: patch set to update the git reference policy

PATCH New Guido Trentalancia 3 participants 14 messages Jan 24, 2011 – Jan 31, 2011

lore

Share & tools

lore

Guido Trentalancia

author

2011-01-24 00:43 UTC #0 lore raw

PATCH 3/19 : patch set to update the git reference policy

policy/modules/admin/readahead.te +1 -0

diff -pruN -x .git -x corenetwork.if -x corenetwork.te -x booleans.conf -x modules.conf refpolicy-git-18012011/policy/modules/admin/readahead.te refpolicy-git-18012011-update/policy/modules/admin/readahead.te
@@ -79,6 +79,7 @@ term_dontaudit_use_console(readahead_t)
 
 auth_dontaudit_read_shadow(readahead_t)
 
+init_read_fifo_file(readahead_t)
 init_use_fds(readahead_t)
 init_use_script_ptys(readahead_t)
 init_getattr_initctl(readahead_t)

policy/modules/system/init.if +18 -0

diff -pruN -x .git -x booleans.conf -x corenetwork.if -x corenetwork.te -x modules.conf refpolicy-git-18012011/policy/modules/system/init.if refpolicy-git-18012011-new/policy/modules/system/init.if
@@ -947,6 +947,24 @@ interface(`init_read_state',`
 
 ########################################
 ## <summary>
+##      Read init fifo file.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`init_read_fifo_file',`
+		gen_require(`
+		attribute init_t;
+	')
+
+	read_fifo_files_pattern($1, init_t, init_t)
+')
+
+########################################
+## <summary>
 ##	Ptrace init
 ## </summary>
 ## <param name="domain">

Dominick Grift

2011-01-24 14:21 UTC #1 lore raw

PATCH 3/19 : patch set to update the git reference policy

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Quoted 23 lines · Guido Trentalancia

diff -pruN -x .git -x corenetwork.if -x corenetwork.te -x booleans.conf -x modules.conf refpolicy-git-18012011/policy/modules/admin/readahead.te refpolicy-git-18012011-update/policy/modules/admin/readahead.te
policy/modules/admin/readahead.te +1 -0
@@ -79,6 +79,7 @@ term_dontaudit_use_console(readahead_t)
 
 auth_dontaudit_read_shadow(readahead_t)
 
+init_read_fifo_file(readahead_t)
 init_use_fds(readahead_t)
 init_use_script_ptys(readahead_t)
 init_getattr_initctl(readahead_t)
diff -pruN -x .git -x booleans.conf -x corenetwork.if -x corenetwork.te -x modules.conf refpolicy-git-18012011/policy/modules/system/init.if refpolicy-git-18012011-new/policy/modules/system/init.if
policy/modules/system/init.if +5 -0
@@ -947,6 +947,24 @@ interface(`init_read_state',`
 
 ########################################
 ## <summary>
+##      Read init fifo file.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.

policy/modules/system/init.if interface(`init_read_state',` · line 964

Quoted 10 lines

policy/modules/system/init.if +10 -0

+##      </summary>
+## </param>
+#
+interface(`init_read_fifo_file',`
+		gen_require(`
+		attribute init_t;
+	')
+
+	read_fifo_files_pattern($1, init_t, init_t)
+')

no need to for pattern here use: allow $1 init_t:fifo_file r_fifo_file_perms;

init_t is not an attribute (its a type)

Quoted 8 lines

policy/modules/system/init.if +3 -0

+
+########################################
+## <summary>
 ##	Ptrace init
 ## </summary>
 ## <param name="domain">

Quoted 4 lines

_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.16 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk09iwUACgkQMlxVo39jgT+z8wCgxkxTW3mmbIfGDj8HHGLlLRuS LR4AnRlYgmCf/My41QotF2VIfAnehq8D
=F4q9
-----END PGP SIGNATURE-----

Guido Trentalancia

author

2011-01-24 15:12 UTC #2 lore raw

PATCH 3/19 : patch set to update the git reference policy

Quoted 29 lines · Dominick Grift

Quoted 28 lines · Guido Trentalancia
diff -pruN -x .git -x corenetwork.if -x corenetwork.te -x booleans.conf -x modules.conf refpolicy-git-18012011/policy/modules/admin/readahead.te refpolicy-git-18012011-update/policy/modules/admin/readahead.te
policy/modules/admin/readahead.te +1 -0
@@ -79,6 +79,7 @@ term_dontaudit_use_console(readahead_t)
 
 auth_dontaudit_read_shadow(readahead_t)
 
+init_read_fifo_file(readahead_t)
 init_use_fds(readahead_t)
 init_use_script_ptys(readahead_t)
 init_getattr_initctl(readahead_t)
diff -pruN -x .git -x booleans.conf -x corenetwork.if -x corenetwork.te -x modules.conf refpolicy-git-18012011/policy/modules/system/init.if refpolicy-git-18012011-new/policy/modules/system/init.if
policy/modules/system/init.if +10 -0
@@ -947,6 +947,24 @@ interface(`init_read_state',`
 
 ########################################
 ## <summary>
+##      Read init fifo file.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`init_read_fifo_file',`
+		gen_require(`

Quoted 8 lines

policy/modules/system/init.if interface(`init_read_state',` · line 964
Quoted 5 lines
policy/modules/system/init.if +5 -0
+		attribute init_t;
+	')
+
+	read_fifo_files_pattern($1, init_t, init_t)
+')
no need to for pattern here use: allow $1 init_t:fifo_file r_fifo_file_perms;

Ok will be changed.

