Add hwloc-dump-hwdata SELinux policy

From: Grzegorz Andrejczuk <[email protected]>

New hwloc utility (hwloc-dump-hwdata) reads firmware entries and generates intermediate files to be used later by hwloc utils.

This cannot be done when MLS is in enforicing mode because SELinux blocks access to var_run_t for user_t.

/var/run/hwloc/knl_memoryside_cache The policy does the following:
- adds hwloc_dhwd_exec_t type for hwloc-dump-hwdata executable - adds hwloc_dhwd_t system domain with entry point in hwloc_dhwd_exec_t - allows hwloc_dhwd_exec_t to be run as application - allows hwloc_dhwd_t access sysfs - allows hwloc_dhwd_t to create dir and file in /var/run - makes transition for hwloc-dump-hwdata output file from var_run_t to var_t.

The data is derived from proprietary SMBIOS entries containing MCDRAM memory side cache configuration : cache size, associativity, inclusiveness and line size.

Signed-off-by Grzegorz Andrejczuk <[email protected]>

---

/usr/sbin/hwloc-dump-hwdata --
gen_context(system_u:object_r:hwloc_dhwd_exec_t,s0)

/var/run/hwloc(/.*)?
gen_context(system_u:object_r:hwloc_var_run_t,s0)

policy_module(hwloc,1.0.0)

attribute_role hwloc_roles; roleattribute system_r hwloc_roles;

type hwloc_dhwd_t; type hwloc_dhwd_exec_t; init_system_domain(hwloc_dhwd_t, hwloc_dhwd_exec_t) role hwloc_roles types hwloc_dhwd_t;

type hwloc_var_run_t; files_pid_file(hwloc_var_run_t)

allow hwloc_dhwd_t hwloc_var_run_t:dir manage_dir_perms; allow hwloc_dhwd_t hwloc_var_run_t:file manage_file_perms; files_pid_filetrans(hwloc_dhwd_t, hwloc_var_run_t, dir)

dev_read_sysfs(hwloc_dhwd_t)

## <summary>Dump topology and locality information from hardware tables.</summary>

######################################## ## <summary> ## Execute
hwloc dhwd in the mount hwloc dhwd domain. ## </summary> ## <param
name="domain"> ## <summary> ## Domain allowed to transition. ##
</summary> ## </param> # interface(hwloc_domtrans_hwloc_dhwd', gen_require(` type hwloc_dhwd_t, hwloc_dhwd_exec_t; ')

domtrans_pattern($1, hwloc_dhwd_exec_t, hwloc_dhwd_t) ')

######################################## ## <summary> ## Execute
hwloc dhwd in the hwloc dhwd domain, and ## allow the specified
role the hwloc dhwd domain. ## </summary> ## <param name="domain">
## <summary> ## Domain allowed to transition. ## </summary> ##
</param> ## <param name="role"> ## <summary> ## Role allowed
access. ## </summary> ## </param> ## <rolecap/> #
interface(hwloc_run_hwloc_dhwd', gen_require(` attribute_role hwloc_roles; ')

hwloc_domtrans_hwloc_dhwd($1) roleattribute $2 hwloc_roles; ')

######################################## ## <summary> ## Execute
hwloc dhwd in the caller domain. ## </summary> ## <param
name="domain"> ## <summary> ## Domain allowed access. ##
</summary> ## </param> # interface(hwloc_exec_hwloc_dhwd', gen_require(` type hwloc_dhwd_exec_t; ')

can_exec($1, hwloc_hdwd_exec_t) ')

######################################## ## <summary> ## Read
runtime files. ## </summary> ## <param name="domain"> ## <summary>
## Domain allowed access. ## </summary> ## </param> #
interface(hwloc_read_runtime_files', gen_require(` type hwloc_var_run_t; ')

files_search_pids($1) read_files_pattern($1, hwloc_var_run_t, hwloc_var_run_t) ')

######################################## ## <summary> ## Manage
runtime. ## </summary> ## <param name="domain"> ## <summary> ##
Domain allowed access. ## </summary> ## </param> #
interface(hwloc_manage_runtime', gen_require(` type hwloc_var_run_t; ')

files_rw_pid_dirs($1) allow $1 hwloc_var_run_t:dir manage_dir_perms; allow $1 hwloc_var_run_t:file manage_file_perms; allow $1 hwloc_var_run_t:lnk_file manage_lnk_file_perms; ')

optional_policy(` hwloc_run_hwloc_dhwd(sysadm_t, sysadm_r) hwloc_manage_runtime(sysadm_t) ')

optional_policy(` hwloc_exec_hwloc_dhwd(user_t)
hwloc_read_runtime_files(user_t) ')

optional_policy(` hwloc_exec_hwloc_dhwd(staff_t)
hwloc_read_runtime_files(staff_t) ')

Quoted 7 lines · gandrejc

From: Grzegorz Andrejczuk <[email protected]>

New hwloc utility (hwloc-dump-hwdata) reads firmware entries and generates intermediate files to be used later by hwloc utils.

