From cc46c3296a4af9a59d369836a299013440091ba8 Mon Sep 17 00:00:00 2001 From: Dave Sugar Date: Sun, 10 Dec 2023 21:00:21 -0500 Subject: [PATCH] SELinux policy for cockpit Setup domain for cockpit-certificate-ensure Setup service rules Signed-off-by: Dave Sugar --- policy/modules/kernel/corecommands.fc | 1 + policy/modules/roles/sysadm.te | 4 + policy/modules/services/cockpit.fc | 20 ++ policy/modules/services/cockpit.if | 202 ++++++++++++++++++++ policy/modules/services/cockpit.te | 262 ++++++++++++++++++++++++++ policy/modules/system/init.te | 5 + 6 files changed, 494 insertions(+) create mode 100644 policy/modules/services/cockpit.fc create mode 100644 policy/modules/services/cockpit.if create mode 100644 policy/modules/services/cockpit.te diff --git a/policy/modules/kernel/corecommands.fc b/policy/modules/kernel/corecommands.fc index 450513230..04d6caa80 100644 --- a/policy/modules/kernel/corecommands.fc +++ b/policy/modules/kernel/corecommands.fc @@ -327,6 +327,7 @@ ifdef(`distro_debian',` /usr/share/cluster/.*\.sh gen_context(system_u:object_r:bin_t,s0) /usr/share/cluster/ocf-shellfuncs -- gen_context(system_u:object_r:bin_t,s0) /usr/share/cluster/svclib_nfslock -- gen_context(system_u:object_r:bin_t,s0) +/usr/share/cockpit/motd/update-motd -- gen_context(system_u:object_r:bin_t,s0) /usr/share/cvs/contrib/rcs2log -- gen_context(system_u:object_r:bin_t,s0) /usr/share/e16/misc(/.*)? gen_context(system_u:object_r:bin_t,s0) /usr/share/gedit/plugins/externaltools/tools(/.*)? gen_context(system_u:object_r:bin_t,s0) diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te index 2744e22c8..08cc0e117 100644 --- a/policy/modules/roles/sysadm.te +++ b/policy/modules/roles/sysadm.te @@ -283,6 +283,10 @@ optional_policy(` cobbler_admin(sysadm_t, sysadm_r) ') +optional_policy(` + cockpit_admin(sysadm_t) +') + optional_policy(` collectd_admin(sysadm_t, sysadm_r) ') diff --git a/policy/modules/services/cockpit.fc b/policy/modules/services/cockpit.fc new file mode 100644 index 000000000..16f964c1c --- /dev/null +++ b/policy/modules/services/cockpit.fc @@ -0,0 +1,20 @@ +# cockpit stuff + +/etc/cockpit/ws-certs\.d(/.*)? gen_context(system_u:object_r:cockpit_cert_t,s0) + +/run/cockpit(/.*)? gen_context(system_u:object_r:cockpit_runtime_t,s0) +/run/cockpit/certificate-helper(/.*) gen_context(system_u:object_r:cockpit_cert_t,s0) + +/usr/lib/systemd/system/cockpit.* -- gen_context(system_u:object_r:cockpit_unit_t,s0) + +/usr/libexec/cockpit-certificate-ensure -- gen_context(system_u:object_r:cockpit_cert_manage_exec_t,s0) +/usr/libexec/cockpit-ws -- gen_context(system_u:object_r:cockpit_ws_exec_t,s0) +/usr/libexec/cockpit-tls -- gen_context(system_u:object_r:cockpit_ws_exec_t,s0) +/usr/libexec/cockpit-wsinstance-factory -- gen_context(system_u:object_r:cockpit_ws_exec_t,s0) +/usr/libexec/cockpit-session -- gen_context(system_u:object_r:cockpit_session_exec_t,s0) +/usr/libexec/cockpit-ssh -- gen_context(system_u:object_r:cockpit_session_exec_t,s0) + +/var/lib/cockpit(/.*)? gen_context(system_u:object_r:cockpit_state_t,s0) + +/var/run/cockpit(/.*)? gen_context(system_u:object_r:cockpit_runtime_t,s0) +/var/run/cockpit-ws(/.*)? gen_context(system_u:object_r:cockpit_runtime_t,s0) diff --git a/policy/modules/services/cockpit.if b/policy/modules/services/cockpit.if new file mode 100644 index 000000000..1d08ebc54 --- /dev/null +++ b/policy/modules/services/cockpit.if @@ -0,0 +1,202 @@ +## Cockpit web management system for Linux +## +## +## Cockpit is a web console that enables users to administer Linux servers +## via a web browser. +## see https://cockpit-project.org/ +## +## For linux logins that are allowed access they must be associated with a +## SELinux user that uses ssh_role_template (sysadm, system). To be able +## to alter system settings the must be allowed sudo access. +## + +######################################## +## +## Transition to the cockpit session domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`cockpit_domtrans_session',` + gen_require(` + type cockpit_session_t, cockpit_session_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, cockpit_session_exec_t, cockpit_session_t) +') + +######################################## +## +## Allow specified domain to get status of cockpit service +## +## +## +## Domain allowed access. +## +## +# +interface(`cockpit_get_service_status',` + gen_require(` + type cockpit_unit_t; + class service status; + ') + + allow $1 cockpit_unit_t:service status; +') + +######################################## +## +## Allow specified domain to enable cockpit units +## +## +## +## Domain allowed access. +## +## +# +interface(`cockpit_enabledisable',` + gen_require(` + type cockpit_unit_t; + class service { enable disable }; + ') + + cockpit_get_service_status($1) + allow $1 cockpit_unit_t:service { enable disable }; +') + +######################################## +## +## Allow specified domain to start cockpit units +## +## +## +## Domain allowed access. +## +## +# +interface(`cockpit_startstop',` + gen_require(` + type cockpit_unit_t; + class service { start stop }; + ') + + cockpit_get_service_status($1) + allow $1 cockpit_unit_t:service { start stop }; +') + +######################################## +## +## Create, read, write, and delete the cockpick runtime symlink files. +## +## +## +## Domain allowed access. +## +## +# +interface(`cockpit_manage_runtime_symlnks',` + gen_require(` + type cockpit_runtime_t; + ') + + files_search_runtime($1) + manage_lnk_files_pattern($1, cockpit_runtime_t, cockpit_runtime_t) +') + +######################################## +## +## Manage the cockpit certificate files. +## +## +## +## Domain allowed access. +## +## +# +interface(`cockpit_manage_cert_files',` + gen_require(` + type cockpit_cert_t; + ') + + manage_files_pattern($1, cockpit_cert_t, cockpit_cert_t) +') + +######################################## +## +## Read cockpit certificate files. +## +## +## +## Domain allowed access. +## +## +# +interface(`cockpit_read_cert_files',` + gen_require(` + type cockpit_cert_t; + ') + + files_search_etc($1) + list_dirs_pattern($1, cockpit_cert_t, cockpit_cert_t) + read_files_pattern($1, cockpit_cert_t, cockpit_cert_t) +') + +######################################## +## +## Delete cockpit certificate files. +## +## +## +## Domain allowed access. +## +## +# +interface(`cockpit_delete_cert_files',` + gen_require(` + type cockpit_cert_t; + type cockpit_runtime_t; + ') + + list_dirs_pattern($1, cockpit_runtime_t, cockpit_runtime_t) + delete_files_pattern($1, cockpit_runtime_t, cockpit_cert_t) +') + +######################################## +## +## All of the rules required to administrate +## an cockpit environment +## +## +## +## Domain allowed access. +## +## +## +# +interface(`cockpit_admin',` + gen_require(` + type cockpit_ws_t; + type cockpit_session_t; + type cockpit_state_t; + type cockpit_runtime_t; + type cockpit_unit_t; + ') + + allow $1 cockpit_ws_t:process { ptrace signal_perms }; + ps_process_pattern($1, cockpit_ws_t) + + allow $1 cockpit_session_t:process { ptrace signal_perms }; + ps_process_pattern($1, cockpit_session_t) + + files_search_var_lib($1) + admin_pattern($1, cockpit_state_t) + admin_pattern($1, cockpit_runtime_t) + + cockpit_enabledisable($1) + cockpit_startstop($1) + admin_pattern($1, cockpit_unit_t) +') diff --git a/policy/modules/services/cockpit.te b/policy/modules/services/cockpit.te new file mode 100644 index 000000000..ca3f12695 --- /dev/null +++ b/policy/modules/services/cockpit.te @@ -0,0 +1,262 @@ +policy_module(cockpit) + +# https://cockpit-project.org/ + +######################################## +# +# Declarations +# + +type cockpit_cert_manage_t; +type cockpit_cert_manage_exec_t; +init_daemon_domain(cockpit_cert_manage_t, cockpit_cert_manage_exec_t) + +type cockpit_cert_t; +miscfiles_cert_type(cockpit_cert_t) + +type cockpit_runtime_t; +files_runtime_file(cockpit_runtime_t) +init_daemon_runtime_file(cockpit_runtime_t, file, "active.motd") +init_daemon_runtime_file(cockpit_runtime_t, file, "iuactive.motd") +init_daemon_runtime_file(cockpit_runtime_t, lnk_file, "motd") + +optional_policy(` + systemd_tmpfilesd_managed(cockpit_runtime_t) +') + +type cockpit_state_t; +files_type(cockpit_state_t) + +type cockpit_session_t; +type cockpit_session_exec_t; +domain_type(cockpit_session_t) +domain_entry_file(cockpit_session_t,cockpit_session_exec_t) + +type cockpit_tmp_t; +files_tmp_file(cockpit_tmp_t) + +type cockpit_tmpfs_t; +userdom_user_tmpfs_file(cockpit_tmpfs_t) + +type cockpit_unit_t; +init_unit_file(cockpit_unit_t) + +type cockpit_ws_t; +type cockpit_ws_exec_t; +init_daemon_domain(cockpit_ws_t,cockpit_ws_exec_t) + +######################################## +# +# cockpit_ws_t local policy +# + +allow cockpit_ws_t self:process setrlimit; +allow cockpit_ws_t self:tcp_socket create_stream_socket_perms; +allow cockpit_ws_t self:fifo_file rw_fifo_file_perms; + +# cockpit-ws launches cockpit-session +cockpit_domtrans_session(cockpit_ws_t) +allow cockpit_ws_t cockpit_session_t:process signal_perms; + +# cockpit-tls and cockpit-ws communicate over a Unix socket +allow cockpit_ws_t self:unix_stream_socket { create_stream_socket_perms connectto }; + +allow cockpit_ws_t cockpit_cert_t:file unlink; + +kernel_read_system_state(cockpit_ws_t) + +# cockpit-tls can execute cockpit-ws +can_exec(cockpit_ws_t,cockpit_ws_exec_t) + +corecmd_exec_shell(cockpit_ws_t) + +# cockpit-ws can read from /dev/urandom +dev_read_urand(cockpit_ws_t) # for authkey +dev_read_rand(cockpit_ws_t) # for libssh + +corenet_tcp_bind_generic_node(cockpit_ws_t) +corenet_tcp_bind_websm_port(cockpit_ws_t) +corenet_sendrecv_websm_server_packets(cockpit_ws_t) + +# cockpit-ws can connect to other hosts via ssh +corenet_tcp_connect_ssh_port(cockpit_ws_t) + +# cockpit-ws can write to its temp files +manage_dirs_pattern(cockpit_ws_t, cockpit_tmp_t, cockpit_tmp_t) +manage_files_pattern(cockpit_ws_t, cockpit_tmp_t, cockpit_tmp_t) +files_tmp_filetrans(cockpit_ws_t, cockpit_tmp_t, { dir file }) + +manage_dirs_pattern(cockpit_ws_t, cockpit_tmpfs_t, cockpit_tmpfs_t) +manage_files_pattern(cockpit_ws_t, cockpit_tmpfs_t, cockpit_tmpfs_t) +fs_tmpfs_filetrans(cockpit_ws_t, cockpit_tmpfs_t, { file }) + +manage_dirs_pattern(cockpit_ws_t, cockpit_runtime_t, cockpit_runtime_t) +manage_files_pattern(cockpit_ws_t, cockpit_runtime_t, cockpit_runtime_t) +manage_lnk_files_pattern(cockpit_ws_t, cockpit_runtime_t, cockpit_runtime_t) +manage_sock_files_pattern(cockpit_ws_t, cockpit_runtime_t, cockpit_runtime_t) +files_runtime_filetrans(cockpit_ws_t, cockpit_runtime_t, { file dir sock_file }) + +manage_files_pattern(cockpit_ws_t, cockpit_state_t, cockpit_state_t) +manage_dirs_pattern(cockpit_ws_t, cockpit_state_t, cockpit_state_t) + + +cockpit_startstop(cockpit_ws_t) +cockpit_read_cert_files(cockpit_ws_t) + +files_map_usr_files(cockpit_ws_t) +files_read_usr_files(cockpit_ws_t) +kernel_recvfrom_unlabeled_peer(cockpit_ws_t) + +kernel_getattr_proc(cockpit_ws_t) +kernel_read_network_state(cockpit_ws_t) + +auth_use_nsswitch(cockpit_ws_t) + +corecmd_exec_bin(cockpit_ws_t) + +fs_read_efivarfs_files(cockpit_ws_t) + +init_read_state(cockpit_ws_t) +init_stream_connect(cockpit_ws_t) + +dbus_system_bus_client(cockpit_ws_t) + +logging_send_syslog_msg(cockpit_ws_t) + +miscfiles_read_localization(cockpit_ws_t) + +sysnet_exec_ifconfig(cockpit_ws_t) + +optional_policy(` + hostname_exec(cockpit_ws_t) +') + +optional_policy(` + kerberos_use(cockpit_ws_t) + kerberos_etc_filetrans_keytab(cockpit_ws_t, file) +') + +optional_policy(` + ssh_read_user_home_files(cockpit_ws_t) +') + +optional_policy(` + systemd_exec_systemctl(cockpit_ws_t) +') + +######################################################### +# +# cockpit-session local policy +# + +# cockpit-session changes to the actual logged in user +allow cockpit_session_t self:capability { sys_admin dac_read_search dac_override setuid setgid sys_resource}; +allow cockpit_session_t self:process { setexec setsched signal_perms setrlimit }; +allow cockpit_session_t self:fifo_file rw_inherited_fifo_file_perms; + +# cockpit-session communicates back with cockpit-ws +allow cockpit_session_t cockpit_ws_t:unix_stream_socket rw_stream_socket_perms; + +read_files_pattern(cockpit_session_t, cockpit_state_t, cockpit_state_t) +list_dirs_pattern(cockpit_session_t, cockpit_state_t, cockpit_state_t) + +manage_dirs_pattern(cockpit_session_t, cockpit_tmp_t, cockpit_tmp_t) +manage_files_pattern(cockpit_session_t, cockpit_tmp_t, cockpit_tmp_t) +manage_sock_files_pattern(cockpit_session_t, cockpit_tmp_t, cockpit_tmp_t) +files_tmp_filetrans(cockpit_session_t, cockpit_tmp_t, { dir file sock_file }) + +manage_dirs_pattern(cockpit_session_t, cockpit_tmpfs_t, cockpit_tmpfs_t) +manage_files_pattern(cockpit_session_t, cockpit_tmpfs_t, cockpit_tmpfs_t) +fs_tmpfs_filetrans(cockpit_session_t, cockpit_tmpfs_t, { file }) + +read_files_pattern(cockpit_session_t, cockpit_runtime_t, cockpit_runtime_t) +list_dirs_pattern(cockpit_session_t, cockpit_runtime_t, cockpit_runtime_t) + +# cockpit-session can execute cockpit-agent as the user +usermanage_read_crack_db(cockpit_session_t) + +corenet_tcp_bind_ssh_port(cockpit_session_t) +corenet_tcp_connect_ssh_port(cockpit_session_t) + +files_read_usr_files(cockpit_session_t) + +kernel_read_kernel_sysctls(cockpit_session_t) +kernel_read_network_state(cockpit_session_t) + +selinux_use_status_page(cockpit_session_t) + +dbus_system_bus_client(cockpit_session_t) + +# cockpit-session runs a full pam stack, including pam_selinux.so +auth_login_pgm_domain(cockpit_session_t) +# cockpit-session resseting expired passwords +auth_manage_shadow(cockpit_session_t) +auth_write_login_records(cockpit_session_t) + +init_rw_inherited_stream_socket(cockpit_session_t) +init_use_fds(cockpit_session_t) +init_named_socket_activation(cockpit_session_t, cockpit_runtime_t) + +miscfiles_read_localization(cockpit_session_t) + +# cockpit-session can execute cockpit-agent as the user +userdom_spec_domtrans_all_users(cockpit_session_t) + +optional_policy(` + systemd_dbus_chat_logind(cockpit_session_t) +') + +optional_policy(` + sssd_dbus_chat(cockpit_session_t) +') + +optional_policy(` + userdom_signal_all_users(cockpit_session_t) +') + +optional_policy(` + unconfined_domtrans(cockpit_session_t) +') + + +################################################################### +# +# cockpit-certificate-ensure policy +# + +allow cockpit_cert_manage_t self:capability { chown dac_read_search dac_override }; +allow cockpit_cert_manage_t self:fifo_file rw_inherited_fifo_file_perms; +allow cockpit_cert_manage_t self:process setfscreate; +allow cockpit_cert_manage_t self:unix_stream_socket { connect create }; + +manage_dirs_pattern(cockpit_cert_manage_t, cockpit_runtime_t, cockpit_runtime_t) +#manage_files_pattern(cockpit_cert_manage_t, cockpit_runtime_t, cockpit_runtime_t) +create_files_pattern(cockpit_cert_manage_t, cockpit_runtime_t, cockpit_runtime_t) +write_files_pattern(cockpit_cert_manage_t, cockpit_runtime_t, cockpit_runtime_t) +setattr_files_pattern(cockpit_cert_manage_t, cockpit_runtime_t, cockpit_runtime_t) +create_lnk_files_pattern(cockpit_cert_manage_t, cockpit_runtime_t, cockpit_runtime_t) + +create_dirs_pattern(cockpit_cert_manage_t, cockpit_runtime_t, cockpit_cert_t) +delete_dirs_pattern(cockpit_cert_manage_t, cockpit_runtime_t, cockpit_cert_t) +allow cockpit_cert_manage_t cockpit_cert_t:file relabel_file_perms; +filetrans_pattern(cockpit_cert_manage_t, cockpit_runtime_t, cockpit_cert_t, dir, "certificate-helper") +cockpit_manage_cert_files(cockpit_cert_manage_t) + +corecmd_exec_bin(cockpit_cert_manage_t) +corecmd_exec_shell(cockpit_cert_manage_t) + +files_read_etc_files(cockpit_cert_manage_t) +files_read_etc_runtime_files(cockpit_cert_manage_t) +files_read_usr_files(cockpit_cert_manage_t) + +fs_getattr_tmpfs(cockpit_cert_manage_t) + +kernel_read_system_state(cockpit_cert_manage_t) + +selinux_compute_create_context(cockpit_cert_manage_t) +selinux_validate_context(cockpit_cert_manage_t) + +miscfiles_read_all_certs(cockpit_cert_manage_t) +miscfiles_read_localization(cockpit_cert_manage_t) + +seutil_read_file_contexts(cockpit_cert_manage_t) diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te index e4b3ecad6..733e78ca5 100644 --- a/policy/modules/system/init.te +++ b/policy/modules/system/init.te @@ -1235,6 +1235,11 @@ optional_policy(` clamav_read_config(initrc_t) ') + +optional_policy(` + cockpit_manage_runtime_symlnks(initrc_t) +') + optional_policy(` courier_read_config(initrc_t) ')