From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.sws.net.au (smtp.sws.net.au [144.76.186.9]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4478AA59 for ; Sat, 21 Dec 2024 02:28:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=144.76.186.9 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1734748142; cv=none; b=CHDJSK+vbuZzHL2xkaHQF1kw/TE1yxQHVeBGpZ1JGcnwjnv+S/tLM+iHsewS/XNiq4d0CGI2EkLK6NqKV+FCuWDnS2TsCPzrnoe/vSEIRJGP8xF9FMiKRW5agc4qEmWPg0wmrMCSp0ogrf9ImbdSAUDSk5wqwyy6nT6ggY1dKCk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1734748142; c=relaxed/simple; bh=9ByfGSIrrCGti64Tpkv2Zy5Iv2nDxmYfo63Z8fRzjQo=; h=From:To:Subject:Date:Message-ID:MIME-Version:Content-Type; b=h2QceJGpobzx8ynj9b4G5LlnrB/v8tavbW3wS5zCynU9Y2KfeYfL/6/B4O5tkuvflQIyT/jZf066wIjBm06CQShMXmHz0sW5GDwj/RBb1Kd0VMQZDK4nF7Q/MLAm1HspbKxx+u+spwfZM/ZQQxAXC6VZm0mwZ/HdjI31l0MJn5s= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=coker.com.au; spf=pass smtp.mailfrom=coker.com.au; dkim=pass (1024-bit key) header.d=coker.com.au header.i=@coker.com.au header.b=p0ly5C39; arc=none smtp.client-ip=144.76.186.9 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=coker.com.au Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=coker.com.au Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=coker.com.au header.i=@coker.com.au header.b="p0ly5C39" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=coker.com.au; s=2008; t=1734747830; bh=yJIKRoVdj6Kr3y67IoZLrH2O8jCVQ252+DaH0fRT1Yo=; l=6615; h=From:To:Subject:Date:From; b=p0ly5C39NzGzfa4LB25AVV8zo/fsqm/6ciXHIa51t6W0pCYT42dFxy3HCuat+yvdX Am2fwAUQY1bmXG3nseITIBhIggZQBd1OOeFgfkWxcgsRMjURT+MTYrzqvq4cOackUC IpWnTuGTOigPdQYqQV+U3NAhYIjWUp3kbmy5ubbM= Received: from liv.coker.com.au (unknown [IPv6:2001:4479:4105:200:6d3f:2b3d:6cc7:c85c]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) (Authenticated sender: russell@coker.com.au) by smtp.sws.net.au (Postfix) with ESMTPSA id F34CF1059E for ; Sat, 21 Dec 2024 13:23:49 +1100 (AEDT) From: Russell Coker To: selinux-refpolicy@vger.kernel.org Subject: policy to systemd Date: Sat, 21 Dec 2024 13:23:44 +1100 Message-ID: <9420284.CDJkKcVGEf@cupcakke> Precedence: bulk X-Mailing-List: selinux-refpolicy@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="nextPart3297955.5fSG56mABF" Content-Transfer-Encoding: 7Bit This is a multi-part message in MIME format. --nextPart3297955.5fSG56mABF Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" I've attached an early version of a program to generate systemd security settings from SE Linux policy. The aim of this is to lock down daemons on non-SE systems while using tested policy and to also act as a second level of security on SE Linux systems while giving a lower score for "systemd-analyze security". Anyone have any ideas for how to automatically determine SystemCallFilter values from policy? -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/ --nextPart3297955.5fSG56mABF Content-Disposition: attachment; filename="pol2systemd.pl" Content-Transfer-Encoding: base64 Content-Type: application/x-perl; name="pol2systemd.pl" IyEvdXNyL2Jpbi9wZXJsCnVzZSBzdHJpY3Q7CgojIHRha2VzIGEgc2luZ2xlIHBhcmFtZXRlciBv ZiBhIGRvbWFpbiBmb3IgYSBkYWVtb24gYW5kIGdlbmVyYXRlcyBzeXN0ZW1kCiMgc2VjdXJpdHkg cnVsZXMgYmFzZWQgb24gdGhlIFNFIExpbnV4IHBvbGljeQoKbXkgQFJlc3RyaWN0QWRkcmVzc0Zh bWlsaWVzOwpwdXNoIEBSZXN0cmljdEFkZHJlc3NGYW1pbGllcywgIkFGX05FVExJTksiOwpteSBA U3lzdGVtQ2FsbEZpbHRlcjsKbXkgJWNmZzsKCmZvcmVhY2ggKCdQcml2YXRlRGV2aWNlcycsICdS ZXN0cmljdFNVSURTR0lEJywgJ1Byb3RlY3RIb21lJywgJ1Byb3RlY3RDbG9jaycsICdNZW1vcnlE ZW55V3JpdGVFeGVjdXRlJywgJ1Jlc3RyaWN0TmFtZXNwYWNlcycsICdQcm90ZWN0S2VybmVsTG9n cycsICdQcm90ZWN0Q29udHJvbEdyb3VwcycsICdQcm90ZWN0S2VybmVsTW9kdWxlcycsICdQcm90 ZWN0SG9zdG5hbWUnLCAnUHJvdGVjdEtlcm5lbFR1bmFibGVzJywgJ1ByaXZhdGVUbXAnLCAnTm9O ZXdQcml2aWxlZ2VzJykKewogICRjZmd7JF99ID0gInRydWUiOwp9Cm15ICRDYXBhYmlsaXR5Qm91 bmRpbmdTZXQgPSAiIjsKCm9wZW4oVFJBTlMsICJzZXNlYXJjaCAtVCAtcyAkQVJHVlswXSAtYyBw cm9jZXNzfCIpIG9yIGRpZSAiQ2FuJ3QgcnVuIHNlc2VhcmNoIjsKd2hpbGUoPFRSQU5TPikKewog ICRjZmd7Tm9OZXdQcml2aWxlZ2VzfSA9ICJmYWxzZSI7Cn0KY2xvc2UoVFJBTlMpOwoKb3BlbihB TExPVywgInNlc2VhcmNoIC1BIC1zICRBUkdWWzBdfCIpIG9yIGRpZSAiQ2FuJ3QgcnVuIHNlc2Vh cmNoIjsKd2hpbGUoPEFMTE9XPikKewogIGNob21wOwogICMgcmVtb3ZlIGJvb2xlYW4gY2hlY2tz LCBhbnl0aGluZyBhbGxvd2VkIHdpdGggYW55IGJvb2xlYW4gaXMgYWRkZWQKICAkXyA9fiBzLyBc Wy4qJC8vOwogICMgcmVtb3ZlIHRyYWlsaW5nIDsKICAkXyA9fiBzLzsvLzsKICBpZigkXyA9fiAi