Small set of updates on non-contrib modules

PATCH New Sven Vermeulen 2 participants 14 messages Aug 17, 2013 – Aug 27, 2013

Share & tools

Sven Vermeulen

author

2013-08-17 18:51 UTC #0 lore raw

cover Small set of updates on non-contrib modules

Not sure about patch 5/7 if this is wanted/needed. It just seems like a good idea to combine the rights as the dontaudit interface itself is meant to, well, ignore certain behavior of applications. With the move to /sys/fs/selinux, these applications would otherwise also need the dontaudit rules against the sysfs parts, so I thought that making them part of the same dontaudit interface makes sense.

Sven Vermeulen (7):
Get grub2-install to work properly
Support /sys/devices/system/cpu/online
Mark f2fs as a xattr-enabled file system
The security_t file system can be at /sys/fs/selinux Dontaudit access on security_t file system at /sys/fs/selinux Support named file transition for fixed_disk_device_t Alsasound init script writes asound.state file

 policy/modules/admin/bootloader.fc  |  2 ++
 policy/modules/kernel/devices.fc    |  1 +
 policy/modules/kernel/devices.if    | 61 +++++++++++++++++++++++++++++++++++++
 policy/modules/kernel/devices.te    |  7 +++++
 policy/modules/kernel/domain.te     |  2 ++
 policy/modules/kernel/filesystem.te |  1 +
 policy/modules/kernel/selinux.if    |  8 +++++
 policy/modules/kernel/storage.if    |  7 ++++-
 policy/modules/system/init.te       |  4 +++
 9 files changed, 92 insertions(+), 1 deletion(-)

Signature · 1 line

1.8.1.5

Sven Vermeulen

author

2013-08-17 18:51 UTC #1 lore raw

PATCH 1/7 Get grub2-install to work properly

The grub2-install application runs a few grub2-* commands. Two of those, grub2-bios-setup and grub2-probe, need read/write access to the (fixed) disks.

Mark those two applications as bootloader_exec_t (as is the case with the "grub" legacy command in the past) allows the commands to continue.

Signed-off-by Sven Vermeulen <[email protected]>

---
 policy/modules/admin/bootloader.fc | 2 ++
 1 file changed, 2 insertions(+)

policy/modules/admin/bootloader.fc +2 -0

index 7a6f06f..2626ebf 100644
@@ -7,3 +7,5 @@
 /sbin/ybin.*		--	gen_context(system_u:object_r:bootloader_exec_t,s0)
 
 /usr/sbin/grub		--	gen_context(system_u:object_r:bootloader_exec_t,s0)
+/usr/sbin/grub2-bios-setup	--	gen_context(system_u:object_r:bootloader_exec_t,s0)
+/usr/sbin/grub2-probe	--	gen_context(system_u:object_r:bootloader_exec_t,s0)

Signature · 1 line

1.8.1.5

Christopher J. PeBenito

2013-08-26 12:39 UTC #2 lore raw

PATCH 1/7 Get grub2-install to work properly

Quoted 5 lines · Sven Vermeulen

The grub2-install application runs a few grub2-* commands. Two of those, grub2-bios-setup and grub2-probe, need read/write access to the (fixed) disks.
Mark those two applications as bootloader_exec_t (as is the case with the "grub" legacy command in the past) allows the commands to continue.

Merged.

Quoted 16 lines

Signed-off-by Sven Vermeulen <[email protected]>

---
 policy/modules/admin/bootloader.fc | 2 ++
 1 file changed, 2 insertions(+)

policy/modules/admin/bootloader.fc +2 -0

index 7a6f06f..2626ebf 100644
@@ -7,3 +7,5 @@
 /sbin/ybin.*		--	gen_context(system_u:object_r:bootloader_exec_t,s0)
 
 /usr/sbin/grub		--	gen_context(system_u:object_r:bootloader_exec_t,s0)
+/usr/sbin/grub2-bios-setup	--	gen_context(system_u:object_r:bootloader_exec_t,s0)
+/usr/sbin/grub2-probe	--	gen_context(system_u:object_r:bootloader_exec_t,s0)

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

Sven Vermeulen

author

2013-08-17 18:51 UTC #3 lore raw

PATCH 2/7 Support /sys/devices/system/cpu/online

In reply to Sven Vermeulen

In glibc, the get_nprocs method reads /sys/devices/system/cpu/online, so we need to grant most domains read access to this file. As we don't want them to have read access on sysfs_t by default, create a new type (cpu_online_t) and assign it to the file, and grant domains read access to the file.

