Received: by 2002:a25:6193:0:0:0:0:0 with SMTP id v141csp272895ybb; Thu, 9 Apr 2020 23:03:26 -0700 (PDT) X-Google-Smtp-Source: APiQypJnZdX5pt/+s1mLVpVWLaZ5Op5BctG5Sz5Rgf9USruw/EqvdujFsHhm1zWwKGfn3odoJEoY X-Received: by 2002:a05:6214:18d2:: with SMTP id cy18mr551617qvb.30.1586498606374; Thu, 09 Apr 2020 23:03:26 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1586498606; cv=none; d=google.com; s=arc-20160816; b=V/3/uYUIcWPHrIkblSnXas34nkG/Xm9mGpI9NfzXaVlfK3I+1PZ3nW3Hd3x53GdYXs qDGptytuOBbcSWkmV72qo8Va+cL4Bc/WzPzxeUBtwjwbsaKFthndovaY/4SgncEJ6oe4 xotPDgSXga6tGZNzsboKGnbHic35nviDNFAs+wwpHSd6xlp2zr1hLeVBpEzrahzQ706D SqXgir5+auDNOdxwxE3CSaUfy2OydNuM66lKK+8PW7+t9DeotZ+AvkQvs8YjP27mEeWq gqrVOJ1H5fc/4eWlHTt+nSDrLgoZL0W4wtgFsmpF/7bBa0Ym1vgSlRgbEotOYVqc4rew CDgQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-disposition:mime-version :message-id:subject:to:from:date:dkim-signature; bh=3/beOGSzXTOY9KokIDPgrHLUetYxEkfnrkj7c4uxXho=; b=dlFU33R1WK8WHpeF4p91SVsV33XpurFniFEspfmFphsUNYbmG0vMt7PBux1YBY7KHE 0CGi0eamP5EdFIWnxIpZUFdMJRpHWCD7CxBhzX+4oUza5vTgv7ss8XcSjWUGjC0J1CtC h6CEbr+vE2Xswj6UlV217R5raPfolks0wRDnCvWDNFREges0WCYNnG337IIyOvzwQPUZ qIq9xZJZ2ZiGd/gs9r/tO7glbu84lMxlTHpr9yvViyizFeL0RafXemhBbuxG0nvLc0OC ZL8B5YZVxoG9WClbNE06sx33aS7j8bNxyu21JgCT0BDdpMors9EIypUJBDj0S54wY+5M DJVg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@coker.com.au header.s=2008 header.b=BXNG5gSq; spf=pass (google.com: best guess record for domain of selinux-refpolicy-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=selinux-refpolicy-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=coker.com.au Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id f137si823869qke.171.2020.04.09.23.03.24; Thu, 09 Apr 2020 23:03:26 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of selinux-refpolicy-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@coker.com.au header.s=2008 header.b=BXNG5gSq; spf=pass (google.com: best guess record for domain of selinux-refpolicy-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=selinux-refpolicy-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=coker.com.au Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1725818AbgDJGDX (ORCPT + 13 others); Fri, 10 Apr 2020 02:03:23 -0400 Received: from smtp.sws.net.au ([46.4.88.250]:32862 "EHLO smtp.sws.net.au" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725776AbgDJGDX (ORCPT ); Fri, 10 Apr 2020 02:03:23 -0400 Received: from xev.coker.com.au (localhost [127.0.0.1]) by smtp.sws.net.au (Postfix) with ESMTP id 25C9A10231 for ; Fri, 10 Apr 2020 16:03:22 +1000 (AEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=coker.com.au; s=2008; t=1586498602; bh=3/beOGSzXTOY9KokIDPgrHLUetYxEkfnrkj7c4uxXho=; l=3657; h=Date:From:To:Subject:From; b=BXNG5gSqtybb+860LBY27X7/egMaj1Xc6mbiviQGZktcOObbYnqdvMx4Yz5OGA5iQ es0s+cW+YJh155rZoaRGWfCBJf3Pa5HA1HdmAkPhsbReshieecdA8Qydr1eD5Kj+N7 f4twl4M7WoaK4e0gS2g8rAFufPgyOO0tq8RoqJsE= Received: by xev.coker.com.au (Postfix, from userid 1001) id D528AFFC3A9; Fri, 10 Apr 2020 16:03:17 +1000 (AEST) Date: Fri, 10 Apr 2020 16:03:17 +1000 From: Russell Coker To: selinux-refpolicy@vger.kernel.org Subject: another memlockd patch Message-ID: <20200410060317.GB35896@xev> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Sender: selinux-refpolicy-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux-refpolicy@vger.kernel.org Signed-off-by: Russell Coker I think this resolves all issues Chris raised. Index: refpolicy-2.20200410/policy/modules/services/memlockd.fc =================================================================== --- /dev/null +++ refpolicy-2.20200410/policy/modules/services/memlockd.fc @@ -0,0 +1 @@ +/usr/sbin/memlockd -- gen_context(system_u:object_r:memlockd_exec_t,s0) Index: refpolicy-2.20200410/policy/modules/services/memlockd.if =================================================================== --- /dev/null +++ refpolicy-2.20200410/policy/modules/services/memlockd.if @@ -0,0 +1,2 @@ +## memory lock daemon, keeps important files in RAM. + Index: refpolicy-2.20200410/policy/modules/services/memlockd.te =================================================================== --- /dev/null +++ refpolicy-2.20200410/policy/modules/services/memlockd.te @@ -0,0 +1,37 @@ +policy_module(memlockd, 1.0.0) + +######################################## +# +# Declarations +# + +type memlockd_t; +type memlockd_exec_t; +init_daemon_domain(memlockd_t, memlockd_exec_t) + +######################################## +# +# Local policy +# + +allow memlockd_t self:capability { setgid setuid ipc_lock }; +allow memlockd_t self:fifo_file rw_file_perms; +allow memlockd_t self:unix_dgram_socket { create connect }; + +# cache /etc/shadow too +auth_read_shadow(memlockd_t) +auth_map_shadow(memlockd_t) + +corecmd_exec_all_executables(memlockd_t) +corecmd_exec_bin(memlockd_t) +corecmd_exec_shell(memlockd_t) +corecmd_read_all_executables(memlockd_t) +corecmd_search_bin(memlockd_t) +files_read_etc_files(memlockd_t) +libs_exec_ld_so(memlockd_t) +files_map_etc_files(memlockd_t) + +logging_send_syslog_msg(memlockd_t) +miscfiles_read_localization(memlockd_t) + +sysnet_mmap_read_config(memlockd_t) Index: refpolicy-2.20200410/policy/modules/system/sysnetwork.if =================================================================== --- refpolicy-2.20200410.orig/policy/modules/system/sysnetwork.if +++ refpolicy-2.20200410/policy/modules/system/sysnetwork.if @@ -391,6 +391,31 @@ interface(`sysnet_mmap_config_files',` ####################################### ## +## map network config files. +## +## +##

+## Allow the specified domain to mmap the +## general network configuration files. +##

+##
+## +## +## Domain allowed access. +## +## +# +interface(`sysnet_mmap_read_config',` + gen_require(` + type net_conf_t; + ') + + files_search_etc($1) + allow $1 net_conf_t:file mmap_read_file_perms; +') + +####################################### +## ## Do not audit attempts to read network config files. ## ## Index: refpolicy-2.20200410/policy/modules/system/authlogin.if =================================================================== --- refpolicy-2.20200410.orig/policy/modules/system/authlogin.if +++ refpolicy-2.20200410/policy/modules/system/authlogin.if @@ -577,6 +577,23 @@ interface(`auth_read_shadow',` ######################################## ## +## Map the shadow passwords file (/etc/shadow) +## +## +## +## Domain allowed access. +## +## +# +interface(`auth_map_shadow',` + gen_require(` + type shadow_t; + ') + allow $1 shadow_t:file map; +') + +######################################## +## ## Pass shadow assertion for reading. ## ##