[refpolicy] Loop device handling with losetup

[refpolicy] Loop device handling with losetup

[Luis Ressel]

This patch series adds the permissions needed for losetup. losetup is a
utility to bind files to loop devices. I reused mount_loopback_t as the
type for files intended to be bound to such loop devices.


Regards,
Luis Ressel

[refpolicy] [PATCH 1/3] system/mount.if: Add mount_rw_loopback_files interface

[Luis Ressel]

---
 policy/modules/system/mount.if | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/policy/modules/system/mount.if b/policy/modules/system/mount.if
index fe24186..8a2105b 100644
--- a/policy/modules/system/mount.if
+++ b/policy/modules/system/mount.if
@@ -191,3 +191,21 @@ interface(`mount_read_loopback_files',`
 
 	allow $1 mount_loopback_t:file read_file_perms;
 ')
+
+########################################
+## <summary>
+##	Read and write loopback filesystem image files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`mount_rw_loopback_files',`
+	gen_require(`
+		type mount_loopback_t;
+	')
+
+	allow $1 mount_loopback_t:file rw_file_perms;
+')
-- 
1.8.5.5

[refpolicy] [PATCH 2/3] system/fstools.if: Add fstools_use_fds interface

[Luis Ressel]

---
 policy/modules/system/fstools.if | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/policy/modules/system/fstools.if b/policy/modules/system/fstools.if
index 016a770..c4bbd88 100644
--- a/policy/modules/system/fstools.if
+++ b/policy/modules/system/fstools.if
@@ -83,6 +83,24 @@ interface(`fstools_signal',`
 
 ########################################
 ## <summary>
+##	Inherit fstools file descriptors.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The type of the process performing this action.
+##	</summary>
+## </param>
+#
+interface(`fstools_use_fds',`
+	gen_require(`
+		type fsadm_t;
+	')
+
+	allow $1 fsadm_t:fd use;
+')
+
+########################################
+## <summary>
 ##	Read fstools unnamed pipes.
 ## </summary>
 ## <param name="domain">
-- 
1.8.5.5

[refpolicy] [PATCH 3/3] Add neccessary permissions for losetup

[Luis Ressel]

This allows losetup to bind mount_loopback_t files to loop devices.
---
 policy/modules/kernel/kernel.te  | 2 ++
 policy/modules/system/fstools.te | 4 ++++
 2 files changed, 6 insertions(+)

diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te
index 7f7372f..cdea637 100644
--- a/policy/modules/kernel/kernel.te
+++ b/policy/modules/kernel/kernel.te
@@ -317,6 +317,8 @@ optional_policy(`
 ')
 
 optional_policy(`
+	# loop devices
+	fsadm_use_fds(kernel_t)
 	mount_use_fds(kernel_t)
 	mount_read_loopback_files(kernel_t)
 ')
diff --git a/policy/modules/system/fstools.te b/policy/modules/system/fstools.te
index 653d0b9..8c751f5 100644
--- a/policy/modules/system/fstools.te
+++ b/policy/modules/system/fstools.te
@@ -53,6 +53,10 @@ logging_log_filetrans(fsadm_t, fsadm_log_t, file)
 # Enable swapping to files
 allow fsadm_t swapfile_t:file { rw_file_perms swapon };
 
+# losetup: bind mount_loopback_t files to loop devices
+dev_rw_loop_control(fsadm_t)
+mount_rw_loopback_files(fsadm_t)
+
 kernel_read_system_state(fsadm_t)
 kernel_read_kernel_sysctls(fsadm_t)
 kernel_request_load_module(fsadm_t)
-- 
1.8.5.5

[refpolicy] [PATCH 3/3] Add neccessary permissions for losetup

[Christopher J. PeBenito]

On 2/16/2014 11:34 AM, Luis Ressel wrote:
> This allows losetup to bind mount_loopback_t files to loop devices.
> ---
>  policy/modules/kernel/kernel.te  | 2 ++
>  policy/modules/system/fstools.te | 4 ++++
>  2 files changed, 6 insertions(+)
> 
> diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te
> index 7f7372f..cdea637 100644
> --- a/policy/modules/kernel/kernel.te
> +++ b/policy/modules/kernel/kernel.te
> @@ -317,6 +317,8 @@ optional_policy(`
>  ')
>  
>  optional_policy(`
> +	# loop devices
> +	fsadm_use_fds(kernel_t)
>  	mount_use_fds(kernel_t)
>  	mount_read_loopback_files(kernel_t)
>  ')

While I doubt that any system would be missing mount, I could see a stateless system missing fsadm.  This addition should be separated out into another optional.

> diff --git a/policy/modules/system/fstools.te b/policy/modules/system/fstools.te
> index 653d0b9..8c751f5 100644
> --- a/policy/modules/system/fstools.te
> +++ b/policy/modules/system/fstools.te
> @@ -53,6 +53,10 @@ logging_log_filetrans(fsadm_t, fsadm_log_t, file)
>  # Enable swapping to files
>  allow fsadm_t swapfile_t:file { rw_file_perms swapon };
>  
> +# losetup: bind mount_loopback_t files to loop devices
> +dev_rw_loop_control(fsadm_t)
> +mount_rw_loopback_files(fsadm_t)

These need to be moved to their correct place in the file.

