: mcelog module initial rewrite

Quoted 4 lines

diff -pruN refpolicy-04062012/policy/modules/contrib/mcelog.fc refpolicy-04062012-mcelog-support/policy/modules/contrib/mcelog.fc

policy/modules/contrib/mcelog.fc +0 -0

@@ -1 +1,16 @@

policy/modules/contrib/mcelog.fc line 4

Quoted 4 lines

policy/modules/contrib/mcelog.fc +4 -0

+/etc/mcelog(/.*)?	gen_context(system_u:object_r:mcelog_etc_t,s0)
+/etc/mcelog/.*-error-trigger	--	gen_context(system_u:object_r:mcelog_exec_t,s0)
+/etc/mcelog/.*.local		--	gen_context(system_u:object_r:mcelog_exec_t,s0)
+

I dont have a good argument for using bin_t but i dont have a good argument for using mcelog_exec_t either , therefore i suggest keeping it bin_t

policy/modules/contrib/mcelog.fc line 11

Quoted 7 lines

policy/modules/contrib/mcelog.fc +7 -0

+ifdef(`distro_redhat',`
+/etc/mcelog/triggers	-d	gen_context(system_u:object_r:mcelog_etc_t,s0)
+/etc/mcelog/triggers(/.*)?	gen_context(system_u:object_r:mcelog_exec_t,s0)
+')
+
+/etc/rc.d/init.d/mcelog	--	gen_context(system_u:object_r:mcelog_initrc_exec_t,s0)
+

Weird, i still dont see the periods escaped above.

Quoted 12 lines

policy/modules/contrib/mcelog.fc +4 -0

 /usr/sbin/mcelog	--	gen_context(system_u:object_r:mcelog_exec_t,s0)
+
+/var/log/mcelog		--	gen_context(system_u:object_r:mcelog_log_t,s0)
+/var/run/mcelog.pid	--	gen_context(system_u:object_r:mcelog_var_run_t,s0)
+/var/run/mcelog-client	-s	gen_context(system_u:object_r:mcelog_var_run_t,s0)

diff -pruN refpolicy-04062012/policy/modules/contrib/mcelog.if refpolicy-04062012-mcelog-support/policy/modules/contrib/mcelog.if

policy/modules/contrib/mcelog.if +0 -0

@@ -18,3 +18,78 @@ interface(`mcelog_domtrans',`
 	domtrans_pattern($1, mcelog_exec_t, mcelog_t)
 ')
 

policy/modules/contrib/mcelog.if interface(`mcelog_domtrans',` · line 23

Quoted 3 lines

policy/modules/contrib/mcelog.if +3 -0

+########################################
+## <summary>
+##	Read the mcelog configuration files.

I would probably use "Read mcelog configuration files."

Quoted 4 lines

policy/modules/contrib/mcelog.if +4 -0

+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.

policy/modules/contrib/mcelog.if interface(`mcelog_domtrans',` · line 32

Quoted 5 lines

policy/modules/contrib/mcelog.if +5 -0

+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`mcelog_read_config',`

I would probably call the interface "mcelog_read_config_files" or "mcelog_read_etc_files"

Quoted 20 lines

policy/modules/contrib/mcelog.if +20 -0

+	gen_require(`
+		type mcelog_etc_t;
+	')
+
+	files_search_etc($1)
+	read_files_pattern($1, mcelog_etc_t, mcelog_etc_t)
+	allow $1 mcelog_etc_t:dir list_dir_perms;
+')
+
+########################################
+## <summary>
+##	Create an mcelog unix stream socket.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`mcelog_stream_socket_create',`

policy/modules/contrib/mcelog.if interface(`mcelog_domtrans',` · line 58

Quoted 6 lines

policy/modules/contrib/mcelog.if +6 -0

+	gen_require(`
+		type mcelog_t;
+	')
+
+	allow $1 mcelog_t:unix_stream_socket create_socket_perms;
+')

Not needed.

Quoted 11 lines

policy/modules/contrib/mcelog.if +11 -0

+########################################
+## <summary>
+##	Read from an mcelog unix stream socket.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`mcelog_stream_socket_read',`

policy/modules/contrib/mcelog.if interface(`mcelog_domtrans',` · line 75

Quoted 6 lines

policy/modules/contrib/mcelog.if +6 -0

+	gen_require(`
+		type mcelog_t, mcelog_var_run_t;
+	')
+
+	allow $1 mcelog_var_run_t:unix_stream_socket { read };
+')

not needed.

Quoted 12 lines

policy/modules/contrib/mcelog.if +12 -0

+########################################
+## <summary>
+##	Connect to mcelog over an unix stream socket.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`mcelog_stream_socket_connect',`
+	gen_require(`

policy/modules/contrib/mcelog.if interface(`mcelog_domtrans',` · line 93

Quoted 6 lines

policy/modules/contrib/mcelog.if +6 -0

+		type mcelog_t, mcelog_var_run_t;
+	')
+
+	files_search_pids($1)
+	stream_connect_pattern($1, mcelog_var_run_t, mcelog_var_run_t, mcelog_t);
+')

Not needed.

Quoted 11 lines

diff -pruN refpolicy-04062012/policy/modules/contrib/mcelog.te refpolicy-04062012-mcelog-support/policy/modules/contrib/mcelog.te

policy/modules/contrib/mcelog.te +1 -1

@@ -1,4 +1,4 @@
-policy_module(mcelog, 1.1.0)
+policy_module(mcelog, 1.1.1)
 
 ########################################
 #

@@ -7,8 +7,20 @@ policy_module(mcelog, 1.1.0)
 

policy/modules/contrib/mcelog.te policy_module(mcelog, 1.1.0) · line 10

Quoted 5 lines

policy/modules/contrib/mcelog.te +1 -2

 type mcelog_t;
 type mcelog_exec_t;
-application_domain(mcelog_t, mcelog_exec_t)
-cron_system_entry(mcelog_t, mcelog_exec_t)
+corecmd_executable_file(mcelog_exec_t);

I still dont think corecmd_executable_file is needed. Not sure though.

Quoted 17 lines

policy/modules/contrib/mcelog.te +13 -0

+init_daemon_domain(mcelog_t, mcelog_exec_t)
+
+type mcelog_initrc_exec_t;
+init_script_file(mcelog_initrc_exec_t)
+
+type mcelog_etc_t;
+files_config_file(mcelog_etc_t)
+
+type mcelog_log_t;
+logging_log_file(mcelog_log_t)
+
+type mcelog_var_run_t;
+files_pid_file(mcelog_var_run_t)
 
 ########################################
 #

policy/modules/contrib/mcelog.te cron_system_entry(mcelog_t, mcelog_exec_ · line 30

Quoted 2 lines

policy/modules/contrib/mcelog.te +0 -0

@@ -17,16 +29,48 @@ cron_system_entry(mcelog_t, mcelog_exec_
 
 allow mcelog_t self:capability sys_admin;

add:

allow mcelog_t self:unix_stream_socket create_stream_socket_perms;

policy/modules/contrib/mcelog.te cron_system_entry(mcelog_t, mcelog_exec_ · line 32

Quoted 3 lines

policy/modules/contrib/mcelog.te +2 -0

+can_exec(mcelog_t, mcelog_exec_t)
+

If we keep using bin_t then this isnt needed

Quoted 32 lines

policy/modules/contrib/mcelog.te +20 -2

 kernel_read_system_state(mcelog_t)
 
 dev_read_raw_memory(mcelog_t)
 dev_read_kmsg(mcelog_t)
 
+dev_rw_sysfs(mcelog_t)
+
+# optional support for running it as a cron job
+optional_policy(`
+	cron_system_entry(mcelog_t, mcelog_exec_t)
+')
+
+manage_files_pattern(mcelog_t, mcelog_var_run_t, mcelog_var_run_t)
+manage_sock_files_pattern(mcelog_t, mcelog_var_run_t, mcelog_var_run_t)
+files_pid_filetrans(mcelog_t, mcelog_var_run_t, { file sock_file })
+
+# needed in daemon mode
 files_read_etc_files(mcelog_t)
 
