* squid patch
@ 2007-04-19 15:08 Daniel J Walsh
2007-05-03 15:00 ` Christopher J. PeBenito
2007-05-07 13:39 ` Christopher J. PeBenito
0 siblings, 2 replies; 6+ messages in thread
From: Daniel J Walsh @ 2007-04-19 15:08 UTC (permalink / raw)
To: Christopher J. PeBenito, SE Linux
[-- Attachment #1: Type: text/plain, Size: 215 bytes --]
Added httpd_squid_script_t
squid_conf_t can be a directory
Squid also needs additional ports to communicate with
dovecot and snmp try to read squid files. (Snuck in a couple of other
fixes for dovecot and snmp)
[-- Attachment #2: squid.patch --]
[-- Type: text/x-patch, Size: 5288 bytes --]
--- nsaserefpolicy/policy/modules/services/squid.fc 2006-11-16 17:15:21.000000000 -0500
+++ serefpolicy-2.5.12/policy/modules/services/squid.fc 2007-04-11 17:07:34.000000000 -0400
@@ -12,3 +12,5 @@
/var/run/squid\.pid -- gen_context(system_u:object_r:squid_var_run_t,s0)
/var/spool/squid(/.*)? gen_context(system_u:object_r:squid_cache_t,s0)
+/usr/lib/squid/cachemgr\.cgi -- gen_context(system_u:object_r:httpd_squid_script_exec_t,s0)
+/usr/lib64/squid/cachemgr\.cgi -- gen_context(system_u:object_r:httpd_squid_script_exec_t,s0)
--- nsaserefpolicy/policy/modules/services/squid.if 2007-03-26 10:39:04.000000000 -0400
+++ serefpolicy-2.5.12/policy/modules/services/squid.if 2007-04-11 17:07:34.000000000 -0400
@@ -36,7 +36,7 @@
')
files_search_etc($1)
- allow $1 squid_conf_t:file read_file_perms;
+ read_files_pattern($1, squid_conf_t, squid_conf_t)
')
########################################
@@ -112,3 +112,23 @@
interface(`squid_use',`
refpolicywarn(`$0($*) has been deprecated.')
')
+
+########################################
+## <summary>
+## dontaudit search squid cache dirs
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+## <rolecap/>
+#
+interface(`squid_dontaudit_search_squid_cache',`
+ gen_require(`
+ type squid_cache_t;
+ ')
+
+ dontaudit $1 squid_cache_t:dir search_dir_perms;
+')
+
--- nsaserefpolicy/policy/modules/services/squid.te 2007-03-26 16:24:12.000000000 -0400
+++ serefpolicy-2.5.12/policy/modules/services/squid.te 2007-04-11 17:07:34.000000000 -0400
@@ -89,6 +89,8 @@
corenet_tcp_bind_ftp_port(squid_t)
corenet_tcp_bind_gopher_port(squid_t)
corenet_udp_bind_gopher_port(squid_t)
+corenet_tcp_bind_squid_port(squid_t)
+corenet_udp_bind_squid_port(squid_t)
corenet_tcp_connect_ftp_port(squid_t)
corenet_tcp_connect_gopher_port(squid_t)
corenet_tcp_connect_http_port(squid_t)
@@ -98,6 +100,7 @@
corenet_sendrecv_gopher_client_packets(squid_t)
corenet_sendrecv_http_cache_server_packets(squid_t)
corenet_sendrecv_http_cache_client_packets(squid_t)
+corenet_sendrecv_squid_client_packets(squid_t)
dev_read_sysfs(squid_t)
dev_read_urand(squid_t)
@@ -181,3 +184,12 @@
#squid requires the following when run in diskd mode, the recommended setting
allow squid_t tmpfs_t:file { read write };
') dnl end TODO
+
+optional_policy(`
+ apache_content_template(squid)
+ corenet_tcp_connect_http_cache_port(httpd_squid_script_t)
+ squid_read_config(httpd_squid_script_t)
+ allow httpd_squid_script_t self:tcp_socket create_socket_perms;
+ sysnet_read_config(httpd_squid_script_t)
+ corenet_non_ipsec_sendrecv(httpd_squid_script_t)
+')
--- nsaserefpolicy/policy/modules/services/snmp.te 2007-03-26 10:39:04.000000000 -0400
+++ serefpolicy-2.5.12/policy/modules/services/snmp.te 2007-04-11 17:07:34.000000000 -0400
@@ -134,6 +134,11 @@
')
optional_policy(`
+ mta_read_config(snmpd_t)
+ mta_search_queue(snmpd_t)
+')
+
+optional_policy(`
