the blkid tool writes to /run/blkid/. This creates the "fstools_run_t"
type an allows the transition in /run.
type=AVC msg=audit(1428929528.885:149519): avc: denied { write } for
pid=5590 comm="mkfs.ext4" name="/" dev="tmpfs" ino=17656
scontext=staff_u:sysadm_r:fsadm_t tcontext=system_u:object_r:var_run_t
tclass=dir permissive=0
In permissive:
avc: denied { write } for pid=18595 comm="mkfs.ext4" name="blkid.tab"
dev="tmpfs" ino=5441676 scontext=root:sysadm_r:fsadm_t
tcontext=root:object_r:var_run_t tclass=file permissive=1
avc: denied { write } for pid=18595 comm="mkfs.ext4" name="blkid"
dev="tmpfs" ino=370936 scontext=root:sysadm_r:fsadm_t
tcontext=root:object_r:var_run_t tclass=dir permissive=1
avc: denied { add_name } for pid=18595 comm="mkfs.ext4"
name="blkid.tab-ZaM0Am" scontext=root:sysadm_r:fsadm_t
tcontext=root:object_r:var_run_t tclass=dir permissive=1
avc: denied { create } for pid=18595 comm="mkfs.ext4"
name="blkid.tab-ZaM0Am" scontext=root:sysadm_r:fsadm_t
tcontext=root:object_r:var_run_t tclass=file permissive=1
---
policy/modules/system/fstools.fc | 2 ++
policy/modules/system/fstools.te | 7 +++++++
2 files changed, 9 insertions(+)
diff --git a/policy/modules/system/fstools.fc b/policy/modules/system/fstools.fc
index d10368d..cba4184 100644
--- a/policy/modules/system/fstools.fc
+++ b/policy/modules/system/fstools.fc
@@ -62,3 +62,5 @@
/usr/sbin/smartctl -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/var/log/fsck(/.*)? gen_context(system_u:object_r:fsadm_log_t,s0)
+
+/var/run/blkid(/.*)? gen_context(system_u:object_r:fsadm_run_t,s0)
diff --git a/policy/modules/system/fstools.te b/policy/modules/system/fstools.te
index a0cfb1d..cbaa18b 100644
--- a/policy/modules/system/fstools.te
+++ b/policy/modules/system/fstools.te
@@ -16,6 +16,9 @@ logging_log_file(fsadm_log_t)
type fsadm_tmp_t;
files_tmp_file(fsadm_tmp_t)
+type fsadm_run_t;
+files_pid_file(fsadm_run_t)
+
type swapfile_t; # customizable
files_type(swapfile_t)
@@ -45,6 +48,10 @@ allow fsadm_t fsadm_tmp_t:dir manage_dir_perms;
allow fsadm_t fsadm_tmp_t:file manage_file_perms;
files_tmp_filetrans(fsadm_t, fsadm_tmp_t, { file dir })
+allow fsadm_t fsadm_run_t:dir manage_dir_perms;
+allow fsadm_t fsadm_run_t:file manage_file_perms;
+files_pid_filetrans(fsadm_t, fsadm_run_t, { file dir })
+
# log files
allow fsadm_t fsadm_log_t:dir setattr;
manage_files_pattern(fsadm_t, fsadm_log_t, fsadm_log_t)
--
2.0.5
On Mon, Apr 13, 2015 at 07:41:35PM +0400, Jason Zaman wrote:
> the blkid tool writes to /run/blkid/. This creates the "fstools_run_t"
> type an allows the transition in /run.
