740 lines
19 KiB
Plaintext
740 lines
19 KiB
Plaintext
|
##############################
|
||
|
|
#
|
||
|
|
# Global macros for the type enforcement (TE) configuration.
|
||
|
|
#
|
||
|
|
|
||
|
|
#
|
||
|
|
# Authors: Stephen Smalley <sds@epoch.ncsc.mil> and Timothy Fraser
|
||
|
|
# Howard Holm (NSA) <hdholm@epoch.ncsc.mil>
|
||
|
|
# Russell Coker <russell@coker.com.au>
|
||
|
|
#
|
||
|
|
#
|
||
|
|
#
|
||
|
|
|
||
|
|
##################################
|
||
|
|
#
|
||
|
|
# can_setexec(domain)
|
||
|
|
#
|
||
|
|
# Authorize a domain to set its exec context
|
||
|
|
# (via /proc/pid/attr/exec).
|
||
|
|
#
|
||
|
|
define(`can_setexec',`
|
||
|
|
allow $1 self:process setexec;
|
||
|
|
allow $1 proc_t:dir search;
|
||
|
|
allow $1 proc_t:{ file lnk_file } read;
|
||
|
|
allow $1 self:dir search;
|
||
|
|
allow $1 self:file { getattr read write };
|
||
|
|
')
|
||
|
|
|
||
|
|
##################################
|
||
|
|
#
|
||
|
|
# can_getcon(domain)
|
||
|
|
#
|
||
|
|
# Authorize a domain to get its context
|
||
|
|
# (via /proc/pid/attr/current).
|
||
|
|
#
|
||
|
|
define(`can_getcon',`
|
||
|
|
allow $1 proc_t:dir search;
|
||
|
|
allow $1 proc_t:{ file lnk_file } read;
|
||
|
|
allow $1 self:dir search;
|
||
|
|
allow $1 self:file { getattr read };
|
||
|
|
allow $1 self:process getattr;
|
||
|
|
')
|
||
|
|
|
||
|
|
##################################
|
||
|
|
#
|
||
|
|
# can_setcon(domain)
|
||
|
|
#
|
||
|
|
# Authorize a domain to set its current context
|
||
|
|
# (via /proc/pid/attr/current).
|
||
|
|
#
|
||
|
|
define(`can_setcon',`
|
||
|
|
allow $1 self:process setcurrent;
|
||
|
|
allow $1 proc_t:dir search;
|
||
|
|
allow $1 proc_t:{ file lnk_file } read;
|
||
|
|
allow $1 self:dir search;
|
||
|
|
allow $1 self:file { getattr read write };
|
||
|
|
')
|
||
|
|
|
||
|
|
##################################
|
||
|
|
# read_sysctl(domain)
|
||
|
|
#
|
||
|
|
# Permissions for reading sysctl variables.
|
||
|
|
# If the second parameter is 'full', allow
|
||
|
|
# reading of any sysctl variables, else only
|
||
|
|
# sysctl_kernel_t.
|
||
|
|
#
|
||
|
|
define(`read_sysctl', `
|
||
|
|
# Read system variables in /sys.
|
||
|
|
ifelse($2,`full', `
|
||
|
|
allow $1 sysctl_type:dir r_dir_perms;
|
||
|
|
allow $1 sysctl_type:file r_file_perms;
|
||
|
|
', `
|
||
|
|
allow $1 sysctl_t:dir search;
|
||
|
|
allow $1 sysctl_kernel_t:dir search;
|
||
|
|
allow $1 sysctl_kernel_t:file { getattr read };
|
||
|
|
')
|
||
|
|
|
||
|
|
')dnl read_sysctl
|
||
|
|
|
||
|
|
##################################
|
||
|
|
#
|
||
|
|
# can_setfscreate(domain)
|
||
|
|
#
|
||
|
|
# Authorize a domain to set its fscreate context
|
||
|
|
# (via /proc/pid/attr/fscreate).
|
||
|
|
#
|
||
|
|
define(`can_setfscreate',`
|
||
|
|
allow $1 self:process setfscreate;
|
||
|
|
allow $1 proc_t:dir search;
|
||
|
|
allow $1 proc_t:{ file lnk_file } read;
|
||
|
|
allow $1 self:dir search;
|
||
|
|
allow $1 self:file { getattr read write };
|
||
|
|
')
