: patch set to update the git reference policy

PATCH New Guido Trentalancia 2 participants 6 messages Jan 24, 2011 – Jan 26, 2011

lore

Share & tools

lore

Guido Trentalancia

author

2011-01-24 00:44 UTC #0 lore raw

PATCH 9/19 : patch set to update the git reference policy

policy/modules/services/devicekit.if +19 -0

diff -pruN refpolicy-git-18012011-update-work/policy/modules/services/devicekit.if refpolicy-git-18012011-devicekit/policy/modules/services/devicekit.if
@@ -240,3 +240,22 @@ interface(`devicekit_admin',`
 	admin_pattern($1, devicekit_var_run_t)
 	files_search_pids($1)
 ')
+
+########################################
+## <summary>
+##      DeviceKit power getattr on APM
+##      bios character device node files.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`devicekit_getattr_apm_bios_files_power',`
+	gen_require(`
+		type apm_bios_t;
+	')
+
+	getattr_chr_files_pattern($1, apm_bios_t, apm_bios_t)
+')

policy/modules/services/devicekit.te +16 -1

diff -pruN refpolicy-git-18012011-update-work/policy/modules/services/devicekit.te refpolicy-git-18012011-devicekit/policy/modules/services/devicekit.te
@@ -43,6 +43,7 @@ dev_read_sysfs(devicekit_t)
 dev_read_urand(devicekit_t)
 
 files_read_etc_files(devicekit_t)
+files_read_etc_runtime_files(devicekit_t)
 
 miscfiles_read_localization(devicekit_t)

@@ -188,7 +189,7 @@ optional_policy(`
 #
 
 allow devicekit_power_t self:capability { dac_override net_admin sys_admin sys_tty_config sys_nice sys_ptrace };
-allow devicekit_power_t self:process getsched;
+allow devicekit_power_t self:process { getsched signal };
 allow devicekit_power_t self:fifo_file rw_fifo_file_perms;
 allow devicekit_power_t self:unix_dgram_socket create_socket_perms;
 allow devicekit_power_t self:netlink_kobject_uevent_socket create_socket_perms;

@@ -197,12 +198,15 @@ manage_dirs_pattern(devicekit_power_t, d
 manage_files_pattern(devicekit_power_t, devicekit_var_lib_t, devicekit_var_lib_t)
 files_var_lib_filetrans(devicekit_power_t, devicekit_var_lib_t, dir)
 
+kernel_search_fs_sysctl(devicekit_power_t)
+kernel_rw_vm_sysctls(devicekit_power_t)
 kernel_read_network_state(devicekit_power_t)
 kernel_read_system_state(devicekit_power_t)
 kernel_rw_hotplug_sysctls(devicekit_power_t)
 kernel_rw_kernel_sysctl(devicekit_power_t)
 kernel_search_debugfs(devicekit_power_t)
 kernel_write_proc_files(devicekit_power_t)
+kernel_setsched(devicekit_power_t)
 
 corecmd_exec_bin(devicekit_power_t)
 corecmd_exec_shell(devicekit_power_t)

@@ -219,9 +223,11 @@ dev_rw_sysfs(devicekit_power_t)
 
 files_read_kernel_img(devicekit_power_t)
 files_read_etc_files(devicekit_power_t)
+files_rw_etc_runtime_files(devicekit_power_t)
 files_read_usr_files(devicekit_power_t)
 
 fs_list_inotifyfs(devicekit_power_t)
+fs_remount_xattr_fs(devicekit_power_t)
 
 term_use_all_terms(devicekit_power_t)

@@ -234,6 +240,11 @@ sysnet_domtrans_ifconfig(devicekit_power
 
 userdom_read_all_users_state(devicekit_power_t)
 
+devicekit_getattr_apm_bios_files_power(devicekit_power_t)
+
+mount_exec_getattr(devicekit_power_t)
+mount_exec(devicekit_power_t)
+
 optional_policy(`
 	bootloader_domtrans(devicekit_power_t)
 ')

@@ -280,6 +291,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	storage_raw_read_fixed_disk(devicekit_power_t)
+')
+
+optional_policy(`
 	udev_read_db(devicekit_power_t)
 ')

Dominick Grift

2011-01-24 14:01 UTC #1 lore raw

PATCH 9/19 : patch set to update the git reference policy

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Quoted 16 lines · Guido Trentalancia

diff -pruN refpolicy-git-18012011-update-work/policy/modules/services/devicekit.if refpolicy-git-18012011-devicekit/policy/modules/services/devicekit.if
policy/modules/services/devicekit.if +9 -0
@@ -240,3 +240,22 @@ interface(`devicekit_admin',`
 	admin_pattern($1, devicekit_var_run_t)
 	files_search_pids($1)
 ')
+
+########################################
+## <summary>
+##      DeviceKit power getattr on APM
+##      bios character device node files.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.

