Attachment 1483453 Details for Bug 1164245 – Munin patch for rhel 7.5 bind policy

[patch] Munin patch for rhel 7.5 bind policy

policy-contrib-bind.patch (text/plain), 5.65 KB, created by Tuomo Soini on 2018-09-15 07:51:08 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tuomo Soini

Created: 2018-09-15 07:51:08 UTC

Size: 5.65 KB

patch

obsolete

># Unbound must be able to bind to ephemeral ports
>type=AVC audit(1427364736.307:17915): avc:  denied  { name_bind } for  pid=1329 comm="unbound" src=46559 scontext=system_u:system_r:named_t:s0 tcontext=system_u:object_r:ephemeral_port_t:s0 tclass=udp_socket
>
># Unbound requires capability net_raw
>type=AVC msg=audit(1478631343.401:85): avc:  denied  { net_raw } for  pid=1569 comm="unbound" capability=13  scontext=system_u:system_r:named_t:s0 tcontext=system_u:system_r:named_t:s0 tclass=capability
>
># munin unbound_ plugin requires execution of unbound-control
>#  - we add bind_exec interface for that
>type=AVC msg=audit(1432311485.685:7751): avc:  denied  { execute } for  pid=21998 comm="unbound_by_clas" name="unbound-control" dev="vda3" ino=1076047464 scontext=system_u:system_r:services_munin_plugin_t:s0 tcontext=system_u:object_r:named_exec_t:s0 tclass=file
>type=AVC msg=audit(1432311485.685:7751): avc:  denied  { read open } for  pid=21998 comm="unbound_by_clas" path="/usr/sbin/unbound-control" dev="vda3" ino=1076047464 scontext=system_u:system_r:services_munin_plugin_t:s0 tcontext=system_u:object_r:named_exec_t:s0 tclass=file
>type=AVC msg=audit(1432311485.685:7751): avc:  denied  { execute_no_trans } for  pid=21998 comm="unbound_by_clas" path="/usr/sbin/unbound-control" dev="vda3" ino=1076047464 scontext=system_u:system_r:services_munin_plugin_t:s0 tcontext=system_u:object_r:named_exec_t:s0 tclass=file
>
># munin unbound_ plugin requires read permission to unbound pid file
>#  - we ad bind_read_pid_files interface for that
>type=AVC msg=audit(1483990688.647:457738): avc:  denied  { read } for  pid=730 comm="cat" name="unbound.pid" dev="tmpfs" ino=22113299 scontext=system_u:system_r:services_munin_plugin_t:s0 tcontext=system_u:object_r:named_var_run_t:s0 tclass=file
>type=AVC msg=audit(1483990688.647:457738): avc:  denied  { open } for  pid=730 comm="cat" path="/run/unbound/unbound.pid" dev="tmpfs" ino=22113299 scontext=system_u:system_r:services_munin_plugin_t:s0 tcontext=system_u:object_r:named_var_run_t:s0 tclass=file
>type=AVC msg=audit(1483990688.648:457739): avc:  denied  { getattr } for  pid=730 comm="cat" path="/run/unbound/unbound.pid" dev="tmpfs" ino=22113299 scontext=system_u:system_r:services_munin_plugin_t:s0 tcontext=system_u:object_r:named_var_run_t:s0 tclass=file
>
>diff -up serefpolicy-contrib-3.13.1/bind.fc.bind serefpolicy-contrib-3.13.1/bind.fc
>--- serefpolicy-contrib-3.13.1/bind.fc.bind	2018-04-10 11:29:08.662787604 +0300
>+++ serefpolicy-contrib-3.13.1/bind.fc	2018-04-10 11:29:09.439664829 +0300
>@@ -6,6 +6,9 @@
> /etc/rndc\.key 		-- 	gen_context(system_u:object_r:dnssec_t,s0)
> /etc/unbound(/.*)?		gen_context(system_u:object_r:named_conf_t,s0)
> /etc/unbound/.*\.key 	--	gen_context(system_u:object_r:dnssec_t,s0)
