[refpolicy] [PATCH v2] ipsec: add missing permissions for pluto

[refpolicy] [PATCH v2] ipsec: add missing permissions for pluto

[Yuli Khodorkovskiy]

When using libreswan, pluto needs permissions for building the
Security Association Database and for setting contexts on IPSec
policy and SAs.

Signed-off-by: Yuli Khodorkovskiy <yuli@crunchydata.com>
---
 policy/modules/system/ipsec.te | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/policy/modules/system/ipsec.te b/policy/modules/system/ipsec.te
index 867aefc4..1613a960 100644
--- a/policy/modules/system/ipsec.te
+++ b/policy/modules/system/ipsec.te
@@ -212,6 +212,12 @@ domtrans_pattern(ipsec_mgmt_t, ipsec_exec_t, ipsec_t)
 read_files_pattern(ipsec_mgmt_t, ipsec_t, ipsec_t)
 read_lnk_files_pattern(ipsec_mgmt_t, ipsec_t, ipsec_t)
 
+# allow pluto to build Security Association Database
+corenet_setcontext_all_spds(ipsec_t)
+
+# allow pluto to set contexts on ipsec policy and SAs
+domain_ipsec_setcontext_all_domains(ipsec_t)
+
 allow ipsec_mgmt_t ipsec_conf_file_t:file read_file_perms;
 
 manage_files_pattern(ipsec_mgmt_t, ipsec_key_file_t, ipsec_key_file_t)
-- 
2.18.0

[refpolicy] [PATCH v2] ipsec: add missing permissions for pluto

[Chris PeBenito]

On 07/26/2018 11:51 AM, Yuli Khodorkovskiy via refpolicy wrote:
> When using libreswan, pluto needs permissions for building the
> Security Association Database and for setting contexts on IPSec
> policy and SAs.
> 
> Signed-off-by: Yuli Khodorkovskiy <yuli@crunchydata.com>
> ---
>   policy/modules/system/ipsec.te | 6 ++++++
>   1 file changed, 6 insertions(+)
> 
> diff --git a/policy/modules/system/ipsec.te b/policy/modules/system/ipsec.te
> index 867aefc4..1613a960 100644
> --- a/policy/modules/system/ipsec.te
> +++ b/policy/modules/system/ipsec.te
> @@ -212,6 +212,12 @@ domtrans_pattern(ipsec_mgmt_t, ipsec_exec_t, ipsec_t)
>   read_files_pattern(ipsec_mgmt_t, ipsec_t, ipsec_t)
>   read_lnk_files_pattern(ipsec_mgmt_t, ipsec_t, ipsec_t)
>   
> +# allow pluto to build Security Association Database
> +corenet_setcontext_all_spds(ipsec_t)
> +
> +# allow pluto to set contexts on ipsec policy and SAs
> +domain_ipsec_setcontext_all_domains(ipsec_t)
> +
>   allow ipsec_mgmt_t ipsec_conf_file_t:file read_file_perms;
>   
>   manage_files_pattern(ipsec_mgmt_t, ipsec_key_file_t, ipsec_key_file_t)

One nit: the additions should be down with the other corenet and domain 
rules.

-- 
Chris PeBenito