Skip to contentSkip to conversation

add targeted/minimum policy and some updates

PATCH In review [email protected] 3 participants 11 messages Mar 25, 2014 – Apr 24, 2014

lore
Share & tools
lore

[email protected]

author
#0 lore raw

cover add targeted/minimum policy and some updates

From: Wenzong Fan <[email protected]>

Changes:
* backport tmpfs_t patch from upstream;
* add rules for /var/log symlink on poky;
* add targeted policy type
* add minimum targeted policy

The following changes since commit a6079a43719e79e12a57e609923a0cccdba06916:

refpolicy: fix real path for su.shadow (2014-02-13 10:52:07 -0500)

are available in the git repository at:

git://git.pokylinux.org/poky-contrib wenzong/ref-minimum
http://git.pokylinux.org/cgit.cgi/poky-contrib/log/?h=wenzong/ref-minimum

Wenzong Fan (4):
refpolicy: associate tmpfs_t (shm) to device_t (devtmpfs) file
systems
refpolicy: add rules for /var/log symlink on poky
refpolicy: add targeted policy type
refpolicy: add minimum targeted policy

 ...associate-tmpfs_t-shm-to-device_t-devtmpf.patch |   30 +++
 ...ky-policy-add-rules-for-syslogd_t-symlink.patch |   30 +++
 ...rules-for-var-log-symlink-audisp_remote_t.patch |   29 +++
 .../refpolicy/refpolicy-minimum_2.20130424.bb      |   46 +++++
 ...olicy-fix-optional-issue-on-sysadm-module.patch |   60 ++++++
 .../refpolicy-unconfined_u-default-user.patch      |  198 ++++++++++++++++++++
 .../refpolicy/refpolicy-targeted_2.20130424.bb     |   18 ++
 .../refpolicy/refpolicy_2.20130424.inc             |    3 +
 8 files changed, 414 insertions(+)
 create mode 100644 recipes-security/refpolicy/refpolicy-2.20130424/filesystem-associate-tmpfs_t-shm-to-device_t-devtmpf.patch
 create mode 100644 recipes-security/refpolicy/refpolicy-2.20130424/poky-policy-add-rules-for-syslogd_t-symlink.patch
 create mode 100644 recipes-security/refpolicy/refpolicy-2.20130424/poky-policy-add-rules-for-var-log-symlink-audisp_remote_t.patch
 create mode 100644 recipes-security/refpolicy/refpolicy-minimum_2.20130424.bb
 create mode 100644 recipes-security/refpolicy/refpolicy-targeted/refpolicy-fix-optional-issue-on-sysadm-module.patch
 create mode 100644 recipes-security/refpolicy/refpolicy-targeted/refpolicy-unconfined_u-default-user.patch
 create mode 100644 recipes-security/refpolicy/refpolicy-targeted_2.20130424.bb
Signature · 1 line
1.7.9.5
author
#1 lore raw

PATCH 1/4 refpolicy: associate tmpfs_t (shm) to device_t (devtmpfs) file systems

From: Wenzong Fan <[email protected]>

The patch is backported from upstream.

Signed-off-by Wenzong Fan <[email protected]>
---
 ...associate-tmpfs_t-shm-to-device_t-devtmpf.patch |   30 ++++++++++++++++++++
 .../refpolicy/refpolicy_2.20130424.inc             |    1 +
 2 files changed, 31 insertions(+)
 create mode 100644 recipes-security/refpolicy/refpolicy-2.20130424/filesystem-associate-tmpfs_t-shm-to-device_t-devtmpf.patch
recipes-security/refpolicy/refpolicy-2.20130424/filesystem-associate-tmpfs_t-shm-to-device_t-devtmpf.patch new file +30 -0
new file mode 100644
index 0000000..094d9e5
@@ -0,0 +1,30 @@
+Upstream-Status: backport
+
+Signed-off-by: Wenzong Fan <[email protected]>
+=========================
+From e3072cb7bf8f9e09598f01c9eb58d9cfb319d8a1 Mon Sep 17 00:00:00 2001
+From: Dominick Grift <[email protected]>
+Date: Tue, 24 Sep 2013 15:39:21 +0200
+Subject: [PATCH] filesystem: associate tmpfs_t (shm) to device_t (devtmpfs)
+ file systems
+
+Signed-off-by: Dominick Grift <[email protected]>
+---
+ policy/modules/kernel/filesystem.te |    1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/policy/modules/kernel/filesystem.te b/policy/modules/kernel/filesystem.te
+index ed59e5e..f72cde1 100644
+--- a/policy/modules/kernel/filesystem.te
++++ b/policy/modules/kernel/filesystem.te
+@@ -177,6 +177,7 @@ genfscon vxfs / gen_context(system_u:object_r:vxfs_t,s0)
+ # tmpfs_t is the type for tmpfs filesystems
+ #
+ type tmpfs_t;
++dev_associate(tmpfs_t)
+ fs_type(tmpfs_t)
+ files_type(tmpfs_t)
+ files_mountpoint(tmpfs_t)
+-- 
+1.7.10.4
+
recipes-security/refpolicy/refpolicy_2.20130424.inc +1 -0
index 9e5e426..08ed04c 100644
@@ -58,6 +58,7 @@ SRC_URI += "file://poky-policy-fix-xconsole_device_t-as-a-dev_node.patch \
 
