Supporting tmpfiles
cover Supporting tmpfiles
In this patchset a first attempt for tmpfiles is provided.
Dominick, we did look at your implementation in your CIL repo but didn't include that approach (with opt-in/opt-out object support) for now, instead opted for a "basic" set of permissions, and optional wider set (through a boolean).
Sven Vermeulen (5):
Introduce interface allowing relabeling from/to non-security file
types
Introduce interface to relabel from/to pidfile associated types Introduce interface to manage all non-security-sensitive resource
types
Introduce the tmpfiles_t domain
Give kmod access to tmpfiles
policy/modules/kernel/files.if | 73 +++++++++++++++++ policy/modules/system/modutils.te | 5 ++ policy/modules/system/tmpfiles.fc | 7 ++ policy/modules/system/tmpfiles.if | 161 ++++++++++++++++++++++++++++++++++++++ policy/modules/system/tmpfiles.te | 99 +++++++++++++++++++++++ 5 files changed, 345 insertions(+) create mode 100644 policy/modules/system/tmpfiles.fc create mode 100644 policy/modules/system/tmpfiles.if create mode 100644 policy/modules/system/tmpfiles.te
Signature · 1 line
1.8.5.5
PATCH 1/5 Introduce interface allowing relabeling from/to non-security file types
This interface can be used by domains that have a need for broad privileges towards the system, but should not need any privileges towards security-sensitive types.
--- policy/modules/kernel/files.if | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+)
policy/modules/kernel/files.if +29 -0
@@ -543,6 +543,35 @@ interface(`files_write_non_security_dirs',` allow $1 non_security_file_type:dir write; ') +######################################### +## <summary> +## Allow relabel from and to non-security types +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`files_relabel_all_non_security_file_types',` + gen_require(` + attribute non_security_file_type; + ') + + allow $1 non_security_file_type:dir list_dir_perms; + + relabel_dirs_pattern($1, non_security_file_type, non_security_file_type) + relabel_files_pattern($1, non_security_file_type, non_security_file_type) + relabel_lnk_files_pattern($1, non_security_file_type, non_security_file_type) + relabel_fifo_files_pattern($1, non_security_file_type, non_security_file_type) + relabel_sock_files_pattern($1, non_security_file_type, non_security_file_type) + + # This is only relabelfrom as there should be no device nodes marked with a type + # associated with the non_security_file_type attribute + relabelfrom_blk_files_pattern($1, non_security_file_type, non_security_file_type) + relabelfrom_chr_files_pattern($1, non_security_file_type, non_security_file_type) +') + ######################################## ## <summary> ## Allow attempts to manage non-security directories
Signature · 1 line
1.8.5.5
PATCH 1/5 Introduce interface allowing relabeling from/to non-security file types
Quoted 3 lines · Sven Vermeulen
This interface can be used by domains that have a need for broad privileges towards the system, but should not need any privileges towards security-sensitive types.
[..]
Quoted 8 lines
policy/modules/kernel/files.if +8
-0+interface(`files_relabel_all_non_security_file_types',` + gen_require(` + attribute non_security_file_type; + ') + + allow $1 non_security_file_type:dir list_dir_perms; + + relabel_dirs_pattern($1, non_security_file_type, non_security_file_type)
policy/modules/kernel/files.if interface(`files_write_non_security_dirs',` · line 573
Quoted 10 lines
policy/modules/kernel/files.if +10
-0+ relabel_files_pattern($1, non_security_file_type, non_security_file_type) + relabel_lnk_files_pattern($1, non_security_file_type, non_security_file_type) + relabel_fifo_files_pattern($1, non_security_file_type, non_security_file_type) + relabel_sock_files_pattern($1, non_security_file_type, non_security_file_type) + + # This is only relabelfrom as there should be no device nodes marked with a type + # associated with the non_security_file_type attribute + relabelfrom_blk_files_pattern($1, non_security_file_type, non_security_file_type) + relabelfrom_chr_files_pattern($1, non_security_file_type, non_security_file_type) +')
While there are a few interfaces that are like this with broad object class usage, I'd rather not have them. I'd prefer that they are broken up into individual interfaces. #3 patch is like this too.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 1/5 Introduce interface allowing relabeling from/to non-security file types
Quoted 19 lines · Christopher J. PeBenito
Quoted 3 lines · Sven Vermeulen
This interface can be used by domains that have a need for broad privileges towards the system, but should not need any privileges towards security-sensitive types.
