[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

["Sven Vermeulen" <sven.vermeulen@siphos.be>]

commit:     a06a7f3cac433c2acb36fd0c3df64770dfaa0c8b
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Fri Oct 26 10:09:46 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Sat Oct 27 11:03:40 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=a06a7f3c

Changes to the samhain policy module

Module clean up
type attribute for samhain domains to write common samhain domain policy
efficiently

Comment out role dependencies for samhain_admin until the call in sysadm
module is modified to support role parameter

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/samhain.fc |    2 +-
 policy/modules/contrib/samhain.if |  154 +++++++++++++------------------------
 policy/modules/contrib/samhain.te |   72 ++++++++++++++----
 3 files changed, 110 insertions(+), 118 deletions(-)

diff --git a/policy/modules/contrib/samhain.fc b/policy/modules/contrib/samhain.fc
index e5c5397..0e17983 100644
--- a/policy/modules/contrib/samhain.fc
+++ b/policy/modules/contrib/samhain.fc
@@ -7,7 +7,7 @@
 
 /var/lib/samhain(/.*)?	gen_context(system_u:object_r:samhain_db_t,mls_systemhigh)
 
-/var/log/samhain_log	--	gen_context(system_u:object_r:samhain_log_t,mls_systemhigh)
+/var/log/samhain_log.*	--	gen_context(system_u:object_r:samhain_log_t,mls_systemhigh)
 /var/log/samhain_log\.lock	--	gen_context(system_u:object_r:samhain_log_t,mls_systemhigh)
 
 /var/run/samhain\.pid	--	gen_context(system_u:object_r:samhain_var_run_t,mls_systemhigh)

diff --git a/policy/modules/contrib/samhain.if b/policy/modules/contrib/samhain.if
index c040ebf..f0236d6 100644
--- a/policy/modules/contrib/samhain.if
+++ b/policy/modules/contrib/samhain.if
@@ -1,94 +1,28 @@
-## <summary>Samhain - check file integrity</summary>
+## <summary>Check file integrity.</summary>
 
 #######################################
 ## <summary>
-##	The template containing the most basic rules
-##	common to the samhain domains.
+##	The template to define a samhain domain.
 ## </summary>
-## <param name="samhaindomain_prefix">
+## <param name="domain_prefix">
 ##	<summary>
-##	The prefix of the samhain domains(e.g., samhain
-##	for the domain of command line access, samhaind
-##	for the domain started by init script).
+##	Domain prefix to be used.
 ##	</summary>
 ## </param>
-## <rolebase/>
 #
 template(`samhain_service_template',`
 	gen_require(`
-		type etc_t, samhain_etc_t, samhain_exec_t;
-		type samhain_log_t, samhain_var_run_t;
+		attribute samhain_domain;
+		type samhain_exec_t;
 	')
 
 	type $1_t;
 	domain_type($1_t)
 	domain_entry_file($1_t, samhain_exec_t)
 
-	allow $1_t self:capability { dac_override dac_read_search fowner ipc_lock };
-	dontaudit $1_t self:capability { sys_resource sys_ptrace };
-	allow $1_t self:fd use;
-	allow $1_t self:process { setsched setrlimit signull };
-
-	allow $1_t samhain_etc_t:file read_file_perms;
-	files_search_etc($1_t)
-
-	manage_files_pattern($1_t, samhain_log_t, samhain_log_t)
-	logging_log_filetrans($1_t, samhain_log_t, file)
-
-	manage_files_pattern($1_t, samhain_var_run_t, samhain_var_run_t)
-	files_pid_filetrans($1_t, samhain_var_run_t, file)
-
-	# Samhain needs to get the attribute of /proc/kcore.
-	kernel_getattr_core_if($1_t)
-
-	corecmd_list_bin($1_t)
-	corecmd_read_bin_symlinks($1_t)
-
-	# To get entropy
-	dev_read_urand($1_t)
-	dev_dontaudit_read_rand($1_t)
-
-	# Get the attributes of all kinds of files in the rootfs.
-	dev_getattr_all_blk_files($1_t)
-	dev_getattr_all_chr_files($1_t)
-	dev_getattr_generic_blk_files($1_t)
-	dev_getattr_generic_chr_files($1_t)
-
-	files_getattr_all_dirs($1_t)
-	files_getattr_all_files($1_t)
-	files_getattr_all_symlinks($1_t)
-	files_getattr_all_pipes($1_t)
-	files_getattr_all_sockets($1_t)
-	files_getattr_all_mountpoints($1_t)
 	files_read_all_files($1_t)
-	files_read_all_symlinks($1_t)
-
-	# Get the attribute of other filesystems mountpoint, such as /selinux
-	# /proc, /sys and /tmp, but not the contents inside, which suggests
-	# that following rules should be set in samhain configuration file:
-	# [Attributes]
-	#    file = /tmp
-	#    file = /proc
-	#    file = /sys
-	#    file = /selinux
-	# [IgnoreALL]
-	#    dir = -1/tmp
-	#    dir = -1/proc
-	#    dir = -1/sys
-	#    dir = -1/selinux
-	fs_getattr_all_dirs($1_t)
 