This cannot be done when MLS is in enforicing mode because SELinux blocks access to var_run_t for user_t.

See below how i think this should be implemented. If any questions, let me know.

From: Grzegorz Andrejczuk <[email protected]>

New hwloc utility (hwloc-dump-hwdata) reads firmware entries and generates intermediate files to be used later by hwloc utils.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Quoted 2 lines · gandrejc

From: Grzegorz Andrejczuk <[email protected]>>

Quoted 2 lines

New hwloc utility (hwloc-dump-hwdata) reads firmware entries and generates intermediate files to be used later by hwloc utils.

Do these do what you want them to do?

http://oss.tresys.com/pipermail/refpolicy/2016-April/007935.html
http://oss.tresys.com/pipermail/refpolicy/2016-April/007936.html

The description is not accurate though. It should probably be:

"Provides a portable abstraction of the hierarchical topology of modern architectures."

Quoted 5 lines

Do these do what you want them to do?

http://oss.tresys.com/pipermail/refpolicy/2016-April/007935.html
http://oss.tresys.com/pipermail/refpolicy/2016-April/007936.html

Yes, thanks. Although we merged both changes in single policy module because we would not like to apply patches to RHEL MLS policy.

Quoted 4 lines

The description is not accurate though. It should probably be:

"Provides a portable abstraction of the hierarchical topology of modern architectures."

Policy is required for the part of the hwloc but general hwloc description could be added. Shall I post updated patch?

The Portable Hardware Locality (hwloc) software package provides a portable abstraction (across OS, versions, architectures, ...) of the hierarchical topology of modern architectures, including NUMA memory nodes, sockets, shared caches,
cores and simultaneous multithreading.
It also gathers various system attributes such as cache and memory

as well as the locality of I/O devices such as network interfaces, InfiniBand HCAs or GPUs.

New hwloc utility (hwloc-dump-hwdata) reads firmware entries and generates intermediate files to be used later by hwloc utils.

This cannot be done when MLS is in enforicing mode because SELinux blocks access to var_run_t for user_t.

The policy does the following:
- adds hwloc_dhwd_exec_t type for hwloc-dump-hwdata executable
- adds hwloc_dhwd_t system domain with entry point in hwloc_dhwd_exec_t
- allows hwloc_dhwd_exec_t to be run as application
- allows hwloc_dhwd_t access sysfs
- allows hwloc_dhwd_t to create dir and file in /var/run
- makes transition for hwloc-dump-hwdata output file from var_run_t to var_t.

The data is derived from proprietary SMBIOS entries containing MCDRAM

side cache configuration : cache size, associativity, inclusiveness and line size.

Signed-off-by Grzegorz Andrejczuk <[email protected]>

---
 hwloc.fc |   3 ++
 hwloc.if | 103

hwloc.if new file +69 -0

+
+########################################
+## <summary>
+##     Execute hwloc dhwd in the hwloc dhwd domain.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed to transition.
+##     </summary>
+## </param>
+#
+interface(`hwloc_domtrans_hwloc_dhwd',`
+       gen_require(`
+               type hwloc_dhwd_t, hwloc_dhwd_exec_t;
+       ')
+
+       domtrans_pattern($1, hwloc_dhwd_exec_t, hwloc_dhwd_t)
+')
+
+########################################
+## <summary>
+##     Execute hwloc dhwd in the hwloc dhwd domain, and
+##     allow the specified role the hwloc dhwd domain,
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed to transition.
+##     </summary>
+## </param>
+## <param name="role">
+##     <summary>
+##     Role allowed access.
+##     </summary>
+## </param>
+## <rolecap/>
+#
+interface(`hwloc_run_hwloc_dhwd',`
+       gen_require(`
+               attribute_role hwloc_dhwd_roles;
+       ')
+
+       hwloc_domtrans_hwloc_dhwd($1)
+       roleattribute $2 hwloc_dhwd_roles;
+')
+
+########################################
+## <summary>
+##     Execute hwloc dhwd in the caller domain.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`hwloc_exec_hwloc_dhwd',`
+       gen_require(`
+               type hwloc_dhwd_exec_t;
+       ')
+
+       can_exec($1, hwloc_dhwd_exec_t)
+')
+
+########################################
+## <summary>
+##     Manage hwloc runtime.
+## </summary>
+## <param name="domain">
+##     <summary>