 # Backport from upstream
 SRC_URI += "file://Allow-ping-to-get-set-capabilities.patch \
+            file://filesystem-associate-tmpfs_t-shm-to-device_t-devtmpf.patch \
            "
 
 include refpolicy_common.inc
Signature · 1 line
1.7.9.5
author
#2 lore raw

PATCH 2/4 refpolicy: add rules for /var/log symlink on poky

In reply to [email protected]

From: Wenzong Fan <[email protected]>

Signed-off-by Wenzong Fan <[email protected]>
---
 ...ky-policy-add-rules-for-syslogd_t-symlink.patch |   30 ++++++++++++++++++++
 ...rules-for-var-log-symlink-audisp_remote_t.patch |   29 +++++++++++++++++++
 .../refpolicy/refpolicy_2.20130424.inc             |    2 ++
 3 files changed, 61 insertions(+)
 create mode 100644 recipes-security/refpolicy/refpolicy-2.20130424/poky-policy-add-rules-for-syslogd_t-symlink.patch
 create mode 100644 recipes-security/refpolicy/refpolicy-2.20130424/poky-policy-add-rules-for-var-log-symlink-audisp_remote_t.patch
recipes-security/refpolicy/refpolicy-2.20130424/poky-policy-add-rules-for-syslogd_t-symlink.patch new file +30 -0
new file mode 100644
index 0000000..aa9734a
@@ -0,0 +1,30 @@
+Subject: [PATCH] add rules for the symlink of /var/log - syslogd_t
+
+We have added rules for the symlink of /var/log in logging.if,
+while syslogd_t uses /var/log but does not use the
+interfaces in logging.if. So still need add a individual rule for
+syslogd_t.
+
+Upstream-Status: Inappropriate [only for Poky]
+
+Signed-off-by: Xin Ouyang <[email protected]>
+---
+ policy/modules/system/logging.te | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
+index 2ad9ea5..70427d8 100644
+--- a/policy/modules/system/logging.te
++++ b/policy/modules/system/logging.te
+@@ -384,6 +384,8 @@ rw_fifo_files_pattern(syslogd_t, var_log_t, var_log_t)
+ # Allow access for syslog-ng
+ allow syslogd_t var_log_t:dir { create setattr };
+ 
++allow syslogd_t var_log_t:lnk_file read_lnk_file_perms;
++
+ # manage temporary files
+ manage_dirs_pattern(syslogd_t, syslogd_tmp_t, syslogd_tmp_t)
+ manage_files_pattern(syslogd_t, syslogd_tmp_t, syslogd_tmp_t)
+-- 
+1.7.11.7
+
recipes-security/refpolicy/refpolicy-2.20130424/poky-policy-add-rules-for-var-log-symlink-audisp_remote_t.patch new file +29 -0
new file mode 100644
index 0000000..cbf0f7d
@@ -0,0 +1,29 @@
+Subject: [PATCH] add rules for the symlink of /var/log - audisp_remote_t
+
+We have added rules for the symlink of /var/log in logging.if,
+while audisp_remote_t uses /var/log but does not use the
+interfaces in logging.if. So still need add a individual rule for
+audisp_remote_t.
+
+Upstream-Status: Inappropriate [only for Poky]
+
+Signed-off-by: Xin Ouyang <[email protected]>
+---
+ policy/modules/system/logging.te | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
+index 8426a49..2ad9ea5 100644
+--- a/policy/modules/system/logging.te
++++ b/policy/modules/system/logging.te
+@@ -262,6 +262,7 @@ allow audisp_remote_t self:capability { setuid setpcap };
+ allow audisp_remote_t self:process { getcap setcap };
+ allow audisp_remote_t self:tcp_socket create_socket_perms;
+ allow audisp_remote_t var_log_t:dir search_dir_perms;
++allow audisp_remote_t var_log_t:lnk_file read_lnk_file_perms;
+ 
+ manage_dirs_pattern(audisp_remote_t, audit_spool_t, audit_spool_t)
+ manage_files_pattern(audisp_remote_t, audit_spool_t, audit_spool_t)
+-- 
+1.7.11.7
+
recipes-security/refpolicy/refpolicy_2.20130424.inc +2 -0
index 08ed04c..c3c7732 100644
@@ -37,6 +37,8 @@ SRC_URI += "file://poky-fc-subs_dist.patch \
 SRC_URI += "file://poky-policy-add-syslogd_t-to-trusted-object.patch \
             file://poky-policy-add-rules-for-var-log-symlink.patch \
             file://poky-policy-add-rules-for-var-log-symlink-apache.patch \
+            file://poky-policy-add-rules-for-var-log-symlink-audisp_remote_t.patch \
+            file://poky-policy-add-rules-for-syslogd_t-symlink.patch \
             file://poky-policy-add-rules-for-var-cache-symlink.patch \
             file://poky-policy-add-rules-for-tmp-symlink.patch \
             file://poky-policy-add-rules-for-bsdpty_device_t.patch \
Signature · 1 line
1.7.9.5
author
#3 lore raw

PATCH 3/4 refpolicy: add targeted policy type

In reply to [email protected]

From: Wenzong Fan <[email protected]>

This SELinux policy would targeted most of service domains for lock down, and users and admins will login in with unconfined_t domain.

So they would have the same access to the system as if SELinux was not enabled, when running commands and services which are not targeted.

