add module for the entropy key daemon
PATCH 1/1 add module for the entropy key daemon
---
policy module for http://www.entropykey.co.uk/download/
gentoo package name: app-crypt/ekeyd
ekeyd.fc | 12 ++++++++++ ekeyd.if | 45 +++++++++++++++++++++++++++++++++++ ekeyd.te | 82 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 139 insertions(+) create mode 100644 ekeyd.fc create mode 100644 ekeyd.if create mode 100644 ekeyd.te
ekeyd.fc new file +12 -0
@@ -0,0 +1,12 @@ + +/etc/entropykey(/.*)? gen_context(system_u:object_r:ekey_etc_t,s0) + +/usr/libexec/ekeyd -- gen_context(system_u:object_r:ekeyd_exec_t,s0) +/usr/libexec/ekey-egd-linux -- gen_context(system_u:object_r:ekey_egd_exec_t,s0) + +/usr/sbin/ekey-setkey -- gen_context(system_u:object_r:ekey_tool_exec_t,s0) +/usr/sbin/ekey-rekey -- gen_context(system_u:object_r:ekey_tool_exec_t,s0) +/usr/sbin/ekeydctl -- gen_context(system_u:object_r:ekey_tool_exec_t,s0) + +/var/run/ekeyd.sock -s gen_context(system_u:object_r:ekey_var_run_t,s0) +
ekeyd.if new file +45 -0
45 lines not on this page · raw message
ekeyd.te new file +82 -0
82 lines not on this page · raw message
Signature · 1 line
1.8.5.5
PATCH 1/1 add ekeyd related rules
---
ekey domain transitions
policy/modules/roles/sysadm.te | 4 ++++ policy/modules/system/udev.te | 4 ++++ 2 files changed, 8 insertions(+)
policy/modules/roles/sysadm.te +4 -0
@@ -152,6 +152,10 @@ optional_policy(` ') optional_policy(` + ekey_tool_run(sysadm_t, sysadm_r) +') + +optional_policy(` firstboot_run(sysadm_t, sysadm_r) ')
policy/modules/system/udev.te +4 -0
@@ -262,6 +262,10 @@ optional_policy(` ') optional_policy(` + ekey_tool_domtrans(udev_t) +') + +optional_policy(` lvm_domtrans(udev_t) ')
Signature · 1 line
1.8.5.5
PATCH 1/1 add module for the entropy key daemon
In reply to Petre RodanQuoted 4 lines · Petre Rodan
index 0000000..d2efb55
ekeyd.te new file +0
-0@@ -0,0 +1,82 @@
[...]
ekeyd.te line 28
Quoted 7 lines
ekeyd.te new file +7
-0+ +type ekey_var_run_t; +files_pid_file(ekey_var_run_t) + +require { + type unreserved_port_t; +}
This looks like it should be a new port type based on the rules below.
Quoted 11 lines
ekeyd.te new file +11
-0+######################################## +# +# Local policy +# + +# ekeyd - the Entropy Key Daemon + +allow ekeyd_t self:tcp_socket create_stream_socket_perms; +allow ekeyd_t self:unix_dgram_socket create_socket_perms; +allow ekeyd_t unreserved_port_t:tcp_socket name_connect; +
ekeyd.te line 50
Quoted 10 lines
ekeyd.te new file +10
-0+read_files_pattern(ekeyd_t, ekey_etc_t, ekey_etc_t) +manage_sock_files_pattern(ekeyd_t, ekey_var_run_t, ekey_var_run_t) +corenet_tcp_bind_generic_node(ekeyd_t) +term_use_unallocated_ttys(ekeyd_t) +logging_send_syslog_msg(ekeyd_t) +miscfiles_read_localization(ekeyd_t) +files_read_usr_files(ekeyd_t) +files_pid_filetrans(ekeyd_t, ekey_var_run_t, sock_file) + +# tools
Needs a bigger comment bock/header for the ekeyd_tool_t domain
Quoted 5 lines
ekeyd.te new file +5
-0+allow ekey_tool_t self:fifo_file rw_fifo_file_perms; +allow ekey_tool_t ekeyd_t:unix_stream_socket connectto; + +manage_files_pattern(ekey_tool_t, ekey_etc_t, ekey_etc_t) +manage_sock_files_pattern(ekey_tool_t, ekey_var_run_t, ekey_var_run_t)
ekeyd.te line 65
Quoted 10 lines
ekeyd.te new file +10
-0+corecmd_exec_shell(ekey_tool_t) +can_exec(ekey_tool_t, ekey_tool_exec_t) +corecmd_exec_bin(ekey_tool_t) +userdom_use_user_terminals(ekey_tool_t) +miscfiles_read_localization(ekey_tool_t) +seutil_use_newrole_fds(ekey_tool_t) +files_read_usr_files(ekey_tool_t) +kernel_read_system_state(ekey_tool_t) +dev_read_sysfs(ekey_tool_t) +term_use_unallocated_ttys(ekey_tool_t)
Why is it using unallocated ttys?