hwloc.if new file +23 -0

+       allow $1 hwloc_var_run_t:dir manage_dir_perms;
+       allow $1 hwloc_var_run_t:file manage_file_perms;
+       allow $1 hwloc_var_run_t:lnk_file manage_lnk_file_perms;
+')
+
+########################################
+## <summary>
+##     Read hwloc runtime files.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`hwloc_read_runtime_files',`
+       gen_require(`
+               type hwloc_var_run_t;
+       ')
+
+       files_search_pids($1)
+       read_files_pattern($1, hwloc_var_run_t, hwloc_var_run_t)
+')

hwloc.te new file +28 -1

new file mode 100644
index 0000000..3465e3a
@@ -0,0 +1,28 @@
+policy_module(hwloc, 1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+attribute_role hwloc_dhwd_roles;
+roleattribute system_r hwloc_dhwd_roles;
+
+type hwloc_dhwd_t;
+type hwloc_dhwd_exec_t;
+init_system_domain(hwloc_dhwd_t, hwloc_dhwd_exec_t)
+role hwloc_dhwd_roles types hwloc_dhwd_t;
+
+type hwloc_var_run_t;
+files_pid_file(hwloc_var_run_t)
+
+########################################
+#
+# Local policy
+#
+
+allow hwloc_dhwd_t hwloc_var_run_t:dir manage_dir_perms;
+allow hwloc_dhwd_t hwloc_var_run_t:file manage_file_perms;
+files_pid_filetrans(hwloc_dhwd_t, hwloc_var_run_t, dir)
+
+dev_read_sysfs(hwloc_dhwd_t)
--

2.5.1

--------------------------------------------------------------------

Intel Technology Poland sp. z o.o.
ul. Slowackiego 173 | 80-298 Gdansk | Sad Rejonowy Gdansk Polnoc | VII

Ta wiadomosc wraz z zalacznikami jest przeznaczona dla okreslonego

przegladanie lub rozpowszechnianie jest zabronione.
This e-mail and any attachments may contain confidential material for the

others is strictly prohibited.

_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

Quoted 6 lines

+ +######################################## +## <summary> +## Manage hwloc runtime. +## </summary> +## <param name="domain">
+## <summary> +## Domain allowed access. +##
</summary> +## </param> +# +interface(hwloc_manage_runtime', +
gen_require(` + type hwloc_var_run_t; + ') +
+ files_rw_pid_dirs($1)

This seems wrong. Shouldn't it be a pid filetrans on 'hwloc'? There is no reason to give rw perms on everything in /run.

Quoted 8 lines · Jason Zaman

Quoted 6 lines

+ +######################################## +## <summary> +## Manage hwloc runtime. +## </summary> +## <param name="domain">
+## <summary> +## Domain allowed access. +##
</summary> +## </param> +# +interface(hwloc_manage_runtime',
+ gen_require(` + type hwloc_var_run_t; +
') + + files_rw_pid_dirs($1)

This seems wrong. Shouldn't it be a pid filetrans on 'hwloc'? There is no reason to give rw perms on everything in /run.

This is suitable for use with manual type transition

Example: mkdir -Z /var/run/hwloc

Mainly for sysadm

hwloc.if new file +3 -0

@@ -0,0 +1,103 @@
+## <summary>Dump topology and locality information from hardware tables.</summary>
+
+########################################

hwloc.if new file +10 -0

+########################################
+## <summary>
+##	Manage hwloc runtime.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#

hwloc.te new file +28 -0

new file mode 100644
index 0000000..3465e3a
@@ -0,0 +1,28 @@
+policy_module(hwloc, 1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+attribute_role hwloc_dhwd_roles;
+roleattribute system_r hwloc_dhwd_roles;
+
+type hwloc_dhwd_t;
+type hwloc_dhwd_exec_t;
+init_system_domain(hwloc_dhwd_t, hwloc_dhwd_exec_t)
+role hwloc_dhwd_roles types hwloc_dhwd_t;
+
+type hwloc_var_run_t;
+files_pid_file(hwloc_var_run_t)
+
+########################################
+#
+# Local policy
+#
+
+allow hwloc_dhwd_t hwloc_var_run_t:dir manage_dir_perms;
+allow hwloc_dhwd_t hwloc_var_run_t:file manage_file_perms;
+files_pid_filetrans(hwloc_dhwd_t, hwloc_var_run_t, dir)
+
+dev_read_sysfs(hwloc_dhwd_t)

Quoted 7 lines · gandrejc

--- /dev/null +++ b/hwloc.if @@ -0,0 +1,103 @@ +## <summary>Dump topology and locality information from hardware tables.</summary> + +######################################## +##
<summary> +## Execute hwloc dhwd in the hwloc dhwd domain. +##
</summary> +## <param name="domain"> +## <summary> +## Domain
allowed to transition. +## </summary> +## </param> +#
+interface(hwloc_domtrans_hwloc_dhwd',

I would name this hwloc_domtrans_dhwd.

