All of lore.kernel.org
 help / color / mirror / Atom feed
* [refpolicy] [PATCH] cron: Allow locks to be lnk_files
@ 2016-01-30 18:15 Jason Zaman
  2016-01-31 13:53 ` Dominick Grift
  0 siblings, 1 reply; 4+ messages in thread
From: Jason Zaman @ 2016-01-30 18:15 UTC (permalink / raw)
  To: refpolicy

The run-crons script now uses symlinks to pids as the locks instead of
just a plain file.

avc:  denied  { create } for pid=5844 comm="ln" name="cron.hourly"
scontext=system_u:system_r:system_cronjob_t:s0-s0:c0.c1023
tcontext=system_u:object_r:var_lock_t:s0 tclass=lnk_file permissive=0
type=PATH msg=audit(1454175001.341:80669): item=2
name="/var/lock/cron.hourly" nametype=CREATE
---
 cron.te | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/cron.te b/cron.te
index b481d5d..4aa43a7 100644
--- a/cron.te
+++ b/cron.te
@@ -439,8 +439,8 @@ files_pid_filetrans(system_cronjob_t, cron_var_run_t, file)
 
 manage_files_pattern(system_cronjob_t, system_cron_spool_t, system_cron_spool_t)
 
-allow system_cronjob_t system_cronjob_lock_t:file manage_file_perms;
-files_lock_filetrans(system_cronjob_t, system_cronjob_lock_t, file)
+allow system_cronjob_t system_cronjob_lock_t:{ file lnk_file } manage_file_perms;
+files_lock_filetrans(system_cronjob_t, system_cronjob_lock_t, { file lnk_file })
 
 manage_files_pattern(system_cronjob_t, crond_tmp_t, system_cronjob_tmp_t)
 manage_lnk_files_pattern(system_cronjob_t, crond_tmp_t, system_cronjob_tmp_t)
-- 
2.4.10

^ permalink raw reply related	[flat|nested] 4+ messages in thread

* [refpolicy] [PATCH] cron: Allow locks to be lnk_files
  2016-01-30 18:15 [refpolicy] [PATCH] cron: Allow locks to be lnk_files Jason Zaman
@ 2016-01-31 13:53 ` Dominick Grift
  2016-02-01  9:19   ` Jason Zaman
  0 siblings, 1 reply; 4+ messages in thread
From: Dominick Grift @ 2016-01-31 13:53 UTC (permalink / raw)
  To: refpolicy

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On Sun, Jan 31, 2016 at 02:15:18AM +0800, Jason Zaman wrote:
> The run-crons script now uses symlinks to pids as the locks instead of
> just a plain file.
> 
> avc:  denied  { create } for pid=5844 comm="ln" name="cron.hourly"
> scontext=system_u:system_r:system_cronjob_t:s0-s0:c0.c1023
> tcontext=system_u:object_r:var_lock_t:s0 tclass=lnk_file permissive=0
> type=PATH msg=audit(1454175001.341:80669): item=2
> name="/var/lock/cron.hourly" nametype=CREATE
> ---
>  cron.te | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/cron.te b/cron.te
> index b481d5d..4aa43a7 100644
> --- a/cron.te
> +++ b/cron.te
> @@ -439,8 +439,8 @@ files_pid_filetrans(system_cronjob_t, cron_var_run_t, file)
>  
>  manage_files_pattern(system_cronjob_t, system_cron_spool_t, system_cron_spool_t)
>  
> -allow system_cronjob_t system_cronjob_lock_t:file manage_file_perms;
> -files_lock_filetrans(system_cronjob_t, system_cronjob_lock_t, file)
> +allow system_cronjob_t system_cronjob_lock_t:{ file lnk_file } manage_file_perms;

I prefer two lines for consistency:

allow system_cronjob_t system_cronjob_lock_t:file manage_file_perms;
allow system_cronjob_t system_cronjob_lock_t:lnk_file manage_lnk_file_perms;

> +files_lock_filetrans(system_cronjob_t, system_cronjob_lock_t, { file lnk_file })
>  
>  manage_files_pattern(system_cronjob_t, crond_tmp_t, system_cronjob_tmp_t)
>  manage_lnk_files_pattern(system_cronjob_t, crond_tmp_t, system_cronjob_tmp_t)
> -- 
> 2.4.10
> 
> _______________________________________________
> refpolicy mailing list
> refpolicy at oss.tresys.com
> http://oss.tresys.com/mailman/listinfo/refpolicy

