[DSE-Dev] refpolicy: patch for Debian backup cron daily jobs

[Václav Ovsík]

Hi,
this patch solves following denials on Debian:

audit(1203020199.510:16): avc:  denied  { execute } for  pid=1841 comm="aptitude" name="bash" dev=sda1 ino=81922 scontext=system_u:system_r:backup_t:s0 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file
audit(1203020199.526:17): avc:  denied  { remove_name } for  pid=1847 comm="rm" name="aptitude.pkgstates.6.gz" dev=sda1 ino=213244 scontext=system_u:system_r:backup_t:s0 tcontext=system_u:object_r:backup_store_t:s0 tclass=dir
audit(1203020199.526:18): avc:  denied  { unlink } for  pid=1847 comm="rm" name="aptitude.pkgstates.6.gz" dev=sda1 ino=213244 scontext=system_u:system_r:backup_t:s0 tcontext=system_u:object_r:backup_store_t:s0 tclass=file
audit(1203020199.538:19): avc:  denied  { rename } for  pid=1848 comm="mv" name="aptitude.pkgstates.5.gz" dev=sda1 ino=213147 scontext=system_u:system_r:backup_t:s0 tcontext=system_u:object_r:backup_store_t:s0 tclass=file
audit(1203020212.719:22): avc:  denied  { fsetid } for  pid=1932 comm="cp" capability=4 scontext=system_u:system_r:backup_t:s0 tcontext=system_u:system_r:backup_t:s0 tclass=capability
audit(1203020212.759:23): avc:  denied  { execute } for  pid=1940 comm="standard" name="bash" dev=sda1 ino=81922 scontext=system_u:system_r:backup_t:s0 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file

Aptitude backup script /etc/cron.daily/aptitude saves the aptitude state
into /var/backup. Cron backup script /etc/cron.daily/standard saves
shadow files and the dpkg status into /var/backup.

The utility savelog from debianutils is used for rotating state
information of aptitude and dpkg (unfortunately). Savelog context
(logrotate_exec_t) should be removed (no specialisation for log files
only). Log rotation cron jobs /etc/cron.{daily,weekly}/sysklogd has
logrotate_exec_t already and some init scipts that uses savelog for
rotating logs during the boot has persmissions already too. So this is
ok alone hope.

Attached patch adds context for /etc/cron.daily/{aptitude,standard}
backup_exec_t. Permission to execute shell and manage files under
/var/backup is granted further.

Hope, this can be included.
Thanks
-- 
Zito
-------------- next part --------------
A non-text attachment was scrubbed...
Name: backup.deb.patch
Type: text/x-diff
Size: 1928 bytes
Desc: not available
Url : http://lists.alioth.debian.org/pipermail/selinux-devel/attachments/20080219/a3d1def2/attachment.patch