selinux-policy/policy/modules/services/dbus.te

policy_module(dbus, 1.13.0)

gen_require(`
	class dbus all_dbus_perms;
')

##############################
#
# Delcarations
#

attribute dbusd_unconfined;
attribute session_bus_type;

type dbusd_etc_t;
files_config_file(dbusd_etc_t)

type dbusd_exec_t;
corecmd_executable_file(dbusd_exec_t)
typealias dbusd_exec_t alias system_dbusd_exec_t;

type session_dbusd_tmp_t;
typealias session_dbusd_tmp_t alias { user_dbusd_tmp_t staff_dbusd_tmp_t sysadm_dbusd_tmp_t };
typealias session_dbusd_tmp_t alias { auditadm_dbusd_tmp_t secadm_dbusd_tmp_t };
files_tmp_file(session_dbusd_tmp_t)
ubac_constrained(session_dbusd_tmp_t)

type system_dbusd_t;
init_system_domain(system_dbusd_t, dbusd_exec_t)

type system_dbusd_tmp_t;
files_tmp_file(system_dbusd_tmp_t)

type system_dbusd_var_lib_t;
files_type(system_dbusd_var_lib_t)

type system_dbusd_var_run_t;
files_pid_file(system_dbusd_var_run_t)

ifdef(`enable_mcs',`
	init_ranged_system_domain(system_dbusd_t, dbusd_exec_t, s0 - mcs_systemhigh)
')

ifdef(`enable_mls',`
	init_ranged_system_domain(system_dbusd_t, dbusd_exec_t, s0 - mls_systemhigh)
')

##############################
#
# System bus local policy
#

# dac_override: /var/run/dbus is owned by messagebus on Debian
# cjp: dac_override should probably go in a distro_debian
allow system_dbusd_t self:capability { dac_override setgid setpcap setuid };
dontaudit system_dbusd_t self:capability sys_tty_config;
allow system_dbusd_t self:process { getattr getsched signal_perms setpgid getcap setcap };
allow system_dbusd_t self:fifo_file rw_fifo_file_perms;
allow system_dbusd_t self:dbus { send_msg acquire_svc };
allow system_dbusd_t self:unix_stream_socket { connectto create_stream_socket_perms connectto };
allow system_dbusd_t self:unix_dgram_socket create_socket_perms;
# Receive notifications of policy reloads and enforcing status changes.
allow system_dbusd_t self:netlink_selinux_socket { create bind read };

can_exec(system_dbusd_t, dbusd_exec_t)

allow system_dbusd_t dbusd_etc_t:dir list_dir_perms;
read_files_pattern(system_dbusd_t, dbusd_etc_t, dbusd_etc_t)
read_lnk_files_pattern(system_dbusd_t, dbusd_etc_t, dbusd_etc_t)

manage_dirs_pattern(system_dbusd_t, system_dbusd_tmp_t, system_dbusd_tmp_t)
manage_files_pattern(system_dbusd_t, system_dbusd_tmp_t, system_dbusd_tmp_t)
files_tmp_filetrans(system_dbusd_t, system_dbusd_tmp_t, { file dir })

read_files_pattern(system_dbusd_t, system_dbusd_var_lib_t, system_dbusd_var_lib_t)

manage_dirs_pattern(system_dbusd_t, system_dbusd_var_run_t, system_dbusd_var_run_t)
manage_files_pattern(system_dbusd_t, system_dbusd_var_run_t, system_dbusd_var_run_t)
manage_sock_files_pattern(system_dbusd_t, system_dbusd_var_run_t, system_dbusd_var_run_t)
files_pid_filetrans(system_dbusd_t, system_dbusd_var_run_t, { file dir })

kernel_read_system_state(system_dbusd_t)
kernel_read_kernel_sysctls(system_dbusd_t)

dev_read_urand(system_dbusd_t)
dev_read_sysfs(system_dbusd_t)

fs_getattr_all_fs(system_dbusd_t)
fs_list_inotifyfs(system_dbusd_t)
fs_search_auto_mountpoints(system_dbusd_t)
fs_dontaudit_list_nfs(system_dbusd_t)

