Subject: Re: [PATCH] Add sigrok contrib module
To:     Guido Trentalancia <guido@trentalancia.com>,
        selinux-refpolicy@vger.kernel.org
References: <1546098044.20582.6.camel@trentalancia.com>
From:   Chris PeBenito <pebenito@ieee.org>
Message-ID: <b9008fe7-ef33-1f2d-40ae-f4e23aa3f369@ieee.org>
Date:   Wed, 2 Jan 2019 18:47:16 -0500
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
 Thunderbird/60.3.0
MIME-Version: 1.0
In-Reply-To: <1546098044.20582.6.camel@trentalancia.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk

On 12/29/18 10:40 AM, Guido Trentalancia wrote:
> Add a SELinux Reference Policy module for the sigrok
> signal analysis software suite (command-line interface).
> 
> Signed-off-by: Guido Trentalancia <guido@trentalancia.com>
> ---
>   policy/modules/contrib/sigrok.fc   |    1
>   policy/modules/contrib/sigrok.if   |   37 +++++++++++++++++++++++++++++++++++
>   policy/modules/contrib/sigrok.te   |   39 +++++++++++++++++++++++++++++++++++++
>   policy/modules/roles/unprivuser.te |    4 +++
>   4 files changed, 81 insertions(+)
> 
> diff -pruN a/policy/modules/contrib/sigrok.fc b/policy/modules/contrib/sigrok.fc
> --- a/policy/modules/contrib/sigrok.fc	1970-01-01 01:00:00.000000000 +0100
> +++ b/policy/modules/contrib/sigrok.fc	2018-12-25 21:33:17.512518983 +0100
> @@ -0,0 +1 @@
> +/usr/bin/sigrok-cli	--	gen_context(system_u:object_r:sigrok_exec_t,s0)
> diff -pruN a/policy/modules/contrib/sigrok.if b/policy/modules/contrib/sigrok.if
> --- a/policy/modules/contrib/sigrok.if	1970-01-01 01:00:00.000000000 +0100
> +++ b/policy/modules/contrib/sigrok.if	2018-12-29 14:52:30.771773190 +0100
> @@ -0,0 +1,37 @@
> +## <summary>sigrok signal analysis software suite.</summary>
> +
> +########################################
> +## <summary>
> +##	Role access for sigrok.
> +## </summary>
> +## <param name="role">
> +##	<summary>
> +##	Role allowed access.
> +##	</summary>
> +## </param>
> +## <param name="domain">
> +##	<summary>
> +##	User domain for the role.
> +##	</summary>
> +## </param>
> +#
> +interface(`sigrok_role',`
> +	gen_require(`
> +		type sigrok_t, sigrok_exec_t;
> +		attribute_role sigrok_roles;
> +	')
> +
> +	########################################
> +	#
> +	# Declarations
> +	#
> +
> +	roleattribute $1 sigrok_roles;
> +
> +	########################################
> +	#
> +	# Policy
> +	#
> +
> +	domtrans_pattern($2, sigrok_exec_t, sigrok_t)
> +')

Is there going to be future content for this module, especially for this 
interface?  It is the equivalent of a "run" interface, which would make 
more sense, unless there will be more content added in the future.


> diff -pruN a/policy/modules/contrib/sigrok.te b/policy/modules/contrib/sigrok.te
> --- a/policy/modules/contrib/sigrok.te	1970-01-01 01:00:00.000000000 +0100
> +++ b/policy/modules/contrib/sigrok.te	2018-12-29 16:25:21.851742375 +0100
> @@ -0,0 +1,39 @@
> +policy_module(sigrok, 1.0.0)
> +
> +########################################
> +#
> +# Declarations
> +#
> +
> +attribute_role sigrok_roles;
> +roleattribute system_r sigrok_roles;
> +
> +type sigrok_t;
> +type sigrok_exec_t;
> +userdom_user_application_domain(sigrok_t, sigrok_exec_t)
> +role sigrok_roles types sigrok_t;
> +
> +########################################
> +#
> +# Local policy
> +#
> +
> +allow sigrok_t self:fifo_file rw_fifo_file_perms;
> +allow sigrok_t self:netlink_kobject_uevent_socket create_socket_perms;
> +allow sigrok_t self:tcp_socket create_socket_perms;
> +
> +corenet_tcp_connect_all_unreserved_ports(sigrok_t)
> +
> +dev_getattr_sysfs_dirs(sigrok_t)
> +dev_read_sysfs(sigrok_t)
> +dev_rw_generic_usb_dev(sigrok_t)
> +
> +files_read_etc_files(sigrok_t)
> +
> +term_use_unallocated_ttys(sigrok_t)
> +
> +userdom_use_user_ptys(sigrok_t)
> +
> +optional_policy(`
> +	udev_read_pid_files(sigrok_t)
> +')
> diff -pruN a/policy/modules/roles/unprivuser.te b/policy/modules/roles/unprivuser.te
> --- a/policy/modules/roles/unprivuser.te	2017-05-13 21:22:22.837046352 +0200
> +++ b/policy/modules/roles/unprivuser.te	2018-12-28 20:07:33.588429238 +0100
> @@ -146,6 +146,10 @@ ifndef(`distro_redhat',`
>   	')
>   
>   	optional_policy(`
> +		sigrok_role(user_r, user_t)
> +	')
> +
> +	optional_policy(`
>   		spamassassin_role(user_r, user_t)
>   	')
>   
> 


-- 
Chris PeBenito