* [refpolicy] ntp issue @ 2012-08-10 16:20 Dominick Grift 2012-08-10 16:59 ` Christopher J. PeBenito 2012-08-10 19:24 ` Guido Trentalancia 0 siblings, 2 replies; 7+ messages in thread From: Dominick Grift @ 2012-08-10 16:20 UTC (permalink / raw) To: refpolicy I was playing with ntp_admin() and i figured out that /etc/ntp.conf is labeled net_conf_t. What is the rationale behind that decision, I dont see it? Whatever the reason for this is, its not implemented properly. The net_conf_t type should not be used in the ntp.fc file. Instead, if one really wants /etc/ntp.conf to be net_conf_t, then move the fc spec to sysnetwork.fc But again i dont see why this file has to be net_conf_t. Its not good for ntp_admin either. I wouldnt want my ntp_admin to have access to net_conf_t files just so that he is able to manage ntp config files ^ permalink raw reply [flat|nested] 7+ messages in thread
* [refpolicy] ntp issue 2012-08-10 16:20 [refpolicy] ntp issue Dominick Grift @ 2012-08-10 16:59 ` Christopher J. PeBenito 2012-08-10 19:24 ` Guido Trentalancia 1 sibling, 0 replies; 7+ messages in thread From: Christopher J. PeBenito @ 2012-08-10 16:59 UTC (permalink / raw) To: refpolicy On 08/10/12 12:20, Dominick Grift wrote: > I was playing with ntp_admin() and i figured out that /etc/ntp.conf is > labeled net_conf_t. What is the rationale behind that decision, I dont > see it? I'd say its a mistake. > Whatever the reason for this is, its not implemented properly. The > net_conf_t type should not be used in the ntp.fc file. > > Instead, if one really wants /etc/ntp.conf to be net_conf_t, then move > the fc spec to sysnetwork.fc > > But again i dont see why this file has to be net_conf_t. Its not good > for ntp_admin either. I wouldnt want my ntp_admin to have access to > net_conf_t files just so that he is able to manage ntp config files I'm fine with a patch that makes a ntp_conf_t. -- Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com ^ permalink raw reply [flat|nested] 7+ messages in thread
* [refpolicy] ntp issue 2012-08-10 16:20 [refpolicy] ntp issue Dominick Grift 2012-08-10 16:59 ` Christopher J. PeBenito @ 2012-08-10 19:24 ` Guido Trentalancia 2012-08-13 13:27 ` Daniel J Walsh 1 sibling, 1 reply; 7+ messages in thread From: Guido Trentalancia @ 2012-08-10 19:24 UTC (permalink / raw) To: refpolicy On 10/08/2012 18:20, Dominick Grift wrote: > I was playing with ntp_admin() and i figured out that /etc/ntp.conf is > labeled net_conf_t. What is the rationale behind that decision, I dont > see it? If net_conf_t is also used in ntp.te then it sounds like a security flaw. Otherwise, it's a typo, which however might not be unlikely to lead to a security flaw in the future. > Whatever the reason for this is, its not implemented properly. The > net_conf_t type should not be used in the ntp.fc file. > Instead, if one really wants /etc/ntp.conf to be net_conf_t, then move > the fc spec to sysnetwork.fc There should be its own type. > But again i dont see why this file has to be net_conf_t. Its not good > for ntp_admin either. I wouldnt want my ntp_admin to have access to > net_conf_t files just so that he is able to manage ntp config files Regards, Guido ^ permalink raw reply [flat|nested] 7+ messages in thread
* [refpolicy] ntp issue 2012-08-10 19:24 ` Guido Trentalancia @ 2012-08-13 13:27 ` Daniel J Walsh 2012-08-13 13:31 ` Dominick Grift 2012-08-15 8:49 ` Guido Trentalancia 0 siblings, 2 replies; 7+ messages in thread From: Daniel J Walsh @ 2012-08-13 13:27 UTC (permalink / raw) To: refpolicy -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 08/10/2012 03:24 PM, Guido Trentalancia wrote: > On 10/08/2012 18:20, Dominick Grift wrote: >> I was playing with ntp_admin() and i figured out that /etc/ntp.conf is >> labeled net_conf_t. What is the rationale behind that decision, I dont >> see it? > > If net_conf_t is also used in ntp.te then it sounds like a security flaw. > > Otherwise, it's a typo, which however might not be unlikely to lead to a > security flaw in the future. > >> Whatever the reason for this is, its not implemented properly. The >> net_conf_t type should not be used in the ntp.fc file. > >> Instead, if one really wants /etc/ntp.conf