SELinux-Refpolicy Archive on lore.kernel.org
 help / Atom feed
* [PATCH] more tiny stuff
@ 2019-01-19 12:04 Russell Coker
  2019-01-19 12:14 ` Dominick Grift
  2019-01-20 21:22 ` Chris PeBenito
  0 siblings, 2 replies; 3+ messages in thread
From: Russell Coker @ 2019-01-19 12:04 UTC (permalink / raw)
  To: selinux-refpolicy

I think the old timesync labelling wasn't working anyway due to -- for a
directory name.

A couple of patches for devicekit calling dmidecode (this is part of replacing
some kmem access that was discussed on this list and rejected as a misfeature
in Debian DMI related code ages ago).

The rest should be obvious.

Index: refpolicy-2.20180701/policy/modules/services/ntp.fc
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/ntp.fc
+++ refpolicy-2.20180701/policy/modules/services/ntp.fc
@@ -32,7 +32,7 @@
 /var/lib/ntp(/.*)?				gen_context(system_u:object_r:ntp_drift_t,s0)
 /var/lib/sntp-kod(/.*)?				gen_context(system_u:object_r:ntp_drift_t,s0)
 /var/lib/systemd/clock			--	gen_context(system_u:object_r:ntp_drift_t,s0)
-/var/lib/private/systemd/timesync(/.*)? --	gen_context(system_u:object_r:ntp_drift_t,s0)
+/var/lib/systemd/timesync(/.*)?			gen_context(system_u:object_r:ntp_drift_t,s0)
 
 /var/lock/ntpdate                       --      gen_context(system_u:object_r:ntpd_lock_t,s0)
 
Index: refpolicy-2.20180701/policy/modules/admin/dmidecode.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/admin/dmidecode.te
+++ refpolicy-2.20180701/policy/modules/admin/dmidecode.te
@@ -32,3 +32,9 @@ mls_file_read_all_levels(dmidecode_t)
 locallogin_use_fds(dmidecode_t)
 
 userdom_use_inherited_user_terminals(dmidecode_t)
+
+ifdef(`init_systemd',`
+	# inherits /dev/null and a socket from devicekit_disk_t
+	init_use_fds(dmidecode_t)
+	init_rw_inherited_stream_socket(dmidecode_t)
+')
Index: refpolicy-2.20180701/policy/modules/services/devicekit.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/devicekit.te
+++ refpolicy-2.20180701/policy/modules/services/devicekit.te
@@ -177,6 +177,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	dmidecode_domtrans(devicekit_disk_t)
+')
+
+optional_policy(`
 	fstools_domtrans(devicekit_disk_t)
 ')
 
Index: refpolicy-2.20180701/policy/modules/services/xserver.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/xserver.te
+++ refpolicy-2.20180701/policy/modules/services/xserver.te
@@ -291,6 +291,8 @@ kernel_request_load_module(xauth_t)
 
 domain_use_interactive_fds(xauth_t)
 
+dev_read_sysfs(xauth_t)
+
 files_read_etc_files(xauth_t)
 files_search_pids(xauth_t)
 
Index: refpolicy-2.20180701/policy/modules/system/unconfined.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/system/unconfined.te
+++ refpolicy-2.20180701/policy/modules/system/unconfined.te
@@ -59,6 +59,9 @@ ifdef(`direct_sysadm_daemon',`
 ')
 
 ifdef(`init_systemd',`
+	# for systemd-analyze
+	init_service_status(unconfined_t)
+
 	optional_policy(`
 		systemd_dbus_chat_resolved(unconfined_t)
 	')

^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [PATCH] more tiny stuff
  2019-01-19 12:04 [PATCH] more tiny stuff Russell Coker
@ 2019-01-19 12:14 ` Dominick Grift
  2019-01-20 21:22 ` Chris PeBenito
  1 sibling, 0 replies; 3+ messages in thread
From: Dominick Grift @ 2019-01-19 12:14 UTC (permalink / raw)
  To: Russell Coker; +Cc: selinux-refpolicy\

Russell Coker <russell@coker.com.au> writes:

