base: label generic SSL certificates as standard files

Reserve the cert_t file label for SSL private keys only and label the generic SSL certificates as standard files (e.g. etc_t for files in /etc/pki/ or usr_t for files in /usr/ subdirectories).

This part (1/2) refers to the base policy changes.

Signed-off-by Guido Trentalancia <[email protected]>

---
 policy/modules/system/miscfiles.fc |    1 -
 1 file changed, 1 deletion(-)

diff -pru a/policy/modules/system/miscfiles.fc
b/policy/modules/system/miscfiles.fc ---
a/policy/modules/system/miscfiles.fc 2017-11-04 20:14:02.301932938 +0100
+++ b/policy/modules/system/miscfiles.fc 2017-11-05 03:00:59.361768672
+0100 @@ -11,7 +11,6 @@ ifdef(distro_gentoo',
/etc/avahi/etc/localtime -- gen_context(system_u:object_r:locale_t,s0)
/etc/httpd/alias/[^/]*\.db(\.[^/]*)* --
gen_context(system_u:object_r:cert_t,s0)
/etc/localtime -- gen_context(system_u:object_r:locale_t,s0)
-/etc/pki(/.*)? gen_context(system_u:object_r:cert_t,s0)
/etc/ssl(/.*)? gen_context(system_u:object_r:cert_t,s0)
/etc/timezone -- gen_context(system_u:object_r:locale_t,s0)

_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

Quoted 4 lines · AEDT Guido Trentalancia via refpolicy

Reserve the cert_t file label for SSL private keys only and label the generic SSL certificates as standard files (e.g. etc_t for files in /etc/pki/ or usr_t for files in /usr/ subdirectories).

Are you sure that we can't have private keys under /etc/pki?

https://www.linux.com/BLOG/PKI-IMPLEMENTATION-LINUX-ADMIN
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linu
x/5/html/
Deployment_Guide/s1-secureserver-oldcert.html

The above URLs suggest that /etc/pki/.*/private(/.*)? should be labeled as
cert_t. But I don't have a setup to test this.

Quoted 19 lines

This part (1/2) refers to the base policy changes.

Signed-off-by Guido Trentalancia <[email protected]>

---
 policy/modules/system/miscfiles.fc |    1 -
 1 file changed, 1 deletion(-)

diff -pru a/policy/modules/system/miscfiles.fc
b/policy/modules/system/miscfiles.fc ---
a/policy/modules/system/miscfiles.fc 2017-11-04
20:14:02.301932938 +0100
+++ b/policy/modules/system/miscfiles.fc 2017-11-05
03:00:59.361768672
+0100 @@ -11,7 +11,6 @@ ifdef(distro_gentoo',
/etc/avahi/etc/localtime -- gen_context(system_u:object_r:l
ocale_t,s0)
/etc/httpd/alias/[^/]*\.db(\.[^/]*)* --
gen_context(system_u:object_r:cert_t,s0)
/etc/localtime -- gen_context(system_u:object

Quoted 8 lines

_r:locale_t,s0)
-/etc/pki(/.*)? gen_context(system_u:object_
r:cert_t,s0)
/etc/ssl(/.*)? gen_context(system_u:object_
r:cert_t,s0)
/etc/timezone -- gen_context(system_u:object
_r:locale_t,s0)

Reserve the ssl_privkey_t file label for SSL private keys (e.g. files in /etc/pki/*/private/).

Create and use appropriate interfaces for such new scenario (so that SSL private keys are protected).

This part (1/2) refers to the base policy changes.

Signed-off-by Guido Trentalancia <[email protected]>

---
  policy/modules/system/miscfiles.fc |    1
  policy/modules/system/miscfiles.if |  104 +++++++++++++++++++++++++++++++++++++
  policy/modules/system/miscfiles.te |    7 ++
  3 files changed, 112 insertions(+)

diff -pru a/policy/modules/system/miscfiles.fc b/policy/modules/system/miscfiles.fc

