Add all the missing _admin interfaces to sysadm

PATCH New Jason Zaman 4 participants 18 messages Dec 3, 2014 – Apr 3, 2015

Share & tools

Jason Zaman

author

2014-12-03 12:28 UTC #0 lore raw

PATCH 1/1 Add all the missing _admin interfaces to sysadm

Lots of the foo_admin() interfaces were not applied to sysadm. This patch adds all the ones that were missing. Interfaces are added together with the matching _role() interface if it was already present.

Make all && make validate passes, but anyone else that can run any test suites on this would be appreciated too.

---
 policy/modules/roles/sysadm.te | 784 ++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 783 insertions(+), 1 deletion(-)

policy/modules/roles/sysadm.te +783 -1

index aeac0ff..da7f18a 100644
@@ -66,10 +66,47 @@ tunable_policy(`allow_ptrace',`
 ')
 
 optional_policy(`
+	abrt_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	accountsd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	acct_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	afs_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	aiccu_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	aide_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	aisexecd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
 	amanda_run_recover(sysadm_t, sysadm_r)
 ')
 
 optional_policy(`
+	amavis_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	amtu_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	apache_admin(sysadm_t, sysadm_r)
 	apache_run_helper(sysadm_t, sysadm_r)
 	#apache_run_all_scripts(sysadm_t, sysadm_r)
 	#apache_domtrans_sys_script(sysadm_t)

@@ -77,6 +114,11 @@ optional_policy(`
 ')
 
 optional_policy(`
+	apcupsd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	apm_admin(sysadm_t, sysadm_r)
 	# cjp: why is this not apm_run_client
 	apm_domtrans_client(sysadm_t)
 ')

@@ -86,6 +128,11 @@ optional_policy(`
 ')
 
 optional_policy(`
+	arpwatch_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	asterisk_admin(sysadm_t, sysadm_r)
 	asterisk_stream_connect(sysadm_t)
 ')

@@ -94,26 +141,104 @@ optional_policy(`
 ')
 
 optional_policy(`
+	automount_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	avahi_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
 	backup_run(sysadm_t, sysadm_r)
 ')
 
 optional_policy(`
+	bacula_admin(sysadm_t, sysadm_r)
 	bacula_run_admin(sysadm_t, sysadm_r)
 ')
 
 optional_policy(`
+	bcfg2_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	bind_admin(sysadm_t, sysadm_r)
 	bind_run_ndc(sysadm_t, sysadm_r)
 ')
 
 optional_policy(`
+	bird_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	bitlbee_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	boinc_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
 	bootloader_run(sysadm_t, sysadm_r)
 ')
 
 optional_policy(`
+	bugzilla_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	cachefilesd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	calamaris_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	callweaver_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	canna_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	ccs_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	certmaster_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	certmonger_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
 	certwatch_run(sysadm_t, sysadm_r)
 ')
 
 optional_policy(`
+	cfengine_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	cgroup_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	chronyd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	cipe_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	clamav_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
 	clock_run(sysadm_t, sysadm_r)
 ')

@@ -122,24 +247,101 @@ optional_policy(`
 ')
 
 optional_policy(`
+	cmirrord_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	cobbler_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	collectd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	condor_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
 	consoletype_run(sysadm_t, sysadm_r)
 ')
 
 optional_policy(`
+	corosync_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	couchdb_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	ctdb_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	cups_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	cvs_admin(sysadm_t, sysadm_r)
 	cvs_exec(sysadm_t)
 ')
 
 optional_policy(`
+	cyphesis_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	cyrus_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	dante_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
 	dcc_run_cdcc(sysadm_t, sysadm_r)
 	dcc_run_client(sysadm_t, sysadm_r)
 	dcc_run_dbclean(sysadm_t, sysadm_r)
 ')
 
 optional_policy(`
+	ddclient_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
 	ddcprobe_run(sysadm_t, sysadm_r)
 ')
 
 optional_policy(`
+	denyhosts_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	devicekit_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	dhcpd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	dictd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	dirmngr_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	distcc_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	dkim_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
 	dmesg_exec(sysadm_t)
 ')

@@ -148,10 +350,54 @@ optional_policy(`
 ')
 
 optional_policy(`
+	dnsmasq_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	dnssectrigger_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	dovecot_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
 	dpkg_run(sysadm_t, sysadm_r)
 ')
 
 optional_policy(`
+	drbd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	dspam_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	entropyd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	exim_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	fail2ban_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	fcoe_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	fetchmail_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	firewalld_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
 	firstboot_run(sysadm_t, sysadm_r)
 ')

@@ -160,14 +406,75 @@ optional_policy(`
 ')
 
 optional_policy(`
-	hostname_run(sysadm_t, sysadm_r)
+	ftp_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	gatekeeper_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	gdomap_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	glance_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	glusterfs_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	gpm_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	gpsd_admin(sysadm_t, sysadm_r)
 ')
 
 optional_policy(`
+	hadoop_admin(sysadm_t, sysadm_r)
 	hadoop_role(sysadm_r, sysadm_t)
 ')
 
 optional_policy(`
+	hddtemp_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	hostname_run(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	howl_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	hypervkvp_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	i18n_input_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	icecast_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	ifplugd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	inn_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	iodine_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
 	# allow system administrator to use the ipsec script to look
 	# at things (e.g., ipsec auto --status)
 	# probably should create an ipsec_admin role for this kind of thing

@@ -182,14 +489,79 @@ optional_policy(`
 ')
 
 optional_policy(`
+	irqbalance_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	iscsi_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	isnsd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	jabber_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	kdump_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	kerberos_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	kerneloops_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	keystone_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	kismet_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	ksmtuned_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	kudzu_admin(sysadm_t, sysadm_r)
 	kudzu_run(sysadm_t, sysadm_r)
 ')
 
 optional_policy(`
+	l2tp_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	ldap_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
 	libs_run_ldconfig(sysadm_t, sysadm_r)
 ')
 
 optional_policy(`
+	lightsquid_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	likewise_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	lircd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	lldpad_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
 	lockdev_role(sysadm_r, sysadm_t)
 ')

@@ -203,16 +575,48 @@ optional_policy(`
 ')
 
 optional_policy(`
+	lsmd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
 	lvm_run(sysadm_t, sysadm_r)
 ')
 
 optional_policy(`
+	mandb_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	mcelog_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	memcached_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	minidlna_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	minissdpd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
 	modutils_run_depmod(sysadm_t, sysadm_r)
 	modutils_run_insmod(sysadm_t, sysadm_r)
 	modutils_run_update_mods(sysadm_t, sysadm_r)
 ')
 
 optional_policy(`
+	mongodb_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	monop_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
 	mount_run(sysadm_t, sysadm_r)
 ')