Quoted 1 line

init_t is not an attribute (its a type)

Hmm. That's too true, good point. But elsewhere in the same interface file it's being declared the same way (see init_ptrace() and init_read_state()). I think I just copied off bits from there, that's why... What should be done to the rest of occurrences then ?

Quoted 26 lines

Quoted 8 lines
policy/modules/system/init.if +3 -0
+
+########################################
+## <summary>
 ##	Ptrace init
 ## </summary>
 ## <param name="domain">
Quoted 4 lines
_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.16 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAk09iwUACgkQMlxVo39jgT+z8wCgxkxTW3mmbIfGDj8HHGLlLRuS LR4AnRlYgmCf/My41QotF2VIfAnehq8D
=F4q9
-----END PGP SIGNATURE-----
_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

Dominick Grift

2011-01-24 15:15 UTC #3 lore raw

PATCH 3/19 : patch set to update the git reference policy

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Quoted 39 lines · Guido Trentalancia

Quoted 29 lines · Dominick Grift
Quoted 28 lines · Guido Trentalancia
diff -pruN -x .git -x corenetwork.if -x corenetwork.te -x booleans.conf -x modules.conf refpolicy-git-18012011/policy/modules/admin/readahead.te refpolicy-git-18012011-update/policy/modules/admin/readahead.te
policy/modules/admin/readahead.te +1 -0
@@ -79,6 +79,7 @@ term_dontaudit_use_console(readahead_t)
 
 auth_dontaudit_read_shadow(readahead_t)
 
+init_read_fifo_file(readahead_t)
 init_use_fds(readahead_t)
 init_use_script_ptys(readahead_t)
 init_getattr_initctl(readahead_t)
diff -pruN -x .git -x booleans.conf -x corenetwork.if -x corenetwork.te -x modules.conf refpolicy-git-18012011/policy/modules/system/init.if refpolicy-git-18012011-new/policy/modules/system/init.if
policy/modules/system/init.if +10 -0
@@ -947,6 +947,24 @@ interface(`init_read_state',`
 
 ########################################
 ## <summary>
+##      Read init fifo file.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`init_read_fifo_file',`
+		gen_require(`
Quoted 8 lines
policy/modules/system/init.if interface(`init_read_state',` · line 964
Quoted 5 lines
policy/modules/system/init.if +5 -0
+		attribute init_t;
+	')
+
+	read_fifo_files_pattern($1, init_t, init_t)
+')
no need to for pattern here use: allow $1 init_t:fifo_file r_fifo_file_perms;

Quoted 8 lines

Ok will be changed.
Quoted 1 line
init_t is not an attribute (its a type)
Hmm. That's too true, good point. But elsewhere in the same interface file it's being declared the same way (see init_ptrace() and init_read_state()). I think I just copied off bits from there, that's why... What should be done to the rest of occurrences then ?

That should be analysed and determined in each of the remaining occurrences.

You may well have stumbled upon a bug.

Quoted 18 lines

Quoted 18 lines
Quoted 9 lines
policy/modules/system/init.if +3 -0
+
+########################################
+## <summary>
 ##	Ptrace init
 ## </summary>
 ## <param name="domain">
Quoted 4 lines
_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.16 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

Quoted 11 lines

Quoted 9 lines
iEYEARECAAYFAk09iwUACgkQMlxVo39jgT+z8wCgxkxTW3mmbIfGDj8HHGLlLRuS LR4AnRlYgmCf/My41QotF2VIfAnehq8D
=F4q9
-----END PGP SIGNATURE-----
_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.16 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk09l3cACgkQMlxVo39jgT8kkQCfUoWNoXKmT/lP/nJgb+fLwnk0 3JMAni6n1wBEpZOVq6g0hodqDou9oc9A
=nNQN
-----END PGP SIGNATURE-----

Christopher J. PeBenito

2011-01-31 19:09 UTC #4 lore raw

PATCH 3/19 : patch set to update the git reference policy

Quoted 44 lines · Dominick Grift

Quoted 43 lines · Guido Trentalancia
Quoted 29 lines · Dominick Grift
Quoted 28 lines · Guido Trentalancia
diff -pruN -x .git -x corenetwork.if -x corenetwork.te -x booleans.conf -x modules.conf refpolicy-git-18012011/policy/modules/admin/readahead.te refpolicy-git-18012011-update/policy/modules/admin/readahead.te
policy/modules/admin/readahead.te +1 -0
@@ -79,6 +79,7 @@ term_dontaudit_use_console(readahead_t)
 
  auth_dontaudit_read_shadow(readahead_t)
 
