From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-15.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 61829C433DB for ; Mon, 18 Jan 2021 14:49:09 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 2EF6322B40 for ; Mon, 18 Jan 2021 14:49:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2405194AbhAROsl (ORCPT ); Mon, 18 Jan 2021 09:48:41 -0500 Received: from smtp.sws.net.au ([46.4.88.250]:33226 "EHLO smtp.sws.net.au" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2405190AbhAROsj (ORCPT ); Mon, 18 Jan 2021 09:48:39 -0500 Received: from xev.coker.com.au (localhost [127.0.0.1]) by smtp.sws.net.au (Postfix) with ESMTP id DF0EA16A7C for ; Tue, 19 Jan 2021 01:47:50 +1100 (AEDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=coker.com.au; s=2008; t=1610981271; bh=w9LMPVqXcU+EA3rh1B5ZFrRczky3MuRZGehn6IBxZUs=; l=6134; h=Date:From:To:Subject:From; b=WKwdoc7Dh7pyIGm/ezgCOPoGrHjJQ+zyVfCnGD5Dqed6BTFlr96wprkrunOf3VWBJ fbd8mxgQCO2zfD7j40rGcgDwulWZ3UvV1xij6tlAiySA3fSrW8BXV009hJidKKIwO5 qKcEnJQ06t70bgc/H6WkZL8SdhcViQR7BZDGIJNY= Received: by xev.coker.com.au (Postfix, from userid 1001) id 72E721319B05; Tue, 19 Jan 2021 01:47:46 +1100 (AEDT) Date: Tue, 19 Jan 2021 01:47:46 +1100 From: Russell Coker To: selinux-refpolicy@vger.kernel.org Subject: [PATCH] matrixd (synapse) policy Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Precedence: bulk List-ID: X-Mailing-List: selinux-refpolicy@vger.kernel.org This is the policy for a Matrix daemon, it was written for Synapse but should be OK with minimal modifications for other Matrix daemons. Thanks to 0xC0ncord for writing a policy which gave me the idea for a tunable for federation. I am happy for this to be included in git now, but no doubt Chris will suggest some changes. Signed-off-by: Russell Coker Index: refpolicy-2.20210115/policy/modules/kernel/corenetwork.te.in =================================================================== --- refpolicy-2.20210115.orig/policy/modules/kernel/corenetwork.te.in +++ refpolicy-2.20210115/policy/modules/kernel/corenetwork.te.in @@ -149,7 +149,7 @@ network_port(hadoop_namenode, tcp,8020,s network_port(hddtemp, tcp,7634,s0) network_port(howl, tcp,5335,s0, udp,5353,s0) network_port(hplip, tcp,1782,s0, tcp,2207,s0, tcp,2208,s0, tcp, 8290,s0, tcp,50000,s0, tcp,50002,s0, tcp,8292,s0, tcp,9100,s0, tcp,9101,s0, tcp,9102,s0, tcp,9220,s0, tcp,9221,s0, tcp,9222,s0, tcp,9280,s0, tcp,9281,s0, tcp,9282,s0, tcp,9290,s0, tcp,9291,s0) -network_port(http, tcp,80,s0, tcp,443,s0, tcp,488,s0, tcp,8008,s0, tcp,8009,s0, tcp,8443,s0) #8443 is mod_nss default port +network_port(http, tcp,80,s0, tcp,443,s0, tcp,488,s0, tcp,8008,s0, tcp,8009,s0, tcp,8443,s0, tcp,8448,s0) #8443 is mod_nss default port network_port(http_cache, tcp,3128,s0, udp,3130,s0, tcp,8080,s0, tcp,8118,s0, tcp,10001-10010,s0) # 8118 is for privoxy network_port(i18n_input, tcp,9010,s0) network_port(imaze, tcp,5323,s0, udp,5323,s0) Index: refpolicy-2.20210115/policy/modules/services/matrixd.fc =================================================================== --- /dev/null +++ refpolicy-2.20210115/policy/modules/services/matrixd.fc @@ -0,0 +1,4 @@ +/var/lib/matrix-synapse(/.*)? gen_context(system_u:object_r:matrixd_var_t,s0) +/var/log/matrix-synapse(/.*)? gen_context(system_u:object_r:matrixd_log_t,s0) +/etc/matrix-synapse(/.*)? gen_context(system_u:object_r:matrixd_conf_t,s0) +/usr/bin/synctl -- gen_context(system_u:object_r:matrixd_exec_t,s0) Index: refpolicy-2.20210115/policy/modules/services/matrixd.if =================================================================== --- /dev/null +++ refpolicy-2.20210115/policy/modules/services/matrixd.if @@ -0,0 +1 @@ +## Matrixd Index: refpolicy-2.20210115/policy/modules/services/matrixd.te =================================================================== --- /dev/null +++ refpolicy-2.20210115/policy/modules/services/matrixd.te @@ -0,0 +1,124 @@ +policy_module(matrixd, 1.0.0) + +######################################## +# +# Declarations +# + +## +##

