rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

part of dan's mega patch

Browse Source
This commit is contained in:
Chris PeBenito 2006-01-06 22:51:40 +00:00
parent 8cffa78840
commit bf080a46c8
71 changed files with 941 additions and 727 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
refpolicy/Rules.modular
View File

@ -91,7 +91,7 @@ tmp/base.mod: base.conf
# Construct a base.conf
#
base.conf: $(BASE_SECTIONS)
@echo "Creating $(NAME) base module policy.conf"
@echo "Creating $(NAME) base module base.conf"
# checkpolicy can use the #line directives provided by -s for error reporting:
$(QUIET) m4 -D self_contained_policy $(M4PARAM) -s $^ > tmp/$@.tmp
$(QUIET) sed -e /^portcon/d -e /^nodecon/d -e /^netifcon/d < tmp/$@.tmp > $@
@ -168,6 +168,16 @@ endif
@test -d tmp || mkdir -p tmp
$(QUIET) m4 $(M4PARAM) $^ > $@
########################################
#
# Remove the dontaudit rules from the base.conf
#
enableaudit: base.conf
@test -d tmp || mkdir -p tmp
@echo "Removing dontaudit rules from base.conf"
$(QUIET) grep -v dontaudit base.conf > tmp/base.audit
$(QUIET) mv tmp/base.audit base.conf
########################################
#
# Appconfig files

6
refpolicy/config/appconfig-strict-mcs/default_type
View File

@ -1,3 +1,3 @@
sysadm_r:sysadm_t:s0
staff_r:staff_t:s0
user_r:user_t:s0
sysadm_r:sysadm_t
staff_r:staff_t
user_r:user_t

7
refpolicy/config/appconfig-strict-mls/default_type
View File

@ -1,3 +1,4 @@
sysadm_r:sysadm_t:s0
staff_r:staff_t:s0
user_r:user_t:s0
sysadm_r:sysadm_t
secadm_r:secadm_t
staff_r:staff_t
user_r:user_t

2
refpolicy/config/appconfig-strict-mls/initrc_context
View File

@ -1 +1 @@
system_u:system_r:initrc_t:s0
system_u:system_r:initrc_t:s0-s15:c0.c255

2
refpolicy/config/appconfig-targeted-mcs/default_type
View File

@ -1 +1 @@
system_r:unconfined_t:s0
system_r:unconfined_t

2
refpolicy/config/appconfig-targeted-mls/default_type
View File

@ -1 +1 @@
system_r:unconfined_t:s0
system_r:unconfined_t

2
refpolicy/config/appconfig-targeted-mls/initrc_context
View File

@ -1 +1 @@
user_u:system_r:unconfined_t:s0
user_u:system_r:unconfined_t:s0-s15:c0.c255

56
refpolicy/man/man8/ftpd_selinux.8 Normal file
View File

@ -0,0 +1,56 @@
.TH "ftpd_selinux" "8" "17 Jan 2005" "dwalsh@redhat.com" "ftpd Selinux Policy documentation"
.SH "NAME"
ftpd_selinux \- Security Enhanced Linux Policy for the ftp daemon
.SH "DESCRIPTION"
Security-Enhanced Linux secures the ftpd server via flexible mandatory access
control.
.SH FILE_CONTEXTS
SELinux requires files to have an extended attribute to define the file type.
Policy governs the access daemons have to these files.
If you want to share files anonymously, you must label the files and directories public_content_t. So if you created a special directory /var/ftp, you would need to label the directory with the chcon tool.
.TP
chcon -R -t public_content_t /var/ftp
.TP
If you want to setup a directory where you can upload files to you must label the files and directories ftpd_anon_rw_t. So if you created a special directory /var/ftp/incoming, you would need to label the directory with the chcon tool.
.TP
chcon -t public_content_rw_t /var/ftp/incoming
.TP
You must also turn on the boolean allow_ftp_anon_write.
.TP
setsebool -P allow_ftp_anon_write=1
.TP
If you want to make this permanant, i.e. survive a relabel, you must add an entry to the file_contexts.local file.
.TP
/etc/selinux/POLICYTYPE/contexts/files/file_contexts.local
.br
/var/ftp(/.*)? system_u:object_r:public_content_t
/var/ftp/incoming(/.*)? system_u:object_r:public_content_rw_t
.SH BOOLEANS
SELinux ftp daemon policy is customizable based on least access required. So by
default SElinux does not allow users to login and read their home directories.
.br
If you are setting up this machine as a ftpd server and wish to allow users to access their home
directorories, you need to set the ftp_home_dir boolean.
.TP
setsebool -P ftp_home_dir 1
.TP
ftpd can run either as a standalone daemon or as part of the xinetd domain. If you want to run ftpd as a daemon you must set the ftpd_is_daemon boolean.
.TP
setsebool -P ftpd_is_daemon 1
.TP
You can disable SELinux protection for the ftpd daemon by executing:
.TP
setsebool -P ftpd_disable_trans 1
.br
service vsftpd restart
.TP
system-config-securitylevel is a GUI tool available to customize SELinux policy settings.
.SH AUTHOR
This manual page was written by Dan Walsh <dwalsh@redhat.com>.
.SH "SEE ALSO"
selinux(8), ftpd(8), chcon(1), setsebool(8)

123
refpolicy/man/man8/httpd_selinux.8 Normal file
View File

@ -0,0 +1,123 @@
.TH "httpd_selinux" "8" "17 Jan 2005" "dwalsh@redhat.com" "httpd Selinux Policy documentation"
.SH "NAME"
httpd_selinux \- Security Enhanced Linux Policy for the httpd daemon
.SH "DESCRIPTION"
Security-Enhanced Linux secures the httpd server via flexible mandatory access
control.
.SH FILE_CONTEXTS
SELinux requires files to have an extended attribute to define the file type.
Policy governs the access daemons have to these files.
SELinux httpd policy is very flexible allowing users to setup their web services in as secure a method as possible.
.TP
The following file contexts types are defined for httpd:
.br
httpd_sys_content_t
.br
- Set files with httpd_sys_content_t for content which is available from all httpd scripts and the daemon.
.br
httpd_sys_script_exec_t
.br
- Set cgi scripts with httpd_sys_script_exec_t to allow them to run with access to all sys types.
.br
httpd_sys_script_ro_t
.br
- Set files with httpd_sys_script_ro_t if you want httpd_sys_script_exec_t scripts to read the data, and disallow other sys scripts from access.
.br
httpd_sys_script_rw_t
.br
- Set files with httpd_sys_script_rw_t if you want httpd_sys_script_exec_t scripts to read/write the data, and disallow other non sys scripts from access.
.br
httpd_sys_script_ra_t
.br
- Set files with httpd_sys_script_ra_t if you want httpd_sys_script_exec_t scripts to read/append to the file, and disallow other non sys scripts from access.
httpd_unconfined_script_exec_t
.br
- Set cgi scripts with httpd_unconfined_script_exec_t to allow them to run without any SELinux protection. This should only be used for a very complex httpd scripts, after exhausting all other options. It is better to use this script rather than turning off SELinux protection for httpd.
.br
.SH NOTE
With certain policies you can define addional file contexts based on roles like user or staff. httpd_user_script_exec_t can be defined where it would only have access to "user" contexts.
.SH SHARING FILES
If you want to share files with multiple domains (Apache, FTP, rsync, Samba), you can set a file context of public_content_t and public_content_rw_t. These context allow any of the above domains to read the content. If you want a particular domain to write to the public_content_rw_t domain, you must set the appropriate boolean. allow_DOMAIN_anon_write. So for httpd you would execute:
setsebool -P allow_httpd_anon_write=1
or
setsebool -P allow_httpd_sys_script_anon_write=1
.SH BOOLEANS
SELinux policy is customizable based on least access required. So by
default SElinux prevents certain http scripts from working. httpd policy is extremely flexible and has several booleans that allow you to manipulate the policy and run httpd with the tightest access possible.
.TP
httpd can be setup to allow cgi scripts to be executed, set httpd_enable_cgi to allow this
.br
setsebool -P httpd_enable_cgi 1
.TP
httpd by default is not allowed to access users home directories. If you want to allow access to users home directories you need to set the httpd_enable_homedirs boolean and change the context of the files that you want people to access off the home dir.
.br
setsebool -P httpd_enable_homedirs 1
.br
chcon -R -t httpd_sys_content_t ~user/public_html
.TP
httpd by default is not allowed access to the controling terminal. In most cases this is prefered, because an intruder might be able to use the access to the terminal to gain privileges. But in certain situations httpd needs to prompt for a password to open a certificate file, in these cases, terminal access is required. Set the httpd_tty_comm boolean to allow terminal access.
.br
setsebool -P httpd_tty_comm 1
.TP
httpd can be configured to not differentiate file controls based on context, i.e. all files labeled as httpd context can be read/write/execute. Setting this boolean to false allows you to setup the security policy such that one httpd service can not interfere with another.
.br
setsebool -P httpd_unified 0
.TP
httpd can be configured to turn off internal scripting (PHP). PHP and other
loadable modules run under the same context as httpd. Therefore several policy rules allow httpd greater access to the system then is needed if you only use external cgi scripts.
.br
setsebool -P httpd_builtin_scripting 0
.TP
httpd scripts by default are not allowed to connect out to the network.
This would prevent a hacker from breaking into you httpd server and attacking
other machines. If you need scripts to be able to connect you can set the httpd_can_network_connect boolean on.
.br
setsebool -P httpd_can_network_connect 1
.TP
You can disable suexec transition, set httpd_suexec_disable_trans deny this
.br
setsebool -P httpd_suexec_disable_trans 1
.TP
You can disable SELinux protection for the httpd daemon by executing:
.br
setsebool -P httpd_disable_trans 1
.br
service httpd restart
.TP
system-config-securitylevel is a GUI tool available to customize SELinux policy settings.
.SH AUTHOR
This manual page was written by Dan Walsh <dwalsh@redhat.com>.
.SH "SEE ALSO"
selinux(8), httpd(8), chcon(1), setsebool(8)

31
refpolicy/man/man8/kerberos_selinux.8 Normal file
View File

@ -0,0 +1,31 @@
.TH "kerberos_selinux" "8" "17 Jan 2005" "dwalsh@redhat.com" "kerberos Selinux Policy documentation"
.SH "NAME"
kerberos_selinux \- Security Enhanced Linux Policy for Kerberos.
.SH "DESCRIPTION"
Security-Enhanced Linux secures the system via flexible mandatory access
control. By default Kerberos access is not allowed, since it requires daemons to be allowed greater access to certain secure files and addtional access to the network.
.SH BOOLEANS
.TP
You must set the allow_kerberos boolean to allow your system to work properly in a Kerberos environment.
.TP
setsebool -P allow_kerberos 1
.TP
If you are running Kerberos daemons kadmind or krb5kdc you can disable the SELinux protection on these daemons by setting the krb5kdc_disable_trans and kadmind_disable_trans booleans.
.br
setsebool -P krb5kdc_disable_trans 1
.br
service krb5kdc restart
.br
setsebool -P kadmind_disable_trans booleans 1
.br
service kadmind restart
.TP
system-config-securitylevel is a GUI tool available to customize SELinux policy settings.
.SH AUTHOR
This manual page was written by Dan Walsh <dwalsh@redhat.com>.
.SH "SEE ALSO"
selinux(8), kerberos(1), chcon(1), setsebool(8)

29
refpolicy/man/man8/named_selinux.8 Normal file
View File

@ -0,0 +1,29 @@
.TH "named_selinux" "8" "17 Jan 2005" "dwalsh@redhat.com" "named Selinux Policy documentation"
.SH "NAME"
named_selinux \- Security Enhanced Linux Policy for the Internet Name server (named) daemon
.SH "DESCRIPTION"
Security-Enhanced Linux secures the named server via flexible mandatory access
control.
.SH BOOLEANS
SELinux policy is customizable based on least access required. So by
default SElinux policy does not allow named to write master zone files. If you want to have named update the master zone files you need to set the named_write_master_zones boolean.
.TP
.br
setsebool -P named_write_master_zones 1
.TP
You can disable SELinux protection for the named daemon by executing:
.TP
setsebool -P named_disable_trans 1
.br
service named restart
.TP
system-config-securitylevel is a GUI tool available to customize SELinux policy settings.
.SH AUTHOR
This manual page was written by Dan Walsh <dwalsh@redhat.com>.
.SH "SEE ALSO"
selinux(8), named(8), chcon(1), setsebool(8)