|
||
|
|
|
||
|
|
#################################
|
||
|
|
#
|
||
|
|
# uses_shlib(domain)
|
||
|
|
#
|
||
|
|
# Permissions for using shared libraries.
|
||
|
|
#
|
||
|
|
define(`uses_shlib',`
|
||
|
|
allow $1 { root_t usr_t lib_t etc_t }:dir r_dir_perms;
|
||
|
|
allow $1 lib_t:lnk_file r_file_perms;
|
||
|
|
allow $1 ld_so_t:file rx_file_perms;
|
||
|
|
#allow $1 ld_so_t:file execute_no_trans;
|
||
|
|
allow $1 ld_so_t:lnk_file r_file_perms;
|
||
|
|
allow $1 { texrel_shlib_t shlib_t }:file rx_file_perms;
|
||
|
|
allow $1 { texrel_shlib_t shlib_t }:lnk_file r_file_perms;
|
||
|
|
allow $1 ld_so_cache_t:file r_file_perms;
|
||
|
|
allow $1 device_t:dir search;
|
||
|
|
allow $1 null_device_t:chr_file rw_file_perms;
|
||
|
|
')
|
||
|
|
|
||
|
|
#################################
|
||
|
|
#
|
||
|
|
# can_exec_any(domain)
|
||
|
|
#
|
||
|
|
# Permissions for executing a variety
|
||
|
|
# of executable types.
|
||
|
|
#
|
||
|
|
define(`can_exec_any',`
|
||
|
|
allow $1 { bin_t sbin_t lib_t etc_t }:dir r_dir_perms;
|
||
|
|
allow $1 { bin_t sbin_t etc_t }:lnk_file { getattr read };
|
||
|
|
uses_shlib($1)
|
||
|
|
can_exec($1, etc_t)
|
||
|
|
can_exec($1, lib_t)
|
||
|
|
can_exec($1, bin_t)
|
||
|
|
can_exec($1, sbin_t)
|
||
|
|
can_exec($1, exec_type)
|
||
|
|
can_exec($1, ld_so_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
|
||
|
|
#################################
|
||
|
|
#
|
||
|
|
# can_sysctl(domain)
|
||
|
|
#
|
||
|
|
# Permissions for modifying sysctl parameters.
|
||
|
|
#
|
||
|
|
define(`can_sysctl',`
|
||
|
|
allow $1 sysctl_type:dir r_dir_perms;
|
||
|
|
allow $1 sysctl_type:file { setattr rw_file_perms };
|
||
|
|
')
|
||
|
|
|
||
|
|
|
||
|
|
##################################
|
||
|
|
#
|
||
|
|
# read_locale(domain)
|
||
|
|
#
|
||
|
|
# Permissions for reading the locale data,
|
||
|
|
# /etc/localtime and the files that it links to
|
||
|
|
#
|
||
|
|
define(`read_locale', `
|
||
|
|
allow $1 etc_t:lnk_file read;
|
||
|
|
allow $1 lib_t:file r_file_perms;
|
||
|
|
r_dir_file($1, locale_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
|
||
|
|
###################################
|
||
|
|
#
|
||
|
|
# access_terminal(domain, typeprefix)
|
||
|
|
#
|
||
|
|
# Permissions for accessing the terminal
|
||
|
|
#
|
||
|
|
define(`access_terminal', `
|
||
|
|
allow $1 $2_tty_device_t:chr_file { read write getattr ioctl };
|
||
|
|
allow $1 devtty_t:chr_file { read write getattr ioctl };
|
||
|
|
allow $1 devpts_t:dir { read search getattr };
|
||
|
|
allow $1 $2_devpts_t:chr_file { read write getattr ioctl };
|
||
|
|
')
|
||
|
|
|
||
|
|
#
|
||
|
|
# general_proc_read_access(domain)
|
||
|
|
#
|
||
|
|
# Grant read/search permissions to most of /proc, excluding
|
||
|
|
# the /proc/PID directories and the /proc/kmsg and /proc/kcore files.
|
||
|
|
# The general_domain_access macro grants access to the domain /proc/PID
|
||
|
|
# directories, but not to other domains. Only permissions to stat
|
||
|
|
# are granted for /proc/kmsg and /proc/kcore, since these files are more
|
||
|
|
# sensitive.
|
||
|
|
#
|
||
|
|
define(`general_proc_read_access',`
|
||
|
|
# Read system information files in /proc.
|
||
|
|
r_dir_file($1, proc_t)
|
||
|
|
r_dir_file($1, proc_net_t)
|
||
|
|
allow $1 proc_mdstat_t:file r_file_perms;
|
||
|
|
|
||
|
|
# Stat /proc/kmsg and /proc/kcore.
|
||
|
|
allow $1 proc_fs:file stat_file_perms;
|
||
|
|
|
||
|
|
# Read system variables in /proc/sys.
|
||
|
|
read_sysctl($1)
|
||
|
|
')