Signed-off-by Wenzong Fan <[email protected]>
---
 ...olicy-fix-optional-issue-on-sysadm-module.patch |   60 ++++++
 .../refpolicy-unconfined_u-default-user.patch      |  198 ++++++++++++++++++++
 .../refpolicy/refpolicy-targeted_2.20130424.bb     |   18 ++
 3 files changed, 276 insertions(+)
 create mode 100644 recipes-security/refpolicy/refpolicy-targeted/refpolicy-fix-optional-issue-on-sysadm-module.patch
 create mode 100644 recipes-security/refpolicy/refpolicy-targeted/refpolicy-unconfined_u-default-user.patch
 create mode 100644 recipes-security/refpolicy/refpolicy-targeted_2.20130424.bb
recipes-security/refpolicy/refpolicy-targeted/refpolicy-fix-optional-issue-on-sysadm-module.patch new file +60 -0
new file mode 100644
index 0000000..44dff5e
@@ -0,0 +1,60 @@
+Subject: [PATCH] refpolicy: fix optional issue on sysadm module
+
+init and locallogin modules have a depend for sysadm module because
+they have called sysadm interfaces(sysadm_shell_domtrans). Since
+sysadm is not a core module, we could make the sysadm_shell_domtrans
+calls optionally by optional_policy.
+
+So, we could make the minimum policy without sysadm module.
+
+Upstream-Status: pending
+
+Signed-off-by: Xin Ouyang <[email protected]>
+---
+ policy/modules/system/init.te       | 14 ++++++++------
+ policy/modules/system/locallogin.te |  4 +++-
+ 2 files changed, 11 insertions(+), 7 deletions(-)
+
+diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
+index 4a88fa1..4548a7e 100644
+--- a/policy/modules/system/init.te
++++ b/policy/modules/system/init.te
+@@ -188,12 +188,14 @@ ifdef(`distro_redhat',`
+ 	fs_tmpfs_filetrans(init_t, initctl_t, fifo_file)
+ ')
+ 
+-tunable_policy(`init_upstart',`
+-	corecmd_shell_domtrans(init_t, initrc_t)
+-',`
+-	# Run the shell in the sysadm role for single-user mode.
+-	# causes problems with upstart
+-	sysadm_shell_domtrans(init_t)
++# Run the shell in the sysadm role for single-user mode.
++# causes problems with upstart
++optional_policy(`
++	tunable_policy(`init_upstart',`
++		corecmd_shell_domtrans(init_t, initrc_t)
++	',`
++		sysadm_shell_domtrans(init_t)
++	')
+ ')
+ 
+ optional_policy(`
+diff --git a/policy/modules/system/locallogin.te b/policy/modules/system/locallogin.te
+index f5a5de7..d942f05 100644
+--- a/policy/modules/system/locallogin.te
++++ b/policy/modules/system/locallogin.te
+@@ -239,7 +239,9 @@ userdom_use_unpriv_users_fds(sulogin_t)
+ userdom_search_user_home_dirs(sulogin_t)
+ userdom_use_user_ptys(sulogin_t)
+ 
+-sysadm_shell_domtrans(sulogin_t)
++optional_policy(`
++	sysadm_shell_domtrans(sulogin_t)
++')
+ 
+ # suse and debian do not use pam with sulogin...
+ ifdef(`distro_suse', `define(`sulogin_no_pam')')
+-- 
+1.7.11.7
+
recipes-security/refpolicy/refpolicy-targeted/refpolicy-unconfined_u-default-user.patch new file +198 -0

198 lines not on this page · raw message

recipes-security/refpolicy/refpolicy-targeted_2.20130424.bb new file +18 -0
new file mode 100644
index 0000000..0f954ec
@@ -0,0 +1,18 @@
+SUMMARY = "SELinux targeted policy"
+DESCRIPTION = "\
+This is the reference policy for SELinux targeted most of service domains \
+for lock down. \
+Users and admins will login in with unconfined_t domain, so they would have \
+the same access to the system as if SELinux was not enabled.\
+"
+
+FILESEXTRAPATHS_prepend := "${THISDIR}/refpolicy-${PV}:"
+
+POLICY_NAME = "targeted"
+POLICY_TYPE = "mcs"
+POLICY_MLS_SENS = "0"
+
+include refpolicy_${PV}.inc
+
+SRC_URI += "file://refpolicy-fix-optional-issue-on-sysadm-module.patch \
+	file://refpolicy-unconfined_u-default-user.patch"
Signature · 1 line
1.7.9.5
author
#4 lore raw

PATCH 4/4 refpolicy: add minimum targeted policy

In reply to [email protected]

From: Wenzong Fan <[email protected]>

This is a minimum targeted policy with just core policy modules, and could be used as a base for customizing targeted policy. Pretty much everything runs as initrc_t or unconfined_t so all of the domains are unconfined.

