From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.5 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E0206C43387 for ; Sat, 5 Jan 2019 19:39:29 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id A3E8E222FE for ; Sat, 5 Jan 2019 19:39:29 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=ieee.org header.i=@ieee.org header.b="WX7Wr0I/" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726282AbfAETj3 (ORCPT ); Sat, 5 Jan 2019 14:39:29 -0500 Received: from mail-qt1-f193.google.com ([209.85.160.193]:44303 "EHLO mail-qt1-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726262AbfAETj3 (ORCPT ); Sat, 5 Jan 2019 14:39:29 -0500 Received: by mail-qt1-f193.google.com with SMTP id n32so43796887qte.11 for ; Sat, 05 Jan 2019 11:39:28 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ieee.org; s=google; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-language:content-transfer-encoding; bh=5d8dsT46t48B0OJDwXc9Lrv7ow8xufIORCo/YVWbMLg=; b=WX7Wr0I/KRZO2TJvIoalvqAkS0vZH1SB+LHF8gpaUWqPmU5hJd9TvTHxDvReqZ9Xbe 5YsO/OShqEVcW2LzKk+9WBrXTIPtqqvCWTI9UocA3Hs2xmtvd/2IzAruQBZjgz5+loDg 2ADtL9YteksVCasrj5nHDhraVbwjyctJF94/Q= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=5d8dsT46t48B0OJDwXc9Lrv7ow8xufIORCo/YVWbMLg=; b=r0HwIeljMrxkP+8xkJaKAYg0qlpuzH6b1Yrc7kccmRgedde85u8B06WW2RegAuxm2q OKnVa6m9ltSAOP8m3GofmRcdBifPdztN0CJEa7NazkZsl8G59nDfsmQbhYUo0qCJXnOP IyNRD1JbzJy097ycNjkEvbr0zb+OPpdHTssWJ/6M2ZMV4j/yWtO81ApksWbeQjse755L Ee5LN77xwV0cxNea4wGxUE7ftJ+Qs7TYzXn7zPxBeU5/SLeb/gwNQbwgdOsLcvHSumTS a5RvJJdkF/KOgkchltO+f44Zc28H+PzzhH5HqCHes4dt5L7/wk8LBtMvxBIMXGP9LEmD HAGA== X-Gm-Message-State: AA+aEWZHyaIsHgb+6qt6RdbfY9nCCo8z65Nqsv1zczryIZAbXvZSX2U5 8Ek9pUlQdMGlaWyhDW867vK2qF0NSII= X-Google-Smtp-Source: AFSGD/XHntV24CQ1cn8zUqG/WiIt74RMZ2sKcx/4y6zOwge80K1H9pPa2l73x3LEi9kftO5hl8+nNQ== X-Received: by 2002:ac8:674b:: with SMTP id n11mr53507022qtp.104.1546717167602; Sat, 05 Jan 2019 11:39:27 -0800 (PST) Received: from [192.168.1.190] (pool-108-15-23-247.bltmmd.fios.verizon.net. [108.15.23.247]) by smtp.gmail.com with ESMTPSA id d50sm34407067qta.31.2019.01.05.11.39.27 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sat, 05 Jan 2019 11:39:27 -0800 (PST) Subject: Re: [PATCH] systemd related interfaces To: Russell Coker , selinux-refpolicy@vger.kernel.org References: <20190104075118.GA11721@aaa.coker.com.au> From: Chris PeBenito Message-ID: <9821c420-35c9-9901-d666-7e23242f9a6e@ieee.org> Date: Sat, 5 Jan 2019 14:18:51 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.3.0 MIME-Version: 1.0 In-Reply-To: <20190104075118.GA11721@aaa.coker.com.au> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Sender: selinux-refpolicy-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux-refpolicy@vger.kernel.org On 1/4/19 2:51 AM, Russell Coker wrote: > This patch has interface changes related to systemd support as well as policy > that uses the new interfaces. > > Index: refpolicy-2.20180701/policy/modules/admin/sudo.if > =================================================================== > --- refpolicy-2.20180701.orig/policy/modules/admin/sudo.if > +++ refpolicy-2.20180701/policy/modules/admin/sudo.if > @@ -154,6 +154,9 @@ template(`sudo_role_template',` > > optional_policy(` > dbus_system_bus_client($1_sudo_t) > + ifdef(`init_systemd',` > + init_dbus_chat($1_sudo_t) > + ') > ') > > optional_policy(` > Index: refpolicy-2.20180701/policy/modules/services/dbus.if > =================================================================== > --- refpolicy-2.20180701.orig/policy/modules/services/dbus.if > +++ refpolicy-2.20180701/policy/modules/services/dbus.if > @@ -318,6 +318,25 @@ interface(`dbus_read_lib_files',` > > ######################################## > ## > +## Relabel system dbus lib directory. > +## > +## > +## > +## Domain allowed access. > +## > +## > +# > +interface(`dbus_relabel_lib_dirs',` > + gen_require(` > + type system_dbusd_var_lib_t; > + ') > + > + files_search_var_lib($1) > + allow $1 system_dbusd_var_lib_t:dir { relabelfrom relabelto }; > +') > + > +######################################## > +## > ## Create, read, write, and delete > ## system dbus lib files. > ## > Index: refpolicy-2.20180701/policy/modules/system/init.if > =================================================================== > --- refpolicy-2.20180701.orig/policy/modules/system/init.if > +++ refpolicy-2.20180701/policy/modules/system/init.if > @@ -1134,6 +1134,25 @@ interface(`init_dbus_chat',` > > ######################################## > ## > +## read/follow symlinks under /var/lib/systemd/ > +## > +## > +## > +## Domain allowed access. > +## > +## > +# > +interface(`init_read_var_lib_links',` > + gen_require(` > + type init_var_lib_t; > + ') > + > + allow $1 init_var_lib_t:dir list_dir_perms; > + allow $1 init_var_lib_t:lnk_file read_lnk_file_perms; > +') > + > +######################################## > +## > ## List /var/lib/systemd/ dir > ## > ## > @@ -1304,23 +1323,13 @@ interface(`init_pid_filetrans',` > ## > # > interface(`init_getattr_initctl',` > - ifdef(`init_systemd',` > - # stat /run/systemd/initctl/fifo > - gen_require(` > - type init_var_run_t; > - ') > - > - allow $1 init_var_run_t:fifo_file getattr; > - allow $1 init_var_run_t:dir list_dir_perms; > - ',` > - gen_require(` > - type initctl_t; > - ') > - > - dev_list_all_dev_nodes($1) > - files_search_pids($1) > - allow $1 initctl_t:fifo_file getattr; > + gen_require(` > + type initctl_t; > ') > + > + files_search_pids($1) > + dev_list_all_dev_nodes($1) > + allow $1 initctl_t:fifo_file getattr; > ') > > ######################################## > @@ -1859,6 +1868,25 @@ interface(`init_ptrace',` > > ######################################## > ## > +## get init process stats > +## > +## > +## > +## Domain allowed access. > +## > +## > +## > +# > +interface(`init_getattr',` > + gen_require(` > + type init_t; > + ') > + > + allow $1 init_t:process getattr; > +') > + > +######################################## > +## > ## Write an init script unnamed pipe. > ## > ## > @@ -2822,6 +2850,25 @@ interface(`init_search_units',` > fs_search_tmpfs($1) > ') > > +###################################### > +## > +## read systemd unit lnk files (usually under /run/systemd/units/) > +## > +## > +## > +## Domain allowed access. > +## > +## > +# > +interface(`init_read_unit_links',` > + gen_require(` > + type init_var_run_t, systemd_unit_t; > + ') > + > + search_dirs_pattern($1, init_var_run_t, systemd_unit_t) > + allow $1 init_var_run_t:lnk_file read_lnk_file_perms; > +') > + > ######################################## > ## > ## Get status of generic systemd units. > @@ -3030,3 +3077,21 @@ interface(`init_admin',` > init_stop_system($1) > init_telinit($1) > ') > + > +######################################## > +## > +## Allow getting init_t rlimit > +## > +## > +## > +## Source domain > +## > +## > +# > +interface(`init_getrlimit',` > + gen_require(` > + type init_t; > + ') > + > + allow $1 init_t:process getrlimit; > +') > Index: refpolicy-2.20180701/policy/modules/system/systemd.if > =================================================================== > --- refpolicy-2.20180701.orig/policy/modules/system/systemd.if > +++ refpolicy-2.20180701/policy/modules/system/systemd.if > @@ -307,6 +307,8 @@ interface(`systemd_use_passwd_agent',` > manage_sock_files_pattern($1, systemd_passwd_var_run_t, systemd_passwd_var_run_t) > > allow systemd_passwd_agent_t $1:process signull; > + allow systemd_passwd_agent_t $1:dir search; > + allow systemd_passwd_agent_t $1:file read_file_perms; I'd rather see something like ps_process_pattern(). Otherwise merged. > allow systemd_passwd_agent_t $1:unix_dgram_socket sendto; > ') > > @@ -828,3 +830,22 @@ interface(`systemd_getattr_updated_runti > > getattr_files_pattern($1, systemd_update_run_t, systemd_update_run_t) > ') > + > +####################################### > +## > +## Allow domain to list dirs under /run/systemd/netif > +## > +## > +## > +## domain permitted the access > +## > +## > +# > +interface(`systemd_list_netif',` > + gen_require(` > + type systemd_networkd_var_run_t; > + ') > + > + init_list_pids($1) > + allow $1 systemd_networkd_var_run_t:dir list_dir_perms; > +') > Index: refpolicy-2.20180701/policy/modules/services/ntp.te > =================================================================== > --- refpolicy-2.20180701.orig/policy/modules/services/ntp.te > +++ refpolicy-2.20180701/policy/modules/services/ntp.te > @@ -142,6 +142,8 @@ ifdef(`init_systemd',` > dbus_connect_system_bus(ntpd_t) > init_dbus_chat(ntpd_t) > init_get_system_status(ntpd_t) > + # for /var/lib/systemd/timesync > + init_read_var_lib_links(ntpd_t) > allow ntpd_t self:capability { fowner setpcap }; > init_read_state(ntpd_t) > init_reload(ntpd_t) > @@ -150,7 +152,7 @@ ifdef(`init_systemd',` > init_list_var_lib_dirs(ntpd_t) > > # for /run/systemd/netif/links > - init_list_pids(ntpd_t) > + systemd_list_netif(ntpd_t) > > optional_policy(` > unconfined_dbus_send(ntpd_t) > Index: refpolicy-2.20180701/policy/modules/system/systemd.te > =================================================================== > --- refpolicy-2.20180701.orig/policy/modules/system/systemd.te > +++ refpolicy-2.20180701/policy/modules/system/systemd.te > @@ -736,6 +736,7 @@ term_setattr_generic_ptys(systemd_nspawn > term_use_ptmx(systemd_nspawn_t) > > init_domtrans_script(systemd_nspawn_t) > +init_getrlimit(systemd_nspawn_t) > init_kill_scripts(systemd_nspawn_t) > init_read_state(systemd_nspawn_t) > init_search_run(systemd_nspawn_t) > @@ -1027,6 +1028,7 @@ tunable_policy(`systemd_tmpfiles_manage_ > > optional_policy(` > dbus_read_lib_files(systemd_tmpfiles_t) > + dbus_relabel_lib_dirs(systemd_tmpfiles_t) > ') > > optional_policy(` > Index: refpolicy-2.20180701/policy/modules/system/logging.te > =================================================================== > --- refpolicy-2.20180701.orig/policy/modules/system/logging.te > +++ refpolicy-2.20180701/policy/modules/system/logging.te > @@ -541,15 +541,19 @@ ifdef(`init_systemd',` > dev_read_urand(syslogd_t) > dev_write_kmsg(syslogd_t) > > + domain_getattr_all_domains(syslogd_t) > domain_read_all_domains_state(syslogd_t) > > init_create_pid_dirs(syslogd_t) > init_daemon_pid_file(syslogd_var_run_t, dir, "syslogd") > + init_getattr(syslogd_t) > init_rename_pid_files(syslogd_t) > init_delete_pid_files(syslogd_t) > init_dgram_send(syslogd_t) > init_read_pid_pipes(syslogd_t) > init_read_state(syslogd_t) > + # for /run/systemd/units/invocation:* links > + init_read_unit_links(syslogd_t) > > systemd_manage_journal_files(syslogd_t) > > -- Chris PeBenito