rpms
/
selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

add authlogin interface to abstract common login program perms

This commit is contained in:
Chris PeBenito 2006-07-31 22:26:59 +00:00
parent 46551033aa
commit 4b3b46d7ef
8 changed files with 67 additions and 137 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
Changelog
View File

@ -1,3 +1,4 @@
- Add authlogin interface to abstract common access for login programs.
- Remove setbool auditallow, except for RHEL4.
- Change eventpollfs to task SID labeling.
- Add key support from Michael LeMay.

35
policy/modules/services/remotelogin.te
View File

@ -1,5 +1,5 @@
policy_module(remotelogin,1.2.1)
policy_module(remotelogin,1.2.2)
########################################
#
@ -7,13 +7,9 @@ policy_module(remotelogin,1.2.1)
#
type remote_login_t;
domain_obj_id_change_exemption(remote_login_t)
domain_subj_id_change_exemption(remote_login_t)
domain_role_change_exemption(remote_login_t)
domain_type(remote_login_t)
domain_interactive_fd(remote_login_t)
auth_login_pgm_domain(remote_login_t)
auth_login_entry_type(remote_login_t)
role system_r types remote_login_t;
type remote_login_tmp_t;
files_tmp_file(remote_login_tmp_t)
@ -49,27 +45,14 @@ kernel_read_kernel_sysctls(remote_login_t)
dev_getattr_mouse_dev(remote_login_t)
dev_setattr_mouse_dev(remote_login_t)
dev_dontaudit_search_sysfs(remote_login_t)
# for SSP/ProPolice
dev_read_urand(remote_login_t)
fs_getattr_xattr_fs(remote_login_t)
fs_search_auto_mountpoints(remote_login_t)
selinux_get_fs_mount(remote_login_t)
selinux_validate_context(remote_login_t)
selinux_compute_access_vector(remote_login_t)
selinux_compute_create_context(remote_login_t)
selinux_compute_relabel_context(remote_login_t)
selinux_compute_user_contexts(remote_login_t)
term_relabel_all_user_ptys(remote_login_t)
auth_domtrans_chk_passwd(remote_login_t)
auth_dontaudit_read_shadow(remote_login_t)
auth_rw_login_records(remote_login_t)
auth_rw_lastlog(remote_login_t)
auth_rw_faillog(remote_login_t)
auth_exec_pam(remote_login_t)
auth_manage_pam_console_data(remote_login_t)
auth_domtrans_pam_console(remote_login_t)
@ -97,26 +80,12 @@ files_read_world_readable_symlinks(remote_login_t)
files_read_world_readable_pipes(remote_login_t)
files_read_world_readable_sockets(remote_login_t)
files_list_mnt(remote_login_t)
files_polyinstantiate_all(remote_login_t)
# for when /var/mail is a sym-link
files_read_var_symlinks(remote_login_t)
init_rw_utmp(remote_login_t)
libs_use_ld_so(remote_login_t)
libs_use_shared_libs(remote_login_t)
logging_send_syslog_msg(remote_login_t)
mls_file_read_up(remote_login_t)
mls_file_write_down(remote_login_t)
mls_file_upgrade(remote_login_t)
mls_file_downgrade(remote_login_t)
mls_process_set_level(remote_login_t)
seutil_read_config(remote_login_t)
seutil_read_default_contexts(remote_login_t)
sysnet_dns_name_resolve(remote_login_t)
miscfiles_read_localization(remote_login_t)

31
policy/modules/services/ssh.if
View File

@ -459,9 +459,7 @@ template(`ssh_per_userdomain_template',`
#
template(`ssh_server_template', `
type $1_t, ssh_server;
domain_type($1_t)
role system_r types $1_t;
auth_login_pgm_domain($1_t)
type $1_devpts_t;
term_login_pty($1_devpts_t)
@ -503,22 +501,9 @@ template(`ssh_server_template', `
corenet_tcp_connect_all_ports($1_t)
corenet_sendrecv_ssh_server_packets($1_t)
dev_read_urand($1_t)
fs_dontaudit_getattr_all_fs($1_t)
selinux_get_fs_mount($1_t)
selinux_validate_context($1_t)
selinux_compute_access_vector($1_t)
selinux_compute_create_context($1_t)
selinux_compute_relabel_context($1_t)
selinux_compute_user_contexts($1_t)
auth_dontaudit_read_shadow($1_t)
auth_domtrans_chk_passwd($1_t)
auth_rw_login_records($1_t)
auth_rw_lastlog($1_t)
auth_append_faillog($1_t)
corecmd_read_bin_symlinks($1_t)
corecmd_getattr_bin_files($1_t)
@ -526,31 +511,17 @@ template(`ssh_server_template', `
corecmd_getattr_bin_files($1_t)
domain_interactive_fd($1_t)
domain_subj_id_change_exemption($1_t)
domain_role_change_exemption($1_t)
domain_obj_id_change_exemption($1_t)
files_read_etc_files($1_t)
files_read_etc_runtime_files($1_t)
init_rw_utmp($1_t)
libs_use_ld_so($1_t)
libs_use_shared_libs($1_t)
logging_search_logs($1_t)
logging_send_syslog_msg($1_t)
miscfiles_read_localization($1_t)
mls_file_read_up($1_t)
mls_file_write_down($1_t)
mls_file_upgrade($1_t)
mls_file_downgrade($1_t)
mls_process_set_level($1_t)
seutil_read_default_contexts($1_t)
sysnet_read_config($1_t)
userdom_dontaudit_relabelfrom_unpriv_users_ptys($1_t)

12
policy/modules/services/ssh.te
View File

@ -1,5 +1,5 @@
policy_module(ssh,1.3.7)
policy_module(ssh,1.3.8)
########################################
#
@ -84,16 +84,6 @@ ifdef(`strict_policy',`
corenet_tcp_bind_xserver_port(sshd_t)
corenet_sendrecv_xserver_server_packets(sshd_t)
mls_file_read_up(sshd_t)
mls_file_write_down(sshd_t)
mls_file_upgrade(sshd_t)
mls_file_downgrade(sshd_t)
mls_process_set_level(sshd_t)
auth_exec_pam(sshd_t)
seutil_read_config(sshd_t)
tunable_policy(`ssh_sysadm_login',`
# Relabel and access ptys created by sshd
# ioctl is necessary for logout() processing for utmp entry and for w to

30
policy/modules/services/xserver.te
View File

@ -1,5 +1,5 @@
policy_module(xserver,1.1.11)
policy_module(xserver,1.1.12)
########################################
#
@ -31,6 +31,7 @@ type xdm_t;
gen_require(`
type xdm_exec_t;
')
auth_login_pgm_domain(xdm_t)
init_domain(xdm_t,xdm_exec_t)
init_daemon_domain(xdm_t,xdm_exec_t)
@ -125,7 +126,6 @@ corenet_sendrecv_all_client_packets(xdm_t)
corenet_dontaudit_tcp_bind_all_ports(xdm_t)
dev_read_rand(xdm_t)
dev_read_urand(xdm_t)
dev_read_sysfs(xdm_t)
dev_getattr_framebuffer_dev(xdm_t)
dev_setattr_framebuffer_dev(xdm_t)
@ -165,13 +165,6 @@ files_create_boot_flag(xdm_t)
fs_getattr_all_fs(xdm_t)
fs_search_auto_mountpoints(xdm_t)
selinux_get_fs_mount(xdm_t)
selinux_validate_context(xdm_t)
selinux_compute_access_vector(xdm_t)
selinux_compute_create_context(xdm_t)
selinux_compute_relabel_context(xdm_t)
selinux_compute_user_contexts(xdm_t)
storage_dontaudit_read_fixed_disk(xdm_t)
storage_dontaudit_write_fixed_disk(xdm_t)
storage_dontaudit_setattr_fixed_disk_dev(xdm_t)
@ -185,14 +178,9 @@ term_dontaudit_use_console(xdm_t)
term_use_unallocated_ttys(xdm_t)
term_setattr_unallocated_ttys(xdm_t)
auth_rw_lastlog(xdm_t)
auth_read_login_records(xdm_t)
auth_append_login_records(xdm_t)
auth_manage_pam_pid(xdm_t)
auth_exec_pam(xdm_t)
auth_manage_pam_console_data(xdm_t)
init_rw_utmp(xdm_t)
init_use_script_ptys(xdm_t)
# Run telinit->init to shutdown.
init_exec(xdm_t)
@ -202,15 +190,11 @@ libs_use_ld_so(xdm_t)
libs_use_shared_libs(xdm_t)
libs_exec_lib_files(xdm_t)
logging_send_syslog_msg(xdm_t)
logging_read_generic_logs(xdm_t)
miscfiles_read_localization(xdm_t)
miscfiles_read_fonts(xdm_t)
seutil_read_config(xdm_t)
seutil_read_default_contexts(xdm_t)
sysnet_read_config(xdm_t)
userdom_dontaudit_use_unpriv_user_fds(xdm_t)
@ -222,11 +206,6 @@ userdom_read_unpriv_users_home_content_files(xdm_t)
userdom_read_all_users_state(xdm_t)
userdom_signal_all_users(xdm_t)
ifdef(`enable_polyinstantiation',`
# xdm_t can polyinstantiate
files_polyinstantiate_all(xdm_t)
')
ifdef(`strict_policy',`
allow xdm_t xdm_lock_t:file create_file_perms;
files_lock_filetrans(xdm_t,xdm_lock_t,file)
@ -283,11 +262,6 @@ ifdef(`strict_policy',`
allow xdm_t xserver_log_t:fifo_file manage_file_perms;
logging_log_filetrans(xdm_t,xserver_log_t,file)
domain_subj_id_change_exemption(xdm_t)
domain_role_change_exemption(xdm_t)
domain_obj_id_change_exemption(xdm_t)
auth_domtrans_chk_passwd(xdm_t)
auth_domtrans_pam_console(xdm_t)
xserver_rw_session_template(xdm,xdm_t,xdm_tmpfs_t)

