[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/kernel/, policy/modules/services/, policy/modules/admin/, ...

["Jason Zaman" <perfinion@gentoo.org>]

commit:     8d05a891d62852e95e4dbcb3f16e299be7cd4644
Author:     Chris PeBenito <Christopher.PeBenito <AT> microsoft <DOT> com>
AuthorDate: Wed Mar  9 20:50:22 2022 +0000
Commit:     Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Sat Sep  3 19:07:49 2022 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=8d05a891

Add cloud-init.

This is used by cloud providers to set up VMs during deployment.

https://github.com/canonical/cloud-init

Signed-off-by: Chris PeBenito <Christopher.PeBenito <AT> microsoft.com>
Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org>

 policy/modules/admin/cloudinit.fc       |  10 +++
 policy/modules/admin/cloudinit.if       | 108 ++++++++++++++++++++++++++++++++
 policy/modules/admin/cloudinit.te       | 108 ++++++++++++++++++++++++++++++++
 policy/modules/admin/usermanage.fc      |   1 +
 policy/modules/kernel/corecommands.fc   |   1 +
 policy/modules/kernel/corenetwork.if.in |  18 ++++++
 policy/modules/services/ssh.fc          |   2 +-
 policy/modules/services/ssh.if          |  55 ++++++++++++++++
 policy/modules/system/libraries.if      |  44 +++++++++++++
 policy/modules/system/sysnetwork.te     |   2 +-
 policy/modules/system/systemd.te        |   9 +++
 11 files changed, 356 insertions(+), 2 deletions(-)

diff --git a/policy/modules/admin/cloudinit.fc b/policy/modules/admin/cloudinit.fc
new file mode 100644
index 00000000..f5fdc535
--- /dev/null
+++ b/policy/modules/admin/cloudinit.fc
@@ -0,0 +1,10 @@
+/run/cloud-init(/.*)?       gen_context(system_u:object_r:cloud_init_runtime_t,s0)
+
+/usr/bin/cloud-id       --  gen_context(system_u:object_r:cloud_init_exec_t,s0)
+/usr/bin/cloud-init     --  gen_context(system_u:object_r:cloud_init_exec_t,s0)
+/usr/bin/cloud-init-per --  gen_context(system_u:object_r:cloud_init_exec_t,s0)
+
+/var/lib/cloud(/.*)?        gen_context(system_u:object_r:cloud_init_state_t,s0)
+
+/var/log/cloud-init-output\.log -- gen_context(system_u:object_r:cloud_init_log_t,s0)
+/var/log/cloud-init\.log --  gen_context(system_u:object_r:cloud_init_log_t,s0)

diff --git a/policy/modules/admin/cloudinit.if b/policy/modules/admin/cloudinit.if
new file mode 100644
index 00000000..4469d7b1
--- /dev/null
+++ b/policy/modules/admin/cloudinit.if
@@ -0,0 +1,108 @@
+## <summary>Init scripts for cloud VMs</summary>
+
+########################################
+## <summary>
+##	Create cloud-init runtime directory.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`cloudinit_create_runtime_dirs',`
+	gen_require(`
+		type cloud_init_runtime_t;
+	')
+
+	files_search_runtime($1)
+	allow $1 cloud_init_runtime_t:dir create_dir_perms;
+')
+
+########################################
+## <summary>
+##	Write cloud-init runtime files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`cloudinit_write_runtime_files',`
+	gen_require(`
+		type cloud_init_runtime_t;
+	')
+
+	files_search_runtime($1)
+	write_files_pattern($1, cloud_init_runtime_t, cloud_init_runtime_t)
+')
+
+########################################
+## <summary>
+##	Create cloud-init runtime files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`cloudinit_create_runtime_files',`
+	gen_require(`
+		type cloud_init_runtime_t;
+	')
+
+	files_search_runtime($1)
+	create_files_pattern($1, cloud_init_runtime_t, cloud_init_runtime_t)
+')
+
+#######################################
+## <summary>
+##	Create files in /run with the type used for
+##	cloud-init runtime files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="object_class">
+##	<summary>
+##	The class of the object to be created.
+##	</summary>
+## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
+#
+interface(`cloudinit_filetrans_runtime',`
+	gen_require(`
+		type cloud_init_runtime_t;
+	')
+
+	files_runtime_filetrans($1, cloud_init_runtime_t, $2, $3)
+')
+
+########################################
+## <summary>
+##	Get the attribute of cloud-init state files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`cloudinit_getattr_state_files',`
+	gen_require(`
+		type cloud_init_state_t;
+	')
+
+	files_search_var_lib($1)
+	allow $1 cloud_init_state_t:dir list_dir_perms;
+	allow $1 cloud_init_state_t:lnk_file read_lnk_file_perms;
+	allow $1 cloud_init_state_t:file getattr;
+')

