Received-SPF: pass (google.com: best guess record for domain of selinux-refpolicy-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   "Sugar, David" <dsugar@tresys.com>
To:     "selinux-refpolicy@vger.kernel.org" 
        <selinux-refpolicy@vger.kernel.org>
Subject: [PATCH v3] audit daemon can halt system, allow this to happen.
Thread-Topic: [PATCH v3] audit daemon can halt system, allow this to happen.
Thread-Index: AQHV0SB1BOajcV15tEyBuZYqA36muw==
Date:   Wed, 22 Jan 2020 12:35:42 +0000
Message-ID: <20200122123529.691385-1-dsugar@tresys.com>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-messagesentrepresentingtype: 1
x-mailer: git-send-email 2.24.1
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: dfdc7860-14e0-4d99-df5a-08d79f37980d
x-ms-traffictypediagnostic: BN8PR15MB3251:
x-microsoft-antispam-prvs: <BN8PR15MB325164E6A9CB31DA9E9B96A2B90C0@BN8PR15MB3251.namprd15.prod.outlook.com>
x-ms-oob-tlc-oobclassifiers: OLM:843;
x-forefront-prvs: 029097202E
x-forefront-antispam-report: SFV:NSPM;SFS:(10019020)(4636009)(376002)(136003)(396003)(39840400004)(346002)(366004)(189003)(199004)(81156014)(6916009)(81166006)(16526019)(8936002)(5660300002)(8676002)(2616005)(956004)(86362001)(6486002)(316002)(52116002)(7696005)(36756003)(66446008)(2906002)(186003)(71200400001)(508600001)(64756008)(66556008)(66946007)(1076003)(66476007)(26005);DIR:OUT;SFP:1102;SCL:1;SRVR:BN8PR15MB3251;H:BN8PR15MB2659.namprd15.prod.outlook.com;FPR:;SPF:None;LANG:en;PTR:InfoNoRecords;MX:1;A:1;
received-spf: None (protection.outlook.com: tresys.com does not designate
 permitted sender hosts)
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: MZ+pBNc74FY6RLcVMLvff3aqgBaIMOkiltQCVQ9t5UK1qPiXPdobbCAAATTC5N6ydYMSxGRsi9mPCoX18aKIXYUvO8NsD4hiFhPMxFZQvf2gC56GB+pBsJcGfueIsoGYGeT52Qu2W7App3ASU2rZAsvvtLSNSgyW4rp+cXOyn5H4owLmjyxgz0/ybIAKihHVGyCYXKPT2VjXe6uewecrkiDM85vtSb+AoHvyz4r0IheROVR8iiL9OuAsAgLx2J/Y6RmgiUzHup1KHwQoU8FLzsbFF5dZQd6rd5wAc4NRR3HddJI18sODTGNcvbf4YgQ7GAFdJl1frU4P9MUlxoHliekBGlqfz+0VowEqHQ6cNlcXAFySgIjDVDhg8czR3+Mrg8x9E25rSqf6v3ViDLDJ5qqKoq571YIcdL62AwABfezgcPTvr53q5OHYAyVvJJjl
x-ms-exchange-transport-forked: True
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: tresys.com
X-MS-Exchange-CrossTenant-Network-Message-Id: dfdc7860-14e0-4d99-df5a-08d79f37980d
X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Jan 2020 12:35:42.1007
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: a0d45667-6c07-4e88-868f-4ac9af95c7ed
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: CvtA1/G8OVBgycmt1ucBWtZALwOojxMI2OVzmI5oGMjN6r+jqKFB94XSA8Tm5qlXG1PPlzVJfmaLvpPTUzEqxw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN8PR15MB3251
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk
List-ID: <selinux-refpolicy.vger.kernel.org>
X-Mailing-List: selinux-refpolicy@vger.kernel.org

auditd can halt the system for several reasons based on configuration.
These mostly revovle around audit partition full issues.  I am seeing
the following denials when attempting to halt the system.

