From: Chris PeBenito <pebenito@ieee.org>
To: Russell Coker <russell@coker.com.au>, selinux-refpolicy@vger.kernel.org
Subject: Re: [PATCH] gpg
Date: Wed, 9 Jan 2019 19:11:20 -0500 [thread overview]
Message-ID: <ba3deeb7-390d-d587-7827-339a910d3aa1@ieee.org> (raw)
In-Reply-To: <20190108085110.GA28727@xev>
On 1/8/19 3:51 AM, Russell Coker wrote:
>
> Description: Create user_gpg_t etc domains, remove gpg_helper_t & gpg_pinentry_t
> Only transition to gpg_t from user_t to solve problems with X sessions.
I'd keep staff too, as that is also an unpriv role.
> Also remove gpg_helper_t and gpg_pinentry_t because they don't do any good.
Can you give a little more of an argument as to why they're not helpful?
I'm not against this, but I don't see what the argument is.
Also, if they are removed, all the rules need to be removed, not just
eliminate the labeling.
> Author: Russell Coker <russell@coker.com.au>
> Last-Update: 2015-01-12
>
> Index: refpolicy-2.20180701/policy/modules/apps/gpg.fc
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/apps/gpg.fc
> +++ refpolicy-2.20180701/policy/modules/apps/gpg.fc
> @@ -6,10 +6,10 @@ HOME_DIR/\.gnupg/S\.scdaemon -s gen_con
> /usr/bin/gpg(2)? -- gen_context(system_u:object_r:gpg_exec_t,s0)
> /usr/bin/gpgsm -- gen_context(system_u:object_r:gpg_exec_t,s0)
> /usr/bin/gpg-agent -- gen_context(system_u:object_r:gpg_agent_exec_t,s0)
> -/usr/bin/pinentry.* -- gen_context(system_u:object_r:gpg_pinentry_exec_t,s0)
> +/usr/bin/pinentry.* -- gen_context(system_u:object_r:gpg_exec_t,s0)
>
> /usr/lib/gnupg/.* -- gen_context(system_u:object_r:gpg_exec_t,s0)
> -/usr/lib/gnupg/gpgkeys.* -- gen_context(system_u:object_r:gpg_helper_exec_t,s0)
> +/usr/lib/gnupg/gpgkeys.* -- gen_context(system_u:object_r:gpg_exec_t,s0)
>
> /run/user/%{USERID}/gnupg(/.*)? gen_context(system_u:object_r:gpg_runtime_t,s0)
> /run/user/%{USERID}/gnupg/S\.gpg-agent.* -s gen_context(system_u:object_r:gpg_agent_tmp_t,s0)
> Index: refpolicy-2.20180701/policy/modules/roles/staff.te
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/roles/staff.te
> +++ refpolicy-2.20180701/policy/modules/roles/staff.te
> @@ -118,10 +118,6 @@ ifndef(`distro_redhat',`
> ')
>
> optional_policy(`
> - gpg_role(staff_r, staff_t)
> - ')
> -
> - optional_policy(`
> irc_role(staff_r, staff_t)
> ')
>
> Index: refpolicy-2.20180701/policy/modules/roles/sysadm.te
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/roles/sysadm.te
> +++ refpolicy-2.20180701/policy/modules/roles/sysadm.te
> @@ -1304,10 +1304,6 @@ ifndef(`distro_redhat',`
> ')
>
> optional_policy(`
> - gpg_role(sysadm_r, sysadm_t)
> - ')
> -
> - optional_policy(`
> irc_role(sysadm_r, sysadm_t)
> ')
>
> Index: refpolicy-2.20180701/policy/modules/apps/gpg.if
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/apps/gpg.if
> +++ refpolicy-2.20180701/policy/modules/apps/gpg.if
> @@ -31,6 +31,11 @@ interface(`gpg_role',`
