157 lines
4.5 KiB
Plaintext
157 lines
4.5 KiB
Plaintext
|
#DESC Passwd - Password utilities
|
||
|
|
#
|
||
|
|
# Authors: Stephen Smalley <sds@epoch.ncsc.mil> and Timothy Fraser
|
||
|
|
# X-Debian-Packages: passwd
|
||
|
|
#
|
||
|
|
|
||
|
|
#################################
|
||
|
|
#
|
||
|
|
# Rules for the passwd_t domain.
|
||
|
|
#
|
||
|
|
define(`base_passwd_domain', `
|
||
|
|
type $1_t, domain, privlog, $2;
|
||
|
|
|
||
|
|
# for SSP
|
||
|
|
allow $1_t urandom_device_t:chr_file read;
|
||
|
|
|
||
|
|
allow $1_t self:process setrlimit;
|
||
|
|
|
||
|
|
general_domain_access($1_t);
|
||
|
|
uses_shlib($1_t);
|
||
|
|
|
||
|
|
# Inherit and use descriptors from login.
|
||
|
|
allow $1_t privfd:fd use;
|
||
|
|
ifdef(`gnome-pty-helper.te', `allow $1_t gphdomain:fd use;')
|
||
|
|
|
||
|
|
read_locale($1_t)
|
||
|
|
|
||
|
|
allow $1_t fs_t:filesystem getattr;
|
||
|
|
|
||
|
|
# allow checking if a shell is executable
|
||
|
|
allow $1_t shell_exec_t:file execute;
|
||
|
|
|
||
|
|
# Obtain contexts
|
||
|
|
can_getsecurity($1_t)
|
||
|
|
|
||
|
|
allow $1_t etc_t:file create_file_perms;
|
||
|
|
|
||
|
|
# read /etc/mtab
|
||
|
|
allow $1_t etc_runtime_t:file { getattr read };
|
||
|
|
|
||
|
|
# Allow etc_t symlinks for /etc/alternatives on Debian.
|
||
|
|
allow $1_t etc_t:lnk_file read;
|
||
|
|
|
||
|
|
# Use capabilities.
|
||
|
|
allow $1_t self:capability { chown dac_override fsetid setuid setgid sys_resource };
|
||
|
|
|
||
|
|
# Access terminals.
|
||
|
|
allow $1_t { ttyfile ptyfile }:chr_file rw_file_perms;
|
||
|
|
allow $1_t devtty_t:chr_file rw_file_perms;
|
||
|
|
|
||
|
|
dontaudit $1_t devpts_t:dir getattr;
|
||
|
|
|
||
|
|
# /usr/bin/passwd asks for w access to utmp, but it will operate
|
||
|
|
# correctly without it. Do not audit write denials to utmp.
|
||
|
|
dontaudit $1_t initrc_var_run_t:file { read write };
|
||
|
|
|
||
|
|
# user generally runs this from their home directory, so do not audit a search
|
||
|
|
# on user home dir
|
||
|
|
dontaudit $1_t { user_home_dir_type user_home_type }:dir search;
|
||
|
|
|
||
|
|
# When the wrong current passwd is entered, passwd, for some reason,
|
||
|
|
# attempts to access /proc and /dev, but handles failure appropriately. So
|
||
|
|
# do not audit those denials.
|
||
|
|
dontaudit $1_t { proc_t device_t }:dir { search read };
|
||
|
|
|
||
|
|
allow $1_t device_t:dir getattr;
