Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

dracut: various fixes #19

Open
wants to merge 16 commits into
base: master
Choose a base branch
from
Open

dracut: various fixes #19

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
16 commits
Select commit Hold shift + click to select a range
81be1fc
dracut: Added dracut_conf_t type.
jpds May 13, 2021
f02254d
dracut.te: Added domain obj/role/system change exemptions.
jpds May 13, 2021
549122b
dracut.te: Added fs_getattr_xattr_fs().
jpds May 13, 2021
e780aa5
dracut.te: Added files_mmap_read_kernel_modules().
jpds May 13, 2021
0dc68f2
dracut.te: Added dev_read_urand().
jpds May 13, 2021
2d8964d
dracut.te: Added files_tmp_filetrans().
jpds May 13, 2021
97bad4a
dracut.te: Added portage_domtrans_gcc_config().
jpds May 13, 2021
6f345dc
dracut.te: Allow more process and capability features.
jpds May 13, 2021
aff6e26
dracut.te: Added files_unconfined().
jpds May 13, 2021
fd9969f
dracut.te: Added seutil_relabelto_bin_policy().
jpds May 13, 2021
8348287
dracut.te: Added storage_getattr_fixed_disk_dev().
jpds May 13, 2021
1c05d33
dracut.te: Use libs_run_ldconfig() instead of exec.
jpds Jun 14, 2021
de8cd4b
portage.te: Added dracut_run().
jpds Jun 14, 2021
ca279cf
dracut.fc: Added dracut-install as dracut_exec_t.
jpds Jun 14, 2021
b9fb2f2
dracut.te: Added storage_raw_rw_fixed_disk().
jpds Jun 14, 2021
ddbc34a
dracut.te: Added LVM control accesses.
jpds Jun 15, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions policy/modules/admin/portage.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -229,6 +229,10 @@ optional_policy(`
cron_system_entry(portage_fetch_t, portage_fetch_exec_t)
')

optional_policy(`
dracut_run(portage_t, portage_roles)
')

optional_policy(`
gpg_spec_domtrans(portage_t, portage_fetch_t)
')
Expand Down
5 changes: 4 additions & 1 deletion policy/modules/contrib/dracut.fc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,8 @@
/etc/dracut\.conf -- gen_context(system_u:object_r:dracut_conf_t,s0)
/etc/dracut\.conf\.d(/.*)? gen_context(system_u:object_r:dracut_conf_t,s0)
#
# /usr
#
/usr/sbin/dracut -- gen_context(system_u:object_r:dracut_exec_t,s0)
/usr/bin/dracut -- gen_context(system_u:object_r:dracut_exec_t,s0)
/usr/lib/dracut/dracut-install -- gen_context(system_u:object_r:dracut_exec_t,s0)
/usr/sbin/dracut -- gen_context(system_u:object_r:dracut_exec_t,s0)
38 changes: 35 additions & 3 deletions policy/modules/contrib/dracut.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,21 +4,30 @@ type dracut_t;
type dracut_exec_t;
application_domain(dracut_t, dracut_exec_t)

type dracut_conf_t;
files_config_file(dracut_conf_t)

type dracut_var_log_t;
logging_log_file(dracut_var_log_t)

type dracut_tmp_t;
files_tmp_file(dracut_tmp_t)

attribute_role dracut_roles;
role dracut_roles types dracut_t;

########################################
#
# Local policy
#
allow dracut_t self:process setfscreate;
allow dracut_t self:capability dac_override;
allow dracut_t self:process { getsched setfscreate };
allow dracut_t self:capability { dac_override dac_read_search fsetid mknod sys_admin };
allow dracut_t self:fifo_file rw_fifo_file_perms;
allow dracut_t self:unix_stream_socket create_stream_socket_perms;

list_dirs_pattern(dracut_t, dracut_conf_t, dracut_conf_t)
read_files_pattern(dracut_t, dracut_conf_t, dracut_conf_t)

manage_files_pattern(dracut_t, dracut_tmp_t, dracut_tmp_t)
manage_dirs_pattern(dracut_t, dracut_tmp_t, dracut_tmp_t)
manage_lnk_files_pattern(dracut_t, dracut_tmp_t, dracut_tmp_t)
Expand All @@ -28,25 +37,40 @@ files_tmp_filetrans(dracut_t, dracut_tmp_t, dir)
manage_files_pattern(dracut_t, dracut_var_log_t, dracut_var_log_t)
logging_log_filetrans(dracut_t, dracut_var_log_t, file)

auth_manage_shadow(dracut_t)
auth_relabelto_shadow(dracut_t)

domain_obj_id_change_exemption(dracut_t)
domain_role_change_exemption(dracut_t)
domain_system_change_exemption(dracut_t)
Comment on lines +40 to +45
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

uh these are dangerous permissions. Why does dracut need to manage shadow?

Also I'd need a pretty strong justification if things need the foo_change_exemption() rules, those are usually for things like login managers that need to switch to different users or security levels etc.

sometimes those rules showing up means PAM or chk_passwd stuff. does this instead need auth_use_pam(dracut_t) or maybe auth_use_nsswitch?

I see this line: modules.d/99base/module-setup.sh:33: [[ $hostonly ]] && grep '^root:' "$dracutsysrootdir"/etc/shadow >> "$initdir/etc/shadow" but at the most that should need read_shadow not manage_shadow right?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These are needed because dracut does this:

#!!!! This avc is a constraint violation.  You would need to modify the attributes of either the source or target types to allow this access.
#Constraint rule:
#       constrain file { create relabelfrom relabelto } ((u1 == u2 -Fail-)  or (t1 == can_change_object_identity -Fail-) ); Constraint DENIED

#       Possible cause is the source user (staff_u) and target user (system_u) are different.
allow dracut_t modules_object_t:file relabelto;

Also needs manage_shadow as otherwise it hits a neverallow rule with the files_unconfined permission.


kernel_read_messages(dracut_t)
kernel_read_system_state(dracut_t)

corecmd_exec_bin(dracut_t)
corecmd_exec_shell(dracut_t)
corecmd_mmap_all_executables(dracut_t)

dev_getattr_lvm_control(dracut_t)
dev_read_lvm_control(dracut_t)
dev_read_kmsg(dracut_t)
dev_read_sysfs(dracut_t)
dev_read_urand(dracut_t)

domain_use_interactive_fds(dracut_t)

files_create_kernel_img(dracut_t)
files_mmap_read_kernel_modules(dracut_t)
files_read_etc_files(dracut_t)
files_read_kernel_modules(dracut_t)
files_read_usr_files(dracut_t)
files_search_runtime(dracut_t)
files_tmp_filetrans(dracut_t, dracut_tmp_t, { file dir })
files_unconfined(dracut_t)

libs_exec_ldconfig(dracut_t)
fs_getattr_xattr_fs(dracut_t)

libs_run_ldconfig(dracut_t, dracut_roles)
libs_exec_ld_so(dracut_t)
libs_exec_lib_files(dracut_t)

Expand All @@ -55,6 +79,11 @@ miscfiles_read_localization(dracut_t)
modutils_read_module_config(dracut_t)
modutils_read_module_deps(dracut_t)

seutil_relabelto_bin_policy(dracut_t)

storage_getattr_fixed_disk_dev(dracut_t)
storage_raw_rw_fixed_disk(dracut_t)

udev_read_rules_files(dracut_t)

userdom_search_user_home_dirs(dracut_t)
Expand All @@ -64,3 +93,6 @@ optional_policy(`
lvm_read_config(dracut_t)
')

ifdef(`distro_gentoo',`
portage_domtrans_gcc_config(dracut_t)
')