Initial systemd_logind policy

logind creates seats, sessions and users dirs in /run/systemd. xdm and
systemd_dbusd_t use (read inherited) files in /run/systemd/sessions and
so i decided to give sessions a private type and leave seats and users
type systemd_logind_var_run_t since no other domains seem to want to
interact with this content so far. Later we could decide to create
private types or seats and or users as well or we could decide to label
all logind content in /run/user systemd_logind_var_run_t.

logind acquires service on system dbus, system dbus client and dbus
chats to xdm and init.
crond dbus chats to logind

systemd_logind needs to create dirs in /run/system/session,
systemd_logind needs to be able to read crond state files (probably does
this when it is not allowed to dbus chat to crond)
crond needs to be able to use systemd_logind fds and it needs to be able
to read inherited systemd_logind_sessions_t pipes.

Obviously systemd-logind is looking for something in /tmp/*/X11-unix but
i cannot determine what and since there is no
xserver_search_xdm_tmp_dirs interface available to call, i decided to
just allow logind to read xdm tmp files for now.

Only "allow systemd_logind_t xdm_tmp_t:dir search;" is actually
confirmed

diff --git a/policy/modules/services/cron.if b/policy/modules/services/cron.if
index 3a542863e7a7cc039adf9cd1b31c9c72f731a05e..2976df7d9eeef94e56435962e06f4d84a365ece8 100644 (file)
--- a/policy/modules/services/cron.if
+++ b/policy/modules/services/cron.if
@@ -386,6 +386,47 @@ interface(`cron_read_pipes',`
        allow $1 crond_t:fifo_file read_fifo_file_perms;
 ')
 
+########################################
+## <summary>
+##     Read crond state files.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`cron_read_state_crond',`
+       gen_require(`
+               type crond_t;
+       ')
+
+       kernel_search_proc($1)
+       ps_process_pattern($1, crond_t)
+')
+
+
+########################################
+## <summary>
+##     Send and receive messages from
+##     crond over dbus.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`cron_dbus_chat_crond',`
+       gen_require(`
+               type crond_t;
+               class dbus send_msg;
+       ')
+
+       allow $1 crond_t:dbus send_msg;
+       allow crond_t $1:dbus send_msg;
+')
+
 ########################################
 ## <summary>
 ##     Do not audit attempts to write cron daemon unnamed pipes.

diff --git a/policy/modules/services/cron.te b/policy/modules/services/cron.te
index e6ddde9cf08bbd5d67de67aed28950217073eb9c..181256347bfbcdce76fbb23be4fb66f3e0985fe7 100644 (file)
--- a/policy/modules/services/cron.te
+++ b/policy/modules/services/cron.te
@@ -331,6 +331,11 @@ optional_policy(`
        postgresql_search_db(crond_t)
 ')
 
+optional_policy(`
+       systemd_use_fds_logind(crond_t)
+       systemd_write_inherited_logind_sessions_pipes(crond_t)
+')
+
 optional_policy(`
        udev_read_db(crond_t)
 ')

diff --git a/policy/modules/services/dbus.te b/policy/modules/services/dbus.te
index a6800d5a64ec41305422ea2f6ed8d7db4295124c..090958934b539892839349106370f17e40dc9a17 100644 (file)
--- a/policy/modules/services/dbus.te
+++ b/policy/modules/services/dbus.te
@@ -169,6 +169,11 @@ optional_policy(`
        sysnet_domtrans_dhcpc(system_dbusd_t)
 ')
 
+optional_policy(`
+       systemd_use_fds_logind(system_dbusd_t)
+       systemd_write_inherited_logind_sessions_pipes(system_dbusd_t)
+')
+
 optional_policy(`
        udev_read_db(system_dbusd_t)
 ')

diff --git a/policy/modules/services/xserver.if b/policy/modules/services/xserver.if
index 9a33b9be8d6609c2248540ab4e01249d803f5e11..3afa206c08dad37c7ac3399718a769929384045d 100644 (file)
--- a/policy/modules/services/xserver.if
+++ b/policy/modules/services/xserver.if
@@ -712,6 +712,25 @@ interface(`xserver_rw_console',`
        allow $1 xconsole_device_t:fifo_file rw_fifo_file_perms;
 ')
 
+########################################
+## <summary>
+##     Read XDM state files.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`xserver_read_state_xdm',`
+       gen_require(`
+               type xdm_t;
+       ')
+
+       kernel_search_proc($1)
+       ps_process_pattern($1, xdm_t)
+')
+
 ########################################
 ## <summary>
 ##     Use file descriptors for xdm.

diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te
index bc547bf52d07639cd94bc34b8bc0090790d06470..05598abc8e5e0d739c911805ee94376b19890010 100644 (file)
--- a/policy/modules/services/xserver.te
+++ b/policy/modules/services/xserver.te
@@ -879,6 +879,11 @@ optional_policy(`
        shutdown_domtrans(xdm_t)
 ')
 
+optional_policy(`
+       systemd_use_fds_logind(xdm_t)
+       systemd_write_inherited_logind_sessions_pipes(xdm_t)
+')
+
 optional_policy(`
        udev_read_db(xdm_t)
 ')

diff --git a/policy/modules/system/init.if b/policy/modules/system/init.if
index 99fe8d14d022dea0059a29489b0349a5afb3b192..5e4571c106f5ee9eca7a54f33824243090c10f98 100644 (file)
--- a/policy/modules/system/init.if
+++ b/policy/modules/system/init.if
@@ -2061,8 +2061,44 @@ interface(`init_pid_filetrans',`
         type init_var_run_t;
     ')
 
+       files_search_pids($1)
     filetrans_pattern($1, init_var_run_t, $2, $3)
-       allow $1 init_var_run_t:dir search_dir_perms;
+')
+
+#######################################
+## <summary>
+##     Create objects in /run/systemd directory
+##     with an automatic type transition to
+##     a specified private type.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+## <param name="private_type">
+##     <summary>
+##     The type of the object to create.
+##     </summary>
+## </param>
+## <param name="object_class">
+##     <summary>
+##     The class of the object to be created.
+##     </summary>
+## </param>
+## <param name="object_name">
+##     <summary>
+##     The name of the object to be created.
+##     </summary>
+## </param>
+#
+interface(`init_named_pid_filetrans',`
+       gen_require(`
+               type init_var_run_t;
+       ')
+
+       files_search_pids($1)
+       filetrans_pattern($1, init_var_run_t, $2, $3, $4)
 ')
 
 ########################################

diff --git a/policy/modules/system/systemd.fc b/policy/modules/system/systemd.fc
index c7476cb392625cdc0c56d8d0ec01c429e32e22ad..9819b563684712a7fa8c5d1532143249b9bfd74b 100644 (file)
--- a/policy/modules/system/systemd.fc
+++ b/policy/modules/system/systemd.fc
@@ -7,8 +7,12 @@
 /usr/bin/systemd-gnome-ask-password-agent      --              gen_context(system_u:object_r:systemd_passwd_agent_exec_t,s0)
 
 /lib/systemd/system(/.*)?                              --              gen_context(system_u:object_r:systemd_unit_file_t,s0)
+/lib/systemd/systemd-logind    --      gen_context(system_u:object_r:systemd_logind_exec_t,s0)
 /lib/systemd/systemd-tmpfiles                          --              gen_context(system_u:object_r:systemd_tmpfiles_exec_t,s0)
 
+/var/run/systemd/seats(/.*)?   gen_context(system_u:object_r:systemd_logind_var_run_t,s0)
+/var/run/systemd/sessions(/.*)?        gen_context(system_u:object_r:systemd_logind_sessions_t,s0)
+/var/run/systemd/users(/.*)?   gen_context(system_u:object_r:systemd_logind_var_run_t,s0)
 /var/run/systemd/ask-password-block/[^/]*              -p      gen_context(system_u:object_r:systemd_device_t,s0)
 /dev/\.systemd/ask-password-block/[^/]*                -p      gen_context(system_u:object_r:systemd_device_t,s0)
 

diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if
index c59c37ce591bac028c2def5b7c61ae2842a8b562..31e51f24c30fe95134073ac3170af461d52dabfd 100644 (file)
--- a/policy/modules/system/systemd.if
+++ b/policy/modules/system/systemd.if
@@ -108,6 +108,64 @@ interface(`systemd_dontaudit_read_unit_files',`
         dontaudit $1 systemd_unit_file_type:file read_file_perms;
 ')
 
+######################################
+## <summary>
+##     Use and and inherited systemd
+##     logind file descriptors.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`systemd_use_fds_logind',`
+       gen_require(`
+               type systemd_logind_t;
+       ')
+
+       allow $1 systemd_logind_t:fd use;
+')
+
+######################################
+## <summary>
+##     Write inherited logind sessions pipes.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`systemd_write_inherited_logind_sessions_pipes',`
+       gen_require(`
+               type systemd_logind_sessions_t;
+       ')
+
+       allow $1 systemd_logind_sessions_t:fifo_file write;
+')
+
+########################################
+## <summary>
+##     Send and receive messages from
+##     systemd logind over dbus.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`systemd_dbus_chat_logind',`
+       gen_require(`
+               type systemd_logind_t;
+               class dbus send_msg;
+       ')
+
+       allow $1 systemd_logind_t:dbus send_msg;
+       allow systemd_logind_t $1:dbus send_msg;
+')
+
 #######################################
 ## <summary>
 ##  Execute a domain transition to run systemd-tmpfiles.

diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
index 9e2eaf0609fd651e5a364e8b3b38531d3fb6c193..a884be6750408ecbea65582b3af128bcb515ad5f 100644 (file)
--- a/policy/modules/system/systemd.te
+++ b/policy/modules/system/systemd.te
@@ -1,4 +1,3 @@
-
 policy_module(systemd, 1.0.0)
 
 #######################################
@@ -8,6 +7,21 @@ policy_module(systemd, 1.0.0)
 
 attribute systemd_unit_file_type;
 
+# New in f16
+permissive systemd_logind_t;
+
+type systemd_logind_t;
+type systemd_logind_exec_t;
+init_systemd_domain(systemd_logind_t, systemd_logind_exec_t)
+
+# /run/systemd/sessions
+type systemd_logind_sessions_t;
+files_type(systemd_logind_sessions_t)
+
+# /run/systemd/{seats, users}
+type systemd_logind_var_run_t;
+files_type(systemd_logind_var_run_t)
+
 # domain for systemd-tty-ask-password-agent and systemd-gnome-ask-password-agent
 # systemd components
 
@@ -39,6 +53,71 @@ type systemd_device_t;
 files_type(systemd_device_t)
 dev_associate(systemd_device_t)
 
+#######################################
+#
+# Systemd_logind local policy
+#
+
+# dac_override is for /run/user/$USER ($USER ownership is $USER:$USER)
+allow systemd_logind_t self:capability { chown dac_override };
+allow systemd_logind_t self:process getcap;
+allow systemd_logind_t self:netlink_kobject_uevent_socket create_socket_perms;
+allow systemd_logind_t self:unix_dgram_socket create_socket_perms;
+
+manage_dirs_pattern(systemd_logind_t, { systemd_logind_sessions_t systemd_logind_var_run_t }, { systemd_logind_sessions_t systemd_logind_var_run_t })
+manage_files_pattern(systemd_logind_t, { systemd_logind_sessions_t systemd_logind_var_run_t }, { systemd_logind_var_run_t systemd_logind_sessions_t })
+manage_fifo_files_pattern(systemd_logind_t, systemd_logind_sessions_t, systemd_logind_sessions_t)
+init_named_pid_filetrans(systemd_logind_t, systemd_logind_sessions_t, dir, "sessions")
+init_pid_filetrans(systemd_logind_t, systemd_logind_var_run_t, dir)
+
+dev_read_sysfs(systemd_logind_t)
+
+dev_getattr_dri_dev(systemd_logind_t)
+dev_setattr_dri_dev(systemd_logind_t)
+dev_getattr_sound_dev(systemd_logind_t)
+dev_setattr_sound_dev(systemd_logind_t)
+dev_getattr_video_dev(systemd_logind_t)
+dev_setattr_video_dev(systemd_logind_t)
+
+# /etc/udev/udev.conf should probably have a private type if only for confined administration
+# /etc/nsswitch.conf
+files_read_etc_files(systemd_logind_t)
+
+# /sys/fs/cgroup/systemd/user
+fs_manage_cgroup_dirs(systemd_logind_t)
+# write getattr open setattr
+fs_manage_cgroup_files(systemd_logind_t)
+
+term_use_unallocated_ttys(systemd_logind_t)
+
+# /run/user/.*
+# Actually only have proof of it creating dirs and symlinks (/run/user/$USER/X11/display)
+auth_manage_var_auth(systemd_logind_t)
+
+dbus_connect_system_bus(systemd_logind_t)
+dbus_system_bus_client(systemd_logind_t)
+
+init_dbus_chat(systemd_logind_t)
+init_read_state(systemd_logind_t)
+
+logging_send_syslog_msg(systemd_logind_t)
+
+miscfiles_read_localization(systemd_logind_t)
+
+udev_read_db(systemd_logind_t)
+
+optional_policy(`
+       cron_dbus_chat_crond(systemd_logind_t)
+       cron_read_state_crond(systemd_logind_t)
+')
+
+optional_policy(`
+       xserver_dbus_chat_xdm(systemd_logind_t)
+       xserver_read_state_xdm(systemd_logind_t)
+       # Only search is confirmed (/tmp/$USER/X11-unix)
+       xserver_read_xdm_tmp_files(systemd_logind_t)
+')
+
 #######################################
 #
 # Local policy