Skip to content

Commit e7f1fe8

Browse files
dorileodorileo
committed
selinux: introduce policy module
Introduce a guest-agent selinux policy. Build and packaging to follow in an upcoming PR. To manually build and install, in a EL 9 system do: - install policycoreutils-devel package - cd selinux && make -f /usr/share/selinux/devel/Makefile google_guest_agent.pp - sudo /usr/sbin/semodule -i google_guest_agent.pp - sudo restorecon /usr/bin/google_metadata_* - sudo systemctl restart google-guest-agent && sudo systemctl restart google-guest-agent-manager
1 parent bdc0a12 commit e7f1fe8

File tree

3 files changed

+150
-0
lines changed

3 files changed

+150
-0
lines changed

‎selinux/google_guest_agent.fc‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
/usr/bin/google_guest_agent_manager -- gen_context(system_u:object_r:google_guest_agent_exec_t,s0)
2+
3+
/usr/bin/google_guest_agent -- gen_context(system_u:object_r:google_guest_agent_exec_t,s0)
4+
5+
/usr/bin/google_metadata_script_runner -- gen_context(system_u:object_r:google_guest_agent_exec_t,s0)
6+
7+
/usr/lib/systemd/system-preset/90-google-guest-agent.preset -- gen_context(system_u:object_r:google_guest_agent_unit_file_t,s0)
8+
9+
/usr/lib/systemd/system/gce-workload-cert-refresh.service -- gen_context(system_u:object_r:google_guest_agent_unit_file_t,s0)
10+
11+
/usr/lib/systemd/system/gce-workload-cert-refresh.timer -- gen_context(system_u:object_r:google_guest_agent_unit_file_t,s0)
12+
13+
/usr/lib/systemd/system/google-guest-agent-manager.service -- gen_context(system_u:object_r:google_guest_agent_unit_file_t,s0)
14+
15+
/usr/lib/systemd/system/google-guest-agent.service -- gen_context(system_u:object_r:google_guest_agent_unit_file_t,s0)
16+
17+
/usr/lib/systemd/system/google-shutdown-scripts.service -- gen_context(system_u:object_r:google_guest_agent_unit_file_t,s0)
18+
19+
/usr/lib/systemd/system/google-startup-scripts.service -- gen_context(system_u:object_r:google_guest_agent_unit_file_t,s0)

‎selinux/google_guest_agent.if‎

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
2+
## <summary>policy for google_guest_agent</summary>
3+
4+
########################################
5+
## <summary>
6+
## Execute google_guest_agent_exec_t in the google_guest_agent domain.
7+
## </summary>
8+
## <param name="domain">
9+
## <summary>
10+
## Domain allowed to transition.
11+
## </summary>
12+
## </param>
13+
#
14+
interface(`google_guest_agent_domtrans',`
15+
gen_require(`
16+
type google_guest_agent_t, google_guest_agent_exec_t;
17+
')
18+
19+
corecmd_search_bin($1)
20+
domtrans_pattern($1, google_guest_agent_exec_t, google_guest_agent_t)
21+
')
22+
23+
######################################
24+
## <summary>
25+
## Execute google_guest_agent in the caller domain.
26+
## </summary>
27+
## <param name="domain">
28+
## <summary>
29+
## Domain allowed access.
30+
## </summary>
31+
## </param>
32+
#
33+
interface(`google_guest_agent_exec',`
34+
gen_require(`
35+
type google_guest_agent_exec_t;
36+
')
37+
38+
corecmd_search_bin($1)
39+
can_exec($1, google_guest_agent_exec_t)
40+
')
41+
########################################
42+
## <summary>
43+
## Execute google_guest_agent server in the google_guest_agent domain.
44+
## </summary>
45+
## <param name="domain">
46+
## <summary>
47+
## Domain allowed to transition.
48+
## </summary>
49+
## </param>
50+
#
51+
interface(`google_guest_agent_systemctl',`
52+
gen_require(`
53+
type google_guest_agent_t;
54+
type google_guest_agent_unit_file_t;
55+
')
56+
57+
systemd_exec_systemctl($1)
58+
systemd_read_fifo_file_passwd_run($1)
59+
allow $1 google_guest_agent_unit_file_t:file read_file_perms;
60+
allow $1 google_guest_agent_unit_file_t:service manage_service_perms;
61+
62+
ps_process_pattern($1, google_guest_agent_t)
63+
')
64+
65+
66+
########################################
67+
## <summary>
68+
## All of the rules required to administrate
69+
## an google_guest_agent environment
70+
## </summary>
71+
## <param name="domain">
72+
## <summary>
73+
## Domain allowed access.
74+
## </summary>
75+
## </param>
76+
## <param name="role">
77+
## <summary>
78+
## Role allowed access.
79+
## </summary>
80+
## </param>
81+
## <rolecap/>
82+
#
83+
interface(`google_guest_agent_admin',`
84+
gen_require(`
85+
type google_guest_agent_t;
86+
type google_guest_agent_unit_file_t;
87+
')
88+
89+
allow $1 google_guest_agent_t:process { signal_perms };
90+
ps_process_pattern($1, google_guest_agent_t)
91+
92+
tunable_policy(`deny_ptrace',`',`
93+
allow $1 google_guest_agent_t:process ptrace;
94+
')
95+
96+
google_guest_agent_systemctl($1)
97+
admin_pattern($1, google_guest_agent_unit_file_t)
98+
allow $1 google_guest_agent_unit_file_t:service all_service_perms;
99+
optional_policy(`
100+
systemd_passwd_agent_exec($1)
101+
systemd_read_fifo_file_passwd_run($1)
102+
')
103+
')

‎selinux/google_guest_agent.te‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
policy_module(google_guest_agent, 1.0.0)
2+
3+
########################################
4+
#
5+
# Declarations
6+
#
7+
8+
type google_guest_agent_t;
9+
type google_guest_agent_exec_t;
10+
init_daemon_domain(google_guest_agent_t, google_guest_agent_exec_t)
11+
12+
permissive google_guest_agent_t;
13+
14+
type google_guest_agent_unit_file_t;
15+
systemd_unit_file(google_guest_agent_unit_file_t)
16+
17+
########################################
18+
#
19+
# google_guest_agent local policy
20+
#
21+
allow google_guest_agent_t self:fifo_file rw_fifo_file_perms;
22+
allow google_guest_agent_t self:unix_stream_socket create_stream_socket_perms;
23+
24+
domain_use_interactive_fds(google_guest_agent_t)
25+
26+
files_read_etc_files(google_guest_agent_t)
27+
28+
miscfiles_read_localization(google_guest_agent_t)

0 commit comments

Comments
 (0)