2019-03-20 00:20:39

by Sugar, David

[permalink] [raw]
Subject: [PATCH 0/4] Resolve issues using /usr/bin/timedatectl

I'm seeing some issues using timedatectl to alter the system
date, time and timezone. The following set of patches is to
resolve issues seen during these interactions. I setup as
several patches to keep the set of denials clear for each
patch.

Dave Sugar (4):
Add interface ntp_dbus_chat
Allow ntpd to alter chronyd service
Allow ntpd to update timezone
Allow ntpd to read unit files

policy/modules/services/ntp.if | 21 +++++++++++++++++++++
policy/modules/services/ntp.te | 9 +++++++++
policy/modules/system/init.if | 10 ++++++++++
3 files changed, 40 insertions(+)

--
2.20.1



2019-03-20 00:20:38

by Sugar, David

[permalink] [raw]
Subject: [PATCH 1/4] Add interface ntp_dbus_chat

type=USER_AVC msg=audit(1553013821.622:9900): pid=7377 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_call interface=org.freedesktop.timedate1 member=SetTimezone dest=org.freedesktop.timedate1 spid=16280 tpid=16281 scontext=sysadm_u:sysadm_r:settings_t:s0-s0:c0.c1023 tcontext=system_u:system_r:ntpd_t:s0 tclass=dbus exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
type=USER_AVC msg=audit(1553013821.625:9911): pid=7377 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_return dest=:1.258 spid=16281 tpid=16280 scontext=system_u:system_r:ntpd_t:s0 tcontext=sysadm_u:sysadm_r:settings_t:s0-s0:c0.c1023 tclass=dbus exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'

Signed-off-by: Dave Sugar <[email protected]>
---
policy/modules/services/ntp.if | 21 +++++++++++++++++++++
1 file changed, 21 insertions(+)

diff --git a/policy/modules/services/ntp.if b/policy/modules/services/ntp.if
index f1a90c55..7fa20c8d 100644
--- a/policy/modules/services/ntp.if
+++ b/policy/modules/services/ntp.if
@@ -79,6 +79,27 @@ interface(`ntp_run',`
roleattribute $2 ntpd_roles;
')

+########################################
+## <summary>
+## Send and receive messages from
+## ntpd over dbus.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`ntp_dbus_chat',`
+ gen_require(`
+ type ntpd_t;
+ class dbus send_msg;
+ ')
+
+ allow $1 ntpd_t:dbus send_msg;
+ allow ntpd_t $1:dbus send_msg;
+')
+
########################################
## <summary>
## Execute ntpdate server in the ntpd domain.
--
2.20.1


2019-03-20 00:20:39

by Sugar, David

[permalink] [raw]
Subject: [PATCH 2/4] Allow ntpd to update chronyd service

type=USER_AVC msg=audit(1553013917.361:9938): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc: denied { disable } for auid=n/a uid=0 gid=0 path="/usr/lib/systemd/system/chronyd.service" cmdline="/usr/lib/systemd/systemd-timedated" scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:chronyd_unit_t:s0 tclass=service exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?
type=USER_AVC msg=audit(1553013917.406:9943): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc: denied { stop } for auid=n/a uid=0 gid=0 path="/usr/lib/systemd/system/chronyd.service" cmdline="/usr/lib/systemd/systemd-timedated" scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:chronyd_unit_t:s0 tclass=service exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'
type=USER_AVC msg=audit(1553021100.061:9970): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc: denied { enable } for auid=n/a uid=0 gid=0 path="/usr/lib/systemd/system/chronyd.service" cmdline="/usr/lib/systemd/systemd-timedated" scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:chronyd_unit_t:s0 tclass=service exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'
type=USER_AVC msg=audit(1553021100.104:9973): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc: denied { start } for auid=n/a uid=0 gid=0 path="/usr/lib/systemd/system/chronyd.service" cmdline="/usr/lib/systemd/systemd-timedated" scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:chronyd_unit_t:s0 tclass=service exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'