This does require systems to relabel the file upon every boot, something distributions do in their bootup scripts, as /sys devices don't keep their context.

Signed-off-by Sven Vermeulen <[email protected]>

---
 policy/modules/kernel/devices.fc |  1 +
 policy/modules/kernel/devices.if | 25 +++++++++++++++++++++++++
 policy/modules/kernel/devices.te |  7 +++++++
 policy/modules/kernel/domain.te  |  2 ++
 4 files changed, 35 insertions(+)

policy/modules/kernel/devices.fc +1 -0

index b31c054..d6ebfcd 100644
@@ -199,6 +199,7 @@ ifdef(`distro_debian',`
 /lib/udev/devices/zero	-c	gen_context(system_u:object_r:zero_device_t,s0)
 
 /sys(/.*)?			gen_context(system_u:object_r:sysfs_t,s0)
+/sys/devices/system/cpu/online	--	gen_context(system_u:object_r:cpu_online_t,s0)
 
 ifdef(`distro_redhat',`
 # originally from named.fc

policy/modules/kernel/devices.if +25 -0

index 76f285e..49f0acb 100644
@@ -4836,6 +4836,31 @@ interface(`dev_create_zero_dev',`
 
 ########################################
 ## <summary>
+##	Read cpu online hardware state information
+## </summary>
+## <desc>
+##	<p>
+##	Allow the specified domain to read /sys/devices/system/cpu/online
+##	</p>
+## </desc>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`dev_read_cpu_online',`
+	gen_require(`
+		type cpu_online_t;
+	')
+
+	allow $1 cpu_online_t:file read_file_perms;
+
+	dev_search_sysfs($1)
+')
+
+########################################
+## <summary>
 ##	Unconfined access to devices.
 ## </summary>
 ## <param name="domain">

policy/modules/kernel/devices.te +7 -0

index 0b1a871..0d7790c 100644
@@ -60,6 +60,13 @@ type cpu_device_t;
 dev_node(cpu_device_t)
 
 #
+# /sys/devices/system/cpu/online device
+#
+type cpu_online_t;
+files_type(cpu_online_t)
+dev_associate_sysfs(cpu_online_t)
+
+#
 # Type for /dev/crash
 #
 type crash_device_t;

policy/modules/kernel/domain.te +2 -0

index cf04cb5..ea5cdee 100644
@@ -96,6 +96,8 @@ kernel_dontaudit_link_key(domain)
 # create child processes in the domain
 allow domain self:process { fork sigchld };
 
+# glibc get_nprocs requires read access to /sys/devices/system/cpu/online
+dev_read_cpu_online(domain)
 # Use trusted objects in /dev
 dev_rw_null(domain)
 dev_rw_zero(domain)

Signature · 1 line

1.8.1.5

Christopher J. PeBenito

2013-08-26 12:49 UTC #4 lore raw

PATCH 2/7 Support /sys/devices/system/cpu/online

Quoted 8 lines · Sven Vermeulen

In glibc, the get_nprocs method reads /sys/devices/system/cpu/online, so we need to grant most domains read access to this file. As we don't want them to have read access on sysfs_t by default, create a new type (cpu_online_t) and assign it to the file, and grant domains read access to the file.
This does require systems to relabel the file upon every boot, something distributions do in their bootup scripts, as /sys devices don't keep their context.

Adding permissions to all domains shouldn't be taken lightly, so I'll have to do some additional research.

Quoted 88 lines

Signed-off-by Sven Vermeulen <[email protected]>

---
 policy/modules/kernel/devices.fc |  1 +
 policy/modules/kernel/devices.if | 25 +++++++++++++++++++++++++
 policy/modules/kernel/devices.te |  7 +++++++
 policy/modules/kernel/domain.te  |  2 ++
 4 files changed, 35 insertions(+)

policy/modules/kernel/devices.fc +1 -0

index b31c054..d6ebfcd 100644
@@ -199,6 +199,7 @@ ifdef(`distro_debian',`
 /lib/udev/devices/zero	-c	gen_context(system_u:object_r:zero_device_t,s0)
 
 /sys(/.*)?			gen_context(system_u:object_r:sysfs_t,s0)
+/sys/devices/system/cpu/online	--	gen_context(system_u:object_r:cpu_online_t,s0)
 
 ifdef(`distro_redhat',`
 # originally from named.fc

policy/modules/kernel/devices.if +25 -0

index 76f285e..49f0acb 100644
@@ -4836,6 +4836,31 @@ interface(`dev_create_zero_dev',`
 
