Small set of updates
v2 cover Small set of updates
This patchset contains a few smaller updates on the SELinux policies.
Changes since v1
----------------
- Drop ifdef in file context (not needed)
- Remove redundant call to files_rw_var_lib_dirs()
- Drop udev changes
Sven Vermeulen (4):
Puppet uses mount output for verification
Allow syslogd to create /var/lib/syslog and
/var/lib/misc/syslog-ng.persist
Gentoo's openrc does not require initrc_exec_t for runscripts anymore Allow init scripts to read courier configuration
policy/modules/system/init.fc | 4 ---- policy/modules/system/init.te | 4 ++++ policy/modules/system/logging.fc | 2 ++ policy/modules/system/logging.te | 1 + policy/modules/system/mount.te | 4 ++++ 5 files changed, 11 insertions(+), 4 deletions(-)
Signature · 1 line
1.7.8.6
PATCH v2 1/4 Puppet uses mount output for verification
Puppet calls mount to obtain the list of mounted file systems, redirecting its output to a temporary file (labeled puppet_tmp_t). This allows the mount domain to write to this resource.
--- policy/modules/system/mount.te | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-)
policy/modules/system/mount.te +4 -0
@@ -193,6 +193,10 @@ optional_policy(` ') ') +optional_policy(` + puppet_rw_tmp(mount_t) +') + # for kernel package installation optional_policy(` rpm_rw_pipes(mount_t)
Signature · 1 line
1.7.8.6
PATCH v2 2/4 Allow syslogd to create /var/lib/syslog and /var/lib/misc/syslog-ng.persist
In reply to Sven VermeulenIf the /var/lib/syslog directory does not exist, then syslog-ng (running in syslogd_t) will attempt to create the directory.
Allow the syslogd_t domain to create the directory, and use an automatic file transition towards syslogd_var_lib_t.
Also, the syslog-ng daemon uses a persistence file in /var/lib/misc/syslog-ng.persist (and .persist- if it suspects a collision). As /var/lib/misc is still a generic var_lib_t, we have the syslogd_t daemon write its files as syslogd_var_lib_t therein.
--- policy/modules/system/logging.fc | 2 ++ policy/modules/system/logging.te | 1 + 2 files changed, 3 insertions(+), 0 deletions(-)
policy/modules/system/logging.fc +2 -0
@@ -24,6 +24,7 @@ /usr/sbin/syslog-ng -- gen_context(system_u:object_r:syslogd_exec_t,s0) /usr/sbin/syslogd -- gen_context(system_u:object_r:syslogd_exec_t,s0) +/var/lib/misc/syslog-ng.persist-? -- gen_context(system_u:object_r:syslogd_var_lib_t,s0) /var/lib/syslog-ng(/.*)? gen_context(system_u:object_r:syslogd_var_lib_t,s0) /var/lib/r?syslog(/.*)? gen_context(system_u:object_r:syslogd_var_lib_t,s0) /var/lib/syslog-ng.persist -- gen_context(system_u:object_r:syslogd_var_lib_t,s0)
@@ -32,6 +33,7 @@ ifdef(`distro_suse', ` /var/lib/stunnel/dev/log -s gen_context(system_u:object_r:devlog_t,s0) ') + /var/axfrdns/log/main(/.*)? gen_context(system_u:object_r:var_log_t,s0) /var/dnscache/log/main(/.*)? gen_context(system_u:object_r:var_log_t,s0) /var/cfengine/outputs(/.*)? gen_context(system_u:object_r:var_log_t,s0)
policy/modules/system/logging.te +1 -0
@@ -439,6 +439,7 @@ files_read_etc_runtime_files(syslogd_t) # /initrd is not umounted before minilog starts files_dontaudit_search_isid_type_dirs(syslogd_t) files_read_kernel_symbol_table(syslogd_t) +files_var_lib_filetrans(syslogd_t, syslogd_var_lib_t, { file dir }) fs_getattr_all_fs(syslogd_t) fs_search_auto_mountpoints(syslogd_t)
Signature · 1 line
1.7.8.6
PATCH v2 2/4 Allow syslogd to create /var/lib/syslog and /var/lib/misc/syslog-ng.persist
Quoted 4 lines · Sven Vermeulen
If the
/var/lib/syslogdirectory does not exist, then syslog-ng (running insyslogd_t) will attempt to create the directory.+files_var_lib_filetrans(syslogd_t,
syslogd_var_lib_t, { file dir })
Why file trans on a file?
PATCH v2 2/4 Allow syslogd to create /var/lib/syslog and /var/lib/misc/syslog-ng.persist
Quoted 7 lines · Dominick Grift
Quoted 4 lines · Sven Vermeulen
If the
/var/lib/syslogdirectory does not exist, then syslog-ng (running insyslogd_t) will attempt to create the directory.+files_var_lib_filetrans(syslogd_t,
syslogd_var_lib_t, { file dir })Why file trans on a file?
You asked that the previous time as well (at least you're consistent ;-) and I hoped a bit that the commit information (and the mail reply) was sufficient.
