Mark wpa_cli as interactive application

PATCH Superseded Sven Vermeulen 2 participants 7 messages May 28, 2012 – Jun 20, 2012

Share & tools

Sven Vermeulen

author

2012-05-28 10:21 UTC #0 lore raw

cover Mark wpa_cli as interactive application

The wpa_cli application is an interactive application to interact with wpa_supplicant. This patch supports this within the SELinux policies.

Wkr,
Sven Vermeulen

Sven Vermeulen

author

2012-05-28 10:22 UTC #1 lore raw

PATCH 1/2 Mark wpa_cli as a commandline utility for admins

The wpa_cli application has two functions within the network manager
environment: (1.) it acts as a commandline interface for administrators to interact with wpa_supplicant, and (2.) it gets called from within init scripts to perform some administrative, unattended tasks.

In this patch, we mark the wpa_cli_t domain as an application domain, introduce a few interfaces to allow roles to run the wpa_cli application, and enhance the wpa_cli_t local policies to reflect its dual use.

Signed-off-by Sven Vermeulen <[email protected]>

---
 networkmanager.fc |    2 +
 networkmanager.if |   65 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 networkmanager.te |   38 ++++++++++++++++++++++++++++++-
 3 files changed, 104 insertions(+), 1 deletions(-)

networkmanager.fc +2 -0

index 386543b..c83ff26 100644
@@ -7,6 +7,7 @@
 /sbin/wpa_cli			--	gen_context(system_u:object_r:wpa_cli_exec_t,s0)
 /sbin/wpa_supplicant		--	gen_context(system_u:object_r:NetworkManager_exec_t,s0)
 
+/usr/bin/wpa_cli		--	gen_context(system_u:object_r:wpa_cli_exec_t,s0)
 /usr/s?bin/NetworkManager	--	gen_context(system_u:object_r:NetworkManager_exec_t,s0)
 /usr/s?bin/wpa_supplicant	--	gen_context(system_u:object_r:NetworkManager_exec_t,s0)
 /usr/sbin/NetworkManagerDispatcher --	gen_context(system_u:object_r:NetworkManager_exec_t,s0)

@@ -22,5 +23,6 @@
 /var/run/NetworkManager\.pid	--	gen_context(system_u:object_r:NetworkManager_var_run_t,s0)
 /var/run/NetworkManager(/.*)?		gen_context(system_u:object_r:NetworkManager_var_run_t,s0)
 /var/run/nm-dhclient.*			gen_context(system_u:object_r:NetworkManager_var_run_t,s0)
+/var/run/wpa_cli-.*		--	gen_context(system_u:object_r:wpa_cli_var_run_t,s0)
 /var/run/wpa_supplicant(/.*)?		gen_context(system_u:object_r:NetworkManager_var_run_t,s0)
 /var/run/wpa_supplicant-global	-s	gen_context(system_u:object_r:NetworkManager_var_run_t,s0)

networkmanager.if +65 -0

68 lines not on this page · raw message

networkmanager.te +37 -1

index 0619395..0cb8072 100644
@@ -28,6 +28,9 @@ type wpa_cli_t;
 type wpa_cli_exec_t;
 init_system_domain(wpa_cli_t, wpa_cli_exec_t)
 
+type wpa_cli_var_run_t;
+files_pid_file(wpa_cli_var_run_t)
+
 ########################################
 #
 # Local policy

@@ -68,6 +71,11 @@ manage_files_pattern(NetworkManager_t, NetworkManager_var_run_t, NetworkManager_
 manage_sock_files_pattern(NetworkManager_t, NetworkManager_var_run_t, NetworkManager_var_run_t)
 files_pid_filetrans(NetworkManager_t, NetworkManager_var_run_t, { dir file sock_file })
 