@@ -221,59 +625,234 @@ optional_policy(`
 ')
 
 optional_policy(`
+	mpd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
 	mplayer_role(sysadm_r, sysadm_t)
 ')
 
 optional_policy(`
+	mrtg_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	mscan_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
 	mta_role(sysadm_r, sysadm_t)
 ')
 
 optional_policy(`
+	munin_admin(sysadm_t, sysadm_r)
 	munin_stream_connect(sysadm_t)
 ')
 
 optional_policy(`
+	mysql_admin(sysadm_t, sysadm_r)
 	mysql_stream_connect(sysadm_t)
 ')
 
 optional_policy(`
+	nagios_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	nessus_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
 	netutils_run(sysadm_t, sysadm_r)
 	netutils_run_ping(sysadm_t, sysadm_r)
 	netutils_run_traceroute(sysadm_t, sysadm_r)
 ')
 
 optional_policy(`
+	networkmanager_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	nis_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	nscd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	nslcd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	ntop_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	ntp_admin(sysadm_t, sysadm_r)
 	ntp_stub()
 	corenet_udp_bind_ntp_port(sysadm_t)
 ')
 
 optional_policy(`
+	numad_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	nut_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
 	oav_run_update(sysadm_t, sysadm_r)
 ')
 
 optional_policy(`
+	oident_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	openct_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	openhpi_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	openvpn_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	openvswitch_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	pacemaker_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	pads_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
 	pcmcia_run_cardctl(sysadm_t, sysadm_r)
 ')
 
 optional_policy(`
+	pcscd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	pegasus_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	perdition_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	pingd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	pkcs_admin_slotd(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	plymouthd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	polipo_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
 	portage_run(sysadm_t, sysadm_r)
 	portage_run_fetch(sysadm_t, sysadm_r)
 	portage_run_gcc_config(sysadm_t, sysadm_r)
 ')
 
 optional_policy(`
+	portmap_admin(sysadm_t, sysadm_r)
 	portmap_run_helper(sysadm_t, sysadm_r)
 ')
 
 optional_policy(`
+	portreserve_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	postfix_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	postfixpolicyd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	postgrey_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	ppp_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	prelude_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	privoxy_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	psad_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	puppet_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	pxe_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	pyicqt_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	pyzor_admin(sysadm_t, sysadm_r)
 	pyzor_role(sysadm_r, sysadm_t)
 ')
 
 optional_policy(`
+	qpidd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	quantum_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	quota_admin(sysadm_t, sysadm_r)
 	quota_run(sysadm_t, sysadm_r)
 ')
 
 optional_policy(`
+	rabbitmq_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	radius_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	radvd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	raid_admin_mdadm(sysadm_t, sysadm_r)
 	raid_run_mdadm(sysadm_r, sysadm_t)
 ')

@@ -282,10 +861,48 @@ optional_policy(`
 ')
 
 optional_policy(`
+	redis_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	resmgr_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	rgmanager_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	rhcs_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	rhsmcertd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	ricci_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	rngd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	roundup_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	rpc_admin(sysadm_t, sysadm_r)
 	rpc_domtrans_nfsd(sysadm_t)
 ')
 
 optional_policy(`
+	rpcbind_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	rpm_admin(sysadm_t, sysadm_r)
 	rpm_run(sysadm_t, sysadm_r)
 ')

@@ -294,10 +911,20 @@ optional_policy(`
 ')
 
 optional_policy(`
+	rsync_admin(sysadm_t, sysadm_r)
 	rsync_exec(sysadm_t)
 ')
 
 optional_policy(`
+	rtkit_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	rwho_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	samba_admin(sysadm_t, sysadm_r)
 	samba_run_net(sysadm_t, sysadm_r)
 	samba_run_winbind_helper(sysadm_t, sysadm_r)
 ')

@@ -307,6 +934,18 @@ optional_policy(`
 ')
 
 optional_policy(`
+	sanlock_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	sasl_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	sblim_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
 	screen_role_template(sysadm, sysadm_r, sysadm_t)
 ')

@@ -315,11 +954,52 @@ optional_policy(`
 ')
 
 optional_policy(`
+	sensord_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	setroubleshoot_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
 	seutil_run_setfiles(sysadm_t, sysadm_r)
 	seutil_run_runinit(sysadm_t, sysadm_r)
 ')
 
 optional_policy(`
+	shorewall_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	slpd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	smartmon_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	smokeping_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	smstools_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	snmp_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	snort_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	soundserver_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	spamassassin_admin(sysadm_t, sysadm_r)
 	spamassassin_role(sysadm_r, sysadm_t)
 ')

@@ -328,10 +1008,18 @@ optional_policy(`
 ')
 
 optional_policy(`
+	sssd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
 	staff_role_change(sysadm_r)
 ')
 
 optional_policy(`
+	stapserver_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
 	su_role_template(sysadm, sysadm_r, sysadm_t)
 ')

@@ -340,15 +1028,43 @@ optional_policy(`
 ')
 
 optional_policy(`
+	svnserve_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
 	sysnet_run_ifconfig(sysadm_t, sysadm_r)
 	sysnet_run_dhcpc(sysadm_t, sysadm_r)
 ')
 
 optional_policy(`
+	sysstat_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	tcsd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	tftp_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	tgtd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
 	thunderbird_role(sysadm_r, sysadm_t)
 ')
 
 optional_policy(`
+	tor_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	transproxy_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
 	tripwire_run_siggen(sysadm_t, sysadm_r)
 	tripwire_run_tripwire(sysadm_t, sysadm_r)
 	tripwire_run_twadmin(sysadm_t, sysadm_r)

@@ -364,6 +1080,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	ulogd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
 	uml_role(sysadm_r, sysadm_t)
 ')

@@ -376,6 +1096,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	uptime_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
 	usbmodules_run(sysadm_t, sysadm_r)
 ')

@@ -390,6 +1114,31 @@ optional_policy(`
 ')
 
 optional_policy(`
+	uucp_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	uuidd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	varnishd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	varnishd_admin_varnishlog(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	vdagent_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	vhostmd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	virt_admin(sysadm_t, sysadm_r)
 	virt_stream_connect(sysadm_t)
 ')

@@ -398,10 +1147,22 @@ optional_policy(`
 ')
 
 optional_policy(`
+	vnstatd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
 	vpn_run(sysadm_t, sysadm_r)
 ')
 
 optional_policy(`
+	watchdog_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	wdmd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
 	webalizer_run(sysadm_t, sysadm_r)
 ')

@@ -418,15 +1179,32 @@ optional_policy(`
 ')
 
 optional_policy(`
+	xfs_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
 	yam_run(sysadm_t, sysadm_r)
 ')
 