-# for /dev/mem access
-mls_file_read_all_levels(mcelog_t)
+locallogin_use_fds(mcelog_t)
+
+# create/append a logfile in a private log directory
+create_files_pattern(mcelog_t, mcelog_log_t, mcelog_log_t)
+append_files_pattern(mcelog_t, mcelog_log_t, mcelog_log_t)
+setattr_files_pattern(mcelog_t, mcelog_log_t, mcelog_log_t)
+logging_log_filetrans(mcelog_t, mcelog_log_t, file)
 
+# use syslog functionality (optional, configurable)
 logging_send_syslog_msg(mcelog_t)
 

policy/modules/contrib/mcelog.te cron_system_entry(mcelog_t, mcelog_exec_ · line 64

Quoted 2 lines

policy/modules/contrib/mcelog.te +2 -0

+# to read the standard configuration file
+mcelog_read_config(mcelog_t)

use read_files_pattern(mcelog_t, mcelog_etc_t, mcelog_etc_t)

Interfaces are not for internal use

policy/modules/contrib/mcelog.te cron_system_entry(mcelog_t, mcelog_exec_ · line 69

Quoted 5 lines

policy/modules/contrib/mcelog.te +5 -0

+
+mcelog_stream_socket_create(mcelog_t)
+mcelog_stream_socket_read(mcelog_t)
+mcelog_stream_socket_connect(mcelog_t)
+

none of the above are needed

policy/modules/contrib/mcelog.te cron_system_entry(mcelog_t, mcelog_exec_ · line 75

Quoted 6 lines

policy/modules/contrib/mcelog.te +5 -0

 miscfiles_read_localization(mcelog_t)
+
+# for /dev/mem access
+mls_file_read_all_levels(mcelog_t)
+
+term_use_all_ttys(mcelog_t)

Quoted 14 lines

diff -pruN refpolicy-04062012/policy/modules/kernel/corecommands.fc refpolicy-04062012-mcelog-support/policy/modules/kernel/corecommands.fc

policy/modules/kernel/corecommands.fc +0 -6

@@ -72,12 +72,6 @@ ifdef(`distro_redhat',`
 /etc/kde/shutdown(/.*)?			gen_context(system_u:object_r:bin_t,s0)
 
 /etc/mail/make			--	gen_context(system_u:object_r:bin_t,s0)
-/etc/mcelog/.*-error-trigger	--	gen_context(system_u:object_r:bin_t,s0)
-/etc/mcelog/.*.local		--	gen_context(system_u:object_r:bin_t,s0)
-
-ifdef(`distro_redhat',`
-/etc/mcelog/triggers(/.*)?		gen_context(system_u:object_r:bin_t,s0)
-')
 

policy/modules/kernel/corecommands.fc ifdef(`distro_redhat',` · line 76

Quoted 1 line

policy/modules/kernel/corecommands.fc +0 -0

 /etc/mgetty+sendfax/new_fax	--	gen_context(system_u:object_r:bin_t,s0)

If we keep bin_t, then we need to use corecmd_exec_bin() or whatever that is called, which means it can execute any script and in particular any binary.

So, the good reason is restricting the type of files that mcelog can execute. In my opinion policy should always been designed that way, when the application needs to execute internal (or user-defined) scripts or binaries (as opposed to system-wide executables in /bin, /sbin, /usr/bin or /usr/sbin).

Unless you give me a good reason, I won't change that.

Ok. I will create a third version (v3) with further changes as necessary.

Quoted 2 lines

Not needed.

You suggested (initial review):

allow mcelog_t self:unix_stream_socket create_socket_perms;

I have just turned that into an interface...

So, I don't get the point now.

I think it gets audited as denied otherwise (possibly the client mode). If time allows, I'll double-check.

In client-mode it needs to connect to the socket.

Has the feature been removed in subsequent versions ? I can't find it anymore on kernel.org...

Otherwise, if they are labelled differently for increased security as explained above, it should need both corecmd_executable_file() and can_exec() on the private executable type.

Quoted 1 line

To be honest I would rather prefer not using bin_t. Perhaps, it needs to be able to transition from the private exec type ?

As far as I know other modules are using interfaces internally. I will double-check and if neccessary remove them.

term_use_all_ttys() is needed for interactive use. Do you know anything more restrictive than that ?

Quoted 5 lines · Guido Trentalancia

If we keep bin_t, then we need to use corecmd_exec_bin() or whatever that is called, which means it can execute any script and in particular any binary.

So, the good reason is restricting the type of files that mcelog can execute. In my opinion policy should always been designed that way, when the application needs to execute internal (or user-defined) scripts or binaries (as opposed to system-wide executables in /bin, /sbin, /usr/bin or /usr/sbin).

Unless you give me a good reason, I won't change that.

The only good reason i can come up with right now is that if you change this the maintainer might not accept the patch.

Quoted 1 line

Ok. I will create a third version (v3) with further changes as necessary.

This interface is not needed at all.

Signed-off-by Guido Trentalancia <[email protected]>

---
  policy/modules/contrib/mcelog.fc      |   15 +++++++
  policy/modules/contrib/mcelog.te      |   67 
+++++++++++++++++++++++++++++++---
  policy/modules/kernel/corecommands.fc |    6 ---
  3 files changed, 77 insertions(+), 11 deletions(-)

diff -pruN refpolicy-04062012/policy/modules/contrib/mcelog.fc refpolicy-04062012-mcelog-support/policy/modules/contrib/mcelog.fc
--- refpolicy-04062012/policy/modules/contrib/mcelog.fc 2011-09-09
18:29:23.578610955 +0200
+++ refpolicy-04062012-mcelog-support/policy/modules/contrib/mcelog.fc

2012-08-06 21:11:19.617661468 +0200

(quoted diff) +2 -0

+/var/run/mcelog\.pid	--	gen_context(system_u:object_r:mcelog_var_run_t,s0)
+/var/run/mcelog-client	-s 

gen_context(system_u:object_r:mcelog_var_run_t,s0)
diff -pruN refpolicy-04062012/policy/modules/contrib/mcelog.te refpolicy-04062012-mcelog-support/policy/modules/contrib/mcelog.te
--- refpolicy-04062012/policy/modules/contrib/mcelog.te 2011-09-09
18:29:23.578610955 +0200
+++ refpolicy-04062012-mcelog-support/policy/modules/contrib/mcelog.te

2012-08-06 22:18:27.551975687 +0200

(quoted diff) +1 -1

@@ -1,14 +1,34 @@
-policy_module(mcelog, 1.1.0)
+policy_module(mcelog, 1.1.1)
 
  ########################################
  #
  # Declarations

(quoted diff) +13 -2

  type mcelog_t;
  type mcelog_exec_t;
-application_domain(mcelog_t, mcelog_exec_t)
-cron_system_entry(mcelog_t, mcelog_exec_t)
+init_daemon_domain(mcelog_t, mcelog_exec_t)
+
+type mcelog_initrc_exec_t;
+init_script_file(mcelog_initrc_exec_t)
+
+type mcelog_etc_t;
+files_config_file(mcelog_etc_t)
+
+type mcelog_log_t;
+logging_log_file(mcelog_log_t)
+
+type mcelog_var_run_t;
+files_pid_file(mcelog_var_run_t)
 
  ########################################
  #

(quoted diff) +4 -0

+# optional support for running it as a cron job
+optional_policy(`
+        cron_system_entry(mcelog_t, mcelog_exec_t)
+')

Binary files refpolicy-04062012/policy/modules/contrib/.xen.te.swp and refpolicy-04062012-mcelog-support/policy/modules/contrib/.xen.te.swp differ diff -pruN refpolicy-04062012/policy/modules/kernel/corecommands.fc refpolicy-04062012-mcelog-support/policy/modules/kernel/corecommands.fc
--- refpolicy-04062012/policy/modules/kernel/corecommands.fc 2012-08-05
04:52:17.194005067 +0200
+++
refpolicy-04062012-mcelog-support/policy/modules/kernel/corecommands.fc

2012-08-05 17:49:05.594838788 +0200

(quoted diff) +0 -0

  /etc/mgetty\+sendfax/new_fax	--	gen_context(system_u:object_r:bin_t,s0)
 