policy/modules/system/miscfiles.fc +1 -0

@@ -12,6 +12,7 @@ ifdef(`distro_gentoo',`
  /etc/httpd/alias/[^/]*\.db(\.[^/]*)* -- gen_context(system_u:object_r:cert_t,s0)
  /etc/localtime		--	gen_context(system_u:object_r:locale_t,s0)
  /etc/pki(/.*)?			gen_context(system_u:object_r:cert_t,s0)
+/etc/pki/.*/private(/.*)?	gen_context(system_u:object_r:ssl_privkey_t,s0)
  /etc/ssl(/.*)?			gen_context(system_u:object_r:cert_t,s0)
  /etc/timezone		--	gen_context(system_u:object_r:locale_t,s0)
 

diff -pru a/policy/modules/system/miscfiles.if b/policy/modules/system/miscfiles.if

policy/modules/system/miscfiles.if +46 -0

@@ -46,6 +46,51 @@ interface(`miscfiles_cert_type',`
 
  ########################################
  ## <summary>
+##	Make the specified type usable
+##	as a SSL private key file.
+## </summary>
+## <desc>
+##	<p>
+##	Make the specified type usable for SSL private key files.
+##	This will also make the type usable for files, making
+##	calls to files_type() redundant.  Failure to use this interface
+##	for a temporary file may result in problems with
+##	SSL private key management tools.
+##	</p>
+##	<p>
+##	Related interfaces:
+##	</p>
+##	<ul>
+##		<li>files_type()</li>
+##	</ul>
+##	<p>
+##	Example:
+##	</p>
+##	<p>
+##	type mysslprivkeyfile_t;
+##	ssl_privkey_type(mysslprivkeyfile_t)
+##	allow mydomain_t mysslprivkeyfile_t:file read_file_perms;
+##	files_search_etc(mydomain_t)
+##	</p>
+## </desc>
+## <param name="type">
+##	<summary>
+##	Type to be used for files.
+##	</summary>
+## </param>
+## <infoflow type="none"/>
+#
+interface(`miscfiles_ssl_privkey_type',`
+	gen_require(`
+		attribute ssl_privkey_type;
+	')
+
+	typeattribute $1 ssl_privkey_type;
+	files_type($1)
+')
+
+########################################
+## <summary>
  ##	Read all SSL certificates.
  ## </summary>
  ## <param name="domain">

@@ -125,6 +170,65 @@ interface(`miscfiles_manage_generic_cert
  ')
 
  ########################################
+## <summary>

policy/modules/system/miscfiles.if +48 -0

+	gen_require(`
+		type ssl_privkey_t;
+	')
+
+	allow $1 ssl_privkey_t:dir list_dir_perms;
+	read_files_pattern($1, ssl_privkey_t, ssl_privkey_t)
+	read_lnk_files_pattern($1, ssl_privkey_t, ssl_privkey_t)
+')
+
+########################################
+## <summary>
+##	Manage SSL private keys.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`miscfiles_manage_ssl_privkey_dirs',`
+	gen_require(`
+		type ssl_privkey_t;
+	')
+
+	manage_dirs_pattern($1, ssl_privkey_t, ssl_privkey_t)
+')
+
+########################################
+## <summary>
+##	Manage SSL private keys.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`miscfiles_manage_ssl_privkey_files',`
+	gen_require(`
+		type ssl_privkey_t;
+	')
+
+	manage_files_pattern($1, ssl_privkey_t, ssl_privkey_t)
+	read_lnk_files_pattern($1, ssl_privkey_t, ssl_privkey_t)
+')
+
+########################################
  ## <summary>
  ##	Read fonts.
  ## </summary>

diff -pru a/policy/modules/system/miscfiles.te b/policy/modules/system/miscfiles.te

policy/modules/system/miscfiles.te +7 -0

@@ -6,6 +6,7 @@ policy_module(miscfiles, 1.13.2)
  #
 
  attribute cert_type;
+attribute ssl_privkey_type;
 
  #
  # cert_t is the type of files in the system certs directories.

@@ -14,6 +15,12 @@ type cert_t;
  miscfiles_cert_type(cert_t)
 
  #
+# ssl_privkey_t is the type of files for the SSL private keys.
+#
+type ssl_privkey_t;
+miscfiles_ssl_privkey_type(ssl_privkey_t)
+
+#
  # fonts_t is the type of various font
  # files in /usr
  #

Quoted 5 lines · Guido Trentalancia via refpolicy

Reserve the ssl_privkey_t file label for SSL private keys (e.g. files in /etc/pki/*/private/).

