Allow certbot to create /var/lib/letsencrypt and /var/og/letsencrypt with the correct contexts. Allow it to read /dev/urandom, dontaudit attempts to write python cache files (would be good to fix python for this), and reload web server to get new keys. I think this is good to merge. Signed-off-by: Russell Coker <russell@xxxxxxxxxxxx> Index: refpolicy-2.20220106/policy/modules/services/apache.if =================================================================== --- refpolicy-2.20220106.orig/policy/modules/services/apache.if +++ refpolicy-2.20220106/policy/modules/services/apache.if @@ -238,6 +238,24 @@ interface(`apache_domtrans',` ######################################## ## <summary> +## Execute httpd +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed to execute it. +## </summary> +## </param> +# +interface(`apache_exec',` + gen_require(` + type httpd_t, httpd_exec_t; + ') + + can_exec($1, httpd_exec_t) +') + +######################################## +## <summary> ## Execute httpd server in the httpd domain. ## </summary> ## <param name="domain"> @@ -1430,3 +1448,21 @@ interface(`apache_admin',` apache_run_all_scripts($1, $2) apache_run_helper($1, $2) ') + +######################################## +## <summary> +## rw httpd_runtime_t files +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`apache_rw_runtime_files',` + gen_require(` + type httpd_runtime_t; + ') + + allow $1 httpd_runtime_t:file rw_file_perms; +') Index: refpolicy-2.20220106/policy/modules/services/certbot.te =================================================================== --- refpolicy-2.20220106.orig/policy/modules/services/certbot.te +++ refpolicy-2.20220106/policy/modules/services/certbot.te @@ -43,9 +43,10 @@ allow certbot_t self:udp_socket all_udp_ allow certbot_t self:tcp_socket all_tcp_socket_perms; allow certbot_t self:netlink_route_socket create_netlink_socket_perms; -files_search_var_lib(certbot_t) +files_var_lib_filetrans(certbot_t, certbot_lib_t, dir, "letsencrypt") manage_dirs_pattern(certbot_t, certbot_lib_t, certbot_lib_t) manage_files_pattern(certbot_t, certbot_lib_t, certbot_lib_t) +allow certbot_t certbot_lib_t:file relabelfrom; manage_dirs_pattern(certbot_t, certbot_tmp_t, certbot_tmp_t) manage_files_pattern(certbot_t, certbot_tmp_t, certbot_tmp_t) @@ -62,7 +63,7 @@ allow certbot_t certbot_tmp_t:file mmap_ allow certbot_t certbot_tmpfs_t:file mmap_exec_file_perms; allow certbot_t certbot_runtime_t:file mmap_exec_file_perms; -logging_search_logs(certbot_t) +logging_log_filetrans(certbot_t, certbot_log_t, dir, "letsencrypt") allow certbot_t certbot_log_t:dir manage_dir_perms; allow certbot_t certbot_log_t:file manage_file_perms; @@ -80,11 +81,15 @@ corenet_tcp_connect_dns_port(certbot_t) # bind to http port for standalone mode corenet_tcp_bind_http_port(certbot_t) +dev_read_urand(certbot_t) + domain_use_interactive_fds(certbot_t) files_read_etc_files(certbot_t) files_read_usr_files(certbot_t) +# dontaudit for attempts to write python cache files +libs_dontaudit_write_lib_dirs(certbot_t) libs_exec_ldconfig(certbot_t) # for /usr/lib/gcc/x86_64-linux-gnu/8/collect2 libs_exec_lib_files(certbot_t) @@ -110,5 +115,17 @@ optional_policy(` # for writing to webroot apache_manage_sys_content(certbot_t) - apache_search_config(certbot_t) + apache_append_log(certbot_t) + apache_exec(certbot_t) + apache_exec_modules(certbot_t) + + # for certbot to create nginx config + apache_manage_config(certbot_t) + + apache_rw_runtime_files(certbot_t) + apache_signal(certbot_t) +') + +optional_policy(` + xdg_search_config_dirs(certbot_t) ')
