Received-SPF: pass (google.com: domain of selinux-refpolicy-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Russell Coker <russell@coker.com.au>
To:     Dominick Grift <dominick.grift@defensec.nl>
Cc:     selinux-refpolicy@vger.kernel.org
Subject: Re: [PATCH] misc services patches
Date:   Fri, 22 Jan 2021 13:24:53 +1100
Message-ID: <3798733.Xe6EjoDzsm@liv>
In-Reply-To: <60db511b-f9a3-5489-182b-88a0b727b9c2@defensec.nl>
References: <YAgBKwxkaxUV4H99@xev> <1730727.gRP4Mpsj7r@liv> <60db511b-f9a3-5489-182b-88a0b727b9c2@defensec.nl>
MIME-Version: 1.0
Content-Transfer-Encoding: 7Bit
Content-Type: text/plain; charset="us-ascii"
Precedence: bulk

On Friday, 22 January 2021 12:35:42 AM AEDT Dominick Grift wrote:
> >>> +++ refpolicy-2.20210120/policy/modules/services/ssh.te
> >>> @@ -268,6 +268,7 @@ ifdef(`init_systemd',`
> >>> 
> >>> init_dbus_chat(sshd_t)
> >>> systemd_dbus_chat_logind(sshd_t)
> >>> init_rw_stream_soconnectivitycheck.cbg-app.huawei.comckets(sshd_t)
> >>> 
> >>> +       systemd_read_logind_sessions_files(sshd_t)
> >> 
> >> This should probably be addressed on the lower authlogin level instead
> > 
> > auth_login_pgm_domain()?
> 
> I would consider adding it to auth_use_pam(). but its a good question.
> 
> > In another patch I have systemd_connect_machined(sshd_t) which I guess
> > should go in the same one too.
> 
> Which patch was that?

A patch I haven't sent to the list yet.

> That does not look right if only that the name of
> the interface isnt very descriptive (there is no way unix stream connect
> or unix dgram sendto machined.
> 
> So this is either about systemd's nss mymachines (in which case it
> belongs in auth_use_nsswitch() or about reading systemd
> /var/run/machines in which case the interface name is wrong.

I don't have the libnss-systemd or libnss-mymachines packages installed on the 
machines that are giving this, /etc/nsswitch.conf hasn't been changed since 
2018.

When I comment out the pam_systemd.so line from /etc/pam.d/common-session that 
access isn't required.  So it's a PAM thing.

+interface(`systemd_connect_machined',`
+       gen_require(`
+               type systemd_machined_t;
+       ')
+
+       allow $1 systemd_machined_t:unix_stream_socket connectto;
+')

Should I put this access in systemd_stream_connect_userdb()?  The socket file 
is /run/systemd/userdb/io.systemd.Machine and is labelled as 
systemd_userdb_runtime_t.

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/