[PATCH] refpolicy: kernel_kernel changes

[PATCH] refpolicy: kernel_kernel changes

[dwalsh]

Additional interfaces for kernel access

--- nsaserefpolicy/policy/modules/kernel/kernel.if	2007-07-03 07:05:38.000000000 -0400
+++ serefpolicy-3.0.5/policy/modules/kernel/kernel.if	2007-08-02 11:02:02.000000000 -0400
@@ -108,6 +108,24 @@
 
 ########################################
 ## <summary>
+##	Set the process scheduler of kernel threads.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`kernel_setsched',`
+	gen_require(`
+		type kernel_t;
+	')
+
+	allow $1 kernel_t:process setsched;
+')
+
+########################################
+## <summary>
 ##	Send a SIGCHLD signal to kernel threads.
 ## </summary>
 ## <param name="domain">
@@ -1848,6 +1866,27 @@
 
 ########################################
 ## <summary>
+##	Read the process state (/proc/pid) of all unlabeled_t.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`kernel_read_unlabeled_state',`
+	gen_require(`
+		type unlabeled_t;
+	')
+
+	allow $1 unlabeled_t:dir list_dir_perms;
+	read_files_pattern($1,unlabeled_t,unlabeled_t)
+	read_lnk_files_pattern($1,unlabeled_t,unlabeled_t)
+')
+
+
+########################################
+## <summary>
 ##	Do not audit attempts to list unlabeled directories.
 ## </summary>
 ## <param name="domain">
--- nsaserefpolicy/policy/modules/kernel/kernel.te	2007-07-25 10:37:36.000000000 -0400
+++ serefpolicy-3.0.5/policy/modules/kernel/kernel.te	2007-08-02 11:02:02.000000000 -0400
@@ -26,9 +26,6 @@
 role staff_r;
 role user_r;
 
-# here until order dependence is fixed:
-role unconfined_r;
-
 ifdef(`enable_mls',`
 	role secadm_r;
 	role auditadm_r;
@@ -278,6 +275,7 @@
 
 optional_policy(`
 	logging_send_syslog_msg(kernel_t)
+	logging_unconfined(kernel_t)
 ')
 
 optional_policy(`

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: [PATCH] refpolicy: kernel_kernel changes

[Christopher J. PeBenito]

On Thu, 2007-08-02 at 16:04 -0400, dwalsh@redhat.com wrote:
> Additional interfaces for kernel access
> 
> @@ -1848,6 +1866,27 @@
> 
>  ########################################
>  ## <summary>
> +##     Read the process state (/proc/pid) of all unlabeled_t.
> +## </summary>
> +## <param name="domain">
> +##     <summary>
> +##     Domain allowed access.
> +##     </summary>
> +## </param>
> +#
> +interface(`kernel_read_unlabeled_state',`
> +       gen_require(`
> +               type unlabeled_t;
> +       ')
> +
> +       allow $1 unlabeled_t:dir list_dir_perms;
> +       read_files_pattern($1,unlabeled_t,unlabeled_t)
> +       read_lnk_files_pattern($1,unlabeled_t,unlabeled_t)
> +')

I'm concerned about this interface since unlabled_t is used for domains
and objects.  Someone using this interface might not realize the
specified domain can now also read other unlabeled files.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: [PATCH] refpolicy: kernel_kernel changes

[Daniel J Walsh]

Christopher J. PeBenito wrote:
> On Thu, 2007-08-02 at 16:04 -0400, dwalsh@redhat.com wrote:
>   
>> Additional interfaces for kernel access
>>
>> @@ -1848,6 +1866,27 @@
>>
>>  ########################################
>>  ## <summary>
>> +##     Read the process state (/proc/pid) of all unlabeled_t.
>> +## </summary>
>> +## <param name="domain">
>> +##     <summary>
>> +##     Domain allowed access.
>> +##     </summary>
>> +## </param>
>> +#
>> +interface(`kernel_read_unlabeled_state',`
>> +       gen_require(`
>> +               type unlabeled_t;
>> +       ')
>> +
>> +       allow $1 unlabeled_t:dir list_dir_perms;
>> +       read_files_pattern($1,unlabeled_t,unlabeled_t)
>> +       read_lnk_files_pattern($1,unlabeled_t,unlabeled_t)
>> +')
>>     
>
> I'm concerned about this interface since unlabled_t is used for domains
> and objects.  Someone using this interface might not realize the
> specified domain can now also read other unlabeled files.
>
>   
The only domain that gets assigned this is sysadm_t.  I believe this was 
needed in order to kill processes that were in the unlabeled state.  For 
example if a sysadm unloads a policy file for a running process.  The 
process goes wild eating up all of cpu, and he can't kill it or even see 
which process is causing the problem.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: [PATCH] refpolicy: kernel_kernel changes

[Christopher J. PeBenito]

On Fri, 2007-08-10 at 09:17 -0400, Daniel J Walsh wrote:
> Christopher J. PeBenito wrote:
> > On Thu, 2007-08-02 at 16:04 -0400, dwalsh@redhat.com wrote:
> >   
> >> Additional interfaces for kernel access
> >>
> >> @@ -1848,6 +1866,27 @@
> >>
> >>  ########################################
> >>  ## <summary>
> >> +##     Read the process state (/proc/pid) of all unlabeled_t.
> >> +## </summary>
> >> +## <param name="domain">
> >> +##     <summary>
> >> +##     Domain allowed access.
> >> +##     </summary>
> >> +## </param>
> >> +#
> >> +interface(`kernel_read_unlabeled_state',`
> >> +       gen_require(`
> >> +               type unlabeled_t;
> >> +       ')
> >> +
> >> +       allow $1 unlabeled_t:dir list_dir_perms;
> >> +       read_files_pattern($1,unlabeled_t,unlabeled_t)
> >> +       read_lnk_files_pattern($1,unlabeled_t,unlabeled_t)
> >> +')
> >>     
> >
> > I'm concerned about this interface since unlabled_t is used for domains
> > and objects.  Someone using this interface might not realize the
> > specified domain can now also read other unlabeled files.
> >
> >   
> The only domain that gets assigned this is sysadm_t.  I believe this was 
> needed in order to kill processes that were in the unlabeled state.  For 
> example if a sysadm unloads a policy file for a running process.  The 
> process goes wild eating up all of cpu, and he can't kill it or even see 
> which process is causing the problem.

I suppose we should turn this into a read unlabeled files interface
instead.  That makes it clear that they can read unlabeled files.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.