Chris PeBenito
4c7926a3c0
init: Revise init_startstop_service() build option blocks.
...
Revise to use ifelse to have a clear set of criteria for enabling the
various options. Additionally, if no options are enabled, run_init
permissions are provided as a default.
Signed-off-by: Chris PeBenito <chpebeni@linux.microsoft.com>
2020-07-27 11:40:36 -04:00
Chris PeBenito
aa6c3f4da3
apt, rpm: Module version bump.
...
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2020-07-27 09:05:53 -04:00
Laurent Bigonville
e4f0709788
Label /usr/libexec/packagekitd as apt_exec_t on debian
...
The daemon has now moved from /usr/lib/packagekit/packagekitd to
/usr/libexec/packagekitd
Signed-off-by: Laurent Bigonville <bigon@bigon.be>
2020-07-27 13:26:06 +02:00
Chris PeBenito
c5ac0d52c4
openvpn: Module version bump.
...
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2020-07-16 09:31:56 -04:00
Chris PeBenito
7f601b8bcf
Merge pull request #284 from alexminder/openvpn
2020-07-16 09:31:06 -04:00
Alexander Miroshnichenko
67c4238e8e
openvpn: update file context regex for ipp.txt
...
Signed-off-by: Alexander Miroshnichenko <alex@millerson.name>
2020-07-14 13:34:58 +03:00
Chris PeBenito
ac02273502
tmp2: Module version bump.
...
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2020-07-10 08:51:57 -04:00
Alexander Miroshnichenko
aff9c6e91c
openvpn: more versatile file context regex for ipp.txt
...
Signed-off-by: Alexander Miroshnichenko <alex@millerson.name>
2020-07-07 15:22:29 +03:00
Dave Sugar
7a03f4a00f
Interfaces for tpm2
...
Add interfaces tpm2_use_fds, tpm2_dontaudit_use_fds, and tpm2_read_pipes
Signed-off-by: Dave Sugar <dsugar@tresys.com>
2020-07-06 22:34:39 -04:00
Chris PeBenito
613708cad6
various: Module version bump.
...
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2020-07-04 09:30:45 -04:00
Chris PeBenito
0992763548
Update callers for "pid" to "runtime" interface rename.
...
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2020-06-28 16:03:45 -04:00
Chris PeBenito
be04bb3e7e
Rename "pid" interfaces to "runtime" interfaces.
...
Rename interfaces to bring consistency with previous pid->runtime type
renaming. See PR #106 or 69a403cd
original type renaming.
Interfaces that are still in use were renamed with a compatibility
interface. Unused interfaces were fully deprecated for removal.
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2020-06-28 14:33:17 -04:00
Chris PeBenito
07c08fa41e
kernel: Module version bump.
...
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2020-06-18 08:30:42 -04:00
Dave Sugar
50c24ca481
Resolve neverallow failure introduced in #273
...
Signed-off-by: Dave Sugar <dsugar@tresys.com>
2020-06-17 19:05:08 -04:00
Chris PeBenito
c63e5410a9
systemd: Module version bump.
...
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2020-06-17 08:48:41 -04:00
Chris PeBenito
c2a142d762
systemd: Merge generator domains.
...
If these processes are compromised they can write units to do malicious
actions, so trying to tightly protect the resources for each generator
is not effective.
Made the fstools_exec() optional, although it is unlikely that a system
would not have the module.
Only aliases for removed types in previous releases are added. The
systemd_unit_generator() interface and systemd_generator_type attribute
were not released and are dropped without deprecation.
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2020-06-15 09:47:20 -04:00
Chris PeBenito
71002cdfe0
various: Module version bump.
...
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2020-06-15 08:57:44 -04:00
Chris PeBenito
91087f8ff1
Merge pull request #274 from bauen1/remove-dead-weight
2020-06-15 08:56:42 -04:00
Chris PeBenito
9169113d42
Merge pull request #271 from bauen1/misc-fixes-2
2020-06-15 08:56:40 -04:00
Chris PeBenito
edbe7e9af7
Merge pull request #267 from bauen1/target-systemd-sysusers
2020-06-15 08:56:24 -04:00
bauen1
fc904634ac
dpkg: domaintrans to sysusers if necessary
...
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-06-15 14:52:53 +02:00
bauen1
77f891c7bf
Remove the ada module, it is unecessary and not touched since ~2008
...
It is only used to allow the compiler execmem / execstack but we have
unconfined_execmem_t for that.
