selinux-policy/policy/modules/system/modutils.te

303 lines
6.8 KiB
Plaintext
Raw Normal View History

2005-04-20 19:07:16 +00:00
2008-09-12 14:18:20 +00:00
policy_module(modutils, 1.7.1)
2005-11-29 21:27:15 +00:00
gen_require(`
bool secure_mode_insmod;
')
2005-05-11 15:46:51 +00:00
########################################
#
# Declarations
#
2005-04-14 20:18:17 +00:00
# module loading config
type modules_conf_t;
files_type(modules_conf_t)
2005-04-14 20:18:17 +00:00
# module dependencies
type modules_dep_t;
files_type(modules_dep_t)
2005-04-14 20:18:17 +00:00
2005-09-26 20:26:32 +00:00
type insmod_t;
2005-04-14 20:18:17 +00:00
type insmod_exec_t;
2007-07-19 18:57:48 +00:00
application_domain(insmod_t,insmod_exec_t)
mls_file_write_all_levels(insmod_t)
role system_r types insmod_t;
2005-04-14 20:18:17 +00:00
type depmod_t;
type depmod_exec_t;
2005-06-13 17:35:46 +00:00
init_system_domain(depmod_t,depmod_exec_t)
role system_r types depmod_t;
type update_modules_t;
type update_modules_exec_t;
2005-06-13 17:35:46 +00:00
init_system_domain(update_modules_t,update_modules_exec_t)
role system_r types update_modules_t;
2005-04-21 22:46:49 +00:00
type update_modules_tmp_t;
2005-06-13 17:35:46 +00:00
files_tmp_file(update_modules_tmp_t)
2005-04-21 22:46:49 +00:00
########################################
#
# insmod local policy
#
allow insmod_t self:capability { dac_override net_raw sys_tty_config };
allow insmod_t self:process { execmem sigchld sigkill sigstop signull signal };
2005-06-09 14:26:05 +00:00
allow insmod_t self:udp_socket create_socket_perms;
allow insmod_t self:rawip_socket create_socket_perms;
2005-05-11 15:22:28 +00:00
# Read module config and dependency information
allow insmod_t { modules_conf_t modules_dep_t }:file read_file_perms;
2005-05-11 15:22:28 +00:00
2005-06-09 14:26:05 +00:00
can_exec(insmod_t, insmod_exec_t)
2005-05-11 15:22:28 +00:00
kernel_load_module(insmod_t)
2005-05-26 20:38:45 +00:00
kernel_read_system_state(insmod_t)
2006-04-03 19:49:47 +00:00
kernel_write_proc_files(insmod_t)
2005-09-19 21:17:45 +00:00
kernel_mount_debugfs(insmod_t)
kernel_mount_kvmfs(insmod_t)
2005-10-14 17:55:40 +00:00
kernel_read_debugfs(insmod_t)
2005-04-14 20:18:17 +00:00
# Rules for /proc/sys/kernel/tainted
kernel_read_kernel_sysctls(insmod_t)
2005-06-10 01:01:13 +00:00
kernel_rw_kernel_sysctl(insmod_t)
kernel_read_hotplug_sysctls(insmod_t)
2005-04-14 20:18:17 +00:00
files_read_kernel_modules(insmod_t)
