Mark wpa_cli as interactive application
v2 cover Mark wpa_cli as interactive application
The wpa_cli application is an interactive application to interact with wpa_supplicant. This patch supports this within the SELinux policies.
Updates since v1
----------------
- Only manage the file class for wpa_cli_t -> wpa_cli_var_run_t, including transition (files_pid_filetrans)
- Drop the direct etc_t call
Wkr,
Sven Vermeulen
PATCH v2 1/2 Mark wpa_cli as a commandline utility for admins
The wpa_cli application has two functions within the network manager
environment: (1.) it acts as a commandline interface for administrators to interact with wpa_supplicant, and (2.) it gets called from within init scripts to perform some administrative, unattended tasks.
In this patch, we mark the wpa_cli_t domain as an application domain, introduce a few interfaces to allow roles to run the wpa_cli application, and enhance the wpa_cli_t local policies to reflect its dual use.
--- networkmanager.fc | 2 + networkmanager.if | 65 +++++++++++++++++++++++++++++++++++++++++++++++++++++ networkmanager.te | 34 +++++++++++++++++++++++++++- 3 files changed, 100 insertions(+), 1 deletions(-)
networkmanager.fc +2 -0
@@ -7,6 +7,7 @@ /sbin/wpa_cli -- gen_context(system_u:object_r:wpa_cli_exec_t,s0) /sbin/wpa_supplicant -- gen_context(system_u:object_r:NetworkManager_exec_t,s0) +/usr/bin/wpa_cli -- gen_context(system_u:object_r:wpa_cli_exec_t,s0) /usr/s?bin/NetworkManager -- gen_context(system_u:object_r:NetworkManager_exec_t,s0) /usr/s?bin/wpa_supplicant -- gen_context(system_u:object_r:NetworkManager_exec_t,s0) /usr/sbin/NetworkManagerDispatcher -- gen_context(system_u:object_r:NetworkManager_exec_t,s0)
@@ -22,5 +23,6 @@ /var/run/NetworkManager\.pid -- gen_context(system_u:object_r:NetworkManager_var_run_t,s0) /var/run/NetworkManager(/.*)? gen_context(system_u:object_r:NetworkManager_var_run_t,s0) /var/run/nm-dhclient.* gen_context(system_u:object_r:NetworkManager_var_run_t,s0) +/var/run/wpa_cli-.* -- gen_context(system_u:object_r:wpa_cli_var_run_t,s0) /var/run/wpa_supplicant(/.*)? gen_context(system_u:object_r:NetworkManager_var_run_t,s0) /var/run/wpa_supplicant-global -s gen_context(system_u:object_r:NetworkManager_var_run_t,s0)
networkmanager.if +65 -0
68 lines not on this page · raw message
networkmanager.te +33 -1
@@ -28,6 +28,9 @@ type wpa_cli_t; type wpa_cli_exec_t; init_system_domain(wpa_cli_t, wpa_cli_exec_t) +type wpa_cli_var_run_t; +files_pid_file(wpa_cli_var_run_t) + ######################################## # # Local policy
@@ -281,9 +284,38 @@ files_tmp_filetrans(wpa_cli_t, NetworkManager_tmp_t, sock_file) list_dirs_pattern(wpa_cli_t, NetworkManager_var_run_t, NetworkManager_var_run_t) rw_sock_files_pattern(wpa_cli_t, NetworkManager_var_run_t, NetworkManager_var_run_t) +manage_files_pattern(wpa_cli_t, wpa_cli_var_run_t, wpa_cli_var_run_t) +files_pid_filetrans(wpa_cli_t, wpa_cli_var_run_t, file) + +corecmd_exec_bin(wpa_cli_t) +corecmd_exec_shell(wpa_cli_t) + +domain_use_interactive_fds(wpa_cli_t) + +files_search_pids(wpa_cli_t) + +fs_manage_tmpfs_dirs(wpa_cli_t) +fs_manage_tmpfs_sockets(wpa_cli_t) +fs_manage