Skip to contentSkip to conversation

milter: align filecontexts

PATCH New Christian Göttsche 2 participants 4 messages Sep 10, 2017 – Sep 11, 2017

lore
Share & tools
lore

Christian Göttsche

author
#0 lore raw

PATCH 1/2 milter: align filecontexts

---
 milter.fc | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)
milter.fc +10 -10
index 378d5e4..9310401 100644
@@ -4,20 +4,20 @@
 /usr/bin/spamass-milter		--	gen_context(system_u:object_r:spamass_milter_exec_t,s0)
 
 /usr/sbin/milter-greylist	--	gen_context(system_u:object_r:greylist_milter_exec_t,s0)
-/usr/sbin/sqlgrey	--	gen_context(system_u:object_r:greylist_milter_exec_t,s0)
-/usr/sbin/milter-regex	--	gen_context(system_u:object_r:regex_milter_exec_t,s0)
+/usr/sbin/sqlgrey		--	gen_context(system_u:object_r:greylist_milter_exec_t,s0)
+/usr/sbin/milter-regex		--	gen_context(system_u:object_r:regex_milter_exec_t,s0)
 /usr/sbin/spamass-milter	--	gen_context(system_u:object_r:spamass_milter_exec_t,s0)
 
-/var/lib/milter-greylist(/.*)?	gen_context(system_u:object_r:greylist_milter_data_t,s0)
-/var/lib/sqlgrey(/.*)?	gen_context(system_u:object_r:greylist_milter_data_t,s0)
-/var/lib/spamass-milter(/.*)?	gen_context(system_u:object_r:spamass_milter_state_t,s0)
+/var/lib/milter-greylist(/.*)?		gen_context(system_u:object_r:greylist_milter_data_t,s0)
+/var/lib/sqlgrey(/.*)?			gen_context(system_u:object_r:greylist_milter_data_t,s0)
+/var/lib/spamass-milter(/.*)?		gen_context(system_u:object_r:spamass_milter_state_t,s0)
 
-/run/milter-greylist(/.*)?	gen_context(system_u:object_r:greylist_milter_data_t,s0)
+/run/milter-greylist(/.*)?		gen_context(system_u:object_r:greylist_milter_data_t,s0)
 /run/milter-greylist\.pid	--	gen_context(system_u:object_r:greylist_milter_data_t,s0)
-/run/spamass(/.*)?	gen_context(system_u:object_r:spamass_milter_data_t,s0)
-/run/sqlgrey\.pid	--	gen_context(system_u:object_r:greylist_milter_data_t,s0)
-/run/spamass-milter(/.*)?	gen_context(system_u:object_r:spamass_milter_data_t,s0)
+/run/spamass(/.*)?			gen_context(system_u:object_r:spamass_milter_data_t,s0)
+/run/sqlgrey\.pid		--	gen_context(system_u:object_r:greylist_milter_data_t,s0)
+/run/spamass-milter(/.*)?		gen_context(system_u:object_r:spamass_milter_data_t,s0)
 /run/spamass-milter\.pid	--	gen_context(system_u:object_r:spamass_milter_data_t,s0)
 
-/var/spool/milter-regex(/.*)?	gen_context(system_u:object_r:regex_milter_data_t,s0)
+/var/spool/milter-regex(/.*)?		gen_context(system_u:object_r:regex_milter_data_t,s0)
 /var/spool/postfix/spamass(/.*)?	gen_context(system_u:object_r:spamass_milter_data_t,s0)
Signature · 1 line
2.14.1
author
#1 lore raw

PATCH 2/2 milter: update

- add initrc filecontext
- remove unnecessary permissions

---
 milter.fc |  2 ++
 milter.te | 16 ++++++----------
 2 files changed, 8 insertions(+), 10 deletions(-)
milter.fc +2 -0
index 9310401..42fe5e9 100644
@@ -1,3 +1,5 @@
+/etc/rc\.d/init\.d/spamass-milter --	gen_context(system_u:object_r:spamass_milter_initrc_exec_t,s0)
+
 /usr/bin/milter-greylist	--	gen_context(system_u:object_r:greylist_milter_exec_t,s0)
 /usr/bin/sqlgrey		--	gen_context(system_u:object_r:greylist_milter_exec_t,s0)
 /usr/bin/milter-regex		--	gen_context(system_u:object_r:regex_milter_exec_t,s0)
milter.te +6 -10
index d0e9c1b..a908466 100644
@@ -12,6 +12,9 @@ milter_template(greylist)
 milter_template(regex)
 milter_template(spamass)
 