 ########################################
 ## <summary>
+##	Read cpu online hardware state information
+## </summary>
+## <desc>
+##	<p>
+##	Allow the specified domain to read /sys/devices/system/cpu/online
+##	</p>
+## </desc>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`dev_read_cpu_online',`
+	gen_require(`
+		type cpu_online_t;
+	')
+
+	allow $1 cpu_online_t:file read_file_perms;
+
+	dev_search_sysfs($1)
+')
+
+########################################
+## <summary>
 ##	Unconfined access to devices.
 ## </summary>
 ## <param name="domain">

policy/modules/kernel/devices.te +7 -0

index 0b1a871..0d7790c 100644
@@ -60,6 +60,13 @@ type cpu_device_t;
 dev_node(cpu_device_t)
 
 #
+# /sys/devices/system/cpu/online device
+#
+type cpu_online_t;
+files_type(cpu_online_t)
+dev_associate_sysfs(cpu_online_t)
+
+#
 # Type for /dev/crash
 #
 type crash_device_t;

policy/modules/kernel/domain.te +2 -0

index cf04cb5..ea5cdee 100644
@@ -96,6 +96,8 @@ kernel_dontaudit_link_key(domain)
 # create child processes in the domain
 allow domain self:process { fork sigchld };
 
+# glibc get_nprocs requires read access to /sys/devices/system/cpu/online
+dev_read_cpu_online(domain)
 # Use trusted objects in /dev
 dev_rw_null(domain)
 dev_rw_zero(domain)

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

Sven Vermeulen

author

2013-08-17 18:51 UTC #5 lore raw

PATCH 3/7 Mark f2fs as a xattr-enabled file system

In reply to Sven Vermeulen

Signed-off-by Sven Vermeulen <[email protected]>

---
 policy/modules/kernel/filesystem.te | 1 +
 1 file changed, 1 insertion(+)

policy/modules/kernel/filesystem.te +1 -0

index 1c66416..9949d77 100644
@@ -26,6 +26,7 @@ fs_use_xattr ext2 gen_context(system_u:object_r:fs_t,s0);
 fs_use_xattr ext3 gen_context(system_u:object_r:fs_t,s0);
 fs_use_xattr ext4 gen_context(system_u:object_r:fs_t,s0);
 fs_use_xattr ext4dev gen_context(system_u:object_r:fs_t,s0);
+fs_use_xattr f2fs gen_context(system_u:object_r:fs_t,s0);
 fs_use_xattr gfs gen_context(system_u:object_r:fs_t,s0);
 fs_use_xattr gfs2 gen_context(system_u:object_r:fs_t,s0);
 fs_use_xattr gpfs gen_context(system_u:object_r:fs_t,s0);

Signature · 1 line

1.8.1.5

Christopher J. PeBenito

2013-08-26 12:38 UTC #6 lore raw

PATCH 3/7 Mark f2fs as a xattr-enabled file system

Is this support upstreamed? I don't see it in my 3.10 kernel tree.

Quoted 18 lines · Sven Vermeulen

Signed-off-by Sven Vermeulen <[email protected]>

---
 policy/modules/kernel/filesystem.te | 1 +
 1 file changed, 1 insertion(+)

policy/modules/kernel/filesystem.te +1 -0

index 1c66416..9949d77 100644
@@ -26,6 +26,7 @@ fs_use_xattr ext2 gen_context(system_u:object_r:fs_t,s0);
 fs_use_xattr ext3 gen_context(system_u:object_r:fs_t,s0);
 fs_use_xattr ext4 gen_context(system_u:object_r:fs_t,s0);
 fs_use_xattr ext4dev gen_context(system_u:object_r:fs_t,s0);
+fs_use_xattr f2fs gen_context(system_u:object_r:fs_t,s0);
 fs_use_xattr gfs gen_context(system_u:object_r:fs_t,s0);
 fs_use_xattr gfs2 gen_context(system_u:object_r:fs_t,s0);
 fs_use_xattr gpfs gen_context(system_u:object_r:fs_t,s0);

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

Sven Vermeulen

author

2013-08-17 18:51 UTC #7 lore raw

PATCH 4/7 The security_t file system can be at /sys/fs/selinux

In reply to Sven Vermeulen

Because it is no longer a top-level file system, we need to enhance some of the interfaces with the appropriate rights towards sysfs_t.

First set to allow getattr rights on the file system, which now also means getattr on the sysfs_t file system as well as search privileges in sysfs_t.

