From patchwork Thu Sep 3 17:02:46 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yi-Hung Wei X-Patchwork-Id: 1356760 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=openvswitch.org (client-ip=140.211.166.136; helo=silver.osuosl.org; envelope-from=ovs-dev-bounces@openvswitch.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20161025 header.b=YtaHpN12; dkim-atps=neutral Received: from silver.osuosl.org (smtp3.osuosl.org [140.211.166.136]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 4Bj6ZY1fjyz9sR4 for ; Fri, 4 Sep 2020 03:03:17 +1000 (AEST) Received: from localhost (localhost [127.0.0.1]) by silver.osuosl.org (Postfix) with ESMTP id AB7542E12E; Thu, 3 Sep 2020 17:03:15 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from silver.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id o+GYs6kBBFjk; Thu, 3 Sep 2020 17:03:13 +0000 (UTC) Received: from lists.linuxfoundation.org (lf-lists.osuosl.org [140.211.9.56]) by silver.osuosl.org (Postfix) with ESMTP id 3406A203A7; Thu, 3 Sep 2020 17:03:13 +0000 (UTC) Received: from lf-lists.osuosl.org (localhost [127.0.0.1]) by lists.linuxfoundation.org (Postfix) with ESMTP id 1B004C07FF; Thu, 3 Sep 2020 17:03:13 +0000 (UTC) X-Original-To: dev@openvswitch.org Delivered-To: ovs-dev@lists.linuxfoundation.org Received: from silver.osuosl.org (smtp3.osuosl.org [140.211.166.136]) by lists.linuxfoundation.org (Postfix) with ESMTP id 9DB69C0051 for ; Thu, 3 Sep 2020 17:03:11 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by silver.osuosl.org (Postfix) with ESMTP id 88D16272AB for ; Thu, 3 Sep 2020 17:03:11 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from silver.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QzPTZ+xI9nqQ for ; Thu, 3 Sep 2020 17:03:09 +0000 (UTC) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6 Received: from mail-pf1-f195.google.com (mail-pf1-f195.google.com [209.85.210.195]) by silver.osuosl.org (Postfix) with ESMTPS id 4BAD02E0EB for ; Thu, 3 Sep 2020 17:03:09 +0000 (UTC) Received: by mail-pf1-f195.google.com with SMTP id o20so2802143pfp.11 for ; Thu, 03 Sep 2020 10:03:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=yzOhcZYlxbV0ay4qu4K8Fau38VD0O2NPWvMlSs5CC+0=; b=YtaHpN12jeZxlNGP9anIDlMWvQvfdcdnVr7tLJTOK/Zemi72HnYkAZbSA/Q8omtmTg zcZkuVQMAA638wKu1D1qEs/nJtewK1/4XwPwcWFYW7av3btACiXRWRu3JwSFxhE4XenE Zwx/uQXhTsMcl6RZfV9bsNBREdck7kX7Yz7mHLTJsJLKN8IPnD8pSUywaL/TmAdUc9+P KudHo5pGhVYqCt4u7YzwD8ZwTXZQH3WJM3YlossmxdTYz5geo9POWwakSS7dSkZq1hep 4uSH5b8sgEV4geIzFDRvCfshl3zx9zyrjvFehViyVuZsOJlQaTE/A5ibo3z5RL+SlYk7 4Svg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=yzOhcZYlxbV0ay4qu4K8Fau38VD0O2NPWvMlSs5CC+0=; b=MB5oDyTcZHEtxw7z7pDkwS4IhwnBzsLAaAgn3x048sWSGbyIG6PuAGYagcYRVCndKZ UTJ7T4/zzcW4/cQlXwere5ItdU+1et0xM8d4MGl4fA27UAfVL2SfiY3y1wNvBFEjBIFU I1rDLXdf5qmkIJM7calmNcCPCBygHqyCC0lvHER5bQfIUxkJHAVnJGp7ASSKKi7s3ysr YA6pa4KPWqqfPXeaqGAy7O09trcP+EuIxYvr3vcAoL4LpMHZ7ymPfH3F4++LW82QxSS1 ju/MpiucrReo6Y1rsHw8wRzqtnhkohyPmztMyfkkdDHD8Y+fRgHCcnrXXI6Iwqpf5Gg5 +Rqw== X-Gm-Message-State: AOAM533egJG5z6unViXabutvky6HNNKqeISPCQFO6RYwxB1y6B4mEBEb 23qgLLtYoDrL1eHAmStHRNEVdTUkDwK+7w== X-Google-Smtp-Source: ABdhPJwtEa9XX1L+huGhOMwB28tEmO+7e8h4UAazZOkzZtCd7ItTvqpdWpC7qFg4bHTgoezznQW5Zg== X-Received: by 2002:a62:92ce:0:b029:13b:88f6:3935 with SMTP id o197-20020a6292ce0000b029013b88f63935mr2969512pfd.2.1599152588331; Thu, 03 Sep 2020 10:03:08 -0700 (PDT) Received: from vm-main.eng.vmware.com ([66.170.99.2]) by smtp.gmail.com with ESMTPSA id k5sm3113163pjq.5.2020.09.03.10.03.06 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Thu, 03 Sep 2020 10:03:07 -0700 (PDT) From: Yi-Hung Wei To: dev@openvswitch.org Date: Thu, 3 Sep 2020 10:02:46 -0700 Message-Id: <1599152566-79233-1-git-send-email-yihung.wei@gmail.com> X-Mailer: git-send-email 2.7.4 Subject: [ovs-dev] [PATCH] selinux: Add missing permissions for ovs-kmod-ctl X-BeenThere: ovs-dev@openvswitch.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: ovs-dev-bounces@openvswitch.org Sender: "dev" On RHEL 8, a SELinux policy is missing when ovs-kmod-ctl use modprobe to load kernel modules. This patch adds the missing permissions based on /var/log/audit/audit.log Example log of the AVC violations: type=AVC msg=audit(1599075387.136:65): avc: denied { read } for pid=1472 comm="modprobe" name="modules.alias.bin" dev="dm-0" ino=586629 scontext=system_u:system_r:openvswitch_load_module_t:s0 tcontext=system_u:object_r:modules_dep_t:s0 tclass=file permissive=0 type=AVC msg=audit(1599085253.148:45): avc: denied { open } for pid=1355 comm="modprobe" path="/usr/lib/modules/4.18.0-193.el8.x86_64/modules.dep.bin" dev="dm-0" ino=624258 scontext=system_u:system_r:openvswitch_load_module_t:s0 tcontext=unconfined_u:object_r:modules_dep_t:s0 tclass=file permissive=0 VMWare-BZ: #2633569 Signed-off-by: Yi-Hung Wei Acked-by: Greg Rose Acked-by: Ansis Atteka --- selinux/openvswitch-custom.te.in | 2 ++ 1 file changed, 2 insertions(+) diff --git a/selinux/openvswitch-custom.te.in b/selinux/openvswitch-custom.te.in index 2adaf231fe63..beb0ab0d6612 100644 --- a/selinux/openvswitch-custom.te.in +++ b/selinux/openvswitch-custom.te.in @@ -19,6 +19,7 @@ require { type kernel_t; type hostname_exec_t; type modules_conf_t; + type modules_dep_t; type modules_object_t; type passwd_file_t; type plymouth_exec_t; @@ -121,6 +122,7 @@ allow openvswitch_load_module_t insmod_exec_t:file { execute execute_no_trans ge allow openvswitch_load_module_t kernel_t:system module_request; allow openvswitch_load_module_t modules_conf_t:dir { getattr open read search }; allow openvswitch_load_module_t modules_conf_t:file { getattr open read }; +allow openvswitch_load_module_t modules_dep_t:file { getattr map open read }; allow openvswitch_load_module_t modules_object_t:file { map getattr open read }; allow openvswitch_load_module_t modules_object_t:dir { getattr open read search }; allow openvswitch_load_module_t openvswitch_load_module_exec_t:file { entrypoint };