Signed-off-by: Dave Sugar <[email protected]>
---
policy/modules/services/ntp.te | 5 +++++
1 file changed, 5 insertions(+)

diff --git a/policy/modules/services/ntp.te b/policy/modules/services/ntp.te
index dc953784..d882fc59 100644
--- a/policy/modules/services/ntp.te
+++ b/policy/modules/services/ntp.te
@@ -153,6 +153,11 @@ ifdef(`init_systemd',`
# for /run/systemd/netif/links
systemd_list_networkd_runtime(ntpd_t)

+ optional_policy(`
+ chronyd_enabledisable(ntpd_t)
+ chronyd_startstop(ntpd_t)
+ ')
+
optional_policy(`
unconfined_dbus_send(ntpd_t)
')
--
2.20.1


2019-03-20 00:20:39

by Sugar, David

[permalink] [raw]
Subject: [PATCH 3/4] Allow ntpd to update timezone symlink

type=AVC msg=audit(1553013821.624:9907): avc: denied { create } for pid=16281 comm="systemd-timedat" name=".#localtime69bc4c9ad513a247" scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=lnk_file permissive=1
type=AVC msg=audit(1553013821.624:9908): avc: denied { rename } for pid=16281 comm="systemd-timedat" name=".#localtime69bc4c9ad513a247" dev="dm-1" ino=714303 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=lnk_file permissive=1
type=AVC msg=audit(1553013821.624:9908): avc: denied { unlink } for pid=16281 comm="systemd-timedat" name="localtime" dev="dm-1" ino=1063377 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=lnk_file permissive=1

Signed-off-by: Dave Sugar <[email protected]>
---
policy/modules/services/ntp.te | 1 +
1 file changed, 1 insertion(+)

diff --git a/policy/modules/services/ntp.te b/policy/modules/services/ntp.te
index d882fc59..eff38486 100644
--- a/policy/modules/services/ntp.te
+++ b/policy/modules/services/ntp.te
@@ -116,6 +116,7 @@ dev_rw_realtime_clock(ntpd_t)
domain_use_interactive_fds(ntpd_t)
domain_dontaudit_list_all_domains_state(ntpd_t)

+files_manage_etc_symlinks(ntpd_t)
files_read_etc_runtime_files(ntpd_t)
files_read_usr_files(ntpd_t)
files_list_var_lib(ntpd_t)
--
2.20.1


2019-03-20 00:20:41

by Sugar, David

[permalink] [raw]
Subject: [PATCH 4/4] Allow ntpd to read unit files

type=AVC msg=audit(1553013917.359:9935): avc: denied { read } for pid=16326 comm="systemd-timedat" name="50-chronyd.list" dev="dm-1" ino=4870675 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:ntpd_unit_t:s0 tclass=file permissive=1
type=AVC msg=audit(1553013917.359:9935): avc: denied { open } for pid=16326 comm="systemd-timedat" path="/usr/lib/systemd/ntp-units.d/50-chronyd.list" dev="dm-1" ino=4870675 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:ntpd_unit_t:s0 tclass=file permissive=1
type=AVC msg=audit(1553013917.359:9936): avc: denied { getattr } for pid=16326 comm="systemd-timedat" path="/usr/lib/systemd/ntp-units.d/50-chronyd.list" dev="dm-1" ino=4870675 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:ntpd_unit_t:s0 tclass=file permissive=1

type=AVC msg=audit(1553013821.622:9902): avc: denied { getattr } for pid=16281 comm="systemd-timedat" path="/usr/lib/systemd/ntp-units.d" dev="dm-1" ino=4700094 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:systemd_unit_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1553013821.622:9903): avc: denied { read } for pid=16281 comm="systemd-timedat" name="ntp-units.d" dev="dm-1" ino=4700094 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:systemd_unit_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1553013821.622:9903): avc: denied { open } for pid=16281 comm="systemd-timedat" path="/usr/lib/systemd/ntp-units.d" dev="dm-1" ino=4700094 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:systemd_unit_t:s0 tclass=dir permissive=1