[..]
Quoted 14 lines
policy/modules/kernel/files.if +14
-0+interface(`files_relabel_all_non_security_file_types',` + gen_require(` + attribute non_security_file_type; + ') + + allow $1 non_security_file_type:dir list_dir_perms; + + relabel_dirs_pattern($1, non_security_file_type, non_security_file_type) + relabel_files_pattern($1, non_security_file_type, non_security_file_type) + relabel_lnk_files_pattern($1, non_security_file_type, non_security_file_type) + relabel_fifo_files_pattern($1, non_security_file_type, non_security_file_type) + relabel_sock_files_pattern($1, non_security_file_type, non_security_file_type) + + # This is only relabelfrom as there should be no device nodes marked with a type
Quoted 8 lines
policy/modules/kernel/files.if interface(`files_write_non_security_dirs',` · line 573
Quoted 4 lines
policy/modules/kernel/files.if +4
-0+ # associated with the non_security_file_type attribute + relabelfrom_blk_files_pattern($1, non_security_file_type, non_security_file_type) + relabelfrom_chr_files_pattern($1, non_security_file_type, non_security_file_type) +')While there are a few interfaces that are like this with broad object class usage, I'd rather not have them. I'd prefer that they are broken up into individual interfaces. #3 patch is like this too.
As in, iterate over all the various types that would be matched?
Although I can do that, that might result in many, many more interfaces being necessary and having updates on the domain as users configure tmpfiles.
Or we can go the other route and not include the broad privileges to start with (only the basic resource types such as the pidfiles) until users start complaining about tmpfiles not creating the directory, socket or file, and adapt the policy as things go along.
Wkr,
Sven Vermeulen
PATCH 1/5 Introduce interface allowing relabeling from/to non-security file types
Quoted 29 lines · Sven Vermeulen
Quoted 19 lines · Christopher J. PeBenito
Quoted 3 lines · Sven Vermeulen
This interface can be used by domains that have a need for broad privileges towards the system, but should not need any privileges towards security-sensitive types.
[..]
Quoted 14 lines
policy/modules/kernel/files.if +14
-0+interface(`files_relabel_all_non_security_file_types',` + gen_require(` + attribute non_security_file_type; + ') + + allow $1 non_security_file_type:dir list_dir_perms; + + relabel_dirs_pattern($1, non_security_file_type, non_security_file_type) + relabel_files_pattern($1, non_security_file_type, non_security_file_type) + relabel_lnk_files_pattern($1, non_security_file_type, non_security_file_type) + relabel_fifo_files_pattern($1, non_security_file_type, non_security_file_type) + relabel_sock_files_pattern($1, non_security_file_type, non_security_file_type) + + # This is only relabelfrom as there should be no device nodes marked with a typeQuoted 8 lines
policy/modules/kernel/files.if interface(`files_write_non_security_dirs',` · line 573
Quoted 4 lines
policy/modules/kernel/files.if +4
-0+ # associated with the non_security_file_type attribute + relabelfrom_blk_files_pattern($1, non_security_file_type, non_security_file_type) + relabelfrom_chr_files_pattern($1, non_security_file_type, non_security_file_type) +')While there are a few interfaces that are like this with broad object class usage, I'd rather not have them. I'd prefer that they are broken up into individual interfaces. #3 patch is like this too.
Quoted 1 line
As in, iterate over all the various types that would be matched?
Yes.
Quoted 8 lines
Although I can do that, that might result in many, many more interfaces being necessary and having updates on the domain as users configure tmpfiles.
Or we can go the other route and not include the broad privileges to start with (only the basic resource types such as the pidfiles) until users start complaining about tmpfiles not creating the directory, socket or file, and adapt the policy as things go along.
