Support dracut domain
v2 cover Support dracut domain
While trying to get a SELinux-supporting initramfs booted up (in enforcing mode, without unconfined domains) my current attempts are at dracut. But dracut itself didn't work quite well on such a system as running it in sysadm_t domain fails (some domain transitions occur which are then asked to write files in user_tmp_t which isn't allowed for those domains).
Instead of patching those domains (ldconfig_t and depmod_t) to allow writing & creating files in user_tmp_t (i.e. manage privileges) I drafted up a dracut domain (dracut_t) and grant those domains manage access to dracut_tmp_t.
To support dracut, a few changes were necessary to the policy as well (additional interfaces).
The summary:
- Add read interface for udev rules (udev_read_rules_files)
- List module configuration option files (modutils_list_module_config)
- Add in the dracut_t policy
- Grant ldconfig_t and depmod_t the dracut_manage_tmp_files privilege
- Allow sysadm_t to run/transition to dracut_t
PATCH v2 1/5 Add read interface for udev rules
Applications, such as dracut or other initramfs creators, need read access to udev rules to see if they need to pull in additional requirements for the initramfs or not. This adds in the udev_read_rules_files() interface for this purpose.
--- policy/modules/system/udev.if | 19 +++++++++++++++++++ 1 files changed, 19 insertions(+), 0 deletions(-)
policy/modules/system/udev.if +19 -0
@@ -132,6 +132,25 @@ interface(`udev_dontaudit_rw_dgram_sockets',` ######################################## ## <summary> +## Read udev rules files +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`udev_read_rules_files',` + gen_require(` + type udev_rules_t; + ') + + read_files_pattern($1, udev_rules_t, udev_rules_t) +') + + +######################################## +## <summary> ## Manage udev rules files ## </summary> ## <param name="domain">
Signature · 1 line
1.7.3.4
PATCH v2 1/5 Add read interface for udev rules
Quoted 21 lines · Sven Vermeulen
Applications, such as dracut or other initramfs creators, need read access to udev rules to see if they need to pull in additional requirements for the initramfs or not. This adds in the
udev_read_rules_files()interface for this purpose.Signed-off-by Sven Vermeulen <[email protected]>--- policy/modules/system/udev.if | 19 +++++++++++++++++++ 1 files changed, 19 insertions(+), 0 deletions(-)policy/modules/system/udev.if +3
-0@@ -132,6 +132,25 @@ interface(`udev_dontaudit_rw_dgram_sockets',` ######################################## ## <summary> +## Read udev rules files +## </summary> +## <param name="domain">
policy/modules/system/udev.if interface(`udev_dontaudit_rw_dgram_sockets',` · line 147
Quoted 10 lines
policy/modules/system/udev.if +10
-0+## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`udev_read_rules_files',` + gen_require(` + type udev_rules_t; + ') +
files_search_etc($1)
Quoted 9 lines
policy/modules/system/udev.if +6
-0+ read_files_pattern($1, udev_rules_t, udev_rules_t) +') + + +######################################## +## <summary> ## Manage udev rules files ## </summary> ## <param name="domain">
PATCH v2 2/5 Support listing module configuration files
In reply to Sven VermeulenDracut, an application that creates an initramfs based on the systems' requirements, needs to list the module configuration
files to function. This adds in this interface for this purpose.
