>From 7bdcc2095e397ae805b18549bc9ce796dfcd221f Mon Sep 17 00:00:00 2001
From: Nathan Kinder <nkinder@xxxxxxxxxx>
Date: Tue, 8 Sep 2009 10:13:34 -0700
Subject: [PATCH] Add selinux policy for ns-slapd
This adds a "dirsrv" selinux policy module to confine the ns-slapd
daemon. The setup and migration perl modules were changed to take
care of any relabeling of installed files if selinux support was
compiled in.
The build system now takes a "--with-selinux" option that will
compile the dirsrv policy module and enable any selinux specific
setup code.
To use the dirsrv policy module, the module will need to be loaded
using the semodule utility. It is also necessary to relabel the
installed files using restorecon after performing a make install.
All of this will be taken care of in the spec file when in the
case of using a RPM package.
---
Makefile.am | 23 ++++++
configure.ac | 2 +
ldap/admin/src/scripts/DSCreate.pm.in | 62 +++++++++++++++
ldap/admin/src/scripts/DSMigration.pm.in | 3 +
ldap/admin/src/scripts/Util.pm.in | 49 +++++++++++-
ldap/admin/src/scripts/setup-ds.res.in | 1 +
m4/selinux.m4 | 34 ++++++++
selinux/Makefile | 17 ++++
selinux/dirsrv.fc.in | 22 +++++
selinux/dirsrv.if | 23 ++++++
selinux/dirsrv.te | 127 ++++++++++++++++++++++++++++++
11 files changed, 359 insertions(+), 4 deletions(-)
create mode 100644 m4/selinux.m4
create mode 100644 selinux/Makefile
create mode 100644 selinux/dirsrv.fc.in
create mode 100644 selinux/dirsrv.if
create mode 100644 selinux/dirsrv.te
diff --git a/Makefile.am b/Makefile.am
index ac7ab27..665b1f4 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -94,9 +94,23 @@ CLEANFILES = dberrstrs.h ns-slapd.properties \
ldap/ldif/template-orgunit.ldif ldap/ldif/template-pampta.ldif ldap/ldif/template-sasl.ldif \
ldap/ldif/template-state.ldif ldap/ldif/template-suffix-db.ldif
+clean-local:
+ -rm -rf selinux-built
+
dberrstrs.h: Makefile
perl $(srcdir)/ldap/servers/slapd/mkDBErrStrs.pl -i @db_incdir@ -o .
+selinux-built:
+ cp -r $(srcdir)/selinux $@
+
+selinux-built/dirsrv.fc: selinux-built
+ $(fixupcmd) selinux-built/dirsrv.fc.in > $@
+
+selinux-built/dirsrv.pp: selinux-built/dirsrv.fc
+ cd selinux-built && $(MAKE)
+
+
+
#------------------------
# Install Paths
#------------------------
@@ -113,6 +127,7 @@ instconfigdir = @instconfigdir@
perldir = $(libdir)@perldir@
infdir = $(datadir)@infdir@
mibdir = $(datadir)@mibdir@
+policydir = $(datadir)/selinux/targeted
defaultuser=@defaultuser@
defaultgroup=@defaultgroup@
@@ -150,6 +165,10 @@ else
enable_presence = off
endif
+if SELINUX
+POLICY_MODULE = selinux-built/dirsrv.pp
+endif
+
serverplugin_LTLIBRARIES = libacl-plugin.la libattr-unique-plugin.la \