 

Quoted 9 lines · Guido Trentalancia

Signed-off-by Guido Trentalancia <[email protected]>

---
   policy/modules/contrib/mcelog.fc      |   15 +++++++
   policy/modules/contrib/mcelog.te      |   67
+++++++++++++++++++++++++++++++---
   policy/modules/kernel/corecommands.fc |    6 ---
   3 files changed, 77 insertions(+), 11 deletions(-)

Quoted 7 lines

diff -pruN refpolicy-04062012/policy/modules/contrib/mcelog.fc refpolicy-04062012-mcelog-support/policy/modules/contrib/mcelog.fc
--- refpolicy-04062012/policy/modules/contrib/mcelog.fc 2011-09-09
18:29:23.578610955 +0200
+++ refpolicy-04062012-mcelog-support/policy/modules/contrib/mcelog.fc

2012-08-06 21:11:19.617661468 +0200

Review line 7

Quoted 7 lines

(quoted diff) +7 -0

@@ -1 +1,16 @@
+/etc/mcelog(/.*)?	gen_context(system_u:object_r:mcelog_etc_t,s0)
+/etc/mcelog/.*-error-trigger	--	gen_context(system_u:object_r:bin_t,s0)
+/etc/mcelog/.*\.local		--	gen_context(system_u:object_r:bin_t,s0)
+
+ifdef(`distro_redhat',`
+/etc/mcelog/triggers	-d	gen_context(system_u:object_r:mcelog_etc_t,s0)
+/etc/mcelog/triggers(/.*)?	gen_context(system_u:object_r:bin_t,s0)

The context specs with bin_t do not belong in this module. they should be moved to corecommands.fc (i believe)

Quoted 4 lines

(quoted diff) +3 -0

+')
+
+/etc/rc\.d/init\.d/mcelog	--
 gen_context(system_u:object_r:mcelog_initrc_exec_t,s0)

Review

Quoted 4 lines

(quoted diff) +3 -0

+
   /usr/sbin/mcelog	--	gen_context(system_u:object_r:mcelog_exec_t,s0)
+
+/var/log/mcelog		--	gen_context(system_u:object_r:mcelog_log_t,s0)

I would use "/var/log/mcelog.*" for logrotate support. logrotate sometimes append datestamps to rotated logs and we still want them to keep the right label

Quoted 18 lines

(quoted diff) +2 -0

+/var/run/mcelog\.pid	--	gen_context(system_u:object_r:mcelog_var_run_t,s0)
+/var/run/mcelog-client	-s

gen_context(system_u:object_r:mcelog_var_run_t,s0)
diff -pruN refpolicy-04062012/policy/modules/contrib/mcelog.te refpolicy-04062012-mcelog-support/policy/modules/contrib/mcelog.te
--- refpolicy-04062012/policy/modules/contrib/mcelog.te 2011-09-09
18:29:23.578610955 +0200
+++ refpolicy-04062012-mcelog-support/policy/modules/contrib/mcelog.te

2012-08-06 22:18:27.551975687 +0200

(quoted diff) +1 -1

@@ -1,14 +1,34 @@
-policy_module(mcelog, 1.1.0)
+policy_module(mcelog, 1.1.1)
 
   ########################################
   #
   # Declarations
   #
 

Review line 15

Quoted 8 lines

(quoted diff) +8 -0

+## <desc>
+## <p>
+## Allow mcelog to use all the ttys.
+## Required in foreground mode and to
+## print out usage and version information.
+## </p>
+## </desc>
+gen_tunable(mcelog_foreground, true)

No need for a boolean for this imho

Quoted 24 lines

(quoted diff) +13 -2

   type mcelog_t;
   type mcelog_exec_t;
-application_domain(mcelog_t, mcelog_exec_t)
-cron_system_entry(mcelog_t, mcelog_exec_t)
+init_daemon_domain(mcelog_t, mcelog_exec_t)
+
+type mcelog_initrc_exec_t;
+init_script_file(mcelog_initrc_exec_t)
+
+type mcelog_etc_t;
+files_config_file(mcelog_etc_t)
+
+type mcelog_log_t;
+logging_log_file(mcelog_log_t)
+
+type mcelog_var_run_t;
+files_pid_file(mcelog_var_run_t)
 
   ########################################
   #

@@ -17,16 +37,53 @@ cron_system_entry(mcelog_t, mcelog_exec_
 
   allow mcelog_t self:capability sys_admin;
 

Review cron_system_entry(mcelog_t, mcelog_exec_ · line 42

Quoted 3 lines

(quoted diff) +3 -0

+allow mcelog_t mcelog_etc_t:dir list_dir_perms;
+
+allow mcelog_t mcelog_t:unix_stream_socket create_socket_perms;

This needs to go under the "allow mcelog_t self:capability sysadmin;" See style guide.

also use create_stream_socket_perms instead of create_socket_perms

Review cron_system_entry(mcelog_t, mcelog_exec_ · line 53

Quoted 11 lines

(quoted diff) +7 -0

   kernel_read_system_state(mcelog_t)
 
+corecmd_exec_bin(mcelog_t)
+
   dev_read_raw_memory(mcelog_t)
   dev_read_kmsg(mcelog_t)
+dev_rw_sysfs(mcelog_t)
+
+manage_files_pattern(mcelog_t, mcelog_var_run_t, mcelog_var_run_t)
+manage_sock_files_pattern(mcelog_t, mcelog_var_run_t, mcelog_var_run_t)
+files_pid_filetrans(mcelog_t, mcelog_var_run_t, { file sock_file })

This needs to above "kernel_read_system_state(mcelog_t) See style guide

Review cron_system_entry(mcelog_t, mcelog_exec_ · line 55

Quoted 2 lines

(quoted diff) +1 -0

   files_read_etc_files(mcelog_t)
+files_search_etc(mcelog_t)

No need for this. files_read_etc_files(mcelog_t) already allow this

Review cron_system_entry(mcelog_t, mcelog_exec_ · line 58

Quoted 3 lines

(quoted diff) +3 -0

+files_search_pids(mcelog_t)
+read_files_pattern(mcelog_t, mcelog_etc_t, mcelog_etc_t)
+

This needs to go above kernel_read_system_state(mcelog_t) See style guide

Review cron_system_entry(mcelog_t, mcelog_exec_ · line 64

Quoted 6 lines

(quoted diff) +6 -0

+locallogin_use_fds(mcelog_t)
+
+# manage a logfile in a generic or private log directory
+manage_dirs_pattern(mcelog_t, mcelog_log_t, mcelog_log_t)
+manage_files_pattern(mcelog_t, mcelog_log_t, mcelog_log_t)
+logging_log_filetrans(mcelog_t, mcelog_log_t, file)

This needs to go above kernel_read_system_state(mcelog_t) See style guide

Quoted 5 lines

(quoted diff) +4 -0

+# use syslog functionality (optional, configurable)
+logging_send_syslog_msg(mcelog_t)
+
+miscfiles_read_localization(mcelog_t)
 

Review cron_system_entry(mcelog_t, mcelog_exec_ · line 74

Quoted 6 lines

(quoted diff) +1 -1

   # for /dev/mem access
   mls_file_read_all_levels(mcelog_t)
 
-logging_send_syslog_msg(mcelog_t)
+stream_connect_pattern(mcelog_t, mcelog_var_run_t, mcelog_var_run_t,
 mcelog_t)

This isnt needed

Review cron_system_entry(mcelog_t, mcelog_exec_ · line 76

Quoted 3 lines

(quoted diff) +2 -1

-miscfiles_read_localization(mcelog_t)
+term_dontaudit_use_all_ptys(mcelog_t)
+term_dontaudit_use_all_ttys(mcelog_t)

not needed. use: userdom_use_user_terminals(mcelog_t)

Review cron_system_entry(mcelog_t, mcelog_exec_ · line 80

Quoted 4 lines

(quoted diff) +4 -0

+tunable_policy(`mcelog_foreground',`
+term_use_all_ttys(mcelog_t)
+term_use_all_ptys(mcelog_t)
+')

Not needed.

