From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.2 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH, MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B4D66C43219 for ; Tue, 30 Apr 2019 23:37:30 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 66A9920835 for ; Tue, 30 Apr 2019 23:37:30 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=ieee.org header.i=@ieee.org header.b="TIplu05e" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726102AbfD3Xha (ORCPT ); Tue, 30 Apr 2019 19:37:30 -0400 Received: from mail-qt1-f196.google.com ([209.85.160.196]:45195 "EHLO mail-qt1-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726086AbfD3Xha (ORCPT ); Tue, 30 Apr 2019 19:37:30 -0400 Received: by mail-qt1-f196.google.com with SMTP id b3so18404057qtc.12 for ; Tue, 30 Apr 2019 16:37:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ieee.org; s=google; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-language:content-transfer-encoding; bh=gRuMa/LVAo3UOomHCLRuieLYDRO3c2oZeCMfPqdk0/k=; b=TIplu05eUg1FroYQHpHQonhPi5BsI1kq9om/TTLAiIMfTzhDZC4oI82UUre6bAkqVW 4zJpr9oGV9MoNq3aeAoO18ijvbkFTVeApxiFpu5N+CVGfGDxPzB1S4AY4gLq5oawJTdT NnxjBGkxvULySd3oTEjJKO/ApB8VmBXVPUu4U= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=gRuMa/LVAo3UOomHCLRuieLYDRO3c2oZeCMfPqdk0/k=; b=Z31wEE41Pod3KkHWBQnN7/Pui/ytnc3JFAVVt1yP08OKD5uyHP/RRrW6EvObmfVZPi foDrwcz2lYUJlwpEcvePRr5TFUv/KzmmneTnvXZhSgVl7rbK8Si+1s0Nb1SjrR+jsgIA 2ThuQ8YR5qixL4xM/o9Edsxb81h2I3Q4qL/17N4yKcODVBCZLIg7Nwl+qRqG3QCjYN7U u6nz6I04MZDOizUznfp0+EwIgSl+rEUhBQ0GMuJCsVVMwy6NOleV8BgyKhuHi74u5xUX 8GU+q5UyV8aa7Lln4k4ZFVmclcqHo5X7aprST/q562YzDK1uUmMya5edFJZMt6cF1kEm GH+w== X-Gm-Message-State: APjAAAUmHtv97A9RZ952PATo9fR2tZb3dzP5LfRu6KreTGR8Hl7bIixo Z83ON2JamMg78RKZZh6I/mmhPRE3nKk= X-Google-Smtp-Source: APXvYqzD6r3NdU7psPWZVVCWrCdgDzlioO4E9Pis7V0FYwGEngTr58ippb0t2hdYgkzA9XnSmUsG6A== X-Received: by 2002:a0c:fe65:: with SMTP id b5mr13316202qvv.106.1556667448618; Tue, 30 Apr 2019 16:37:28 -0700 (PDT) Received: from [192.168.1.190] (pool-108-15-23-247.bltmmd.fios.verizon.net. [108.15.23.247]) by smtp.gmail.com with ESMTPSA id y14sm22092520qth.48.2019.04.30.16.37.27 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 30 Apr 2019 16:37:27 -0700 (PDT) Subject: Re: [PATCH] Introduce allow_bluetooth boolean To: Lukas Vrabec , selinux-refpolicy@vger.kernel.org References: <20190430175329.25335-1-lvrabec@redhat.com> From: Chris PeBenito Message-ID: <4438fae1-fa76-27ea-a7dc-509112540e8c@ieee.org> Date: Tue, 30 Apr 2019 19:37:27 -0400 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.3.0 MIME-Version: 1.0 In-Reply-To: <20190430175329.25335-1-lvrabec@redhat.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Sender: selinux-refpolicy-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux-refpolicy@vger.kernel.org On 4/30/19 1:53 PM, Lukas Vrabec wrote: > Because of new bluetooth_socket which is part of extended_socket_class > policy capability, it's possible to control which SELinux domains can > use bluetooth wireless technology. Default value of the boolean is > turned off. > > Signed-off-by: Lukas Vrabec > --- > policy/global_tunables | 7 +++++++ > policy/modules/admin/netutils.te | 4 ++++ > policy/modules/services/arpwatch.te | 4 ++++ > policy/modules/services/bluetooth.if | 4 ++++ > policy/modules/services/bluetooth.te | 4 ++++ > policy/modules/services/ntop.te | 4 ++++ > policy/modules/system/userdomain.if | 8 ++++++++ > 7 files changed, 35 insertions(+) > > diff --git a/policy/global_tunables b/policy/global_tunables > index affc020f..69b356e2 100644 > --- a/policy/global_tunables > +++ b/policy/global_tunables > @@ -4,6 +4,13 @@ > # file should be used. > # > > +## > +##

> +## Allow all system processes and Linux users to use bluetooth wireless technology. > +##