+optional_policy(`
+	zabbix_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	zarafa_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
+	zebra_admin(sysadm_t, sysadm_r)
+')
+
 ifndef(`distro_redhat',`
 	optional_policy(`
 		auth_role(sysadm_r, sysadm_t)
 	')
 
 	optional_policy(`
+		bluetooth_admin(sysadm_t, sysadm_r)
 		bluetooth_role(sysadm_r, sysadm_t)
 	')

@@ -467,6 +1245,10 @@ ifndef(`distro_redhat',`
 	')
 
 	optional_policy(`
+		ircd_admin(sysadm_t, sysadm_r)
+	')
+
+	optional_policy(`
 		java_role(sysadm_r, sysadm_t)
 	')
 ')

Signature · 1 line

2.0.4

Christopher J. PeBenito

2014-12-03 13:18 UTC #1 lore raw

PATCH 1/1 Add all the missing _admin interfaces to sysadm

Quoted 6 lines · Jason Zaman

Lots of the foo_admin() interfaces were not applied to sysadm. This patch adds all the ones that were missing. Interfaces are added together with the matching _role() interface if it was already present.
Make all && make validate passes, but anyone else that can run any test suites on this would be appreciated too.

I'm not opposed to this change, but I wonder about cases like these:

policy/modules/roles/sysadm.te optional_policy(` · line 158

Quoted 10 lines

policy/modules/roles/sysadm.te +4 -0

+
+optional_policy(`
+	asterisk_admin(sysadm_t, sysadm_r)
 	asterisk_stream_connect(sysadm_t)
 ')
 
 optional_policy(`
+	bacula_admin(sysadm_t, sysadm_r)
 	bacula_run_admin(sysadm_t, sysadm_r)
 ')

Since I would assume that the admin interface would already include the existing rule.

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

Jason Zaman

author

2014-12-03 13:42 UTC #2 lore raw

PATCH 1/1 Add all the missing _admin interfaces to sysadm

Quoted 16 lines · Christopher J. PeBenito

Quoted 6 lines · Jason Zaman
Lots of the foo_admin() interfaces were not applied to sysadm. This patch adds all the ones that were missing. Interfaces are added together with the matching _role() interface if it was already present.
Make all && make validate passes, but anyone else that can run any test suites on this would be appreciated too.
I'm not opposed to this change, but I wonder about cases like these:
Quoted 5 lines
policy/modules/roles/sysadm.te +3 -0
+
+optional_policy(`
+	asterisk_admin(sysadm_t, sysadm_r)
 	asterisk_stream_connect(sysadm_t)
 ')

Quoted 7 lines

policy/modules/roles/sysadm.te optional_policy(` · line 158
Quoted 4 lines
optional_policy(`
policy/modules/roles/sysadm.te +1 -0
+	bacula_admin(sysadm_t, sysadm_r)
 	bacula_run_admin(sysadm_t, sysadm_r)
 ')
Since I would assume that the admin interface would already include the existing rule.

Bacula_admin does indeed call _run_admin so i'll take that away, asterisk does not call _stream_connect so that one is correct. I will fix up all the others like this in the patch and send again.

Could you perhaps also shed some light on:

optional_policy(`
+ apache_admin(sysadm_t, sysadm_r)
apache_run_helper(sysadm_t, sysadm_r) #apache_run_all_scripts(sysadm_t, sysadm_r) #apache_domtrans_sys_script(sysadm_t) apache_role(sysadm_r, sysadm_t)
')

It looks like _admin calls _run_helper so that can be removed no problem. Why are the other ones commented out? should i remove the comments to clean it up in v2 of the patch then?

Also:
optional_policy(`
+ apm_admin(sysadm_t, sysadm_r)
# cjp: why is this not apm_run_client apm_domtrans_client(sysadm_t)
')
apm_admin calls apm_run_client which then calls _domtrans_, so if that what it should be (like the comment mentions) then this can be cleaned up too.

-- Jason

Christopher J. PeBenito

2014-12-03 13:56 UTC #3 lore raw

PATCH 1/1 Add all the missing _admin interfaces to sysadm

Quoted 25 lines · Jason Zaman

Quoted 16 lines · Christopher J. PeBenito
Quoted 6 lines · Jason Zaman
Lots of the foo_admin() interfaces were not applied to sysadm. This patch adds all the ones that were missing. Interfaces are added together with the matching _role() interface if it was already present.
Make all && make validate passes, but anyone else that can run any test suites on this would be appreciated too.
I'm not opposed to this change, but I wonder about cases like these:
Quoted 5 lines
policy/modules/roles/sysadm.te +3 -0
+
+optional_policy(`
+	asterisk_admin(sysadm_t, sysadm_r)
 	asterisk_stream_connect(sysadm_t)
 ')
Quoted 7 lines
policy/modules/roles/sysadm.te optional_policy(` · line 158
Quoted 4 lines
optional_policy(`
policy/modules/roles/sysadm.te +1 -0
+	bacula_admin(sysadm_t, sysadm_r)
 	bacula_run_admin(sysadm_t, sysadm_r)
 ')
Since I would assume that the admin interface would already include the existing rule.

Quoted 2 lines

Bacula_admin does indeed call _run_admin so i'll take that away, asterisk does not call _stream_connect so that one is correct. I will

I think there is still the question, should the stream connect be added to the admin interface?

Quoted 12 lines

fix up all the others like this in the patch and send again.
Could you perhaps also shed some light on:
optional_policy(`
+ apache_admin(sysadm_t, sysadm_r)
apache_run_helper(sysadm_t, sysadm_r) #apache_run_all_scripts(sysadm_t, sysadm_r) #apache_domtrans_sys_script(sysadm_t) apache_role(sysadm_r, sysadm_t)
')

Quoted 5 lines

It looks like _admin calls _run_helper so that can be removed no problem. Why are the other ones commented out? should i remove the comments to clean it up in v2 of the patch then?
From what I can tell from git blame, those have been commented out since

at least mid 2008, so they can be removed.

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

Dominick Grift

2014-12-03 14:27 UTC #4 lore raw

PATCH 1/1 Add all the missing _admin interfaces to sysadm

Quoted 26 lines · Christopher J. PeBenito

Quoted 25 lines · Jason Zaman
Quoted 23 lines · Christopher J. PeBenito
Quoted 6 lines · Jason Zaman
Lots of the foo_admin() interfaces were not applied to sysadm. This patch adds all the ones that were missing. Interfaces are added together with the matching _role() interface if it was already present.
Make all && make validate passes, but anyone else that can run any test suites on this would be appreciated too.
I'm not opposed to this change, but I wonder about cases like these:
policy/modules/roles/sysadm.te optional_policy(` · line 158
Quoted 10 lines
policy/modules/roles/sysadm.te +4 -0
+
+optional_policy(`
+	asterisk_admin(sysadm_t, sysadm_r)
 	asterisk_stream_connect(sysadm_t)
 ')
 
 optional_policy(`
+	bacula_admin(sysadm_t, sysadm_r)
 	bacula_run_admin(sysadm_t, sysadm_r)
 ')
Since I would assume that the admin interface would already include the existing rule.

