Incomplete systemd-journald policy
cover Incomplete systemd-journald policy
This patchset is the result of "cleaning up" the journald part of Debian systemd patch and some research about why new allow rules were needed. It introduces some file labels and basic rules to enable applications to log to journald.
Please note that this patchset does NOT include:
* complete systemd-as-init support,
* file contexts and policy for systemd units,
* journalctl policy (to query logs from journald).
Moreover my system uses "volatile storage" for journald (and log-forwarding to syslog-ng). That's why there is nothing explicitly related to files in /var/log/journal in this patchset.
The last patch is a small clean-up in a Gentoo-specific part of logging.te. This patch may require attention from Gentoo developers before being accepted.
Last but not the least, the second patch introduces an interface to search init_var_run_t directories (such as /run/systemd). This interface is named init_search_pid_dirs in Fedora policy [1], which seems too restrictive for the purpose of the directory. If you have a better name for this interface, suggestion are welcome.
Nicolas Iooss (8):
Label systemd files in init module
Introduce init_search_run interface
Label systemd-journald files and directories
Support logging with /run/systemd/journal/dev-log
Label /dev/log symlink at boot time with systemd
Allow journald to read the kernel ring buffer and to use /dev/kmsg Allow journald to access to the state of all processes Remove redundant Gentoo-specific
term_append_unallocated_ttys(syslogd_t)
policy/modules/kernel/devices.if | 18 ++++++++++++++++++ policy/modules/system/init.fc | 6 ++++++ policy/modules/system/init.if | 19 +++++++++++++++++++ policy/modules/system/init.te | 11 ++++++++++- policy/modules/system/logging.fc | 8 ++++++++ policy/modules/system/logging.if | 25 ++++++++++++++++++++++++- policy/modules/system/logging.te | 7 ++++++- 7 files changed, 91 insertions(+), 3 deletions(-)
Signature · 1 line
2.0.4
PATCH 1/8 Label systemd files in init module
--- policy/modules/system/init.fc | 6 ++++++ policy/modules/system/init.te | 8 +++++++- 2 files changed, 13 insertions(+), 1 deletion(-)
policy/modules/system/init.fc +6 -0
@@ -25,6 +25,7 @@ ifdef(`distro_gentoo',` ifdef(`distro_gentoo', ` /lib/rc/init\.d(/.*)? gen_context(system_u:object_r:initrc_state_t,s0) ') +/lib/systemd/systemd -- gen_context(system_u:object_r:init_exec_t,s0) # # /sbin
@@ -42,6 +43,8 @@ ifdef(`distro_gentoo', ` # /usr/bin/sepg_ctl -- gen_context(system_u:object_r:initrc_exec_t,s0) +/usr/lib/systemd/systemd -- gen_context(system_u:object_r:init_exec_t,s0) + /usr/libexec/dcc/start-.* -- gen_context(system_u:object_r:initrc_exec_t,s0) /usr/libexec/dcc/stop-.* -- gen_context(system_u:object_r:initrc_exec_t,s0)
@@ -51,11 +54,14 @@ ifdef(`distro_gentoo', ` # # /var # +/var/lib/systemd(/.*)? gen_context(system_u:object_r:init_var_lib_t,s0) + /var/run/initctl -p gen_context(system_u:object_r:initctl_t,s0) /var/run/utmp -- gen_context(system_u:object_r:initrc_var_run_t,s0) /var/run/runlevel\.dir gen_context(system_u:object_r:initrc_var_run_t,s0) /var/run/random-seed -- gen_context(system_u:object_r:initrc_var_run_t,s0) /var/run/setmixer_flag -- gen_context(system_u:object_r:initrc_var_run_t,s0) +/var/run/systemd(/.*)? gen_context(system_u:object_r:init_var_run_t,s0) ifdef(`distro_debian',` /var/run/hotkey-setup -- gen_context(system_u:object_r:initrc_var_run_t,s0)
policy/modules/system/init.te +7 -1
@@ -40,12 +40,18 @@ kernel_domtrans_to(init_t, init_exec_t) role system_r types init_t; # -# init_var_run_t is the type for /var/run/shutdown.pid. +# init_var_run_t is the type for /var/run/shutdown.pid and /var/run/systemd. # type init_var_run_t; files_pid_file(init_var_run_t) # +# init_var_lib_t is the type for /var/lib/systemd. +# +type init_var_lib_t; +files_type(init_var_lib_t) + +# # initctl_t is the type of the named pipe created # by init during initialization. This pipe is used # to communicate with init.