mls_fd_use_all_levels(system_dbusd_t)
mls_rangetrans_target(system_dbusd_t)
mls_file_read_all_levels(system_dbusd_t)
mls_socket_write_all_levels(system_dbusd_t)
mls_socket_read_to_clearance(system_dbusd_t)
mls_dbus_recv_all_levels(system_dbusd_t)

selinux_get_fs_mount(system_dbusd_t)
selinux_validate_context(system_dbusd_t)
selinux_compute_access_vector(system_dbusd_t)
selinux_compute_create_context(system_dbusd_t)
selinux_compute_relabel_context(system_dbusd_t)
selinux_compute_user_contexts(system_dbusd_t)

term_dontaudit_use_console(system_dbusd_t)

auth_use_nsswitch(system_dbusd_t)
auth_read_pam_console_data(system_dbusd_t)

corecmd_list_bin(system_dbusd_t)
corecmd_read_bin_pipes(system_dbusd_t)
corecmd_read_bin_sockets(system_dbusd_t)

domain_use_interactive_fds(system_dbusd_t)
domain_read_all_domains_state(system_dbusd_t)

files_read_etc_files(system_dbusd_t)
files_list_home(system_dbusd_t)
files_read_usr_files(system_dbusd_t)

init_use_fds(system_dbusd_t)
init_use_script_ptys(system_dbusd_t)
init_bin_domtrans_spec(system_dbusd_t)
init_domtrans_script(system_dbusd_t)
init_rw_stream_sockets(system_dbusd_t)

logging_send_audit_msgs(system_dbusd_t)
logging_send_syslog_msg(system_dbusd_t)

miscfiles_read_localization(system_dbusd_t)
miscfiles_read_generic_certs(system_dbusd_t)

seutil_read_config(system_dbusd_t)
seutil_read_default_contexts(system_dbusd_t)
seutil_sigchld_newrole(system_dbusd_t)

userdom_dontaudit_use_unpriv_user_fds(system_dbusd_t)
userdom_dontaudit_search_user_home_dirs(system_dbusd_t)

optional_policy(`
	bind_domtrans(system_dbusd_t)
')

optional_policy(`
	gnome_exec_gconf(system_dbusd_t)
')

optional_policy(`
	networkmanager_initrc_domtrans(system_dbusd_t)
')

optional_policy(`
	policykit_dbus_chat(system_dbusd_t)
	policykit_domtrans_auth(system_dbusd_t)
	policykit_search_lib(system_dbusd_t)
')

optional_policy(`
	sysnet_domtrans_dhcpc(system_dbusd_t)
')

optional_policy(`
	udev_read_db(system_dbusd_t)
')

########################################
#
# Unconfined access to this module
#
allow dbusd_unconfined session_bus_type:dbus all_dbus_perms;
allow dbusd_unconfined dbusd_unconfined:dbus all_dbus_perms;
allow session_bus_type dbusd_unconfined:dbus send_msg;

optional_policy(`
	xserver_use_xdm_fds(session_bus_type)
	xserver_rw_xdm_pipes(session_bus_type)
	xserver_append_xdm_home_files(session_bus_type)
')
Bump module versions for release. 2010-05-24 19:32:01 +00:00			`policy_module(dbus, 1.13.0)`
add dbus 2005-08-31 20:58:12 +00:00
final updates from nsa cvs 2005-09-19 21:17:45 +00:00			gen_require(`
trunk: merge strict and targeted policies. merge shlib_t into lib_t. 2007-10-02 16:04:50 +00:00			`class dbus all_dbus_perms;`
final updates from nsa cvs 2005-09-19 21:17:45 +00:00			`')`

add dbus 2005-08-31 20:58:12 +00:00			`##############################`
			`#`
			`# Delcarations`
			`#`

dbus patch from dan 2009-07-27 13:46:35 +00:00			`attribute dbusd_unconfined;`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00			`attribute session_bus_type;`

			`type dbusd_etc_t;`
dbus patch from dan 2009-07-27 13:46:35 +00:00			`files_config_file(dbusd_etc_t)`
add dbus 2005-08-31 20:58:12 +00:00
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00			`type dbusd_exec_t;`
			`corecmd_executable_file(dbusd_exec_t)`
dbus patch from dan 2009-07-27 13:46:35 +00:00			`typealias dbusd_exec_t alias system_dbusd_exec_t;`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00
			`type session_dbusd_tmp_t;`
			`typealias session_dbusd_tmp_t alias { user_dbusd_tmp_t staff_dbusd_tmp_t sysadm_dbusd_tmp_t };`
			`typealias session_dbusd_tmp_t alias { auditadm_dbusd_tmp_t secadm_dbusd_tmp_t };`
			`files_tmp_file(session_dbusd_tmp_t)`
			`ubac_constrained(session_dbusd_tmp_t)`

