From patchwork Fri Sep 23 14:28:44 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gary Tierney X-Patchwork-Id: 9348225 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 95D436077A for ; Fri, 23 Sep 2016 14:30:50 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 8692B2ABC2 for ; Fri, 23 Sep 2016 14:30:50 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 7B1662ABEF; Fri, 23 Sep 2016 14:30:50 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00,FREEMAIL_FROM, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from emsm-gh1-uea11.nsa.gov (emsm-gh1-uea11.nsa.gov [8.44.101.9]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id BB5CA2ABED for ; Fri, 23 Sep 2016 14:30:48 +0000 (UTC) X-IronPort-AV: E=Sophos;i="5.30,381,1470700800"; d="scan'208";a="19503625" IronPort-PHdr: =?us-ascii?q?9a23=3AH/IsVRGvtZiBsbFdkztPRZ1GYnF86YWxBRYc798d?= =?us-ascii?q?s5kLTJ75rsuwAkXT6L1XgUPTWs2DsrQf2rCQ6/+rBjBIyK3CmUhKSIZLWR4BhJ?= =?us-ascii?q?detC0bK+nBN3fGKuX3ZTcxBsVIWQwt1Xi6NU9IBJS2PAWK8TWM5DIfUi/yKRBy?= =?us-ascii?q?brysXNWD1YLviKvtp9X6WEZhvHKFe7R8LRG7/036l/I9ps9cEJs30QbDuXBSeu?= =?us-ascii?q?5blitCLFOXmAvgtI/rpMYwuxlKv7od0+IIEeCjJ+Vre4Z2J3FjE2wvofb2rgHO?= =?us-ascii?q?RhfK4nwDGiVL00l+OSbuqVTaUo20iTbhrud2xGHaZ5W3HvgIXmG54qNqTgL4oD?= =?us-ascii?q?sWPD4+tmfMg4p/i7wIjgimoklQypTFKL2UOeB4c7KVKdwTX3sHQsdcTSpME6uz?= =?us-ascii?q?aptJBO0Ea7UL57LhrkcD+EPtTTKnA/nin2YViw=3D=3D?= X-IPAS-Result: =?us-ascii?q?A2FcBAAvO+VX/wHyM5BdGgEBAQECAQEBAQgBAQEBFwEBBAE?= =?us-ascii?q?BCgEBgxABAQEBAR6BU7p4IIdjTAEBAQEBAQEBAgECWyeCMgQDAxWCEQIEAQIkE?= =?us-ascii?q?xQgDgMJAQEXJwIICAMBLRURDgsFGASIDwEDFwSkEJQvAYROhjeCBIUXgU8RAYV?= =?us-ascii?q?6AQSONItCgWWYAIVukGdUhQZxhFh4gScBAQE?= Received: from unknown (HELO tarius.tycho.ncsc.mil) ([144.51.242.1]) by emsm-gh1-uea11.nsa.gov with ESMTP; 23 Sep 2016 14:30:39 +0000 Received: from prometheus.infosec.tycho.ncsc.mil (prometheus [192.168.25.40]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id u8NETIQu027849; Fri, 23 Sep 2016 10:29:36 -0400 Received: from tarius.tycho.ncsc.mil (tarius.infosec.tycho.ncsc.mil [144.51.242.1]) by prometheus.infosec.tycho.ncsc.mil (8.15.2/8.15.2) with ESMTP id u8NETGpS197349 for ; Fri, 23 Sep 2016 10:29:16 -0400 Received: from goalie.tycho.ncsc.mil (goalie [144.51.242.250]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id u8NETFb3027846 for ; Fri, 23 Sep 2016 10:29:15 -0400 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: A1AfAQCUO+VXhxYR49RdGwEBBAEBCgEBgzwBAQEBAYFxpSkEkT+EE4YeAoFcTAECAQEBAQECEwEBAQgNCQkZhRECAQMnYj8SVxmIMAEDG6QRlC8BhB0BCyWGN4IEhReESQuDBwWONItCgWWdbpBng36BXHGGdwEBAQ X-IPAS-Result: A1AfAQCUO+VXhxYR49RdGwEBBAEBCgEBgzwBAQEBAYFxpSkEkT+EE4YeAoFcTAECAQEBAQECEwEBAQgNCQkZhRECAQMnYj8SVxmIMAEDG6QRlC8BhB0BCyWGN4IEhReESQuDBwWONItCgWWdbpBng36BXHGGdwEBAQ X-IronPort-AV: E=Sophos;i="5.30,381,1470715200"; d="scan'208";a="5725195" Received: from emsm-gh1-uea11.corp.nsa.gov (HELO emsm-gh1-uea11.nsa.gov) ([10.208.41.37]) by goalie.tycho.ncsc.mil with ESMTP; 23 Sep 2016 10:29:11 -0400 IronPort-PHdr: =?us-ascii?q?9a23=3ArJJcLBWeliU3EDRWjEHms01OBjTV8LGtZVwlr6E/?= =?us-ascii?q?grcLSJyIuqrYZhyEt8tkgFKBZ4jH8fUM07OQ6PG6HzRfqsnd+Fk5M7V0Hycfjs?= =?us-ascii?q?sXmwFySOWkMmbcaMDQUiohAc5ZX0Vk9XzoeWJcGcL5ekGA6ibqtW1aJBzzOEJP?= =?us-ascii?q?K/jvHcaK1oLshrr0o8KYPFkArQH+SIs6FA+xowTVu5teqqpZAYF19CH0pGBVcf?= =?us-ascii?q?9d32JiKAHbtR/94sCt4MwrqHwI6LoXzeBrFODac759dqFDFDktLyUx49Kj9USC?= =?us-ascii?q?Hj21yFBZF0UaiF9zHhPd4RrmFter6mqp/tZ6jTKXOczwUKAcRSWp76AtTgThzi?= =?us-ascii?q?gAKW0X6mbS3+N5lrMTnBOsvRpy0saAb4iPJbxif67He94LbWVEToBaUCkXUdD0?= =?us-ascii?q?VJcGE+dUZbUQlIL6vVZb90az?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0HwAQAvO+VXhxYR49RdHAEFAQsBgzwBA?= =?us-ascii?q?QEBAYFxpSkEkT+EE4YeAoFcTAEBAQEBAQEBAgECEAEBAQgNCQkZL4IyBAMDFYI?= =?us-ascii?q?RAgEDJ2I/ElcZiDABAxukEJQvAYQdAQslhjeCBIUXhEkLgwcFjjSLQoFlnW6QZ?= =?us-ascii?q?4N+gVxxhTgDAYE7AQEB?= X-IPAS-Result: =?us-ascii?q?A0HwAQAvO+VXhxYR49RdHAEFAQsBgzwBAQEBAYFxpSkEkT+?= =?us-ascii?q?EE4YeAoFcTAEBAQEBAQEBAgECEAEBAQgNCQkZL4IyBAMDFYIRAgEDJ2I/ElcZi?= =?us-ascii?q?DABAxukEJQvAYQdAQslhjeCBIUXhEkLgwcFjjSLQoFlnW6QZ4N+gVxxhTgDAYE?= =?us-ascii?q?7AQEB?= X-IronPort-AV: E=Sophos;i="5.30,381,1470700800"; d="scan'208";a="19503533" Received: from mout.gmx.net ([212.227.17.22]) by emsm-gh1-uea11.nsa.gov with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 23 Sep 2016 14:29:06 +0000 Received: from workstation.fluency.net.uk ([185.34.9.224]) by mail.gmx.com (mrgmx101) with ESMTPSA (Nemesis) id 0M8ZtH-1b1Vsg0Yx1-00wAJD for ; Fri, 23 Sep 2016 16:29:05 +0200 From: Gary Tierney To: selinux@tycho.nsa.gov Subject: [PATCH 1/1] genhomedircon: support policies using RBACSEP Date: Fri, 23 Sep 2016 15:28:44 +0100 Message-Id: <1062ebe32922aec79a0232acfdd0005e9ce124da.1474639773.git.gary.tierney@gmx.com> X-Mailer: git-send-email 2.4.11 In-Reply-To: References: In-Reply-To: References: X-Provags-ID: V03:K0:ilEQET9uJxCvPujr1dxItHQD/KFKqPRLVTGyYBuCGvK8MV2JDyL w5F2H5Wh21swYGpHK97po5jQgJWX0gEqT1Oy/2nwHzodulo3JMd67CfncZGkO+rRY0vgcCf kp+39QOWqqPtIVTK5hJq+G2IsSnQL7mKnqgKxvnABZO45Y69V1zLQXvRMdiB+e7w1jaYKJp Hl00g4ZXl5d/8ZgLDLh/w== X-UI-Out-Filterresults: notjunk:1; V01:K0:/mmRXEHM4j0=:tIOCzDoUiQngoab4kQU8/h fzZWe17l6EdR9TJPyu04NainlWc8EU6wNH1i7g1mxepnNToBgijpLTJEIo8/HIktXbfpWgNiq ib7UiBME3bMtc9CPXtdTT10RAzjqPZcVVOMhl7rvUMqP7x0WBau8gRmD0nIa0lYpnQeYa4OKx B1hXLZvo0XFyJKjeDC8kw+7BkdLTaqi0Bp9TeC/afyWiZ478kRCBulcrZxPnWbI7jORKxZ7Oj TfW6vE847qnZrbsxzJRCREypF0BwmmCby85jFFrbFWjBskprSlTr+qJlIlkECtcHBCbtemEBg O/y8ZQEuW9pqlSSZbR8j/+56/ZbV2X36g57S/2ef7BX7nPN/EgY02VbFC5xZD4X0z/I3pBd1S 004ZWaOvwxNvi/+aMKatD65bIfjmHMj8ik0pUg4RuRtRnxy/ohm7/NmGkHJ/ub+ThsnJQrjJG npINBf/5m9g0MRa+kD4QdXDQKQtu/XHSsatjExglABnHgMUO3zt/0AQCsdIcKMS/94S79cSYc NOLFfu8tohamkuDAmGrrOrSCtQehz5/dlNQUo5ODDn0CuRANKQJwXFrkCDt25UcAS9wRMImXM tS7yBeJZisgOf08gHovLDogcOvmKh5h1ZTlgWVVPUVfQB33k/POlgqgXX+UZVmv/r5/7lvHKV g5sMYBIflR4h5bxFfPvdVfnK642zfkmSyMb8pXAjVFJ37y92jPsRkEv5n/IeFjg+ELVL6+ewm ANS/ht9yF8BxiJpmRvg3v0WP9d6WFj5V+Qqa1BrA0mU3eMLG54wGMktSo7g= X-BeenThere: selinux@tycho.nsa.gov X-Mailman-Version: 2.1.20 Precedence: list List-Id: "Security-Enhanced Linux \(SELinux\) mailing list" List-Post: List-Help: MIME-Version: 1.0 Errors-To: selinux-bounces@tycho.nsa.gov Sender: "Selinux" X-Virus-Scanned: ClamAV using ClamSMTP Introduces support for generating homedir/user contexts for policies that implement RBACSEP. The support works by taking the prefix of a logins seuser and replacing the role field in their context specifications with the prefix. A new option "genhomedircon-rbacsep" was added to /etc/selinux/semanage.conf to allow toggling this behavior. The user prefix can be set from both standard kernel policy and CIL: CIL: (user user_u) (role user_r) (userrole user_u user_r) (userprefix user_u user_r) kernel policy language: role user_r; user user_u roles { user_r } prefix user_r; Signed-off-by: Gary Tierney --- libsemanage/src/conf-parse.y | 14 +++++++++++++- libsemanage/src/conf-scan.l | 1 + libsemanage/src/genhomedircon.c | 30 +++++++++++++++++++++++++++++- libsemanage/src/semanage_conf.h | 1 + 4 files changed, 44 insertions(+), 2 deletions(-) diff --git a/libsemanage/src/conf-parse.y b/libsemanage/src/conf-parse.y index b527e89..d2112d2 100644 --- a/libsemanage/src/conf-parse.y +++ b/libsemanage/src/conf-parse.y @@ -61,7 +61,7 @@ static int parse_errors; %token MODULE_STORE VERSION EXPAND_CHECK FILE_MODE SAVE_PREVIOUS SAVE_LINKED TARGET_PLATFORM COMPILER_DIR IGNORE_MODULE_CACHE STORE_ROOT %token LOAD_POLICY_START SETFILES_START SEFCONTEXT_COMPILE_START DISABLE_GENHOMEDIRCON HANDLE_UNKNOWN USEPASSWD IGNOREDIRS -%token BZIP_BLOCKSIZE BZIP_SMALL REMOVE_HLL +%token BZIP_BLOCKSIZE BZIP_SMALL REMOVE_HLL GENHOMEDIRCON_RBACSEP %token VERIFY_MOD_START VERIFY_LINKED_START VERIFY_KERNEL_START BLOCK_END %token PROG_PATH PROG_ARGS %token ARG @@ -95,6 +95,7 @@ single_opt: module_store | bzip_blocksize | bzip_small | remove_hll + | genhomedircon_rbacsep ; module_store: MODULE_STORE '=' ARG { @@ -268,6 +269,17 @@ remove_hll: REMOVE_HLL'=' ARG { free($3); } +genhomedircon_rbacsep: GENHOMEDIRCON_RBACSEP'=' ARG { + if (strcasecmp($3, "false") == 0) { + current_conf->genhomedircon_rbacsep = 0; + } else if (strcasecmp($3, "true") == 0) { + current_conf->genhomedircon_rbacsep = 1; + } else { + yyerror("genhomedircon-rbacsep can only be 'true' or 'false'"); + } + free($3); +} + command_block: command_start external_opts BLOCK_END { if (new_external->path == NULL) { diff --git a/libsemanage/src/conf-scan.l b/libsemanage/src/conf-scan.l index 607bbf0..114098c 100644 --- a/libsemanage/src/conf-scan.l +++ b/libsemanage/src/conf-scan.l @@ -54,6 +54,7 @@ handle-unknown return HANDLE_UNKNOWN; bzip-blocksize return BZIP_BLOCKSIZE; bzip-small return BZIP_SMALL; remove-hll return REMOVE_HLL; +genhomedircon-rbacsep return GENHOMEDIRCON_RBACSEP; "[load_policy]" return LOAD_POLICY_START; "[setfiles]" return SETFILES_START; "[sefcontext_compile]" return SEFCONTEXT_COMPILE_START; diff --git a/libsemanage/src/genhomedircon.c b/libsemanage/src/genhomedircon.c index 3fc9e7a..98f9ebd 100644 --- a/libsemanage/src/genhomedircon.c +++ b/libsemanage/src/genhomedircon.c @@ -71,6 +71,10 @@ #define COMMENT_USER_HOME_CONTEXT "\n\n#\n# Home Context for user %s" \ "\n#\n\n" +#define WARNING_RBACSEP_INVALID_ROLE "genhomedircon-rbacsep is enabled, " \ + "but the user prefix of " \ + "'%s' for %s is not a valid role. Skipping user." + /* placeholders used in the template file which are searched for and replaced */ #define TEMPLATE_HOME_ROOT "HOME_ROOT" @@ -638,6 +642,11 @@ static int write_contexts(genhomedircon_settings_t *s, FILE *out, goto fail; } + if (s->h_semanage->conf->genhomedircon_rbacsep && + sepol_context_set_role(sepolh, context, user->prefix) < 0) { + goto fail; + } + if (sepol_context_to_string(sepolh, context, &new_context_str) < 0) { goto fail; @@ -857,7 +866,7 @@ static int setup_fallback_user(genhomedircon_settings_t * s) int errors = 0; retval = semanage_seuser_list(s->h_semanage, &seuser_list, &nseusers); - if (retval < 0 || (nseusers < 1)) { + if (retval < 0 || (nseusers < 2)) { /* if there are no users, this function can't do any other work */ return errors; } @@ -886,6 +895,17 @@ static int setup_fallback_user(genhomedircon_settings_t * s) level = FALLBACK_LEVEL; } + if (u && s->h_semanage->conf->genhomedircon_rbacsep && + !semanage_user_has_role(u, prefix)) { + WARN(s->h_semanage, WARNING_RBACSEP_INVALID_ROLE, + prefix, seuname); + + errors = STATUS_ERR; + semanage_user_key_free(key); + semanage_user_free(u); + break; + } + if (push_user_entry(&(s->fallback), FALLBACK_NAME, FALLBACK_UIDGID, FALLBACK_UIDGID, seuname, prefix, "", level, @@ -969,6 +989,14 @@ static int add_user(genhomedircon_settings_t * s, level = FALLBACK_LEVEL; } + if (s->h_semanage->conf->genhomedircon_rbacsep && + !semanage_user_has_role(user, prefix)) { + WARN(s->h_semanage, WARNING_RBACSEP_INVALID_ROLE, prefix, sename); + + retval = STATUS_SUCCESS; + goto cleanup; + } + retval = getpwnam_r(name, &pwstorage, rbuf, rbuflen, &pwent); if (retval != 0 || pwent == NULL) { if (retval != 0 && retval != ENOENT) { diff --git a/libsemanage/src/semanage_conf.h b/libsemanage/src/semanage_conf.h index c99ac8c..2c968da 100644 --- a/libsemanage/src/semanage_conf.h +++ b/libsemanage/src/semanage_conf.h @@ -46,6 +46,7 @@ typedef struct semanage_conf { int bzip_blocksize; int bzip_small; int remove_hll; + int genhomedircon_rbacsep; int ignore_module_cache; char *ignoredirs; /* ";" separated of list for genhomedircon to ignore */ struct external_prog *load_policy;