Allow systemd services to use PrivateNetwork feature

PATCH New Nicolas Iooss 4 participants 4 messages Jan 11, 2016 – Jan 19, 2016

lore

Share & tools

lore

Nicolas Iooss

author

2016-01-11 18:14 UTC #0 lore raw

PATCH 1/1 Allow systemd services to use PrivateNetwork feature

systemd creates a new network namespace for services which are using PrivateNetwork=yes.

In the implementation, systemd uses a socketpair as a storage buffer for the namespace reference file descriptor (c.f.
https://github.com/systemd/systemd/blob/v228/src/core/namespace.c#L660).
One end of this socketpair is locked (hence the need of "lock" access to self:unix_dgram_socket for init_t) while systemd opens /proc/self/ns/net, which lives in nsfs.

While at it, add filesystem_type attribute to nsfs_t.

---
 policy/modules/kernel/filesystem.if | 17 +++++++++++++++++
 policy/modules/kernel/filesystem.te |  1 +
 policy/modules/system/init.te       |  3 +++
 3 files changed, 21 insertions(+)

policy/modules/kernel/filesystem.if +17 -0

index 99ad71f926b4..3455c2270942 100644
@@ -3360,6 +3360,23 @@ interface(`fs_rw_nfsd_fs',`
 
 ########################################
 ## <summary>
+##	Read nsfs inodes (e.g. /proc/pid/ns/uts)
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`fs_read_nsfs_files',`
+	gen_require(`
+		type nsfs_t;
+	')
+
+	allow $1 nsfs_t:file read_file_perms;
+')
+########################################
+## <summary>
 ##	Getattr on pstore dirs.
 ## </summary>
 ## <param name="domain">

policy/modules/kernel/filesystem.te +1 -0

index 920527ca9995..ae44d92f4f10 100644
@@ -126,6 +126,7 @@ fs_type(nfsd_fs_t)
 genfscon nfsd / gen_context(system_u:object_r:nfsd_fs_t,s0)
 
 type nsfs_t;
+fs_type(nsfs_t)
 genfscon nsfs / gen_context(system_u:object_r:nsfs_t,s0)
 
 type oprofilefs_t;

policy/modules/system/init.te +3 -0

index ea5530f55689..78031010d38c 100644
@@ -199,6 +199,7 @@ ifdef(`init_systemd',`
 	allow init_t self:netlink_kobject_uevent_socket create_socket_perms;
 	allow init_t self:netlink_route_socket create_netlink_socket_perms;
 	allow init_t self:netlink_selinux_socket create_socket_perms;
+	allow init_t self:unix_dgram_socket lock;
 
 	manage_files_pattern(init_t, init_var_run_t, init_var_run_t)
 	manage_lnk_files_pattern(init_t, init_var_run_t, init_var_run_t)

@@ -260,6 +261,8 @@ ifdef(`init_systemd',`
 	# mount-setup
 	fs_unmount_autofs(init_t)
 	fs_getattr_pstore_dirs(init_t)
+	# for network namespaces
+	fs_read_nsfs_files(init_t)
 
 	# systemd_socket_activated policy
 	mls_socket_write_all_levels(init_t)

Signature · 1 line

2.7.0

Christopher J. PeBenito

2016-01-11 18:27 UTC #1 lore raw

PATCH 1/1 Allow systemd services to use PrivateNetwork feature

Quoted 11 lines · Nicolas Iooss

systemd creates a new network namespace for services which are using PrivateNetwork=yes.
In the implementation, systemd uses a socketpair as a storage buffer for the namespace reference file descriptor (c.f.
https://github.com/systemd/systemd/blob/v228/src/core/namespace.c#L660).
One end of this socketpair is locked (hence the need of "lock" access to self:unix_dgram_socket for init_t) while systemd opens /proc/self/ns/net, which lives in nsfs.
While at it, add filesystem_type attribute to nsfs_t.

Merged.

