* [refpolicy] [PATCH] single binary modutils
@ 2016-07-31 12:34 Russell Coker
2016-08-02 23:59 ` Chris PeBenito
0 siblings, 1 reply; 6+ messages in thread
From: Russell Coker @ 2016-07-31 12:34 UTC (permalink / raw)
To: refpolicy
The following patch deals with a single binary for modutils, so depmod_t,
and insmod_t are merged.
diff -ruN /home/rjc/src/pol-git/policy/modules/system/modutils.fc ./policy/modules/system/modutils.fc
--- /home/rjc/src/pol-git/policy/modules/system/modutils.fc 2016-07-28 20:33:39.971961928 +1000
+++ ./policy/modules/system/modutils.fc 2016-07-31 22:31:01.121039414 +1000
@@ -23,3 +23,4 @@
/sbin/update-modules -- gen_context(system_u:object_r:update_modules_exec_t,s0)
/usr/bin/kmod -- gen_context(system_u:object_r:insmod_exec_t,s0)
+/var/run/tmpfiles.d(/.*)? gen_context(system_u:object_r:kmod_var_run_t,s0)
diff -ruN /home/rjc/src/pol-git/policy/modules/system/modutils.te ./policy/modules/system/modutils.te
--- /home/rjc/src/pol-git/policy/modules/system/modutils.te 2016-07-28 20:33:39.971961928 +1000
+++ ./policy/modules/system/modutils.te 2016-07-31 22:31:01.117039342 +1000
@@ -5,15 +5,12 @@
# Declarations
#
-attribute_role update_modules_roles;
-
-type depmod_t;
-type depmod_exec_t;
-init_system_domain(depmod_t, depmod_exec_t)
-role system_r types depmod_t;
-
type insmod_t;
+typealias insmod_t alias { depmod_t update_modules_t };
+
type insmod_exec_t;
+typealias insmod_exec_t alias { depmod_exec_t update_modules_exec_t };
+
application_domain(insmod_t, insmod_exec_t)
mls_file_write_all_levels(insmod_t)
role system_r types insmod_t;
@@ -26,77 +23,8 @@
type modules_dep_t;
files_type(modules_dep_t)
-type update_modules_t;
-type update_modules_exec_t;
-init_system_domain(update_modules_t, update_modules_exec_t)
-roleattribute system_r update_modules_roles;
-role update_modules_roles types update_modules_t;
-
-type update_modules_tmp_t;
-files_tmp_file(update_modules_tmp_t)
-
-########################################
-#
-# depmod local policy
-#
-
-can_exec(depmod_t, depmod_exec_t)
-
-# Read conf.modules.
-read_files_pattern(depmod_t, modules_conf_t, modules_conf_t)
-
-allow depmod_t modules_dep_t:file manage_file_perms;
-files_kernel_modules_filetrans(depmod_t, modules_dep_t, file)
-
-kernel_read_system_state(depmod_t)
-
-corecmd_search_bin(depmod_t)
-
-domain_use_interactive_fds(depmod_t)
-
-files_read_kernel_symbol_table(depmod_t)
-files_read_kernel_modules(depmod_t)
-files_read_etc_runtime_files(depmod_t)
-files_read_etc_files(depmod_t)
-files_read_usr_src_files(depmod_t)
-files_list_usr(depmod_t)
-
-fs_getattr_xattr_fs(depmod_t)
-
-term_use_console(depmod_t)
-
-init_use_fds(depmod_t)
-init_use_script_fds(depmod_t)
-init_use_script_ptys(depmod_t)
-
-userdom_use_user_terminals(depmod_t)
-# Read System.map from home directories.
-files_list_home(depmod_t)
-userdom_read_user_home_content_files(depmod_t)
-
-ifdef(`distro_ubuntu',`
- optional_policy(`
- unconfined_domain(depmod_t)
- ')
-')
-
-tunable_policy(`use_nfs_home_dirs',`
- fs_read_nfs_files(depmod_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_read_cifs_files(depmod_t)
-')
-
-optional_policy(`
- rpm_rw_pipes(depmod_t)
- rpm_manage_script_tmp_files(depmod_t)
-')
-
-optional_policy(`
- # Read System.map from home directories.
- unconfined_domain(depmod_t)
-')
+type kmod_var_run_t;
+files_pid_file(kmod_var_run_t)
########################################
#
@@ -114,6 +42,9 @@
read_files_pattern(insmod_t, modules_conf_t, modules_conf_t)
list_dirs_pattern(insmod_t, modules_dep_t, modules_dep_t)
read_files_pattern(insmod_t, modules_dep_t, modules_dep_t)
+filetrans_add_pattern(insmod_t, modules_object_t, modules_dep_t, file)
+create_files_pattern(insmod_t, modules_object_t, modules_dep_t)
+delete_files_pattern(insmod_t, modules_object_t, modules_dep_t)
can_exec(insmod_t, insmod_exec_t)
@@ -136,6 +67,11 @@
corecmd_exec_bin(insmod_t)
corecmd_exec_shell(insmod_t)
+# for /run/tmpfiles.d/kmod.conf
+files_pid_filetrans(insmod_t, kmod_var_run_t, dir)
+allow insmod_t kmod_var_run_t:dir manage_dir_perms;
+allow insmod_t kmod_var_run_t:file manage_file_perms;
+
dev_rw_sysfs(insmod_t)
dev_search_usbfs(insmod_t)
dev_rw_mtrr(insmod_t)
@@ -238,6 +174,7 @@
optional_policy(`
unconfined_domain(insmod_t)
unconfined_dontaudit_rw_pipes(insmod_t)
+ unconfined_domtrans_to(insmod_t, insmod_exec_t)
')
optional_policy(`
@@ -247,85 +184,3 @@
xserver_getattr_log(insmod_t)
')
-#################################
-#
-# update-modules local policy
-#
-
-allow update_modules_t self:fifo_file rw_fifo_file_perms;
-
-allow update_modules_t modules_dep_t:file rw_file_perms;
-
-can_exec(update_modules_t, insmod_exec_t)
-can_exec(update_modules_t, update_modules_exec_t)
-
-# manage module loading configuration
-manage_files_pattern(update_modules_t, modules_conf_t, modules_conf_t)
-files_kernel_modules_filetrans(update_modules_t, modules_conf_t, file)
-files_etc_filetrans(update_modules_t, modules_conf_t, file)
-
-# transition to depmod
-domain_auto_trans(update_modules_t, depmod_exec_t, depmod_t)
-allow update_modules_t depmod_t:fd use;
-allow depmod_t update_modules_t:fd use;
-allow depmod_t update_modules_t:fifo_file rw_file_perms;
-allow depmod_t update_modules_t:process sigchld;
-
-manage_dirs_pattern(update_modules_t, update_modules_tmp_t, update_modules_tmp_t)
-manage_files_pattern(update_modules_t, update_modules_tmp_t, update_modules_tmp_t)
-files_tmp_filetrans(update_modules_t, update_modules_tmp_t, { file dir })
-
-kernel_read_kernel_sysctls(update_modules_t)
-kernel_read_system_state(update_modules_t)
-
-corecmd_exec_bin(update_modules_t)
-corecmd_exec_shell(update_modules_t)
-
-dev_read_urand(update_modules_t)
-
-domain_use_interactive_fds(update_modules_t)
-
-files_read_etc_runtime_files(update_modules_t)
-files_read_etc_files(update_modules_t)
-files_exec_etc_files(update_modules_t)
-
-fs_getattr_xattr_fs(update_modules_t)
-
-term_use_console(update_modules_t)
-
-init_use_fds(update_modules_t)
-init_use_script_fds(update_modules_t)
-init_use_script_ptys(update_modules_t)
-
-logging_send_syslog_msg(update_modules_t)
-
-miscfiles_read_localization(update_modules_t)
-
-modutils_run_insmod(update_modules_t, update_modules_roles)
-
-userdom_use_user_terminals(update_modules_t)
-userdom_dontaudit_search_user_home_dirs(update_modules_t)
-
-ifdef(`distro_gentoo',`
- kernel_list_unlabeled(update_modules_t) # /var
-
- files_search_pids(update_modules_t)
- files_getattr_usr_src_files(update_modules_t)
-
- # update-modules on Gentoo throws errors when run because it
- # sources /etc/init.d/functions.sh, which always scans
- # /var/lib/init.d to set SOFTLEVEL environment var.
