rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

add a couple more nfs and cifs interfaces, to cover most of the

Browse Source 
use_(nfs|cifs)_home_dirs tunable
This commit is contained in:
Chris PeBenito 2005-06-16 20:33:51 +00:00
parent 77c124c8cd
commit d35c621eb0
19 changed files with 402 additions and 309 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
refpolicy/policy/modules/admin/rpm.te
View File

@ -118,6 +118,7 @@ dev_read_urand(rpm_t)
#fs_manage_nfs_dir(rpm_t) #fs_manage_nfs_dir(rpm_t)
#fs_manage_nfs_files(rpm_t) #fs_manage_nfs_files(rpm_t)
fs_manage_nfs_symlinks(rpm_t)
fs_getattr_all_fs(rpm_t) fs_getattr_all_fs(rpm_t)
storage_raw_write_fixed_disk(rpm_t) storage_raw_write_fixed_disk(rpm_t)
@ -176,7 +177,6 @@ allow rpm_t ttyfile:chr_file unlink;
allow rpm_t fs_type:dir { setattr rw_dir_perms }; allow rpm_t fs_type:dir { setattr rw_dir_perms };
allow rpm_t mount_t:tcp_socket write; allow rpm_t mount_t:tcp_socket write;
allow rpm_t nfs_t:lnk_file create_file_perms;
allow rpm_t sysfs_t:dir r_dir_perms; allow rpm_t sysfs_t:dir r_dir_perms;
allow rpm_t usbdevfs_t:dir r_dir_perms; allow rpm_t usbdevfs_t:dir r_dir_perms;

76
refpolicy/policy/modules/apps/gpg.if
View File

@ -43,10 +43,7 @@ define(`gpg_per_userdomain_template',`
# #
# transition from the userdomain to the derived domain # transition from the userdomain to the derived domain
allow $1_t $1_gpg_t:process transition; domain_auto_trans($1_t,gpg_exec_t,$1_gpg_t)
allow $1_t gpg_exec_t:file rx_file_perms;
type_transition $1_t gpg_exec_t:process $1_gpg_t;
dontaudit $1_t $1_gpg_t:process { noatsecure siginh rlimitinh };
allow $1_t $1_gpg_t:fd use; allow $1_t $1_gpg_t:fd use;
allow $1_gpg_t $1_t:fd use; allow $1_gpg_t $1_t:fd use;
@ -103,6 +100,18 @@ define(`gpg_per_userdomain_template',`
allow $1_gpg_t gpg_exec_t:file execmod; allow $1_gpg_t gpg_exec_t:file execmod;
') ')
tunable_policy(`use_nfs_home_dirs',`
fs_manage_nfs_dirs($1_gpg_t)
fs_manage_nfs_files($1_gpg_t)
fs_manage_nfs_symlinks($1_gpg_t)
')
tunable_policy(`use_samba_home_dirs',`
fs_manage_cifs_dirs($1_gpg_t)
fs_manage_cifs_files($1_gpg_t)
fs_manage_cifs_symlinks($1_gpg_t)
')
ifdef(`TODO',` ifdef(`TODO',`
can_ypbind($1_gpg_t) can_ypbind($1_gpg_t)
@ -134,13 +143,6 @@ define(`gpg_per_userdomain_template',`
# allow the usual access to /tmp # allow the usual access to /tmp
file_type_auto_trans($1_gpg_t, tmp_t, $1_tmp_t) file_type_auto_trans($1_gpg_t, tmp_t, $1_tmp_t)
tunable_policy(`use_nfs_home_dirs',`
create_dir_file($1_gpg_t, nfs_t)
')
tunable_policy(`use_samba_home_dirs',`
create_dir_file($1_gpg_t, cifs_t)
')
rw_dir_create_file($1_gpg_t, $1_file_type) rw_dir_create_file($1_gpg_t, $1_file_type)
allow $1_t $1_gpg_secret_t:dir rw_dir_perms; allow $1_t $1_gpg_secret_t:dir rw_dir_perms;
@ -157,11 +159,12 @@ define(`gpg_per_userdomain_template',`
# Note: this is only tested with the hkp interface. If you use eg the # Note: this is only tested with the hkp interface. If you use eg the
# mail interface you will likely need additional permissions. # mail interface you will likely need additional permissions.
# communicate with the user
allow $1_gpg_helper_t $1_t:fd use;
allow $1_gpg_helper_t $1_t:fifo_file write;
# transition from the gpg domain to the helper domain # transition from the gpg domain to the helper domain
allow $1_gpg_t $1_gpg_helper_t:process transition; domain_auto_trans($1_gpg_t,gpg_helper_exec_t,$1_gpg_helper_t)
allow $1_gpg_t gpg_helper_exec_t:file rx_file_perms;
type_transition $1_gpg_t gpg_helper_exec_t:process $1_gpg_helper_t;
dontaudit $1_gpg_helper_t $1_gpg_t:process { noatsecure siginh rlimitinh };
allow $1_gpg_t $1_gpg_helper_t:fd use; allow $1_gpg_t $1_gpg_helper_t:fd use;
allow $1_gpg_helper_t $1_gpg_t:fd use; allow $1_gpg_helper_t $1_gpg_t:fd use;
@ -197,18 +200,15 @@ define(`gpg_per_userdomain_template',`
sysnet_read_config($1_gpg_helper_t) sysnet_read_config($1_gpg_helper_t)
ifdef(`TODO',`
tunable_policy(`use_nfs_home_dirs',` tunable_policy(`use_nfs_home_dirs',`
dontaudit $1_gpg_helper_t nfs_t:file { read write }; fs_dontaudit_rw_nfs_files($1_gpg_helper_t)
')
tunable_policy(`use_samba_home_dirs',`
dontaudit $1_gpg_helper_t cifs_t:file { read write };
') ')
# communicate with the user tunable_policy(`use_samba_home_dirs',`
allow $1_gpg_helper_t $1_t:fd use; fs_dontaudit_rw_cifs_files($1_gpg_helper_t)
allow $1_gpg_helper_t $1_t:fifo_file write; ')
ifdef(`TODO',`
ifdef(`xdm.te', ` ifdef(`xdm.te', `
dontaudit $1_gpg_t xdm_t:fd use; dontaudit $1_gpg_t xdm_t:fd use;
@ -232,6 +232,9 @@ define(`gpg_per_userdomain_template',`
allow $1_t $1_gpg_agent_tmp_t:sock_file create_file_perms; allow $1_t $1_gpg_agent_tmp_t:sock_file create_file_perms;
files_create_tmp_files($1_gpg_agent_t, $1_gpg_agent_tmp_t, { file sock_file dir }) files_create_tmp_files($1_gpg_agent_t, $1_gpg_agent_tmp_t, { file sock_file dir })
# Transition from the user domain to the derived domain.
domain_auto_trans($1_t, gpg_agent_exec_t, $1_gpg_agent_t)
domain_use_wide_inherit_fd($1_gpg_agent_t) domain_use_wide_inherit_fd($1_gpg_agent_t)
libs_use_ld_so($1_gpg_agent_t) libs_use_ld_so($1_gpg_agent_t)
@ -239,9 +242,19 @@ define(`gpg_per_userdomain_template',`
miscfiles_read_localization($1_gpg_agent_t) miscfiles_read_localization($1_gpg_agent_t)
tunable_policy(`use_nfs_home_dirs',`
fs_manage_nfs_dirs($1_gpg_agent_t)
fs_manage_nfs_files($1_gpg_agent_t)
fs_manage_nfs_symlinks($1_gpg_agent_t)
')
tunable_policy(`use_samba_home_dirs',`
fs_manage_cifs_dirs($1_gpg_agent_t)
fs_manage_cifs_files($1_gpg_agent_t)
fs_manage_cifs_symlinks($1_gpg_agent_t)
')
ifdef(`TODO',` ifdef(`TODO',`
# Transition from the user domain to the derived domain.
domain_auto_trans($1_t, gpg_agent_exec_t, $1_gpg_agent_t)
allow $1_gpg_agent_t xdm_t:fd use; allow $1_gpg_agent_t xdm_t:fd use;
@ -261,12 +274,6 @@ define(`gpg_per_userdomain_template',`
# read and write ~/.gnupg (gpg-agent stores secret keys in ~/.gnupg/private-keys-v1.d ) # read and write ~/.gnupg (gpg-agent stores secret keys in ~/.gnupg/private-keys-v1.d )
allow $1_gpg_agent_t { home_root_t $1_home_dir_t }:dir search; allow $1_gpg_agent_t { home_root_t $1_home_dir_t }:dir search;
create_dir_file($1_gpg_agent_t, $1_gpg_secret_t) create_dir_file($1_gpg_agent_t, $1_gpg_secret_t)
tunable_policy(`use_nfs_home_dirs',`
create_dir_file($1_gpg_agent_t, nfs_t)
')
tunable_policy(`use_samba_home_dirs',`
create_dir_file($1_gpg_agent_t, cifs_t)
')
# gpg connect # gpg connect
allow $1_gpg_t $1_gpg_agent_tmp_t:dir search; allow $1_gpg_t $1_gpg_agent_tmp_t:dir search;
@ -281,10 +288,7 @@ define(`gpg_per_userdomain_template',`
# we need to allow gpg-agent to call pinentry so it can get the passphrase # we need to allow gpg-agent to call pinentry so it can get the passphrase
# from the user. # from the user.
allow $1_gpg_agent_t $1_gpg_pinentry_t:process transition; domain_auto_trans($1_gpg_agent_t,pinentry_exec_t,$1_gpg_pinentry_t)
allow $1_gpg_agent_t pinentry_exec_t:file rx_file_perms;
type_transition $1_gpg_agent_t pinentry_exec_t:process $1_gpg_pinentry_t;
dontaudit $1_gpg_agent_t $1_gpg_pinentry_t:process { noatsecure siginh rlimitinh };
allow $1_gpg_pinentry_t $1_gpg_agent_t:fd use; allow $1_gpg_pinentry_t $1_gpg_agent_t:fd use;
allow $1_gpg_agent_t $1_gpg_pinentry_t:fd use; allow $1_gpg_agent_t $1_gpg_pinentry_t:fd use;