Signed-off-by Wenzong Fan <[email protected]>
---
 .../refpolicy/refpolicy-minimum_2.20130424.bb      |   46 ++++++++++++++++++++
 1 file changed, 46 insertions(+)
 create mode 100644 recipes-security/refpolicy/refpolicy-minimum_2.20130424.bb
recipes-security/refpolicy/refpolicy-minimum_2.20130424.bb new file +46 -0
new file mode 100644
index 0000000..e904810
@@ -0,0 +1,46 @@
+include refpolicy-targeted_${PV}.bb
+
+SUMMARY = "SELinux minimum policy"
+DESCRIPTION = "\
+This is a minimum reference policy with just core policy modules, and \
+could be used as a base for customizing targeted policy. \
+Pretty much everything runs as initrc_t or unconfined_t so all of the \
+domains are unconfined. \
+"
+
+POLICY_NAME = "minimum"
+
+FILESEXTRAPATHS_prepend := "${THISDIR}/files:${THISDIR}/refpolicy-${PV}:${THISDIR}/refpolicy-targeted:"
+
+CORE_POLICY_MODULES = "unconfined \
+	selinuxutil storage sysnetwork \
+	application libraries miscfiles logging userdomain \
+	init mount modutils getty authlogin locallogin \
+	"
+
+# nscd caches libc-issued requests to the name service.
+# Without nscd.pp, commands want to use these caches will be blocked.
+EXTRA_POLICY_MODULES += "nscd"
+
+# pam_mail module enables checking and display of mailbox status upon
+# "login", so "login" process will access to /var/spool/mail.
+EXTRA_POLICY_MODULES += "mta"
+
+POLICY_MODULES_MIN = "${CORE_POLICY_MODULES} ${EXTRA_POLICY_MODULES}"
+
+prepare_policy_store () {
+	oe_runmake install \
+		DESTDIR=${D}
+
+	# Prepare to create policy store
+	mkdir -p ${D}${sysconfdir}/selinux/
+	mkdir -p ${D}${sysconfdir}/selinux/${POLICY_NAME}/policy
+	mkdir -p ${D}${sysconfdir}/selinux/${POLICY_NAME}/modules/active/modules
+	mkdir -p ${D}${sysconfdir}/selinux/${POLICY_NAME}/contexts/files
+	bzip2 -c ${D}${datadir}/selinux/${POLICY_NAME}/base.pp  > \
+		${D}${sysconfdir}/selinux/${POLICY_NAME}/modules/active/base.pp
+	for i in ${POLICY_MODULES_MIN}; do
+		bzip2 -c ${D}${datadir}/selinux/${POLICY_NAME}/$i.pp > \
+			${D}${sysconfdir}/selinux/${POLICY_NAME}/modules/active/modules/$i.pp
+	done
+}
Signature · 1 line
1.7.9.5
#5 lore raw
In reply to [email protected]
Quoted 33 lines · 于 14-3-25 上午9:07, [email protected] 写道:

From: Wenzong Fan <[email protected]>

Changes:
* backport tmpfs_t patch from upstream;
* add rules for /var/log symlink on poky;
* add targeted policy type
* add minimum targeted policy

The following changes since commit a6079a43719e79e12a57e609923a0cccdba06916:

   refpolicy: fix real path for su.shadow (2014-02-13 10:52:07 -0500)

are available in the git repository at:

git://git.pokylinux.org/poky-contrib wenzong/ref-minimum
http://git.pokylinux.org/cgit.cgi/poky-contrib/log/?h=wenzong/ref-minimum

Wenzong Fan (4):
refpolicy: associate tmpfs_t (shm) to device_t (devtmpfs) file
systems
refpolicy: add rules for /var/log symlink on poky
refpolicy: add targeted policy type
refpolicy: add minimum targeted policy

  ...associate-tmpfs_t-shm-to-device_t-devtmpf.patch |   30 +++
  ...ky-policy-add-rules-for-syslogd_t-symlink.patch |   30 +++
  ...rules-for-var-log-symlink-audisp_remote_t.patch |   29 +++
  .../refpolicy/refpolicy-minimum_2.20130424.bb      |   46 +++++
  ...olicy-fix-optional-issue-on-sysadm-module.patch |   60 ++++++
  .../refpolicy-unconfined_u-default-user.patch      |  198 ++++++++++++++++++++
  .../refpolicy/refpolicy-targeted_2.20130424.bb     |   18 ++
  .../refpolicy/refpolicy_2.20130424.inc             |    3 +
  8 files changed, 414 insertions(+)
Quoted 8 lines

create mode 100644 recipes-security/refpolicy/refpolicy-2.20130424/filesystem-associate-tmpfs_t-shm-to-device_t-devtmpf.patch create mode 100644 recipes-security/refpolicy/refpolicy-2.20130424/poky-policy-add-rules-for-syslogd_t-symlink.patch create mode 100644 recipes-security/refpolicy/refpolicy-2.20130424/poky-policy-add-rules-for-var-log-symlink-audisp_remote_t.patch create mode 100644 recipes-security/refpolicy/refpolicy-minimum_2.20130424.bb
create mode 100644 recipes-security/refpolicy/refpolicy-targeted/refpolicy-fix-optional-issue-on-sysadm-module.patch create mode 100644 recipes-security/refpolicy/refpolicy-targeted/refpolicy-unconfined_u-default-user.patch create mode 100644 recipes-security/refpolicy/refpolicy-targeted_2.20130424.bb

Ack. :)

Signature · 1 line
- Pascal
#6 lore raw
In reply to [email protected]

Hey Wenzong,

I merged two of these four.

