2019-01-19 12:04:51

by Russell Coker

Subject: [PATCH] more tiny stuff

I think the old timesync labelling wasn't working anyway due to -- for a
directory name.

A couple of patches for devicekit calling dmidecode (this is part of replacing
some kmem access that was discussed on this list and rejected as a misfeature
in Debian DMI related code ages ago).

The rest should be obvious.

Index: refpolicy-2.20180701/policy/modules/services/ntp.fc
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/ntp.fc
+++ refpolicy-2.20180701/policy/modules/services/ntp.fc
@@ -32,7 +32,7 @@
/var/lib/ntp(/.*)? gen_context(system_u:object_r:ntp_drift_t,s0)
/var/lib/sntp-kod(/.*)? gen_context(system_u:object_r:ntp_drift_t,s0)
/var/lib/systemd/clock -- gen_context(system_u:object_r:ntp_drift_t,s0)
-/var/lib/private/systemd/timesync(/.*)? -- gen_context(system_u:object_r:ntp_drift_t,s0)
+/var/lib/systemd/timesync(/.*)? gen_context(system_u:object_r:ntp_drift_t,s0)

/var/lock/ntpdate -- gen_context(system_u:object_r:ntpd_lock_t,s0)

Index: refpolicy-2.20180701/policy/modules/admin/dmidecode.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/admin/dmidecode.te
+++ refpolicy-2.20180701/policy/modules/admin/dmidecode.te
@@ -32,3 +32,9 @@ mls_file_read_all_levels(dmidecode_t)
locallogin_use_fds(dmidecode_t)

userdom_use_inherited_user_terminals(dmidecode_t)
+
+ifdef(`init_systemd',`
+ # inherits /dev/null and a socket from devicekit_disk_t
+ init_use_fds(dmidecode_t)
+ init_rw_inherited_stream_socket(dmidecode_t)
+')
Index: refpolicy-2.20180701/policy/modules/services/devicekit.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/devicekit.te
+++ refpolicy-2.20180701/policy/modules/services/devicekit.te
@@ -177,6 +177,10 @@ optional_policy(`
')

optional_policy(`
+ dmidecode_domtrans(devicekit_disk_t)
+')
+
+optional_policy(`
fstools_domtrans(devicekit_disk_t)
')

Index: refpolicy-2.20180701/policy/modules/services/xserver.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/xserver.te
+++ refpolicy-2.20180701/policy/modules/services/xserver.te
@@ -291,6 +291,8 @@ kernel_request_load_module(xauth_t)

domain_use_interactive_fds(xauth_t)

+dev_read_sysfs(xauth_t)
+
files_read_etc_files(xauth_t)
files_search_pids(xauth_t)

Index: refpolicy-2.20180701/policy/modules/system/unconfined.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/system/unconfined.te
+++ refpolicy-2.20180701/policy/modules/system/unconfined.te
@@ -59,6 +59,9 @@ ifdef(`direct_sysadm_daemon',`
')

ifdef(`init_systemd',`
+ # for systemd-analyze
+ init_service_status(unconfined_t)
+
optional_policy(`
systemd_dbus_chat_resolved(unconfined_t)
')

2019-01-19 12:14:53

by Dac Override

Subject: Re: [PATCH] more tiny stuff

Russell Coker <[email protected]> writes:

> I think the old timesync labelling wasn't working anyway due to -- for a
> directory name.
>
> A couple of patches for devicekit calling dmidecode (this is part of replacing
> some kmem access that was discussed on this list and rejected as a misfeature
> in Debian DMI related code ages ago).
>
> The rest should be obvious.
>
> Index: refpolicy-2.20180701/policy/modules/services/ntp.fc
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/services/ntp.fc
> +++ refpolicy-2.20180701/policy/modules/services/ntp.fc
> @@ -32,7 +32,7 @@
> /var/lib/ntp(/.*)? gen_context(system_u:object_r:ntp_drift_t,s0)
> /var/lib/sntp-kod(/.*)? gen_context(system_u:object_r:ntp_drift_t,s0)
> /var/lib/systemd/clock -- gen_context(system_u:object_r:ntp_drift_t,s0)
> -/var/lib/private/systemd/timesync(/.*)? -- gen_context(system_u:object_r:ntp_drift_t,s0)
> +/var/lib/systemd/timesync(/.*)? gen_context(system_u:object_r:ntp_drift_t,s0)

Yes that and systemd-timesync no longer uses DynamicUser= and so
/var/lib/private no longer applies

Also refpolicy should consider making /var/{lib/private,cache/private,log/private} equivalent to
/var/lib, /var/cache and /var/log respectively