OmNhcGFiaWxpdHkgIikKICB7CiAgICAkXyA9fiBzL14uKjpjYXBhYmlsaXR5IC8vOwogICAgJENh cGFiaWxpdHlCb3VuZGluZ1NldCAuPSAkXzsKICAgIGlmKCRDYXBhYmlsaXR5Qm91bmRpbmdTZXQg PX4gIkNBUF9NS05PRCIpCiAgICB7CiAgICAgICRjZmd7UHJpdmF0ZURldmljZXN9ID0gImZhbHNl IjsKICAgIH0KICAgIG5leHQ7CiAgfQogIGlmKCRfID1+ICI6Y2hyX2ZpbGUgIikKICB7CiAgICBp ZigkXyA9fiAiY29uc29sZV9kZXZpY2VfdCIgb3IgJF8gPX4gIl9kZXZwdHNfdCIgb3IgJF8gPX4g InB0eW5vZGUiIG9yICRfID1+ICJ0dHlfZGV2aWNlX3QiIG9yICRfID1+ICJ0dHlub2RlIiBvciAk XyA9fiAiZGV2dHR5X3QiIG9yICRfID1+ICJudWxsX2RldmljZV90IiBvciAkXyA9fiAidXJhbmRv bV9kZXZpY2VfdCIgb3IgJF8gPX4gInplcm9fZGV2aWNlX3QiKQogICAgewogICAgICBuZXh0Owog ICAgfQogICAgJGNmZ3tQcml2YXRlRGV2aWNlc30gPSAiZmFsc2UiOwogICAgbmV4dDsKICB9CiAg aWYoJF8gPX4gIjpibGtfZmlsZSAiKQogIHsKICAgICRjZmd7UHJpdmF0ZURldmljZXN9ID0gImZh bHNlIjsKICAgIG5leHQ7CiAgfQogIGlmKCRfID1+IC9leGVjX3QuKnJlbGFiZWwvKQogIHsKICAg ICRjZmd7UmVzdHJpY3RTVUlEU0dJRH0gPSAiZmFsc2UiOwogIH0KICBpZigkXyA9fiAvOnRtcF90 LykKICB7CiAgICAkY2Zne1ByaXZhdGVUbXB9ID0gImZhbHNlIjsKICB9CiAgaWYoJF8gPX4gImhv bWVfcm9vdF90IiBvciAkXyA9fiAidXNlcl9ob21lX2Rpcl90IikKICB7CiAgICBpZihub3QgJF8g PX4gIm5zc3dpdGNoX2RvbWFpbiIpCiAgICB7CiAgICAgICRjZmd7UHJvdGVjdEhvbWV9ID0gImZh bHNlIjsKICAgIH0KICAgIG5leHQ7CiAgfQogIGlmKCRfID1+IC9wcm9jZXNzLipleGVjbWVtLykK ICB7CiAgICAkY2Zne01lbW9yeURlbnlXcml0ZUV4ZWN1dGV9ID0gImZhbHNlIjsKICAgIG5leHQ7 CiAgfQogIGlmKCRfID1+IC9jYXBfdXNlcm5zLyBvciAkXyA9fiAvY2FwMl91c2VybnMvKQogIHsK ICAgICRjZmd7UmVzdHJpY3ROYW1lc3BhY2VzfSA9ICJmYWxzZSI7CiAgICBuZXh0OwogIH0KICBp ZigkXyA9fiAvY2dyb3VwLip3cml0ZS8pCiAgewogICAgJGNmZ3tQcm90ZWN0Q29udHJvbEdyb3Vw c30gPSAiZmFsc2UiOwogICAgbmV4dDsKICB9CiAgaWYoJF8gPX4gL2tlcm5lbF90OnN5c3RlbSBt b2R1bGVfcmVxdWVzdC8pCiAgewogICAgJGNmZ3tQcm90ZWN0S2VybmVsTW9kdWxlc30gPSAiZmFs c2UiOwogICAgbmV4dDsKICB9CiAgaWYoJF8gPX4gL3N5c2N0bF8uKndyaXRlLykKICB7CiAgICAk Y2Zne1Byb3RlY3RLZXJuZWxUdW5hYmxlc30gPSAiZmFsc2UiOwogICAgbmV4dDsKICB9CiAgaWYo JF8gPX4gL3VkcF9zb2NrZXQvIG9yICRfID1+IC90Y3Bfc29ja2V0LykKICB7CiAgICBwdXNoIEBS ZXN0cmljdEFkZHJlc3NGYW1pbGllcywgIkFGX0lORVQgQUZfSU5FVDYiOwogICAgbmV4dDsKICB9 CiAgaWYoJF8gPX4gL3VuaXhfLipfc29ja2V0LykKICB7CiAgICBwdXNoIEBSZXN0cmljdEFkZHJl c3NGYW1pbGllcywgIkFGX1VOSVgiOwogICAgbmV4dDsKICB9CiAgaWYoJF8gPX4gL3BhY2tldF9z