1 |
Hi, |
2 |
|
3 |
On Sun, Mar 25, 2007 at 10:58:05PM +0100, Justin Heesemann wrote: |
4 |
> Petre Rodan wrote: |
5 |
> > Hi, |
6 |
> > |
7 |
> > On Sun, Mar 25, 2007 at 05:17:39PM +0100, Justin Heesemann wrote: |
8 |
> >> since the default role for root is staff_t, who's not allowed (almost) |
9 |
> >> anything.. |
10 |
> >> i wonder how to manage to backup stuff to another server. |
11 |
> > |
12 |
> > |
13 |
> > you only have to make sure that no wrongdoers can execute that special rsync binary of yours or you have a serious security problem. |
14 |
> |
15 |
> ok, this shouldn't be much of a problem. |
16 |
> |
17 |
> thanks for the fast reply! |
18 |
> |
19 |
> i've now written a small module but i have a problem installing it: |
20 |
> |
21 |
> # semodule -v -i backup.pp |
22 |
|
23 |
:) my sample policy was for the older framework. |
24 |
if you're using the new reference policy, you can try to tweak the backup module located here: |
25 |
|
26 |
http://oss.tresys.com/projects/refpolicy/browser/trunk/policy/modules/admin/ |
27 |
|
28 |
> Attempting to install module 'backup.pp': |
29 |
> Ok: return value of 0. |
30 |
> Committing changes: |
31 |
> libsepol.print_missing_requirements: rsync_backup's global requirements were |
32 |
> not met: type/attribute auth |
33 |
> libsemanage.semanage_link_sandbox: Link packages failed |
34 |
> semodule: Failed! |
35 |
> |
36 |
> |
37 |
> |
38 |
> just to make sure: this is my rsync_backup.te: |
39 |
> |
40 |
> module rsync_backup 1.1; |
41 |
> require { |
42 |
> class dir { getattr read search }; |
43 |
> class file { execute getattr read }; |
44 |
> class lnk_file { getattr read }; |
45 |
> class sock_file { getattr }; |
46 |
> class fifo_file { getattr }; |
47 |
> class process { noatsecure siginh rlimitinh transition }; |
48 |
> |
49 |
> type mnt_t; |
50 |
> type portage_fetch_tmp_t; |
51 |
> type proc_t; |
52 |
> type shadow_t; |
53 |
> type staff_t; |
54 |
> type sysfs_t; |
55 |
> |
56 |
> attribute auth_chkpwd; |
57 |
> attribute auth; |
58 |
> attribute domain; |
59 |
> attribute file_type; |
60 |
> attribute privlog; |
61 |
> attribute sysadmfile; |
62 |
> |
63 |
> } |
64 |
> |
65 |
> type backup_t, domain, privlog, auth_chkpwd, auth; |
66 |
> type backup_exec_t, file_type, sysadmfile; |
67 |
> role staff_r types backup_t; |
68 |
> |
69 |
> domain_auto_trans(staff_t, backup_exec_t, backup_t); |
70 |
> |
71 |
> allow backup_t { file_type -shadow_t -portage_fetch_tmp_t -sysfs_t }:file { |
72 |
> getattr read }; |
73 |
> allow backup_t { file_type }:lnk_file { getattr read }; |
74 |
> allow backup_t { file_type }:fifo_file getattr; |
75 |
> allow backup_t { file_type }:sock_file getattr; |
76 |
> allow backup_t { file_type -mnt_t -proc_t -sysfs_t }:dir { getattr read |
77 |
> search }; |
78 |
> |
79 |
> |
80 |
> |
81 |
> |
82 |
> -- |
83 |
> Best Regards, |
84 |
> Justin |
85 |
> -- |
86 |
> gentoo-hardened@g.o mailing list |
87 |
> |
88 |
|
89 |
bye, |
90 |
peter |
91 |
|
92 |
-- |
93 |
petre rodan |
94 |
<kaiowas@g.o> |
95 |
Developer, |
96 |
Hardened Gentoo Linux |