>
> /var/lock/ntpdate -- gen_context(system_u:object_r:ntpd_lock_t,s0)
>
> Index: refpolicy-2.20180701/policy/modules/admin/dmidecode.te
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/admin/dmidecode.te
> +++ refpolicy-2.20180701/policy/modules/admin/dmidecode.te
> @@ -32,3 +32,9 @@ mls_file_read_all_levels(dmidecode_t)
> locallogin_use_fds(dmidecode_t)
>
> userdom_use_inherited_user_terminals(dmidecode_t)
> +
> +ifdef(`init_systemd',`
> + # inherits /dev/null and a socket from devicekit_disk_t
> + init_use_fds(dmidecode_t)
> + init_rw_inherited_stream_socket(dmidecode_t)
> +')
> Index: refpolicy-2.20180701/policy/modules/services/devicekit.te
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/services/devicekit.te
> +++ refpolicy-2.20180701/policy/modules/services/devicekit.te
> @@ -177,6 +177,10 @@ optional_policy(`
> ')
>
> optional_policy(`
> + dmidecode_domtrans(devicekit_disk_t)
> +')
> +
> +optional_policy(`
> fstools_domtrans(devicekit_disk_t)
> ')
>
> Index: refpolicy-2.20180701/policy/modules/services/xserver.te
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/services/xserver.te
> +++ refpolicy-2.20180701/policy/modules/services/xserver.te
> @@ -291,6 +291,8 @@ kernel_request_load_module(xauth_t)
>
> domain_use_interactive_fds(xauth_t)
>
> +dev_read_sysfs(xauth_t)
> +
> files_read_etc_files(xauth_t)
> files_search_pids(xauth_t)
>
> Index: refpolicy-2.20180701/policy/modules/system/unconfined.te
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/system/unconfined.te
> +++ refpolicy-2.20180701/policy/modules/system/unconfined.te
> @@ -59,6 +59,9 @@ ifdef(`direct_sysadm_daemon',`
> ')
>
> ifdef(`init_systemd',`
> + # for systemd-analyze
> + init_service_status(unconfined_t)
> +
> optional_policy(`
> systemd_dbus_chat_resolved(unconfined_t)
> ')

--
Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02
Dominick Grift

2019-01-21 08:40:03

by Chris PeBenito

Subject: Re: [PATCH] more tiny stuff

On 1/19/19 7:04 AM, Russell Coker wrote:
> I think the old timesync labelling wasn't working anyway due to -- for a
> directory name.
>
> A couple of patches for devicekit calling dmidecode (this is part of replacing
> some kmem access that was discussed on this list and rejected as a misfeature
> in Debian DMI related code ages ago).
>
> The rest should be obvious.
>
> Index: refpolicy-2.20180701/policy/modules/services/ntp.fc
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/services/ntp.fc
> +++ refpolicy-2.20180701/policy/modules/services/ntp.fc
> @@ -32,7 +32,7 @@
> /var/lib/ntp(/.*)? gen_context(system_u:object_r:ntp_drift_t,s0)
> /var/lib/sntp-kod(/.*)? gen_context(system_u:object_r:ntp_drift_t,s0)
> /var/lib/systemd/clock -- gen_context(system_u:object_r:ntp_drift_t,s0)
> -/var/lib/private/systemd/timesync(/.*)? -- gen_context(system_u:object_r:ntp_drift_t,s0)
> +/var/lib/systemd/timesync(/.*)? gen_context(system_u:object_r:ntp_drift_t,s0)
>
> /var/lock/ntpdate -- gen_context(system_u:object_r:ntpd_lock_t,s0)
>
> Index: refpolicy-2.20180701/policy/modules/admin/dmidecode.te
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/admin/dmidecode.te
> +++ refpolicy-2.20180701/policy/modules/admin/dmidecode.te
> @@ -32,3 +32,9 @@ mls_file_read_all_levels(dmidecode_t)
> locallogin_use_fds(dmidecode_t)
>
> userdom_use_inherited_user_terminals(dmidecode_t)
> +
> +ifdef(`init_systemd',`
> + # inherits /dev/null and a socket from devicekit_disk_t
> + init_use_fds(dmidecode_t)
> + init_rw_inherited_stream_socket(dmidecode_t)
> +')
> Index: refpolicy-2.20180701/policy/modules/services/devicekit.te
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/services/devicekit.te
> +++ refpolicy-2.20180701/policy/modules/services/devicekit.te
> @@ -177,6 +177,10 @@ optional_policy(`
> ')
>
> optional_policy(`
> + dmidecode_domtrans(devicekit_disk_t)
> +')
> +
> +optional_policy(`
> fstools_domtrans(devicekit_disk_t)
> ')
>
> Index: refpolicy-2.20180701/policy/modules/services/xserver.te
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/services/xserver.te
> +++ refpolicy-2.20180701/policy/modules/services/xserver.te
> @@ -291,6 +291,8 @@ kernel_request_load_module(xauth_t)
>
> domain_use_interactive_fds(xauth_t)
>
> +dev_read_sysfs(xauth_t)
> +
> files_read_etc_files(xauth_t)
> files_search_pids(xauth_t)
>
> Index: refpolicy-2.20180701/policy/modules/system/unconfined.te
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/system/unconfined.te
> +++ refpolicy-2.20180701/policy/modules/system/unconfined.te
> @@ -59,6 +59,9 @@ ifdef(`direct_sysadm_daemon',`
> ')
>
> ifdef(`init_systemd',`
> + # for systemd-analyze
> + init_service_status(unconfined_t)
> +
> optional_policy(`
> systemd_dbus_chat_resolved(unconfined_t)
> ')

Merged.

--
Chris PeBenito