From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.1 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH, MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7395AC10F14 for ; Wed, 17 Apr 2019 02:08:50 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 2531B20872 for ; Wed, 17 Apr 2019 02:08:50 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=ieee.org header.i=@ieee.org header.b="UHmYtxSX" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728888AbfDQCIt (ORCPT ); Tue, 16 Apr 2019 22:08:49 -0400 Received: from mail-qk1-f193.google.com ([209.85.222.193]:34700 "EHLO mail-qk1-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728851AbfDQCIt (ORCPT ); Tue, 16 Apr 2019 22:08:49 -0400 Received: by mail-qk1-f193.google.com with SMTP id n68so13469322qka.1 for ; Tue, 16 Apr 2019 19:08:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ieee.org; s=google; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-language:content-transfer-encoding; bh=+mro6sB3a5p1jNM5TGYBJwXarkyRVW3mmieuL00ze/s=; b=UHmYtxSXFqV6KILEzsJl9Sevxqx+qM+gAZagiNBapTPVx6MdWQS4hl0O2zxX4+XjNM gBrDy9CAblNX8hQ79jUn/KMJcfw7nGQiN0gWrRZ5WHYel6nG9L51poPnt8gWz37u67wP huba1lnR6gLPbL2faKldjIloMMbP+TMDpj1Hs= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=+mro6sB3a5p1jNM5TGYBJwXarkyRVW3mmieuL00ze/s=; b=bOnX+NMyfJ+oC2406GryrHQZBPOmzS3P8alWqW/gOagC+hEUXPbfBh29cfthvrssfk Vc9qIbufk4O6Fp2JhaODX7eBLqApg6qxNwXabHSQhWqRwC38KB0k3CuUSg5Xiotkxoh6 CsGAQRf0rrkHY6aOXJjr80K3B1mId0Cnc2kLu9bZihaONUXkugfK9Xw5R3CIyKucPWnF N2om7Wd9rDV2hoNdo+9cIJ16ffOjm2uj1BuGq66WnZ6ld68n7faRngQ457g7opzapHKH Ua5s4R12dLDPP/TW604uYX5n4qUAMIqxsseEXUMn9cdJKB1BCO/7dVpIifeagGc4Tp/6 FODg== X-Gm-Message-State: APjAAAVKeD3mj5yG0kKW9Rl9UrGU5DNX0sv5u/0AihuJMiFJVgeyxsoe vfWFY5C88pZpSQfBh70rDDJaww+YBR0= X-Google-Smtp-Source: APXvYqzstXY2BgkUoJRZsSS5VCmgxJJjbvSZ5KZlaui+J/JKfaUDeq/uaSFktLeR6jRAxYbs3O5waA== X-Received: by 2002:a05:620a:16c5:: with SMTP id a5mr67420328qkn.212.1555466928012; Tue, 16 Apr 2019 19:08:48 -0700 (PDT) Received: from [192.168.1.190] (pool-108-15-23-247.bltmmd.fios.verizon.net. [108.15.23.247]) by smtp.gmail.com with ESMTPSA id j93sm29578886qte.42.2019.04.16.19.08.46 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 16 Apr 2019 19:08:47 -0700 (PDT) Subject: Re: [PATCH v3] Add kernel_dgram_send() into logging_send_syslog_msg() To: "Sugar, David" , "selinux-refpolicy@vger.kernel.org" References: <20190415021153.8218-1-dsugar@tresys.com> From: Chris PeBenito Message-ID: <875b03c2-1b37-8c22-3a4d-3a5c647b0c0b@ieee.org> Date: Tue, 16 Apr 2019 22:08:45 -0400 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.3.0 MIME-Version: 1.0 In-Reply-To: <20190415021153.8218-1-dsugar@tresys.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Sender: selinux-refpolicy-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux-refpolicy@vger.kernel.org On 4/14/19 10:12 PM, Sugar, David wrote: > This patch is based on comments from previous a patch to > remove the many uses of kernel_dgram_send() and incorporate > it into logging_send_syslog_msg(). > > v2 - enclose in ifdef for redhat > v3 - rebase this patch on e41def136a9b2246ceba671421caafa893814cdb > > Signed-off-by: Dave Sugar > --- > policy/modules/admin/aide.te | 1 - > policy/modules/admin/usermanage.te | 5 ----- > policy/modules/services/dbus.te | 3 --- > policy/modules/system/authlogin.te | 5 ----- > policy/modules/system/init.if | 2 -- > policy/modules/system/init.te | 3 --- > policy/modules/system/logging.if | 4 ++++ > policy/modules/system/logging.te | 4 ---- > policy/modules/system/systemd.te | 5 ----- > policy/modules/system/udev.te | 1 - > 10 files changed, 4 insertions(+), 29 deletions(-) > > diff --git a/policy/modules/admin/aide.te b/policy/modules/admin/aide.te > index 30deba09..f5e64a86 100644 > --- a/policy/modules/admin/aide.te > +++ b/policy/modules/admin/aide.te > @@ -44,7 +44,6 @@ logging_log_filetrans(aide_t, aide_log_t, file) > files_read_all_files(aide_t) > files_read_all_symlinks(aide_t) > > -kernel_dgram_send(aide_t) > kernel_read_crypto_sysctls(aide_t) > > logging_send_audit_msgs(aide_t) > diff --git a/policy/modules/admin/usermanage.te b/policy/modules/admin/usermanage.te > index 5753741b..4a10bf84 100644 > --- a/policy/modules/admin/usermanage.te > +++ b/policy/modules/admin/usermanage.te > @@ -366,11 +366,6 @@ userdom_read_user_tmp_files(passwd_t) > # on user home dir > userdom_dontaudit_search_user_home_content(passwd_t) > > -ifdef(`init_systemd',` > - # for journald /dev/log > - kernel_dgram_send(passwd_t) > -') > - > optional_policy(` > nscd_run(passwd_t, passwd_roles) > ') > diff --git a/policy/modules/services/dbus.te b/policy/modules/services/dbus.te > index 9c085876..c05370dd 100644 > --- a/policy/modules/services/dbus.te > +++ b/policy/modules/services/dbus.te > @@ -162,9 +162,6 @@ ifdef(`init_systemd', ` > # for /run/systemd/dynamic-uid/ > init_list_pids(system_dbusd_t) > init_read_runtime_symlinks(system_dbusd_t) > - > - # for journald /dev/log > - kernel_dgram_send(system_dbusd_t) > ') > > optional_policy(` > diff --git a/policy/modules/system/authlogin.te b/policy/modules/system/authlogin.te > index 28f74bac..2cf86952 100644 > --- a/policy/modules/system/authlogin.te > +++ b/policy/modules/system/authlogin.te > @@ -144,11 +144,6 @@ ifdef(`distro_ubuntu',` > ') > ') > > -ifdef(`init_systemd',` > - # for journald /dev/log > - kernel_dgram_send(chkpwd_t) > -') > - > optional_policy(` > # apache leaks file descriptors > apache_dontaudit_rw_tcp_sockets(chkpwd_t) > diff --git a/policy/modules/system/init.if b/policy/modules/system/init.if > index fef2c88e..00bd4991 100644 > --- a/policy/modules/system/init.if > +++ b/policy/modules/system/init.if > @@ -306,8 +306,6 @@ interface(`init_daemon_domain',` > > ifdef(`init_systemd',` > init_domain($1, $2) > - # this may be because of late labelling > - kernel_dgram_send($1) > > allow $1 init_t:unix_dgram_socket sendto; > ') > diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te > index a12d151b..3e8eb2da 100644 > --- a/policy/modules/system/init.te > +++ b/policy/modules/system/init.te > @@ -272,7 +272,6 @@ ifdef(`init_systemd',` > > kernel_dyntrans_to(init_t) > kernel_read_network_state(init_t) > - kernel_dgram_send(init_t) > kernel_stream_connect(init_t) > kernel_getattr_proc(init_t) > kernel_read_fs_sysctls(init_t) > @@ -969,8 +968,6 @@ ifdef(`init_systemd',` > allow initrc_t