2

I've written a custom selinux module that looks something like this:

require {
    type my_app_t;
    type my_app_file_t;
    class file { getattr lock open read write execute execute_no_trans ioctl append setattr };
    class dir { write search getattr };
}

allow my_app_t my_app_file_t:file { append setattr write getattr execute read open execute_no_trans lock ioctl};
allow my_app_t my_app_file_t:dir { write search getattr};

This mostly works OK, but I'm tired of adding new perms every time a new deny shows up in audit.log. Is there any way to just allow all permissions for files/directories with a given context? For instance:

require {
    type my_app_t;
    type my_app_file_t;
    class file { * };
    class dir { * };
}

allow my_app_t my_app_file_t:file { * };
allow my_app_t my_app_file_t:dir { * };
  • allow my_app_t my_app_file_t:file *; works for me without the curly braces. – NReilingh Jul 21 at 2:35
  • @NReilingh I'll keep experimenting with that, but I don't think it works. I added this to my module: allow nrpe_t user_tmp_t:dir *;, but I'm still seeing this denial in my audit.log: type=AVC msg=audit(1563901989.705:1826): avc: denied { search } for pid=8228 comm="stat" name="kitchen" dev="tmpfs" ino=29034 scontext=system_u:system_r:nrpe_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=dir permissive=0 – jayhendren Jul 23 at 17:18
  • @NReilingh do you have documentation for that syntax? I'm struggling to find documentation to support your claim. The modules do compile with the asterix though, so it seems to at least be valid syntax. – jayhendren Jul 23 at 17:19
3

You should consider using reference policy macros. Using reference policy macros, you can then use manage_files_pattern macro to allow all access, for example:

manage_files_pattern(my_app_t, my_app_file_t, my_app_file_t)

There are also macros for other commonly used patterns, located at /policy/support in the reference policy source.

If my_app_t is defined by a reference policy module, there likely already exists an interface, which you can use to allow access. Interfaces are documented in reference policy API documentation (provided by selinux-policy-doc package) and are also available online (however a bit outdated).

The easiest way to build a reference policy module is by using the makefile in SELinux policy development package (selinux-policy-devel or similar) of your distribution, for example: make -f /usr/share/selinux/devel/Makefile my_app.pp.

  • Thanks. I didn't know the manage_files_pattern macro existed. In my particular case, my_app_t and my_app_file_t are actually defined in my module, I just didn't include them in my question because it didn't seem relevant. – jayhendren Dec 7 '18 at 20:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.