> I think the old timesync labelling wasn't working anyway due to -- for a
> directory name.
>
> A couple of patches for devicekit calling dmidecode (this is part of replacing
> some kmem access that was discussed on this list and rejected as a misfeature
> in Debian DMI related code ages ago).
>
> The rest should be obvious.
>
> Index: refpolicy-2.20180701/policy/modules/services/ntp.fc
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/services/ntp.fc
> +++ refpolicy-2.20180701/policy/modules/services/ntp.fc
> @@ -32,7 +32,7 @@
>  /var/lib/ntp(/.*)?				gen_context(system_u:object_r:ntp_drift_t,s0)
>  /var/lib/sntp-kod(/.*)?				gen_context(system_u:object_r:ntp_drift_t,s0)
>  /var/lib/systemd/clock			--	gen_context(system_u:object_r:ntp_drift_t,s0)
> -/var/lib/private/systemd/timesync(/.*)? --	gen_context(system_u:object_r:ntp_drift_t,s0)
> +/var/lib/systemd/timesync(/.*)?			gen_context(system_u:object_r:ntp_drift_t,s0)

Yes that and systemd-timesync no longer uses DynamicUser= and so
/var/lib/private no longer applies

Also refpolicy should consider making /var/{lib/private,cache/private,log/private} equivalent to
/var/lib, /var/cache and /var/log respectively

>  
>  /var/lock/ntpdate                       --      gen_context(system_u:object_r:ntpd_lock_t,s0)
>  
> Index: refpolicy-2.20180701/policy/modules/admin/dmidecode.te
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/admin/dmidecode.te
> +++ refpolicy-2.20180701/policy/modules/admin/dmidecode.te
> @@ -32,3 +32,9 @@ mls_file_read_all_levels(dmidecode_t)
>  locallogin_use_fds(dmidecode_t)
>  
>  userdom_use_inherited_user_terminals(dmidecode_t)
> +
> +ifdef(`init_systemd',`
> +	# inherits /dev/null and a socket from devicekit_disk_t
> +	init_use_fds(dmidecode_t)
> +	init_rw_inherited_stream_socket(dmidecode_t)
> +')
> Index: refpolicy-2.20180701/policy/modules/services/devicekit.te
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/services/devicekit.te
> +++ refpolicy-2.20180701/policy/modules/services/devicekit.te
> @@ -177,6 +177,10 @@ optional_policy(`
>  ')
>  
>  optional_policy(`
> +	dmidecode_domtrans(devicekit_disk_t)
> +')
> +
> +optional_policy(`
>  	fstools_domtrans(devicekit_disk_t)
>  ')
>  
> Index: refpolicy-2.20180701/policy/modules/services/xserver.te
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/services/xserver.te
> +++ refpolicy-2.20180701/policy/modules/services/xserver.te
> @@ -291,6 +291,8 @@ kernel_request_load_module(xauth_t)
>  
>  domain_use_interactive_fds(xauth_t)
>  
> +dev_read_sysfs(xauth_t)
> +
>  files_read_etc_files(xauth_t)
>  files_search_pids(xauth_t)
>  
> Index: refpolicy-2.20180701/policy/modules/system/unconfined.te
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/system/unconfined.te
> +++ refpolicy-2.20180701/policy/modules/system/unconfined.te
> @@ -59,6 +59,9 @@ ifdef(`direct_sysadm_daemon',`
>  ')
>  
>  ifdef(`init_systemd',`
> +	# for systemd-analyze
> +	init_service_status(unconfined_t)
> +
>  	optional_policy(`
>  		systemd_dbus_chat_resolved(unconfined_t)
>  	')

-- 
Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02
Dominick Grift

^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [PATCH] more tiny stuff
  2019-01-19 12:04 [PATCH] more tiny stuff Russell Coker
  2019-01-19 12:14 ` Dominick Grift
@ 2019-01-20 21:22 ` Chris PeBenito
  1 sibling, 0 replies; 3+ messages in thread
From: Chris PeBenito @ 2019-01-20 21:22 UTC (permalink / raw)
  To: Russell Coker, selinux-refpolicy

