add socket support to phpfpm and switched to sysnet_use_ldap with tunable

PATCH Superseded Matthew Thode 2 participants 7 messages Sep 25, 2012

Share & tools

Matthew Thode

author

2012-09-25 14:42 UTC #0 lore raw

PATCH v2 1/1 add socket support to phpfpm and switched to sysnet_use_ldap with tunable

Subject: [PATCH] added postgres and mysql socket support along with running
phpfpm on a socket. Also switched to sysnet_use_ldap (with the default being false for the tunable)

---
 policy/modules/contrib/phpfpm.fc |    2 +-
 policy/modules/contrib/phpfpm.if |   18 ++++++++++++++++++
 policy/modules/contrib/phpfpm.te |   23 ++++++++++++++++-------
 3 files changed, 35 insertions(+), 8 deletions(-)

(quoted diff) +0 -0

b/policy/modules/contrib/phpfpm.fc
index 536a5c7..51da02a 100644

policy/modules/contrib/phpfpm.fc +0 -0

@@ -1,5 +1,5 @@
 /usr/lib(64)?/php.*/bin/php-fpm

gen_context(system_u:object_r:phpfpm_exec_t,s0) +/var/run/php*-fpm/*.sock gen_context(system_u:object_r:phpfpm_var_run_t,s0)

/var/log/php-fpm.log gen_context(system_u:object_r:phpfpm_log_t,s0)
/var/run/php-fpm.pid gen_context(system_u:object_r:phpfpm_var_run_t,s0)
-

(quoted diff) +0 -0

b/policy/modules/contrib/phpfpm.if
index d9481d9..fee2c17 100644

policy/modules/contrib/phpfpm.if +18 -0

@@ -28,3 +28,21 @@ interface(`phpfpm_admin',`
 	files_list_pids($1)
 	admin_pattern($1, phpfpm_var_run_t)
 ')
+
+########################################
+## <summary>
+##      Connect to phpfpm using a unix domain stream socket.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+## <rolecap/>
+#
+interface(`phpfpm_stream_connect',`
+	gen_require(`
+		type phpfpm_t, phpfpm_var_run_t;
+	')
+	stream_connect_pattern($1, phpfpm_var_run_t, phpfpm_var_run_t, phpfpm_t)
+')

(quoted diff) +0 -0

b/policy/modules/contrib/phpfpm.te
index 2bd30d7..8758c01 100644

policy/modules/contrib/phpfpm.te +3 -1

@@ -5,6 +5,8 @@
 # Declarations
 #
 
+gen_tunable(phpfpm_use_ldap, false)
+
 type phpfpm_t;
 type phpfpm_exec_t;
 init_daemon_domain(phpfpm_t, phpfpm_exec_t)

@@ -28,7 +30,7 @@ allow phpfpm_t self:process signal;
 allow phpfpm_t self:capability { setuid setgid kill };
 allow phpfpm_t self:tcp_socket rw_stream_socket_perms;
 allow phpfpm_t self:udp_socket connected_socket_perms;
-allow phpfpm_t self:unix_stream_socket accept;
+allow phpfpm_t self:unix_stream_socket { accept

create_stream_socket_perms };

manage_files_pattern(phpfpm_t, phpfpm_log_t, phpfpm_log_t) logging_log_filetrans(phpfpm_t, phpfpm_log_t, file)
@@ -38,7 +40,9 @@ manage_dirs_pattern(phpfpm_t, phpfpm_tmp_t, phpfpm_tmp_t)
files_tmp_filetrans(phpfpm_t, phpfpm_tmp_t, {file dir})

manage_files_pattern(phpfpm_t, phpfpm_var_run_t, phpfpm_var_run_t)
-files_pid_filetrans(phpfpm_t, phpfpm_var_run_t, file) +files_pid_filetrans(phpfpm_t, phpfpm_var_run_t, { file sock_file }) +
+manage_sock_files_pattern(phpfpm_t, phpfpm_var_run_t, phpfpm_var_run_t)

kernel_read_kernel_sysctls(phpfpm_t)

@@ -48,10 +52,6 @@ corecmd_search_bin(phpfpm_t)
corenet_tcp_bind_all_unreserved_ports(phpfpm_t) corenet_tcp_bind_generic_node(phpfpm_t) corenet_tcp_bind_generic_port(phpfpm_t)
-# Comment was 'allow ldap connections' -> sysnet_use_ldap ? -# Also, if it was optional because the application optionally does it, perhaps
-# introduce a tunable for this? phpfpm_allow_ldap? -corenet_tcp_connect_ldap_port(phpfpm_t)

dev_read_rand(phpfpm_t)
dev_read_urand(phpfpm_t)
@@ -60,6 +60,8 @@ files_read_etc_files(phpfpm_t)
files_read_usr_files(phpfpm_t)
files_search_var_lib(phpfpm_t)

+fs_getattr_xattr_fs(phpfpm_t)
+
miscfiles_read_localization(phpfpm_t)

sysnet_dns_name_resolve(phpfpm_t)
@@ -73,10 +75,12 @@ apache_read_sys_content(phpfpm_t)
apache_dontaudit_search_modules(phpfpm_t)

optional_policy(`
+ mysql_stream_connect(phpfpm_t)
mysql_tcp_connect(phpfpm_t)
')

optional_policy(`
+ postgresql_stream_connect(phpfpm_t)
postgresql_tcp_connect(phpfpm_t)
')

@@ -84,3 +88,8 @@ optional_policy(`
snmp_read_snmp_var_lib_files(phpfpm_t)
')

+optional_policy(`
+ tunable_policy(phpfpm_use_ldap',
+ sysnet_use_ldap(phpfpm_t)
+ ')
+')

Signature · 12 lines

1.7.8.5

-- 
-- Matthew Thode

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: OpenPGP digital signature
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20120925/5dbe2a54/attachment.bin

Dominick Grift

2012-09-25 15:09 UTC #1 lore raw

PATCH v2 1/1 add socket support to phpfpm and switched to sysnet_use_ldap with tunable

Quoted 3 lines · Matthew Thode

Subject: [PATCH] added postgres and mysql socket support along with running
phpfpm on a socket. Also switched to sysnet_use_ldap (with the default being false for the tunable)

This seems to be a patch on a patch.

Fedora also has a phpfpm policy module that i will port to contrib soon (maybe tomorrow) When i do that i will probably also take some bits from your patches if you don't mind.

I am not sure about the ldap boolean as auth_use_nsswitch() also provides this functionality via the authlogin_nsswitch_use_ldap boolean so it seems reduntant to me.

Also have you tried (atleast some) of the database functionality? mysql maybe? I wonder whether mysql_stream_connect() is enough or whether it needs more like writing db sockets or reading mysql config

Some comments inline below

Quoted 13 lines

---
 policy/modules/contrib/phpfpm.fc |    2 +-
 policy/modules/contrib/phpfpm.if |   18 ++++++++++++++++++
 policy/modules/contrib/phpfpm.te |   23 ++++++++++++++++-------
 3 files changed, 35 insertions(+), 8 deletions(-)

policy/modules/contrib/phpfpm.fc +0 -0

index 536a5c7..51da02a 100644

policy/modules/contrib/phpfpm.fc line 4

Quoted 4 lines

policy/modules/contrib/phpfpm.fc +1 -0

@@ -1,5 +1,5 @@
 /usr/lib(64)?/php.*/bin/php-fpm	
 gen_context(system_u:object_r:phpfpm_exec_t,s0)
+/var/run/php*-fpm/*.sock	
 gen_context(system_u:object_r:phpfpm_var_run_t,s0)

