Run frr service as frr_t and add new bfd_multi port #547

Koncpa · 2021-01-22T10:07:10Z

Confined frr service as frr_t and create policy files and rules for frr service.
FRRouting (FRR) is an IP routing protocol which
includes protocol daemons for BGP, IS-IS, LDP, OSPF, PIM, and RIP.
Add new port called bfd_multi for bfdd daemon, which is use in frr service.

policy/modules/contrib/frr.if

policy/modules/contrib/frr.te

WOnder93

Looks good to my untrained eye now, although @zpytela might have further comments.

Add new port called cmadmin for bfdd daemon, which is use in frr service. Related to PR: fedora-selinux#547

Koncpa · 2021-01-29T18:20:23Z

Add another permissions for frr policy, which were discover during testing a common selinux policy tests. The build test will fail, because in policy has added interface, which isn't yet in policy, but PR has already made: #556

WOnder93 · 2021-01-29T20:32:05Z

The build test will fail, because in policy has added interface, which isn't yet in policy, but PR has already made: #556

In that case why not just include the commit in this PR instead of opening a separate one?

Add new port called cmadmin for bfdd daemon, which is use in frr service. Related to PR: fedora-selinux#547

policy/modules.conf

policy/modules/contrib/frr.fc

zpytela · 2021-02-01T19:12:27Z

policy/modules/contrib/frr.fc

+/var/lock/subsys/ripd           gen_context(system_u:object_r:frr_lock_t,s0)
+/var/lock/subsys/ripngd         gen_context(system_u:object_r:frr_lock_t,s0)
+/var/lock/subsys/staticd        gen_context(system_u:object_r:frr_lock_t,s0)
+/var/lock/subsys/zebra          gen_context(system_u:object_r:frr_lock_t,s0)


Are all of the subsys locks plain files?

Yes, It was tested.

For plain files the -- spec can be used.

policy/modules/contrib/frr.if

policy/modules/contrib/frr.te

zpytela · 2021-02-01T19:35:29Z

policy/modules/contrib/frr.te

+files_pid_filetrans(frr_t, frr_var_run_t, { dir file lnk_file })
+
+allow frr_t frr_exec_t:dir search_dir_perms;
+read_lnk_files_pattern(frr_t, frr_exec_t, frr_exec_t)


Is there an example for executable symlink?

Yes, here you have example.

Example : type=PROCTITLE msg=audit(02/02/2021 06:02:14.242:651) : proctitle=/usr/lib/frr/fabricd -d -A 127.0.0.1 type=PATH msg=audit(02/02/2021 06:02:14.242:651) : item=0 name=/usr/lib64/frr/libfrr.so.0 nametype=UNKNOWN cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(02/02/2021 06:02:14.242:651) : cwd=/etc/frr type=SYSCALL msg=audit(02/02/2021 06:02:14.242:651) : arch=x86_64 syscall=openat success=no exit=EACCES(Permission denied) a0=0xffffff9c a1=0x7ffcae5eadb0 a2=O_RDONLY|O_CLOEXEC a3=0x0 items=1 ppid=35891 pid=35892 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=fabricd exe=/usr/lib/frr/fabricd subj=system_u:system_r:frr_t:s0 key=(null) type=AVC msg=audit(02/02/2021 06:02:14.242:651) : avc: denied { read } for pid=35892 comm=fabricd name=libfrr.so.0 dev="vda1" ino=35651802 scontext=system_u:system_r:frr_t:s0 tcontext=system_u:object_r:frr_exec_t:s0 tclass=lnk_file permissive=0

Thanks, I managed to find the previous discussion.

Can you post the output of this command?

ls -laZ /usr/lib64/frr

This seems like a packaging bug in frr - the executable files currently in /usr/lib/frr should be placed in /usr/libexec/frr instead. Did you report it to the maintainer/upstream?

