reorder kernel policy, add attributes for sysctl and proc entries. fix unconfined interface
This commit is contained in:
Chris PeBenito
parent
f82c6ac64c
commit
d250634311
@ -1030,16 +1030,18 @@ interface(`kernel_rw_rpc_sysctl',`
|
|||||||
## </param>
|
## </param>
|
||||||
#
|
#
|
||||||
interface(`kernel_read_all_sysctl',`
|
interface(`kernel_read_all_sysctl',`
|
||||||
kernel_read_device_sysctl($1)
|
gen_require(`
|
||||||
kernel_read_vm_sysctl($1)
|
attribute sysctl_type;
|
||||||
kernel_read_net_sysctl($1)
|
type proc_t, proc_net_t;
|
||||||
kernel_read_unix_sysctl($1)
|
class dir r_dir_perms;
|
||||||
kernel_read_hotplug_sysctl($1)
|
class file r_file_perms;
|
||||||
kernel_read_modprobe_sysctl($1)
|
')
|
||||||
kernel_read_kernel_sysctl($1)
|
|
||||||
kernel_read_fs_sysctl($1)
|
# proc_net_t for /proc/net/rpc sysctls
|
||||||
kernel_read_irq_sysctl($1)
|
allow $1 { proc_t proc_net_t }:dir search;
|
||||||
kernel_read_rpc_sysctl($1)
|
|
||||||
|
allow $1 sysctl_type:dir r_dir_perms;
|
||||||
|
allow $1 sysctl_type:file r_file_perms;
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@ -1051,16 +1053,18 @@ interface(`kernel_read_all_sysctl',`
|
|||||||
## </param>
|
## </param>
|
||||||
#
|
#
|
||||||
interface(`kernel_rw_all_sysctl',`
|
interface(`kernel_rw_all_sysctl',`
|
||||||
kernel_rw_device_sysctl($1)
|
gen_require(`
|
||||||
kernel_rw_vm_sysctl($1)
|
attribute sysctl_type;
|
||||||
kernel_rw_net_sysctl($1)
|
type proc_t, proc_net_t;
|
||||||
kernel_rw_unix_sysctl($1)
|
class dir r_dir_perms;
|
||||||
kernel_rw_hotplug_sysctl($1)
|
class file { rw_file_perms setattr };
|
||||||
kernel_rw_modprobe_sysctl($1)
|
')
|
||||||
kernel_rw_kernel_sysctl($1)
|
|
||||||
kernel_rw_fs_sysctl($1)
|
# proc_net_t for /proc/net/rpc sysctls
|
||||||
kernel_rw_irq_sysctl($1)
|
allow $1 { proc_t proc_net_t }:dir search;
|
||||||
kernel_rw_rpc_sysctl($1)
|
|
||||||
|
allow $1 sysctl_type:dir r_dir_perms;
|
||||||
|
allow $1 sysctl_type:file { rw_file_perms setattr };
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@ -1228,13 +1232,7 @@ interface(`kernel_use_unlabeled_blk_dev',`
|
|||||||
interface(`kernel_relabel_unlabeled',`
|
interface(`kernel_relabel_unlabeled',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
type unlabeled_t;
|
type unlabeled_t;
|
||||||
class dir { getattr relabelfrom };
|
gen_require_set({ getattr relabelfrom },dir_file_class_set)
|
||||||
class file { getattr relabelfrom };
|
|
||||||
class lnk_file { getattr relabelfrom };
|
|
||||||
class fifo_file { getattr relabelfrom };
|
|
||||||
class sock_file { getattr relabelfrom };
|
|
||||||
class chr_file { getattr relabelfrom };
|
|
||||||
class blk_file { getattr relabelfrom };
|
|
||||||
')
|
')
|
||||||
|
|
||||||
allow $1 unlabeled_t:dir_file_class_set { getattr relabelfrom };
|
allow $1 unlabeled_t:dir_file_class_set { getattr relabelfrom };
|
||||||
