reorder kernel policy, add attributes for sysctl and proc entries. fix unconfined interface
This commit is contained in:
Chris PeBenito
parent
f82c6ac64c
commit
d250634311
@ -1030,16 +1030,18 @@ interface(`kernel_rw_rpc_sysctl',`
|
||||
## </param>
|
||||
#
|
||||
interface(`kernel_read_all_sysctl',`
|
||||
kernel_read_device_sysctl($1)
|
||||
kernel_read_vm_sysctl($1)
|
||||
kernel_read_net_sysctl($1)
|
||||
kernel_read_unix_sysctl($1)
|
||||
kernel_read_hotplug_sysctl($1)
|
||||
kernel_read_modprobe_sysctl($1)
|
||||
kernel_read_kernel_sysctl($1)
|
||||
kernel_read_fs_sysctl($1)
|
||||
kernel_read_irq_sysctl($1)
|
||||
kernel_read_rpc_sysctl($1)
|
||||
gen_require(`
|
||||
attribute sysctl_type;
|
||||
type proc_t, proc_net_t;
|
||||
class dir r_dir_perms;
|
||||
class file r_file_perms;
|
||||
')
|
||||
|
||||
# proc_net_t for /proc/net/rpc sysctls
|
||||
allow $1 { proc_t proc_net_t }:dir search;
|
||||
|
||||
allow $1 sysctl_type:dir r_dir_perms;
|
||||
allow $1 sysctl_type:file r_file_perms;
|
||||
')
|
||||
|
||||
########################################
|
||||
@ -1051,16 +1053,18 @@ interface(`kernel_read_all_sysctl',`
|
||||
## </param>
|
||||
#
|
||||
interface(`kernel_rw_all_sysctl',`
|
||||
kernel_rw_device_sysctl($1)
|
||||
kernel_rw_vm_sysctl($1)
|
||||
kernel_rw_net_sysctl($1)
|
||||
kernel_rw_unix_sysctl($1)
|
||||
kernel_rw_hotplug_sysctl($1)
|
||||
kernel_rw_modprobe_sysctl($1)
|
||||
kernel_rw_kernel_sysctl($1)
|
||||
kernel_rw_fs_sysctl($1)
|
||||
kernel_rw_irq_sysctl($1)
|
||||
kernel_rw_rpc_sysctl($1)
|
||||
gen_require(`
|
||||
attribute sysctl_type;
|
||||
type proc_t, proc_net_t;
|
||||
class dir r_dir_perms;
|
||||
class file { rw_file_perms setattr };
|
||||
')
|
||||
|
||||
# proc_net_t for /proc/net/rpc sysctls
|
||||
allow $1 { proc_t proc_net_t }:dir search;
|
||||
|
||||
allow $1 sysctl_type:dir r_dir_perms;
|
||||
allow $1 sysctl_type:file { rw_file_perms setattr };
|
||||
')
|
||||
|
||||
########################################
|
||||
@ -1228,13 +1232,7 @@ interface(`kernel_use_unlabeled_blk_dev',`
|
||||
interface(`kernel_relabel_unlabeled',`
|
||||
gen_require(`
|
||||
type unlabeled_t;
|
||||
class dir { getattr relabelfrom };
|
||||
class file { getattr relabelfrom };
|
||||
class lnk_file { getattr relabelfrom };
|
||||
class fifo_file { getattr relabelfrom };
|
||||
class sock_file { getattr relabelfrom };
|
||||
class chr_file { getattr relabelfrom };
|
||||
class blk_file { getattr relabelfrom };
|
||||
gen_require_set({ getattr relabelfrom },dir_file_class_set)
|
||||
')
|
||||
|
||||
allow $1 unlabeled_t:dir_file_class_set { getattr relabelfrom };
|
||||
@ -1251,19 +1249,24 @@ interface(`kernel_relabel_unlabeled',`
|
||||
interface(`kernel_unconfined',`
|
||||
gen_require(`
|
||||
type kernel_t, unlabeled_t;
|
||||
attribute proc_type, sysctl_type;
|
||||
attribute kern_unconfined;
|
||||
attribute can_load_kernmodule, can_receive_kernel_messages;
|
||||
class dir r_dir_perms;
|
||||
class file { rw_file_perms setattr };
|
||||
')
|
||||
|
||||
# allow $1 proc_fs:{ dir file } *;
|
||||
allow $1 proc_type:{ dir file } *;
|
||||
|
||||
allow $1 sysctl_t:{ dir file } *;
|
||||
|
||||
allow $1 kernel_t:system *;
|
||||
|
||||
allow $1 unlabeled_t:{ dir lnk_file sock_file fifo_file blk_file } *;
|
||||
allow $1 unlabeled_t:dir_file_class_set *;
|
||||
allow $1 unlabeled_t:filesystem *;
|
||||
|
||||
typeattribute $1 can_load_kernmodule, can_receive_kernel_messages;
|
||||
typeattribute $1 kern_unconfined;
|
||||
|
||||
kernel_rw_all_sysctl($1)
|
||||
')
|
||||
|
||||
@ -10,6 +10,15 @@ policy_module(kernel,1.0)
|
||||
attribute can_load_kernmodule;
|
||||
attribute can_receive_kernel_messages;
|
||||
|
||||
# domains with unconfined access to kernel resources
|
||||
attribute kern_unconfined;
|
||||
|
||||
# regular entries in proc
|
||||
attribute proc_type;
|
||||
|
||||
# sysctls
|
||||
attribute sysctl_type;
|
||||
|
||||
#
|
||||
# kernel_t is the domain of kernel threads.
|
||||
# It is also the target type when checking permissions in the system class.
|
||||
@ -19,6 +28,83 @@ role system_r types kernel_t;
|
||||
domain_type(kernel_t)
|
||||
sid kernel context_template(system_u:system_r:kernel_t,s0 - s9:c0.c127)
|
||||
|
||||
#
|
||||
# Procfs types
|
||||
#
|
||||
|
||||
type proc_t, proc_type;
|
||||
files_mountpoint(proc_t)
|
||||
fs_type(proc_t)
|
||||
genfscon proc / context_template(system_u:object_r:proc_t,s0)
|
||||
genfscon proc /sysvipc context_template(system_u:object_r:proc_t,s0)
|
||||
|
||||
# kernel message interface
|
||||
type proc_kmsg_t, proc_type;
|
||||
genfscon proc /kmsg context_template(system_u:object_r:proc_kmsg_t,s0)
|
||||
neverallow ~can_receive_kernel_messages proc_kmsg_t:file ~getattr;
|
||||
|
||||
# /proc kcore: inaccessible
|
||||
type proc_kcore_t, proc_type;
|
||||
neverallow { domain -kern_unconfined } proc_kcore_t:file ~getattr;
|
||||
genfscon proc /kcore context_template(system_u:object_r:proc_kcore_t,s0)
|
||||
|
||||
type proc_mdstat_t, proc_type;
|
||||
genfscon proc /mdstat context_template(system_u:object_r:proc_mdstat_t,s0)
|
||||
|
||||
type proc_net_t, proc_type;
|
||||
genfscon proc /net context_template(system_u:object_r:proc_net_t,s0)
|
||||
|
||||
#
|
||||
# Sysctl types
|
||||
#
|
||||
|
||||
# /proc/sys directory, base directory of sysctls
|
||||
type sysctl_t, sysctl_type;
|
||||
files_mountpoint(sysctl_t)
|
||||
sid sysctl context_template(system_u:object_r:sysctl_t,s0)
|
||||
genfscon proc /sys context_template(system_u:object_r:sysctl_t,s0)
|
||||
|
||||
# /proc/irq directory and files
|
||||
type sysctl_irq_t, sysctl_type;
|
||||
genfscon proc /irq context_template(system_u:object_r:sysctl_irq_t,s0)
|
||||
|
||||
# /proc/net/rpc directory and files
|
||||
type sysctl_rpc_t, sysctl_type;
|
||||
genfscon proc /net/rpc context_template(system_u:object_r:sysctl_rpc_t,s0)
|
||||
|
||||
# /proc/sys/fs directory and files
|
||||
type sysctl_fs_t, sysctl_type;
|
||||
files_mountpoint(sysctl_fs_t)
|
||||
genfscon proc /sys/fs context_template(system_u:object_r:sysctl_fs_t,s0)
|
||||
|
||||
# /proc/sys/kernel directory and files
|
||||
type sysctl_kernel_t, sysctl_type;
|
||||
genfscon proc /sys/kernel context_template(system_u:object_r:sysctl_kernel_t,s0)
|
||||
|
||||
# /proc/sys/kernel/modprobe file
|
||||
type sysctl_modprobe_t, sysctl_type;
|
||||
genfscon proc /sys/kernel/modprobe context_template(system_u:object_r:sysctl_modprobe_t,s0)
|
||||
|
||||
# /proc/sys/kernel/hotplug file
|
||||
type sysctl_hotplug_t, sysctl_type;
|
||||
genfscon proc /sys/kernel/hotplug context_template(system_u:object_r:sysctl_hotplug_t,s0)
|
||||
|
||||
# /proc/sys/net directory and files
|
||||
type sysctl_net_t, sysctl_type;
|
||||
genfscon proc /sys/net context_template(system_u:object_r:sysctl_net_t,s0)
|
||||
|
||||
# /proc/sys/net/unix directory and files
|
||||
type sysctl_net_unix_t, sysctl_type;
|
||||
genfscon proc /sys/net/unix context_template(system_u:object_r:sysctl_net_unix_t,s0)
|
||||
|
||||
# /proc/sys/vm directory and files
|
||||
type sysctl_vm_t, sysctl_type;
|
||||
genfscon proc /sys/vm context_template(system_u:object_r:sysctl_vm_t,s0)
|
||||
|
||||
# /proc/sys/dev directory and files
|
||||
type sysctl_dev_t, sysctl_type;
|
||||
genfscon proc /sys/dev context_template(system_u:object_r:sysctl_dev_t,s0)
