sereference: screen policy

sereference: screen policy

[Serge E. Hallyn]

Still getting the hang of the various existing interfaces, but this
policy at least lets me run screen as sysadm_u and user_u.  This
likely shouldn't go in as is since I doubt it's minimal due to clumsy
use of wrong interfaces, but I won't be looking at this again until
next week at earliest, so meanwhile here's what I've got.

thanks,
-serge

Index: refpolicy/policy/modules/apps/screen.if
===================================================================
--- /dev/null
+++ refpolicy/policy/modules/apps/screen.if
@@ -0,0 +1,153 @@
+## <summary>Screen policy</summary>
+
+#######################################
+## <summary>
+##	The per user domain template for the screen module.
+## </summary>
+## <desc>
+##	<p>
+##	This template creates a derived domains which are used
+##	for screen sessions.
+##	</p>
+##	<p>
+##	This template is invoked automatically for each user, and
+##	generally does not need to be invoked directly
+##	by policy writers.
+##	</p>
+##	<p>
+##	Based on Russel Coker's version for the strict policy
+##	</p>
+## </desc>
+## <param name="userdomain_prefix">
+##	The prefix of the user domain (e.g., user
+##	is the prefix for user_t).
+## </param>
+## <param name="user_domain">
+##	The type of the user domain.
+## </param>
+## <param name="user_role">
+##	The role associated with the user domain.
+## </param>
+#
+
+template(`screen_per_userdomain_template',`
+	type $1_screen_t;
+	domain_type($1_screen_t);
+	#domain_entry_file($1_screen_t,screen_exec_t)
+	domain_auto_trans($1_t, screen_exec_t, $1_screen_t)
+	domain_entry_file($1_screen_t, screen_exec_t)
+	allow $1_screen_t $1_t:process sigchld;
+	allow $1_t $1_screen_t:process sigchld;
+	allow $1_screen_t $1_t:fd use;
+	allow $1_t $1_screen_t:fd use;
+	allow $1_t $1_screen_t:fifo_file rw_file_perms;
+	role $3 types $1_screen_t;
+
+	files_read_etc_files($1_screen_t)
+	files_read_etc_runtime_files($1_screen_t)
+	files_search_home($1_screen_t)
+
+	libs_read_lib($1_screen_t)
+	libs_use_ld_so($1_screen_t)
+	libs_use_shared_libs($1_screen_t)
+
+	locallogin_use_fd($1_screen_t)
+	dev_read_urand($1_screen_t)
+
+	userdom_use_user_terminals($1, $1_screen_t)
+
+	files_create_tmp_files($1_screen_t, $1_tmp_t, { file dir })
+
+	allow $1_screen_t $1_home_t:file rw_file_perms;
+	allow $1_screen_t $1_tmp_t:file rw_file_perms;
+
+	# Revert to the user domain when a shell is executed.
+	domain_auto_trans($1_screen_t, { shell_exec_t bin_t }, $1_t)
+	domain_auto_trans($1_screen_t, $1_home_t, $1_t)
+
+	#if (use_nfs_home_dirs) {
+	#domain_auto_trans($1_screen_t, nfs_t, $1_t)
+	#}
+	#if (use_samba_home_dirs) {
+	#domain_auto_trans($1_screen_t, cifs_t, $1_t)
+	#}
+
+	# Write to utmp.
+	init_rw_script_pid($1_screen_t);
+
+	# create pty devices
+	allow $1_t $1_devpts_t:chr_file { rw_file_perms setattr getattr relabelfrom };
+	term_create_pty($1_t,$1_devpts_t)
+	allow $1_t devpts_t:chr_file rw_file_perms;
+	allow $1_screen_t bsdpty_device_t:chr_file rw_file_perms;
+
+	term_use_ptmx($1_screen_t)
+
+	# Create fifo
+	allow $1_screen_t var_t:dir search;
+	type_transition $1_screen_t var_run_t:dir screen_dir_t;
+	allow $1_screen_t var_run_t:dir create_dir_perms;
+	allow $1_screen_t screen_dir_t:dir create_dir_perms;
+	type $1_screen_var_run_t;
+	files_pid_file($1_screen_var_run_t)
+	type_transition $1_screen_t screen_dir_t:{ fifo_file file } $1_screen_var_run_t;
+	allow $1_screen_t $1_screen_var_run_t:fifo_file create_file_perms;
+
+	allow $1_screen_t self:process { fork signal_perms };
+	allow $1_t $1_screen_t:process signal;
+	allow $1_screen_t $1_t:process signal;
+	allow $1_screen_t self:capability { setuid setgid fsetid };
+
+	allow $1_screen_t tmp_t:dir search;
+	allow $1_screen_t port_type:tcp_socket name_connect;
+
+	allow $1_screen_t devpts_t:filesystem getattr;
+	allow $1_screen_t tmpfs_t:filesystem getattr;
+	allow $1_screen_t tmpfs_t:fifo_file getattr;
+	term_getattr_unallocated_ttys($1_screen_t)
+	dev_getattr_generic_blk_file($1_screen_t)
+	dev_getattr_generic_chr_file($1_screen_t)
+
+	term_use_generic_pty($1_screen_t)
+	term_setattr_all_user_ptys($1_screen_t)
+	term_use_all_terms($1_screen_t)
+	auth_read_shadow($1_screen_t)
+	allow sysadm_screen_t devpts_t:chr_file setattr;
+
+	optional_policy(`nis',`
+		nis_use_ypbind($1_screen_t)
+	')
+
+
+	# get stats
+	kernel_search_proc($1_screen_t)
+	kernel_list_proc($1_screen_t)
+	kernel_getattr_proc_files($1_screen_t)
+	kernel_read_proc_symlinks($1_screen_t)
+
+	files_read_etc_files($1_screen_t)
+	allow $1_screen_t self:dir { search read };
+	dev_list_all_dev_nodes($1_screen_t)
+	allow $1_screen_t self:lnk_file read;
+	allow $1_screen_t { $1_home_dir_t }:dir search;
+
+	files_search_home($1_screen_t)
+
+	# only for serges setup
+	allow $1_screen_t user_home_dir_t:dir search_dir_perms;
+
+	# Internal screen networking
+	allow $1_screen_t self:fd use;
+	allow $1_screen_t self:unix_stream_socket create_socket_perms;
+	allow $1_screen_t self:unix_dgram_socket create_socket_perms;
+
+	corecmd_exec_bin($1_screen_t)
+	miscfiles_read_localization($1_screen_t)
+
+	# Ok, well I need these too...
+	allow $1_screen_t device_t:file getattr;
+	allow $1_screen_t device_t:sock_file getattr;
+	allow $1_screen_t tmpfs_t:dir getattr;
+	allow $1_screen_t tty_device_t:lnk_file read;
+
+')
Index: refpolicy/policy/modules/apps/screen.te
===================================================================
--- /dev/null
+++ refpolicy/policy/modules/apps/screen.te
@@ -0,0 +1,11 @@
+policy_module(screen,1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type screen_exec_t;
+files_type(screen_exec_t);
+type screen_dir_t;
+files_type(screen_dir_t);
Index: refpolicy/policy/modules/apps/screen.fc
===================================================================
--- /dev/null
+++ refpolicy/policy/modules/apps/screen.fc
@@ -0,0 +1,5 @@
+# screen
+/usr/bin/screen         --      system_u:object_r:screen_exec_t
+HOME_DIR/\.screenrc     --      system_u:object_r:ROLE_screen_ro_home_t
+/var/run/screens?/S-[^/]+       -d      system_u:object_r:screen_dir_t
+/var/run/screens?/S-[^/]+/.*    <<none>>
Index: refpolicy/policy/modules.conf
===================================================================
--- refpolicy.orig/policy/modules.conf
+++ refpolicy/policy/modules.conf
@@ -262,6 +262,13 @@ gpg = module
 irc = module
 