- # This is never used by update-modules.
- files_dontaudit_search_var_lib(update_modules_t)
- init_dontaudit_read_script_status_files(update_modules_t)
-
- optional_policy(`
- consoletype_exec(update_modules_t)
- ')
-')
-
-ifdef(`distro_ubuntu',`
- optional_policy(`
- unconfined_domain(update_modules_t)
- ')
-')
^ permalink raw reply [flat|nested] 6+ messages in thread
* [refpolicy] [PATCH] single binary modutils
2016-07-31 12:34 [refpolicy] [PATCH] single binary modutils Russell Coker
@ 2016-08-02 23:59 ` Chris PeBenito
2016-08-03 2:33 ` Russell Coker
2016-10-21 8:35 ` Russell Coker
0 siblings, 2 replies; 6+ messages in thread
From: Chris PeBenito @ 2016-08-02 23:59 UTC (permalink / raw)
To: refpolicy
On 07/31/16 08:34, Russell Coker wrote:
> The following patch deals with a single binary for modutils, so depmod_t,
> and insmod_t are merged.
Since the main SELinux distros (including RHEL/CentOS 7) all have merged
modutils these days, I'm open to taking a patch that fully merges these
domains (in which case renaming to kmod_t, with proper aliasing seems
the best idea).
However, it's been some time since I used a busybox-based system; does
busybox still have separated tools? Yes, this is a bit of an obvious
question since busybox is also single-binary, but IIRC, the embedded
guys made some tiny helper scripts or executables so proper
transitioning could occur. Separate domains may still make sense.
> diff -ruN /home/rjc/src/pol-git/policy/modules/system/modutils.fc ./policy/modules/system/modutils.fc
> --- /home/rjc/src/pol-git/policy/modules/system/modutils.fc 2016-07-28 20:33:39.971961928 +1000
> +++ ./policy/modules/system/modutils.fc 2016-07-31 22:31:01.121039414 +1000
> @@ -23,3 +23,4 @@
> /sbin/update-modules -- gen_context(system_u:object_r:update_modules_exec_t,s0)
>
> /usr/bin/kmod -- gen_context(system_u:object_r:insmod_exec_t,s0)
> +/var/run/tmpfiles.d(/.*)? gen_context(system_u:object_r:kmod_var_run_t,s0)
> diff -ruN /home/rjc/src/pol-git/policy/modules/system/modutils.te ./policy/modules/system/modutils.te
> --- /home/rjc/src/pol-git/policy/modules/system/modutils.te 2016-07-28 20:33:39.971961928 +1000
> +++ ./policy/modules/system/modutils.te 2016-07-31 22:31:01.117039342 +1000
> @@ -5,15 +5,12 @@
> # Declarations
> #
>
> -attribute_role update_modules_roles;
> -
> -type depmod_t;
> -type depmod_exec_t;
> -init_system_domain(depmod_t, depmod_exec_t)
> -role system_r types depmod_t;
> -
> type insmod_t;
> +typealias insmod_t alias { depmod_t update_modules_t };
> +
> type insmod_exec_t;
> +typealias insmod_exec_t alias { depmod_exec_t update_modules_exec_t };
> +
> application_domain(insmod_t, insmod_exec_t)
> mls_file_write_all_levels(insmod_t)
> role system_r types insmod_t;
> @@ -26,77 +23,8 @@
> type modules_dep_t;
> files_type(modules_dep_t)
>
> -type update_modules_t;
> -type update_modules_exec_t;
> -init_system_domain(update_modules_t, update_modules_exec_t)
> -roleattribute system_r update_modules_roles;
> -role update_modules_roles types update_modules_t;
> -
> -type update_modules_tmp_t;
> -files_tmp_file(update_modules_tmp_t)
> -
> -########################################
> -#
> -# depmod local policy
> -#
> -
> -can_exec(depmod_t, depmod_exec_t)
> -
> -# Read conf.modules.
> -read_files_pattern(depmod_t, modules_conf_t, modules_conf_t)
> -
> -allow depmod_t modules_dep_t:file manage_file_perms;
> -files_kernel_modules_filetrans(depmod_t, modules_dep_t, file)
> -
> -kernel_read_system_state(depmod_t)
> -
> -corecmd_search_bin(depmod_t)
> -
> -domain_use_interactive_fds(depmod_t)
> -
> -files_read_kernel_symbol_table(depmod_t)
> -files_read_kernel_modules(depmod_t)
> -files_read_etc_runtime_files(depmod_t)
> -files_read_etc_files(depmod_t)
> -files_read_usr_src_files(depmod_t)
> -files_list_usr(depmod_t)
> -
> -fs_getattr_xattr_fs(depmod_t)
> -
> -term_use_console(depmod_t)
> -
> -init_use_fds(depmod_t)
> -init_use_script_fds(depmod_t)
> -init_use_script_ptys(depmod_t)
> -
> -userdom_use_user_terminals(depmod_t)
> -# Read System.map from home directories.
> -files_list_home(depmod_t)
> -userdom_read_user_home_content_files(depmod_t)
> -
> -ifdef(`distro_ubuntu',`
> - optional_policy(`
> - unconfined_domain(depmod_t)
> - ')
> -')
> -
> -tunable_policy(`use_nfs_home_dirs',`
> - fs_read_nfs_files(depmod_t)
> -')
> -
> -tunable_policy(`use_samba_home_dirs',`
> - fs_read_cifs_files(depmod_t)
> -')
> -
> -optional_policy(`
> - rpm_rw_pipes(depmod_t)
> - rpm_manage_script_tmp_files(depmod_t)
> -')
> -
> -optional_policy(`
> - # Read System.map from home directories.
