From: pebenito@ieee.org (Chris PeBenito)
Date: Sat, 31 Dec 2016 11:20:47 -0500
Subject: [refpolicy] mon patch for inclusion (I hope)
In-Reply-To: <20161231102013.fnjv5qbw525cuxd3@athena.coker.com.au>
References: <20161231102013.fnjv5qbw525cuxd3@athena.coker.com.au>
Message-ID: <09ce5e2d-40d3-772b-b2d6-f5b8368f5a24@ieee.org>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com

On 12/31/16 05:20, Russell Coker via refpolicy wrote:
> As requested I have reworked the mon policy to have separate domains for
> local tests (which in some cases need root access) and remote tests that
> just use the Internet.
>
>
> diff -ruN /home/rjc/src/pol-git/policy/modules/contrib/gpm.if ./policy/modules/contrib/gpm.if
> --- /home/rjc/src/pol-git/policy/modules/contrib/gpm.if	2016-07-30 08:14:41.105650077 +1000
> +++ ./policy/modules/contrib/gpm.if	2016-12-31 21:17:25.064313571 +1100
> @@ -38,6 +38,7 @@
>
>  	dev_list_all_dev_nodes($1)
>  	allow $1 gpmctl_t:sock_file getattr_sock_file_perms;
> +	allow $1 gpmctl_t:fifo_file getattr_fifo_file_perms;
>  ')
>
>  ########################################
> diff -ruN /home/rjc/src/pol-git/policy/modules/contrib/mon.fc ./policy/modules/contrib/mon.fc
> --- /home/rjc/src/pol-git/policy/modules/contrib/mon.fc	1970-01-01 10:00:00.000000000 +1000
> +++ ./policy/modules/contrib/mon.fc	2016-12-31 21:17:25.060313447 +1100
> @@ -0,0 +1,11 @@
> +
> +/usr/sbin/mon		--	gen_context(system_u:object_r:mon_exec_t,s0)
> +/usr/lib/mon/mon.d/.*	--	gen_context(system_u:object_r:mon_net_test_exec_t,s0)
> +/usr/lib/mon/mon-local.d/.*	--	gen_context(system_u:object_r:mon_local_test_exec_t,s0)
> +/usr/lib/mon-contrib/mon.d/.* -- gen_context(system_u:object_r:mon_net_test_exec_t,s0)
> +/usr/lib/mon-contrib/mon-local.d/.* -- gen_context(system_u:object_r:mon_local_test_exec_t,s0)
> +
> +/var/run/mon(/.*)?		gen_context(system_u:object_r:mon_var_run_t,s0)
> +
> +/var/lib/mon(/.*)?		gen_context(system_u:object_r:mon_var_lib_t,s0)
> +/var/log/mon(/.*)?		gen_context(system_u:object_r:mon_var_log_t,s0)
> diff -ruN /home/rjc/src/pol-git/policy/modules/contrib/mon.if ./policy/modules/contrib/mon.if
> --- /home/rjc/src/pol-git/policy/modules/contrib/mon.if	1970-01-01 10:00:00.000000000 +1000
> +++ ./policy/modules/contrib/mon.if	2016-12-31 21:17:25.064313571 +1100
> @@ -0,0 +1 @@
> +## <summary>mon network monitoring daemon.</summary>
> diff -ruN /home/rjc/src/pol-git/policy/modules/contrib/mon.te ./policy/modules/contrib/mon.te
> --- /home/rjc/src/pol-git/policy/modules/contrib/mon.te	1970-01-01 10:00:00.000000000 +1000
> +++ ./policy/modules/contrib/mon.te	2016-12-31 21:17:25.064313571 +1100
> @@ -0,0 +1,188 @@
> +policy_module(mon, 1.12.0)
> +
> +########################################
> +#
> +# Declarations
> +#
> +
> +type mon_t;
> +type mon_exec_t;
> +init_daemon_domain(mon_t, mon_exec_t)
> +
> +type mon_net_test_t;
> +typealias mon_net_test_t alias mon_test_t;
> +type mon_net_test_exec_t;
> +typealias mon_net_test_exec_t alias mon_test_exec_t;
> +
> +domain_type(mon_net_test_t)
> +domain_entry_file(mon_net_test_t, mon_net_test_exec_t)
> +role system_r types mon_net_test_t;
> +domtrans_pattern(mon_t, mon_net_test_exec_t, mon_net_test_t)
> +
> +type mon_local_test_t;
> +type mon_local_test_exec_t;
> +
> +domain_type(mon_local_test_t)
