From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-17.4 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,NICE_REPLY_A, SPF_HELO_NONE,SPF_PASS,USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C22BEC282DC for ; Tue, 19 Jan 2021 18:29:35 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 8792922CAD for ; Tue, 19 Jan 2021 18:29:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2391938AbhASRxu (ORCPT ); Tue, 19 Jan 2021 12:53:50 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57954 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2392195AbhASO47 (ORCPT ); Tue, 19 Jan 2021 09:56:59 -0500 Received: from mail-qk1-x732.google.com (mail-qk1-x732.google.com [IPv6:2607:f8b0:4864:20::732]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0F6D7C0617A5 for ; Tue, 19 Jan 2021 06:54:46 -0800 (PST) Received: by mail-qk1-x732.google.com with SMTP id w79so22030067qkb.5 for ; Tue, 19 Jan 2021 06:54:46 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ieee.org; s=google; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-language:content-transfer-encoding; bh=oWj7st9DOoRsAK6k1erAhEBWPxCPfX7a/rf6mPLg7fk=; b=X6dvBaXkEpmGaZUB6tlDKHgalBerIPsMvn9/i+lXwoDb9bq7UHz2bRtJZ170MbDrMe 40WrY2k9fg+sx6+oSbJ4aYJKEpUautGUeKV/DgG6scohBgLPXOttICN3TmcPT7hmUbvk fFsp3LIupZspNO9y8V7BR1/W4jHLHFATxq1I8= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=oWj7st9DOoRsAK6k1erAhEBWPxCPfX7a/rf6mPLg7fk=; b=XD2I6JfXats5ad1ETzNgTi6iqQAgHEdIFWy2x6JstTDhycY6N31ZoqbP6b1drzRg4X F35ZJJLE8PwRvYfnFA0GOlb3yikycN0DnCZBuDwcKJTmNRQASjet5IbeDhjnM/qP9Mhm FfeLaePnJzoOQQG6/RA0/Hsjg0K5tzWgMcQUWJqSoKtFjyd0azUvpLf8JnbJZdRjbHBq llRmURqrFYwdRQtqnnzSzP8GY/WVluXgBVFtybv3AeR3BANYhoaetfGlxVh7oQWWWTKU /1n0WQl/mozOIhzXYgkay1IIq78TgSFRIxT6eQH4FfAVWlzMmuyWUoG+zN3S6Inoq0FN rgBg== X-Gm-Message-State: AOAM533x7pV7VxLusDADaF0Z5+fq+5jwdGRS1ul/4RBnOnRl6so34nOJ N1KDKIWX9UuLR6sPoTm8HLqg+wHzJ4bfzg== X-Google-Smtp-Source: ABdhPJzWbIq5/HtVGP/9yNtDx7rxHeJC0BJZGf10Sh5TpDJlQRygHKe3ERAOkBRFnWSKnmYSbNdFiQ== X-Received: by 2002:ae9:c013:: with SMTP id u19mr4612947qkk.59.1611068084915; Tue, 19 Jan 2021 06:54:44 -0800 (PST) Received: from fedora.pebenito.net (pool-96-234-173-17.bltmmd.fios.verizon.net. [96.234.173.17]) by smtp.gmail.com with ESMTPSA id f22sm13066037qkl.65.2021.01.19.06.54.44 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 19 Jan 2021 06:54:44 -0800 (PST) Subject: Re: [PATCH] matrixd (synapse) policy 2 To: Russell Coker , selinux-refpolicy@vger.kernel.org References: From: Chris PeBenito Message-ID: <2d078257-acdf-5ec5-34d0-d002ed97ef00@ieee.org> Date: Tue, 19 Jan 2021 09:54:31 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Thunderbird/78.6.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Precedence: bulk List-ID: X-Mailing-List: selinux-refpolicy@vger.kernel.org On 1/18/21 6:39 PM, Russell Coker wrote: > New version after review by Dominick. > > > Signed-off-by: Russell Coker > > Index: refpolicy-2.20210115/policy/modules/kernel/corenetwork.te.in > =================================================================== > --- refpolicy-2.20210115.orig/policy/modules/kernel/corenetwork.te.in > +++ refpolicy-2.20210115/policy/modules/kernel/corenetwork.te.in > @@ -149,7 +149,7 @@ network_port(hadoop_namenode, tcp,8020,s > network_port(hddtemp, tcp,7634,s0) > network_port(howl, tcp,5335,s0, udp,5353,s0) > network_port(hplip, tcp,1782,s0, tcp,2207,s0, tcp,2208,s0, tcp, 8290,s0, tcp,50000,s0, tcp,50002,s0, tcp,8292,s0, tcp,9100,s0, tcp,9101,s0, tcp,9102,s0, tcp,9220,s0, tcp,9221,s0, tcp,9222,s0, tcp,9280,s0, tcp,9281,s0, tcp,9282,s0, tcp,9290,s0, tcp,9291,s0) > -network_port(http, tcp,80,s0, tcp,443,s0, tcp,488,s0, tcp,8008,s0, tcp,8009,s0, tcp,8443,s0) #8443 is mod_nss default port > +network_port(http, tcp,80,s0, tcp,443,s0, tcp,488,s0, tcp,8008,s0, tcp,8009,s0, tcp,8443,s0, tcp,8448,s0) #8443 is mod_nss default port > network_port(http_cache, tcp,3128,s0, udp,3130,s0, tcp,8080,s0, tcp,8118,s0, tcp,10001-10010,s0) # 8118 is for privoxy > network_port(i18n_input, tcp,9010,s0) > network_port(imaze, tcp,5323,s0, udp,5323,s0) > Index: refpolicy-2.20210115/policy/modules/services/matrixd.fc > =================================================================== > --- /dev/null > +++ refpolicy-2.20210115/policy/modules/services/matrixd.fc > @@ -0,0 +1,4 @@ > +/var/lib/matrix-synapse(/.*)? gen_context(system_u:object_r:matrixd_var_t,s0) > +/var/log/matrix-synapse(/.*)? gen_context(system_u:object_r:matrixd_log_t,s0) > +/etc/matrix-synapse(/.*)? gen_context(system_u:object_r:matrixd_conf_t,s0) > +/usr/bin/synctl -- gen_context(system_u:object_r:matrixd_exec_t,s0) > Index: refpolicy-2.20210115/policy/modules/services/matrixd.if > =================================================================== > --- /dev/null > +++ refpolicy-2.20210115/policy/modules/services/matrixd.if > @@ -0,0 +1 @@ > +## Matrixd > Index: refpolicy-2.20210115/policy/modules/services/matrixd.te > =================================================================== > --- /dev/null > +++ refpolicy-2.20210115/policy/modules/services/matrixd.te > @@ -0,0 +1,121 @@ > +policy_module(matrixd, 1.0.0) > + > +######################################## > +# > +# Declarations > +# > + > +## > +##