Quoted 1 line
+# ekey-egd-linux - the EGD Entropy Daemon
Same thing regarding the header
Quoted 4 lines
ekeyd.te new file +4
-0+allow ekey_egd_t self:netlink_route_socket create_netlink_socket_perms; +allow ekey_egd_t self:tcp_socket create_socket_perms; +allow ekey_egd_t self:unix_dgram_socket create_socket_perms; +allow ekey_egd_t unreserved_port_t:tcp_socket name_connect;
ekeyd.te line 82
Quoted 10 lines
ekeyd.te new file +10
-0+ +dev_write_rand(ekey_egd_t) +miscfiles_read_localization(ekey_egd_t) +logging_send_syslog_msg(ekey_egd_t) + +optional_policy(` + daemontools_service_domain(ekeyd_t, ekeyd_exec_t) + daemontools_service_domain(ekey_egd_t, ekey_egd_exec_t) +') +
Overall it could use more space between interface calls to different modules.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 1/1 add module for the entropy key daemon
---
Entropy Key daemon policy
ekeyd.fc | 12 +++++++ ekeyd.if | 45 ++++++++++++++++++++++++++ ekeyd.te | 110 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 167 insertions(+) create mode 100644 ekeyd.fc create mode 100644 ekeyd.if create mode 100644 ekeyd.te
ekeyd.fc new file +12 -0
@@ -0,0 +1,12 @@ + +/etc/entropykey(/.*)? gen_context(system_u:object_r:ekey_etc_t,s0) + +/usr/libexec/ekeyd -- gen_context(system_u:object_r:ekeyd_exec_t,s0) +/usr/libexec/ekey-egd-linux -- gen_context(system_u:object_r:ekey_egd_exec_t,s0) + +/usr/sbin/ekey-setkey -- gen_context(system_u:object_r:ekey_tool_exec_t,s0) +/usr/sbin/ekey-rekey -- gen_context(system_u:object_r:ekey_tool_exec_t,s0) +/usr/sbin/ekeydctl -- gen_context(system_u:object_r:ekey_tool_exec_t,s0) + +/var/run/ekeyd.sock -s gen_context(system_u:object_r:ekey_var_run_t,s0) +
ekeyd.if new file +45 -0
45 lines not on this page · raw message
ekeyd.te new file +110 -0
110 lines not on this page · raw message
Signature · 1 line
1.8.5.5
PATCH 1/1 add module for the entropy key daemon
In reply to Christopher J. PeBenitoHi Chris,
Quoted 9 lines · Christopher J. PeBenito
ekeyd.te line 28
Quoted 6 lines · Petre Rodan
index 0000000..d2efb55
ekeyd.te new file +3
-0+require { + type unreserved_port_t; +}This looks like it should be a new port type based on the rules below.
well, there is no standard port for this application and there is no default set anywhere AFAICT.
the default is to send the random stream to the local machine only, but if the user needs to send entropy to more than a box that port needs to be set via EGDTCPSocket.
the man page looks like this: http://manpages.ubuntu.com/manpages/lucid/man5/ekeyd.conf.5.html
Quoted 3 lines
Quoted 1 line
+term_use_unallocated_ttys(ekey_tool_t)
Why is it using unallocated ttys?
the entropy-generating device is a usb dongle and /dev/ttyACM[0-9] (tty_device_t) ends up being used as an interface between the dongle and the software.
please don't forget to merge the sysadm_t and udev_t domain transitions too from the other patch.
Signature · 11 lines
petre rodan <[email protected]> Technical Manager Simplex SRL, Bucharest -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 198 bytes Desc: not available Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20140525/57c3a4ac/attachment.bin
PATCH 1/1 add module for the entropy key daemon
Quoted 14 lines · Petre Rodan
Hi Chris,
Quoted 9 lines · Christopher J. PeBenito
ekeyd.te line 28
Quoted 6 lines · Petre Rodan
index 0000000..d2efb55
ekeyd.te new file +3
-0+require { + type unreserved_port_t; +}This looks like it should be a new port type based on the rules below.
Quoted 4 lines
well, there is no standard port for this application and there is no default set anywhere AFAICT.
the default is to send the random stream to the local machine only, but if the user needs to send entropy to more than a box that port needs to be set via EGDTCPSocket.the man page looks like this: http://manpages.ubuntu.com/manpages/lucid/man5/ekeyd.conf.5.html
Ok, then an interface needs to be created rather than requiring the type.
Quoted 5 lines
Quoted 3 lines
Quoted 1 line
+term_use_unallocated_ttys(ekey_tool_t)
Why is it using unallocated ttys?
the entropy-generating device is a usb dongle and /dev/ttyACM[0-9] (
tty_device_t) ends up being used as an interface between the dongle and the software.
Please add a comment about this.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com