From: cpebenito@tresys.com (Christopher J. PeBenito)
Date: Mon, 21 Mar 2011 09:23:43 -0400
Subject: [refpolicy] [PATCH]: dontaudit sys_module wpa_supplicant
In-Reply-To: <1300637900.27586.9.camel@tesla.lan>
References: <0Cz62XCZ8hNS.j4bfZvpJ@mail.posta.tim.it>	<201103201812.14967.russell@coker.com.au>	<1300632793.28926.5.camel@tesla.lan>
	<20110320150504.GA16383@siphos.be>	<1300636047.28926.16.camel@tesla.lan>	<20110320155613.GA18417@siphos.be>
	<1300637900.27586.9.camel@tesla.lan>
Message-ID: <4D87515F.3040201@tresys.com>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com

On 03/20/11 12:18, Guido Trentalancia wrote:
> On Sun, 2011-03-20 at 16:56 +0100, Sven Vermeulen wrote:
>> On Sun, Mar 20, 2011 at 04:47:27PM +0100, Guido Trentalancia wrote:
>>>> The moment you set kernel_load_module(NetworkManager_t) you're all set. The
>>>> neverallow is on all domains that do not have the can_load_kernmodule
>>>> attribute set, and with kernel_load_moduel() you set it for the specified
>>>> domain.
>>>
>>> The "neverallow" rule in kernel/kernel.te prevents NetworkManager_t from
>>> having the "sys_module" capability.
>>
>> In kernel/kernel.te:
>>
>>   neverallow ~{ can_load_kernmodule kern_unconfined } self:capability sys_module;
>>
>> The kernel_load_module interface:
>>
>>   interface(`kernel_load_module',`
>>           gen_require(`
>>                   attribute can_load_kernmodule;
>>           ')
>>   
>>           allow $1 self:capability sys_module;
>>           typeattribute $1 can_load_kernmodule;
>>   
>>           # load_module() calls stop_machine() which
>>           # calls sched_setscheduler()
>>           allow $1 self:capability sys_nice;
>>           kernel_setsched($1)
>>   ')
>>   
>> When you use kernel_load_module(NetworkManager_t), then the typeattribute
>> will add "can_load_kernmodule" as an attribute to the NetworkManager_t
>> domain. The neverallow works on all but those domains having
>> can_load_kernmodule and/or kern_unconfined set as an attribute.
> 
> It seems quite difficult to explain this...
> 
> I do not want to break things for distributions that do not want
> wpa_supplicant to load kernel modules and in any case I would like to
> hear from Christopher.
> 
> So unless Dan Walsh changes his mind there needs to be at least one
> ifdef (for DISTRO=redhat).
> 
> I am happy to prepare a patch which does can_load_kernmodule()/dontaudit
> depending on the distribution, but I need to hear from people with
> authority for each distribution. And Christopher should decide what
> would be the default behaviour.
> 
> It is perfectly fine to me (and I would probably be happier) if the
> default behaviour is can_load_kernmodule() as I do not particularly like
> "dontaudit" for stuff which just logs once (but Christopher has a
> different opinion on this, so once again nothing can be changed before
> Monday).

I would rather not allow this.  We don't want network-facing services
loading kernel modules.


-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com