30a46e5676
various: Module version bump.
2019-01-23 19:02:01 -05:00
fa23645ca1
userdomain: introduce userdom_user_home_dir_filetrans_user_cert
...
Signed-off-by: Jason Zaman <jason@perfinion.com>
2019-01-23 18:40:57 -05:00
7a1e0d0ca9
init: Drop unnecessary userspace class dependence in init_read_generic_units_symlinks().
2019-01-23 18:35:00 -05:00
09a81f7220
init: Rename init_read_generic_units_links() to init_read_generic_units_symlinks().
2019-01-23 18:34:10 -05:00
eba35802cc
yet more tiny stuff
...
I think this should be self-explanatory. I've added an audit trace for the
sys_ptrace access that was previously rejected.
Here is the audit log for sys_ptrace:
type=PROCTITLE msg=audit(22/01/19 00:00:18.998:61459) : proctitle=systemctl restart cups.service
type=PATH msg=audit(22/01/19 00:00:18.998:61459) : item=0 name=/proc/1/root nametype=UNKNOWN cap_fp=none cap_fi=none cap_fe=0 cap_fver=0
type=CWD msg=audit(22/01/19 00:00:18.998:61459) : cwd=/
type=SYSCALL msg=audit(22/01/19 00:00:18.998:61459) : arch=x86_64 syscall=newfstatat success=no exit=EACCES(Permission denied) a0=0xffffff9c a1=0x55dd7ea7a23d a2=0x7ffee0a8a1b0 a3=0x0 items=1 ppid=12745 pid=12750 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=systemctl exe=/bin/systemctl subj=system_u:system_r:logrotate_t:s0 key=(null)
type=AVC msg=audit(22/01/19 00:00:18.998:61459) : avc: denied { sys_ptrace } for pid=12750 comm=systemctl capability=sys_ptrace scontext=system_u:system_r:logrotate_t:s0 tcontext=system_u:system_r:logrotate_t:s0 tclass=capability permissive=0
2019-01-23 18:32:41 -05:00
ed79766651
dpkg: Rename dpkg_nnp_transition() to dpkg_nnp_domtrans().
2019-01-23 18:28:51 -05:00
05cd55fb51
tiny stuff for today
...
Allow transition to dpkg_t with nnp, Dominick seems to imply this shouldn't
be necessary.
Lots of little stuff for system_cronjob_t.
Other minor trivial changes that should be obvious.
2019-01-23 18:26:45 -05:00
a7f2394902
various: Module version bump.
2019-01-20 16:45:55 -05:00
ecb4968238
systemd: Move interface implementation.
2019-01-20 16:36:36 -05:00
6e86de0736
Add interface to read journal files
...
When using 'systemctl status <service>' it will show recent
log entries for the selected service. These recent log
entries are coming from the journal. These rules allow the
reading of the journal files.
type=AVC msg=audit(1547760159.435:864): avc: denied { read } for pid=8823 comm="systemctl" name="journal" dev="dm-14" ino=112 scontext=staff_u:staff_r:monitor_t:s0-s0:c0.c1023 tcontext=system_u:object_r:systemd_journal_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1547760159.435:864): avc: denied { open } for pid=8823 comm="systemctl" path="/var/log/journal" dev="dm-14" ino=112 scontext=staff_u:staff_r:monitor_t:s0-s0:c0.c1023 tcontext=system_u:object_r:systemd_journal_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1547760159.435:865): avc: denied { getattr } for pid=8823 comm="systemctl" path="/var/log/journal/21cf24d493e746a9847730f8476e1dba/system.journal" dev="dm-14" ino=8388707 scontext=staff_u:staff_r:monitor_t:s0-s0:c0.c1023 tcontext=system_u:object_r:systemd_journal_t:s0 tclass=file permissive=1
type=AVC msg=audit(1547760159.435:866): avc: denied { read } for pid=8823 comm="systemctl" name="system.journal" dev="dm-14" ino=8388707 scontext=staff_u:staff_r:monitor_t:s0-s0:c0.c1023 tcontext=system_u:object_r:systemd_journal_t:s0 tclass=file permissive=1
type=AVC msg=audit(1547760159.435:866): avc: denied { open } for pid=8823 comm="systemctl" path="/var/log/journal/21cf24d493e746a9847730f8476e1dba/system.journal" dev="dm-14" ino=8388707 scontext=staff_u:staff_r:monitor_t:s0-s0:c0.c1023 tcontext=system_u:object_r:systemd_journal_t:s0 tclass=file permissive=1
type=AVC msg=audit(1547760159.436:867): avc: denied { map } for pid=8823 comm="systemctl" path="/var/log/journal/21cf24d493e746a9847730f8476e1dba/system.journal" dev="dm-14" ino=8388707 scontext=staff_u:staff_r:monitor_t:s0-s0:c0.c1023 tcontext=system_u:object_r:systemd_journal_t:s0 tclass=file permissive=1
Signed-off-by: Dave Sugar <dsugar@tresys.com>
2019-01-20 16:34:14 -05:00
54136fa311
more tiny stuff
...