> - unconfined_domain(depmod_t)
> -')
> +type kmod_var_run_t;
> +files_pid_file(kmod_var_run_t)
>
> ########################################
> #
> @@ -114,6 +42,9 @@
> read_files_pattern(insmod_t, modules_conf_t, modules_conf_t)
> list_dirs_pattern(insmod_t, modules_dep_t, modules_dep_t)
> read_files_pattern(insmod_t, modules_dep_t, modules_dep_t)
> +filetrans_add_pattern(insmod_t, modules_object_t, modules_dep_t, file)
> +create_files_pattern(insmod_t, modules_object_t, modules_dep_t)
> +delete_files_pattern(insmod_t, modules_object_t, modules_dep_t)
>
> can_exec(insmod_t, insmod_exec_t)
>
> @@ -136,6 +67,11 @@
> corecmd_exec_bin(insmod_t)
> corecmd_exec_shell(insmod_t)
>
> +# for /run/tmpfiles.d/kmod.conf
> +files_pid_filetrans(insmod_t, kmod_var_run_t, dir)
> +allow insmod_t kmod_var_run_t:dir manage_dir_perms;
> +allow insmod_t kmod_var_run_t:file manage_file_perms;
> +
> dev_rw_sysfs(insmod_t)
> dev_search_usbfs(insmod_t)
> dev_rw_mtrr(insmod_t)
> @@ -238,6 +174,7 @@
> optional_policy(`
> unconfined_domain(insmod_t)
> unconfined_dontaudit_rw_pipes(insmod_t)
> + unconfined_domtrans_to(insmod_t, insmod_exec_t)
> ')
>
> optional_policy(`
> @@ -247,85 +184,3 @@
> xserver_getattr_log(insmod_t)
> ')
>
> -#################################
> -#
> -# update-modules local policy
> -#
> -
> -allow update_modules_t self:fifo_file rw_fifo_file_perms;
> -
> -allow update_modules_t modules_dep_t:file rw_file_perms;
> -
> -can_exec(update_modules_t, insmod_exec_t)
> -can_exec(update_modules_t, update_modules_exec_t)
> -
> -# manage module loading configuration
> -manage_files_pattern(update_modules_t, modules_conf_t, modules_conf_t)
> -files_kernel_modules_filetrans(update_modules_t, modules_conf_t, file)
> -files_etc_filetrans(update_modules_t, modules_conf_t, file)
> -
> -# transition to depmod
> -domain_auto_trans(update_modules_t, depmod_exec_t, depmod_t)
> -allow update_modules_t depmod_t:fd use;
> -allow depmod_t update_modules_t:fd use;
> -allow depmod_t update_modules_t:fifo_file rw_file_perms;
> -allow depmod_t update_modules_t:process sigchld;
> -
> -manage_dirs_pattern(update_modules_t, update_modules_tmp_t, update_modules_tmp_t)
> -manage_files_pattern(update_modules_t, update_modules_tmp_t, update_modules_tmp_t)
> -files_tmp_filetrans(update_modules_t, update_modules_tmp_t, { file dir })
> -
> -kernel_read_kernel_sysctls(update_modules_t)
> -kernel_read_system_state(update_modules_t)
> -
> -corecmd_exec_bin(update_modules_t)
> -corecmd_exec_shell(update_modules_t)
> -
> -dev_read_urand(update_modules_t)
> -
> -domain_use_interactive_fds(update_modules_t)
> -
> -files_read_etc_runtime_files(update_modules_t)
> -files_read_etc_files(update_modules_t)
> -files_exec_etc_files(update_modules_t)
> -
> -fs_getattr_xattr_fs(update_modules_t)
> -
> -term_use_console(update_modules_t)
> -
> -init_use_fds(update_modules_t)
> -init_use_script_fds(update_modules_t)
> -init_use_script_ptys(update_modules_t)
> -
> -logging_send_syslog_msg(update_modules_t)
> -
> -miscfiles_read_localization(update_modules_t)
> -
> -modutils_run_insmod(update_modules_t, update_modules_roles)
> -
> -userdom_use_user_terminals(update_modules_t)
> -userdom_dontaudit_search_user_home_dirs(update_modules_t)
> -
> -ifdef(`distro_gentoo',`
> - kernel_list_unlabeled(update_modules_t) # /var
> -
> - files_search_pids(update_modules_t)
> - files_getattr_usr_src_files(update_modules_t)
> -
> - # update-modules on Gentoo throws errors when run because it
> - # sources /etc/init.d/functions.sh, which always scans
> - # /var/lib/init.d to set SOFTLEVEL environment var.
> - # This is never used by update-modules.
> - files_dontaudit_search_var_lib(update_modules_t)
> - init_dontaudit_read_script_status_files(update_modules_t)
> -
> - optional_policy(`
> - consoletype_exec(update_modules_t)
> - ')
> -')
> -
> -ifdef(`distro_ubuntu',`
> - optional_policy(`
> - unconfined_domain(update_modules_t)
> - ')
> -')
> _______________________________________________
> refpolicy mailing list
> refpolicy at oss.tresys.com
> http://oss.tresys.com/mailman/listinfo/refpolicy
>
--
Chris PeBenito
^ permalink raw reply [flat|nested] 6+ messages in thread
* [refpolicy] [PATCH] single binary modutils
2016-08-02 23:59 ` Chris PeBenito
@ 2016-08-03 2:33 ` Russell Coker
2016-08-06 20:53 ` Chris PeBenito
2016-10-21 8:35 ` Russell Coker
1 sibling, 1 reply; 6+ messages in thread
From: Russell Coker @ 2016-08-03 2:33 UTC (permalink / raw)
To: refpolicy
On Wed, 3 Aug 2016 09:59:28 AM Chris PeBenito wrote:
> On 07/31/16 08:34, Russell Coker wrote:
> > The following patch deals with a single binary for modutils, so depmod_t,
> > and insmod_t are merged.
>
> Since the main SELinux distros (including RHEL/CentOS 7) all have merged
> modutils these days, I'm open to taking a patch that fully merges these
> domains (in which case renaming to kmod_t, with proper aliasing seems
> the best idea).
OK.
> However, it's been some time since I used a busybox-based system; does
> busybox still have separated tools? Yes, this is a bit of an obvious
> question since busybox is also single-binary, but IIRC, the embedded
> guys made some tiny helper scripts or executables so proper
> transitioning could occur. Separate domains may still make sense.
Maybe have an ifdef(`embedded' or something around it then?
