All of lore.kernel.org
 help / color / mirror / Atom feed
From: Dominick Grift <dominick.grift@defensec.nl>
To: selinux@vger.kernel.org
Cc: Dominick Grift <dominick.grift@defensec.nl>
Subject: [PATCH] scripts/selinux: modernize mdp
Date: Wed, 20 Feb 2019 13:33:54 +0100	[thread overview]
Message-ID: <20190220123354.1589-1-dominick.grift@defensec.nl> (raw)

The MDP example no longer works on modern systems.

Add support for devtmpfs. This is required by login programs to relabel terminals.
Compile the policy with deny_unknown allow status to anticipate user space object managers in core components such as systemd.
Add default seusers mapping and failsafe context for the SELinux PAM module.

Signed-off-by: Dominick Grift <dominick.grift@defensec.nl>
---
 scripts/selinux/install_policy.sh | 6 +++++-
 scripts/selinux/mdp/mdp.c         | 1 +
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/scripts/selinux/install_policy.sh b/scripts/selinux/install_policy.sh
index 0b86c47baf7d..334fcf8903d5 100755
--- a/scripts/selinux/install_policy.sh
+++ b/scripts/selinux/install_policy.sh
@@ -20,14 +20,18 @@ CP=`which checkpolicy`
 VERS=`$CP -V | awk '{print $1}'`
 
 ./mdp policy.conf file_contexts
-$CP -o policy.$VERS policy.conf
+$CP -U allow -o policy.$VERS policy.conf
 
 mkdir -p /etc/selinux/dummy/policy
 mkdir -p /etc/selinux/dummy/contexts/files
 
+echo "__default__:user_u" > /etc/selinux/dummy/seusers
+echo "base_r:base_t" > /etc/selinux/dummy/contexts/failsafe_context
+
 cp file_contexts /etc/selinux/dummy/contexts/files
 cp dbus_contexts /etc/selinux/dummy/contexts
 cp policy.$VERS /etc/selinux/dummy/policy
+
 FC_FILE=/etc/selinux/dummy/contexts/files/file_contexts
 
 if [ ! -d /etc/selinux ]; then
diff --git a/scripts/selinux/mdp/mdp.c b/scripts/selinux/mdp/mdp.c
index 073fe7537f6c..cf06d5694cbc 100644
--- a/scripts/selinux/mdp/mdp.c
+++ b/scripts/selinux/mdp/mdp.c
@@ -131,6 +131,7 @@ int main(int argc, char *argv[])
 
 	fprintf(fout, "fs_use_trans mqueue user_u:base_r:base_t;\n");
 	fprintf(fout, "fs_use_trans devpts user_u:base_r:base_t;\n");
+	fprintf(fout, "fs_use_trans devtmpfs user_u:base_r:base_t;\n");
 	fprintf(fout, "fs_use_trans hugetlbfs user_u:base_r:base_t;\n");
 	fprintf(fout, "fs_use_trans tmpfs user_u:base_r:base_t;\n");
 	fprintf(fout, "fs_use_trans shm user_u:base_r:base_t;\n");
-- 
2.21.0.rc1


             reply	other threads:[~2019-02-20 12:43 UTC|newest]

Thread overview: 23+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-02-20 12:33 Dominick Grift [this message]
2019-02-20 14:09 ` [PATCH] scripts/selinux: modernize mdp Dominick Grift
2019-02-20 14:47   ` Dominick Grift
2019-02-20 19:21     ` Stephen Smalley
2019-02-20 19:25       ` Stephen Smalley
2019-02-20 19:35         ` Dominick Grift
2019-02-20 15:19 ` [PATCH v2] " Dominick Grift
2019-02-20 15:34 ` [PATCH v3] " Dominick Grift
2019-02-20 19:34   ` Stephen Smalley
2019-02-20 19:36     ` Dominick Grift
2019-02-20 20:25     ` Dominick Grift
2019-02-21 18:42 [PATCH] " Stephen Smalley
2019-02-21 19:34 ` Stephen Smalley
2019-02-21 19:44   ` Dominick Grift
2019-02-21 20:28     ` Stephen Smalley
2019-02-21 20:56       ` Dominick Grift
2019-02-22 15:13         ` Stephen Smalley
2019-02-22 15:35           ` Dominick Grift
2019-02-22 15:46             ` Stephen Smalley
2019-02-21 20:11 ` Dominick Grift
2019-02-21 20:22   ` Stephen Smalley
2019-02-21 20:32     ` Dominick Grift
2019-02-21 20:46     ` Dominick Grift

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190220123354.1589-1-dominick.grift@defensec.nl \
    --to=dominick.grift@defensec.nl \
    --cc=selinux@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.