|
||
|
|
read_sysctl($1_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
#################################
|
||
|
|
#
|
||
|
|
# Rules for the passwd_t domain.
|
||
|
|
#
|
||
|
|
define(`passwd_domain', `
|
||
|
|
base_passwd_domain($1, `auth_write, privowner')
|
||
|
|
# Update /etc/shadow and /etc/passwd
|
||
|
|
file_type_auto_trans($1_t, etc_t, shadow_t, file)
|
||
|
|
allow $1_t { etc_t shadow_t }:file { relabelfrom relabelto };
|
||
|
|
can_setfscreate($1_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
passwd_domain(passwd)
|
||
|
|
passwd_domain(sysadm_passwd)
|
||
|
|
base_passwd_domain(chfn, `auth_chkpwd, etc_writer, privowner')
|
||
|
|
can_setfscreate(chfn_t)
|
||
|
|
|
||
|
|
# can exec /sbin/unix_chkpwd
|
||
|
|
allow chfn_t { bin_t sbin_t }:dir search;
|
||
|
|
|
||
|
|
# uses unix_chkpwd for checking passwords
|
||
|
|
dontaudit chfn_t shadow_t:file read;
|
||
|
|
allow chfn_t etc_t:dir rw_dir_perms;
|
||
|
|
allow chfn_t etc_t:file create_file_perms;
|
||
|
|
allow chfn_t proc_t:file { getattr read };
|
||
|
|
allow chfn_t self:file write;
|
||
|
|
|
||
|
|
in_user_role(passwd_t)
|
||
|
|
in_user_role(chfn_t)
|
||
|
|
role sysadm_r types passwd_t;
|
||
|
|
role sysadm_r types sysadm_passwd_t;
|
||
|
|
role sysadm_r types chfn_t;
|
||
|
|
role system_r types passwd_t;
|
||
|
|
role system_r types chfn_t;
|
||
|
|
|
||
|
|
type admin_passwd_exec_t, file_type, sysadmfile;
|
||
|
|
type passwd_exec_t, file_type, sysadmfile, exec_type;
|
||
|
|
type chfn_exec_t, file_type, sysadmfile, exec_type;
|
||
|
|
|
||
|
|
domain_auto_trans({ userdomain ifdef(`firstboot.te', `firstboot_t') }, passwd_exec_t, passwd_t)
|
||
|
|
domain_auto_trans({ userdomain ifdef(`firstboot.te', `firstboot_t') }, chfn_exec_t, chfn_t)
|
||
|
|
domain_auto_trans(sysadm_t, admin_passwd_exec_t, sysadm_passwd_t)
|
||
|
|
|
||
|
|
dontaudit chfn_t var_t:dir search;
|
||
|
|
|
||
|
|
ifdef(`crack.te', `
|
||
|
|
allow passwd_t var_t:dir search;
|
||
|
|
dontaudit passwd_t var_run_t:dir search;
|
||
|
|
allow passwd_t crack_db_t:dir r_dir_perms;
|
||
|
|
allow passwd_t crack_db_t:file r_file_perms;
|
||
|
|
', `
|
||
|
|
dontaudit passwd_t var_t:dir search;
|
||
|
|
')
|
||
|
|
|
||
|
|
# allow vipw to exec the editor
|
||
|
|
allow sysadm_passwd_t { root_t bin_t sbin_t }:dir search;
|
||
|
|
allow sysadm_passwd_t bin_t:lnk_file read;
|
||
|
|
can_exec(sysadm_passwd_t, { shell_exec_t bin_t })
|
||
|
|
r_dir_file(sysadm_passwd_t, usr_t)
|
||
|
|
|
||
|
|
# allow vipw to create temporary files under /var/tmp/vi.recover
|
||
|
|
allow sysadm_passwd_t var_t:dir search;
|
||
|
|
tmp_domain(sysadm_passwd)
|
||
|
|
# for vipw - vi looks in the root home directory for config
|
||
|
|
dontaudit sysadm_passwd_t sysadm_home_dir_t:dir { getattr search };
|
||
|
|
# for /etc/alternatives/vi
|
||
|
|
allow sysadm_passwd_t etc_t:lnk_file read;
|
||
|
|
|
||
|
|
# for nscd lookups
|
||
|
|
dontaudit sysadm_passwd_t var_run_t:dir search;
|
||
|
|
|
||
|
|
# for /proc/meminfo
|
||
|
|
allow sysadm_passwd_t proc_t:file { getattr read };
|
||
|
|
|
||
|
|
dontaudit { chfn_t passwd_t sysadm_passwd_t } selinux_config_t:dir search;
|
||
|
|
dontaudit sysadm_passwd_t devpts_t:dir search;
|
||
|
|
|
||
|
|
# make sure that getcon succeeds
|
||
|
|
allow passwd_t userdomain:dir search;
|
||
|
|
allow passwd_t userdomain:file { getattr read };
|
||
|
|
allow passwd_t userdomain:process getattr;
|
||
|
|
|
||
|
|
allow passwd_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay };
|
||
|
|
|
||
|
|
ifdef(`targeted_policy', `
|
||
|
|
role system_r types sysadm_passwd_t;
|
||
|
|
')
|