RepoMirrors/selinux-refpolicy
1
0
Fork 0
mirror of https://github.com/SELinuxProject/refpolicy synced 2025-03-19 17:54:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

Enable factory directory support in systemd-tmpfilesd

Browse Source 
/usr/share/factory serves as a template directory for
systemd-tmpfilesd. The copy (C) and link (L) commands can utilize this
directory as a default source for files, which should be placed in the
filesystem.

This behaiour is controlled via a tunable as it gives
systemd-tmpfilesd manage permissions over etc, which could be
considered as a security risk.

Relevant denials are silenced in case the policy is disabled.

Signed-off-by: Krzysztof Nowicki <krissn@op.pl>
This commit is contained in:
Krzysztof Nowicki 2021-02-03 10:00:35 +01:00
parent b30437e487
commit 68e5f4d3f3
3 changed files with 46 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
policy/modules/kernel/files.if
View File

@ -3117,6 +3117,26 @@ interface(`files_manage_etc_files',`
read_lnk_files_pattern($1, etc_t, etc_t)
')
########################################
## <summary>
## Do not audit attempts to create, read, write,
## and delete generic files in /etc.
## </summary>
## <param name="domain">
## <summary>
## Domain to not audit.
## </summary>
## </param>
## <rolecap/>
#
interface(`files_dontaudit_manage_etc_files',`
gen_require(`
type etc_t;
')
dontaudit $1 etc_t:file manage_file_perms;
')
########################################
## <summary>
## Delete system configuration files in /etc.

2
policy/modules/system/systemd.fc
View File

@ -57,6 +57,8 @@
/usr/lib/systemd/system/systemd-rfkill.* -- gen_context(system_u:object_r:systemd_rfkill_unit_t,s0)
/usr/lib/systemd/system/systemd-socket-proxyd\.service -- gen_context(system_u:object_r:systemd_socket_proxyd_unit_file_t,s0)
/usr/share/factory(/.*)? gen_context(system_u:object_r:systemd_factory_conf_t,s0)
/var/\.updated -- gen_context(system_u:object_r:systemd_update_run_t,s0)
/var/lib/systemd/backlight(/.*)? gen_context(system_u:object_r:systemd_backlight_var_lib_t,s0)

24
policy/modules/system/systemd.te
View File

@ -45,6 +45,14 @@ gen_tunable(systemd_socket_proxyd_bind_any, false)
## </desc>
gen_tunable(systemd_socket_proxyd_connect_any, false)
## <desc>
## <p>
## Allow systemd-tmpfilesd to populate missing configuration files from factory
## template directory.
## </p>
## </desc>
gen_tunable(systemd_tmpfilesd_factory, false)
attribute systemd_log_parse_env_type;
attribute systemd_tmpfiles_conf_type;
attribute systemd_user_session_type;
@ -104,6 +112,9 @@ type systemd_detect_virt_t;
type systemd_detect_virt_exec_t;
init_daemon_domain(systemd_detect_virt_t, systemd_detect_virt_exec_t)
type systemd_factory_conf_t;
systemd_tmpfiles_conf_file(systemd_factory_conf_t)
type systemd_generator_t;
type systemd_generator_exec_t;
typealias systemd_generator_t alias { systemd_fstab_generator_t systemd_gpt_generator_t };
@ -1283,6 +1294,7 @@ allow systemd_tmpfiles_t systemd_journal_t:dir relabel_dir_perms;
allow systemd_tmpfiles_t systemd_journal_t:file relabel_file_perms;
allow systemd_tmpfiles_t systemd_tmpfiles_conf_t:dir list_dir_perms;
allow systemd_tmpfiles_t systemd_tmpfiles_conf_type:dir search_dir_perms;
allow systemd_tmpfiles_t systemd_tmpfiles_conf_type:file read_file_perms;
kernel_getattr_proc(systemd_tmpfiles_t)
@ -1377,6 +1389,18 @@ tunable_policy(`systemd_tmpfiles_manage_all',`
files_relabel_non_security_files(systemd_tmpfiles_t)
')
tunable_policy(`systemd_tmpfilesd_factory', `
allow systemd_tmpfiles_t systemd_factory_conf_t:dir list_dir_perms;
allow systemd_tmpfiles_t systemd_factory_conf_t:file read_file_perms;
files_manage_etc_files(systemd_tmpfiles_t)
',`
dontaudit systemd_tmpfiles_t systemd_factory_conf_t:dir list_dir_perms;
dontaudit systemd_tmpfiles_t systemd_factory_conf_t:file read_file_perms;
files_dontaudit_manage_etc_files(systemd_tmpfiles_t)
')
optional_policy(`
dbus_read_lib_files(systemd_tmpfiles_t)
dbus_relabel_lib_dirs(systemd_tmpfiles_t)