On 1/19/19 7:04 AM, Russell Coker wrote:
> I think the old timesync labelling wasn't working anyway due to -- for a
> directory name.
> 
> A couple of patches for devicekit calling dmidecode (this is part of replacing
> some kmem access that was discussed on this list and rejected as a misfeature
> in Debian DMI related code ages ago).
> 
> The rest should be obvious.
> 
> Index: refpolicy-2.20180701/policy/modules/services/ntp.fc
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/services/ntp.fc
> +++ refpolicy-2.20180701/policy/modules/services/ntp.fc
> @@ -32,7 +32,7 @@
>   /var/lib/ntp(/.*)?				gen_context(system_u:object_r:ntp_drift_t,s0)
>   /var/lib/sntp-kod(/.*)?				gen_context(system_u:object_r:ntp_drift_t,s0)
>   /var/lib/systemd/clock			--	gen_context(system_u:object_r:ntp_drift_t,s0)
> -/var/lib/private/systemd/timesync(/.*)? --	gen_context(system_u:object_r:ntp_drift_t,s0)
> +/var/lib/systemd/timesync(/.*)?			gen_context(system_u:object_r:ntp_drift_t,s0)
>   
>   /var/lock/ntpdate                       --      gen_context(system_u:object_r:ntpd_lock_t,s0)
>   
> Index: refpolicy-2.20180701/policy/modules/admin/dmidecode.te
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/admin/dmidecode.te
> +++ refpolicy-2.20180701/policy/modules/admin/dmidecode.te
> @@ -32,3 +32,9 @@ mls_file_read_all_levels(dmidecode_t)
>   locallogin_use_fds(dmidecode_t)
>   
>   userdom_use_inherited_user_terminals(dmidecode_t)
> +
> +ifdef(`init_systemd',`
> +	# inherits /dev/null and a socket from devicekit_disk_t
> +	init_use_fds(dmidecode_t)
> +	init_rw_inherited_stream_socket(dmidecode_t)
> +')
> Index: refpolicy-2.20180701/policy/modules/services/devicekit.te
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/services/devicekit.te
> +++ refpolicy-2.20180701/policy/modules/services/devicekit.te
> @@ -177,6 +177,10 @@ optional_policy(`
>   ')
>   
>   optional_policy(`
> +	dmidecode_domtrans(devicekit_disk_t)
> +')
> +
> +optional_policy(`
>   	fstools_domtrans(devicekit_disk_t)
>   ')
>   
> Index: refpolicy-2.20180701/policy/modules/services/xserver.te
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/services/xserver.te
> +++ refpolicy-2.20180701/policy/modules/services/xserver.te
> @@ -291,6 +291,8 @@ kernel_request_load_module(xauth_t)
>   
>   domain_use_interactive_fds(xauth_t)
>   
> +dev_read_sysfs(xauth_t)
> +
>   files_read_etc_files(xauth_t)
>   files_search_pids(xauth_t)
>   
> Index: refpolicy-2.20180701/policy/modules/system/unconfined.te
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/system/unconfined.te
> +++ refpolicy-2.20180701/policy/modules/system/unconfined.te
> @@ -59,6 +59,9 @@ ifdef(`direct_sysadm_daemon',`
>   ')
>   
>   ifdef(`init_systemd',`
> +	# for systemd-analyze
> +	init_service_status(unconfined_t)
> +
>   	optional_policy(`
>   		systemd_dbus_chat_resolved(unconfined_t)
>   	')

Merged.

-- 
Chris PeBenito

^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, back to index

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-01-19 12:04 [PATCH] more tiny stuff Russell Coker
2019-01-19 12:14 ` Dominick Grift
2019-01-20 21:22 ` Chris PeBenito

SELinux-Refpolicy Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/selinux-refpolicy/0 selinux-refpolicy/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 selinux-refpolicy selinux-refpolicy/ https://lore.kernel.org/selinux-refpolicy \
		selinux-refpolicy@vger.kernel.org selinux-refpolicy@archiver.kernel.org
	public-inbox-index selinux-refpolicy


Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.selinux-refpolicy


AGPL code for this site: git clone https://public-inbox.org/ public-inbox