From d1c159d4400722e783d12cc3684c1cf15004f7a9 Mon Sep 17 00:00:00 2001 From: Yi Zhao Date: Thu, 24 Sep 2020 14:05:52 +0800 Subject: [PATCH] policy/modules/system/sysnetwork: support priviledge separation for dhcpcd Fixes: avc: denied { sys_chroot } for pid=332 comm="dhcpcd" capability=18 scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tclass=capability permissive=0 avc: denied { setgid } for pid=332 comm="dhcpcd" capability=6 scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tclass=capability permissive=0 avc: denied { setuid } for pid=332 comm="dhcpcd" capability=7 scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tclass=capability permissive=0 avc: denied { setrlimit } for pid=332 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tclass=process permissive=0 avc: denied { create } for pid=330 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tclass=netlink_kobject_uevent_socket permissive=0 avc: denied { setopt } for pid=330 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tclass=netlink_kobject_uevent_socket permissive=0 avc: denied { bind } for pid=330 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tclass=netlink_kobject_uevent_socket permissive=0 avc: denied { getattr } for pid=330 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tclass=netlink_kobject_uevent_socket permissive=0 avc: denied { read } for pid=330 comm="dhcpcd" name="n1" dev="tmpfs" ino=15616 scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tcontext=system_u:object_r:udev_runtime_t:s0 tclass=file permissive=0 avc: denied { open } for pid=330 comm="dhcpcd" path="/run/udev/data/n1" dev="tmpfs" ino=15616 scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tcontext=system_u:object_r:udev_runtime_t:s0 tclass=file permissive=0 avc: denied { getattr } for pid=330 comm="dhcpcd" path="/run/udev/data/n1" dev="tmpfs" ino=15616 scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tcontext=system_u:object_r:udev_runtime_t:s0 tclass=file permissive=0 avc: denied { connectto } for pid=1600 comm="dhcpcd" path="/run/dhcpcd/unpriv.sock" scontext=root:sysadm_r:dhcpc_t:s0-s15:c0.c1023 tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tclass=unix_stream_socket permissive=0 avc: denied { kill } for pid=314 comm="dhcpcd" capability=5 scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tclass=capability permissive=0 avc: denied { getattr } for pid=300 comm="dhcpcd" path="net:[4026532008]" dev="nsfs" ino=4026532008 scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tcontext=system_u:object_r:nsfs_t:s0 tclass=file permissive=0 Upstream-Status: Inappropriate [embedded specific] Signed-off-by: Yi Zhao --- policy/modules/system/sysnetwork.te | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/policy/modules/system/sysnetwork.te b/policy/modules/system/sysnetwork.te index 4c317cc4c..05a9a52b8 100644 --- a/policy/modules/system/sysnetwork.te +++ b/policy/modules/system/sysnetwork.te @@ -58,10 +58,11 @@ ifdef(`distro_debian',` # DHCP client local policy # allow dhcpc_t self:capability { dac_override fsetid net_admin net_bind_service net_raw setpcap sys_nice sys_resource sys_tty_config }; +allow dhcpc_t self:capability { setgid setuid sys_chroot kill }; dontaudit dhcpc_t self:capability { sys_ptrace sys_tty_config }; # for access("/etc/bashrc", X_OK) on Red Hat dontaudit dhcpc_t self:capability { dac_read_search sys_module }; -allow dhcpc_t self:process { getsched getcap setcap setfscreate ptrace signal_perms }; +allow dhcpc_t self:process { getsched getcap setcap setfscreate ptrace signal_perms setrlimit }; allow dhcpc_t self:fifo_file rw_fifo_file_perms; allow dhcpc_t self:tcp_socket create_stream_socket_perms; @@ -69,8 +70,10 @@ allow dhcpc_t self:udp_socket create_socket_perms; allow dhcpc_t self:packet_socket create_socket_perms; allow dhcpc_t self:netlink_generic_socket create_socket_perms; allow dhcpc_t self:netlink_route_socket create_netlink_socket_perms; +allow dhcpc_t self:netlink_kobject_uevent_socket create_socket_perms; allow dhcpc_t self:rawip_socket create_socket_perms; allow dhcpc_t self:unix_dgram_socket { create_socket_perms sendto }; +allow dhcpc_t self:unix_stream_socket connectto; allow dhcpc_t dhcp_etc_t:dir list_dir_perms; read_lnk_files_pattern(dhcpc_t, dhcp_etc_t, dhcp_etc_t) @@ -146,6 +149,7 @@ files_manage_var_files(dhcpc_t) fs_getattr_all_fs(dhcpc_t) fs_search_auto_mountpoints(dhcpc_t) fs_search_cgroup_dirs(dhcpc_t) +fs_read_nsfs_files(dhcpc_t) term_dontaudit_use_all_ttys(dhcpc_t) term_dontaudit_use_all_ptys(dhcpc_t) @@ -181,6 +185,7 @@ ifdef(`init_systemd',` init_stream_connect(dhcpc_t) init_get_all_units_status(dhcpc_t) init_search_units(dhcpc_t) + udev_read_runtime_files(dhcpc_t) ') optional_policy(` -- 2.17.1