trunk: several MLS enhancements.

Changelog

@@ -1,3 +1,9 @@
+- Add make kernel and init ranged interfaces pass the range transition MLS
+  constraints.  Also remove calls to mls_rangetrans_target() in modules that use
+  the kernel and init interfaces, since its redundant.
+- Add interfaces for all MLS attributes except X object classes.
+- Require all sensitivities and categories for MLS and MCS policies, not just
+  the low and high sensitivity and category.
 - Database userspace object manager classes from KaiGai Kohei.
 - Add third-party interface for Apache CGI.
 - Add getserv and shmemserv nscd permissions.

policy/modules/kernel/kernel.if

@@ -66,6 +66,7 @@ interface(`kernel_ranged_domtrans_to',`
 
 	ifdef(`enable_mls',`
 		range_transition kernel_t $2:process $3;
+		mls_rangetrans_target($1)
 	')
 ')
 

policy/modules/kernel/kernel.te

@@ -1,5 +1,5 @@
 
-policy_module(kernel,1.7.1)
+policy_module(kernel,1.7.2)
 
 ########################################
 #

policy/modules/kernel/mls.if

@@ -14,7 +14,7 @@
 ########################################
 ## <summary>
 ##	Make specified domain MLS trusted
-##	for reading from files at higher levels.
+##	for reading from files up to its clearance.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -23,7 +23,53 @@
 ## </param>
 ## <rolecap/>
 #
+interface(`mls_file_read_to_clearance',`
+	gen_require(`
+		attribute mlsfilereadtoclr;
+	')
+
+	typeattribute $1 mlsfilereadtoclr;
+')
+
+########################################
+## <summary>
+##	Make specified domain MLS trusted
+##	for reading from files at all levels.  (Deprecated)
+## </summary>
+## <desc>
+##	<p>
+##	Make specified domain MLS trusted
+##	for reading from files at all levels.
+##	</p>
+##	<p>
+##	This interface has been deprecated, please use
+##	mls_file_read_all_levels() instead.
+##	</p>
+## </desc>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
 interface(`mls_file_read_up',`
+#	refpolicywarn(`$0($*) has been deprecated, please use mls_file_read_all_levels() instead.')
+	mls_file_read_all_levels($1)
+')
+
+########################################
+## <summary>
+##	Make specified domain MLS trusted
+##	for reading from files at all levels.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`mls_file_read_all_levels',`
 	gen_require(`
 		attribute mlsfileread;
 	')
@@ -34,7 +80,7 @@ interface(`mls_file_read_up',`
 ########################################
 ## <summary>
 ##	Make specified domain MLS trusted
-##	for writing to files at lower levels.
+##	for write to files up to its clearance.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -43,7 +89,53 @@ interface(`mls_file_read_up',`
 ## </param>
 ## <rolecap/>
 #
+interface(`mls_file_write_to_clearance',`
+	gen_require(`
+		attribute mlsfilewritetoclr;
+	')
+
+	typeattribute $1 mlsfilewritetoclr;
+')
+
+########################################
+## <summary>
+##	Make specified domain MLS trusted
+##	for writing to files at all levels.  (Deprecated)
+## </summary>
+## <desc>
+##	<p>
+##	Make specified domain MLS trusted
+##	for writing to files at all levels.
+##	</p>
+##	<p>
+##	This interface has been deprecated, please use
+##	mls_file_write_all_levels() instead.
+##	</p>
+## </desc>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
 interface(`mls_file_write_down',`
+#	refpolicywarn(`$0($*) has been deprecated, please use mls_file_write_all_levels() instead.')
+	mls_file_write_all_levels($1)
+')
+
+########################################
+## <summary>
+##	Make specified domain MLS trusted
+##	for writing to files at all levels.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`mls_file_write_all_levels',`
 	gen_require(`
 		attribute mlsfilewrite;
 	')
@@ -103,6 +195,7 @@ interface(`mls_file_downgrade',`
 ##	Domain allowed access.
 ##	</summary>
 ## </param>
+## <rolecap/>
 #
 interface(`mls_file_write_within_range',`
 	gen_require(`
@@ -122,6 +215,7 @@ interface(`mls_file_write_within_range',`
 ##	Domain allowed access.
 ##	</summary>
 ## </param>
+## <rolecap/>
 #
 interface(`mls_socket_read_all_levels',`
 	gen_require(`
@@ -142,6 +236,7 @@ interface(`mls_socket_read_all_levels',`
 ##	Domain allowed access.
 ##	</summary>
 ## </param>
+## <rolecap/>
 #
 interface(`mls_socket_read_to_clearance',`
 	gen_require(`
@@ -151,6 +246,27 @@ interface(`mls_socket_read_to_clearance',`
 	typeattribute $1 mlsnetreadtoclr;
 ')
 