--
My Main Blog http://etbe.coker.com.au/
My Documents Blog http://doc.coker.com.au/
^ permalink raw reply [flat|nested] 6+ messages in thread
* [refpolicy] [PATCH] single binary modutils
2016-08-03 2:33 ` Russell Coker
@ 2016-08-06 20:53 ` Chris PeBenito
0 siblings, 0 replies; 6+ messages in thread
From: Chris PeBenito @ 2016-08-06 20:53 UTC (permalink / raw)
To: refpolicy
On 08/02/16 22:33, Russell Coker wrote:
> On Wed, 3 Aug 2016 09:59:28 AM Chris PeBenito wrote:
>> On 07/31/16 08:34, Russell Coker wrote:
>>> The following patch deals with a single binary for modutils, so depmod_t,
>>> and insmod_t are merged.
>>
>> Since the main SELinux distros (including RHEL/CentOS 7) all have merged
>> modutils these days, I'm open to taking a patch that fully merges these
>> domains (in which case renaming to kmod_t, with proper aliasing seems
>> the best idea).
>
> OK.
>
>> However, it's been some time since I used a busybox-based system; does
>> busybox still have separated tools? Yes, this is a bit of an obvious
>> question since busybox is also single-binary, but IIRC, the embedded
>> guys made some tiny helper scripts or executables so proper
>> transitioning could occur. Separate domains may still make sense.
>
> Maybe have an ifdef(`embedded' or something around it then?
I'm having a hard time envisioning how that would work.
If anyone is using busybox like this, please speak up. No sense in us
trying to handle a use case that no one uses.
--
Chris PeBenito
^ permalink raw reply [flat|nested] 6+ messages in thread
* [refpolicy] [PATCH] single binary modutils
2016-08-02 23:59 ` Chris PeBenito
2016-08-03 2:33 ` Russell Coker
@ 2016-10-21 8:35 ` Russell Coker
2016-10-23 23:28 ` Chris PeBenito
1 sibling, 1 reply; 6+ messages in thread
From: Russell Coker @ 2016-10-21 8:35 UTC (permalink / raw)
To: refpolicy
On Tuesday, 2 August 2016 7:59:28 PM AEDT Chris PeBenito wrote:
> On 07/31/16 08:34, Russell Coker wrote:
> > The following patch deals with a single binary for modutils, so depmod_t,
> > and insmod_t are merged.
>
> Since the main SELinux distros (including RHEL/CentOS 7) all have merged
> modutils these days, I'm open to taking a patch that fully merges these
> domains (in which case renaming to kmod_t, with proper aliasing seems
> the best idea).
>
> However, it's been some time since I used a busybox-based system; does
> busybox still have separated tools? Yes, this is a bit of an obvious
> question since busybox is also single-binary, but IIRC, the embedded
> guys made some tiny helper scripts or executables so proper
> transitioning could occur. Separate domains may still make sense.
As we have had no response from Busybox users in the last 3 months and also no
response to the thread Luis started in 2013 I think it's safe to assume that
they don't need this.
I've attached a new patch which renames to kmod_t as you suggested. Please
consider it for inclusion.
--
My Main Blog http://etbe.coker.com.au/
My Documents Blog http://doc.coker.com.au/
-------------- next part --------------
Description: Change modutils policy to match the use of a single binary
Author: Russell Coker <russell@coker.com.au>
Last-Update: 2014-06-25
Index: refpolicy-2.20160928/policy/modules/system/modutils.te
===================================================================
--- refpolicy-2.20160928.orig/policy/modules/system/modutils.te
+++ refpolicy-2.20160928/policy/modules/system/modutils.te
@@ -5,18 +5,15 @@ policy_module(modutils, 1.16.0)
# Declarations
#
-attribute_role update_modules_roles;
+type kmod_t;
+typealias kmod_t alias { insmod_t depmod_t update_modules_t };
-type depmod_t;
-type depmod_exec_t;
-init_system_domain(depmod_t, depmod_exec_t)
-role system_r types depmod_t;
-
-type insmod_t;
-type insmod_exec_t;
-application_domain(insmod_t, insmod_exec_t)
-mls_file_write_all_levels(insmod_t)
-role system_r types insmod_t;
+type kmod_exec_t;
+typealias kmod_exec_t alias { insmod_exec_t depmod_exec_t update_modules_exec_t };
+
+application_domain(kmod_t, kmod_exec_t)
+mls_file_write_all_levels(kmod_t)
+role system_r types kmod_t;
# module loading config
type modules_conf_t;
@@ -26,306 +23,164 @@ files_type(modules_conf_t)
type modules_dep_t;
files_type(modules_dep_t)
-type update_modules_t;
-type update_modules_exec_t;
-init_system_domain(update_modules_t, update_modules_exec_t)
-roleattribute system_r update_modules_roles;
-role update_modules_roles types update_modules_t;
-
-type update_modules_tmp_t;
-files_tmp_file(update_modules_tmp_t)
-
-########################################
-#
-# depmod local policy
-#
-
-can_exec(depmod_t, depmod_exec_t)
-
-# Read conf.modules.
-read_files_pattern(depmod_t, modules_conf_t, modules_conf_t)
-
-allow depmod_t modules_dep_t:file manage_file_perms;
-files_kernel_modules_filetrans(depmod_t, modules_dep_t, file)
-
-kernel_read_system_state(depmod_t)
-
-corecmd_search_bin(depmod_t)
-
-domain_use_interactive_fds(depmod_t)
-
-files_read_kernel_symbol_table(depmod_t)
-files_read_kernel_modules(depmod_t)
-files_read_etc_runtime_files(depmod_t)
-files_read_etc_files(depmod_t)
-files_read_usr_src_files(depmod_t)
-files_list_usr(depmod_t)
-
-fs_getattr_xattr_fs(depmod_t)
-
-term_use_console(depmod_t)
-
-init_use_fds(depmod_t)
-init_use_script_fds(depmod_t)
-init_use_script_ptys(depmod_t)
-
-userdom_use_user_terminals(depmod_t)
-# Read System.map from home directories.
-files_list_home(depmod_t)
-userdom_read_user_home_content_files(depmod_t)
-
-ifdef(`distro_ubuntu',`
- optional_policy(`
- unconfined_domain(depmod_t)
- ')
-')
-
-tunable_policy(`use_nfs_home_dirs',`
- fs_read_nfs_files(depmod_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_read_cifs_files(depmod_t)
-')
-
-optional_policy(`
- rpm_rw_pipes(depmod_t)
- rpm_manage_script_tmp_files(depmod_t)
-')
-
-optional_policy(`
- # Read System.map from home directories.
