Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

init.te: Allow access to search initrc_state_t. #4

Open
wants to merge 8 commits into
base: next
Choose a base branch
from
Open

init.te: Allow access to search initrc_state_t. #4

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
527ef94
userdomain: Add watch on home dirs
perfinion Feb 16, 2020
3a6fbfc
portage: Added /var/cache/distfiles path.
jpds Oct 21, 2020
d54dff6
init: Added fcontext for openrc-init.
jpds Oct 25, 2020
7e3ee88
init: Added fcontext for openrc-shutdown.
jpds Oct 25, 2020
e433682
getty: allow watching file /run/agetty.reload
perfinion Nov 16, 2020
99961cf
systemd: make remaining dbus_* optional
perfinion Nov 16, 2020
d0b761a
Add transition on gentoo init_t to openrc
perfinion Oct 19, 2020
9f492bc
init.te: Allow access to search initrc_state_t.
jpds Nov 18, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions policy/modules/admin/portage.fc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,7 @@
/var/db/pkg(/.*)? gen_context(system_u:object_r:portage_db_t,s0)
/var/db/repos(/.*)? gen_context(system_u:object_r:portage_ebuild_t,s0)
/var/cache/binpkgs(/.*)? gen_context(system_u:object_r:portage_ebuild_t,s0)
/var/cache/distfiles(/.*)? gen_context(system_u:object_r:portage_ebuild_t,s0)
/var/cache/distfiles/cvs-src(/.*)? gen_context(system_u:object_r:portage_srcrepo_t,s0)
/var/cache/distfiles/egit-src(/.*)? gen_context(system_u:object_r:portage_srcrepo_t,s0)
/var/cache/distfiles/git[0-9]-src(/.*)? gen_context(system_u:object_r:portage_srcrepo_t,s0)
Expand Down
11 changes: 10 additions & 1 deletion policy/modules/services/xserver.if
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -95,6 +95,7 @@ interface(`xserver_restricted_role',`
dev_rw_usbfs($2)

miscfiles_read_fonts($2)
miscfiles_watch_fonts_dirs($2)

xserver_common_x_domain_template(user, $2) #selint-disable:S-004
xserver_domtrans($2)
Expand Down Expand Up @@ -186,10 +187,13 @@ interface(`xserver_role',`
optional_policy(`
xdg_manage_all_cache($2)
xdg_relabel_all_cache($2)
xdg_watch_all_cache_dirs($2)
xdg_manage_all_config($2)
xdg_relabel_all_config($2)
xdg_watch_all_config_dirs($2)
xdg_manage_all_data($2)
xdg_relabel_all_data($2)
xdg_watch_all_data_dirs($2)

xdg_generic_user_home_dir_filetrans_cache($2, dir, ".cache")
xdg_generic_user_home_dir_filetrans_config($2, dir, ".config")
Expand All @@ -203,14 +207,19 @@ interface(`xserver_role',`

xdg_manage_documents($2)
xdg_relabel_documents($2)
xdg_watch_documents_dirs($2)
xdg_manage_downloads($2)
xdg_relabel_downloads($2)
xdg_watch_downloads_dirs($2)
xdg_manage_music($2)
xdg_relabel_music($2)
xdg_watch_music_dirs($2)
xdg_manage_pictures($2)
xdg_relabel_pictures($2)
xdg_watch_pictures_dirs($2)
xdg_manage_videos($2)
xdg_relabel_videos($2)
xdg_watch_videos_dirs($2)

xdg_cache_filetrans($2, mesa_shader_cache_t, dir, "mesa_shader_cache")
')
Expand Down Expand Up @@ -508,7 +517,7 @@ interface(`xserver_use_user_fonts',`
')

# Read per user fonts
allow $1 user_fonts_t:dir list_dir_perms;
allow $1 user_fonts_t:dir { list_dir_perms watch };
allow $1 user_fonts_t:file { map read_file_perms };

# Manipulate the global font cache
Expand Down
1 change: 1 addition & 0 deletions policy/modules/system/getty.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,7 @@ allow getty_t getty_log_t:file { append_file_perms create_file_perms setattr_fil
logging_log_filetrans(getty_t, getty_log_t, file)

allow getty_t getty_runtime_t:dir watch;
allow getty_t getty_runtime_t:file watch;
manage_files_pattern(getty_t, getty_runtime_t, getty_runtime_t)
files_runtime_filetrans(getty_t, getty_runtime_t, file)

Expand Down
2 changes: 2 additions & 0 deletions policy/modules/system/init.fc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,6 +99,8 @@ ifdef(`distro_gentoo',`
# /sbin
#
/usr/sbin/openrc -- gen_context(system_u:object_r:rc_exec_t,s0)
/usr/sbin/openrc-init -- gen_context(system_u:object_r:init_exec_t,s0)
/usr/sbin/openrc-shutdown -- gen_context(system_u:object_r:init_exec_t,s0)

#
# /var
Expand Down
2 changes: 2 additions & 0 deletions policy/modules/system/init.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -120,6 +120,7 @@ init_unit_file(systemd_unit_t)
ifdef(`distro_gentoo',`
type rc_exec_t;
domain_entry_file(initrc_t, rc_exec_t)
domtrans_pattern(init_t, rc_exec_t, initrc_t)
')

ifdef(`enable_mls',`
Expand Down Expand Up @@ -755,6 +756,7 @@ fs_unmount_all_fs(initrc_t)
fs_remount_all_fs(initrc_t)
fs_getattr_all_fs(initrc_t)
fs_search_all(initrc_t)
fs_search_all(initrc_state_t)
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fs_search_all(initrc_state_t) doesnt make sense. initrc_state_t is a file type, domains do the searching, files don't.

This looks like parts were merged already? Is this just a stray line that I dropped when I merged the rest? It looks like there are a bunch of other commits in this PR so I'm guessing it picked up more when I merged stuff?

This looks like the only outstanding line? Can you re-check and fix this PR so its just the needed stuff or maybe close if we've already merged the important bits?

fs_getattr_nfsd_files(initrc_t)

# initrc_t needs to do a pidof which requires ptrace
Expand Down
18 changes: 18 additions & 0 deletions policy/modules/system/miscfiles.if
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -854,6 +854,24 @@ interface(`miscfiles_manage_public_files',`
manage_lnk_files_pattern($1, public_content_rw_t, public_content_rw_t)
')

########################################
## <summary>
## Watch public files
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`miscfiles_watch_public_dirs',`
gen_require(`
type public_content_rw_t;
')

allow $1 public_content_rw_t:dir watch;
')

########################################
## <summary>
## Read TeX data
Expand Down
4 changes: 3 additions & 1 deletion policy/modules/system/systemd.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1450,4 +1450,6 @@ userdom_manage_user_runtime_dirs(systemd_user_runtime_dir_t)
userdom_mounton_user_runtime_dirs(systemd_user_runtime_dir_t)
userdom_relabelto_user_runtime_dirs(systemd_user_runtime_dir_t)

dbus_system_bus_client(systemd_user_runtime_dir_t)
optional_policy(`
dbus_system_bus_client(systemd_user_runtime_dir_t)
')
15 changes: 14 additions & 1 deletion policy/modules/system/userdomain.if
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -289,6 +289,12 @@ interface(`userdom_ro_home_role',`
read_sock_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
files_list_home($2)

allow $2 { user_home_t user_home_dir_t }:dir { watch watch_mount watch_sb watch_with_perm watch_reads };
allow $2 user_home_t:file { watch watch_mount watch_sb watch_with_perm watch_reads };
allow $2 user_home_t:lnk_file { watch watch_mount watch_sb watch_with_perm watch_reads };
allow $2 user_home_t:sock_file { watch watch_mount watch_sb watch_with_perm watch_reads };
allow $2 user_home_t:fifo_file { watch watch_mount watch_sb watch_with_perm watch_reads };

tunable_policy(`use_nfs_home_dirs',`
fs_list_nfs($2)
fs_read_nfs_files($2)
Expand Down Expand Up @@ -368,7 +374,11 @@ interface(`userdom_manage_home_role',`
# cjp: this should probably be removed:
allow $2 user_home_dir_t:dir { manage_dir_perms relabel_dir_perms };

allow $2 user_home_dir_t:dir watch;
allow $2 { user_home_t user_home_dir_t }:dir { watch watch_mount watch_sb watch_with_perm watch_reads };
allow $2 user_home_t:file { watch watch_mount watch_sb watch_with_perm watch_reads };
allow $2 user_home_t:lnk_file { watch watch_mount watch_sb watch_with_perm watch_reads };
allow $2 user_home_t:sock_file { watch watch_mount watch_sb watch_with_perm watch_reads };
allow $2 user_home_t:fifo_file { watch watch_mount watch_sb watch_with_perm watch_reads };

userdom_manage_user_certs($2)
userdom_user_home_dir_filetrans($2, user_cert_t, dir, ".pki")
Expand Down Expand Up @@ -631,6 +641,8 @@ template(`userdom_common_user_template',`
files_read_var_lib_files($1_t)
# Stat lost+found.
files_getattr_lost_found_dirs($1_t)
files_watch_etc_dirs($1_t)
files_watch_usr_dirs($1_t)

fs_rw_cgroup_files($1_t)

Expand Down Expand Up @@ -1183,6 +1195,7 @@ template(`userdom_unpriv_user_template', `
files_exec_usr_files($1_t)

miscfiles_manage_public_files($1_t)
miscfiles_watch_public_dirs($1_t)

tunable_policy(`user_dmesg',`
kernel_read_ring_buffer($1_t)
Expand Down
Loading