Received-SPF: pass (google.com: best guess record for domain of selinux-refpolicy-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   "Sugar, David" <dsugar@tresys.com>
To:     "selinux-refpolicy@vger.kernel.org" 
        <selinux-refpolicy@vger.kernel.org>
Subject: [PATCH v2] Allow systemd to getattr configfile
Thread-Topic: [PATCH v2] Allow systemd to getattr configfile
Thread-Index: AQHVyj8StLfF4NCTnESXS61wDEUM3w==
Date:   Mon, 13 Jan 2020 18:27:11 +0000
Message-ID: <20200113182658.3502291-1-dsugar@tresys.com>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-messagesentrepresentingtype: 1
x-mailer: git-send-email 2.24.1
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: 9455f5db-0e0f-4657-8fd6-08d7985634a2
x-ms-traffictypediagnostic: BYAPR15MB2903:
x-microsoft-antispam-prvs: <BYAPR15MB290302ACB16C9B8A8E2A9E61B9350@BYAPR15MB2903.namprd15.prod.outlook.com>
x-ms-oob-tlc-oobclassifiers: OLM:4125;
x-forefront-prvs: 028166BF91
x-forefront-antispam-report: SFV:NSPM;SFS:(10019020)(4636009)(376002)(366004)(136003)(346002)(39830400003)(396003)(189003)(199004)(1076003)(186003)(26005)(7696005)(52116002)(6916009)(16526019)(5660300002)(71200400001)(316002)(2616005)(66446008)(64756008)(66556008)(66476007)(36756003)(8676002)(81166006)(956004)(8936002)(6486002)(66946007)(508600001)(2906002)(86362001)(81156014);DIR:OUT;SFP:1102;SCL:1;SRVR:BYAPR15MB2903;H:BYAPR15MB2375.namprd15.prod.outlook.com;FPR:;SPF:None;LANG:en;PTR:InfoNoRecords;MX:1;A:1;
received-spf: None (protection.outlook.com: tresys.com does not designate
 permitted sender hosts)
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: b6qs2VY/kNcqXuG3S6G3vGIgC9GAXJVJDXlPSIbXq/0yeePB5+Dg1ZQJqAUjr7BR6uquPw9/ICOabh59Y7ba9axdirR5TRSkJrOszhodNMroDMm8OcuH3Yeam7RqHnYlCQKYC+Vc4KJp77CY1Gjr8y1phRYlBaMRs/RvPEKh9PevaoNjFi2PknSwIjp2wGKueEgBfdQRF50u7FAb8bpWalMlb6wRQrlfJwmST+z5jTZgkfm6vM5Y8cVHD7JbkbJgr+iM9fuX5Z3KXfMokaPUHmGAevBdm4yDv0W7fRsy86h2mOwRtrHijsEpBqMYR54V3OM7365XiiceDDg2U7YpwrYxDhpUo/fr7XHNv2eI/SZAdsMoCAdZ9xUBq+r7sBLR0x2TIi4LWuDp7sWJX8/LYaSCT5I5+oRFlDRrFY9WcUpuWQJ4EnI4ThddsTrkXVBX
x-ms-exchange-transport-forked: True
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: tresys.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 9455f5db-0e0f-4657-8fd6-08d7985634a2
X-MS-Exchange-CrossTenant-originalarrivaltime: 13 Jan 2020 18:27:11.6281
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: a0d45667-6c07-4e88-868f-4ac9af95c7ed
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: MiQ07pjDWYyPBjhUxCb/dpfSL7bW2JFd/sRCpP95jk/RgM/Pe72tk/lTP+LfOFUL9aylpHHNG7ZK88pQnPPZOA==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR15MB2903
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk
List-ID: <selinux-refpolicy.vger.kernel.org>
X-Mailing-List: selinux-refpolicy@vger.kernel.org

v2 update - rework, creating interface 'init_systemd_conditional'
as suggested.  This grants getattr access to the type provided.

Signed-off-by: Dave Sugar <dsugar@tresys.com>
---
 policy/modules/services/chronyd.te |  2 ++
 policy/modules/system/init.if      | 26 ++++++++++++++++++++++++++
 2 files changed, 28 insertions(+)

diff --git a/policy/modules/services/chronyd.te b/policy/modules/services/c=
hronyd.te
index 5e680d39..7ae8bb5a 100644
--- a/policy/modules/services/chronyd.te
+++ b/policy/modules/services/chronyd.te
@@ -102,6 +102,8 @@ miscfiles_read_localization(chronyd_t)
 chronyd_dgram_send_cli(chronyd_t)
 chronyd_read_config(chronyd_t)
=20
+init_systemd_conditional(chronyd_conf_t)
+
 optional_policy(`
 	gpsd_rw_shm(chronyd_t)
 ')
diff --git a/policy/modules/system/init.if b/policy/modules/system/init.if
index 62ab4da8..5a0a78bf 100644
--- a/policy/modules/system/init.if
+++ b/policy/modules/system/init.if
@@ -3232,6 +3232,32 @@ interface(`init_reload_all_units',`
 	allow $1 { init_script_file_type systemdunit }:service reload;
 ')
=20
+
+########################################
+## <summary>
+##      Allow init_t getattr permissions.  Generally
+##      needed for types that are used in a Condition
+##      predicate.
+## </summary>
+## <param name=3D"domain">
+##      <summary>
+##      type accessible by init_t
+##      </summary>
+## </param>
+#
+interface(`init_systemd_conditional',`
+	gen_require(`
+		type init_t;
+	')
+	allow init_t $1:dir search_dir_perms;
+	allow init_t $1:lnk_file read_lnk_file_perms;
+	allow init_t $1:fifo_file getattr_fifo_file_perms;
+	allow init_t $1:sock_file getattr_sock_file_perms;
+	allow init_t $1:file getattr_file_perms;
+	allow init_t $1:blk_file getattr_blk_file_perms;
+	allow init_t $1:chr_file getattr_chr_file_perms;
+')
+
 ########################################
 ## <summary>
 ##      Allow unconfined access to send instructions to init
--=20
2.24.1