Received-SPF: pass (google.com: best guess record for domain of selinux-refpolicy-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Thu, 9 Jan 2020 22:42:40 +0100
From:   Dominick Grift <dac.override@gmail.com>
To:     Chris PeBenito <pebenito@ieee.org>
Cc:     refpolicy <selinux-refpolicy@vger.kernel.org>
Subject: Re: [RFC] refining systemd mountpoints
Message-ID: <20200109214240.GA2283901@brutus.lan>
Mail-Followup-To: Chris PeBenito <pebenito@ieee.org>,
        refpolicy <selinux-refpolicy@vger.kernel.org>
References: <3418ebca-80c0-b10e-c0a2-a80427fdbf71@ieee.org>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
        protocol="application/pgp-signature"; boundary="M9NhX3UHpAaciwkO"
Content-Disposition: inline
In-Reply-To: <3418ebca-80c0-b10e-c0a2-a80427fdbf71@ieee.org>
User-Agent: Every email client sucks, this one just sucks less.
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk


--M9NhX3UHpAaciwkO
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Thu, Jan 09, 2020 at 04:06:38PM -0500, Chris PeBenito wrote:
> I'd like to refine how the policy handles systemd's mounton so that it wo=
rks
> similar to how we manage mountpoints for mount_t. Since systemd can be ma=
de
> to mount over just about anything, I'm looking at adding a new conditional
> that would allow init_t to mounton non_security_file_type, and then an
> interface like files_mountpoint().
>=20
> The question is for the implementation of the interface; I see two option=
s,
> either the interface allows mounton for all file-like classes, or the
> classes are specified as a parameter:
>=20
> --------
> init.te:
> attribute init_mountpoint_type;
> allow init_t init_mountpoint_type:dir_file_class_set mounton;
>=20
> init.if:
> interface(`init_mountpoint',`
> typeattribute $1 init_mountpoint_type;
> ')
> --------
>=20
> or
>=20
> --------
> init.if:
> interface(`init_mountpoint',`
> allow init_t $1:$2 mounton;
> ')
> --------
>=20
> I like the first option because it is clearer since you can see the mount=
on
> in init.te, but that is excessive access.  The second option could be made
> to look like the first option, but it would need several attributes and
> interfaces, e.g. init_dir_mountpoint_type, init_file_mountpoint_type, etc.
> which isn't so desirable.
>=20
> Any thoughts on this?

I implemented the former in my policy. ie the dir_file_class_set equiv..

4163               (allow subj bind_path_obj_type_attribute (dirs (create)))
4164               (allow subj bind_path_obj_type_attribute list_dir_perms)
4165               (allow subj bind_path_obj_type_attribute (dir (mounton)))
4166               (allow subj bind_path_obj_type_attribute create_file_per=
ms)
4167               (allow subj bind_path_obj_type_attribute (file (mounton)=
))

As you can see i even allow systemd to create the mountpoint in case it doe=
s not exist. For example if /etc/machine-id does not exist and I have a Bin=
dReadOnlyPath=3D/etc/machine-id then systemd will touch /etc/machine-id and=
 mount it ro

It also generally buggy. Systemd does not (alway's) use setfscreatecon to c=
reate the mountpoints. And sometimes it does use setfscreatecon where it sh=
ouldnt.

https://github.com/systemd/systemd/issues/13762

>=20
> --=20
> Chris PeBenito

--=20
Key fingerprint =3D 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
https://sks-keyservers.net/pks/lookup?op=3Dget&search=3D0x3B6C5F1D2C7B6B02
Dominick Grift

--M9NhX3UHpAaciwkO
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQGyBAEBCAAdFiEEujmXliIBLFTc2Y4AJXSOVTf5R2kFAl4XnksACgkQJXSOVTf5
R2kV2Av2JgAK2SgH9qdYZYULNw+nqyTjk6umYOQy54rv6LUG+Vmk23a8HhHZTWJN
lk5CTm4mnKf1fpxVdQ/198wRcJd7/WaKF7m4KlT83hwl4aDnUePV/ATsQkRWOYuq
cKzXYv87WdZlblHG2j3Kn745eI6ug2uKfdwdcys9j3uIgqLVR8aNAv0fg++8/Oku
izLQjhLkseqC5Ah6zQfgtPWf4TQQ1LydnMXpBc4rbZ9n5AbuaxfJiKuWngSUmnRd
nMBFTiTGnERHnulddfeojjrNsVmNsGZ4LS1Zhwit/3Ar+jTCbRgxZf+qS6cW19Vg
EDroCuwEhSkpTudH4kni6UDRhDJyVs1KWb1W6EYZPJEVnXS41u8BO/qJ0TGuVVS4
bQvP39nVTVowTJAjyp+DUDj8wIzmIpUimyKYoxqO7kFOxlp4ONWfkAL7FkXa4zm8
XRxI9q7fPyvY4S2+D7yLgG3iMbaS27ZWalLbpeUCakr1JY0wzIkDemv9z5mSs4ot
SIziCns=
=q/sC
-----END PGP SIGNATURE-----

--M9NhX3UHpAaciwkO--