From 85fa1e88aa4aa48369af7a94e9873c1f9227f33e Mon Sep 17 00:00:00 2001 From: Radovan Sroka Date: Wed, 21 Jul 2021 14:43:14 +0200 Subject: [PATCH] RHEL 9 BETA - SELinux prevents fapolicyd from watch_mount/watch_with_perm on /dev/shm Resolves: rhbz#1932225 Resolves: rhbz#1977731 Signed-off-by: Radovan Sroka --- fapolicyd-selinux-allow-boot-home.patch | 40 +++++++ fapolicyd-selinux-watch-perm.patch | 31 ++++++ fapolicyd.spec | 22 +++- selinux-backport.patch | 136 ++++++++++++++++++++++++ 4 files changed, 226 insertions(+), 3 deletions(-) create mode 100644 fapolicyd-selinux-allow-boot-home.patch create mode 100644 fapolicyd-selinux-watch-perm.patch create mode 100644 selinux-backport.patch diff --git a/fapolicyd-selinux-allow-boot-home.patch b/fapolicyd-selinux-allow-boot-home.patch new file mode 100644 index 0000000..f676d59 --- /dev/null +++ b/fapolicyd-selinux-allow-boot-home.patch @@ -0,0 +1,40 @@ +From a1a9a59f93ebfe6d0c9d725ed0712210994e6d64 Mon Sep 17 00:00:00 2001 +From: Zdenek Pytela +Date: Tue, 6 Apr 2021 16:06:48 +0200 +Subject: [PATCH] Allow fapolicyd watch boot and home directories + +The fapolicyd service needs watch_mount and watch_with_perm permissions +for fanotify/inotify/dnotify calls on the following directories: +- /boot and /boot/efi directories +- /home directories + +Note the /boot/efi directory has the dosfs_t label. +--- + fapolicyd.te | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/fapolicyd-selinux-0.4/fapolicyd.te b/fapolicyd-selinux-0.4/fapolicyd.te +index f5d0052..c12f385 100644 +--- a/fapolicyd-selinux-0.4/fapolicyd.te ++++ b/fapolicyd-selinux-0.4/fapolicyd.te +@@ -63,14 +63,20 @@ domain_read_all_domains_state(fapolicyd_t) + + files_mmap_usr_files(fapolicyd_t) + files_read_all_files(fapolicyd_t) ++files_watch_mount_boot_dirs(fapolicyd_t) ++files_watch_with_perm_boot_dirs(fapolicyd_t) + files_watch_mount_generic_tmp_dirs(fapolicyd_t) + files_watch_with_perm_generic_tmp_dirs(fapolicyd_t) ++files_watch_mount_home(fapolicyd_t) ++files_watch_with_perm_home(fapolicyd_t) + files_watch_mount_root_dirs(fapolicyd_t) + files_watch_with_perm_root_dirs(fapolicyd_t) + + fs_getattr_xattr_fs(fapolicyd_t) + fs_watch_mount_tmpfs_dirs(fapolicyd_t) + fs_watch_with_perm_tmpfs_dirs(fapolicyd_t) ++fs_watch_mount_dos_dirs(fapolicyd_t) ++fs_watch_with_perm_dos_dirs(fapolicyd_t) + + logging_send_syslog_msg(fapolicyd_t) + dbus_system_bus_client(fapolicyd_t) diff --git a/fapolicyd-selinux-watch-perm.patch b/fapolicyd-selinux-watch-perm.patch new file mode 100644 index 0000000..4128b8e --- /dev/null +++ b/fapolicyd-selinux-watch-perm.patch @@ -0,0 +1,31 @@ +From 6a966a3ee89233a0a055712f39ca564ba91183bf Mon Sep 17 00:00:00 2001 +From: Zdenek Pytela +Date: Thu, 15 Apr 2021 16:56:08 +0200 +Subject: [PATCH] Allow fapolicyd watch_mount/watch_with_perm all files and + directories + +For the fanotify_mark() syscall, fapolicyd uses the FAN_MARK_MOUNT flag +to mark the file's mount point to monitor. As this can be any file or +directory on the filesystem, the SELinux watch_mount and watch_with_perm +permissions are allowed for the file_type attribute. +--- + fapolicyd.te | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/fapolicyd-selinux-0.4/fapolicyd.te b/fapolicyd-selinux-0.4/fapolicyd.te +index c12f385..582e03f 100644 +--- a/fapolicyd-selinux-0.4/fapolicyd.te ++++ b/fapolicyd-selinux-0.4/fapolicyd.te +@@ -36,6 +36,12 @@ allow fapolicyd_t self:process { setcap setsched }; + allow fapolicyd_t self:unix_stream_socket create_stream_socket_perms; + allow fapolicyd_t self:unix_dgram_socket create_socket_perms; + ++gen_require(` ++ attribute file_type; ++') ++allow fapolicyd_t file_type:dir { watch_mount watch_with_perm }; ++allow fapolicyd_t file_type:file { watch_mount watch_with_perm }; ++ + manage_files_pattern(fapolicyd_t, fapolicyd_log_t, fapolicyd_log_t) + logging_log_filetrans(fapolicyd_t, fapolicyd_log_t, file) + diff --git a/fapolicyd.spec b/fapolicyd.spec index a800d5e..71fa1e2 100644 --- a/fapolicyd.spec +++ b/fapolicyd.spec @@ -5,7 +5,7 @@ Summary: Application Whitelisting Daemon Name: fapolicyd Version: 1.0.3 -Release: 2%{?dist} +Release: 3%{?dist} License: GPLv3+ URL: http://people.redhat.com/sgrubb/fapolicyd Source0: https://people.redhat.com/sgrubb/fapolicyd/%{name}-%{version}.tar.gz @@ -31,6 +31,11 @@ Requires(preun): systemd-units Requires(postun): systemd-units Patch1: fapolicyd-uthash-bundle.patch +Patch2: fapolicyd-selinux-allow-boot-home.patch +Patch3: fapolicyd-selinux-watch-perm.patch + +# hardcode missing selinux definitions from selinux-policy +Patch4: selinux-backport.patch %description Fapolicyd (File Access Policy Daemon) implements application whitelisting @@ -54,8 +59,8 @@ The %{name}-selinux package contains selinux policy for the %{name} daemon. Summary: Fapolicyd dnf plugin Group: Applications/System Requires: %{name} = %{version}-%{release} -BuildArch: noarch -Provides: %{name}-plugin +BuildArch: noarch +Provides: %{name}-plugin %description dnf-plugin The %{name}-dnf-plugin notifies %{name} daemon about dnf update. @@ -76,6 +81,11 @@ Don't use dnf and rpm plugin together. %patch1 -p1 -b .uthash %endif +%patch2 -p1 -b .home-boot +%patch3 -p1 -b .watch-perm + +%patch4 -p1 -b .backport + sed -i "s/%python2_path%/`readlink -f %{__python2} | sed 's/\//\\\\\//g'`/g" init/%{name}.rules.* sed -i "s/%python3_path%/`readlink -f %{__python3} | sed 's/\//\\\\\//g'`/g" init/%{name}.rules.* sed -i "s/%ld_so_path%/`find /usr/lib64/ -type f -name 'ld-2\.*.so' | sed 's/\//\\\\\//g'`/g" init/%{name}.rules.* @@ -201,6 +211,12 @@ fi %changelog +* Tue Jul 20 2021 Radovan Sroka - 1.0.3-3 +RHEL 9 BETA +- SELinux prevents fapolicyd from watch_mount/watch_with_perm on /dev/shm +Resolves: rhbz#1932225 +Resolves: rhbz#1977731 + * Thu Apr 15 2021 Mohan Boddu - 1.0.3-2 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 diff --git a/selinux-backport.patch b/selinux-backport.patch new file mode 100644 index 0000000..9666860 --- /dev/null +++ b/selinux-backport.patch @@ -0,0 +1,136 @@ +diff -up ./fapolicyd-selinux-0.4/fapolicyd.if.backport ./fapolicyd-selinux-0.4/fapolicyd.if +--- ./fapolicyd-selinux-0.4/fapolicyd.if.backport 2021-03-23 10:21:31.000000000 +0100 ++++ ./fapolicyd-selinux-0.4/fapolicyd.if 2021-07-20 17:38:51.266053356 +0200 +@@ -2,6 +2,122 @@ + + ######################################## + ## ++## Watch_mount directories in /boot. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++ ++ifndef(`files_watch_mount_boot_dirs',` ++ interface(`files_watch_mount_boot_dirs',` ++ gen_require(` ++ type boot_t; ++ ') ++ ++ allow $1 boot_t:dir watch_mount_dir_perms; ++ ') ++') ++ ++ ++######################################## ++## ++## Watch_mount home directories. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++ ++ifndef(`files_watch_mount_home',` ++ interface(`files_watch_mount_home',` ++ gen_require(` ++ type home_root_t; ++ ') ++ ++ allow $1 home_root_t:dir watch_mount_dir_perms; ++ ') ++') ++ ++ ++######################################## ++## ++## Watch_with_perm home directories. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++ ++ifndef(`files_watch_with_perm_home',` ++interface(`files_watch_with_perm_home',` ++ gen_require(` ++ type home_root_t; ++ ') ++ ++ allow $1 home_root_t:dir watch_with_perm_dir_perms; ++') ++') ++ ++ ++######################################## ++## ++## Watch_mount dirs on a DOS filesystem. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++ ++ifndef(`fs_watch_mount_dos_dirs',` ++interface(`fs_watch_mount_dos_dirs',` ++ gen_require(` ++ type dosfs_t; ++ ') ++ ++ watch_mount_dirs_pattern($1, dosfs_t, dosfs_t) ++') ++') ++ ++ ++ ++######################################## ++## ++## Watch_with_perm dirs on a DOS filesystem. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++ ++ifndef(`fs_watch_with_perm_dos_dirs',` ++interface(`fs_watch_with_perm_dos_dirs',` ++ gen_require(` ++ type dosfs_t; ++ ') ++ ++ watch_with_perm_dirs_pattern($1, dosfs_t, dosfs_t) ++') ++') ++ ++ ++################################################################################################### ++ ++ ++ ++ ++######################################## ++## + ## Execute fapolicyd_exec_t in the fapolicyd domain. + ## + ## +diff -up ./fapolicyd-selinux-0.4/fapolicyd.te.backport ./fapolicyd-selinux-0.4/fapolicyd.te +--- ./fapolicyd-selinux-0.4/fapolicyd.te.backport 2021-07-20 17:31:12.161166538 +0200 ++++ ./fapolicyd-selinux-0.4/fapolicyd.te 2021-07-20 17:31:12.162166524 +0200 +@@ -1,5 +1,6 @@ + policy_module(fapolicyd, 1.0.0) + ++ + ######################################## + # + # Declarations