From 6db31179272c8dde68f157732cdd7338ee696829 Mon Sep 17 00:00:00 2001 From: CentOS Sources Date: Jan 23 2023 14:31:58 +0000 Subject: import fapolicyd-1.1.3-102.el9_1.7 --- diff --git a/SOURCES/fapolicyd-markfs-1.patch b/SOURCES/fapolicyd-markfs-1.patch new file mode 100644 index 0000000..041c878 --- /dev/null +++ b/SOURCES/fapolicyd-markfs-1.patch @@ -0,0 +1,170 @@ +From 2d15ea13e2a3dca1bb159f2cf031ca437c0b9aa1 Mon Sep 17 00:00:00 2001 +From: Steve Grubb +Date: Tue, 27 Sep 2022 10:33:44 -0400 +Subject: [PATCH] Add support for using FAN_MARK_FILESYSTEM to see bind mounted + accesses + +--- + ChangeLog | 1 + + configure.ac | 1 + + doc/fapolicyd.conf.5 | 5 ++++- + init/fapolicyd.conf | 1 + + src/daemon/notify.c | 12 ++++++++++-- + src/library/conf.h | 3 ++- + src/library/daemon-config.c | 28 +++++++++++++++++++++++++++- + 7 files changed, 46 insertions(+), 5 deletions(-) + +diff --git a/configure.ac b/configure.ac +index 4437685..a67c46b 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -56,6 +56,7 @@ AC_CHECK_DECLS([FAN_OPEN_EXEC_PERM], [perm=yes], [perm=no], [[#include ]]) + + withval="" + AC_ARG_WITH(rpm, +diff --git a/doc/fapolicyd.conf.5 b/doc/fapolicyd.conf.5 +index 812cfa4..d8cb296 100644 +--- a/doc/fapolicyd.conf.5 ++++ b/doc/fapolicyd.conf.5 +@@ -1,4 +1,4 @@ +-.TH FAPOLICYD.CONF: "6" "October 2021" "Red Hat" "System Administration Utilities" ++.TH FAPOLICYD.CONF: "6" "September 2022" "Red Hat" "System Administration Utilities" + .SH NAME + fapolicyd.conf \- fapolicyd configuration file + .SH DESCRIPTION +@@ -87,6 +87,9 @@ Example: + .B rpm_sha256_only + The option set to 1 forces the daemon to work only with SHA256 hashes. This is useful on the systems where the integrity is set to SHA256 or IMA and some rpms were originally built with e.g. SHA1. The daemon will ingore these SHA1 entries therefore they can be added manually via CLI with correct SHA256 to a trust file later. If set to 0 the daemon stores SHA1 in trustdb as well. This is compatible with older behavior which works with the integrity set to NONE and SIZE. The NONE or SIZE integrity setting considers the files installed via rpm as trusted and it does not care about their hashes at all. On the other hand the integrity set to SHA256 or IMA will never consider a file with SHA1 in trustdb as trusted. The default value is 0. + ++.TP ++.B allow_filesystem_mark ++When this option is set to 1, it allows fapolicyd to monitor file access events on the underlying file system when they are bind mounted or are overlayed (e.g. the overlayfs). Normally they block fapolicyd from seeing events on the underlying file systems. This may or may not be desirable. For example, you might start seeing containers accessing things outside of the container but there is no source of trust for the container. In that case you probably do not want to see access from the container. Or maybe you do not use containers but want to control anything run by systemd-run when dynamic users are allowed. In that case you probably want to turn it on. Not all