Changes to the miscfiles policy module

PATCH New Dominick Grift 2 participants 7 messages Oct 5, 2012 – Oct 19, 2012

lore

Share & tools

lore

Dominick Grift

author

2012-10-05 12:56 UTC #0 lore raw

PATCH 1/1 Changes to the miscfiles policy module

The file context for /var/cache/man will be handled by mandb

Change various miscfiles man interfaces to include relevant mandb interface calls

Signed-off-by Dominick Grift <[email protected]>

policy/modules/system/miscfiles.fc +0 -1

index 9116567..016974b 100644
@@ -77,7 +77,6 @@
 
 /var/cache/fontconfig(/.*)?	gen_context(system_u:object_r:fonts_cache_t,s0)
 /var/cache/fonts(/.*)?		gen_context(system_u:object_r:tetex_data_t,s0)
-/var/cache/man(/.*)?		gen_context(system_u:object_r:man_t,s0)
 
 /var/named/chroot/etc/pki(/.*)? gen_context(system_u:object_r:cert_t,s0)

policy/modules/system/miscfiles.if +16 -0

index 926ba65..518f940 100644
@@ -491,6 +491,10 @@
 
 	allow $1 man_t:dir search_dir_perms;
 	files_search_usr($1)
+
+	optional_policy(`
+		mandb_search_cache($1)
+	')
 ')
 
 ########################################

@@ -531,6 +535,10 @@
 	allow $1 man_t:dir list_dir_perms;
 	read_files_pattern($1, man_t, man_t)
 	read_lnk_files_pattern($1, man_t, man_t)
+
+	optional_policy(`
+		mandb_read_cache_content($1)
+	')
 ')
 
 ########################################

@@ -557,6 +565,10 @@
 	delete_dirs_pattern($1, man_t, man_t)
 	delete_files_pattern($1, man_t, man_t)
 	delete_lnk_files_pattern($1, man_t, man_t)
+
+	optional_policy(`
+		mandb_delete_cache_content($1)
+	')
 ')
 
 ########################################

@@ -578,6 +590,10 @@
 	manage_dirs_pattern($1, man_t, man_t)
 	manage_files_pattern($1, man_t, man_t)
 	read_lnk_files_pattern($1, man_t, man_t)
+
+	optional_policy(`
+		mandb_manage_cache_content($1)
+	')
 ')
 
 ########################################

Christopher J. PeBenito

2012-10-09 14:14 UTC #1 lore raw

PATCH 1/1 Changes to the miscfiles policy module

Quoted 4 lines · Dominick Grift

The file context for /var/cache/man will be handled by mandb
Change various miscfiles man interfaces to include relevant mandb interface calls

I'm not sure that this is the right way to do. If you have miscfiles and not mandb, then you have a mislabeled /var/cache/man. I looked at your mandb.fc, and the entrypoint looks like a script; what is actually running? makewhatis?

Quoted 66 lines

Signed-off-by Dominick Grift <[email protected]>

policy/modules/system/miscfiles.fc +0 -1

index 9116567..016974b 100644
@@ -77,7 +77,6 @@
 
 /var/cache/fontconfig(/.*)?	gen_context(system_u:object_r:fonts_cache_t,s0)
 /var/cache/fonts(/.*)?		gen_context(system_u:object_r:tetex_data_t,s0)
-/var/cache/man(/.*)?		gen_context(system_u:object_r:man_t,s0)
 
 /var/named/chroot/etc/pki(/.*)? gen_context(system_u:object_r:cert_t,s0)

policy/modules/system/miscfiles.if +16 -0

index 926ba65..518f940 100644
@@ -491,6 +491,10 @@
 
 	allow $1 man_t:dir search_dir_perms;
 	files_search_usr($1)
+
+	optional_policy(`
+		mandb_search_cache($1)
+	')
 ')
 
 ########################################

@@ -531,6 +535,10 @@
 	allow $1 man_t:dir list_dir_perms;
 	read_files_pattern($1, man_t, man_t)
 	read_lnk_files_pattern($1, man_t, man_t)
+
+	optional_policy(`
+		mandb_read_cache_content($1)
+	')
 ')
 
 ########################################

@@ -557,6 +565,10 @@
 	delete_dirs_pattern($1, man_t, man_t)
 	delete_files_pattern($1, man_t, man_t)
 	delete_lnk_files_pattern($1, man_t, man_t)
+
+	optional_policy(`
+		mandb_delete_cache_content($1)
+	')
 ')
 
 ########################################

@@ -578,6 +590,10 @@
 	manage_dirs_pattern($1, man_t, man_t)
 	manage_files_pattern($1, man_t, man_t)
 	read_lnk_files_pattern($1, man_t, man_t)
+
+	optional_policy(`
+		mandb_manage_cache_content($1)
+	')
 ')
 