Signature · 1 line
2.0.4
PATCH 2/8 Introduce init_search_run interface
In reply to Nicolas Iooss--- policy/modules/system/init.if | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+)
policy/modules/system/init.if +19 -0
@@ -1594,6 +1594,25 @@ interface(`init_dontaudit_read_script_status_files',` dontaudit $1 initrc_state_t:file read_file_perms; ') +###################################### +## <summary> +## Search the /run/systemd directory. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`init_search_run',` + gen_require(` + type init_var_run_t; + ') + + files_search_pids($1) + allow $1 init_var_run_t:dir search_dir_perms; +') + ######################################## ## <summary> ## Read init script temporary data.
Signature · 1 line
2.0.4
PATCH 3/8 Label systemd-journald files and directories
In reply to Nicolas Iooss--- policy/modules/system/logging.fc | 8 ++++++++ 1 file changed, 8 insertions(+)
policy/modules/system/logging.fc +8 -0
@@ -1,4 +1,5 @@ /dev/log -s gen_context(system_u:object_r:devlog_t,mls_systemhigh) +/dev/log -l gen_context(system_u:object_r:devlog_t,mls_systemhigh) /etc/rsyslog.conf gen_context(system_u:object_r:syslog_conf_t,s0) /etc/syslog.conf gen_context(system_u:object_r:syslog_conf_t,s0)
@@ -17,6 +18,8 @@ /sbin/syslogd -- gen_context(system_u:object_r:syslogd_exec_t,s0) /sbin/syslog-ng -- gen_context(system_u:object_r:syslogd_exec_t,s0) +/usr/lib/systemd/systemd-journald -- gen_context(system_u:object_r:syslogd_exec_t,s0) + /usr/sbin/klogd -- gen_context(system_u:object_r:klogd_exec_t,s0) /usr/sbin/metalog -- gen_context(system_u:object_r:syslogd_exec_t,s0) /usr/sbin/rklogd -- gen_context(system_u:object_r:klogd_exec_t,s0)
@@ -61,12 +64,17 @@ ifdef(`distro_redhat',` /var/run/auditd_sock -s gen_context(system_u:object_r:auditd_var_run_t,mls_systemhigh) /var/run/klogd\.pid -- gen_context(system_u:object_r:klogd_var_run_t,s0) /var/run/log -s gen_context(system_u:object_r:devlog_t,s0) +/var/run/log -d gen_context(system_u:object_r:var_log_t,s0-mls_systemhigh) +/var/run/log/journal(/.*)? gen_context(system_u:object_r:var_log_t,mls_systemhigh) /var/run/metalog\.pid -- gen_context(system_u:object_r:syslogd_var_run_t,s0) /var/run/rsyslogd\.pid -- gen_context(system_u:object_r:syslogd_var_run_t,mls_systemhigh) /var/run/syslogd\.pid -- gen_context(system_u:object_r:syslogd_var_run_t,mls_systemhigh) /var/run/syslog-ng.ctl -- gen_context(system_u:object_r:syslogd_var_run_t,s0) /var/run/syslog-ng\.pid -- gen_context(system_u:object_r:syslogd_var_run_t,mls_systemhigh) /var/run/syslog-ng(/.*)? gen_context(system_u:object_r:syslogd_var_run_t,s0) +/var/run/systemd/journal(/.*)? gen_context(system_u:object_r:syslogd_var_run_t,mls_systemhigh) +/var/run/systemd/journal/syslog -s gen_context(system_u:object_r:devlog_t,mls_systemhigh) +/var/run/systemd/journal/dev-log -s gen_context(system_u:object_r:devlog_t,mls_systemhigh) /var/spool/audit(/.*)? gen_context(system_u:object_r:audit_spool_t,mls_systemhigh) /var/spool/bacula/log(/.*)? gen_context(system_u:object_r:var_log_t,s0)
Signature · 1 line
2.0.4
PATCH 3/8 Label systemd-journald files and directories
policy/modules/system/logging.fc line 3
Quoted 12 lines · Nicolas Iooss
--- policy/modules/system/logging.fc | 8 ++++++++ 1 file changed, 8 insertions(+)policy/modules/system/logging.fc +1
-0@@ -1,4 +1,5 @@ /dev/log -s gen_context(system_u:object_r:devlog_t,mls_systemhigh) +/dev/log -l gen_context(system_u:object_r:devlog_t,mls_systemhigh)
The solution I chose for my personal policy is to just keep the links device_t. In my opinion it keeps things a bit simpler.
