selinux-refpolicy.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH] systemd related interfaces
@ 2019-01-04  7:51 Russell Coker
  2019-01-05 19:18 ` Chris PeBenito
  0 siblings, 1 reply; 8+ messages in thread
From: Russell Coker @ 2019-01-04  7:51 UTC (permalink / raw)
  To: selinux-refpolicy

This patch has interface changes related to systemd support as well as policy
that uses the new interfaces.

Index: refpolicy-2.20180701/policy/modules/admin/sudo.if
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/admin/sudo.if
+++ refpolicy-2.20180701/policy/modules/admin/sudo.if
@@ -154,6 +154,9 @@ template(`sudo_role_template',`
 
 	optional_policy(`
 		dbus_system_bus_client($1_sudo_t)
+		ifdef(`init_systemd',`
+			init_dbus_chat($1_sudo_t)
+		')
 	')
 
 	optional_policy(`
Index: refpolicy-2.20180701/policy/modules/services/dbus.if
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/dbus.if
+++ refpolicy-2.20180701/policy/modules/services/dbus.if
@@ -318,6 +318,25 @@ interface(`dbus_read_lib_files',`
 
 ########################################
 ## <summary>
+##	Relabel system dbus lib directory.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`dbus_relabel_lib_dirs',`
+	gen_require(`
+		type system_dbusd_var_lib_t;
+	')
+
+	files_search_var_lib($1)
+	allow $1 system_dbusd_var_lib_t:dir { relabelfrom relabelto };
+')
+
+########################################
+## <summary>
 ##	Create, read, write, and delete
 ##	system dbus lib files.
 ## </summary>
Index: refpolicy-2.20180701/policy/modules/system/init.if
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/system/init.if
+++ refpolicy-2.20180701/policy/modules/system/init.if
@@ -1134,6 +1134,25 @@ interface(`init_dbus_chat',`
 
 ########################################
 ## <summary>
+##      read/follow symlinks under /var/lib/systemd/
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`init_read_var_lib_links',`
+	gen_require(`
+		type init_var_lib_t;
+	')
+
+	allow $1 init_var_lib_t:dir list_dir_perms;
+	allow $1 init_var_lib_t:lnk_file read_lnk_file_perms;
+')
+
+########################################
+## <summary>
 ##      List /var/lib/systemd/ dir
 ## </summary>
 ## <param name="domain">
@@ -1304,23 +1323,13 @@ interface(`init_pid_filetrans',`
 ## </param>
 #
 interface(`init_getattr_initctl',`
-	ifdef(`init_systemd',`
-		# stat /run/systemd/initctl/fifo
-		gen_require(`
-			type init_var_run_t;
-		')
-
-		allow $1 init_var_run_t:fifo_file getattr;
-		allow $1 init_var_run_t:dir list_dir_perms;
-	',`
-		gen_require(`
-			type initctl_t;
-		')
-
-		dev_list_all_dev_nodes($1)
-		files_search_pids($1)
-		allow $1 initctl_t:fifo_file getattr;
+	gen_require(`
+		type initctl_t;
 	')
+
+	files_search_pids($1)
+	dev_list_all_dev_nodes($1)
+	allow $1 initctl_t:fifo_file getattr;
 ')
 
 ########################################
@@ -1859,6 +1868,25 @@ interface(`init_ptrace',`
 
 ########################################
 ## <summary>
+##	get init process stats
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`init_getattr',`
+	gen_require(`
+		type init_t;
+	')
+
+	allow $1 init_t:process getattr;
+')
+
+########################################
+## <summary>
 ##	Write an init script unnamed pipe.
 ## </summary>
 ## <param name="domain">
@@ -2822,6 +2850,25 @@ interface(`init_search_units',`
 	fs_search_tmpfs($1)
 ')
 
+######################################
+## <summary>
+##	read systemd unit lnk files (usually under /run/systemd/units/)
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`init_read_unit_links',`
+	gen_require(`
+		type init_var_run_t, systemd_unit_t;
+	')
+
+	search_dirs_pattern($1, init_var_run_t, systemd_unit_t)
+	allow $1 init_var_run_t:lnk_file read_lnk_file_perms;
+')
+
 ########################################
 ## <summary>
 ##	Get status of generic systemd units.
@@ -3030,3 +3077,21 @@ interface(`init_admin',`
 	init_stop_system($1)
 	init_telinit($1)
 ')
+
+########################################
+## <summary>
+##      Allow getting init_t rlimit
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Source domain
+##      </summary>
+## </param>
+#
+interface(`init_getrlimit',`
+	gen_require(`
+		type init_t;
+	')
+
+	allow $1 init_t:process getrlimit;
+')
Index: refpolicy-2.20180701/policy/modules/system/systemd.if
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/system/systemd.if
+++ refpolicy-2.20180701/policy/modules/system/systemd.if
@@ -307,6 +307,8 @@ interface(`systemd_use_passwd_agent',`
 	manage_sock_files_pattern($1, systemd_passwd_var_run_t, systemd_passwd_var_run_t)
 
