commit: a59bba5a73324e8d769dd47bb44353784a27f416 Author: Chris PeBenito <Christopher.PeBenito <AT> microsoft <DOT> com> AuthorDate: Tue May 28 14:02:31 2019 +0000 Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org> CommitDate: Sat Jul 13 06:43:14 2019 +0000 URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=a59bba5a
apache: Web content rules simplification. Signed-off-by: Chris PeBenito <Christopher.PeBenito <AT> microsoft.com> Signed-off-by: Jason Zaman <jason <AT> perfinion.com> policy/modules/services/apache.fc | 3 ++- policy/modules/services/apache.if | 24 ++---------------------- policy/modules/services/apache.te | 27 +++++++++++++++++++++++++++ 3 files changed, 31 insertions(+), 23 deletions(-) diff --git a/policy/modules/services/apache.fc b/policy/modules/services/apache.fc index f3202453..36bff004 100644 --- a/policy/modules/services/apache.fc +++ b/policy/modules/services/apache.fc @@ -179,7 +179,8 @@ ifdef(`distro_suse',` /var/spool/viewvc(/.*)? gen_context(system_u:object_r:httpd_sys_rw_content_t, s0) /var/www(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) -/var/www(/.*)?/logs(/.*)? gen_context(system_u:object_r:httpd_sys_ra_content_t,s0) +/var/www(/.*)?/logs -d gen_context(system_u:object_r:httpd_sys_ra_content_t,s0) +/var/www(/.*)?/logs/.* gen_context(system_u:object_r:httpd_sys_ra_content_t,s0) /var/www(/.*)?/roundcubemail/logs(/.*)? gen_context(system_u:object_r:httpd_sys_rw_content_t,s0) /var/www(/.*)?/roundcubemail/temp(/.*)? gen_context(system_u:object_r:httpd_sys_rw_content_t,s0) /var/www/[^/]*/cgi-bin(/.*)? gen_context(system_u:object_r:httpd_sys_script_exec_t,s0) diff --git a/policy/modules/services/apache.if b/policy/modules/services/apache.if index 94878d66..2934337b 100644 --- a/policy/modules/services/apache.if +++ b/policy/modules/services/apache.if @@ -15,7 +15,7 @@ template(`apache_content_template',` gen_require(` attribute httpdcontent, httpd_exec_scripts, httpd_script_exec_type; attribute httpd_script_domains, httpd_htaccess_type; - attribute httpd_rw_content, httpd_ra_content; + attribute httpd_ro_content, httpd_rw_content, httpd_ra_content; type httpd_t, httpd_suexec_t; ') @@ -34,7 +34,7 @@ template(`apache_content_template',` ## </desc> gen_tunable(allow_httpd_$1_script_anon_write, false) - type httpd_$1_content_t, httpdcontent; # customizable + type httpd_$1_content_t, httpdcontent, httpd_ro_content; # customizable typealias httpd_$1_content_t alias httpd_$1_script_ro_t; files_type(httpd_$1_content_t) @@ -79,30 +79,10 @@ template(`apache_content_template',` manage_sock_files_pattern(httpd_$1_script_t, httpd_$1_rw_content_t, httpd_$1_rw_content_t) files_tmp_filetrans(httpd_$1_script_t, httpd_$1_rw_content_t, { dir file lnk_file sock_file fifo_file }) - allow { httpd_t httpd_suexec_t } httpd_$1_content_t:dir list_dir_perms; - allow { httpd_t httpd_suexec_t } { httpd_$1_content_t httpd_$1_htaccess_t }:file read_file_perms; - allow { httpd_t httpd_suexec_t } httpd_$1_content_t:lnk_file read_lnk_file_perms; - tunable_policy(`allow_httpd_$1_script_anon_write',` miscfiles_manage_public_files(httpd_$1_script_t) ') - tunable_policy(`httpd_builtin_scripting',` - manage_dirs_pattern(httpd_t, httpd_$1_rw_content_t, httpd_$1_rw_content_t) - manage_files_pattern(httpd_t, httpd_$1_rw_content_t, httpd_$1_rw_content_t) - manage_fifo_files_pattern(httpd_t, httpd_$1_rw_content_t, httpd_$1_rw_content_t) - manage_lnk_files_pattern(httpd_t, httpd_$1_rw_content_t, httpd_$1_rw_content_t) - manage_sock_files_pattern(httpd_t, httpd_$1_rw_content_t, httpd_$1_rw_content_t) - - allow