* Add separate db for couchjs, as it needs execmem
* Add several dontaudits to hide noise caused by Erlang's disksup
---
couchdb.fc | 16 +++++++---------
couchdb.te | 26 ++++++++++++++++++++++++--
2 files changed, 31 insertions(+), 11 deletions(-)
diff --git a/couchdb.fc b/couchdb.fc
index c086302..5c1388a 100644
--- a/couchdb.fc
+++ b/couchdb.fc
@@ -1,11 +1,9 @@
-/etc/couchdb(/.*)? gen_context(system_u:object_r:couchdb_conf_t,s0)
+/etc/couchdb(/.*)? gen_context(system_u:object_r:couchdb_conf_t,s0)
-/etc/rc\.d/init\.d/couchdb -- gen_context(system_u:object_r:couchdb_initrc_exec_t,s0)
+/usr/bin/couchdb -- gen_context(system_u:object_r:couchdb_exec_t,s0)
+/usr/lib/couchdb/bin/couchjs -- gen_context(system_u:object_r:couchdb_js_exec_t,s0)
+/usr/lib/couchdb/erlang/lib/couch-[0-9.]+/priv/couchspawnkillable -- gen_context(system_u:object_r:bin_t,s0)
-/usr/bin/couchdb -- gen_context(system_u:object_r:couchdb_exec_t,s0)
-
-/var/lib/couchdb(/.*)? gen_context(system_u:object_r:couchdb_var_lib_t,s0)
-
-/var/log/couchdb(/.*)? gen_context(system_u:object_r:couchdb_log_t,s0)
-
-/var/run/couchdb(/.*)? gen_context(system_u:object_r:couchdb_var_run_t,s0)
+/var/lib/couchdb(/.*)? gen_context(system_u:object_r:couchdb_var_lib_t,s0)
+/var/log/couchdb(/.*)? gen_context(system_u:object_r:couchdb_log_t,s0)
+/var/run/couchdb(/.*)? gen_context(system_u:object_r:couchdb_var_run_t,s0)
diff --git a/couchdb.te b/couchdb.te
index ae1c1b1..1bf163e 100644
--- a/couchdb.te
+++ b/couchdb.te
@@ -9,6 +9,10 @@ type couchdb_t;
type couchdb_exec_t;
init_daemon_domain(couchdb_t, couchdb_exec_t)
+type couchdb_js_t;
+type couchdb_js_exec_t;
+init_daemon_domain(couchdb_js_t, couchdb_js_exec_t)
+
type couchdb_initrc_exec_t;
init_script_file(couchdb_initrc_exec_t)
@@ -29,10 +33,10 @@ files_pid_file(couchdb_var_run_t)
########################################
#
-# Local policy
+# couchdb policy
#
-allow couchdb_t self:process { setsched signal signull sigkill };
+allow couchdb_t self:process { getsched setsched signal signull sigkill };
allow couchdb_t self:fifo_file rw_fifo_file_perms;
allow couchdb_t self:unix_stream_socket create_stream_socket_perms;
allow couchdb_t self:tcp_socket { accept listen };
@@ -70,6 +74,7 @@ corenet_all_recvfrom_netlabel(couchdb_t)
corenet_tcp_sendrecv_generic_if(couchdb_t)
corenet_tcp_sendrecv_generic_node(couchdb_t)
corenet_tcp_bind_generic_node(couchdb_t)
+corenet_udp_bind_generic_node(couchdb_t)
corenet_sendrecv_couchdb_server_packets(couchdb_t)
corenet_tcp_bind_couchdb_port(couchdb_t)
@@ -81,8 +86,25 @@ dev_read_urand(couchdb_t)
files_read_usr_files(couchdb_t)
+# disksup tries to monitor the local disks
fs_getattr_xattr_fs(couchdb_t)
+fs_dontaudit_getattr_all_fs(couchdb_t)
+files_dontaudit_search_all_mountpoints(couchdb_t)
+files_dontaudit_getattr_lost_found_dirs(couchdb_t)
+dontaudit couchdb_t var_t:dir list_dir_perms;
auth_use_nsswitch(couchdb_t)
miscfiles_read_localization(couchdb_t)
+
+domtrans_pattern(couchdb_t, couchdb_js_exec_t, couchdb_js_t)
+
+########################################
+#
+# couchdb_js policy
+#
+
+allow couchdb_js_t self:process { execmem getsched setsched };
+
+files_read_usr_files(couchdb_js_t)
+miscfiles_read_localization(couchdb_js_t)
--
1.8.5.3
On 1/25/2014 6:18 PM, Luis Ressel wrote:
> * Add separate db for couchjs, as it needs execmem
> * Add several dontaudits to hide noise caused by Erlang's disksup
> ---
