Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

systemd-homed: various fixups #839

Merged
merged 16 commits into from
Dec 10, 2024
Merged

systemd-homed: various fixups #839

Show file tree
Hide file tree
Changes from 9 commits
Commits
Show all changes
16 commits
Select commit Hold shift + click to select a range
c90195b
systemd_stream_connect_homed: new interface to access account info
WavyEbuilder Nov 28, 2024
0b129ea
locallogin: allow talking to systemd-homed user record APIs
WavyEbuilder Nov 28, 2024
8ee5070
systemd_homed_t, systemd_homework_t: allow reading of /etc/machine-id
WavyEbuilder Nov 28, 2024
5a6334a
systemd-homed: label LUKS home images as systemd_homed_storage_t
WavyEbuilder Nov 28, 2024
5b382a4
authlogin: connect to homed
WavyEbuilder Nov 28, 2024
b1babb9
systemd_homed_runtime_work_dir_t: new type for systemd-homed workdir
WavyEbuilder Nov 28, 2024
a74dd7b
lvm_manage_runtime_dirs: new interface for managing LVM runtime dirs
WavyEbuilder Nov 28, 2024
76febf5
systemd_homework_t: allow managing of lvm_runtime_t files and dirs
WavyEbuilder Nov 28, 2024
cfeefc0
systemd_homed_record_t: new type for user records
WavyEbuilder Nov 28, 2024
91b23cc
systemd_stream_connect_homed: make use of stream_connect_pattern
WavyEbuilder Dec 4, 2024
28788aa
systemd-homed: make lvm related policy optional
WavyEbuilder Dec 4, 2024
bbf1e6f
systemd-homework: reformat *_files_pattern block
WavyEbuilder Dec 4, 2024
84fd2d7
systemd-homed: use files_read_etc_runtime_files to read machine-id
WavyEbuilder Dec 4, 2024
63a5726
systemd-homed: fix filecontexts for systemd_home_storage_t objects
WavyEbuilder Dec 4, 2024
be6f0a5
systemd_stream_connect_homed: genrequire systemd_userdbd_runtime_t
WavyEbuilder Dec 10, 2024
a4485e5
systemd-homework: move optional policy to end of block
WavyEbuilder Dec 10, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions policy/modules/system/authlogin.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -476,6 +476,7 @@ sysnet_dns_name_resolve(nsswitch_domain)

ifdef(`init_systemd', `
systemd_stream_connect_userdb(nsswitch_domain)
systemd_stream_connect_homed(nsswitch_domain)
')

tunable_policy(`authlogin_nsswitch_use_ldap',`
Expand Down
2 changes: 2 additions & 0 deletions policy/modules/system/locallogin.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -154,6 +154,8 @@ ifdef(`init_systemd',`
systemd_dbus_chat_logind(local_login_t)
systemd_use_logind_fds(local_login_t)
systemd_manage_logind_runtime_pipes(local_login_t)
systemd_dbus_chat_homed(local_login_t)
systemd_stream_connect_homed(local_login_t)
')

ifdef(`distro_debian',`
Expand Down
19 changes: 19 additions & 0 deletions policy/modules/system/lvm.if
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -210,6 +210,25 @@ interface(`lvm_manage_runtime_files',`
manage_files_pattern($1, lvm_runtime_t, lvm_runtime_t)
')

########################################
## <summary>
## Manage LVM runtime dirs.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
## <rolecap/>
#
interface(`lvm_manage_runtime_dirs',`
gen_require(`
type lvm_runtime_t;
')

manage_dirs_pattern($1, lvm_runtime_t, lvm_runtime_t)
')

######################################
## <summary>
## All of the rules required to
Expand Down
6 changes: 6 additions & 0 deletions policy/modules/system/systemd.fc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,6 +61,11 @@ HOME_DIR/\.config/containers/systemd(/.*)? gen_context(system_u:object_r:system
HOME_DIR/\.config/systemd(/.*)? gen_context(system_u:object_r:systemd_conf_home_t,s0)
HOME_DIR/\.local/share/systemd(/.*)? gen_context(system_u:object_r:systemd_data_home_t,s0)

# homed files
HOME_DIR/\.identity -- gen_context(system_u:object_r:systemd_homed_record_t,s0)
HOME_DIR/\.identity-blob(/.*)? gen_context(system_u:object_r:systemd_homed_record_t,s0)
pebenito marked this conversation as resolved.
Show resolved Hide resolved
HOME_ROOT/(.+)\.home -- gen_context(system_u:object_r:systemd_homed_storage_t,s0)

/usr/lib/systemd/user(/.*)? gen_context(system_u:object_r:systemd_user_unit_t,s0)