A sock needs to be specified with -s, so example: "/var/run/php-fpm/.*\.sock -s gen_context(system_u:object_r:phpfpm_var_run_t,s0)"

single files need --, dirs need -d, links need -l etc

policy/modules/contrib/phpfpm.fc

Quoted 2 lines

policy/modules/contrib/phpfpm.fc +0 -0

 /var/log/php-fpm.log			gen_context(system_u:object_r:phpfpm_log_t,s0)
 /var/run/php-fpm.pid			gen_context(system_u:object_r:phpfpm_var_run_t,s0)

So these two above would need -- since they both single files

Quoted 17 lines

policy/modules/contrib/phpfpm.if +8 -0

index d9481d9..fee2c17 100644
@@ -28,3 +28,21 @@ interface(`phpfpm_admin',`
 	files_list_pids($1)
 	admin_pattern($1, phpfpm_var_run_t)
 ')
+
+########################################
+## <summary>
+##      Connect to phpfpm using a unix domain stream socket.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.

policy/modules/contrib/phpfpm.if interface(`phpfpm_admin',` · line 48

Quoted 10 lines

policy/modules/contrib/phpfpm.if +10 -0

+##      </summary>
+## </param>
+## <rolecap/>
+#
+interface(`phpfpm_stream_connect',`
+	gen_require(`
+		type phpfpm_t, phpfpm_var_run_t;
+	')
+	stream_connect_pattern($1, phpfpm_var_run_t, phpfpm_var_run_t, phpfpm_t)
+')

The above could use a files_search_pids($1) so that callers can get to phpfpm_var_run_t

Quoted 15 lines

policy/modules/contrib/phpfpm.te +2 -0

index 2bd30d7..8758c01 100644
@@ -5,6 +5,8 @@
 # Declarations
 #
 
+gen_tunable(phpfpm_use_ldap, false)
+
 type phpfpm_t;
 type phpfpm_exec_t;
 init_daemon_domain(phpfpm_t, phpfpm_exec_t)

policy/modules/contrib/phpfpm.te allow phpfpm_t self:process signal; · line 34

Quoted 6 lines

policy/modules/contrib/phpfpm.te +1 -1

@@ -28,7 +30,7 @@ allow phpfpm_t self:process signal;
 allow phpfpm_t self:capability { setuid setgid kill };
 allow phpfpm_t self:tcp_socket rw_stream_socket_perms;
 allow phpfpm_t self:udp_socket connected_socket_perms;
-allow phpfpm_t self:unix_stream_socket accept;
+allow phpfpm_t self:unix_stream_socket { accept
 create_stream_socket_perms };

In fedora phpfpm policy, phpfpm is allowed to send messages to syslog.
the logging send syslog msg() interface provides: allow $1 self:unix_stream_socket create_socket_perms; Thus thhe rule above can be: allow phpfpm_t self:unix_stream_socket { accept listen }; instead

It needs listen as far as i know to be able to accept

policy/modules/contrib/phpfpm.te manage_dirs_pattern(phpfpm_t, phpfpm_tmp_t, phpfpm_tmp_t) · line 45

Quoted 11 lines

policy/modules/contrib/phpfpm.te +3 -1

 manage_files_pattern(phpfpm_t, phpfpm_log_t, phpfpm_log_t)
 logging_log_filetrans(phpfpm_t, phpfpm_log_t, file)

@@ -38,7 +40,9 @@ manage_dirs_pattern(phpfpm_t, phpfpm_tmp_t, phpfpm_tmp_t)
 files_tmp_filetrans(phpfpm_t, phpfpm_tmp_t, {file dir})
 
 manage_files_pattern(phpfpm_t, phpfpm_var_run_t, phpfpm_var_run_t)
-files_pid_filetrans(phpfpm_t, phpfpm_var_run_t, file)
+files_pid_filetrans(phpfpm_t, phpfpm_var_run_t, { file sock_file })
+
+manage_sock_files_pattern(phpfpm_t, phpfpm_var_run_t, phpfpm_var_run_t)

This should go just above the files_pid_filetrans()

Quoted 51 lines

policy/modules/contrib/phpfpm.te +0 -2

 kernel_read_kernel_sysctls(phpfpm_t)

@@ -48,10 +52,6 @@ corecmd_search_bin(phpfpm_t)
 corenet_tcp_bind_all_unreserved_ports(phpfpm_t)
 corenet_tcp_bind_generic_node(phpfpm_t)
 corenet_tcp_bind_generic_port(phpfpm_t)
-# Comment was 'allow ldap connections' -> sysnet_use_ldap ?
-# Also, if it was optional because the application optionally does it,

perhaps

policy/modules/contrib/phpfpm.te +9 -2

-# introduce a tunable for this? phpfpm_allow_ldap?
-corenet_tcp_connect_ldap_port(phpfpm_t)
 
 dev_read_rand(phpfpm_t)
 dev_read_urand(phpfpm_t)

@@ -60,6 +60,8 @@ files_read_etc_files(phpfpm_t)
 files_read_usr_files(phpfpm_t)
 files_search_var_lib(phpfpm_t)
 
+fs_getattr_xattr_fs(phpfpm_t)
+
 miscfiles_read_localization(phpfpm_t)
 
 sysnet_dns_name_resolve(phpfpm_t)

@@ -73,10 +75,12 @@ apache_read_sys_content(phpfpm_t)
 apache_dontaudit_search_modules(phpfpm_t)
 
 optional_policy(`
+	mysql_stream_connect(phpfpm_t)
 	mysql_tcp_connect(phpfpm_t)
 ')
 
 optional_policy(`
+	postgresql_stream_connect(phpfpm_t)
 	postgresql_tcp_connect(phpfpm_t)
 ')

@@ -84,3 +88,8 @@ optional_policy(`
 	snmp_read_snmp_var_lib_files(phpfpm_t)
 ')
 
+optional_policy(`
+	tunable_policy(`phpfpm_use_ldap',`
+		sysnet_use_ldap(phpfpm_t)
+	')
+')

Signature · 4 lines

1.7.8.5

-- 
-- Matthew Thode

Thanks!

Quoted 4 lines

_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 836 bytes
Desc: not available
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20120925/6b2be9b8/attachment.bin

Matthew Thode

author

2012-09-25 16:07 UTC #2 lore raw

PATCH v2 1/1 add socket support to phpfpm and switched to sysnet_use_ldap with tunable

Quoted 37 lines · Dominick Grift

Quoted 3 lines · Matthew Thode
Subject: [PATCH] added postgres and mysql socket support along with running
phpfpm on a socket. Also switched to sysnet_use_ldap (with the default being false for the tunable)
This seems to be a patch on a patch.
Fedora also has a phpfpm policy module that i will port to contrib soon (maybe tomorrow) When i do that i will probably also take some bits from your patches if you don't mind.
I am not sure about the ldap boolean as auth_use_nsswitch() also provides this functionality via the authlogin_nsswitch_use_ldap boolean so it seems reduntant to me.
Also have you tried (atleast some) of the database functionality? mysql maybe? I wonder whether mysql_stream_connect() is enough or whether it needs more like writing db sockets or reading mysql config
Some comments inline below
Quoted 13 lines
---
 policy/modules/contrib/phpfpm.fc |    2 +-
 policy/modules/contrib/phpfpm.if |   18 ++++++++++++++++++
 policy/modules/contrib/phpfpm.te |   23 ++++++++++++++++-------
 3 files changed, 35 insertions(+), 8 deletions(-)
policy/modules/contrib/phpfpm.fc +0 -0
index 536a5c7..51da02a 100644
policy/modules/contrib/phpfpm.fc line 4
Quoted 4 lines
policy/modules/contrib/phpfpm.fc +1 -0
@@ -1,5 +1,5 @@
 /usr/lib(64)?/php.*/bin/php-fpm	
 gen_context(system_u:object_r:phpfpm_exec_t,s0)
+/var/run/php*-fpm/*.sock	
 gen_context(system_u:object_r:phpfpm_var_run_t,s0)
A sock needs to be specified with -s, so example: "/var/run/php-fpm/.*\.sock -s gen_context(system_u:object_r:phpfpm_var_run_t,s0)"

Quoted 7 lines

single files need --, dirs need -d, links need -l etc
policy/modules/contrib/phpfpm.fc
Quoted 2 lines
policy/modules/contrib/phpfpm.fc +0 -0
 /var/log/php-fpm.log			gen_context(system_u:object_r:phpfpm_log_t,s0)
 /var/run/php-fpm.pid			gen_context(system_u:object_r:phpfpm_var_run_t,s0)
So these two above would need -- since they both single files

updated the file context to the have -s and the like.