Quoted 10 lines

+######################################## +## <summary> +## Manage hwloc runtime. +## </summary> +## <param name="domain">
+## <summary> +## Domain allowed access. +## </summary> +##
</param> +# +interface(hwloc_manage_runtime', + gen_require(` +
type hwloc_var_run_t; + ') + + files_rw_pid_dirs($1) + allow $1
hwloc_var_run_t:dir manage_dir_perms; + allow $1
hwloc_var_run_t:file manage_file_perms; + allow $1
hwloc_var_run_t:lnk_file manage_lnk_file_perms; +')

Are there subdirectories under /var/run/hwloc? If not, I would reduce the access to rw_dir_perms on hwloc_var_run_t dirs.

Additionally, since the tool itself seems to create the top level dir (based on the below filetrans in the .te), it doesn't seem appropriate for this interface allow the caller files_rw_pid_dirs(), but to simply search pid dirs. The rw_pid_dirs would more likely fall under a filetrans interface.

Quoted 10 lines

hwloc.te new file mode 100644 index renamed from hwloc.te +0 -0

0000000..3465e3a --- /dev/null +++ b/hwloc.te @@ -0,0 +1,28 @@

hwloc.te new file mode 100644 index renamed from hwloc.te +3 -0

+policy_module(hwloc, 1.0.0) + 
+######################################## +# +# Declarations +# 
+ +attribute_role hwloc_dhwd_roles; +roleattribute system_r

hwloc_dhwd_roles; + +type hwloc_dhwd_t; +type hwloc_dhwd_exec_t; +init_system_domain(hwloc_dhwd_t, hwloc_dhwd_exec_t) +role hwloc_dhwd_roles types hwloc_dhwd_t; + +type hwloc_var_run_t;

hwloc.te new file mode 100644 index

Quoted 6 lines

hwloc.te new file mode 100644 index renamed from hwloc.te +6 -0

+files_pid_file(hwloc_var_run_t) + 
+######################################## +# +# Local policy +# 
+ +allow hwloc_dhwd_t hwloc_var_run_t:dir manage_dir_perms; 
+allow hwloc_dhwd_t hwloc_var_run_t:file manage_file_perms; 
+files_pid_filetrans(hwloc_dhwd_t, hwloc_var_run_t, dir) + 
+dev_read_sysfs(hwloc_dhwd_t)

Quoted 14 lines · Christopher J. PeBenito

Quoted 8 lines · gandrejc

+######################################## +## <summary> +## Manage hwloc runtime. +## </summary> +## <param name="domain">
+## <summary> +## Domain allowed access. +## </summary> +##
</param> +# +interface(hwloc_manage_runtime', + gen_require(` +
type hwloc_var_run_t; + ') + + files_rw_pid_dirs($1) + allow $1
hwloc_var_run_t:dir manage_dir_perms; + allow $1
hwloc_var_run_t:file manage_file_perms; + allow $1
hwloc_var_run_t:lnk_file manage_lnk_file_perms; +')

Are there subdirectories under /var/run/hwloc? If not, I would reduce the access to rw_dir_perms on hwloc_var_run_t dirs.

Not that i am aware of but I would keep it atleast a little flexible. That is also why i added the lnk_file permissions.

Quoted 5 lines

Additionally, since the tool itself seems to create the top level dir (based on the below filetrans in the .te), it doesn't seem appropriate for this interface allow the caller files_rw_pid_dirs(), but to simply search pid dirs. The rw_pid_dirs would more likely fall under a filetrans interface.

By default the app probably creates /var/run/hwloc. However In my view callers of the interface should be able to create /var/run/hwloc as well with a manual type transition with mkdir -Z /var/run/hwloc if that is ever needed for whatever reason.

If the hwloc_manage_runtime() is used together with files_pid_filetrans($1, hwloc_var_run_t, dir) then the compiler will remove the duplicate files_rw_pid_dirs()

However if hwloc_manage_runtime() is used without files_pid_file_trans() then the caller can create /var/run/hwloc with a manual type transition (provided that he has access to setfscreatecon and compute_create (which nowadays is used by policycoreutils)

So yes this is definitely a matter of taste. I like to keep some room to manouver and this this is a reasonable compromise.