@ -1251,19 +1249,24 @@ interface(`kernel_relabel_unlabeled',`
|
|||||||
interface(`kernel_unconfined',`
|
interface(`kernel_unconfined',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
type kernel_t, unlabeled_t;
|
type kernel_t, unlabeled_t;
|
||||||
|
attribute proc_type, sysctl_type;
|
||||||
|
attribute kern_unconfined;
|
||||||
attribute can_load_kernmodule, can_receive_kernel_messages;
|
attribute can_load_kernmodule, can_receive_kernel_messages;
|
||||||
|
class dir r_dir_perms;
|
||||||
|
class file { rw_file_perms setattr };
|
||||||
')
|
')
|
||||||
|
|
||||||
# allow $1 proc_fs:{ dir file } *;
|
allow $1 proc_type:{ dir file } *;
|
||||||
|
|
||||||
allow $1 sysctl_t:{ dir file } *;
|
allow $1 sysctl_t:{ dir file } *;
|
||||||
|
|
||||||
allow $1 kernel_t:system *;
|
allow $1 kernel_t:system *;
|
||||||
|
|
||||||
allow $1 unlabeled_t:{ dir lnk_file sock_file fifo_file blk_file } *;
|
allow $1 unlabeled_t:dir_file_class_set *;
|
||||||
allow $1 unlabeled_t:filesystem *;
|
allow $1 unlabeled_t:filesystem *;
|
||||||
|
|
||||||
typeattribute $1 can_load_kernmodule, can_receive_kernel_messages;
|
typeattribute $1 can_load_kernmodule, can_receive_kernel_messages;
|
||||||
|
typeattribute $1 kern_unconfined;
|
||||||
|
|
||||||
kernel_rw_all_sysctl($1)
|
kernel_rw_all_sysctl($1)
|
||||||
')
|
')
|
||||||
|
|||||||
@ -10,6 +10,15 @@ policy_module(kernel,1.0)
|
|||||||
attribute can_load_kernmodule;
|
attribute can_load_kernmodule;
|
||||||
attribute can_receive_kernel_messages;
|
attribute can_receive_kernel_messages;
|
||||||
|
|
||||||
|
# domains with unconfined access to kernel resources
|
||||||
|
attribute kern_unconfined;
|
||||||
|
|
||||||
|
# regular entries in proc
|
||||||
|
attribute proc_type;
|
||||||
|
|
||||||
|
# sysctls
|
||||||
|
attribute sysctl_type;
|
||||||
|
|
||||||
#
|
#
|
||||||
# kernel_t is the domain of kernel threads.
|
# kernel_t is the domain of kernel threads.
|
||||||
# It is also the target type when checking permissions in the system class.
|
# It is also the target type when checking permissions in the system class.
|
||||||
@ -19,6 +28,83 @@ role system_r types kernel_t;
|
|||||||
domain_type(kernel_t)
|
domain_type(kernel_t)
|
||||||
sid kernel context_template(system_u:system_r:kernel_t,s0 - s9:c0.c127)
|
sid kernel context_template(system_u:system_r:kernel_t,s0 - s9:c0.c127)
|
||||||
|
|
||||||
|
#
|
||||||
|
# Procfs types
|
||||||
|
#
|
||||||
|
|
||||||
|
type proc_t, proc_type;
|
||||||
|
files_mountpoint(proc_t)
|
||||||
|
fs_type(proc_t)
|
||||||
|
genfscon proc / context_template(system_u:object_r:proc_t,s0)
|
||||||
|
genfscon proc /sysvipc context_template(system_u:object_r:proc_t,s0)
|
||||||
|
|
||||||
|
# kernel message interface
|
||||||
|
type proc_kmsg_t, proc_type;
|
||||||
|
genfscon proc /kmsg context_template(system_u:object_r:proc_kmsg_t,s0)
|
||||||
|
