Skip to contentSkip to conversation

chkrootkit: update

PATCH New Christian Göttsche 2 participants 2 messages Sep 10, 2017 – Sep 11, 2017

lore
Share & tools
lore

Christian Göttsche

author
#0 lore raw

PATCH 1/1 chkrootkit: update

- drop unneeded dac_override permission
- add getattr permissions on filesystems

---
 chkrootkit.te | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)
chkrootkit.te +4 -1
index f62eb49..007b062 100644
@@ -20,7 +20,7 @@ logging_log_file(chkrootkit_log_t)
 # Application local policy
 #
 
-allow chkrootkit_t self:capability { dac_override dac_read_search setuid sys_ptrace };
+allow chkrootkit_t self:capability { dac_read_search setuid sys_ptrace };
 allow chkrootkit_t self:fifo_file rw_fifo_file_perms;
 allow chkrootkit_t self:udp_socket { create ioctl };
 

@@ -32,6 +32,7 @@ kernel_getattr_message_if(chkrootkit_t)
 corecmd_exec_bin(chkrootkit_t)
 corecmd_exec_shell(chkrootkit_t)
 
+dev_getattr_fs(chkrootkit_t)
 dev_read_rand(chkrootkit_t)
 dev_read_urand(chkrootkit_t)
 dev_getattr_all_chr_files(chkrootkit_t)

@@ -46,6 +47,8 @@ files_read_all_symlinks(chkrootkit_t)
 files_read_all_chr_files(chkrootkit_t)
 files_getattr_all_pipes(chkrootkit_t)
 
+fs_getattr_xattr_fs(chkrootkit_t)
+
 init_signal(chkrootkit_t)
 
 logging_send_syslog_msg(chkrootkit_t)
Signature · 1 line
2.14.1
#1 lore raw

PATCH 1/1 chkrootkit: update

Quoted 28 lines · Christian G?ttsche via refpolicy

- drop unneeded dac_override permission
- add getattr permissions on filesystems

---
  chkrootkit.te | 5 ++++-
  1 file changed, 4 insertions(+), 1 deletion(-)
chkrootkit.te +2 -1
index f62eb49..007b062 100644
@@ -20,7 +20,7 @@ logging_log_file(chkrootkit_log_t)
  # Application local policy
  #
 
-allow chkrootkit_t self:capability { dac_override dac_read_search setuid sys_ptrace };
+allow chkrootkit_t self:capability { dac_read_search setuid sys_ptrace };
  allow chkrootkit_t self:fifo_file rw_fifo_file_perms;
  allow chkrootkit_t self:udp_socket { create ioctl };
 

@@ -32,6 +32,7 @@ kernel_getattr_message_if(chkrootkit_t)
  corecmd_exec_bin(chkrootkit_t)
  corecmd_exec_shell(chkrootkit_t)
 
+dev_getattr_fs(chkrootkit_t)
  dev_read_rand(chkrootkit_t)
  dev_read_urand(chkrootkit_t)
  dev_getattr_all_chr_files(chkrootkit_t)

chkrootkit.te files_read_all_symlinks(chkrootkit_t) · line 54

Quoted 8 lines
chkrootkit.te +2 -0
@@ -46,6 +47,8 @@ files_read_all_symlinks(chkrootkit_t)
  files_read_all_chr_files(chkrootkit_t)
  files_getattr_all_pipes(chkrootkit_t)
 
+fs_getattr_xattr_fs(chkrootkit_t)
+
  init_signal(chkrootkit_t)
 
  logging_send_syslog_msg(chkrootkit_t)

Merged.

Signature · 1 line
Chris PeBenito