userdom_ro_home_role and userdom_manage_home_role
PATCH 2/7 userdom_ro_home_role and userdom_manage_home_role
Edit userdom_manage_home_role and userdom_ro_home_role to include attribute user_home_type. Allow users that call userdom_ro_home_role() to read all userdom_user_home_content. Allow users that call userdom_manange_home_role() to manage and relabel all userdom_user_home_content.
Signed-off-by Dominick Grift <[email protected]>
---
:100644 100644 d5cf579... 347d339... M policy/modules/system/userdomain.if
policy/modules/system/userdomain.if | 34 ++++++++++++++++++---------------- 1 files changed, 18 insertions(+), 16 deletions(-)
policy/modules/system/userdomain.if +18 -16
@@ -146,10 +146,11 @@ template(`userdom_base_user_template',` # interface(`userdom_ro_home_role',` gen_require(` + attribute user_home_type; type user_home_t, user_home_dir_t; ') - role $1 types { user_home_t user_home_dir_t }; + role $1 types { user_home_type user_home_dir_t }; ############################## #
@@ -162,10 +163,10 @@ interface(`userdom_ro_home_role',` allow $2 user_home_dir_t:dir list_dir_perms; allow $2 user_home_t:dir list_dir_perms; allow $2 user_home_t:file entrypoint; - read_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t) - read_lnk_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t) - read_fifo_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t) - read_sock_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t) + read_files_pattern($2, { user_home_type user_home_dir_t }, user_home_type) + read_lnk_files_pattern($2, { user_home_type user_home_dir_t }, user_home_type) + read_fifo_files_pattern($2, { user_home_type user_home_dir_t }, user_home_type) + read_sock_files_pattern($2, { user_home_type user_home_dir_t }, user_home_type) files_list_home($2) tunable_policy(`use_nfs_home_dirs',`
@@ -219,10 +220,11 @@ interface(`userdom_ro_home_role',` # interface(`userdom_manage_home_role',` gen_require(` + attribute user_home_type; type user_home_t, user_home_dir_t; ') - role $1 types { user_home_t user_home_dir_t }; + role $1 types { user_home_type user_home_dir_t }; ############################## #
@@ -233,16 +235,16 @@ interface(`userdom_manage_home_role',` # full control of the home directory allow $2 user_home_t:file entrypoint; - manage_dirs_pattern($2, { user_home_dir_t user_home_t }, user_home_t) - manage_files_pattern($2, { user_home_dir_t user_home_t }, user_home_t) - manage_lnk_files_pattern($2, { user_home_dir_t user_home_t }, user_home_t) - manage_sock_files_pattern($2, { user_home_dir_t user_home_t }, user_home_t) - manage_fifo_files_pattern($2, { user_home_dir_t user_home_t }, user_home_t) - relabel_dirs_pattern($2, { user_home_dir_t user_home_t }, user_home_t) - relabel_files_pattern($2, { user_home_dir_t user_home_t }, user_home_t) - relabel_lnk_files_pattern($2, { user_home_dir_t user_home_t }, user_home_t) - relabel_sock_files_pattern($2, { user_home_dir_t user_home_t }, user_home_t) - relabel_fifo_files_pattern($2, { user_home_dir_t user_home_t }, user_home_t) + manage_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type) + manage_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type) + manage_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type) + manage_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type) + manage_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type) + relabel_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type) + relabel_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type) + relabel_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type) + relabel_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type) + relabel_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type) filetrans_pattern($2, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file }) files_list_home($2)
Signature · 9 lines
1.7.1 -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 198 bytes Desc: not available Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20100708/8a54e436/attachment.bin
PATCH 2/7 userdom_ro_home_role and userdom_manage_home_role
Quoted 3 lines · Dominick Grift
Edit
userdom_manage_home_roleanduserdom_ro_home_roleto include attributeuser_home_type. Allow users that calluserdom_ro_home_role()to read alluserdom_user_home_content. Allow users that calluserdom_manange_home_role()to manage and relabel alluserdom_user_home_content.
