[PATCH 0/4] Resolve issues using /usr/bin/timedatectl

[PATCH 0/4] Resolve issues using /usr/bin/timedatectl

[Sugar, David]

I'm seeing some issues using timedatectl to alter the system
date, time and timezone.  The following set of patches is to
resolve issues seen during these interactions.  I setup as
several patches to keep the set of denials clear for each
patch.

Dave Sugar (4):
  Add interface ntp_dbus_chat
  Allow ntpd to alter chronyd service
  Allow ntpd to update timezone
  Allow ntpd to read unit files

 policy/modules/services/ntp.if | 21 +++++++++++++++++++++
 policy/modules/services/ntp.te |  9 +++++++++
 policy/modules/system/init.if  | 10 ++++++++++
 3 files changed, 40 insertions(+)

-- 
2.20.1

[PATCH 1/4] Add interface ntp_dbus_chat

[Sugar, David]

type=USER_AVC msg=audit(1553013821.622:9900): pid=7377 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_call interface=org.freedesktop.timedate1 member=SetTimezone dest=org.freedesktop.timedate1 spid=16280 tpid=16281 scontext=sysadm_u:sysadm_r:settings_t:s0-s0:c0.c1023 tcontext=system_u:system_r:ntpd_t:s0 tclass=dbus  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
type=USER_AVC msg=audit(1553013821.625:9911): pid=7377 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_return dest=:1.258 spid=16281 tpid=16280 scontext=system_u:system_r:ntpd_t:s0 tcontext=sysadm_u:sysadm_r:settings_t:s0-s0:c0.c1023 tclass=dbus  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'

Signed-off-by: Dave Sugar <dsugar@tresys.com>
---
 policy/modules/services/ntp.if | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/policy/modules/services/ntp.if b/policy/modules/services/ntp.if
index f1a90c55..7fa20c8d 100644
--- a/policy/modules/services/ntp.if
+++ b/policy/modules/services/ntp.if
@@ -79,6 +79,27 @@ interface(`ntp_run',`
 	roleattribute $2 ntpd_roles;
 ')
 
+########################################
+## <summary>
+##	Send and receive messages from
+##	ntpd over dbus.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`ntp_dbus_chat',`
+	gen_require(`
+		type ntpd_t;
+		class dbus send_msg;
+	')
+
+	allow $1 ntpd_t:dbus send_msg;
+	allow ntpd_t $1:dbus send_msg;
+')
+
 ########################################
 ## <summary>
 ##	Execute ntpdate server in the ntpd domain.
-- 
2.20.1

Re: [PATCH 1/4] Add interface ntp_dbus_chat

[Chris PeBenito]

On 3/19/19 8:20 PM, Sugar, David wrote:
> type=USER_AVC msg=audit(1553013821.622:9900): pid=7377 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_call interface=org.freedesktop.timedate1 member=SetTimezone dest=org.freedesktop.timedate1 spid=16280 tpid=16281 scontext=sysadm_u:sysadm_r:settings_t:s0-s0:c0.c1023 tcontext=system_u:system_r:ntpd_t:s0 tclass=dbus  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
> type=USER_AVC msg=audit(1553013821.625:9911): pid=7377 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_return dest=:1.258 spid=16281 tpid=16280 scontext=system_u:system_r:ntpd_t:s0 tcontext=sysadm_u:sysadm_r:settings_t:s0-s0:c0.c1023 tclass=dbus  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
> 
> Signed-off-by: Dave Sugar <dsugar@tresys.com>
> ---
>   policy/modules/services/ntp.if | 21 +++++++++++++++++++++
>   1 file changed, 21 insertions(+)
> 
> diff --git a/policy/modules/services/ntp.if b/policy/modules/services/ntp.if
> index f1a90c55..7fa20c8d 100644
> --- a/policy/modules/services/ntp.if
> +++ b/policy/modules/services/ntp.if
> @@ -79,6 +79,27 @@ interface(`ntp_run',`
>   	roleattribute $2 ntpd_roles;
>   ')
>   
> +########################################
> +## <summary>
> +##	Send and receive messages from
> +##	ntpd over dbus.
> +## </summary>
> +## <param name="domain">
> +##	<summary>
> +##	Domain allowed access.
> +##	</summary>
> +## </param>
> +#
> +interface(`ntp_dbus_chat',`
> +	gen_require(`
> +		type ntpd_t;
> +		class dbus send_msg;
> +	')
> +
> +	allow $1 ntpd_t:dbus send_msg;
> +	allow ntpd_t $1:dbus send_msg;
> +')
> +
>   ########################################
>   ## <summary>
>   ##	Execute ntpdate server in the ntpd domain.

