On 1/8/19 3:52 AM, Russell Coker wrote:
Here are the patches I used last time I tried to get MLS going on Debian.
Index: refpolicy-2.20180701/policy/modules/kernel/kernel.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/kernel/kernel.te
+++ refpolicy-2.20180701/policy/modules/kernel/kernel.te
@@ -39,6 +39,7 @@ role unconfined_r;
ifdef(`enable_mls',`
role secadm_r;
role auditadm_r;
+ mls_process_set_level(kernel_t)
')
#
Index: refpolicy-2.20180701/policy/modules/system/systemd.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/system/systemd.te
+++ refpolicy-2.20180701/policy/modules/system/systemd.te
@@ -251,7 +251,13 @@ systemd_log_parse_environment(systemd_gp
allow systemd_cgroups_t self:capability net_admin;
-kernel_domtrans_to(systemd_cgroups_t, systemd_cgroups_exec_t)
+ifdef(`enable_mls',`
+ kernel_ranged_domtrans_to(systemd_cgroups_t, systemd_cgroups_exec_t, s0 - mls_systemhigh)
+ mls_fd_use_all_levels(systemd_cgroups_t)
+',`
+ kernel_domtrans_to(systemd_cgroups_t, systemd_cgroups_exec_t)
+')
+
kernel_dgram_send(systemd_cgroups_t)
# for /proc/cmdline
kernel_read_system_state(systemd_cgroups_t)
Index: refpolicy-2.20180701/policy/modules/system/init.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/system/init.te
+++ refpolicy-2.20180701/policy/modules/system/init.te
@@ -191,6 +191,7 @@ mls_file_read_all_levels(init_t)
mls_file_write_all_levels(init_t)
mls_process_write_all_levels(init_t)
mls_fd_use_all_levels(init_t)
+mls_process_set_level(init_t)
# the following one is needed for libselinux:is_selinux_enabled()
# otherwise the call fails and sysvinit tries to load the policy
@@ -384,6 +385,8 @@ ifdef(`init_systemd',`
# systemd_socket_activated policy
mls_socket_write_all_levels(init_t)
+ # read from systemd-journal and similar
+ mls_socket_read_to_clearance(init_t)
selinux_unmount_fs(init_t)
selinux_validate_context(init_t)
Index: refpolicy-2.20180701/policy/modules/system/logging.if
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/system/logging.if
+++ refpolicy-2.20180701/policy/modules/system/logging.if
@@ -422,6 +422,9 @@ interface(`logging_domtrans_syslog',`
corecmd_search_bin($1)
domtrans_pattern($1, syslogd_exec_t, syslogd_t)
+ ifdef(`enable_mls',`
+ range_transition $1 syslogd_exec_t:process mls_systemhigh;
+ ')
')
########################################
Merged, though I changed the style a bit.
--
Chris PeBenito
