Properly label all the ssh host keys
PATCH 1/7 Properly label all the ssh host keys
From: Laurent Bigonville <[email protected]>
Be sure that we are labeling properly all ssh host keys even if new algorithms are added in the future.
--- policy/modules/services/ssh.fc | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
policy/modules/services/ssh.fc +1 -3
@@ -1,9 +1,7 @@ HOME_DIR/\.ssh(/.*)? gen_context(system_u:object_r:ssh_home_t,s0) /etc/ssh/primes -- gen_context(system_u:object_r:sshd_key_t,s0) -/etc/ssh/ssh_host_key -- gen_context(system_u:object_r:sshd_key_t,s0) -/etc/ssh/ssh_host_dsa_key -- gen_context(system_u:object_r:sshd_key_t,s0) -/etc/ssh/ssh_host_rsa_key -- gen_context(system_u:object_r:sshd_key_t,s0) +/etc/ssh/ssh_host.*_key -- gen_context(system_u:object_r:sshd_key_t,s0) /usr/bin/ssh -- gen_context(system_u:object_r:ssh_exec_t,s0) /usr/bin/ssh-agent -- gen_context(system_u:object_r:ssh_agent_exec_t,s0)
Signature · 1 line
1.7.10.4
PATCH 2/7 Allow udev_t domain to read files labeled as consolekit_var_run_t
From: Laurent Bigonville <[email protected]>
When the active session is changed, the udev-acl executable is called by ConsoleKit. It will then read the ConsoleKit database to figure out which is the active one.
--- policy/modules/system/udev.te | 4 ++++ 1 file changed, 4 insertions(+)
policy/modules/system/udev.te +4 -0
@@ -221,6 +221,10 @@ optional_policy(` ') optional_policy(` + consolekit_read_pid_files(udev_t) +') + +optional_policy(` cups_domtrans_config(udev_t) ')
Signature · 1 line
1.7.10.4
PATCH 2/7 Allow udev_t domain to read files labeled as consolekit_var_run_t
Quoted 14 lines · Laurent Bigonville
From: Laurent Bigonville <[email protected]>
When the active session is changed, the udev-acl executable is called by ConsoleKit. It will then read the ConsoleKit database to figure out which is the active one.
--- policy/modules/system/udev.te | 4 ++++ 1 file changed, 4 insertions(+)policy/modules/system/udev.te +0
-0
policy/modules/system/udev.te optional_policy(` · line 229
Quoted 9 lines
policy/modules/system/udev.te +4
-0@@ -221,6 +221,10 @@ optional_policy(` ') optional_policy(` + consolekit_read_pid_files(udev_t) +') + +optional_policy(` cups_domtrans_config(udev_t) ')
Merged.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 3/7 Label /var/run/shm as tmpfs_t
In reply to Laurent BigonvilleFrom: Laurent Bigonville <[email protected]>
In Debian, /dev/shm is a symlink to /var/run/shm. Label that mountpoint the same way.
--- policy/modules/kernel/filesystem.fc | 3 +++ 1 file changed, 3 insertions(+)
policy/modules/kernel/filesystem.fc +3 -0
@@ -14,3 +14,6 @@ # for systemd systems: /sys/fs/cgroup -d gen_context(system_u:object_r:cgroup_t,s0) /sys/fs/cgroup/.* <<none>> + +/var/run/shm -d gen_context(system_u:object_r:tmpfs_t,s0) +/var/run/shm/.* <<none>>
Signature · 1 line
1.7.10.4
PATCH 3/7 Label /var/run/shm as tmpfs_t
Quoted 13 lines · Laurent Bigonville
From: Laurent Bigonville <[email protected]>
In Debian,
/dev/shmis a symlink to/var/run/shm. Label that mountpoint the same way.--- policy/modules/kernel/filesystem.fc | 3 +++ 1 file changed, 3 insertions(+)policy/modules/kernel/filesystem.fc +0
-0
policy/modules/kernel/filesystem.fc line 19
Quoted 6 lines
policy/modules/kernel/filesystem.fc +3
-0@@ -14,3 +14,6 @@ # for systemd systems: /sys/fs/cgroup -d gen_context(system_u:object_r:cgroup_t,s0) /sys/fs/cgroup/.* <<none>> + +/var/run/shm -d gen_context(system_u:object_r:tmpfs_t,s0) +/var/run/shm/.* <<none>>
Wouldn't it make more sense to just have a file context substitution in the Debian policy?
