Subject: Re: [PATCH misc 1/3] backup boinc fetchmail, gdomap jabber mon
 syncthing ssh and login
To:     Russell Coker <russell@coker.com.au>,
        selinux-refpolicy@vger.kernel.org
References: <20190102084045.GA31076@aaa.coker.com.au>
From:   Chris PeBenito <pebenito@ieee.org>
Message-ID: <b1a8f09d-fb0b-b9e4-1229-6de5cfb1a5fc@ieee.org>
Date:   Wed, 2 Jan 2019 18:52:55 -0500
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
 Thunderbird/60.3.0
MIME-Version: 1.0
In-Reply-To: <20190102084045.GA31076@aaa.coker.com.au>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk

On 1/2/19 3:40 AM, Russell Coker wrote:
> Lots of little things that are self-explanatory.
> 
> Boinc has some unusual stuff for lsb_release -a and for mmaping ld.so.cache.
> 
> Remove obsolete policy from syncthing as we have it in
> sysnet_dns_name_resolve().
> 

[...]
> Index: refpolicy-2.20180701/policy/modules/services/boinc.te
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/services/boinc.te
> +++ refpolicy-2.20180701/policy/modules/services/boinc.te
[...]

> @@ -169,7 +173,7 @@ optional_policy(`
>   #
>   
>   allow boinc_project_t self:capability { setgid setuid };
> -allow boinc_project_t self:process { execmem execstack noatsecure ptrace setcap getcap setpgid setsched signal_perms };
> +allow boinc_project_t self:process { execmem execstack noatsecure ptrace setcap getcap setpgid setsched signal signal_perms };

This change shouldn't be necessary since signal is already in signal_perms.

[...]

> --- refpolicy-2.20180701.orig/policy/modules/system/authlogin.if
> +++ refpolicy-2.20180701/policy/modules/system/authlogin.if
> @@ -823,6 +823,25 @@ interface(`auth_append_lastlog',`
>   
>   #######################################
>   ## <summary>
> +##	relabel the last logins log.
> +## </summary>
> +## <param name="domain">
> +##	<summary>
> +##	Domain allowed access.
> +##	</summary>
> +## </param>
> +#
> +interface(`auth_relabel_lastlog',`
> +	gen_require(`
> +		type lastlog_t;
> +	')
> +
> +	logging_search_logs($1)
> +	allow $1 lastlog_t:file { relabelfrom relabelto };
> +')
> +
> +#######################################
> +## <summary>
>   ##	Read and write to the last logins log.
>   ## </summary>
>   ## <param name="domain">
> @@ -841,6 +860,25 @@ interface(`auth_rw_lastlog',`
>   ')
>   
>   ########################################
> +## <summary>
> +##     Manage the last logins log.
> +## </summary>
> +## <param name="domain">
> +##     <summary>
> +##     Domain allowed access.
> +##     </summary>
> +## </param>
> +#
> +interface(`auth_manage_lastlog',`
> +	gen_require(`
> +		type lastlog_t;
> +	')
> +
> +	allow $1 lastlog_t:file { relabelfrom relabelto manage_file_perms };

The relabel perms shouldn't be in here.  I'd say split it into a new 
interface, but you're adding the other interface earlier in the patch.


-- 
Chris PeBenito