)
+files_dontaudit_setattr_all_mountpoints(mount_t)
 
 fs_getattr_xattr_fs(mount_t)
 fs_getattr_cifs(mount_t)

@@ -113,6 +114,7 @@ storage_raw_read_removable_device(mount_t)
 storage_raw_write_removable_device(mount_t)
 
 term_use_all_terms(mount_t)
+term_dontaudit_manage_pty_dirs(mount_t)
 
 auth_use_nsswitch(mount_t)

Signature · 1 line

1.7.3.4

Christopher J. PeBenito

2012-04-20 20:12 UTC #22 lore raw

PATCH 10/13 Adding dontaudits for mount

Quoted 21 lines · Sven Vermeulen

Signed-off-by Sven Vermeulen <[email protected]>

---
 policy/modules/system/mount.te |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)

policy/modules/system/mount.te +2 -1

index fba350b..57c2a00 100644
@@ -89,7 +89,8 @@ files_read_isid_type_files(mount_t)
 # For reading cert files
 files_read_usr_files(mount_t)
 files_list_mnt(mount_t)
-files_dontaudit_write_root_dirs(mount_t)
+files_dontaudit_write_all_mountpoints(mount_t)
+files_dontaudit_setattr_all_mountpoints(mount_t)
 
 fs_getattr_xattr_fs(mount_t)
 fs_getattr_cifs(mount_t)

policy/modules/system/mount.te storage_raw_read_removable_device(mount_t) · line 119

Quoted 6 lines

policy/modules/system/mount.te +1 -0

@@ -113,6 +114,7 @@ storage_raw_read_removable_device(mount_t)
 storage_raw_write_removable_device(mount_t)
 
 term_use_all_terms(mount_t)
+term_dontaudit_manage_pty_dirs(mount_t)
 
 auth_use_nsswitch(mount_t)

Merged.

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

Sven Vermeulen

author

2012-03-22 20:13 UTC #23 lore raw

PATCH 11/13 Adding dontaudits for selinuxutil

In reply to Sven Vermeulen

Signed-off-by Sven Vermeulen <[email protected]>

---
 policy/modules/system/selinuxutil.te |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

policy/modules/system/selinuxutil.te +2 -0

index ab78aea..bc6e9b7 100644
@@ -234,6 +234,8 @@ allow newrole_t self:unix_dgram_socket sendto;
 allow newrole_t self:unix_stream_socket { create_stream_socket_perms connectto };
 allow newrole_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay };
 
+dontaudit newrole_t self:capability dac_read_search;
+
 read_files_pattern(newrole_t, default_context_t, default_context_t)
 read_lnk_files_pattern(newrole_t, default_context_t, default_context_t)

Signature · 1 line

1.7.3.4

Christopher J. PeBenito

2012-04-20 20:13 UTC #24 lore raw

PATCH 11/13 Adding dontaudits for selinuxutil

Quoted 11 lines · Sven Vermeulen

Signed-off-by Sven Vermeulen <[email protected]>
---
 policy/modules/system/selinuxutil.te |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)
policy/modules/system/selinuxutil.te +0 -0
index ab78aea..bc6e9b7 100644

policy/modules/system/selinuxutil.te allow newrole_t self:unix_dgram_socket sendto; · line 240

Quoted 7 lines

policy/modules/system/selinuxutil.te +2 -0

@@ -234,6 +234,8 @@ allow newrole_t self:unix_dgram_socket sendto;
 allow newrole_t self:unix_stream_socket { create_stream_socket_perms connectto };
 allow newrole_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay };
 
+dontaudit newrole_t self:capability dac_read_search;
+
 read_files_pattern(newrole_t, default_context_t, default_context_t)
 read_lnk_files_pattern(newrole_t, default_context_t, default_context_t)

On the fence with this one. It already has dac_override, which is a superset of dac_read_search.