It didn't occur to me before, but we can't make this part of the changeset. If you look at the sediff before and after this change, other roles, such as aduitadm, dbadm, and guest gain a bunch of new permissions. For example, I see:
+ allow dbadm_t thunderbird_home_t : dir { add_name create getattr
ioctl link lock open read relabelfrom relabelto remove_name rename reparent rmdir search setattr unlink write };
+ allow dbadm_t thunderbird_home_t : fifo_file { append create getattr
ioctl link lock open read relabelfrom relabelto rename setattr unlink write };
+ allow dbadm_t thunderbird_home_t : file { append create getattr ioctl
link lock open read relabelfrom relabelto rename setattr unlink write };
+ allow dbadm_t thunderbird_home_t : lnk_file { create getattr link
read relabelfrom relabelto rename setattr unlink write };
+ allow dbadm_t thunderbird_home_t : sock_file { append create getattr
ioctl link lock open read relabelfrom relabelto rename setattr unlink write };
But it doesn't have thunderbird_role().
Quoted 85 lines
Signed-off-by Dominick Grift<[email protected]>---
:100644 100644 d5cf579... 347d339... M policy/modules/system/userdomain.ifpolicy/modules/system/userdomain.if | 34 ++++++++++++++++++---------------- 1 files changed, 18 insertions(+), 16 deletions(-)policy/modules/system/userdomain.if +18
-16@@ -146,10 +146,11 @@ template(`userdom_base_user_template',` # interface(`userdom_ro_home_role',` gen_require(` + attribute user_home_type; type user_home_t, user_home_dir_t; ') - role $1 types { user_home_t user_home_dir_t }; + role $1 types { user_home_type user_home_dir_t }; ############################## #@@ -162,10 +163,10 @@ interface(`userdom_ro_home_role',` allow $2 user_home_dir_t:dir list_dir_perms; allow $2 user_home_t:dir list_dir_perms; allow $2 user_home_t:file entrypoint; - read_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t) - read_lnk_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t) - read_fifo_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t) - read_sock_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t) + read_files_pattern($2, { user_home_type user_home_dir_t }, user_home_type) + read_lnk_files_pattern($2, { user_home_type user_home_dir_t }, user_home_type) + read_fifo_files_pattern($2, { user_home_type user_home_dir_t }, user_home_type) + read_sock_files_pattern($2, { user_home_type user_home_dir_t }, user_home_type) files_list_home($2) tunable_policy(`use_nfs_home_dirs',`@@ -219,10 +220,11 @@ interface(`userdom_ro_home_role',` # interface(`userdom_manage_home_role',` gen_require(` + attribute user_home_type; type user_home_t, user_home_dir_t; ') - role $1 types { user_home_t user_home_dir_t }; + role $1 types { user_home_type user_home_dir_t }; ############################## #@@ -233,16 +235,16 @@ interface(`userdom_manage_home_role',` # full control of the home directory allow $2 user_home_t:file entrypoint; - manage_dirs_pattern($2, { user_home_dir_t user_home_t }, user_home_t) - manage_files_pattern($2, { user_home_dir_t user_home_t }, user_home_t) - manage_lnk_files_pattern($2, { user_home_dir_t user_home_t }, user_home_t) - manage_sock_files_pattern($2, { user_home_dir_t user_home_t }, user_home_t) - manage_fifo_files_pattern($2, { user_home_dir_t user_home_t }, user_home_t) - relabel_dirs_pattern($2, { user_home_dir_t user_home_t }, user_home_t) - relabel_files_pattern($2, { user_home_dir_t user_home_t }, user_home_t) - relabel_lnk_files_pattern($2, { user_home_dir_t user_home_t }, user_home_t) - relabel_sock_files_pattern($2, { user_home_dir_t user_home_t }, user_home_t) - relabel_fifo_files_pattern($2, { user_home_dir_t user_home_t }, user_home_t) + manage_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type) + manage_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type) + manage_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type) + manage_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type) + manage_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type) + relabel_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type) + relabel_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type) + relabel_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type) + relabel_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type) + relabel_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type) filetrans_pattern($2, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file }) files_list_home($2)_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 2/7 userdom_ro_home_role and userdom_manage_home_role