+init_read_fifo_file(readahead_t)
  init_use_fds(readahead_t)
  init_use_script_ptys(readahead_t)
  init_getattr_initctl(readahead_t)
diff -pruN -x .git -x booleans.conf -x corenetwork.if -x corenetwork.te -x modules.conf refpolicy-git-18012011/policy/modules/system/init.if refpolicy-git-18012011-new/policy/modules/system/init.if
policy/modules/system/init.if +10 -0
@@ -947,6 +947,24 @@ interface(`init_read_state',`
 
  ########################################
  ##<summary>
+##      Read init fifo file.
+##</summary>
+##<param name="domain">
+##<summary>
+##      Domain allowed access.
+##</summary>
+##</param>
+#
+interface(`init_read_fifo_file',`
+		gen_require(`
Quoted 8 lines
policy/modules/system/init.if interface(`init_read_state',` · line 964
Quoted 5 lines
policy/modules/system/init.if +5 -0
+		attribute init_t;
+	')
+
+	read_fifo_files_pattern($1, init_t, init_t)
+')
no need to for pattern here use: allow $1 init_t:fifo_file r_fifo_file_perms;
Ok will be changed.
Quoted 1 line
init_t is not an attribute (its a type)

Quoted 8 lines

Quoted 4 lines
Hmm. That's too true, good point. But elsewhere in the same interface file it's being declared the same way (see init_ptrace() and init_read_state()). I think I just copied off bits from there, that's why... What should be done to the rest of occurrences then ?
That should be analysed and determined in each of the remaining occurrences.
You may well have stumbled upon a bug.

Yep, there are two interfaces with this bug. I have fixed them in git master.

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

Guido Trentalancia

author

2011-01-25 18:04 UTC #5 lore raw

PATCH 3/19 : patch set to update the git reference policy

In reply to Dominick Grift

Hi Dominick,

just a quick question on one of your comments...

Quoted 29 lines · Dominick Grift

Quoted 28 lines · Guido Trentalancia
diff -pruN -x .git -x corenetwork.if -x corenetwork.te -x booleans.conf -x modules.conf refpolicy-git-18012011/policy/modules/admin/readahead.te refpolicy-git-18012011-update/policy/modules/admin/readahead.te
policy/modules/admin/readahead.te +1 -0
@@ -79,6 +79,7 @@ term_dontaudit_use_console(readahead_t)
 
 auth_dontaudit_read_shadow(readahead_t)
 
+init_read_fifo_file(readahead_t)
 init_use_fds(readahead_t)
 init_use_script_ptys(readahead_t)
 init_getattr_initctl(readahead_t)
diff -pruN -x .git -x booleans.conf -x corenetwork.if -x corenetwork.te -x modules.conf refpolicy-git-18012011/policy/modules/system/init.if refpolicy-git-18012011-new/policy/modules/system/init.if
policy/modules/system/init.if +10 -0
@@ -947,6 +947,24 @@ interface(`init_read_state',`
 
 ########################################
 ## <summary>
+##      Read init fifo file.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`init_read_fifo_file',`
+		gen_require(`

Quoted 8 lines

policy/modules/system/init.if interface(`init_read_state',` · line 964
Quoted 5 lines
policy/modules/system/init.if +5 -0
+		attribute init_t;
+	')
+
+	read_fifo_files_pattern($1, init_t, init_t)
+')
no need to for pattern here use: allow $1 init_t:fifo_file r_fifo_file_perms;

Why should we avoid the use of the pattern here ? It gives better readability and also it grants permission to search the parent dir.

Regards,

Guido

Dominick Grift

2011-01-25 18:14 UTC #6 lore raw

PATCH 3/19 : patch set to update the git reference policy

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Quoted 43 lines · Guido Trentalancia

Hi Dominick,
just a quick question on one of your comments...
Quoted 29 lines · Dominick Grift
Quoted 28 lines · Guido Trentalancia
diff -pruN -x .git -x corenetwork.if -x corenetwork.te -x booleans.conf -x modules.conf refpolicy-git-18012011/policy/modules/admin/readahead.te refpolicy-git-18012011-update/policy/modules/admin/readahead.te
policy/modules/admin/readahead.te +1 -0
@@ -79,6 +79,7 @@ term_dontaudit_use_console(readahead_t)
 
 auth_dontaudit_read_shadow(readahead_t)
 
+init_read_fifo_file(readahead_t)
 init_use_fds(readahead_t)
 init_use_script_ptys(readahead_t)
 init_getattr_initctl(readahead_t)
diff -pruN -x .git -x booleans.conf -x corenetwork.if -x corenetwork.te -x modules.conf refpolicy-git-18012011/policy/modules/system/init.if refpolicy-git-18012011-new/policy/modules/system/init.if
policy/modules/system/init.if +10 -0
@@ -947,6 +947,24 @@ interface(`init_read_state',`
 
 ########################################
 ## <summary>
+##      Read init fifo file.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`init_read_fifo_file',`
+		gen_require(`
Quoted 8 lines
policy/modules/system/init.if interface(`init_read_state',` · line 964
Quoted 5 lines
policy/modules/system/init.if +5 -0
+		attribute init_t;
+	')
+
+	read_fifo_files_pattern($1, init_t, init_t)
+')
no need to for pattern here use: allow $1 init_t:fifo_file r_fifo_file_perms;

Quoted 2 lines

Why should we avoid the use of the pattern here ? It gives better readability and also it grants permission to search the parent dir.

