commit: b383b3a683a47119d32fee1af95d467f007a0aac Author: Stephen Smalley <sds <AT> tycho <DOT> nsa <DOT> gov> AuthorDate: Wed May 24 19:40:18 2017 +0000 Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org> CommitDate: Thu May 25 16:36:54 2017 +0000 URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=b383b3a6
refpolicy: Define and allow map permission Kernel commit 6941857e82ae ("selinux: add a map permission check for mmap") added a map permission check on mmap so that we can distinguish memory mapped access (since it has different implications for revocation). The purpose of a separate map permission check on mmap(2) is to permit policy to prohibit memory mapping of specific files for which we need to ensure that every access is revalidated, particularly useful for scenarios where we expect the file to be relabeled at runtime in order to reflect state changes (e.g. cross-domain solution, assured pipeline without data copying). The kernel commit is anticipated to be included in Linux 4.13. This refpolicy change defines map permission for refpolicy. It mirrors the definition in the kernel classmap by adding it to the common definitions for files and sockets. This will break compatibility for kernels that predate the dynamic class/perm mapping support (< 2.6.33, < RHEL 6); on such kernels, one would instead need to add map permission to the end of each file and socket access vector. This change only allows map permission as needed, e.g. only in the mmap_file_perms and exec_file_perms object permission sets (since map is always required there) and only in specific interfaces or modules where denials were observed in limited testing. It is important to note that effective use of this permission requires complete removal of unconfined, as otherwise unconfined domains will be able to map all file types and therefore bypass the intended protection. If we wanted to exclude map permission to all file types by default from unconfined, we would need to add it to the list of permissions excluded from files_unconfined_type in kernel/files.te. Policies that depend on this permission not being allowed to specific file types should also make use of neverallow rules to ensure that this is not undermined by any allow rule, and ensure that they are performing neverallow checking at policy build time (e.g. make validate) or runtime (e.g. semanage.conf expand-check=1). Signed-off-by: Stephen Smalley <sds <AT> tycho.nsa.gov> policy/flask/access_vectors | 2 ++ policy/modules/kernel/devices.if | 10 ++++++---- policy/modules/system/libraries.if | 2 +- policy/modules/system/logging.if | 37 ++++++++++++++++++++++++++++++++++++ policy/modules/system/logging.te | 1 + policy/modules/system/miscfiles.if | 2 ++ policy/modules/system/selinuxutil.if | 5 +++++ policy/modules/system/selinuxutil.te | 2 ++ policy/support/obj_perm_sets.spt | 4 ++-- 9 files changed, 58 insertions(+), 7 deletions(-) diff --git a/policy/flask/access_vectors b/policy/flask/access_vectors index f20e5c1e..5d539e95 100644 --- a/policy/flask/access_vectors +++ b/policy/flask/access_vectors @@ -20,6 +20,7 @@ common file relabelfrom relabelto append + map unlink link rename @@ -47,6 +48,7 @@ common socket relabelfrom relabelto append + map # socket-specific bind connect diff --git a/policy/modules/kernel/devices.if b/policy/modules/kernel/devices.if index dceb9ef1..ef7b429b 100644 --- a/policy/modules/kernel/devices.if +++ b/policy/modules/kernel/devices.if @@ -1955,6 +1955,7 @@ interface(`dev_rw_dri',` ') rw_chr_files_pattern($1, device_t, dri_device_t) + allow $1 dri_device_t:chr_file map; ') ######################################## @@ -2741,7 +2742,7 @@ interface(`dev_rx_raw_memory',` ') dev_read_raw_memory($1) - allow $1 memory_device_t:chr_file execute; + allow $1 memory_device_t:chr_file { map execute }; ') ######################################## @@ -2760,7 +2761,7 @@ interface(`dev_wx_raw_memory',` ') dev_write_raw_memory($1) - allow $1 memory_device_t:chr_file execute; + allow $1 memory_device_t:chr_file { map execute }; ') ######################################## @@ -3843,6 +3844,7 @@ interface(`dev_read_sound_mixer',` ') read_chr_files_pattern($1, device_t, sound_device_t) + allow $1 sound_device_t:chr_file map; ') ######################################## @@ -4945,7 +4947,7 @@ interface(`dev_rwx_vmware',` ') dev_rw_vmware($1) - allow $1 vmware_device_t:chr_file execute; + allow $1 vmware_device_t:chr_file { map execute }; ') ######################################## @@ -5168,7 +5170,7 @@ interface(`dev_rwx_zero',` ') dev_rw_zero($1) - allow $1 zero_device_t:chr_file execute; + allow $1 zero_device_t:chr_file { map execute }; ') ######################################## diff --git a/policy/modules/system/libraries.if b/policy/modules/system/libraries.if index 24b7ef66..9e8a0448 100644 --- a/policy/modules/system/libraries.if +++ b/policy/modules/system/libraries.if @@ -86,7 +86,7 @@ interface(`libs_use_ld_so',` read_lnk_files_pattern($1, lib_t, { lib_t ld_so_t }) mmap_files_pattern($1, lib_t, ld_so_t) - allow $1 ld_so_cache_t:file read_file_perms; + allow $1 ld_so_cache_t:file { map read_file_perms }; ') ######################################## diff --git a/policy/modules/system/logging.if b/policy/modules/system/logging.if index 705ed1fb..126d44b6 100644 --- a/policy/modules/system/logging.if +++ b/policy/modules/system/logging.if @@ -1103,6 +1103,25 @@ interface(`logging_read_generic_logs',` ######################################## ## <summary> +## Map generic log files. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +## <rolecap/> +# +interface(`logging_mmap_generic_logs',` + gen_require(` + type var_log_t; + ') + + allow $1 var_log_t:file map; +') + +######################################## +## <summary> ## Write generic log files. ## </summary> ## <param name="domain"> @@ -1368,3 +1387,21 @@ interface(`logging_syslog_managed_log_dir',` logging_log_file($1) logging_log_filetrans(syslogd_t, $1, dir, $2) ') + +####################################### +## <summary> +## Map files in /run/log/journal/ directory. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`logging_mmap_journal',` + gen_require(` + type syslogd_var_run_t; + ') + + allow $1 syslogd_var_run_t:file map; +') diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te index bf427e5a..8086ca97 100644 --- a/policy/modules/system/logging.te +++ b/policy/modules/system/logging.te @@ -400,6 +400,7 @@ init_pid_filetrans(syslogd_t, devlog_t, sock_file, "dev-log") # create/append log files. manage_files_pattern(syslogd_t, var_log_t, var_log_t) +allow syslogd_t var_log_t:file map; rw_fifo_files_pattern(syslogd_t, var_log_t, var_log_t) files_search_spool(syslogd_t) diff --git a/policy/modules/system/miscfiles.if b/policy/modules/system/miscfiles.if index 204390d1..d26a982b 100644 --- a/policy/modules/system/miscfiles.if +++ b/policy/modules/system/miscfiles.if @@ -221,6 +221,7 @@ interface(`miscfiles_read_fonts',` allow $1 fonts_t:dir list_dir_perms; read_files_pattern($1, fonts_t, fonts_t) + allow $1 fonts_t:file map; read_lnk_files_pattern($1, fonts_t, fonts_t) allow $1 fonts_cache_t:dir list_dir_perms; @@ -444,6 +445,7 @@ interface(`miscfiles_read_localization',` allow $1 locale_t:dir list_dir_perms; read_files_pattern($1, locale_t, locale_t) read_lnk_files_pattern($1, locale_t, locale_t) + allow $1 locale_t:file map; ') ######################################## diff --git a/policy/modules/system/selinuxutil.if b/policy/modules/system/selinuxutil.if index a8221f0e..332d5797 100644 --- a/policy/modules/system/selinuxutil.if +++ b/policy/modules/system/selinuxutil.if @@ -860,6 +860,7 @@ interface(`seutil_read_file_contexts',` files_search_etc($1) allow $1 { selinux_config_t default_context_t }:dir search_dir_perms; read_files_pattern($1, file_context_t, file_context_t) + allow $1 file_context_t:file map; ') ######################################## @@ -880,6 +881,7 @@ interface(`seutil_dontaudit_read_file_contexts',` dontaudit $1 { selinux_config_t default_context_t file_context_t }:dir search_dir_perms; dontaudit $1 file_context_t:file read_file_perms; + dontaudit $1 file_context_t:file map; ') ######################################## @@ -900,6 +902,7 @@ interface(`seutil_rw_file_contexts',` files_search_etc($1) allow $1 { selinux_config_t default_context_t }:dir search_dir_perms; rw_files_pattern($1, file_context_t, file_context_t) + allow $1 file_context_t:file map; ') ######################################## @@ -921,6 +924,7 @@ interface(`seutil_manage_file_contexts',` files_search_etc($1) allow $1 { selinux_config_t default_context_t }:dir search_dir_perms; manage_files_pattern($1, file_context_t, file_context_t) + allow $1 file_context_t:file map; ') ######################################## @@ -941,6 +945,7 @@ interface(`seutil_read_bin_policy',` files_search_etc($1) allow $1 selinux_config_t:dir search_dir_perms; read_files_pattern($1, policy_config_t, policy_config_t) + allow $1 policy_config_t:file map; ifdef(`distro_gentoo',` # Allow sesearch to read /etc/selinux/.../policy diff --git a/policy/modules/system/selinuxutil.te b/policy/modules/system/selinuxutil.te index e61d4209..557e935c 100644 --- a/policy/modules/system/selinuxutil.te +++ b/policy/modules/system/selinuxutil.te @@ -170,6 +170,7 @@ allow load_policy_t self:capability dac_override; # only allow read of policy config files read_files_pattern(load_policy_t, { policy_src_t policy_config_t }, policy_config_t) +allow load_policy_t policy_config_t:file map; dev_read_urand(load_policy_t) @@ -572,6 +573,7 @@ allow setfiles_t self:fifo_file rw_file_perms; allow setfiles_t { policy_src_t policy_config_t file_context_t default_context_t }:dir list_dir_perms; allow setfiles_t { policy_src_t policy_config_t file_context_t default_context_t }:file read_file_perms; allow setfiles_t { policy_src_t policy_config_t file_context_t default_context_t }:lnk_file { read_lnk_file_perms ioctl lock }; +allow setfiles_t file_context_t:file map; kernel_read_system_state(setfiles_t) kernel_relabelfrom_unlabeled_dirs(setfiles_t) diff --git a/policy/support/obj_perm_sets.spt b/policy/support/obj_perm_sets.spt index 938a6cd7..16f549c1 100644 --- a/policy/support/obj_perm_sets.spt +++ b/policy/support/obj_perm_sets.spt @@ -155,8 +155,8 @@ define(`getattr_file_perms',`{ getattr }') define(`setattr_file_perms',`{ setattr }') define(`read_inherited_file_perms',`{ getattr read lock ioctl }') define(`read_file_perms',`{ read_inherited_file_perms open }') -define(`mmap_file_perms',`{ getattr open read execute ioctl }') -define(`exec_file_perms',`{ getattr open read execute ioctl execute_no_trans }') +define(`mmap_file_perms',`{ getattr open map read execute ioctl }') +define(`exec_file_perms',`{ getattr open map read execute ioctl execute_no_trans }') define(`append_inherited_file_perms',` { getattr append lock ioctl }') define(`append_file_perms',`{ append_inherited_file_perms open}') define(`write_inherited_file_perms',`{ getattr write append lock ioctl }')