--- policy/modules/system/modutils.if | 21 +++++++++++++++++++++ policy/modules/system/modutils.te | 4 ++++ 2 files changed, 25 insertions(+), 0 deletions(-)
policy/modules/system/modutils.if +21 -0
@@ -39,6 +39,27 @@ interface(`modutils_read_module_deps',` ######################################## ## <summary> +## List the module configuration option files +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +## <rolecap/> +# +interface(`modutils_list_module_config',` + gen_require(` + type modules_conf_t; + ') + + list_dirs_pattern($1, modules_conf_t, modules_conf_t) +') + + + +######################################## +## <summary> ## Read the configuration options used when ## loading modules. ## </summary>
policy/modules/system/modutils.te +4 -0
@@ -89,6 +89,10 @@ tunable_policy(`use_samba_home_dirs',` ') optional_policy(` + dracut_manage_tmp_files(depmod_t) +') + +optional_policy(` rpm_rw_pipes(depmod_t) rpm_manage_script_tmp_files(depmod_t) ')
Signature · 1 line
1.7.3.4
PATCH v2 2/5 Support listing module configuration files
Quoted 21 lines · Sven Vermeulen
Dracut, an application that creates an initramfs based on the systems' requirements, needs to list the module configuration
files to function. This adds in this interface for this purpose.Signed-off-by Sven Vermeulen <[email protected]>--- policy/modules/system/modutils.if | 21 +++++++++++++++++++++ policy/modules/system/modutils.te | 4 ++++ 2 files changed, 25 insertions(+), 0 deletions(-)policy/modules/system/modutils.if +3
-0@@ -39,6 +39,27 @@ interface(`modutils_read_module_deps',` ######################################## ## <summary> +## List the module configuration option files +## </summary> +## <param name="domain">
policy/modules/system/modutils.if interface(`modutils_read_module_deps',` · line 54
Quoted 10 lines
policy/modules/system/modutils.if +10
-0+## <summary> +## Domain allowed access. +## </summary> +## </param> +## <rolecap/> +# +interface(`modutils_list_module_config',` + gen_require(` + type modules_conf_t; + ')
I doubt that its listing this just for the sake of listing. You will probably want to use "modutils_read_module_config()" instead. This also allow caller to list.
Quoted 25 lines
policy/modules/system/modutils.if +7
-0+ list_dirs_pattern($1, modules_conf_t, modules_conf_t) +') + + + +######################################## +## <summary> ## Read the configuration options used when ## loading modules. ## </summary>policy/modules/system/modutils.te +4
-0@@ -89,6 +89,10 @@ tunable_policy(`use_samba_home_dirs',` ') optional_policy(` + dracut_manage_tmp_files(depmod_t) +') + +optional_policy(` rpm_rw_pipes(depmod_t) rpm_manage_script_tmp_files(depmod_t) ')
PATCH v2 3/5 Adding dracut policy
In reply to Sven VermeulenRunning dracut out of the sysadm_t domain doesn't (fully) work on a policy without unconfined domains. The calls to depmod, whose output is then directed to a tmp location, is denied through this. Instead of granting depmod (and other tools) "manage" access to user_tmp_t, we create a separate domain for dracut (called dracut_t) and grant these tools management access to dracut_tmp_t.
--- dracut.fc | 4 +++ dracut.if | 69 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ dracut.te | 76 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 149 insertions(+), 0 deletions(-) create mode 100644 dracut.fc create mode 100644 dracut.if create mode 100644 dracut.te
dracut.fc new file +4 -0
@@ -0,0 +1,4 @@ +# +# /usr +# +/usr/(s)?bin/dracut -- gen_context(system_u:object_r:dracut_exec_t,s0)
dracut.if new file +69 -0
69 lines not on this page · raw message
dracut.te new file +76 -0
76 lines not on this page · raw message
Signature · 1 line
1.7.3.4
PATCH v2 3/5 Adding dracut policy
Quoted 91 lines · Sven Vermeulen
Running dracut out of the
sysadm_tdomain doesn't (fully) work on a policy without unconfined domains. The calls to depmod, whose output is then directed to a tmp location, is denied through this. Instead of granting depmod (and other tools) "manage" access touser_tmp_t, we create a separate domain for dracut (calleddracut_t) and grant these tools management access todracut_tmp_t.Signed-off-by Sven Vermeulen <[email protected]>--- dracut.fc | 4 +++ dracut.if | 69 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ dracut.te | 76 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 149 insertions(+), 0 deletions(-) create mode 100644 dracut.fc create mode 100644 dracut.if create mode 100644 dracut.tedracut.fc new file +4
