From 6ca77541220ec84ae8d6e67b44214577b927c336 Mon Sep 17 00:00:00 2001 From: Jason Andryuk Date: Thu, 4 Nov 2021 10:50:25 -0400 Subject: [PATCH 1/6] refpolicy: Don't audit xec_t using init_t:fd Boot shows 4 denials of xec_t using init_t fds. The vglass initscript uses xec to query gpu configuration over dbus. xec doesn't need to access the FDs, so quiet them with a dontaudit. Signed-off-by: Jason Andryuk --- .../refpolicy/refpolicy-mcs/policy/modules/apps/xec.te | 3 +++ 1 file changed, 3 insertions(+) diff --git a/recipes-security/refpolicy/refpolicy-mcs/policy/modules/apps/xec.te b/recipes-security/refpolicy/refpolicy-mcs/policy/modules/apps/xec.te index a36c2beee1..0ba785b7d4 100644 --- a/recipes-security/refpolicy/refpolicy-mcs/policy/modules/apps/xec.te +++ b/recipes-security/refpolicy/refpolicy-mcs/policy/modules/apps/xec.te @@ -94,6 +94,9 @@ allow xec_t self:capability { dac_override dac_read_search }; statusreport_write_storage_files(xec_t) statusreport_getattr_storage_files(xec_t) +# The vGlass initscript uses xec to query xenmgr for GPUs +init_dontaudit_use_fds(xec_t) + ####################################### # # xentop local policy From a900398cd5ca2093f3d63dbb52426d048a85c241 Mon Sep 17 00:00:00 2001 From: Jason Andryuk Date: Wed, 30 Aug 2023 14:08:57 -0400 Subject: [PATCH 2/6] refpolicy: Remove udevrc_t The .fc file has the incorrect /etc/init.d/udev path, when it needs to be /etc/rc.d/init.d/udev to label the file properly. It's been ending up as initrc_exec_t and things (mostly) work. Remove the dead code. Signed-off-by: Jason Andryuk --- .../patches/policy.modules.system.udev.diff | 53 ++----------------- .../patches/xc-files-interfaces.patch | 15 +----- 2 files changed, 6 insertions(+), 62 deletions(-) diff --git a/recipes-security/refpolicy/refpolicy-mcs/patches/policy.modules.system.udev.diff b/recipes-security/refpolicy/refpolicy-mcs/patches/policy.modules.system.udev.diff index 31dd5b8e56..08d95a6f7e 100644 --- a/recipes-security/refpolicy/refpolicy-mcs/patches/policy.modules.system.udev.diff +++ b/recipes-security/refpolicy/refpolicy-mcs/patches/policy.modules.system.udev.diff @@ -1,31 +1,8 @@ ndex: refpolicy/policy/modules/system/udev.fc =================================================================== ---- a/policy/modules/system/udev.fc -+++ b/policy/modules/system/udev.fc -@@ -2,6 +2,7 @@ - /dev/\.udevdb -- gen_context(system_u:object_r:udev_tbl_t,s0) - /dev/udev\.tbl -- gen_context(system_u:object_r:udev_tbl_t,s0) - -+/etc/init\.d/udev -- gen_context(system_u:object_r:udevrc_exec_t,s0) - /etc/dev\.d/.+ -- gen_context(system_u:object_r:udev_helper_exec_t,s0) - - /etc/hotplug\.d/default/udev.* -- gen_context(system_u:object_r:udev_helper_exec_t,s0) --- a/policy/modules/system/udev.te +++ b/policy/modules/system/udev.te -@@ -22,6 +22,12 @@ init_system_domain(udevadm_t, udevadm_ex - application_domain(udevadm_t, udevadm_exec_t) - role udevadm_roles types udevadm_t; - -+type udevrc_t; -+type udevrc_exec_t; -+init_script_domain(udevrc_t, udevrc_exec_t) -+udev_domtrans(udevrc_t) -+role system_r types udevrc_t; -+ - type udev_etc_t alias etc_udev_t; - files_config_file(udev_etc_t) - -@@ -66,6 +72,11 @@ allow udev_t self:rawip_socket create_so +@@ -66,6 +66,11 @@ allow udev_t self:rawip_socket create_so # for systemd-udevd to rename