nis_use_ypbind(snmpd_t)
')
@@ -146,9 +151,19 @@
')
optional_policy(`
+ sendmail_read_log(snmpd_t)
+')
+
+optional_policy(`
seutil_sigchld_newrole(snmpd_t)
')
optional_policy(`
+ squid_read_config(snmpd_t)
+')
+
+optional_policy(`
udev_read_db(snmpd_t)
')
+
+
--- nsaserefpolicy/policy/modules/services/dovecot.te 2007-03-20 23:38:12.000000000 -0400
+++ serefpolicy-2.5.12/policy/modules/services/dovecot.te 2007-04-11 17:07:34.000000000 -0400
@@ -46,6 +46,7 @@
allow dovecot_t self:tcp_socket create_stream_socket_perms;
allow dovecot_t self:unix_dgram_socket create_socket_perms;
allow dovecot_t self:unix_stream_socket { create_stream_socket_perms connectto };
+allow dovecot_t self:netlink_route_socket r_netlink_socket_perms;
domtrans_pattern(dovecot_t, dovecot_auth_exec_t, dovecot_auth_t)
@@ -140,6 +141,10 @@
udev_read_db(dovecot_t)
')
+optional_policy(`
+ squid_dontaudit_search_squid_cache(dovecot_t)
+')
+
########################################
#
# dovecot auth local policy
--- nsaserefpolicy/policy/modules/services/apache.fc 2007-02-23 16:50:01.000000000 -0500
+++ serefpolicy-2.5.12/policy/modules/services/apache.fc 2007-04-11 17:07:34.000000000 -0400
@@ -21,7 +16,6 @@
/usr/lib/apache-ssl/.+ -- gen_context(system_u:object_r:httpd_exec_t,s0)
/usr/lib/cgi-bin(/.*)? gen_context(system_u:object_r:httpd_sys_script_exec_t,s0)
-/usr/lib/squid/cachemgr\.cgi -- gen_context(system_u:object_r:httpd_exec_t,s0)
/usr/lib(64)?/apache(/.*)? gen_context(system_u:object_r:httpd_modules_t,s0)
/usr/lib(64)?/apache2/modules(/.*)? gen_context(system_u:object_r:httpd_modules_t,s0)
/usr/lib(64)?/apache(2)?/suexec(2)? -- gen_context(system_u:object_r:httpd_suexec_exec_t,s0)
--- nsaserefpolicy/policy/modules/kernel/corenetwork.te.in 2007-04-11 15:52:53.000000000 -0400
+++ serefpolicy-2.5.12/policy/modules/kernel/corenetwork.te.in 2007-04-17 15:19:50.000000000 -0400
@@ -140,6 +147,7 @@
network_port(soundd, tcp,8000,s0, tcp,9433,s0)
type socks_port_t, port_type; dnl network_port(socks) # no defined portcon
type stunnel_port_t, port_type; dnl network_port(stunnel) # no defined portcon in current strict
+network_port(squid, udp,3401,s0, tcp,3401,s0, udp,4827,s0, tcp,4827,s0, )
network_port(swat, tcp,901,s0)
network_port(syslogd, udp,514,s0)
network_port(telnetd, tcp,23,s0)
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: squid patch
2007-04-19 15:08 squid patch Daniel J Walsh
@ 2007-05-03 15:00 ` Christopher J. PeBenito
2007-05-03 18:39 ` Karl MacMillan
2007-05-07 13:39 ` Christopher J. PeBenito
1 sibling, 1 reply; 6+ messages in thread
From: Christopher J. PeBenito @ 2007-05-03 15:00 UTC (permalink / raw)
To: Daniel J Walsh; +Cc: SE Linux
On Thu, 2007-04-19 at 11:08 -0400, Daniel J Walsh wrote:
> @@ -181,3 +184,12 @@
> #squid requires the following when run in diskd mode, the recommended setting
> allow squid_t tmpfs_t:file { read write };
> ') dnl end TODO
> +
> +optional_policy(`
> + apache_content_template(squid)
> + corenet_tcp_connect_http_cache_port(httpd_squid_script_t)
> + squid_read_config(httpd_squid_script_t)
> + allow httpd_squid_script_t self:tcp_socket create_socket_perms;
> + sysnet_read_config(httpd_squid_script_t)
> + corenet_non_ipsec_sendrecv(httpd_squid_script_t)
> +')
This brings up a problem to which I currently don't have a good
solution. Due to the encapsulation, the squid module doesn't actually
know how many types are created or their names when using
apache_content_template(), so httpd_squid_script_t can't be used here.
