From: Dominick Grift <dominick.grift@defensec.nl>
To: Russell Coker <russell@coker.com.au>
Cc: selinux-refpolicy@vger.kernel.org
Subject: Re: [PATCH] mailman 3
Date: Wed, 03 Feb 2021 18:40:43 +0100 [thread overview]
Message-ID: <ypjlwnvpqcbo.fsf@defensec.nl> (raw)
In-Reply-To: <YBoZKrzxfKdrIoN+@xev> (Russell Coker's message of "Wed, 3 Feb 2021 14:31:54 +1100")
Russell Coker <russell@coker.com.au> writes:
> Patches needed for mailman3.
>
> Signed-off-by: Russell Coker <russell@coker.com.au>
>
> Index: refpolicy-2.20210203/policy/modules/services/mailman.if
> ===================================================================
> --- refpolicy-2.20210203.orig/policy/modules/services/mailman.if
> +++ refpolicy-2.20210203/policy/modules/services/mailman.if
> @@ -109,6 +109,64 @@ interface(`mailman_domtrans_cgi',`
>
> #######################################
> ## <summary>
> +## Talk to mailman_cgi_t via Unix domain socket
> +## </summary>
> +## <param name="domain">
> +## <summary>
> +## Domain talking to mailman
> +## </summary>
> +## </param>
> +#
> +interface(`mailman_connect_cgi',`
probably: mailman_stream_connect_cgi
> + gen_require(`
> + type mailman_cgi_t, mailman_runtime_t;
> + ')
> +
> + allow $1 mailman_runtime_t:dir search;
> + allow $1 mailman_runtime_t:sock_file write;
> + allow $1 mailman_cgi_t:unix_stream_socket connectto;
files_search_runtime($1)
stream_connect_pattern($1, mailman_runtime_t, mailman_runtime_t, mailman_cgi_t)
> +')
> +
> +#######################################
> +## <summary>
> +## Manage mailman runtime files
> +## </summary>
> +## <param name="domain">
> +## <summary>
> +## Domain to manage the files
> +## </summary>
> +## </param>
> +#
> +interface(`mailman_manage_runtime',`
probably mailman_manage_runtime_files
> + gen_require(`
> + type mailman_runtime_t;
> + ')
> +
> + allow $1 mailman_runtime_t:dir rw_dir_perms;
> + allow $1 mailman_runtime_t:file manage_file_perms;
files_search_runtime($1)
manage_files_pattern($1, mailman_runtime_t, mailman_runtime_t)
> +')
> +
> +#######################################
> +## <summary>
> +## read mailman runtime files
> +## </summary>
> +## <param name="domain">
> +## <summary>
> +## Domain to read the files
> +## </summary>
> +## </param>
> +#
> +interface(`mailman_read_runtime',`
probably mailman_read_runtime_files
> + gen_require(`
> + type mailman_runtime_t;
> + ')
> +
> + allow $1 mailman_runtime_t:dir search_dir_perms;
> + allow $1 mailman_runtime_t:file read_file_perms;
files_search_runtime($1)
read_files_pattern($1, mailman_runtime_t, mailman_runtime_t))
> +')
> +
> +#######################################
> +## <summary>
> ## Execute mailman in the caller domain.
> ## </summary>
> ## <param name="domain">
> @@ -181,6 +239,7 @@ interface(`mailman_read_data_files',`
> files_search_spool($1)
> list_dirs_pattern($1, mailman_data_t, mailman_data_t)
> read_files_pattern($1, mailman_data_t, mailman_data_t)
> + allow $1 mailman_data_t:file map;
maybe a seperate mailman_map_data_files
> read_lnk_files_pattern($1, mailman_data_t, mailman_data_t)
> ')
>
> @@ -342,3 +401,21 @@ interface(`mailman_domtrans_queue',`
> libs_search_lib($1)
> domtrans_pattern($1, mailman_queue_exec_t, mailman_queue_t)
> ')
> +
> +#######################################
> +## <summary>
> +## Manage mailman lock dir
> +## </summary>
> +## <param name="domain">
> +## <summary>
> +## Domain allowed to manage it.
> +## </summary>
> +## </param>
> +#
> +interface(`mailman_manage_lockdir',`
> + gen_require(`
> + type mailman_lock_t;
> + ')
> +
> + allow $1 mailman_lock_t:dir manage_dir_perms;
> +')
> Index: refpolicy-2.20210203/policy/modules/services/mailman.te
> ===================================================================
> --- refpolicy-2.20210203.orig/policy/modules/services/mailman.te
> +++ refpolicy-2.20210203/policy/modules/services/mailman.te
> @@ -26,6 +26,9 @@ files_lock_file(mailman_lock_t)
> type mailman_runtime_t alias mailman_var_run_t;
> files_runtime_file(mailman_runtime_t)
>
> +type mailman_cgi_tmpfs_t;
> +files_tmpfs_file(mailman_cgi_tmpfs_t)
> +
> mailman_domain_template(mail)
> init_daemon_domain(mailman_mail_t, mailman_mail_exec_t)
> role mailman_roles types mailman_mail_t;
> @@ -89,13 +92,16 @@ miscfiles_read_localization(mailman_doma
> # CGI local policy
> #
>
> -allow mailman_cgi_t self:unix_dgram_socket { create connect };
> +allow mailman_cgi_t self:process { signal signull sigkill };
> +allow mailman_cgi_t self:fifo_file rw_file_perms;
rw_fifo_file_perms
> +allow mailman_cgi_t self:capability { dac_override setgid setuid };
> +allow mailman_cgi_t self:unix_dgram_socket create_socket_perms;
>
> allow mailman_cgi_t mailman_archive_t:dir search_dir_perms;
> allow mailman_cgi_t mailman_archive_t:file read_file_perms;
>
> allow mailman_cgi_t mailman_data_t:dir rw_dir_perms;
> -allow mailman_cgi_t mailman_data_t:file manage_file_perms;
> +allow mailman_cgi_t mailman_data_t:file { map manage_file_perms };
> allow mailman_cgi_t mailman_data_t:lnk_file read_lnk_file_perms;
>
> allow mailman_cgi_t mailman_lock_t:dir manage_dir_perms;
> @@ -104,25 +110,40 @@ allow mailman_cgi_t mailman_lock_t:file
> allow mailman_cgi_t mailman_log_t:file { append_file_perms read_file_perms };
> allow mailman_cgi_t mailman_log_t:dir search_dir_perms;
>
> +allow mailman_cgi_t mailman_runtime_t:dir rw_dir_perms;
> +allow mailman_cgi_t mailman_runtime_t:file read_file_perms;
> +allow mailman_cgi_t mailman_runtime_t:sock_file manage_file_perms;
> +
> +fs_tmpfs_filetrans(mailman_cgi_t, mailman_cgi_tmpfs_t, file)
> +allow mailman_cgi_t mailman_cgi_tmpfs_t:file { map manage_file_perms };
> +
> kernel_read_crypto_sysctls(mailman_cgi_t)
> +kernel_read_net_sysctls(mailman_cgi_t)
> kernel_read_system_state(mailman_cgi_t)
> +kernel_search_vm_sysctl(mailman_cgi_t)
>
> +corecmd_bin_entry_type(mailman_cgi_t)
why is this needed?
> corecmd_exec_bin(mailman_cgi_t)
>
> +corenet_tcp_bind_generic_node(mailman_cgi_t)
> +corenet_tcp_connect_all_unreserved_ports(mailman_cgi_t)
> +
> dev_read_urand(mailman_cgi_t)
>
> files_search_locks(mailman_cgi_t)
> files_read_usr_files(mailman_cgi_t)
>
> +init_daemon_domain(mailman_cgi_t, mailman_cgi_exec_t)
style issue, needs to go up
> +
> term_use_controlling_term(mailman_cgi_t)
>
> libs_dontaudit_write_lib_dirs(mailman_cgi_t)
>
> logging_search_logs(mailman_cgi_t)
>
> +miscfiles_read_generic_certs(mailman_cgi_t)
> miscfiles_read_localization(mailman_cgi_t)
>
> -
> optional_policy(`
> apache_sigchld(mailman_cgi_t)
> apache_use_fds(mailman_cgi_t)
> @@ -133,6 +154,15 @@ optional_policy(`
> ')
>
> optional_policy(`
> + cron_rw_inherited_tmp_files(mailman_cgi_t)
> + cron_system_entry(mailman_cgi_t, mailman_cgi_exec_t)
> +')
> +
> +optional_policy(`
> + mysql_stream_connect(mailman_cgi_t)
> +')
> +
> +optional_policy(`
> postfix_read_config(mailman_cgi_t)
> ')
>
> @@ -142,7 +172,9 @@ optional_policy(`
> #
>
> allow mailman_mail_t self:capability { dac_override kill setgid setuid sys_tty_config };
> -allow mailman_mail_t self:process { signal signull setsched };
> +allow mailman_mail_t self:process { execmem signal signull setsched };
> +allow mailman_mail_t self:netlink_audit_socket { nlmsg_relay create_socket_perms };
> +allow mailman_mail_t self:fifo_file rw_file_perms;
>
> allow mailman_mail_t mailman_archive_t:dir manage_dir_perms;
> allow mailman_mail_t mailman_archive_t:file manage_file_perms;
> @@ -167,8 +199,12 @@ manage_files_pattern(mailman_mail_t, mai
> manage_dirs_pattern(mailman_mail_t, mailman_runtime_t, mailman_runtime_t)
> files_runtime_filetrans(mailman_mail_t, mailman_runtime_t, { file dir })
>
> +kernel_read_network_state(mailman_mail_t)