b2NrZXQvKQogIHsKICAgIHB1c2ggQFJlc3RyaWN0QWRkcmVzc0ZhbWlsaWVzLCAiQUZfUEFDS0VU IjsKICAgIG5leHQ7CiAgfQp9CmNsb3NlKEFMTE9XKTsKCgpteSAkUHJvdGVjdFN5c3RlbSA9ICJz dHJpY3QiOwpvcGVuKFNUUklDVFdSSVRFLCAiKHNlc2VhcmNoIC1BIC1zICRBUkdWWzBdIC1jIGRp ciAtcCB3cml0ZSA7IHNlc2VhcmNoIC1BIC1zICRBUkdWWzBdIC1jIGZpbGUgLXAgd3JpdGUpfCIp IG9yIGRpZSAiQ2FuJ3QgcnVuIHNlc2VhcmNoIjsKd2hpbGUoPFNUUklDVFdSSVRFPikKewogICRQ cm90ZWN0U3lzdGVtID0gImZ1bGwiOwogIG9wZW4oRVRDLCAiKHNlc2VhcmNoIC1BIC1zICRBUkdW WzBdIC10IGNvbmZpZ2ZpbGUgLWMgZGlyIC1wIHdyaXRlIDsgc2VzZWFyY2ggLUEgLXMgJEFSR1Zb MF0gLXQgY29uZmlnZmlsZSAtYyBmaWxlIC1wIHdyaXRlKXwiKSBvciBkaWUgIkNhbid0IHJ1biBz ZXNlYXJjaCI7CiAgd2hpbGUoPEVUQz4pCiAgewogICAgJFByb3RlY3RTeXN0ZW0gPSAidHJ1ZSI7 CiAgICBsYXN0OwogIH0gCiAgY2xvc2UoRVRDKTsKICBsYXN0Owp9CmNsb3NlKFNUUklDVFdSSVRF KTsKCiRDYXBhYmlsaXR5Qm91bmRpbmdTZXQgPX4gcy9bXHtcfV0vIC9nOwokQ2FwYWJpbGl0eUJv dW5kaW5nU2V0ID1+IHMvICAvIC9nOwokQ2FwYWJpbGl0eUJvdW5kaW5nU2V0ID0gdWMoJENhcGFi aWxpdHlCb3VuZGluZ1NldCk7CiRDYXBhYmlsaXR5Qm91bmRpbmdTZXQgPSBqb2luKCIgQ0FQXyIs IHNwbGl0KC8gLywgJENhcGFiaWxpdHlCb3VuZGluZ1NldCkpOwppZiAobGVuZ3RoKCRDYXBhYmls aXR5Qm91bmRpbmdTZXQpID4gMCkKewogICRDYXBhYmlsaXR5Qm91bmRpbmdTZXQgPSAiQ0FQXyIg LiAkQ2FwYWJpbGl0eUJvdW5kaW5nU2V0Owp9CgppZigkQ2FwYWJpbGl0eUJvdW5kaW5nU2V0ID1+ ICJDQVBfU0VUR0lEIiBvciAkQ2FwYWJpbGl0eUJvdW5kaW5nU2V0ID1+ICJDQVBfU0VUVUlEIikK ewogICRjZmd7UmVzdHJpY3RTVUlEU0dJRH0gPSAiZmFsc2UiOwp9CmlmKCRDYXBhYmlsaXR5Qm91 bmRpbmdTZXQgPX4gIkNBUF9TWVNfVElNRSIpCnsKICAkY2Zne1Byb3RlY3RDbG9ja30gPSAiZmFs c2UiOwp9CmlmKCRDYXBhYmlsaXR5Qm91bmRpbmdTZXQgPX4gIkNBUF9TWVNMT0ciKQp7CiAgJGNm Z3tQcm90ZWN0S2VybmVsTG9nc30gPSAiZmFsc2UiOwp9CmlmKCRDYXBhYmlsaXR5Qm91bmRpbmdT ZXQgPX4gIkNBUF9TWVNfQURNSU4iKQp7CiAgJGNmZ3tQcm90ZWN0SG9zdG5hbWV9ID0gImZhbHNl IjsKfQoKcHJpbnQgIkNhcGFiaWxpdHlCb3VuZGluZ1NldD0kQ2FwYWJpbGl0eUJvdW5kaW5nU2V0 XG4iOwpwcmludCAiUHJvdGVjdFN5c3RlbT0kUHJvdGVjdFN5c3RlbVxuIjsKZm9yZWFjaCAoa2V5 cyglY2ZnKSkKewogIHByaW50ICIkXz0kY2ZneyRffVxuIjsKfQoKIyBmcm9tIGh0dHBzOi8vcGVy bG1hdmVuLmNvbS91bmlxdWUtdmFsdWVzLWluLWFuLWFycmF5LWluLXBlcmwKc3ViIHVuaXEKewog IG15ICVoID0gbWFwIHsgJF8gPT4gMSB9IEBfOwogIGtleXMgJWgKfTsKCm15ICRyZXMgPSBqb2lu KCIgIiwgdW5pcShAUmVzdHJpY3RBZGRyZXNzRmFtaWxpZXMpKTsKcHJpbnQgIlJlc3RyaWN0QWRk cmVzc0ZhbWlsaWVzPSRyZXNcbiI7Cg== --nextPart3297955.5fSG56mABF--