policy/modules/services/devicekit.if interface(`devicekit_admin',` · line 261

Quoted 10 lines

policy/modules/services/devicekit.if +10 -0

+##      </summary>
+## </param>
+#
+interface(`devicekit_getattr_apm_bios_files_power',`
+	gen_require(`
+		type apm_bios_t;
+	')
+
+	getattr_chr_files_pattern($1, apm_bios_t, apm_bios_t)
+')

This interface name is wrong. It should be prefixed by the module name that defined it (which is not devicekit)

You should also allow access to the location of the apm_bios_t chr_files. This interface may provide access to get attribute of apm_bios_t chr_files, but it does not do any good if the caller cannot traverse its parent(s)

Quoted 49 lines

diff -pruN refpolicy-git-18012011-update-work/policy/modules/services/devicekit.te refpolicy-git-18012011-devicekit/policy/modules/services/devicekit.te

policy/modules/services/devicekit.te +7 -1

@@ -43,6 +43,7 @@ dev_read_sysfs(devicekit_t)
 dev_read_urand(devicekit_t)
 
 files_read_etc_files(devicekit_t)
+files_read_etc_runtime_files(devicekit_t)
 
 miscfiles_read_localization(devicekit_t)

@@ -188,7 +189,7 @@ optional_policy(`
 #
 
 allow devicekit_power_t self:capability { dac_override net_admin sys_admin sys_tty_config sys_nice sys_ptrace };
-allow devicekit_power_t self:process getsched;
+allow devicekit_power_t self:process { getsched signal };
 allow devicekit_power_t self:fifo_file rw_fifo_file_perms;
 allow devicekit_power_t self:unix_dgram_socket create_socket_perms;
 allow devicekit_power_t self:netlink_kobject_uevent_socket create_socket_perms;

@@ -197,12 +198,15 @@ manage_dirs_pattern(devicekit_power_t, d
 manage_files_pattern(devicekit_power_t, devicekit_var_lib_t, devicekit_var_lib_t)
 files_var_lib_filetrans(devicekit_power_t, devicekit_var_lib_t, dir)
 
+kernel_search_fs_sysctl(devicekit_power_t)
+kernel_rw_vm_sysctls(devicekit_power_t)
 kernel_read_network_state(devicekit_power_t)
 kernel_read_system_state(devicekit_power_t)
 kernel_rw_hotplug_sysctls(devicekit_power_t)
 kernel_rw_kernel_sysctl(devicekit_power_t)
 kernel_search_debugfs(devicekit_power_t)
 kernel_write_proc_files(devicekit_power_t)
+kernel_setsched(devicekit_power_t)
 
 corecmd_exec_bin(devicekit_power_t)
 corecmd_exec_shell(devicekit_power_t)

@@ -219,9 +223,11 @@ dev_rw_sysfs(devicekit_power_t)
 
 files_read_kernel_img(devicekit_power_t)
 files_read_etc_files(devicekit_power_t)
+files_rw_etc_runtime_files(devicekit_power_t)
 files_read_usr_files(devicekit_power_t)
 
 fs_list_inotifyfs(devicekit_power_t)
+fs_remount_xattr_fs(devicekit_power_t)
 
 term_use_all_terms(devicekit_power_t)

policy/modules/services/devicekit.te sysnet_domtrans_ifconfig(devicekit_power · line 245

Quoted 6 lines

policy/modules/services/devicekit.te +3 -0

@@ -234,6 +240,11 @@ sysnet_domtrans_ifconfig(devicekit_power
 
 userdom_read_all_users_state(devicekit_power_t)
 
+devicekit_getattr_apm_bios_files_power(devicekit_power_t)
+
+mount_exec_getattr(devicekit_power_t)

This interface name doesnt make sense to me

Quoted 18 lines

policy/modules/services/devicekit.te +6 -0

+mount_exec(devicekit_power_t)
+
 optional_policy(`
 	bootloader_domtrans(devicekit_power_t)
 ')

@@ -280,6 +291,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	storage_raw_read_fixed_disk(devicekit_power_t)
+')
+
+optional_policy(`
 	udev_read_db(devicekit_power_t)
 ')

Quoted 4 lines

_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.16 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk09hk8ACgkQMlxVo39jgT8ivACfebUqxIup1uLhdPBqnPMyIyk1 5RoAoIzgwDxb0BY+3TzwigGJ1W0e3a++
=qdkU
-----END PGP SIGNATURE-----

