From 0bca409d74efaadc12e37850dffe93bca8e3135c Mon Sep 17 00:00:00 2001
From: Matthew Ife
Date: Wed, 28 Oct 2009 17:00:03 +0000
Subject: [PATCH 01/35] RESET tgtd daemon.
This one makes an effort to check for syntax and that it actually compiles.
Signed-off-by: Matthew Ife
Signed-off-by: Chris PeBenito
---
policy/modules/services/tgtd.fc | 3 ++
policy/modules/services/tgtd.if | 11 ++++++
policy/modules/services/tgtd.te | 70 +++++++++++++++++++++++++++++++++
3 files changed, 84 insertions(+)
create mode 100644 policy/modules/services/tgtd.fc
create mode 100644 policy/modules/services/tgtd.if
create mode 100644 policy/modules/services/tgtd.te
diff --git a/policy/modules/services/tgtd.fc b/policy/modules/services/tgtd.fc
new file mode 100644
index 00000000..58126893
--- /dev/null
+++ b/policy/modules/services/tgtd.fc
@@ -0,0 +1,3 @@
+/etc/rc\.d/init\.d/tgtd -- gen_context(system_u:object_r:tgtd_initrc_exec_t, s0)
+/usr/sbin/tgtd -- gen_context(system_u:object_r:tgtd_exec_t, s0)
+/var/lib/tgtd(/.*)? gen_context(system_u:object_r:tgtd_var_lib_t, s0)
diff --git a/policy/modules/services/tgtd.if b/policy/modules/services/tgtd.if
new file mode 100644
index 00000000..d4979364
--- /dev/null
+++ b/policy/modules/services/tgtd.if
@@ -0,0 +1,11 @@
+## Linux Target Framework Daemon.
+##
+##
+## Linux target framework (tgt) aims to simplify various
+## SCSI target driver (iSCSI, Fibre Channel, SRP, etc) creation
+## and maintenance. Our key goals are the clean integration into
+## the scsi-mid layer and implementing a great portion of tgt
+## in user space.
+##
+##
+
diff --git a/policy/modules/services/tgtd.te b/policy/modules/services/tgtd.te
new file mode 100644
index 00000000..ca91b845
--- /dev/null
+++ b/policy/modules/services/tgtd.te
@@ -0,0 +1,70 @@
+policy_module(tgtd, 1.0.0)
+
+########################################
+#
+# TGTD personal declarations.
+#
+
+type tgtd_t;
+type tgtd_exec_t;
+init_daemon_domain(tgtd_t, tgtd_exec_t)
+
+type tgtd_initrc_exec_t;
+init_script_file(tgtd_initrc_exec_t)
+
+type tgtd_tmp_t;
+files_tmp_file(tgtd_tmp_t)
+
+type tgtd_tmpfs_t;
+files_tmpfs_file(tgtd_tmpfs_t)
+
+type tgtd_var_lib_t;
+files_type(tgtd_var_lib_t)
+
+########################################
+#
+# TGTD personal policy.
+#
+
+allow tgtd_t self:capability sys_resource;
+allow tgtd_t self:process { setrlimit signal };
+allow tgtd_t self:fifo_file rw_fifo_file_perms;
+allow tgtd_t self:netlink_route_socket { create_socket_perms nlmsg_read };
+allow tgtd_t self:shm create_shm_perms;
+allow tgtd_t self:sem create_sem_perms;
+allow tgtd_t self:tcp_socket { create_socket_perms accept listen };
+allow tgtd_t self:udp_socket create_socket_perms;
+allow tgtd_t self:unix_dgram_socket create_socket_perms;
+
+manage_sock_files_pattern(tgtd_t, tgtd_tmp_t, tgtd_tmp_t)
+files_tmp_filetrans(tgtd_t, tgtd_tmp_t, { sock_file })
+
+manage_files_pattern(tgtd_t, tgtd_tmpfs_t, tgtd_tmpfs_t)
+fs_tmpfs_filetrans(tgtd_t, tgtd_tmpfs_t, file)
+
+manage_dirs_pattern(tgtd_t, tgtd_var_lib_t, tgtd_var_lib_t)
+manage_files_pattern(tgtd_t, tgtd_var_lib_t, tgtd_var_lib_t)
+files_var_lib_filetrans(tgtd_t, tgtd_var_lib_t, { dir file })
+
+corenet_all_recvfrom_netlabel(tgtd_t)
+corenet_all_recvfrom_unlabeled(tgtd_t)
+
+corenet_sendrecv_iscsi_server_packets(tgtd_t)
+
+corenet_tcp_bind_generic_node(tgtd_t)
+corenet_tcp_bind_iscsi_port(tgtd_t)
+
+corenet_tcp_sendrecv_generic_if(tgtd_t)
+corenet_tcp_sendrecv_generic_node(tgtd_t)
+
+corenet_tcp_sendrecv_iscsi_port(tgtd_t)
+
+files_read_etc_files(tgtd_t)
+
+kernel_read_fs_sysctls(tgtd_t)
+
+logging_send_syslog_msg(tgtd_t)
+
+miscfiles_read_localization(tgtd_t)
+
+storage_getattr_fixed_disk_dev(tgtd_t)
From 222d5b598773461ded17cb46a2c97f288a20b70b Mon Sep 17 00:00:00 2001
From: Chris PeBenito
Date: Tue, 3 Nov 2009 09:25:37 -0500
Subject: [PATCH 02/35] clean up 0bca409 and add changelog entry.
---
Changelog | 1 +
policy/modules/services/tgtd.fc | 6 +++---
policy/modules/services/tgtd.if | 12 ++++++------
policy/modules/services/tgtd.te | 13 +++++--------
4 files changed, 15 insertions(+), 17 deletions(-)
diff --git a/Changelog b/Changelog
index b03fb48d..16311972 100644
--- a/Changelog
+++ b/Changelog
@@ -22,6 +22,7 @@
rtkit (Dan Walsh)
seunshare (Dan Walsh)
shorewall (Dan Walsh)
+ tgtd (Matthew Ife)
tuned (Miroslav Grepl)
xscreensaver (Corentin Labbe)
diff --git a/policy/modules/services/tgtd.fc b/policy/modules/services/tgtd.fc
index 58126893..8294f6fc 100644
--- a/policy/modules/services/tgtd.fc
+++ b/policy/modules/services/tgtd.fc
@@ -1,3 +1,3 @@
-/etc/rc\.d/init\.d/tgtd -- gen_context(system_u:object_r:tgtd_initrc_exec_t, s0)
-/usr/sbin/tgtd -- gen_context(system_u:object_r:tgtd_exec_t, s0)
-/var/lib/tgtd(/.*)? gen_context(system_u:object_r:tgtd_var_lib_t, s0)
+/etc/rc\.d/init\.d/tgtd -- gen_context(system_u:object_r:tgtd_initrc_exec_t,s0)
+/usr/sbin/tgtd -- gen_context(system_u:object_r:tgtd_exec_t,s0)
+/var/lib/tgtd(/.*)? gen_context(system_u:object_r:tgtd_var_lib_t,s0)
diff --git a/policy/modules/services/tgtd.if b/policy/modules/services/tgtd.if
index d4979364..2c0bc5cf 100644
--- a/policy/modules/services/tgtd.if
+++ b/policy/modules/services/tgtd.if
@@ -1,11 +1,11 @@
## Linux Target Framework Daemon.
##
-##
-## Linux target framework (tgt) aims to simplify various
-## SCSI target driver (iSCSI, Fibre Channel, SRP, etc) creation
-## and maintenance. Our key goals are the clean integration into
-## the scsi-mid layer and implementing a great portion of tgt
+##
+## Linux target framework (tgt) aims to simplify various
+## SCSI target driver (iSCSI, Fibre Channel, SRP, etc) creation
+## and maintenance. Our key goals are the clean integration into
+## the scsi-mid layer and implementing a great portion of tgt
## in user space.
-##
+##
##
diff --git a/policy/modules/services/tgtd.te b/policy/modules/services/tgtd.te
index ca91b845..e0e1d4bf 100644
--- a/policy/modules/services/tgtd.te
+++ b/policy/modules/services/tgtd.te
@@ -1,3 +1,4 @@
+
policy_module(tgtd, 1.0.0)
########################################
@@ -32,7 +33,7 @@ allow tgtd_t self:fifo_file rw_fifo_file_perms;
allow tgtd_t self:netlink_route_socket { create_socket_perms nlmsg_read };
allow tgtd_t self:shm create_shm_perms;
allow tgtd_t self:sem create_sem_perms;
-allow tgtd_t self:tcp_socket { create_socket_perms accept listen };
+allow tgtd_t self:tcp_socket create_stream_socket_perms;
allow tgtd_t self:udp_socket create_socket_perms;
allow tgtd_t self:unix_dgram_socket create_socket_perms;
@@ -46,25 +47,21 @@ manage_dirs_pattern(tgtd_t, tgtd_var_lib_t, tgtd_var_lib_t)
manage_files_pattern(tgtd_t, tgtd_var_lib_t, tgtd_var_lib_t)
files_var_lib_filetrans(tgtd_t, tgtd_var_lib_t, { dir file })
+kernel_read_fs_sysctls(tgtd_t)
+
corenet_all_recvfrom_netlabel(tgtd_t)
corenet_all_recvfrom_unlabeled(tgtd_t)
-
corenet_sendrecv_iscsi_server_packets(tgtd_t)
-
corenet_tcp_bind_generic_node(tgtd_t)
corenet_tcp_bind_iscsi_port(tgtd_t)
-
corenet_tcp_sendrecv_generic_if(tgtd_t)
corenet_tcp_sendrecv_generic_node(tgtd_t)
-
corenet_tcp_sendrecv_iscsi_port(tgtd_t)
files_read_etc_files(tgtd_t)
-kernel_read_fs_sysctls(tgtd_t)
+storage_getattr_fixed_disk_dev(tgtd_t)
logging_send_syslog_msg(tgtd_t)
miscfiles_read_localization(tgtd_t)
-
-storage_getattr_fixed_disk_dev(tgtd_t)
From f272825b2dd05343bc5f22a70d8977a01230b64c Mon Sep 17 00:00:00 2001
From: Chris PeBenito
Date: Tue, 3 Nov 2009 09:41:24 -0500
Subject: [PATCH 03/35] one further rearrangement of tgtd.