-0@@ -0,0 +1,4 @@ +# +# /usr +# +/usr/(s)?bin/dracut -- gen_context(system_u:object_r:dracut_exec_t,s0)dracut.if new file +58
-0@@ -0,0 +1,69 @@ +## <summary>Dracut initramfs creation tool</summary> + +######################################## +## <summary> +## Execute the dracut program in the dracut domain. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed to transition. +## </summary> +## </param> +# +interface(`dracut_domtrans',` + gen_require(` + type dracut_t, dracut_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, dracut_exec_t, dracut_t) +') + +######################################## +## <summary> +## Execute dracut in the dracut domain, and +## allow the specified role the dracut domain. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed to transition. +## </summary> +## </param> +## <param name="role"> +## <summary> +## Role allowed access. +## </summary> +## </param> +# +interface(`dracut_run',` + gen_require(` + type dracut_t; + ') + + dracut_domtrans($1) + role $2 types dracut_t; +') + +######################################## +## <summary> +## Allow domain to manage dracut temporary files +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`dracut_manage_tmp_files',` + gen_require(`
dracut.if line 68
Quoted 10 lines
dracut.if new file +10
-0+ type dracut_tmp_t; + ') + + files_search_var($1) + files_search_tmp($1) + + manage_files_pattern($1, dracut_tmp_t, dracut_tmp_t) + manage_dirs_pattern($1, dracut_tmp_t, dracut_tmp_t) + read_lnk_files_pattern($1, dracut_tmp_t, dracut_tmp_t) +')
This isn't what it say's it is. I would probably make it dracut_manage_tmp()
Allow, and dracut in description is obvious, i would make it "Manage temporary content"
Quoted 20 lines
dracut.te new file +14
-0@@ -0,0 +1,76 @@ +policy_module(dracut, 1.0) + +type dracut_t; +type dracut_exec_t; +application_domain(dracut_t, dracut_exec_t) + +type dracut_var_log_t; +logging_log_file(dracut_var_log_t) + +type dracut_tmp_t; +files_tmp_file(dracut_tmp_t) + +######################################## +#
dracut.te line 24
Quoted 10 lines
dracut.te new file +10
-0+# Local policy +# +allow dracut_t self:process setfscreate; +allow dracut_t self:fifo_file rw_fifo_file_perms; +allow dracut_t self:unix_stream_socket create_stream_socket_perms; + +manage_files_pattern(dracut_t, dracut_tmp_t, dracut_tmp_t) +manage_lnk_files_pattern(dracut_t, dracut_tmp_t, dracut_tmp_t) +manage_dirs_pattern(dracut_t, dracut_tmp_t, dracut_tmp_t) +files_tmp_filetrans(dracut_t, dracut_tmp_t, { file lnk_file dir })
i suspect not all these type transitions are needed.
Quoted 21 lines
dracut.te new file +21
-0+ +manage_files_pattern(dracut_t, dracut_var_log_t, dracut_var_log_t) +logging_log_filetrans(dracut_t, dracut_var_log_t, file) + +kernel_read_system_state(dracut_t) + +corecmd_exec_bin(dracut_t) +corecmd_exec_shell(dracut_t) +corecmd_read_all_executables(dracut_t) + +dev_read_sysfs(dracut_t) + +domain_use_interactive_fds(dracut_t) + +files_create_kernel_img(dracut_t) +files_read_etc_files(dracut_t) +files_read_kernel_modules(dracut_t) +files_read_usr_files(dracut_t) +files_search_pids(dracut_t) + +fstools_exec(dracut_t)
dracut.te line 55
Quoted 10 lines
dracut.te new file +10
-0+ +libs_domtrans_ldconfig(dracut_t) +libs_exec_ld_so(dracut_t) +libs_exec_lib_files(dracut_t) + +miscfiles_read_localization(dracut_t) + +modutils_exec_depmod(dracut_t) +modutils_exec_insmod(dracut_t) +modutils_list_module_config(dracut_t)
redundant this is already allowed with modutils_read_module_config()
dracut.te line 61
Quoted 6 lines
dracut.te new file +6
-0+modutils_read_module_config(dracut_t) +modutils_read_module_deps(dracut_t) + +mount_exec(dracut_t) + +seutil_exec_setfiles(dracut_t)
So you allow it to run setfiles in the dracut domain, but you dont allow the dracut domain to relabelfrom and -to anything?
