Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixes for systemd v256 #805

Merged
merged 7 commits into from
Sep 11, 2024
Merged

Fixes for systemd v256 #805

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
29d0bb8
systemd: set context to systemd_networkd_var_lib_t for /var/lib/syste…
yizhao1 Aug 11, 2024
78cacc7
systemd: allow systemd-networkd to manage sock files under /run/syste…
yizhao1 Aug 11, 2024
47081be
systemd: allow system --user to create netlink_route_socket
yizhao1 Aug 12, 2024
a4a7b83
systemd: add policy for systemd-nsresourced
yizhao1 Aug 12, 2024
d852b75
devices: add label vsock_device_t for /dev/vsock
yizhao1 Aug 30, 2024
4f34370
systemd: fix policy for systemd-ssh-generator
yizhao1 Aug 26, 2024
c20cf22
systemd: allow systemd-hostnamed to read vsock device
yizhao1 Sep 10, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions policy/modules/kernel/devices.fc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -134,6 +134,7 @@ ifdef(`distro_suse', `
')
/dev/vbi.* -c gen_context(system_u:object_r:v4l_device_t,s0)
/dev/vbox.* -c gen_context(system_u:object_r:xserver_misc_device_t,s0)
/dev/vsock -c gen_context(system_u:object_r:vsock_device_t,s0)
/dev/vfio/.+ -c gen_context(system_u:object_r:vfio_device_t,s0)
/dev/vga_arbiter -c gen_context(system_u:object_r:xserver_misc_device_t,s0)
/dev/vhci -c gen_context(system_u:object_r:vhost_device_t,s0)
Expand Down
54 changes: 54 additions & 0 deletions policy/modules/kernel/devices.if
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5556,6 +5556,60 @@ interface(`dev_rwx_vmware',`
allow $1 vmware_device_t:chr_file { execute map };
')

########################################
## <summary>
## Read the vsock device.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`dev_read_vsock',`
gen_require(`
type device_t, vsock_device_t;
')

read_chr_files_pattern($1, device_t, vsock_device_t)
')

########################################
## <summary>
## Write the vsock device.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`dev_write_vsock',`
gen_require(`
type device_t, vsock_device_t;
')

write_chr_files_pattern($1, device_t, vsock_device_t)
')

########################################
## <summary>
## Read and write the vsock device.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`dev_rw_vsock',`
gen_require(`
type device_t, vsock_device_t;
')

rw_chr_files_pattern($1, device_t, vsock_device_t)
')

########################################
## <summary>
## Read from watchdog devices.
Expand Down
6 changes: 6 additions & 0 deletions policy/modules/kernel/devices.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -402,6 +402,12 @@ dev_node(vhost_device_t)
type vmware_device_t;
dev_node(vmware_device_t)

#
# vsock_device_t is the type for /dev/vsock
#
type vsock_device_t;
dev_node(vsock_device_t)

type watchdog_device_t;
dev_node(watchdog_device_t)

Expand Down
4 changes: 4 additions & 0 deletions policy/modules/services/avahi.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -95,6 +95,10 @@ sysnet_etc_filetrans_config(avahi_t)
userdom_dontaudit_use_unpriv_user_fds(avahi_t)
userdom_dontaudit_search_user_home_dirs(avahi_t)

ifdef(`init_systemd',`
systemd_stream_connect_nsresourced(avahi_t)
')

optional_policy(`
dbus_system_domain(avahi_t, avahi_exec_t)

Expand Down
4 changes: 4 additions & 0 deletions policy/modules/services/bind.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -168,6 +168,10 @@ miscfiles_read_generic_tls_privkey(named_t)
userdom_dontaudit_use_unpriv_user_fds(named_t)
userdom_dontaudit_search_user_home_dirs(named_t)

ifdef(`init_systemd',`
systemd_stream_connect_nsresourced(named_t)
')

tunable_policy(`named_tcp_bind_http_port',`
corenet_sendrecv_http_server_packets(named_t)
corenet_tcp_bind_http_port(named_t)
Expand Down
2 changes: 2 additions & 0 deletions policy/modules/services/dbus.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -215,6 +215,8 @@ ifdef(`init_systemd', `
init_start_all_units(system_dbusd_t)
init_stop_all_units(system_dbusd_t)

systemd_stream_connect_nsresourced(system_dbusd_t)