+type spamass_milter_initrc_exec_t;
+init_script_file(spamass_milter_initrc_exec_t)
+
 type spamass_milter_state_t;
 files_type(spamass_milter_state_t)
 

@@ -23,8 +26,6 @@ files_type(spamass_milter_state_t)
 allow milter_domains self:fifo_file rw_fifo_file_perms;
 allow milter_domains self:tcp_socket { accept listen };
 
-kernel_dontaudit_read_system_state(milter_domains)
-
 corenet_all_recvfrom_unlabeled(milter_domains)
 corenet_all_recvfrom_netlabel(milter_domains)
 corenet_tcp_sendrecv_generic_if(milter_domains)

@@ -44,7 +45,7 @@ logging_send_syslog_msg(milter_domains)
 #
 
 allow greylist_milter_t self:capability { chown dac_override setgid setuid sys_nice };
-allow greylist_milter_t self:process { setsched getsched };
+allow greylist_milter_t self:process { getsched setsched };
 
 files_pid_filetrans(greylist_milter_t, greylist_milter_data_t, file)
 

@@ -93,20 +94,15 @@ mta_read_config(regex_milter_t)
 # spamass local policy
 #
 
-allow spamass_milter_t spamass_milter_state_t:dir search_dir_perms;
 allow spamass_milter_t self:process sigkill;
+allow spamass_milter_t self:unix_stream_socket { accept listen };
 
-kernel_read_system_state(spamass_milter_t)
-kernel_read_vm_overcommit_sysctl(spamass_milter_t)
+allow spamass_milter_t spamass_milter_state_t:dir search_dir_perms;
 
 corecmd_exec_shell(spamass_milter_t)
 
-dev_read_sysfs(spamass_milter_t)
-
 files_search_var_lib(spamass_milter_t)
 
-mta_send_mail(spamass_milter_t)
-
 optional_policy(`
 	postfix_search_spool(spamass_milter_t)
 ')
Signature · 1 line
2.14.1
#2 lore raw

PATCH 2/2 milter: update

Quoted 2 lines · Christian G?ttsche via refpolicy

- add initrc filecontext
- remove unnecessary permissions

While I'd like to remove permissions, how do you know they're not needed? Did you test all the combinations and error paths?

Quoted 71 lines
---
  milter.fc |  2 ++
  milter.te | 16 ++++++----------
  2 files changed, 8 insertions(+), 10 deletions(-)
milter.fc +2 -0
index 9310401..42fe5e9 100644
@@ -1,3 +1,5 @@
+/etc/rc\.d/init\.d/spamass-milter --	gen_context(system_u:object_r:spamass_milter_initrc_exec_t,s0)
+
  /usr/bin/milter-greylist	--	gen_context(system_u:object_r:greylist_milter_exec_t,s0)
  /usr/bin/sqlgrey		--	gen_context(system_u:object_r:greylist_milter_exec_t,s0)
  /usr/bin/milter-regex		--	gen_context(system_u:object_r:regex_milter_exec_t,s0)
milter.te +6 -10
index d0e9c1b..a908466 100644
@@ -12,6 +12,9 @@ milter_template(greylist)
  milter_template(regex)
  milter_template(spamass)
 
+type spamass_milter_initrc_exec_t;
+init_script_file(spamass_milter_initrc_exec_t)
+
  type spamass_milter_state_t;
  files_type(spamass_milter_state_t)
 

@@ -23,8 +26,6 @@ files_type(spamass_milter_state_t)
  allow milter_domains self:fifo_file rw_fifo_file_perms;
  allow milter_domains self:tcp_socket { accept listen };
 
-kernel_dontaudit_read_system_state(milter_domains)
-
  corenet_all_recvfrom_unlabeled(milter_domains)
  corenet_all_recvfrom_netlabel(milter_domains)
  corenet_tcp_sendrecv_generic_if(milter_domains)

@@ -44,7 +45,7 @@ logging_send_syslog_msg(milter_domains)
  #
 
  allow greylist_milter_t self:capability { chown dac_override setgid setuid sys_nice };
-allow greylist_milter_t self:process { setsched getsched };
+allow greylist_milter_t self:process { getsched setsched };
 
  files_pid_filetrans(greylist_milter_t, greylist_milter_data_t, file)
 

