selinux: use watch perm correctly
Signed-off-by: Radovan Sroka <rsroka@redhat.com>
This commit is contained in:
Radovan Sroka
parent
3baac102cf
commit
2a4ad6eae7
40
fapolicyd-selinux-allow-boot-home.patch
Normal file
40
fapolicyd-selinux-allow-boot-home.patch
Normal file
@ -0,0 +1,40 @@
|
||||
From a1a9a59f93ebfe6d0c9d725ed0712210994e6d64 Mon Sep 17 00:00:00 2001
|
||||
From: Zdenek Pytela <zpytela@redhat.com>
|
||||
Date: Tue, 6 Apr 2021 16:06:48 +0200
|
||||
Subject: [PATCH] Allow fapolicyd watch boot and home directories
|
||||
|
||||
The fapolicyd service needs watch_mount and watch_with_perm permissions
|
||||
for fanotify/inotify/dnotify calls on the following directories:
|
||||
- /boot and /boot/efi directories
|
||||
- /home directories
|
||||
|
||||
Note the /boot/efi directory has the dosfs_t label.
|
||||
---
|
||||
fapolicyd.te | 6 ++++++
|
||||
1 file changed, 6 insertions(+)
|
||||
|
||||
diff --git a/fapolicyd-selinux-0.4/fapolicyd.te b/fapolicyd-selinux-0.4/fapolicyd.te
|
||||
index f5d0052..c12f385 100644
|
||||
--- a/fapolicyd-selinux-0.4/fapolicyd.te
|
||||
+++ b/fapolicyd-selinux-0.4/fapolicyd.te
|
||||
@@ -63,14 +63,20 @@ domain_read_all_domains_state(fapolicyd_t)
|
||||
|
||||
files_mmap_usr_files(fapolicyd_t)
|
||||
files_read_all_files(fapolicyd_t)
|
||||
+files_watch_mount_boot_dirs(fapolicyd_t)
|
||||
+files_watch_with_perm_boot_dirs(fapolicyd_t)
|
||||
files_watch_mount_generic_tmp_dirs(fapolicyd_t)
|
||||
files_watch_with_perm_generic_tmp_dirs(fapolicyd_t)
|
||||
+files_watch_mount_home(fapolicyd_t)
|
||||
+files_watch_with_perm_home(fapolicyd_t)
|
||||
files_watch_mount_root_dirs(fapolicyd_t)
|
||||
files_watch_with_perm_root_dirs(fapolicyd_t)
|
||||
|
||||
fs_getattr_xattr_fs(fapolicyd_t)
|
||||
fs_watch_mount_tmpfs_dirs(fapolicyd_t)
|
||||
fs_watch_with_perm_tmpfs_dirs(fapolicyd_t)
|
||||
+fs_watch_mount_dos_dirs(fapolicyd_t)
|
||||
+fs_watch_with_perm_dos_dirs(fapolicyd_t)
|
||||
|
||||
logging_send_syslog_msg(fapolicyd_t)
|
||||
dbus_system_bus_client(fapolicyd_t)
|
||||
31
fapolicyd-selinux-watch-perm.patch
Normal file
31
fapolicyd-selinux-watch-perm.patch
Normal file
@ -0,0 +1,31 @@
|
||||
From 6a966a3ee89233a0a055712f39ca564ba91183bf Mon Sep 17 00:00:00 2001
|
||||
From: Zdenek Pytela <zpytela@redhat.com>
|
||||
Date: Thu, 15 Apr 2021 16:56:08 +0200
|
||||
Subject: [PATCH] Allow fapolicyd watch_mount/watch_with_perm all files and
|
||||
directories
|
||||
|
||||
For the fanotify_mark() syscall, fapolicyd uses the FAN_MARK_MOUNT flag
|
||||
to mark the file's mount point to monitor. As this can be any file or
|
||||
directory on the filesystem, the SELinux watch_mount and watch_with_perm
|
||||
permissions are allowed for the file_type attribute.
|
||||
---
|
||||
fapolicyd.te | 6 ++++++
|
||||
1 file changed, 6 insertions(+)
|
||||
|
||||
diff --git a/fapolicyd-selinux-0.4/fapolicyd.te b/fapolicyd-selinux-0.4/fapolicyd.te
|
||||
index c12f385..582e03f 100644
|
||||
--- a/fapolicyd-selinux-0.4/fapolicyd.te
|
||||
+++ b/fapolicyd-selinux-0.4/fapolicyd.te
|
||||
@@ -36,6 +36,12 @@ allow fapolicyd_t self:process { setcap setsched };
|
||||
allow fapolicyd_t self:unix_stream_socket create_stream_socket_perms;
|
||||
allow fapolicyd_t self:unix_dgram_socket create_socket_perms;
|
||||
|
||||
+gen_require(`
|
||||
+ attribute file_type;
|
||||
+')
|
||||
+allow fapolicyd_t file_type:dir { watch_mount watch_with_perm };
|
||||
+allow fapolicyd_t file_type:file { watch_mount watch_with_perm };
|
||||
+
|
||||
manage_files_pattern(fapolicyd_t, fapolicyd_log_t, fapolicyd_log_t)
|
||||
logging_log_filetrans(fapolicyd_t, fapolicyd_log_t, file)
|
||||
|
||||
@ -5,7 +5,7 @@
|
||||
Summary: Application Whitelisting Daemon
|
||||
Name: fapolicyd
|
||||
Version: 1.0.3
|
||||
Release: 3%{?dist}
|
||||
Release: 4%{?dist}
|
||||
License: GPLv3+
|
||||
URL: http://people.redhat.com/sgrubb/fapolicyd
|
||||
Source0: https://people.redhat.com/sgrubb/fapolicyd/%{name}-%{version}.tar.gz
|
||||
@ -31,7 +31,9 @@ Requires(preun): systemd-units
|
||||
Requires(postun): systemd-units
|
||||
|
||||
Patch1: fapolicyd-uthash-bundle.patch
|
||||
Patch2: fapolicyd-revert-watch-selinux.patch
|
||||
|
||||
Patch2: fapolicyd-selinux-watch-perm.patch
|
||||
Patch3: fapolicyd-selinux-allow-boot-home.patch
|
||||
|
||||
%description
|
||||
Fapolicyd (File Access Policy Daemon) implements application whitelisting
|
||||
@ -77,7 +79,8 @@ Don't use dnf and rpm plugin together.
|
||||
%patch1 -p1 -b .uthash
|
||||
%endif
|
||||
|
||||
%patch2 -p1 -b .selinux
|
||||
%patch2 -p1 -b .watch-perm
|
||||
%patch3 -p1 -b .home
|
||||
|
||||
sed -i "s/%python2_path%/`readlink -f %{__python2} | sed 's/\//\\\\\//g'`/g" init/%{name}.rules.*
|
||||
sed -i "s/%python3_path%/`readlink -f %{__python3} | sed 's/\//\\\\\//g'`/g" init/%{name}.rules.*
|
||||
@ -204,6 +207,9 @@ fi
|
||||
|
||||
|
||||
%changelog
|
||||
* Wed Sep 01 2021 Radovan Sroka <rsroka@redhat.com> - 1.0.3-4
|
||||
- selinux: use watch perm correctly
|
||||
|
||||
* Wed Jul 21 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.0.3-3
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user