Quoted 6 lines

Quoted 2 lines
Bacula_admin does indeed call _run_admin so i'll take that away, asterisk does not call _stream_connect so that one is correct. I will
I think there is still the question, should the stream connect be added to the admin interface?

I would argue, no

The application use to stream connect should instead be confined and _admin should run that application with a domain transition instead

Jason Zaman

author

2014-12-03 15:29 UTC #5 lore raw

PATCH 1/1 Add all the missing _admin interfaces to sysadm

Quoted 4 lines · Dominick Grift

Quoted 2 lines · Christopher J. PeBenito
Quoted 1 line · Jason Zaman
On Wed, Dec 03, 2014 at 08:18:46AM -0500, Christopher J. PeBenito

Quoted 3 lines · wrote:

Quoted 3 lines
Quoted 3 lines
Quoted 3 lines · Jason Zaman
Quoted 2 lines
Lots of the foo_admin() interfaces were not applied to sysadm. This patch adds all the ones that were missing. Interfaces are added

together

Quoted 3 lines

Quoted 3 lines
Quoted 3 lines
Quoted 3 lines
Quoted 3 lines
with the matching _role() interface if it was already present.
Make all && make validate passes, but anyone else that can run any

test

Quoted 10 lines

Quoted 10 lines
Quoted 10 lines
Quoted 10 lines
Quoted 1 line
suites on this would be appreciated too.
I'm not opposed to this change, but I wonder about cases like these:
Quoted 5 lines
policy/modules/roles/sysadm.te +3 -0
+
+optional_policy(`
+ asterisk_admin(sysadm_t, sysadm_r)
  asterisk_stream_connect(sysadm_t)
 ')

Quoted 6 lines

Quoted 6 lines
Quoted 6 lines
Quoted 6 lines
Quoted 4 lines
optional_policy(`
+ bacula_admin(sysadm_t, sysadm_r)
bacula_run_admin(sysadm_t, sysadm_r)
')
Since I would assume that the admin interface would already include

the

Quoted 5 lines

Quoted 5 lines
Quoted 4 lines
Quoted 1 line
existing rule.
Bacula_admin does indeed call _run_admin so i'll take that away, asterisk does not call _stream_connect so that one is correct. I will

Quoted 9 lines

Quoted 3 lines
I think there is still the question, should the stream connect be added to the admin interface?
I would argue, no
The application use to stream connect should instead be confined and _admin should run that application with a domain transition instead

I think admining something and using it are not necessarily the same so I agree with Dominick, they should be separate.

Along with stream connect, should _admin always call _role? It makes things complicated and was the reason I removed in the earlier patches.

The problem with having things in the admin interface is that if someone wants to give foo_admin to staff_t which already has foo_role applied then there are problems cuz named filetrans can't be applied twice and a number of role interfaces have them.

-- Jason
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://oss.tresys.com/pipermail/refpolicy/attachments/20141203/c431d564/attachment.html

Dominick Grift

2014-12-03 15:41 UTC #6 lore raw

PATCH 1/1 Add all the missing _admin interfaces to sysadm

Quoted 48 lines · Jason Zaman

Quoted 4 lines · Dominick Grift
Quoted 2 lines · Christopher J. PeBenito
Quoted 1 line · Jason Zaman
On Wed, Dec 03, 2014 at 08:18:46AM -0500, Christopher J. PeBenito
Quoted 3 lines · wrote:
Quoted 3 lines
Quoted 3 lines
Quoted 3 lines · Jason Zaman
Quoted 2 lines
Lots of the foo_admin() interfaces were not applied to sysadm. This patch adds all the ones that were missing. Interfaces are added
together
Quoted 3 lines
Quoted 3 lines
Quoted 3 lines
Quoted 3 lines
Quoted 3 lines
with the matching _role() interface if it was already present.
Make all && make validate passes, but anyone else that can run any
test
Quoted 10 lines
Quoted 10 lines
Quoted 10 lines
Quoted 10 lines
Quoted 1 line
suites on this would be appreciated too.
I'm not opposed to this change, but I wonder about cases like these:
Quoted 5 lines
policy/modules/roles/sysadm.te +3 -0
+
+optional_policy(`
+ asterisk_admin(sysadm_t, sysadm_r)
  asterisk_stream_connect(sysadm_t)
 ')
Quoted 6 lines
Quoted 6 lines
Quoted 6 lines
Quoted 6 lines
Quoted 4 lines
optional_policy(`
+ bacula_admin(sysadm_t, sysadm_r)
bacula_run_admin(sysadm_t, sysadm_r)
')
Since I would assume that the admin interface would already include
the
Quoted 5 lines
Quoted 5 lines
Quoted 4 lines
Quoted 1 line
existing rule.
Bacula_admin does indeed call _run_admin so i'll take that away, asterisk does not call _stream_connect so that one is correct. I will
Quoted 9 lines
Quoted 3 lines
I think there is still the question, should the stream connect be added to the admin interface?
I would argue, no
The application use to stream connect should instead be confined and _admin should run that application with a domain transition instead
I think admining something and using it are not necessarily the same so I agree with Dominick, they should be separate.

Quoted 8 lines

Along with stream connect, should _admin always call _role? It makes things complicated and was the reason I removed in the earlier patches.
The problem with having things in the admin interface is that if someone wants to give foo_admin to staff_t which already has foo_role applied then there are problems cuz named filetrans can't be applied twice and a number of role interfaces have them.

I think you misunderstood me. in my view there should not be a asterisk_stream_connect() called directly by a strict user domain at all

be it admin user domain or otherwise

Signature · 8 lines

Dominick Grift
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 648 bytes
Desc: not available
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20141203/02c4d895/attachment-0001.bin

