From c89e121db4de75c4e79bc333b63b556c39aa62ea Mon Sep 17 00:00:00 2001 From: Laurent Bigonville Date: Tue, 8 Oct 2019 16:37:06 +0200 Subject: [PATCH 1/3] Add an interface to allow the specified domain to mmap the general network configuration files Signed-off-by: Laurent Bigonville --- policy/modules/system/sysnetwork.if | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/policy/modules/system/sysnetwork.if b/policy/modules/system/sysnetwork.if index b2314784a..f22afb7a6 100644 --- a/policy/modules/system/sysnetwork.if +++ b/policy/modules/system/sysnetwork.if @@ -364,6 +364,31 @@ interface(`sysnet_read_config',` ') ') +####################################### +## +## Map network config files. +## +## +##

+## Allow the specified domain to mmap the +## general network configuration files. +##

+## +## +## +## Domain allowed access. +## +## +# +interface(`sysnet_mmap_config_files',` + gen_require(` + type net_conf_t; + ') + + files_search_etc($1) + allow $1 net_conf_t:file map; +') + ####################################### ## ## Do not audit attempts to read network config files. From 0136b586eff054c664b9d340f62e6b82f8d4d109 Mon Sep 17 00:00:00 2001 From: Laurent Bigonville Date: Mon, 7 Oct 2019 16:20:22 +0200 Subject: [PATCH 2/3] Add policy for apt-cacher-ng Signed-off-by: Laurent Bigonville --- policy/modules/kernel/corenetwork.te.in | 1 + policy/modules/services/aptcacher.fc | 11 ++++ policy/modules/services/aptcacher.if | 21 +++++++ policy/modules/services/aptcacher.te | 75 +++++++++++++++++++++++++ 4 files changed, 108 insertions(+) create mode 100644 policy/modules/services/aptcacher.fc create mode 100644 policy/modules/services/aptcacher.if create mode 100644 policy/modules/services/aptcacher.te diff --git a/policy/modules/kernel/corenetwork.te.in b/policy/modules/kernel/corenetwork.te.in index 4bfc55b29..065567004 100644 --- a/policy/modules/kernel/corenetwork.te.in +++ b/policy/modules/kernel/corenetwork.te.in @@ -89,6 +89,7 @@ network_port(amqp, udp,5671-5672,s0, tcp,5671-5672,s0) network_port(aol, udp,5190-5193,s0, tcp,5190-5193,s0) network_port(apcupsd, tcp,3551,s0, udp,3551,s0) network_port(apertus_ldp, tcp,539,s0, udp,539,s0) +network_port(aptcacher, tcp,3142,s0) network_port(armtechdaemon, tcp,9292,s0, udp,9292,s0) network_port(asterisk, tcp,1720,s0, udp,2427,s0, udp,2727,s0, udp,4569,s0) network_port(audit, tcp,60,s0) diff --git a/policy/modules/services/aptcacher.fc b/policy/modules/services/aptcacher.fc new file mode 100644 index 000000000..928623131 --- /dev/null +++ b/policy/modules/services/aptcacher.fc @@ -0,0 +1,11 @@ +/etc/apt-cacher-ng(/.*)? gen_context(system_u:object_r:aptcacher_conf_t,s0) + +/usr/sbin/apt-cacher-ng -- gen_context(system_u:object_r:aptcacher_exec_t,s0) + +/run/apt-cacher-ng(/.*)? gen_context(system_u:object_r:aptcacher_runtime_t,s0) + +/var/cache/apt-cacher-ng(/.*)? gen_context(system_u:object_r:aptcacher_cache_t,s0) + +/var/lib/apt-cacher-ng(/.*)? gen_context(system_u:object_r:aptcacher_lib_t,s0) + +/var/log/apt-cacher-ng(/.*)? gen_context(system_u:object_r:aptcacher_log_t,s0) diff --git a/policy/modules/services/aptcacher.if b/policy/modules/services/aptcacher.if new file mode 100644 index 000000000..201514e6a --- /dev/null +++ b/policy/modules/services/aptcacher.if @@ -0,0 +1,21 @@ +## apt-cacher, cache for Debian APT repositories. + +######################################## +## +## Connect to aptcacher using a unix +## stream socket. +## +## +## +## Domain allowed access. +## +## +# +interface(`aptcacher_stream_connect',` + gen_require(` + type