Quoted 15 lines
dracut.te new file +15
-0+ +udev_exec(dracut_t) +udev_read_rules_files(dracut_t) + +userdom_use_user_terminals(dracut_t) + +optional_policy(` + dmesg_exec(dracut_t) +') + +optional_policy(` + lvm_exec(dracut_t) + lvm_read_config(dracut_t) +') +
PATCH v2 3/5 Adding dracut policy
Quoted 173 lines · Dominick Grift
Quoted 91 lines · Sven Vermeulen
Running dracut out of the
sysadm_tdomain doesn't (fully) work on a policy without unconfined domains. The calls to depmod, whose output is then directed to a tmp location, is denied through this. Instead of granting depmod (and other tools) "manage" access touser_tmp_t, we create a separate domain for dracut (calleddracut_t) and grant these tools management access todracut_tmp_t.Signed-off-by Sven Vermeulen<[email protected]>--- dracut.fc | 4 +++ dracut.if | 69 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ dracut.te | 76 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 149 insertions(+), 0 deletions(-)create mode 100644 dracut.fc
create mode 100644 dracut.if
create mode 100644 dracut.tedracut.fc new file +4
-0@@ -0,0 +1,4 @@ +# +# /usr +# +/usr/(s)?bin/dracut -- gen_context(system_u:object_r:dracut_exec_t,s0)dracut.if new file +58
-0@@ -0,0 +1,69 @@ +##<summary>Dracut initramfs creation tool</summary> + +######################################## +##<summary> +## Execute the dracut program in the dracut domain. +##</summary> +##<param name="domain"> +## <summary> +## Domain allowed to transition. +## </summary> +##</param> +# +interface(`dracut_domtrans',` + gen_require(` + type dracut_t, dracut_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, dracut_exec_t, dracut_t) +') + +######################################## +##<summary> +## Execute dracut in the dracut domain, and +## allow the specified role the dracut domain. +##</summary> +##<param name="domain"> +## <summary> +## Domain allowed to transition. +## </summary> +##</param> +##<param name="role"> +## <summary> +## Role allowed access. +## </summary> +##</param> +# +interface(`dracut_run',` + gen_require(` + type dracut_t; + ') + + dracut_domtrans($1) + role $2 types dracut_t; +') + +######################################## +##<summary> +## Allow domain to manage dracut temporary files +##</summary> +##<param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +##</param> +# +interface(`dracut_manage_tmp_files',` + gen_require(`dracut.if line 68
Quoted 10 lines
dracut.if new file +10
-0+ type dracut_tmp_t; + ') + + files_search_var($1) + files_search_tmp($1) + + manage_files_pattern($1, dracut_tmp_t, dracut_tmp_t) + manage_dirs_pattern($1, dracut_tmp_t, dracut_tmp_t) + read_lnk_files_pattern($1, dracut_tmp_t, dracut_tmp_t) +')This isn't what it say's it is. I would probably make it
dracut_manage_tmp()Allow, and dracut in description is obvious, i would make it "Manage temporary content"
Quoted 20 lines
dracut.te new file +14
-0@@ -0,0 +1,76 @@ +policy_module(dracut, 1.0) + +type dracut_t; +type dracut_exec_t; +application_domain(dracut_t, dracut_exec_t) + +type dracut_var_log_t; +logging_log_file(dracut_var_log_t) + +type dracut_tmp_t; +files_tmp_file(dracut_tmp_t) + +######################################## +#dracut.te line 24
Quoted 10 lines
dracut.te new file +10
-0+# Local policy +# +allow dracut_t self:process setfscreate; +allow dracut_t self:fifo_file rw_fifo_file_perms; +allow dracut_t self:unix_stream_socket create_stream_socket_perms; + +manage_files_pattern(dracut_t, dracut_tmp_t, dracut_tmp_t) +manage_lnk_files_pattern(dracut_t, dracut_tmp_t, dracut_tmp_t) +manage_dirs_pattern(dracut_t, dracut_tmp_t, dracut_tmp_t) +files_tmp_filetrans(dracut_t, dracut_tmp_t, { file lnk_file dir })i suspect not all these type transitions are needed.