neverallow ~can_receive_kernel_messages proc_kmsg_t:file ~getattr;
|
||||||
|
|
||||||
|
# /proc kcore: inaccessible
|
||||||
|
type proc_kcore_t, proc_type;
|
||||||
|
neverallow { domain -kern_unconfined } proc_kcore_t:file ~getattr;
|
||||||
|
genfscon proc /kcore context_template(system_u:object_r:proc_kcore_t,s0)
|
||||||
|
|
||||||
|
type proc_mdstat_t, proc_type;
|
||||||
|
genfscon proc /mdstat context_template(system_u:object_r:proc_mdstat_t,s0)
|
||||||
|
|
||||||
|
type proc_net_t, proc_type;
|
||||||
|
genfscon proc /net context_template(system_u:object_r:proc_net_t,s0)
|
||||||
|
|
||||||
|
#
|
||||||
|
# Sysctl types
|
||||||
|
#
|
||||||
|
|
||||||
|
# /proc/sys directory, base directory of sysctls
|
||||||
|
type sysctl_t, sysctl_type;
|
||||||
|
files_mountpoint(sysctl_t)
|
||||||
|
sid sysctl context_template(system_u:object_r:sysctl_t,s0)
|
||||||
|
genfscon proc /sys context_template(system_u:object_r:sysctl_t,s0)
|
||||||
|
|
||||||
|
# /proc/irq directory and files
|
||||||
|
type sysctl_irq_t, sysctl_type;
|
||||||
|
genfscon proc /irq context_template(system_u:object_r:sysctl_irq_t,s0)
|
||||||
|
|
||||||
|
# /proc/net/rpc directory and files
|
||||||
|
type sysctl_rpc_t, sysctl_type;
|
||||||
|
genfscon proc /net/rpc context_template(system_u:object_r:sysctl_rpc_t,s0)
|
||||||
|
|
||||||
|
# /proc/sys/fs directory and files
|
||||||
|
type sysctl_fs_t, sysctl_type;
|
||||||
|
files_mountpoint(sysctl_fs_t)
|
||||||
|
genfscon proc /sys/fs context_template(system_u:object_r:sysctl_fs_t,s0)
|
||||||
|
|
||||||
|
# /proc/sys/kernel directory and files
|
||||||
|
type sysctl_kernel_t, sysctl_type;
|
||||||
|
genfscon proc /sys/kernel context_template(system_u:object_r:sysctl_kernel_t,s0)
|
||||||
|
|
||||||
|
# /proc/sys/kernel/modprobe file
|
||||||
|
type sysctl_modprobe_t, sysctl_type;
|
||||||
|
genfscon proc /sys/kernel/modprobe context_template(system_u:object_r:sysctl_modprobe_t,s0)
|
||||||
|
|
||||||
|
# /proc/sys/kernel/hotplug file
|
||||||
|
type sysctl_hotplug_t, sysctl_type;
|
||||||
|
genfscon proc /sys/kernel/hotplug context_template(system_u:object_r:sysctl_hotplug_t,s0)
|
||||||
|
|
||||||
|
# /proc/sys/net directory and files
|
||||||
|
type sysctl_net_t, sysctl_type;
|
||||||
|
genfscon proc /sys/net context_template(system_u:object_r:sysctl_net_t,s0)
|
||||||
|
|
||||||
|
# /proc/sys/net/unix directory and files
|
||||||
|
type sysctl_net_unix_t, sysctl_type;
|
||||||
|
genfscon proc /sys/net/unix context_template(system_u:object_r:sysctl_net_unix_t,s0)
|
||||||
|
|
||||||
|
# /proc/sys/vm directory and files
|
||||||
|
type sysctl_vm_t, sysctl_type;
|
||||||
|
genfscon proc /sys/vm context_template(system_u:object_r:sysctl_vm_t,s0)
|
||||||
|
|
||||||
|
# /proc/sys/dev directory and files
|
||||||
|
type sysctl_dev_t, sysctl_type;
|
||||||
|
genfscon proc /sys/dev context_template(system_u:object_r:sysctl_dev_t,s0)