|
||
|
|
|
||
|
|
#
|
||
|
|
# base_file_read_access(domain)
|
||
|
|
#
|
||
|
|
# Grant read/search permissions to a few system file types.
|
||
|
|
#
|
||
|
|
define(`base_file_read_access',`
|
||
|
|
# Read /.
|
||
|
|
allow $1 root_t:dir r_dir_perms;
|
||
|
|
allow $1 root_t:notdevfile_class_set r_file_perms;
|
||
|
|
|
||
|
|
# Read /home.
|
||
|
|
allow $1 home_root_t:dir r_dir_perms;
|
||
|
|
|
||
|
|
# Read /usr.
|
||
|
|
allow $1 usr_t:dir r_dir_perms;
|
||
|
|
allow $1 usr_t:notdevfile_class_set r_file_perms;
|
||
|
|
|
||
|
|
# Read bin and sbin directories.
|
||
|
|
allow $1 bin_t:dir r_dir_perms;
|
||
|
|
allow $1 bin_t:notdevfile_class_set r_file_perms;
|
||
|
|
allow $1 sbin_t:dir r_dir_perms;
|
||
|
|
allow $1 sbin_t:notdevfile_class_set r_file_perms;
|
||
|
|
read_sysctl($1)
|
||
|
|
|
||
|
|
r_dir_file($1, selinux_config_t)
|
||
|
|
|
||
|
|
if (read_default_t) {
|
||
|
|
#
|
||
|
|
# Read default_t
|
||
|
|
#.
|
||
|
|
allow $1 default_t:dir r_dir_perms;
|
||
|
|
allow $1 default_t:notdevfile_class_set r_file_perms;
|
||
|
|
}
|
||
|
|
|
||
|
|
')
|
||
|
|
|
||
|
|
#######################
|
||
|
|
# daemon_core_rules(domain_prefix, attribs)
|
||
|
|
#
|
||
|
|
# Define the core rules for a daemon, used by both daemon_base_domain() and
|
||
|
|
# init_service_domain().
|
||
|
|
# Attribs is the list of attributes which must start with "," if it is not empty
|
||
|
|
#
|
||
|
|
# Author: Russell Coker <russell@coker.com.au>
|
||
|
|
#
|
||
|
|
define(`daemon_core_rules', `
|
||
|
|
type $1_t, domain, privlog, daemon $2;
|
||
|
|
type $1_exec_t, file_type, sysadmfile, exec_type;
|
||
|
|
dontaudit $1_t self:capability sys_tty_config;
|
||
|
|
|
||
|
|
role system_r types $1_t;
|
||
|
|
|
||
|
|
# Inherit and use descriptors from init.
|
||
|
|
allow $1_t init_t:fd use;
|
||
|
|
allow $1_t init_t:process sigchld;
|
||
|
|
allow $1_t self:process { signal_perms fork };
|
||
|
|
|
||
|
|
uses_shlib($1_t)
|
||
|
|
|
||
|
|
allow $1_t { self proc_t }:dir r_dir_perms;
|
||
|
|
allow $1_t { self proc_t }:lnk_file read;
|
||
|
|
|
||
|
|
allow $1_t device_t:dir r_dir_perms;
|
||
|
|
ifdef(`udev.te', `
|
||
|
|
allow $1_t udev_tdb_t:file r_file_perms;
|
||
|
|
')dnl end if udev.te
|
||
|
|
allow $1_t null_device_t:chr_file rw_file_perms;
|
||
|
|
dontaudit $1_t console_device_t:chr_file rw_file_perms;
|
||
|
|
dontaudit $1_t unpriv_userdomain:fd use;
|
||
|
|
|
||
|
|
r_dir_file($1_t, sysfs_t)
|
||
|
|
|
||
|
|
allow $1_t autofs_t:dir { search getattr };
|
||
|
|
ifdef(`targeted_policy', `
|
||
|
|
dontaudit $1_t { tty_device_t devpts_t }:chr_file { read write };
|
||
|
|
dontaudit $1_t root_t:file { getattr read };
|
||
|
|
')dnl end if targeted_policy
|
||
|
|
|
||
|
|
')dnl end macro daemon_core_rules
|
||
|
|
|
||
|
|
#######################
|
||
|
|
# init_service_domain(domain_prefix, attribs)
|
||
|
|
#
|
||
|
|
# Define a domain for a program that is run from init
|
||
|
|
# Attribs is the list of attributes which must start with "," if it is not empty
|
||
|
|
#
|
||
|
|
# Author: Russell Coker <russell@coker.com.au>
|
||
|
|
#
|
||
|
|
define(`init_service_domain', `
|
||
|
|
daemon_core_rules($1, `$2')
|
||
|
|
|
||
|
|
domain_auto_trans(init_t, $1_exec_t, $1_t)
