These patches provide additional enhancements for Gentoo portage
1. Support layman through its own domain
2. Support emerge-webrsync through the portage domain
Both patches are a result of supporting standard update operations (sync
tree) through unattended methods, like cron or puppet.
Wkr,
Sven Vermeulen
The layman utility is used by Gentoo to manage additional overlays. The
application manages files in /var/lib/layman (which are the various overlays)
and is able to update them using utilities like rsync, svn, git, ...
Previously, layman was just ran within the domain of the caller (which was
usually sysadm_t). However, when using automated methods like updating the
trees through cron or puppet, this fails since these domains do not hold the
necessary privileges. By putting the necessary privileges in a separate domain,
we can assign this domain to the appropriate roles.
Since layman and portage (emerge) are very closely related, we manage the
necessary domtrans rules through the portage_domtrans() method. There is
hardly any point to make this a separate interface.
Signed-off-by: Sven Vermeulen <[email protected]>
---
policy/modules/admin/portage.fc | 2 +
policy/modules/admin/portage.if | 6 +++-
policy/modules/admin/portage.te | 61 +++++++++++++++++++++++++++++++++++++++
3 files changed, 68 insertions(+), 1 deletions(-)
diff --git a/policy/modules/admin/portage.fc b/policy/modules/admin/portage.fc
index db46387..38cc918 100644
--- a/policy/modules/admin/portage.fc
+++ b/policy/modules/admin/portage.fc
@@ -3,6 +3,7 @@
/etc/portage(/.*)? gen_context(system_u:object_r:portage_conf_t,s0)
/usr/bin/gcc-config -- gen_context(system_u:object_r:gcc_config_exec_t,s0)
+/usr/bin/layman -- gen_context(system_u:object_r:layman_exec_t,s0)
/usr/bin/sandbox -- gen_context(system_u:object_r:portage_exec_t,s0)
/usr/lib(64)?/portage/bin/ebuild -- gen_context(system_u:object_r:portage_exec_t,s0)
@@ -19,6 +20,7 @@
/var/log/emerge\.log.* -- gen_context(system_u:object_r:portage_log_t,s0)
/var/log/emerge-fetch.log -- gen_context(system_u:object_r:portage_log_t,s0)
/var/log/portage(/.*)? gen_context(system_u:object_r:portage_log_t,s0)
+/var/lib/layman(/.*)? gen_context(system_u:object_r:layman_var_lib_t,s0)
/var/lib/portage(/.*)? gen_context(system_u:object_r:portage_cache_t,s0)
/var/tmp/portage(/.*)? gen_context(system_u:object_r:portage_tmp_t,s0)
/var/tmp/portage-pkg(/.*)? gen_context(system_u:object_r:portage_tmp_t,s0)
diff --git a/policy/modules/admin/portage.if b/policy/modules/admin/portage.if
index 0f27b1c..faf2eba 100644
--- a/policy/modules/admin/portage.if
+++ b/policy/modules/admin/portage.if
@@ -16,6 +16,7 @@
interface(`portage_domtrans',`
gen_require(`
type portage_t, portage_exec_t;
+ type layman_t, layman_exec_t;
')
files_search_usr($1)
@@ -23,6 +24,8 @@ interface(`portage_domtrans',`
# transition to portage
domtrans_pattern($1, portage_exec_t, portage_t)
+ # transition to layman
+ domtrans_pattern($1, layman_exec_t, layman_t)
')
########################################
@@ -45,10 +48,11 @@ interface(`portage_domtrans',`
interface(`portage_run',`
gen_require(`
type portage_t, portage_fetch_t, portage_sandbox_t;
+ type layman_t;
')
portage_domtrans($1)
- role $2 types { portage_t portage_fetch_t portage_sandbox_t };
+ role $2 types { portage_t portage_fetch_t portage_sandbox_t layman_t };
')
########################################