+## Determine whether Matrixd is allowed to federate +## (bind all UDP ports and connect to all TCP ports). +##

+## +gen_tunable(matrix_allow_federation, true) + +## +##

+## Determine whether Matrixd can connect to the Postgres database. +##

+## +gen_tunable(matrix_postgresql_connect, false) + + +type matrixd_t; +type matrixd_exec_t; +init_daemon_domain(matrixd_t, matrixd_exec_t) + +type matrixd_var_t; +files_type(matrixd_var_t) +manage_files_pattern(matrixd_t, matrixd_var_t, matrixd_var_t) +files_search_var_lib(matrixd_t) +allow matrixd_t matrixd_var_t:file map; +allow matrixd_t matrixd_var_t:dir manage_dir_perms; + +type matrixd_log_t; +logging_log_file(matrixd_log_t) +logging_search_logs(matrixd_t) +manage_files_pattern(matrixd_t, matrixd_log_t, matrixd_log_t) + +type matrixd_conf_t; +files_config_file(matrixd_conf_t) +read_files_pattern(matrixd_t, matrixd_conf_t, matrixd_conf_t) +allow matrixd_t matrixd_conf_t:dir list_dir_perms; + +type matrixd_tmp_t; +files_tmp_file(matrixd_tmp_t) +allow matrixd_t matrixd_tmp_t:file { manage_file_perms map }; +files_tmp_filetrans(matrixd_t, matrixd_tmp_t, file) +fs_tmpfs_filetrans(matrixd_t, matrixd_tmp_t, file) + +######################################## +# +# Local policy +# + +allow matrixd_t self:fifo_file rw_file_perms; +allow matrixd_t self:tcp_socket create_stream_socket_perms; +allow matrixd_t self:netlink_route_socket rw_netlink_socket_perms; + +corenet_tcp_connect_http_port(matrixd_t) +corenet_tcp_connect_http_cache_port(matrixd_t) +corenet_udp_bind_generic_port(matrixd_t) +corenet_tcp_bind_http_port(matrixd_t) +corenet_udp_bind_reserved_port(matrixd_t) + +allow matrixd_t self:udp_socket create_socket_perms; +allow matrixd_t self:unix_dgram_socket { create getopt setopt write }; +# https://cffi.readthedocs.io/en/latest/using.html#callbacks +allow matrixd_t self:process execmem; + +can_exec(matrixd_t, { matrixd_tmp_t matrixd_var_t }) + +kernel_read_system_state(matrixd_t) +kernel_search_fs_sysctls(matrixd_t) +kernel_read_vm_overcommit_sysctl(matrixd_t) +kernel_search_vm_sysctl(matrixd_t) + +corecmd_exec_bin(matrixd_t) +corecmd_shell_entry_type(matrixd_t) +corecmd_exec_shell(matrixd_t) + +corenet_tcp_bind_generic_node(matrixd_t) +corenet_udp_bind_generic_node(matrixd_t) + +dev_read_urand(matrixd_t) + +files_read_etc_files(matrixd_t) +files_read_etc_runtime_files(matrixd_t) +files_read_etc_symlinks(matrixd_t) + +# for /usr/share/ca-certificates +files_read_usr_files(matrixd_t) + +init_search_runtime(matrixd_t) +libs_exec_ldconfig(matrixd_t) +libs_exec_lib_files(matrixd_t) +logging_send_syslog_msg(matrixd_t) + +miscfiles_read_generic_tls_privkey(matrixd_t) +miscfiles_read_generic_certs(matrixd_t) +miscfiles_read_localization(matrixd_t) + +sysnet_read_config(matrixd_t) + +userdom_search_user_runtime_root(matrixd_t) + +optional_policy(` + apache_search_config(matrixd_t) +') + +tunable_policy(`matrix_allow_federation',` + corenet_tcp_connect_all_unreserved_ports(matrixd_t) + corenet_tcp_connect_generic_port(matrixd_t) + corenet_udp_bind_all_ports(matrixd_t) +', ` + corenet_dontaudit_tcp_connect_all_ports(matrixd_t) + corenet_dontaudit_udp_bind_all_ports(matrixd_t) +') + +tunable_policy(`matrix_postgresql_connect',` + postgresql_stream_connect(matrixd_t) + postgresql_tcp_connect(matrixd_t) +') +