From: Chris PeBenito <pebenito@ieee.org>
To: Russell Coker <russell@coker.com.au>, selinux-refpolicy@vger.kernel.org
Subject: Re: [PATCH] certbot V3
Date: Fri, 25 Mar 2022 11:35:07 -0400 [thread overview]
Message-ID: <b132b211-de63-8dc3-851f-84d5b92469dd@ieee.org> (raw)
In-Reply-To: <YjyBiQcGsOE7TeJS@xev.coker.com.au>
On 3/24/22 10:34, Russell Coker wrote:
> Same as the last one but with the directory names for the auto trans rules
> removed. I think it's ready for merging.
>
> Signed-off-by: Russell Coker <russell@coker.com.au>
>
> Index: refpolicy-2.20220309/policy/modules/services/apache.if
> ===================================================================
> --- refpolicy-2.20220309.orig/policy/modules/services/apache.if
> +++ refpolicy-2.20220309/policy/modules/services/apache.if
> @@ -238,6 +238,24 @@ interface(`apache_domtrans',`
>
> ########################################
> ## <summary>
> +## Execute httpd
> +## </summary>
> +## <param name="domain">
> +## <summary>
> +## Domain allowed to execute it.
> +## </summary>
> +## </param>
> +#
> +interface(`apache_exec',`
> + gen_require(`
> + type httpd_t, httpd_exec_t;
> + ')
> +
> + can_exec($1, httpd_exec_t)
> +')
> +
> +########################################
> +## <summary>
> ## Execute httpd server in the httpd domain.
> ## </summary>
> ## <param name="domain">
> @@ -1430,3 +1448,21 @@ interface(`apache_admin',`
> apache_run_all_scripts($1, $2)
> apache_run_helper($1, $2)
> ')
> +
> +########################################
> +## <summary>
> +## rw httpd_runtime_t files
> +## </summary>
> +## <param name="domain">
> +## <summary>
> +## Domain allowed access.
> +## </summary>
> +## </param>
> +#
> +interface(`apache_rw_runtime_files',`
> + gen_require(`
> + type httpd_runtime_t;
> + ')
> +
> + allow $1 httpd_runtime_t:file rw_file_perms;
> +')
> Index: refpolicy-2.20220309/policy/modules/services/certbot.te
> ===================================================================
> --- refpolicy-2.20220309.orig/policy/modules/services/certbot.te
> +++ refpolicy-2.20220309/policy/modules/services/certbot.te
> @@ -43,7 +43,7 @@ allow certbot_t self:udp_socket all_udp_
> allow certbot_t self:tcp_socket all_tcp_socket_perms;
> allow certbot_t self:netlink_route_socket create_netlink_socket_perms;
>
> -files_search_var_lib(certbot_t)
> +files_var_lib_filetrans(certbot_t, certbot_lib_t, dir)
> manage_dirs_pattern(certbot_t, certbot_lib_t, certbot_lib_t)
> manage_files_pattern(certbot_t, certbot_lib_t, certbot_lib_t)
>
> @@ -62,7 +62,7 @@ allow certbot_t certbot_tmp_t:file mmap_
> allow certbot_t certbot_tmpfs_t:file mmap_exec_file_perms;
> allow certbot_t certbot_runtime_t:file mmap_exec_file_perms;
>
> -logging_search_logs(certbot_t)
> +logging_log_filetrans(certbot_t, certbot_log_t, dir)
> allow certbot_t certbot_log_t:dir manage_dir_perms;
> allow certbot_t certbot_log_t:file manage_file_perms;
>
> @@ -80,11 +80,15 @@ corenet_tcp_connect_dns_port(certbot_t)
> # bind to http port for standalone mode
> corenet_tcp_bind_http_port(certbot_t)
>
> +dev_read_urand(certbot_t)
> +
> domain_use_interactive_fds(certbot_t)
>
> files_read_etc_files(certbot_t)
> files_read_usr_files(certbot_t)
>
> +# dontaudit for attempts to write python cache files
> +libs_dontaudit_write_lib_dirs(certbot_t)
> libs_exec_ldconfig(certbot_t)
> # for /usr/lib/gcc/x86_64-linux-gnu/8/collect2
> libs_exec_lib_files(certbot_t)
> @@ -110,5 +114,17 @@ optional_policy(`
> # for writing to webroot
> apache_manage_sys_content(certbot_t)
>
> - apache_search_config(certbot_t)
> + apache_append_log(certbot_t)
> + apache_exec(certbot_t)
> + apache_exec_modules(certbot_t)
> +
> + # for certbot to create nginx config
> + apache_manage_config(certbot_t)
> +
> + apache_rw_runtime_files(certbot_t)
> + apache_signal(certbot_t)
> +')
> +
> +optional_policy(`
> + xdg_search_config_dirs(certbot_t)
> ')
Merged.
--
Chris PeBenito
prev parent reply other threads:[~2022-03-25 15:37 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-03-24 14:34 [PATCH] certbot V3 Russell Coker
2022-03-25 15:35 ` Chris PeBenito [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=b132b211-de63-8dc3-851f-84d5b92469dd@ieee.org \
--to=pebenito@ieee.org \
--cc=russell@coker.com.au \
--cc=selinux-refpolicy@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).