I guess you may indeed be right here. I assume that this pipe is somewhere in /proc in an init_t directory? If that is so then the caller indeed needs to traverse an init_t directory to get to the pipe i guess, and in that case the pattern makes good sense.

looking at similar examples thought, like

Quoted 7 lines

interface(init_rw_script_pipes',

	gen_require(`
		type initrc_t;
	')

	allow $1 initrc_t:fifo_file { read write };

And

Quoted 7 lines

interface(init_write_script_pipes',
	gen_require(`
		type initrc_t;
	')

	allow $1 initrc_t:fifo_file write;
')

It appears that searching domain_type directories is not applicable here.

Can you reproduce this (and in particular the caller searching init_t directories?)

Quoted 5 lines

Regards,
Guido

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.16 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk0/ExcACgkQMlxVo39jgT+5NACdHO/ZysRYMxLjU0J1+8NcWT2u nDgAn0Q4PNYqudn97HQFxHh386VDiCeV
=HaKz
-----END PGP SIGNATURE-----

Guido Trentalancia

author

2011-01-25 18:26 UTC #7 lore raw

PATCH 3/19 : patch set to update the git reference policy

Hello Dominick !

Quoted 69 lines · Dominick Grift

Quoted 43 lines · Guido Trentalancia
Hi Dominick,
just a quick question on one of your comments...
Quoted 29 lines · Dominick Grift
Quoted 28 lines · Guido Trentalancia
diff -pruN -x .git -x corenetwork.if -x corenetwork.te -x booleans.conf -x modules.conf refpolicy-git-18012011/policy/modules/admin/readahead.te refpolicy-git-18012011-update/policy/modules/admin/readahead.te
policy/modules/admin/readahead.te +1 -0
@@ -79,6 +79,7 @@ term_dontaudit_use_console(readahead_t)
 
 auth_dontaudit_read_shadow(readahead_t)
 
+init_read_fifo_file(readahead_t)
 init_use_fds(readahead_t)
 init_use_script_ptys(readahead_t)
 init_getattr_initctl(readahead_t)
diff -pruN -x .git -x booleans.conf -x corenetwork.if -x corenetwork.te -x modules.conf refpolicy-git-18012011/policy/modules/system/init.if refpolicy-git-18012011-new/policy/modules/system/init.if
policy/modules/system/init.if +10 -0
@@ -947,6 +947,24 @@ interface(`init_read_state',`
 
 ########################################
 ## <summary>
+##      Read init fifo file.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`init_read_fifo_file',`
+		gen_require(`
Quoted 8 lines
policy/modules/system/init.if interface(`init_read_state',` · line 964
Quoted 5 lines
policy/modules/system/init.if +5 -0
+		attribute init_t;
+	')
+
+	read_fifo_files_pattern($1, init_t, init_t)
+')
no need to for pattern here use: allow $1 init_t:fifo_file r_fifo_file_perms;
Quoted 2 lines
Why should we avoid the use of the pattern here ? It gives better readability and also it grants permission to search the parent dir.
I guess you may indeed be right here. I assume that this pipe is somewhere in /proc in an init_t directory? If that is so then the caller indeed needs to traverse an init_t directory to get to the pipe i guess, and in that case the pattern makes good sense.
looking at similar examples thought, like
Quoted 7 lines
interface(init_rw_script_pipes',
	gen_require(`
		type initrc_t;
	')

	allow $1 initrc_t:fifo_file { read write };
')
And
Quoted 5 lines
interface(init_write_script_pipes',
	gen_require(`
		type initrc_t;
	')

Quoted 7 lines

Quoted 2 lines
	allow $1 initrc_t:fifo_file write;
')
It appears that searching domain_type directories is not applicable here.
Can you reproduce this (and in particular the caller searching init_t directories?)

Yes, of course I am quite sure it can be reproduced by just starting up readahead. Here is the log:

type=AVC msg=audit(1294704869.317:19776): avc: denied { read } for pid=2661 comm="readahead" path="pipe:[8853]" dev=pipefs ino=8853 scontext=system_u:system_r:readahead_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=fifo_file type=1400 audit(1294704824.813:3): avc: denied { read } for pid=1398 comm="readahead-colle" path="pipe:[3384]" dev=pipefs ino=3384 scontext=system_u:system_r:readahead_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=fifo_file

Regards,

Guido

Dominick Grift

2011-01-25 18:30 UTC #8 lore raw

PATCH 3/19 : patch set to update the git reference policy

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Quoted 83 lines · Guido Trentalancia

