RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
selinux-refpolicy/policy/modules/services/ntp.te

203 lines
4.6 KiB
Plaintext
Raw Normal View History

various: Module version bump. Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2020-01-15 15:42:45 +00:00
policy_module(ntp, 1.20.3)
Re-add policy modules from old refpolicy-contrib submodule.
2018-06-23 13:00:56 +00:00
########################################
#
# Declarations
#
attribute_role ntpd_roles;
type ntp_conf_t;
files_config_file(ntp_conf_t)
type ntp_drift_t;
files_type(ntp_drift_t)
type ntpd_t;
type ntpd_exec_t;
init_daemon_domain(ntpd_t, ntpd_exec_t)
role ntpd_roles types ntpd_t;
type ntpd_initrc_exec_t;
init_script_file(ntpd_initrc_exec_t)
type ntpd_key_t;
files_type(ntpd_key_t)
type ntpd_lock_t;
files_lock_file(ntpd_lock_t)
init_daemon_lock_file(ntpd_lock_t, file, "ntpdate")
type ntpd_log_t;
logging_log_file(ntpd_log_t)
type ntpd_pid_t;
files_pid_file(ntpd_pid_t)
type ntpd_tmp_t;
files_tmp_file(ntpd_tmp_t)
type ntpd_tmpfs_t;
files_tmpfs_file(ntpd_tmpfs_t)
type ntpd_unit_t;
init_unit_file(ntpd_unit_t)
type ntpdate_exec_t;
init_system_domain(ntpd_t, ntpdate_exec_t)
########################################
#
# Local policy
#
allow ntpd_t self:capability { chown dac_override kill setgid setuid sys_time ipc_lock ipc_owner sys_chroot sys_nice };
dontaudit ntpd_t self:capability { net_admin sys_tty_config fsetid sys_resource };
allow ntpd_t self:process { signal_perms getcap setcap setsched setrlimit };
allow ntpd_t self:fifo_file rw_fifo_file_perms;
allow ntpd_t self:shm create_shm_perms;
allow ntpd_t self:socket create;
allow ntpd_t self:unix_dgram_socket sendto;
allow ntpd_t ntp_conf_t:file read_file_perms;
manage_dirs_pattern(ntpd_t, ntp_drift_t, ntp_drift_t)
manage_files_pattern(ntpd_t, ntp_drift_t, ntp_drift_t)
files_etc_filetrans(ntpd_t, ntp_drift_t, file)
files_var_filetrans(ntpd_t, ntp_drift_t, file)
read_files_pattern(ntpd_t, ntpd_key_t, ntpd_key_t)
read_lnk_files_pattern(ntpd_t, ntpd_key_t, ntpd_key_t)
allow ntpd_t ntpd_lock_t:file rw_file_perms;
allow ntpd_t ntpd_log_t:dir setattr_dir_perms;
logging Prosody and ntpd don't just need append access to their log files.
2019-01-08 08:55:27 +00:00
manage_dirs_pattern(ntpd_t, ntpd_log_t, ntpd_log_t)
manage_files_pattern(ntpd_t, ntpd_log_t, ntpd_log_t)
Re-add policy modules from old refpolicy-contrib submodule.
