RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
5,145 Commits 3 Branches 49 Tags 19 MiB
Commit Graph

5145 Commits

Author SHA1 Message Date
Laurent Bigonville 8215279af4 Add dovecot to listen to LMTP port 
Mails can be injected in dovecot directly using LMTP
 2019-05-03 12:33:09 +02:00
Dave Sugar de0e70f07a create interfaces for NetworkManager units 
Create interfaces to allow start/stop, enable/disable
and status of NetworkManager systemd unit
 2019-05-02 11:16:41 -04:00
Chris PeBenito 5d345b79ee various: Module version bump. 
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
 2019-04-27 10:51:06 -04:00
Chris PeBenito 6857cda019 Merge pull request #46 from pebenito/systemd-user 2019-04-27 10:50:32 -04:00
Chris PeBenito a77e0f6837 Merge pull request #45 from pebenito/systemd-update-done-tweak 2019-04-27 10:50:30 -04:00
Chris PeBenito e5d14ad308 Merge pull request #44 from pebenito/http-mta-optional 2019-04-27 10:50:29 -04:00
Chris PeBenito 54dbc8a7a7 Merge pull request #43 from pebenito/various-device-labels 2019-04-27 10:50:27 -04:00
Chris PeBenito da156aea1e systemd: Add initial policy for systemd --user. 
This is just a start; it does not cover all uses.

Signed-off-by: Chris PeBenito <Christopher.PeBenito@microsoft.com>
 2019-04-25 11:18:58 -04:00
Chris PeBenito 4bca3dade2 devices: Change netcontrol devices to pmqos. 
Devices with the netcontrol_device_t type are actually PM QoS devices.
Rename the type and add labeling for /dev/memory_bandwidth.

Signed-off-by: Chris PeBenito <Christopher.PeBenito@microsoft.com>
 2019-04-24 09:17:36 -04:00
Chris PeBenito 3b0d0ea330 devices: Add type for GPIO chips, /dev/gpiochip[0-9] 
Signed-off-by: Chris PeBenito <Christopher.PeBenito@microsoft.com>
 2019-04-24 08:50:41 -04:00
Chris PeBenito b1a312152c devices: Label /dev/tpmrm[0-9]. 
Signed-off-by: Chris PeBenito <Christopher.PeBenito@microsoft.com>
 2019-04-24 08:50:41 -04:00
Chris PeBenito 77161ca8b7 storage: Label /dev/mmcblk* character nodes. 
An example is mmcblk0rpmb, which is for the replay protected memory block
subsystem.

Signed-off-by: Chris PeBenito <Christopher.PeBenito@microsoft.com>
 2019-04-24 08:50:41 -04:00
Chris PeBenito ae2d2ec470 kernel, devices, plymouthd, xserver: Module version bump. 2019-04-23 18:37:22 -04:00
Chris PeBenito 2da6525bf5 Merge pull request #42 from dsugar100/master 2019-04-23 18:16:20 -04:00
Chris PeBenito ff9bd742b7 systemd: Remove unnecessary names in systemd-update-done filetrans. 
Signed-off-by: Chris PeBenito <Christopher.PeBenito@microsoft.com>
 2019-04-23 15:22:17 -04:00
Chris PeBenito 2f0ead8ecf apache: Make MTA optional. 
Signed-off-by: Chris PeBenito <Christopher.PeBenito@microsoft.com>
 2019-04-23 15:17:33 -04:00
Dave Sugar 51aadce3c2 Changes to support plymouth working in enforcing 
plymouth is started very early in the boot process.  Looks
like before the SELinux policy is loaded so plymouthd is
running as kernel_t rather than plymouthd_t.  Due to this
I needed to allow a few permissions on kernel_t to get
the system to boot.