Create and use appropriate interfaces for such new scenario (so that SSL private keys are protected).

Perhaps I'm just being too pedantic, but no one uses SSL, so why not use
TLS in the type name?

Quoted 6 lines

This part (1/2) refers to the base policy changes.

Signed-off-by Guido Trentalancia <[email protected]>

---
  policy/modules/system/miscfiles.fc |    1
  policy/modules/system/miscfiles.if |  104

+++++++++++++++++++++++++++++++++++++

Quoted 4 lines

  policy/modules/system/miscfiles.te |    7 ++
  3 files changed, 112 insertions(+)

diff -pru a/policy/modules/system/miscfiles.fc

b/policy/modules/system/miscfiles.fc

Quoted 1 line

--- a/policy/modules/system/miscfiles.fc 2017-11-04

20:14:02.301932938 +0100

Quoted 1 line

+++ b/policy/modules/system/miscfiles.fc 2017-11-05

21:21:46.574498652 +0100

Review ifdef(`distro_gentoo',` · line 12

Quoted 2 lines

(quoted diff) +0 -0

@@ -12,6 +12,7 @@ ifdef(`distro_gentoo',`
  /etc/httpd/alias/[^/]*\.db(\.[^/]*)* --

gen_context(system_u:object_r:cert_t,s0)

policy/modules/system/miscfiles.fc ifdef(`distro_gentoo',` · line 18

Quoted 3 lines

policy/modules/system/miscfiles.fc +0 -0

  /etc/localtime		--	gen_context(system_u:object_r:locale_t,s0)
  /etc/pki(/.*)?			gen_context(system_u:object_r:cert_t,s0)
 

+/etc/pki/.*/private(/.*)? gen_context(system_u:object_r:ssl_privkey_t,s0)

Quoted 4 lines

policy/modules/system/miscfiles.fc +0 -0

  /etc/ssl(/.*)?			gen_context(system_u:object_r:cert_t,s0)
  /etc/timezone		--	gen_context(system_u:object_r:locale_t,s0)

diff -pru a/policy/modules/system/miscfiles.if

b/policy/modules/system/miscfiles.if

Quoted 1 line

--- a/policy/modules/system/miscfiles.if 2017-09-29

19:01:28.001455758 +0200

Quoted 1 line

+++ b/policy/modules/system/miscfiles.if 2017-11-05

21:46:31.113492583 +0100

Quoted 55 lines

policy/modules/system/miscfiles.if +45 -0

@@ -46,6 +46,51 @@ interface(`miscfiles_cert_type',`
 
  ########################################
  ## <summary>
+##	Make the specified type usable
+##	as a SSL private key file.
+## </summary>
+## <desc>
+##	<p>
+##	Make the specified type usable for SSL private key files.
+##	This will also make the type usable for files, making
+##	calls to files_type() redundant.  Failure to use this interface
+##	for a temporary file may result in problems with
+##	SSL private key management tools.
+##	</p>
+##	<p>
+##	Related interfaces:
+##	</p>
+##	<ul>
+##		<li>files_type()</li>
+##	</ul>
+##	<p>
+##	Example:
+##	</p>
+##	<p>
+##	type mysslprivkeyfile_t;
+##	ssl_privkey_type(mysslprivkeyfile_t)
+##	allow mydomain_t mysslprivkeyfile_t:file read_file_perms;
+##	files_search_etc(mydomain_t)
+##	</p>
+## </desc>
+## <param name="type">
+##	<summary>
+##	Type to be used for files.
+##	</summary>
+## </param>
+## <infoflow type="none"/>
+#
+interface(`miscfiles_ssl_privkey_type',`
+	gen_require(`
+		attribute ssl_privkey_type;
+	')
+
+	typeattribute $1 ssl_privkey_type;
+	files_type($1)
+')
+
+########################################
+## <summary>
  ##	Read all SSL certificates.
  ## </summary>
  ## <param name="domain">

@@ -125,6 +170,65 @@ interface(`miscfiles_manage_generic_cert
  ')
 

policy/modules/system/miscfiles.if interface(`miscfiles_manage_generic_cert · line 183

Quoted 12 lines

policy/modules/system/miscfiles.if +11 -0

  ########################################
+## <summary>
+##	Read SSL private keys.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`miscfiles_read_ssl_privkey',`

This should have "generic privkeys" in the interface name (and below), since other private keys would have different types.

