[refpolicy] [PATCH] added autofs support

[refpolicy] [PATCH] added autofs support

[Matthew Thode]

adds autofs support to portage, needed for using portage on nfs on autofs.

---
 portage.te |    3 +++
 1 files changed, 3 insertions(+), 0 deletions(-)

diff --git a/portage.te b/portage.te
index 630f16f..128e7d6 100644
--- a/portage.te
+++ b/portage.te
@@ -298,6 +298,9 @@ files_read_usr_files(portage_fetch_t)
 files_search_var_lib(portage_fetch_t)
 files_dontaudit_search_pids(portage_fetch_t)
 
+fs_search_auto_mountpoints(portage_fetch_t)
+dev_rw_autofs(portage_fetch_t)
+
 logging_list_logs(portage_fetch_t)
 logging_dontaudit_search_logs(portage_fetch_t)
 
-- 
1.7.8.6

[refpolicy] [PATCH] added autofs support

[Dominick Grift]

On Tue, 2012-10-02 at 02:25 -0500, Matthew Thode wrote:
> adds autofs support to portage, needed for using portage on nfs on autofs.
> 
> ---
>  portage.te |    3 +++
>  1 files changed, 3 insertions(+), 0 deletions(-)
> 
> diff --git a/portage.te b/portage.te
> index 630f16f..128e7d6 100644
> --- a/portage.te
> +++ b/portage.te
> @@ -298,6 +298,9 @@ files_read_usr_files(portage_fetch_t)
>  files_search_var_lib(portage_fetch_t)
>  files_dontaudit_search_pids(portage_fetch_t)
>  
> +fs_search_auto_mountpoints(portage_fetch_t)
> +dev_rw_autofs(portage_fetch_t)
> +
>  logging_list_logs(portage_fetch_t)
>  logging_dontaudit_search_logs(portage_fetch_t)
>  

This is wrong but this reply is mainly just a note to self.

So far i established that we need the following instead:

+tunable_policy(`portage_use_nfs',`
+	fs_getattr_nfs(portage_t)
+')

+fs_search_auto_mountpoints(portage_fetch_t)
 
+auth_use_nsswitch(portage_fetch_t)

[refpolicy] [PATCH] removed the rw autofs stuff added nfs search for portage_t and allowed use of nsswitch

[Matthew Thode]

subject more or less speaks for itself, lessened the permissions needed from autofs and fixed a couple of AVC denials with grifts help in irc, thanks :D

---
 portage.te |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)

diff --git a/portage.te b/portage.te
index 128e7d6..321b1ac 100644
--- a/portage.te
+++ b/portage.te
@@ -193,6 +193,8 @@ files_manage_all_files(portage_t)
 selinux_get_fs_mount(portage_t)
 
 auth_manage_shadow(portage_t)
+auth_use_nsswitch(portage_fetch_t)
+auth_use_nsswitch(portage_sandbox_t)
 
 # merging baselayout will need this:
 init_exec(portage_t)
@@ -299,7 +301,6 @@ files_search_var_lib(portage_fetch_t)
 files_dontaudit_search_pids(portage_fetch_t)
 
 fs_search_auto_mountpoints(portage_fetch_t)
-dev_rw_autofs(portage_fetch_t)
 
 logging_list_logs(portage_fetch_t)
 logging_dontaudit_search_logs(portage_fetch_t)
@@ -321,6 +322,7 @@ ifdef(`hide_broken_symptoms',`
 ')
 
 tunable_policy(`portage_use_nfs',`
+	fs_getattr_nfs(portage_t)
 	fs_getattr_nfs(portage_fetch_t)
 	fs_manage_nfs_dirs(portage_fetch_t)
 	fs_manage_nfs_files(portage_fetch_t)
-- 
1.7.8.6

[refpolicy] [PATCH] removed the rw autofs stuff added nfs search for portage_t and allowed use of nsswitch

[Christopher J. PeBenito]

On 10/02/12 09:59, Matthew Thode wrote:
> subject more or less speaks for itself, lessened the permissions needed from autofs and fixed a couple of AVC denials with grifts help in irc, thanks :D
> 
> ---
>  portage.te |    4 +++-
>  1 files changed, 3 insertions(+), 1 deletions(-)
> 
> diff --git a/portage.te b/portage.te
> index 128e7d6..321b1ac 100644
> --- a/portage.te
> +++ b/portage.te
> @@ -193,6 +193,8 @@ files_manage_all_files(portage_t)
>  selinux_get_fs_mount(portage_t)
>  
>  auth_manage_shadow(portage_t)
> +auth_use_nsswitch(portage_fetch_t)
> +auth_use_nsswitch(portage_sandbox_t)
>  
>  # merging baselayout will need this:
>  init_exec(portage_t)
[cut]
> @@ -321,6 +322,7 @@ ifdef(`hide_broken_symptoms',`
>  ')
>  
>  tunable_policy(`portage_use_nfs',`
> +	fs_getattr_nfs(portage_t)
>  	fs_getattr_nfs(portage_fetch_t)
>  	fs_manage_nfs_dirs(portage_fetch_t)
>  	fs_manage_nfs_files(portage_fetch_t)
 
The lines should go with the sections, i.e. the portage_fetch_t addition should go in the portage_fetch_t section, and the portage_sandbox_t addition should go in the portage_sandbox_t section.

-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

[refpolicy] [PATCH] removed the rw autofs stuff added nfs search for portage_t and allowed use of nsswitch

[Dominick Grift]

On Tue, 2012-10-09 at 10:09 -0400, Christopher J. PeBenito wrote:
> On 10/02/12 09:59, Matthew Thode wrote:
> > subject more or less speaks for itself, lessened the permissions needed from autofs and fixed a couple of AVC denials with grifts help in irc, thanks :D
> > 
> > ---
> >  portage.te |    4 +++-
> >  1 files changed, 3 insertions(+), 1 deletions(-)
> > 
> > diff --git a/portage.te b/portage.te
> > index 128e7d6..321b1ac 100644
> > --- a/portage.te
> > +++ b/portage.te
> > @@ -193,6 +193,8 @@ files_manage_all_files(portage_t)
> >  selinux_get_fs_mount(portage_t)
> >  
> >  auth_manage_shadow(portage_t)
> > +auth_use_nsswitch(portage_fetch_t)
> > +auth_use_nsswitch(portage_sandbox_t)
> >  
> >  # merging baselayout will need this:
> >  init_exec(portage_t)
> [cut]
> > @@ -321,6 +322,7 @@ ifdef(`hide_broken_symptoms',`
> >  ')
> >  
> >  tunable_policy(`portage_use_nfs',`
> > +	fs_getattr_nfs(portage_t)
> >  	fs_getattr_nfs(portage_fetch_t)
> >  	fs_manage_nfs_dirs(portage_fetch_t)
> >  	fs_manage_nfs_files(portage_fetch_t)
>  
> The lines should go with the sections, i.e. the portage_fetch_t addition should go in the portage_fetch_t section, and the portage_sandbox_t addition should go in the portage_sandbox_t section.
> 

This has already been taken care of