184
refpolicy/policy/modules/kernel/filesystem.if
View File

@ -399,17 +399,14 @@ define(`fs_mount_cifs_depend',`
## </interface> ## </interface>
# #
define(`fs_remount_cifs',` define(`fs_remount_cifs',`
gen_require(`$0'_depend) gen_require(`
type cifs_t;
class filesystem remount;
')
allow $1 cifs_t:filesystem remount; allow $1 cifs_t:filesystem remount;
') ')
define(`fs_remount_cifs_depend',`
type cifs_t;
class filesystem remount;
')
######################################## ########################################
## <interface name="fs_unmount_cifs"> ## <interface name="fs_unmount_cifs">
## <description> ## <description>
@ -421,17 +418,14 @@ define(`fs_remount_cifs_depend',`
## </interface> ## </interface>
# #
define(`fs_unmount_cifs',` define(`fs_unmount_cifs',`
gen_require(`$0'_depend) gen_require(`
type cifs_t;
class filesystem unmount;
')
allow $1 cifs_t:filesystem mount; allow $1 cifs_t:filesystem mount;
') ')
define(`fs_unmount_cifs_depend',`
type cifs_t;
class filesystem unmount;
')
######################################## ########################################
## <interface name="fs_getattr_cifs"> ## <interface name="fs_getattr_cifs">
## <description> ## <description>
@ -445,15 +439,74 @@ define(`fs_unmount_cifs_depend',`
## </interface> ## </interface>
# #
define(`fs_getattr_cifs',` define(`fs_getattr_cifs',`
gen_require(`$0'_depend) gen_require(`
type cifs_t;
class filesystem getattr;
')
allow $1 cifs_t:filesystem getattr; allow $1 cifs_t:filesystem getattr;
') ')
define(`fs_getattr_cifs_depend',` ########################################
## <interface name="fs_read_cifs_files">
## <description>
## Read files on a CIFS or SMB filesystem.
## </description>
## <parameter name="domain">
## The type of the domain reading the files.
## </parameter>
## </interface>
#
define(`fs_read_cifs_files',`
gen_require(`
type cifs_t; type cifs_t;
class dir r_dir_perms;
class file r_file_perms;
')
class filesystem getattr; allow $1 cifs_t:dir r_dir_perms;
allow $1 cifs_t:file r_file_perms;
')
########################################
## <interface name="fs_dontaudit_rw_cifs_files">
## <description>
## Do not audit attempts to read or
## write files on a CIFS or SMB filesystem.
## </description>
## <parameter name="domain">
## The type of the domain to not audit.
## </parameter>
## </interface>
#
define(`fs_dontaudit_rw_cifs_files',`
gen_require(`
type cifs_t;
class file { read write };
')
dontaudit $1 cifs_t:file { read write };
')
########################################
## <interface name="fs_read_cifs_symlinks">
## <description>
## Read symbolic links on a CIFS or SMB filesystem.
## </description>
## <parameter name="domain">
## The type of the domain reading the symbolic links.
## </parameter>
## </interface>
#
define(`fs_read_cifs_symlinks',`
gen_require(`
type cifs_t;
class dir r_dir_perms;
class lnk_file r_file_perms;
')
allow $1 cifs_t:dir r_dir_perms;
allow $1 cifs_t:lnk_file r_file_perms;
') ')
######################################## ########################################
@ -482,6 +535,26 @@ define(`fs_execute_cifs_files_depend',`
class file { getattr read execute execute_no_trans }; class file { getattr read execute execute_no_trans };
') ')
########################################
## <interface name="fs_dontaudit_rw_cifs_files">
## <description>
## Do not audit attempts to read or
## write files on a CIFS or SMB filesystems.
## </description>
## <parameter name="domain">
## The type of the domain to not audit.
## </parameter>
## </interface>
#
define(`fs_read_cifs_files',`
gen_require(`
type cifs_t;
class file { read write };
')
dontaudit $1 cifs_t:file { read write };
')
######################################## ########################################
## <interface name="fs_manage_cifs_dirs"> ## <interface name="fs_manage_cifs_dirs">
## <description> ## <description>
@ -906,6 +979,27 @@ define(`fs_getattr_nfs_depend',`
class filesystem getattr; class filesystem getattr;
') ')
########################################
## <interface name="fs_read_nfs_files">
## <description>
## Read files on a NFS filesystem.
## </description>
## <parameter name="domain">
## The type of the domain reading the files.
## </parameter>
## </interface>
#
define(`fs_read_nfs_files',`
gen_require(`
type nfs_t;
class dir r_dir_perms;
class file r_file_perms;
')
allow $1 nfs_t:dir r_dir_perms;
allow $1 nfs_t:file r_file_perms;
')
######################################## ########################################
## <interface name="fs_execute_nfs_files"> ## <interface name="fs_execute_nfs_files">
## <description> ## <description>
@ -917,17 +1011,54 @@ define(`fs_getattr_nfs_depend',`
## </interface> ## </interface>
# #
define(`fs_execute_nfs_files',` define(`fs_execute_nfs_files',`
gen_require(`$0'_depend) gen_require(`
type nfs_t;
class dir r_dir_perms;
')
allow $1 nfs_t:dir r_dir_perms; allow $1 nfs_t:dir r_dir_perms;
can_exec($1, nfs_t) can_exec($1, nfs_t)
') ')
define(`fs_execute_nfs_files_depend',` ########################################
## <interface name="fs_dontaudit_rw_nfs_files">
## <description>
## Do not audit attempts to read or
## write files on a NFS filesystem.
## </description>
## <parameter name="domain">
## The type of the domain to not audit.
## </parameter>
## </interface>
#
define(`fs_dontaudit_rw_nfs_files',`
gen_require(`
type nfs_t; type nfs_t;
class file { read write };
')
dontaudit $1 nfs_t:file { read write };
')
########################################
## <interface name="fs_read_nfs_symlinks">
## <description>
## Read symbolic links on a NFS filesystem.
## </description>
## <parameter name="domain">
## The type of the domain reading the symbolic links.
## </parameter>
## </interface>
#
define(`fs_read_nfs_symlinks',`
gen_require(`
type nfs_t;
class dir r_dir_perms; class dir r_dir_perms;
class file { getattr read execute execute_no_trans }; class lnk_file r_file_perms;
')
allow $1 nfs_t:dir r_dir_perms;
allow $1 nfs_t:lnk_file r_file_perms;
') ')
######################################## ########################################
@ -990,19 +1121,16 @@ define(`fs_manage_nfs_files_depend',`
## </interface> ## </interface>
# #
define(`fs_manage_nfs_symlinks',` define(`fs_manage_nfs_symlinks',`
gen_require(`$0'_depend) gen_require(`
type nfs_t;
class dir r_dir_perms;
class lnk_file create_lnk_perms;
')
allow $1 nfs_t:dir rw_dir_perms; allow $1 nfs_t:dir rw_dir_perms;
allow $1 nfs_t:lnk_file create_lnk_perms; allow $1 nfs_t:lnk_file create_lnk_perms;
') ')
define(`fs_manage_nfs_symlinks_depend',`
type nfs_t;
class dir r_dir_perms;
class lnk_file create_lnk_perms;
')
######################################### #########################################
## <interface name="fs_manage_nfs_named_pipes"> ## <interface name="fs_manage_nfs_named_pipes">
## <description> ## <description>