Guido Trentalancia

author

2011-01-24 15:32 UTC #2 lore raw

PATCH 9/19 : patch set to update the git reference policy

Quoted 31 lines · Dominick Grift

Quoted 16 lines · Guido Trentalancia
diff -pruN refpolicy-git-18012011-update-work/policy/modules/services/devicekit.if refpolicy-git-18012011-devicekit/policy/modules/services/devicekit.if
policy/modules/services/devicekit.if +9 -0
@@ -240,3 +240,22 @@ interface(`devicekit_admin',`
 	admin_pattern($1, devicekit_var_run_t)
 	files_search_pids($1)
 ')
+
+########################################
+## <summary>
+##      DeviceKit power getattr on APM
+##      bios character device node files.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
policy/modules/services/devicekit.if interface(`devicekit_admin',` · line 261
Quoted 10 lines
policy/modules/services/devicekit.if +10 -0
+##      </summary>
+## </param>
+#
+interface(`devicekit_getattr_apm_bios_files_power',`
+	gen_require(`
+		type apm_bios_t;
+	')
+
+	getattr_chr_files_pattern($1, apm_bios_t, apm_bios_t)
+')
This interface name is wrong. It should be prefixed by the module name that defined it (which is not devicekit)

Quoted 4 lines

You should also allow access to the location of the apm_bios_t chr_files. This interface may provide access to get attribute of apm_bios_t chr_files, but it does not do any good if the caller cannot traverse its parent(s)

Yes. Will be moved to devices.if.

Quoted 50 lines

diff -pruN refpolicy-git-18012011-update-work/policy/modules/services/devicekit.te refpolicy-git-18012011-devicekit/policy/modules/services/devicekit.te

policy/modules/services/devicekit.te +7 -1

@@ -43,6 +43,7 @@ dev_read_sysfs(devicekit_t)
 dev_read_urand(devicekit_t)
 
 files_read_etc_files(devicekit_t)
+files_read_etc_runtime_files(devicekit_t)
 
 miscfiles_read_localization(devicekit_t)

@@ -188,7 +189,7 @@ optional_policy(`
 #
 
 allow devicekit_power_t self:capability { dac_override net_admin sys_admin sys_tty_config sys_nice sys_ptrace };
-allow devicekit_power_t self:process getsched;
+allow devicekit_power_t self:process { getsched signal };
 allow devicekit_power_t self:fifo_file rw_fifo_file_perms;
 allow devicekit_power_t self:unix_dgram_socket create_socket_perms;
 allow devicekit_power_t self:netlink_kobject_uevent_socket create_socket_perms;

@@ -197,12 +198,15 @@ manage_dirs_pattern(devicekit_power_t, d
 manage_files_pattern(devicekit_power_t, devicekit_var_lib_t, devicekit_var_lib_t)
 files_var_lib_filetrans(devicekit_power_t, devicekit_var_lib_t, dir)
 
+kernel_search_fs_sysctl(devicekit_power_t)
+kernel_rw_vm_sysctls(devicekit_power_t)
 kernel_read_network_state(devicekit_power_t)
 kernel_read_system_state(devicekit_power_t)
 kernel_rw_hotplug_sysctls(devicekit_power_t)
 kernel_rw_kernel_sysctl(devicekit_power_t)
 kernel_search_debugfs(devicekit_power_t)
 kernel_write_proc_files(devicekit_power_t)
+kernel_setsched(devicekit_power_t)
 
 corecmd_exec_bin(devicekit_power_t)
 corecmd_exec_shell(devicekit_power_t)

@@ -219,9 +223,11 @@ dev_rw_sysfs(devicekit_power_t)
 
 files_read_kernel_img(devicekit_power_t)
 files_read_etc_files(devicekit_power_t)
+files_rw_etc_runtime_files(devicekit_power_t)
 files_read_usr_files(devicekit_power_t)
 
 fs_list_inotifyfs(devicekit_power_t)
+fs_remount_xattr_fs(devicekit_power_t)
 
 term_use_all_terms(devicekit_power_t)

@@ -234,6 +240,11 @@ sysnet_domtrans_ifconfig(devicekit_power

Quoted 7 lines

policy/modules/services/devicekit.te sysnet_domtrans_ifconfig(devicekit_power · line 245
Quoted 5 lines
policy/modules/services/devicekit.te +3 -0
 userdom_read_all_users_state(devicekit_power_t)
 
+devicekit_getattr_apm_bios_files_power(devicekit_power_t)
+
+mount_exec_getattr(devicekit_power_t)
This interface name doesnt make sense to me

So, what name do you propose instead ?

