commit: b5319ac6961b49e3f3b83cd390c102cd39bb33fd Author: Krzysztof Nowicki <krissn <AT> op <DOT> pl> AuthorDate: Wed Feb 3 14:59:22 2021 +0000 Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org> CommitDate: Mon Feb 15 19:49:24 2021 +0000 URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=b5319ac6
Allow systemd-tmpfilesd to relabel generic files inside /etc Enable this only with the systemd_tmpfilesd_factory tunable, otherwise silence the messages with a dontaudit rule. Fixes: avc: denied { relabelfrom } for comm="systemd-tmpfile" name="pam.d" dev= ino= scontext=system_u:system_r:systemd_tmpfiles_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=dir Signed-off-by: Krzysztof Nowicki <krissn <AT> op.pl> Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org> policy/modules/kernel/files.if | 38 ++++++++++++++++++++++++++++++++++++++ policy/modules/system/systemd.te | 4 ++++ 2 files changed, 42 insertions(+) diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if index 55fbf783..0687a435 100644 --- a/policy/modules/kernel/files.if +++ b/policy/modules/kernel/files.if @@ -1611,6 +1611,25 @@ interface(`files_relabel_config_dirs',` relabel_dirs_pattern($1, configfile, configfile) ') +######################################### +## <summary> +## Do not audit attempts to relabel configuration directories +## </summary> +## <param name="domain"> +## <summary> +## Domain not to audit. +## </summary> +## </param> +## +# +interface(`files_dontaudit_relabel_config_dirs',` + gen_require(` + attribute configfile; + ') + + dontaudit $1 configfile:dir relabel_dir_perms; +') + ######################################## ## <summary> ## Read config files in /etc. @@ -1669,6 +1688,25 @@ interface(`files_relabel_config_files',` relabel_files_pattern($1, configfile, configfile) ') +####################################### +## <summary> +## Do not audit attempts to relabel configuration files +## </summary> +## <param name="domain"> +## <summary> +## Domain not to audit. +## </summary> +## </param> +## +# +interface(`files_dontaudit_relabel_config_files',` + gen_require(` + attribute configfile; + ') + + dontaudit $1 configfile:file relabel_file_perms; +') + ######################################## ## <summary> ## Mount a filesystem on all mount points. diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te index ed2bce80..08c26078 100644 --- a/policy/modules/system/systemd.te +++ b/policy/modules/system/systemd.te @@ -1394,11 +1394,15 @@ tunable_policy(`systemd_tmpfilesd_factory', ` allow systemd_tmpfiles_t systemd_factory_conf_t:file read_file_perms; files_manage_etc_files(systemd_tmpfiles_t) + files_relabel_config_dirs(systemd_tmpfiles_t) + files_relabel_config_files(systemd_tmpfiles_t) ',` dontaudit systemd_tmpfiles_t systemd_factory_conf_t:dir list_dir_perms; dontaudit systemd_tmpfiles_t systemd_factory_conf_t:file read_file_perms; files_dontaudit_manage_etc_files(systemd_tmpfiles_t) + files_dontaudit_relabel_config_dirs(systemd_tmpfiles_t) + files_dontaudit_relabel_config_files(systemd_tmpfiles_t) ') optional_policy(`