Signed-off-by Sven Vermeulen <[email protected]>

---
 policy/modules/kernel/devices.if | 18 ++++++++++++++++++
 policy/modules/kernel/selinux.if |  4 ++++
 2 files changed, 22 insertions(+)

policy/modules/kernel/devices.if +18 -0

index 49f0acb..a0a2a0d 100644
@@ -3855,6 +3855,24 @@ interface(`dev_getattr_sysfs_dirs',`
 
 ########################################
 ## <summary>
+##	Get the attributes of sysfs filesystem
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`dev_getattr_sysfs_fs',`
+	gen_require(`
+		type sysfs_t;
+	')
+
+	allow $1 sysfs_t:filesystem getattr;
+')
+
+########################################
+## <summary>
 ##	Search the sysfs directories.
 ## </summary>
 ## <param name="domain">

policy/modules/kernel/selinux.if +4 -0

index 81440c5..9623a80 100644
@@ -63,6 +63,10 @@ interface(`selinux_get_fs_mount',`
 	# (/selinux) is already a selinuxfs
 	allow $1 security_t:filesystem getattr;
 
+	# Same for /sys/fs/selinux
+	dev_getattr_sysfs_fs($1)
+	dev_search_sysfs($1)
+
 	# read /proc/filesystems to see if selinuxfs is supported
 	# then read /proc/self/mount to see where selinuxfs is mounted
 	kernel_read_system_state($1)

Signature · 1 line

1.8.1.5

Sven Vermeulen

author

2013-08-17 18:51 UTC #8 lore raw

PATCH 5/7 Dontaudit access on security_t file system at /sys/fs/selinux

In reply to Sven Vermeulen

Second part of the support of security_t under /sys/fs/selinux - when asked not to audit getting attributes on the selinux file system, have this propagate to the sysfs parts as well.

Signed-off-by Sven Vermeulen <[email protected]>

---
 policy/modules/kernel/devices.if | 18 ++++++++++++++++++
 policy/modules/kernel/selinux.if |  4 ++++
 2 files changed, 22 insertions(+)

policy/modules/kernel/devices.if +18 -0

index a0a2a0d..2a4a3ca 100644
@@ -3871,6 +3871,24 @@ interface(`dev_getattr_sysfs_fs',`
 	allow $1 sysfs_t:filesystem getattr;
 ')
 
+#######################################
+## <summary>
+##	Do not audit getting the attributes of sysfs filesystem
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to dontaudit access from
+##	</summary>
+## </param>
+#
+interface(`dev_dontaudit_getattr_sysfs_fs',`
+	gen_require(`
+		type sysfs_t;
+	')
+
+	dontaudit $1 sysfs_t:filesystem getattr;
+')
+
 ########################################
 ## <summary>
 ##	Search the sysfs directories.

policy/modules/kernel/selinux.if +4 -0

index 9623a80..a62ac8f 100644
@@ -93,6 +93,10 @@ interface(`selinux_dontaudit_get_fs_mount',`
 	# (/selinux) is already a selinuxfs
 	dontaudit $1 security_t:filesystem getattr;
 
+	# Same for /sys/fs/selinux
+	dev_dontaudit_getattr_sysfs_fs($1)
+	dev_dontaudit_search_sysfs($1)
+
 	# read /proc/filesystems to see if selinuxfs is supported
 	# then read /proc/self/mount to see where selinuxfs is mounted
 	kernel_dontaudit_read_system_state($1)

Signature · 1 line

1.8.1.5

Sven Vermeulen

author

2013-08-17 18:51 UTC #9 lore raw

PATCH 6/7 Support named file transition for fixed_disk_device_t

In reply to Sven Vermeulen

Signed-off-by Sven Vermeulen <[email protected]>

---
 policy/modules/kernel/storage.if | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

policy/modules/kernel/storage.if +6 -1

index 1700ef2..64c4cd0 100644
@@ -260,13 +260,18 @@ interface(`storage_manage_fixed_disk',`
 ##	Domain allowed access.
 ##	</summary>
 ## </param>
+## <param name="filename" optional="true">
+##	<summary>
+##	Optional filename of the block device to be created
+##	</summary>
+## </param>
 #
 interface(`storage_dev_filetrans_fixed_disk',`
 	gen_require(`
 		type fixed_disk_device_t;
 	')
 
-	dev_filetrans($1, fixed_disk_device_t, blk_file)
+	dev_filetrans($1, fixed_disk_device_t, blk_file, $2)
 ')
 