Quoted 18 lines · Dominick Grift

Quoted 16 lines · Christopher J. PeBenito

Quoted 9 lines · gandrejc

+######################################## +## <summary> +## Manage hwloc runtime. +## </summary> +## <param
name="domain"> +## <summary> +## Domain allowed access. +##
</summary> +## </param> +#
+interface(hwloc_manage_runtime', + gen_require(` + type
hwloc_var_run_t; + ') + + files_rw_pid_dirs($1) + allow $1
hwloc_var_run_t:dir manage_dir_perms; + allow $1
hwloc_var_run_t:file manage_file_perms; + allow $1
hwloc_var_run_t:lnk_file manage_lnk_file_perms; +')

Are there subdirectories under /var/run/hwloc? If not, I would reduce the access to rw_dir_perms on hwloc_var_run_t dirs.

Quoted 2 lines

Not that i am aware of but I would keep it atleast a little flexible. That is also why i added the lnk_file permissions.

I'm fine with the lnk_file permissions, but I see this interface as applying to the contents of the top level directory. Though if there are subdirectories, the're isn't a good enough reason to distinguish the top from sub directories.

Quoted 24 lines

Quoted 6 lines

Additionally, since the tool itself seems to create the top level dir (based on the below filetrans in the .te), it doesn't seem appropriate for this interface allow the caller files_rw_pid_dirs(), but to simply search pid dirs. The rw_pid_dirs would more likely fall under a filetrans interface.

By default the app probably creates /var/run/hwloc. However In my view callers of the interface should be able to create /var/run/hwloc as well with a manual type transition with mkdir -Z /var/run/hwloc if that is ever needed for whatever reason.

If the hwloc_manage_runtime() is used together with files_pid_filetrans($1, hwloc_var_run_t, dir) then the compiler will remove the duplicate files_rw_pid_dirs()

However if hwloc_manage_runtime() is used without files_pid_file_trans() then the caller can create /var/run/hwloc with a manual type transition (provided that he has access to setfscreatecon and compute_create (which nowadays is used by policycoreutils)

Quoted 2 lines

So yes this is definitely a matter of taste. I like to keep some room to manouver and this this is a reasonable compromise.

I understand the desire to be flexible, but this doesn't give us the chance to be more restrictive.

Ultimately I'm not persuaded simply because sysadm can already manage all these files. I'd like to reduce sysadm's access, but I think the blanket pid access makes sense. Splitting into two or three interfaces is more flexible from the policy writing perspective, and the flexible (from the runtime perspective) behavior you describe above is what is desired, then all of the interfaces can be called. Then we still have room for more restrictive cases.

Quoted 3 lines

So yes this is definitely a matter of taste. I like to keep some room to manouver and this this is a reasonable compromise.

I understand the desire to be flexible, but this doesn't give us the chance to be more restrictive.

Ultimately I'm not persuaded simply because sysadm can already manage all these files. I'd like to reduce sysadm's access, but I think the blanket pid access makes sense. Splitting into two or three interfaces is more flexible from the policy writing perspective, and the flexible (from the runtime perspective) behavior you describe above is what is desired, then all of the interfaces can be called. Then we still have room for more restrictive cases.

Quoted 7 lines · Christopher J. PeBenito

Quoted 3 lines

So yes this is definitely a matter of taste. I like to keep some room to manouver and this this is a reasonable compromise.

I understand the desire to be flexible, but this doesn't give us the chance to be more restrictive.

Quoted 8 lines

Ultimately I'm not persuaded simply because sysadm can already manage all these files. I'd like to reduce sysadm's access, but I think the blanket pid access makes sense. Splitting into two or three interfaces is more flexible from the policy writing perspective, and the flexible (from the runtime perspective) behavior you describe above is what is desired, then all of the interfaces can be called. Then we still have room for more restrictive cases.

So now that i have accepted your point of view let me explain why I do not do this with DSSP

I do not give blanket access to sysadm to maintain all of /var/run, this is part of my ".adm()" implementation.

managing services can be done on an individual level in DSSP so hwloc.adm() can manage /var/run/hwloc (and when i mean "manage" i mean rm -rf /var/run/hwloc && mkdir -Z /var/run/hwlok) but not /var/run/http

sysadm is (almost) merely the accumulation of all the ".adm()" macros available.
So if i would give sysadm blacket /var/run access then that would just be duplicate because sysadm can already manage it via the ".adm()" macro calls.

I think though that your approach explained above seems a little inconsistent with your desire to not give login users "blanket" access to user content via for example: userdom_manage_all_home_content() userdom_relabel_home_content()

In that instance you do want to give access on individual basis
example: firefox.manage_home_content() firefox.relabe_home_content()

Quoted 36 lines · Dominick Grift

Quoted 8 lines · Christopher J. PeBenito

Quoted 4 lines

So yes this is definitely a matter of taste. I like to keep some room to manouver and this this is a reasonable compromise.

I understand the desire to be flexible, but this doesn't give us the chance to be more restrictive.

