Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 433084 - selinux policy for rtorrent-0.8.9
Summary: selinux policy for rtorrent-0.8.9
Status: VERIFIED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: SELinux (show other bugs)
Hardware: All Linux
: Normal enhancement (vote)
Assignee: Sven Vermeulen (RETIRED)
URL:
Whiteboard: sec-policy r6
Keywords:
Depends on:
Blocks:
 
Reported: 2012-08-28 19:29 UTC by Vincent Brillault
Modified: 2012-12-13 10:15 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
Module main rules (rtorrent.te,3.42 KB, text/plain)
2012-08-28 19:29 UTC, Vincent Brillault
Details
Module interfaces (rtorrent.if,1.96 KB, text/plain)
2012-08-28 19:30 UTC, Vincent Brillault
Details
Module file context rules (rtorrent.fc,325 bytes, text/plain)
2012-08-28 19:30 UTC, Vincent Brillault
Details
Simple ebuild (contains elogs for setting correctly the port) (selinux-rtorrent-2.20120725-r4.ebuild,1.42 KB, text/plain)
2012-08-28 19:31 UTC, Vincent Brillault
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Vincent Brillault 2012-08-28 19:29:37 UTC
Created attachment 322466 [details]
Module main rules

I've built a SELinux module for running rtorrent in strict mode. Seems to work fine with current rtorrent stable version 0.8.9 running inside a screen and without xmlrpc (I have been using it for some months now).

I created a rtorrent_tcp_port_t but that could be replaced by rights to listen on any port for simplicity.
Comment 1 Vincent Brillault 2012-08-28 19:30:08 UTC
Created attachment 322468 [details]
Module interfaces
Comment 2 Vincent Brillault 2012-08-28 19:30:30 UTC
Created attachment 322470 [details]
Module file context rules
Comment 3 Vincent Brillault 2012-08-28 19:31:26 UTC
Created attachment 322472 [details]
Simple ebuild (contains elogs for setting correctly the port)
Comment 4 Sven Vermeulen (RETIRED) gentoo-dev 2012-09-29 16:32:07 UTC
I'm integrating it in our repository and will submit it upstream as well soon.

A few comments:

(0.) rtorrent_conf_t will most likely be named rtorrent_home_t.

Most HOME_DIR/* stuff is labeled with _home_t, whereas /etc/* stuff is _conf_t or _etc_t. As you defined it for a ~/.rtorrentrc item, I think rtorrent_home_t is more applicable.

(1.) I'm probably going to drop rtorrent_download_t in favor of xdg_downloads_home_t

We're working on an XDG-supporting policy, which includes the generic user directories for downloads, music, ... I'm not sure refpolicy (upstream) accepts this (they're more into having all user files to remain labeled user_home_t) but I'm definitely going further with this for Gentoo.

So I'm probably going to allow rtorrent_t to manage xdg_downloads_home_t content, unless you think it's better to have a separate type for this? In any case, users need to be able to relabel their content as such, so you'd need to allow relabel rights anyway.

(2.) Using rtorrent_port_t

I generally don't make any separation between the udp port and tcp port types. Otherwise this policy would be the first to do so.
Comment 5 Sven Vermeulen (RETIRED) gentoo-dev 2012-09-29 17:03:37 UTC
If you have hardened-dev overlay, you should be able to remove your local rtorrent policy from memory and use the live policy ebuild to test the policy out further.
Comment 6 Sven Vermeulen (RETIRED) gentoo-dev 2012-11-03 17:40:33 UTC
In hardened-dev, r6 release
Comment 7 Vincent Brillault 2012-11-15 16:57:14 UTC
Your policy looks great.
Some remarks:
 - After thinking about it, I'm not sure if the port name is apprioriate: it will probably collide with other BitTorrent clients, perhaps a more generic name
would be better
 - Are there some location marked 'xdg_downloads_home_t' by default ? Wouldn't using this type give right to rtorrent to manage things downloaded by other
programs ?
 - Would it be possible to add some warnings in the ebuild ? (Users need to define the tcp ports and to use xdg_downloads_home_t directories)

I'm currently using your policy (with a single change: I don't use xdg_downloads_home_t as I don't understand its consequences) without problems so far :)
Comment 8 Sven Vermeulen (RETIRED) gentoo-dev 2012-11-16 14:18:02 UTC
Is the port generic for bittorrent?

Also, on the xdg_downloads_home_t, you're correct (but on the other hand, using general user_home_t has even more consequences on this). We could look at supporting specific download types, but I don't think that would be very much manageable...
Comment 9 Sven Vermeulen (RETIRED) gentoo-dev 2012-11-18 15:29:01 UTC
In main tree, ~arch'ed
Comment 10 Sven Vermeulen (RETIRED) gentoo-dev 2012-12-13 10:15:32 UTC
r8 is now stable