add usbmodules

This commit is contained in:
Chris PeBenito 2006-01-11 18:28:57 +00:00
parent e831e4199e
commit 44f490b556
6 changed files with 116 additions and 1 deletions

View File

@ -16,6 +16,7 @@
slrnpull
smartmon
sysstat
usbmodules
vbetool (Dan Walsh)
* Wed Dec 07 2005 Chris PeBenito <selinux@tresys.com> - 20051207

View File

@ -0,0 +1,9 @@
#
# /sbin
#
/sbin/usbmodules -- gen_context(system_u:object_r:usbmodules_exec_t,s0)
#
# /usr
#
/usr/sbin/usbmodules -- gen_context(system_u:object_r:usbmodules_exec_t,s0)

View File

@ -0,0 +1,49 @@
## <summary>List kernel modules of USB devices</summary>
########################################
## <summary>
## Execute usbmodules in the usbmodules domain.
## </summary>
## <param name="domain">
## Domain allowed access.
## </param>
#
interface(`usbmodules_domtrans',`
gen_require(`
type usbmodules_t, usbmodules_exec_t;
')
domain_auto_trans($1, usbmodules_exec_t, usbmodules_t)
allow $1 usbmodules_t:fd use;
allow usbmodules_t $1:fd use;
allow usbmodules_t $1:fifo_file rw_file_perms;
allow usbmodules_t $1:process sigchld;
')
########################################
## <summary>
## Execute usbmodules in the usbmodules domain, and
## allow the specified role the usbmodules domain,
## and use the caller's terminal.
## </summary>
## <param name="domain">
## The type of the process performing this action.
## </param>
## <param name="role">
## The role to be allowed the usbmodules domain.
## </param>
## <param name="terminal">
## The type of the terminal allow the usbmodules domain to use.
## </param>
#
interface(`usbmodules_run',`
gen_require(`
type usbmodules_t;
')
usbmodules_domtrans($1)
role $2 types usbmodules_t;
allow usbmodules_t $3:chr_file rw_term_perms;
')

View File

@ -0,0 +1,48 @@
policy_module(usbmodules,1.0.0)
########################################
#
# Declarations
#
type usbmodules_t;
type usbmodules_exec_t;
init_system_domain(usbmodules_t,usbmodules_exec_t)
role system_r types usbmodules_t;
########################################
#
# Local policy
#
kernel_list_proc(usbmodules_t)
bootloader_list_kernel_modules(usbmodules_t)
dev_list_usbfs(usbmodules_t)
# allow usb device access
dev_rw_usbfs(usbmodules_t)
files_list_etc(usbmodules_t)
# needs etc_t read access for the hotplug config, maybe should have a new type
files_read_etc_files(usbmodules_t)
term_read_console(usbmodules_t)
term_write_console(usbmodules_t)
init_use_fd(usbmodules_t)
libs_use_ld_so(usbmodules_t)
libs_use_shared_libs(usbmodules_t)
modutils_read_mods_deps(usbmodules_t)
optional_policy(`hotplug',`
hotplug_read_config(usbmodules_t)
')
optional_policy(`logging',`
logging_send_syslog_msg(usbmodules_t)
')

View File

@ -205,3 +205,7 @@ optional_policy(`udev',`
optional_policy(`updfstab',`
updfstab_domtrans(hotplug_t)
')
optional_policy(`usbmodules',`
usbmodules_domtrans(hotplug_t)
')

View File

@ -1,5 +1,5 @@
policy_module(userdomain,1.1.4)
policy_module(userdomain,1.1.5)
gen_require(`
role sysadm_r, staff_r, user_r, secadm_r;
@ -315,6 +315,10 @@ ifdef(`targeted_policy',`
unconfined_domtrans(sysadm_t,sysadm_r,admin_terminal)
')
optional_policy(`usbmodules',`
usbmodules_run(sysadm_t,sysadm_r,admin_terminal)
')
optional_policy(`usermanage',`
usermanage_run_admin_passwd(sysadm_t,sysadm_r,admin_terminal)
usermanage_run_groupadd(sysadm_t,sysadm_r,admin_terminal)