 ########################################

_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

Dominick Grift

author

2012-10-09 14:18 UTC #2 lore raw

PATCH 1/1 Changes to the miscfiles policy module

Quoted 7 lines · Christopher J. PeBenito

Quoted 4 lines · Dominick Grift
The file context for /var/cache/man will be handled by mandb
Change various miscfiles man interfaces to include relevant mandb interface calls
I'm not sure that this is the right way to do. If you have miscfiles and not mandb, then you have a mislabeled /var/cache/man. I looked at your mandb.fc, and the entrypoint looks like a script; what is actually running? makewhatis?

mandb owns and installs /var/cache/man

# yum whatprovides /var/cache/man
Loaded plugins: langpacks, presto, refresh-packagekit
rpmfusion-free-updates/filelists_db
| 136 kB     00:00     
rpmfusion-nonfree-updates/filelists_db
|  72 kB     00:00     
man-db-2.6.0.2-6.fc17.x86_64 : Tools for searching and reading man pages
Repo        : fedora
Matched from:
Filename    : /var/cache/man

Dominick Grift

author

2012-10-09 14:20 UTC #3 lore raw

PATCH 1/1 Changes to the miscfiles policy module

Quoted 10 lines · Dominick Grift

Quoted 7 lines · Christopher J. PeBenito
Quoted 4 lines · Dominick Grift
The file context for /var/cache/man will be handled by mandb
Change various miscfiles man interfaces to include relevant mandb interface calls
I'm not sure that this is the right way to do. If you have miscfiles and not mandb, then you have a mislabeled /var/cache/man. I looked at your mandb.fc, and the entrypoint looks like a script; what is actually running? makewhatis?

It's a system cronjob that runs daily

Dominick Grift

author

2012-10-09 14:38 UTC #4 lore raw

PATCH 1/1 Changes to the miscfiles policy module

In reply to Christopher J. PeBenito

Quoted 8 lines · Christopher J. PeBenito

Quoted 4 lines · Dominick Grift
The file context for /var/cache/man will be handled by mandb
Change various miscfiles man interfaces to include relevant mandb interface calls
I'm not sure that this is the right way to do. If you have miscfiles and not mandb, then you have a mislabeled /var/cache/man. I looked at your mandb.fc, and the entrypoint looks like a script; what is actually running? makewhatis?

Further explained

/etc/cron.daily/man-db.cron
/etc/man_db.conf
/etc/sysconfig/man-db
/usr/bin/apropos
/usr/bin/catman
/usr/bin/lexgrog
/usr/bin/man
/usr/bin/mandb
/usr/bin/manpath
/usr/bin/whatis
...
/var/cache/man

That is part of the list of files installed by man-db

Fedora labels /usr/bin/mandb with the mandb executable type and makes that a cron system entry

In refpolicy however i label the /etc/cron.daily/man-db.cron so that /usr/bin/mandb stays bin_t.

Then i have a mandb_run and mandb_admin to allow privi users to run the script in the privileged domain

This is the content of the script:

#! /bin/bash

if [ -e /etc/sysconfig/man-db ]; then
. /etc/sysconfig/man-db
fi

if [ "$CRON" = "no" ]; then
exit 0
fi

renice +19 -p $$ >/dev/null 2>&1
ionice -c3 -p $$ >/dev/null 2>&1

LOCKFILE=/var/lock/man-db.lock

# the lockfile is not meant to be perfect, it's just in case the
# two man-db cron scripts get run close to each other to keep
# them from stepping on each other's toes.  The worst that will
# happen is that they will temporarily corrupt the database
[ -f $LOCKFILE ] && exit 0

trap "{ rm -f $LOCKFILE ; exit 0; }" EXIT
touch $LOCKFILE

# create/update the mandb database
mandb $OPTS

exit 0

Dominick Grift

author

2012-10-09 14:57 UTC #5 lore raw

PATCH 1/1 Changes to the miscfiles policy module

In reply to Christopher J. PeBenito

Quoted 7 lines · Christopher J. PeBenito

Quoted 4 lines · Dominick Grift
The file context for /var/cache/man will be handled by mandb
Change various miscfiles man interfaces to include relevant mandb interface calls
I'm not sure that this is the right way to do. If you have miscfiles and not mandb, then you have a mislabeled /var/cache/man. I looked at your mandb.fc, and the entrypoint looks like a script; what is actually running? makewhatis?

Ok how about we require mandb module by the miscfiles module instead?

I can remove the optional(`')

That way one cannot have the misfiles module without the mandb module

Christopher J. PeBenito

2012-10-19 12:08 UTC #6 lore raw

PATCH 1/1 Changes to the miscfiles policy module

Quoted 7 lines · Dominick Grift

Quoted 6 lines · Christopher J. PeBenito
Quoted 4 lines · Dominick Grift
The file context for /var/cache/man will be handled by mandb
Change various miscfiles man interfaces to include relevant mandb interface calls

Quoted 7 lines

Quoted 1 line
I'm not sure that this is the right way to do. If you have miscfiles and not mandb, then you have a mislabeled /var/cache/man. I looked at your mandb.fc, and the entrypoint looks like a script; what is actually running? makewhatis?
Ok how about we require mandb module by the miscfiles module instead?
I can remove the optional(`')
That way one cannot have the misfiles module without the mandb module

No, modules can't unconditionally depend on modules at higher layers.

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com