Regards,

Guido

Dominick Grift

2011-01-24 15:34 UTC #3 lore raw

PATCH 9/19 : patch set to update the git reference policy

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Quoted 91 lines · Guido Trentalancia

Quoted 31 lines · Dominick Grift

Quoted 16 lines · Guido Trentalancia
diff -pruN refpolicy-git-18012011-update-work/policy/modules/services/devicekit.if refpolicy-git-18012011-devicekit/policy/modules/services/devicekit.if
policy/modules/services/devicekit.if +9 -0
@@ -240,3 +240,22 @@ interface(`devicekit_admin',`
 	admin_pattern($1, devicekit_var_run_t)
 	files_search_pids($1)
 ')
+
+########################################
+## <summary>
+##      DeviceKit power getattr on APM
+##      bios character device node files.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
policy/modules/services/devicekit.if interface(`devicekit_admin',` · line 261
Quoted 10 lines
policy/modules/services/devicekit.if +10 -0
+##      </summary>
+## </param>
+#
+interface(`devicekit_getattr_apm_bios_files_power',`
+	gen_require(`
+		type apm_bios_t;
+	')
+
+	getattr_chr_files_pattern($1, apm_bios_t, apm_bios_t)
+')
This interface name is wrong. It should be prefixed by the module name that defined it (which is not devicekit)

Quoted 4 lines

You should also allow access to the location of the apm_bios_t chr_files. This interface may provide access to get attribute of apm_bios_t chr_files, but it does not do any good if the caller cannot traverse its parent(s)

Yes. Will be moved to devices.if.

Quoted 52 lines

diff -pruN refpolicy-git-18012011-update-work/policy/modules/services/devicekit.te refpolicy-git-18012011-devicekit/policy/modules/services/devicekit.te

policy/modules/services/devicekit.te +7 -1

@@ -43,6 +43,7 @@ dev_read_sysfs(devicekit_t)
 dev_read_urand(devicekit_t)
 
 files_read_etc_files(devicekit_t)
+files_read_etc_runtime_files(devicekit_t)
 
 miscfiles_read_localization(devicekit_t)

@@ -188,7 +189,7 @@ optional_policy(`
 #
 
 allow devicekit_power_t self:capability { dac_override net_admin sys_admin sys_tty_config sys_nice sys_ptrace };
-allow devicekit_power_t self:process getsched;
+allow devicekit_power_t self:process { getsched signal };
 allow devicekit_power_t self:fifo_file rw_fifo_file_perms;
 allow devicekit_power_t self:unix_dgram_socket create_socket_perms;
 allow devicekit_power_t self:netlink_kobject_uevent_socket create_socket_perms;

@@ -197,12 +198,15 @@ manage_dirs_pattern(devicekit_power_t, d
 manage_files_pattern(devicekit_power_t, devicekit_var_lib_t, devicekit_var_lib_t)
 files_var_lib_filetrans(devicekit_power_t, devicekit_var_lib_t, dir)
 
+kernel_search_fs_sysctl(devicekit_power_t)
+kernel_rw_vm_sysctls(devicekit_power_t)
 kernel_read_network_state(devicekit_power_t)
 kernel_read_system_state(devicekit_power_t)
 kernel_rw_hotplug_sysctls(devicekit_power_t)
 kernel_rw_kernel_sysctl(devicekit_power_t)
 kernel_search_debugfs(devicekit_power_t)
 kernel_write_proc_files(devicekit_power_t)
+kernel_setsched(devicekit_power_t)
 
 corecmd_exec_bin(devicekit_power_t)
 corecmd_exec_shell(devicekit_power_t)

@@ -219,9 +223,11 @@ dev_rw_sysfs(devicekit_power_t)
 
 files_read_kernel_img(devicekit_power_t)
 files_read_etc_files(devicekit_power_t)
+files_rw_etc_runtime_files(devicekit_power_t)
 files_read_usr_files(devicekit_power_t)
 
 fs_list_inotifyfs(devicekit_power_t)
+fs_remount_xattr_fs(devicekit_power_t)
 
 term_use_all_terms(devicekit_power_t)

@@ -234,6 +240,11 @@ sysnet_domtrans_ifconfig(devicekit_power
 
 userdom_read_all_users_state(devicekit_power_t)

Quoted 7 lines

Quoted 5 lines
policy/modules/services/devicekit.te sysnet_domtrans_ifconfig(devicekit_power · line 245
Quoted 3 lines
policy/modules/services/devicekit.te +3 -0
+devicekit_getattr_apm_bios_files_power(devicekit_power_t)
+
+mount_exec_getattr(devicekit_power_t)
This interface name doesnt make sense to me
So, what name do you propose instead ?

something like mount_getattr_executable_file() or something. Although besides the naming issue, i am not sure whether there is a real need for the interface at all.