30
refpolicy/man/man8/nfs_selinux.8 Normal file
View File

@ -0,0 +1,30 @@
.TH "nfs_selinux" "8" "17 Jan 2005" "dwalsh@redhat.com" "nfs Selinux Policy documentation"
.SH "NAME"
nfs_selinux \- Security Enhanced Linux Policy for NFS
.SH "DESCRIPTION"
Security-Enhanced Linux secures the nfs server via flexible mandatory access
control.
.SH BOOLEANS
SELinux policy is customizable based on least access required. So by
default SElinux policy does not allow nfs to share files. If you want to
setup this machine to share nfs partitions read only, you must set the boolean nfs_export_all_ro boolean.
.TP
setsebool -P nfs_export_all_ro 1
.TP
If you want to share files read/write you must set the nfs_export_all_rw boolean.
.TP
setsebool -P nfs_export_all_rw 1
.TP
If you want to use a remote NFS server for the home directories on this machine, you must set the use_nfs_home_dir boolean.
.TP
setsebool -P use_nfs_home_dirs 1
.TP
system-config-securitylevel is a GUI tool available to customize SELinux policy settings.
.SH AUTHOR
This manual page was written by Dan Walsh <dwalsh@redhat.com>.
.SH "SEE ALSpppO"
selinux(8), chcon(1), setsebool(8)

1
refpolicy/man/man8/nis_selinux.8 Normal file
View File

@ -0,0 +1 @@
.so man8/ypbind_selinux.8

41
refpolicy/man/man8/rsync_selinux.8 Normal file
View File

@ -0,0 +1,41 @@
.TH "rsync_selinux" "8" "17 Jan 2005" "dwalsh@redhat.com" "rsync Selinux Policy documentation"
.SH "NAME"
rsync_selinux \- Security Enhanced Linux Policy for the rsync daemon
.SH "DESCRIPTION"
Security-Enhanced Linux secures the rsync server via flexible mandatory access
control.
.SH FILE_CONTEXTS
SELinux requires files to have an extended attribute to define the file type.
Policy governs the access daemons have to these files.
If you want to share files using the rsync daemon, you must label the files and directories public_content_t. So if you created a special directory /var/rsync, you
would need to label the directory with the chcon tool.
.TP
chcon -t public_content_t /var/rsync
.TP
If you want to make this permanant, i.e. survive a relabel, you must add an entry to the file_contexts.local file.
.TP
/etc/selinux/POLICYTYPE/contexts/files/file_contexts.local
.br
/var/rsync(/.*)? system_u:object_r:public_content_t
.SH SHARING FILES
If you want to share files with multiple domains (Apache, FTP, rsync, Samba), you can set a file context of public_content_t and public_content_rw_t. These context allow any of the above domains to read the content. If you want a particular domain to write to the public_content_rw_t domain, you must set the appropriate boolean. allow_DOMAIN_anon_write. So for rsync you would execute:
setsebool -P allow_rsync_anon_write=1
.SH BOOLEANS
.TP
You can disable SELinux protection for the rsync daemon by executing:
.TP
setsebool -P rsync_disable_trans 1
.br
service xinetd restart
.TP
system-config-securitylevel is a GUI tool available to customize SELinux policy settings.
.SH AUTHOR
This manual page was written by Dan Walsh <dwalsh@redhat.com>.
.SH "SEE ALSO"
selinux(8), rsync(1), chcon(1), setsebool(8)

60
refpolicy/man/man8/samba_selinux.8 Normal file
View File

@ -0,0 +1,60 @@
.TH "samba_selinux" "8" "17 Jan 2005" "dwalsh@redhat.com" "Samba Selinux Policy documentation"
.SH "NAME"
samba_selinux \- Security Enhanced Linux Policy for Samba
.SH "DESCRIPTION"
Security-Enhanced Linux secures the Samba server via flexible mandatory access
control.
.SH FILE_CONTEXTS
SELinux requires files to have an extended attribute to define the file type.
Policy governs the access daemons have to these files.
If you want to share files other than home directories, those files must be
labeled samba_share_t. So if you created a special directory /var/eng, you
would need to label the directory with the chcon tool.
.TP
chcon -t samba_share_t /var/eng
.TP
If you want to make this permanant, i.e. survive a relabel, you must add an entry to the file_contexts.local file.
.TP
/etc/selinux/POLICYTYPE/contexts/files/file_contexts.local
.br
/var/eng(/.*)? system_u:object_r:samba_share_t
.SH SHARING FILES
If you want to share files with multiple domains (Apache, FTP, rsync, Samba), you can set a file context of public_content_t and public_content_rw_t. These context allow any of the above domains to read the content. If you want a particular domain to write to the public_content_rw_t domain, you must set the appropriate boolean. allow_DOMAIN_anon_write. So for samba you would execute:
setsebool -P allow_smb_anon_write=1
.SH BOOLEANS
.br
SELinux policy is customizable based on least access required. So by
default SElinux policy turns off SELinux sharing of home directories and
the use of Samba shares from a remote machine as a home directory.
.TP
If you are setting up this machine as a Samba server and wish to share the home directories, you need to set the samba_enable_home_dirs boolean.
.br
setsebool -P samba_enable_home_dirs 1
.TP
If you want to use a remote Samba server for the home directories on this machine, you must set the use_samba_home_dirs boolean.
.br
setsebool -P use_samba_home_dirs 1
.TP
You can disable SELinux protection for the samba daemon by executing:
.br
setsebool -P smbd_disable_trans 1
.br
service smb restart
.TP
system-config-securitylevel is a GUI tool available to customize SELinux policy settings.
.SH AUTHOR
This manual page was written by Dan Walsh <dwalsh@redhat.com>.
.SH "SEE ALSO"
selinux(8), samba(7), chcon(1), setsebool(8)

19
refpolicy/man/man8/ypbind_selinux.8 Normal file
View File

@ -0,0 +1,19 @@
.TH "ypbind_selinux" "8" "17 Jan 2005" "dwalsh@redhat.com" "ypbind Selinux Policy documentation"
.SH "NAME"
ypbind_selinux \- Security Enhanced Linux Policy for NIS.
.SH "DESCRIPTION"
Security-Enhanced Linux secures the system via flexible mandatory access
control. By default NIS is not allowed, since it requires daemons to be allowed greater access to the network.
.SH BOOLEANS
.TP
You must set the allow_ypbind boolean to allow your system to work properly in a NIS environment.
.TP
setsebool -P allow_ypbind 1
.TP
system-config-securitylevel is a GUI tool available to customize SELinux policy settings.
.SH AUTHOR
This manual page was written by Dan Walsh <dwalsh@redhat.com>.
.SH "SEE ALSO"
selinux(8), ypbind(8), chcon(1), setsebool(8)

3
refpolicy/policy/global_tunables
View File

@ -9,6 +9,9 @@
# Common tunables
#
## Allow cvs daemon to read shadow
gen_tunable(allow_cvs_read_shadow,false)
## Allow making anonymous memory executable, e.g.
## for runtime-code generation or executable stack.
gen_tunable(allow_execmem,false)

321
refpolicy/policy/mcs
View File

@ -19,263 +19,70 @@ dominance { s0 }
#
# Each category has a name and zero or more aliases.
#
category c0;
category c1;
category c2;
category c3;
category c4;
category c5;
category c6;
category c7;
category c8;
category c9;
category c10;
category c11;
category c12;
category c13;
category c14;
category c15;
category c16;
category c17;
category c18;
category c19;
category c20;
category c21;
category c22;
category c23;
category c24;
category c25;
category c26;
category c27;
category c28;
category c29;
category c30;
category c31;
category c32;
category c33;
category c34;
category c35;
category c36;
category c37;
category c38;
category c39;
category c40;
category c41;
category c42;
category c43;
category c44;
category c45;
category c46;
category c47;
category c48;
category c49;
category c50;
category c51;
category c52;
category c53;
category c54;
category c55;
category c56;
category c57;
category c58;
category c59;
category c60;
category c61;
category c62;
category c63;
category c64;
category c65;
category c66;
category c67;
category c68;
category c69;
category c70;
category c71;
category c72;
category c73;
category c74;
category c75;
category c76;
category c77;
category c78;
category c79;
category c80;
category c81;
category c82;
category c83;
category c84;
category c85;
category c86;
category c87;
category c88;
category c89;
category c90;
category c91;
category c92;
category c93;
category c94;
category c95;
category c96;
category c97;
category c98;
category c99;
category c100;
category c101;
category c102;
category c103;
category c104;
category c105;
category c106;
category c107;
category c108;
category c109;
category c110;
category c111;
category c112;
category c113;
category c114;
category c115;
category c116;
category c117;
category c118;
category c119;
category c120;
category c121;
category c122;
category c123;
category c124;
category c125;
category c126;
category c127;
category c128;
category c129;
category c130;
category c131;
category c132;
category c133;
category c134;
category c135;
category c136;
category c137;
category c138;
category c139;
category c140;
category c141;
category c142;
category c143;
category c144;
category c145;
category c146;
category c147;
category c148;
category c149;
category c150;
category c151;
category c152;
category c153;
category c154;
category c155;
category c156;
category c157;
category c158;
category c159;
category c160;
category c161;
category c162;
category c163;
category c164;
category c165;
category c166;
category c167;
category c168;
category c169;
category c170;
category c171;
category c172;
category c173;
category c174;
category c175;
category c176;
category c177;
category c178;
category c179;
category c180;
category c181;
category c182;
category c183;
category c184;
category c185;
category c186;
category c187;
category c188;
category c189;
category c190;
category c191;
category c192;
category c193;
category c194;
category c195;
category c196;
category c197;
category c198;
category c199;
category c200;
category c201;
category c202;
category c203;
category c204;
category c205;
category c206;
category c207;
category c208;
category c209;
category c210;
category c211;
category c212;
category c213;
category c214;
category c215;
category c216;
category c217;
category c218;
category c219;
category c220;
category c221;
category c222;
category c223;
category c224;
category c225;
category c226;
category c227;
category c228;
category c229;
category c230;
category c231;
category c232;
category c233;
category c234;
category c235;
category c236;
category c237;
category c238;
category c239;
category c240;
category c241;
category c242;
category c243;
category c244;
category c245;
category c246;
category c247;
category c248;
category c249;
category c250;
category c251;
category c252;
category c253;
category c254;
category c255;
category c0; category c1; category c2; category c3;
category c4; category c5; category c6; category c7;
category c8; category c9; category c10; category c11;
category c12; category c13; category c14; category c15;
category c16; category c17; category c18; category c19;
category c20; category c21; category c22; category c23;
category c24; category c25; category c26; category c27;
category c28; category c29; category c30; category c31;
category c32; category c33; category c34; category c35;
category c36; category c37; category c38; category c39;
category c40; category c41; category c42; category c43;
category c44; category c45; category c46; category c47;
category c48; category c49; category c50; category c51;
category c52; category c53; category c54; category c55;
category c56; category c57; category c58; category c59;
category c60; category c61; category c62; category c63;
category c64; category c65; category c66; category c67;
category c68; category c69; category c70; category c71;
category c72; category c73; category c74; category c75;
category c76; category c77; category c78; category c79;
category c80; category c81; category c82; category c83;
category c84; category c85; category c86; category c87;
category c88; category c89; category c90; category c91;
category c92; category c93; category c94; category c95;
category c96; category c97; category c98; category c99;
category c100; category c101; category c102; category c103;
category c104; category c105; category c106; category c107;
category c108; category c109; category c110; category c111;
category c112; category c113; category c114; category c115;
category c116; category c117; category c118; category c119;
category c120; category c121; category c122; category c123;
category c124; category c125; category c126; category c127;
category c128; category c129; category c130; category c131;
category c132; category c133; category c134; category c135;
category c136; category c137; category c138; category c139;
category c140; category c141; category c142; category c143;
category c144; category c145; category c146; category c147;
category c148; category c149; category c150; category c151;
category c152; category c153; category c154; category c155;
category c156; category c157; category c158; category c159;
category c160; category c161; category c162; category c163;
category c164; category c165; category c166; category c167;
category c168; category c169; category c170; category c171;
category c172; category c173; category c174; category c175;
category c176; category c177; category c178; category c179;
category c180; category c181; category c182; category c183;
category c184; category c185; category c186; category c187;
category c188; category c189; category c190; category c191;
category c192; category c193; category c194; category c195;
category c196; category c197; category c198; category c199;
category c200; category c201; category c202; category c203;
category c204; category c205; category c206; category c207;
category c208; category c209; category c210; category c211;
category c212; category c213; category c214; category c215;
category c216; category c217; category c218; category c219;
category c220; category c221; category c222; category c223;
category c224; category c225; category c226; category c227;
category c228; category c229; category c230; category c231;
category c232; category c233; category c234; category c235;
category c236; category c237; category c238; category c239;
category c240; category c241; category c242; category c243;
category c244; category c245; category c246; category c247;
category c248; category c249; category c250; category c251;
category c252; category c253; category c254; category c255;
#
# Each MCS level specifies a sensitivity and zero or more categories which may

