Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.6 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_PASS, USER_AGENT_MUTT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3D64BC43387 for ; Fri, 4 Jan 2019 07:51:29 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 02961208E3 for ; Fri, 4 Jan 2019 07:51:29 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=coker.com.au header.i=@coker.com.au header.b="tF5CyTXE" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1725958AbfADHv2 (ORCPT ); Fri, 4 Jan 2019 02:51:28 -0500 Received: from smtp.sws.net.au ([46.4.88.250]:40106 "EHLO smtp.sws.net.au" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726637AbfADHv2 (ORCPT ); Fri, 4 Jan 2019 02:51:28 -0500 Received: from liv.coker.com.au (localhost [127.0.0.1]) by smtp.sws.net.au (Postfix) with ESMTP id EE27BEFEB for ; Fri, 4 Jan 2019 18:51:25 +1100 (AEDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=coker.com.au; s=2008; t=1546588286; bh=3IT/6nHTrzfH73XzbAjMhI3YWZurtZGaoyHrxm3JK50=; l=8090; h=Date:From:To:Subject:From; b=tF5CyTXEnKb7ZsrnHfAfHmY/DLFS4f4oLEQy/nH3U+7uDbG4ebxdhGqDNuAQ5qmwE RRR/5FrTAIVQzQe5dkaxT27bNHKEvkb8M6qX37G4IwQI3cRTrpWJmgNqiWVc0c5xDA rC/sM5SGSIelMFNezCD9Enjnr8eHV9CVXOjz6KKI= Received: by liv.coker.com.au (Postfix, from userid 1000) id BF3392D1E98; Fri, 4 Jan 2019 18:51:18 +1100 (AEDT) Date: Fri, 4 Jan 2019 18:51:18 +1100 From: Russell Coker To: selinux-refpolicy@vger.kernel.org Subject: [PATCH] systemd related interfaces Message-ID: <20190104075118.GA11721@aaa.coker.com.au> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.10.1 (2018-07-13) Sender: selinux-refpolicy-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux-refpolicy@vger.kernel.org This patch has interface changes related to systemd support as well as policy that uses the new interfaces. Index: refpolicy-2.20180701/policy/modules/admin/sudo.if =================================================================== --- refpolicy-2.20180701.orig/policy/modules/admin/sudo.if +++ refpolicy-2.20180701/policy/modules/admin/sudo.if @@ -154,6 +154,9 @@ template(`sudo_role_template',` optional_policy(` dbus_system_bus_client($1_sudo_t) + ifdef(`init_systemd',` + init_dbus_chat($1_sudo_t) + ') ') optional_policy(` Index: refpolicy-2.20180701/policy/modules/services/dbus.if =================================================================== --- refpolicy-2.20180701.orig/policy/modules/services/dbus.if +++ refpolicy-2.20180701/policy/modules/services/dbus.if @@ -318,6 +318,25 @@ interface(`dbus_read_lib_files',` ######################################## ## +## Relabel system dbus lib directory. +## +## +## +## Domain allowed access. +## +## +# +interface(`dbus_relabel_lib_dirs',` + gen_require(` + type system_dbusd_var_lib_t; + ') + + files_search_var_lib($1) + allow $1 system_dbusd_var_lib_t:dir { relabelfrom relabelto }; +') + +######################################## +## ## Create, read, write, and delete ## system dbus lib files. ## Index: refpolicy-2.20180701/policy/modules/system/init.if =================================================================== --- refpolicy-2.20180701.orig/policy/modules/system/init.if +++ refpolicy-2.20180701/policy/modules/system/init.if @@ -1134,6 +1134,25 @@ interface(`init_dbus_chat',` ######################################## ## +## read/follow symlinks under /var/lib/systemd/ +## +## +## +## Domain allowed access. +## +## +# +interface(`init_read_var_lib_links',` + gen_require(` + type init_var_lib_t; + ') + + allow $1 init_var_lib_t:dir list_dir_perms; + allow $1 init_var_lib_t:lnk_file read_lnk_file_perms; +') + +######################################## +## ## List /var/lib/systemd/ dir ## ## @@ -1304,23 +1323,13 @@ interface(`init_pid_filetrans',` ## # interface(`init_getattr_initctl',` - ifdef(`init_systemd',` - # stat /run/systemd/initctl/fifo - gen_require(` - type init_var_run_t; - ') - - allow $1 init_var_run_t:fifo_file getattr; - allow $1 init_var_run_t:dir list_dir_perms; - ',` - gen_require(` - type initctl_t; - ') - - dev_list_all_dev_nodes($1) - files_search_pids($1) - allow $1 initctl_t:fifo_file getattr; + gen_require(` + type initctl_t; ') + + files_search_pids($1) + dev_list_all_dev_nodes($1) + allow $1 initctl_t:fifo_file getattr; ') ######################################## @@ -1859,6 +1868,25 @@ interface(`init_ptrace',` ######################################## ## +## get init process stats +## +## +## +## Domain allowed access. +## +## +## +# +interface(`init_getattr',` + gen_require(` + type init_t; + ') + + allow $1 init_t:process getattr; +') + +######################################## +## ## Write an init script unnamed pipe. ## ## @@ -2822,6 +2850,25 @@ interface(`init_search_units',` fs_search_tmpfs($1) ') +###################################### +## +## read systemd unit lnk files (usually under /run/systemd/units/) +## +## +## +## Domain allowed access. +## +## +# +interface(`init_read_unit_links',` + gen_require(` + type init_var_run_t, systemd_unit_t; + ') + + search_dirs_pattern($1, init_var_run_t, systemd_unit_t) + allow $1 init_var_run_t:lnk_file read_lnk_file_perms; +') + ######################################## ## ## Get status of generic systemd units. @@ -3030,3 +3077,21 @@ interface(`init_admin',` init_stop_system($1) init_telinit($1) ') + +######################################## +## +## Allow getting init_t rlimit +## +## +## +## Source domain +## +## +# +interface(`init_getrlimit',` + gen_require(` + type init_t; + ') + + allow $1 init_t:process getrlimit; +') Index: refpolicy-2.20180701/policy/modules/system/systemd.if =================================================================== --- refpolicy-2.20180701.orig/policy/modules/system/systemd.if +++ refpolicy-2.20180701/policy/modules/system/systemd.if @@ -307,6 +307,8 @@ interface(`systemd_use_passwd_agent',` manage_sock_files_pattern($1, systemd_passwd_var_run_t, systemd_passwd_var_run_t) allow systemd_passwd_agent_t $1:process signull; + allow systemd_passwd_agent_t $1:dir search; + allow systemd_passwd_agent_t $1:file read_file_perms; allow systemd_passwd_agent_t $1:unix_dgram_socket sendto; ') @@ -828,3 +830,22 @@ interface(`systemd_getattr_updated_runti getattr_files_pattern($1, systemd_update_run_t, systemd_update_run_t) ') + +####################################### +## +## Allow domain to list dirs under /run/systemd/netif +## +## +## +## domain permitted the access +## +## +# +interface(`systemd_list_netif',` + gen_require(` + type systemd_networkd_var_run_t; + ') + + init_list_pids($1) + allow $1 systemd_networkd_var_run_t:dir list_dir_perms; +') Index: refpolicy-2.20180701/policy/modules/services/ntp.te =================================================================== --- refpolicy-2.20180701.orig/policy/modules/services/ntp.te +++ refpolicy-2.20180701/policy/modules/services/ntp.te @@ -142,6 +142,8 @@ ifdef(`init_systemd',` dbus_connect_system_bus(ntpd_t) init_dbus_chat(ntpd_t) init_get_system_status(ntpd_t) + # for /var/lib/systemd/timesync + init_read_var_lib_links(ntpd_t) allow ntpd_t self:capability { fowner setpcap }; init_read_state(ntpd_t) init_reload(ntpd_t) @@ -150,7 +152,7 @@ ifdef(`init_systemd',` init_list_var_lib_dirs(ntpd_t) # for /run/systemd/netif/links - init_list_pids(ntpd_t) + systemd_list_netif(ntpd_t) optional_policy(` unconfined_dbus_send(ntpd_t) Index: refpolicy-2.20180701/policy/modules/system/systemd.te =================================================================== --- refpolicy-2.20180701.orig/policy/modules/system/systemd.te +++ refpolicy-2.20180701/policy/modules/system/systemd.te @@ -736,6 +736,7 @@ term_setattr_generic_ptys(systemd_nspawn term_use_ptmx(systemd_nspawn_t) init_domtrans_script(systemd_nspawn_t) +init_getrlimit(systemd_nspawn_t) init_kill_scripts(systemd_nspawn_t) init_read_state(systemd_nspawn_t) init_search_run(systemd_nspawn_t) @@ -1027,6 +1028,7 @@ tunable_policy(`systemd_tmpfiles_manage_ optional_policy(` dbus_read_lib_files(systemd_tmpfiles_t) + dbus_relabel_lib_dirs(systemd_tmpfiles_t) ') optional_policy(` Index: refpolicy-2.20180701/policy/modules/system/logging.te =================================================================== --- refpolicy-2.20180701.orig/policy/modules/system/logging.te +++ refpolicy-2.20180701/policy/modules/system/logging.te @@ -541,15 +541,19 @@ ifdef(`init_systemd',` dev_read_urand(syslogd_t) dev_write_kmsg(syslogd_t) + domain_getattr_all_domains(syslogd_t) domain_read_all_domains_state(syslogd_t) init_create_pid_dirs(syslogd_t) init_daemon_pid_file(syslogd_var_run_t, dir, "syslogd") + init_getattr(syslogd_t) init_rename_pid_files(syslogd_t) init_delete_pid_files(syslogd_t) init_dgram_send(syslogd_t) init_read_pid_pipes(syslogd_t) init_read_state(syslogd_t) + # for /run/systemd/units/invocation:* links + init_read_unit_links(syslogd_t) systemd_manage_journal_files(syslogd_t)