 	allow systemd_passwd_agent_t $1:process signull;
+	allow systemd_passwd_agent_t $1:dir search;
+	allow systemd_passwd_agent_t $1:file read_file_perms;
 	allow systemd_passwd_agent_t $1:unix_dgram_socket sendto;
 ')
 
@@ -828,3 +830,22 @@ interface(`systemd_getattr_updated_runti
 
 	getattr_files_pattern($1, systemd_update_run_t, systemd_update_run_t)
 ')
+
+#######################################
+## <summary>
+##  Allow domain to list dirs under /run/systemd/netif
+## </summary>
+## <param name="domain">
+## <summary>
+##  domain permitted the access
+## </summary>
+## </param>
+#
+interface(`systemd_list_netif',`
+	gen_require(`
+		type systemd_networkd_var_run_t;
+	')
+
+	init_list_pids($1)
+	allow $1 systemd_networkd_var_run_t:dir list_dir_perms;
+')
Index: refpolicy-2.20180701/policy/modules/services/ntp.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/ntp.te
+++ refpolicy-2.20180701/policy/modules/services/ntp.te
@@ -142,6 +142,8 @@ ifdef(`init_systemd',`
 	dbus_connect_system_bus(ntpd_t)
 	init_dbus_chat(ntpd_t)
 	init_get_system_status(ntpd_t)
+	# for /var/lib/systemd/timesync
+	init_read_var_lib_links(ntpd_t)
 	allow ntpd_t self:capability { fowner setpcap };
 	init_read_state(ntpd_t)
 	init_reload(ntpd_t)
@@ -150,7 +152,7 @@ ifdef(`init_systemd',`
 	init_list_var_lib_dirs(ntpd_t)
 
 	# for /run/systemd/netif/links
-	init_list_pids(ntpd_t)
+	systemd_list_netif(ntpd_t)
 
 	optional_policy(`
 		unconfined_dbus_send(ntpd_t)
Index: refpolicy-2.20180701/policy/modules/system/systemd.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/system/systemd.te
+++ refpolicy-2.20180701/policy/modules/system/systemd.te
@@ -736,6 +736,7 @@ term_setattr_generic_ptys(systemd_nspawn
 term_use_ptmx(systemd_nspawn_t)
 
 init_domtrans_script(systemd_nspawn_t)
+init_getrlimit(systemd_nspawn_t)
 init_kill_scripts(systemd_nspawn_t)
 init_read_state(systemd_nspawn_t)
 init_search_run(systemd_nspawn_t)
@@ -1027,6 +1028,7 @@ tunable_policy(`systemd_tmpfiles_manage_
 
 optional_policy(`
 	dbus_read_lib_files(systemd_tmpfiles_t)
+	dbus_relabel_lib_dirs(systemd_tmpfiles_t)
 ')
 
 optional_policy(`
Index: refpolicy-2.20180701/policy/modules/system/logging.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/system/logging.te
+++ refpolicy-2.20180701/policy/modules/system/logging.te
@@ -541,15 +541,19 @@ ifdef(`init_systemd',`
 	dev_read_urand(syslogd_t)
 	dev_write_kmsg(syslogd_t)
 
+	domain_getattr_all_domains(syslogd_t)
 	domain_read_all_domains_state(syslogd_t)
 
 	init_create_pid_dirs(syslogd_t)
 	init_daemon_pid_file(syslogd_var_run_t, dir, "syslogd")
+	init_getattr(syslogd_t)
 	init_rename_pid_files(syslogd_t)
 	init_delete_pid_files(syslogd_t)
 	init_dgram_send(syslogd_t)
 	init_read_pid_pipes(syslogd_t)
 	init_read_state(syslogd_t)
+	# for /run/systemd/units/invocation:* links
+	init_read_unit_links(syslogd_t)
 
 	systemd_manage_journal_files(syslogd_t)
 

^ permalink raw reply	[flat|nested] 8+ messages in thread
* Re: [PATCH] systemd related interfaces
  2019-01-04  7:51 [PATCH] systemd related interfaces Russell Coker
@ 2019-01-05 19:18 ` Chris PeBenito
  2019-01-05 21:39   ` Nicolas Iooss
  0 siblings, 1 reply; 8+ messages in thread
From: Chris PeBenito @ 2019-01-05 19:18 UTC (permalink / raw)
  To: Russell Coker, selinux-refpolicy

