Received-SPF: pass (google.com: best guess record for domain of selinux-refpolicy-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   "Sugar, David" <dsugar@tresys.com>
To:     "selinux-refpolicy@vger.kernel.org" 
        <selinux-refpolicy@vger.kernel.org>
Subject: [PATCH] Allow audit daemon to halt system
Thread-Topic: [PATCH] Allow audit daemon to halt system
Thread-Index: AQHVyj8vtwTQ9xpcokeWwo8stMhbsQ==
Date:   Mon, 13 Jan 2020 18:28:00 +0000
Message-ID: <20200113182743.3502993-1-dsugar@tresys.com>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-messagesentrepresentingtype: 1
x-mailer: git-send-email 2.24.1
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: 49c3b9fe-251b-4b15-50a9-08d79856518e
x-ms-traffictypediagnostic: BYAPR15MB2903:
x-microsoft-antispam-prvs: <BYAPR15MB2903CF61C099B91B8D989497B9350@BYAPR15MB2903.namprd15.prod.outlook.com>
x-ms-oob-tlc-oobclassifiers: OLM:843;
x-forefront-prvs: 028166BF91
x-forefront-antispam-report: SFV:NSPM;SFS:(10019020)(4636009)(376002)(366004)(136003)(346002)(39830400003)(396003)(189003)(199004)(1076003)(186003)(26005)(7696005)(52116002)(6916009)(16526019)(5660300002)(71200400001)(316002)(2616005)(66446008)(64756008)(66556008)(66476007)(6666004)(36756003)(8676002)(81166006)(956004)(8936002)(6486002)(66946007)(508600001)(2906002)(86362001)(81156014);DIR:OUT;SFP:1102;SCL:1;SRVR:BYAPR15MB2903;H:BYAPR15MB2375.namprd15.prod.outlook.com;FPR:;SPF:None;LANG:en;PTR:InfoNoRecords;MX:1;A:1;
received-spf: None (protection.outlook.com: tresys.com does not designate
 permitted sender hosts)
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: +ZwcboRfKstQ6ZwYyRxcLDvogI/2D+rOYxdRbCYNN55sYqmAfzQcxRxCIkkIkT3GW1izntw5e14+TkfAOAsX3vPrDX7w2/l1UoG0+yH0FpPoDspyGvUGou1Iu2Ju1j8Ch7qGQe6yS7Nvof7qZVE96bLiqmCloVxGKbZJFP5l3cxbaVxhoPjsaTIqh7/lqmGW6sN4uHHkQEH3ufKqffGM8p4vOSpUq7JWkx2gUX20ht2kVGSK/HpNdo2XNt+erCuNo1FHHdfHFBcxnxV3FVgRBJuXV6fSqvKnUjL4dpLvzCAZTs/Jz1bCTVN57Qbm0Zj4xUZpmkYfLxSt/Ad3DZo8I0kdE78pY/ERLUVXTjVJeAqFsxQ9njX1Ixf8Cidev/ADTdkOAH0yTWrNXq85jGl4hGJWj2rycdbHx4huYc8Zc+1edSrv8gCBUuBglzcdNN12
x-ms-exchange-transport-forked: True
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: tresys.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 49c3b9fe-251b-4b15-50a9-08d79856518e
X-MS-Exchange-CrossTenant-originalarrivaltime: 13 Jan 2020 18:28:00.0384
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: a0d45667-6c07-4e88-868f-4ac9af95c7ed
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: ZmqgVdhMeukP5F8zt7pf+9J99HN8tlwLIdZo4bJkrXVJt0tmc92UdJnDgMqLdxanil/DHtVpl+rbylcEv4NeYQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR15MB2903
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk
List-ID: <selinux-refpolicy.vger.kernel.org>
X-Mailing-List: selinux-refpolicy@vger.kernel.org

auditd can halt the system for several reasons based on configuration.
These mostly revovle around audit partition full issues.  I am seeing
the following denials when attempting to halt the system.

Jan 12 03:38:48 localhost audispd: node=3Dlocalhost type=3DUSER_AVC msg=3Da=
udit(1578800328.122:1943): pid=3D1 uid=3D0 auid=3D4294967295 ses=3D42949672=
95 subj=3Dsystem_u:system_r:init_t:s0 msg=3D'avc:  denied  { start } for au=
id=3Dn/a uid=3D0 gid=3D0 path=3D"/usr/lib/systemd/system/poweroff.target" c=
mdline=3D"/sbin/init 0" scontext=3Dsystem_u:system_r:auditd_t:s0 tcontext=
=3Dsystem_u:object_r:power_unit_t:s0 tclass=3Dservice exe=3D"/usr/lib/syste=
md/systemd" sauid=3D0 hostname=3D? addr=3D? terminal=3D?'
Jan 12 03:38:48 localhost audispd: node=3Dlocalhost type=3DUSER_AVC msg=3Da=
udit(1578800328.147:1944): pid=3D1 uid=3D0 auid=3D4294967295 ses=3D42949672=
95 subj=3Dsystem_u:system_r:init_t:s0 msg=3D'avc:  denied  { status } for a=
uid=3Dn/a uid=3D0 gid=3D0 path=3D"/usr/lib/systemd/system/poweroff.target" =
cmdline=3D"/sbin/init 0" scontext=3Dsystem_u:system_r:auditd_t:s0 tcontext=
=3Dsystem_u:object_r:power_unit_t:s0 tclass=3Dservice exe=3D"/usr/lib/syste=
md/systemd" sauid=3D0 hostname=3D? addr=3D? terminal=3D?'
Jan 12 04:44:54 localhost audispd: node=3Dlocalhost type=3DAVC msg=3Daudit(=
1578804294.103:1923): avc:  denied  { getattr } for  pid=3D6936 comm=3D"sys=
temctl" path=3D"/run/systemd/system" dev=3D"tmpfs" ino=3D45 scontext=3Dsyst=
em_u:system_r:auditd_t:s0 tcontext=3Dsystem_u:object_r:systemd_unit_t:s0 tc=
lass=3Ddir permissive=3D1

Signed-off-by: Dave Sugar <dsugar@tresys.com>
---
 policy/modules/system/logging.te |  6 ++++++
 policy/modules/system/systemd.if | 20 ++++++++++++++++++++
 2 files changed, 26 insertions(+)

diff --git a/policy/modules/system/logging.te b/policy/modules/system/loggi=
ng.te
index 73ca3042..69349af0 100644
--- a/policy/modules/system/logging.te
+++ b/policy/modules/system/logging.te
@@ -224,6 +224,12 @@ ifdef(`distro_ubuntu',`
 	')
 ')
=20
+ifdef(`init_systemd',`
+	init_list_unit_dirs(auditd_t)
+	systemd_start_power_units(auditd_t)
+	systemd_status_power_units(auditd_t)
+')
+
 optional_policy(`
 	mta_send_mail(auditd_t)
 ')
diff --git a/policy/modules/system/systemd.if b/policy/modules/system/syste=
md.if
index 0fd37fe8..2e9098a2 100644
--- a/policy/modules/system/systemd.if
+++ b/policy/modules/system/systemd.if
@@ -773,6 +773,26 @@ interface(`systemd_start_power_units',`
 	allow $1 power_unit_t:service start;
 ')
=20
+########################################
+## <summary>
+##	Get the system status information about power units
+## </summary>
+## <param name=3D"domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`systemd_status_power_units',`
+	gen_require(`
+		type power_unit_t;
+		class service status;
+	')
+
+	allow $1 power_unit_t:service status;
+')
+
+
 ########################################
 ## <summary>
 ##	Make the specified type usable for
--=20
2.24.1