-	# Samhain pid, log and log.lock files are all in directories of s0,
-	# while samhain daemon is running with the clearance level.
 	mls_file_write_all_levels($1_t)
-
-	# Read from utmp when monitoring login/logout events.
-	auth_read_login_records($1_t)
-
-	# Read from wtmp when monitoring login/logout events.
-	init_read_utmp($1_t)
-
-	logging_send_syslog_msg($1_t)
 ')
 
 ########################################
@@ -112,18 +46,25 @@ interface(`samhain_domtrans',`
 
 ########################################
 ## <summary>
-##	Execute samhain in the samhain domain with the clearance security
-##	level and allow the specifiled role the samhain domain.
+##	Execute samhain in the samhain
+##	domain with the clearance security
+##	level and allow the specifiled role
+##	the samhain domain.
 ## </summary>
 ## <desc>
 ##	<p>
-##	Execute samhain in the samhain domain with the clearance security
-##	level and allow the specifiled role the samhain domain.
+##	Execute samhain in the samhain
+##	domain with the clearance security
+##	level and allow the specifiled role
+##	the samhain domain.
 ##	</p>
 ##	<p>
-##	The range_transition rule used in this interface requires that
-##	the calling domain should have the clearance security level
-##	otherwise the MLS constraint for process transition would fail.
+##	The range_transition rule used in
+##	this interface requires that the
+##	calling domain should have the
+##	clearance security level otherwise
+##	the MLS constraint for process
+##	transition would fail.
 ##	</p>
 ## </desc>
 ## <param name="domain">
@@ -140,11 +81,12 @@ interface(`samhain_domtrans',`
 #
 interface(`samhain_run',`
 	gen_require(`
-		type samhain_t, samhain_exec_t;
+		attribute_role samhain_roles;
+		type samhain_exec_t;
 	')
 
 	samhain_domtrans($1)
-	role $2 types samhain_t;
+	roleattribute $2 samhain_roles;
 
 	ifdef(`enable_mls', `
 		range_transition $1 samhain_exec_t:process mls_systemhigh;
@@ -153,7 +95,8 @@ interface(`samhain_run',`
 
 ########################################
 ## <summary>
-##	Manage samhain configuration files.
+##	Create, read, write, and delete
+##	samhain configuration files.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -172,7 +115,8 @@ interface(`samhain_manage_config_files',`
 
 ########################################
 ## <summary>
-##	Manage samhain database files.
+##	Create, read, write, and delete
+##	samhain database files.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -191,7 +135,8 @@ interface(`samhain_manage_db_files',`
 
 #######################################
 ## <summary>
-##	Manage samhain init script files
+##	Create, read, write, and delete
+##	samhain init script files.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -210,7 +155,8 @@ interface(`samhain_manage_init_script_files',`
 
 ########################################
 ## <summary>
-##	Manage samhain log and log.lock files.
+##	Create, read, write, and delete
+##	samhain log and log.lock files.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -229,7 +175,8 @@ interface(`samhain_manage_log_files',`
 
 ########################################
 ## <summary>
-##	Manage samhain pid files.
+##	Create, read, write, and delete
+##	samhain pid files.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -248,45 +195,48 @@ interface(`samhain_manage_pid_files',`
 
 #######################################
 ## <summary>
-##	All of the rules required to administrate
-##	the samhain environment.
+##	All of the rules required to
+##	administrate the samhain environment.
 ## </summary>
-## <desc>
-##	<p>
-##	This interface assumes that the calling domain has been able to
-##	remove an entry from /var/lib/ or /var/log/ and belongs to the
-##	mlsfilewrite attribute, since samhain files may be of clearance
-##	security level while their parent directories are of s0.
-##	</p>
-## </desc>
 ## <param name="domain">
 ##	<summary>
 ##	Domain allowed access.
 ##	</summary>
 ## </param>
+## <param name="role">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
 #
 interface(`samhain_admin',`
 	gen_require(`
+		attribute samhain_domain;
 		type samhain_t, samhaind_t, samhain_db_t, samhain_etc_t;
 		type samhain_initrc_exec_t, samhain_log_t, samhain_var_run_t;
 	')
 
-	allow $1 samhain_t:process { ptrace signal_perms };
-	ps_process_pattern($1, samhain_t)
+	allow $1 samhain_domain:process { ptrace signal_perms };
+	ps_process_pattern($1, samhain_domain)
 