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-06-15 14:47:14 +02:00
bauen1
cbdf1fad22
systemd: systemd-tempfiles will relabel tmpfs if mounted over e.g. /tmp
...
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-06-15 14:45:07 +02:00
bauen1
e12d84181b
corecommands: correct label for debian ssh-agent helper script
...
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-06-15 14:45:07 +02:00
bauen1
cb2d84b0d1
gpg: don't allow gpg-agent to read /proc/kcore
...
This was probably a typo and shouldn't have been merged.
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-06-15 14:45:07 +02:00
bauen1
083e5d1d58
dpkg: dpkg scripts are part of dpkg and therefor also an application domain
...
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-06-15 14:45:07 +02:00
bauen1
583f435c7b
systemd: systemd --user add essential permissions
...
Allow selinux awareness (libselinux) and access to setsockcreatecon to
correctly set the label of sockets.
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-06-15 14:45:07 +02:00
bauen1
e7fc029a95
dpkg: allow dpkg frontends to acquire lock by labeling it correctly
...
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-06-15 14:45:07 +02:00
Chris PeBenito
2f097a0c6d
various: Module version bump.
...
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2020-06-15 08:43:30 -04:00
bauen1
66b4101b36
systemd: maintain /memfd:systemd-state
...
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-06-15 14:43:18 +02:00
bauen1
a42a15dd4d
authlogin: unix_chkpwd is linked to libselinux
...
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-06-15 14:43:18 +02:00
bauen1
6f7bc3da46
init: systemd will run chkpwd to start user@1000
...
This was likely also hidden by the unconfined module.
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-06-15 14:43:17 +02:00
bauen1
a5c3c70385
thunderbird: label files under /tmp
...
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-06-15 14:43:17 +02:00
bauen1
6ce9865e6c
systemd: fixed systemd_rfkill_t denial spam
...
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-06-15 14:41:30 +02:00
bauen1
a9ff07d886
postfix: add filetrans for sendmail and postfix for aliases db operations
...
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-06-15 14:41:30 +02:00
bauen1
0f4eb2a324
init: fix systemd boot
...
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-06-11 19:10:35 +02:00
bauen1
93beef3ce5
systemd-logind.service sandbox required permissions
...
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-06-11 19:10:35 +02:00
bauen1
e20db26b7b
systemd-timesyncd.service sandbox requried permissions
...
For every services sandbox systemd will create a (or more ?) tmpfs including symlinks for various files, e.g.:
Jun 11 14:03:17 selinux-pr-test1 audit[284]: AVC avc: granted { create } for pid=284 comm="(imesyncd)" name="stderr" scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=lnk_file
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-06-11 19:10:35 +02:00
bauen1
83a39ad4fd
udev.service sandbox required permissions
...
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-06-11 19:10:35 +02:00
bauen1
0a596401f1
logrotate.service sandbox required permissions
...
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-06-11 19:10:34 +02:00
bauen1
d9a58c8434
terminal: cleanup term_create interfaces
...
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-06-11 19:10:34 +02:00
bauen1
aa6c7f28f2
allow most common permissions for systemd sandboxing options
...
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-06-11 19:10:28 +02:00
Chris PeBenito
309f655fdc
various: Module version bump.
...
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2020-06-10 15:02:27 -04:00
bauen1
8f782ae820
systemd-sysusers: add policy
...
On systems without the unconfined module this service needs additional
privileges.
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-06-04 19:53:47 +02:00
Topi Miettinen
1d8333d7a7
Remove unlabeled packet access
...
When SECMARK or Netlabel packet labeling is used, it's useful to
forbid receiving and sending unlabeled packets. If packet labeling is
not active, there's no effect.
Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
2020-06-03 23:16:19 +03:00
Christian Göttsche
b4180614b6
apache: quote gen_tunable name argument
...
Match the style of tunable_policy and gen_tunable statements in userdomain
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
2020-06-02 20:35:30 +02:00
Christian Göttsche
dcb01ec4cc
devices/storage: quote arguments to tunable_policy
...
Match the overall style and please sepolgen-ifgen
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
2020-06-02 20:35:30 +02:00
Chris PeBenito
c950ada4ea
openvpn: Module version bump.
...
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2020-06-02 13:35:57 -04:00
McSim85
95c43ef3a4
add rule for the management socket file
...
fixed comments from @bauen1
Signed-off-by: McSim85 <maxim@kramarenko.pro>
2020-06-02 13:58:46 +03:00
Chris PeBenito
b38804e328
init, logging: Module version bump.
