[PATCH] certbot

[PATCH] certbot

[Russell Coker]

Allow certbot to create /var/lib/letsencrypt and /var/og/letsencrypt with
the correct contexts.

Allow it to read /dev/urandom, dontaudit attempts to write python cache files
(would be good to fix python for this), and reload web server to get new
keys.

I think this is good to merge.

Signed-off-by: Russell Coker <russell@coker.com.au>

Index: refpolicy-2.20220106/policy/modules/services/apache.if
===================================================================
--- refpolicy-2.20220106.orig/policy/modules/services/apache.if
+++ refpolicy-2.20220106/policy/modules/services/apache.if
@@ -238,6 +238,24 @@ interface(`apache_domtrans',`
 
 ########################################
 ## <summary>
+##	Execute httpd
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to execute it.
+##	</summary>
+## </param>
+#
+interface(`apache_exec',`
+	gen_require(`
+		type httpd_t, httpd_exec_t;
+	')
+
+	can_exec($1, httpd_exec_t)
+')
+
+########################################
+## <summary>
 ##	Execute httpd server in the httpd domain.
 ## </summary>
 ## <param name="domain">
@@ -1430,3 +1448,21 @@ interface(`apache_admin',`
 	apache_run_all_scripts($1, $2)
 	apache_run_helper($1, $2)
 ')
+
+########################################
+## <summary>
+##	rw httpd_runtime_t files
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`apache_rw_runtime_files',`
+	gen_require(`
+		type httpd_runtime_t;
+	')
+
+	allow $1 httpd_runtime_t:file rw_file_perms;
+')
Index: refpolicy-2.20220106/policy/modules/services/certbot.te
===================================================================
--- refpolicy-2.20220106.orig/policy/modules/services/certbot.te
+++ refpolicy-2.20220106/policy/modules/services/certbot.te
@@ -43,9 +43,10 @@ allow certbot_t self:udp_socket all_udp_
 allow certbot_t self:tcp_socket all_tcp_socket_perms;
 allow certbot_t self:netlink_route_socket create_netlink_socket_perms;
 
-files_search_var_lib(certbot_t)
+files_var_lib_filetrans(certbot_t, certbot_lib_t, dir, "letsencrypt")
 manage_dirs_pattern(certbot_t, certbot_lib_t, certbot_lib_t)
 manage_files_pattern(certbot_t, certbot_lib_t, certbot_lib_t)
+allow certbot_t certbot_lib_t:file relabelfrom;
 
 manage_dirs_pattern(certbot_t, certbot_tmp_t, certbot_tmp_t)
 manage_files_pattern(certbot_t, certbot_tmp_t, certbot_tmp_t)
@@ -62,7 +63,7 @@ allow certbot_t certbot_tmp_t:file mmap_
 allow certbot_t certbot_tmpfs_t:file mmap_exec_file_perms;
 allow certbot_t certbot_runtime_t:file mmap_exec_file_perms;
 
-logging_search_logs(certbot_t)
+logging_log_filetrans(certbot_t, certbot_log_t, dir, "letsencrypt")
 allow certbot_t certbot_log_t:dir manage_dir_perms;
 allow certbot_t certbot_log_t:file manage_file_perms;
 
@@ -80,11 +81,15 @@ corenet_tcp_connect_dns_port(certbot_t)
 # bind to http port for standalone mode
 corenet_tcp_bind_http_port(certbot_t)
 
+dev_read_urand(certbot_t)
+
 domain_use_interactive_fds(certbot_t)
 
 files_read_etc_files(certbot_t)
 files_read_usr_files(certbot_t)
 
+# dontaudit for attempts to write python cache files
+libs_dontaudit_write_lib_dirs(certbot_t)
 libs_exec_ldconfig(certbot_t)
 # for /usr/lib/gcc/x86_64-linux-gnu/8/collect2
 libs_exec_lib_files(certbot_t)
@@ -110,5 +115,17 @@ optional_policy(`
 	# for writing to webroot
 	apache_manage_sys_content(certbot_t)
 
-	apache_search_config(certbot_t)
+	apache_append_log(certbot_t)
+	apache_exec(certbot_t)
+	apache_exec_modules(certbot_t)
+
+	# for certbot to create nginx config
+	apache_manage_config(certbot_t)
+
+	apache_rw_runtime_files(certbot_t)
+	apache_signal(certbot_t)
+')
+
+optional_policy(`
+	xdg_search_config_dirs(certbot_t)
 ')

Re: [PATCH] certbot

[Chris PeBenito]

