Received-SPF: pass (google.com: best guess record for domain of selinux-refpolicy-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   "Sugar, David" <dsugar@tresys.com>
To:     "selinux-refpolicy@vger.kernel.org" 
        <selinux-refpolicy@vger.kernel.org>
Subject: [PATCH v3] Allow systemd to getattr all files
Thread-Topic: [PATCH v3] Allow systemd to getattr all files
Thread-Index: AQHV0epXuYPF87B5bUmMHrYkdqoZ/g==
Date:   Thu, 23 Jan 2020 12:40:49 +0000
Message-ID: <20200123124037.969990-1-dsugar@tresys.com>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-messagesentrepresentingtype: 1
x-mailer: git-send-email 2.24.1
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: b33dfe8b-cfd5-48c6-abbe-08d7a0017992
x-ms-traffictypediagnostic: BN8PR15MB2642:
x-microsoft-antispam-prvs: <BN8PR15MB26423055CEB2EBB3C7D93E91B90F0@BN8PR15MB2642.namprd15.prod.outlook.com>
x-ms-oob-tlc-oobclassifiers: OLM:6430;
x-forefront-prvs: 029174C036
x-forefront-antispam-report: SFV:NSPM;SFS:(10019020)(4636009)(346002)(366004)(199004)(189003)(8936002)(26005)(2906002)(7696005)(52116002)(16526019)(186003)(81156014)(71200400001)(81166006)(1076003)(8676002)(66446008)(64756008)(66946007)(66476007)(508600001)(66556008)(5660300002)(36756003)(956004)(2616005)(6486002)(86362001)(6916009);DIR:OUT;SFP:1102;SCL:1;SRVR:BN8PR15MB2642;H:BN8PR15MB2659.namprd15.prod.outlook.com;FPR:;SPF:None;LANG:en;PTR:InfoNoRecords;A:1;MX:1;
received-spf: None (protection.outlook.com: tresys.com does not designate
 permitted sender hosts)
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: Z/FBQ55GWDF/kSDCjiRvhOsIMDtxCIUTHRJi3Keq8tKGlS3OBq+mOAL/tBS7kmYiwv50iOlJy2UQJPNG9odaLXlaYT48anGEvgj2172KjMQsqBqdrw2XbpORJSM1wMVzh22RaKIApPxqfKzZM7O9JZ0GIv7TQYMcPH8+d85Wap1hjCKgK8fEwwxxgjyvpMoOtkPRT5hE1lVxmUF5bW54L3Q8YMz4Ldo4gU0zA+CuvoJCJjGy9TE4tO+GDUCYkFMRNXFXVzKK7JdCQ1DS0IqHkDjuqF9mktXA5+mzaxGmNy89l3+Jued3mIuyH04zG8af63yOnyX1wvhmPeP4Fdv8STuJ8xB+z5P0Mp1uIB3Pki1KH1N5rVTr6aGvkOkavqQKQjW7Kf/rhLDUlnRDfXOCRSsiEPd73MuaFqXzuQM++y25gH5Ps21G9tku0g6AGFn5
x-ms-exchange-antispam-messagedata: 7au4u2o0K1Blreq2gQOnT7uoznGaG6NkVWLF8CavS+jzcL3Apa2EsCyR2f0QhPHPkQC614yr9Qwlfpw3bXeNG9hONzx4/wGKTlkJ883vKXw0DmFVUF54C1FPGFaMsqSD2RlcCtyJ0Gv7Nww1vjB/jw==
x-ms-exchange-transport-forked: True
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: tresys.com
X-MS-Exchange-CrossTenant-Network-Message-Id: b33dfe8b-cfd5-48c6-abbe-08d7a0017992
X-MS-Exchange-CrossTenant-originalarrivaltime: 23 Jan 2020 12:40:49.3140
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: a0d45667-6c07-4e88-868f-4ac9af95c7ed
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: /f9CcInesHCHdhDr/aRX6sjKadIanhlfS4+D2X8zKjJGk9+lQKBCbnDHOYUd3WSoqnhMpPj92abx3fy/zt/Q9w==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN8PR15MB2642
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk
List-ID: <selinux-refpolicy.vger.kernel.org>
X-Mailing-List: selinux-refpolicy@vger.kernel.org

Systemd has ConditionPath.*, ConditionFile.* and ConditionDir* which
are used to check various path/file/directory to control starting a
service.  But this requires getattr permissions on the types.
Example denials that fit the problem.

The first example is from lvm where accessing config file.

type=3DAVC msg=3Daudit(1575427946.229:1624): avc:  denied  { getattr } for
pid=3D1 comm=3D"systemd" path=3D"/etc/lvm/lvm.conf" dev=3D"dm-0" ino=3D5179=
9
scontext=3Dsystem_u:system_r:init_t:s0
tcontext=3Dsystem_u:object_r:lvm_etc_t:s0 tclass=3Dfile permissive=3D0

This second example is from chronyd, but it is happening becuase I added
the conditional in a drop-in file.=20

type=3DAVC msg=3Daudit(1575427959.882:1901): avc:  denied  { getattr } for
pid=3D1 comm=3D"systemd" path=3D"/etc/chrony.conf" dev=3D"dm-0" ino=3D53824
scontext=3Dsystem_u:system_r:init_t:s0
tcontext=3Dsystem_u:object_r:chronyd_conf_t:s0 tclass=3Dfile permissive=3D1

v3 - rework to not use interface and allow getattr for all files

Signed-off-by: Dave Sugar <dsugar@tresys.com>
---
 policy/modules/system/init.te | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index 281d4fd2..c772ff40 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -335,6 +335,11 @@ ifdef(`init_systemd',`
 	domain_subj_id_change_exemption(init_t)
 	domain_role_change_exemption(init_t)
=20
+	files_getattr_all_dirs(init_t)
+	files_getattr_all_files(init_t)
+	files_getattr_all_pipes(init_t)
+	files_getattr_all_sockets(init_t)
+	files_read_all_symlinks(init_t)
 	files_read_all_pids(init_t)
 	files_list_usr(init_t)
 	files_list_var(init_t)
--=20
2.24.1