Skip to contentSkip to conversation

Some simple core policy updates

PATCH New Sven Vermeulen 2 participants 10 messages Nov 22, 2014 – Dec 2, 2014

lore
Share & tools
lore

Sven Vermeulen

author
#0 lore raw

v2 cover Some simple core policy updates

This is a small set of policy updates that have been in the Gentoo policy for a while and are ready for upstreaming.

Added the auth_pid_filetrans_pam_var_run as Nicolas Iooss correctly found; shame that I missed it, I checked it against the wrong repository :(

Sven Vermeulen (8):
Run grub(2)-mkconfig in bootloader domain Add auth_pid_filetrans_pam_var_run
New sudo manages timestamp directory in /var/run/sudo xfce4-notifyd is an executable
Mark f2fs as a SELinux capable file system Add in LightDM contexts
Add gfisk and efibootmgr as fsadm_exec_t
Add /var/lib/racoon as runtime directory for ipsec

 policy/modules/admin/bootloader.fc    |  1 +
 policy/modules/admin/sudo.if          |  3 ++-
 policy/modules/kernel/corecommands.fc |  1 +
 policy/modules/kernel/filesystem.te   |  1 +
 policy/modules/services/xserver.fc    |  7 +++++++
 policy/modules/system/authlogin.if    | 31 +++++++++++++++++++++++++++++++
 policy/modules/system/fstools.fc      |  2 ++
 policy/modules/system/ipsec.fc        |  2 ++
 8 files changed, 47 insertions(+), 1 deletion(-)
Signature · 1 line
2.0.4
author
#1 lore raw

PATCH v2 1/8 Run grub(2)-mkconfig in bootloader domain

In order to write the grub configuration and perform the preliminary checks, the grub-mkconfig command should run in the bootloader_t domain. As such, update the file context definition to be bootloader_exec_t.

---
 policy/modules/admin/bootloader.fc | 1 +
 1 file changed, 1 insertion(+)
policy/modules/admin/bootloader.fc +1 -0
index d56f931..d908d56 100644
@@ -9,4 +9,5 @@
 /usr/sbin/grub		--	gen_context(system_u:object_r:bootloader_exec_t,s0)
 /usr/sbin/grub2?-bios-setup	--	gen_context(system_u:object_r:bootloader_exec_t,s0)
 /usr/sbin/grub2?-install	--	gen_context(system_u:object_r:bootloader_exec_t,s0)
+/usr/sbin/grub2?-mkconfig	--	gen_context(system_u:object_r:bootloader_exec_t,s0)
 /usr/sbin/grub2?-probe	--	gen_context(system_u:object_r:bootloader_exec_t,s0)
Signature · 1 line
2.0.4
author
#2 lore raw

PATCH v2 2/8 Add auth_pid_filetrans_pam_var_run

In reply to Sven Vermeulen
---
 policy/modules/system/authlogin.if | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)
policy/modules/system/authlogin.if +31 -0
index 3efd5b6..f05d7bf 100644
@@ -1004,6 +1004,37 @@ interface(`auth_dontaudit_read_pam_pid',`
 
 ########################################
 ## <summary>
+##	Create specified objects in
+##	pid directories with the pam var
+##      run file type using a
+##      file type transition.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="object_class">
+##	<summary>
+##	Class of the object being created.
+##	</summary>
+## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
+#
+interface(`auth_pid_filetrans_pam_var_run',`
+	gen_require(`
+		type pam_var_run_t;
+	')
+
+	files_pid_filetrans($1, pam_var_run_t, $2, $3)
+')
+
+########################################
+## <summary>
 ##	Delete pam PID files.
 ## </summary>
 ## <param name="domain">
Signature · 1 line
2.0.4
author
#3 lore raw

PATCH v2 3/8 New sudo manages timestamp directory in /var/run/sudo

In reply to Sven Vermeulen

Allow sudo (1.8.9_p5 and higher) to handle /var/run/sudo/ts if it does not exist (given the tmpfs nature of /var/run). This is done when sudo is run in the user prefixed domain, and requires both the chown capability as well as the proper file transition when /var/run/sudo is created.

---
 policy/modules/admin/sudo.if | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
policy/modules/admin/sudo.if +2 -1
index d9114b3..2ee052b 100644
@@ -52,7 +52,7 @@ template(`sudo_role_template',`
 	#
 
 	# Use capabilities.
-	allow $1_sudo_t self:capability { fowner setuid setgid dac_override sys_nice sys_resource };
+	allow $1_sudo_t self:capability { chown fowner setuid setgid dac_override sys_nice sys_resource };
 	allow $1_sudo_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
 	allow $1_sudo_t self:process { setexec setrlimit };
 	allow $1_sudo_t self:fd use;

