Add kup server utils module.
PATCH 1/1 Add kup server utils module.
Reworking to match the style guide better.
I think I got the module order right this time.
Signed-off-by Konstantin Ryabitsev <[email protected]>
--- kup.fc | 8 ++++ kup.if | 128 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ kup.te | 84 ++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 220 insertions(+), 0 deletions(-) create mode 100644 kup.fc create mode 100644 kup.if create mode 100644 kup.te
kup.fc new file +8 -0
@@ -0,0 +1,8 @@ +/usr/bin/kup-server -- gen_context(system_u:object_r:kup_server_exec_t,s0) +/etc/kup(/.*)? gen_context(system_u:object_r:kup_server_etc_t,s0) +/var/lib/kup -d gen_context(system_u:object_r:kup_server_var_lib_t,s0) +/var/lib/kup/pgp(/.*)? gen_context(system_u:object_r:kup_server_var_lib_t,s0) +/var/lib/kup/pub(/.*)? gen_context(system_u:object_r:kup_server_content_rw_t,s0) +/var/lib/kup/tmp(/.*)? gen_context(system_u:object_r:kup_server_content_rw_t,s0) +/var/run/kup(/.*)? gen_context(system_u:object_r:kup_server_var_run_t,s0) +
kup.if new file +128 -0
128 lines not on this page · raw message
kup.te new file +84 -0
84 lines not on this page · raw message
Signature · 10 lines
1.7.7.6 -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 665 bytes Desc: This is a digitally signed message part Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20120214/6021b790/attachment.bin
PATCH 1/1 Add kup server utils module.
Quoted 2 lines · Konstantin Ryabitsev
Reworking to match the style guide better.
I think I got the module order right this time.
Overall it seems ok, but needs some style cleanup, as noted below.
Quoted 16 lines
Signed-off-by Konstantin Ryabitsev <[email protected]>--- kup.fc | 8 ++++ kup.if | 128 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ kup.te | 84 ++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 220 insertions(+), 0 deletions(-) create mode 100644 kup.fc create mode 100644 kup.if create mode 100644 kup.tekup.fc new file +0
-0
kup.fc line 2
Quoted 2 lines
kup.fc new file +2
-0@@ -0,0 +1,8 @@ +/usr/bin/kup-server -- gen_context(system_u:object_r:kup_server_exec_t,s0) +/etc/kup(/.*)? gen_context(system_u:object_r:kup_server_etc_t,s0)
/etc above /usr
Quoted 20 lines
kup.fc new file +6
-0+/var/lib/kup -d gen_context(system_u:object_r:kup_server_var_lib_t,s0) +/var/lib/kup/pgp(/.*)? gen_context(system_u:object_r:kup_server_var_lib_t,s0) +/var/lib/kup/pub(/.*)? gen_context(system_u:object_r:kup_server_content_rw_t,s0) +/var/lib/kup/tmp(/.*)? gen_context(system_u:object_r:kup_server_content_rw_t,s0) +/var/run/kup(/.*)? gen_context(system_u:object_r:kup_server_var_run_t,s0) +kup.if new file +8
-0@@ -0,0 +1,128 @@ +## <summary>Kernel.org Uploader server utilities</summary> + + +######################################## +## <summary> +## Execute a domain transition to run kup. +## </summary> +## <param name="domain">
kup.if line 18
Quoted 10 lines
kup.if new file +10
-0+## <summary> +## Domain allowed to transition. +## </summary> +## </param> +# +interface(`kup_server_domtrans',` + gen_require(` + type kup_server_t, kup_server_exec_t; + ') +
These look like spaces rather than tabs.