			`type system_dbusd_t;`
			`init_system_domain(system_dbusd_t, dbusd_exec_t)`
add dbus 2005-08-31 20:58:12 +00:00
			`type system_dbusd_tmp_t;`
			`files_tmp_file(system_dbusd_tmp_t)`

trunk: 6 patches from dan. 2007-09-07 13:41:20 +00:00			`type system_dbusd_var_lib_t;`
dbus patch from dan 2009-07-27 13:46:35 +00:00			`files_type(system_dbusd_var_lib_t)`
trunk: 6 patches from dan. 2007-09-07 13:41:20 +00:00
add dbus 2005-08-31 20:58:12 +00:00			`type system_dbusd_var_run_t;`
			`files_pid_file(system_dbusd_var_run_t)`

dbus patch from dan 2009-07-27 13:46:35 +00:00			ifdef(`enable_mcs',`
fix dbus type transition conflict. switch dbus ranged calls from daemon domain to system domain. This works around a type transition conflict. It is also why the non-ranged init_system_domain() is used instead of init_daemon_domain(). 2009-07-28 15:05:19 +00:00			`init_ranged_system_domain(system_dbusd_t, dbusd_exec_t, s0 - mcs_systemhigh)`
dbus patch from dan 2009-07-27 13:46:35 +00:00			`')`

			ifdef(`enable_mls',`
fix dbus type transition conflict. switch dbus ranged calls from daemon domain to system domain. This works around a type transition conflict. It is also why the non-ranged init_system_domain() is used instead of init_daemon_domain(). 2009-07-28 15:05:19 +00:00			`init_ranged_system_domain(system_dbusd_t, dbusd_exec_t, s0 - mls_systemhigh)`
dbus patch from dan 2009-07-27 13:46:35 +00:00			`')`

add dbus 2005-08-31 20:58:12 +00:00			`##############################`
			`#`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00			`# System bus local policy`
add dbus 2005-08-31 20:58:12 +00:00			`#`

			`# dac_override: /var/run/dbus is owned by messagebus on Debian`
			`# cjp: dac_override should probably go in a distro_debian`
merge policy patterns to trunk 2006-12-12 20:08:08 +00:00			`allow system_dbusd_t self:capability { dac_override setgid setpcap setuid };`
add dbus 2005-08-31 20:58:12 +00:00			`dontaudit system_dbusd_t self:capability sys_tty_config;`
dbus patch from dan 2009-07-27 13:46:35 +00:00			`allow system_dbusd_t self:process { getattr getsched signal_perms setpgid getcap setcap };`
trunk: Enable open permission checks policy capability. 2008-10-16 16:09:20 +00:00			`allow system_dbusd_t self:fifo_file rw_fifo_file_perms;`
add dbus 2005-08-31 20:58:12 +00:00			`allow system_dbusd_t self:dbus { send_msg acquire_svc };`
partial (most of it) merge of selinux-policy-strict-sources-1.27.1-15 2005-10-13 20:59:36 +00:00			`allow system_dbusd_t self:unix_stream_socket { connectto create_stream_socket_perms connectto };`
add dbus 2005-08-31 20:58:12 +00:00			`allow system_dbusd_t self:unix_dgram_socket create_socket_perms;`
			`# Receive notifications of policy reloads and enforcing status changes.`
			`allow system_dbusd_t self:netlink_selinux_socket { create bind read };`

dbus patch from dan 2009-07-27 13:46:35 +00:00			`can_exec(system_dbusd_t, dbusd_exec_t)`