56
policy/modules/system/authlogin.if
View File

@ -193,6 +193,62 @@ template(`auth_domtrans_user_chk_passwd',`
')
')
########################################
## <summary>
## Make the specified domain used for a login program.
## </summary>
## <param name="domain">
## <summary>
## Domain type used for a login program domain.
## </summary>
## </param>
#
interface(`auth_login_pgm_domain',`
domain_type($1)
domain_subj_id_change_exemption($1)
domain_role_change_exemption($1)
domain_obj_id_change_exemption($1)
role system_r types $1;
# for SSP/ProPolice
dev_read_urand($1)
files_read_etc_files($1)
selinux_get_fs_mount($1)
selinux_validate_context($1)
selinux_compute_access_vector($1)
selinux_compute_create_context($1)
selinux_compute_relabel_context($1)
selinux_compute_user_contexts($1)
mls_file_read_up($1)
mls_file_write_down($1)
mls_file_upgrade($1)
mls_file_downgrade($1)
mls_process_set_level($1)
auth_domtrans_chk_passwd($1)
auth_dontaudit_read_shadow($1)
auth_read_login_records($1)
auth_append_login_records($1)
auth_rw_lastlog($1)
auth_append_faillog($1)
auth_exec_pam($1)
init_rw_utmp($1)
logging_send_syslog_msg($1)
seutil_read_config($1)
seutil_read_default_contexts($1)
ifdef(`enable_polyinstantiation',`
files_polyinstantiate_all($1)
')
')
########################################
## <summary>
## Use the login program as an entry point program.

2
policy/modules/system/authlogin.te
View File

@ -1,5 +1,5 @@
policy_module(authlogin,1.3.9)
policy_module(authlogin,1.3.10)
########################################
#

37
policy/modules/system/locallogin.te
View File

@ -1,5 +1,5 @@
policy_module(locallogin,1.2.4)
policy_module(locallogin,1.2.5)
########################################
#
@ -7,13 +7,9 @@ policy_module(locallogin,1.2.4)
#
type local_login_t;
auth_login_entry_type(local_login_t)
domain_type(local_login_t)
domain_obj_id_change_exemption(local_login_t)
domain_subj_id_change_exemption(local_login_t)
domain_role_change_exemption(local_login_t)
domain_interactive_fd(local_login_t)
role system_r types local_login_t;
auth_login_pgm_domain(local_login_t)
auth_login_entry_type(local_login_t)
type local_login_lock_t;
files_lock_file(local_login_lock_t)
@ -85,18 +81,9 @@ dev_dontaudit_setattr_scanner_dev(local_login_t)
dev_dontaudit_search_sysfs(local_login_t)
dev_dontaudit_getattr_video_dev(local_login_t)
dev_dontaudit_setattr_video_dev(local_login_t)
# for SSP/ProPolice
dev_read_urand(local_login_t)
fs_search_auto_mountpoints(local_login_t)
selinux_get_fs_mount(local_login_t)
selinux_validate_context(local_login_t)
selinux_compute_access_vector(local_login_t)
selinux_compute_create_context(local_login_t)
selinux_compute_relabel_context(local_login_t)
selinux_compute_user_contexts(local_login_t)
storage_dontaudit_getattr_fixed_disk_dev(local_login_t)
storage_dontaudit_setattr_fixed_disk_dev(local_login_t)
storage_dontaudit_getattr_removable_dev(local_login_t)
@ -109,12 +96,8 @@ term_relabel_all_user_ttys(local_login_t)
term_setattr_all_user_ttys(local_login_t)
term_setattr_unallocated_ttys(local_login_t)
auth_domtrans_chk_passwd(local_login_t)
auth_dontaudit_read_shadow(local_login_t)
auth_rw_login_records(local_login_t)
auth_rw_lastlog(local_login_t)
auth_rw_faillog(local_login_t)
auth_exec_pam(local_login_t)
auth_manage_pam_console_data(local_login_t)
auth_domtrans_pam_console(local_login_t)
@ -143,28 +126,14 @@ files_read_world_readable_pipes(local_login_t)
files_read_world_readable_sockets(local_login_t)
# for when /var/mail is a symlink
files_read_var_symlinks(local_login_t)
# Login can polyinstantiate
files_polyinstantiate_all(local_login_t)
init_rw_utmp(local_login_t)
init_dontaudit_use_fds(local_login_t)
libs_use_ld_so(local_login_t)
libs_use_shared_libs(local_login_t)
logging_send_syslog_msg(local_login_t)
miscfiles_read_localization(local_login_t)
mls_file_read_up(local_login_t)
mls_file_write_down(local_login_t)
mls_file_upgrade(local_login_t)
mls_file_downgrade(local_login_t)
mls_process_set_level(local_login_t)
seutil_read_config(local_login_t)
seutil_read_default_contexts(local_login_t)
userdom_spec_domtrans_all_users(local_login_t)
userdom_signal_all_users(local_login_t)
userdom_search_all_users_home_content(local_login_t)