alsactl policy

alsactl policy

[Martin Orr]

Here's a new version of the patch I sent a while ago to add policy for
alsactl.  This is run from an init script to set set volume levels on
boot.  At least on Debian and Fedora, it is also run by udev when a
sound card is detected.

Index: policy/modules/admin/alsa.te
===================================================================
--- policy/modules/admin/alsa.te	(revision 2411)
+++ policy/modules/admin/alsa.te	(working copy)
@@ -8,12 +8,18 @@
 
 type alsa_t;
 type alsa_exec_t;
-application_domain(alsa_t, alsa_exec_t)
+init_system_domain(alsa_t, alsa_exec_t)
 role system_r types alsa_t;
 
 type alsa_etc_rw_t;
 files_type(alsa_etc_rw_t)
 
+type alsa_var_lib_t;
+files_type(alsa_var_lib_t)
+
+type alsa_state_t;
+files_type(alsa_state_t)
+
 ########################################
 #
 # Local policy
@@ -30,9 +36,23 @@
 manage_lnk_files_pattern(alsa_t,alsa_etc_rw_t,alsa_etc_rw_t)
 
 files_read_etc_files(alsa_t)
+files_read_usr_files(alsa_t)
+files_search_pids(alsa_t)
 
+allow alsa_t alsa_state_t:file manage_file_perms;
+ifdef(`distro_debian',`
+	files_search_var_lib(alsa_t)
+	filetrans_pattern(alsa_t,alsa_var_lib_t,alsa_state_t,file)
+',`
+	files_etc_filetrans(alsa_t,alsa_state_t,file)
+')
+
+dev_read_sound(alsa_t)
+dev_write_sound(alsa_t)
+
 term_use_generic_ptys(alsa_t)
 term_dontaudit_use_unallocated_ttys(alsa_t)
+init_dontaudit_use_fds(alsa_t)
 
 libs_use_ld_so(alsa_t)
 libs_use_shared_libs(alsa_t)
@@ -43,6 +63,7 @@
 
 userdom_manage_unpriv_user_semaphores(alsa_t)
 userdom_manage_unpriv_user_shared_mem(alsa_t)
+userdom_search_generic_user_home_dirs(alsa_t)
 
 optional_policy(`
 	nscd_socket_use(alsa_t)
Index: policy/modules/admin/alsa.if
===================================================================
--- policy/modules/admin/alsa.if	(revision 2411)
+++ policy/modules/admin/alsa.if	(working copy)
@@ -74,3 +74,26 @@
 	read_files_pattern($1,alsa_etc_rw_t,alsa_etc_rw_t)
 	read_lnk_files_pattern($1,alsa_etc_rw_t,alsa_etc_rw_t)
 ')
+
+########################################
+## <summary>
+##	Read alsa state file.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`alsa_read_state',`
+	gen_require(`
+		type alsa_state_t, alsa_var_lib_t;
+	')
+	ifdef(`distro_debian',`
+		files_search_var_lib($1)
+		read_files_pattern($1,alsa_var_lib_t,alsa_state_t)
+	',`
+		files_search_etc($1)
+		allow $1 alsa_state_t:file read_file_perms;
+	')
+')
Index: policy/modules/admin/alsa.fc
===================================================================
--- policy/modules/admin/alsa.fc	(revision 2411)
+++ policy/modules/admin/alsa.fc	(working copy)
@@ -1,4 +1,10 @@
 
 /etc/alsa/pcm(/.*)?		gen_context(system_u:object_r:alsa_etc_rw_t,s0)
 
+/etc/(alsa/)?asound\.state --	gen_context(system_u:object_r:alsa_state_t,s0)
+/var/lib/alsa		-d	gen_context(system_u:object_r:alsa_var_lib_t,s0)
+/var/lib/alsa/asound.state --	gen_context(system_u:object_r:alsa_state_t,s0)
+
 /usr/bin/ainit 		--	gen_context(system_u:object_r:alsa_exec_t,s0)
+/usr/sbin/alsactl	--	gen_context(system_u:object_r:alsa_exec_t,s0)
+/usr/bin/amixer		--	gen_context(system_u:object_r:alsa_exec_t,s0)
Index: policy/modules/system/udev.te
===================================================================
--- policy/modules/system/udev.te	(revision 2411)
+++ policy/modules/system/udev.te	(working copy)
@@ -190,6 +190,11 @@
 ')
 
 optional_policy(`
+	alsa_domtrans(udev_t)
+	alsa_read_state(udev_t)
+')
+
+optional_policy(`
 	brctl_domtrans(udev_t)
 ')
 