I'm fine with that too.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 2/5 Introduce interface to relabel from/to pidfile associated types
In reply to Sven VermeulenThis interface can be used by domains needing wide relabel privileges towards the *_var_run_t and var_run_t types.
--- policy/modules/kernel/files.if | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+)
policy/modules/kernel/files.if +22 -0
@@ -6304,6 +6304,28 @@ interface(`files_delete_all_pid_dirs',` delete_dirs_pattern($1, pidfile, pidfile) ') +######################################### +## <summary> +## Allow relabeling from and to any pidfile associated type +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`files_relabel_all_pids',` + gen_require(` + attribute pidfile; + ') + + allow $1 pidfile:dir list_dir_perms; + + relabel_dirs_pattern($1, pidfile, pidfile) + relabel_files_pattern($1, pidfile, pidfile) + relabel_lnk_files_pattern($1, pidfile, pidfile) +') + ######################################## ## <summary> ## Create, read, write and delete all
Signature · 1 line
1.8.5.5
PATCH 3/5 Introduce interface to manage all non-security-sensitive resource types
In reply to Sven VermeulenThis interface can be used by domains that need wide management privileges on the various file-related types (directories, symbolic links and the like) but should not need this for security-sensitive resources.
--- policy/modules/kernel/files.if | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+)
policy/modules/kernel/files.if +22 -0
@@ -590,6 +590,28 @@ interface(`files_manage_non_security_dirs',` allow $1 non_security_file_type:dir manage_dir_perms; ') +######################################### +## <summary> +## Manage non-security-sensitive resource types +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`files_manage_all_non_security_file_types',` + gen_require(` + attribute non_security_file_type; + ') + + manage_dirs_pattern($1, non_security_file_type, non_security_file_type) + manage_files_pattern($1, non_security_file_type, non_security_file_type) + manage_lnk_files_pattern($1, non_security_file_type, non_security_file_type) + manage_fifo_files_pattern($1, non_security_file_type, non_security_file_type) + manage_sock_files_pattern($1, non_security_file_type, non_security_file_type) +') + ######################################## ## <summary> ## Get the attributes of all files.
Signature · 1 line
1.8.5.5
PATCH 4/5 Introduce the tmpfiles_t domain
In reply to Sven VermeulenThe tmpfiles application, as documented in [1], is used to prepare directory structures in runtime, volatile locations (such as /var/run, /run and perhaps even /tmp and /var/tmp).
[1] http://www.freedesktop.org/software/systemd/man/tmpfiles.d.html
The need for the tmpfiles application seems to came forward as systemd service files ("unit files") are not the flexible shell scripts that are used in init scripts (/etc/rc.d/init.d/* files). Whereas these init scripts usually did the preparation of runtime directories, the systemd service scripts do not (well, beyond the RuntimeDirectory= directive, that is).
Instead, services are required to create a tmpfiles configuration file inside one of the following locations, informing the tmpfiles application to create directories and files as needed:
(a.) /usr/lib/tmpfiles.d/ (*.conf) for packaged services (default settings) (b.) /run/tmpfiles.d/ (*.conf) for dynamically generated overrides of (a.) (c.) /etc/tmpfiles.d/ (*.conf) for local system administration overrides
of (a.) and (b.)
These files declare what action to perform on a specific location (such as create a directory) and which ownership to apply (similar to the install(1) application it seems).
Both in systemd as well as OpenRC the tmpfiles application is SELinux-aware, (re)setting the context of the target.
--- policy/modules/system/tmpfiles.fc | 7 ++ policy/modules/system/tmpfiles.if | 161 ++++++++++++++++++++++++++++++++++++++ policy/modules/system/tmpfiles.te | 99 +++++++++++++++++++++++ 3 files changed, 267 insertions(+) create mode 100644 policy/modules/system/tmpfiles.fc create mode 100644 policy/modules/system/tmpfiles.if create mode 100644 policy/modules/system/tmpfiles.te
policy/modules/system/tmpfiles.fc new file +7 -0
@@ -0,0 +1,7 @@ + +/etc/tmpfiles.d(/.*)? gen_context(system_u:object_r:tmpfiles_conf_t,s0) +/var/run/tmpfiles.d(/.*)? gen_context(system_u:object_r:tmpfiles_var_run_t,s0) + +/lib/rc/bin/checkpath -- gen_context(system_u:object_r:tmpfiles_exec_t,s0) +/lib/rc/sh/tmpfiles.sh -- gen_context(system_u:object_r:tmpfiles_exec_t,s0) +
policy/modules/system/tmpfiles.if new file +161 -0
161 lines not on this page · raw message
policy/modules/system/tmpfiles.te new file +99 -0
99 lines not on this page · raw message
Signature · 1 line
1.8.5.5
PATCH 4/5 Introduce the tmpfiles_t domain
Quoted 1 line · Sven Vermeulen
+policy_module(tmpfiles, 1.0.0)
[...]