I think the old timesync labelling wasn't working anyway due to -- for a
directory name.
A couple of patches for devicekit calling dmidecode (this is part of replacing
some kmem access that was discussed on this list and rejected as a misfeature
in Debian DMI related code ages ago).
The rest should be obvious.
2019-01-20 16:20:33 -05:00
b5cda0e2c5
selinuxutil: Module version bump.
2019-01-16 18:20:51 -05:00
038a5af1ed
Merge branch 'restorecond-dontaudit-symlinks' of git://github.com/fishilico/selinux-refpolicy
2019-01-16 18:20:05 -05:00
238bd4f91f
logging, sysnetwork, systemd: Module version bump.
2019-01-16 18:19:22 -05:00
69961e18a8
Modify type for /etc/hostname
...
hostnamectl updates /etc/hostname
This change is setting the type for the file /etc/hostname to
net_conf_t and granting hostnamectl permission to edit this file.
Note that hostnamectl is initially creating a new file .#hostname*
which is why the create permissions are requied.
type=AVC msg=audit(1547039052.041:563): avc: denied { write } for pid=7564 comm="systemd-hostnam" name="etc" dev="dm-1" ino=101 scontext=system_u:system_r:systemd_hostnamed_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1547039052.041:563): avc: denied { add_name } for pid=7564 comm="systemd-hostnam" name=".#hostnamezyqZ9t" scontext=system_u:system_r:systemd_hostnamed_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1547039052.041:563): avc: denied { create } for pid=7564 comm="systemd-hostnam" name=".#hostnamezyqZ9t" scontext=system_u:system_r:systemd_hostnamed_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file permissive=1
type=AVC msg=audit(1547039052.041:563): avc: denied { write } for pid=7564 comm="systemd-hostnam" path="/etc/.#hostnamezyqZ9t" dev="dm-1" ino=1094726 scontext=system_u:system_r:systemd_hostnamed_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file permissive=1
type=SYSCALL msg=audit(1547039052.041:563): arch=c000003e syscall=2 success=yes exit=8 a0=560d0bba34b0 a1=800c2 a2=180 a3=5c35f14c items=2 ppid=1 pid=7564 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-hostnam" exe="/usr/lib/systemd/systemd-hostnamed" subj=system_u:system_r:systemd_hostnamed_t:s0 key=(null)
type=AVC msg=audit(1547039052.041:564): avc: denied { setattr } for pid=7564 comm="systemd-hostnam" name=".#hostnamezyqZ9t" dev="dm-1" ino=1094726 scontext=system_u:system_r:systemd_hostnamed_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file permissive=1
type=SYSCALL msg=audit(1547039052.041:564): arch=c000003e syscall=91 success=yes exit=0 a0=8 a1=1a4 a2=fbad2484 a3=24 items=1 ppid=1 pid=7564 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-hostnam" exe="/usr/lib/systemd/systemd-hostnamed" subj=system_u:system_r:systemd_hostnamed_t:s0 key=(null)
type=AVC msg=audit(1547039052.041:565): avc: denied { remove_name } for pid=7564 comm="systemd-hostnam" name=".#hostnamezyqZ9t" dev="dm-1" ino=1094726 scontext=system_u:system_r:systemd_hostnamed_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1547039052.041:565): avc: denied { rename } for pid=7564 comm="systemd-hostnam" name=".#hostnamezyqZ9t" dev="dm-1" ino=1094726 scontext=system_u:system_r:systemd_hostnamed_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file permissive=1
type=AVC msg=audit(1547039052.041:565): avc: denied { unlink } for pid=7564 comm="systemd-hostnam" name="hostname" dev="dm-1" ino=1094712 scontext=system_u:system_r:systemd_hostnamed_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file permissive=1
Signed-off-by: Dave Sugar <dsugar@tresys.com>
2019-01-16 18:13:41 -05:00
34e3505004
Interface with systemd_hostnamed over dbus to set hostname
...