+manage_dirs_pattern(wpa_cli_t, wpa_cli_var_run_t, wpa_cli_var_run_t)
+manage_files_pattern(wpa_cli_t, wpa_cli_var_run_t, wpa_cli_var_run_t)
+manage_sock_files_pattern(wpa_cli_t, wpa_cli_var_run_t, wpa_cli_var_run_t)
+files_pid_filetrans(wpa_cli_t, wpa_cli_var_run_t, { dir file sock_file })
+
 kernel_read_system_state(NetworkManager_t)
 kernel_read_network_state(NetworkManager_t)
 kernel_read_kernel_sysctls(NetworkManager_t)

@@ -281,9 +289,37 @@ files_tmp_filetrans(wpa_cli_t, NetworkManager_tmp_t, sock_file)
 list_dirs_pattern(wpa_cli_t, NetworkManager_var_run_t, NetworkManager_var_run_t)
 rw_sock_files_pattern(wpa_cli_t, NetworkManager_var_run_t, NetworkManager_var_run_t)
 
+corecmd_exec_bin(wpa_cli_t)
+corecmd_exec_shell(wpa_cli_t)
+
+domain_use_interactive_fds(wpa_cli_t)
+
+files_search_pids(wpa_cli_t)
+
+fs_manage_tmpfs_dirs(wpa_cli_t)
+fs_manage_tmpfs_sockets(wpa_cli_t)
+fs_manage_tmpfs_sockets(NetworkManager_t)
+fs_rw_tmpfs_files(wpa_cli_t)
+fs_rw_tmpfs_files(NetworkManager_t)
+fs_search_tmpfs(wpa_cli_t)
+fs_search_tmpfs(NetworkManager_t)
+
+term_dontaudit_use_console(wpa_cli_t)
+
+getty_use_fds(wpa_cli_t)
+
+init_domtrans_script(wpa_cli_t)
 init_dontaudit_use_fds(wpa_cli_t)
 init_use_script_ptys(wpa_cli_t)
 
+logging_send_syslog_msg(wpa_cli_t)
+
 miscfiles_read_localization(wpa_cli_t)
 
-term_dontaudit_use_console(wpa_cli_t)
+userdom_use_user_terminals(wpa_cli_t)
+
+ifdef(`distro_gentoo',`
+       allow wpa_cli_t etc_t:file { getattr };
+
+       sysnet_domtrans_dhcpc(wpa_cli_t)
+')

Signature · 1 line

1.7.3.4

Dominick Grift

2012-05-28 13:54 UTC #2 lore raw

PATCH 1/2 Mark wpa_cli as a commandline utility for admins

Quoted 1 line · Sven Vermeulen

+/var/run/wpa_cli-.* -- gen_context(system_u:object_r:wpa_cli_var_run_t,s0)

This applies to files only (--). However there are also dirs and sock_files labeled wpi_cli_var_run_t. The context of those objects will not be restored as per above file context specification.

networkmanager.te manage_files_pattern(NetworkManager_t, NetworkManager_var_run_t, NetworkManager_ · line 78

Quoted 5 lines

networkmanager.te +5 -0

+manage_dirs_pattern(wpa_cli_t, wpa_cli_var_run_t, wpa_cli_var_run_t)
+manage_files_pattern(wpa_cli_t, wpa_cli_var_run_t, wpa_cli_var_run_t)
+manage_sock_files_pattern(wpa_cli_t, wpa_cli_var_run_t, wpa_cli_var_run_t)
+files_pid_filetrans(wpa_cli_t, wpa_cli_var_run_t, { dir file sock_file })
+

Not sure if it applies here but try to be conservative with type transitions. If any of the dir, file, sock_file security classes do no really need to type transition from var_run_t to wpa_cli_var_run_t, then i would not specify a type transition for it.

So if a dir /var/run/wpa-cli-bla gets created in /var/run and files and sock files get created in /var/run/wpa-cli-bla, then there really is no need to add type transition rules for files and sock_files in my view.

Quoted 1 line

+ allow wpa_cli_t etc_t:file { getattr };

you dont need brace extension here because there is nothing to extent. I would however use the getattr_file_perms permissions set for forward compatibility.