371
refpolicy/policy/mls
View File

@ -33,262 +33,70 @@ dominance { s0 s1 s2 s3 s4 s5 s6 s7 s8 s9 s10 s11 s12 s13 s14 s15 }
#
# Each category has a name and zero or more aliases.
#
category c0;
category c1;
category c2;
category c3;
category c4;
category c5;
category c6;
category c7;
category c8;
category c9;
category c10;
category c11;
category c12;
category c13;
category c14;
category c15;
category c16;
category c17;
category c18;
category c19;
category c20;
category c21;
category c22;
category c23;
category c24;
category c25;
category c26;
category c27;
category c28;
category c29;
category c30;
category c31;
category c32;
category c33;
category c34;
category c35;
category c36;
category c37;
category c38;
category c39;
category c40;
category c41;
category c42;
category c43;
category c44;
category c45;
category c46;
category c47;
category c48;
category c49;
category c50;
category c51;
category c52;
category c53;
category c54;
category c55;
category c56;
category c57;
category c58;
category c59;
category c60;
category c61;
category c62;
category c63;
category c64;
category c65;
category c66;
category c67;
category c68;
category c69;
category c70;
category c71;
category c72;
category c73;
category c74;
category c75;
category c76;
category c77;
category c78;
category c79;
category c80;
category c81;
category c82;
category c83;
category c84;
category c85;
category c86;
category c87;
category c88;
category c89;
category c90;
category c91;
category c92;
category c93;
category c94;
category c95;
category c96;
category c97;
category c98;
category c99;
category c100;
category c101;
category c102;
category c103;
category c104;
category c105;
category c106;
category c107;
category c108;
category c109;
category c110;
category c111;
category c112;
category c113;
category c114;
category c115;
category c116;
category c117;
category c118;
category c119;
category c120;
category c121;
category c122;
category c123;
category c124;
category c125;
category c126;
category c127;
category c128;
category c129;
category c130;
category c131;
category c132;
category c133;
category c134;
category c135;
category c136;
category c137;
category c138;
category c139;
category c140;
category c141;
category c142;
category c143;
category c144;
category c145;
category c146;
category c147;
category c148;
category c149;
category c150;
category c151;
category c152;
category c153;
category c154;
category c155;
category c156;
category c157;
category c158;
category c159;
category c160;
category c161;
category c162;
category c163;
category c164;
category c165;
category c166;
category c167;
category c168;
category c169;
category c170;
category c171;
category c172;
category c173;
category c174;
category c175;
category c176;
category c177;
category c178;
category c179;
category c180;
category c181;
category c182;
category c183;
category c184;
category c185;
category c186;
category c187;
category c188;
category c189;
category c190;
category c191;
category c192;
category c193;
category c194;
category c195;
category c196;
category c197;
category c198;
category c199;
category c200;
category c201;
category c202;
category c203;
category c204;
category c205;
category c206;
category c207;
category c208;
category c209;
category c210;
category c211;
category c212;
category c213;
category c214;
category c215;
category c216;
category c217;
category c218;
category c219;
category c220;
category c221;
category c222;
category c223;
category c224;
category c225;
category c226;
category c227;
category c228;
category c229;
category c230;
category c231;
category c232;
category c233;
category c234;
category c235;
category c236;
category c237;
category c238;
category c239;
category c240;
category c241;
category c242;
category c243;
category c244;
category c245;
category c246;
category c247;
category c248;
category c249;
category c250;
category c251;
category c252;
category c253;
category c254;
category c255;
category c0; category c1; category c2; category c3;
category c4; category c5; category c6; category c7;
category c8; category c9; category c10; category c11;
category c12; category c13; category c14; category c15;
category c16; category c17; category c18; category c19;
category c20; category c21; category c22; category c23;
category c24; category c25; category c26; category c27;
category c28; category c29; category c30; category c31;
category c32; category c33; category c34; category c35;
category c36; category c37; category c38; category c39;
category c40; category c41; category c42; category c43;
category c44; category c45; category c46; category c47;
category c48; category c49; category c50; category c51;
category c52; category c53; category c54; category c55;
category c56; category c57; category c58; category c59;
category c60; category c61; category c62; category c63;
category c64; category c65; category c66; category c67;
category c68; category c69; category c70; category c71;
category c72; category c73; category c74; category c75;
category c76; category c77; category c78; category c79;
category c80; category c81; category c82; category c83;
category c84; category c85; category c86; category c87;
category c88; category c89; category c90; category c91;
category c92; category c93; category c94; category c95;
category c96; category c97; category c98; category c99;
category c100; category c101; category c102; category c103;
category c104; category c105; category c106; category c107;
category c108; category c109; category c110; category c111;
category c112; category c113; category c114; category c115;
category c116; category c117; category c118; category c119;
category c120; category c121; category c122; category c123;
category c124; category c125; category c126; category c127;
category c128; category c129; category c130; category c131;
category c132; category c133; category c134; category c135;
category c136; category c137; category c138; category c139;
category c140; category c141; category c142; category c143;
category c144; category c145; category c146; category c147;
category c148; category c149; category c150; category c151;
category c152; category c153; category c154; category c155;
category c156; category c157; category c158; category c159;
category c160; category c161; category c162; category c163;
category c164; category c165; category c166; category c167;
category c168; category c169; category c170; category c171;
category c172; category c173; category c174; category c175;
category c176; category c177; category c178; category c179;
category c180; category c181; category c182; category c183;
category c184; category c185; category c186; category c187;
category c188; category c189; category c190; category c191;
category c192; category c193; category c194; category c195;
category c196; category c197; category c198; category c199;
category c200; category c201; category c202; category c203;
category c204; category c205; category c206; category c207;
category c208; category c209; category c210; category c211;
category c212; category c213; category c214; category c215;
category c216; category c217; category c218; category c219;
category c220; category c221; category c222; category c223;
category c224; category c225; category c226; category c227;
category c228; category c229; category c230; category c231;
category c232; category c233; category c234; category c235;
category c236; category c237; category c238; category c239;
category c240; category c241; category c242; category c243;
category c244; category c245; category c246; category c247;
category c248; category c249; category c250; category c251;
category c252; category c253; category c254; category c255;
#
@ -358,7 +166,7 @@ level s15:c0.c255;
mlsconstrain { file lnk_file fifo_file } { create relabelto }
( l2 eq h2 );
# new file labels must be dominated by the relabeling subject clearance
# new file labels must be dominated by the relabeling subjects clearance
mlsconstrain { dir file lnk_file chr_file blk_file sock_file fifo_file } relabelto
( h1 dom h2 );
@ -431,7 +239,7 @@ mlsconstrain { dir file lnk_file chr_file blk_file sock_file fifo_file } create
# MLS policy for the filesystem class
#
# new filesystem labels must be dominated by the relabeling subject clearance
# new filesystem labels must be dominated by the relabeling subjects clearance
mlsconstrain filesystem relabelto
( h1 dom h2 );
@ -457,7 +265,7 @@ mlsconstrain filesystem { mount remount unmount relabelfrom quotamod }
# MLS policy for the socket classes
#
# new socket labels must be dominated by the relabeling subject clearance
# new socket labels must be dominated by the relabeling subjects clearance
mlsconstrain { socket tcp_socket udp_socket rawip_socket netlink_socket packet_socket key_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_ip6fw_socket netlink_dnrt_socket } relabelto
( h1 dom h2 );
@ -566,7 +374,7 @@ mlsconstrain { netif node } { tcp_send udp_send rawip_send }
# MLS policy for the process class
#
# new process labels must be dominated by the relabeling subject clearance
# new process labels must be dominated by the relabeling subjects clearance
# and sensitivity level changes require privilege
mlsconstrain process transition
(( h1 dom h2 ) and
@ -686,7 +494,8 @@ mlsconstrain window { listprop getattr enumerate mousemotion inputevent draweven
mlsconstrain window { addchild create destroy chstack chproplist chprop setattr setfocus move chselection chparent ctrllife transparent clientcomevent }
(( l1 eq l2 ) or
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
( t1 == mlsxwinwrite ));
( t1 == mlsxwinwrite ) or
( t2 == mlstrustedobject ));
# these access vectors have no MLS restrictions
# window { map unmap }
@ -724,12 +533,14 @@ mlsconstrain font free
mlsconstrain colormap { list read getattr }
(( l1 dom l2 ) or
(( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
( t1 == mlsxwinreadcolormap ) or
( t1 == mlsxwinread ));
# the colormap "write" ops (implicit single level)
mlsconstrain colormap { create free install uninstall store setattr }
(( l1 eq l2 ) or
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
( t1 == mlsxwinwritecolormap ) or
( t1 == mlsxwinwrite ));
@ -743,12 +554,14 @@ mlsconstrain colormap { create free install uninstall store setattr }
mlsconstrain property { read }
(( l1 dom l2 ) or
(( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
( t1 == mlsxwinreadproperty ) or
( t1 == mlsxwinread ));
# the property "write" ops (implicit single level)
mlsconstrain property { create free write }
(( l1 eq l2 ) or
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
( t1 == mlsxwinwriteproperty ) or
( t1 == mlsxwinwrite ));
@ -784,16 +597,14 @@ mlsconstrain xclient kill
# MLS policy for the xinput class
#
# the xinput "read" ops (implicit single level)
mlsconstrain xinput { lookup getattr mousemotion }
(( l1 dom l2 ) or
(( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
( t1 == mlsxwinread ));
# these access vectors have no MLS restrictions
# xinput ~{ relabelinput setattr }
# the xinput "write" ops (implicit single level)
mlsconstrain xinput { setattr setfocus warppointer activegrab passivegrab ungrab bell relabelinput }
mlsconstrain xinput { setattr relabelinput }
(( l1 eq l2 ) or
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
( t1 == mlsxwinwritexinput ) or
( t1 == mlsxwinwrite ));
@ -803,17 +614,8 @@ mlsconstrain xinput { setattr setfocus warppointer activegrab passivegrab ungrab
# MLS policy for the xserver class
#
# the xserver "read" ops (implicit single level)
mlsconstrain xserver { gethostlist getfontpath getattr screensaver }
(( l1 dom l2 ) or
(( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
( t1 == mlsxwinread ));
# the xserver "write" ops (implicit single level)
mlsconstrain xserver { sethostlist setfontpath grab ungrab screensaver }
(( l1 eq l2 ) or
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
( t1 == mlsxwinwrite ));
# these access vectors have no MLS restrictions
# xserver *
@ -822,17 +624,8 @@ mlsconstrain xserver { sethostlist setfontpath grab ungrab screensaver }
# MLS policy for the xextension class
#
# the xextension "read" ops (implicit single level)
mlsconstrain xextension query
(( l1 dom l2 ) or
(( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
( t1 == mlsxwinread ));
# the xextension "write" ops (implicit single level)
mlsconstrain xextension use
(( l1 eq l2 ) or
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
( t1 == mlsxwinwrite ));
# these access vectors have no MLS restrictions
# xextension { query use }
#

11
refpolicy/policy/modules/admin/kudzu.te
View File

@ -1,5 +1,5 @@
policy_module(kudzu,1.0.0)
policy_module(kudzu,1.0.1)
########################################
#
@ -23,7 +23,8 @@ files_pid_file(kudzu_var_run_t)
allow kudzu_t self:capability { dac_override sys_admin sys_rawio net_admin sys_tty_config mknod };
dontaudit kudzu_t self:capability sys_tty_config;
allow kudzu_t self:process signal_perms;
allow kudzu_t self:process { signal_perms execmem };
auditallow kudzu_t self:process execmem;
allow kudzu_t self:fifo_file rw_file_perms;
allow kudzu_t self:unix_stream_socket { connectto create_stream_socket_perms };
allow kudzu_t self:unix_dgram_socket create_socket_perms;
@ -61,6 +62,8 @@ fs_search_auto_mountpoints(kudzu_t)
fs_search_ramfs(kudzu_t)
fs_write_ramfs_socket(kudzu_t)
mls_file_read_up(kudzu_t)
modutils_read_mods_deps(kudzu_t)
modutils_read_module_conf(kudzu_t)
modutils_rename_module_conf(kudzu_t)
@ -130,10 +133,6 @@ ifdef(`targeted_policy',`
unconfined_domain_template(kudzu_t)
')
tunable_policy(`allow_execmem',`
allow kudzu_t self:process execmem;
')
optional_policy(`gpm',`
gpm_getattr_gpmctl(kudzu_t)
')

