[refpolicy] [PATCH 0/6] Updates on init scripts and udev (mainly /run related)

[refpolicy] [PATCH 0/6] Updates on init scripts and udev (mainly /run related)

[Sven Vermeulen]

This is a larger set of structured changes to the system
utilities. The main drivers are supporting the new /run location,
but some smaller changes have been incorporated as well.

Sven Vermeulen (6):
  Support log location for init script logging
  Allow init scripts to handle sysctls
  Supporting interfaces for the /run changes
  Allow init scripts to populate /run location
  Prepare udev interfaces for /run usage
  Allow init scripts to create and manage (udev) /run location

 policy/modules/kernel/files.if |   61 +++++++++++++++++++++++++++++++++
 policy/modules/system/init.te  |   15 +++++++-
 policy/modules/system/udev.if  |   74 +++++++++++++++++++++++++++++++++++++++-
 3 files changed, 148 insertions(+), 2 deletions(-)

-- 
1.7.3.4

[refpolicy] [PATCH 1/6] Support log location for init script logging

[Sven Vermeulen]

Recent init script packages allow for logging init script progress (service
start/stop state information, sometimes even duration, etc.) so we introduce an
initrc_var_log_t logtype and allow initrc_t to manage this.

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
---
 policy/modules/system/init.te |    6 ++++++
 1 files changed, 6 insertions(+), 0 deletions(-)

diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index 5fb9683..9fdd704 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -74,6 +74,9 @@ files_type(initrc_state_t)
 type initrc_tmp_t;
 files_tmp_file(initrc_tmp_t)
 
+type initrc_var_log_t;
+logging_log_file(initrc_var_log_t)
+
 type initrc_var_run_t;
 files_pid_file(initrc_var_run_t)
 
@@ -255,6 +258,9 @@ manage_dirs_pattern(initrc_t, initrc_tmp_t, initrc_tmp_t)
 manage_lnk_files_pattern(initrc_t, initrc_tmp_t, initrc_tmp_t)
 files_tmp_filetrans(initrc_t, initrc_tmp_t, { file dir })
 
+manage_dirs_pattern(initrc_t, initrc_var_log_t, initrc_var_log_t)
+logging_log_filetrans(initrc_t, initrc_var_log_t, dir)
+
 init_write_initctl(initrc_t)
 
 kernel_read_system_state(initrc_t)
-- 
1.7.3.4

[refpolicy] [PATCH 2/6] Allow init scripts to handle sysctls

[Sven Vermeulen]

The init script(s) that set/reset the sysctl's require the sys_admin capability
(as you cannot change sysctls without it).

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
---
 policy/modules/system/init.te |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index 9fdd704..7dfd9a9 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -222,7 +222,7 @@ optional_policy(`
 #
 
 allow initrc_t self:process { getpgid setsched setpgid setrlimit getsched };
-allow initrc_t self:capability ~{ sys_admin sys_module };
+allow initrc_t self:capability ~{ sys_module };
 dontaudit initrc_t self:capability sys_module; # sysctl is triggering this
 allow initrc_t self:passwd rootok;
 allow initrc_t self:key manage_key_perms;
-- 
1.7.3.4

[refpolicy] [PATCH 3/6] Supporting interfaces for the /run changes

[Sven Vermeulen]

Since most distributions now support /run (which, thanks the the
file context substitutions, is marked as var_run_t), we need to update the
SELinux policies to support "dynamically" building up /run. Unlike /var/run,
which is most likely statically defined during distribution installation, /run
is a tmpfs which is built up from scratch on each and every boot.

But not only that, many services also use this location for other purposes than
just PID files (which is to be expected as these "other reasons" is why /run
came to be in the first place), so we need to support other types within this
location easily.

For this reason, we introduce support to
- creating the /run/lock location
- supporting named file transitions when init scripts create stuff in /run

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
---
 policy/modules/kernel/files.if |   61 ++++++++++++++++++++++++++++++++++++++++
 1 files changed, 61 insertions(+), 0 deletions(-)

diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if
index 41346fb..279c63c 100644
--- a/policy/modules/kernel/files.if
+++ b/policy/modules/kernel/files.if
@@ -5608,6 +5608,26 @@ interface(`files_list_locks',`
 
 ########################################
 ## <summary>
+## 	Create lock directories
+## </summary>
+## <param name="domain">
+## 	<summary>
+##	Domain allowed access
+##	</summary>
+## </param>
+#
+interface(`files_create_lock_dirs',`
+	gen_require(`
+		type var_t, var_lock_t;
+	')
+
+	allow $1 var_t:dir search_dir_perms;
+	allow $1 var_lock_t:lnk_file read_lnk_file_perms;
+	create_dirs_pattern($1, var_lock_t, var_lock_t)
+')
+
+########################################
+## <summary>
 ##	Add and remove entries in the /var/lock
 ##	directories.
 ## </summary>
@@ -5628,6 +5648,24 @@ interface(`files_rw_lock_dirs',`
 