275
refpolicy/policy/modules/kernel/storage.if
View File

@ -13,18 +13,15 @@
## </interface> ## </interface>
# #
define(`storage_getattr_fixed_disk',` define(`storage_getattr_fixed_disk',`
gen_require(`$0'_depend) gen_require(`
type fixed_disk_device_t;
class blk_file getattr;
')
dev_list_all_dev_nodes($1) dev_list_all_dev_nodes($1)
allow $1 fixed_disk_device_t:blk_file getattr; allow $1 fixed_disk_device_t:blk_file getattr;
') ')
define(`storage_getattr_fixed_disk_depend',`
type fixed_disk_device_t;
class blk_file getattr;
')
######################################## ########################################
## <interface name="storage_dontaudit_getattr_fixed_disk"> ## <interface name="storage_dontaudit_getattr_fixed_disk">
## <description> ## <description>
@ -37,17 +34,14 @@ define(`storage_getattr_fixed_disk_depend',`
## </interface> ## </interface>
# #
define(`storage_dontaudit_getattr_fixed_disk',` define(`storage_dontaudit_getattr_fixed_disk',`
gen_require(`$0'_depend) gen_require(`
type fixed_disk_device_t;
class blk_file getattr;
')
dontaudit $1 fixed_disk_device_t:blk_file getattr; dontaudit $1 fixed_disk_device_t:blk_file getattr;
') ')
define(`storage_dontaudit_getattr_fixed_disk_depend',`
type fixed_disk_device_t;
class blk_file getattr;
')
######################################## ########################################
## <interface name="storage_setattr_fixed_disk"> ## <interface name="storage_setattr_fixed_disk">
## <description> ## <description>
@ -60,16 +54,33 @@ define(`storage_dontaudit_getattr_fixed_disk_depend',`
## </interface> ## </interface>
# #
define(`storage_setattr_fixed_disk',` define(`storage_setattr_fixed_disk',`
gen_require(`$0'_depend) gen_require(`
type fixed_disk_device_t;
class blk_file setattr;
')
dev_list_all_dev_nodes($1) dev_list_all_dev_nodes($1)
allow $1 fixed_disk_device_t:blk_file setattr; allow $1 fixed_disk_device_t:blk_file setattr;
') ')
define(`storage_setattr_fixed_disk_depend',` ########################################
## <interface name="storage_dontaudit_setattr_fixed_disk">
## <description>
## Do not audit attempts made by the caller to set
## the attributes of fixed disk device nodes.
## </description>
## <parameter name="domain">
## The type of the process to not audit.
## </parameter>
## </interface>
#
define(`storage_dontaudit_setattr_fixed_disk',`
gen_require(`
type fixed_disk_device_t; type fixed_disk_device_t;
class blk_file getattr;
')
class blk_file setattr; dontaudit $1 fixed_disk_device_t:blk_file getattr;
') ')
######################################## ########################################
@ -86,21 +97,17 @@ define(`storage_setattr_fixed_disk_depend',`
## </interface> ## </interface>
# #
define(`storage_raw_read_fixed_disk',` define(`storage_raw_read_fixed_disk',`
gen_require(`$0'_depend) gen_require(`
attribute fixed_disk_raw_read;
type fixed_disk_device_t;
class blk_file r_file_perms;
')
dev_list_all_dev_nodes($1) dev_list_all_dev_nodes($1)
allow $1 fixed_disk_device_t:blk_file r_file_perms; allow $1 fixed_disk_device_t:blk_file r_file_perms;
typeattribute $1 fixed_disk_raw_read; typeattribute $1 fixed_disk_raw_read;
') ')
define(`storage_raw_read_fixed_disk_depend',`
attribute fixed_disk_raw_read;
type fixed_disk_device_t;
class blk_file r_file_perms;
')
######################################## ########################################
## <interface name="storage_raw_write_fixed_disk"> ## <interface name="storage_raw_write_fixed_disk">
## <description> ## <description>
@ -115,21 +122,17 @@ define(`storage_raw_read_fixed_disk_depend',`
## </interface> ## </interface>
# #
define(`storage_raw_write_fixed_disk',` define(`storage_raw_write_fixed_disk',`
gen_require(`$0'_depend) gen_require(`
attribute fixed_disk_raw_write;
type fixed_disk_device_t;
class blk_file { getattr write ioctl };
')
dev_list_all_dev_nodes($1) dev_list_all_dev_nodes($1)
allow $1 fixed_disk_device_t:blk_file { getattr write ioctl }; allow $1 fixed_disk_device_t:blk_file { getattr write ioctl };
typeattribute $1 fixed_disk_raw_write; typeattribute $1 fixed_disk_raw_write;
') ')
define(`storage_raw_write_fixed_disk_depend',`
attribute fixed_disk_raw_write;
type fixed_disk_device_t;
class blk_file { getattr write ioctl };
')
######################################## ########################################
## <interface name="storage_create_fixed_disk"> ## <interface name="storage_create_fixed_disk">
## <description> ## <description>
@ -141,19 +144,17 @@ define(`storage_raw_write_fixed_disk_depend',`
## </interface> ## </interface>
# #
define(`storage_create_fixed_disk_dev_entry',` define(`storage_create_fixed_disk_dev_entry',`
gen_require(`$0'_depend) gen_require(`
attribute fixed_disk_raw_read, fixed_disk_raw_write;
type fixed_disk_device_t;
class blk_file create_file_perms;
')
allow $1 fixed_disk_device_t:blk_file create_file_perms; allow $1 fixed_disk_device_t:blk_file create_file_perms;
dev_create_dev_node($1,fixed_disk_device_t,blk_file) dev_create_dev_node($1,fixed_disk_device_t,blk_file)
typeattribute $1 fixed_disk_raw_read, fixed_disk_raw_write; typeattribute $1 fixed_disk_raw_read, fixed_disk_raw_write;
') ')
define(`storage_create_fixed_disk_dev_entry_depend',`
type fixed_disk_device_t;
class blk_file create_file_perms;
')
######################################## ########################################
## <interface name="storage_manage_fixed_disk"> ## <interface name="storage_manage_fixed_disk">
## <description> ## <description>
@ -165,21 +166,17 @@ define(`storage_create_fixed_disk_dev_entry_depend',`
## </interface> ## </interface>
# #
define(`storage_manage_fixed_disk',` define(`storage_manage_fixed_disk',`
gen_require(`$0'_depend) gen_require(`
attribute fixed_disk_raw_read, fixed_disk_raw_write;
type fixed_disk_device_t;
class blk_file create_file_perms;
')
dev_list_all_dev_nodes($1) dev_list_all_dev_nodes($1)
allow $1 fixed_disk_device_t:blk_file create_file_perms; allow $1 fixed_disk_device_t:blk_file create_file_perms;
typeattribute $1 fixed_disk_raw_read, fixed_disk_raw_write; typeattribute $1 fixed_disk_raw_read, fixed_disk_raw_write;
') ')
define(`storage_manage_fixed_disk_depend',`
attribute fixed_disk_raw_read, fixed_disk_raw_write;
type fixed_disk_device_t;
class blk_file create_file_perms;
')
######################################## ########################################
## <interface name="storage_raw_read_lvm_volume"> ## <interface name="storage_raw_read_lvm_volume">
## <description> ## <description>
@ -194,21 +191,17 @@ define(`storage_manage_fixed_disk_depend',`
## </interface> ## </interface>
# #
define(`storage_raw_read_lvm_volume',` define(`storage_raw_read_lvm_volume',`
gen_require(`$0'_depend) gen_require(`
attribute fixed_disk_raw_read;
type lvm_vg_t;
class blk_file r_file_perms;
')
dev_list_all_dev_nodes($1) dev_list_all_dev_nodes($1)
allow $1 lvm_vg_t:blk_file r_file_perms; allow $1 lvm_vg_t:blk_file r_file_perms;
typeattribute $1 fixed_disk_raw_read; typeattribute $1 fixed_disk_raw_read;
') ')
define(`storage_raw_read_lvm_volume_depend',`
attribute fixed_disk_raw_read;
type lvm_vg_t;
class blk_file r_file_perms;
')
######################################## ########################################
## <interface name="storage_raw_write_lvm_volume"> ## <interface name="storage_raw_write_lvm_volume">
## <description> ## <description>
@ -223,21 +216,17 @@ define(`storage_raw_read_lvm_volume_depend',`
## </interface> ## </interface>
# #
define(`storage_raw_write_lvm_volume',` define(`storage_raw_write_lvm_volume',`
gen_require(`$0'_depend) gen_require(`
attribute fixed_disk_raw_write;
type lvm_vg_t;
class blk_file { getattr write ioctl };
')
dev_list_all_dev_nodes($1) dev_list_all_dev_nodes($1)
allow $1 lvm_vg_t:blk_file { getattr write ioctl }; allow $1 lvm_vg_t:blk_file { getattr write ioctl };
typeattribute $1 fixed_disk_raw_write; typeattribute $1 fixed_disk_raw_write;
') ')
define(`storage_raw_write_lvm_volume_depend',`
attribute fixed_disk_raw_write;
type lvm_vg_t;
class blk_file { getattr write ioctl };
')
######################################## ########################################
## <interface name="storage_read_scsi_generic"> ## <interface name="storage_read_scsi_generic">
## <description> ## <description>
@ -253,21 +242,17 @@ define(`storage_raw_write_lvm_volume_depend',`
## </interface> ## </interface>
# #
define(`storage_read_scsi_generic',` define(`storage_read_scsi_generic',`
gen_require(`$0'_depend) gen_require(`
attribute scsi_generic_read;
type scsi_generic_device_t;
class blk_file r_file_perms;
')
dev_list_all_dev_nodes($1) dev_list_all_dev_nodes($1)
allow $1 scsi_generic_device_t:blk_file r_file_perms; allow $1 scsi_generic_device_t:blk_file r_file_perms;
typeattribute $1 scsi_generic_read; typeattribute $1 scsi_generic_read;
') ')
define(`storage_read_scsi_generic_depend',`
attribute scsi_generic_read;
type scsi_generic_device_t;
class blk_file r_file_perms;
')
######################################## ########################################
## <interface name="storage_write_scsi_generic"> ## <interface name="storage_write_scsi_generic">
## <description> ## <description>
@ -283,21 +268,17 @@ define(`storage_read_scsi_generic_depend',`