On 1/4/19 2:51 AM, Russell Coker wrote:
> This patch has interface changes related to systemd support as well as policy
> that uses the new interfaces.
> 
> Index: refpolicy-2.20180701/policy/modules/admin/sudo.if
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/admin/sudo.if
> +++ refpolicy-2.20180701/policy/modules/admin/sudo.if
> @@ -154,6 +154,9 @@ template(`sudo_role_template',`
>   
>   	optional_policy(`
>   		dbus_system_bus_client($1_sudo_t)
> +		ifdef(`init_systemd',`
> +			init_dbus_chat($1_sudo_t)
> +		')
>   	')
>   
>   	optional_policy(`
> Index: refpolicy-2.20180701/policy/modules/services/dbus.if
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/services/dbus.if
> +++ refpolicy-2.20180701/policy/modules/services/dbus.if
> @@ -318,6 +318,25 @@ interface(`dbus_read_lib_files',`
>   
>   ########################################
>   ## <summary>
> +##	Relabel system dbus lib directory.
> +## </summary>
> +## <param name="domain">
> +##	<summary>
> +##	Domain allowed access.
> +##	</summary>
> +## </param>
> +#
> +interface(`dbus_relabel_lib_dirs',`
> +	gen_require(`
> +		type system_dbusd_var_lib_t;
> +	')
> +
> +	files_search_var_lib($1)
> +	allow $1 system_dbusd_var_lib_t:dir { relabelfrom relabelto };
> +')
> +
> +########################################
> +## <summary>
>   ##	Create, read, write, and delete
>   ##	system dbus lib files.
>   ## </summary>
> Index: refpolicy-2.20180701/policy/modules/system/init.if
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/system/init.if
> +++ refpolicy-2.20180701/policy/modules/system/init.if
> @@ -1134,6 +1134,25 @@ interface(`init_dbus_chat',`
>   
>   ########################################
>   ## <summary>
> +##      read/follow symlinks under /var/lib/systemd/
> +## </summary>
> +## <param name="domain">
> +##      <summary>
> +##      Domain allowed access.
> +##      </summary>
> +## </param>
> +#
> +interface(`init_read_var_lib_links',`
> +	gen_require(`
> +		type init_var_lib_t;
> +	')
> +
> +	allow $1 init_var_lib_t:dir list_dir_perms;
> +	allow $1 init_var_lib_t:lnk_file read_lnk_file_perms;
> +')
> +
> +########################################
> +## <summary>
>   ##      List /var/lib/systemd/ dir
>   ## </summary>
>   ## <param name="domain">
> @@ -1304,23 +1323,13 @@ interface(`init_pid_filetrans',`
>   ## </param>
>   #
>   interface(`init_getattr_initctl',`
> -	ifdef(`init_systemd',`
> -		# stat /run/systemd/initctl/fifo
> -		gen_require(`
> -			type init_var_run_t;
> -		')
> -
> -		allow $1 init_var_run_t:fifo_file getattr;
> -		allow $1 init_var_run_t:dir list_dir_perms;
> -	',`
> -		gen_require(`
> -			type initctl_t;
> -		')
> -
> -		dev_list_all_dev_nodes($1)
> -		files_search_pids($1)
> -		allow $1 initctl_t:fifo_file getattr;
> +	gen_require(`
> +		type initctl_t;
>   	')
> +
> +	files_search_pids($1)
> +	dev_list_all_dev_nodes($1)
> +	allow $1 initctl_t:fifo_file getattr;
>   ')
>   
>   ########################################
> @@ -1859,6 +1868,25 @@ interface(`init_ptrace',`
>   
>   ########################################
>   ## <summary>
> +##	get init process stats
> +## </summary>
> +## <param name="domain">
> +##	<summary>
> +##	Domain allowed access.
> +##	</summary>
> +## </param>
> +## <rolecap/>
> +#
> +interface(`init_getattr',`
> +	gen_require(`
> +		type init_t;
> +	')
> +
> +	allow $1 init_t:process getattr;
> +')
> +
> +########################################
> +## <summary>
>   ##	Write an init script unnamed pipe.
>   ## </summary>
>   ## <param name="domain">
> @@ -2822,6 +2850,25 @@ interface(`init_search_units',`
>   	fs_search_tmpfs($1)
>   ')
>   
> +######################################
> +## <summary>
> +##	read systemd unit lnk files (usually under /run/systemd/units/)
> +## </summary>
> +## <param name="domain">
> +##	<summary>
> +##	Domain allowed access.
> +##	</summary>
> +## </param>
> +#
> +interface(`init_read_unit_links',`
> +	gen_require(`
> +		type init_var_run_t, systemd_unit_t;
> +	')
> +
> +	search_dirs_pattern($1, init_var_run_t, systemd_unit_t)
> +	allow $1 init_var_run_t:lnk_file read_lnk_file_perms;
> +')
> +
>   ########################################
>   ## <summary>
>   ##	Get status of generic systemd units.
> @@ -3030,3 +3077,21 @@ interface(`init_admin',`
>   	init_stop_system($1)
>   	init_telinit($1)
>   ')
> +
> +########################################
> +## <summary>
> +##      Allow getting init_t rlimit
> +## </summary>
> +## <param name="domain">
> +##      <summary>
> +##      Source domain
> +##      </summary>
> +## </param>
> +#
> +interface(`init_getrlimit',`
> +	gen_require(`
> +		type init_t;
> +	')
> +
> +	allow $1 init_t:process getrlimit;
> +')
> Index: refpolicy-2.20180701/policy/modules/system/systemd.if
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/system/systemd.if
> +++ refpolicy-2.20180701/policy/modules/system/systemd.if
> @@ -307,6 +307,8 @@ interface(`systemd_use_passwd_agent',`
>   	manage_sock_files_pattern($1, systemd_passwd_var_run_t, systemd_passwd_var_run_t)
>   
>   	allow systemd_passwd_agent_t $1:process signull;
> +	allow systemd_passwd_agent_t $1:dir search;
> +	allow systemd_passwd_agent_t $1:file read_file_perms;

