* [PATCH] more tiny stuff
@ 2019-01-19 12:04 Russell Coker
2019-01-19 12:14 ` Dominick Grift
2019-01-20 21:22 ` Chris PeBenito
0 siblings, 2 replies; 3+ messages in thread
From: Russell Coker @ 2019-01-19 12:04 UTC (permalink / raw)
To: selinux-refpolicy
I think the old timesync labelling wasn't working anyway due to -- for a
directory name.
A couple of patches for devicekit calling dmidecode (this is part of replacing
some kmem access that was discussed on this list and rejected as a misfeature
in Debian DMI related code ages ago).
The rest should be obvious.
Index: refpolicy-2.20180701/policy/modules/services/ntp.fc
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/ntp.fc
+++ refpolicy-2.20180701/policy/modules/services/ntp.fc
@@ -32,7 +32,7 @@
/var/lib/ntp(/.*)? gen_context(system_u:object_r:ntp_drift_t,s0)
/var/lib/sntp-kod(/.*)? gen_context(system_u:object_r:ntp_drift_t,s0)
/var/lib/systemd/clock -- gen_context(system_u:object_r:ntp_drift_t,s0)
-/var/lib/private/systemd/timesync(/.*)? -- gen_context(system_u:object_r:ntp_drift_t,s0)
+/var/lib/systemd/timesync(/.*)? gen_context(system_u:object_r:ntp_drift_t,s0)
/var/lock/ntpdate -- gen_context(system_u:object_r:ntpd_lock_t,s0)
Index: refpolicy-2.20180701/policy/modules/admin/dmidecode.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/admin/dmidecode.te
+++ refpolicy-2.20180701/policy/modules/admin/dmidecode.te
@@ -32,3 +32,9 @@ mls_file_read_all_levels(dmidecode_t)
locallogin_use_fds(dmidecode_t)
userdom_use_inherited_user_terminals(dmidecode_t)
+
+ifdef(`init_systemd',`
+ # inherits /dev/null and a socket from devicekit_disk_t
+ init_use_fds(dmidecode_t)
+ init_rw_inherited_stream_socket(dmidecode_t)
+')
Index: refpolicy-2.20180701/policy/modules/services/devicekit.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/devicekit.te
+++ refpolicy-2.20180701/policy/modules/services/devicekit.te
@@ -177,6 +177,10 @@ optional_policy(`
')
optional_policy(`
+ dmidecode_domtrans(devicekit_disk_t)
+')
+
+optional_policy(`
fstools_domtrans(devicekit_disk_t)
')
Index: refpolicy-2.20180701/policy/modules/services/xserver.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/xserver.te
+++ refpolicy-2.20180701/policy/modules/services/xserver.te
@@ -291,6 +291,8 @@ kernel_request_load_module(xauth_t)
domain_use_interactive_fds(xauth_t)
+dev_read_sysfs(xauth_t)
+
files_read_etc_files(xauth_t)
files_search_pids(xauth_t)
Index: refpolicy-2.20180701/policy/modules/system/unconfined.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/system/unconfined.te
+++ refpolicy-2.20180701/policy/modules/system/unconfined.te
@@ -59,6 +59,9 @@ ifdef(`direct_sysadm_daemon',`
')
ifdef(`init_systemd',`
+ # for systemd-analyze
+ init_service_status(unconfined_t)
+
optional_policy(`
systemd_dbus_chat_resolved(unconfined_t)
')
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] more tiny stuff
2019-01-19 12:04 [PATCH] more tiny stuff Russell Coker
@ 2019-01-19 12:14 ` Dominick Grift
2019-01-20 21:22 ` Chris PeBenito
1 sibling, 0 replies; 3+ messages in thread
From: Dominick Grift @ 2019-01-19 12:14 UTC (permalink / raw)
To: Russell Coker; +Cc: selinux-refpolicy
Russell Coker <russell@coker.com.au> writes:
> I think the old timesync labelling wasn't working anyway due to -- for a
> directory name.
>
> A couple of patches for devicekit calling dmidecode (this is part of replacing
> some kmem access that was discussed on this list and rejected as a misfeature
> in Debian DMI related code ages ago).
>
> The rest should be obvious.
