From 21cba0d13af23be86c1a7afbe733deddb184a365 Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Mon, 18 Dec 2023 15:29:10 +0100 Subject: [PATCH] Draft: Update systemd-generators Confine all systemd generators and setup a label for a generic generator. --- policy/modules/system/init.fc | 2 +- policy/modules/system/systemd.fc | 7 +++++++ policy/modules/system/systemd.if | 34 ++++++++++++++++++++++++++++++++ policy/modules/system/systemd.te | 19 ++++++++++++++++++ 4 files changed, 61 insertions(+), 1 deletion(-) diff --git a/policy/modules/system/init.fc b/policy/modules/system/init.fc index 489edccfde..569096ba39 100644 --- a/policy/modules/system/init.fc +++ b/policy/modules/system/init.fc @@ -56,7 +56,7 @@ ifdef(`distro_gentoo', ` /usr/lib/systemd/[^/]* -- gen_context(system_u:object_r:init_exec_t,s0) /usr/lib/systemd/fedora[^/]* -- gen_context(system_u:object_r:initrc_exec_t,s0) -/usr/lib/systemd/system-generators/[^/]* -- gen_context(system_u:object_r:init_exec_t,s0) +#/usr/lib/systemd/system-generators/[^/]* -- gen_context(system_u:object_r:init_exec_t,s0) /usr/libexec/dcc/start-.* -- gen_context(system_u:object_r:initrc_exec_t,s0) /usr/libexec/dcc/stop-.* -- gen_context(system_u:object_r:initrc_exec_t,s0) diff --git a/policy/modules/system/systemd.fc b/policy/modules/system/systemd.fc index 29e7ffddf3..49857bef6d 100644 --- a/policy/modules/system/systemd.fc +++ b/policy/modules/system/systemd.fc @@ -68,10 +68,17 @@ HOME_DIR/\.config/systemd/user(/.*)? gen_context(system_u:object_r:systemd_unit /usr/lib/systemd/systemd-coredump -- gen_context(system_u:object_r:systemd_coredump_exec_t,s0) /usr/lib/systemd/systemd-modules-load -- gen_context(system_u:object_r:systemd_modules_load_exec_t,s0) /usr/lib/systemd/systemd-network-generator -- gen_context(system_u:object_r:systemd_network_generator_exec_t,s0) + +/usr/lib/systemd/system-generators/systemd-bless-boot-generator -- gen_context(system_u:object_r:systemd_bless_boot_generator_exec_t,s0) +/usr/lib/systemd/system-generators/systemd-cryptsetup-generator -- gen_context(system_u:object_r:systemd_cryptsetup_generator_exec_t,s0) +/usr/lib/systemd/system-generators/systemd-debug-generator -- gen_context(system_u:object_r:systemd_debug_generator_exec_t,s0) /usr/lib/systemd/system-generators/systemd-fstab-generator -- gen_context(system_u:object_r:systemd_fstab_generator_exec_t,s0) +/usr/lib/systemd/system-generators/systemd-getty-generator -- gen_context(system_u:object_r:systemd_getty_generator_exec_t,s0) /usr/lib/systemd/system-generators/systemd-gpt-auto-generator -- gen_context(system_u:object_r:systemd_gpt_generator_exec_t,s0) /usr/lib/systemd/system-generators/systemd-rc-local-generator -- gen_context(system_u:object_r:systemd_rc_local_generator_exec_t,s0) /usr/lib/systemd/system-generators/systemd-sysv-generator -- gen_context(system_u:object_r:systemd_sysv_generator_exec_t,s0) +/usr/lib/systemd/system-generators/zram-generator -- gen_context(system_u:object_r:systemd_zram_generator_exec_t,s0) +/usr/lib/systemd/system-generators/.+ -- gen_context(system_u:object_r:systemd_generic_generator_exec_t,s0) /usr/lib/systemd/systemd-resolve(d|-host) gen_context(system_u:object_r:systemd_resolved_exec_t,s0) /usr/lib/systemd/systemd-importd -- gen_context(system_u:object_r:systemd_importd_exec_t,s0) /usr/lib/systemd/systemd-journal-upload -- gen_context(system_u:object_r:systemd_journal_upload_exec_t,s0) diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if index dca99a7cb6..7350c6095b 100644 --- a/policy/modules/system/systemd.if +++ b/policy/modules/system/systemd.if @@ -60,6 +60,40 @@ template(`systemd_generator_template',` systemd_create_unit_file_lnk($1_t) ') +###################################### +## +## Creates types and rules for +## systemd generators - new version +## +## +## +## Prefix for the domain. +## +## +# +template(`systemd_generator_template_new',` + gen_require(` + attribute systemd_generator2; + ') + + type $1_t, systemd_generator2; + type $1_exec_t; + init_daemon_domain($1_t, $1_exec_t) + init_nnp_daemon_domain($1_t) + + #kernel_read_system_state($1_t) + + #dev_write_kmsg($1_t) + + #auth_use_nsswitch($1_t) + #selinux_get_enforce_mode($1_t) + + #systemd_manage_unit_dirs($1_t) + #systemd_create_unit_file_dirs($1_t) + #systemd_create_unit_file_lnk($1_t) + permissive $1_t; +') + ###################################### ## ## Create a domain for processes which are started diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te index b3512c726d..b695ca9069 100644 --- a/policy/modules/system/systemd.te +++ b/policy/modules/system/systemd.te @@ -24,6 +24,7 @@ gen_tunable(systemd_socket_proxyd_connect_any, false) attribute systemd_unit_file_type; attribute systemd_domain; attribute systemd_generator; +attribute systemd_generator2; attribute systemctl_domain; attribute systemd_mount_directory; attribute systemd_private_tmp_type; @@ -193,6 +194,18 @@ systemd_domain_template(systemd_network_generator) type systemd_gpt_generator_unit_file_t; systemd_unit_file(systemd_gpt_generator_unit_file_t) +# domain for bless-boot-generator +systemd_generator_template_new(systemd_bless_boot_generator) + +# domain for cryptsetup-generator +systemd_generator_template_new(systemd_cryptsetup_generator) + +# domain for debug-generator +systemd_generator_template_new(systemd_debug_generator) + +# domain for getty-generator +systemd_generator_template_new(systemd_getty_generator) + #domain for fstab-generator systemd_generator_template(systemd_fstab_generator) @@ -202,6 +215,12 @@ systemd_generator_template(systemd_rc_local_generator) #domain for sysv-generator systemd_generator_template(systemd_sysv_generator) +# domain for zram-generator +systemd_generator_template_new(systemd_zram_generator) + +# domain for a generic generator +systemd_generator_template_new(systemd_generic_generator) + #domain for systemd-machined systemd_domain_template(systemd_machined)