|
||
|
|
')dnl
|
||
|
|
|
||
|
|
#######################
|
||
|
|
# daemon_base_domain(domain_prefix, attribs)
|
||
|
|
#
|
||
|
|
# Define a daemon domain with a base set of type declarations
|
||
|
|
# and permissions that are common to most daemons.
|
||
|
|
# attribs is the list of attributes which must start with "," if it is not empty
|
||
|
|
#
|
||
|
|
# Author: Russell Coker <russell@coker.com.au>
|
||
|
|
#
|
||
|
|
define(`daemon_base_domain', `
|
||
|
|
daemon_core_rules($1, `$2')
|
||
|
|
|
||
|
|
rhgb_domain($1_t)
|
||
|
|
|
||
|
|
read_sysctl($1_t)
|
||
|
|
|
||
|
|
ifdef(`direct_sysadm_daemon', `
|
||
|
|
dontaudit $1_t admin_tty_type:chr_file rw_file_perms;
|
||
|
|
')
|
||
|
|
|
||
|
|
#
|
||
|
|
# Allows user to define a tunable to disable domain transition
|
||
|
|
#
|
||
|
|
ifelse(index(`$2',`transitionbool'), -1, `', `
|
||
|
|
bool $1_disable_trans false;
|
||
|
|
if ($1_disable_trans) {
|
||
|
|
can_exec(initrc_t, $1_exec_t)
|
||
|
|
can_exec(sysadm_t, $1_exec_t)
|
||
|
|
} else {
|
||
|
|
') dnl transitionbool
|
||
|
|
domain_auto_trans(initrc_t, $1_exec_t, $1_t)
|
||
|
|
allow initrc_t $1_t:process { noatsecure siginh rlimitinh };
|
||
|
|
ifdef(`direct_sysadm_daemon', `
|
||
|
|
ifelse(`$3', `nosysadm', `', `
|
||
|
|
domain_auto_trans(sysadm_t, $1_exec_t, $1_t)
|
||
|
|
allow sysadm_t $1_t:process { noatsecure siginh rlimitinh };
|
||
|
|
')dnl end direct_sysadm_daemon
|
||
|
|
')dnl end nosysadm
|
||
|
|
ifelse(index(`$2', `transitionbool'), -1, `', `
|
||
|
|
}
|
||
|
|
') dnl end transitionbool
|
||
|
|
ifdef(`direct_sysadm_daemon', `
|
||
|
|
ifelse(`$3', `nosysadm', `', `
|
||
|
|
role_transition sysadm_r $1_exec_t system_r;
|
||
|
|
')dnl end nosysadm
|
||
|
|
')dnl end direct_sysadm_daemon
|
||
|
|
|
||
|
|
allow $1_t privfd:fd use;
|
||
|
|
ifdef(`newrole.te', `allow $1_t newrole_t:process sigchld;')
|
||
|
|
allow $1_t initrc_devpts_t:chr_file rw_file_perms;
|
||
|
|
')dnl
|
||
|
|
|
||
|
|
# allow a domain to create its own files under /var/run and to create files
|
||
|
|
# in directories that are created for it. $2 is an optional list of
|
||
|
|
# classes to use; default is file.
|
||
|
|
define(`var_run_domain', `
|
||
|
|
type $1_var_run_t, file_type, sysadmfile, pidfile;
|
||
|
|
|
||
|
|
ifelse(`$2', `', `
|
||
|
|
file_type_auto_trans($1_t, var_run_t, $1_var_run_t, file)
|
||
|
|
', `
|
||
|
|
file_type_auto_trans($1_t, var_run_t, $1_var_run_t, $2)
|
||
|
|
')
|
||
|
|
allow $1_t var_t:dir search;
|
||
|
|
allow $1_t $1_var_run_t:dir rw_dir_perms;
|
||
|
|
')
|
||
|
|
define(`daemon_domain', `
|
||
|
|
ifdef(`targeted_policy', `
|
||
|
|
daemon_base_domain($1, `$2, transitionbool', $3)
|
||
|
|
', `
|
||
|
|
daemon_base_domain($1, `$2', $3)
|
||
|
|
')
|
||
|
|
# Create pid file.
|
||
|
|
allow $1_t var_t:dir { getattr search };
|
||
|
|
var_run_domain($1)
|
||
|
|
|
||
|
|
allow $1_t devtty_t:chr_file rw_file_perms;
|
||
|
|
|
||
|
|
# for daemons that look at /root on startup
|
||
|
|
dontaudit $1_t sysadm_home_dir_t:dir search;
|
||
|
|
|
||
|
|
# for df
|
||
|
|
allow $1_t fs_type:filesystem getattr;
|
||
|
|
allow $1_t removable_t:filesystem getattr;
|
||
|
|
|
||
|
|
read_locale($1_t)
|
||
|
|
|
||
|
|
# for localization
|
||
|
|
allow $1_t lib_t:file { getattr read };
|
||
|
|
')dnl end daemon_domain macro
|
||
|
|
|
||
|
|
define(`uses_authbind',
|
||
|
|
`domain_auto_trans($1, authbind_exec_t, authbind_t)
|
||
|
|
allow authbind_t $1:process sigchld;
|
||
|
|
allow authbind_t $1:fd use;
|
||
|
|
allow authbind_t $1:{ tcp_socket udp_socket } rw_socket_perms;
|
||
|
|
')
|
||
|
|
|
||
|
|
# define a sub-domain, $1_t is the parent domain, $2 is the name
|
||
|
|
# of the sub-domain.
|
||
|
|
#
|
||
|
|
define(`daemon_sub_domain', `
|
||
|
|
# $1 is the parent domain (or domains), $2_t is the child domain,
|
||
|
|
# and $3 is any attributes to apply to the child
|
||
|
|
type $2_t, domain, privlog, daemon $3;
|
||
|
|
type $2_exec_t, file_type, sysadmfile, exec_type;
|
||
|
|
|
||
|
|
role system_r types $2_t;
|
||
|
|
|
||
|
|
domain_auto_trans($1, $2_exec_t, $2_t)
|
||
|
|
|
||
|
|
# Inherit and use descriptors from parent.
|
||
|
|
allow $2_t $1:fd use;
|
||
|
|
allow $2_t $1:process sigchld;
|
||
|
|
|
||
|
|
allow $2_t self:process signal_perms;
|
||
|
|
|
||
|
|
uses_shlib($2_t)
|
||
|
|
|
||
|
|
allow $2_t { self proc_t }:dir r_dir_perms;
|
||
|
|
allow $2_t { self proc_t }:lnk_file read;
|
||
|
|
|
||
|
|
allow $2_t device_t:dir getattr;
|
||
|
|
')
|
||
|
|
|
||
|
|
# grant access to /tmp
|
||
|
|
# by default, only plain files and dirs may be stored there.
|
||
|
|
# This can be overridden with a third parameter
|
||
|
|
define(`tmp_domain', `
|
||
|
|
type $1_tmp_t, file_type, sysadmfile, tmpfile $2;
|
||
|
|
ifelse($3, `',
|
||
|
|
`file_type_auto_trans($1_t, tmp_t, $1_tmp_t, `{ file dir }')',
|
||
|
|
`file_type_auto_trans($1_t, tmp_t, $1_tmp_t, `$3')')
|
||
|
|
')
|
||
|
|
|
||
|
|
define(`tmpfs_domain', `
|
||
|
|
type $1_tmpfs_t, file_type, sysadmfile, tmpfsfile;
|
||
|
|
# Use this type when creating tmpfs/shm objects.
|
||
|
|
file_type_auto_trans($1_t, tmpfs_t, $1_tmpfs_t)
|
||
|
|
allow $1_tmpfs_t tmpfs_t:filesystem associate;
|
||
|
|
')
|
||
|
|
|
||
|
|
define(`var_lib_domain', `
|
||
|
|
type $1_var_lib_t, file_type, sysadmfile;
|
||
|
|
typealias $1_var_lib_t alias var_lib_$1_t;
|
||
|
|
file_type_auto_trans($1_t, var_lib_t, $1_var_lib_t, file)
|
||
|
|
allow $1_t $1_var_lib_t:dir rw_dir_perms;
|
||
|
|
')
|
||
|
|
|
||
|
|
define(`log_domain', `
|
||
|
|
type $1_log_t, file_type, sysadmfile, logfile;
|
||
|
|
file_type_auto_trans($1_t, var_log_t, $1_log_t, file)
|
||
|
|
')
|
||
|
|
|
||
|
|
define(`logdir_domain', `
|
||
|
|
log_domain($1)
|
||
|
|
allow $1_t $1_log_t:dir { setattr rw_dir_perms };
|
||
|
|
')
|
||
|
|
|
||
|
|
define(`etc_domain', `
|
||
|
|
type $1_etc_t, file_type, sysadmfile, usercanread;
|
||
|
|
allow $1_t $1_etc_t:file r_file_perms;
|
||
|
|
')
|
||
|
|
|
||
|
|
define(`etcdir_domain', `
|
||
|
|
etc_domain($1)
|
||
|
|
allow $1_t $1_etc_t:dir r_dir_perms;
|
||
|
|
allow $1_t $1_etc_t:lnk_file { getattr read };
|
||
|
|
')
|
||
|
|
|
||
|
|
define(`append_log_domain', `
|
||
|
|
type $1_log_t, file_type, sysadmfile, logfile;
|
||
|
|
allow $1_t var_log_t:dir ra_dir_perms;
|
||
|
|
allow $1_t $1_log_t:file { create ra_file_perms };
|
||
|
|
type_transition $1_t var_log_t:file $1_log_t;
|
||
|
|
')
|
||
|
|
|
||
|
|
define(`append_logdir_domain', `
|
||
|
|
append_log_domain($1)
|
||
|
|
allow $1_t $1_log_t:dir { setattr ra_dir_perms };
|
||
|
|
')
|
||
|
|
|
||
|
|
define(`lock_domain', `
|
||
|
|
type $1_lock_t, file_type, sysadmfile, lockfile;
|
||
|
|
file_type_auto_trans($1_t, var_lock_t, $1_lock_t, file)
|
||
|
|
')
|
||
|
|
|
||
|
|
####################################################################
|
||
|
|
# home_domain_ro_access(source, user, app)
|
||
|
|
#
|
||
|
|
# Gives source access to the read-only home
|
||
|
|
# domain of app for the given user type
|
||
|
|
#
|
||
|
|
|
||
|
|
define(`home_domain_ro_access', `
|
||
|
|
|
||
|
|
allow $1 home_root_t:dir search;
|
||
|
|
|
||
|
|
if (use_nfs_home_dirs) {
|
||
|
|
r_dir_file($1, nfs_t)
|
||
|
|
}
|
||
|
|
if (use_samba_home_dirs) {
|
||
|
|
r_dir_file($1, cifs_t)
|
||
|
|
}
|
||
|
|
allow $1 autofs_t:dir { search getattr };
|
||
|
|
|
||
|
|
r_dir_file($1, $2_$3_ro_home_t)
|
||
|
|
|
||
|
|
') dnl home_domain_ro_access
|
||
|
|
|
||
|
|
####################################################################
|
||
|
|
# home_domain_access(source, user, app)
|
||
|
|
#
|
||
|
|
# Gives source full access to the home
|
||
|
|
# domain of app for the given user type
|
||
|
|
#
|
||
|
|
|
||
|
|
define(`home_domain_access', `
|
||
|
|
|
||
|
|
allow $1 home_root_t:dir search;
|
||
|
|
|
||
|
|
if (use_nfs_home_dirs) {
|
||
|
|
create_dir_file($1, nfs_t)
|
||
|
|
}
|
||
|
|
if (use_samba_home_dirs) {
|
||
|
|
create_dir_file($1, cifs_t)
|
||
|
|
}
|
||
|
|
allow $1 autofs_t:dir { search getattr };
|
||
|
|
|
||
|
|
file_type_auto_trans($1, $2_home_dir_t, $2_$3_home_t)
|
||
|
|
|
||
|
|
') dnl home_domain_access
|
||
|
|
|
||
|
|
####################################################################
|
||
|
|
# home_domain (prefix, app)
|
||
|
|
#
|
||
|
|
# Creates a domain in the prefix home where an application can
|
||
|
|
# store its settings. It's accessible by the prefix domain.
|
||
|
|
#
|
||
|
|
|
||
|
|
define(`home_domain', `
|
||
|
|
|
||
|
|
# Declare home domain
|
||
|
|
# FIXME: the second alias is problematic because
|
||
|
|
# home_domain and home_domain_ro cannot be used in parallel
|
||
|
|
# Remove the second alias when compatibility is no longer an issue
|
||
|
|
|
||
|
|
type $1_$2_home_t, file_type, $1_file_type, sysadmfile;
|
||
|
|
typealias $1_$2_home_t alias $1_$2_rw_t;
|
||
|
|
typealias $1_$2_home_t alias $1_home_$2_t;
|
||
|
|
|
||
|
|
# User side access
|
||
|
|
create_dir_file($1_t, $1_$2_home_t)
|
||
|
|
allow $1_t $1_$2_home_t:{ dir file lnk_file } { relabelfrom relabelto };
|
||
|
|
|
||
|
|
# App side access
|
||
|
|
home_domain_access($1_$2_t, $1, $2)
|
||
|
|
')
|
||
|
|
|
||
|
|
####################################################################
|
||
|
|
# home_domain_ro (user, app)
|
||
|
|
#
|
||
|
|
# Creates a read-only domain in the user home where an application can
|
||
|
|
# store its settings. It's fully accessible by the user, but
|
||
|
|
# it's read-only for the application.
|
||
|
|
#
|
||
|
|
|
||
|
|
define(`home_domain_ro', `
|
||
|
|
|
||
|
|
# Declare home domain
|
||
|
|
# FIXME: the second alias is problematic because
|
||
|
|
# home_domain and home_domain_ro cannot be used in parallel
|
||
|
|
# Remove the second alias when compatibility is no longer an issue
|
||
|
|
|
||
|
|
type $1_$2_ro_home_t, file_type, $1_file_type, sysadmfile;
|
||
|
|
typealias $1_$2_ro_home_t alias $1_$2_ro_t;
|
||
|
|
typealias $1_$2_ro_home_t alias $1_home_$2_t;
|
||
|
|
|
||
|
|
# User side access
|
||
|
|
create_dir_file($1_t, $1_$2_ro_home_t)
|
||
|
|
allow $1_t $1_$2_ro_home_t:{ dir file lnk_file } { relabelfrom relabelto };
|
||
|
|
|
||
|
|
# App side access
|
||
|
|
home_domain_ro_access($1_$2_t, $1, $2)
|
||
|
|
')
|
||
|
|
|
||
|
|
#######################
|
||
|
|
# application_domain(domain_prefix)
|
||
|
|
#
|
||
|
|
# Define a domain with a base set of type declarations
|
||
|
|
# and permissions that are common to simple applications.
|
||
|
|
#
|
||
|
|
# Author: Russell Coker <russell@coker.com.au>
|
||
|
|
#
|
||
|
|
define(`application_domain', `
|
||
|
|
type $1_t, domain, privlog $2;
|
||
|
|
type $1_exec_t, file_type, sysadmfile, exec_type;
|
||
|
|
role sysadm_r types $1_t;
|
||
|
|
domain_auto_trans(sysadm_t, $1_exec_t, $1_t)
|
||
|
|
uses_shlib($1_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
define(`user_application_domain', `
|
||
|
|
application_domain($1, `$2')
|
||
|
|
in_user_role($1_t)
|
||
|
|
domain_auto_trans(userdomain, $1_exec_t, $1_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
define(`system_domain', `
|
||
|
|
type $1_t, domain, privlog $2;
|
||
|
|
type $1_exec_t, file_type, sysadmfile, exec_type;
|
||
|
|
role system_r types $1_t;
|
||
|
|
uses_shlib($1_t)
|
||
|
|
allow $1_t etc_t:dir r_dir_perms;
|
||
|
|
')
|
||
|
|
|
||
|
|
# Do not flood message log, if the user does a browse
|
||
|
|
define(`file_browse_domain', `
|
||
|
|
|
||
|
|
# Regular files/directories that are not security sensitive
|
||
|
|
dontaudit $1 file_type - secure_file_type:dir_file_class_set getattr;
|
||
|
|
dontaudit $1 file_type - secure_file_type:dir { read search };
|
||
|
|
|
||
|
|
# /dev
|
||
|
|
dontaudit $1 dev_fs:dir_file_class_set getattr;
|
||
|
|
dontaudit $1 dev_fs:dir { read search };
|
||
|
|
|
||
|
|
# /proc
|
||
|
|
dontaudit $1 sysctl_t:dir_file_class_set getattr;
|
||
|
|
dontaudit $1 proc_fs:dir { read search };
|
||
|
|
|
||
|
|
')dnl end file_browse_domain
|
||
|
|
|
||
|
|
|
||
|
|
# Define legacy_domain for legacy binaries (java)
|
||
|
|
# "legacy" binary == lacks PT_GNU_STACK header, i.e. built with an old
|
||
|
|
# toolchain. They cause the kernel to automatically start translating all
|
||
|
|
# read protection requests to read|execute for backward compatibility on
|
||
|
|
# x86. They will all need execmem and execmod, including execmod to
|
||
|
|
# shlib_t and ld_so_t unlike non-legacy binaries.
|
||
|
|
|
||
|
|
define(`legacy_domain', `
|
||
|
|
allow $1_t self:process { execmem };
|
||
|
|
allow $1_t { texrel_shlib_t shlib_t }:file execmod;
|
||
|
|
allow $1_t ld_so_t:file execmod;
|
||
|
|
allow $1_t ld_so_cache_t:file execute;
|
||
|
|
')
|
||
|
|
|
||
|
|
#
|
||
|
|
# Define a domain that can do anything, so that it is
|
||
|
|
# effectively unconfined by the SELinux policy. This
|
||
|
|
# means that it is only restricted by the normal Linux
|
||
|
|
# protections. Note that you may need to add further rules
|
||
|
|
# to allow other domains to interact with this domain as expected,
|
||
|
|
# since this macro only allows the specified domain to act upon
|
||
|
|
# all other domains and types, not vice versa.
|
||
|
|
#
|
||
|
|
define(`unconfined_domain', `
|
||
|
|
|
||
|
|
typeattribute $1 unrestricted;