type=USER_AVC msg=audit(1547039052.040:558): pid=7159 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_call interface=org.freedesktop.hostname1 member=SetPrettyHostname dest=org.freedesktop.hostname1 spid=7563 tpid=7564 scontext=sysadm_u:sysadm_r:applyconfig_t:s0-s0:c0.c1023 tcontext=system_u:system_r:systemd_hostnamed_t:s0 tclass=dbus exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
type=USER_AVC msg=audit(1547039052.040:560): pid=7159 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_return dest=:1.29 spid=7564 tpid=7563 scontext=system_u:system_r:systemd_hostnamed_t:s0 tcontext=sysadm_u:sysadm_r:applyconfig_t:s0-s0:c0.c1023 tclass=dbus exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
Signed-off-by: Dave Sugar <dsugar@tresys.com>
2019-01-16 18:12:50 -05:00
9255dfbf4e
label journald configuraiton files syslog_conf_t
...
journald already runs as syslogd_t label the config files similarly to
allow editing by domains that can edit syslog configuration files.
Also added some missing '\' before dot in filenames.
Signed-off-by: Dave Sugar <dsugar@tresys.com>
2019-01-16 18:11:43 -05:00
6e2896098c
selinuxutil: restorecond is buggy when it dereferencies symlinks
...
restorecond uses libselinux's selinux_restorecon() to relabel files,
which dereferences symlinks in a useless call to statfs(). This produces
AVC denials which are noisy.
Fixes: https://github.com/SELinuxProject/refpolicy/pull/22
2019-01-16 22:10:38 +01:00
4a90eae668
usermanage, cron, selinuxutil: Module version bump.
2019-01-14 17:45:24 -05:00
2c96e2fb56
Merge branch 'add_comment' of git://github.com/DefenSec/refpolicy
2019-01-14 17:41:28 -05:00
a4a219a733
unconfined: add a note about DBUS
...
Addresses https://github.com/SELinuxProject/refpolicy/issues/18
2019-01-14 17:02:56 +01:00
ae35b48f8e
selinuxutil: allow restorecond to read symlinks
...
As restorecond dereferences symlinks when it encounters them in user
home directories, allow this access.
2019-01-13 22:47:11 +01:00
353d92a77a
systemd: Module version bump.
2019-01-13 14:59:27 -05:00
966f981fd8
systemd: Whitespace change
2019-01-13 14:47:34 -05:00
c53019f2c3
systemd: add policy for systemd-rfkill
2019-01-12 23:00:29 +01:00
e6a67f295c
various: Module name bump.
2019-01-12 15:03:59 -05:00
e8b70915b1
Merge branch 'init_rename_pid_interfaces' of git://github.com/fishilico/selinux-refpolicy
2019-01-12 14:55:36 -05:00
f0860ff0bb
Add interface to start/stop iptables service
...
Signed-off-by: Dave Sugar <dsugar@tresys.com>
2019-01-12 14:32:00 -05:00
da1de46f66
some little stuff
...
Tiny and I think they are all obvious.
2019-01-12 14:16:33 -05:00
c3b588bc65
init: rename *_pid_* interfaces to use "runtime"
...
The name of these interfaces is clearer that way.
This comes from a suggestion from
https://lore.kernel.org/selinux-refpolicy/dedf3ce8-4e9f-2313-6799-bbc9dc3a8124@ieee.org/
2019-01-12 17:11:00 +01:00
143ed2cc1b
init, logging: Module version bump.