2018-06-23 13:00:56 +00:00
logging_log_filetrans(ntpd_t, ntpd_log_t, { file dir })
manage_files_pattern(ntpd_t, ntpd_pid_t, ntpd_pid_t)
files_pid_filetrans(ntpd_t, ntpd_pid_t, file)
manage_dirs_pattern(ntpd_t, ntpd_tmp_t, ntpd_tmp_t)
manage_files_pattern(ntpd_t, ntpd_tmp_t, ntpd_tmp_t)
files_tmp_filetrans(ntpd_t, ntpd_tmp_t, { file dir })
manage_dirs_pattern(ntpd_t, ntpd_tmpfs_t, ntpd_tmpfs_t)
manage_files_pattern(ntpd_t, ntpd_tmpfs_t, ntpd_tmpfs_t)
fs_tmpfs_filetrans(ntpd_t, ntpd_tmpfs_t, { dir file })
can_exec(ntpd_t, ntpd_exec_t)
kernel_read_kernel_sysctls(ntpd_t)
kernel_read_system_state(ntpd_t)
kernel_read_network_state(ntpd_t)
kernel_request_load_module(ntpd_t)
corenet_all_recvfrom_unlabeled(ntpd_t)
corenet_all_recvfrom_netlabel(ntpd_t)
corenet_udp_sendrecv_generic_if(ntpd_t)
corenet_udp_sendrecv_generic_node(ntpd_t)
corenet_udp_bind_generic_node(ntpd_t)
corenet_sendrecv_ntp_client_packets(ntpd_t)
corenet_sendrecv_ntp_server_packets(ntpd_t)
corenet_udp_bind_ntp_port(ntpd_t)
corecmd_exec_bin(ntpd_t)
corecmd_exec_shell(ntpd_t)
dev_read_sysfs(ntpd_t)
dev_read_urand(ntpd_t)
dev_rw_realtime_clock(ntpd_t)
domain_use_interactive_fds(ntpd_t)
domain_dontaudit_list_all_domains_state(ntpd_t)
Allow ntpd to update timezone symlink type=AVC msg=audit(1553013821.624:9907): avc: denied { create } for pid=16281 comm="systemd-timedat" name=".#localtime69bc4c9ad513a247" scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=lnk_file permissive=1 type=AVC msg=audit(1553013821.624:9908): avc: denied { rename } for pid=16281 comm="systemd-timedat" name=".#localtime69bc4c9ad513a247" dev="dm-1" ino=714303 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=lnk_file permissive=1 type=AVC msg=audit(1553013821.624:9908): avc: denied { unlink } for pid=16281 comm="systemd-timedat" name="localtime" dev="dm-1" ino=1063377 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=lnk_file permissive=1 Signed-off-by: Dave Sugar <dsugar@tresys.com>
2019-03-20 00:20:34 +00:00
files_manage_etc_symlinks(ntpd_t)
Re-add policy modules from old refpolicy-contrib submodule.
2018-06-23 13:00:56 +00:00
files_read_etc_runtime_files(ntpd_t)
files_read_usr_files(ntpd_t)
files_list_var_lib(ntpd_t)
fs_getattr_all_fs(ntpd_t)
fs_search_auto_mountpoints(ntpd_t)
term_use_ptmx(ntpd_t)
auth_use_nsswitch(ntpd_t)
init_exec_script_files(ntpd_t)
logging_send_syslog_msg(ntpd_t)
miscfiles_read_localization(ntpd_t)
userdom_dontaudit_use_unpriv_user_fds(ntpd_t)
userdom_list_user_home_dirs(ntpd_t)
ifdef(`init_systemd',`
Allow ntpd to read unit files Adding missing documenation (sorry about that). type=AVC msg=audit(1553013917.359:9935): avc: denied { read } for pid=16326 comm="systemd-timedat" name="50-chronyd.list" dev="dm-1" ino=4870675 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:ntpd_unit_t:s0 tclass=file permissive=1 type=AVC msg=audit(1553013917.359:9935): avc: denied { open } for pid=16326 comm="systemd-timedat" path="/usr/lib/systemd/ntp-units.d/50-chronyd.list" dev="dm-1" ino=4870675 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:ntpd_unit_t:s0 tclass=file permissive=1 type=AVC msg=audit(1553013917.359:9936): avc: denied { getattr } for pid=16326 comm="systemd-timedat" path="/usr/lib/systemd/ntp-units.d/50-chronyd.list" dev="dm-1" ino=4870675 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:ntpd_unit_t:s0 tclass=file permissive=1 type=AVC msg=audit(1553013821.622:9902): avc: denied { getattr } for pid=16281 comm="systemd-timedat" path="/usr/lib/systemd/ntp-units.d" dev="dm-1" ino=4700094 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:systemd_unit_t:s0 tclass=dir permissive=1 type=AVC msg=audit(1553013821.622:9903): avc: denied { read } for pid=16281 comm="systemd-timedat" name="ntp-units.d" dev="dm-1" ino=4700094 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:systemd_unit_t:s0 tclass=dir permissive=1 type=AVC msg=audit(1553013821.622:9903): avc: denied { open } for pid=16281 comm="systemd-timedat" path="/usr/lib/systemd/ntp-units.d" dev="dm-1" ino=4700094 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:systemd_unit_t:s0 tclass=dir permissive=1 Signed-off-by: Dave Sugar <dsugar@tresys.com>
2019-03-26 22:00:27 +00:00
allow ntpd_t ntpd_unit_t:file read_file_perms;
Re-add policy modules from old refpolicy-contrib submodule.
