rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

patch from dan, Thu, 2007-01-25 at 08:12 -0500

Browse Source
This commit is contained in:
Chris PeBenito 2007-02-16 23:01:42 +00:00
parent 4bd55ebf32
commit 6b19be3360
146 changed files with 2676 additions and 646 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Changelog
View File

@ -1,5 +1,7 @@
- Fix explicit use of httpd_t in openca_domtrans(). - Fix explicit use of httpd_t in openca_domtrans().
- Clean up file context regexes in apache and java, from Eamon Walsh. - Clean up file context regexes in apache and java, from Eamon Walsh.
- Patches from Dan Walsh:
Thu, 25 Jan 2007
* Tue Dec 12 2006 Chris PeBenito <selinux@tresys.com> - 20061212 * Tue Dec 12 2006 Chris PeBenito <selinux@tresys.com> - 20061212
- Add policy patterns support macros. This changes the behavior of - Add policy patterns support macros. This changes the behavior of

1
config/appconfig-strict-mcs/seusers
View File

@ -1,2 +1,3 @@
system_u:system_u:s0-mcs_systemhigh
root:root:s0-mcs_systemhigh root:root:s0-mcs_systemhigh
__default__:user_u:s0 __default__:user_u:s0

1
config/appconfig-strict-mls/seusers
View File

@ -1,2 +1,3 @@
system_u:system_u:s0-mls_systemhigh
root:root:s0-mls_systemhigh root:root:s0-mls_systemhigh
__default__:user_u:s0 __default__:user_u:s0

1
config/appconfig-strict/seusers
View File

@ -1,2 +1,3 @@
system_u:system_u
root:root root:root
__default__:user_u __default__:user_u

88
man/man8/httpd_selinux.8
View File

@ -1,4 +1,12 @@
.TH "httpd_selinux" "8" "17 Jan 2005" "dwalsh@redhat.com" "httpd Selinux Policy documentation" .TH "httpd_selinux" "8" "17 Jan 2005" "dwalsh@redhat.com" "httpd Selinux Policy documentation"
.de EX
.nf
.ft CW
..
.de EE
.ft R
.fi
..
.SH "NAME" .SH "NAME"
httpd_selinux \- Security Enhanced Linux Policy for the httpd daemon httpd_selinux \- Security Enhanced Linux Policy for the httpd daemon
.SH "DESCRIPTION" .SH "DESCRIPTION"
@ -9,38 +17,32 @@ control.
SELinux requires files to have an extended attribute to define the file type. SELinux requires files to have an extended attribute to define the file type.
Policy governs the access daemons have to these files. Policy governs the access daemons have to these files.
SELinux httpd policy is very flexible allowing users to setup their web services in as secure a method as possible. SELinux httpd policy is very flexible allowing users to setup their web services in as secure a method as possible.
.TP .PP
The following file contexts types are defined for httpd: The following file contexts types are defined for httpd:
.br .EX
httpd_sys_content_t httpd_sys_content_t
.br .EE
- Set files with httpd_sys_content_t for content which is available from all httpd scripts and the daemon. - Set files with httpd_sys_content_t for content which is available from all httpd scripts and the daemon.
.br .EX
httpd_sys_script_exec_t httpd_sys_script_exec_t
.br .EE
- Set cgi scripts with httpd_sys_script_exec_t to allow them to run with access to all sys types. - Set cgi scripts with httpd_sys_script_exec_t to allow them to run with access to all sys types.
.br .EX
httpd_sys_script_ro_t httpd_sys_script_ro_t
.br .EE
- Set files with httpd_sys_script_ro_t if you want httpd_sys_script_exec_t scripts to read the data, and disallow other sys scripts from access. - Set files with httpd_sys_script_ro_t if you want httpd_sys_script_exec_t scripts to read the data, and disallow other sys scripts from access.
.br .EX
httpd_sys_script_rw_t httpd_sys_script_rw_t
.br .EE
- Set files with httpd_sys_script_rw_t if you want httpd_sys_script_exec_t scripts to read/write the data, and disallow other non sys scripts from access. - Set files with httpd_sys_script_rw_t if you want httpd_sys_script_exec_t scripts to read/write the data, and disallow other non sys scripts from access.
.br .EX
httpd_sys_script_ra_t httpd_sys_script_ra_t
.br .EE
- Set files with httpd_sys_script_ra_t if you want httpd_sys_script_exec_t scripts to read/append to the file, and disallow other non sys scripts from access. - Set files with httpd_sys_script_ra_t if you want httpd_sys_script_exec_t scripts to read/append to the file, and disallow other non sys scripts from access.
.EX
httpd_unconfined_script_exec_t httpd_unconfined_script_exec_t
.br .EE
- Set cgi scripts with httpd_unconfined_script_exec_t to allow them to run without any SELinux protection. This should only be used for a very complex httpd scripts, after exhausting all other options. It is better to use this script rather than turning off SELinux protection for httpd. - Set cgi scripts with httpd_unconfined_script_exec_t to allow them to run without any SELinux protection. This should only be used for a very complex httpd scripts, after exhausting all other options. It is better to use this script rather than turning off SELinux protection for httpd.
.br
.SH NOTE .SH NOTE
With certain policies you can define addional file contexts based on roles like user or staff. httpd_user_script_exec_t can be defined where it would only have access to "user" contexts. With certain policies you can define addional file contexts based on roles like user or staff. httpd_user_script_exec_t can be defined where it would only have access to "user" contexts.
@ -48,71 +50,81 @@ With certain policies you can define addional file contexts based on roles like
.SH SHARING FILES .SH SHARING FILES
If you want to share files with multiple domains (Apache, FTP, rsync, Samba), you can set a file context of public_content_t and public_content_rw_t. These context allow any of the above domains to read the content. If you want a particular domain to write to the public_content_rw_t domain, you must set the appropriate boolean. allow_DOMAIN_anon_write. So for httpd you would execute: If you want to share files with multiple domains (Apache, FTP, rsync, Samba), you can set a file context of public_content_t and public_content_rw_t. These context allow any of the above domains to read the content. If you want a particular domain to write to the public_content_rw_t domain, you must set the appropriate boolean. allow_DOMAIN_anon_write. So for httpd you would execute:
.EX
setsebool -P allow_httpd_anon_write=1 setsebool -P allow_httpd_anon_write=1
.EE
or or
.EX
setsebool -P allow_httpd_sys_script_anon_write=1 setsebool -P allow_httpd_sys_script_anon_write=1
.EE
.SH BOOLEANS .SH BOOLEANS
SELinux policy is customizable based on least access required. So by SELinux policy is customizable based on least access required. So by
default SElinux prevents certain http scripts from working. httpd policy is extremely flexible and has several booleans that allow you to manipulate the policy and run httpd with the tightest access possible. default SElinux prevents certain http scripts from working. httpd policy is extremely flexible and has several booleans that allow you to manipulate the policy and run httpd with the tightest access possible.
.TP .PP
httpd can be setup to allow cgi scripts to be executed, set httpd_enable_cgi to allow this httpd can be setup to allow cgi scripts to be executed, set httpd_enable_cgi to allow this
.br
.EX
setsebool -P httpd_enable_cgi 1 setsebool -P httpd_enable_cgi 1
.EE
.TP .PP
httpd by default is not allowed to access users home directories. If you want to allow access to users home directories you need to set the httpd_enable_homedirs boolean and change the context of the files that you want people to access off the home dir. httpd by default is not allowed to access users home directories. If you want to allow access to users home directories you need to set the httpd_enable_homedirs boolean and change the context of the files that you want people to access off the home dir.
.br
.EX
setsebool -P httpd_enable_homedirs 1 setsebool -P httpd_enable_homedirs 1
.br
chcon -R -t httpd_sys_content_t ~user/public_html chcon -R -t httpd_sys_content_t ~user/public_html
.EE
.TP .PP
httpd by default is not allowed access to the controling terminal. In most cases this is prefered, because an intruder might be able to use the access to the terminal to gain privileges. But in certain situations httpd needs to prompt for a password to open a certificate file, in these cases, terminal access is required. Set the httpd_tty_comm boolean to allow terminal access. httpd by default is not allowed access to the controling terminal. In most cases this is prefered, because an intruder might be able to use the access to the terminal to gain privileges. But in certain situations httpd needs to prompt for a password to open a certificate file, in these cases, terminal access is required. Set the httpd_tty_comm boolean to allow terminal access.
.br
.EX
setsebool -P httpd_tty_comm 1 setsebool -P httpd_tty_comm 1
.EE
.TP .PP
httpd can be configured to not differentiate file controls based on context, i.e. all files labeled as httpd context can be read/write/execute. Setting this boolean to false allows you to setup the security policy such that one httpd service can not interfere with another. httpd can be configured to not differentiate file controls based on context, i.e. all files labeled as httpd context can be read/write/execute. Setting this boolean to false allows you to setup the security policy such that one httpd service can not interfere with another.
.br
.EX
setsebool -P httpd_unified 0 setsebool -P httpd_unified 0
.EE
.TP .PP
httpd can be configured to turn off internal scripting (PHP). PHP and other httpd can be configured to turn off internal scripting (PHP). PHP and other
loadable modules run under the same context as httpd. Therefore several policy rules allow httpd greater access to the system then is needed if you only use external cgi scripts. loadable modules run under the same context as httpd. Therefore several policy rules allow httpd greater access to the system then is needed if you only use external cgi scripts.
.br
.EX
setsebool -P httpd_builtin_scripting 0 setsebool -P httpd_builtin_scripting 0
.EE
.TP .PP
httpd scripts by default are not allowed to connect out to the network. httpd scripts by default are not allowed to connect out to the network.
This would prevent a hacker from breaking into you httpd server and attacking This would prevent a hacker from breaking into you httpd server and attacking
other machines. If you need scripts to be able to connect you can set the httpd_can_network_connect boolean on. other machines. If you need scripts to be able to connect you can set the httpd_can_network_connect boolean on.
.br
.EX
setsebool -P httpd_can_network_connect 1 setsebool -P httpd_can_network_connect 1
.EE
.TP .PP
You can disable suexec transition, set httpd_suexec_disable_trans deny this You can disable suexec transition, set httpd_suexec_disable_trans deny this
.br
.EX
setsebool -P httpd_suexec_disable_trans 1 setsebool -P httpd_suexec_disable_trans 1
.EE
.TP .PP
You can disable SELinux protection for the httpd daemon by executing: You can disable SELinux protection for the httpd daemon by executing:
.br
.EX
setsebool -P httpd_disable_trans 1 setsebool -P httpd_disable_trans 1
.br
service httpd restart service httpd restart
.EE
.TP .PP
system-config-securitylevel is a GUI tool available to customize SELinux policy settings. system-config-securitylevel is a GUI tool available to customize SELinux policy settings.
.SH AUTHOR .SH AUTHOR
This manual page was written by Dan Walsh <dwalsh@redhat.com>. This manual page was written by Dan Walsh <dwalsh@redhat.com>.

24
man/man8/kerberos_selinux.8
View File

@ -1,4 +1,12 @@
.TH "kerberos_selinux" "8" "17 Jan 2005" "dwalsh@redhat.com" "kerberos Selinux Policy documentation" .TH "kerberos_selinux" "8" "17 Jan 2005" "dwalsh@redhat.com" "kerberos Selinux Policy documentation"
.de EX
.nf
.ft CW
..
.de EE
.ft R
.fi
..
.SH "NAME" .SH "NAME"
kerberos_selinux \- Security Enhanced Linux Policy for Kerberos. kerberos_selinux \- Security Enhanced Linux Policy for Kerberos.
.SH "DESCRIPTION" .SH "DESCRIPTION"
@ -6,23 +14,19 @@ kerberos_selinux \- Security Enhanced Linux Policy for Kerberos.
Security-Enhanced Linux secures the system via flexible mandatory access Security-Enhanced Linux secures the system via flexible mandatory access
control. By default Kerberos access is not allowed, since it requires daemons to be allowed greater access to certain secure files and addtional access to the network. control. By default Kerberos access is not allowed, since it requires daemons to be allowed greater access to certain secure files and addtional access to the network.
.SH BOOLEANS .SH BOOLEANS
.TP .PP
You must set the allow_kerberos boolean to allow your system to work properly in a Kerberos environment. You must set the allow_kerberos boolean to allow your system to work properly in a Kerberos environment.
.TP .EX
setsebool -P allow_kerberos 1 setsebool -P allow_kerberos 1
.TP .EE
If you are running Kerberos daemons kadmind or krb5kdc you can disable the SELinux protection on these daemons by setting the krb5kdc_disable_trans and kadmind_disable_trans booleans. If you are running Kerberos daemons kadmind or krb5kdc you can disable the SELinux protection on these daemons by setting the krb5kdc_disable_trans and kadmind_disable_trans booleans.
.br .EX
setsebool -P krb5kdc_disable_trans 1 setsebool -P krb5kdc_disable_trans 1
.br
service krb5kdc restart service krb5kdc restart
.br
setsebool -P kadmind_disable_trans booleans 1 setsebool -P kadmind_disable_trans booleans 1
.br
service kadmind restart service kadmind restart
.EE
.TP .PP
system-config-securitylevel is a GUI tool available to customize SELinux policy settings. system-config-securitylevel is a GUI tool available to customize SELinux policy settings.
.SH AUTHOR .SH AUTHOR
This manual page was written by Dan Walsh <dwalsh@redhat.com>. This manual page was written by Dan Walsh <dwalsh@redhat.com>.

21
man/man8/named_selinux.8
View File

@ -1,4 +1,12 @@
.TH "named_selinux" "8" "17 Jan 2005" "dwalsh@redhat.com" "named Selinux Policy documentation" .TH "named_selinux" "8" "17 Jan 2005" "dwalsh@redhat.com" "named Selinux Policy documentation"
.de EX
.nf
.ft CW
..
.de EE
.ft R
.fi
..
.SH "NAME" .SH "NAME"
named_selinux \- Security Enhanced Linux Policy for the Internet Name server (named) daemon named_selinux \- Security Enhanced Linux Policy for the Internet Name server (named) daemon
.SH "DESCRIPTION" .SH "DESCRIPTION"
@ -8,17 +16,16 @@ control.
.SH BOOLEANS .SH BOOLEANS
SELinux policy is customizable based on least access required. So by SELinux policy is customizable based on least access required. So by
default SElinux policy does not allow named to write master zone files. If you want to have named update the master zone files you need to set the named_write_master_zones boolean. default SElinux policy does not allow named to write master zone files. If you want to have named update the master zone files you need to set the named_write_master_zones boolean.
.TP .EX
.br
setsebool -P named_write_master_zones 1 setsebool -P named_write_master_zones 1
.EE
.TP .PP
You can disable SELinux protection for the named daemon by executing: You can disable SELinux protection for the named daemon by executing:
.TP .EX
setsebool -P named_disable_trans 1 setsebool -P named_disable_trans 1
.br
service named restart service named restart
.TP .EE
.PP
system-config-securitylevel is a GUI tool available to customize SELinux policy settings. system-config-securitylevel is a GUI tool available to customize SELinux policy settings.
.SH AUTHOR .SH AUTHOR
This manual page was written by Dan Walsh <dwalsh@redhat.com>. This manual page was written by Dan Walsh <dwalsh@redhat.com>.

19
man/man8/rsync_selinux.8
View File

@ -1,4 +1,12 @@
.TH "rsync_selinux" "8" "17 Jan 2005" "dwalsh@redhat.com" "rsync Selinux Policy documentation" .TH "rsync_selinux" "8" "17 Jan 2005" "dwalsh@redhat.com" "rsync Selinux Policy documentation"
.de EX
.nf
.ft CW
..
.de EE
.ft R
.fi
..
.SH "NAME" .SH "NAME"
rsync_selinux \- Security Enhanced Linux Policy for the rsync daemon rsync_selinux \- Security Enhanced Linux Policy for the rsync daemon
.SH "DESCRIPTION" .SH "DESCRIPTION"
@ -14,24 +22,25 @@ would need to label the directory with the chcon tool.
chcon -t public_content_t /var/rsync chcon -t public_content_t /var/rsync
.TP .TP
If you want to make this permanant, i.e. survive a relabel, you must add an entry to the file_contexts.local file. If you want to make this permanant, i.e. survive a relabel, you must add an entry to the file_contexts.local file.
.TP .EX
/etc/selinux/POLICYTYPE/contexts/files/file_contexts.local /etc/selinux/POLICYTYPE/contexts/files/file_contexts.local
.br
/var/rsync(/.*)? system_u:object_r:public_content_t /var/rsync(/.*)? system_u:object_r:public_content_t
.EE
.SH SHARING FILES .SH SHARING FILES
If you want to share files with multiple domains (Apache, FTP, rsync, Samba), you can set a file context of public_content_t and public_content_rw_t. These context allow any of the above domains to read the content. If you want a particular domain to write to the public_content_rw_t domain, you must set the appropriate boolean. allow_DOMAIN_anon_write. So for rsync you would execute: If you want to share files with multiple domains (Apache, FTP, rsync, Samba), you can set a file context of public_content_t and public_content_rw_t. These context allow any of the above domains to read the content. If you want a particular domain to write to the public_content_rw_t domain, you must set the appropriate boolean. allow_DOMAIN_anon_write. So for rsync you would execute:
.EX
setsebool -P allow_rsync_anon_write=1 setsebool -P allow_rsync_anon_write=1
.EE
.SH BOOLEANS .SH BOOLEANS
.TP .TP
You can disable SELinux protection for the rsync daemon by executing: You can disable SELinux protection for the rsync daemon by executing:
.TP .EX
setsebool -P rsync_disable_trans 1 setsebool -P rsync_disable_trans 1
.br
service xinetd restart service xinetd restart
.EE
.TP .TP
system-config-securitylevel is a GUI tool available to customize SELinux policy settings. system-config-securitylevel is a GUI tool available to customize SELinux policy settings.
.SH AUTHOR .SH AUTHOR

43
policy/global_tunables
View File

@ -64,6 +64,14 @@ gen_tunable(allow_execstack,false)
## </desc> ## </desc>
gen_tunable(allow_ftpd_anon_write,false) gen_tunable(allow_ftpd_anon_write,false)
## <desc>
## <p>
## Allow ftp servers to login to local users and
## read/write all files on the system, governed by DAC.
## </p>
## </desc>
gen_tunable(allow_ftpd_full_access,false)
## <desc> ## <desc>
## <p> ## <p>
## Allow ftp servers to use cifs ## Allow ftp servers to use cifs
@ -326,6 +334,13 @@ gen_tunable(samba_share_nfs,false)
## </desc> ## </desc>
gen_tunable(squid_connect_any,false) gen_tunable(squid_connect_any,false)
## <desc>
## <p>
## Allow ssh logins as sysadm_r:sysadm_t
## </p>
## </desc>
gen_tunable(ssh_sysadm_login,false)
## <desc> ## <desc>
## <p> ## <p>
## Configure stunnel to be a standalone daemon or ## Configure stunnel to be a standalone daemon or
@ -348,6 +363,13 @@ gen_tunable(use_nfs_home_dirs,false)
## </desc> ## </desc>
gen_tunable(use_samba_home_dirs,false) gen_tunable(use_samba_home_dirs,false)
## <desc>
## <p>
## Allow xdm logins as sysadm
## </p>
## </desc>
gen_tunable(xdm_sysadm_login,false)
######################################## ########################################
# #
# Strict policy specific # Strict policy specific
@ -496,13 +518,6 @@ gen_tunable(run_ssh_inetd,false)
## </desc> ## </desc>
gen_tunable(spamassassin_can_network,false) gen_tunable(spamassassin_can_network,false)
## <desc>
## <p>
## Allow ssh logins as sysadm_r:sysadm_t
## </p>
## </desc>
gen_tunable(ssh_sysadm_login,false)
## <desc> ## <desc>
## <p> ## <p>
## Allow staff_r users to search the sysadm home ## Allow staff_r users to search the sysadm home
@ -511,6 +526,13 @@ gen_tunable(ssh_sysadm_login,false)
## </desc> ## </desc>
gen_tunable(staff_read_sysadm_file,false) gen_tunable(staff_read_sysadm_file,false)
## <desc>
## <p>
## Use lpd server instead of cups
## </p>
## </desc>
gen_tunable(use_lpd_server,false)
## <desc> ## <desc>
## <p> ## <p>
## Allow regular users direct mouse access ## Allow regular users direct mouse access
@ -565,13 +587,6 @@ gen_tunable(user_ttyfile_stat,false)
## </p> ## </p>
## </desc> ## </desc>
gen_tunable(write_untrusted_content,false) gen_tunable(write_untrusted_content,false)
## <desc>
## <p>
## Allow xdm logins as sysadm
## </p>
## </desc>
gen_tunable(xdm_sysadm_login,false)
') ')
######################################## ########################################

5
policy/modules/admin/bootloader.fc
View File

@ -2,11 +2,6 @@
/etc/lilo\.conf.* -- gen_context(system_u:object_r:bootloader_etc_t,s0) /etc/lilo\.conf.* -- gen_context(system_u:object_r:bootloader_etc_t,s0)
/etc/yaboot\.conf.* -- gen_context(system_u:object_r:bootloader_etc_t,s0) /etc/yaboot\.conf.* -- gen_context(system_u:object_r:bootloader_etc_t,s0)
/etc/mkinitrd/scripts/.* -- gen_context(system_u:object_r:bootloader_exec_t,s0)
/usr/sbin/mkinitrd -- gen_context(system_u:object_r:bootloader_exec_t,s0)
/sbin/grub -- gen_context(system_u:object_r:bootloader_exec_t,s0) /sbin/grub -- gen_context(system_u:object_r:bootloader_exec_t,s0)
/sbin/lilo.* -- gen_context(system_u:object_r:bootloader_exec_t,s0) /sbin/lilo.* -- gen_context(system_u:object_r:bootloader_exec_t,s0)
/sbin/mkinitrd -- gen_context(system_u:object_r:bootloader_exec_t,s0)
/sbin/ybin.* -- gen_context(system_u:object_r:bootloader_exec_t,s0) /sbin/ybin.* -- gen_context(system_u:object_r:bootloader_exec_t,s0)

7
policy/modules/admin/bootloader.te
View File

@ -1,5 +1,5 @@
policy_module(bootloader,1.4.0) policy_module(bootloader,1.4.1)
######################################## ########################################
# #
@ -93,6 +93,8 @@ fs_read_tmpfs_symlinks(bootloader_t)
fs_manage_dos_files(bootloader_t) fs_manage_dos_files(bootloader_t)
mls_file_read_up(bootloader_t) mls_file_read_up(bootloader_t)
mls_file_write_down(bootloader_t)
term_getattr_all_user_ttys(bootloader_t) term_getattr_all_user_ttys(bootloader_t)
term_dontaudit_manage_pty_dirs(bootloader_t) term_dontaudit_manage_pty_dirs(bootloader_t)
@ -163,9 +165,6 @@ ifdef(`distro_redhat',`
# new file system defaults to file_t, granting file_t access is still bad. # new file system defaults to file_t, granting file_t access is still bad.
allow bootloader_t boot_runtime_t:file { read_file_perms unlink }; allow bootloader_t boot_runtime_t:file { read_file_perms unlink };
# mkinitrd mount initrd on bootloader temp dir
files_mountpoint(bootloader_tmp_t)
# new file system defaults to file_t, granting file_t access is still bad. # new file system defaults to file_t, granting file_t access is still bad.
files_manage_isid_type_dirs(bootloader_t) files_manage_isid_type_dirs(bootloader_t)
files_manage_isid_type_files(bootloader_t) files_manage_isid_type_files(bootloader_t)

7
policy/modules/admin/consoletype.te
View File

@ -1,5 +1,5 @@
policy_module(consoletype,1.2.0) policy_module(consoletype,1.2.1)
######################################## ########################################
# #
@ -87,6 +87,11 @@ optional_policy(`
firstboot_rw_pipes(consoletype_t) firstboot_rw_pipes(consoletype_t)
') ')
optional_policy(`
hal_dontaudit_use_fds(consoletype_t)
hal_dontaudit_rw_pipes(consoletype_t)
')
optional_policy(` optional_policy(`
logrotate_dontaudit_use_fds(consoletype_t) logrotate_dontaudit_use_fds(consoletype_t)
') ')

7
policy/modules/admin/logwatch.te
View File

@ -1,5 +1,5 @@
policy_module(logwatch,1.3.0) policy_module(logwatch,1.3.1)
################################# #################################
# #
@ -58,6 +58,7 @@ dev_search_sysfs(logwatch_t)
# Read /proc/PID directories for all domains. # Read /proc/PID directories for all domains.
domain_read_all_domains_state(logwatch_t) domain_read_all_domains_state(logwatch_t)
files_list_var(logwatch_t)
files_read_etc_files(logwatch_t) files_read_etc_files(logwatch_t)
files_read_etc_runtime_files(logwatch_t) files_read_etc_runtime_files(logwatch_t)
files_read_usr_files(logwatch_t) files_read_usr_files(logwatch_t)
@ -112,6 +113,10 @@ optional_policy(`
mta_getattr_spool(logwatch_t) mta_getattr_spool(logwatch_t)
') ')
optional_policy(`
nis_use_ypbind(logwatch_t)
')
optional_policy(` optional_policy(`
nscd_socket_use(logwatch_t) nscd_socket_use(logwatch_t)
') ')

9
policy/modules/admin/prelink.te
View File

@ -1,5 +1,5 @@
policy_module(prelink,1.3.0) policy_module(prelink,1.3.1)
######################################## ########################################
# #
@ -18,6 +18,9 @@ files_type(prelink_cache_t)
type prelink_log_t; type prelink_log_t;
logging_log_file(prelink_log_t) logging_log_file(prelink_log_t)
type prelink_tmp_t;
files_tmp_file(prelink_tmp_t)
######################################## ########################################
# #
# Local policy # Local policy
@ -37,6 +40,10 @@ append_files_pattern(prelink_t,prelink_log_t,prelink_log_t)
read_lnk_files_pattern(prelink_t,prelink_log_t,prelink_log_t) read_lnk_files_pattern(prelink_t,prelink_log_t,prelink_log_t)
logging_log_filetrans(prelink_t, prelink_log_t, file) logging_log_filetrans(prelink_t, prelink_log_t, file)
allow prelink_t prelink_tmp_t:file { manage_file_perms execute };
files_tmp_filetrans(prelink_t, prelink_tmp_t, file)
fs_tmpfs_filetrans(prelink_t, prelink_tmp_t, file)
# prelink misc objects that are not system # prelink misc objects that are not system
# libraries or entrypoints # libraries or entrypoints
allow prelink_t prelink_object:file { manage_file_perms execute relabelto relabelfrom }; allow prelink_t prelink_object:file { manage_file_perms execute relabelto relabelfrom };

17
policy/modules/admin/quota.fc
View File

@ -1,14 +1,19 @@
HOME_ROOT/a?quota\.(user|group) -- gen_context(system_u:object_r:quota_db_t,s0)
/a?quota\.(user|group) -- gen_context(system_u:object_r:quota_db_t,s0)
/boot/a?quota\.(user|group) -- gen_context(system_u:object_r:quota_db_t,s0)
/etc/a?quota\.(user|group) -- gen_context(system_u:object_r:quota_db_t,s0)
/sbin/quota(check|on) -- gen_context(system_u:object_r:quota_exec_t,s0) /sbin/quota(check|on) -- gen_context(system_u:object_r:quota_exec_t,s0)
/var/a?quota\.(user|group) -- gen_context(system_u:object_r:quota_db_t,s0)
/var/lib/quota(/.*)? gen_context(system_u:object_r:quota_flag_t,s0)
/var/spool/a?quota\.(user|group) -- gen_context(system_u:object_r:quota_db_t,s0)
ifdef(`distro_redhat',` ifdef(`distro_redhat',`
/usr/sbin/convertquota -- gen_context(system_u:object_r:quota_exec_t,s0) /usr/sbin/convertquota -- gen_context(system_u:object_r:quota_exec_t,s0)
',` ',`
/sbin/convertquota -- gen_context(system_u:object_r:quota_exec_t,s0) /sbin/convertquota -- gen_context(system_u:object_r:quota_exec_t,s0)
') ')
HOME_ROOT/a?quota\.(user|group) -- gen_context(system_u:object_r:quota_db_t,s0)
/var/a?quota\.(user|group) -- gen_context(system_u:object_r:quota_db_t,s0)
/var/lib/quota(/.*)? gen_context(system_u:object_r:quota_flag_t,s0)

22
policy/modules/admin/quota.te
View File

@ -1,5 +1,5 @@
policy_module(quota,1.1.0) policy_module(quota,1.1.1)
######################################## ########################################
# #
@ -26,7 +26,15 @@ dontaudit quota_t self:capability sys_tty_config;
allow quota_t self:process signal_perms; allow quota_t self:process signal_perms;
# for /quota.* # for /quota.*
allow quota_t quota_db_t:file { read write quotaon }; allow quota_t quota_db_t:file { manage_file_perms quotaon };
files_root_filetrans(quota_t, quota_db_t, file)
files_boot_filetrans(quota_t, quota_db_t, file)
files_etc_filetrans(quota_t, quota_db_t, file)
files_tmp_filetrans(quota_t, quota_db_t, file)
files_home_filetrans(quota_t, quota_db_t, file)
files_usr_filetrans(quota_t, quota_db_t, file)
files_var_filetrans(quota_t, quota_db_t, file)
files_spool_filetrans(quota_t, quota_db_t, file)
kernel_list_proc(quota_t) kernel_list_proc(quota_t)
kernel_read_proc_symlinks(quota_t) kernel_read_proc_symlinks(quota_t)
@ -55,6 +63,7 @@ files_read_all_files(quota_t)
files_read_all_symlinks(quota_t) files_read_all_symlinks(quota_t)
files_getattr_all_pipes(quota_t) files_getattr_all_pipes(quota_t)
files_getattr_all_sockets(quota_t) files_getattr_all_sockets(quota_t)
files_getattr_all_file_type_fs(quota_t)
# Read /etc/mtab. # Read /etc/mtab.
files_read_etc_runtime_files(quota_t) files_read_etc_runtime_files(quota_t)
@ -81,12 +90,3 @@ optional_policy(`
optional_policy(` optional_policy(`
udev_read_db(quota_t) udev_read_db(quota_t)
') ')
ifdef(`TODO',`
# quotacheck creates new quota_db_t files
file_type_auto_trans(quota_t, { root_t home_root_t var_t usr_t src_t var_spool_t }, quota_db_t, file)
allow quota_t file_t:file quotaon;
allow quota_t proc_t:file getattr;
') dnl end TODO

11
policy/modules/admin/rpm.te
View File

@ -1,5 +1,5 @@
policy_module(rpm,1.5.0) policy_module(rpm,1.5.1)
######################################## ########################################
# #
@ -188,11 +188,11 @@ ifdef(`targeted_policy',`
') ')
optional_policy(` optional_policy(`
hal_dbus_chat(rpm_t) cron_system_entry(rpm_t,rpm_exec_t)
') ')
optional_policy(` optional_policy(`
cron_system_entry(rpm_t,rpm_exec_t) hal_dbus_chat(rpm_t)
') ')
optional_policy(` optional_policy(`
@ -368,6 +368,11 @@ optional_policy(`
nis_use_ypbind(rpm_script_t) nis_use_ypbind(rpm_script_t)
') ')
optional_policy(`
tzdata_domtrans(rpm_t)
tzdata_domtrans(rpm_script_t)
')
optional_policy(` optional_policy(`
usermanage_domtrans_groupadd(rpm_script_t) usermanage_domtrans_groupadd(rpm_script_t)
usermanage_domtrans_useradd(rpm_script_t) usermanage_domtrans_useradd(rpm_script_t)

17
policy/modules/admin/su.if
View File

@ -61,6 +61,7 @@ template(`su_restricted_domain_template', `
kernel_read_system_state($1_su_t) kernel_read_system_state($1_su_t)
kernel_read_kernel_sysctls($1_su_t) kernel_read_kernel_sysctls($1_su_t)
kernel_search_key($1_su_t) kernel_search_key($1_su_t)
kernel_link_key($1_su_t)
# for SSP # for SSP
dev_read_urand($1_su_t) dev_read_urand($1_su_t)
@ -160,11 +161,12 @@ template(`su_restricted_domain_template', `
# #
template(`su_per_role_template',` template(`su_per_role_template',`
gen_require(` gen_require(`
attribute su_domain_type;
type su_exec_t; type su_exec_t;
bool secure_mode; bool secure_mode;
') ')
type $1_su_t; type $1_su_t, su_domain_type;
domain_entry_file($1_su_t,su_exec_t) domain_entry_file($1_su_t,su_exec_t)
domain_type($1_su_t) domain_type($1_su_t)
domain_interactive_fd($1_su_t) domain_interactive_fd($1_su_t)
@ -177,6 +179,7 @@ template(`su_per_role_template',`
allow $1_su_t self:process { setexec setsched setrlimit }; allow $1_su_t self:process { setexec setsched setrlimit };
allow $1_su_t self:fifo_file rw_fifo_file_perms; allow $1_su_t self:fifo_file rw_fifo_file_perms;
allow $1_su_t self:netlink_audit_socket { nlmsg_relay create_netlink_socket_perms }; allow $1_su_t self:netlink_audit_socket { nlmsg_relay create_netlink_socket_perms };
allow $1_su_t self:key { search write };
# Transition from the user domain to this domain. # Transition from the user domain to this domain.
domtrans_pattern($2, su_exec_t, $1_su_t) domtrans_pattern($2, su_exec_t, $1_su_t)
@ -189,12 +192,17 @@ template(`su_per_role_template',`
kernel_read_system_state($1_su_t) kernel_read_system_state($1_su_t)
kernel_read_kernel_sysctls($1_su_t) kernel_read_kernel_sysctls($1_su_t)
kernel_search_key($1_su_t)
kernel_link_key($1_su_t)
# for SSP # for SSP
dev_read_urand($1_su_t) dev_read_urand($1_su_t)
fs_search_auto_mountpoints($1_su_t) fs_search_auto_mountpoints($1_su_t)
# needed for pam_rootok
selinux_compute_access_vector($1_su_t)
auth_domtrans_user_chk_passwd($1,$1_su_t) auth_domtrans_user_chk_passwd($1,$1_su_t)
auth_dontaudit_read_shadow($1_su_t) auth_dontaudit_read_shadow($1_su_t)
auth_use_nsswitch($1_su_t) auth_use_nsswitch($1_su_t)
@ -213,6 +221,8 @@ template(`su_per_role_template',`
# Write to utmp. # Write to utmp.
init_rw_utmp($1_su_t) init_rw_utmp($1_su_t)
mls_file_write_down($1_su_t)
libs_use_ld_so($1_su_t) libs_use_ld_so($1_su_t)
libs_use_shared_libs($1_su_t) libs_use_shared_libs($1_su_t)
@ -230,7 +240,6 @@ template(`su_per_role_template',`
selinux_get_fs_mount($1_su_t) selinux_get_fs_mount($1_su_t)
selinux_validate_context($1_su_t) selinux_validate_context($1_su_t)
selinux_compute_access_vector($1_su_t)
selinux_compute_create_context($1_su_t) selinux_compute_create_context($1_su_t)
selinux_compute_relabel_context($1_su_t) selinux_compute_relabel_context($1_su_t)
selinux_compute_user_contexts($1_su_t) selinux_compute_user_contexts($1_su_t)
@ -297,9 +306,7 @@ template(`su_per_role_template',`
# Modify .Xauthority file (via xauth program). # Modify .Xauthority file (via xauth program).
optional_policy(` optional_policy(`
# file_type_auto_trans($1_su_t, staff_home_dir_t, staff_xauth_home_t, file) xserver_user_home_dir_filetrans_user_xauth($1, su_domain_type)
# file_type_auto_trans($1_su_t, user_home_dir_t, user_xauth_home_t, file)
# file_type_auto_trans($1_su_t, sysadm_home_dir_t, sysadm_xauth_home_t, file)
xserver_domtrans_user_xauth($1, $1_su_t) xserver_domtrans_user_xauth($1, $1_su_t)
') ')

4
policy/modules/admin/su.te
View File

@ -1,10 +1,12 @@
policy_module(su,1.5.0) policy_module(su,1.5.1)
######################################## ########################################
# #
# Declarations # Declarations
# #
attribute su_domain_type;
type su_exec_t; type su_exec_t;
corecmd_executable_file(su_exec_t) corecmd_executable_file(su_exec_t)

8
policy/modules/admin/sudo.if
View File

@ -71,6 +71,7 @@ template(`sudo_per_role_template',`
allow $1_sudo_t self:unix_dgram_socket sendto; allow $1_sudo_t self:unix_dgram_socket sendto;
allow $1_sudo_t self:unix_stream_socket connectto; allow $1_sudo_t self:unix_stream_socket connectto;
allow $1_sudo_t self:netlink_audit_socket { create bind write nlmsg_read read }; allow $1_sudo_t self:netlink_audit_socket { create bind write nlmsg_read read };
allow $1_sudo_t self:netlink_route_socket r_netlink_socket_perms;
# Enter this derived domain from the user domain # Enter this derived domain from the user domain
domtrans_pattern($2, sudo_exec_t, $1_sudo_t) domtrans_pattern($2, sudo_exec_t, $1_sudo_t)
@ -83,6 +84,7 @@ template(`sudo_per_role_template',`
kernel_read_kernel_sysctls($1_sudo_t) kernel_read_kernel_sysctls($1_sudo_t)
kernel_read_system_state($1_sudo_t) kernel_read_system_state($1_sudo_t)
kernel_search_key($1_sudo_t)
dev_read_urand($1_sudo_t) dev_read_urand($1_sudo_t)
@ -90,6 +92,8 @@ template(`sudo_per_role_template',`
fs_getattr_xattr_fs($1_sudo_t) fs_getattr_xattr_fs($1_sudo_t)
auth_domtrans_chk_passwd($1_sudo_t) auth_domtrans_chk_passwd($1_sudo_t)
# sudo stores a token in the pam_pid directory
auth_manage_pam_pid($1_sudo_t)
corecmd_getattr_bin_files($1_sudo_t) corecmd_getattr_bin_files($1_sudo_t)
corecmd_read_sbin_symlinks($1_sudo_t) corecmd_read_sbin_symlinks($1_sudo_t)
@ -140,9 +144,5 @@ template(`sudo_per_role_template',`
domain_auto_trans($1_sudo_t, sendmail_exec_t, $1_mail_t) domain_auto_trans($1_sudo_t, sendmail_exec_t, $1_mail_t)
') ')
ifdef(`pam.te', `
allow $1_sudo_t pam_var_run_t:dir manage_dir_perms;
allow $1_sudo_t pam_var_run_t:file manage_file_perms;
')
') dnl end TODO ') dnl end TODO
') ')

2
policy/modules/admin/sudo.te
View File

@ -1,5 +1,5 @@
policy_module(sudo,1.0.0) policy_module(sudo,1.0.1)
######################################## ########################################
# #

1
policy/modules/admin/tzdata.fc Normal file
View File

@ -0,0 +1 @@
/usr/sbin/tzdata-update -- gen_context(system_u:object_r:tzdata_exec_t,s0)

19
policy/modules/admin/tzdata.if Normal file
View File

@ -0,0 +1,19 @@
## <summary>Time zone updater</summary>
########################################
## <summary>
## Execute a domain transition to run tzdata.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed to transition.
## </summary>
## </param>
#
interface(`tzdata_domtrans',`
gen_require(`
type tzdata_t, tzdata_exec_t;
')
domtrans_pattern($1,tzdata_exec_t,tzdata_t)
')

40
policy/modules/admin/tzdata.te Normal file
View File

@ -0,0 +1,40 @@
policy_module(tzdata,1.0.0)
########################################
#
# Declarations
#
type tzdata_t;
type tzdata_exec_t;
init_daemon_domain(tzdata_t, tzdata_exec_t)
########################################
#
# tzdata local policy
#
files_read_etc_files(tzdata_t)
files_search_spool(tzdata_t)
term_dontaudit_list_ptys(tzdata_t)
libs_use_ld_so(tzdata_t)
libs_use_shared_libs(tzdata_t)
locallogin_dontaudit_use_fds(tzdata_t)
miscfiles_read_localization(tzdata_t)
miscfiles_manage_localization(tzdata_t)
miscfiles_etc_filetrans_localization(tzdata_t)
ifdef(`targeted_policy',`
term_dontaudit_use_unallocated_ttys(tzdata_t)
term_dontaudit_use_generic_ptys(tzdata_t)
')
# tzdata looks for /var/spool/postfix/etc/localtime.
optional_policy(`
postfix_search_spool(tzdata_t)
')

13
policy/modules/admin/usermanage.te
View File

@ -1,5 +1,5 @@
policy_module(usermanage,1.5.0) policy_module(usermanage,1.5.1)
######################################## ########################################
# #
@ -112,6 +112,7 @@ domain_use_interactive_fds(chfn_t)
files_manage_etc_files(chfn_t) files_manage_etc_files(chfn_t)
files_read_etc_runtime_files(chfn_t) files_read_etc_runtime_files(chfn_t)
files_dontaudit_search_var(chfn_t) files_dontaudit_search_var(chfn_t)
files_dontaudit_search_home(chfn_t)
# /usr/bin/passwd asks for w access to utmp, but it will operate # /usr/bin/passwd asks for w access to utmp, but it will operate
# correctly without it. Do not audit write denials to utmp. # correctly without it. Do not audit write denials to utmp.
@ -486,6 +487,8 @@ files_read_etc_runtime_files(useradd_t)
fs_search_auto_mountpoints(useradd_t) fs_search_auto_mountpoints(useradd_t)
fs_getattr_xattr_fs(useradd_t) fs_getattr_xattr_fs(useradd_t)
mls_file_upgrade(useradd_t)
# Allow access to context for shadow file # Allow access to context for shadow file
selinux_get_fs_mount(useradd_t) selinux_get_fs_mount(useradd_t)
selinux_validate_context(useradd_t) selinux_validate_context(useradd_t)
@ -517,16 +520,16 @@ miscfiles_read_localization(useradd_t)
seutil_read_config(useradd_t) seutil_read_config(useradd_t)
seutil_read_file_contexts(useradd_t) seutil_read_file_contexts(useradd_t)
seutil_read_default_contexts(useradd_t) seutil_read_default_contexts(useradd_t)
seutil_domtrans_semanage(useradd_t)
seutil_domtrans_restorecon(useradd_t)
userdom_use_unpriv_users_fds(useradd_t) userdom_use_unpriv_users_fds(useradd_t)
# for when /root is the cwd # for when /root is the cwd
userdom_dontaudit_search_sysadm_home_dirs(useradd_t) userdom_dontaudit_search_sysadm_home_dirs(useradd_t)
# Add/remove user home directories # Add/remove user home directories
userdom_home_filetrans_generic_user_home_dir(useradd_t) userdom_home_filetrans_generic_user_home_dir(useradd_t)
userdom_manage_generic_user_home_content_dirs(useradd_t) userdom_manage_all_users_home_content_dirs(useradd_t)
userdom_manage_generic_user_home_content_files(useradd_t) userdom_manage_all_users_home_content_files(useradd_t)
userdom_manage_generic_user_home_dirs(useradd_t)
userdom_manage_staff_home_dirs(useradd_t)
userdom_generic_user_home_dir_filetrans_generic_user_home_content(useradd_t,notdevfile_class_set) userdom_generic_user_home_dir_filetrans_generic_user_home_content(useradd_t,notdevfile_class_set)
mta_manage_spool(useradd_t) mta_manage_spool(useradd_t)

3
policy/modules/admin/vpn.te
View File

@ -1,5 +1,5 @@
policy_module(vpn,1.3.0) policy_module(vpn,1.3.1)
######################################## ########################################
# #
@ -95,6 +95,7 @@ logging_send_syslog_msg(vpnc_t)
miscfiles_read_localization(vpnc_t) miscfiles_read_localization(vpnc_t)
seutil_dontaudit_search_config(vpnc_t) seutil_dontaudit_search_config(vpnc_t)
seutil_use_newrole_fds(vpnc_t)
sysnet_exec_ifconfig(vpnc_t) sysnet_exec_ifconfig(vpnc_t)
sysnet_etc_filetrans_config(vpnc_t) sysnet_etc_filetrans_config(vpnc_t)

4
policy/modules/apps/ethereal.if
View File

@ -34,6 +34,10 @@
# #
template(`ethereal_per_role_template',` template(`ethereal_per_role_template',`
gen_require(`
type ethereal_exec_t;
')
############################## ##############################
# #
# Declarations # Declarations

2
policy/modules/apps/ethereal.te
View File

@ -1,5 +1,5 @@
policy_module(ethereal,1.1.0) policy_module(ethereal,1.1.1)
######################################## ########################################
# #

131
policy/modules/apps/evolution.if
View File

@ -53,7 +53,7 @@ template(`evolution_per_role_template',`
userdom_user_home_content($1,$1_evolution_home_t) userdom_user_home_content($1,$1_evolution_home_t)
type $1_evolution_orbit_tmp_t; type $1_evolution_orbit_tmp_t;
files_type($1_evolution_orbit_tmp_t) files_tmp_file($1_evolution_orbit_tmp_t)
type $1_evolution_alarm_t; type $1_evolution_alarm_t;
domain_type($1_evolution_alarm_t) domain_type($1_evolution_alarm_t)
@ -64,7 +64,7 @@ template(`evolution_per_role_template',`
files_tmpfs_file($1_evolution_alarm_tmpfs_t) files_tmpfs_file($1_evolution_alarm_tmpfs_t)
type $1_evolution_alarm_orbit_tmp_t; type $1_evolution_alarm_orbit_tmp_t;
files_type($1_evolution_alarm_orbit_tmp_t) files_tmp_file($1_evolution_alarm_orbit_tmp_t)
type $1_evolution_exchange_t; type $1_evolution_exchange_t;
domain_type($1_evolution_exchange_t) domain_type($1_evolution_exchange_t)
@ -78,7 +78,7 @@ template(`evolution_per_role_template',`
files_tmp_file($1_evolution_exchange_tmp_t) files_tmp_file($1_evolution_exchange_tmp_t)
type $1_evolution_exchange_orbit_tmp_t; type $1_evolution_exchange_orbit_tmp_t;
files_type($1_evolution_exchange_orbit_tmp_t) files_tmp_file($1_evolution_exchange_orbit_tmp_t)
type $1_evolution_server_t; type $1_evolution_server_t;
domain_type($1_evolution_server_t) domain_type($1_evolution_server_t)
@ -86,7 +86,7 @@ template(`evolution_per_role_template',`
role $3 types $1_evolution_server_t; role $3 types $1_evolution_server_t;
type $1_evolution_server_orbit_tmp_t; type $1_evolution_server_orbit_tmp_t;
files_type($1_evolution_server_orbit_tmp_t) files_tmp_file($1_evolution_server_orbit_tmp_t)
type $1_evolution_webcal_t; type $1_evolution_webcal_t;
domain_type($1_evolution_webcal_t) domain_type($1_evolution_webcal_t)
@ -97,7 +97,7 @@ template(`evolution_per_role_template',`
files_tmpfs_file($1_evolution_webcal_tmpfs_t) files_tmpfs_file($1_evolution_webcal_tmpfs_t)
type $1_orbit_tmp_t; type $1_orbit_tmp_t;
files_type($1_orbit_tmp_t) files_tmp_file($1_orbit_tmp_t)
######################################## ########################################
# #
@ -129,6 +129,10 @@ template(`evolution_per_role_template',`
allow $1_evolution_t $1_evolution_orbit_tmp_t:file manage_file_perms; allow $1_evolution_t $1_evolution_orbit_tmp_t:file manage_file_perms;
files_tmp_filetrans($1_evolution_t,$1_evolution_orbit_tmp_t,{ dir file }) files_tmp_filetrans($1_evolution_t,$1_evolution_orbit_tmp_t,{ dir file })
allow $1_evolution_server_t $1_evolution_orbit_tmp_t:dir manage_dir_perms;
allow $1_evolution_server_t $1_evolution_orbit_tmp_t:file manage_file_perms;
files_tmp_filetrans($1_evolution_server_t,$1_evolution_orbit_tmp_t,{ dir file })
allow $1_evolution_t $1_evolution_server_t:dir search_dir_perms; allow $1_evolution_t $1_evolution_server_t:dir search_dir_perms;
allow $1_evolution_t $1_evolution_server_t:file read; allow $1_evolution_t $1_evolution_server_t:file read;
@ -171,6 +175,8 @@ template(`evolution_per_role_template',`
allow $2 $1_evolution_t:{ file lnk_file } { read getattr }; allow $2 $1_evolution_t:{ file lnk_file } { read getattr };
allow $2 $1_evolution_t:process getattr; allow $2 $1_evolution_t:process getattr;
domain_dontaudit_read_all_domains_state($1_evolution_t)
#FIXME check to see if really needed #FIXME check to see if really needed
kernel_read_kernel_sysctls($1_evolution_t) kernel_read_kernel_sysctls($1_evolution_t)
kernel_read_system_state($1_evolution_t) kernel_read_system_state($1_evolution_t)
@ -238,6 +244,7 @@ template(`evolution_per_role_template',`
userdom_manage_user_tmp_dirs($1,$1_evolution_t) userdom_manage_user_tmp_dirs($1,$1_evolution_t)
userdom_manage_user_tmp_sockets($1,$1_evolution_t) userdom_manage_user_tmp_sockets($1,$1_evolution_t)
userdom_manage_user_tmp_files($1,$1_evolution_t) userdom_manage_user_tmp_files($1,$1_evolution_t)
userdom_use_user_terminals($1, $1_evolution_t)
# FIXME: suppress access to .local/.icons/.themes until properly implemented # FIXME: suppress access to .local/.icons/.themes until properly implemented
# FIXME: suppress access to .gaim/blist.xml (buddy list synchronization) # FIXME: suppress access to .gaim/blist.xml (buddy list synchronization)
# until properly implemented # until properly implemented
@ -246,6 +253,7 @@ template(`evolution_per_role_template',`
mta_read_config($1_evolution_t) mta_read_config($1_evolution_t)
xserver_user_client_template($1,$1_evolution_t,$1_evolution_tmpfs_t) xserver_user_client_template($1,$1_evolution_t,$1_evolution_tmpfs_t)
xserver_read_xdm_tmp_files($1_evolution_t)
tunable_policy(`use_nfs_home_dirs',` tunable_policy(`use_nfs_home_dirs',`
fs_manage_nfs_dirs($1_evolution_t) fs_manage_nfs_dirs($1_evolution_t)
@ -367,7 +375,10 @@ template(`evolution_per_role_template',`
tunable_policy(`write_untrusted_content',` tunable_policy(`write_untrusted_content',`
files_search_home($1_evolution_t) files_search_home($1_evolution_t)
userdom_manage_user_untrusted_content_files($1,$1_evolution_t,{ dir file }) userdom_manage_user_untrusted_content_files($1,$1_evolution_t)
userdom_user_home_dir_filetrans($1,$1_evolution_t,$1_untrusted_content_tmp_t, { file dir })
userdom_user_home_content_filetrans($1,$1_evolution_t,$1_untrusted_content_tmp_t, { file dir })
',` ',`
files_dontaudit_list_home($1_evolution_t) files_dontaudit_list_home($1_evolution_t)
files_dontaudit_list_tmp($1_evolution_t) files_dontaudit_list_tmp($1_evolution_t)
@ -394,6 +405,10 @@ template(`evolution_per_role_template',`
dbus_send_user_bus($1,$1_evolution_t) dbus_send_user_bus($1,$1_evolution_t)
') ')
optional_policy(`
gnome_stream_connect_gconf_template($1, $1_evolution_t)
')
# Encrypt mail # Encrypt mail
optional_policy(` optional_policy(`
gpg_domtrans_user_gpg($1,$1_evolution_t) gpg_domtrans_user_gpg($1,$1_evolution_t)
@ -404,13 +419,18 @@ template(`evolution_per_role_template',`
lpd_domtrans_user_lpr($1,$1_evolution_t) lpd_domtrans_user_lpr($1,$1_evolution_t)
') ')
optional_policy(`
mozilla_read_user_home_files($1, $1_evolution_t)
mozilla_domtrans_user_mozilla($1, $1_evolution_t)
')
# Allow POP/IMAP/SMTP/NNTP/LDAP/IPP(printing) # Allow POP/IMAP/SMTP/NNTP/LDAP/IPP(printing)
optional_policy(` optional_policy(`
nis_use_ypbind($1_evolution_t) nis_use_ypbind($1_evolution_t)
') ')
optional_policy(` optional_policy(`
nscd_socket_use($1_evolution_exchange_t) nscd_socket_use($1_evolution_t)
') ')
### Junk mail filtering (start spamd) ### Junk mail filtering (start spamd)
@ -427,9 +447,6 @@ template(`evolution_per_role_template',`
ifdef(`TODO',` ifdef(`TODO',`
#dbus connect to
allow $1_evolution_t $1_dbusd_t:unix_stream_socket connectto;
# Gnome common stuff # Gnome common stuff
gnome_application($1_evolution, $1) gnome_application($1_evolution, $1)
@ -450,12 +467,6 @@ template(`evolution_per_role_template',`
ifdef(`TODO',` ifdef(`TODO',`
gnome_file_dialog($1_evolution, $1) gnome_file_dialog($1_evolution, $1)
') ')
# Start links in web browser
ifdef(`mozilla', `
corecmd_exec_shell($1_evolution_t)
domain_auto_trans($1_evolution_t, mozilla_exec_t, $1_mozilla_t)
')
') ')
######################################## ########################################
@ -463,7 +474,8 @@ template(`evolution_per_role_template',`
# Evolution alarm local policy # Evolution alarm local policy
# #
allow $1_evolution_alarm_t self:fifo_file { read write }; allow $1_evolution_alarm_t self:process { signal getsched };
allow $1_evolution_alarm_t self:fifo_file rw_fifo_file_perms;
allow $1_evolution_alarm_t $1_evolution_t:unix_stream_socket connectto; allow $1_evolution_alarm_t $1_evolution_t:unix_stream_socket connectto;
allow $1_evolution_alarm_t $1_evolution_orbit_tmp_t:sock_file write; allow $1_evolution_alarm_t $1_evolution_orbit_tmp_t:sock_file write;
@ -489,8 +501,16 @@ template(`evolution_per_role_template',`
domain_auto_trans($2, evolution_alarm_exec_t, $1_evolution_alarm_t) domain_auto_trans($2, evolution_alarm_exec_t, $1_evolution_alarm_t)
allow $1_evolution_alarm_t $2:fd use; allow $1_evolution_alarm_t $2:fd use;
dev_read_urand($1_evolution_alarm_t)
files_read_etc_files($1_evolution_alarm_t)
files_read_usr_files($1_evolution_alarm_t)
fs_search_auto_mountpoints($1_evolution_alarm_t) fs_search_auto_mountpoints($1_evolution_alarm_t)
libs_use_ld_so($1_evolution_alarm_t)
libs_use_shared_libs($1_evolution_alarm_t)
miscfiles_read_localization($1_evolution_alarm_t) miscfiles_read_localization($1_evolution_alarm_t)
# Access evolution home # Access evolution home
@ -511,6 +531,15 @@ template(`evolution_per_role_template',`
fs_manage_cifs_files($1_evolution_alarm_t) fs_manage_cifs_files($1_evolution_alarm_t)
') ')
optional_policy(`
dbus_user_bus_client_template($1,$1_evolution_alarm,$1_evolution_alarm_t)
dbus_send_user_bus($1,$1_evolution_alarm_t)
')
optional_policy(`
gnome_stream_connect_gconf_template($1, $1_evolution_alarm_t)
')
optional_policy(` optional_policy(`
nscd_socket_use($1_evolution_alarm_t) nscd_socket_use($1_evolution_alarm_t)
') ')
@ -525,6 +554,9 @@ template(`evolution_per_role_template',`
# Evolution exchange connector local policy # Evolution exchange connector local policy
# #
allow $1_evolution_exchange_t self:process getsched;
allow $1_evolution_exchange_t self:fifo_file rw_fifo_file_perms;
allow $1_evolution_exchange_t self:tcp_socket create_socket_perms; allow $1_evolution_exchange_t self:tcp_socket create_socket_perms;
allow $1_evolution_exchange_t self:udp_socket create_socket_perms; allow $1_evolution_exchange_t self:udp_socket create_socket_perms;
@ -571,9 +603,19 @@ template(`evolution_per_role_template',`
# Allow netstat # Allow netstat
corecmd_exec_bin($1_evolution_exchange_t) corecmd_exec_bin($1_evolution_exchange_t)
dev_read_urand($1_evolution_exchange_t)
files_read_etc_files($1_evolution_exchange_t)
files_read_usr_files($1_evolution_exchange_t)
# Access evolution home # Access evolution home
fs_search_auto_mountpoints($1_evolution_exchange_t) fs_search_auto_mountpoints($1_evolution_exchange_t)
libs_use_ld_so($1_evolution_exchange_t)
libs_use_shared_libs($1_evolution_exchange_t)
miscfiles_read_localization($1_evolution_exchange_t)
# Access evolution home # Access evolution home
userdom_search_user_home_dirs($1,$1_evolution_exchange_t) userdom_search_user_home_dirs($1,$1_evolution_exchange_t)
# FIXME: suppress access to .local/.icons/.themes until properly implemented # FIXME: suppress access to .local/.icons/.themes until properly implemented
@ -592,6 +634,10 @@ template(`evolution_per_role_template',`
fs_manage_cifs_files($1_evolution_exchange_t) fs_manage_cifs_files($1_evolution_exchange_t)
') ')
optional_policy(`
gnome_stream_connect_gconf_template($1, $1_evolution_exchange_t)
')
optional_policy(` optional_policy(`
nscd_socket_use($1_evolution_exchange_t) nscd_socket_use($1_evolution_exchange_t)
') ')
@ -606,6 +652,8 @@ template(`evolution_per_role_template',`
# Evolution data server local policy # Evolution data server local policy
# #
allow $1_evolution_server_t self:process { getsched signal };
allow $1_evolution_server_t self:fifo_file { read write }; allow $1_evolution_server_t self:fifo_file { read write };
allow $1_evolution_server_t self:unix_stream_socket { accept connectto }; allow $1_evolution_server_t self:unix_stream_socket { accept connectto };
# Talk to ldap (address book), # Talk to ldap (address book),
@ -643,6 +691,8 @@ template(`evolution_per_role_template',`
corenet_sendrecv_http_client_packets($1_evolution_server_t) corenet_sendrecv_http_client_packets($1_evolution_server_t)
corenet_sendrecv_http_cache_client_packets($1_evolution_server_t) corenet_sendrecv_http_cache_client_packets($1_evolution_server_t)
dev_read_urand($1_evolution_server_t)
files_read_etc_files($1_evolution_server_t) files_read_etc_files($1_evolution_server_t)
# Obtain weather data via http (read server name from xml file in /usr) # Obtain weather data via http (read server name from xml file in /usr)
files_read_usr_files($1_evolution_server_t) files_read_usr_files($1_evolution_server_t)
@ -652,6 +702,7 @@ template(`evolution_per_role_template',`
libs_use_ld_so($1_evolution_server_t) libs_use_ld_so($1_evolution_server_t)
libs_use_shared_libs($1_evolution_server_t) libs_use_shared_libs($1_evolution_server_t)
miscfiles_read_localization($1_evolution_server_t)
# Look in /etc/pki # Look in /etc/pki
miscfiles_read_certs($1_evolution_server_t) miscfiles_read_certs($1_evolution_server_t)
@ -681,6 +732,10 @@ template(`evolution_per_role_template',`
fs_manage_cifs_files($1_evolution_server_t) fs_manage_cifs_files($1_evolution_server_t)
') ')
optional_policy(`
gnome_stream_connect_gconf_template($1, $1_evolution_server_t)
')
optional_policy(` optional_policy(`
nscd_socket_use($1_evolution_server_t) nscd_socket_use($1_evolution_server_t)
') ')
@ -813,3 +868,45 @@ template(`evolution_stream_connect',`
allow $2 $1_evolution_t:unix_stream_socket connectto; allow $2 $1_evolution_t:unix_stream_socket connectto;
allow $2 $1_evolution_home_t:dir search; allow $2 $1_evolution_home_t:dir search;
') ')
########################################
## <summary>
## Send and receive messages from
## evolution over dbus.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`evolution_dbus_chat',`
gen_require(`
type $1_evolution_t;
class dbus send_msg;
')
allow $2 $1_evolution_t:dbus send_msg;
allow $1_evolution_t $2:dbus send_msg;
')
########################################
## <summary>
## Send and receive messages from
## evolution_alarm over dbus.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`evolution_alarm_dbus_chat',`
gen_require(`
type $1_evolution_alarm_t;
class dbus send_msg;
')
allow $2 $1_evolution_alarm_t:dbus send_msg;
allow $1_evolution_alarm_t $2:dbus send_msg;
')

2
policy/modules/apps/evolution.te
View File

@ -1,5 +1,5 @@
policy_module(evolution,1.1.0) policy_module(evolution,1.1.1)
######################################## ########################################
# #

4
policy/modules/apps/games.if
View File

@ -34,6 +34,10 @@
# #
template(`games_per_role_template',` template(`games_per_role_template',`
gen_require(`
type games_exec_t, games_data_t;
')
######################################## ########################################
# #
# Declarations # Declarations

2
policy/modules/apps/games.te
View File

@ -1,5 +1,5 @@
policy_module(games,1.1.0) policy_module(games,1.1.1)
######################################## ########################################
# #

2
policy/modules/apps/gnome.fc
View File

@ -1,3 +1,5 @@
HOME_DIR/\.config/gtk-.* gen_context(system_u:object_r:ROLE_gnome_home_t,s0)
/etc/gconf(/.*)? gen_context(system_u:object_r:gconf_etc_t,s0) /etc/gconf(/.*)? gen_context(system_u:object_r:gconf_etc_t,s0)
/usr/libexec/gconfd-2 -- gen_context(system_u:object_r:gconfd_exec_t,s0) /usr/libexec/gconfd-2 -- gen_context(system_u:object_r:gconfd_exec_t,s0)

72
policy/modules/apps/gnome.if
View File

@ -35,19 +35,24 @@
template(`gnome_per_role_template',` template(`gnome_per_role_template',`
gen_require(` gen_require(`
type gconfd_exec_t; type gconfd_exec_t;
attribute gnomedomain;
') ')
############################## ##############################
# #
# Declarations # Declarations
# #
type $1_gconfd_t; type $1_gconfd_t, gnomedomain;
domain_type($1_gconfd_t) domain_type($1_gconfd_t)
domain_entry_file($1_gconfd_t, gconfd_exec_t) domain_entry_file($1_gconfd_t, gconfd_exec_t)
role $3 types $1_gconfd_t; role $3 types $1_gconfd_t;
type $1_gconf_home_t; type $1_gconf_home_t;
files_type($1_gconf_home_t) userdom_user_home_content($1, $1_gconf_home_t)
type $1_gnome_home_t;
userdom_user_home_content($1, $1_gnome_home_t)
type $1_gconf_tmp_t; type $1_gconf_tmp_t;
files_tmp_file($1_gconf_tmp_t) files_tmp_file($1_gconf_tmp_t)
@ -58,6 +63,7 @@ template(`gnome_per_role_template',`
# #
allow $1_gconfd_t self:process getsched; allow $1_gconfd_t self:process getsched;
allow $1_gconfd_t self:fifo_file rw_fifo_file_perms;
manage_dirs_pattern($1_gconfd_t,$1_gconf_home_t,$1_gconf_home_t) manage_dirs_pattern($1_gconfd_t,$1_gconf_home_t,$1_gconf_home_t)
manage_files_pattern($1_gconfd_t,$1_gconf_home_t,$1_gconf_home_t) manage_files_pattern($1_gconfd_t,$1_gconf_home_t,$1_gconf_home_t)
@ -75,6 +81,8 @@ template(`gnome_per_role_template',`
allow $1_gconfd_t gconf_etc_t:dir list_dir_perms; allow $1_gconfd_t gconf_etc_t:dir list_dir_perms;
read_files_pattern($1_gconfd_t,gconf_etc_t,gconf_etc_t) read_files_pattern($1_gconfd_t,gconf_etc_t,gconf_etc_t)
ps_process_pattern($2,$1_gconfd_t)
dev_read_urand($1_gconfd_t) dev_read_urand($1_gconfd_t)
files_read_etc_files($1_gconfd_t) files_read_etc_files($1_gconfd_t)
@ -124,6 +132,64 @@ template(`gnome_stream_connect_gconf_template',`
type $1_gconf_tmp_t; type $1_gconf_tmp_t;
') ')
read_files_pattern($2,$1_gconf_tmp_t,$1_gconf_tmp_t)
allow $2 $1_gconfd_t:unix_stream_socket connectto; allow $2 $1_gconfd_t:unix_stream_socket connectto;
allow $2 $1_gconf_tmp_t:file read_file_perms; ')
########################################
## <summary>
## Run gconfd in the role-specific gconfd domain.
## </summary>
## <desc>
## <p>
## Run gconfd in the role-specfic gconfd domain.
## </p>
## <p>
## This is a templated interface, and should only
## be called from a per-userdomain template.
## </p>
## </desc>
## <param name="userdomain_prefix">
## <summary>
## The prefix of the user domain (e.g., user
## is the prefix for user_t).
## </summary>
## </param>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
template(`gnome_domtrans_user_gconf',`
gen_require(`
type $1_gconfd_t, gconfd_exec_t;
')
domtrans_pattern($2,gconfd_exec_t,$1_gconfd_t)
')
########################################
## <summary>
## manage gnome homedir content (.config)
## </summary>
## <param name="userdomain_prefix">
## <summary>
## The prefix of the user domain (e.g., user
## is the prefix for user_t).
## </summary>
## </param>
## <param name="user_domain">
## <summary>
## The type of the user domain.
## </summary>
## </param>
#
template(`gnome_manage_user_gnome_config',`
gen_require(`
type $1_gnome_home_t;
')
allow $2 $1_gnome_home_t:dir manage_dir_perms;
allow $2 $1_gnome_home_t:file manage_file_perms;
') ')

4
policy/modules/apps/gnome.te
View File

@ -1,11 +1,13 @@
policy_module(gnome,1.0.0) policy_module(gnome,1.0.1)
############################## ##############################
# #
# Declarations # Declarations
# #
attribute gnomedomain;
type gconf_etc_t; type gconf_etc_t;
files_type(gconf_etc_t) files_type(gconf_etc_t)

33
policy/modules/apps/java.if
View File

@ -169,6 +169,39 @@ template(`java_per_role_template',`
') ')
') ')
########################################
## <summary>
## Run java in javaplugin domain.
## </summary>
## <desc>
## <p>
## Run java in javaplugin domain.
## </p>
## <p>
## This is a templated interface, and should only
## be called from a per-userdomain template.
## </p>
## </desc>
## <param name="userdomain_prefix">
## <summary>
## The prefix of the user domain (e.g., user
## is the prefix for user_t).
## </summary>
## </param>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
template(`java_domtrans_user_javaplugin',`
gen_require(`
type $1_javaplugin_t, java_exec_t;
')
domtrans_pattern($2,java_exec_t,$1_javaplugin_t)
')
######################################## ########################################
## <summary> ## <summary>
## Execute the java program in the java domain. ## Execute the java program in the java domain.

8
policy/modules/apps/java.te
View File

@ -1,5 +1,5 @@
policy_module(java,1.3.1) policy_module(java,1.3.2)
######################################## ########################################
# #
@ -18,6 +18,10 @@ init_system_domain(java_t,java_exec_t)
ifdef(`targeted_policy',` ifdef(`targeted_policy',`
# execheap is needed for itanium/BEA jrocket # execheap is needed for itanium/BEA jrocket
allow java_t self:process { execstack execmem execheap }; allow java_t self:process { execstack execmem execheap };
unconfined_domain_noaudit(java_t)
role system_r types java_t; role system_r types java_t;
init_dbus_chat_script(java_t)
unconfined_domain_noaudit(java_t)
unconfined_dbus_chat(java_t)
') ')

17
policy/modules/apps/loadkeys.te
View File

@ -1,5 +1,5 @@
policy_module(loadkeys,1.0.0) policy_module(loadkeys,1.0.1)
######################################## ########################################
# #
@ -15,10 +15,8 @@ ifdef(`targeted_policy',`
# all user domain ttys # all user domain ttys
type loadkeys_t; type loadkeys_t;
domain_type(loadkeys_t)
type loadkeys_exec_t; type loadkeys_exec_t;
domain_entry_file(loadkeys_t,loadkeys_exec_t) init_system_domain(loadkeys_t,loadkeys_exec_t)
') ')
######################################## ########################################
@ -29,15 +27,22 @@ ifdef(`targeted_policy',`
ifdef(`targeted_policy',` ifdef(`targeted_policy',`
# loadkeys domain disabled in targeted policy # loadkeys domain disabled in targeted policy
',` ',`
allow loadkeys_t self:capability { setuid sys_tty_config }; allow loadkeys_t self:capability { dac_override dac_read_search setuid sys_tty_config };
allow loadkeys_t self:fifo_file rw_fifo_file_perms; allow loadkeys_t self:fifo_file rw_fifo_file_perms;
kernel_read_system_state(loadkeys_t) kernel_read_system_state(loadkeys_t)
corecmd_exec_bin(loadkeys_t) corecmd_exec_bin(loadkeys_t)
corecmd_exec_shell(loadkeys_t) corecmd_exec_shell(loadkeys_t)
corecmd_search_sbin(loadkeys_t)
files_dontaudit_read_etc_runtime_files(loadkeys_t) files_read_etc_files(loadkeys_t)
files_read_etc_runtime_files(loadkeys_t)
term_dontaudit_use_console(loadkeys_t)
term_dontaudit_use_unallocated_ttys(loadkeys_t)
init_dontaudit_use_script_ptys(loadkeys_t)
libs_use_ld_so(loadkeys_t) libs_use_ld_so(loadkeys_t)
libs_use_shared_libs(loadkeys_t) libs_use_shared_libs(loadkeys_t)

240
policy/modules/apps/mozilla.if
View File

@ -60,7 +60,7 @@ template(`mozilla_per_role_template',`
allow $1_mozilla_t self:capability { sys_nice setgid setuid }; allow $1_mozilla_t self:capability { sys_nice setgid setuid };
allow $1_mozilla_t self:process { sigkill signal setsched getsched setrlimit }; allow $1_mozilla_t self:process { sigkill signal setsched getsched setrlimit };
allow $1_mozilla_t self:fifo_file { getattr read write }; allow $1_mozilla_t self:fifo_file rw_fifo_file_perms;
allow $1_mozilla_t self:shm { unix_read unix_write read write destroy create }; allow $1_mozilla_t self:shm { unix_read unix_write read write destroy create };
allow $1_mozilla_t self:sem create_sem_perms; allow $1_mozilla_t self:sem create_sem_perms;
allow $1_mozilla_t self:socket create_socket_perms; allow $1_mozilla_t self:socket create_socket_perms;
@ -150,6 +150,7 @@ template(`mozilla_per_role_template',`
dev_write_sound($1_mozilla_t) dev_write_sound($1_mozilla_t)
dev_read_sound($1_mozilla_t) dev_read_sound($1_mozilla_t)
dev_dontaudit_rw_dri($1_mozilla_t) dev_dontaudit_rw_dri($1_mozilla_t)
dev_getattr_sysfs_dirs($1_mozilla_t)
files_read_etc_runtime_files($1_mozilla_t) files_read_etc_runtime_files($1_mozilla_t)
files_read_usr_files($1_mozilla_t) files_read_usr_files($1_mozilla_t)
@ -159,11 +160,14 @@ template(`mozilla_per_role_template',`
# interacting with gstreamer # interacting with gstreamer
files_read_var_files($1_mozilla_t) files_read_var_files($1_mozilla_t)
files_read_var_symlinks($1_mozilla_t) files_read_var_symlinks($1_mozilla_t)
files_dontaudit_getattr_boot_dirs($1_mozilla_t)
fs_search_auto_mountpoints($1_mozilla_t) fs_search_auto_mountpoints($1_mozilla_t)
fs_search_inotifyfs($1_mozilla_t) fs_list_inotifyfs($1_mozilla_t)
fs_rw_tmpfs_files($1_mozilla_t) fs_rw_tmpfs_files($1_mozilla_t)
term_dontaudit_getattr_pty_dirs($1_mozilla_t)
libs_use_ld_so($1_mozilla_t) libs_use_ld_so($1_mozilla_t)
libs_use_lib_files($1_mozilla_t) libs_use_lib_files($1_mozilla_t)
libs_use_shared_libs($1_mozilla_t) libs_use_shared_libs($1_mozilla_t)
@ -185,6 +189,8 @@ template(`mozilla_per_role_template',`
userdom_manage_user_tmp_sockets($1,$1_mozilla_t) userdom_manage_user_tmp_sockets($1,$1_mozilla_t)
xserver_user_client_template($1,$1_mozilla_t,$1_mozilla_tmpfs_t) xserver_user_client_template($1,$1_mozilla_t,$1_mozilla_tmpfs_t)
xserver_dontaudit_read_xdm_tmp_files($1_mozilla_t)
xserver_dontaudit_getattr_xdm_tmp_sockets($1_mozilla_t)
tunable_policy(`allow_execmem',` tunable_policy(`allow_execmem',`
allow $1_mozilla_t self:process { execmem execstack }; allow $1_mozilla_t self:process { execmem execstack };
@ -318,11 +324,13 @@ template(`mozilla_per_role_template',`
tunable_policy(`write_untrusted_content',` tunable_policy(`write_untrusted_content',`
files_search_home($1_mozilla_t) files_search_home($1_mozilla_t)
userdom_manage_user_untrusted_content_tmp_files($1, $1_mozilla_t)
files_tmp_filetrans($1_mozilla_t,$1_untrusted_content_tmp_t,file) files_tmp_filetrans($1_mozilla_t,$1_untrusted_content_tmp_t,file)
files_tmp_filetrans($1_mozilla_t,$1_untrusted_content_tmp_t,dir) files_tmp_filetrans($1_mozilla_t,$1_untrusted_content_tmp_t,dir)
userdom_manage_user_untrusted_content_files($1,$1_mozilla_t,file) userdom_manage_user_untrusted_content_files($1,$1_mozilla_t)
userdom_manage_user_untrusted_content_files($1,$1_mozilla_t,dir) userdom_user_home_dir_filetrans($1,$1_mozilla_t,$1_untrusted_content_tmp_t, { file dir })
userdom_user_home_content_filetrans($1,$1_mozilla_t,$1_untrusted_content_tmp_t, { file dir })
',` ',`
files_dontaudit_list_home($1_mozilla_t) files_dontaudit_list_home($1_mozilla_t)
files_dontaudit_list_tmp($1_mozilla_t) files_dontaudit_list_tmp($1_mozilla_t)
@ -339,18 +347,37 @@ template(`mozilla_per_role_template',`
apache_read_user_content($1,$1_mozilla_t) apache_read_user_content($1,$1_mozilla_t)
') ')
optional_policy(`
automount_dontaudit_getattr_tmp_dirs($1_mozilla_t)
')
optional_policy(` optional_policy(`
cups_read_rw_config($1_mozilla_t) cups_read_rw_config($1_mozilla_t)
cups_dbus_chat($1_mozilla_t)
') ')
optional_policy(` optional_policy(`
dbus_system_bus_client_template($1_mozilla,$1_mozilla_t) dbus_system_bus_client_template($1_mozilla,$1_mozilla_t)
dbus_send_system_bus($1_mozilla_t) dbus_send_system_bus($1_mozilla_t)
ifdef(`TODO',` dbus_user_bus_client_template($1,$1_mozilla,$1_mozilla_t)
dbus_send_user_bus($1,$1_mozilla_t)
')
optional_policy(` optional_policy(`
allow cupsd_t $1_mozilla_t:dbus send_msg; gnome_stream_connect_gconf_template($1,$1_mozilla_t)
') ')
optional_policy(`
java_domtrans_user_javaplugin($1, $1_mozilla_t)
') ')
optional_policy(`
lpd_domtrans_user_lpr($1,$1_mozilla_t)
')
optional_policy(`
mplayer_domtrans_user_mplayer($1, $1_mozilla_t)
mplayer_read_user_home_files($1, $1_mozilla_t)
') ')
optional_policy(` optional_policy(`
@ -358,44 +385,16 @@ template(`mozilla_per_role_template',`
') ')
optional_policy(` optional_policy(`
lpd_domtrans_user_lpr($1,$1_mozilla_t) thunderbird_domtrans_user_thunderbird($1, $1_mozilla_t)
') ')
ifdef(`TODO',` ifdef(`TODO',`
# Java plugin
optional_policy(`
#reh, these are hacked in types due to the use of the java_per_role_template
type $1_mozilla_tmp_t;
files_tmp_file($1_mozilla_tmp_t)
#this looks even more ugly.
type $1_mozilla_tty_device_t;
term_tty($1_mozilla_t,$1_mozilla_tty_device_t)
type $1_mozilla_devpts_t;
term_pty($1_mozilla_devpts_t)
type $1_mozilla_home_dir_t;
userdom_user_home_content($1,$1_mozilla_home_dir_t)
java_per_role_template($1_mozilla,$2,$3)
')
######### Launch mplayer
optional_policy(`
domain_auto_trans($1_mozilla_t, mplayer_exec_t, $1_mplayer_t)
dontaudit $1_mplayer_t $1_mozilla_home_t:file { read write };
dontaudit $1_mplayer_t $1_mozilla_t:unix_stream_socket { read write };
dontaudit $1_mplayer_t $1_mozilla_home_t:file { read write };
')
#NOTE commented out in strict. #NOTE commented out in strict.
######### Launch email client, and make webcal links work ######### Launch email client, and make webcal links work
#ifdef(`evolution.te', ` #ifdef(`evolution.te', `
#domain_auto_trans($1_mozilla_t, evolution_exec_t, $1_evolution_t) #domain_auto_trans($1_mozilla_t, evolution_exec_t, $1_evolution_t)
#domain_auto_trans($1_mozilla_t, evolution_webcal_exec_t, $1_evolution_webcal_t) #domain_auto_trans($1_mozilla_t, evolution_webcal_exec_t, $1_evolution_webcal_t)
#') #')
#NOTE commented out in strict
#ifdef(`thunderbird.te', `
#domain_auto_trans($1_mozilla_t, thunderbird_exec_t, $1_thunderbird_t)
#')
# Macros for mozilla/mozilla (or other browser) domains. # Macros for mozilla/mozilla (or other browser) domains.
# FIXME: Rules were removed to centralize policy in a gnome_app macro # FIXME: Rules were removed to centralize policy in a gnome_app macro
@ -409,3 +408,174 @@ template(`mozilla_per_role_template',`
') ')
') ')
') ')
########################################
## <summary>
## Read mozilla per user homedir
## </summary>
## <desc>
## <p>
## Read mozilla per user homedir
## </p>
## <p>
## This is a templated interface, and should only
## be called from a per-userdomain template.
## </p>
## </desc>
## <param name="userdomain_prefix">
## <summary>
## The prefix of the user domain (e.g., user
## is the prefix for user_t).
## </summary>
## </param>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
template(`mozilla_read_user_home_files',`
gen_require(`
type $1_mozilla_home_t;
')
allow $2 $1_mozilla_home_t:dir list_dir_perms;
allow $2 $1_mozilla_home_t:file read_file_perms;
')
########################################
## <summary>
## write mozilla per user homedir
## </summary>
## <desc>
## <p>
## Read mozilla per user homedir
## </p>
## <p>
## This is a templated interface, and should only
## be called from a per-userdomain template.
## </p>
## </desc>
## <param name="userdomain_prefix">
## <summary>
## The prefix of the user domain (e.g., user
## is the prefix for user_t).
## </summary>
## </param>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
template(`mozilla_write_user_home_files',`
gen_require(`
type $1_mozilla_home_t;
')
allow $2 $1_mozilla_home_t:dir list_dir_perms;
allow $2 $1_mozilla_home_t:file write;
')
########################################
## <summary>
## Run mozilla in user mozilla domain.
## </summary>
## <desc>
## <p>
## Run mozilla in mozilla domain.
## </p>
## <p>
## This is a templated interface, and should only
## be called from a per-userdomain template.
## </p>
## </desc>
## <param name="userdomain_prefix">
## <summary>
## The prefix of the user domain (e.g., user
## is the prefix for user_t).
## </summary>
## </param>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
template(`mozilla_domtrans_user_mozilla',`
gen_require(`
type $1_mozilla_t, mozilla_exec_t;
')
domtrans_pattern($2, mozilla_exec_t,$1_mozilla_t)
')
########################################
## <summary>
## Send and receive messages from
## mozilla over dbus.
## </summary>
## <desc>
## <p>
## Send and receive messages from
## mozilla over dbus.
## </p>
## <p>
## This is a templated interface, and should only
## be called from a per-userdomain template.
## </p>
## </desc>
## <param name="userdomain_prefix">
## <summary>
## The prefix of the user domain (e.g., user
## is the prefix for user_t).
## </summary>
## </param>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
template(`mozilla_dbus_chat',`
gen_require(`
type $1_mozilla_t;
class dbus send_msg;
')
allow $2 $1_mozilla_t:dbus send_msg;
allow $1_mozilla_t $2:dbus send_msg;
')
########################################
## <summary>
## read/write mozilla per user tcp_socket
## </summary>
## <desc>
## <p>
## read/write mozilla per user tcp_socket
## </p>
## <p>
## This is a templated interface, and should only
## be called from a per-userdomain template.
## </p>
## </desc>
## <param name="userdomain_prefix">
## <summary>
## The prefix of the user domain (e.g., user
## is the prefix for user_t).
## </summary>
## </param>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
template(`mozilla_rw_user_tcp_sockets',`
gen_require(`
type $1_mozilla_t;
')
allow $2 $1_mozilla_t:tcp_socket rw_socket_perms;
')

2
policy/modules/apps/mozilla.te
View File

@ -1,5 +1,5 @@
policy_module(mozilla,1.1.0) policy_module(mozilla,1.1.1)
######################################## ########################################
# #

75
policy/modules/apps/mplayer.if
View File

@ -33,6 +33,9 @@
## </param> ## </param>
# #
template(`mplayer_per_role_template',` template(`mplayer_per_role_template',`
gen_require(`
type mencoder_exec_t, mplayer_exec_t;
')
######################################## ########################################
# #
@ -198,6 +201,10 @@ template(`mplayer_per_role_template',`
userdom_dontaudit_read_user_tmp_untrusted_content_files($1,$1_mencoder_t) userdom_dontaudit_read_user_tmp_untrusted_content_files($1,$1_mencoder_t)
') ')
tunable_policy(`write_untrusted_content',`
userdom_manage_user_untrusted_content_files($1, $1_mplayer_t)
')
# Save encoded files # Save encoded files
tunable_policy(`write_untrusted_content && use_nfs_home_dirs',` tunable_policy(`write_untrusted_content && use_nfs_home_dirs',`
files_search_home($1_mencoder_t) files_search_home($1_mencoder_t)
@ -249,6 +256,7 @@ template(`mplayer_per_role_template',`
allow $1_mplayer_t self:process { signal_perms getsched }; allow $1_mplayer_t self:process { signal_perms getsched };
allow $1_mplayer_t self:fifo_file rw_fifo_file_perms; allow $1_mplayer_t self:fifo_file rw_fifo_file_perms;
allow $1_mplayer_t self:sem create_sem_perms;
manage_dirs_pattern($1_mplayer_t,$1_mplayer_home_t,$1_mplayer_home_t) manage_dirs_pattern($1_mplayer_t,$1_mplayer_home_t,$1_mplayer_home_t)
manage_files_pattern($1_mplayer_t,$1_mplayer_home_t,$1_mplayer_home_t) manage_files_pattern($1_mplayer_t,$1_mplayer_home_t,$1_mplayer_home_t)
@ -320,6 +328,7 @@ template(`mplayer_per_role_template',`
fs_dontaudit_getattr_all_fs($1_mplayer_t) fs_dontaudit_getattr_all_fs($1_mplayer_t)
fs_search_auto_mountpoints($1_mplayer_t) fs_search_auto_mountpoints($1_mplayer_t)
fs_list_inotifyfs($1_mplayer_t)
libs_use_ld_so($1_mplayer_t) libs_use_ld_so($1_mplayer_t)
libs_use_shared_libs($1_mplayer_t) libs_use_shared_libs($1_mplayer_t)
@ -435,3 +444,69 @@ template(`mplayer_per_role_template',`
nscd_socket_use($1_mplayer_t) nscd_socket_use($1_mplayer_t)
') ')
') ')
########################################
## <summary>
## Run mplayer in mplayer domain.
## </summary>
## <desc>
## <p>
## Run mplayer in mplayer domain.
## </p>
## <p>
## This is a templated interface, and should only
## be called from a per-userdomain template.
## </p>
## </desc>
## <param name="userdomain_prefix">
## <summary>
## The prefix of the user domain (e.g., user
## is the prefix for user_t).
## </summary>
## </param>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
template(`mplayer_domtrans_user_mplayer',`
gen_require(`
type $1_mplayer_t, mplayer_exec_t;
')
domtrans_pattern($2, mplayer_exec_t,$1_mplayer_t)
')
########################################
## <summary>
## Read mplayer per user homedir
## </summary>
## <desc>
## <p>
## Read mplayer per user homedir
## </p>
## <p>
## This is a templated interface, and should only
## be called from a per-userdomain template.
## </p>
## </desc>
## <param name="userdomain_prefix">
## <summary>
## The prefix of the user domain (e.g., user
## is the prefix for user_t).
## </summary>
## </param>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
template(`mplayer_read_user_home_files',`
gen_require(`
type $1_mplayer_home_t;
')
read_files_pattern($2,$1_mplayer_home_t,$1_mplayer_home_t)
')

2
policy/modules/apps/mplayer.te
View File

@ -1,5 +1,5 @@
policy_module(mplayer,1.1.0) policy_module(mplayer,1.1.1)
######################################## ########################################
# #

20
policy/modules/apps/slocate.if
View File

@ -19,3 +19,23 @@ interface(`slocate_create_append_log',`
create_files_pattern($1,locate_log_t,locate_log_t) create_files_pattern($1,locate_log_t,locate_log_t)
append_files_pattern($1,locate_log_t,locate_log_t) append_files_pattern($1,locate_log_t,locate_log_t)
') ')
########################################
## <summary>
## Read locate lib files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`locate_read_lib_files',`
gen_require(`
type locate_var_lib_t;
')
read_files_pattern($1,locate_var_lib_t,locate_var_lib_t)
allow $1 locate_var_lib_t:dir list_dir_perms;
files_search_var_lib($1)
')

3
policy/modules/apps/slocate.te
View File

@ -1,5 +1,5 @@
policy_module(slocate,1.3.0) policy_module(slocate,1.3.1)
################################# #################################
# #
@ -44,6 +44,7 @@ files_read_etc_files(locate_t)
fs_getattr_xattr_fs(locate_t) fs_getattr_xattr_fs(locate_t)
fs_getattr_rpc_pipefs(locate_t) fs_getattr_rpc_pipefs(locate_t)
fs_getattr_rpc_dirs(locate_t)
libs_use_shared_libs(locate_t) libs_use_shared_libs(locate_t)
libs_use_ld_so(locate_t) libs_use_ld_so(locate_t)

90
policy/modules/apps/thunderbird.if
View File

@ -46,6 +46,7 @@ template(`thunderbird_per_role_template',`
type $1_thunderbird_home_t alias $1_thunderbird_rw_t; type $1_thunderbird_home_t alias $1_thunderbird_rw_t;
files_poly_member($1_thunderbird_home_t) files_poly_member($1_thunderbird_home_t)
userdom_user_home_content($1, $1_thunderbird_home_t)
type $1_thunderbird_tmpfs_t; type $1_thunderbird_tmpfs_t;
files_tmpfs_file($1_thunderbird_tmpfs_t) files_tmpfs_file($1_thunderbird_tmpfs_t)
@ -62,6 +63,7 @@ template(`thunderbird_per_role_template',`
allow $1_thunderbird_t self:unix_stream_socket { create accept connect write getattr read listen bind }; allow $1_thunderbird_t self:unix_stream_socket { create accept connect write getattr read listen bind };
allow $1_thunderbird_t self:tcp_socket create_socket_perms; allow $1_thunderbird_t self:tcp_socket create_socket_perms;
allow $1_thunderbird_t self:shm { read write create destroy unix_read unix_write }; allow $1_thunderbird_t self:shm { read write create destroy unix_read unix_write };
allow $1_thunderbird_t self:netlink_route_socket r_netlink_socket_perms;
# Access ~/.thunderbird # Access ~/.thunderbird
manage_dirs_pattern($1_thunderbird_t,$1_thunderbird_home_t,$1_thunderbird_home_t) manage_dirs_pattern($1_thunderbird_t,$1_thunderbird_home_t,$1_thunderbird_home_t)
@ -89,16 +91,19 @@ template(`thunderbird_per_role_template',`
manage_dirs_pattern($2,$1_thunderbird_home_t,$1_thunderbird_home_t) manage_dirs_pattern($2,$1_thunderbird_home_t,$1_thunderbird_home_t)
manage_files_pattern($2,$1_thunderbird_home_t,$1_thunderbird_home_t) manage_files_pattern($2,$1_thunderbird_home_t,$1_thunderbird_home_t)
manage_lnk_files_pattern($2,$1_thunderbird_home_t,$1_thunderbird_home_t) manage_lnk_files_pattern($2,$1_thunderbird_home_t,$1_thunderbird_home_t)
relabel_dirs_pattern($2,$1_thunderbird_home_t,$1_thunderbird_home_t) relabel_dirs_pattern($2,$1_thunderbird_home_t,$1_thunderbird_home_t)
relabel_files_pattern($2,$1_thunderbird_home_t,$1_thunderbird_home_t) relabel_files_pattern($2,$1_thunderbird_home_t,$1_thunderbird_home_t)
relabel_lnk_files_pattern($2,$1_thunderbird_home_t,$1_thunderbird_home_t) relabel_lnk_files_pattern($2,$1_thunderbird_home_t,$1_thunderbird_home_t)
# Allow netstat # Allow netstat
kernel_read_network_state($1_thunderbird_t) kernel_read_network_state($1_thunderbird_t)
kernel_read_net_sysctls($1_thunderbird_t)
kernel_read_system_state($1_thunderbird_t)
corecmd_exec_shell($1_thunderbird_t) corecmd_exec_shell($1_thunderbird_t)
# Startup shellscript # Startup shellscript
corecmd_exec_bin($1_thunderbird_t) corecmd_search_sbin($1_thunderbird_t)
corenet_non_ipsec_sendrecv($1_thunderbird_t) corenet_non_ipsec_sendrecv($1_thunderbird_t)
corenet_tcp_sendrecv_generic_if($1_thunderbird_t) corenet_tcp_sendrecv_generic_if($1_thunderbird_t)
@ -122,11 +127,22 @@ template(`thunderbird_per_role_template',`
corenet_sendrecv_pop_client_packets($1_thunderbird_t) corenet_sendrecv_pop_client_packets($1_thunderbird_t)
corenet_sendrecv_http_client_packets($1_thunderbird_t) corenet_sendrecv_http_client_packets($1_thunderbird_t)
dev_read_urand($1_thunderbird_t)
dev_dontaudit_search_sysfs($1_thunderbird_t)
files_list_tmp($1_thunderbird_t) files_list_tmp($1_thunderbird_t)
files_read_usr_files($1_thunderbird_t) files_read_usr_files($1_thunderbird_t)
files_read_etc_files($1_thunderbird_t) files_read_etc_files($1_thunderbird_t)
files_read_etc_runtime_files($1_thunderbird_t)
files_read_var_files($1_thunderbird_t)
files_read_var_symlinks($1_thunderbird_t)
files_dontaudit_getattr_all_tmp_files($1_thunderbird_t)
files_dontaudit_getattr_boot_dirs($1_thunderbird_t)
files_dontaudit_getattr_lost_found_dirs($1_thunderbird_t)
files_dontaudit_search_mnt($1_thunderbird_t)
fs_getattr_xattr_fs($1_thunderbird_t) fs_getattr_xattr_fs($1_thunderbird_t)
fs_list_inotifyfs($1_thunderbird_t)
# Access ~/.thunderbird # Access ~/.thunderbird
fs_search_auto_mountpoints($1_thunderbird_t) fs_search_auto_mountpoints($1_thunderbird_t)
@ -134,6 +150,7 @@ template(`thunderbird_per_role_template',`
libs_use_ld_so($1_thunderbird_t) libs_use_ld_so($1_thunderbird_t)
miscfiles_read_fonts($1_thunderbird_t) miscfiles_read_fonts($1_thunderbird_t)
miscfiles_read_localization($1_thunderbird_t)
sysnet_read_config($1_thunderbird_t) sysnet_read_config($1_thunderbird_t)
# Allow DNS # Allow DNS
@ -147,6 +164,8 @@ template(`thunderbird_per_role_template',`
userdom_read_user_home_content_files($1,$1_thunderbird_t) userdom_read_user_home_content_files($1,$1_thunderbird_t)
xserver_user_client_template($1,$1_thunderbird_t,$1_thunderbird_tmpfs_t) xserver_user_client_template($1,$1_thunderbird_t,$1_thunderbird_tmpfs_t)
xserver_read_xdm_tmp_files($1_thunderbird_t)
xserver_dontaudit_getattr_xdm_tmp_sockets($1_thunderbird_t)
# Transition from user type # Transition from user type
tunable_policy(`! disable_thunderbird_trans',` tunable_policy(`! disable_thunderbird_trans',`
@ -200,7 +219,6 @@ template(`thunderbird_per_role_template',`
userdom_read_user_tmp_symlinks($1,$1_thunderbird_t) userdom_read_user_tmp_symlinks($1,$1_thunderbird_t)
userdom_search_user_home_dirs($1,$1_thunderbird_t) userdom_search_user_home_dirs($1,$1_thunderbird_t)
userdom_read_user_home_content_files($1,$1_thunderbird_t) userdom_read_user_home_content_files($1,$1_thunderbird_t)
userdom_read_user_home_content_symlinks($1,$1_thunderbird_t)
ifndef(`enable_mls',` ifndef(`enable_mls',`
fs_search_removable($1_thunderbird_t) fs_search_removable($1_thunderbird_t)
@ -284,9 +302,10 @@ template(`thunderbird_per_role_template',`
files_search_home($1_thunderbird_t) files_search_home($1_thunderbird_t)
files_tmp_filetrans($1_thunderbird_t,$1_untrusted_content_tmp_t,file) files_tmp_filetrans($1_thunderbird_t,$1_untrusted_content_tmp_t,file)
files_tmp_filetrans($1_thunderbird_t,$1_untrusted_content_tmp_t,dir) files_tmp_filetrans($1_thunderbird_t,$1_untrusted_content_tmp_t,dir)
userdom_manage_user_untrusted_content_files($1,$1_thunderbird_t)
userdom_manage_user_untrusted_content_files($1,$1_thunderbird_t,file) userdom_manage_user_untrusted_content_tmp_files($1, $1_thunderbird_t)
userdom_manage_user_untrusted_content_files($1,$1_thunderbird_t,dir) userdom_user_home_dir_filetrans($1,$1_thunderbird_t,$1_untrusted_content_tmp_t, { file dir })
userdom_user_home_content_filetrans($1,$1_thunderbird_t,$1_untrusted_content_tmp_t, { file dir })
',` ',`
files_dontaudit_list_home($1_thunderbird_t) files_dontaudit_list_home($1_thunderbird_t)
files_dontaudit_list_tmp($1_thunderbird_t) files_dontaudit_list_tmp($1_thunderbird_t)
@ -305,44 +324,81 @@ template(`thunderbird_per_role_template',`
') ')
optional_policy(` optional_policy(`
lpd_domtrans_user_lpr($1,$1_thunderbird_t) cups_read_rw_config($1_thunderbird_t)
cups_dbus_chat($1_thunderbird_t)
') ')
optional_policy(` optional_policy(`
cups_read_rw_config($1_thunderbird_t) gnome_stream_connect_gconf_template($1,$1_thunderbird_t)
gnome_domtrans_user_gconf($1, $1_thunderbird_t)
gnome_manage_user_gnome_config($1, $1_thunderbird_t)
') ')
optional_policy(` optional_policy(`
gpg_domtrans_user_gpg($1,$1_thunderbird_t) gpg_domtrans_user_gpg($1,$1_thunderbird_t)
') ')
optional_policy(`
lpd_domtrans_user_lpr($1,$1_thunderbird_t)
')
optional_policy(`
mozilla_read_user_home_files($1, $1_thunderbird_t)
mozilla_domtrans_user_mozilla($1, $1_thunderbird_t)
mozilla_dbus_chat($1, $1_thunderbird_t)
')
optional_policy(` optional_policy(`
nis_use_ypbind($1_thunderbird_t) nis_use_ypbind($1_thunderbird_t)
') ')
optional_policy(`
nscd_socket_use($1_thunderbird_t)
')
ifdef(`TODO',` ifdef(`TODO',`
# FIXME: Rules were removed to centralize policy in a gnome_app macro # FIXME: Rules were removed to centralize policy in a gnome_app macro
# A similar thing might be necessary for mozilla compiled without GNOME # A similar thing might be necessary for mozilla compiled without GNOME
# support (is this possible?). # support (is this possible?).
# Start links in web browser
ifdef(`mozilla.te', `
can_exec($1_thunderbird_t, shell_exec_t)
domain_auto_trans($1_thunderbird_t, mozilla_exec_t, $1_mozilla_t)
')
# GNOME support # GNOME support
optional_policy(` optional_policy(`
gnome_application($1_thunderbird, $1) gnome_application($1_thunderbird, $1)
gnome_file_dialog($1_thunderbird, $1) gnome_file_dialog($1_thunderbird, $1)
allow $1_thunderbird_t $1_gnome_settings_t:file { read write }; allow $1_thunderbird_t $1_gnome_settings_t:file { read write };
') ')
optinal_policy(`
allow $1_t $2_dbusd_t:dbus send_msg;
ifdef(`cups.te', `
allow cupsd_t $1_t:dbus send_msg;
') ')
') ')
########################################
## <summary>
## Run thunderbird in the user thunderbird domain.
## </summary>
## <desc>
## <p>
## Run thunderbird in the user thunderbird domain.
## </p>
## <p>
## This is a templated interface, and should only
## be called from a per-userdomain template.
## </p>
## </desc>
## <param name="userdomain_prefix">
## <summary>
## The prefix of the user domain (e.g., user
## is the prefix for user_t).
## </summary>
## </param>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
template(`thunderbird_domtrans_user_thunderbird',`
gen_require(`
type $1_thunderbird_t, thunderbird_exec_t;
') ')
domtrans_pattern($2, thunderbird_exec_t,$1_thunderbird_t)
') ')

2
policy/modules/apps/thunderbird.te
View File

@ -1,5 +1,5 @@
policy_module(thunderbird,1.1.0) policy_module(thunderbird,1.1.1)
######################################## ########################################
# #

3
policy/modules/apps/tvtime.if
View File

@ -33,6 +33,9 @@
## </param> ## </param>
# #
template(`tvtime_per_role_template',` template(`tvtime_per_role_template',`
gen_require(`
type tvtime_exec_t;
')
######################################## ########################################
# #

2
policy/modules/apps/tvtime.te
View File

@ -1,5 +1,5 @@
policy_module(tvtime,1.1.0) policy_module(tvtime,1.1.1)
######################################## ########################################
# #

4
policy/modules/apps/uml.if
View File

@ -34,6 +34,10 @@
# #
template(`uml_per_role_template',` template(`uml_per_role_template',`
gen_require(`
type uml_ro_t, uml_exec_t;
')
######################################## ########################################
# #
# Declarations # Declarations

2
policy/modules/apps/uml.te
View File

@ -1,5 +1,5 @@
policy_module(uml,1.1.0) policy_module(uml,1.1.1)
######################################## ########################################
# #

20
policy/modules/apps/userhelper.if
View File

@ -49,7 +49,7 @@ template(`userhelper_per_role_template',`
domain_obj_id_change_exemption($1_userhelper_t) domain_obj_id_change_exemption($1_userhelper_t)
domain_interactive_fd($1_userhelper_t) domain_interactive_fd($1_userhelper_t)
domain_subj_id_change_exemption($1_userhelper_t) domain_subj_id_change_exemption($1_userhelper_t)
role system_r types $1_userhelper_t; role $3 types $1_userhelper_t;
######################################## ########################################
# #
@ -287,3 +287,21 @@ template(`userhelper_sigchld_user',`
allow $2 $1_userhelper_t:process sigchld; allow $2 $1_userhelper_t:process sigchld;
') ')
########################################
## <summary>
## Execute the userhelper program in the caller domain.
## </summary>
## <param name="domain">
## <summary>
## The type of the process performing this action.
## </summary>
## </param>
#
interface(`userhelper_exec',`
gen_require(`
type userhelper_exec_t;
')
can_exec($1,userhelper_exec_t)
')

2
policy/modules/apps/userhelper.te
View File

@ -1,5 +1,5 @@
policy_module(userhelper,1.1.0) policy_module(userhelper,1.1.1)
######################################## ########################################
# #

3
policy/modules/apps/vmware.if
View File

@ -33,6 +33,9 @@
## </param> ## </param>
# #
template(`vmware_per_role_template',` template(`vmware_per_role_template',`
gen_require(`
type vmware_exec_t, vmware_sys_conf_t;
')
############################## ##############################
# #

2
policy/modules/apps/vmware.te
View File

@ -1,5 +1,5 @@
policy_module(vmware,1.0.0) policy_module(vmware,1.0.1)
######################################## ########################################
# #

3
policy/modules/apps/webalizer.te
View File

@ -1,5 +1,5 @@
policy_module(webalizer,1.3.0) policy_module(webalizer,1.3.1)
######################################## ########################################
# #
@ -67,6 +67,7 @@ corenet_tcp_sendrecv_all_nodes(webalizer_t)
corenet_tcp_sendrecv_all_ports(webalizer_t) corenet_tcp_sendrecv_all_ports(webalizer_t)
fs_search_auto_mountpoints(webalizer_t) fs_search_auto_mountpoints(webalizer_t)
fs_getattr_xattr_fs(webalizer_t)
files_read_etc_files(webalizer_t) files_read_etc_files(webalizer_t)
files_read_etc_runtime_files(webalizer_t) files_read_etc_runtime_files(webalizer_t)

6
policy/modules/kernel/corecommands.fc
View File

@ -73,6 +73,7 @@ ifdef(`distro_debian',`
ifdef(`targeted_policy',` ifdef(`targeted_policy',`
/etc/X11/prefdm -- gen_context(system_u:object_r:bin_t,s0) /etc/X11/prefdm -- gen_context(system_u:object_r:bin_t,s0)
/usr/games/nethack-3.4.3/nethack -- gen_context(system_u:object_r:bin_t,s0)
') ')
# #
@ -189,7 +190,12 @@ ifdef(`distro_redhat', `
/usr/lib/.*/program(/.*)? gen_context(system_u:object_r:bin_t,s0) /usr/lib/.*/program(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/share/authconfig/authconfig-gtk\.py -- gen_context(system_u:object_r:bin_t,s0) /usr/share/authconfig/authconfig-gtk\.py -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/authconfig/authconfig-tui\.py -- gen_context(system_u:object_r:bin_t,s0) /usr/share/authconfig/authconfig-tui\.py -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/authconfig/authconfig.py -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/cvs/contrib/rcs2log -- gen_context(system_u:object_r:bin_t,s0) /usr/share/cvs/contrib/rcs2log -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/clamav/clamd-gen -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/clamav/freshclam-sleep -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/fedora-usermgmt/wrapper -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/hplip/[^/]* -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/hwbrowser/hwbrowser -- gen_context(system_u:object_r:bin_t,s0) /usr/share/hwbrowser/hwbrowser -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/pwlib/make/ptlib-config -- gen_context(system_u:object_r:bin_t,s0) /usr/share/pwlib/make/ptlib-config -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/pydict/pydict\.py -- gen_context(system_u:object_r:bin_t,s0) /usr/share/pydict/pydict\.py -- gen_context(system_u:object_r:bin_t,s0)

19
policy/modules/kernel/corecommands.if
View File

@ -463,6 +463,25 @@ interface(`corecmd_list_sbin',`
list_dirs_pattern($1,sbin_t,sbin_t) list_dirs_pattern($1,sbin_t,sbin_t)
') ')
########################################
## <summary>
## Do not audit attempts to write
## sbin directories.
## </summary>
## <param name="domain">
## <summary>
## Domain to not audit.
## </summary>
## </param>
#
interface(`corecmd_dontaudit_write_sbin_dirs',`
gen_require(`
type sbin_t;
')
dontaudit $1 sbin_t:dir write;
')
######################################## ########################################
## <summary> ## <summary>
## Get the attributes of sbin files. ## Get the attributes of sbin files.

2
policy/modules/kernel/corecommands.te
View File

@ -1,5 +1,5 @@
policy_module(corecommands,1.5.0) policy_module(corecommands,1.5.1)
######################################## ########################################
# #

84
policy/modules/kernel/corenetwork.if.in
View File

@ -1003,6 +1003,25 @@ interface(`corenet_tcp_connect_all_ports',`
allow $1 port_type:tcp_socket name_connect; allow $1 port_type:tcp_socket name_connect;
') ')
########################################
## <summary>
## Do not audit attempts to connect TCP sockets
## to all ports.
## </summary>
## <param name="domain">
## <summary>
## Domain to not audit.
## </summary>
## </param>
#
interface(`corenet_dontaudit_tcp_connect_all_ports',`
gen_require(`
attribute port_type;
')
dontaudit $1 port_type:tcp_socket name_connect;
')
######################################## ########################################
## <summary> ## <summary>
## Send and receive TCP network traffic on generic reserved ports. ## Send and receive TCP network traffic on generic reserved ports.
@ -1271,6 +1290,42 @@ interface(`corenet_dontaudit_udp_bind_all_reserved_ports',`
dontaudit $1 reserved_port_type:udp_socket name_bind; dontaudit $1 reserved_port_type:udp_socket name_bind;
') ')
########################################
## <summary>
## Bind TCP sockets to all ports > 1024.
## </summary>
## <param name="domain">
## <summary>
## The type of the process performing this action.
## </summary>
## </param>
#
interface(`corenet_tcp_bind_all_unreserved_ports',`
gen_require(`
attribute port_type, reserved_port_type;
')
allow $1 { port_type -reserved_port_type }:tcp_socket name_bind;
')
########################################
## <summary>
## Bind UDP sockets to all ports > 1024.
## </summary>
## <param name="domain">
## <summary>
## The type of the process performing this action.
## </summary>
## </param>
#
interface(`corenet_udp_bind_all_unreserved_ports',`
gen_require(`
attribute port_type, reserved_port_type;
')
allow $1 { port_type -reserved_port_type }:udp_socket name_bind;
')
######################################## ########################################
## <summary> ## <summary>
## Connect TCP sockets to reserved ports. ## Connect TCP sockets to reserved ports.
@ -1510,6 +1565,35 @@ interface(`corenet_dontaudit_udp_recv_netlabel',`
kernel_dontaudit_udp_recvfrom_unlabeled($1) kernel_dontaudit_udp_recvfrom_unlabeled($1)
') ')
########################################
## <summary>
## Receive Raw IP packets from a NetLabel connection.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`corenet_raw_recv_netlabel',`
kernel_raw_recvfrom_unlabeled($1)
')
########################################
## <summary>
## Do not audit attempts to receive Raw IP packets from a NetLabel
## connection.
## </summary>
## <param name="domain">
## <summary>
## Domain to not audit.
## </summary>
## </param>
#
interface(`corenet_dontaudit_raw_recv_netlabel',`
kernel_dontaudit_raw_recvfrom_unlabeled($1)
')
######################################## ########################################
## <summary> ## <summary>
## Send generic client packets. ## Send generic client packets.

6
policy/modules/kernel/corenetwork.te.in
View File

@ -1,5 +1,5 @@
policy_module(corenetwork,1.2.3) policy_module(corenetwork,1.2.4)
######################################## ########################################
# #
@ -111,7 +111,7 @@ network_port(netsupport, tcp,5405,s0, udp,5405,s0)
network_port(nmbd, udp,137,s0, udp,138,s0, udp,139,s0) network_port(nmbd, udp,137,s0, udp,138,s0, udp,139,s0)
network_port(ntp, udp,123,s0) network_port(ntp, udp,123,s0)
network_port(ocsp, tcp,9080,s0) network_port(ocsp, tcp,9080,s0)
network_port(openvpn, udp,1194,s0) network_port(openvpn, tcp,1194,s0, udp,1194,s0)
network_port(pegasus_http, tcp,5988,s0) network_port(pegasus_http, tcp,5988,s0)
network_port(pegasus_https, tcp,5989,s0) network_port(pegasus_https, tcp,5989,s0)
network_port(pop, tcp,106,s0, tcp,109,s0, tcp,110,s0, tcp,143,s0, tcp,220,s0, tcp,993,s0, tcp,995,s0, tcp,1109,s0) network_port(pop, tcp,106,s0, tcp,109,s0, tcp,110,s0, tcp,143,s0, tcp,220,s0, tcp,993,s0, tcp,995,s0, tcp,1109,s0)
@ -196,6 +196,8 @@ sid netif gen_context(system_u:object_r:netif_t,s0 - mls_systemhigh)
build_option(`enable_mls',` build_option(`enable_mls',`
network_interface(lo, lo,s0 - mls_systemhigh) network_interface(lo, lo,s0 - mls_systemhigh)
',`
typealias netif_t alias netif_lo_t;
') ')
######################################## ########################################

37
policy/modules/kernel/domain.if
View File

@ -1053,6 +1053,25 @@ interface(`domain_dontaudit_getattr_all_pipes',`
dontaudit $1 domain:fifo_file getattr; dontaudit $1 domain:fifo_file getattr;
') ')
########################################
## <summary>
## Allow specified type to set context of all
## domains IPSEC associations.
## </summary>
## <param name="type">
## <summary>
## Type of subject to be allowed this.
## </summary>
## </param>
#
interface(`domain_ipsec_setcontext_all_domains',`
gen_require(`
attribute domain;
')
allow $1 domain:association setcontext;
')
######################################## ########################################
## <summary> ## <summary>
## Get the attributes of entry point ## Get the attributes of entry point
@ -1112,6 +1131,24 @@ interface(`domain_exec_all_entry_files',`
can_exec($1,entry_type) can_exec($1,entry_type)
') ')
########################################
## <summary>
## dontaudit checking for execute on all entry point files
## </summary>
## <param name="domain">
## <summary>
## Domain to not audit.
## </summary>
## </param>
#
interface(`domain_dontaudit_exec_all_entry_files',`
gen_require(`
attribute entry_type;
')
dontaudit $1 entry_type:file exec_file_perms;
')
######################################## ########################################
## <summary> ## <summary>
## Create, read, write, and delete all ## Create, read, write, and delete all

2
policy/modules/kernel/domain.te
View File

@ -1,5 +1,5 @@
policy_module(domain,1.2.0) policy_module(domain,1.2.1)
######################################## ########################################
# #

120
policy/modules/kernel/files.if
View File

@ -1002,6 +1002,29 @@ interface(`files_dontaudit_search_all_dirs',`
dontaudit $1 file_type:dir search; dontaudit $1 file_type:dir search;
') ')
########################################
## <summary>
## Get the attributes of all filesystems
## with the type of a file.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
# dwalsh: This interface is to allow quotacheck to work on a
# a filesystem mounted with the --context switch
# https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=212957
#
interface(`files_getattr_all_file_type_fs',`
gen_require(`
attribute file_type;
')
allow $1 file_type:filesystem getattr;
')
######################################## ########################################
## <summary> ## <summary>
## Relabel a filesystem to the type of a file. ## Relabel a filesystem to the type of a file.
@ -1937,6 +1960,24 @@ interface(`files_read_etc_symlinks',`
read_lnk_files_pattern($1,etc_t,etc_t) read_lnk_files_pattern($1,etc_t,etc_t)
') ')
########################################
## <summary>
## Create, read, write, and delete symbolic links in /etc.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`files_manage_etc_symlinks',`
gen_require(`
type etc_t;
')
manage_lnk_files_pattern($1,etc_t,etc_t)
')
######################################## ########################################
## <summary> ## <summary>
## Create objects in /etc with a private ## Create objects in /etc with a private
@ -2487,6 +2528,25 @@ interface(`files_getattr_lost_found_dirs',`
allow $1 lost_found_t:dir getattr; allow $1 lost_found_t:dir getattr;
') ')
########################################
## <summary>
## Do not audit attempts to get the attributes of
## lost+found directories.
## </summary>
## <param name="domain">
## <summary>
## Domain to not audit.
## </summary>
## </param>
#
interface(`files_dontaudit_getattr_lost_found_dirs',`
gen_require(`
type lost_found_t;
')
dontaudit $1 lost_found_t:dir getattr;
')
######################################## ########################################
## <summary> ## <summary>
## Create, read, write, and delete objects in ## Create, read, write, and delete objects in
@ -3129,6 +3189,43 @@ interface(`files_setattr_all_tmp_dirs',`
allow $1 tmpfile:dir { search_dir_perms setattr }; allow $1 tmpfile:dir { search_dir_perms setattr };
') ')
########################################
## <summary>
## Do not audit attempts to get the attributes
## of all tmp files.
## </summary>
## <param name="domain">
## <summary>
## Domain not to audit.
## </summary>
## </param>
#
interface(`files_dontaudit_getattr_all_tmp_files',`
gen_require(`
attribute tmpfile;
')
dontaudit $1 tmpfile:file getattr;
')
########################################
## <summary>
## Read all tmp files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`files_read_all_tmp_files',`
gen_require(`
attribute tmpfile;
')
read_files_pattern($1,tmpfile,tmpfile)
')
######################################## ########################################
## <summary> ## <summary>
## Create an object in the tmp directories, with a private ## Create an object in the tmp directories, with a private
@ -3513,6 +3610,24 @@ interface(`files_dontaudit_write_var_dirs',`
dontaudit $1 var_t:dir write; dontaudit $1 var_t:dir write;
') ')
########################################
## <summary>
## Allow attempts to write to /var.dirs
## </summary>
## <param name="domain">
## <summary>
## Domain to not audit.
## </summary>
## </param>
#
interface(`files_write_var_dirs',`
gen_require(`
type var_t;
')
allow $1 var_t:dir write;
')
######################################## ########################################
## <summary> ## <summary>
## Do not audit attempts to search ## Do not audit attempts to search
@ -3786,6 +3901,7 @@ interface(`files_read_var_lib_files',`
type var_t, var_lib_t; type var_t, var_lib_t;
') ')
allow $1 var_lib_t:dir list_dir_perms;
read_files_pattern($1,{ var_t var_lib_t },var_lib_t) read_files_pattern($1,{ var_t var_lib_t },var_lib_t)
') ')
@ -4421,7 +4537,7 @@ interface(`files_polyinstantiate_all',`
selinux_compute_member($1) selinux_compute_member($1)
# Need sys_admin capability for mounting # Need sys_admin capability for mounting
allow $1 self:capability sys_admin; allow $1 self:capability { chown fsetid sys_admin };
# Need to give access to the directories to be polyinstantiated # Need to give access to the directories to be polyinstantiated
allow $1 polydir:dir { create getattr search write add_name setattr mounton rmdir }; allow $1 polydir:dir { create getattr search write add_name setattr mounton rmdir };
@ -4437,7 +4553,7 @@ interface(`files_polyinstantiate_all',`
allow $1 self:process setfscreate; allow $1 self:process setfscreate;
allow $1 polymember: dir { create setattr relabelto }; allow $1 polymember: dir { create setattr relabelto };
allow $1 polydir: dir { write add_name }; allow $1 polydir: dir { write add_name };
allow $1 polyparent:dir { write add_name relabelfrom relabelto }; allow $1 polyparent:dir { read write remove_name add_name relabelfrom relabelto };
# Default type for mountpoints # Default type for mountpoints
allow $1 poly_t:dir { create mounton }; allow $1 poly_t:dir { create mounton };

4
policy/modules/kernel/files.te
View File

@ -1,5 +1,5 @@
policy_module(files,1.4.0) policy_module(files,1.4.1)
######################################## ########################################
# #
@ -50,6 +50,8 @@ files_mountpoint(default_t)
# #
type etc_t; type etc_t;
files_type(etc_t) files_type(etc_t)
# compatibility aliases for removed types:
typealias etc_t alias automount_etc_t;
# #
# etc_runtime_t is the type of various # etc_runtime_t is the type of various

21
policy/modules/kernel/filesystem.if
View File

@ -2719,6 +2719,25 @@ interface(`fs_tmpfs_filetrans',`
filetrans_pattern($1,tmpfs_t,$2,$3) filetrans_pattern($1,tmpfs_t,$2,$3)
') ')
########################################
## <summary>
## Do not audit attempts to getattr
## generic tmpfs files.
## </summary>
## <param name="domain">
## <summary>
## Domain to not audit.
## </summary>
## </param>
#
interface(`fs_dontaudit_getattr_tmpfs_files',`
gen_require(`
type tmpfs_t;
')
dontaudit $1 tmpfs_t:file getattr;
')
######################################## ########################################
## <summary> ## <summary>
## Do not audit attempts to read or write ## Do not audit attempts to read or write
@ -2735,7 +2754,7 @@ interface(`fs_dontaudit_rw_tmpfs_files',`
type tmpfs_t; type tmpfs_t;
') ')
dontaudit $1 tmpfs_t:file { read write }; dontaudit $1 tmpfs_t:file rw_file_perms;
') ')
######################################## ########################################

5
policy/modules/kernel/filesystem.te
View File

@ -1,5 +1,5 @@
policy_module(filesystem,1.5.0) policy_module(filesystem,1.5.1)
######################################## ########################################
# #
@ -103,6 +103,7 @@ genfscon cramfs / gen_context(system_u:object_r:romfs_t,s0)
type rpc_pipefs_t; type rpc_pipefs_t;
fs_type(rpc_pipefs_t) fs_type(rpc_pipefs_t)
genfscon rpc_pipefs / gen_context(system_u:object_r:rpc_pipefs_t,s0) genfscon rpc_pipefs / gen_context(system_u:object_r:rpc_pipefs_t,s0)
files_mountpoint(rpc_pipefs_t)
# #
# tmpfs_t is the type for tmpfs filesystems # tmpfs_t is the type for tmpfs filesystems
@ -139,6 +140,7 @@ genfscon automount / gen_context(system_u:object_r:autofs_t,s0)
# #
type cifs_t alias sambafs_t; type cifs_t alias sambafs_t;
fs_noxattr_type(cifs_t) fs_noxattr_type(cifs_t)
files_mountpoint(cifs_t)
genfscon cifs / gen_context(system_u:object_r:cifs_t,s0) genfscon cifs / gen_context(system_u:object_r:cifs_t,s0)
genfscon smbfs / gen_context(system_u:object_r:cifs_t,s0) genfscon smbfs / gen_context(system_u:object_r:cifs_t,s0)
@ -151,6 +153,7 @@ fs_noxattr_type(dosfs_t)
allow dosfs_t fs_t:filesystem associate; allow dosfs_t fs_t:filesystem associate;
genfscon fat / gen_context(system_u:object_r:dosfs_t,s0) genfscon fat / gen_context(system_u:object_r:dosfs_t,s0)
genfscon msdos / gen_context(system_u:object_r:dosfs_t,s0) genfscon msdos / gen_context(system_u:object_r:dosfs_t,s0)
genfscon ntfs-3g / gen_context(system_u:object_r:dosfs_t,s0)
genfscon ntfs / gen_context(system_u:object_r:dosfs_t,s0) genfscon ntfs / gen_context(system_u:object_r:dosfs_t,s0)
genfscon vfat / gen_context(system_u:object_r:dosfs_t,s0) genfscon vfat / gen_context(system_u:object_r:dosfs_t,s0)

61
policy/modules/kernel/kernel.if
View File

@ -2300,6 +2300,67 @@ interface(`kernel_dontaudit_udp_recvfrom_unlabeled',`
dontaudit $1 unlabeled_t:udp_socket recvfrom; dontaudit $1 unlabeled_t:udp_socket recvfrom;
') ')
########################################
## <summary>
## Receive Raw IP packets from a NetLabel connection.
## </summary>
## <desc>
## <p>
## Receive Raw IP packets from a NetLabel connection, NetLabel is an
## explicit packet labeling framework which implements CIPSO and
## similar protocols.
## </p>
## <p>
## The corenetwork interface
## corenet_raw_recv_netlabel() should
## be used instead of this one.
## </p>
## </desc>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`kernel_raw_recvfrom_unlabeled',`
gen_require(`
type unlabeled_t;
')
allow $1 unlabeled_t:rawip_socket recvfrom;
')
########################################
## <summary>
## Do not audit attempts to receive Raw IP packets from a NetLabel
## connection.
## </summary>
## <desc>
## <p>
## Do not audit attempts to receive Raw IP packets from a NetLabel
## connection. NetLabel is an explicit packet labeling framework
## which implements CIPSO and similar protocols.
## </p>
## <p>
## The corenetwork interface
## corenet_dontaudit_raw_recv_netlabel() should
## be used instead of this one.
## </p>
## </desc>
## <param name="domain">
## <summary>
## Domain to not audit.
## </summary>
## </param>
#
interface(`kernel_dontaudit_raw_recvfrom_unlabeled',`
gen_require(`
type unlabeled_t;
')
dontaudit $1 unlabeled_t:rawip_socket recvfrom;
')
######################################## ########################################
## <summary> ## <summary>
## Send and receive unlabeled packets. ## Send and receive unlabeled packets.

9
policy/modules/kernel/kernel.te
View File

@ -1,5 +1,5 @@
policy_module(kernel,1.5.0) policy_module(kernel,1.5.1)
######################################## ########################################
# #
@ -239,6 +239,11 @@ mcs_process_set_categories(kernel_t)
mls_process_read_up(kernel_t) mls_process_read_up(kernel_t)
mls_process_write_down(kernel_t) mls_process_write_down(kernel_t)
ifdef(`distro_redhat',`
# Bugzilla 222337
fs_rw_tmpfs_chr_files(kernel_t)
')
ifdef(`targeted_policy',` ifdef(`targeted_policy',`
unconfined_domain(kernel_t) unconfined_domain(kernel_t)
') ')
@ -345,7 +350,7 @@ optional_policy(`
# Rules for unconfined acccess to this module # Rules for unconfined acccess to this module
# #
allow kern_unconfined proc_type:{ dir file } *; allow kern_unconfined proc_type:{ dir file lnk_file } *;
allow kern_unconfined sysctl_t:{ dir file } *; allow kern_unconfined sysctl_t:{ dir file } *;

11
policy/modules/services/apache.te
View File

@ -1,5 +1,5 @@
policy_module(apache,1.5.1) policy_module(apache,1.5.2)
# #
# NOTES: # NOTES:
@ -424,6 +424,11 @@ optional_policy(`
seutil_sigchld_newrole(httpd_t) seutil_sigchld_newrole(httpd_t)
') ')
optional_policy(`
snmp_dontaudit_read_snmp_var_lib_files(httpd_t)
snmp_dontaudit_write_snmp_var_lib_files(httpd_t)
')
optional_policy(` optional_policy(`
udev_read_db(httpd_t) udev_read_db(httpd_t)
') ')
@ -684,10 +689,6 @@ optional_policy(`
nscd_socket_use(httpd_unconfined_script_t) nscd_socket_use(httpd_unconfined_script_t)
') ')
optional_policy(`
snmp_dontaudit_read_snmp_var_lib_files(httpd_t)
')
######################################## ########################################
# #
# httpd_rotatelogs local policy # httpd_rotatelogs local policy

3
policy/modules/services/apm.te
View File

@ -1,5 +1,5 @@
policy_module(apm,1.3.0) policy_module(apm,1.3.1)
######################################## ########################################
# #
@ -109,6 +109,7 @@ term_dontaudit_use_console(apmd_t)
corecmd_exec_all_executables(apmd_t) corecmd_exec_all_executables(apmd_t)
domain_read_all_domains_state(apmd_t) domain_read_all_domains_state(apmd_t)
domain_dontaudit_ptrace_all_domains(apmd_t)
domain_use_interactive_fds(apmd_t) domain_use_interactive_fds(apmd_t)
domain_dontaudit_getattr_all_sockets(apmd_t) domain_dontaudit_getattr_all_sockets(apmd_t)
domain_dontaudit_getattr_all_key_sockets(apmd_t) # Excessive? domain_dontaudit_getattr_all_key_sockets(apmd_t) # Excessive?

1
policy/modules/services/automount.fc
View File

@ -2,7 +2,6 @@
# /etc # /etc
# #
/etc/apm/event\.d/autofs -- gen_context(system_u:object_r:automount_exec_t,s0) /etc/apm/event\.d/autofs -- gen_context(system_u:object_r:automount_exec_t,s0)
/etc/auto\..+ -- gen_context(system_u:object_r:automount_etc_t,s0)
# #
# /usr # /usr

10
policy/modules/services/automount.te
View File

@ -1,5 +1,5 @@
policy_module(automount,1.4.0) policy_module(automount,1.4.1)
######################################## ########################################
# #
@ -13,9 +13,6 @@ init_daemon_domain(automount_t,automount_exec_t)
type automount_var_run_t; type automount_var_run_t;
files_pid_file(automount_var_run_t) files_pid_file(automount_var_run_t)
type automount_etc_t;
files_config_file(automount_etc_t)
type automount_lock_t; type automount_lock_t;
files_lock_file(automount_lock_t) files_lock_file(automount_lock_t)
@ -28,7 +25,7 @@ files_mountpoint(automount_tmp_t)
# Local policy # Local policy
# #
allow automount_t self:capability { net_bind_service sys_nice sys_resource dac_override sys_admin }; allow automount_t self:capability { net_bind_service setgid setuid sys_nice sys_resource dac_override sys_admin };
dontaudit automount_t self:capability sys_tty_config; dontaudit automount_t self:capability sys_tty_config;
allow automount_t self:process { signal_perms getpgid setpgid setsched setrlimit }; allow automount_t self:process { signal_perms getpgid setpgid setsched setrlimit };
allow automount_t self:fifo_file rw_fifo_file_perms; allow automount_t self:fifo_file rw_fifo_file_perms;
@ -40,9 +37,6 @@ allow automount_t self:rawip_socket create_socket_perms;
allow automount_t self:netlink_route_socket r_netlink_socket_perms; allow automount_t self:netlink_route_socket r_netlink_socket_perms;
allow automount_t automount_etc_t:file { getattr read };
# because config files can be shell scripts
can_exec(automount_t, automount_etc_t)
can_exec(automount_t, automount_exec_t) can_exec(automount_t, automount_exec_t)
allow automount_t automount_lock_t:file manage_file_perms; allow automount_t automount_lock_t:file manage_file_perms;

2
policy/modules/services/ccs.fc
View File

@ -4,5 +4,7 @@
/usr/sbin/aisexec -- gen_context(system_u:object_r:ccs_exec_t,s0) /usr/sbin/aisexec -- gen_context(system_u:object_r:ccs_exec_t,s0)
/var/lib/openais(/.*)? gen_context(system_u:object_r:ccs_var_lib_t,s0)
/var/run/cluster(/.*)? gen_context(system_u:object_r:ccs_var_run_t,s0) /var/run/cluster(/.*)? gen_context(system_u:object_r:ccs_var_run_t,s0)
/var/run/cman_.* -s gen_context(system_u:object_r:ccs_var_run_t,s0) /var/run/cman_.* -s gen_context(system_u:object_r:ccs_var_run_t,s0)

18
policy/modules/services/ccs.te
View File

@ -1,5 +1,5 @@
policy_module(ccs,1.0.0) policy_module(ccs,1.0.1)
######################################## ########################################
# #
@ -18,6 +18,10 @@ files_type(cluster_conf_t)
type ccs_var_log_t; type ccs_var_log_t;
logging_log_file(ccs_var_log_t) logging_log_file(ccs_var_log_t)
# var lib files
type ccs_var_lib_t;
logging_log_file(ccs_var_lib_t)
# pid files # pid files
type ccs_var_run_t; type ccs_var_run_t;
files_pid_file(ccs_var_run_t) files_pid_file(ccs_var_run_t)
@ -27,7 +31,7 @@ files_pid_file(ccs_var_run_t)
# ccs local policy # ccs local policy
# #
allow ccs_t self:capability { ipc_lock sys_nice sys_resource }; allow ccs_t self:capability { ipc_lock sys_nice sys_resource sys_admin };
allow ccs_t self:process { signal setrlimit setsched }; allow ccs_t self:process { signal setrlimit setsched };
allow ccs_t self:fifo_file { read write }; allow ccs_t self:fifo_file { read write };
allow ccs_t self:unix_stream_socket { connectto create_stream_socket_perms }; allow ccs_t self:unix_stream_socket { connectto create_stream_socket_perms };
@ -46,6 +50,11 @@ manage_sock_files_pattern(ccs_t,ccs_var_log_t,ccs_var_log_t)
allow ccs_t ccs_var_log_t:dir setattr; allow ccs_t ccs_var_log_t:dir setattr;
logging_log_filetrans(ccs_t,ccs_var_log_t,{ sock_file file dir }) logging_log_filetrans(ccs_t,ccs_var_log_t,{ sock_file file dir })
# var lib files
manage_dirs_pattern(ccs_t,ccs_var_lib_t,ccs_var_lib_t)
manage_files_pattern(ccs_t,ccs_var_lib_t,ccs_var_lib_t)
files_var_lib_filetrans(ccs_t,ccs_var_lib_t,{ file dir })
# pid file # pid file
manage_dirs_pattern(ccs_t,ccs_var_run_t,ccs_var_run_t) manage_dirs_pattern(ccs_t,ccs_var_run_t,ccs_var_run_t)
manage_files_pattern(ccs_t,ccs_var_run_t,ccs_var_run_t) manage_files_pattern(ccs_t,ccs_var_run_t,ccs_var_run_t)
@ -87,6 +96,11 @@ miscfiles_read_localization(ccs_t)
sysnet_dns_name_resolve(ccs_t) sysnet_dns_name_resolve(ccs_t)
ifdef(`hide_broken_symptoms', `
corecmd_dontaudit_write_sbin_dirs(ccs_t)
files_manage_isid_type_files(ccs_t)
')
ifdef(`targeted_policy',` ifdef(`targeted_policy',`
term_dontaudit_use_generic_ptys(ccs_t) term_dontaudit_use_generic_ptys(ccs_t)
term_dontaudit_use_unallocated_ttys(ccs_t) term_dontaudit_use_unallocated_ttys(ccs_t)

6
policy/modules/services/cups.te
View File

@ -1,5 +1,5 @@
policy_module(cups,1.5.0) policy_module(cups,1.5.1)
######################################## ########################################
# #
@ -203,6 +203,10 @@ files_read_var_files(cupsd_t)
files_read_var_symlinks(cupsd_t) files_read_var_symlinks(cupsd_t)
# for /etc/printcap # for /etc/printcap
files_dontaudit_write_etc_files(cupsd_t) files_dontaudit_write_etc_files(cupsd_t)
# smbspool seems to be iterating through all existing tmp files.
# redhat bug #214953
# cjp: this might be a broken behavior
files_dontaudit_getattr_all_tmp_files(cupsd_t)
selinux_compute_access_vector(cupsd_t) selinux_compute_access_vector(cupsd_t)

38
policy/modules/services/dbus.if
View File

@ -71,6 +71,7 @@ template(`dbus_per_role_template',`
allow $1_dbusd_t self:process { getattr sigkill signal }; allow $1_dbusd_t self:process { getattr sigkill signal };
allow $1_dbusd_t self:file { getattr read write }; allow $1_dbusd_t self:file { getattr read write };
allow $1_dbusd_t self:fifo_file rw_fifo_file_perms;
allow $1_dbusd_t self:dbus { send_msg acquire_svc }; allow $1_dbusd_t self:dbus { send_msg acquire_svc };
allow $1_dbusd_t self:unix_stream_socket create_stream_socket_perms; allow $1_dbusd_t self:unix_stream_socket create_stream_socket_perms;
allow $1_dbusd_t self:unix_dgram_socket create_socket_perms; allow $1_dbusd_t self:unix_dgram_socket create_socket_perms;
@ -102,22 +103,6 @@ template(`dbus_per_role_template',`
kernel_read_system_state($1_dbusd_t) kernel_read_system_state($1_dbusd_t)
kernel_read_kernel_sysctls($1_dbusd_t) kernel_read_kernel_sysctls($1_dbusd_t)
corenet_non_ipsec_sendrecv($1_dbusd_t)
corenet_tcp_sendrecv_all_if($1_dbusd_t)
corenet_tcp_sendrecv_all_nodes($1_dbusd_t)
corenet_tcp_sendrecv_all_ports($1_dbusd_t)
corenet_tcp_bind_all_nodes($1_dbusd_t)
corenet_tcp_bind_reserved_port($1_dbusd_t)
dev_read_urand($1_dbusd_t)
selinux_get_fs_mount($1_dbusd_t)
selinux_validate_context($1_dbusd_t)
selinux_compute_access_vector($1_dbusd_t)
selinux_compute_create_context($1_dbusd_t)
selinux_compute_relabel_context($1_dbusd_t)
selinux_compute_user_contexts($1_dbusd_t)
corecmd_list_bin($1_dbusd_t) corecmd_list_bin($1_dbusd_t)
corecmd_read_bin_symlinks($1_dbusd_t) corecmd_read_bin_symlinks($1_dbusd_t)
corecmd_read_bin_files($1_dbusd_t) corecmd_read_bin_files($1_dbusd_t)
@ -129,11 +114,32 @@ template(`dbus_per_role_template',`
corecmd_read_sbin_pipes($1_dbusd_t) corecmd_read_sbin_pipes($1_dbusd_t)
corecmd_read_sbin_sockets($1_dbusd_t) corecmd_read_sbin_sockets($1_dbusd_t)
corenet_non_ipsec_sendrecv($1_dbusd_t)
corenet_tcp_sendrecv_all_if($1_dbusd_t)
corenet_tcp_sendrecv_all_nodes($1_dbusd_t)
corenet_tcp_sendrecv_all_ports($1_dbusd_t)
corenet_tcp_bind_all_nodes($1_dbusd_t)
corenet_tcp_bind_reserved_port($1_dbusd_t)
dev_read_urand($1_dbusd_t)
domain_use_interactive_fds($1_dbusd_t)
files_read_etc_files($1_dbusd_t) files_read_etc_files($1_dbusd_t)
files_list_home($1_dbusd_t) files_list_home($1_dbusd_t)
files_read_usr_files($1_dbusd_t) files_read_usr_files($1_dbusd_t)
files_dontaudit_search_var($1_dbusd_t) files_dontaudit_search_var($1_dbusd_t)
fs_getattr_romfs($1_dbusd_t)
fs_getattr_xattr_fs($1_dbusd_t)
selinux_get_fs_mount($1_dbusd_t)
selinux_validate_context($1_dbusd_t)
selinux_compute_access_vector($1_dbusd_t)
selinux_compute_create_context($1_dbusd_t)
selinux_compute_relabel_context($1_dbusd_t)
selinux_compute_user_contexts($1_dbusd_t)
auth_read_pam_console_data($1_dbusd_t) auth_read_pam_console_data($1_dbusd_t)
libs_use_ld_so($1_dbusd_t) libs_use_ld_so($1_dbusd_t)

2
policy/modules/services/dbus.te
View File

@ -1,5 +1,5 @@
policy_module(dbus,1.4.0) policy_module(dbus,1.4.1)
gen_require(` gen_require(`
class dbus { send_msg acquire_svc }; class dbus { send_msg acquire_svc };

4
policy/modules/services/ftp.if
View File

@ -24,6 +24,10 @@
## </param> ## </param>
# #
template(`ftp_per_role_template',` template(`ftp_per_role_template',`
gen_require(`
type ftpd_t;
')
tunable_policy(`ftpd_is_daemon',` tunable_policy(`ftpd_is_daemon',`
userdom_manage_user_home_content_files($1,ftpd_t) userdom_manage_user_home_content_files($1,ftpd_t)
userdom_manage_user_home_content_symlinks($1,ftpd_t) userdom_manage_user_home_content_symlinks($1,ftpd_t)

10
policy/modules/services/ftp.te
View File

@ -1,5 +1,5 @@
policy_module(ftp,1.4.0) policy_module(ftp,1.4.1)
######################################## ########################################
# #
@ -102,6 +102,8 @@ corenet_tcp_bind_all_nodes(ftpd_t)
corenet_tcp_bind_ftp_port(ftpd_t) corenet_tcp_bind_ftp_port(ftpd_t)
corenet_tcp_bind_ftp_data_port(ftpd_t) corenet_tcp_bind_ftp_data_port(ftpd_t)
corenet_tcp_bind_generic_port(ftpd_t) corenet_tcp_bind_generic_port(ftpd_t)
corenet_tcp_bind_all_unreserved_ports(ftpd_t)
corenet_dontaudit_tcp_bind_all_ports(ftpd_t)
corenet_tcp_connect_all_ports(ftpd_t) corenet_tcp_connect_all_ports(ftpd_t)
corenet_sendrecv_ftp_server_packets(ftpd_t) corenet_sendrecv_ftp_server_packets(ftpd_t)
@ -123,6 +125,7 @@ auth_domtrans_chk_passwd(ftpd_t)
auth_append_login_records(ftpd_t) auth_append_login_records(ftpd_t)
#kerberized ftp requires the following #kerberized ftp requires the following
auth_write_login_records(ftpd_t) auth_write_login_records(ftpd_t)
auth_append_faillog(ftpd_t)
init_use_fds(ftpd_t) init_use_fds(ftpd_t)
init_use_script_ptys(ftpd_t) init_use_script_ptys(ftpd_t)
@ -173,6 +176,11 @@ tunable_policy(`allow_ftpd_use_nfs && allow_ftpd_anon_write',`
fs_manage_nfs_files(ftpd_t) fs_manage_nfs_files(ftpd_t)
') ')
tunable_policy(`allow_ftpd_full_access',`
allow ftpd_t self:capability { dac_override dac_read_search };
auth_manage_all_files_except_shadow(ftpd_t)
')
tunable_policy(`ftp_home_dir',` tunable_policy(`ftp_home_dir',`
allow ftpd_t self:capability { dac_override dac_read_search }; allow ftpd_t self:capability { dac_override dac_read_search };

37
policy/modules/services/hal.if
View File

@ -18,6 +18,43 @@ interface(`hal_domtrans',`
domtrans_pattern($1,hald_exec_t,hald_t) domtrans_pattern($1,hald_exec_t,hald_t)
') ')
########################################
## <summary>
## Do not audit attempts to use file descriptors from hal.
## </summary>
## <param name="domain">
## <summary>
## Domain to not audit.
## </summary>
## </param>
#
interface(`hal_dontaudit_use_fds',`
gen_require(`
type hald_t;
')
dontaudit $1 hald_t:fd use;
')
########################################
## <summary>
## Do not audit attempts to read and write to
## hald unnamed pipes.
## </summary>
## <param name="domain">
## <summary>
## Domain to not audit.
## </summary>
## </param>
#
interface(`hal_dontaudit_rw_pipes',`
gen_require(`
type hald_t;
')
dontaudit $1 hald_t:fifo_file rw_fifo_file_perms;
')
######################################## ########################################
## <summary> ## <summary>
## Send to hal over a unix domain ## Send to hal over a unix domain

2
policy/modules/services/hal.te
View File

@ -1,5 +1,5 @@
policy_module(hal,1.5.0) policy_module(hal,1.5.1)
######################################## ########################################
# #

29
policy/modules/services/inetd.te
View File

@ -1,5 +1,5 @@
policy_module(inetd,1.2.0) policy_module(inetd,1.2.1)
######################################## ########################################
# #
@ -37,10 +37,11 @@ files_pid_file(inetd_child_var_run_t)
allow inetd_t self:capability { setuid setgid }; allow inetd_t self:capability { setuid setgid };
dontaudit inetd_t self:capability sys_tty_config; dontaudit inetd_t self:capability sys_tty_config;
allow inetd_t self:process setsched; allow inetd_t self:process { setsched setexec };
allow inetd_t self:fifo_file rw_fifo_file_perms; allow inetd_t self:fifo_file rw_fifo_file_perms;
allow inetd_t self:tcp_socket create_stream_socket_perms; allow inetd_t self:tcp_socket create_stream_socket_perms;
allow inetd_t self:udp_socket create_socket_perms; allow inetd_t self:udp_socket create_socket_perms;
allow inetd_t self:fd use;
allow inetd_t inetd_log_t:file manage_file_perms; allow inetd_t inetd_log_t:file manage_file_perms;
logging_log_filetrans(inetd_t,inetd_log_t,file) logging_log_filetrans(inetd_t,inetd_log_t,file)
@ -55,6 +56,8 @@ files_pid_filetrans(inetd_t,inetd_var_run_t,file)
kernel_read_kernel_sysctls(inetd_t) kernel_read_kernel_sysctls(inetd_t)
kernel_list_proc(inetd_t) kernel_list_proc(inetd_t)
kernel_read_proc_symlinks(inetd_t) kernel_read_proc_symlinks(inetd_t)
kernel_read_system_state(inetd_t)
kernel_tcp_recvfrom_unlabeled(inetd_t)
# base networking: # base networking:
corenet_non_ipsec_sendrecv(inetd_t) corenet_non_ipsec_sendrecv(inetd_t)
@ -88,6 +91,7 @@ corenet_udp_bind_rsync_port(inetd_t)
corenet_tcp_bind_swat_port(inetd_t) corenet_tcp_bind_swat_port(inetd_t)
corenet_udp_bind_swat_port(inetd_t) corenet_udp_bind_swat_port(inetd_t)
corenet_udp_bind_tftp_port(inetd_t) corenet_udp_bind_tftp_port(inetd_t)
corenet_tcp_bind_ssh_port(inetd_t)
# service port packets: # service port packets:
corenet_sendrecv_amanda_server_packets(inetd_t) corenet_sendrecv_amanda_server_packets(inetd_t)
@ -109,6 +113,9 @@ dev_read_sysfs(inetd_t)
fs_getattr_all_fs(inetd_t) fs_getattr_all_fs(inetd_t)
fs_search_auto_mountpoints(inetd_t) fs_search_auto_mountpoints(inetd_t)
selinux_validate_context(inetd_t)
selinux_compute_create_context(inetd_t)
term_dontaudit_use_console(inetd_t) term_dontaudit_use_console(inetd_t)
# Run other daemons in the inetd_child_t domain. # Run other daemons in the inetd_child_t domain.
@ -129,11 +136,23 @@ logging_send_syslog_msg(inetd_t)
miscfiles_read_localization(inetd_t) miscfiles_read_localization(inetd_t)
# xinetd needs MLS override privileges to work
mls_fd_use_all_levels(inetd_t)
mls_fd_share_all_levels(inetd_t)
mls_socket_read_to_clearance(inetd_t)
mls_process_set_level(inetd_t)
mls_socket_read_to_clearance(inetd_t)
sysnet_read_config(inetd_t) sysnet_read_config(inetd_t)
userdom_dontaudit_use_unpriv_user_fds(inetd_t) userdom_dontaudit_use_unpriv_user_fds(inetd_t)
userdom_dontaudit_search_sysadm_home_dirs(inetd_t) userdom_dontaudit_search_sysadm_home_dirs(inetd_t)
ifdef(`enable_mls',`
corenet_tcp_recv_netlabel(inetd_t)
corenet_udp_recv_netlabel(inetd_t)
')
ifdef(`targeted_policy',` ifdef(`targeted_policy',`
term_dontaudit_use_unallocated_ttys(inetd_t) term_dontaudit_use_unallocated_ttys(inetd_t)
term_dontaudit_use_generic_ptys(inetd_t) term_dontaudit_use_generic_ptys(inetd_t)
@ -209,10 +228,8 @@ miscfiles_read_localization(inetd_child_t)
sysnet_read_config(inetd_child_t) sysnet_read_config(inetd_child_t)
ifdef(`strict_policy',` ifdef(`targeted_policy',`
tunable_policy(`run_ssh_inetd',` unconfined_domain(inetd_child_t)
corenet_tcp_bind_ssh_port(inetd_t)
')
') ')
optional_policy(` optional_policy(`

6
policy/modules/services/irqbalance.te
View File

@ -1,5 +1,5 @@
policy_module(irqbalance,1.0.0) policy_module(irqbalance,1.0.1)
######################################## ########################################
# #
@ -18,12 +18,16 @@ files_pid_file(irqbalance_var_run_t)
# Local policy # Local policy
# #
allow irqbalance_t self:capability net_admin;
allow irqbalance_t self:udp_socket create_socket_perms;
dontaudit irqbalance_t self:capability sys_tty_config; dontaudit irqbalance_t self:capability sys_tty_config;
allow irqbalance_t self:process signal_perms; allow irqbalance_t self:process signal_perms;
manage_files_pattern(irqbalance_t,irqbalance_var_run_t,irqbalance_var_run_t) manage_files_pattern(irqbalance_t,irqbalance_var_run_t,irqbalance_var_run_t)
files_pid_filetrans(irqbalance_t,irqbalance_var_run_t,file) files_pid_filetrans(irqbalance_t,irqbalance_var_run_t,file)
kernel_read_network_state(irqbalance_t)
kernel_read_system_state(irqbalance_t) kernel_read_system_state(irqbalance_t)
kernel_read_kernel_sysctls(irqbalance_t) kernel_read_kernel_sysctls(irqbalance_t)
kernel_rw_irq_sysctls(irqbalance_t) kernel_rw_irq_sysctls(irqbalance_t)

9
policy/modules/services/kerberos.if
View File

@ -40,7 +40,8 @@ interface(`kerberos_use',`
files_search_etc($1) files_search_etc($1)
allow $1 krb5_conf_t:file { getattr read }; allow $1 krb5_conf_t:file { getattr read };
dontaudit $1 krb5_conf_t:file write; dontaudit $1 krb5_conf_t:file write;
dontaudit $1 krb5kdc_conf_t:dir r_dir_perms; dontaudit $1 krb5kdc_conf_t:dir list_dir_perms;
dontaudit $1 krb5kdc_conf_t:file read_file_perms;
tunable_policy(`allow_kerberos',` tunable_policy(`allow_kerberos',`
allow $1 self:tcp_socket create_socket_perms; allow $1 self:tcp_socket create_socket_perms;
@ -63,6 +64,12 @@ interface(`kerberos_use',`
sysnet_read_config($1) sysnet_read_config($1)
sysnet_dns_name_resolve($1) sysnet_dns_name_resolve($1)
') ')
optional_policy(`
tunable_policy(`allow_kerberos',`
pcscd_stream_connect($1)
')
')
') ')
######################################## ########################################

2
policy/modules/services/kerberos.te
View File

@ -1,5 +1,5 @@
policy_module(kerberos,1.3.0) policy_module(kerberos,1.3.1)
######################################## ########################################
# #

5
policy/modules/services/ktalk.fc
View File

@ -1,4 +1,7 @@
/usr/bin/in\.talkd -- gen_context(system_u:object_r:ktalkd_exec_t,s0)
/usr/bin/ktalkd -- gen_context(system_u:object_r:ktalkd_exec_t,s0) /usr/bin/ktalkd -- gen_context(system_u:object_r:ktalkd_exec_t,s0)
/usr/sbin/in\.talkd -- gen_context(system_u:object_r:ktalkd_exec_t,s0)
/usr/sbin/in\.ntalkd -- gen_context(system_u:object_r:ktalkd_exec_t,s0)
/var/log/talkd.* -- gen_context(system_u:object_r:ktalkd_log_t,s0) /var/log/talkd.* -- gen_context(system_u:object_r:ktalkd_log_t,s0)

7
policy/modules/services/ktalk.te
View File

@ -1,5 +1,5 @@
policy_module(ktalk,1.3.0) policy_module(ktalk,1.3.1)
######################################## ########################################
# #
@ -77,6 +77,11 @@ miscfiles_read_localization(ktalkd_t)
sysnet_read_config(ktalkd_t) sysnet_read_config(ktalkd_t)
ifdef(`targeted_policy',`
term_dontaudit_use_generic_ptys(ktalkd_t)
term_dontaudit_use_unallocated_ttys(ktalkd_t)
')
optional_policy(` optional_policy(`
nis_use_ypbind(ktalkd_t) nis_use_ypbind(ktalkd_t)
') ')

12
policy/modules/services/lpd.if
View File

@ -64,19 +64,20 @@ template(`lpd_per_role_template',`
allow $1_lpr_t self:udp_socket create_socket_perms; allow $1_lpr_t self:udp_socket create_socket_perms;
allow $1_lpr_t self:netlink_route_socket r_netlink_socket_perms; allow $1_lpr_t self:netlink_route_socket r_netlink_socket_perms;
can_exec($1_lpr_t,lpr_exec_t)
tunable_policy(`use_lpd_server',`
# lpr can run in lightweight mode, without a local print spooler. # lpr can run in lightweight mode, without a local print spooler.
allow $1_lpr_t lpd_var_run_t:dir search; allow $1_lpr_t lpd_var_run_t:dir search;
allow $1_lpr_t lpd_var_run_t:sock_file write; allow $1_lpr_t lpd_var_run_t:sock_file write;
files_read_var_files($1_lpr_t) files_read_var_files($1_lpr_t)
# Connect to lpd via a Unix domain socket. # Connect to lpd via a Unix domain socket.
allow $1_lpr_t printer_t:sock_file rw_file_perms; allow $1_lpr_t printer_t:sock_file rw_sock_file_perms;
allow $1_lpr_t lpd_t:unix_stream_socket connectto; allow $1_lpr_t lpd_t:unix_stream_socket connectto;
# Send SIGHUP to lpd. # Send SIGHUP to lpd.
allow $1_lpr_t lpd_t:process signal; allow $1_lpr_t lpd_t:process signal;
can_exec($1_lpr_t,lpr_exec_t)
manage_dirs_pattern($1_lpr_t,$1_lpr_tmp_t,$1_lpr_tmp_t) manage_dirs_pattern($1_lpr_t,$1_lpr_tmp_t,$1_lpr_tmp_t)
manage_files_pattern($1_lpr_t,$1_lpr_tmp_t,$1_lpr_tmp_t) manage_files_pattern($1_lpr_t,$1_lpr_tmp_t,$1_lpr_tmp_t)
files_tmp_filetrans($1_lpr_t, $1_lpr_tmp_t, { file dir }) files_tmp_filetrans($1_lpr_t, $1_lpr_tmp_t, { file dir })
@ -89,6 +90,7 @@ template(`lpd_per_role_template',`
allow $1_lpr_t printconf_t:dir list_dir_perms; allow $1_lpr_t printconf_t:dir list_dir_perms;
read_files_pattern($1_lpr_t,printconf_t,printconf_t) read_files_pattern($1_lpr_t,printconf_t,printconf_t)
read_lnk_files_pattern($1_lpr_t,printconf_t,printconf_t) read_lnk_files_pattern($1_lpr_t,printconf_t,printconf_t)
')
dontaudit $1_lpr_t $2:unix_stream_socket { read write }; dontaudit $1_lpr_t $2:unix_stream_socket { read write };
@ -215,10 +217,14 @@ template(`lpd_per_role_template',`
template(`lpr_admin_template',` template(`lpr_admin_template',`
gen_require(` gen_require(`
type $1_lpr_t; type $1_lpr_t;
type print_spool_t;
') ')
userdom_read_all_users_home_content_files($1_lpr_t) userdom_read_all_users_home_content_files($1_lpr_t)
# Read and write shared files in the spool directory.
allow $1_lpr_t print_spool_t:file rw_file_perms;
# Allow per user lpr domain read acces for specific user. # Allow per user lpr domain read acces for specific user.
tunable_policy(`read_untrusted_content',` tunable_policy(`read_untrusted_content',`
userdom_read_all_untrusted_content($1_lpr_t) userdom_read_all_untrusted_content($1_lpr_t)

2
policy/modules/services/lpd.te
View File

@ -1,5 +1,5 @@
policy_module(lpd,1.4.0) policy_module(lpd,1.4.1)
######################################## ########################################
# #

9
policy/modules/services/mta.if
View File

@ -40,6 +40,11 @@ interface(`mta_stub',`
# #
template(`mta_base_mail_template',` template(`mta_base_mail_template',`
gen_require(`
attribute user_mail_domain;
type sendmail_exec_t;
')
############################## ##############################
# #
# $1_mail_t declarations # $1_mail_t declarations
@ -174,6 +179,10 @@ template(`mta_base_mail_template',`
## </param> ## </param>
# #
template(`mta_per_role_template',` template(`mta_per_role_template',`
gen_require(`
attribute mta_user_agent;
attribute mailserver_delivery;
')
############################## ##############################
# #

3
policy/modules/services/mta.te
View File

@ -1,5 +1,5 @@
policy_module(mta,1.5.0) policy_module(mta,1.5.1)
######################################## ########################################
# #
@ -58,6 +58,7 @@ dev_read_urand(system_mail_t)
init_use_script_ptys(system_mail_t) init_use_script_ptys(system_mail_t)
userdom_use_sysadm_terms(system_mail_t) userdom_use_sysadm_terms(system_mail_t)
userdom_dontaudit_search_sysadm_home_dirs(system_mail_t)
ifdef(`targeted_policy',` ifdef(`targeted_policy',`
typealias system_mail_t alias sysadm_mail_t; typealias system_mail_t alias sysadm_mail_t;

4
policy/modules/services/networkmanager.te
View File

@ -1,5 +1,5 @@
policy_module(networkmanager,1.5.0) policy_module(networkmanager,1.5.1)
######################################## ########################################
# #
@ -119,6 +119,8 @@ ifdef(`targeted_policy', `
term_dontaudit_use_unallocated_ttys(NetworkManager_t) term_dontaudit_use_unallocated_ttys(NetworkManager_t)
term_dontaudit_use_generic_ptys(NetworkManager_t) term_dontaudit_use_generic_ptys(NetworkManager_t)
files_dontaudit_read_root_files(NetworkManager_t) files_dontaudit_read_root_files(NetworkManager_t)
# Read gnome-keyring
userdom_read_generic_user_home_content_files(NetworkManager_t)
optional_policy(` optional_policy(`
unconfined_rw_pipes(NetworkManager_t) unconfined_rw_pipes(NetworkManager_t)

2
policy/modules/services/nis.fc
View File

@ -6,7 +6,7 @@
/usr/lib/yp/ypxfr -- gen_context(system_u:object_r:ypxfr_exec_t,s0) /usr/lib/yp/ypxfr -- gen_context(system_u:object_r:ypxfr_exec_t,s0)
/usr/sbin/rpc\.yppasswdd -- gen_context(system_u:object_r:yppasswdd_exec_t,s0) /usr/sbin/rpc\.yppasswdd -- gen_context(system_u:object_r:yppasswdd_exec_t,s0)
/usr/sbin/rpc\.ypxfr -- gen_context(system_u:object_r:ypxfr_exec_t,s0) /usr/sbin/rpc\.ypxfrd -- gen_context(system_u:object_r:ypxfr_exec_t,s0)
/usr/sbin/ypserv -- gen_context(system_u:object_r:ypserv_exec_t,s0) /usr/sbin/ypserv -- gen_context(system_u:object_r:ypserv_exec_t,s0)
/var/yp(/.*)? gen_context(system_u:object_r:var_yp_t,s0) /var/yp(/.*)? gen_context(system_u:object_r:var_yp_t,s0)

8
policy/modules/services/nis.if
View File

@ -50,12 +50,12 @@ interface(`nis_use_ypbind_uncond',`
corenet_udp_bind_generic_port($1) corenet_udp_bind_generic_port($1)
corenet_tcp_bind_reserved_port($1) corenet_tcp_bind_reserved_port($1)
corenet_udp_bind_reserved_port($1) corenet_udp_bind_reserved_port($1)
corenet_dontaudit_tcp_bind_all_reserved_ports($1) corenet_dontaudit_tcp_bind_all_ports($1)
corenet_dontaudit_udp_bind_all_reserved_ports($1) corenet_dontaudit_udp_bind_all_ports($1)
corenet_tcp_connect_portmap_port($1) corenet_tcp_connect_portmap_port($1)
corenet_tcp_connect_reserved_port($1) corenet_tcp_connect_reserved_port($1)
corenet_tcp_connect_generic_port($1) corenet_tcp_connect_generic_port($1)
corenet_dontaudit_tcp_connect_all_reserved_ports($1) corenet_dontaudit_tcp_connect_all_ports($1)
corenet_sendrecv_portmap_client_packets($1) corenet_sendrecv_portmap_client_packets($1)
corenet_sendrecv_generic_client_packets($1) corenet_sendrecv_generic_client_packets($1)
corenet_sendrecv_generic_server_packets($1) corenet_sendrecv_generic_server_packets($1)
@ -81,8 +81,6 @@ interface(`nis_use_ypbind',`
tunable_policy(`allow_ypbind',` tunable_policy(`allow_ypbind',`
nis_use_ypbind_uncond($1) nis_use_ypbind_uncond($1)
',`
dontaudit $1 var_yp_t:dir search;
') ')
') ')

9
policy/modules/services/nis.te
View File

@ -1,5 +1,5 @@
policy_module(nis,1.3.0) policy_module(nis,1.3.1)
######################################## ########################################
# #
@ -285,6 +285,7 @@ corecmd_exec_bin(ypserv_t)
domain_use_interactive_fds(ypserv_t) domain_use_interactive_fds(ypserv_t)
files_read_var_files(ypserv_t) files_read_var_files(ypserv_t)
files_read_etc_files(ypserv_t)
init_use_fds(ypserv_t) init_use_fds(ypserv_t)
init_use_script_ptys(ypserv_t) init_use_script_ptys(ypserv_t)
@ -324,6 +325,10 @@ optional_policy(`
# #
allow ypxfr_t self:unix_stream_socket create_stream_socket_perms; allow ypxfr_t self:unix_stream_socket create_stream_socket_perms;
allow ypxfr_t self:tcp_socket connected_socket_perms;
allow ypxfr_t self:udp_socket create_socket_perms;
manage_files_pattern(ypxfr_t, var_yp_t, var_yp_t)
allow ypxfr_t ypserv_t:tcp_socket { read write }; allow ypxfr_t ypserv_t:tcp_socket { read write };
allow ypxfr_t ypserv_t:udp_socket { read write }; allow ypxfr_t ypserv_t:udp_socket { read write };
@ -352,3 +357,5 @@ files_search_usr(ypxfr_t)
libs_use_shared_libs(ypxfr_t) libs_use_shared_libs(ypxfr_t)
libs_use_ld_so(ypxfr_t) libs_use_ld_so(ypxfr_t)
sysnet_read_config(ypxfr_t)

14
policy/modules/services/nscd.te
View File

@ -1,5 +1,5 @@
policy_module(nscd,1.3.0) policy_module(nscd,1.3.1)
gen_require(` gen_require(`
class nscd all_nscd_perms; class nscd all_nscd_perms;
@ -35,7 +35,6 @@ allow nscd_t self:fifo_file { read write };
allow nscd_t self:unix_stream_socket create_stream_socket_perms; allow nscd_t self:unix_stream_socket create_stream_socket_perms;
allow nscd_t self:unix_dgram_socket create_socket_perms; allow nscd_t self:unix_dgram_socket create_socket_perms;
allow nscd_t self:netlink_selinux_socket create_socket_perms; allow nscd_t self:netlink_selinux_socket create_socket_perms;
allow nscd_t self:netlink_route_socket r_netlink_socket_perms;
allow nscd_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay }; allow nscd_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay };
allow nscd_t self:tcp_socket create_socket_perms; allow nscd_t self:tcp_socket create_socket_perms;
allow nscd_t self:udp_socket create_socket_perms; allow nscd_t self:udp_socket create_socket_perms;
@ -66,6 +65,7 @@ term_dontaudit_use_console(nscd_t)
# for when /etc/passwd has just been updated and has the wrong type # for when /etc/passwd has just been updated and has the wrong type
auth_getattr_shadow(nscd_t) auth_getattr_shadow(nscd_t)
auth_use_nsswitch(nscd_t)
corenet_non_ipsec_sendrecv(nscd_t) corenet_non_ipsec_sendrecv(nscd_t)
corenet_tcp_sendrecv_all_if(nscd_t) corenet_tcp_sendrecv_all_if(nscd_t)
@ -99,14 +99,12 @@ libs_use_shared_libs(nscd_t)
logging_send_syslog_msg(nscd_t) logging_send_syslog_msg(nscd_t)
miscfiles_read_certs(nscd_t)
miscfiles_read_localization(nscd_t) miscfiles_read_localization(nscd_t)
seutil_read_config(nscd_t) seutil_read_config(nscd_t)
seutil_read_default_contexts(nscd_t) seutil_read_default_contexts(nscd_t)
seutil_sigchld_newrole(nscd_t) seutil_sigchld_newrole(nscd_t)
sysnet_dns_name_resolve(nscd_t)
sysnet_read_config(nscd_t) sysnet_read_config(nscd_t)
userdom_dontaudit_use_unpriv_user_fds(nscd_t) userdom_dontaudit_use_unpriv_user_fds(nscd_t)
@ -121,14 +119,6 @@ ifdef(`targeted_policy',`
files_dontaudit_read_root_files(nscd_t) files_dontaudit_read_root_files(nscd_t)
') ')
optional_policy(`
nis_use_ypbind(nscd_t)
')
optional_policy(`
samba_stream_connect_winbind(nscd_t)
')
optional_policy(` optional_policy(`
udev_read_db(nscd_t) udev_read_db(nscd_t)
') ')

6
policy/modules/services/openvpn.te
View File

@ -1,5 +1,5 @@
policy_module(openvpn,1.1.0) policy_module(openvpn,1.1.1)
######################################## ########################################
# #
@ -28,11 +28,11 @@ files_pid_file(openvpn_var_run_t)
# openvpn local policy # openvpn local policy
# #
allow openvpn_t self:capability { net_admin setgid setuid sys_tty_config }; allow openvpn_t self:capability { net_bind_service net_admin setgid setuid sys_tty_config };
allow openvpn_t self:unix_dgram_socket { create_socket_perms sendto }; allow openvpn_t self:unix_dgram_socket { create_socket_perms sendto };
allow openvpn_t self:unix_stream_socket { create_stream_socket_perms connectto }; allow openvpn_t self:unix_stream_socket { create_stream_socket_perms connectto };
allow openvpn_t self:udp_socket create_socket_perms; allow openvpn_t self:udp_socket create_socket_perms;
allow openvpn_t self:tcp_socket create_socket_perms; allow openvpn_t self:tcp_socket server_stream_socket_perms;
allow openvpn_t self:netlink_route_socket rw_netlink_socket_perms; allow openvpn_t self:netlink_route_socket rw_netlink_socket_perms;
allow openvpn_t openvpn_etc_t:dir list_dir_perms; allow openvpn_t openvpn_etc_t:dir list_dir_perms;

5
policy/modules/services/pcscd.fc Normal file
View File

@ -0,0 +1,5 @@
/var/run/pcscd\.comm -s gen_context(system_u:object_r:pcscd_var_run_t,s0)
/var/run/pcscd\.pid -- gen_context(system_u:object_r:pcscd_var_run_t,s0)
/var/run/pcscd\.pub -- gen_context(system_u:object_r:pcscd_var_run_t,s0)
/usr/sbin/pcscd -- gen_context(system_u:object_r:pcscd_exec_t,s0)

58
policy/modules/services/pcscd.if Normal file
View File

@ -0,0 +1,58 @@
## <summary>PCSC smart card service</summary>
########################################
## <summary>
## Execute a domain transition to run pcscd.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed to transition.
## </summary>
## </param>
#
interface(`pcscd_domtrans',`
gen_require(`
type pcscd_t, pcscd_exec_t;
')
domtrans_pattern($1,pcscd_exec_t,pcscd_t)
')
########################################
## <summary>
## Read pcscd pub files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`pcscd_read_pub_files',`
gen_require(`
type pcscd_var_run_t;
')
files_search_pids($1)
allow $1 pcscd_var_run_t:file read_file_perms;
')
########################################
## <summary>
## Connect to pcscd over an unix stream socket.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`pcscd_stream_connect',`
gen_require(`
type pcscd_t, pcscd_var_run_t;
')
files_search_pids($1)
allow $1 pcscd_var_run_t:sock_file write;
allow $1 pcscd_t:unix_stream_socket connectto;
')

69
policy/modules/services/pcscd.te Normal file
View File

@ -0,0 +1,69 @@
policy_module(pcscd,1.0.0)
########################################
#
# Declarations
#
type pcscd_t;
type pcscd_exec_t;
domain_type(pcscd_t)
init_daemon_domain(pcscd_t, pcscd_exec_t)
# pid files
type pcscd_var_run_t;
files_pid_file(pcscd_var_run_t)
########################################
#
# pcscd local policy
#
allow pcscd_t self:capability { dac_override dac_read_search };
allow pcscd_t self:fifo_file { read write };
allow pcscd_t self:unix_stream_socket create_stream_socket_perms;
allow pcscd_t self:unix_dgram_socket create_socket_perms;
allow pcscd_t self:tcp_socket create_stream_socket_perms;
manage_files_pattern(pcscd_t,pcscd_var_run_t,pcscd_var_run_t)
manage_sock_files_pattern(pcscd_t,pcscd_var_run_t,pcscd_var_run_t)
files_pid_filetrans(pcscd_t,pcscd_var_run_t, { file sock_file })
corenet_tcp_sendrecv_all_if(pcscd_t)
corenet_tcp_sendrecv_all_nodes(pcscd_t)
corenet_tcp_sendrecv_all_ports(pcscd_t)
corenet_non_ipsec_sendrecv(pcscd_t)
corenet_tcp_connect_http_port(pcscd_t)
dev_rw_generic_usb_dev(pcscd_t)
dev_rw_usbfs(pcscd_t)
dev_search_sysfs(pcscd_t)
files_read_etc_files(pcscd_t)
files_read_etc_runtime_files(pcscd_t)
term_dontaudit_getattr_pty_dirs(pcscd_t)
init_dontaudit_use_fds(pcscd_t)
libs_use_ld_so(pcscd_t)
libs_use_shared_libs(pcscd_t)
locallogin_use_fds(pcscd_t)
logging_send_syslog_msg(pcscd_t)
miscfiles_read_localization(pcscd_t)
sysnet_dns_name_resolve(pcscd_t)
ifdef(`targeted_policy',`
term_dontaudit_use_generic_ptys(pcscd_t)
term_dontaudit_use_unallocated_ttys(pcscd_t)
term_dontaudit_use_console(pcscd_t)
')
optional_policy(`
rpm_use_script_fds(pcscd_t)
')

Some files were not shown because too many files have changed in this diff Show More