Some simple core policy updates

[...]

policy/modules/admin/sudo.if +1 -1

@@ -52,7 +52,7 @@ template(`sudo_role_template',`
        #
 
        # Use capabilities.
-       allow $1_sudo_t self:capability { fowner setuid setgid dac_override sys_nice sys_resource };
+       allow $1_sudo_t self:capability { chown fowner setuid setgid dac_override sys_nice sys_resource };
        allow $1_sudo_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
        allow $1_sudo_t self:process { setexec setrlimit };
        allow $1_sudo_t self:fd use;

2014-11-22 19:54 GMT+01:00 Sven Vermeulen:

Quoted 13 lines

[...]

policy/modules/admin/sudo.if +1 -1

@@ -52,7 +52,7 @@ template(`sudo_role_template',`
        #
 
        # Use capabilities.
-       allow $1_sudo_t self:capability { fowner setuid setgid dac_override sys_nice sys_resource };
+       allow $1_sudo_t self:capability { chown fowner setuid setgid dac_override sys_nice sys_resource };
        allow $1_sudo_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
        allow $1_sudo_t self:process { setexec setrlimit };
        allow $1_sudo_t self:fd use;

policy/modules/admin/sudo.if template(`sudo_role_template',` · line 120

Quoted 4 lines

policy/modules/admin/sudo.if +1 -0

@@ -117,6 +117,7 @@ template(`sudo_role_template',`
        auth_run_chk_passwd($1_sudo_t, $2)
        # sudo stores a token in the pam_pid directory
        auth_manage_pam_pid($1_sudo_t)
+       auth_pid_filetrans_pam_var_run($1_sudo_t, dir, "sudo")

This interface does not exist in refpolicy and the build fails because of this. Gentoo policy defines it in authlogin.if and the definition looks good to me:
https://github.com/sjvermeu/hardened-refpolicy/blob/9d229675d7084facc9592f1ddab5f976337524f4/policy/modules/system/authlogin.if#L1811

Thanks,

Nicolas

Good catch, I checked against the wrong repo :-( Thanks.

I've resent it with the interface added (although I got the mails twice now, my git send-email-fu is not at its peak right now).

Wkr,
Sven Vermeulen

2014-11-22 20:55 GMT+01:00 Nicolas Iooss <[email protected]>:

Quoted 24 lines

2014-11-22 19:54 GMT+01:00 Sven Vermeulen:

Quoted 13 lines

[...]

policy/modules/admin/sudo.if +1 -1

@@ -52,7 +52,7 @@ template(`sudo_role_template',`
        #
 
        # Use capabilities.
-       allow $1_sudo_t self:capability { fowner setuid setgid dac_override sys_nice sys_resource };
+       allow $1_sudo_t self:capability { chown fowner setuid setgid dac_override sys_nice sys_resource };
        allow $1_sudo_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
        allow $1_sudo_t self:process { setexec setrlimit };
        allow $1_sudo_t self:fd use;

policy/modules/admin/sudo.if template(`sudo_role_template',` · line 120

Quoted 4 lines

policy/modules/admin/sudo.if +1 -0

@@ -117,6 +117,7 @@ template(`sudo_role_template',`
        auth_run_chk_passwd($1_sudo_t, $2)
        # sudo stores a token in the pam_pid directory
        auth_manage_pam_pid($1_sudo_t)
+       auth_pid_filetrans_pam_var_run($1_sudo_t, dir, "sudo")

This interface does not exist in refpolicy and the build fails because of this. Gentoo policy defines it in authlogin.if and the definition looks good to me:
https://github.com/sjvermeu/hardened-refpolicy/blob/9d229675d7084facc9592f1ddab5f976337524f4/policy/modules/system/authlogin.if#L1811

Quoted 11 lines

Quoted 11 lines

policy/modules/admin/sudo.if template(`sudo_role_template',` · line 120

Quoted 5 lines

policy/modules/admin/sudo.if +1 -0

@@ -117,6 +117,7 @@ template(`sudo_role_template',`
        auth_run_chk_passwd($1_sudo_t, $2)
        # sudo stores a token in the pam_pid directory
        auth_manage_pam_pid($1_sudo_t)
+       auth_pid_filetrans_pam_var_run($1_sudo_t, dir, "sudo")