Quoted 21 lines

policy/modules/contrib/phpfpm.if +12 -0

index d9481d9..fee2c17 100644
@@ -28,3 +28,21 @@ interface(`phpfpm_admin',`
 	files_list_pids($1)
 	admin_pattern($1, phpfpm_var_run_t)
 ')
+
+########################################
+## <summary>
+##      Connect to phpfpm using a unix domain stream socket.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+## <rolecap/>
+#

Quoted 9 lines

policy/modules/contrib/phpfpm.if interface(`phpfpm_admin',` · line 48
Quoted 6 lines
policy/modules/contrib/phpfpm.if +6 -0
+interface(`phpfpm_stream_connect',`
+	gen_require(`
+		type phpfpm_t, phpfpm_var_run_t;
+	')
+	stream_connect_pattern($1, phpfpm_var_run_t, phpfpm_var_run_t, phpfpm_t)
+')
The above could use a files_search_pids($1) so that callers can get to phpfpm_var_run_t

added it right after the stream_connect_pattern()

Quoted 34 lines

Quoted 15 lines
policy/modules/contrib/phpfpm.te +2 -0
index 2bd30d7..8758c01 100644
@@ -5,6 +5,8 @@
 # Declarations
 #
 
+gen_tunable(phpfpm_use_ldap, false)
+
 type phpfpm_t;
 type phpfpm_exec_t;
 init_daemon_domain(phpfpm_t, phpfpm_exec_t)
policy/modules/contrib/phpfpm.te allow phpfpm_t self:process signal; · line 34
Quoted 6 lines
policy/modules/contrib/phpfpm.te +1 -1
@@ -28,7 +30,7 @@ allow phpfpm_t self:process signal;
 allow phpfpm_t self:capability { setuid setgid kill };
 allow phpfpm_t self:tcp_socket rw_stream_socket_perms;
 allow phpfpm_t self:udp_socket connected_socket_perms;
-allow phpfpm_t self:unix_stream_socket accept;
+allow phpfpm_t self:unix_stream_socket { accept
 create_stream_socket_perms };
In fedora phpfpm policy, phpfpm is allowed to send messages to syslog.
the logging send syslog msg() interface provides: allow $1 self:unix_stream_socket create_socket_perms; Thus thhe rule above can be: allow phpfpm_t self:unix_stream_socket { accept listen }; instead
It needs listen as far as i know to be able to accept
Quoted 5 lines
policy/modules/contrib/phpfpm.te +0 -0
 manage_files_pattern(phpfpm_t, phpfpm_log_t, phpfpm_log_t)
 logging_log_filetrans(phpfpm_t, phpfpm_log_t, file)
@@ -38,7 +40,9 @@ manage_dirs_pattern(phpfpm_t, phpfpm_tmp_t, phpfpm_tmp_t)
 files_tmp_filetrans(phpfpm_t, phpfpm_tmp_t, {file dir})

Quoted 7 lines

policy/modules/contrib/phpfpm.te manage_dirs_pattern(phpfpm_t, phpfpm_tmp_t, phpfpm_tmp_t) · line 44
Quoted 5 lines
policy/modules/contrib/phpfpm.te +3 -1
 manage_files_pattern(phpfpm_t, phpfpm_var_run_t, phpfpm_var_run_t)
-files_pid_filetrans(phpfpm_t, phpfpm_var_run_t, file)
+files_pid_filetrans(phpfpm_t, phpfpm_var_run_t, { file sock_file })
+
+manage_sock_files_pattern(phpfpm_t, phpfpm_var_run_t, phpfpm_var_run_t)
This should go just above the files_pid_filetrans()

what do you mean by that? do you mean that this files_pid_filetrans(phpfpm_t, phpfpm_var_run_t, { file sock_file }) should be
files_pid_filetrans()
or that this
files_pid_filetrans(phpfpm_t, phpfpm_var_run_t, { file sock_file })

manage_sock_files_pattern(phpfpm_t, phpfpm_var_run_t, phpfpm_var_run_t) should be this, I assume the first one? files_pid_filetrans()

Quoted 62 lines

Quoted 52 lines

policy/modules/contrib/phpfpm.te +0 -2

 kernel_read_kernel_sysctls(phpfpm_t)

@@ -48,10 +52,6 @@ corecmd_search_bin(phpfpm_t)
 corenet_tcp_bind_all_unreserved_ports(phpfpm_t)
 corenet_tcp_bind_generic_node(phpfpm_t)
 corenet_tcp_bind_generic_port(phpfpm_t)
-# Comment was 'allow ldap connections' -> sysnet_use_ldap ?
-# Also, if it was optional because the application optionally does it,

perhaps

policy/modules/contrib/phpfpm.te +9 -2

-# introduce a tunable for this? phpfpm_allow_ldap?
-corenet_tcp_connect_ldap_port(phpfpm_t)
 
 dev_read_rand(phpfpm_t)
 dev_read_urand(phpfpm_t)

@@ -60,6 +60,8 @@ files_read_etc_files(phpfpm_t)
 files_read_usr_files(phpfpm_t)
 files_search_var_lib(phpfpm_t)
 
+fs_getattr_xattr_fs(phpfpm_t)
+
 miscfiles_read_localization(phpfpm_t)
 
 sysnet_dns_name_resolve(phpfpm_t)

@@ -73,10 +75,12 @@ apache_read_sys_content(phpfpm_t)
 apache_dontaudit_search_modules(phpfpm_t)
 
 optional_policy(`
+	mysql_stream_connect(phpfpm_t)
 	mysql_tcp_connect(phpfpm_t)
 ')
 
 optional_policy(`
+	postgresql_stream_connect(phpfpm_t)
 	postgresql_tcp_connect(phpfpm_t)
 ')

@@ -84,3 +88,8 @@ optional_policy(`
 	snmp_read_snmp_var_lib_files(phpfpm_t)
 ')
 
+optional_policy(`
+	tunable_policy(`phpfpm_use_ldap',`
+		sysnet_use_ldap(phpfpm_t)
+	')
+')

Signature · 4 lines

1.7.8.5

-- 
-- Matthew Thode

Thanks!

Quoted 4 lines

_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

Quoted 5 lines

_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

It was my understanding that my previous patch was accepted. It's fine if you pull stuff out of this for that, though I think it may be best if we focus on one module instead of two doing the same thing :D

I've used this policy with postgres (as has another person who may be commenting) but not mysql.

I'm prometheanfire on irc (freenode) if you want to work on it with me.

