[refpolicy] apps_gpg.patch

[refpolicy] apps_gpg.patch

[Daniel J Walsh]

http://people.fedoraproject.org/~dwalsh/SELinux/F11/apps_gpg.patch

Fix gpg file context for 64 bit platform

Apps send sigkill to gpg as well as signal

gpg gets execed by firefox and thunderbird which leak file descriptors 
like crazy so need to cover this up

gpg needs getcap


Creates /tmp files

Reads kernel sysctl to check fips mode

lists inotify

cals getpw



gpg_helper needs get and setsched

calls getpw
Lists inotify

gpg_t needs to be able to rewrite /tmp files created by thunderbird and 
files in the homedir, in order to sign/encrypt them

[refpolicy] apps_gpg.patch

[Daniel J Walsh]

http://people.fedoraproject.org/~dwalsh/SELinux/F11/apps_gpg.patch

gpg sends signals

executed from firefox/thunderbird, which leak filedescripors like a sieve.

Needs getcap

Creates files in /tmp

uses getpw calls

Needs to manager users files in /tmp and the homedir.  It signs, them, 
encrypts them ...

[refpolicy] apps_gpg.patch

[Christopher J. PeBenito]

On Thu, 2009-05-21 at 10:58 -0400, Daniel J Walsh wrote:
> http://people.fedoraproject.org/~dwalsh/SELinux/F11/apps_gpg.patch
> 
> gpg sends signals
> 
> executed from firefox/thunderbird, which leak filedescripors like a
> sieve.
> 
> Needs getcap
> 
> Creates files in /tmp
> 
> uses getpw calls
> 
> Needs to manager users files in /tmp and the homedir.  It signs, them,
> encrypts them ...

Merged.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150

[refpolicy] apps_gpg.patch

[Daniel J Walsh]

http://people.fedoraproject.org/~dwalsh/SELinux/F12/apps_gpg.patch

gpg sends sigstop and signull

Reads usb devices

Can encrypts users content in /tmp and the homedir, as well as on NFS and cifs

[refpolicy] apps_gpg.patch

[Christopher J. PeBenito]

On Fri, 2009-08-28 at 16:06 -0400, Daniel J Walsh wrote:
> gpg sends sigstop and signull
> 
> Reads usb devices
> 
> Can encrypts users content in /tmp and the homedir, as well as on NFS
> and cifs

Merged.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150

[refpolicy] apps_gpg.patch

[Daniel J Walsh]

http://people.fedoraproject.org/~dwalsh/SELinux/F12/apps_gpg.patch

gpg sends syslog

can be run in cron jobs

gpg_helper needs to dontaudit leaked descriptors in nfs and cifs homedirs

[refpolicy] apps_gpg.patch

[Christopher J. PeBenito]

On Thu, 2009-11-12 at 15:45 -0500, Daniel J Walsh wrote:
> http://people.fedoraproject.org/~dwalsh/SELinux/F12/apps_gpg.patch
> 
> gpg sends syslog
> 
> can be run in cron jobs
> 
> gpg_helper needs to dontaudit leaked descriptors in nfs and cifs
> homedirs

Merged.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150

[refpolicy] apps_gpg.patch

[Daniel J Walsh]

http://people.fedoraproject.org/~dwalsh/SELinux/F13/apps_gpg.patch

Allow apache to run gpg_t as system_r

We dont allow cron to transition to gpg_t.

[refpolicy] apps_gpg.patch

[Daniel J Walsh]

http://people.fedoraproject.org/~dwalsh/SELinux/F14/apps_gpg.patch

gpg dontaudit leaks.

Added policy so apache can execute gpg

[refpolicy] apps_gpg.patch

[Christopher J. PeBenito]

On 06/02/10 16:05, Daniel J Walsh wrote:
> http://people.fedoraproject.org/~dwalsh/SELinux/F14/apps_gpg.patch
>
> gpg dontaudit leaks.

Merged.

> Added policy so apache can execute gpg

I don't understand this part.  It seems more like it should be a domain 
in the apache module instead.

-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

[refpolicy] apps_gpg.patch

[Daniel J Walsh]

On 07/06/2010 10:59 AM, Christopher J. PeBenito wrote:
> On 06/02/10 16:05, Daniel J Walsh wrote:
>> http://people.fedoraproject.org/~dwalsh/SELinux/F14/apps_gpg.patch
>>
>> gpg dontaudit leaks.
> 
> Merged.
> 
>> Added policy so apache can execute gpg
> 
> I don't understand this part.  It seems more like it should be a domain
> in the apache module instead.
> 
I guess we could go that way, but you need interfaces including gpg_exec_t.