Merged.

-- 
Chris PeBenito

[PATCH 2/4] Allow ntpd to update chronyd service

[Sugar, David]

type=USER_AVC msg=audit(1553013917.361:9938): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc:  denied  { disable } for auid=n/a uid=0 gid=0 path="/usr/lib/systemd/system/chronyd.service" cmdline="/usr/lib/systemd/systemd-timedated" scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:chronyd_unit_t:s0 tclass=service  exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?
type=USER_AVC msg=audit(1553013917.406:9943): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc:  denied  { stop } for auid=n/a uid=0 gid=0 path="/usr/lib/systemd/system/chronyd.service" cmdline="/usr/lib/systemd/systemd-timedated" scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:chronyd_unit_t:s0 tclass=service  exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'
type=USER_AVC msg=audit(1553021100.061:9970): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc:  denied  { enable } for auid=n/a uid=0 gid=0 path="/usr/lib/systemd/system/chronyd.service" cmdline="/usr/lib/systemd/systemd-timedated" scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:chronyd_unit_t:s0 tclass=service  exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'
type=USER_AVC msg=audit(1553021100.104:9973): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc:  denied  { start } for auid=n/a uid=0 gid=0 path="/usr/lib/systemd/system/chronyd.service" cmdline="/usr/lib/systemd/systemd-timedated" scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:chronyd_unit_t:s0 tclass=service  exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'

Signed-off-by: Dave Sugar <dsugar@tresys.com>
---
 policy/modules/services/ntp.te | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/policy/modules/services/ntp.te b/policy/modules/services/ntp.te
index dc953784..d882fc59 100644
--- a/policy/modules/services/ntp.te
+++ b/policy/modules/services/ntp.te
@@ -153,6 +153,11 @@ ifdef(`init_systemd',`
 	# for /run/systemd/netif/links
 	systemd_list_networkd_runtime(ntpd_t)
 
+	optional_policy(`
+		chronyd_enabledisable(ntpd_t)
+		chronyd_startstop(ntpd_t)
+	')
+
 	optional_policy(`
 		unconfined_dbus_send(ntpd_t)
 	')
-- 
2.20.1

Re: [PATCH 2/4] Allow ntpd to update chronyd service

[Chris PeBenito]

