From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.1 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 06B1FC43387 for ; Sat, 12 Jan 2019 01:12:05 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id C7E762084E for ; Sat, 12 Jan 2019 01:12:04 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=coker.com.au header.i=@coker.com.au header.b="BnChNuMw" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726371AbfALBME (ORCPT ); Fri, 11 Jan 2019 20:12:04 -0500 Received: from smtp.sws.net.au ([46.4.88.250]:60304 "EHLO smtp.sws.net.au" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726270AbfALBME (ORCPT ); Fri, 11 Jan 2019 20:12:04 -0500 Received: from xev.coker.com.au (localhost [127.0.0.1]) by smtp.sws.net.au (Postfix) with ESMTP id 1E3FFED04; Sat, 12 Jan 2019 12:12:02 +1100 (AEDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=coker.com.au; s=2008; t=1547255522; bh=j5Fk4BBzzMZN2aK3v1oiH+0HmBo8iMF/48vT6xbDnpU=; l=5234; h=From:To:Reply-To:Cc:Subject:Date:In-Reply-To:References:From; b=BnChNuMwm7CBbJicsXYkecITdJTwI0wHCEvCbJuiuSYb3Vzkrfae2Bydrpp590eka l9QuyfJHTOI0/qWdqIAe3TCPQFEyY83gBn1dztHMGxpTbmV5OZvB/HWhA0a7lmBOvR zKn5EooBuNoBY111H/lWa86QCcT2XNiGFMYvwrus= Received: by xev.coker.com.au (Postfix, from userid 1001) id 48832C4897B; Sat, 12 Jan 2019 12:11:57 +1100 (AEDT) From: Russell Coker To: "Sugar, David" Reply-To: russell@coker.com.au Cc: "selinux-refpolicy@vger.kernel.org" Subject: Re: [PATCH 2/2] Setup private type for /etc/hostname. Date: Sat, 12 Jan 2019 12:11:57 +1100 Message-ID: <31583679.z2ikJt99TD@xev> In-Reply-To: <20190111153011.27275-5-dsugar@tresys.com> References: <20190111153011.27275-1-dsugar@tresys.com> <20190111153011.27275-5-dsugar@tresys.com> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Sender: selinux-refpolicy-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux-refpolicy@vger.kernel.org Are we really gaining anything from not using net_conf_t? Yes writing to net_conf_t allows doing more things than changing the hostname, but changing the hostname is a privileged operation anyway. Are we getting a benefit to make up for the increase in types? On Saturday, 12 January 2019 2:30:54 AM AEDT Sugar, David wrote: > hostnamectl updates /etc/hostname. > This change is setting up a private type for the file /etc/hostname (was > etc_t) and granting hostnamectl permission to edit this file. Note that > hostnamectl is initially creating a new file .#hostname????? which is why > the create permissions are requied. > > type=AVC msg=audit(1547039052.041:563): avc: denied { write } for > pid=7564 comm="systemd-hostnam" name="etc" dev="dm-1" ino=101 > scontext=system_u:system_r:systemd_hostnamed_t:s0 > tcontext=system_u:object_r:etc_t:s0 tclass=dir permissive=1 type=AVC > msg=audit(1547039052.041:563): avc: denied { add_name } for pid=7564 > comm="systemd-hostnam" name=".#hostnamezyqZ9t" > scontext=system_u:system_r:systemd_hostnamed_t:s0 > tcontext=system_u:object_r:etc_t:s0 tclass=dir permissive=1 type=AVC > msg=audit(1547039052.041:563): avc: denied { create } for pid=7564 > comm="systemd-hostnam" name=".#hostnamezyqZ9t" > scontext=system_u:system_r:systemd_hostnamed_t:s0 > tcontext=system_u:object_r:etc_t:s0 tclass=file permissive=1 type=AVC > msg=audit(1547039052.041:563): avc: denied { write } for pid=7564 > comm="systemd-hostnam" path="/etc/.