Signed-off-by: Dave Sugar <[email protected]>
---
policy/modules/services/ntp.te | 3 +++
policy/modules/system/init.if | 10 ++++++++++
2 files changed, 13 insertions(+)

diff --git a/policy/modules/services/ntp.te b/policy/modules/services/ntp.te
index eff38486..85747e76 100644
--- a/policy/modules/services/ntp.te
+++ b/policy/modules/services/ntp.te
@@ -138,10 +138,13 @@ userdom_dontaudit_use_unpriv_user_fds(ntpd_t)
userdom_list_user_home_dirs(ntpd_t)

ifdef(`init_systemd',`
+ allow ntpd_t ntpd_unit_t:file read_file_perms;
+
dbus_system_bus_client(ntpd_t)
dbus_connect_system_bus(ntpd_t)
init_dbus_chat(ntpd_t)
init_get_system_status(ntpd_t)
+ init_list_unit_dirs(ntpd_t)
# for /var/lib/systemd/timesync
init_read_var_lib_links(ntpd_t)
allow ntpd_t self:capability { fowner setpcap };
diff --git a/policy/modules/system/init.if b/policy/modules/system/init.if
index 2a17910e..4f4d4d2c 100644
--- a/policy/modules/system/init.if
+++ b/policy/modules/system/init.if
@@ -2960,6 +2960,16 @@ interface(`init_search_units',`
fs_search_tmpfs($1)
')

+interface(`init_list_unit_dirs',`
+ gen_require(`
+ type systemd_unit_t;
+ ')
+
+ allow $1 systemd_unit_t:dir list_dir_perms;
+
+ init_search_units($1)
+')
+
########################################
## <summary>
## Read systemd unit links
--
2.20.1


2019-03-24 18:43:58

by Chris PeBenito

[permalink] [raw]
Subject: Re: [PATCH 1/4] Add interface ntp_dbus_chat

On 3/19/19 8:20 PM, Sugar, David wrote:
> type=USER_AVC msg=audit(1553013821.622:9900): pid=7377 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_call interface=org.freedesktop.timedate1 member=SetTimezone dest=org.freedesktop.timedate1 spid=16280 tpid=16281 scontext=sysadm_u:sysadm_r:settings_t:s0-s0:c0.c1023 tcontext=system_u:system_r:ntpd_t:s0 tclass=dbus exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
> type=USER_AVC msg=audit(1553013821.625:9911): pid=7377 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_return dest=:1.258 spid=16281 tpid=16280 scontext=system_u:system_r:ntpd_t:s0 tcontext=sysadm_u:sysadm_r:settings_t:s0-s0:c0.c1023 tclass=dbus exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
>
> Signed-off-by: Dave Sugar <[email protected]>
> ---
> policy/modules/services/ntp.if | 21 +++++++++++++++++++++
> 1 file changed, 21 insertions(+)
>
> diff --git a/policy/modules/services/ntp.if b/policy/modules/services/ntp.if
> index f1a90c55..7fa20c8d 100644
> --- a/policy/modules/services/ntp.if
> +++ b/policy/modules/services/ntp.if
> @@ -79,6 +79,27 @@ interface(`ntp_run',`
> roleattribute $2 ntpd_roles;
> ')
>
> +########################################
> +## <summary>
> +## Send and receive messages from
> +## ntpd over dbus.
> +## </summary>
> +## <param name="domain">
> +## <summary>
> +## Domain allowed access.
> +## </summary>
> +## </param>
> +#
> +interface(`ntp_dbus_chat',`
> + gen_require(`
> + type ntpd_t;
> + class dbus send_msg;
> + ')
> +
> + allow $1 ntpd_t:dbus send_msg;
> + allow ntpd_t $1:dbus send_msg;
> +')
> +
> ########################################
> ## <summary>
> ## Execute ntpdate server in the ntpd domain.