Quoted 5 lines · [[yocto] [meta-selinux][PATCH 0/4] add targeted/minimum policy and some…

From: Wenzong Fan <[email protected]>

Changes:
* backport tmpfs_t patch from upstream;
* add rules for /var/log symlink on poky;

These both went in. These:

Quoted 2 lines

* add targeted policy type
* add minimum targeted policy

I'm less clear on. They both look like significant changes to refpolicy-* behaviour, which is fine, but in that case I think it'd be better to give them a different name. Or one that differentiates them significantly. For example the "minimum" policy has users unconfined and applications confined? Or neither? I'm not sure what the value is of these.

If they really are just specialized versions of the standard reference policy, they should at least be ported to use the refpolicy_common infrastructure Phil set up a while back.

Thanks,
-J.

Quoted 34 lines

The following changes since commit a6079a43719e79e12a57e609923a0cccdba06916:

refpolicy: fix real path for su.shadow (2014-02-13 10:52:07 -0500)

are available in the git repository at:

git://git.pokylinux.org/poky-contrib wenzong/ref-minimum
http://git.pokylinux.org/cgit.cgi/poky-contrib/log/?h=wenzong/ref-minimum

Wenzong Fan (4):
refpolicy: associate tmpfs_t (shm) to device_t (devtmpfs) file
systems
refpolicy: add rules for /var/log symlink on poky
refpolicy: add targeted policy type
refpolicy: add minimum targeted policy

 ...associate-tmpfs_t-shm-to-device_t-devtmpf.patch |   30 +++
 ...ky-policy-add-rules-for-syslogd_t-symlink.patch |   30 +++
 ...rules-for-var-log-symlink-audisp_remote_t.patch |   29 +++
 .../refpolicy/refpolicy-minimum_2.20130424.bb      |   46 +++++
 ...olicy-fix-optional-issue-on-sysadm-module.patch |   60 ++++++
 .../refpolicy-unconfined_u-default-user.patch      |  198 ++++++++++++++++++++
 .../refpolicy/refpolicy-targeted_2.20130424.bb     |   18 ++
 .../refpolicy/refpolicy_2.20130424.inc             |    3 +
 8 files changed, 414 insertions(+)
 create mode 100644 recipes-security/refpolicy/refpolicy-2.20130424/filesystem-associate-tmpfs_t-shm-to-device_t-devtmpf.patch
 create mode 100644 recipes-security/refpolicy/refpolicy-2.20130424/poky-policy-add-rules-for-syslogd_t-symlink.patch
 create mode 100644 recipes-security/refpolicy/refpolicy-2.20130424/poky-policy-add-rules-for-var-log-symlink-audisp_remote_t.patch
 create mode 100644 recipes-security/refpolicy/refpolicy-minimum_2.20130424.bb
 create mode 100644 recipes-security/refpolicy/refpolicy-targeted/refpolicy-fix-optional-issue-on-sysadm-module.patch
 create mode 100644 recipes-security/refpolicy/refpolicy-targeted/refpolicy-unconfined_u-default-user.patch
 create mode 100644 recipes-security/refpolicy/refpolicy-targeted_2.20130424.bb
Signature · 2 lines
-Joe MacDonald.
:wq
#7 lore raw
Quoted 24 lines · Joe MacDonald

Hey Wenzong,

I merged two of these four.

Quoted 5 lines · [[yocto] [meta-selinux][PATCH 0/4] add targeted/minimum policy and some…

From: Wenzong Fan <[email protected]>

Changes:
* backport tmpfs_t patch from upstream;
* add rules for /var/log symlink on poky;

These both went in. These:

Quoted 2 lines

* add targeted policy type
* add minimum targeted policy

I'm less clear on. They both look like significant changes to refpolicy-* behaviour, which is fine, but in that case I think it'd be better to give them a different name. Or one that differentiates them significantly. For example the "minimum" policy has users unconfined and applications confined? Or neither? I'm not sure what the value is of these.

Quoted 3 lines

If they really are just specialized versions of the standard reference policy, they should at least be ported to use the refpolicy_common infrastructure Phil set up a while back.

Hi Joe&Wenzong,

According to the origin design, both policy types are targeted policies.

For targeted policies,
* Users will login into shells on unconfined domain.
* For applications with no policy module or with policy module disabled, they will also run on unconfined domain.
* For applications "targeted", they would have policy module enabled, with rules to do domtrans from unconfined/init* domain to their own domain.

The result will be:
- standard/mls :
un-ruled applications(usually bin_t) will run on unconfined domain,
so operations will *not* be blocked.
- targeted/minimum
un-ruled applications will run on user's current domain, such as
user_t,sysadm_t, so most privileged operations will be blocked.

Difference between refpolicy-minium&refpolicy-targeted
* refpolicy-minium = targeted policy with only core policies
It should just be used for admins to defined their own policy.
For example, a httpd server could just use refpolicy-minium + httpd
module. Actually, I have thought to use refpolicy-targeted-minium as its name, but not in the end.
* refpolicy-targeted = targeted policy with all 300+ modules

Thanks. :)

- Pascal

Quoted 38 lines

Thanks,
-J.