- unconfined_domain(depmod_t)
-')
+type kmod_var_run_t;
+files_pid_file(kmod_var_run_t)
########################################
#
# insmod local policy
#
-allow insmod_t self:capability { dac_override net_raw sys_nice sys_tty_config };
-allow insmod_t self:process { execmem sigchld sigkill sigstop signull signal };
+allow kmod_t self:capability { dac_override net_raw sys_nice sys_tty_config };
+allow kmod_t self:process { execmem sigchld sigkill sigstop signull signal };
-allow insmod_t self:udp_socket create_socket_perms;
-allow insmod_t self:rawip_socket create_socket_perms;
+allow kmod_t self:udp_socket create_socket_perms;
+allow kmod_t self:rawip_socket create_socket_perms;
# Read module config and dependency information
-list_dirs_pattern(insmod_t, modules_conf_t, modules_conf_t)
-read_files_pattern(insmod_t, modules_conf_t, modules_conf_t)
-list_dirs_pattern(insmod_t, modules_dep_t, modules_dep_t)
-read_files_pattern(insmod_t, modules_dep_t, modules_dep_t)
-
-can_exec(insmod_t, insmod_exec_t)
-
-kernel_load_module(insmod_t)
-kernel_request_load_module(insmod_t)
-kernel_read_system_state(insmod_t)
-kernel_read_network_state(insmod_t)
-kernel_write_proc_files(insmod_t)
-kernel_mount_debugfs(insmod_t)
-kernel_mount_kvmfs(insmod_t)
-kernel_read_debugfs(insmod_t)
+list_dirs_pattern(kmod_t, modules_conf_t, modules_conf_t)
+read_files_pattern(kmod_t, modules_conf_t, modules_conf_t)
+list_dirs_pattern(kmod_t, modules_dep_t, modules_dep_t)
+manage_files_pattern(kmod_t, modules_dep_t, modules_dep_t)
+filetrans_add_pattern(kmod_t, modules_object_t, modules_dep_t, file)
+create_files_pattern(kmod_t, modules_object_t, modules_dep_t)
+delete_files_pattern(kmod_t, modules_object_t, modules_dep_t)
+
+can_exec(kmod_t, kmod_exec_t)
+
+kernel_load_module(kmod_t)
+kernel_request_load_module(kmod_t)
+kernel_read_system_state(kmod_t)
+kernel_read_network_state(kmod_t)
+kernel_write_proc_files(kmod_t)
+kernel_mount_debugfs(kmod_t)
+kernel_mount_kvmfs(kmod_t)
+kernel_read_debugfs(kmod_t)
# Rules for /proc/sys/kernel/tainted
-kernel_read_kernel_sysctls(insmod_t)
-kernel_rw_kernel_sysctl(insmod_t)
-kernel_read_hotplug_sysctls(insmod_t)
-kernel_setsched(insmod_t)
+kernel_read_kernel_sysctls(kmod_t)
+kernel_rw_kernel_sysctl(kmod_t)
+kernel_read_hotplug_sysctls(kmod_t)
+kernel_setsched(kmod_t)
# for when /var is not mounted early in the boot:
-kernel_dontaudit_search_unlabeled(insmod_t)
+kernel_dontaudit_search_unlabeled(kmod_t)
-corecmd_exec_bin(insmod_t)
-corecmd_exec_shell(insmod_t)
+corecmd_exec_bin(kmod_t)
+corecmd_exec_shell(kmod_t)
-dev_rw_sysfs(insmod_t)
-dev_search_usbfs(insmod_t)
-dev_rw_mtrr(insmod_t)
-dev_read_urand(insmod_t)
-dev_rw_agp(insmod_t)
-dev_read_sound(insmod_t)
-dev_write_sound(insmod_t)
-dev_rw_apm_bios(insmod_t)
-
-domain_signal_all_domains(insmod_t)
-domain_use_interactive_fds(insmod_t)
-
-files_read_kernel_modules(insmod_t)
-files_read_etc_runtime_files(insmod_t)
-files_read_etc_files(insmod_t)
-files_read_usr_files(insmod_t)
-files_exec_etc_files(insmod_t)
+# for /run/tmpfiles.d/kmod.conf
+files_pid_filetrans(kmod_t, kmod_var_run_t, dir)
+allow kmod_t kmod_var_run_t:dir manage_dir_perms;
+allow kmod_t kmod_var_run_t:file manage_file_perms;
+
+dev_rw_sysfs(kmod_t)
+dev_search_usbfs(kmod_t)
+dev_rw_mtrr(kmod_t)
+dev_read_urand(kmod_t)
+dev_rw_agp(kmod_t)
+dev_read_sound(kmod_t)
+dev_write_sound(kmod_t)
+dev_rw_apm_bios(kmod_t)
+
+domain_signal_all_domains(kmod_t)
+domain_use_interactive_fds(kmod_t)
+
+files_read_kernel_modules(kmod_t)
+files_read_etc_runtime_files(kmod_t)
+files_read_etc_files(kmod_t)
+files_read_usr_files(kmod_t)
+files_exec_etc_files(kmod_t)
# for nscd:
-files_dontaudit_search_pids(insmod_t)
+files_dontaudit_search_pids(kmod_t)
# for locking: (cjp: ????)
-files_write_kernel_modules(insmod_t)
+files_write_kernel_modules(kmod_t)
-fs_getattr_xattr_fs(insmod_t)
-fs_dontaudit_use_tmpfs_chr_dev(insmod_t)
+fs_getattr_xattr_fs(kmod_t)
+fs_dontaudit_use_tmpfs_chr_dev(kmod_t)
-init_rw_initctl(insmod_t)
-init_use_fds(insmod_t)
-init_use_script_fds(insmod_t)
-init_use_script_ptys(insmod_t)
+init_rw_initctl(kmod_t)
+init_use_fds(kmod_t)
+init_use_script_fds(kmod_t)
+init_use_script_ptys(kmod_t)
-logging_send_syslog_msg(insmod_t)
-logging_search_logs(insmod_t)
+logging_send_syslog_msg(kmod_t)
+logging_search_logs(kmod_t)
-miscfiles_read_localization(insmod_t)
+miscfiles_read_localization(kmod_t)
-seutil_read_file_contexts(insmod_t)
+seutil_read_file_contexts(kmod_t)
-userdom_use_user_terminals(insmod_t)
+userdom_use_user_terminals(kmod_t)
-userdom_dontaudit_search_user_home_dirs(insmod_t)
+userdom_dontaudit_search_user_home_dirs(kmod_t)
-kernel_domtrans_to(insmod_t, insmod_exec_t)
+kernel_domtrans_to(kmod_t, kmod_exec_t)
ifdef(`init_systemd',`
- kernel_search_key(insmod_t)
+ kernel_search_key(kmod_t)
- init_rw_stream_sockets(insmod_t)
+ init_rw_stream_sockets(kmod_t)
- systemd_write_kmod_files(insmod_t)
+ systemd_write_kmod_files(kmod_t)
')
optional_policy(`
- alsa_domtrans(insmod_t)
+ alsa_domtrans(kmod_t)
')
optional_policy(`
- firstboot_dontaudit_rw_pipes(insmod_t)
- firstboot_dontaudit_rw_stream_sockets(insmod_t)
+ firstboot_dontaudit_rw_pipes(kmod_t)