> +domain_entry_file(mon_local_test_t, mon_local_test_exec_t)
> +role system_r types mon_local_test_t;
> +domtrans_pattern(mon_t, mon_local_test_exec_t, mon_local_test_t)
> +
> +type mon_var_run_t;
> +files_pid_file(mon_var_run_t)
> +
> +type mon_var_lib_t;
> +files_type(mon_var_lib_t)
> +
> +type mon_var_log_t;
> +logging_log_file(mon_var_log_t)
> +
> +type mon_tmp_t;
> +files_tmp_file(mon_tmp_t)
> +
> +########################################
> +#
> +# Local policy
> +# mon_t is for the main mon process and for sending alerts
> +#
> +
> +corenet_tcp_bind_mon_port(mon_t)
> +corenet_udp_bind_mon_port(mon_t)
> +corenet_tcp_bind_generic_node(mon_t)
> +corenet_udp_bind_generic_node(mon_t)
> +allow mon_t self:tcp_socket create_stream_socket_perms;
> +
> +corenet_tcp_connect_jabber_client_port(mon_t)
> +
> +allow mon_t self:fifo_file rw_fifo_file_perms;
> +
> +manage_dirs_pattern(mon_t, mon_tmp_t, mon_tmp_t)
> +manage_files_pattern(mon_t, mon_tmp_t, mon_tmp_t)
> +files_tmp_filetrans(mon_t, mon_tmp_t, { file dir })
> +
> +manage_files_pattern(mon_t, mon_var_run_t, mon_var_run_t)
> +files_pid_filetrans(mon_t, mon_var_run_t, file)
> +
> +manage_files_pattern(mon_t, mon_var_lib_t, mon_var_lib_t)
> +
> +kernel_read_kernel_sysctls(mon_t)
> +kernel_read_network_state(mon_t)
> +kernel_read_system_state(mon_t)
> +
> +domain_use_interactive_fds(mon_t)
> +
> +corecmd_exec_bin(mon_t)
> +dev_read_urand(mon_t)
> +dev_read_sysfs(mon_t)
> +logging_search_logs(mon_t)
> +manage_files_pattern(mon_t, mon_var_log_t, mon_var_log_t)
> +
> +files_read_etc_files(mon_t)
> +files_read_etc_runtime_files(mon_t)
> +files_read_usr_files(mon_t)
> +
> +fs_getattr_all_fs(mon_t)
> +fs_search_auto_mountpoints(mon_t)
> +
> +term_dontaudit_search_ptys(mon_t)
> +
> +application_signull(mon_t)
> +
> +init_read_utmp(mon_t)
> +
> +libs_exec_ld_so(mon_t)
> +libs_exec_lib_files(mon_t)
> +
> +logging_send_syslog_msg(mon_t)
> +
> +miscfiles_read_localization(mon_t)
> +
> +sysnet_dns_name_resolve(mon_t)
> +
> +userdom_dontaudit_use_unpriv_user_fds(mon_t)
> +userdom_dontaudit_search_user_home_dirs(mon_t)
> +
> +corecmd_exec_shell(mon_t)
> +
> +optional_policy(`
> +	mta_send_mail(mon_t)
> +')
> +
> +########################################
> +#
> +# Local policy
> +# mon_net_test_t is for running tests that need network access
> +#
> +
> +can_exec(mon_net_test_t, mon_net_test_exec_t)
> +manage_files_pattern(mon_net_test_t, mon_var_lib_t, mon_var_lib_t)
> +allow mon_net_test_t self:fifo_file rw_file_perms;
> +corecmd_exec_bin(mon_net_test_t)
> +miscfiles_read_localization(mon_net_test_t)
> +files_read_usr_files(mon_net_test_t)
> +fs_getattr_xattr_fs(mon_net_test_t)
> +sysnet_read_config(mon_net_test_t)
> +auth_use_nsswitch(mon_net_test_t)
> +dev_read_urand(mon_net_test_t)
> +corenet_tcp_connect_all_ports(mon_net_test_t)
> +dev_dontaudit_getattr_all_chr_files(mon_net_test_t)
> +kernel_dontaudit_getattr_core_if(mon_net_test_t)
> +corecmd_exec_shell(mon_net_test_t)
> +dev_read_sysfs(mon_net_test_t)
> +dev_getattr_sysfs(mon_net_test_t)
> +kernel_getattr_proc(mon_net_test_t)
> +kernel_read_system_state(mon_net_test_t)
> +netutils_domtrans_ping(mon_net_test_t)

I'm ok with the rules, but I'd ask that you group the rules per standard 
style here and in the below section.


