commit d7679bd7cbb94692250a450bccf9f01cb982467f

Author: Mark Goodwin <mgoodwin@redhat.com>

Date:   Fri Feb 12 10:12:59 2021 +1100

    selinux, qa: allow pmcd to use netlink_tcpdiag_socket for sockets PMDA

    Add SELinux rules allowing pmcd to create, setopt, bind, getattr and

    nlmsg_read to netlink tcpdiag sockets. Needed by pmdasockets.

    Update qa/1622 and 917.

    Resolves: RHBZ#1926756

diff --git a/qa/1622 b/qa/1622

index 83f260d6d..f62b5f89a 100755

--- a/qa/1622

+++ b/qa/1622

@@ -216,6 +216,11 @@ type=AVC msg=audit(XXX.62): avc:  denied  { getattr open read } for  pid=YYYY co

 type=AVC msg=audit(XXX.63): avc:  denied  { connectto } for  pid=YYYY comm="pmdaX" name="/" dev="tracefs" ino=1 scontext=system_u:system_r:pcp_pmlogger_t:s0 tcontext=system_u:object_r:saslauthd_t:s0 tclass=unix_stream_socket permissive=0

 type=AVC msg=audit(XXX.66): avc:  denied  { sys_rawio } for  pid=YYYY comm="pmdaX" name="/" dev="tracefs" ino=1 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:pcp_pmcd_t:s0 tclass=capability permissive=0

 type=AVC msg=audit(XXX.67): avc:  denied  { module_request } for pid=YYYY comm="pmdalinux" kmod="netdev-tun0" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=system permissive=0

+type=AVC msg=audit(XXX.85): avc:  denied  { create } for  pid=YYYY comm="ss" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=netlink_tcpdiag_socket permissive=1

+type=AVC msg=audit(XXX.86): avc:  denied  { setopt } for  pid=YYYY comm="ss" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=netlink_tcpdiag_socket permissive=1

+type=AVC msg=audit(XXX.87): avc:  denied  { bind } for  pid=YYYY comm="ss" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=netlink_tcpdiag_socket permissive=1

+type=AVC msg=audit(XXX.88): avc:  denied  { getattr } for  pid=YYYY comm="ss" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=netlink_tcpdiag_socket permissive=1

+type=AVC msg=audit(XXX.89): avc:  denied  { nlmsg_read } for  pid=YYYY comm="ss" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=netlink_tcpdiag_socket permissive=1

 EOF

 echo "Silence is golden ... all AVC's are allowed by active policy"

diff --git a/qa/917.out.in b/qa/917.out.in

index 69c3b2d12..ddec57f9c 100644

--- a/qa/917.out.in

+++ b/qa/917.out.in

@@ -125,6 +125,7 @@ Checking policies.

   allow [pcp_pmcd_t] [drbd_exec_t] : [file] { execute execute_no_trans };

   allow [pcp_pmcd_t] self : [netlink_generic_socket] { bind create getattr setopt write read };

   allow [pcp_pmcd_t] [sbd_exec_t] : [file] { execute execute_no_trans };

+  allow [pcp_pmcd_t] self : [netlink_tcpdiag_socket] { bind create getattr nlmsg_read setopt };

   allow [pcp_pmcd_t] [etc_t] : [dir] { open read search getattr lock ioctl };

   allow [pcp_pmcd_t] [shadow_t] : [file] { getattr ioctl lock open read };

   allow [pcp_pmie_t] [etc_t] : [dir] { open read search getattr lock ioctl };

diff --git a/src/selinux/GNUlocaldefs b/src/selinux/GNUlocaldefs

index 30b67d907..cbfa34c14 100644

--- a/src/selinux/GNUlocaldefs

+++ b/src/selinux/GNUlocaldefs

@@ -118,5 +118,7 @@ endif

 ifeq "$(PCP_SELINUX_NETLINK_GENERIC_SOCKET_CLASS)" "true"

 PCP_NETLINK_GENERIC_SOCKET_CLASS="class netlink_generic_socket { bind create getattr setopt write read };"

+PCP_NETLINK_TCPDIAG_SOCKET_CLASS="class netlink_tcpdiag_socket { bind create getattr nlmsg_read setopt };"

 PCP_NETLINK_GENERIC_SOCKET_RULE="allow pcp_pmcd_t self:netlink_generic_socket { bind create getattr setopt write read };"

+PCP_NETLINK_TCPDIAG_SOCKET_RULE="allow pcp_pmcd_t self:netlink_tcpdiag_socket { bind create getattr nlmsg_read setopt };"

 endif

diff --git a/src/selinux/GNUmakefile b/src/selinux/GNUmakefile

index e16859d7e..d04644fcb 100644

--- a/src/selinux/GNUmakefile

+++ b/src/selinux/GNUmakefile

@@ -80,6 +80,8 @@ $(IAM).te: $(IAM).te.in

 		-e 's+@PCP_ICMP_SOCKET_RULE@+'$(PCP_ICMP_SOCKET_RULE)'+' \

 		-e 's+@PCP_NETLINK_GENERIC_SOCKET_CLASS@+'$(PCP_NETLINK_GENERIC_SOCKET_CLASS)'+' \

 		-e 's+@PCP_NETLINK_GENERIC_SOCKET_RULE@+'$(PCP_NETLINK_GENERIC_SOCKET_RULE)'+' \

+		-e 's+@PCP_NETLINK_TCPDIAG_SOCKET_CLASS@+'$(PCP_NETLINK_TCPDIAG_SOCKET_CLASS)'+' \

+		-e 's+@PCP_NETLINK_TCPDIAG_SOCKET_RULE@+'$(PCP_NETLINK_TCPDIAG_SOCKET_RULE)'+' \

 		-e 's+@PCP_SELINUX_MACRO_RULE@+'$(PCP_SELINUX_MACRO_RULE)'+' \

 		-e 's+@PACKAGE_VERSION@+'$(PACKAGE_VERSION)'+' \

diff --git a/src/selinux/pcpupstream.te.in b/src/selinux/pcpupstream.te.in

index 36a043be1..d935aee36 100644

--- a/src/selinux/pcpupstream.te.in

+++ b/src/selinux/pcpupstream.te.in

@@ -90,6 +90,7 @@ require {

         @PCP_BPF_CLASS@

 	class system { module_request };

 	@PCP_NETLINK_GENERIC_SOCKET_CLASS@

+	@PCP_NETLINK_TCPDIAG_SOCKET_CLASS@

 }

 #============= init_t ==============

@@ -423,3 +424,11 @@ allow pcp_pmcd_t drbd_exec_t:file { execute execute_no_trans };

 # pmda-hacluster requirements for checking sbd

 # type=AVC msg=audit(XXX.81): avc:  denied  { execute_no_trans } for  pid=421434 comm="sh" path="/usr/sbin/sbd" dev="vda1" ino=1050019 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:sbd_exec_t:s0 tclass=file permissive=1

 @PCP_SBD_EXEC_RULE@

+

+#=========== pmda-sockets ============

+# type=AVC msg=audit(XXX.85): avc:  denied  { create } for  pid=YYYY comm="ss" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=netlink_tcpdiag_socket permissive=1

+# type=AVC msg=audit(XXX.86): avc:  denied  { setopt } for  pid=YYYY comm="ss" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=netlink_tcpdiag_socket permissive=1

+# type=AVC msg=audit(XXX.87): avc:  denied  { bind } for  pid=YYYY comm="ss" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=netlink_tcpdiag_socket permissive=1

+# type=AVC msg=audit(XXX.88): avc:  denied  { getattr } for  pid=YYYY comm="ss" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=netlink_tcpdiag_socket permissive=1

+# type=AVC msg=audit(XXX.89): avc:  denied  { nlmsg_read } for  pid=YYYY comm="ss" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=netlink_tcpdiag_socket permissive=1

+@PCP_NETLINK_TCPDIAG_SOCKET_RULE@

commit a49772607d80b25b2ae4b8764be709bb27d7e16f

Author: Mark Goodwin <mgoodwin@redhat.com>

Date:   Fri Feb 12 10:09:23 2021 +1100

    pmdasockets: minor changes to Install and Remove, add -U username

    Specify pmns_name in Install and Remove scripts since the pmda name

    differs to the namespace. Add -U username for optional use when run

    as a daemon.

diff --git a/src/pmdas/linux_sockets/GNUmakefile b/src/pmdas/linux_sockets/GNUmakefile

index 34897f2e9..a32987ef7 100644

--- a/src/pmdas/linux_sockets/GNUmakefile

+++ b/src/pmdas/linux_sockets/GNUmakefile

@@ -31,7 +31,7 @@ HFILES		= indom.h cluster.h ss_stats.h

 LLDLIBS		= $(PCP_PMDALIB)

 LCFLAGS		= $(INVISIBILITY)

-SCRIPTS		= Install Remove

+SCRIPTS		= Install Remove Upgrade

 VERSION_SCRIPT	= exports

 LDIRT		= domain.h $(VERSION_SCRIPT) $(IAM).log

diff --git a/src/pmdas/linux_sockets/Install b/src/pmdas/linux_sockets/Install

index 4bc934c96..28d7c7f9e 100755

--- a/src/pmdas/linux_sockets/Install

+++ b/src/pmdas/linux_sockets/Install

@@ -1,4 +1,4 @@

-#! /bin/sh

+#!/usr/bin/sh

 #

 # Copyright (c) 2021 Red Hat.

 # 

@@ -25,6 +25,8 @@ dso_opt=true

 pipe_opt=false

 daemon_opt=false

+pmns_name=network.persocket	# differs to PMDA name

+

 which ss >/dev/null 2>&1

 if [ $? -ne 0 ]

 then

diff --git a/src/pmdas/linux_sockets/Remove b/src/pmdas/linux_sockets/Remove

index 26edc85aa..3fee6a0e6 100755

--- a/src/pmdas/linux_sockets/Remove

+++ b/src/pmdas/linux_sockets/Remove

@@ -1,4 +1,4 @@

-#! /bin/sh

+#!/usr/bin/sh

 #

 # Copyright (c) 2021 Red Hat.

 # 

@@ -19,6 +19,7 @@

 . $PCP_SHARE_DIR/lib/pmdaproc.sh

 iam=sockets

+pmns_name=network.persocket	# differs to PMDA name

 pmdaSetup

 pmdaRemove

diff --git a/src/pmdas/linux_sockets/pmda.c b/src/pmdas/linux_sockets/pmda.c

index 9bca5d9d0..fab4be290 100644

--- a/src/pmdas/linux_sockets/pmda.c

+++ b/src/pmdas/linux_sockets/pmda.c

@@ -23,6 +23,7 @@

 #include "ss_stats.h"

 static int		_isDSO = 1; /* for local contexts */

+static char		*username;

 /* metrics supported in this PMDA - see metrictab.c */

 extern pmdaMetric metrictable[];

@@ -200,6 +201,8 @@ sockets_init(pmdaInterface *dp)

 		pmGetConfig("PCP_PMDAS_DIR"), sep, sep);

 	pmdaDSO(dp, PMDA_INTERFACE_7, "SOCKETS DSO", helppath);

     }

+    else

+	pmSetProcessIdentity(username);

     if (dp->status != 0)

 	return;

@@ -227,12 +230,13 @@ static pmLongOptions longopts[] = {

     PMOPT_DEBUG,

     PMDAOPT_DOMAIN,

     PMDAOPT_LOGFILE,

+    PMDAOPT_USERNAME,

     PMOPT_HELP,

     PMDA_OPTIONS_END

 };

 static pmdaOptions opts = {

-    .short_options = "D:d:l:?",

+    .short_options = "D:d:l:U:?",

     .long_options = longopts,

 };

@@ -248,6 +252,7 @@ main(int argc, char **argv)

     _isDSO = 0;

     pmSetProgname(argv[0]);

+    pmGetUsername(&username);

     pmsprintf(helppath, sizeof(helppath), "%s%c" "sockets" "%c" "help",

 		pmGetConfig("PCP_PMDAS_DIR"), sep, sep);

     pmdaDaemon(&dispatch, PMDA_INTERFACE_7, pmGetProgname(), SOCKETS, "sockets.log", helppath);

@@ -257,6 +262,8 @@ main(int argc, char **argv)

 	pmdaUsageMessage(&opts);

 	exit(1);

     }

+    if (opts.username)

+	username = opts.username;

     pmdaOpenLog(&dispatch);

     sockets_init(&dispatch);