+ firstboot_dontaudit_rw_stream_sockets(kmod_t)
')
optional_policy(`
- hal_write_log(insmod_t)
+ hal_write_log(kmod_t)
')
optional_policy(`
- hotplug_search_config(insmod_t)
+ hotplug_search_config(kmod_t)
')
optional_policy(`
- mount_domtrans(insmod_t)
+ mount_domtrans(kmod_t)
')
optional_policy(`
- nis_use_ypbind(insmod_t)
+ nis_use_ypbind(kmod_t)
')
optional_policy(`
- nscd_use(insmod_t)
+ nscd_use(kmod_t)
')
optional_policy(`
- fs_manage_ramfs_files(insmod_t)
+ fs_manage_ramfs_files(kmod_t)
- rhgb_use_fds(insmod_t)
- rhgb_dontaudit_use_ptys(insmod_t)
+ rhgb_use_fds(kmod_t)
+ rhgb_dontaudit_use_ptys(kmod_t)
- xserver_dontaudit_write_log(insmod_t)
- xserver_stream_connect(insmod_t)
- xserver_dontaudit_rw_stream_sockets(insmod_t)
+ xserver_dontaudit_write_log(kmod_t)
+ xserver_stream_connect(kmod_t)
+ xserver_dontaudit_rw_stream_sockets(kmod_t)
ifdef(`hide_broken_symptoms',`
- xserver_dontaudit_rw_tcp_sockets(insmod_t)
+ xserver_dontaudit_rw_tcp_sockets(kmod_t)
')
')
optional_policy(`
- rpm_rw_pipes(insmod_t)
+ rpm_rw_pipes(kmod_t)
')
optional_policy(`
- unconfined_domain(insmod_t)
- unconfined_dontaudit_rw_pipes(insmod_t)
+ unconfined_domain(kmod_t)
+ unconfined_dontaudit_rw_pipes(kmod_t)
+ unconfined_domtrans_to(kmod_t, kmod_exec_t)
')
optional_policy(`
# cjp: why is this needed:
- dev_rw_xserver_misc(insmod_t)
+ dev_rw_xserver_misc(kmod_t)
- xserver_getattr_log(insmod_t)
+ xserver_getattr_log(kmod_t)
')
-#################################
-#
-# update-modules local policy
-#
-
-allow update_modules_t self:fifo_file rw_fifo_file_perms;
-
-allow update_modules_t modules_dep_t:file rw_file_perms;
-
-can_exec(update_modules_t, insmod_exec_t)
-can_exec(update_modules_t, update_modules_exec_t)
-
-# manage module loading configuration
-manage_files_pattern(update_modules_t, modules_conf_t, modules_conf_t)
-files_kernel_modules_filetrans(update_modules_t, modules_conf_t, file)
-files_etc_filetrans(update_modules_t, modules_conf_t, file)
-
-# transition to depmod
-domain_auto_trans(update_modules_t, depmod_exec_t, depmod_t)
-allow update_modules_t depmod_t:fd use;
-allow depmod_t update_modules_t:fd use;
-allow depmod_t update_modules_t:fifo_file rw_file_perms;
-allow depmod_t update_modules_t:process sigchld;
-
-manage_dirs_pattern(update_modules_t, update_modules_tmp_t, update_modules_tmp_t)
-manage_files_pattern(update_modules_t, update_modules_tmp_t, update_modules_tmp_t)
-files_tmp_filetrans(update_modules_t, update_modules_tmp_t, { file dir })
-
-kernel_read_kernel_sysctls(update_modules_t)
-kernel_read_system_state(update_modules_t)
-
-corecmd_exec_bin(update_modules_t)
-corecmd_exec_shell(update_modules_t)
-
-dev_read_urand(update_modules_t)
-
-domain_use_interactive_fds(update_modules_t)
-
-files_read_etc_runtime_files(update_modules_t)
-files_read_etc_files(update_modules_t)
-files_exec_etc_files(update_modules_t)
-
-fs_getattr_xattr_fs(update_modules_t)
-
-term_use_console(update_modules_t)
-
-init_use_fds(update_modules_t)
-init_use_script_fds(update_modules_t)
-init_use_script_ptys(update_modules_t)
-
-logging_send_syslog_msg(update_modules_t)
-
-miscfiles_read_localization(update_modules_t)
-
-modutils_run_insmod(update_modules_t, update_modules_roles)
-
-userdom_use_user_terminals(update_modules_t)
-userdom_dontaudit_search_user_home_dirs(update_modules_t)
-
-ifdef(`distro_gentoo',`
- kernel_list_unlabeled(update_modules_t) # /var
-
- files_search_pids(update_modules_t)
- files_getattr_usr_src_files(update_modules_t)
-
- # update-modules on Gentoo throws errors when run because it
- # sources /etc/init.d/functions.sh, which always scans
- # /var/lib/init.d to set SOFTLEVEL environment var.
- # This is never used by update-modules.
- files_dontaudit_search_var_lib(update_modules_t)
- init_dontaudit_read_script_status_files(update_modules_t)
-
- optional_policy(`
- consoletype_exec(update_modules_t)
- ')
-')
-
-ifdef(`distro_ubuntu',`
- optional_policy(`
- unconfined_domain(update_modules_t)
- ')
-')
Index: refpolicy-2.20160928/policy/modules/kernel/kernel.te
===================================================================
--- refpolicy-2.20160928.orig/policy/modules/kernel/kernel.te
+++ refpolicy-2.20160928/policy/modules/kernel/kernel.te
@@ -278,6 +278,9 @@ selinux_load_policy(kernel_t)
term_use_console(kernel_t)
+# for kdevtmpfs
+term_setattr_unlink_unallocated_ttys(kernel_t)
+
corecmd_exec_shell(kernel_t)
corecmd_list_bin(kernel_t)
# /proc/sys/kernel/modprobe is set to /bin/true if not using modules.
Index: refpolicy-2.20160928/policy/modules/kernel/terminal.if
===================================================================
--- refpolicy-2.20160928.orig/policy/modules/kernel/terminal.if
+++ refpolicy-2.20160928/policy/modules/kernel/terminal.if
@@ -1121,6 +1121,26 @@ interface(`term_getattr_unallocated_ttys
########################################
## <summary>
+## Setattr and unlink unallocated tty device nodes.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+## <rolecap/>
+#
+interface(`term_setattr_unlink_unallocated_ttys',`
+ gen_require(`
+ type tty_device_t;
+ ')
+
+ dev_list_all_dev_nodes($1)
+ allow $1 tty_device_t:chr_file { getattr setattr unlink };
+')