--
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: squid patch
2007-05-03 15:00 ` Christopher J. PeBenito
@ 2007-05-03 18:39 ` Karl MacMillan
0 siblings, 0 replies; 6+ messages in thread
From: Karl MacMillan @ 2007-05-03 18:39 UTC (permalink / raw)
To: Christopher J. PeBenito; +Cc: Daniel J Walsh, SE Linux
On Thu, 2007-05-03 at 15:00 +0000, Christopher J. PeBenito wrote:
> On Thu, 2007-04-19 at 11:08 -0400, Daniel J Walsh wrote:
> > @@ -181,3 +184,12 @@
> > #squid requires the following when run in diskd mode, the recommended setting
> > allow squid_t tmpfs_t:file { read write };
> > ') dnl end TODO
> > +
> > +optional_policy(`
> > + apache_content_template(squid)
> > + corenet_tcp_connect_http_cache_port(httpd_squid_script_t)
> > + squid_read_config(httpd_squid_script_t)
> > + allow httpd_squid_script_t self:tcp_socket create_socket_perms;
> > + sysnet_read_config(httpd_squid_script_t)
> > + corenet_non_ipsec_sendrecv(httpd_squid_script_t)
> > +')
>
> This brings up a problem to which I currently don't have a good
> solution. Due to the encapsulation, the squid module doesn't actually
> know how many types are created or their names when using
> apache_content_template(), so httpd_squid_script_t can't be used here.
>
Yeah - there isn't really a good solution. You could argue that the
types are actually for the squid module (otherwise it would be an
interface rather than a template), but you still have the problem that a
change to the template could result in different types.
We should think about this for when interfaces are pushed into the
language.
Karl
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: squid patch
2007-04-19 15:08 squid patch Daniel J Walsh
2007-05-03 15:00 ` Christopher J. PeBenito
@ 2007-05-07 13:39 ` Christopher J. PeBenito
2007-05-07 14:47 ` Daniel J Walsh
1 sibling, 1 reply; 6+ messages in thread
From: Christopher J. PeBenito @ 2007-05-07 13:39 UTC (permalink / raw)
To: Daniel J Walsh; +Cc: SE Linux
On Thu, 2007-04-19 at 11:08 -0400, Daniel J Walsh wrote:
> Added httpd_squid_script_t
>
> squid_conf_t can be a directory
> Squid also needs additional ports to communicate with
>
> dovecot and snmp try to read squid files. (Snuck in a couple of other
> fixes for dovecot and snmp)
Merged except for the apache template, plus:
> +interface(`squid_dontaudit_search_squid_cache',`
> + gen_require(`
> + type squid_cache_t;
> + ')
> +
> + dontaudit $1 squid_cache_t:dir search_dir_perms;
> +')
Dropped the second squid in the name.
> --- nsaserefpolicy/policy/modules/services/snmp.te 2007-03-26 10:39:04.000000000 -0400
> +++ serefpolicy-2.5.12/policy/modules/services/snmp.te 2007-04-11 17:07:34.000000000 -0400
> @@ -134,6 +134,11 @@
> ')
>
> optional_policy(`
> + mta_read_config(snmpd_t)
> + mta_search_queue(snmpd_t)
> +')
The second interface is missing.
> optional_policy(`
> + sendmail_read_log(snmpd_t)
> +')
This one is missing too.
--
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: squid patch
2007-05-07 13:39 ` Christopher J. PeBenito
@ 2007-05-07 14:47 ` Daniel J Walsh
2007-05-15 18:00 ` Christopher J. PeBenito
0 siblings, 1 reply; 6+ messages in thread
From: Daniel J Walsh @ 2007-05-07 14:47 UTC (permalink / raw)
To: Christopher J. PeBenito; +Cc: SE Linux
[-- Attachment #1: Type: text/plain, Size: 1391 bytes --]
Christopher J. PeBenito wrote:
> On Thu, 2007-04-19 at 11:08 -0400, Daniel J Walsh wrote:
>
>> Added httpd_squid_script_t
>>
>> squid_conf_t can be a directory
>> Squid also needs additional ports to communicate with
>>
>> dovecot and snmp try to read squid files. (Snuck in a couple of other
>> fixes for dovecot and snmp)
>>
>
> Merged except for the apache template, plus:
>
>
>> +interface(`squid_dontaudit_search_squid_cache',`
>> + gen_require(`
>> + type squid_cache_t;
>> + ')
>> +
>> + dontaudit $1 squid_cache_t:dir search_dir_perms;
>> +')
>>
>
> Dropped the second squid in the name.
>
>
>> --- nsaserefpolicy/policy/modules/services/snmp.te 2007-03-26 10:39:04.000000000 -0400
>> +++ serefpolicy-2.5.12/policy/modules/services/snmp.te 2007-04-11 17:07:34.000000000 -0400
>> @@ -134,6 +134,11 @@
>> ')
>>
>> optional_policy(`
>> + mta_read_config(snmpd_t)
>> + mta_search_queue(snmpd_t)
>> +')
>>
>
> The second interface is missing.