I'd rather see something like ps_process_pattern().

Otherwise merged.


>   	allow systemd_passwd_agent_t $1:unix_dgram_socket sendto;
>   ')
>   
> @@ -828,3 +830,22 @@ interface(`systemd_getattr_updated_runti
>   
>   	getattr_files_pattern($1, systemd_update_run_t, systemd_update_run_t)
>   ')
> +
> +#######################################
> +## <summary>
> +##  Allow domain to list dirs under /run/systemd/netif
> +## </summary>
> +## <param name="domain">
> +## <summary>
> +##  domain permitted the access
> +## </summary>
> +## </param>
> +#
> +interface(`systemd_list_netif',`
> +	gen_require(`
> +		type systemd_networkd_var_run_t;
> +	')
> +
> +	init_list_pids($1)
> +	allow $1 systemd_networkd_var_run_t:dir list_dir_perms;
> +')
> Index: refpolicy-2.20180701/policy/modules/services/ntp.te
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/services/ntp.te
> +++ refpolicy-2.20180701/policy/modules/services/ntp.te
> @@ -142,6 +142,8 @@ ifdef(`init_systemd',`
>   	dbus_connect_system_bus(ntpd_t)
>   	init_dbus_chat(ntpd_t)
>   	init_get_system_status(ntpd_t)
> +	# for /var/lib/systemd/timesync
> +	init_read_var_lib_links(ntpd_t)
>   	allow ntpd_t self:capability { fowner setpcap };
>   	init_read_state(ntpd_t)
>   	init_reload(ntpd_t)
> @@ -150,7 +152,7 @@ ifdef(`init_systemd',`
>   	init_list_var_lib_dirs(ntpd_t)
>   
>   	# for /run/systemd/netif/links
> -	init_list_pids(ntpd_t)
> +	systemd_list_netif(ntpd_t)
>   
>   	optional_policy(`
>   		unconfined_dbus_send(ntpd_t)
> Index: refpolicy-2.20180701/policy/modules/system/systemd.te
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/system/systemd.te
> +++ refpolicy-2.20180701/policy/modules/system/systemd.te
> @@ -736,6 +736,7 @@ term_setattr_generic_ptys(systemd_nspawn
>   term_use_ptmx(systemd_nspawn_t)
>   
>   init_domtrans_script(systemd_nspawn_t)
> +init_getrlimit(systemd_nspawn_t)
>   init_kill_scripts(systemd_nspawn_t)
>   init_read_state(systemd_nspawn_t)
>   init_search_run(systemd_nspawn_t)
> @@ -1027,6 +1028,7 @@ tunable_policy(`systemd_tmpfiles_manage_
>   
>   optional_policy(`
>   	dbus_read_lib_files(systemd_tmpfiles_t)
> +	dbus_relabel_lib_dirs(systemd_tmpfiles_t)
>   ')
>   
>   optional_policy(`
> Index: refpolicy-2.20180701/policy/modules/system/logging.te
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/system/logging.te
> +++ refpolicy-2.20180701/policy/modules/system/logging.te
> @@ -541,15 +541,19 @@ ifdef(`init_systemd',`
>   	dev_read_urand(syslogd_t)
>   	dev_write_kmsg(syslogd_t)
>   
> +	domain_getattr_all_domains(syslogd_t)
>   	domain_read_all_domains_state(syslogd_t)
>   
>   	init_create_pid_dirs(syslogd_t)
>   	init_daemon_pid_file(syslogd_var_run_t, dir, "syslogd")
> +	init_getattr(syslogd_t)
>   	init_rename_pid_files(syslogd_t)
>   	init_delete_pid_files(syslogd_t)
>   	init_dgram_send(syslogd_t)
>   	init_read_pid_pipes(syslogd_t)
>   	init_read_state(syslogd_t)
> +	# for /run/systemd/units/invocation:* links
> +	init_read_unit_links(syslogd_t)
>   
>   	systemd_manage_journal_files(syslogd_t)
>   
> 