+
+########################################
+## <summary>
## Do not audit attempts to get the attributes
## of all unallocated tty device nodes.
## </summary>
Index: refpolicy-2.20160928/policy/modules/system/modutils.fc
===================================================================
--- refpolicy-2.20160928.orig/policy/modules/system/modutils.fc
+++ refpolicy-2.20160928/policy/modules/system/modutils.fc
@@ -1,4 +1,4 @@
-/bin/kmod -- gen_context(system_u:object_r:insmod_exec_t,s0)
+/bin/kmod -- gen_context(system_u:object_r:kmod_exec_t,s0)
/etc/modules\.conf.* -- gen_context(system_u:object_r:modules_conf_t,s0)
/etc/modprobe\.conf.* -- gen_context(system_u:object_r:modules_conf_t,s0)
@@ -14,12 +14,13 @@ ifdef(`distro_gentoo',`
/lib/modules/modprobe\.conf -- gen_context(system_u:object_r:modules_conf_t,s0)
-/sbin/depmod.* -- gen_context(system_u:object_r:depmod_exec_t,s0)
-/sbin/generate-modprobe\.conf -- gen_context(system_u:object_r:update_modules_exec_t,s0)
-/sbin/insmod.* -- gen_context(system_u:object_r:insmod_exec_t,s0)
-/sbin/modprobe.* -- gen_context(system_u:object_r:insmod_exec_t,s0)
-/sbin/modules-update -- gen_context(system_u:object_r:update_modules_exec_t,s0)
-/sbin/rmmod.* -- gen_context(system_u:object_r:insmod_exec_t,s0)
-/sbin/update-modules -- gen_context(system_u:object_r:update_modules_exec_t,s0)
+/sbin/depmod.* -- gen_context(system_u:object_r:kmod_exec_t,s0)
+/sbin/generate-modprobe\.conf -- gen_context(system_u:object_r:kmod_exec_t,s0)
+/sbin/insmod.* -- gen_context(system_u:object_r:kmod_exec_t,s0)
+/sbin/modprobe.* -- gen_context(system_u:object_r:kmod_exec_t,s0)
+/sbin/modules-update -- gen_context(system_u:object_r:kmod_exec_t,s0)
+/sbin/rmmod.* -- gen_context(system_u:object_r:kmod_exec_t,s0)
+/sbin/update-modules -- gen_context(system_u:object_r:kmod_exec_t,s0)
-/usr/bin/kmod -- gen_context(system_u:object_r:insmod_exec_t,s0)
+/usr/bin/kmod -- gen_context(system_u:object_r:kmod_exec_t,s0)
+/var/run/tmpfiles.d(/.*)? gen_context(system_u:object_r:kmod_var_run_t,s0)
^ permalink raw reply [flat|nested] 6+ messages in thread
* [refpolicy] [PATCH] single binary modutils
2016-10-21 8:35 ` Russell Coker
@ 2016-10-23 23:28 ` Chris PeBenito
0 siblings, 0 replies; 6+ messages in thread
From: Chris PeBenito @ 2016-10-23 23:28 UTC (permalink / raw)
To: refpolicy
On 10/21/16 04:35, Russell Coker wrote:
> On Tuesday, 2 August 2016 7:59:28 PM AEDT Chris PeBenito wrote:
>> On 07/31/16 08:34, Russell Coker wrote:
>>> The following patch deals with a single binary for modutils, so depmod_t,
>>> and insmod_t are merged.
>>
>> Since the main SELinux distros (including RHEL/CentOS 7) all have merged
>> modutils these days, I'm open to taking a patch that fully merges these
>> domains (in which case renaming to kmod_t, with proper aliasing seems
>> the best idea).
>>
>> However, it's been some time since I used a busybox-based system; does
>> busybox still have separated tools? Yes, this is a bit of an obvious
>> question since busybox is also single-binary, but IIRC, the embedded
>> guys made some tiny helper scripts or executables so proper
>> transitioning could occur. Separate domains may still make sense.
>
> As we have had no response from Busybox users in the last 3 months and also no
> response to the thread Luis started in 2013 I think it's safe to assume that
> they don't need this.
>
> I've attached a new patch which renames to kmod_t as you suggested. Please
> consider it for inclusion.
>
> Description: Change modutils policy to match the use of a single binary
> Author: Russell Coker <russell@coker.com.au>
> Last-Update: 2014-06-25
>
> Index: refpolicy-2.20160928/policy/modules/system/modutils.te
> ===================================================================
> --- refpolicy-2.20160928.orig/policy/modules/system/modutils.te
> +++ refpolicy-2.20160928/policy/modules/system/modutils.te
> @@ -5,18 +5,15 @@ policy_module(modutils, 1.16.0)
> # Declarations
> #
>
> -attribute_role update_modules_roles;
> +type kmod_t;
> +typealias kmod_t alias { insmod_t depmod_t update_modules_t };
Nitpicky, but I'd prefer to have the aliases on the type declaration
line here (and below)
> -type depmod_t;
> -type depmod_exec_t;
> -init_system_domain(depmod_t, depmod_exec_t)
> -role system_r types depmod_t;
> -
> -type insmod_t;
> -type insmod_exec_t;
> -application_domain(insmod_t, insmod_exec_t)
> -mls_file_write_all_levels(insmod_t)
> -role system_r types insmod_t;
> +type kmod_exec_t;
> +typealias kmod_exec_t alias { insmod_exec_t depmod_exec_t update_modules_exec_t };
> +
> +application_domain(kmod_t, kmod_exec_t)
> +mls_file_write_all_levels(kmod_t)
> +role system_r types kmod_t;
>
> # module loading config
> type modules_conf_t;
> @@ -26,306 +23,164 @@ files_type(modules_conf_t)
> type modules_dep_t;
> files_type(modules_dep_t)
>
> -type update_modules_t;
> -type update_modules_exec_t;
> -init_system_domain(update_modules_t, update_modules_exec_t)
It looks like the init_system_domain() was lost.
> -roleattribute system_r update_modules_roles;
> -role update_modules_roles types update_modules_t;
This removal appears to break modutils_run_update_mods() at least.
> -type update_modules_tmp_t;
> -files_tmp_file(update_modules_tmp_t)
> -
> -########################################
> -#
> -# depmod local policy
> -#
> -
> -can_exec(depmod_t, depmod_exec_t)
> -
> -# Read conf.modules.
> -read_files_pattern(depmod_t, modules_conf_t, modules_conf_t)
> -
> -allow depmod_t modules_dep_t:file manage_file_perms;
> -files_kernel_modules_filetrans(depmod_t, modules_dep_t, file)
> -
> -kernel_read_system_state(depmod_t)
> -
> -corecmd_search_bin(depmod_t)
> -
> -domain_use_interactive_fds(depmod_t)
> -
> -files_read_kernel_symbol_table(depmod_t)
> -files_read_kernel_modules(depmod_t)
> -files_read_etc_runtime_files(depmod_t)
> -files_read_etc_files(depmod_t)
> -files_read_usr_src_files(depmod_t)
> -files_list_usr(depmod_t)
> -
> -fs_getattr_xattr_fs(depmod_t)
> -
> -term_use_console(depmod_t)
> -
> -init_use_fds(depmod_t)
> -init_use_script_fds(depmod_t)
> -init_use_script_ptys(depmod_t)
> -
> -userdom_use_user_terminals(depmod_t)
> -# Read System.map from home directories.
