commit: 813eb9b92bf4f592dcedf24a2e18d2645d07ea4a
Author: Chris PeBenito <chpebeni <AT> linux <DOT> microsoft <DOT> com>
AuthorDate: Wed Aug 17 17:54:09 2022 +0000
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Sat Sep 3 19:07:49 2022 +0000
URL:
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=813eb9b9
hypervkvp: Port updated module from Fedora policy.
Change to refpolicy interfaces and fix optional blocks.
Signed-off-by: Chris PeBenito <chpebeni <AT> linux.microsoft.com>
Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org>
policy/modules/kernel/devices.fc | 3 +
policy/modules/kernel/devices.if | 36 ++++++++
policy/modules/kernel/devices.te | 9 ++
policy/modules/kernel/files.if | 18 ++++
policy/modules/services/dbus.if | 19 +++++
policy/modules/services/hypervkvp.fc | 8 +-
policy/modules/services/hypervkvp.te | 154 +++++++++++++++++++++++++++++++++--
policy/modules/system/sysnetwork.if | 18 ++++
8 files changed, 258 insertions(+), 7 deletions(-)
diff --git a/policy/modules/kernel/devices.fc b/policy/modules/kernel/devices.fc
index 19b06ab7..84427423 100644
--- a/policy/modules/kernel/devices.fc
+++ b/policy/modules/kernel/devices.fc
@@ -196,6 +196,9 @@ ifdef(`distro_suse', `
/dev/usb/mdc800.* -c
gen_context(system_u:object_r:scanner_device_t,s0)
/dev/usb/scanner.* -c
gen_context(system_u:object_r:scanner_device_t,s0)
+/dev/vmbus/hv_kvp -c
gen_context(system_u:object_r:hyperv_kvp_device_t,s0)
+/dev/vmbus/hv_vss -c
gen_context(system_u:object_r:hyperv_vss_device_t,s0)
+
/dev/wmi/dell-smbios -c gen_context(system_u:object_r:acpi_bios_t,s0)
/dev/xen/blktap.* -c gen_context(system_u:object_r:xen_device_t,s0)
diff --git a/policy/modules/kernel/devices.if b/policy/modules/kernel/devices.if
index bfb08b21..ba652e81 100644
--- a/policy/modules/kernel/devices.if
+++ b/policy/modules/kernel/devices.if
@@ -2368,6 +2368,42 @@ interface(`dev_rw_framebuffer',`
rw_chr_files_pattern($1, device_t, framebuf_device_t)
')
+########################################
+## <summary>
+## Allow read/write the hypervkvp device
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`dev_rw_hyperv_kvp',`
+ gen_require(`
+ type device_t, hyperv_kvp_device_t;
+ ')
+
+ rw_chr_files_pattern($1, device_t, hyperv_kvp_device_t)
+')
+
+########################################
+## <summary>
+## Allow read/write the hypervvssd device
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`dev_rw_hyperv_vss',`
+ gen_require(`
+ type device_t, hyperv_vss_device_t;
+ ')
+
+ rw_chr_files_pattern($1, device_t, hyperv_vss_device_t)
+')
+
########################################
## <summary>
## Read the kernel messages
diff --git a/policy/modules/kernel/devices.te b/policy/modules/kernel/devices.te
index 8ac7c212..49718cc2 100644
--- a/policy/modules/kernel/devices.te
+++ b/policy/modules/kernel/devices.te
@@ -122,6 +122,15 @@ dev_node(freefall_device_t)
type gpiochip_device_t;
dev_node(gpiochip_device_t)
+#
+# Types for Hyper-V guest devices
+#
+type hyperv_kvp_device_t;
+dev_node(hyperv_kvp_device_t)
+
+type hyperv_vss_device_t;
+dev_node(hyperv_vss_device_t)
+
#
# Type for /dev/infiniband/*
#
diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if
index fb27ed18..eeed098c 100644
--- a/policy/modules/kernel/files.if
+++ b/policy/modules/kernel/files.if
@@ -1846,6 +1846,24 @@ interface(`files_dontaudit_list_all_mountpoints',`
dontaudit $1 mountpoint:dir list_dir_perms;
')
+########################################
+## <summary>
+## Check if all mountpoints are writable.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`files_write_all_mountpoints',`
+ gen_require(`
+ attribute mountpoint;
+ ')
+
+ allow $1 mountpoint:dir write;
+')
