From f5bbca8b04b2058e1f13056ab05acf93bb0c6bfb Mon Sep 17 00:00:00 2001 From: Daniel J Walsh Date: Oct 23 2008 12:54:29 +0000 Subject: - Allow kerneloops to create tmp files --- diff --git a/policy-20080710.patch b/policy-20080710.patch index 4a2fb2c..a5d571c 100644 --- a/policy-20080710.patch +++ b/policy-20080710.patch @@ -6168,8 +6168,16 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ######################################## diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.te.in serefpolicy-3.5.13/policy/modules/kernel/corenetwork.te.in --- nsaserefpolicy/policy/modules/kernel/corenetwork.te.in 2008-10-14 11:58:07.000000000 -0400 -+++ serefpolicy-3.5.13/policy/modules/kernel/corenetwork.te.in 2008-10-17 10:31:26.000000000 -0400 -@@ -93,6 +93,7 @@ ++++ serefpolicy-3.5.13/policy/modules/kernel/corenetwork.te.in 2008-10-23 08:53:02.000000000 -0400 +@@ -79,6 +79,7 @@ + network_port(auth, tcp,113,s0) + network_port(bgp, tcp,179,s0, udp,179,s0, tcp,2605,s0, udp,2605,s0) + type biff_port_t, port_type, reserved_port_type; dnl network_port(biff) # no defined portcon in current strict ++network_port(certmaster, tcp,51235,s0) + network_port(clamd, tcp,3310,s0) + network_port(clockspeed, udp,4041,s0) + network_port(cluster, tcp,5149,s0, udp,5149,s0, tcp,40040,s0, tcp,50006,s0, udp,50006,s0, tcp,50007,s0, udp,50007,s0, tcp,50008,s0, udp,50008,s0) +@@ -93,6 +94,7 @@ network_port(distccd, tcp,3632,s0) network_port(dns, udp,53,s0, tcp,53,s0) network_port(fingerd, tcp,79,s0) @@ -6177,7 +6185,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol network_port(ftp_data, tcp,20,s0) network_port(ftp, tcp,21,s0) network_port(gatekeeper, udp,1718,s0, udp,1719,s0, tcp,1721,s0, tcp,7000,s0) -@@ -117,6 +118,8 @@ +@@ -117,6 +119,8 @@ network_port(kerberos_admin, tcp,464,s0, udp,464,s0, tcp,749,s0) network_port(kerberos_master, tcp,4444,s0, udp,4444,s0) network_port(kerberos, tcp,88,s0, udp,88,s0, tcp,750,s0, udp,750,s0) @@ -6186,7 +6194,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol network_port(ktalkd, udp,517,s0, udp,518,s0) network_port(ldap, tcp,389,s0, udp,389,s0, tcp,636,s0, udp,636,s0, tcp,3268,s0) type lrrd_port_t, port_type; dnl network_port(lrrd_port_t) # no defined portcon -@@ -126,6 +129,7 @@ +@@ -126,6 +130,7 @@ network_port(mmcc, tcp,5050,s0, udp,5050,s0) network_port(monopd, tcp,1234,s0) network_port(msnp, tcp,1863,s0, udp,1863,s0) @@ -6194,7 +6202,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol network_port(mysqld, tcp,1186,s0, tcp,3306,s0) portcon tcp 63132-63163 gen_context(system_u:object_r:mysqld_port_t, s0) network_port(nessus, tcp,1241,s0) -@@ -137,11 +141,13 @@ +@@ -137,11 +142,13 @@ network_port(pegasus_http, tcp,5988,s0) network_port(pegasus_https, tcp,5989,s0) network_port(postfix_policyd, tcp,10031,s0) @@ -6208,7 +6216,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol network_port(printer, tcp,515,s0) network_port(ptal, tcp,5703,s0) network_port(pxe, udp,4011,s0) -@@ -159,9 +165,10 @@ +@@ -159,9 +166,10 @@ network_port(rwho, udp,513,s0) network_port(smbd, tcp,137-139,s0, tcp,445,s0) network_port(smtp, tcp,25,s0, tcp,465,s0, tcp,587,s0) @@ -6220,7 +6228,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol network_port(soundd, tcp,8000,s0, tcp,9433,s0, tcp, 16001, s0) type socks_port_t, port_type; dnl network_port(socks) # no defined portcon type stunnel_port_t, port_type; dnl network_port(stunnel) # no defined portcon in current strict -@@ -170,13 +177,16 @@ +@@ -170,13 +178,16 @@ network_port(syslogd, udp,514,s0) network_port(telnetd, tcp,23,s0) network_port(tftp, udp,69,s0) @@ -8480,8 +8488,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +logging_admin(logadm_t, logadm_r, { logadm_devpts_t logadm_tty_device_t }) diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/staff.te serefpolicy-3.5.13/policy/modules/roles/staff.te --- nsaserefpolicy/policy/modules/roles/staff.te 2008-08-07 11:15:11.000000000 -0400 -+++ serefpolicy-3.5.13/policy/modules/roles/staff.te 2008-10-17 10:31:27.000000000 -0400 -@@ -8,23 +8,55 @@ ++++ serefpolicy-3.5.13/policy/modules/roles/staff.te 2008-10-22 16:47:01.000000000 -0400 +@@ -8,23 +8,59 @@ role staff_r; @@ -8507,6 +8515,10 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') optional_policy(` ++ kerneloops_manage_tmp_files(staff_t) ++') ++ ++optional_policy(` + logadm_role_change_template(staff) +') + @@ -10545,7 +10557,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +') diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-3.5.13/policy/modules/services/apache.te --- nsaserefpolicy/policy/modules/services/apache.te 2008-10-16 17:21:16.000000000 -0400 -+++ serefpolicy-3.5.13/policy/modules/services/apache.te 2008-10-22 09:53:30.000000000 -0400 ++++ serefpolicy-3.5.13/policy/modules/services/apache.te 2008-10-22 14:38:49.000000000 -0400 @@ -20,6 +20,8 @@ # Declarations # @@ -10689,7 +10701,15 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol manage_dirs_pattern(httpd_t, httpd_tmp_t, httpd_tmp_t) manage_files_pattern(httpd_t, httpd_tmp_t, httpd_tmp_t) -@@ -289,6 +338,7 @@ +@@ -278,6 +327,7 @@ + manage_files_pattern(httpd_t, httpd_var_lib_t, httpd_var_lib_t) + files_var_lib_filetrans(httpd_t, httpd_var_lib_t, file) + ++setattr_dir_pattern(httpd_t, httpd_var_run_t, httpd_var_run_t) + manage_files_pattern(httpd_t, httpd_var_run_t, httpd_var_run_t) + manage_sock_files_pattern(httpd_t, httpd_var_run_t, httpd_var_run_t) + files_pid_filetrans(httpd_t, httpd_var_run_t, { file sock_file }) +@@ -289,6 +339,7 @@ kernel_read_kernel_sysctls(httpd_t) # for modules that want to access /proc/meminfo kernel_read_system_state(httpd_t) @@ -10697,7 +10717,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol corenet_all_recvfrom_unlabeled(httpd_t) corenet_all_recvfrom_netlabel(httpd_t) -@@ -299,6 +349,7 @@ +@@ -299,6 +350,7 @@ corenet_tcp_sendrecv_all_ports(httpd_t) corenet_udp_sendrecv_all_ports(httpd_t) corenet_tcp_bind_all_nodes(httpd_t) @@ -10705,7 +10725,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol corenet_tcp_bind_http_port(httpd_t) corenet_tcp_bind_http_cache_port(httpd_t) corenet_sendrecv_http_server_packets(httpd_t) -@@ -312,12 +363,11 @@ +@@ -312,12 +364,11 @@ fs_getattr_all_fs(httpd_t) fs_search_auto_mountpoints(httpd_t) @@ -10720,7 +10740,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol domain_use_interactive_fds(httpd_t) -@@ -335,6 +385,10 @@ +@@ -335,6 +386,10 @@ files_read_var_lib_symlinks(httpd_t) fs_search_auto_mountpoints(httpd_sys_script_t) @@ -10731,7 +10751,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol libs_use_ld_so(httpd_t) libs_use_shared_libs(httpd_t) -@@ -351,18 +405,33 @@ +@@ -351,18 +406,33 @@ userdom_use_unpriv_users_fds(httpd_t) @@ -10769,7 +10789,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ') -@@ -370,20 +439,45 @@ +@@ -370,20 +440,45 @@ corenet_tcp_connect_all_ports(httpd_t) ') @@ -10816,7 +10836,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol manage_dirs_pattern(httpd_t, httpdcontent, httpdcontent) manage_files_pattern(httpd_t, httpdcontent, httpdcontent) -@@ -394,11 +488,12 @@ +@@ -394,11 +489,12 @@ corenet_tcp_bind_ftp_port(httpd_t) ') @@ -10832,7 +10852,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol fs_read_nfs_files(httpd_t) fs_read_nfs_symlinks(httpd_t) ') -@@ -408,6 +503,11 @@ +@@ -408,6 +504,11 @@ fs_read_cifs_symlinks(httpd_t) ') @@ -10844,7 +10864,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol tunable_policy(`httpd_ssi_exec',` corecmd_shell_domtrans(httpd_t,httpd_sys_script_t) allow httpd_sys_script_t httpd_t:fd use; -@@ -441,8 +541,13 @@ +@@ -441,8 +542,13 @@ ') optional_policy(` @@ -10860,7 +10880,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') optional_policy(` -@@ -454,18 +559,13 @@ +@@ -454,18 +560,13 @@ ') optional_policy(` @@ -10880,7 +10900,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') optional_policy(` -@@ -475,6 +575,12 @@ +@@ -475,6 +576,12 @@ openca_kill(httpd_t) ') @@ -10893,7 +10913,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol optional_policy(` # Allow httpd to work with postgresql postgresql_stream_connect(httpd_t) -@@ -482,6 +588,7 @@ +@@ -482,6 +589,7 @@ tunable_policy(`httpd_can_network_connect_db',` postgresql_tcp_connect(httpd_t) @@ -10901,7 +10921,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ') -@@ -490,6 +597,7 @@ +@@ -490,6 +598,7 @@ ') optional_policy(` @@ -10909,7 +10929,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol snmp_dontaudit_read_snmp_var_lib_files(httpd_t) snmp_dontaudit_write_snmp_var_lib_files(httpd_t) ') -@@ -519,9 +627,28 @@ +@@ -519,9 +628,28 @@ logging_send_syslog_msg(httpd_helper_t) tunable_policy(`httpd_tty_comm',` @@ -10938,7 +10958,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ######################################## # # Apache PHP script local policy -@@ -551,22 +678,27 @@ +@@ -551,22 +679,27 @@ fs_search_auto_mountpoints(httpd_php_t) @@ -10972,7 +10992,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -584,12 +716,14 @@ +@@ -584,12 +717,14 @@ append_files_pattern(httpd_suexec_t, httpd_log_t, httpd_log_t) read_files_pattern(httpd_suexec_t, httpd_log_t, httpd_log_t) @@ -10988,7 +11008,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol kernel_read_kernel_sysctls(httpd_suexec_t) kernel_list_proc(httpd_suexec_t) kernel_read_proc_symlinks(httpd_suexec_t) -@@ -598,9 +732,7 @@ +@@ -598,9 +733,7 @@ fs_search_auto_mountpoints(httpd_suexec_t) @@ -10999,7 +11019,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol files_read_etc_files(httpd_suexec_t) files_read_usr_files(httpd_suexec_t) -@@ -633,12 +765,25 @@ +@@ -633,12 +766,25 @@ corenet_sendrecv_all_client_packets(httpd_suexec_t) ') @@ -11028,7 +11048,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',` -@@ -647,6 +792,12 @@ +@@ -647,6 +793,12 @@ fs_exec_nfs_files(httpd_suexec_t) ') @@ -11041,7 +11061,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',` fs_read_cifs_files(httpd_suexec_t) fs_read_cifs_symlinks(httpd_suexec_t) -@@ -664,10 +815,6 @@ +@@ -664,20 +816,20 @@ dontaudit httpd_suexec_t httpd_t:unix_stream_socket { read write }; ') @@ -11052,7 +11072,12 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ######################################## # # Apache system script local policy -@@ -677,7 +824,8 @@ + # + ++auth_use_nsswitch(httpd_sys_script_t) ++ ++allow httpd_sys_script_t httpd_t:unix_stream_socket rw_stream_socket_perms; + allow httpd_sys_script_t httpd_t:tcp_socket { read write }; dontaudit httpd_sys_script_t httpd_config_t:dir search; @@ -11062,7 +11087,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol allow httpd_sys_script_t squirrelmail_spool_t:dir list_dir_perms; read_files_pattern(httpd_sys_script_t, squirrelmail_spool_t, squirrelmail_spool_t) -@@ -691,12 +839,15 @@ +@@ -691,12 +843,15 @@ # Should we add a boolean? apache_domtrans_rotatelogs(httpd_sys_script_t) @@ -11080,7 +11105,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',` -@@ -704,6 +855,30 @@ +@@ -704,6 +859,30 @@ fs_read_nfs_symlinks(httpd_sys_script_t) ') @@ -11111,7 +11136,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',` fs_read_cifs_files(httpd_sys_script_t) fs_read_cifs_symlinks(httpd_sys_script_t) -@@ -716,10 +891,10 @@ +@@ -716,10 +895,10 @@ optional_policy(` mysql_stream_connect(httpd_sys_script_t) mysql_rw_db_sockets(httpd_sys_script_t) @@ -11126,7 +11151,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -727,6 +902,8 @@ +@@ -727,6 +906,8 @@ # httpd_rotatelogs local policy # @@ -11135,7 +11160,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol manage_files_pattern(httpd_rotatelogs_t, httpd_log_t, httpd_log_t) kernel_read_kernel_sysctls(httpd_rotatelogs_t) -@@ -741,3 +918,66 @@ +@@ -741,3 +922,66 @@ logging_search_logs(httpd_rotatelogs_t) miscfiles_read_localization(httpd_rotatelogs_t) @@ -14928,7 +14953,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol + diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim.if serefpolicy-3.5.13/policy/modules/services/exim.if --- nsaserefpolicy/policy/modules/services/exim.if 2008-08-07 11:15:11.000000000 -0400 -+++ serefpolicy-3.5.13/policy/modules/services/exim.if 2008-10-17 10:31:27.000000000 -0400 ++++ serefpolicy-3.5.13/policy/modules/services/exim.if 2008-10-22 16:44:31.000000000 -0400 @@ -97,6 +97,26 @@ ######################################## @@ -15695,6 +15720,74 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol dev_read_urand(kpropd_t) +diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerneloops.if serefpolicy-3.5.13/policy/modules/services/kerneloops.if +--- nsaserefpolicy/policy/modules/services/kerneloops.if 2008-10-14 11:58:09.000000000 -0400 ++++ serefpolicy-3.5.13/policy/modules/services/kerneloops.if 2008-10-22 16:51:11.000000000 -0400 +@@ -63,6 +63,25 @@ + + ######################################## + ## ++## Allow domain to manage kerneloops tmp files ++## ++## ++## ++## Domain to not audit. ++## ++## ++# ++interface(`kerneloops_manage_tmp_files',` ++ gen_require(` ++ type kerneloops_tmp_t; ++ ') ++ ++ manage_files_pattern($1, kerneloops_tmp_t, kerneloops_tmp_t) ++ files_search_tmp($1) ++') ++ ++######################################## ++## + ## All of the rules required to administrate + ## an kerneloops environment + ## +@@ -81,6 +100,7 @@ + interface(`kerneloops_admin',` + gen_require(` + type kerneloops_t, kerneloops_initrc_exec_t; ++ type kerneloops_tmp_t; + ') + + allow $1 kerneloops_t:process { ptrace signal_perms }; +@@ -90,4 +110,7 @@ + domain_system_change_exemption($1) + role_transition $2 kerneloops_initrc_exec_t system_r; + allow $2 system_r; ++ ++ admin_pattern($1, kerneloops_tmp_t) + ') ++ +diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerneloops.te serefpolicy-3.5.13/policy/modules/services/kerneloops.te +--- nsaserefpolicy/policy/modules/services/kerneloops.te 2008-10-14 11:58:09.000000000 -0400 ++++ serefpolicy-3.5.13/policy/modules/services/kerneloops.te 2008-10-22 16:49:44.000000000 -0400 +@@ -13,6 +13,9 @@ + type kerneloops_initrc_exec_t; + init_script_file(kerneloops_initrc_exec_t) + ++type kerneloops_tmp_t; ++files_tmp_file(kerneloops_tmp_t) ++ + ######################################## + # + # kerneloops local policy +@@ -23,6 +26,9 @@ + allow kerneloops_t self:fifo_file rw_file_perms; + allow kerneloops_t self:netlink_route_socket r_netlink_socket_perms; + ++manage_files_pattern(kerneloops_t, kerneloops_tmp_t, kerneloops_tmp_t) ++files_tmp_filetrans(kerneloops_t,kerneloops_tmp_t,file) ++ + kernel_read_ring_buffer(kerneloops_t) + + # Init script handling diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ldap.te serefpolicy-3.5.13/policy/modules/services/ldap.te --- nsaserefpolicy/policy/modules/services/ldap.te 2008-10-16 17:21:16.000000000 -0400 +++ serefpolicy-3.5.13/policy/modules/services/ldap.te 2008-10-17 10:31:27.000000000 -0400