Quoted 68 lines

---
 policy/modules/kernel/filesystem.if | 17 +++++++++++++++++
 policy/modules/kernel/filesystem.te |  1 +
 policy/modules/system/init.te       |  3 +++
 3 files changed, 21 insertions(+)

policy/modules/kernel/filesystem.if +17 -0

index 99ad71f926b4..3455c2270942 100644
@@ -3360,6 +3360,23 @@ interface(`fs_rw_nfsd_fs',`
 
 ########################################
 ## <summary>
+##	Read nsfs inodes (e.g. /proc/pid/ns/uts)
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`fs_read_nsfs_files',`
+	gen_require(`
+		type nsfs_t;
+	')
+
+	allow $1 nsfs_t:file read_file_perms;
+')
+########################################
+## <summary>
 ##	Getattr on pstore dirs.
 ## </summary>
 ## <param name="domain">

policy/modules/kernel/filesystem.te +1 -0

index 920527ca9995..ae44d92f4f10 100644
@@ -126,6 +126,7 @@ fs_type(nfsd_fs_t)
 genfscon nfsd / gen_context(system_u:object_r:nfsd_fs_t,s0)
 
 type nsfs_t;
+fs_type(nsfs_t)
 genfscon nsfs / gen_context(system_u:object_r:nsfs_t,s0)
 
 type oprofilefs_t;

policy/modules/system/init.te +3 -0

index ea5530f55689..78031010d38c 100644
@@ -199,6 +199,7 @@ ifdef(`init_systemd',`
 	allow init_t self:netlink_kobject_uevent_socket create_socket_perms;
 	allow init_t self:netlink_route_socket create_netlink_socket_perms;
 	allow init_t self:netlink_selinux_socket create_socket_perms;
+	allow init_t self:unix_dgram_socket lock;
 
 	manage_files_pattern(init_t, init_var_run_t, init_var_run_t)
 	manage_lnk_files_pattern(init_t, init_var_run_t, init_var_run_t)

@@ -260,6 +261,8 @@ ifdef(`init_systemd',`
 	# mount-setup
 	fs_unmount_autofs(init_t)
 	fs_getattr_pstore_dirs(init_t)
+	# for network namespaces
+	fs_read_nsfs_files(init_t)
 
 	# systemd_socket_activated policy
 	mls_socket_write_all_levels(init_t)

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

Miroslav Grepl

2016-01-11 18:31 UTC #2 lore raw

PATCH 1/1 Allow systemd services to use PrivateNetwork feature

Quoted 11 lines · Christopher J. PeBenito

Quoted 10 lines · Nicolas Iooss
systemd creates a new network namespace for services which are using PrivateNetwork=yes.
In the implementation, systemd uses a socketpair as a storage buffer for the namespace reference file descriptor (c.f.
https://github.com/systemd/systemd/blob/v228/src/core/namespace.c#L660).
One end of this socketpair is locked (hence the need of "lock" access to self:unix_dgram_socket for init_t) while systemd opens /proc/self/ns/net, which lives in nsfs.

Quoted 3 lines

Quoted 1 line
While at it, add filesystem_type attribute to nsfs_t.
Merged.

Lukas,
could play around and make this change also for Fedora bugs to see if it works as expected?

Nicolas,
thank you for patches.

Quoted 73 lines

Quoted 71 lines



---
 policy/modules/kernel/filesystem.if | 17 +++++++++++++++++
 policy/modules/kernel/filesystem.te |  1 +
 policy/modules/system/init.te       |  3 +++
 3 files changed, 21 insertions(+)

policy/modules/kernel/filesystem.if +17 -0

index 99ad71f926b4..3455c2270942 100644
@@ -3360,6 +3360,23 @@ interface(`fs_rw_nfsd_fs',`
 
 ########################################
 ## <summary>
+##	Read nsfs inodes (e.g. /proc/pid/ns/uts)
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`fs_read_nsfs_files',`
+	gen_require(`
+		type nsfs_t;
+	')
+
+	allow $1 nsfs_t:file read_file_perms;
+')
+########################################
+## <summary>
 ##	Getattr on pstore dirs.
 ## </summary>
 ## <param name="domain">

policy/modules/kernel/filesystem.te +1 -0

index 920527ca9995..ae44d92f4f10 100644
@@ -126,6 +126,7 @@ fs_type(nfsd_fs_t)
 genfscon nfsd / gen_context(system_u:object_r:nfsd_fs_t,s0)
 
 type nsfs_t;
+fs_type(nsfs_t)
 genfscon nsfs / gen_context(system_u:object_r:nsfs_t,s0)
 
 type oprofilefs_t;

policy/modules/system/init.te +3 -0

index ea5530f55689..78031010d38c 100644
@@ -199,6 +199,7 @@ ifdef(`init_systemd',`
 	allow init_t self:netlink_kobject_uevent_socket create_socket_perms;
 	allow init_t self:netlink_route_socket create_netlink_socket_perms;
 	allow init_t self:netlink_selinux_socket create_socket_perms;
+	allow init_t self:unix_dgram_socket lock;
 
 	manage_files_pattern(init_t, init_var_run_t, init_var_run_t)
 	manage_lnk_files_pattern(init_t, init_var_run_t, init_var_run_t)

