From: guido@trentalancia.net (Guido Trentalancia) Date: Fri, 30 Dec 2016 23:28:37 +0100 (CET) Subject: [refpolicy] [PATCH v2] init: update the initrc_t domain policy In-Reply-To: <1483051782.12123.10.camel@trentalancia.net> References: <1483051782.12123.10.camel@trentalancia.net> Message-ID: <978270280.72036.1483136917778.JavaMail.open-xchange@popper10.register.it> To: refpolicy@oss.tresys.com List-Id: refpolicy.oss.tresys.com Update the initrc_t domain policy in the init module with some missing permissions. Signed-off-by: Guido Trentalancia --- policy/modules/kernel/terminal.if | 21 +++++++++++++++++++++ policy/modules/system/init.te | 15 +++++++++++++-- 2 files changed, 34 insertions(+), 2 deletions(-) diff -pru a/policy/modules/kernel/terminal.if b/policy/modules/kernel/terminal.if --- a/policy/modules/kernel/terminal.if 2016-12-27 22:41:00.664390360 +0100 +++ b/policy/modules/kernel/terminal.if 2016-12-30 23:17:49.135396217 +0100 @@ -1102,6 +1102,27 @@ interface(`term_relabel_all_user_ptys',` ######################################## ## +## Unlink BSD-style pty device +## nodes. +## +## +## +## Domain allowed access. +## +## +## +# +interface(`term_unlink_bsd_ptys',` + gen_require(` + type bsdpty_device_t; + ') + + dev_list_all_dev_nodes($1) + allow $1 bsdpty_device_t:chr_file { unlink }; +') + +######################################## +## ## Get the attributes of all unallocated ## tty device nodes. ## diff -pru a/policy/modules/system/init.te b/policy/modules/system/init.te --- a/policy/modules/system/init.te 2016-12-29 22:48:16.456818544 +0100 +++ b/policy/modules/system/init.te 2016-12-30 23:18:06.332953421 +0100 @@ -415,6 +415,7 @@ kernel_clear_ring_buffer(initrc_t) kernel_get_sysvipc_info(initrc_t) kernel_read_all_sysctls(initrc_t) kernel_rw_all_sysctls(initrc_t) +kernel_use_fds(initrc_t) # for lsof which is used by alsa shutdown: kernel_dontaudit_getattr_message_if(initrc_t) # cjp: not sure why these are here; should use mount policy @@ -462,6 +463,8 @@ dev_getattr_all_blk_files(initrc_t) dev_getattr_all_chr_files(initrc_t) # Early devtmpfs dev_rw_generic_chr_files(initrc_t) +# mcelog service +dev_read_kmsg(initrc_t) domain_kill_all_domains(initrc_t) domain_signal_all_domains(initrc_t) @@ -496,6 +499,8 @@ files_exec_etc_files(initrc_t) files_read_usr_files(initrc_t) files_manage_urandom_seed(initrc_t) files_manage_generic_spool(initrc_t) +# manage the restorecond lock file +files_manage_generic_locks(initrc_t) # Mount and unmount file systems. # cjp: not sure why these are here; should use mount policy files_list_default(initrc_t) @@ -532,10 +537,12 @@ storage_setattr_removable_dev(initrc_t) term_use_all_terms(initrc_t) term_reset_tty_labels(initrc_t) +term_unlink_bsd_ptys(initrc_t) auth_rw_login_records(initrc_t) auth_setattr_login_records(initrc_t) auth_rw_lastlog(initrc_t) +auth_manage_faillog(initrc_t) auth_read_pam_pid(initrc_t) auth_delete_pam_pid(initrc_t) auth_delete_pam_console_data(initrc_t) @@ -831,12 +838,12 @@ optional_policy(` ') optional_policy(` - dev_getattr_printer_dev(initrc_t) - cups_read_log(initrc_t) cups_read_rw_config(initrc_t) #cups init script clears error log cups_write_log(initrc_t) + + dev_getattr_printer_dev(initrc_t) ') optional_policy(` @@ -900,6 +907,10 @@ optional_policy(` ') optional_policy(` + iptables_read_config(initrc_t) +') + +optional_policy(` iscsi_stream_connect(initrc_t) iscsi_read_lib_files(initrc_t) ')