From 77c71b54e501adc2c20c4eb1822ddea0467d155a Mon Sep 17 00:00:00 2001 From: Chris PeBenito Date: Wed, 25 Nov 2009 10:27:31 -0500 Subject: [PATCH] Fstools and Xen patches from Dan Walsh. --- policy/modules/system/fstools.fc | 1 + policy/modules/system/fstools.te | 4 +- policy/modules/system/xen.fc | 6 ++ policy/modules/system/xen.if | 30 ++++++- policy/modules/system/xen.te | 142 ++++++++++++++++++++++++++----- 5 files changed, 161 insertions(+), 22 deletions(-) diff --git a/policy/modules/system/fstools.fc b/policy/modules/system/fstools.fc index 7432278c8..cf61a559e 100644 --- a/policy/modules/system/fstools.fc +++ b/policy/modules/system/fstools.fc @@ -6,6 +6,7 @@ /sbin/dump -- gen_context(system_u:object_r:fsadm_exec_t,s0) /sbin/dumpe2fs -- gen_context(system_u:object_r:fsadm_exec_t,s0) /sbin/e2fsck -- gen_context(system_u:object_r:fsadm_exec_t,s0) +/sbin/e4fsck -- gen_context(system_u:object_r:fsadm_exec_t,s0) /sbin/e2label -- gen_context(system_u:object_r:fsadm_exec_t,s0) /sbin/fdisk -- gen_context(system_u:object_r:fsadm_exec_t,s0) /sbin/findfs -- gen_context(system_u:object_r:fsadm_exec_t,s0) diff --git a/policy/modules/system/fstools.te b/policy/modules/system/fstools.te index d1ce63c9c..1bab1913c 100644 --- a/policy/modules/system/fstools.te +++ b/policy/modules/system/fstools.te @@ -1,5 +1,5 @@ -policy_module(fstools, 1.13.0) +policy_module(fstools, 1.13.1) ######################################## # @@ -144,6 +144,7 @@ logging_send_syslog_msg(fsadm_t) miscfiles_read_localization(fsadm_t) modutils_read_module_config(fsadm_t) +modutils_read_module_deps(fsadm_t) seutil_read_config(fsadm_t) @@ -177,4 +178,5 @@ optional_policy(` optional_policy(` xen_append_log(fsadm_t) + xen_rw_image_files(fsadm_t) ') diff --git a/policy/modules/system/xen.fc b/policy/modules/system/xen.fc index 0d60e80ef..8c827f8fa 100644 --- a/policy/modules/system/xen.fc +++ b/policy/modules/system/xen.fc @@ -2,6 +2,8 @@ /usr/bin/virsh -- gen_context(system_u:object_r:xm_exec_t,s0) +/usr/sbin/evtchnd -- gen_context(system_u:object_r:evtchnd_exec_t,s0) + ifdef(`distro_debian',` /usr/lib/xen-[^/]*/bin/xenconsoled -- gen_context(system_u:object_r:xenconsoled_exec_t,s0) /usr/lib/xen-[^/]*/bin/xend -- gen_context(system_u:object_r:xend_exec_t,s0) @@ -19,14 +21,18 @@ ifdef(`distro_debian',` /var/lib/xend(/.*)? gen_context(system_u:object_r:xend_var_lib_t,s0) /var/lib/xenstored(/.*)? gen_context(system_u:object_r:xenstored_var_lib_t,s0) +/var/log/evtchnd\.log -- gen_context(system_u:object_r:evtchnd_var_log_t,s0) /var/log/xen(/.*)? gen_context(system_u:object_r:xend_var_log_t,s0) /var/log/xen-hotplug\.log -- gen_context(system_u:object_r:xend_var_log_t,s0) /var/log/xend\.log -- gen_context(system_u:object_r:xend_var_log_t,s0) /var/log/xend-debug\.log -- gen_context(system_u:object_r:xend_var_log_t,s0) +/var/run/evtchnd -s gen_context(system_u:object_r:evtchnd_var_run_t,s0) +/var/run/evtchnd\.pid -- gen_context(system_u:object_r:evtchnd_var_run_t,s0) /var/run/xenconsoled\.pid -- gen_context(system_u:object_r:xenconsoled_var_run_t,s0) /var/run/xend(/.*)? gen_context(system_u:object_r:xend_var_run_t,s0) /var/run/xend\.pid -- gen_context(system_u:object_r:xend_var_run_t,s0) +/var/run/xenner(/.*)? gen_context(system_u:object_r:xend_var_run_t,s0) /var/run/xenstore\.pid -- gen_context(system_u:object_r:xenstored_var_run_t,s0) /var/run/xenstored(/.