_tmpfs_sockets(NetworkManager_t) +fs_rw_tmpfs_files(wpa_cli_t) +fs_rw_tmpfs_files(NetworkManager_t) +fs_search_tmpfs(wpa_cli_t) +fs_search_tmpfs(NetworkManager_t) + +term_dontaudit_use_console(wpa_cli_t) + +getty_use_fds(wpa_cli_t) + +init_domtrans_script(wpa_cli_t) init_dontaudit_use_fds(wpa_cli_t) init_use_script_ptys(wpa_cli_t) +logging_send_syslog_msg(wpa_cli_t) + miscfiles_read_localization(wpa_cli_t) -term_dontaudit_use_console(wpa_cli_t) +userdom_use_user_terminals(wpa_cli_t) + +ifdef(`distro_gentoo',` + sysnet_domtrans_dhcpc(wpa_cli_t) +')
Signature · 1 line
1.7.3.4
PATCH v2 1/2 Mark wpa_cli as a commandline utility for admins
Quoted 32 lines · Sven Vermeulen
The
wpa_cliapplication has two functions within the network manager
environment: (1.) it acts as a commandline interface for administrators to interact withwpa_supplicant, and (2.) it gets called from within init scripts to perform some administrative, unattended tasks.In this patch, we mark the
wpa_cli_tdomain as an application domain, introduce a few interfaces to allow roles to run thewpa_cliapplication, and enhance thewpa_cli_tlocal policies to reflect its dual use.Signed-off-by Sven Vermeulen <[email protected]>--- networkmanager.fc | 2 + networkmanager.if | 65 +++++++++++++++++++++++++++++++++++++++++++++++++++++ networkmanager.te | 34 +++++++++++++++++++++++++++- 3 files changed, 100 insertions(+), 1 deletions(-)networkmanager.te +7
-0@@ -281,9 +284,38 @@ files_tmp_filetrans(wpa_cli_t, NetworkManager_tmp_t, sock_file) list_dirs_pattern(wpa_cli_t, NetworkManager_var_run_t, NetworkManager_var_run_t) rw_sock_files_pattern(wpa_cli_t, NetworkManager_var_run_t, NetworkManager_var_run_t) +manage_files_pattern(wpa_cli_t, wpa_cli_var_run_t, wpa_cli_var_run_t) +files_pid_filetrans(wpa_cli_t, wpa_cli_var_run_t, file) + +corecmd_exec_bin(wpa_cli_t) +corecmd_exec_shell(wpa_cli_t) + +domain_use_interactive_fds(wpa_cli_t)
networkmanager.te files_tmp_filetrans(wpa_cli_t, NetworkManager_tmp_t, sock_file) · line 303
Quoted 10 lines
networkmanager.te +10
-0+ +files_search_pids(wpa_cli_t) + +fs_manage_tmpfs_dirs(wpa_cli_t) +fs_manage_tmpfs_sockets(wpa_cli_t) +fs_manage_tmpfs_sockets(NetworkManager_t) +fs_rw_tmpfs_files(wpa_cli_t) +fs_rw_tmpfs_files(NetworkManager_t) +fs_search_tmpfs(wpa_cli_t) +fs_search_tmpfs(NetworkManager_t)
tmpfs_t usage? It looks like there should be either a NetworkManager_tmpfs_t or wpa_cli_tmpfs_t (my guess is the former). Also the NetworkManager_t rules should be moved over with the other NetworkManager_t rules.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH v2 2/2 Allow sysadm_r role to call wpa_cli
In reply to Sven VermeulenAllow system administrators to run wpa_cli to interact with wpa_supplicant.
--- policy/modules/roles/sysadm.te | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-)
policy/modules/roles/sysadm.te +4 -0
@@ -241,6 +241,10 @@ optional_policy(` ') optional_policy(` + networkmanager_run_wpa_cli(sysadm_t, sysadm_r) +') + +optional_policy(` netutils_run(sysadm_t, sysadm_r) netutils_run_ping(sysadm_t, sysadm_r) netutils_run_traceroute(sysadm_t, sysadm_r)
Signature · 1 line
1.7.3.4