interfaces allow udev_t self:netlink_route_socket nlmsg_write; @@ -37,7 +14,7 @@ ndex: refpolicy/policy/modules/system/udev.fc can_exec(udev_t, udev_exec_t) allow udev_t udev_helper_exec_t:dir list_dir_perms; -@@ -111,6 +122,8 @@ kernel_dontaudit_search_unlabeled(udev_t +@@ -111,6 +116,8 @@ kernel_dontaudit_search_unlabeled(udev_t corecmd_exec_all_executables(udev_t) @@ -46,7 +23,7 @@ ndex: refpolicy/policy/modules/system/udev.fc dev_rw_sysfs(udev_t) dev_manage_all_dev_nodes(udev_t) dev_rw_generic_files(udev_t) -@@ -200,6 +213,8 @@ sysnet_etc_filetrans_config(udev_t) +@@ -200,6 +207,8 @@ sysnet_etc_filetrans_config(udev_t) userdom_dontaudit_search_user_home_content(udev_t) @@ -55,7 +32,7 @@ ndex: refpolicy/policy/modules/system/udev.fc ifdef(`distro_debian',` # for https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851933 files_read_default_files(udev_t) -@@ -381,12 +396,52 @@ optional_policy(` +@@ -381,12 +390,30 @@ optional_policy(` xen_manage_log(udev_t) xen_read_image_files(udev_t) fs_manage_xenfs_files(udev_t) @@ -82,28 +59,6 @@ ndex: refpolicy/policy/modules/system/udev.fc +allow udev_t lib_t:dir { watch }; +allow udev_t udev_rules_t:dir { watch }; +allow udev_t udev_runtime_t:dir { watch }; -+ -+######################################## -+# -+# Local policy for udevrc_t -+# -+ -+mount_domtrans(udevrc_t) -+ -+corecmd_exec_bin(udevrc_t) -+corecmd_exec_shell(udevrc_t) -+dev_search_sysfs(udevrc_t) -+files_read_etc_files(udevrc_t) -+initrc_rw_pid_chr_files(udevrc_t) -+kernel_read_system_state(udevrc_t) -+kernel_rw_hotplug_sysctls(udevrc_t) -+init_dontaudit_use_fds(udevrc_t) -+term_use_console(udevrc_t) -+dev_dontaudit_rw_generic_chr_files(udevrc_t) -+fs_search_tmpfs(udevrc_t) -+seutil_domtrans_setfiles(udevrc_t) -+ -+allow udevrc_t self:fifo_file manage_fifo_file_perms; + ######################################## # diff --git a/recipes-security/refpolicy/refpolicy-mcs/patches/xc-files-interfaces.patch b/recipes-security/refpolicy/refpolicy-mcs/patches/xc-files-interfaces.patch index ba17c98caf..29e0356490 100644 --- a/recipes-security/refpolicy/refpolicy-mcs/patches/xc-files-interfaces.patch +++ b/recipes-security/refpolicy/refpolicy-mcs/patches/xc-files-interfaces.patch @@ -58,7 +58,7 @@ +optional_policy(` xen_dontaudit_rw_unix_stream_sockets(NetworkManager_t) xen_dbus_chat(NetworkManager_t) - dev_rw_xen(NetworkManager_t) + xen_rw_xenstore(NetworkManager_t) --- a/policy/modules/apps/qemu.te +++ b/policy/modules/apps/qemu.te @@ -116,6 +116,13 @@ optional_policy(` @@ -307,7 +307,7 @@ --- a/policy/modules/system/udev.te +++ b/policy/modules/system/udev.te -@@ -406,6 +406,13 @@ optional_policy(` +@@ -400,6 +400,13 @@ optional_policy(` ') optional_policy(` @@ -321,14 +321,3 @@ xserver_read_xdm_runtime_files(udev_t) ') -@@ -436,6 +443,10 @@ dev_dontaudit_rw_generic_chr_files(udevr - fs_search_tmpfs(udevrc_t) - seutil_domtrans_setfiles(udevrc_t) - -+optional_policy(` -+ xc_config_dir_search(udevrc_t) -+') -+ - allow udevrc_t self:fifo_file manage_fifo_file_perms; - - ######################################## From 46e5c706c83936f73fa1f46cd3459e3472e58076 Mon Sep 17 00:00:00 2001 From: Jason Andryuk Date: Wed, 30 Aug 2023 14:33:45 -0400 Subject: [PATCH 3/6] refpolicy-mcs: Fix NDVM udev boot selinux denial We see the following denial: avc: denied { read write } for pid=74 comm="udevadm" path="/dev/console" dev="devtmpfs" ino=9 scontext=system_u:system_r:udevadm_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=chr_file permissive=0 udevadm is run during boot. device_t shows that /dev/console has not been labeled yet. The 20200229 refpolicy uprev introduced udevadm_t - previously it ran as udev_t. Add a dontaudit to keep the logs clean. Signed-off-by: Jason Andryuk --- .../refpolicy-mcs/patches/policy.modules.system.udev.diff | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/recipes-security/refpolicy/refpolicy-mcs/patches/policy.modules.system.udev.diff b/recipes-security/refpolicy/refpolicy-mcs/patches/policy.modules.system.udev.diff index 08d95a6f7e..14fc523492 100644 --- a/recipes-security/refpolicy/refpolicy-mcs/patches/policy.modules.system.udev.diff +++ b/recipes-security/refpolicy/refpolicy-mcs/patches/policy.modules.system.udev.diff @@ -63,3 +63,8 @@ ndex: refpolicy/policy/modules/system/udev.fc ######################################## # # udevadm Local policy +@@ -427,3 +454,4 @@ seutil_read_file_contexts(udevadm_t) + + init_dontaudit_use_fds(udevadm_t) + term_dontaudit_use_console(udevadm_t) ++dev_dontaudit_rw_generic_chr_files(udevadm_t) From c83c2da008ac9f8417ee148146cdd7f36459d4a6 Mon Sep 17 00:00:00 2001 From: Jason Andryuk Date: Wed, 30 Aug 2023 15:27:53 -0400 Subject: [PATCH 4/6] refpolicy: Backport udev watch patch Backport the upstream udev watch patch and remove our customization. It labels the files under lib_t, so it doesn't need a watch on lib_t:dir. The patch comes from 2.20220520. Signed-off-by: Jason Andryuk --- ...low-udev_t-to-watch-udev_rules_t-dir.patch | 61 +++++++++++++++++++ .../patches/policy.modules.system.udev.diff | 10 +-- .../refpolicy/refpolicy-mcs_git.bbappend | 1 + 3 files changed, 63 insertions(+), 9 deletions(-) create mode 100644 recipes-security/refpolicy/refpolicy-mcs/patches/0001-udev-allow-udev_t-to-watch-udev_rules_t-dir.patch diff --git a/recipes-security/refpolicy/refpolicy-mcs/patches/0001-udev-allow-udev_t-to-watch-udev_rules_t-dir.patch b/recipes-security/refpolicy/refpolicy-mcs/patches/0001-udev-allow-udev_t-to-watch-udev_rules_t-dir.patch new file mode 100644 index 0000000000..bddf8f4690 --- /dev/null +++ b/recipes-security/refpolicy/refpolicy-mcs/patches/0001-udev-allow-udev_t-to-watch-udev_rules_t-dir.patch @@ -0,0 +1,61 @@ +From 7ae40510fd1b7704ef4e08b0377a71f7522dcef2 Mon Sep 17 00:00:00 2001 +From: Yi Zhao +Date: Sun, 10 Oct 2021 23:21:09 +0800 +Subject: [PATCH] udev: allow udev_t to watch udev_rules_t dir + +Fixes: +avc: denied { watch } for pid=187 comm="udevd" path="/lib/udev/rules.d" +dev="vda" ino=1060 scontext=system_u:system_r:udev_t +tcontext=system_u:object_r:lib_t tclass=dir permissive=0 + +avc: denied { watch } for pid=187 comm="udevd" path="/etc/udev/rules.d" +dev="vda" ino=886 scontext=system_u:system_r:udev_t +tcontext=system_u:object_r:udev_rules_t tclass=dir permissive=0 + +avc: denied { watch } for pid=187 comm="udevd" path="/run/udev/rules.d" +dev="tmpfs" ino=4 scontext=system_u:system_r:udev_t +tcontext=system_u:object_r:udev_runtime_t tclass=dir permissive=0 + +avc: denied { watch } for pid=196 comm="udevadm" path="/run/udev" +dev="tmpfs" ino=2 scontext=system_u:system_r:udev_t +tcontext=system_u:object_r:udev_runtime_t tclass=dir permissive=0 + +Signed-off-by: Yi Zhao +--- + policy/modules/system/udev.fc | 2 ++ + policy/modules/system/udev.te | 2 ++ + 2 files changed, 4 insertions(+) + +--- a/policy/modules/system/udev.fc ++++ b/policy/modules/system/udev.fc +@@ -36,10 +36,12 @@ ifdef(`distro_redhat',` + + /usr/lib/systemd/systemd-udevd -- gen_context(system_u:object_r:udev_exec_t,s0) + /usr/lib/udev/udev-acl -- gen_context(system_u:object_r:udev_exec_t,s0) ++/usr/lib/udev/rules\.d(/.