policy/modules/system/tmpfiles.te line 26
Quoted 2 lines
policy/modules/system/tmpfiles.te new file +2
-0+type tmpfiles_var_run_t; +files_pid_file(tmpfiles_var_run_t)
Nothing really jumped out at me as being a problem, but since most (all?) distributions have moved towards these files being in /run, I'd prefer to get away from having "var_run" in the type names. Why don't we go with something like tmpfiles_run_t or tmpfiles_pid_t?
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 4/5 Introduce the tmpfiles_t domain
Quoted 11 lines · Christopher J. PeBenito
Quoted 1 line · Sven Vermeulen
+policy_module(tmpfiles, 1.0.0)
[...]
policy/modules/system/tmpfiles.te line 26
Quoted 2 lines
policy/modules/system/tmpfiles.te new file +2
-0+type tmpfiles_var_run_t; +files_pid_file(tmpfiles_var_run_t)Nothing really jumped out at me as being a problem, but since most (all?) distributions have moved towards these files being in /run, I'd prefer to get away from having "
var_run" in the type names. Why don't we go with something liketmpfiles_run_tortmpfiles_pid_t?
In that policy tmpfiles is allowed to create chars with type device_t
Also this is not tmpfiles, this is a shell script that mimics tmpfiles
tmpfiles does not run setfiles, it uses libselinux
PATCH 4/5 Introduce the tmpfiles_t domain
Quoted 13 lines · Dominick Grift
Quoted 11 lines · Christopher J. PeBenito
Quoted 1 line · Sven Vermeulen
+policy_module(tmpfiles, 1.0.0)
[...]
policy/modules/system/tmpfiles.te line 26
Quoted 2 lines
policy/modules/system/tmpfiles.te new file +2
-0+type tmpfiles_var_run_t; +files_pid_file(tmpfiles_var_run_t)Nothing really jumped out at me as being a problem, but since most (all?) distributions have moved towards these files being in /run, I'd prefer to get away from having "
var_run" in the type names. Why don't we go with something liketmpfiles_run_tortmpfiles_pid_t?
Quoted 3 lines
In that policy tmpfiles is allowed to create chars with type
device_tAlso this is not tmpfiles, this is a shell script that mimics tmpfiles
I think that's a matter of looking at things. I see "tmpfiles" as the API and functionality as described by freedesktop.org, and the main implementation of it is systemd-tmpfiles, but other implementations exist as well.
The reference policy has many examples of domains that are providing the rules for multiple implementations.
Quoted 1 line
tmpfiles does not run setfiles, it uses libselinux
I'll happily put the Gentoo specifics inside an ifdef(`distro_gentoo',...) block once I know which ones that would be.
Wkr,
Sven Vermeulen
PATCH 4/5 Introduce the tmpfiles_t domain
In reply to Christopher J. PeBenitoQuoted 10 lines · Christopher J. PeBenito
Quoted 1 line · Sven Vermeulen
+policy_module(tmpfiles, 1.0.0)
[...]
policy/modules/system/tmpfiles.te line 26
Quoted 2 lines
policy/modules/system/tmpfiles.te new file +2
-0+type tmpfiles_var_run_t; +files_pid_file(tmpfiles_var_run_t)Nothing really jumped out at me as being a problem, but since most (all?) distributions have moved towards these files being in /run, I'd prefer to get away from having "
var_run" in the type names. Why don't we go with something liketmpfiles_run_tortmpfiles_pid_t?
