3c556c3386
Allow osbuild_t to no_new_privs (nnp) and nosuid domain transition into setfiles_mac_t and install_t. nnp is a inheritable per-thread flag (PR_SET_NO_NEW_PRIVS, see prctl(2)), whereby a promise is made by execve(2) to not grant any new privileges that could not have been done without the execv call. This is on contrast to what can be done via SELinux rules, i.e. in our case `setfiles_mac_t` and `install_t` can set arbitrary SELinux labels, but `osbuild_t` itself can not; but `osbuild_t` enables the transitioning of `setfiles_mac_t` for the `setfiles` binary via execve(2) from a process with `osbuild_t`. Related, the nosuid mount flag, prevents the suid, sgid bits to be interpreted and thus are in the same spirit as nnp, i.e. no new privs during execve(2). Thus SELinux domain transitions stand in contrast with nnp and nosuid transitions, and have therefore been de-coupled. See also the corresponding kernel patch at [1] for more information. bubblewrap (bwrap) in contrast to `systemd-nspawn` always sets the nnp flag, as well as the nosuid option for all bind-mounts. Since we no use bwrap to contain processes we need to allow the nnp and nosuid transitions from `osbuild_t` to `setfiles_mac_t` and `install_t`. [1] https://patchwork.kernel.org/patch/9841441/
68 lines
1.4 KiB
Text
68 lines
1.4 KiB
Text
policy_module(osbuild, 1.0.0)
|
|
|
|
########################################
|
|
#
|
|
# Declarations
|
|
#
|
|
|
|
attribute_role osbuild_roles;
|
|
roleattribute system_r osbuild_roles;
|
|
|
|
type osbuild_t;
|
|
type osbuild_exec_t;
|
|
application_domain(osbuild_t, osbuild_exec_t)
|
|
role osbuild_roles types osbuild_t;
|
|
|
|
########################################
|
|
#
|
|
# osbuild local policy
|
|
#
|
|
|
|
allow osbuild_t self:fifo_file manage_fifo_file_perms;
|
|
allow osbuild_t self:unix_stream_socket create_stream_socket_perms;
|
|
|
|
# #####################################
|
|
# Customization
|
|
#
|
|
|
|
# make an osbuild_t unconfined domain
|
|
unconfined_domain(osbuild_t)
|
|
|
|
# execute setfiles in the setfiles_mac domain
|
|
# when in the osbuild_t domain
|
|
seutil_domtrans_setfiles_mac(osbuild_t)
|
|
osbuild_nnp_nosuid_trans(setfiles_mac_t)
|
|
|
|
# Allow sysadm and unconfined to run osbuild
|
|
optional_policy(`
|
|
gen_require(`
|
|
type sysadm_t;
|
|
role sysadm_r;
|
|
')
|
|
|
|
osbuild_run(sysadm_t, sysadm_r)
|
|
')
|
|
|
|
optional_policy(`
|
|
gen_require(`
|
|
type unconfined_t;
|
|
role unconfined_r;
|
|
')
|
|
|
|
osbuild_run(unconfined_t, unconfined_r)
|
|
')
|
|
|
|
optional_policy(`
|
|
gen_require(`
|
|
type unconfined_service_t;
|
|
role system_r;
|
|
')
|
|
|
|
osbuild_run(unconfined_service_t, system_r)
|
|
')
|
|
|
|
# allow transitioning to install_t (for ostree)
|
|
optional_policy(`
|
|
anaconda_domtrans_install(osbuild_t)
|
|
osbuild_nnp_nosuid_trans(install_t)
|
|
')
|