aptcacher_t, aptcacher_runtime_t; + ') + + files_search_pids($1) + stream_connect_pattern($1, aptcacher_runtime_t, aptcacher_runtime_t, aptcacher_t) +') diff --git a/policy/modules/services/aptcacher.te b/policy/modules/services/aptcacher.te new file mode 100644 index 000000000..3e4442809 --- /dev/null +++ b/policy/modules/services/aptcacher.te @@ -0,0 +1,75 @@ +policy_module(aptcacher, 1.0.0) + +######################################## +# +# Declarations +# + +type aptcacher_t; +type aptcacher_exec_t; +init_daemon_domain(aptcacher_t, aptcacher_exec_t) + +type aptcacher_conf_t; +files_config_file(aptcacher_conf_t) + +type aptcacher_cache_t; +files_type(aptcacher_cache_t) + +type aptcacher_lib_t; +files_type(aptcacher_lib_t) + +type aptcacher_log_t; +logging_log_file(aptcacher_log_t) + +type aptcacher_runtime_t; +files_pid_file(aptcacher_runtime_t) + +######################################## +# +# Local policy +# + +allow aptcacher_t self:process signal; + +allow aptcacher_t self:fifo_file rw_inherited_fifo_file_perms; +allow aptcacher_t self:tcp_socket create_stream_socket_perms; +allow aptcacher_t self:unix_dgram_socket create_socket_perms; +allow aptcacher_t self:unix_stream_socket create_stream_socket_perms; + +allow aptcacher_t aptcacher_conf_t:dir list_dir_perms; +allow aptcacher_t aptcacher_conf_t:file mmap_read_file_perms; +# /etc/apt-cacher-ng/ contains symlinks that point to /var/lib/apt-cacher-ng/ +allow aptcacher_t aptcacher_conf_t:lnk_file read_lnk_file_perms; + +allow aptcacher_t aptcacher_cache_t:dir manage_dir_perms; +allow aptcacher_t aptcacher_cache_t:file { manage_file_perms map }; +allow aptcacher_t aptcacher_cache_t:lnk_file manage_lnk_file_perms; + +allow aptcacher_t aptcacher_lib_t:file map; +files_search_var_lib(aptcacher_t) +read_files_pattern(aptcacher_t, aptcacher_lib_t, aptcacher_lib_t) + +allow aptcacher_t aptcacher_log_t:file map; +logging_search_logs(aptcacher_t) +manage_files_pattern(aptcacher_t, aptcacher_log_t, aptcacher_log_t) + +manage_sock_files_pattern(aptcacher_t, aptcacher_runtime_t, aptcacher_runtime_t) + +kernel_read_vm_overcommit_sysctl(aptcacher_t) + +corenet_tcp_bind_aptcacher_port(aptcacher_t) +corenet_tcp_bind_generic_node(aptcacher_t) +corenet_tcp_connect_http_port(aptcacher_t) + +auth_use_nsswitch(aptcacher_t) + +# Uses sd_notify() to inform systemd it has properly started +init_dgram_send(aptcacher_t) + +miscfiles_read_generic_certs(aptcacher_t) + +# Reads /usr/share/zoneinfo/ +miscfiles_read_localization(aptcacher_t) + +# For some reasons it's trying to mmap /etc/hosts.deny +sysnet_mmap_config_files(aptcacher_t) From 1911cd11f44b084e2da6791454e996aa0b90cc76 Mon Sep 17 00:00:00 2001 From: Laurent Bigonville Date: Fri, 11 Oct 2019 14:34:27 +0200 Subject: [PATCH 3/3] Add policy for acngtool Signed-off-by: Laurent Bigonville --- policy/modules/roles/sysadm.te | 4 +++ policy/modules/services/aptcacher.fc | 2 ++ policy/modules/services/aptcacher.if | 44 ++++++++++++++++++++++++++++ policy/modules/services/aptcacher.te | 36 +++++++++++++++++++++++ 4 files changed, 86 insertions(+) diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te index 0630db47e..da507b559 100644 --- a/policy/modules/roles/sysadm.te +++ b/policy/modules/roles/sysadm.te @@ -142,6 +142,10 @@ optional_policy(` apt_run(sysadm_t, sysadm_r) ') +optional_policy(` + aptcacher_run_acngtool(sysadm_t, sysadm_r) +') + optional_policy(` arpwatch_admin(sysadm_t, sysadm_r) ') diff --git a/policy/modules/services/aptcacher.fc b/policy/modules/services/aptcacher.fc index 928623131..5f27bb04f 100644 --- a/policy/modules/services/aptcacher.fc +++ b/policy/modules/services/aptcacher.fc @@ -1,5 +1,7 @@ /etc/apt-cacher-ng(/.