rpms/selinux-policy
5
0
Fork 0
Code Issues Pull Requests Releases Activity

start adding user domains. fix ttynode and ptynode handling, as they're

Browse Source 
more then user terminals (at least ptynode is).  start adding XML comments
This commit is contained in:
Chris PeBenito 2005-05-16 21:10:33 +00:00
parent c6a3a22457
commit b16c6b8c32
27 changed files with 1350 additions and 184 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
refpolicy/policy/modules/admin/netutils.te
View File

@ -131,8 +131,8 @@ sysnetwork_read_network_config(ping_t)
logging_send_system_log_message(ping_t)
if (user_ping) {
terminal_use_all_users_physical_terminals(ping_t)
terminal_use_all_users_pseudoterminals(ping_t)
terminal_use_all_private_physical_terminals(ping_t)
terminal_use_all_private_pseudoterminals(ping_t)
}
ifdef(`TODO',`
@ -194,8 +194,8 @@ devices_get_pseudorandom_data(traceroute_t)
files_read_general_application_resources(traceroute_t)
if (user_ping) {
terminal_use_all_users_physical_terminals(traceroute_t)
terminal_use_all_users_pseudoterminals(traceroute_t)
terminal_use_all_private_physical_terminals(traceroute_t)
terminal_use_all_private_pseudoterminals(traceroute_t)
}
ifdef(`TODO',`

20
refpolicy/policy/modules/admin/usermanage.te
View File

@ -85,8 +85,8 @@ kernel_compute_create(chfn_t)
kernel_compute_relabel(chfn_t)
kernel_compute_reachable_user_contexts(chfn_t)
terminal_use_all_users_physical_terminals(chfn_t)
terminal_use_all_users_pseudoterminals(chfn_t)
terminal_use_all_private_physical_terminals(chfn_t)
terminal_use_all_private_pseudoterminals(chfn_t)
filesystem_get_persistent_filesystem_attributes(chfn_t)
@ -220,8 +220,8 @@ kernel_compute_reachable_user_contexts(groupadd_t)
filesystem_get_persistent_filesystem_attributes(groupadd_t)
terminal_use_all_users_physical_terminals(groupadd_t)
terminal_use_all_users_pseudoterminals(groupadd_t)
terminal_use_all_private_physical_terminals(groupadd_t)
terminal_use_all_private_pseudoterminals(groupadd_t)
init_use_file_descriptors(groupadd_t)
init_script_read_runtime_data(groupadd_t)
@ -298,8 +298,8 @@ devices_get_pseudorandom_data(passwd_t)
filesystem_get_persistent_filesystem_attributes(passwd_t)
terminal_use_all_users_physical_terminals(passwd_t)
terminal_use_all_users_pseudoterminals(passwd_t)
terminal_use_all_private_physical_terminals(passwd_t)
terminal_use_all_private_pseudoterminals(passwd_t)
# /usr/bin/passwd asks for w access to utmp, but it will operate
# correctly without it. Do not audit write denials to utmp.
@ -398,8 +398,8 @@ devices_get_pseudorandom_data(sysadm_passwd_t)
filesystem_get_persistent_filesystem_attributes(sysadm_passwd_t)
terminal_use_all_users_physical_terminals(sysadm_passwd_t)
terminal_use_all_users_pseudoterminals(sysadm_passwd_t)
terminal_use_all_private_physical_terminals(sysadm_passwd_t)
terminal_use_all_private_pseudoterminals(sysadm_passwd_t)
# /usr/bin/passwd asks for w access to utmp, but it will operate
# correctly without it. Do not audit write denials to utmp.
@ -487,8 +487,8 @@ kernel_read_kernel_sysctl(useradd_t)
filesystem_get_persistent_filesystem_attributes(useradd_t)
terminal_use_all_users_physical_terminals(useradd_t)
terminal_use_all_users_pseudoterminals(useradd_t)
terminal_use_all_private_physical_terminals(useradd_t)
terminal_use_all_private_pseudoterminals(useradd_t)
init_use_file_descriptors(useradd_t)
init_script_modify_runtime_data(useradd_t)

2
refpolicy/policy/modules/kernel/bootloader.te
View File

@ -109,7 +109,7 @@ devices_raw_read_memory(bootloader_t)
filesystem_get_persistent_filesystem_attributes(bootloader_t)
terminal_get_all_users_physical_terminal_attributes(bootloader_t)
terminal_get_all_private_physical_terminal_attributes(bootloader_t)
init_get_control_channel_attributes(bootloader_t)
init_script_use_pseudoterminal(bootloader_t)

14
refpolicy/policy/modules/kernel/corenetwork.if
View File

@ -724,6 +724,20 @@ class tcp_socket name_bind;
class capability net_bind_service;
')
#######################################
#
# corenetwork_ignore_bind_tcp_on_all_reserved_ports(domain)
#
define(`corenetwork_ignore_bind_tcp_on_all_reserved_ports',`
requires_block_template(`$0'_depend)
dontaudit $1 reserved_port_type:tcp_socket name_bind;
')
define(`corenetwork_ignore_bind_tcp_on_all_reserved_ports_depend',`
attribute reserved_port_type;
class tcp_socket name_bind;
')
#######################################
#
# corenetwork_bind_udp_on_all_reserved_ports(domain)

32
refpolicy/policy/modules/kernel/devices.if
View File

@ -576,6 +576,22 @@ class dir { getattr read search };
class chr_file { getattr read write ioctl };
')
########################################
#
# devices_get_direct_rendering_interface_attributes(domain)
#
define(`devices_get_direct_rendering_interface_attributes',`
requires_block_template(`$0'_depend)
allow $1 device_t:dir { getattr read search };
allow $1 dri_device_t:chr_file getattr;
')
define(`devices_get_direct_rendering_interface_attributes_depend',`
type device_t, dri_device_t;
class dir { getattr read search };
class chr_file getattr;
')
########################################
#
# devices_use_direct_rendering_interface(domain)
@ -583,7 +599,7 @@ class chr_file { getattr read write ioctl };
define(`devices_use_direct_rendering_interface',`
requires_block_template(`$0'_depend)
allow $1 device_t:dir { getattr read search };
allow $1 dri_device_t:chr_file { getattr read ioctl };
allow $1 dri_device_t:chr_file { getattr read write ioctl };
')
define(`devices_use_direct_rendering_interface_depend',`
@ -592,6 +608,20 @@ class dir { getattr read search };
class chr_file { getattr read write ioctl };
')
########################################
#
# devices_ignore_use_direct_rendering_interface(domain)
#
define(`devices_ignore_use_direct_rendering_interface',`
requires_block_template(`$0'_depend)
dontaudit $1 dri_device_t:chr_file { getattr read write ioctl };
')
define(`devices_ignore_use_direct_rendering_interface_depend',`
type dri_device_t;
class chr_file { getattr read write ioctl };
')
########################################
#
# devices_read_mtrr(domain)

4
refpolicy/policy/modules/kernel/devices.te
View File

@ -88,6 +88,10 @@ filesystem_tmpfs_associate(memory_device_t)
neverallow ~memory_raw_read memory_device_t:{ chr_file blk_file } read;
neverallow ~memory_raw_write memory_device_t:{ chr_file blk_file } { append write };
type misc_device_t, device_node;
filesystem_associate(misc_device_t)
filesystem_tmpfs_associate(misc_device_t)
#
# A more general type for mouse devices.
#