+
########################################
## <summary>
## Do not audit attempts to write to mount points.
diff --git a/policy/modules/services/dbus.if b/policy/modules/services/dbus.if
index 3dfeadf9..432eae55 100644
--- a/policy/modules/services/dbus.if
+++ b/policy/modules/services/dbus.if
@@ -647,6 +647,25 @@ interface(`dbus_watch_system_bus_runtime_dirs',`
allow $1 system_dbusd_runtime_t:dir watch;
')
+########################################
+## <summary>
+## Read system bus runtime files.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`dbus_read_system_bus_runtime_files',`
+ gen_require(`
+ type system_dbusd_runtime_t;
+ ')
+
+ allow $1 system_dbusd_runtime_t:file read;
+')
+
+
########################################
## <summary>
## List system bus runtime directories.
diff --git a/policy/modules/services/hypervkvp.fc
b/policy/modules/services/hypervkvp.fc
index d1bbb44c..aa585191 100644
--- a/policy/modules/services/hypervkvp.fc
+++ b/policy/modules/services/hypervkvp.fc
@@ -1,5 +1,9 @@
/etc/rc\.d/init\.d/hypervkvpd --
gen_context(system_u:object_r:hypervkvpd_initrc_exec_t,s0)
-/usr/bin/hv_kvp_daemon --
gen_context(system_u:object_r:hypervkvpd_exec_t,s0)
+/usr/lib/systemd/system/hypervkvpd.* --
gen_context(system_u:object_r:hypervkvpd_unit_t,s0)
+/usr/lib/systemd/system/hypervvssd.* --
gen_context(system_u:object_r:hypervvssd_unit_t,s0)
-/usr/sbin/hv_kvp_daemon --
gen_context(system_u:object_r:hypervkvpd_exec_t,s0)
+/usr/sbin/hypervkvpd --
gen_context(system_u:object_r:hypervkvpd_exec_t,s0)
+/usr/sbin/hypervvssd --
gen_context(system_u:object_r:hypervvssd_exec_t,s0)
+
+/var/lib/hyperv(/.*)?
gen_context(system_u:object_r:hypervkvpd_var_lib_t,s0)
diff --git a/policy/modules/services/hypervkvp.te
b/policy/modules/services/hypervkvp.te
index 62e4e55b..dccb0ec0 100644
--- a/policy/modules/services/hypervkvp.te
+++ b/policy/modules/services/hypervkvp.te
@@ -1,28 +1,172 @@
-policy_module(hypervkvp)
+policy_module(hypervkvp, 1.0.0)
########################################
#
# Declarations
#
-type hypervkvpd_t;
+attribute hyperv_domain;
+
+type hypervkvpd_t, hyperv_domain;
type hypervkvpd_exec_t;
init_daemon_domain(hypervkvpd_t, hypervkvpd_exec_t)
type hypervkvpd_initrc_exec_t;
init_script_file(hypervkvpd_initrc_exec_t)
+type hypervkvpd_unit_t;
+init_unit_file(hypervkvpd_unit_t)
+
+type hypervkvpd_var_lib_t;
+files_type(hypervkvpd_var_lib_t)
+
+type hypervkvpd_tmp_t;
+files_tmpfs_file(hypervkvpd_tmp_t)
+
+type hypervvssd_t, hyperv_domain;
+type hypervvssd_exec_t;
+init_daemon_domain(hypervvssd_t, hypervvssd_exec_t)
+
+type hypervvssd_unit_t;
+init_unit_file(hypervvssd_unit_t)
+
########################################
#
-# Local policy
+# hyperv domain local policy
+#
+
+allow hyperv_domain self:capability net_admin;
+allow hyperv_domain self:netlink_socket create_socket_perms;
+
+allow hyperv_domain self:fifo_file rw_fifo_file_perms;
+allow hyperv_domain self:unix_stream_socket create_stream_socket_perms;
+
+corecmd_exec_shell(hyperv_domain)
+corecmd_exec_bin(hyperv_domain)
+
+dev_read_sysfs(hyperv_domain)
+
+########################################
#
+# hypervkvp local policy
#
-allow hypervkvpd_t self:fifo_file rw_fifo_file_perms;
-allow hypervkvpd_t self:unix_stream_socket create_stream_socket_perms;
+allow hypervkvpd_t self:capability sys_ptrace;
+allow hypervkvpd_t self:process setfscreate;
+allow hypervkvpd_t self:netlink_route_socket rw_netlink_socket_perms;
+
+manage_dirs_pattern(hypervkvpd_t, hypervkvpd_var_lib_t, hypervkvpd_var_lib_t)