2018-06-23 13:00:56 +00:00
dbus_system_bus_client(ntpd_t)
dbus_connect_system_bus(ntpd_t)
init_dbus_chat(ntpd_t)
init_get_system_status(ntpd_t)
Allow ntpd to read unit files Adding missing documenation (sorry about that). type=AVC msg=audit(1553013917.359:9935): avc: denied { read } for pid=16326 comm="systemd-timedat" name="50-chronyd.list" dev="dm-1" ino=4870675 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:ntpd_unit_t:s0 tclass=file permissive=1 type=AVC msg=audit(1553013917.359:9935): avc: denied { open } for pid=16326 comm="systemd-timedat" path="/usr/lib/systemd/ntp-units.d/50-chronyd.list" dev="dm-1" ino=4870675 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:ntpd_unit_t:s0 tclass=file permissive=1 type=AVC msg=audit(1553013917.359:9936): avc: denied { getattr } for pid=16326 comm="systemd-timedat" path="/usr/lib/systemd/ntp-units.d/50-chronyd.list" dev="dm-1" ino=4870675 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:ntpd_unit_t:s0 tclass=file permissive=1 type=AVC msg=audit(1553013821.622:9902): avc: denied { getattr } for pid=16281 comm="systemd-timedat" path="/usr/lib/systemd/ntp-units.d" dev="dm-1" ino=4700094 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:systemd_unit_t:s0 tclass=dir permissive=1 type=AVC msg=audit(1553013821.622:9903): avc: denied { read } for pid=16281 comm="systemd-timedat" name="ntp-units.d" dev="dm-1" ino=4700094 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:systemd_unit_t:s0 tclass=dir permissive=1 type=AVC msg=audit(1553013821.622:9903): avc: denied { open } for pid=16281 comm="systemd-timedat" path="/usr/lib/systemd/ntp-units.d" dev="dm-1" ino=4700094 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:systemd_unit_t:s0 tclass=dir permissive=1 Signed-off-by: Dave Sugar <dsugar@tresys.com>
2019-03-26 22:00:27 +00:00
init_list_unit_dirs(ntpd_t)
systemd related interfaces This patch has interface changes related to systemd support as well as policy that uses the new interfaces.
2019-01-04 07:51:18 +00:00
# for /var/lib/systemd/timesync
init_read_var_lib_links(ntpd_t)
Re-add policy modules from old refpolicy-contrib submodule.
2018-06-23 13:00:56 +00:00
allow ntpd_t self:capability { fowner setpcap };
Allow ntpd_t to read init state With systemd-timesyncd, the following AVC denials are generated: type=AVC msg=audit(01/11/18 15:44:39.564:48) : avc: denied { open } for pid=397 comm=systemd-timesyn path=/proc/1/sched dev="proc" ino=1128 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=file permissive=1 type=AVC msg=audit(01/11/18 15:44:39.564:48) : avc: denied { read } for pid=397 comm=systemd-timesyn name=sched dev="proc" ino=1128 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=file permissive=1 type=AVC msg=audit(01/11/18 15:44:39.564:49) : avc: denied { getattr } for pid=397 comm=systemd-timesyn path=/proc/1/sched dev="proc" ino=1128 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=file permissive=1
2018-11-01 15:09:00 +00:00
init_read_state(ntpd_t)
Re-add policy modules from old refpolicy-contrib submodule.
2018-06-23 13:00:56 +00:00
init_reload(ntpd_t)
# for /var/lib/systemd/clock
init_list_var_lib_dirs(ntpd_t)
# for /run/systemd/netif/links
systemd: Rename systemd_list_netif() to systemd_list_networkd_runtime(). Move implementation with other networkd_runtime interfaces.
