Refpolicy aos vm #2

MykolaSolyanko · 2022-09-10T08:27:42Z

No description provided.

Eabramov84 · 2022-09-12T09:29:33Z

README

+## How to work with SELinux
+### Introduction
+
+To be able to add and change the SELinux policy, you need to clone the repository with refpolicy, and make changes with a separate commit.


Please write instructions in indirect form(withou you)
e.g.
To add and change the SELinux policy, the repository with refpolicy should be cloned and changes are done with a separate commit.

Eabramov84 · 2022-09-12T09:35:46Z

README

+
+Refpolicy contains the following file types:
+1. **te** - the file contains rules describing what the domain can do (labels of the subjects or objects). This file does not say that this process can run another file, it just says that the process labeled A can read the file labeled B.
+2. **fc** - describes the security context (labels) on a file, directory, etc., which will be applied when the policy is install. By default, directories or files inherit the context of their parents, but you can manually set the desired context through this file


but the desired context could be manually set using this file

Eabramov84 · 2022-09-12T09:36:09Z

README

+Refpolicy contains the following file types:
+1. **te** - the file contains rules describing what the domain can do (labels of the subjects or objects). This file does not say that this process can run another file, it just says that the process labeled A can read the file labeled B.
+2. **fc** - describes the security context (labels) on a file, directory, etc., which will be applied when the policy is install. By default, directories or files inherit the context of their parents, but you can manually set the desired context through this file
+3. **if** - the interface file creates the macros that other modules will use to gain access to my resources.


to the resources

Eabramov84 · 2022-09-12T09:40:26Z

README

+- **name** - name of the target
+- can contained **path** -  path to the object (target) the process attempted to access.
+
+Next we need to analyze the received log and find the corresponding **te** file by **scontext**, for example, for **dnsmasq_t** there is a corresponding **dnsmasq.te** file and in this file you need to add a rule that allows **scontext** to access **tcontext**.


The next step is to analyze ... dnsmasq.te file and in this file rule that allows scontext to access tcontext should be added.

al1img · 2022-09-13T09:27:25Z

policy/modules/kernel/files.if

@@ -5834,6 +5834,7 @@ interface(`files_dontaudit_rw_var_files',`
 	dontaudit $1 var_t:file rw_file_perms;
 ')

+


Not relevant change.

al1img · 2022-09-13T09:31:45Z

policy/modules/kernel/files.if

@@ -6047,6 +6048,24 @@ interface(`files_manage_var_lib_dirs',`
 	allow $1 var_lib_t:dir manage_dir_perms;
 ')

+########################################


Would be nice to have it in separate commit:

provide access for /var/run

provide access for efivars
In this case, it would be easier to apply policies for new platform. For example for u-boot devices we should remove efivar access e.g.

Done. Split to several commits

al1img · 2022-09-13T09:38:20Z

README

+
+Each process or resource (file, dir etc.) has a label (type) that describes what can be accessed.
+
+SELinux considers subject-access-object rule set. On a Linux system, subjects are processes, and object is the resource on which an action applies.


Could you use max 120 length line?

al1img · 2022-09-20T09:29:45Z

README

+## How to work with SELinux
+### Introduction
+
+To add and change the SELinux policy, the repository with refpolicy, and make changes with


Looks like something is missing in this sentence.

Remove this sentence

al1img · 2022-09-20T09:30:26Z

README

+Each process or resource (file, dir etc.) has a label (type) that describes what can be accessed.
+
+SELinux considers subject-access-object rule set. On a Linux system, subjects are processes, and object is the resource
+on which an action applies.


al1img · 2022-09-20T09:31:47Z

README

+does not say that this process can run another file, it just says that the process labeled A can read the file
+labeled B.
+2. **fc** - describes the security context (labels) on a file, directory, etc., which will be applied when the policy
+is install. By default, directories or files inherit the context of their parents, but the desired context could


is installed

al1img · 2022-09-20T09:36:11Z

README

+on which an action applies.
+
+Refpolicy contains the following file types:
+1. **te** - the file contains rules describing what the domain can do (labels of the subjects or objects). This file


Add full name for each type: te - (type enforcement)

al1img · 2022-09-20T09:36:38Z

README

+1. **te** - the file contains rules describing what the domain can do (labels of the subjects or objects). This file
+does not say that this process can run another file, it just says that the process labeled A can read the file
+labeled B.
+2. **fc** - describes the security context (labels) on a file, directory, etc., which will be applied when the policy


fc - (file context)

al1img · 2022-09-20T10:08:59Z

README

+command or another command, after that the resource or process's will be labeled with proper context.
+
+**It is important** if need to create a new label, then must be create three files **te, fc, if** with the name
+of the label that with which is created. At the same time, the **te** file in which declare a new label type must not