I may be overlooking an compelling argument to label the link with a private type.
Signature · 9 lines
http://subkeys.pgp.net:11371/pks/lookup?search=0x02DFF788&op=index Dominick Grift -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 648 bytes Desc: not available Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20140823/9b6f9549/attachment.bin
PATCH 3/8 Label systemd-journald files and directories
Quoted 17 lines · 2014-08-23 16:29 GMT+02:00 Dominick Grift wrote:
policy/modules/system/logging.fc line 3
Quoted 12 lines · Nicolas Iooss
--- policy/modules/system/logging.fc | 8 ++++++++ 1 file changed, 8 insertions(+)policy/modules/system/logging.fc +1
-0@@ -1,4 +1,5 @@ /dev/log -s gen_context(system_u:object_r:devlog_t,mls_systemhigh) +/dev/log -l gen_context(system_u:object_r:devlog_t,mls_systemhigh)The solution I chose for my personal policy is to just keep the links
device_t. In my opinion it keeps things a bit simpler.
Quoted 2 lines
I may be overlooking an compelling argument to label the link with a private type.
The reasons which explain why I did this are:
(a) refpolicy already supports reading devlog_t symlinks [1].
(b) I believed "device_t" was to be understood as meaning "things which are not yet precisely labeled in /dev".
(c) I believed only few domains were allowed to read device_t:lnk_files.
Even if (a) is an established fact, (b) is in fact false, as every symlink in /dev but /dev/log is labeled as device_t. (c) is also false, as the set of domains returned by "sesearch -A -t device_t -c lnk_file -p read" includes all of the domains returned by the same search with devlog_t on my system.
Moreover I agree with your argument "it keeps things a bit simple", as keeping /dev/log labeled as device_t makes patch 5/8 useless.
So I'll wait for other comments on this patchset and then submit a v2.
Thanks for your review,
Nicolas
PATCH 3/8 Label systemd-journald files and directories
Quoted 21 lines · Nicolas Iooss
Quoted 17 lines · 2014-08-23 16:29 GMT+02:00 Dominick Grift wrote:
policy/modules/system/logging.fc line 3
Quoted 12 lines · Nicolas Iooss
--- policy/modules/system/logging.fc | 8 ++++++++ 1 file changed, 8 insertions(+)policy/modules/system/logging.fc +1
-0@@ -1,4 +1,5 @@ /dev/log -s gen_context(system_u:object_r:devlog_t,mls_systemhigh) +/dev/log -l gen_context(system_u:object_r:devlog_t,mls_systemhigh)The solution I chose for my personal policy is to just keep the links
device_t. In my opinion it keeps things a bit simpler.Quoted 2 lines
I may be overlooking an compelling argument to label the link with a private type.
Quoted 6 lines
The reasons which explain why I did this are:
(a) refpolicy already supports reading
devlog_tsymlinks [1].
(b) I believed "device_t" was to be understood as meaning "things which are not yet precisely labeled in /dev".
(c) I believed only few domains were allowed to read device_t:lnk_files.
Yes, in my policy I did something that I am not really proud of
In refpolicy (I believe) anyone associated with domain (which is pretty much any process) can traverse device_t dirs. However in my policy the devices_search() macro uses a "dirs search" classmapping, which really extends "dir search" with "lnk_file read"
So in practice any domain is allowed to traverse device_t dirs, and is additionally allowed to read device_t symlinks
A bit overkill, and should probably revisit that if only for the sake of efficiency
(In fact i will add that to my TODO list right now)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 648 bytes
Desc: not available
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20140823/63f52474/attachment.bin
PATCH 3/8 Label systemd-journald files and directories
In reply to Nicolas IoossQuoted 6 lines · Nicolas Iooss
Quoted 5 lines · 2014-08-23 16:29 GMT+02:00 Dominick Grift wrote:
Quoted 4 lines · Nicolas Iooss
--- policy/modules/system/logging.fc | 8 ++++++++ 1 file changed, 8 insertions(+)
Quoted 11 lines
Quoted 11 lines
policy/modules/system/logging.fc line 3
Quoted 8 lines
policy/modules/system/logging.fc +1
-0@@ -1,4 +1,5 @@ /dev/log -s gen_context(system_u:object_r:devlog_t,mls_systemhigh) +/dev/log -l gen_context(system_u:object_r:devlog_t,mls_systemhigh)The solution I chose for my personal policy is to just keep the links
device_t. In my opinion it keeps things a bit simpler.
