[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

["Sven Vermeulen" <sven.vermeulen@siphos.be>]

commit:     7a17b28e92b1c29cb7d0ddc269b5aa17c00c8a0e
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Thu Oct 25 12:06:46 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Sat Oct 27 11:03:00 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=7a17b28e

Changes to the rsync policy module

Ported from Fedora with changes

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/rsync.fc |    2 +-
 policy/modules/contrib/rsync.if |  119 ++++++++++++++++++++++++++++----
 policy/modules/contrib/rsync.te |  143 ++++++++++++++++++++++++++++-----------
 3 files changed, 209 insertions(+), 55 deletions(-)

diff --git a/policy/modules/contrib/rsync.fc b/policy/modules/contrib/rsync.fc
index 6a4b371..d25301b 100644
--- a/policy/modules/contrib/rsync.fc
+++ b/policy/modules/contrib/rsync.fc
@@ -2,6 +2,6 @@
 
 /usr/bin/rsync	--	gen_context(system_u:object_r:rsync_exec_t,s0)
 
-/var/log/rsync\.log	--	gen_context(system_u:object_r:rsync_log_t,s0)
+/var/log/rsync\.log.*	--	gen_context(system_u:object_r:rsync_log_t,s0)
 
 /var/run/rsyncd\.lock	--	gen_context(system_u:object_r:rsync_var_run_t,s0)

diff --git a/policy/modules/contrib/rsync.if b/policy/modules/contrib/rsync.if
index a580523..f1140ef 100644
--- a/policy/modules/contrib/rsync.if
+++ b/policy/modules/contrib/rsync.if
@@ -1,16 +1,16 @@
-## <summary>Fast incremental file transfer for synchronization</summary>
+## <summary>Fast incremental file transfer for synchronization.</summary>
 
 ########################################
 ## <summary>
-##	Make rsync an entry point for
-##	the specified domain.
+##	Make rsync executable file an
+##	entry point for the specified domain.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
-##	The domain for which init scripts are an entrypoint.
+##	The domain for which rsync_exec_t is an entrypoint.
 ##	</summary>
 ## </param>
-# cjp: added for portage
+#
 interface(`rsync_entry_type',`
 	gen_require(`
 		type rsync_exec_t;
@@ -43,13 +43,14 @@ interface(`rsync_entry_type',`
 ##	Domain to transition to.
 ##	</summary>
 ## </param>
-# cjp: added for portage
+#
 interface(`rsync_entry_spec_domtrans',`
 	gen_require(`
 		type rsync_exec_t;
 	')
 
-	domain_trans($1, rsync_exec_t, $2)
+	corecmd_search_bin($1)
+	auto_trans($1, rsync_exec_t, $2)
 ')
 
 ########################################
@@ -76,31 +77,76 @@ interface(`rsync_entry_spec_domtrans',`
 ##	Domain to transition to.
 ##	</summary>
 ## </param>
-# cjp: added for portage
+#
 interface(`rsync_entry_domtrans',`
 	gen_require(`
 		type rsync_exec_t;
 	')
 
+	corecmd_search_bin($1)
 	domain_auto_trans($1, rsync_exec_t, $2)
 ')
 
 ########################################
 ## <summary>
-##	Execute rsync in the caller domain domain.
+##	Execute the rsync program in the rsync domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+#
+interface(`rsync_domtrans',`
+	gen_require(`
+		type rsync_t, rsync_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	domtrans_pattern($1, rsync_exec_t, rsync_t)
+')
+
+########################################
+## <summary>
+##	Execute rsync in the rsync domain, and
+##	allow the specified role the rsync domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+#
+interface(`rsync_run',`
+	gen_require(`
+		attribute_role rsync_roles;
+	')
+
+	rsync_domtrans($1)
+	roleattribute $2 rsync_roles;
+')
+
+########################################
+## <summary>
+##	Execute rsync in the caller domain.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
 ##	Domain allowed access.
 ##	</summary>
 ## </param>
-## <rolecap/>
 #
 interface(`rsync_exec',`
 	gen_require(`
 		type rsync_exec_t;
 	')
 
+	corecmd_search_bin($1)
 	can_exec($1, rsync_exec_t)
 ')
 
@@ -119,13 +165,13 @@ interface(`rsync_read_config',`
 		type rsync_etc_t;
 	')
 
-	allow $1 rsync_etc_t:file read_file_perms;
 	files_search_etc($1)
+	allow $1 rsync_etc_t:file read_file_perms;
 ')
 
 ########################################
 ## <summary>
-##	Write to rsync config files.
+##	Write rsync config files.
 ## </summary>
 ## <param name="domain">
 ## <summary>
@@ -138,8 +184,8 @@ interface(`rsync_write_config',`
 		type rsync_etc_t;
 	')
 
-	allow $1 rsync_etc_t:file read_file_perms;
 	files_search_etc($1)
+	allow $1 rsync_etc_t:file write_file_perms;
 ')
 