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 3/7 Label /var/run/shm as tmpfs_t
Le Fri, 07 Dec 2012 00:13:03 -0500,
"Christopher J. PeBenito" <[email protected]> a ?crit :
Quoted 9 lines · Laurent Bigonville
Quoted 8 lines
From: Laurent Bigonville <[email protected]>
In Debian,
/dev/shmis a symlink to/var/run/shm. Label that mountpoint the same way.--- policy/modules/kernel/filesystem.fc | 3 +++ 1 file changed, 3 insertions(+)
Quoted 15 lines
Quoted 7 lines
(quoted diff) +0
-0b/policy/modules/kernel/filesystem.fc index cda5588..4da589c 100644
policy/modules/kernel/filesystem.fc +0
-0@@ -14,3 +14,6 @@ # for systemd systems: /sys/fs/cgroup -dQuoted 5 lines
gen_context(system_u:object_r:cgroup_t,s0)/sys/fs/cgroup/.*<<none>> +
+/var/run/shm -dgen_context(system_u:object_r:tmpfs_t,s0)
+/var/run/shm/.* <<none>>Wouldn't it make more sense to just have a file context substitution in the Debian policy?
For some reason it's not working. Maybe because /var/run is already a tmpfs? If you want I can give a patch that define this only for debian.
Laurent Bigonville
PATCH 3/7 Label /var/run/shm as tmpfs_t
Quoted 28 lines · Laurent Bigonville
Le Fri, 07 Dec 2012 00:13:03 -0500,
"Christopher J. PeBenito" <[email protected]> a ?crit :Quoted 9 lines · Laurent Bigonville
Quoted 8 lines
From: Laurent Bigonville <[email protected]>
In Debian,
/dev/shmis a symlink to/var/run/shm. Label that mountpoint the same way.--- policy/modules/kernel/filesystem.fc | 3 +++ 1 file changed, 3 insertions(+)Quoted 15 lines
Quoted 7 lines
(quoted diff) +0
-0b/policy/modules/kernel/filesystem.fc index cda5588..4da589c 100644
policy/modules/kernel/filesystem.fc +0
-0@@ -14,3 +14,6 @@ # for systemd systems: /sys/fs/cgroup -dQuoted 5 lines
gen_context(system_u:object_r:cgroup_t,s0)/sys/fs/cgroup/.*<<none>> +
+/var/run/shm -dgen_context(system_u:object_r:tmpfs_t,s0)
+/var/run/shm/.* <<none>>Wouldn't it make more sense to just have a file context substitution in the Debian policy?
Quoted 3 lines
For some reason it's not working. Maybe because
/var/runis already a tmpfs? If you want I can give a patch that define this only for debian.
I think it may be related to the fact that this tmpfs here is mounted with the rootcontext= option in debian
Quoted 5 lines
Laurent Bigonville
_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy
PATCH 4/7 authlogin.if: Add auth_create_pam_console_data_dirs and auth_pid_filetrans_pam_var_console interfaces
In reply to Laurent BigonvilleFrom: Laurent Bigonville <[email protected]>
On Debian /var/run/console directory might be created by consolekit, we need these new interfaces to achieve this.
--- policy/modules/system/authlogin.if | 50 ++++++++++++++++++++++++++++++++++++ 1 file changed, 50 insertions(+)
policy/modules/system/authlogin.if +50 -0
@@ -1102,6 +1102,25 @@ interface(`auth_list_pam_console_data',` ######################################## ## <summary> +## Create pam var console pid directories. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`auth_create_pam_console_data_dirs',` + gen_require(` + type pam_var_console_t; + ') + + files_search_pids($1) + allow $1 pam_var_console_t:dir create_dir_perms; +') + +######################################## +## <summary> ## Relabel pam_console data directories. ## </summary> ## <param name="domain">
@@ -1181,6 +1200,37 @@ interface(`auth_delete_pam_console_data',` ######################################## ## <summary> +## Create specified objects in +## pid directories with the pam var +## console pid file type using a +## file type transition. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +## <param name="object_class"> +## <summary> +## Class of the object being created. +## </summary> +## </param> +## <param name="name" optional="true"> +## <summary> +## The name of the object being created. +## </summary> +## </param> +# +interface(`auth_pid_filetrans_pam_var_console',` + gen_require(` + type pam_var_console_t; + ') + + files_pid_filetrans($1, pam_var_console_t, $2, $3) +') + +######################################## +## <summary> ## Read all directories on the filesystem, except ## login files and listed exceptions. ## </summary>
Signature · 1 line
1.7.10.4
