* [refpolicy] [PATCH] Update couchdb policy
@ 2014-01-25 23:18 Luis Ressel
2014-02-01 4:05 ` Christopher J. PeBenito
0 siblings, 1 reply; 3+ messages in thread
From: Luis Ressel @ 2014-01-25 23:18 UTC (permalink / raw)
To: refpolicy
* Add separate db for couchjs, as it needs execmem
* Add several dontaudits to hide noise caused by Erlang's disksup
---
couchdb.fc | 16 +++++++---------
couchdb.te | 26 ++++++++++++++++++++++++--
2 files changed, 31 insertions(+), 11 deletions(-)
diff --git a/couchdb.fc b/couchdb.fc
index c086302..5c1388a 100644
--- a/couchdb.fc
+++ b/couchdb.fc
@@ -1,11 +1,9 @@
-/etc/couchdb(/.*)? gen_context(system_u:object_r:couchdb_conf_t,s0)
+/etc/couchdb(/.*)? gen_context(system_u:object_r:couchdb_conf_t,s0)
-/etc/rc\.d/init\.d/couchdb -- gen_context(system_u:object_r:couchdb_initrc_exec_t,s0)
+/usr/bin/couchdb -- gen_context(system_u:object_r:couchdb_exec_t,s0)
+/usr/lib/couchdb/bin/couchjs -- gen_context(system_u:object_r:couchdb_js_exec_t,s0)
+/usr/lib/couchdb/erlang/lib/couch-[0-9.]+/priv/couchspawnkillable -- gen_context(system_u:object_r:bin_t,s0)
-/usr/bin/couchdb -- gen_context(system_u:object_r:couchdb_exec_t,s0)
-
-/var/lib/couchdb(/.*)? gen_context(system_u:object_r:couchdb_var_lib_t,s0)
-
-/var/log/couchdb(/.*)? gen_context(system_u:object_r:couchdb_log_t,s0)
-
-/var/run/couchdb(/.*)? gen_context(system_u:object_r:couchdb_var_run_t,s0)
+/var/lib/couchdb(/.*)? gen_context(system_u:object_r:couchdb_var_lib_t,s0)
+/var/log/couchdb(/.*)? gen_context(system_u:object_r:couchdb_log_t,s0)
+/var/run/couchdb(/.*)? gen_context(system_u:object_r:couchdb_var_run_t,s0)
diff --git a/couchdb.te b/couchdb.te
index ae1c1b1..1bf163e 100644
--- a/couchdb.te
+++ b/couchdb.te
@@ -9,6 +9,10 @@ type couchdb_t;
type couchdb_exec_t;
init_daemon_domain(couchdb_t, couchdb_exec_t)
+type couchdb_js_t;
+type couchdb_js_exec_t;
+init_daemon_domain(couchdb_js_t, couchdb_js_exec_t)
+
type couchdb_initrc_exec_t;
init_script_file(couchdb_initrc_exec_t)
@@ -29,10 +33,10 @@ files_pid_file(couchdb_var_run_t)
########################################
#
-# Local policy
+# couchdb policy
#
-allow couchdb_t self:process { setsched signal signull sigkill };
+allow couchdb_t self:process { getsched setsched signal signull sigkill };
allow couchdb_t self:fifo_file rw_fifo_file_perms;
allow couchdb_t self:unix_stream_socket create_stream_socket_perms;
allow couchdb_t self:tcp_socket { accept listen };
@@ -70,6 +74,7 @@ corenet_all_recvfrom_netlabel(couchdb_t)
corenet_tcp_sendrecv_generic_if(couchdb_t)
corenet_tcp_sendrecv_generic_node(couchdb_t)
corenet_tcp_bind_generic_node(couchdb_t)
+corenet_udp_bind_generic_node(couchdb_t)
corenet_sendrecv_couchdb_server_packets(couchdb_t)
corenet_tcp_bind_couchdb_port(couchdb_t)
@@ -81,8 +86,25 @@ dev_read_urand(couchdb_t)
files_read_usr_files(couchdb_t)
+# disksup tries to monitor the local disks
fs_getattr_xattr_fs(couchdb_t)
+fs_dontaudit_getattr_all_fs(couchdb_t)
+files_dontaudit_search_all_mountpoints(couchdb_t)
+files_dontaudit_getattr_lost_found_dirs(couchdb_t)
+dontaudit couchdb_t var_t:dir list_dir_perms;
auth_use_nsswitch(couchdb_t)
miscfiles_read_localization(couchdb_t)
+
+domtrans_pattern(couchdb_t, couchdb_js_exec_t, couchdb_js_t)
+
+########################################
+#
+# couchdb_js policy
+#
+
+allow couchdb_js_t self:process { execmem getsched setsched };
+
+files_read_usr_files(couchdb_js_t)
+miscfiles_read_localization(couchdb_js_t)
--
1.8.5.3
^ permalink raw reply related [flat|nested] 3+ messages in thread* [refpolicy] [PATCH] Update couchdb policy
2014-01-25 23:18 [refpolicy] [PATCH] Update couchdb policy Luis Ressel
@ 2014-02-01 4:05 ` Christopher J. PeBenito
2014-02-01 10:28 ` Luis Ressel
0 siblings, 1 reply; 3+ messages in thread
From: Christopher J. PeBenito @ 2014-02-01 4:05 UTC (permalink / raw)
To: refpolicy
On 1/25/2014 6:18 PM, Luis Ressel wrote:
> * Add separate db for couchjs, as it needs execmem
> * Add several dontaudits to hide noise caused by Erlang's disksup