diff --git a/policy/modules/admin/cloudinit.te b/policy/modules/admin/cloudinit.te
new file mode 100644
index 00000000..f531cc5d
--- /dev/null
+++ b/policy/modules/admin/cloudinit.te
@@ -0,0 +1,108 @@
+policy_module(cloudinit)
+
+########################################
+#
+# Declarations
+#
+
+type cloud_init_t;
+type cloud_init_exec_t;
+init_system_domain(cloud_init_t, cloud_init_exec_t)
+
+type cloud_init_log_t;
+logging_log_file(cloud_init_log_t)
+
+type cloud_init_runtime_t;
+files_runtime_file(cloud_init_runtime_t)
+files_mountpoint(cloud_init_runtime_t)
+
+type cloud_init_state_t;
+files_type(cloud_init_state_t)
+
+########################################
+#
+# Local policy
+#
+
+allow cloud_init_t self:capability { chown dac_override dac_read_search fowner fsetid setgid setuid };
+dontaudit cloud_init_t self:capability { net_admin sys_tty_config };
+allow cloud_init_t self:fifo_file rw_fifo_file_perms;
+allow cloud_init_t self:unix_dgram_socket create_socket_perms;
+
+allow cloud_init_t cloud_init_log_t:file { create_file_perms append_file_perms setattr };
+logging_log_filetrans(cloud_init_t, cloud_init_log_t, file)
+
+manage_files_pattern(cloud_init_t, cloud_init_runtime_t, cloud_init_runtime_t)
+manage_lnk_files_pattern(cloud_init_t, cloud_init_runtime_t, cloud_init_runtime_t)
+manage_dirs_pattern(cloud_init_t, cloud_init_runtime_t, cloud_init_runtime_t)
+files_runtime_filetrans(cloud_init_t, cloud_init_runtime_t, { dir file lnk_file })
+
+manage_files_pattern(cloud_init_t, cloud_init_state_t, cloud_init_state_t)
+manage_lnk_files_pattern(cloud_init_t, cloud_init_state_t, cloud_init_state_t)
+manage_dirs_pattern(cloud_init_t, cloud_init_state_t, cloud_init_state_t)
+files_var_lib_filetrans(cloud_init_t, cloud_init_state_t, { dir file lnk_file })
+
+auth_domtrans_chk_passwd(cloud_init_t)
+
+corecmd_exec_bin(cloud_init_t)
+corecmd_exec_shell(cloud_init_t)
+
+corenet_dontaudit_tcp_bind_generic_node(cloud_init_t)
+
+dbus_system_bus_client(cloud_init_t)
+
+dev_getattr_all_blk_files(cloud_init_t)
+# /sys/devices/pci0000:00/0000:00:03.0/net/eth0/address
+dev_read_sysfs(cloud_init_t)
+
+files_manage_config_dirs(cloud_init_t)
+files_relabel_config_dirs(cloud_init_t)
+files_manage_config_files(cloud_init_t)
+files_relabel_config_files(cloud_init_t)
+
+fs_getattr_all_fs(cloud_init_t)
+fs_search_tmpfs(cloud_init_t)
+fs_search_cgroup_dirs(cloud_init_t)
+fs_read_iso9660_files(cloud_init_t)
+
+fstools_domtrans(cloud_init_t)
+
+hostname_domtrans(cloud_init_t)
+
+init_get_system_status(cloud_init_t)
+init_read_state(cloud_init_t)
+init_stream_connect(cloud_init_t)
+
+kernel_read_system_state(cloud_init_t)
+kernel_read_crypto_sysctls(cloud_init_t)
+kernel_read_kernel_sysctls(cloud_init_t)
+
+libs_dontaudit_manage_lib_dirs(cloud_init_t)
+libs_dontaudit_manage_lib_files(cloud_init_t)
+
+logging_send_syslog_msg(cloud_init_t)
+
+miscfiles_read_localization(cloud_init_t)
+
+mount_domtrans(cloud_init_t)
+
+seutil_read_default_contexts(cloud_init_t)
+
+ssh_domtrans_keygen(cloud_init_t)
+ssh_manage_home_files(cloud_init_t)
+ssh_create_home_dirs(cloud_init_t)
+ssh_setattr_home_dirs(cloud_init_t)
+# Read public keys
+ssh_read_server_keys(cloud_init_t)
+
+sysnet_domtrans_ifconfig(cloud_init_t)
+
+term_write_console(cloud_init_t)
+
+usermanage_domtrans_useradd(cloud_init_t)
+usermanage_domtrans_groupadd(cloud_init_t)
+usermanage_domtrans_passwd(cloud_init_t)
+
+optional_policy(`
+	systemd_dbus_chat_hostnamed(cloud_init_t)
+')