@zpytela , matchpathcon say:
/usr/lib64/frr/libfrr.so.0 system_u:object_r:frr_exec_t:s0

This seems like a packaging bug in frr - the executable files currently in /usr/lib/frr should be placed in /usr/libexec/frr instead. Did you report it to the maintainer/upstream?

No didn't report that.

The problem is that in .fc there is /usr/lib/frr(/.*)? gen_context(system_u:object_r:frr_exec_t,s0), which breaks the labels in /usr/lib64/frr/..., since there is an equivalency between /usr/lib and /usr/lib64.

So issue is that this files should be in /usr/libexec/frr a also have different label?

Executable files which are not supposed to be executed from cmdline should be in /usr/libexec. Shared libraries should be in /usr/lib64 and have the common type lib_t unless there was a reason for having a private type - this matches the purpose of shared libraries.

@WOnder93 So I have already reported this bug to frr maintainer.

zpytela · 2021-02-02T12:22:54Z

@Koncpa, do you want to keep the 2 commit separate, like to distinguish between the initial policy and later enhancements, or will it make sense for you to squash them?

Koncpa · 2021-02-02T13:12:35Z

@Koncpa, do you want to keep the 2 commit separate, like to distinguish between the initial policy and later enhancements, or will it make sense for you to squash them?

What do you think that will be better? I made two commits because on previous commit made @WOnder93 review so I want distinguish later enchancements for next review.

Koncpa · 2021-02-04T15:02:41Z

Squash two commits into one.

Add new port called cmadmin for bfdd daemon, which is use in frr service. Related to PR: #547

vmojzis · 2021-02-10T09:38:41Z

@Koncpa Could you please rebase the PR to incoporate abf7fa2 ?

Add new port called cmadmin for bfdd daemon, which is use in frr service. Related to PR: fedora-selinux#547

policy/modules/contrib/frr.if

Koncpa · 2021-02-10T11:26:59Z

@Koncpa Could you please rebase the PR to incoporate abf7fa2 ?

Can I rebase PR to incorporate commit in this way?

zpytela · 2021-03-18T16:02:13Z

Now it generally looks good.

Confined frr service as frr_t and create policy files and rules for frr service. FRRouting (FRR) is an IP routing protocol which includes protocol daemons for BGP, IS-IS, LDP, OSPF, PIM, and RIP. Add new port called bfd_multi for bfdd daemon, which is use in frr service.

Koncpa force-pushed the frr branch 3 times, most recently from 3b578c3 to 86025b5 Compare January 22, 2021 14:42

WOnder93 reviewed Jan 25, 2021

View reviewed changes

policy/modules/contrib/frr.if Outdated Show resolved Hide resolved

WOnder93 reviewed Jan 25, 2021

View reviewed changes

policy/modules/contrib/frr.te Outdated Show resolved Hide resolved

WOnder93 reviewed Jan 25, 2021

View reviewed changes

policy/modules/contrib/frr.te Outdated Show resolved Hide resolved

Koncpa force-pushed the frr branch 4 times, most recently from 29b5ffc to e2d2f63 Compare January 26, 2021 09:48

WOnder93 approved these changes Jan 26, 2021

View reviewed changes

Koncpa added a commit to Koncpa/selinux-policy that referenced this pull request Jan 29, 2021

Add new cmadmin port for bfdd dameon

44e1335

Add new port called cmadmin for bfdd daemon, which is use in frr service. Related to PR: fedora-selinux#547

Koncpa mentioned this pull request Jan 29, 2021

Add new cmadmin port for bfdd dameon #556

Merged

Koncpa force-pushed the frr branch from e2d2f63 to 5f108cf Compare January 29, 2021 18:13

Koncpa force-pushed the frr branch from 5f108cf to 6048219 Compare January 29, 2021 18:20

Koncpa added a commit to Koncpa/selinux-policy that referenced this pull request Feb 1, 2021

