[PATCH 0/6] selinux: Assorted fixes, libvirt support

[PATCH 0/6] selinux: Assorted fixes, libvirt support

[Stefano Brivio]

This series exports interfaces that are useful for libvirt, updates
type enforcement rules to current needs, and fixes some issues.

Stefano Brivio (6):
  selinux/passt.if: Fix typo in passt_read_data interface definition
  selinux: Define interfaces for libvirt and similar frameworks
  selinux: Switch to a more reasonable model for PID and socket files
  selinux/passt.te: Allow setcap on the process itself
  selinux/passt.te: Allow /etc/resolv.conf symlinks to be followed
  selinux/passt.te: Allow setting socket option on routing netlink
    socket

 contrib/selinux/passt.fc |  1 -
 contrib/selinux/passt.if | 28 +++++++++++++++++++++++++++-
 contrib/selinux/passt.te | 16 +++++++++++-----
 3 files changed, 38 insertions(+), 7 deletions(-)

-- 
2.39.1

[PATCH 1/6] selinux/passt.if: Fix typo in passt_read_data interface definition

[Stefano Brivio]

This is an example interface, currently unused, so it went undetected:
m4 macros need a backtick at the beginning of a block instead of a
single quote.

Fixes: 1f4b7fa0d75d ("passt, pasta: Add examples of SELinux policy modules")
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
---
 contrib/selinux/passt.if | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/contrib/selinux/passt.if b/contrib/selinux/passt.if
index 3ccb7f4..f689a99 100644
--- a/contrib/selinux/passt.if
+++ b/contrib/selinux/passt.if
@@ -8,7 +8,7 @@
 # Copyright (c) 2022 Red Hat GmbH
 # Author: Stefano Brivio <sbrivio@redhat.com>
 
-interface('passt_read_data','
+interface(`passt_read_data',`
 	gen_require(`
 		type passt_data_t;
 	')
-- 
@@ -8,7 +8,7 @@
 # Copyright (c) 2022 Red Hat GmbH
 # Author: Stefano Brivio <sbrivio@redhat.com>
 
-interface('passt_read_data','
+interface(`passt_read_data',`
 	gen_require(`
 		type passt_data_t;
 	')
-- 
2.39.1

[PATCH 2/6] selinux: Define interfaces for libvirt and similar frameworks

[Stefano Brivio]

Services running passt will commonly need to transition to its
domain, terminate it, connect and write to its socket.

The init_daemon_domain() macro now defines the default transition to
the passt_t domain, using the passt_exec_t type.

Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
---
 contrib/selinux/passt.if | 26 ++++++++++++++++++++++++++
 contrib/selinux/passt.te |  1 +
 2 files changed, 27 insertions(+)

diff --git a/contrib/selinux/passt.if b/contrib/selinux/passt.if
index f689a99..893395b 100644
--- a/contrib/selinux/passt.if
+++ b/contrib/selinux/passt.if
@@ -15,3 +15,29 @@ interface(`passt_read_data',`
 	allow $1 passt_t:dir { search add_name };
 	allow $1 passt_t:file { open read getattr };
 ')
+
+interface(`passt_domtrans',`
+	gen_require(`
+		type passt_t, passt_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	domtrans_pattern($1, passt_exec_t, passt_t)
+')
+
+interface(`passt_socket',`
+	gen_require(`
+		type passt_t;
+	')
+
+	allow $1 user_tmp_t:sock_file write;
+	allow $1 passt_t:unix_stream_socket connectto;
+')
+
+interface(`passt_kill',`
+	gen_require(`
+		type passt_t;
+	')
+
+	allow $1 passt_t:process { signal sigkill };
+')
diff --git a/contrib/selinux/passt.te b/contrib/selinux/passt.te
index b38304b..1f45fcd 100644
--- a/contrib/selinux/passt.te
+++ b/contrib/selinux/passt.te
@@ -56,6 +56,7 @@ type passt_t;
 domain_type(passt_t);
 type passt_exec_t;
 files_type(passt_exec_t);
+init_daemon_domain(passt_t, passt_exec_t)
 type passt_log_t;
 logging_log_file(passt_log_t);
 type passt_pid_t;
-- 
@@ -56,6 +56,7 @@ type passt_t;
 domain_type(passt_t);
 type passt_exec_t;
 files_type(passt_exec_t);
+init_daemon_domain(passt_t, passt_exec_t)
 type passt_log_t;
 logging_log_file(passt_log_t);
 type passt_pid_t;
-- 
2.39.1

[PATCH 3/6] selinux: Switch to a more reasonable model for PID and socket files

[Stefano Brivio]

Instead of restricting PID files to /var/run/passt.pid, which is a
single file and unlikely to be used, use the user_tmp_t type which
should cover any reasonable need.

Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
---
 contrib/selinux/passt.fc |  1 -
 contrib/selinux/passt.te | 11 +++++++----
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/contrib/selinux/passt.fc b/contrib/selinux/passt.fc
index 4638200..286c868 100644
--- a/contrib/selinux/passt.fc
+++ b/contrib/selinux/passt.fc
@@ -10,4 +10,3 @@
 
 /usr/bin/passt(\.*)?		system_u:object_r:passt_exec_t:s0
 /tmp/passt\.pcap		system_u:object_r:passt_log_t:s0
-/var/run/passt\.pid		system_u:object_r:passt_pid_t:s0
diff --git a/contrib/selinux/passt.te b/contrib/selinux/passt.te
index 1f45fcd..12a4288 100644
--- a/contrib/selinux/passt.te
+++ b/contrib/selinux/passt.te
@@ -19,6 +19,7 @@ require {
 	type user_home_dir_t;
 	type fs_t;
 	type tmp_t;
+	type user_tmp_t;
 	type tmpfs_t;
 	type root_t;
 
@@ -59,8 +60,6 @@ files_type(passt_exec_t);
 init_daemon_domain(passt_t, passt_exec_t)
 type passt_log_t;
 logging_log_file(passt_log_t);
-type passt_pid_t;
-files_pid_file(passt_pid_t);
 type passt_etc_t;
 files_config_file(passt_etc_t);
 
@@ -83,8 +82,8 @@ allow passt_t tmp_t:dir { add_name mounton remove_name write };
 allow passt_t tmpfs_t:filesystem mount;
 allow passt_t fs_t:filesystem unmount;
 
-manage_files_pattern(passt_t, passt_pid_t, passt_pid_t)
-files_pid_filetrans(passt_t, passt_pid_t, file)
+manage_files_pattern(passt_t, user_tmp_t, user_tmp_t)
+files_pid_filetrans(passt_t, user_tmp_t, file)
 
 allow passt_t console_device_t:chr_file { open write getattr ioctl };
 allow passt_t user_devpts_t:chr_file { getattr read write ioctl };
@@ -110,3 +109,7 @@ corenet_udp_bind_generic_node(passt_t)
 allow passt_t passt_port_t:udp_socket { name_bind };
 allow passt_t node_t:icmp_socket { name_bind node_bind };
 allow passt_t self:icmp_socket { bind create setopt read write };
+
+allow passt_t user_tmp_t:dir { add_name write };
+allow passt_t user_tmp_t:file { create open };
+allow passt_t user_tmp_t:sock_file { create read write unlink };
-- 
@@ -19,6 +19,7 @@ require {
 	type user_home_dir_t;
 	type fs_t;
 	type tmp_t;
+	type user_tmp_t;
 	type tmpfs_t;
 	type root_t;
 
@@ -59,8 +60,6 @@ files_type(passt_exec_t);
 init_daemon_domain(passt_t, passt_exec_t)
 type passt_log_t;
 logging_log_file(passt_log_t);
-type passt_pid_t;
-files_pid_file(passt_pid_t);
 type passt_etc_t;
 files_config_file(passt_etc_t);
 
@@ -83,8 +82,8 @@ allow passt_t tmp_t:dir { add_name mounton remove_name write };
 allow passt_t tmpfs_t:filesystem mount;
 allow passt_t fs_t:filesystem unmount;
 
-manage_files_pattern(passt_t, passt_pid_t, passt_pid_t)
-files_pid_filetrans(passt_t, passt_pid_t, file)
+manage_files_pattern(passt_t, user_tmp_t, user_tmp_t)
+files_pid_filetrans(passt_t, user_tmp_t, file)
 
 allow passt_t console_device_t:chr_file { open write getattr ioctl };
 allow passt_t user_devpts_t:chr_file { getattr read write ioctl };
@@ -110,3 +109,7 @@ corenet_udp_bind_generic_node(passt_t)
 allow passt_t passt_port_t:udp_socket { name_bind };
 allow passt_t node_t:icmp_socket { name_bind node_bind };
 allow passt_t self:icmp_socket { bind create setopt read write };
+
+allow passt_t user_tmp_t:dir { add_name write };
+allow passt_t user_tmp_t:file { create open };
+allow passt_t user_tmp_t:sock_file { create read write unlink };
-- 
2.39.1

[PATCH 4/6] selinux/passt.te: Allow setcap on the process itself

[Stefano Brivio]

This is needed by the new functions in isolate.c, add the
corresponding rule.

Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
---
 contrib/selinux/passt.te | 1 +
 1 file changed, 1 insertion(+)

diff --git a/contrib/selinux/passt.te b/contrib/selinux/passt.te
index 12a4288..45d56c2 100644
--- a/contrib/selinux/passt.te
+++ b/contrib/selinux/passt.te
@@ -90,6 +90,7 @@ allow passt_t user_devpts_t:chr_file { getattr read write ioctl };
 logging_send_syslog_msg(passt_t)
 allow syslogd_t self:cap_userns sys_ptrace;
 
+allow passt_t self:process setcap;
 allow passt_t self:capability { sys_tty_config setpcap net_bind_service };
 allow passt_t self:cap_userns { setpcap sys_admin sys_ptrace };
 
-- 
@@ -90,6 +90,7 @@ allow passt_t user_devpts_t:chr_file { getattr read write ioctl };
 logging_send_syslog_msg(passt_t)
 allow syslogd_t self:cap_userns sys_ptrace;
 
+allow passt_t self:process setcap;
 allow passt_t self:capability { sys_tty_config setpcap net_bind_service };
 allow passt_t self:cap_userns { setpcap sys_admin sys_ptrace };
 
-- 
2.39.1

[PATCH 5/6] selinux/passt.te: Allow /etc/resolv.conf symlinks to be followed

[Stefano Brivio]

Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
---
 contrib/selinux/passt.te | 1 +
 1 file changed, 1 insertion(+)

diff --git a/contrib/selinux/passt.te b/contrib/selinux/passt.te
index 45d56c2..3125d52 100644
--- a/contrib/selinux/passt.te
+++ b/contrib/selinux/passt.te
@@ -96,6 +96,7 @@ allow passt_t self:cap_userns { setpcap sys_admin sys_ptrace };
 
 allow passt_t proc_net_t:file read;
 allow passt_t net_conf_t:file { open read };
+allow passt_t net_conf_t:lnk_file read;
 allow passt_t tmp_t:sock_file { create unlink write };
 allow passt_t self:netlink_route_socket { bind create nlmsg_read read write };
 
-- 
@@ -96,6 +96,7 @@ allow passt_t self:cap_userns { setpcap sys_admin sys_ptrace };
 
 allow passt_t proc_net_t:file read;
 allow passt_t net_conf_t:file { open read };
+allow passt_t net_conf_t:lnk_file read;
 allow passt_t tmp_t:sock_file { create unlink write };
 allow passt_t self:netlink_route_socket { bind create nlmsg_read read write };
 
-- 
2.39.1

[PATCH 6/6] selinux/passt.te: Allow setting socket option on routing netlink socket

[Stefano Brivio]

Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
---
 contrib/selinux/passt.te | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/contrib/selinux/passt.te b/contrib/selinux/passt.te
index 3125d52..7fa4fb9 100644
--- a/contrib/selinux/passt.te
+++ b/contrib/selinux/passt.te
@@ -98,7 +98,7 @@ allow passt_t proc_net_t:file read;
 allow passt_t net_conf_t:file { open read };
 allow passt_t net_conf_t:lnk_file read;
 allow passt_t tmp_t:sock_file { create unlink write };
-allow passt_t self:netlink_route_socket { bind create nlmsg_read read write };
+allow passt_t self:netlink_route_socket { bind create nlmsg_read read write setopt };
 
 allow passt_t self:tcp_socket create_stream_socket_perms;
 corenet_tcp_sendrecv_generic_node(passt_t)
-- 
@@ -98,7 +98,7 @@ allow passt_t proc_net_t:file read;
 allow passt_t net_conf_t:file { open read };
 allow passt_t net_conf_t:lnk_file read;
 allow passt_t tmp_t:sock_file { create unlink write };
-allow passt_t self:netlink_route_socket { bind create nlmsg_read read write };
+allow passt_t self:netlink_route_socket { bind create nlmsg_read read write setopt };
 
 allow passt_t self:tcp_socket create_stream_socket_perms;
 corenet_tcp_sendrecv_generic_node(passt_t)
-- 
2.39.1