type=AVC msg=audit(1554917011.127:225): avc:  denied  { write } for  pid=2585 comm="plymouthd" name="plymouth" dev="tmpfs" ino=18877 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:plymouthd_var_run_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1554917011.127:226): avc:  denied  { remove_name } for  pid=2585 comm="plymouthd" name="pid" dev="tmpfs" ino=18883 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:plymouthd_var_run_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1554917011.127:227): avc:  denied  { unlink } for  pid=2585 comm="plymouthd" name="pid" dev="tmpfs" ino=18883 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:plymouthd_var_run_t:s0 tclass=file permissive=1

type=AVC msg=audit(1554917011.116:224): avc:  denied  { write } for  pid=2585 comm="plymouthd" name="boot-duration" dev="dm-16" ino=2097285 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:plymouthd_var_lib_t:s0 tclass=file permissive=1

type=AVC msg=audit(1555069712.938:237): avc:  denied  { ioctl } for  pid=2554 comm="plymouthd" path="/dev/dri/card0" dev="devtmpfs" ino=12229 ioctlcmd=64b1 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:dri_device_t:s0 tclass=chr_file permissive=0
 2019-04-23 07:48:15 -04:00
Dave Sugar 2b42f0c13d Allow xdm (lightdm) start plymouth 
type=AVC msg=audit(1554917007.995:194): avc:  denied  { execute } for  pid=7647 comm="lightdm" name="plymouth" dev="dm-1" ino=6508817 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:plymouth_exec_t:s0 tclass=file permissive=1
type=AVC msg=audit(1554917007.995:194): avc:  denied  { read open } for  pid=7647 comm="lightdm" path="/usr/bin/plymouth" dev="dm-1" ino=6508817 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:plymouth_exec_t:s0 tclass=file permissive=1
type=AVC msg=audit(1554917007.995:194): avc:  denied  { execute_no_trans } for  pid=7647 comm="lightdm" path="/usr/bin/plymouth" dev="dm-1" ino=6508817 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:plymouth_exec_t:s0 tclass=file permissive=1
type=AVC msg=audit(1554917007.995:194): avc:  denied  { map } for  pid=7647 comm="plymouth" path="/usr/bin/plymouth" dev="dm-1" ino=6508817 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:plymouth_exec_t:s0 tclass=file permissive=1
 2019-04-16 22:20:29 -04:00
Chris PeBenito e2e4094bd4 various: Module version bump 
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
 2019-04-16 22:08:11 -04:00
Sugar, David a49163250f Add kernel_dgram_send() into logging_send_syslog_msg() 
This patch is based on comments from previous a patch to
remove the many uses of kernel_dgram_send() and incorporate
it into logging_send_syslog_msg().

v2 - enclose in ifdef for redhat
v3 - rebase this patch on e41def136a

Signed-off-by: Dave Sugar <dsugar@tresys.com>
 2019-04-16 20:51:55 -04:00
Chris PeBenito e41def136a xserver: Module version bump. 
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
 2019-04-14 14:20:55 -04:00
Chris PeBenito 2356eda7fc Merge pull request #40 from gtrentalancia/master 2019-04-14 14:15:16 -04:00
Guido Trentalancia db33386c01 The Qt library version 5 requires to write xserver_tmp_t 
files upon starting up applications (tested on version
5.12.1).

Signed-off-by: Guido Trentalancia <guido@trentalancia.com>
---
 policy/modules/services/xserver.if |    3 +++
 1 file changed, 3 insertions(+)
 2019-04-12 17:52:50 +02:00
Chris PeBenito 32ce73f9b8 kernel: Module version bump. 
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
 2019-04-12 07:57:00 -04:00
Lukas Vrabec ce570ab34d Label /sys/kernel/ns_last_pid as sysctl_kernel_ns_last_pid_t 
CRIU can influence the PID of the threads it wants to create.
CRIU uses /proc/sys/kernel/ns_last_pidto tell the kernel which
PID it wants for the next clone().
So it has to write to that file. This feels like a problematic as
it opens up the container writing to all sysctl_kernel_t.

