Allow domains using sysnet_dns_name_resolve() interface to access NSS mymachines files

PATCH New Laurent Bigonville 2 participants 4 messages Dec 6, 2017 – Dec 7, 2017

lore

Share & tools

lore

Laurent Bigonville

author

2017-12-06 17:06 UTC #0 lore raw

PATCH 1/2 Allow domains using sysnet_dns_name_resolve() interface to access NSS mymachines files

From: Laurent Bigonville <[email protected]>

If the machine is using the mymachine NSS module, the domain doing DNS resolution should be able to access files under /run/systemd/machines/

---
 policy/modules/system/sysnetwork.if | 5 +++++
 1 file changed, 5 insertions(+)

policy/modules/system/sysnetwork.if +5 -0

index 5b8266ca..a53122b1 100644
@@ -751,6 +751,11 @@ interface(`sysnet_dns_name_resolve',`
 	optional_policy(`
 		nscd_use($1)
 	')
+
+	# This seems needed when the mymachines NSS module is used
+	optional_policy(`
+		systemd_read_machines($1)
+	')
 ')
 
 ########################################

Signature · 1 line

2.15.1

Laurent Bigonville

author

2017-12-06 17:06 UTC #1 lore raw

PATCH 2/2 Add private type for systemd logind inhibit files and pipes

From: Laurent Bigonville <[email protected]>

---
 policy/modules/system/systemd.fc |  2 +-
 policy/modules/system/systemd.if | 20 ++++++++++++++++++++
 policy/modules/system/systemd.te |  9 ++++++++-
 3 files changed, 29 insertions(+), 2 deletions(-)

policy/modules/system/systemd.fc +1 -1

index 56e9bc13..183e0939 100644
@@ -51,7 +51,7 @@
 /run/systemd/sessions(/.*)?	gen_context(system_u:object_r:systemd_sessions_var_run_t,s0)
 /run/systemd/transient(/.*)?	gen_context(system_u:object_r:systemd_unit_t,s0)
 /run/systemd/users(/.*)?	gen_context(system_u:object_r:systemd_logind_var_run_t,s0)
-/run/systemd/inhibit(/.*)?	gen_context(system_u:object_r:systemd_logind_var_run_t,s0)
+/run/systemd/inhibit(/.*)?	gen_context(system_u:object_r:systemd_logind_inhibit_var_run_t,s0)
 /run/systemd/nspawn(/.*)?	gen_context(system_u:object_r:systemd_nspawn_var_run_t,s0)
 /run/systemd/machines(/.*)?	gen_context(system_u:object_r:systemd_machined_var_run_t,s0)
 /run/systemd/netif(/.*)?	gen_context(system_u:object_r:systemd_networkd_var_run_t,s0)

policy/modules/system/systemd.if +20 -0

index 8f914837..d875098a 100644
@@ -138,6 +138,26 @@ interface(`systemd_write_inherited_logind_sessions_pipes',`
 	allow systemd_logind_t $1:process signal;
 ')
 
+######################################
+## <summary>
+##      Write inherited logind inhibit pipes.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`systemd_write_inherited_logind_inhibit_pipes',`
+	gen_require(`
+		type systemd_logind_inhibit_var_run_t;
+		type systemd_logind_t;
+	')
+
+	allow $1 systemd_logind_t:fd use;
+	allow $1 systemd_logind_inhibit_var_run_t:fifo_file write;
+')
+
 ########################################
 ## <summary>
 ##   Send and receive messages from

policy/modules/system/systemd.te +8 -1

index 5051b87c..9a65b8f6 100644
@@ -101,6 +101,9 @@ type systemd_logind_var_run_t;
 files_pid_file(systemd_logind_var_run_t)
 init_daemon_pid_file(systemd_logind_var_run_t, dir, "systemd_logind")
 
+type systemd_logind_inhibit_var_run_t;
+files_pid_file(systemd_logind_inhibit_var_run_t)
+
 type systemd_machined_t;
 type systemd_machined_exec_t;
 init_daemon_domain(systemd_machined_t, systemd_machined_exec_t)

@@ -364,7 +367,11 @@ init_var_lib_filetrans(systemd_logind_t, systemd_logind_var_lib_t, dir)
 manage_fifo_files_pattern(systemd_logind_t, systemd_logind_var_run_t, systemd_logind_var_run_t)
 manage_files_pattern(systemd_logind_t, systemd_logind_var_run_t, systemd_logind_var_run_t)
 allow systemd_logind_t systemd_logind_var_run_t:dir manage_dir_perms;
-init_pid_filetrans(systemd_logind_t, systemd_logind_var_run_t, dir, "inhibit")
+
+manage_dirs_pattern(systemd_logind_t, systemd_logind_inhibit_var_run_t, systemd_logind_inhibit_var_run_t)
+manage_files_pattern(systemd_logind_t, systemd_logind_inhibit_var_run_t, systemd_logind_inhibit_var_run_t)
+manage_fifo_files_pattern(systemd_logind_t, systemd_logind_inhibit_var_run_t, systemd_logind_inhibit_var_run_t)
+init_pid_filetrans(systemd_logind_t, systemd_logind_inhibit_var_run_t, dir, "inhibit")
 
 allow systemd_logind_t systemd_sessions_var_run_t:dir manage_dir_perms;
 allow systemd_logind_t systemd_sessions_var_run_t:file manage_file_perms;

