nnd/selinux-refpolicy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
7,124 Commits 1 Branch 0 Tags 16 MiB
1c20c002cd
Commit Graph

7124 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Chris PeBenito
1c20c002cd minissdpd: Revoke kernel module loading permissions. 
This domain also calls kernel_request_load_module(), which should be
sufficent.

Signed-off-by: Chris PeBenito <chpebeni@linux.microsoft.com>
 2024-04-26 14:21:12 -04:00
Chris PeBenito
5671390e2c docker: Fix dockerc typo in container_engine_executable_file 
Signed-off-by: Chris PeBenito <chpebeni@linux.microsoft.com>
 2024-04-26 14:21:12 -04:00
Chris PeBenito
e1bc4830d6 cron: Use raw entrypoint rule for system_cronjob_t. 
By using domain_entry_file() to provide the entrypoint permission, it makes
the spool file an executable, with unexpected access.

Signed-off-by: Chris PeBenito <chpebeni@linux.microsoft.com>
 2024-04-26 14:21:12 -04:00
Chris PeBenito
0f71792c8c uml: Remove excessive access from user domains on uml_exec_t. 
The user domains were allowed to modify uml_exec_t files.

Signed-off-by: Chris PeBenito <chpebeni@linux.microsoft.com>
 2024-04-26 14:21:12 -04:00
Chris PeBenito
f889384ddf
Merge pull request #774 from ralther/machine-info 
Set the type on /etc/machine-info to net_conf_t
 2024-04-24 13:25:36 -04:00
Chris PeBenito
bea4b160bf
Merge pull request #773 from ralther/fix_MCS_CATS_comment 
Minor correction in MCS_CATS range comment
 2024-04-22 10:11:25 -04:00
Chris PeBenito
0ede5759d8
Merge pull request #769 from cgzones/systemd 
systemd: allow notify client to stat socket
 2024-04-22 09:56:00 -04:00
Rick Alther
511223e2d1 Set the type on /etc/machine-info to net_conf_t so hostnamectl can manipulate it (CRUD) 
When attempting to set the PRETTY_HOSTNAME (e.g. hostnamectl --pretty hostname "My Pretty Host") you will receive these denials in the audit log:
`node=localhost type=AVC msg=audit(1713748477.775:17769): avc: denied { create } for pid=3012 comm="systemd-hostnam" name=".#machine-infocuJGLW" scontext=system_u:system_r:systemd_hostnamed_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file permissive=1

node=localhost type=AVC msg=audit(1713748477.775:17769): avc: denied { write } for pid=3012 comm="systemd-hostnam" path="/etc/.#machine-infocuJGLW" dev="dm-1" ino=1180584 scontext=system_u:system_r:systemd_hostnamed_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file permissive=1

node=localhost type=PATH msg=audit(1713748477.775:17769): item=1 name="/etc/.#machine-infocuJGLW" inode=1180584 dev=fd:01 mode=0100600 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:etc_t:s0 nametype=CREATE cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0OUID="root" OGID="root"

node=localhost type=AVC msg=audit(1713748477.775:17770): avc: denied { setattr } for pid=3012 comm="systemd-hostnam" name=".#machine-infocuJGLW" dev="dm-1" ino=1180584 scontext=system_u:system_r:systemd_hostnamed_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file permissive=1

node=localhost type=AVC msg=audit(1713748477.776:17771): avc: denied { rename } for pid=3012 comm="systemd-hostnam" name=".#machine-infocuJGLW" dev="dm-1" ino=1180584 scontext=system_u:system_r:systemd_hostnamed_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file permissive=1

node=localhost type=PATH msg=audit(1713748477.776:17771): item=2 name="/etc/.#machine-infocuJGLW" inode=1180584 dev=fd:01 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:etc_t:s0 nametype=DELETE cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0OUID="root" OGID="root"

node=localhost type=PATH msg=audit(1713748477.776:17771): item=3 name="/etc/machine-info" inode=1180584 dev=fd:01 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:etc_t:s0 nametype=CREATE cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0OUID="root" OGID="root"

node=localhost type=PATH msg=audit(1713748497.093:17897): item=0 name="/etc/machine-info" inode=1180584 dev=fd:01 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:etc_t:s0 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0OUID="root" OGID="root`

This is on a Rocky 9 system where the default type is etc_t. Setting the type to net_conf_t allows the command to succeed without error.

Signed-off-by: Rick Alther <alther@acm.org>
 2024-04-22 09:20:11 -04:00
Rick Alther
72fc1b2a3e fix: minor correction in MCS_CATS range comment 
Signed-off-by: Rick Alther <alther@acm.org>
 2024-04-22 01:27:13 -04:00
Christian Göttsche
cbf56c8aea systemd: allow notify client to stat socket 
Caused by the latest openssh version in Debian sid:

    AVC avc:  denied  { getattr } for  pid=13544 comm="sshd" path="/run/systemd/notify" dev="tmpfs" ino=286 scontext=system_u:system_r:sshd_t:s0 tcontext=system_u:object_r:systemd_runtime_notify_t:s0 tclass=sock_file permissive=0

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
 2024-04-13 21:08:01 +02:00
Chris PeBenito
6507eebc23
Merge pull request #750 from dsugar100/selinux_dbus 
Setup domain for dbus selinux interface
 2024-04-02 08:56:15 -04:00
Chris PeBenito
77184560ba
Merge pull request #766 from dsugar100/sos_rhel9 
Update SOS report to work on RHEL9
 2024-04-02 08:55:19 -04:00
Chris PeBenito
48b4e36137
Merge pull request #767 from cgzones/misc 
Misc
 2024-04-02 08:53:27 -04:00
Christian Göttsche
0aff1990e1 quote: read localization 
AVC avc:  denied  { map } for  pid=581 comm="quotaon" path="/usr/lib/locale/locale-archive" dev="vda1" ino=392093 scontext=system_u:system_r:quota_t:s0 tcontext=unconfined_u:object_r:locale_t:s0 tclass=file permissive=0

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
 2024-03-28 20:02:47 +01:00
Christian Göttsche
ab13c04211 getty: grant checkpoint_restore 
Since Linux 6.7 checkpoint-restore functionality is guareded via the
capability CAP_CHECKPOINT_RESTORE, with a fallback to CAP_SYS_ADMIN.
Grant the new capability while keeping the old one for backwards
compatibility.

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
 2024-03-28 20:01:49 +01:00
Dave Sugar
3643773aed Update SOS report to work on RHEL9 
binary is now /usr/sbin/sos
Cleanup "invalid security context" type errors

Allow read/write user ptty
node=destination type=AVC msg=audit(1709914012.455:7495): avc: denied  { read write } for  pid=2214 comm="sos" path="/dev/pts/0" dev="devpts" ino=3 scontext=admin_u:staff_r:sosreport_t:s0 tcontext=admin_u:object_r:user_devpts_t:s0 tclass=chr_file permissive=1
node=destination type=AVC msg=audit(1709914012.527:7512): avc: denied  { ioctl } for  pid=2214 comm="sos" path="/dev/pts/0" dev="devpts" ino=3 ioctlcmd=0x5401 scontext=admin_u:staff_r:sosreport_t:s0 tcontext=admin_u:object_r:user_devpts_t:s0 tclass=chr_file permissive=1

node=destination type=AVC msg=audit(1709928066.892:80267): avc:  denied  { create } for  pid=3998 comm="mkfifo" name="systemd-cat" scontext=admin_u:staff_r:sosreport_t:s0 tcontext=admin_u:object_r:sosreport_tmp_t:s0 tclass=fifo_file permissive=1
node=destination type=AVC msg=audit(1709928066.893:80269): avc:  denied  { write } for  pid=3968 comm="dracut" name="systemd-cat" dev="dm-3" ino=24 scontext=admin_u:staff_r:sosreport_t:s0 tcontext=admin_u:object_r:sosreport_tmp_t:s0 tclass=fifo_file permissive=1
node=destination type=AVC msg=audit(1709928066.893:80269): avc:  denied  { open } for  pid=3968 comm="dracut" path="/var/tmp/dracut.GUBZQZ/systemd-cat" dev="dm-3" ino=24 scontext=admin_u:staff_r:sosreport_t:s0 tcontext=admin_u:object_r:sosreport_tmp_t:s0 tclass=fifo_file permissive=1
node=destination type=AVC msg=audit(1709928066.893:80281): avc:  denied  { read } for  pid=3999 comm="dracut" name="systemd-cat" dev="dm-3" ino=24 scontext=admin_u:staff_r:sosreport_t:s0 tcontext=admin_u:object_r:sosreport_tmp_t:s0 tclass=fifo_file permissive=1
node=destination type=AVC msg=audit(1709928068.848:94243): avc:  denied  { unlink } for  pid=4049 comm="rm" name="systemd-cat" dev="dm-3" ino=24 scontext=admin_u:staff_r:sosreport_t:s0 tcontext=admin_u:object_r:sosreport_tmp_t:s0 tclass=fifo_file permissive=1
node=destination type=AVC msg=audit(1709928080.775:126505): avc:  denied  { create } for  pid=2229 comm="sos" name="lvmpolld.socket" scontext=admin_u:staff_r:sosreport_t:s0 tcontext=admin_u:object_r:sosreport_tmp_t:s0 tclass=sock_file permissive=1
node=destination type=AVC msg=audit(1709928080.775:126510): avc:  denied  { setattr } for pid=2229 comm="sos" name="lvmpolld.socket" dev="dm-3" ino=138652 scontext=admin_u:staff_r:sosreport_t:s0 tcontext=admin_u:object_r:sosreport_tmp_t:s0 tclass=sock_file permissive=1

Allow sosreport to read SELinux booleans

node=destination type=AVC msg=audit(1709931730.500:181982): avc:  denied  { read } for  pid=6578 comm="sestatus" name="aide_mmap_files" dev="selinuxfs" ino=33554432 scontext=admin_u:staff_r:sosreport_t:s0 tcontext=system_u:object_r:boolean_t:s0 tclass=file permissive=1
node=destination type=AVC msg=audit(1709931730.500:181982): avc:  denied  { open } for  pid=6578 comm="sestatus" path="/sys/fs/selinux/booleans/aide_mmap_files" dev="selinuxfs" ino=33554432 scontext=admin_u:staff_r:sosreport_t:s0 tcontext=system_u:object_r:boolean_t:s0 tclass=file permissive=1

Allow sosreport dbus send_msg

node=destination type=USER_AVC msg=audit(1709931682.344:10950): pid=1194 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0 msg='avc:  denied  { send_msg } for  scontext=admin_u:staff_r:sosreport_t:s0 tcontext=system_u:system_r:NetworkManager_t:s0 tclass=dbus permissive=1 exe="/usr/bin/dbus-broker" sauid=81 hostname=? addr=?  terminal=?'UID="dbus" AUID="unset" SAUID="dbus"
node=destination type=USER_AVC msg=audit(1709931707.581:103764): pid=1194 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0 msg='avc:  denied  { send_msg } for  scontext=admin_u:staff_r:sosreport_t:s0 tcontext=system_u:system_r:firewalld_t:s0 tclass=dbus permissive=1 exe="/usr/bin/dbus-broker" sauid=81 hostname=? addr=?  terminal=?'UID="dbus" AUID="unset" SAUID="dbus"
node=destination type=USER_AVC msg=audit(1709931711.203:109364): pid=1194 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0 msg='avc:  denied  { send_msg } for  scontext=admin_u:staff_r:sosreport_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=dbus permissive=1 exe="/usr/bin/dbus-broker
node=destination type=USER_AVC msg=audit(1709931713.737:118226): pid=1194 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0 msg='avc:  denied  { send_msg } for  scontext=admin_u:staff_r:sosreport_t:s0 tcontext=system_u:system_r:systemd_hostnamed_t:s0 tclass=dbus permissive=1 exe="/usr/bin/dbus-broker" sauid=81 hostname=? addr=?  terminal=?'UID="dbus" AUID="unset" SAUID="dbus"
node=destination type=USER_AVC msg=audit(1709931741.992:218433): pid=1194 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0 msg='avc:  denied  { send_msg } for  scontext=admin_u:staff_r:sosreport_t:s0 tcontext=system_u:system_r:systemd_logind_t:s0 tclass=dbus permissive=1 exe="/usr/bin/dbus-broker" sauid=81 hostname=? addr=?  terminal=?'UID="dbus" AUID="unset" SAUID="dbus"
node=destination type=USER_AVC msg=audit(1709931735.870:210757): pid=1194 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0 msg='avc: denied  { send_msg } for  scontext=admin_u:staff_r:sosreport_t:s0 tcontext=system_u:system_r:devicekit_disk_t:s0 tclass=dbus permissive=1 exe="/usr/bin/dbus-broker" sauid=81 hostname=? addr=?  terminal=?'UID="dbus" AUID="unset" SAUID="dbus"
node=destination type=USER_AVC msg=audit(1709931742.051:218502): pid=1194 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0 msg='avc:  denied  { send_msg } for  scontext=admin_u:staff_r:sosreport_t:s0 tcontext=system_u:system_r:ntpd_t:s0 tclass=dbus permissive=1 exe="/usr/bin/dbus-broker" sauid=81 hostname=? addr=?  terminal=?'UID="dbus" AUID="unset" SAUID="dbus"

Allow sosreport to get status of all units

node=destination type=USER_AVC msg=audit(1709951886.954:202544): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc:  denied  { status } for auid=n/a uid=0 gid=0 path="/usr/lib/systemd/system/dm-event.socket" cmdline="" function="mac_selinux_filter" scontext=admin_u:staff_r:sosreport_t:s0 tcontext=system_u:object_r:lvm_unit_t:s0 tclass=service permissive=1 exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=?  terminal=?'UID="root" AUID="unset" AUID="root" UID="root" GID="root" SAUID="root"
node=destination type=USER_AVC msg=audit(1709951886.994:202604): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc:  denied  { status } for auid=n/a uid=0 gid=0 path="/usr/lib/systemd/system/dnf-makecache.timer" cmdline="" function="mac_selinux_filter" scontext=admin_u:staff_r:sosreport_t:s0 tcontext=system_u:object_r:rpm_unit_t:s0 tclass=service permissive=1 exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=?  terminal=?'UID="root" AUID="unset" AUID="root" UID="root" GID="root" SAUID="root"
node=destination type=USER_AVC msg=audit(1709951860.321:103971): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc:  denied  { status } for auid=n/a uid=0 gid=0 path="/usr/lib/systemd/system/fwupd.service" cmdline="" function="mac_selinux_filter" scontext=admin_u:staff_r:sosreport_t:s0 tcontext=system_u:object_r:systemd_unit_t:s0 tclass=service permissive=1 exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=?  terminal=?'UID="root" AUID="unset" AUID="root" UID="root" GID="root" SAUID="root"
node=destination type=USER_AVC msg=audit(1709951889.117:209277): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc:  denied  { status } for auid=n/a uid=0 gid=0 path="/usr/lib/systemd/system/systemd-rfkill.service" cmdline="" function="mac_selinux_filter" scontext=admin_u:staff_r:sosreport_t:s0 tcontext=system_u:object_r:systemd_rfkill_unit_t:s0 tclass=service permissive=1 exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=?  terminal=?'UID="root" AUID="unset" AUID="root" UID="root" GID="root" SAUID="root"

Allow sosreport to map some files

node=destination type=AVC msg=audit(1709951889.013:209184): avc: denied  { map } for  pid=6932 comm="lsusb" path="/etc/udev/hwdb.bin" dev="dm-0" ino=1180591 scontext=admin_u:staff_r:sosreport_t:s0 tcontext=system_u:object_r:systemd_hwdb_t:s0 tclass=file permissive=1
node=destination type=AVC msg=audit(1709951850.662:58892): avc: denied  { map } for  pid=3814 comm="journalctl" path="/var/log/journal/4fa8dbda531a499cb4bdf065a9b23471/user-1000@db7a3287b7234e07b839915b69371deb-000000000000110a-0006133115ceaa6d.journal" dev="dm-6" ino=262149 scontext=admin_u:staff_r:sosreport_t:s0 tcontext=system_u:object_r:systemd_journal_t:s0 tclass=file permissive=1

Access SELinux stuff

node=destination type=AVC msg=audit(1709951851.398:60712): avc: denied  { compute_av } for  pid=3902 comm="crontab" scontext=admin_u:staff_r:sosreport_t:s0 tcontext=system_u:object_r:security_t:s0 tclass=security permissive=1
node=destination type=AVC msg=audit(1709951864.926:110932): avc:  denied  { map } for  pid=5345 comm="udevadm" path="/sys/fs/selinux/status" dev="selinuxfs" ino=19 scontext=admin_u:staff_r:sosreport_t:s0 tcontext=system_u:object_r:security_t:s0 tclass=file permissive=1
node=destination type=AVC msg=audit(1709951883.687:182874): avc: denied  { check_context } for  pid=6675 comm="selinuxdefcon" scontext=admin_u:staff_r:sosreport_t:s0 tcontext=system_u:object_r:security_t:s0 tclass=security permissive=1
node=destination type=AVC msg=audit(1709951883.763:183087): avc:  denied  { compute_create } for pid=6696 comm="selinuxexeccon" scontext=admin_u:staff_r:sosreport_t:s0 tcontext=system_u:object_r:security_t:s0 tclass=security permissive=1
node=destination type=AVC msg=audit(1709951883.946:183609): avc:  denied  { map } for  pid=6715 comm="udevadm" path="/sys/fs/selinux/status" dev="selinuxfs" ino=19 scontext=admin_u:staff_r:sosreport_t:s0 tcontext=system_u:object_r:security_t:s0 tclass=file permissive=1
node=destination type=AVC msg=audit(1709951884.669:188960): avc:  denied  { read_policy } for pid=6703 comm="semanage" scontext=admin_u:staff_r:sosreport_t:s0 tcontext=system_u:object_r:security_t:s0 tclass=security permissive=1

Signed-off-by: Dave Sugar <dsugar100@gmail.com>
 2024-03-09 17:23:47 -05:00
Chris PeBenito
fa84ee8fc0 Update Changelog and VERSION for release 2.20240226. 
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
 2024-02-26 13:38:45 -05:00
Chris PeBenito
d48b57a5bd
Merge pull request #763 from cgzones/dnl_space 
libraries: drop space in empty line
 2024-02-23 13:18:44 -05:00
Chris PeBenito
806f3e31e1
Merge pull request #759 from cgzones/deb 
Minimal Debian system updates
 2024-02-23 13:17:40 -05:00
Christian Göttsche
8f9be7c635 libraries: drop space in empty line 
Drop a line containing a single space from the file context file to
avoid SELint stumble on it:

    libraries.mod.fc:   130: (E): Bad file context format (E-002)

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
 2024-02-23 18:04:11 +01:00
Christian Göttsche
b8ad74030f consolesetup: update 
AVC avc:  denied  { read } for  pid=770 comm="mkdir" name="filesystems" dev="proc" ino=4026532069 scontext=system_u:system_r:consolesetup_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file permissive=0

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
 2024-02-23 17:55:29 +01:00
Christian Göttsche
859f90be12 systemd: logind update 
type=PROCTITLE msg=audit(21/02/24 23:31:52.659:83) : proctitle=/usr/lib/systemd/systemd-logind
    type=SYSCALL msg=audit(21/02/24 23:31:52.659:83) : arch=x86_64 syscall=recvmsg success=yes exit=24 a0=0xf a1=0x7ffdec4e7bc0 a2=MSG_DONTWAIT|MSG_CMSG_CLOEXEC a3=0x0 items=0 ppid=1 pid=909 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=systemd-logind exe=/usr/lib/systemd/systemd-logind subj=system_u:system_r:systemd_logind_t:s0 key=(null)
    type=AVC msg=audit(21/02/24 23:31:52.659:83) : avc:  denied  { use } for  pid=909 comm=systemd-logind path=anon_inode:[pidfd] dev="anon_inodefs" ino=1051 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:system_r:system_dbusd_t:s0 tclass=fd permissive=1

p.s.: this might need an overhaul after pidfd handling in the kernel has
been improved.

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
 2024-02-23 17:55:29 +01:00
Christian Göttsche
06927582c8 udev: update 
AVC avc:  denied  { create } for  pid=685 comm="ifquery" name="network" scontext=system_u:system_r:udev_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=dir permissive=1

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
 2024-02-23 17:55:29 +01:00
Christian Göttsche
395f5cb588 systemd: generator updates 
type=1400 audit(1708552475.580:3): avc:  denied  { getattr } for  pid=528 comm="systemd-sysv-ge" path="/etc/init.d/auditd" dev="vda1" ino=262124 scontext=system_u:system_r:systemd_generator_t:s0 tcontext=system_u:object_r:auditd_initrc_exec_t:s0 tclass=file permissive=1
    type=1400 audit(1708552475.580:4): avc:  denied  { getattr } for  pid=528 comm="systemd-sysv-ge" path="/usr/lib/systemd/system/auditd.service" dev="vda1" ino=395421 scontext=system_u:system_r:systemd_generator_t:s0 tcontext=system_u:object_r:auditd_unit_t:s0 tclass=file permissive=1
    type=1400 audit(1708552475.580:5): avc:  denied  { getattr } for  pid=528 comm="systemd-sysv-ge" path="/etc/init.d/vnstat" dev="vda1" ino=261247 scontext=system_u:system_r:systemd_generator_t:s0 tcontext=system_u:object_r:vnstatd_initrc_exec_t:s0 tclass=file permissive=1
    type=1400 audit(1708552475.580:6): avc:  denied  { getattr } for  pid=528 comm="systemd-sysv-ge" path="/usr/lib/systemd/system/vnstat.service" dev="vda1" ino=394196 scontext=system_u:system_r:systemd_generator_t:s0 tcontext=system_u:object_r:vnstatd_unit_t:s0 tclass=file permissive=1
    type=1400 audit(1708552475.580:7): avc:  denied  { getattr } for  pid=528 comm="systemd-sysv-ge" path="/usr/lib/systemd/system/dbus-broker.service" dev="vda1" ino=394383 scontext=system_u:system_r:systemd_generator_t:s0 tcontext=system_u:object_r:dbusd_unit_t:s0 tclass=file permissive=1
    type=1400 audit(1708552475.584:8): avc:  denied  { getattr } for  pid=528 comm="systemd-sysv-ge" path="/usr/lib/systemd/system/qemu-guest-agent.service" dev="vda1" ino=392981 scontext=system_u:system_r:systemd_generator_t:s0 tcontext=system_u:object_r:qemu_unit_t:s0 tclass=file permissive=1
    type=1400 audit(1708552475.584:9): avc:  denied  { getattr } for  pid=528 comm="systemd-sysv-ge" path="/usr/lib/systemd/system/ssh.service" dev="vda1" ino=393521 scontext=system_u:system_r:systemd_generator_t:s0 tcontext=system_u:object_r:sshd_unit_t:s0 tclass=file permissive=1

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
 2024-02-23 17:55:29 +01:00
Christian Göttsche
206bdcb6d3 fs: add support for virtiofs 
Adopted from 5580e9a576

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
 2024-02-23 17:55:29 +01:00
Christian Göttsche
1816085864 vnstatd: update 
type=PROCTITLE msg=audit(21/02/24 22:54:36.792:69) : proctitle=/usr/sbin/vnstatd -n
    type=PATH msg=audit(21/02/24 22:54:36.792:69) : item=0 name=/dev/urandom inode=18 dev=00:2b mode=character,666 ouid=root ogid=root rdev=01:09 obj=system_u:object_r:urandom_device_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
    type=CWD msg=audit(21/02/24 22:54:36.792:69) : cwd=/
    type=SYSCALL msg=audit(21/02/24 22:54:36.792:69) : arch=x86_64 syscall=openat success=yes exit=5 a0=AT_FDCWD a1=0x7f197cc66865 a2=O_RDONLY|O_CLOEXEC a3=0x0 items=1 ppid=1 pid=900 auid=unset uid=vnstat gid=vnstat euid=vnstat suid=vnstat fsuid=vnstat egid=vnstat sgid=vnstat fsgid=vnstat tty=(none) ses=unset comm=vnstatd exe=/usr/sbin/vnstatd subj=system_u:system_r:vnstatd_t:s0 key=(null)
    type=AVC msg=audit(21/02/24 22:54:36.792:69) : avc:  denied  { open } for  pid=900 comm=vnstatd path=/dev/urandom dev=tmpfs ino=18 scontext=system_u:system_r:vnstatd_t:s0 tcontext=system_u:object_r:urandom_device_t:s0 tclass=chr_file permissive=1
    type=AVC msg=audit(21/02/24 22:54:36.792:69) : avc:  denied  { read } for  pid=900 comm=vnstatd name=urandom dev=tmpfs ino=18 scontext=system_u:system_r:vnstatd_t:s0 tcontext=system_u:object_r:urandom_device_t:s0 tclass=chr_file permissive=1

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
 2024-02-23 17:55:29 +01:00
Christian Göttsche
fa7004426f systemd: binfmt updates 
type=PROCTITLE msg=audit(21/02/24 22:54:36.708:53) : proctitle=/usr/lib/systemd/systemd-binfmt
    type=SYSCALL msg=audit(21/02/24 22:54:36.708:53) : arch=x86_64 syscall=fstatfs success=yes exit=0 a0=0x5 a1=0x7ffc547fbda0 a2=0x0 a3=0x0 items=0 ppid=1 pid=694 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=systemd-binfmt exe=/usr/lib/systemd/systemd-binfmt subj=system_u:system_r:systemd_binfmt_t:s0 key=(null)
    type=AVC msg=audit(21/02/24 22:54:36.708:53) : avc:  denied  { getattr } for  pid=694 comm=systemd-binfmt name=/ dev=binfmt_misc ino=1 scontext=system_u:system_r:systemd_binfmt_t:s0 tcontext=system_u:object_r:binfmt_misc_fs_t:s0 tclass=filesystem permissive=1

    type=PROCTITLE msg=audit(21/02/24 22:54:36.708:54) : proctitle=/usr/lib/systemd/systemd-binfmt
    type=PATH msg=audit(21/02/24 22:54:36.708:54) : item=0 name=/proc/self/fd/4 inode=1 dev=00:27 mode=dir,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:binfmt_misc_fs_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
    type=CWD msg=audit(21/02/24 22:54:36.708:54) : cwd=/
    type=SYSCALL msg=audit(21/02/24 22:54:36.708:54) : arch=x86_64 syscall=access success=yes exit=0 a0=0x7ffc547fbdf0 a1=W_OK a2=0x0 a3=0x0 items=1 ppid=1 pid=694 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=systemd-binfmt exe=/usr/lib/systemd/systemd-binfmt subj=system_u:system_r:systemd_binfmt_t:s0 key=(null)
    type=AVC msg=audit(21/02/24 22:54:36.708:54) : avc:  denied  { write } for  pid=694 comm=systemd-binfmt name=/ dev=binfmt_misc ino=1 scontext=system_u:system_r:systemd_binfmt_t:s0 tcontext=system_u:object_r:binfmt_misc_fs_t:s0 tclass=dir permissive=1

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
 2024-02-23 17:55:29 +01:00
Christian Göttsche
6992e200ac fs: mark memory pressure type as file 
Associate the type memory_pressure_t with the attribute file_type, so
all attribute based rules apply, e.g. for unconfined_t.

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
 2024-02-23 17:55:29 +01:00
Christian Göttsche
088bf3ab5d userdom: permit reading PSI as admin 
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
 2024-02-23 17:55:29 +01:00
Christian Göttsche
7879c6a0db selinuxutil: ignore getattr proc in newrole 
type=PROCTITLE msg=audit(02/21/24 22:42:44.555:112) : proctitle=newrole -r sysadm_r
    type=SYSCALL msg=audit(02/21/24 22:42:44.555:112) : arch=x86_64 syscall=fstatfs success=yes exit=0 a0=0x3 a1=0x7ffc75fe1990 a2=0x0 a3=0x0 items=0 ppid=946 pid=1001 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 ses=1 comm=newrole exe=/usr/bin/newrole subj=root:staff_r:newrole_t:s0-s0:c0.c1023 key=(null)
    type=AVC msg=audit(02/21/24 22:42:44.555:112) : avc:  denied  { getattr } for  pid=1001 comm=newrole name=/ dev=proc ino=1 scontext=root:staff_r:newrole_t:s0-s0:c0.c1023 tcontext=system_u:object_r:proc_t:s0 tclass=filesystem permissive=1

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
 2024-02-23 17:55:29 +01:00
Christian Göttsche
ef0f55827d selinuxutil: setfiles updates 
type=PROCTITLE msg=audit(21/02/24 22:31:50.044:122) : proctitle=restorecon -vRn -T0 /
    type=SYSCALL msg=audit(21/02/24 22:31:50.044:122) : arch=x86_64 syscall=sched_getaffinity success=yes exit=8 a0=0x0 a1=0x1000 a2=0x7fc235649bf0 a3=0x0 items=0 ppid=1103 pid=13398 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts1 ses=1 comm=restorecon exe=/usr/sbin/setfiles subj=unconfined_u:unconfined_r:setfiles_t:s0-s0:c0.c1023 key=(null)
    type=AVC msg=audit(21/02/24 22:31:50.044:122) : avc:  denied  { getsched } for  pid=13398 comm=restorecon scontext=unconfined_u:unconfined_r:setfiles_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:setfiles_t:s0-s0:c0.c1023 tclass=process permissive=1

    type=PROCTITLE msg=audit(21/02/24 22:31:55.040:123) : proctitle=restorecon -vRn -T0 /
    type=PATH msg=audit(21/02/24 22:31:55.040:123) : item=0 name=/sys/fs/cgroup/user.slice/user-0.slice/user@0.service/memory.pressure inode=2455 dev=00:1b mode=file,644 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:memory_pressure_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
    type=CWD msg=audit(21/02/24 22:31:55.040:123) : cwd=/root/workspace/selinux/refpolicy/refpolicy
    type=SYSCALL msg=audit(21/02/24 22:31:55.040:123) : arch=x86_64 syscall=newfstatat success=yes exit=0 a0=AT_FDCWD a1=0x557264466530 a2=0x7fc2004cacc0 a3=0x100 items=1 ppid=1103 pid=13398 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts1 ses=1 comm=restorecon exe=/usr/sbin/setfiles subj=unconfined_u:unconfined_r:setfiles_t:s0-s0:c0.c1023 key=(null)
    type=AVC msg=audit(21/02/24 22:31:55.040:123) : avc:  denied  { getattr } for  pid=13398 comm=restorecon path=/sys/fs/cgroup/user.slice/user-0.slice/user@0.service/memory.pressure dev="cgroup2" ino=2455 scontext=unconfined_u:unconfined_r:setfiles_t:s0-s0:c0.c1023 tcontext=system_u:object_r:memory_pressure_t:s0 tclass=file permissive=1

    type=PROCTITLE msg=audit(21/02/24 22:32:15.512:126) : proctitle=restorecon -vRFn -T0 /usr/
    type=PATH msg=audit(21/02/24 22:32:15.512:126) : item=0 name=/proc/sys/vm/overcommit_memory inode=41106 dev=00:16 mode=file,644 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:sysctl_vm_overcommit_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
    type=CWD msg=audit(21/02/24 22:32:15.512:126) : cwd=/root/workspace/selinux/refpolicy/refpolicy
    type=SYSCALL msg=audit(21/02/24 22:32:15.512:126) : arch=x86_64 syscall=openat success=yes exit=3 a0=AT_FDCWD a1=0x7f59f7316810 a2=O_RDONLY|O_CLOEXEC a3=0x0 items=1 ppid=1103 pid=13491 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts1 ses=1 comm=restorecon exe=/usr/sbin/setfiles subj=unconfined_u:unconfined_r:setfiles_t:s0-s0:c0.c1023 key=(null)
    type=AVC msg=audit(21/02/24 22:32:15.512:126) : avc:  denied  { open } for  pid=13491 comm=restorecon path=/proc/sys/vm/overcommit_memory dev="proc" ino=41106 scontext=unconfined_u:unconfined_r:setfiles_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sysctl_vm_overcommit_t:s0 tclass=file permissive=1
    type=AVC msg=audit(21/02/24 22:32:15.512:126) : avc:  denied  { read } for  pid=13491 comm=restorecon name=overcommit_memory dev="proc" ino=41106 scontext=unconfined_u:unconfined_r:setfiles_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sysctl_vm_overcommit_t:s0 tclass=file permissive=1

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
 2024-02-23 17:16:44 +01:00
Christian Göttsche
441d71d7ae virt: label qemu configuration directory 
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
 2024-02-23 17:16:44 +01:00
Chris PeBenito
0f77ba352d
Merge pull request #757 from pebenito/misc-fixes 
Misc fixes
 2024-02-23 09:49:56 -05:00
Chris PeBenito
9be10bc695
Merge pull request #758 from cgzones/dev 
Misc build system and tooling updates
 2024-02-22 14:42:51 -05:00
Christian Göttsche
f9595d30ff Makefile: set PYTHONPATH for test toolchain 
In case of a non-default toolchain also set the environment variable
PTYHONPATH to run sepolgen related python code from that toolchain.
See scripts/env_use_destdir in the SELinux userland repository.

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
 2024-02-22 20:21:35 +01:00
Christian Göttsche
426cbc3dac Makefile: use sepolgen-ifgen-attr-helper from test toolchain 
When building with a non default toolchain by setting the environment
variable TEST_TOOLCHAIN also use the sepolgen-ifgen helper binary
sepolgen-ifgen-attr-helper from this toolchain.

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
 2024-02-22 17:41:37 +01:00
Christian Göttsche
82eca136e6 Rules.modular: use temporary file to not ignore error 
Save the result of the m4 command into a temporary file and split the
commands, to avoid ignoring failures of the first command.

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
 2024-02-22 17:41:37 +01:00
Christian Göttsche
752ebc167b Rules.monolithic: pre-compile fcontexts on install 
On install pre-compile the file contexts.

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
 2024-02-22 17:41:37 +01:00
Christian Göttsche
d008f97a4d policy_capabilities: remove estimated from released versions 
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
 2024-02-22 17:28:11 +01:00
Christian Göttsche
ec28725235 Support multi-line interface calls 
Support splitting the call of an interface over multiple lines, e.g. for
interfaces with a long list as argument:

    term_control_unallocated_ttys(udev_t, {
	    ioctl_kdgkbtype
	    ioctl_kdgetmode
	    ioctl_pio_unimap
	    ioctl_pio_unimapclr
	    ioctl_kdfontop
	    ioctl_tcgets
    })

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
 2024-02-22 17:27:36 +01:00
Christian Göttsche
bdd5036d7a fix misc typos 
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
 2024-02-22 17:24:25 +01:00
Christian Göttsche
c781fb74c9 support/genhomedircon: support usr prefixed paths 
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
 2024-02-22 17:12:56 +01:00
Christian Göttsche
b215f46531 access_vectors: define io_uring { cmd } 
Added in Linux 6.0.

Link: f4d653dcaa
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
 2024-02-22 17:12:36 +01:00
Chris PeBenito
0c41682fc4 cloudinit: Add permissions derived from sysadm. 
Allow a similar amount of admin capability to cloud-init as sysadm.  Also add
a tunable to allow non-security file management for fallback.

Signed-off-by: Chris PeBenito <Christopher.PeBenito@microsoft.com>
 2024-02-22 09:13:38 -05:00
Chris PeBenito
65dfbda501 systemd: Updates for systemd-locale. 
Signed-off-by: Chris PeBenito <Christopher.PeBenito@microsoft.com>
 2024-02-21 16:45:39 -05:00
Chris PeBenito
34afd8343c cloud-init: Change udev rules 
Signed-off-by: Chris PeBenito <Christopher.PeBenito@microsoft.com>
 2024-02-21 16:45:39 -05:00
Chris PeBenito
758f819529 cloud-init: Add systemd permissions. 
Additional access for controlling systemd units and logind dbus chat.

Signed-off-by: Chris PeBenito <Christopher.PeBenito@microsoft.com>
 2024-02-21 16:45:39 -05:00
Chris PeBenito
7213dcf3a7 cloud-init: Allow use of sudo in runcmd. 
Signed-off-by: Chris PeBenito <Christopher.PeBenito@microsoft.com>
 2024-02-21 16:45:39 -05:00
Chris PeBenito
2e981f1790 chronyd: Read /dev/urandom. 
Signed-off-by: Chris PeBenito <Christopher.PeBenito@microsoft.com>
 2024-02-21 16:45:39 -05:00
Chris PeBenito
2e3cb74315 unconfined: Add remaining watch_* permissions. 
Signed-off-by: Chris PeBenito <Christopher.PeBenito@microsoft.com>
 2024-02-21 16:45:39 -05:00