Subject: Re: [PATCH misc 2/3] selinuxutil sysnetwork consolekit apt dpkg udev
 iptables logrotate, and gpm
To:     Russell Coker <russell@coker.com.au>,
        selinux-refpolicy@vger.kernel.org
References: <20190102084500.GB31076@aaa.coker.com.au>
From:   Chris PeBenito <pebenito@ieee.org>
Message-ID: <ff620905-5c53-8b3d-749e-d04719195fba@ieee.org>
Date:   Wed, 2 Jan 2019 19:07:19 -0500
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
 Thunderbird/60.3.0
MIME-Version: 1.0
In-Reply-To: <20190102084500.GB31076@aaa.coker.com.au>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk

On 1/2/19 3:45 AM, Russell Coker wrote:
> Lots of little stuff.
> 
> Also the sysnet_dns_name_resolve() change the previous patch needed.
> 
[...]

> --- refpolicy-2.20180701.orig/policy/modules/services/consolekit.te
> +++ refpolicy-2.20180701/policy/modules/services/consolekit.te
> @@ -27,7 +27,7 @@ init_daemon_pid_file(consolekit_var_run_
>   # Local policy
>   #
>   
> -allow consolekit_t self:capability { chown dac_override fowner setgid setuid sys_admin sys_nice sys_ptrace sys_tty_config };
> +allow consolekit_t self:capability { chown dac_override dac_read_search fowner setgid setuid sys_admin sys_nice sys_ptrace sys_tty_config };

Since you're getting the dac_read_search denial, the dac_override 
probably isn't necessary anymore.  Can you retest without it?


[...]
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/system/udev.te
> +++ refpolicy-2.20180701/policy/modules/system/udev.te
[...]

> @@ -328,6 +324,11 @@ optional_policy(`
>   ')
>   
>   optional_policy(`
> +	iptables_domtrans(udev_t)
> +	iptables_write_pipe(udev_t)

I'm not clear why this separate pipe interface is necessary, as that 
access should be provided by the domtrans interface already.


> --- refpolicy-2.20180701.orig/policy/modules/system/iptables.if
> +++ refpolicy-2.20180701/policy/modules/system/iptables.if
> @@ -25,6 +25,24 @@ interface(`iptables_domtrans',`
>   
>   ########################################
>   ## <summary>
> +##	Allow iptables to write to a pipe
> +## </summary>
> +## <param name="domain">
> +##	<summary>
> +##	Domain to be written to
> +##	</summary>
> +## </param>
> +#
> +interface(`iptables_write_pipe',`

Should be iptables_write_inherited_pipe().

> +	gen_require(`
> +		type iptables_t;
> +	')
> +
> +	allow iptables_t $1:fifo_file write;
> +')
> +

-- 
Chris PeBenito