> +## Determine whether Matrixd is allowed to federate > +## (bind all UDP ports and connect to all TCP ports). > +##

> +## > +gen_tunable(matrix_allow_federation, true) > + > +## > +##

> +## Determine whether Matrixd can connect to the Postgres database. > +##

> +## > +gen_tunable(matrix_postgresql_connect, false) > + > + > +type matrixd_t; > +type matrixd_exec_t; > +init_daemon_domain(matrixd_t, matrixd_exec_t) > + > +type matrixd_var_t; > +files_type(matrixd_var_t) > +manage_files_pattern(matrixd_t, matrixd_var_t, matrixd_var_t) > +files_search_var_lib(matrixd_t) > +allow matrixd_t matrixd_var_t:file map; > +allow matrixd_t matrixd_var_t:dir manage_dir_perms; I think I'm ok with the rules, but this needs a little style cleanup. For example the above 4 lines need to move down. Same comment for lines below. > + > +type matrixd_log_t; > +logging_log_file(matrixd_log_t) > +logging_search_logs(matrixd_t) > +manage_files_pattern(matrixd_t, matrixd_log_t, matrixd_log_t) > + > +type matrixd_conf_t; > +files_config_file(matrixd_conf_t) > +read_files_pattern(matrixd_t, matrixd_conf_t, matrixd_conf_t) > +allow matrixd_t matrixd_conf_t:dir list_dir_perms; > + > +type matrixd_tmp_t; > +files_tmp_file(matrixd_tmp_t) > +allow matrixd_t matrixd_tmp_t:file { manage_file_perms map }; > +files_tmp_filetrans(matrixd_t, matrixd_tmp_t, file) > +fs_tmpfs_filetrans(matrixd_t, matrixd_tmp_t, file) > + > +######################################## > +# > +# Local policy > +# > + > +allow matrixd_t self:fifo_file rw_file_perms; > +allow matrixd_t self:tcp_socket create_stream_socket_perms; > +allow matrixd_t self:netlink_route_socket r_netlink_socket_perms; > + > +corenet_tcp_connect_http_port(matrixd_t) > +corenet_tcp_connect_http_cache_port(matrixd_t) > +corenet_udp_bind_generic_port(matrixd_t) > +corenet_tcp_bind_http_port(matrixd_t) > +corenet_udp_bind_reserved_port(matrixd_t) These corenet lines should go down with the other corenet lines. > +allow matrixd_t self:udp_socket create_socket_perms; > +allow matrixd_t self:unix_dgram_socket create_socket_perms; > +# https://cffi.readthedocs.io/en/latest/using.html#callbacks > +allow matrixd_t self:process execmem; > + > +kernel_read_system_state(matrixd_t) > +kernel_search_fs_sysctls(matrixd_t) > +kernel_read_vm_overcommit_sysctl(matrixd_t) > +kernel_search_vm_sysctl(matrixd_t) > + > +corecmd_exec_bin(matrixd_t) > +corecmd_exec_shell(matrixd_t) > + > +corenet_tcp_bind_generic_node(matrixd_t) > +corenet_udp_bind_generic_node(matrixd_t) > + > +dev_read_urand(matrixd_t) > + > +files_read_etc_files(matrixd_t) > +files_read_etc_runtime_files(matrixd_t) > +files_read_etc_symlinks(matrixd_t) > + > +# for /usr/share/ca-certificates > +files_read_usr_files(matrixd_t) > + > +init_search_runtime(matrixd_t) > +libs_exec_ldconfig(matrixd_t) > +libs_exec_lib_files(matrixd_t) > +logging_send_syslog_msg(matrixd_t) > + > +miscfiles_read_generic_tls_privkey(matrixd_t) > +miscfiles_read_generic_certs(matrixd_t) > +miscfiles_read_localization(matrixd_t) > + > +sysnet_read_config(matrixd_t) > + > +userdom_search_user_runtime_root(matrixd_t) > + > +optional_policy(` > + apache_search_config(matrixd_t) > +') > + > +tunable_policy(`matrix_allow_federation',` > + corenet_tcp_connect_all_unreserved_ports(matrixd_t) > + corenet_tcp_connect_generic_port(matrixd_t) > + corenet_udp_bind_all_ports(matrixd_t) > +', ` > + corenet_dontaudit_tcp_connect_all_ports(matrixd_t) > + corenet_dontaudit_udp_bind_all_ports(matrixd_t) > +') > + > +tunable_policy(`matrix_postgresql_connect',` > + postgresql_stream_connect(matrixd_t) > + postgresql_tcp_connect(matrixd_t) > +') > + > -- Chris PeBenito