*)? gen_context(system_u:object_r:xenstored_var_run_t,s0) diff --git a/policy/modules/system/xen.if b/policy/modules/system/xen.if index 0b1878c37..76010795c 100644 --- a/policy/modules/system/xen.if +++ b/policy/modules/system/xen.if @@ -71,7 +71,30 @@ interface(`xen_read_image_files',` ') files_list_var_lib($1) - read_files_pattern($1,{ xend_var_lib_t xen_image_t },xen_image_t) + + list_dirs_pattern($1, xend_var_lib_t, xend_var_lib_t) + read_files_pattern($1, { xend_var_lib_t xen_image_t }, xen_image_t) +') + +######################################## +## +## Allow the specified domain to read/write +## xend image files. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`xen_rw_image_files',` + gen_require(` + type xen_image_t, xend_var_lib_t; + ') + + files_list_var_lib($1) + allow $1 xend_var_lib_t:dir search_dir_perms; + rw_files_pattern($1, xen_image_t, xen_image_t) ') ######################################## @@ -167,11 +190,14 @@ interface(`xen_stream_connect_xenstore',` # interface(`xen_stream_connect',` gen_require(` - type xend_t, xend_var_run_t; + type xend_t, xend_var_run_t, xend_var_lib_t; ') files_search_pids($1) stream_connect_pattern($1, xend_var_run_t, xend_var_run_t, xend_t) + + files_search_var_lib($1) + stream_connect_pattern($1, xend_var_lib_t, xend_var_lib_t, xend_t) ') ######################################## diff --git a/policy/modules/system/xen.te b/policy/modules/system/xen.te index 40410a73a..5dc22924f 100644 --- a/policy/modules/system/xen.te +++ b/policy/modules/system/xen.te @@ -1,11 +1,30 @@ -policy_module(xen, 1.9.0) +policy_module(xen, 1.9.1) ######################################## # # Declarations # +## +##

+## Allow xen to manage nfs files +##

+## +gen_tunable(xen_use_nfs, false) + +type evtchnd_t; +type evtchnd_exec_t; +init_daemon_domain(evtchnd_t, evtchnd_exec_t) + +# log files +type evtchnd_var_log_t; +logging_log_file(evtchnd_var_log_t) + +# pid files +type evtchnd_var_run_t; +files_pid_file(evtchnd_var_run_t) + # console ptys type xen_devpts_t; term_pty(xen_devpts_t) @@ -42,26 +61,30 @@ logging_log_file(xend_var_log_t) # pid files type xend_var_run_t; files_pid_file(xend_var_run_t) +files_mountpoint(xend_var_run_t) type xenstored_t; type xenstored_exec_t; -domain_type(xenstored_t) -domain_entry_file(xenstored_t, xenstored_exec_t) -role system_r types xenstored_t; +init_daemon_domain(xenstored_t, xenstored_exec_t) + +type xenstored_tmp_t; +files_tmp_file(xenstored_tmp_t) # var/lib files type xenstored_var_lib_t; files_type(xenstored_var_lib_t) +# log files +type xenstored_var_log_t; +logging_log_file(xenstored_var_log_t) + # pid files type xenstored_var_run_t; files_pid_file(xenstored_var_run_t) type xenconsoled_t; type xenconsoled_exec_t; -domain_type(xenconsoled_t) -domain_entry_file(xenconsoled_t, xenconsoled_exec_t) -role system_r types xenconsoled_t; +init_daemon_domain(xenconsoled_t, xenconsoled_exec_t) # pid files type xenconsoled_var_run_t; @@ -72,6 +95,20 @@ type xm_exec_t; domain_type(xm_t) init_system_domain(xm_t, xm_exec_t) +####################################### +# +# evtchnd local policy +# + +manage_dirs_pattern(evtchnd_t, evtchnd_var_log_t, evtchnd_var_log_t) +manage_files_pattern(evtchnd_t, evtchnd_var_log_t, evtchnd_var_log_t) +logging_log_filetrans(evtchnd_t, evtchnd_var_log_t, { file dir }) + +manage_dirs_pattern(evtchnd_t, evtchnd_var_run_t, evtchnd_var_run_t) +manage_files_pattern(evtchnd_t, evtchnd_var_run_t, evtchnd_var_run_t) +manage_sock_files_pattern(evtchnd_t, evtchnd_var_run_t, evtchnd_var_run_t) +files_pid_filetrans(evtchnd_t, evtchnd_var_run_t, { file sock_file dir }) + ######################################## # # xend local policy @@ -95,7 +132,7 @@ manage_files_pattern(xend_t, xen_image_t, xen_image_t) read_lnk_files_pattern(xend_t, xen_image_t, xen_image_t) rw_blk_files_pattern(xend_t, xen_image_t, xen_image_t) -allow xend_t xenctl_t:fifo_file manage_file_perms; +allow xend_t xenctl_t:fifo_file manage_fifo_file_perms; dev_filetrans(xend_t, xenctl_t, fifo_file) manage_files_pattern(xend_t, xend_tmp_t, xend_tmp_t) @@ -103,31 +140,30 @@ manage_dirs_pattern(xend_t, xend_tmp_t, xend_tmp_t) files_tmp_filetrans(xend_t, xend_tmp_t, { file dir }) # pid file -allow xend_t xend_var_run_t:dir setattr; +manage_dirs_pattern(xend_t, xend_var_run_t, xend_var_run_t) manage_files_pattern(xend_t, xend_var_run_t, xend_var_run_t) manage_sock_files_pattern(xend_t, xend_var_run_t, xend_var_run_t) manage_fifo_files_pattern(xend_t, xend_var_run_t, xend_var_run_t) -files_pid_filetrans(xend_t, xend_var_run_t, { file sock_file fifo_file }) +files_pid_filetrans(xend_t, xend_var_run_t, { file sock_file fifo_file dir }) # log files -allow xend_t xend_var_log_t:dir setattr; +manage_dirs_pattern(xend_t, xend_var_log_t, xend_var_log_t) manage_files_pattern(xend_t, xend_var_log_t, xend_var_log_t) manage_sock_files_pattern(xend_t, xend_var_log_t, xend_var_log_t) -logging_log_filetrans(xend_t, xend_var_log_t,{ sock_file file dir }) +logging_log_filetrans(xend_t, xend_var_log_t, { sock_file file dir }) # var/lib files for xend manage_dirs_pattern(xend_t, xend_var_lib_t, xend_var_lib_t) manage_files_pattern(xend_t, xend_var_lib_t, xend_var_lib_t) manage_sock_files_pattern(xend_t, xend_var_lib_t, xend_var_lib_t) manage_fifo_files_pattern(xend_t, xend_var_lib_t, xend_var_lib_t) -files_var_lib_filetrans(xend_t, xend_var_lib_t,{ file dir }) +files_var_lib_filetrans(xend_t, xend_var_lib_t, { file dir }) # transition to store domtrans_pattern(xend_t, xenstored_exec_t, xenstored_t) # transition to console -domain_auto_trans(xend_t, xenconsoled_exec_t, xenconsoled_t) -allow xenconsoled_t xend_t:fd use; +domtrans_pattern(xend_t, xenconsoled_exec_t, xenconsoled_t) kernel_read_kernel_sysctls(xend_t) kernel_read_system_state(xend_t) @@ -183,6 +219,8 @@ term_use_generic_ptys(xend_t) term_use_ptmx(xend_t) term_getattr_pty_fs(xend_t) +init_stream_connect_script(xend_t) + locallogin_dontaudit_use_fds(xend_t) logging_send_syslog_msg(xend_t) @@ -207,6 +245,10 @@ xen_stream_connect_xenstore(xend_t) netutils_domtrans(xend_t) +optional_policy(` + brctl_domtrans(xend_t) +') + optional_policy(` consoletype_exec(xend_t) ') @@ -239,6 +281,10 @@ domain_dontaudit_ptrace_all_domains(xenconsoled_t) files_read_usr_files(xenconsoled_t) +fs_list_tmpfs(xenconsoled_t) +fs_manage_xenfs_dirs(xenconsoled_t) +fs_manage_xenfs_files(xenconsoled_t) + term_create_pty(xenconsoled_t, xen_devpts_t) term_use_generic_ptys(xenconsoled_t) term_use_console(xenconsoled_t) @@ -248,7 +294,7 @@ init_use_script_ptys(xenconsoled_t) miscfiles_read_localization(xenconsoled_t) -xen_append_log(xenconsoled_t) +xen_manage_log(xenconsoled_t) xen_stream_connect_xenstore(xenconsoled_t) ######################################## @@ -256,20 +302,32 @@ xen_stream_connect_xenstore(xenconsoled_t) # Xen store local policy # -allow xenstored_t self:capability { dac_override mknod ipc_lock }; +allow xenstored_t self:capability { dac_override mknod ipc_lock sys_resource }; allow xenstored_t self:unix_stream_socket create_stream_socket_perms; allow xenstored_t self:unix_dgram_socket create_socket_perms; +manage_files_pattern(xenstored_t, xenstored_tmp_t, xenstored_tmp_t) +manage_dirs_pattern(xenstored_t, xenstored_tmp_t, xenstored_tmp_t) +files_tmp_filetrans(xenstored_t, xenstored_tmp_t, { file