-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 12/05/2010 07:46 PM, Dominick Grift wrote:
> On 12/05/2010 04:44 PM, Jorge Fábregas wrote:
>> On Saturday 04 December 2010 16:41:39 Dominick Grift wrote:
>>> So you could define a file type transition:
>>>
>>> if unconfined_t creates a file in directories with type etc_t, then
>>> transition from type etc_t to some specified type (net_conf_t in your
>>> example)
>>>
>>> filetrans_pattern(unconfined_t, etc_t, net_conf_t, file)
>
>> Hello again!
>
>> I would like to try this out (files created with unconfined_t, under /etc/, to
>> have a label of net_conf_t). My only experience with inserting custom-policy
>> modules is with the "allow rules" suggested by audit2allow. Other than that I
>> have never done anything else policy-wise so bear with me :)
>
>> I tried this:
>
> You should remove the ; on the filetrans line
>
> mkdir mytest; cd mytest;
>
> echo "policy_module(mytest, 1.0.0)" > mytest.te;
> echo "gen_require(\` type unconfined_t, etc_t, net_conf_t; ')" >> mytest.te;
> echo"# allow unconfined_t to create files with type net_conf_t in etc_t
> directories. So unconfined_t should be able to traverse etc_t
> directories (search) and to add entries to the parent etc_t directories.
> this is all provided in the manage_files_pattern" >> mytest.te;
> echo "manage_files_pattern(unconfined_t, etc_t, net_conf_t)" >> mytest.te;
> echo "Now we must tell selinux to transition the type of the file
whoops this lines needs to be commented.
> created by unconfined_t in etc_t directories from the default etc_t type
> to the specified net_conf_t type." >> mytest.te;
> echo "filetrans_pattern(unconfined_t, etc_t, net_conf_t, file)" >>
> mytest.te;
>
> make -f /usr/share/selinux/devel/Makefile mytest.pp
> sudo semodule -i mytest.pp
>
> touch /etc/test
> ls -alZ /etc/test
> rm /etc/test
> sudo semodule -r mytest.pp
We use already defined patterns in above example instead of raw policy
that is the policy that the kernel understands.
patterns, interfaces, permission sets, templates are all m4 macro-ish
things that aim to make policy development easier and more maintainable.
You can find the patterns we used above in the file below:
> /usr/share/selinux/devel/include/support/file_patterns.spt
There is also a interface provided in the sysnetwork module that
basically wraps the filetrans pattern up for us:
> #######################################
> ## <summary>
> ## Create files in /etc with the type used for
> ## the network config files.
> ## </summary>
> ## <param name="domain">
> ## <summary>
> ## Domain allowed access.
> ## </summary>
> ## </param>
> #
> interface(`sysnet_etc_filetrans_config',`
> gen_require(`
> type net_conf_t;
> ')
>
> files_etc_filetrans($1, net_conf_t, file)
> ')
So instead of using the filetrans_pattern in above example we could
simply call this:
sysnet_etc_filetrans_config(unconfined_t)
The above interface uses another macro that is defined in the files
module. Youll see that often.
The manage_files_pattern i used in my example can be replaced by:
sysnet_manage_config(unconfined_t
which is also defined in the sysnet module for us to use:
> #######################################
> ## <summary>
> ## Create, read, write, and delete network config files.
> ## </summary>
> ## <param name="domain">
> ## <summary>
> ## Domain allowed access.
> ## </summary>
> ## </param>
> #
> interface(`sysnet_manage_config',`
> gen_require(`
> type net_conf_t;
> ')
>
> files_search_etc($1)
> allow $1 net_conf_t:file manage_file_perms;
>
> ifdef(`distro_redhat',`
> manage_files_pattern($1, net_conf_t, net_conf_t)
> ')
> ')
You can find these provided interfaces here in the *.if files youll find
in the below directories:
> /usr/share/selinux/devel/include
>
>
>
>> ------------------------------ cut here ---------------------------
>
>> module localtran 1.0;
>> require {
>> type unconfined_t;
>> type etc_t;
>> type net_conf_t;
>> class file {write};
>> }
>
>> filetrans_pattern(unconfined_t, etc_t, net_conf_t, file);
>
>> ------------------------------ cut here ---------------------------
>
>> and then tried "checmodule -M -m localtran.te -o localtran.pp" but I get
>> syntax errors with token "filetrans_pattern". I did some googling and noticed
>> the use of "files_type" and "manage_files" before filetrans_pattern (tried it but
>> didn't work). I'm not sure if I need those and also the class directive.
>
>> I would like to try this first and eventually get more sophisticated with your
>> other suggestions.. Of course, this is just for learning purposes (not that I
>> need unconfined_t to create files in /etc with net_conf_t ).
>
>> Regards,
>> Jorge
>> --
>> selinux mailing list
>> selinux@xxxxxxxxxxxxxxxxxxxxxxx
>> https://admin.fedoraproject.org/mailman/listinfo/selinux
>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.16 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkz74zoACgkQMlxVo39jgT/aXQCffy0tO3OZAlM/0QTelHUO0GpK
rtEAn01oZlyX0lH0jq9XJ/4KGCgZitEB
=nQ4q
-----END PGP SIGNATURE-----
--
selinux mailing list
selinux@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/selinux