Christopher J. PeBenito

2014-12-03 15:44 UTC #7 lore raw

PATCH 1/1 Add all the missing _admin interfaces to sysadm

In reply to Jason Zaman

Quoted 42 lines · Jason Zaman

Quoted 4 lines · On 3 Dec 2014 18:27, "Dominick Grift" <[email protected]…
Quoted 2 lines · Christopher J. PeBenito
Quoted 1 line · Jason Zaman
On Wed, Dec 03, 2014 at 08:18:46AM -0500, Christopher J. PeBenito
Quoted 3 lines · wrote:
Quoted 3 lines
Quoted 3 lines
Quoted 3 lines · Jason Zaman
Quoted 2 lines
Lots of the foo_admin() interfaces were not applied to sysadm. This patch adds all the ones that were missing. Interfaces are added
together
Quoted 3 lines
Quoted 3 lines
Quoted 3 lines
Quoted 3 lines
Quoted 3 lines
with the matching _role() interface if it was already present.
Make all && make validate passes, but anyone else that can run
any test
Quoted 10 lines
Quoted 10 lines
Quoted 10 lines
Quoted 10 lines
Quoted 1 line
suites on this would be appreciated too.
I'm not opposed to this change, but I wonder about cases like these:
Quoted 5 lines
policy/modules/roles/sysadm.te +3 -0
+
+optional_policy(`
+ asterisk_admin(sysadm_t, sysadm_r)
  asterisk_stream_connect(sysadm_t)
 ')
Quoted 6 lines
Quoted 6 lines
Quoted 6 lines
Quoted 6 lines
Quoted 4 lines
optional_policy(`
+ bacula_admin(sysadm_t, sysadm_r)
bacula_run_admin(sysadm_t, sysadm_r)
')
Since I would assume that the admin interface would already
include the
Quoted 9 lines
Quoted 8 lines
Quoted 4 lines
Quoted 1 line
existing rule.
Bacula_admin does indeed call _run_admin so i'll take that away, asterisk does not call _stream_connect so that one is correct. I will
I think there is still the question, should the stream connect be added to the admin interface?

Quoted 7 lines

Quoted 5 lines
I would argue, no
The application use to stream connect should instead be confined and _admin should run that application with a domain transition instead
I think admining something and using it are not necessarily the same so I agree with Dominick, they should be separate.

I also agree. The admin interfaces should have all of the rules needed to admin the service, and that's it. If that socket connect is not related to an admin function, then it should remain separate. I asked the question since I was unsure why there was a stream connect.

Quoted 2 lines

Along with stream connect, should _admin always call _role? It makes things complicated and was the reason I removed in the earlier patches.

No, the admin interfaces should probably never call role, since using a service (in an unprivileged/client sense) is something different than admining a service.

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

Christopher J. PeBenito

2014-12-03 15:50 UTC #8 lore raw

PATCH 1/1 Add all the missing _admin interfaces to sysadm

Quoted 49 lines · Christopher J. PeBenito

Quoted 30 lines · Jason Zaman
Quoted 4 lines · On 3 Dec 2014 18:27, "Dominick Grift" <[email protected]…
Quoted 2 lines · Christopher J. PeBenito
Quoted 1 line · Jason Zaman
On Wed, Dec 03, 2014 at 08:18:46AM -0500, Christopher J. PeBenito
Quoted 3 lines · wrote:
Quoted 3 lines
Quoted 3 lines
Quoted 3 lines · Jason Zaman
Quoted 2 lines
Lots of the foo_admin() interfaces were not applied to sysadm. This patch adds all the ones that were missing. Interfaces are added
together
Quoted 3 lines
Quoted 3 lines
Quoted 3 lines
Quoted 3 lines
Quoted 3 lines
with the matching _role() interface if it was already present.
Make all && make validate passes, but anyone else that can run
any test
Quoted 14 lines
Quoted 13 lines
Quoted 9 lines
Quoted 9 lines
Quoted 1 line
suites on this would be appreciated too.
I'm not opposed to this change, but I wonder about cases like these:
Review
Quoted 5 lines
(quoted diff) +3 -0
+
+optional_policy(`
+ asterisk_admin(sysadm_t, sysadm_r)
  asterisk_stream_connect(sysadm_t)
 ')
I think there is still the question, should the stream connect be added to the admin interface?
Quoted 7 lines
Quoted 5 lines
I would argue, no
The application use to stream connect should instead be confined and _admin should run that application with a domain transition instead
I think admining something and using it are not necessarily the same so I agree with Dominick, they should be separate.
I also agree. The admin interfaces should have all of the rules needed to admin the service, and that's it. If that socket connect is not related to an admin function, then it should remain separate. I asked the question since I was unsure why there was a stream connect.
From the commit, Sven said:
Author: Sven Vermeulen
Date:   Mon Oct 3 21:24:38 2011 +0200

Quoted 7 lines

Allow sysadm to interact with asterisk
When administering asterisk, one often ran command is "asterisk -r" which yields the asterisk CLI (when the asterisk server is running). To be able to run this, you need asterisk_stream_connect privileges.
Assign these privileges to the sysadm_r

Which tells me that the stream connect should be added to the admin interface.

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

Dominick Grift

2014-12-03 15:55 UTC #9 lore raw

PATCH 1/1 Add all the missing _admin interfaces to sysadm

Quoted 56 lines · Christopher J. PeBenito

Quoted 43 lines · Christopher J. PeBenito
Quoted 30 lines · Jason Zaman
Quoted 4 lines · On 3 Dec 2014 18:27, "Dominick Grift" <[email protected]…
Quoted 2 lines · Christopher J. PeBenito
Quoted 1 line · Jason Zaman
On Wed, Dec 03, 2014 at 08:18:46AM -0500, Christopher J. PeBenito
Quoted 3 lines · wrote:
Quoted 3 lines
Quoted 3 lines
Quoted 3 lines · Jason Zaman
Quoted 2 lines
Lots of the foo_admin() interfaces were not applied to sysadm. This patch adds all the ones that were missing. Interfaces are added
together
Quoted 3 lines
Quoted 3 lines
Quoted 3 lines
Quoted 3 lines
Quoted 3 lines
with the matching _role() interface if it was already present.
Make all && make validate passes, but anyone else that can run
any test
Quoted 14 lines
Quoted 13 lines
Quoted 9 lines
Quoted 9 lines
Quoted 1 line
suites on this would be appreciated too.
I'm not opposed to this change, but I wonder about cases like these:
Review
Quoted 5 lines
(quoted diff) +3 -0
+
+optional_policy(`
+ asterisk_admin(sysadm_t, sysadm_r)
  asterisk_stream_connect(sysadm_t)
 ')
I think there is still the question, should the stream connect be added to the admin interface?
Quoted 7 lines
Quoted 5 lines
I would argue, no
The application use to stream connect should instead be confined and _admin should run that application with a domain transition instead
I think admining something and using it are not necessarily the same so I agree with Dominick, they should be separate.
I also agree. The admin interfaces should have all of the rules needed to admin the service, and that's it. If that socket connect is not related to an admin function, then it should remain separate. I asked the question since I was unsure why there was a stream connect.
Quoted 9 lines · Sven
Author: Sven Vermeulen
Date:   Mon Oct 3 21:24:38 2011 +0200
Allow sysadm to interact with asterisk
When administering asterisk, one often ran command is "asterisk -r" which yields the asterisk CLI (when the asterisk server is running). To be able to run this, you need asterisk_stream_connect privileges.

