All of lore.kernel.org
 help / color / mirror / Atom feed
* patch: add policy for gpg helpers
@ 2004-12-09 17:46 Thomas Bleher
  2004-12-15 20:43 ` James Carter
  0 siblings, 1 reply; 8+ messages in thread
From: Thomas Bleher @ 2004-12-09 17:46 UTC (permalink / raw)
  To: SELinux ML


[-- Attachment #1.1: Type: text/plain, Size: 455 bytes --]

This patch adds support for gpg-helpers. These can be used to
automatically fetch gpg keys over the network. Properly configured,
$1_gpg_t doesn't need network access anymore. Unfortunately, eg Debian
doesn't yet include all the necessary helpers, so I left the
can_network() for $1_gpg_t in for now.

Thomas

-- 
http://www.cip.ifi.lmu.de/~bleher/selinux/ - my SELinux pages
GPG-Fingerprint: BC4F BB16 30D6 F253 E3EA  D09E C562 2BAE B2F4 ABE7

[-- Attachment #1.2: gpg_helper.patch --]
[-- Type: text/plain, Size: 2875 bytes --]

diff -urN orig/domains/program/unused/gpg.te mod/domains/program/unused/gpg.te
--- orig/domains/program/unused/gpg.te	2003-08-14 14:37:36.000000000 +0200
+++ mod/domains/program/unused/gpg.te	2004-12-09 18:38:03.000000000 +0100
@@ -6,6 +6,7 @@
 
 # Type for gpg or pgp executables.
 type gpg_exec_t, file_type, sysadmfile, exec_type;
+type gpg_helper_exec_t, file_type, sysadmfile, exec_type;
 
 allow sysadm_gpg_t { home_root_t user_home_dir_t }:dir search;
 allow sysadm_gpg_t ptyfile:chr_file rw_file_perms;
diff -urN orig/file_contexts/program/gpg.fc mod/file_contexts/program/gpg.fc
--- orig/file_contexts/program/gpg.fc	2004-03-09 16:31:36.000000000 +0100
+++ mod/file_contexts/program/gpg.fc	2004-12-09 18:38:03.000000000 +0100
@@ -1,3 +1,4 @@
 # gpg
 HOME_DIR/\.gnupg(/.+)?	system_u:object_r:ROLE_gpg_secret_t
 /usr/bin/gpg		--	system_u:object_r:gpg_exec_t
+/usr/lib/gnupg/gpgkeys.*	--	system_u:object_r:gpg_helper_exec_t
diff -urN orig/macros/program/gpg_macros.te mod/macros/program/gpg_macros.te
--- orig/macros/program/gpg_macros.te	2004-11-30 16:19:26.000000000 +0100
+++ mod/macros/program/gpg_macros.te	2004-12-09 18:38:54.000000000 +0100
@@ -19,7 +19,7 @@
 define(`gpg_domain', `
 # Derived domain based on the calling user domain and the program.
 type $1_gpg_t, domain, privlog;
-type $1_gpg_secret_t, file_type, $1_file_type, sysadmfile, $1_file_type;
+type $1_gpg_secret_t, file_type, $1_file_type, sysadmfile;
 
 # Transition from the user domain to the derived domain.
 domain_auto_trans($1_t, gpg_exec_t, $1_gpg_t)
@@ -94,4 +94,38 @@
 
 ifdef(`gpg-agent.te', `gpg_agent_domain($1)')
 
+# for helper programs (which automatically fetch keys)
+# Note: this is only tested with the hkp interface. If you use eg the 
+# mail interface you will likely need additional permissions.
+type $1_gpg_helper_t, domain;
+role $1_r types $1_gpg_helper_t;
+
+domain_auto_trans($1_gpg_t, gpg_helper_exec_t, $1_gpg_helper_t)
+uses_shlib($1_gpg_helper_t)
+
+# allow gpg to fork so it can call the helpers
+allow $1_gpg_t self:process { fork sigchld };
+allow $1_gpg_t self:fifo_file { getattr read write };
+
+dontaudit $1_gpg_helper_t $1_gpg_secret_t:file read;
+if (use_nfs_home_dirs) {
+dontaudit $1_gpg_helper_t nfs_t:file { read write };
+}
+
+# communicate with the user 
+allow $1_gpg_helper_t $1_t:fd use;
+allow $1_gpg_helper_t $1_t:fifo_file write;
+# get keys from the network
+can_network_client($1_gpg_helper_t)
+allow $1_gpg_helper_t etc_t:file { getattr read };
+allow $1_gpg_helper_t urandom_device_t:chr_file read;
+allow $1_gpg_helper_t self:unix_stream_socket create_stream_socket_perms;
+# for nscd
+dontaudit $1_gpg_helper_t var_t:dir search;
+
+ifdef(`xdm.te', `
+dontaudit $1_gpg_t xdm_t:fd use;
+dontaudit $1_gpg_t xdm_t:fifo_file read;
+')
+
 ')dnl end gpg_domain definition

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

^ permalink raw reply	[flat|nested] 8+ messages in thread
[parent not found: <4256D267.7050403@comcast.net>]
* [patch] misc. policy updates
@ 2004-12-17  1:22 Greg Norris
  2004-12-20  1:01 ` Russell Coker
  0 siblings, 1 reply; 8+ messages in thread
From: Greg Norris @ 2004-12-17  1:22 UTC (permalink / raw)
  To: SELinux


[-- Attachment #1.1: Type: text/plain, Size: 275 bytes --]

The attached diff against ddclient.te is necessary in order for it to
work properly with the new networking macros.  Also, it updates my email
address in the policy header.  The other two simply perform the latter
update for the other policies I've submitted.