libback-ldbm.la libchainingdb-plugin.la libcollation-plugin.la \
libcos-plugin.la libderef-plugin.la libdes-plugin.la libdistrib-plugin.la \
@@ -170,6 +189,8 @@ noinst_LIBRARIES = libavl.a libldaputil.a
#------------------------
# Installed Files
#------------------------
+policy_DATA = $(POLICY_MODULE)
+
config_DATA = $(srcdir)/lib/ldaputil/certmap.conf \
$(srcdir)/ldap/schema/slapd-collations.conf \
ldap/admin/src/template-initconfig
@@ -1226,6 +1247,7 @@ fixupcmd = sed \
-e 's,@defaultuser\@,$(defaultuser),g' \
-e 's,@defaultgroup\@,$(defaultgroup),g' \
-e 's,@with_fhs_opt\@,@with_fhs_opt@,g' \
+ -e 's,@with_selinux\@,@with_selinux@,g' \
-e 's,@perlexec\@,@perlexec@,g' \
-e 's,@initconfigdir\@,$(initconfigdir),g'
else
@@ -1277,6 +1299,7 @@ fixupcmd = sed \
-e 's,@defaultuser\@,$(defaultuser),g' \
-e 's,@defaultgroup\@,$(defaultgroup),g' \
-e 's,@with_fhs_opt\@,@with_fhs_opt@,g' \
+ -e 's,@with_selinux\@,@with_selinux@,g' \
-e 's,@perlexec\@,@perlexec@,g' \
-e 's,@initconfigdir\@,$(initconfigdir),g'
endif
diff --git a/configure.ac b/configure.ac
index fa54060..b886643 100644
--- a/configure.ac
+++ b/configure.ac
@@ -439,6 +439,7 @@ m4_include(m4/icu.m4)
m4_include(m4/netsnmp.m4)
m4_include(m4/kerberos.m4)
m4_include(m4/pcre.m4)
+m4_include(m4/selinux.m4)
PACKAGE_BASE_VERSION=`echo $PACKAGE_VERSION | awk -F\. '{print $1"."$2}'`
AC_SUBST(PACKAGE_BASE_VERSION)
@@ -450,6 +451,7 @@ else
sasl_path="$sasl_libdir/sasl2"
fi
+AM_CONDITIONAL(SELINUX,test "$with_selinux" = "yes")
AM_CONDITIONAL(OPENLDAP,test "$with_openldap" = "yes")
# write out paths for binary components
diff --git a/ldap/admin/src/scripts/DSCreate.pm.in b/ldap/admin/src/scripts/DSCreate.pm.in
index d33f13a..15302b9 100644
--- a/ldap/admin/src/scripts/DSCreate.pm.in
+++ b/ldap/admin/src/scripts/DSCreate.pm.in
@@ -888,6 +888,41 @@ sub setDefaults {
return ();
}
+sub updateSelinuxPolicy {
+ my $inf = shift;
+
+ # if selinux is not available, do nothing
+ if ("@with_selinux@") {
+ # run restorecon on all directories we created
+ for (qw(inst_dir config_dir schema_dir log_dir lock_dir run_dir tmp_dir
+ cert_dir db_dir ldif_dir bak_dir)) {
+ my $dir = $inf->{slapd}->{$_};
+ system("restorecon -R $dir");
+ }
+
+ # label the selected port as ldap_port_t
+ if ($inf->{slapd}->{ServerPort} != 0) {
+ my $need_label = 1;
+
+ # check if the port is already labeled properly
+ my $portline = `semanage port -l | grep ldap_port_t | grep tcp`;
+ chomp($portline);
+ $portline =~ s/ldap_port_t\s+tcp\s+//g;
+ my @labeledports = split(/,\s+/, $portline);
+ foreach my $labeledport (@labeledports) {
+ if ($inf->{slapd}->{ServerPort} == $labeledport) {
+ $need_label = 0;
+ last;
+ }
+ }
+