+########################################
+## <summary>
+##	Make specified domain MLS trusted
+##	for writing to sockets up to
+##	its clearance.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`mls_socket_write_to_clearance',`
+	gen_require(`
+		attribute mlsnetwritetoclr;
+	')
+
+	typeattribute $1 mlsnetwritetoclr;
+')
+
 ########################################
 ## <summary>
 ##	Make specified domain MLS trusted
@@ -161,6 +277,7 @@ interface(`mls_socket_read_to_clearance',`
 ##	Domain allowed access.
 ##	</summary>
 ## </param>
+## <rolecap/>
 #
 interface(`mls_socket_write_all_levels',`
 	gen_require(`
@@ -181,6 +298,7 @@ interface(`mls_socket_write_all_levels',`
 ##	Domain allowed access.
 ##	</summary>
 ## </param>
+## <rolecap/>
 #
 interface(`mls_net_receive_all_levels',`
 	gen_require(`
@@ -190,6 +308,27 @@ interface(`mls_net_receive_all_levels',`
 	typeattribute $1 mlsnetrecvall;
 ')
 
+########################################
+## <summary>
+##	Make specified domain MLS trusted
+##	for reading from System V IPC objects
+##	up to its clearance.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`mls_sysvipc_read_to_clearance',`
+	gen_require(`
+		attribute mlsipcreadtoclr;
+	')
+
+	typeattribute $1 mlsipcreadtoclr;
+')
+
 ########################################
 ## <summary>
 ##	Make specified domain MLS trusted
@@ -201,6 +340,7 @@ interface(`mls_net_receive_all_levels',`
 ##	Domain allowed access.
 ##	</summary>
 ## </param>
+## <rolecap/>
 #
 interface(`mls_sysvipc_read_all_levels',`
 	gen_require(`
@@ -210,6 +350,27 @@ interface(`mls_sysvipc_read_all_levels',`
 	typeattribute $1 mlsipcread;
 ')
 
+########################################
+## <summary>
+##	Make specified domain MLS trusted
+##	for writing to System V IPC objects
+##	up to its clearance.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`mls_sysvipc_write_to_clearance',`
+	gen_require(`
+		attribute mlsipcwritetoclr;
+	')
+
+	typeattribute $1 mlsipcwritetoclr;
+')
+
 ########################################
 ## <summary>
 ##	Make specified domain MLS trusted
@@ -221,6 +382,7 @@ interface(`mls_sysvipc_read_all_levels',`
 ##	Domain allowed access.
 ##	</summary>
 ## </param>
+## <rolecap/>
 #
 interface(`mls_sysvipc_write_all_levels',`
 	gen_require(`
@@ -273,15 +435,63 @@ interface(`mls_rangetrans_target',`
 ########################################
 ## <summary>
 ##	Make specified domain MLS trusted
-##	for reading from processes at higher levels.
+##	for reading from processes up to
+##	its clearance.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
 ##	Domain allowed access.
 ##	</summary>
 ## </param>
+## <rolecap/>
+#
+interface(`mls_process_read_to_clearance',`
+	gen_require(`
+		attribute mlsprocreadtoclr;
+	')
+
+	typeattribute $1 mlsprocreadtoclr;
+')
+
+########################################
+## <summary>
+##	Make specified domain MLS trusted
+##	for reading from processes at all levels.  (Deprecated)
+## </summary>
+## <desc>
+##	<p>
+##	Make specified domain MLS trusted
+##	for reading from processes at all levels.
+##	</p>
+##	<p>
+##	This interface has been deprecated, please use
+##	mls_process_read_all_levels() instead.
+##	</p>
+## </desc>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
 #
 interface(`mls_process_read_up',`
+#	refpolicywarn(`$0($*) has been deprecated, please use mls_process_read_all_levels() instead.')
+	mls_process_read_all_levels($1)
+')
+
+########################################
+## <summary>
+##	Make specified domain MLS trusted
+##	for reading from processes at all levels.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`mls_process_read_all_levels',`
 	gen_require(`
 		attribute mlsprocread;
 	')
@@ -292,15 +502,63 @@ interface(`mls_process_read_up',`
 ########################################
 ## <summary>
 ##	Make specified domain MLS trusted
-##	for writing to processes at lower levels.
+##	for writing to processes up to
+##	its clearance.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
 ##	Domain allowed access.
 ##	</summary>
 ## </param>
+## <rolecap/>
+#
+interface(`mls_process_write_to_clearance',`
+	gen_require(`
+		attribute mlsprocwritetoclr;
+	')
+
+	typeattribute $1 mlsprocwritetoclr;
+')
+
+########################################
+## <summary>
+##	Make specified domain MLS trusted
+##	for writing to processes at all levels.  (Deprecated)
+## </summary>
+## <desc>
+##	<p>
+##	Make specified domain MLS trusted
+##	for writing to processes at all levels.
+##	</p>
+##	<p>
+##	This interface has been deprecated, please use
+##	mls_process_write_all_levels() instead.
+##	</p>
+## </desc>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
 #
 interface(`mls_process_write_down',`
+#	refpolicywarn(`$0($*) has been deprecated, please use mls_process_write_all_levels() instead.')
+	mls_process_write_all_levels($1)
+')
+
+########################################
+## <summary>
+##	Make specified domain MLS trusted
+##	for writing to processes at all levels.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`mls_process_write_all_levels',`
 	gen_require(`
 		attribute mlsprocwrite;
 	')
@@ -319,6 +577,7 @@ interface(`mls_process_write_down',`
 ##	Domain allowed access.
 ##	</summary>
 ## </param>
+## <rolecap/>
 #
 interface(`mls_process_set_level',`
 	gen_require(`
@@ -338,6 +597,7 @@ interface(`mls_process_set_level',`
 ##	Domain allowed access.
 ##	</summary>
 ## </param>
+## <rolecap/>
 #
 interface(`mls_xwin_read_all_levels',`
 	gen_require(`
@@ -357,6 +617,7 @@ interface(`mls_xwin_read_all_levels',`
 ##	Domain allowed access.
 ##	</summary>
 ## </param>
+## <rolecap/>
 #
 interface(`mls_xwin_write_all_levels',`
 	gen_require(`
@@ -376,6 +637,7 @@ interface(`mls_xwin_write_all_levels',`
 ##	Domain allowed access.
 ##	</summary>
 ## </param>
+## <rolecap/>
 #
 interface(`mls_colormap_read_all_levels',`
 	gen_require(`
@@ -395,6 +657,7 @@ interface(`mls_colormap_read_all_levels',`
 ##	Domain allowed access.
 ##	</summary>
 ## </param>
+## <rolecap/>
 #
 interface(`mls_colormap_write_all_levels',`
 	gen_require(`
@@ -444,6 +707,7 @@ interface(`mls_trusted_object',`
 ##	Domain allowed access.
 ##	</summary>
 ## </param>
+## <rolecap/>
 #
 interface(`mls_fd_use_all_levels',`
 	gen_require(`
@@ -464,6 +728,7 @@ interface(`mls_fd_use_all_levels',`
 ##	Domain allowed access.
 ##	</summary>
 ## </param>
+## <rolecap/>
 #
 interface(`mls_fd_share_all_levels',`
 	gen_require(`
@@ -483,6 +748,7 @@ interface(`mls_fd_share_all_levels',`
 ##	Domain allowed access.
 ##	</summary>
 ## </param>
+## <rolecap/>
 #
 interface(`mls_context_translate_all_levels',`
 	gen_require(`
@@ -502,6 +768,7 @@ interface(`mls_context_translate_all_levels',`
 ##      Domain allowed access.
 ##      </summary>
 ## </param>
+## <rolecap/>
 #
 interface(`mls_db_read_all_levels',`
 	gen_require(`
@@ -521,6 +788,7 @@ interface(`mls_db_read_all_levels',`
 ##      Domain allowed access.
 ##      </summary>
 ## </param>
+## <rolecap/>
 #
 interface(`mls_db_write_all_levels',`
 	gen_require(`
@@ -540,6 +808,7 @@ interface(`mls_db_write_all_levels',`
 ##      Domain allowed access.
 ##      </summary>
 ## </param>
+## <rolecap/>
 #
 interface(`mls_db_upgrade',`
 	gen_require(`
@@ -559,6 +828,7 @@ interface(`mls_db_upgrade',`
 ##      Domain allowed access.
 ##      </summary>
 ## </param>
+## <rolecap/>
 #
 interface(`mls_db_downgrade',`
 	gen_require(`

policy/modules/kernel/mls.te

@@ -1,5 +1,5 @@
 
-policy_module(mls,1.5.1)
+policy_module(mls,1.5.2)
 
 ########################################
 #

policy/modules/services/cups.te

@@ -1,5 +1,5 @@
 
-policy_module(cups,1.7.0)
+policy_module(cups,1.7.1)
 
 ########################################
 #
@@ -169,7 +169,6 @@ mls_fd_use_all_levels(cupsd_t)
 mls_file_downgrade(cupsd_t)
 mls_file_write_down(cupsd_t)
 mls_file_read_up(cupsd_t)
-mls_rangetrans_target(cupsd_t)
 mls_socket_write_all_levels(cupsd_t)
 
 term_use_unallocated_ttys(cupsd_t)

policy/modules/system/init.if

@@ -71,6 +71,7 @@ interface(`init_ranged_domain',`
 
 	ifdef(`enable_mls',`
 		range_transition init_t $2:process $3;
+		mls_rangetrans_target($1)
 	')
 ')
 
@@ -171,6 +172,7 @@ interface(`init_ranged_daemon_domain',`
 
 	ifdef(`enable_mls',`
 		range_transition initrc_t $2:process $3;
+		mls_rangetrans_target($1)
 	')
 ')
 

policy/modules/system/init.te

@@ -1,5 +1,5 @@
 
-policy_module(init,1.7.1)
+policy_module(init,1.7.2)
 
 gen_require(`
 	class passwd rootok;
@@ -138,7 +138,10 @@ files_dontaudit_rw_root_chr_files(init_t)
 fs_write_ramfs_sockets(init_t)
 
 mcs_process_set_categories(init_t)
+mcs_killall(init_t)
 
+mls_file_read_up(init_t)
+mls_file_write_down(init_t)
 mls_process_write_down(init_t)
 mls_fd_use_all_levels(init_t)
 
@@ -156,12 +159,6 @@ libs_rw_ld_so_cache(init_t)
 logging_send_syslog_msg(init_t)
 logging_rw_generic_logs(init_t)
 
-mcs_killall(init_t)
-
-mls_file_read_up(init_t)
-mls_file_write_down(init_t)
-mls_rangetrans_target(init_t)
-
 seutil_read_config(init_t)
 
 miscfiles_read_localization(init_t)
@@ -287,6 +284,14 @@ fs_getattr_all_fs(initrc_t)
 