---
policy/modules/services/tgtd.te | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/policy/modules/services/tgtd.te b/policy/modules/services/tgtd.te
index e0e1d4bf..917dae8b 100644
--- a/policy/modules/services/tgtd.te
+++ b/policy/modules/services/tgtd.te
@@ -51,12 +51,12 @@ kernel_read_fs_sysctls(tgtd_t)
corenet_all_recvfrom_netlabel(tgtd_t)
corenet_all_recvfrom_unlabeled(tgtd_t)
-corenet_sendrecv_iscsi_server_packets(tgtd_t)
-corenet_tcp_bind_generic_node(tgtd_t)
-corenet_tcp_bind_iscsi_port(tgtd_t)
corenet_tcp_sendrecv_generic_if(tgtd_t)
corenet_tcp_sendrecv_generic_node(tgtd_t)
corenet_tcp_sendrecv_iscsi_port(tgtd_t)
+corenet_tcp_bind_generic_node(tgtd_t)
+corenet_tcp_bind_iscsi_port(tgtd_t)
+corenet_sendrecv_iscsi_server_packets(tgtd_t)
files_read_etc_files(tgtd_t)
From e8779130bfe75a810dde9c01e750c817993d4add Mon Sep 17 00:00:00 2001
From: Craig Grube
Date: Mon, 9 Nov 2009 17:54:00 -0500
Subject: [PATCH 04/35] adding puppet configuration management system
Signed-off-by: Craig Grube
Signed-off-by: Chris PeBenito
---
policy/modules/admin/usermanage.te | 8 +
policy/modules/kernel/corenetwork.te.in | 1 +
policy/modules/kernel/files.if | 118 +++++++++++
policy/modules/kernel/files.te | 1 +
policy/modules/services/puppet.fc | 13 ++
policy/modules/services/puppet.if | 32 +++
policy/modules/services/puppet.te | 260 ++++++++++++++++++++++++
policy/modules/system/init.if | 19 ++
policy/modules/system/init.te | 4 +
policy/modules/system/libraries.te | 4 +
10 files changed, 460 insertions(+)
create mode 100644 policy/modules/services/puppet.fc
create mode 100644 policy/modules/services/puppet.if
create mode 100644 policy/modules/services/puppet.te
diff --git a/policy/modules/admin/usermanage.te b/policy/modules/admin/usermanage.te
index 1865872d..d6423c8c 100644
--- a/policy/modules/admin/usermanage.te
+++ b/policy/modules/admin/usermanage.te
@@ -247,6 +247,10 @@ optional_policy(`
rpm_rw_pipes(groupadd_t)
')
+optional_policy(`
+ puppet_rw_tmp(groupadd_t)
+')
+
########################################
#
# Passwd local policy
@@ -524,3 +528,7 @@ optional_policy(`
rpm_use_fds(useradd_t)
rpm_rw_pipes(useradd_t)
')
+
+optional_policy(`
+ puppet_rw_tmp(useradd_t)
+')
diff --git a/policy/modules/kernel/corenetwork.te.in b/policy/modules/kernel/corenetwork.te.in
index c62a95ea..85a5fcfa 100644
--- a/policy/modules/kernel/corenetwork.te.in
+++ b/policy/modules/kernel/corenetwork.te.in
@@ -156,6 +156,7 @@ network_port(prelude, tcp,4690,s0, udp,4690,s0)
network_port(printer, tcp,515,s0)
network_port(ptal, tcp,5703,s0)
network_port(pulseaudio, tcp,4713,s0)
+network_port(puppet, tcp, 8140, s0)
network_port(pxe, udp,4011,s0)
network_port(pyzor, udp,24441,s0)
network_port(radacct, udp,1646,s0, udp,1813,s0)
diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if
index 87442ecf..88813330 100644
--- a/policy/modules/kernel/files.if
+++ b/policy/modules/kernel/files.if
@@ -110,7 +110,11 @@ interface(`files_pid_file',`
##
#
interface(`files_config_file',`
+ gen_require(`
+ attribute configfile;
+ ')
files_type($1)
+ typeattribute $1 configfile;
')
########################################
@@ -997,6 +1001,83 @@ interface(`files_manage_all_files',`
files_manage_kernel_modules($1)
')
+###########################################
+##
+## Manage all configuration files on filesystem
+##
+##
+##
+## The type of domain performing this action
+##
+##
+##
+#
+interface(`files_manage_config_files',`
+ gen_require(`
+ attribute configfile;
+ ')
+
+ manage_files_pattern($1, configfile, configfile)
+')
+
+#############################################
+##
+## Manage all configuration directories on filesystem
+##
+##
+##
+## The type of domain performing this action
+##
+##
+##
+#
+interface(`files_manage_config_dirs',`
+ gen_require(`
+ attribute configfile;
+ ')
+
+ manage_dirs_pattern($1, configfile, configfile)
+')
+
+
+#######################################
+##
+## Relabel configuration files
+##
+##
+##
+## Type of domain performing this action
+##
+##
+##
+#
+interface(`files_relabel_config_files',`
+ gen_require(`
+ attribute configfile;
+ ')
+
+ relabel_files_pattern($1, configfile, configfile)
+')
+
+#########################################
+##
+## Relabel configuration directories
+##
+##
+##
+## Type of domain performing this action
+##
+##
+##
+#
+interface(`files_relabel_config_dirs',`
+ gen_require(`
+ attribute configfile;
+ ')
+
+ relabel_dirs_pattern($1, configfile, configfile)
+')
+
########################################
##
## Search the contents of all directories on
@@ -1993,6 +2074,25 @@ interface(`files_manage_etc_files',`
read_lnk_files_pattern($1, etc_t, etc_t)
')
+##########################################
+##
+## Manage generic directories in /etc
+##
+##
+##
+## Domain allowed access
+##
+##
+##
+#
+interface(`files_manage_etc_dirs',`
+ gen_require(`
+ type etc_t;
+ ')
+
+ manage_dirs_pattern($1, etc_t, etc_t)
+')
+
########################################
##
## Delete system configuration files in /etc.
@@ -4222,6 +4322,24 @@ interface(`files_list_var_lib',`
list_dirs_pattern($1, var_t, var_lib_t)
')
+###########################################
+##
+## Read-write /var/lib directories
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`files_rw_var_lib_dirs',`
+ gen_require(`
+ type var_lib_t;
+ ')
+
+ rw_dirs_pattern($1, var_lib_t, var_lib_t)
+')
+
########################################
##
## Create objects in the /var/lib directory
diff --git a/policy/modules/kernel/files.te b/policy/modules/kernel/files.te
index 3ae897dd..e970d85b 100644
--- a/policy/modules/kernel/files.te
+++ b/policy/modules/kernel/files.te
@@ -11,6 +11,7 @@ attribute files_unconfined_type;
attribute lockfile;
attribute mountpoint;
attribute pidfile;
+attribute configfile;
# For labeling types that are to be polyinstantiated
attribute polydir;
diff --git a/policy/modules/services/puppet.fc b/policy/modules/services/puppet.fc
new file mode 100644
index 00000000..8cc04c31
--- /dev/null
+++ b/policy/modules/services/puppet.fc
@@ -0,0 +1,13 @@
+/etc/puppet(/.*)? gen_context(system_u:object_r:puppet_etc_t, s0)
+
+/etc/rc\.d/init\.d/puppet -- gen_context(system_u:object_r:puppet_initrc_exec_t, s0)
+/etc/rc\.d/init\.d/puppetmaster -- gen_context(system_u:object_r:puppetmasterd_initrc_exec_t, s0)
+
+/usr/sbin/puppetd -- gen_context(system_u:object_r:puppet_exec_t, s0)
+/usr/sbin/puppetmasterd -- gen_context(system_u:object_r:puppetmaster_exec_t, s0)
+
+/var/lib/puppet(/.*)? gen_context(system_u:object_r:puppet_var_lib_t, s0)
+/var/log/puppet(/.*)? gen_context(system_u:object_r:puppet_log_t, s0)
+/var/run/puppet(/.*)? gen_context(system_u:object_r:puppet_var_run_t, s0)
+
+
diff --git a/policy/modules/services/puppet.if b/policy/modules/services/puppet.if
new file mode 100644
index 00000000..ad75def4
--- /dev/null
+++ b/policy/modules/services/puppet.if
@@ -0,0 +1,32 @@
+## Puppet client daemon
+##
+##
+## Puppet is a configuration management system written in Ruby.
+## The client daemon is responsible for periodically requesting the
+## desired system state from the server and ensuring the state of
+## the client system matches.
+##
+##
+
+################################################
+##
+## Read / Write to Puppet temp files. Puppet uses
+## some system binaries (groupadd, etc) that run in
+## a non-puppet domain and redirects output into temp
+## files.
+##
+##
+##
+## Domain allowed access
+##
+##
+##
+#
+interface(`puppet_rw_tmp', `
+ gen_require(`
+ type puppet_tmp_t;
+ ')
+
+ allow $1 puppet_tmp_t:file rw_file_perms;
+ files_search_tmp($1)
+')
diff --git a/policy/modules/services/puppet.te b/policy/modules/services/puppet.te
new file mode 100644
index 00000000..2336da4f
--- /dev/null
+++ b/policy/modules/services/puppet.te
@@ -0,0 +1,260 @@
+
+policy_module(puppet, 0.0.1)
+
+########################################
+#
+# Declarations
+#
+
+##
+##
+## Allow Puppet client to manage all file
+## types.
+##
+##
+gen_tunable(puppet_manage_all_files, false)
+
+
+########################################
+#
+# Puppet personal declarations
+#
+
+type puppet_t;
+type puppet_exec_t;
+init_daemon_domain(puppet_t, puppet_exec_t)
+
+type puppet_initrc_exec_t;
+init_script_file(puppet_initrc_exec_t);
+
+type puppet_log_t;
+logging_log_file(puppet_log_t)
+
+type puppet_var_lib_t;
+files_type(puppet_var_lib_t)
+
+type puppet_var_run_t;
+files_pid_file(puppet_var_run_t)
+
+type puppet_etc_t;
+files_config_file(puppet_etc_t)
+
+type puppet_tmp_t;
+files_tmp_file(puppet_tmp_t)
+
+########################################
+#
+# Pupper master personal declarations
+#
+
+type puppetmaster_t;
+type puppetmaster_exec_t;
+init_daemon_domain(puppetmaster_t, puppetmaster_exec_t)
+
+type puppetmasterd_initrc_exec_t;
+init_script_file(puppetmasterd_initrc_exec_t)
+
+type puppetmaster_tmp_t;
+files_tmp_file(puppetmaster_tmp_t)
+
+########################################
+#
+# Puppet personal policy
+#
+
+allow puppet_t self:capability { fowner fsetid setuid setgid dac_override sys_nice sys_ptrace sys_tty_config };
+allow puppet_t self:fifo_file rw_fifo_file_perms;
+allow puppet_t self:netlink_route_socket create_netlink_socket_perms;
+allow puppet_t self:process { signal signull getsched setsched };
+allow puppet_t self:tcp_socket create_stream_socket_perms;
+allow puppet_t self:udp_socket create_socket_perms;
+
+search_dirs_pattern(puppet_t, puppet_etc_t, puppet_etc_t)
+read_files_pattern(puppet_t, puppet_etc_t, puppet_etc_t)
+
+manage_dirs_pattern(puppet_t ,puppet_var_lib_t, puppet_var_lib_t)
+manage_files_pattern(puppet_t, puppet_var_lib_t, puppet_var_lib_t)
+
+setattr_dirs_pattern(puppet_t, puppet_var_run_t, puppet_var_run_t)
+manage_files_pattern(puppet_t, puppet_var_run_t, puppet_var_run_t)
+files_pid_filetrans(puppet_t, puppet_var_run_t, { file dir })
+
+create_dirs_pattern(puppet_t, var_log_t, puppet_log_t)
+create_files_pattern(puppet_t, puppet_log_t, puppet_log_t)
+append_files_pattern(puppet_t, puppet_log_t, puppet_log_t)
+logging_log_filetrans(puppet_t, puppet_log_t, { file dir })
+
+manage_dirs_pattern(puppet_t, puppet_tmp_t, puppet_tmp_t)
+manage_files_pattern(puppet_t, puppet_tmp_t, puppet_tmp_t)
+files_tmp_filetrans(puppet_t, puppet_tmp_t, { file dir })
+
+corenet_sendrecv_puppet_client_packets(puppet_t)
+corenet_tcp_connect_puppet_port(puppet_t)
+
+corenet_all_recvfrom_netlabel(puppet_t)
+corenet_all_recvfrom_unlabeled(puppet_t)
+
+corenet_tcp_sendrecv_generic_if(puppet_t)
+corenet_tcp_sendrecv_generic_node(puppet_t)
+
+corenet_tcp_bind_generic_node(puppet_t)
+
+corecmd_exec_bin(puppet_t)
+corecmd_exec_shell(puppet_t)
+
+dev_read_rand(puppet_t)
+dev_read_sysfs(puppet_t)
+dev_read_urand(puppet_t)
+
+domain_read_all_domains_state(puppet_t)
+domain_interactive_fd(puppet_t)
+
+files_manage_config_files(puppet_t)
+files_manage_config_dirs(puppet_t)
+files_manage_etc_dirs(puppet_t)
+files_manage_etc_files(puppet_t)
+files_read_usr_symlinks(puppet_t)
+files_relabel_config_dirs(puppet_t)
+files_relabel_config_files(puppet_t)
+files_search_default(puppet_t)
+files_search_var_lib(puppet_t)
+
+init_all_labeled_script_domtrans(puppet_t)
+init_domtrans_script(puppet_t)
+init_read_utmp(puppet_t)
+init_signull_script(puppet_t)
+
+kernel_dontaudit_search_sysctl(puppet_t)
+kernel_dontaudit_search_kernel_sysctl(puppet_t)
+kernel_read_system_state(puppet_t)
+kernel_read_crypto_sysctls(puppet_t)
+
+logging_send_syslog_msg(puppet_t)
+
+miscfiles_read_hwdata(puppet_t)
+miscfiles_read_localization(puppet_t)
+
+selinux_search_fs(puppet_t)
+selinux_set_all_booleans(puppet_t)
+selinux_set_generic_booleans(puppet_t)
+selinux_validate_context(puppet_t)
+
+seutil_domtrans_setfiles(puppet_t)
+seutil_domtrans_semanage(puppet_t)
+
+sysnet_dns_name_resolve(puppet_t)
+sysnet_run_ifconfig(puppet_t, system_r)
+
+term_dontaudit_getattr_unallocated_ttys(puppet_t)
+term_dontaudit_getattr_all_user_ttys(puppet_t)
+
+tunable_policy(`puppet_manage_all_files',`
+ auth_manage_all_files_except_shadow(puppet_t)
+')
+
+optional_policy(`
+ consoletype_domtrans(puppet_t)
+')
+
+optional_policy(`
+ hostname_exec(puppet_t)
+')
+
+optional_policy(`
+ files_rw_var_files(puppet_t)
+ files_var_lib_filetrans(puppet_t, var_lib_t, dir)
+
+ rpm_domtrans(puppet_t)
+ rpm_manage_db(puppet_t)
+ rpm_manage_log(puppet_t)
+')
+
+optional_policy(`
+ unconfined_domain(puppet_t)
+')
+
+optional_policy(`
+ usermanage_domtrans_groupadd(puppet_t)
+ usermanage_domtrans_useradd(puppet_t)
+')
+
+
+########################################
+#
+# Pupper master personal policy
+#
+
+allow puppetmaster_t self:capability { dac_read_search dac_override setuid setgid fowner chown fsetid sys_tty_config };
+allow puppetmaster_t self:fifo_file rw_fifo_file_perms;;
+allow puppetmaster_t self:netlink_route_socket create_netlink_socket_perms;
+allow puppetmaster_t self:process { signal_perms getsched setsched };
+allow puppetmaster_t self:socket create;
+allow puppetmaster_t self:tcp_socket create_stream_socket_perms;
+allow puppetmaster_t self:udp_socket create_socket_perms;
+
+list_dirs_pattern(puppetmaster_t, puppet_etc_t, puppet_etc_t)
+read_files_pattern(puppetmaster_t, puppet_etc_t, puppet_etc_t)
+
+manage_dirs_pattern(puppetmaster_t ,puppet_var_lib_t, puppet_var_lib_t)
+manage_files_pattern(puppetmaster_t, puppet_var_lib_t, puppet_var_lib_t)
+
+setattr_dirs_pattern(puppetmaster_t, puppet_var_run_t, puppet_var_run_t)
+manage_files_pattern(puppetmaster_t, puppet_var_run_t, puppet_var_run_t)
+files_pid_filetrans(puppetmaster_t, puppet_var_run_t, { file dir })
+
+rw_dirs_pattern(puppetmaster_t, puppet_log_t, puppet_log_t)
+setattr_dirs_pattern(puppetmaster_t, puppet_log_t, puppet_log_t)
+setattr_files_pattern(puppetmaster_t, puppet_log_t, puppet_log_t)
+create_files_pattern(puppetmaster_t, puppet_log_t, puppet_log_t)
+append_files_pattern(puppetmaster_t, puppet_log_t, puppet_log_t)
+rw_files_pattern(puppetmaster_t, puppet_log_t, puppet_log_t)
+logging_log_filetrans(puppetmaster_t, puppet_log_t, { file dir })
+
+manage_dirs_pattern(puppetmaster_t, puppetmaster_tmp_t, puppetmaster_tmp_t)
+manage_files_pattern(puppetmaster_t, puppetmaster_tmp_t, puppetmaster_tmp_t)
+files_tmp_filetrans(puppetmaster_t, puppetmaster_tmp_t, { file dir })
+
+corenet_sendrecv_puppet_server_packets(puppetmaster_t)
+corenet_tcp_bind_puppet_port(puppetmaster_t)
+
+corenet_all_recvfrom_netlabel(puppetmaster_t)
+corenet_all_recvfrom_unlabeled(puppetmaster_t)
+
+corenet_tcp_sendrecv_generic_if(puppetmaster_t)
+corenet_tcp_sendrecv_generic_node(puppetmaster_t)
+
+corenet_tcp_bind_generic_node(puppetmaster_t)
+
+corecmd_exec_bin(puppetmaster_t)
+corecmd_exec_shell(puppetmaster_t)
+
+files_read_etc_files(puppetmaster_t)
+files_search_var_lib(puppetmaster_t)
+
+dev_read_rand(puppetmaster_t)
+dev_read_urand(puppetmaster_t)
+
+domain_read_all_domains_state(puppetmaster_t)
+
+kernel_dontaudit_search_kernel_sysctl(puppetmaster_t)
+kernel_read_system_state(puppetmaster_t)
+kernel_read_crypto_sysctls(puppetmaster_t)
+
+logging_send_syslog_msg(puppetmaster_t)
+
+miscfiles_read_localization(puppetmaster_t)
+
+sysnet_dns_name_resolve(puppetmaster_t)
+sysnet_run_ifconfig(puppetmaster_t, system_r)
+
+optional_policy(`
+ hostname_exec(puppetmaster_t)
+')
+
+optional_policy(`
+ files_read_usr_symlinks(puppetmaster_t)
+
+ rpm_exec(puppetmaster_t)
+ rpm_read_db(puppetmaster_t)
+')
+
diff --git a/policy/modules/system/init.if b/policy/modules/system/init.if
index 7637333d..a5a3adbd 100644
--- a/policy/modules/system/init.if
+++ b/policy/modules/system/init.if
@@ -720,6 +720,25 @@ interface(`init_labeled_script_domtrans',`
files_search_etc($1)
')
+#########################################
+##
+## Transition to the init script domain
+## for all labeled init script types
+##
+##
+##
+## Domain allowed access
+##
+##
+#########################################
+interface(`init_all_labeled_script_domtrans',`
+ gen_require(`
+ attribute init_script_file_type;
+ ')
+
+ init_labeled_script_domtrans($1, init_script_file_type)
+')
+
########################################
##
## Start and stop daemon programs directly.
diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index efe52772..1ff05965 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -687,6 +687,10 @@ optional_policy(`
postfix_list_spool(initrc_t)
')
+optional_policy(`
+ puppet_rw_tmp(initrc_t)
+')
+
optional_policy(`
quota_manage_flags(initrc_t)
')
diff --git a/policy/modules/system/libraries.te b/policy/modules/system/libraries.te
index 0c4f4ba6..8005fb67 100644
--- a/policy/modules/system/libraries.te
+++ b/policy/modules/system/libraries.te
@@ -123,3 +123,7 @@ optional_policy(`
# blow up.
rpm_manage_script_tmp_files(ldconfig_t)
')
+
+optional_policy(`
+ puppet_rw_tmp(ldconfig_t)
+')
From e6d8fd1e508a1980dccfbff87d25be1e2f62ed9b Mon Sep 17 00:00:00 2001
From: Chris PeBenito
Date: Wed, 11 Nov 2009 11:28:50 -0500
Subject: [PATCH 05/35] additional cleanup for e877913.
---
Changelog | 1 +
policy/modules/admin/usermanage.te | 12 +-
policy/modules/kernel/files.if | 191 ++++++++++++++---------------
policy/modules/services/puppet.fc | 18 ++-
policy/modules/services/puppet.if | 33 +++--
policy/modules/services/puppet.te | 140 +++++++++------------
policy/modules/system/init.if | 2 +-
policy/modules/system/libraries.te | 8 +-
8 files changed, 188 insertions(+), 217 deletions(-)
diff --git a/Changelog b/Changelog
index 16311972..886e462c 100644
--- a/Changelog
+++ b/Changelog
@@ -19,6 +19,7 @@
kdump (Dan Walsh)
modemmanager(Dan Walsh)
nslcd (Dan Walsh)
+ puppet (Craig Grube)
rtkit (Dan Walsh)
seunshare (Dan Walsh)
shorewall (Dan Walsh)
diff --git a/policy/modules/admin/usermanage.te b/policy/modules/admin/usermanage.te
index d6423c8c..3a1e04f4 100644
--- a/policy/modules/admin/usermanage.te
+++ b/policy/modules/admin/usermanage.te
@@ -243,12 +243,12 @@ optional_policy(`
')
optional_policy(`
- rpm_use_fds(groupadd_t)
- rpm_rw_pipes(groupadd_t)
+ puppet_rw_tmp(groupadd_t)
')
optional_policy(`
- puppet_rw_tmp(groupadd_t)
+ rpm_use_fds(groupadd_t)
+ rpm_rw_pipes(groupadd_t)
')
########################################
@@ -525,10 +525,10 @@ optional_policy(`
')
optional_policy(`
- rpm_use_fds(useradd_t)
- rpm_rw_pipes(useradd_t)
+ puppet_rw_tmp(useradd_t)
')
optional_policy(`
- puppet_rw_tmp(useradd_t)
+ rpm_use_fds(useradd_t)
+ rpm_rw_pipes(useradd_t)
')
diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if
index 88813330..57f66ded 100644
--- a/policy/modules/kernel/files.if
+++ b/policy/modules/kernel/files.if
@@ -1001,83 +1001,6 @@ interface(`files_manage_all_files',`
files_manage_kernel_modules($1)
')
-###########################################
-##
-## Manage all configuration files on filesystem
-##
-##
-##
-## The type of domain performing this action
-##
-##
-##
-#
-interface(`files_manage_config_files',`
- gen_require(`
- attribute configfile;
- ')
-
- manage_files_pattern($1, configfile, configfile)
-')
-
-#############################################
-##
-## Manage all configuration directories on filesystem
-##
-##
-##
-## The type of domain performing this action
-##
-##
-##
-#
-interface(`files_manage_config_dirs',`
- gen_require(`
- attribute configfile;
- ')
-
- manage_dirs_pattern($1, configfile, configfile)
-')
-
-
-#######################################
-##
-## Relabel configuration files
-##
-##
-##
-## Type of domain performing this action
-##
-##
-##
-#
-interface(`files_relabel_config_files',`
- gen_require(`
- attribute configfile;
- ')
-
- relabel_files_pattern($1, configfile, configfile)
-')
-
-#########################################
-##
-## Relabel configuration directories
-##
-##
-##
-## Type of domain performing this action
-##
-##
-##
-#
-interface(`files_relabel_config_dirs',`
- gen_require(`
- attribute configfile;
- ')
-
- relabel_dirs_pattern($1, configfile, configfile)
-')
-
########################################
##
## Search the contents of all directories on
@@ -1231,6 +1154,82 @@ interface(`files_unmount_all_file_type_fs',`
allow $1 file_type:filesystem unmount;
')
+#############################################
+##
+## Manage all configuration directories on filesystem
+##
+##
+##
+## The type of domain performing this action
+##
+##
+##
+#
+interface(`files_manage_config_dirs',`
+ gen_require(`
+ attribute configfile;
+ ')
+
+ manage_dirs_pattern($1, configfile, configfile)
+')
+
+#########################################
+##
+## Relabel configuration directories
+##
+##
+##
+## Type of domain performing this action
+##
+##
+##
+#
+interface(`files_relabel_config_dirs',`
+ gen_require(`
+ attribute configfile;
+ ')
+
+ relabel_dirs_pattern($1, configfile, configfile)
+')
+
+###########################################
+##
+## Manage all configuration files on filesystem
+##
+##
+##
+## The type of domain performing this action
+##
+##
+##
+#
+interface(`files_manage_config_files',`
+ gen_require(`
+ attribute configfile;
+ ')
+
+ manage_files_pattern($1, configfile, configfile)
+')
+
+#######################################
+##
+## Relabel configuration files
+##
+##
+##
+## Type of domain performing this action
+##
+##
+##
+#
+interface(`files_relabel_config_files',`
+ gen_require(`
+ attribute configfile;
+ ')
+
+ relabel_files_pattern($1, configfile, configfile)
+')
+
########################################
##
## Mount a filesystem on all mount points.
@@ -1994,6 +1993,25 @@ interface(`files_rw_etc_dirs',`
allow $1 etc_t:dir rw_dir_perms;
')
+##########################################
+##
+## Manage generic directories in /etc
+##
+##
+##
+## Domain allowed access
+##
+##
+##
+#
+interface(`files_manage_etc_dirs',`
+ gen_require(`
+ type etc_t;
+ ')
+
+ manage_dirs_pattern($1, etc_t, etc_t)
+')
+
########################################
##
## Read generic files in /etc.
@@ -2074,25 +2092,6 @@ interface(`files_manage_etc_files',`
read_lnk_files_pattern($1, etc_t, etc_t)
')
-##########################################
-##
-## Manage generic directories in /etc
-##
-##
-##
-## Domain allowed access
-##
-##
-##
-#
-interface(`files_manage_etc_dirs',`
- gen_require(`
- type etc_t;
- ')
-
- manage_dirs_pattern($1, etc_t, etc_t)
-')
-
########################################
##
## Delete system configuration files in /etc.
diff --git a/policy/modules/services/puppet.fc b/policy/modules/services/puppet.fc
index 8cc04c31..2f1e5299 100644
--- a/policy/modules/services/puppet.fc
+++ b/policy/modules/services/puppet.fc
@@ -1,13 +1,11 @@
-/etc/puppet(/.*)? gen_context(system_u:object_r:puppet_etc_t, s0)
+/etc/puppet(/.*)? gen_context(system_u:object_r:puppet_etc_t,s0)
-/etc/rc\.d/init\.d/puppet -- gen_context(system_u:object_r:puppet_initrc_exec_t, s0)
-/etc/rc\.d/init\.d/puppetmaster -- gen_context(system_u:object_r:puppetmasterd_initrc_exec_t, s0)
-
-/usr/sbin/puppetd -- gen_context(system_u:object_r:puppet_exec_t, s0)
-/usr/sbin/puppetmasterd -- gen_context(system_u:object_r:puppetmaster_exec_t, s0)
-
-/var/lib/puppet(/.*)? gen_context(system_u:object_r:puppet_var_lib_t, s0)
-/var/log/puppet(/.*)? gen_context(system_u:object_r:puppet_log_t, s0)
-/var/run/puppet(/.*)? gen_context(system_u:object_r:puppet_var_run_t, s0)
+/etc/rc\.d/init\.d/puppet -- gen_context(system_u:object_r:puppet_initrc_exec_t,s0)
+/etc/rc\.d/init\.d/puppetmaster -- gen_context(system_u:object_r:puppetmaster_initrc_exec_t,s0)
+/usr/sbin/puppetd -- gen_context(system_u:object_r:puppet_exec_t,s0)
+/usr/sbin/puppetmasterd -- gen_context(system_u:object_r:puppetmaster_exec_t,s0)
+/var/lib/puppet(/.*)? gen_context(system_u:object_r:puppet_var_lib_t,s0)
+/var/log/puppet(/.*)? gen_context(system_u:object_r:puppet_log_t,s0)
+/var/run/puppet(/.*)? gen_context(system_u:object_r:puppet_var_run_t,s0)
diff --git a/policy/modules/services/puppet.if b/policy/modules/services/puppet.if
index ad75def4..34946a2c 100644
--- a/policy/modules/services/puppet.if
+++ b/policy/modules/services/puppet.if
@@ -1,27 +1,26 @@
## Puppet client daemon
##
-##
+##
## Puppet is a configuration management system written in Ruby.
-## The client daemon is responsible for periodically requesting the
-## desired system state from the server and ensuring the state of
-## the client system matches.