...
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2020-05-27 11:36:44 -04:00
Chris PeBenito
fe0a8d2542
Merge pull request #261 from bauen1/confined-debian-fixes
2020-05-27 11:35:49 -04:00
bauen1
be231899f5
init: replace call to init_domtrans_script
...
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-05-27 17:09:06 +02:00
Chris PeBenito
c75b2f3642
corecommands, files, filesystem, init, systemd: Module version bump.
...
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2020-05-27 10:52:49 -04:00
Chris PeBenito
d8da662d5e
Merge pull request #262 from bauen1/misc-fixes-1
2020-05-27 10:52:07 -04:00
Chris PeBenito
382c5f7c09
domain, setrans: Module version bump.
...
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2020-05-27 10:46:47 -04:00
Chris PeBenito
5374e1ac16
Merge pull request #264 from bauen1/reenable-setrans
2020-05-27 10:46:08 -04:00
bauen1
b184f71bed
init: fix init_manage_pid_symlinks to grant more than just create permissions
...
This was introduced in 4e842fe209
by me.
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-05-27 14:23:18 +02:00
bauen1
ab2c353048
systemd: allow systemd-user-runtime-dir to do its job
...
It requires access to /run/user/UID while running as root
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-05-27 14:03:05 +02:00
bauen1
7eae84a8b4
lvm-activation-generator also needs to execute lvm
...
lvm will also try to read localization.
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-05-27 14:03:05 +02:00
bauen1
ee323d3b9a
filesystem: pathcon for matching tracefs mount
...
Prevent restorecon from trying to relabel /sys/fs/tracing .
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-05-27 11:51:36 +02:00
bauen1
c9354399f9
corecommands: proper label for unattended-upgrades helpers
...
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-05-27 11:51:36 +02:00
bauen1
ef0238d2d5
init: watch /etc/localtime even if it's a symlink
...
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-05-27 11:51:36 +02:00
bauen1
70e0d26988
files: add files_watch_etc_symlinks interface
...
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-05-27 11:51:36 +02:00
bauen1
9e2e343989
setrans: allow label translation for all domains.
...
This partially reverts commit 65da822c1b
Connecting to setransd is still very much necessary for any domain that
uses SELinux labels in any way.
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-05-22 20:53:47 +02:00
bauen1
8784dd0c66
init: allow systemd to activate journald-audit.socket
...
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-05-22 20:51:46 +02:00
bauen1
5fb8157616
init: make initrc_t a init_domain to simplify the policy
...
This also allows init_t initrc_t:process2 nnp_transition which can be
required if the service isn't targeted.
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-05-22 20:51:39 +02:00
bauen1
51d76f956f
init: allow systemd to setup mount namespaces
...
This is required to boot without the unconfined module.
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-05-22 20:48:13 +02:00
Christian Göttsche
160e2016bb
apache: use correct content types in apache_manage_all_user_content()
...
The content types are named httpd_user_rw_content_t and
httpd_user_ra_content_t not httpd_user_content_rw_t and
httpd_user_content_ra_t in apache_content_template()
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
2020-05-15 00:01:02 +02:00
Chris PeBenito
5b171c223a
various: Module version bump.
...
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2020-05-14 10:32:30 -04:00
Chris PeBenito
28bf3cb4fb
Merge pull request #258 from bauen1/misc-fixes-1
2020-05-14 10:27:04 -04:00
Chris PeBenito
2ab326ab2d
Merge pull request #253 from cgzones/selint
2020-05-14 10:27:00 -04:00
bauen1
09c028ead9
dnsmasq: watch for new dns resolvers
...
dnsmasq will watch /etc/resolv.conf for any changes to add new dns
servers immediately.
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-05-14 09:31:51 +02:00
bauen1
096b8f59f2
semanage: create directories for new policies
...
semodule will try to create a directory under /etc/selinux if the policy
it is modifying doesn't exist (e.g. it is being build for the first time).
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-05-14 09:31:31 +02:00
bauen1
4f9772e309
systemd-fstab-generator needs to know about all mountpoints
...
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-05-14 09:31:30 +02:00
bauen1
da561748d0
corecommands: fix atrild label
...
atrild is a daemon shipped by atril, see shell/Makefile.am of
https://github.com/mate-desktop/atril
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-05-14 09:31:30 +02:00
bauen1
955c5c5253
lvm: create /etc/lvm/archive if it doesn't exist
...
