3c556c3386
Allow osbuild_t to no_new_privs (nnp) and nosuid domain transition into setfiles_mac_t and install_t. nnp is a inheritable per-thread flag (PR_SET_NO_NEW_PRIVS, see prctl(2)), whereby a promise is made by execve(2) to not grant any new privileges that could not have been done without the execv call. This is on contrast to what can be done via SELinux rules, i.e. in our case `setfiles_mac_t` and `install_t` can set arbitrary SELinux labels, but `osbuild_t` itself can not; but `osbuild_t` enables the transitioning of `setfiles_mac_t` for the `setfiles` binary via execve(2) from a process with `osbuild_t`. Related, the nosuid mount flag, prevents the suid, sgid bits to be interpreted and thus are in the same spirit as nnp, i.e. no new privs during execve(2). Thus SELinux domain transitions stand in contrast with nnp and nosuid transitions, and have therefore been de-coupled. See also the corresponding kernel patch at [1] for more information. bubblewrap (bwrap) in contrast to `systemd-nspawn` always sets the nnp flag, as well as the nosuid option for all bind-mounts. Since we no use bwrap to contain processes we need to allow the nnp and nosuid transitions from `osbuild_t` to `setfiles_mac_t` and `install_t`. [1] https://patchwork.kernel.org/patch/9841441/
114 lines
2.2 KiB
Text
114 lines
2.2 KiB
Text
|
|
## <summary>policy for osbuild</summary>
|
|
|
|
########################################
|
|
## <summary>
|
|
## Execute osbuild_exec_t in the osbuild domain.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed to transition.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`osbuild_domtrans',`
|
|
gen_require(`
|
|
type osbuild_t, osbuild_exec_t;
|
|
')
|
|
|
|
corecmd_search_bin($1)
|
|
domtrans_pattern($1, osbuild_exec_t, osbuild_t)
|
|
')
|
|
|
|
######################################
|
|
## <summary>
|
|
## Execute osbuild in the caller domain.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`osbuild_exec',`
|
|
gen_require(`
|
|
type osbuild_exec_t;
|
|
')
|
|
|
|
corecmd_search_bin($1)
|
|
can_exec($1, osbuild_exec_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Execute osbuild in the osbuild domain, and
|
|
## allow the specified role the osbuild domain.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed to transition
|
|
## </summary>
|
|
## </param>
|
|
## <param name="role">
|
|
## <summary>
|
|
## The role to be allowed the osbuild domain.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`osbuild_run',`
|
|
gen_require(`
|
|
type osbuild_t;
|
|
attribute_role osbuild_roles;
|
|
')
|
|
|
|
osbuild_domtrans($1)
|
|
roleattribute $2 osbuild_roles;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Role access for osbuild
|
|
## </summary>
|
|
## <param name="role">
|
|
## <summary>
|
|
## Role allowed access
|
|
## </summary>
|
|
## </param>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## User domain for the role
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`osbuild_role',`
|
|
gen_require(`
|
|
type osbuild_t;
|
|
attribute_role osbuild_roles;
|
|
')
|
|
|
|
roleattribute $1 osbuild_roles;
|
|
|
|
osbuild_domtrans($2)
|
|
|
|
ps_process_pattern($2, osbuild_t)
|
|
allow $2 osbuild_t:process { signull signal sigkill };
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## osbuild nnp / nosuid transitions to domain
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain to be allowed to transition into.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`osbuild_nnp_nosuid_trans',`
|
|
gen_require(`
|
|
type osbuild_t;
|
|
class process2 { nnp_transition nosuid_transition };
|
|
')
|
|
|
|
allow osbuild_t $1:process2 {nnp_transition nosuid_transition};
|
|
')
|