From 144d81eb199ef2a7d95959f41c91e27446913fda Mon Sep 17 00:00:00 2001 From: Tomaz Zaman Date: Tue, 18 Aug 2026 12:21:11 +0200 Subject: [PATCH 72/77] selinux-policy: fold in harvested permissive AVCs Permissive-mode denials harvested on production: - monoupdate: search a /root home-config dir to reach a dotfile. - stockfixes: early-boot hotplug getattr on /etc/board.json; uhttpd (www.server) SIGKILL of its confined LuCI CGI child on request timeout/disconnect; rpcd-spawned wget reading a generic /etc config via its confine transition. Co-Authored-By: Claude Opus 4.8 --- .../files/cil/monoupdatesysagent.cil | 5 ++++ .../selinux-policy/files/cil/stockfixes.cil | 24 +++++++++++++++++++ 2 files changed, 29 insertions(+) diff --git a/package/system/selinux-policy/files/cil/monoupdatesysagent.cil b/package/system/selinux-policy/files/cil/monoupdatesysagent.cil index 49db4e21c9..6f65993695 100644 --- a/package/system/selinux-policy/files/cil/monoupdatesysagent.cil +++ b/package/system/selinux-policy/files/cil/monoupdatesysagent.cil @@ -72,6 +72,11 @@ ;; (uci.subj) can manage it. monoupdate only READS it -> generic conf read (no private label). (call .conf.read_file_files (subj)) + ;; harvested on production (permissive): a subprocess (curl/usign/uci/shell) + ;; traverses a /root home-config dir to reach a dotfile — search only (dir + ;; traversal). Exact path not captured in the deduped harvest; low-risk grant. + (call .sys.home.conf.search_file_dirs (subj)) + (block conf ;; daemon-owned (NOT UCI): keep private so only mono_update_t reads them diff --git a/package/system/selinux-policy/files/cil/stockfixes.cil b/package/system/selinux-policy/files/cil/stockfixes.cil index c2b8392082..5e63a9cf34 100644 --- a/package/system/selinux-policy/files/cil/stockfixes.cil +++ b/package/system/selinux-policy/files/cil/stockfixes.cil @@ -91,6 +91,7 @@ (call .sys.modulerequest_system (subj)) ;; device-module autoload (call .conf.read_file_files (subj)) ;; generic /etc config reads (call .conf.list_file_dirs (subj)) ;; +read/open conf.file dirs (surfaced by openvpn-up hotplug) + (call .board.read_file_files (subj)) ;; getattr /etc/board.json — early-boot hotplug reads board identity (call .runtmp.manage_file_dirs (subj)) ;; manage generic /tmp/run (call .runtmp.manage_file_files (subj))) @@ -480,3 +481,26 @@ (in wpa.server (call .openssl.conftmp.search_file_dirs (subj)) (call .openssl.conftmp.read_file_files (subj))) + +;; =========================================================================== +;; www.server (uhttpd) — SIGKILL its LuCI CGI child on timeout/disconnect +;; =========================================================================== +;; Denial: process luci.subj { sigkill }. uhttpd spawns the LuCI CGI/RPC handler +;; as its own child, which runs confined as luci.subj (the cgiscript transition). +;; On a request timeout or client disconnect uhttpd SIGKILLs that child. Same +;; idiom netifd uses to reap ppp.server/wpa.server (..sigkill_subj_processes). + +(in www.server + (call .luci.sigkill_subj_processes (subj))) + +;; =========================================================================== +;; wget — read a generic /etc config (running confined via the rpcd transition) +;; =========================================================================== +;; Denial: file conf.file { read open }. When rpcd execs wget for LuCI status it +;; runs confined as wget.subj (rpc.server's .wget.subj_type_transition, above) and +;; opens+reads a generic /etc config (conf.file). `open` is present, so this is a +;; genuine open (not an inherited-fd leak like the wget dontaudit section above) — +;; grant the generic conf read, the same interface jshn/htop/hotplug already use. + +(in wget + (call .conf.read_file_files (subj))) -- 2.47.3