[refpolicy] [PATCH 1/4] Support layman through its own domain

[cpebenito@tresys.com (Christopher J. PeBenito)]

On 8/13/2011 2:22 PM, Sven Vermeulen wrote:
> The layman utility is used by Gentoo to manage additional overlays. The
> application manages files in /var/lib/layman (which are the various
> overlays) and is able to update them using utilities like rsync, svn, git, ...
>
> Previously, layman was just ran within the domain of the caller (which was
> usually sysadm_t). However, when using automated methods like updating the
> trees through cron or puppet, this fails since these domains do not hold the
> necessary privileges. By putting the necessary privileges in a separate domain,
> we can assign this domain to the appropriate roles.
>
> Since layman and portage (emerge) are very closely related, we manage the
> necessary domtrans rules through the portage_domtrans() method. There is
> hardly any point to make this a separate interface.

Have you considered transitioning to portage_fetch_t for the fetch? 
Since there already is SELinux aware code in portage, it seems like it 
would be easy to get that into layman, especially if layman uses portage 
libraries (I don't know if it does).  Alternatively, you could try 
transitioning to portage_fetch_t when running layman; its been a while 
since I used it, so I'm not completely sure if that makes sense.

> Signed-off-by: Sven Vermeulen<sven.vermeulen@siphos.be>
> ---
>   policy/modules/admin/portage.fc |    2 +
>   policy/modules/admin/portage.if |    6 +++-
>   policy/modules/admin/portage.te |   60 +++++++++++++++++++++++++++++++++++++++
>   3 files changed, 67 insertions(+), 1 deletions(-)
>
> diff --git a/policy/modules/admin/portage.fc b/policy/modules/admin/portage.fc
> index db46387..38cc918 100644
> --- a/policy/modules/admin/portage.fc
> +++ b/policy/modules/admin/portage.fc
> @@ -3,6 +3,7 @@
>   /etc/portage(/.*)?			gen_context(system_u:object_r:portage_conf_t,s0)
>
>   /usr/bin/gcc-config		--	gen_context(system_u:object_r:gcc_config_exec_t,s0)
> +/usr/bin/layman			--	gen_context(system_u:object_r:layman_exec_t,s0)
>   /usr/bin/sandbox		--	gen_context(system_u:object_r:portage_exec_t,s0)
>
>   /usr/lib(64)?/portage/bin/ebuild --	gen_context(system_u:object_r:portage_exec_t,s0)
> @@ -19,6 +20,7 @@
>   /var/log/emerge\.log.*		--	gen_context(system_u:object_r:portage_log_t,s0)
>   /var/log/emerge-fetch.log	--	gen_context(system_u:object_r:portage_log_t,s0)
>   /var/log/portage(/.*)?			gen_context(system_u:object_r:portage_log_t,s0)
> +/var/lib/layman(/.*)?			gen_context(system_u:object_r:layman_var_lib_t,s0)
>   /var/lib/portage(/.*)?			gen_context(system_u:object_r:portage_cache_t,s0)
>   /var/tmp/portage(/.*)?			gen_context(system_u:object_r:portage_tmp_t,s0)
>   /var/tmp/portage-pkg(/.*)?		gen_context(system_u:object_r:portage_tmp_t,s0)
> diff --git a/policy/modules/admin/portage.if b/policy/modules/admin/portage.if
> index 0f27b1c..faf2eba 100644
> --- a/policy/modules/admin/portage.if
> +++ b/policy/modules/admin/portage.if
> @@ -16,6 +16,7 @@
>   interface(`portage_domtrans',`
>   	gen_require(`
>   		type portage_t, portage_exec_t;
> +		type layman_t, layman_exec_t;
>   	')
>
>   	files_search_usr($1)
> @@ -23,6 +24,8 @@ interface(`portage_domtrans',`
>
>   	# transition to portage
>   	domtrans_pattern($1, portage_exec_t, portage_t)
> +	# transition to layman
> +	domtrans_pattern($1, layman_exec_t, layman_t)
>   ')
>
>   ########################################
> @@ -45,10 +48,11 @@ interface(`portage_domtrans',`
>   interface(`portage_run',`
>   	gen_require(`
>   		type portage_t, portage_fetch_t, portage_sandbox_t;
> +		type layman_t;
>   	')
>
>   	portage_domtrans($1)
> -	role $2 types { portage_t portage_fetch_t portage_sandbox_t };
> +	role $2 types { portage_t portage_fetch_t portage_sandbox_t layman_t };
>   ')
>
>   ########################################
> diff --git a/policy/modules/admin/portage.te b/policy/modules/admin/portage.te
> index d2ff138..29130da 100644
> --- a/policy/modules/admin/portage.te
> +++ b/policy/modules/admin/portage.te
> @@ -9,6 +9,16 @@ type gcc_config_t;
>   type gcc_config_exec_t;
>   application_domain(gcc_config_t, gcc_config_exec_t)
>
> +type layman_t;
> +type layman_exec_t;
> +application_domain(layman_t, layman_exec_t)
> +
> +type layman_tmp_t;
> +files_tmp_file(layman_tmp_t)
> +
> +type layman_var_lib_t;
> +files_type(layman_var_lib_t)
> +
>   # constraining type
>   type portage_t;
>   type portage_exec_t;
> @@ -115,6 +125,56 @@ optional_policy(`
>
>   ########################################
>   #
> +# Layman local policy
> +#
> +allow layman_t self:process signal;
> +allow layman_t self:fifo_file rw_fifo_file_perms;
> +
> +# Manage layman var/lib files
> +manage_files_pattern(layman_t, layman_var_lib_t, layman_var_lib_t)
> +manage_dirs_pattern(layman_t, layman_var_lib_t, layman_var_lib_t)
> +manage_lnk_files_pattern(layman_t, layman_var_lib_t, layman_var_lib_t)
> +
> +# Manage layman tmp files (needed in case of subversion)
> +manage_dirs_pattern(layman_t, layman_tmp_t, layman_tmp_t)
> +manage_files_pattern(layman_t, layman_tmp_t, layman_tmp_t)
> +files_tmp_filetrans(layman_t, layman_tmp_t, { file dir })
> +
> +
> +kernel_dontaudit_read_system_state(layman_t)
> +kernel_dontaudit_request_load_module(layman_t)
> +
> +corecmd_exec_bin(layman_t)
> +corecmd_exec_shell(layman_t)
> +
> +corenet_sendrecv_generic_client_packets(layman_t)
> +corenet_sendrecv_git_client_packets(layman_t)
> +corenet_sendrecv_http_client_packets(layman_t)
> +corenet_sendrecv_rsync_client_packets(layman_t)
> +corenet_tcp_connect_generic_port(layman_t)
> +corenet_tcp_connect_git_port(layman_t)
> +corenet_tcp_connect_http_port(layman_t)
> +corenet_tcp_connect_rsync_port(layman_t)
> +
> +domain_use_interactive_fds(layman_t)
> +
> +files_read_etc_files(layman_t)
> +files_read_etc_runtime_files(layman_t)
> +files_read_usr_files(layman_t)
> +files_search_var_lib(layman_t)
> +
> +
> +logging_list_logs(layman_t)
> +miscfiles_read_localization(layman_t)
> +sysnet_dns_name_resolve(layman_t)
> +userdom_dontaudit_list_user_home_dirs(layman_t)
> +userdom_use_user_terminals(layman_t)
> +
> +
> +rsync_exec(layman_t)
> +
> +########################################
> +#
>   # Portage Merging Rules
>   #
>


-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com