I prefer the _run_t suffix, even though this would mean that there will be interfaces ending with "_run" which aren't the standard _run interfaces (as in, assign role and perform a domain transition).
But unless some developer starts naming an application "read" or "manage", I think we can deal with that through the name: tmpfiles_read_run versus tmpfiles_run.
I'm okay with _pid_t too, but I prefer _run_t because _pid_t "sounds" like it is specific to pid files (*.pid) whereas /run resources are used for much, more more than that.
Wkr,
Sven Vermeulen
PATCH 4/5 Introduce the tmpfiles_t domain
Quoted 22 lines · Sven Vermeulen
Quoted 9 lines · Christopher J. PeBenito
Quoted 1 line · Sven Vermeulen
+policy_module(tmpfiles, 1.0.0)
[...]
policy/modules/system/tmpfiles.te line 26
Quoted 2 lines
policy/modules/system/tmpfiles.te new file +2
-0+type tmpfiles_var_run_t; +files_pid_file(tmpfiles_var_run_t)Nothing really jumped out at me as being a problem, but since most (all?) distributions have moved towards these files being in /run, I'd prefer to get away from having "
var_run" in the type names. Why don't we go with something liketmpfiles_run_tortmpfiles_pid_t?I prefer the
_run_tsuffix, even though this would mean that there will be interfaces ending with "_run" which aren't the standard_runinterfaces (as in, assign role and perform a domain transition).But unless some developer starts naming an application "read" or "manage", I think we can deal with that through the name:
tmpfiles_read_runversustmpfiles_run.I'm okay with
_pid_ttoo, but I prefer_run_tbecause_pid_t"sounds" like it is specific to pid files (*.pid) whereas /run resources are used for much, more more than that.
Quoted 6 lines
Wkr,
Sven Vermeulen
_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy
I like _run also.
PATCH 4/5 Introduce the tmpfiles_t domain
In reply to Sven VermeulenQuoted 16 lines · Sven Vermeulen
Quoted 10 lines · Christopher J. PeBenito
Quoted 1 line · Sven Vermeulen
+policy_module(tmpfiles, 1.0.0)
[...]
policy/modules/system/tmpfiles.te line 26
Quoted 2 lines
policy/modules/system/tmpfiles.te new file +2
-0+type tmpfiles_var_run_t; +files_pid_file(tmpfiles_var_run_t)Nothing really jumped out at me as being a problem, but since most (all?) distributions have moved towards these files being in /run, I'd prefer to get away from having "
var_run" in the type names. Why don't we go with something liketmpfiles_run_tortmpfiles_pid_t?I prefer the
_run_tsuffix, even though this would mean that there will be interfaces ending with "_run" which aren't the standard_runinterfaces (as in, assign role and perform a domain transition).
Quoted 7 lines
But unless some developer starts naming an application "read" or "manage", I think we can deal with that through the name:
tmpfiles_read_runversustmpfiles_run.I'm okay with
_pid_ttoo, but I prefer_run_tbecause_pid_t"sounds" like it is specific to pid files (*.pid) whereas /run resources are used for much, more more than that.
How about _runtime? There already are a couple types with that naming.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 5/5 Give kmod access to tmpfiles
In reply to Sven VermeulenUpon boot, the kmod application (running as insmod_t) can generate a tmpfiles configuration file to allow tmpfiles to relabel and set the required static device nodes for the kernel:
kmod static-nodes --format=tmpfiles --output=/run/tmpfiles.d/kmod.conf
This requires the insmod_t domain to have create/write privileges towards the /run/tmpfiles.d location.
--- policy/modules/system/modutils.te | 5 +++++ 1 file changed, 5 insertions(+)
policy/modules/system/modutils.te +5 -0
@@ -228,6 +228,11 @@ optional_policy(` ') optional_policy(` + tmpfiles_create_var_run_files(insmod_t) + tmpfiles_write_var_run_files(insmod_t) +') + +optional_policy(` unconfined_domain(insmod_t) unconfined_dontaudit_rw_pipes(insmod_t) ')
Signature · 1 line
1.8.5.5