From fe185d88a0d504efdc40ddf71b47b40b4223e057 Mon Sep 17 00:00:00 2001 From: Marius Gavrilescu Date: Thu, 21 Nov 2013 13:11:57 +0200 Subject: [PATCH] Finish SELinux policy ad fix some bugs Bugs fixed: * compile-error is now preserved * Fix typo: htm -> html * Logging in Format::CPP child fixed --- lib/Gruntmaster/Daemon.pm | 4 +- lib/Gruntmaster/Daemon/Format/CPP.pm | 4 +- selinux/gruntmasterd.fc | 2 + selinux/gruntmasterd.te | 60 +++++++++++++++++++++++++--- 4 files changed, 60 insertions(+), 10 deletions(-) create mode 100644 selinux/gruntmasterd.fc diff --git a/lib/Gruntmaster/Daemon.pm b/lib/Gruntmaster/Daemon.pm index f0e66f2..bc2518e 100644 --- a/lib/Gruntmaster/Daemon.pm +++ b/lib/Gruntmaster/Daemon.pm @@ -122,7 +122,7 @@ sub process{ $meta->{results} = \@full_results if scalar @full_results; DumpFile "meta.yml", $meta; for (<*>) { - unlink $_ unless $_ eq 'in' || $_ eq 'meta.yml'; + unlink $_ unless $_ eq 'in' || $_ eq 'meta.yml' || ($_ eq 'compile-error' && -s); } chdir '../..'; mkdir 'log' unless -d 'log'; @@ -131,7 +131,7 @@ sub process{ my $logmeta = LoadFile 'log/meta.yml'; $logmeta->{last}++; rename $dir, 'log/' . $logmeta->{last}; - generate 'log/' . $logmeta->{last} . '/index.htm'; + generate 'log/' . $logmeta->{last} . '/index.html'; DumpFile 'log/meta.yml', $logmeta; undef $logmetafh; generate 'log/index.html' diff --git a/lib/Gruntmaster/Daemon/Format/CPP.pm b/lib/Gruntmaster/Daemon/Format/CPP.pm index 707af32..828252a 100644 --- a/lib/Gruntmaster/Daemon/Format/CPP.pm +++ b/lib/Gruntmaster/Daemon/Format/CPP.pm @@ -53,10 +53,10 @@ sub run{ die [DIED, "Crash (SIG$signame)"] if $sig; die [NZX, "Non-zero exit status: " . ($? >> 8)] if $?; } else { - $^F = 50; - POSIX::close $_ for 0, 1, 3 .. $^F; my @fds = exists $args{fds} ? @{$args{fds}} : (); get_logger->trace("Running $basename with fds ". join ' ', @fds); + $^F = 50; + POSIX::close $_ for 0, 1, 3 .. $^F; my $it = natatime 2, @fds; while (my ($fd, $file) = $it->()) { open my $fh, $file or die $!; diff --git a/selinux/gruntmasterd.fc b/selinux/gruntmasterd.fc new file mode 100644 index 0000000..d215af2 --- /dev/null +++ b/selinux/gruntmasterd.fc @@ -0,0 +1,2 @@ +/usr/(local/)?bin/gruntmasterd gen_context(system_u:object_r:gruntmasterd_exec_t, s0) +# /var/log/gruntmasterd gen_context(system_u:object_r:gruntmasterd_log_t, s0) diff --git a/selinux/gruntmasterd.te b/selinux/gruntmasterd.te index bd0d99d..767e61a 100644 --- a/selinux/gruntmasterd.te +++ b/selinux/gruntmasterd.te @@ -1,4 +1,21 @@ -policy_mdule(gruntmasterd, 1.0) +policy_module(gruntmasterd, 1.0) + +define(`read_file_perms', `{ getattr ioctl read lock open }') +define(`read_dir_perms', `{ getattr ioctl read lock open search}') +define(`everything_file_perms', `{ getattr ioctl read lock open unlink setattr write create rename link }') +define(`everything_dir_perms', `{ getattr ioctl read lock open search unlink setattr write create rename link rmdir remove_name reparent add_name }') +define(`gruntmaster_read', `allow gruntmasterd_t $1 : dir read_dir_perms; allow gruntmasterd_t $1 : file read_file_perms; allow gruntmasterd_t $1 : lnk_file read_file_perms;') +define(`gruntmaster_everything', `allow gruntmasterd_t $1 : dir everything_dir_perms; allow gruntmasterd_t $1 : file everything_file_perms; allow gruntmasterd_t $1 : lnk_file everything_file_perms;') + +require{ + type bin_t; + type httpd_sys_content_rw_t; + type httpd_sys_content_t; + type httpd_t; + type httpd_tmp_t; + type proc_t; + type urandom_device_t; +} type gruntmasterd_t; type gruntmasterd_exec_t; @@ -10,15 +27,46 @@ logging_log_file(gruntmasterd_log_t); type gruntmaster_job_t; type gruntmaster_job_exec_t; init_daemon_domain(gruntmaster_job_t, gruntmaster_job_exec_t); +type_transition gruntmasterd_t gruntmaster_job_exec_t : process gruntmaster_job_t; +allow gruntmasterd_t gruntmaster_job_t:process transition; +dontaudit gruntmasterd_t gruntmaster_job_t:process noatsecure; +allow gruntmaster_job_t gruntmasterd_t:fd use; +allow gruntmaster_job_t gruntmasterd_t:process sigchld; +allow gruntmaster_job_t gruntmaster_job_exec_t:file write; +allow httpd_t gruntmaster_job_exec_t:file { read getattr open }; + +type_transition gruntmasterd_t httpd_tmp_t : file gruntmaster_job_exec_t; + +allow gruntmasterd_t self : process { fork setrlimit }; +allow gruntmasterd_t gruntmaster_job_t : process { sigkill siginh rlimitinh }; -allow gruntmasterd_t self : process fork; +gruntmaster_read(httpd_sys_content_t) +gruntmaster_read(proc_t) +gruntmaster_read(bin_t) +gruntmaster_read(lib_t) +gruntmaster_read(usr_t) +allow gruntmasterd_t urandom_device_t:chr_file read_file_perms; +allow gruntmasterd_t { gruntmaster_job_exec_t } : file execute; +allow gruntmasterd_t { bin_t lib_t } : file { execute execute_no_trans }; + +gruntmaster_everything(gruntmasterd_log_t) +gruntmaster_everything(gruntmaster_job_exec_t) +gruntmaster_everything(httpd_sys_content_rw_t) +gruntmaster_everything(httpd_tmp_t) +gruntmaster_everything(tmp_t) + +allow gruntmasterd_t self:fifo_file everything_file_perms; -allow gruntmasterd_t gruntmasterd_job_t : dir ra_dir_perms; -allow gruntmasterd_t gruntmasterd_job_t : file { create ra_file_perms }; logging_log_filetrans(gruntmasterd_t, gruntmasterd_log_t, file) logging_search_logs(gruntmasterd_t) libs_use_ld_so(gruntmasterd_t) -libs_use_ld_so(gruntmasterd_job_t) +libs_use_ld_so(gruntmaster_job_t) libs_use_shared_libs(gruntmasterd_t) -libs_use_shared_libs(gruntmasterd_job_t) \ No newline at end of file +libs_use_shared_libs(gruntmaster_job_t) + +miscfiles_read_localization(gruntmasterd_t) +miscfiles_read_localization(gruntmaster_job_t) + +files_search_etc(gruntmasterd_t) +files_read_etc_files(gruntmasterd_t) -- 2.39.2