-- 
Chris PeBenito

^ permalink raw reply	[flat|nested] 8+ messages in thread
* Re: [PATCH] systemd related interfaces
  2019-01-05 19:18 ` Chris PeBenito
@ 2019-01-05 21:39   ` Nicolas Iooss
  2019-01-05 21:49     ` Dominick Grift
  0 siblings, 1 reply; 8+ messages in thread
From: Nicolas Iooss @ 2019-01-05 21:39 UTC (permalink / raw)
  To: Chris PeBenito, selinux-refpolicy; +Cc: Russell Coker

On Sat, Jan 5, 2019 at 8:39 PM Chris PeBenito <pebenito@ieee.org> wrote:
>
> On 1/4/19 2:51 AM, Russell Coker wrote:
> > This patch has interface changes related to systemd support as well as policy
> > that uses the new interfaces.
> > [...]
> > Index: refpolicy-2.20180701/policy/modules/system/logging.te
> > ===================================================================
> > --- refpolicy-2.20180701.orig/policy/modules/system/logging.te
> > +++ refpolicy-2.20180701/policy/modules/system/logging.te
> > @@ -541,15 +541,19 @@ ifdef(`init_systemd',`
> >       dev_read_urand(syslogd_t)
> >       dev_write_kmsg(syslogd_t)
> >
> > +     domain_getattr_all_domains(syslogd_t)
> >       domain_read_all_domains_state(syslogd_t)
> >
> >       init_create_pid_dirs(syslogd_t)
> >       init_daemon_pid_file(syslogd_var_run_t, dir, "syslogd")
> > +     init_getattr(syslogd_t)
> >       init_rename_pid_files(syslogd_t)
> >       init_delete_pid_files(syslogd_t)
> >       init_dgram_send(syslogd_t)
> >       init_read_pid_pipes(syslogd_t)
> >       init_read_state(syslogd_t)
> > +     # for /run/systemd/units/invocation:* links
> > +     init_read_unit_links(syslogd_t)
> >
> >       systemd_manage_journal_files(syslogd_t)
> >

This change has not been merged and I see the relevant AVC on an Arch
Linux virtual machine (using systemd 239.370):

type=AVC msg=audit(1546723651.696:2091): avc:  denied  { read } for
pid=240 comm="systemd-journal" name="invocation:user@1000.service"
dev="tmpfs" ino=17614 scontext=system_u:system_r:syslogd_t
tcontext=system_u:object_r:init_var_run_t tclass=lnk_file permissive=0
type=AVC msg=audit(1546723651.799:2092): avc:  denied  { read } for
pid=240 comm="systemd-journal" name="invocation:dbus.service"
dev="tmpfs" ino=12542 scontext=system_u:system_r:syslogd_t
tcontext=system_u:object_r:init_var_run_t tclass=lnk_file permissive=0

What prevented init_read_unit_links(syslogd_t) from being added?

Nicolas


^ permalink raw reply	[flat|nested] 8+ messages in thread
* Re: [PATCH] systemd related interfaces
  2019-01-05 21:39   ` Nicolas Iooss
@ 2019-01-05 21:49     ` Dominick Grift
  2019-01-06 18:39       ` Chris PeBenito
  0 siblings, 1 reply; 8+ messages in thread
From: Dominick Grift @ 2019-01-05 21:49 UTC (permalink / raw)
  To: Nicolas Iooss; +Cc: Chris PeBenito, selinux-refpolicy, Russell Coker

Nicolas Iooss <nicolas.iooss@m4x.org> writes:

> On Sat, Jan 5, 2019 at 8:39 PM Chris PeBenito <pebenito@ieee.org> wrote:
>>
>> On 1/4/19 2:51 AM, Russell Coker wrote:
>> > This patch has interface changes related to systemd support as well as policy
>> > that uses the new interfaces.
>> > [...]
>> > Index: refpolicy-2.20180701/policy/modules/system/logging.te
>> > ===================================================================
>> > --- refpolicy-2.20180701.orig/policy/modules/system/logging.te
>> > +++ refpolicy-2.20180701/policy/modules/system/logging.te
>> > @@ -541,15 +541,19 @@ ifdef(`init_systemd',`
>> >       dev_read_urand(syslogd_t)
>> >       dev_write_kmsg(syslogd_t)
>> >
>> > +     domain_getattr_all_domains(syslogd_t)
>> >       domain_read_all_domains_state(syslogd_t)
>> >
>> >       init_create_pid_dirs(syslogd_t)
>> >       init_daemon_pid_file(syslogd_var_run_t, dir, "syslogd")
>> > +     init_getattr(syslogd_t)
>> >       init_rename_pid_files(syslogd_t)
>> >       init_delete_pid_files(syslogd_t)
>> >       init_dgram_send(syslogd_t)
>> >       init_read_pid_pipes(syslogd_t)
>> >       init_read_state(syslogd_t)
>> > +     # for /run/systemd/units/invocation:* links
>> > +     init_read_unit_links(syslogd_t)
>> >
>> >       systemd_manage_journal_files(syslogd_t)
>> >
>
> This change has not been merged and I see the relevant AVC on an Arch
> Linux virtual machine (using systemd 239.370):
>
> type=AVC msg=audit(1546723651.696:2091): avc:  denied  { read } for
> pid=240 comm="systemd-journal" name="invocation:user@1000.service"
> dev="tmpfs" ino=17614 scontext=system_u:system_r:syslogd_t
> tcontext=system_u:object_r:init_var_run_t tclass=lnk_file permissive=0
> type=AVC msg=audit(1546723651.799:2092): avc:  denied  { read } for
> pid=240 comm="systemd-journal" name="invocation:dbus.service"
> dev="tmpfs" ino=12542 scontext=system_u:system_r:syslogd_t
> tcontext=system_u:object_r:init_var_run_t tclass=lnk_file permissive=0

This should be ok to allow, afaik only journald reads these
symlinks.

>
> What prevented init_read_unit_links(syslogd_t) from being added?
>
> Nicolas
>

-- 
Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02
Dominick Grift

^ permalink raw reply	[flat|nested] 8+ messages in thread
* Re: [PATCH] systemd related interfaces
  2019-01-05 21:49     ` Dominick Grift
@ 2019-01-06 18:39       ` Chris PeBenito
  2019-01-06 22:10         ` Nicolas Iooss
  0 siblings, 1 reply; 8+ messages in thread
From: Chris PeBenito @ 2019-01-06 18:39 UTC (permalink / raw)
  To: Dominick Grift, Nicolas Iooss; +Cc: selinux-refpolicy, Russell Coker

On 1/5/19 4:49 PM, Dominick Grift wrote:
> Nicolas Iooss <nicolas.iooss@m4x.org> writes:
> 
>> On Sat, Jan 5, 2019 at 8:39 PM Chris PeBenito <pebenito@ieee.org> wrote:
>>>
>>> On 1/4/19 2:51 AM, Russell Coker wrote:
>>>> This patch has interface changes related to systemd support as well as policy
>>>> that uses the new interfaces.
>>>> [...]
>>>> Index: refpolicy-2.20180701/policy/modules/system/logging.te
>>>> ===================================================================
>>>> --- refpolicy-2.20180701.orig/policy/modules/system/logging.te
>>>> +++ refpolicy-2.20180701/policy/modules/system/logging.te
>>>> @@ -541,15 +541,19 @@ ifdef(`init_systemd',`
>>>>        dev_read_urand(syslogd_t)
>>>>        dev_write_kmsg(syslogd_t)
>>>>
>>>> +     domain_getattr_all_domains(syslogd_t)
>>>>        domain_read_all_domains_state(syslogd_t)
>>>>
>>>>        init_create_pid_dirs(syslogd_t)
>>>>        init_daemon_pid_file(syslogd_var_run_t, dir, "syslogd")
>>>> +     init_getattr(syslogd_t)
>>>>        init_rename_pid_files(syslogd_t)
>>>>        init_delete_pid_files(syslogd_t)
>>>>        init_dgram_send(syslogd_t)
>>>>        init_read_pid_pipes(syslogd_t)
>>>>        init_read_state(syslogd_t)
>>>> +     # for /run/systemd/units/invocation:* links
>>>> +     init_read_unit_links(syslogd_t)
>>>>
>>>>        systemd_manage_journal_files(syslogd_t)
>>>>
>>
>> This change has not been merged and I see the relevant AVC on an Arch
>> Linux virtual machine (using systemd 239.370):
>>
>> type=AVC msg=audit(1546723651.696:2091): avc:  denied  { read } for
>> pid=240 comm="systemd-journal" name="invocation:user@1000.service"
>> dev="tmpfs" ino=17614 scontext=system_u:system_r:syslogd_t
>> tcontext=system_u:object_r:init_var_run_t tclass=lnk_file permissive=0
>> type=AVC msg=audit(1546723651.799:2092): avc:  denied  { read } for
>> pid=240 comm="systemd-journal" name="invocation:dbus.service"
>> dev="tmpfs" ino=12542 scontext=system_u:system_r:syslogd_t
>> tcontext=system_u:object_r:init_var_run_t tclass=lnk_file permissive=0
> 
> This should be ok to allow, afaik only journald reads these
> symlinks.
> 
>>
>> What prevented init_read_unit_links(syslogd_t) from being added?

