Allow mozilla/firefox to manage tempfiles
PATCH 5/15 Allow mozilla/firefox to manage tempfiles
To be able to launch firefox, firefox needs to use tmp files and sockets. Create a domain for firefox to work in. Use ubac_constrained as not to potentially leak info
--- policy/modules/apps/mozilla.te | 10 ++++++++++ 1 files changed, 10 insertions(+), 0 deletions(-)
policy/modules/apps/mozilla.te +10 -0
@@ -33,6 +33,10 @@ typealias mozilla_tmpfs_t alias { auditadm_mozilla_tmpfs_t secadm_mozilla_tmpfs_ files_tmpfs_file(mozilla_tmpfs_t) ubac_constrained(mozilla_tmpfs_t) +type mozilla_tmp_t; +files_tmp_file(mozilla_tmp_t) +ubac_contrained(mozilla_tmp_t) + ######################################## # # Local policy
@@ -68,6 +72,10 @@ manage_fifo_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t) manage_sock_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t) fs_tmpfs_filetrans(mozilla_t, mozilla_tmpfs_t, { file lnk_file sock_file fifo_file }) +manage_files_pattern(mozilla_t, mozilla_tmp_t, mozilla_tmp_t) +manage_dirs_pattern(mozilla_t, mozilla_tmp_t, mozilla_tmp_t) +files_tmp_filetrans(mozilla_t, mozilla_tmp_t, { file dir } ) + kernel_read_kernel_sysctls(mozilla_t) kernel_read_network_state(mozilla_t) # Access /proc, sysctl
@@ -142,6 +150,8 @@ miscfiles_dontaudit_setattr_fonts_dirs(mozilla_t) sysnet_dns_name_resolve(mozilla_t) userdom_use_user_ptys(mozilla_t) +userdom_manage_user_tmp_files(mozilla_t) +userdom_manage_user_tmp_sockets(mozilla_t) xserver_user_x_domain_template(mozilla, mozilla_t, mozilla_tmpfs_t) xserver_dontaudit_read_xdm_tmp_files(mozilla_t)
Signature · 1 line
1.7.3.4
PATCH 5/15 Allow mozilla/firefox to manage tempfiles
I did build firefox from sources (several times since 3.6.10) and it was not requiring these...
Is it the new 4.0 version ?
Regards,
Guido
Quoted 44 lines · Sven Vermeulen
To be able to launch firefox, firefox needs to use tmp files and sockets. Create a domain for firefox to work in. Use
ubac_constrainedas not to potentially leak infoSigned-off-by Sven Vermeulen <[email protected]>--- policy/modules/apps/mozilla.te | 10 ++++++++++ 1 files changed, 10 insertions(+), 0 deletions(-)policy/modules/apps/mozilla.te +10
-0@@ -33,6 +33,10 @@ typealias mozilla_tmpfs_t alias { auditadm_mozilla_tmpfs_t secadm_mozilla_tmpfs_ files_tmpfs_file(mozilla_tmpfs_t) ubac_constrained(mozilla_tmpfs_t) +type mozilla_tmp_t; +files_tmp_file(mozilla_tmp_t) +ubac_contrained(mozilla_tmp_t) + ######################################## # # Local policy@@ -68,6 +72,10 @@ manage_fifo_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t) manage_sock_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t) fs_tmpfs_filetrans(mozilla_t, mozilla_tmpfs_t, { file lnk_file sock_file fifo_file }) +manage_files_pattern(mozilla_t, mozilla_tmp_t, mozilla_tmp_t) +manage_dirs_pattern(mozilla_t, mozilla_tmp_t, mozilla_tmp_t) +files_tmp_filetrans(mozilla_t, mozilla_tmp_t, { file dir } ) + kernel_read_kernel_sysctls(mozilla_t) kernel_read_network_state(mozilla_t) # Access /proc, sysctl@@ -142,6 +150,8 @@ miscfiles_dontaudit_setattr_fonts_dirs(mozilla_t) sysnet_dns_name_resolve(mozilla_t) userdom_use_user_ptys(mozilla_t) +userdom_manage_user_tmp_files(mozilla_t) +userdom_manage_user_tmp_sockets(mozilla_t) xserver_user_x_domain_template(mozilla, mozilla_t, mozilla_tmpfs_t) xserver_dontaudit_read_xdm_tmp_files(mozilla_t)
PATCH 5/15 Allow mozilla/firefox to manage tempfiles
In reply to Sven Vermeulen-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Quoted 3 lines · Sven Vermeulen
To be able to launch firefox, firefox needs to use tmp files and sockets. Create a domain for firefox to work in. Use
ubac_constrainedas not to potentially leak info
sockets are for pulseaudio and gconfd ( both of which i rather would confine )
in my policy firefox is allowed to manage mozilla_tmp_t dirs files and fifo files.