Quoted 21 lines
dracut.te new file +21
-0+ +manage_files_pattern(dracut_t, dracut_var_log_t, dracut_var_log_t) +logging_log_filetrans(dracut_t, dracut_var_log_t, file) + +kernel_read_system_state(dracut_t) + +corecmd_exec_bin(dracut_t) +corecmd_exec_shell(dracut_t) +corecmd_read_all_executables(dracut_t) + +dev_read_sysfs(dracut_t) + +domain_use_interactive_fds(dracut_t) + +files_create_kernel_img(dracut_t) +files_read_etc_files(dracut_t) +files_read_kernel_modules(dracut_t) +files_read_usr_files(dracut_t) +files_search_pids(dracut_t) + +fstools_exec(dracut_t)dracut.te line 55
Quoted 10 lines
dracut.te new file +10
-0+ +libs_domtrans_ldconfig(dracut_t) +libs_exec_ld_so(dracut_t) +libs_exec_lib_files(dracut_t) + +miscfiles_read_localization(dracut_t) + +modutils_exec_depmod(dracut_t) +modutils_exec_insmod(dracut_t) +modutils_list_module_config(dracut_t)redundant this is already allowed with
modutils_read_module_config()
Quoted 8 lines
dracut.te line 61
Quoted 6 lines
dracut.te new file +6
-0+modutils_read_module_config(dracut_t) +modutils_read_module_deps(dracut_t) + +mount_exec(dracut_t) + +seutil_exec_setfiles(dracut_t)So you allow it to run setfiles in the dracut domain, but you dont allow the dracut domain to relabelfrom and -to anything?
I believe dracut should stay as unconfined domain. Also you probably will see other domains which are want to execute dracut. And I would think transitions will be needed rather than just execute apps in the dracut domain.
Quoted 21 lines
Quoted 6 lines
dracut.te new file +5
-0+ +udev_exec(dracut_t) +udev_read_rules_files(dracut_t) + +userdom_use_user_terminals(dracut_t)dracut.te line 76
Quoted 10 lines
dracut.te new file +10
-0+ +optional_policy(` + dmesg_exec(dracut_t) +') + +optional_policy(` + lvm_exec(dracut_t) + lvm_read_config(dracut_t) +') +_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy
PATCH v2 3/5 Adding dracut policy
Quoted 7 lines · Miroslav Grepl
Quoted 3 lines
Quoted 1 line
+seutil_exec_setfiles(dracut_t)
So you allow it to run setfiles in the dracut domain, but you dont allow the dracut domain to relabelfrom and -to anything?
I believe dracut should stay as unconfined domain. Also you probably will see other domains which are want to execute dracut. And I would think transitions will be needed rather than just execute apps in the dracut domain.
But what about MLS? MLS doesnt have the luxury of unconfined domains.
Also its easy enough to append unconfined_domain(dracut_t) for stable releases only and in the meantime try to perfect the confined dracut domain in test releases as much as possible.
PATCH v2 3/5 Adding dracut policy
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Quoted 12 lines · Dominick Grift
Quoted 7 lines · Miroslav Grepl
Quoted 3 lines
Quoted 1 line
+seutil_exec_setfiles(dracut_t)
So you allow it to run setfiles in the dracut domain, but you dont allow the dracut domain to relabelfrom and -to anything?
I believe dracut should stay as unconfined domain. Also you probably will see other domains which are want to execute dracut. And I would think transitions will be needed rather than just execute apps in the dracut domain.
But what about MLS? MLS doesnt have the luxury of unconfined domains.
Quoted 9 lines
Also its easy enough to append
unconfined_domain(dracut_t)for stable releases only and in the meantime try to perfect the confined dracut domain in test releases as much as possible._______________________________________________ refpolicy mailing list refpolicy at oss.tresys.com http://oss.tresys.com/mailman/listinfo/refpolicy
If we are only going to allow dracut to fix the labels on /dev and /run you can add the rules for relabelfrom/relabelto, If it needs to do more maybe a transition to setfiles_t is necessary.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAk/oasIACgkQrlYvE4MpobPBdACgy4uhK1mxovyBhzgqcJA9OZTc NX4AoI5Le6yrK8B9b3VmCvQNlgjN5e1J
=77/O
-----END PGP SIGNATURE-----
PATCH v2 3/5 Adding dracut policy
In reply to Miroslav GreplQuoted 4 lines · Miroslav Grepl
I believe dracut should stay as unconfined domain. Also you probably will see other domains which are want to execute dracut. And I would think transitions will be needed rather than just execute apps in the dracut domain.
