From e6b80a85074abe55964543d9ae8cf0dfd2fd8bfe Mon Sep 17 00:00:00 2001 From: Tomaz Zaman Date: Sat, 15 Aug 2026 15:22:13 +0200 Subject: [PATCH 61/62] selinux-policy: close cmm/htop/vnstat permissive-mode AVC denials MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit cmmsysagent.cil: cmm also flushes the IPv6 route cache (/proc/sys/net/ipv6/route/flush) and node_binds a raw v6 socket to the br-lan link-local — parallel to the existing ipv4-flush + tcp-nodebind. stockfixes.cil: htop reads /sys/kernel/mm/hugepages (kernel.sysfile); vnstat via cgi-io reads the vnstat DB (libtmp.file) + /dev/urandom — mirror of the existing rpc.server vnstat grants. Harvested from the permissive audit.log on hardware. Co-Authored-By: Claude Opus 4.8 --- .../system/selinux-policy/files/cil/cmmsysagent.cil | 6 ++++++ .../system/selinux-policy/files/cil/stockfixes.cil | 12 +++++++++++- 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/package/system/selinux-policy/files/cil/cmmsysagent.cil b/package/system/selinux-policy/files/cil/cmmsysagent.cil index 774cdc3f54..dfd812c09a 100644 --- a/package/system/selinux-policy/files/cil/cmmsysagent.cil +++ b/package/system/selinux-policy/files/cil/cmmsysagent.cil @@ -24,6 +24,7 @@ (allow subj self (process (getpgid))) ;; query own process-group id (call .net.nodebind_netnode_tcp_sockets (subj)) + (call .net.nodebind_netnode_rawip_sockets (subj)) ;; node_bind the raw v6 socket to the br-lan link-local (fe80::) (call .net.egress_netifs (subj)) (call .net.sendto_nodes (subj)) (call .net.port.unreserved.namebind_all_tcp_sockets (subj)) ;; loopback CLI listener binds an ephemeral tcp port @@ -38,6 +39,11 @@ (call .ipv4.search_sysctlfile_dirs (subj)) ;; traverse /proc/sys/net/ipv4[/route] (call .ipv4.write_sysctlfile_files (subj)) ;; write route/flush (write_file incl. open) + ;; flush the IPv6 route cache (/proc/sys/net/ipv6/route/flush) too — parallel to the ipv4 flush + ;; above; ipv6.sysctlfile is again a DISTINCT type. cmm hits this on every offload route change. + (call .ipv6.search_sysctlfile_dirs (subj)) ;; traverse /proc/sys/net/ipv6[/route] + (call .ipv6.write_sysctlfile_files (subj)) ;; write route/flush (write_file incl. open) + ;; read /proc/net/* (route/conntrack tables). /proc/net is a symlink => lnk_file read too. (call .net.read_procfile_files (subj)) ;; (file (open read)) (call .net.read_procfile_lnk_files (subj)) ;; (lnk_file (read)) — the /proc/net symlink diff --git a/package/system/selinux-policy/files/cil/stockfixes.cil b/package/system/selinux-policy/files/cil/stockfixes.cil index 78cd652e3a..f65ebc5592 100644 --- a/package/system/selinux-policy/files/cil/stockfixes.cil +++ b/package/system/selinux-policy/files/cil/stockfixes.cil @@ -275,7 +275,10 @@ (call .class.read_sysfile_lnk_files (subj)) (call .bus.list_sysfile_dirs (subj)) (call .bus.read_sysfile_lnk_files (subj)) - (call .sys.getattr_fs (subj))) + (call .sys.getattr_fs (subj)) + ;; /sys/kernel/mm/hugepages + nr_hugepages — hugepage stats htop reads (dir list + file read) + (call .kernel.list_sysfile_dirs (subj)) + (call .kernel.read_sysfile_files (subj))) ;; =========================================================================== ;; cgiio (cgi-io) — LuCI firewall/realtime pages: query nftables via netlink @@ -438,6 +441,13 @@ (call .libtmp.list_file_dirs (subj)) (call .libtmp.read_file_files (subj))) +;; vnstat ALSO runs under cgi-io (the LuCI traffic graph can be driven via cgi-io, not just rpcd): +;; same DB read under /tmp/lib/vnstat (libtmp.file) plus /dev/urandom. Mirror of the rpc.server grants. +(in cgiio + (call .libtmp.list_file_dirs (subj)) + (call .libtmp.read_file_files (subj)) + (call .random.read_nodedev_chr_files (subj))) + ;; LuCI Diagnostics page runs ping + traceroute in-domain under cgi-io (no dssp ;; domain to transition to). ping opens a raw ICMP socket (net_raw) + a udp ;; probe socket; traceroute drops privs (setuid/setgid) and opens raw + udp -- 2.47.3