fstools: add in filetrans for /run dir
PATCH 1/1 fstools: add in filetrans for /run dir
the blkid tool writes to /run/blkid/. This creates the "fstools_run_t" type an allows the transition in /run.
type=AVC msg=audit(1428929528.885:149519): avc: denied { write } for pid=5590 comm="mkfs.ext4" name="/" dev="tmpfs" ino=17656 scontext=staff_u:sysadm_r:fsadm_t tcontext=system_u:object_r:var_run_t tclass=dir permissive=0
In permissive:
avc: denied { write } for pid=18595 comm="mkfs.ext4" name="blkid.tab" dev="tmpfs" ino=5441676 scontext=root:sysadm_r:fsadm_t tcontext=root:object_r:var_run_t tclass=file permissive=1
avc: denied { write } for pid=18595 comm="mkfs.ext4" name="blkid" dev="tmpfs" ino=370936 scontext=root:sysadm_r:fsadm_t tcontext=root:object_r:var_run_t tclass=dir permissive=1
avc: denied { add_name } for pid=18595 comm="mkfs.ext4" name="blkid.tab-ZaM0Am" scontext=root:sysadm_r:fsadm_t tcontext=root:object_r:var_run_t tclass=dir permissive=1
avc: denied { create } for pid=18595 comm="mkfs.ext4" name="blkid.tab-ZaM0Am" scontext=root:sysadm_r:fsadm_t tcontext=root:object_r:var_run_t tclass=file permissive=1
--- policy/modules/system/fstools.fc | 2 ++ policy/modules/system/fstools.te | 7 +++++++ 2 files changed, 9 insertions(+)
policy/modules/system/fstools.fc +2 -0
@@ -62,3 +62,5 @@ /usr/sbin/smartctl -- gen_context(system_u:object_r:fsadm_exec_t,s0) /var/log/fsck(/.*)? gen_context(system_u:object_r:fsadm_log_t,s0) + +/var/run/blkid(/.*)? gen_context(system_u:object_r:fsadm_run_t,s0)
policy/modules/system/fstools.te +7 -0
@@ -16,6 +16,9 @@ logging_log_file(fsadm_log_t) type fsadm_tmp_t; files_tmp_file(fsadm_tmp_t) +type fsadm_run_t; +files_pid_file(fsadm_run_t) + type swapfile_t; # customizable files_type(swapfile_t)
@@ -45,6 +48,10 @@ allow fsadm_t fsadm_tmp_t:dir manage_dir_perms; allow fsadm_t fsadm_tmp_t:file manage_file_perms; files_tmp_filetrans(fsadm_t, fsadm_tmp_t, { file dir }) +allow fsadm_t fsadm_run_t:dir manage_dir_perms; +allow fsadm_t fsadm_run_t:file manage_file_perms; +files_pid_filetrans(fsadm_t, fsadm_run_t, { file dir }) + # log files allow fsadm_t fsadm_log_t:dir setattr; manage_files_pattern(fsadm_t, fsadm_log_t, fsadm_log_t)
Signature · 1 line
2.0.5
PATCH 1/1 fstools: add in filetrans for /run dir
Quoted 31 lines · Jason Zaman
the blkid tool writes to
/run/blkid/. This creates the "fstools_run_t" type an allows the transition in /run.type=AVC msg=audit(1428929528.885:149519): avc: denied { write } for pid=5590 comm="mkfs.ext4" name="/" dev="tmpfs" ino=17656 scontext=staff_u:sysadm_r:fsadm_t tcontext=system_u:object_r:var_run_t tclass=dir permissive=0
In permissive:
avc: denied { write } for pid=18595 comm="mkfs.ext4" name="blkid.tab" dev="tmpfs" ino=5441676 scontext=root:sysadm_r:fsadm_t tcontext=root:object_r:var_run_t tclass=file permissive=1
avc: denied { write } for pid=18595 comm="mkfs.ext4" name="blkid" dev="tmpfs" ino=370936 scontext=root:sysadm_r:fsadm_t tcontext=root:object_r:var_run_t tclass=dir permissive=1
avc: denied {add_name} for pid=18595 comm="mkfs.ext4" name="blkid.tab-ZaM0Am" scontext=root:sysadm_r:fsadm_t tcontext=root:object_r:var_run_t tclass=dir permissive=1
avc: denied { create } for pid=18595 comm="mkfs.ext4" name="blkid.tab-ZaM0Am" scontext=root:sysadm_r:fsadm_t tcontext=root:object_r:var_run_t tclass=file permissive=1--- policy/modules/system/fstools.fc | 2 ++ policy/modules/system/fstools.te | 7 +++++++ 2 files changed, 9 insertions(+)policy/modules/system/fstools.fc +0
-0
policy/modules/system/fstools.fc line 66
Quoted 5 lines
policy/modules/system/fstools.fc +2
