[refpolicy] [PATCH] gpg: manage user runtime socket files and directories

From: dac.override@gmail.com (Dominick Grift)
To: refpolicy@oss.tresys.com
Subject: [refpolicy] [PATCH] gpg: manage user runtime socket files and directories
Date: Tue, 23 May 2017 08:43:31 +0200	[thread overview]
Message-ID: <20170523064331.GA23273@julius.enp8s0.d30> (raw)
In-Reply-To: <1F5CB8FD-2213-4ADC-B078-EDD507FA9500@trentalancia.com>

On Tue, May 23, 2017 at 03:04:52AM +0200, Guido Trentalancia via refpolicy wrote:
> Hello and thanks for getting back... 
> 
> On the 23rd of May 2017 01:24:59 CEST, Chris PeBenito <pebenito@ieee.org> wrote:
> >On 05/21/2017 12:21 PM, Guido Trentalancia via refpolicy wrote:
> >> Update the gpg module so that it can correctly manage socket files
> >> and directories in the user runtime directories.
> >>
> >> Some other minor fixes are also included in this patch.
> >>
> >> Signed-off-by: Guido Trentalancia <guido@trentalancia.com>
> >> ---
> >>  policy/modules/contrib/gpg.te |   10 +++++++++-
> >>  1 file changed, 9 insertions(+), 1 deletion(-)
> >>
> >> --- a/policy/modules/contrib/gpg.te	2017-04-26 17:47:20.555423022
> >+0200
> >> +++ b/policy/modules/contrib/gpg.te	2017-05-21 18:13:36.728343506
> >+0200
> >> @@ -124,6 +124,8 @@ miscfiles_read_localization(gpg_t)
> >>
> >>  userdom_use_user_terminals(gpg_t)
> >>
> >> +userdom_manage_user_runtime_dirs(gpg_t)
> >> +userdom_manage_user_tmp_dirs(gpg_t)
> >>  userdom_manage_user_tmp_files(gpg_t)
> >>  userdom_manage_user_home_content_files(gpg_t)
> >>  userdom_user_home_dir_filetrans_user_home_content(gpg_t, file)
> >> @@ -247,10 +249,14 @@ fs_dontaudit_list_inotifyfs(gpg_agent_t)
> >>
> >>  miscfiles_read_localization(gpg_agent_t)
> >>
> >> +userdom_manage_user_runtime_dirs(gpg_agent_t)
> >> +userdom_manage_user_tmp_dirs(gpg_agent_t)
> >> +userdom_manage_user_tmp_files(gpg_agent_t)
> >
> >It's not clear whats going on here, but perhaps these make more sense
> >as 
> >a new gpg_runtime_t?
> 
> The agent should be able to create a gnupg directory in /var/run/user/USERID/ and manage socket files in that directory... 

the agent can't create USERID because its parent is owned by root and gpg-agent does not have permission to add directory entries to /var/run/user. systemd-logind , or some other privileged process, creates USERID generally on behalf of the user
also the sockets should not go to /var/run/user/USERID/ , but instead should go to /var/run/user/USERID/gnupg/ and gnupg can be creeted with an automatic type transition

> 
> >>  userdom_use_user_terminals(gpg_agent_t)
> >>  userdom_search_user_home_dirs(gpg_agent_t)
> >>  userdom_search_user_runtime(gpg_agent_t)
> >> -userdom_user_runtime_filetrans(gpg_agent_t, gpg_agent_tmp_t, dir)
> >> +userdom_user_runtime_filetrans(gpg_agent_t, gpg_agent_tmp_t, { dir
> >file sock_file })
> >>
> >>  ifdef(`hide_broken_symptoms',`
> >>  	userdom_dontaudit_read_user_tmp_files(gpg_agent_t)
> >> @@ -310,6 +316,7 @@ fs_tmpfs_filetrans(gpg_pinentry_t, gpg_p
> >>
> >>  can_exec(gpg_pinentry_t, gpg_pinentry_exec_t)
> >>
> >> +kernel_dontaudit_search_sysctl(gpg_pinentry_t)
> >>  kernel_read_system_state(gpg_pinentry_t)
> >>
> >>  corecmd_exec_shell(gpg_pinentry_t)
> >> @@ -327,6 +334,7 @@ domain_use_interactive_fds(gpg_pinentry_
> >>
> >>  files_read_usr_files(gpg_pinentry_t)
> >>
> >> +fs_dontaudit_getattr_xattr_fs(gpg_pinentry_t)
> >>  fs_dontaudit_list_inotifyfs(gpg_pinentry_t)
> >>
> >>  auth_use_nsswitch(gpg_pinentry_t)
> 
> _______________________________________________
> refpolicy mailing list
> refpolicy at oss.tresys.com
> http://oss.tresys.com/mailman/listinfo/refpolicy

-- 
Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8  02D5 3B6C 5F1D 2C7B 6B02
https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02
Dominick Grift
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 659 bytes
Desc: not available
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20170523/17d871b0/attachment.bin 