@@ -117,6 +117,7 @@ template(`sudo_role_template',`
 	auth_run_chk_passwd($1_sudo_t, $2)
 	# sudo stores a token in the pam_pid directory
 	auth_manage_pam_pid($1_sudo_t)
+	auth_pid_filetrans_pam_var_run($1_sudo_t, dir, "sudo")
 	auth_use_nsswitch($1_sudo_t)
 
 	init_rw_utmp($1_sudo_t)
Signature · 1 line
2.0.4
author
#4 lore raw

PATCH v2 4/8 xfce4-notifyd is an executable

In reply to Sven Vermeulen
---
 policy/modules/kernel/corecommands.fc | 1 +
 1 file changed, 1 insertion(+)
policy/modules/kernel/corecommands.fc +1 -0
index c860d81..958fad7 100644
@@ -239,6 +239,7 @@ ifdef(`distro_gentoo',`
 /usr/lib/vte/gnome-pty-helper	--	gen_context(system_u:object_r:bin_t,s0)
 /usr/lib/xfce4/exo-1/exo-compose-mail-1 -- gen_context(system_u:object_r:bin_t,s0)
 /usr/lib/xfce4/exo-1/exo-helper-1 --	gen_context(system_u:object_r:bin_t,s0)
+/usr/lib/xfce4/notifyd/xfce4-notifyd -- gen_context(system_u:object_r:bin_t,s0)
 /usr/lib/xfce4/panel/migrate	--	gen_context(system_u:object_r:bin_t,s0)
 /usr/lib/xfce4/panel/wrapper	--	gen_context(system_u:object_r:bin_t,s0)
 /usr/lib/xfce4/session/balou-export-theme -- gen_context(system_u:object_r:bin_t,s0)
Signature · 1 line
2.0.4
author
#5 lore raw

PATCH v2 5/8 Mark f2fs as a SELinux capable file system

In reply to Sven Vermeulen

Since Linux kernel 3.11, F2FS supports XATTR and the security namespace. See commit
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8ae8f1627f39bae505b90cade50cd8a911b8bda6

---
 policy/modules/kernel/filesystem.te | 1 +
 1 file changed, 1 insertion(+)
policy/modules/kernel/filesystem.te +1 -0
index cf04fb7..fd1e7fe 100644
@@ -27,6 +27,7 @@ fs_use_xattr ext2 gen_context(system_u:object_r:fs_t,s0);
 fs_use_xattr ext3 gen_context(system_u:object_r:fs_t,s0);
 fs_use_xattr ext4 gen_context(system_u:object_r:fs_t,s0);
 fs_use_xattr ext4dev gen_context(system_u:object_r:fs_t,s0);
+fs_use_xattr f2fs gen_context(system_u:object_r:fs_t,s0);
 fs_use_xattr gfs gen_context(system_u:object_r:fs_t,s0);
 fs_use_xattr gfs2 gen_context(system_u:object_r:fs_t,s0);
 fs_use_xattr gpfs gen_context(system_u:object_r:fs_t,s0);
Signature · 1 line
2.0.4
author
#6 lore raw

PATCH v2 6/8 Add in LightDM contexts

In reply to Sven Vermeulen
---
 policy/modules/services/xserver.fc | 7 +++++++
 1 file changed, 7 insertions(+)
policy/modules/services/xserver.fc +7 -0
index 3fe4eef..71b307c 100644
@@ -22,6 +22,8 @@ HOME_DIR/\.Xauthority.*	--	gen_context(system_u:object_r:xauth_home_t,s0)
 /etc/gdm(3)?/PreSession/.* --	gen_context(system_u:object_r:xsession_exec_t,s0)
 /etc/gdm(3)?/Xsession	--	gen_context(system_u:object_r:xsession_exec_t,s0)
 
+/etc/lightdm/Xsession	--	gen_context(system_u:object_r:xsession_exec_t,s0)
+
 /etc/kde[34]?/kdm/Xstartup --	gen_context(system_u:object_r:xsession_exec_t,s0)
 /etc/kde[34]?/kdm/Xreset --	gen_context(system_u:object_r:xsession_exec_t,s0)
 /etc/kde[34]?/kdm/Xsession --	gen_context(system_u:object_r:xsession_exec_t,s0)

@@ -92,12 +94,16 @@ ifndef(`distro_debian',`
 
 /var/[xgkw]dm(/.*)?		gen_context(system_u:object_r:xserver_log_t,s0)
 
+/var/cache/lightdm(/.*)?	gen_context(system_u:object_r:xdm_var_lib_t,s0)
+
 /var/lib/gdm(3)?(/.*)?		gen_context(system_u:object_r:xdm_var_lib_t,s0)
+/var/lib/lightdm(/.*)?		gen_context(system_u:object_r:xdm_var_lib_t,s0)
 /var/lib/lxdm(/.*)?		gen_context(system_u:object_r:xdm_var_lib_t,s0)
 /var/lib/[xkw]dm(/.*)?		gen_context(system_u:object_r:xdm_var_lib_t,s0)
 /var/lib/xkb(/.*)?		gen_context(system_u:object_r:xkb_var_lib_t,s0)
 