## </interface> ## </interface>
# #
define(`storage_write_scsi_generic',` define(`storage_write_scsi_generic',`
gen_require(`$0'_depend) gen_require(`
attribute scsi_generic_write;
type scsi_generic_device_t;
class blk_file { getattr write ioctl };
')
dev_list_all_dev_nodes($1) dev_list_all_dev_nodes($1)
allow $1 scsi_generic_device_t:blk_file { getattr write ioctl }; allow $1 scsi_generic_device_t:blk_file { getattr write ioctl };
typeattribute $1 scsi_generic_write; typeattribute $1 scsi_generic_write;
') ')
define(`storage_write_scsi_generic_depend',`
attribute scsi_generic_write;
type scsi_generic_device_t;
class blk_file { getattr write ioctl };
')
######################################## ########################################
## <interface name="storage_getattr_scsi_generic"> ## <interface name="storage_getattr_scsi_generic">
## <description> ## <description>
@ -310,18 +291,15 @@ define(`storage_write_scsi_generic_depend',`
## </interface> ## </interface>
# #
define(`storage_getattr_scsi_generic',` define(`storage_getattr_scsi_generic',`
gen_require(`$0'_depend) gen_require(`
type scsi_generic_device_t;
class blk_file getattr;
')
dev_list_all_dev_nodes($1) dev_list_all_dev_nodes($1)
allow $1 scsi_generic_device_t:blk_file getattr; allow $1 scsi_generic_device_t:blk_file getattr;
') ')
define(`storage_getattr_scsi_generic_depend',`
type scsi_generic_device_t;
class blk_file getattr;
')
######################################## ########################################
## <interface name="storage_setattr_scsi_generic"> ## <interface name="storage_setattr_scsi_generic">
## <description> ## <description>
@ -334,18 +312,15 @@ define(`storage_getattr_scsi_generic_depend',`
## </interface> ## </interface>
# #
define(`storage_set_scsi_generic_attributes',` define(`storage_set_scsi_generic_attributes',`
gen_require(`$0'_depend) gen_require(`
type scsi_generic_device_t;
class blk_file setattr;
')
dev_list_all_dev_nodes($1) dev_list_all_dev_nodes($1)
allow $1 scsi_generic_device_t:blk_file setattr; allow $1 scsi_generic_device_t:blk_file setattr;
') ')
define(`storage_set_scsi_generic_attributes_depend',`
type scsi_generic_device_t;
class blk_file setattr;
')
######################################## ########################################
## <interface name="storage_getattr_removable_device"> ## <interface name="storage_getattr_removable_device">
## <description> ## <description>
@ -358,18 +333,15 @@ define(`storage_set_scsi_generic_attributes_depend',`
## </interface> ## </interface>
# #
define(`storage_getattr_removable_device',` define(`storage_getattr_removable_device',`
gen_require(`$0'_depend) gen_require(`
type removable_device_t;
class blk_file getattr;
')
dev_list_all_dev_nodes($1) dev_list_all_dev_nodes($1)
allow $1 removable_device_t:blk_file getattr; allow $1 removable_device_t:blk_file getattr;
') ')
define(`storage_getattr_removable_device_depend',`
type removable_device_t;
class blk_file getattr;
')
######################################## ########################################
## <interface name="storage_dontaudit_getattr_removable_device"> ## <interface name="storage_dontaudit_getattr_removable_device">
## <description> ## <description>
@ -382,17 +354,14 @@ define(`storage_getattr_removable_device_depend',`
## </interface> ## </interface>
# #
define(`storage_dontaudit_getattr_removable_device',` define(`storage_dontaudit_getattr_removable_device',`
gen_require(`$0'_depend) gen_require(`
type removable_device_t;
class blk_file getattr;
')
dontaudit $1 removable_device_t:blk_file getattr; dontaudit $1 removable_device_t:blk_file getattr;
') ')
define(`storage_dontaudit_getattr_removable_device_depend',`
type removable_device_t;
class blk_file getattr;
')
######################################## ########################################
## <interface name="storage_setattr_removable_device"> ## <interface name="storage_setattr_removable_device">
## <description> ## <description>
@ -405,18 +374,15 @@ define(`storage_dontaudit_getattr_removable_device_depend',`
## </interface> ## </interface>
# #
define(`storage_setattr_removable_device',` define(`storage_setattr_removable_device',`
gen_require(`$0'_depend) gen_require(`
type removable_device_t;
class blk_file setattr;
')
dev_list_all_dev_nodes($1) dev_list_all_dev_nodes($1)
allow $1 removable_device_t:blk_file setattr; allow $1 removable_device_t:blk_file setattr;
') ')
define(`storage_setattr_removable_device_depend',`
type removable_device_t;
class blk_file setattr;
')
######################################## ########################################
## <interface name="storage_raw_read_removable_device"> ## <interface name="storage_raw_read_removable_device">
## <description> ## <description>
@ -432,18 +398,15 @@ define(`storage_setattr_removable_device_depend',`
## </interface> ## </interface>
# #
define(`storage_raw_read_removable_device',` define(`storage_raw_read_removable_device',`
gen_require(`$0'_depend) gen_require(`
type removable_device_t;
class blk_file r_file_perms;
')
dev_list_all_dev_nodes($1) dev_list_all_dev_nodes($1)
allow $1 removable_device_t:blk_file r_file_perms; allow $1 removable_device_t:blk_file r_file_perms;
') ')
define(`storage_raw_read_removable_device_depend',`
type removable_device_t;
class blk_file r_file_perms;
')
######################################## ########################################
## <interface name="storage_raw_write_removable_device"> ## <interface name="storage_raw_write_removable_device">
## <description> ## <description>
@ -459,18 +422,15 @@ define(`storage_raw_read_removable_device_depend',`
## </interface> ## </interface>
# #
define(`storage_raw_write_removable_device',` define(`storage_raw_write_removable_device',`
gen_require(`$0'_depend) gen_require(`
type removable_device_t;
class blk_file { getattr write ioctl };
')
dev_list_all_dev_nodes($1) dev_list_all_dev_nodes($1)
allow $1 removable_device_t:blk_file { getattr write ioctl }; allow $1 removable_device_t:blk_file { getattr write ioctl };
') ')
define(`storage_raw_write_removable_device_depend',`
type removable_device_t;
class blk_file { getattr write ioctl };
')
######################################## ########################################
## <interface name="storage_read_tape_device"> ## <interface name="storage_read_tape_device">
## <description> ## <description>
@ -483,18 +443,15 @@ define(`storage_raw_write_removable_device_depend',`
## </interface> ## </interface>
# #
define(`storage_read_tape_device',` define(`storage_read_tape_device',`
gen_require(`$0'_depend) gen_require(`
type tape_device_t;
class blk_file r_file_perms;
')
dev_list_all_dev_nodes($1) dev_list_all_dev_nodes($1)
allow $1 tape_device_t:blk_file r_file_perms; allow $1 tape_device_t:blk_file r_file_perms;
') ')
define(`storage_read_tape_device_depend',`
type tape_device_t;
class blk_file r_file_perms;
')
######################################## ########################################
## <interface name="storage_write_tape_device"> ## <interface name="storage_write_tape_device">
## <description> ## <description>
@ -507,18 +464,15 @@ define(`storage_read_tape_device_depend',`
## </interface> ## </interface>
# #
define(`storage_write_tape_device',` define(`storage_write_tape_device',`
gen_require(`$0'_depend) gen_require(`
type tape_device_t;
class blk_file { getattr write ioctl };
')
dev_list_all_dev_nodes($1) dev_list_all_dev_nodes($1)
allow $1 tape_device_t:blk_file { getattr write ioctl }; allow $1 tape_device_t:blk_file { getattr write ioctl };
') ')
define(`storage_write_tape_device_depend',`
type tape_device_t;
class blk_file { getattr write ioctl };
')
######################################## ########################################
## <interface name="storage_getattr_tape_device"> ## <interface name="storage_getattr_tape_device">
## <description> ## <description>
@ -531,18 +485,15 @@ define(`storage_write_tape_device_depend',`
## </interface> ## </interface>
# #
define(`storage_getattr_tape_device',` define(`storage_getattr_tape_device',`
gen_require(`$0'_depend) gen_require(`
type tape_device_t;
class blk_file getattr;
')
dev_list_all_dev_nodes($1) dev_list_all_dev_nodes($1)
allow $1 tape_device_t:blk_file getattr; allow $1 tape_device_t:blk_file getattr;
') ')
define(`storage_getattr_tape_device_depend',`
type tape_device_t;
class blk_file getattr;
')
######################################## ########################################
## <interface name="storage_setattr_tape_device"> ## <interface name="storage_setattr_tape_device">
## <description> ## <description>
@ -555,15 +506,13 @@ define(`storage_getattr_tape_device_depend',`
## </interface> ## </interface>
# #
define(`storage_setattr_tape_device',` define(`storage_setattr_tape_device',`
gen_require(`$0'_depend) gen_require(`
type tape_device_t;
class blk_file setattr;
')
dev_list_all_dev_nodes($1) dev_list_all_dev_nodes($1)
allow $1 tape_device_t:blk_file setattr; allow $1 tape_device_t:blk_file setattr;
') ')
define(`storage_setattr_tape_device_depend',`
type tape_device_t;
class blk_file setattr;
')
## </module> ## </module>

