selinux-policy/policy/modules/kernel/kernel.te

390 lines
11 KiB
Plaintext
Raw Normal View History

2005-04-20 19:07:16 +00:00
2009-07-23 12:58:35 +00:00
policy_module(kernel, 1.10.5)
2005-06-14 20:40:09 +00:00
########################################
#
# Declarations
#
# assertion related attributes
attribute can_load_kernmodule;
attribute can_receive_kernel_messages;
neverallow ~{ can_load_kernmodule kern_unconfined } self:capability sys_module;
2005-09-12 15:17:39 +00:00
# domains with unconfined access to kernel resources
attribute kern_unconfined;
# regular entries in proc
attribute proc_type;
# sysctls
attribute sysctl_type;
2005-11-29 21:27:15 +00:00
role system_r;
role sysadm_r;
role staff_r;
role user_r;
2006-01-24 22:03:36 +00:00
# here until order dependence is fixed:
role unconfined_r;
2006-01-24 22:03:36 +00:00
ifdef(`enable_mls',`
role secadm_r;
role auditadm_r;
2006-01-24 22:03:36 +00:00
')
2005-11-29 21:27:15 +00:00
#
2005-04-14 20:18:17 +00:00
# kernel_t is the domain of kernel threads.
# It is also the target type when checking permissions in the system class.
#
2005-09-26 20:26:32 +00:00
type kernel_t, can_load_kernmodule;
domain_base_type(kernel_t)
2005-09-26 20:26:32 +00:00
mls_rangetrans_source(kernel_t)
role system_r types kernel_t;
sid kernel gen_context(system_u:system_r:kernel_t,mls_systemhigh)
2005-04-14 20:18:17 +00:00
2008-06-18 13:15:25 +00:00
#
# cgroup fs
#
type cgroup_t;
fs_type(cgroup_t)
allow cgroup_t self:filesystem associate;
genfscon cgroup / gen_context(system_u:object_r:cgroup_t,s0)
2005-09-19 21:17:45 +00:00
#
# DebugFS
#
type debugfs_t;
fs_type(debugfs_t)
allow debugfs_t self:filesystem associate;
genfscon debugfs / gen_context(system_u:object_r:debugfs_t,s0)
2005-09-19 21:17:45 +00:00
2007-03-19 18:48:14 +00:00
#
# kvmFS
#
type kvmfs_t;
fs_type(kvmfs_t)
genfscon kvmfs / gen_context(system_u:object_r:kvmfs_t,s0)
2005-04-14 20:18:17 +00:00
#
# Procfs types
#
type proc_t, proc_type;
2005-06-13 17:35:46 +00:00
files_mountpoint(proc_t)
fs_type(proc_t)
genfscon proc / gen_context(system_u:object_r:proc_t,s0)
genfscon proc /sysvipc gen_context(system_u:object_r:proc_t,s0)
2005-04-14 20:18:17 +00:00
2007-10-29 22:08:34 +00:00
type proc_afs_t, proc_type;
genfscon proc /fs/openafs gen_context(system_u:object_r:proc_afs_t,s0)
2005-04-14 20:18:17 +00:00
# kernel message interface
type proc_kmsg_t, proc_type;
genfscon proc /kmsg gen_context(system_u:object_r:proc_kmsg_t,mls_systemhigh)
neverallow ~{ can_receive_kernel_messages kern_unconfined } proc_kmsg_t:file ~getattr;
2005-04-14 20:18:17 +00:00
# /proc kcore: inaccessible
type proc_kcore_t, proc_type;
neverallow ~kern_unconfined proc_kcore_t:file ~getattr;
genfscon proc /kcore gen_context(system_u:object_r:proc_kcore_t,mls_systemhigh)
2005-04-14 20:18:17 +00:00
type proc_mdstat_t, proc_type;
genfscon proc /mdstat gen_context(system_u:object_r:proc_mdstat_t,s0)
2005-04-14 20:18:17 +00:00
type proc_net_t, proc_type;
genfscon proc /net gen_context(system_u:object_r:proc_net_t,s0)
2005-04-14 20:18:17 +00:00
type proc_xen_t, proc_type;
2009-06-11 15:00:48 +00:00
files_mountpoint(proc_xen_t)
genfscon proc /xen gen_context(system_u:object_r:proc_xen_t,s0)
2005-04-14 20:18:17 +00:00
#
# Sysctl types
#
# /proc/sys directory, base directory of sysctls
type sysctl_t, sysctl_type;
files_mountpoint(sysctl_t)
sid sysctl gen_context(system_u:object_r:sysctl_t,s0)
genfscon proc /sys gen_context(system_u:object_r:sysctl_t,s0)
2005-04-14 20:18:17 +00:00
# /proc/irq directory and files
type sysctl_irq_t, sysctl_type;
genfscon proc /irq gen_context(system_u:object_r:sysctl_irq_t,s0)
2005-04-14 20:18:17 +00:00
# /proc/net/rpc directory and files
type sysctl_rpc_t, sysctl_type;
genfscon proc /net/rpc gen_context(system_u:object_r:sysctl_rpc_t,s0)
2005-04-14 20:18:17 +00:00
2009-06-11 15:00:48 +00:00
# /proc/sys/crypto directory and files
type sysctl_crypto_t, sysctl_type;
genfscon proc /sys/crypto gen_context(system_u:object_r:sysctl_crypto_t,s0)
2005-04-14 20:18:17 +00:00
# /proc/sys/fs directory and files
type sysctl_fs_t, sysctl_type;
2005-06-13 17:35:46 +00:00
files_mountpoint(sysctl_fs_t)
genfscon proc /sys/fs gen_context(system_u:object_r:sysctl_fs_t,s0)
2005-04-14 20:18:17 +00:00
# /proc/sys/kernel directory and files
type sysctl_kernel_t, sysctl_type;
genfscon proc /sys/kernel gen_context(system_u:object_r:sysctl_kernel_t,s0)
2005-04-14 20:18:17 +00:00
# /proc/sys/kernel/modprobe file
type sysctl_modprobe_t, sysctl_type;
genfscon proc /sys/kernel/modprobe gen_context(system_u:object_r:sysctl_modprobe_t,s0)
2005-04-14 20:18:17 +00:00
# /proc/sys/kernel/hotplug file
type sysctl_hotplug_t, sysctl_type;
genfscon proc /sys/kernel/hotplug gen_context(system_u:object_r:sysctl_hotplug_t,s0)
2005-04-14 20:18:17 +00:00
# /proc/sys/net directory and files
type sysctl_net_t, sysctl_type;
genfscon proc /sys/net gen_context(system_u:object_r:sysctl_net_t,s0)
2005-04-14 20:18:17 +00:00
# /proc/sys/net/unix directory and files
type sysctl_net_unix_t, sysctl_type;
genfscon proc /sys/net/unix gen_context(system_u:object_r:sysctl_net_unix_t,s0)
2005-04-14 20:18:17 +00:00
# /proc/sys/vm directory and files
type sysctl_vm_t, sysctl_type;
genfscon proc /sys/vm gen_context(system_u:object_r:sysctl_vm_t,s0)
2005-04-14 20:18:17 +00:00
# /proc/sys/dev directory and files
type sysctl_dev_t, sysctl_type;
genfscon proc /sys/dev gen_context(system_u:object_r:sysctl_dev_t,s0)
#
# unlabeled_t is the type of unlabeled objects.
# Objects that have no known labeling information or that
# have labels that are no longer valid are treated as having this type.
#
type unlabeled_t;
sid unlabeled gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
# These initial sids are no longer used, and can be removed:
sid any_socket gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
sid file_labels gen_context(system_u:object_r:unlabeled_t,s0)
sid icmp_socket gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
sid igmp_packet gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
sid init gen_context(system_u:object_r:unlabeled_t,s0)
sid kmod gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
sid policy gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
sid scmp_packet gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
sid sysctl_modprobe gen_context(system_u:object_r:unlabeled_t,s0)
sid sysctl_fs gen_context(system_u:object_r:unlabeled_t,s0)
sid sysctl_kernel gen_context(system_u:object_r:unlabeled_t,s0)
sid sysctl_net gen_context(system_u:object_r:unlabeled_t,s0)
sid sysctl_net_unix gen_context(system_u:object_r:unlabeled_t,s0)
sid sysctl_vm gen_context(system_u:object_r:unlabeled_t,s0)
sid sysctl_dev gen_context(system_u:object_r:unlabeled_t,s0)
sid tcp_socket gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
########################################
#
# kernel local policy
#
allow kernel_t self:capability *;
2005-10-18 15:07:11 +00:00
allow kernel_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
2005-06-08 20:28:45 +00:00
allow kernel_t self:shm create_shm_perms;
allow kernel_t self:sem create_sem_perms;
allow kernel_t self:msg { send receive };
2005-06-08 20:28:45 +00:00
allow kernel_t self:msgq create_msgq_perms;
allow kernel_t self:unix_dgram_socket create_socket_perms;
allow kernel_t self:unix_stream_socket create_stream_socket_perms;
allow kernel_t self:unix_dgram_socket sendto;
allow kernel_t self:unix_stream_socket connectto;
allow kernel_t self:fifo_file rw_fifo_file_perms;
allow kernel_t self:sock_file read_sock_file_perms;
allow kernel_t self:fd use;
2009-06-11 15:00:48 +00:00
allow kernel_t debugfs_t:dir search_dir_perms;
allow kernel_t proc_t:dir list_dir_perms;
allow kernel_t proc_t:file read_file_perms;
allow kernel_t proc_t:lnk_file read_lnk_file_perms;
2006-05-26 19:04:18 +00:00
allow kernel_t proc_net_t:dir list_dir_perms;
allow kernel_t proc_net_t:file read_file_perms;
2006-05-26 19:04:18 +00:00
allow kernel_t proc_mdstat_t:file read_file_perms;
2006-05-26 19:04:18 +00:00
allow kernel_t proc_kcore_t:file getattr;
2006-05-26 19:04:18 +00:00
allow kernel_t proc_kmsg_t:file getattr;
2006-05-26 19:04:18 +00:00
allow kernel_t sysctl_kernel_t:dir list_dir_perms;
allow kernel_t sysctl_kernel_t:file read_file_perms;
allow kernel_t sysctl_t:dir list_dir_perms;
2006-05-26 19:04:18 +00:00
# Other possible mount points for the root fs are in files
allow kernel_t unlabeled_t:dir mounton;
# Kernel-generated traffic e.g., TCP resets on
# connections with invalidated labels:
allow kernel_t unlabeled_t:packet send;
2005-09-15 15:34:31 +00:00
# Allow unlabeled network traffic
allow unlabeled_t unlabeled_t:packet { forward_in forward_out };
corenet_in_generic_if(unlabeled_t)
corenet_in_generic_node(unlabeled_t)
corenet_all_recvfrom_unlabeled(kernel_t)
corenet_all_recvfrom_netlabel(kernel_t)
2005-06-09 21:07:58 +00:00
# Kernel-generated traffic e.g., ICMP replies:
corenet_raw_sendrecv_all_if(kernel_t)
corenet_raw_sendrecv_all_nodes(kernel_t)
2006-01-06 22:51:40 +00:00
corenet_raw_send_generic_if(kernel_t)
2005-06-09 21:07:58 +00:00
# Kernel-generated traffic e.g., TCP resets:
2005-06-10 01:01:13 +00:00
corenet_tcp_sendrecv_all_if(kernel_t)
corenet_tcp_sendrecv_all_nodes(kernel_t)
2006-01-06 22:51:40 +00:00
corenet_raw_send_generic_node(kernel_t)
corenet_send_all_packets(kernel_t)
2005-06-09 21:07:58 +00:00
2005-09-15 15:34:31 +00:00
dev_read_sysfs(kernel_t)
dev_search_usbfs(kernel_t)
2005-06-09 21:07:58 +00:00
# Mount root file system. Used when loading a policy
# from initrd, then mounting the root filesystem
fs_mount_all_fs(kernel_t)
2008-06-07 13:53:29 +00:00
fs_unmount_all_fs(kernel_t)
2005-06-09 21:07:58 +00:00
2005-09-15 15:34:31 +00:00
selinux_load_policy(kernel_t)
term_use_console(kernel_t)
2005-06-13 17:35:46 +00:00
corecmd_exec_shell(kernel_t)
2007-03-23 23:24:59 +00:00
corecmd_list_bin(kernel_t)
2005-06-09 21:07:58 +00:00
# /proc/sys/kernel/modprobe is set to /bin/true if not using modules.
2005-06-13 17:35:46 +00:00
corecmd_exec_bin(kernel_t)
2005-06-09 21:07:58 +00:00
domain_signal_all_domains(kernel_t)
2005-09-15 15:34:31 +00:00
domain_search_all_domains_state(kernel_t)
2005-06-09 20:50:17 +00:00
2005-06-13 17:35:46 +00:00
files_list_root(kernel_t)
2005-09-12 15:17:39 +00:00
files_list_etc(kernel_t)
2005-06-13 17:35:46 +00:00
files_list_home(kernel_t)
files_read_usr_files(kernel_t)
2005-06-09 20:50:17 +00:00
mcs_process_set_categories(kernel_t)
2005-09-26 20:26:32 +00:00
mls_process_read_up(kernel_t)
mls_process_write_down(kernel_t)
2008-06-07 13:53:29 +00:00
mls_file_write_all_levels(kernel_t)
mls_file_read_all_levels(kernel_t)
2005-09-26 20:26:32 +00:00
ifdef(`distro_redhat',`
# Bugzilla 222337
fs_rw_tmpfs_chr_files(kernel_t)
')
optional_policy(`
hotplug_search_config(kernel_t)
')
optional_policy(`
init_sigchld(kernel_t)
')
optional_policy(`
libs_use_ld_so(kernel_t)
libs_use_shared_libs(kernel_t)
')
optional_policy(`
logging_send_syslog_msg(kernel_t)
')
optional_policy(`
2005-10-24 14:15:29 +00:00
nis_use_ypbind(kernel_t)
')
optional_policy(`
2008-12-03 19:16:20 +00:00
# nfs kernel server needs kernel UDP access. It is less risky and painful
2005-10-24 01:53:13 +00:00
# to just give it everything.
allow kernel_t self:tcp_socket create_stream_socket_perms;
2006-04-24 14:52:01 +00:00
allow kernel_t self:udp_socket create_socket_perms;
2005-10-24 01:53:13 +00:00
# nfs kernel server needs kernel UDP access. It is less risky and painful
# to just give it everything.
corenet_udp_sendrecv_generic_if(kernel_t)
corenet_udp_sendrecv_generic_node(kernel_t)
2005-10-24 01:53:13 +00:00
corenet_udp_sendrecv_all_ports(kernel_t)
corenet_udp_bind_generic_node(kernel_t)
2006-05-26 20:29:51 +00:00
corenet_sendrecv_portmap_client_packets(kernel_t)
corenet_sendrecv_generic_server_packets(kernel_t)
2005-10-24 01:53:13 +00:00
fs_getattr_xattr_fs(kernel_t)
2005-10-24 01:53:13 +00:00
auth_dontaudit_getattr_shadow(kernel_t)
sysnet_read_config(kernel_t)
rpc_manage_nfs_ro_content(kernel_t)
rpc_manage_nfs_rw_content(kernel_t)
rpc_udp_rw_nfs_sockets(kernel_t)
tunable_policy(`nfs_export_all_ro',`
fs_getattr_noxattr_fs(kernel_t)
fs_list_noxattr_fs(kernel_t)
fs_read_noxattr_fs_files(kernel_t)
fs_read_noxattr_fs_symlinks(kernel_t)
auth_read_all_dirs_except_shadow(kernel_t)
auth_read_all_files_except_shadow(kernel_t)
auth_read_all_symlinks_except_shadow(kernel_t)
2005-10-24 01:53:13 +00:00
')
tunable_policy(`nfs_export_all_rw',`
fs_getattr_noxattr_fs(kernel_t)
fs_list_noxattr_fs(kernel_t)
fs_read_noxattr_fs_files(kernel_t)
fs_read_noxattr_fs_symlinks(kernel_t)
2005-10-24 01:53:13 +00:00
auth_manage_all_files_except_shadow(kernel_t)
2005-10-24 01:53:13 +00:00
')
')
optional_policy(`
seutil_read_config(kernel_t)
2006-02-02 21:08:12 +00:00
seutil_read_bin_policy(kernel_t)
')
optional_policy(`
unconfined_domain(kernel_t)
')
2005-06-09 20:50:17 +00:00
########################################
#
# Unlabeled process local policy
#
optional_policy(`
# If you load a new policy that removes active domains, processes can
# get stuck if you do not allow unlabeled processes to signal init.
# If you load an incompatible policy, you should probably reboot,
# since you may have compromised system security.
init_sigchld(unlabeled_t)
')
########################################
#
# Rules for unconfined acccess to this module
#
allow kern_unconfined proc_type:{ dir file lnk_file } *;
2008-04-04 17:08:34 +00:00
allow kern_unconfined sysctl_type:{ dir file } *;
allow kern_unconfined kernel_t:system *;
allow kern_unconfined unlabeled_t:dir_file_class_set *;
allow kern_unconfined unlabeled_t:filesystem *;
allow kern_unconfined unlabeled_t:association *;
allow kern_unconfined unlabeled_t:packet *;
allow kern_unconfined unlabeled_t:process ~{ transition dyntransition execmem execstack execheap };