2005-05-26 20:38:45 +00:00
# for locking: (cjp: ????)
files_write_kernel_modules(insmod_t)
dev_rw_sysfs(insmod_t)
dev_search_usbfs(insmod_t)
dev_rw_mtrr(insmod_t)
2005-06-13 16:22:32 +00:00
dev_read_urand(insmod_t)
dev_rw_agp(insmod_t)
dev_read_sound(insmod_t)
dev_write_sound(insmod_t)
2005-06-29 20:53:53 +00:00
dev_rw_apm_bios(insmod_t)
2005-06-30 18:54:08 +00:00
# cjp: why is this needed? insmod cannot mounton any dir
# and it also transitions to mount
dev_mount_usbfs(insmod_t)
2005-04-14 20:18:17 +00:00
2005-06-10 01:01:13 +00:00
fs_getattr_xattr_fs(insmod_t)
2005-04-14 20:18:17 +00:00
2005-06-13 17:35:46 +00:00
corecmd_exec_bin(insmod_t)
corecmd_exec_shell(insmod_t)
2005-05-30 21:17:20 +00:00
domain_signal_all_domains(insmod_t)
2006-02-20 21:33:25 +00:00
domain_use_interactive_fds(insmod_t)
2005-05-30 21:17:20 +00:00
2005-06-13 17:35:46 +00:00
files_read_etc_runtime_files(insmod_t)
files_read_etc_files(insmod_t)
2005-06-13 17:35:46 +00:00
files_read_usr_files(insmod_t)
files_exec_etc_files(insmod_t)
# for nscd:
2005-06-13 17:35:46 +00:00
files_dontaudit_search_pids(insmod_t)
# for when /var is not mounted early in the boot:
files_dontaudit_search_isid_type_dirs(insmod_t)
2005-04-14 20:18:17 +00:00
2006-02-02 21:08:12 +00:00
init_rw_initctl(insmod_t)
init_use_fds(insmod_t)
2006-02-20 21:33:25 +00:00
init_use_script_fds(insmod_t)
2006-02-02 21:08:12 +00:00
init_use_script_ptys(insmod_t)
2005-05-03 20:44:35 +00:00
2005-06-13 17:35:46 +00:00
libs_use_ld_so(insmod_t)
libs_use_shared_libs(insmod_t)
2005-04-14 20:18:17 +00:00
2005-06-13 17:35:46 +00:00
logging_send_syslog_msg(insmod_t)
logging_search_logs(insmod_t)
2005-04-14 20:18:17 +00:00
miscfiles_read_localization(insmod_t)
seutil_read_file_contexts(insmod_t)
2008-02-05 18:24:43 +00:00
ifdef(`distro_ubuntu',`
optional_policy(`
unconfined_domain(insmod_t)
')
')
2005-11-08 22:00:30 +00:00
if( ! secure_mode_insmod ) {
kernel_domtrans_to(insmod_t,insmod_exec_t)
2005-11-08 22:00:30 +00:00
}
optional_policy(`
2005-09-15 21:03:29 +00:00
hotplug_search_config(insmod_t)
')
optional_policy(`
2005-06-13 17:35:46 +00:00
mount_domtrans(insmod_t)
')
2005-04-14 20:18:17 +00:00
optional_policy(`
nis_use_ypbind(insmod_t)
')
optional_policy(`
2006-02-02 21:08:12 +00:00
nscd_socket_use(insmod_t)
2005-09-15 21:03:29 +00:00
')
optional_policy(`
2006-03-09 19:02:29 +00:00
fs_manage_ramfs_files(insmod_t)
rhgb_use_fds(insmod_t)
rhgb_dontaudit_use_ptys(insmod_t)
xserver_dontaudit_write_log(insmod_t)
xserver_stream_connect_xdm_xserver(insmod_t)
xserver_dontaudit_rw_xdm_stream_sockets(insmod_t)
2006-03-09 19:02:29 +00:00
ifdef(`hide_broken_symptoms',`
xserver_dontaudit_rw_xdm_xserver_tcp_sockets(insmod_t)
')
')
optional_policy(`
2006-02-02 21:08:12 +00:00
rpm_rw_pipes(insmod_t)
2005-07-12 20:34:24 +00:00
')
optional_policy(`
unconfined_dontaudit_rw_pipes(insmod_t)
')
optional_policy(`
2006-04-03 19:49:47 +00:00
# cjp: why is this needed:
dev_rw_xserver_misc(insmod_t)
2005-09-16 21:20:37 +00:00
xserver_getattr_log(insmod_t)
')
2005-04-14 20:18:17 +00:00
########################################
#
# depmod local policy
#
2005-06-09 14:26:05 +00:00
can_exec(depmod_t, depmod_exec_t)
# Read conf.modules.
2006-12-12 20:08:08 +00:00
allow depmod_t modules_conf_t:file read_file_perms;
2006-12-12 20:08:08 +00:00
allow depmod_t modules_dep_t:file manage_file_perms;
files_kernel_modules_filetrans(depmod_t,modules_dep_t,file)
kernel_read_system_state(depmod_t)
files_read_kernel_symbol_table(depmod_t)
files_read_kernel_modules(depmod_t)
2005-06-10 01:01:13 +00:00
fs_getattr_xattr_fs(depmod_t)
2005-06-10 01:01:13 +00:00
term_use_console(depmod_t)
2005-06-27 20:59:28 +00:00
corecmd_search_bin(depmod_t)
2006-02-20 21:33:25 +00:00
domain_use_interactive_fds(depmod_t)
2005-06-27 20:59:28 +00:00
init_use_fds(depmod_t)
2006-02-20 21:33:25 +00:00
init_use_script_fds(depmod_t)
2006-02-02 21:08:12 +00:00
init_use_script_ptys(depmod_t)
2005-05-03 20:44:35 +00:00
2005-06-13 17:35:46 +00:00
files_read_etc_runtime_files(depmod_t)
files_read_etc_files(depmod_t)
files_read_usr_src_files(depmod_t)
2005-09-22 21:59:50 +00:00
files_list_usr(depmod_t)
2005-06-13 17:35:46 +00:00
libs_use_ld_so(depmod_t)
libs_use_shared_libs(depmod_t)