Quoted 6 lines

Quoted 1 line
Assign these privileges to the sysadm_r
Which tells me that the stream connect should be added to the admin interface.

Where do you draw the line, are you now also adding all the permissions to sysadm_t that asterisk cli needs to run?

You dont see them now because sysadm_t is virtually unconfined_t already, but i bet the app needs permissions that a normal confined shell session does not need

why not just run the asterisk cli with a domain transition and associate these permission with at domain instead of sysadm_t?

Signature · 8 lines

Dominick Grift
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 648 bytes
Desc: not available
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20141203/ea442cbf/attachment.bin

Christopher J. PeBenito

2014-12-03 16:12 UTC #10 lore raw

PATCH 1/1 Add all the missing _admin interfaces to sysadm

Quoted 64 lines · Dominick Grift

Quoted 56 lines · Christopher J. PeBenito
Quoted 43 lines · Christopher J. PeBenito
Quoted 30 lines · Jason Zaman
Quoted 4 lines · On 3 Dec 2014 18:27, "Dominick Grift" <[email protected]…
Quoted 2 lines · Christopher J. PeBenito
Quoted 1 line · Jason Zaman
On Wed, Dec 03, 2014 at 08:18:46AM -0500, Christopher J. PeBenito
Quoted 3 lines · wrote:
Quoted 3 lines
Quoted 3 lines
Quoted 3 lines · Jason Zaman
Quoted 2 lines
Lots of the foo_admin() interfaces were not applied to sysadm. This patch adds all the ones that were missing. Interfaces are added
together
Quoted 3 lines
Quoted 3 lines
Quoted 3 lines
Quoted 3 lines
Quoted 3 lines
with the matching _role() interface if it was already present.
Make all && make validate passes, but anyone else that can run
any test
Quoted 14 lines
Quoted 13 lines
Quoted 9 lines
Quoted 9 lines
Quoted 1 line
suites on this would be appreciated too.
I'm not opposed to this change, but I wonder about cases like these:
Review
Quoted 5 lines
(quoted diff) +3 -0
+
+optional_policy(`
+ asterisk_admin(sysadm_t, sysadm_r)
  asterisk_stream_connect(sysadm_t)
 ')
I think there is still the question, should the stream connect be added to the admin interface?
Quoted 7 lines
Quoted 5 lines
I would argue, no
The application use to stream connect should instead be confined and _admin should run that application with a domain transition instead
I think admining something and using it are not necessarily the same so I agree with Dominick, they should be separate.
I also agree. The admin interfaces should have all of the rules needed to admin the service, and that's it. If that socket connect is not related to an admin function, then it should remain separate. I asked the question since I was unsure why there was a stream connect.
Quoted 9 lines · Sven
Author: Sven Vermeulen
Date:   Mon Oct 3 21:24:38 2011 +0200
Allow sysadm to interact with asterisk
When administering asterisk, one often ran command is "asterisk -r" which yields the asterisk CLI (when the asterisk server is running). To be able to run this, you need asterisk_stream_connect privileges.
Quoted 6 lines
Quoted 1 line
Assign these privileges to the sysadm_r
Which tells me that the stream connect should be added to the admin interface.

Quoted 5 lines

Where do you draw the line, are you now also adding all the permissions to sysadm_t that asterisk cli needs to run?
You dont see them now because sysadm_t is virtually unconfined_t already, but i bet the app needs permissions that a normal confined shell session does not need
why not just run the asterisk cli with a domain transition and associate these permission with at domain instead of sysadm_t?

See my other email. If we further constrain sysadm_t, it may make more sense to do that, but at this time I don't think it's warranted.

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

Dominick Grift

2014-12-03 16:19 UTC #11 lore raw

PATCH 1/1 Add all the missing _admin interfaces to sysadm

Quoted 65 lines · Christopher J. PeBenito

Quoted 64 lines · Dominick Grift
Quoted 62 lines · Christopher J. PeBenito
Quoted 43 lines · Christopher J. PeBenito
Quoted 30 lines · Jason Zaman
Quoted 4 lines · On 3 Dec 2014 18:27, "Dominick Grift" <[email protected]…
Quoted 2 lines · Christopher J. PeBenito
Quoted 1 line · Jason Zaman
On Wed, Dec 03, 2014 at 08:18:46AM -0500, Christopher J. PeBenito
Quoted 3 lines · wrote:
Quoted 3 lines
Quoted 3 lines
Quoted 3 lines · Jason Zaman
Quoted 2 lines
Lots of the foo_admin() interfaces were not applied to sysadm. This patch adds all the ones that were missing. Interfaces are added
together
Quoted 3 lines
Quoted 3 lines
Quoted 3 lines
Quoted 3 lines
Quoted 3 lines
with the matching _role() interface if it was already present.
Make all && make validate passes, but anyone else that can run
any test
Quoted 14 lines
Quoted 13 lines
Quoted 9 lines
Quoted 9 lines
Quoted 1 line
suites on this would be appreciated too.
I'm not opposed to this change, but I wonder about cases like these:
Review
Quoted 5 lines
(quoted diff) +3 -0
+
+optional_policy(`
+ asterisk_admin(sysadm_t, sysadm_r)
  asterisk_stream_connect(sysadm_t)
 ')
I think there is still the question, should the stream connect be added to the admin interface?
Quoted 7 lines
Quoted 5 lines
I would argue, no
The application use to stream connect should instead be confined and _admin should run that application with a domain transition instead
I think admining something and using it are not necessarily the same so I agree with Dominick, they should be separate.
I also agree. The admin interfaces should have all of the rules needed to admin the service, and that's it. If that socket connect is not related to an admin function, then it should remain separate. I asked the question since I was unsure why there was a stream connect.
Quoted 10 lines · Sven
Author: Sven Vermeulen
Date:   Mon Oct 3 21:24:38 2011 +0200
Allow sysadm to interact with asterisk
When administering asterisk, one often ran command is "asterisk -r" which yields the asterisk CLI (when the asterisk server is running). To be able to run this, you need asterisk_stream_connect privileges.
Assign these privileges to the sysadm_r
Which tells me that the stream connect should be added to the admin interface.

Quoted 10 lines

Quoted 5 lines
Where do you draw the line, are you now also adding all the permissions to sysadm_t that asterisk cli needs to run?
You dont see them now because sysadm_t is virtually unconfined_t already, but i bet the app needs permissions that a normal confined shell session does not need
why not just run the asterisk cli with a domain transition and associate these permission with at domain instead of sysadm_t?
See my other email. If we further constrain sysadm_t, it may make more sense to do that, but at this time I don't think it's warranted.