I don't mind people or organizations opting to use unconfined domains, but I strive to run all applications, services and users in a confined manner. It is easy enough, like Dominick said, to add an optional unconfined_domain() to make us all happy ;-)
Wkr,
Sven Vermeulen
PATCH v2 3/5 Adding dracut policy
In reply to Dominick GriftQuoted 25 lines · Dominick Grift
Quoted 12 lines
dracut.if new file +12
-0+######################################## +## <summary> +## Allow domain to manage dracut temporary files +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`dracut_manage_tmp_files',` + gen_require(`dracut.if line 68
Quoted 10 lines
dracut.if new file +10
-0+ type dracut_tmp_t; + ') + + files_search_var($1) + files_search_tmp($1) + + manage_files_pattern($1, dracut_tmp_t, dracut_tmp_t) + manage_dirs_pattern($1, dracut_tmp_t, dracut_tmp_t) + read_lnk_files_pattern($1, dracut_tmp_t, dracut_tmp_t) +')This isn't what it say's it is. I would probably make it
dracut_manage_tmp()
Quoted 2 lines
Allow, and dracut in description is obvious, i would make it "Manage temporary content"
Ok
Quoted 5 lines
dracut.te line 24
Quoted 4 lines
dracut.te new file +4
-0+manage_files_pattern(dracut_t, dracut_tmp_t, dracut_tmp_t) +manage_lnk_files_pattern(dracut_t, dracut_tmp_t, dracut_tmp_t) +manage_dirs_pattern(dracut_t, dracut_tmp_t, dracut_tmp_t) +files_tmp_filetrans(dracut_t, dracut_tmp_t, { file lnk_file dir })i suspect not all these type transitions are needed.
I think they were. Dracut generated a temporary directory in which it positioned whatever information it needed to generate an initramfs. I'm not sure about the lnk_file, so I'll try again to verify (I'll just add in a temporary auditallow to make sure locally ;-)
Quoted 4 lines
dracut.te line 55
Quoted 3 lines
dracut.te new file +3
-0+modutils_exec_depmod(dracut_t) +modutils_exec_insmod(dracut_t) +modutils_list_module_config(dracut_t)redundant this is already allowed with
modutils_read_module_config()
Ok
Quoted 8 lines
dracut.te line 61
Quoted 6 lines
dracut.te new file +6
-0+modutils_read_module_config(dracut_t) +modutils_read_module_deps(dracut_t) + +mount_exec(dracut_t) + +seutil_exec_setfiles(dracut_t)So you allow it to run setfiles in the dracut domain, but you dont allow the dracut domain to relabelfrom and -to anything?
It's not about executing; dracut uses "ldd" to scan for libraries it needs in the initramfs. But using "ldd" means that ldd (underlyingly) executes the files. Hence, the need for _exec (but not for _domtrans or functionality).
Wkr,
Sven Vermeulen
PATCH v2 3/5 Adding dracut policy
Quoted 9 lines
Quoted 4 lines
Quoted 2 lines
+seutil_exec_setfiles(dracut_t)
So you allow it to run setfiles in the dracut domain, but you dont allow the dracut domain to relabelfrom and -to anything?
It's not about executing; dracut uses "ldd" to scan for libraries it needs in the initramfs. But using "ldd" means that ldd (underlyingly) executes the files. Hence, the need for
_exec(but not for_domtransor functionality).
I think you want mmap ( create a seutil_check_exec_setfiles() or something)
mmap provides only execute
exec provides execute as well as execute_no_trans
i think that , if i understand you correctly, it doesnt need the execute_no_trans
PATCH v2 3/5 Adding dracut policy
Quoted 9 lines · Dominick Grift
Quoted 8 lines
Quoted 3 lines
Quoted 1 line
+seutil_exec_setfiles(dracut_t)
So you allow it to run setfiles in the dracut domain, but you dont allow the dracut domain to relabelfrom and -to anything?
