Received-SPF: pass (google.com: best guess record for domain of selinux-refpolicy-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   "Sugar, David" <dsugar@tresys.com>
To:     "selinux-refpolicy@vger.kernel.org" 
        <selinux-refpolicy@vger.kernel.org>
Subject: [PATCH v2] audit daemon can halt system, allow this to happen.
Thread-Topic: [PATCH v2] audit daemon can halt system, allow this to happen.
Thread-Index: AQHV0HRlEVBVdLnXHUWr4wzeja5gYQ==
Date:   Tue, 21 Jan 2020 16:04:01 +0000
Message-ID: <20200121160346.392210-1-dsugar@tresys.com>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-messagesentrepresentingtype: 1
x-mailer: git-send-email 2.24.1
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: 448e746d-cc39-46db-4fa1-08d79e8b87eb
x-ms-traffictypediagnostic: BN8PR15MB2755:
x-microsoft-antispam-prvs: <BN8PR15MB27557F9A665C8BDE5AF627E5B90D0@BN8PR15MB2755.namprd15.prod.outlook.com>
x-ms-oob-tlc-oobclassifiers: OLM:843;
x-forefront-prvs: 0289B6431E
x-forefront-antispam-report: SFV:NSPM;SFS:(10019020)(4636009)(376002)(366004)(396003)(39830400003)(136003)(346002)(189003)(199004)(52116002)(6916009)(2616005)(956004)(36756003)(1076003)(7696005)(26005)(86362001)(2906002)(6486002)(64756008)(66446008)(8676002)(71200400001)(5660300002)(81156014)(81166006)(66946007)(66476007)(66556008)(186003)(508600001)(316002)(8936002)(16526019);DIR:OUT;SFP:1102;SCL:1;SRVR:BN8PR15MB2755;H:BN8PR15MB2659.namprd15.prod.outlook.com;FPR:;SPF:None;LANG:en;PTR:InfoNoRecords;MX:1;A:1;
received-spf: None (protection.outlook.com: tresys.com does not designate
 permitted sender hosts)
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: EEHg87+Q7OacQak1jVqb0M745QCPirLp9JKALuM4a0uhK1K4T+6JoAxOgMZ902PHKOyc3prP0t6hB8qgFhodswhSaWDsBRYOO2r3KYoriQL3tIygNWapiVFmcSV6fDv2yAH8YV6ppTUeL70K8PgBWvMcbA/up0fL4V2GjrLJfAzMFFxNWcCju6zXiyP3rarDzNqsUSk7benGe8AiWORHXM14Oxjf+wbU3yADEOtUAGDXaXDVktkCES5YUYOq/V7gUZrvQF6KKSK7kH+mF3ratXvgfjhrk1OG0+/HrwUzm4VqMkH46r3agub3uHaebDoPGUqN0+eMi2sW5c5BZbaBO4iU0gzv1Ph29NoPpDZbg7Nyi7fFbIhyM6qHXTQE0LrM9dRO23cmNEZRTyfMsOyWMYEqhC80oidrlaMdvNR1RYvzotiwQBlEkOvkUL169xVG
x-ms-exchange-transport-forked: True
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: tresys.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 448e746d-cc39-46db-4fa1-08d79e8b87eb
X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Jan 2020 16:04:01.5671
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: a0d45667-6c07-4e88-868f-4ac9af95c7ed
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: B52dQW9T6TD0eHFX2RcccVuEwXMY0zEz9t7MRpWbcOWPOk0hStwNy7mJzD4y2YWz9fqizgHo6/XRUaoqoz154w==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN8PR15MB2755
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk
List-ID: <selinux-refpolicy.vger.kernel.org>
X-Mailing-List: selinux-refpolicy@vger.kernel.org

auditd can halt the system for several reasons based on configuration.
These mostly revovle around audit partition full issues.  I am seeing
the following denials when attempting to halt the system.

Jan 12 03:38:48 localhost audispd: node=3Dlocalhost type=3DUSER_AVC msg=3Da=
udit(1578800328.122:1943): pid=3D1 uid=3D0 auid=3D4294967295 ses=3D42949672=
95 subj=3Dsystem_u:system_r:init_t:s0 msg=3D'avc:  denied  { start } for au=
id=3Dn/a uid=3D0 gid=3D0 path=3D"/usr/lib/systemd/system/poweroff.target" c=
mdline=3D"/sbin/init 0" scontext=3Dsystem_u:system_r:auditd_t:s0 tcontext=
=3Dsystem_u:object_r:power_unit_t:s0 tclass=3Dservice exe=3D"/usr/lib/syste=
md/systemd" sauid=3D0 hostname=3D? addr=3D? terminal=3D?'
Jan 12 03:38:48 localhost audispd: node=3Dlocalhost type=3DUSER_AVC msg=3Da=
udit(1578800328.147:1944): pid=3D1 uid=3D0 auid=3D4294967295 ses=3D42949672=
95 subj=3Dsystem_u:system_r:init_t:s0 msg=3D'avc:  denied  { status } for a=
uid=3Dn/a uid=3D0 gid=3D0 path=3D"/usr/lib/systemd/system/poweroff.target" =
cmdline=3D"/sbin/init 0" scontext=3Dsystem_u:system_r:auditd_t:s0 tcontext=
=3Dsystem_u:object_r:power_unit_t:s0 tclass=3Dservice exe=3D"/usr/lib/syste=
md/systemd" sauid=3D0 hostname=3D? addr=3D? terminal=3D?'
Jan 12 04:44:54 localhost audispd: node=3Dlocalhost type=3DAVC msg=3Daudit(=
1578804294.103:1923): avc:  denied  { getattr } for  pid=3D6936 comm=3D"sys=
temctl" path=3D"/run/systemd/system" dev=3D"tmpfs" ino=3D45 scontext=3Dsyst=
em_u:system_r:auditd_t:s0 tcontext=3Dsystem_u:object_r:systemd_unit_t:s0 tc=
lass=3Ddir permissive=3D1

v2 - use optional rather than ifdef

Signed-off-by: Dave Sugar <dsugar@tresys.com>
---
 policy/modules/system/logging.te |  6 ++++++
 policy/modules/system/systemd.if | 20 ++++++++++++++++++++
 2 files changed, 26 insertions(+)

diff --git a/policy/modules/system/logging.te b/policy/modules/system/loggi=
ng.te
index 4c11d061..a4c46c81 100644
--- a/policy/modules/system/logging.te
+++ b/policy/modules/system/logging.te
@@ -223,6 +223,12 @@ ifdef(`distro_ubuntu',`
 	')
 ')
=20
+optional_policy(`
+	init_list_unit_dirs(auditd_t)
+	systemd_start_power_units(auditd_t)
+	systemd_status_power_units(auditd_t)
+')
+
 optional_policy(`
 	mta_send_mail(auditd_t)
 ')
diff --git a/policy/modules/system/systemd.if b/policy/modules/system/syste=
md.if
index a49b0f77..8e46f443 100644
--- a/policy/modules/system/systemd.if
+++ b/policy/modules/system/systemd.if
@@ -791,6 +791,26 @@ interface(`systemd_start_power_units',`
 	allow $1 power_unit_t:service start;
 ')
=20
+########################################
+## <summary>
+##	Get the system status information about power units
+## </summary>
+## <param name=3D"domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`systemd_status_power_units',`
+	gen_require(`
+		type power_unit_t;
+		class service status;
+	')
+
+	allow $1 power_unit_t:service status;
+')
+
+
 ########################################
 ## <summary>
 ##	Make the specified type usable for
--=20
2.24.1