merge policy patterns to trunk 2006-12-12 20:08:08 +00:00			`allow system_dbusd_t dbusd_etc_t:dir list_dir_perms;`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`read_files_pattern(system_dbusd_t, dbusd_etc_t, dbusd_etc_t)`
			`read_lnk_files_pattern(system_dbusd_t, dbusd_etc_t, dbusd_etc_t)`
merge policy patterns to trunk 2006-12-12 20:08:08 +00:00
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`manage_dirs_pattern(system_dbusd_t, system_dbusd_tmp_t, system_dbusd_tmp_t)`
			`manage_files_pattern(system_dbusd_t, system_dbusd_tmp_t, system_dbusd_tmp_t)`
another round of renaming 2006-02-21 18:40:44 +00:00			`files_tmp_filetrans(system_dbusd_t, system_dbusd_tmp_t, { file dir })`
add dbus 2005-08-31 20:58:12 +00:00
trunk: 6 patches from dan. 2007-09-07 13:41:20 +00:00			`read_files_pattern(system_dbusd_t, system_dbusd_var_lib_t, system_dbusd_var_lib_t)`

UPdate for f14 policy 2010-08-26 13:41:21 +00:00			`manage_dirs_pattern(system_dbusd_t, system_dbusd_var_run_t, system_dbusd_var_run_t)`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`manage_files_pattern(system_dbusd_t, system_dbusd_var_run_t, system_dbusd_var_run_t)`
			`manage_sock_files_pattern(system_dbusd_t, system_dbusd_var_run_t, system_dbusd_var_run_t)`
UPdate for f14 policy 2010-08-26 13:41:21 +00:00			`files_pid_filetrans(system_dbusd_t, system_dbusd_var_run_t, { file dir })`
add dbus 2005-08-31 20:58:12 +00:00
			`kernel_read_system_state(system_dbusd_t)`
renaming from 20060131 interface review, round 2 2006-01-31 16:49:43 +00:00			`kernel_read_kernel_sysctls(system_dbusd_t)`
add dbus 2005-08-31 20:58:12 +00:00
			`dev_read_urand(system_dbusd_t)`
			`dev_read_sysfs(system_dbusd_t)`

			`fs_getattr_all_fs(system_dbusd_t)`
Dbus patch from Dan Walsh. 2010-05-03 13:34:42 +00:00			`fs_list_inotifyfs(system_dbusd_t)`
add dbus 2005-08-31 20:58:12 +00:00			`fs_search_auto_mountpoints(system_dbusd_t)`
dbus patch from dan 2009-07-27 13:46:35 +00:00			`fs_dontaudit_list_nfs(system_dbusd_t)`

			`mls_fd_use_all_levels(system_dbusd_t)`
			`mls_rangetrans_target(system_dbusd_t)`
			`mls_file_read_all_levels(system_dbusd_t)`
			`mls_socket_write_all_levels(system_dbusd_t)`
			`mls_socket_read_to_clearance(system_dbusd_t)`
			`mls_dbus_recv_all_levels(system_dbusd_t)`
add dbus 2005-08-31 20:58:12 +00:00
			`selinux_get_fs_mount(system_dbusd_t)`
			`selinux_validate_context(system_dbusd_t)`
			`selinux_compute_access_vector(system_dbusd_t)`
			`selinux_compute_create_context(system_dbusd_t)`
			`selinux_compute_relabel_context(system_dbusd_t)`
			`selinux_compute_user_contexts(system_dbusd_t)`

			`term_dontaudit_use_console(system_dbusd_t)`

partial (most of it) merge of selinux-policy-strict-sources-1.27.1-15 2005-10-13 20:59:36 +00:00			`auth_use_nsswitch(system_dbusd_t)`
			`auth_read_pam_console_data(system_dbusd_t)`

add dbus 2005-08-31 20:58:12 +00:00			`corecmd_list_bin(system_dbusd_t)`
another slew of renaming 2006-02-02 21:08:12 +00:00			`corecmd_read_bin_pipes(system_dbusd_t)`
			`corecmd_read_bin_sockets(system_dbusd_t)`
add dbus 2005-08-31 20:58:12 +00:00
another round of renaming 2006-02-20 21:33:25 +00:00			`domain_use_interactive_fds(system_dbusd_t)`
dbus patch from dan 2009-07-27 13:46:35 +00:00			`domain_read_all_domains_state(system_dbusd_t)`
add dbus 2005-08-31 20:58:12 +00:00
			`files_read_etc_files(system_dbusd_t)`
			`files_list_home(system_dbusd_t)`
			`files_read_usr_files(system_dbusd_t)`

make (almost) all interface parameters required. move boot_t, system_map_t, and modules_object_t to files module. fd use interface renames, udp sendto interface renames. 2006-03-02 23:41:11 +00:00			`init_use_fds(system_dbusd_t)`
another slew of renaming 2006-02-02 21:08:12 +00:00			`init_use_script_ptys(system_dbusd_t)`
UPdate for f14 policy 2010-08-26 13:41:21 +00:00			`init_bin_domtrans_spec(system_dbusd_t)`
Dbus patch from Dan Walsh. 2010-05-03 13:34:42 +00:00			`init_domtrans_script(system_dbusd_t)`
UPdate for f14 policy 2010-08-26 13:41:21 +00:00			`init_rw_stream_sockets(system_dbusd_t)`
add dbus 2005-08-31 20:58:12 +00:00
trunk: Add logging_send_audit_msgs() interface and deprecate send_audit_msgs_pattern(). 2007-06-12 18:46:14 +00:00			`logging_send_audit_msgs(system_dbusd_t)`
add dbus 2005-08-31 20:58:12 +00:00			`logging_send_syslog_msg(system_dbusd_t)`

			`miscfiles_read_localization(system_dbusd_t)`
Implement miscfiles_cert_type(). This is based on Fedoras' miscfiles_cert_type implementation. The idea was that openvpn needs to be able read home certificates (home_cert_t) which is not implemented in refpolicy yet, as well as generic cert_t certificates. Note that openvpn is allowed to read all cert_types, as i know that it needs access to both generic cert_t as well as (future) home_cert_t. Dwalsh noted that other domains may need this as well but because i do not know exactly which domains i will not changes any other domains call to generic cert type interfaces. Signed-off-by: Dominick Grift <domg472@gmail.com> 2010-09-09 16:14:48 +00:00			`miscfiles_read_generic_certs(system_dbusd_t)`
add dbus 2005-08-31 20:58:12 +00:00
			`seutil_read_config(system_dbusd_t)`
			`seutil_read_default_contexts(system_dbusd_t)`
			`seutil_sigchld_newrole(system_dbusd_t)`

another round of renaming 2006-02-20 21:33:25 +00:00			`userdom_dontaudit_use_unpriv_user_fds(system_dbusd_t)`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00			`userdom_dontaudit_search_user_home_dirs(system_dbusd_t)`
add dbus 2005-08-31 20:58:12 +00:00
deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
more merging from 1.27.1-15 2005-10-14 18:42:42 +00:00			`bind_domtrans(system_dbusd_t)`
			`')`

dbus patch from dan 2009-07-27 13:46:35 +00:00			optional_policy(`
UPdate for f14 policy 2010-08-26 13:41:21 +00:00			`gnome_exec_gconf(system_dbusd_t)`
			`')`

			optional_policy(`
			`networkmanager_initrc_domtrans(system_dbusd_t)`
			`')`

			optional_policy(`
Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. 2010-09-22 10:07:37 +00:00			`policykit_dbus_chat(system_dbusd_t)`
dbus patch from dan 2009-07-27 13:46:35 +00:00			`policykit_domtrans_auth(system_dbusd_t)`
			`policykit_search_lib(system_dbusd_t)`
			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
pile o fixes 2005-10-26 16:00:13 +00:00			`sysnet_domtrans_dhcpc(system_dbusd_t)`
			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
move rhgb_domain into TODO so modules can compile as binary modules 2005-09-01 13:52:59 +00:00			`udev_read_db(system_dbusd_t)`
			`')`
dbus patch from dan 2009-07-27 13:46:35 +00:00
			`########################################`
			`#`
			`# Unconfined access to this module`
			`#`
			`allow dbusd_unconfined session_bus_type:dbus all_dbus_perms;`
UPdate for f14 policy 2010-08-26 13:41:21 +00:00			`allow dbusd_unconfined dbusd_unconfined:dbus all_dbus_perms;`
			`allow session_bus_type dbusd_unconfined:dbus send_msg;`

			optional_policy(`
			`xserver_use_xdm_fds(session_bus_type)`
			`xserver_rw_xdm_pipes(session_bus_type)`
			`xserver_append_xdm_home_files(session_bus_type)`
			`')`