On 2/18/22 21:45, Russell Coker wrote:
> Allow certbot to create /var/lib/letsencrypt and /var/og/letsencrypt with
> the correct contexts.
> 
> Allow it to read /dev/urandom, dontaudit attempts to write python cache files
> (would be good to fix python for this), and reload web server to get new
> keys.
> 
> I think this is good to merge.
> 
> Signed-off-by: Russell Coker <russell@coker.com.au>
> 
> Index: refpolicy-2.20220106/policy/modules/services/apache.if
> ===================================================================
> --- refpolicy-2.20220106.orig/policy/modules/services/apache.if
> +++ refpolicy-2.20220106/policy/modules/services/apache.if
> @@ -238,6 +238,24 @@ interface(`apache_domtrans',`
>   
>   ########################################
>   ## <summary>
> +##	Execute httpd
> +## </summary>
> +## <param name="domain">
> +##	<summary>
> +##	Domain allowed to execute it.
> +##	</summary>
> +## </param>
> +#
> +interface(`apache_exec',`
> +	gen_require(`
> +		type httpd_t, httpd_exec_t;
> +	')
> +
> +	can_exec($1, httpd_exec_t)
> +')
> +
> +########################################
> +## <summary>
>   ##	Execute httpd server in the httpd domain.
>   ## </summary>
>   ## <param name="domain">
> @@ -1430,3 +1448,21 @@ interface(`apache_admin',`
>   	apache_run_all_scripts($1, $2)
>   	apache_run_helper($1, $2)
>   ')
> +
> +########################################
> +## <summary>
> +##	rw httpd_runtime_t files
> +## </summary>
> +## <param name="domain">
> +##	<summary>
> +##	Domain allowed access.
> +##	</summary>
> +## </param>
> +#
> +interface(`apache_rw_runtime_files',`
> +	gen_require(`
> +		type httpd_runtime_t;
> +	')
> +
> +	allow $1 httpd_runtime_t:file rw_file_perms;
> +')
> Index: refpolicy-2.20220106/policy/modules/services/certbot.te
> ===================================================================
> --- refpolicy-2.20220106.orig/policy/modules/services/certbot.te
> +++ refpolicy-2.20220106/policy/modules/services/certbot.te
> @@ -43,9 +43,10 @@ allow certbot_t self:udp_socket all_udp_
>   allow certbot_t self:tcp_socket all_tcp_socket_perms;
>   allow certbot_t self:netlink_route_socket create_netlink_socket_perms;
>   
> -files_search_var_lib(certbot_t)
> +files_var_lib_filetrans(certbot_t, certbot_lib_t, dir, "letsencrypt")
>   manage_dirs_pattern(certbot_t, certbot_lib_t, certbot_lib_t)
>   manage_files_pattern(certbot_t, certbot_lib_t, certbot_lib_t)
> +allow certbot_t certbot_lib_t:file relabelfrom;

There is no relabelto.  What is happening here?


>   manage_dirs_pattern(certbot_t, certbot_tmp_t, certbot_tmp_t)
>   manage_files_pattern(certbot_t, certbot_tmp_t, certbot_tmp_t)
> @@ -62,7 +63,7 @@ allow certbot_t certbot_tmp_t:file mmap_
>   allow certbot_t certbot_tmpfs_t:file mmap_exec_file_perms;
>   allow certbot_t certbot_runtime_t:file mmap_exec_file_perms;
>   
> -logging_search_logs(certbot_t)
> +logging_log_filetrans(certbot_t, certbot_log_t, dir, "letsencrypt")
>   allow certbot_t certbot_log_t:dir manage_dir_perms;
>   allow certbot_t certbot_log_t:file manage_file_perms;
>   
> @@ -80,11 +81,15 @@ corenet_tcp_connect_dns_port(certbot_t)
>   # bind to http port for standalone mode
>   corenet_tcp_bind_http_port(certbot_t)
>   
> +dev_read_urand(certbot_t)
> +
>   domain_use_interactive_fds(certbot_t)
>   
>   files_read_etc_files(certbot_t)
>   files_read_usr_files(certbot_t)
>   
> +# dontaudit for attempts to write python cache files
> +libs_dontaudit_write_lib_dirs(certbot_t)
>   libs_exec_ldconfig(certbot_t)
>   # for /usr/lib/gcc/x86_64-linux-gnu/8/collect2
>   libs_exec_lib_files(certbot_t)
> @@ -110,5 +115,17 @@ optional_policy(`
>   	# for writing to webroot
>   	apache_manage_sys_content(certbot_t)
>   
> -	apache_search_config(certbot_t)
> +	apache_append_log(certbot_t)
> +	apache_exec(certbot_t)
> +	apache_exec_modules(certbot_t)
> +
> +	# for certbot to create nginx config
> +	apache_manage_config(certbot_t)
> +
> +	apache_rw_runtime_files(certbot_t)
> +	apache_signal(certbot_t)
> +')
> +
> +optional_policy(`
> +	xdg_search_config_dirs(certbot_t)
>   ')


-- 
Chris PeBenito

Re: [PATCH] certbot

[Russell Coker]

On Tuesday, 1 March 2022 07:44:47 AEDT Chris PeBenito wrote:
> > +allow certbot_t certbot_lib_t:file relabelfrom;
> 
> There is no relabelto.  What is happening here?

I'm not sure, I can't reproduce the situation that led to this, I've removed 
it.

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/