The file transition is for /var/lib/misc/syslog-ng.persist (and /var/lib/misc/syslog-ng.persist-) as the /var/lib/misc location itself is still var_lib_t.
Wkr,
Sven Vermeulen
PATCH v2 2/4 Allow syslogd to create /var/lib/syslog and /var/lib/misc/syslog-ng.persist
Quoted 9 lines · Sven Vermeulen
Quoted 7 lines · Dominick Grift
Quoted 4 lines · Sven Vermeulen
If the
/var/lib/syslogdirectory does not exist, then syslog-ng (running insyslogd_t) will attempt to create the directory.+files_var_lib_filetrans(syslogd_t,
syslogd_var_lib_t, { file dir })Why file trans on a file?
Quoted 7 lines
You asked that the previous time as well (at least you're consistent ;-) and I hoped a bit that the commit information (and the mail reply) was sufficient.
The file transition is for
/var/lib/misc/syslog-ng.persist(and/var/lib/misc/syslog-ng.persist-) as the/var/lib/misclocation itself is stillvar_lib_t.
ok, that explains it. It was just a question :)
Quoted 6 lines
Wkr,
Sven Vermeulen
_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy
PATCH v2 2/4 Allow syslogd to create /var/lib/syslog and /var/lib/misc/syslog-ng.persist
In reply to Sven Vermeulen-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Quoted 13 lines · Sven Vermeulen
Quoted 7 lines · Dominick Grift
Quoted 4 lines · Sven Vermeulen
If the
/var/lib/syslogdirectory does not exist, then syslog-ng (running insyslogd_t) will attempt to create the directory.+files_var_lib_filetrans(syslogd_t,
syslogd_var_lib_t, { file dir })Why file trans on a file?
You asked that the previous time as well (at least you're consistent ;-) and I hoped a bit that the commit information (and the mail reply) was sufficient.
Quoted 8 lines
The file transition is for
/var/lib/misc/syslog-ng.persist(and/var/lib/misc/syslog-ng.persist-) as the/var/lib/misclocation itself is stillvar_lib_t.Wkr, Sven Vermeulen _______________________________________________ refpolicy mailing list refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy
/var/lib/misc should just die a horrible death. /var/lib itself is misc. syslog should store its content under /var/lib/syslog.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://www.enigmail.net/
iEYEARECAAYFAlBI+2YACgkQrlYvE4MpobOWeACcCXEHPxEf97w4i3MbYw+yb5aw q3IAoNeTPB6MFENf0kOtlAbk3LXQCoox
=40Ns
-----END PGP SIGNATURE-----
PATCH v2 2/4 Allow syslogd to create /var/lib/syslog and /var/lib/misc/syslog-ng.persist
In reply to Sven Vermeulenpolicy/modules/system/logging.fc ifdef(`distro_suse', ` · line 39
Quoted 12 lines · Sven Vermeulen
policy/modules/system/logging.fc +1
-0@@ -32,6 +33,7 @@ ifdef(`distro_suse', ` /var/lib/stunnel/dev/log -s gen_context(system_u:object_r:devlog_t,s0) ') + /var/axfrdns/log/main(/.*)? gen_context(system_u:object_r:var_log_t,s0) /var/dnscache/log/main(/.*)? gen_context(system_u:object_r:var_log_t,s0) /var/cfengine/outputs(/.*)? gen_context(system_u:object_r:var_log_t,s0)
Unnecessary whitespace change.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH v2 3/4 Gentoo's openrc does not require initrc_exec_t for runscripts anymore
In reply to Sven VermeulenThe Gentoo-specific runscripts in /sbin should not be marked as initrc_exec_t anymore (just bin_t).
--- policy/modules/system/init.fc | 4 ---- 1 files changed, 0 insertions(+), 4 deletions(-)
policy/modules/system/init.fc +0 -4
@@ -35,10 +35,6 @@ ifdef(`distro_gentoo', ` ifdef(`distro_gentoo', ` /sbin/rc -- gen_context(system_u:object_r:rc_exec_t,s0) -/sbin/runscript -- gen_context(system_u:object_r:initrc_exec_t,s0) -/sbin/runscript\.sh -- gen_context(system_u:object_r:initrc_exec_t,s0) -/sbin/runsvcscript\.sh -- gen_context(system_u:object_r:initrc_exec_t,s0) -/sbin/svcinit -- gen_context(system_u:object_r:initrc_exec_t,s0) ') #
Signature · 1 line
1.7.8.6
PATCH v2 4/4 Allow init scripts to read courier configuration
In reply to Sven VermeulenThe courier-imap and courier-pop3 daemons are started by sourcing their configuration files, and then invoking the daemons using the proper options. If this is done through a specialized script, then init only needs to call this script (where a proper transition occurs) but if the init script itself does this, it needs to be able to read the configuration files.
--- policy/modules/system/init.te | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-)
policy/modules/system/init.te +4 -0
@@ -613,6 +613,10 @@ optional_policy(` ') optional_policy(` + courier_read_config(initrc_t) +') + +optional_policy(` cpucontrol_stub(initrc_t) dev_getattr_cpu_dev(initrc_t) ')
Signature · 1 line
1.7.8.6