|
 |
7238b3 |
From 3c556c3386ffc2e4f722d90a723d9e97e9b72a66 Mon Sep 17 00:00:00 2001
|
|
|
7238b3 |
From: Christian Kellner <christian@kellner.me>
|
|
|
7238b3 |
Date: Sun, 9 Aug 2020 13:09:06 +0200
|
|
|
7238b3 |
Subject: [PATCH] selinux: allow nnp and nosuid transitions
|
|
|
7238b3 |
|
|
|
7238b3 |
Allow osbuild_t to no_new_privs (nnp) and nosuid domain transition
|
|
|
7238b3 |
into setfiles_mac_t and install_t. nnp is a inheritable per-thread
|
|
|
7238b3 |
flag (PR_SET_NO_NEW_PRIVS, see prctl(2)), whereby a promise is made
|
|
|
7238b3 |
by execve(2) to not grant any new privileges that could not have
|
|
|
7238b3 |
been done without the execv call. This is on contrast to what can
|
|
|
7238b3 |
be done via SELinux rules, i.e. in our case `setfiles_mac_t` and
|
|
|
7238b3 |
`install_t` can set arbitrary SELinux labels, but `osbuild_t`
|
|
|
7238b3 |
itself can not; but `osbuild_t` enables the transitioning of
|
|
|
7238b3 |
`setfiles_mac_t` for the `setfiles` binary via execve(2) from a
|
|
|
7238b3 |
process with `osbuild_t`. Related, the nosuid mount flag, prevents
|
|
|
7238b3 |
the suid, sgid bits to be interpreted and thus are in the same
|
|
|
7238b3 |
spirit as nnp, i.e. no new privs during execve(2).
|
|
|
7238b3 |
|
|
|
7238b3 |
Thus SELinux domain transitions stand in contrast with nnp and
|
|
|
7238b3 |
nosuid transitions, and have therefore been de-coupled. See also
|
|
|
7238b3 |
the corresponding kernel patch at [1] for more information.
|
|
|
7238b3 |
|
|
|
7238b3 |
bubblewrap (bwrap) in contrast to `systemd-nspawn` always sets the
|
|
|
7238b3 |
nnp flag, as well as the nosuid option for all bind-mounts. Since
|
|
|
7238b3 |
we no use bwrap to contain processes we need to allow the nnp and
|
|
|
7238b3 |
nosuid transitions from `osbuild_t` to `setfiles_mac_t` and
|
|
|
7238b3 |
`install_t`.
|
|
|
7238b3 |
|
|
|
7238b3 |
[1] https://patchwork.kernel.org/patch/9841441/
|
|
|
7238b3 |
---
|
|
|
7238b3 |
selinux/osbuild.if | 19 +++++++++++++++++++
|
|
|
7238b3 |
selinux/osbuild.te | 2 ++
|
|
|
7238b3 |
2 files changed, 21 insertions(+)
|
|
|
7238b3 |
|
|
|
7238b3 |
diff --git a/selinux/osbuild.if b/selinux/osbuild.if
|
|
|
7238b3 |
index 815c691..48d099f 100644
|
|
|
7238b3 |
--- a/selinux/osbuild.if
|
|
|
7238b3 |
+++ b/selinux/osbuild.if
|
|
|
7238b3 |
@@ -93,3 +93,22 @@ interface(`osbuild_role',`
|
|
|
7238b3 |
ps_process_pattern($2, osbuild_t)
|
|
|
7238b3 |
allow $2 osbuild_t:process { signull signal sigkill };
|
|
|
7238b3 |
')
|
|
|
7238b3 |
+
|
|
|
7238b3 |
+########################################
|
|
|
7238b3 |
+## <summary>
|
|
|
7238b3 |
+## osbuild nnp / nosuid transitions to domain
|
|
|
7238b3 |
+## </summary>
|
|
|
7238b3 |
+## <param name="domain">
|
|
|
7238b3 |
+## <summary>
|
|
|
7238b3 |
+## Domain to be allowed to transition into.
|
|
|
7238b3 |
+## </summary>
|
|
|
7238b3 |
+## </param>
|
|
|
7238b3 |
+#
|
|
|
7238b3 |
+interface(`osbuild_nnp_nosuid_trans',`
|
|
|
7238b3 |
+ gen_require(`
|
|
|
7238b3 |
+ type osbuild_t;
|
|
|
7238b3 |
+ class process2 { nnp_transition nosuid_transition };
|
|
|
7238b3 |
+ ')
|
|
|
7238b3 |
+
|
|
|
7238b3 |
+ allow osbuild_t $1:process2 {nnp_transition nosuid_transition};
|
|
|
7238b3 |
+')
|
|
|
7238b3 |
diff --git a/selinux/osbuild.te b/selinux/osbuild.te
|
|
|
7238b3 |
index 1a5f98d..e4a0c7d 100644
|
|
|
7238b3 |
--- a/selinux/osbuild.te
|
|
|
7238b3 |
+++ b/selinux/osbuild.te
|
|
|
7238b3 |
@@ -31,6 +31,7 @@ unconfined_domain(osbuild_t)
|
|
|
7238b3 |
# execute setfiles in the setfiles_mac domain
|
|
|
7238b3 |
# when in the osbuild_t domain
|
|
|
7238b3 |
seutil_domtrans_setfiles_mac(osbuild_t)
|
|
|
7238b3 |
+osbuild_nnp_nosuid_trans(setfiles_mac_t)
|
|
|
7238b3 |
|
|
|
7238b3 |
# Allow sysadm and unconfined to run osbuild
|
|
|
7238b3 |
optional_policy(`
|
|
|
7238b3 |
@@ -63,4 +64,5 @@ optional_policy(`
|
|
|
7238b3 |
# allow transitioning to install_t (for ostree)
|
|
|
7238b3 |
optional_policy(`
|
|
|
7238b3 |
anaconda_domtrans_install(osbuild_t)
|
|
|
7238b3 |
+ osbuild_nnp_nosuid_trans(install_t)
|
|
|
7238b3 |
')
|
|
|
7238b3 |
--
|
|
|
7238b3 |
2.26.2
|
|
|
7238b3 |
|