Quoted 51 lines

policy/modules/system/miscfiles.if +48 -0

+	gen_require(`
+		type ssl_privkey_t;
+	')
+
+	allow $1 ssl_privkey_t:dir list_dir_perms;
+	read_files_pattern($1, ssl_privkey_t, ssl_privkey_t)
+	read_lnk_files_pattern($1, ssl_privkey_t, ssl_privkey_t)
+')
+
+########################################
+## <summary>
+##	Manage SSL private keys.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`miscfiles_manage_ssl_privkey_dirs',`
+	gen_require(`
+		type ssl_privkey_t;
+	')
+
+	manage_dirs_pattern($1, ssl_privkey_t, ssl_privkey_t)
+')
+
+########################################
+## <summary>
+##	Manage SSL private keys.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`miscfiles_manage_ssl_privkey_files',`
+	gen_require(`
+		type ssl_privkey_t;
+	')
+
+	manage_files_pattern($1, ssl_privkey_t, ssl_privkey_t)
+	read_lnk_files_pattern($1, ssl_privkey_t, ssl_privkey_t)
+')
+
+########################################
  ## <summary>
  ##	Read fonts.
  ## </summary>

Quoted 1 line

diff -pru a/policy/modules/system/miscfiles.te

b/policy/modules/system/miscfiles.te

Quoted 1 line

--- a/policy/modules/system/miscfiles.te 2017-11-04

20:14:02.301932938 +0100

Quoted 1 line

+++ b/policy/modules/system/miscfiles.te 2017-11-05

23:22:06.926469134 +0100

Quoted 11 lines

policy/modules/system/miscfiles.te +1 -0

@@ -6,6 +6,7 @@ policy_module(miscfiles, 1.13.2)
  #
 
  attribute cert_type;
+attribute ssl_privkey_type;
 
  #
  # cert_t is the type of files in the system certs directories.

@@ -14,6 +15,12 @@ type cert_t;
  miscfiles_cert_type(cert_t)
 

policy/modules/system/miscfiles.te type cert_t; · line 26

Quoted 10 lines

policy/modules/system/miscfiles.te +6 -0

  #
+# ssl_privkey_t is the type of files for the SSL private keys.
+#
+type ssl_privkey_t;
+miscfiles_ssl_privkey_type(ssl_privkey_t)
+
+#
  # fonts_t is the type of various font
  # files in /usr
  #

Reserve the tls_privkey_t file label for SSL/TLS private keys (e.g. files in /etc/pki/*/private/).

Create and use appropriate interfaces for such new scenario (so that SSL/TLS private keys are protected).

This part (1/2) refers to the base policy changes.

Signed-off-by Guido Trentalancia <[email protected]>

---
  policy/modules/system/miscfiles.fc |    1
  policy/modules/system/miscfiles.if |  115 +++++++++++++++++++++++++++++++++++--
  policy/modules/system/miscfiles.te |    7 ++
  3 files changed, 119 insertions(+), 4 deletions(-)

diff -pru a/policy/modules/system/miscfiles.fc b/policy/modules/system/miscfiles.fc

policy/modules/system/miscfiles.fc +1 -0

@@ -12,6 +12,7 @@ ifdef(`distro_gentoo',`
  /etc/httpd/alias/[^/]*\.db(\.[^/]*)* -- gen_context(system_u:object_r:cert_t,s0)
  /etc/localtime		--	gen_context(system_u:object_r:locale_t,s0)
  /etc/pki(/.*)?			gen_context(system_u:object_r:cert_t,s0)
+/etc/pki/.*/private(/.*)?	gen_context(system_u:object_r:tls_privkey_t,s0)
  /etc/ssl(/.*)?			gen_context(system_u:object_r:cert_t,s0)
  /etc/timezone		--	gen_context(system_u:object_r:locale_t,s0)
 

diff -pru a/policy/modules/system/miscfiles.if b/policy/modules/system/miscfiles.if