Hello Dominick !
Quoted 69 lines · Dominick Grift
Quoted 43 lines · Guido Trentalancia
Hi Dominick,
just a quick question on one of your comments...
Quoted 29 lines · Dominick Grift
Quoted 28 lines · Guido Trentalancia
diff -pruN -x .git -x corenetwork.if -x corenetwork.te -x booleans.conf -x modules.conf refpolicy-git-18012011/policy/modules/admin/readahead.te refpolicy-git-18012011-update/policy/modules/admin/readahead.te
policy/modules/admin/readahead.te +1 -0
@@ -79,6 +79,7 @@ term_dontaudit_use_console(readahead_t)
 
 auth_dontaudit_read_shadow(readahead_t)
 
+init_read_fifo_file(readahead_t)
 init_use_fds(readahead_t)
 init_use_script_ptys(readahead_t)
 init_getattr_initctl(readahead_t)
diff -pruN -x .git -x booleans.conf -x corenetwork.if -x corenetwork.te -x modules.conf refpolicy-git-18012011/policy/modules/system/init.if refpolicy-git-18012011-new/policy/modules/system/init.if
policy/modules/system/init.if +10 -0
@@ -947,6 +947,24 @@ interface(`init_read_state',`
 
 ########################################
 ## <summary>
+##      Read init fifo file.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`init_read_fifo_file',`
+		gen_require(`
Quoted 8 lines
policy/modules/system/init.if interface(`init_read_state',` · line 964
Quoted 5 lines
policy/modules/system/init.if +5 -0
+		attribute init_t;
+	')
+
+	read_fifo_files_pattern($1, init_t, init_t)
+')
no need to for pattern here use: allow $1 init_t:fifo_file r_fifo_file_perms;
Quoted 2 lines
Why should we avoid the use of the pattern here ? It gives better readability and also it grants permission to search the parent dir.
I guess you may indeed be right here. I assume that this pipe is somewhere in /proc in an init_t directory? If that is so then the caller indeed needs to traverse an init_t directory to get to the pipe i guess, and in that case the pattern makes good sense.
looking at similar examples thought, like
Quoted 7 lines
interface(init_rw_script_pipes',
	gen_require(`
		type initrc_t;
	')

	allow $1 initrc_t:fifo_file { read write };
')
And
Quoted 5 lines
interface(init_write_script_pipes',
	gen_require(`
		type initrc_t;
	')
Quoted 7 lines
Quoted 2 lines
	allow $1 initrc_t:fifo_file write;
')
It appears that searching domain_type directories is not applicable here.
Can you reproduce this (and in particular the caller searching init_t directories?)
Yes, of course I am quite sure it can be reproduced by just starting up readahead. Here is the log:

Quoted 8 lines

type=AVC msg=audit(1294704869.317:19776): avc: denied { read } for pid=2661 comm="readahead" path="pipe:[8853]" dev=pipefs ino=8853 scontext=system_u:system_r:readahead_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=fifo_file type=1400 audit(1294704824.813:3): avc: denied { read } for pid=1398 comm="readahead-colle" path="pipe:[3384]" dev=pipefs ino=3384 scontext=system_u:system_r:readahead_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=fifo_file

Yes but it does not need to search any init_t type directories from what i can see in your avc denial above.

That is why i suggest you use:

allow $1 init_t:fifo_file r_fifo_file_perms;

instead.

Quoted 4 lines

Regards,
Guido

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.16 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk0/FtIACgkQMlxVo39jgT+afwCfRAz/0CBOTPYTIS40CAQAW8pZ vUcAn1tadnK+wgIXcLyF/72NHlJ2TWgW
=Y49m
-----END PGP SIGNATURE-----

Guido Trentalancia

author

2011-01-25 18:39 UTC #9 lore raw

PATCH 3/19 : patch set to update the git reference policy

Hello Dominick !

Quoted 73 lines · Dominick Grift

Quoted 63 lines · Guido Trentalancia
Hello Dominick !
Quoted 52 lines · Dominick Grift
Quoted 43 lines · Guido Trentalancia
Hi Dominick,
just a quick question on one of your comments...
Quoted 29 lines · Dominick Grift
Quoted 28 lines · Guido Trentalancia
diff -pruN -x .git -x corenetwork.if -x corenetwork.te -x booleans.conf -x modules.conf refpolicy-git-18012011/policy/modules/admin/readahead.te refpolicy-git-18012011-update/policy/modules/admin/readahead.te
policy/modules/admin/readahead.te +1 -0
@@ -79,6 +79,7 @@ term_dontaudit_use_console(readahead_t)
 
 auth_dontaudit_read_shadow(readahead_t)
 
+init_read_fifo_file(readahead_t)
 init_use_fds(readahead_t)
 init_use_script_ptys(readahead_t)
 init_getattr_initctl(readahead_t)
diff -pruN -x .git -x booleans.conf -x corenetwork.if -x corenetwork.te -x modules.conf refpolicy-git-18012011/policy/modules/system/init.if refpolicy-git-18012011-new/policy/modules/system/init.if
policy/modules/system/init.if +10 -0
@@ -947,6 +947,24 @@ interface(`init_read_state',`
 