2019-01-10 20:26:36 -05:00
6f5e31431e
Allow systemd-journald to read systemd unit symlinks
...
type=AVC msg=audit(1546723651.696:2091): avc: denied { read } for
pid=240 comm="systemd-journal" name="invocation:user@1000.service"
dev="tmpfs" ino=17614 scontext=system_u:system_r:syslogd_t
tcontext=system_u:object_r:init_var_run_t tclass=lnk_file
permissive=0
type=AVC msg=audit(1546723651.799:2092): avc: denied { read } for
pid=240 comm="systemd-journal" name="invocation:dbus.service"
dev="tmpfs" ino=12542 scontext=system_u:system_r:syslogd_t
tcontext=system_u:object_r:init_var_run_t tclass=lnk_file
permissive=0
"ls -lZ" on these files gives:
lrwxrwxrwx. 1 root root system_u:object_r:init_var_run_t 32
/run/systemd/units/invocation:user@1000.service -> a12344e990e641d9a43065b2d1e115a7
lrwxrwxrwx. 1 root root system_u:object_r:init_var_run_t 32
/run/systemd/units/invocation:dbus.service -> 70bd8da4e0c14bf8b7fcadcd71d22214
2019-01-10 23:51:08 +01:00
85536c64e1
kernel, jabber, ntp, init, logging, systemd: Module version bump.
2019-01-09 19:36:41 -05:00
d2a1333fdc
kernel, systemd: Move lines.
2019-01-09 19:30:15 -05:00
9cb572bd02
mls stuff
...
Here are the patches I used last time I tried to get MLS going on Debian.
2019-01-09 19:20:35 -05:00
1ff4b35ec2
iptables: Module version bump.
2019-01-07 18:48:44 -05:00
43a77c30fa
Add interface to get status of iptables service
...
Signed-off-by: Dave Sugar <dsugar@tresys.com>
2019-01-07 18:40:13 -05:00
e8ba31557d
various: Module version bump.
2019-01-06 14:11:08 -05:00
599112a85c
Merge branch 'systemd-logind-getutxent' of git://github.com/fishilico/selinux-refpolicy
2019-01-06 14:07:54 -05:00
bd50873362
Merge branch 'restorecond_getattr_cgroupfs' of git://github.com/fishilico/selinux-refpolicy
2019-01-06 14:07:24 -05:00
82494cedc1
pam_faillock creates files in /run/faillock
...
These are changes needed when pam_fallock creates files in /run/faillock
(which is labeled faillog_t). sudo and xdm (and probably other domains)
will create files in this directory for successful and failed login
attempts.
v3 - Updated based on feedback
type=AVC msg=audit(1545153126.899:210): avc: denied { search } for pid=8448 comm="lightdm" name="faillock" dev="tmpfs" ino=39318 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:faillog_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1545153131.090:214): avc: denied { write } for pid=8448 comm="lightdm" name="faillock" dev="tmpfs" ino=39318 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:faillog_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1545153131.090:214): avc: denied { add_name } for pid=8448 comm="lightdm" name="dsugar" scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:faillog_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1545153131.090:214): avc: denied { create } for pid=8448 comm="lightdm" name="dsugar" scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:faillog_t:s0 tclass=file permissive=1
type=AVC msg=audit(1545153131.091:215): avc: denied { setattr } for pid=8448 comm="lightdm" name="dsugar" dev="tmpfs" ino=87599 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:faillog_t:s0 tclass=file permissive=1
type=AVC msg=audit(1545167205.531:626): avc: denied { search } for pid=8264 comm="sudo" name="faillock" dev="tmpfs" ino=35405 scontext=sysadm_u:sysadm_r:cleaner_applyconfig_sudo_t:s0-s0:c0.c1023 tcontext=system_u:object_r:faillog_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1545167205.531:627): avc: denied { write } for pid=8264 comm="sudo" name="faillock" dev="tmpfs" ino=35405 scontext=sysadm_u:sysadm_r:cleaner_applyconfig_sudo_t:s0-s0:c0.c1023 tcontext=system_u:object_r:faillog_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1545167205.531:627): avc: denied { add_name } for pid=8264 comm="sudo" name="root" scontext=sysadm_u:sysadm_r:cleaner_applyconfig_sudo_t:s0-s0:c0.c1023 tcontext=system_u:object_r:faillog_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1545167205.531:627): avc: denied { create } for pid=8264 comm="sudo" name="root" scontext=sysadm_u:sysadm_r:cleaner_applyconfig_sudo_t:s0-s0:c0.c1023 tcontext=sysadm_u:object_r:faillog_t:s0 tclass=file permissive=1
Signed-off-by: Dave Sugar <dsugar@tresys.com>
2019-01-06 13:57:18 -05:00
6780e6d2e2
init: Remove inadvertent merge.