On 3/19/19 8:20 PM, Sugar, David wrote:
> type=USER_AVC msg=audit(1553013917.361:9938): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc:  denied  { disable } for auid=n/a uid=0 gid=0 path="/usr/lib/systemd/system/chronyd.service" cmdline="/usr/lib/systemd/systemd-timedated" scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:chronyd_unit_t:s0 tclass=service  exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?
> type=USER_AVC msg=audit(1553013917.406:9943): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc:  denied  { stop } for auid=n/a uid=0 gid=0 path="/usr/lib/systemd/system/chronyd.service" cmdline="/usr/lib/systemd/systemd-timedated" scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:chronyd_unit_t:s0 tclass=service  exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'
> type=USER_AVC msg=audit(1553021100.061:9970): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc:  denied  { enable } for auid=n/a uid=0 gid=0 path="/usr/lib/systemd/system/chronyd.service" cmdline="/usr/lib/systemd/systemd-timedated" scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:chronyd_unit_t:s0 tclass=service  exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'
> type=USER_AVC msg=audit(1553021100.104:9973): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc:  denied  { start } for auid=n/a uid=0 gid=0 path="/usr/lib/systemd/system/chronyd.service" cmdline="/usr/lib/systemd/systemd-timedated" scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:chronyd_unit_t:s0 tclass=service  exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'
> 
> Signed-off-by: Dave Sugar <dsugar@tresys.com>
> ---
>   policy/modules/services/ntp.te | 5 +++++
>   1 file changed, 5 insertions(+)
> 
> diff --git a/policy/modules/services/ntp.te b/policy/modules/services/ntp.te
> index dc953784..d882fc59 100644
> --- a/policy/modules/services/ntp.te
> +++ b/policy/modules/services/ntp.te
> @@ -153,6 +153,11 @@ ifdef(`init_systemd',`
>   	# for /run/systemd/netif/links
>   	systemd_list_networkd_runtime(ntpd_t)
>   
> +	optional_policy(`
> +		chronyd_enabledisable(ntpd_t)
> +		chronyd_startstop(ntpd_t)
> +	')
> +
>   	optional_policy(`
>   		unconfined_dbus_send(ntpd_t)
>   	')

Merged.

-- 
Chris PeBenito

[PATCH 3/4] Allow ntpd to update timezone symlink

[Sugar, David]

type=AVC msg=audit(1553013821.624:9907): avc:  denied  { create } for  pid=16281 comm="systemd-timedat" name=".#localtime69bc4c9ad513a247" scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=lnk_file permissive=1
type=AVC msg=audit(1553013821.624:9908): avc:  denied  { rename } for  pid=16281 comm="systemd-timedat" name=".#localtime69bc4c9ad513a247" dev="dm-1" ino=714303 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=lnk_file permissive=1
type=AVC msg=audit(1553013821.624:9908): avc:  denied  { unlink } for  pid=16281 comm="systemd-timedat" name="localtime" dev="dm-1" ino=1063377 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=lnk_file permissive=1

Signed-off-by: Dave Sugar <dsugar@tresys.com>
---
 policy/modules/services/ntp.te | 1 +
 1 file changed, 1 insertion(+)

diff --git a/policy/modules/services/ntp.te b/policy/modules/services/ntp.te
index d882fc59..eff38486 100644
--- a/policy/modules/services/ntp.te
+++ b/policy/modules/services/ntp.te
@@ -116,6 +116,7 @@ dev_rw_realtime_clock(ntpd_t)
 domain_use_interactive_fds(ntpd_t)
 domain_dontaudit_list_all_domains_state(ntpd_t)
 
+files_manage_etc_symlinks(ntpd_t)
 files_read_etc_runtime_files(ntpd_t)
 files_read_usr_files(ntpd_t)
 files_list_var_lib(ntpd_t)
-- 
2.20.1

Re: [PATCH 3/4] Allow ntpd to update timezone symlink

[Chris PeBenito]

On 3/19/19 8:20 PM, Sugar, David wrote:
> type=AVC msg=audit(1553013821.624:9907): avc:  denied  { create } for  pid=16281 comm="systemd-timedat" name=".#localtime69bc4c9ad513a247" scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=lnk_file permissive=1
> type=AVC msg=audit(1553013821.624:9908): avc:  denied  { rename } for  pid=16281 comm="systemd-timedat" name=".#localtime69bc4c9ad513a247" dev="dm-1" ino=714303 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=lnk_file permissive=1
> type=AVC msg=audit(1553013821.624:9908): avc:  denied  { unlink } for  pid=16281 comm="systemd-timedat" name="localtime" dev="dm-1" ino=1063377 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=lnk_file permissive=1
> 
> Signed-off-by: Dave Sugar <dsugar@tresys.com>
> ---
>   policy/modules/services/ntp.te | 1 +
>   1 file changed, 1 insertion(+)
> 
> diff --git a/policy/modules/services/ntp.te b/policy/modules/services/ntp.te
> index d882fc59..eff38486 100644
> --- a/policy/modules/services/ntp.te
> +++ b/policy/modules/services/ntp.te
> @@ -116,6 +116,7 @@ dev_rw_realtime_clock(ntpd_t)
>   domain_use_interactive_fds(ntpd_t)
>   domain_dontaudit_list_all_domains_state(ntpd_t)
>   
> +files_manage_etc_symlinks(ntpd_t)
>   files_read_etc_runtime_files(ntpd_t)
>   files_read_usr_files(ntpd_t)
>   files_list_var_lib(ntpd_t)