I missed putting in my reason in the previous email.  Your denial is for 
init_var_run_t:lnk_file access and the change was for 
systemd_unit_t:lnk_file.  What you're seeing makes more sense to me.  As 
far as I can tell, there should be no systemd_unit_t symlinks, and I'd 
prefer to keep it that way, if possible.

-- 
Chris PeBenito

^ permalink raw reply	[flat|nested] 8+ messages in thread
* Re: [PATCH] systemd related interfaces
  2019-01-06 18:39       ` Chris PeBenito
@ 2019-01-06 22:10         ` Nicolas Iooss
  2019-01-07 23:36           ` Chris PeBenito
  0 siblings, 1 reply; 8+ messages in thread
From: Nicolas Iooss @ 2019-01-06 22:10 UTC (permalink / raw)
  To: Chris PeBenito; +Cc: Dominick Grift, selinux-refpolicy, Russell Coker

On Sun, Jan 6, 2019 at 8:14 PM Chris PeBenito <pebenito@ieee.org> wrote:
>
> On 1/5/19 4:49 PM, Dominick Grift wrote:
> > Nicolas Iooss <nicolas.iooss@m4x.org> writes:
> >
> >> On Sat, Jan 5, 2019 at 8:39 PM Chris PeBenito <pebenito@ieee.org> wrote:
> >>>
> >>> On 1/4/19 2:51 AM, Russell Coker wrote:
> >>>> This patch has interface changes related to systemd support as well as policy
> >>>> that uses the new interfaces.
> >>>> [...]
> >>>> Index: refpolicy-2.20180701/policy/modules/system/logging.te
> >>>> ===================================================================
> >>>> --- refpolicy-2.20180701.orig/policy/modules/system/logging.te
> >>>> +++ refpolicy-2.20180701/policy/modules/system/logging.te
> >>>> @@ -541,15 +541,19 @@ ifdef(`init_systemd',`
> >>>>        dev_read_urand(syslogd_t)
> >>>>        dev_write_kmsg(syslogd_t)
> >>>>
> >>>> +     domain_getattr_all_domains(syslogd_t)
> >>>>        domain_read_all_domains_state(syslogd_t)
> >>>>
> >>>>        init_create_pid_dirs(syslogd_t)
> >>>>        init_daemon_pid_file(syslogd_var_run_t, dir, "syslogd")
> >>>> +     init_getattr(syslogd_t)
> >>>>        init_rename_pid_files(syslogd_t)
> >>>>        init_delete_pid_files(syslogd_t)
> >>>>        init_dgram_send(syslogd_t)
> >>>>        init_read_pid_pipes(syslogd_t)
> >>>>        init_read_state(syslogd_t)
> >>>> +     # for /run/systemd/units/invocation:* links
> >>>> +     init_read_unit_links(syslogd_t)
> >>>>
> >>>>        systemd_manage_journal_files(syslogd_t)
> >>>>
> >>
> >> This change has not been merged and I see the relevant AVC on an Arch
> >> Linux virtual machine (using systemd 239.370):
> >>
> >> type=AVC msg=audit(1546723651.696:2091): avc:  denied  { read } for
> >> pid=240 comm="systemd-journal" name="invocation:user@1000.service"
> >> dev="tmpfs" ino=17614 scontext=system_u:system_r:syslogd_t
> >> tcontext=system_u:object_r:init_var_run_t tclass=lnk_file permissive=0
> >> type=AVC msg=audit(1546723651.799:2092): avc:  denied  { read } for
> >> pid=240 comm="systemd-journal" name="invocation:dbus.service"
> >> dev="tmpfs" ino=12542 scontext=system_u:system_r:syslogd_t
> >> tcontext=system_u:object_r:init_var_run_t tclass=lnk_file permissive=0
> >
> > This should be ok to allow, afaik only journald reads these
> > symlinks.
> >
> >>
> >> What prevented init_read_unit_links(syslogd_t) from being added?
>
> I missed putting in my reason in the previous email.  Your denial is for
> init_var_run_t:lnk_file access and the change was for
> systemd_unit_t:lnk_file.  What you're seeing makes more sense to me.  As
> far as I can tell, there should be no systemd_unit_t symlinks, and I'd
> prefer to keep it that way, if possible.

