1 |
commit: 9f1063357d52895b54c477bdc498d2a2b21895da |
2 |
Author: Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be> |
3 |
AuthorDate: Fri Nov 28 10:13:54 2014 +0000 |
4 |
Commit: Sven Vermeulen <swift <AT> gentoo <DOT> org> |
5 |
CommitDate: Fri Nov 28 10:13:54 2014 +0000 |
6 |
URL: http://sources.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=9f106335 |
7 |
|
8 |
Fix bug 529204 - Support a dhcpc_script_t domain |
9 |
|
10 |
We introduce an executable domain (dhcpc_script_t) through which the |
11 |
hooks can be executed for the DHCP clients. This domain is separate in |
12 |
order to keep the privileges of the application small, but also because |
13 |
this domain will execute commands that are not in the responsibility of |
14 |
the DHCP client code itself (code-wise) but is provided by |
15 |
administrators. |
16 |
|
17 |
Security-wise, as these are scripts, it is more difficult to guarantee |
18 |
correctness. As such, we want to isolate these privileges into its own |
19 |
domain. |
20 |
|
21 |
The domain will have basic privileges to support the majority of |
22 |
installations, but we also include a sysnet_dhcpc_script_entry() |
23 |
interface so that domain transitions can be easily added without the |
24 |
need for augmenting the privileges of the dhcpc_script_t domain. |
25 |
|
26 |
--- |
27 |
policy/modules/system/sysnetwork.fc | 3 +++ |
28 |
policy/modules/system/sysnetwork.te | 32 ++++++++++++++++++++++++++++++++ |
29 |
2 files changed, 35 insertions(+) |
30 |
|
31 |
diff --git a/policy/modules/system/sysnetwork.fc b/policy/modules/system/sysnetwork.fc |
32 |
index fbb935c..b1c6404 100644 |
33 |
--- a/policy/modules/system/sysnetwork.fc |
34 |
+++ b/policy/modules/system/sysnetwork.fc |
35 |
@@ -80,3 +80,6 @@ ifdef(`distro_debian',` |
36 |
/var/run/network(/.*)? gen_context(system_u:object_r:net_conf_t,s0) |
37 |
') |
38 |
|
39 |
+ifdef(`distro_gentoo',` |
40 |
+/lib/dhcpcd/dhcpcd-run-hooks -- gen_context(system_u:object_r:dhcpc_script_exec_t,s0) |
41 |
+') |
42 |
|
43 |
diff --git a/policy/modules/system/sysnetwork.te b/policy/modules/system/sysnetwork.te |
44 |
index 3576536..fad8fce 100644 |
45 |
--- a/policy/modules/system/sysnetwork.te |
46 |
+++ b/policy/modules/system/sysnetwork.te |
47 |
@@ -422,4 +422,36 @@ ifdef(`distro_gentoo',` |
48 |
optional_policy(` |
49 |
resolvconf_client_domain(dhcpc_t) |
50 |
') |
51 |
+ |
52 |
+ ######################################### |
53 |
+ # |
54 |
+ # dhcpc_script_t |
55 |
+ # |
56 |
+ |
57 |
+ # The purpose of the dhcpc_script_t domain is to handle the post-processing of |
58 |
+ # the dhcpcd ip renewal. dhcpcd (the tool) supports hooks for this, and I would |
59 |
+ # assume others do as well. With the dhcpc_script_t domain we can isolate the |
60 |
+ # privileges of the DHCP client itself from the hooks / flexibility that the developers |
61 |
+ # introduced. |
62 |
+ |
63 |
+ type dhcpc_script_t; |
64 |
+ domain_type(dhcpc_script_t) |
65 |
+ role dhcpc_roles types dhcpc_script_t; |
66 |
+ |
67 |
+ type dhcpc_script_exec_t; |
68 |
+ domain_entry_file(dhcpc_script_t, dhcpc_script_exec_t) |
69 |
+ |
70 |
+ type dhcpc_script_tmp_t; |
71 |
+ files_tmp_file(dhcpc_script_tmp_t) |
72 |
+ |
73 |
+ ######################################## |
74 |
+ # |
75 |
+ # dhcpc script policy |
76 |
+ # |
77 |
+ |
78 |
+ manage_files_pattern(dhcpc_script_t, dhcpc_script_tmp_t, dhcpc_script_tmp_t) |
79 |
+ files_tmp_filetrans(dhcpc_script_t, dhcpc_script_tmp_t, { file dir }) |
80 |
+ |
81 |
+ corecmd_exec_bin(dhcpc_script_t) |
82 |
+ corecmd_exec_shell(dhcpc_script_t) |
83 |
') |