@@ -93,20 +94,15 @@ mta_read_config(regex_milter_t)
  # spamass local policy
  #
 
-allow spamass_milter_t spamass_milter_state_t:dir search_dir_perms;
  allow spamass_milter_t self:process sigkill;
+allow spamass_milter_t self:unix_stream_socket { accept listen };
 
-kernel_read_system_state(spamass_milter_t)
-kernel_read_vm_overcommit_sysctl(spamass_milter_t)
+allow spamass_milter_t spamass_milter_state_t:dir search_dir_perms;
 
  corecmd_exec_shell(spamass_milter_t)
 
-dev_read_sysfs(spamass_milter_t)
-
  files_search_var_lib(spamass_milter_t)
 
-mta_send_mail(spamass_milter_t)
-
  optional_policy(`
  	postfix_search_spool(spamass_milter_t)
  ')
Signature · 1 line
Chris PeBenito
#3 lore raw

PATCH 1/2 milter: align filecontexts

In reply to Christian Göttsche
Quoted 29 lines · Christian G?ttsche via refpolicy
---
  milter.fc | 20 ++++++++++----------
  1 file changed, 10 insertions(+), 10 deletions(-)
milter.fc +6 -7
index 378d5e4..9310401 100644
@@ -4,20 +4,20 @@
  /usr/bin/spamass-milter		--	gen_context(system_u:object_r:spamass_milter_exec_t,s0)
 
  /usr/sbin/milter-greylist	--	gen_context(system_u:object_r:greylist_milter_exec_t,s0)
-/usr/sbin/sqlgrey	--	gen_context(system_u:object_r:greylist_milter_exec_t,s0)
-/usr/sbin/milter-regex	--	gen_context(system_u:object_r:regex_milter_exec_t,s0)
+/usr/sbin/sqlgrey		--	gen_context(system_u:object_r:greylist_milter_exec_t,s0)
+/usr/sbin/milter-regex		--	gen_context(system_u:object_r:regex_milter_exec_t,s0)
  /usr/sbin/spamass-milter	--	gen_context(system_u:object_r:spamass_milter_exec_t,s0)
 
-/var/lib/milter-greylist(/.*)?	gen_context(system_u:object_r:greylist_milter_data_t,s0)
-/var/lib/sqlgrey(/.*)?	gen_context(system_u:object_r:greylist_milter_data_t,s0)
-/var/lib/spamass-milter(/.*)?	gen_context(system_u:object_r:spamass_milter_state_t,s0)
+/var/lib/milter-greylist(/.*)?		gen_context(system_u:object_r:greylist_milter_data_t,s0)
+/var/lib/sqlgrey(/.*)?			gen_context(system_u:object_r:greylist_milter_data_t,s0)
+/var/lib/spamass-milter(/.*)?		gen_context(system_u:object_r:spamass_milter_state_t,s0)
 
-/run/milter-greylist(/.*)?	gen_context(system_u:object_r:greylist_milter_data_t,s0)
+/run/milter-greylist(/.*)?		gen_context(system_u:object_r:greylist_milter_data_t,s0)
  /run/milter-greylist\.pid	--	gen_context(system_u:object_r:greylist_milter_data_t,s0)
-/run/spamass(/.*)?	gen_context(system_u:object_r:spamass_milter_data_t,s0)

milter.fc line 23

Quoted 10 lines
milter.fc +4 -3
-/run/sqlgrey\.pid	--	gen_context(system_u:object_r:greylist_milter_data_t,s0)
-/run/spamass-milter(/.*)?	gen_context(system_u:object_r:spamass_milter_data_t,s0)
+/run/spamass(/.*)?			gen_context(system_u:object_r:spamass_milter_data_t,s0)
+/run/sqlgrey\.pid		--	gen_context(system_u:object_r:greylist_milter_data_t,s0)
+/run/spamass-milter(/.*)?		gen_context(system_u:object_r:spamass_milter_data_t,s0)
  /run/spamass-milter\.pid	--	gen_context(system_u:object_r:spamass_milter_data_t,s0)
 
-/var/spool/milter-regex(/.*)?	gen_context(system_u:object_r:regex_milter_data_t,s0)
+/var/spool/milter-regex(/.*)?		gen_context(system_u:object_r:regex_milter_data_t,s0)
  /var/spool/postfix/spamass(/.*)?	gen_context(system_u:object_r:spamass_milter_data_t,s0)

Merged.

Signature · 1 line
Chris PeBenito