Skip to contentSkip to conversation

Make role attributes able to type their "own" types.

PATCH New Harry Ciao 2 participants 3 messages Dec 15, 2011 – Feb 27, 2012

lore
Share & tools
lore

Harry Ciao

author
#0 lore raw

PATCH 1/1 Make role attributes able to type their "own" types.

By default, any role attribute should be able to type their "own" types that share the same prefix and used in the run interface. For example,

role newrole_roles types newrole_t;

so that the calling domain of the seutil_run_newrole() interface could properly tansition into newrole_t. Without above role rule, the caller's role won't be associated with newrole_t.

Other role attributes such as useradd_roles, groupadd_roles, chfn_roles and run_init_roles should be fixed in the same way.

---
 policy/modules/admin/usermanage.te   |    3 +++
 policy/modules/system/selinuxutil.te |    2 ++
 2 files changed, 5 insertions(+), 0 deletions(-)
policy/modules/admin/usermanage.te +3 -0
index 530c988..8fc8052 100644
@@ -6,9 +6,11 @@ policy_module(usermanage, 1.16.1)
 #
 
 attribute_role chfn_roles;
+role chfn_roles types chfn_t;
 role system_r types chfn_t;
 
 attribute_role groupadd_roles;
+role groupadd_roles types groupadd_t;
 
 attribute_role passwd_roles;
 roleattribute system_r passwd_roles;

@@ -17,6 +19,7 @@ attribute_role sysadm_passwd_roles;
 roleattribute system_r sysadm_passwd_roles;
 
 attribute_role useradd_roles;
+role useradd_roles types useradd_t;
 
 type admin_passwd_exec_t;
 files_type(admin_passwd_exec_t)
policy/modules/system/selinuxutil.te +2 -0
index b3286c5..82268df 100644
@@ -13,8 +13,10 @@ attribute can_write_binary_policy;
 attribute can_relabelto_binary_policy;
 
 attribute_role newrole_roles;
+role newrole_roles types newrole_t;
 
 attribute_role run_init_roles;
+role run_init_roles types run_init_t;
 role system_r types run_init_t;
 
 attribute_role semanage_roles;
Signature · 1 line
1.7.0.4
author
#1 lore raw

PATCH 1/1 Make role attributes able to type their "own" types.

BTW, by using "seinfo --role=sysadm_r -x" command, we could get a full manifest of types that sysadm_r is able to type with. Below is the difference between without and with this fix. We sure want the sysadm_r able to type with newrole_t, useradd_t etc, don't we :-P

Thanks,
Harry

cao at cao-laptop:~/tmp/setools-3.3.7$ diff -up /home/cao/tmp/sysadm_r_types.wrong /home/cao/tmp/sysadm_r_types.correct
--- /home/cao/tmp/sysadm_r_types.wrong 2011-12-16 14:24:21.000000000
+0800
+++ /home/cao/tmp/sysadm_r_types.correct 2011-12-16
14:23:32.000000000 +0800
@@ -56,12 +56,14 @@
webalizer_t
oav_update_t
httpd_user_script_t
+ run_init_t
smbmount_t
spamassassin_t
checkpc_t
clockspeed_cli_t
gpg_pinentry_t
hwclock_t
+ newrole_t
dcc_client_t
mozilla_t
traceroute_t
@@ -83,6 +85,7 @@
portage_sandbox_t
evolution_alarm_t
qmail_queue_t
+ groupadd_t
backup_t
chkpwd_t
depmod_t
@@ -93,6 +96,7 @@
siggen_t
updpwd_t
apt_t
+ chfn_t
gift_t
giftd_t
lpr_t
@@ -128,6 +132,7 @@
lockdev_t
mplayer_t
sysadm_sudo_t
+ useradd_t
twadmin_t
twprint_t
xserver_t
cao at cao-laptop:~/tmp/setools-3.3.7$

Quoted 55 lines · Harry Ciao

By default, any role attribute should be able to type their "own" types that share the same prefix and used in the run interface. For example,

role newrole_roles types newrole_t;

so that the calling domain of the seutil_run_newrole() interface could properly tansition into newrole_t. Without above role rule, the caller's role won't be associated with newrole_t.