|
||||
|
||||
#
|
||||
# unlabeled_t is the type of unlabeled objects.
|
||||
# Objects that have no known labeling information or that
|
||||
@ -46,83 +132,6 @@ sid sysctl_vm context_template(system_u:object_r:unlabeled_t,s0)
|
||||
sid sysctl_dev context_template(system_u:object_r:unlabeled_t,s0)
|
||||
sid tcp_socket context_template(system_u:object_r:unlabeled_t,s0)
|
||||
|
||||
#
|
||||
# Procfs types
|
||||
#
|
||||
|
||||
type proc_t;
|
||||
files_mountpoint(proc_t)
|
||||
fs_type(proc_t)
|
||||
genfscon proc / context_template(system_u:object_r:proc_t,s0)
|
||||
genfscon proc /sysvipc context_template(system_u:object_r:proc_t,s0)
|
||||
|
||||
# kernel message interface
|
||||
type proc_kmsg_t;
|
||||
genfscon proc /kmsg context_template(system_u:object_r:proc_kmsg_t,s0)
|
||||
neverallow ~can_receive_kernel_messages proc_kmsg_t:file ~getattr;
|
||||
|
||||
# /proc kcore: inaccessible
|
||||
type proc_kcore_t;
|
||||
neverallow * proc_kcore_t:file ~getattr;
|
||||
genfscon proc /kcore context_template(system_u:object_r:proc_kcore_t,s0)
|
||||
|
||||
type proc_mdstat_t;
|
||||
genfscon proc /mdstat context_template(system_u:object_r:proc_mdstat_t,s0)
|
||||
|
||||
type proc_net_t;
|
||||
genfscon proc /net context_template(system_u:object_r:proc_net_t,s0)
|
||||
|
||||
#
|
||||
# Sysctl types
|
||||
#
|
||||
|
||||
# /proc/irq directory and files
|
||||
type sysctl_irq_t;
|
||||
genfscon proc /irq context_template(system_u:object_r:sysctl_irq_t,s0)
|
||||
|
||||
# /proc/net/rpc directory and files
|
||||
type sysctl_rpc_t;
|
||||
genfscon proc /net/rpc context_template(system_u:object_r:sysctl_rpc_t,s0)
|
||||
|
||||
# /proc/sys directory, base directory of sysctls
|
||||
type sysctl_t;
|
||||
files_mountpoint(sysctl_t)
|
||||
sid sysctl context_template(system_u:object_r:sysctl_t,s0)
|
||||
genfscon proc /sys context_template(system_u:object_r:sysctl_t,s0)
|
||||
|
||||
# /proc/sys/fs directory and files
|
||||
type sysctl_fs_t;
|
||||
files_mountpoint(sysctl_fs_t)
|
||||
genfscon proc /sys/fs context_template(system_u:object_r:sysctl_fs_t,s0)
|
||||
|
||||
# /proc/sys/kernel directory and files
|
||||
type sysctl_kernel_t;
|
||||
genfscon proc /sys/kernel context_template(system_u:object_r:sysctl_kernel_t,s0)
|
||||
|
||||
# /proc/sys/kernel/modprobe file
|
||||
type sysctl_modprobe_t;
|
||||
genfscon proc /sys/kernel/modprobe context_template(system_u:object_r:sysctl_modprobe_t,s0)
|
||||
|
||||
# /proc/sys/kernel/hotplug file
|
||||
type sysctl_hotplug_t;
|
||||
genfscon proc /sys/kernel/hotplug context_template(system_u:object_r:sysctl_hotplug_t,s0)
|
||||
|
||||
# /proc/sys/net directory and files
|
||||
type sysctl_net_t;
|
||||
genfscon proc /sys/net context_template(system_u:object_r:sysctl_net_t,s0)
|
||||
|
||||
# /proc/sys/net/unix directory and files
|
||||
type sysctl_net_unix_t;
|
||||
genfscon proc /sys/net/unix context_template(system_u:object_r:sysctl_net_unix_t,s0)
|
||||
|
||||
# /proc/sys/vm directory and files
|
||||
type sysctl_vm_t;
|
||||
genfscon proc /sys/vm context_template(system_u:object_r:sysctl_vm_t,s0)
|
||||
|
||||
# /proc/sys/dev directory and files
|
||||
type sysctl_dev_t;
|
||||
genfscon proc /sys/dev context_template(system_u:object_r:sysctl_dev_t,s0)
|
||||
|
||||
########################################
|
||||
#
|
||||
# kernel local policy
|
||||
|
||||
Loading…
Reference in New Issue
Block a user