diff --git a/policy/modules/admin/portage.te b/policy/modules/admin/portage.te
index d2ff138..7d7242d 100644
--- a/policy/modules/admin/portage.te
+++ b/policy/modules/admin/portage.te
@@ -9,6 +9,16 @@ type gcc_config_t;
type gcc_config_exec_t;
application_domain(gcc_config_t, gcc_config_exec_t)
+type layman_t;
+type layman_exec_t;
+application_domain(layman_t, layman_exec_t)
+
+type layman_var_lib_t;
+files_type(layman_var_lib_t)
+
+type layman_tmp_t;
+files_tmp_file(layman_tmp_t)
+
# constraining type
type portage_t;
type portage_exec_t;
@@ -115,6 +125,57 @@ optional_policy(`
########################################
#
+# Layman local policy
+#
+allow layman_t self:process signal;
+allow layman_t self:fifo_file rw_fifo_file_perms;
+
+# Manage layman var/lib files
+manage_files_pattern(layman_t, layman_var_lib_t, layman_var_lib_t)
+manage_dirs_pattern(layman_t, layman_var_lib_t, layman_var_lib_t)
+manage_lnk_files_pattern(layman_t, layman_var_lib_t, layman_var_lib_t)
+
+# Manage layman tmp files (needed in case of subversion)
+manage_dirs_pattern(layman_t, layman_tmp_t, layman_tmp_t)
+manage_files_pattern(layman_t, layman_tmp_t, layman_tmp_t)
+files_tmp_filetrans(layman_t, layman_tmp_t, { file dir })
+
+## Kernel layer calls
+#
+kernel_dontaudit_read_system_state(layman_t)
+kernel_dontaudit_request_load_module(layman_t)
+
+corecmd_exec_bin(layman_t)
+corecmd_exec_shell(layman_t)
+
+corenet_tcp_connect_generic_port(layman_t)
+corenet_tcp_connect_git_port(layman_t)
+corenet_tcp_connect_http_port(layman_t)
+corenet_tcp_connect_rsync_port(layman_t)
+
+domain_use_interactive_fds(layman_t)
+
+files_read_etc_files(layman_t)
+files_read_etc_runtime_files(layman_t)
+files_read_usr_files(layman_t)
+files_search_var_lib(layman_t)
+
+## System layer calls
+#
+logging_list_logs(layman_t)
+miscfiles_read_localization(layman_t)
+sysnet_dns_name_resolve(layman_t)
+userdom_dontaudit_list_user_home_dirs(layman_t)
+userdom_use_user_terminals(layman_t)
+
+## Other calls
+#
+rsync_exec(layman_t)
+
+
+
+########################################
+#
# Portage Merging Rules
#
--
1.7.3.4
The emerge-webrsync application fetches snapshots (archives), extracts them and
then synchronizes the local tree with the snapshot. It uses portage code (and
libraries) to do so, but is implemented as a wrapper as it also offers the
possibility of verifying the GPG signature of the snapshot first.
By putting emerge-webrsync in portage' domain, it is handled through the regular
portage_run() and portage_domtrans() methods. It is also necessary to put it in
this domain for unattended/automated calls, such as through cron and puppet.
Signed-off-by: Sven Vermeulen <[email protected]>
---
policy/modules/admin/portage.fc | 2 ++
policy/modules/admin/portage.te | 4 ++++
2 files changed, 6 insertions(+), 0 deletions(-)
diff --git a/policy/modules/admin/portage.fc b/policy/modules/admin/portage.fc
index 38cc918..b1bb073 100644
--- a/policy/modules/admin/portage.fc
+++ b/policy/modules/admin/portage.fc
@@ -8,6 +8,7 @@
/usr/lib(64)?/portage/bin/ebuild -- gen_context(system_u:object_r:portage_exec_t,s0)
/usr/lib(64)?/portage/bin/emerge -- gen_context(system_u:object_r:portage_exec_t,s0)
+/usr/lib(64)?/portage/bin/emerge-webrsync -- gen_context(system_u:object_r:portage_exec_t,s0)
/usr/lib(64)?/portage/bin/quickpkg -- gen_context(system_u:object_r:portage_exec_t,s0)