Quoted 16 lines

(quoted diff) +4 -0

+# optional support for running it as a cron job
+optional_policy(`
+        cron_system_entry(mcelog_t, mcelog_exec_t)
+')

Binary files refpolicy-04062012/policy/modules/contrib/.xen.te.swp and refpolicy-04062012-mcelog-support/policy/modules/contrib/.xen.te.swp differ diff -pruN refpolicy-04062012/policy/modules/kernel/corecommands.fc refpolicy-04062012-mcelog-support/policy/modules/kernel/corecommands.fc
--- refpolicy-04062012/policy/modules/kernel/corecommands.fc 2012-08-05
04:52:17.194005067 +0200
+++
refpolicy-04062012-mcelog-support/policy/modules/kernel/corecommands.fc

2012-08-05 17:49:05.594838788 +0200

(quoted diff) +0 -0

@@ -72,12 +72,6 @@ ifdef(`distro_redhat',`
   /etc/kde/shutdown(/.*)?			gen_context(system_u:object_r:bin_t,s0)
 

Review ifdef(`distro_redhat',` · line 80

Quoted 7 lines

(quoted diff) +0 -6

   /etc/mail/make			--	gen_context(system_u:object_r:bin_t,s0)
-/etc/mcelog/.*-error-trigger	--	gen_context(system_u:object_r:bin_t,s0)
-/etc/mcelog/.*\.local		--	gen_context(system_u:object_r:bin_t,s0)
-
-ifdef(`distro_redhat',`
-/etc/mcelog/triggers(/.*)?		gen_context(system_u:object_r:bin_t,s0)
-')

dont remove this, this belongs here and not in mcelog.fc

Review ifdef(`distro_redhat',` · line 77

Quoted 3 lines

(quoted diff) +0 -0

   /etc/mgetty\+sendfax/new_fax	--	gen_context(system_u:object_r:bin_t,s0)
 
 

It's needed for the (untested) client mode.

There is a boolean for that (and for the server mode, as one might want to write another client for example).

Quoted 5 lines

Review

Quoted 3 lines

(quoted diff) +2 -1

-miscfiles_read_localization(mcelog_t)
+term_dontaudit_use_all_ptys(mcelog_t)
+term_dontaudit_use_all_ttys(mcelog_t)

not needed. use: userdom_use_user_terminals(mcelog_t)

It works and it appears to be widely used.

However I am not entirely clear to me what would happen if the userdomain module is explicitly turned off and whether it will keep working in single-user mode...

Quoted 6 lines

Review

Quoted 4 lines

(quoted diff) +4 -0

+tunable_policy(`mcelog_foreground',`
+term_use_all_ttys(mcelog_t)
+term_use_all_ptys(mcelog_t)
+')

Not needed.

See above.

Quoted 7 lines

It's needed for the (untested) client mode.

There is a boolean for that (and for the server mode, as one might want to write another client for example).

Its already allowed... I will explain it one more time:

allow mcelog_t self:unix_stream_socket create_stream_socket_perms; manage_sock_files_pattern(mcelog_t, mcelog_var_run_t, mcelog_var_run_t)

is what allows this already. Its already there and therefore the stream_connect_pattern() is reduntant.

Quoted 6 lines

Quoted 5 lines

Review

Quoted 3 lines

(quoted diff) +2 -1

-miscfiles_read_localization(mcelog_t)
+term_dontaudit_use_all_ptys(mcelog_t)
+term_dontaudit_use_all_ttys(mcelog_t)

not needed. use: userdom_use_user_terminals(mcelog_t)

Quoted 6 lines

It works and it appears to be widely used.

However I am not entirely clear to me what would happen if the userdomain module is explicitly turned off and whether it will keep working in single-user mode...

No need to worry about that. The userdomain module is not optional.

Quoted 8 lines

Quoted 6 lines

Review

Quoted 4 lines

(quoted diff) +4 -0

+tunable_policy(`mcelog_foreground',`
+term_use_all_ttys(mcelog_t)
+term_use_all_ptys(mcelog_t)
+')

Not needed.

See above.

Although the policy improved i still have issues with various parts of your policy.

However i won't review it anymore because i have made my points already in previous reviews. No need for repeating myself.

Quoted 7 lines

It's needed for the (untested) client mode.

There is a boolean for that (and for the server mode, as one might want to write another client for example).

Its already allowed... I will explain it one more time:

allow mcelog_t self:unix_stream_socket create_stream_socket_perms; manage_sock_files_pattern(mcelog_t, mcelog_var_run_t, mcelog_var_run_t)

is what allows this already. Its already there and therefore the stream_connect_pattern() is reduntant.

However i won't review it anymore because i have made my points already in previous reviews. No need for repeating myself.

Hello Dominick.

Quoted 10 lines · Dominick Grift

Quoted 7 lines

It's needed for the (untested) client mode.

There is a boolean for that (and for the server mode, as one might want to write another client for example).

Its already allowed... I will explain it one more time:

Quoted 5 lines

allow mcelog_t self:unix_stream_socket create_stream_socket_perms; manage_sock_files_pattern(mcelog_t, mcelog_var_run_t, mcelog_var_run_t)

is what allows this already. Its already there and therefore the stream_connect_pattern() is reduntant.

I have triple-checked now, so at least you could double-check...

stream_connect_pattern() is needed for "connectto" (client-mode)

removal of manage_sock_files_pattern would prevent sock_file creation:
it's the physical entry in the filesystem, not the logical socket created by create_stream_socket_perms !

Quoted 2 lines

However i won't review it anymore because i have made my points already in previous reviews. No need for repeating myself.

As already explained, all your revision have been introduced as applicable.

My advice is to apply it as it is now and then you can submit further patches as needed, which also seems much more efficient.

But I would strongly recommend you to also carry out some testing, because otherwise, no matter how skilled you are, things similar to the above might happen.

Regards,

Guido

Quoted 19 lines · Guido Trentalancia

Hello Dominick.

Quoted 15 lines · Dominick Grift

Quoted 7 lines

It's needed for the (untested) client mode.

There is a boolean for that (and for the server mode, as one might want to write another client for example).

Its already allowed... I will explain it one more time:

allow mcelog_t self:unix_stream_socket create_stream_socket_perms; manage_sock_files_pattern(mcelog_t, mcelog_var_run_t, mcelog_var_run_t)

is what allows this already. Its already there and therefore the stream_connect_pattern() is reduntant.

Quoted 2 lines

I have triple-checked now, so at least you could double-check...

whoops you are right but in that case just do something like this instead:

allow mcslog_t self:unix_stream_socket { create_socket_perms connectto; }

or show me the avc denials related to mcelog_t operating on mcelog_t unix stream sockets so that we can figure out the exact permissions.

but using stream_connect_pattern() is not the way to go here

Quoted 5 lines

stream_connect_pattern() is needed for "connectto" (client-mode)

removal of manage_sock_files_pattern would prevent sock_file creation:
it's the physical entry in the filesystem, not the logical socket created by create_stream_socket_perms !

I am not saying that you should remove it. I am saying that you should use the stream_connect_pattern()

Quoted 7 lines

Quoted 2 lines

However i won't review it anymore because i have made my points already in previous reviews. No need for repeating myself.

As already explained, all your revision have been introduced as applicable.

My advice is to apply it as it is now and then you can submit further patches as needed, which also seems much more efficient.

It's not my call. I am just reviewing.

Quoted 3 lines

But I would strongly recommend you to also carry out some testing, because otherwise, no matter how skilled you are, things similar to the above might happen.

It should be tested indeed

Quoted 3 lines

Regards,

Guido

Quoted 3 lines

allow mcslog_t self:unix_stream_socket { create_socket_perms connectto; }

Yes, I think it can be done, but I would need to check. But is this not going to be considered overengineering ?

I don't like such term very much in this context anyway, as usually there is always an advantage in terms of maintanability.

Quoted 4 lines

or show me the avc denials related to mcelog_t operating on mcelog_t unix stream sockets so that we can figure out the exact permissions.

but using stream_connect_pattern() is not the way to go here

Initially you had suggested that pattern, so I went for that.