> -files_list_home(depmod_t)
> -userdom_read_user_home_content_files(depmod_t)
> -
> -ifdef(`distro_ubuntu',`
> - optional_policy(`
> - unconfined_domain(depmod_t)
> - ')
> -')
> -
> -tunable_policy(`use_nfs_home_dirs',`
> - fs_read_nfs_files(depmod_t)
> -')
> -
> -tunable_policy(`use_samba_home_dirs',`
> - fs_read_cifs_files(depmod_t)
> -')
> -
> -optional_policy(`
> - rpm_rw_pipes(depmod_t)
> - rpm_manage_script_tmp_files(depmod_t)
> -')
> -
> -optional_policy(`
> - # Read System.map from home directories.
> - unconfined_domain(depmod_t)
> -')
> +type kmod_var_run_t;
> +files_pid_file(kmod_var_run_t)
Please move these above the modules_*_t declarations.
> ########################################
> #
> # insmod local policy
> #
>
> -allow insmod_t self:capability { dac_override net_raw sys_nice sys_tty_config };
> -allow insmod_t self:process { execmem sigchld sigkill sigstop signull signal };
> +allow kmod_t self:capability { dac_override net_raw sys_nice sys_tty_config };
> +allow kmod_t self:process { execmem sigchld sigkill sigstop signull signal };
>
> -allow insmod_t self:udp_socket create_socket_perms;
> -allow insmod_t self:rawip_socket create_socket_perms;
> +allow kmod_t self:udp_socket create_socket_perms;
> +allow kmod_t self:rawip_socket create_socket_perms;
>
> # Read module config and dependency information
> -list_dirs_pattern(insmod_t, modules_conf_t, modules_conf_t)
> -read_files_pattern(insmod_t, modules_conf_t, modules_conf_t)
> -list_dirs_pattern(insmod_t, modules_dep_t, modules_dep_t)
> -read_files_pattern(insmod_t, modules_dep_t, modules_dep_t)
> -
> -can_exec(insmod_t, insmod_exec_t)
> -
> -kernel_load_module(insmod_t)
> -kernel_request_load_module(insmod_t)
> -kernel_read_system_state(insmod_t)
> -kernel_read_network_state(insmod_t)
> -kernel_write_proc_files(insmod_t)
> -kernel_mount_debugfs(insmod_t)
> -kernel_mount_kvmfs(insmod_t)
> -kernel_read_debugfs(insmod_t)
> +list_dirs_pattern(kmod_t, modules_conf_t, modules_conf_t)
> +read_files_pattern(kmod_t, modules_conf_t, modules_conf_t)
> +list_dirs_pattern(kmod_t, modules_dep_t, modules_dep_t)
> +manage_files_pattern(kmod_t, modules_dep_t, modules_dep_t)
> +filetrans_add_pattern(kmod_t, modules_object_t, modules_dep_t, file)
> +create_files_pattern(kmod_t, modules_object_t, modules_dep_t)
> +delete_files_pattern(kmod_t, modules_object_t, modules_dep_t)
> +
> +can_exec(kmod_t, kmod_exec_t)
> +
> +kernel_load_module(kmod_t)
> +kernel_request_load_module(kmod_t)
> +kernel_read_system_state(kmod_t)
> +kernel_read_network_state(kmod_t)
> +kernel_write_proc_files(kmod_t)
> +kernel_mount_debugfs(kmod_t)
> +kernel_mount_kvmfs(kmod_t)
> +kernel_read_debugfs(kmod_t)
> # Rules for /proc/sys/kernel/tainted
> -kernel_read_kernel_sysctls(insmod_t)
> -kernel_rw_kernel_sysctl(insmod_t)
> -kernel_read_hotplug_sysctls(insmod_t)
> -kernel_setsched(insmod_t)
> +kernel_read_kernel_sysctls(kmod_t)
> +kernel_rw_kernel_sysctl(kmod_t)
> +kernel_read_hotplug_sysctls(kmod_t)
> +kernel_setsched(kmod_t)
> # for when /var is not mounted early in the boot:
> -kernel_dontaudit_search_unlabeled(insmod_t)
> +kernel_dontaudit_search_unlabeled(kmod_t)
>
> -corecmd_exec_bin(insmod_t)
> -corecmd_exec_shell(insmod_t)
> +corecmd_exec_bin(kmod_t)
> +corecmd_exec_shell(kmod_t)
>
> -dev_rw_sysfs(insmod_t)
> -dev_search_usbfs(insmod_t)
> -dev_rw_mtrr(insmod_t)
> -dev_read_urand(insmod_t)
> -dev_rw_agp(insmod_t)
> -dev_read_sound(insmod_t)
> -dev_write_sound(insmod_t)
> -dev_rw_apm_bios(insmod_t)
> -
> -domain_signal_all_domains(insmod_t)
> -domain_use_interactive_fds(insmod_t)
> -
> -files_read_kernel_modules(insmod_t)
> -files_read_etc_runtime_files(insmod_t)
> -files_read_etc_files(insmod_t)
> -files_read_usr_files(insmod_t)
> -files_exec_etc_files(insmod_t)
> +# for /run/tmpfiles.d/kmod.conf
> +files_pid_filetrans(kmod_t, kmod_var_run_t, dir)
> +allow kmod_t kmod_var_run_t:dir manage_dir_perms;
> +allow kmod_t kmod_var_run_t:file manage_file_perms;
Please move these three kmod_var_run_t lines above the modules_conf_t
group of lines (line 35 from what I see).
[...]
> # /proc/sys/kernel/modprobe is set to /bin/true if not using modules.
> Index: refpolicy-2.20160928/policy/modules/kernel/terminal.if
> ===================================================================
> --- refpolicy-2.20160928.orig/policy/modules/kernel/terminal.if
> +++ refpolicy-2.20160928/policy/modules/kernel/terminal.if
> @@ -1121,6 +1121,26 @@ interface(`term_getattr_unallocated_ttys
>
> ########################################
> ## <summary>
> +## Setattr and unlink unallocated tty device nodes.
> +## </summary>
> +## <param name="domain">
> +## <summary>
> +## Domain allowed access.
> +## </summary>
> +## </param>
> +## <rolecap/>
> +#
> +interface(`term_setattr_unlink_unallocated_ttys',`
There already are term_(get|set)attr_unallocated_ttys, so I'd prefer to
add a delete one for the unlink perm.
> + gen_require(`
> + type tty_device_t;
> + ')
> +
> + dev_list_all_dev_nodes($1)
> + allow $1 tty_device_t:chr_file { getattr setattr unlink };
> +')
> +
--
Chris PeBenito
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2016-10-23 23:28 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-07-31 12:34 [refpolicy] [PATCH] single binary modutils Russell Coker
2016-08-02 23:59 ` Chris PeBenito
2016-08-03 2:33 ` Russell Coker
2016-08-06 20:53 ` Chris PeBenito
2016-10-21 8:35 ` Russell Coker
2016-10-23 23:28 ` Chris PeBenito
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.