Quoted 34 lines

The following changes since commit a6079a43719e79e12a57e609923a0cccdba06916:

   refpolicy: fix real path for su.shadow (2014-02-13 10:52:07 -0500)

are available in the git repository at:

git://git.pokylinux.org/poky-contrib wenzong/ref-minimum
http://git.pokylinux.org/cgit.cgi/poky-contrib/log/?h=wenzong/ref-minimum

Wenzong Fan (4):
refpolicy: associate tmpfs_t (shm) to device_t (devtmpfs) file
systems
refpolicy: add rules for /var/log symlink on poky
refpolicy: add targeted policy type
refpolicy: add minimum targeted policy

  ...associate-tmpfs_t-shm-to-device_t-devtmpf.patch |   30 +++
  ...ky-policy-add-rules-for-syslogd_t-symlink.patch |   30 +++
  ...rules-for-var-log-symlink-audisp_remote_t.patch |   29 +++
  .../refpolicy/refpolicy-minimum_2.20130424.bb      |   46 +++++
  ...olicy-fix-optional-issue-on-sysadm-module.patch |   60 ++++++
  .../refpolicy-unconfined_u-default-user.patch      |  198 ++++++++++++++++++++
  .../refpolicy/refpolicy-targeted_2.20130424.bb     |   18 ++
  .../refpolicy/refpolicy_2.20130424.inc             |    3 +
  8 files changed, 414 insertions(+)

create mode 100644 recipes-security/refpolicy/refpolicy-2.20130424/filesystem-associate-tmpfs_t-shm-to-device_t-devtmpf.patch create mode 100644 recipes-security/refpolicy/refpolicy-2.20130424/poky-policy-add-rules-for-syslogd_t-symlink.patch create mode 100644 recipes-security/refpolicy/refpolicy-2.20130424/poky-policy-add-rules-for-var-log-symlink-audisp_remote_t.patch create mode 100644 recipes-security/refpolicy/refpolicy-minimum_2.20130424.bb
create mode 100644 recipes-security/refpolicy/refpolicy-targeted/refpolicy-fix-optional-issue-on-sysadm-module.patch create mode 100644 recipes-security/refpolicy/refpolicy-targeted/refpolicy-unconfined_u-default-user.patch create mode 100644 recipes-security/refpolicy/refpolicy-targeted_2.20130424.bb

Signature · 1 line
- Pascal
#8 lore raw
Quoted 41 lines · Pascal Ouyang
Quoted 25 lines · Joe MacDonald

Hey Wenzong,

I merged two of these four.

[[yocto] [meta-selinux][PATCH 0/4] add targeted/minimum policy and

Quoted 5 lines · some updates] On 14.03.24 (Mon 21:07) [email protected] wrote:

From: Wenzong Fan <[email protected]>

Changes:
* backport tmpfs_t patch from upstream;
* add rules for /var/log symlink on poky;

These both went in. These:

Quoted 2 lines

* add targeted policy type
* add minimum targeted policy

I'm less clear on. They both look like significant changes to refpolicy-* behaviour, which is fine, but in that case I think it'd be better to give them a different name. Or one that differentiates them significantly. For example the "minimum" policy has users unconfined and applications confined? Or neither? I'm not sure what the value is of these.

Quoted 3 lines

If they really are just specialized versions of the standard reference policy, they should at least be ported to use the refpolicy_common infrastructure Phil set up a while back.

Hi Joe&Wenzong,

According to the origin design, both policy types are targeted policies.

For targeted policies,
* Users will login into shells on unconfined domain.
* For applications with no policy module or with policy module disabled, they will also run on unconfined domain.
* For applications "targeted", they would have policy module enabled, with rules to do domtrans from unconfined/init* domain to their own domain.

Quoted 4 lines

The result will be:
- standard/mls :
un-ruled applications(usually bin_t) will run on unconfined domain,
so operations will *not* be blocked.

s#standard/mls#targeted/minimum#

Quoted 4 lines

- targeted/minimum
un-ruled applications will run on user's current domain, such as
user_t,sysadm_t, so most privileged operations will be blocked.

s#targeted/minimum#standard/mls#

:-;

- Pascal

Quoted 69 lines

Difference between refpolicy-minium&refpolicy-targeted
* refpolicy-minium = targeted policy with only core policies It should just be used for admins to defined their own policy. For example, a httpd server could just use refpolicy-minium + httpd
module. Actually, I have thought to use refpolicy-targeted-minium as its name, but not in the end.
* refpolicy-targeted = targeted policy with all 300+ modules

Thanks. :)

- Pascal

Quoted 54 lines

Thanks,
-J.

Quoted 50 lines

The following changes since commit
a6079a43719e79e12a57e609923a0cccdba06916:

   refpolicy: fix real path for su.shadow (2014-02-13 10:52:07 -0500)

are available in the git repository at:

git://git.pokylinux.org/poky-contrib wenzong/ref-minimum

http://git.pokylinux.org/cgit.cgi/poky-contrib/log/?h=wenzong/ref-minimum

Wenzong Fan (4):
refpolicy: associate tmpfs_t (shm) to device_t (devtmpfs) file
systems
refpolicy: add rules for /var/log symlink on poky
refpolicy: add targeted policy type
refpolicy: add minimum targeted policy

