* logwatch tries to look at avahi, avahi needs to use winbind
@ 2007-04-20 18:54 dwalsh
2007-05-02 17:52 ` Christopher J. PeBenito
0 siblings, 1 reply; 4+ messages in thread
From: dwalsh @ 2007-04-20 18:54 UTC (permalink / raw)
To: cpebenito; +Cc: selinux
--- nsaserefpolicy/policy/modules/admin/logwatch.te 2007-04-10 12:52:58.000000000 -0400
+++ serefpolicy-2.5.12/policy/modules/admin/logwatch.te 2007-04-11 17:07:34.000000000 -0400
@@ -95,6 +95,10 @@
')
optional_policy(`
+ avahi_dontaudit_search_pid(logwatch_t)
+')
+
+optional_policy(`
bind_read_config(logwatch_t)
bind_read_zone(logwatch_t)
')
--- nsaserefpolicy/policy/modules/services/avahi.if 2007-01-02 12:57:43.000000000 -0500
+++ serefpolicy-2.5.12/policy/modules/services/avahi.if 2007-04-11 17:07:34.000000000 -0400
@@ -39,3 +39,22 @@
files_search_pids($1)
stream_connect_pattern($1,avahi_var_run_t,avahi_var_run_t,avahi_t)
')
+
+########################################
+## <summary>
+## Do not audit attempts to search the AVAHI pid directory.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`avahi_dontaudit_search_pid',`
+ gen_require(`
+ type avahi_var_run_t;
+ ')
+
+ dontaudit $1 avahi_var_run_t:dir search_dir_perms;
+')
+
--- nsaserefpolicy/policy/modules/services/avahi.te 2007-03-20 23:38:05.000000000 -0400
+++ serefpolicy-2.5.12/policy/modules/services/avahi.te 2007-04-18 16:04:51.000000000 -0400
@@ -105,3 +105,7 @@
optional_policy(`
udev_read_db(avahi_t)
')
+
+optional_policy(`
+ samba_stream_connect_winbind(avahi_t)
+')
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: logwatch tries to look at avahi, avahi needs to use winbind
2007-04-20 18:54 logwatch tries to look at avahi, avahi needs to use winbind dwalsh
@ 2007-05-02 17:52 ` Christopher J. PeBenito
2007-05-02 20:25 ` Daniel J Walsh
0 siblings, 1 reply; 4+ messages in thread
From: Christopher J. PeBenito @ 2007-05-02 17:52 UTC (permalink / raw)
To: dwalsh; +Cc: selinux
On Fri, 2007-04-20 at 14:54 -0400, dwalsh@redhat.com wrote:
> --- nsaserefpolicy/policy/modules/admin/logwatch.te 2007-04-10 12:52:58.000000000 -0400
> +++ serefpolicy-2.5.12/policy/modules/admin/logwatch.te 2007-04-11 17:07:34.000000000 -0400
> @@ -95,6 +95,10 @@
> ')
>
> optional_policy(`
> + avahi_dontaudit_search_pid(logwatch_t)
> +')
> +
> +optional_policy(`
> bind_read_config(logwatch_t)
> bind_read_zone(logwatch_t)
> ')
> --- nsaserefpolicy/policy/modules/services/avahi.if 2007-01-02 12:57:43.000000000 -0500
> +++ serefpolicy-2.5.12/policy/modules/services/avahi.if 2007-04-11 17:07:34.000000000 -0400
> @@ -39,3 +39,22 @@
> files_search_pids($1)
> stream_connect_pattern($1,avahi_var_run_t,avahi_var_run_t,avahi_t)
> ')
> +
> +########################################
> +## <summary>
> +## Do not audit attempts to search the AVAHI pid directory.
> +## </summary>
> +## <param name="domain">
> +## <summary>
> +## Domain allowed access.
> +## </summary>
> +## </param>
> +#
> +interface(`avahi_dontaudit_search_pid',`
> + gen_require(`
> + type avahi_var_run_t;
> + ')
> +
> + dontaudit $1 avahi_var_run_t:dir search_dir_perms;
> +')
> +
> --- nsaserefpolicy/policy/modules/services/avahi.te 2007-03-20 23:38:05.000000000 -0400
> +++ serefpolicy-2.5.12/policy/modules/services/avahi.te 2007-04-18 16:04:51.000000000 -0400
> @@ -105,3 +105,7 @@
> optional_policy(`
> udev_read_db(avahi_t)
> ')
> +
> +optional_policy(`
> + samba_stream_connect_winbind(avahi_t)
> +')
Merged except for this last part. I can't find any reference in the
avahi code or wiki for it connecting to windbind.