Then it does not make sense to add all those _admin() interface calls to sysadm either in my view.

sysadm can already do all (most) those things on a lower level

So its pretty much just dupes; overhead

Signature · 8 lines

Dominick Grift
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 648 bytes
Desc: not available
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20141203/aa026d3b/attachment-0001.bin

Dominick Grift

2014-12-03 15:39 UTC #12 lore raw

PATCH 1/1 Add all the missing _admin interfaces to sysadm

In reply to Christopher J. PeBenito

Quoted 12 lines · Christopher J. PeBenito

Quoted 12 lines
Quoted 11 lines
I'm not opposed to this change, but I wonder about cases like these:
policy/modules/roles/sysadm.te optional_policy(` · line 137
Quoted 5 lines
policy/modules/roles/sysadm.te +3 -0
+
+optional_policy(`
+	asterisk_admin(sysadm_t, sysadm_r)
 	asterisk_stream_connect(sysadm_t)
 ')
Since I would assume that the admin interface would already include the existing rule.

Quoted 6 lines

Quoted 2 lines
Bacula_admin does indeed call _run_admin so i'll take that away, asterisk does not call _stream_connect so that one is correct. I will
I think there is still the question, should the stream connect be added to the admin interface?

In my opinion where refpolicy went wrong is by allowing confined user domains this low level access in the first place
shells do not stream connect, applications do.sysadm is a strict domain and so it should run the app that stream connects in the apps domain with a domain transition if that makes sense.

That is strict. Anything else is "drunken unconfined" in my view, or at least a compromise.

In my vision confined users should be strictly enforced (least privilege) or at least as much as possible

This will inflate the policy in a huge way, i see that. However the policy should be modular anyway. One should only have installed what one needs (which is another things that in practice proves to be currently not working well)

Ask yourself do you know anyone that disables modules that he doesnt need when it installs a system? (i tried it once and its a huge pain, i gave up trying. The toolchain (semodule) cant tell you the dependencies, so it just fails an you wont know why or where it fails))

if you run a asterisk server and you want it strict then you should be able to have it strict.

But thats where other decisions were made, now we have a huge policy that "tries to do everything, but does nothing right". well its not that dramatic but it is not perfect either (although nothing ever is)

In my view a huge policy is not a problem but the policy that is there should at least be applicable.

There would be room for compromise though. for example confined admins wouldnt run apps like systemctl with a domain transition because that wouldnt work either, but there should be finer line than there currently is in my view (systemd ctl commands are an exception)

Signature · 8 lines

Dominick Grift
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 648 bytes
Desc: not available
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20141203/462d60a0/attachment.bin

Dominick Grift

2014-12-03 15:50 UTC #13 lore raw

PATCH 1/1 Add all the missing _admin interfaces to sysadm

Quoted 31 lines · Dominick Grift

Quoted 12 lines · Christopher J. PeBenito
Quoted 12 lines
Quoted 11 lines
I'm not opposed to this change, but I wonder about cases like these:
policy/modules/roles/sysadm.te optional_policy(` · line 137
Quoted 5 lines
policy/modules/roles/sysadm.te +3 -0
+
+optional_policy(`
+	asterisk_admin(sysadm_t, sysadm_r)
 	asterisk_stream_connect(sysadm_t)
 ')
Since I would assume that the admin interface would already include the existing rule.
Quoted 6 lines
Quoted 2 lines
Bacula_admin does indeed call _run_admin so i'll take that away, asterisk does not call _stream_connect so that one is correct. I will
I think there is still the question, should the stream connect be added to the admin interface?
In my opinion where refpolicy went wrong is by allowing confined user domains this low level access in the first place
shells do not stream connect, applications do.sysadm is a strict domain and so it should run the app that stream connects in the apps domain with a domain transition if that makes sense.
That is strict. Anything else is "drunken unconfined" in my view, or at least a compromise.
In my vision confined users should be strictly enforced (least privilege) or at least as much as possible
This will inflate the policy in a huge way, i see that. However the policy should be modular anyway. One should only have installed what one needs (which is another things that in practice proves to be currently not working well)
Ask yourself do you know anyone that disables modules that he doesnt need when it installs a system? (i tried it once and its a huge pain, i gave up trying. The toolchain (semodule) cant tell you the dependencies, so it just fails an you wont know why or where it fails))

Quoted 8 lines

if you run a asterisk server and you want it strict then you should be able to have it strict.
But thats where other decisions were made, now we have a huge policy that "tries to do everything, but does nothing right". well its not that dramatic but it is not perfect either (although nothing ever is)
In my view a huge policy is not a problem but the policy that is there should at least be applicable.
There would be room for compromise though. for example confined admins wouldnt run apps like systemctl with a domain transition because that wouldnt work either, but there should be finer line than there currently is in my view (systemd ctl commands are an exception)

By the way: Walsh once dubbed the term "drunken unconfined_t" but i doubt that he meant the same as i do.

I am borrowing the term for identifying domains that have excessive permissions

Signature · 8 lines

Dominick Grift
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 648 bytes
Desc: not available
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20141203/b5abf1bc/attachment.bin

Christopher J. PeBenito

2014-12-03 16:07 UTC #14 lore raw

PATCH 1/1 Add all the missing _admin interfaces to sysadm

In reply to Dominick Grift

Quoted 26 lines · Dominick Grift

Quoted 10 lines · Christopher J. PeBenito
Quoted 10 lines
Quoted 9 lines
I'm not opposed to this change, but I wonder about cases like these:
Quoted 2 lines
+ +optional_policy(` + asterisk_admin(sysadm_t, sysadm_r)
asterisk_stream_connect(sysadm_t) ')
Since I would assume that the admin interface would already include the existing rule.
Quoted 7 lines
Quoted 3 lines
Bacula_admin does indeed call _run_admin so i'll take that away, asterisk does not call _stream_connect so that one is correct. I will
I think there is still the question, should the stream connect be added to the admin interface?
In my opinion where refpolicy went wrong is by allowing confined user domains this low level access in the first place shells do not stream connect, applications do.sysadm is a strict domain and so it should run the app that stream connects in the apps domain with a domain transition if that makes sense.

Quoted 5 lines

That is strict. Anything else is "drunken unconfined" in my view, or at least a compromise.
In my vision confined users should be strictly enforced (least privilege) or at least as much as possible

I understand your position, but I believe the (IMO modest) gains don't outweigh the additional complexity cost. In this case, if your admin is abusing their privileges, then there is a worse problem. I think a more effective confinement would be eliminating sysadm's blanket manage access on basically the entire filesystem. If all these admin interfaces work well, all that access won't be necessary.

