[refpolicy] two fixups for mount_t: uses mount.tmpfs and manage lock files

[cpebenito@tresys.com (Christopher J. PeBenito)]

On 12/20/10 22:16, HarryCiao wrote:
> 1. Since the mount program would make use of the shell script of mount.tmpfs
> to preserve the mountpoint's security context across mounting if it ever
> makes sense, the mount domain should have been able to execute the shell
> and rw its fifo files.
>  
> type=1400 audit(1292851031.156:19): avc: denied { execute } for pid=513
> comm="mount" name="bash" dev=sda ino=98324
> scontext=system_u:system_r:mount_t:s0-s15:c0.c1023
> tcontext=system_u:object_r:shell_exec_t:s0 tclass=file
> type=1400 audit(1288069794.081:6): avc: denied { getattr } for pid=92
> comm="mount.tmpfs" path="pipe:[2444]" dev=pipefs ino=2444
> scontext=system_u:system_r:mount_t tcontext=system_u:system_r:mount_t
> tclass=fifo_file
> type=1400 audit(1288069794.085:7): avc: denied { write } for pid=92
> comm="mount.tmpfs" path="pipe:[2444]" dev=pipefs ino=2444
> scontext=system_u:system_r:mount_t tcontext=system_u:system_r:mount_t
> tclass=fifo_file
> type=1400 audit(1288069794.149:8): avc: denied { read } for pid=93
> comm="grep" path="pipe:[2444]" dev=pipefs ino=2444
> scontext=system_u:system_r:mount_t tcontext=system_u:system_r:mount_t
> tclass=fifo_file
> type=1400 audit(1288069794.225:9): avc: denied { ioctl } for pid=95
> comm="ls" path="pipe:[2446]" dev=pipefs ino=2446
> scontext=system_u:system_r:mount_t tcontext=system_u:system_r:mount_t
> tclass=fifo_file

This makes me wonder if we should make a mount_helper_exec_t for these
mount.* helper programs.  I'd rather not allow mount to execute
shell_exec_t.

> 2. While the mount program writes into /etc/mtab, it needs to create
> a lock file under /var/lock/, otherwise the /etc/mtab would be empty.
>  
> type=1400 audit(1287984885.601:19): avc: denied { write } for pid=471
> comm="mount" name="lock" dev=sda ino=114693
> scontext=system_u:system_r:mount_t tcontext=system_u:object_r:var_lock_t
> tclass=dir
> can't create lock file /var/lock/mtab~471: Permission denied (use -n
> flag to override)

Which distro is this on?

-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com