-	allow $1 samhaind_t:process { ptrace signal_perms };
-	ps_process_pattern($1, samhaind_t)
+	# pending
+	# init_labeled_script_domtrans($1, samhain_initrc_exec_t)
+	# domain_system_change_exemption($1)
+	# role_transition $2 samhain_initrc_exec_t system_r;
+	# allow $2 system_r;
 
 	files_list_var_lib($1)
 	admin_pattern($1, samhain_db_t)
 
 	files_list_etc($1)
-	admin_pattern($1, samhain_etc_t)
-	admin_pattern($1, samhain_initrc_exec_t)
+	admin_pattern($1, { samhain_initrc_exec_t samhain_etc_t })
 
 	logging_list_logs($1)
 	admin_pattern($1, samhain_log_t)
 
 	files_list_pids($1)
 	admin_pattern($1, samhain_var_run_t)
+
+	# samhain_run($1, $2)
 ')

diff --git a/policy/modules/contrib/samhain.te b/policy/modules/contrib/samhain.te
index acd1700..931312b 100644
--- a/policy/modules/contrib/samhain.te
+++ b/policy/modules/contrib/samhain.te
@@ -1,10 +1,15 @@
-policy_module(samhain, 1.1.0)
+policy_module(samhain, 1.1.1)
 
 ########################################
 #
 # Declarations
 #
 
+attribute samhain_domain;
+
+attribute_role samhain_roles;
+roleattribute system_r samhain_roles;
+
 type samhain_etc_t;
 files_config_file(samhain_etc_t)
 
@@ -14,7 +19,6 @@ corecmd_executable_file(samhain_exec_t)
 type samhain_log_t;
 logging_log_file(samhain_log_t)
 
-# Filesystem signature database
 type samhain_db_t;
 files_type(samhain_db_t)
 
@@ -24,28 +28,71 @@ init_script_file(samhain_initrc_exec_t)
 type samhain_var_run_t;
 files_pid_file(samhain_var_run_t)
 
-# Domain for command line access
 samhain_service_template(samhain)
 application_domain(samhain_t, samhain_exec_t)
+role samhain_roles types samhain_t;
 
-# Domain for samhain service started by samhain init script
 samhain_service_template(samhaind)
+init_system_domain(samhaind_t, samhain_exec_t)
 
 ifdef(`enable_mcs',`
-	# This is system instead of daemon to work around
-	# a type transition conflict
 	init_ranged_system_domain(samhaind_t, samhain_exec_t, mcs_systemhigh)
 ')
 
 ifdef(`enable_mls',`
-	# This is system instead of daemon to work around
-	# a type transition conflict
 	init_ranged_system_domain(samhaind_t, samhain_exec_t, mls_systemhigh)
 ')
 
 ########################################
 #
-# Samhain local policy
+# Common samhain domain local policy
+#
+
+allow samhain_domain self:capability { dac_override dac_read_search fowner ipc_lock };
+dontaudit samhain_domain self:capability { sys_resource sys_ptrace };
+allow samhain_domain self:fd use;
+allow samhain_domain self:process { setsched setrlimit signull };
+
+allow samhain_domain samhain_etc_t:file read_file_perms;
+
+manage_files_pattern(samhain_domain, samhain_log_t, samhain_log_t)
+logging_log_filetrans(samhain_domain, samhain_log_t, file)
+
+manage_files_pattern(samhain_domain, samhain_var_run_t, samhain_var_run_t)
+files_pid_filetrans(samhain_domain, samhain_var_run_t, file)
+
+kernel_getattr_core_if(samhain_domain)
+
+corecmd_list_bin(samhain_domain)
+corecmd_read_bin_symlinks(samhain_domain)
+
+dev_read_urand(samhain_domain)
+dev_dontaudit_read_rand(samhain_domain)
+dev_getattr_all_blk_files(samhain_domain)
+dev_getattr_all_chr_files(samhain_domain)
+dev_getattr_generic_blk_files(samhain_domain)
+dev_getattr_generic_chr_files(samhain_domain)
+
+files_getattr_all_dirs(samhain_domain)
+files_getattr_all_files(samhain_domain)
+files_getattr_all_symlinks(samhain_domain)
+files_getattr_all_pipes(samhain_domain)
+files_getattr_all_sockets(samhain_domain)
+files_getattr_all_mountpoints(samhain_domain)
+files_read_all_symlinks(samhain_domain)
+files_search_etc(samhain_domain)
+
+fs_getattr_all_dirs(samhain_domain)
+
+auth_read_login_records(samhain_domain)
+
+init_read_utmp(samhain_domain)
+
+logging_send_syslog_msg(samhain_domain)
+
+########################################
+#
+# Client local policy
 #
 
 manage_files_pattern(samhain_t, samhain_db_t, samhain_db_t)
@@ -59,18 +106,13 @@ userdom_use_user_terminals(samhain_t)
 
 ########################################
 #
-# Samhaind local policy
+# Server local policy
 #
 
-# Need signal_perms to send SIGABRT/SIGKILL to termiate samhain_t
-# Need signull to get the status of samhain_t
 allow samhaind_t { samhain_t self }:process signal_perms;
 
-# Only needed when starting samhain daemon from its init script.
 can_exec(samhaind_t, samhain_exec_t)
 
 read_files_pattern(samhaind_t, samhain_db_t, samhain_db_t)
 
-# init script ptys are the stdin/out/err
-# when using run_init
 init_use_script_ptys(samhaind_t)