The te file that declares (or in which the new label is declared) should not be empty whereas fc, if files can be empty,

al1img · 2022-09-20T10:11:16Z

README

+of the label that with which is created. At the same time, the **te** file in which declare a new label type must not
+be empty, the **fc, if** files can be empty.
+
+Sometimes in the logs contains denials security policies, but which may not be very critical, for example, get the


Sometimes, logs may contain denials security policies that are not very critical, for example, getting... or reading

Need to be restructured: for example, ... , for example.

al1img · 2022-09-20T10:11:32Z

README

+
+Sometimes in the logs contains denials security policies, but which may not be very critical, for example, get the
+file attribute or read a file that may not affect the system, for example, when login into the system, being created
+policies to denial write to the system log


al1img · 2022-09-20T10:12:39Z

README

+scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023
+tcontext=system_u:object_r:syslogd_runtime_t:s0 tclass=sock_file permissive=0
+```
+For these denials **not need to add rules** to the refpolicy if it is not necessary.


no need to add rules or rules may not be added

al1img · 2022-09-20T10:13:55Z

README

+For these denials **not need to add rules** to the refpolicy if it is not necessary.
+
+After the corresponding security policy is added, it is necessary to build the refpolicy again through yocto.
+To find interest a custom module with the **pp** extension and install it on the system without reinstalling


Unclear sentence, please rephrase.

Removed this sentence as it is incorrect in our context

Fixes: avc: denied { write } for pid=165 comm="systemd-journal" name="syslog" dev="tmpfs" ino=545 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:syslogd_runtime_t tclass=sock_file permissive=0 Signed-off-by: Yi Zhao <[email protected]>

* Add dac_read_search capability to radiusd_t * Add getcap to radiusd_t process Fixes: avc: denied { dac_read_search } for pid=473 comm="radiusd" capability=2 scontext=system_u:system_r:radiusd_t tcontext=system_u:system_r:radiusd_t tclass=capability permissive=1 avc: denied { getcap } for pid=473 comm="radiusd" scontext=system_u:system_r:radiusd_t tcontext=system_u:system_r:radiusd_t tclass=process permissive=1 Signed-off-by: Yi Zhao <[email protected]>

radius: fixes for freeradius

logging: allow systemd-journal to write syslogd_runtime_t sock_file

Signed-off-by: Dave Sugar <[email protected]>

node=localhost type=AVC msg=audit(1664829990.107:8051): avc: denied { chown } for pid=3709 comm="chgrp" capability=0 scontext=toor_u:sysadm_r:fagenrules_t:s0 tcontext=sysadm_u:sysadm_r:fagenrules_t:s0 tclass=capability permissive=0 Signed-off-by: Dave Sugar <[email protected]>

Signed-off-by: Dave Sugar <[email protected]>

Fapolicyd fixes

chpasswd is installed to /usr/bin in Gentoo. Signed-off-by: Kenton Groombridge <[email protected]>

Signed-off-by: Kenton Groombridge <[email protected]>

The git binary and its subcommands are hardlinks that live in /usr/bin and /usr/libexec/git-core. Add a file context to encompass all these binaries. This also fixes conflicting type specifications. Signed-off-by: Kenton Groombridge <[email protected]>

mount.nfs will attempt to start the rpc-statd.service unit but will fall back to executing start-statd directly. Dontaudit attempts to start the unit and perform a domain transition to start-statd from mount. Signed-off-by: Kenton Groombridge <[email protected]>

Signed-off-by: Mykola Solianko <[email protected]>

MykolaSolyanko requested review from al1img and Eabramov84 September 10, 2022 08:27

MykolaSolyanko self-assigned this Sep 10, 2022

Eabramov84 reviewed Sep 12, 2022

View reviewed changes

MykolaSolyanko force-pushed the refpolicy_aos_vm branch 4 times, most recently from d8ba020 to 182a572 Compare September 13, 2022 08:07

al1img reviewed Sep 13, 2022

View reviewed changes

MykolaSolyanko force-pushed the refpolicy_aos_vm branch 2 times, most recently from b4e28ed to 3c646a1 Compare September 14, 2022 08:17

al1img reviewed Sep 20, 2022

View reviewed changes

yizhao1 added 2 commits September 29, 2022 10:34

MykolaSolyanko force-pushed the refpolicy_aos_vm branch from 3c646a1 to b0b942b Compare September 30, 2022 11:32