> couchdb.fc | 16 +++++++---------
> couchdb.te | 26 ++++++++++++++++++++++++--
> 2 files changed, 31 insertions(+), 11 deletions(-)
>
> diff --git a/couchdb.fc b/couchdb.fc
> index c086302..5c1388a 100644
> --- a/couchdb.fc
> +++ b/couchdb.fc
> @@ -1,11 +1,9 @@
> -/etc/couchdb(/.*)? gen_context(system_u:object_r:couchdb_conf_t,s0)
> +/etc/couchdb(/.*)? gen_context(system_u:object_r:couchdb_conf_t,s0)
>
> -/etc/rc\.d/init\.d/couchdb -- gen_context(system_u:object_r:couchdb_initrc_exec_t,s0)
> +/usr/bin/couchdb -- gen_context(system_u:object_r:couchdb_exec_t,s0)
> +/usr/lib/couchdb/bin/couchjs -- gen_context(system_u:object_r:couchdb_js_exec_t,s0)
> +/usr/lib/couchdb/erlang/lib/couch-[0-9.]+/priv/couchspawnkillable -- gen_context(system_u:object_r:bin_t,s0)
>
> -/usr/bin/couchdb -- gen_context(system_u:object_r:couchdb_exec_t,s0)
> -
> -/var/lib/couchdb(/.*)? gen_context(system_u:object_r:couchdb_var_lib_t,s0)
> -
> -/var/log/couchdb(/.*)? gen_context(system_u:object_r:couchdb_log_t,s0)
> -
> -/var/run/couchdb(/.*)? gen_context(system_u:object_r:couchdb_var_run_t,s0)
> +/var/lib/couchdb(/.*)? gen_context(system_u:object_r:couchdb_var_lib_t,s0)
> +/var/log/couchdb(/.*)? gen_context(system_u:object_r:couchdb_log_t,s0)
> +/var/run/couchdb(/.*)? gen_context(system_u:object_r:couchdb_var_run_t,s0)
Typically, its preferred that whitespace fixes be sent in separate patches.
> diff --git a/couchdb.te b/couchdb.te
> index ae1c1b1..1bf163e 100644
> --- a/couchdb.te
> +++ b/couchdb.te
> @@ -81,8 +86,25 @@ dev_read_urand(couchdb_t)
>
> files_read_usr_files(couchdb_t)
>
> +# disksup tries to monitor the local disks
> fs_getattr_xattr_fs(couchdb_t)
> +fs_dontaudit_getattr_all_fs(couchdb_t)
> +files_dontaudit_search_all_mountpoints(couchdb_t)
> +files_dontaudit_getattr_lost_found_dirs(couchdb_t)
> +dontaudit couchdb_t var_t:dir list_dir_perms;
This last rule needs to use an interface instead.
> auth_use_nsswitch(couchdb_t)
>
> miscfiles_read_localization(couchdb_t)
> +
> +domtrans_pattern(couchdb_t, couchdb_js_exec_t, couchdb_js_t)
> +
> +########################################
> +#
> +# couchdb_js policy
> +#
> +
> +allow couchdb_js_t self:process { execmem getsched setsched };
> +
> +files_read_usr_files(couchdb_js_t)
> +miscfiles_read_localization(couchdb_js_t)
Is this a complete set of rules for this domain? This doesn't look like it can really do anything, since it doesn't have any output.
--
Chris PeBenito
Tresys Technology, LLC
http://www.tresys.com | oss.tresys.com
On Fri, 31 Jan 2014 23:05:46 -0500
"Christopher J. PeBenito" <[email protected]> wrote:
> Typically, its preferred that whitespace fixes be sent in separate
> patches.
> This last rule needs to use an interface instead.
I'll send a new patch series to address your concerns.
> Is this a complete set of rules for this domain? This doesn't look
> like it can really do anything, since it doesn't have any output.
Yes, this is the complete set of neccessary rules. couchjs is a helper
program invoked by couchdb to execute Javascript. It communicates its
results back via a fifo, which is allowed by domtrans_pattern().
--
Luis Ressel <[email protected]>
GPG fpr: F08D 2AF6 655E 25DE 52BC E53D 08F5 7F90 3029 B5BD
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 966 bytes
Desc: not available
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20140201/d94d1b5e/attachment-0001.bin