@@ -260,6 +261,8 @@ ifdef(`init_systemd',`
 	# mount-setup
 	fs_unmount_autofs(init_t)
 	fs_getattr_pstore_dirs(init_t)
+	# for network namespaces
+	fs_read_nsfs_files(init_t)
 
 	# systemd_socket_activated policy
 	mls_socket_write_all_levels(init_t)

Signature · 3 lines

Miroslav Grepl
Senior Software Engineer, SELinux Solutions
Red Hat, Inc.

Lukas Vrabec

2016-01-19 11:30 UTC #3 lore raw

PATCH 1/1 Allow systemd services to use PrivateNetwork feature

Quoted 12 lines · Miroslav Grepl

Quoted 11 lines · Christopher J. PeBenito
Quoted 10 lines · Nicolas Iooss
systemd creates a new network namespace for services which are using PrivateNetwork=yes.
In the implementation, systemd uses a socketpair as a storage buffer for the namespace reference file descriptor (c.f.
https://github.com/systemd/systemd/blob/v228/src/core/namespace.c#L660).
One end of this socketpair is locked (hence the need of "lock" access to self:unix_dgram_socket for init_t) while systemd opens /proc/self/ns/net, which lives in nsfs.

Quoted 8 lines

Quoted 3 lines
Quoted 1 line
While at it, add filesystem_type attribute to nsfs_t.
Merged.
Lukas,
could play around and make this change also for Fedora bugs to see if it works as expected?

Fixes available for Fedora 23 and Fedora Rawhide here:
http://koji.fedoraproject.org/koji/buildinfo?buildID=712094
http://koji.fedoraproject.org/koji/buildinfo?buildID=712091

Quoted 78 lines

Nicolas,
thank you for patches.

Quoted 73 lines

Quoted 71 lines



---
  policy/modules/kernel/filesystem.if | 17 +++++++++++++++++
  policy/modules/kernel/filesystem.te |  1 +
  policy/modules/system/init.te       |  3 +++
  3 files changed, 21 insertions(+)

policy/modules/kernel/filesystem.if +17 -0

index 99ad71f926b4..3455c2270942 100644
@@ -3360,6 +3360,23 @@ interface(`fs_rw_nfsd_fs',`
 
  ########################################
  ## <summary>
+##	Read nsfs inodes (e.g. /proc/pid/ns/uts)
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`fs_read_nsfs_files',`
+	gen_require(`
+		type nsfs_t;
+	')
+
+	allow $1 nsfs_t:file read_file_perms;
+')
+########################################
+## <summary>
  ##	Getattr on pstore dirs.
  ## </summary>
  ## <param name="domain">

policy/modules/kernel/filesystem.te +1 -0

index 920527ca9995..ae44d92f4f10 100644
@@ -126,6 +126,7 @@ fs_type(nfsd_fs_t)
  genfscon nfsd / gen_context(system_u:object_r:nfsd_fs_t,s0)
 
  type nsfs_t;
+fs_type(nsfs_t)
  genfscon nsfs / gen_context(system_u:object_r:nsfs_t,s0)
 
  type oprofilefs_t;

policy/modules/system/init.te +3 -0

index ea5530f55689..78031010d38c 100644
@@ -199,6 +199,7 @@ ifdef(`init_systemd',`
  	allow init_t self:netlink_kobject_uevent_socket create_socket_perms;
  	allow init_t self:netlink_route_socket create_netlink_socket_perms;
  	allow init_t self:netlink_selinux_socket create_socket_perms;
+	allow init_t self:unix_dgram_socket lock;
 
  	manage_files_pattern(init_t, init_var_run_t, init_var_run_t)
  	manage_lnk_files_pattern(init_t, init_var_run_t, init_var_run_t)

@@ -260,6 +261,8 @@ ifdef(`init_systemd',`
  	# mount-setup
  	fs_unmount_autofs(init_t)
  	fs_getattr_pstore_dirs(init_t)
+	# for network namespaces
+	fs_read_nsfs_files(init_t)
 
  	# systemd_socket_activated policy
  	mls_socket_write_all_levels(init_t)

Signature · 3 lines

Lukas Vrabec
SELinux Solutions
Red Hat, Inc.