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: alsactl policy

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Martin Orr wrote:
> Here's a new version of the patch I sent a while ago to add policy for
> alsactl.  This is run from an init script to set set volume levels on
> boot.  At least on Debian and Fedora, it is also run by udev when a
> sound card is detected.
> 
> Index: policy/modules/admin/alsa.te
> ===================================================================
> --- policy/modules/admin/alsa.te	(revision 2411)
> +++ policy/modules/admin/alsa.te	(working copy)
> @@ -8,12 +8,18 @@
>  
>  type alsa_t;
>  type alsa_exec_t;
> -application_domain(alsa_t, alsa_exec_t)
> +init_system_domain(alsa_t, alsa_exec_t)
>  role system_r types alsa_t;
>  
>  type alsa_etc_rw_t;
>  files_type(alsa_etc_rw_t)
>  
> +type alsa_var_lib_t;
> +files_type(alsa_var_lib_t)
> +
> +type alsa_state_t;
> +files_type(alsa_state_t)
> +
We already have alsa_etc_rw_t for this.  So we could either change
alsa_etc_rw_t to this context and typealias it or leave it as rw_t.
Or alternatively just allow alsa to write to alsa_var_lib_t,

Fedora stores asound.state under etc.  Although it probably would be
better in var/lib

I have opened a bugzilla for Fedora to write their asound.state file there.

https://bugzilla.redhat.com/show_bug.cgi?id=293301

>  ########################################
>  #
>  # Local policy
> @@ -30,9 +36,23 @@
>  manage_lnk_files_pattern(alsa_t,alsa_etc_rw_t,alsa_etc_rw_t)
>  
>  files_read_etc_files(alsa_t)
> +files_read_usr_files(alsa_t)
> +files_search_pids(alsa_t)
>  
> +allow alsa_t alsa_state_t:file manage_file_perms;
> +ifdef(`distro_debian',`
> +	files_search_var_lib(alsa_t)
> +	filetrans_pattern(alsa_t,alsa_var_lib_t,alsa_state_t,file)
> +',`
> +	files_etc_filetrans(alsa_t,alsa_state_t,file)
> +')
> +
> +dev_read_sound(alsa_t)
> +dev_write_sound(alsa_t)
> +
>  term_use_generic_ptys(alsa_t)
>  term_dontaudit_use_unallocated_ttys(alsa_t)
> +init_dontaudit_use_fds(alsa_t)
>  
>  libs_use_ld_so(alsa_t)
>  libs_use_shared_libs(alsa_t)
> @@ -43,6 +63,7 @@
>  
>  userdom_manage_unpriv_user_semaphores(alsa_t)
>  userdom_manage_unpriv_user_shared_mem(alsa_t)
> +userdom_search_generic_user_home_dirs(alsa_t)
Probably wrong interface moving forward.  You probably need to allow it
to search all non prived user home dirs.
>  
>  optional_policy(`
>  	nscd_socket_use(alsa_t)
> Index: policy/modules/admin/alsa.if
> ===================================================================
> --- policy/modules/admin/alsa.if	(revision 2411)
> +++ policy/modules/admin/alsa.if	(working copy)
> @@ -74,3 +74,26 @@
>  	read_files_pattern($1,alsa_etc_rw_t,alsa_etc_rw_t)
>  	read_lnk_files_pattern($1,alsa_etc_rw_t,alsa_etc_rw_t)
>  ')
> +
> +########################################
> +## <summary>
> +##	Read alsa state file.
> +## </summary>
> +## <param name="domain">
> +##	<summary>
> +##	Domain allowed access.
> +##	</summary>
> +## </param>
> +#
> +interface(`alsa_read_state',`
> +	gen_require(`
> +		type alsa_state_t, alsa_var_lib_t;
> +	')
> +	ifdef(`distro_debian',`
> +		files_search_var_lib($1)
> +		read_files_pattern($1,alsa_var_lib_t,alsa_state_t)
> +	',`
> +		files_search_etc($1)
> +		allow $1 alsa_state_t:file read_file_perms;
> +	')
> +')
This should change to read lib if you eliminate state_t.