+manage_files_pattern(hypervkvpd_t, hypervkvpd_var_lib_t, hypervkvpd_var_lib_t)
+files_var_lib_filetrans(hypervkvpd_t, hypervkvpd_var_lib_t, dir)
+
+manage_files_pattern(hypervkvpd_t, hypervkvpd_tmp_t, hypervkvpd_tmp_t)
+manage_dirs_pattern(hypervkvpd_t, hypervkvpd_tmp_t, hypervkvpd_tmp_t)
+files_tmp_filetrans(hypervkvpd_t, hypervkvpd_tmp_t, { file dir })
+
+kernel_read_system_state(hypervkvpd_t)
+kernel_read_network_state(hypervkvpd_t)
+kernel_request_load_module(hypervkvpd_t)
+kernel_rw_net_sysctls(hypervkvpd_t)
+
+corecmd_getattr_all_executables(hypervkvpd_t)
+
+dev_rw_hyperv_kvp(hypervkvpd_t)
+
+domain_read_all_domains_state(hypervkvpd_t)
+
+seutil_exec_setfiles(hypervkvpd_t)
+seutil_read_file_contexts(hypervkvpd_t)
+
+domain_read_all_domains_state(hypervkvpd_t)
+
+dev_read_urand(hypervkvpd_t)
+
+files_dontaudit_search_home(hypervkvpd_t)
+files_dontaudit_getattr_non_security_files(hypervkvpd_t)
+
+fs_getattr_all_fs(hypervkvpd_t)
+fs_list_hugetlbfs(hypervkvpd_t)
+
+auth_use_nsswitch(hypervkvpd_t)
logging_send_syslog_msg(hypervkvpd_t)
+logging_read_syslog_config(hypervkvpd_t)
+
+libs_exec_ldconfig(hypervkvpd_t)
miscfiles_read_localization(hypervkvpd_t)
+modutils_domtrans(hypervkvpd_t)
+
+seutil_domtrans_setfiles(hypervkvpd_t)
+
sysnet_dns_name_resolve(hypervkvpd_t)
+sysnet_domtrans_dhcpc(hypervkvpd_t)
+sysnet_domtrans_ifconfig(hypervkvpd_t)
+
+sysnet_manage_dhcpc_runtime_files(hypervkvpd_t)
+sysnet_signal_dhcpc(hypervkvpd_t)
+sysnet_manage_config(hypervkvpd_t)
+sysnet_read_dhcpc_state(hypervkvpd_t)
+sysnet_read_dhcp_config(hypervkvpd_t)
+sysnet_etc_filetrans_config(hypervkvpd_t)
+
+systemd_exec_systemctl(hypervkvpd_t)
+
+userdom_dontaudit_search_user_home_dirs(hypervkvpd_t)
+
+optional_policy(`
+ brctl_domtrans(hypervkvpd_t)
+')
+
+optional_policy(`
+ dbus_read_system_bus_runtime_files(hypervkvpd_t)
+ dbus_system_bus_client(hypervkvpd_t)
+
+ optional_policy(`
+ firewalld_dbus_chat(hypervkvpd_t)
+ ')
+
+ optional_policy(`
+ networkmanager_read_runtime_files(hypervkvpd_t)
+ networkmanager_dbus_chat(hypervkvpd_t)
+ ')
+')
+
+optional_policy(`
+ hostname_exec(hypervkvpd_t)
+')
+
+optional_policy(`
+ netutils_domtrans_ping(hypervkvpd_t)
+ netutils_domtrans(hypervkvpd_t)
+')
+
+optional_policy(`
+ sysnet_exec_ifconfig(hypervkvpd_t)
+')
+
+optional_policy(`
+ rpm_exec(hypervkvpd_t)
+')
+
+########################################
+#
+# hypervvssd local policy
+#
+
+allow hypervvssd_t self:capability { dac_read_search dac_override sys_admin };
+
+dev_rw_hyperv_vss(hypervvssd_t)
+
+files_list_boot(hypervvssd_t)
+
+files_list_all_mountpoints(hypervvssd_t)
+files_write_all_mountpoints(hypervvssd_t)
+files_list_non_auth_dirs(hypervvssd_t)
+
+logging_send_syslog_msg(hypervvssd_t)
+
+miscfiles_read_localization(hypervvssd_t)
+
+storage_raw_read_fixed_disk(hypervvssd_t)
diff --git a/policy/modules/system/sysnetwork.if
b/policy/modules/system/sysnetwork.if
index 464893f6..2598c7ad 100644
--- a/policy/modules/system/sysnetwork.if
+++ b/policy/modules/system/sysnetwork.if
@@ -614,6 +614,24 @@ interface(`sysnet_delete_dhcpc_runtime_files',`
allow $1 dhcpc_runtime_t:file unlink;
')
+#######################################
+## <summary>
+## Create, read, write, and delete dhcp client runtime files.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`sysnet_manage_dhcpc_runtime_files',`
+ gen_require(`
+ type dhcpc_runtime_t;
+ ')
+
+ manage_files_pattern($1, dhcpc_runtime_t, dhcpc_runtime_t)
+')
+
#######################################
## <summary>
## Execute ifconfig in the ifconfig domain.