- -- 
Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8  02D5 3B6C 5F1D 2C7B 6B02
https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02
Dominick Grift
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQGcBAEBCAAGBQJWrhHbAAoJECV0jlU3+UdpVAsL/0R7Gh4f2CXk+eWbkAcRj75m
+njD7iPYkCJ8gr96XVvM4/sCCV0YiWnknj43MH+sRrPc+MwkOfWvLlYoPMfKiruF
ipeDTkgIQ/IHak54xtsx+l7TLNpg/5QcmwXRX5DlKy/1dl4qIKMmSvCzIebF24zV
rjXIZs9poHdS5WYTDJZnl4PT7DmjwfcbAWXpsa1Wlmy6T9ycuG0upxIJTCXWdFi3
9TJLuiYgpQEKpdF3n7ccgCBrz12bEnbY4Tq9imhNbB4MzewIMdeZJDS2KPHprs4q
cgg6VW87233rGC/oG6fFCfQTPxCX0DbzYPys3EATkbNFS5MZ9A5f05HhKQfu30LC
lGg5LuiRx4oZiBrKOQCsUqf9CiAt8jnQetB2RpUNP+ngyBlOn+BFyQwYnjwESQec
x7rDJJnLEWLjBSusfejcokwkfleWV7BBQH3PAlFFpilRAfSPqO+ivR4pXI3WUAol
GBOT/mOBYy+hqaqaefg+6Kfhorci/ADqWzgShxlYlA==
=Zafm
-----END PGP SIGNATURE-----

^ permalink raw reply	[flat|nested] 4+ messages in thread

* [refpolicy] [PATCH] cron: Allow locks to be lnk_files
  2016-01-31 13:53 ` Dominick Grift
@ 2016-02-01  9:19   ` Jason Zaman
  0 siblings, 0 replies; 4+ messages in thread
From: Jason Zaman @ 2016-02-01  9:19 UTC (permalink / raw)
  To: refpolicy

On Sun, Jan 31, 2016 at 02:53:37PM +0100, Dominick Grift wrote:
> On Sun, Jan 31, 2016 at 02:15:18AM +0800, Jason Zaman wrote:
> > -allow system_cronjob_t system_cronjob_lock_t:file manage_file_perms;
> > -files_lock_filetrans(system_cronjob_t, system_cronjob_lock_t, file)
> > +allow system_cronjob_t system_cronjob_lock_t:{ file lnk_file } manage_file_perms;
> 
> I prefer two lines for consistency:
> 
> allow system_cronjob_t system_cronjob_lock_t:file manage_file_perms;
> allow system_cronjob_t system_cronjob_lock_t:lnk_file manage_lnk_file_perms;

Fair enough, the manage_lnk_file_perms bit is better too. ive sent a new
version.

Thanks,
Jason

^ permalink raw reply	[flat|nested] 4+ messages in thread

* [refpolicy] [PATCH] cron: Allow locks to be lnk_files
@ 2016-02-01  9:17 Jason Zaman
  0 siblings, 0 replies; 4+ messages in thread
From: Jason Zaman @ 2016-02-01  9:17 UTC (permalink / raw)
  To: refpolicy

The run-crons script now uses symlinks to pids as the locks instead of
just a plain file.

avc:  denied  { create } for pid=5844 comm="ln" name="cron.hourly"
scontext=system_u:system_r:system_cronjob_t:s0-s0:c0.c1023
tcontext=system_u:object_r:var_lock_t:s0 tclass=lnk_file permissive=0
type=PATH msg=audit(1454175001.341:80669): item=2
name="/var/lock/cron.hourly" nametype=CREATE
---
 cron.te | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/cron.te b/cron.te
index b481d5d..b50d468 100644
--- a/cron.te
+++ b/cron.te
@@ -440,7 +440,8 @@ files_pid_filetrans(system_cronjob_t, cron_var_run_t, file)
 manage_files_pattern(system_cronjob_t, system_cron_spool_t, system_cron_spool_t)
 
 allow system_cronjob_t system_cronjob_lock_t:file manage_file_perms;
-files_lock_filetrans(system_cronjob_t, system_cronjob_lock_t, file)
+allow system_cronjob_t system_cronjob_lock_t:lnk_file manage_lnk_file_perms;
+files_lock_filetrans(system_cronjob_t, system_cronjob_lock_t, { file lnk_file })
 
 manage_files_pattern(system_cronjob_t, crond_tmp_t, system_cronjob_tmp_t)
 manage_lnk_files_pattern(system_cronjob_t, crond_tmp_t, system_cronjob_tmp_t)
-- 
2.4.10

^ permalink raw reply related	[flat|nested] 4+ messages in thread

end of thread, other threads:[~2016-02-01  9:19 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-01-30 18:15 [refpolicy] [PATCH] cron: Allow locks to be lnk_files Jason Zaman
2016-01-31 13:53 ` Dominick Grift
2016-02-01  9:19   ` Jason Zaman
2016-02-01  9:17 Jason Zaman

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.