updater-shell

Jens Kasten <[email protected]> Thu, 28 Jun 2012 19:43:18 +0200

Newsgroups	gmane.linux.rsbac
Message-ID	<[email protected]>

Hi list,

Here i have finnish in beta stage the updater-shell.
Its a python dialog script which is set for the updater user as login 
shell toh manage the gentoo packages.

Its can download here http://hg.kasten-edv.de/rsbac-tools

Some screenshoots can found on 
http://kasten-edv.de/download/images/updater-shell/

On attachment are the files which set the rsbac permission for the user 
updater and the /etc/portage/bashrc.

When this is fix and all stabilized then the script is extend for 
debian system.
The main ui is finnish.
To choose which ui should loaded its make a dessision based on the 
return value from linux platform.
So it should easy to extend for other distributions too.

What is missing is to set proper rsbac attribute read and modify for 
this user.
Maybe someone can help to fix the permission problem.


-- 
Mit freundlichen Grüßen

Jens Kasten


http://www.kasten-edv.de

_______________________________________________
rsbac mailing list
[email protected]
http://www.rsbac.org/mailman/listinfo/rsbac

create_update_user_gentoo.sh (text/plain, 1.5 KB)

# for using emerge and revdep-rebuild
attr_set_file_dir FILE /usr/lib64/portage/bin/emerge fake_root_uid 3
attr_set_file_dir FILE /usr/bin/revdep-rebuild.sh fake_root_uid 3

# create group and user updater
rsbac_groupadd -g 410 updater
if [ ! -d /home/admins/updater ]; then
    # allow security user to create home directory
    attr_set_user security min_caps DAC_OVERRIDE 
    rsbac_useradd -s /usr/bin/updater-shell -m -d /home/admins/updater -g 410 -u 410 updater
    # disabled it again
    attr_set_user security min_caps
else
    rsbac_useradd -s /usr/bin/updater-shell -g 410 -u 410 updater
fi

# set min caps for user updater
attr_set_user updater min_caps CHOWN DAC_OVERRIDE DAC_READ_SEARCH FOWNER FSETID MKNOD NET_BIND_SERVICE

# solve this acl request
# request GET_STATUS_DATA, pid 10699, ppid 10696, prog_name sort, 
# prog_file /bin/sort, uid 410, remote ip 192.168.1.5, target_type SCD, 
# tid priority, attr none, value none, result NOT_GRANTED by ACL
acl_grant USER 410 GET_STATUS_DATA SCD priority rsbac
# mlock is need for password storing in memory
acl_grant USER 410 MODIFY_SYSTEM_DATA SCD mlock

# allow ssh access
auth_set_cap FD add /usr/sbin/sshd 410
auth_set_cap -e FD add /usr/sbin/sshd 410
auth_set_cap -f FD add /usr/sbin/sshd 410
auth_set_cap -g FD add /usr/sbin/sshd 410
auth_set_cap -E FD add /usr/sbin/sshd 410
auth_set_cap -F FD add /usr/sbin/sshd 410

# not working
#acl_grant USER 410 READ_ATTRIBUTE FILE
#acl_grant USER 410 READ_ATTRIBUTE DIR
#acl_grant USER 410 MODIFY_ATTRIBUTE DIR
#acl_grant USER 410 MODIFY_ATTRIBUTE FILE

bashrc (text/plain, 645 B)

source /etc/portage/etckeeper


post_pkg_postinst() { 
    rsbac_attributes_initial="/etc/rsbac/packages/${CATEGORY}/${PN}/${PF}.sh"
    rsbac_attributes="/home/admins/updater/packages/${CATEGORY}/${PN}/${PF}.sh"
    einfo  "Applying rsbac attributes:" 
    # first policy
    if [ -f "${rsbac_attributes_initial}" ]; then
        sh ${rsbac_attributes_initial}
    else
        einfo "No rsbac attribute initial available"
    fi
    # second which found
    einfo "Set attribute from ${rsbac_attributes}"
    if [ -f "${rsbac_attributes}" ]; then
        sh ${rsbac_attributes}
    else
        einfo "No rsbac attribute available"
    fi
}