RE: [gentoo-hardened] daemontools RFC

[Tad]

On Sunday, November 30, 2003 at 3:42 AM, Petre Rodan wrote:
> On Sun, Nov 30, 2003 at 02:26:45AM -0800, Tad wrote:
> > I like the centralized location. If each service directory where
> completely
> > static I'd be happier with /etc/service. But since the supervise
> directory
> > isn't static, I think /var/service is ideal. If a particular service
> > requires a context other than svc_run_t, then a more explicit rule (e.g.
> > /var/service/qmail-smtp/run) will get the job done.
> >
> > I would, however, make a few slight changes to the actual labels used.
> > The supervise directories are not created at install time but
> automatically.
> > The only way to get the files labled properl at runtime (baring code
> > changes) is to use the handy file_type_autp_trans(). So what I would do
> is
> > use svc_dir_t to label the supervise dir and label the files svc_file_t
> and
> > svc_pipe_t (easier to differentiate from svc_fifo_t).
> >
> > The file_type_auto_trans rules would be:
> > file_type_auto_trans(svc_t, svc_dir_t, svc_file_t, file)
> > file_type_auto_trans(svc_t, svc_dir_t, svc_pipe_t, fifo_file)
> >
> > I realize it isn't quite as fine grained as what you are proposing, but
> it
> > ensures proper labeling on first run.
>
> this is a good idea. do you have made actual rules i can check out on the
> test system? these kind of changes will somewhat propagate in ucspi-tcp
> and others.

I have rules that do this, but they are in flux as I am rethinking how I
want to handle ucspi-tcp. Once I have something working I'll post it.

> > BTW, what do you think about treating svc_t similar to initrc_t with its
> own
> > run_svc. The run_svc would exec svc into the proper context. Initrc_t
> has a
> > lot of priviledges and it makes me nervous running svc in that domain.
> > If we put svc in it's own domain, we can create service_domain macros
> that
> > are similar to daemon_domain but relevant to svc and containing only
> > permissions needed for running a service under svc/supervise.
>
> the thing is that in gentoo daemontools are run from /etc/init.d/svscan.
> this is the place where i make the domain_auto_trans to svc_t.
> with the default install, supervise would be spawned directly using
> inittab.

The supervise processes are spawned from svscan not init.

> i dont understand from what domain would you like to trans to svc_t.

there would be two domain_auto_trans rules:

# trans from init_rc to svc_t when svscan is run.
domain_auto_trans(initrc_t, svc_exec_t, svc_t)
# trans to svc_t when sysadm_t runs svc.
Domain_auto_trans(sysadm_t, svc_exec_t, svc_t)

A program similar to run_init is needed when starting services because svc
directly exec's supervise. And supervise needs to be running in the
system_u:system_r:svc_t context and not root:sysadm_r:svc_t.

> i like the idea with new domain macros, but i don't yet have the knowledge
> to do it.

I've already started on this and will use qmail as the first test case.

> the important thing here would be to have a centralized daemon pool, or
> our selinux policies for daemons will be extremely bloated.

I'm not quite sure what you mean here.

> maybe i should have posted this on gentoo-dev ...

Personally, I think this is the right place for this discussion.

-Tad


--
gentoo-hardened@g.o mailing list