From bf34d3e5e8be4f7618f4755c99c3927a1b14aec3 Mon Sep 17 00:00:00 2001 From: Yi Zhao Date: Tue, 28 May 2024 13:17:42 +0800 Subject: [PATCH 1/2] sysnetwork: fixes for dhcpcd Allow dhcpcd to create netlink socket and read files under /run/udev/. Fixes: avc: denied { search } for pid=393 comm="dhcpcd" name="udev" dev="tmpfs" ino=49 scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tcontext=system_u:object_r:udev_runtime_t:s0 tclass=dir permissive=1 avc: denied { create } for pid=393 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tclass=netlink_kobject_uevent_socket permissive=1 avc: denied { getopt } for pid=393 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tclass=netlink_kobject_uevent_socket permissive=1 avc: denied { setopt } for pid=393 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tclass=netlink_kobject_uevent_socket permissive=1 avc: denied { bind } for pid=393 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tclass=netlink_kobject_uevent_socket permissive=1 avc: denied { getattr } for pid=393 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tclass=netlink_kobject_uevent_socket permissive=1 avc: denied { read } for pid=393 comm="dhcpcd" name="n1" dev="tmpfs" ino=222 scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tcontext=system_u:object_r:udev_runtime_t:s0 tclass=file permissive=1 avc: denied { open } for pid=393 comm="dhcpcd" path="/run/udev/data/n1" dev="tmpfs" ino=222 scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tcontext=system_u:object_r:udev_runtime_t:s0 tclass=file permissive=1 avc: denied { getattr } for pid=393 comm="dhcpcd" path="/run/udev/data/n1" dev="tmpfs" ino=222 scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tcontext=system_u:object_r:udev_runtime_t:s0 tclass=file permissive=1 Signed-off-by: Yi Zhao --- policy/modules/system/sysnetwork.te | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/policy/modules/system/sysnetwork.te b/policy/modules/system/sysnetwork.te index 6af242108..b5607a2da 100644 --- a/policy/modules/system/sysnetwork.te +++ b/policy/modules/system/sysnetwork.te @@ -73,6 +73,7 @@ allow dhcpc_t self:tcp_socket create_stream_socket_perms; allow dhcpc_t self:udp_socket create_socket_perms; allow dhcpc_t self:packet_socket create_socket_perms; allow dhcpc_t self:netlink_generic_socket create_socket_perms; +allow dhcpc_t self:netlink_kobject_uevent_socket create_socket_perms; allow dhcpc_t self:netlink_route_socket create_netlink_socket_perms; allow dhcpc_t self:rawip_socket create_socket_perms; allow dhcpc_t self:unix_dgram_socket { create_socket_perms sendto }; @@ -266,6 +267,10 @@ optional_policy(` seutil_dontaudit_search_config(dhcpc_t) ') +optional_policy(` + udev_read_runtime_files(dhcpc_t) +') + optional_policy(` userdom_use_all_users_fds(dhcpc_t) ') From 10feb47e55b52c88248f003450051cafe41c921d Mon Sep 17 00:00:00 2001 From: Yi Zhao Date: Tue, 28 May 2024 15:06:06 +0800 Subject: [PATCH 2/2] newrole: allow newrole to search faillock runtime directory Allow newrole to search the /run/faillock directory, otherwise the faillock mechanism will not work for neworle. Before the patch (pam faillock deny=3): root@intel-x86-64:~# newrole -r sysadm_r Password: newrole: incorrect password for root root@intel-x86-64:~# newrole -r sysadm_r Password: newrole: incorrect password for root root@intel-x86-64:~# newrole -r sysadm_r Password: newrole: incorrect password for root root@intel-x86-64:~# newrole -r sysadm_r Password: newrole: incorrect password for root After the patch (pam faillock deny=3): root@intel-x86-64:~# newrole -r sysadm_r Password: newrole: incorrect password for root root@intel-x86-64:~# newrole -r sysadm_r Password: newrole: incorrect password for root root@intel-x86-64:~# newrole -r sysadm_r Password: newrole: incorrect password for root root@intel-x86-64:~# newrole -r sysadm_r The account is locked due to 3 failed logins. (1 minute left to unlock) Password: Fixes: avc: denied { search } for pid=508 comm="newrole" name="faillock" dev="tmpfs" ino=582 scontext=root:sysadm_r:newrole_t:s0-s15:c0.c1023 tcontext=system_u:object_r:faillog_t:s0 tclass=dir permissive=0 Signed-off-by: Yi Zhao --- policy/modules/system/authlogin.if | 18 ++++++++++++++++++ policy/modules/system/selinuxutil.te | 1 + 2 files changed, 19 insertions(+) diff --git a/policy/modules/system/authlogin.if b/policy/modules/system/authlogin.if index 899171aa2..62e0e0585 100644 --- a/policy/modules/system/authlogin.if +++ b/policy/modules/system/authlogin.if @@ -845,6 +845,24 @@ interface(`auth_rw_shadow_lock',` rw_files_pattern($1, shadow_lock_t, shadow_lock_t) ') +######################################## +## +## Search faillock directory (/run/faillock). +## +## +## +## Domain allowed access. +## +## +# +interface(`auth_search_faillog',` + gen_require(` + type faillog_t; + ') + + allow $1 faillog_t:dir search_dir_perms; +') + ####################################### ## ## Append to the login failure log. diff --git a/policy/modules/system/selinuxutil.te b/policy/modules/system/selinuxutil.te index fb4dddc29..ebc1abc10 100644 --- a/policy/modules/system/selinuxutil.te +++ b/policy/modules/system/selinuxutil.te @@ -294,6 +294,7 @@ auth_use_nsswitch(newrole_t) auth_run_chk_passwd(newrole_t, newrole_roles) auth_run_upd_passwd(newrole_t, newrole_roles) auth_rw_faillog(newrole_t) +auth_search_faillog(newrole_t) # Write to utmp. init_rw_utmp(newrole_t)