18
refpolicy/policy/modules/services/remotelogin.te
View File

@ -81,6 +81,16 @@ auth_manage_pam_console_data(remote_login_t)
miscfiles_read_localization(remote_login_t) miscfiles_read_localization(remote_login_t)
tunable_policy(`use_nfs_home_dirs',`
fs_read_nfs_files(remote_login_t)
fs_read_nfs_symlinks(remote_login_t)
')
tunable_policy(`use_samba_home_dirs',`
fs_read_cifs_files(remote_login_t)
fs_read_cifs_symlinks(remote_login_t)
')
ifdef(`TODO',` ifdef(`TODO',`
allow remote_login_t unpriv_userdomain:fd use; allow remote_login_t unpriv_userdomain:fd use;
can_ypbind(remote_login_t) can_ypbind(remote_login_t)
@ -116,14 +126,6 @@ dontaudit remote_login_t sysfs_t:dir search;
allow remote_login_t autofs_t:dir r_dir_perms; allow remote_login_t autofs_t:dir r_dir_perms;
allow remote_login_t mnt_t:dir r_dir_perms; allow remote_login_t mnt_t:dir r_dir_perms;
tunable_policy(`use_nfs_home_dirs',`
r_dir_file(remote_login_t, nfs_t)
')
tunable_policy(`use_samba_home_dirs',`
r_dir_file(remote_login_t, cifs_t)
')
# FIXME: what is this for? # FIXME: what is this for?
ifdef(`xdm.te', ` ifdef(`xdm.te', `
allow xdm_t remote_login_t:process signull; allow xdm_t remote_login_t:process signull;

9
refpolicy/policy/modules/system/authlogin.te
View File

@ -138,9 +138,10 @@ allow pam_console_t pam_var_console_t:lnk_file r_file_perms;
kernel_read_kernel_sysctl(pam_console_t) kernel_read_kernel_sysctl(pam_console_t)
kernel_read_system_state(pam_console_t) kernel_read_system_state(pam_console_t)
dev_read_sysfs(pam_console_t)
kernel_use_fd(pam_console_t) kernel_use_fd(pam_console_t)
dev_read_sysfs(pam_console_t)
# Allow to set attributes on /dev entries # Allow to set attributes on /dev entries
storage_getattr_fixed_disk(pam_console_t) storage_getattr_fixed_disk(pam_console_t)
storage_setattr_fixed_disk(pam_console_t) storage_setattr_fixed_disk(pam_console_t)
@ -151,15 +152,15 @@ term_use_console(pam_console_t)
term_getattr_unallocated_ttys(pam_console_t) term_getattr_unallocated_ttys(pam_console_t)
term_setattr_unallocated_ttys(pam_console_t) term_setattr_unallocated_ttys(pam_console_t)
init_use_fd(pam_console_t)
init_use_script_pty(pam_console_t)
domain_use_wide_inherit_fd(pam_console_t) domain_use_wide_inherit_fd(pam_console_t)
files_read_generic_etc_files(pam_console_t) files_read_generic_etc_files(pam_console_t)
files_search_pids(pam_console_t) files_search_pids(pam_console_t)
files_list_mnt(pam_console_t) files_list_mnt(pam_console_t)
init_use_fd(pam_console_t)
init_use_script_pty(pam_console_t)
libs_use_ld_so(pam_console_t) libs_use_ld_so(pam_console_t)
libs_use_shared_libs(pam_console_t) libs_use_shared_libs(pam_console_t)