6
refpolicy/policy/modules/admin/logrotate.te
View File

@ -1,5 +1,5 @@
policy_module(logrotate,1.1.1)
policy_module(logrotate,1.1.2)
########################################
#
@ -72,6 +72,10 @@ dev_read_urand(logrotate_t)
fs_search_auto_mountpoints(logrotate_t)
fs_getattr_xattr_fs(logrotate_t)
mls_file_read_up(logrotate_t)
mls_file_write_down(logrotate_t)
mls_file_upgrade(logrotate_t)
selinux_get_fs_mount(logrotate_t)
selinux_get_enforce_mode(logrotate_t)

1
refpolicy/policy/modules/admin/rpm.fc
View File

@ -1,5 +1,6 @@
/bin/rpm -- gen_context(system_u:object_r:rpm_exec_t,s0)
/usr/bin/smart -- gen_context(system_u:object_r:rpm_exec_t,s0)
/usr/bin/apt-get -- gen_context(system_u:object_r:rpm_exec_t,s0)
/usr/bin/apt-shell -- gen_context(system_u:object_r:rpm_exec_t,s0)

21
refpolicy/policy/modules/admin/rpm.te
View File

@ -1,5 +1,5 @@
policy_module(rpm,1.1.1)
policy_module(rpm,1.1.2)
########################################
#
@ -114,6 +114,10 @@ fs_manage_nfs_symlinks(rpm_t)
fs_getattr_all_fs(rpm_t)
fs_search_auto_mountpoints(rpm_t)
mls_file_read_up(rpm_t)
mls_file_write_down(rpm_t)
mls_file_upgrade(rpm_t)
selinux_get_fs_mount(rpm_t)
selinux_validate_context(rpm_t)
selinux_compute_access_vector(rpm_t)
@ -269,6 +273,9 @@ fs_mount_xattr_fs(rpm_script_t)
fs_unmount_xattr_fs(rpm_script_t)
fs_search_auto_mountpoints(rpm_script_t)
mls_file_read_up(rpm_script_t)
mls_file_write_down(rpm_script_t)
selinux_get_fs_mount(rpm_script_t)
selinux_validate_context(rpm_script_t)
selinux_compute_access_vector(rpm_script_t)
@ -328,17 +335,17 @@ ifdef(`distro_redhat',`
ifdef(`targeted_policy',`
unconfined_domain_template(rpm_script_t)
',`
ifdef(`distro_redhat',`
optional_policy(`mta',`
mta_send_mail(rpm_script_t)
')
')
optional_policy(`bootloader',`
bootloader_domtrans(rpm_script_t)
')
')
ifdef(`distro_redhat',`
optional_policy(`mta',`
mta_send_mail(rpm_script_t)
')
')
tunable_policy(`allow_execmem',`
allow rpm_script_t self:process execmem;
')

5
refpolicy/policy/modules/admin/tmpreaper.te
View File

@ -1,5 +1,5 @@
policy_module(tmpreaper,1.0.0)
policy_module(tmpreaper,1.0.1)
########################################
#
@ -31,6 +31,9 @@ files_purge_tmp(tmpreaper_t)
# why does it need setattr?
files_setattr_all_tmp_dirs(tmpreaper_t)
mls_file_read_up(tmpreaper_t)
mls_file_write_down(tmpreaper_t)
libs_use_ld_so(tmpreaper_t)
libs_use_shared_libs(tmpreaper_t)

16
refpolicy/policy/modules/admin/usermanage.te
View File

@ -1,5 +1,5 @@
policy_module(usermanage,1.1.0)
policy_module(usermanage,1.1.1)
########################################
#
@ -136,6 +136,10 @@ optional_policy(`nis',`
nis_use_ypbind(chfn_t)
')
optional_policy(`nscd',`
nscd_use_socket(chfn_t)
')
########################################
#
# Crack local policy
@ -197,7 +201,7 @@ allow groupadd_t self:unix_dgram_socket create_socket_perms;
allow groupadd_t self:unix_stream_socket create_stream_socket_perms;
allow groupadd_t self:unix_dgram_socket sendto;
allow groupadd_t self:unix_stream_socket connectto;
allow groupadd_t self:netlink_audit_socket { create_socket_perms nlmsg_relay };
allow groupadd_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay };
fs_getattr_xattr_fs(groupadd_t)
fs_search_auto_mountpoints(groupadd_t)
@ -262,7 +266,7 @@ optional_policy(`rpm',`
# Passwd local policy
#
allow passwd_t self:capability { chown dac_override fsetid setuid setgid sys_resource };
allow passwd_t self:capability { chown dac_override fsetid setuid setgid sys_resource audit_control audit_write };
allow passwd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
allow passwd_t self:process { setrlimit setfscreate };
allow passwd_t self:fd use;
@ -338,6 +342,10 @@ optional_policy(`nis',`
nis_use_ypbind(passwd_t)
')
optional_policy(`nscd',`
nscd_use_socket(passwd_t)
')
########################################
#
# Password admin local policy
@ -443,7 +451,7 @@ allow useradd_t self:unix_dgram_socket create_socket_perms;
allow useradd_t self:unix_stream_socket create_stream_socket_perms;
allow useradd_t self:unix_dgram_socket sendto;
allow useradd_t self:unix_stream_socket connectto;
allow useradd_t self:netlink_audit_socket { create_socket_perms nlmsg_relay };
allow useradd_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay };
# Allow access to context for shadow file
selinux_get_fs_mount(useradd_t)

3
refpolicy/policy/modules/apps/webalizer.te
View File

@ -1,5 +1,5 @@
policy_module(webalizer,1.1.0)
policy_module(webalizer,1.1.1)
########################################
#
@ -87,6 +87,7 @@ miscfiles_read_localization(webalizer_t)
sysnet_read_config(webalizer_t)
userdom_use_unpriv_users_fd(webalizer_t)
userdom_dontaudit_search_all_users_home(webalizer_t)
apache_read_log(webalizer_t)
apache_manage_sys_content(webalizer_t)

2
refpolicy/policy/modules/kernel/corecommands.fc
View File

@ -64,6 +64,8 @@ ifdef(`targeted_policy',`
# /lib
#
/lib/udev/[^/]* -- gen_context(system_u:object_r:bin_t,s0)
ifdef(`distro_gentoo',`
/lib/rcscripts/sh(/.*)? gen_context(system_u:object_r:bin_t,s0)
')

14
refpolicy/policy/modules/kernel/corenetwork.te.in
View File

@ -1,5 +1,5 @@
policy_module(corenetwork,1.0.1)
policy_module(corenetwork,1.0.2)
########################################
#
@ -143,15 +143,15 @@ portcon udp 1-1023 gen_context(system_u:object_r:reserved_port_t, s0)
# nodes in net_contexts or net_contexts.mls.
#
type node_t, node_type;
sid node gen_context(system_u:object_r:node_t,s0)
sid node gen_context(system_u:object_r:node_t,s0 - s15:c0.c255)
network_node(compat_ipv4, s0, ::, ffff:ffff:ffff:ffff:ffff:ffff::)
network_node(inaddr_any, s0, 0.0.0.0, 255.255.255.255)
type node_internal_t, node_type; dnl network_node(internal, s0, , ) # no nodecon for this in current strict policy
network_node(link_local, s0, fe80::, ffff:ffff:ffff:ffff::, )
network_node(lo, s0, 127.0.0.1, 255.255.255.255)
network_node(lo, s0 - s15:c0.c255, 127.0.0.1, 255.255.255.255)
network_node(mapped_ipv4, s0, ::ffff:0000:0000, ffff:ffff:ffff:ffff:ffff:ffff::)
network_node(multicast, s0, ff00::, ff00::)
network_node(multicast, s0 - s15:c0.c255, ff00::, ff00::)
network_node(site_local, s0, fec0::, ffc0::)
network_node(unspec, s0, ::, ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff)
@ -164,7 +164,9 @@ network_node(unspec, s0, ::, ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff)
# netif_t is the default type of network interfaces.
#
type netif_t, netif_type;
sid netif gen_context(system_u:object_r:netif_t,s0)
sid netif gen_context(system_u:object_r:netif_t,s0 - s15:c0.c255)
#network_interface(lo, lo,s0)
ifdef(`enable_mls', `
network_interface(lo, lo,s0 - s15:c0.c255)
')
#network_interface(eth0, eth0,s0)

18
refpolicy/policy/modules/kernel/devices.fc
View File

@ -15,12 +15,12 @@
/dev/dsp.* -c gen_context(system_u:object_r:sound_device_t,s0)
/dev/fb[0-9]* -c gen_context(system_u:object_r:framebuf_device_t,s0)
/dev/full -c gen_context(system_u:object_r:null_device_t,s0)
/dev/irlpt[0-9]+ -c gen_context(system_u:object_r:printer_device_t,s0)
/dev/irlpt[0-9]+ -c gen_context(system_u:object_r:printer_device_t,s0)
/dev/js.* -c gen_context(system_u:object_r:mouse_device_t,s0)
/dev/kmem -c gen_context(system_u:object_r:memory_device_t,s0)
/dev/kmem -c gen_context(system_u:object_r:memory_device_t,s15:c0.c255)
/dev/logibm -c gen_context(system_u:object_r:mouse_device_t,s0)
/dev/lp.* -c gen_context(system_u:object_r:printer_device_t,s0)
/dev/mem -c gen_context(system_u:object_r:memory_device_t,s0)
/dev/mem -c gen_context(system_u:object_r:memory_device_t,s15:c0.c255)
/dev/microcode -c gen_context(system_u:object_r:cpu_device_t,s0)
/dev/midi.* -c gen_context(system_u:object_r:sound_device_t,s0)
/dev/mixer.* -c gen_context(system_u:object_r:sound_device_t,s0)
@ -28,17 +28,17 @@
/dev/mpu401.* -c gen_context(system_u:object_r:sound_device_t,s0)
/dev/null -c gen_context(system_u:object_r:null_device_t,s0)
/dev/nvidia.* -c gen_context(system_u:object_r:xserver_misc_device_t,s0)
/dev/nvram -c gen_context(system_u:object_r:memory_device_t,s0)
/dev/nvram -c gen_context(system_u:object_r:memory_device_t,s15:c0.c255)
/dev/par.* -c gen_context(system_u:object_r:printer_device_t,s0)
/dev/patmgr[01] -c gen_context(system_u:object_r:sound_device_t,s0)
/dev/pmu -c gen_context(system_u:object_r:power_device_t,s0)
/dev/port -c gen_context(system_u:object_r:memory_device_t,s0)
/dev/pmu -c gen_context(system_u:object_r:power_device_t,s0)
/dev/port -c gen_context(system_u:object_r:memory_device_t,s15:c0.c255)
/dev/psaux -c gen_context(system_u:object_r:mouse_device_t,s0)
/dev/rmidi.* -c gen_context(system_u:object_r:sound_device_t,s0)
/dev/radeon -c gen_context(system_u:object_r:dri_device_t,s0)
/dev/radio.* -c gen_context(system_u:object_r:v4l_device_t,s0)
/dev/random -c gen_context(system_u:object_r:random_device_t,s0)
/dev/rtc -c gen_context(system_u:object_r:clock_device_t,s0)
/dev/rtc -c gen_context(system_u:object_r:clock_device_t,s0)
/dev/sequencer -c gen_context(system_u:object_r:sound_device_t,s0)
/dev/sequencer2 -c gen_context(system_u:object_r:sound_device_t,s0)
/dev/smpte.* -c gen_context(system_u:object_r:sound_device_t,s0)
@ -72,9 +72,9 @@ ifdef(`distro_suse', `
/dev/pts(/.*)? <<none>>
/dev/s(ou)?nd/.* -c gen_context(system_u:object_r:sound_device_t,s0)
/dev/s(ou)?nd/.* -c gen_context(system_u:object_r:sound_device_t,s0)
/dev/usb/dc2xx.* -c gen_context(system_u:object_r:scanner_device_t,s0)
/dev/usb/dc2xx.* -c gen_context(system_u:object_r:scanner_device_t,s0)
/dev/usb/lp.* -c gen_context(system_u:object_r:printer_device_t,s0)
/dev/usb/mdc800.* -c gen_context(system_u:object_r:scanner_device_t,s0)
/dev/usb/scanner.* -c gen_context(system_u:object_r:scanner_device_t,s0)