2019-01-06 13:53:02 -05:00
61b83b30be
systemd: Rename systemd_list_netif() to systemd_list_networkd_runtime().
...
Move implementation with other networkd_runtime interfaces.
2019-01-06 13:49:02 -05:00
b77b4cd610
missing from previous
...
Here are the things that weren't applied from my previous patches, I think they
are all worthy of inclusion.
2019-01-06 13:44:18 -05:00
ef6c7f155e
systemd misc
...
This patch has policy changes related to systemd and the systemd versions
of system programs.
Also has some dbus policy which probably isn't strictly a systemd thing, but it
all came at the same time.
2019-01-06 13:11:51 -05:00
150bd4e179
systemd: allow systemd-logind to use getutxent()
...
systemd-logind reads /run/utmp in order to warn users who are currently
logged in about an imminent shutdown. It calls utmp_wall() in
https://github.com/systemd/systemd/blob/v240/src/login/logind-utmp.c#L75-L87
This function calls glibc's getutxent() here:
https://github.com/systemd/systemd/blob/v240/src/shared/utmp-wtmp.c#L401
This function, implemented in
https://sourceware.org/git/?p=glibc.git;a=blob;f=login/utmp_file.c;h=040a5057116bb69d9dfb1ca46f025277a6e20291;hb=3c03baca37fdcb52c3881e653ca392bba7a99c2b
, opens and locks /run/utmp in order to enumerate the users.
2019-01-06 16:28:32 +01:00
49af56f3b5
selinuxutil: allow restorecond to try counting the number of files in cgroup fs
...
When restorecond calls selinux_restorecon(), libselinux scans
/proc/mounts in a function named exclude_non_seclabel_mounts with the
following comment
(https://github.com/SELinuxProject/selinux/blob/libselinux-2.8/libselinux/src/selinux_restorecon.c#L224-L230 ):
/*
* This is called once when selinux_restorecon() is first called.
* Searches /proc/mounts for all file systems that do not support extended
* attributes and adds them to the exclude directory table. File systems
* that support security labels have the seclabel option, return
* approximate total file count.
*/
The "approximate total file count" is computed using statvfs(), which
results in a system call to statfs().
The cgroup filesystem supports security label (/proc/mounts shows
"seclabel") so restorecond uses statfs to try counting the number of its
inodes. This result in the following denial:
type=AVC msg=audit(1546727200.623:67): avc: denied { getattr } for
pid=314 comm="restorecond" name="/" dev="cgroup" ino=1
scontext=system_u:system_r:restorecond_t
tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=0
type=SYSCALL msg=audit(1546727200.623:67): arch=c000003e syscall=137
success=no exit=-13 a0=556d2aeb4c37 a1=7fffa4a90a90 a2=556d2aeb4c55
a3=7f043156a9f0 items=0 ppid=1 pid=314 auid=4294967295 uid=0 gid=0
euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none)
ses=4294967295 comm="restorecond" exe="/usr/bin/restorecond"
subj=system_u:system_r:restorecond_t key=(null)
type=PROCTITLE msg=audit(1546727200.623:67): proctitle="/usr/sbin/restorecond"
Allow this, like commit 5125b8eb2d
2019-01-05 23:51:36 +01:00
d6b46686cd
many: Module version bumps for changes from Russell Coker.
2019-01-05 14:33:50 -05:00
e1babbc375
systemd related interfaces
...
This patch has interface changes related to systemd support as well as policy
that uses the new interfaces.
2019-01-05 14:17:01 -05:00
39881a0e14
dpkg: Rename dpkg_read_script_tmp_links().
2019-01-05 13:56:43 -05:00
Chris PeBenito
Jason Zaman
Russell Coker
Sugar, David
Nicolas Iooss
Dominick Grift