From mboxrd@z Thu Jan 1 00:00:00 1970 Received: by passt.top (Postfix, from userid 1000) id 7F7575A026D; Tue, 21 Feb 2023 19:39:15 +0100 (CET) From: Stefano Brivio To: passt-dev@passt.top Subject: [PATCH 3/6] selinux: Switch to a more reasonable model for PID and socket files Date: Tue, 21 Feb 2023 19:39:12 +0100 Message-Id: <20230221183915.3740123-4-sbrivio@redhat.com> X-Mailer: git-send-email 2.39.1 In-Reply-To: <20230221183915.3740123-1-sbrivio@redhat.com> References: <20230221183915.3740123-1-sbrivio@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Message-ID-Hash: NM2N56I6XHDDUWI2A33YO6MOIX4EQFXU X-Message-ID-Hash: NM2N56I6XHDDUWI2A33YO6MOIX4EQFXU X-MailFrom: sbrivio@passt.top X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: Laine Stump X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Instead of restricting PID files to /var/run/passt.pid, which is a single file and unlikely to be used, use the user_tmp_t type which should cover any reasonable need. Signed-off-by: Stefano Brivio --- contrib/selinux/passt.fc | 1 - contrib/selinux/passt.te | 11 +++++++---- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/contrib/selinux/passt.fc b/contrib/selinux/passt.fc index 4638200..286c868 100644 --- a/contrib/selinux/passt.fc +++ b/contrib/selinux/passt.fc @@ -10,4 +10,3 @@ /usr/bin/passt(\.*)? system_u:object_r:passt_exec_t:s0 /tmp/passt\.pcap system_u:object_r:passt_log_t:s0 -/var/run/passt\.pid system_u:object_r:passt_pid_t:s0 diff --git a/contrib/selinux/passt.te b/contrib/selinux/passt.te index 1f45fcd..12a4288 100644 --- a/contrib/selinux/passt.te +++ b/contrib/selinux/passt.te @@ -19,6 +19,7 @@ require { type user_home_dir_t; type fs_t; type tmp_t; + type user_tmp_t; type tmpfs_t; type root_t; @@ -59,8 +60,6 @@ files_type(passt_exec_t); init_daemon_domain(passt_t, passt_exec_t) type passt_log_t; logging_log_file(passt_log_t); -type passt_pid_t; -files_pid_file(passt_pid_t); type passt_etc_t; files_config_file(passt_etc_t); @@ -83,8 +82,8 @@ allow passt_t tmp_t:dir { add_name mounton remove_name write }; allow passt_t tmpfs_t:filesystem mount; allow passt_t fs_t:filesystem unmount; -manage_files_pattern(passt_t, passt_pid_t, passt_pid_t) -files_pid_filetrans(passt_t, passt_pid_t, file) +manage_files_pattern(passt_t, user_tmp_t, user_tmp_t) +files_pid_filetrans(passt_t, user_tmp_t, file) allow passt_t console_device_t:chr_file { open write getattr ioctl }; allow passt_t user_devpts_t:chr_file { getattr read write ioctl }; @@ -110,3 +109,7 @@ corenet_udp_bind_generic_node(passt_t) allow passt_t passt_port_t:udp_socket { name_bind }; allow passt_t node_t:icmp_socket { name_bind node_bind }; allow passt_t self:icmp_socket { bind create setopt read write }; + +allow passt_t user_tmp_t:dir { add_name write }; +allow passt_t user_tmp_t:file { create open }; +allow passt_t user_tmp_t:sock_file { create read write unlink }; -- 2.39.1