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

Dominick Grift

2014-12-03 16:28 UTC #15 lore raw

PATCH 1/1 Add all the missing _admin interfaces to sysadm

Quoted 33 lines · Christopher J. PeBenito

Quoted 26 lines · Dominick Grift
Quoted 10 lines · Christopher J. PeBenito
Quoted 10 lines
Quoted 9 lines
I'm not opposed to this change, but I wonder about cases like these:
Quoted 2 lines
+ +optional_policy(` + asterisk_admin(sysadm_t, sysadm_r)
asterisk_stream_connect(sysadm_t) ')
Since I would assume that the admin interface would already include the existing rule.
Quoted 7 lines
Quoted 3 lines
Bacula_admin does indeed call _run_admin so i'll take that away, asterisk does not call _stream_connect so that one is correct. I will
I think there is still the question, should the stream connect be added to the admin interface?
In my opinion where refpolicy went wrong is by allowing confined user domains this low level access in the first place shells do not stream connect, applications do.sysadm is a strict domain and so it should run the app that stream connects in the apps domain with a domain transition if that makes sense.
Quoted 5 lines
That is strict. Anything else is "drunken unconfined" in my view, or at least a compromise.
In my vision confined users should be strictly enforced (least privilege) or at least as much as possible

Quoted 6 lines

I understand your position, but I believe the (IMO modest) gains don't outweigh the additional complexity cost. In this case, if your admin is abusing their privileges, then there is a worse problem. I think a more effective confinement would be eliminating sysadm's blanket manage access on basically the entire filesystem. If all these admin interfaces work well, all that access won't be necessary.

Its not just about abuse its about containing processes. Programs have flaws

If you run those programs in one big privileged domain than those processes can affect everything else it has access to.

I rather have a highly complex policy that does what it say's on the label and is applicable, than a slighty less highly complex policy that is basically a compromise that sets a sub-optimal precedence.

Anyhow you made your point, and i made my point. Lets just agree to disagree.

Signature · 8 lines

Dominick Grift
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 648 bytes
Desc: not available
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20141203/ec0ed892/attachment.bin

Christopher J. PeBenito

2014-12-03 16:47 UTC #16 lore raw

PATCH 1/1 Add all the missing _admin interfaces to sysadm

Quoted 50 lines · Dominick Grift

Quoted 34 lines · Christopher J. PeBenito
Quoted 27 lines · Dominick Grift
Quoted 10 lines · Christopher J. PeBenito
Quoted 10 lines
Quoted 9 lines
I'm not opposed to this change, but I wonder about cases like these:
Quoted 2 lines
+ +optional_policy(` + asterisk_admin(sysadm_t,
sysadm_r) asterisk_stream_connect(sysadm_t) ')
Since I would assume that the admin interface would already include the existing rule.
Quoted 7 lines
Quoted 3 lines
Bacula_admin does indeed call _run_admin so i'll take that
away, asterisk does not call _stream_connect so that one
is correct. I will
I think there is still the question, should the stream connect be added to the admin interface?
In my opinion where refpolicy went wrong is by allowing confined user domains this low level access in the first place shells do not stream connect, applications do.sysadm is a strict domain and so it should run the app that stream connects in the apps domain with a domain transition if that makes sense.
Quoted 5 lines
That is strict. Anything else is "drunken unconfined" in my view, or at least a compromise.
In my vision confined users should be strictly enforced (least
privilege) or at least as much as possible
Quoted 7 lines
I understand your position, but I believe the (IMO modest) gains don't outweigh the additional complexity cost. In this case, if your admin is abusing their privileges, then there is a worse problem. I think a more effective confinement would be eliminating sysadm's blanket manage access on basically the entire filesystem. If all these admin interfaces work well, all that access won't be necessary.
Its not just about abuse its about containing processes. Programs have flaws
If you run those programs in one big privileged domain than those processes can affect everything else it has access to.

Quoted 7 lines

I rather have a highly complex policy that does what it say's on the label and is applicable, than a slighty less highly complex policy that is basically a compromise that sets a sub-optimal precedence.
Anyhow you made your point, and i made my point. Lets just agree to disagree.

I don't think we actually disagree in the long term. I've always wanted to remove access from sysadm_t. Once that happens, it probably will be much more obvious and compelling to add more domains for admin programs. Since further constraining sysadm_t is a massive change, adding calls to the admin interfaces will be necessary to ensure expected behavior. It's a multi-step process.

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

Miroslav Grepl

2015-04-03 14:29 UTC #17 lore raw

PATCH 1/1 Add all the missing _admin interfaces to sysadm

Quoted 59 lines · Christopher J. PeBenito

Quoted 50 lines · Dominick Grift
Quoted 34 lines · Christopher J. PeBenito
Quoted 27 lines · Dominick Grift
Quoted 10 lines · Christopher J. PeBenito
Quoted 10 lines
Quoted 9 lines
I'm not opposed to this change, but I wonder about cases like these:
Quoted 2 lines
+ +optional_policy(` + asterisk_admin(sysadm_t,
sysadm_r) asterisk_stream_connect(sysadm_t) ')
Since I would assume that the admin interface would already include the existing rule.
Quoted 7 lines
Quoted 3 lines
Bacula_admin does indeed call _run_admin so i'll take that
away, asterisk does not call _stream_connect so that one
is correct. I will
I think there is still the question, should the stream connect be added to the admin interface?
In my opinion where refpolicy went wrong is by allowing confined user domains this low level access in the first place shells do not stream connect, applications do.sysadm is a strict domain and so it should run the app that stream connects in the apps domain with a domain transition if that makes sense.
Quoted 5 lines
That is strict. Anything else is "drunken unconfined" in my view, or at least a compromise.
In my vision confined users should be strictly enforced (least
privilege) or at least as much as possible
Quoted 7 lines
I understand your position, but I believe the (IMO modest) gains don't outweigh the additional complexity cost. In this case, if your admin is abusing their privileges, then there is a worse problem. I think a more effective confinement would be eliminating sysadm's blanket manage access on basically the entire filesystem. If all these admin interfaces work well, all that access won't be necessary.
Its not just about abuse its about containing processes. Programs have flaws
If you run those programs in one big privileged domain than those processes can affect everything else it has access to.
Quoted 7 lines
I rather have a highly complex policy that does what it say's on the label and is applicable, than a slighty less highly complex policy that is basically a compromise that sets a sub-optimal precedence.
Anyhow you made your point, and i made my point. Lets just agree to disagree.

Quoted 8 lines

I don't think we actually disagree in the long term. I've always wanted to remove access from sysadm_t. Once that happens, it probably will be much more obvious and compelling to add more domains for admin programs. Since further constraining sysadm_t is a massive change, adding calls to the admin interfaces will be necessary to ensure expected behavior. It's a multi-step process.

I believe both of you are right. But you will have always CLI tools which need to have access from sysadm_t to a domain. We would need to take care also about these tools.

Signature · 3 lines

Miroslav Grepl
Software Engineering, SELinux Solutions
Red Hat, Inc.