Quoted 1 line · Guido Trentalancia

Quoted 1 line

Quoted 5 lines

Quoted 2 lines

allow mcslog_t self:unix_stream_socket { create_socket_perms connectto; }

Yes, I think it can be done, but I would need to check. But is this not going to be considered overengineering ?

No that is the way to go

Quoted 6 lines

I don't like such term very much in this context anyway, as usually there is always an advantage in terms of maintanability.

Quoted 3 lines

or show me the avc denials related to mcelog_t operating on mcelog_t unix stream sockets so that we can figure out the exact permissions.

Quoted 3 lines

Quoted 1 line

but using stream_connect_pattern() is not the way to go here

Initially you had suggested that pattern, so I went for that.

Right but at that time i didnt see the big picture (context of the usage)

Here is the latest (v6) version:

Rewrite of mcelog module:
- version increment
- fix and extend file contexts (private types)
- support daemon mode and init scripting (+ deprecated and untested cron mode)
- support optional triggers for all distributions, while leaving compatibility with their alternate location in Fedora (and current policy)
- initial configurable support for client/server mode (untested)
- support for sysfs (rw)
- includes several revisions from Dominick Grift
- removed duplicate syslog interface over previous version 4
- reduced stream_connect_pattern to permissions from version 5

Signed-off-by Guido Trentalancia <[email protected]>

---
  policy/modules/contrib/mcelog.fc      |   12 +++
  policy/modules/contrib/mcelog.te      |  118 
++++++++++++++++++++++++++++++++--
  policy/modules/kernel/corecommands.fc |    8 ++
  3 files changed, 131 insertions(+), 7 deletions(-)

diff -pruN refpolicy-04062012/policy/modules/contrib/mcelog.fc refpolicy-04062012-mcelog-support-v6/policy/modules/contrib/mcelog.fc
--- refpolicy-04062012/policy/modules/contrib/mcelog.fc 2011-09-09
18:29:23.578610955 +0200
+++
refpolicy-04062012-mcelog-support-v6/policy/modules/contrib/mcelog.fc

2012-08-07 21:10:43.247757154 +0200

(quoted diff) +12 -0

@@ -1 +1,13 @@
+/etc/mcelog(/.*)?		gen_context(system_u:object_r:mcelog_etc_t,s0)
+
+ifdef(`distro_redhat',`
+/etc/mcelog/triggers	-d	gen_context(system_u:object_r:mcelog_etc_t,s0)
+')
+
+/etc/rc\.d/init\.d/mcelog	-- 
 gen_context(system_u:object_r:mcelog_initrc_exec_t,s0)
+
  /usr/sbin/mcelog	--	gen_context(system_u:object_r:mcelog_exec_t,s0)
+
+/var/log/mcelog.*	--	gen_context(system_u:object_r:mcelog_log_t,s0)
+/var/run/mcelog\.pid	--	gen_context(system_u:object_r:mcelog_var_run_t,s0)
+/var/run/mcelog-client	-s 

gen_context(system_u:object_r:mcelog_var_run_t,s0)
diff -pruN refpolicy-04062012/policy/modules/contrib/mcelog.te refpolicy-04062012-mcelog-support-v6/policy/modules/contrib/mcelog.te
--- refpolicy-04062012/policy/modules/contrib/mcelog.te 2011-09-09
18:29:23.578610955 +0200
+++
refpolicy-04062012-mcelog-support-v6/policy/modules/contrib/mcelog.te

2012-08-08 01:11:06.572330170 +0200

(quoted diff) +112 -6

@@ -1,14 +1,70 @@
-policy_module(mcelog, 1.1.0)
+policy_module(mcelog, 1.1.1)
 
  ########################################
  #
  # Declarations
  #
 
+## <desc>
+## <p>
+## Allow mcelog to run in client mode.
+## Required to run mcelog in client
+## mode.
+## </p>
+## </desc>
+gen_tunable(mcelog_client, false)
+
+## <desc>
+## <p>
+## Allow mcelog to execute scripts.
+## Required to execute optional triggers
+## and/or local scripts.
+## </p>
+## </desc>
+gen_tunable(mcelog_exec_scripts, true)
+
+## <desc>
+## <p>
+## Allow mcelog to use all the user ttys.
+## Required in foreground mode and to
+## print out usage and version information.
+## </p>
+## </desc>
+gen_tunable(mcelog_foreground, true)
+
+## <desc>
+## <p>
+## Allow mcelog to run a server.
+## Required to enable the optional configurable
+## Unix stream socket server functionality.
+## </p>
+## </desc>
+gen_tunable(mcelog_server, false)
+
+## <desc>
+## <p>
+## Allow mcelog to use syslog.
+## Required to use the configurable
+## syslog option.
+## </p>
+## </desc>
+gen_tunable(mcelog_syslog, true)
+
  type mcelog_t;
  type mcelog_exec_t;
-application_domain(mcelog_t, mcelog_exec_t)
-cron_system_entry(mcelog_t, mcelog_exec_t)
+init_daemon_domain(mcelog_t, mcelog_exec_t)
+
+type mcelog_initrc_exec_t;
+init_script_file(mcelog_initrc_exec_t)
+
+type mcelog_etc_t;
+files_config_file(mcelog_etc_t)
+
+type mcelog_log_t;
+logging_log_file(mcelog_log_t)
+
+type mcelog_var_run_t;
+files_pid_file(mcelog_var_run_t)
 
  ########################################
  #

@@ -16,17 +72,67 @@ cron_system_entry(mcelog_t, mcelog_exec_
  #
 
  allow mcelog_t self:capability sys_admin;
+allow mcelog_t self:unix_stream_socket connected_socket_perms;
+allow mcelog_t mcelog_etc_t:dir list_dir_perms;
+
+files_search_pids(mcelog_t)
+read_files_pattern(mcelog_t, mcelog_etc_t, mcelog_etc_t)
+
+# manage a logfile in a generic or private log directory
+manage_dirs_pattern(mcelog_t, mcelog_log_t, mcelog_log_t)
+manage_files_pattern(mcelog_t, mcelog_log_t, mcelog_log_t)
+logging_log_filetrans(mcelog_t, mcelog_log_t, file)
+
+manage_files_pattern(mcelog_t, mcelog_var_run_t, mcelog_var_run_t)
+manage_sock_files_pattern(mcelog_t, mcelog_var_run_t, mcelog_var_run_t)
+files_pid_filetrans(mcelog_t, mcelog_var_run_t, { file sock_file })
 
  kernel_read_system_state(mcelog_t)
 
  dev_read_raw_memory(mcelog_t)
  dev_read_kmsg(mcelog_t)
+dev_rw_sysfs(mcelog_t)
 
  files_read_etc_files(mcelog_t)
+files_search_pids(mcelog_t)
+read_files_pattern(mcelog_t, mcelog_etc_t, mcelog_etc_t)
+
+locallogin_use_fds(mcelog_t)
+
+miscfiles_read_localization(mcelog_t)
 
  # for /dev/mem access
  mls_file_read_all_levels(mcelog_t)
 
-logging_send_syslog_msg(mcelog_t)
-
-miscfiles_read_localization(mcelog_t)
+# needed in client-mode
+tunable_policy(`mcelog_client',`
+	allow mcelog_t self:unix_stream_socket connectto;
+')
+
+# required for executing optional triggers and scripts
+tunable_policy(`mcelog_exec_scripts',`
+	allow mcelog_t self:fifo_file { read getattr write };
+	corecmd_exec_bin(mcelog_t)
+	corecmd_exec_shell(mcelog_t)
+')
+
+# required for optional foreground mode and
+# console output
+tunable_policy(`mcelog_foreground',`
+	userdom_use_user_terminals(mcelog_t)
+')
+
+# required for the optional server functionality
+tunable_policy(`mcelog_server',`
+	allow mcelog_t self:unix_stream_socket { listen accept };
+')
+
+# use syslog functionality (optional, configurable)
+tunable_policy(`mcelog_syslog',`
+	logging_send_syslog_msg(mcelog_t)
+')
+
+# optional support for running it as a cron job
+optional_policy(`
+	cron_system_entry(mcelog_t, mcelog_exec_t)
+')

diff -pruN refpolicy-04062012/policy/modules/kernel/corecommands.fc refpolicy-04062012-mcelog-support-v6/policy/modules/kernel/corecommands.fc
--- refpolicy-04062012/policy/modules/kernel/corecommands.fc 2012-08-07
18:38:05.323569047 +0200
+++
refpolicy-04062012-mcelog-support-v6/policy/modules/kernel/corecommands.fc

