!42 restore ima selinux type when perform new configuration
From: @xucee Reviewed-by: @HuaxinLuGitee Signed-off-by: @HuaxinLuGitee
This commit is contained in:
openeuler-ci-bot
Gitee
commit
266ba061b6
127
restore-ima-selinux-type-when-perform-new-configurat.patch
Normal file
127
restore-ima-selinux-type-when-perform-new-configurat.patch
Normal file
@ -0,0 +1,127 @@
|
||||
From 7adb0853596e1ec546ef33aba26b69e31a695041 Mon Sep 17 00:00:00 2001
|
||||
From: xuce <xuce10@h-partners.com>
|
||||
Date: Mon, 2 Dec 2024 16:16:40 +0800
|
||||
Subject: [PATCH] restore ima selinux type when perform new configuration
|
||||
|
||||
Signed-off-by: xuce <xuce10@h-partners.com>
|
||||
---
|
||||
secpaver-secconf-1.0.0/secconf/gen/gen_ima | 73 ++++++++++++----------
|
||||
1 file changed, 40 insertions(+), 33 deletions(-)
|
||||
|
||||
diff --git a/secpaver-secconf-1.0.0/secconf/gen/gen_ima b/secpaver-secconf-1.0.0/secconf/gen/gen_ima
|
||||
index a657614..d40dce6 100644
|
||||
--- a/secpaver-secconf-1.0.0/secconf/gen/gen_ima
|
||||
+++ b/secpaver-secconf-1.0.0/secconf/gen/gen_ima
|
||||
@@ -14,7 +14,7 @@ measure_list+=({{.}})
|
||||
{{end}}
|
||||
|
||||
needReboot=false
|
||||
-packages=("ima-evm-utils" "digest-list-tools")
|
||||
+packages=("ima-evm-utils" "digest-list-tools" "selinux-policy" "selinux-policy-targeted" "policycoreutils")
|
||||
for pkg in "${packages[@]}"; do
|
||||
get_usr_input "${pkg} is about to installed?【Y/N】"
|
||||
if [ $? -eq 1 ]; then
|
||||
@@ -33,14 +33,14 @@ rm_kernel_param()
|
||||
for param in "${@}"; do
|
||||
cmdline_contains_param=$(grep -q "${param}" /proc/cmdline && echo "true" || echo "false")
|
||||
grub_contains_param=$(grep -q "${param}" "${grub_path}" && echo "true" || echo "false")
|
||||
- if [[ "$cmdline_contains_param" == "true" && "$grub_contains_param" == "true" ]]; then
|
||||
- sed -i "s/ \<${param}\>//g" ${grub_path}
|
||||
- needReboot=true
|
||||
- elif [[ "$cmdline_contains_param" == "false" && "$grub_contains_param" == "true" ]]; then
|
||||
- sed -i "s/ \<${param}\>//g" ${grub_path}
|
||||
- elif [[ "$cmdline_contains_param" == "true" && "$grub_contains_param" == "false" ]]; then
|
||||
- needReboot=true
|
||||
- fi
|
||||
+ if [[ "$cmdline_contains_param" == "true" && "$grub_contains_param" == "true" ]]; then
|
||||
+ sed -i "s/ \<${param}\>//g" ${grub_path}
|
||||
+ needReboot=true
|
||||
+ elif [[ "$cmdline_contains_param" == "false" && "$grub_contains_param" == "true" ]]; then
|
||||
+ sed -i "s/ \<${param}\>//g" ${grub_path}
|
||||
+ elif [[ "$cmdline_contains_param" == "true" && "$grub_contains_param" == "false" ]]; then
|
||||
+ needReboot=true
|
||||
+ fi
|
||||
done
|
||||
}
|
||||
|
||||
@@ -60,8 +60,39 @@ set_kernel_param()
|
||||
done
|
||||
}
|
||||
|
||||
+set_selinux_type()
|
||||
+{
|
||||
+ module_name=$(echo "$1" | awk -F'_' '{print $1 "_" $2}')
|
||||
+ semodule -l | grep $module_name > /dev/null
|
||||
+ if [ $? -eq 1 ]; then
|
||||
+ file=/tmp/${module_name}.cil
|
||||
+ cat <<EOF > $file
|
||||
+(type $1)
|
||||
+(roletype object_r $1)
|
||||
+(typeattributeset file_type ($1))
|
||||
+(allow domain $1 (file (append execmod ioctl mounton relabelfrom swapon watch_reads audit_access execute link open relabelto unlink watch_sb create execute_no_trans lock quotaon rename watch watch_with_perm entrypoint getattr map read setattr watch_mount write)))
|
||||
+EOF
|
||||
+
|
||||
+ semodule -i $file
|
||||
+ echo "selinux type $1 has been successfully created"
|
||||
+ rm $file
|
||||
+ fi
|
||||
+ chcon -t $1 $2
|
||||
+}
|
||||
+
|
||||
+restore_selinux_type()