in my policy firefox does not need access to user_tmp_t content but that is because i have almost everything confined here in f14. I am just saying that its possible.
I have been using this policy for months now.
Quoted 30 lines
policy/modules/apps/mozilla.te | 10 ++++++++++ 1 files changed, 10 insertions(+), 0 deletions(-)policy/modules/apps/mozilla.te +8
-0@@ -33,6 +33,10 @@ typealias mozilla_tmpfs_t alias { auditadm_mozilla_tmpfs_t secadm_mozilla_tmpfs_ files_tmpfs_file(mozilla_tmpfs_t) ubac_constrained(mozilla_tmpfs_t) +type mozilla_tmp_t; +files_tmp_file(mozilla_tmp_t) +ubac_contrained(mozilla_tmp_t) + ######################################## # # Local policy@@ -68,6 +72,10 @@ manage_fifo_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t) manage_sock_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t) fs_tmpfs_filetrans(mozilla_t, mozilla_tmpfs_t, { file lnk_file sock_file fifo_file }) +manage_files_pattern(mozilla_t, mozilla_tmp_t, mozilla_tmp_t) +manage_dirs_pattern(mozilla_t, mozilla_tmp_t, mozilla_tmp_t) +files_tmp_filetrans(mozilla_t, mozilla_tmp_t, { file dir } ) + kernel_read_kernel_sysctls(mozilla_t) kernel_read_network_state(mozilla_t) # Access /proc, sysctl
policy/modules/apps/mozilla.te miscfiles_dontaudit_setattr_fonts_dirs(mozilla_t) · line 157
Quoted 8 lines
policy/modules/apps/mozilla.te +2
-0@@ -142,6 +150,8 @@ miscfiles_dontaudit_setattr_fonts_dirs(mozilla_t) sysnet_dns_name_resolve(mozilla_t) userdom_use_user_ptys(mozilla_t) +userdom_manage_user_tmp_files(mozilla_t) +userdom_manage_user_tmp_sockets(mozilla_t) xserver_user_x_domain_template(mozilla, mozilla_t, mozilla_tmpfs_t) xserver_dontaudit_read_xdm_tmp_files(mozilla_t)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.16 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAk14jl4ACgkQMlxVo39jgT9V3gCeIx+vLWn4IW4evyVNOVheIqpw 1XQAn3KGZgV9aHlnS/51e1S+tDQX7o4h
=gVdY
-----END PGP SIGNATURE-----
PATCH 5/15 Allow mozilla/firefox to manage tempfiles
In reply to Sven VermeulenQuoted 36 lines · Sven Vermeulen
To be able to launch firefox, firefox needs to use tmp files and sockets. Create a domain for firefox to work in. Use
ubac_constrainedas not to potentially leak infoSigned-off-by Sven Vermeulen <[email protected]>--- policy/modules/apps/mozilla.te | 10 ++++++++++ 1 files changed, 10 insertions(+), 0 deletions(-)policy/modules/apps/mozilla.te +8
-0@@ -33,6 +33,10 @@ typealias mozilla_tmpfs_t alias { auditadm_mozilla_tmpfs_t secadm_mozilla_tmpfs_ files_tmpfs_file(mozilla_tmpfs_t) ubac_constrained(mozilla_tmpfs_t) +type mozilla_tmp_t; +files_tmp_file(mozilla_tmp_t) +ubac_contrained(mozilla_tmp_t) + ######################################## # # Local policy@@ -68,6 +72,10 @@ manage_fifo_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t) manage_sock_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t) fs_tmpfs_filetrans(mozilla_t, mozilla_tmpfs_t, { file lnk_file sock_file fifo_file }) +manage_files_pattern(mozilla_t, mozilla_tmp_t, mozilla_tmp_t) +manage_dirs_pattern(mozilla_t, mozilla_tmp_t, mozilla_tmp_t) +files_tmp_filetrans(mozilla_t, mozilla_tmp_t, { file dir } ) + kernel_read_kernel_sysctls(mozilla_t) kernel_read_network_state(mozilla_t) # Access /proc, sysctl
