gradm error checking - "/dev h" vs "/dev/* h"

[Grach]

Some applications aren't happy when listing of /dev is forbidden, even if the files they need inside /dev are allowed to be accessed. For now gradm does policy checks that prevents allowing safe listing of /dev in the following way within default subject boundaries:

Code: Select all

subject /
    .....
    /dev r
    /dev/null rw
    /dev/* h
    .....

... while it seems pretty safe and correct to me. Is it? I've come up with the following cute little patch for gradm in my local overlay:

Code: Select all

--- gradm2/gradm_analyze.c   2009-04-11 08:27:16.000000000 +0800
+++ gradm2.new/gradm_analyze.c   2009-07-28 10:18:37.000000000 +0800
@@ -513,7 +513,8 @@
          errs_found++;
       }
 
-      if (!check_permission(role, def_acl, "/dev", &chk)) {
+      if (!check_permission(role, def_acl, "/dev", &chk) &&
+          !check_permission(role, def_acl, "/dev/*", &chk)) {
          fprintf(stderr,
             "Writing access is allowed by role %s to /dev, the directory which "
             "holds system devices.\n\n", role->rolename);
@@ -601,7 +602,8 @@
 
       chk.u_modes = GR_READ;
 
-      if (!check_permission(role, def_acl, "/dev", &chk)) {
+      if (!check_permission(role, def_acl, "/dev", &chk) &&
+          !check_permission(role, def_acl, "/dev/*", &chk)) {
          fprintf(stderr,
             "Reading access is allowed by role %s to /dev, the directory which "
             "holds system devices.\n\n", role->rolename);


It's not a feature request, I post it just for the case if anyone interested in less painful policy creation for desktop environments as I am. Would be great if the official gradm will suggest something similar though.

[spender]

To list /dev, only "/dev" is needed as an object. You don't need to add "r" to list the directory, as that gives read access to all files within that directory.

Also, I don't believe the check_permission function will handle your globbed check. We don't actually enforce that /dev be hidden, only that it not be readable/writable in general. So replacing "/dev h" with just "/dev" should resolve all your issues.

-Brad

[Grach]

To list /dev, only "/dev" is needed as an object. You don't need to add "r" to list the directory, as that gives read access to all files within that directory.

Oh, I see... I totally misunderstood that "/object r vs /object <nothing>" thing. Thank you!

Also, I don't believe the check_permission function will handle your globbed check.

Somehow it works, I double-checked.