>+/etc/unbound/keys.d/.*.key	--	gen_context(system_u:object_r:dnssec_t,s0)
>+/etc/unbound/unbound_control\.key	--	gen_context(system_u:object_r:named_conf_t,s0)
>+/etc/unbound/unbound_server\.key	--	gen_context(system_u:object_r:named_conf_t,s0)
> /etc/dnssec-trigger/dnssec_trigger_server\.key 	--	gen_context(system_u:object_r:dnssec_t,s0)
> 
> /usr/lib/systemd/system/unbound.* --  gen_context(system_u:object_r:named_unit_file_t,s0)
>diff -up serefpolicy-contrib-3.13.1/bind.if.bind serefpolicy-contrib-3.13.1/bind.if
>--- serefpolicy-contrib-3.13.1/bind.if.bind	2018-04-10 11:29:08.662787604 +0300
>+++ serefpolicy-contrib-3.13.1/bind.if	2018-04-10 11:29:09.440664671 +0300
>@@ -162,6 +162,26 @@ interface(`bind_domtrans',`
> 
> ########################################
> ## <summary>
>+##      Allow the specified domain to execute named_exec_t
>+##      in the caller domain.
>+## </summary>
>+## <param name="domain">
>+## <summary>
>+##      Domain allowed to execute.
>+## </summary>
>+## </param>
>+#
>+interface(`bind_exec',`
>+        gen_require(`
>+                type named_exec_t;
>+        ')
>+
>+        corecmd_search_bin($1)
>+        can_exec($1, named_exec_t)
>+')
>+
>+########################################
>+## <summary>
> ##	Read dnssec key files.
> ## </summary>
> ## <param name="domain">
>@@ -298,6 +318,26 @@ interface(`bind_manage_cache',`
> ')
> 
> ########################################
>+## <summary>
>+##	Read bind PID files.
>+## </summary>
>+## <param name="domain">
>+##	<summary>
>+##	Domain allowed access.
>+##	</summary>
>+## </param>
>+#
>+interface(`bind_read_pid_files',`
>+	gen_require(`
>+		type named_var_run_t;
>+	')
>+
>+	files_search_pids($1)
>+	read_files_pattern($1, named_var_run_t, named_var_run_t)
>+	read_lnk_files_pattern($1, named_var_run_t, named_var_run_t)
>+')
>+
>+########################################
> ## <summary>
> ##	Set attributes of bind pid directories.
> ## </summary>
>diff -up serefpolicy-contrib-3.13.1/bind.te.bind serefpolicy-contrib-3.13.1/bind.te
>--- serefpolicy-contrib-3.13.1/bind.te.bind	2018-04-10 11:29:08.663787446 +0300
>+++ serefpolicy-contrib-3.13.1/bind.te	2018-04-10 11:30:52.399393488 +0300
>@@ -74,7 +74,7 @@ role ndc_roles types ndc_t;
> # Local policy
> #
> 
>-allow named_t self:capability { chown dac_read_search dac_override fowner net_admin setgid setuid sys_chroot sys_nice sys_resource };
>+allow named_t self:capability { chown dac_read_search dac_override fowner net_admin net_raw setgid setuid sys_chroot sys_nice sys_resource };
> dontaudit named_t self:capability sys_tty_config;
> allow named_t self:capability2 block_suspend;
> allow named_t self:process { setsched getcap setcap setrlimit signal_perms };
>@@ -125,6 +125,8 @@ corenet_tcp_sendrecv_generic_node(named_
> corenet_udp_sendrecv_generic_node(named_t)
> corenet_tcp_bind_generic_node(named_t)
> corenet_udp_bind_generic_node(named_t)
>+corenet_tcp_bind_all_ephemeral_ports(named_t)
>+corenet_udp_bind_all_ephemeral_ports(named_t)
> 
> corenet_sendrecv_all_server_packets(named_t)
> corenet_tcp_bind_dns_port(named_t)

Actions: View | Diff

Attachments on bug 1164245: 1483452 | 1483453 | 1483454 | 1483455