Other role attributes such as useradd_roles, groupadd_roles, chfn_roles and run_init_roles should be fixed in the same way.

---
  policy/modules/admin/usermanage.te   |    3 +++
  policy/modules/system/selinuxutil.te |    2 ++
  2 files changed, 5 insertions(+), 0 deletions(-)
policy/modules/admin/usermanage.te +3 -0
index 530c988..8fc8052 100644
@@ -6,9 +6,11 @@ policy_module(usermanage, 1.16.1)
  #
 
  attribute_role chfn_roles;
+role chfn_roles types chfn_t;
  role system_r types chfn_t;
 
  attribute_role groupadd_roles;
+role groupadd_roles types groupadd_t;
 
  attribute_role passwd_roles;
  roleattribute system_r passwd_roles;

@@ -17,6 +19,7 @@ attribute_role sysadm_passwd_roles;
  roleattribute system_r sysadm_passwd_roles;
 
  attribute_role useradd_roles;
+role useradd_roles types useradd_t;
 
  type admin_passwd_exec_t;
  files_type(admin_passwd_exec_t)
policy/modules/system/selinuxutil.te +2 -0
index b3286c5..82268df 100644
@@ -13,8 +13,10 @@ attribute can_write_binary_policy;
  attribute can_relabelto_binary_policy;
 
  attribute_role newrole_roles;
+role newrole_roles types newrole_t;
 
  attribute_role run_init_roles;
+role run_init_roles types run_init_t;
  role system_r types run_init_t;
 
  attribute_role semanage_roles;
#2 lore raw

PATCH 1/1 Make role attributes able to type their "own" types.

In reply to Harry Ciao
Quoted 11 lines · Harry Ciao

By default, any role attribute should be able to type their "own" types that share the same prefix and used in the run interface. For example,

role newrole_roles types newrole_t;

so that the calling domain of the seutil_run_newrole() interface could properly tansition into newrole_t. Without above role rule, the caller's role won't be associated with newrole_t.

Other role attributes such as useradd_roles, groupadd_roles, chfn_roles and run_init_roles should be fixed in the same way.

Merged.

Quoted 44 lines
---
 policy/modules/admin/usermanage.te   |    3 +++
 policy/modules/system/selinuxutil.te |    2 ++
 2 files changed, 5 insertions(+), 0 deletions(-)
policy/modules/admin/usermanage.te +3 -0
index 530c988..8fc8052 100644
@@ -6,9 +6,11 @@ policy_module(usermanage, 1.16.1)
 #
 
 attribute_role chfn_roles;
+role chfn_roles types chfn_t;
 role system_r types chfn_t;
 
 attribute_role groupadd_roles;
+role groupadd_roles types groupadd_t;
 
 attribute_role passwd_roles;
 roleattribute system_r passwd_roles;

@@ -17,6 +19,7 @@ attribute_role sysadm_passwd_roles;
 roleattribute system_r sysadm_passwd_roles;
 
 attribute_role useradd_roles;
+role useradd_roles types useradd_t;
 
 type admin_passwd_exec_t;
 files_type(admin_passwd_exec_t)
policy/modules/system/selinuxutil.te +2 -0
index b3286c5..82268df 100644
@@ -13,8 +13,10 @@ attribute can_write_binary_policy;
 attribute can_relabelto_binary_policy;
 
 attribute_role newrole_roles;
+role newrole_roles types newrole_t;
 
 attribute_role run_init_roles;
+role run_init_roles types run_init_t;
 role system_r types run_init_t;
 
 attribute_role semanage_roles;
Signature · 3 lines
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com