Quoted 8 lines

Ultimately I'm not persuaded simply because sysadm can already manage all these files. I'd like to reduce sysadm's access, but I think the blanket pid access makes sense. Splitting into two or three interfaces is more flexible from the policy writing perspective, and the flexible (from the runtime perspective) behavior you describe above is what is desired, then all of the interfaces can be called. Then we still have room for more restrictive cases.

So now that i have accepted your point of view let me explain why I do not do this with DSSP

I do not give blanket access to sysadm to maintain all of /var/run, this is part of my ".adm()" implementation.

managing services can be done on an individual level in DSSP so hwloc.adm() can manage /var/run/hwloc (and when i mean "manage" i mean rm -rf /var/run/hwloc && mkdir -Z /var/run/hwlok) but not /var/run/http

sysadm is (almost) merely the accumulation of all the ".adm()" macros available. So if i would give sysadm blacket /var/run access then that would just be duplicate because sysadm can already manage it via the ".adm()" macro calls.

Quoted 8 lines

I think though that your approach explained above seems a little inconsistent with your desire to not give login users "blanket" access to user content via for example:
userdom_manage_all_home_content() userdom_relabel_home_content()

In that instance you do want to give access on individual basis
example: firefox.manage_home_content() firefox.relabe_home_content()

This is a good point; I would prefer that sysadm also be a collection calls to admin() interfaces too, and it has slowly been moving that way. Hopefully we we will be able to eliminate the blanket access some time in the future. However, the interface we're talking about is not the hwloc_admin() interface. I would be fine changing this interface into the hwloc_admin() interface.

The Portable Hardware Locality (hwloc) software package provides a portable abstraction (across OS, versions, architectures, ...) of the hierarchical topology of modern architectures, including NUMA memory nodes, sockets, shared caches, cores and simultaneous multithreading. It also gathers various system attributes such as cache and memory information as well as the locality of I/O devices such as network interfaces, InfiniBand HCAs or GPUs.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Quoted 7 lines · gandrejc

The Portable Hardware Locality (hwloc) software package provides a portable abstraction (across OS, versions, architectures, ...) of the hierarchical topology of modern architectures, including NUMA memory nodes, sockets, shared caches, cores and simultaneous multithreading. It also gathers various system attributes such as cache and memory information as well as the locality of I/O devices such as network interfaces, InfiniBand HCAs or GPUs.

grzegorz, I imagine that by now you may be a little confused by this discussion. Therefore I am willing to create a new patch with some of the considerations mentioned > in this threat applied.

I would need some information though that i cannot find myself. Your policy implies that hwloc-dhwd can be run as a system service. However the system service > > > > initscript and/or service unit is not taken into consideration. what is the exact location of this script? Once I know that , then i can redo the patch with that part taken into account and hopefully take away the remaining concerns.

Quoted 18 lines

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256

Quoted 8 lines · gandrejc

The Portable Hardware Locality (hwloc) software package provides a portable abstraction (across OS, versions, architectures, ...) of the hierarchical topology of modern architectures, including NUMA memory nodes, sockets, shared caches, cores and simultaneous multithreading. It also gathers various system attributes such as cache and memory information as well as the locality of I/O devices such as network interfaces, InfiniBand HCAs or GPUs.

grzegorz, I imagine that by now you may be a little confused by this discussion. Therefore I am willing to create a new patch with some of the considerations mentioned > in this threat applied.

Quoted 7 lines

I would need some information though that i cannot find myself. Your policy implies that hwloc-dhwd can be run as a system service. However the system service > > > > initscript and/or service unit is not taken into consideration. what is the exact location of this script? Once I know that , then i can redo the patch with that part taken into account and hopefully take away the remaining concerns.

We support system only, unit file is hwloc-dump-hwdata.service is installed to default systemd unit location (on RedHat /usr/lib/systemd/system). The unit file looks like this: [Unit] Description=Dump hardware topology and locality information to /var/run/hwloc

[Service] Type=oneshot RemainAfterExit=yes ExecStart=/usr/sbin/hwloc-dump-hwdata -o /var/run/hwloc ExecStop=/usr/bin/rm -rf /var/run/hwloc

