RFC: Expand checks about requirements to userspace classes #250
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Just a quick comment on the RFC nature of this: The high level idea seems really valuable, and like a good addition to SELint. Thanks for putting in the work on this! Looks like a pretty large chunk of code, so I don't think I'll have time to review it this week, but I'll aim to set aside some time next week. |
cgzones
force-pushed
the
userspace_classes
branch
from
f296281
to
cea5660
Compare
dburgener
requested changes
Jan 5, 2024
For checks checking for missing or redundant required types `get_names_in_node()` and `get_names_required()` return a list of names. Currently those are just a list of strings without any type information. Add a new datatype to store known type information to improve checks iterating these names.
cgzones
force-pushed
the
userspace_classes
branch
from
cea5660
to
2fe0fd8
Compare
Refpolicy findings:
unconfined.te: 63: (W): No explicit declaration for userspace class system. You should access it via interface call or use a require block. (W-001)
systemd.te: 1170: (W): No explicit declaration for userspace class dbus. You should access it via interface call or use a require block. (W-001)
systemd.te: 1282: (W): No explicit declaration for userspace class dbus. You should access it via interface call or use a require block. (W-001)
init.te: 261: (W): No explicit declaration for userspace class system. You should access it via interface call or use a require block. (W-001)
init.te: 302: (W): No explicit declaration for userspace class service. You should access it via interface call or use a require block. (W-001)
init.te: 1094: (W): No explicit declaration for userspace class system. You should access it via interface call or use a require block. (W-001)
init.te: 1102: (W): No explicit declaration for userspace class service. You should access it via interface call or use a require block. (W-001)
init.te: 1110: (W): No explicit declaration for userspace class service. You should access it via interface call or use a require block. (W-001)
init.te: 1114: (W): No explicit declaration for userspace class service. You should access it via interface call or use a require block. (W-001)
init.te: 1115: (W): No explicit declaration for userspace class service. You should access it via interface call or use a require block. (W-001)
devicekit.te: 56: (W): No explicit declaration for userspace class dbus. You should access it via interface call or use a require block. (W-001)
devicekit.te: 157: (W): No explicit declaration for userspace class dbus. You should access it via interface call or use a require block. (W-001)
devicekit.te: 297: (W): No explicit declaration for userspace class dbus. You should access it via interface call or use a require block. (W-001)
kernel.te: 558: (W): No explicit declaration for userspace class system. You should access it via interface call or use a require block. (W-001)
chromium.if: 139: (W): Class dbus is listed in require block but not used in interface (W-003)
init.if: 1200: (W): Class system is used in interface but not required (W-002)
init.if: 1218: (W): Class system is used in interface but not required (W-002)
init.if: 1236: (W): Class system is used in interface but not required (W-002)
init.if: 1254: (W): Class system is used in interface but not required (W-002)
init.if: 1272: (W): Class system is used in interface but not required (W-002)
init.if: 1290: (W): Class system is used in interface but not required (W-002)
init.if: 1308: (W): Class system is used in interface but not required (W-002)
init.if: 1326: (W): Class system is used in interface but not required (W-002)
init.if: 1401: (W): Class bpf is listed in require block but is not a userspace class (W-003)
systemd.if: 148: (W): Class system is used in interface but not required (W-002)
systemd.if: 158: (W): Class service is used in interface but not required (W-002)
systemd.if: 159: (W): Class service is used in interface but not required (W-002)
systemd.if: 391: (W): Class system is used in interface but not required (W-002)
systemd.if: 415: (W): Class system is used in interface but not required (W-002)
systemd.if: 439: (W): Class system is used in interface but not required (W-002)
unconfined.if: 34: (W): Class service is listed in require block but not used in interface (W-003)
xserver.if: 353: (W): Class x_property is listed in require block but not used in interface (W-003)
postgresql.if: 31: (W): Class db_database is listed in require block but not used in interface (W-003)
postgresql.if: 37: (W): Class db_language is listed in require block but not used in interface (W-003)
postgresql.if: 465: (W): Class db_database is listed in require block but not used in interface (W-003)
postgresql.if: 471: (W): Class db_language is listed in require block but not used in interface (W-003)
Found the following issue counts:
W-001: 14
W-002: 14
W-003: 8
Add a section to the ReadMe mentioning the policy convention expected, which are used to improve comprehension of the policy improving accuracy of checks.
cgzones
force-pushed
the
userspace_classes
branch
from
2fe0fd8
to
6fbb752
Compare
dburgener
approved these changes
Jan 8, 2024
|
This looks good, merged, thanks! |
Merged
dburgener
added a commit
that referenced
this pull request
Jan 8, 2024
Merged
dburgener
added a commit
that referenced
this pull request
Jan 9, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Expand the check
W-001,W-002andW-003to security classes.Since the
systemclass is used both by the kernel and in userspace by systemd some machinery needs to be added to gather the associated used permission.This can also be reused to infer the type of identifiers, see #206.