29
refpolicy/policy/modules/kernel/files.fc
View File

@ -24,7 +24,7 @@ ifdef(`distro_suse',`
# /boot
#
/boot/\.journal <<none>>
/boot/lost\+found -d gen_context(system_u:object_r:lost_found_t,s0)
/boot/lost\+found -d gen_context(system_u:object_r:lost_found_t,s15:c0.c255)
/boot/lost\+found/.* <<none>>
#
@ -89,10 +89,10 @@ ifdef(`distro_suse',`
# HOME_ROOT
# expanded by genhomedircon
#
HOME_ROOT -d gen_context(system_u:object_r:home_root_t,s0)
HOME_ROOT -d gen_context(system_u:object_r:home_root_t,s15:c0.c255)
HOME_ROOT/\.journal <<none>>
HOME_ROOT/lost\+found -d gen_context(system_u:object_r:lost_found_t,s0)
HOME_ROOT/lost\+found/.* <<none>>
HOME_ROOT/lost\+found -d gen_context(system_u:object_r:lost_found_t,s15:c0.c255)
HOME_ROOT/lost\+found/.* <<none>>
#
# /initrd
@ -103,7 +103,7 @@ HOME_ROOT/lost\+found/.* <<none>>
#
# /lost+found
#
/lost\+found -d gen_context(system_u:object_r:lost_found_t,s0)
/lost\+found -d gen_context(system_u:object_r:lost_found_t,s15:c0.c255)
/lost\+found/.* <<none>>
#
@ -150,11 +150,11 @@ HOME_ROOT/lost\+found/.* <<none>>
#
# /tmp
#
/tmp -d gen_context(system_u:object_r:tmp_t,s0)
/tmp -d gen_context(system_u:object_r:tmp_t,s0-s15:c0.c255)
/tmp/.* <<none>>
/tmp/\.journal <<none>>
/tmp/lost\+found -d gen_context(system_u:object_r:lost_found_t,s0)
/tmp/lost\+found -d gen_context(system_u:object_r:lost_found_t,s15:c0.c255)
/tmp/lost\+found/.* <<none>>
#
@ -171,19 +171,19 @@ HOME_ROOT/lost\+found/.* <<none>>
/usr/local/etc(/.*)? gen_context(system_u:object_r:etc_t,s0)
/usr/local/lost\+found -d gen_context(system_u:object_r:lost_found_t,s0)
/usr/local/lost\+found -d gen_context(system_u:object_r:lost_found_t,s15:c0.c255)
/usr/local/lost\+found/.* <<none>>
/usr/local/src(/.*)? gen_context(system_u:object_r:src_t,s0)
/usr/lost\+found -d gen_context(system_u:object_r:lost_found_t,s0)
/usr/lost\+found -d gen_context(system_u:object_r:lost_found_t,s15:c0.c255)
/usr/lost\+found/.* <<none>>
/usr/share(/.*)?/lib(64)?(/.*)? gen_context(system_u:object_r:usr_t,s0)
/usr/src(/.*)? gen_context(system_u:object_r:src_t,s0)
/usr/tmp -d gen_context(system_u:object_r:tmp_t,s0)
/usr/tmp -d gen_context(system_u:object_r:tmp_t,s0-s15:c0.c255)
/usr/tmp/.* <<none>>
#
@ -202,16 +202,17 @@ HOME_ROOT/lost\+found/.* <<none>>
/var/lock(/.*)? gen_context(system_u:object_r:var_lock_t,s0)
/var/lost\+found -d gen_context(system_u:object_r:lost_found_t,s0)
/var/lost\+found -d gen_context(system_u:object_r:lost_found_t,s15:c0.c255)
/var/lost\+found/.* <<none>>
/var/run(/.*)? gen_context(system_u:object_r:var_run_t,s0)
/var/run -d gen_context(system_u:object_r:var_run_t,s0-s15:c0.c255)
/var/run/.* gen_context(system_u:object_r:var_run_t,s0)
/var/run/.*\.*pid <<none>>
/var/spool(/.*)? gen_context(system_u:object_r:var_spool_t,s0)
/var/tmp -d gen_context(system_u:object_r:tmp_t,s0)
/var/tmp -d gen_context(system_u:object_r:tmp_t,s0-s15:c0.c255)
/var/tmp/.* <<none>>
/var/tmp/lost\+found -d gen_context(system_u:object_r:lost_found_t,s0)
/var/tmp/lost\+found -d gen_context(system_u:object_r:lost_found_t,s15:c0.c255)
/var/tmp/lost\+found/.* <<none>>
/var/tmp/vi\.recover -d gen_context(system_u:object_r:tmp_t,s0)

7
refpolicy/policy/modules/kernel/kernel.if
View File

@ -31,6 +31,10 @@ interface(`kernel_userland_entry',`
allow $1 kernel_t:fd use;
allow $1 kernel_t:fifo_file rw_file_perms;
allow $1 kernel_t:process sigchld;
ifdef(`enable_mls',`
allow kernel_t $1:process noatsecure;
')
')
########################################
@ -436,7 +440,7 @@ interface(`kernel_read_debugfs',`
type debugfs_t;
')
allow $1 debugfs_t:dir r_file_perms;
allow $1 debugfs_t:dir r_dir_perms;
allow $1 debugfs_t:file r_file_perms;
allow $1 debugfs_t:lnk_file { getattr read };
')
@ -1680,6 +1684,7 @@ interface(`kernel_relabel_unlabeled',`
gen_require_set({ getattr relabelfrom },dir_file_class_set)
')
kernel_list_unlabeled($1)
allow $1 unlabeled_t:dir_file_class_set { getattr relabelfrom };
')

30
refpolicy/policy/modules/kernel/kernel.te
View File

@ -1,5 +1,5 @@
policy_module(kernel,1.1.0)
policy_module(kernel,1.1.1)
########################################
#
@ -38,7 +38,7 @@ type kernel_t, can_load_kernmodule;
domain_base_type(kernel_t)
mls_rangetrans_source(kernel_t)
role system_r types kernel_t;
sid kernel gen_context(system_u:system_r:kernel_t,s0 - s9:c0.c127)
sid kernel gen_context(system_u:system_r:kernel_t,s15:c0.c255)
#
# DebugFS
@ -61,13 +61,13 @@ genfscon proc /sysvipc gen_context(system_u:object_r:proc_t,s0)
# kernel message interface
type proc_kmsg_t, proc_type;
genfscon proc /kmsg gen_context(system_u:object_r:proc_kmsg_t,s0)
genfscon proc /kmsg gen_context(system_u:object_r:proc_kmsg_t,s15:c0.c255)
neverallow ~can_receive_kernel_messages proc_kmsg_t:file ~getattr;
# /proc kcore: inaccessible
type proc_kcore_t, proc_type;
neverallow { domain -kern_unconfined } proc_kcore_t:file ~getattr;
genfscon proc /kcore gen_context(system_u:object_r:proc_kcore_t,s0)
genfscon proc /kcore gen_context(system_u:object_r:proc_kcore_t,s15:c0.c255)
type proc_mdstat_t, proc_type;
genfscon proc /mdstat gen_context(system_u:object_r:proc_mdstat_t,s0)
@ -132,18 +132,18 @@ genfscon proc /sys/dev gen_context(system_u:object_r:sysctl_dev_t,s0)
# have labels that are no longer valid are treated as having this type.
#
type unlabeled_t;
sid unlabeled gen_context(system_u:object_r:unlabeled_t,s0)
sid unlabeled gen_context(system_u:object_r:unlabeled_t,s15:c0.c255)
# These initial sids are no longer used, and can be removed:
sid any_socket gen_context(system_u:object_r:unlabeled_t,s0)
sid any_socket gen_context(system_u:object_r:unlabeled_t,s15:c0.c255)
sid file_labels gen_context(system_u:object_r:unlabeled_t,s0)
sid icmp_socket gen_context(system_u:object_r:unlabeled_t,s0)
sid igmp_packet gen_context(system_u:object_r:unlabeled_t,s0)
sid icmp_socket gen_context(system_u:object_r:unlabeled_t,s15:c0.c255)
sid igmp_packet gen_context(system_u:object_r:unlabeled_t,s15:c0.c255)
sid init gen_context(system_u:object_r:unlabeled_t,s0)
sid kmod gen_context(system_u:object_r:unlabeled_t,s0)
sid netmsg gen_context(system_u:object_r:unlabeled_t,s0)
sid policy gen_context(system_u:object_r:unlabeled_t,s0)
sid scmp_packet gen_context(system_u:object_r:unlabeled_t,s0)
sid kmod gen_context(system_u:object_r:unlabeled_t,s15:c0.c255)
sid netmsg gen_context(system_u:object_r:unlabeled_t,s15:c0.c255)
sid policy gen_context(system_u:object_r:unlabeled_t,s15:c0.c255)
sid scmp_packet gen_context(system_u:object_r:unlabeled_t,s15:c0.c255)
sid sysctl_modprobe gen_context(system_u:object_r:unlabeled_t,s0)
sid sysctl_fs gen_context(system_u:object_r:unlabeled_t,s0)
sid sysctl_kernel gen_context(system_u:object_r:unlabeled_t,s0)
@ -151,7 +151,7 @@ sid sysctl_net gen_context(system_u:object_r:unlabeled_t,s0)
sid sysctl_net_unix gen_context(system_u:object_r:unlabeled_t,s0)
sid sysctl_vm gen_context(system_u:object_r:unlabeled_t,s0)
sid sysctl_dev gen_context(system_u:object_r:unlabeled_t,s0)
sid tcp_socket gen_context(system_u:object_r:unlabeled_t,s0)
sid tcp_socket gen_context(system_u:object_r:unlabeled_t,s15:c0.c255)
########################################
#
@ -197,9 +197,13 @@ corenet_non_ipsec_sendrecv(kernel_t)
# Kernel-generated traffic e.g., ICMP replies:
corenet_raw_sendrecv_all_if(kernel_t)
corenet_raw_sendrecv_all_nodes(kernel_t)
corenet_raw_send_generic_if(kernel_t)
# Kernel-generated traffic e.g., TCP resets:
corenet_tcp_sendrecv_all_if(kernel_t)
corenet_tcp_sendrecv_all_nodes(kernel_t)
corenet_raw_send_generic_node(kernel_t)
corenet_raw_send_multicast_node(kernel_t)
dev_read_sysfs(kernel_t)
dev_search_usbfs(kernel_t)

9
refpolicy/policy/modules/kernel/mls.te
View File

@ -1,5 +1,5 @@
policy_module(mls,1.1.1)
policy_module(mls,1.1.2)
########################################
#
@ -36,8 +36,11 @@ attribute mlsxwinread;
attribute mlsxwinreadtoclr;
attribute mlsxwinwrite;
attribute mlsxwinwritetoclr;
attribute mlsxwinupgrade;
attribute mlsxwindowngrade;
attribute mlsxwinreadproperty;
attribute mlsxwinwriteproperty;
attribute mlsxwinreadcolormap;
attribute mlsxwinwritecolormap;
attribute mlsxwinwritexinput;
attribute mlstrustedobject;

4
refpolicy/policy/modules/kernel/selinux.te
View File

@ -1,5 +1,5 @@
policy_module(selinux,1.0.0)
policy_module(selinux,1.0.1)
########################################
#
@ -18,7 +18,7 @@ attribute can_setsecparam;
type security_t;
fs_type(security_t)
mls_trusted_object(security_t)
sid security gen_context(system_u:object_r:security_t,s0)
sid security gen_context(system_u:object_r:security_t,s15:c0.c255)
genfscon selinuxfs / gen_context(system_u:object_r:security_t,s0)
neverallow ~can_load_policy security_t:security load_policy;