# Recent versions of dbus are started as Type=notify
systemd_write_notify_socket(system_dbusd_t)

Expand Down
8 changes: 8 additions & 0 deletions policy/modules/services/postfix.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -575,6 +575,10 @@ allow postfix_pickup_t postfix_spool_maildrop_t:dir list_dir_perms;
read_files_pattern(postfix_pickup_t, postfix_spool_maildrop_t, postfix_spool_maildrop_t)
delete_files_pattern(postfix_pickup_t, postfix_spool_maildrop_t, postfix_spool_maildrop_t)

ifdef(`init_systemd',`
systemd_stream_connect_nsresourced(postfix_pickup_t)
')

optional_policy(`
dbus_system_bus_client(postfix_pickup_t)
init_dbus_chat(postfix_pickup_t)
Expand Down Expand Up @@ -729,6 +733,10 @@ files_spool_filetrans(postfix_qmgr_t, postfix_spool_t, dir)

corecmd_exec_bin(postfix_qmgr_t)

ifdef(`init_systemd',`
systemd_stream_connect_nsresourced(postfix_qmgr_t)
')

optional_policy(`
dbus_send_system_bus(postfix_qmgr_t)
dbus_system_bus_client(postfix_qmgr_t)
Expand Down
5 changes: 5 additions & 0 deletions policy/modules/system/systemd.fc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,8 @@
/usr/lib/systemd/systemd-modules-load -- gen_context(system_u:object_r:systemd_modules_load_exec_t,s0)
/usr/lib/systemd/systemd-networkd -- gen_context(system_u:object_r:systemd_networkd_exec_t,s0)
/usr/lib/systemd/systemd-network-generator -- gen_context(system_u:object_r:systemd_networkd_exec_t,s0)
/usr/lib/systemd/systemd-nsresourced -- gen_context(system_u:object_r:systemd_nsresourced_exec_t,s0)
/usr/lib/systemd/systemd-nsresourcework -- gen_context(system_u:object_r:systemd_nsresourced_exec_t,s0)
/usr/lib/systemd/systemd-pcrextend -- gen_context(system_u:object_r:systemd_pcrphase_exec_t,s0)
/usr/lib/systemd/systemd-pcrlock -- gen_context(system_u:object_r:systemd_pcrphase_exec_t,s0)
/usr/lib/systemd/systemd-pcrphase -- gen_context(system_u:object_r:systemd_pcrphase_exec_t,s0)
Expand Down Expand Up @@ -87,6 +89,7 @@ HOME_DIR/\.local/share/systemd(/.*)? gen_context(system_u:object_r:systemd_data
/var/lib/systemd/coredump(/.*)? gen_context(system_u:object_r:systemd_coredump_var_lib_t,s0)
/var/lib/systemd/home(/.*)? gen_context(system_u:object_r:systemd_homed_var_lib_t,s0)
/var/lib/systemd/linger(/.*)? gen_context(system_u:object_r:systemd_logind_var_lib_t,s0)
/var/lib/systemd/network(/.*)? gen_context(system_u:object_r:systemd_networkd_var_lib_t,s0)
/var/lib/systemd/pstore(/.*)? gen_context(system_u:object_r:systemd_pstore_var_lib_t,s0)
/var/lib/systemd/rfkill(/.*)? gen_context(system_u:object_r:systemd_rfkill_var_lib_t,s0)

Expand Down Expand Up @@ -115,6 +118,8 @@ HOME_DIR/\.local/share/systemd(/.*)? gen_context(system_u:object_r:systemd_data
/run/systemd/nspawn(/.*)? gen_context(system_u:object_r:systemd_nspawn_runtime_t,s0)
/run/systemd/machines(/.*)? gen_context(system_u:object_r:systemd_machined_runtime_t,s0)
/run/systemd/netif(/.*)? gen_context(system_u:object_r:systemd_networkd_runtime_t,s0)
/run/systemd/nsresource(/.*)? gen_context(system_u:object_r:systemd_nsresourced_runtime_t,s0)
/run/systemd/io\.systemd\.NamespaceResource -s gen_context(system_u:object_r:systemd_nsresourced_runtime_t,s0)