> +## > +gen_tunable(allow_bluetooth,false) > + > ## > ##

> ## Allow unconfined executables to make their heap memory executable. Doing this is a really bad idea. Probably indicates a badly coded executable, but could indicate an attack. This executable should be reported in bugzilla > diff --git a/policy/modules/admin/netutils.te b/policy/modules/admin/netutils.te > index 46560a09..8821b108 100644 > --- a/policy/modules/admin/netutils.te > +++ b/policy/modules/admin/netutils.te > @@ -99,6 +99,10 @@ optional_policy(` > xen_append_log(netutils_t) > ') > > +tunable_policy(`allow_bluetooth',` > + allow netutils_t self:bluetooth_socket create_stream_socket_perms; > +') > + > ######################################## > # > # Ping local policy > diff --git a/policy/modules/services/arpwatch.te b/policy/modules/services/arpwatch.te > index 87aed96f..6f05441a 100644 > --- a/policy/modules/services/arpwatch.te > +++ b/policy/modules/services/arpwatch.te > @@ -77,6 +77,10 @@ miscfiles_read_localization(arpwatch_t) > userdom_dontaudit_search_user_home_dirs(arpwatch_t) > userdom_dontaudit_use_unpriv_user_fds(arpwatch_t) > > +tunable_policy(`allow_bluetooth',` > + allow arpwatch_t self:bluetooth_socket create_socket_perms; > +') > + > optional_policy(` > mta_send_mail(arpwatch_t) > ') > diff --git a/policy/modules/services/bluetooth.if b/policy/modules/services/bluetooth.if > index dc61988c..9097803f 100644 > --- a/policy/modules/services/bluetooth.if > +++ b/policy/modules/services/bluetooth.if > @@ -68,6 +68,10 @@ interface(`bluetooth_stream_connect',` > files_search_pids($1) > allow $1 bluetooth_t:socket rw_socket_perms; > stream_connect_pattern($1, bluetooth_var_run_t, bluetooth_var_run_t, bluetooth_t) > + > + tunable_policy(`deny_bluetooth',`',` Missed a deny_bluetooth. I'm also a little uneasy with adding this access here, as this would seem to be a side effect to a simple stream socket connection. Perhaps there should be a new interface like bluetooth_client(). It might also make sense in bluetooth_role(), as there is a generic socket class rule in there too. > + allow $1 bluetooth_t:bluetooth_socket rw_socket_perms; > + ') > ') > > ######################################## > diff --git a/policy/modules/services/bluetooth.te b/policy/modules/services/bluetooth.te > index 45e5a361..39af72d5 100644 > --- a/policy/modules/services/bluetooth.te > +++ b/policy/modules/services/bluetooth.te > @@ -133,6 +133,10 @@ userdom_dontaudit_use_unpriv_user_fds(bluetooth_t) > userdom_dontaudit_use_user_terminals(bluetooth_t) > userdom_dontaudit_search_user_home_dirs(bluetooth_t) > > +tunable_policy(`allow_bluetooth',` > + allow bluetooth_t self:bluetooth_socket create_stream_socket_perms; > +') > + > optional_policy(` > dbus_system_bus_client(bluetooth_t) > dbus_connect_system_bus(bluetooth_t) > diff --git a/policy/modules/services/ntop.te b/policy/modules/services/ntop.te > index 178bbb1d..537d9323 100644 > --- a/policy/modules/services/ntop.te > +++ b/policy/modules/services/ntop.te > @@ -96,6 +96,10 @@ miscfiles_read_localization(ntop_t) > userdom_dontaudit_use_unpriv_user_fds(ntop_t) > userdom_dontaudit_search_user_home_dirs(ntop_t) > > +tunable_policy(`allow_bluetooth',` > + allow ntop_t self:bluetooth_socket create_socket_perms; > +') > + > optional_policy(` > apache_read_sys_content(ntop_t) > ') > diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if > index 5221bd13..5654de6e 100644 > --- a/policy/modules/system/userdomain.if > +++ b/policy/modules/system/userdomain.if > @@ -1189,6 +1189,10 @@ template(`userdom_unpriv_user_template', ` > corenet_udp_bind_generic_port($1_t) > ') > > + tunable_policy(`allow_bluetooth',` > + allow $1_t self:bluetooth_socket create_socket_perms; > + ') > + > optional_policy(` > netutils_run_ping_cond($1_t, $1_r) > netutils_run_traceroute_cond($1_t, $1_r) > @@ -1362,6 +1366,10 @@ template(`userdom_admin_user_template',` > userdom_manage_user_home_content_sockets($1_t) > userdom_user_home_dir_filetrans_user_home_content($1_t, { dir file lnk_file fifo_file sock_file }) > > + tunable_policy(`allow_bluetooth',` > + allow $1_t self:bluetooth_socket create_stream_socket_perms; > + ') > + > optional_policy(` > postgresql_unconfined($1_t) > ') > -- Chris PeBenito