 ########################################
@@ -158,13 +204,13 @@ interface(`rsync_manage_config_files',`
 		type rsync_etc_t;
 	')
 
-	manage_files_pattern($1, rsync_etc_t, rsync_etc_t)
 	files_search_etc($1)
+	manage_files_pattern($1, rsync_etc_t, rsync_etc_t)
 ')
 
 ########################################
 ## <summary>
-##	Create objects in etc directories
+##	Create specified objects in etc directories
 ##	with rsync etc type.
 ## </summary>
 ## <param name="domain">
@@ -190,3 +236,46 @@ interface(`rsync_etc_filetrans_config',`
 
 	files_etc_filetrans($1, rsync_etc_t, $2, $3)
 ')
+
+########################################
+## <summary>
+##	All of the rules required to
+##	administrate an rsync environment.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`rsync_admin',`
+	gen_require(`
+		type rsync_t, rsync_etc_t, rsync_data_t;
+		type rsync_log_t, rsync_tmp_t. rsync_var_run_t;
+	')
+
+	allow $1 rsync_t:process { ptrace signal_perms };
+	ps_process_pattern($1, rsync_t)
+
+	files_search_etc($1)
+	admin_pattern($1, rsync_etc_t)
+
+	admin_pattern($1, rsync_data_t)
+
+	logging_search_logs($1)
+	admin_pattern($1, rsync_log_t)
+
+	files_search_tmp($1)
+	admin_pattern($1, rsync_tmp_t)
+
+	files_search_pids($1)
+	admin_pattern($1, rsync_var_run_t)
+
+	rsync_run($1, $2)
+')

diff --git a/policy/modules/contrib/rsync.te b/policy/modules/contrib/rsync.te
index d5e469e..e3e7c96 100644
--- a/policy/modules/contrib/rsync.te
+++ b/policy/modules/contrib/rsync.te
@@ -1,4 +1,4 @@
-policy_module(rsync, 1.12.1)
+policy_module(rsync, 1.12.2)
 
 ########################################
 #
@@ -6,31 +6,67 @@ policy_module(rsync, 1.12.1)
 #
 
 ## <desc>
-## <p>
-## Allow rsync to export any files/directories read only.
-## </p>
+##	<p>
+##	Determine whether rsync can use
+##	cifs file systems.
+##	</p>
+## </desc>
+gen_tunable(rsync_use_cifs, false)
+
+## <desc>
+##	<p>
+##	Determine whether rsync can
+##	use fuse file systems.
+##	</p>
+## </desc>
+gen_tunable(rsync_use_fusefs, false)
+
+## <desc>
+##	<p>
+##	Determine whether rsync can use
+##	nfs file systems.
+##	</p>
+## </desc>
+gen_tunable(rsync_use_nfs, false)
+
+## <desc>
+##	<p>
+##	Determine whether rsync can
+##	run as a client
+##	</p>
+## </desc>
+gen_tunable(rsync_client, false)
+
+## <desc>
+##	<p>
+##	Determine whether rsync can
+##	export all content read only.
+##	</p>
 ## </desc>
 gen_tunable(rsync_export_all_ro, false)
 
 ## <desc>
-## <p>
-## Allow rsync to modify public files
-## used for public file transfer services.  Files/Directories must be
-## labeled public_content_rw_t.
-## </p>
+##	<p>
+##	Determine whether rsync can modify
+##	public files used for public file
+##	transfer services. Directories/Files must
+##	be labeled public_content_rw_t.
+##	</p>
 ## </desc>
 gen_tunable(allow_rsync_anon_write, false)
 
+attribute_role rsync_roles;
+
 type rsync_t;
 type rsync_exec_t;
 init_daemon_domain(rsync_t, rsync_exec_t)
-application_executable_file(rsync_exec_t)
-role system_r types rsync_t;
+application_domain(rsync_t, rsync_exec_t)
+role rsync_roles types rsync_t;
 
 type rsync_etc_t;
 files_config_file(rsync_etc_t)
 
-type rsync_data_t;
+type rsync_data_t; # customizable
 files_type(rsync_data_t)
 
 type rsync_log_t;
@@ -50,22 +86,15 @@ files_pid_file(rsync_var_run_t)
 allow rsync_t self:capability { chown dac_read_search dac_override fowner fsetid setuid setgid sys_chroot };
 allow rsync_t self:process signal_perms;
 allow rsync_t self:fifo_file rw_fifo_file_perms;
-allow rsync_t self:tcp_socket create_stream_socket_perms;
-allow rsync_t self:udp_socket connected_socket_perms;
-
-# for identd
-# cjp: this should probably only be inetd_child_t rules?
-# search home and kerberos also.
-allow rsync_t self:netlink_tcpdiag_socket r_netlink_socket_perms;
-#end for identd
+allow rsync_t self:tcp_socket { accept listen };
 
 allow rsync_t rsync_etc_t:file read_file_perms;
 
 allow rsync_t rsync_data_t:dir list_dir_perms;
-read_files_pattern(rsync_t, rsync_data_t, rsync_data_t)
-read_lnk_files_pattern(rsync_t, rsync_data_t, rsync_data_t)
+allow rsync_t rsync_data_t:file read_file_perms;
+allow rsync_t rsync_data_t:lnk_file read_lnk_file_perms;
 