*)? gen_context(system_u:object_r:udev_rules_t,s0) + + /usr/share/virtualbox/VBoxCreateUSBNode\.sh -- gen_context(system_u:object_r:udev_helper_exec_t,s0) + + /run/udev(/.*)? gen_context(system_u:object_r:udev_runtime_t,s0) ++/run/udev/rules\.d(/.*)? gen_context(system_u:object_r:udev_rules_t,s0) + + ifdef(`distro_debian',` + /run/xen-hotplug -d gen_context(system_u:object_r:udev_runtime_t,s0) +--- a/policy/modules/system/udev.te ++++ b/policy/modules/system/udev.te +@@ -78,6 +78,7 @@ can_exec(udev_t, udev_helper_exec_t) + + # read udev config + allow udev_t udev_etc_t:file read_file_perms; ++allow udev_t udev_runtime_t:dir watch; + + allow udev_t udev_tbl_t:file manage_file_perms; + dev_filetrans(udev_t, udev_tbl_t, file) +@@ -85,6 +86,7 @@ dev_filetrans(udev_t, udev_tbl_t, file) + list_dirs_pattern(udev_t, udev_rules_t, udev_rules_t) + manage_files_pattern(udev_t, udev_rules_t, udev_rules_t) + manage_lnk_files_pattern(udev_t, udev_rules_t, udev_rules_t) ++allow udev_t udev_rules_t:dir watch; + + manage_dirs_pattern(udev_t, udev_runtime_t, udev_runtime_t) + manage_files_pattern(udev_t, udev_runtime_t, udev_runtime_t) diff --git a/recipes-security/refpolicy/refpolicy-mcs/patches/policy.modules.system.udev.diff b/recipes-security/refpolicy/refpolicy-mcs/patches/policy.modules.system.udev.diff index 14fc523492..c4b2e0ea0a 100644 --- a/recipes-security/refpolicy/refpolicy-mcs/patches/policy.modules.system.udev.diff +++ b/recipes-security/refpolicy/refpolicy-mcs/patches/policy.modules.system.udev.diff @@ -32,7 +32,7 @@ ndex: refpolicy/policy/modules/system/udev.fc ifdef(`distro_debian',` # for https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851933 files_read_default_files(udev_t) -@@ -381,12 +390,30 @@ optional_policy(` +@@ -381,12 +390,22 @@ optional_policy(` xen_manage_log(udev_t) xen_read_image_files(udev_t) fs_manage_xenfs_files(udev_t) @@ -51,14 +51,6 @@ ndex: refpolicy/policy/modules/system/udev.fc +virt_search_dirs(udev_t) + +vusbd_read_etc_files(udev_t) -+ -+gen_require(` -+ type lib_t; -+') -+ -+allow udev_t lib_t:dir { watch }; -+allow udev_t udev_rules_t:dir { watch }; -+allow udev_t udev_runtime_t:dir { watch }; + ######################################## # diff --git a/recipes-security/refpolicy/refpolicy-mcs_git.bbappend b/recipes-security/refpolicy/refpolicy-mcs_git.bbappend index eca6b8a5ff..e716e66780 100644 --- a/recipes-security/refpolicy/refpolicy-mcs_git.bbappend +++ b/recipes-security/refpolicy/refpolicy-mcs_git.bbappend @@ -91,6 +91,7 @@ SRC_URI += " \ " # Patches. SRC_URI += " \ + file://patches/0001-udev-allow-udev_t-to-watch-udev_rules_t-dir.patch \ file://patches/fc-subs-config-aliases.patch \ file://patches/policy.modules.admin.alsa.diff \ file://patches/policy.modules.admin.brctl.diff \ From e2210d5bc76050e4c3b939adbc896c69beaf9728 Mon Sep 17 00:00:00 