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

Sven Vermeulen

author

2012-03-22 20:13 UTC #25 lore raw

PATCH 12/13 Adding dontaudit for sudo

In reply to Sven Vermeulen

Signed-off-by Sven Vermeulen <[email protected]>

---
 policy/modules/admin/sudo.if |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

policy/modules/admin/sudo.if +1 -0

index 6e1de7a..095a505 100644
@@ -136,6 +136,7 @@ template(`sudo_role_template',`
 	userdom_use_user_terminals($1_sudo_t)
 	# for some PAM modules and for cwd
 	userdom_dontaudit_search_user_home_content($1_sudo_t)
+	userdom_dontaudit_search_user_home_dirs($1_sudo_t)
 
 	ifdef(`hide_broken_symptoms', `
 		dontaudit $1_sudo_t $3:socket_class_set { read write };

Signature · 1 line

1.7.3.4

Christopher J. PeBenito

2012-04-20 20:13 UTC #26 lore raw

PATCH 12/13 Adding dontaudit for sudo

Quoted 11 lines · Sven Vermeulen

Signed-off-by Sven Vermeulen <[email protected]>
---
 policy/modules/admin/sudo.if |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)
policy/modules/admin/sudo.if +0 -0
index 6e1de7a..095a505 100644

policy/modules/admin/sudo.if template(`sudo_role_template',` · line 142

Quoted 7 lines

policy/modules/admin/sudo.if +1 -0

@@ -136,6 +136,7 @@ template(`sudo_role_template',`
 	userdom_use_user_terminals($1_sudo_t)
 	# for some PAM modules and for cwd
 	userdom_dontaudit_search_user_home_content($1_sudo_t)
+	userdom_dontaudit_search_user_home_dirs($1_sudo_t)
 
 	ifdef(`hide_broken_symptoms', `
 		dontaudit $1_sudo_t $3:socket_class_set { read write };

Merged.

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

Sven Vermeulen

author

2012-03-22 20:14 UTC #27 lore raw

PATCH 13/13 Adding dontaudits for raid

In reply to Sven Vermeulen

Signed-off-by Sven Vermeulen <[email protected]>

---
 raid.te |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

raid.te +2 -0

index 3fd46f7..458d42e 100644
@@ -57,6 +57,7 @@ domain_use_interactive_fds(mdadm_t)
 
 files_read_etc_files(mdadm_t)
 files_read_etc_runtime_files(mdadm_t)
+files_dontaudit_getattr_all_files(mdadm_t)
 
 fs_search_auto_mountpoints(mdadm_t)
 fs_dontaudit_list_tmpfs(mdadm_t)

@@ -70,6 +71,7 @@ storage_dev_filetrans_fixed_disk(mdadm_t)
 storage_read_scsi_generic(mdadm_t)
 
 term_dontaudit_list_ptys(mdadm_t)
+term_dontaudit_use_unallocated_ttys(mdadm_t)
 
 init_dontaudit_getattr_initctl(mdadm_t)

Signature · 1 line

1.7.3.4

Christopher J. PeBenito

2012-04-20 20:13 UTC #28 lore raw

PATCH 13/13 Adding dontaudits for raid

Quoted 5 lines · Sven Vermeulen

Signed-off-by Sven Vermeulen <[email protected]>
---
 raid.te |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

Merged.

Quoted 20 lines

raid.te +2 -0

index 3fd46f7..458d42e 100644
@@ -57,6 +57,7 @@ domain_use_interactive_fds(mdadm_t)
 
 files_read_etc_files(mdadm_t)
 files_read_etc_runtime_files(mdadm_t)
+files_dontaudit_getattr_all_files(mdadm_t)
 
 fs_search_auto_mountpoints(mdadm_t)
 fs_dontaudit_list_tmpfs(mdadm_t)

@@ -70,6 +71,7 @@ storage_dev_filetrans_fixed_disk(mdadm_t)
 storage_read_scsi_generic(mdadm_t)
 
 term_dontaudit_list_ptys(mdadm_t)
+term_dontaudit_use_unallocated_ttys(mdadm_t)
 
 init_dontaudit_getattr_initctl(mdadm_t)

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com