Signature · 9 lines

-- Matthew Thode

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: OpenPGP digital signature
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20120925/d5224e31/attachment.bin

Dominick Grift

2012-09-25 16:37 UTC #3 lore raw

PATCH v2 1/1 add socket support to phpfpm and switched to sysnet_use_ldap with tunable

Quoted 130 lines · Matthew Thode

Quoted 37 lines · Dominick Grift
Quoted 3 lines · Matthew Thode
Subject: [PATCH] added postgres and mysql socket support along with running
phpfpm on a socket. Also switched to sysnet_use_ldap (with the default being false for the tunable)
This seems to be a patch on a patch.
Fedora also has a phpfpm policy module that i will port to contrib soon (maybe tomorrow) When i do that i will probably also take some bits from your patches if you don't mind.
I am not sure about the ldap boolean as auth_use_nsswitch() also provides this functionality via the authlogin_nsswitch_use_ldap boolean so it seems reduntant to me.
Also have you tried (atleast some) of the database functionality? mysql maybe? I wonder whether mysql_stream_connect() is enough or whether it needs more like writing db sockets or reading mysql config
Some comments inline below
Quoted 13 lines
---
 policy/modules/contrib/phpfpm.fc |    2 +-
 policy/modules/contrib/phpfpm.if |   18 ++++++++++++++++++
 policy/modules/contrib/phpfpm.te |   23 ++++++++++++++++-------
 3 files changed, 35 insertions(+), 8 deletions(-)
policy/modules/contrib/phpfpm.fc +0 -0
index 536a5c7..51da02a 100644
policy/modules/contrib/phpfpm.fc line 4
Quoted 4 lines
policy/modules/contrib/phpfpm.fc +1 -0
@@ -1,5 +1,5 @@
 /usr/lib(64)?/php.*/bin/php-fpm	
 gen_context(system_u:object_r:phpfpm_exec_t,s0)
+/var/run/php*-fpm/*.sock	
 gen_context(system_u:object_r:phpfpm_var_run_t,s0)
A sock needs to be specified with -s, so example: "/var/run/php-fpm/.*\.sock -s gen_context(system_u:object_r:phpfpm_var_run_t,s0)"
Quoted 7 lines
single files need --, dirs need -d, links need -l etc
policy/modules/contrib/phpfpm.fc
Quoted 2 lines
policy/modules/contrib/phpfpm.fc +0 -0
 /var/log/php-fpm.log			gen_context(system_u:object_r:phpfpm_log_t,s0)
 /var/run/php-fpm.pid			gen_context(system_u:object_r:phpfpm_var_run_t,s0)
So these two above would need -- since they both single files
updated the file context to the have -s and the like.
Quoted 21 lines
Quoted 21 lines
policy/modules/contrib/phpfpm.if +12 -0
index d9481d9..fee2c17 100644
@@ -28,3 +28,21 @@ interface(`phpfpm_admin',`
 	files_list_pids($1)
 	admin_pattern($1, phpfpm_var_run_t)
 ')
+
+########################################
+## <summary>
+##      Connect to phpfpm using a unix domain stream socket.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+## <rolecap/>
+#
Quoted 9 lines
policy/modules/contrib/phpfpm.if interface(`phpfpm_admin',` · line 48
Quoted 6 lines
policy/modules/contrib/phpfpm.if +6 -0
+interface(`phpfpm_stream_connect',`
+	gen_require(`
+		type phpfpm_t, phpfpm_var_run_t;
+	')
+	stream_connect_pattern($1, phpfpm_var_run_t, phpfpm_var_run_t, phpfpm_t)
+')
The above could use a files_search_pids($1) so that callers can get to phpfpm_var_run_t
added it right after the stream_connect_pattern()
Quoted 34 lines
Quoted 15 lines
policy/modules/contrib/phpfpm.te +2 -0
index 2bd30d7..8758c01 100644
@@ -5,6 +5,8 @@
 # Declarations
 #
 
+gen_tunable(phpfpm_use_ldap, false)
+
 type phpfpm_t;
 type phpfpm_exec_t;
 init_daemon_domain(phpfpm_t, phpfpm_exec_t)
policy/modules/contrib/phpfpm.te allow phpfpm_t self:process signal; · line 34
Quoted 6 lines
policy/modules/contrib/phpfpm.te +1 -1
@@ -28,7 +30,7 @@ allow phpfpm_t self:process signal;
 allow phpfpm_t self:capability { setuid setgid kill };
 allow phpfpm_t self:tcp_socket rw_stream_socket_perms;
 allow phpfpm_t self:udp_socket connected_socket_perms;
-allow phpfpm_t self:unix_stream_socket accept;
+allow phpfpm_t self:unix_stream_socket { accept
 create_stream_socket_perms };
In fedora phpfpm policy, phpfpm is allowed to send messages to syslog.
the logging send syslog msg() interface provides: allow $1 self:unix_stream_socket create_socket_perms; Thus thhe rule above can be: allow phpfpm_t self:unix_stream_socket { accept listen }; instead
It needs listen as far as i know to be able to accept
Quoted 5 lines
policy/modules/contrib/phpfpm.te +0 -0
 manage_files_pattern(phpfpm_t, phpfpm_log_t, phpfpm_log_t)
 logging_log_filetrans(phpfpm_t, phpfpm_log_t, file)
@@ -38,7 +40,9 @@ manage_dirs_pattern(phpfpm_t, phpfpm_tmp_t, phpfpm_tmp_t)
 files_tmp_filetrans(phpfpm_t, phpfpm_tmp_t, {file dir})
Quoted 7 lines
policy/modules/contrib/phpfpm.te manage_dirs_pattern(phpfpm_t, phpfpm_tmp_t, phpfpm_tmp_t) · line 44
Quoted 5 lines
policy/modules/contrib/phpfpm.te +3 -1
 manage_files_pattern(phpfpm_t, phpfpm_var_run_t, phpfpm_var_run_t)
-files_pid_filetrans(phpfpm_t, phpfpm_var_run_t, file)
+files_pid_filetrans(phpfpm_t, phpfpm_var_run_t, { file sock_file })
+
+manage_sock_files_pattern(phpfpm_t, phpfpm_var_run_t, phpfpm_var_run_t)
This should go just above the files_pid_filetrans()
what do you mean by that? do you mean that this files_pid_filetrans(phpfpm_t, phpfpm_var_run_t, { file sock_file }) should be
files_pid_filetrans()
or that this
files_pid_filetrans(phpfpm_t, phpfpm_var_run_t, { file sock_file })

Quoted 3 lines

manage_sock_files_pattern(phpfpm_t, phpfpm_var_run_t, phpfpm_var_run_t) should be this, I assume the first one? files_pid_filetrans()

Sorry , no mean that:

manage_sock_files_pattern(phpfpm_t, phpfpm_var_run_t, phpfpm_var_run_t)

should be above

files_pid_filetrans(phpfpm_t, phpfpm_var_run_t, { file sock_file })

like so:

manage_files_pattern(phpfpm_t, phpfpm_var_run_t, phpfpm_var_run_t) manage_sock_files_pattern(phpfpm_t, phpfpm_var_run_t, phpfpm_var_run_t) files_pid_filetrans(phpfpm_t, phpfpm_var_run_t, { file sock_file })

minor style issue, nothing too important

Quoted 69 lines

Quoted 63 lines

Quoted 53 lines

policy/modules/contrib/phpfpm.te +0 -2

 kernel_read_kernel_sysctls(phpfpm_t)

@@ -48,10 +52,6 @@ corecmd_search_bin(phpfpm_t)
 corenet_tcp_bind_all_unreserved_ports(phpfpm_t)
 corenet_tcp_bind_generic_node(phpfpm_t)
 corenet_tcp_bind_generic_port(phpfpm_t)
-# Comment was 'allow ldap connections' -> sysnet_use_ldap ?
-# Also, if it was optional because the application optionally does it,

perhaps

policy/modules/contrib/phpfpm.te +9 -2

-# introduce a tunable for this? phpfpm_allow_ldap?
-corenet_tcp_connect_ldap_port(phpfpm_t)
 
 dev_read_rand(phpfpm_t)
 dev_read_urand(phpfpm_t)

@@ -60,6 +60,8 @@ files_read_etc_files(phpfpm_t)
 files_read_usr_files(phpfpm_t)
 files_search_var_lib(phpfpm_t)
 
+fs_getattr_xattr_fs(phpfpm_t)
+
 miscfiles_read_localization(phpfpm_t)
 
 sysnet_dns_name_resolve(phpfpm_t)

@@ -73,10 +75,12 @@ apache_read_sys_content(phpfpm_t)
 apache_dontaudit_search_modules(phpfpm_t)
 
 optional_policy(`
+	mysql_stream_connect(phpfpm_t)
 	mysql_tcp_connect(phpfpm_t)
 ')
 
 optional_policy(`
+	postgresql_stream_connect(phpfpm_t)
 	postgresql_tcp_connect(phpfpm_t)
 ')

@@ -84,3 +88,8 @@ optional_policy(`
 	snmp_read_snmp_var_lib_files(phpfpm_t)
 ')
 
+optional_policy(`
+	tunable_policy(`phpfpm_use_ldap',`
+		sysnet_use_ldap(phpfpm_t)
+	')
+')

Signature · 4 lines

1.7.8.5

-- 
-- Matthew Thode

Thanks!