>
> type=AVC msg=audit(1428929528.885:149519): avc: denied { write } for
> pid=5590 comm="mkfs.ext4" name="/" dev="tmpfs" ino=17656
> scontext=staff_u:sysadm_r:fsadm_t tcontext=system_u:object_r:var_run_t
> tclass=dir permissive=0
>
> In permissive:
> avc: denied { write } for pid=18595 comm="mkfs.ext4" name="blkid.tab"
> dev="tmpfs" ino=5441676 scontext=root:sysadm_r:fsadm_t
> tcontext=root:object_r:var_run_t tclass=file permissive=1
> avc: denied { write } for pid=18595 comm="mkfs.ext4" name="blkid"
> dev="tmpfs" ino=370936 scontext=root:sysadm_r:fsadm_t
> tcontext=root:object_r:var_run_t tclass=dir permissive=1
> avc: denied { add_name } for pid=18595 comm="mkfs.ext4"
> name="blkid.tab-ZaM0Am" scontext=root:sysadm_r:fsadm_t
> tcontext=root:object_r:var_run_t tclass=dir permissive=1
> avc: denied { create } for pid=18595 comm="mkfs.ext4"
> name="blkid.tab-ZaM0Am" scontext=root:sysadm_r:fsadm_t
> tcontext=root:object_r:var_run_t tclass=file permissive=1
> ---
> policy/modules/system/fstools.fc | 2 ++
> policy/modules/system/fstools.te | 7 +++++++
> 2 files changed, 9 insertions(+)
>
> diff --git a/policy/modules/system/fstools.fc b/policy/modules/system/fstools.fc
> index d10368d..cba4184 100644
> --- a/policy/modules/system/fstools.fc
> +++ b/policy/modules/system/fstools.fc
> @@ -62,3 +62,5 @@
> /usr/sbin/smartctl -- gen_context(system_u:object_r:fsadm_exec_t,s0)
>
> /var/log/fsck(/.*)? gen_context(system_u:object_r:fsadm_log_t,s0)
> +
> +/var/run/blkid(/.*)? gen_context(system_u:object_r:fsadm_run_t,s0)
Should probably also cover /var/run/fsck
> diff --git a/policy/modules/system/fstools.te b/policy/modules/system/fstools.te
> index a0cfb1d..cbaa18b 100644
> --- a/policy/modules/system/fstools.te
> +++ b/policy/modules/system/fstools.te
> @@ -16,6 +16,9 @@ logging_log_file(fsadm_log_t)
> type fsadm_tmp_t;
> files_tmp_file(fsadm_tmp_t)
>
> +type fsadm_run_t;
> +files_pid_file(fsadm_run_t)
> +
> type swapfile_t; # customizable
> files_type(swapfile_t)
>
> @@ -45,6 +48,10 @@ allow fsadm_t fsadm_tmp_t:dir manage_dir_perms;
> allow fsadm_t fsadm_tmp_t:file manage_file_perms;
> files_tmp_filetrans(fsadm_t, fsadm_tmp_t, { file dir })
>
> +allow fsadm_t fsadm_run_t:dir manage_dir_perms;
> +allow fsadm_t fsadm_run_t:file manage_file_perms;
> +files_pid_filetrans(fsadm_t, fsadm_run_t, { file dir })
> +
The transition should only be needed on "dir" (/var/run/blkid and /var/run/fsck)
files_pid_filetrans(fsadm_t, fsadm_run_t, dir)
I think it is important do this properly since it makes it sensible. Adding rules that do not make
sense only make it harder to understand what is going on and it needlessly inflates the policy.
> # log files
> allow fsadm_t fsadm_log_t:dir setattr;
> manage_files_pattern(fsadm_t, fsadm_log_t, fsadm_log_t)
> --
> 2.0.5
>
> _______________________________________________
> refpolicy mailing list
> refpolicy at oss.tresys.com
> http://oss.tresys.com/mailman/listinfo/refpolicy
--
02DFF788
4D30 903A 1CF3 B756 FB48 1514 3148 83A2 02DF F788
http://keys.gnupg.net/pks/lookup?op=vindex&search=0x314883A202DFF788
Dominick Grift
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 648 bytes
Desc: not available
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20150413/c86bab71/attachment.bin
On Mon, Apr 13, 2015 at 06:09:59PM +0200, Dominick Grift wrote:
>
> The transition should only be needed on "dir" (/var/run/blkid and /var/run/fsck)
>
> files_pid_filetrans(fsadm_t, fsadm_run_t, dir)
>
> I think it is important do this properly since it makes it sensible. Adding rules that do not make
> sense only make it harder to understand what is going on and it needlessly inflates the policy.
>
But i think i know what is going on here since you have no avc denials of the event where /var/run/blkid dir is created.
blkid is probably run by some process that is allowed to run all executable files and that has permissions to create generic var_run_t dirs
I would probably instead identity what creates /var/run/blkid dir and why it creates it with the generic var_run_t type
then act accordingly by either making it run blkid with a domain transition or by making it create /var/run/blkid with a object type transition
What you have currently is inconsistent and is bound be cause issues later on.
Because in some instances /var/run/blkid may be created with var_run_t and in other instances with fsadm_var_run_t.
Then youll end up allowing processes that need to manage fsadm_var_run_t files to write/del_entry/add_entry of both var_run_t as well as fsadm_var_run_t dirs
Add a rule: auditallow domain var_run_t:dir create; then keep an eye on any event showing up where /var/run/blkid is created
then deal with it accordingly
--
02DFF788
4D30 903A 1CF3 B756 FB48 1514 3148 83A2 02DF F788
http://keys.gnupg.net/pks/lookup?op=vindex&search=0x314883A202DFF788
Dominick Grift
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 648 bytes
Desc: not available
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20150413/0e607140/attachment.bin