46
refpolicy/policy/modules/kernel/storage.fc
View File

@ -5,35 +5,35 @@
/dev/n?osst[0-3].* -c gen_context(system_u:object_r:tape_device_t,s0)
/dev/n?pt[0-9]+ -c gen_context(system_u:object_r:tape_device_t,s0)
/dev/n?tpqic[12].* -c gen_context(system_u:object_r:tape_device_t,s0)
/dev/[shmx]d[^/]* -b gen_context(system_u:object_r:fixed_disk_device_t,s0)
/dev/[shmx]d[^/]* -b gen_context(system_u:object_r:fixed_disk_device_t,s15:c0.c255)
/dev/aztcd -b gen_context(system_u:object_r:removable_device_t,s0)
/dev/bpcd -b gen_context(system_u:object_r:removable_device_t,s0)
/dev/cdu.* -b gen_context(system_u:object_r:removable_device_t,s0)
/dev/cm20.* -b gen_context(system_u:object_r:removable_device_t,s0)
/dev/dasd[^/]* -b gen_context(system_u:object_r:fixed_disk_device_t,s0)
/dev/dm-[0-9]+ -b gen_context(system_u:object_r:fixed_disk_device_t,s0)
/dev/dasd[^/]* -b gen_context(system_u:object_r:fixed_disk_device_t,s15:c0.c255)
/dev/dm-[0-9]+ -b gen_context(system_u:object_r:fixed_disk_device_t,s15:c0.c255)
/dev/fd[^/]+ -b gen_context(system_u:object_r:removable_device_t,s0)
/dev/flash[^/]* -b gen_context(system_u:object_r:fixed_disk_device_t,s0)
/dev/flash[^/]* -b gen_context(system_u:object_r:fixed_disk_device_t,s15:c0.c255)
/dev/gscd -b gen_context(system_u:object_r:removable_device_t,s0)
/dev/hitcd -b gen_context(system_u:object_r:removable_device_t,s0)
/dev/ht[0-1] -b gen_context(system_u:object_r:tape_device_t,s0)
/dev/initrd -b gen_context(system_u:object_r:fixed_disk_device_t,s0)
/dev/jsfd -b gen_context(system_u:object_r:fixed_disk_device_t,s0)
/dev/jsflash -c gen_context(system_u:object_r:fixed_disk_device_t,s0)
/dev/loop.* -b gen_context(system_u:object_r:fixed_disk_device_t,s0)
/dev/lvm -c gen_context(system_u:object_r:fixed_disk_device_t,s0)
/dev/initrd -b gen_context(system_u:object_r:fixed_disk_device_t,s15:c0.c255)
/dev/jsfd -b gen_context(system_u:object_r:fixed_disk_device_t,s15:c0.c255)
/dev/jsflash -c gen_context(system_u:object_r:fixed_disk_device_t,s15:c0.c255)
/dev/loop.* -b gen_context(system_u:object_r:fixed_disk_device_t,s15:c0.c255)
/dev/lvm -c gen_context(system_u:object_r:fixed_disk_device_t,s15:c0.c255)
/dev/mcdx? -b gen_context(system_u:object_r:removable_device_t,s0)
/dev/nb[^/]+ -b gen_context(system_u:object_r:fixed_disk_device_t,s0)
/dev/nb[^/]+ -b gen_context(system_u:object_r:fixed_disk_device_t,s15:c0.c255)
/dev/optcd -b gen_context(system_u:object_r:removable_device_t,s0)
/dev/p[fg][0-3] -b gen_context(system_u:object_r:removable_device_t,s0)
/dev/pcd[0-3] -b gen_context(system_u:object_r:removable_device_t,s0)
/dev/pd[a-d][^/]* -b gen_context(system_u:object_r:removable_device_t,s0)
/dev/pg[0-3] -c gen_context(system_u:object_r:removable_device_t,s0)
/dev/ram.* -b gen_context(system_u:object_r:fixed_disk_device_t,s0)
/dev/rawctl -c gen_context(system_u:object_r:fixed_disk_device_t,s0)
/dev/rd.* -b gen_context(system_u:object_r:fixed_disk_device_t,s0)
/dev/ram.* -b gen_context(system_u:object_r:fixed_disk_device_t,s15:c0.c255)
/dev/rawctl -c gen_context(system_u:object_r:fixed_disk_device_t,s15:c0.c255)
/dev/rd.* -b gen_context(system_u:object_r:fixed_disk_device_t,s15:c0.c255)
ifdef(`distro_redhat', `
/dev/root -b gen_context(system_u:object_r:fixed_disk_device_t,s0)
/dev/root -b gen_context(system_u:object_r:fixed_disk_device_t,s15:c0.c255)
')
/dev/s(cd|r)[^/]* -b gen_context(system_u:object_r:removable_device_t,s0)
/dev/sbpcd.* -b gen_context(system_u:object_r:removable_device_t,s0)
@ -41,21 +41,23 @@ ifdef(`distro_redhat', `
/dev/sjcd -b gen_context(system_u:object_r:removable_device_t,s0)
/dev/sonycd -b gen_context(system_u:object_r:removable_device_t,s0)
/dev/tape.* -c gen_context(system_u:object_r:tape_device_t,s0)
/dev/ubd[^/]* -b gen_context(system_u:object_r:fixed_disk_device_t,s0)
/dev/ub[a-z] -b gen_context(system_u:object_r:removable_device_t,s15:c0.c255)
/dev/ataraid/.* -b gen_context(system_u:object_r:fixed_disk_device_t,s0)
/dev/ubd[^/]* -b gen_context(system_u:object_r:fixed_disk_device_t,s15:c0.c255)
/dev/cciss/[^/]* -b gen_context(system_u:object_r:fixed_disk_device_t,s0)
/dev/ataraid/.* -b gen_context(system_u:object_r:fixed_disk_device_t,s15:c0.c255)
/dev/i2o/hd[^/]* -b gen_context(system_u:object_r:fixed_disk_device_t,s0)
/dev/cciss/[^/]* -b gen_context(system_u:object_r:fixed_disk_device_t,s15:c0.c255)
/dev/ida/[^/]* -b gen_context(system_u:object_r:fixed_disk_device_t,s0)
/dev/i2o/hd[^/]* -b gen_context(system_u:object_r:fixed_disk_device_t,s15:c0.c255)
/dev/ida/[^/]* -b gen_context(system_u:object_r:fixed_disk_device_t,s15:c0.c255)
/dev/md/.* -b gen_context(system_u:object_r:fixed_disk_device_t,s0)
/dev/mapper/.* -b gen_context(system_u:object_r:fixed_disk_device_t,s0)
/dev/mapper/.* -b gen_context(system_u:object_r:fixed_disk_device_t,s15:c0.c255)
/dev/raw/raw[0-9]+ -c gen_context(system_u:object_r:fixed_disk_device_t,s0)
/dev/raw/raw[0-9]+ -c gen_context(system_u:object_r:fixed_disk_device_t,s15:c0.c255)
/dev/scramdisk/.* -b gen_context(system_u:object_r:fixed_disk_device_t,s0)
/dev/scramdisk/.* -b gen_context(system_u:object_r:fixed_disk_device_t,s15:c0.c255)
/dev/usb/rio500 -c gen_context(system_u:object_r:removable_device_t,s0)

2
refpolicy/policy/modules/kernel/terminal.fc
View File

@ -17,6 +17,8 @@
/dev/pty/.* -c gen_context(system_u:object_r:bsdpty_device_t,s0)
/dev/pts -d gen_context(system_u:object_r:devpts_t,s0-s15:c0.c255)
/dev/vcc?/.* -c gen_context(system_u:object_r:tty_device_t,s0)
/dev/vcs[^/]* -c gen_context(system_u:object_r:tty_device_t,s0)

7
refpolicy/policy/modules/services/automount.te
View File

@ -1,5 +1,5 @@
policy_module(automount,1.0.2)
policy_module(automount,1.0.3)
########################################
#
@ -65,7 +65,7 @@ kernel_list_proc(automount_t)
bootloader_getattr_boot_dir(automount_t)
corecmd_search_sbin(automount_t)
corecmd_exec_sbin(automount_t)
corecmd_exec_bin(automount_t)
corecmd_exec_shell(automount_t)
@ -80,6 +80,8 @@ corenet_tcp_sendrecv_all_ports(automount_t)
corenet_udp_sendrecv_all_ports(automount_t)
corenet_tcp_bind_all_nodes(automount_t)
corenet_udp_bind_all_nodes(automount_t)
corenet_tcp_connect_portmap_port(automount_t)
corenet_dontaudit_tcp_connect_all_reserved_ports(automount_t)
dev_read_sysfs(automount_t)
# for SSP
@ -113,6 +115,7 @@ libs_use_ld_so(automount_t)
libs_use_shared_libs(automount_t)
logging_send_syslog_msg(automount_t)
logging_search_logs(automount_t)
miscfiles_read_localization(automount_t)

19
refpolicy/policy/modules/services/bind.if
View File

@ -188,3 +188,22 @@ interface(`bind_setattr_pid_dir',`
allow $1 named_var_run_t:dir setattr;
')
########################################
## <summary>
## Read BIND zone files.
## </summary>
## <param name="domain">
## Domain allowed access.
## </param>
#
interface(`bind_read_zone',`
gen_require(`
type named_zone_t;
')
files_search_var($1)
allow $1 named_zone_t:dir search_dir_perms;
allow $1 named_zone_t:file r_file_perms;
')

16
refpolicy/policy/modules/services/bluetooth.if
View File

@ -1,5 +1,21 @@
## <summary>Bluetooth tools and system services.</summary>
########################################
## <summary>
## Read bluetooth daemon configuration.
## </summary>
## <param name="domain">
## Domain allowed access.
## </param>
#
interface(`bluetooth_read_config',`
gen_require(`
type bluetooth_conf_t;
')
allow $1 bluetooth_conf_t:file { getattr read ioctl };
')
########################################
## <summary>
## Execute bluetooth_helper in the bluetooth_helper domain.

3
refpolicy/policy/modules/services/cron.te
View File

@ -1,5 +1,5 @@
policy_module(cron, 1.1.1)
policy_module(cron,1.1.2)
gen_require(`
class passwd rootok;
@ -120,6 +120,7 @@ files_search_default(crond_t)
init_use_fd(crond_t)
init_use_script_pty(crond_t)
init_read_script_pid(crond_t)
libs_use_ld_so(crond_t)
libs_use_shared_libs(crond_t)

1
refpolicy/policy/modules/services/cups.te
View File

@ -365,6 +365,7 @@ allow initrc_t printer_device_t:chr_file getattr;
allow initrc_t ptal_var_run_t:dir rmdir;
allow initrc_t ptal_var_run_t:fifo_file unlink;
allow initrc_t cupsd_rw_etc_t:file r_file_perms;
########################################
#

5
refpolicy/policy/modules/services/cvs.fc
View File

@ -1,2 +1,7 @@
/opt/cvs(/.*)? gen_context(system_u:object_r:cvs_data_t,s0)
/usr/bin/cvs -- gen_context(system_u:object_r:cvs_exec_t,s0)
/var/cvs(/.*)? gen_context(system_u:object_r:cvs_data_t,s0)

8
refpolicy/policy/modules/services/cvs.te
View File

@ -1,5 +1,5 @@
policy_module(cvs,1.1.0)
policy_module(cvs,1.1.1)
########################################
#
@ -86,6 +86,12 @@ sysnet_read_config(cvs_t)
mta_send_mail(cvs_t)
# cjp: typeattribute doesnt work in conditionals yet
auth_can_read_shadow_passwords(cvs_t)
tunable_policy(`allow_cvs_read_shadow',`
auth_tunable_read_shadow(cvs_t)
')
optional_policy(`kerberos',`
kerberos_use(cvs_t)
kerberos_read_keytab(cvs_t)

16
refpolicy/policy/modules/services/dbus.if
View File

@ -204,6 +204,22 @@ template(`dbus_system_bus_client_template',`
allow $2 system_dbusd_t:unix_stream_socket connectto;
')
########################################
## <summary>
## Read dbus configuration.
## </summary>
## <param name="domain">
## Domain allowed access.
## </param>
#
interface(`dbus_read_config',`
gen_require(`
type dbusd_etc_t;
')
allow $1 dbusd_etc_t:file r_file_perms;
')
########################################
## <summary>
## Connect to the the system DBUS

3
refpolicy/policy/modules/services/dovecot.te
View File

@ -1,5 +1,5 @@
policy_module(dovecot,1.1.1)
policy_module(dovecot,1.1.2)
########################################
#
@ -95,6 +95,7 @@ domain_use_wide_inherit_fd(dovecot_t)
files_read_etc_files(dovecot_t)
files_search_spool(dovecot_t)
files_search_tmp(dovecot_t)
files_dontaudit_list_default(dovecot_t)
init_use_fd(dovecot_t)
init_use_script_pty(dovecot_t)

3
refpolicy/policy/modules/services/hal.te
View File

@ -1,5 +1,5 @@
policy_module(hal,1.1.3)
policy_module(hal,1.1.4)
########################################
#
@ -105,6 +105,7 @@ storage_raw_write_fixed_disk(hald_t)
term_dontaudit_use_console(hald_t)
term_dontaudit_ioctl_unallocated_ttys(hald_t)
term_dontaudit_use_unallocated_tty(hald_t)
init_use_fd(hald_t)
init_use_script_pty(hald_t)

6
refpolicy/policy/modules/services/ldap.te
View File

@ -1,5 +1,5 @@
policy_module(ldap,1.1.0)
policy_module(ldap,1.1.1)
########################################
#
@ -138,6 +138,10 @@ ifdef(`targeted_policy',`
files_dontaudit_read_root_file(slapd_t)
')
optional_policy(`kerberos',`
kerberos_use(slapd_t)
')
optional_policy(`nis',`
nis_use_ypbind(slapd_t)
')

8
refpolicy/policy/modules/services/ppp.te
View File

@ -1,5 +1,5 @@
policy_module(ppp,1.1.0)
policy_module(ppp,1.1.1)
########################################
#
@ -318,10 +318,8 @@ optional_policy(`udev',`
udev_read_db(pptp_t)
')
ifdef(`postfix.te', `
allow pppd_t postfix_etc_t:dir search;
allow pppd_t postfix_etc_t:file r_file_perms;
allow pppd_t postfix_master_exec_t:file { getattr read };
optional_policy(`postfix',`
postfix_read_config(pppd_t)
')
domain_auto_trans(pppd_t, pppd_script_exec_t, initrc_t)

3
refpolicy/policy/modules/services/remotelogin.te
View File

@ -1,5 +1,5 @@
policy_module(remotelogin,1.0.0)
policy_module(remotelogin,1.0.1)
########################################
#
@ -106,6 +106,7 @@ libs_use_shared_libs(remote_login_t)
logging_send_syslog_msg(remote_login_t)
mls_file_read_up(remote_login_t)
mls_file_write_down(remote_login_t)
mls_file_upgrade(remote_login_t)
mls_file_downgrade(remote_login_t)

1
refpolicy/policy/modules/services/samba.if
View File

@ -158,6 +158,7 @@ interface(`samba_read_log',`
')
logging_search_logs($1)
allow $1 samba_log_t:dir r_dir_perms;
allow $1 samba_log_t:file { read getattr lock };
')

11
refpolicy/policy/modules/services/sasl.te
View File

@ -1,5 +1,5 @@
policy_module(sasl,1.1.0)
policy_module(sasl,1.1.1)
########################################
#
@ -87,10 +87,11 @@ ifdef(`targeted_policy', `
files_dontaudit_read_root_file(saslauthd_t)
')
# cjp: typeattribute doesnt work in conditionals yet
#tunable_policy(`allow_saslauthd_read_shadow',`
# auth_read_shadow(saslauthd_t)
#')
# cjp: typeattribute dont work in conditionals yet
auth_can_read_shadow_passwords(saslauthd_t)
tunable_policy(`allow_saslauthd_read_shadow',`
auth_tunable_read_shadow(saslauthd_t)
')
optional_policy(`mysql',`
mysql_search_db_dir(saslauthd_t)

30
refpolicy/policy/modules/services/sendmail.te
View File

@ -1,5 +1,5 @@
policy_module(sendmail,1.1.0)
policy_module(sendmail,1.1.1)
########################################
#
@ -15,15 +15,10 @@ files_tmp_file(sendmail_tmp_t)
type sendmail_var_run_t;
files_pid_file(sendmail_var_run_t)
ifdef(`targeted_policy',`
unconfined_alias_domain(sendmail_t)
mta_sendmail_mailserver(sendmail_t)
',`
type sendmail_t;
mta_sendmail_mailserver(sendmail_t)
mta_mailserver_delivery(sendmail_t)
mta_mailserver_sender(sendmail_t)
')
type sendmail_t;
mta_sendmail_mailserver(sendmail_t)
mta_mailserver_delivery(sendmail_t)
mta_mailserver_sender(sendmail_t)
########################################
#
@ -31,9 +26,11 @@ ifdef(`targeted_policy',`
#
allow sendmail_t self:capability { setuid setgid net_bind_service sys_nice chown sys_tty_config };
allow sendmail_t self:process signal;
allow sendmail_t self:fifo_file rw_file_perms;
allow sendmail_t self:unix_stream_socket create_stream_socket_perms;
allow sendmail_t self:unix_dgram_socket create_socket_perms;
allow sendmail_t self:tcp_socket create_stream_socket_perms;
allow sendmail_t sendmail_log_t:file create_file_perms;
allow sendmail_t sendmail_log_t:dir { rw_dir_perms setattr };
@ -111,7 +108,7 @@ ifdef(`targeted_policy',`
allow sendmail_t sendmail_tmp_t:file create_file_perms;
files_create_tmp_files(sendmail_t, sendmail_tmp_t, { file dir })
allow sendmail_t sendmail_var_run_t:file { getattr create read write append setattr unlink };
allow sendmail_t sendmail_var_run_t:file { getattr create read write append setattr unlink lock };
files_create_pid(sendmail_t,sendmail_var_run_t)
')
@ -128,6 +125,10 @@ optional_policy(`postfix',`
postfix_search_spool(sendmail_t)
')
optional_policy(`procmail',`
procmail_domtrans(sendmail_t)
')
optional_policy(`selinuxutil',`
seutil_sigchld_newrole(sendmail_t)
')
@ -152,12 +153,5 @@ allow user_mail_domain etc_mail_t:file rw_file_perms;
# Silently deny attempts to access /root.
dontaudit system_mail_t { staff_home_dir_t sysadm_home_dir_t}:dir { getattr search };
# Run procmail in its own domain, if defined.
ifdef(`procmail.te',`
corecmd_search_bin(sendmail_t)
procmail_domtrans(sendmail_t)
domain_auto_trans(system_mail_t, procmail_exec_t, procmail_t)
')
dontaudit sendmail_t admin_tty_type:chr_file { getattr ioctl };
') dnl end TODO

12
refpolicy/policy/modules/services/ssh.te
View File

@ -1,5 +1,5 @@
policy_module(ssh,1.1.0)
policy_module(ssh,1.1.1)
########################################
#
@ -87,14 +87,16 @@ ifdef(`targeted_policy',`',`
# for X forwarding
corenet_tcp_bind_xserver_port(sshd_t)
mls_file_read_up(sshd_t)
mls_file_write_down(sshd_t)
mls_file_upgrade(sshd_t)
mls_file_downgrade(sshd_t)
mls_process_set_level(sshd_t)
auth_exec_pam(sshd_t)
seutil_read_config(sshd_t)
ifdef(`targeted_policy',`
unconfined_domain_template(sshd_t)
')
tunable_policy(`ssh_sysadm_login',`
# Relabel and access ptys created by sshd
# ioctl is necessary for logout() processing for utmp entry and for w to

17
refpolicy/policy/modules/system/authlogin.if
View File

@ -319,16 +319,31 @@ interface(`auth_dontaudit_getattr_shadow',`
## The type of the process performing this action.
## </param>
#
# cjp: these next three interfaces are split
# since typeattribute does not work in conditionals
# yet, otherwise they should be one interface.
#
interface(`auth_read_shadow',`
auth_can_read_shadow_passwords($1)
auth_tunable_read_shadow($1)
')
interface(`auth_can_read_shadow_passwords',`
gen_require(`
attribute can_read_shadow_passwords;
')
typeattribute $1 can_read_shadow_passwords;
')
interface(`auth_tunable_read_shadow',`
gen_require(`
type shadow_t;
class file r_file_perms;
')
files_list_etc($1)
allow $1 shadow_t:file r_file_perms;
typeattribute $1 can_read_shadow_passwords;
')
########################################

3
refpolicy/policy/modules/system/authlogin.te
View File

@ -1,5 +1,5 @@
policy_module(authlogin,1.1.0)
policy_module(authlogin,1.1.1)
########################################
#
@ -211,6 +211,7 @@ libs_use_shared_libs(pam_console_t)
logging_send_syslog_msg(pam_console_t)
mls_file_read_up(pam_console_t)
mls_file_write_down(pam_console_t)
seutil_read_file_contexts(pam_console_t)

5
refpolicy/policy/modules/system/getty.te
View File

@ -1,5 +1,5 @@
policy_module(getty,1.0.0)
policy_module(getty,1.0.1)
########################################
#
@ -69,6 +69,9 @@ fs_search_auto_mountpoints(getty_t)
# for error condition handling
fs_getattr_xattr_fs(getty_t)
mls_file_read_up(getty_t)
mls_file_write_down(getty_t)
# Chown, chmod, read and write ttys.
term_use_all_user_ttys(getty_t)
term_use_unallocated_tty(getty_t)

1
refpolicy/policy/modules/system/hostname.if
View File

@ -64,5 +64,6 @@ interface(`hostname_exec',`
type hostname_exec_t;
')
corecmd_search_bin($1)
can_exec($1,hostname_exec_t)
')

12
refpolicy/policy/modules/system/init.te
View File

@ -1,5 +1,5 @@
policy_module(init,1.1.1)
policy_module(init,1.1.2)
gen_require(`
class passwd rootok;
@ -369,6 +369,7 @@ mls_file_read_up(initrc_t)
mls_file_write_down(initrc_t)
mls_process_read_up(initrc_t)
mls_process_write_down(initrc_t)
mls_rangetrans_source(initrc_t)
modutils_read_module_conf(initrc_t)
modutils_domtrans_insmod(initrc_t)
@ -435,15 +436,19 @@ ifdef(`distro_redhat',`
fs_use_tmpfs_chr_dev(initrc_t)
storage_create_fixed_disk(initrc_t)
storage_getattr_removable_device(initrc_t)
files_create_boot_flag(initrc_t)
files_getattr_all_file_type_sockets(initrc_t)
# wants to read /.fonts directory
files_read_default_files(initrc_t)
files_mountpoint(initrc_tmp_t)
miscfiles_read_fonts(initrc_t)
miscfiles_read_hwdata(initrc_t)
# readahead asks for these
auth_dontaudit_read_shadow(initrc_t)
mta_read_aliases(initrc_t)
optional_policy(`bind',`
@ -496,6 +501,7 @@ optional_policy(`bind',`
optional_policy(`bluetooth',`
dev_read_usbfs(initrc_t)
bluetooth_read_config(initrc_t)
')
optional_policy(`cpucontrol',`
@ -511,6 +517,7 @@ optional_policy(`dbus',`
dbus_connect_system_bus(initrc_t)
dbus_send_system_bus_msg(initrc_t)
dbus_system_bus_client_template(initrc,initrc_t)
dbus_read_config(initrc_t)
optional_policy(`networkmanager',`
networkmanager_dbus_chat(initrc_t)
@ -580,6 +587,7 @@ optional_policy(`mailman',`
')
optional_policy(`mta',`
mta_read_config(initrc_t)
mta_dontaudit_read_spool_symlink(initrc_t)
')

4
refpolicy/policy/modules/system/iptables.te
View File

@ -1,5 +1,5 @@
policy_module(iptables, 1.0.0)
policy_module(iptables,1.0.1)
########################################
#
@ -48,6 +48,8 @@ dev_read_sysfs(iptables_t)
fs_getattr_xattr_fs(iptables_t)
fs_search_auto_mountpoints(iptables_t)
mls_file_read_up(iptables_t)
term_dontaudit_use_console(iptables_t)
domain_use_wide_inherit_fd(iptables_t)

5
refpolicy/policy/modules/system/libraries.fc
View File

@ -98,6 +98,7 @@ ifdef(`distro_redhat',`
/usr/lib/helix/codecs/cvt1\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib/libSDL-.*\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/X11R6/lib/modules/dri/.*\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib/dri/.*\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/X11R6/lib/libOSMesa\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/X11R6/lib/libfglrx_gamma\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib/libHermes\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
@ -113,7 +114,8 @@ ifdef(`distro_redhat',`
/usr/lib(64)?/.*/program/libsvx680li\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib(64)?/.*/program/libcomphelp4gcc3\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib(64)?/.*/program/libsoffice\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr(/.*)?/pcsc/drivers(/.*)?/libcm(2020|4000|SCR24x)\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr(/.*)?/pcsc/drivers(/.*)?/lib(cm2020|cm4000|SCR24x)\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib(64)?/firefox.*\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib(64)?/mozilla.*\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib(64)?/sunbird.*\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
@ -148,6 +150,7 @@ ifdef(`distro_redhat',`
/usr/lib/libpostproc\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib/libavformat-.*\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib/libavcodec-.*\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib/libavutil-.*\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib/libxvidcore\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib/xine/plugins/.*\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib/libgsm\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)