+ if ($need_label == 1) {
+ system("semanage port -a -t ldap_port_t -p tcp $inf->{slapd}->{ServerPort}");
+ }
+ }
+ }
+}
+
sub createDSInstance {
my $inf = shift;
my @errs;
@@ -924,6 +959,8 @@ sub createDSInstance {
return @errs;
}
+ updateSelinuxPolicy($inf);
+
if (@errs = startServer($inf)) {
return @errs;
}
@@ -1048,6 +1085,31 @@ sub removeDSInstance {
# Finally, config dir
push @errs, remove_tree($entry, "nsslapd-schemadir", $instname, 1, "\.db\$");
+ # remove the selinux label from the ports if needed
+ if ("@with_selinux@") {
+ foreach my $port (@{$entry->{"nsslapd-port"}})
+ {
+ my $semanage_err = `semanage port -d -t ldap_port_t -p tcp $port 2>&1`;
+ if ($? != 0) {
+ if ($semanage_err !~ /defined in policy, cannot be deleted/) {
+ push @errs, [ 'error_removing_port_label', $port, $semanage_err];
+ debug(1, "Warning: Port $port not removed from selinux policy correctly. Error: $semanage_err\n");
+ }
+ }
+ }
+
+ foreach my $secureport (@{$entry->{"nsslapd-secureport"}})
+ {
+ my $semanage_err = `semanage port -d -t ldap_port_t -p tcp $secureport 2>&1`;
+ if ($? != 0) {
+ if ($semanage_err !~ /defined in policy, cannot be deleted/) {
+ push @errs, [ 'error_removing_port_label', $secureport, $semanage_err];
+ debug(1, "Warning: Port $secureport not removed from selinux policy correctly. Error: $semanage_err\n");
+ }
+ }
+ }
+ }
+
# if we got here, report success
if (@errs) {
debug(1, "Could not successfully remove $instname\n");
diff --git a/ldap/admin/src/scripts/DSMigration.pm.in b/ldap/admin/src/scripts/DSMigration.pm.in
index 69e1288..c661d2c 100644
--- a/ldap/admin/src/scripts/DSMigration.pm.in
+++ b/ldap/admin/src/scripts/DSMigration.pm.in
@@ -1141,6 +1141,9 @@ sub migrateDS {
return 0;
}
+ # ensure any selinux relabeling gets done if needed
+ DSCreate::updateSelinuxPolicy($inf);
+
# finally, start the server
if ($mig->{start_servers}) {
$inf->{slapd}->{start_server} = 1;
diff --git a/ldap/admin/src/scripts/Util.pm.in b/ldap/admin/src/scripts/Util.pm.in
index e90f3c1..6d54648 100644
--- a/ldap/admin/src/scripts/Util.pm.in
+++ b/ldap/admin/src/scripts/Util.pm.in
@@ -917,11 +917,52 @@ sub remove_tree
sub remove_pidfile
{
my ($type, $instdir, $instname) = @_;
+ my $serv_id;
+ my $run_dir;
+ my $product_name;
+ my $pidfile;
+
+ # Get the serv_id from the start-slapd script.
+ unless(open(INFILE,"$instdir/start-slapd")) {
+ print("Cannot open start-slapd file for reading "); return 0;
+ }
+ while(<INFILE>) {
+ if (/start-dirsrv /g) {
+ my @servline=split(/start-dirsrv /, );
+ @servline=split(/\s+/, $servline[1]);
+ $serv_id=$servline[0];
+ }
+ }
+ close(INFILE);
+
+ # Get the run_dir and product_name from the instance initconfig script.
