commit: d953a2fbae3db9cea8136566782294d6206a717a Author: Russell Coker <russell <AT> coker <DOT> com <DOT> au> AuthorDate: Thu Mar 24 14:34:49 2022 +0000 Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org> CommitDate: Thu Mar 31 02:40:53 2022 +0000 URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=d953a2fb
certbot V3 Same as the last one but with the directory names for the auto trans rules removed. I think it's ready for merging. Signed-off-by: Russell Coker <russell <AT> coker.com.au> Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org> policy/modules/services/apache.if | 36 ++++++++++++++++++++++++++++++++++++ policy/modules/services/certbot.te | 22 +++++++++++++++++++--- 2 files changed, 55 insertions(+), 3 deletions(-) diff --git a/policy/modules/services/apache.if b/policy/modules/services/apache.if index 11a7120e..dd86c618 100644 --- a/policy/modules/services/apache.if +++ b/policy/modules/services/apache.if @@ -236,6 +236,24 @@ interface(`apache_domtrans',` domtrans_pattern($1, httpd_exec_t, httpd_t) ') +######################################## +## <summary> +## Execute httpd +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed to execute it. +## </summary> +## </param> +# +interface(`apache_exec',` + gen_require(` + type httpd_t, httpd_exec_t; + ') + + can_exec($1, httpd_exec_t) +') + ######################################## ## <summary> ## Execute httpd server in the httpd domain. @@ -1430,3 +1448,21 @@ interface(`apache_admin',` apache_run_all_scripts($1, $2) apache_run_helper($1, $2) ') + +######################################## +## <summary> +## rw httpd_runtime_t files +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`apache_rw_runtime_files',` + gen_require(` + type httpd_runtime_t; + ') + + allow $1 httpd_runtime_t:file rw_file_perms; +') diff --git a/policy/modules/services/certbot.te b/policy/modules/services/certbot.te index fc979c5f..ac609795 100644 --- a/policy/modules/services/certbot.te +++ b/policy/modules/services/certbot.te @@ -43,7 +43,7 @@ allow certbot_t self:udp_socket all_udp_socket_perms; allow certbot_t self:tcp_socket all_tcp_socket_perms; allow certbot_t self:netlink_route_socket create_netlink_socket_perms; -files_search_var_lib(certbot_t) +files_var_lib_filetrans(certbot_t, certbot_lib_t, dir) manage_dirs_pattern(certbot_t, certbot_lib_t, certbot_lib_t) manage_files_pattern(certbot_t, certbot_lib_t, certbot_lib_t) @@ -62,7 +62,7 @@ allow certbot_t certbot_tmp_t:file mmap_exec_file_perms; allow certbot_t certbot_tmpfs_t:file mmap_exec_file_perms; allow certbot_t certbot_runtime_t:file mmap_exec_file_perms; -logging_search_logs(certbot_t) +logging_log_filetrans(certbot_t, certbot_log_t, dir) allow certbot_t certbot_log_t:dir manage_dir_perms; allow certbot_t certbot_log_t:file manage_file_perms; @@ -80,11 +80,15 @@ corenet_tcp_connect_dns_port(certbot_t) # bind to http port for standalone mode corenet_tcp_bind_http_port(certbot_t) +dev_read_urand(certbot_t) + domain_use_interactive_fds(certbot_t) files_read_etc_files(certbot_t) files_read_usr_files(certbot_t) +# dontaudit for attempts to write python cache files +libs_dontaudit_write_lib_dirs(certbot_t) libs_exec_ldconfig(certbot_t) # for /usr/lib/gcc/x86_64-linux-gnu/8/collect2 libs_exec_lib_files(certbot_t) @@ -110,5 +114,17 @@ optional_policy(` # for writing to webroot apache_manage_sys_content(certbot_t) - apache_search_config(certbot_t) + apache_append_log(certbot_t) + apache_exec(certbot_t) + apache_exec_modules(certbot_t) + + # for certbot to create nginx config + apache_manage_config(certbot_t) + + apache_rw_runtime_files(certbot_t) + apache_signal(certbot_t) +') + +optional_policy(` + xdg_search_config_dirs(certbot_t) ')