>
>
>> optional_policy(`
>> + sendmail_read_log(snmpd_t)
>> +')
>>
>
> This one is missing too.
>
>
Ok here is an updated patch with the missing interfaces.
snmp is trying to execute sys_module, we are dontauditing
Switched from using nis_use_ypbind to nsswitch, since snmp is using nsswitch
Also sneaking in a fix for manage sendmail_log_t.
[-- Attachment #2: snmp.patch --]
[-- Type: text/x-patch, Size: 2613 bytes --]
--- nsaserefpolicy/policy/modules/services/snmp.te 2007-05-07 10:32:44.000000000 -0400
+++ serefpolicy-2.6.3/policy/modules/services/snmp.te 2007-05-07 10:36:03.000000000 -0400
@@ -26,7 +26,7 @@
# Local policy
#
allow snmpd_t self:capability { dac_override kill net_admin sys_nice sys_tty_config };
-dontaudit snmpd_t self:capability sys_tty_config;
+dontaudit snmpd_t self:capability { sys_module sys_tty_config };
allow snmpd_t self:fifo_file rw_fifo_file_perms;
allow snmpd_t self:unix_dgram_socket create_socket_perms;
allow snmpd_t self:unix_stream_socket create_stream_socket_perms;
@@ -135,18 +135,19 @@
optional_policy(`
mta_read_config(snmpd_t)
+ mta_search_queue(snmpd_t)
')
optional_policy(`
- nis_use_ypbind(snmpd_t)
+ auth_use_nsswitch(snmpd_t)
')
optional_policy(`
- nscd_socket_use(snmpd_t)
+ rpc_search_nfs_state_data(snmpd_t)
')
optional_policy(`
- rpc_search_nfs_state_data(snmpd_t)
+ sendmail_read_log(snmpd_t)
')
optional_policy(`
--- nsaserefpolicy/policy/modules/services/mta.if 2007-03-26 10:39:04.000000000 -0400
+++ serefpolicy-2.6.3/policy/modules/services/mta.if 2007-05-07 10:36:03.000000000 -0400
@@ -847,6 +847,25 @@
manage_files_pattern($1,mqueue_spool_t,mqueue_spool_t)
')
+########################################
+## <summary>
+## search mail queue dirs.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`mta_search_queue',`
+ gen_require(`
+ type mqueue_spool_t;
+ ')
+
+ files_search_spool($1)
+ allow $1 mqueue_spool_t:dir search_dir_perms;
+')
+
#######################################
## <summary>
## Read sendmail binary.
--- nsaserefpolicy/policy/modules/services/sendmail.if 2006-11-16 17:15:21.000000000 -0500
+++ serefpolicy-2.6.3/policy/modules/services/sendmail.if 2007-05-07 10:36:03.000000000 -0400
@@ -76,6 +76,26 @@
########################################
## <summary>
+## read sendmail logs.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+## <rolecap/>
+#
+interface(`sendmail_read_log',`
+ gen_require(`
+ type sendmail_log_t;
+ ')
+
+ logging_search_logs($1)
+ read_files_pattern($1, sendmail_log_t, sendmail_log_t)
+')
+
+########################################
+## <summary>
## Create, read, write, and delete sendmail logs.
## </summary>
## <param name="domain">
@@ -91,7 +111,7 @@
')
logging_search_logs($1)
- allow $1 sendmail_log_t:file manage_file_perms;
+ manage_files_pattern($1, sendmail_log_t, sendmail_log_t)
')
########################################
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: squid patch
2007-05-07 14:47 ` Daniel J Walsh
@ 2007-05-15 18:00 ` Christopher J. PeBenito
0 siblings, 0 replies; 6+ messages in thread
From: Christopher J. PeBenito @ 2007-05-15 18:00 UTC (permalink / raw)
To: Daniel J Walsh; +Cc: SE Linux
On Mon, 2007-05-07 at 10:47 -0400, Daniel J Walsh wrote:
> Ok here is an updated patch with the missing interfaces.
>
> snmp is trying to execute sys_module, we are dontauditing
>
> Switched from using nis_use_ypbind to nsswitch, since snmp is using nsswitch
>
> Also sneaking in a fix for manage sendmail_log_t.
Merged.
--
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2007-05-15 18:01 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2007-04-19 15:08 squid patch Daniel J Walsh
2007-05-03 15:00 ` Christopher J. PeBenito
2007-05-03 18:39 ` Karl MacMillan
2007-05-07 13:39 ` Christopher J. PeBenito
2007-05-07 14:47 ` Daniel J Walsh
2007-05-15 18:00 ` Christopher J. PeBenito
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.