selinux-policy/policy/modules/kernel/domain.te

271 lines
6.7 KiB
Plaintext
Raw Normal View History

policy_module(domain, 1.8.1)
2005-06-30 18:54:08 +00:00
########################################
#
# Declarations
#
2010-08-26 13:41:21 +00:00
## <desc>
## <p>
## Allow all domains to use other domains file descriptors
## </p>
## </desc>
#
gen_tunable(allow_domain_fd_use, true)
## <desc>
## <p>
## Allow all domains to have the kernel load modules
## </p>
## </desc>
#
gen_tunable(domain_kernel_load_modules, false)
2005-06-30 18:54:08 +00:00
## <desc>
## <p>
## Control the ability to mmap a low area of the address space,
## as configured by /proc/sys/kernel/mmap_min_addr.
## </p>
## </desc>
gen_tunable(mmap_low_allowed, false)
2005-04-14 20:18:17 +00:00
# Mark process types as domains
attribute domain;
# Transitions only allowed from domains to other domains
neverallow domain ~domain:process { transition dyntransition };
2005-09-15 15:34:31 +00:00
# Domains that are unconfined
attribute unconfined_domain_type;
2005-09-15 15:34:31 +00:00
# Domains that can mmap low memory.
attribute mmap_low_domain_type;
neverallow { domain -mmap_low_domain_type } self:memprotect mmap_zero;
# Domains that can set their current context
# (perform dynamic transitions)
attribute set_curr_context;
# enabling setcurrent breaks process tranquility. If you do not
# know what this means or do not understand the implications of a
# dynamic transition, you should not be using it!!!
neverallow { domain -set_curr_context } self:process setcurrent;
# entrypoint executables
attribute entry_type;
# widely-inheritable file descriptors
attribute privfd;
#
# constraint related attributes
#
# [1] types that can change SELinux identity on transition
attribute can_change_process_identity;
# [2] types that can change SELinux role on transition
attribute can_change_process_role;
# [3] types that can change the SELinux identity on a filesystem
# object or a socket object on a create or relabel
attribute can_change_object_identity;
# [3] types that can change to system_u:system_r
attribute can_system_change;
2005-06-09 21:07:58 +00:00
# [4] types that have attribute 1 can change the SELinux
# identity only if the target domain has this attribute.
# Types that have attribute 2 can change the SELinux role
# only if the target domain has this attribute.
attribute process_user_target;
# For cron jobs
# [5] types used for cron daemons
attribute cron_source_domain;
# [6] types used for cron jobs
attribute cron_job_domain;
# [7] types that are unconditionally exempt from
# SELinux identity and role change constraints
attribute process_uncond_exempt; # add userhelperdomain to this one
neverallow { domain unlabeled_t } ~{ domain unlabeled_t }:process *;
neverallow ~{ domain unlabeled_t } *:process *;
########################################
#
# Rules applied to all domains
#
2006-07-06 17:00:29 +00:00
# read /proc/(pid|self) entries
allow domain self:dir list_dir_perms;
allow domain self:lnk_file { read_lnk_file_perms lock ioctl };
allow domain self:file rw_file_perms;
2006-07-06 17:00:29 +00:00
kernel_read_proc_symlinks(domain)
2010-08-26 13:41:21 +00:00
kernel_read_crypto_sysctls(domain)
2007-10-29 18:35:32 +00:00
# Every domain gets the key ring, so we should default
# to no one allowed to look at it; afs kernel support creates
# a keyring
kernel_dontaudit_search_key(domain)
kernel_dontaudit_link_key(domain)
2010-08-26 13:41:21 +00:00
kernel_dontaudit_search_debugfs(domain)
# create child processes in the domain
2010-08-26 13:41:21 +00:00
allow domain self:process { fork getsched sigchld };
# Use trusted objects in /dev
dev_rw_null(domain)
dev_rw_zero(domain)
term_use_controlling_term(domain)
# list the root directory
files_list_root(domain)
2010-08-26 13:41:21 +00:00
# All executables should be able to search the directory they are in
corecmd_search_bin(domain)
tunable_policy(`domain_kernel_load_modules',`
kernel_request_load_module(domain)
')
