Received: by 2002:a05:6359:c8b:b0:c7:702f:21d4 with SMTP id go11csp3468636rwb; Sun, 25 Sep 2022 07:04:49 -0700 (PDT) X-Google-Smtp-Source: AMsMyM480FFAzqmuNz0NAzIL08Ht80WWXfNWjiGIAeXqw3q3OBX75LyEsLjHGZv86XIz1H8fXnU+ X-Received: by 2002:aa7:cd8e:0:b0:452:2682:a955 with SMTP id x14-20020aa7cd8e000000b004522682a955mr18025732edv.379.1664114689475; Sun, 25 Sep 2022 07:04:49 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1664114689; cv=none; d=google.com; s=arc-20160816; b=IBK78MuhU1BI+SdNnAI2rJzyhU/bzINsqX1GuF2e/NLDyluPeyGQddvr1Jwd6tORxB vHXSbxuugoB3h2bCk0Zy6PrOzOXX8sSjuqmtomrASyxpjDvbaOUAVgfOV+zRCsQOWhCR gWF9comV37bCndge9zvunU+MOmrh1jW7GgsgarlJv2nndcLkLbSengcof7Ny/3qkI96j KZIasJaOY76KJr0mfnihJ1qn93+wR45MW8LjvhoOxST1/zT069WqVFwHor1WHUIug8fc QdkhLkl2ixZ/XM+3KoXNjHJb91jl6GZn5IKPqtwkWk5OO2PR5A75eqS7is6sFWTWbvOR 2JBA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-disposition:mime-version:message-id :subject:to:from:date:dkim-signature; bh=AYlg0oWuNiJxz0Z7N1kaOfYnV6pD3QM9IPObR8EUnuQ=; b=oS+RVX++5xuMHScnRddnjDKpJb8X4qouhLS1Q/d0nXmeXQUYR6iFzR4V9e/qXA6jyG tp5fXpTxsdu0aqpdgJrYrfGUy4yYAofW6rm4ENaiWPCKTEsN1v9g9zSbtLBmQV6tCpFX Hqu2jDFBoc2dhjNGLFnq0Blvoe5zWlTw0U+ZZYLKlni2nhS7lmskhFCd3YBZtz6h13qw eABmSu1941sVkdlPYFsxslfPVAMXuY64x/0CGUr3Iz+hvZWS/Ir2QSKFGIXpe+Q/XhG/ haiXEQTs2jCxUTTPZyfhXGJL3sVcIB8K5GV3w28Io/yX+bSfsOadU66hKKCvN7TIOqOp kGaA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@coker.com.au header.s=2008 header.b=ddpgPI7q; spf=pass (google.com: domain of selinux-refpolicy-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=selinux-refpolicy-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=coker.com.au Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id ds19-20020a170907725300b00780427ba4e0si5571475ejc.233.2022.09.25.07.04.39; Sun, 25 Sep 2022 07:04:49 -0700 (PDT) Received-SPF: pass (google.com: domain of selinux-refpolicy-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@coker.com.au header.s=2008 header.b=ddpgPI7q; spf=pass (google.com: domain of selinux-refpolicy-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=selinux-refpolicy-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=coker.com.au Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230509AbiIYN62 (ORCPT + 21 others); Sun, 25 Sep 2022 09:58:28 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58582 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230504AbiIYN61 (ORCPT ); Sun, 25 Sep 2022 09:58:27 -0400 X-Greylist: delayed 72 seconds by postgrey-1.37 at lindbergh.monkeyblade.net; Sun, 25 Sep 2022 06:58:25 PDT Received: from smtp.sws.net.au (smtp.sws.net.au [IPv6:2a01:4f8:201:1e6::dada:cafe]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 028CE23BF1 for ; Sun, 25 Sep 2022 06:58:24 -0700 (PDT) Received: from xev.coker.com.au (localhost [127.0.0.1]) by smtp.sws.net.au (Postfix) with ESMTP id DC32610395 for ; Sun, 25 Sep 2022 23:58:22 +1000 (AEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=coker.com.au; s=2008; t=1664114303; bh=AYlg0oWuNiJxz0Z7N1kaOfYnV6pD3QM9IPObR8EUnuQ=; l=11035; h=Date:From:To:Subject:From; b=ddpgPI7qNmoO1u3r1UOiM3oZcagJeYxC7O/yla7O/gzOfazGHr0o/mopyuHNgeYtX aE7GOaAdhdqyvY2xMsm1yVOmJ8jm55mmSAuNoHfSjejGXTu/cT+VgD/1kqvDH+k4KU pJSO17Gz+2mS7INnXnczPdXodwixDt5vVbY8oNQA= Received: by xev.coker.com.au (Postfix, from userid 