3
refpolicy/policy/modules/system/locallogin.te
View File

@ -1,5 +1,5 @@
policy_module(locallogin,1.0.0)
policy_module(locallogin,1.0.1)
########################################
#
@ -152,6 +152,7 @@ logging_send_syslog_msg(local_login_t)
miscfiles_read_localization(local_login_t)
mls_file_read_up(local_login_t)
mls_file_write_down(local_login_t)
mls_file_upgrade(local_login_t)
mls_file_downgrade(local_login_t)

13
refpolicy/policy/modules/system/logging.fc
View File

@ -1,8 +1,8 @@
/dev/log -s gen_context(system_u:object_r:devlog_t,s0)
/dev/log -s gen_context(system_u:object_r:devlog_t,s0)
/etc/auditd.conf -- gen_context(system_u:object_r:auditd_etc_t,s0)
/etc/audit.rules -- gen_context(system_u:object_r:auditd_etc_t,s0)
/etc/auditd.conf -- gen_context(system_u:object_r:auditd_etc_t,s0)
/etc/audit.rules -- gen_context(system_u:object_r:auditd_etc_t,s0)
/sbin/auditctl -- gen_context(system_u:object_r:auditctl_exec_t,s0)
/sbin/auditd -- gen_context(system_u:object_r:auditd_exec_t,s0)
@ -19,10 +19,11 @@ ifdef(`distro_suse', `
/var/lib/stunnel/dev/log -s gen_context(system_u:object_r:devlog_t,s0)
')
/var/log(/.*)? gen_context(system_u:object_r:var_log_t,s0)
/var/log/audit.log -- gen_context(system_u:object_r:auditd_log_t,s0)
/var/log -d gen_context(system_u:object_r:var_log_t,s0-s15:c0.c255)
/var/log/.* gen_context(system_u:object_r:var_log_t,s0)
/var/log/audit.log -- gen_context(system_u:object_r:auditd_log_t,s15:c0.c255)
/var/log/audit(/.*)? gen_context(system_u:object_r:auditd_log_t,s0)
/var/log/audit(/.*)? gen_context(system_u:object_r:auditd_log_t,s15:c0.c255)
/var/run/klogd\.pid -- gen_context(system_u:object_r:klogd_var_run_t,s0)
/var/run/log -s gen_context(system_u:object_r:devlog_t,s0)

18
refpolicy/policy/modules/system/logging.if
View File

@ -20,6 +20,24 @@ interface(`logging_log_file',`
typeattribute $1 logfile;
')
########################################
## <summary>
## Read the audit log.
## </summary>
## <param name="domain">
## Domain allowed access.
## </param>
#
interface(`logging_read_audit_log',`
gen_require(`
type auditd_log_t;
')
files_search_var($1)
allow $1 auditd_log_t:dir r_dir_perms;
allow $1 auditd_log_t:file r_file_perms;
')
########################################
## <summary>
## Execute auditctl in the auditctl domain.

7
refpolicy/policy/modules/system/logging.te
View File

@ -1,5 +1,5 @@
policy_module(logging,1.1.0)
policy_module(logging,1.1.1)
########################################
#
@ -74,6 +74,8 @@ kernel_read_proc_symlinks(auditctl_t)
domain_read_all_domains_state(auditctl_t)
domain_use_wide_inherit_fd(auditctl_t)
mls_file_read_up(auditctl_t)
init_use_script_pty(auditctl_t)
init_dontaudit_use_fd(auditctl_t)
@ -155,6 +157,7 @@ libs_use_shared_libs(auditd_t)
miscfiles_read_localization(auditd_t)
mls_file_read_up(auditd_t)
mls_rangetrans_target(auditd_t)
seutil_dontaudit_read_config(auditd_t)
@ -227,6 +230,8 @@ logging_send_syslog_msg(klogd_t)
miscfiles_read_localization(klogd_t)
mls_file_read_up(klogd_t)
userdom_dontaudit_search_sysadm_home_dir(klogd_t)
optional_policy(`udev',`

6
refpolicy/policy/modules/system/selinuxutil.fc
View File

@ -9,9 +9,9 @@
/etc/selinux/([^/]*/)?contexts/files(/.*)? gen_context(system_u:object_r:file_context_t,s0)
/etc/selinux/([^/]*/)?policy(/.*)? gen_context(system_u:object_r:policy_config_t,s0)
/etc/selinux/([^/]*/)?src(/.*)? gen_context(system_u:object_r:policy_src_t,s0)
/etc/selinux/([^/]*/)?policy(/.*)? gen_context(system_u:object_r:policy_config_t,s15:c0.c255)
/etc/selinux/([^/]*/)?seusers -- gen_context(system_u:object_r:selinux_config_t,s15:c0.c255)
/etc/selinux/([^/]*/)?users(/.*)? -- gen_context(system_u:object_r:selinux_config_t,s15:c0.c255)
#
# /root

23
refpolicy/policy/modules/system/selinuxutil.te
View File

@ -1,5 +1,5 @@
policy_module(selinuxutil,1.0.0)
policy_module(selinuxutil,1.0.1)
gen_require(`
bool secure_mode;
@ -182,6 +182,7 @@ domain_use_wide_inherit_fd(load_policy_t)
# for mcs.conf
files_read_etc_files(load_policy_t)
files_read_etc_runtime_files(load_policy_t)
libs_use_ld_so(load_policy_t)
libs_use_shared_libs(load_policy_t)
@ -190,16 +191,19 @@ miscfiles_read_localization(load_policy_t)
userdom_use_all_user_fd(load_policy_t)
ifdef(`targeted_policy', `
ifdef(`hide_broken_symptoms',`
# cjp: cover up stray file descriptors.
dontaudit load_policy_t selinux_config_t:file write;
optional_policy(`unconfined',`
unconfined_dontaudit_read_pipe(load_policy_t)
')
')
ifdef(`targeted_policy',`
term_use_unallocated_tty(load_policy_t)
term_use_generic_pty(load_policy_t)
')
# cjp: temporary hack to cover
# up stray file descriptors.
dontaudit load_policy_t selinux_config_t:file write;
unconfined_dontaudit_read_pipe(load_policy_t)
########################################
#
# Newrole local policy
@ -217,7 +221,8 @@ allow newrole_t self:msgq create_msgq_perms;
allow newrole_t self:msg { send receive };
allow newrole_t self:unix_dgram_socket sendto;
allow newrole_t self:unix_stream_socket { create_stream_socket_perms connectto };
allow newrole_t self:netlink_audit_socket { create bind write nlmsg_read read };
allow newrole_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay };
allow newrole_t { selinux_config_t default_context_t }:dir r_dir_perms;
allow newrole_t { selinux_config_t default_context_t }:file r_file_perms;
@ -407,8 +412,8 @@ selinux_compute_user_contexts(run_init_t)
ifdef(`targeted_policy',`',`
allow run_init_t self:process setexec;
allow run_init_t self:capability setuid;
allow run_init_t self:fifo_file rw_file_perms;
allow run_init_t self:netlink_audit_socket { create bind write nlmsg_read read };
# often the administrator runs such programs from a directory that is owned
# by a different user or has restrictive SE permissions, do not want to audit

6
refpolicy/policy/modules/system/udev.te
View File

@ -1,5 +1,5 @@
policy_module(udev,1.1.0)
policy_module(udev,1.1.1)
########################################
#
@ -39,7 +39,7 @@ files_pid_file(udev_var_run_t)
# Local policy
#
allow udev_t self:capability { chown dac_override dac_read_search fowner fsetid sys_admin mknod net_raw net_admin sys_nice sys_rawio sys_nice };
allow udev_t self:capability { chown dac_override dac_read_search fowner fsetid sys_admin mknod net_raw net_admin sys_nice sys_rawio sys_resource sys_nice };
dontaudit udev_t self:capability sys_tty_config;
allow udev_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
allow udev_t self:process { execmem setfscreate };
@ -79,6 +79,7 @@ kernel_read_device_sysctl(udev_t)
kernel_read_hotplug_sysctl(udev_t)
kernel_read_modprobe_sysctl(udev_t)
kernel_read_kernel_sysctl(udev_t)
kernel_rw_hotplug_sysctl(udev_t)
kernel_rw_unix_dgram_socket(udev_t)
kernel_sendto_unix_dgram_socket(udev_t)
kernel_signal(udev_t)
@ -141,6 +142,7 @@ seutil_domtrans_restorecon(udev_t)
sysnet_domtrans_ifconfig(udev_t)
userdom_use_sysadm_tty(udev_t)
userdom_dontaudit_search_all_users_home(udev_t)
ifdef(`distro_redhat',`
fs_manage_tmpfs_dirs(udev_t)

2
refpolicy/policy/modules/system/unconfined.fc
View File

@ -1,3 +1,5 @@
# Add programs here which should not be confined by SELinux
# e.g.:
# /usr/local/bin/appsrv -- gen_context(system_u:object_r:unconfined_exec_t,s0)
# For the time being until someone writes a sane policy, we need initrc to transition to unconfined_t
/usr/bin/vncserver -- gen_context(system_u:object_r:unconfined_exec_t,s0)

3
refpolicy/policy/modules/system/unconfined.te
View File

@ -1,5 +1,5 @@
policy_module(unconfined,1.1.2)
policy_module(unconfined,1.1.3)
########################################
#
@ -118,7 +118,6 @@ ifdef(`targeted_policy',`
optional_policy(`rpm',`
rpm_domtrans(unconfined_t)
rpm_script_domtrans(unconfined_t)
')
optional_policy(`samba',`

29
refpolicy/policy/modules/system/userdomain.if
View File

@ -572,6 +572,7 @@ template(`unpriv_user_template', `
corenet_dontaudit_tcp_bind_all_reserved_ports($1_t)
files_read_etc_files($1_t)
files_read_etc_runtime_files($1_t)
files_list_home($1_t)
files_read_usr_files($1_t)
files_exec_usr_files($1_t)
@ -1880,11 +1881,19 @@ interface(`userdom_getattr_sysadm_home_dir',`
## </param>
#
interface(`userdom_dontaudit_getattr_sysadm_home_dir',`
gen_require(`
type sysadm_home_dir_t;
')
ifdef(`targeted_policy',`
gen_require(`
type user_home_dir_t;
')
dontaudit $1 sysadm_home_dir_t:dir getattr;
dontaudit $1 user_home_dir_t:dir getattr;
', `
gen_require(`
type sysadm_home_dir_t;
')
dontaudit $1 sysadm_home_dir_t:dir getattr;
')
')
########################################
@ -1913,11 +1922,19 @@ interface(`userdom_search_sysadm_home_dir',`
## </param>
#
interface(`userdom_dontaudit_search_sysadm_home_dir',`
ifdef(`targeted_policy',`
gen_require(`
type sysadm_home_dir_t;
type user_home_dir_t;
')
dontaudit $1 sysadm_home_dir_t:dir search_dir_perms;
dontaudit $1 user_home_dir_t:dir search_dir_perms;
',`
gen_require(`
type sysadm_home_dir_t;
')
dontaudit $1 sysadm_home_dir_t:dir search_dir_perms;
')
')
########################################

17
refpolicy/policy/modules/system/userdomain.te
View File

@ -1,8 +1,8 @@
policy_module(userdomain,1.1.1)
policy_module(userdomain,1.1.2)
gen_require(`
role sysadm_r, staff_r, user_r;
role sysadm_r, staff_r, user_r, secadm_r;
')
########################################
@ -96,11 +96,19 @@ ifdef(`targeted_policy',`
type_transition privhome user_home_dir_t:{ dir file lnk_file fifo_file sock_file } user_home_t;
files_search_home(privhome)
ifdef(`enable_mls',`
allow secadm_r system_r;
allow secadm_r user_r;
allow user_r secadm_r;
allow staff_r secadm_r;
')
optional_policy(`samba',`
samba_per_userdomain_template(user)
')
',`
admin_user_template(sysadm)
admin_user_template(secadm)
unpriv_user_template(staff)
unpriv_user_template(user)
@ -111,6 +119,7 @@ ifdef(`targeted_policy',`
# only staff_r can change to sysadm_r
role_change(staff, sysadm)
role_change(staff, secadm)
# this should be tunable_policy, but
# currently type_change and RBAC allow
@ -133,6 +142,10 @@ ifdef(`targeted_policy',`
allow sysadm_t user_home_dir_t:dir create_dir_perms;
files_create_home_dirs(sysadm_t,user_home_dir_t)
mls_process_read_up(sysadm_t)
logging_read_audit_log(sysadm_t)
ifdef(`direct_sysadm_daemon',`
optional_policy(`init',`
init_run_daemon(sysadm_t,sysadm_r,admin_terminal)