Using new label container_t will just write to
sysctl_kernel_ns_last_pid_t instad writing to more generic
sysctl_kernel_t files.
 2019-04-12 07:52:27 -04:00
Chris PeBenito beb4a290b0 init: Module version bump. 2019-04-07 20:56:22 -04:00
Chris PeBenito 4c2f16bb26 Merge pull request #39 from pebenito/revise-init-stopstart 2019-04-07 20:54:40 -04:00
Chris PeBenito b06126dca3 init: Revise conditions in init_startstop_service(). 
Signed-off-by: Chris PeBenito <Christopher.PeBenito@microsoft.com>
 2019-04-05 15:18:29 -04:00
Chris PeBenito df696a3254 kernel, init, systemd, udev: Module version bump. 
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
 2019-03-27 18:58:15 -04:00
Chris PeBenito 98c16077ba Merge pull request #37 from pebenito/master 
Misc system fixes.

Remove use of kernel_unconfined() by systemd_nspawn and udev write to its own executable.
 2019-03-27 18:57:39 -04:00
Chris PeBenito 4f6614ba7f ntp, init, lvm: Module version bump. 
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
 2019-03-27 18:49:54 -04:00
Sugar, David d3c4e19f72 Denial of cryptsetup reading cracklib database 
When setting up a LUKS encrypted partition, cryptsetup is reading
the cracklib databases to ensure password strength.  This is
allowing the needed access.

type=AVC msg=audit(1553216939.261:2652): avc:  denied  { search } for  pid=8107 comm="cryptsetup" name="cracklib" dev="dm-1" ino=6388736 scontext=sysadm_u:sysadm_r:lvm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:crack_db_t:s0 tclass=dir permissive=0
type=AVC msg=audit(1553216980.909:2686): avc:  denied  { read } for  pid=8125 comm="cryptsetup" name="pw_dict.pwd" dev="dm-1" ino=6388748 scontext=sysadm_u:sysadm_r:lvm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:crack_db_t:s0 tclass=file permissive=1
type=AVC msg=audit(1553216980.909:2686): avc:  denied  { open } for  pid=8125 comm="cryptsetup" path="/usr/share/cracklib/pw_dict.pwd" dev="dm-1" ino=6388748 scontext=sysadm_u:sysadm_r:lvm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:crack_db_t:s0 tclass=file permissive=1
type=AVC msg=audit(1553216980.909:2687): avc:  denied  { getattr } for  pid=8125 comm="cryptsetup" path="/usr/share/cracklib/pw_dict.pwi" dev="dm-1" ino=6388749 scontext=sysadm_u:sysadm_r:lvm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:crack_db_t:s0 tclass=file permissive=1

Signed-off-by: Dave Sugar <dsugar@tresys.com>
 2019-03-27 18:48:01 -04:00
Sugar, David 7525ba9c1e Allow ntpd to read unit files 
Adding missing documenation (sorry about that).

type=AVC msg=audit(1553013917.359:9935): avc:  denied  { read } for  pid=16326 comm="systemd-timedat" name="50-chronyd.list" dev="dm-1" ino=4870675 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:ntpd_unit_t:s0 tclass=file permissive=1
type=AVC msg=audit(1553013917.359:9935): avc:  denied  { open } for  pid=16326 comm="systemd-timedat" path="/usr/lib/systemd/ntp-units.d/50-chronyd.list" dev="dm-1" ino=4870675 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:ntpd_unit_t:s0 tclass=file permissive=1
type=AVC msg=audit(1553013917.359:9936): avc:  denied  { getattr } for  pid=16326 comm="systemd-timedat" path="/usr/lib/systemd/ntp-units.d/50-chronyd.list" dev="dm-1" ino=4870675 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:ntpd_unit_t:s0 tclass=file permissive=1

type=AVC msg=audit(1553013821.622:9902): avc:  denied  { getattr } for  pid=16281 comm="systemd-timedat" path="/usr/lib/systemd/ntp-units.d" dev="dm-1" ino=4700094 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:systemd_unit_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1553013821.622:9903): avc:  denied  { read } for  pid=16281 comm="systemd-timedat" name="ntp-units.d" dev="dm-1" ino=4700094 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:systemd_unit_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1553013821.622:9903): avc:  denied  { open } for  pid=16281 comm="systemd-timedat" path="/usr/lib/systemd/ntp-units.d" dev="dm-1" ino=4700094 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:systemd_unit_t:s0 tclass=dir permissive=1

Signed-off-by: Dave Sugar <dsugar@tresys.com>
 2019-03-27 18:48:01 -04:00
Chris PeBenito 32f3f09dc4 authlogin, dbus, ntp: Module version bump. 2019-03-24 14:43:35 -04:00
Sugar, David 142651a8b4 Resolve denial about logging to journal from dbus 
type=AVC msg=audit(1553013821.597:9897): avc:  denied  { sendto } for  pid=7377 comm="dbus-daemon" path="/dev/log" scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:kernel_t:s0 tclass=unix_dgram_socket permissive=1

Signed-off-by: Dave Sugar <dsugar@tresys.com>
 2019-03-24 14:37:22 -04:00
Sugar, David 5f14e530ad Resolve denial about logging to journal from chkpwd 
type=AVC msg=audit(1553029357.588:513): avc:  denied  { sendto } for  pid=7577 comm="unix_chkpwd" path="/dev/log" scontext=toor_u:staff_r:chkpwd_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=unix_dgram_socket permissive=0

Signed-off-by: Dave Sugar <dsugar@tresys.com>
 2019-03-24 14:37:22 -04:00
Sugar, David 9f2b1e2b4c Allow ntpd to update timezone symlink 
type=AVC msg=audit(1553013821.624:9907): avc:  denied  { create } for  pid=16281 comm="systemd-timedat" name=".#localtime69bc4c9ad513a247" scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=lnk_file permissive=1
type=AVC msg=audit(1553013821.624:9908): avc:  denied  { rename } for  pid=16281 comm="systemd-timedat" name=".#localtime69bc4c9ad513a247" dev="dm-1" ino=714303 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=lnk_file permissive=1
type=AVC msg=audit(1553013821.624:9908): avc:  denied  { unlink } for  pid=16281 comm="systemd-timedat" name="localtime" dev="dm-1" ino=1063377 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=lnk_file permissive=1

Signed-off-by: Dave Sugar <dsugar@tresys.com>
 2019-03-24 14:35:44 -04:00
Sugar, David 1b4ffb7806 Allow ntpd to update chronyd service 
type=USER_AVC msg=audit(1553013917.361:9938): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc:  denied  { disable } for auid=n/a uid=0 gid=0 path="/usr/lib/systemd/system/chronyd.service" cmdline="/usr/lib/systemd/systemd-timedated" scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:chronyd_unit_t:s0 tclass=service  exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?
type=USER_AVC msg=audit(1553013917.406:9943): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc:  denied  { stop } for auid=n/a uid=0 gid=0 path="/usr/lib/systemd/system/chronyd.service" cmdline="/usr/lib/systemd/systemd-timedated" scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:chronyd_unit_t:s0 tclass=service  exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'
type=USER_AVC msg=audit(1553021100.061:9970): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc:  denied  { enable } for auid=n/a uid=0 gid=0 path="/usr/lib/systemd/system/chronyd.service" cmdline="/usr/lib/systemd/systemd-timedated" scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:chronyd_unit_t:s0 tclass=service  exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'
type=USER_AVC msg=audit(1553021100.104:9973): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc:  denied  { start } for auid=n/a uid=0 gid=0 path="/usr/lib/systemd/system/chronyd.service" cmdline="/usr/lib/systemd/systemd-timedated" scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:chronyd_unit_t:s0 tclass=service  exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'

Signed-off-by: Dave Sugar <dsugar@tresys.com>
 2019-03-24 14:35:44 -04:00
Sugar, David a50afdcc84 Add interface ntp_dbus_chat 
type=USER_AVC msg=audit(1553013821.622:9900): pid=7377 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_call interface=org.freedesktop.timedate1 member=SetTimezone dest=org.freedesktop.timedate1 spid=16280 tpid=16281 scontext=sysadm_u:sysadm_r:settings_t:s0-s0:c0.c1023 tcontext=system_u:system_r:ntpd_t:s0 tclass=dbus  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
type=USER_AVC msg=audit(1553013821.625:9911): pid=7377 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_return dest=:1.258 spid=16281 tpid=16280 scontext=system_u:system_r:ntpd_t:s0 tcontext=sysadm_u:sysadm_r:settings_t:s0-s0:c0.c1023 tclass=dbus  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'

Signed-off-by: Dave Sugar <dsugar@tresys.com>
 2019-03-24 14:35:44 -04:00
Chris PeBenito e19f3d658c init: Remove duplicate setenforce rule for init scripts. 
Signed-off-by: Chris PeBenito <Christopher.PeBenito@microsoft.com>
 2019-03-20 10:10:23 -04:00
Chris PeBenito 99f967d3b5 udev: Drop write by udev to its executable. 
This removes one vector for arbitrary code execution if udev is
compromised.

Signed-off-by: Chris PeBenito <Christopher.PeBenito@microsoft.com>
 2019-03-20 10:10:10 -04:00
Chris PeBenito 40bf663090 systemd: Drop unconfined kernel access for systemd_nspawn. 
Revise kernel assertion to /proc/kmsg to be more precise.

Signed-off-by: Chris PeBenito <Christopher.PeBenito@microsoft.com>
 2019-03-20 10:09:37 -04:00
Chris PeBenito af68a29b42
Merge pull request #35 from pebenito/master 
genhomedircon.py: Fix top-level exception handling.
 2019-03-17 16:30:42 -04:00
Chris PeBenito c46eba9c02 sysadm, udev: Module version bump. 
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
 2019-03-17 16:27:34 -04:00
Chris PeBenito ceadf42b75 udev: Move one line and remove a redundant line. 
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
 2019-03-17 16:25:28 -04:00
Chris PeBenito 2297487654 udev: Whitespace fix. 
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
 2019-03-17 16:25:03 -04:00
Sugar, David ba31e59cd1 Separate out udevadm into a new domain 
This is the update I have made based on suggestions for the previous
patches to add a udev_run interface.  This adds the new domain udevadm_t
which is entered from /usr/bin/udevadm.

It seems to meet the needs that I have, but there are some things to
note that are probably important.
1) There are a few systemd services that use udevadm during startup.
   I have granted the permisssions that I need based on denials I was
   seeing during startup (the machine would fail to start without the
   permisions).
2) In the udev.fc file there are other binaries that I don't have on a
   RHEL7 box that maybe should also be labeled udevadm_exec_t.
   e.g. /usr/bin/udevinfo and /usr/bin/udevsend
   But as I don't have those binaries to test, I have not updated the
   type of that binary.
3) There are some places that call udev_domtrans that maybe should now
   be using udevadm_domtrans - rpm.te, hal.te, hotplug.te.  Again,
   these are not things that I am using in my current situation and am
   unable to test the interactions to know if the change is correct.

Other than that, I think this was a good suggestion to split udevadm
into a different domain.

Only change for v4 is to use stream_connect_pattern as suggested.

Signed-off-by: Dave Sugar <dsugar@tresys.com>
 2019-03-17 16:15:21 -04:00
Chris PeBenito 0af99256c6 genhomedircon.py: Fix top-level exception handling. 
Fixes errors like this:

Traceback (most recent call last):
  File "support/genhomedircon.py", line 490, in <module>
    errorExit("Options Error " + error)
TypeError: Can't convert 'GetoptError' object to str implicitly

Signed-off-by: Chris PeBenito <Christopher.PeBenito@microsoft.com>
 2019-03-15 09:41:49 -04:00
Chris PeBenito 60b8e08f4f systemd, udev, usermanage: Module version bump. 2019-03-11 20:59:21 -04:00
Chris PeBenito 5260679657 usermanage: Move kernel_dgram_send(passwd_t) to systemd block. 2019-03-11 20:59:16 -04:00