On Tue, 2008-02-19 at 13:29 +0100, Václav Ovsík wrote:
> Hi,
> this patch solves following denials on Debian:
>
> audit(1203020199.510:16): avc: denied { execute } for pid=1841 comm="aptitude" name="bash" dev=sda1 ino=81922 scontext=system_u:system_r:backup_t:s0 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file
> audit(1203020199.526:17): avc: denied { remove_name } for pid=1847 comm="rm" name="aptitude.pkgstates.6.gz" dev=sda1 ino=213244 scontext=system_u:system_r:backup_t:s0 tcontext=system_u:object_r:backup_store_t:s0 tclass=dir
> audit(1203020199.526:18): avc: denied { unlink } for pid=1847 comm="rm" name="aptitude.pkgstates.6.gz" dev=sda1 ino=213244 scontext=system_u:system_r:backup_t:s0 tcontext=system_u:object_r:backup_store_t:s0 tclass=file
> audit(1203020199.538:19): avc: denied { rename } for pid=1848 comm="mv" name="aptitude.pkgstates.5.gz" dev=sda1 ino=213147 scontext=system_u:system_r:backup_t:s0 tcontext=system_u:object_r:backup_store_t:s0 tclass=file
> audit(1203020212.719:22): avc: denied { fsetid } for pid=1932 comm="cp" capability=4 scontext=system_u:system_r:backup_t:s0 tcontext=system_u:system_r:backup_t:s0 tclass=capability
> audit(1203020212.759:23): avc: denied { execute } for pid=1940 comm="standard" name="bash" dev=sda1 ino=81922 scontext=system_u:system_r:backup_t:s0 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file
>
> Aptitude backup script /etc/cron.daily/aptitude saves the aptitude state
> into /var/backup. Cron backup script /etc/cron.daily/standard saves
> shadow files and the dpkg status into /var/backup.
>
> The utility savelog from debianutils is used for rotating state
> information of aptitude and dpkg (unfortunately). Savelog context
> (logrotate_exec_t) should be removed (no specialisation for log files
> only). Log rotation cron jobs /etc/cron.{daily,weekly}/sysklogd has
> logrotate_exec_t already and some init scipts that uses savelog for
> rotating logs during the boot has persmissions already too. So this is
> ok alone hope.
>
> Attached patch adds context for /etc/cron.daily/{aptitude,standard}
> backup_exec_t. Permission to execute shell and manage files under
> /var/backup is granted further.
Merged. I moved the file context change into a distro_debian block,
though I suspect the backup policy is fairly Debian-specific.
--
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
the words "unsubscribe selinux" without quotes as the message.
