[refpolicy] [PATCH] fstools: add in filetrans for /run dir

[dac.override@gmail.com (Dominick Grift)]

On Mon, Apr 13, 2015 at 07:41:35PM +0400, Jason Zaman wrote:
> the blkid tool writes to /run/blkid/. This creates the "fstools_run_t"
> type an allows the transition in /run.
> 
> type=AVC msg=audit(1428929528.885:149519): avc:  denied  { write } for
> pid=5590 comm="mkfs.ext4" name="/" dev="tmpfs" ino=17656
> scontext=staff_u:sysadm_r:fsadm_t tcontext=system_u:object_r:var_run_t
> tclass=dir permissive=0
> 
> In permissive:
> avc: denied { write } for  pid=18595 comm="mkfs.ext4" name="blkid.tab"
> dev="tmpfs" ino=5441676 scontext=root:sysadm_r:fsadm_t
> tcontext=root:object_r:var_run_t tclass=file permissive=1
> avc: denied { write } for  pid=18595 comm="mkfs.ext4" name="blkid"
> dev="tmpfs" ino=370936 scontext=root:sysadm_r:fsadm_t
> tcontext=root:object_r:var_run_t tclass=dir permissive=1
> avc: denied { add_name } for  pid=18595 comm="mkfs.ext4"
> name="blkid.tab-ZaM0Am" scontext=root:sysadm_r:fsadm_t
> tcontext=root:object_r:var_run_t tclass=dir permissive=1
> avc: denied { create } for  pid=18595 comm="mkfs.ext4"
> name="blkid.tab-ZaM0Am" scontext=root:sysadm_r:fsadm_t
> tcontext=root:object_r:var_run_t tclass=file permissive=1
> ---
>  policy/modules/system/fstools.fc | 2 ++
>  policy/modules/system/fstools.te | 7 +++++++
>  2 files changed, 9 insertions(+)
> 
> diff --git a/policy/modules/system/fstools.fc b/policy/modules/system/fstools.fc
> index d10368d..cba4184 100644
> --- a/policy/modules/system/fstools.fc
> +++ b/policy/modules/system/fstools.fc
> @@ -62,3 +62,5 @@
>  /usr/sbin/smartctl	--	gen_context(system_u:object_r:fsadm_exec_t,s0)
>  
>  /var/log/fsck(/.*)?		gen_context(system_u:object_r:fsadm_log_t,s0)
> +
> +/var/run/blkid(/.*)?		gen_context(system_u:object_r:fsadm_run_t,s0)

Should probably also cover /var/run/fsck

> diff --git a/policy/modules/system/fstools.te b/policy/modules/system/fstools.te
> index a0cfb1d..cbaa18b 100644
> --- a/policy/modules/system/fstools.te
> +++ b/policy/modules/system/fstools.te
> @@ -16,6 +16,9 @@ logging_log_file(fsadm_log_t)
>  type fsadm_tmp_t;
>  files_tmp_file(fsadm_tmp_t)
>  
> +type fsadm_run_t;
> +files_pid_file(fsadm_run_t)
> +
>  type swapfile_t; # customizable
>  files_type(swapfile_t)
>  
> @@ -45,6 +48,10 @@ allow fsadm_t fsadm_tmp_t:dir manage_dir_perms;
>  allow fsadm_t fsadm_tmp_t:file manage_file_perms;
>  files_tmp_filetrans(fsadm_t, fsadm_tmp_t, { file dir })
>  
> +allow fsadm_t fsadm_run_t:dir manage_dir_perms;
> +allow fsadm_t fsadm_run_t:file manage_file_perms;
> +files_pid_filetrans(fsadm_t, fsadm_run_t, { file dir })
> +

The transition should only be needed on "dir" (/var/run/blkid and /var/run/fsck)

files_pid_filetrans(fsadm_t, fsadm_run_t, dir)

I think it is important do this properly since it makes it sensible. Adding rules that do not make
sense only make it harder to understand what is going on and it needlessly inflates the policy.

>  # log files
>  allow fsadm_t fsadm_log_t:dir setattr;
>  manage_files_pattern(fsadm_t, fsadm_log_t, fsadm_log_t)
> -- 
> 2.0.5
> 
> _______________________________________________
> refpolicy mailing list
> refpolicy at oss.tresys.com
> http://oss.tresys.com/mailman/listinfo/refpolicy

-- 
02DFF788
4D30 903A 1CF3 B756 FB48  1514 3148 83A2 02DF F788
http://keys.gnupg.net/pks/lookup?op=vindex&search=0x314883A202DFF788
Dominick Grift
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 648 bytes
Desc: not available
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20150413/c86bab71/attachment.bin