2005-06-30 18:54:08 +00:00
# Read System.map from home directories.
files_list_home(depmod_t)
staff_read_home_content_files(depmod_t)
sysadm_read_home_content_files(depmod_t)
2008-02-05 18:24:43 +00:00
ifdef(`distro_ubuntu',`
optional_policy(`
unconfined_domain(depmod_t)
')
')
optional_policy(`
# Read System.map from home directories.
unconfined_read_home_content_files(depmod_t)
2005-11-01 15:34:00 +00:00
')
optional_policy(`
2006-02-02 21:08:12 +00:00
rpm_rw_pipes(depmod_t)
2005-07-12 20:34:24 +00:00
')
#################################
#
# update-modules local policy
#
2006-12-12 20:08:08 +00:00
allow update_modules_t self:fifo_file rw_fifo_file_perms;
2005-06-09 14:26:05 +00:00
allow update_modules_t modules_dep_t:file rw_file_perms;
2005-06-09 14:26:05 +00:00
can_exec(update_modules_t, insmod_exec_t)
can_exec(update_modules_t, update_modules_exec_t)
2005-05-03 20:44:35 +00:00
# manage module loading configuration
2006-12-12 20:08:08 +00:00
allow update_modules_t modules_conf_t:file manage_file_perms;
files_kernel_modules_filetrans(update_modules_t,modules_conf_t,file)
files_etc_filetrans(update_modules_t,modules_conf_t,file)
2005-05-03 20:44:35 +00:00
# transition to depmod
2005-06-09 14:26:05 +00:00
domain_auto_trans(update_modules_t, depmod_exec_t, depmod_t)
2005-10-25 19:03:15 +00:00
allow update_modules_t depmod_t:fd use;
allow depmod_t update_modules_t:fd use;
allow depmod_t update_modules_t:fifo_file rw_file_perms;
allow depmod_t update_modules_t:process sigchld;
2006-12-12 20:08:08 +00:00
manage_dirs_pattern(update_modules_t,update_modules_tmp_t,update_modules_tmp_t)
manage_files_pattern(update_modules_t,update_modules_tmp_t,update_modules_tmp_t)
2006-02-21 18:40:44 +00:00
files_tmp_filetrans(update_modules_t, update_modules_tmp_t, { file dir })
2005-04-25 21:44:48 +00:00
kernel_read_kernel_sysctls(update_modules_t)
kernel_read_system_state(update_modules_t)
2005-06-13 16:22:32 +00:00
dev_read_urand(update_modules_t)
2005-06-10 01:01:13 +00:00
fs_getattr_xattr_fs(update_modules_t)
2005-06-10 01:01:13 +00:00
term_use_console(update_modules_t)
init_use_fds(update_modules_t)
2006-02-20 21:33:25 +00:00
init_use_script_fds(update_modules_t)
2006-02-02 21:08:12 +00:00
init_use_script_ptys(update_modules_t)
2005-05-03 20:44:35 +00:00
2006-02-20 21:33:25 +00:00
domain_use_interactive_fds(update_modules_t)
2005-05-03 20:44:35 +00:00
2005-06-13 17:35:46 +00:00
files_read_etc_runtime_files(update_modules_t)
files_read_etc_files(update_modules_t)
files_exec_etc_files(update_modules_t)
2005-06-13 17:35:46 +00:00
corecmd_exec_bin(update_modules_t)
corecmd_exec_shell(update_modules_t)
2005-06-13 17:35:46 +00:00
libs_use_ld_so(update_modules_t)
libs_use_shared_libs(update_modules_t)
2005-06-13 17:35:46 +00:00
logging_send_syslog_msg(update_modules_t)
miscfiles_read_localization(update_modules_t)
sysadm_dontaudit_search_home_dirs(update_modules_t)
2005-10-27 14:52:37 +00:00
2006-08-23 03:47:39 +00:00
ifdef(`distro_gentoo',`
files_search_pids(update_modules_t)
2006-09-19 17:02:29 +00:00
files_getattr_usr_src_files(update_modules_t)
2006-10-13 21:44:02 +00:00
files_list_isid_type_dirs(update_modules_t) # /var
2006-08-23 03:47:39 +00:00
optional_policy(`
consoletype_exec(update_modules_t)
')
')
2008-02-05 18:24:43 +00:00
ifdef(`distro_ubuntu',`
optional_policy(`
unconfined_domain(update_modules_t)
')
')