*)? gen_context(system_u:object_r:aptcacher_conf_t,s0) +/usr/lib/apt-cacher-ng/acngtool -- gen_context(system_u:object_r:acngtool_exec_t,s0) + /usr/sbin/apt-cacher-ng -- gen_context(system_u:object_r:aptcacher_exec_t,s0) /run/apt-cacher-ng(/.*)? gen_context(system_u:object_r:aptcacher_runtime_t,s0) diff --git a/policy/modules/services/aptcacher.if b/policy/modules/services/aptcacher.if index 201514e6a..7460f2e59 100644 --- a/policy/modules/services/aptcacher.if +++ b/policy/modules/services/aptcacher.if @@ -1,5 +1,49 @@ ## apt-cacher, cache for Debian APT repositories. +######################################## +## +## Execute acngtool in the acngtool domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`aptcacher_domtrans_acngtool',` + gen_require(` + type acngtool_t, acngtool_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, acngtool_exec_t, acngtool_t) +') + +######################################## +## +## Execute acngtool in the acngtool domain, and +## allow the specified role the acngtool domain. +## +## +## +## Domain allowed to transition. +## +## +## +## +## Role allowed access. +## +## +# +interface(`aptcacher_run_acngtool',` + gen_require(` + attribute_role acngtool_roles; + ') + + aptcacher_domtrans_acngtool($1) + roleattribute $2 acngtool_roles; +') + ######################################## ## ## Connect to aptcacher using a unix diff --git a/policy/modules/services/aptcacher.te b/policy/modules/services/aptcacher.te index 3e4442809..055c23ff5 100644 --- a/policy/modules/services/aptcacher.te +++ b/policy/modules/services/aptcacher.te @@ -5,6 +5,13 @@ policy_module(aptcacher, 1.0.0) # Declarations # +attribute_role acngtool_roles; + +type acngtool_t; +type acngtool_exec_t; +application_domain(acngtool_t, acngtool_exec_t) +role acngtool_roles types acngtool_t; + type aptcacher_t; type aptcacher_exec_t; init_daemon_domain(aptcacher_t, aptcacher_exec_t) @@ -36,6 +43,8 @@ allow aptcacher_t self:tcp_socket create_stream_socket_perms; allow aptcacher_t self:unix_dgram_socket create_socket_perms; allow aptcacher_t self:unix_stream_socket create_stream_socket_perms; +can_exec(aptcacher_t, acngtool_exec_t) + allow aptcacher_t aptcacher_conf_t:dir list_dir_perms; allow aptcacher_t aptcacher_conf_t:file mmap_read_file_perms; # /etc/apt-cacher-ng/ contains symlinks that point to /var/lib/apt-cacher-ng/ @@ -57,6 +66,9 @@ manage_sock_files_pattern(aptcacher_t, aptcacher_runtime_t, aptcacher_runtime_t) kernel_read_vm_overcommit_sysctl(aptcacher_t) +# Calls system() +corecmd_exec_shell(aptcacher_t) + corenet_tcp_bind_aptcacher_port(aptcacher_t) corenet_tcp_bind_generic_node(aptcacher_t) corenet_tcp_connect_http_port(aptcacher_t) @@ -73,3 +85,27 @@ miscfiles_read_localization(aptcacher_t) # For some reasons it's trying to mmap /etc/hosts.deny sysnet_mmap_config_files(aptcacher_t) + +####################################### +# +# acngtool local policy +# + +allow acngtool_t self:tcp_socket create_stream_socket_perms; +allow acngtool_t self:unix_stream_socket create_socket_perms; + +allow acngtool_t aptcacher_conf_t:dir list_dir_perms; +allow acngtool_t aptcacher_conf_t:file mmap_read_file_perms; + +aptcacher_stream_connect(acngtool_t) + +corenet_tcp_connect_aptcacher_port(acngtool_t) + +auth_use_nsswitch(acngtool_t) + +# For some reasons it's trying to mmap /etc/hosts.deny +sysnet_mmap_config_files(acngtool_t) + +optional_policy(` + cron_system_entry(acngtool_t, acngtool_exec_t) +')