+ unless(open(INFILE,"@initconfigdir@/@package_name@-$serv_id")) {
+ print("Couldn't open @initconfigdir@/@package_name@-$serv_id "); return 0;
+ }
+ while(<INFILE>) {
+ if (/RUN_DIR=/g) {
+ my @rundir_line=split(/RUN_DIR=+/, );
+ @rundir_line=split(/;/, $rundir_line[1]);
+ $run_dir = $rundir_line[0];
+ chop($run_dir);
+ } elsif (/PRODUCT_NAME=/g) {
+ my @product_line=split(/PRODUCT_NAME=+/, );
+ @product_line=split(/;/, $product_line[1]);
+ $product_name = $product_line[0];
+ chop($product_name);
+ }
+ }
+ close(INFILE);
+
+ # Construct the pidfile name as follows:
+ # PIDFILE=$RUN_DIR/$PRODUCT_NAME-$SERV_ID.pid
+ # STARTPIDFILE=$RUN_DIR/$PRODUCT_NAME-$SERV_ID.startpid
+ if ($type eq "PIDFILE") {
+ $pidfile = $run_dir . "/" . $product_name . "-" . $serv_id . ".pid";
+ } elsif ($type eq "STARTPIDFILE") {
+ $pidfile = $run_dir . "/" . $product_name . "-" . $serv_id . ".startpid";
+ }
- my $pattern = "^" . $type . ".*=";
- my $pidline = `grep $pattern $instdir/start-slapd`;
- chomp($pidline);
- my ($key, $pidfile) = split(/=/, $pidline);
if ( -e $pidfile && $pidfile =~ /$instname/ )
{
unlink($pidfile);
diff --git a/ldap/admin/src/scripts/setup-ds.res.in b/ldap/admin/src/scripts/setup-ds.res.in
index 6502951..5326963 100644
--- a/ldap/admin/src/scripts/setup-ds.res.in
+++ b/ldap/admin/src/scripts/setup-ds.res.in
@@ -135,3 +135,4 @@ error_creating_templdif = Could not create temporary LDIF file. Error: %s\n
error_no_such_instance = Error: could not find directory server configuration directory '%s'. Error: %s\n
error_finding_config_entry = Error: could not find the config entry '%s' in '%s'. Error: %s\n
error_removing_path = Error: could not remove path '%s'. Error: %s\n
+error_removing_port_label = Error: could not remove selinux label from port '%s'. Error: %s\n
diff --git a/m4/selinux.m4 b/m4/selinux.m4
new file mode 100644
index 0000000..de97c94
--- /dev/null
+++ b/m4/selinux.m4
@@ -0,0 +1,34 @@
+# BEGIN COPYRIGHT BLOCK
+# Copyright (C) 2009 Red Hat, Inc.
+# All rights reserved.
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+#
+# END COPYRIGHT BLOCK
+
+AC_CHECKING(for SELinux)
+
+# check for --with-selinux
+AC_MSG_CHECKING(for --with-selinux)
+AC_ARG_WITH(selinux, [ --with-selinux Build SELinux policy],
+[
+ with_selinux=yes
+ AC_MSG_RESULT(yes)
+ AC_SUBST(with_selinux)
+ if test ! -f "/usr/share/selinux/devel/Makefile"; then
+ AC_MSG_ERROR([SELinux development tools (selinux-policy) not found])
+ fi
+],
+AC_MSG_RESULT(no))
diff --git a/selinux/Makefile b/selinux/Makefile
new file mode 100644
index 0000000..bc8e6a7
--- /dev/null
+++ b/selinux/Makefile
@@ -0,0 +1,17 @@
+POLICY_MAKEFILE = /usr/share/selinux/devel/Makefile
+POLICY_DIR = $(DESTDIR)/usr/share/selinux/targeted
+
+all:
+ if [ ! -e $(POLICY_MAKEFILE) ]; then echo "You need to install the SELinux policy development tools (selinux-policy)" && exit 1; fi
+
+ $(MAKE) -f $(POLICY_MAKEFILE) $@ || exit 1;
+
+clean:
+ $(MAKE) -f $(POLICY_MAKEFILE) $@ || exit 1;
+
+install: all
+ install -d $(POLICY_DIR)
+ install -m 644 dirsrv.pp $(POLICY_DIR)
+
