Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.6 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_PASS, URIBL_BLOCKED,USER_AGENT_MUTT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id F1468C43387 for ; Tue, 8 Jan 2019 08:51:17 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 965FA2070B for ; Tue, 8 Jan 2019 08:51:17 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=coker.com.au header.i=@coker.com.au header.b="SvwA3q+H" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727796AbfAHIvR (ORCPT ); Tue, 8 Jan 2019 03:51:17 -0500 Received: from smtp.sws.net.au ([46.4.88.250]:58414 "EHLO smtp.sws.net.au" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727454AbfAHIvR (ORCPT ); Tue, 8 Jan 2019 03:51:17 -0500 Received: from xev.coker.com.au (localhost [127.0.0.1]) by smtp.sws.net.au (Postfix) with ESMTP id ECBA6EE4C for ; Tue, 8 Jan 2019 19:51:14 +1100 (AEDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=coker.com.au; s=2008; t=1546937475; bh=PLsjqf7/ubvvGlcPuRf6x1S1qPakVaIdJG2VsJ8kiL8=; l=8993; h=Date:From:To:Subject:From; b=SvwA3q+HM6/jDiJxoqzC3/ThNx9X7p+aYY2KXK3uNLUDrJKC6QAHFf3ykq9uOjsb+ FBfj5NaXD6ef84MYYhDpGoy8vevYNIBrcHXe4JMYT76gzuc3NaXlNhOnobEMxoW48U r4I4rWto0MovzfFxblNi7I+S28MVzUu0vHCbTElM= Received: by xev.coker.com.au (Postfix, from userid 1001) id 640B4C3E93B; Tue, 8 Jan 2019 19:51:10 +1100 (AEDT) Date: Tue, 8 Jan 2019 19:51:10 +1100 From: Russell Coker To: selinux-refpolicy@vger.kernel.org Subject: [PATCH] gpg Message-ID: <20190108085110.GA28727@xev> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.10.1 (2018-07-13) Sender: selinux-refpolicy-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux-refpolicy@vger.kernel.org Description: Create user_gpg_t etc domains, remove gpg_helper_t & gpg_pinentry_t Only transition to gpg_t from user_t to solve problems with X sessions. Also remove gpg_helper_t and gpg_pinentry_t because they don't do any good. . Author: Russell Coker Last-Update: 2015-01-12 Index: refpolicy-2.20180701/policy/modules/apps/gpg.fc =================================================================== --- refpolicy-2.20180701.orig/policy/modules/apps/gpg.fc +++ refpolicy-2.20180701/policy/modules/apps/gpg.fc @@ -6,10 +6,10 @@ HOME_DIR/\.gnupg/S\.scdaemon -s gen_con /usr/bin/gpg(2)? -- gen_context(system_u:object_r:gpg_exec_t,s0) /usr/bin/gpgsm -- gen_context(system_u:object_r:gpg_exec_t,s0) /usr/bin/gpg-agent -- gen_context(system_u:object_r:gpg_agent_exec_t,s0) -/usr/bin/pinentry.* -- gen_context(system_u:object_r:gpg_pinentry_exec_t,s0) +/usr/bin/pinentry.* -- gen_context(system_u:object_r:gpg_exec_t,s0) /usr/lib/gnupg/.* -- gen_context(system_u:object_r:gpg_exec_t,s0) -/usr/lib/gnupg/gpgkeys.* -- gen_context(system_u:object_r:gpg_helper_exec_t,s0) +/usr/lib/gnupg/gpgkeys.* -- gen_context(system_u:object_r:gpg_exec_t,s0) /run/user/%{USERID}/gnupg(/.*)? gen_context(system_u:object_r:gpg_runtime_t,s0) /run/user/%{USERID}/gnupg/S\.gpg-agent.* -s gen_context(system_u:object_r:gpg_agent_tmp_t,s0) Index: refpolicy-2.20180701/policy/modules/roles/staff.te =================================================================== --- refpolicy-2.20180701.orig/policy/modules/roles/staff.te +++ refpolicy-2.20180701/policy/modules/roles/staff.te @@ -118,10 +118,6 @@ ifndef(`distro_redhat',` ') optional_policy(` - gpg_role(staff_r, staff_t) - ') - - optional_policy(` irc_role(staff_r, staff_t) ') Index: refpolicy-2.20180701/policy/modules/roles/sysadm.te =================================================================== --- refpolicy-2.20180701.orig/policy/modules/roles/sysadm.te +++ refpolicy-2.20180701/policy/modules/roles/sysadm.te @@ -1304,10 +1304,6 @@ ifndef(`distro_redhat',` ') optional_policy(` - gpg_role(sysadm_r, sysadm_t) - ') - - optional_policy(` irc_role(sysadm_r, sysadm_t) ') Index: refpolicy-2.20180701/policy/modules/apps/gpg.if =================================================================== --- refpolicy-2.20180701.orig/policy/modules/apps/gpg.if +++ refpolicy-2.20180701/policy/modules/apps/gpg.if @@ -31,6 +31,11 @@ interface(`gpg_role',` domtrans_pattern($2, gpg_exec_t, gpg_t) domtrans_pattern($2, gpg_agent_exec_t, gpg_agent_t) + # transition to user_t when running ck-launch-session or other bin_t + corecmd_bin_domtrans(gpg_agent_t, $2) + allow gpg_agent_t $2:process signull; + allow $2 gpg_agent_t:fd use; + allow $2 self:process setrlimit; allow $2 { gpg_t gpg_agent_t gpg_helper_t gpg_pinentry_t }:process { ptrace signal_perms }; ps_process_pattern($2, { gpg_t gpg_agent_t gpg_helper_t gpg_pinentry_t }) @@ -46,6 +51,9 @@ interface(`gpg_role',` filetrans_pattern($2, gpg_secret_t, gpg_agent_tmp_t, sock_file, "log-socket") userdom_user_home_dir_filetrans($2, gpg_secret_t, dir, ".gnupg") + # so gpg_agent_t can append to .xsession-errors + userdom_append_inherited_user_home_content_files(gpg_agent_t) + optional_policy(` gpg_pinentry_dbus_chat($2) ') @@ -179,6 +187,28 @@ interface(`gpg_signal',` allow $1 gpg_t:process signal; ') +####################################### +## +## Transition to $2_gpg_agent_t from another domain via gpg_agent_exec_t +## +## +## +## source domain +## +## +## +## +## base of target domain +## +## +# +interface(`gpg_enter_user_gpg_agent_domain',` + gen_require(` + type gpg_agent_exec_t, $2_gpg_agent_t; + ') + domain_auto_transition_pattern($1, gpg_agent_exec_t, $2_gpg_agent_t) +') + ######################################## ## ## Read and write gpg agent pipes. Index: refpolicy-2.20180701/policy/modules/roles/unprivuser.te =================================================================== --- refpolicy-2.20180701.orig/policy/modules/roles/unprivuser.te +++ refpolicy-2.20180701/policy/modules/roles/unprivuser.te @@ -157,8 +157,9 @@ ifndef(`distro_redhat',` spamassassin_role(user_r, user_t) ') - optional_policy(` + optional_policy(` ssh_role_template(user, user_r, user_t) + gpg_enter_user_gpg_agent_domain(user_ssh_agent_t) ') optional_policy(` Index: refpolicy-2.20180701/policy/modules/system/userdomain.if =================================================================== --- refpolicy-2.20180701.orig/policy/modules/system/userdomain.if +++ refpolicy-2.20180701/policy/modules/system/userdomain.if @@ -2139,6 +2139,24 @@ interface(`userdom_dontaudit_append_user ######################################## ## +## Allow append on inherited user home files. +## +## +## +## Domain to allow. +## +## +# +interface(`userdom_append_inherited_user_home_content_files',` + gen_require(` + type user_home_t; + ') + + allow $1 user_home_t:file { append getattr ioctl }; +') + +######################################## +## ## Do not audit attempts to write user