|
||||
+{
|
||||
+ for type in "$@"; do
|
||||
+ find / -context "*${type}*" -exec restorecon -v {} \; &>/dev/null
|
||||
+ done
|
||||
+}
|
||||
+
|
||||
appraise_param=("ima_appraise=enforce" "ima_appraise_digest_list=digest-nometadata")
|
||||
measure_param=("ima_digest_list_pcr=11" "ima_template=ima-ng")
|
||||
+measure_type=ima_measure_bprm_t
|
||||
+appraise_type=ima_appraise_bprm_t
|
||||
+all_type=ima_all_bprm_t
|
||||
+restore_selinux_type $measure_type $appraise_type $all_type
|
||||
|
||||
if [[ ${#appraise_list[@]} -eq 0 && ${#measure_list[@]} -eq 0 ]]; then
|
||||
rm_kernel_param "${appraise_param[@]}"
|
||||
@@ -82,27 +113,6 @@ if [[ $needReboot == "true" ]]; then
|
||||
return 0
|
||||
fi
|
||||
|
||||
-
|
||||
-set_selinux_type()
|
||||
-{
|
||||
- module_name=$(echo "$1" | awk -F'_' '{print $1 "_" $2}')
|
||||
- semodule -l | grep $module_name > /dev/null
|
||||
- if [ $? -eq 1 ]; then
|
||||
- file=/tmp/${module_name}.cil
|
||||
- cat <<EOF > $file
|
||||
-(type $1)
|
||||
-(roletype object_r $1)
|
||||
-(typeattributeset file_type ($1))
|
||||
-(allow domain $1 (file (append execmod ioctl mounton relabelfrom swapon watch_reads audit_access execute link open relabelto unlink watch_sb create execute_no_trans lock quotaon rename watch watch_with_perm entrypoint getattr map read setattr watch_mount write)))
|
||||
-EOF
|
||||
-
|
||||
- semodule -i $file
|
||||
- echo "selinux type $1 has been successfully created"
|
||||
- rm $file
|
||||
- fi
|
||||
- chcon -t $1 $2
|
||||
-}
|
||||
-
|
||||
unique() {
|
||||
echo "$@" | tr ' ' '\n' | sort -u | tr '\n' ' '
|
||||
}
|
||||
@@ -124,9 +134,6 @@ if [[ ${#common_list[@]} -eq 0 && ${#appraise_list[@]} -eq 0 && ${#measure_list[
|
||||
echo "IMA is disabled!"
|
||||
return 0
|
||||
fi
|
||||
-measure_type=ima_measure_bprm_t
|
||||
-appraise_type=ima_appraise_bprm_t
|
||||
-all_type=ima_all_bprm_t
|
||||
|
||||
for measure_file in "${measure_list[@]}"; do
|
||||
set_selinux_type $measure_type $measure_file
|
||||
--
|
||||
2.33.0
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
Name: secpaver
|
||||
Summary: Security policy development tool
|
||||
Version: 1.0.2
|
||||
Release: 13
|
||||
Release: 14
|
||||
License: MulanPSL-2.0
|
||||
URL: https://gitee.com/openeuler/secpaver
|
||||
Source: https://gitee.com/openeuler/secpaver/repository/archive/%{name}-%{version}.tar.gz
|
||||
@ -16,6 +16,7 @@ Patch0003: support-clang-build.patch
|
||||
Patch0004: fix-go-build-ref-cldflags.patch
|
||||
Patch0005: remove-unused-socket.patch
|
||||
Patch0006: Add-example-of-how-to-import-digest-list-when-using-.patch
|
||||
Patch0007: restore-ima-selinux-type-when-perform-new-configurat.patch
|
||||
%ifarch riscv64 loongarch64
|
||||
Patch1000: 1000-fix-build-on-riscv64.patch
|
||||
%endif
|
||||
@ -59,6 +60,7 @@ unzip %{SOURCE2}
|
||||
%patch0004 -p1
|
||||
%patch0005 -p1
|
||||
%patch0006 -p1
|
||||
%patch0007 -p1
|
||||
%ifarch riscv64 loongarch64
|
||||
%patch1000 -p1
|
||||
%endif
|
||||
@ -117,7 +119,10 @@ make test
|
||||
%systemd_postun_with_restart pavd.service
|
||||
|
||||
%changelog
|
||||
* Thu Nov 28 2024 jinlun <xuce10@h-partners.com> - 1.0.2-13
|
||||
* Mon Dec 2 2024 xuce <xuce10@h-partners.com> - 1.0.2-14
|
||||
- restore ima selinux type when perform new configuration
|
||||
|
||||
* Thu Nov 28 2024 xuce <xuce10@h-partners.com> - 1.0.2-13
|
||||
- Add example of how to import digest list when using IMA appraise
|
||||
|
||||
* Mon Nov 25 2024 jinlun <jinlun@huawei.com> - 1.0.2-12
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user