 ########################################

Signature · 1 line

1.8.1.5

Christopher J. PeBenito

2013-08-26 12:51 UTC #10 lore raw

PATCH 6/7 Support named file transition for fixed_disk_device_t

Quoted 20 lines · Sven Vermeulen

Signed-off-by Sven Vermeulen <[email protected]>

---
 policy/modules/kernel/storage.if | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

policy/modules/kernel/storage.if +5 -0

index 1700ef2..64c4cd0 100644
@@ -260,13 +260,18 @@ interface(`storage_manage_fixed_disk',`
 ##	Domain allowed access.
 ##	</summary>
 ## </param>
+## <param name="filename" optional="true">
+##	<summary>
+##	Optional filename of the block device to be created
+##	</summary>
+## </param>
 #

policy/modules/kernel/storage.if interface(`storage_manage_fixed_disk',` · line 277

Quoted 10 lines

policy/modules/kernel/storage.if +1 -1

 interface(`storage_dev_filetrans_fixed_disk',`
 	gen_require(`
 		type fixed_disk_device_t;
 	')
 
-	dev_filetrans($1, fixed_disk_device_t, blk_file)
+	dev_filetrans($1, fixed_disk_device_t, blk_file, $2)
 ')
 
 ########################################

Merged.

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

Sven Vermeulen

author

2013-08-17 18:51 UTC #11 lore raw

PATCH 7/7 Alsasound init script writes asound.state file

In reply to Sven Vermeulen

The alsasound init script writes updates into alsa state files, such as /var/lib/alsa/asound.state (for storing the ALSA mixer levels at shutdown).

Signed-off-by Sven Vermeulen <[email protected]>

---
 policy/modules/system/init.te | 4 ++++
 1 file changed, 4 insertions(+)

policy/modules/system/init.te +4 -0

index a97372a..08dd000 100644
@@ -578,6 +578,10 @@ ifdef(`distro_suse',`
 ')
 
 optional_policy(`
+	alsa_write_lib(initrc_t)
+')
+
+optional_policy(`
 	amavis_search_lib(initrc_t)
 	amavis_setattr_pid_files(initrc_t)
 ')

Signature · 1 line

1.8.1.5

Christopher J. PeBenito

2013-08-26 12:57 UTC #12 lore raw

PATCH 7/7 Alsasound init script writes asound.state file

Quoted 13 lines · Sven Vermeulen

The alsasound init script writes updates into alsa state files, such as /var/lib/alsa/asound.state (for storing the ALSA mixer levels at shutdown).
Signed-off-by Sven Vermeulen <[email protected]>
---
 policy/modules/system/init.te | 4 ++++
 1 file changed, 4 insertions(+)
policy/modules/system/init.te +0 -0
index a97372a..08dd000 100644

policy/modules/system/init.te ifdef(`distro_suse',` · line 587

Quoted 10 lines

policy/modules/system/init.te +4 -0

@@ -578,6 +578,10 @@ ifdef(`distro_suse',`
 ')
 
 optional_policy(`
+	alsa_write_lib(initrc_t)
+')
+
+optional_policy(`
 	amavis_search_lib(initrc_t)
 	amavis_setattr_pid_files(initrc_t)
 ')

Shouldn't this be handled by alsa_t?

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

Sven Vermeulen

author

2013-08-27 10:42 UTC #13 lore raw

PATCH 7/7 Alsasound init script writes asound.state file

Quoted 7 lines · Christopher J. PeBenito

Quoted 7 lines
policy/modules/system/init.te +0 -0
index a97372a..08dd000 100644
@@ -578,6 +578,10 @@ ifdef(`distro_suse',`
 ')
 

Quoted 11 lines

policy/modules/system/init.te ifdef(`distro_suse',` · line 587
Quoted 8 lines
policy/modules/system/init.te +4 -0
 optional_policy(`
+     alsa_write_lib(initrc_t)
+')
+
+optional_policy(`
      amavis_search_lib(initrc_t)
      amavis_setattr_pid_files(initrc_t)
 ')
Shouldn't this be handled by alsa_t?

It is the /etc/init.d/alsasound init script itself that is writing into /var/lib/alsa, for instance:

        for ossfile in /proc/asound/card*/pcm*/oss; do
                [ -e "${ossfile}" ] || continue
                local device=${ossfile##/proc/asound/} ; device=${device%%/oss}
                device="$(echo "${device}" | sed -e 's,/,_,g')"
                mkdir -p "${alsastatedir}/oss/"
                cp "${ossfile}" "${alsastatedir}/oss/${device}"
        done

Here, ${alsastatedir} = /var/lib/alsa.

It does seem however that the asound.state itself is handled by alsactl (and thus through alsa_t). Shall I update the description to explain that it is for restoring OSS state information instead?

Wkr,
Sven Vermeulen