refpolicy updates from debian

refpolicy updates from debian

[Erich Schubert]

[-- Attachment #1: Type: text/plain, Size: 675 bytes --]

Hi,
Attached is a diff with the changes in my modified policy for Debian.
You probably won't like some of it (netuser), or prefer a different
approach, but there are also some fixes in there that should go into the
main branch.
some are no brainers (e.g. slapd location in debian; you might want to
do an ifdef around that one however) The /dev/.static/dev/ stuff is a
bit ugly, I know. But it'll hose udev otherwise.

best regards,
Erich Schubert
-- 
     erich@(vitavonni.de|debian.org)    --    GPG Key ID: 4B3A135C    (o_
 Why waste time learning, when ignorance is instantaneous? --- Calvin //\
        Ein Freund ist ein Geschenk, das man sich selbst macht.       V_/_

[-- Attachment #2: refpolicy-debian-changes.gz --]
[-- Type: application/x-gzip, Size: 7435 bytes --]

Re: refpolicy updates from debian

[Christopher J. PeBenito]

On Sat, 2006-09-02 at 03:37 +0200, Erich Schubert wrote:
> Attached is a diff with the changes in my modified policy for Debian.
> You probably won't like some of it (netuser), or prefer a different
> approach, but there are also some fixes in there that should go into the
> main branch.
> some are no brainers (e.g. slapd location in debian; you might want to
> do an ifdef around that one however) The /dev/.static/dev/ stuff is a
> bit ugly, I know. But it'll hose udev otherwise.

- changed fsadm_var_log_t to fsadm_log_t
- dropped netuser
- rearranged several additions
- dropped dev/.static/dev/ stuff.  please put in distro_debian
- please make a more descriptive name for usbmodules_var_lib_t.  maybe
usbmodules_ids_t?
- why does crond_t transition to amavis? why not system_crond_t?
- why does system_crond_t connect to mysql?

The remainder should be merged.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: refpolicy updates from debian

[Erich Schubert]

Hello Chris,
> - changed fsadm_var_log_t to fsadm_log_t

Okay.

> - dropped netuser

I'm still convinced it's useful.
It's an easy way of allowing only certain users to setup network
servers.
If like, 10% of your users should be allowed to setup network servers,
the others should not.

> - dropped dev/.static/dev/ stuff.  please put in distro_debian

It might be removed again. This directory isn't really used apparently;
it was added to allow the admin to configure the static /dev dir while
running udev.
I don't think we need to support switching from udev to static /dev
while selinux is in enforcing mode.

> - please make a more descriptive name for usbmodules_var_lib_t.  maybe
> usbmodules_ids_t?

Right now there is only the usbmodules ids file in there, so that name
is fine with me. I have no idea if usbmodules might get extra var files
later on. AFAICT the file is generated from one single source file on my
system anyway. That might differ for certain USB hardware not supported
by the stock kernel, though.

> - why does crond_t transition to amavis? why not system_crond_t?

Should be system_crond_t I think. Maybe a typo. Must have done that
change some months ago, actually.
This is the cronjob rebuilding or doing maintainance on the amavis
spamassassins bayes database. It will have to su to user amavis, too; I
didn't complete these changes I think. The amavisd-new maintainer
uploaded a useful change to unstable; however my only selinux system
with amavis in use was a sarge system.

> - why does system_crond_t connect to mysql?

I'm not sure, I believe it's cron signaling mysql some maintainance.
I don't actually use MySQL.

>From the cronjob:
# This script only rotates the binary logs. The normal logs are rotated
# via /etc/logrotate.d/mysql-server.

I don't know why logrotate is not used for the binary logs, too.

best regards,
Erich Schubert
-- 
    erich@(vitavonni.de|debian.org)    --    GPG Key ID: 4B3A135C    (o_
     Which is worse: ignorance or apathy? Who knows? Who cares?      //\
  Bei dem Freunde halte still, der dich nur, nicht das deine will.   V_/_


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: refpolicy updates from debian

[Christopher J. PeBenito]

On Mon, 2006-09-04 at 21:43 +0200, Erich Schubert wrote:
> > - dropped netuser
> 
> I'm still convinced it's useful.
> It's an easy way of allowing only certain users to setup network
> servers.
> If like, 10% of your users should be allowed to setup network servers,
> the others should not.

I see where it would be useful, I just don't believe its common enough
to be added.

> > - please make a more descriptive name for usbmodules_var_lib_t.  maybe
> > usbmodules_ids_t?
> 
> Right now there is only the usbmodules ids file in there, so that name
> is fine with me. I have no idea if usbmodules might get extra var files
> later on. AFAICT the file is generated from one single source file on my
> system anyway. That might differ for certain USB hardware not supported
> by the stock kernel, though.

After doing a little digging to see where these files are on FC and
Gentoo machines, I see that the existing hwdata_t is the right type for
this.  I have added the appropriate rules and fc entries.  However, I
don't see any options for usbmodules that would have it write to
usb.ids, so why does your patch have this access?

> > - why does system_crond_t connect to mysql?
> 
> I'm not sure, I believe it's cron signaling mysql some maintainance.
> I don't actually use MySQL.
> 
> >From the cronjob:
> # This script only rotates the binary logs. The normal logs are rotated
> # via /etc/logrotate.d/mysql-server.
> 
> I don't know why logrotate is not used for the binary logs, too.

Can you send me a copy of the script off list?

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: refpolicy updates from debian

[Erich Schubert]

Hello Christopher,
> this.  I have added the appropriate rules and fc entries.  However, I
> don't see any options for usbmodules that would have it write to
> usb.ids, so why does your patch have this access?

It's not supposed to, there is a script called update-usbids which does
that. I assume it's being called from package postinsts, and should run
with these permissions fine. But I havn't tested that. But usually the
package managers can write regular files, can't they?

> Can you send me a copy of the script off list?

Will do.

best regards,
Erich Schubert
-- 
    erich@(vitavonni.de|debian.org)    --    GPG Key ID: 4B3A135C   (o_
   There was never a good war or a bad peace. - Benjamin Franklin   //\
         Humor sollte immmer dabeisein, auch bei Problemen.         V_/_


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: refpolicy updates from debian

[Christopher J. PeBenito]

On Tue, 2006-09-05 at 16:33 +0200, Erich Schubert wrote:
> Hello Christopher,
> > this.  I have added the appropriate rules and fc entries.  However, I
> > don't see any options for usbmodules that would have it write to
> > usb.ids, so why does your patch have this access?
> 
> It's not supposed to, there is a script called update-usbids which does
> that. I assume it's being called from package postinsts, and should run
> with these permissions fine. But I havn't tested that. But usually the
> package managers can write regular files, can't they?

Yes, but what I'm referring to is:

+allow usbmodules_t usbmodules_var_lib_t:dir rw_dir_perms;
+allow usbmodules_t usbmodules_var_lib_t:file create_file_perms;

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: refpolicy updates from debian

[Erich Schubert]

Hi,
> +allow usbmodules_t usbmodules_var_lib_t:dir rw_dir_perms;
> +allow usbmodules_t usbmodules_var_lib_t:file create_file_perms;

r_ should be sufficient, yes. Sorry about that.

best regards,
Erich Schubert
-- 
    erich@(vitavonni.de|debian.org)    --    GPG Key ID: 4B3A135C    (o_
           There are only 10 types of people in the world:           //\
           Those who understand binary and those who don't           V_/_
   Freund in der Not will nicht viel heißen; hilfreich möchte sich
    mancher erweisen. Aber die neidlos dein Glück dir gönnen, die
        darfst du wahrlich Freunde nennen. --- Paul von Heyse



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.