/usr/lib(64)?/portage/bin/ebuild\.sh -- gen_context(system_u:object_r:portage_exec_t,s0)
/usr/lib(64)?/portage/bin/regenworld -- gen_context(system_u:object_r:portage_exec_t,s0)
@@ -22,5 +23,6 @@
/var/log/portage(/.*)? gen_context(system_u:object_r:portage_log_t,s0)
/var/lib/layman(/.*)? gen_context(system_u:object_r:layman_var_lib_t,s0)
/var/lib/portage(/.*)? gen_context(system_u:object_r:portage_cache_t,s0)
+/var/tmp/emerge-webrsync(/.*)? gen_context(system_u:object_r:portage_tmp_t,s0)
/var/tmp/portage(/.*)? gen_context(system_u:object_r:portage_tmp_t,s0)
/var/tmp/portage-pkg(/.*)? gen_context(system_u:object_r:portage_tmp_t,s0)
diff --git a/policy/modules/admin/portage.te b/policy/modules/admin/portage.te
index 7d7242d..d392124 100644
--- a/policy/modules/admin/portage.te
+++ b/policy/modules/admin/portage.te
@@ -240,6 +240,10 @@ optional_policy(`
')
optional_policy(`
+ gpg_domtrans(portage_t)
+')
+
+optional_policy(`
modutils_domtrans_depmod(portage_t)
modutils_domtrans_update_mods(portage_t)
#dontaudit update_modules_t portage_tmp_t:dir search_dir_perms;
--
1.7.3.4
On 07/24/11 06:43, Sven Vermeulen wrote:
> The layman utility is used by Gentoo to manage additional overlays. The
> application manages files in /var/lib/layman (which are the various overlays)
> and is able to update them using utilities like rsync, svn, git, ...
>
> Previously, layman was just ran within the domain of the caller (which was
> usually sysadm_t). However, when using automated methods like updating the
> trees through cron or puppet, this fails since these domains do not hold the
> necessary privileges. By putting the necessary privileges in a separate domain,
> we can assign this domain to the appropriate roles.
>
> Since layman and portage (emerge) are very closely related, we manage the
> necessary domtrans rules through the portage_domtrans() method. There is
> hardly any point to make this a separate interface.
>
> Signed-off-by: Sven Vermeulen <[email protected]>
> ---
> policy/modules/admin/portage.fc | 2 +
> policy/modules/admin/portage.if | 6 +++-
> policy/modules/admin/portage.te | 61 +++++++++++++++++++++++++++++++++++++++
> 3 files changed, 68 insertions(+), 1 deletions(-)
>
> diff --git a/policy/modules/admin/portage.fc b/policy/modules/admin/portage.fc
> index db46387..38cc918 100644
> --- a/policy/modules/admin/portage.fc
> +++ b/policy/modules/admin/portage.fc
> @@ -3,6 +3,7 @@
> /etc/portage(/.*)? gen_context(system_u:object_r:portage_conf_t,s0)
>
> /usr/bin/gcc-config -- gen_context(system_u:object_r:gcc_config_exec_t,s0)
> +/usr/bin/layman -- gen_context(system_u:object_r:layman_exec_t,s0)
> /usr/bin/sandbox -- gen_context(system_u:object_r:portage_exec_t,s0)
>
> /usr/lib(64)?/portage/bin/ebuild -- gen_context(system_u:object_r:portage_exec_t,s0)
> @@ -19,6 +20,7 @@
> /var/log/emerge\.log.* -- gen_context(system_u:object_r:portage_log_t,s0)
> /var/log/emerge-fetch.log -- gen_context(system_u:object_r:portage_log_t,s0)
> /var/log/portage(/.*)? gen_context(system_u:object_r:portage_log_t,s0)
> +/var/lib/layman(/.*)? gen_context(system_u:object_r:layman_var_lib_t,s0)
> /var/lib/portage(/.*)? gen_context(system_u:object_r:portage_cache_t,s0)
> /var/tmp/portage(/.*)? gen_context(system_u:object_r:portage_tmp_t,s0)
> /var/tmp/portage-pkg(/.*)? gen_context(system_u:object_r:portage_tmp_t,s0)
> diff --git a/policy/modules/admin/portage.if b/policy/modules/admin/portage.if