-##
-##
-
+## The client daemon is responsible for periodically requesting the
+## desired system state from the server and ensuring the state of
+## the client system matches.
+##
+##
+
################################################
##
-## Read / Write to Puppet temp files. Puppet uses
-## some system binaries (groupadd, etc) that run in
-## a non-puppet domain and redirects output into temp
-## files.
+## Read / Write to Puppet temp files. Puppet uses
+## some system binaries (groupadd, etc) that run in
+## a non-puppet domain and redirects output into temp
+## files.
##
##
-##
-## Domain allowed access
-##
-##
-##
-#
+##
+## Domain allowed access
+##
+##
+#
interface(`puppet_rw_tmp', `
gen_require(`
type puppet_tmp_t;
diff --git a/policy/modules/services/puppet.te b/policy/modules/services/puppet.te
index 2336da4f..3cb17418 100644
--- a/policy/modules/services/puppet.te
+++ b/policy/modules/services/puppet.te
@@ -1,5 +1,5 @@
-policy_module(puppet, 0.0.1)
+policy_module(puppet, 1.0.0)
########################################
#
@@ -14,45 +14,34 @@ policy_module(puppet, 0.0.1)
##
gen_tunable(puppet_manage_all_files, false)
-
-########################################
-#
-# Puppet personal declarations
-#
-
type puppet_t;
type puppet_exec_t;
init_daemon_domain(puppet_t, puppet_exec_t)
+type puppet_etc_t;
+files_config_file(puppet_etc_t)
+
type puppet_initrc_exec_t;
-init_script_file(puppet_initrc_exec_t);
+init_script_file(puppet_initrc_exec_t)
type puppet_log_t;
logging_log_file(puppet_log_t)
+type puppet_tmp_t;
+files_tmp_file(puppet_tmp_t)
+
type puppet_var_lib_t;
files_type(puppet_var_lib_t)
type puppet_var_run_t;
files_pid_file(puppet_var_run_t)
-type puppet_etc_t;
-files_config_file(puppet_etc_t)
-
-type puppet_tmp_t;
-files_tmp_file(puppet_tmp_t)
-
-########################################
-#
-# Pupper master personal declarations
-#
-
type puppetmaster_t;
type puppetmaster_exec_t;
init_daemon_domain(puppetmaster_t, puppetmaster_exec_t)
-type puppetmasterd_initrc_exec_t;
-init_script_file(puppetmasterd_initrc_exec_t)
+type puppetmaster_initrc_exec_t;
+init_script_file(puppetmaster_initrc_exec_t)
type puppetmaster_tmp_t;
files_tmp_file(puppetmaster_tmp_t)
@@ -63,17 +52,17 @@ files_tmp_file(puppetmaster_tmp_t)
#
allow puppet_t self:capability { fowner fsetid setuid setgid dac_override sys_nice sys_ptrace sys_tty_config };
+allow puppet_t self:process { signal signull getsched setsched };
allow puppet_t self:fifo_file rw_fifo_file_perms;
allow puppet_t self:netlink_route_socket create_netlink_socket_perms;
-allow puppet_t self:process { signal signull getsched setsched };
allow puppet_t self:tcp_socket create_stream_socket_perms;
allow puppet_t self:udp_socket create_socket_perms;
-search_dirs_pattern(puppet_t, puppet_etc_t, puppet_etc_t)
read_files_pattern(puppet_t, puppet_etc_t, puppet_etc_t)
-manage_dirs_pattern(puppet_t ,puppet_var_lib_t, puppet_var_lib_t)
+manage_dirs_pattern(puppet_t, puppet_var_lib_t, puppet_var_lib_t)
manage_files_pattern(puppet_t, puppet_var_lib_t, puppet_var_lib_t)
+files_search_var_lib(puppet_t)
setattr_dirs_pattern(puppet_t, puppet_var_run_t, puppet_var_run_t)
manage_files_pattern(puppet_t, puppet_var_run_t, puppet_var_run_t)
@@ -88,20 +77,22 @@ manage_dirs_pattern(puppet_t, puppet_tmp_t, puppet_tmp_t)
manage_files_pattern(puppet_t, puppet_tmp_t, puppet_tmp_t)
files_tmp_filetrans(puppet_t, puppet_tmp_t, { file dir })
-corenet_sendrecv_puppet_client_packets(puppet_t)
-corenet_tcp_connect_puppet_port(puppet_t)
-
-corenet_all_recvfrom_netlabel(puppet_t)
-corenet_all_recvfrom_unlabeled(puppet_t)
-
-corenet_tcp_sendrecv_generic_if(puppet_t)
-corenet_tcp_sendrecv_generic_node(puppet_t)
-
-corenet_tcp_bind_generic_node(puppet_t)
+kernel_dontaudit_search_sysctl(puppet_t)
+kernel_dontaudit_search_kernel_sysctl(puppet_t)
+kernel_read_system_state(puppet_t)
+kernel_read_crypto_sysctls(puppet_t)
corecmd_exec_bin(puppet_t)
corecmd_exec_shell(puppet_t)
+corenet_all_recvfrom_netlabel(puppet_t)
+corenet_all_recvfrom_unlabeled(puppet_t)
+corenet_tcp_sendrecv_generic_if(puppet_t)
+corenet_tcp_sendrecv_generic_node(puppet_t)
+corenet_tcp_bind_generic_node(puppet_t)
+corenet_tcp_connect_puppet_port(puppet_t)
+corenet_sendrecv_puppet_client_packets(puppet_t)
+
dev_read_rand(puppet_t)
dev_read_sysfs(puppet_t)
dev_read_urand(puppet_t)
@@ -116,38 +107,31 @@ files_manage_etc_files(puppet_t)
files_read_usr_symlinks(puppet_t)
files_relabel_config_dirs(puppet_t)
files_relabel_config_files(puppet_t)
-files_search_default(puppet_t)
-files_search_var_lib(puppet_t)
-
-init_all_labeled_script_domtrans(puppet_t)
-init_domtrans_script(puppet_t)
-init_read_utmp(puppet_t)
-init_signull_script(puppet_t)
-
-kernel_dontaudit_search_sysctl(puppet_t)
-kernel_dontaudit_search_kernel_sysctl(puppet_t)
-kernel_read_system_state(puppet_t)
-kernel_read_crypto_sysctls(puppet_t)
-
-logging_send_syslog_msg(puppet_t)
-
-miscfiles_read_hwdata(puppet_t)
-miscfiles_read_localization(puppet_t)
selinux_search_fs(puppet_t)
selinux_set_all_booleans(puppet_t)
selinux_set_generic_booleans(puppet_t)
selinux_validate_context(puppet_t)
+term_dontaudit_getattr_unallocated_ttys(puppet_t)
+term_dontaudit_getattr_all_user_ttys(puppet_t)
+
+init_all_labeled_script_domtrans(puppet_t)
+init_domtrans_script(puppet_t)
+init_read_utmp(puppet_t)
+init_signull_script(puppet_t)
+
+logging_send_syslog_msg(puppet_t)
+
+miscfiles_read_hwdata(puppet_t)
+miscfiles_read_localization(puppet_t)
+
seutil_domtrans_setfiles(puppet_t)
seutil_domtrans_semanage(puppet_t)
sysnet_dns_name_resolve(puppet_t)
sysnet_run_ifconfig(puppet_t, system_r)
-term_dontaudit_getattr_unallocated_ttys(puppet_t)
-term_dontaudit_getattr_all_user_ttys(puppet_t)
-
tunable_policy(`puppet_manage_all_files',`
auth_manage_all_files_except_shadow(puppet_t)
')
@@ -162,7 +146,6 @@ optional_policy(`
optional_policy(`
files_rw_var_files(puppet_t)
- files_var_lib_filetrans(puppet_t, var_lib_t, dir)
rpm_domtrans(puppet_t)
rpm_manage_db(puppet_t)
@@ -178,16 +161,15 @@ optional_policy(`
usermanage_domtrans_useradd(puppet_t)
')
-
########################################
#
# Pupper master personal policy
#
allow puppetmaster_t self:capability { dac_read_search dac_override setuid setgid fowner chown fsetid sys_tty_config };
-allow puppetmaster_t self:fifo_file rw_fifo_file_perms;;
-allow puppetmaster_t self:netlink_route_socket create_netlink_socket_perms;
allow puppetmaster_t self:process { signal_perms getsched setsched };
+allow puppetmaster_t self:fifo_file rw_fifo_file_perms;
+allow puppetmaster_t self:netlink_route_socket create_netlink_socket_perms;
allow puppetmaster_t self:socket create;
allow puppetmaster_t self:tcp_socket create_stream_socket_perms;
allow puppetmaster_t self:udp_socket create_socket_perms;
@@ -195,50 +177,43 @@ allow puppetmaster_t self:udp_socket create_socket_perms;
list_dirs_pattern(puppetmaster_t, puppet_etc_t, puppet_etc_t)
read_files_pattern(puppetmaster_t, puppet_etc_t, puppet_etc_t)
-manage_dirs_pattern(puppetmaster_t ,puppet_var_lib_t, puppet_var_lib_t)
+allow puppetmaster_t puppet_log_t:dir { rw_dir_perms setattr };
+allow puppetmaster_t puppet_log_t:file { rw_file_perms create setattr };
+logging_log_filetrans(puppetmaster_t, puppet_log_t, { file dir })
+
+manage_dirs_pattern(puppetmaster_t, puppet_var_lib_t, puppet_var_lib_t)
manage_files_pattern(puppetmaster_t, puppet_var_lib_t, puppet_var_lib_t)
setattr_dirs_pattern(puppetmaster_t, puppet_var_run_t, puppet_var_run_t)
manage_files_pattern(puppetmaster_t, puppet_var_run_t, puppet_var_run_t)
files_pid_filetrans(puppetmaster_t, puppet_var_run_t, { file dir })
-rw_dirs_pattern(puppetmaster_t, puppet_log_t, puppet_log_t)
-setattr_dirs_pattern(puppetmaster_t, puppet_log_t, puppet_log_t)
-setattr_files_pattern(puppetmaster_t, puppet_log_t, puppet_log_t)
-create_files_pattern(puppetmaster_t, puppet_log_t, puppet_log_t)
-append_files_pattern(puppetmaster_t, puppet_log_t, puppet_log_t)
-rw_files_pattern(puppetmaster_t, puppet_log_t, puppet_log_t)
-logging_log_filetrans(puppetmaster_t, puppet_log_t, { file dir })
-
manage_dirs_pattern(puppetmaster_t, puppetmaster_tmp_t, puppetmaster_tmp_t)
manage_files_pattern(puppetmaster_t, puppetmaster_tmp_t, puppetmaster_tmp_t)
files_tmp_filetrans(puppetmaster_t, puppetmaster_tmp_t, { file dir })
-corenet_sendrecv_puppet_server_packets(puppetmaster_t)
-corenet_tcp_bind_puppet_port(puppetmaster_t)
-
-corenet_all_recvfrom_netlabel(puppetmaster_t)
-corenet_all_recvfrom_unlabeled(puppetmaster_t)
-
-corenet_tcp_sendrecv_generic_if(puppetmaster_t)
-corenet_tcp_sendrecv_generic_node(puppetmaster_t)
-
-corenet_tcp_bind_generic_node(puppetmaster_t)
+kernel_dontaudit_search_kernel_sysctl(puppetmaster_t)
+kernel_read_system_state(puppetmaster_t)
+kernel_read_crypto_sysctls(puppetmaster_t)
corecmd_exec_bin(puppetmaster_t)
corecmd_exec_shell(puppetmaster_t)
-files_read_etc_files(puppetmaster_t)
-files_search_var_lib(puppetmaster_t)
+corenet_all_recvfrom_netlabel(puppetmaster_t)
+corenet_all_recvfrom_unlabeled(puppetmaster_t)
+corenet_tcp_sendrecv_generic_if(puppetmaster_t)
+corenet_tcp_sendrecv_generic_node(puppetmaster_t)
+corenet_tcp_bind_generic_node(puppetmaster_t)
+corenet_tcp_bind_puppet_port(puppetmaster_t)
+corenet_sendrecv_puppet_server_packets(puppetmaster_t)
dev_read_rand(puppetmaster_t)
dev_read_urand(puppetmaster_t)
domain_read_all_domains_state(puppetmaster_t)
-kernel_dontaudit_search_kernel_sysctl(puppetmaster_t)
-kernel_read_system_state(puppetmaster_t)
-kernel_read_crypto_sysctls(puppetmaster_t)
+files_read_etc_files(puppetmaster_t)
+files_search_var_lib(puppetmaster_t)
logging_send_syslog_msg(puppetmaster_t)
@@ -257,4 +232,3 @@ optional_policy(`
rpm_exec(puppetmaster_t)
rpm_read_db(puppetmaster_t)
')
-
diff --git a/policy/modules/system/init.if b/policy/modules/system/init.if
index a5a3adbd..f073b540 100644
--- a/policy/modules/system/init.if
+++ b/policy/modules/system/init.if
@@ -730,7 +730,7 @@ interface(`init_labeled_script_domtrans',`
## Domain allowed access
##
##
-#########################################
+#
interface(`init_all_labeled_script_domtrans',`
gen_require(`
attribute init_script_file_type;
diff --git a/policy/modules/system/libraries.te b/policy/modules/system/libraries.te
index 8005fb67..39f5a992 100644
--- a/policy/modules/system/libraries.te
+++ b/policy/modules/system/libraries.te
@@ -117,13 +117,13 @@ optional_policy(`
apt_use_ptys(ldconfig_t)
')
+optional_policy(`
+ puppet_rw_tmp(ldconfig_t)
+')
+
optional_policy(`
# When you install a kernel the postinstall builds a initrd image in tmp
# and executes ldconfig on it. If you dont allow this kernel installs
# blow up.
rpm_manage_script_tmp_files(ldconfig_t)
')
-
-optional_policy(`
- puppet_rw_tmp(ldconfig_t)
-')
From ed3a1f559a7b22e4d88af4cadfd635b8e3c93a69 Mon Sep 17 00:00:00 2001
From: Chris PeBenito
Date: Tue, 17 Nov 2009 10:05:56 -0500
Subject: [PATCH 06/35] bump module versions for release.
---
policy/modules/admin/certwatch.te | 2 +-
policy/modules/admin/kismet.te | 2 +-
policy/modules/admin/mrtg.te | 2 +-
policy/modules/admin/portage.te | 2 +-
policy/modules/admin/prelink.te | 2 +-
policy/modules/admin/readahead.te | 2 +-
policy/modules/admin/usermanage.te | 2 +-
policy/modules/admin/vpn.te | 2 +-
policy/modules/apps/awstats.te | 2 +-
policy/modules/apps/cdrecord.te | 2 +-
policy/modules/apps/cpufreqselector.te | 2 +-
policy/modules/apps/gpg.te | 2 +-
policy/modules/apps/java.te | 2 +-
policy/modules/apps/pulseaudio.te | 2 +-
policy/modules/apps/qemu.te | 2 +-
policy/modules/apps/screen.te | 2 +-
policy/modules/apps/vmware.te | 2 +-
policy/modules/apps/webalizer.te | 2 +-
policy/modules/apps/wireshark.te | 2 +-
policy/modules/kernel/corenetwork.te.in | 2 +-
policy/modules/kernel/devices.te | 2 +-
policy/modules/kernel/mcs.te | 2 +-
policy/modules/services/cron.te | 2 +-
policy/modules/services/dbus.te | 2 +-
policy/modules/services/nscd.te | 2 +-
policy/modules/services/openvpn.te | 2 +-
policy/modules/services/policykit.te | 2 +-
policy/modules/services/virt.te | 2 +-
policy/modules/services/xserver.te | 2 +-
policy/modules/system/iptables.te | 2 +-
policy/modules/system/libraries.te | 2 +-
policy/modules/system/logging.te | 2 +-
policy/modules/system/unconfined.te | 2 +-
policy/modules/system/userdomain.te | 2 +-
34 files changed, 34 insertions(+), 34 deletions(-)
diff --git a/policy/modules/admin/certwatch.te b/policy/modules/admin/certwatch.te
index 60df2cd8..9a5d7e99 100644
--- a/policy/modules/admin/certwatch.te
+++ b/policy/modules/admin/certwatch.te
@@ -1,5 +1,5 @@
-policy_module(certwatch, 1.4.1)
+policy_module(certwatch, 1.5.0)
########################################
#
diff --git a/policy/modules/admin/kismet.te b/policy/modules/admin/kismet.te
index 49ed789e..d39aaada 100644
--- a/policy/modules/admin/kismet.te
+++ b/policy/modules/admin/kismet.te
@@ -1,5 +1,5 @@
-policy_module(kismet, 1.3.1)
+policy_module(kismet, 1.4.0)
########################################
#
diff --git a/policy/modules/admin/mrtg.te b/policy/modules/admin/mrtg.te
index fa7a62a1..2d3cd3a3 100644
--- a/policy/modules/admin/mrtg.te
+++ b/policy/modules/admin/mrtg.te
@@ -1,5 +1,5 @@
-policy_module(mrtg, 1.7.1)
+policy_module(mrtg, 1.8.0)
########################################
#
diff --git a/policy/modules/admin/portage.te b/policy/modules/admin/portage.te
index c3154d12..6af6e8ae 100644
--- a/policy/modules/admin/portage.te
+++ b/policy/modules/admin/portage.te
@@ -1,5 +1,5 @@
-policy_module(portage, 1.8.1)
+policy_module(portage, 1.9.0)
########################################
#
diff --git a/policy/modules/admin/prelink.te b/policy/modules/admin/prelink.te
index 91889d5f..15621d8f 100644
--- a/policy/modules/admin/prelink.te
+++ b/policy/modules/admin/prelink.te
@@ -1,5 +1,5 @@
-policy_module(prelink, 1.7.1)
+policy_module(prelink, 1.8.0)
########################################
#
diff --git a/policy/modules/admin/readahead.te b/policy/modules/admin/readahead.te
index 43398ed0..be338088 100644
--- a/policy/modules/admin/readahead.te
+++ b/policy/modules/admin/readahead.te
@@ -1,5 +1,5 @@
-policy_module(readahead, 1.9.1)
+policy_module(readahead, 1.10.0)
########################################
#
diff --git a/policy/modules/admin/usermanage.te b/policy/modules/admin/usermanage.te
index 3a1e04f4..e07b0094 100644
--- a/policy/modules/admin/usermanage.te
+++ b/policy/modules/admin/usermanage.te
@@ -1,5 +1,5 @@
-policy_module(usermanage, 1.13.1)
+policy_module(usermanage, 1.14.0)
########################################
#
diff --git a/policy/modules/admin/vpn.te b/policy/modules/admin/vpn.te
index 08d917d9..bdd2b1b4 100644
--- a/policy/modules/admin/vpn.te
+++ b/policy/modules/admin/vpn.te
@@ -1,5 +1,5 @@
-policy_module(vpn, 1.11.1)
+policy_module(vpn, 1.12.0)
########################################
#
diff --git a/policy/modules/apps/awstats.te b/policy/modules/apps/awstats.te
index 7a98be84..6dd7816d 100644
--- a/policy/modules/apps/awstats.te
+++ b/policy/modules/apps/awstats.te
@@ -1,5 +1,5 @@
-policy_module(awstats, 1.1.1)
+policy_module(awstats, 1.2.0)
########################################
#
diff --git a/policy/modules/apps/cdrecord.te b/policy/modules/apps/cdrecord.te
index 57ad303e..f09ab37f 100644
--- a/policy/modules/apps/cdrecord.te
+++ b/policy/modules/apps/cdrecord.te
@@ -1,5 +1,5 @@
-policy_module(cdrecord, 2.1.1)
+policy_module(cdrecord, 2.2.0)
########################################
#
diff --git a/policy/modules/apps/cpufreqselector.te b/policy/modules/apps/cpufreqselector.te
index 2bd85728..6e404431 100644
--- a/policy/modules/apps/cpufreqselector.te
+++ b/policy/modules/apps/cpufreqselector.te
@@ -1,5 +1,5 @@
-policy_module(cpufreqselector, 1.0.1)
+policy_module(cpufreqselector, 1.1.0)
########################################
#
diff --git a/policy/modules/apps/gpg.te b/policy/modules/apps/gpg.te
index 9d162a8e..5e664500 100644
--- a/policy/modules/apps/gpg.te
+++ b/policy/modules/apps/gpg.te
@@ -1,5 +1,5 @@
-policy_module(gpg, 2.1.1)
+policy_module(gpg, 2.2.0)
########################################
#
diff --git a/policy/modules/apps/java.te b/policy/modules/apps/java.te
index 47ea7633..8285ec95 100644
--- a/policy/modules/apps/java.te
+++ b/policy/modules/apps/java.te
@@ -1,5 +1,5 @@
-policy_module(java, 2.1.1)
+policy_module(java, 2.2.0)
########################################
#
diff --git a/policy/modules/apps/pulseaudio.te b/policy/modules/apps/pulseaudio.te
index a29cbc70..bb5bbc82 100644
--- a/policy/modules/apps/pulseaudio.te
+++ b/policy/modules/apps/pulseaudio.te
@@ -1,5 +1,5 @@
-policy_module(pulseaudio, 1.0.1)
+policy_module(pulseaudio, 1.1.0)
########################################
#
diff --git a/policy/modules/apps/qemu.te b/policy/modules/apps/qemu.te
index 84d4e08d..1a8edea6 100644
--- a/policy/modules/apps/qemu.te
+++ b/policy/modules/apps/qemu.te
@@ -1,5 +1,5 @@
-policy_module(qemu, 1.2.1)
+policy_module(qemu, 1.3.0)
########################################
#
diff --git a/policy/modules/apps/screen.te b/policy/modules/apps/screen.te
index a7b7cf20..e5bb2476 100644
--- a/policy/modules/apps/screen.te
+++ b/policy/modules/apps/screen.te
@@ -1,5 +1,5 @@
-policy_module(screen, 2.1.1)
+policy_module(screen, 2.2.0)
########################################
#
diff --git a/policy/modules/apps/vmware.te b/policy/modules/apps/vmware.te
index 6d054878..778fe33d 100644
--- a/policy/modules/apps/vmware.te
+++ b/policy/modules/apps/vmware.te
@@ -1,5 +1,5 @@
-policy_module(vmware, 2.1.1)
+policy_module(vmware, 2.2.0)
########################################
#
diff --git a/policy/modules/apps/webalizer.te b/policy/modules/apps/webalizer.te
index aaf313be..c5710c8e 100644
--- a/policy/modules/apps/webalizer.te
+++ b/policy/modules/apps/webalizer.te
@@ -1,5 +1,5 @@
-policy_module(webalizer, 1.9.1)
+policy_module(webalizer, 1.10.0)
########################################
#
diff --git a/policy/modules/apps/wireshark.te b/policy/modules/apps/wireshark.te
index d8e0c928..66b51e77 100644
--- a/policy/modules/apps/wireshark.te
+++ b/policy/modules/apps/wireshark.te
@@ -1,5 +1,5 @@
-policy_module(wireshark, 2.0.1)
+policy_module(wireshark, 2.1.0)
########################################
#
diff --git a/policy/modules/kernel/corenetwork.te.in b/policy/modules/kernel/corenetwork.te.in
index 85a5fcfa..37a97d7a 100644
--- a/policy/modules/kernel/corenetwork.te.in
+++ b/policy/modules/kernel/corenetwork.te.in
@@ -1,5 +1,5 @@
-policy_module(corenetwork, 1.12.1)
+policy_module(corenetwork, 1.13.0)
########################################
#
diff --git a/policy/modules/kernel/devices.te b/policy/modules/kernel/devices.te
index c37a400b..e87179fc 100644
--- a/policy/modules/kernel/devices.te
+++ b/policy/modules/kernel/devices.te
@@ -1,5 +1,5 @@
-policy_module(devices, 1.8.2)
+policy_module(devices, 1.9.0)
########################################
#
diff --git a/policy/modules/kernel/mcs.te b/policy/modules/kernel/mcs.te
index 79622ec1..1e999d74 100644
--- a/policy/modules/kernel/mcs.te
+++ b/policy/modules/kernel/mcs.te
@@ -1,5 +1,5 @@
-policy_module(mcs, 1.1.1)
+policy_module(mcs, 1.2.0)
########################################
#
diff --git a/policy/modules/services/cron.te b/policy/modules/services/cron.te
index fe7c4496..3a8f03d3 100644
--- a/policy/modules/services/cron.te
+++ b/policy/modules/services/cron.te
@@ -1,5 +1,5 @@
-policy_module(cron, 2.1.2)
+policy_module(cron, 2.2.0)
gen_require(`
class passwd rootok;
diff --git a/policy/modules/services/dbus.te b/policy/modules/services/dbus.te
index aa857cb2..5c3924d5 100644
--- a/policy/modules/services/dbus.te