-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

[refpolicy] [PATCH 1/3] system/mount.if: Add mount_rw_loopback_files interface

[Luis Ressel]

---
 policy/modules/system/mount.if | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/policy/modules/system/mount.if b/policy/modules/system/mount.if
index fe24186..8a2105b 100644
--- a/policy/modules/system/mount.if
+++ b/policy/modules/system/mount.if
@@ -191,3 +191,21 @@ interface(`mount_read_loopback_files',`
 
 	allow $1 mount_loopback_t:file read_file_perms;
 ')
+
+########################################
+## <summary>
+##	Read and write loopback filesystem image files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`mount_rw_loopback_files',`
+	gen_require(`
+		type mount_loopback_t;
+	')
+
+	allow $1 mount_loopback_t:file rw_file_perms;
+')
-- 
2.0.4

[refpolicy] [PATCH 3/3] Add neccessary permissions for losetup

[Luis Ressel]

This allows losetup to bind mount_loopback_t files to loop devices.
---
 policy/modules/kernel/kernel.te  | 5 +++++
 policy/modules/system/fstools.te | 5 +++++
 2 files changed, 10 insertions(+)

diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te
index 7fe10c3..777f180 100644
--- a/policy/modules/kernel/kernel.te
+++ b/policy/modules/kernel/kernel.te
@@ -300,6 +300,11 @@ ifdef(`distro_redhat',`
 ')
 
 optional_policy(`
+	# loop devices
+	fsadm_use_fds(kernel_t)
+')
+
+optional_policy(`
 	hotplug_search_config(kernel_t)
 ')
 
diff --git a/policy/modules/system/fstools.te b/policy/modules/system/fstools.te
index b876224..1d40813 100644
--- a/policy/modules/system/fstools.te
+++ b/policy/modules/system/fstools.te
@@ -94,6 +94,8 @@ dev_rw_sysfs(fsadm_t)
 dev_getattr_usbfs_dirs(fsadm_t)
 # Access to /dev/mapper/control
 dev_rw_lvm_control(fsadm_t)
+# for losetup
+dev_rw_loop_control(fsadm_t)
 
 domain_use_interactive_fds(fsadm_t)
 
@@ -125,6 +127,9 @@ files_search_all(fsadm_t)
 mls_file_read_all_levels(fsadm_t)
 mls_file_write_all_levels(fsadm_t)
 
+# losetup: bind mount_loopback_t files to loop devices
+mount_rw_loopback_files(fsadm_t)
+
 storage_raw_read_fixed_disk(fsadm_t)
 storage_raw_write_fixed_disk(fsadm_t)
 storage_raw_read_removable_device(fsadm_t)
-- 
2.0.4

[refpolicy] [PATCH 3/3] Add neccessary permissions for losetup

[Luis Ressel]

On Mon, 11 Aug 2014 15:33:18 +0200
Luis Ressel <aranea@aixah.de> wrote:

> diff --git a/policy/modules/system/fstools.te
> b/policy/modules/system/fstools.te index b876224..1d40813 100644
> --- a/policy/modules/system/fstools.te
> +++ b/policy/modules/system/fstools.te
> @@ -94,6 +94,8 @@ dev_rw_sysfs(fsadm_t)
>  dev_getattr_usbfs_dirs(fsadm_t)
>  # Access to /dev/mapper/control
>  dev_rw_lvm_control(fsadm_t)
> +# for losetup
> +dev_rw_loop_control(fsadm_t)
>  
>  domain_use_interactive_fds(fsadm_t)
>  
> @@ -125,6 +127,9 @@ files_search_all(fsadm_t)
>  mls_file_read_all_levels(fsadm_t)
>  mls_file_write_all_levels(fsadm_t)
>  
> +# losetup: bind mount_loopback_t files to loop devices
> +mount_rw_loopback_files(fsadm_t)
> +
>  storage_raw_read_fixed_disk(fsadm_t)
>  storage_raw_write_fixed_disk(fsadm_t)
>  storage_raw_read_removable_device(fsadm_t)

I hope these are at the correct positions now as Chris requested.


Regards,
Luis Ressel
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 949 bytes
Desc: not available
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20140811/9a409739/attachment.bin 

[refpolicy] [PATCH 3/3] Add neccessary permissions for losetup

[Luis Ressel]

On Mon, 11 Aug 2014 15:33:18 +0200
Luis Ressel <aranea@aixah.de> wrote:

>  optional_policy(`
> +	# loop devices
> +	fsadm_use_fds(kernel_t)
> +')
> +
> +optional_policy(`
>  	hotplug_search_config(kernel_t)
>  ')

Whoops, that patch is faulty, it should be fstools_use_fds() of course.
I'll send a new patch.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 949 bytes
Desc: not available
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20140812/bdc8a21b/attachment.bin