Quoted 4 lines

_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

Quoted 5 lines

_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

Quoted 19 lines

It was my understanding that my previous patch was accepted. It's fine if you pull stuff out of this for that, though I think it may be best if we focus on one module instead of two doing the same thing :D
I've used this policy with postgres (as has another person who may be commenting) but not mysql.
I'm prometheanfire on irc (freenode) if you want to work on it with me.
Signature · 9 lines
-- Matthew Thode




_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

Dominick Grift

2012-09-25 16:43 UTC #4 lore raw

PATCH v2 1/1 add socket support to phpfpm and switched to sysnet_use_ldap with tunable

In reply to Matthew Thode

Quoted 130 lines · Matthew Thode

Quoted 37 lines · Dominick Grift
Quoted 3 lines · Matthew Thode
Subject: [PATCH] added postgres and mysql socket support along with running
phpfpm on a socket. Also switched to sysnet_use_ldap (with the default being false for the tunable)
This seems to be a patch on a patch.
Fedora also has a phpfpm policy module that i will port to contrib soon (maybe tomorrow) When i do that i will probably also take some bits from your patches if you don't mind.
I am not sure about the ldap boolean as auth_use_nsswitch() also provides this functionality via the authlogin_nsswitch_use_ldap boolean so it seems reduntant to me.
Also have you tried (atleast some) of the database functionality? mysql maybe? I wonder whether mysql_stream_connect() is enough or whether it needs more like writing db sockets or reading mysql config
Some comments inline below
Quoted 13 lines
---
 policy/modules/contrib/phpfpm.fc |    2 +-
 policy/modules/contrib/phpfpm.if |   18 ++++++++++++++++++
 policy/modules/contrib/phpfpm.te |   23 ++++++++++++++++-------
 3 files changed, 35 insertions(+), 8 deletions(-)
policy/modules/contrib/phpfpm.fc +0 -0
index 536a5c7..51da02a 100644
policy/modules/contrib/phpfpm.fc line 4
Quoted 4 lines
policy/modules/contrib/phpfpm.fc +1 -0
@@ -1,5 +1,5 @@
 /usr/lib(64)?/php.*/bin/php-fpm	
 gen_context(system_u:object_r:phpfpm_exec_t,s0)
+/var/run/php*-fpm/*.sock	
 gen_context(system_u:object_r:phpfpm_var_run_t,s0)
A sock needs to be specified with -s, so example: "/var/run/php-fpm/.*\.sock -s gen_context(system_u:object_r:phpfpm_var_run_t,s0)"
Quoted 7 lines
single files need --, dirs need -d, links need -l etc
policy/modules/contrib/phpfpm.fc
Quoted 2 lines
policy/modules/contrib/phpfpm.fc +0 -0
 /var/log/php-fpm.log			gen_context(system_u:object_r:phpfpm_log_t,s0)
 /var/run/php-fpm.pid			gen_context(system_u:object_r:phpfpm_var_run_t,s0)
So these two above would need -- since they both single files
updated the file context to the have -s and the like.
Quoted 21 lines
Quoted 21 lines
policy/modules/contrib/phpfpm.if +12 -0
index d9481d9..fee2c17 100644
@@ -28,3 +28,21 @@ interface(`phpfpm_admin',`
 	files_list_pids($1)
 	admin_pattern($1, phpfpm_var_run_t)
 ')
+
+########################################
+## <summary>
+##      Connect to phpfpm using a unix domain stream socket.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+## <rolecap/>
+#
Quoted 9 lines
policy/modules/contrib/phpfpm.if interface(`phpfpm_admin',` · line 48
Quoted 6 lines
policy/modules/contrib/phpfpm.if +6 -0
+interface(`phpfpm_stream_connect',`
+	gen_require(`
+		type phpfpm_t, phpfpm_var_run_t;
+	')
+	stream_connect_pattern($1, phpfpm_var_run_t, phpfpm_var_run_t, phpfpm_t)
+')
The above could use a files_search_pids($1) so that callers can get to phpfpm_var_run_t
added it right after the stream_connect_pattern()
Quoted 34 lines
Quoted 15 lines
policy/modules/contrib/phpfpm.te +2 -0
index 2bd30d7..8758c01 100644
@@ -5,6 +5,8 @@
 # Declarations
 #
 
+gen_tunable(phpfpm_use_ldap, false)
+
 type phpfpm_t;
 type phpfpm_exec_t;
 init_daemon_domain(phpfpm_t, phpfpm_exec_t)
policy/modules/contrib/phpfpm.te allow phpfpm_t self:process signal; · line 34
Quoted 6 lines
policy/modules/contrib/phpfpm.te +1 -1
@@ -28,7 +30,7 @@ allow phpfpm_t self:process signal;
 allow phpfpm_t self:capability { setuid setgid kill };
 allow phpfpm_t self:tcp_socket rw_stream_socket_perms;
 allow phpfpm_t self:udp_socket connected_socket_perms;
-allow phpfpm_t self:unix_stream_socket accept;
+allow phpfpm_t self:unix_stream_socket { accept
 create_stream_socket_perms };
In fedora phpfpm policy, phpfpm is allowed to send messages to syslog.
the logging send syslog msg() interface provides: allow $1 self:unix_stream_socket create_socket_perms; Thus thhe rule above can be: allow phpfpm_t self:unix_stream_socket { accept listen }; instead
It needs listen as far as i know to be able to accept
Quoted 5 lines
policy/modules/contrib/phpfpm.te +0 -0
 manage_files_pattern(phpfpm_t, phpfpm_log_t, phpfpm_log_t)
 logging_log_filetrans(phpfpm_t, phpfpm_log_t, file)
@@ -38,7 +40,9 @@ manage_dirs_pattern(phpfpm_t, phpfpm_tmp_t, phpfpm_tmp_t)
 files_tmp_filetrans(phpfpm_t, phpfpm_tmp_t, {file dir})
Quoted 7 lines
policy/modules/contrib/phpfpm.te manage_dirs_pattern(phpfpm_t, phpfpm_tmp_t, phpfpm_tmp_t) · line 44
Quoted 5 lines
policy/modules/contrib/phpfpm.te +3 -1
 manage_files_pattern(phpfpm_t, phpfpm_var_run_t, phpfpm_var_run_t)
-files_pid_filetrans(phpfpm_t, phpfpm_var_run_t, file)
+files_pid_filetrans(phpfpm_t, phpfpm_var_run_t, { file sock_file })
+
+manage_sock_files_pattern(phpfpm_t, phpfpm_var_run_t, phpfpm_var_run_t)
This should go just above the files_pid_filetrans()
what do you mean by that? do you mean that this files_pid_filetrans(phpfpm_t, phpfpm_var_run_t, { file sock_file }) should be
files_pid_filetrans()
or that this
files_pid_filetrans(phpfpm_t, phpfpm_var_run_t, { file sock_file })

Quoted 3 lines

manage_sock_files_pattern(phpfpm_t, phpfpm_var_run_t, phpfpm_var_run_t) should be this, I assume the first one? files_pid_filetrans()

In this case you can even make it more efficient like so:

allow phpfpm_t phpfpm_var_run_t:file manage_file_perms; allow phpfpm_t phpfpm_var_run_t:sock_file manage_sock_file_perms; files_pid_filetrans(phpfpm_t, phpfpm_var_run_t, { file sock_file })

because there are no phpfpm_var_run_t directories involved
so the patterns you used above are a little too coarse (they add rules that do not apply here)

These day's we focus more and more on writing policy efficiently.
This is to keep the policy footprint as small as possible and thereby performance as optimal as possible

Quoted 69 lines

Quoted 63 lines

Quoted 53 lines

policy/modules/contrib/phpfpm.te +0 -2

 kernel_read_kernel_sysctls(phpfpm_t)

@@ -48,10 +52,6 @@ corecmd_search_bin(phpfpm_t)
 corenet_tcp_bind_all_unreserved_ports(phpfpm_t)
 corenet_tcp_bind_generic_node(phpfpm_t)
 corenet_tcp_bind_generic_port(phpfpm_t)
-# Comment was 'allow ldap connections' -> sysnet_use_ldap ?
-# Also, if it was optional because the application optionally does it,

perhaps

policy/modules/contrib/phpfpm.te +9 -2

-# introduce a tunable for this? phpfpm_allow_ldap?
-corenet_tcp_connect_ldap_port(phpfpm_t)
 
 dev_read_rand(phpfpm_t)
 dev_read_urand(phpfpm_t)

@@ -60,6 +60,8 @@ files_read_etc_files(phpfpm_t)
 files_read_usr_files(phpfpm_t)
 files_search_var_lib(phpfpm_t)
 
+fs_getattr_xattr_fs(phpfpm_t)
+
 miscfiles_read_localization(phpfpm_t)
 
 sysnet_dns_name_resolve(phpfpm_t)

@@ -73,10 +75,12 @@ apache_read_sys_content(phpfpm_t)
 apache_dontaudit_search_modules(phpfpm_t)
 
 optional_policy(`
+	mysql_stream_connect(phpfpm_t)
 	mysql_tcp_connect(phpfpm_t)
 ')
 
 optional_policy(`
+	postgresql_stream_connect(phpfpm_t)
 	postgresql_tcp_connect(phpfpm_t)
 ')

@@ -84,3 +88,8 @@ optional_policy(`
 	snmp_read_snmp_var_lib_files(phpfpm_t)
 ')
 
+optional_policy(`
+	tunable_policy(`phpfpm_use_ldap',`
+		sysnet_use_ldap(phpfpm_t)
+	')
+')

Signature · 4 lines

1.7.8.5

-- 
-- Matthew Thode

Thanks!

Quoted 4 lines

_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

Quoted 5 lines

_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

Quoted 19 lines

It was my understanding that my previous patch was accepted. It's fine if you pull stuff out of this for that, though I think it may be best if we focus on one module instead of two doing the same thing :D
I've used this policy with postgres (as has another person who may be commenting) but not mysql.
I'm prometheanfire on irc (freenode) if you want to work on it with me.
Signature · 9 lines
-- Matthew Thode




_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

Matthew Thode

author

2012-09-25 20:21 UTC #5 lore raw

PATCH v2 1/1 add socket support to phpfpm and switched to sysnet_use_ldap with tunable

Quoted 239 lines · Dominick Grift

Quoted 130 lines · Matthew Thode
Quoted 37 lines · Dominick Grift
Quoted 3 lines · Matthew Thode
Subject: [PATCH] added postgres and mysql socket support along with running
phpfpm on a socket. Also switched to sysnet_use_ldap (with the default being false for the tunable)
This seems to be a patch on a patch.
Fedora also has a phpfpm policy module that i will port to contrib soon (maybe tomorrow) When i do that i will probably also take some bits from your patches if you don't mind.
I am not sure about the ldap boolean as auth_use_nsswitch() also provides this functionality via the authlogin_nsswitch_use_ldap boolean so it seems reduntant to me.
Also have you tried (atleast some) of the database functionality? mysql maybe? I wonder whether mysql_stream_connect() is enough or whether it needs more like writing db sockets or reading mysql config
Some comments inline below
Quoted 13 lines
---
 policy/modules/contrib/phpfpm.fc |    2 +-
 policy/modules/contrib/phpfpm.if |   18 ++++++++++++++++++
 policy/modules/contrib/phpfpm.te |   23 ++++++++++++++++-------
 3 files changed, 35 insertions(+), 8 deletions(-)
policy/modules/contrib/phpfpm.fc +0 -0
index 536a5c7..51da02a 100644
policy/modules/contrib/phpfpm.fc line 4
Quoted 4 lines
policy/modules/contrib/phpfpm.fc +1 -0
@@ -1,5 +1,5 @@
 /usr/lib(64)?/php.*/bin/php-fpm	
 gen_context(system_u:object_r:phpfpm_exec_t,s0)
+/var/run/php*-fpm/*.sock	
 gen_context(system_u:object_r:phpfpm_var_run_t,s0)
A sock needs to be specified with -s, so example: "/var/run/php-fpm/.*\.sock -s gen_context(system_u:object_r:phpfpm_var_run_t,s0)"
Quoted 7 lines
single files need --, dirs need -d, links need -l etc
policy/modules/contrib/phpfpm.fc
Quoted 2 lines
policy/modules/contrib/phpfpm.fc +0 -0
 /var/log/php-fpm.log			gen_context(system_u:object_r:phpfpm_log_t,s0)
 /var/run/php-fpm.pid			gen_context(system_u:object_r:phpfpm_var_run_t,s0)
So these two above would need -- since they both single files
updated the file context to the have -s and the like.
Quoted 21 lines
Quoted 21 lines
policy/modules/contrib/phpfpm.if +12 -0
index d9481d9..fee2c17 100644
@@ -28,3 +28,21 @@ interface(`phpfpm_admin',`
 	files_list_pids($1)
 	admin_pattern($1, phpfpm_var_run_t)
 ')
+
+########################################
+## <summary>
+##      Connect to phpfpm using a unix domain stream socket.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+## <rolecap/>
+#
Quoted 9 lines
policy/modules/contrib/phpfpm.if interface(`phpfpm_admin',` · line 48
Quoted 6 lines
policy/modules/contrib/phpfpm.if +6 -0
+interface(`phpfpm_stream_connect',`
+	gen_require(`
+		type phpfpm_t, phpfpm_var_run_t;
+	')
+	stream_connect_pattern($1, phpfpm_var_run_t, phpfpm_var_run_t, phpfpm_t)
+')
The above could use a files_search_pids($1) so that callers can get to phpfpm_var_run_t
added it right after the stream_connect_pattern()
Quoted 34 lines
Quoted 15 lines
policy/modules/contrib/phpfpm.te +2 -0
index 2bd30d7..8758c01 100644
@@ -5,6 +5,8 @@
 # Declarations
 #
 
+gen_tunable(phpfpm_use_ldap, false)
+
 type phpfpm_t;
 type phpfpm_exec_t;
 init_daemon_domain(phpfpm_t, phpfpm_exec_t)
policy/modules/contrib/phpfpm.te allow phpfpm_t self:process signal; · line 34
Quoted 6 lines
policy/modules/contrib/phpfpm.te +1 -1
@@ -28,7 +30,7 @@ allow phpfpm_t self:process signal;
 allow phpfpm_t self:capability { setuid setgid kill };
 allow phpfpm_t self:tcp_socket rw_stream_socket_perms;
 allow phpfpm_t self:udp_socket connected_socket_perms;
-allow phpfpm_t self:unix_stream_socket accept;
+allow phpfpm_t self:unix_stream_socket { accept
 create_stream_socket_perms };
In fedora phpfpm policy, phpfpm is allowed to send messages to syslog.
the logging send syslog msg() interface provides: allow $1 self:unix_stream_socket create_socket_perms; Thus thhe rule above can be: allow phpfpm_t self:unix_stream_socket { accept listen }; instead
It needs listen as far as i know to be able to accept
Quoted 5 lines
policy/modules/contrib/phpfpm.te +0 -0
 manage_files_pattern(phpfpm_t, phpfpm_log_t, phpfpm_log_t)
 logging_log_filetrans(phpfpm_t, phpfpm_log_t, file)
@@ -38,7 +40,9 @@ manage_dirs_pattern(phpfpm_t, phpfpm_tmp_t, phpfpm_tmp_t)
 files_tmp_filetrans(phpfpm_t, phpfpm_tmp_t, {file dir})
Quoted 7 lines
policy/modules/contrib/phpfpm.te manage_dirs_pattern(phpfpm_t, phpfpm_tmp_t, phpfpm_tmp_t) · line 44
Quoted 5 lines
policy/modules/contrib/phpfpm.te +3 -1
 manage_files_pattern(phpfpm_t, phpfpm_var_run_t, phpfpm_var_run_t)
-files_pid_filetrans(phpfpm_t, phpfpm_var_run_t, file)
+files_pid_filetrans(phpfpm_t, phpfpm_var_run_t, { file sock_file })
+
+manage_sock_files_pattern(phpfpm_t, phpfpm_var_run_t, phpfpm_var_run_t)
This should go just above the files_pid_filetrans()
what do you mean by that? do you mean that this files_pid_filetrans(phpfpm_t, phpfpm_var_run_t, { file sock_file }) should be
files_pid_filetrans()
or that this
files_pid_filetrans(phpfpm_t, phpfpm_var_run_t, { file sock_file })
Quoted 3 lines
manage_sock_files_pattern(phpfpm_t, phpfpm_var_run_t, phpfpm_var_run_t) should be this, I assume the first one? files_pid_filetrans()
In this case you can even make it more efficient like so:
allow phpfpm_t phpfpm_var_run_t:file manage_file_perms; allow phpfpm_t phpfpm_var_run_t:sock_file manage_sock_file_perms; files_pid_filetrans(phpfpm_t, phpfpm_var_run_t, { file sock_file })
because there are no phpfpm_var_run_t directories involved
so the patterns you used above are a little too coarse (they add rules that do not apply here)
These day's we focus more and more on writing policy efficiently.
This is to keep the policy footprint as small as possible and thereby performance as optimal as possible
Quoted 69 lines
Quoted 63 lines
Quoted 53 lines
policy/modules/contrib/phpfpm.te +0 -2
 kernel_read_kernel_sysctls(phpfpm_t)
 
@@ -48,10 +52,6 @@ corecmd_search_bin(phpfpm_t)
 corenet_tcp_bind_all_unreserved_ports(phpfpm_t)
 corenet_tcp_bind_generic_node(phpfpm_t)
 corenet_tcp_bind_generic_port(phpfpm_t)
-# Comment was 'allow ldap connections' -> sysnet_use_ldap ?
-# Also, if it was optional because the application optionally does it,
perhaps
policy/modules/contrib/phpfpm.te +9 -2
-# introduce a tunable for this? phpfpm_allow_ldap?
-corenet_tcp_connect_ldap_port(phpfpm_t)
 
 dev_read_rand(phpfpm_t)
 dev_read_urand(phpfpm_t)
@@ -60,6 +60,8 @@ files_read_etc_files(phpfpm_t)
 files_read_usr_files(phpfpm_t)
 files_search_var_lib(phpfpm_t)
 
+fs_getattr_xattr_fs(phpfpm_t)
+
 miscfiles_read_localization(phpfpm_t)
 
 sysnet_dns_name_resolve(phpfpm_t)
@@ -73,10 +75,12 @@ apache_read_sys_content(phpfpm_t)
 apache_dontaudit_search_modules(phpfpm_t)
 
 optional_policy(`
+	mysql_stream_connect(phpfpm_t)
 	mysql_tcp_connect(phpfpm_t)
 ')
 
 optional_policy(`
+	postgresql_stream_connect(phpfpm_t)
 	postgresql_tcp_connect(phpfpm_t)
 ')
 
@@ -84,3 +88,8 @@ optional_policy(`
 	snmp_read_snmp_var_lib_files(phpfpm_t)
 ')
 
+optional_policy(`
+	tunable_policy(`phpfpm_use_ldap',`
+		sysnet_use_ldap(phpfpm_t)
+	')
+')
Signature · 4 lines
1.7.8.5

-- 
-- Matthew Thode
Thanks!
Quoted 4 lines
_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy
Quoted 5 lines
_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy
Quoted 19 lines
It was my understanding that my previous patch was accepted. It's fine if you pull stuff out of this for that, though I think it may be best if we focus on one module instead of two doing the same thing :D
I've used this policy with postgres (as has another person who may be commenting) but not mysql.
I'm prometheanfire on irc (freenode) if you want to work on it with me.
Signature · 9 lines
-- Matthew Thode




_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

Quoted 5 lines

_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

Ok, and how about working on this together?

Signature · 9 lines

-- Matthew Thode

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: OpenPGP digital signature
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20120925/c717ec22/attachment.bin

Dominick Grift

2012-09-25 21:02 UTC #6 lore raw

PATCH v2 1/1 add socket support to phpfpm and switched to sysnet_use_ldap with tunable

Quoted 240 lines · Matthew Thode

Quoted 239 lines · Dominick Grift
Quoted 130 lines · Matthew Thode
Quoted 37 lines · Dominick Grift
Quoted 3 lines · Matthew Thode
Subject: [PATCH] added postgres and mysql socket support along with running
phpfpm on a socket. Also switched to sysnet_use_ldap (with the default being false for the tunable)
This seems to be a patch on a patch.
Fedora also has a phpfpm policy module that i will port to contrib soon (maybe tomorrow) When i do that i will probably also take some bits from your patches if you don't mind.
I am not sure about the ldap boolean as auth_use_nsswitch() also provides this functionality via the authlogin_nsswitch_use_ldap boolean so it seems reduntant to me.
Also have you tried (atleast some) of the database functionality? mysql maybe? I wonder whether mysql_stream_connect() is enough or whether it needs more like writing db sockets or reading mysql config
Some comments inline below
Quoted 13 lines
---
 policy/modules/contrib/phpfpm.fc |    2 +-
 policy/modules/contrib/phpfpm.if |   18 ++++++++++++++++++
 policy/modules/contrib/phpfpm.te |   23 ++++++++++++++++-------
 3 files changed, 35 insertions(+), 8 deletions(-)
policy/modules/contrib/phpfpm.fc +0 -0
index 536a5c7..51da02a 100644
policy/modules/contrib/phpfpm.fc line 4
Quoted 4 lines
policy/modules/contrib/phpfpm.fc +1 -0
@@ -1,5 +1,5 @@
 /usr/lib(64)?/php.*/bin/php-fpm	
 gen_context(system_u:object_r:phpfpm_exec_t,s0)
+/var/run/php*-fpm/*.sock	
 gen_context(system_u:object_r:phpfpm_var_run_t,s0)
A sock needs to be specified with -s, so example: "/var/run/php-fpm/.*\.sock -s gen_context(system_u:object_r:phpfpm_var_run_t,s0)"
Quoted 7 lines
single files need --, dirs need -d, links need -l etc
policy/modules/contrib/phpfpm.fc
Quoted 2 lines
policy/modules/contrib/phpfpm.fc +0 -0
 /var/log/php-fpm.log			gen_context(system_u:object_r:phpfpm_log_t,s0)
 /var/run/php-fpm.pid			gen_context(system_u:object_r:phpfpm_var_run_t,s0)
So these two above would need -- since they both single files
updated the file context to the have -s and the like.
Quoted 21 lines
Quoted 21 lines
policy/modules/contrib/phpfpm.if +12 -0
index d9481d9..fee2c17 100644
@@ -28,3 +28,21 @@ interface(`phpfpm_admin',`
 	files_list_pids($1)
 	admin_pattern($1, phpfpm_var_run_t)
 ')
+
+########################################
+## <summary>
+##      Connect to phpfpm using a unix domain stream socket.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+## <rolecap/>
+#
Quoted 9 lines
policy/modules/contrib/phpfpm.if interface(`phpfpm_admin',` · line 48
Quoted 6 lines
policy/modules/contrib/phpfpm.if +6 -0
+interface(`phpfpm_stream_connect',`
+	gen_require(`
+		type phpfpm_t, phpfpm_var_run_t;
+	')
+	stream_connect_pattern($1, phpfpm_var_run_t, phpfpm_var_run_t, phpfpm_t)
+')
The above could use a files_search_pids($1) so that callers can get to phpfpm_var_run_t
added it right after the stream_connect_pattern()
Quoted 34 lines
Quoted 15 lines
policy/modules/contrib/phpfpm.te +2 -0
index 2bd30d7..8758c01 100644
@@ -5,6 +5,8 @@
 # Declarations
 #
 
