From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.4 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH, MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED, USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 613DBC34024 for ; Mon, 17 Feb 2020 18:34:35 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 2FFAF2467E for ; Mon, 17 Feb 2020 18:34:35 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=ieee.org header.i=@ieee.org header.b="HFuUm5ev" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727429AbgBQSee (ORCPT ); Mon, 17 Feb 2020 13:34:34 -0500 Received: from mail-qt1-f194.google.com ([209.85.160.194]:40240 "EHLO mail-qt1-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727179AbgBQSee (ORCPT ); Mon, 17 Feb 2020 13:34:34 -0500 Received: by mail-qt1-f194.google.com with SMTP id v25so12705546qto.7 for ; Mon, 17 Feb 2020 10:34:34 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ieee.org; s=google; h=subject:to:cc:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=U9dQThR6fMELPtX1UVF3JntGYE95NFGnQ1CrPnpGhPg=; b=HFuUm5ev72UMO1u8/HWFbWSI0mj6XT9HNfjSOdQQo98ZjJws3n3aD9ODwE9Brlp6ri dytR7Debk7YvGRR7SrkWw/qLqxCt20Nyf08iMu+tdw5gfhYzEZpEAS8UdoIzfCJCLNjl 0r8kUVTVypFwB55ES9L76EWcHhWqI2eTe/13Q= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=U9dQThR6fMELPtX1UVF3JntGYE95NFGnQ1CrPnpGhPg=; b=O/ZVaiYUX7qcjGfu6gZMjb1aKXkX0EBVzkSXHxPgVt7WpDEpQB3PH7b2yADf2dg3Ji WCXBWIQTe4nAqQ2xU6IYHMm5bfD35vD0HpMCCF4UPpaqAKON1k4XO8VCHgyelScJAg2b csYeDj3fh9pd/F6umowqbqA0voIq78GSoM2CnVD0UWJgMr3dcof7TWfx1vSJbz/Zpe3T guXzWNwSaFeFvta58wRfxm+yrMVQP/InjCfH7LRMXbnptPjVI+Y9jjZ5ljIFr2Q9guyp EsPAkkqTvpjaGZPpSowfO2k7Fd7lFzIK3Zg6d7cTCRMSWWdQKFdis4cbmZ9Ko0LqnJrj D0Fg== X-Gm-Message-State: APjAAAWxnMIhleAO51DtWUvZomXpJicsVcVuwZus+I6t68OtL3EfxWse pLshjcK1UVz3itCluiNsmKePMTHpxsg= X-Google-Smtp-Source: APXvYqx7VIaRn5IQNDhkzofvJqYxHGJwkK6g1+Yxy7GW6tWFCRWjmj8C9NSi/3zJp7+QXdik5UNAZA== X-Received: by 2002:aed:2e03:: with SMTP id j3mr14309854qtd.365.1581964473514; Mon, 17 Feb 2020 10:34:33 -0800 (PST) Received: from fedora.pebenito.net (pool-108-15-23-247.bltmmd.fios.verizon.net. [108.15.23.247]) by smtp.gmail.com with ESMTPSA id b7sm619593qka.67.2020.02.17.10.34.33 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 17 Feb 2020 10:34:33 -0800 (PST) Subject: Re: [PATCH 01/10] fstools: add zfs-auto-snapshot To: Jason Zaman , selinux-refpolicy@vger.kernel.org Cc: Jason Zaman References: <20200216200319.39337-1-jason@perfinion.com> From: Chris PeBenito Message-ID: <1afd8a7c-336c-2385-e9d4-1475f62c3f58@ieee.org> Date: Mon, 17 Feb 2020 13:26:51 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.3.1 MIME-Version: 1.0 In-Reply-To: <20200216200319.39337-1-jason@perfinion.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Sender: selinux-refpolicy-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux-refpolicy@vger.kernel.org On 2/16/20 3:03 PM, Jason Zaman wrote: > Should be in domain fstools_t, and needs to run zpool which is > mount_exec_t. > > type=AVC msg=audit(1563084061.269:2472): avc: denied { execute } for pid=4981 comm="env" name="zpool" dev="zfs" ino=259064 scontext=system_u:system_r:fsadm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:mount_exec_t:s0 tclass=file permissive=0 > type=SYSCALL msg=audit(1563084061.269:2472): arch=c000003e syscall=59 success=no exit=-13 a0=7ffeba786e70 a1=7ffeba787098 a2=55726a69a4e0 a3=7fbff7eb5b00 items=1 ppid=4980 pid=4981 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="env" exe="/bin/env" subj=system_u:system_r:fsadm_t:s0-s0:c0.c1023 key=(null) > type=CWD msg=audit(1563084061.269:2472): cwd="/root" > type=PATH msg=audit(1563084061.269:2472): item=0 name="/sbin/zpool" inode=259064 dev=00:17 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:mount_exec_t:s0 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0 > > Signed-off-by: Jason Zaman > Signed-off-by: Jason Zaman > --- > policy/modules/system/fstools.fc | 1 + > policy/modules/system/fstools.te | 2 ++ > 2 files changed, 3 insertions(+) > > diff --git a/policy/modules/system/fstools.fc b/policy/modules/system/fstools.fc > index 8fbd5ce4..d871294e 100644 > --- a/policy/modules/system/fstools.fc > +++ b/policy/modules/system/fstools.fc > @@ -49,6 +49,7 @@ > /usr/bin/swapon.* -- gen_context(system_u:object_r:fsadm_exec_t,s0) > /usr/bin/tune2fs -- gen_context(system_u:object_r:fsadm_exec_t,s0) > /usr/bin/zdb -- gen_context(system_u:object_r:fsadm_exec_t,s0) > +/usr/bin/zfs-auto-snapshot -- gen_context(system_u:object_r:fsadm_exec_t,s0) > /usr/bin/zhack -- gen_context(system_u:object_r:fsadm_exec_t,s0) > /usr/bin/zinject -- gen_context(system_u:object_r:fsadm_exec_t,s0) > /usr/bin/zpios -- gen_context(system_u:object_r:fsadm_exec_t,s0) > diff --git a/policy/modules/system/fstools.te b/policy/modules/system/fstools.te > index 4ad6e65f..4ae0301a 100644 > --- a/policy/modules/system/fstools.te > +++ b/policy/modules/system/fstools.te > @@ -154,6 +154,8 @@ logging_send_syslog_msg(fsadm_t) > > miscfiles_read_localization(fsadm_t) > > +# for zfs/zpool > +mount_exec(fsadm_t) > # for /run/mount/utab > mount_getattr_runtime_files(fsadm_t) > # losetup: bind mount_loopback_t files to loop devices Merged. -- Chris PeBenito