Skip to contentSkip to conversation

Updates for asterisk domain

PATCH New Sven Vermeulen 2 participants 11 messages Mar 26, 2012 – Apr 20, 2012

lore
Share & tools
lore

Sven Vermeulen

author
#0 lore raw

cover Updates for asterisk domain

The following set of patches updates the asterisk_t domain definition:

1. Add "chown" capability to asterisk domain
2. Allow asterisk to listen/accept on its control socket
3. Allow asterisk read access to /dev/random
4. Add interfaces to manage attributes of asterisk log and pid files
5. Allow initrc to manage asterisk log and pid files

Wkr,
Sven Vermeulen

author
#1 lore raw

PATCH 1/5 Allow asterisk to chown its own /var/run/asterisk directory

During startup, asterisk verifies the ownership of its run-directory and, if not set correctly, changes it accordingly.

Signed-off-by Sven Vermeulen <[email protected]>
---
 asterisk.te |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)
asterisk.te +1 -1
index 22d7cdf..c702879 100644
@@ -40,7 +40,7 @@ files_pid_file(asterisk_var_run_t)
 #
 
 # dac_override for /var/run/asterisk
-allow asterisk_t self:capability { dac_override setgid setuid sys_nice net_admin };
+allow asterisk_t self:capability { dac_override setgid setuid sys_nice net_admin chown };
 dontaudit asterisk_t self:capability sys_tty_config;
 allow asterisk_t self:process { getsched setsched signal_perms getcap setcap };
 allow asterisk_t self:fifo_file rw_fifo_file_perms;
Signature · 1 line
1.7.3.4
#2 lore raw

PATCH 1/5 Allow asterisk to chown its own /var/run/asterisk directory

Quoted 12 lines · Sven Vermeulen

During startup, asterisk verifies the ownership of its run-directory and, if not set correctly, changes it accordingly.

Signed-off-by Sven Vermeulen <[email protected]>
---
 asterisk.te |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)
asterisk.te +0 -0
index 22d7cdf..c702879 100644

asterisk.te files_pid_file(asterisk_var_run_t) · line 46

Quoted 8 lines
asterisk.te +1 -1
@@ -40,7 +40,7 @@ files_pid_file(asterisk_var_run_t)
 #
 
 # dac_override for /var/run/asterisk
-allow asterisk_t self:capability { dac_override setgid setuid sys_nice net_admin };
+allow asterisk_t self:capability { dac_override setgid setuid sys_nice net_admin chown };
 dontaudit asterisk_t self:capability sys_tty_config;
 allow asterisk_t self:process { getsched setsched signal_perms getcap setcap };
 allow asterisk_t self:fifo_file rw_fifo_file_perms;

Merged.

Signature · 3 lines
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
author
#3 lore raw

PATCH 2/5 Allow asterisk to listen on its control socket

In reply to Sven Vermeulen
Signed-off-by Sven Vermeulen <[email protected]>
---
 asterisk.te |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)
asterisk.te +1 -1
index c702879..aac5a41 100644
@@ -46,7 +46,7 @@ allow asterisk_t self:process { getsched setsched signal_perms getcap setcap };
 allow asterisk_t self:fifo_file rw_fifo_file_perms;
 allow asterisk_t self:sem create_sem_perms;
 allow asterisk_t self:shm create_shm_perms;
-allow asterisk_t self:unix_stream_socket connectto;
+allow asterisk_t self:unix_stream_socket { connectto listen accept };
 allow asterisk_t self:tcp_socket create_stream_socket_perms;
 allow asterisk_t self:udp_socket create_socket_perms;
Signature · 1 line
1.7.3.4
#4 lore raw

PATCH 2/5 Allow asterisk to listen on its control socket

Quoted 11 lines · Sven Vermeulen
Signed-off-by Sven Vermeulen <[email protected]>
---
 asterisk.te |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)
asterisk.te +0 -0
index c702879..aac5a41 100644

asterisk.te allow asterisk_t self:process { getsched setsched signal_perms getcap setcap }; · line 51