/usr/lib/systemd/system/[^/]*halt.* -- gen_context(system_u:object_r:power_unit_t,s0)
Expand Down Expand Up @@ -106,6 +111,7 @@ HOME_DIR/\.local/share/systemd(/.*)? gen_context(system_u:object_r:systemd_data
/run/systemd/ask-password(/.*)? gen_context(system_u:object_r:systemd_passwd_runtime_t,s0)
/run/systemd/ask-password-block(/.*)? gen_context(system_u:object_r:systemd_passwd_runtime_t,s0)
/run/systemd/home(/.*)? gen_context(system_u:object_r:systemd_homed_runtime_t,s0)
/run/systemd/user-home-mount -d gen_context(system_u:object_r:systemd_homed_runtime_work_dir_t,s0)
/run/systemd/network(/.*)? gen_context(system_u:object_r:systemd_networkd_runtime_t,s0)
/run/systemd/notify -s gen_context(system_u:object_r:systemd_runtime_notify_t,s0)
/run/systemd/resolve(/.*)? gen_context(system_u:object_r:systemd_resolved_runtime_t,s0)
Expand Down
19 changes: 19 additions & 0 deletions policy/modules/system/systemd.if
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1136,6 +1136,25 @@ interface(`systemd_dbus_chat_homed',`
allow systemd_homed_t $1:dbus send_msg;
')

########################################
## <summary>
## Connect to /run/systemd/userdb/io.systemd.Home to
## query user account information.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`systemd_stream_connect_homed',`
gen_require(`
type systemd_homed_t;
')

allow $1 systemd_homed_t:unix_stream_socket connectto;
WavyEbuilder marked this conversation as resolved.
Show resolved Hide resolved
')

######################################
## <summary>
## Read and write systemd-homework semaphores.
Expand Down
23 changes: 22 additions & 1 deletion policy/modules/system/systemd.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -126,9 +126,16 @@ domain_type(systemd_homework_t)
domain_entry_file(systemd_homework_t, systemd_homework_exec_t)
role system_r types systemd_homework_t;

type systemd_homed_record_t;
files_auth_file(systemd_homed_record_t)

type systemd_homed_runtime_t;
files_runtime_file(systemd_homed_runtime_t)

type systemd_homed_runtime_work_dir_t;
files_runtime_file(systemd_homed_runtime_work_dir_t)
files_mountpoint(systemd_homed_runtime_work_dir_t)

type systemd_homed_storage_t;
files_type(systemd_homed_storage_t)

Expand Down Expand Up @@ -675,6 +682,9 @@ allow systemd_homed_t systemd_homed_var_lib_t:dir manage_dir_perms;
allow systemd_homed_t systemd_homed_var_lib_t:file manage_file_perms;
init_var_lib_filetrans(systemd_homed_t, systemd_homed_var_lib_t, dir)

# read /etc/machine-id
files_read_etc_runtime(systemd_homed_t)

# Entries such as /sys/devices/virtual/block/loop1/uevent:
dev_read_sysfs(systemd_homed_t)

Expand Down Expand Up @@ -725,14 +735,21 @@ allow systemd_homework_t systemd_homed_runtime_t:dir manage_dir_perms;
files_runtime_filetrans(systemd_homework_t, systemd_homed_runtime_t, file)
init_runtime_filetrans(systemd_homework_t, systemd_homed_runtime_t, dir)

# read /etc/machine-id
files_read_etc_runtime(systemd_homework_t)

# mount on /run/systemd/user-home-mount
allow systemd_homework_t systemd_homed_runtime_t:dir mounton;
allow systemd_homework_t systemd_homed_runtime_work_dir_t:dir mounton;

allow systemd_homework_t systemd_homed_storage_t:file manage_file_perms;
files_home_filetrans(systemd_homework_t, systemd_homed_storage_t, file)

allow systemd_homework_t systemd_homed_tmpfs_t:file rw_inherited_file_perms;

# setup luks backed home directories in /run/cryptsetup
lvm_manage_runtime_files(systemd_homework_t)
lvm_manage_runtime_dirs(systemd_homework_t)
WavyEbuilder marked this conversation as resolved.
Show resolved Hide resolved

dev_rw_loop_control(systemd_homework_t)
dev_read_rand(systemd_homework_t)
dev_read_urand(systemd_homework_t)
Expand Down Expand Up @@ -769,6 +786,10 @@ systemd_log_parse_environment(systemd_homework_t)

udev_read_runtime_files(systemd_homework_t)

read_files_pattern(systemd_homework_t, systemd_homed_runtime_work_dir_t, systemd_homed_record_t)
create_files_pattern(systemd_homework_t, systemd_homed_runtime_work_dir_t, systemd_homed_record_t)
delete_files_pattern(systemd_homework_t, systemd_homed_runtime_work_dir_t, systemd_homed_record_t)
WavyEbuilder marked this conversation as resolved.
Show resolved Hide resolved

#######################################
#
# Hostnamed policy
Expand Down
Loading