PATCH 4/7 authlogin.if: Add auth_create_pam_console_data_dirs and auth_pid_filetrans_pam_var_console interfaces
Quoted 66 lines · Laurent Bigonville
From: Laurent Bigonville <[email protected]>
On Debian
/var/run/consoledirectory might be created by consolekit, we need these new interfaces to achieve this.--- policy/modules/system/authlogin.if | 50 ++++++++++++++++++++++++++++++++++++ 1 file changed, 50 insertions(+)policy/modules/system/authlogin.if +43
-0@@ -1102,6 +1102,25 @@ interface(`auth_list_pam_console_data',` ######################################## ## <summary> +## Create pam var console pid directories. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`auth_create_pam_console_data_dirs',` + gen_require(` + type pam_var_console_t; + ') + + files_search_pids($1) + allow $1 pam_var_console_t:dir create_dir_perms; +') + +######################################## +## <summary> ## Relabel pam_console data directories. ## </summary> ## <param name="domain">@@ -1181,6 +1200,37 @@ interface(`auth_delete_pam_console_data',` ######################################## ## <summary> +## Create specified objects in +## pid directories with the pam var +## console pid file type using a +## file type transition. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +## <param name="object_class"> +## <summary> +## Class of the object being created. +## </summary> +## </param> +## <param name="name" optional="true"> +## <summary> +## The name of the object being created. +## </summary> +## </param> +# +interface(`auth_pid_filetrans_pam_var_console',` + gen_require(` + type pam_var_console_t;
policy/modules/system/authlogin.if interface(`auth_delete_pam_console_data',` · line 1236
Quoted 10 lines
policy/modules/system/authlogin.if +7
-0+ ') + + files_pid_filetrans($1, pam_var_console_t, $2, $3) +') + +######################################## +## <summary> ## Read all directories on the filesystem, except ## login files and listed exceptions. ## </summary>>
Merged.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 5/7 init.if: Add init_daemon_run_file interface
In reply to Laurent BigonvilleFrom: Laurent Bigonville <[email protected]>
This is allowing initscripts to create pidfile and to let them transition to their context
--- policy/modules/system/init.if | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+)
policy/modules/system/init.if +27 -0
@@ -444,6 +444,33 @@ interface(`init_daemon_run_dir',` ######################################## ## <summary> +## Mark the file type as a pid file, allowing initrc_t +## to create it +## </summary> +## <param name="filetype"> +## <summary> +## Type to mark as a pid file +## </summary> +## </param> +## <param name="filename"> +## <summary> +## Filename of the file that the init script creates +## </summary> +## </param> +# +interface(`init_daemon_run_file',` + gen_require(` + attribute pidfile; + type initrc_t; + ') + + typeattribute $1 pidfile; + + files_pid_filetrans(initrc_t, $1, file, $2) +') + +######################################## +## <summary> ## Execute init (/sbin/init) with a domain transition. ## </summary> ## <param name="domain">
Signature · 1 line
1.7.10.4
PATCH 5/7 init.if: Add init_daemon_run_file interface
Quoted 30 lines · Laurent Bigonville
From: Laurent Bigonville <[email protected]>
This is allowing initscripts to create pidfile and to let them transition to their context
--- policy/modules/system/init.if | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+)policy/modules/system/init.if +14
-0@@ -444,6 +444,33 @@ interface(`init_daemon_run_dir',` ######################################## ## <summary> +## Mark the file type as a pid file, allowing initrc_t +## to create it +## </summary> +## <param name="filetype"> +## <summary> +## Type to mark as a pid file +## </summary> +## </param> +## <param name="filename"> +## <summary> +## Filename of the file that the init script creates +## </summary> +## </param> +#
policy/modules/system/init.if interface(`init_daemon_run_dir',` · line 470
Quoted 10 lines
policy/modules/system/init.if +10
-0+interface(`init_daemon_run_file',` + gen_require(` + attribute pidfile; + type initrc_t; + ') + + typeattribute $1 pidfile; + + files_pid_filetrans(initrc_t, $1, file, $2) +')
Better use:
## <param name="name" optional="true">
## <summary>
## The name of the object being created.
## </summary>
## </param>
#
instead of:
## <param name="filename">
## <summary>
## Filename of the file that the init script creates
## </summary>
## </param>
For consistency
Quoted 5 lines
policy/modules/system/init.if +2
-0+######################################## +## <summary> ## Execute init (/sbin/init) with a domain transition. ## </summary> ## <param name="domain">
PATCH v2 5/7 init.if: Add init_daemon_run_file interface
From: Laurent Bigonville <[email protected]>
This is allowing initscripts to create pidfile and to let them transition to their context
--- policy/modules/system/init.if | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+)
policy/modules/system/init.if +27 -0
@@ -444,6 +444,33 @@ interface(`init_daemon_run_dir',` ######################################## ## <summary> +## Mark the file type as a pid file, allowing initrc_t +## to create it +## </summary> +## <param name="filetype"> +## <summary> +## Type to mark as a pid file +## </summary> +## </param> +## <param name="name" optional="true"> +## <summary> +## The name of the object being created. +## </summary> +## </param> +# +interface(`init_daemon_run_file',` + gen_require(` + attribute pidfile; + type initrc_t; + ') + + typeattribute $1 pidfile; + + files_pid_filetrans(initrc_t, $1, file, $2) +') + +######################################## +## <summary> ## Execute init (/sbin/init) with a domain transition. ## </summary> ## <param name="domain">
Signature · 1 line
1.7.10.4
PATCH v2 5/7 init.if: Add init_daemon_run_file interface
Quoted 30 lines · Laurent Bigonville
From: Laurent Bigonville <[email protected]>
This is allowing initscripts to create pidfile and to let them transition to their context
--- policy/modules/system/init.if | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+)policy/modules/system/init.if +14
-0@@ -444,6 +444,33 @@ interface(`init_daemon_run_dir',` ######################################## ## <summary> +## Mark the file type as a pid file, allowing initrc_t +## to create it +## </summary> +## <param name="filetype"> +## <summary> +## Type to mark as a pid file +## </summary> +## </param> +## <param name="name" optional="true"> +## <summary> +## The name of the object being created. +## </summary> +## </param> +#
policy/modules/system/init.if interface(`init_daemon_run_dir',` · line 470
Quoted 10 lines
policy/modules/system/init.if +10
-0+interface(`init_daemon_run_file',` + gen_require(` + attribute pidfile; + type initrc_t; + ') + + typeattribute $1 pidfile; + + files_pid_filetrans(initrc_t, $1, file, $2) +')
pidfile isn't owned by this module. Additionally, I'm thinking that it would probably be better to generalize init_daemon_run_dir to take object classes as a parameter.... but I don't know what to call it.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 6/7 Label /etc/rc.d/init.d/x11-common as xdm_exec_t
In reply to Laurent BigonvilleFrom: Laurent Bigonville <[email protected]>
In Debian, this initscript is creating both /tmp/.X11-unix and /tmp/.ICE-unix. This allows the directory to transition to the context defined in the filecontext.
--- policy/modules/services/xserver.fc | 1 + 1 file changed, 1 insertion(+)
policy/modules/services/xserver.fc +1 -0
@@ -27,6 +27,7 @@ HOME_DIR/\.Xauthority.* -- gen_context(system_u:object_r:xauth_home_t,s0) /etc/kde[34]?/kdm/Xsession -- gen_context(system_u:object_r:xsession_exec_t,s0) /etc/kde[34]?/kdm/backgroundrc gen_context(system_u:object_r:xdm_var_run_t,s0) +/etc/rc\.d/init\.d/x11-common -- gen_context(system_u:object_r:xdm_exec_t,s0) /etc/rc\.d/init\.d/xfree86-common -- gen_context(system_u:object_r:xserver_exec_t,s0) /etc/X11/[wx]dm/Xreset.* -- gen_context(system_u:object_r:xsession_exec_t,s0)
Signature · 1 line
1.7.10.4
PATCH 6/7 Label /etc/rc.d/init.d/x11-common as xdm_exec_t
Quoted 14 lines · Laurent Bigonville
From: Laurent Bigonville <[email protected]>
