RHEL 9 BETA
- SELinux prevents fapolicyd from watch_mount/watch_with_perm on /dev/shm Resolves: rhbz#1932225 Resolves: rhbz#1977731 Signed-off-by: Radovan Sroka <rsroka@redhat.com>
This commit is contained in:
Radovan Sroka
parent
421ab1fe32
commit
85fa1e88aa
40
fapolicyd-selinux-allow-boot-home.patch
Normal file
40
fapolicyd-selinux-allow-boot-home.patch
Normal file
@ -0,0 +1,40 @@
|
||||
From a1a9a59f93ebfe6d0c9d725ed0712210994e6d64 Mon Sep 17 00:00:00 2001
|
||||
From: Zdenek Pytela <zpytela@redhat.com>
|
||||
Date: Tue, 6 Apr 2021 16:06:48 +0200
|
||||
Subject: [PATCH] Allow fapolicyd watch boot and home directories
|
||||
|
||||
The fapolicyd service needs watch_mount and watch_with_perm permissions
|
||||
for fanotify/inotify/dnotify calls on the following directories:
|
||||
- /boot and /boot/efi directories
|
||||
- /home directories
|
||||
|
||||
Note the /boot/efi directory has the dosfs_t label.
|
||||
---
|
||||
fapolicyd.te | 6 ++++++
|
||||
1 file changed, 6 insertions(+)
|
||||
|
||||
diff --git a/fapolicyd-selinux-0.4/fapolicyd.te b/fapolicyd-selinux-0.4/fapolicyd.te
|
||||
index f5d0052..c12f385 100644
|
||||
--- a/fapolicyd-selinux-0.4/fapolicyd.te
|
||||
+++ b/fapolicyd-selinux-0.4/fapolicyd.te
|
||||
@@ -63,14 +63,20 @@ domain_read_all_domains_state(fapolicyd_t)
|
||||
|
||||
files_mmap_usr_files(fapolicyd_t)
|
||||
files_read_all_files(fapolicyd_t)
|
||||
+files_watch_mount_boot_dirs(fapolicyd_t)
|
||||
+files_watch_with_perm_boot_dirs(fapolicyd_t)
|
||||
files_watch_mount_generic_tmp_dirs(fapolicyd_t)
|
||||
files_watch_with_perm_generic_tmp_dirs(fapolicyd_t)
|
||||
+files_watch_mount_home(fapolicyd_t)
|
||||
+files_watch_with_perm_home(fapolicyd_t)
|
||||
files_watch_mount_root_dirs(fapolicyd_t)
|
||||
files_watch_with_perm_root_dirs(fapolicyd_t)
|
||||
|
||||
fs_getattr_xattr_fs(fapolicyd_t)
|
||||
fs_watch_mount_tmpfs_dirs(fapolicyd_t)
|
||||
fs_watch_with_perm_tmpfs_dirs(fapolicyd_t)
|
||||
+fs_watch_mount_dos_dirs(fapolicyd_t)
|
||||
+fs_watch_with_perm_dos_dirs(fapolicyd_t)
|
||||
|
||||
logging_send_syslog_msg(fapolicyd_t)
|
||||
dbus_system_bus_client(fapolicyd_t)
|
||||
31
fapolicyd-selinux-watch-perm.patch
Normal file
31
fapolicyd-selinux-watch-perm.patch
Normal file
@ -0,0 +1,31 @@
|
||||
From 6a966a3ee89233a0a055712f39ca564ba91183bf Mon Sep 17 00:00:00 2001
|
||||
From: Zdenek Pytela <zpytela@redhat.com>
|
||||
Date: Thu, 15 Apr 2021 16:56:08 +0200
|
||||
Subject: [PATCH] Allow fapolicyd watch_mount/watch_with_perm all files and
|
||||
directories
|
||||
|
||||
For the fanotify_mark() syscall, fapolicyd uses the FAN_MARK_MOUNT flag
|
||||
to mark the file's mount point to monitor. As this can be any file or
|
||||
directory on the filesystem, the SELinux watch_mount and watch_with_perm
|
||||
permissions are allowed for the file_type attribute.