>
> Index: refpolicy-2.20180701/policy/modules/services/ntp.fc
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/services/ntp.fc
> +++ refpolicy-2.20180701/policy/modules/services/ntp.fc
> @@ -32,7 +32,7 @@
> /var/lib/ntp(/.*)? gen_context(system_u:object_r:ntp_drift_t,s0)
> /var/lib/sntp-kod(/.*)? gen_context(system_u:object_r:ntp_drift_t,s0)
> /var/lib/systemd/clock -- gen_context(system_u:object_r:ntp_drift_t,s0)
> -/var/lib/private/systemd/timesync(/.*)? -- gen_context(system_u:object_r:ntp_drift_t,s0)
> +/var/lib/systemd/timesync(/.*)? gen_context(system_u:object_r:ntp_drift_t,s0)
Yes that and systemd-timesync no longer uses DynamicUser= and so
/var/lib/private no longer applies
Also refpolicy should consider making /var/{lib/private,cache/private,log/private} equivalent to
/var/lib, /var/cache and /var/log respectively
>
> /var/lock/ntpdate -- gen_context(system_u:object_r:ntpd_lock_t,s0)
>
> Index: refpolicy-2.20180701/policy/modules/admin/dmidecode.te
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/admin/dmidecode.te
> +++ refpolicy-2.20180701/policy/modules/admin/dmidecode.te
> @@ -32,3 +32,9 @@ mls_file_read_all_levels(dmidecode_t)
> locallogin_use_fds(dmidecode_t)
>
> userdom_use_inherited_user_terminals(dmidecode_t)
> +
> +ifdef(`init_systemd',`
> + # inherits /dev/null and a socket from devicekit_disk_t
> + init_use_fds(dmidecode_t)
> + init_rw_inherited_stream_socket(dmidecode_t)
> +')
> Index: refpolicy-2.20180701/policy/modules/services/devicekit.te
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/services/devicekit.te
> +++ refpolicy-2.20180701/policy/modules/services/devicekit.te
> @@ -177,6 +177,10 @@ optional_policy(`
> ')
>
> optional_policy(`
> + dmidecode_domtrans(devicekit_disk_t)
> +')
> +
> +optional_policy(`
> fstools_domtrans(devicekit_disk_t)
> ')
>
> Index: refpolicy-2.20180701/policy/modules/services/xserver.te
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/services/xserver.te
> +++ refpolicy-2.20180701/policy/modules/services/xserver.te
> @@ -291,6 +291,8 @@ kernel_request_load_module(xauth_t)
>
> domain_use_interactive_fds(xauth_t)
>
> +dev_read_sysfs(xauth_t)
> +
> files_read_etc_files(xauth_t)
> files_search_pids(xauth_t)
>
> Index: refpolicy-2.20180701/policy/modules/system/unconfined.te
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/system/unconfined.te
> +++ refpolicy-2.20180701/policy/modules/system/unconfined.te
> @@ -59,6 +59,9 @@ ifdef(`direct_sysadm_daemon',`
> ')
>
> ifdef(`init_systemd',`
> + # for systemd-analyze
> + init_service_status(unconfined_t)
> +
> optional_policy(`
> systemd_dbus_chat_resolved(unconfined_t)
> ')
--
Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02
Dominick Grift
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] more tiny stuff
2019-01-19 12:04 [PATCH] more tiny stuff Russell Coker
2019-01-19 12:14 ` Dominick Grift
@ 2019-01-20 21:22 ` Chris PeBenito
1 sibling, 0 replies; 3+ messages in thread
From: Chris PeBenito @ 2019-01-20 21:22 UTC (permalink / raw)
To: Russell Coker, selinux-refpolicy
On 1/19/19 7:04 AM, Russell Coker wrote:
> I think the old timesync labelling wasn't working anyway due to -- for a
> directory name.
>
> A couple of patches for devicekit calling dmidecode (this is part of replacing
> some kmem access that was discussed on this list and rejected as a misfeature
> in Debian DMI related code ages ago).
>
> The rest should be obvious.
>
> Index: refpolicy-2.20180701/policy/modules/services/ntp.fc
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/services/ntp.fc
> +++ refpolicy-2.20180701/policy/modules/services/ntp.fc
> @@ -32,7 +32,7 @@
> /var/lib/ntp(/.*)? gen_context(system_u:object_r:ntp_drift_t,s0)
> /var/lib/sntp-kod(/.*)? gen_context(system_u:object_r:ntp_drift_t,s0)
> /var/lib/systemd/clock -- gen_context(system_u:object_r:ntp_drift_t,s0)
> -/var/lib/private/systemd/timesync(/.*)? -- gen_context(system_u:object_r:ntp_drift_t,s0)
> +/var/lib/systemd/timesync(/.*)? gen_context(system_u:object_r:ntp_drift_t,s0)
>
> /var/lock/ntpdate -- gen_context(system_u:object_r:ntpd_lock_t,s0)
>
> Index: refpolicy-2.20180701/policy/modules/admin/dmidecode.te
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/admin/dmidecode.te
> +++ refpolicy-2.20180701/policy/modules/admin/dmidecode.te
> @@ -32,3 +32,9 @@ mls_file_read_all_levels(dmidecode_t)
> locallogin_use_fds(dmidecode_t)
>
> userdom_use_inherited_user_terminals(dmidecode_t)
> +
> +ifdef(`init_systemd',`
> + # inherits /dev/null and a socket from devicekit_disk_t
> + init_use_fds(dmidecode_t)
> + init_rw_inherited_stream_socket(dmidecode_t)
> +')
> Index: refpolicy-2.20180701/policy/modules/services/devicekit.te
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/services/devicekit.te
> +++ refpolicy-2.20180701/policy/modules/services/devicekit.te
> @@ -177,6 +177,10 @@ optional_policy(`
> ')
>
> optional_policy(`
> + dmidecode_domtrans(devicekit_disk_t)
> +')
> +
> +optional_policy(`
> fstools_domtrans(devicekit_disk_t)
> ')
>
> Index: refpolicy-2.20180701/policy/modules/services/xserver.te
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/services/xserver.te
> +++ refpolicy-2.20180701/policy/modules/services/xserver.te
> @@ -291,6 +291,8 @@ kernel_request_load_module(xauth_t)
>
> domain_use_interactive_fds(xauth_t)
>
> +dev_read_sysfs(xauth_t)
> +
> files_read_etc_files(xauth_t)
> files_search_pids(xauth_t)
>
> Index: refpolicy-2.20180701/policy/modules/system/unconfined.te
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/system/unconfined.te
> +++ refpolicy-2.20180701/policy/modules/system/unconfined.te
> @@ -59,6 +59,9 @@ ifdef(`direct_sysadm_daemon',`
> ')
>
> ifdef(`init_systemd',`
> + # for systemd-analyze
> + init_service_status(unconfined_t)
> +
> optional_policy(`
> systemd_dbus_chat_resolved(unconfined_t)
> ')
Merged.
--
Chris PeBenito
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2019-01-21 8:40 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-01-19 12:04 [PATCH] more tiny stuff Russell Coker
2019-01-19 12:14 ` Dominick Grift
2019-01-20 21:22 ` Chris PeBenito
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).