-0@@ -62,3 +62,5 @@ /usr/sbin/smartctl -- gen_context(system_u:object_r:fsadm_exec_t,s0) /var/log/fsck(/.*)? gen_context(system_u:object_r:fsadm_log_t,s0) + +/var/run/blkid(/.*)? gen_context(system_u:object_r:fsadm_run_t,s0)
Should probably also cover /var/run/fsck
Quoted 15 lines
policy/modules/system/fstools.te +3
-0@@ -16,6 +16,9 @@ logging_log_file(fsadm_log_t) type fsadm_tmp_t; files_tmp_file(fsadm_tmp_t) +type fsadm_run_t; +files_pid_file(fsadm_run_t) + type swapfile_t; # customizable files_type(swapfile_t)
policy/modules/system/fstools.te allow fsadm_t fsadm_tmp_t:dir manage_dir_perms; · line 54
Quoted 7 lines
policy/modules/system/fstools.te +4
-0@@ -45,6 +48,10 @@ allow fsadm_t fsadm_tmp_t:dir manage_dir_perms; allow fsadm_t fsadm_tmp_t:file manage_file_perms; files_tmp_filetrans(fsadm_t, fsadm_tmp_t, { file dir }) +allow fsadm_t fsadm_run_t:dir manage_dir_perms; +allow fsadm_t fsadm_run_t:file manage_file_perms; +files_pid_filetrans(fsadm_t, fsadm_run_t, { file dir }) +
The transition should only be needed on "dir" (/var/run/blkid and /var/run/fsck)
files_pid_filetrans(fsadm_t, fsadm_run_t, dir)
I think it is important do this properly since it makes it sensible. Adding rules that do not make sense only make it harder to understand what is going on and it needlessly inflates the policy.
Quoted 10 lines
policy/modules/system/fstools.te +0
-0# log files allow fsadm_t fsadm_log_t:dir setattr; manage_files_pattern(fsadm_t, fsadm_log_t, fsadm_log_t)Signature · 6 lines
2.0.5 _______________________________________________ refpolicy mailing list refpolicy at oss.tresys.com http://oss.tresys.com/mailman/listinfo/refpolicy
Signature · 11 lines
02DFF788 4D30 903A 1CF3 B756 FB48 1514 3148 83A2 02DF F788 http://keys.gnupg.net/pks/lookup?op=vindex&search=0x314883A202DFF788 Dominick Grift -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 648 bytes Desc: not available Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20150413/c86bab71/attachment.bin
PATCH 1/1 fstools: add in filetrans for /run dir
Quoted 8 lines · Dominick Grift
The transition should only be needed on "dir" (
/var/run/blkidand/var/run/fsck)
files_pid_filetrans(fsadm_t, fsadm_run_t, dir)I think it is important do this properly since it makes it sensible. Adding rules that do not make sense only make it harder to understand what is going on and it needlessly inflates the policy.
But i think i know what is going on here since you have no avc denials of the event where /var/run/blkid dir is created.
blkid is probably run by some process that is allowed to run all executable files and that has permissions to create generic var_run_t dirs
I would probably instead identity what creates /var/run/blkid dir and why it creates it with the generic var_run_t type
then act accordingly by either making it run blkid with a domain transition or by making it create /var/run/blkid with a object type transition
What you have currently is inconsistent and is bound be cause issues later on.
Because in some instances /var/run/blkid may be created with var_run_t and in other instances with fsadm_var_run_t.
Then youll end up allowing processes that need to manage fsadm_var_run_t files to write/del_entry/add_entry of both var_run_t as well as fsadm_var_run_t dirs
Add a rule: auditallow domain var_run_t:dir create; then keep an eye on any event showing up where /var/run/blkid is created then deal with it accordingly
Signature · 11 lines
02DFF788 4D30 903A 1CF3 B756 FB48 1514 3148 83A2 02DF F788 http://keys.gnupg.net/pks/lookup?op=vindex&search=0x314883A202DFF788 Dominick Grift -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 648 bytes Desc: not available Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20150413/0e607140/attachment.bin