: patch for logging in the sysadm role

PATCH New Guido Trentalancia 3 participants 8 messages Feb 16, 2011 – Mar 4, 2011

Share & tools

Guido Trentalancia

author

2011-02-16 06:07 UTC #0 lore raw

PATCH 9/34 : patch for logging in the sysadm role

This patch adds some permissions (through interface calls) needed by the sysadm role (in particular logging permissions).

policy/modules/roles/sysadm.te +4 -0

diff -pruN refpolicy-git-15022011-new-before-modification/policy/modules/roles/sysadm.te refpolicy-git-15022011-new-modified/policy/modules/roles/sysadm.te
@@ -34,6 +34,10 @@ ubac_file_exempt(sysadm_t)
 ubac_fd_exempt(sysadm_t)
 
 init_exec(sysadm_t)
+init_stream_connect(sysadm_t)
+
+logging_send_audit_msgs(sysadm_t)
+logging_set_tty_audit(sysadm_t)
 
 # Add/remove user home directories
 userdom_manage_user_home_dirs(sysadm_t)

Christopher J. PeBenito

2011-02-23 14:19 UTC #1 lore raw

PATCH 9/34 : patch for logging in the sysadm role

policy/modules/roles/sysadm.te ubac_file_exempt(sysadm_t) · line 37

Quoted 11 lines · Guido Trentalancia

This patch adds some permissions (through interface calls) needed by the sysadm role (in particular logging permissions).
diff -pruN refpolicy-git-15022011-new-before-modification/policy/modules/roles/sysadm.te refpolicy-git-15022011-new-modified/policy/modules/roles/sysadm.te
policy/modules/roles/sysadm.te +1 -0
@@ -34,6 +34,10 @@ ubac_file_exempt(sysadm_t)
 ubac_fd_exempt(sysadm_t)
 
 init_exec(sysadm_t)
+init_stream_connect(sysadm_t)

Is this on an upstart system? If so these two rules should probably turn into init_telinit() and also that interface updated to handle stream sockets.

policy/modules/roles/sysadm.te ubac_file_exempt(sysadm_t) · line 39

Quoted 1 line

policy/modules/roles/sysadm.te +1 -0
+logging_send_audit_msgs(sysadm_t)

Why is this necessary?

Quoted 4 lines

policy/modules/roles/sysadm.te +1 -0

+logging_set_tty_audit(sysadm_t)
 
 # Add/remove user home directories
 userdom_manage_user_home_dirs(sysadm_t)

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

Guido Trentalancia

author

2011-02-23 19:28 UTC #2 lore raw

PATCH 9/34 : patch for logging in the sysadm role

Quoted 10 lines · Christopher J. PeBenito

Quoted 9 lines · Guido Trentalancia
This patch adds some permissions (through interface calls) needed by the sysadm role (in particular logging permissions).
diff -pruN refpolicy-git-15022011-new-before-modification/policy/modules/roles/sysadm.te refpolicy-git-15022011-new-modified/policy/modules/roles/sysadm.te
policy/modules/roles/sysadm.te +0 -0
@@ -34,6 +34,10 @@ ubac_file_exempt(sysadm_t)
 ubac_fd_exempt(sysadm_t)
 

Quoted 6 lines

policy/modules/roles/sysadm.te ubac_file_exempt(sysadm_t) · line 37
Quoted 2 lines
policy/modules/roles/sysadm.te +1 -0
 init_exec(sysadm_t)
+init_stream_connect(sysadm_t)
Is this on an upstart system? If so these two rules should probably turn into init_telinit() and also that interface updated to handle stream sockets.

I confirm it's an upstart system. At the moment I can't check about the interface that you suggest to use. If it is equivalent, then that's fine. Is it a way to compact things ?

Do you think we should use the upstart boolean here ?

Quoted 3 lines

policy/modules/roles/sysadm.te ubac_file_exempt(sysadm_t) · line 39
Quoted 1 line
policy/modules/roles/sysadm.te +1 -0
+logging_send_audit_msgs(sysadm_t)
Why is this necessary?

I am not sure. If I can get some more insight on this I will let you know later on or tomorrow.