tunable_policy(`global_ssp',`
# enable reading of urandom for all domains:
# this should be enabled when all programs
# are compiled with ProPolice/SSP
# stack smashing protection.
dev_read_urand(domain)
')
2010-08-26 13:41:21 +00:00
optional_policy(`
afs_rw_cache(domain)
')
optional_policy(`
libs_use_ld_so(domain)
libs_use_shared_libs(domain)
2010-08-26 13:41:21 +00:00
libs_read_lib_files(domain)
')
optional_policy(`
setrans_translate_context(domain)
')
2007-10-29 18:35:32 +00:00
# xdm passes an open file descriptor to xsession-errors.log which is then audited by all confined domains.
optional_policy(`
xserver_dontaudit_use_xdm_fds(domain)
xserver_dontaudit_rw_xdm_pipes(domain)
2010-08-26 13:41:21 +00:00
xserver_dontaudit_append_xdm_home_files(domain)
xserver_dontaudit_write_log(domain)
2007-10-29 18:35:32 +00:00
')
########################################
#
# Unconfined access to this module
#
# unconfined access also allows constraints, but this
# is handled in the interface as typeattribute cannot
# be used on an attribute.
# Use/sendto/connectto sockets created by any domain.
allow unconfined_domain_type domain:{ socket_class_set socket key_socket } *;
# Use descriptors and pipes created by any domain.
allow unconfined_domain_type domain:fd use;
allow unconfined_domain_type domain:fifo_file rw_file_perms;
2010-08-26 13:41:21 +00:00
allow unconfined_domain_type unconfined_domain_type:dbus send_msg;
# Act upon any other process.
allow unconfined_domain_type domain:process ~{ transition dyntransition execmem execstack execheap };
# Create/access any System V IPC objects.
allow unconfined_domain_type domain:{ sem msgq shm } *;
allow unconfined_domain_type domain:msg { send receive };
# For /proc/pid
allow unconfined_domain_type domain:dir list_dir_perms;
2009-06-11 15:00:48 +00:00
allow unconfined_domain_type domain:file rw_file_perms;
allow unconfined_domain_type domain:lnk_file { read_lnk_file_perms ioctl lock };
2006-07-14 13:11:42 +00:00
# act on all domains keys
allow unconfined_domain_type domain:key *;
# receive from all domains over labeled networking
domain_all_recvfrom_all_domains(unconfined_domain_type)
2010-08-26 13:41:21 +00:00
selinux_getattr_fs(domain)
selinux_search_fs(domain)
selinux_dontaudit_read_fs(domain)
seutil_dontaudit_read_config(domain)
init_sigchld(domain)
init_signull(domain)
ifdef(`distro_redhat',`
files_search_mnt(domain)
optional_policy(`
unconfined_use_fds(domain)
')
')
# these seem questionable:
optional_policy(`
abrt_domtrans_helper(domain)
abrt_read_pid_files(domain)
abrt_read_state(domain)
abrt_signull(domain)
abrt_stream_connect(domain)
')
optional_policy(`
rpm_use_fds(domain)
rpm_read_pipes(domain)
rpm_search_log(domain)
rpm_append_tmp_files(domain)
rpm_dontaudit_leaks(domain)
rpm_read_script_tmp_files(domain)
rpm_inherited_fifo(domain)
')
optional_policy(`
sosreport_append_tmp_files(domain)
')
tunable_policy(`allow_domain_fd_use',`
# Allow all domains to use fds past to them
allow domain domain:fd use;
')
optional_policy(`
cron_dontaudit_write_system_job_tmp_files(domain)
cron_rw_pipes(domain)
cron_rw_system_job_pipes(domain)
')
ifdef(`hide_broken_symptoms',`
dontaudit domain self:udp_socket listen;
allow domain domain:key { link search };
')
optional_policy(`
ifdef(`hide_broken_symptoms',`
afs_rw_udp_sockets(domain)
')
')
optional_policy(`
ssh_rw_pipes(domain)
')
optional_policy(`
unconfined_dontaudit_rw_pipes(domain)
unconfined_sigchld(domain)
')
# broken kernel
dontaudit can_change_object_identity can_change_object_identity:key link;