to be net_conf_t, then move >> the fc spec to sysnetwork.fc > > There should be its own type. > >> But again i dont see why this file has to be net_conf_t. Its not good for >> ntp_admin either. I wouldnt want my ntp_admin to have access to >> net_conf_t files just so that he is able to manage ntp config files > > Regards, > > Guido _______________________________________________ refpolicy mailing > list refpolicy at oss.tresys.com > http://oss.tresys.com/mailman/listinfo/refpolicy > I agree it should not be net_conf_t, but I think we will need to make sure that NetworkManager_t can configure it, as it was most likely changed to this label when a network configuration tool needed to manage it. Now that we have filename transition rules we can label /etc/resolv.conf and /etc/ntp.conf differently and allow network manage ment tools to manage and maintain the labels. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAlApAM8ACgkQrlYvE4MpobOgaQCg69H6oJeitKhiw+K/n3oL39iO f6cAoKFcmSXEJKL4GUF1DL59XmIXHUs3 =GaiW -----END PGP SIGNATURE----- ^ permalink raw reply [flat|nested] 7+ messages in thread
* [refpolicy] ntp issue 2012-08-13 13:27 ` Daniel J Walsh @ 2012-08-13 13:31 ` Dominick Grift 2012-08-13 13:50 ` Daniel J Walsh 2012-08-15 8:49 ` Guido Trentalancia 1 sibling, 1 reply; 7+ messages in thread From: Dominick Grift @ 2012-08-13 13:31 UTC (permalink / raw) To: refpolicy On Mon, 2012-08-13 at 09:27 -0400, Daniel J Walsh wrote: > On 08/10/2012 03:24 PM, Guido Trentalancia wrote: > > On 10/08/2012 18:20, Dominick Grift wrote: > >> I was playing with ntp_admin() and i figured out that /etc/ntp.conf is > >> labeled net_conf_t. What is the rationale behind that decision, I dont > >> see it? > > > > If net_conf_t is also used in ntp.te then it sounds like a security flaw. > > > > Otherwise, it's a typo, which however might not be unlikely to lead to a > > security flaw in the future. > > > >> Whatever the reason for this is, its not implemented properly. The > >> net_conf_t type should not be used in the ntp.fc file. > > > >> Instead, if one really wants /etc/ntp.conf to be net_conf_t, then move > >> the fc spec to sysnetwork.fc > > > > There should be its own type. > > > >> But again i dont see why this file has to be net_conf_t. Its not good for > >> ntp_admin either. I wouldnt want my ntp_admin to have access to > >> net_conf_t files just so that he is able to manage ntp config files > > > > Regards, > > > > Guido _______________________________________________ refpolicy mailing > > list refpolicy at oss.tresys.com > > http://oss.tresys.com/mailman/listinfo/refpolicy > > > > I agree it should not be net_conf_t, but I think we will need to make sure > that NetworkManager_t can configure it, as it was most likely changed to this > label when a network configuration tool needed to manage it. Now that we have > filename transition rules we can label /etc/resolv.conf and /etc/ntp.conf > differently and allow network manage ment tools to manage and maintain the labels. That is what i thought as well but git blame shows otherwise. This has been there ever since the first iteration of this module. ^ permalink raw reply [flat|nested] 7+ messages in thread
* [refpolicy] ntp issue 2012-08-13 13:31 ` Dominick Grift @ 2012-08-13 13:50 ` Daniel J Walsh 0 siblings, 0 replies; 7+ messages in thread From: Daniel J Walsh @ 2012-08-13 13:50 UTC (permalink / raw) To: refpolicy -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 08/13/2012 09:31 AM, Dominick Grift wrote: > > > On Mon, 2012-08-13 at 09:27 -0400, Daniel J Walsh wrote: >> On 08/10/2012 03:24 PM, Guido Trentalancia wrote: >>> On 10/08/2012 18:20, Dominick Grift wrote: >>>> I was playing with ntp_admin() and i figured out that /etc/ntp.conf >>>> is labeled net_conf_t. What is the rationale behind that decision, I >>>> dont see it? >>> >>> If net_conf_t is also used in ntp.te then it sounds like a security >>> flaw. >>> >>> Otherwise, it's a typo, which however might not be unlikely to lead to >>> a security flaw in the future. >>> >>>> Whatever the reason for this is, its not implemented properly. The >>>> net_conf_t type should not be used in the ntp.fc file. >>> >>>> Instead, if one