1001) id 4BBAA1AB5331; Sun, 25 Sep 2022 23:58:18 +1000 (AEST) Date: Sun, 25 Sep 2022 23:58:18 +1000 From: Russell Coker To: selinux-refpolicy@vger.kernel.org Subject: [PATCH] Sympa list server Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: selinux-refpolicy@vger.kernel.org Policy for the Sympa mailing list server. I think this is ready to merge, it works well. Signed-off-by: Russell Coker Index: refpolicy-2.20220918/policy/modules/services/sympa.fc =================================================================== --- /dev/null +++ refpolicy-2.20220918/policy/modules/services/sympa.fc @@ -0,0 +1,6 @@ +/usr/lib/sympa/bin/.* -- gen_context(system_u:object_r:sympa_exec_t,s0) +/var/lib/sympa(/.*)? gen_context(system_u:object_r:sympa_var_t,s0) +/var/spool/sympa(/.*)? gen_context(system_u:object_r:sympa_var_t,s0) +/run/sympa(/.*)? gen_context(system_u:object_r:sympa_runtime_t,s0) +/etc/mail/sympa(/.*)? gen_context(system_u:object_r:sympa_etc_t,s0) +/etc/sympa(/.*)? gen_context(system_u:object_r:sympa_etc_t,s0) Index: refpolicy-2.20220918/policy/modules/services/sympa.te =================================================================== --- /dev/null +++ refpolicy-2.20220918/policy/modules/services/sympa.te @@ -0,0 +1,86 @@ +policy_module(sympa,1.0.0) + +######################################## +# +# Declarations +# + +type sympa_t; +type sympa_exec_t; +init_daemon_domain(sympa_t, sympa_exec_t) + +type sympa_var_t; +files_type(sympa_var_t) + +type sympa_runtime_t; +files_runtime_file(sympa_runtime_t) + +type sympa_etc_t; +files_config_file(sympa_etc_t) + +type sympa_tmp_t; +files_tmp_file(sympa_tmp_t) + +######################################## +# +# Local policy +# + +allow sympa_t self:capability { chown dac_override setgid setuid }; +allow sympa_t self:fifo_file rw_file_perms; +allow sympa_t self:tcp_socket create_socket_perms; +allow sympa_t self:unix_dgram_socket create_socket_perms; +allow sympa_t self:process signull; +allow sympa_t sympa_var_t:dir manage_dir_perms; +allow sympa_t sympa_var_t:file manage_file_perms; + +allow sympa_t sympa_runtime_t:dir manage_dir_perms; +allow sympa_t sympa_runtime_t:file manage_file_perms; +allow sympa_t sympa_runtime_t:sock_file { create setattr unlink write }; + +allow sympa_t sympa_etc_t:dir list_dir_perms; +allow sympa_t sympa_etc_t:file read_file_perms; + +files_tmp_filetrans(sympa_t, sympa_tmp_t, { file }) +allow sympa_t sympa_tmp_t:file manage_file_perms; + +can_exec(sympa_t, sympa_exec_t) + +kernel_read_kernel_sysctls(sympa_t) + +auth_dontaudit_read_shadow(sympa_t) + +# for setting SE Linux context in systemd unit file +corecmd_bin_entry_type(sympa_t) + +corecmd_exec_bin(sympa_t) +corecmd_exec_shell(sympa_t) + +dev_read_urand(sympa_t) + +files_read_etc_files(sympa_t) +files_read_usr_files(sympa_t) +files_search_spool(sympa_t) +files_search_var_lib(sympa_t) + +logging_send_syslog_msg(sympa_t) + +miscfiles_read_generic_certs(sympa_t) +miscfiles_read_localization(sympa_t) + +sysnet_read_config(sympa_t) + +optional_policy(` + apache_search_sys_scripts(sympa_t) +') + +optional_policy(` + mta_read_config(sympa_t) + mta_send_mail(sympa_t) + mta_rw_delivery_fifos(sympa_t) +') + +optional_policy(` + mysql_tcp_connect(sympa_t) + mysql_stream_connect(sympa_t) +') Index: refpolicy-2.20220918/policy/modules/services/sympa.if =================================================================== --- /dev/null +++ refpolicy-2.20220918/policy/modules/services/sympa.if @@ -0,0 +1,209 @@ +## Sympa mailing list manager +## +## +## Sympa is a popular mailing list manager. +## https://www.sympa.org/ +## + +######################################## +## +## Allow appending to sympa_var_t (for error log) +## +## +## +## Domain allowed access. +## +## +# +interface(`sympa_append_var_files',` + gen_require(` + type sympa_var_t; + ') + + allow $1 sympa_var_t:file { append getattr }; +') + +######################################## +## +## Allow reading sympa_var_t files +## +## +## +## Domain allowed access. +## +## +# +interface(`sympa_read_var_files',` + gen_require(` + type sympa_var_t; + ') + + allow $1 sympa_var_t:dir list_dir_perms; + allow $1 sympa_var_t:file read_file_perms; +') + +######################################## +## +## Allow managing sympa_var_t files +## +## +## +## Domain allowed access. +## +## +# +interface(`sympa_manage_var_files',` + gen_require(` + type sympa_var_t; + ') + + allow $1 sympa_var_t:dir rw_dir_perms; + allow $1 sympa_var_t:file manage_file_perms; +') + +######################################## +## +## Allow mapping sympa_var_t files +## +## +## +## Domain allowed access. +## +## +# +interface(`sympa_map_var_files',` + gen_require(` + type sympa_var_t; + ') + + allow $1 sympa_var_t:file map; +') + +######################################## +## +## Transition to sympa_t when executing sympa_exec_t +## +## +## +## Domain allowed access. +## +## +# +interface(`sympa_domtrans',` + gen_require(` + type sympa_exec_t, sympa_t; + ') + + domain_auto_transition_pattern($1, sympa_exec_t, sympa_t) +') + +######################################## +## +## Use file handles inherited from sympa +## +## +## +## Domain allowed access. +## +## +# +interface(`sympa_use_fd',` + gen_require(` + type sympa_t; + ') + + allow $1 sympa_t:fd use; +') + +######################################## +## +## Dontaudit access to inherited sympa tcp sockets +## +## +## +## Domain to not audit +## +## +# +interface(`sympa_dontaudit_tcp_rw',` + gen_require(` + type sympa_t; + ') + + dontaudit $1 sympa_t:tcp_socket { read write }; +') + +######################################## +## +## Allow reading sympa config files +## +## +## +## Domain to allow +## +## +# +interface(`sympa_read_conf',` + gen_require(` + type sympa_etc_t; + ') + + allow $1 sympa_etc_t:dir list_dir_perms; + allow $1 sympa_etc_t:file read_file_perms; +') + +######################################## +## +## Allow rw sympa runtime dirs and manage sympa runtime files +## +## +## +## Domain to allow +## +## +# +interface(`sympa_manage_runtime_files',` + gen_require(` + type sympa_runtime_t; + ') + + allow $1 sympa_runtime_t:dir rw_dir_perms; + allow $1 sympa_runtime_t:file manage_file_perms; +') + +######################################## +## +## Allow rw sympa runtime dirs and manage sympa runtime sock files +## +## +## +## Domain to allow +## +## +# +interface(`sympa_manage_runtime_sock_files',` + gen_require(` + type sympa_runtime_t; + ') + + allow $1 sympa_runtime_t:dir rw_dir_perms; + allow $1 sympa_runtime_t:sock_file { setattr create unlink write }; +') + +######################################## +## +## Allow domain to connect to sympa socket +## +## +## +## Domain to allow +## +## +# +interface(`sympa_connect_runtime_sock_files',` + gen_require(` + type sympa_t; + ') + + allow $1 sympa_t:unix_stream_socket connectto; +') Index: refpolicy-2.20220918/policy/modules/services/mta.te =================================================================== --- refpolicy-2.20220918.orig/policy/modules/services/mta.te +++ refpolicy-2.20220918/policy/modules/services/mta.te @@ -306,6 +306,11 @@ optional_policy(` ') optional_policy(` + sympa_append_var_files(system_mail_t) + sympa_dontaudit_tcp_rw(system_mail_t) +') + +optional_policy(` unconfined_use_fds(system_mail_t) ') @@ -396,6 +401,11 @@ optional_policy(` ') optional_policy(` + sympa_dontaudit_tcp_rw(mailserver_delivery) + sympa_domtrans(mailserver_delivery) +') + +optional_policy(` uucp_domtrans_uux(mailserver_delivery) ') Index: refpolicy-2.20220918/policy/modules/services/mta.if =================================================================== --- refpolicy-2.20220918.orig/policy/modules/services/mta.if +++ refpolicy-2.20220918/policy/modules/services/mta.if @@ -872,6 +872,26 @@ interface(`mta_read_spool_symlinks',` ####################################### ## +## read and write fifo files inherited from delivery domains +## +## +## +## Domain to use fifo files +## +## +# +interface(`mta_rw_delivery_fifos',` + gen_require(` + attribute mailserver_delivery; + ') + + allow $1 mailserver_delivery:fd use; + allow $1 mailserver_delivery:fifo_file { getattr read write }; +') + + +####################################### +## ## Do not audit attempts to read ## mail spool symlinks. ## Index: refpolicy-2.20220918/policy/modules/services/exim.te =================================================================== --- refpolicy-2.20220918.orig/policy/modules/services/exim.te +++ refpolicy-2.20220918/policy/modules/services/exim.te @@ -251,3 +251,10 @@ optional_policy(` spamassassin_exec(exim_t) spamassassin_exec_client(exim_t) ') + +optional_policy(` + # each of these should probably be for mailserver_delivery or mailserver_domain + sympa_append_var_files(exim_t) + sympa_read_var_files(exim_t) + sympa_use_fd(exim_t) +') Index: refpolicy-2.20220918/policy/modules/services/apache.te =================================================================== --- refpolicy-2.20220918.orig/policy/modules/services/apache.te +++ refpolicy-2.20220918/policy/modules/services/apache.te @@ -898,6 +898,14 @@ optional_policy(` snmp_dontaudit_write_snmp_var_lib_files(httpd_t) ') +optional_policy(` + sympa_manage_runtime_sock_files(httpd_t) + sympa_map_var_files(httpd_t) + sympa_read_conf(httpd_t) + sympa_read_var_files(httpd_t) +') + + ######################################## # # Helper local policy @@ -1239,6 +1247,8 @@ files_read_var_symlinks(httpd_sys_script files_search_var_lib(httpd_sys_script_t) files_search_spool(httpd_sys_script_t) +miscfiles_read_generic_certs(httpd_sys_script_t) + apache_domtrans_rotatelogs(httpd_sys_script_t) auth_use_nsswitch(httpd_sys_script_t) @@ -1321,6 +1331,11 @@ optional_policy(` ') ') +optional_policy(` + sympa_manage_var_files(httpd_sys_script_t) + sympa_read_conf(httpd_sys_script_t) +') + ######################################## # # Rotatelogs local policy