+++ b/policy/modules/services/dbus.te
@@ -1,5 +1,5 @@
-policy_module(dbus, 1.11.1)
+policy_module(dbus, 1.12.0)
gen_require(`
class dbus all_dbus_perms;
diff --git a/policy/modules/services/nscd.te b/policy/modules/services/nscd.te
index afbd2be2..7c9b57c3 100644
--- a/policy/modules/services/nscd.te
+++ b/policy/modules/services/nscd.te
@@ -1,5 +1,5 @@
-policy_module(nscd, 1.9.2)
+policy_module(nscd, 1.10.0)
gen_require(`
class nscd all_nscd_perms;
diff --git a/policy/modules/services/openvpn.te b/policy/modules/services/openvpn.te
index 4ad43ef4..8d1f370a 100644
--- a/policy/modules/services/openvpn.te
+++ b/policy/modules/services/openvpn.te
@@ -1,5 +1,5 @@
-policy_module(openvpn, 1.8.2)
+policy_module(openvpn, 1.9.0)
########################################
#
diff --git a/policy/modules/services/policykit.te b/policy/modules/services/policykit.te
index 4334f27b..0c4e92c8 100644
--- a/policy/modules/services/policykit.te
+++ b/policy/modules/services/policykit.te
@@ -1,5 +1,5 @@
-policy_module(policykit, 1.0.1)
+policy_module(policykit, 1.1.0)
########################################
#
diff --git a/policy/modules/services/virt.te b/policy/modules/services/virt.te
index 243e25cb..88fb1401 100644
--- a/policy/modules/services/virt.te
+++ b/policy/modules/services/virt.te
@@ -1,5 +1,5 @@
-policy_module(virt, 1.2.1)
+policy_module(virt, 1.3.0)
########################################
#
diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te
index fc421d51..20dcde71 100644
--- a/policy/modules/services/xserver.te
+++ b/policy/modules/services/xserver.te
@@ -1,5 +1,5 @@
-policy_module(xserver, 3.2.3)
+policy_module(xserver, 3.3.0)
gen_require(`
class x_drawable all_x_drawable_perms;
diff --git a/policy/modules/system/iptables.te b/policy/modules/system/iptables.te
index b70500e4..7ad25444 100644
--- a/policy/modules/system/iptables.te
+++ b/policy/modules/system/iptables.te
@@ -1,5 +1,5 @@
-policy_module(iptables, 1.9.1)
+policy_module(iptables, 1.10.0)
########################################
#
diff --git a/policy/modules/system/libraries.te b/policy/modules/system/libraries.te
index 39f5a992..76a1a05c 100644
--- a/policy/modules/system/libraries.te
+++ b/policy/modules/system/libraries.te
@@ -1,5 +1,5 @@
-policy_module(libraries, 2.5.1)
+policy_module(libraries, 2.6.0)
########################################
#
diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
index 3e7ce07f..d2443048 100644
--- a/policy/modules/system/logging.te
+++ b/policy/modules/system/logging.te
@@ -1,5 +1,5 @@
-policy_module(logging, 1.14.1)
+policy_module(logging, 1.15.0)
########################################
#
diff --git a/policy/modules/system/unconfined.te b/policy/modules/system/unconfined.te
index 662e60d2..698ce2e7 100644
--- a/policy/modules/system/unconfined.te
+++ b/policy/modules/system/unconfined.te
@@ -1,5 +1,5 @@
-policy_module(unconfined, 3.0.1)
+policy_module(unconfined, 3.1.0)
########################################
#
diff --git a/policy/modules/system/userdomain.te b/policy/modules/system/userdomain.te
index 6bdd0813..7b7d709d 100644
--- a/policy/modules/system/userdomain.te
+++ b/policy/modules/system/userdomain.te
@@ -1,5 +1,5 @@
-policy_module(userdomain, 4.2.4)
+policy_module(userdomain, 4.3.0)
########################################
#
From a404bc39a79c678e351ce2d66a8cbb5b7e95ac66 Mon Sep 17 00:00:00 2001
From: Chris PeBenito
Date: Tue, 17 Nov 2009 10:17:43 -0500
Subject: [PATCH 07/35] update VERSION and Changelog for release.
---
Changelog | 3 ++-
VERSION | 2 +-
2 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/Changelog b/Changelog
index 886e462c..92c273d6 100644
--- a/Changelog
+++ b/Changelog
@@ -1,6 +1,7 @@
+* Tue Nov 17 2009 Chris PeBenito - 2.20091117
- Add separate x_pointer and x_keyboard classes inheriting from x_device.
From Eamon Walsh.
-- Deprecated the userdom_xwindwos_client_template().
+- Deprecated the userdom_xwindows_client_template().
- Misc Gentoo fixes from Corentin Labbe.
- Debian policykit fixes from Martin Orr.
- Fix unconfined_r use of unconfined_java_t.
diff --git a/VERSION b/VERSION
index 6e273447..72bfd296 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-2.20090730
+2.20091117
From deb527262a52db070b2986119f936c7782d1a2e2 Mon Sep 17 00:00:00 2001
From: Chris PeBenito
Date: Thu, 19 Nov 2009 08:52:06 -0500
Subject: [PATCH 08/35] Add module_request permission, from Dan Walsh.
---
policy/flask/access_vectors | 1 +
1 file changed, 1 insertion(+)
diff --git a/policy/flask/access_vectors b/policy/flask/access_vectors
index 6620e4cc..6760c955 100644
--- a/policy/flask/access_vectors
+++ b/policy/flask/access_vectors
@@ -376,6 +376,7 @@ class system
syslog_read
syslog_mod
syslog_console
+ module_request
}
#
From 53c73dc7852da8a8a46133ef433203adf489839d Mon Sep 17 00:00:00 2001
From: Chris PeBenito
Date: Thu, 19 Nov 2009 09:03:36 -0500
Subject: [PATCH 09/35] Add storage patch, from Dan Walsh.
---
policy/modules/kernel/storage.fc | 1 +
policy/modules/kernel/storage.if | 2 +-
policy/modules/kernel/storage.te | 2 +-
3 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/policy/modules/kernel/storage.fc b/policy/modules/kernel/storage.fc
index 5afa664e..d1719ca1 100644
--- a/policy/modules/kernel/storage.fc
+++ b/policy/modules/kernel/storage.fc
@@ -28,6 +28,7 @@
/dev/megadev.* -c gen_context(system_u:object_r:removable_device_t,s0)
/dev/mmcblk.* -b gen_context(system_u:object_r:removable_device_t,s0)
/dev/mspblk.* -b gen_context(system_u:object_r:removable_device_t,s0)
+/dev/mtd.* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
/dev/nb[^/]+ -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
/dev/optcd -b gen_context(system_u:object_r:removable_device_t,s0)
/dev/p[fg][0-3] -b gen_context(system_u:object_r:removable_device_t,s0)
diff --git a/policy/modules/kernel/storage.if b/policy/modules/kernel/storage.if
index 05d99232..a388e63b 100644
--- a/policy/modules/kernel/storage.if
+++ b/policy/modules/kernel/storage.if
@@ -529,7 +529,7 @@ interface(`storage_dontaudit_read_removable_device',`
')
- dontaudit $1 removable_device_t:blk_file { getattr ioctl read };
+ dontaudit $1 removable_device_t:blk_file read_blk_file_perms;
')
########################################
diff --git a/policy/modules/kernel/storage.te b/policy/modules/kernel/storage.te
index 7a07c605..dab6e3e9 100644
--- a/policy/modules/kernel/storage.te
+++ b/policy/modules/kernel/storage.te
@@ -1,5 +1,5 @@
-policy_module(storage, 1.7.0)
+policy_module(storage, 1.7.1)
########################################
#
From e276b8e5d0e25d32890e5554a82c43a0ff6ecef1 Mon Sep 17 00:00:00 2001
From: Chris PeBenito
Date: Thu, 19 Nov 2009 09:25:38 -0500
Subject: [PATCH 10/35] Add kernel patch from Dan Walsh
---
policy/modules/kernel/kernel.if | 47 ++++++++++++++++++++++++++++++---
policy/modules/kernel/kernel.te | 17 ++++++------
2 files changed, 53 insertions(+), 11 deletions(-)
diff --git a/policy/modules/kernel/kernel.if b/policy/modules/kernel/kernel.if
index d6ec5467..f8fad776 100644
--- a/policy/modules/kernel/kernel.if
+++ b/policy/modules/kernel/kernel.if
@@ -1,5 +1,5 @@
##
-## Policy for kernel threads, proc filesystem,
+## Policy for kernel threads, proc filesystem,
## and unlabeled processes and objects.
##
##
@@ -57,7 +57,7 @@ interface(`kernel_ranged_domtrans_to',`
type kernel_t;
')
- kernel_domtrans_to($1,$2)
+ kernel_domtrans_to($1, $2)
ifdef(`enable_mcs',`
range_transition kernel_t $2:process $3;
@@ -483,13 +483,32 @@ interface(`kernel_clear_ring_buffer',`
allow $1 kernel_t:system syslog_mod;
')
+########################################
+##
+## Allows caller to request the kernel to load a module
+##
+##
+##
+## Domain allowed access.
+##
+##
+##
+#
+interface(`kernel_request_load_module',`
+ gen_require(`
+ type kernel_t;
+ ')
+
+ allow $1 kernel_t:system module_request;
+')
+
########################################
##
## Get information on all System V IPC objects.
##
##
##
-##
+## Domain allowed access.
##
##
#
@@ -939,6 +958,28 @@ interface(`kernel_dontaudit_getattr_core_if',`
dontaudit $1 proc_kcore_t:file getattr;
')
+########################################
+##
+## Allows caller to read the core kernel interface.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`kernel_read_core_if',`
+ gen_require(`
+ type proc_t, proc_kcore_t;
+ attribute can_dump_kernel;
+ ')
+
+ read_files_pattern($1, proc_t, proc_kcore_t)
+ list_dirs_pattern($1, proc_t, proc_t)
+
+ typeattribute $1 can_dump_kernel;
+')
+
########################################
##
## Allow caller to read kernel messages
diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te
index faf39a52..42a4d056 100644
--- a/policy/modules/kernel/kernel.te
+++ b/policy/modules/kernel/kernel.te
@@ -1,5 +1,5 @@
-policy_module(kernel, 1.11.0)
+policy_module(kernel, 1.11.1)
########################################
#
@@ -9,6 +9,7 @@ policy_module(kernel, 1.11.0)
# assertion related attributes
attribute can_load_kernmodule;
attribute can_receive_kernel_messages;
+attribute can_dump_kernel;
neverallow ~{ can_load_kernmodule kern_unconfined } self:capability sys_module;