> domtrans_pattern($2, gpg_exec_t, gpg_t)
> domtrans_pattern($2, gpg_agent_exec_t, gpg_agent_t)
>
> + # transition to user_t when running ck-launch-session or other bin_t
> + corecmd_bin_domtrans(gpg_agent_t, $2)
> + allow gpg_agent_t $2:process signull;
> + allow $2 gpg_agent_t:fd use;
> +
> allow $2 self:process setrlimit;
> allow $2 { gpg_t gpg_agent_t gpg_helper_t gpg_pinentry_t }:process { ptrace signal_perms };
> ps_process_pattern($2, { gpg_t gpg_agent_t gpg_helper_t gpg_pinentry_t })
> @@ -46,6 +51,9 @@ interface(`gpg_role',`
> filetrans_pattern($2, gpg_secret_t, gpg_agent_tmp_t, sock_file, "log-socket")
> userdom_user_home_dir_filetrans($2, gpg_secret_t, dir, ".gnupg")
>
> + # so gpg_agent_t can append to .xsession-errors
> + userdom_append_inherited_user_home_content_files(gpg_agent_t)
> +
> optional_policy(`
> gpg_pinentry_dbus_chat($2)
> ')
> @@ -179,6 +187,28 @@ interface(`gpg_signal',`
> allow $1 gpg_t:process signal;
> ')
>
> +#######################################
> +## <summary>
> +## Transition to $2_gpg_agent_t from another domain via gpg_agent_exec_t
> +## </summary>
> +## <param name="domain">
> +## <summary>
> +## source domain
> +## </summary>
> +## </param>
> +## <param name="domain">
> +## <summary>
> +## base of target domain
> +## </summary>
> +## </param>
> +#
> +interface(`gpg_enter_user_gpg_agent_domain',`
> + gen_require(`
> + type gpg_agent_exec_t, $2_gpg_agent_t;
> + ')
> + domain_auto_transition_pattern($1, gpg_agent_exec_t, $2_gpg_agent_t)
> +')
> +
> ########################################
> ## <summary>
> ## Read and write gpg agent pipes.
> Index: refpolicy-2.20180701/policy/modules/roles/unprivuser.te
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/roles/unprivuser.te
> +++ refpolicy-2.20180701/policy/modules/roles/unprivuser.te
> @@ -157,8 +157,9 @@ ifndef(`distro_redhat',`
> spamassassin_role(user_r, user_t)
> ')
>
> - optional_policy(`
> + optional_policy(`
> ssh_role_template(user, user_r, user_t)
> + gpg_enter_user_gpg_agent_domain(user_ssh_agent_t)
> ')
>
> optional_policy(`
> Index: refpolicy-2.20180701/policy/modules/system/userdomain.if
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/system/userdomain.if
> +++ refpolicy-2.20180701/policy/modules/system/userdomain.if
> @@ -2139,6 +2139,24 @@ interface(`userdom_dontaudit_append_user
>
> ########################################
> ## <summary>
> +## Allow append on inherited user home files.
> +## </summary>
> +## <param name="domain">
> +## <summary>
> +## Domain to allow.
> +## </summary>
> +## </param>
> +#
> +interface(`userdom_append_inherited_user_home_content_files',`
> + gen_require(`
> + type user_home_t;
> + ')
> +
> + allow $1 user_home_t:file { append getattr ioctl };
> +')
> +
> +########################################
> +## <summary>
> ## Do not audit attempts to write user home files.
