Re: [PATCH] Allow systemd to getattr configfile

Dominick Grift <[email protected]> Wed, 4 Dec 2019 17:56:14 +0100
Newsgroups	org.kernel.vger.selinux-refpolicy
Message-ID	<[email protected]>
On Wed, Dec 04, 2019 at 04:33:20PM +0000, Sugar, David wrote:
> Systemd has ConditionalPathExists which is used to check if a path exists to control starting a service.  But this requires getattr permissions on the file.  This is generally for configuration files.  We are mostly seeing this is in our own policy.  But this lvm denial also fits the example.
> 
> type=AVC msg=audit(1575427946.229:1624): avc:  denied  { getattr } for  pid=1 comm="systemd" path="/etc/lvm/lvm.conf" dev="dm-0" ino=51799 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:lvm_etc_t:s0 tclass=file permissive=0
> 
> This second example is from chronyd, but it is happening becuase I added the conditional in a drop-in file. Note that chronyd_conf_t is already a 'configfile'.
> 
> type=AVC msg=audit(1575427959.882:1901): avc:  denied  { getattr } for  pid=1 comm="systemd" path="/etc/chrony.conf" dev="dm-0" ino=53824 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:chronyd_conf_t:s0 tclass=file permissive=1

how about something a little more general?

systemd_ConditionPath(`,'
	allow init_t $1:dir search_dir_perms;
	allow init_t $1:lnk_file read_lnk_file_perms;
	allow init_t $1:fifo_file getattr_fifo_file_perms;
	allow init_t $1:sock_file getattr_sock_file_perms;
	allow init_t $1:file getattr_file_perms;
	allow init_t $1:blk_file getattr_blk_file_perms;
	allow init_t $1:chr_file getattr_chr_file_perms;
')

> 
> Signed-off-by: Dave Sugar <[email protected]>
> ---
>  policy/modules/kernel/files.if | 20 ++++++++++++++++++++
>  policy/modules/system/init.te  |  1 +
>  policy/modules/system/lvm.te   |  2 +-
>  3 files changed, 22 insertions(+), 1 deletion(-)
> 
> diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if
> index f1c94411..87be07ae 100644
> --- a/policy/modules/kernel/files.if
> +++ b/policy/modules/kernel/files.if
> @@ -1562,6 +1562,26 @@ interface(`files_relabel_config_dirs',`
>  	relabel_dirs_pattern($1, configfile, configfile)
>  ')
>  
> +########################################
> +## <summary>
> +##	Getattr config files in /etc.
> +## </summary>
> +## <param name="domain">
> +##	<summary>
> +##	Domain allowed access.
> +##	</summary>
> +## </param>
> +#
> +interface(`files_getattr_config_files',`
> +	gen_require(`
> +		attribute configfile;
> +	')
> +
> +	allow $1 configfile:dir list_dir_perms;
> +	getattr_files_pattern($1, configfile, configfile)
> +	read_lnk_files_pattern($1, configfile, configfile)
> +')
> +
>  ########################################
>  ## <summary>
>  ##	Read config files in /etc.
> diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
> index 8973a622..747b696e 100644
> --- a/policy/modules/system/init.te
> +++ b/policy/modules/system/init.te
> @@ -320,6 +320,7 @@ ifdef(`init_systemd',`
>  	domain_subj_id_change_exemption(init_t)
>  	domain_role_change_exemption(init_t)
>  
> +	files_getattr_config_files(init_t)
>  	files_read_all_pids(init_t)
>  	files_list_usr(init_t)
>  	files_list_var(init_t)
> diff --git a/policy/modules/system/lvm.te b/policy/modules/system/lvm.te
> index ad4eb579..c05344e0 100644
> --- a/policy/modules/system/lvm.te
> +++ b/policy/modules/system/lvm.te
> @@ -25,7 +25,7 @@ domain_obj_id_change_exemption(lvm_t)
>  role system_r types lvm_t;
>  
>  type lvm_etc_t;
> -files_type(lvm_etc_t)
> +files_config_file(lvm_etc_t)
>  
>  type lvm_lock_t;
>  files_lock_file(lvm_lock_t)
> -- 
> 2.21.0
> 

-- 
Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02
Dominick Grift
signature.asc (application/pgp-signature, 659 B)