Quoted 119 lines
kup.if new file +110
-0+ domtrans_pattern($1, kup_server_exec_t, kup_server_t) +') + +######################################## +## <summary> +## Read content uploaded via kup. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed to transition. +## </summary> +## </param> +# +interface(`kup_server_read_content',` + gen_require(` + type kup_server_content_rw_t; + ') + + files_search_var_lib($1) + read_files_pattern($1, kup_server_content_rw_t, kup_server_content_rw_t) + list_dirs_pattern($1, kup_server_content_rw_t, kup_server_content_rw_t) +') + +######################################## +## <summary> +## Create, read, write, and delete +## content uploaded via kup. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed to transition. +## </summary> +## </param> +# +interface(`kup_server_manage_content',` + gen_require(` + type kup_server_content_rw_t; + ') + + files_search_var_lib($1) + manage_files_pattern($1, kup_server_content_rw_t, kup_server_content_rw_t) + manage_dirs_pattern($1, kup_server_content_rw_t, kup_server_content_rw_t) +') + + +######################################## +## <summary> +## Execute kup in the kup domain, and +## allow the specified role the kup domain. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed to transition. +## </summary> +## </param> +## <param name="role"> +## <summary> +## The role to be allowed to transition. +## </summary> +## </param> +# +interface(`kup_server_run',` + gen_require(` + type kup_server_t; + ') + + kup_server_domtrans($1) + role $2 types kup_server_t; +') + +######################################## +## <summary> +## All of the rules required to administrate +## an kup environment +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +## <param name="role"> +## <summary> +## Role allowed access. +## </summary> +## </param> +## <rolecap/> +# +interface(`kup_server_admin',` + gen_require(` + type kup_server_t; + type kup_server_etc_t; + type kup_server_var_lib_t; + type kup_server_content_rw_t; + type kup_server_var_run_t; + ') + + allow $1 kup_server_t:process { ptrace signal_perms }; + ps_process_pattern($1, kup_server_t) + + files_search_etc($1) + admin_pattern($1, kup_server_etc_t) + + files_search_var_lib($1) + admin_pattern($1, kup_server_var_lib_t) + admin_pattern($1, kup_server_content_rw_t) + + files_search_pids($1) + admin_pattern($1, kup_server_var_run_t) + +')kup.te new file +3
-0@@ -0,0 +1,84 @@ +policy_module(kup,1.0.0) + +########################################
kup.te line 13
Quoted 10 lines
kup.te new file +10
-0+# +# Declarations +# + +type kup_server_t; +type kup_server_exec_t; +application_domain(kup_server_t, kup_server_exec_t) + +type kup_server_content_rw_t; +files_type(kup_server_content_rw_t)
Unless theres the possibility of having read-only content, kup_server_content_t would be fine.
Quoted 12 lines
kup.te new file +12
-0+type kup_server_etc_t; +files_config_file(kup_server_etc_t); + +type kup_server_var_lib_t; +files_type(kup_server_var_lib_t) + +type kup_server_var_run_t; +# not really a pid file, but the policy suits what we want to do +files_pid_file(kup_server_var_run_t) + +######################################## +#
kup.te line 36
Quoted 10 lines
kup.te new file +10
-0+# kup_server local policy +# + +allow kup_server_t self:process { setrlimit signal }; +allow kup_server_t self:fifo_file manage_fifo_file_perms; + +manage_dirs_pattern(kup_server_t, kup_server_content_rw_t, kup_server_content_rw_t) +manage_dirs_pattern(kup_server_t, kup_server_var_run_t, kup_server_var_run_t) +manage_files_pattern(kup_server_t, kup_server_content_rw_t, kup_server_content_rw_t) +manage_files_pattern(kup_server_t, kup_server_var_run_t, kup_server_var_run_t)
These should be grouped by type, so e.g. the two content lines should be grouped together
Quoted 14 lines
kup.te new file +14
-0+read_files_pattern(kup_server_t, kup_server_etc_t, kup_server_etc_t) +read_files_pattern(kup_server_t, kup_server_var_lib_t, kup_server_var_lib_t) +read_lnk_files_pattern(kup_server_t, kup_server_content_rw_t, kup_server_content_rw_t) + +######################################## +# +# Kernel layer modules +# + +# xz wants to read /proc/meminfo +kernel_read_system_state(kup_server_t) + +# executing gzip, bzip2, xz +corecmd_exec_bin(kup_server_t)
kup.te line 61
Quoted 10 lines
kup.te new file +10
-0+ +# gathering entropy for uniqueness +dev_read_urand(kup_server_t) + +domain_use_interactive_fds(kup_server_t) + +files_read_usr_files(kup_server_t) + +files_pid_filetrans(kup_server_t, kup_server_var_run_t, { dir file }) +files_var_lib_filetrans(kup_server_t, kup_server_content_rw_t, { dir file })
These can go up, grouped with the appropriate manage_*_pattern for the target type.
kup.te line 68
Quoted 6 lines
kup.te new file +6
-0+miscfiles_read_localization(kup_server_t) + +######################################## +# +# System layer modules +#
Comment blocks like the above are unnecessary.
Quoted 15 lines
kup.te new file +15
-0+# looking up user info +auth_use_nsswitch(kup_server_t) + +logging_send_syslog_msg(kup_server_t) + +# Temp.pm wants to stat bits in the userdir +userdom_getattr_user_home_dirs(kup_server_t) + +######################################## +# +# Other modules +# + +# accessing git trees for kup put --tar and --diff +git_read_generic_system_content_files(kup_server_t)
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com