Quoted 7 lines
asterisk.te +1 -1
@@ -46,7 +46,7 @@ allow asterisk_t self:process { getsched setsched signal_perms getcap setcap };
 allow asterisk_t self:fifo_file rw_fifo_file_perms;
 allow asterisk_t self:sem create_sem_perms;
 allow asterisk_t self:shm create_shm_perms;
-allow asterisk_t self:unix_stream_socket connectto;
+allow asterisk_t self:unix_stream_socket { connectto listen accept };
 allow asterisk_t self:tcp_socket create_stream_socket_perms;
 allow asterisk_t self:udp_socket create_socket_perms;

Merged.

Signature · 3 lines
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
author
#5 lore raw

PATCH 3/5 Asterisk requires access to /dev/random too

In reply to Sven Vermeulen
Signed-off-by Sven Vermeulen <[email protected]>
---
 asterisk.te |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)
asterisk.te +1 -0
index aac5a41..dda6c5e 100644
@@ -117,6 +117,7 @@ dev_rw_generic_usb_dev(asterisk_t)
 dev_read_sysfs(asterisk_t)
 dev_read_sound(asterisk_t)
 dev_write_sound(asterisk_t)
+dev_read_rand(asterisk_t)
 dev_read_urand(asterisk_t)
 
 domain_use_interactive_fds(asterisk_t)
Signature · 1 line
1.7.3.4
#6 lore raw

PATCH 3/5 Asterisk requires access to /dev/random too

Quoted 11 lines · Sven Vermeulen
Signed-off-by Sven Vermeulen <[email protected]>
---
 asterisk.te |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)
asterisk.te +0 -0
index aac5a41..dda6c5e 100644

asterisk.te dev_rw_generic_usb_dev(asterisk_t) · line 123

Quoted 7 lines
asterisk.te +1 -0
@@ -117,6 +117,7 @@ dev_rw_generic_usb_dev(asterisk_t)
 dev_read_sysfs(asterisk_t)
 dev_read_sound(asterisk_t)
 dev_write_sound(asterisk_t)
+dev_read_rand(asterisk_t)
 dev_read_urand(asterisk_t)
 
 domain_use_interactive_fds(asterisk_t)

Merged.

Signature · 3 lines
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
author
#7 lore raw

PATCH 4/5 Add interfaces to manage attributes of asterisk log and pid files

In reply to Sven Vermeulen
Signed-off-by Sven Vermeulen <[email protected]>
---
 asterisk.if |   43 +++++++++++++++++++++++++++++++++++++++++++
 1 files changed, 43 insertions(+), 0 deletions(-)
asterisk.if +43 -0
index 8b8143e..bd6273f 100644
@@ -90,3 +90,46 @@ interface(`asterisk_admin',`
 	files_list_pids($1)
 	admin_pattern($1, asterisk_var_run_t)
 ')
+
+#######################################
+## <summary>
+##   Allow changing the attributes of the asterisk log files and directories
+## </summary>
+## <param name="domain">
+##   <summary>
+##     Domain allowed to change the attributes of the asterisk log files and
+##     directories
+##   </summary>
+## </param>
+#
+interface(`asterisk_setattr_logs',`
+	gen_require(`
+		type asterisk_log_t;
+	')
+
+	setattr_files_pattern($1, asterisk_log_t, asterisk_log_t)
+	setattr_dirs_pattern($1, asterisk_log_t, asterisk_log_t)
+
+	logging_search_logs($1)
+')
+
+#######################################
+## <summary>
+##   Allow changing the attributes of the asterisk PID files
+## </summary>
+## <param name="domain">
+##   <summary>
+##     Domain allowed to change the attributes of the asterisk PID files
+##   </summary>
+## </param>
+#
+interface(`asterisk_setattr_pid_files',`
+	gen_require(`
+		type asterisk_var_run_t;
+	')
+
+	setattr_files_pattern($1, asterisk_var_run_t, asterisk_var_run_t)
+	setattr_dirs_pattern($1, asterisk_var_run_t, asterisk_var_run_t)
+
+	files_search_pids($1)
+')
Signature · 1 line
1.7.3.4
#8 lore raw