It's not about executing; dracut uses "ldd" to scan for libraries it needs in the initramfs. But using "ldd" means that ldd (underlyingly) executes the files. Hence, the need for
_exec(but not for_domtransor functionality).
Quoted 9 lines
I think you want mmap ( create a
seutil_check_exec_setfiles()or something)mmap provides only execute
exec provides execute as well asexecute_no_transi think that , if i understand you correctly, it doesnt need the
execute_no_trans
but nevertheless, push comes to shove, dracut should probably optionally be allowed to (really) execute setfiles and be allowed to dev_relabel_all_devices
In at least old fedora it mounts /sysroot/dev, restores context of /dev and then loads policy (if i am not mistaken)
Quoted 1 line
PATCH v2 3/5 Adding dracut policy
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Quoted 25 lines · Dominick Grift
Quoted 10 lines · Dominick Grift
Quoted 9 lines
Quoted 3 lines
Quoted 1 line
+seutil_exec_setfiles(dracut_t)
So you allow it to run setfiles in the dracut domain, but you dont allow the dracut domain to relabelfrom and -to anything?
It's not about executing; dracut uses "ldd" to scan for libraries it needs in the initramfs. But using "ldd" means that ldd (underlyingly) executes the files. Hence, the need for
_exec(but not for_domtransor functionality).Quoted 9 lines
I think you want mmap ( create a
seutil_check_exec_setfiles()or something)mmap provides only execute exec provides execute as well as
execute_no_transi think that , if i understand you correctly, it doesnt need the
execute_no_transbut nevertheless, push comes to shove, dracut should probably optionally be allowed to (really) execute setfiles and be allowed to
dev_relabel_all_devices
Quoted 9 lines
In at least old fedora it mounts /sysroot/dev, restores context of /dev and then loads policy (if i am not mistaken)
Quoted 1 line
_______________________________________________ refpolicy mailing list refpolicy at oss.tresys.com http://oss.tresys.com/mailman/listinfo/refpolicy
Yes although I think that is being done by systemd or systemd-udev now. -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAk/og9cACgkQrlYvE4MpobOgFQCfc/1HkxLjTKynRsy9qtG8LaN+ ZRwAnA6TgB/A1Z3Mv6m7Gv5yJZXwql12
=J4oz
-----END PGP SIGNATURE-----
PATCH v2 3/5 Adding dracut policy
In reply to Dominick GriftQuoted 10 lines · Dominick Grift
Quoted 9 lines
I think you want mmap ( create a
seutil_check_exec_setfiles()or something)mmap provides only execute
exec provides execute as well asexecute_no_transi think that , if i understand you correctly, it doesnt need the
execute_no_trans
Quoted 6 lines
but nevertheless, push comes to shove, dracut should probably optionally be allowed to (really) execute setfiles and be allowed to
dev_relabel_all_devicesIn at least old fedora it mounts /sysroot/dev, restores context of /dev and then loads policy (if i am not mistaken)
Thanks for the mmap hint, didn't know there was something like that.
Regarding the policy allowing executing - dracut_t is about the dracut application. The initramfs itself doesn't run in dracut_t, but in init_t or kernel_t (depending on when the policy itself is loaded)...
Wkr,
Sven Vermeulen
PATCH v2 3/5 Adding dracut policy
A. On Mon, 2012-06-25 at 18:29 +0200, Sven Vermeulen wrote:
Quoted 15 lines · Dominick Grift
Quoted 14 lines
Quoted 9 lines
I think you want mmap ( create a
seutil_check_exec_setfiles()or something)mmap provides only execute
exec provides execute as well asexecute_no_transi think that , if i understand you correctly, it doesnt need the
execute_no_transbut nevertheless, push comes to shove, dracut should probably optionally be allowed to (really) execute setfiles and be allowed to
dev_relabel_all_devices
Quoted 8 lines
Quoted 2 lines
In at least old fedora it mounts /sysroot/dev, restores context of /dev and then loads policy (if i am not mistaken)
Thanks for the mmap hint, didn't know there was something like that.
Regarding the policy allowing executing -
dracut_tis about the dracut application. The initramfs itself doesn't run indracut_t, but ininit_torkernel_t(depending on when the policy itself is loaded)...
