commit d7679bd7cbb94692250a450bccf9f01cb982467f
Author: Mark Goodwin <mgoodwin@redhat.com>
Date: Fri Feb 12 10:12:59 2021 +1100
selinux, qa: allow pmcd to use netlink_tcpdiag_socket for sockets PMDA
Add SELinux rules allowing pmcd to create, setopt, bind, getattr and
nlmsg_read to netlink tcpdiag sockets. Needed by pmdasockets.
Update qa/1622 and 917.
Resolves: RHBZ#1926756
diff --git a/qa/1622 b/qa/1622
index 83f260d6d..f62b5f89a 100755
--- a/qa/1622
+++ b/qa/1622
@@ -216,6 +216,11 @@ type=AVC msg=audit(XXX.62): avc: denied { getattr open read } for pid=YYYY co
type=AVC msg=audit(XXX.63): avc: denied { connectto } for pid=YYYY comm="pmdaX" name="/" dev="tracefs" ino=1 scontext=system_u:system_r:pcp_pmlogger_t:s0 tcontext=system_u:object_r:saslauthd_t:s0 tclass=unix_stream_socket permissive=0
type=AVC msg=audit(XXX.66): avc: denied { sys_rawio } for pid=YYYY comm="pmdaX" name="/" dev="tracefs" ino=1 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:pcp_pmcd_t:s0 tclass=capability permissive=0
type=AVC msg=audit(XXX.67): avc: denied { module_request } for pid=YYYY comm="pmdalinux" kmod="netdev-tun0" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=system permissive=0
+type=AVC msg=audit(XXX.85): avc: denied { create } for pid=YYYY comm="ss" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=netlink_tcpdiag_socket permissive=1
+type=AVC msg=audit(XXX.86): avc: denied { setopt } for pid=YYYY comm="ss" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=netlink_tcpdiag_socket permissive=1
+type=AVC msg=audit(XXX.87): avc: denied { bind } for pid=YYYY comm="ss" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=netlink_tcpdiag_socket permissive=1
+type=AVC msg=audit(XXX.88): avc: denied { getattr } for pid=YYYY comm="ss" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=netlink_tcpdiag_socket permissive=1
+type=AVC msg=audit(XXX.89): avc: denied { nlmsg_read } for pid=YYYY comm="ss" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=netlink_tcpdiag_socket permissive=1
EOF
echo "Silence is golden ... all AVC's are allowed by active policy"
diff --git a/qa/917.out.in b/qa/917.out.in
index 69c3b2d12..ddec57f9c 100644
--- a/qa/917.out.in
+++ b/qa/917.out.in
@@ -125,6 +125,7 @@ Checking policies.
allow [pcp_pmcd_t] [drbd_exec_t] : [file] { execute execute_no_trans };
allow [pcp_pmcd_t] self : [netlink_generic_socket] { bind create getattr setopt write read };
allow [pcp_pmcd_t] [sbd_exec_t] : [file] { execute execute_no_trans };
+ allow [pcp_pmcd_t] self : [netlink_tcpdiag_socket] { bind create getattr nlmsg_read setopt };
allow [pcp_pmcd_t] [etc_t] : [dir] { open read search getattr lock ioctl };
allow [pcp_pmcd_t] [shadow_t] : [file] { getattr ioctl lock open read };
allow [pcp_pmie_t] [etc_t] : [dir] { open read search getattr lock ioctl };
diff --git a/src/selinux/GNUlocaldefs b/src/selinux/GNUlocaldefs
index 30b67d907..cbfa34c14 100644
--- a/src/selinux/GNUlocaldefs
+++ b/src/selinux/GNUlocaldefs
@@ -118,5 +118,7 @@ endif
ifeq "$(PCP_SELINUX_NETLINK_GENERIC_SOCKET_CLASS)" "true"
PCP_NETLINK_GENERIC_SOCKET_CLASS="class netlink_generic_socket { bind create getattr setopt write read };"
+PCP_NETLINK_TCPDIAG_SOCKET_CLASS="class netlink_tcpdiag_socket { bind create getattr nlmsg_read setopt };"
PCP_NETLINK_GENERIC_SOCKET_RULE="allow pcp_pmcd_t self:netlink_generic_socket { bind create getattr setopt write read };"
+PCP_NETLINK_TCPDIAG_SOCKET_RULE="allow pcp_pmcd_t self:netlink_tcpdiag_socket { bind create getattr nlmsg_read setopt };"
endif
diff --git a/src/selinux/GNUmakefile b/src/selinux/GNUmakefile
index e16859d7e..d04644fcb 100644
--- a/src/selinux/GNUmakefile
+++ b/src/selinux/GNUmakefile
@@ -80,6 +80,8 @@ $(IAM).te: $(IAM).te.in
-e 's+@PCP_ICMP_SOCKET_RULE@+'$(PCP_ICMP_SOCKET_RULE)'+' \
-e 's+@PCP_NETLINK_GENERIC_SOCKET_CLASS@+'$(PCP_NETLINK_GENERIC_SOCKET_CLASS)'+' \
-e 's+@PCP_NETLINK_GENERIC_SOCKET_RULE@+'$(PCP_NETLINK_GENERIC_SOCKET_RULE)'+' \
+ -e 's+@PCP_NETLINK_TCPDIAG_SOCKET_CLASS@+'$(PCP_NETLINK_TCPDIAG_SOCKET_CLASS)'+' \
+ -e 's+@PCP_NETLINK_TCPDIAG_SOCKET_RULE@+'$(PCP_NETLINK_TCPDIAG_SOCKET_RULE)'+' \
-e 's+@PCP_SELINUX_MACRO_RULE@+'$(PCP_SELINUX_MACRO_RULE)'+' \
-e 's+@PACKAGE_VERSION@+'$(PACKAGE_VERSION)'+' \
diff --git a/src/selinux/pcpupstream.te.in b/src/selinux/pcpupstream.te.in
index 36a043be1..d935aee36 100644
--- a/src/selinux/pcpupstream.te.in
+++ b/src/selinux/pcpupstream.te.in
@@ -90,6 +90,7 @@ require {
@PCP_BPF_CLASS@
class system { module_request };
@PCP_NETLINK_GENERIC_SOCKET_CLASS@
+ @PCP_NETLINK_TCPDIAG_SOCKET_CLASS@
}
#============= init_t ==============
@@ -423,3 +424,11 @@ allow pcp_pmcd_t drbd_exec_t:file { execute execute_no_trans };
# pmda-hacluster requirements for checking sbd
# type=AVC msg=audit(XXX.81): avc: denied { execute_no_trans } for pid=421434 comm="sh" path="/usr/sbin/sbd" dev="vda1" ino=1050019 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:sbd_exec_t:s0 tclass=file permissive=1
@PCP_SBD_EXEC_RULE@
+
+#=========== pmda-sockets ============
+# type=AVC msg=audit(XXX.85): avc: denied { create } for pid=YYYY comm="ss" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=netlink_tcpdiag_socket permissive=1
+# type=AVC msg=audit(XXX.86): avc: denied { setopt } for pid=YYYY comm="ss" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=netlink_tcpdiag_socket permissive=1
+# type=AVC msg=audit(XXX.87): avc: denied { bind } for pid=YYYY comm="ss" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=netlink_tcpdiag_socket permissive=1
+# type=AVC msg=audit(XXX.88): avc: denied { getattr } for pid=YYYY comm="ss" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=netlink_tcpdiag_socket permissive=1
+# type=AVC msg=audit(XXX.89): avc: denied { nlmsg_read } for pid=YYYY comm="ss" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=netlink_tcpdiag_socket permissive=1
+@PCP_NETLINK_TCPDIAG_SOCKET_RULE@
commit a49772607d80b25b2ae4b8764be709bb27d7e16f
Author: Mark Goodwin <mgoodwin@redhat.com>
Date: Fri Feb 12 10:09:23 2021 +1100
pmdasockets: minor changes to Install and Remove, add -U username
Specify pmns_name in Install and Remove scripts since the pmda name
differs to the namespace. Add -U username for optional use when run
as a daemon.
diff --git a/src/pmdas/linux_sockets/GNUmakefile b/src/pmdas/linux_sockets/GNUmakefile
index 34897f2e9..a32987ef7 100644
--- a/src/pmdas/linux_sockets/GNUmakefile
+++ b/src/pmdas/linux_sockets/GNUmakefile
@@ -31,7 +31,7 @@ HFILES = indom.h cluster.h ss_stats.h
LLDLIBS = $(PCP_PMDALIB)
LCFLAGS = $(INVISIBILITY)
-SCRIPTS = Install Remove
+SCRIPTS = Install Remove Upgrade
VERSION_SCRIPT = exports
LDIRT = domain.h $(VERSION_SCRIPT) $(IAM).log
diff --git a/src/pmdas/linux_sockets/Install b/src/pmdas/linux_sockets/Install
index 4bc934c96..28d7c7f9e 100755
--- a/src/pmdas/linux_sockets/Install
+++ b/src/pmdas/linux_sockets/Install
@@ -1,4 +1,4 @@
-#! /bin/sh
+#!/usr/bin/sh
#
# Copyright (c) 2021 Red Hat.
#
@@ -25,6 +25,8 @@ dso_opt=true
pipe_opt=false
daemon_opt=false
+pmns_name=network.persocket # differs to PMDA name
+
which ss >/dev/null 2>&1
if [ $? -ne 0 ]
then
diff --git a/src/pmdas/linux_sockets/Remove b/src/pmdas/linux_sockets/Remove
index 26edc85aa..3fee6a0e6 100755
--- a/src/pmdas/linux_sockets/Remove
+++ b/src/pmdas/linux_sockets/Remove
@@ -1,4 +1,4 @@
-#! /bin/sh
+#!/usr/bin/sh
#
# Copyright (c) 2021 Red Hat.
#
@@ -19,6 +19,7 @@
. $PCP_SHARE_DIR/lib/pmdaproc.sh
iam=sockets
+pmns_name=network.persocket # differs to PMDA name
pmdaSetup
pmdaRemove
diff --git a/src/pmdas/linux_sockets/pmda.c b/src/pmdas/linux_sockets/pmda.c
index 9bca5d9d0..fab4be290 100644
--- a/src/pmdas/linux_sockets/pmda.c
+++ b/src/pmdas/linux_sockets/pmda.c
@@ -23,6 +23,7 @@
#include "ss_stats.h"
static int _isDSO = 1; /* for local contexts */
+static char *username;
/* metrics supported in this PMDA - see metrictab.c */
extern pmdaMetric metrictable[];
@@ -200,6 +201,8 @@ sockets_init(pmdaInterface *dp)
pmGetConfig("PCP_PMDAS_DIR"), sep, sep);
pmdaDSO(dp, PMDA_INTERFACE_7, "SOCKETS DSO", helppath);
}
+ else
+ pmSetProcessIdentity(username);
if (dp->status != 0)
return;
@@ -227,12 +230,13 @@ static pmLongOptions longopts[] = {
PMOPT_DEBUG,
PMDAOPT_DOMAIN,
PMDAOPT_LOGFILE,
+ PMDAOPT_USERNAME,
PMOPT_HELP,
PMDA_OPTIONS_END
};
static pmdaOptions opts = {
- .short_options = "D:d:l:?",
+ .short_options = "D:d:l:U:?",
.long_options = longopts,
};
@@ -248,6 +252,7 @@ main(int argc, char **argv)
_isDSO = 0;
pmSetProgname(argv[0]);
+ pmGetUsername(&username);
pmsprintf(helppath, sizeof(helppath), "%s%c" "sockets" "%c" "help",
pmGetConfig("PCP_PMDAS_DIR"), sep, sep);
pmdaDaemon(&dispatch, PMDA_INTERFACE_7, pmGetProgname(), SOCKETS, "sockets.log", helppath);
@@ -257,6 +262,8 @@ main(int argc, char **argv)
pmdaUsageMessage(&opts);
exit(1);
}
+ if (opts.username)
+ username = opts.username;
pmdaOpenLog(&dispatch);
sockets_init(&dispatch);