From: guido@trentalancia.net (Guido Trentalancia)
Date: Fri, 19 Aug 2016 22:41:08 +0200
Subject: [refpolicy] [PATCH v5] Add module_load permission to
	can_load_kernmodule
In-Reply-To: <6c4dbea2-4bb5-fe20-fd0b-2badaa067d23@ieee.org>
References: <1470604093.2822.5.camel@trentalancia.net>
	<1470752290.26741.0.camel@trentalancia.net>
	<cf1ea694-5c65-6704-1220-be3b1de5a38e@ieee.org>
	<1401960383.997208.1471208558275.JavaMail.open-xchange@popper06.register.it>
	<1471299772.3112.0.camel@trentalancia.net>
	<1471613252.2903.14.camel@trentalancia.net>
	<6c4dbea2-4bb5-fe20-fd0b-2badaa067d23@ieee.org>
Message-ID: <1471639268.9597.2.camel@trentalancia.net>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com

Hello Christopher.

On Wed, 17/08/2016 at 16.05 -0400, Chris PeBenito wrote:
> On 08/19/16 09:27, Guido Trentalancia wrote:
> > The "module_load" permission has been recently added to the
> > "system"
> > class (kernel 4.7).
> > 
> > The following patch updates the Reference Policy so that the new
> > permission is allowed when a kernel module should be loaded.
> > 
> > To preserve the module encapsulation, a new interface is defined
> > in the kernel files module and that interface is then used in the
> > kernel module.
> > 
> > A short note is added about unneeded permissions that set the
> > kernel scheduling parameters (might lead to service disruption).
> 
> The policy change is fine, but I want to think about the name of the?
> interface.??The name doesn't seem right, but I can't immediately come
> up?
> with a better one.

An alternative name could be:

files_kernel_module_load()

> > Signed-off-by: Guido Trentalancia <guido@trentalancia.net>
> > ---
> > ?policy/modules/kernel/files.if??|???19 +++++++++++++++++++
> > ?policy/modules/kernel/kernel.te |????4 ++++
> > ?2 files changed, 23 insertions(+)
> > 
> > --- refpolicy-git-06082016-orig/policy/modules/kernel/files.if	
> > 2016-08-06 21:26:43.284774157 +0200
> > +++ refpolicy-git-06082016/policy/modules/kernel/files.if	20
> > 16-08-19 15:05:34.503054733 +0200
> > @@ -4158,6 +4158,25 @@ interface(`files_kernel_modules_filetran
> > 
> > ?########################################
> > ?## <summary>
> > +##	Load kernel module files.
> > +## </summary>
> > +## <param name="domain">
> > +##	<summary>
> > +##	Domain allowed access.
> > +##	</summary>
> > +## </param>
> > +#
> > +interface(`files_load_kernel_modules',`
> > +	gen_require(`
> > +		type modules_object_t;
> > +	')
> > +
> > +	files_read_kernel_modules($1)
> > +	allow $1 modules_object_t:system module_load;
> > +')
> > +
> > +########################################
> > +## <summary>
> > ?##	List world-readable directories.
> > ?## </summary>
> > ?## <param name="domain">
> > --- refpolicy-git-06082016-orig/policy/modules/kernel/kernel.te	
> > 2016-08-09 16:09:48.811753763 +0200
> > +++ refpolicy-git-06082016/policy/modules/kernel/kernel.te	2
> > 016-08-19 15:07:21.169666858 +0200
> > @@ -429,8 +429,12 @@ optional_policy(`
> > ?if( ! secure_mode_insmod ) {
> > ?	allow can_load_kernmodule self:capability sys_module;
> > 
> > +	files_load_kernel_modules(can_load_kernmodule)
> > +
> > ?	# load_module() calls stop_machine() which
> > ?	# calls sched_setscheduler()
> > +	# gt: there seems to be no trace of the above, at
> > +	# least in kernel versions greater than 2.6.37...
> > ?	allow can_load_kernmodule self:capability sys_nice;
> > ?	kernel_setsched(can_load_kernmodule)
> > ?}
> >?

Best regards,

Guido