+load:
+ /usr/sbin/semodule -i dirsrv.pp
diff --git a/selinux/dirsrv.fc.in b/selinux/dirsrv.fc.in
new file mode 100644
index 0000000..ae768b1
--- /dev/null
+++ b/selinux/dirsrv.fc.in
@@ -0,0 +1,22 @@
+# dirsrv executable will have:
+# label: system_u:object_r:dirsrv_exec_t
+# MLS sensitivity: s0
+# MCS categories: <none>
+
+@sbindir@/ns-slapd -- gen_context(system_u:object_r:dirsrv_exec_t,s0)
+@sbindir@/start-dirsrv -- gen_context(system_u:object_r:initrc_exec_t,s0)
+@sbindir@/restart-dirsrv -- gen_context(system_u:object_r:initrc_exec_t,s0)
+@serverdir@ gen_context(system_u:object_r:dirsrv_lib_t,s0)
+@serverdir@(/.*) gen_context(system_u:object_r:dirsrv_lib_t,s0)
+@localstatedir@/run/@package_name@ gen_context(system_u:object_r:dirsrv_var_run_t,s0)
+@localstatedir@/run/@package_name@(/.*) gen_context(system_u:object_r:dirsrv_var_run_t,s0)
+@localstatedir@/log/@package_name@ gen_context(system_u:object_r:dirsrv_var_log_t,s0)
+@localstatedir@/log/@package_name@(/.*) gen_context(system_u:object_r:dirsrv_var_log_t,s0)
+@localstatedir@/lock/@package_name@ gen_context(system_u:object_r:dirsrv_var_lock_t,s0)
+@localstatedir@/lock/@package_name@(/.*) gen_context(system_u:object_r:dirsrv_var_lock_t,s0)
+@localstatedir@/lib/@package_name@ gen_context(system_u:object_r:dirsrv_var_lib_t,s0)
+@localstatedir@/lib/@package_name@(/.*) gen_context(system_u:object_r:dirsrv_var_lib_t,s0)
+@sysconfdir@/@package_name@ gen_context(system_u:object_r:dirsrv_config_t,s0)
+@sysconfdir@/@package_name@(/.*) gen_context(system_u:object_r:dirsrv_config_t,s0)
+@datadir@/@package_name@ gen_context(system_u:object_r:dirsrv_share_t,s0)
+@datadir@/@package_name@(/.*) gen_context(system_u:object_r:dirsrv_share_t,s0)
diff --git a/selinux/dirsrv.if b/selinux/dirsrv.if
new file mode 100644
index 0000000..d3851ba
--- /dev/null
+++ b/selinux/dirsrv.if
@@ -0,0 +1,23 @@
+## <summary>policy for dirsrv</summary>
+
+########################################
+## <summary>
+## Execute a domain transition to run dirsrv.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`dirsrv_domtrans',`
+ gen_require(`
+ type dirsrv_t, dirsrv_exec_t;
+ ')
+
+ domain_auto_trans($1,dirsrv_exec_t,dirsrv_t)
+
+ allow dirsrv_t $1:fd use;
+ allow dirsrv_t $1:fifo_file rw_file_perms;
+ allow dirsrv_t $1:process sigchld;
+')
diff --git a/selinux/dirsrv.te b/selinux/dirsrv.te
new file mode 100644
index 0000000..ea10355
--- /dev/null
+++ b/selinux/dirsrv.te
@@ -0,0 +1,127 @@
+policy_module(dirsrv,1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+# main daemon
+type dirsrv_t;
+type dirsrv_exec_t;
+domain_type(dirsrv_t)
+init_daemon_domain(dirsrv_t, dirsrv_exec_t)
+
+# dynamic libraries
+type dirsrv_lib_t;
+files_type(dirsrv_lib_t)
+
+# var/lib files
+type dirsrv_var_lib_t;
+files_type(dirsrv_var_lib_t)
+
+# log files
+type dirsrv_var_log_t;
+logging_log_file(dirsrv_var_log_t)
+
+# pid files
+type dirsrv_var_run_t;
+files_pid_file(dirsrv_var_run_t)
+
+# lock files
+type dirsrv_var_lock_t;
+files_lock_file(dirsrv_var_lock_t)
+
+# config files
+type dirsrv_config_t;