In the unlikely scenario that in the future a new av permission is introduced that is required to get attributes, it will be easier to integrate if you consistently use permission sets (single point of entry)

Sven Vermeulen

author

2012-06-20 15:48 UTC #3 lore raw

PATCH 1/2 Mark wpa_cli as a commandline utility for admins

Quoted 7 lines · Dominick Grift

Quoted 1 line · Sven Vermeulen
+/var/run/wpa_cli-.* -- gen_context(system_u:object_r:wpa_cli_var_run_t,s0)
This applies to files only (--). However there are also dirs and sock_files labeled wpi_cli_var_run_t. The context of those objects will not be restored as per above file context specification.

Hmm, on my system, it is only PID files directly in /var/run.

The socket is stored in /tmp (but is written/managed by wpa_supplicant, not wpa_cli).

I'll incorporate the other changes in the next try; if you know of any other locations (fc's) that I need to add in case of Fedora (or other systems), let me know and I'll add them in.

Wkr,
Sven Vermeulen

Dominick Grift

2012-06-20 16:02 UTC #4 lore raw

PATCH 1/2 Mark wpa_cli as a commandline utility for admins

Quoted 10 lines · Sven Vermeulen

Quoted 7 lines · Dominick Grift
Quoted 1 line · Sven Vermeulen
+/var/run/wpa_cli-.* -- gen_context(system_u:object_r:wpa_cli_var_run_t,s0)
This applies to files only (--). However there are also dirs and sock_files labeled wpi_cli_var_run_t. The context of those objects will not be restored as per above file context specification.
Hmm, on my system, it is only PID files directly in /var/run.

Thats not what your policy says:

networkmanager.te manage_files_pattern(NetworkManager_t, NetworkManager_var_run_t, NetworkManager_

Quoted 3 lines

networkmanager.te +3 -0

+manage_dirs_pattern(wpa_cli_t, wpa_cli_var_run_t, wpa_cli_var_run_t)
+manage_files_pattern(wpa_cli_t, wpa_cli_var_run_t, wpa_cli_var_run_t)
+manage_sock_files_pattern(wpa_cli_t, wpa_cli_var_run_t,

wpa_cli_var_run_t)

Quoted 1 line

+files_pid_filetrans(wpa_cli_t, wpa_cli_var_run_t, { dir file

sock_file })

The above is a type transition for dirs files and for sock_files So there is a conflict there if you ask me.

Quoted 13 lines

The socket is stored in /tmp (but is written/managed by wpa_supplicant, not wpa_cli).
I'll incorporate the other changes in the next try; if you know of any other locations (fc's) that I need to add in case of Fedora (or other systems), let me know and I'll add them in.
Wkr,
Sven Vermeulen
_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

Dominick Grift

2012-05-28 14:01 UTC #5 lore raw

PATCH 1/2 Mark wpa_cli as a commandline utility for admins

In reply to Sven Vermeulen

networkmanager.te files_tmp_filetrans(wpa_cli_t, NetworkManager_tmp_t, sock_file) · line 322

Quoted 2 lines · Sven Vermeulen

networkmanager.te +2 -0

+ifdef(`distro_gentoo',`
+       allow wpa_cli_t etc_t:file { getattr };

By the way: type etc_t is declared in the files module and is external to the networkmanager module. You should not make direct references to external types but use interfaces instead.

Sven Vermeulen

author

2012-05-28 10:22 UTC #6 lore raw

PATCH 2/2 Allow sysadm_r role to call wpa_cli

In reply to Sven Vermeulen

Allow system administrators to run wpa_cli to interact with wpa_supplicant.

Signed-off-by Sven Vermeulen <[email protected]>

---
 policy/modules/roles/sysadm.te |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)

policy/modules/roles/sysadm.te +4 -0

index bd5a2ea..3c74fcb 100644
@@ -241,6 +241,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	networkmanager_run_wpa_cli(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
 	netutils_run(sysadm_t, sysadm_r)
 	netutils_run_ping(sysadm_t, sysadm_r)
 	netutils_run_traceroute(sysadm_t, sysadm_r)

Signature · 1 line

1.7.3.4