202
refpolicy/policy/modules/kernel/filesystem.if
View File

@ -245,6 +245,100 @@ type cifs_t;
class filesystem getattr;
')
########################################
#
# filesystem_execute_windows_network_files(domain)
#
define(`filesystem_execute_windows_network_files',`
requires_block_template(`$0'_depend)
allow $1 cifs_t:dir { getattr search read };
allow $1 cifs_t:file { getattr read execute execute_no_trans };
')
define(`filesystem_execute_windows_network_files_depend',`
type cifs_t;
class dir { getattr search read };
class file { getattr read execute execute_no_trans };
')
########################################
#
# filesystem_manage_windows_network_directories(domain)
#
define(`filesystem_manage_windows_network_directories',`
requires_block_template(`$0'_depend)
allow $1 cifs_t:dir { create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir };
')
define(`filesystem_manage_windows_network_directories_depend',`
type cifs_t;
class dir { create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir };
')
########################################
#
# filesystem_manage_windows_network_files(domain)
#
define(`filesystem_manage_windows_network_files',`
requires_block_template(`$0'_depend)
allow $1 cifs_t:dir { getattr search read write add_name remove_name };
allow $1 cifs_t:file { create ioctl read getattr lock write setattr append link unlink rename };
')
define(`filesystem_manage_windows_network_files_depend',`
type cifs_t;
class dir { getattr search read write add_name remove_name };
class file { create ioctl read getattr lock write setattr append link unlink rename };
')
########################################
#
# filesystem_manage_windows_network_symbolic_links(domain)
#
define(`filesystem_manage_windows_network_symbolic_links',`
requires_block_template(`$0'_depend)
allow $1 cifs_t:dir { getattr search read write add_name remove_name };
allow $1 cifs_t:lnk_file { create ioctl read getattr lock write setattr append link unlink rename };
')
define(`filesystem_manage_windows_network_symbolic_links_depend',`
type cifs_t;
class dir { getattr search read write add_name remove_name };
class lnk_file { create ioctl read getattr lock write setattr append link unlink rename };
')
########################################
#
# filesystem_manage_windows_network_named_pipes(domain)
#
define(`filesystem_manage_windows_network_named_pipes',`
requires_block_template(`$0'_depend)
allow $1 cifs_t:dir { getattr search read write add_name remove_name };
allow $1 cifs_t:fifo_file { create ioctl read getattr lock write setattr append link unlink rename };
')
define(`filesystem_manage_windows_network_named_pipes_depend',`
type cifs_t;
class dir { getattr search read write add_name remove_name };
class fifo_file { create ioctl read getattr lock write setattr append link unlink rename };
')
########################################
#
# filesystem_manage_windows_network_named_sockets(domain)
#
define(`filesystem_manage_windows_network_named_sockets',`
requires_block_template(`$0'_depend)
allow $1 cifs_t:dir { getattr search read write add_name remove_name };
allow $1 cifs_t:sock_file { create ioctl read getattr lock write setattr append link unlink rename };
')
define(`filesystem_manage_windows_network_named_sockets_depend',`
type cifs_t;
class dir { getattr search read write add_name remove_name };
class sock_file { create ioctl read getattr lock write setattr append link unlink rename };
')
########################################
#
# filesystem_mount_dos_filesystem(domain)
@ -413,6 +507,100 @@ type nfs_t;
class filesystem getattr;
')
########################################
#
# filesystem_execute_nfs_files(domain)
#
define(`filesystem_execute_nfs_files',`
requires_block_template(`$0'_depend)
allow $1 nfs_t:dir { getattr search read };
allow $1 nfs_t:file { getattr read execute execute_no_trans };
')
define(`filesystem_execute_nfs_files_depend',`
type nfs_t;
class dir { getattr search read };
class file { getattr read execute execute_no_trans };
')
########################################
#
# filesystem_manage_nfs_directories(domain)
#
define(`filesystem_manage_nfs_directories',`
requires_block_template(`$0'_depend)
allow $1 nfs_t:dir { create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir };
')
define(`filesystem_manage_nfs_directories_depend',`
type nfs_t;
class dir { create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir };
')
########################################
#
# filesystem_manage_nfs_files(domain)
#
define(`filesystem_manage_nfs_files',`
requires_block_template(`$0'_depend)
allow $1 nfs_t:dir { getattr search read write add_name remove_name };
allow $1 nfs_t:file { create ioctl read getattr lock write setattr append link unlink rename };
')
define(`filesystem_manage_nfs_files_depend',`
type nfs_t;
class dir { getattr search read write add_name remove_name };
class file { create ioctl read getattr lock write setattr append link unlink rename };
')
########################################
#
# filesystem_manage_nfs_symbolic_links(domain)
#
define(`filesystem_manage_nfs_symbolic_links',`
requires_block_template(`$0'_depend)
allow $1 nfs_t:dir { getattr search read write add_name remove_name };
allow $1 nfs_t:lnk_file { create ioctl read getattr lock write setattr append link unlink rename };
')
define(`filesystem_manage_nfs_symbolic_links_depend',`
type nfs_t;
class dir { getattr search read write add_name remove_name };
class lnk_file { create ioctl read getattr lock write setattr append link unlink rename };
')
########################################
#
# filesystem_manage_nfs_named_pipes(domain)
#
define(`filesystem_manage_nfs_named_pipes',`
requires_block_template(`$0'_depend)
allow $1 nfs_t:dir { getattr search read write add_name remove_name };
allow $1 nfs_t:fifo_file { create ioctl read getattr lock write setattr append link unlink rename };
')
define(`filesystem_manage_nfs_named_pipes_depend',`
type nfs_t;
class dir { getattr search read write add_name remove_name };
class fifo_file { create ioctl read getattr lock write setattr append link unlink rename };
')
########################################
#
# filesystem_manage_nfs_named_sockets(domain)
#
define(`filesystem_manage_nfs_named_sockets',`
requires_block_template(`$0'_depend)
allow $1 nfs_t:dir { getattr search read write add_name remove_name };
allow $1 nfs_t:sock_file { create ioctl read getattr lock write setattr append link unlink rename };
')
define(`filesystem_manage_nfs_named_sockets_depend',`
type nfs_t;
class dir { getattr search read write add_name remove_name };
class sock_file { create ioctl read getattr lock write setattr append link unlink rename };
')
########################################
#
# filesystem_mount_nfsd_filesystem(domain)
@ -782,6 +970,20 @@ attribute fs_type;
class filesystem getattr;
')
########################################
#
# filesystem_get_all_filesystems_quotas(type)
#
define(`filesystem_get_all_filesystems_quotas',`
requires_block_template(`$0'_depend)
allow $1 fs_type:filesystem quotaget;
')
define(`filesystem_get_all_filesystems_quotas_depend',`
attribute fs_type;
class filesystem quotaget;
')
########################################
#
# filesystem_get_all_file_attributes(type)

14
refpolicy/policy/modules/kernel/kernel.if
View File

@ -370,6 +370,20 @@ type kernel_t;
class system syslog_read;
')
########################################
#
# kernel_ignore_read_ring_buffer(domain)
#
define(`kernel_ignore_read_ring_buffer',`
requires_block_template(`$0'_depend)
dontaudit $1 kernel_t:system syslog_read;
')
define(`kernel_ignore_read_ring_buffer_depend',`
type kernel_t;
class system syslog_read;
')
########################################
#
# kernel_change_ring_buffer_level(domain)

285
refpolicy/policy/modules/kernel/storage.if
View File

@ -1,13 +1,93 @@
# Copyright (C) 2005 Tresys Technology, LLC
## <interfaces module="storage">
## <summary>Policy controlling access to storage devices</summary>
########################################
#
# storage_raw_read_fixed_disk(domain)
## <interface name="storage_get_fixed_disk_attributes">
## <description>
## Allow the caller to get the attributes of fixed disk
## device nodes.
## </description>
## <parameter position="1" name="domain">
## The type of the process performing this action.
## </parameter>
## <infoflow type="read" weight="7"/>
## </interface>
#
define(`storage_get_fixed_disk_attributes',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
allow $1 fixed_disk_device_t:blk_file getattr;
')
define(`storage_get_fixed_disk_attributes_depend',`
type fixed_disk_device_t;
class blk_file getattr;
')
#
## <interface name="storage_ignore_get_fixed_disk_attributes">
## <description>
## Do not audit attempts made by the caller to get
## the attributes of fixed disk device nodes.
## </description>
## <parameter position="1" name="domain">
## The type of the process to not audit.
## </parameter>
## <infoflow type="none"/>
## </interface>
#
define(`storage_ignore_get_fixed_disk_attributes',`
requires_block_template(`$0'_depend)
dontaudit $1 fixed_disk_device_t:blk_file getattr;
')
define(`storage_ignore_get_fixed_disk_attributes_depend',`
type fixed_disk_device_t;
class blk_file getattr;
')
#
## <interface name="storage_set_fixed_disk_attributes">
## <description>
## Allow the caller to set the attributes of fixed disk
## device nodes.
## </description>
## <parameter position="1" name="domain">
## The type of the process performing this action.
## </parameter>
## <infoflow type="write" weight="7"/>
## </interface>
#
define(`storage_set_fixed_disk_attributes',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
allow $1 fixed_disk_device_t:blk_file setattr;
')
define(`storage_set_fixed_disk_attributes_depend',`
type fixed_disk_device_t;
class blk_file setattr;
')
#
## <interface name="storage_raw_read_fixed_disk">
## <description>
## Allow the caller to directly read from a fixed disk.
## This is extremly dangerous as it can bypass the
## SELinux protections for filesystem objects, and
## should only be used by trusted domains.
## </description>
## <parameter position="1" name="domain">
## The type of the process performing this action.
## </parameter>
## <infoflow type="read" weight="10"/>
## </interface>
#
define(`storage_raw_read_fixed_disk',`
requires_block_template(`$0'_depend)
typeattribute $1 fixed_disk_raw_read;
devices_list_device_nodes($1,optional)
devices_list_device_nodes($1)
allow $1 fixed_disk_device_t:blk_file { getattr read ioctl };
')
@ -15,17 +95,26 @@ define(`storage_raw_read_fixed_disk_depend',`
type fixed_disk_device_t;
attribute fixed_disk_raw_read;
class blk_file { getattr read ioctl };
devices_list_device_nodes_depend
')
########################################
#
# storage_raw_write_fixed_disk(domain)
## <interface name="storage_write_read_fixed_disk">
## <description>
## Allow the caller to directly write to a fixed disk.
## This is extremly dangerous as it can bypass the
## SELinux protections for filesystem objects, and
## should only be used by trusted domains.
## </description>
## <parameter position="1" name="domain">
## The type of the process performing this action.
## </parameter>
## <infoflow type="write" weight="10"/>
## </interface>
#
define(`storage_raw_write_fixed_disk',`
requires_block_template(`$0'_depend)
typeattribute $1 fixed_disk_raw_write;
devices_list_device_nodes($1,optional)
devices_list_device_nodes($1)
allow $1 fixed_disk_device_t:blk_file { getattr write ioctl };
')
@ -33,12 +122,22 @@ define(`storage_raw_write_fixed_disk_depend',`
type fixed_disk_device_t;
attribute fixed_disk_raw_write;
class blk_file { getattr write ioctl };
devices_list_device_nodes_depend
')
########################################
#
# storage_raw_read_lvm_volume(domain)
##
## <interface name="storage_raw_read_lvm_volume">
## <description>
## Allow the caller to directly read from a logical volume.
## This is extremly dangerous as it can bypass the
## SELinux protections for filesystem objects, and
## should only be used by trusted domains.
## </description>
## <parameter position="1" name="domain">
## The type of the process performing this action.
## </parameter>
## <infoflow type="read" weight="10"/>
## </interface>
#
define(`storage_raw_read_lvm_volume',`
requires_block_template(`$0'_depend)
@ -53,9 +152,19 @@ attribute fixed_disk_raw_read;
class blk_file { getattr read ioctl };
')
########################################
#
# storage_raw_write_lvm_volume(domain)
## <interface name="storage_raw_write_lvm_volume">
## <description>
## Allow the caller to directly read from a logical volume.
## This is extremly dangerous as it can bypass the
## SELinux protections for filesystem objects, and
## should only be used by trusted domains.
## </description>
## <parameter position="1" name="domain">
## The type of the process performing this action.
## </parameter>
## <infoflow type="write" weight="10"/>
## </interface>
#
define(`storage_raw_write_lvm_volume',`
requires_block_template(`$0'_depend)
@ -70,39 +179,20 @@ attribute fixed_disk_raw_write;
class blk_file { getattr write ioctl };
')
########################################
#
# storage_get_fixed_disk_attributes(domain)
#
define(`storage_get_fixed_disk_attributes',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
allow $1 fixed_disk_device_t:blk_file getattr;
')
define(`storage_get_fixed_disk_attributes_depend',`
type fixed_disk_device_t;
class blk_file getattr;
')
########################################
#
# storage_set_fixed_disk_attributes(domain)
#
define(`storage_set_fixed_disk_attributes',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
allow $1 fixed_disk_device_t:blk_file setattr;
')
define(`storage_set_fixed_disk_attributes_depend',`
type fixed_disk_device_t;
class blk_file setattr;
')
########################################
#
# storage_read_scsi_generic(domain)
## <interface name="storage_read_scsi_generic">
## <description>
## Allow the caller to directly read, in a
## generic fashion, from any SCSI device.
## This is extremly dangerous as it can bypass the
## SELinux protections for filesystem objects, and
## should only be used by trusted domains.
## </description>
## <parameter position="1" name="domain">
## The type of the process performing this action.
## </parameter>
## <infoflow type="read" weight="10"/>
## </interface>
#
define(`storage_read_scsi_generic',`
requires_block_template(`$0'_depend)
@ -117,9 +207,20 @@ attribute scsi_generic_read;
class blk_file { getattr read ioctl };
')
########################################
#
# storage_write_scsi_generic(domain)
## <interface name="storage_write_scsi_generic">
## <description>
## Allow the caller to directly write, in a
## generic fashion, from any SCSI device.
## This is extremly dangerous as it can bypass the
## SELinux protections for filesystem objects, and
## should only be used by trusted domains.
## </description>
## <parameter position="1" name="domain">
## The type of the process performing this action.
## </parameter>
## <infoflow type="write" weight="10"/>
## </interface>
#
define(`storage_write_scsi_generic',`
requires_block_template(`$0'_depend)
@ -164,6 +265,66 @@ type scsi_generic_device_t;
class blk_file setattr;
')
#
## <interface name="storage_get_removable_device_attributes">
## <description>
## Allow the caller to get the attributes of removable
## devices device nodes.
## </description>
## <parameter position="1" name="domain">
## The type of the process performing this action.
## </parameter>
## <infoflow type="read" weight="7"/>
## </interface>
#
define(`storage_get_removable_device_attributes',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
allow $1 removable_device_t:blk_file getattr;
')
define(`storage_get_removable_device_attributes_depend',`
type removable_device_t;
class blk_file getattr;
')
#
## <interface name="storage_ignore_get_removable_device_attributes">
## <description>
## Do not audit attempts made by the caller to get
## the attributes of removable devices device nodes.
## </description>
## <parameter position="1" name="domain">
## The type of the process to not audit.
## </parameter>
## <infoflow type="none"/>
## </interface>
#
define(`storage_ignore_get_removable_device_attributes',`
requires_block_template(`$0'_depend)
dontaudit $1 removable_device_t:blk_file getattr;
')
define(`storage_ignore_get_removable_device_attributes_depend',`
type removable_device_t;
class blk_file getattr;
')
########################################
#
# storage_set_removable_device_attributes(domain)
#
define(`storage_set_removable_device_attributes',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
allow $1 removable_device_t:blk_file setattr;
')
define(`storage_set_removable_device_attributes_depend',`
type removable_device_t;
class blk_file setattr;
')
########################################
#
# storage_raw_read_removable_device(domain)
@ -194,36 +355,6 @@ type removable_device_t;
class blk_file { getattr write ioctl };
')
########################################
#
# storage_get_removable_device_attributes(domain)
#
define(`storage_get_removable_device_attributes',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
allow $1 removable_device_t:blk_file getattr;
')
define(`storage_get_removable_device_attributes_depend',`
type removable_device_t;
class blk_file getattr;
')
########################################
#
# storage_set_removable_device_attributes(domain)
#
define(`storage_set_removable_device_attributes',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
allow $1 removable_device_t:blk_file setattr;
')
define(`storage_set_removable_device_attributes_depend',`
type removable_device_t;
class blk_file setattr;
')
########################################
#
# storage_read_tape_device(domain)
@ -283,3 +414,5 @@ define(`storage_set_tape_device_attributes_depend',`
type tape_device_t;
class blk_file setattr;
')
## </interfaces>

124
refpolicy/policy/modules/kernel/terminal.if
View File

@ -2,27 +2,87 @@
########################################
#
# terminal_make_pseudoterminal(domain,ptytype)
# terminal_make_pseudoterminal(type)
#
define(`terminal_make_pseudoterminal',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1,optional)
allow $1 ptmx_t:chr_file { getattr read write };
allow $1 devpts_t:dir { getattr search read };
allow $1 devpts_t:filesystem getattr;
allow $2 devpts_t:filesystem associate;
dontaudit $1 bsdpty_device_t:chr_file { getattr read write };
type_transition $1 devpts_t:chr_file $2;
typeattribute $2 ptynode;
allow $1 devpts_t:filesystem associate;
typeattribute $1 ptynode;
')
define(`terminal_make_pseudoterminal_depend',`
attribute ptynode;
type devpts_t;
class filesystem associate;
')
########################################
#
# terminal_make_user_pseudoterminal(domain,type)
#
define(`terminal_make_user_pseudoterminal',`
requires_block_template(`$0'_depend)
terminal_make_pseudoterminal($1)
type_change $1 server_ptynode:chr_file $2;
')
define(`terminal_make_user_pseudoterminal_depend',`
attribute server_ptynode;
')
########################################
#
# terminal_make_service_pseudoterminal(type)
#
define(`terminal_make_service_pseudoterminal',`
requires_block_template(`$0'_depend)
terminal_make_pseudoterminal($1)
typeattribute $1 server_ptynode;
')
define(`terminal_make_service_pseudoterminal_depend',`
attribute server_ptynode;
')
########################################
#
# terminal_make_physical_terminal(domain,type)
#
define(`terminal_make_physical_terminal',`
requires_block_template(`$0'_depend)
typeattribute $2 ttynode;
type_change $1 tty_device_t:chr_file $2;
# Debian login is from shadow utils and does not allow resetting the perms.
# have to fix this!
tunable_policy(`distro_debian',`
type_change $1 ttyfile:chr_file $2;
')
')
define(`terminal_make_physical_terminal_depend',`
attribute ttynode;
type tty_device_t;
')
########################################
#
# terminal_create_private_pseudoterminal(domain,ptytype)
#
define(`terminal_create_private_pseudoterminal',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
allow $1 ptmx_t:chr_file { getattr read write };
allow $1 devpts_t:dir { getattr search read };
allow $1 devpts_t:filesystem getattr;
dontaudit $1 bsdpty_device_t:chr_file { getattr read write };
type_transition $1 devpts_t:chr_file $2;
')
define(`terminal_create_pseudoterminal_depend',`
type ptmx_t, devpts_t;
class filesystem { getattr associate };
class filesystem getattr;
class dir { getattr search read };
class chr_file { getattr read write };
devices_list_device_nodes_depend
')
########################################
@ -179,16 +239,16 @@ class chr_file { getattr read write };
########################################
#
# terminal_get_all_users_pseudoterminal_attributes(domain)
# terminal_get_all_private_pseudoterminal_attributes(domain)
#
define(`terminal_get_all_users_pseudoterminal_attributes',`
define(`terminal_get_all_private_pseudoterminal_attributes',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
allow $1 devpts_t:dir { getattr search read };
allow $1 ptynode:chr_file getattr;
')
define(`terminal_get_all_users_pseudoterminal_attributes_depend',`
define(`terminal_get_all_private_pseudoterminal_attributes_depend',`
attribute ptynode;
class dir { getattr search read };
class chr_file getattr;
@ -196,16 +256,16 @@ class chr_file getattr;
########################################
#
# terminal_use_all_users_pseudoterminals(domain)
# terminal_use_all_private_pseudoterminals(domain)
#
define(`terminal_use_all_users_pseudoterminals',`
define(`terminal_use_all_private_pseudoterminals',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
allow $1 devpts_t:dir { getattr read search };
allow $1 ptynode:chr_file { read write };
')
define(`terminal_use_all_users_pseudoterminals_depend',`
define(`terminal_use_all_private_pseudoterminals_depend',`
attribute ptynode;
class dir { getattr search read };
class chr_file { read write };
@ -213,14 +273,14 @@ class chr_file { read write };
########################################
#
# terminal_ignore_use_all_users_pseudoterminals(domain)
# terminal_ignore_use_all_private_pseudoterminals(domain)
#
define(`terminal_ignore_use_all_users_pseudoterminals',`
define(`terminal_ignore_use_all_private_pseudoterminals',`
requires_block_template(`$0'_depend)
dontaudit $1 ptynode:chr_file { read write };
')
define(`terminal_ignore_use_all_users_pseudoterminals_depend',`
define(`terminal_ignore_use_all_private_pseudoterminals_depend',`
attribute ptynode;
class chr_file { read write };
')
@ -304,58 +364,58 @@ class chr_file { read write };
########################################
#
# terminal_get_all_users_physical_terminal_attributes(domain)
# terminal_get_all_private_physical_terminal_attributes(domain)
#
define(`terminal_get_all_users_physical_terminal_attributes',`
define(`terminal_get_all_private_physical_terminal_attributes',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
allow $1 ttynode:chr_file getattr;
')
define(`terminal_get_all_users_physical_terminal_attributes_depend',`
define(`terminal_get_all_private_physical_terminal_attributes_depend',`
attribute ttynode;
class chr_file getattr;
')
########################################
#
# terminal_ignore_get_all_users_physical_terminal_attributes(domain)
# terminal_ignore_get_all_private_physical_terminal_attributes(domain)
#
define(`terminal_ignore_get_all_users_physical_terminal_attributes',`
define(`terminal_ignore_get_all_private_physical_terminal_attributes',`
requires_block_template(`$0'_depend)
dontaudit $1 ttynode:chr_file getattr;
')
define(`terminal_ignore_get_all_users_physical_terminal_attributes_depend',`
define(`terminal_ignore_get_all_private_physical_terminal_attributes_depend',`
attribute ttynode;
class chr_file getattr;
')
########################################
#
# terminal_use_all_users_physical_terminals(domain)
# terminal_use_all_private_physical_terminals(domain)
#
define(`terminal_use_all_users_physical_terminals',`
define(`terminal_use_all_private_physical_terminals',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
allow $1 ttynode:chr_file { read write };
')
define(`terminal_use_all_users_physical_terminals_depend',`
define(`terminal_use_all_private_physical_terminals_depend',`
attribute ttynode;
class chr_file { read write };
')
########################################
#
# terminal_ignore_use_all_users_physical_terminals(domain)
# terminal_ignore_use_all_private_physical_terminals(domain)
#
define(`terminal_ignore_use_all_users_physical_terminals',`
define(`terminal_ignore_use_all_private_physical_terminals',`
requires_block_template(`$0'_depend)
dontaudit $1 ttynode:chr_file { read write };
')
define(`terminal_ignore_use_all_users_physical_terminals_depend',`
define(`terminal_ignore_use_all_private_physical_terminals_depend',`
attribute ttynode;
class chr_file { read write };
')

1
refpolicy/policy/modules/kernel/terminal.te
View File

@ -4,6 +4,7 @@ policy_module(terminal,1.0)
attribute ttynode;
attribute ptynode;
attribute server_ptynode;
#
# bsdpty_device_t is the type of /dev/[tp]ty[abcdepqrstuvwxyz][0-9a-f]

16
refpolicy/policy/modules/services/mta.if
View File

@ -218,6 +218,22 @@ type etc_aliases_t;
class file { getattr read write append setattr };
')
#######################################
#
# mta_modify_mail_spool(domain)
#
define(`mta_modify_mail_spool',`
requires_block_template(`$0'_depend)
allow $1 mail_spool_t:dir { read getattr lock search ioctl add_name remove_name write };
allow $1 mail_spool_t:file { getattr read write append setattr };
')
define(`mta_modify_mail_spool_depend',`
type mail_spool_t;
class dir { read getattr lock search ioctl add_name remove_name write };
class file { create ioctl read getattr lock write setattr append link unlink rename };
')
#######################################
#
# mta_manage_mail_spool(domain)

59
refpolicy/policy/modules/system/authlogin.if
View File

@ -134,21 +134,6 @@ class process transition;
class udp_socket { create ioctl read getattr write setattr append bind getopt setopt shutdown connect };
')
#######################################
#
# authlogin_modify_login_records(domain)
#
define(`authlogin_modify_login_records',`
requires_block_template(`$0'_depend)
logging_search_system_log_directory($1)
allow $1 wtmp_t:file { getattr read write setattr };
')
define(`authlogin_modify_login_records_depend',`
type wtmp_t;
class file { getattr read write setattr };
')
#######################################
#
# authlogin_read_shadow_passwords(domain)
@ -373,3 +358,47 @@ class dir { read getattr lock search ioctl add_name remove_name write };
class file { create ioctl read getattr lock write setattr append link unlink rename };
class lnk_file { create read getattr setattr link unlink rename };
')
#######################################
#
# authlogin_read_login_records(domain)
#
define(`authlogin_read_login_records',`
requires_block_template(`$0'_depend)
logging_search_system_log_directory($1)
allow $1 wtmp_t:file { getattr read };
')
define(`authlogin_read_login_records_depend',`
type wtmp_t;
class file { getattr read };
')
#######################################
#
# authlogin_ignore_write_login_records(domain)
#
define(`authlogin_ignore_write_login_records',`
requires_block_template(`$0'_depend)
dontaudit $1 wtmp_t:file write;
')
define(`authlogin_read_login_records_depend',`
type wtmp_t;
class file write;
')
#######################################
#
# authlogin_modify_login_records(domain)
#
define(`authlogin_modify_login_records',`
requires_block_template(`$0'_depend)
logging_search_system_log_directory($1)
allow $1 wtmp_t:file { getattr read write setattr };
')
define(`authlogin_modify_login_records_depend',`
type wtmp_t;
class file { getattr read write setattr };
')

12
refpolicy/policy/modules/system/authlogin.te
View File

@ -94,8 +94,8 @@ files_create_private_tmp_data(pam_t, pam_tmp_t, { file dir })
kernel_read_system_state(pam_t)
terminal_use_all_users_physical_terminals(pam_t)
terminal_use_all_users_pseudoterminals(pam_t)
terminal_use_all_private_physical_terminals(pam_t)
terminal_use_all_private_pseudoterminals(pam_t)
init_script_ignore_modify_runtime_data(pam_t)
@ -288,10 +288,10 @@ allow utempter_t self:unix_stream_socket { create ioctl read getattr write setat
allow utempter_t wtmp_t:file { ioctl read getattr lock write append };
terminal_get_all_users_physical_terminal_attributes(utempter_t)
terminal_get_all_users_pseudoterminal_attributes(utempter_t)
terminal_ignore_use_all_users_physical_terminals(utempter_t)
terminal_ignore_use_all_users_pseudoterminals(utempter_t)
terminal_get_all_private_physical_terminal_attributes(utempter_t)
terminal_get_all_private_pseudoterminal_attributes(utempter_t)
terminal_ignore_use_all_private_physical_terminals(utempter_t)
terminal_ignore_use_all_private_pseudoterminals(utempter_t)
terminal_ignore_use_pseudoterminal_multiplexer(utempter_t)
init_script_modify_runtime_data(utempter_t)

4
refpolicy/policy/modules/system/clock.te
View File

@ -39,8 +39,8 @@ filesystem_get_persistent_filesystem_attributes(hwclock_t)
terminal_ignore_use_console(hwclock_t)
terminal_use_general_physical_terminal(hwclock_t)
terminal_use_all_users_physical_terminals(hwclock_t)
terminal_use_all_users_pseudoterminals(hwclock_t)
terminal_use_all_private_physical_terminals(hwclock_t)
terminal_use_all_private_pseudoterminals(hwclock_t)
init_use_file_descriptors(hwclock_t)
init_script_use_pseudoterminal(hwclock_t)

6
refpolicy/policy/modules/system/getty.te
View File

@ -60,9 +60,3 @@ locallogin_transition(getty_t)
logging_send_system_log_message(getty_t)
miscfiles_read_localization(getty_t)
# TODO: to allow w to display everyone...
#bool user_ttyfile_stat false;
#if (user_ttyfile_stat) {
#allow userdomain ttyfile:chr_file getattr;
#}

4
refpolicy/policy/modules/system/hostname.te
View File

@ -35,8 +35,8 @@ files_ignore_search_system_state_data_directory(hostname_t)
filesystem_get_persistent_filesystem_attributes(hostname_t)
terminal_ignore_use_console(hostname_t)
terminal_use_all_users_physical_terminals(hostname_t)
terminal_use_all_users_pseudoterminals(hostname_t)
terminal_use_all_private_physical_terminals(hostname_t)
terminal_use_all_private_pseudoterminals(hostname_t)
init_use_file_descriptors(hostname_t)
init_script_use_pseudoterminal(hostname_t)

42
refpolicy/policy/modules/system/init.if
View File

@ -255,20 +255,6 @@ type initrc_t;
class fd use;
')
########################################
#
# init_script_use_pseudoterminal(domain)
#
define(`init_script_use_pseudoterminal',`
requires_block_template(`$0'_depend)
allow $1 initrc_devpts_t:chr_file { read write };
')
define(`init_script_use_pseudoterminal_depend',`
type initrc_devpts_t;
class chr_file { read write };
')
########################################
#
# init_script_get_process_group(domain)
@ -283,6 +269,34 @@ type initrc_t;
class process getpgid;
')
########################################
#
# init_script_use_pseudoterminal(domain)
#
define(`init_script_use_pseudoterminal',`
requires_block_template(`$0'_depend)
allow $1 initrc_devpts_t:chr_file { getattr read write ioctl };
')
define(`init_script_use_pseudoterminal_depend',`
type initrc_devpts_t;
class chr_file { getattr read write ioctl };
')
########################################
#
# init_script_ignore_use_pseudoterminal(domain)
#
define(`init_script_ignore_use_pseudoterminal',`
requires_block_template(`$0'_depend)
allow $1 initrc_devpts_t:chr_file { read write ioctl };
')
define(`init_script_ignore_use_pseudoterminal_depend',`
type initrc_devpts_t;
class chr_file { read write ioctl };
')
########################################
#
# init_script_read_runtime_data(domain)

2
refpolicy/policy/modules/system/init.te
View File

@ -47,7 +47,7 @@ domain_make_entrypoint_file(initrc_t,initrc_exec_t)
type initrc_devpts_t;
filesystem_associate(initrc_devpts_t)
filesystem_noxattr_associate(initrc_devpts_t)
terminal_make_pseudoterminal(initrc_t,initrc_devpts_t)
terminal_make_pseudoterminal(initrc_devpts_t)
type initrc_var_run_t;
files_make_daemon_runtime_file(initrc_var_run_t)

2
refpolicy/policy/modules/system/locallogin.te
View File

@ -65,7 +65,7 @@ kernel_compute_reachable_user_contexts(local_login_t)
# for SSP/ProPolice
devices_get_pseudorandom_data(local_login_t)
terminal_use_all_users_physical_terminals(local_login_t)
terminal_use_all_private_physical_terminals(local_login_t)
terminal_use_general_physical_terminal(local_login_t)
init_script_modify_runtime_data(local_login_t)

14
refpolicy/policy/modules/system/logging.if
View File

@ -72,6 +72,20 @@ type var_log_t;
class dir search;
')
#######################################
#
# logging_ignore_get_all_logs_attributes(domain)
#
define(`logging_ignore_get_all_logs_attributes',`
requires_block_template(`$0'_depend)
dontaudit $1 logfile:file getattr;
')
define(`logging_ignore_get_all_logs_attributes_depend',`
attribute logfile;
class file getattr;
')
#######################################
#
# logging_append_all_logs(domain)

2
refpolicy/policy/modules/system/lvm.te
View File

@ -95,7 +95,7 @@ devices_ignore_get_all_character_device_attributes(lvm_t)
devices_ignore_get_all_block_device_attributes(lvm_t)
devices_ignore_get_generic_character_device_attributes(lvm_t)
devices_ignore_get_generic_block_device_attributes(lvm_t)
terminal_ignore_get_all_users_physical_terminal_attributes(lvm_t)
terminal_ignore_get_all_private_physical_terminal_attributes(lvm_t)
filesystem_get_persistent_filesystem_attributes(lvm_t)

8
refpolicy/policy/modules/system/selinux.te
View File

@ -219,8 +219,8 @@ devices_get_pseudorandom_data(newrole_t)
filesystem_get_persistent_filesystem_attributes(newrole_t)
terminal_use_all_users_physical_terminals(newrole_t)
terminal_use_all_users_pseudoterminals(newrole_t)
terminal_use_all_private_physical_terminals(newrole_t)
terminal_use_all_private_pseudoterminals(newrole_t)
# Write to utmp.
init_script_modify_runtime_data(newrole_t)
@ -374,8 +374,8 @@ kernel_compute_reachable_user_contexts(setfiles_t)
filesystem_get_persistent_filesystem_attributes(setfiles_t)
terminal_use_all_users_physical_terminals(setfiles_t)
terminal_use_all_users_pseudoterminals(setfiles_t)
terminal_use_all_private_physical_terminals(setfiles_t)
terminal_use_all_private_pseudoterminals(setfiles_t)
terminal_use_general_physical_terminal(setfiles_t)
init_use_file_descriptors(setfiles_t)