Merged.

-- 
Chris PeBenito

[PATCH 4/4] Allow ntpd to read unit files

[Sugar, David]

type=AVC msg=audit(1553013917.359:9935): avc:  denied  { read } for  pid=16326 comm="systemd-timedat" name="50-chronyd.list" dev="dm-1" ino=4870675 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:ntpd_unit_t:s0 tclass=file permissive=1
type=AVC msg=audit(1553013917.359:9935): avc:  denied  { open } for  pid=16326 comm="systemd-timedat" path="/usr/lib/systemd/ntp-units.d/50-chronyd.list" dev="dm-1" ino=4870675 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:ntpd_unit_t:s0 tclass=file permissive=1
type=AVC msg=audit(1553013917.359:9936): avc:  denied  { getattr } for  pid=16326 comm="systemd-timedat" path="/usr/lib/systemd/ntp-units.d/50-chronyd.list" dev="dm-1" ino=4870675 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:ntpd_unit_t:s0 tclass=file permissive=1

type=AVC msg=audit(1553013821.622:9902): avc:  denied  { getattr } for  pid=16281 comm="systemd-timedat" path="/usr/lib/systemd/ntp-units.d" dev="dm-1" ino=4700094 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:systemd_unit_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1553013821.622:9903): avc:  denied  { read } for  pid=16281 comm="systemd-timedat" name="ntp-units.d" dev="dm-1" ino=4700094 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:systemd_unit_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1553013821.622:9903): avc:  denied  { open } for  pid=16281 comm="systemd-timedat" path="/usr/lib/systemd/ntp-units.d" dev="dm-1" ino=4700094 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:systemd_unit_t:s0 tclass=dir permissive=1

Signed-off-by: Dave Sugar <dsugar@tresys.com>
---
 policy/modules/services/ntp.te |  3 +++
 policy/modules/system/init.if  | 10 ++++++++++
 2 files changed, 13 insertions(+)

diff --git a/policy/modules/services/ntp.te b/policy/modules/services/ntp.te
index eff38486..85747e76 100644
--- a/policy/modules/services/ntp.te
+++ b/policy/modules/services/ntp.te
@@ -138,10 +138,13 @@ userdom_dontaudit_use_unpriv_user_fds(ntpd_t)
 userdom_list_user_home_dirs(ntpd_t)
 
 ifdef(`init_systemd',`
+	allow ntpd_t ntpd_unit_t:file read_file_perms;
+
 	dbus_system_bus_client(ntpd_t)
 	dbus_connect_system_bus(ntpd_t)
 	init_dbus_chat(ntpd_t)
 	init_get_system_status(ntpd_t)
+	init_list_unit_dirs(ntpd_t)
 	# for /var/lib/systemd/timesync
 	init_read_var_lib_links(ntpd_t)
 	allow ntpd_t self:capability { fowner setpcap };
diff --git a/policy/modules/system/init.if b/policy/modules/system/init.if
index 2a17910e..4f4d4d2c 100644
--- a/policy/modules/system/init.if
+++ b/policy/modules/system/init.if
@@ -2960,6 +2960,16 @@ interface(`init_search_units',`
 	fs_search_tmpfs($1)
 ')
 