2001 From: Jason Andryuk Date: Thu, 31 Aug 2023 13:28:06 -0400 Subject: [PATCH 5/6] distro: Remove refpolicy-mcs preferred version WARNING: preferred version 2.20200229 of refpolicy-mcs not available (for item refpolicy-mcs) WARNING: versions of refpolicy-mcs available: 2.20200229+gitAUTOINC+613708cad6 We only have one now, so just remove the preferred version line. Signed-off-by: Jason Andryuk --- conf/distro/openxt-main.conf | 2 -- 1 file changed, 2 deletions(-) diff --git a/conf/distro/openxt-main.conf b/conf/distro/openxt-main.conf index d6c35f40ab..a65b26ea57 100644 --- a/conf/distro/openxt-main.conf +++ b/conf/distro/openxt-main.conf @@ -62,8 +62,6 @@ PREFERRED_VERSION_network-manager-applet = "1.8.22" PREFERRED_PROVIDER_iasl = "acpica" PREFERRED_PROVIDER_iasl-native = "${PREFERRED_PROVIDER_iasl}-native" -PREFERRED_VERSION_refpolicy-mcs = "2.20200229" - # Select our preferred providers PREFERRED_PROVIDER_sysvinit-inittab = "sysvinit" PREFERRED_PROVIDER_virtual/java-initial = "cacao-initial" From 078bff7aed3ccb5ca78c44f0da301bf8d73c0cc1 Mon Sep 17 00:00:00 2001 From: Jason Andryuk Date: Wed, 30 Aug 2023 15:27:53 -0400 Subject: [PATCH 6/6] linux: Remove SELINUX_CHECKREQPROT_VALUE Having a non-zero value is deprecated and it was removed in Linux 6.4. Testing without it, everything seems to work. Drop it. Signed-off-by: Jason Andryuk --- recipes-kernel/linux/6.1/defconfigs/openxt-installer/defconfig | 1 - recipes-kernel/linux/6.1/defconfigs/xenclient-dom0/defconfig | 1 - recipes-kernel/linux/6.1/defconfigs/xenclient-ndvm/defconfig | 1 - 3 files changed, 3 deletions(-) diff --git a/recipes-kernel/linux/6.1/defconfigs/openxt-installer/defconfig b/recipes-kernel/linux/6.1/defconfigs/openxt-installer/defconfig index 2252c7f6ba..d8fe2868a6 100644 --- a/recipes-kernel/linux/6.1/defconfigs/openxt-installer/defconfig +++ b/recipes-kernel/linux/6.1/defconfigs/openxt-installer/defconfig @@ -448,7 +448,6 @@ CONFIG_SECURITY_NETWORK=y CONFIG_SECURITY_PATH=y CONFIG_SECURITY_SELINUX=y CONFIG_SECURITY_SELINUX_BOOTPARAM=y -CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE=1 CONFIG_CRYPTO_SEQIV=y CONFIG_CRYPTO_ECHAINIV=y CONFIG_CRYPTO_XTS=y diff --git a/recipes-kernel/linux/6.1/defconfigs/xenclient-dom0/defconfig b/recipes-kernel/linux/6.1/defconfigs/xenclient-dom0/defconfig index 7557f5d946..cf9918d831 100644 --- a/recipes-kernel/linux/6.1/defconfigs/xenclient-dom0/defconfig +++ b/recipes-kernel/linux/6.1/defconfigs/xenclient-dom0/defconfig @@ -366,7 +366,6 @@ CONFIG_SECURITY_NETWORK=y CONFIG_SECURITY_PATH=y CONFIG_SECURITY_SELINUX=y CONFIG_SECURITY_SELINUX_BOOTPARAM=y -CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE=1 CONFIG_CRYPTO_CCM=m CONFIG_CRYPTO_ECHAINIV=m CONFIG_CRYPTO_XTS=m diff --git a/recipes-kernel/linux/6.1/defconfigs/xenclient-ndvm/defconfig b/recipes-kernel/linux/6.1/defconfigs/xenclient-ndvm/defconfig index 8014f2e6f5..2d7828af1c 100644 --- a/recipes-kernel/linux/6.1/defconfigs/xenclient-ndvm/defconfig +++ b/recipes-kernel/linux/6.1/defconfigs/xenclient-ndvm/defconfig @@ -201,7 +201,6 @@ CONFIG_SECURITY_NETWORK=y # CONFIG_PAGE_TABLE_ISOLATION is not set CONFIG_SECURITY_SELINUX=y CONFIG_SECURITY_SELINUX_BOOTPARAM=y -CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE=1 CONFIG_CRYPTO_ARC4=y # CONFIG_CRYPTO_HW is not set CONFIG_CRC_T10DIF=y