/run/tmpfiles\.d -d gen_context(system_u:object_r:systemd_tmpfiles_conf_t,s0)
/run/tmpfiles\.d/.* <<none>>
Expand Down
23 changes: 23 additions & 0 deletions policy/modules/system/systemd.if
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,6 +61,8 @@ template(`systemd_role_template',`
# remainder of the rules.
allow $1_systemd_t self:process { getsched signal };
allow $1_systemd_t self:netlink_kobject_uevent_socket create_socket_perms;
allow $1_systemd_t self:netlink_route_socket r_netlink_socket_perms;
allow $1_systemd_t self:unix_dgram_socket { create_socket_perms sendto };
allow $1_systemd_t self:unix_stream_socket create_stream_socket_perms;
allow $1_systemd_t $3:process { rlimitinh setsched signal_perms };
corecmd_shell_domtrans($1_systemd_t, $3)
Expand Down Expand Up @@ -2232,6 +2234,27 @@ interface(`systemd_read_networkd_runtime',`
read_files_pattern($1, systemd_networkd_runtime_t, systemd_networkd_runtime_t)
')

#######################################
## <summary>
## Connect to systemd-nsresourced over
## /run/systemd/io.systemd.NamespaceResource .
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`systemd_stream_connect_nsresourced', `
gen_require(`
type systemd_nsresourced_t;
type systemd_nsresourced_runtime_t;
')

init_search_runtime($1)
stream_connect_pattern($1, systemd_nsresourced_runtime_t, systemd_nsresourced_runtime_t, systemd_nsresourced_t)
')

########################################
## <summary>
## Allow systemd_logind_t to read process state for cgroup file
Expand Down
54 changes: 54 additions & 0 deletions policy/modules/system/systemd.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -212,6 +212,9 @@ init_mountpoint(systemd_networkd_runtime_t)
type systemd_networkd_unit_t;
init_unit_file(systemd_networkd_unit_t)

type systemd_networkd_var_lib_t;
files_type(systemd_networkd_var_lib_t)

type systemd_notify_t;
type systemd_notify_exec_t;
init_daemon_domain(systemd_notify_t, systemd_notify_exec_t)
Expand All @@ -226,6 +229,13 @@ files_runtime_file(systemd_nspawn_runtime_t)
type systemd_nspawn_tmp_t;
files_tmp_file(systemd_nspawn_tmp_t)

type systemd_nsresourced_t;
type systemd_nsresourced_exec_t;
init_daemon_domain(systemd_nsresourced_t, systemd_nsresourced_exec_t)

type systemd_nsresourced_runtime_t;
files_runtime_file(systemd_nsresourced_runtime_t)

type systemd_pcrphase_t;
type systemd_pcrphase_exec_t;
init_system_domain(systemd_pcrphase_t, systemd_pcrphase_exec_t)
Expand Down Expand Up @@ -528,6 +538,8 @@ seutil_search_default_contexts(systemd_coredump_t)
allow systemd_generator_t self:fifo_file rw_fifo_file_perms;
allow systemd_generator_t self:capability { dac_override sys_admin sys_resource };
allow systemd_generator_t self:process { getcap getsched setfscreate signal };
# for systemd-ssh-generator
allow systemd_generator_t self:vsock_socket create;

corecmd_exec_shell(systemd_generator_t)
corecmd_exec_bin(systemd_generator_t)
Expand All @@ -538,6 +550,8 @@ dev_write_sysfs_dirs(systemd_generator_t)
dev_read_urand(systemd_generator_t)
dev_create_sysfs_files(systemd_generator_t)
dev_write_sysfs(systemd_generator_t)
# for systemd-ssh-generator
dev_read_vsock(systemd_generator_t)