diff --git a/policy/modules/admin/usermanage.fc b/policy/modules/admin/usermanage.fc
index 620eefc6..1065db10 100644
--- a/policy/modules/admin/usermanage.fc
+++ b/policy/modules/admin/usermanage.fc
@@ -24,6 +24,7 @@ ifdef(`distro_debian',`
 
 /usr/lib/cracklib_dict.* --	gen_context(system_u:object_r:crack_db_t,s0)
 
+/usr/sbin/chpasswd	--	gen_context(system_u:object_r:passwd_exec_t,s0)
 /usr/sbin/crack_[a-z]*	--	gen_context(system_u:object_r:crack_exec_t,s0)
 /usr/sbin/cracklib-[a-z]* --	gen_context(system_u:object_r:crack_exec_t,s0)
 /usr/sbin/gpasswd	--	gen_context(system_u:object_r:groupadd_exec_t,s0)

diff --git a/policy/modules/kernel/corecommands.fc b/policy/modules/kernel/corecommands.fc
index 48540ef9..28c4e825 100644
--- a/policy/modules/kernel/corecommands.fc
+++ b/policy/modules/kernel/corecommands.fc
@@ -179,6 +179,7 @@ ifdef(`distro_gentoo',`
 /usr/lib/bluetooth/.*		--	gen_context(system_u:object_r:bin_t,s0)
 /usr/lib/bridge-utils/.*\.sh	--	gen_context(system_u:object_r:bin_t,s0)
 /usr/lib/ccache/bin(/.*)?		gen_context(system_u:object_r:bin_t,s0)
+/usr/lib/cloud-init(/.*)?		gen_context(system_u:object_r:bin_t,s0)
 #/usr/lib/dhcpcd/dhcpcd-hooks(/.*)?	gen_context(system_u:object_r:bin_t,s0)
 #/usr/lib/dhcpcd/dhcpcd-run-hooks --	gen_context(system_u:object_r:bin_t,s0)
 /usr/lib/dovecot/.+			gen_context(system_u:object_r:bin_t,s0)

diff --git a/policy/modules/kernel/corenetwork.if.in b/policy/modules/kernel/corenetwork.if.in
index 65e54854..d1038d74 100644
--- a/policy/modules/kernel/corenetwork.if.in
+++ b/policy/modules/kernel/corenetwork.if.in
@@ -910,6 +910,24 @@ interface(`corenet_tcp_bind_generic_node',`
 	allow $1 node_t:tcp_socket node_bind;
 ')
 
+########################################
+## <summary>
+##	Do not audit denials on binding TCP sockets to generic nodes.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`corenet_dontaudit_tcp_bind_generic_node',`
+	gen_require(`
+		type node_t;
+	')
+
+	dontaudit $1 node_t:tcp_socket node_bind;
+')
+
 ########################################
 ## <summary>
 ##	Bind UDP sockets to generic nodes.

diff --git a/policy/modules/services/ssh.fc b/policy/modules/services/ssh.fc
index 60060c35..5c512e97 100644
--- a/policy/modules/services/ssh.fc
+++ b/policy/modules/services/ssh.fc
@@ -1,7 +1,7 @@
 HOME_DIR/\.ssh(/.*)?			gen_context(system_u:object_r:ssh_home_t,s0)
 
 /etc/ssh/primes			--	gen_context(system_u:object_r:sshd_key_t,s0)
-/etc/ssh/ssh_host.*_key		--	gen_context(system_u:object_r:sshd_key_t,s0)
+/etc/ssh/ssh_host.*_key(\.pub)?	--	gen_context(system_u:object_r:sshd_key_t,s0)
 