 ########################################
 ## <summary>
+##	Set the attributes of the generic lock directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`files_setattr_lock_dirs',`
+	gen_require(`
+		type var_t, var_lock_t;
+	')
+
+	setattr_dirs_pattern($1, var_t, var_lock_t)
+')
+
+########################################
+## <summary>
 ##	Relabel to and from all lock directory types.
 ## </summary>
 ## <param name="domain">
@@ -6016,6 +6054,29 @@ interface(`files_pid_filetrans',`
 
 ########################################
 ## <summary>
+## 	Create a generic lock directory within the run directories
+## </summary>
+## <param name="domain">
+## 	<summary>
+##	Domain allowed access
+##	</summary>
+## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
+#
+interface(`files_pid_filetrans_lock_dir',`
+	gen_require(`
+		type var_t, var_run_t;
+	')
+
+	files_pid_filetrans($1, var_lock_t, dir, $2)
+')
+
+########################################
+## <summary>
 ##	Read and write generic process ID files.
 ## </summary>
 ## <param name="domain">
-- 
1.7.3.4

[refpolicy] [PATCH 4/6] Allow init scripts to populate /run location

[Sven Vermeulen]

At boot up, the /run location is empty, and init scripts are responsible for
creating the necessary structure within to support their services. This means,
adding entries like for the lock folder (/run/lock).

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
---
 policy/modules/system/init.te |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)

diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index 7dfd9a9..8667e14 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -275,7 +275,10 @@ kernel_rw_all_sysctls(initrc_t)
 # for lsof which is used by alsa shutdown:
 kernel_dontaudit_getattr_message_if(initrc_t)
 
+files_create_lock_dirs(initrc_t)
+files_pid_filetrans_lock_dir(initrc_t, "lock")
 files_read_kernel_symbol_table(initrc_t)
+files_setattr_lock_dirs(initrc_t)
 
 corecmd_exec_all_executables(initrc_t)
 
@@ -451,6 +454,7 @@ ifdef(`distro_gentoo',`
 
 	# allow bootmisc to create /var/lock/.keep.
 	files_manage_generic_locks(initrc_t)
+	files_pid_filetrans(initrc_t, initrc_state_t, dir, "openrc")
 
 	# openrc uses tmpfs for its state data
 	fs_tmpfs_filetrans(initrc_t, initrc_state_t, { dir file fifo_file lnk_file })
-- 
1.7.3.4

[refpolicy] [PATCH 5/6] Prepare udev interfaces for /run usage

[Sven Vermeulen]

Recent udev implementations now use /run (actually, /run/udev) for storing
database files, rules and more. Hence, we need to extend existing interfaces to
support searching through the udev_var_run_t location (as most of that was
previously only in device_t and/or etc_t or udev_etc_t)

Next to enhancing the interfaces, we provide additional ones that will be used
by the init script (for udev) which needs to create and support the new
/run/udev locations.

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
---
 policy/modules/system/udev.if |   74 ++++++++++++++++++++++++++++++++++++++++-
 1 files changed, 73 insertions(+), 1 deletions(-)

diff --git a/policy/modules/system/udev.if b/policy/modules/system/udev.if
index 025348a..f1d1ce0 100644
--- a/policy/modules/system/udev.if
+++ b/policy/modules/system/udev.if
@@ -146,6 +146,10 @@ interface(`udev_manage_rules_files',`
 	')
 
 	manage_files_pattern($1, udev_rules_t, udev_rules_t)
+	
+	files_search_etc($1)
+
+	udev_search_pids($1)
 ')
 
 ########################################
@@ -187,10 +191,16 @@ interface(`udev_read_db',`
 		type udev_tbl_t;
 	')
 
-	dev_list_all_dev_nodes($1)
 	allow $1 udev_tbl_t:dir list_dir_perms;
+	
 	read_files_pattern($1, udev_tbl_t, udev_tbl_t)
 	read_lnk_files_pattern($1, udev_tbl_t, udev_tbl_t)
+
+	dev_list_all_dev_nodes($1)
+	
+	files_search_etc($1)
+
+	udev_search_pids($1)
 ')
 
 ########################################
@@ -214,6 +224,68 @@ interface(`udev_rw_db',`
 
 ########################################
 ## <summary>
+##	Search through udev pid content
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`udev_search_pids',`
+	gen_require(`
+		type udev_var_run_t;
+	')
+
+	files_search_pids($1)
+	search_dirs_pattern($1, udev_var_run_t, udev_var_run_t)
+')
+
+########################################
+## <summary>
+##	Create directories in the run location with udev_var_run_t type
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="name" optional="true">
+## 	<summary>
+##	Name of the directory that is created
+##	</summary>
+## </param>
+#
+interface(`udev_pid_filetrans_run_dirs',`
+	gen_require(`
+		type udev_var_run_t;
+	')
+
+	files_pid_filetrans($1, udev_var_run_t, dir, $2)
+')
+
+########################################
+## <summary>
+##	Create, read, write, and delete
+##	udev pid directories
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`udev_manage_pid_dirs',`
+	gen_require(`
+		type udev_var_run_t;
+	')
+
+	files_search_var($1)
+	manage_dirs_pattern($1, udev_var_run_t, udev_var_run_t)
+')
+
+########################################
+## <summary>
 ##	Create, read, write, and delete
 ##	udev pid files.
 ## </summary>
-- 
1.7.3.4

[refpolicy] [PATCH 6/6] Allow init scripts to create and manage (udev) /run location

[Sven Vermeulen]

With udev now using /run for its data, the init script responsible for preparing
the environment to start up udev needs to be able to setup this location as
well.