dir }) + # pid file manage_files_pattern(xenstored_t, xenstored_var_run_t, xenstored_var_run_t) manage_sock_files_pattern(xenstored_t, xenstored_var_run_t, xenstored_var_run_t) files_pid_filetrans(xenstored_t, xenstored_var_run_t, { file sock_file }) +# log files +manage_dirs_pattern(xenstored_t, xenstored_var_log_t, xenstored_var_log_t) +manage_files_pattern(xenstored_t, xenstored_var_log_t, xenstored_var_log_t) +manage_sock_files_pattern(xenstored_t, xenstored_var_log_t, xenstored_var_log_t) +logging_log_filetrans(xenstored_t, xenstored_var_log_t, { sock_file file dir }) + # var/lib files for xenstored manage_dirs_pattern(xenstored_t, xenstored_var_lib_t, xenstored_var_lib_t) manage_files_pattern(xenstored_t, xenstored_var_lib_t, xenstored_var_lib_t) manage_sock_files_pattern(xenstored_t, xenstored_var_lib_t, xenstored_var_lib_t) -files_var_lib_filetrans(xenstored_t, xenstored_var_lib_t,{ file dir sock_file }) +files_var_lib_filetrans(xenstored_t, xenstored_var_lib_t, { file dir sock_file }) + +stream_connect_pattern(xenstored_t, evtchnd_var_run_t, evtchnd_var_run_t, evtchnd_t) kernel_write_xen_state(xenstored_t) kernel_read_xen_state(xenstored_t) @@ -304,6 +362,7 @@ xen_append_log(xenstored_t) # allow xm_t self:capability { dac_override ipc_lock sys_tty_config }; +allow xm_t self:process { getsched signal }; # internal communication is often done using fifo and unix sockets. allow xm_t self:fifo_file rw_fifo_file_perms; @@ -312,6 +371,7 @@ allow xm_t self:tcp_socket create_stream_socket_perms; manage_files_pattern(xm_t, xend_var_lib_t, xend_var_lib_t) manage_fifo_files_pattern(xm_t, xend_var_lib_t, xend_var_lib_t) +manage_sock_files_pattern(xm_t, xend_var_lib_t, xend_var_lib_t) files_search_var_lib(xm_t) allow xm_t xen_image_t:dir rw_dir_perms; @@ -320,16 +380,19 @@ allow xm_t xen_image_t:blk_file read_blk_file_perms; kernel_read_system_state(xm_t) kernel_read_kernel_sysctls(xm_t) +kernel_read_sysctl(xm_t) kernel_read_xen_state(xm_t) kernel_write_xen_state(xm_t) corecmd_exec_bin(xm_t) +corecmd_exec_shell(xm_t) corenet_tcp_sendrecv_generic_if(xm_t) corenet_tcp_sendrecv_generic_node(xm_t) corenet_tcp_connect_soundd_port(xm_t) dev_read_urand(xm_t) +dev_read_sysfs(xm_t) files_read_etc_runtime_files(xm_t) files_read_usr_files(xm_t) @@ -337,17 +400,58 @@ files_list_mnt(xm_t) # Some common macros (you might be able to remove some) files_read_etc_files(xm_t) +fs_getattr_all_fs(xm_t) +fs_manage_xenfs_dirs(xm_t) +fs_manage_xenfs_files(xm_t) + storage_raw_read_fixed_disk(xm_t) term_use_all_terms(xm_t) +init_stream_connect_script(xm_t) init_rw_script_stream_sockets(xm_t) init_use_fds(xm_t) miscfiles_read_localization(xm_t) -sysnet_read_config(xm_t) +sysnet_dns_name_resolve(xm_t) xen_append_log(xm_t) xen_stream_connect(xm_t) xen_stream_connect_xenstore(xm_t) + +optional_policy(` + virt_manage_images(xm_t) + virt_stream_connect(xm_t) +') + +######################################## +# +# SSH component local policy +# +optional_policy(` + ssh_basic_client_template(xm, xm_t, system_r) + + kernel_read_xen_state(xm_ssh_t) + kernel_write_xen_state(xm_ssh_t) + + fs_manage_xenfs_dirs(xm_ssh_t) + fs_manage_xenfs_files(xm_ssh_t) + + #Should have a boolean wrapping these + fs_list_auto_mountpoints(xend_t) + files_search_mnt(xend_t) + fs_getattr_all_fs(xend_t) + fs_read_dos_files(xend_t) + fs_manage_xenfs_dirs(xend_t) + fs_manage_xenfs_files(xend_t) + + tunable_policy(`xen_use_nfs',` + fs_manage_nfs_files(xend_t) + fs_read_nfs_symlinks(xend_t) + ') + + optional_policy(` + unconfined_domain(xend_t) + ') +')