From: sven.vermeulen@siphos.be (Sven Vermeulen) Date: Sat, 13 Aug 2011 20:22:21 +0200 Subject: [refpolicy] [PATCH 1/4] Support layman through its own domain In-Reply-To: <20110813182048.GA12571@siphos.be> References: <20110813182048.GA12571@siphos.be> Message-ID: <20110813182221.GB12571@siphos.be> To: refpolicy@oss.tresys.com List-Id: refpolicy.oss.tresys.com The layman utility is used by Gentoo to manage additional overlays. The application manages files in /var/lib/layman (which are the various overlays) and is able to update them using utilities like rsync, svn, git, ... Previously, layman was just ran within the domain of the caller (which was usually sysadm_t). However, when using automated methods like updating the trees through cron or puppet, this fails since these domains do not hold the necessary privileges. By putting the necessary privileges in a separate domain, we can assign this domain to the appropriate roles. Since layman and portage (emerge) are very closely related, we manage the necessary domtrans rules through the portage_domtrans() method. There is hardly any point to make this a separate interface. Signed-off-by: Sven Vermeulen --- policy/modules/admin/portage.fc | 2 + policy/modules/admin/portage.if | 6 +++- policy/modules/admin/portage.te | 60 +++++++++++++++++++++++++++++++++++++++ 3 files changed, 67 insertions(+), 1 deletions(-) diff --git a/policy/modules/admin/portage.fc b/policy/modules/admin/portage.fc index db46387..38cc918 100644 --- a/policy/modules/admin/portage.fc +++ b/policy/modules/admin/portage.fc @@ -3,6 +3,7 @@ /etc/portage(/.*)? gen_context(system_u:object_r:portage_conf_t,s0) /usr/bin/gcc-config -- gen_context(system_u:object_r:gcc_config_exec_t,s0) +/usr/bin/layman -- gen_context(system_u:object_r:layman_exec_t,s0) /usr/bin/sandbox -- gen_context(system_u:object_r:portage_exec_t,s0) /usr/lib(64)?/portage/bin/ebuild -- gen_context(system_u:object_r:portage_exec_t,s0) @@ -19,6 +20,7 @@ /var/log/emerge\.log.* -- gen_context(system_u:object_r:portage_log_t,s0) /var/log/emerge-fetch.log -- gen_context(system_u:object_r:portage_log_t,s0) /var/log/portage(/.*)? gen_context(system_u:object_r:portage_log_t,s0) +/var/lib/layman(/.*)? gen_context(system_u:object_r:layman_var_lib_t,s0) /var/lib/portage(/.*)? gen_context(system_u:object_r:portage_cache_t,s0) /var/tmp/portage(/.*)? gen_context(system_u:object_r:portage_tmp_t,s0) /var/tmp/portage-pkg(/.*)? gen_context(system_u:object_r:portage_tmp_t,s0) diff --git a/policy/modules/admin/portage.if b/policy/modules/admin/portage.if index 0f27b1c..faf2eba 100644 --- a/policy/modules/admin/portage.if +++ b/policy/modules/admin/portage.if @@ -16,6 +16,7 @@ interface(`portage_domtrans',` gen_require(` type portage_t, portage_exec_t; + type layman_t, layman_exec_t; ') files_search_usr($1) @@ -23,6 +24,8 @@ interface(`portage_domtrans',` # transition to portage domtrans_pattern($1, portage_exec_t, portage_t) + # transition to layman + domtrans_pattern($1, layman_exec_t, layman_t) ') ######################################## @@ -45,10 +48,11 @@ interface(`portage_domtrans',` interface(`portage_run',` gen_require(` type portage_t, portage_fetch_t, portage_sandbox_t; + type layman_t; ') portage_domtrans($1) - role $2 types { portage_t portage_fetch_t portage_sandbox_t }; + role $2 types { portage_t portage_fetch_t portage_sandbox_t layman_t }; ') ######################################## diff --git a/policy/modules/admin/portage.te b/policy/modules/admin/portage.te index d2ff138..29130da 100644 --- a/policy/modules/admin/portage.te +++ b/policy/modules/admin/portage.te @@ -9,6 +9,16 @@ type gcc_config_t; type gcc_config_exec_t; application_domain(gcc_config_t, gcc_config_exec_t) +type layman_t; +type layman_exec_t; +application_domain(layman_t, layman_exec_t) + +type layman_tmp_t; +files_tmp_file(layman_tmp_t) + +type layman_var_lib_t; +files_type(layman_var_lib_t) + # constraining type type portage_t; type portage_exec_t; @@ -115,6 +125,56 @@ optional_policy(` ######################################## # +# Layman local policy +# +allow layman_t self:process signal; +allow layman_t self:fifo_file rw_fifo_file_perms; + +# Manage layman var/lib files +manage_files_pattern(layman_t, layman_var_lib_t, layman_var_lib_t) +manage_dirs_pattern(layman_t, layman_var_lib_t, layman_var_lib_t) +manage_lnk_files_pattern(layman_t, layman_var_lib_t, layman_var_lib_t) + +# Manage layman tmp files (needed in case of subversion) +manage_dirs_pattern(layman_t, layman_tmp_t, layman_tmp_t) +manage_files_pattern(layman_t, layman_tmp_t, layman_tmp_t) +files_tmp_filetrans(layman_t, layman_tmp_t, { file dir }) + + +kernel_dontaudit_read_system_state(layman_t) +kernel_dontaudit_request_load_module(layman_t) + +corecmd_exec_bin(layman_t) +corecmd_exec_shell(layman_t) + +corenet_sendrecv_generic_client_packets(layman_t) +corenet_sendrecv_git_client_packets(layman_t) +corenet_sendrecv_http_client_packets(layman_t) +corenet_sendrecv_rsync_client_packets(layman_t) +corenet_tcp_connect_generic_port(layman_t) +corenet_tcp_connect_git_port(layman_t) +corenet_tcp_connect_http_port(layman_t) +corenet_tcp_connect_rsync_port(layman_t) + +domain_use_interactive_fds(layman_t) + +files_read_etc_files(layman_t) +files_read_etc_runtime_files(layman_t) +files_read_usr_files(layman_t) +files_search_var_lib(layman_t) + + +logging_list_logs(layman_t) +miscfiles_read_localization(layman_t) +sysnet_dns_name_resolve(layman_t) +userdom_dontaudit_list_user_home_dirs(layman_t) +userdom_use_user_terminals(layman_t) + + +rsync_exec(layman_t) + +######################################## +# # Portage Merging Rules # -- 1.7.3.4