2012-08-07 15:54:20.796905090 +0200

(quoted diff) +7 -1

@@ -72,8 +72,14 @@ ifdef(`distro_redhat',`
  /etc/kde/shutdown(/.*)?			gen_context(system_u:object_r:bin_t,s0)
 
  /etc/mail/make			--	gen_context(system_u:object_r:bin_t,s0)
-/etc/mcelog/cache-error-trigger	--	gen_context(system_u:object_r:bin_t,s0)
+
+/etc/mcelog/.*-error-trigger	--	gen_context(system_u:object_r:bin_t,s0)
+/etc/mcelog/.*\.local		--	gen_context(system_u:object_r:bin_t,s0)
+
+ifdef(`distro_redhat',`
  /etc/mcelog/triggers(/.*)?		gen_context(system_u:object_r:bin_t,s0)
+')
+
  /etc/mgetty\+sendfax/new_fax	--	gen_context(system_u:object_r:bin_t,s0)
 
  /etc/netplug\.d(/.*)? 	 		gen_context(system_u:object_r:bin_t,s0)

Quoted 15 lines · Guido Trentalancia

Here is the latest (v6) version:

Rewrite of mcelog module:
- version increment
- fix and extend file contexts (private types)
- support daemon mode and init scripting (+ deprecated and untested cron mode)
- support optional triggers for all distributions, while leaving compatibility with their alternate location in Fedora (and current policy)
- initial configurable support for client/server mode (untested)
- support for sysfs (rw)
- includes several revisions from Dominick Grift
- removed duplicate syslog interface over previous version 4
- reduced stream_connect_pattern to permissions from version 5

Merged. In the future, please do not increment the module version.

Quoted 8 lines

Signed-off-by Guido Trentalancia <[email protected]>

---
   policy/modules/contrib/mcelog.fc      |   12 +++
   policy/modules/contrib/mcelog.te      |  118
++++++++++++++++++++++++++++++++--
   policy/modules/kernel/corecommands.fc |    8 ++
   3 files changed, 131 insertions(+), 7 deletions(-)

Quoted 8 lines

diff -pruN refpolicy-04062012/policy/modules/contrib/mcelog.fc refpolicy-04062012-mcelog-support-v6/policy/modules/contrib/mcelog.fc
--- refpolicy-04062012/policy/modules/contrib/mcelog.fc 2011-09-09
18:29:23.578610955 +0200
+++
refpolicy-04062012-mcelog-support-v6/policy/modules/contrib/mcelog.fc

2012-08-07 21:10:43.247757154 +0200

Review line 8

Quoted 8 lines

(quoted diff) +7 -0

@@ -1 +1,13 @@
+/etc/mcelog(/.*)?		gen_context(system_u:object_r:mcelog_etc_t,s0)
+
+ifdef(`distro_redhat',`
+/etc/mcelog/triggers	-d	gen_context(system_u:object_r:mcelog_etc_t,s0)
+')
+
+/etc/rc\.d/init\.d/mcelog	--
 gen_context(system_u:object_r:mcelog_initrc_exec_t,s0)

Quoted 17 lines

(quoted diff) +5 -0

+
   /usr/sbin/mcelog	--	gen_context(system_u:object_r:mcelog_exec_t,s0)
+
+/var/log/mcelog.*	--	gen_context(system_u:object_r:mcelog_log_t,s0)
+/var/run/mcelog\.pid	--	gen_context(system_u:object_r:mcelog_var_run_t,s0)
+/var/run/mcelog-client	-s

gen_context(system_u:object_r:mcelog_var_run_t,s0)
diff -pruN refpolicy-04062012/policy/modules/contrib/mcelog.te refpolicy-04062012-mcelog-support-v6/policy/modules/contrib/mcelog.te
--- refpolicy-04062012/policy/modules/contrib/mcelog.te 2011-09-09
18:29:23.578610955 +0200
+++
refpolicy-04062012-mcelog-support-v6/policy/modules/contrib/mcelog.te

2012-08-08 01:11:06.572330170 +0200

(quoted diff) +1 -1

@@ -1,14 +1,70 @@
-policy_module(mcelog, 1.1.0)
+policy_module(mcelog, 1.1.1)

Quoted 21 lines

(quoted diff) +14 -0

@@ -16,17 +72,67 @@ cron_system_entry(mcelog_t, mcelog_exec_
   #
 
   allow mcelog_t self:capability sys_admin;
+allow mcelog_t self:unix_stream_socket connected_socket_perms;
+allow mcelog_t mcelog_etc_t:dir list_dir_perms;
+
+files_search_pids(mcelog_t)
+read_files_pattern(mcelog_t, mcelog_etc_t, mcelog_etc_t)
+
+# manage a logfile in a generic or private log directory
+manage_dirs_pattern(mcelog_t, mcelog_log_t, mcelog_log_t)
+manage_files_pattern(mcelog_t, mcelog_log_t, mcelog_log_t)
+logging_log_filetrans(mcelog_t, mcelog_log_t, file)
+
+manage_files_pattern(mcelog_t, mcelog_var_run_t, mcelog_var_run_t)
+manage_sock_files_pattern(mcelog_t, mcelog_var_run_t, mcelog_var_run_t)
+files_pid_filetrans(mcelog_t, mcelog_var_run_t, { file sock_file })
 
   kernel_read_system_state(mcelog_t)
 

Review cron_system_entry(mcelog_t, mcelog_exec_ · line 98

Quoted 7 lines

(quoted diff) +3 -0

   dev_read_raw_memory(mcelog_t)
   dev_read_kmsg(mcelog_t)
+dev_rw_sysfs(mcelog_t)
 
   files_read_etc_files(mcelog_t)
+files_search_pids(mcelog_t)
+read_files_pattern(mcelog_t, mcelog_etc_t, mcelog_etc_t)

Quoted 11 lines · Christopher J. PeBenito

Review line 8

Quoted 9 lines · Guido Trentalancia

(quoted diff) +7 -0

@@ -1 +1,13 @@
+/etc/mcelog(/.*)?        gen_context(system_u:object_r:mcelog_etc_t,s0)
+
+ifdef(`distro_redhat',`
+/etc/mcelog/triggers    -d    gen_context(system_u:object_r:mcelog_etc_t,s0)
+')
+
+/etc/rc\.d/init\.d/mcelog    --
 gen_context(system_u:object_r:mcelog_initrc_exec_t,s0)

Dominick has also noted that Debian (and Gentoo) are actually using a different path for the init scripts. I don't know how to move on with this really, as the rest of the current reference policy only has support for such alternative location in the hadoop module.

Quoted 15 lines · Guido Trentalancia

Here is the latest (v6) version:

Rewrite of mcelog module:
- version increment
- fix and extend file contexts (private types)
- support daemon mode and init scripting (+ deprecated and untested cron mode)
- support optional triggers for all distributions, while leaving compatibility with their alternate location in Fedora (and current policy)
- initial configurable support for client/server mode (untested)
- support for sysfs (rw)
- includes several revisions from Dominick Grift
- removed duplicate syslog interface over previous version 4
- reduced stream_connect_pattern to permissions from version 5

Merged. In the future, please do not increment the module version.