> ## </summary>
> ## <param name="domain">
> Index: refpolicy-2.20180701/policy/modules/services/ssh.if
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/services/ssh.if
> +++ refpolicy-2.20180701/policy/modules/services/ssh.if
> @@ -373,6 +373,7 @@ template(`ssh_role_template',`
> ps_process_pattern($3, $1_ssh_agent_t)
>
> domtrans_pattern($3, ssh_agent_exec_t, $1_ssh_agent_t)
> + userdom_append_inherited_user_home_content_files($1_ssh_agent_t)
>
> kernel_read_kernel_sysctls($1_ssh_agent_t)
>
> Index: refpolicy-2.20180701/policy/modules/services/dbus.if
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/services/dbus.if
> +++ refpolicy-2.20180701/policy/modules/services/dbus.if
> @@ -75,6 +75,9 @@ template(`dbus_role_template',`
> domain_entry_file($1_dbusd_t, dbusd_exec_t)
> ubac_constrained($1_dbusd_t)
>
> + # for .xsession-errors
> + userdom_append_inherited_user_home_content_files($1_dbusd_t)
> +
> role $2 types $1_dbusd_t;
>
> ##############################
> @@ -82,7 +85,7 @@ template(`dbus_role_template',`
> # Local policy
> #
>
> - allow $3 $1_dbusd_t:unix_stream_socket connectto;
> + allow $3 $1_dbusd_t:unix_stream_socket { connectto rw_socket_perms };
> allow $3 $1_dbusd_t:dbus { send_msg acquire_svc };
> allow $3 $1_dbusd_t:fd use;
>
> @@ -213,7 +216,7 @@ interface(`dbus_all_session_bus_client',
> allow $1 { session_bus_type self }:dbus send_msg;
> allow session_bus_type $1:dbus send_msg;
>
> - allow $1 session_bus_type:unix_stream_socket connectto;
> + allow $1 session_bus_type:unix_stream_socket { connectto rw_socket_perms };
> allow $1 session_bus_type:fd use;
> ')
>
> @@ -246,7 +249,7 @@ interface(`dbus_spec_session_bus_client'
> allow $2 { $1_dbusd_t self }:dbus send_msg;
> allow $1_dbusd_t $2:dbus send_msg;
>
> - allow $2 $1_dbusd_t:unix_stream_socket connectto;
> + allow $2 $1_dbusd_t:unix_stream_socket { connectto rw_socket_perms };
> allow $2 $1_dbusd_t:fd use;
> ')
>
> Index: refpolicy-2.20180701/policy/modules/services/cron.if
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/services/cron.if
> +++ refpolicy-2.20180701/policy/modules/services/cron.if
> @@ -862,10 +862,31 @@ interface(`cron_read_system_job_tmp_file
> ')
>
> files_search_tmp($1)
> + allow $1 system_cronjob_tmp_t:dir search_dir_perms;
> allow $1 system_cronjob_tmp_t:file read_file_perms;
> ')
>
> ########################################
> +## <summary>
> +## Read/write system cron job temporary files.
> +## </summary>
> +## <param name="domain">
> +## <summary>
> +## Domain allowed access.
> +## </summary>
> +## </param>
> +#
> +interface(`cron_rw_system_job_tmp_files',`
> + gen_require(`
> + type system_cronjob_tmp_t;
> + ')
> +
> + files_search_tmp($1)
> + allow $1 system_cronjob_tmp_t:dir search_dir_perms;
> + allow $1 system_cronjob_tmp_t:file rw_file_perms;
> +')
> +
> +########################################
> ## <summary>
> ## Do not audit attempts to append temporary
> ## system cron job files.
> Index: refpolicy-2.20180701/policy/modules/apps/gpg.te
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/apps/gpg.te
> +++ refpolicy-2.20180701/policy/modules/apps/gpg.te
> @@ -184,8 +184,9 @@ optional_policy(`
> ')
>
> optional_policy(`
> - cron_system_entry(gpg_t, gpg_exec_t)
> cron_read_system_job_tmp_files(gpg_t)
> + cron_rw_system_job_tmp_files(gpg_t)
> + cron_system_entry(gpg_t, gpg_exec_t)
> ')
>
> optional_policy(`
>
--
Chris PeBenito
next prev parent reply other threads:[~2019-01-10 0:37 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-01-08 8:51 [PATCH] gpg Russell Coker
2019-01-10 0:11 ` Chris PeBenito [this message]
2019-01-10 1:40 ` Jason Zaman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ba3deeb7-390d-d587-7827-339a910d3aa1@ieee.org \
--to=pebenito@ieee.org \
--cc=russell@coker.com.au \
--cc=selinux-refpolicy@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.