Whoops yes thats right, kernel_t i guess...
PATCH v2 3/5 Adding dracut policy
In reply to Dominick GriftQuoted 5 lines · Dominick Grift
dracut.te line 24
Quoted 4 lines
dracut.te new file +4
-0+manage_files_pattern(dracut_t, dracut_tmp_t, dracut_tmp_t) +manage_lnk_files_pattern(dracut_t, dracut_tmp_t, dracut_tmp_t) +manage_dirs_pattern(dracut_t, dracut_tmp_t, dracut_tmp_t) +files_tmp_filetrans(dracut_t, dracut_tmp_t, { file lnk_file dir })i suspect not all these type transitions are needed.
Indeed, dir is sufficient on the type transition. Dracut creates a temporary working directory in /var/tmp in which it pregenerates its initramfs environment.
The manage_* stuff needs to be elaborated a bit though (including chr_file support at least).
Quoted 2 lines
Quoted 1 line
+modutils_list_module_config(dracut_t)
redundant this is already allowed with
modutils_read_module_config()
It's not.
In modutils_read_module_config, you have search privileges in the directory, but not listing privileges. Dracut needs listing privileges, as it uses something like "find /etc/modprobe.d" in its internal operations.
I could add in list_dirs_pattern() in the modutils_read_module_config(), but then that would enlarge the privileges for other domains that have this (which is about 12 domains on my system).
Wkr,
Sven Vermeulen
PATCH v2 4/5 Grant dracut_manage_tmp_files to domains called by dracut
In reply to Sven VermeulenThe dracut application calls, amongst other applications, ldconfig and depmod and gets them to write information in a temporary location created by dracut. This allows those domains manage access to these locations.
Write privileges alone were not sufficient as new files were created as well.
--- policy/modules/system/libraries.te | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-)
policy/modules/system/libraries.te +4 -0
@@ -131,6 +131,10 @@ optional_policy(` ') optional_policy(` + dracut_manage_tmp_files(ldconfig_t) +') + +optional_policy(` puppet_rw_tmp(ldconfig_t) ')
Signature · 1 line
1.7.3.4
PATCH v2 4/5 Grant dracut_manage_tmp_files to domains called by dracut
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Quoted 11 lines · Sven Vermeulen
The dracut application calls, amongst other applications, ldconfig and depmod and gets them to write information in a temporary location created by dracut. This allows those domains manage access to these locations.
Write privileges alone were not sufficient as new files were created as well.
Signed-off-by Sven Vermeulen <[email protected]> ---policy/modules/system/libraries.te | 4 ++++ 1 files changed, 4
insertions(+), 0 deletions(-)
Quoted 10 lines
(quoted diff) +0
-0b/policy/modules/system/libraries.te index 992d105..834b7fe 100644 --- a/policy/modules/system/libraries.te +++ b/policy/modules/system/libraries.te @@ -131,6 +131,10 @@ optional_policy(` ')
optional_policy(` +
dracut_manage_tmp_files(ldconfig_t)+') +
+optional_policy(`puppet_rw_tmp(ldconfig_t)')
Don't transition to ldconfig_t, it is a crappy domain with little value. Just add the filename trans rules for dacut and then we don't end up with this kind of nonsence.
I wish ldconfig_t and consoletype_t... and any other domain invented to maintain labeling would just dissapear, they just generate bug reports without adding any security.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAk/oazgACgkQrlYvE4MpobNPMQCg1OJ8RGrrsYMa9a+w+JTQEmxI VDEAoNE6D3FgqKlxgLHqRuEPNA0N4wj6
=gp0p
-----END PGP SIGNATURE-----
PATCH v2 5/5 Allow sysadm_t to call dracut and transition to dracut_t
In reply to Sven Vermeulen--- policy/modules/roles/sysadm.te | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-)
policy/modules/roles/sysadm.te +4 -0
@@ -152,6 +152,10 @@ optional_policy(` ') optional_policy(` + dracut_run(sysadm_t, sysadm_r) +') + +optional_policy(` firstboot_run(sysadm_t, sysadm_r) ')
Signature · 1 line
1.7.3.4