Signature · 1 line

2.15.1

Chris PeBenito

2017-12-07 23:51 UTC #2 lore raw

PATCH 2/2 Add private type for systemd logind inhibit files and pipes

Quoted 69 lines · Laurent Bigonville via refpolicy

From: Laurent Bigonville <[email protected]>

---
  policy/modules/system/systemd.fc |  2 +-
  policy/modules/system/systemd.if | 20 ++++++++++++++++++++
  policy/modules/system/systemd.te |  9 ++++++++-
  3 files changed, 29 insertions(+), 2 deletions(-)

policy/modules/system/systemd.fc +1 -1

index 56e9bc13..183e0939 100644
@@ -51,7 +51,7 @@
  /run/systemd/sessions(/.*)?	gen_context(system_u:object_r:systemd_sessions_var_run_t,s0)
  /run/systemd/transient(/.*)?	gen_context(system_u:object_r:systemd_unit_t,s0)
  /run/systemd/users(/.*)?	gen_context(system_u:object_r:systemd_logind_var_run_t,s0)
-/run/systemd/inhibit(/.*)?	gen_context(system_u:object_r:systemd_logind_var_run_t,s0)
+/run/systemd/inhibit(/.*)?	gen_context(system_u:object_r:systemd_logind_inhibit_var_run_t,s0)
  /run/systemd/nspawn(/.*)?	gen_context(system_u:object_r:systemd_nspawn_var_run_t,s0)
  /run/systemd/machines(/.*)?	gen_context(system_u:object_r:systemd_machined_var_run_t,s0)
  /run/systemd/netif(/.*)?	gen_context(system_u:object_r:systemd_networkd_var_run_t,s0)

policy/modules/system/systemd.if +20 -0

index 8f914837..d875098a 100644
@@ -138,6 +138,26 @@ interface(`systemd_write_inherited_logind_sessions_pipes',`
  	allow systemd_logind_t $1:process signal;
  ')
 
+######################################
+## <summary>
+##      Write inherited logind inhibit pipes.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`systemd_write_inherited_logind_inhibit_pipes',`
+	gen_require(`
+		type systemd_logind_inhibit_var_run_t;
+		type systemd_logind_t;
+	')
+
+	allow $1 systemd_logind_t:fd use;
+	allow $1 systemd_logind_inhibit_var_run_t:fifo_file write;
+')
+
  ########################################
  ## <summary>
  ##   Send and receive messages from

policy/modules/system/systemd.te +3 -0

index 5051b87c..9a65b8f6 100644
@@ -101,6 +101,9 @@ type systemd_logind_var_run_t;
  files_pid_file(systemd_logind_var_run_t)
  init_daemon_pid_file(systemd_logind_var_run_t, dir, "systemd_logind")
 
+type systemd_logind_inhibit_var_run_t;
+files_pid_file(systemd_logind_inhibit_var_run_t)
+
  type systemd_machined_t;
  type systemd_machined_exec_t;
  init_daemon_domain(systemd_machined_t, systemd_machined_exec_t)

@@ -364,7 +367,11 @@ init_var_lib_filetrans(systemd_logind_t, systemd_logind_var_lib_t, dir)
  manage_fifo_files_pattern(systemd_logind_t, systemd_logind_var_run_t, systemd_logind_var_run_t)
  manage_files_pattern(systemd_logind_t, systemd_logind_var_run_t, systemd_logind_var_run_t)

policy/modules/system/systemd.te init_var_lib_filetrans(systemd_logind_t, systemd_logind_var_lib_t, dir) · line 377

Quoted 10 lines

policy/modules/system/systemd.te +5 -1

  allow systemd_logind_t systemd_logind_var_run_t:dir manage_dir_perms;
-init_pid_filetrans(systemd_logind_t, systemd_logind_var_run_t, dir, "inhibit")
+
+manage_dirs_pattern(systemd_logind_t, systemd_logind_inhibit_var_run_t, systemd_logind_inhibit_var_run_t)
+manage_files_pattern(systemd_logind_t, systemd_logind_inhibit_var_run_t, systemd_logind_inhibit_var_run_t)
+manage_fifo_files_pattern(systemd_logind_t, systemd_logind_inhibit_var_run_t, systemd_logind_inhibit_var_run_t)
+init_pid_filetrans(systemd_logind_t, systemd_logind_inhibit_var_run_t, dir, "inhibit")
 
  allow systemd_logind_t systemd_sessions_var_run_t:dir manage_dir_perms;
  allow systemd_logind_t systemd_sessions_var_run_t:file manage_file_perms;

I tend to agree with Dominick that this is probably not needed; however, I have merged it anyway. If it ends up being a problem, it is easy to remove.

Signature · 1 line

Chris PeBenito

Chris PeBenito

2017-12-07 23:50 UTC #3 lore raw

PATCH 1/2 Allow domains using sysnet_dns_name_resolve() interface to access NSS mymachines files

In reply to Laurent Bigonville

Quoted 13 lines · Laurent Bigonville via refpolicy

From: Laurent Bigonville <[email protected]>
If the machine is using the mymachine NSS module, the domain doing DNS resolution should be able to access files under /run/systemd/machines/
---
  policy/modules/system/sysnetwork.if | 5 +++++
  1 file changed, 5 insertions(+)
policy/modules/system/sysnetwork.if +0 -0
index 5b8266ca..a53122b1 100644

policy/modules/system/sysnetwork.if interface(`sysnet_dns_name_resolve',` · line 758

Quoted 8 lines

policy/modules/system/sysnetwork.if +5 -0

@@ -751,6 +751,11 @@ interface(`sysnet_dns_name_resolve',`
  	optional_policy(`
  		nscd_use($1)
  	')
+
+	# This seems needed when the mymachines NSS module is used
+	optional_policy(`
+		systemd_read_machines($1)
+	')

Merged.

Signature · 1 line

Chris PeBenito