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
---
 policy/modules/system/init.te |    3 +++
 1 files changed, 3 insertions(+), 0 deletions(-)

diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index 8667e14..c544eea 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -276,6 +276,7 @@ kernel_rw_all_sysctls(initrc_t)
 kernel_dontaudit_getattr_message_if(initrc_t)
 
 files_create_lock_dirs(initrc_t)
+files_create_pid_dirs(initrc_t)
 files_pid_filetrans_lock_dir(initrc_t, "lock")
 files_read_kernel_symbol_table(initrc_t)
 files_setattr_lock_dirs(initrc_t)
@@ -828,7 +829,9 @@ optional_policy(`
 
 optional_policy(`
 	udev_rw_db(initrc_t)
+	udev_pid_filetrans_run_dirs(initrc_t, "udev")
 	udev_manage_pid_files(initrc_t)
+	udev_manage_pid_dirs(initrc_t)
 	udev_manage_rules_files(initrc_t)
 ')
 
-- 
1.7.3.4

[refpolicy] [PATCH 3/6] Supporting interfaces for the /run changes

[Dominick Grift]

On Wed, 2012-06-27 at 23:52 +0200, Sven Vermeulen wrote:
>  
>  ########################################
>  ## <summary>
> +## 	Create a generic lock directory within the run directories
> +## </summary>
> +## <param name="domain">
> +## 	<summary>
> +##	Domain allowed access
> +##	</summary>
> +## </param>
> +## <param name="name" optional="true">
> +##	<summary>
> +##	The name of the object being created.
> +##	</summary>
> +## </param>
> +#
> +interface(`files_pid_filetrans_lock_dir',`
> +	gen_require(`
> +		type var_t, var_run_t;

Bad requires: need var_lock_t instead.
> +	')
> +
> +	files_pid_filetrans($1, var_lock_t, dir, $2)
> +')

[refpolicy] [PATCH 1/6] Support log location for init script logging

[Christopher J. PeBenito]

On 06/27/12 17:52, Sven Vermeulen wrote:
> Recent init script packages allow for logging init script progress (service
> start/stop state information, sometimes even duration, etc.) so we introduce an
> initrc_var_log_t logtype and allow initrc_t to manage this.
> 
> Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
> ---
>  policy/modules/system/init.te |    6 ++++++
>  1 files changed, 6 insertions(+), 0 deletions(-)
> 
> diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
> index 5fb9683..9fdd704 100644
> --- a/policy/modules/system/init.te
> +++ b/policy/modules/system/init.te
> @@ -74,6 +74,9 @@ files_type(initrc_state_t)
>  type initrc_tmp_t;
>  files_tmp_file(initrc_tmp_t)
>  
> +type initrc_var_log_t;
> +logging_log_file(initrc_var_log_t)
> +
>  type initrc_var_run_t;
>  files_pid_file(initrc_var_run_t)
>  
> @@ -255,6 +258,9 @@ manage_dirs_pattern(initrc_t, initrc_tmp_t, initrc_tmp_t)
>  manage_lnk_files_pattern(initrc_t, initrc_tmp_t, initrc_tmp_t)
>  files_tmp_filetrans(initrc_t, initrc_tmp_t, { file dir })
>  
> +manage_dirs_pattern(initrc_t, initrc_var_log_t, initrc_var_log_t)
> +logging_log_filetrans(initrc_t, initrc_var_log_t, dir)
> +
>  init_write_initctl(initrc_t)
>  
>  kernel_read_system_state(initrc_t)
 
This only adds directory rules, not file rules, so this doesn't appear to work.

-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

[refpolicy] [PATCH 2/6] Allow init scripts to handle sysctls

[Christopher J. PeBenito]

On 06/27/12 17:52, Sven Vermeulen wrote:
> The init script(s) that set/reset the sysctl's require the sys_admin capability
> (as you cannot change sysctls without it).
> 
> Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
> ---
>  policy/modules/system/init.te |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)
> 
> diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
> index 9fdd704..7dfd9a9 100644
> --- a/policy/modules/system/init.te
> +++ b/policy/modules/system/init.te
> @@ -222,7 +222,7 @@ optional_policy(`
>  #
>  
>  allow initrc_t self:process { getpgid setsched setpgid setrlimit getsched };
> -allow initrc_t self:capability ~{ sys_admin sys_module };
> +allow initrc_t self:capability ~{ sys_module };
>  dontaudit initrc_t self:capability sys_module; # sysctl is triggering this
>  allow initrc_t self:passwd rootok;
>  allow initrc_t self:key manage_key_perms;
 
We typically try to separate out the sys_admin privileges since its so broad.  Can a new domain be created?

-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com