systemdunit:service reload; > allow initrc_t init_script_file_type:service { stop start status reload }; > > - kernel_dgram_send(initrc_t) > - > # run systemd misc initializations > # in the initrc_t domain, as would be > # done in traditional sysvinit/upstart. > diff --git a/policy/modules/system/logging.if b/policy/modules/system/logging.if > index 7b7644f7..e7321d3e 100644 > --- a/policy/modules/system/logging.if > +++ b/policy/modules/system/logging.if > @@ -642,6 +642,10 @@ interface(`logging_send_syslog_msg',` > ifdef(`init_systemd',` > # Allow systemd-journald to check whether the process died > allow syslogd_t $1:process signull; > + > + ifdef(`distro_redhat',` > + kernel_dgram_send($1) > + ') > ') > ') > > diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te > index 0c5be1cd..02f268ea 100644 > --- a/policy/modules/system/logging.te > +++ b/policy/modules/system/logging.te > @@ -271,10 +271,6 @@ miscfiles_read_localization(audisp_t) > > sysnet_dns_name_resolve(audisp_t) > > -ifdef(`init_systemd',` > - kernel_dgram_send(audisp_t) > -') > - > optional_policy(` > dbus_system_bus_client(audisp_t) > ') > diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te > index f6455f6f..cf9241c0 100644 > --- a/policy/modules/system/systemd.te > +++ b/policy/modules/system/systemd.te > @@ -266,7 +266,6 @@ systemd_log_parse_environment(systemd_gpt_generator_t) > allow systemd_cgroups_t self:capability net_admin; > > kernel_domtrans_to(systemd_cgroups_t, systemd_cgroups_exec_t) > -kernel_dgram_send(systemd_cgroups_t) > # for /proc/cmdline > kernel_read_system_state(systemd_cgroups_t) > > @@ -642,7 +641,6 @@ manage_dirs_pattern(systemd_networkd_t, systemd_networkd_var_run_t, systemd_netw > manage_files_pattern(systemd_networkd_t, systemd_networkd_var_run_t, systemd_networkd_var_run_t) > manage_lnk_files_pattern(systemd_networkd_t, systemd_networkd_var_run_t, systemd_networkd_var_run_t) > > -kernel_dgram_send(systemd_networkd_t) > kernel_read_system_state(systemd_networkd_t) > kernel_read_kernel_sysctls(systemd_networkd_t) > kernel_read_network_state(systemd_networkd_t) > @@ -667,8 +665,6 @@ auth_use_nsswitch(systemd_networkd_t) > init_dgram_send(systemd_networkd_t) > init_read_state(systemd_networkd_t) > > -logging_send_syslog_msg(systemd_networkd_t) > - > miscfiles_read_localization(systemd_networkd_t) > > sysnet_read_config(systemd_networkd_t) > @@ -945,7 +941,6 @@ init_pid_filetrans(systemd_resolved_t, systemd_resolved_var_run_t, dir) > > dev_read_sysfs(systemd_resolved_t) > > -kernel_dgram_send(systemd_resolved_t) > kernel_read_crypto_sysctls(systemd_resolved_t) > kernel_read_kernel_sysctls(systemd_resolved_t) > kernel_read_net_sysctls(systemd_resolved_t) > diff --git a/policy/modules/system/udev.te b/policy/modules/system/udev.te > index ff564280..f00de30d 100644 > --- a/policy/modules/system/udev.te > +++ b/policy/modules/system/udev.te > @@ -99,7 +99,6 @@ kernel_read_modprobe_sysctls(udev_t) > kernel_read_kernel_sysctls(udev_t) > kernel_rw_hotplug_sysctls(udev_t) > kernel_rw_unix_dgram_sockets(udev_t) > -kernel_dgram_send(udev_t) > kernel_signal(udev_t) > kernel_search_debugfs(udev_t) > kernel_search_key(udev_t) Merged. -- Chris PeBenito