  ...associate-tmpfs_t-shm-to-device_t-devtmpf.patch |   30 +++
  ...ky-policy-add-rules-for-syslogd_t-symlink.patch |   30 +++
  ...rules-for-var-log-symlink-audisp_remote_t.patch |   29 +++
  .../refpolicy/refpolicy-minimum_2.20130424.bb      |   46 +++++
  ...olicy-fix-optional-issue-on-sysadm-module.patch |   60 ++++++
  .../refpolicy-unconfined_u-default-user.patch      |  198
++++++++++++++++++++
  .../refpolicy/refpolicy-targeted_2.20130424.bb     |   18 ++
  .../refpolicy/refpolicy_2.20130424.inc             |    3 +
  8 files changed, 414 insertions(+)

create mode 100644
recipes-security/refpolicy/refpolicy-2.20130424/filesystem-associate-tmpfs_t-shm-to-device_t-devtmpf.patch

create mode 100644
recipes-security/refpolicy/refpolicy-2.20130424/poky-policy-add-rules-for-syslogd_t-symlink.patch

create mode 100644
recipes-security/refpolicy/refpolicy-2.20130424/poky-policy-add-rules-for-var-log-symlink-audisp_remote_t.patch

create mode 100644
recipes-security/refpolicy/refpolicy-minimum_2.20130424.bb
create mode 100644
recipes-security/refpolicy/refpolicy-targeted/refpolicy-fix-optional-issue-on-sysadm-module.patch

create mode 100644
recipes-security/refpolicy/refpolicy-targeted/refpolicy-unconfined_u-default-user.patch

create mode 100644
recipes-security/refpolicy/refpolicy-targeted_2.20130424.bb

Signature · 1 line
- Pascal
#9 lore raw

Hey guys,

Sorry about the delayed response on these, I merged them today with a minor update to the targeted description based on the explanation below.

Thanks,
-J.

Quoted 131 lines · [Re: [yocto] [meta-selinux][PATCH 0/4] add targeted/minimum policy and some…
Quoted 41 lines · Pascal Ouyang
Quoted 25 lines · Joe MacDonald

Hey Wenzong,

I merged two of these four.

[[yocto] [meta-selinux][PATCH 0/4] add targeted/minimum policy and

Quoted 5 lines · some updates] On 14.03.24 (Mon 21:07) [email protected] wrote:

From: Wenzong Fan <[email protected]>

Changes:
* backport tmpfs_t patch from upstream;
* add rules for /var/log symlink on poky;

These both went in. These:

Quoted 2 lines

* add targeted policy type
* add minimum targeted policy

I'm less clear on. They both look like significant changes to refpolicy-* behaviour, which is fine, but in that case I think it'd be better to give them a different name. Or one that differentiates them significantly. For example the "minimum" policy has users unconfined and applications confined? Or neither? I'm not sure what the value is of these.

Quoted 3 lines

If they really are just specialized versions of the standard reference policy, they should at least be ported to use the refpolicy_common infrastructure Phil set up a while back.

Hi Joe&Wenzong,

According to the origin design, both policy types are targeted policies.

For targeted policies,
* Users will login into shells on unconfined domain.
* For applications with no policy module or with policy module disabled, they will also run on unconfined domain.
* For applications "targeted", they would have policy module enabled, with rules to do domtrans from unconfined/init* domain to their own domain.

Quoted 4 lines

The result will be:
- standard/mls :
un-ruled applications(usually bin_t) will run on unconfined domain,
so operations will *not* be blocked.

s#standard/mls#targeted/minimum#

Quoted 4 lines

- targeted/minimum
un-ruled applications will run on user's current domain, such as
user_t,sysadm_t, so most privileged operations will be blocked.

s#targeted/minimum#standard/mls#

:-;

- Pascal

Quoted 69 lines

Difference between refpolicy-minium&refpolicy-targeted
* refpolicy-minium = targeted policy with only core policies It should just be used for admins to defined their own policy. For example, a httpd server could just use refpolicy-minium + httpd
module. Actually, I have thought to use refpolicy-targeted-minium as its name, but not in the end.
* refpolicy-targeted = targeted policy with all 300+ modules

Thanks. :)

- Pascal

Quoted 54 lines

Thanks,
-J.

Quoted 50 lines

The following changes since commit
a6079a43719e79e12a57e609923a0cccdba06916:

refpolicy: fix real path for su.shadow (2014-02-13 10:52:07 -0500)

are available in the git repository at:

git://git.pokylinux.org/poky-contrib wenzong/ref-minimum

http://git.pokylinux.org/cgit.cgi/poky-contrib/log/?h=wenzong/ref-minimum

Wenzong Fan (4):
refpolicy: associate tmpfs_t (shm) to device_t (devtmpfs) file
systems
refpolicy: add rules for /var/log symlink on poky
refpolicy: add targeted policy type
refpolicy: add minimum targeted policy

 ...associate-tmpfs_t-shm-to-device_t-devtmpf.patch |   30 +++
 ...ky-policy-add-rules-for-syslogd_t-symlink.patch |   30 +++
 ...rules-for-var-log-symlink-audisp_remote_t.patch |   29 +++
 .../refpolicy/refpolicy-minimum_2.20130424.bb      |   46 +++++
 ...olicy-fix-optional-issue-on-sysadm-module.patch |   60 ++++++
 .../refpolicy-unconfined_u-default-user.patch      |  198
++++++++++++++++++++
 .../refpolicy/refpolicy-targeted_2.20130424.bb     |   18 ++
 .../refpolicy/refpolicy_2.20130424.inc             |    3 +
 8 files changed, 414 insertions(+)
 create mode 100644

recipes-security/refpolicy/refpolicy-2.20130424/filesystem-associate-tmpfs_t-shm-to-device_t-devtmpf.patch

 create mode 100644

recipes-security/refpolicy/refpolicy-2.20130424/poky-policy-add-rules-for-syslogd_t-symlink.patch

