Skip to content

Commit 78be247

Browse files
bachradsusibachradsusi
committed
Introduce dontaudit_unlabeled
dontaudit_unlabeled=off would suppress dontaudit rules mostly related to dir and unlabeled_t unfortunately unlabeled_t is also file_type so it would also suppress dontaudit rules related to file_type dir/ # semanage permissive -a unconfined_t # cat setcon.py #!/usr/bin/python3 import os import selinux import sys selinux.setcon("system_u:system_r:%s:s0" % sys.argv[1]) os.mkdir("/unlabeled/abc/d") # setsebool -P dontaudit_unlabeled on # d=`date +%H:%M:%S`; sleep 1; ./setcon.py smbcontrol_t; sleep 1; ausearch -m avc -ts $d | audit2allow allow smbcontrol_t syslogd_var_run_t:sock_file write; allow unconfined_t smbcontrol_t:process dyntransition; # setsebool -P dontaudit_unlabeled off # d=`date +%H:%M:%S`; sleep 1; ./setcon.py smbcontrol_t; sleep 1; ausearch -m avc -ts $d | audit2allow allow smbcontrol_t unlabeled_t:dir search;
1 parent 14539b4 commit 78be247

11 files changed

Lines changed: 62 additions & 42 deletions

File tree

‎Makefile‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -215,10 +215,6 @@ ifeq "$(UBAC)" "y"
215215
M4PARAM += -D enable_ubac
216216
endif
217217

218-
ifeq "$(DONTAUDIT_UNLABELED)" "y"
219-
M4PARAM += -D dontaudit_unlabeled
220-
endif
221-
222218
# default MLS/MCS sensitivity and category settings.
223219
MLS_SENS ?= 16
224220
MLS_CATS ?= 1024

‎policy/modules/contrib/amanda.te‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -109,9 +109,7 @@ kernel_read_kernel_sysctls(amanda_t)
109109
kernel_read_net_sysctls(amanda_t)
110110
kernel_read_system_state(amanda_t)
111111
kernel_read_network_state(amanda_t)
112-
ifdef(`dontaudit_unlabeled',`
113-
kernel_dontaudit_getattr_unlabeled_files(amanda_t)
114-
')
112+
kernel_dontaudit_getattr_unlabeled_files(amanda_t)
115113
kernel_dontaudit_read_proc_symlinks(amanda_t)
116114

117115
corecmd_exec_shell(amanda_t)

‎policy/modules/contrib/apache.te‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -715,7 +715,8 @@ tunable_policy(`httpd_anon_write',`
715715
')
716716

717717
tunable_policy(`httpd_dontaudit_search_dirs',`
718-
files_dontaudit_search_non_security_dirs(httpd_t)
718+
# cannot nest tunable_policy intro tunable_policy, use macro without tunable_policy
719+
files_dontaudit_search_non_security_dirs_(httpd_t)
719720
')
720721

721722
#

‎policy/modules/contrib/devicekit.te‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -90,9 +90,7 @@ manage_files_pattern(devicekit_disk_t, devicekit_var_run_t, devicekit_var_run_t)
9090
files_pid_filetrans(devicekit_disk_t, devicekit_var_run_t, { dir file })
9191
files_filetrans_named_content(devicekit_disk_t)
9292

93-
ifdef(`dontaudit_unlabeled',`
94-
kernel_dontaudit_getattr_unlabeled_files(devicekit_disk_t)
95-
')
93+
kernel_dontaudit_getattr_unlabeled_files(devicekit_disk_t)
9694
kernel_getattr_message_if(devicekit_disk_t)
9795
kernel_list_unlabeled(devicekit_disk_t)
9896
kernel_read_fs_sysctls(devicekit_disk_t)

‎policy/modules/contrib/mplayer.te‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -146,11 +146,9 @@ manage_fifo_files_pattern(mplayer_t, mplayer_tmpfs_t, mplayer_tmpfs_t)
146146
manage_sock_files_pattern(mplayer_t, mplayer_tmpfs_t, mplayer_tmpfs_t)
147147
fs_tmpfs_filetrans(mplayer_t, mplayer_tmpfs_t,{ dir file lnk_file sock_file fifo_file })
148148

149-
ifdef(`dontaudit_unlabeled',`
150-
kernel_dontaudit_list_unlabeled(mplayer_t)
151-
kernel_dontaudit_getattr_unlabeled_files(mplayer_t)
152-
kernel_dontaudit_read_unlabeled_files(mplayer_t)
153-
')
149+
kernel_dontaudit_list_unlabeled(mplayer_t)
150+
kernel_dontaudit_getattr_unlabeled_files(mplayer_t)
151+
kernel_dontaudit_read_unlabeled_files(mplayer_t)
154152
kernel_read_system_state(mplayer_t)
155153
kernel_read_kernel_sysctls(mplayer_t)
156154

‎policy/modules/kernel/domain.te‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,13 @@ gen_tunable(domain_can_write_kmsg, false)
5151
## </desc>
5252
gen_tunable(domain_can_mmap_files, false)
5353