Quoted 4 lines

Regards,
Guido

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.16 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk09nA8ACgkQMlxVo39jgT9h6ACggShQXCugLPWW3pFQBFIEMNJH 94cAn02PtH6Wr7tuO33iXQjpvPamDWL+
=94mT
-----END PGP SIGNATURE-----

Guido Trentalancia

author

2011-01-25 18:20 UTC #4 lore raw

PATCH 9/19 : patch set to update the git reference policy

Hello again Dominick !

Quoted 61 lines · Dominick Grift

Quoted 60 lines · Guido Trentalancia

Quoted 58 lines · Dominick Grift

Quoted 49 lines · Guido Trentalancia

diff -pruN refpolicy-git-18012011-update-work/policy/modules/services/devicekit.te refpolicy-git-18012011-devicekit/policy/modules/services/devicekit.te

policy/modules/services/devicekit.te +7 -1

@@ -43,6 +43,7 @@ dev_read_sysfs(devicekit_t)
 dev_read_urand(devicekit_t)
 
 files_read_etc_files(devicekit_t)
+files_read_etc_runtime_files(devicekit_t)
 
 miscfiles_read_localization(devicekit_t)

@@ -188,7 +189,7 @@ optional_policy(`
 #
 
 allow devicekit_power_t self:capability { dac_override net_admin sys_admin sys_tty_config sys_nice sys_ptrace };
-allow devicekit_power_t self:process getsched;
+allow devicekit_power_t self:process { getsched signal };
 allow devicekit_power_t self:fifo_file rw_fifo_file_perms;
 allow devicekit_power_t self:unix_dgram_socket create_socket_perms;
 allow devicekit_power_t self:netlink_kobject_uevent_socket create_socket_perms;

@@ -197,12 +198,15 @@ manage_dirs_pattern(devicekit_power_t, d
 manage_files_pattern(devicekit_power_t, devicekit_var_lib_t, devicekit_var_lib_t)
 files_var_lib_filetrans(devicekit_power_t, devicekit_var_lib_t, dir)
 
+kernel_search_fs_sysctl(devicekit_power_t)
+kernel_rw_vm_sysctls(devicekit_power_t)
 kernel_read_network_state(devicekit_power_t)
 kernel_read_system_state(devicekit_power_t)
 kernel_rw_hotplug_sysctls(devicekit_power_t)
 kernel_rw_kernel_sysctl(devicekit_power_t)
 kernel_search_debugfs(devicekit_power_t)
 kernel_write_proc_files(devicekit_power_t)
+kernel_setsched(devicekit_power_t)
 
 corecmd_exec_bin(devicekit_power_t)
 corecmd_exec_shell(devicekit_power_t)

@@ -219,9 +223,11 @@ dev_rw_sysfs(devicekit_power_t)
 
 files_read_kernel_img(devicekit_power_t)
 files_read_etc_files(devicekit_power_t)
+files_rw_etc_runtime_files(devicekit_power_t)
 files_read_usr_files(devicekit_power_t)
 
 fs_list_inotifyfs(devicekit_power_t)
+fs_remount_xattr_fs(devicekit_power_t)
 
 term_use_all_terms(devicekit_power_t)

policy/modules/services/devicekit.te sysnet_domtrans_ifconfig(devicekit_power · line 245

Quoted 6 lines

policy/modules/services/devicekit.te +3 -0

@@ -234,6 +240,11 @@ sysnet_domtrans_ifconfig(devicekit_power
 
 userdom_read_all_users_state(devicekit_power_t)
 
+devicekit_getattr_apm_bios_files_power(devicekit_power_t)
+
+mount_exec_getattr(devicekit_power_t)

This interface name doesnt make sense to me

Quoted 6 lines

Quoted 1 line
So, what name do you propose instead ?
something like mount_getattr_executable_file() or something. Although besides the naming issue, i am not sure whether there is a real need for the interface at all.

The name has been changed according to the one that you proposed. Yes, it's needed, unless the explcit permissions are written down as allowed rules in the TE file, which is not very readable.

Regards,

Guido

Guido Trentalancia

author

2011-01-26 17:26 UTC #5 lore raw

PATCH 9/19 : patch set to update the git reference policy

Hi Dominick !

Something new in the DeviceKit module. The following permissions came up as needed and have been added:

fs_getattr_xattr_fs for both devicekit_{disk,power}_t

Regards,

Guido