Updates to squid policy and corenet policy

Updates to squid policy and corenet policy

[Daniel J Walsh]

[-- Attachment #1: Type: text/plain, Size: 158 bytes --]

Add policy to handle  /usr/lib/squid/cachemgr\.cgi  

Additional squid ports.

Also changed corenetworks to handle hi_reserved_port_t for name_bind only.





[-- Attachment #2: nsaserefpolicy_policy_modules_services_squid.patch --]
[-- Type: text/x-patch, Size: 2075 bytes --]

--- nsaserefpolicy/policy/modules/services/squid.fc	2006-11-16 17:15:21.000000000 -0500
+++ serefpolicy-2.5.4/policy/modules/services/squid.fc	2007-02-19 16:01:52.000000000 -0500
@@ -12,3 +12,4 @@
 /var/run/squid\.pid	--	gen_context(system_u:object_r:squid_var_run_t,s0)
 
 /var/spool/squid(/.*)?		gen_context(system_u:object_r:squid_cache_t,s0)
+/usr/lib/squid/cachemgr\.cgi	--	gen_context(system_u:object_r:httpd_squid_script_exec_t,s0)
--- nsaserefpolicy/policy/modules/services/squid.if	2007-01-02 12:57:43.000000000 -0500
+++ serefpolicy-2.5.4/policy/modules/services/squid.if	2007-02-19 16:01:52.000000000 -0500
@@ -36,7 +36,7 @@
 	')
 
 	files_search_etc($1)
-	allow $1 squid_conf_t:file read_file_perms;
+	read_files_pattern($1, squid_conf_t, squid_conf_t)
 ')
 
 ########################################
--- nsaserefpolicy/policy/modules/services/squid.te	2007-01-02 12:57:43.000000000 -0500
+++ serefpolicy-2.5.4/policy/modules/services/squid.te	2007-02-19 16:01:52.000000000 -0500
@@ -81,6 +81,8 @@
 corenet_tcp_bind_ftp_port(squid_t)
 corenet_tcp_bind_gopher_port(squid_t)
 corenet_udp_bind_gopher_port(squid_t)
+corenet_tcp_bind_squid_port(squid_t)
+corenet_udp_bind_squid_port(squid_t)
 corenet_tcp_connect_ftp_port(squid_t)
 corenet_tcp_connect_gopher_port(squid_t)
 corenet_tcp_connect_http_port(squid_t)
@@ -90,6 +92,7 @@
 corenet_sendrecv_gopher_client_packets(squid_t)
 corenet_sendrecv_http_cache_server_packets(squid_t)
 corenet_sendrecv_http_cache_client_packets(squid_t)
+corenet_sendrecv_squid_client_packets(squid_t)
 
 dev_read_sysfs(squid_t)
 dev_read_urand(squid_t)
@@ -178,3 +181,12 @@
 #squid requires the following when run in diskd mode, the recommended setting
 allow squid_t tmpfs_t:file { read write };
 ') dnl end TODO
+
+optional_policy(`
+	apache_content_template(squid)
+	corenet_tcp_connect_http_cache_port(httpd_squid_script_t)
+	squid_read_config(httpd_squid_script_t)
+	allow httpd_squid_script_t self:tcp_socket create_socket_perms;
+	sysnet_read_config(httpd_squid_script_t)
+	corenet_non_ipsec_sendrecv(httpd_squid_script_t)
+')

[-- Attachment #3: nsaserefpolicy_policy_modules_kernel_corenetwork.if.in --]
[-- Type: text/plain, Size: 2043 bytes --]

--- nsaserefpolicy/policy/modules/kernel/corenetwork.if.in	2007-02-19 11:32:51.000000000 -0500
+++ serefpolicy-2.5.4/policy/modules/kernel/corenetwork.if.in	2007-02-20 10:34:05.000000000 -0500
@@ -1034,10 +1034,10 @@
 #
 interface(`corenet_tcp_sendrecv_reserved_port',`
 	gen_require(`
-		type reserved_port_t;
+		attribute reserved_port_type;
 	')
 
-	allow $1 reserved_port_t:tcp_socket { send_msg recv_msg };
+	allow $1 reserved_port_type:tcp_socket { send_msg recv_msg };
 ')
 
 ########################################
@@ -1052,10 +1052,10 @@
 #
 interface(`corenet_udp_send_reserved_port',`
 	gen_require(`
-		type reserved_port_t;
+		attribute reserved_port_type;
 	')
 
-	allow $1 reserved_port_t:udp_socket send_msg;
+	allow $1 reserved_port_type:udp_socket send_msg;
 ')
 
