* [refpolicy] [PATCH] cron: Allow locks to be lnk_files
@ 2016-01-30 18:15 Jason Zaman
2016-01-31 13:53 ` Dominick Grift
0 siblings, 1 reply; 4+ messages in thread
From: Jason Zaman @ 2016-01-30 18:15 UTC (permalink / raw)
To: refpolicy
The run-crons script now uses symlinks to pids as the locks instead of
just a plain file.
avc: denied { create } for pid=5844 comm="ln" name="cron.hourly"
scontext=system_u:system_r:system_cronjob_t:s0-s0:c0.c1023
tcontext=system_u:object_r:var_lock_t:s0 tclass=lnk_file permissive=0
type=PATH msg=audit(1454175001.341:80669): item=2
name="/var/lock/cron.hourly" nametype=CREATE
---
cron.te | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/cron.te b/cron.te
index b481d5d..4aa43a7 100644
--- a/cron.te
+++ b/cron.te
@@ -439,8 +439,8 @@ files_pid_filetrans(system_cronjob_t, cron_var_run_t, file)
manage_files_pattern(system_cronjob_t, system_cron_spool_t, system_cron_spool_t)
-allow system_cronjob_t system_cronjob_lock_t:file manage_file_perms;
-files_lock_filetrans(system_cronjob_t, system_cronjob_lock_t, file)
+allow system_cronjob_t system_cronjob_lock_t:{ file lnk_file } manage_file_perms;
+files_lock_filetrans(system_cronjob_t, system_cronjob_lock_t, { file lnk_file })
manage_files_pattern(system_cronjob_t, crond_tmp_t, system_cronjob_tmp_t)
manage_lnk_files_pattern(system_cronjob_t, crond_tmp_t, system_cronjob_tmp_t)
--
2.4.10
^ permalink raw reply related [flat|nested] 4+ messages in thread* [refpolicy] [PATCH] cron: Allow locks to be lnk_files
2016-01-30 18:15 [refpolicy] [PATCH] cron: Allow locks to be lnk_files Jason Zaman
@ 2016-01-31 13:53 ` Dominick Grift
2016-02-01 9:19 ` Jason Zaman
0 siblings, 1 reply; 4+ messages in thread
From: Dominick Grift @ 2016-01-31 13:53 UTC (permalink / raw)
To: refpolicy
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
On Sun, Jan 31, 2016 at 02:15:18AM +0800, Jason Zaman wrote:
> The run-crons script now uses symlinks to pids as the locks instead of
> just a plain file.
>
> avc: denied { create } for pid=5844 comm="ln" name="cron.hourly"
> scontext=system_u:system_r:system_cronjob_t:s0-s0:c0.c1023
> tcontext=system_u:object_r:var_lock_t:s0 tclass=lnk_file permissive=0
> type=PATH msg=audit(1454175001.341:80669): item=2
> name="/var/lock/cron.hourly" nametype=CREATE
> ---
> cron.te | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/cron.te b/cron.te
> index b481d5d..4aa43a7 100644
> --- a/cron.te
> +++ b/cron.te
> @@ -439,8 +439,8 @@ files_pid_filetrans(system_cronjob_t, cron_var_run_t, file)
>
> manage_files_pattern(system_cronjob_t, system_cron_spool_t, system_cron_spool_t)
>
> -allow system_cronjob_t system_cronjob_lock_t:file manage_file_perms;
> -files_lock_filetrans(system_cronjob_t, system_cronjob_lock_t, file)
> +allow system_cronjob_t system_cronjob_lock_t:{ file lnk_file } manage_file_perms;
I prefer two lines for consistency:
allow system_cronjob_t system_cronjob_lock_t:file manage_file_perms;
allow system_cronjob_t system_cronjob_lock_t:lnk_file manage_lnk_file_perms;
> +files_lock_filetrans(system_cronjob_t, system_cronjob_lock_t, { file lnk_file })
>
> manage_files_pattern(system_cronjob_t, crond_tmp_t, system_cronjob_tmp_t)
> manage_lnk_files_pattern(system_cronjob_t, crond_tmp_t, system_cronjob_tmp_t)
> --
> 2.4.10
>
> _______________________________________________
> refpolicy mailing list
> refpolicy at oss.tresys.com
> http://oss.tresys.com/mailman/listinfo/refpolicy
- --
Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02
Dominick Grift
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQGcBAEBCAAGBQJWrhHbAAoJECV0jlU3+UdpVAsL/0R7Gh4f2CXk+eWbkAcRj75m
+njD7iPYkCJ8gr96XVvM4/sCCV0YiWnknj43MH+sRrPc+MwkOfWvLlYoPMfKiruF
ipeDTkgIQ/IHak54xtsx+l7TLNpg/5QcmwXRX5DlKy/1dl4qIKMmSvCzIebF24zV
rjXIZs9poHdS5WYTDJZnl4PT7DmjwfcbAWXpsa1Wlmy6T9ycuG0upxIJTCXWdFi3
9TJLuiYgpQEKpdF3n7ccgCBrz12bEnbY4Tq9imhNbB4MzewIMdeZJDS2KPHprs4q
cgg6VW87233rGC/oG6fFCfQTPxCX0DbzYPys3EATkbNFS5MZ9A5f05HhKQfu30LC
lGg5LuiRx4oZiBrKOQCsUqf9CiAt8jnQetB2RpUNP+ngyBlOn+BFyQwYnjwESQec
x7rDJJnLEWLjBSusfejcokwkfleWV7BBQH3PAlFFpilRAfSPqO+ivR4pXI3WUAol
GBOT/mOBYy+hqaqaefg+6Kfhorci/ADqWzgShxlYlA==
=Zafm
-----END PGP SIGNATURE-----
^ permalink raw reply [flat|nested] 4+ messages in thread* [refpolicy] [PATCH] cron: Allow locks to be lnk_files
2016-01-31 13:53 ` Dominick Grift
@ 2016-02-01 9:19 ` Jason Zaman
0 siblings, 0 replies; 4+ messages in thread
From: Jason Zaman @ 2016-02-01 9:19 UTC (permalink / raw)
To: refpolicy
On Sun, Jan 31, 2016 at 02:53:37PM +0100, Dominick Grift wrote:
> On Sun, Jan 31, 2016 at 02:15:18AM +0800, Jason Zaman wrote:
> > -allow system_cronjob_t system_cronjob_lock_t:file manage_file_perms;
> > -files_lock_filetrans(system_cronjob_t, system_cronjob_lock_t, file)
> > +allow system_cronjob_t system_cronjob_lock_t:{ file lnk_file } manage_file_perms;
>
> I prefer two lines for consistency:
>
> allow system_cronjob_t system_cronjob_lock_t:file manage_file_perms;
> allow system_cronjob_t system_cronjob_lock_t:lnk_file manage_lnk_file_perms;
Fair enough, the manage_lnk_file_perms bit is better too. ive sent a new
version.
Thanks,
Jason
^ permalink raw reply [flat|nested] 4+ messages in thread
* [refpolicy] [PATCH] cron: Allow locks to be lnk_files
@ 2016-02-01 9:17 Jason Zaman
0 siblings, 0 replies; 4+ messages in thread
From: Jason Zaman @ 2016-02-01 9:17 UTC (permalink / raw)
To: refpolicy
The run-crons script now uses symlinks to pids as the locks instead of
just a plain file.
avc: denied { create } for pid=5844 comm="ln" name="cron.hourly"
scontext=system_u:system_r:system_cronjob_t:s0-s0:c0.c1023
tcontext=system_u:object_r:var_lock_t:s0 tclass=lnk_file permissive=0
type=PATH msg=audit(1454175001.341:80669): item=2
name="/var/lock/cron.hourly" nametype=CREATE
---
cron.te | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/cron.te b/cron.te
index b481d5d..b50d468 100644
--- a/cron.te
+++ b/cron.te
@@ -440,7 +440,8 @@ files_pid_filetrans(system_cronjob_t, cron_var_run_t, file)
manage_files_pattern(system_cronjob_t, system_cron_spool_t, system_cron_spool_t)
allow system_cronjob_t system_cronjob_lock_t:file manage_file_perms;
-files_lock_filetrans(system_cronjob_t, system_cronjob_lock_t, file)
+allow system_cronjob_t system_cronjob_lock_t:lnk_file manage_lnk_file_perms;
+files_lock_filetrans(system_cronjob_t, system_cronjob_lock_t, { file lnk_file })
manage_files_pattern(system_cronjob_t, crond_tmp_t, system_cronjob_tmp_t)
manage_lnk_files_pattern(system_cronjob_t, crond_tmp_t, system_cronjob_tmp_t)
--
2.4.10
^ permalink raw reply related [flat|nested] 4+ messages in thread
end of thread, other threads:[~2016-02-01 9:19 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-01-30 18:15 [refpolicy] [PATCH] cron: Allow locks to be lnk_files Jason Zaman
2016-01-31 13:53 ` Dominick Grift
2016-02-01 9:19 ` Jason Zaman
2016-02-01 9:17 Jason Zaman
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.