 # initrc_t needs to do a pidof which requires ptrace
 mcs_ptrace_all(initrc_t)
+mcs_killall(initrc_t)
+mcs_process_set_categories(initrc_t)
+
+mls_file_read_up(initrc_t)
+mls_file_write_down(initrc_t)
+mls_process_read_up(initrc_t)
+mls_process_write_down(initrc_t)
+mls_rangetrans_source(initrc_t)
 
 selinux_get_enforce_mode(initrc_t)
 
@@ -363,16 +368,6 @@ miscfiles_read_localization(initrc_t)
 # slapd needs to read cert files from its initscript
 miscfiles_read_certs(initrc_t)
 
-mcs_killall(initrc_t)
-mcs_process_set_categories(initrc_t)
-
-mls_file_read_up(initrc_t)
-mls_file_write_down(initrc_t)
-mls_process_read_up(initrc_t)
-mls_process_write_down(initrc_t)
-mls_rangetrans_source(initrc_t)
-mls_rangetrans_target(initrc_t)
-
 modutils_read_module_config(initrc_t)
 modutils_domtrans_insmod(initrc_t)
 

policy/modules/system/logging.te

@@ -1,5 +1,5 @@
 
-policy_module(logging,1.7.0)
+policy_module(logging,1.7.1)
 
 ########################################
 #
@@ -155,7 +155,6 @@ miscfiles_read_localization(auditd_t)
 
 mls_file_read_up(auditd_t)
 mls_file_write_down(auditd_t) # Need to be able to write to /var/run/ directory
-mls_rangetrans_target(auditd_t)
 mls_fd_use_all_levels(auditd_t)
 
 seutil_dontaudit_read_config(auditd_t)

policy/modules/system/selinuxutil.te

@@ -1,5 +1,5 @@
 
-policy_module(selinuxutil,1.6.1)
+policy_module(selinuxutil,1.6.2)
 
 ifdef(`strict_policy',`
 	gen_require(`
@@ -90,10 +90,9 @@ domain_system_change_exemption(run_init_t)
 role system_r types run_init_t;
 
 type semanage_t;
-domain_interactive_fd(semanage_t)
-
 type semanage_exec_t;
 application_domain(semanage_t,semanage_exec_t)
+domain_interactive_fd(semanage_t)
 role system_r types semanage_t;
 
 type semanage_store_t;
@@ -474,7 +473,6 @@ files_read_usr_files(semanage_t)
 files_list_pids(semanage_t)
 
 mls_file_write_down(semanage_t)
-mls_rangetrans_target(semanage_t)
 mls_file_read_up(semanage_t)
 
 selinux_validate_context(semanage_t)

policy/modules/system/setrans.te

@@ -1,5 +1,5 @@
 
-policy_module(setrans,1.3.0)
+policy_module(setrans,1.3.1)
 
 ########################################
 #
@@ -55,7 +55,6 @@ files_read_etc_runtime_files(setrans_t)
 mls_file_read_up(setrans_t)
 mls_file_write_down(setrans_t)
 mls_net_receive_all_levels(setrans_t)
-mls_rangetrans_target(setrans_t)
 mls_socket_write_all_levels(setrans_t)
 mls_process_read_up(setrans_t)
 mls_socket_read_all_levels(setrans_t)

policy/support/loadable_module.spt

@@ -17,13 +17,13 @@ define(`policy_module',`
 			all_kernel_class_perms
 
 			ifdef(`enable_mcs',`
-				sensitivity s0;
+				decl_sens(0,0)
-				category c0, c`'decr(mcs_num_cats);
+				decl_cats(0,decr(mcs_num_cats))
 			')
 
 			ifdef(`enable_mls',`
-				sensitivity s0, s`'decr(mls_num_sens);
+				decl_sens(0,decr(mls_num_sens))
-				category c0, c`'decr(mls_num_cats);
+				decl_cats(0,decr(mls_num_cats))
 			')
 		}
 	')