> kernel_read_system_state(mailman_mail_t)
>
> +corenet_tcp_bind_all_unreserved_ports(mailman_mail_t)
> +corenet_tcp_bind_generic_node(mailman_mail_t)
> +corenet_tcp_connect_http_port(mailman_mail_t)
> corenet_tcp_connect_smtp_port(mailman_mail_t)
> corenet_sendrecv_spamd_client_packets(mailman_mail_t)
> corenet_sendrecv_innd_client_packets(mailman_mail_t)
> @@ -193,6 +229,7 @@ libs_read_lib_files(mailman_mail_t)
>
> logging_search_logs(mailman_mail_t)
>
> +miscfiles_read_generic_certs(mailman_mail_t)
> miscfiles_read_localization(mailman_mail_t)
>
> mta_use_mailserver_fds(mailman_mail_t)
> @@ -200,14 +237,26 @@ mta_dontaudit_rw_delivery_tcp_sockets(ma
> mta_dontaudit_rw_queue(mailman_mail_t)
>
> optional_policy(`
> + apache_search_config(mailman_mail_t)
> +')
> +
> +optional_policy(`
> courier_read_spool(mailman_mail_t)
> ')
>
> optional_policy(`
> cron_read_pipes(mailman_mail_t)
> + cron_rw_inherited_tmp_files(mailman_mail_t)
> + cron_search_spool(mailman_mail_t)
> + cron_system_entry(mailman_mail_t, mailman_mail_exec_t)
> ')
>
> optional_policy(`
> + corenet_tcp_connect_mysqld_port(mailman_mail_t)
> +')
> +
> +optional_policy(`
> + postfix_read_config(mailman_mail_t)
> postfix_search_spool(mailman_mail_t)
> postfix_rw_inherited_master_pipes(mailman_mail_t)
> ')
> @@ -217,8 +266,8 @@ optional_policy(`
> # Queue local policy
> #
>
> -allow mailman_queue_t self:capability { setgid setuid };
> -allow mailman_queue_t self:process { setsched signal_perms };
> +allow mailman_queue_t self:capability { dac_override setgid setuid };
> +allow mailman_queue_t self:process { setsched signal_perms sigkill };
is sigkill not implied with signal_perms?
> allow mailman_queue_t self:fifo_file rw_fifo_file_perms;
>
> allow mailman_queue_t mailman_archive_t:dir manage_dir_perms;
> @@ -251,14 +300,14 @@ seutil_dontaudit_search_config(mailman_q
>
> userdom_search_user_home_dirs(mailman_queue_t)
>
> -cron_rw_tmp_files(mailman_queue_t)
> -
> optional_policy(`
> apache_read_config(mailman_queue_t)
> ')
>
> optional_policy(`
> + cron_rw_tmp_files(mailman_queue_t)
> cron_system_entry(mailman_queue_t, mailman_queue_exec_t)
> + cron_use_fds(mailman_queue_t)
> ')
>
> optional_policy(`
> Index: refpolicy-2.20210203/policy/modules/services/apache.te
> ===================================================================
> --- refpolicy-2.20210203.orig/policy/modules/services/apache.te
> +++ refpolicy-2.20210203/policy/modules/services/apache.te
> @@ -815,6 +815,7 @@ optional_policy(`
> ')
>
> optional_policy(`
> + mailman_connect_cgi(httpd_t)
> mailman_signal_cgi(httpd_t)
> mailman_domtrans_cgi(httpd_t)
> mailman_read_data_files(httpd_t)
> Index: refpolicy-2.20210203/policy/modules/services/cron.te
> ===================================================================
> --- refpolicy-2.20210203.orig/policy/modules/services/cron.te
> +++ refpolicy-2.20210203/policy/modules/services/cron.te
> @@ -607,6 +607,12 @@ optional_policy(`
> ')
>
> optional_policy(`
> + mailman_domtrans_queue(system_cronjob_t)
> + # for flock
> + mailman_manage_runtime(system_cronjob_t)
> +')
> +
> +optional_policy(`
> mrtg_append_create_logs(system_cronjob_t)
> mrtg_read_config(system_cronjob_t)
> ')
> Index: refpolicy-2.20210203/policy/modules/system/systemd.te
> ===================================================================
> --- refpolicy-2.20210203.orig/policy/modules/system/systemd.te
> +++ refpolicy-2.20210203/policy/modules/system/systemd.te
> @@ -1523,6 +1523,10 @@ optional_policy(`
> ')
>
> optional_policy(`
> + mailman_manage_lockdir(systemd_tmpfiles_t)
> +')
> +
> +optional_policy(`
> xfs_create_tmp_dirs(systemd_tmpfiles_t)
> ')
>
>
--
gpg --locate-keys dominick.grift@defensec.nl
Key fingerprint = FCD2 3660 5D6B 9D27 7FC6 E0FF DA7E 521F 10F6 4098
https://sks-keyservers.net/pks/lookup?op=get&search=0xDA7E521F10F64098
Dominick Grift
prev parent reply other threads:[~2021-02-03 17:41 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-02-03 3:31 [PATCH] mailman 3 Russell Coker
2021-02-03 17:40 ` Dominick Grift [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ypjlwnvpqcbo.fsf@defensec.nl \
--to=dominick.grift@defensec.nl \
--cc=russell@coker.com.au \
--cc=selinux-refpolicy@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.