@@ -37,7 +38,7 @@ ifdef(`enable_mls',`
#
# kernel_t is the domain of kernel threads.
# It is also the target type when checking permissions in the system class.
-#
+#
type kernel_t, can_load_kernmodule;
domain_base_type(kernel_t)
mls_rangetrans_source(kernel_t)
@@ -90,7 +91,7 @@ neverallow ~{ can_receive_kernel_messages kern_unconfined } proc_kmsg_t:file ~ge
# /proc kcore: inaccessible
type proc_kcore_t, proc_type;
-neverallow ~kern_unconfined proc_kcore_t:file ~getattr;
+neverallow ~{ can_dump_kernel kern_unconfined } proc_kcore_t:file ~getattr;
genfscon proc /kcore gen_context(system_u:object_r:proc_kcore_t,mls_systemhigh)
type proc_mdstat_t, proc_type;
@@ -248,7 +249,7 @@ corenet_send_all_packets(kernel_t)
dev_read_sysfs(kernel_t)
dev_search_usbfs(kernel_t)
-# Mount root file system. Used when loading a policy
+# Mount root file system. Used when loading a policy
# from initrd, then mounting the root filesystem
fs_mount_all_fs(kernel_t)
fs_unmount_all_fs(kernel_t)
@@ -275,7 +276,7 @@ mcs_process_set_categories(kernel_t)
mls_process_read_up(kernel_t)
mls_process_write_down(kernel_t)
mls_file_write_all_levels(kernel_t)
-mls_file_read_all_levels(kernel_t)
+mls_file_read_all_levels(kernel_t)
ifdef(`distro_redhat',`
# Bugzilla 222337
@@ -309,7 +310,7 @@ optional_policy(`
allow kernel_t self:tcp_socket create_stream_socket_perms;
allow kernel_t self:udp_socket create_socket_perms;
- # nfs kernel server needs kernel UDP access. It is less risky and painful
+ # nfs kernel server needs kernel UDP access. It is less risky and painful
# to just give it everything.
corenet_udp_sendrecv_generic_if(kernel_t)
corenet_udp_sendrecv_generic_node(kernel_t)
@@ -326,7 +327,7 @@ optional_policy(`
rpc_manage_nfs_ro_content(kernel_t)
rpc_manage_nfs_rw_content(kernel_t)
- rpc_udp_rw_nfs_sockets(kernel_t)
+ rpc_udp_rw_nfs_sockets(kernel_t)
tunable_policy(`nfs_export_all_ro',`
fs_getattr_noxattr_fs(kernel_t)
@@ -355,7 +356,7 @@ optional_policy(`
')
optional_policy(`
- unconfined_domain(kernel_t)
+ unconfined_domain_noaudit(kernel_t)
')
########################################
From b51e8e0b42cd7e546c2f82946a4f3b84f7b2a467 Mon Sep 17 00:00:00 2001
From: Chris PeBenito
Date: Thu, 19 Nov 2009 09:44:19 -0500
Subject: [PATCH 11/35] Add devices patch from Dan Walsh.
---
policy/modules/kernel/devices.fc | 9 +-
policy/modules/kernel/devices.if | 257 ++++++++++++++++++++++++++++++-
policy/modules/kernel/devices.te | 34 +++-
3 files changed, 292 insertions(+), 8 deletions(-)
diff --git a/policy/modules/kernel/devices.fc b/policy/modules/kernel/devices.fc
index 94b4bc4f..a241ea1a 100644
--- a/policy/modules/kernel/devices.fc
+++ b/policy/modules/kernel/devices.fc
@@ -47,8 +47,10 @@
/dev/kmem -c gen_context(system_u:object_r:memory_device_t,mls_systemhigh)
/dev/kmsg -c gen_context(system_u:object_r:kmsg_device_t,mls_systemhigh)
/dev/kqemu -c gen_context(system_u:object_r:qemu_device_t,s0)
+/dev/ksm -c gen_context(system_u:object_r:ksm_device_t,s0)
/dev/kvm -c gen_context(system_u:object_r:kvm_device_t,s0)
/dev/lik.* -c gen_context(system_u:object_r:event_device_t,s0)
+/dev/lirc[0-9]+ -c gen_context(system_u:object_r:lirc_device_t,s0)
/dev/lircm -c gen_context(system_u:object_r:mouse_device_t,s0)
/dev/logibm -c gen_context(system_u:object_r:mouse_device_t,s0)
/dev/lp.* -c gen_context(system_u:object_r:printer_device_t,s0)
@@ -61,10 +63,12 @@
/dev/midi.* -c gen_context(system_u:object_r:sound_device_t,s0)
/dev/mixer.* -c gen_context(system_u:object_r:sound_device_t,s0)
/dev/mmetfgrab -c gen_context(system_u:object_r:scanner_device_t,s0)
+/dev/modem -c gen_context(system_u:object_r:modem_device_t,s0)
/dev/mpu401.* -c gen_context(system_u:object_r:sound_device_t,s0)
/dev/msr.* -c gen_context(system_u:object_r:cpu_device_t,s0)
/dev/network_latency -c gen_context(system_u:object_r:netcontrol_device_t,s0)
/dev/network_throughput -c gen_context(system_u:object_r:netcontrol_device_t,s0)
+/dev/noz.* -c gen_context(system_u:object_r:modem_device_t,s0)
/dev/null -c gen_context(system_u:object_r:null_device_t,s0)
/dev/nvidia.* -c gen_context(system_u:object_r:xserver_misc_device_t,s0)
/dev/nvram -c gen_context(system_u:object_r:nvram_device_t,mls_systemhigh)
@@ -82,6 +86,7 @@
/dev/radio.* -c gen_context(system_u:object_r:v4l_device_t,s0)
/dev/random -c gen_context(system_u:object_r:random_device_t,s0)
/dev/raw1394.* -c gen_context(system_u:object_r:v4l_device_t,s0)
+/dev/rfkill -c gen_context(system_u:object_r:wireless_device_t,s0)
/dev/(misc/)?rtc[0-9]* -c gen_context(system_u:object_r:clock_device_t,s0)
/dev/sequencer -c gen_context(system_u:object_r:sound_device_t,s0)
/dev/sequencer2 -c gen_context(system_u:object_r:sound_device_t,s0)
@@ -101,7 +106,8 @@ ifdef(`distro_suse', `
/dev/usbscanner -c gen_context(system_u:object_r:scanner_device_t,s0)
')
/dev/vbi.* -c gen_context(system_u:object_r:v4l_device_t,s0)
-/dev/vboxadd.* -c gen_context(system_u:object_r:xserver_misc_device_t,s0)
+/dev/vbox.* -c gen_context(system_u:object_r:xserver_misc_device_t,s0)
+/dev/vga_arbiter -c gen_context(system_u:object_r:xserver_misc_device_t,s0)
/dev/vmmon -c gen_context(system_u:object_r:vmware_device_t,s0)
/dev/vmnet.* -c gen_context(system_u:object_r:vmware_device_t,s0)
/dev/video.* -c gen_context(system_u:object_r:v4l_device_t,s0)
@@ -168,6 +174,7 @@ ifdef(`distro_gentoo',`
ifdef(`distro_redhat',`
# originally from named.fc
+/var/named/chroot/dev -d gen_context(system_u:object_r:device_t,s0)
/var/named/chroot/dev/null -c gen_context(system_u:object_r:null_device_t,s0)
/var/named/chroot/dev/random -c gen_context(system_u:object_r:random_device_t,s0)
/var/named/chroot/dev/zero -c gen_context(system_u:object_r:zero_device_t,s0)
diff --git a/policy/modules/kernel/devices.if b/policy/modules/kernel/devices.if
index dec0e028..2b7ad830 100644
--- a/policy/modules/kernel/devices.if
+++ b/policy/modules/kernel/devices.if
@@ -68,8 +68,8 @@ interface(`dev_relabel_all_dev_nodes',`
relabelfrom_lnk_files_pattern($1, device_t, { device_t device_node })
relabelfrom_fifo_files_pattern($1, device_t, device_node)
relabelfrom_sock_files_pattern($1, device_t, device_node)
- relabel_blk_files_pattern($1, device_t,{ device_t device_node })
- relabel_chr_files_pattern($1, device_t,{ device_t device_node })
+ relabel_blk_files_pattern($1, device_t, { device_t device_node })
+ relabel_chr_files_pattern($1, device_t, { device_t device_node })
')
########################################
@@ -1690,6 +1690,78 @@ interface(`dev_read_kmsg',`
read_chr_files_pattern($1, device_t, kmsg_device_t)
')
+########################################
+##
+## Get the attributes of the ksm devices.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`dev_getattr_ksm_dev',`
+ gen_require(`
+ type device_t, ksm_device_t;
+ ')
+
+ getattr_chr_files_pattern($1, device_t, ksm_device_t)
+')
+
+########################################
+##
+## Set the attributes of the ksm devices.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`dev_setattr_ksm_dev',`
+ gen_require(`
+ type device_t, ksm_device_t;
+ ')
+
+ setattr_chr_files_pattern($1, device_t, ksm_device_t)
+')
+
+########################################
+##
+## Read the ksm devices.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`dev_read_ksm',`
+ gen_require(`
+ type device_t, ksm_device_t;
+ ')
+
+ read_chr_files_pattern($1, device_t, ksm_device_t)
+')
+
+########################################
+##
+## Read and write to ksm devices.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`dev_rw_ksm',`
+ gen_require(`
+ type device_t, ksm_device_t;
+ ')
+
+ rw_chr_files_pattern($1, device_t, ksm_device_t)
+')
+
########################################
##
## Get the attributes of the kvm devices.
@@ -1762,6 +1834,61 @@ interface(`dev_rw_kvm',`
rw_chr_files_pattern($1, device_t, kvm_device_t)
')
+######################################
+##
+## Read the lirc device.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`dev_read_lirc',`
+ gen_require(`
+ type device_t, lirc_device_t;
+ ')
+
+ read_chr_files_pattern($1, device_t, lirc_device_t)
+')
+
+######################################
+##
+## Read and write the lirc device.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`dev_rw_lirc',`
+ gen_require(`
+ type device_t, lirc_device_t;
+ ')
+
+ rw_chr_files_pattern($1, device_t, lirc_device_t)
+')
+
+######################################
+##
+## Automatic type transition to the type
+## for lirc device nodes when created in /dev.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`dev_filetrans_lirc',`
+ gen_require(`
+ type device_t, lirc_device_t;
+ ')
+
+ filetrans_pattern($1, device_t, lirc_device_t, chr_file)
+')
+
########################################
##
## Read the lvm comtrol device.
@@ -1798,6 +1925,24 @@ interface(`dev_rw_lvm_control',`
rw_chr_files_pattern($1, device_t, lvm_control_t)
')
+########################################
+##
+## Do not audit attempts to read and write lvm control device.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`dev_dontaudit_rw_lvm_control',`
+ gen_require(`
+ type lvm_control_t;
+ ')
+
+ dontaudit $1 lvm_control_t:chr_file rw_file_perms;
+')
+
########################################
##
## Delete the lvm control device.
@@ -2044,6 +2189,78 @@ interface(`dev_dontaudit_rw_misc',`
dontaudit $1 misc_device_t:chr_file rw_file_perms;
')
+########################################
+##
+## Get the attributes of the modem devices.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`dev_getattr_modem_dev',`
+ gen_require(`
+ type device_t, modem_device_t;
+ ')
+
+ getattr_chr_files_pattern($1, device_t, modem_device_t)
+')
+
+########################################
+##
+## Set the attributes of the modem devices.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`dev_setattr_modem_dev',`
+ gen_require(`
+ type device_t, modem_device_t;
+ ')
+
+ setattr_chr_files_pattern($1, device_t, modem_device_t)
+')
+
+########################################
+##
+## Read the modem devices.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`dev_read_modem',`
+ gen_require(`
+ type device_t, modem_device_t;
+ ')
+
+ read_chr_files_pattern($1, device_t, modem_device_t)
+')
+
+########################################
+##
+## Read and write to modem devices.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`dev_rw_modem',`
+ gen_require(`
+ type device_t, modem_device_t;
+ ')
+
+ rw_chr_files_pattern($1, device_t, modem_device_t)
+')
+
########################################
##
## Get the attributes of the mouse devices.
@@ -2303,6 +2520,24 @@ interface(`dev_setattr_null_dev',`
setattr_chr_files_pattern($1, device_t, null_device_t)
')
+########################################
+##
+## Delete the null device (/dev/null).
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`dev_delete_null',`
+ gen_require(`
+ type device_t, null_device_t;
+ ')
+
+ delete_chr_files_pattern($1, device_t, null_device_t)
+')
+
########################################
##
## Read and write to the null device (/dev/null).
@@ -3597,6 +3832,24 @@ interface(`dev_write_watchdog',`
write_chr_files_pattern($1, device_t, watchdog_device_t)
')
+########################################
+##
+## Read and write the the wireless device.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`dev_rw_wireless',`
+ gen_require(`
+ type device_t, wireless_device_t;
+ ')
+
+ rw_chr_files_pattern($1, device_t, wireless_device_t)
+')
+
########################################
##
## Read and write Xen devices.
diff --git a/policy/modules/kernel/devices.te b/policy/modules/kernel/devices.te
index e87179fc..1b536ec2 100644
--- a/policy/modules/kernel/devices.te
+++ b/policy/modules/kernel/devices.te
@@ -1,5 +1,5 @@
-policy_module(devices, 1.9.0)
+policy_module(devices, 1.9.1)
########################################
#
@@ -83,6 +83,12 @@ dev_node(ipmi_device_t)
type kmsg_device_t;
dev_node(kmsg_device_t)
+#
+# ksm_device_t is the type of /dev/ksm
+#
+type ksm_device_t;
+dev_node(ksm_device_t)
+
#
# kvm_device_t is the type of
# /dev/kvm
@@ -90,6 +96,12 @@ dev_node(kmsg_device_t)
type kvm_device_t;
dev_node(kvm_device_t)
+#
+# Type for /dev/lirc
+#
+type lirc_device_t;
+dev_node(lirc_device_t)
+
#
# Type for /dev/mapper/control
#
@@ -109,6 +121,12 @@ neverallow ~{ memory_raw_write devices_unconfined_type } memory_device_t:{ chr_f
type misc_device_t;
dev_node(misc_device_t)
+#
+# A general type for modem devices.