2019-01-06 18:49:02 +00:00
systemd_list_networkd_runtime(ntpd_t)
ntp: allow systemd-timesyncd to read network status systemd-timesyncd uses network_is_online() [1], which calls sd_network_get_operational_state() [2], which reads /run/systemd/netif/state [3]: r = parse_env_file(NULL, "/run/systemd/netif/state", "OPER_STATE", &s); On a Debian virtual machine created with Vagrant, /run/systemd/netif/state contains: # This is private data. Do not parse. OPER_STATE=routable DNS=192.168.121.1 172.28.128.1 systemd-timesyncd's access produces the following logs: type=AVC msg=audit(1567359197.660:323): avc: denied { read } for pid=230 comm="systemd-timesyn" name="state" dev="tmpfs" ino=24564 scontext=system_u:system_r:ntpd_t tcontext=system_u:object_r:systemd_networkd_var_run_t tclass=file permissive=1 type=AVC msg=audit(1567359197.660:324): avc: denied { open } for pid=230 comm="systemd-timesyn" path="/run/systemd/netif/state" dev="tmpfs" ino=24564 scontext=system_u:system_r:ntpd_t tcontext=system_u:object_r:systemd_networkd_var_run_t tclass=file permissive=1 type=AVC msg=audit(1567359197.660:325): avc: denied { getattr } for pid=230 comm="systemd-timesyn" path="/run/systemd/netif/state" dev="tmpfs" ino=24564 scontext=system_u:system_r:ntpd_t tcontext=system_u:object_r:systemd_networkd_var_run_t tclass=file permissive=1 Allow these accesses. [1] https://github.com/systemd/systemd/blob/v242/src/timesync/timesyncd.c#L158 [2] https://github.com/systemd/systemd/blob/v242/src/libsystemd/sd-network/network-util.c#L13 [3] https://github.com/systemd/systemd/blob/v242/src/libsystemd/sd-network/sd-network.c#L27 Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2019-09-01 18:44:14 +00:00
# for /run/systemd/netif/state
systemd_read_networkd_runtime(ntpd_t)
Re-add policy modules from old refpolicy-contrib submodule.
2018-06-23 13:00:56 +00:00
Allow ntpd to update chronyd service type=USER_AVC msg=audit(1553013917.361:9938): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc: denied { disable } for auid=n/a uid=0 gid=0 path="/usr/lib/systemd/system/chronyd.service" cmdline="/usr/lib/systemd/systemd-timedated" scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:chronyd_unit_t:s0 tclass=service exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=? type=USER_AVC msg=audit(1553013917.406:9943): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc: denied { stop } for auid=n/a uid=0 gid=0 path="/usr/lib/systemd/system/chronyd.service" cmdline="/usr/lib/systemd/systemd-timedated" scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:chronyd_unit_t:s0 tclass=service exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?' type=USER_AVC msg=audit(1553021100.061:9970): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc: denied { enable } for auid=n/a uid=0 gid=0 path="/usr/lib/systemd/system/chronyd.service" cmdline="/usr/lib/systemd/systemd-timedated" scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:chronyd_unit_t:s0 tclass=service exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?' type=USER_AVC msg=audit(1553021100.104:9973): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc: denied { start } for auid=n/a uid=0 gid=0 path="/usr/lib/systemd/system/chronyd.service" cmdline="/usr/lib/systemd/systemd-timedated" scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:chronyd_unit_t:s0 tclass=service exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?' Signed-off-by: Dave Sugar <dsugar@tresys.com>
2019-03-20 00:20:34 +00:00
optional_policy(`
chronyd_enabledisable(ntpd_t)
chronyd_startstop(ntpd_t)
')
Re-add policy modules from old refpolicy-contrib submodule.
2018-06-23 13:00:56 +00:00
optional_policy(`
unconfined_dbus_send(ntpd_t)
')
')
optional_policy(`
clock_read_adjtime(ntpd_t)
')
optional_policy(`
cron_system_entry(ntpd_t, ntpdate_exec_t)
')
optional_policy(`
gpsd_rw_shm(ntpd_t)
')
optional_policy(`
firstboot_dontaudit_use_fds(ntpd_t)
firstboot_dontaudit_rw_pipes(ntpd_t)
firstboot_dontaudit_rw_stream_sockets(ntpd_t)
')
optional_policy(`
hal_dontaudit_write_log(ntpd_t)
')
optional_policy(`
logrotate_exec(ntpd_t)
')
optional_policy(`
seutil_sigchld_newrole(ntpd_t)
')
optional_policy(`
udev_read_db(ntpd_t)
')