I agree.
Quoted 2 lines
Quoted 2 lines
I may be overlooking an compelling argument to label the link with a private type.
I can't think of any examples of that for system controlled objects.
Quoted 3 lines
The reasons which explain why I did this are:
(a) refpolicy already supports reading
devlog_tsymlinks [1].
It a vestige of the NSA example policy. Since we don't label the symlink devlog_t anymore, we should remove the rules.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 3/8 Label systemd-journald files and directories
2014-08-25 14:32 GMT+02:00 Christopher J. PeBenito:
Quoted 5 lines · Nicolas Iooss
Quoted 1 line
(a) refpolicy already supports reading
devlog_tsymlinks [1].It a vestige of the NSA example policy. Since we don't label the symlink
devlog_tanymore, we should remove the rules.
Actually it seems that this rule has been added a few days after the initial SVN import, by commit 5a9522111548 ("add devlog_t symlink to loggers") [1]. If the arguments which explain this commit from 2005 no longer apply, I agree we should remove this rule to prevent future confusion.
Wkr,
Nicolas
[1]
https://github.com/TresysTechnology/refpolicy/commit/5a952211154895a2da79c78ad6ee45b8dca089a2
PATCH 4/8 Support logging with /run/systemd/journal/dev-log
In reply to Nicolas IoossIn June 2014 systemd moved the socket used by journald to /run. This requires two new directory search access for every domain sending syslog messages:
* /run/systemd/ (handled by init_search_run)
* /run/systemd/journal/ (labeled syslogd_var_run_t)
systemd commit:
http://cgit.freedesktop.org/systemd/systemd/commit/units/systemd-journald-dev-log.socket?id=03ee5c38cb0da193dd08733fb4c0c2809cee6a99
--- policy/modules/system/logging.if | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
policy/modules/system/logging.if +5 -1
@@ -530,12 +530,16 @@ interface(`logging_log_filetrans',` # interface(`logging_send_syslog_msg',` gen_require(` - type syslogd_t, devlog_t; + type syslogd_t, syslogd_var_run_t, devlog_t; ') allow $1 devlog_t:lnk_file read_lnk_file_perms; allow $1 devlog_t:sock_file write_sock_file_perms; + # systemd journal socket is in /run/systemd/journal/dev-log + init_search_run($1) + allow $1 syslogd_var_run_t:dir search_dir_perms; + # the type of socket depends on the syslog daemon allow $1 syslogd_t:unix_dgram_socket sendto; allow $1 syslogd_t:unix_stream_socket connectto;
Signature · 1 line
2.0.4
PATCH 5/8 Label /dev/log symlink at boot time with systemd
In reply to Nicolas Ioosssystemd creates /dev/log as a symlink to /run/systemd/journal/dev-log when staring the Journal Socket Unit. Add an interface to logging module to label this symlink correctly.