6
refpolicy/policy/modules/system/clock.te
View File

@ -30,8 +30,8 @@ dontaudit hwclock_t self:capability sys_tty_config;
allow hwclock_t adjtime_t:file { setattr ioctl read getattr lock write append }; allow hwclock_t adjtime_t:file { setattr ioctl read getattr lock write append };
kernel_read_kernel_sysctl(hwclock_t) kernel_read_kernel_sysctl(hwclock_t)
dev_read_sysfs(hwclock_t)
dev_read_sysfs(hwclock_t)
dev_rw_realtime_clock(hwclock_t) dev_rw_realtime_clock(hwclock_t)
fs_getattr_xattr_fs(hwclock_t) fs_getattr_xattr_fs(hwclock_t)
@ -41,11 +41,11 @@ term_use_unallocated_tty(hwclock_t)
term_use_all_user_ttys(hwclock_t) term_use_all_user_ttys(hwclock_t)
term_use_all_user_ptys(hwclock_t) term_use_all_user_ptys(hwclock_t)
domain_use_wide_inherit_fd(hwclock_t)
init_use_fd(hwclock_t) init_use_fd(hwclock_t)
init_use_script_pty(hwclock_t) init_use_script_pty(hwclock_t)
domain_use_wide_inherit_fd(hwclock_t)
files_read_generic_etc_files_directory(hwclock_t) files_read_generic_etc_files_directory(hwclock_t)
# for when /usr is not mounted: # for when /usr is not mounted:
files_dontaudit_search_isid_type_dir(hwclock_t) files_dontaudit_search_isid_type_dir(hwclock_t)

3
refpolicy/policy/modules/system/hostname.te
View File

@ -26,9 +26,10 @@ dontaudit hostname_t self:capability sys_tty_config;
sysnet_read_config(hostname_t) sysnet_read_config(hostname_t)
kernel_read_kernel_sysctl(hostname_t) kernel_read_kernel_sysctl(hostname_t)
dev_read_sysfs(hostname_t)
kernel_dontaudit_use_fd(hostname_t) kernel_dontaudit_use_fd(hostname_t)
dev_read_sysfs(hostname_t)
fs_getattr_xattr_fs(hostname_t) fs_getattr_xattr_fs(hostname_t)
term_dontaudit_use_console(hostname_t) term_dontaudit_use_console(hostname_t)

6
refpolicy/policy/modules/system/hotplug.te
View File

@ -45,9 +45,7 @@ files_create_pid(hotplug_t,hotplug_var_run_t)
kernel_read_system_state(hotplug_t) kernel_read_system_state(hotplug_t)
kernel_read_kernel_sysctl(hotplug_t) kernel_read_kernel_sysctl(hotplug_t)
dev_read_sysfs(hotplug_t)
kernel_read_net_sysctl(hotplug_t) kernel_read_net_sysctl(hotplug_t)
dev_read_usbfs(hotplug_t)
bootloader_read_kernel_modules(hotplug_t) bootloader_read_kernel_modules(hotplug_t)
@ -58,7 +56,9 @@ corenet_raw_sendrecv_all_nodes(hotplug_t)
corenet_tcp_sendrecv_all_ports(hotplug_t) corenet_tcp_sendrecv_all_ports(hotplug_t)
corenet_tcp_bind_all_nodes(hotplug_t) corenet_tcp_bind_all_nodes(hotplug_t)
# for SSP dev_read_sysfs(hotplug_t)
dev_read_usbfs(hotplug_t)
# for SSP:
dev_read_urand(hotplug_t) dev_read_urand(hotplug_t)
fs_getattr_all_fs(hotplug_t) fs_getattr_all_fs(hotplug_t)

6
refpolicy/policy/modules/system/init.te
View File

@ -88,11 +88,13 @@ allow init_t initrc_var_run_t:file { rw_file_perms setattr };
# Run init scripts. # Run init scripts.
domain_auto_trans(init_t,initrc_exec_t,initrc_t) domain_auto_trans(init_t,initrc_exec_t,initrc_t)
selinux_set_boolean(init_t)
kernel_read_system_state(init_t) kernel_read_system_state(init_t)
dev_read_sysfs(init_t)
kernel_share_state(init_t) kernel_share_state(init_t)
dev_read_sysfs(init_t)
selinux_set_boolean(init_t)
term_use_all_terms(init_t) term_use_all_terms(init_t)
corecmd_chroot_exec_chroot(init_t) corecmd_chroot_exec_chroot(init_t)

3
refpolicy/policy/modules/system/iptables.te
View File

@ -39,11 +39,12 @@ allow iptables_t self:rawip_socket create_socket_perms;
kernel_read_system_state(iptables_t) kernel_read_system_state(iptables_t)
kernel_read_network_state(iptables_t) kernel_read_network_state(iptables_t)
dev_read_sysfs(iptables_t)
kernel_read_kernel_sysctl(iptables_t) kernel_read_kernel_sysctl(iptables_t)
kernel_read_modprobe_sysctl(iptables_t) kernel_read_modprobe_sysctl(iptables_t)
kernel_use_fd(iptables_t) kernel_use_fd(iptables_t)
dev_read_sysfs(iptables_t)
fs_getattr_xattr_fs(iptables_t) fs_getattr_xattr_fs(iptables_t)
term_dontaudit_use_console(iptables_t) term_dontaudit_use_console(iptables_t)

1
refpolicy/policy/modules/system/libraries.te
View File

@ -74,7 +74,6 @@ logging_send_syslog_msg(ldconfig_t)
userdom_use_all_user_fd(ldconfig_t) userdom_use_all_user_fd(ldconfig_t)
ifdef(`TODO',` ifdef(`TODO',`
allow ldconfig_t tmp_t:dir search; allow ldconfig_t tmp_t:dir search;

43
refpolicy/policy/modules/system/locallogin.te
View File

@ -7,11 +7,11 @@ policy_module(locallogin,1.0)
# #
type local_login_t; #, nscd_client_domain; type local_login_t; #, nscd_client_domain;
auth_login_entry_type(local_login_t)
domain_type(local_login_t)
domain_obj_id_change_exempt(local_login_t) domain_obj_id_change_exempt(local_login_t)
domain_subj_id_change_exempt(local_login_t) domain_subj_id_change_exempt(local_login_t)
domain_role_change_exempt(local_login_t) domain_role_change_exempt(local_login_t)
auth_login_entry_type(local_login_t)
domain_type(local_login_t)
domain_wide_inherit_fd(local_login_t) domain_wide_inherit_fd(local_login_t)
role system_r types local_login_t; role system_r types local_login_t;
@ -53,6 +53,10 @@ files_create_tmp_files(local_login_t, local_login_tmp_t, { file dir })
kernel_read_system_state(local_login_t) kernel_read_system_state(local_login_t)
kernel_read_kernel_sysctl(local_login_t) kernel_read_kernel_sysctl(local_login_t)
# for SSP/ProPolice
dev_read_urand(local_login_t)
selinux_get_fs_mount(local_login_t) selinux_get_fs_mount(local_login_t)
selinux_validate_context(local_login_t) selinux_validate_context(local_login_t)
selinux_compute_access_vector(local_login_t) selinux_compute_access_vector(local_login_t)
@ -60,8 +64,8 @@ selinux_compute_create_context(local_login_t)
selinux_compute_relabel_context(local_login_t) selinux_compute_relabel_context(local_login_t)
selinux_compute_user_contexts(local_login_t) selinux_compute_user_contexts(local_login_t)
# for SSP/ProPolice storage_dontaudit_getattr_fixed_disk(local_login_t)
dev_read_urand(local_login_t) storage_dontaudit_setattr_fixed_disk(local_login_t)
term_use_all_user_ttys(local_login_t) term_use_all_user_ttys(local_login_t)
term_use_unallocated_tty(local_login_t) term_use_unallocated_tty(local_login_t)
@ -106,6 +110,16 @@ userdom_use_unpriv_users_fd(local_login_t)
# Search for mail spool file. # Search for mail spool file.
mta_getattr_spool(local_login_t) mta_getattr_spool(local_login_t)
tunable_policy(`use_nfs_home_dirs',`
fs_read_nfs_files(local_login_t)
fs_read_nfs_symlinks(local_login_t)
')
tunable_policy(`use_samba_home_dirs',`
fs_read_cifs_files(local_login_t)
fs_read_cifs_symlinks(local_login_t)
')
# Red Hat systems seem to have a stray # Red Hat systems seem to have a stray
# fd open from the initrd # fd open from the initrd
optional_policy(`distro_redhat',` optional_policy(`distro_redhat',`
@ -152,15 +166,16 @@ ifdef(`crack.te', `
allow local_login_t crack_db_t:file r_file_perms; allow local_login_t crack_db_t:file r_file_perms;
') ')
allow local_login_t mouse_device_t:chr_file { getattr setattr };
ifdef(`targeted_policy',` ifdef(`targeted_policy',`
unconfined_domain(local_login_t) unconfined_domain(local_login_t)
domain_auto_trans(local_login_t, shell_exec_t, unconfined_t) domain_auto_trans(local_login_t, shell_exec_t, unconfined_t)
') ')
allow local_login_t mouse_device_t:chr_file { getattr setattr };
allow local_login_t sound_device_t:chr_file { getattr setattr };
allow local_login_t power_device_t:chr_file { getattr setattr };
# Do not audit denied attempts to access devices. # Do not audit denied attempts to access devices.
dontaudit local_login_t fixed_disk_device_t:blk_file { getattr setattr };
dontaudit local_login_t removable_device_t:blk_file { getattr setattr }; dontaudit local_login_t removable_device_t:blk_file { getattr setattr };
dontaudit local_login_t device_t:{ chr_file blk_file lnk_file } { getattr setattr }; dontaudit local_login_t device_t:{ chr_file blk_file lnk_file } { getattr setattr };
dontaudit local_login_t misc_device_t:{ chr_file blk_file } { getattr setattr }; dontaudit local_login_t misc_device_t:{ chr_file blk_file } { getattr setattr };
@ -177,20 +192,6 @@ optional_policy(`gpm.te',`
allow local_login_t gpmctl_t:sock_file { getattr setattr }; allow local_login_t gpmctl_t:sock_file { getattr setattr };
') ')
# Allow setting of attributes on sound devices.
allow local_login_t sound_device_t:chr_file { getattr setattr };
# Allow setting of attributes on power management devices.
allow local_login_t power_device_t:chr_file { getattr setattr };
tunable_policy(`use_nfs_home_dirs',`
r_dir_file(local_login_t, nfs_t)
')
tunable_policy(`use_samba_home_dirs',`
r_dir_file(local_login_t, cifs_t)
')
') dnl endif TODO ') dnl endif TODO
################################# #################################

3
refpolicy/policy/modules/system/logging.te
View File

@ -59,6 +59,7 @@ allow auditd_t auditd_var_run_t:file create_file_perms;
files_create_pid(auditd_t,auditd_var_run_t) files_create_pid(auditd_t,auditd_var_run_t)
kernel_read_kernel_sysctl(auditd_t) kernel_read_kernel_sysctl(auditd_t)
dev_read_sysfs(auditd_t) dev_read_sysfs(auditd_t)
fs_getattr_all_fs(auditd_t) fs_getattr_all_fs(auditd_t)
@ -186,10 +187,10 @@ allow syslogd_t devlog_t:unix_dgram_socket name_bind;
allow syslogd_t syslogd_var_run_t:file create_file_perms; allow syslogd_t syslogd_var_run_t:file create_file_perms;
files_create_pid(syslogd_t,syslogd_var_run_t) files_create_pid(syslogd_t,syslogd_var_run_t)
dev_read_sysfs(syslogd_t)
kernel_read_kernel_sysctl(syslogd_t) kernel_read_kernel_sysctl(syslogd_t)
dev_create_dev_node(syslogd_t,devlog_t,sock_file) dev_create_dev_node(syslogd_t,devlog_t,sock_file)
dev_read_sysfs(syslogd_t)
term_dontaudit_use_console(syslogd_t) term_dontaudit_use_console(syslogd_t)
# Allow syslog to a terminal # Allow syslog to a terminal

18
refpolicy/policy/modules/system/lvm.te
View File

@ -69,20 +69,18 @@ type_transition lvm_t lvm_etc_t:file lvm_metadata_t;
files_create_etc_config(lvm_t,lvm_metadata_t,file) files_create_etc_config(lvm_t,lvm_metadata_t,file)
kernel_read_system_state(lvm_t) kernel_read_system_state(lvm_t)
kernel_read_kernel_sysctl(lvm_t)
# Read system variables in /proc/sys
kernel_read_kernel_sysctl(lvm_t)
# it has no reason to need this
kernel_dontaudit_getattr_core(lvm_t)
selinux_get_fs_mount(lvm_t) selinux_get_fs_mount(lvm_t)
selinux_validate_context(lvm_t) selinux_validate_context(lvm_t)
selinux_compute_access_vector(lvm_t) selinux_compute_access_vector(lvm_t)
selinux_compute_create_context(lvm_t) selinux_compute_create_context(lvm_t)
selinux_compute_relabel_context(lvm_t) selinux_compute_relabel_context(lvm_t)
selinux_compute_user_contexts(lvm_t) selinux_compute_user_contexts(lvm_t)
kernel_read_kernel_sysctl(lvm_t)
dev_read_sysfs(lvm_t)
# Read /sys/block. Device mapper metadata is kept there.
dev_read_sysfs(sysfs_t)
# Read system variables in /proc/sys
kernel_read_kernel_sysctl(lvm_t)
# it has no reason to need this
kernel_dontaudit_getattr_core(lvm_t)
dev_create_generic_chr_file(lvm_t) dev_create_generic_chr_file(lvm_t)
dev_read_rand(lvm_t) dev_read_rand(lvm_t)
@ -91,7 +89,9 @@ dev_rw_lvm_control(lvm_t)
dev_manage_generic_symlinks(lvm_t) dev_manage_generic_symlinks(lvm_t)
dev_relabel_dev_dirs(lvm_t) dev_relabel_dev_dirs(lvm_t)
dev_manage_generic_blk_file(lvm_t) dev_manage_generic_blk_file(lvm_t)
dev_read_sysfs(lvm_t)
# Read /sys/block. Device mapper metadata is kept there.
dev_read_sysfs(sysfs_t)
# LVM (vgscan) scans for devices by stating every file in /dev and applying a regex... # LVM (vgscan) scans for devices by stating every file in /dev and applying a regex...
dev_dontaudit_getattr_all_chr_files(lvm_t) dev_dontaudit_getattr_all_chr_files(lvm_t)
dev_dontaudit_getattr_all_blk_files(lvm_t) dev_dontaudit_getattr_all_blk_files(lvm_t)

6
refpolicy/policy/modules/system/modutils.te
View File

@ -131,13 +131,13 @@ bootloader_create_private_module_dir_entry(depmod_t,modules_dep_t)
kernel_read_system_state(depmod_t) kernel_read_system_state(depmod_t)
bootloader_read_kernel_symbol_table(depmod_t)
bootloader_read_kernel_modules(depmod_t)
fs_getattr_xattr_fs(depmod_t) fs_getattr_xattr_fs(depmod_t)
term_use_console(depmod_t) term_use_console(depmod_t)
bootloader_read_kernel_symbol_table(depmod_t)
bootloader_read_kernel_modules(depmod_t)
init_use_fd(depmod_t) init_use_fd(depmod_t)
init_use_script_fd(depmod_t) init_use_script_fd(depmod_t)
init_use_script_pty(depmod_t) init_use_script_pty(depmod_t)

31
refpolicy/policy/modules/system/selinuxutil.te
View File

@ -149,12 +149,12 @@ allow load_policy_t selinux_config_t:dir r_dir_perms;
allow load_policy_t selinux_config_t:file r_file_perms; allow load_policy_t selinux_config_t:file r_file_perms;
allow load_policy_t selinux_config_t:lnk_file r_file_perms; allow load_policy_t selinux_config_t:lnk_file r_file_perms;
fs_getattr_xattr_fs(load_policy_t)
selinux_get_fs_mount(load_policy_t) selinux_get_fs_mount(load_policy_t)
selinux_load_policy(load_policy_t) selinux_load_policy(load_policy_t)
selinux_set_boolean(load_policy_t) selinux_set_boolean(load_policy_t)
fs_getattr_xattr_fs(load_policy_t)
term_use_console(load_policy_t) term_use_console(load_policy_t)
term_list_ptys(load_policy_t) term_list_ptys(load_policy_t)
@ -196,6 +196,11 @@ allow newrole_t { selinux_config_t default_context_t }:lnk_file r_file_perms;
kernel_read_system_state(newrole_t) kernel_read_system_state(newrole_t)
kernel_read_kernel_sysctl(newrole_t) kernel_read_kernel_sysctl(newrole_t)
dev_read_urand(newrole_t)
fs_getattr_xattr_fs(newrole_t)
selinux_get_fs_mount(newrole_t) selinux_get_fs_mount(newrole_t)
selinux_validate_context(newrole_t) selinux_validate_context(newrole_t)
selinux_compute_access_vector(newrole_t) selinux_compute_access_vector(newrole_t)
@ -203,10 +208,6 @@ selinux_compute_create_context(newrole_t)
selinux_compute_relabel_context(newrole_t) selinux_compute_relabel_context(newrole_t)
selinux_compute_user_contexts(newrole_t) selinux_compute_user_contexts(newrole_t)
dev_read_urand(newrole_t)
fs_getattr_xattr_fs(newrole_t)
term_use_all_user_ttys(newrole_t) term_use_all_user_ttys(newrole_t)
term_use_all_user_ptys(newrole_t) term_use_all_user_ptys(newrole_t)
@ -280,6 +281,9 @@ allow restorecon_t { policy_src_t policy_config_t file_context_t selinux_config_
kernel_use_fd(restorecon_t) kernel_use_fd(restorecon_t)
kernel_read_system_state(restorecon_t) kernel_read_system_state(restorecon_t)
fs_getattr_xattr_fs(restorecon_t)
selinux_get_fs_mount(restorecon_t) selinux_get_fs_mount(restorecon_t)
selinux_validate_context(restorecon_t) selinux_validate_context(restorecon_t)
selinux_compute_access_vector(restorecon_t) selinux_compute_access_vector(restorecon_t)
@ -287,8 +291,6 @@ selinux_compute_create_context(restorecon_t)
selinux_compute_relabel_context(restorecon_t) selinux_compute_relabel_context(restorecon_t)
selinux_compute_user_contexts(restorecon_t) selinux_compute_user_contexts(restorecon_t)
fs_getattr_xattr_fs(restorecon_t)
term_use_unallocated_tty(restorecon_t) term_use_unallocated_tty(restorecon_t)
init_use_fd(restorecon_t) init_use_fd(restorecon_t)
@ -320,10 +322,10 @@ files_list_all_dirs(restorecon_t)
auth_relabelto_shadow(restorecon_t) auth_relabelto_shadow(restorecon_t)
ifdef(`distro_redhat', ` ifdef(`distro_redhat', `
fs_use_tmpfs_character_devices(restorecon_t) fs_use_tmpfs_character_devices(restorecon_t)
fs_use_tmpfs_block_devices(restorecon_t) fs_use_tmpfs_block_devices(restorecon_t)
fs_relabel_tmpfs_block_devices(restorecon_t) fs_relabel_tmpfs_block_devices(restorecon_t)
fs_relabel_tmpfs_character_devices(restorecon_t) fs_relabel_tmpfs_character_devices(restorecon_t)
') ')
ifdef(`TODO',` ifdef(`TODO',`
@ -414,6 +416,9 @@ allow setfiles_t { policy_src_t policy_config_t file_context_t selinux_config_t
allow setfiles_t { policy_src_t policy_config_t file_context_t selinux_config_t default_context_t }:lnk_file r_file_perms; allow setfiles_t { policy_src_t policy_config_t file_context_t selinux_config_t default_context_t }:lnk_file r_file_perms;
kernel_read_system_state(setfiles_t) kernel_read_system_state(setfiles_t)
fs_getattr_xattr_fs(setfiles_t)
selinux_get_fs_mount(setfiles_t) selinux_get_fs_mount(setfiles_t)
selinux_validate_context(setfiles_t) selinux_validate_context(setfiles_t)
selinux_compute_access_vector(setfiles_t) selinux_compute_access_vector(setfiles_t)
@ -421,8 +426,6 @@ selinux_compute_create_context(setfiles_t)
selinux_compute_relabel_context(setfiles_t) selinux_compute_relabel_context(setfiles_t)
selinux_compute_user_contexts(setfiles_t) selinux_compute_user_contexts(setfiles_t)
fs_getattr_xattr_fs(setfiles_t)
term_use_all_user_ttys(setfiles_t) term_use_all_user_ttys(setfiles_t)
term_use_all_user_ptys(setfiles_t) term_use_all_user_ptys(setfiles_t)
term_use_unallocated_tty(setfiles_t) term_use_unallocated_tty(setfiles_t)

4
refpolicy/policy/modules/system/sysnetwork.te
View File

@ -86,7 +86,6 @@ allow ifconfig_t dhcpc_t:process sigchld;
kernel_read_system_state(dhcpc_t) kernel_read_system_state(dhcpc_t)
kernel_read_network_state(dhcpc_t) kernel_read_network_state(dhcpc_t)
kernel_read_kernel_sysctl(dhcpc_t) kernel_read_kernel_sysctl(dhcpc_t)
dev_read_sysfs(dhcpc_t)
kernel_use_fd(dhcpc_t) kernel_use_fd(dhcpc_t)
corenet_tcp_sendrecv_all_if(dhcpc_t) corenet_tcp_sendrecv_all_if(dhcpc_t)
@ -101,7 +100,8 @@ corenet_tcp_bind_all_nodes(dhcpc_t)
corenet_udp_bind_all_nodes(dhcpc_t) corenet_udp_bind_all_nodes(dhcpc_t)
corenet_udp_bind_dhcpc_port(dhcpc_t) corenet_udp_bind_dhcpc_port(dhcpc_t)
# for SSP dev_read_sysfs(dhcpc_t)
# for SSP:
dev_read_urand(dhcpc_t) dev_read_urand(dhcpc_t)
fs_getattr_all_fs(dhcpc_t) fs_getattr_all_fs(dhcpc_t)

9
refpolicy/policy/modules/system/udev.te
View File

@ -70,7 +70,12 @@ kernel_read_device_sysctl(udev_t)
kernel_read_hotplug_sysctl(udev_t) kernel_read_hotplug_sysctl(udev_t)
kernel_read_modprobe_sysctl(udev_t) kernel_read_modprobe_sysctl(udev_t)
kernel_read_kernel_sysctl(udev_t) kernel_read_kernel_sysctl(udev_t)
dev_read_sysfs(udev_t) dev_read_sysfs(udev_t)
dev_manage_dev_nodes(udev_t)
fs_getattr_all_fs(udev_t)
selinux_get_fs_mount(udev_t) selinux_get_fs_mount(udev_t)
selinux_validate_context(udev_t) selinux_validate_context(udev_t)
selinux_compute_access_vector(udev_t) selinux_compute_access_vector(udev_t)
@ -78,10 +83,6 @@ selinux_compute_create_context(udev_t)
selinux_compute_relabel_context(udev_t) selinux_compute_relabel_context(udev_t)
selinux_compute_user_contexts(udev_t) selinux_compute_user_contexts(udev_t)
dev_manage_dev_nodes(udev_t)
fs_getattr_all_fs(udev_t)
corecmd_exec_bin(udev_t) corecmd_exec_bin(udev_t)
corecmd_exec_sbin(udev_t) corecmd_exec_sbin(udev_t)
corecmd_exec_shell(udev_t) corecmd_exec_shell(udev_t)