Quoted 206 lines

Signed-off-by Guido Trentalancia <[email protected]>

---
   policy/modules/contrib/mcelog.fc      |   12 +++
   policy/modules/contrib/mcelog.te      |  118
++++++++++++++++++++++++++++++++--
   policy/modules/kernel/corecommands.fc |    8 ++
   3 files changed, 131 insertions(+), 7 deletions(-)

diff -pruN refpolicy-04062012/policy/modules/contrib/mcelog.fc refpolicy-04062012-mcelog-support-v6/policy/modules/contrib/mcelog.fc
--- refpolicy-04062012/policy/modules/contrib/mcelog.fc 2011-09-09
18:29:23.578610955 +0200
+++
refpolicy-04062012-mcelog-support-v6/policy/modules/contrib/mcelog.fc

2012-08-07 21:10:43.247757154 +0200

(quoted diff) +12 -0

@@ -1 +1,13 @@
+/etc/mcelog(/.*)?		gen_context(system_u:object_r:mcelog_etc_t,s0)
+
+ifdef(`distro_redhat',`
+/etc/mcelog/triggers	-d	gen_context(system_u:object_r:mcelog_etc_t,s0)
+')
+
+/etc/rc\.d/init\.d/mcelog	--
 gen_context(system_u:object_r:mcelog_initrc_exec_t,s0)
+
   /usr/sbin/mcelog	--	gen_context(system_u:object_r:mcelog_exec_t,s0)
+
+/var/log/mcelog.*	--	gen_context(system_u:object_r:mcelog_log_t,s0)
+/var/run/mcelog\.pid	--	gen_context(system_u:object_r:mcelog_var_run_t,s0)
+/var/run/mcelog-client	-s

gen_context(system_u:object_r:mcelog_var_run_t,s0)
diff -pruN refpolicy-04062012/policy/modules/contrib/mcelog.te refpolicy-04062012-mcelog-support-v6/policy/modules/contrib/mcelog.te
--- refpolicy-04062012/policy/modules/contrib/mcelog.te 2011-09-09
18:29:23.578610955 +0200
+++
refpolicy-04062012-mcelog-support-v6/policy/modules/contrib/mcelog.te

2012-08-08 01:11:06.572330170 +0200

(quoted diff) +112 -6

@@ -1,14 +1,70 @@
-policy_module(mcelog, 1.1.0)
+policy_module(mcelog, 1.1.1)
 
   ########################################
   #
   # Declarations
   #
 
+## <desc>
+## <p>
+## Allow mcelog to run in client mode.
+## Required to run mcelog in client
+## mode.
+## </p>
+## </desc>
+gen_tunable(mcelog_client, false)
+
+## <desc>
+## <p>
+## Allow mcelog to execute scripts.
+## Required to execute optional triggers
+## and/or local scripts.
+## </p>
+## </desc>
+gen_tunable(mcelog_exec_scripts, true)
+
+## <desc>
+## <p>
+## Allow mcelog to use all the user ttys.
+## Required in foreground mode and to
+## print out usage and version information.
+## </p>
+## </desc>
+gen_tunable(mcelog_foreground, true)
+
+## <desc>
+## <p>
+## Allow mcelog to run a server.
+## Required to enable the optional configurable
+## Unix stream socket server functionality.
+## </p>
+## </desc>
+gen_tunable(mcelog_server, false)
+
+## <desc>
+## <p>
+## Allow mcelog to use syslog.
+## Required to use the configurable
+## syslog option.
+## </p>
+## </desc>
+gen_tunable(mcelog_syslog, true)
+
   type mcelog_t;
   type mcelog_exec_t;
-application_domain(mcelog_t, mcelog_exec_t)
-cron_system_entry(mcelog_t, mcelog_exec_t)
+init_daemon_domain(mcelog_t, mcelog_exec_t)
+
+type mcelog_initrc_exec_t;
+init_script_file(mcelog_initrc_exec_t)
+
+type mcelog_etc_t;
+files_config_file(mcelog_etc_t)
+
+type mcelog_log_t;
+logging_log_file(mcelog_log_t)
+
+type mcelog_var_run_t;
+files_pid_file(mcelog_var_run_t)
 
   ########################################
   #

@@ -16,17 +72,67 @@ cron_system_entry(mcelog_t, mcelog_exec_
   #
 
   allow mcelog_t self:capability sys_admin;
+allow mcelog_t self:unix_stream_socket connected_socket_perms;
+allow mcelog_t mcelog_etc_t:dir list_dir_perms;
+
+files_search_pids(mcelog_t)
+read_files_pattern(mcelog_t, mcelog_etc_t, mcelog_etc_t)
+
+# manage a logfile in a generic or private log directory
+manage_dirs_pattern(mcelog_t, mcelog_log_t, mcelog_log_t)
+manage_files_pattern(mcelog_t, mcelog_log_t, mcelog_log_t)
+logging_log_filetrans(mcelog_t, mcelog_log_t, file)
+
+manage_files_pattern(mcelog_t, mcelog_var_run_t, mcelog_var_run_t)
+manage_sock_files_pattern(mcelog_t, mcelog_var_run_t, mcelog_var_run_t)
+files_pid_filetrans(mcelog_t, mcelog_var_run_t, { file sock_file })
 
   kernel_read_system_state(mcelog_t)
 
   dev_read_raw_memory(mcelog_t)
   dev_read_kmsg(mcelog_t)
+dev_rw_sysfs(mcelog_t)
 
   files_read_etc_files(mcelog_t)
+files_search_pids(mcelog_t)
+read_files_pattern(mcelog_t, mcelog_etc_t, mcelog_etc_t)
+
+locallogin_use_fds(mcelog_t)
+
+miscfiles_read_localization(mcelog_t)
 
   # for /dev/mem access
   mls_file_read_all_levels(mcelog_t)
 
-logging_send_syslog_msg(mcelog_t)
-
-miscfiles_read_localization(mcelog_t)
+# needed in client-mode
+tunable_policy(`mcelog_client',`
+	allow mcelog_t self:unix_stream_socket connectto;
+')
+
+# required for executing optional triggers and scripts
+tunable_policy(`mcelog_exec_scripts',`
+	allow mcelog_t self:fifo_file { read getattr write };
+	corecmd_exec_bin(mcelog_t)
+	corecmd_exec_shell(mcelog_t)
+')
+
+# required for optional foreground mode and
+# console output
+tunable_policy(`mcelog_foreground',`
+	userdom_use_user_terminals(mcelog_t)
+')
+
+# required for the optional server functionality
+tunable_policy(`mcelog_server',`
+	allow mcelog_t self:unix_stream_socket { listen accept };
+')
+
+# use syslog functionality (optional, configurable)
+tunable_policy(`mcelog_syslog',`
+	logging_send_syslog_msg(mcelog_t)
+')
+
+# optional support for running it as a cron job
+optional_policy(`
+	cron_system_entry(mcelog_t, mcelog_exec_t)
+')

diff -pruN refpolicy-04062012/policy/modules/kernel/corecommands.fc refpolicy-04062012-mcelog-support-v6/policy/modules/kernel/corecommands.fc
--- refpolicy-04062012/policy/modules/kernel/corecommands.fc 2012-08-07
18:38:05.323569047 +0200
+++
refpolicy-04062012-mcelog-support-v6/policy/modules/kernel/corecommands.fc

2012-08-07 15:54:20.796905090 +0200

(quoted diff) +7 -1

@@ -72,8 +72,14 @@ ifdef(`distro_redhat',`
   /etc/kde/shutdown(/.*)?			gen_context(system_u:object_r:bin_t,s0)
 
   /etc/mail/make			--	gen_context(system_u:object_r:bin_t,s0)
-/etc/mcelog/cache-error-trigger	--	gen_context(system_u:object_r:bin_t,s0)
+
+/etc/mcelog/.*-error-trigger	--	gen_context(system_u:object_r:bin_t,s0)
+/etc/mcelog/.*\.local		--	gen_context(system_u:object_r:bin_t,s0)
+
+ifdef(`distro_redhat',`
   /etc/mcelog/triggers(/.*)?		gen_context(system_u:object_r:bin_t,s0)
+')
+
   /etc/mgetty\+sendfax/new_fax	--	gen_context(system_u:object_r:bin_t,s0)
 
   /etc/netplug\.d(/.*)? 	 		gen_context(system_u:object_r:bin_t,s0)

Christopher,

you can also add the following, if you like (I see from latest git that the duplicate etc_t file pattern interface have already been removed):

Reorder one file pattern interface in the recently updated mcelog.

