[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/kernel/, policy/modules/system/

[Jason Zaman]

commit:     b5319ac6961b49e3f3b83cd390c102cd39bb33fd
Author:     Krzysztof Nowicki <krissn <AT> op <DOT> pl>
AuthorDate: Wed Feb  3 14:59:22 2021 +0000
Commit:     Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Mon Feb 15 19:49:24 2021 +0000
URL:        
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=b5319ac6

Allow systemd-tmpfilesd to relabel generic files inside /etc

Enable this only with the systemd_tmpfilesd_factory tunable, otherwise
silence the messages with a dontaudit rule.

Fixes:

avc:  denied  { relabelfrom } for comm="systemd-tmpfile"
name="pam.d" dev= ino=
scontext=system_u:system_r:systemd_tmpfiles_t:s0
tcontext=system_u:object_r:etc_t:s0 tclass=dir

Signed-off-by: Krzysztof Nowicki <krissn <AT> op.pl>
Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org>

 policy/modules/kernel/files.if   | 38 ++++++++++++++++++++++++++++++++++++++
 policy/modules/system/systemd.te |  4 ++++
 2 files changed, 42 insertions(+)

diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if
index 55fbf783..0687a435 100644
--- a/policy/modules/kernel/files.if
+++ b/policy/modules/kernel/files.if
@@ -1611,6 +1611,25 @@ interface(`files_relabel_config_dirs',`
        relabel_dirs_pattern($1, configfile, configfile)
 ')
 
+#########################################
+## <summary>
+##     Do not audit attempts to relabel configuration directories
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain not to audit.
+##     </summary>
+## </param>
+##
+#
+interface(`files_dontaudit_relabel_config_dirs',`
+       gen_require(`
+               attribute configfile;
+       ')
+
+       dontaudit $1 configfile:dir relabel_dir_perms;
+')
+
 ########################################
 ## <summary>
 ##     Read config files in /etc.
@@ -1669,6 +1688,25 @@ interface(`files_relabel_config_files',`
        relabel_files_pattern($1, configfile, configfile)
 ')
 
+#######################################
+## <summary>
+##     Do not audit attempts to relabel configuration files
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain not to audit.
+##     </summary>
+## </param>
+##
+#
+interface(`files_dontaudit_relabel_config_files',`
+       gen_require(`
+               attribute configfile;
+       ')
+
+       dontaudit $1 configfile:file relabel_file_perms;
+')
+
 ########################################
 ## <summary>
 ##     Mount a filesystem on all mount points.

diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
index ed2bce80..08c26078 100644
--- a/policy/modules/system/systemd.te
+++ b/policy/modules/system/systemd.te
@@ -1394,11 +1394,15 @@ tunable_policy(`systemd_tmpfilesd_factory', `
        allow systemd_tmpfiles_t systemd_factory_conf_t:file read_file_perms;
 
        files_manage_etc_files(systemd_tmpfiles_t)
+       files_relabel_config_dirs(systemd_tmpfiles_t)
+       files_relabel_config_files(systemd_tmpfiles_t)
 ',`
        dontaudit systemd_tmpfiles_t systemd_factory_conf_t:dir list_dir_perms;
        dontaudit systemd_tmpfiles_t systemd_factory_conf_t:file 
read_file_perms;
 
        files_dontaudit_manage_etc_files(systemd_tmpfiles_t)
+       files_dontaudit_relabel_config_dirs(systemd_tmpfiles_t)
+       files_dontaudit_relabel_config_files(systemd_tmpfiles_t)
 ')
 
 optional_policy(`