The search_dirs_pattern($1, init_var_run_t, systemd_unit_t) was indeed
not useful here. I have created a Pull Request fixing this on
https://github.com/SELinuxProject/refpolicy/pull/17 .

By the way, I do pull requests because I find them simpler to handle
from my side (because I have too many emails in my inbox), but if you
prefer that I post the patches on the list, I can do that instead. It
would be useful for the project to have a CONTRIBUTING file describing
the preferred way of sending patches or reporting issues, or to have
such information in the README file.

Thanks,
Nicolas


^ permalink raw reply	[flat|nested] 8+ messages in thread
* Re: [PATCH] systemd related interfaces
  2019-01-06 22:10         ` Nicolas Iooss
@ 2019-01-07 23:36           ` Chris PeBenito
  2019-01-10 23:10             ` Nicolas Iooss
  0 siblings, 1 reply; 8+ messages in thread
From: Chris PeBenito @ 2019-01-07 23:36 UTC (permalink / raw)
  To: Nicolas Iooss; +Cc: Dominick Grift, selinux-refpolicy, Russell Coker

On 1/6/19 5:10 PM, Nicolas Iooss wrote:
> By the way, I do pull requests because I find them simpler to handle
> from my side (because I have too many emails in my inbox), but if you
> prefer that I post the patches on the list, I can do that instead. It
> would be useful for the project to have a CONTRIBUTING file describing
> the preferred way of sending patches or reporting issues, or to have
> such information in the README file.

It is described here:

https://github.com/SELinuxProject/refpolicy/wiki/HowToContribute

But I need to update it, as I prefer the GitHub pull requests these days 
(though will always accept patches via the list).  I'll add a 
CONTRIBUTING file, though it will probably consist mostly of the above link.

-- 
Chris PeBenito

^ permalink raw reply	[flat|nested] 8+ messages in thread
* Re: [PATCH] systemd related interfaces
  2019-01-07 23:36           ` Chris PeBenito
@ 2019-01-10 23:10             ` Nicolas Iooss
  0 siblings, 0 replies; 8+ messages in thread
From: Nicolas Iooss @ 2019-01-10 23:10 UTC (permalink / raw)
  To: Chris PeBenito; +Cc: Dominick Grift, selinux-refpolicy, Russell Coker

On Tue, Jan 8, 2019 at 12:37 AM Chris PeBenito <pebenito@ieee.org> wrote:
>
> On 1/6/19 5:10 PM, Nicolas Iooss wrote:
> > By the way, I do pull requests because I find them simpler to handle
> > from my side (because I have too many emails in my inbox), but if you
> > prefer that I post the patches on the list, I can do that instead. It
> > would be useful for the project to have a CONTRIBUTING file describing
> > the preferred way of sending patches or reporting issues, or to have
> > such information in the README file.
>
> It is described here:
>
> https://github.com/SELinuxProject/refpolicy/wiki/HowToContribute
>
> But I need to update it, as I prefer the GitHub pull requests these days
> (though will always accept patches via the list).  I'll add a
> CONTRIBUTING file, though it will probably consist mostly of the above link.

I indeed missed the wiki page, which is now easier to find. Thanks!

Nicolas


^ permalink raw reply	[flat|nested] 8+ messages in thread
end of thread, other threads:[~2019-01-10 23:10 UTC | newest]

Thread overview: 8+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-01-04  7:51 [PATCH] systemd related interfaces Russell Coker
2019-01-05 19:18 ` Chris PeBenito
2019-01-05 21:39   ` Nicolas Iooss
2019-01-05 21:49     ` Dominick Grift
2019-01-06 18:39       ` Chris PeBenito
2019-01-06 22:10         ` Nicolas Iooss
2019-01-07 23:36           ` Chris PeBenito
2019-01-10 23:10             ` Nicolas Iooss

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).