 # Layer: apps
+# Module: screen
+#
+# Screen policy
+# 
+screen = module
+
+# Layer: apps
 # Module: loadkeys
 #
 # Load keyboard mappings.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: sereference: screen policy

[Christopher J. PeBenito]

On Thu, 2006-01-12 at 15:48 -0600, Serge E. Hallyn wrote:
> Still getting the hang of the various existing interfaces, but this
> policy at least lets me run screen as sysadm_u and user_u.  This
> likely shouldn't go in as is since I doubt it's minimal due to clumsy
> use of wrong interfaces, but I won't be looking at this again until
> next week at earliest, so meanwhile here's what I've got.

A screen policy was committed two days ago, can you try that one?  I
tested it and it seemed to work ok for me.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: sereference: screen policy

[Serge E. Hallyn]

Quoting Christopher J. PeBenito (cpebenito@tresys.com):
> On Thu, 2006-01-12 at 15:48 -0600, Serge E. Hallyn wrote:
> > Still getting the hang of the various existing interfaces, but this
> > policy at least lets me run screen as sysadm_u and user_u.  This
> > likely shouldn't go in as is since I doubt it's minimal due to clumsy
> > use of wrong interfaces, but I won't be looking at this again until
> > next week at earliest, so meanwhile here's what I've got.
> 
> A screen policy was committed two days ago, can you try that one?  I
> tested it and it seemed to work ok for me.

Oops, didn't notice that.  I will try it this afternoon, thanks.

-serge

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: sereference: screen policy

[Serge E. Hallyn]

Quoting Christopher J. PeBenito (cpebenito@tresys.com):
> On Thu, 2006-01-12 at 15:48 -0600, Serge E. Hallyn wrote:
> > Still getting the hang of the various existing interfaces, but this
> > policy at least lets me run screen as sysadm_u and user_u.  This
> > likely shouldn't go in as is since I doubt it's minimal due to clumsy
> > use of wrong interfaces, but I won't be looking at this again until
> > next week at earliest, so meanwhile here's what I've got.
> 
> A screen policy was committed two days ago, can you try that one?  I
> tested it and it seemed to work ok for me.