+files_type(dirsrv_config_t)
+
+# tmp files
+type dirsrv_tmp_t;
+files_tmp_file(dirsrv_tmp_t)
+
+# semaphores
+type dirsrv_tmpfs_t;
+files_tmpfs_file(dirsrv_tmpfs_t)
+
+# shared files
+type dirsrv_share_t;
+files_type(dirsrv_share_t);
+
+########################################
+#
+# dirsrv local policy
+#
+
+# Some common macros
+files_read_etc_files(dirsrv_t)
+corecmd_search_sbin(dirsrv_t)
+files_read_usr_symlinks(dirsrv_t)
+miscfiles_read_localization(dirsrv_t)
+dev_read_urand(dirsrv_t)
+libs_use_ld_so(dirsrv_t)
+libs_use_shared_libs(dirsrv_t)
+allow dirsrv_t self:fifo_file { read write };
+
+# process stuff
+allow dirsrv_t self:process { getsched setsched signal_perms};
+allow dirsrv_t self:capability { sys_nice setuid setgid chown dac_override };
+
+# semaphores
+allow dirsrv_t self:sem all_sem_perms;
+manage_files_pattern(dirsrv_t, dirsrv_tmpfs_t, dirsrv_tmpfs_t)
+fs_tmpfs_filetrans(dirsrv_t, dirsrv_tmpfs_t, file)
+
+# dynamic libraries
+allow dirsrv_t dirsrv_lib_t:file exec_file_perms;
+allow dirsrv_t dirsrv_lib_t:lnk_file read_lnk_file_perms;
+allow dirsrv_t dirsrv_lib_t:dir search_dir_perms;
+
+# var/lib files for dirsrv
+manage_files_pattern(dirsrv_t, dirsrv_var_lib_t, dirsrv_var_lib_t)
+manage_dirs_pattern(dirsrv_t, dirsrv_var_lib_t, dirsrv_var_lib_t)
+files_var_lib_filetrans(dirsrv_t,dirsrv_var_lib_t, { file dir sock_file })
+
+# log files
+manage_files_pattern(dirsrv_t, dirsrv_var_log_t, dirsrv_var_log_t)
+allow dirsrv_t dirsrv_var_log_t:dir { setattr };
+logging_log_filetrans(dirsrv_t,dirsrv_var_log_t,{ sock_file file dir })
+
+# pid files
+manage_files_pattern(dirsrv_t, dirsrv_var_run_t, dirsrv_var_run_t)
+files_pid_filetrans(dirsrv_t,dirsrv_var_run_t, { file sock_file })
+
+#lock files
+manage_files_pattern(dirsrv_t, dirsrv_var_lock_t, dirsrv_var_lock_t)
+manage_dirs_pattern(dirsrv_t, dirsrv_var_lock_t, dirsrv_var_lock_t)
+files_lock_filetrans(dirsrv_t,dirsrv_var_lock_t, { file })
+
+# config files
+manage_files_pattern(dirsrv_t, dirsrv_config_t, dirsrv_config_t)
+
+# tmp files
+manage_files_pattern(dirsrv_t, dirsrv_tmp_t, dirsrv_tmp_t)
+manage_dirs_pattern(dirsrv_t, dirsrv_tmp_t, dirsrv_tmp_t)
+files_tmp_filetrans(dirsrv_t, dirsrv_tmp_t, { file dir })
+
+# system state
+fs_getattr_all_fs(dirsrv_t)
+kernel_read_system_state(dirsrv_t)
+
+# Networking basics
+sysnet_dns_name_resolve(dirsrv_t)
+corenet_all_recvfrom_unlabeled(dirsrv_t)
+corenet_all_recvfrom_netlabel(dirsrv_t)
+corenet_tcp_sendrecv_generic_if(dirsrv_t)
+corenet_tcp_sendrecv_generic_node(dirsrv_t)
+corenet_tcp_sendrecv_all_ports(dirsrv_t)
+corenet_tcp_bind_all_nodes(dirsrv_t)
+corenet_tcp_bind_ldap_port(dirsrv_t)
+corenet_tcp_connect_all_ports(dirsrv_t)
+corenet_sendrecv_ldap_server_packets(dirsrv_t)
+corenet_sendrecv_all_client_packets(dirsrv_t)
+allow dirsrv_t self:tcp_socket { create_stream_socket_perms };
+
+# Init script handling
+init_use_fds(dirsrv_t)
+init_use_script_ptys(dirsrv_t)
+domain_use_interactive_fds(dirsrv_t)
--
1.6.2.5
--
389-devel mailing list
389-devel@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-directory-devel
