Skip to content

Fixes for FR policy fixing up SELinux context of ~cftransport/.ssh #2816

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Jan 3, 2024
Merged

Fixes for FR policy fixing up SELinux context of ~cftransport/.ssh #2816

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
5cda66e
Fix condition of the FR SSH files SELinux context check
vpodzime Jan 2, 2024
ab1c21c
Fix class name for restorecon availability in FR policy
vpodzime Jan 2, 2024
9f88d5e
Fix check of ~cftransport/.ssh directory existence and SELinux context
vpodzime Jan 2, 2024
a32e2db
Don't use shell when checking SELinux context of FR SSH files
vpodzime Jan 2, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
51 changes: 28 additions & 23 deletions cfe_internal/enterprise/federation/federation.cf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -300,29 +300,34 @@ bundle agent transport_user
expression => not(returnszero("$(default:paths.semanage) fcontext -l | grep '$(home)/.ssh(/.*)?'", "useshell")),
if => fileexists("$(home)");
enabled.selinux_enabled::
# For all the files below it must be true that if they exist they need
Copy link
Contributor

@craigcomstock craigcomstock Jan 2, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I appreciate your explanation here but have to say this block has become rather unreadable. I wonder if we could do better? The logic reads to me as correct after some time looking at it.

Copy link
Contributor Author

@vpodzime vpodzime Jan 3, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Well, I know how to make this a lot nicer in Python. Or any language with functions and loops, really. But no clue how to make it nicer in CFEngine policy. Maybe @nickanderson can help polish this later.

Copy link
Contributor Author

@vpodzime vpodzime Jan 3, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We could use a list of files and then create an array with those files as keys and the results of the SELinux labels as values and then search for a false value in getindices() on the array. But that's similarly ugly, AFAICT.

# to have the right context.
# IOW, the following implication: if fileexists() then correct_context.
# IOW, the following OR: not(filexists()) or correct_context.
# not( and()) means that if for one of the files the implication is false, we get a true.
"incorrect_ssh_context"
expression => and( and(
fileexists("$(home)"),
fileexists("$(ssh_auth_keys)"),
fileexists("$(ssh_priv_key)"),
fileexists("$(ssh_pub_key)"),
fileexists("$(ssh_config)")),
or(
regcmp(".*[\s:]ssh_home_t[\s:].*",
execresult("ls -Z $(home) | grep .ssh",
useshell)),
regcmp(".*[\s:]ssh_home_t[\s:].*",
execresult("ls -Z $(ssh_auth_keys)",
useshell)),
regcmp(".*[\s:]ssh_home_t[\s:].*",
execresult("ls -Z $(ssh_priv_key)",
useshell)),
regcmp(".*[\s:]ssh_home_t[\s:].*",
execresult("ls -Z $(ssh_pub_key)",
useshell)),
regcmp(".*[\s:]ssh_home_t[\s:].*",
execresult("ls -Z $(ssh_config)",
useshell))));
expression => not( and(
or(
not(fileexists("$(home)/.ssh")),
regcmp(".*[\s:]ssh_home_t[\s:].*",
execresult("$(default:paths.ls) -dZ $(home)/.ssh", noshell))),
or(
not(fileexists("$(ssh_auth_keys)")),
regcmp(".*[\s:]ssh_home_t[\s:].*",
execresult("$(default:paths.ls) -Z $(ssh_auth_keys)", noshell))),
or(
not(fileexists("$(ssh_priv_key)")),
regcmp(".*[\s:]ssh_home_t[\s:].*",
execresult("$(default:paths.ls) -Z $(ssh_priv_key)", noshell))),
or(
not(fileexists("$(ssh_pub_key)")),
regcmp(".*[\s:]ssh_home_t[\s:].*",
execresult("$(default:paths.ls) -Z $(ssh_pub_key)", noshell))),
or(
not(fileexists("$(ssh_config)")),
regcmp(".*[\s:]ssh_home_t[\s:].*",
execresult("$(default:paths.ls) -Z $(ssh_config)", noshell)))
));
users:
"$(user)"
policy => "present",
Expand Down Expand Up @@ -369,7 +374,7 @@ bundle agent transport_user
# _stdlib_path_exists_<command> and paths.<command> are defined is masterfiles/lib/paths.cf
selinux_enabled.cftransport_fcontext_missing.default:_stdlib_path_exists_semanage::
"$(default:paths.semanage) fcontext -a -t ssh_home_t '$(home)/.ssh(/.*)?'";
selinux_enabled.incorrect_ssh_context.default:_stdlib_exists_restorecon::
selinux_enabled.incorrect_ssh_context.default:_stdlib_path_exists_restorecon::
"$(default:paths.restorecon) -R -F $(home)/.ssh/";

any::
Expand Down