selinux-refpolicy.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Laurent Bigonville <bigon@debian.org>
To: selinux-refpolicy@vger.kernel.org
Subject: [PATCH 10/10] Allow vpnc to create and write its pid file in /run/NetworkManager
Date: Fri, 11 Oct 2019 14:24:16 +0200	[thread overview]
Message-ID: <20191011122416.14651-10-bigon@debian.org> (raw)
In-Reply-To: <20191011122416.14651-1-bigon@debian.org>

From: Laurent Bigonville <bigon@bigon.be>

The pid file is deleted by NetworkManager itself when the vpnc process
exits

NetworkManager call vpnc the following way:

system_u:system_r:NetworkManager_t:s0 root 11692 0.0  0.0 166272 9472 ?        Sl   12:58   0:00 /usr/lib/NetworkManager/nm-vpnc-service --bus-name org.freedesktop.NetworkManager.vpnc.Connection_21
system_u:system_r:vpnc_t:s0     root     11703  0.1  0.0   9900  4896 ?        SL   12:58   0:00 /usr/sbin/vpnc --no-detach --pid-file /var/run/NetworkManager/nm-vpnc-fa482929-93ee-4c64-bfba-4ee31d70f35f.pid -

----
type=AVC msg=audit(07/10/19 10:38:35.131:931) : avc:  denied  { write } for  pid=8653 comm=vpnc path=/run/NetworkManager/nm-vpnc-fa482929-93ee-4c64-bfba-4ee31d70f35f.pid dev="tmpfs" ino=112390 scontext=system_u:system_r:vpnc_t:s0 tcontext=system_u:object_r:NetworkManager_runtime_t:s0 tclass=file permissive=1
type=AVC msg=audit(07/10/19 10:38:35.131:931) : avc:  denied  { create } for  pid=8653 comm=vpnc name=nm-vpnc-fa482929-93ee-4c64-bfba-4ee31d70f35f.pid scontext=system_u:system_r:vpnc_t:s0 tcontext=system_u:object_r:NetworkManager_runtime_t:s0 tclass=file permissive=1
type=AVC msg=audit(07/10/19 10:38:35.131:931) : avc:  denied  { add_name } for  pid=8653 comm=vpnc name=nm-vpnc-fa482929-93ee-4c64-bfba-4ee31d70f35f.pid scontext=system_u:system_r:vpnc_t:s0 tcontext=system_u:object_r:NetworkManager_runtime_t:s0 tclass=dir permissive=1
type=AVC msg=audit(07/10/19 10:38:35.131:931) : avc:  denied  { write } for  pid=8653 comm=vpnc name=NetworkManager dev="tmpfs" ino=30783 scontext=system_u:system_r:vpnc_t:s0 tcontext=system_u:object_r:NetworkManager_runtime_t:s0 tclass=dir permissive=1

This commit also adds the needed interfaces

Signed-off-by: Laurent Bigonville <bigon@bigon.be>
---
 policy/modules/admin/vpn.te               |  2 ++
 policy/modules/services/networkmanager.if | 38 +++++++++++++++++++++++
 2 files changed, 40 insertions(+)

diff --git a/policy/modules/admin/vpn.te b/policy/modules/admin/vpn.te
index 01fd8340..6b2ad24c 100644
--- a/policy/modules/admin/vpn.te
+++ b/policy/modules/admin/vpn.te
@@ -124,6 +124,8 @@ optional_policy(`
 
 optional_policy(`
 	networkmanager_attach_tun_iface(vpnc_t)
+	networkmanager_create_pid_files(vpnc_t)
+	networkmanager_rw_pid_files(vpnc_t)
 ')
 
 optional_policy(`
diff --git a/policy/modules/services/networkmanager.if b/policy/modules/services/networkmanager.if
index 4c6dd342..fb89f210 100644
--- a/policy/modules/services/networkmanager.if
+++ b/policy/modules/services/networkmanager.if
@@ -253,6 +253,25 @@ interface(`networkmanager_append_log_files',`
 	append_files_pattern($1, NetworkManager_log_t, NetworkManager_log_t)
 ')
 
+########################################
+## <summary>
+##	Create networkmanager pid files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`networkmanager_create_pid_files',`
+	gen_require(`
+		type NetworkManager_runtime_t;
+	')
+
+	files_search_pids($1)
+	create_files_pattern($1, NetworkManager_runtime_t, NetworkManager_runtime_t)
+')
+
 ########################################
 ## <summary>
 ##	Read networkmanager pid files.
@@ -273,6 +292,25 @@ interface(`networkmanager_read_pid_files',`
 	allow $1 NetworkManager_runtime_t:file read_file_perms;
 ')
 
+########################################
+## <summary>
+##	Read/Write networkmanager pid files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`networkmanager_rw_pid_files',`
+	gen_require(`
+		type NetworkManager_runtime_t;
+	')
+
+	files_search_pids($1)
+	rw_files_pattern($1, NetworkManager_runtime_t, NetworkManager_runtime_t)
+')
+
 ####################################
 ## <summary>
 ##  Connect to networkmanager over
-- 
2.23.0


      parent reply	other threads:[~2019-10-11 12:24 UTC|newest]

Thread overview: 17+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-10-11 12:24 [PATCH 01/10] Allow the systemd dbus-daemon to talk to systemd Laurent Bigonville
2019-10-11 12:24 ` [PATCH 02/10] Allow geoclue to log in syslog Laurent Bigonville
2019-10-11 12:24 ` [PATCH 03/10] Allow colord_t to exec colord_exec_t type Laurent Bigonville
2019-10-11 12:24 ` [PATCH 04/10] Allow realmd_t to read localization files Laurent Bigonville
2019-10-11 12:24 ` [PATCH 05/10] Allow colord_t to read the color profile stored in ~/.local/share/icc/ Laurent Bigonville
2019-10-11 12:54   ` Dominick Grift
2019-10-12  7:53     ` Dominick Grift
2019-10-12 15:51       ` Chris PeBenito
2019-10-12 16:09         ` Dominick Grift
2019-10-15 13:09           ` Laurent Bigonville
2019-10-11 12:24 ` [PATCH 06/10] Allow alsa_t to create alsa_runtime_t file as well Laurent Bigonville
2019-10-12 15:52   ` Chris PeBenito
2019-10-15 13:10     ` Laurent Bigonville
2019-10-11 12:24 ` [PATCH 07/10] Allow alsa_t to set scheduling priority and send signal to itself Laurent Bigonville
2019-10-11 12:24 ` [PATCH 08/10] Allow colord_t to read snmpd_var_lib_t files Laurent Bigonville
2019-10-11 12:24 ` [PATCH 09/10] Allow systemd_locale_t to talk to systemd notify socket Laurent Bigonville
2019-10-11 12:24 ` Laurent Bigonville [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20191011122416.14651-10-bigon@debian.org \
    --to=bigon@debian.org \
    --cc=selinux-refpolicy@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).