Jan 12 03:38:48 localhost audispd: node=3Dlocalhost type=3DUSER_AVC msg=3Da=
udit(1578800328.122:1943): pid=3D1 uid=3D0 auid=3D4294967295 ses=3D42949672=
95 subj=3Dsystem_u:system_r:init_t:s0 msg=3D'avc:  denied  { start } for au=
id=3Dn/a uid=3D0 gid=3D0 path=3D"/usr/lib/systemd/system/poweroff.target" c=
mdline=3D"/sbin/init 0" scontext=3Dsystem_u:system_r:auditd_t:s0 tcontext=
=3Dsystem_u:object_r:power_unit_t:s0 tclass=3Dservice exe=3D"/usr/lib/syste=
md/systemd" sauid=3D0 hostname=3D? addr=3D? terminal=3D?'
Jan 12 03:38:48 localhost audispd: node=3Dlocalhost type=3DUSER_AVC msg=3Da=
udit(1578800328.147:1944): pid=3D1 uid=3D0 auid=3D4294967295 ses=3D42949672=
95 subj=3Dsystem_u:system_r:init_t:s0 msg=3D'avc:  denied  { status } for a=
uid=3Dn/a uid=3D0 gid=3D0 path=3D"/usr/lib/systemd/system/poweroff.target" =
cmdline=3D"/sbin/init 0" scontext=3Dsystem_u:system_r:auditd_t:s0 tcontext=
=3Dsystem_u:object_r:power_unit_t:s0 tclass=3Dservice exe=3D"/usr/lib/syste=
md/systemd" sauid=3D0 hostname=3D? addr=3D? terminal=3D?'
Jan 12 04:44:54 localhost audispd: node=3Dlocalhost type=3DAVC msg=3Daudit(=
1578804294.103:1923): avc:  denied  { getattr } for  pid=3D6936 comm=3D"sys=
temctl" path=3D"/run/systemd/system" dev=3D"tmpfs" ino=3D45 scontext=3Dsyst=
em_u:system_r:auditd_t:s0 tcontext=3Dsystem_u:object_r:systemd_unit_t:s0 tc=
lass=3Ddir permissive=3D1

 v2 - use optional rather than ifdef
 v3 - fix order

Signed-off-by: Dave Sugar <dsugar@tresys.com>
---
 policy/modules/system/logging.te |  6 ++++++
 policy/modules/system/systemd.if | 20 ++++++++++++++++++++
 2 files changed, 26 insertions(+)

diff --git a/policy/modules/system/logging.te b/policy/modules/system/loggi=
ng.te
index 4c11d061..bce6b4d8 100644
--- a/policy/modules/system/logging.te
+++ b/policy/modules/system/logging.te
@@ -231,6 +231,12 @@ optional_policy(`
 	seutil_sigchld_newrole(auditd_t)
 ')
=20
+optional_policy(`
+	init_list_unit_dirs(auditd_t)
+	systemd_start_power_units(auditd_t)
+	systemd_status_power_units(auditd_t)
+')
+
 optional_policy(`
 	udev_read_db(auditd_t)
 ')
diff --git a/policy/modules/system/systemd.if b/policy/modules/system/syste=
md.if
index a49b0f77..8e46f443 100644
--- a/policy/modules/system/systemd.if
+++ b/policy/modules/system/systemd.if
@@ -791,6 +791,26 @@ interface(`systemd_start_power_units',`
 	allow $1 power_unit_t:service start;
 ')
=20
+########################################
+## <summary>
+##	Get the system status information about power units
+## </summary>
+## <param name=3D"domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`systemd_status_power_units',`
+	gen_require(`
+		type power_unit_t;
+		class service status;
+	')
+
+	allow $1 power_unit_t:service status;
+')
+
+
 ########################################
 ## <summary>
 ##	Make the specified type usable for
--=20
2.24.1