In reply to Dominick GriftQuoted 43 lines · Dominick Grift
Edit
userdom_manage_home_roleanduserdom_ro_home_roleto include attributeuser_home_type. Allow users that calluserdom_ro_home_role()to read alluserdom_user_home_content. Allow users that calluserdom_manange_home_role()to manage and relabel alluserdom_user_home_content.Signed-off-by Dominick Grift<[email protected]>---
:100644 100644 d5cf579... 347d339... M policy/modules/system/userdomain.ifpolicy/modules/system/userdomain.if | 34 ++++++++++++++++++---------------- 1 files changed, 18 insertions(+), 16 deletions(-)policy/modules/system/userdomain.if +6
-5@@ -146,10 +146,11 @@ template(`userdom_base_user_template',` # interface(`userdom_ro_home_role',` gen_require(` + attribute user_home_type; type user_home_t, user_home_dir_t; ') - role $1 types { user_home_t user_home_dir_t }; + role $1 types { user_home_type user_home_dir_t }; ############################## #@@ -162,10 +163,10 @@ interface(`userdom_ro_home_role',` allow $2 user_home_dir_t:dir list_dir_perms; allow $2 user_home_t:dir list_dir_perms; allow $2 user_home_t:file entrypoint; - read_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t) - read_lnk_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t) - read_fifo_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t) - read_sock_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t) + read_files_pattern($2, { user_home_type user_home_dir_t }, user_home_type) + read_lnk_files_pattern($2, { user_home_type user_home_dir_t }, user_home_type) + read_fifo_files_pattern($2, { user_home_type user_home_dir_t }, user_home_type) + read_sock_files_pattern($2, { user_home_type user_home_dir_t }, user_home_type) files_list_home($2) tunable_policy(`use_nfs_home_dirs',`
policy/modules/system/userdomain.if interface(`userdom_ro_home_role',` · line 227
Quoted 9 lines
policy/modules/system/userdomain.if +2
-1@@ -219,10 +220,11 @@ interface(`userdom_ro_home_role',` # interface(`userdom_manage_home_role',` gen_require(` + attribute user_home_type; type user_home_t, user_home_dir_t; ') - role $1 types { user_home_t user_home_dir_t }; + role $1 types { user_home_type user_home_dir_t };
Also, this is wrong. I have removed this and other lines like it in userdomain.if.
Quoted 36 lines
policy/modules/system/userdomain.if +10
-10############################## #@@ -233,16 +235,16 @@ interface(`userdom_manage_home_role',` # full control of the home directory allow $2 user_home_t:file entrypoint; - manage_dirs_pattern($2, { user_home_dir_t user_home_t }, user_home_t) - manage_files_pattern($2, { user_home_dir_t user_home_t }, user_home_t) - manage_lnk_files_pattern($2, { user_home_dir_t user_home_t }, user_home_t) - manage_sock_files_pattern($2, { user_home_dir_t user_home_t }, user_home_t) - manage_fifo_files_pattern($2, { user_home_dir_t user_home_t }, user_home_t) - relabel_dirs_pattern($2, { user_home_dir_t user_home_t }, user_home_t) - relabel_files_pattern($2, { user_home_dir_t user_home_t }, user_home_t) - relabel_lnk_files_pattern($2, { user_home_dir_t user_home_t }, user_home_t) - relabel_sock_files_pattern($2, { user_home_dir_t user_home_t }, user_home_t) - relabel_fifo_files_pattern($2, { user_home_dir_t user_home_t }, user_home_t) + manage_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type) + manage_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type) + manage_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type) + manage_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type) + manage_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type) + relabel_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type) + relabel_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type) + relabel_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type) + relabel_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type) + relabel_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type) filetrans_pattern($2, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file }) files_list_home($2)_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com