132 lines
5.2 KiB
Plaintext
132 lines
5.2 KiB
Plaintext
|
|
||
|
|
# macro for chroot environments
|
||
|
|
# Author Russell Coker
|
||
|
|
|
||
|
|
# chroot(initial_domain, basename, role, tty_device_type)
|
||
|
|
define(`chroot', `
|
||
|
|
|
||
|
|
ifelse(`$1', `initrc', `
|
||
|
|
define(`chroot_role', `system_r')
|
||
|
|
define(`chroot_tty_device', `{ console_device_t admin_tty_type }')
|
||
|
|
define(`chroot_mount_domain', `mount_t')
|
||
|
|
define(`chroot_fd_use', `{ privfd init_t }')
|
||
|
|
', `
|
||
|
|
define(`chroot_role', `$1_r')
|
||
|
|
define(`chroot_tty_device', `{ $1_devpts_t $1_tty_device_t }')
|
||
|
|
define(`chroot_fd_use', `privfd')
|
||
|
|
|
||
|
|
# allow mounting /proc and /dev
|
||
|
|
ifdef(`$1_mount_def', `', `
|
||
|
|
mount_domain($1, $1_mount)
|
||
|
|
role chroot_role types $1_mount_t;
|
||
|
|
')
|
||
|
|
define(`chroot_mount_domain', `$1_mount_t')
|
||
|
|
ifdef(`ssh.te', `
|
||
|
|
can_tcp_connect($1_ssh_t, $2_t)
|
||
|
|
')dnl end ssh
|
||
|
|
')dnl end ifelse initrc
|
||
|
|
|
||
|
|
# types for read-only and read-write files in the chroot
|
||
|
|
type $2_ro_t, file_type, sysadmfile, home_type, user_home_type;
|
||
|
|
type $2_rw_t, file_type, sysadmfile, home_type, user_home_type;
|
||
|
|
# type like $2_ro_t but that triggers a transition from $2_super_t to $2_t
|
||
|
|
# when you execute it
|
||
|
|
type $2_dropdown_t, file_type, sysadmfile, home_type, user_home_type;
|
||
|
|
|
||
|
|
allow chroot_mount_domain { $2_rw_t $2_ro_t }:dir { getattr search mounton };
|
||
|
|
allow chroot_mount_domain { $2_rw_t $2_ro_t }:file { getattr mounton };
|
||
|
|
|
||
|
|
# entry point for $2_super_t
|
||
|
|
type $2_super_entry_t, file_type, sysadmfile, home_type, user_home_type;
|
||
|
|
# $2_t is the base domain, has full access to $2_rw_t files
|
||
|
|
type $2_t, domain;
|
||
|
|
# $2_super_t is the super-chroot domain, can also write to $2_ro_t
|
||
|
|
# but still can not access outside the chroot
|
||
|
|
type $2_super_t, domain;
|
||
|
|
allow $2_super_t chroot_tty_device:chr_file rw_file_perms;
|
||
|
|
|
||
|
|
ifdef(`$1_chroot_def', `', `
|
||
|
|
dnl can not have this defined twice
|
||
|
|
define(`$1_chroot_def')
|
||
|
|
|
||
|
|
allow chroot_mount_domain { proc_t device_t fs_t }:filesystem { mount unmount };
|
||
|
|
|
||
|
|
# $1_chroot_t is the domain for /usr/sbin/chroot
|
||
|
|
type $1_chroot_t, domain;
|
||
|
|
|
||
|
|
# allow $1_chroot_t to write to the tty device
|
||
|
|
allow $1_chroot_t chroot_tty_device:chr_file rw_file_perms;
|
||
|
|
allow $1_chroot_t chroot_fd_use:fd use;
|
||
|
|
allow { $1_chroot_t $2_t $2_super_t } $1_t:fd use;
|
||
|
|
|
||
|
|
role chroot_role types $1_chroot_t;
|
||
|
|
uses_shlib($1_chroot_t)
|
||
|
|
allow $1_chroot_t self:capability sys_chroot;
|
||
|
|
allow $1_t $1_chroot_t:dir { search getattr read };
|
||
|
|
allow $1_t $1_chroot_t:{ file lnk_file } { read getattr };
|
||
|
|
domain_auto_trans($1_t, chroot_exec_t, $1_chroot_t)
|
||
|
|
allow $1_chroot_t fs_t:filesystem getattr;
|
||
|
|
')dnl End conditional
|
||
|
|
|
||
|
|
role chroot_role types { $2_t $2_super_t };
|
||
|
|
|
||
|
|
# allow ps to show processes and allow killing them
|
||
|
|
allow $1_t { $2_super_t $2_t }:dir { search getattr read };
|
||
|
|
