add a transition rule

[Vadym Chepkov]

Hi,

I have a script, executed by apache, which is running in httpd_svn_script_t domain. This
script calls svn-mailer(bin_t) which in turns calls
/usr/sbin/sendmail.sendmail(sendmail_exec_t) and since there is no transition defined,
sendmail still runs in httpd_svn_script_t and I get humongous amount of avc's. What
would be the proper rule to add to the local policy to make sendmail running in the proper
domain, sendmail_t? 
And for that matter if httpd_can_sendmail --> on, shouldn't it be happening
automatically? Thank you. 

Sincerely yours,
  Vadym Chepkov

[Dominick Grift]

On Sat, 2009-07-18 at 20:35 -0700, Vadym Chepkov wrote:
>  Hi,
>  
>  I have a script, executed by apache, which is running in httpd_svn_script_t domain. This
> script calls svn-mailer(bin_t) which in turns calls
> /usr/sbin/sendmail.sendmail(sendmail_exec_t) and since there is no transition defined,
> sendmail still runs in httpd_svn_script_t and I get humongous amount of avc's. What
> would be the proper rule to add to the local policy to make sendmail running in the proper
> domain, sendmail_t? 
>  And for that matter if httpd_can_sendmail --> on, shouldn't it be happening
> automatically? Thank you.  
Not sure about all this (sesearch and review of source
policy might
reveal the answer). I am not in my usual location so i cannot verify at
the moment, however my personal opinion is that you might as well write
some policy yourself to make this happen. Those httpd booleans are
generally coarse grained.

If you write a policy for your script and do a transition from
httpd_svn_script_t to myscript_t and than allow myscript_t to transition
to the mail domain (probably something like
sendmail_domtrans(myscript_t)). That way you do not pollute your
httpd_svn_script_t domain too much with access vectors that are really
meant for your script and not svn.

>  Sincerely yours,
>    Vadym Chepkov
>  
>  --
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-selinux-list

[Vadym Chepkov]

I created httpd_svn_script_t for this exact purpose, I don't think another one is
required.

sendmail_domtrans(httpd_svn_script_t) is the rule then?
Thank you, I will try it.

Sincerely yours,
  Vadym Chepkov


--- On Sun, 7/19/09, Dominick Grift <domg472(a)gmail.com&gt; wrote:

>  From: Dominick Grift <domg472(a)gmail.com&gt;
>  Subject: Re: add a transition rule
>  To: "Vadym Chepkov" <chepkov(a)yahoo.com&gt;
>  Cc: "Fedora SELinux" <fedora-selinux-list(a)redhat.com&gt;
>  Date: Sunday, July 19, 2009, 7:06 AM
>  On Sat, 2009-07-18 at 20:35 -0700,
>  Vadym Chepkov wrote:
>  > Hi,
>  > 
>  > I have a script, executed by apache, which is running
>  in httpd_svn_script_t domain. This script calls
>  svn-mailer(bin_t) which in turns calls
>  /usr/sbin/sendmail.sendmail(sendmail_exec_t) and since there
>  is no transition defined, sendmail still runs in
>  httpd_svn_script_t and I get humongous amount of avc's. What
>  would be the proper rule to add to the local policy to make
>  sendmail running in the proper domain, sendmail_t? 
>  > And for that matter if httpd_can_sendmail --> on,
>  shouldn't it be happening automatically? Thank you. 
>  Not sure about all this (sesearch and review of source
>  policy might
>  reveal the answer). I am not in my usual location so i
>  cannot verify at
>  the moment, however my personal opinion is that you might
>  as well write
>  some policy yourself to make this happen. Those httpd
>  booleans are
>  generally coarse grained.
>  
>  If you write a policy for your script and do a transition
>  from
>  httpd_svn_script_t to myscript_t and than allow myscript_t
>  to transition
>  to the mail domain (probably something like
>  sendmail_domtrans(myscript_t)). That way you do not pollute
>  your
>  httpd_svn_script_t domain too much with access vectors that
>  are really
>  meant for your script and not svn.
>  
>  > Sincerely yours,
>  >   Vadym Chepkov
>  > 
>  > --
>  > fedora-selinux-list mailing list
>  > fedora-selinux-list(a)redhat.com
>  > https://www.redhat.com/mailman/listinfo/fedora-selinux-list
>  
>

[Daniel J Walsh]

