RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
selinux-refpolicy/policy/modules/system/fstools.fc

117 lines
7.6 KiB
Plaintext
Raw Normal View History

Support systems with a single /usr/bin directory On systems such as Arch Linux, all programs which are usually located in /bin, /sbin, /usr/bin and /usr/sbin are present in /usr/bin and the other locations are symbolic links to this directory. With such a configuration, the file contexts which define types for files in /bin, /sbin and /usr/sbin need to be duplicated to provide definitions for /usr/bin/... As the "/bin vs. /usr/bin" part of the needed definitions has already been done with the "usr merge" patches, the next step consists in duplicating file contexts for /usr/sbin. This is what this patch does for all modules which are not in contrib. This is the second iteration of an idea I have previously posted on http://oss.tresys.com/pipermail/refpolicy/2017-March/009176.html
2017-04-15 18:49:07 +00:00
/usr/bin/addpart -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/badblocks -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/blkid -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/blockdev -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/cfdisk -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/clubufflush -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/delpart -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/dosfsck -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/dump -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/dumpe2fs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/e2fsck -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/e4fsck -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/e2label -- gen_context(system_u:object_r:fsadm_exec_t,s0)
fstools: label e2mmpstatus as fsadm_exec_t e2fsprogs 1.44.3 installs e2mmpstatus as a hard link to dumpe2fs. This makes "restorecon -Rv /usr/bin" relabels this file with conflicting contexts: Relabeled /usr/bin/e2mmpstatus from system_u:object_r:fsadm_exec_t to system_u:object_r:bin_t Relabeled /usr/bin/dumpe2fs from system_u:object_r:bin_t to system_u:object_r:fsadm_exec_t Fix this by labelling e2mmpstatus like dumpe2fs. Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2018-08-03 19:27:51 +00:00
/usr/bin/e2mmpstatus -- gen_context(system_u:object_r:fsadm_exec_t,s0)
Support systems with a single /usr/bin directory On systems such as Arch Linux, all programs which are usually located in /bin, /sbin, /usr/bin and /usr/sbin are present in /usr/bin and the other locations are symbolic links to this directory. With such a configuration, the file contexts which define types for files in /bin, /sbin and /usr/sbin need to be duplicated to provide definitions for /usr/bin/... As the "/bin vs. /usr/bin" part of the needed definitions has already been done with the "usr merge" patches, the next step consists in duplicating file contexts for /usr/sbin. This is what this patch does for all modules which are not in contrib. This is the second iteration of an idea I have previously posted on http://oss.tresys.com/pipermail/refpolicy/2017-March/009176.html
2017-04-15 18:49:07 +00:00
/usr/bin/efibootmgr -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/fatsort -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/fdisk -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/findfs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/fsck.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/gdisk -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/hdparm -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/install-mbr -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/jfs_.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/losetup.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/lsraid -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/make_reiser4 -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/mkdosfs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/mke2fs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/mke4fs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/mkfs.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/mkraid -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/mkreiserfs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/mkswap -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/parted -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/partition_uuid -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/partprobe -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/partx -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/raidautorun -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/raidstart -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/raw -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/reiserfs(ck|tune) -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/resize.*fs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/scsi_info -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/scsi_unique_id -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/syslinux -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/sfdisk -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/smartctl -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/swapoff -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/swapon.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/tune2fs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/zdb -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/zhack -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/zinject -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/zpios -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/zstreamdump -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/bin/ztest -- gen_context(system_u:object_r:fsadm_exec_t,s0)
add fstools, and more cleanup
2005-06-27 20:59:28 +00:00
Add file contexts in /usr for /bin, /usr/sbin and /usr/lib Some policy modules define file contexts in /bin, /sbin and /lib without defining similar file contexts in the same directory under /usr. Add these missing file contexts when there are outside ifdef blocks.
2016-12-27 16:06:54 +00:00
/usr/sbin/addpart -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/sbin/badblocks -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/sbin/blkid -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/sbin/blockdev -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/sbin/cfdisk -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/sbin/clubufflush -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/sbin/delpart -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/sbin/dosfsck -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/sbin/dump -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/sbin/dumpe2fs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/sbin/e2fsck -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/sbin/e4fsck -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/sbin/e2label -- gen_context(system_u:object_r:fsadm_exec_t,s0)
fstools: label e2mmpstatus as fsadm_exec_t e2fsprogs 1.44.3 installs e2mmpstatus as a hard link to dumpe2fs. This makes "restorecon -Rv /usr/bin" relabels this file with conflicting contexts: Relabeled /usr/bin/e2mmpstatus from system_u:object_r:fsadm_exec_t to system_u:object_r:bin_t Relabeled /usr/bin/dumpe2fs from system_u:object_r:bin_t to system_u:object_r:fsadm_exec_t Fix this by labelling e2mmpstatus like dumpe2fs. Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2018-08-03 19:27:51 +00:00
/usr/sbin/e2mmpstatus -- gen_context(system_u:object_r:fsadm_exec_t,s0)
Add file contexts in /usr for /bin, /usr/sbin and /usr/lib Some policy modules define file contexts in /bin, /sbin and /lib without defining similar file contexts in the same directory under /usr. Add these missing file contexts when there are outside ifdef blocks.