home files. ## ## Index: refpolicy-2.20180701/policy/modules/services/ssh.if =================================================================== --- refpolicy-2.20180701.orig/policy/modules/services/ssh.if +++ refpolicy-2.20180701/policy/modules/services/ssh.if @@ -373,6 +373,7 @@ template(`ssh_role_template',` ps_process_pattern($3, $1_ssh_agent_t) domtrans_pattern($3, ssh_agent_exec_t, $1_ssh_agent_t) + userdom_append_inherited_user_home_content_files($1_ssh_agent_t) kernel_read_kernel_sysctls($1_ssh_agent_t) Index: refpolicy-2.20180701/policy/modules/services/dbus.if =================================================================== --- refpolicy-2.20180701.orig/policy/modules/services/dbus.if +++ refpolicy-2.20180701/policy/modules/services/dbus.if @@ -75,6 +75,9 @@ template(`dbus_role_template',` domain_entry_file($1_dbusd_t, dbusd_exec_t) ubac_constrained($1_dbusd_t) + # for .xsession-errors + userdom_append_inherited_user_home_content_files($1_dbusd_t) + role $2 types $1_dbusd_t; ############################## @@ -82,7 +85,7 @@ template(`dbus_role_template',` # Local policy # - allow $3 $1_dbusd_t:unix_stream_socket connectto; + allow $3 $1_dbusd_t:unix_stream_socket { connectto rw_socket_perms }; allow $3 $1_dbusd_t:dbus { send_msg acquire_svc }; allow $3 $1_dbusd_t:fd use; @@ -213,7 +216,7 @@ interface(`dbus_all_session_bus_client', allow $1 { session_bus_type self }:dbus send_msg; allow session_bus_type $1:dbus send_msg; - allow $1 session_bus_type:unix_stream_socket connectto; + allow $1 session_bus_type:unix_stream_socket { connectto rw_socket_perms }; allow $1 session_bus_type:fd use; ') @@ -246,7 +249,7 @@ interface(`dbus_spec_session_bus_client' allow $2 { $1_dbusd_t self }:dbus send_msg; allow $1_dbusd_t $2:dbus send_msg; - allow $2 $1_dbusd_t:unix_stream_socket connectto; + allow $2 $1_dbusd_t:unix_stream_socket { connectto rw_socket_perms }; allow $2 $1_dbusd_t:fd use; ') Index: refpolicy-2.20180701/policy/modules/services/cron.if =================================================================== --- refpolicy-2.20180701.orig/policy/modules/services/cron.if +++ refpolicy-2.20180701/policy/modules/services/cron.if @@ -862,10 +862,31 @@ interface(`cron_read_system_job_tmp_file ') files_search_tmp($1) + allow $1 system_cronjob_tmp_t:dir search_dir_perms; allow $1 system_cronjob_tmp_t:file read_file_perms; ') ######################################## +## +## Read/write system cron job temporary files. +## +## +## +## Domain allowed access. +## +## +# +interface(`cron_rw_system_job_tmp_files',` + gen_require(` + type system_cronjob_tmp_t; + ') + + files_search_tmp($1) + allow $1 system_cronjob_tmp_t:dir search_dir_perms; + allow $1 system_cronjob_tmp_t:file rw_file_perms; +') + +######################################## ## ## Do not audit attempts to append temporary ## system cron job files. Index: refpolicy-2.20180701/policy/modules/apps/gpg.te =================================================================== --- refpolicy-2.20180701.orig/policy/modules/apps/gpg.te +++ refpolicy-2.20180701/policy/modules/apps/gpg.te @@ -184,8 +184,9 @@ optional_policy(` ') optional_policy(` - cron_system_entry(gpg_t, gpg_exec_t) cron_read_system_job_tmp_files(gpg_t) + cron_rw_system_job_tmp_files(gpg_t) + cron_system_entry(gpg_t, gpg_exec_t) ') optional_policy(`