|
||||||
|
|
||||||
#
|
#
|
||||||
# unlabeled_t is the type of unlabeled objects.
|
# unlabeled_t is the type of unlabeled objects.
|
||||||
# Objects that have no known labeling information or that
|
# Objects that have no known labeling information or that
|
||||||
@ -46,83 +132,6 @@ sid sysctl_vm context_template(system_u:object_r:unlabeled_t,s0)
|
|||||||
sid sysctl_dev context_template(system_u:object_r:unlabeled_t,s0)
|
sid sysctl_dev context_template(system_u:object_r:unlabeled_t,s0)
|
||||||
sid tcp_socket context_template(system_u:object_r:unlabeled_t,s0)
|
sid tcp_socket context_template(system_u:object_r:unlabeled_t,s0)
|
||||||
|
|
||||||
#
|
|
||||||
# Procfs types
|
|
||||||
#
|
|
||||||
|
|
||||||
type proc_t;
|
|
||||||
files_mountpoint(proc_t)
|
|
||||||
fs_type(proc_t)
|
|
||||||
genfscon proc / context_template(system_u:object_r:proc_t,s0)
|
|
||||||
genfscon proc /sysvipc context_template(system_u:object_r:proc_t,s0)
|
|
||||||
|
|
||||||
# kernel message interface
|
|
||||||
type proc_kmsg_t;
|
|
||||||
genfscon proc /kmsg context_template(system_u:object_r:proc_kmsg_t,s0)
|
|
||||||
neverallow ~can_receive_kernel_messages proc_kmsg_t:file ~getattr;
|
|
||||||
|
|
||||||
# /proc kcore: inaccessible
|
|
||||||
type proc_kcore_t;
|
|
||||||
neverallow * proc_kcore_t:file ~getattr;
|
|
||||||
genfscon proc /kcore context_template(system_u:object_r:proc_kcore_t,s0)
|
|
||||||
|
|
||||||
type proc_mdstat_t;
|
|
||||||
genfscon proc /mdstat context_template(system_u:object_r:proc_mdstat_t,s0)
|
|
||||||
|
|
||||||
type proc_net_t;
|
|
||||||
genfscon proc /net context_template(system_u:object_r:proc_net_t,s0)
|
|
||||||
|
|
||||||
#
|
|
||||||
# Sysctl types
|
|
||||||
#
|
|
||||||
|
|
||||||
# /proc/irq directory and files
|
|
||||||
type sysctl_irq_t;
|
|
||||||
genfscon proc /irq context_template(system_u:object_r:sysctl_irq_t,s0)
|
|
||||||
|
|
||||||
# /proc/net/rpc directory and files
|
|
||||||
type sysctl_rpc_t;
|
|
||||||
genfscon proc /net/rpc context_template(system_u:object_r:sysctl_rpc_t,s0)
|
|
||||||
|
|
||||||
# /proc/sys directory, base directory of sysctls
|
|
||||||
type sysctl_t;
|
|
||||||
files_mountpoint(sysctl_t)
|
|
||||||
sid sysctl context_template(system_u:object_r:sysctl_t,s0)
|
|
||||||
genfscon proc /sys context_template(system_u:object_r:sysctl_t,s0)
|
|
||||||
|
|
||||||
# /proc/sys/fs directory and files
|
|
||||||
type sysctl_fs_t;
|
|
||||||
files_mountpoint(sysctl_fs_t)
|
|
||||||
genfscon proc /sys/fs context_template(system_u:object_r:sysctl_fs_t,s0)
|
|
||||||
|
|
||||||
# /proc/sys/kernel directory and files
|
|
||||||
type sysctl_kernel_t;
|
|
||||||
genfscon proc /sys/kernel context_template(system_u:object_r:sysctl_kernel_t,s0)
|
|
||||||
|
|
||||||
# /proc/sys/kernel/modprobe file
|
|
||||||
type sysctl_modprobe_t;
|
|
||||||
genfscon proc /sys/kernel/modprobe context_template(system_u:object_r:sysctl_modprobe_t,s0)
|
|
||||||
|
|
||||||
# /proc/sys/kernel/hotplug file
|
|
||||||
type sysctl_hotplug_t;
|
|
||||||
genfscon proc /sys/kernel/hotplug context_template(system_u:object_r:sysctl_hotplug_t,s0)
|
|
||||||
|
|
||||||
# /proc/sys/net directory and files
|
|
||||||
type sysctl_net_t;
|
|
||||||
genfscon proc /sys/net context_template(system_u:object_r:sysctl_net_t,s0)
|
|
||||||
|
|
||||||
# /proc/sys/net/unix directory and files
|
|
||||||
type sysctl_net_unix_t;
|
|
||||||
genfscon proc /sys/net/unix context_template(system_u:object_r:sysctl_net_unix_t,s0)
|
|
||||||
|
|
||||||
# /proc/sys/vm directory and files
|
|
||||||
type sysctl_vm_t;
|
|
||||||
genfscon proc /sys/vm context_template(system_u:object_r:sysctl_vm_t,s0)
|
|
||||||
|
|
||||||
# /proc/sys/dev directory and files
|
|
||||||
type sysctl_dev_t;
|
|
||||||
genfscon proc /sys/dev context_template(system_u:object_r:sysctl_dev_t,s0)
|
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
# kernel local policy
|
# kernel local policy
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user