 /usr/bin/ssh			--	gen_context(system_u:object_r:ssh_exec_t,s0)
 /usr/bin/ssh-agent		--	gen_context(system_u:object_r:ssh_agent_exec_t,s0)

diff --git a/policy/modules/services/ssh.if b/policy/modules/services/ssh.if
index c438985e..606bf43f 100644
--- a/policy/modules/services/ssh.if
+++ b/policy/modules/services/ssh.if
@@ -730,6 +730,43 @@ interface(`ssh_agent_exec',`
 	can_exec($1, ssh_agent_exec_t)
 ')
 
+########################################
+## <summary>
+##	Set the attributes of ssh home directory (~/.ssh)
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`ssh_setattr_home_dirs',`
+	gen_require(`
+		type ssh_home_t;
+	')
+
+	allow $1 ssh_home_t:dir setattr_dir_perms;
+')
+
+########################################
+## <summary>
+##	Create ssh home directory (~/.ssh)
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`ssh_create_home_dirs',`
+	gen_require(`
+		type ssh_home_t;
+	')
+
+	allow $1 ssh_home_t:dir create_dir_perms;
+	userdom_user_home_dir_filetrans($1, ssh_home_t, dir, ".ssh")
+')
+
 ########################################
 ## <summary>
 ##	Read ssh home directory content
@@ -775,6 +812,24 @@ interface(`ssh_domtrans_keygen',`
 ## </summary>
 ## <param name="domain">
 ##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`ssh_read_server_keys',`
+	gen_require(`
+		type sshd_key_t;
+	')
+
+	allow $1 sshd_key_t:file read_file_perms;
+')
+
+########################################
+## <summary>
+##	Do not audit denials on reading ssh server keys
+## </summary>
+## <param name="domain">
+##	<summary>
 ##	Domain to not audit.
 ##	</summary>
 ## </param>

diff --git a/policy/modules/system/libraries.if b/policy/modules/system/libraries.if
index cb1ef12c..20e307c8 100644
--- a/policy/modules/system/libraries.if
+++ b/policy/modules/system/libraries.if
@@ -233,6 +233,31 @@ interface(`libs_dontaudit_write_lib_dirs',`
 	dontaudit $1 lib_t:dir write;
 ')
 
+########################################
+## <summary>
+##	Do not audit attempts to manage to library directories.
+## </summary>
+## <desc>
+##	<p>
+##	Do not audit attempts to manage to library directories.
+##	Typically this is used to quiet attempts to recompile
+##	python byte code.
+##	</p>
+## </desc>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`libs_dontaudit_manage_lib_dirs',`
+	gen_require(`
+		type lib_t;
+	')
+
+	dontaudit $1 lib_t:dir manage_dir_perms;
+')
+
 ########################################
 ## <summary>
 ##	Create, read, write, and delete library directories.
@@ -332,6 +357,25 @@ interface(`libs_manage_lib_files',`
 	manage_files_pattern($1, lib_t, lib_t)
 ')
 
+########################################
+## <summary>
+##	Do not audit attempts to create, read, write,
+##  and delete generic files in library directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`libs_dontaudit_manage_lib_files',`
+	gen_require(`
+		type lib_t;
+	')
+
+	dontaudit $1 lib_t:file manage_file_perms;
+')
+
 ########################################
 ## <summary>
 ##	Relabel files to the type used in library directories.

diff --git a/policy/modules/system/sysnetwork.te b/policy/modules/system/sysnetwork.te
index 155a8059..e18bdf2a 100644
--- a/policy/modules/system/sysnetwork.te
+++ b/policy/modules/system/sysnetwork.te
@@ -51,7 +51,7 @@ optional_policy(`
 ')
 
 type net_conf_t;
-files_type(net_conf_t)
+files_config_file(net_conf_t)
 
 ifdef(`distro_debian',`
 	init_daemon_runtime_file(net_conf_t, dir, "network")

diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
index 3d853c4c..2dc8b901 100644
--- a/policy/modules/system/systemd.te
+++ b/policy/modules/system/systemd.te
@@ -530,6 +530,15 @@ ifdef(`distro_gentoo',`
 	corecmd_shell_entry_type(systemd_generator_t)
 ')
 
+optional_policy(`
+	cloudinit_create_runtime_dirs(systemd_generator_t)
+	cloudinit_write_runtime_files(systemd_generator_t)
+	cloudinit_create_runtime_files(systemd_generator_t)
+	cloudinit_filetrans_runtime(systemd_generator_t, dir, "cloud-init")
+
+	cloudinit_getattr_state_files(systemd_generator_t)
+')
+
 optional_policy(`
 	fstools_exec(systemd_generator_t)
 ')