 ########################################
 ## <summary>
+##      Read init fifo file.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`init_read_fifo_file',`
+		gen_require(`
Quoted 8 lines
policy/modules/system/init.if interface(`init_read_state',` · line 964
Quoted 5 lines
policy/modules/system/init.if +5 -0
+		attribute init_t;
+	')
+
+	read_fifo_files_pattern($1, init_t, init_t)
+')
no need to for pattern here use: allow $1 init_t:fifo_file r_fifo_file_perms;
Quoted 2 lines
Why should we avoid the use of the pattern here ? It gives better readability and also it grants permission to search the parent dir.
I guess you may indeed be right here. I assume that this pipe is somewhere in /proc in an init_t directory? If that is so then the caller indeed needs to traverse an init_t directory to get to the pipe i guess, and in that case the pattern makes good sense.
Quoted 4 lines
It appears that searching domain_type directories is not applicable here.
Can you reproduce this (and in particular the caller searching init_t directories?)
Yes, of course I am quite sure it can be reproduced by just starting up readahead. Here is the log:
Quoted 8 lines
type=AVC msg=audit(1294704869.317:19776): avc: denied { read } for pid=2661 comm="readahead" path="pipe:[8853]" dev=pipefs ino=8853 scontext=system_u:system_r:readahead_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=fifo_file type=1400 audit(1294704824.813:3): avc: denied { read } for pid=1398 comm="readahead-colle" path="pipe:[3384]" dev=pipefs ino=3384 scontext=system_u:system_r:readahead_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=fifo_file

Quoted 8 lines

Yes but it does not need to search any init_t type directories from what i can see in your avc denial above.
That is why i suggest you use:
allow $1 init_t:fifo_file r_fifo_file_perms;
instead.

It was just to keep the interface more generic and eventually re-usable. But I have now changed the interface to:

allow $1 init_t:fifo_file read_fifo_file_perms;

so it's a bit more optimised and tight.

Regards,

Guido

Dominick Grift

2011-01-25 18:46 UTC #10 lore raw

PATCH 3/19 : patch set to update the git reference policy

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Quoted 79 lines · Guido Trentalancia

Hello Dominick !
Quoted 76 lines · Dominick Grift
Quoted 63 lines · Guido Trentalancia
Hello Dominick !
Quoted 52 lines · Dominick Grift
Quoted 43 lines · Guido Trentalancia
Hi Dominick,
just a quick question on one of your comments...
Quoted 29 lines · Dominick Grift
Quoted 28 lines · Guido Trentalancia
diff -pruN -x .git -x corenetwork.if -x corenetwork.te -x booleans.conf -x modules.conf refpolicy-git-18012011/policy/modules/admin/readahead.te refpolicy-git-18012011-update/policy/modules/admin/readahead.te
policy/modules/admin/readahead.te +1 -0
@@ -79,6 +79,7 @@ term_dontaudit_use_console(readahead_t)
 
 auth_dontaudit_read_shadow(readahead_t)
 
+init_read_fifo_file(readahead_t)
 init_use_fds(readahead_t)
 init_use_script_ptys(readahead_t)
 init_getattr_initctl(readahead_t)
diff -pruN -x .git -x booleans.conf -x corenetwork.if -x corenetwork.te -x modules.conf refpolicy-git-18012011/policy/modules/system/init.if refpolicy-git-18012011-new/policy/modules/system/init.if
policy/modules/system/init.if +10 -0
@@ -947,6 +947,24 @@ interface(`init_read_state',`
 
 ########################################
 ## <summary>
+##      Read init fifo file.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`init_read_fifo_file',`
+		gen_require(`
Quoted 8 lines
policy/modules/system/init.if interface(`init_read_state',` · line 964
Quoted 5 lines
policy/modules/system/init.if +5 -0
+		attribute init_t;
+	')
+
+	read_fifo_files_pattern($1, init_t, init_t)
+')
no need to for pattern here use: allow $1 init_t:fifo_file r_fifo_file_perms;
Quoted 2 lines
Why should we avoid the use of the pattern here ? It gives better readability and also it grants permission to search the parent dir.
I guess you may indeed be right here. I assume that this pipe is somewhere in /proc in an init_t directory? If that is so then the caller indeed needs to traverse an init_t directory to get to the pipe i guess, and in that case the pattern makes good sense.
Quoted 4 lines
It appears that searching domain_type directories is not applicable here.
Can you reproduce this (and in particular the caller searching init_t directories?)
Yes, of course I am quite sure it can be reproduced by just starting up readahead. Here is the log:
Quoted 8 lines
type=AVC msg=audit(1294704869.317:19776): avc: denied { read } for pid=2661 comm="readahead" path="pipe:[8853]" dev=pipefs ino=8853 scontext=system_u:system_r:readahead_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=fifo_file type=1400 audit(1294704824.813:3): avc: denied { read } for pid=1398 comm="readahead-colle" path="pipe:[3384]" dev=pipefs ino=3384 scontext=system_u:system_r:readahead_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=fifo_file
Yes but it does not need to search any init_t type directories from what i can see in your avc denial above.