--
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: logwatch tries to look at avahi, avahi needs to use winbind
2007-05-02 17:52 ` Christopher J. PeBenito
@ 2007-05-02 20:25 ` Daniel J Walsh
2007-05-03 12:40 ` Christopher J. PeBenito
0 siblings, 1 reply; 4+ messages in thread
From: Daniel J Walsh @ 2007-05-02 20:25 UTC (permalink / raw)
To: Christopher J. PeBenito; +Cc: selinux
[-- Attachment #1: Type: text/plain, Size: 1843 bytes --]
Christopher J. PeBenito wrote:
> On Fri, 2007-04-20 at 14:54 -0400, dwalsh@redhat.com wrote:
>
>> --- nsaserefpolicy/policy/modules/admin/logwatch.te 2007-04-10 12:52:58.000000000 -0400
>> +++ serefpolicy-2.5.12/policy/modules/admin/logwatch.te 2007-04-11 17:07:34.000000000 -0400
>> @@ -95,6 +95,10 @@
>> ')
>>
>> optional_policy(`
>> + avahi_dontaudit_search_pid(logwatch_t)
>> +')
>> +
>> +optional_policy(`
>> bind_read_config(logwatch_t)
>> bind_read_zone(logwatch_t)
>> ')
>> --- nsaserefpolicy/policy/modules/services/avahi.if 2007-01-02 12:57:43.000000000 -0500
>> +++ serefpolicy-2.5.12/policy/modules/services/avahi.if 2007-04-11 17:07:34.000000000 -0400
>> @@ -39,3 +39,22 @@
>> files_search_pids($1)
>> stream_connect_pattern($1,avahi_var_run_t,avahi_var_run_t,avahi_t)
>> ')
>> +
>> +########################################
>> +## <summary>
>> +## Do not audit attempts to search the AVAHI pid directory.
>> +## </summary>
>> +## <param name="domain">
>> +## <summary>
>> +## Domain allowed access.
>> +## </summary>
>> +## </param>
>> +#
>> +interface(`avahi_dontaudit_search_pid',`
>> + gen_require(`
>> + type avahi_var_run_t;
>> + ')
>> +
>> + dontaudit $1 avahi_var_run_t:dir search_dir_perms;
>> +')
>> +
>> --- nsaserefpolicy/policy/modules/services/avahi.te 2007-03-20 23:38:05.000000000 -0400
>> +++ serefpolicy-2.5.12/policy/modules/services/avahi.te 2007-04-18 16:04:51.000000000 -0400
>> @@ -105,3 +105,7 @@
>> optional_policy(`
>> udev_read_db(avahi_t)
>> ')
>> +
>> +optional_policy(`
>> + samba_stream_connect_winbind(avahi_t)
>> +')
>>
>
> Merged except for this last part. I can't find any reference in the
> avahi code or wiki for it connecting to windbind.
>
>
Right, turns out avahi uses nsswitch, and this is causing the avc.
Attached patch to switch to using nsswitch.
[-- Attachment #2: avahi.patch --]
[-- Type: text/x-patch, Size: 1114 bytes --]
--- nsaserefpolicy/policy/modules/services/avahi.te 2007-05-02 15:04:46.000000000 -0400
+++ serefpolicy-2.6.3/policy/modules/services/avahi.te 2007-05-02 15:19:03.000000000 -0400
@@ -24,7 +24,6 @@
allow avahi_t self:fifo_file { read write };
allow avahi_t self:unix_stream_socket { connectto create_stream_socket_perms };
allow avahi_t self:unix_dgram_socket create_socket_perms;
-allow avahi_t self:netlink_route_socket r_netlink_socket_perms;
allow avahi_t self:tcp_socket create_stream_socket_perms;
allow avahi_t self:udp_socket create_socket_perms;
@@ -73,10 +72,8 @@
logging_send_syslog_msg(avahi_t)
miscfiles_read_localization(avahi_t)
-miscfiles_read_certs(avahi_t)
sysnet_read_config(avahi_t)
-sysnet_use_ldap(avahi_t)
userdom_dontaudit_use_unpriv_user_fds(avahi_t)
userdom_dontaudit_search_sysadm_home_dirs(avahi_t)
@@ -95,13 +92,13 @@
')
optional_policy(`
- nis_use_ypbind(avahi_t)
+ seutil_sigchld_newrole(avahi_t)
')
optional_policy(`
- seutil_sigchld_newrole(avahi_t)
+ udev_read_db(avahi_t)
')
optional_policy(`
- udev_read_db(avahi_t)
+ auth_use_nsswitch(avahi_t)
')
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: logwatch tries to look at avahi, avahi needs to use winbind
2007-05-02 20:25 ` Daniel J Walsh
@ 2007-05-03 12:40 ` Christopher J. PeBenito
0 siblings, 0 replies; 4+ messages in thread
From: Christopher J. PeBenito @ 2007-05-03 12:40 UTC (permalink / raw)
To: Daniel J Walsh; +Cc: selinux
On Wed, 2007-05-02 at 16:25 -0400, Daniel J Walsh wrote:
> Christopher J. PeBenito wrote:
> > On Fri, 2007-04-20 at 14:54 -0400, dwalsh@redhat.com wrote:
> >> --- nsaserefpolicy/policy/modules/services/avahi.te 2007-03-20 23:38:05.000000000 -0400
> >> +++ serefpolicy-2.5.12/policy/modules/services/avahi.te 2007-04-18 16:04:51.000000000 -0400
> >> @@ -105,3 +105,7 @@
> >> optional_policy(`
> >> udev_read_db(avahi_t)
> >> ')
> >> +
> >> +optional_policy(`
> >> + samba_stream_connect_winbind(avahi_t)
> >> +')
> >>
> >
> > Merged except for this last part. I can't find any reference in the
> > avahi code or wiki for it connecting to windbind.
>
> Right, turns out avahi uses nsswitch, and this is causing the avc.
> Attached patch to switch to using nsswitch.
Merged, except I made it unconditional, since I see usage of getpwnam()
and getgrnam() in main.c of avahi-daemon.
--
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2007-05-03 12:40 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2007-04-20 18:54 logwatch tries to look at avahi, avahi needs to use winbind dwalsh
2007-05-02 17:52 ` Christopher J. PeBenito
2007-05-02 20:25 ` Daniel J Walsh
2007-05-03 12:40 ` Christopher J. PeBenito
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.