[Install] WantedBy=multi-user.target

- -- Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02

-----BEGIN PGP SIGNATURE----- Version: GnuPG v2

iQGcBAEBCAAGBQJXIRA6AAoJECV0jlU3+Udpm+gL/iXpQhK0Vknb9U5jyzCQ4FhH nzOvD2yfZhgVHdNt+D//OZ45fcZsyGFy1V4JPUpS703csgCzYzbTyvKq6rF0Wc3O TYZixv1WKx8l35SAN5nKvFBvv9b+WPcbxT4Rm6pzXUcH+TVJdi1inOpOqQ1dNF30 rruZEBkkOwW2wLyHa/W2APDD0iBG5M9roBL5NjN54H215J3iugt2lh+aJIFXhClZ JeMUTE10UAL2TvZiuNPmsDjmzsKfOZg0VrDuE4hYYlAvNz4CotZye/PX1izlZvVc oPn0kaCHfLoRR9Z1UiR4nLH+lzawUOLsoiskofo2cARxRU6MYy2u7OYFWVopDx46 +02/v7LgPVCHrBmJhLd4E5aBh2H2Y+QeomTHPYgg+uGOyW3oSEzoMubhciKOqGcZ n58ZCYsFnQmBNC9IGd1yLfJN4V+SOPEYKxHT2k2bvabNQFeZ4MXLp0Xl1FzrsRaI V9BrlYGOTQg5t5uBZmnWzDhs8KtTTJCoPEdbvDDAHA== =6m1E -----END PGP SIGNATURE-----
--------------------------------------------------------------------

Intel Technology Poland sp. z o.o. ul. Slowackiego 173 | 80-298
Gdansk | Sad Rejonowy Gdansk Polnoc | VII Wydzial Gospodarczy Krajowego Rejestru Sadowego - KRS 101882 | NIP 957-07-52-316 | Kapital zakladowy 200.000 PLN.

Ta wiadomosc wraz z zalacznikami jest przeznaczona dla okreslonego adresata i moze zawierac informacje poufne. W razie przypadkowego otrzymania tej wiadomosci, prosimy o powiadomienie nadawcy oraz trwale jej usuniecie; jakiekolwiek przegladanie lub rozpowszechnianie jest zabronione. This e-mail and any attachments may contain confidential material for the sole use of the intended recipient(s). If you are not the intended recipient, please contact the sender and delete all copies; any review or distribution by others is strictly prohibited.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Quoted 29 lines · Grzegorz

Quoted 16 lines

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256

Quoted 2 lines · gandrejc

The Portable Hardware Locality (hwloc) software package provides a portable abstraction (across OS, versions, architectures, ...) of

the hierarchical topology of modern architectures, including NUMA

Quoted 4 lines

memory nodes, sockets, shared caches, cores and simultaneous multithreading. It also gathers various system attributes such as cache and memory information as well as the locality of I/O devices such as network interfaces, InfiniBand HCAs or GPUs.

grzegorz, I imagine that by now you may be a little confused by this discussion. Therefore I am willing to create a new patch with some of the considerations mentioned > in this threat applied.

Quoted 6 lines

I would need some information though that i cannot find myself. Your policy implies that hwloc-dhwd can be run as a system service. However the system service > > > > initscript and/or service unit is not taken into consideration. what is the exact location of this script? Once I know that , then i can redo the patch with that part taken into account and hopefully take away the remaining concerns.

We support system only, unit file is hwloc-dump-hwdata.service is installed to default systemd unit location (on RedHat /usr/lib/systemd/system). The unit file looks like this: [Unit] Description=Dump hardware topology and locality information to /var/run/hwloc

Quoted 4 lines

[Service] Type=oneshot RemainAfterExit=yes ExecStart=/usr/sbin/hwloc-dump-hwdata -o /var/run/hwloc ExecStop=/usr/bin/rm -rf /var/run/hwloc

Okay, thanks. I will see if i can whip another patch up today.

By the way that ExecStop= is generally not such a good idea. Is that really required? Does it not just overwrite the files in there when you restart the service?

systemd will usually run generic coreutils like rm with a domain transition to the initrc_t domain. That means that initrc_t would need to be able to rm /var/run/hwloc. >This is sub-optimal.

Its bad enough that ExecStop is often used for kill $MAINPID with system d.

[Install] WantedBy=multi-user.target

- -- Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02

-----BEGIN PGP SIGNATURE----- Version: GnuPG v2

iQGcBAEBCAAGBQJXIRA6AAoJECV0jlU3+Udpm+gL/iXpQhK0Vknb9U5jyzCQ4FhH nzOvD2yfZhgVHdNt+D//OZ45fcZsyGFy1V4JPUpS703csgCzYzbTyvKq6rF0Wc3O TYZixv1WKx8l35SAN5nKvFBvv9b+WPcbxT4Rm6pzXUcH+TVJdi1inOpOqQ1dNF30 rruZEBkkOwW2wLyHa/W2APDD0iBG5M9roBL5NjN54H215J3iugt2lh+aJIFXhClZ JeMUTE10UAL2TvZiuNPmsDjmzsKfOZg0VrDuE4hYYlAvNz4CotZye/PX1izlZvVc oPn0kaCHfLoRR9Z1UiR4nLH+lzawUOLsoiskofo2cARxRU6MYy2u7OYFWVopDx46 +02/v7LgPVCHrBmJhLd4E5aBh2H2Y+QeomTHPYgg+uGOyW3oSEzoMubhciKOqGcZ n58ZCYsFnQmBNC9IGd1yLfJN4V+SOPEYKxHT2k2bvabNQFeZ4MXLp0Xl1FzrsRaI V9BrlYGOTQg5t5uBZmnWzDhs8KtTTJCoPEdbvDDAHA== =6m1E -----END PGP SIGNATURE-----
--------------------------------------------------------------------