> index 0f27b1c..faf2eba 100644
> --- a/policy/modules/admin/portage.if
> +++ b/policy/modules/admin/portage.if
> @@ -16,6 +16,7 @@
> interface(`portage_domtrans',`
> gen_require(`
> type portage_t, portage_exec_t;
> + type layman_t, layman_exec_t;
> ')
>
> files_search_usr($1)
> @@ -23,6 +24,8 @@ interface(`portage_domtrans',`
>
> # transition to portage
> domtrans_pattern($1, portage_exec_t, portage_t)
> + # transition to layman
> + domtrans_pattern($1, layman_exec_t, layman_t)
> ')
>
> ########################################
> @@ -45,10 +48,11 @@ interface(`portage_domtrans',`
> interface(`portage_run',`
> gen_require(`
> type portage_t, portage_fetch_t, portage_sandbox_t;
> + type layman_t;
> ')
>
> portage_domtrans($1)
> - role $2 types { portage_t portage_fetch_t portage_sandbox_t };
> + role $2 types { portage_t portage_fetch_t portage_sandbox_t layman_t };
> ')
>
> ########################################
> diff --git a/policy/modules/admin/portage.te b/policy/modules/admin/portage.te
> index d2ff138..7d7242d 100644
> --- a/policy/modules/admin/portage.te
> +++ b/policy/modules/admin/portage.te
> @@ -9,6 +9,16 @@ type gcc_config_t;
> type gcc_config_exec_t;
> application_domain(gcc_config_t, gcc_config_exec_t)
>
> +type layman_t;
> +type layman_exec_t;
> +application_domain(layman_t, layman_exec_t)
> +
> +type layman_var_lib_t;
> +files_type(layman_var_lib_t)
> +
> +type layman_tmp_t;
> +files_tmp_file(layman_tmp_t)
These last two are out of order.
> # constraining type
> type portage_t;
> type portage_exec_t;
> @@ -115,6 +125,57 @@ optional_policy(`
>
> ########################################
> #
> +# Layman local policy
> +#
> +allow layman_t self:process signal;
> +allow layman_t self:fifo_file rw_fifo_file_perms;
> +
> +# Manage layman var/lib files
> +manage_files_pattern(layman_t, layman_var_lib_t, layman_var_lib_t)
> +manage_dirs_pattern(layman_t, layman_var_lib_t, layman_var_lib_t)
> +manage_lnk_files_pattern(layman_t, layman_var_lib_t, layman_var_lib_t)
> +
> +# Manage layman tmp files (needed in case of subversion)
> +manage_dirs_pattern(layman_t, layman_tmp_t, layman_tmp_t)
> +manage_files_pattern(layman_t, layman_tmp_t, layman_tmp_t)
> +files_tmp_filetrans(layman_t, layman_tmp_t, { file dir })
> +
> +## Kernel layer calls
> +#
> +kernel_dontaudit_read_system_state(layman_t)
> +kernel_dontaudit_request_load_module(layman_t)
> +
> +corecmd_exec_bin(layman_t)
> +corecmd_exec_shell(layman_t)
> +
> +corenet_tcp_connect_generic_port(layman_t)
> +corenet_tcp_connect_git_port(layman_t)
> +corenet_tcp_connect_http_port(layman_t)
> +corenet_tcp_connect_rsync_port(layman_t)
> +
Needs sendrecv on http, rsync, and git client packets
> +domain_use_interactive_fds(layman_t)
> +
> +files_read_etc_files(layman_t)
> +files_read_etc_runtime_files(layman_t)
> +files_read_usr_files(layman_t)
> +files_search_var_lib(layman_t)
> +
> +## System layer calls
> +#
> +logging_list_logs(layman_t)
> +miscfiles_read_localization(layman_t)
> +sysnet_dns_name_resolve(layman_t)
> +userdom_dontaudit_list_user_home_dirs(layman_t)
> +userdom_use_user_terminals(layman_t)
> +
> +## Other calls
> +#
> +rsync_exec(layman_t)
> +
> +
> +
Needs some whitespace and extra comments cleanup.
> +########################################
> +#
> # Portage Merging Rules
> #
>
--
Chris PeBenito
Tresys Technology, LLC
http://www.tresys.com | oss.tresys.com