pebenito and others added 12 commits October 4, 2022 09:55

Merge pull request SELinuxProject#545 from yizhao1/radius

d7a7ea3

radius: fixes for freeradius

Merge pull request SELinuxProject#548 from yizhao1/systemd-journal

e94bd84

logging: allow systemd-journal to write syslogd_runtime_t sock_file

fix: issue SELinuxProject#550 - compile failed when DIRECT_INITRC=y

cdfa072

Signed-off-by: Dave Sugar <[email protected]>

Add 'DIRECT_INITRC' config to automated tests

847cffd

Signed-off-by: Dave Sugar <[email protected]>

Merge pull request SELinuxProject#551 from dsugar100/fapolicyd_fixes

f8dabbe

Fapolicyd fixes

usermanage: add file context for chpasswd in /usr/bin

4257f87

chpasswd is installed to /usr/bin in Gentoo. Signed-off-by: Kenton Groombridge <[email protected]>

node_exporter: add file context for node_exporter in /usr/bin

1206a74

Signed-off-by: Kenton Groombridge <[email protected]>

usbguard: add file context for usbguard in /usr/bin

56fed5b

Signed-off-by: Kenton Groombridge <[email protected]>

init: add file context for systemd units in dracut modules

9ee16f9

Signed-off-by: Kenton Groombridge <[email protected]>

Add rules for login into system

5711830

Signed-off-by: Mykola Solianko <[email protected]>

MykolaSolyanko force-pushed the refpolicy_aos_vm branch from d7e5ed4 to 5711830 Compare August 15, 2023 12:57

Add rules for provisioning

6f2f1d1

Signed-off-by: Mykola Solianko <[email protected]>

MykolaSolyanko force-pushed the refpolicy_aos_vm branch from 024c902 to 097873b Compare August 16, 2023 13:47

Add rules for services

9b81e58

Signed-off-by: Mykola Solianko <[email protected]>

MykolaSolyanko force-pushed the refpolicy_aos_vm branch from 097873b to 9b81e58 Compare August 16, 2023 14:14

MykolaSolyanko force-pushed the refpolicy_aos_vm branch 21 times, most recently from a7e5fe0 to cdbadaa Compare September 1, 2023 09:31

Implement login policy

a49fd8c

Signed-off-by: Mykola Solianko <[email protected]>

MykolaSolyanko force-pushed the refpolicy_aos_vm branch from cdbadaa to a49fd8c Compare September 1, 2023 11:02

MykolaSolyanko closed this Sep 4, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Refpolicy aos vm #2

Refpolicy aos vm #2

MykolaSolyanko commented Sep 10, 2022

Eabramov84 Sep 12, 2022

MykolaSolyanko Sep 14, 2022

Eabramov84 Sep 12, 2022

MykolaSolyanko Sep 14, 2022

Eabramov84 Sep 12, 2022

MykolaSolyanko Sep 14, 2022

Eabramov84 Sep 12, 2022

MykolaSolyanko Sep 14, 2022

al1img Sep 13, 2022

MykolaSolyanko Sep 14, 2022

al1img Sep 13, 2022

MykolaSolyanko Sep 14, 2022

al1img Sep 13, 2022

MykolaSolyanko Sep 14, 2022

al1img Sep 20, 2022

MykolaSolyanko Sep 30, 2022

al1img Sep 20, 2022

MykolaSolyanko Sep 30, 2022

al1img Sep 20, 2022

MykolaSolyanko Sep 30, 2022

al1img Sep 20, 2022

MykolaSolyanko Sep 30, 2022

al1img Sep 20, 2022

MykolaSolyanko Sep 30, 2022

al1img Sep 20, 2022

MykolaSolyanko Sep 30, 2022

al1img Sep 20, 2022

MykolaSolyanko Sep 30, 2022

al1img Sep 20, 2022

MykolaSolyanko Sep 30, 2022

al1img Sep 20, 2022

MykolaSolyanko Sep 30, 2022

al1img Sep 20, 2022

MykolaSolyanko Sep 30, 2022

		@@ -5834,6 +5834,7 @@ interface(`files_dontaudit_rw_var_files',`
		dontaudit $1 var_t:file rw_file_perms;
		')


		Each process or resource (file, dir etc.) has a label (type) that describes what can be accessed.

		SELinux considers subject-access-object rule set. On a Linux system, subjects are processes, and object is the resource on which an action applies.

Refpolicy aos vm #2

Refpolicy aos vm #2

Conversation

MykolaSolyanko commented Sep 10, 2022

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment