selinux-policy/policy/modules/apps/vmware.te


policy_module(vmware, 1.6.0)

########################################
#
# Declarations
#

# VMWare user program
type vmware_exec_t;
corecmd_executable_file(vmware_exec_t)

# VMWare host programs
type vmware_host_t;
type vmware_host_exec_t;
init_daemon_domain(vmware_host_t, vmware_host_exec_t)

type vmware_log_t;
logging_log_file(vmware_log_t)

# Systemwide configuration files
type vmware_sys_conf_t;
files_type(vmware_sys_conf_t)

type vmware_var_run_t;
files_pid_file(vmware_var_run_t)

########################################
#
# VMWare host local policy
#

allow vmware_host_t self:capability { setgid setuid net_raw };
dontaudit vmware_host_t self:capability sys_tty_config;
allow vmware_host_t self:process signal_perms;
allow vmware_host_t self:fifo_file rw_fifo_file_perms;
allow vmware_host_t self:unix_stream_socket create_stream_socket_perms;
allow vmware_host_t self:rawip_socket create_socket_perms;
allow vmware_host_t self:tcp_socket create_socket_perms;

# cjp: the ro and rw files should be split up
manage_files_pattern(vmware_host_t, vmware_sys_conf_t, vmware_sys_conf_t)

manage_files_pattern(vmware_host_t, vmware_var_run_t, vmware_var_run_t)
manage_sock_files_pattern(vmware_host_t, vmware_var_run_t, vmware_var_run_t)
files_pid_filetrans(vmware_host_t, vmware_var_run_t, { file sock_file })

manage_files_pattern(vmware_host_t, vmware_log_t, vmware_log_t)	
logging_log_filetrans(vmware_host_t, vmware_log_t, { file dir })

kernel_read_kernel_sysctls(vmware_host_t)
kernel_list_proc(vmware_host_t)
kernel_read_proc_symlinks(vmware_host_t)

corenet_all_recvfrom_unlabeled(vmware_host_t)
corenet_all_recvfrom_netlabel(vmware_host_t)
corenet_tcp_sendrecv_generic_if(vmware_host_t)
corenet_udp_sendrecv_generic_if(vmware_host_t)
corenet_raw_sendrecv_generic_if(vmware_host_t)
corenet_tcp_sendrecv_all_nodes(vmware_host_t)
corenet_udp_sendrecv_all_nodes(vmware_host_t)
corenet_raw_sendrecv_all_nodes(vmware_host_t)
corenet_tcp_sendrecv_all_ports(vmware_host_t)
corenet_udp_sendrecv_all_ports(vmware_host_t)
corenet_raw_bind_all_nodes(vmware_host_t)
corenet_tcp_bind_all_nodes(vmware_host_t)
corenet_udp_bind_all_nodes(vmware_host_t)
corenet_tcp_connect_all_ports(vmware_host_t)
corenet_sendrecv_all_client_packets(vmware_host_t)
corenet_sendrecv_all_server_packets(vmware_host_t)

dev_read_sysfs(vmware_host_t)
dev_read_urand(vmware_host_t)
dev_rw_vmware(vmware_host_t)

domain_use_interactive_fds(vmware_host_t)

files_read_etc_files(vmware_host_t)

fs_getattr_all_fs(vmware_host_t)
fs_search_auto_mountpoints(vmware_host_t)

term_dontaudit_use_console(vmware_host_t)

init_use_fds(vmware_host_t)
init_use_script_ptys(vmware_host_t)

logging_send_syslog_msg(vmware_host_t)

miscfiles_read_localization(vmware_host_t)

sysnet_dns_name_resolve(vmware_host_t)

userdom_dontaudit_use_unpriv_user_fds(vmware_host_t)

sysadm_dontaudit_search_home_dirs(vmware_host_t)

netutils_domtrans_ping(vmware_host_t)

optional_policy(`
	seutil_sigchld_newrole(vmware_host_t)

')

optional_policy(`
	udev_read_db(vmware_host_t)
')
add vmware, bug 1389 2006-04-26 18:18:15 +00:00
trunk: bump versions for release. 2008-07-02 14:07:57 +00:00			`policy_module(vmware, 1.6.0)`
add vmware, bug 1389 2006-04-26 18:18:15 +00:00
			`########################################`
			`#`
			`# Declarations`
			`#`

			`# VMWare user program`
			`type vmware_exec_t;`
			`corecmd_executable_file(vmware_exec_t)`

			`# VMWare host programs`
			`type vmware_host_t;`
			`type vmware_host_exec_t;`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`init_daemon_domain(vmware_host_t, vmware_host_exec_t)`
add vmware, bug 1389 2006-04-26 18:18:15 +00:00
trunk: pull in most of dans vmware patch. 2008-06-18 15:35:49 +00:00			`type vmware_log_t;`
			`logging_log_file(vmware_log_t)`

add vmware, bug 1389 2006-04-26 18:18:15 +00:00			`# Systemwide configuration files`
			`type vmware_sys_conf_t;`
			`files_type(vmware_sys_conf_t)`

			`type vmware_var_run_t;`
			`files_pid_file(vmware_var_run_t)`

			`########################################`
			`#`
			`# VMWare host local policy`
			`#`

trunk: pull in most of dans vmware patch. 2008-06-18 15:35:49 +00:00			`allow vmware_host_t self:capability { setgid setuid net_raw };`
add vmware, bug 1389 2006-04-26 18:18:15 +00:00			`dontaudit vmware_host_t self:capability sys_tty_config;`
			`allow vmware_host_t self:process signal_perms;`
merge policy patterns to trunk 2006-12-12 20:08:08 +00:00			`allow vmware_host_t self:fifo_file rw_fifo_file_perms;`
fixes for testing with unconfined vms 2006-04-26 19:03:41 +00:00			`allow vmware_host_t self:unix_stream_socket create_stream_socket_perms;`
			`allow vmware_host_t self:rawip_socket create_socket_perms;`
trunk: pull in most of dans vmware patch. 2008-06-18 15:35:49 +00:00			`allow vmware_host_t self:tcp_socket create_socket_perms;`
add vmware, bug 1389 2006-04-26 18:18:15 +00:00
fixes for testing with unconfined vms 2006-04-26 19:03:41 +00:00			`# cjp: the ro and rw files should be split up`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`manage_files_pattern(vmware_host_t, vmware_sys_conf_t, vmware_sys_conf_t)`
fixes for testing with unconfined vms 2006-04-26 19:03:41 +00:00
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`manage_files_pattern(vmware_host_t, vmware_var_run_t, vmware_var_run_t)`
			`manage_sock_files_pattern(vmware_host_t, vmware_var_run_t, vmware_var_run_t)`
			`files_pid_filetrans(vmware_host_t, vmware_var_run_t, { file sock_file })`
add vmware, bug 1389 2006-04-26 18:18:15 +00:00
trunk: pull in most of dans vmware patch. 2008-06-18 15:35:49 +00:00			`manage_files_pattern(vmware_host_t, vmware_log_t, vmware_log_t)`
			`logging_log_filetrans(vmware_host_t, vmware_log_t, { file dir })`

add vmware, bug 1389 2006-04-26 18:18:15 +00:00			`kernel_read_kernel_sysctls(vmware_host_t)`
			`kernel_list_proc(vmware_host_t)`
			`kernel_read_proc_symlinks(vmware_host_t)`

trunk: Unified labeled networking policy from Paul Moore. The latest revision of the labeled policy patches which enable both labeled and unlabeled policy support for NetLabel. This revision takes into account Chris' feedback from the first version and reduces the number of interface calls in each domain down to two at present: one for unlabeled access, one for NetLabel access. The older, transport layer specific interfaces, are still present for use by third-party modules but are not used in the default policy modules. trunk: Use netmsg initial SID for MLS-only Netlabel packets, from Paul Moore. This patch changes the policy to use the netmsg initial SID as the "base" SID/context for NetLabel packets which only have MLS security attributes. Currently we use the unlabeled initial SID which makes it very difficult to distinquish between actual unlabeled packets and those packets which have MLS security attributes. 2007-06-27 15:23:21 +00:00			`corenet_all_recvfrom_unlabeled(vmware_host_t)`
			`corenet_all_recvfrom_netlabel(vmware_host_t)`
fill out networking perms 2006-06-01 18:17:53 +00:00			`corenet_tcp_sendrecv_generic_if(vmware_host_t)`
			`corenet_udp_sendrecv_generic_if(vmware_host_t)`
fixes for testing with unconfined vms 2006-04-26 19:03:41 +00:00			`corenet_raw_sendrecv_generic_if(vmware_host_t)`
fill out networking perms 2006-06-01 18:17:53 +00:00			`corenet_tcp_sendrecv_all_nodes(vmware_host_t)`
			`corenet_udp_sendrecv_all_nodes(vmware_host_t)`
fixes for testing with unconfined vms 2006-04-26 19:03:41 +00:00			`corenet_raw_sendrecv_all_nodes(vmware_host_t)`
add packets for apps 2006-05-29 18:25:58 +00:00			`corenet_tcp_sendrecv_all_ports(vmware_host_t)`
fill out networking perms 2006-06-01 18:17:53 +00:00			`corenet_udp_sendrecv_all_ports(vmware_host_t)`
			`corenet_raw_bind_all_nodes(vmware_host_t)`
trunk: updates from dan on 9 modules 2007-08-22 20:02:41 +00:00			`corenet_tcp_bind_all_nodes(vmware_host_t)`
			`corenet_udp_bind_all_nodes(vmware_host_t)`
add packets for apps 2006-05-29 18:25:58 +00:00			`corenet_tcp_connect_all_ports(vmware_host_t)`
			`corenet_sendrecv_all_client_packets(vmware_host_t)`
fill out networking perms 2006-06-01 18:17:53 +00:00			`corenet_sendrecv_all_server_packets(vmware_host_t)`
fixes for testing with unconfined vms 2006-04-26 19:03:41 +00:00
add vmware, bug 1389 2006-04-26 18:18:15 +00:00			`dev_read_sysfs(vmware_host_t)`
trunk: pull in most of dans vmware patch. 2008-06-18 15:35:49 +00:00			`dev_read_urand(vmware_host_t)`
fixes for testing with unconfined vms 2006-04-26 19:03:41 +00:00			`dev_rw_vmware(vmware_host_t)`
add vmware, bug 1389 2006-04-26 18:18:15 +00:00
			`domain_use_interactive_fds(vmware_host_t)`

fixes for testing with unconfined vms 2006-04-26 19:03:41 +00:00			`files_read_etc_files(vmware_host_t)`

add vmware, bug 1389 2006-04-26 18:18:15 +00:00			`fs_getattr_all_fs(vmware_host_t)`
			`fs_search_auto_mountpoints(vmware_host_t)`

			`term_dontaudit_use_console(vmware_host_t)`

			`init_use_fds(vmware_host_t)`
			`init_use_script_ptys(vmware_host_t)`

			`logging_send_syslog_msg(vmware_host_t)`

			`miscfiles_read_localization(vmware_host_t)`

fixes from testing 2006-05-09 20:13:25 +00:00			`sysnet_dns_name_resolve(vmware_host_t)`

add vmware, bug 1389 2006-04-26 18:18:15 +00:00			`userdom_dontaudit_use_unpriv_user_fds(vmware_host_t)`
trunk: Move user roles into individual modules. 2008-04-29 13:58:34 +00:00
			`sysadm_dontaudit_search_home_dirs(vmware_host_t)`
add vmware, bug 1389 2006-04-26 18:18:15 +00:00
trunk: pull in most of dans vmware patch. 2008-06-18 15:35:49 +00:00			`netutils_domtrans_ping(vmware_host_t)`

add vmware, bug 1389 2006-04-26 18:18:15 +00:00			optional_policy(`
			`seutil_sigchld_newrole(vmware_host_t)`

			`')`

			optional_policy(`
			`udev_read_db(vmware_host_t)`
			`')`