-manage_files_pattern(rsync_t, rsync_log_t, rsync_log_t)
+allow rsync_t rsync_log_t:file { append_file_perms create_file_perms setattr_file_perms };
 logging_log_filetrans(rsync_t, rsync_log_t, file)
 
 manage_dirs_pattern(rsync_t, rsync_tmp_t, rsync_tmp_t)
@@ -82,22 +111,21 @@ kernel_read_network_state(rsync_t)
 corenet_all_recvfrom_unlabeled(rsync_t)
 corenet_all_recvfrom_netlabel(rsync_t)
 corenet_tcp_sendrecv_generic_if(rsync_t)
-corenet_udp_sendrecv_generic_if(rsync_t)
 corenet_tcp_sendrecv_generic_node(rsync_t)
-corenet_udp_sendrecv_generic_node(rsync_t)
-corenet_tcp_sendrecv_all_ports(rsync_t)
-corenet_udp_sendrecv_all_ports(rsync_t)
 corenet_tcp_bind_generic_node(rsync_t)
-corenet_tcp_bind_rsync_port(rsync_t)
+
 corenet_sendrecv_rsync_server_packets(rsync_t)
+corenet_tcp_bind_rsync_port(rsync_t)
+corenet_tcp_sendrecv_rsync_port(rsync_t)
 
 dev_read_urand(rsync_t)
 
-fs_getattr_xattr_fs(rsync_t)
+fs_getattr_all_fs(rsync_t)
+fs_search_auto_mountpoints(rsync_t)
 
-files_read_etc_files(rsync_t)
 files_search_home(rsync_t)
 
+auth_can_read_shadow_passwords(rsync_t)
 auth_use_nsswitch(rsync_t)
 
 logging_send_syslog_msg(rsync_t)
@@ -109,25 +137,62 @@ tunable_policy(`allow_rsync_anon_write',`
 	miscfiles_manage_public_files(rsync_t)
 ')
 
-optional_policy(`
-	daemontools_service_domain(rsync_t, rsync_exec_t)
-')
+tunable_policy(`rsync_client',`
+	corenet_sendrecv_rsync_client_packets(rsync_t)
+	corenet_tcp_connect_rsync_port(rsync_t)
 
-optional_policy(`
-	kerberos_use(rsync_t)
-')
+	corenet_sendrecv_ssh_client_packets(rsync_t)
+	corenet_tcp_connect_ssh_port(rsync_t)
+	corenet_tcp_sendrecv_ssh_port(rsync_t)
 
-optional_policy(`
-	inetd_service_domain(rsync_t, rsync_exec_t)
+	manage_dirs_pattern(rsync_t, rsync_data_t, rsync_data_t)
+	manage_files_pattern(rsync_t, rsync_data_t, rsync_data_t)
+	manage_lnk_files_pattern(rsync_t, rsync_data_t, rsync_data_t)
 ')
 
 tunable_policy(`rsync_export_all_ro',`
 	fs_read_noxattr_fs_files(rsync_t)
 	fs_read_nfs_files(rsync_t)
+	fs_read_fusefs_files(rsync_t)
 	fs_read_cifs_files(rsync_t)
 	files_list_non_auth_dirs(rsync_t)
 	files_read_non_auth_files(rsync_t)
 	files_read_non_auth_symlinks(rsync_t)
 	auth_tunable_read_shadow(rsync_t)
 ')
-auth_can_read_shadow_passwords(rsync_t)
+
+tunable_policy(`rsync_use_cifs',`
+	fs_list_cifs(rsync_t)
+	fs_read_cifs_files(rsync_t)
+	fs_read_cifs_symlinks(rsync_t)
+')
+
+tunable_policy(`rsync_use_fusefs',`
+	fs_search_fusefs(rsync_t)
+	fs_read_fusefs_files(rsync_t)
+	fs_read_fusefs_symlinks(rsync_t)
+')
+
+tunable_policy(`rsync_use_nfs',`
+	fs_list_nfs(rsync_t)
+	fs_read_nfs_files(rsync_t)
+	fs_read_nfs_symlinks(rsync_t)
+')
+
+optional_policy(`
+	tunable_policy(`rsync_client',`
+		ssh_exec(rsync_t)
+	')
+')
+
+optional_policy(`
+	daemontools_service_domain(rsync_t, rsync_exec_t)
+')
+
+optional_policy(`
+	kerberos_use(rsync_t)
+')
+
+optional_policy(`
+	inetd_service_domain(rsync_t, rsync_exec_t)
+')