PATCH 4/5 Add interfaces to manage attributes of asterisk log and pid files

Quoted 6 lines · Sven Vermeulen
Signed-off-by Sven Vermeulen <[email protected]>
---
 asterisk.if |   43 +++++++++++++++++++++++++++++++++++++++++++
 1 files changed, 43 insertions(+), 0 deletions(-)

Merged. Fixed whitespace and rearranged interfaces.

Quoted 51 lines
asterisk.if +43 -0
index 8b8143e..bd6273f 100644
@@ -90,3 +90,46 @@ interface(`asterisk_admin',`
 	files_list_pids($1)
 	admin_pattern($1, asterisk_var_run_t)
 ')
+
+#######################################
+## <summary>
+##   Allow changing the attributes of the asterisk log files and directories
+## </summary>
+## <param name="domain">
+##   <summary>
+##     Domain allowed to change the attributes of the asterisk log files and
+##     directories
+##   </summary>
+## </param>
+#
+interface(`asterisk_setattr_logs',`
+	gen_require(`
+		type asterisk_log_t;
+	')
+
+	setattr_files_pattern($1, asterisk_log_t, asterisk_log_t)
+	setattr_dirs_pattern($1, asterisk_log_t, asterisk_log_t)
+
+	logging_search_logs($1)
+')
+
+#######################################
+## <summary>
+##   Allow changing the attributes of the asterisk PID files
+## </summary>
+## <param name="domain">
+##   <summary>
+##     Domain allowed to change the attributes of the asterisk PID files
+##   </summary>
+## </param>
+#
+interface(`asterisk_setattr_pid_files',`
+	gen_require(`
+		type asterisk_var_run_t;
+	')
+
+	setattr_files_pattern($1, asterisk_var_run_t, asterisk_var_run_t)
+	setattr_dirs_pattern($1, asterisk_var_run_t, asterisk_var_run_t)
+
+	files_search_pids($1)
+')
Signature · 3 lines
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
author
#9 lore raw

PATCH 5/5 Allow initrc to manage asterisk log and pid file attributes

In reply to Sven Vermeulen
Signed-off-by Sven Vermeulen <[email protected]>
---
 policy/modules/system/init.te |    5 +++++
 1 files changed, 5 insertions(+), 0 deletions(-)
policy/modules/system/init.te +5 -0
index b7fcbe3..dd37cf1 100644
@@ -571,6 +571,11 @@ optional_policy(`
 ')
 
 optional_policy(`
+	asterisk_setattr_logs(initrc_t)
+	asterisk_setattr_pid_files(initrc_t)
+')
+
+optional_policy(`
 	bind_read_config(initrc_t)
 
 	# for chmod in start script
Signature · 1 line
1.7.3.4
#10 lore raw

PATCH 5/5 Allow initrc to manage asterisk log and pid file attributes

Quoted 12 lines · Sven Vermeulen
Signed-off-by Sven Vermeulen <[email protected]>
---
 policy/modules/system/init.te |    5 +++++
 1 files changed, 5 insertions(+), 0 deletions(-)
policy/modules/system/init.te +0 -0
index b7fcbe3..dd37cf1 100644
@@ -571,6 +571,11 @@ optional_policy(`
 ')

policy/modules/system/init.te optional_policy(` · line 581

Quoted 10 lines
policy/modules/system/init.te +5 -0
 
 optional_policy(`
+	asterisk_setattr_logs(initrc_t)
+	asterisk_setattr_pid_files(initrc_t)
+')
+
+optional_policy(`
 	bind_read_config(initrc_t)
 
 	# for chmod in start script

Merged.

Signature · 3 lines
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com