[refpolicy] apps_gpg.patch

[Christopher J. PeBenito]

On 07/13/10 08:15, Daniel J Walsh wrote:
> On 07/06/2010 10:59 AM, Christopher J. PeBenito wrote:
>> On 06/02/10 16:05, Daniel J Walsh wrote:
>>> http://people.fedoraproject.org/~dwalsh/SELinux/F14/apps_gpg.patch
>>>
>>> gpg dontaudit leaks.
>>
>> Merged.
>>
>>> Added policy so apache can execute gpg
>>
>> I don't understand this part.  It seems more like it should be a domain
>> in the apache module instead.
>>
> I guess we could go that way, but you need interfaces including gpg_exec_t.

How is this used?  Is it run from a CGI script to check the signature or 
(en|de)crypt a file?

-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

[refpolicy] apps_gpg.patch

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 07/19/2010 01:45 PM, Christopher J. PeBenito wrote:
> On 07/13/10 08:15, Daniel J Walsh wrote:
>> On 07/06/2010 10:59 AM, Christopher J. PeBenito wrote:
>>> On 06/02/10 16:05, Daniel J Walsh wrote:
>>>> http://people.fedoraproject.org/~dwalsh/SELinux/F14/apps_gpg.patch
>>>>
>>>> gpg dontaudit leaks.
>>>
>>> Merged.
>>>
>>>> Added policy so apache can execute gpg
>>>
>>> I don't understand this part.  It seems more like it should be a domain
>>> in the apache module instead.
>>>
>> I guess we could go that way, but you need interfaces including
>> gpg_exec_t.
> 
> How is this used?  Is it run from a CGI script to check the signature or
> (en|de)crypt a file?
> 
Yes and Yes, I think.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkxEkw0ACgkQrlYvE4MpobP5PQCghfRZmBU9jAJKqInOupTCscKj
QbkAoNE0YRTo7HSdry4fyyIG+JGlg+3r
=ObBx
-----END PGP SIGNATURE-----

[refpolicy] apps_gpg.patch

[Miroslav Grepl]

On 07/19/2010 08:01 PM, Daniel J Walsh wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 07/19/2010 01:45 PM, Christopher J. PeBenito wrote:
>    
>> On 07/13/10 08:15, Daniel J Walsh wrote:
>>      
>>> On 07/06/2010 10:59 AM, Christopher J. PeBenito wrote:
>>>        
>>>> On 06/02/10 16:05, Daniel J Walsh wrote:
>>>>          
>>>>> http://people.fedoraproject.org/~dwalsh/SELinux/F14/apps_gpg.patch
>>>>>
>>>>> gpg dontaudit leaks.
>>>>>            
>>>> Merged.
>>>>
>>>>          
>>>>> Added policy so apache can execute gpg
>>>>>            
>>>> I don't understand this part.  It seems more like it should be a domain
>>>> in the apache module instead.
>>>>
>>>>          
>>> I guess we could go that way, but you need interfaces including
>>> gpg_exec_t.
>>>        
>> How is this used?  Is it run from a CGI script to check the signature or
>> (en|de)crypt a file?
>>
>>      
Yes, it is run from a CGI script to check the signature or (en|de)crypt 
a file. Related bug #562083.

We also added the following change

  optional_policy(`
      tunable_policy(`httpd_enable_cgi && httpd_use_gpg',`
-        gpg_domtrans(httpd_t)
+       gpg_domtrans_web(httpd_t)
      ')
  ')

Regards,
Miroslav
> Yes and Yes, I think.
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2.0.14 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAkxEkw0ACgkQrlYvE4MpobP5PQCghfRZmBU9jAJKqInOupTCscKj
> QbkAoNE0YRTo7HSdry4fyyIG+JGlg+3r
> =ObBx
> -----END PGP SIGNATURE-----
>    

[refpolicy] apps_gpg.patch

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

http://people.fedoraproject.org/~dwalsh/SELinux/F14/apps_gpg.patch

gpg for the web
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.16 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkx27I0ACgkQrlYvE4MpobNo+gCg3TGs5r8mOI3+ZtkbyctGTtVy
WicAnRUYSG+DDeRSDzy3Hoh+fnX19WAz
=fO31
-----END PGP SIGNATURE-----