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-05-14 09:31:27 +02:00
bauen1
67dfa3651f
init: read default context during boot
...
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-05-14 09:31:26 +02:00
bauen1
2b11987003
quota: allow quota to modify /aquota even if immutable
...
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-05-14 09:31:26 +02:00
bauen1
0ff1f78619
systemd: allow regular users to run systemd-analyze
...
Same deal as with systemd-run this is potentially useful for non
privileged users and especially useful for admins.
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-05-14 09:31:17 +02:00
Christian Göttsche
57d570f01c
chromium/libraries: move lib_t filecontext to defining module
...
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
2020-05-12 20:09:44 +02:00
Christian Göttsche
2884cfe4bc
files/miscfiles: move usr_t filecontext to defining module
...
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
2020-05-12 20:09:44 +02:00
Christian Göttsche
75b3bcaf3e
files/logging: move var_run_t filecontext to defining module
...
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
2020-05-12 20:09:44 +02:00
Chris PeBenito
e7dad518eb
application: Module version bump.
...
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2020-05-12 11:24:40 -04:00
Chris PeBenito
5387a29b40
Merge pull request #255 from bauen1/fix-sudo-ssh
2020-05-12 11:24:10 -04:00
bauen1
dd8ed0ba14
application: applications can be executed from ssh without pty
...
For example ansible uses `ssh localhost sudo id` to become root.
This doesn't appear to be necessary in redhat due to https://src.fedoraproject.org/rpms/openssh/blob/master/f/openssh-6.6p1-privsep-selinux.patch
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-05-12 16:52:59 +02:00
Chris PeBenito
68a076bf43
dirmngr: Module version bump
...
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2020-05-12 10:50:57 -04:00
Christian Göttsche
0ac9f4cb22
tpm2: small fixes
...
* Drop permissions implied by domtrans_pattern
* Use fifo_file permission macro for fifo_file class
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
2020-05-11 21:42:50 +02:00
Christian Göttsche
d769c71848
init/systemd: move systemd_manage_all_units to init_manage_all_units
...
The attribute systemdunit is defined in the file init.te, so interfaces
granting access on it should be defined in init.if
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
2020-05-11 21:42:50 +02:00
Christian Göttsche
e683d67f46
portage: drop bizarre conditional TODO blocks
...
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
2020-05-11 21:42:50 +02:00
Christian Göttsche
8f308eb846
unconfined: clarify unconfined_t stub usage in unconfined_domain_noaudit()
...
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
2020-05-11 21:42:50 +02:00
Christian Göttsche
f6a7365cc0
consolesetup: drop unused requires
...
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
2020-05-11 21:42:50 +02:00
Christian Göttsche
31153edcb4
chromium: drop dead conditional block
...
The condition `use_alsa` is nowhere defined, and the contained interface
`alsa_domain` does not exist.
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
2020-05-11 21:42:50 +02:00
Christian Göttsche
c7d77a32b9
samba: fix wrong interface context smbd_runtime_t
...
Commit 69a403cd97
renamed smbd_var_run_t to smbd_runtime_t,
but smbd_runtime_t does not exist.
Commit 61ecff5c31
removed the alias smbd_var_run_t to samba_runtime_t.
Use samba_runtime_t instead.
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
2020-05-11 21:42:50 +02:00
bauen1
3cdae47364
dirmngr: ~/.gnupg/crls.d might not exist
...
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-05-10 14:44:41 +02:00
bauen1
a356bce2d4
dirmngr: also requires access to /dev/urandom
...
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-05-10 14:44:41 +02:00
bauen1
5bd2650602
dirmngr: allow to probe for tor
...
dirmngr will test if tor is running, even if it isn't and this check
fails dirmngr will fail to retrieve any keys, this is the default (see
https://www.gnupg.org/documentation/manuals/gnupg/Dirmngr-Options.html
for --use-tor)
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-05-10 14:44:40 +02:00
Chris PeBenito
6df603e814
apache, bird, ntp: Module version bump.
...
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2020-05-05 13:35:34 -04:00
Chris PeBenito
370160dcb9
Merge pull request #251 from bauen1/fix-systemd-timesyncd
2020-05-05 13:28:54 -04:00
Chris PeBenito
45733fcfb1
Merge pull request #250 from bauen1/nginx
2020-05-05 13:28:31 -04:00
Chris PeBenito
809c39fa50
Merge pull request #239 from bauen1/fix-bird2
2020-05-05 13:27:55 -04:00