|
||||
---
|
||||
fapolicyd.te | 6 ++++++
|
||||
1 file changed, 6 insertions(+)
|
||||
|
||||
diff --git a/fapolicyd-selinux-0.4/fapolicyd.te b/fapolicyd-selinux-0.4/fapolicyd.te
|
||||
index c12f385..582e03f 100644
|
||||
--- a/fapolicyd-selinux-0.4/fapolicyd.te
|
||||
+++ b/fapolicyd-selinux-0.4/fapolicyd.te
|
||||
@@ -36,6 +36,12 @@ allow fapolicyd_t self:process { setcap setsched };
|
||||
allow fapolicyd_t self:unix_stream_socket create_stream_socket_perms;
|
||||
allow fapolicyd_t self:unix_dgram_socket create_socket_perms;
|
||||
|
||||
+gen_require(`
|
||||
+ attribute file_type;
|
||||
+')
|
||||
+allow fapolicyd_t file_type:dir { watch_mount watch_with_perm };
|
||||
+allow fapolicyd_t file_type:file { watch_mount watch_with_perm };
|
||||
+
|
||||
manage_files_pattern(fapolicyd_t, fapolicyd_log_t, fapolicyd_log_t)
|
||||
logging_log_filetrans(fapolicyd_t, fapolicyd_log_t, file)
|
||||
|
||||
@ -5,7 +5,7 @@
|
||||
Summary: Application Whitelisting Daemon
|
||||
Name: fapolicyd
|
||||
Version: 1.0.3
|
||||
Release: 2%{?dist}
|
||||
Release: 3%{?dist}
|
||||
License: GPLv3+
|
||||
URL: http://people.redhat.com/sgrubb/fapolicyd
|
||||
Source0: https://people.redhat.com/sgrubb/fapolicyd/%{name}-%{version}.tar.gz
|
||||
@ -31,6 +31,11 @@ Requires(preun): systemd-units
|
||||
Requires(postun): systemd-units
|
||||
|
||||
Patch1: fapolicyd-uthash-bundle.patch
|
||||
Patch2: fapolicyd-selinux-allow-boot-home.patch
|
||||
Patch3: fapolicyd-selinux-watch-perm.patch
|
||||
|
||||
# hardcode missing selinux definitions from selinux-policy
|
||||
Patch4: selinux-backport.patch
|
||||
|
||||
%description
|
||||
Fapolicyd (File Access Policy Daemon) implements application whitelisting
|
||||
@ -54,8 +59,8 @@ The %{name}-selinux package contains selinux policy for the %{name} daemon.
|
||||
Summary: Fapolicyd dnf plugin
|
||||
Group: Applications/System
|
||||
Requires: %{name} = %{version}-%{release}
|
||||
BuildArch: noarch
|
||||
Provides: %{name}-plugin
|
||||
BuildArch: noarch
|
||||
Provides: %{name}-plugin
|
||||
|
||||
%description dnf-plugin
|
||||
The %{name}-dnf-plugin notifies %{name} daemon about dnf update.
|
||||
@ -76,6 +81,11 @@ Don't use dnf and rpm plugin together.
|
||||
%patch1 -p1 -b .uthash
|
||||
%endif
|
||||
|
||||
%patch2 -p1 -b .home-boot
|
||||
%patch3 -p1 -b .watch-perm
|
||||
|
||||
%patch4 -p1 -b .backport
|
||||
|
||||
sed -i "s/%python2_path%/`readlink -f %{__python2} | sed 's/\//\\\\\//g'`/g" init/%{name}.rules.*
|
||||
sed -i "s/%python3_path%/`readlink -f %{__python3} | sed 's/\//\\\\\//g'`/g" init/%{name}.rules.*
|
||||
sed -i "s/%ld_so_path%/`find /usr/lib64/ -type f -name 'ld-2\.*.so' | sed 's/\//\\\\\//g'`/g" init/%{name}.rules.*
|
||||
@ -201,6 +211,12 @@ fi
|
||||
|
||||
|
||||
%changelog
|
||||
* Tue Jul 20 2021 Radovan Sroka <rsroka@redhat.com> - 1.0.3-3
|
||||
RHEL 9 BETA
|
||||
- SELinux prevents fapolicyd from watch_mount/watch_with_perm on /dev/shm
|
||||
Resolves: rhbz#1932225
|
||||
Resolves: rhbz#1977731
|
||||
|
||||
* Thu Apr 15 2021 Mohan Boddu <mboddu@redhat.com> - 1.0.3-2
|
||||
- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
|
||||
|
||||
|
||||
136
selinux-backport.patch
Normal file
136
selinux-backport.patch
Normal file
@ -0,0 +1,136 @@
|
||||
diff -up ./fapolicyd-selinux-0.4/fapolicyd.if.backport ./fapolicyd-selinux-0.4/fapolicyd.if
|
||||
--- ./fapolicyd-selinux-0.4/fapolicyd.if.backport 2021-03-23 10:21:31.000000000 +0100
|
||||
+++ ./fapolicyd-selinux-0.4/fapolicyd.if 2021-07-20 17:38:51.266053356 +0200
|
||||
@@ -2,6 +2,122 @@
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
+## Watch_mount directories in /boot.
