Commit Graph

37 Commits

Author SHA1 Message Date
Chris PeBenito 69a403cd97 Rename *_var_run_t types to *_runtime_t.
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2019-09-30 20:02:43 -04:00
Nicolas Iooss c021287125
Allow Debian to generate a dynamic motd when users log in
Debian's PAM configuration uses a patched pam_motd module that runs
files in /etc/update-motd.d/ in order to generate a dynamic Message Of
The Day (MOTD). By default, there is only one script:

    $ cat /etc/update-motd.d/10-uname
    #!/bin/sh
    uname -snrvm

According to https://wiki.debian.org/motd, the script is executed
through run-parts:

    if (!system("/usr/bin/env -i
    PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
    run-parts --lsbsysinit /etc/update-motd.d >
    /run/motd.dynamic.new"))
        rename("/run/motd.dynamic.new", "/run/motd.dynamic");

This requires allowing pam_motd users to execute bin_t commands
(/usr/bin/env) and shells (/bin/sh), and to manage /run/motd.dynamic*
files.

Allow relevant accesses for Debian-based systems.

Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2019-09-01 13:44:28 +02:00
James Carter 6226181924 Move use of systemd_unit_t from systemd.fc to init.fc
The type systemd_unit_t is actually declared in init.te.

Moved the file contexts to label transient systemd files with the
systemd_unit_t type from systemd.fc to init.fc.

Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
2018-04-12 18:44:50 -04:00
James Carter d172b3b45d Move the use of initrc_var_run_t from files.fc to init.fc
The type initrc_var_run_t is actually declared in init.te and moving it
removes a dependency of the base module (which files is a part) on a
module.

Moved the file contexts to label motd for debian systems with the
initrc_var_run_t type from files.fc to init.fc.

Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
2018-04-12 18:44:50 -04:00
David Sugar 8a7a8bd8c8 label systemd-shutdown so shutdown works
I am seeing (on RHEL 7.4 w/systemd) that halting the system doesn't work.  It took me a long time (and a lot of help from Steve L.) to figure out what was going on.  It turns out in refpolicy the default label for /usr/lib/systemd/systemd-shutdown is bin_t.  But when systemd tried to execve systemd-shutdown it fails because init_t isn't allowed file entrypoint for bin_t.  When I labeled systemd-shutdown as init_exec_t shutting down the system works.

I was seeing the following log (from systemd) when I enabled systemd debug logging (which was very useful).

[   59.745037] systemd[1]: Starting Final Step.
[   59.746112] systemd[1]: Starting Power-Off...
[   59.776320] systemd[1]: Shutting down.
[   59.783559] systemd[1]: Failed to execute shutdown binary, freezing: Operation not permitted

At this point everything locks up instead of actually halting the system.

This is a patch to change the label for systemd-shutdown which solves the problem.  I'm happy to go through and make a distinct type of systemd-shutdown if someone doesn't think it is a good idea to share the type with systemd.  But based on what is going on, this might be reasonable.

Signed-off-by: Dave Sugar <dsugar@tresys.com>
2017-12-10 14:45:35 -05:00
Chris PeBenito eea649c0f4 init: Remove sm-notify.pid fc entry which collides with the rpc module. 2017-09-16 13:31:12 -04:00
Chris PeBenito 46bf71752a init: Move fc lines. 2017-09-08 19:30:34 -04:00
David Sugar bd515fd951 Label RHEL specific systemd binaries
Label RHEL specific systemd binaries /usr/lib/systemd/rhel* as initrc_exec_t.
Now in the proper location.

Signed-off-by: Dave Sugar <dsugar@tresys.com>
2017-09-08 19:28:31 -04:00
Nicolas Iooss 69c742f11b
Support systems with a single /usr/bin directory
On systems such as Arch Linux, all programs which are usually located in
/bin, /sbin, /usr/bin and /usr/sbin are present in /usr/bin and the
other locations are symbolic links to this directory.  With such a
configuration, the file contexts which define types for files in
/bin, /sbin and /usr/sbin need to be duplicated to provide definitions
for /usr/bin/...

As the "/bin vs. /usr/bin" part of the needed definitions has already
been done with the "usr merge" patches, the next step consists in
duplicating file contexts for /usr/sbin. This is what this patch does
for all modules which are not in contrib.

This is the second iteration of an idea I have previously posted on
http://oss.tresys.com/pipermail/refpolicy/2017-March/009176.html
2017-04-15 20:49:07 +02:00
Chris PeBenito b690079a93 Misc fc changes from Russell Coker. 2017-04-06 17:00:28 -04:00
Chris PeBenito 5e20a0ee5b /var/run -> /run again
Here's the latest version of my patch to remove all /var/run when it's not
needed.  I have removed the subst thing from the patch, but kept a
distro_debian bit that relies on it.  So with this patch the policy won't
install if you build it with distro_debian unless you have my subst patch.
Chris, if your automated tests require that it build and install with
distro_debian then skip the patch for sysnetwork.fc.

From Russell Coker
2017-03-25 12:56:03 -04:00
Chris PeBenito 2087bde934 Systemd fixes from Russell Coker. 2017-02-23 20:03:23 -05:00
Chris PeBenito cb35cd587f Little misc patches from Russell Coker. 2017-02-18 09:39:01 -05:00
Chris PeBenito 2e7553db63 Create / to /usr equivalence for bin, sbin, and lib, from Russell Coker. 2017-02-04 15:19:35 -05:00
Nicolas Iooss 85d678bd2f
Add file contexts in /usr for /bin, /usr/sbin and /usr/lib
Some policy modules define file contexts in /bin, /sbin and /lib without
defining similar file contexts in the same directory under /usr.

Add these missing file contexts when there are outside ifdef blocks.
2016-12-27 17:06:54 +01:00
cgzones 7d376d7e4d transition file contexts to /run
Remove file context aliases and update file context paths to use the /run filesystem path.
Add backward compatibility file context alias for /var/run using applications like https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=783321
Lock files are still seated at /var/lock
2016-12-17 18:32:39 +01:00
Chris PeBenito 3639880cf6 Implement core systemd policy.
Significant contributions from the Tresys CLIP team.

Other changes from Laurent Bigonville.
2015-10-23 10:16:59 -04:00
Chris PeBenito 8cfe827a3d Move systemd fc entry. 2014-09-12 09:42:59 -04:00
Nicolas Iooss dcca3e977b Label systemd files in init module 2014-09-12 09:41:25 -04:00
Laurent Bigonville 0ca8ac16f3 Label /var/run/initctl as initctl_t
In Debian, the initctl pipe has been moved from /dev/initctl to
/run/initctl
2013-01-23 07:08:38 -05:00
Sven Vermeulen a3ac9f6054 Gentoo's openrc does not require initrc_exec_t for runscripts anymore
The Gentoo-specific runscripts in /sbin should not be marked as initrc_exec_t
anymore (just bin_t).

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2012-09-17 09:31:40 -04:00
Sven Vermeulen 8e678aa594 Use substititions for /usr/local/lib and /etc/init.d
Introduce the substitutions for the /usr/local/lib* locations (towards /usr/lib)
and /etc/init.d (towards /etc/rc.d/init.d).

Update the file contexts of the translated locations.

Rebased (collided with Guido's patch for commenting within the
file_contexts.subs_dist file) since v3.

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2012-08-15 10:30:25 -04:00
Sven Vermeulen b55726771e Simplify .fc in light of file_contexts.subs_dist
Now that we have file_contexts.subs_dist, translations that were put in the file context definition files can now be
cleaned up.

Differences from v1:
- removes a few duplicate entries in the libraries.fc file, and
- removes the contrib references

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2012-05-10 10:09:00 -04:00
Chris PeBenito e78ada8605 Debian file locations patch from Russell Coker. 2011-11-16 15:29:18 -05:00
Sven Vermeulen bce639cff4 Introduce rc_exec_t as file entry for initrc_t
Within Gentoo, the init system (openrc) uses a single binary (/sbin/rc)
for all its functions, be it executing init scripts, managing runlevels,
checking state, etc. This binary is not allowed to be labeled
initrc_exec_t as that would trigger domain transitions where this isn't
necessary (or even allowed).

A suggested solution is to use a separate type declaration for /sbin/rc
(rc_exec_t) which transitions where necessary.

This patch includes support for the /sbin/rc rc_exec_t type and declares
the init_rc_exec() interface which allows domains to execute the binary
without transitioning.

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2011-09-06 13:22:22 -04:00
Guido Trentalancia ad43927c43 patch to add a file context for /sbin/upstart
This patch adds a file context for /sbin/upstart.
2011-02-28 09:24:42 -05:00
Chris PeBenito 0233fc5126 Rearrange distro blocks in init.fc 2010-12-15 14:48:43 -05:00
Chris Richards 9951061f90 Fix OpenRC status dir labeling for Gentoo
Current policy sets /lib(32|64)?/rc/init.d to lib_t.  This causes
problems for DHCP among other things, as the initrc domain does not
have permissions to perform some operations.  Changing to
initrc_state_t (the labeling used for /var/lib/init.d by
the older baselayout-1) resolves some of these issues.

Signed-off-by: Chris Richards <gizmo@giz-works.com>
2010-12-15 14:44:40 -05:00
Chris PeBenito ddd786e404 Init patch from Dan Walsh. 2010-03-18 10:19:49 -04:00
Chris PeBenito 6073ea1e13 trunk: whitespace fix changing multiple spaces into tabs. 2008-12-03 18:33:19 +00:00
Chris PeBenito 88cf0a9c2b trunk: whitespace fix; collapse multiple blank lines into one. 2008-10-17 15:29:51 +00:00
Chris PeBenito e8cb08aefa trunk: add sepostgresql policy from kaigai kohei. 2008-06-10 15:33:18 +00:00
Chris PeBenito 6c53a10e28 trunk: Patch to clean up unescaped periods in several file context entries from Jan-Frode Myklebust. 2007-10-05 18:00:55 +00:00
Chris PeBenito 350b6ab767 trunk: merge strict and targeted policies. merge shlib_t into lib_t. 2007-10-02 16:04:50 +00:00
Chris PeBenito 0f9a2be65d add missing gentoo file contexts for initrc and lvm 2006-11-07 19:38:10 +00:00
Chris PeBenito 98de871cee more strict testing fixes 2006-08-23 19:36:04 +00:00
Chris PeBenito 17de1b790b remove extra level of directory 2006-07-12 20:32:27 +00:00