+gen_tunable(phpfpm_use_ldap, false)
+
 type phpfpm_t;
 type phpfpm_exec_t;
 init_daemon_domain(phpfpm_t, phpfpm_exec_t)
policy/modules/contrib/phpfpm.te allow phpfpm_t self:process signal; · line 34
Quoted 6 lines
policy/modules/contrib/phpfpm.te +1 -1
@@ -28,7 +30,7 @@ allow phpfpm_t self:process signal;
 allow phpfpm_t self:capability { setuid setgid kill };
 allow phpfpm_t self:tcp_socket rw_stream_socket_perms;
 allow phpfpm_t self:udp_socket connected_socket_perms;
-allow phpfpm_t self:unix_stream_socket accept;
+allow phpfpm_t self:unix_stream_socket { accept
 create_stream_socket_perms };
In fedora phpfpm policy, phpfpm is allowed to send messages to syslog.
the logging send syslog msg() interface provides: allow $1 self:unix_stream_socket create_socket_perms; Thus thhe rule above can be: allow phpfpm_t self:unix_stream_socket { accept listen }; instead
It needs listen as far as i know to be able to accept
Quoted 5 lines
policy/modules/contrib/phpfpm.te +0 -0
 manage_files_pattern(phpfpm_t, phpfpm_log_t, phpfpm_log_t)
 logging_log_filetrans(phpfpm_t, phpfpm_log_t, file)
@@ -38,7 +40,9 @@ manage_dirs_pattern(phpfpm_t, phpfpm_tmp_t, phpfpm_tmp_t)
 files_tmp_filetrans(phpfpm_t, phpfpm_tmp_t, {file dir})
Quoted 7 lines
policy/modules/contrib/phpfpm.te manage_dirs_pattern(phpfpm_t, phpfpm_tmp_t, phpfpm_tmp_t) · line 44
Quoted 5 lines
policy/modules/contrib/phpfpm.te +3 -1
 manage_files_pattern(phpfpm_t, phpfpm_var_run_t, phpfpm_var_run_t)
-files_pid_filetrans(phpfpm_t, phpfpm_var_run_t, file)
+files_pid_filetrans(phpfpm_t, phpfpm_var_run_t, { file sock_file })
+
+manage_sock_files_pattern(phpfpm_t, phpfpm_var_run_t, phpfpm_var_run_t)
This should go just above the files_pid_filetrans()
what do you mean by that? do you mean that this files_pid_filetrans(phpfpm_t, phpfpm_var_run_t, { file sock_file }) should be
files_pid_filetrans()
or that this
files_pid_filetrans(phpfpm_t, phpfpm_var_run_t, { file sock_file })
Quoted 3 lines
manage_sock_files_pattern(phpfpm_t, phpfpm_var_run_t, phpfpm_var_run_t) should be this, I assume the first one? files_pid_filetrans()
In this case you can even make it more efficient like so:
allow phpfpm_t phpfpm_var_run_t:file manage_file_perms; allow phpfpm_t phpfpm_var_run_t:sock_file manage_sock_file_perms; files_pid_filetrans(phpfpm_t, phpfpm_var_run_t, { file sock_file })
because there are no phpfpm_var_run_t directories involved
so the patterns you used above are a little too coarse (they add rules that do not apply here)
These day's we focus more and more on writing policy efficiently.
This is to keep the policy footprint as small as possible and thereby performance as optimal as possible
Quoted 88 lines
Quoted 63 lines
Quoted 53 lines
policy/modules/contrib/phpfpm.te +0 -2
 kernel_read_kernel_sysctls(phpfpm_t)
 
@@ -48,10 +52,6 @@ corecmd_search_bin(phpfpm_t)
 corenet_tcp_bind_all_unreserved_ports(phpfpm_t)
 corenet_tcp_bind_generic_node(phpfpm_t)
 corenet_tcp_bind_generic_port(phpfpm_t)
-# Comment was 'allow ldap connections' -> sysnet_use_ldap ?
-# Also, if it was optional because the application optionally does it,
perhaps
policy/modules/contrib/phpfpm.te +9 -2
-# introduce a tunable for this? phpfpm_allow_ldap?
-corenet_tcp_connect_ldap_port(phpfpm_t)
 
 dev_read_rand(phpfpm_t)
 dev_read_urand(phpfpm_t)
@@ -60,6 +60,8 @@ files_read_etc_files(phpfpm_t)
 files_read_usr_files(phpfpm_t)
 files_search_var_lib(phpfpm_t)
 
+fs_getattr_xattr_fs(phpfpm_t)
+
 miscfiles_read_localization(phpfpm_t)
 
 sysnet_dns_name_resolve(phpfpm_t)
@@ -73,10 +75,12 @@ apache_read_sys_content(phpfpm_t)
 apache_dontaudit_search_modules(phpfpm_t)
 
 optional_policy(`
+	mysql_stream_connect(phpfpm_t)
 	mysql_tcp_connect(phpfpm_t)
 ')
 
 optional_policy(`
+	postgresql_stream_connect(phpfpm_t)
 	postgresql_tcp_connect(phpfpm_t)
 ')
 
@@ -84,3 +88,8 @@ optional_policy(`
 	snmp_read_snmp_var_lib_files(phpfpm_t)
 ')
 
+optional_policy(`
+	tunable_policy(`phpfpm_use_ldap',`
+		sysnet_use_ldap(phpfpm_t)
+	')
+')
Signature · 4 lines
1.7.8.5

-- 
-- Matthew Thode
Thanks!
Quoted 4 lines
_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy
Quoted 5 lines
_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy
It was my understanding that my previous patch was accepted. It's fine if you pull stuff out of this for that, though I think it may be best if we focus on one module instead of two doing the same thing :D
I've used this policy with postgres (as has another person who may be commenting) but not mysql.
I'm prometheanfire on irc (freenode) if you want to work on it with me.
Signature · 9 lines
-- Matthew Thode




_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

Quoted 6 lines

Quoted 5 lines
_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy
Ok, and how about working on this together?

I contacted you on irc

Quoted 11 lines

Signature · 10 lines

-- 
-- Matthew Thode




_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy