rpms/selinux-policy
5
0
Fork 0
Code Issues Pull Requests Releases Activity

change dmesg and loadkeys behavior to aliasing, and enable modules

Browse Source
This commit is contained in:
Chris PeBenito 2005-11-14 20:26:41 +00:00
parent a8b62e799c
commit 9e91381a26
7 changed files with 157 additions and 109 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
refpolicy/policy/modules.conf
View File

@ -175,7 +175,7 @@ quota = off
#
# Policy for dmesg.
#
dmesg = off
dmesg = base
# Layer: admin
# Module: logrotate
@ -231,7 +231,7 @@ webalizer = base
#
# Load keyboard mappings.
#
loadkeys = off
loadkeys = base
# Layer: apps
# Module: gpg

14
refpolicy/policy/modules/admin/dmesg.if
View File

@ -9,11 +9,12 @@
## </param>
#
interface(`dmesg_domtrans',`
ifdef(`targeted_policy',`
# $0(): disabled in targeted policy as there
# is no dmesg domain.
',`
gen_require(`
type dmesg_t, dmesg_exec_t;
class process sigchld;
class fd use;
class fifo_file rw_file_perms;
')
corecmd_search_sbin($1)
@ -24,6 +25,7 @@ interface(`dmesg_domtrans',`
allow dmesg_t $1:fifo_file rw_file_perms;
allow dmesg_t $1:process sigchld;
')
')
########################################
## <summary>
@ -34,6 +36,11 @@ interface(`dmesg_domtrans',`
## </param>
#
interface(`dmesg_exec',`
ifdef(`targeted_policy',`
# $0(): the dmesg program is an alias
# of generic bin programs.
corecmd_exec_bin($1)
',`
gen_require(`
type dmesg_exec_t;
')
@ -41,4 +48,5 @@ interface(`dmesg_exec',`
corecmd_search_sbin($1)
can_exec($1,dmesg_exec_t)
')
')

15
refpolicy/policy/modules/admin/dmesg.te
View File

@ -6,16 +6,24 @@ policy_module(dmesg, 1.0)
# Declarations
#
ifdef(`targeted_policy',`
# for compatibility with strict:
corecmd_bin_alias(dmesg_exec_t)
',`
type dmesg_t;
type dmesg_exec_t;
init_system_domain(dmesg_t,dmesg_exec_t)
role system_r types dmesg_t;
')
########################################
#
# Local policy
#
ifdef(`targeted_policy',`
# dmesg domain disabled in targeted policy
',`
allow dmesg_t self:capability sys_admin;
dontaudit dmesg_t self:capability sys_tty_config;
@ -54,12 +62,6 @@ miscfiles_read_localization(dmesg_t)
userdom_use_sysadm_terms(dmesg_t)
userdom_dontaudit_use_unpriv_user_fd(dmesg_t)
ifdef(`targeted_policy', `
term_dontaudit_use_unallocated_tty(dmesg_t)
term_dontaudit_use_generic_pty(dmesg_t)
files_dontaudit_read_root_file(dmesg_t)
')
optional_policy(`selinuxutil.te',`
seutil_sigchld_newrole(dmesg_t)
')
@ -73,3 +75,4 @@ optional_policy(`rhgb.te',`
rhgb_domain(dmesg_t)
')
') dnl endif TODO
')

20
refpolicy/policy/modules/apps/loadkeys.if
View File

@ -9,11 +9,12 @@
## </param>
#
interface(`loadkeys_domtrans',`
ifdef(`targeted_policy',`
# $0(): disabled in targeted policy as there
# is no loadkeys domain.
',`
gen_require(`
type loadkeys_t, loadkeys_exec_t;
class process sigchld;
class fd use;
class fifo_file rw_file_perms;
')
corecmd_search_bin($1)
@ -24,6 +25,7 @@ interface(`loadkeys_domtrans',`
allow loadkeys_t $1:fifo_file rw_file_perms;
allow loadkeys_t $1:process sigchld;
')
')
########################################
## <summary>
@ -40,15 +42,19 @@ interface(`loadkeys_domtrans',`
## </param>
#
interface(`loadkeys_run',`
ifdef(`targeted_policy',`
# $0(): disabled in targeted policy as there
# is no loadkeys domain.
',`
gen_require(`
type loadkeys_t;
class chr_file rw_term_perms;
')
loadkeys_domtrans($1)
role $2 types loadkeys_t;
allow loadkeys_t $3:chr_file rw_term_perms;
')
')
########################################
## <summary>
@ -59,9 +65,15 @@ interface(`loadkeys_run',`
## </param>
#
interface(`loadkeys_exec',`
ifdef(`targeted_policy',`
# $0(): the loadkeys program is an alias
# of generic bin programs.
corecmd_exec_bin($1)
',`
gen_require(`
type loadkeys_exec_t;
')
can_exec($1,loadkeys_exec_t)
')
')

9
refpolicy/policy/modules/apps/loadkeys.te
View File

@ -6,6 +6,10 @@ policy_module(loadkeys,1.0)
# Declarations
#
ifdef(`targeted_policy',`
# for compatibility with strict:
corecmd_bin_alias(loadkeys_exec_t)
',`
# cjp: this should probably be rewritten
# per user domain, since it can rw
# all user domain ttys
@ -15,12 +19,16 @@ domain_type(loadkeys_t)
type loadkeys_exec_t;
domain_entry_file(loadkeys_t,loadkeys_exec_t)
')
########################################
#
# Local policy
#
ifdef(`targeted_policy',`
# loadkeys domain disabled in targeted policy
',`
allow loadkeys_t self:capability { setuid sys_tty_config };
allow loadkeys_t self:fifo_file rw_file_perms;
@ -37,3 +45,4 @@ libs_use_shared_libs(loadkeys_t)
locallogin_use_fd(loadkeys_t)
miscfiles_read_localization(loadkeys_t)
')

15
refpolicy/policy/modules/system/corecommands.if
View File

@ -8,6 +8,21 @@
## run init.
## </required>
########################################
## <summary>
## Create a aliased type to bin_t.
## </summary>
## <param name="domain">
## Alias type for bin_t.
## </param>
interface(`corecmd_bin_alias',`
gen_require(`
type bin_t;
')
typealias bin_t alias $1;
')
########################################
## <summary>
## Make the shell an entrypoint for the specified domain.

3
refpolicy/policy/modules/system/corecommands.te
View File

@ -13,7 +13,8 @@ type bin_t;
files_type(bin_t)
ifdef(`targeted_policy',`
typealias bin_t alias { procmail_exec_t dmesg_exec_t loadkeys_exec_t };
# cjp: temporary until procmail is added
typealias bin_t alias procmail_exec_t;
')
#