Bug 1710962

+++ This bug was initially created as a clone of Bug #1417671 +++

Description of problem:
We use the a 3rd party software called OpenAFS (http://www.openafs.org) to access home directories in AFS.  There already is policy added for support of using AFS (so everything is correctly labeled), however, I've discovered that the existing AFS policy needs to be updated to allow SELinux confined users to acquire AFS Tokens.

Version-Release number of selected component (if applicable):
selinux-policy-3.13.1-102.el7_3.13.noarch

How reproducible:
Always

Steps to Reproduce:
1. Install openafs software, I build my own repos here:
https://copr.fedorainfracloud.org/coprs/jsbillings/openafs/builds/
Note: this requires a working AFS cell and kerberos realm.
2. Set up a user that is confined and has an AFS account:
semanage login -a -s user_u myuser
3. Try to run 'aklog' as myuser

Actual results:
$ aklog
aklog: can't get afs configuration (afsconf_Open(/etc/openafs))

Expected results:
'aklog' should get AFS tokens from my kerberos tickets.

Additional info:

Here are the Audit logs for when I run aklog (permissive with dontaudit off):

type=AVC msg=audit(1485791285.432:1496): avc:  denied  { open } for  pid=3747 comm="aklog" path="/etc/openafs/ThisCell" dev="dm-0" ino=3408589 scontext=user_u:user_r:user_t:s0 tcontext=system_u:object_r:afs_config_t:s0 tclass=file
type=AVC msg=audit(1485791285.432:1496): avc:  denied  { read } for  pid=3747 comm="aklog" name="ThisCell" dev="dm-0" ino=3408589 scontext=user_u:user_r:user_t:s0 tcontext=system_u:object_r:afs_config_t:s0 tclass=file

type=AVC msg=audit(1485791285.438:1498): avc:  denied  { open } for  pid=3747 comm="aklog" path="/proc/fs/openafs/afs_ioctl" dev="proc" ino=4026532171 scontext=user_u:user_r:user_t:s0 tcontext=system_u:object_r:proc_afs_t:s0 tclass=file
type=AVC msg=audit(1485791285.438:1498): avc:  denied  { read } for  pid=3747 comm="aklog" name="afs_ioctl" dev="proc" ino=4026532171 scontext=user_u:user_r:user_t:s0 tcontext=system_u:object_r:proc_afs_t:s0 tclass=file

I have a working SELinux module that addresses this problem.

$ cat afsusers.te 
policy_module(afsusers,1.0.0)
gen_require(` type staff_t, user_t; ')
gen_require(` type proc_afs_t; ')
read_files_pattern({ staff_t user_t}, proc_afs_t, proc_afs_t)
afs_read_config(staff_t)
afs_read_config(user_t)

Loading the module lets 'aklog' read /etc/openafs/ThisCell as well as /proc/fs/openafs/afs_ioctl.

--- Additional comment from Jonathan Billings on 2017-01-31 21:26:48 UTC ---

I have to amend my custom module, I forgot to allow staff_sudo_t:

Here is the updated module .te:

policy_module(afsusers,1.0.1)
gen_require(` type staff_t, user_t, staff_sudo_t; ')
gen_require(` type proc_afs_t; ')
read_files_pattern({ staff_t user_t}, proc_afs_t, proc_afs_t)
afs_read_config(staff_t)
afs_read_config(staff_sudo_t)
afs_read_config(user_t)

--- Additional comment from Milos Malik on 2018-09-21 10:16:25 UTC ---

Following rules are missing:

:: [ 12:13:18 ] :: [   INFO   ] :: rlSESearchRule: checking rule 'allow staff_sudo_t afs_config_t : dir { getattr open search } [ ]'
:: [ 12:13:18 ] :: [   FAIL   ] ::   check permission 'getattr' is present (Assert: '1' should equal '0')
:: [ 12:13:18 ] :: [   FAIL   ] ::   check permission 'open' is present (Assert: '1' should equal '0')
:: [ 12:13:18 ] :: [   FAIL   ] ::   check permission 'search' is present (Assert: '1' should equal '0')
:: [ 12:13:18 ] :: [   INFO   ] :: rlSESearchRule: checking rule 'allow staff_sudo_t afs_config_t : file { getattr open read } [ ]'
:: [ 12:13:18 ] :: [   FAIL   ] ::   check permission 'getattr' is present (Assert: '1' should equal '0')
:: [ 12:13:18 ] :: [   FAIL   ] ::   check permission 'open' is present (Assert: '1' should equal '0')
:: [ 12:13:18 ] :: [   FAIL   ] ::   check permission 'read' is present (Assert: '1' should equal '0')

# rpm -qa selinux-policy\*
selinux-policy-mls-3.13.1-227.el7.noarch
selinux-policy-3.13.1-227.el7.noarch
selinux-policy-sandbox-3.13.1-227.el7.noarch
selinux-policy-targeted-3.13.1-227.el7.noarch
selinux-policy-devel-3.13.1-227.el7.noarch
selinux-policy-doc-3.13.1-227.el7.noarch
selinux-policy-minimum-3.13.1-227.el7.noarch
#

--- Additional comment from Lukas Vrabec on 2018-09-23 13:09:29 UTC ---

Milos, 

what about staff_t? Could staff_t access afs_config_t ? AFAIK, we should allow it for users domains. 

Thanks,
Lukas.

--- Additional comment from Milos Malik on 2018-09-24 06:58:22 UTC ---

staff_t and user_t can access afs_config_t, but the reporter also mentions staff_sudo_t. See comment#1.

# rpm -qa selinux-policy\*
selinux-policy-3.14.3-4.el8.noarch
selinux-policy-targeted-3.14.3-4.el8.noarch
# sesearch -s staff_sudo_t -t afs_config_t -A
allow domain file_type:blk_file map; [ domain_can_mmap_files ]:True
allow domain file_type:chr_file map; [ domain_can_mmap_files ]:True
allow domain file_type:file map; [ domain_can_mmap_files ]:True
allow domain file_type:lnk_file map; [ domain_can_mmap_files ]:True
allow sudodomain file_type:filesystem getattr;
#