Received-SPF: pass (google.com: best guess record for domain of selinux-refpolicy-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Tue, 2 Jul 2019 18:03:51 +0200
From:   Dominick Grift <dac.override@gmail.com>
To:     "Sugar, David" <dsugar@tresys.com>
Cc:     "selinux-refpolicy@vger.kernel.org" 
        <selinux-refpolicy@vger.kernel.org>
Subject: Re: [PATCH 2/5] grant permission for rpm to write to audit log
Message-ID: <20190702160351.GB27193@brutus.lan>
Mail-Followup-To: "Sugar, David" <dsugar@tresys.com>,
        "selinux-refpolicy@vger.kernel.org" <selinux-refpolicy@vger.kernel.org>
References: <20190702153014.14097-1-dsugar@tresys.com>
 <20190702153014.14097-3-dsugar@tresys.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
        protocol="application/pgp-signature"; boundary="RASg3xLB4tUQ4RcS"
Content-Disposition: inline
In-Reply-To: <20190702153014.14097-3-dsugar@tresys.com>
User-Agent: Every email client sucks, this one just sucks less.
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk


--RASg3xLB4tUQ4RcS
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Tue, Jul 02, 2019 at 03:30:30PM +0000, Sugar, David wrote:
> Messages like this are added to the audit log when an rpm is installed:
> type=3DSOFTWARE_UPDATE msg=3Daudit(1560913896.581:244): pid=3D1265 uid=3D=
0 auid=3D4294967295 ses=3D4294967295 subj=3Dsystem_u:system_r:rpm_t:s0 msg=
=3D'sw=3D"ntpdate-4.2.6p5-25.el7_3.2.x86_64" sw_type=3Drpm key_enforce=3D0 =
gpg_res=3D0 root_dir=3D"/" comm=3D"rpm" exe=3D"/usr/bin/rpm" hostname=3D? a=
ddr=3D?  terminal=3D? res=3Dsuccess'
>=20
> These are the denials that I'm seeing:
> type=3DAVC msg=3Daudit(1560913896.581:243): avc:  denied  { audit_write }=
 for  pid=3D1265 comm=3D"rpm" capability=3D29 scontext=3Dsystem_u:system_r:=
rpm_t:s0 tcontext=3Dsystem_u:system_r:rpm_t:s0 tclass=3Dcapability permissi=
ve=3D1
>=20
> type=3DAVC msg=3Daudit(1561298132.446:240): avc:  denied  { create } for =
pid=3D1266 comm=3D"rpm" scontext=3Dsystem_u:system_r:rpm_t:s0 tcontext=3Dsy=
stem_u:system_r:rpm_t:s0 tclass=3Dnetlink_audit_socket permissive=3D1
> type=3DAVC msg=3Daudit(1561298132.446:241): avc:  denied  { write } for p=
id=3D1266 comm=3D"rpm" scontext=3Dsystem_u:system_r:rpm_t:s0 tcontext=3Dsys=
tem_u:system_r:rpm_t:s0 tclass=3Dnetlink_audit_socket permissive=3D1
> type=3DAVC msg=3Daudit(1561298132.446:241): avc:  denied  { nlmsg_relay }=
 for  pid=3D1266 comm=3D"rpm" scontext=3Dsystem_u:system_r:rpm_t:s0 tcontex=
t=3Dsystem_u:system_r:rpm_t:s0 tclass=3Dnetlink_audit_socket permissive=3D1
> type=3DAVC msg=3Daudit(1561298132.447:243): avc:  denied  { read } for pi=
d=3D1266 comm=3D"rpm" scontext=3Dsystem_u:system_r:rpm_t:s0 tcontext=3Dsyst=
em_u:system_r:rpm_t:s0 tclass=3Dnetlink_audit_socket permissive=3D1

There is an interface for that: logging_send_audit_msgs(rpm_t)

>=20
> Signed-off-by: Dave Sugar <dsugar@tresys.com>
> ---
>  policy/modules/admin/rpm.te | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>=20
> diff --git a/policy/modules/admin/rpm.te b/policy/modules/admin/rpm.te
> index 0e6e9c03..a28a24d3 100644
> --- a/policy/modules/admin/rpm.te
> +++ b/policy/modules/admin/rpm.te
> @@ -73,7 +73,7 @@ files_tmpfs_file(rpm_script_tmpfs_t)
>  # rpm Local policy
>  #
> =20
> -allow rpm_t self:capability { chown dac_override fowner fsetid ipc_lock =
mknod setfcap setgid setuid sys_chroot sys_nice sys_tty_config };
> +allow rpm_t self:capability { audit_write chown dac_override fowner fset=
id ipc_lock mknod setfcap setgid setuid sys_chroot sys_nice sys_tty_config =
};
>  allow rpm_t self:process { transition signal_perms getsched setsched get=
session getpgid setpgid getcap setcap share getattr setexec setfscreate noa=
tsecure siginh setrlimit rlimitinh dyntransition execmem setkeycreate setso=
ckcreate getrlimit };
>  allow rpm_t self:fd use;
>  allow rpm_t self:fifo_file rw_fifo_file_perms;
> @@ -87,6 +87,7 @@ allow rpm_t self:msgq create_msgq_perms;
>  allow rpm_t self:msg { send receive };
>  allow rpm_t self:file rw_file_perms;
>  allow rpm_t self:netlink_kobject_uevent_socket create_socket_perms;
> +allow rpm_t self:netlink_audit_socket { nlmsg_relay create_socket_perms =
};
> =20
>  allow rpm_t rpm_log_t:file { append_file_perms create_file_perms setattr=
_file_perms };
>  logging_log_filetrans(rpm_t, rpm_log_t, file)
> --=20
> 2.21.0
>=20

--=20
Key fingerprint =3D 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
https://sks-keyservers.net/pks/lookup?op=3Dget&search=3D0x3B6C5F1D2C7B6B02
Dominick Grift

--RASg3xLB4tUQ4RcS
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQGzBAEBCAAdFiEEujmXliIBLFTc2Y4AJXSOVTf5R2kFAl0bgGMACgkQJXSOVTf5
R2k+BAv/dudwUGASFZcXKaGuLiLsdp1CufpwFWdvYuj7GedUOEG/Of+1vAL0Lrx2
VTQWfp/wZLl1zCg1Y5MxRBLaRNMsETvXc1c9rWexPIikufMR0TlUmUyw2goHIA+x
IPaEbJQiywFXP3p6Owv2ZhWPJ+R6JQhLhJWaZCmG4ckiK+LYM1zNRQvg2dESeWTD
Xwv65vYImUmnvtFU6nc8SG5O99syULeYbWf0ekT60o/XHbF61k86ynQAf3BKQfnR
nCFpZ5tJKPI11pWiYjGQbVW1kproRFq3vk7/voP+Eu46ezYfFvyDX3BhTL+1X6S+
T1CbFdKkqTrqZXD/fjpM3dp6VP+3fXOFudKR34XqMr8rEIhnJR7Pzn62XCU6jg6W
xF1wITBM8g4D29TzsWkotb5fXVg7ccKJnq7I39srajDqu/FWIgB7X+YuXMem8pGh
i6eI/Es8Kkb0NznBk6/NCklsqUiXEJ5wlWKieARIPZ/hnOEkOK/ml7+1GJ3VGoUQ
UHHkBDO5
=rbta
-----END PGP SIGNATURE-----

--RASg3xLB4tUQ4RcS--