Create new RPM for loading iptables rules at system start

iptables rules can be used by security network control with
internet and internal/appdebugging priviledges.

Mapping internet GID privilege with this set of iptables rules
can be much simpler alternative to nether, which also supports multiuser
but doesn't support runtime policy change for running apps.

Change-Id: I033b36c64fc14de5a275db00aab5825dad61341d

diff --git a/packaging/security-manager-ip6tables.rules b/packaging/security-manager-ip6tables.rules
new file mode 100644 (file)
index 0000000..4d98982
--- /dev/null
+++ b/packaging/security-manager-ip6tables.rules
@@ -0,0 +1,45 @@
+#
+#  Copyright (c) 2019 Samsung Electronics Co., Ltd All Rights Reserved
+#
+#  Contact: Lukasz Pawelczyk (l.pawelczyk@samsung.com)
+#
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License
+#
+
+*mangle
+:PREROUTING ACCEPT
+:INPUT ACCEPT
+:FORWARD ACCEPT
+:OUTPUT ACCEPT
+:POSTROUTING ACCEPT
+:CHECK-LOCALHOST -
+-A INPUT ! -i lo -j SECMARK --selctx System
+-A OUTPUT -o lo -j CHECK-LOCALHOST
+-A OUTPUT -p igmp -j ACCEPT
+-A CHECK-LOCALHOST -p udp -m udp --dport 53 -j RETURN
+-A CHECK-LOCALHOST -p tcp -m tcp --dport 53 -j RETURN
+-A CHECK-LOCALHOST -j ACCEPT
+COMMIT
+*filter
+:INPUT ACCEPT
+:FORWARD ACCEPT
+:OUTPUT ACCEPT
+:REJECT-LOG -
+-A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+-A OUTPUT -m owner --uid-owner 0-5000 -j ACCEPT
+-A OUTPUT -m owner --gid-owner priv_internet --suppl-groups -j ACCEPT
+-A OUTPUT -j REJECT-LOG
+-A REJECT-LOG -m limit --limit 1/min -j AUDIT --type reject
+-A REJECT-LOG -j REJECT --reject-with icmp6-adm-prohibited
+-A REJECT-LOG -j RETURN
+COMMIT

diff --git a/packaging/security-manager-iptables-load.service b/packaging/security-manager-iptables-load.service
new file mode 100644 (file)
index 0000000..7115a8e
--- /dev/null
+++ b/packaging/security-manager-iptables-load.service
@@ -0,0 +1,13 @@
+[Unit]
+Description=Load default Tizen iptables firewall rules
+# sounds reasonable to have firewall up before any of the services go up
+Before=network-pre.target
+Wants=network-pre.target
+
+[Service]
+Type=oneshot
+ExecStart=/sbin/iptables-restore -w -- /etc/security-manager-iptables.rules
+ExecStart=/sbin/ip6tables-restore -w -- /etc/security-manager-ip6tables.rules
+
+[Install]
+WantedBy=basic.target

diff --git a/packaging/security-manager-iptables.rules b/packaging/security-manager-iptables.rules
new file mode 100644 (file)
index 0000000..f8874bb
--- /dev/null
+++ b/packaging/security-manager-iptables.rules
@@ -0,0 +1,49 @@
+#
+#  Copyright (c) 2019 Samsung Electronics Co., Ltd All Rights Reserved
+#
+#  Contact: Lukasz Pawelczyk (l.pawelczyk@samsung.com)
+#
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License
+#
+
+*mangle
+:PREROUTING ACCEPT
+:INPUT ACCEPT
+:FORWARD ACCEPT
+:OUTPUT ACCEPT
+:POSTROUTING ACCEPT
+:CHECK-LOCALHOST -
+-A INPUT ! -i lo -j SECMARK --selctx System
+-A OUTPUT -o lo -j CHECK-LOCALHOST
+-A OUTPUT -p igmp -j ACCEPT
+-A CHECK-LOCALHOST -p udp -m udp --dport 53 -j RETURN
+-A CHECK-LOCALHOST -p tcp -m tcp --dport 53 -j RETURN
+-A CHECK-LOCALHOST -j ACCEPT
+COMMIT
+*filter
+:INPUT ACCEPT
+:FORWARD ACCEPT
+:OUTPUT ACCEPT
+:REJECT-LOG -
+-A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+-A OUTPUT -m owner --uid-owner 0-5000 -j ACCEPT
+-A OUTPUT -m owner --gid-owner priv_internet --suppl-groups -j ACCEPT
+-A OUTPUT -d 10.0.2.2/32 -m owner --gid-owner priv_appdebugging --suppl-groups -j ACCEPT
+-A OUTPUT -d 10.0.2.15/32 -m owner --gid-owner priv_appdebugging --suppl-groups -j ACCEPT
+-A OUTPUT -d 192.168.129.1/32 -m owner --gid-owner priv_appdebugging --suppl-groups -j ACCEPT
+-A OUTPUT -d 192.168.129.3/32 -m owner --gid-owner priv_appdebugging --suppl-groups -j ACCEPT
+-A OUTPUT -j REJECT-LOG
+-A REJECT-LOG -m limit --limit 1/min -j AUDIT --type reject
+-A REJECT-LOG -j REJECT --reject-with icmp-net-prohibited
+-A REJECT-LOG -j RETURN
+COMMIT

diff --git a/packaging/security-manager.spec b/packaging/security-manager.spec
index 0d50227c30105ad5cc722ba14df10e20fab1c979..17380e14d6f0558574bb02a089533cbbefc9b8a9 100644 (file)
--- a/packaging/security-manager.spec
+++ b/packaging/security-manager.spec
@@ -12,6 +12,9 @@ Source4:    libnss-security-manager.manifest
 Source5:    security-manager-tests.manifest
 Source6:    security-manager-policy.manifest
 Source7:    security-license-manager.manifest
+Source8:    security-manager-iptables-load.service
+Source9:    security-manager-iptables.rules
+Source10:   security-manager-ip6tables.rules
 Requires:   security-manager-policy
 Requires:   security-license-manager
 Requires:   libnss-security-manager
@@ -82,6 +85,15 @@ Requires(post): tizen-platform-config-tools
 %description policy
 Set of security rules that constitute security policy in the system
 
+%package policy-iptables
+Summary:    Security manager iptables policy
+Group:      Security/Access Control
+Requires:   security-manager = %{version}-%{release}
+Requires:   iptables
+
+%description policy-iptables
+Set of iptables rules governing the internet related priviledges
+
 %package -n security-manager-tests
 Summary:    Security manager unit test binaries
 Group:      Security/Development
@@ -155,6 +167,11 @@ cp -a test/data/.security-manager-test-rules*.{db,txt} %{buildroot}/%{db_test_di
 
 cp -a %{SOURCE1} %{SOURCE2} %{SOURCE3} %{SOURCE4} %{SOURCE5} %{SOURCE6} %{SOURCE7} %{buildroot}%{_datadir}/
 
+install -m 644 %{SOURCE8} %{buildroot}%{_unitdir}/security-manager-iptables.service
+install -m 600 %{SOURCE9} %{buildroot}%{_sysconfdir}/security-manager-iptables.rules
+install -m 600 %{SOURCE10} %{buildroot}%{_sysconfdir}/security-manager-ip6tables.rules
+ln -sf ../security-manager-iptables.service %{buildroot}%{_unitdir}/basic.target.wants/
+
 %clean
 rm -rf %{buildroot}
 
@@ -305,6 +322,12 @@ chsmack -a System %{db_test_dir}/.security-manager-test-rules*.txt
 %attr(755,root,root) %{_bindir}/security-manager-policy-reload
 %attr(755,root,root) %{_sysconfdir}/opt/upgrade/241.security-manager.policy-update.sh
 
+%files -n security-manager-policy-iptables
+%{_unitdir}/security-manager-iptables.service
+%{_unitdir}/basic.target.wants/security-manager-iptables.service
+%attr(600, root, root) %{_sysconfdir}/security-manager-iptables.rules
+%attr(600, root, root) %{_sysconfdir}/security-manager-ip6tables.rules
+
 %files -n security-manager-tests
 %manifest %{_datadir}/security-manager-tests.manifest
 %attr(755,root,root) %{_bindir}/security-manager-unit-tests