> Index: policy/modules/admin/alsa.fc
> ===================================================================
> --- policy/modules/admin/alsa.fc	(revision 2411)
> +++ policy/modules/admin/alsa.fc	(working copy)
> @@ -1,4 +1,10 @@
>  
>  /etc/alsa/pcm(/.*)?		gen_context(system_u:object_r:alsa_etc_rw_t,s0)
>  
> +/etc/(alsa/)?asound\.state --	gen_context(system_u:object_r:alsa_state_t,s0)
> +/var/lib/alsa		-d	gen_context(system_u:object_r:alsa_var_lib_t,s0)
> +/var/lib/alsa/asound.state --	gen_context(system_u:object_r:alsa_state_t,s0)
> +
/var/lib/alsa(/.*)?	gen_context(system_u:object_r:alsa_var_lib_t,s0)
Would be a lot less error prone.
>  /usr/bin/ainit 		--	gen_context(system_u:object_r:alsa_exec_t,s0)
> +/usr/sbin/alsactl	--	gen_context(system_u:object_r:alsa_exec_t,s0)
/sbin/alsactl on Fedora

> +/usr/bin/amixer		--	gen_context(system_u:object_r:alsa_exec_t,s0)

> Index: policy/modules/system/udev.te
> ===================================================================
> --- policy/modules/system/udev.te	(revision 2411)
> +++ policy/modules/system/udev.te	(working copy)
> @@ -190,6 +190,11 @@
>  ')
>  
>  optional_policy(`
> +	alsa_domtrans(udev_t)
> +	alsa_read_state(udev_t)
> +')
> +
> +optional_policy(`
>  	brctl_domtrans(udev_t)
>  ')
>  
> 
> --
> This message was distributed to subscribers of the selinux mailing list.
> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
> the words "unsubscribe selinux" without quotes as the message.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iD8DBQFG7o1wrlYvE4MpobMRApLpAJsEDfZaayv9e1+cULOZpebxwf0qMQCg1Mn9
3l5j9MGDoafTx8oXRjFAK7s=
=u/Cr
-----END PGP SIGNATURE-----

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: alsactl policy

[Martin Orr]

On 17/09/07 15:21, Daniel J Walsh wrote:
>>  type alsa_etc_rw_t;
>>  files_type(alsa_etc_rw_t)
> 
>> +type alsa_var_lib_t;
>> +files_type(alsa_var_lib_t)
>> +
>> +type alsa_state_t;
>> +files_type(alsa_state_t)
>> +
> We already have alsa_etc_rw_t for this.  So we could either change
> alsa_etc_rw_t to this context and typealias it or leave it as rw_t.
> Or alternatively just allow alsa to write to alsa_var_lib_t,

OK, I thought that alsa_etc_rw_t was for something else.  Since I don't have
any /etc/alsa/pcm directory, I didn't know what it was for.

> Fedora stores asound.state under etc.  Although it probably would be
> better in var/lib
> 
> I have opened a bugzilla for Fedora to write their asound.state file there.
> 
> https://bugzilla.redhat.com/show_bug.cgi?id=293301

There is a bug in the upstream BTS to change this as well:
https://bugtrack.alsa-project.org/alsa-bug/view.php?id=3128

Thanks for your reviewing time,

-- 
Martin Orr

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

alsactl policy

[Martin Orr]

[-- Attachment #1: Type: text/plain, Size: 260 bytes --]

The alsa policy doesn't address alsactl, run from an init script and via a
udev rule whenever a sound device is loaded to set volumes.  This patch
addresses this.  Since I have never written SELinux policy before, all
comments are appreciated.

-- 
Martin Orr

[-- Attachment #2: alsa.diff --]
[-- Type: text/plain, Size: 2458 bytes --]

Index: policy/modules/system/init.te
===================================================================
--- policy/modules/system/init.te	(revision 2373)
+++ policy/modules/system/init.te	(working copy)
@@ -541,6 +541,10 @@
 ')
 
 optional_policy(`
+	alsa_domtrans(initrc_t)
+')
+
+optional_policy(`
 	amavis_search_lib(initrc_t)
 	amavis_setattr_pid_files(initrc_t)
 ')
Index: policy/modules/system/udev.te
===================================================================
--- policy/modules/system/udev.te	(revision 2373)
+++ policy/modules/system/udev.te	(working copy)
@@ -176,6 +176,10 @@
 ')
 
 optional_policy(`
+	alsa_domtrans(udev_t)
+')
+
+optional_policy(`
 	consoletype_exec(udev_t)
 ')
 
