[refpolicy] cron patches and remaining questions

[harrytaurus2002@hotmail.com (HarryCiao)]

Hello Guido,
 

> Subject: Re: [refpolicy] cron patches and remaining questions
> From: guido at trentalancia.com
> To: harrytaurus2002 at hotmail.com
> CC: refpolicy at oss.tresys.com
> Date: Mon, 31 Jan 2011 22:54:10 +0100
> 
> Hello Harry,
> 
> just a quick comment on the first two issues...
> 
> On Mon, 31/01/2011 at 11.20 +0000, HarryCiao wrote:
> > Hi Chris and all,
> > 
> > I've run into some cron issues and come up with the attached 3
> > patches, so far I am new to cron and cron.pp so it's likely there is a
> > better way to fix the problems, any comments are greatly welcomed!
> > 
> > Aslo there are a few cron problems that have not been fixed after
> > applying these 3 patches:
> > 
> > 1. on creation of /var/log/cron.log, its label is still var_log_t, the
> > type_transition rule still not take effect;
> 
> This is consistent with the file contexts as specified by the reference
> policy. What do you expect as a label for cron log files ?
 
Because logging_log_filetrans interface has been called for the crond_t and system_cronjob_t:
 
cao at cao-laptop:/work/selinux/refpolicy/policy/modules$ grep logging_log_filetrans services/cron.te
logging_log_filetrans(crond_t, cron_log_t, file)
logging_log_filetrans(system_cronjob_t, cron_log_t, file)
cao at cao-laptop:/work/selinux/refpolicy/policy/modules$
 
So I expect when the crond_t creates cron log files during system booting up, this newly created file should be auto-labeled as cron_log_t, rather than the inherited label for its parent directory.
 
BTW, once we fix the label of /var/log/cron(\.log)? file, we also have to grant the write permission on it to the syslogd_t domain.

> 
> > 2. on creation of /var/spool/cron/root by the crontab command, its
> > label is still cron_spool_t, the type_transition rule still not take
> > effect;
> 
> Similar considerations as above apply here (behaviour appears consistent
> with current file context definitions in the reference policy). What
> label do you expect for root's crontab ? Perhaps sysadm_cron_spool_t ?
> It's actually commented out in the file context for the cron module.
> 
> It's very easy to change the labels, one just needs to modify the
> relative cron.fc file under policy/modules/services. But what would you
> change that to ? And will that be desirable for all refpolicy users ?
> 
> I have not had time to look at your patches yet, but what problem are
> they supposed to tackle ? Is the problem relevant to all refpolicy
> users ?
> 
 
Again, the cron_common_crontab_template has called the interface filetrans_pattern($1_t, cron_spool_t, user_cron_spool_t, file) for crontab_t and admin_crontab_t domains, so whenever root user or non-root user uses crontab command to register a new crontab files, the created /var/spool/cron/[user] files should be auto-label as user_cron_spool_t, rather than cron_spool_t, otherwise cronjob_t won't have the required entrypoint permission on it.
 
Cheers,
Harry

> Regards,
> 
> Guido
> 
 		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://oss.tresys.com/pipermail/refpolicy/attachments/20110201/3e7c190e/attachment-0001.html