Merged.

--
Chris PeBenito

2019-03-24 18:44:00

by Chris PeBenito

[permalink] [raw]
Subject: Re: [PATCH 2/4] Allow ntpd to update chronyd service

On 3/19/19 8:20 PM, Sugar, David wrote:
> type=USER_AVC msg=audit(1553013917.361:9938): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc: denied { disable } for auid=n/a uid=0 gid=0 path="/usr/lib/systemd/system/chronyd.service" cmdline="/usr/lib/systemd/systemd-timedated" scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:chronyd_unit_t:s0 tclass=service exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?
> type=USER_AVC msg=audit(1553013917.406:9943): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc: denied { stop } for auid=n/a uid=0 gid=0 path="/usr/lib/systemd/system/chronyd.service" cmdline="/usr/lib/systemd/systemd-timedated" scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:chronyd_unit_t:s0 tclass=service exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'
> type=USER_AVC msg=audit(1553021100.061:9970): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc: denied { enable } for auid=n/a uid=0 gid=0 path="/usr/lib/systemd/system/chronyd.service" cmdline="/usr/lib/systemd/systemd-timedated" scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:chronyd_unit_t:s0 tclass=service exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'
> type=USER_AVC msg=audit(1553021100.104:9973): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc: denied { start } for auid=n/a uid=0 gid=0 path="/usr/lib/systemd/system/chronyd.service" cmdline="/usr/lib/systemd/systemd-timedated" scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:chronyd_unit_t:s0 tclass=service exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'
>
> Signed-off-by: Dave Sugar <[email protected]>
> ---
> policy/modules/services/ntp.te | 5 +++++
> 1 file changed, 5 insertions(+)
>
> diff --git a/policy/modules/services/ntp.te b/policy/modules/services/ntp.te
> index dc953784..d882fc59 100644
> --- a/policy/modules/services/ntp.te
> +++ b/policy/modules/services/ntp.te
> @@ -153,6 +153,11 @@ ifdef(`init_systemd',`
> # for /run/systemd/netif/links
> systemd_list_networkd_runtime(ntpd_t)
>
> + optional_policy(`
> + chronyd_enabledisable(ntpd_t)
> + chronyd_startstop(ntpd_t)
> + ')
> +
> optional_policy(`
> unconfined_dbus_send(ntpd_t)
> ')

Merged.

--
Chris PeBenito

2019-03-24 18:44:02

by Chris PeBenito

[permalink] [raw]
Subject: Re: [PATCH 3/4] Allow ntpd to update timezone symlink

On 3/19/19 8:20 PM, Sugar, David wrote:
> type=AVC msg=audit(1553013821.624:9907): avc: denied { create } for pid=16281 comm="systemd-timedat" name=".#localtime69bc4c9ad513a247" scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=lnk_file permissive=1
> type=AVC msg=audit(1553013821.624:9908): avc: denied { rename } for pid=16281 comm="systemd-timedat" name=".#localtime69bc4c9ad513a247" dev="dm-1" ino=714303 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=lnk_file permissive=1
> type=AVC msg=audit(1553013821.624:9908): avc: denied { unlink } for pid=16281 comm="systemd-timedat" name="localtime" dev="dm-1" ino=1063377 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=lnk_file permissive=1
>
> Signed-off-by: Dave Sugar <[email protected]>
> ---
> policy/modules/services/ntp.te | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/policy/modules/services/ntp.te b/policy/modules/services/ntp.te
> index d882fc59..eff38486 100644
> --- a/policy/modules/services/ntp.te
> +++ b/policy/modules/services/ntp.te
> @@ -116,6 +116,7 @@ dev_rw_realtime_clock(ntpd_t)
> domain_use_interactive_fds(ntpd_t)
> domain_dontaudit_list_all_domains_state(ntpd_t)
>
> +files_manage_etc_symlinks(ntpd_t)
> files_read_etc_runtime_files(ntpd_t)
> files_read_usr_files(ntpd_t)
> files_list_var_lib(ntpd_t)

Merged.