Quoted 4 lines

policy/modules/roles/sysadm.te ubac_file_exempt(sysadm_t) · line 43
Quoted 4 lines
policy/modules/roles/sysadm.te +1 -0
+logging_set_tty_audit(sysadm_t)
 
 # Add/remove user home directories
 userdom_manage_user_home_dirs(sysadm_t)

Regards,

Guido

Christopher J. PeBenito

2011-03-01 19:16 UTC #3 lore raw

PATCH 9/34 : patch for logging in the sysadm role

Quoted 18 lines · Guido Trentalancia

Quoted 10 lines · Christopher J. PeBenito
Quoted 9 lines · Guido Trentalancia
This patch adds some permissions (through interface calls) needed by the sysadm role (in particular logging permissions).
diff -pruN refpolicy-git-15022011-new-before-modification/policy/modules/roles/sysadm.te refpolicy-git-15022011-new-modified/policy/modules/roles/sysadm.te
policy/modules/roles/sysadm.te +0 -0
@@ -34,6 +34,10 @@ ubac_file_exempt(sysadm_t)
 ubac_fd_exempt(sysadm_t)
 
Quoted 6 lines
policy/modules/roles/sysadm.te ubac_file_exempt(sysadm_t) · line 37
Quoted 2 lines
policy/modules/roles/sysadm.te +1 -0
 init_exec(sysadm_t)
+init_stream_connect(sysadm_t)
Is this on an upstart system? If so these two rules should probably turn into init_telinit() and also that interface updated to handle stream sockets.

Quoted 3 lines

I confirm it's an upstart system. At the moment I can't check about the interface that you suggest to use. If it is equivalent, then that's fine. Is it a way to compact things ?

Its not completely identical, as init_telinit() uses datagram sockets, and this has stream sockets. But init_telinit() may need to be updated if upstart changed its socket type.

Quoted 1 line

Do you think we should use the upstart boolean here ?

No, its in the init_telinit() interface.

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

Guido Trentalancia

author

2011-03-01 20:07 UTC #4 lore raw

PATCH 9/34 : patch for logging in the sysadm role

Quoted 23 lines · Christopher J. PeBenito

Quoted 18 lines · Guido Trentalancia
Quoted 10 lines · Christopher J. PeBenito
Quoted 9 lines · Guido Trentalancia
This patch adds some permissions (through interface calls) needed by the sysadm role (in particular logging permissions).
diff -pruN refpolicy-git-15022011-new-before-modification/policy/modules/roles/sysadm.te refpolicy-git-15022011-new-modified/policy/modules/roles/sysadm.te
policy/modules/roles/sysadm.te +0 -0
@@ -34,6 +34,10 @@ ubac_file_exempt(sysadm_t)
 ubac_fd_exempt(sysadm_t)
 
Quoted 6 lines
policy/modules/roles/sysadm.te ubac_file_exempt(sysadm_t) · line 37
Quoted 2 lines
policy/modules/roles/sysadm.te +1 -0
 init_exec(sysadm_t)
+init_stream_connect(sysadm_t)
Is this on an upstart system? If so these two rules should probably turn into init_telinit() and also that interface updated to handle stream sockets.
Quoted 3 lines
I confirm it's an upstart system. At the moment I can't check about the interface that you suggest to use. If it is equivalent, then that's fine. Is it a way to compact things ?

Quoted 7 lines

Its not completely identical, as init_telinit() uses datagram sockets, and this has stream sockets. But init_telinit() may need to be updated if upstart changed its socket type.
Quoted 1 line
Do you think we should use the upstart boolean here ?
No, its in the init_telinit() interface.

That's fine to me, good idea ! As soon as you commit, I will test.

Regards,

Guido

Christopher J. PeBenito

2011-03-04 13:15 UTC #5 lore raw

PATCH 9/34 : patch for logging in the sysadm role

Quoted 28 lines · Guido Trentalancia

Quoted 27 lines · Christopher J. PeBenito
Quoted 18 lines · Guido Trentalancia
Quoted 10 lines · Christopher J. PeBenito
Quoted 9 lines · Guido Trentalancia
This patch adds some permissions (through interface calls) needed by the sysadm role (in particular logging permissions).
diff -pruN refpolicy-git-15022011-new-before-modification/policy/modules/roles/sysadm.te refpolicy-git-15022011-new-modified/policy/modules/roles/sysadm.te
policy/modules/roles/sysadm.te +0 -0
@@ -34,6 +34,10 @@ ubac_file_exempt(sysadm_t)
 ubac_fd_exempt(sysadm_t)
 
Quoted 6 lines
policy/modules/roles/sysadm.te ubac_file_exempt(sysadm_t) · line 37
Quoted 2 lines
policy/modules/roles/sysadm.te +1 -0
 init_exec(sysadm_t)
+init_stream_connect(sysadm_t)
Is this on an upstart system? If so these two rules should probably turn into init_telinit() and also that interface updated to handle stream sockets.
Quoted 3 lines
I confirm it's an upstart system. At the moment I can't check about the interface that you suggest to use. If it is equivalent, then that's fine. Is it a way to compact things ?
Its not completely identical, as init_telinit() uses datagram sockets, and this has stream sockets. But init_telinit() may need to be updated if upstart changed its socket type.

Quoted 5 lines

Quoted 3 lines
Quoted 1 line
Do you think we should use the upstart boolean here ?
No, its in the init_telinit() interface.
That's fine to me, good idea ! As soon as you commit, I will test.

I think you misunderstand. I'm not going to commit it until you can confirm this is telinit (which also happens when you run shutdown).

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

Guido Trentalancia

author

2011-03-01 20:02 UTC #6 lore raw

PATCH 9/34 : patch for logging in the sysadm role

In reply to Guido Trentalancia

Hello Christopher !

Finally I am getting back on this...

Quoted 22 lines · Guido Trentalancia

Quoted 10 lines · Christopher J. PeBenito
Quoted 9 lines · Guido Trentalancia
This patch adds some permissions (through interface calls) needed by the sysadm role (in particular logging permissions).
diff -pruN refpolicy-git-15022011-new-before-modification/policy/modules/roles/sysadm.te refpolicy-git-15022011-new-modified/policy/modules/roles/sysadm.te
policy/modules/roles/sysadm.te +0 -0
@@ -34,6 +34,10 @@ ubac_file_exempt(sysadm_t)
 ubac_fd_exempt(sysadm_t)
 
Quoted 6 lines
policy/modules/roles/sysadm.te ubac_file_exempt(sysadm_t) · line 37
Quoted 2 lines
policy/modules/roles/sysadm.te +1 -0
 init_exec(sysadm_t)
+init_stream_connect(sysadm_t)
Is this on an upstart system? If so these two rules should probably turn into init_telinit() and also that interface updated to handle stream sockets.
I confirm it's an upstart system. At the moment I can't check about the interface that you suggest to use. If it is equivalent, then that's fine. Is it a way to compact things ?

Quoted 13 lines

Do you think we should use the upstart boolean here ?
Quoted 3 lines
policy/modules/roles/sysadm.te ubac_file_exempt(sysadm_t) · line 39
Quoted 1 line
policy/modules/roles/sysadm.te +1 -0
+logging_send_audit_msgs(sysadm_t)
Why is this necessary?
I am not sure. If I can get some more insight on this I will let you know later on or tomorrow.
Quoted 4 lines
Quoted 4 lines
policy/modules/roles/sysadm.te +1 -0
+logging_set_tty_audit(sysadm_t)
 
 # Add/remove user home directories
 userdom_manage_user_home_dirs(sysadm_t)

I found the following logs about the logging calls:

type=AVC msg=audit(1295734084.283:24): avc:  denied  { create } for  pid=2677 comm="bash" scontext=root:sysadm_r:sysadm_t:s0-s0:c0.c1023 tcontext=root:sysadm_r:sysadm_t:s0-s0:c0.c1023 tclass=netlink_audit_socket
type=AVC msg=audit(1295734079.261:20): avc:  denied  { create } for  pid=2765 comm="bash" scontext=root:sysadm_r:sysadm_t:s0-s0:c0.c1023 tcontext=root:sysadm_r:sysadm_t:s0-s0:c0.c1023 tclass=netlink_audit_socket
type=AVC msg=audit(1295734079.536:21): avc:  denied  { create } for  pid=2765 comm="bash" scontext=root:sysadm_r:sysadm_t:s0-s0:c0.c1023 tcontext=root:sysadm_r:sysadm_t:s0-s0:c0.c1023 tclass=netlink_audit_socket
type=AVC msg=audit(1295736796.387:81): avc:  denied  { nlmsg_relay } for  pid=2821 comm="bash" scontext=root:sysadm_r:sysadm_t:s0-s0:c0.c1023 tcontext=root:sysadm_r:sysadm_t:s0-s0:c0.c1023 tclass=netlink_audit_socket

type=AVC msg=audit(1294619138.946:19637): avc: denied { create } for pid=5744 comm="bash" scontext=root:sysadm_r:sysadm_t:s0-s0:c0.c1023 tcontext=root:sysadm_r:sysadm_t:s0-s0:c0.c1023 tclass=netlink_audit_socket type=AVC msg=audit(1294683721.351:42): avc: denied { write } for pid=2670 comm="bash" scontext=root:sysadm_r:sysadm_t:s0-s0:c0.c1023 tcontext=root:sysadm_r:sysadm_t:s0-s0:c0.c1023 tclass=netlink_audit_socket

Quoted 1 line

From the sysadm_t context, I bet this is something interactive from the

console. And I told you already that there are a few problems from the console. It needs to be checked carefully as soon as you have finished to evaluate and commit the patches that I have already submitted.