+interface(`init_list_unit_dirs',`
+	gen_require(`
+		type systemd_unit_t;
+	')
+
+	allow $1 systemd_unit_t:dir list_dir_perms;
+
+	init_search_units($1)
+')
+
 ########################################
 ## <summary>
 ##	Read systemd unit links
-- 
2.20.1

Re: [PATCH 4/4] Allow ntpd to read unit files

[Chris PeBenito]

On 3/19/19 8:20 PM, Sugar, David wrote:
> type=AVC msg=audit(1553013917.359:9935): avc:  denied  { read } for  pid=16326 comm="systemd-timedat" name="50-chronyd.list" dev="dm-1" ino=4870675 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:ntpd_unit_t:s0 tclass=file permissive=1
> type=AVC msg=audit(1553013917.359:9935): avc:  denied  { open } for  pid=16326 comm="systemd-timedat" path="/usr/lib/systemd/ntp-units.d/50-chronyd.list" dev="dm-1" ino=4870675 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:ntpd_unit_t:s0 tclass=file permissive=1
> type=AVC msg=audit(1553013917.359:9936): avc:  denied  { getattr } for  pid=16326 comm="systemd-timedat" path="/usr/lib/systemd/ntp-units.d/50-chronyd.list" dev="dm-1" ino=4870675 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:ntpd_unit_t:s0 tclass=file permissive=1
> 
> type=AVC msg=audit(1553013821.622:9902): avc:  denied  { getattr } for  pid=16281 comm="systemd-timedat" path="/usr/lib/systemd/ntp-units.d" dev="dm-1" ino=4700094 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:systemd_unit_t:s0 tclass=dir permissive=1
> type=AVC msg=audit(1553013821.622:9903): avc:  denied  { read } for  pid=16281 comm="systemd-timedat" name="ntp-units.d" dev="dm-1" ino=4700094 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:systemd_unit_t:s0 tclass=dir permissive=1
> type=AVC msg=audit(1553013821.622:9903): avc:  denied  { open } for  pid=16281 comm="systemd-timedat" path="/usr/lib/systemd/ntp-units.d" dev="dm-1" ino=4700094 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:systemd_unit_t:s0 tclass=dir permissive=1
> 
> Signed-off-by: Dave Sugar <dsugar@tresys.com>
> ---
>   policy/modules/services/ntp.te |  3 +++
>   policy/modules/system/init.if  | 10 ++++++++++
>   2 files changed, 13 insertions(+)
> 
> diff --git a/policy/modules/services/ntp.te b/policy/modules/services/ntp.te
> index eff38486..85747e76 100644
> --- a/policy/modules/services/ntp.te
> +++ b/policy/modules/services/ntp.te
> @@ -138,10 +138,13 @@ userdom_dontaudit_use_unpriv_user_fds(ntpd_t)
>   userdom_list_user_home_dirs(ntpd_t)
>   
>   ifdef(`init_systemd',`
> +	allow ntpd_t ntpd_unit_t:file read_file_perms;
> +
>   	dbus_system_bus_client(ntpd_t)
>   	dbus_connect_system_bus(ntpd_t)
>   	init_dbus_chat(ntpd_t)
>   	init_get_system_status(ntpd_t)
> +	init_list_unit_dirs(ntpd_t)
>   	# for /var/lib/systemd/timesync
>   	init_read_var_lib_links(ntpd_t)
>   	allow ntpd_t self:capability { fowner setpcap };
> diff --git a/policy/modules/system/init.if b/policy/modules/system/init.if
> index 2a17910e..4f4d4d2c 100644
> --- a/policy/modules/system/init.if
> +++ b/policy/modules/system/init.if
> @@ -2960,6 +2960,16 @@ interface(`init_search_units',`
>   	fs_search_tmpfs($1)
>   ')
>   
> +interface(`init_list_unit_dirs',`
> +	gen_require(`
> +		type systemd_unit_t;
> +	')
> +
> +	allow $1 systemd_unit_t:dir list_dir_perms;
> +
> +	init_search_units($1)
> +')

Missing documentation.



-- 
Chris PeBenito