policy/modules/system/miscfiles.if +111 -4

@@ -46,7 +46,52 @@ interface(`miscfiles_cert_type',`
 
  ########################################
  ## <summary>
-##	Read all SSL certificates.
+##	Make the specified type usable
+##	as a SSL/TLS private key file.
+## </summary>
+## <desc>
+##	<p>
+##	Make the specified type usable for SSL/TLS private key files.
+##	This will also make the type usable for files, making
+##	calls to files_type() redundant.  Failure to use this interface
+##	for a temporary file may result in problems with
+##	SSL/TLS private key management tools.
+##	</p>
+##	<p>
+##	Related interfaces:
+##	</p>
+##	<ul>
+##		<li>files_type()</li>
+##	</ul>
+##	<p>
+##	Example:
+##	</p>
+##	<p>
+##	type mytlsprivkeyfile_t;
+##	tls_privkey_type(mytlsprivkeyfile_t)
+##	allow mydomain_t mytlsprivkeyfile_t:file read_file_perms;
+##	files_search_etc(mydomain_t)
+##	</p>
+## </desc>
+## <param name="type">
+##	<summary>
+##	Type to be used for files.
+##	</summary>
+## </param>
+## <infoflow type="none"/>
+#
+interface(`miscfiles_tls_privkey_type',`
+	gen_require(`
+		attribute tls_privkey_type;
+	')
+
+	typeattribute $1 tls_privkey_type;
+	files_type($1)
+')
+
+########################################
+## <summary>
+##	Read all SSL/TLS certificates.
  ## </summary>
  ## <param name="domain">
  ##	<summary>

@@ -67,7 +112,7 @@ interface(`miscfiles_read_all_certs',`
 
  ########################################
  ## <summary>
-##	Read generic SSL certificates.
+##	Read generic SSL/TLS certificates.
  ## </summary>
  ## <param name="domain">
  ##	<summary>

@@ -88,7 +133,7 @@ interface(`miscfiles_read_generic_certs'
 
  ########################################
  ## <summary>
-##	Manage generic SSL certificates.
+##	Manage generic SSL/TLS certificates.
  ## </summary>
  ## <param name="domain">
  ##	<summary>

@@ -106,7 +151,7 @@ interface(`miscfiles_manage_generic_cert
 
  ########################################
  ## <summary>
-##	Manage generic SSL certificates.
+##	Manage generic SSL/TLS certificates.
  ## </summary>
  ## <param name="domain">
  ##	<summary>

@@ -125,6 +170,68 @@ interface(`miscfiles_manage_generic_cert
  ')
 
  ########################################
+## <summary>
+##	Read generic SSL/TLS private
+##	keys.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`miscfiles_read_generic_tls_privkey',`
+	gen_require(`
+		type tls_privkey_t;
+	')
+
+	allow $1 tls_privkey_t:dir list_dir_perms;
+	read_files_pattern($1, tls_privkey_t, tls_privkey_t)
+	read_lnk_files_pattern($1, tls_privkey_t, tls_privkey_t)
+')
+
+########################################
+## <summary>
+##	Manage generic SSL/TLS private
+##	keys.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`miscfiles_manage_generic_tls_privkey_dirs',`
+	gen_require(`
+		type tls_privkey_t;
+	')
+
+	manage_dirs_pattern($1, tls_privkey_t, tls_privkey_t)
+')
+
+########################################
+## <summary>
+##	Manage generic SSL/TLS private
+##	keys.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`miscfiles_manage_generic_tls_privkey_files',`
+	gen_require(`
+		type tls_privkey_t;
+	')
+
+	manage_files_pattern($1, tls_privkey_t, tls_privkey_t)
+	read_lnk_files_pattern($1, tls_privkey_t, tls_privkey_t)
+')
+
+########################################
  ## <summary>
  ##	Read fonts.
  ## </summary>

diff -pru a/policy/modules/system/miscfiles.te b/policy/modules/system/miscfiles.te

policy/modules/system/miscfiles.te +1 -0

@@ -6,6 +6,7 @@ policy_module(miscfiles, 1.13.2)
  #
 
  attribute cert_type;
+attribute tls_privkey_type;
 
  #
  # cert_t is the type of files in the system certs directories.

@@ -14,6 +15,12 @@ type cert_t;
  miscfiles_cert_type(cert_t)