Quoted 8 lines

Quoted 5 lines
That is why i suggest you use:
allow $1 init_t:fifo_file r_fifo_file_perms;
instead.
It was just to keep the interface more generic and eventually re-usable. But I have now changed the interface to:

I understand, and allowing a domain to search a directory isnt a big deal. Yet i learned from experience. I mean there is a "pattern" in refpolicy, and i almost never see the read_fifo_file_pattern for domain types used so that is the reason for my suggestion. A nitpick but i had to mention it anyway. Trying to keep things uniform.

Quoted 9 lines

allow $1 init_t:fifo_file read_fifo_file_perms;
so it's a bit more optimised and tight.
Regards,
Guido

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.16 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk0/Gp0ACgkQMlxVo39jgT816QCeOVveRof++hSSxAE0D9io4rKT KWAAnjYOfbm/nj+8t1xn9/CzN1JgRsHk
=O37L
-----END PGP SIGNATURE-----

Guido Trentalancia

author

2011-01-25 19:20 UTC #11 lore raw

PATCH 3/19 : patch set to update the git reference policy

Quoted 11 lines · Dominick Grift

Quoted 4 lines · Guido Trentalancia
Hello Dominick !
It was just to keep the interface more generic and eventually re-usable. But I have now changed the interface to:
I understand, and allowing a domain to search a directory isnt a big deal. Yet i learned from experience. I mean there is a "pattern" in refpolicy, and i almost never see the read_fifo_file_pattern for domain types used so that is the reason for my suggestion. A nitpick but i had to mention it anyway. Trying to keep things uniform.

Yes, one of my first aims is to stay definitely uniform unless there is really a good reason to do things differently because of a possible improvement which brings some good advantages.

Splitting up dbus:send_msg permissions (to be uni-directional from each module) was one thing that I thought it could improve the actual situation for a good reason. But nobody else commented on that, so that thing is still pending... You didn't manage to convince me yet of your different opinion, but we'll see ;-)

Quoted 3 lines

Quoted 3 lines
allow $1 init_t:fifo_file read_fifo_file_perms;
so it's a bit more optimised and tight.

Regards,

Guido

Christopher J. PeBenito

2011-01-31 19:03 UTC #12 lore raw

PATCH 3/19 : patch set to update the git reference policy

In reply to Guido Trentalancia

Quoted 83 lines · Guido Trentalancia

Hello Dominick !
Quoted 69 lines · Dominick Grift
Quoted 43 lines · Guido Trentalancia
Hi Dominick,
just a quick question on one of your comments...
Quoted 29 lines · Dominick Grift
Quoted 28 lines · Guido Trentalancia
diff -pruN -x .git -x corenetwork.if -x corenetwork.te -x booleans.conf -x modules.conf refpolicy-git-18012011/policy/modules/admin/readahead.te refpolicy-git-18012011-update/policy/modules/admin/readahead.te
policy/modules/admin/readahead.te +1 -0
@@ -79,6 +79,7 @@ term_dontaudit_use_console(readahead_t)
 
  auth_dontaudit_read_shadow(readahead_t)
 
+init_read_fifo_file(readahead_t)
  init_use_fds(readahead_t)
  init_use_script_ptys(readahead_t)
  init_getattr_initctl(readahead_t)
diff -pruN -x .git -x booleans.conf -x corenetwork.if -x corenetwork.te -x modules.conf refpolicy-git-18012011/policy/modules/system/init.if refpolicy-git-18012011-new/policy/modules/system/init.if
policy/modules/system/init.if +10 -0
@@ -947,6 +947,24 @@ interface(`init_read_state',`
 
  ########################################
  ##<summary>
+##      Read init fifo file.
+##</summary>
+##<param name="domain">
+##<summary>
+##      Domain allowed access.
+##</summary>
+##</param>
+#
+interface(`init_read_fifo_file',`
+		gen_require(`
Quoted 8 lines
policy/modules/system/init.if interface(`init_read_state',` · line 964
Quoted 5 lines
policy/modules/system/init.if +5 -0
+		attribute init_t;
+	')
+
+	read_fifo_files_pattern($1, init_t, init_t)
+')
no need to for pattern here use: allow $1 init_t:fifo_file r_fifo_file_perms;
Quoted 2 lines
Why should we avoid the use of the pattern here ? It gives better readability and also it grants permission to search the parent dir.
I guess you may indeed be right here. I assume that this pipe is somewhere in /proc in an init_t directory? If that is so then the caller indeed needs to traverse an init_t directory to get to the pipe i guess, and in that case the pattern makes good sense.
looking at similar examples thought, like
Quoted 7 lines
interface(init_rw_script_pipes',
	gen_require(`
		type initrc_t;
	')

	allow $1 initrc_t:fifo_file { read write };
')
And
Quoted 5 lines
interface(init_write_script_pipes',
	gen_require(`
		type initrc_t;
	')
Quoted 7 lines
Quoted 2 lines
	allow $1 initrc_t:fifo_file write;
')
It appears that searching domain_type directories is not applicable here.
Can you reproduce this (and in particular the caller searching init_t directories?)
Yes, of course I am quite sure it can be reproduced by just starting up readahead. Here is the log:

Quoted 8 lines

type=AVC msg=audit(1294704869.317:19776): avc: denied { read } for pid=2661 comm="readahead" path="pipe:[8853]" dev=pipefs ino=8853 scontext=system_u:system_r:readahead_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=fifo_file type=1400 audit(1294704824.813:3): avc: denied { read } for pid=1398 comm="readahead-colle" path="pipe:[3384]" dev=pipefs ino=3384 scontext=system_u:system_r:readahead_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=fifo_file

The read_fifo_file_perms is appropriate instead of the pattern because this is an unnamed pipe (note the pipe=). There is no dir to search.

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

Guido Trentalancia

author

2011-01-31 23:00 UTC #13 lore raw

PATCH 3/19 : patch set to update the git reference policy

Hello Christopher !

Quoted 93 lines · Christopher J. PeBenito

Quoted 83 lines · Guido Trentalancia
Hello Dominick !
Quoted 69 lines · Dominick Grift
Quoted 43 lines · Guido Trentalancia
Hi Dominick,
just a quick question on one of your comments...
Quoted 29 lines · Dominick Grift
Quoted 28 lines · Guido Trentalancia
diff -pruN -x .git -x corenetwork.if -x corenetwork.te -x booleans.conf -x modules.conf refpolicy-git-18012011/policy/modules/admin/readahead.te refpolicy-git-18012011-update/policy/modules/admin/readahead.te
policy/modules/admin/readahead.te +1 -0
@@ -79,6 +79,7 @@ term_dontaudit_use_console(readahead_t)
 
  auth_dontaudit_read_shadow(readahead_t)
 
+init_read_fifo_file(readahead_t)
  init_use_fds(readahead_t)
  init_use_script_ptys(readahead_t)
  init_getattr_initctl(readahead_t)
diff -pruN -x .git -x booleans.conf -x corenetwork.if -x corenetwork.te -x modules.conf refpolicy-git-18012011/policy/modules/system/init.if refpolicy-git-18012011-new/policy/modules/system/init.if
policy/modules/system/init.if +10 -0
@@ -947,6 +947,24 @@ interface(`init_read_state',`
 
  ########################################
  ##<summary>
+##      Read init fifo file.
+##</summary>
+##<param name="domain">
+##<summary>
+##      Domain allowed access.
+##</summary>
+##</param>
+#
+interface(`init_read_fifo_file',`
+		gen_require(`
Quoted 8 lines
policy/modules/system/init.if interface(`init_read_state',` · line 964
Quoted 5 lines
policy/modules/system/init.if +5 -0
+		attribute init_t;
+	')
+
+	read_fifo_files_pattern($1, init_t, init_t)
+')
no need to for pattern here use: allow $1 init_t:fifo_file r_fifo_file_perms;
Quoted 2 lines
Why should we avoid the use of the pattern here ? It gives better readability and also it grants permission to search the parent dir.
I guess you may indeed be right here. I assume that this pipe is somewhere in /proc in an init_t directory? If that is so then the caller indeed needs to traverse an init_t directory to get to the pipe i guess, and in that case the pattern makes good sense.
looking at similar examples thought, like
Quoted 7 lines
interface(init_rw_script_pipes',
	gen_require(`
		type initrc_t;
	')

	allow $1 initrc_t:fifo_file { read write };
')
And
Quoted 5 lines
interface(init_write_script_pipes',
	gen_require(`
		type initrc_t;
	')
Quoted 7 lines
Quoted 2 lines
	allow $1 initrc_t:fifo_file write;
')
It appears that searching domain_type directories is not applicable here.
Can you reproduce this (and in particular the caller searching init_t directories?)
Yes, of course I am quite sure it can be reproduced by just starting up readahead. Here is the log:
Quoted 8 lines
type=AVC msg=audit(1294704869.317:19776): avc: denied { read } for pid=2661 comm="readahead" path="pipe:[8853]" dev=pipefs ino=8853 scontext=system_u:system_r:readahead_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=fifo_file type=1400 audit(1294704824.813:3): avc: denied { read } for pid=1398 comm="readahead-colle" path="pipe:[3384]" dev=pipefs ino=3384 scontext=system_u:system_r:readahead_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=fifo_file

Quoted 2 lines

The read_fifo_file_perms is appropriate instead of the pattern because this is an unnamed pipe (note the pipe=). There is no dir to search.

Thanks for confirming.

Do you also confirm the attribute versus type issue regarding init_t (at lines 940 and 961 of the existing policy/modules/system/init.if and in the new interface that I had created) ?

Dominick spotted that out and now I also believe that is a typo.

If the latter is confirmed, my worry is how comes nothing in the build process (or any subsequent step) failed ?

Regards,

Guido