|
||
|
|
|
||
|
|
# Mount/unmount any filesystem.
|
||
|
|
allow $1 fs_type:filesystem *;
|
||
|
|
|
||
|
|
# Mount/unmount any filesystem with the context= option.
|
||
|
|
allow $1 file_type:filesystem *;
|
||
|
|
|
||
|
|
# Create/access any file in a labeled filesystem;
|
||
|
|
allow $1 file_type:{ file chr_file } ~execmod;
|
||
|
|
allow $1 file_type:{ dir lnk_file sock_file fifo_file blk_file } *;
|
||
|
|
allow $1 sysctl_t:{ dir file } *;
|
||
|
|
allow $1 device_type:devfile_class_set *;
|
||
|
|
allow $1 mtrr_device_t:file *;
|
||
|
|
|
||
|
|
# Create/access other files. fs_type is to pick up various
|
||
|
|
# pseudo filesystem types that are applied to both the filesystem
|
||
|
|
# and its files.
|
||
|
|
allow $1 { unlabeled_t fs_type }:dir_file_class_set *;
|
||
|
|
allow $1 proc_fs:{ dir file } *;
|
||
|
|
|
||
|
|
# For /proc/pid
|
||
|
|
r_dir_file($1,domain)
|
||
|
|
# Write access is for setting attributes under /proc/self/attr.
|
||
|
|
allow $1 self:file rw_file_perms;
|
||
|
|
|
||
|
|
# Read and write sysctls.
|
||
|
|
can_sysctl($1)
|
||
|
|
|
||
|
|
# Access the network.
|
||
|
|
allow $1 node_type:node *;
|
||
|
|
allow $1 netif_type:netif *;
|
||
|
|
allow $1 port_type:{ tcp_socket udp_socket } { send_msg recv_msg };
|
||
|
|
|
||
|
|
# Bind to any network address.
|
||
|
|
allow $1 port_type:{ tcp_socket udp_socket } name_bind;
|
||
|
|
allow $1 node_type:{ tcp_socket udp_socket rawip_socket } node_bind;
|
||
|
|
allow $1 file_type:{ unix_stream_socket unix_dgram_socket } name_bind;
|
||
|
|
|
||
|
|
# Use/sendto/connectto sockets created by any domain.
|
||
|
|
allow $1 domain:{ socket_class_set socket key_socket } *;
|
||
|
|
|
||
|
|
# Use descriptors and pipes created by any domain.
|
||
|
|
allow $1 domain:fd use;
|
||
|
|
allow $1 domain:fifo_file rw_file_perms;
|
||
|
|
|
||
|
|
# Act upon any other process.
|
||
|
|
allow $1 domain:process ~{ transition dyntransition execmem };
|
||
|
|
# Transition to myself, to make get_ordered_context_list happy.
|
||
|
|
allow $1 self:process transition;
|
||
|
|
|
||
|
|
if (allow_execmem) {
|
||
|
|
# Allow loading DSOs that require executable stack.
|
||
|
|
allow $1 self:process execmem;
|
||
|
|
}
|
||
|
|
|
||
|
|
if (allow_execmod) {
|
||
|
|
# Allow text relocations on system shared libraries, e.g. libGL.
|
||
|
|
allow $1 texrel_shlib_t:file execmod;
|
||
|
|
}
|
||
|
|
|
||
|
|
# Create/access any System V IPC objects.
|
||
|
|
allow $1 domain:{ sem msgq shm } *;
|
||
|
|
allow $1 domain:msg { send receive };
|
||
|
|
|
||
|
|
# Access the security API.
|
||
|
|
allow $1 security_t:security *;
|
||
|
|
auditallow $1 security_t:security { load_policy setenforce setbool };
|
||
|
|
|
||
|
|
# Perform certain system operations that lacked individual capabilities.
|
||
|
|
allow $1 kernel_t:system *;
|
||
|
|
|
||
|
|
# Use any Linux capability.
|
||
|
|
allow $1 self:capability *;
|
||
|
|
|
||
|
|
# Set user information and skip authentication.
|
||
|
|
allow $1 self:passwd *;
|
||
|
|
|
||
|
|
# Communicate via dbusd.
|
||
|
|
allow $1 self:dbus *;
|
||
|
|
ifdef(`dbusd.te', `
|
||
|
|
allow $1 system_dbusd_t:dbus *;
|
||
|
|
')
|
||
|
|
|
||
|
|
# Get info via nscd.
|
||
|
|
allow $1 self:nscd *;
|
||
|
|
ifdef(`nscd.te', `
|
||
|
|
allow $1 nscd_t:nscd *;
|
||
|
|
')
|
||
|
|
|
||
|
|
')dnl end unconfined_domain
|