allow $1_t { $2_super_t $2_t }:{ file lnk_file } { read getattr };
|
||
|
|
allow $1_t { $2_super_t $2_t }:process signal_perms;
|
||
|
|
allow $2_super_t $2_t:dir { search getattr read };
|
||
|
|
allow $2_super_t $2_t:{ file lnk_file } { read getattr };
|
||
|
|
allow { $1_t $2_super_t } $2_t:process { signal_perms ptrace };
|
||
|
|
allow $1_t $2_super_t:process { signal_perms ptrace };
|
||
|
|
allow sysadm_t { $2_super_t $2_t }:process { signal_perms ptrace };
|
||
|
|
|
||
|
|
allow { $2_super_t $2_t } { fs_t device_t }:filesystem getattr;
|
||
|
|
allow { $2_super_t $2_t } device_t:dir { search getattr };
|
||
|
|
allow { $2_super_t $2_t } devtty_t:chr_file rw_file_perms;
|
||
|
|
allow { $2_super_t $2_t } random_device_t:chr_file r_file_perms;
|
||
|
|
allow { $2_super_t $2_t } self:capability { fowner chown fsetid setgid setuid net_bind_service sys_tty_config };
|
||
|
|
allow $2_super_t self:capability sys_ptrace;
|
||
|
|
|
||
|
|
can_tcp_connect($2_super_t, $2_t)
|
||
|
|
allow { $2_super_t $2_t } $2_rw_t:sock_file create_file_perms;
|
||
|
|
|
||
|
|
# quiet ps and killall
|
||
|
|
dontaudit { $2_super_t $2_t } domain:dir { search getattr };
|
||
|
|
|
||
|
|
# allow $2_t to write to the owner tty device (should remove this)
|
||
|
|
allow $2_t chroot_tty_device:chr_file { read write };
|
||
|
|
|
||
|
|
r_dir_file($1_chroot_t, { $2_ro_t $2_rw_t $2_super_entry_t $2_dropdown_t })
|
||
|
|
can_exec($2_t, { $2_ro_t $2_rw_t $2_super_entry_t $2_dropdown_t })
|
||
|
|
can_exec($2_super_t, { $2_ro_t $2_super_entry_t })
|
||
|
|
create_dir_notdevfile($2_super_t, { $2_ro_t $2_rw_t $2_super_entry_t $2_dropdown_t })
|
||
|
|
# $2_super_t transitions to $2_t when it executes
|
||
|
|
# any file that $2_t can write
|
||
|
|
domain_auto_trans($2_super_t, { $2_rw_t $2_dropdown_t }, $2_t)
|
||
|
|
allow $1_chroot_t { $2_ro_t $2_rw_t }:lnk_file read;
|
||
|
|
r_dir_file($2_t, { $2_ro_t $2_super_entry_t $2_dropdown_t })
|
||
|
|
create_dir_notdevfile($2_t, $2_rw_t)
|
||
|
|
allow $2_t $2_rw_t:fifo_file create_file_perms;
|
||
|
|
allow $2_t $2_ro_t:fifo_file rw_file_perms;
|
||
|
|
allow { $1_t $2_super_t } { $2_rw_t $2_ro_t }:fifo_file create_file_perms;
|
||
|
|
create_dir_notdevfile($1_t, { $2_ro_t $2_rw_t $2_super_entry_t $2_dropdown_t })
|
||
|
|
can_exec($1_t, { $2_ro_t $2_dropdown_t })
|
||
|
|
domain_auto_trans($1_chroot_t, { $2_ro_t $2_rw_t $2_dropdown_t }, $2_t)
|
||
|
|
domain_auto_trans($1_chroot_t, $2_super_entry_t, $2_super_t)
|
||
|
|
allow { $1_t $2_super_t } { $2_ro_t $2_rw_t $2_super_entry_t $2_dropdown_t }:{ dir notdevfile_class_set } { relabelfrom relabelto };
|
||
|
|
general_proc_read_access({ $2_t $2_super_t })
|
||
|
|
general_domain_access({ $2_t $2_super_t })
|
||
|
|
can_create_pty($2)
|
||
|
|
can_create_pty($2_super)
|
||
|
|
can_network({ $2_t $2_super_t })
|
||
|
|
allow { $2_t $2_super_t } port_type:tcp_socket name_connect;
|
||
|
|
allow { $2_t $2_super_t } null_device_t:chr_file rw_file_perms;
|
||
|
|
allow $2_super_t { $2_rw_t $2_ro_t }:{ dir file } mounton;
|
||
|
|
allow { $2_t $2_super_t } self:capability { dac_override kill };
|
||
|
|
|
||
|
|
undefine(`chroot_role')
|
||
|
|
undefine(`chroot_tty_device')
|
||
|
|
undefine(`chroot_mount_domain')
|
||
|
|
undefine(`chroot_fd_use')
|
||
|
|
')
|