From:   Dominick Grift <dac.override@gmail.com>
To:     Russell Coker <russell@coker.com.au>
Cc:     "selinux-refpolicy\@vger.kernel.org" 
        <selinux-refpolicy@vger.kernel.org>
Subject: Re: [PATCH] more tiny stuff
References: <20190119120444.GA1199@xev>
Date:   Sat, 19 Jan 2019 13:14:49 +0100
In-Reply-To: <20190119120444.GA1199@xev> (Russell Coker's message of "Sat, 19
        Jan 2019 23:04:44 +1100")
Message-ID: <875zuk269y.fsf@gmail.com>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.1 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk

Russell Coker <russell@coker.com.au> writes:

> I think the old timesync labelling wasn't working anyway due to -- for a
> directory name.
>
> A couple of patches for devicekit calling dmidecode (this is part of replacing
> some kmem access that was discussed on this list and rejected as a misfeature
> in Debian DMI related code ages ago).
>
> The rest should be obvious.
>
> Index: refpolicy-2.20180701/policy/modules/services/ntp.fc
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/services/ntp.fc
> +++ refpolicy-2.20180701/policy/modules/services/ntp.fc
> @@ -32,7 +32,7 @@
>  /var/lib/ntp(/.*)?				gen_context(system_u:object_r:ntp_drift_t,s0)
>  /var/lib/sntp-kod(/.*)?				gen_context(system_u:object_r:ntp_drift_t,s0)
>  /var/lib/systemd/clock			--	gen_context(system_u:object_r:ntp_drift_t,s0)
> -/var/lib/private/systemd/timesync(/.*)? --	gen_context(system_u:object_r:ntp_drift_t,s0)
> +/var/lib/systemd/timesync(/.*)?			gen_context(system_u:object_r:ntp_drift_t,s0)

Yes that and systemd-timesync no longer uses DynamicUser= and so
/var/lib/private no longer applies

Also refpolicy should consider making /var/{lib/private,cache/private,log/private} equivalent to
/var/lib, /var/cache and /var/log respectively

>  
>  /var/lock/ntpdate                       --      gen_context(system_u:object_r:ntpd_lock_t,s0)
>  
> Index: refpolicy-2.20180701/policy/modules/admin/dmidecode.te
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/admin/dmidecode.te
> +++ refpolicy-2.20180701/policy/modules/admin/dmidecode.te
> @@ -32,3 +32,9 @@ mls_file_read_all_levels(dmidecode_t)
>  locallogin_use_fds(dmidecode_t)
>  
>  userdom_use_inherited_user_terminals(dmidecode_t)
> +
> +ifdef(`init_systemd',`
> +	# inherits /dev/null and a socket from devicekit_disk_t
> +	init_use_fds(dmidecode_t)
> +	init_rw_inherited_stream_socket(dmidecode_t)
> +')
> Index: refpolicy-2.20180701/policy/modules/services/devicekit.te
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/services/devicekit.te
> +++ refpolicy-2.20180701/policy/modules/services/devicekit.te
> @@ -177,6 +177,10 @@ optional_policy(`
>  ')
>  
>  optional_policy(`
> +	dmidecode_domtrans(devicekit_disk_t)
> +')
> +
> +optional_policy(`
>  	fstools_domtrans(devicekit_disk_t)
>  ')
>  
> Index: refpolicy-2.20180701/policy/modules/services/xserver.te
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/services/xserver.te
> +++ refpolicy-2.20180701/policy/modules/services/xserver.te
> @@ -291,6 +291,8 @@ kernel_request_load_module(xauth_t)
>  
>  domain_use_interactive_fds(xauth_t)
>  
> +dev_read_sysfs(xauth_t)
> +
>  files_read_etc_files(xauth_t)
>  files_search_pids(xauth_t)
>  
> Index: refpolicy-2.20180701/policy/modules/system/unconfined.te
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/system/unconfined.te
> +++ refpolicy-2.20180701/policy/modules/system/unconfined.te
> @@ -59,6 +59,9 @@ ifdef(`direct_sysadm_daemon',`
>  ')
>  
>  ifdef(`init_systemd',`
> +	# for systemd-analyze
> +	init_service_status(unconfined_t)
> +
>  	optional_policy(`
>  		systemd_dbus_chat_resolved(unconfined_t)
>  	')

-- 
Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02
Dominick Grift