kernel's supoport this option. Therefore the default value is 0. + + .SH "SEE ALSO" + .BR fapolicyd (8), +diff --git a/init/fapolicyd.conf b/init/fapolicyd.conf +index 42e8798..8363b89 100644 +--- a/init/fapolicyd.conf ++++ b/init/fapolicyd.conf +@@ -18,3 +18,4 @@ trust = rpmdb,file + integrity = none + syslog_format = rule,dec,perm,auid,pid,exe,:,path,ftype,trust + rpm_sha256_only = 0 ++allow_filesystem_mark = 0 +diff --git a/src/daemon/notify.c b/src/daemon/notify.c +index f550e99..c91abc4 100644 +--- a/src/daemon/notify.c ++++ b/src/daemon/notify.c +@@ -123,8 +123,16 @@ int init_fanotify(const conf_t *conf, mlist *m) + path = mlist_first(m); + while (path) { + retry_mark: +- if (fanotify_mark(fd, FAN_MARK_ADD | FAN_MARK_MOUNT, +- mask, -1, path) == -1) { ++ unsigned int flags = FAN_MARK_ADD; ++#ifdef HAVE_DECL_FAN_MARK_FILESYSTEM ++ if (conf->allow_filesystem_mark) ++ flags |= FAN_MARK_FILESYSTEM; ++#else ++ if (conf->allow_filesystem_mark) ++ msg(LOG_ERR, ++ "allow_filesystem_mark is unsupported for this kernel - ignoring"); ++#endif ++ if (fanotify_mark(fd, flags, mask, -1, path) == -1) { + /* + * The FAN_OPEN_EXEC_PERM mask is not supported by + * all kernel releases prior to 5.0. Retry setting +diff --git a/src/library/conf.h b/src/library/conf.h +index e774ff6..57c19a2 100644 +--- a/src/library/conf.h ++++ b/src/library/conf.h +@@ -1,5 +1,5 @@ + /* conf.h configuration structure +- * Copyright 2018-20 Red Hat Inc. ++ * Copyright 2018-20,22 Red Hat Inc. + * All Rights Reserved. + * + * This program is free software; you can redistribute it and/or modify +@@ -45,6 +45,7 @@ typedef struct conf + integrity_t integrity; + const char *syslog_format; + unsigned int rpm_sha256_only; ++ unsigned int allow_filesystem_mark; + } conf_t; + + #endif +diff --git a/src/library/daemon-config.c b/src/library/daemon-config.c +index e803e0b..89b7f68 100644 +--- a/src/library/daemon-config.c ++++ b/src/library/daemon-config.c +@@ -1,7 +1,7 @@ + /* + * daemon-config.c - This is a config file parser + * +- * Copyright 2018-21 Red Hat Inc. ++ * Copyright 2018-22 Red Hat Inc. + * All Rights Reserved. + * + * This library is free software; you can redistribute it and/or +@@ -92,6 +92,8 @@ static int syslog_format_parser(const struct nv_pair *nv, int line, + conf_t *config); + static int rpm_sha256_only_parser(const struct nv_pair *nv, int line, + conf_t *config); ++static int fs_mark_parser(const struct nv_pair *nv, int line, ++ conf_t *config); + + static const struct kw_pair keywords[] = + { +@@ -110,6 +112,7 @@ static const struct kw_pair keywords[] = + {"integrity", integrity_parser }, + {"syslog_format", syslog_format_parser }, + {"rpm_sha256_only", rpm_sha256_only_parser}, ++ {"allow_filesystem_mark", fs_mark_parser }, + { NULL, NULL } + }; + +@@ -138,6 +141,7 @@ static void clear_daemon_config(conf_t *config) + config->syslog_format = + strdup("rule,dec,perm,auid,pid,exe,:,path,ftype"); + config->rpm_sha256_only = 0; ++ config->allow_filesystem_mark = 0; + } + + int load_daemon_config(conf_t *config) +@@ -590,6 +594,7 @@ static int syslog_format_parser(const struct nv_pair *nv, int line, + return 1; + } + ++ + static int rpm_sha256_only_parser(const struct nv_pair *nv, int line, + conf_t *config) + { +@@ -607,3 +612,24 @@ static int rpm_sha256_only_parser(const struct nv_pair *nv, int line, + + return rc; + } ++ ++ ++static int fs_mark_parser(const struct nv_pair *nv, int line, ++ conf_t *config) ++{ ++ int rc = 0; ++#ifndef HAVE_DECL_FAN_MARK_FILESYSTEM ++ msg(LOG_WARNING, ++ "allow_filesystem_mark is unsupported on this kernel - ignoring"); ++#else ++ rc = unsigned_int_parser(&(config->allow_filesystem_mark), nv->value, line); ++ ++ if (rc == 0 && config->allow_filesystem_mark > 1) { ++ msg(LOG_WARNING, ++ "allow_filesystem_mark value reset to 0 - line %d", line); ++ config->allow_filesystem_mark = 0; ++ } ++#endif ++ ++ return rc; ++} diff --git a/SOURCES/fapolicyd-markfs-2.patch b/SOURCES/fapolicyd-markfs-2.patch new file mode 100644 index 0000000..3b66146 --- /dev/null +++ b/SOURCES/fapolicyd-markfs-2.patch @@ -0,0 +1,38 @@ +From ca225c8e83b37e5f29703d7352af0b937b2e933c Mon Sep 17 00:00:00 2001 +From: Steve Grubb +Date: Tue, 27 Sep 2022 19:41:24 -0400 +Subject: [PATCH] Correct the optional inclusion of code based on + HAVE_DECL_FAN_MARK_FILESYSTEM + +--- + ChangeLog | 1 + + src/daemon/notify.c | 2 +- + src/library/daemon-config.c | 2 +- + 3 files changed, 3 insertions(+), 2 deletions(-) + +diff --git a/src/daemon/notify.c b/src/daemon/notify.c +index c91abc4..f36b644 100644 +--- a/src/daemon/notify.c ++++ b/src/daemon/notify.c +@@ -124,7 +124,7 @@ int init_fanotify(const conf_t *conf, mlist *m) + while (path) { + retry_mark: + unsigned int flags = FAN_MARK_ADD; +-#ifdef HAVE_DECL_FAN_MARK_FILESYSTEM ++#if HAVE_DECL_FAN_MARK_FILESYSTEM != 0 + if (conf->allow_filesystem_mark) + flags |= FAN_MARK_FILESYSTEM; + #else +diff --git a/src/library/daemon-config.c b/src/library/daemon-config.c +index 89b7f68..778b89a 100644 +--- a/src/library/daemon-config.c ++++ b/src/library/daemon-config.c +@@ -618,7 +618,7 @@ static int fs_mark_parser(const struct nv_pair *nv, int line, + conf_t *config) + { + int rc = 0; +-#ifndef HAVE_DECL_FAN_MARK_FILESYSTEM ++#if HAVE_DECL_FAN_MARK_FILESYSTEM == 0 + msg(LOG_WARNING, + "allow_filesystem_mark is unsupported on this kernel - ignoring"); + #else diff --git a/SOURCES/fapolicyd-markfs-3.patch b/SOURCES/fapolicyd-markfs-3.patch new file mode 100644 index 0000000..e2af31d --- /dev/null +++ b/SOURCES/fapolicyd-markfs-3.patch @@ -0,0 +1,53 @@ +From cd315ebb45e3a095f612ec0e03f606a5383c39ba Mon Sep 17 00:00:00 2001 +From: Steve Grubb +Date: Wed, 28 Sep 2022 16:36:28 -0400 +Subject: [PATCH] Add a check to see if they are defined before using them + +--- + src/daemon/notify.c | 2 +- + src/library/daemon-config.c | 14 ++++++++------ + 2 files changed, 9 insertions(+), 7 deletions(-) + +diff --git a/src/daemon/notify.c b/src/daemon/notify.c +index f36b644..3986390 100644 +--- a/src/daemon/notify.c ++++ b/src/daemon/notify.c +@@ -124,7 +124,7 @@ int init_fanotify(const conf_t *conf, mlist *m) + while (path) { + retry_mark: + unsigned int flags = FAN_MARK_ADD; +-#if HAVE_DECL_FAN_MARK_FILESYSTEM != 0 ++#if defined HAVE_DECL_FAN_MARK_FILESYSTEM && HAVE_DECL_FAN_MARK_FILESYSTEM != 0 + if (conf->allow_filesystem_mark) + flags |= FAN_MARK_FILESYSTEM; + #else +diff --git a/src/library/daemon-config.c b/src/library/daemon-config.c +index 778b89a..ba8ade0 100644 +--- a/src/library/daemon-config.c ++++ b/src/library/daemon-config.c +@@ -618,17 +618,19 @@ static int fs_mark_parser(const struct nv_pair *nv, int line, + conf_t *config) + { + int rc = 0; +-#if HAVE_DECL_FAN_MARK_FILESYSTEM == 0 +- msg(LOG_WARNING, +- "allow_filesystem_mark is unsupported on this kernel - ignoring"); +-#else +- rc = unsigned_int_parser(&(config->allow_filesystem_mark), nv->value, line); ++#if defined HAVE_DECL_FAN_MARK_FILESYSTEM && HAVE_DECL_FAN_MARK_FILESYSTEM != 0 ++ rc = unsigned_int_parser(&(config->allow_filesystem_mark), ++ nv->value, line); + + if (rc == 0 && config->allow_filesystem_mark > 1) { + msg(LOG_WARNING, +- "allow_filesystem_mark value reset to 0 - line %d", line); ++ "allow_filesystem_mark value reset to 0 - line %d", ++ line); + config->allow_filesystem_mark = 0; + } ++#else ++ msg(LOG_WARNING, ++ "allow_filesystem_mark is unsupported on this kernel - ignoring"); + #endif + + return rc; diff --git a/SOURCES/fapolicyd-markfs-4.patch b/SOURCES/fapolicyd-markfs-4.patch new file mode 100644 index 0000000..b9f4429 --- /dev/null +++ b/SOURCES/fapolicyd-markfs-4.patch @@ -0,0 +1,29 @@ +From 194ac1b87ba46ea9e26a865e8432e228cf8fefef Mon Sep 17 00:00:00 2001 +From: Steven Brzozowski +Date: Thu, 20 Oct 2022 17:55:30 -0400 +Subject: [PATCH] Add `FAN_MARK_MOUNT` when opting out of `FAN_MARK_FILESYSTEM` + (#210) + +Without `FAN_MARK_MOUNT`, fapolicyd will not receive events for any subdirectories specified by the path parameter. +--- + src/daemon/notify.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/src/daemon/notify.c b/src/daemon/notify.c +index 586b6df..5e4f160 100644 +--- a/src/daemon/notify.c ++++ b/src/daemon/notify.c +@@ -128,10 +128,13 @@ int init_fanotify(const conf_t *conf, mlist *m) + #if defined HAVE_DECL_FAN_MARK_FILESYSTEM && HAVE_DECL_FAN_MARK_FILESYSTEM != 0 + if (conf->allow_filesystem_mark) + flags |= FAN_MARK_FILESYSTEM; ++ else ++ flags |= FAN_MARK_MOUNT; + #else + if (conf->allow_filesystem_mark) + msg(LOG_ERR, + "allow_filesystem_mark is unsupported for this kernel - ignoring"); ++ flags |= FAN_MARK_MOUNT; + #endif + if (fanotify_mark(fd, flags, mask, -1, path) == -1) { + /* diff --git a/SOURCES/fapolicyd-selinux-1.patch b/SOURCES/fapolicyd-selinux-1.patch new file mode 100644 index 0000000..5f5fea5 --- /dev/null +++ b/SOURCES/fapolicyd-selinux-1.patch @@ -0,0 +1,173 @@ +diff -up ./fapolicyd-selinux-0.4/fapolicyd.if.selinux ./fapolicyd-selinux-0.4/fapolicyd.if +--- ./fapolicyd-selinux-0.4/fapolicyd.if.selinux 2021-03-23 10:21:31.000000000 +0100 ++++ ./fapolicyd-selinux-0.4/fapolicyd.if 2022-06-30 10:52:05.112355159 +0200 +@@ -2,6 +2,122 @@ + + ######################################## + ## ++## Watch_mount directories in /boot. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++ ++ifndef(`files_watch_mount_boot_dirs',` ++ interface(`files_watch_mount_boot_dirs',` ++ gen_require(` ++ type boot_t; ++ ') ++ ++ allow $1 boot_t:dir watch_mount_dir_perms; ++ ') ++') ++ ++ ++######################################## ++## ++## Watch_mount home directories. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++ ++ifndef(`files_watch_mount_home',` ++ interface(`files_watch_mount_home',` ++ gen_require(` ++ type home_root_t; ++ ') ++ ++ allow $1 home_root_t:dir watch_mount_dir_perms; ++ ') ++') ++ ++ ++######################################## ++## ++## Watch_with_perm home directories. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++ ++ifndef(`files_watch_with_perm_home',` ++interface(`files_watch_with_perm_home',` ++ gen_require(` ++ type home_root_t; ++ ') ++ ++ allow $1 home_root_t:dir watch_with_perm_dir_perms; ++') ++') ++ ++ ++######################################## ++## ++## Watch_mount dirs on a DOS filesystem. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++ ++ifndef(`fs_watch_mount_dos_dirs',` ++interface(`fs_watch_mount_dos_dirs',` ++ gen_require(` ++ type dosfs_t; ++ ') ++ ++ watch_mount_dirs_pattern($1, dosfs_t, dosfs_t) ++') ++') ++ ++ ++ ++######################################## ++## ++## Watch_with_perm dirs on a DOS filesystem. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++ ++ifndef(`fs_watch_with_perm_dos_dirs',` ++interface(`fs_watch_with_perm_dos_dirs',` ++ gen_require(` ++ type dosfs_t; ++ ') ++ ++ watch_with_perm_dirs_pattern($1, dosfs_t, dosfs_t) ++') ++') ++ ++ ++################################################################################################### ++ ++ ++ ++ ++######################################## ++## + ## Execute fapolicyd_exec_t in the fapolicyd domain. + ## + ## +diff -up ./fapolicyd-selinux-0.4/fapolicyd.te.selinux ./fapolicyd-selinux-0.4/fapolicyd.te +--- ./fapolicyd-selinux-0.4/fapolicyd.te.selinux 2021-03-23 10:21:31.000000000 +0100 ++++ ./fapolicyd-selinux-0.4/fapolicyd.te 2022-06-30 10:53:01.693055971 +0200 +@@ -1,5 +1,6 @@ + policy_module(fapolicyd, 1.0.0) + ++ + ######################################## + # + # Declarations +@@ -36,6 +37,12 @@ allow fapolicyd_t self:process { setcap + allow fapolicyd_t self:unix_stream_socket create_stream_socket_perms; + allow fapolicyd_t self:unix_dgram_socket create_socket_perms; + ++gen_require(` ++ attribute file_type; ++') ++allow fapolicyd_t file_type:dir { watch_mount watch_with_perm }; ++allow fapolicyd_t file_type:file { watch_mount watch_with_perm }; ++ + manage_files_pattern(fapolicyd_t, fapolicyd_log_t, fapolicyd_log_t) + logging_log_filetrans(fapolicyd_t, fapolicyd_log_t, file) + +@@ -61,16 +68,22 @@ corecmd_exec_bin(fapolicyd_t) + + domain_read_all_domains_state(fapolicyd_t) + +-files_mmap_usr_files(fapolicyd_t) ++files_mmap_all_files(fapolicyd_t) + files_read_all_files(fapolicyd_t) ++files_watch_mount_boot_dirs(fapolicyd_t) ++files_watch_with_perm_boot_dirs(fapolicyd_t) + files_watch_mount_generic_tmp_dirs(fapolicyd_t) + files_watch_with_perm_generic_tmp_dirs(fapolicyd_t) ++files_watch_mount_home(fapolicyd_t) ++files_watch_with_perm_home(fapolicyd_t) + files_watch_mount_root_dirs(fapolicyd_t) + files_watch_with_perm_root_dirs(fapolicyd_t) + + fs_getattr_xattr_fs(fapolicyd_t) + fs_watch_mount_tmpfs_dirs(fapolicyd_t) + fs_watch_with_perm_tmpfs_dirs(fapolicyd_t) ++fs_watch_mount_dos_dirs(fapolicyd_t) ++fs_watch_with_perm_dos_dirs(fapolicyd_t) + + logging_send_syslog_msg(fapolicyd_t) + dbus_system_bus_client(fapolicyd_t) diff --git a/SOURCES/fapolicyd-selinux-2.patch b/SOURCES/fapolicyd-selinux-2.patch new file mode 100644 index 0000000..80ffe37 --- /dev/null +++ b/SOURCES/fapolicyd-selinux-2.patch @@ -0,0 +1,19 @@ +diff -up ./fapolicyd-selinux-0.4/fapolicyd.te.selinux2 ./fapolicyd-selinux-0.4/fapolicyd.te +--- ./fapolicyd-selinux-0.4/fapolicyd.te.selinux2 2022-11-11 10:46:51.016420807 +0100 ++++ ./fapolicyd-selinux-0.4/fapolicyd.te 2022-11-11 10:47:25.161793205 +0100 +@@ -39,10 +39,15 @@ allow fapolicyd_t self:unix_dgram_socket + + gen_require(` + attribute file_type; ++ attribute filesystem_type; ++ attribute mountpoint; + ') + allow fapolicyd_t file_type:dir { watch_mount watch_with_perm }; + allow fapolicyd_t file_type:file { watch_mount watch_with_perm }; + ++allow fapolicyd_t filesystem_type : filesystem { watch }; ++allow fapolicyd_t mountpoint : dir { watch_sb }; ++ + manage_files_pattern(fapolicyd_t, fapolicyd_log_t, fapolicyd_log_t) + logging_log_filetrans(fapolicyd_t, fapolicyd_log_t, file) + diff --git a/SOURCES/fapolicyd-selinux.patch b/SOURCES/fapolicyd-selinux.patch deleted file mode 100644 index 5f5fea5..0000000 --- a/SOURCES/fapolicyd-selinux.patch +++ /dev/null @@ -1,173 +0,0 @@ -diff -up ./fapolicyd-selinux-0.4/fapolicyd.if.selinux ./fapolicyd-selinux-0.4/fapolicyd.if ---- ./fapolicyd-selinux-0.4/fapolicyd.if.selinux 2021-03-23 10:21:31.000000000 +0100 -+++ ./fapolicyd-selinux-0.4/fapolicyd.if 2022-06-30 10:52:05.112355159 +0200 -@@ -2,6 +2,122 @@ - - ######################################## - ## -+## Watch_mount directories in /boot. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+ -+ifndef(`files_watch_mount_boot_dirs',` -+ interface(`files_watch_mount_boot_dirs',` -+ gen_require(` -+ type boot_t; -+ ') -+ -+ allow $1 boot_t:dir watch_mount_dir_perms; -+ ') -+') -+ -+ -+######################################## -+## -+## Watch_mount home directories. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+ -+ifndef(`files_watch_mount_home',` -+ interface(`files_watch_mount_home',` -+ gen_require(` -+ type home_root_t; -+ ') -+ -+ allow $1 home_root_t:dir watch_mount_dir_perms; -+ ') -+') -+ -+ -+######################################## -+## -+## Watch_with_perm home directories. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+ -+ifndef(`files_watch_with_perm_home',` -+interface(`files_watch_with_perm_home',` -+ gen_require(` -+ type home_root_t; -+ ') -+ -+ allow $1 home_root_t:dir watch_with_perm_dir_perms; -+') -+') -+ -+ -+######################################## -+## -+## Watch_mount dirs on a DOS filesystem. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+ -+ifndef(`fs_watch_mount_dos_dirs',` -+interface(`fs_watch_mount_dos_dirs',` -+ gen_require(` -+ type dosfs_t; -+ ') -+ -+ watch_mount_dirs_pattern($1, dosfs_t, dosfs_t) -+') -+') -+ -+ -+ -+######################################## -+## -+## Watch_with_perm dirs on a DOS filesystem. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+ -+ifndef(`fs_watch_with_perm_dos_dirs',` -+interface(`fs_watch_with_perm_dos_dirs',` -+ gen_require(` -+ type dosfs_t; -+ ') -+ -+ watch_with_perm_dirs_pattern($1, dosfs_t, dosfs_t) -+') -+') -+ -+ -+################################################################################################### -+ -+ -+ -+ -+######################################## -+## - ## Execute fapolicyd_exec_t in the fapolicyd domain. - ## - ## -diff -up ./fapolicyd-selinux-0.4/fapolicyd.te.selinux ./fapolicyd-selinux-0.4/fapolicyd.te ---- ./fapolicyd-selinux-0.4/fapolicyd.te.selinux 2021-03-23 10:21:31.000000000 +0100 -+++ ./fapolicyd-selinux-0.4/fapolicyd.te 2022-06-30 10:53:01.693055971 +0200 -@@ -1,5 +1,6 @@ - policy_module(fapolicyd, 1.0.0) - -+ - ######################################## - # - # Declarations -@@ -36,6 +37,12 @@ allow fapolicyd_t self:process { setcap - allow fapolicyd_t self:unix_stream_socket create_stream_socket_perms; - allow fapolicyd_t self:unix_dgram_socket create_socket_perms; - -+gen_require(` -+ attribute file_type; -+') -+allow fapolicyd_t file_type:dir { watch_mount watch_with_perm }; -+allow fapolicyd_t file_type:file { watch_mount watch_with_perm }; -+ - manage_files_pattern(fapolicyd_t, fapolicyd_log_t, fapolicyd_log_t) - logging_log_filetrans(fapolicyd_t, fapolicyd_log_t, file) - -@@ -61,16 +68,22 @@ corecmd_exec_bin(fapolicyd_t) - - domain_read_all_domains_state(fapolicyd_t) - --files_mmap_usr_files(fapolicyd_t) -+files_mmap_all_files(fapolicyd_t) - files_read_all_files(fapolicyd_t) -+files_watch_mount_boot_dirs(fapolicyd_t) -+files_watch_with_perm_boot_dirs(fapolicyd_t) - files_watch_mount_generic_tmp_dirs(fapolicyd_t) - files_watch_with_perm_generic_tmp_dirs(fapolicyd_t) -+files_watch_mount_home(fapolicyd_t) -+files_watch_with_perm_home(fapolicyd_t) - files_watch_mount_root_dirs(fapolicyd_t) - files_watch_with_perm_root_dirs(fapolicyd_t) - - fs_getattr_xattr_fs(fapolicyd_t) - fs_watch_mount_tmpfs_dirs(fapolicyd_t) - fs_watch_with_perm_tmpfs_dirs(fapolicyd_t) -+fs_watch_mount_dos_dirs(fapolicyd_t) -+fs_watch_with_perm_dos_dirs(fapolicyd_t) - - logging_send_syslog_msg(fapolicyd_t) - dbus_system_bus_client(fapolicyd_t) diff --git a/SOURCES/fapolicyd-static-app.patch b/SOURCES/fapolicyd-static-app.patch new file mode 100644 index 0000000..34f4510 --- /dev/null +++ b/SOURCES/fapolicyd-static-app.patch @@ -0,0 +1,22 @@ +From 67c116d07ed4e73127392a2100a042882488585a Mon Sep 17 00:00:00 2001 +From: Steve Grubb +Date: Tue, 27 Sep 2022 10:32:28 -0400 +Subject: [PATCH] Detect trusted static apps running programs by ld.so + +--- + ChangeLog | 1 + + src/library/event.c | 1 - + 2 files changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/library/event.c b/src/library/event.c +index cbb4292..4d79eb9 100644 +--- a/src/library/event.c ++++ b/src/library/event.c +@@ -149,7 +149,6 @@ int new_event(const struct fanotify_event_metadata *m, event_t *e) + skip_path = 1; + } + evict = 0; +- skip_path = 1; + subject_reset(s, EXE); + subject_reset(s, COMM); + subject_reset(s, EXE_TYPE); diff --git a/SPECS/fapolicyd.spec b/SPECS/fapolicyd.spec index 229a5dd..cdf096b 100644 --- a/SPECS/fapolicyd.spec +++ b/SPECS/fapolicyd.spec @@ -5,7 +5,7 @@ Summary: Application Whitelisting Daemon Name: fapolicyd Version: 1.1.3 -Release: 102%{?dist} +Release: 102%{?dist}.7 License: GPLv3+ URL: http://people.redhat.com/sgrubb/fapolicyd Source0: https://people.redhat.com/sgrubb/fapolicyd/%{name}-%{version}.tar.gz @@ -31,7 +31,7 @@ Requires(preun): systemd-units Requires(postun): systemd-units Patch1: fapolicyd-uthash-bundle.patch -Patch2: fapolicyd-selinux.patch +Patch2: fapolicyd-selinux-1.patch Patch3: fagenrules-group.patch Patch4: fapolicyd-fgets-update-thread.patch Patch5: fapolicyd-openssl.patch @@ -40,6 +40,17 @@ Patch7: fapolicyd-cli-segfault.patch Patch8: fapolicyd-sighup.patch Patch9: fapolicyd-readme.patch +# 2137254 - statically linked app can execute untrusted app [rhel-9.1.0.z] +Patch10: fapolicyd-static-app.patch +# 2137263 - fapolicyd ineffective with systemd DynamicUser=yes [rhel-9.1.0.z] +Patch11: fapolicyd-markfs-1.patch +Patch12: fapolicyd-markfs-2.patch +Patch13: fapolicyd-markfs-3.patch +Patch14: fapolicyd-markfs-4.patch + +Patch15: fapolicyd-selinux-2.patch + + %description Fapolicyd (File Access Policy Daemon) implements application whitelisting to decide file access rights. Applications that are known via a reputation @@ -71,7 +82,7 @@ The %{name}-selinux package contains selinux policy for the %{name} daemon. %patch1 -p1 -b .uthash %endif -%patch2 -p1 -b .selinux +%patch2 -p1 -b .selinux1 %patch3 -p1 -b .group %patch4 -p1 -b .update-thread %patch5 -p1 -b .openssl @@ -80,6 +91,14 @@ The %{name}-selinux package contains selinux policy for the %{name} daemon. %patch8 -p1 -b .sighup %patch9 -p1 -b .readme +%patch10 -p1 -b .static +%patch11 -p1 -b .markfs1 +%patch12 -p1 -b .markfs2 +%patch13 -p1 -b .markfs3 +%patch14 -p1 -b .markfs4 + +%patch15 -p1 -b .selinux2 + # generate rules for python sed -i "s|%python2_path%|`readlink -f %{__python2}`|g" rules.d/*.rules sed -i "s|%python3_path%|`readlink -f %{__python3}`|g" rules.d/*.rules @@ -263,6 +282,13 @@ fi %selinux_relabel_post -s %{selinuxtype} %changelog +* Tue Oct 25 2022 Radovan Sroka - 1.1.3-102.7 +RHEL 9.1.0.Z ERRATUM +- statically linked app can execute untrusted app +Resolves: rhbz#2137254 +- fapolicyd ineffective with systemd DynamicUser=yes +Resolves: rhbz#2137263 + * Fri Aug 05 2022 Radovan Sroka - 1.1.3-102 RHEL 9.1.0 ERRATUM - rebase fapolicyd to the latest stable vesion