From: Russell Coker <russell@coker.com.au>
To: selinux-refpolicy@vger.kernel.org
Subject: [PATCH] mls stuff
Date: Tue, 8 Jan 2019 19:52:40 +1100 [thread overview]
Message-ID: <20190108085240.GA28781@xev> (raw)
Here are the patches I used last time I tried to get MLS going on Debian.
Index: refpolicy-2.20180701/policy/modules/kernel/kernel.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/kernel/kernel.te
+++ refpolicy-2.20180701/policy/modules/kernel/kernel.te
@@ -39,6 +39,7 @@ role unconfined_r;
ifdef(`enable_mls',`
role secadm_r;
role auditadm_r;
+ mls_process_set_level(kernel_t)
')
#
Index: refpolicy-2.20180701/policy/modules/system/systemd.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/system/systemd.te
+++ refpolicy-2.20180701/policy/modules/system/systemd.te
@@ -251,7 +251,13 @@ systemd_log_parse_environment(systemd_gp
allow systemd_cgroups_t self:capability net_admin;
-kernel_domtrans_to(systemd_cgroups_t, systemd_cgroups_exec_t)
+ifdef(`enable_mls',`
+ kernel_ranged_domtrans_to(systemd_cgroups_t, systemd_cgroups_exec_t, s0 - mls_systemhigh)
+ mls_fd_use_all_levels(systemd_cgroups_t)
+',`
+ kernel_domtrans_to(systemd_cgroups_t, systemd_cgroups_exec_t)
+')
+
kernel_dgram_send(systemd_cgroups_t)
# for /proc/cmdline
kernel_read_system_state(systemd_cgroups_t)
Index: refpolicy-2.20180701/policy/modules/system/init.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/system/init.te
+++ refpolicy-2.20180701/policy/modules/system/init.te
@@ -191,6 +191,7 @@ mls_file_read_all_levels(init_t)
mls_file_write_all_levels(init_t)
mls_process_write_all_levels(init_t)
mls_fd_use_all_levels(init_t)
+mls_process_set_level(init_t)
# the following one is needed for libselinux:is_selinux_enabled()
# otherwise the call fails and sysvinit tries to load the policy
@@ -384,6 +385,8 @@ ifdef(`init_systemd',`
# systemd_socket_activated policy
mls_socket_write_all_levels(init_t)
+ # read from systemd-journal and similar
+ mls_socket_read_to_clearance(init_t)
selinux_unmount_fs(init_t)
selinux_validate_context(init_t)
Index: refpolicy-2.20180701/policy/modules/system/logging.if
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/system/logging.if
+++ refpolicy-2.20180701/policy/modules/system/logging.if
@@ -422,6 +422,9 @@ interface(`logging_domtrans_syslog',`
corecmd_search_bin($1)
domtrans_pattern($1, syslogd_exec_t, syslogd_t)
+ ifdef(`enable_mls',`
+ range_transition $1 syslogd_exec_t:process mls_systemhigh;
+ ')
')
########################################
next reply other threads:[~2019-01-08 8:52 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-01-08 8:52 Russell Coker [this message]
2019-01-10 0:24 ` [PATCH] mls stuff Chris PeBenito
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190108085240.GA28781@xev \
--to=russell@coker.com.au \
--cc=selinux-refpolicy@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).