policy/modules/apps/mozilla.te miscfiles_dontaudit_setattr_fonts_dirs(mozilla_t) · line 154
Quoted 5 lines
policy/modules/apps/mozilla.te +2
-0@@ -142,6 +150,8 @@ miscfiles_dontaudit_setattr_fonts_dirs(mozilla_t) sysnet_dns_name_resolve(mozilla_t) userdom_use_user_ptys(mozilla_t) +userdom_manage_user_tmp_files(mozilla_t) +userdom_manage_user_tmp_sockets(mozilla_t)
Do you have more info on these? Such as what files and sockets are being managed?
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 5/15 Allow mozilla/firefox to manage tempfiles
Quoted 12 lines · Christopher J. PeBenito
Quoted 11 lines · Sven Vermeulen
policy/modules/apps/mozilla.te +4
-0+type mozilla_tmp_t; +files_tmp_file(mozilla_tmp_t) +ubac_contrained(mozilla_tmp_t) + ######################################## # # Local policy@@ -68,6 +72,10 @@ manage_fifo_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t) manage_sock_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t) fs_tmpfs_filetrans(mozilla_t, mozilla_tmpfs_t, { file lnk_file sock_file fifo_file })
Quoted 7 lines
policy/modules/apps/mozilla.te manage_fifo_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t) · line 81
Quoted 7 lines
policy/modules/apps/mozilla.te +4
-0+manage_files_pattern(mozilla_t, mozilla_tmp_t, mozilla_tmp_t) +manage_dirs_pattern(mozilla_t, mozilla_tmp_t, mozilla_tmp_t) +files_tmp_filetrans(mozilla_t, mozilla_tmp_t, { file dir } ) + kernel_read_kernel_sysctls(mozilla_t) kernel_read_network_state(mozilla_t) # Access /proc, sysctl
The mozilla_tmp_t is used by firefox to create /tmp/plugtmp/plugin-crossdomain.xml (for instance while viewing Youtube streams).
Quoted 9 lines
policy/modules/apps/mozilla.te miscfiles_dontaudit_setattr_fonts_dirs(mozilla_t) · line 154
Quoted 6 lines
policy/modules/apps/mozilla.te +2
-0@@ -142,6 +150,8 @@ miscfiles_dontaudit_setattr_fonts_dirs(mozilla_t) sysnet_dns_name_resolve(mozilla_t) userdom_use_user_ptys(mozilla_t) +userdom_manage_user_tmp_files(mozilla_t) +userdom_manage_user_tmp_sockets(mozilla_t)Do you have more info on these? Such as what files and sockets are being managed?
These ones I have not been able to hit immediately, but I'll run a while without to see if I can get the information back.
Wkr,
Sven Vermeulen
PATCH 5/15 Allow mozilla/firefox to manage tempfiles
In reply to Christopher J. PeBenitoQuoted 6 lines · Christopher J. PeBenito
Review
Quoted 3 lines
userdom_use_user_ptys(mozilla_t)(quoted diff) +2
-0+userdom_manage_user_tmp_files(mozilla_t) +userdom_manage_user_tmp_sockets(mozilla_t)Do you have more info on these? Such as what files and sockets are being managed?
Not anymore apparently. Been running now for quite some time without these privileges and I get no problems with it. Retry:
Mozilla/Firefox creates temporary files for its plugin support (for instance while viewing flc streams), like /tmp/plugtmp/plugin-crossdomain.xml.
Update policy to allow it to create its own tmp type and perform a file transition when creating a file or directory in a tmp_t location (like /tmp).
--- policy/modules/apps/mozilla.te | 10 ++++++++++ 1 files changed, 10 insertions(+), 0 deletions(-)
policy/modules/apps/mozilla.te +10 -0
@@ -33,6 +33,12 @@ typealias mozilla_tmpfs_t alias { auditadm_mozilla_tmpfs_t secadm_mozilla_tmpfs_ files_tmpfs_file(mozilla_tmpfs_t) ubac_constrained(mozilla_tmpfs_t) +type mozilla_tmp_t; +typealias mozilla_tmp_t alias { user_mozilla_tmp_t staff_mozilla_tmp_t sysadm_mozilla_tmp_t }; +typealias mozilla_tmp_t alias { auditadm_mozilla_t secadm_mozilla_t }; +files_tmp_file(mozilla_tmp_t) +ubac_constrained(mozilla_tmp_t) + ######################################## # # Local policy
@@ -68,6 +74,10 @@ manage_fifo_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t) manage_sock_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t) fs_tmpfs_filetrans(mozilla_t, mozilla_tmpfs_t, { file lnk_file sock_file fifo_file }) +manage_files_pattern(mozilla_t, mozilla_tmp_t, mozilla_tmp_t) +manage_dirs_pattern(mozilla_t, mozilla_tmp_t, mozilla_tmp_t) +files_tmp_filetrans(mozilla_t, mozilla_tmp_t, { file dir }) + kernel_read_kernel_sysctls(mozilla_t) kernel_read_network_state(mozilla_t) # Access /proc, sysctl
Signature · 1 line
1.7.3.4
PATCH 5/15 Allow mozilla/firefox to manage tempfiles
Quoted 11 lines · Sven Vermeulen
Quoted 6 lines · Christopher J. PeBenito
Review
Quoted 3 lines
userdom_use_user_ptys(mozilla_t)(quoted diff) +2
-0+userdom_manage_user_tmp_files(mozilla_t) +userdom_manage_user_tmp_sockets(mozilla_t)Do you have more info on these? Such as what files and sockets are being managed?
Not anymore apparently. Been running now for quite some time without these privileges and I get no problems with it. Retry:
Quoted 6 lines
Mozilla/Firefox creates temporary files for its plugin support (for instance while viewing flc streams), like
/tmp/plugtmp/plugin-crossdomain.xml.Update policy to allow it to create its own tmp type and perform a file transition when creating a file or directory in a
tmp_tlocation (like /tmp).
Merged.
Quoted 33 lines
Signed-off-by Sven Vermeulen <[email protected]>--- policy/modules/apps/mozilla.te | 10 ++++++++++ 1 files changed, 10 insertions(+), 0 deletions(-)policy/modules/apps/mozilla.te +10
-0@@ -33,6 +33,12 @@ typealias mozilla_tmpfs_t alias { auditadm_mozilla_tmpfs_t secadm_mozilla_tmpfs_ files_tmpfs_file(mozilla_tmpfs_t) ubac_constrained(mozilla_tmpfs_t) +type mozilla_tmp_t; +typealias mozilla_tmp_t alias { user_mozilla_tmp_t staff_mozilla_tmp_t sysadm_mozilla_tmp_t }; +typealias mozilla_tmp_t alias { auditadm_mozilla_t secadm_mozilla_t }; +files_tmp_file(mozilla_tmp_t) +ubac_constrained(mozilla_tmp_t) + ######################################## # # Local policy@@ -68,6 +74,10 @@ manage_fifo_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t) manage_sock_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t) fs_tmpfs_filetrans(mozilla_t, mozilla_tmpfs_t, { file lnk_file sock_file fifo_file }) +manage_files_pattern(mozilla_t, mozilla_tmp_t, mozilla_tmp_t) +manage_dirs_pattern(mozilla_t, mozilla_tmp_t, mozilla_tmp_t) +files_tmp_filetrans(mozilla_t, mozilla_tmp_t, { file dir }) + kernel_read_kernel_sysctls(mozilla_t) kernel_read_network_state(mozilla_t) # Access /proc, sysctl
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com