> ---
> couchdb.fc | 16 +++++++---------
> couchdb.te | 26 ++++++++++++++++++++++++--
> 2 files changed, 31 insertions(+), 11 deletions(-)
>
> diff --git a/couchdb.fc b/couchdb.fc
> index c086302..5c1388a 100644
> --- a/couchdb.fc
> +++ b/couchdb.fc
> @@ -1,11 +1,9 @@
> -/etc/couchdb(/.*)? gen_context(system_u:object_r:couchdb_conf_t,s0)
> +/etc/couchdb(/.*)? gen_context(system_u:object_r:couchdb_conf_t,s0)
>
> -/etc/rc\.d/init\.d/couchdb -- gen_context(system_u:object_r:couchdb_initrc_exec_t,s0)
> +/usr/bin/couchdb -- gen_context(system_u:object_r:couchdb_exec_t,s0)
> +/usr/lib/couchdb/bin/couchjs -- gen_context(system_u:object_r:couchdb_js_exec_t,s0)
> +/usr/lib/couchdb/erlang/lib/couch-[0-9.]+/priv/couchspawnkillable -- gen_context(system_u:object_r:bin_t,s0)
>
> -/usr/bin/couchdb -- gen_context(system_u:object_r:couchdb_exec_t,s0)
> -
> -/var/lib/couchdb(/.*)? gen_context(system_u:object_r:couchdb_var_lib_t,s0)
> -
> -/var/log/couchdb(/.*)? gen_context(system_u:object_r:couchdb_log_t,s0)
> -
> -/var/run/couchdb(/.*)? gen_context(system_u:object_r:couchdb_var_run_t,s0)
> +/var/lib/couchdb(/.*)? gen_context(system_u:object_r:couchdb_var_lib_t,s0)
> +/var/log/couchdb(/.*)? gen_context(system_u:object_r:couchdb_log_t,s0)
> +/var/run/couchdb(/.*)? gen_context(system_u:object_r:couchdb_var_run_t,s0)
Typically, its preferred that whitespace fixes be sent in separate patches.
> diff --git a/couchdb.te b/couchdb.te
> index ae1c1b1..1bf163e 100644
> --- a/couchdb.te
> +++ b/couchdb.te
> @@ -81,8 +86,25 @@ dev_read_urand(couchdb_t)
>
> files_read_usr_files(couchdb_t)
>
> +# disksup tries to monitor the local disks
> fs_getattr_xattr_fs(couchdb_t)
> +fs_dontaudit_getattr_all_fs(couchdb_t)
> +files_dontaudit_search_all_mountpoints(couchdb_t)
> +files_dontaudit_getattr_lost_found_dirs(couchdb_t)
> +dontaudit couchdb_t var_t:dir list_dir_perms;
This last rule needs to use an interface instead.
> auth_use_nsswitch(couchdb_t)
>
> miscfiles_read_localization(couchdb_t)
> +
> +domtrans_pattern(couchdb_t, couchdb_js_exec_t, couchdb_js_t)
> +
> +########################################
> +#
> +# couchdb_js policy
> +#
> +
> +allow couchdb_js_t self:process { execmem getsched setsched };
> +
> +files_read_usr_files(couchdb_js_t)
> +miscfiles_read_localization(couchdb_js_t)
Is this a complete set of rules for this domain? This doesn't look like it can really do anything, since it doesn't have any output.
--
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
^ permalink raw reply [flat|nested] 3+ messages in thread* [refpolicy] [PATCH] Update couchdb policy
2014-02-01 4:05 ` Christopher J. PeBenito
@ 2014-02-01 10:28 ` Luis Ressel
0 siblings, 0 replies; 3+ messages in thread
From: Luis Ressel @ 2014-02-01 10:28 UTC (permalink / raw)
To: refpolicy
On Fri, 31 Jan 2014 23:05:46 -0500
"Christopher J. PeBenito" <cpebenito@tresys.com> wrote:
> Typically, its preferred that whitespace fixes be sent in separate
> patches.
> This last rule needs to use an interface instead.
I'll send a new patch series to address your concerns.
> Is this a complete set of rules for this domain? This doesn't look
> like it can really do anything, since it doesn't have any output.
Yes, this is the complete set of neccessary rules. couchjs is a helper
program invoked by couchdb to execute Javascript. It communicates its
results back via a fifo, which is allowed by domtrans_pattern().
--
Luis Ressel <aranea@aixah.de>
GPG fpr: F08D 2AF6 655E 25DE 52BC E53D 08F5 7F90 3029 B5BD
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 966 bytes
Desc: not available
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20140201/d94d1b5e/attachment-0001.bin
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2014-02-01 10:28 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-01-25 23:18 [refpolicy] [PATCH] Update couchdb policy Luis Ressel
2014-02-01 4:05 ` Christopher J. PeBenito
2014-02-01 10:28 ` Luis Ressel
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.