Received-SPF: pass (google.com: best guess record for domain of selinux-refpolicy-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Subject: Re: [PATCH v2] Allow systemd to getattr configfile
To:     "Sugar, David" <dsugar@tresys.com>,
        "selinux-refpolicy@vger.kernel.org" 
        <selinux-refpolicy@vger.kernel.org>
References: <20200113182658.3502291-1-dsugar@tresys.com>
From:   Chris PeBenito <pebenito@ieee.org>
Message-ID: <413d1a7d-224f-49eb-6a51-dab0a6227804@ieee.org>
Date:   Tue, 21 Jan 2020 08:42:54 -0500
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
 Thunderbird/68.3.1
MIME-Version: 1.0
In-Reply-To: <20200113182658.3502291-1-dsugar@tresys.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk

On 1/13/20 1:27 PM, Sugar, David wrote:
> v2 update - rework, creating interface 'init_systemd_conditional'
> as suggested.  This grants getattr access to the type provided.
> 
> Signed-off-by: Dave Sugar <dsugar@tresys.com>
> ---
>   policy/modules/services/chronyd.te |  2 ++
>   policy/modules/system/init.if      | 26 ++++++++++++++++++++++++++
>   2 files changed, 28 insertions(+)
> 
> diff --git a/policy/modules/services/chronyd.te b/policy/modules/services/chronyd.te
> index 5e680d39..7ae8bb5a 100644
> --- a/policy/modules/services/chronyd.te
> +++ b/policy/modules/services/chronyd.te
> @@ -102,6 +102,8 @@ miscfiles_read_localization(chronyd_t)
>   chronyd_dgram_send_cli(chronyd_t)
>   chronyd_read_config(chronyd_t)
>   
> +init_systemd_conditional(chronyd_conf_t)
> +
>   optional_policy(`
>   	gpsd_rw_shm(chronyd_t)
>   ')
> diff --git a/policy/modules/system/init.if b/policy/modules/system/init.if
> index 62ab4da8..5a0a78bf 100644
> --- a/policy/modules/system/init.if
> +++ b/policy/modules/system/init.if
> @@ -3232,6 +3232,32 @@ interface(`init_reload_all_units',`
>   	allow $1 { init_script_file_type systemdunit }:service reload;
>   ')
>   
> +
> +########################################
> +## <summary>
> +##      Allow init_t getattr permissions.  Generally
> +##      needed for types that are used in a Condition
> +##      predicate.
> +## </summary>
> +## <param name="domain">
> +##      <summary>
> +##      type accessible by init_t
> +##      </summary>
> +## </param>
> +#
> +interface(`init_systemd_conditional',`

systemd_ConditionPath is a more preferable name.


> +	gen_require(`
> +		type init_t;
> +	')
> +	allow init_t $1:dir search_dir_perms;
> +	allow init_t $1:lnk_file read_lnk_file_perms;
> +	allow init_t $1:fifo_file getattr_fifo_file_perms;
> +	allow init_t $1:sock_file getattr_sock_file_perms;
> +	allow init_t $1:file getattr_file_perms;
> +	allow init_t $1:blk_file getattr_blk_file_perms;
> +	allow init_t $1:chr_file getattr_chr_file_perms;
> +')
> +
>   ########################################
>   ## <summary>
>   ##      Allow unconfined access to send instructions to init
> 


-- 
Chris PeBenito