8
refpolicy/policy/modules/system/selinuxutil.te
View File

@ -219,8 +219,8 @@ devices_get_pseudorandom_data(newrole_t)
filesystem_get_persistent_filesystem_attributes(newrole_t)
terminal_use_all_users_physical_terminals(newrole_t)
terminal_use_all_users_pseudoterminals(newrole_t)
terminal_use_all_private_physical_terminals(newrole_t)
terminal_use_all_private_pseudoterminals(newrole_t)
# Write to utmp.
init_script_modify_runtime_data(newrole_t)
@ -374,8 +374,8 @@ kernel_compute_reachable_user_contexts(setfiles_t)
filesystem_get_persistent_filesystem_attributes(setfiles_t)
terminal_use_all_users_physical_terminals(setfiles_t)
terminal_use_all_users_pseudoterminals(setfiles_t)
terminal_use_all_private_physical_terminals(setfiles_t)
terminal_use_all_private_pseudoterminals(setfiles_t)
terminal_use_general_physical_terminal(setfiles_t)
init_use_file_descriptors(setfiles_t)

8
refpolicy/policy/modules/system/sysnetwork.te
View File

@ -90,8 +90,8 @@ devices_get_pseudorandom_data(dhcpc_t)
filesystem_get_all_filesystems_attributes(dhcpc_t)
terminal_ignore_use_console(dhcpc_t)
terminal_ignore_use_all_users_physical_terminals(dhcpc_t)
terminal_ignore_use_all_users_pseudoterminals(dhcpc_t)
terminal_ignore_use_all_private_physical_terminals(dhcpc_t)
terminal_ignore_use_all_private_pseudoterminals(dhcpc_t)
terminal_ignore_use_general_physical_terminal(dhcpc_t)
init_use_file_descriptors(dhcpc_t)
@ -254,8 +254,8 @@ kernel_read_network_state(ifconfig_t)
filesystem_get_persistent_filesystem_attributes(ifconfig_t)
terminal_ignore_use_all_users_physical_terminals(ifconfig_t)
terminal_ignore_use_all_users_pseudoterminals(ifconfig_t)
terminal_ignore_use_all_private_physical_terminals(ifconfig_t)
terminal_ignore_use_all_private_pseudoterminals(ifconfig_t)
init_use_file_descriptors(ifconfig_t)
init_script_use_pseudoterminal(ifconfig_t)

562
refpolicy/policy/modules/system/userdomain.if Normal file
View File

@ -0,0 +1,562 @@
# Copyright (C) 2005 Tresys Technology, LLC
########################################
#
# Base user domain template
#
# This is common to user and admin domain
define(`base_user_domain',`
role $1_r types $1_t;
allow system_r $1_r;
allow $1_t self:capability { setgid chown fowner };
dontaudit $1_t self:capability { sys_nice fsetid };
allow $1_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem dyntransition };
allow $1_t self:process { ptrace setfscreate };
allow $1_t self:fd use;
allow $1_t self:fifo_file { read getattr lock ioctl write append };
allow $1_t self:unix_dgram_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
allow $1_t self:unix_stream_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown listen accept };
allow $1_t self:unix_dgram_socket sendto;
allow $1_t self:unix_stream_socket connectto;
allow $1_t self:shm { associate getattr setattr create destroy read write lock unix_read unix_write };
allow $1_t self:sem { associate getattr setattr create destroy read write unix_read unix_write };
allow $1_t self:msgq { associate getattr setattr create destroy read write enqueue unix_read unix_write };
allow $1_t self:msg { send receive };
dontaudit $1_t self:socket create;
# Irrelevant until we have labeled networking.
#allow $1_t self:udp_socket { sendto recvfrom };
# evolution and gnome-session try to create a netlink socket
dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
# execute files in the home directory
allow $1_t $1_home_t:file { getattr read execute execute_no_trans };
# full control of the home directory
allow $1_t $1_home_t:file { create ioctl read getattr lock write setattr append link unlink rename relabelfrom relabelto };
allow $1_t $1_home_t:lnk_file { create read getattr setattr link unlink rename relabelfrom relabelto };
allow $1_t $1_home_t:dir { create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir relabelfrom relabelto };
allow $1_t $1_home_t:sock_file { create ioctl read getattr lock write setattr append link unlink rename relabelfrom relabelto };
allow $1_t $1_home_t:fifo_file { create ioctl read getattr lock write setattr append link unlink rename relabelfrom relabelto };
allow $1_t $1_home_dir_t:dir { create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir };
type_transition $1_t $1_home_dir_t:{ file lnk_file dir sock_file fifo_file } $1_home_t;
allow $1_t $1_tmp_t:file { getattr read execute execute_no_trans };
# Bind to a Unix domain socket in /tmp.
# cjp: this is combination is not checked and should be removed
allow $1_t $1_tmp_t:unix_stream_socket name_bind;
allow $1_t $1_tty_device_t:chr_file { setattr getattr read write append ioctl lock };
allow $1_t unpriv_userdomain:fd use;
# Instantiate derived domains for a number of programs.
# These derived domains encode both information about the calling
# user domain and the program, and allow us to maintain separation
# between different instances of the program being run by different
# user domains.
per_userdomain_templates($1)
kernel_read_kernel_sysctl($1_t)
kernel_get_selinuxfs_mount_point($1_t)
# Very permissive allowing every domain to see every type.
kernel_get_sysvipc_info($1_t)
# Find CDROM devices
kernel_read_device_sysctl($1_t)
corenetwork_network_tcp_on_all_interfaces($1_t)
corenetwork_network_raw_on_all_interfaces($1_t)
corenetwork_network_udp_on_all_interfaces($1_t)
corenetwork_network_tcp_on_all_nodes($1_t)
corenetwork_network_raw_on_all_nodes($1_t)
corenetwork_network_udp_on_all_nodes($1_t)
corenetwork_network_tcp_on_all_ports($1_t)
corenetwork_network_udp_on_all_ports($1_t)
corenetwork_bind_tcp_on_all_nodes($1_t)
corenetwork_bind_udp_on_all_nodes($1_t)
# allow port_t name binding for UDP because it is not very usable otherwise
corenetwork_bind_udp_on_general_port($1_t)
devices_get_input_event($1_t)
devices_read_misc($1_t)
devices_write_misc($1_t)
devices_play_sound($1_t)
devices_record_sound_input($1_t)
devices_read_sound_mixer_levels($1_t)
devices_write_sound_mixer_levels($1_t)
devices_get_random_data($1_t)
devices_get_pseudorandom_data($1_t)
# open office is looking for the following
devices_get_direct_rendering_interface_attributes($1_t)
devices_ignore_use_direct_rendering_interface($1_t)
filesystem_get_all_filesystems_quotas($1_t)
filesystem_get_all_filesystems_attributes($1_t)
# for eject
storage_get_fixed_disk_attributes($1_t)
authlogin_read_login_records($1_t)
authlogin_ignore_write_login_records($1_t)
corecommands_execute_general_programs($1_t)
corecommands_execute_system_programs($1_t)
domain_execute_all_entrypoint_programs($1_t)
domain_use_widely_inheritable_file_descriptors($1_t)
files_execute_system_config_script($1_t)
files_read_system_source_code($1_t)
# Caused by su - init scripts
init_script_ignore_use_pseudoterminal($1_t)
libraries_use_dynamic_loader($1_t)
libraries_read_shared_libraries($1_t)
libraries_execute_dynamic_loader($1_t)
libraries_execute_library_scripts($1_t)
logging_ignore_get_all_logs_attributes($1_t)
miscfiles_read_localization($1_t)
miscfiles_manage_man_page_cache($1_t)
mta_modify_mail_spool($1_t)
if (allow_execmem) {
# Allow loading DSOs that require executable stack.
allow $1_t self:process execmem;
}
if (use_nfs_home_dirs) {
filesystem_manage_nfs_directories($1_t)
filesystem_manage_nfs_files($1_t)
filesystem_manage_nfs_symbolic_links($1_t)
filesystem_manage_nfs_named_sockets($1_t)
filesystem_manage_nfs_named_pipes($1_t)
filesystem_execute_nfs_files($1_t)
}
if (use_samba_home_dirs) {
filesystem_manage_windows_network_directories($1_t)
filesystem_manage_windows_network_files($1_t)
filesystem_manage_windows_network_symbolic_links($1_t)
filesystem_manage_windows_network_named_sockets($1_t)
filesystem_manage_windows_network_named_pipes($1_t)
filesystem_execute_windows_network_files($1_t)
}
if (user_direct_mouse) {
devices_get_mouse_input($1_t)
}
if (user_ttyfile_stat) {
terminal_get_all_private_physical_terminal_attributes($1_t)
}
ifdef(`TODO',`
# When the user domain runs ps, there will be a number of access
# denials when ps tries to search /proc. Do not audit these denials.
dontaudit $1_t domain:dir r_dir_perms;
dontaudit $1_t domain:notdevfile_class_set r_file_perms;
dontaudit $1_t domain:process { getattr getsession };
#
# Cups daemon running as user tries to write /etc/printcap
#
dontaudit $1_t usr_t:file setattr;
# Access the power device.
allow $1_t power_device_t:chr_file { getattr read write ioctl };
# Check to see if cdrom is mounted
allow $1_t mnt_t:dir { getattr search };
#
# Added to allow reading of cdrom
#
allow $1_t rpc_pipefs_t:dir getattr;
allow $1_t nfsd_fs_t:dir getattr;
allow $1_t binfmt_misc_fs_t:dir getattr;
# /initrd is left mounted, various programs try to look at it
dontaudit $1_t ramfs_t:dir getattr;
if (read_default_t) {
allow $1_t default_t:dir r_dir_perms;
allow $1_t default_t:notdevfile_class_set r_file_perms;
}
#
# Running ifconfig as a user generates the following
#
dontaudit $1_t sysctl_net_t:dir search;
dontaudit $1_t default_context_t:dir search;
r_dir_file($1_t, usercanread)
can_ypbind($1_t)
if (allow_execmod) {
# Allow text relocations on system shared libraries, e.g. libGL.
allow $1_t texrel_shlib_t:file execmod;
}
allow $1_t fs_type:dir getattr;
# old "file_browse_domain":
# Regular files/directories that are not security sensitive
dontaudit $1_t file_type - secure_file_type:dir_file_class_set getattr;
dontaudit $1_t file_type - secure_file_type:dir { read search };
# /dev
dontaudit $1_t dev_fs:dir_file_class_set getattr;
dontaudit $1_t dev_fs:dir { read search };
# /proc
dontaudit $1_t sysctl_t:dir_file_class_set getattr;
dontaudit $1_t proc_fs:dir { read search };
allow $1_t autofs_t:dir { search getattr };
can_exec($1_t, { removable_t noexattrfile } )
if (user_rw_noexattrfile) {
create_dir_file($1_t, noexattrfile)
create_dir_file($1_t, removable_t)
# Write floppies
allow $1_t removable_device_t:blk_file rw_file_perms;
allow $1_t usbtty_device_t:chr_file write;
} else {
r_dir_file($1_t, noexattrfile)
r_dir_file($1_t, removable_t)
allow $1_t removable_device_t:blk_file r_file_perms;
}
allow $1_t usbtty_device_t:chr_file read;
# GNOME checks for usb and other devices
rw_dir_file($1_t,usbfs_t)
can_exec($1_t, noexattrfile)
# for running TeX programs
r_dir_file($1_t, tetex_data_t)
can_exec($1_t, tetex_data_t)
type $1_tmpfs_t, file_type, sysadmfile, tmpfsfile;
file_type_auto_trans($1_t, tmpfs_t, $1_tmpfs_t)
allow $1_tmpfs_t tmpfs_t:filesystem associate;
# Run programs developed by other users in the same domain.
can_resmgrd_connect($1_t)
can_ypbind($1_t)
allow $1_t var_lock_t:dir search;
# Grant permissions to access the system DBus
ifdef(`dbusd.te', `
dbusd_client(system, $1)
can_network_server_tcp($1_dbusd_t)
allow $1_dbusd_t reserved_port_t:tcp_socket name_bind;
allow $1_t system_dbusd_t:dbus { send_msg acquire_svc };
dbusd_client($1, $1)
allow $1_t $1_dbusd_t:dbus { send_msg acquire_svc };
dbusd_domain($1)
ifdef(`hald.te', `
allow $1_t hald_t:dbus send_msg;
allow hald_t $1_t:dbus send_msg;
') dnl end ifdef hald.te
') dnl end ifdef dbus.te
# Gnome pannel binds to the following
ifdef(`cups.te', `
allow $1_t { cupsd_etc_t cupsd_rw_etc_t }:file { read getattr };
')
# Connect to inetd.
ifdef(`inetd.te', `
can_tcp_connect($1_t, inetd_t)
can_udp_send($1_t, inetd_t)
can_udp_send(inetd_t, $1_t)
')
# Connect to portmap.
ifdef(`portmap.te', `can_tcp_connect($1_t, portmap_t)')
# Inherit and use sockets from inetd
ifdef(`inetd.te', `
allow $1_t inetd_t:fd use;
allow $1_t inetd_t:tcp_socket rw_stream_socket_perms;
')
ifdef(`xserver.te', `
# for /tmp/.ICE-unix
file_type_auto_trans($1_t, xdm_xserver_tmp_t, $1_tmp_t, sock_file)
allow $1_t xserver_misc_device_t:{ chr_file blk_file } rw_file_perms;
')
ifdef(`xdm.te', `
# Connect to the X server run by the X Display Manager.
can_unix_connect($1_t, xdm_t)
allow $1_t xdm_tmp_t:sock_file rw_file_perms;
allow $1_t xdm_tmp_t:dir r_dir_perms;
allow $1_t xdm_tmp_t:file { getattr read };
allow $1_t xdm_xserver_tmp_t:sock_file { read write };
allow $1_t xdm_xserver_tmp_t:dir search;
allow $1_t xdm_xserver_t:unix_stream_socket connectto;
# certain apps want to read xdm.pid file
r_dir_file($1_t, xdm_var_run_t)
allow $1_t xdm_var_lib_t:file { getattr read };
allow xdm_t $1_home_dir_t:dir getattr;
ifdef(`xauth.te', `
file_type_auto_trans(xdm_t, $1_home_dir_t, $1_xauth_home_t, file)
')
# for shared memory
allow xdm_xserver_t $1_tmpfs_t:file { read write };
')dnl end ifdef xdm.te
ifdef(`rpcd.te', `
create_dir_file($1_t, nfsd_rw_t)
')
ifdef(`cardmgr.te', `
# to allow monitoring of pcmcia status
allow $1_t cardmgr_var_run_t:file { getattr read };
')
#
# Allow graphical boot to check battery lifespan
#
ifdef(`apmd.te', `
allow $1_t apmd_t:unix_stream_socket connectto;
allow $1_t apmd_var_run_t:sock_file write;
')
ifdef(`automount.te', `
allow $1_t autofs_t:dir { search getattr };
')
ifdef(`pamconsole.te', `
allow $1_t pam_var_console_t:dir search;
')
') dnl endif TODO
')dnl end base_user_domain macro
########################################
#
# User domain template
#
define(`user_domain_template', `
##############################
#
# Declarations
#
attribute $1_file_type;
type $1_t, userdomain, unpriv_userdomain; #, web_client_domain, nscd_client_domain;
domain_make_domain($1_t)
domain_make_file_descriptors_widely_inheritable($1_t)
type $1_devpts_t; # userpty_type, user_tty_type;
terminal_make_user_pseudoterminal($1_t,$1_devpts_t)
# Type for home directory.
type $1_home_dir_t; #, home_dir_type, home_type, user_home_dir_type;
files_make_file($1_home_dir_t)
# Type for files and directories in the home directory
type $1_home_t, $1_file_type; #, home_type, user_home_type;
files_make_file($1_home_t)
type $1_tmp_t, $1_file_type; #, user_tmpfile
files_make_temporary_file($1_tmp_t)
type $1_tty_device_t; #, sysadmfile, ttyfile, user_tty_type, dev_fs;
terminal_make_physical_terminal($1_t,$1_tty_device_t)
##############################
#
# Local policy
#
base_user_domain($1)
allow $1_t $1_devpts_t:chr_file { setattr ioctl read getattr lock write append };
terminal_create_private_pseudoterminal($1_t,$1_devpts_t)
# Rules used to associate a homedir as a mountpoint
allow $1_home_t self:filesystem associate;
allow $1_file_type $1_home_t:filesystem associate;
# user temporary files
allow $1_t $1_tmp_t:file { create ioctl read getattr lock write setattr append link unlink rename };
allow $1_t $1_tmp_t:lnk_file { create read getattr setattr link unlink rename };
allow $1_t $1_tmp_t:dir { create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir };
allow $1_t $1_tmp_t:sock_file { create ioctl read getattr lock write setattr append link unlink rename };
allow $1_t $1_tmp_t:fifo_file { create ioctl read getattr lock write setattr append link unlink rename };
files_create_private_tmp_data($1_t, $1_tmp_t, { file lnk_file dir sock_file fifo_file })
# privileged home directory writers
allow privhome $1_home_t:file { create ioctl read getattr lock write setattr append link unlink rename };
allow privhome $1_home_t:lnk_file { create read getattr setattr link unlink rename };
allow privhome $1_home_t:dir { create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir };
allow privhome $1_home_t:sock_file { create ioctl read getattr lock write setattr append link unlink rename };
allow privhome $1_home_t:fifo_file { create ioctl read getattr lock write setattr append link unlink rename };
type_transition privhome $1_home_dir_t:{ file lnk_file dir sock_file fifo_file } $1_home_t;
kernel_read_system_state($1_t)
kernel_read_network_state($1_t)
kernel_read_hardware_state($1_t)
# cjp: why?
bootloader_read_kernel_symbol_table($1_t)
# port access is audited even if dac would not have allowed it, so dontaudit it here
corenetwork_ignore_bind_tcp_on_all_reserved_ports($1_t)
files_read_general_system_config($1_t)
files_list_home_directories($1_t)
files_read_general_application_resources($1_t)
init_script_read_runtime_data($1_t)
# The library functions always try to open read-write first,
# then fall back to read-only if it fails.
init_script_ignore_write_runtime_data($1_t)
selinux_read_config($1_t)
if (user_dmesg) {
kernel_read_ring_buffer($1_t)
} else {
kernel_ignore_read_ring_buffer($1_t)
}
# Allow users to run TCP servers (bind to ports and accept connection from
# the same domain and outside users) disabling this forces FTP passive mode
# and may change other protocols
if (user_tcp_server) {
corenetwork_bind_tcp_on_general_port($1_t)
}
# Need the following rule to allow users to run vpnc
optional_policy(`xserver.te', `
corenetwork_bind_tcp_on_xserver_port($1_t)
')
ifdef(`TODO',`
dontaudit $1_t boot_t:lnk_file read;
dontaudit $1_t boot_t:file read;
can_kerberos($1_t)
# do not audit read on disk devices
dontaudit $1_t { removable_device_t fixed_disk_device_t }:blk_file read;
ifdef(`xdm.te', `
allow xdm_t $1_home_t:lnk_file read;
allow xdm_t $1_home_t:dir search;
#
# Changing this to dontaudit should cause the .xsession-errors file to be written to /tmp
#
dontaudit xdm_t $1_home_t:file rw_file_perms;
')dnl end ifdef xdm.te
ifdef(`ftpd.te', `
if (ftp_home_dir) {
file_type_auto_trans(ftpd_t, $1_home_dir_t, $1_home_t)
}
')dnl end ifdef ftpd
if (read_default_t) {
allow $1 default_t:dir r_dir_perms;
allow $1 default_t:notdevfile_class_set r_file_perms;
}
can_exec($1_t, usr_t)
# Read directories and files with the readable_t type.
# This type is a general type for "world"-readable files.
allow $1_t readable_t:dir r_dir_perms;
allow $1_t readable_t:notdevfile_class_set r_file_perms;
# Stat lost+found.
allow $1_t lost_found_t:dir getattr;
# Read /var, /var/spool, /var/run.
allow $1_t var_t:dir r_dir_perms;
allow $1_t var_t:notdevfile_class_set r_file_perms;
allow $1_t var_spool_t:dir r_dir_perms;
allow $1_t var_spool_t:notdevfile_class_set r_file_perms;
allow $1_t var_run_t:dir r_dir_perms;
allow $1_t var_run_t:{ file lnk_file } r_file_perms;
allow $1_t var_lib_t:dir r_dir_perms;
allow $1_t var_lib_t:file { getattr read };
# for running depmod as part of the kernel packaging process
allow $1_t modules_conf_t:file { getattr read };
# Read man directories and files.
allow $1_t man_t:dir r_dir_perms;
allow $1_t man_t:notdevfile_class_set r_file_perms;
# Allow users to rw usb devices
if (user_rw_usb) {
rw_dir_create_file($1_t,usbdevfs_t)
} else {
r_dir_file($1_t,usbdevfs_t)
}
# Read /dev directories and any symbolic links.
allow $1_t device_t:dir r_dir_perms;
allow $1_t device_t:lnk_file r_file_perms;
# Do not audit write denials to /etc/ld.so.cache.
dontaudit $1_t ld_so_cache_t:file write;
dontaudit $1_t sysadm_home_t:file { read append };
ifdef(`syslogd.te', `
# Some programs that are left in $1_t will try to connect
# to syslogd, but we do not want to let them generate log messages.
# Do not audit.
dontaudit $1_t devlog_t:sock_file { read write };
dontaudit $1_t syslogd_t:unix_dgram_socket sendto;
')
# Stop warnings about access to /dev/console
dontaudit $1_t init_t:fd use;
dontaudit $1_t initrc_t:fd use;
allow $1_t initrc_t:fifo_file write;
ifdef(`user_can_mount', `
#
# Allow users to mount file systems like floppies and cdrom
#
mount_domain($1, $1_mount, `, fs_domain')
r_dir_file($1_t, mnt_t)
allow $1_mount_t device_t:lnk_file read;
allow $1_mount_t removable_device_t:blk_file read;
allow $1_mount_t iso9660_t:filesystem relabelfrom;
allow $1_mount_t removable_t:filesystem { mount relabelto };
allow $1_mount_t removable_t:dir mounton;
ifdef(`xdm.te', `
allow $1_mount_t xdm_t:fd use;
allow $1_mount_t xdm_t:fifo_file { read write };
')
')
') dnl end TODO
')