This interface does not exist in refpolicy and the build fails because of this. Gentoo policy defines it in authlogin.if and the definition looks good to me:
https://github.com/sjvermeu/hardened-refpolicy/blob/9d229675d7084facc9592f1ddab5f976337524f4/policy/modules/system/authlogin.if#L1811

I do not see how /var/run/sudo is associated with pam

2014-11-23 13:50 GMT+01:00 Dominick Grift <[email protected]>:

Quoted 12 lines

Quoted 11 lines

Quoted 11 lines

policy/modules/admin/sudo.if template(`sudo_role_template',` · line 120

Quoted 5 lines

policy/modules/admin/sudo.if +1 -0

@@ -117,6 +117,7 @@ template(`sudo_role_template',`
        auth_run_chk_passwd($1_sudo_t, $2)
        # sudo stores a token in the pam_pid directory
        auth_manage_pam_pid($1_sudo_t)
+       auth_pid_filetrans_pam_var_run($1_sudo_t, dir, "sudo")

This interface does not exist in refpolicy and the build fails because of this. Gentoo policy defines it in authlogin.if and the definition looks good to me:
https://github.com/sjvermeu/hardened-refpolicy/blob/9d229675d7084facc9592f1ddab5f976337524f4/policy/modules/system/authlogin.if#L1811

Quoted 1 line

I do not see how /var/run/sudo is associated with pam

The authlogin.fc already contains the following:

/var/run/sudo(/.*)?             gen_context(system_u:object_r:pam_var_run_t,s0)
/var/run/user(/.*)?             gen_context(system_u:object_r:var_auth_t,s0)
/var/(db|adm)/sudo(/.*)?        gen_context(system_u:object_r:pam_var_run_t,s0)

/var/lib/sudo(/.*)? gen_context(system_u:object_r:pam_var_run_t,s0)

I don't know if it is legacy, or because some PAM modules require a more common access pattern. In any case, this file transition is only to keep the application (and policy) running as-is -- without it, users need to run "restorecon -R /var/run/sudo" every time their system is started.

Quoted 15 lines · Sven Vermeulen

2014-11-23 13:50 GMT+01:00 Dominick Grift
<[email protected]>:

Quoted 13 lines

Quoted 13 lines

Quoted 13 lines

Quoted 4 lines

(quoted diff) +0 -0

@@ -117,6 +117,7 @@ template(`sudo_role_template',` 

auth_run_chk_passwd($1_sudo_t, $2) # sudo stores a token in the pam_pid directory auth_manage_pam_pid($1_sudo_t) + auth_pid_filetrans_pam_var_run($1_sudo_t, dir, "sudo")

This interface does not exist in refpolicy and the build fails because of this. Gentoo policy defines it in authlogin.if and the definition looks good to me:
https://github.com/sjvermeu/hardened-refpolicy/blob/9d229675d7084facc9592f1ddab5f976337524f4/policy/modules/system/authlogin.if#L1811

Quoted 12 lines

The authlogin.fc already contains the following:

/var/run/sudo(/.*)?
gen_context(system_u:object_r:pam_var_run_t,s0)
/var/run/user(/.*)?
gen_context(system_u:object_r:var_auth_t,s0)
/var/(db|adm)/sudo(/.*)?
gen_context(system_u:object_r:pam_var_run_t,s0)
/var/lib/sudo(/.*)?
gen_context(system_u:object_r:pam_var_run_t,s0)

Quoted 6 lines

I don't know if it is legacy, or because some PAM modules require a more common access pattern. In any case, this file transition is only to keep the application (and policy) running as-is -- without it, users need to run "restorecon -R /var/run/sudo" every time their system is started.

Yea, probably legacy. Just sayin' though ideally it should probably not be associated with pam_var_run_t in my view.