Please apply.

[-- Attachment #1.2: ddclient.te.diff --]
[-- Type: text/plain, Size: 1224 bytes --]

--- ddclient.te.orig	2004-12-16 19:03:49.000000000 -0600
+++ ddclient.te	2004-12-16 19:04:50.000000000 -0600
@@ -1,6 +1,6 @@
 #DESC ddclient - Update dynamic IP address at DynDNS.org
 #
-# Author: Greg Norris <adric@debian.org>
+# Author: Greg Norris <haphazard@kc.rr.com>
 # X-Debian-Packages: ddclient
 #
 
@@ -20,17 +20,18 @@
 
 # misc. requirements
 allow ddclient_t self:fifo_file rw_file_perms;
-allow ddclient_t self:unix_stream_socket create_socket_perms;
+allow ddclient_t self:socket create_socket_perms;
 allow ddclient_t etc_t:file { getattr read };
 allow ddclient_t etc_runtime_t:file r_file_perms;
 allow ddclient_t ifconfig_exec_t:file { rx_file_perms execute_no_trans };
 allow ddclient_t urandom_device_t:chr_file { read };
-allow ddclient_t proc_t:file r_file_perms;
+general_proc_read_access(ddclient_t)
 allow ddclient_t sysctl_net_t:dir { search };
 
 # network-related goodies
-can_network_server(ddclient_t)
+can_network_udp(ddclient_t)
 allow ddclient_t self:unix_dgram_socket create_socket_perms;
+allow ddclient_t self:unix_stream_socket create_socket_perms;
 
 # allow access to ddclient.conf and ddclient.cache
 allow ddclient_t ddclient_etc_t:file r_file_perms;

[-- Attachment #1.3: dnsmasq.te.diff --]
[-- Type: text/plain, Size: 305 bytes --]

--- dnsmasq.te.orig	2004-12-16 19:08:32.000000000 -0600
+++ dnsmasq.te	2004-12-16 19:09:34.000000000 -0600
@@ -1,6 +1,6 @@
 #DESC dnsmasq - DNS forwarder and DHCP server
 #
-# Author: Greg Norris <adric@debian.org>
+# Author: Greg Norris <haphazard@kc.rr.com>
 # X-Debian-Packages: dnsmasq
 #
 

[-- Attachment #1.4: fetchmail.te.diff --]
[-- Type: text/plain, Size: 378 bytes --]

--- fetchmail.te.orig	2004-12-16 19:08:37.000000000 -0600
+++ fetchmail.te	2004-12-16 19:09:42.000000000 -0600
@@ -1,6 +1,6 @@
 #DESC fetchmail - remote-mail retrieval utility
 #
-# Author: Greg Norris <adric@debian.org>
+# Author: Greg Norris <haphazard@kc.rr.com>
 # X-Debian-Packages: fetchmail
 #
 # Note: This policy is only required when running fetchmail in daemon mode.

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

^ permalink raw reply	[flat|nested] 8+ messages in thread
* Adding alternate root patch to restorecon (setfiles?)
@ 2004-10-18 19:31 Daniel J Walsh
  2004-10-25 15:38 ` Russell Coker
  0 siblings, 1 reply; 8+ messages in thread
From: Daniel J Walsh @ 2004-10-18 19:31 UTC (permalink / raw)
  To: Stephen Smalley, SELinux

We are beginning to look into how we could support clusters with SELinux. 
Usually in clusters you move your configuration off on to some shared 
storage.

So you might do a cp -a  /var/named /shared/var/named

We need some way of relabeling these directories with file context.  My 
idea is to add an alternate
root qualifier to restorecon

So in the above example you would do a

restorecon -R -p /shared /shared/var/named

I think this would work fairly well for chroot environments also.

Ideas?


Dan

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

^ permalink raw reply	[flat|nested] 8+ messages in thread
end of thread, other threads:[~2005-04-14 14:07 UTC | newest]

Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2004-12-09 17:46 patch: add policy for gpg helpers Thomas Bleher
2004-12-15 20:43 ` James Carter
2004-12-16 16:50   ` Latest patch Daniel J Walsh
2004-12-20 21:43     ` James Carter
     [not found] <4256D267.7050403@comcast.net>
2005-04-14 14:04 ` Latest Patch James Carter
  -- strict thread matches above, loose matches on Subject: below --
2004-12-17  1:22 [patch] misc. policy updates Greg Norris
2004-12-20  1:01 ` Russell Coker
2004-12-20 21:54   ` James Carter
2004-12-28 22:29     ` Latest patch Daniel J Walsh
2004-10-18 19:31 Adding alternate root patch to restorecon (setfiles?) Daniel J Walsh
2004-10-25 15:38 ` Russell Coker
2004-10-25 21:31   ` Thomas Bleher
2004-10-26 14:36     ` Russell Coker
2004-11-05 21:39       ` James Carter
2004-11-10 23:11         ` Patches without the can_network patch Daniel J Walsh
2004-11-17 20:15           ` James Carter
2004-11-18 14:33             ` Daniel J Walsh
2004-11-23 18:52               ` James Carter
2004-11-24 16:22                 ` Daniel J Walsh
2004-11-24 19:48                   ` James Carter
2004-11-30 21:19                     ` Reissue previous patch Daniel J Walsh
2004-12-02 13:54                       ` James Carter
2004-12-02 14:16                         ` Daniel J Walsh
2004-12-02 17:51                           ` James Carter
2004-12-02 19:27                             ` Latest patch Daniel J Walsh
2004-12-03 13:40                               ` James Carter

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.