Add new cmadmin port for bfdd dameon

abf7fa2

Add new port called cmadmin for bfdd daemon, which is use in frr service. Related to PR: fedora-selinux#547

zpytela requested changes Feb 1, 2021

View reviewed changes

Koncpa force-pushed the frr branch from 6048219 to a40e28d Compare February 2, 2021 11:23

Koncpa force-pushed the frr branch 2 times, most recently from 4c9f3fa to ae53499 Compare February 4, 2021 15:01

zpytela pushed a commit that referenced this pull request Feb 4, 2021

Add new cmadmin port for bfdd dameon

5caabf3

Add new port called cmadmin for bfdd daemon, which is use in frr service. Related to PR: #547

Koncpa force-pushed the frr branch 2 times, most recently from 13efe63 to a1ee416 Compare February 10, 2021 10:38

Koncpa added a commit to Koncpa/selinux-policy that referenced this pull request Feb 10, 2021

Add new cmadmin port for bfdd dameon

b0d1c8f

Add new port called cmadmin for bfdd daemon, which is use in frr service. Related to PR: fedora-selinux#547

Koncpa force-pushed the frr branch 3 times, most recently from ae53499 to e83f4ab Compare February 10, 2021 11:15

WOnder93 reviewed Feb 10, 2021

View reviewed changes

policy/modules/contrib/frr.if Show resolved Hide resolved

Koncpa force-pushed the frr branch 2 times, most recently from f7a8c31 to 6410e5e Compare February 12, 2021 13:59

Koncpa force-pushed the frr branch from 6410e5e to 3394136 Compare March 18, 2021 12:27

Koncpa changed the title ~~Run frr service as frr_t~~ Run frr service as frr_t and add new bfd_multi port Mar 18, 2021

zpytela approved these changes Mar 18, 2021

View reviewed changes

WOnder93 approved these changes Apr 7, 2021

View reviewed changes

Koncpa force-pushed the frr branch from 3394136 to d22abfa Compare May 25, 2021 14:12

Koncpa force-pushed the frr branch from d22abfa to 045a79d Compare May 11, 2022 06:51

Koncpa force-pushed the frr branch 2 times, most recently from 4f6d6ce to 9109d77 Compare June 15, 2022 10:01

Koncpa force-pushed the frr branch from 9109d77 to 8f66a21 Compare June 15, 2022 10:10

Run frr service as frr_t and add new bfd_multi port #547

Run frr service as frr_t and add new bfd_multi port #547

Koncpa commented Jan 22, 2021 •

edited

WOnder93 left a comment

Koncpa commented Jan 29, 2021

WOnder93 commented Jan 29, 2021

zpytela Feb 1, 2021

Koncpa Feb 2, 2021

zpytela Feb 2, 2021

zpytela Feb 1, 2021

Koncpa Feb 2, 2021

zpytela Feb 2, 2021

zpytela Feb 2, 2021

WOnder93 Feb 2, 2021

Koncpa Feb 2, 2021

Koncpa Feb 2, 2021

Koncpa Feb 2, 2021

zpytela Feb 2, 2021

Koncpa Feb 4, 2021

zpytela commented Feb 2, 2021

Koncpa commented Feb 2, 2021

Koncpa commented Feb 4, 2021

vmojzis commented Feb 10, 2021

Koncpa commented Feb 10, 2021

zpytela commented Mar 18, 2021

Run frr service as frr_t and add new bfd_multi port #547

Are you sure you want to change the base?

Run frr service as frr_t and add new bfd_multi port #547

Conversation

Koncpa commented Jan 22, 2021 • edited

WOnder93 left a comment

Choose a reason for hiding this comment

Koncpa commented Jan 29, 2021

WOnder93 commented Jan 29, 2021

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

zpytela commented Feb 2, 2021

Koncpa commented Feb 2, 2021

Koncpa commented Feb 4, 2021

vmojzis commented Feb 10, 2021

Koncpa commented Feb 10, 2021

zpytela commented Mar 18, 2021

Koncpa commented Jan 22, 2021 •

edited