|
||||
+## </summary>
|
||||
+## <param name="domain">
|
||||
+## <summary>
|
||||
+## Domain allowed access.
|
||||
+## </summary>
|
||||
+## </param>
|
||||
+#
|
||||
+
|
||||
+ifndef(`files_watch_mount_boot_dirs',`
|
||||
+ interface(`files_watch_mount_boot_dirs',`
|
||||
+ gen_require(`
|
||||
+ type boot_t;
|
||||
+ ')
|
||||
+
|
||||
+ allow $1 boot_t:dir watch_mount_dir_perms;
|
||||
+ ')
|
||||
+')
|
||||
+
|
||||
+
|
||||
+########################################
|
||||
+## <summary>
|
||||
+## Watch_mount home directories.
|
||||
+## </summary>
|
||||
+## <param name="domain">
|
||||
+## <summary>
|
||||
+## Domain allowed access.
|
||||
+## </summary>
|
||||
+## </param>
|
||||
+#
|
||||
+
|
||||
+ifndef(`files_watch_mount_home',`
|
||||
+ interface(`files_watch_mount_home',`
|
||||
+ gen_require(`
|
||||
+ type home_root_t;
|
||||
+ ')
|
||||
+
|
||||
+ allow $1 home_root_t:dir watch_mount_dir_perms;
|
||||
+ ')
|
||||
+')
|
||||
+
|
||||
+
|
||||
+########################################
|
||||
+## <summary>
|
||||
+## Watch_with_perm home directories.
|
||||
+## </summary>
|
||||
+## <param name="domain">
|
||||
+## <summary>
|
||||
+## Domain allowed access.
|
||||
+## </summary>
|
||||
+## </param>
|
||||
+#
|
||||
+
|
||||
+ifndef(`files_watch_with_perm_home',`
|
||||
+interface(`files_watch_with_perm_home',`
|
||||
+ gen_require(`
|
||||
+ type home_root_t;
|
||||
+ ')
|
||||
+
|
||||
+ allow $1 home_root_t:dir watch_with_perm_dir_perms;
|
||||
+')
|
||||
+')
|
||||
+
|
||||
+
|
||||
+########################################
|
||||
+## <summary>
|
||||
+## Watch_mount dirs on a DOS filesystem.
|
||||
+## </summary>
|
||||
+## <param name="domain">
|
||||
+## <summary>
|
||||
+## Domain allowed access.
|
||||
+## </summary>
|
||||
+## </param>
|
||||
+#
|
||||
+
|
||||
+ifndef(`fs_watch_mount_dos_dirs',`
|
||||
+interface(`fs_watch_mount_dos_dirs',`
|
||||
+ gen_require(`
|
||||
+ type dosfs_t;
|
||||
+ ')
|
||||
+
|
||||
+ watch_mount_dirs_pattern($1, dosfs_t, dosfs_t)
|
||||
+')
|
||||
+')
|
||||
+
|
||||
+
|
||||
+
|
||||
+########################################
|
||||
+## <summary>
|
||||
+## Watch_with_perm dirs on a DOS filesystem.
|
||||
+## </summary>
|
||||
+## <param name="domain">
|
||||
+## <summary>
|
||||
+## Domain allowed access.
|
||||
+## </summary>
|
||||
+## </param>
|
||||
+#
|
||||
+
|
||||
+ifndef(`fs_watch_with_perm_dos_dirs',`
|
||||
+interface(`fs_watch_with_perm_dos_dirs',`
|
||||
+ gen_require(`
|
||||
+ type dosfs_t;
|
||||
+ ')
|
||||
+
|
||||
+ watch_with_perm_dirs_pattern($1, dosfs_t, dosfs_t)
|
||||
+')
|
||||
+')
|
||||
+
|
||||
+
|
||||
+###################################################################################################
|
||||
+
|
||||
+
|
||||
+
|
||||
+
|
||||
+########################################
|
||||
+## <summary>
|
||||
## Execute fapolicyd_exec_t in the fapolicyd domain.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
diff -up ./fapolicyd-selinux-0.4/fapolicyd.te.backport ./fapolicyd-selinux-0.4/fapolicyd.te
|
||||
--- ./fapolicyd-selinux-0.4/fapolicyd.te.backport 2021-07-20 17:31:12.161166538 +0200
|
||||
+++ ./fapolicyd-selinux-0.4/fapolicyd.te 2021-07-20 17:31:12.162166524 +0200
|
||||
@@ -1,5 +1,6 @@
|
||||
policy_module(fapolicyd, 1.0.0)
|
||||
|
||||
+
|
||||
########################################
|
||||
#
|
||||
# Declarations
|
||||
Loading…
Reference in New Issue
Block a user