 /var/log/[kwx]dm\.log.*	--	gen_context(system_u:object_r:xserver_log_t,s0)
+/var/log/lightdm(/.*)?		gen_context(system_u:object_r:xserver_log_t,s0)
 /var/log/lxdm\.log	--	gen_context(system_u:object_r:xserver_log_t,s0)
 /var/log/gdm(3)?(/.*)?		gen_context(system_u:object_r:xserver_log_t,s0)
 /var/log/slim\.log	--	gen_context(system_u:object_r:xserver_log_t,s0)

@@ -107,6 +113,7 @@ ifndef(`distro_debian',`
 /var/run/gdm(3)?(/.*)?		gen_context(system_u:object_r:xdm_var_run_t,s0)
 /var/run/gdm(3)?\.pid	--	gen_context(system_u:object_r:xdm_var_run_t,s0)
 /var/run/xdm\.pid	--	gen_context(system_u:object_r:xdm_var_run_t,s0)
+/var/run/lightdm(/.*)?		gen_context(system_u:object_r:xdm_var_run_t,s0)
 /var/run/lxdm\.auth	--	gen_context(system_u:object_r:xdm_var_run_t,s0)
 /var/run/lxdm\.pid	--	gen_context(system_u:object_r:xdm_var_run_t,s0)
 /var/run/lxdm(/.*)?		gen_context(system_u:object_r:xdm_var_run_t,s0)
Signature · 1 line
2.0.4
author
#7 lore raw

PATCH v2 7/8 Add gfisk and efibootmgr as fsadm_exec_t

In reply to Sven Vermeulen
---
 policy/modules/system/fstools.fc | 2 ++
 1 file changed, 2 insertions(+)
policy/modules/system/fstools.fc +2 -0
index 3101274..d10368d 100644
@@ -51,8 +51,10 @@
 /usr/sbin/addpart	--	gen_context(system_u:object_r:fsadm_exec_t,s0)
 /usr/sbin/clubufflush	--	gen_context(system_u:object_r:fsadm_exec_t,s0)
 /usr/sbin/delpart	--	gen_context(system_u:object_r:fsadm_exec_t,s0)
+/usr/sbin/efibootmgr	--	gen_context(system_u:object_r:fsadm_exec_t,s0)
 /usr/sbin/fatsort	--	gen_context(system_u:object_r:fsadm_exec_t,s0)
 /usr/sbin/fsck.*	--	gen_context(system_u:object_r:fsadm_exec_t,s0)
+/usr/sbin/gdisk		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
 /usr/sbin/mkfs.*	--	gen_context(system_u:object_r:fsadm_exec_t,s0)
 /usr/sbin/parted	--	gen_context(system_u:object_r:fsadm_exec_t,s0)
 /usr/sbin/partprobe	--	gen_context(system_u:object_r:fsadm_exec_t,s0)
Signature · 1 line
2.0.4
author
#8 lore raw

PATCH v2 8/8 Add /var/lib/racoon as runtime directory for ipsec

In reply to Sven Vermeulen
---
 policy/modules/system/ipsec.fc | 2 ++
 1 file changed, 2 insertions(+)
policy/modules/system/ipsec.fc +2 -0
index 662e79b..0f1e351 100644
@@ -31,6 +31,8 @@
 /usr/sbin/racoon		--	gen_context(system_u:object_r:racoon_exec_t,s0)
 /usr/sbin/setkey		--	gen_context(system_u:object_r:setkey_exec_t,s0)
 
+/var/lib/racoon(/.*)?			gen_context(system_u:object_r:ipsec_var_run_t,s0)
+
 /var/lock/subsys/ipsec		--	gen_context(system_u:object_r:ipsec_mgmt_lock_t,s0)
 
 /var/log/pluto\.log		--	gen_context(system_u:object_r:ipsec_log_t,s0)
Signature · 1 line
2.0.4
#9 lore raw

v2 cover Some simple core policy updates

In reply to Sven Vermeulen
Quoted 14 lines · Sven Vermeulen

This is a small set of policy updates that have been in the Gentoo policy for a while and are ready for upstreaming.

Added the auth_pid_filetrans_pam_var_run as Nicolas Iooss correctly found; shame that I missed it, I checked it against the wrong repository :(

Sven Vermeulen (8):
Run grub(2)-mkconfig in bootloader domain Add auth_pid_filetrans_pam_var_run
New sudo manages timestamp directory in /var/run/sudo xfce4-notifyd is an executable
Mark f2fs as a SELinux capable file system Add in LightDM contexts
Add gfisk and efibootmgr as fsadm_exec_t
Add /var/lib/racoon as runtime directory for ipsec

Quoted 9 lines
 policy/modules/admin/bootloader.fc    |  1 +
 policy/modules/admin/sudo.if          |  3 ++-
 policy/modules/kernel/corecommands.fc |  1 +
 policy/modules/kernel/filesystem.te   |  1 +
 policy/modules/services/xserver.fc    |  7 +++++++
 policy/modules/system/authlogin.if    | 31 +++++++++++++++++++++++++++++++
 policy/modules/system/fstools.fc      |  2 ++
 policy/modules/system/ipsec.fc        |  2 ++
 8 files changed, 47 insertions(+), 1 deletion(-)

This set is merged.

Signature · 3 lines
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com