From: Stefano Brivio <sbrivio@redhat.com>
To: passt-dev@passt.top
Cc: Laine Stump <laine@redhat.com>
Subject: [PATCH 3/6] selinux: Switch to a more reasonable model for PID and socket files
Date: Tue, 21 Feb 2023 19:39:12 +0100 [thread overview]
Message-ID: <20230221183915.3740123-4-sbrivio@redhat.com> (raw)
In-Reply-To: <20230221183915.3740123-1-sbrivio@redhat.com>
Instead of restricting PID files to /var/run/passt.pid, which is a
single file and unlikely to be used, use the user_tmp_t type which
should cover any reasonable need.
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
---
contrib/selinux/passt.fc | 1 -
contrib/selinux/passt.te | 11 +++++++----
2 files changed, 7 insertions(+), 5 deletions(-)
diff --git a/contrib/selinux/passt.fc b/contrib/selinux/passt.fc
index 4638200..286c868 100644
--- a/contrib/selinux/passt.fc
+++ b/contrib/selinux/passt.fc
@@ -10,4 +10,3 @@
/usr/bin/passt(\.*)? system_u:object_r:passt_exec_t:s0
/tmp/passt\.pcap system_u:object_r:passt_log_t:s0
-/var/run/passt\.pid system_u:object_r:passt_pid_t:s0
diff --git a/contrib/selinux/passt.te b/contrib/selinux/passt.te
index 1f45fcd..12a4288 100644
--- a/contrib/selinux/passt.te
+++ b/contrib/selinux/passt.te
@@ -19,6 +19,7 @@ require {
type user_home_dir_t;
type fs_t;
type tmp_t;
+ type user_tmp_t;
type tmpfs_t;
type root_t;
@@ -59,8 +60,6 @@ files_type(passt_exec_t);
init_daemon_domain(passt_t, passt_exec_t)
type passt_log_t;
logging_log_file(passt_log_t);
-type passt_pid_t;
-files_pid_file(passt_pid_t);
type passt_etc_t;
files_config_file(passt_etc_t);
@@ -83,8 +82,8 @@ allow passt_t tmp_t:dir { add_name mounton remove_name write };
allow passt_t tmpfs_t:filesystem mount;
allow passt_t fs_t:filesystem unmount;
-manage_files_pattern(passt_t, passt_pid_t, passt_pid_t)
-files_pid_filetrans(passt_t, passt_pid_t, file)
+manage_files_pattern(passt_t, user_tmp_t, user_tmp_t)
+files_pid_filetrans(passt_t, user_tmp_t, file)
allow passt_t console_device_t:chr_file { open write getattr ioctl };
allow passt_t user_devpts_t:chr_file { getattr read write ioctl };
@@ -110,3 +109,7 @@ corenet_udp_bind_generic_node(passt_t)
allow passt_t passt_port_t:udp_socket { name_bind };
allow passt_t node_t:icmp_socket { name_bind node_bind };
allow passt_t self:icmp_socket { bind create setopt read write };
+
+allow passt_t user_tmp_t:dir { add_name write };
+allow passt_t user_tmp_t:file { create open };
+allow passt_t user_tmp_t:sock_file { create read write unlink };
--
@@ -19,6 +19,7 @@ require {
type user_home_dir_t;
type fs_t;
type tmp_t;
+ type user_tmp_t;
type tmpfs_t;
type root_t;
@@ -59,8 +60,6 @@ files_type(passt_exec_t);
init_daemon_domain(passt_t, passt_exec_t)
type passt_log_t;
logging_log_file(passt_log_t);
-type passt_pid_t;
-files_pid_file(passt_pid_t);
type passt_etc_t;
files_config_file(passt_etc_t);
@@ -83,8 +82,8 @@ allow passt_t tmp_t:dir { add_name mounton remove_name write };
allow passt_t tmpfs_t:filesystem mount;
allow passt_t fs_t:filesystem unmount;
-manage_files_pattern(passt_t, passt_pid_t, passt_pid_t)
-files_pid_filetrans(passt_t, passt_pid_t, file)
+manage_files_pattern(passt_t, user_tmp_t, user_tmp_t)
+files_pid_filetrans(passt_t, user_tmp_t, file)
allow passt_t console_device_t:chr_file { open write getattr ioctl };
allow passt_t user_devpts_t:chr_file { getattr read write ioctl };
@@ -110,3 +109,7 @@ corenet_udp_bind_generic_node(passt_t)
allow passt_t passt_port_t:udp_socket { name_bind };
allow passt_t node_t:icmp_socket { name_bind node_bind };
allow passt_t self:icmp_socket { bind create setopt read write };
+
+allow passt_t user_tmp_t:dir { add_name write };
+allow passt_t user_tmp_t:file { create open };
+allow passt_t user_tmp_t:sock_file { create read write unlink };
--
2.39.1
next prev parent reply other threads:[~2023-02-21 18:39 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-02-21 18:39 [PATCH 0/6] selinux: Assorted fixes, libvirt support Stefano Brivio
2023-02-21 18:39 ` [PATCH 1/6] selinux/passt.if: Fix typo in passt_read_data interface definition Stefano Brivio
2023-02-21 18:39 ` [PATCH 2/6] selinux: Define interfaces for libvirt and similar frameworks Stefano Brivio
2023-02-21 18:39 ` Stefano Brivio [this message]
2023-02-21 18:39 ` [PATCH 4/6] selinux/passt.te: Allow setcap on the process itself Stefano Brivio
2023-02-21 18:39 ` [PATCH 5/6] selinux/passt.te: Allow /etc/resolv.conf symlinks to be followed Stefano Brivio
2023-02-21 18:39 ` [PATCH 6/6] selinux/passt.te: Allow setting socket option on routing netlink socket Stefano Brivio
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230221183915.3740123-4-sbrivio@redhat.com \
--to=sbrivio@redhat.com \
--cc=laine@redhat.com \
--cc=passt-dev@passt.top \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://passt.top/passt
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for IMAP folder(s).