[refpolicy] [PATCH] fstools: add in filetrans for /run dir

[cpebenito@tresys.com (Christopher J. PeBenito)]

On 4/13/2015 2:13 PM, Jason Zaman wrote:
> the blkid tool writes to /run/blkid/. This creates the "fstools_run_t"
> type an allows the transition in /run.

Merged.



> type=AVC msg=audit(1428929528.885:149519): avc:  denied  { write } for pid=5590 comm="mkfs.ext4" name="/" dev="tmpfs" ino=17656 scontext=staff_u:sysadm_r:fsadm_t tcontext=system_u:object_r:var_run_t tclass=dir permissive=0
> 
> In permissive:
> type=AVC msg=audit(1428948565.919:160149): avc:  denied  { write } for  pid=26197 comm="mkfs.ext4" name="/" dev="tmpfs" ino=17656 scontext=staff_u:sysadm_r:fsadm_t tcontext=system_u:object_r:var_run_t tclass=dir permissive=1
> type=AVC msg=audit(1428948565.919:160149): avc:  denied  { add_name } for  pid=26197 comm="mkfs.ext4" name="blkid" scontext=staff_u:sysadm_r:fsadm_t tcontext=system_u:object_r:var_run_t tclass=dir permissive=1
> type=AVC msg=audit(1428948565.919:160149): avc:  denied  { create } for  pid=26197 comm="mkfs.ext4" name="blkid" scontext=staff_u:sysadm_r:fsadm_t tcontext=staff_u:object_r:var_run_t tclass=dir permissive=1
> type=SYSCALL msg=audit(1428948565.919:160149): arch=c000003e syscall=83 success=yes exit=0 a0=2cd79c6d214 a1=1ed a2=ffffffffffffff20 a3=539fe9bc40 items=2 ppid=28115 pid=26197 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts2 ses=2 comm="mkfs.ext4" exe="/sbin/mke2fs" subj=staff_u:sysadm_r:fsadm_t key=(null)
> type=CWD msg=audit(1428948565.919:160149):  cwd="/root/selinux"
> type=PATH msg=audit(1428948565.919:160149): item=0 name="/run/" inode=17656 dev=00:13 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:var_run_t nametype=PARENT
> type=PATH msg=audit(1428948565.919:160149): item=1 name="/run/blkid" inode=4062404 dev=00:13 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=staff_u:object_r:var_run_t nametype=CREATE
> type=UNKNOWN[1327] msg=audit(1428948565.919:160149): proctitle=6D6B66732E65787434002F6465762F7A72616D31
> type=AVC msg=audit(1428948565.919:160150): avc:  denied  { write } for  pid=26197 comm="mkfs.ext4" name="blkid" dev="tmpfs" ino=4062404 scontext=staff_u:sysadm_r:fsadm_t tcontext=staff_u:object_r:var_run_t tclass=dir permissive=1
> type=AVC msg=audit(1428948565.919:160150): avc:  denied  { add_name } for  pid=26197 comm="mkfs.ext4" name="blkid.tab" scontext=staff_u:sysadm_r:fsadm_t tcontext=staff_u:object_r:var_run_t tclass=dir permissive=1
> type=AVC msg=audit(1428948565.919:160150): avc:  denied  { create } for  pid=26197 comm="mkfs.ext4" name="blkid.tab" scontext=staff_u:sysadm_r:fsadm_t tcontext=staff_u:object_r:var_run_t tclass=file permissive=1
> type=AVC msg=audit(1428948565.919:160150): avc:  denied  { write open } for  pid=26197 comm="mkfs.ext4" path="/run/blkid/blkid.tab" dev="tmpfs" ino=4062405 scontext=staff_u:sysadm_r:fsadm_t tcontext=staff_u:object_r:var_run_t tclass=file permissive=1
> type=AVC msg=audit(1428948565.919:160151): avc:  denied  { getattr } for  pid=26197 comm="mkfs.ext4" path="/run/blkid/blkid.tab" dev="tmpfs" ino=4062405 scontext=staff_u:sysadm_r:fsadm_t tcontext=staff_u:object_r:var_run_t tclass=file permissive=1
> 
> Changes from v1:
> - only transition on dir, not file.
> - add fcontext for /run/fsck too.
> - the audit log in the previous version was missing some lines.
> ---
>  policy/modules/system/fstools.fc | 3 +++
>  policy/modules/system/fstools.te | 7 +++++++
>  2 files changed, 10 insertions(+)
> 
> diff --git a/policy/modules/system/fstools.fc b/policy/modules/system/fstools.fc
> index d10368d..22996d5 100644
> --- a/policy/modules/system/fstools.fc
> +++ b/policy/modules/system/fstools.fc
> @@ -62,3 +62,6 @@
>  /usr/sbin/smartctl	--	gen_context(system_u:object_r:fsadm_exec_t,s0)
>  
>  /var/log/fsck(/.*)?		gen_context(system_u:object_r:fsadm_log_t,s0)
> +
> +/var/run/blkid(/.*)?		gen_context(system_u:object_r:fsadm_run_t,s0)
> +/var/run/fsck(/.*)?		gen_context(system_u:object_r:fsadm_run_t,s0)
> diff --git a/policy/modules/system/fstools.te b/policy/modules/system/fstools.te
> index a0cfb1d..868cf31 100644
> --- a/policy/modules/system/fstools.te
> +++ b/policy/modules/system/fstools.te
> @@ -16,6 +16,9 @@ logging_log_file(fsadm_log_t)
>  type fsadm_tmp_t;
>  files_tmp_file(fsadm_tmp_t)
>  
> +type fsadm_run_t;
> +files_pid_file(fsadm_run_t)
> +
>  type swapfile_t; # customizable
>  files_type(swapfile_t)
>  
> @@ -45,6 +48,10 @@ allow fsadm_t fsadm_tmp_t:dir manage_dir_perms;
>  allow fsadm_t fsadm_tmp_t:file manage_file_perms;
>  files_tmp_filetrans(fsadm_t, fsadm_tmp_t, { file dir })
>  
> +allow fsadm_t fsadm_run_t:dir manage_dir_perms;
> +allow fsadm_t fsadm_run_t:file manage_file_perms;
> +files_pid_filetrans(fsadm_t, fsadm_run_t, dir)
> +
>  # log files
>  allow fsadm_t fsadm_log_t:dir setattr;
>  manage_files_pattern(fsadm_t, fsadm_log_t, fsadm_log_t)
> 


-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com