From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.4 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH, MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED, USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6FD83C606B0 for ; Tue, 9 Jul 2019 00:50:02 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 43178216C4 for ; Tue, 9 Jul 2019 00:50:02 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=ieee.org header.i=@ieee.org header.b="Yk1JRcIS" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727148AbfGIAuB (ORCPT ); Mon, 8 Jul 2019 20:50:01 -0400 Received: from mail-qk1-f196.google.com ([209.85.222.196]:45272 "EHLO mail-qk1-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725857AbfGIAuB (ORCPT ); Mon, 8 Jul 2019 20:50:01 -0400 Received: by mail-qk1-f196.google.com with SMTP id s22so14764297qkj.12 for ; Mon, 08 Jul 2019 17:50:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ieee.org; s=google; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-language:content-transfer-encoding; bh=zlMmBW0APdMcrkzExzDm3LEvEJ0ghAPHTBu53I9a6vY=; b=Yk1JRcISUEkhreI1PnAZGAaWvZIrbnQNbIelSBkOqM3aPXDt8EWaxj0pqBpVYjHog3 TD5VXEZR75V97bguWZg7Ythst4y72PuCDFnEKLENVAbNFdiQO2VZT1J7MN7xXQtpNtVr BsiPgJBduAGB7EjymO2OtHQYT6Pp1LYZFRsxo= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=zlMmBW0APdMcrkzExzDm3LEvEJ0ghAPHTBu53I9a6vY=; b=sABlf1neO17Ny4OkfIuoq3xazlQxXBr4CdPdWnkvJ/fasdUWtLiusAEoO805iDhuYI 3rM2kbV+kkDobJqoReyIAc4xacKNncobr2AY94LTVfIsUNd/kDDyI2wzEEwKLPTKuLnP V1ghFxBDE6lGTWGNxIIWdiaHNpWXjRraxBq3eX+k3OxBBsgyNwU1S9QXvUnxl6k4eYF1 nI6Nqgf+Z+Lpmh3yDJMEGUeW11+90K1zcoxFilbvNxxiOc+B3Ma2wTYjwR2w/9dLfN9D IJi7q3L2N01azLalwknJRuE6loXk3ZJXVYcghoL4UcrDnc/+CYoyfZFibON0orA96a4n CBZQ== X-Gm-Message-State: APjAAAU/qE240UDosFbG+rEPOQbbx0qTsBzzNbXIQ5WyX1G/JSAWbYhO uXz0Jp+MH/wXT8t/Fc/UUO0wXC/AFC0= X-Google-Smtp-Source: APXvYqyS/bWP83RcpQAJVR6p87VdTHq4MxGVwpFl2akgzQp5lbCAkRqLiaoMmyi671Cz3fKpkXnYXw== X-Received: by 2002:a37:6a87:: with SMTP id f129mr16475550qkc.183.1562633400557; Mon, 08 Jul 2019 17:50:00 -0700 (PDT) Received: from [192.168.1.190] (pool-108-15-23-247.bltmmd.fios.verizon.net. [108.15.23.247]) by smtp.gmail.com with ESMTPSA id o21sm7820781qtq.16.2019.07.08.17.49.59 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 08 Jul 2019 17:50:00 -0700 (PDT) Subject: Re: [PATCH 5/5] Allow rpm scripts to alter systemd services To: "Sugar, David" , "selinux-refpolicy@vger.kernel.org" References: <20190702153014.14097-1-dsugar@tresys.com> <20190702153014.14097-6-dsugar@tresys.com> From: Chris PeBenito Message-ID: <5d31d72b-c6a6-7f28-1d86-3cb6d817b618@ieee.org> Date: Mon, 8 Jul 2019 20:40:10 -0400 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.6.1 MIME-Version: 1.0 In-Reply-To: <20190702153014.14097-6-dsugar@tresys.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Sender: selinux-refpolicy-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux-refpolicy@vger.kernel.org On 7/2/19 11:30 AM, Sugar, David wrote: > In RPM scripts it is common to enable/start services that are being > installed. This allows rpm_script_t to manage sysemd units > > type=USER_AVC msg=audit(1561033935.758:283): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc: denied { enable } for auid=n/a uid=0 gid=0 path="/usr/lib/systemd/system/ntpdate.service" cmdline="systemctl preset ntpdate.service" scontext=system_u:system_r:rpm_script_t:s0 tcontext=system_u:object_r:ntpd_unit_t:s0 tclass=service exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?' > type=USER_AVC msg=audit(1561033935.837:286): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc: denied { enable } for auid=n/a uid=0 gid=0 path="/usr/lib/systemd/system/ntpd.service" cmdline="systemctl preset ntpd.service" scontext=system_u:system_r:rpm_script_t:s0 tcontext=system_u:object_r:ntpd_unit_t:s0 tclass=service exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?' > > type=USER_AVC msg=audit(1561059114.937:239): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc: denied { reload } for auid=n/a uid=0 gid=0 cmdline="systemctl preset ntpdate.service" scontext=system_u:system_r:rpm_script_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=system exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?' > > Signed-off-by: Dave Sugar > --- > policy/modules/admin/rpm.te | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/policy/modules/admin/rpm.te b/policy/modules/admin/rpm.te > index 111fcb01..c572c741 100644 > --- a/policy/modules/admin/rpm.te > +++ b/policy/modules/admin/rpm.te > @@ -345,6 +345,8 @@ auth_dontaudit_getattr_shadow(rpm_script_t) > auth_use_nsswitch(rpm_script_t) > > init_domtrans_script(rpm_script_t) > +init_manage_all_units(rpm_script_t) > +init_reload(rpm_script_t) > init_telinit(rpm_script_t) > > libs_exec_ld_so(rpm_script_t) Merged. -- Chris PeBenito