From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.2 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH, MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id AE7A4C43441 for ; Sat, 10 Nov 2018 00:43:04 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 69D0820855 for ; Sat, 10 Nov 2018 00:43:04 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=ieee.org header.i=@ieee.org header.b="FeObBUZG" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 69D0820855 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=ieee.org Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=selinux-refpolicy-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728310AbeKJK0I (ORCPT ); Sat, 10 Nov 2018 05:26:08 -0500 Received: from mail-qk1-f193.google.com ([209.85.222.193]:42170 "EHLO mail-qk1-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727730AbeKJK0H (ORCPT ); Sat, 10 Nov 2018 05:26:07 -0500 Received: by mail-qk1-f193.google.com with SMTP id m5so4849683qka.9 for ; Fri, 09 Nov 2018 16:43:02 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ieee.org; s=google; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-language:content-transfer-encoding; bh=nv4AJGz44VtcDEztONSJ+XNsndo2uOeNS+1QSagUM5U=; b=FeObBUZG02uIN7M1Tk82+YCLtIv/NZ8kjolZLH9+XiGWfT/vReyRhya3cQzjgNcCID yENNe6UeW0AqrgI0C0pjt8mmE7H4+SVWgrCFVOGLM58C92XpbMYV6sHbh4CV4q/SoIuF 1jmTKEKPwjVnCYZbXxQ2o1XUWeuaPautpT6ak= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=nv4AJGz44VtcDEztONSJ+XNsndo2uOeNS+1QSagUM5U=; b=R4+qtIUwNb6XVVSG03XjUKAZAgykx+MpORyuGpxzXreaqc8ndihnQl3/zYdGhKUlaZ nzzCiID5NyjPBQmmG+eFO/QpweUN+zJC/ELDgeXOINLlD5EGjbdxv2NzR22LjXGiFYpk cS/hRx09Zr3pA2xS+gEaTqO0rFv0nfnBLYgcNcvpZZ46GaJ5kqal5j8LS7IfirkAYpgn 4Nvj9yo7qLN1vDkpGoy24sObQdeprg3L/jZq47Yu7l4zwfuWC2wIoIM+CCAr4hg8+yz9 XMumBR8jzxfXFbDSD0XYROnISeG0DRoTbEn0dr5/huyzNcBMSHQ01poAQWmyyhLIbTx8 AR1A== X-Gm-Message-State: AGRZ1gLMPCpmuS5rw15qfCxTfS/xS7lxDqLcnD4ozBAfX+yfwNJHPj8n 8LSN5YuUBZ5gFdEDJI9iF75PIPjCnsvGFobC X-Google-Smtp-Source: AJdET5dcePXo5CqE0XzaMsn6IIqmHCtiqvSgOfX/ULBX2YXk+gB9E8VfKd5fkak9i3aOvCklaVg+dw== X-Received: by 2002:a37:16cf:: with SMTP id 76mr10375195qkw.3.1541810582070; Fri, 09 Nov 2018 16:43:02 -0800 (PST) Received: from [192.168.1.190] (pool-108-15-23-247.bltmmd.fios.verizon.net. [108.15.23.247]) by smtp.gmail.com with ESMTPSA id t188-v6sm4171620qkf.26.2018.11.09.16.43.01 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 09 Nov 2018 16:43:01 -0800 (PST) Subject: Re: [PATCH 2/3] Interface to add domain allowed to be read by ClamAV for scanning. To: David Sugar , "selinux-refpolicy@vger.kernel.org" References: <20181102003923.22817-1-dsugar@tresys.com> From: Chris PeBenito Message-ID: <206db618-c006-9039-7c8f-69ecf31bd664@ieee.org> Date: Fri, 9 Nov 2018 19:07:01 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: <20181102003923.22817-1-dsugar@tresys.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Sender: selinux-refpolicy-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux-refpolicy@vger.kernel.org On 11/01/2018 08:39 PM, David Sugar wrote: > Create an attribute for types that clamd_t and clamscan_t can read > (for scanning purposes) rather than require clamav.te to be modified. > > Signed-off-by: Dave Sugar > --- > policy/modules/services/amavis.te | 1 + > policy/modules/services/apache.te | 1 + > policy/modules/services/clamav.if | 18 ++++++++++++++++++ > policy/modules/services/clamav.te | 23 +++++++++-------------- > policy/modules/services/exim.te | 1 + > policy/modules/services/mta.te | 1 + > 6 files changed, 31 insertions(+), 14 deletions(-) > > diff --git a/policy/modules/services/amavis.te b/policy/modules/services/amavis.te > index 9517486e..59d87259 100644 > --- a/policy/modules/services/amavis.te > +++ b/policy/modules/services/amavis.te > @@ -152,6 +152,7 @@ tunable_policy(`amavis_use_jit',` > ') > > optional_policy(` > + clamav_scannable_files(amavis_spool_t) > clamav_stream_connect(amavis_t) > clamav_domtrans_clamscan(amavis_t) > clamav_read_state_clamd(amavis_t) > diff --git a/policy/modules/services/apache.te b/policy/modules/services/apache.te > index d1fbeb17..5cb38386 100644 > --- a/policy/modules/services/apache.te > +++ b/policy/modules/services/apache.te > @@ -1323,6 +1323,7 @@ tunable_policy(`httpd_use_nfs && httpd_builtin_scripting',` > > optional_policy(` > clamav_domtrans_clamscan(httpd_sys_script_t) > + clamav_scannable_files(httpd_sys_content_t) > ') > > optional_policy(` > diff --git a/policy/modules/services/clamav.if b/policy/modules/services/clamav.if > index 80ac5c1e..d1296fcc 100644 > --- a/policy/modules/services/clamav.if > +++ b/policy/modules/services/clamav.if > @@ -205,6 +205,24 @@ interface(`clamav_read_signatures',` > read_lnk_files_pattern($1, clamd_var_lib_t, clamd_var_lib_t) > ') > > +####################################### > +## > +## Denote a particular type to be scanned by ClamAV > +## > +## > +## > +## Type that clamd_t and clamscan_t can read. > +## > +## > +# > +interface(`clamav_scannable_files',` > + gen_require(` > + attribute clam_scannable_type; > + ') > + > + typeattribute $1 clam_scannable_type; > +') > + > ######################################## > ## > ## All of the rules required to > diff --git a/policy/modules/services/clamav.te b/policy/modules/services/clamav.te > index a2f30133..b63503f1 100644 > --- a/policy/modules/services/clamav.te > +++ b/policy/modules/services/clamav.te > @@ -27,6 +27,7 @@ gen_tunable(clamd_use_jit, false) > # > # Declarations > # > +attribute clam_scannable_type; > > type clamd_t; > type clamd_exec_t; > @@ -103,6 +104,10 @@ manage_files_pattern(clamd_t, clamd_var_run_t, clamd_var_run_t) > manage_sock_files_pattern(clamd_t, clamd_var_run_t, clamd_var_run_t) > files_pid_filetrans(clamd_t, clamd_var_run_t, { dir file sock_file }) > > +read_files_pattern(clamd_t, clam_scannable_type, clam_scannable_type) > +read_lnk_files_pattern(clamd_t, clam_scannable_type, clam_scannable_type) > +list_dirs_pattern(clamd_t, clam_scannable_type, clam_scannable_type) > + > kernel_dontaudit_list_proc(clamd_t) > kernel_read_crypto_sysctls(clamd_t) > kernel_read_sysctl(clamd_t) > @@ -152,7 +157,6 @@ tunable_policy(`clamd_use_jit',` > > optional_policy(` > amavis_read_lib_files(clamd_t) > - amavis_read_spool_files(clamd_t) > amavis_spool_filetrans(clamd_t, clamd_var_run_t, sock_file) > amavis_create_pid_files(clamd_t) > ') > @@ -163,10 +167,6 @@ optional_policy(` > cron_rw_pipes(clamd_t) > ') > > -optional_policy(` > - exim_read_spool_files(clamd_t) > -') > - > optional_policy(` > mta_read_config(clamd_t) > mta_send_mail(clamd_t) > @@ -274,6 +274,10 @@ manage_dirs_pattern(clamscan_t, clamscan_tmp_t, clamscan_tmp_t) > manage_files_pattern(clamscan_t, clamscan_tmp_t, clamscan_tmp_t) > files_tmp_filetrans(clamscan_t, clamscan_tmp_t, { dir file }) > > +read_files_pattern(clamscan_t, clam_scannable_type, clam_scannable_type) > +read_lnk_files_pattern(clamscan_t, clam_scannable_type, clam_scannable_type) > +list_dirs_pattern(clamscan_t, clam_scannable_type, clam_scannable_type) > + > allow clamscan_t clamd_var_lib_t:dir list_dir_perms; > manage_files_pattern(clamscan_t, clamd_var_lib_t, clamd_var_lib_t) > > @@ -320,15 +324,6 @@ tunable_policy(`clamav_read_all_non_security_files_clamscan',` > files_getattr_all_sockets(clamscan_t) > ') > > -optional_policy(` > - amavis_read_spool_files(clamscan_t) > -') > - > -optional_policy(` > - apache_read_sys_content(clamscan_t) > -') > - > optional_policy(` > mta_send_mail(clamscan_t) > - mta_read_queue(clamscan_t) > ') > diff --git a/policy/modules/services/exim.te b/policy/modules/services/exim.te > index 693ac491..6430aee8 100644 > --- a/policy/modules/services/exim.te > +++ b/policy/modules/services/exim.te > @@ -189,6 +189,7 @@ tunable_policy(`exim_manage_user_files',` > > optional_policy(` > clamav_domtrans_clamscan(exim_t) > + clamav_scannable_files(exim_spool_t) > clamav_stream_connect(exim_t) > ') > > diff --git a/policy/modules/services/mta.te b/policy/modules/services/mta.te > index 3b45c48e..c741a461 100644 > --- a/policy/modules/services/mta.te > +++ b/policy/modules/services/mta.te > @@ -233,6 +233,7 @@ optional_policy(` > ') > > optional_policy(` > + clamav_scannable_files(mqueue_spool_t) > clamav_stream_connect(system_mail_t) > clamav_append_log(system_mail_t) > ') Merged. -- Chris PeBenito