 ########################################
@@ -1070,10 +1070,10 @@
 #
 interface(`corenet_udp_receive_reserved_port',`
 	gen_require(`
-		type reserved_port_t;
+		attribute reserved_port_type;
 	')
 
-	allow $1 reserved_port_t:udp_socket recv_msg;
+	allow $1 reserved_port_type:udp_socket recv_msg;
 ')
 
 ########################################
@@ -1103,10 +1103,10 @@
 #
 interface(`corenet_tcp_bind_reserved_port',`
 	gen_require(`
-		type reserved_port_t;
+		type hi_reserved_port_t;
 	')
 
-	allow $1 reserved_port_t:tcp_socket name_bind;
+	allow $1 hi_reserved_port_t:tcp_socket name_bind;
 	allow $1 self:capability net_bind_service;
 ')
 
@@ -1122,10 +1122,10 @@
 #
 interface(`corenet_udp_bind_reserved_port',`
 	gen_require(`
-		type reserved_port_t;
+		type hi_reserved_port_t;
 	')
 
-	allow $1 reserved_port_t:udp_socket name_bind;
+	allow $1 hi_reserved_port_t:udp_socket name_bind;
 	allow $1 self:capability net_bind_service;
 ')
 
@@ -1141,10 +1141,10 @@
 #
 interface(`corenet_tcp_connect_reserved_port',`
 	gen_require(`
-		type reserved_port_t;
+		attribute reserved_port_type;
 	')
 
-	allow $1 reserved_port_t:tcp_socket name_connect;
+	allow $1 reserved_port_type:tcp_socket name_connect;
 ')
 
 ########################################

[-- Attachment #4: nsaserefpolicy_policy_modules_kernel_corenetwork.te.in --]
[-- Type: text/plain, Size: 1821 bytes --]

--- nsaserefpolicy/policy/modules/kernel/corenetwork.te.in	2007-02-19 11:32:51.000000000 -0500
+++ serefpolicy-2.5.4/policy/modules/kernel/corenetwork.te.in	2007-02-20 10:22:47.000000000 -0500
@@ -43,11 +43,16 @@
 sid port gen_context(system_u:object_r:port_t,s0)
 
 #
-# reserved_port_t is the type of INET port numbers below 1024.
+# reserved_port_t is the type of INET port numbers below 599.
 #
 type reserved_port_t, port_type, reserved_port_type;
 
 #
+# hi_reserved_port_t is the type of INET port numbers between 600-1023.
+#
+type hi_reserved_port_t, port_type, reserved_port_type, rpc_port_type;
+
+#
 # server_packet_t is the default type of IPv4 and IPv6 server packets.
 #
 type server_packet_t, packet_type, server_packet_type;
@@ -140,6 +145,7 @@
 network_port(soundd, tcp,8000,s0, tcp,9433,s0)
 type socks_port_t, port_type; dnl network_port(socks) # no defined portcon
 type stunnel_port_t, port_type; dnl network_port(stunnel) # no defined portcon in current strict
+network_port(squid, udp,3401,s0, tcp,3401,s0, udp,4827,s0, tcp,4827,s0, )
 network_port(swat, tcp,901,s0)
 network_port(syslogd, udp,514,s0)
 network_port(telnetd, tcp,23,s0)
@@ -157,8 +163,11 @@
 
 # Defaults for reserved ports.  Earlier portcon entries take precedence;
 # these entries just cover any remaining reserved ports not otherwise declared.
-portcon tcp 1-1023 gen_context(system_u:object_r:reserved_port_t, s0)
-portcon udp 1-1023 gen_context(system_u:object_r:reserved_port_t, s0)
+
+portcon tcp 600-1023 gen_context(system_u:object_r:hi_reserved_port_t, s0)
+portcon udp 600-1023 gen_context(system_u:object_r:hi_reserved_port_t, s0)
+portcon tcp 1-599 gen_context(system_u:object_r:reserved_port_t, s0)
+portcon udp 1-599 gen_context(system_u:object_r:reserved_port_t, s0)
 
 ########################################
 #

[-- Attachment #5: nsaserefpolicy_policy_modules_kernel_corenetwork.te.m4 --]
[-- Type: application/x-m4, Size: 692 bytes --]

Re: Updates to squid policy and corenet policy

[Christopher J. PeBenito]

On Tue, 2007-02-20 at 11:36 -0500, Daniel J Walsh wrote:
> Add policy to handle  /usr/lib/squid/cachemgr\.cgi  
> 
> Additional squid ports.
> 
> Also changed corenetworks to handle hi_reserved_port_t for name_bind only.

Please separate out the corenetwork parts that aren't related to squid
changes.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.