Almost but not quite for me.  I needed the following lines added to the
template:

	allow $1_screen_t $1_t:process sigchld;
	allow $1_screen_t $1_t:fd use;
	term_setattr_all_user_ptys($1_screen_t)
	term_use_all_terms($1_screen_t)
	allow $1_screen_t tty_device_t:lnk_file read;

Note that I also still need my other patch for local logins from Jan 11.

-serge

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: sereference: screen policy

[Christopher J. PeBenito]

On Fri, 2006-01-13 at 16:22 -0600, Serge E. Hallyn wrote:
> Quoting Christopher J. PeBenito (cpebenito@tresys.com):
> > On Thu, 2006-01-12 at 15:48 -0600, Serge E. Hallyn wrote:
> > > Still getting the hang of the various existing interfaces, but this
> > > policy at least lets me run screen as sysadm_u and user_u.  This
> > > likely shouldn't go in as is since I doubt it's minimal due to clumsy
> > > use of wrong interfaces, but I won't be looking at this again until
> > > next week at earliest, so meanwhile here's what I've got.
> > 
> > A screen policy was committed two days ago, can you try that one?  I
> > tested it and it seemed to work ok for me.
> 
> Almost but not quite for me.  I needed the following lines added to the
> template:
> 
> 	allow $1_screen_t $1_t:process sigchld;
> 	allow $1_screen_t $1_t:fd use;

Ok, well these should be in there already ($2 == the old $1_t in the
template).

> 	term_setattr_all_user_ptys($1_screen_t)
> 	term_use_all_terms($1_screen_t)

The rule for the user's own terminal should be in.  I don't know if we
should trust screen to use all terminals.

> 	allow $1_screen_t tty_device_t:lnk_file read;

Looks like a mislabeled symlink.  Currently the symlinks in /dev are all
device_t, as far as I know.  Looking at terminal.fc, everything is
marked -c (with the exception of /dev/pts directory which is -d), so I'm
not sure how this would happen.

> Note that I also still need my other patch for local logins from Jan 11.

Ok, I'll go back and look at it.  The response you made to your email
made me think it wasn't actually needed.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: sereference: screen policy

[Serge E. Hallyn]

Quoting Christopher J. PeBenito (cpebenito@tresys.com):
> The rule for the user's own terminal should be in.  I don't know if we
> should trust screen to use all terminals.
> 
> > 	allow $1_screen_t tty_device_t:lnk_file read;
> 
> Looks like a mislabeled symlink.  Currently the symlinks in /dev are all
> device_t, as far as I know.  Looking at terminal.fc, everything is
> marked -c (with the exception of /dev/pts directory which is -d), so I'm
> not sure how this would happen.
> 
> > Note that I also still need my other patch for local logins from Jan 11.
> 
> Ok, I'll go back and look at it.  The response you made to your email
> made me think it wasn't actually needed.

Ah, ok, I added a line to terminal.fc in my login patch to label my
/dev/ttyS1 as tty_device_t:

+/dev/.*tty[^/]*                -l gen_context(system_u:object_r:tty_device _t,s0)

Let me see if removing that lets me still log in, and if so I guess I
may not need

> > 	allow $1_screen_t tty_device_t:lnk_file read;

in the screen template.

thanks,
-serge

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: sereference: screen policy

[Serge E. Hallyn]

Quoting Christopher J. PeBenito (cpebenito@tresys.com):
> On Fri, 2006-01-13 at 16:22 -0600, Serge E. Hallyn wrote:
> > Quoting Christopher J. PeBenito (cpebenito@tresys.com):
> > > On Thu, 2006-01-12 at 15:48 -0600, Serge E. Hallyn wrote:
> > > > Still getting the hang of the various existing interfaces, but this
> > > > policy at least lets me run screen as sysadm_u and user_u.  This
> > > > likely shouldn't go in as is since I doubt it's minimal due to clumsy
> > > > use of wrong interfaces, but I won't be looking at this again until
> > > > next week at earliest, so meanwhile here's what I've got.
> > > 
> > > A screen policy was committed two days ago, can you try that one?  I
> > > tested it and it seemed to work ok for me.
> > 
> > Almost but not quite for me.  I needed the following lines added to the
> > template:
> > 
> > 	allow $1_screen_t $1_t:process sigchld;
> > 	allow $1_screen_t $1_t:fd use;
> 
> Ok, well these should be in there already ($2 == the old $1_t in the
> template).
> 
> > 	term_setattr_all_user_ptys($1_screen_t)
> > 	term_use_all_terms($1_screen_t)
> 
> The rule for the user's own terminal should be in.  I don't know if we
> should trust screen to use all terminals.
> 
> > 	allow $1_screen_t tty_device_t:lnk_file read;
> 
> Looks like a mislabeled symlink.  Currently the symlinks in /dev are all
> device_t, as far as I know.  Looking at terminal.fc, everything is
> marked -c (with the exception of /dev/pts directory which is -d), so I'm
> not sure how this would happen.

Yup, with /dev/ttyS1 correctly labeled, the existing screen policy works.

(But I still need the rest of my login fix)

thanks,
-serge

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.