54+
## <desc>
55+
## <p>
56+
## Dontaudit domains to search unalebeld_t dirs.
57+
## </p>
58+
## </desc>
59+
gen_tunable(dontaudit_unlabeled, false)
60+
5461
# Mark process types as domains
5562
attribute domain;
5663
attribute named_filetrans_domain;

‎policy/modules/kernel/files.if‎

Lines changed: 24 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1019,6 +1019,27 @@ interface(`files_dontaudit_search_non_security_dirs',`
10191019
attribute non_security_file_type;
10201020
')
10211021

1022+
tunable_policy(`dontaudit_unlabeled',`
1023+
dontaudit $1 non_security_file_type:dir search_dir_perms;
1024+
')
1025+
')
1026+
1027+
########################################
1028+
## <summary>
1029+
## Do not audit attempts to search
1030+
## non security dirs.
1031+
## </summary>
1032+
## <param name="domain">
1033+
## <summary>
1034+
## Domain to not audit.
1035+
## </summary>
1036+
## </param>
1037+
#
1038+
interface(`files_dontaudit_search_non_security_dirs_',`
1039+
gen_require(`
1040+
attribute non_security_file_type;
1041+
')
1042+
10221043
dontaudit $1 non_security_file_type:dir search_dir_perms;
10231044
')
10241045

@@ -4730,8 +4751,9 @@ interface(`files_dontaudit_search_isid_type_dirs',`
47304751
gen_require(`
47314752
type unlabeled_t;
47324753
')
4733-
4734-
dontaudit $1 unlabeled_t:dir search_dir_perms;
4754+
tunable_policy(`dontaudit_unlabeled',`
4755+
dontaudit $1 unlabeled_t:dir search_dir_perms;
4756+
')
47354757
')
47364758

47374759
########################################

‎policy/modules/kernel/kernel.if‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2933,7 +2933,9 @@ interface(`kernel_dontaudit_list_unlabeled',`
29332933
type unlabeled_t;
29342934
')
29352935

2936-
dontaudit $1 unlabeled_t:dir list_dir_perms;
2936+
tunable_policy(`dontaudit_unlabeled',`
2937+
dontaudit $1 unlabeled_t:dir list_dir_perms;
2938+
')
29372939
')
29382940

29392941
########################################
@@ -3025,7 +3027,9 @@ interface(`kernel_dontaudit_read_unlabeled_files',`
30253027
type unlabeled_t;
30263028
')
30273029

3028-
dontaudit $1 unlabeled_t:file { getattr read };
3030+
tunable_policy(`dontaudit_unlabeled',`
3031+
dontaudit $1 unlabeled_t:file { getattr read };
3032+
')
30293033
')
30303034

30313035
########################################

‎policy/modules/system/init.te‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1672,9 +1672,7 @@ optional_policy(`
16721672

16731673
optional_policy(`
16741674
# bash tries to access a block device in the initrd
1675-
ifdef(`dontaudit_unlabeled',`
1676-
kernel_dontaudit_getattr_unlabeled_blk_files(initrc_t)
1677-
')
1675+
kernel_dontaudit_getattr_unlabeled_blk_files(initrc_t)
16781676
# for a bug in rm
16791677
files_dontaudit_write_all_pids(initrc_t)
16801678

‎policy/modules/system/userdomain.if‎

Lines changed: 7 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -77,15 +77,13 @@ template(`userdom_base_user_template',`
7777

7878
kernel_read_kernel_sysctls($1_usertype)
7979
kernel_read_all_sysctls($1_usertype)
80-
ifdef(`dontaudit_unlabeled',`
81-
kernel_dontaudit_list_unlabeled($1_usertype)
82-
kernel_dontaudit_getattr_unlabeled_files($1_usertype)
83-
kernel_dontaudit_getattr_unlabeled_symlinks($1_usertype)
84-
kernel_dontaudit_getattr_unlabeled_pipes($1_usertype)
85-
kernel_dontaudit_getattr_unlabeled_sockets($1_usertype)
86-
kernel_dontaudit_getattr_unlabeled_blk_files($1_usertype)
87-
kernel_dontaudit_getattr_unlabeled_chr_files($1_usertype)
88-
')
80+
kernel_dontaudit_list_unlabeled($1_usertype)
81+
kernel_dontaudit_getattr_unlabeled_files($1_usertype)
82+
kernel_dontaudit_getattr_unlabeled_symlinks($1_usertype)
83+
kernel_dontaudit_getattr_unlabeled_pipes($1_usertype)
84+
kernel_dontaudit_getattr_unlabeled_sockets($1_usertype)
85+
kernel_dontaudit_getattr_unlabeled_blk_files($1_usertype)
86+
kernel_dontaudit_getattr_unlabeled_chr_files($1_usertype)
8987
kernel_dontaudit_list_proc($1_usertype)
9088

9189
dev_dontaudit_getattr_all_blk_files($1_usertype)

0 commit comments

Comments
 (0)