In Debian, this initscript is creating both
/tmp/.X11-unixand/tmp/.ICE-unix. This allows the directory to transition to the context defined in the filecontext.--- policy/modules/services/xserver.fc | 1 + 1 file changed, 1 insertion(+)policy/modules/services/xserver.fc +0
-0
policy/modules/services/xserver.fc HOME_DIR/\.Xauthority.* -- gen_context(system_u:object_r:xauth_home_t,s0) · line 33
Quoted 7 lines
policy/modules/services/xserver.fc +1
-0@@ -27,6 +27,7 @@ HOME_DIR/\.Xauthority.* -- gen_context(system_u:object_r:xauth_home_t,s0) /etc/kde[34]?/kdm/Xsession -- gen_context(system_u:object_r:xsession_exec_t,s0) /etc/kde[34]?/kdm/backgroundrc gen_context(system_u:object_r:xdm_var_run_t,s0) +/etc/rc\.d/init\.d/x11-common -- gen_context(system_u:object_r:xdm_exec_t,s0) /etc/rc\.d/init\.d/xfree86-common -- gen_context(system_u:object_r:xserver_exec_t,s0) /etc/X11/[wx]dm/Xreset.* -- gen_context(system_u:object_r:xsession_exec_t,s0)
Merged.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 7/7 Drop /etc/rc.d/init.d/xfree86-common filecontext definition
In reply to Laurent BigonvilleFrom: Laurent Bigonville <[email protected]>
This only seems to be used in Debian and the file is gone since 2006
--- policy/modules/services/xserver.fc | 1 - 1 file changed, 1 deletion(-)
policy/modules/services/xserver.fc +0 -1
@@ -28,7 +28,6 @@ HOME_DIR/\.Xauthority.* -- gen_context(system_u:object_r:xauth_home_t,s0) /etc/kde[34]?/kdm/backgroundrc gen_context(system_u:object_r:xdm_var_run_t,s0) /etc/rc\.d/init\.d/x11-common -- gen_context(system_u:object_r:xdm_exec_t,s0) -/etc/rc\.d/init\.d/xfree86-common -- gen_context(system_u:object_r:xserver_exec_t,s0) /etc/X11/[wx]dm/Xreset.* -- gen_context(system_u:object_r:xsession_exec_t,s0) /etc/X11/[wxg]dm/Xsession -- gen_context(system_u:object_r:xsession_exec_t,s0)
Signature · 1 line
1.7.10.4
PATCH 7/7 Drop /etc/rc.d/init.d/xfree86-common filecontext definition
Quoted 12 lines · Laurent Bigonville
From: Laurent Bigonville <[email protected]>
This only seems to be used in Debian and the file is gone since 2006
--- policy/modules/services/xserver.fc | 1 - 1 file changed, 1 deletion(-)policy/modules/services/xserver.fc +0
-0
policy/modules/services/xserver.fc HOME_DIR/\.Xauthority.* -- gen_context(system_u:object_r:xauth_home_t,s0) · line 33
Quoted 7 lines
policy/modules/services/xserver.fc +0
-1@@ -28,7 +28,6 @@ HOME_DIR/\.Xauthority.* -- gen_context(system_u:object_r:xauth_home_t,s0) /etc/kde[34]?/kdm/backgroundrc gen_context(system_u:object_r:xdm_var_run_t,s0) /etc/rc\.d/init\.d/x11-common -- gen_context(system_u:object_r:xdm_exec_t,s0) -/etc/rc\.d/init\.d/xfree86-common -- gen_context(system_u:object_r:xserver_exec_t,s0) /etc/X11/[wx]dm/Xreset.* -- gen_context(system_u:object_r:xsession_exec_t,s0) /etc/X11/[wxg]dm/Xsession -- gen_context(system_u:object_r:xsession_exec_t,s0)
Merged.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 1/7 Properly label all the ssh host keys
In reply to Laurent BigonvilleQuoted 13 lines · Laurent Bigonville
From: Laurent Bigonville <[email protected]>
Be sure that we are labeling properly all ssh host keys even if new algorithms are added in the future.
--- policy/modules/services/ssh.fc | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)policy/modules/services/ssh.fc +0
-0
policy/modules/services/ssh.fc line 7
Quoted 10 lines
policy/modules/services/ssh.fc +1
-3@@ -1,9 +1,7 @@ HOME_DIR/\.ssh(/.*)? gen_context(system_u:object_r:ssh_home_t,s0) /etc/ssh/primes -- gen_context(system_u:object_r:sshd_key_t,s0) -/etc/ssh/ssh_host_key -- gen_context(system_u:object_r:sshd_key_t,s0) -/etc/ssh/ssh_host_dsa_key -- gen_context(system_u:object_r:sshd_key_t,s0) -/etc/ssh/ssh_host_rsa_key -- gen_context(system_u:object_r:sshd_key_t,s0) +/etc/ssh/ssh_host.*_key -- gen_context(system_u:object_r:sshd_key_t,s0) /usr/bin/ssh -- gen_context(system_u:object_r:ssh_exec_t,s0) /usr/bin/ssh-agent -- gen_context(system_u:object_r:ssh_agent_exec_t,s0)
Merged.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com