79
refpolicy/policy/modules/system/userdomain.te Normal file
View File

@ -0,0 +1,79 @@
# Copyright (C) 2005 Tresys Technology, LLC
policy_module(userdomain,1.0)
########################################
#
# Declarations
#
# The privhome attribute identifies every domain that can create files under
# regular user home directories in the regular context (IE act on behalf of
# a user in writing regular files)
attribute privhome;
# all user domains
attribute userdomain;
# unprivileged user domains
attribute unpriv_userdomain;
# Allow execution of anonymous mappings, e.g. executable stack.
bool allow_execmem false;
# Support Share libraries with Text Relocation
bool allow_execmod false;
# Allow system to run with kerberos
bool allow_kerberos false;
# Allow system to run with NIS
bool allow_ypbind false;
# Allow reading of default_t files.
bool read_default_t false;
# Allow staff_r users to search the sysadm home dir and read
# files (such as ~/.bashrc)
bool staff_read_sysadm_file false;
# Support NFS home directories
bool use_nfs_home_dirs false;
# Support SAMBA home directories
bool use_samba_home_dirs false;
# Allow regular users direct mouse access
bool user_direct_mouse false;
# Allow users to read system messages.
bool user_dmesg false;
# Allow users to control network interfaces (also needs USERCTL=true)
bool user_net_control false;
# Allow user to r/w noextattrfile (FAT, CDROM, FLOPPY)
bool user_rw_noexattrfile false;
# Allow users to rw usb devices
bool user_rw_usb false;
# Allow users to run TCP servers (bind to ports and accept connection from
# the same domain and outside users) disabling this forces FTP passive mode
# and may change other protocols
bool user_tcp_server false;
# Allow w to display everyone
bool user_ttyfile_stat false;
user_domain_template(staff)
user_domain_template(user)
type sysadm_t;
domain_make_domain(sysadm_t)
per_userdomain_templates(sysadm)
########################################
#
# Local policy
#