2016-12-27 16:06:54 +00:00
/usr/sbin/efibootmgr -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/sbin/fatsort -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/sbin/fdisk -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/sbin/findfs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/sbin/fsck.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/sbin/gdisk -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/sbin/hdparm -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/sbin/install-mbr -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/sbin/jfs_.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/sbin/losetup.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/sbin/lsraid -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/sbin/make_reiser4 -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/sbin/mkdosfs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/sbin/mke2fs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/sbin/mke4fs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/sbin/mkfs.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/sbin/mkraid -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/sbin/mkreiserfs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/sbin/mkswap -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/sbin/parted -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/sbin/partprobe -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/sbin/partx -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/sbin/raidautorun -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/sbin/raidstart -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/sbin/reiserfs(ck|tune) -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/sbin/resize.*fs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/sbin/scsi_info -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/sbin/sfdisk -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/sbin/smartctl -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/sbin/swapoff -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/sbin/swapon.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/sbin/tune2fs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/sbin/zdb -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/sbin/zhack -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/sbin/zinject -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/sbin/zpios -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/sbin/zstreamdump -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/sbin/ztest -- gen_context(system_u:object_r:fsadm_exec_t,s0)
patch from erich Sat, 02 Sep 2006 03:37:44 +0200
2006-09-04 18:22:12 +00:00
dphysswapfile: add interfaces and sysadm access v2: add swapfile file context
2017-09-14 11:46:04 +00:00
/var/swap -- gen_context(system_u:object_r:swapfile_t,s0)
patch from erich Sat, 02 Sep 2006 03:37:44 +0200
2006-09-04 18:22:12 +00:00
/var/log/fsck(/.*)? gen_context(system_u:object_r:fsadm_log_t,s0)
fstools: add in filetrans for /run dir the blkid tool writes to /run/blkid/. This creates the "fstools_run_t" type an allows the transition in /run. type=AVC msg=audit(1428929528.885:149519): avc: denied { write } for pid=5590 comm="mkfs.ext4" name="/" dev="tmpfs" ino=17656 scontext=staff_u:sysadm_r:fsadm_t tcontext=system_u:object_r:var_run_t tclass=dir permissive=0 In permissive: type=AVC msg=audit(1428948565.919:160149): avc: denied { write } for pid=26197 comm="mkfs.ext4" name="/" dev="tmpfs" ino=17656 scontext=staff_u:sysadm_r:fsadm_t tcontext=system_u:object_r:var_run_t tclass=dir permissive=1 type=AVC msg=audit(1428948565.919:160149): avc: denied { add_name } for pid=26197 comm="mkfs.ext4" name="blkid" scontext=staff_u:sysadm_r:fsadm_t tcontext=system_u:object_r:var_run_t tclass=dir permissive=1 type=AVC msg=audit(1428948565.919:160149): avc: denied { create } for pid=26197 comm="mkfs.ext4" name="blkid" scontext=staff_u:sysadm_r:fsadm_t tcontext=staff_u:object_r:var_run_t tclass=dir permissive=1 type=SYSCALL msg=audit(1428948565.919:160149): arch=c000003e syscall=83 success=yes exit=0 a0=2cd79c6d214 a1=1ed a2=ffffffffffffff20 a3=539fe9bc40 items=2 ppid=28115 pid=26197 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts2 ses=2 comm="mkfs.ext4" exe="/sbin/mke2fs" subj=staff_u:sysadm_r:fsadm_t key=(null) type=CWD msg=audit(1428948565.919:160149): cwd="/root/selinux" type=PATH msg=audit(1428948565.919:160149): item=0 name="/run/" inode=17656 dev=00:13 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:var_run_t nametype=PARENT type=PATH msg=audit(1428948565.919:160149): item=1 name="/run/blkid" inode=4062404 dev=00:13 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=staff_u:object_r:var_run_t nametype=CREATE type=UNKNOWN[1327] msg=audit(1428948565.919:160149): proctitle=6D6B66732E65787434002F6465762F7A72616D31 type=AVC msg=audit(1428948565.919:160150): avc: denied { write } for pid=26197 comm="mkfs.ext4" name="blkid" dev="tmpfs" ino=4062404 scontext=staff_u:sysadm_r:fsadm_t tcontext=staff_u:object_r:var_run_t tclass=dir permissive=1 type=AVC msg=audit(1428948565.919:160150): avc: denied { add_name } for pid=26197 comm="mkfs.ext4" name="blkid.tab" scontext=staff_u:sysadm_r:fsadm_t tcontext=staff_u:object_r:var_run_t tclass=dir permissive=1 type=AVC msg=audit(1428948565.919:160150): avc: denied { create } for pid=26197 comm="mkfs.ext4" name="blkid.tab" scontext=staff_u:sysadm_r:fsadm_t tcontext=staff_u:object_r:var_run_t tclass=file permissive=1 type=AVC msg=audit(1428948565.919:160150): avc: denied { write open } for pid=26197 comm="mkfs.ext4" path="/run/blkid/blkid.tab" dev="tmpfs" ino=4062405 scontext=staff_u:sysadm_r:fsadm_t tcontext=staff_u:object_r:var_run_t tclass=file permissive=1 type=AVC msg=audit(1428948565.919:160151): avc: denied { getattr } for pid=26197 comm="mkfs.ext4" path="/run/blkid/blkid.tab" dev="tmpfs" ino=4062405 scontext=staff_u:sysadm_r:fsadm_t tcontext=staff_u:object_r:var_run_t tclass=file permissive=1 Changes from v1: - only transition on dir, not file. - add fcontext for /run/fsck too. - the audit log in the previous version was missing some lines.
2015-04-13 18:13:39 +00:00
transition file contexts to /run Remove file context aliases and update file context paths to use the /run filesystem path. Add backward compatibility file context alias for /var/run using applications like https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=783321 Lock files are still seated at /var/lock
2016-12-16 20:07:56 +00:00
/run/blkid(/.*)? gen_context(system_u:object_r:fsadm_run_t,s0)
/run/fsck(/.*)? gen_context(system_u:object_r:fsadm_run_t,s0)