Index: policy/modules/admin/alsa.te
===================================================================
--- policy/modules/admin/alsa.te	(revision 2373)
+++ policy/modules/admin/alsa.te	(working copy)
@@ -14,6 +14,9 @@
 type alsa_etc_rw_t;
 files_type(alsa_etc_rw_t)
 
+type alsa_var_lib_t;
+files_type(alsa_var_lib_t)
+
 ########################################
 #
 # Local policy
@@ -30,9 +33,20 @@
 manage_lnk_files_pattern(alsa_t,alsa_etc_rw_t,alsa_etc_rw_t)
 
 files_read_etc_files(alsa_t)
+files_read_usr_files(alsa_t)
+files_search_pids(alsa_t)
 
+# asound.state: lives in /var/lib/alsa on Debian, /etc elsewhere
+files_etc_filetrans(alsa_t,alsa_etc_rw_t,file)
+files_search_var_lib(alsa_t)
+manage_files_pattern(alsa_t,alsa_var_lib_t,alsa_var_lib_t)
+
+dev_read_sound(alsa_t)
+dev_write_sound(alsa_t)
+
 term_use_generic_ptys(alsa_t)
 term_dontaudit_use_unallocated_ttys(alsa_t)
+init_dontaudit_use_fds(alsa_t)
 
 libs_use_ld_so(alsa_t)
 libs_use_shared_libs(alsa_t)
@@ -43,6 +57,7 @@
 
 userdom_manage_unpriv_user_semaphores(alsa_t)
 userdom_manage_unpriv_user_shared_mem(alsa_t)
+userdom_search_generic_user_home_dirs(alsa_t)
 
 optional_policy(`
 	nscd_socket_use(alsa_t)
Index: policy/modules/admin/alsa.fc
===================================================================
--- policy/modules/admin/alsa.fc	(revision 2373)
+++ policy/modules/admin/alsa.fc	(working copy)
@@ -1,4 +1,8 @@
 
 /etc/alsa/pcm(/.*)?		gen_context(system_u:object_r:alsa_etc_rw_t,s0)
 
+/etc/asound\.state	--	gen_context(system_u:object_r:alsa_etc_rw_t,s0)
+/var/lib/alsa(/.*)?		gen_context(system_u:object_r:alsa_var_lib_t,s0)
+
 /usr/bin/ainit 		--	gen_context(system_u:object_r:alsa_exec_t,s0)
+/usr/sbin/alsactl	--	gen_context(system_u:object_r:alsa_exec_t,s0)

Re: alsactl policy

[Christopher J. PeBenito]

On Mon, 2007-07-23 at 15:49 -0400, Martin Orr wrote:
> The alsa policy doesn't address alsactl, run from an init script and
> via a
> udev rule whenever a sound device is loaded to set volumes.  This
> patch
> addresses this.

> @@ -541,6 +541,10 @@
>  ')
>  
>  optional_policy(`
> +	alsa_domtrans(initrc_t)
> +')
> +
> +optional_policy(`
>  	amavis_search_lib(initrc_t)
>  	amavis_setattr_pid_files(initrc_t)
>  ')

This should be init_system_domain() in alsa.te instead.

> @@ -176,6 +176,10 @@
>  ')
>  
>  optional_policy(`
> +	alsa_domtrans(udev_t)
> +')
> +
> +optional_policy(`
>  	consoletype_exec(udev_t)
>  ')

What causes udev to run this (might it be debian-specific)?
 
> @@ -14,6 +14,9 @@
>  type alsa_etc_rw_t;
>  files_type(alsa_etc_rw_t)
>  
> +type alsa_var_lib_t;
> +files_type(alsa_var_lib_t)
> +
[...]
> +# asound.state: lives in /var/lib/alsa on Debian, /etc elsewhere
> +files_etc_filetrans(alsa_t,alsa_etc_rw_t,file)
> +files_search_var_lib(alsa_t)
> +manage_files_pattern(alsa_t,alsa_var_lib_t,alsa_var_lib_t)

This is the problem with encoding paths into the type names.  It might
be in different paths, but its the same file, with the same security
attributes, so there isn't a need for a new type.  Since the /var/lib
stuff is debian-specific, it should be in a ifdef(`distro_debian'.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.