#hostnamezyqZ9t" dev="dm-1" ino=1094726 > scontext=system_u:system_r:systemd_hostnamed_t:s0 > tcontext=system_u:object_r:etc_t:s0 tclass=file permissive=1 type=SYSCALL > msg=audit(1547039052.041:563): arch=c000003e syscall=2 success=yes exit=8 > a0=560d0bba34b0 a1=800c2 a2=180 a3=5c35f14c items=2 ppid=1 pid=7564 > auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 > tty=(none) ses=4294967295 comm="systemd-hostnam" > exe="/usr/lib/systemd/systemd-hostnamed" > subj=system_u:system_r:systemd_hostnamed_t:s0 key=(null) type=AVC > msg=audit(1547039052.041:564): avc: denied { setattr } for pid=7564 > comm="systemd-hostnam" name=".#hostnamezyqZ9t" dev="dm-1" ino=1094726 > scontext=system_u:system_r:systemd_hostnamed_t:s0 > tcontext=system_u:object_r:etc_t:s0 tclass=file permissive=1 type=SYSCALL > msg=audit(1547039052.041:564): arch=c000003e syscall=91 success=yes exit=0 > a0=8 a1=1a4 a2=fbad2484 a3=24 items=1 ppid=1 pid=7564 auid=4294967295 uid=0 > gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 > comm="systemd-hostnam" exe="/usr/lib/systemd/systemd-hostnamed" > subj=system_u:system_r:systemd_hostnamed_t:s0 key=(null) type=AVC > msg=audit(1547039052.041:565): avc: denied { remove_name } for pid=7564 > comm="systemd-hostnam" name=".#hostnamezyqZ9t" dev="dm-1" ino=1094726 > scontext=system_u:system_r:systemd_hostnamed_t:s0 > tcontext=system_u:object_r:etc_t:s0 tclass=dir permissive=1 type=AVC > msg=audit(1547039052.041:565): avc: denied { rename } for pid=7564 > comm="systemd-hostnam" name=".#hostnamezyqZ9t" dev="dm-1" ino=1094726 > scontext=system_u:system_r:systemd_hostnamed_t:s0 > tcontext=system_u:object_r:etc_t:s0 tclass=file permissive=1 type=AVC > msg=audit(1547039052.041:565): avc: denied { unlink } for pid=7564 > comm="systemd-hostnam" name="hostname" dev="dm-1" ino=1094712 > scontext=system_u:system_r:systemd_hostnamed_t:s0 > tcontext=system_u:object_r:etc_t:s0 tclass=file permissive=1 > > Signed-off-by: Dave Sugar > --- > policy/modules/system/systemd.fc | 1 + > policy/modules/system/systemd.te | 6 ++++++ > 2 files changed, 7 insertions(+) > > diff --git a/policy/modules/system/systemd.fc > b/policy/modules/system/systemd.fc index eefcfaf1..2277fc1e 100644 > --- a/policy/modules/system/systemd.fc > +++ b/policy/modules/system/systemd.fc > @@ -1,3 +1,4 @@ > +/etc/hostname -- gen_context(system_u:object_r:hostname_etc_t,s0) > /etc/udev/hwdb\.bin -- gen_context(system_u:object_r:systemd_hwdb_t,s0) > > /run/log/journal(/.*)? gen_context(system_u:object_r:systemd_journal_t,s > 0) diff --git a/policy/modules/system/systemd.te > b/policy/modules/system/systemd.te index f5f7dc1b..3704b756 100644 > --- a/policy/modules/system/systemd.te > +++ b/policy/modules/system/systemd.te > @@ -77,6 +77,9 @@ type systemd_detect_virt_t; > type systemd_detect_virt_exec_t; > init_daemon_domain(systemd_detect_virt_t, systemd_detect_virt_exec_t) > > +type hostname_etc_t; > +files_config_file(hostname_etc_t) > + > type systemd_hostnamed_t; > type systemd_hostnamed_exec_t; > init_daemon_domain(systemd_hostnamed_t, systemd_hostnamed_exec_t) > @@ -317,10 +320,13 @@ seutil_search_default_contexts(systemd_coredump_t) > # Hostnamed policy > # > > +allow systemd_hostnamed_t hostname_etc_t:file manage_file_perms; > + > kernel_read_kernel_sysctls(systemd_hostnamed_t) > > dev_read_sysfs(systemd_hostnamed_t) > > +files_etc_filetrans(systemd_hostnamed_t, hostname_etc_t, file) > files_read_etc_files(systemd_hostnamed_t) > > seutil_read_file_contexts(systemd_hostnamed_t) -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/