really wants /etc/ntp.conf to be net_conf_t, then >>>> move the fc spec to sysnetwork.fc >>> >>> There should be its own type. >>> >>>> But again i dont see why this file has to be net_conf_t. Its not good >>>> for ntp_admin either. I wouldnt want my ntp_admin to have access to >>>> net_conf_t files just so that he is able to manage ntp config files >>> >>> Regards, >>> >>> Guido _______________________________________________ refpolicy >>> mailing list refpolicy at oss.tresys.com >>> http://oss.tresys.com/mailman/listinfo/refpolicy >>> >> >> I agree it should not be net_conf_t, but I think we will need to make >> sure that NetworkManager_t can configure it, as it was most likely >> changed to this label when a network configuration tool needed to manage >> it. Now that we have filename transition rules we can label >> /etc/resolv.conf and /etc/ntp.conf differently and allow network manage >> ment tools to manage and maintain the labels. > > That is what i thought as well but git blame shows otherwise. This has been > there ever since the first iteration of this module. > > Ok. Lets try it out and see if NetworkManager starts to complain... -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAlApBjkACgkQrlYvE4MpobOeRQCg0D30zUW1QA9fdiJ0Umkbgoi9 PyEAnjLB7N3Wvup1CWUgariyzUiD632q =kkPV -----END PGP SIGNATURE----- ^ permalink raw reply [flat|nested] 7+ messages in thread
* [refpolicy] ntp issue 2012-08-13 13:27 ` Daniel J Walsh 2012-08-13 13:31 ` Dominick Grift @ 2012-08-15 8:49 ` Guido Trentalancia 1 sibling, 0 replies; 7+ messages in thread From: Guido Trentalancia @ 2012-08-15 8:49 UTC (permalink / raw) To: refpolicy On 13/08/2012 15:27, Daniel J Walsh wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > On 08/10/2012 03:24 PM, Guido Trentalancia wrote: >> On 10/08/2012 18:20, Dominick Grift wrote: >>> I was playing with ntp_admin() and i figured out that /etc/ntp.conf is >>> labeled net_conf_t. What is the rationale behind that decision, I dont >>> see it? >> >> If net_conf_t is also used in ntp.te then it sounds like a security flaw. >> >> Otherwise, it's a typo, which however might not be unlikely to lead to a >> security flaw in the future. >> >>> Whatever the reason for this is, its not implemented properly. The >>> net_conf_t type should not be used in the ntp.fc file. >> >>> Instead, if one really wants /etc/ntp.conf to be net_conf_t, then move >>> the fc spec to sysnetwork.fc >> >> There should be its own type. >> >>> But again i dont see why this file has to be net_conf_t. Its not good for >>> ntp_admin either. I wouldnt want my ntp_admin to have access to >>> net_conf_t files just so that he is able to manage ntp config files >> >> Regards, >> >> Guido > I agree it should not be net_conf_t, but I think we will need to make sure > that NetworkManager_t can configure it, as it was most likely changed to this > label when a network configuration tool needed to manage it. Now that we have > filename transition rules we can label /etc/resolv.conf and /etc/ntp.conf > differently and allow network manage ment tools to manage and maintain the labels. In my opinion, this is a good point, but it's only really needed in certain conditions (multiuser X mode). So, definitely, not on servers running at init level 3 or, say, kiosks running single-mode. Ideally, tunable policy should be used to restore the above compatibility with NetworkManager on the desktops (and maybe those servers) that actually use it. On Fedora, you could then even toggle such boolean on/off upon installation/removal of the NM package (%postinstall, %preinstall spec sections). But having a stricter policy for safer servers should probably be the priority in my opinion. Regards, Guido ^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2012-08-15 8:49 UTC | newest] Thread overview: 7+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2012-08-10 16:20 [refpolicy] ntp issue Dominick Grift 2012-08-10 16:59 ` Christopher J. PeBenito 2012-08-10 19:24 ` Guido Trentalancia 2012-08-13 13:27 ` Daniel J Walsh 2012-08-13 13:31 ` Dominick Grift 2012-08-13 13:50 ` Daniel J Walsh 2012-08-15 8:49 ` Guido Trentalancia
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.