Skip to contentSkip to conversation

: add lost+found filesystem labels to support NSA security guidelines

PATCH New Guido Trentalancia 2 participants 3 messages Aug 25, 2012 – Aug 29, 2012

lore
Share & tools
lore

Guido Trentalancia

author
#0 lore raw

PATCH 1/1 : add lost+found filesystem labels to support NSA security guidelines

Add lost+found filesystem label to /var/log and /var/log/audit.

Signed-off-by Guido Trentalancia <[email protected]>
---
  policy/modules/kernel/files.fc |    6 ++++++
  1 file changed, 6 insertions(+)

--- refpolicy-25082012/policy/modules/kernel/files.fc 2012-08-25
17:52:10.037296340 +0200
+++ refpolicy-25082012-lost_found-fc/policy/modules/kernel/files.fc

2012-08-26 00:38:29.364804301 +0200

@@ -243,6 +243,12 @@ ifndef(distro_redhat',

/var/lock(/.*)? gen_context(system_u:object_r:var_lock_t,s0)

+/var/log/lost\+found -d
gen_context(system_u:object_r:lost_found_t,mls_systemhigh)
+/var/log/lost\+found/.* <<none>>
+
+/var/log/audit/lost\+found -d
gen_context(system_u:object_r:lost_found_t,mls_systemhigh)
+/var/log/audit/lost\+found/.* <<none>>
+
/var/lost\+found -d
gen_context(system_u:object_r:lost_found_t,mls_systemhigh)
/var/lost\+found/.* <<none>>

#1 lore raw

PATCH 1/1 : add lost+found filesystem labels to support NSA security guidelines

Quoted 24 lines · Guido Trentalancia

Add lost+found filesystem label to /var/log and /var/log/audit.

Signed-off-by Guido Trentalancia <[email protected]>
---
  policy/modules/kernel/files.fc |    6 ++++++
  1 file changed, 6 insertions(+)

--- refpolicy-25082012/policy/modules/kernel/files.fc 2012-08-25
17:52:10.037296340 +0200
+++ refpolicy-25082012-lost_found-fc/policy/modules/kernel/files.fc

2012-08-26 00:38:29.364804301 +0200
(quoted diff) +6 -0
@@ -243,6 +243,12 @@ ifndef(`distro_redhat',`
 
  /var/lock(/.*)?			gen_context(system_u:object_r:var_lock_t,s0)
 
+/var/log/lost\+found	-d 
 gen_context(system_u:object_r:lost_found_t,mls_systemhigh)
+/var/log/lost\+found/.*		<<none>>
+
+/var/log/audit/lost\+found	-d 
 gen_context(system_u:object_r:lost_found_t,mls_systemhigh)
+/var/log/audit/lost\+found/.*		<<none>>
+
  /var/lost\+found	-d
Quoted 2 lines

gen_context(system_u:object_r:lost_found_t,mls_systemhigh)
/var/lost\+found/.* <<none>>

Merged.

Signature · 3 lines
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
author
#2 lore raw

PATCH 1/1 : add lost+found filesystem labels to support NSA security guidelines

Quoted 16 lines · Christopher J. PeBenito
Quoted 15 lines · Guido Trentalancia

Add lost+found filesystem label to /var/log and /var/log/audit.

Signed-off-by Guido Trentalancia <[email protected]>
---
   policy/modules/kernel/files.fc |    6 ++++++
   1 file changed, 6 insertions(+)

--- refpolicy-25082012/policy/modules/kernel/files.fc 2012-08-25
17:52:10.037296340 +0200
+++ refpolicy-25082012-lost_found-fc/policy/modules/kernel/files.fc

2012-08-26 00:38:29.364804301 +0200
(quoted diff) +0 -0
@@ -243,6 +243,12 @@ ifndef(`distro_redhat',`
 
   /var/lock(/.*)?			gen_context(system_u:object_r:var_lock_t,s0)
Quoted 13 lines
Quoted 11 lines
(quoted diff) +6 -0
+/var/log/lost\+found	-d
 gen_context(system_u:object_r:lost_found_t,mls_systemhigh)
+/var/log/lost\+found/.*		<<none>>
+
+/var/log/audit/lost\+found	-d
 gen_context(system_u:object_r:lost_found_t,mls_systemhigh)
+/var/log/audit/lost\+found/.*		<<none>>
+
   /var/lost\+found	-d

gen_context(system_u:object_r:lost_found_t,mls_systemhigh)
/var/lost\+found/.* <<none>>

Merged.

Perhaps, it might be profitable to have such labels automatically and dynamically added to the policy upon filesystem mount by the means of code modifications ?

Just an idea...

Regards,

Guido