Regards,

Guido

Daniel J Walsh

2011-03-01 20:13 UTC #7 lore raw

PATCH 9/34 : patch for logging in the sysadm role

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Quoted 55 lines · Guido Trentalancia

Hello Christopher !
Finally I am getting back on this...
Quoted 22 lines · Guido Trentalancia
Quoted 10 lines · Christopher J. PeBenito
Quoted 9 lines · Guido Trentalancia
This patch adds some permissions (through interface calls) needed by the sysadm role (in particular logging permissions).
diff -pruN refpolicy-git-15022011-new-before-modification/policy/modules/roles/sysadm.te refpolicy-git-15022011-new-modified/policy/modules/roles/sysadm.te
policy/modules/roles/sysadm.te +0 -0
@@ -34,6 +34,10 @@ ubac_file_exempt(sysadm_t)
 ubac_fd_exempt(sysadm_t)
 
Quoted 6 lines
policy/modules/roles/sysadm.te ubac_file_exempt(sysadm_t) · line 37
Quoted 2 lines
policy/modules/roles/sysadm.te +1 -0
 init_exec(sysadm_t)
+init_stream_connect(sysadm_t)
Is this on an upstart system? If so these two rules should probably turn into init_telinit() and also that interface updated to handle stream sockets.
I confirm it's an upstart system. At the moment I can't check about the interface that you suggest to use. If it is equivalent, then that's fine. Is it a way to compact things ?
Quoted 13 lines
Do you think we should use the upstart boolean here ?
Quoted 3 lines
policy/modules/roles/sysadm.te ubac_file_exempt(sysadm_t) · line 39
Quoted 1 line
policy/modules/roles/sysadm.te +1 -0
+logging_send_audit_msgs(sysadm_t)
Why is this necessary?
I am not sure. If I can get some more insight on this I will let you know later on or tomorrow.
Quoted 4 lines
Quoted 4 lines
policy/modules/roles/sysadm.te +1 -0
+logging_set_tty_audit(sysadm_t)
 
 # Add/remove user home directories
 userdom_manage_user_home_dirs(sysadm_t)
I found the following logs about the logging calls:
type=AVC msg=audit(1295734084.283:24): avc:  denied  { create } for  pid=2677 comm="bash" scontext=root:sysadm_r:sysadm_t:s0-s0:c0.c1023 tcontext=root:sysadm_r:sysadm_t:s0-s0:c0.c1023 tclass=netlink_audit_socket
type=AVC msg=audit(1295734079.261:20): avc:  denied  { create } for  pid=2765 comm="bash" scontext=root:sysadm_r:sysadm_t:s0-s0:c0.c1023 tcontext=root:sysadm_r:sysadm_t:s0-s0:c0.c1023 tclass=netlink_audit_socket
type=AVC msg=audit(1295734079.536:21): avc:  denied  { create } for  pid=2765 comm="bash" scontext=root:sysadm_r:sysadm_t:s0-s0:c0.c1023 tcontext=root:sysadm_r:sysadm_t:s0-s0:c0.c1023 tclass=netlink_audit_socket
type=AVC msg=audit(1295736796.387:81): avc:  denied  { nlmsg_relay } for  pid=2821 comm="bash" scontext=root:sysadm_r:sysadm_t:s0-s0:c0.c1023 tcontext=root:sysadm_r:sysadm_t:s0-s0:c0.c1023 tclass=netlink_audit_socket
type=AVC msg=audit(1294619138.946:19637): avc: denied { create } for pid=5744 comm="bash" scontext=root:sysadm_r:sysadm_t:s0-s0:c0.c1023 tcontext=root:sysadm_r:sysadm_t:s0-s0:c0.c1023 tclass=netlink_audit_socket type=AVC msg=audit(1294683721.351:42): avc: denied { write } for pid=2670 comm="bash" scontext=root:sysadm_r:sysadm_t:s0-s0:c0.c1023 tcontext=root:sysadm_r:sysadm_t:s0-s0:c0.c1023 tclass=netlink_audit_socket
Quoted 1 line
From the sysadm_t context, I bet this is something interactive from the
console. And I told you already that there are a few problems from the console. It needs to be checked carefully as soon as you have finished to evaluate and commit the patches that I have already submitted.

Quoted 8 lines

Regards,
Guido
_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

bash has builtin audit logging.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk1tU10ACgkQrlYvE4MpobMVzQCdGJSFxMEHq9vHvROwxS1JBSwP isMAn24kv49S3agafRGkJCP09Jn4cPi0
=hWTl
-----END PGP SIGNATURE-----