Intel Technology Poland sp. z o.o. ul. Slowackiego 173 | 80-298
Gdansk | Sad Rejonowy Gdansk Polnoc | VII Wydzial Gospodarczy Krajowego Rejestru Sadowego - KRS 101882 | NIP 957-07-52-316 | Kapital zakladowy 200.000 PLN.

Ta wiadomosc wraz z zalacznikami jest przeznaczona dla okreslonego adresata i moze zawierac informacje poufne. W razie przypadkowego otrzymania tej wiadomosci, prosimy o powiadomienie nadawcy oraz trwale jej usuniecie; jakiekolwiek przegladanie lub rozpowszechnianie jest zabronione. This e-mail and any attachments may contain confidential material for the sole use of the intended recipient(s). If you are not the intended recipient, please contact the sender and delete all copies; any review or distribution by others is strictly prohibited.

The Portable Hardware Locality (hwloc) software package provides a portable abstraction (across OS, versions, architectures, ...) of the hierarchical topology of modern architectures, including NUMA memory nodes, sockets, shared caches, cores and simultaneous multithreading. It also gathers various system attributes such as cache and memory information as well as the locality of I/O devices such as network interfaces, InfiniBand HCAs or GPUs.

Following changes enable:
- add interface to change dirs in /var/run
- add optional policies for hwloc-dump-hwdata

V3:
Remove files_rw_pid_dirs()
Call hwloc_admin(sysadm_t) instead of hwloc_manage_runtime(sysadm_t) Adjust calls to renamed hwloc dhwd run and exec interfaces

Signed-off-by Dominick Grift <[email protected]>

---
 policy/modules/roles/sysadm.te      | 5 +++++
 policy/modules/system/userdomain.if | 5 +++++
 2 files changed, 10 insertions(+)

policy/modules/roles/sysadm.te +5 -0

index ceaa4cb..5bbb52c 100644
@@ -458,6 +458,11 @@ optional_policy(`
 ')
 
 optional_policy(`
+	hwloc_admin(sysadm_t)
+	hwloc_run_dhwd(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
 	howl_admin(sysadm_t, sysadm_r)
 ')
 

policy/modules/system/userdomain.if +5 -0

index cbb6e09..d604147 100644
@@ -619,6 +619,11 @@ template(`userdom_common_user_template',`
 	')
 
 	optional_policy(`
+		hwloc_exec_dhwd($1_t)
+		hwloc_read_runtime_files($1_t)
+	')
+
+	optional_policy(`
 		inetd_use_fds($1_t)
 		inetd_rw_tcp_sockets($1_t)
 	')

The Portable Hardware Locality (hwloc) software package provides a portable abstraction (across OS, versions, architectures, ...) of the hierarchical topology of modern architectures, including NUMA memory nodes, sockets, shared caches, cores and simultaneous multithreading. It also gathers various system attributes such as cache and memory information as well as the locality of I/O devices such as network interfaces, InfiniBand HCAs or GPUs.

Following changes enable:
- add interface to change dirs in /var/run
- add optional policies for hwloc-dump-hwdata

V3:
Remove files_rw_pid_dirs()
Call hwloc_admin(sysadm_t) instead of hwloc_manage_runtime(sysadm_t) Adjust calls to renamed hwloc dhwd run and exec interfaces

Signed-off-by Dominick Grift <[email protected]>

---
 policy/modules/roles/sysadm.te      | 5 +++++
 policy/modules/system/userdomain.if | 5 +++++
 2 files changed, 10 insertions(+)

policy/modules/roles/sysadm.te +5 -0

index ceaa4cb..5bbb52c 100644
@@ -458,6 +458,11 @@ optional_policy(`
 ')
 
 optional_policy(`
+	hwloc_admin(sysadm_t)
+	hwloc_run_dhwd(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
 	howl_admin(sysadm_t, sysadm_r)
 ')
 

policy/modules/system/userdomain.if +5 -0

index cbb6e09..d604147 100644
@@ -619,6 +619,11 @@ template(`userdom_common_user_template',`
 	')
 
 	optional_policy(`
+		hwloc_exec_dhwd($1_t)
+		hwloc_read_runtime_files($1_t)
+	')
+
+	optional_policy(`
 		inetd_use_fds($1_t)
 		inetd_rw_tcp_sockets($1_t)
 	')