 create mode 100644

recipes-security/refpolicy/refpolicy-2.20130424/poky-policy-add-rules-for-var-log-symlink-audisp_remote_t.patch

 create mode 100644
recipes-security/refpolicy/refpolicy-minimum_2.20130424.bb
 create mode 100644

recipes-security/refpolicy/refpolicy-targeted/refpolicy-fix-optional-issue-on-sysadm-module.patch

 create mode 100644

recipes-security/refpolicy/refpolicy-targeted/refpolicy-unconfined_u-default-user.patch

 create mode 100644

recipes-security/refpolicy/refpolicy-targeted_2.20130424.bb

Signature · 2 lines
-Joe MacDonald.
:wq
author
#10 lore raw
In reply to Pascal Ouyang
Quoted 26 lines · Pascal Ouyang
Quoted 25 lines · Joe MacDonald

Hey Wenzong,

I merged two of these four.

[[yocto] [meta-selinux][PATCH 0/4] add targeted/minimum policy and

Quoted 5 lines · some updates] On 14.03.24 (Mon 21:07) [email protected] wrote:

From: Wenzong Fan <[email protected]>

Changes:
* backport tmpfs_t patch from upstream;
* add rules for /var/log symlink on poky;

These both went in. These:

Quoted 2 lines

* add targeted policy type
* add minimum targeted policy

I'm less clear on. They both look like significant changes to refpolicy-* behaviour, which is fine, but in that case I think it'd be better to give them a different name. Or one that differentiates them significantly. For example the "minimum" policy has users unconfined and applications confined? Or neither? I'm not sure what the value is of these.

Quoted 3 lines
Quoted 3 lines

If they really are just specialized versions of the standard reference policy, they should at least be ported to use the refpolicy_common infrastructure Phil set up a while back.

We have used the refpolicy_common via: include refpolicy_${PV}.inc -> refpolicy_common.inc

And appreciate for Pascal clarify the usage & difference between those two policies:)

Wenzong

Quoted 89 lines

Hi Joe&Wenzong,

According to the origin design, both policy types are targeted policies.

For targeted policies,
* Users will login into shells on unconfined domain.
* For applications with no policy module or with policy module disabled, they will also run on unconfined domain.
* For applications "targeted", they would have policy module enabled, with rules to do domtrans from unconfined/init* domain to their own domain.

The result will be:
- standard/mls :
un-ruled applications(usually bin_t) will run on unconfined domain,
so operations will *not* be blocked.
- targeted/minimum
un-ruled applications will run on user's current domain, such as
user_t,sysadm_t, so most privileged operations will be blocked.

Difference between refpolicy-minium&refpolicy-targeted
* refpolicy-minium = targeted policy with only core policies It should just be used for admins to defined their own policy. For example, a httpd server could just use refpolicy-minium + httpd
module. Actually, I have thought to use refpolicy-targeted-minium as its name, but not in the end.
* refpolicy-targeted = targeted policy with all 300+ modules

Thanks. :)

- Pascal

Quoted 54 lines

Thanks,
-J.

Quoted 50 lines

The following changes since commit
a6079a43719e79e12a57e609923a0cccdba06916:

   refpolicy: fix real path for su.shadow (2014-02-13 10:52:07 -0500)

are available in the git repository at:

git://git.pokylinux.org/poky-contrib wenzong/ref-minimum

http://git.pokylinux.org/cgit.cgi/poky-contrib/log/?h=wenzong/ref-minimum

Wenzong Fan (4):
refpolicy: associate tmpfs_t (shm) to device_t (devtmpfs) file
systems
refpolicy: add rules for /var/log symlink on poky
refpolicy: add targeted policy type
refpolicy: add minimum targeted policy

  ...associate-tmpfs_t-shm-to-device_t-devtmpf.patch |   30 +++
  ...ky-policy-add-rules-for-syslogd_t-symlink.patch |   30 +++
  ...rules-for-var-log-symlink-audisp_remote_t.patch |   29 +++
  .../refpolicy/refpolicy-minimum_2.20130424.bb      |   46 +++++
  ...olicy-fix-optional-issue-on-sysadm-module.patch |   60 ++++++
  .../refpolicy-unconfined_u-default-user.patch      |  198
++++++++++++++++++++
  .../refpolicy/refpolicy-targeted_2.20130424.bb     |   18 ++
  .../refpolicy/refpolicy_2.20130424.inc             |    3 +
  8 files changed, 414 insertions(+)

create mode 100644
recipes-security/refpolicy/refpolicy-2.20130424/filesystem-associate-tmpfs_t-shm-to-device_t-devtmpf.patch

create mode 100644
recipes-security/refpolicy/refpolicy-2.20130424/poky-policy-add-rules-for-syslogd_t-symlink.patch

create mode 100644
recipes-security/refpolicy/refpolicy-2.20130424/poky-policy-add-rules-for-var-log-symlink-audisp_remote_t.patch

create mode 100644
recipes-security/refpolicy/refpolicy-minimum_2.20130424.bb
create mode 100644
recipes-security/refpolicy/refpolicy-targeted/refpolicy-fix-optional-issue-on-sysadm-module.patch

create mode 100644
recipes-security/refpolicy/refpolicy-targeted/refpolicy-unconfined_u-default-user.patch

create mode 100644
recipes-security/refpolicy/refpolicy-targeted_2.20130424.bb