--
Chris PeBenito

2019-03-24 18:44:02

by Chris PeBenito

[permalink] [raw]
Subject: Re: [PATCH 4/4] Allow ntpd to read unit files

On 3/19/19 8:20 PM, Sugar, David wrote:
> type=AVC msg=audit(1553013917.359:9935): avc: denied { read } for pid=16326 comm="systemd-timedat" name="50-chronyd.list" dev="dm-1" ino=4870675 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:ntpd_unit_t:s0 tclass=file permissive=1
> type=AVC msg=audit(1553013917.359:9935): avc: denied { open } for pid=16326 comm="systemd-timedat" path="/usr/lib/systemd/ntp-units.d/50-chronyd.list" dev="dm-1" ino=4870675 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:ntpd_unit_t:s0 tclass=file permissive=1
> type=AVC msg=audit(1553013917.359:9936): avc: denied { getattr } for pid=16326 comm="systemd-timedat" path="/usr/lib/systemd/ntp-units.d/50-chronyd.list" dev="dm-1" ino=4870675 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:ntpd_unit_t:s0 tclass=file permissive=1
>
> type=AVC msg=audit(1553013821.622:9902): avc: denied { getattr } for pid=16281 comm="systemd-timedat" path="/usr/lib/systemd/ntp-units.d" dev="dm-1" ino=4700094 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:systemd_unit_t:s0 tclass=dir permissive=1
> type=AVC msg=audit(1553013821.622:9903): avc: denied { read } for pid=16281 comm="systemd-timedat" name="ntp-units.d" dev="dm-1" ino=4700094 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:systemd_unit_t:s0 tclass=dir permissive=1
> type=AVC msg=audit(1553013821.622:9903): avc: denied { open } for pid=16281 comm="systemd-timedat" path="/usr/lib/systemd/ntp-units.d" dev="dm-1" ino=4700094 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:systemd_unit_t:s0 tclass=dir permissive=1
>
> Signed-off-by: Dave Sugar <[email protected]>
> ---
> policy/modules/services/ntp.te | 3 +++
> policy/modules/system/init.if | 10 ++++++++++
> 2 files changed, 13 insertions(+)
>
> diff --git a/policy/modules/services/ntp.te b/policy/modules/services/ntp.te
> index eff38486..85747e76 100644
> --- a/policy/modules/services/ntp.te
> +++ b/policy/modules/services/ntp.te
> @@ -138,10 +138,13 @@ userdom_dontaudit_use_unpriv_user_fds(ntpd_t)
> userdom_list_user_home_dirs(ntpd_t)
>
> ifdef(`init_systemd',`
> + allow ntpd_t ntpd_unit_t:file read_file_perms;
> +
> dbus_system_bus_client(ntpd_t)
> dbus_connect_system_bus(ntpd_t)
> init_dbus_chat(ntpd_t)
> init_get_system_status(ntpd_t)
> + init_list_unit_dirs(ntpd_t)
> # for /var/lib/systemd/timesync
> init_read_var_lib_links(ntpd_t)
> allow ntpd_t self:capability { fowner setpcap };
> diff --git a/policy/modules/system/init.if b/policy/modules/system/init.if
> index 2a17910e..4f4d4d2c 100644
> --- a/policy/modules/system/init.if
> +++ b/policy/modules/system/init.if
> @@ -2960,6 +2960,16 @@ interface(`init_search_units',`
> fs_search_tmpfs($1)
> ')
>
> +interface(`init_list_unit_dirs',`
> + gen_require(`
> + type systemd_unit_t;
> + ')
> +
> + allow $1 systemd_unit_t:dir list_dir_perms;
> +
> + init_search_units($1)
> +')

Missing documentation.



--
Chris PeBenito