> +optional_policy(`
> +	bind_read_zone(mon_net_test_t)
> +')
> +
> +########################################
> +#
> +# Local policy
> +# mon_local_test_t is for running tests that don't need network access
> +# this domain has much more access to the local system!
> +#
> +# try not to use dontaudit rules for this
> +#
> +
> +allow mon_local_test_t self:capability sys_admin;
> +
> +can_exec(mon_local_test_t, mon_local_test_exec_t)
> +manage_files_pattern(mon_local_test_t, mon_var_lib_t, mon_var_lib_t)
> +allow mon_local_test_t self:fifo_file rw_file_perms;
> +corecmd_exec_bin(mon_local_test_t)
> +miscfiles_read_localization(mon_local_test_t)
> +files_read_usr_files(mon_local_test_t)
> +fs_getattr_xattr_fs(mon_local_test_t)
> +sysnet_read_config(mon_local_test_t)
> +auth_use_nsswitch(mon_local_test_t)
> +dev_read_urand(mon_local_test_t)
> +dev_dontaudit_getattr_all_chr_files(mon_local_test_t)
> +kernel_dontaudit_getattr_core_if(mon_local_test_t)
> +domain_read_all_domains_state(mon_local_test_t)
> +corecmd_exec_shell(mon_local_test_t)
> +dev_read_sysfs(mon_local_test_t)
> +dev_getattr_sysfs(mon_local_test_t)
> +kernel_getattr_proc(mon_local_test_t)
> +kernel_read_system_state(mon_local_test_t)
> +kernel_read_software_raid_state(mon_local_test_t)
> +fs_search_nfs(mon_local_test_t)
> +fs_getattr_nfs(mon_local_test_t)
> +storage_getattr_fixed_disk_dev(mon_local_test_t)
> +storage_getattr_removable_dev(mon_local_test_t)
> +fs_list_hugetlbfs(mon_local_test_t)
> +term_list_ptys(mon_local_test_t)
> +term_getattr_generic_ptys(mon_local_test_t)
> +fs_list_tmpfs(mon_local_test_t)
> +logging_send_syslog_msg(mon_local_test_t)
> +getattr_init_fifo(mon_local_test_t)
> +
> +optional_policy(`
> +	sudo_role_template(system, system_r, mon_local_test_t)
> +	corecmd_bin_entry_type(mon_local_test_t)
> +')
> +
> +optional_policy(`
> +	gpm_getattr_gpmctl(mon_local_test_t)
> +')
> diff -ruN /home/rjc/src/pol-git/policy/modules/kernel/corenetwork.te.in ./policy/modules/kernel/corenetwork.te.in
> --- /home/rjc/src/pol-git/policy/modules/kernel/corenetwork.te.in	2016-12-31 21:09:24.673504756 +1100
> +++ ./policy/modules/kernel/corenetwork.te.in	2016-12-31 21:17:25.064313571 +1100
> @@ -176,6 +176,7 @@
>  network_port(memcache, tcp,11211,s0, udp,11211,s0)
>  network_port(milter) # no defined portcon
>  network_port(mmcc, tcp,5050,s0, udp,5050,s0)
> +network_port(mon, tcp,2583,s0, udp,2583,s0)
>  network_port(monopd, tcp,1234,s0)
>  network_port(mountd, tcp,20048,s0, udp,20048,s0)
>  network_port(movaz_ssc, tcp,5252,s0, udp,5252,s0)
> diff -ruN /home/rjc/src/pol-git/policy/modules/system/init.if ./policy/modules/system/init.if
> --- /home/rjc/src/pol-git/policy/modules/system/init.if	2016-12-04 23:04:21.264949806 +1100
> +++ ./policy/modules/system/init.if	2016-12-31 21:17:25.064313571 +1100
> @@ -2504,3 +2504,22 @@
>
>  	allow $1 systemdunit:service reload;
>  ')
> +
> +########################################
> +## <summary>
> +##      stat /run/systemd/initctl/fifo
> +## </summary>
> +## <param name="domain">
> +##      <summary>
> +##      domain
> +##      </summary>
> +## </param>
> +#
> +interface(`getattr_init_fifo',`
> +	gen_require(`
> +		type init_var_run_t;
> +	')
> +
> +	allow $1 init_var_run_t:fifo_file getattr;
> +	allow $1 init_var_run_t:dir list_dir_perms;
> +')

This prompts a question.  Is this pipe the only systemd named pipe?  If 
so, the pipes should be initctl_t instead.  That may be outside the 
scope of this patch, as it might require some systemd/init surgery.


Not a big deal since I could trim the patch, but you accidentally 
included an init.if.orig:


> diff -ruN /home/rjc/src/pol-git/policy/modules/system/init.if.orig ./policy/modules/system/init.if.orig
> --- /home/rjc/src/pol-git/policy/modules/system/init.if.orig	1970-01-01 10:00:00.000000000 +1000
> +++ ./policy/modules/system/init.if.orig	2016-12-04 23:04:21.264949806 +1100
[cut]



-- 
Chris PeBenito