rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

move fs_use and isids to respective modules

Browse Source
This commit is contained in:
Chris PeBenito 2005-06-02 15:39:10 +00:00
parent ca83afe7e6
commit cabfa520aa
7 changed files with 59 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
refpolicy/Makefile
View File

@ -102,7 +102,7 @@ ALL_LAYERS := $(filter-out tmp CVS $(APPCONF) $(FLASKDIR),$(DETECTED_DIRS))
PRE_TE_FILES := $(addprefix $(FLASKDIR)/,security_classes initial_sids access_vectors) $(M4SUPPORT) mls
ALL_INTERFACES := $(foreach dir,$(ALL_LAYERS),$(wildcard $(dir)/*.if))
ALL_TE_FILES := $(foreach dir,$(ALL_LAYERS),$(wildcard $(dir)/*.te))
POST_TE_FILES := users constraints initial_sid_contexts fs_use
POST_TE_FILES := users constraints
ALL_FC_FILES := $(foreach dir,$(ALL_LAYERS),$(wildcard $(dir)/*.fc))
@ -213,8 +213,12 @@ tmp/all_attrs_types.conf tmp/only_te_rules.conf tmp/all_post.conf: tmp/all_te_fi
$(QUIET) grep ^attribute tmp/all_te_files.conf > tmp/all_attrs_types.conf || true
$(QUIET) grep '^type ' tmp/all_te_files.conf >> tmp/all_attrs_types.conf
$(QUIET) cat tmp/post_te_files.conf > tmp/all_post.conf
$(QUIET) grep '^sid ' tmp/all_te_files.conf >> tmp/all_post.conf || true
$(QUIET) egrep '^fs_use_(xattr|task|trans)' tmp/all_te_files.conf >> tmp/all_post.conf || true
$(QUIET) grep ^genfscon tmp/all_te_files.conf >> tmp/all_post.conf || true
$(QUIET) sed -e /^attribute/d -e '/^type /d' -e /^genfscon/d < tmp/all_te_files.conf > tmp/only_te_rules.conf
$(QUIET) sed -r -e /^attribute/d -e '/^type /d' -e /^genfscon/d \
-e '/^sid /d' -e '/^fs_use_(xattr|task|trans)/d' \
< tmp/all_te_files.conf > tmp/only_te_rules.conf
########################################
#

4
refpolicy/policy/modules/kernel/corenetwork.te
View File

@ -24,6 +24,7 @@ devices_make_device_node(tun_tap_device_t)
# port_t is the default type of INET port numbers.
#
type port_t, port_type;
sid port context_template(system_u:object_r:port_t,s0)
#
# reserved_port_t is the type of INET port numbers below 1024.
@ -94,6 +95,7 @@ portcon udp 1-1023 context_template(system_u:object_r:reserved_port_t, s0)
# nodes in net_contexts or net_contexts.mls.
#
type node_t, node_type;
sid node context_template(system_u:object_r:node_t,s0)
network_node(compat_ipv4, s0, ::, ffff:ffff:ffff:ffff:ffff:ffff::)
network_node(inaddr_any, s0, 0.0.0.0, 255.255.255.255)
@ -105,7 +107,6 @@ network_node(multicast, s0, ff00::, ff00::)
network_node(site_local, s0, fec0::, ffc0::)
network_node(unspec, s0, ::, ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff)
########################################
#
# Network Interfaces:
@ -115,6 +116,7 @@ network_node(unspec, s0, ::, ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff)
# netif_t is the default type of network interfaces.
#
type netif_t, netif_type;
sid netif context_template(system_u:object_r:netif_t,s0)
network_interface(lo, s0)
network_interface(eth0, s0)

1
refpolicy/policy/modules/kernel/devices.te
View File

@ -112,6 +112,7 @@ genfscon proc /mtrr context_template(system_u:object_r:mtrr_device_t,s0)
type null_device_t, device_node;
filesystem_associate(null_device_t)
filesystem_tmpfs_associate(null_device_t)
sid devnull context_template(system_u:object_r:null_device_t,s0)
#
# Type for /dev/pmu

24
refpolicy/policy/modules/kernel/filesystem.te
View File

@ -9,6 +9,22 @@ attribute fs_type;
# filesystems with extended attributes
#
type fs_t, fs_type;
sid fs context_template(system_u:object_r:fs_t,s0)
# Use xattrs for the following filesystem types.
# Requires that a security xattr handler exist for the filesystem.
fs_use_xattr ext2 context_template(system_u:object_r:fs_t,s0);
fs_use_xattr ext3 context_template(system_u:object_r:fs_t,s0);
fs_use_xattr jfs context_template(system_u:object_r:fs_t,s0);
fs_use_xattr xfs context_template(system_u:object_r:fs_t,s0);
# Use the allocating task SID to label inodes in the following filesystem
# types, and label the filesystem itself with the specified context.
# This is appropriate for pseudo filesystems that represent objects
# like pipes and sockets, so that these objects are labeled with the same
# type as the creating task.
fs_use_task pipefs context_template(system_u:object_r:fs_t,s0);
fs_use_task sockfs context_template(system_u:object_r:fs_t,s0);
########################################
#
@ -47,6 +63,14 @@ genfscon rpc_pipefs / context_template(system_u:object_r:rpc_pipefs_t,s0)
type tmpfs_t, fs_type;
files_make_file(tmpfs_t)
# Use a transition SID based on the allocating task SID and the
# filesystem SID to label inodes in the following filesystem types,
# and label the filesystem itself with the specified context.
# This is appropriate for pseudo filesystems like devpts and tmpfs
# where we want to label objects with a derived type.
fs_use_trans tmpfs context_template(system_u:object_r:tmpfs_t,s0);
fs_use_trans shm context_template(system_u:object_r:tmpfs_t,s0);
allow tmpfs_t self:filesystem associate;
allow tmpfs_t autofs_t:filesystem associate;
allow tmpfs_t cifs_t:filesystem associate;

23
refpolicy/policy/modules/kernel/kernel.te
View File

@ -20,6 +20,7 @@ attribute can_change_object_identity;
type kernel_t, can_load_kernmodule, can_load_policy;
role system_r types kernel_t;
domain_make_domain(kernel_t)
sid kernel context_template(system_u:system_r:kernel_t,s0 - s9:c0.c127)
#
# unlabeled_t is the type of unlabeled objects.
@ -27,6 +28,26 @@ domain_make_domain(kernel_t)
# have labels that are no longer valid are treated as having this type.
#
type unlabeled_t;
sid unlabeled context_template(system_u:object_r:unlabeled_t,s0)
# These initial sids are no longer used, and can be removed:
sid any_socket context_template(system_u:object_r:unlabeled_t,s0)
sid file_labels context_template(system_u:object_r:unlabeled_t,s0)
sid icmp_socket context_template(system_u:object_r:unlabeled_t,s0)
sid igmp_packet context_template(system_u:object_r:unlabeled_t,s0)
sid init context_template(system_u:object_r:unlabeled_t,s0)
sid kmod context_template(system_u:object_r:unlabeled_t,s0)
sid netmsg context_template(system_u:object_r:unlabeled_t,s0)
sid policy context_template(system_u:object_r:unlabeled_t,s0)
sid scmp_packet context_template(system_u:object_r:unlabeled_t,s0)
sid sysctl_modprobe context_template(system_u:object_r:unlabeled_t,s0)
sid sysctl_fs context_template(system_u:object_r:unlabeled_t,s0)
sid sysctl_kernel context_template(system_u:object_r:unlabeled_t,s0)
sid sysctl_net context_template(system_u:object_r:unlabeled_t,s0)
sid sysctl_net_unix context_template(system_u:object_r:unlabeled_t,s0)
sid sysctl_vm context_template(system_u:object_r:unlabeled_t,s0)
sid sysctl_dev context_template(system_u:object_r:unlabeled_t,s0)
sid tcp_socket context_template(system_u:object_r:unlabeled_t,s0)
#
# security_t is the target type when checking
@ -35,6 +56,7 @@ type unlabeled_t;
#
type security_t;
filesystem_make_filesystem(security_t)
sid security context_template(system_u:object_r:security_t,s0)
genfscon selinuxfs / context_template(system_u:object_r:security_t,s0)
#
@ -95,6 +117,7 @@ genfscon proc /net/rpc context_template(system_u:object_r:sysctl_rpc_t,s0)
# /proc/sys directory, base directory of sysctls
type sysctl_t;
files_make_mountpoint(sysctl_t)
sid sysctl context_template(system_u:object_r:sysctl_t,s0)
genfscon proc /sys context_template(system_u:object_r:sysctl_t,s0)
# /proc/sys/fs directory and files

1
refpolicy/policy/modules/kernel/terminal.te
View File

@ -23,6 +23,7 @@ devices_make_device_node(console_device_t)
type devpts_t;
files_make_mountpoint(devpts_t)
filesystem_make_filesystem(devpts_t)
fs_use_trans devpts context_template(system_u:object_r:devpts_t,s0);
#
# devtty_t is the type of /dev/tty.

1
refpolicy/policy/modules/system/files.te
View File

@ -40,6 +40,7 @@ type file_t, file_type, mountpoint;
filesystem_associate(file_t)
filesystem_noxattr_associate(file_t)
kernel_make_root_filesystem_mountpoint(file_t)
sid file context_template(system_u:object_r:file_t,s0)
#
# home_root_t is the type for the directory where user home directories