Signed-off-by Guido Trentalancia <[email protected]>

---

policy/modules/contrib/mcelog.te 2012-08-08 21:22:19.204057838 +0200 renamed from policy/modules/contrib/mcelog.te 2012-08-08 21:22:01.160888610 +0200 +1 -0

@@ -75,6 +75,7 @@ allow mcelog_t self:capability sys_admin
 allow mcelog_t self:unix_stream_socket connected_socket_perms;
 allow mcelog_t mcelog_etc_t:dir list_dir_perms;
 
+files_read_etc_files(mcelog_t)
 read_files_pattern(mcelog_t, mcelog_etc_t, mcelog_etc_t)
 
 # manage a logfile in a generic or private log directory

Quoted 23 lines · Guido Trentalancia

Christopher,

you can also add the following, if you like (I see from latest git that the duplicate etc_t file pattern interface have already been removed):

Reorder one file pattern interface in the recently updated mcelog.

Signed-off-by Guido Trentalancia <[email protected]>

---

policy/modules/contrib/mcelog.te 2012-08-08 21:22:19.204057838 +0200 renamed from policy/modules/contrib/mcelog.te 2012-08-08 21:22:01.160888610 +0200 +1 -0

@@ -75,6 +75,7 @@ allow mcelog_t self:capability sys_admin
  allow mcelog_t self:unix_stream_socket connected_socket_perms;
  allow mcelog_t mcelog_etc_t:dir list_dir_perms;
 
+files_read_etc_files(mcelog_t)
  read_files_pattern(mcelog_t, mcelog_etc_t, mcelog_etc_t)
 
  # manage a logfile in a generic or private log directory

@@ -92,8 +93,6 @@ dev_read_raw_memory(mcelog_t)
  dev_read_kmsg(mcelog_t)
  dev_rw_sysfs(mcelog_t)
 

policy/modules/contrib/mcelog.te 2012-08-08 21:22:19.204057838 +0200 dev_read_raw_memory(mcelog_t) · line 97

Quoted 4 lines

policy/modules/contrib/mcelog.te 2012-08-08 21:22:19.204057838 +0200 renamed from policy/modules/contrib/mcelog.te 2012-08-08 21:22:01.160888610 +0200 +0 -2

-files_read_etc_files(mcelog_t)
-
  # for /dev/mem access
  mls_file_read_all_levels(mcelog_t)

This isn't necessary. The reading etc files stands on its own where it is. If we want to be really thorough, you could add files_search_etc() by the read_files_pattern, but I think its fine as is.

Quoted 15 lines · Christopher J. PeBenito

Quoted 14 lines · Guido Trentalancia

policy/modules/contrib/mcelog.te 2012-08-08 21:22:19.204057838 +0200 renamed from policy/modules/contrib/mcelog.te 2012-08-08 21:22:01.160888610 +0200 +1 -0

@@ -75,6 +75,7 @@ allow mcelog_t self:capability sys_admin
  allow mcelog_t self:unix_stream_socket connected_socket_perms;
  allow mcelog_t mcelog_etc_t:dir list_dir_perms;
 
+files_read_etc_files(mcelog_t)
  read_files_pattern(mcelog_t, mcelog_etc_t, mcelog_etc_t)
 
  # manage a logfile in a generic or private log directory

@@ -92,8 +93,6 @@ dev_read_raw_memory(mcelog_t)
  dev_read_kmsg(mcelog_t)
  dev_rw_sysfs(mcelog_t)
 

Quoted 6 lines

policy/modules/contrib/mcelog.te 2012-08-08 21:22:19.204057838 +0200 dev_read_raw_memory(mcelog_t) · line 97

Quoted 4 lines

policy/modules/contrib/mcelog.te 2012-08-08 21:22:19.204057838 +0200 renamed from policy/modules/contrib/mcelog.te 2012-08-08 21:22:01.160888610 +0200 +0 -2

-files_read_etc_files(mcelog_t)
-
  # for /dev/mem access
  mls_file_read_all_levels(mcelog_t)

This isn't necessary. The reading etc files stands on its own where it is. If we want to be really thorough, you could add files_search_etc() by the read_files_pattern, but I think its fine as is.

Yes, why not ? I have also added a comment to be 100% transparent to the user, if anybodys want to further restrict it under particular circumstances:

Quoted 23 lines · Guido Trentalancia

Quoted 21 lines · Christopher J. PeBenito

Quoted 11 lines · Guido Trentalancia

policy/modules/contrib/mcelog.te 2012-08-08 21:22:19.204057838 +0200 renamed from policy/modules/contrib/mcelog.te 2012-08-08 21:22:01.160888610 +0200 +1 -0

@@ -75,6 +75,7 @@ allow mcelog_t self:capability sys_admin
   allow mcelog_t self:unix_stream_socket connected_socket_perms;
   allow mcelog_t mcelog_etc_t:dir list_dir_perms;
 
+files_read_etc_files(mcelog_t)
   read_files_pattern(mcelog_t, mcelog_etc_t, mcelog_etc_t)
 
   # manage a logfile in a generic or private log directory

policy/modules/contrib/mcelog.te 2012-08-08 21:22:19.204057838 +0200 dev_read_raw_memory(mcelog_t) · line 97

Quoted 7 lines

policy/modules/contrib/mcelog.te 2012-08-08 21:22:19.204057838 +0200 renamed from policy/modules/contrib/mcelog.te 2012-08-08 21:22:01.160888610 +0200 +0 -2

@@ -92,8 +93,6 @@ dev_read_raw_memory(mcelog_t)
   dev_read_kmsg(mcelog_t)
   dev_rw_sysfs(mcelog_t)
 
-files_read_etc_files(mcelog_t)
-
   # for /dev/mem access
   mls_file_read_all_levels(mcelog_t)

This isn't necessary. The reading etc files stands on its own where it is. If we want to be really thorough, you could add files_search_etc() by the read_files_pattern, but I think its fine as is.

Quoted 3 lines

Yes, why not ? I have also added a comment to be 100% transparent to the user, if anybodys want to further restrict it under particular circumstances:

Reading etc_t files is not a required access for reading mcelog_etc_t files. If mcelog does not read etc_t files, then moving the line makes sense, if its also changed to files_search_etc().

Quoted 24 lines · Christopher J. PeBenito

Quoted 23 lines · Guido Trentalancia

Quoted 21 lines · Christopher J. PeBenito

Quoted 11 lines · Guido Trentalancia

policy/modules/contrib/mcelog.te 2012-08-08 21:22:19.204057838 +0200 renamed from policy/modules/contrib/mcelog.te 2012-08-08 21:22:01.160888610 +0200 +1 -0

@@ -75,6 +75,7 @@ allow mcelog_t self:capability sys_admin
   allow mcelog_t self:unix_stream_socket connected_socket_perms;
   allow mcelog_t mcelog_etc_t:dir list_dir_perms;
 
+files_read_etc_files(mcelog_t)
   read_files_pattern(mcelog_t, mcelog_etc_t, mcelog_etc_t)
 
   # manage a logfile in a generic or private log directory

policy/modules/contrib/mcelog.te 2012-08-08 21:22:19.204057838 +0200 dev_read_raw_memory(mcelog_t) · line 97

Quoted 7 lines

policy/modules/contrib/mcelog.te 2012-08-08 21:22:19.204057838 +0200 renamed from policy/modules/contrib/mcelog.te 2012-08-08 21:22:01.160888610 +0200 +0 -2

@@ -92,8 +93,6 @@ dev_read_raw_memory(mcelog_t)
   dev_read_kmsg(mcelog_t)
   dev_rw_sysfs(mcelog_t)
 
-files_read_etc_files(mcelog_t)
-
   # for /dev/mem access
   mls_file_read_all_levels(mcelog_t)

This isn't necessary. The reading etc files stands on its own where it is. If we want to be really thorough, you could add files_search_etc() by the read_files_pattern, but I think its fine as is.

Quoted 5 lines

Quoted 3 lines

Yes, why not ? I have also added a comment to be 100% transparent to the user, if anybodys want to further restrict it under particular circumstances:

Reading etc_t files is not a required access for reading mcelog_etc_t files. If mcelog does not read etc_t files, then moving the line makes sense, if its also changed to files_search_etc().

I think it might need to read the passwd database in daemon mode only for uid/gid. Perhaps there is a more specific interface for doing so...