httpd_t httpd_$1_ra_content_t:dir { list_dir_perms add_entry_dir_perms setattr_dir_perms }; - allow httpd_t httpd_$1_ra_content_t:file { append_file_perms read_file_perms create_file_perms setattr_file_perms }; - allow httpd_t httpd_$1_ra_content_t:lnk_file read_lnk_file_perms; - ') - - tunable_policy(`httpd_builtin_scripting && httpd_tmp_exec',` - can_exec(httpd_t, httpd_$1_rw_content_t) - ') - tunable_policy(`httpd_enable_cgi',` allow httpd_$1_script_t httpd_$1_script_exec_t:file entrypoint; domtrans_pattern({ httpd_t httpd_suexec_t httpd_exec_scripts }, httpd_$1_script_exec_t, httpd_$1_script_t) diff --git a/policy/modules/services/apache.te b/policy/modules/services/apache.te index ee95b305..e87a74ac 100644 --- a/policy/modules/services/apache.te +++ b/policy/modules/services/apache.te @@ -258,6 +258,7 @@ attribute httpd_htaccess_type; attribute httpd_exec_scripts; attribute httpd_ra_content; +attribute httpd_ro_content; attribute httpd_rw_content; attribute httpd_script_exec_type; @@ -400,6 +401,12 @@ allow httpd_t httpd_config_t:dir list_dir_perms; read_files_pattern(httpd_t, httpd_config_t, httpd_config_t) read_lnk_files_pattern(httpd_t, httpd_config_t, httpd_config_t) +allow httpd_t httpd_htaccess_type:file read_file_perms; + +allow httpd_t httpd_ro_content:dir list_dir_perms; +allow httpd_t httpd_ro_content:file read_file_perms; +allow httpd_t httpd_ro_content:lnk_file read_lnk_file_perms; + allow httpd_t httpd_keytab_t:file read_file_perms; allow httpd_t httpd_lock_t:dir manage_dir_perms; @@ -597,6 +604,20 @@ tunable_policy(`httpd_builtin_scripting',` allow httpd_t httpdcontent:dir list_dir_perms; allow httpd_t httpdcontent:file read_file_perms; allow httpd_t httpdcontent:lnk_file read_lnk_file_perms; + + allow httpd_t httpd_ra_content:dir { list_dir_perms add_entry_dir_perms setattr_dir_perms }; + allow httpd_t httpd_ra_content:file { append_file_perms read_file_perms create_file_perms setattr_file_perms }; + allow httpd_t httpd_ra_content:lnk_file read_lnk_file_perms; + + manage_dirs_pattern(httpd_t, httpd_rw_content, httpd_rw_content) + manage_files_pattern(httpd_t, httpd_rw_content, httpd_rw_content) + manage_fifo_files_pattern(httpd_t, httpd_rw_content, httpd_rw_content) + manage_lnk_files_pattern(httpd_t, httpd_rw_content, httpd_rw_content) + manage_sock_files_pattern(httpd_t, httpd_rw_content, httpd_rw_content) +') + +tunable_policy(`httpd_builtin_scripting && httpd_tmp_exec',` + can_exec(httpd_t, httpd_rw_content) ') tunable_policy(`httpd_enable_cgi',` @@ -945,6 +966,12 @@ allow httpd_suexec_t self:fifo_file rw_fifo_file_perms; allow httpd_suexec_t self:tcp_socket { accept listen }; allow httpd_suexec_t self:unix_stream_socket { accept listen }; +allow httpd_suexec_t httpd_htaccess_type:file read_file_perms; + +allow httpd_suexec_t httpd_ro_content:dir list_dir_perms; +allow httpd_suexec_t httpd_ro_content:file read_file_perms; +allow httpd_suexec_t httpd_ro_content:lnk_file read_lnk_file_perms; + create_files_pattern(httpd_suexec_t, httpd_log_t, httpd_log_t) append_files_pattern(httpd_suexec_t, httpd_log_t, httpd_log_t) read_files_pattern(httpd_suexec_t, httpd_log_t, httpd_log_t)