files_read_etc_files(systemd_generator_t)
files_read_etc_runtime_files(systemd_generator_t)
Expand Down Expand Up @@ -625,6 +639,11 @@ optional_policy(`
rpc_read_exports(systemd_generator_t)
')

optional_policy(`
# needed by systemd-ssh-generator
ssh_exec_sshd(systemd_generator_t)
')

optional_policy(`
# needed by zfs-mount-generator
zfs_read_config(systemd_generator_t)
Expand Down Expand Up @@ -763,6 +782,7 @@ kernel_read_kernel_sysctls(systemd_hostnamed_t)
kernel_dontaudit_getattr_proc(systemd_hostnamed_t)

dev_read_sysfs(systemd_hostnamed_t)
dev_read_vsock(systemd_hostnamed_t)

files_read_etc_files(systemd_hostnamed_t)
files_read_etc_runtime_files(systemd_hostnamed_t)
Expand Down Expand Up @@ -1240,6 +1260,11 @@ allow systemd_networkd_t self:unix_dgram_socket create_socket_perms;
manage_dirs_pattern(systemd_networkd_t, systemd_networkd_runtime_t, systemd_networkd_runtime_t)
manage_files_pattern(systemd_networkd_t, systemd_networkd_runtime_t, systemd_networkd_runtime_t)
manage_lnk_files_pattern(systemd_networkd_t, systemd_networkd_runtime_t, systemd_networkd_runtime_t)
manage_sock_files_pattern(systemd_networkd_t, systemd_networkd_runtime_t, systemd_networkd_runtime_t)

init_var_lib_filetrans(systemd_networkd_t, systemd_networkd_var_lib_t, dir)
manage_dirs_pattern(systemd_networkd_t, systemd_networkd_var_lib_t, systemd_networkd_var_lib_t)
manage_files_pattern(systemd_networkd_t, systemd_networkd_var_lib_t, systemd_networkd_var_lib_t)

kernel_read_system_state(systemd_networkd_t)
kernel_read_kernel_sysctls(systemd_networkd_t)
Expand Down Expand Up @@ -1479,6 +1504,31 @@ optional_policy(`
virt_manage_virt_content(systemd_nspawn_t)
')

#########################################
#
# nsresourced local policy
#

allow systemd_nsresourced_t self:capability { sys_resource };
allow systemd_nsresourced_t self:process { getcap signal };
allow systemd_nsresourced_t systemd_nsresourced_exec_t:file execute_no_trans;

manage_dirs_pattern(systemd_nsresourced_t, systemd_nsresourced_runtime_t, systemd_nsresourced_runtime_t)
manage_files_pattern(systemd_nsresourced_t, systemd_nsresourced_runtime_t, systemd_nsresourced_runtime_t)
manage_sock_files_pattern(systemd_nsresourced_t, systemd_nsresourced_runtime_t, systemd_nsresourced_runtime_t)
init_runtime_filetrans(systemd_nsresourced_t, systemd_nsresourced_runtime_t, dir)

fs_getattr_cgroup(systemd_nsresourced_t)

# for /proc/1/environ
init_read_state(systemd_nsresourced_t)

kernel_read_kernel_sysctls(systemd_nsresourced_t)
# for /proc/cmdline
kernel_read_system_state(systemd_nsresourced_t)

systemd_log_parse_environment(systemd_nsresourced_t)

#######################################
#
# systemd_passwd_agent_t local policy
Expand Down Expand Up @@ -1796,6 +1846,8 @@ seutil_read_file_contexts(systemd_sysusers_t)

systemd_log_parse_environment(systemd_sysusers_t)

systemd_stream_connect_nsresourced(systemd_sysusers_t)

#########################################
#
# Tmpfiles local policy
Expand Down Expand Up @@ -2098,6 +2150,8 @@ seutil_search_default_contexts(systemd_userdbd_t)

systemd_log_parse_environment(systemd_userdbd_t)

systemd_stream_connect_nsresourced(systemd_userdbd_t)

#########################################
#
# systemd-user-runtime-dir local policy
Expand Down