On 07/19/2009 09:33 AM, Vadym Chepkov wrote:
>  I created httpd_svn_script_t for this exact purpose, I don't
> think another one is required.
>  
>  sendmail_domtrans(httpd_svn_script_t) is the rule then?
>  Thank you, I will try it.
>  
>  Sincerely yours,
>    Vadym Chepkov
>  
>  
>  --- On Sun, 7/19/09, Dominick Grift <domg472(a)gmail.com&gt; wrote:
>  
> > From: Dominick Grift <domg472(a)gmail.com&gt;
> > Subject: Re: add a transition rule
> > To: "Vadym Chepkov" <chepkov(a)yahoo.com&gt;
> > Cc: "Fedora SELinux" <fedora-selinux-list(a)redhat.com&gt;
> > Date: Sunday, July 19, 2009, 7:06 AM
> > On Sat, 2009-07-18 at 20:35 -0700,
> > Vadym Chepkov wrote:
> >> Hi,
> >>
> >> I have a script, executed by apache, which is running
> > in httpd_svn_script_t domain. This script calls
> > svn-mailer(bin_t) which in turns calls
> > /usr/sbin/sendmail.sendmail(sendmail_exec_t) and since there
> > is no transition defined, sendmail still runs in
> > httpd_svn_script_t and I get humongous amount of avc's. What
> > would be the proper rule to add to the local policy to make
> > sendmail running in the proper domain, sendmail_t? 
> >> And for that matter if httpd_can_sendmail --> on,
> > shouldn't it be happening automatically? Thank you. 
> > Not sure about all this (sesearch and review of source
> > policy might
> > reveal the answer). I am not in my usual location so i
> > cannot verify at
> > the moment, however my personal opinion is that you might
> > as well write
> > some policy yourself to make this happen. Those httpd
> > booleans are
> > generally coarse grained.
> >
> > If you write a policy for your script and do a transition
> > from
> > httpd_svn_script_t to myscript_t and than allow myscript_t
> > to transition
> > to the mail domain (probably something like
> > sendmail_domtrans(myscript_t)). That way you do not pollute
> > your
> > httpd_svn_script_t domain too much with access vectors that
> > are really
> > meant for your script and not svn.
> >
> >> Sincerely yours,
> >>    Vadym Chepkov
> >>
> >> --
> >> fedora-selinux-list mailing list
> >> fedora-selinux-list(a)redhat.com
> >> https://www.redhat.com/mailman/listinfo/fedora-selinux-list
> >
>  
>  --
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-selinux-list 
mta_send_mail is
probably better, since it will cover all possible mailers, not just sendmail

[Paul Howarth]

Hi Vadym,

On 19/07/09 04:35, Vadym Chepkov wrote:
>  I have a script, executed by apache, which is running in
> httpd_svn_script_t domain. This script calls svn-mailer(bin_t) which in turns calls
> /usr/sbin/sendmail.sendmail(sendmail_exec_t) and since there is no transition defined,
> sendmail still runs in httpd_svn_script_t and I get humongous amount of avc's. What
> would be the proper rule to add to the local policy to make sendmail running in the proper
> domain, sendmail_t?
>  And for that matter if httpd_can_sendmail -->  on, shouldn't it be happening
> automatically? Thank you.
>
>  Sincerely yours,
>     Vadym Chepkov 
I'm just back off vacation and saw your email. Funnily enough I wrote an 
svnmailer policy a few weeks ago, so it would be interesting to compare 
notes:

I've actually split it into two modules, svnmailer for the policy 
itself, and svnmailer-extras for additional interfaces needed in other 
policy modules. I find this arrangement is easier to manage when getting 
policy merged upstream.

I made my hook scripts httpd_sys_script_exec_t and transition from there 
to httpd_svnmailer_script_t via a domtrans. The svn repository itself is 
httpd_sys_content_rw_t.

Paul.

[Vadym Chepkov]

Hi,

My policy is very simplistic

local.te
apache_content_template(svn)
domain_auto_trans(httpd_svn_script_t, sendmail_exec_t, sendmail_t)

local.fc
# svn
/var/svn(/.*)?                                                 
gen_context(system_u:object_r:httpd_svn_script_ro_t,s0)
/var/svn/(.*/)?hooks(/.*)?                         
gen_context(system_u:object_r:httpd_svn_script_exec_t,s0)
/var/svn/(.*/)?dav(/.*)?                           
gen_context(system_u:object_r:httpd_svn_script_rw_t,s0)
/var/svn/(.*/)?locks(/.*)?                         
gen_context(system_u:object_r:httpd_svn_script_rw_t,s0)
/var/svn/(.*/)?db(/.*)?                            
gen_context(system_u:object_r:httpd_svn_script_rw_t,s0)

Works well

Sincerely yours,
  Vadym Chepkov


--- On Tue, 7/28/09, Paul Howarth <paul(a)city-fan.org&gt; wrote:

>  From: Paul Howarth <paul(a)city-fan.org&gt;
>  Subject: Re: add a transition rule
>  To: "Vadym Chepkov" <chepkov(a)yahoo.com&gt;
>  Cc: "Fedora SELinux" <fedora-selinux-list(a)redhat.com&gt;
>  Date: Tuesday, July 28, 2009, 9:46 AM
>  Hi Vadym,
>  
>  On 19/07/09 04:35, Vadym Chepkov wrote:
>  > I have a script, executed by apache, which is running
>  in httpd_svn_script_t domain. This script calls
>  svn-mailer(bin_t) which in turns calls
>  /usr/sbin/sendmail.sendmail(sendmail_exec_t) and since there
>  is no transition defined, sendmail still runs in
>  httpd_svn_script_t and I get humongous amount of avc's. What
>  would be the proper rule to add to the local policy to make
>  sendmail running in the proper domain, sendmail_t?
>  > And for that matter if httpd_can_sendmail --> 
>  on, shouldn't it be happening automatically? Thank you.
>  > 
>  > Sincerely yours,
>  >    Vadym Chepkov
>  
>  I'm just back off vacation and saw your email. Funnily
>  enough I wrote an svnmailer policy a few weeks ago, so it
>  would be interesting to compare notes:
>  
>  I've actually split it into two modules, svnmailer for the
>  policy itself, and svnmailer-extras for additional
>  interfaces needed in other policy modules. I find this
>  arrangement is easier to manage when getting policy merged
>  upstream.
>  
>  I made my hook scripts httpd_sys_script_exec_t and
>  transition from there to httpd_svnmailer_script_t via a
>  domtrans. The svn repository itself is
>  httpd_sys_content_rw_t.
>  
>  Paul.
>