Received: by 2002:a25:1506:0:0:0:0:0 with SMTP id 6csp5022434ybv; Mon, 17 Feb 2020 10:34:50 -0800 (PST) X-Google-Smtp-Source: APXvYqxRFxuOGz4eKjVZ3FfJr7fovZFrSiT981Qu6agp8L+OtT60U3ZMXBi3TW7L9Q+GQcsxGqNa X-Received: by 2002:aca:be57:: with SMTP id o84mr241935oif.138.1581964490896; Mon, 17 Feb 2020 10:34:50 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1581964490; cv=none; d=google.com; s=arc-20160816; b=jFjdFE97PrmhsQX6hLYawaX8EGwKMLLPukSFwOz6Rf6T3Gt3XpUU2xdKOAolHAlhX1 yQBvZLzmy7PLHXFhGhXTSpmB7ZwmdeiZrQLV7ivLDGpT21aHfCZxrQLIWCEjN2hM7iNq zzf8DvCiSMpBV8ZlHUA6q0qmeIdrttlvnt/zWiyCSL5sCWVEYvbllWW4VL8a0KuxP+6e 8Rd5Gvr4NRElcf77Z8/Y9YYcOJE9Sq4alRXIrpgbNRYWiMeP/Pxmlyi0v3LVUToxZPwG zCf6ZDEOqgLb8UFrKqf89yud+xLw54p4te76sUvnJODeK4mJr15U/zvdhRa3/cVRPbJi h+FQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding :content-language:in-reply-to:mime-version:user-agent:date :message-id:from:references:cc:to:subject:dkim-signature; bh=U9dQThR6fMELPtX1UVF3JntGYE95NFGnQ1CrPnpGhPg=; b=HBcPfXKeD0uKtHrwjUeKI6veD8hpHP30iOUgSEuiNsxymEN9awurxhuawZ5CqcrdoK q6hWqS6M7vyBhrtBMOF0DMMeIORgJhAFCdo3srLKgkKlutnxj1k5etu3GkPFSiCEhFUz INo7H8iv9RlEWwDE22ZioPrXv1n0vkbjBhO92th7vMunS5IzrW/FvRRfDj5thVqiEy33 wPIb3zb3pC6yTIqoKXpxIWxHncLvqNzUokZHBwlxahc4YdnFe8CBzyc31y+VJL1l62yy pHhzjr9AH+YQgFqwABXhxy+4m7szE3HZHhbSDXUNTKpJmvUM8g8igtTFN7a6mvRbkqqp 2KNQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@ieee.org header.s=google header.b=HFuUm5ev; spf=pass (google.com: best guess record for domain of selinux-refpolicy-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=selinux-refpolicy-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=ieee.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id m67si6923580oib.117.2020.02.17.10.34.44; Mon, 17 Feb 2020 10:34:50 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of selinux-refpolicy-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@ieee.org header.s=google header.b=HFuUm5ev; spf=pass (google.com: best guess record for domain of selinux-refpolicy-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=selinux-refpolicy-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=ieee.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727429AbgBQSee (ORCPT + 13 others); Mon, 17 Feb 2020 13:34:34 -0500 Received: from mail-qt1-f194.google.com ([209.85.160.194]:40240 "EHLO mail-qt1-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727179AbgBQSee (ORCPT ); Mon, 17 Feb 2020 13:34:34 -0500 Received: by mail-qt1-f194.google.com with SMTP id v25so12705546qto.7 for ; Mon, 17 Feb 2020 10:34:34 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ieee.org; s=google; h=subject:to:cc:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=U9dQThR6fMELPtX1UVF3JntGYE95NFGnQ1CrPnpGhPg=; b=HFuUm5ev72UMO1u8/HWFbWSI0mj6XT9HNfjSOdQQo98ZjJws3n3aD9ODwE9Brlp6ri dytR7Debk7YvGRR7SrkWw/qLqxCt20Nyf08iMu+tdw5gfhYzEZpEAS8UdoIzfCJCLNjl 0r8kUVTVypFwB55ES9L76EWcHhWqI2eTe/13Q= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=U9dQThR6fMELPtX1UVF3JntGYE95NFGnQ1CrPnpGhPg=; b=O/ZVaiYUX7qcjGfu6gZMjb1aKXkX0EBVzkSXHxPgVt7WpDEpQB3PH7b2yADf2dg3Ji WCXBWIQTe4nAqQ2xU6IYHMm5bfD35vD0HpMCCF4UPpaqAKON1k4XO8VCHgyelScJAg2b csYeDj3fh9pd/F6umowqbqA0voIq78GSoM2CnVD0UWJgMr3dcof7TWfx1vSJbz/Zpe3T guXzWNwSaFeFvta58wRfxm+yrMVQP/InjCfH7LRMXbnptPjVI+Y9jjZ5ljIFr2Q9guyp EsPAkkqTvpjaGZPpSowfO2k7Fd7lFzIK3Zg6d7cTCRMSWWdQKFdis4cbmZ9Ko0LqnJrj D0Fg== X-Gm-Message-State: APjAAAWxnMIhleAO51DtWUvZomXpJicsVcVuwZus+I6t68OtL3EfxWse pLshjcK1UVz3itCluiNsmKePMTHpxsg= X-Received: by 2002:aed:2e03:: with SMTP id j3mr14309854qtd.365.1581964473514; Mon, 17 Feb 2020 10:34:33 -0800 (PST) Received: from fedora.pebenito.net (pool-108-15-23-247.bltmmd.fios.verizon.net. [108.15.23.247]) by smtp.gmail.com with ESMTPSA id b7sm619593qka.67.2020.02.17.10.34.33 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 17 Feb 2020 10:34:33 -0800 (PST) Subject: Re: [PATCH 01/10] fstools: add zfs-auto-snapshot To: Jason Zaman , selinux-refpolicy@vger.kernel.org Cc: Jason Zaman References: <20200216200319.39337-1-jason@perfinion.com> From: Chris PeBenito Message-ID: <1afd8a7c-336c-2385-e9d4-1475f62c3f58@ieee.org> Date: Mon, 17 Feb 2020 13:26:51 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.3.1 MIME-Version: 1.0 In-Reply-To: <20200216200319.39337-1-jason@perfinion.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Sender: selinux-refpolicy-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux-refpolicy@vger.kernel.org On 2/16/20 3:03 PM, Jason Zaman wrote: > Should be in domain fstools_t, and needs to run zpool which is > mount_exec_t. > > type=AVC msg=audit(1563084061.269:2472): avc: denied { execute } for pid=4981 comm="env" name="zpool" dev="zfs" ino=259064 scontext=system_u:system_r:fsadm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:mount_exec_t:s0 tclass=file permissive=0 > type=SYSCALL msg=audit(1563084061.269:2472): arch=c000003e syscall=59 success=no exit=-13 a0=7ffeba786e70 a1=7ffeba787098 a2=55726a69a4e0 a3=7fbff7eb5b00 items=1 ppid=4980 pid=4981 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="env" exe="/bin/env" subj=system_u:system_r:fsadm_t:s0-s0:c0.c1023 key=(null) > type=CWD msg=audit(1563084061.269:2472): cwd="/root" > type=PATH msg=audit(1563084061.269:2472): item=0 name="/sbin/zpool" inode=259064 dev=00:17 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:mount_exec_t:s0 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0 > > Signed-off-by: Jason Zaman > Signed-off-by: Jason Zaman > --- > policy/modules/system/fstools.fc | 1 + > policy/modules/system/fstools.te | 2 ++ > 2 files changed, 3 insertions(+) > > diff --git a/policy/modules/system/fstools.fc b/policy/modules/system/fstools.fc > index 8fbd5ce4..d871294e 100644 > --- a/policy/modules/system/fstools.fc > +++ b/policy/modules/system/fstools.fc > @@ -49,6 +49,7 @@ > /usr/bin/swapon.* -- gen_context(system_u:object_r:fsadm_exec_t,s0) > /usr/bin/tune2fs -- gen_context(system_u:object_r:fsadm_exec_t,s0) > /usr/bin/zdb -- gen_context(system_u:object_r:fsadm_exec_t,s0) > +/usr/bin/zfs-auto-snapshot -- gen_context(system_u:object_r:fsadm_exec_t,s0) > /usr/bin/zhack -- gen_context(system_u:object_r:fsadm_exec_t,s0) > /usr/bin/zinject -- gen_context(system_u:object_r:fsadm_exec_t,s0) > /usr/bin/zpios -- gen_context(system_u:object_r:fsadm_exec_t,s0) > diff --git a/policy/modules/system/fstools.te b/policy/modules/system/fstools.te > index 4ad6e65f..4ae0301a 100644 > --- a/policy/modules/system/fstools.te > +++ b/policy/modules/system/fstools.te > @@ -154,6 +154,8 @@ logging_send_syslog_msg(fsadm_t) > > miscfiles_read_localization(fsadm_t) > > +# for zfs/zpool > +mount_exec(fsadm_t) > # for /run/mount/utab > mount_getattr_runtime_files(fsadm_t) > # losetup: bind mount_loopback_t files to loop devices Merged. -- Chris PeBenito