Please note this is distinct from what Fedora does in its policy:
https://git.fedorahosted.org/cgit/selinux-policy.git/tree/policy/modules/system/logging.if?h=rawhide-base&id=f85b52d1c6805e9b0a8bd2a4a4332e66e4b52c00#n611
Here is the unit file responsible for creating the symlink:
http://cgit.freedesktop.org/systemd/systemd/tree/units/systemd-journald-dev-log.socket?id=v215
--- policy/modules/system/init.te | 3 +++ policy/modules/system/logging.if | 19 +++++++++++++++++++ 2 files changed, 22 insertions(+)
policy/modules/system/init.te +3 -0
@@ -123,6 +123,9 @@ files_pid_filetrans(init_t, init_var_run_t, file) allow init_t initctl_t:fifo_file manage_fifo_file_perms; dev_filetrans(init_t, initctl_t, fifo_file) +# Create /dev/log symlink to /run/systemd/journal/dev-log +logging_filetrans_devlog_lnk(init_t) + # Modify utmp. allow init_t initrc_var_run_t:file { rw_file_perms setattr };
policy/modules/system/logging.if +19 -0
@@ -1089,3 +1089,22 @@ interface(`logging_admin',` logging_admin_audit($1, $2) logging_admin_syslog($1, $2) ') + +######################################## +## <summary> +## Automatic type transition when creating +## /dev/log symbolic link. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`logging_filetrans_devlog_lnk',` + gen_require(` + type devlog_t; + ') + + dev_filetrans($1, devlog_t, lnk_file, "log") +')
Signature · 1 line
2.0.4
PATCH 6/8 Allow journald to read the kernel ring buffer and to use /dev/kmsg
In reply to Nicolas Ioossaudit.log shows that journald needs to read the kernel ring buffer:
avc: denied { syslog_read } for pid=147 comm="systemd-journal" scontext=system_u:system_r:syslogd_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1
Moreover journald uses RW access to /dev/kmsg, according to its code:
http://cgit.freedesktop.org/systemd/systemd/tree/src/journal/journald-kmsg.c?id=v215#n394
--- policy/modules/kernel/devices.if | 18 ++++++++++++++++++ policy/modules/system/logging.te | 3 +++ 2 files changed, 21 insertions(+)
policy/modules/kernel/devices.if +18 -0
@@ -2198,6 +2198,24 @@ interface(`dev_write_kmsg',` ######################################## ## <summary> +## Read and write to the kernel messages device +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`dev_rw_kmsg',` + gen_require(` + type device_t, kmsg_device_t; + ') + + rw_chr_files_pattern($1, device_t, kmsg_device_t) +') + +######################################## +## <summary> ## Get the attributes of the ksm devices. ## </summary> ## <param name="domain">
policy/modules/system/logging.te +3 -0
@@ -406,6 +406,7 @@ kernel_read_messages(syslogd_t) kernel_read_vm_sysctls(syslogd_t) kernel_clear_ring_buffer(syslogd_t) kernel_change_ring_buffer_level(syslogd_t) +kernel_read_ring_buffer(syslogd_t) # /initrd is not umounted before minilog starts kernel_dontaudit_search_unlabeled(syslogd_t)
@@ -437,6 +438,8 @@ corenet_sendrecv_mysqld_client_packets(syslogd_t) dev_filetrans(syslogd_t, devlog_t, sock_file) dev_read_sysfs(syslogd_t) +# Allow access to /dev/kmsg for journald +dev_rw_kmsg(syslogd_t) domain_use_interactive_fds(syslogd_t)
Signature · 1 line
2.0.4
PATCH 7/8 Allow journald to access to the state of all processes
In reply to Nicolas IoossWhen a process sends a syslog message to journald, journald records information such as command, executable, cgroup, etc.:
http://cgit.freedesktop.org/systemd/systemd/tree/src/journal/journald-server.c?id=v215#n589
This needs domain_read_all_domains_state.
--- policy/modules/system/logging.te | 2 ++ 1 file changed, 2 insertions(+)
policy/modules/system/logging.te +2 -0
@@ -442,6 +442,8 @@ dev_read_sysfs(syslogd_t) dev_rw_kmsg(syslogd_t) domain_use_interactive_fds(syslogd_t) +# Allow access to /proc/ information for journald +domain_read_all_domains_state(syslogd_t) files_read_etc_files(syslogd_t) files_read_usr_files(syslogd_t)
Signature · 1 line
2.0.4
PATCH 8/8 Remove redundant Gentoo-specific term_append_unallocated_ttys(syslogd_t)
In reply to Nicolas IoossSince commit 0fd9dc55, logging.te contains:
term_write_all_user_ttys(syslogd_t)
As "write" is a superset of "append", this rule is no longer needed:
term_append_unallocated_ttys(syslogd_t)
While at it, add a comment which explains why term_dontaudit_setattr_unallocated_ttys is needed.
--- policy/modules/system/logging.te | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
policy/modules/system/logging.te +1 -1
@@ -482,7 +482,7 @@ userdom_dontaudit_search_user_home_dirs(syslogd_t) ifdef(`distro_gentoo',` # default gentoo syslog-ng config appends kernel # and high priority messages to /dev/tty12 - term_append_unallocated_ttys(syslogd_t) + # and chown/chgrp/chmod /dev/tty12, which is denied term_dontaudit_setattr_unallocated_ttys(syslogd_t) ')
Signature · 1 line
2.0.4