+#
+type modem_device_t;
+dev_node(modem_device_t)
+
#
# A more general type for mouse devices.
#
@@ -123,7 +141,7 @@ dev_node(mtrr_device_t)
genfscon proc /mtrr gen_context(system_u:object_r:mtrr_device_t,s0)
#
-# network control devices
+# network control devices
#
type netcontrol_device_t;
dev_node(netcontrol_device_t)
@@ -137,13 +155,13 @@ mls_trusted_object(null_device_t)
sid devnull gen_context(system_u:object_r:null_device_t,s0)
#
-# Type for /dev/nvram
+# Type for /dev/nvram
#
type nvram_device_t;
dev_node(nvram_device_t)
#
-# Type for /dev/pmu
+# Type for /dev/pmu
#
type power_device_t;
dev_node(power_device_t)
@@ -153,7 +171,7 @@ dev_node(printer_device_t)
mls_file_write_within_range(printer_device_t)
#
-# qemu control devices
+# qemu control devices
#
type qemu_device_t;
dev_node(qemu_device_t)
@@ -224,6 +242,12 @@ dev_node(vmware_device_t)
type watchdog_device_t;
dev_node(watchdog_device_t)
+#
+# wireless control devices
+#
+type wireless_device_t;
+dev_node(wireless_device_t)
+
type xen_device_t;
dev_node(xen_device_t)
From d6c3ed85577a26cefec4b981338019d3f3af8949 Mon Sep 17 00:00:00 2001
From: Chris PeBenito
Date: Thu, 19 Nov 2009 14:57:49 -0500
Subject: [PATCH 12/35] Add terminal patch from Dan Walsh.
---
policy/modules/kernel/terminal.fc | 1 +
policy/modules/kernel/terminal.if | 39 ++++++++++++++++++++++++++++++-
policy/modules/kernel/terminal.te | 3 ++-
3 files changed, 41 insertions(+), 2 deletions(-)
diff --git a/policy/modules/kernel/terminal.fc b/policy/modules/kernel/terminal.fc
index 592a1aca..3994e578 100644
--- a/policy/modules/kernel/terminal.fc
+++ b/policy/modules/kernel/terminal.fc
@@ -13,6 +13,7 @@
/dev/ip2[^/]* -c gen_context(system_u:object_r:tty_device_t,s0)
/dev/isdn.* -c gen_context(system_u:object_r:tty_device_t,s0)
/dev/ptmx -c gen_context(system_u:object_r:ptmx_t,s0)
+/dev/pts/ptmx -c gen_context(system_u:object_r:ptmx_t,s0)
/dev/rfcomm[0-9]+ -c gen_context(system_u:object_r:tty_device_t,s0)
/dev/slamr[0-9]+ -c gen_context(system_u:object_r:tty_device_t,s0)
/dev/tty -c gen_context(system_u:object_r:devtty_t,s0)
diff --git a/policy/modules/kernel/terminal.if b/policy/modules/kernel/terminal.if
index f89eaba0..8e907629 100644
--- a/policy/modules/kernel/terminal.if
+++ b/policy/modules/kernel/terminal.if
@@ -196,7 +196,7 @@ interface(`term_use_all_terms',`
dev_list_all_dev_nodes($1)
allow $1 devpts_t:dir list_dir_perms;
- allow $1 { console_device_t tty_device_t ttynode ptynode }:chr_file rw_chr_file_perms;
+ allow $1 { devpts_t console_device_t tty_device_t ttynode ptynode }:chr_file rw_chr_file_perms;
')
########################################
@@ -472,6 +472,24 @@ interface(`term_dontaudit_manage_pty_dirs',`
dontaudit $1 devpts_t:dir manage_dir_perms;
')
+########################################
+##
+## Do not audit attempts to get the attributes
+## of generic pty devices.
+##
+##
+##
+## The type of the process to not audit.
+##
+##
+#
+interface(`term_dontaudit_getattr_generic_ptys',`
+ gen_require(`
+ type devpts_t;
+ ')
+
+ dontaudit $1 devpts_t:chr_file getattr;
+')
########################################
##
## ioctl of generic pty devices.
@@ -575,6 +593,25 @@ interface(`term_dontaudit_use_generic_ptys',`
dontaudit $1 devpts_t:chr_file { getattr read write ioctl };
')
+#######################################
+##
+## Set the attributes of the tty device
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`term_setattr_controlling_term',`
+ gen_require(`
+ type devtty_t;
+ ')
+
+ dev_list_all_dev_nodes($1)
+ allow $1 devtty_t:chr_file setattr;
+')
+
########################################
##
## Read and write the controlling
diff --git a/policy/modules/kernel/terminal.te b/policy/modules/kernel/terminal.te
index f7db981d..ba8d5b68 100644
--- a/policy/modules/kernel/terminal.te
+++ b/policy/modules/kernel/terminal.te
@@ -1,5 +1,5 @@
-policy_module(terminal, 1.7.0)
+policy_module(terminal, 1.7.1)
########################################
#
@@ -44,6 +44,7 @@ mls_trusted_object(devtty_t)
type ptmx_t;
dev_node(ptmx_t)
mls_trusted_object(ptmx_t)
+allow ptmx_t devpts_t:filesystem associate;
#
# tty_device_t is the type of /dev/*tty*
From f4b9dc3b00f7106852fe745a48b9cf9218e0d5e3 Mon Sep 17 00:00:00 2001
From: Chris PeBenito
Date: Mon, 23 Nov 2009 13:16:28 -0500
Subject: [PATCH 13/35] Filesystem patch from Dan Walsh.
---
policy/modules/kernel/filesystem.fc | 2 +-
policy/modules/kernel/filesystem.if | 224 +++++++++++++++++++++++++++-
policy/modules/kernel/filesystem.te | 14 +-
3 files changed, 227 insertions(+), 13 deletions(-)
diff --git a/policy/modules/kernel/filesystem.fc b/policy/modules/kernel/filesystem.fc
index 7be4ddf7..b029773a 100644
--- a/policy/modules/kernel/filesystem.fc
+++ b/policy/modules/kernel/filesystem.fc
@@ -1 +1 @@
-# This module currently does not have any file contexts.
+/dev/shm -d gen_context(system_u:object_r:tmpfs_t,s0)
diff --git a/policy/modules/kernel/filesystem.if b/policy/modules/kernel/filesystem.if
index b2c058a4..eb723b42 100644
--- a/policy/modules/kernel/filesystem.if
+++ b/policy/modules/kernel/filesystem.if
@@ -308,6 +308,26 @@ interface(`fs_rw_anon_inodefs_files',`
rw_files_pattern($1, anon_inodefs_t, anon_inodefs_t)
')
+########################################
+##
+## Do not audit attempts to read or write files on
+## anon_inodefs file systems.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`fs_dontaudit_rw_anon_inodefs_files',`
+ gen_require(`
+ type anon_inodefs_t;
+
+ ')
+
+ dontaudit $1 anon_inodefs_t:file rw_file_perms;
+')
+
########################################
##
## Mount an automount pseudo filesystem.
@@ -462,7 +482,7 @@ interface(`fs_manage_autofs_symlinks',`
########################################
##
## Get the attributes of directories on
-## binfmt_misc filesystems.
+## binfmt_misc filesystems.
##
##
##
@@ -1149,6 +1169,44 @@ interface(`fs_cifs_domtrans',`
domain_auto_transition_pattern($1, cifs_t, $2)
')
+#######################################
+##
+## Create, read, write, and delete dirs
+## on a configfs filesystem.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`fs_manage_configfs_dirs',`
+ gen_require(`
+ type configfs_t;
+ ')
+
+ manage_dirs_pattern($1, configfs_t, configfs_t)
+')
+
+#######################################
+##
+## Create, read, write, and delete files
+## on a configfs filesystem.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`fs_manage_configfs_files',`
+ gen_require(`
+ type configfs_t;
+ ')
+
+ manage_files_pattern($1, configfs_t, configfs_t)
+')
+
########################################
##
## Mount a DOS filesystem, such as
@@ -1248,7 +1306,7 @@ interface(`fs_relabelfrom_dos_fs',`
########################################
##
-## Search dosfs filesystem.
+## Search dosfs filesystem.
##
##
##
@@ -1537,7 +1595,25 @@ interface(`fs_rw_hugetlbfs_files',`
########################################
##
-## Search inotifyfs filesystem.
+## Allow the type to associate to hugetlbfs filesystems.
+##
+##
+##
+## The type of the object to be associated.
+##
+##
+#
+interface(`fs_associate_hugetlbfs',`
+ gen_require(`
+ type hugetlbfs_t;
+ ')
+
+ allow $1 hugetlbfs_t:filesystem associate;
+')
+
+########################################
+##
+## Search inotifyfs filesystem.
##
##
##
@@ -1555,7 +1631,7 @@ interface(`fs_search_inotifyfs',`
########################################
##
-## List inotifyfs filesystem.
+## List inotifyfs filesystem.
##
##
##
@@ -2540,6 +2616,42 @@ interface(`fs_search_nfsd_fs',`
allow $1 nfsd_fs_t:dir search_dir_perms;
')
+########################################
+##
+## List NFS server directories.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`fs_list_nfsd_fs',`
+ gen_require(`
+ type nfsd_fs_t;
+ ')
+
+ allow $1 nfsd_fs_t:dir list_dir_perms;
+')
+
+########################################
+##
+## Getattr files on an nfsd filesystem
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`fs_getattr_nfsd_files',`
+ gen_require(`
+ type nfsd_fs_t;
+ ')
+
+ getattr_files_pattern($1, nfsd_fs_t, nfsd_fs_t)
+')
+
########################################
##
## Read and write NFS server files.
@@ -2687,7 +2799,7 @@ interface(`fs_dontaudit_search_ramfs',`
########################################
##
-## Create, read, write, and delete
+## Create, read, write, and delete
## directories on a ramfs.
##
##
@@ -2779,7 +2891,7 @@ interface(`fs_write_ramfs_pipes',`
########################################
##
-## Do not audit attempts to write to named
+## Do not audit attempts to write to named
## pipes on a ramfs filesystem.
##
##
@@ -2816,7 +2928,7 @@ interface(`fs_rw_ramfs_pipes',`
########################################
##
-## Create, read, write, and delete
+## Create, read, write, and delete
## named pipes on a ramfs filesystem.
##
##
@@ -3570,6 +3682,104 @@ interface(`fs_manage_tmpfs_blk_files',`
manage_blk_files_pattern($1, tmpfs_t, tmpfs_t)
')
+########################################
+##
+## Mount a XENFS filesystem.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`fs_mount_xenfs',`
+ gen_require(`
+ type xenfs_t;
+ ')
+
+ allow $1 xenfs_t:filesystem mount;
+')
+
+########################################
+##
+## Create, read, write, and delete directories
+## on a XENFS filesystem.
+##
+##
+##
+## Domain allowed access.
+##
+##
+##
+#
+interface(`fs_manage_xenfs_dirs',`
+ gen_require(`
+ type xenfs_t;
+ ')
+
+ allow $1 xenfs_t:dir manage_dir_perms;
+')
+
+########################################
+##
+## Do not audit attempts to create, read,
+## write, and delete directories
+## on a XENFS filesystem.
+##
+##
+##
+## Domain to not audit.
+##
+##
+#
+interface(`fs_dontaudit_manage_xenfs_dirs',`
+ gen_require(`
+ type xenfs_t;
+ ')
+
+ dontaudit $1 xenfs_t:dir manage_dir_perms;
+')
+
+########################################
+##
+## Create, read, write, and delete files
+## on a XENFS filesystem.
+##
+##
+##
+## Domain allowed access.
+##
+##
+##
+#
+interface(`fs_manage_xenfs_files',`
+ gen_require(`
+ type xenfs_t;
+ ')
+
+ manage_files_pattern($1, xenfs_t, xenfs_t)
+')
+
+########################################
+##
+## Do not audit attempts to create,
+## read, write, and delete files
+## on a XENFS filesystem.
+##
+##
+##
+## Domain to not audit.
+##
+##
+#
+interface(`fs_dontaudit_manage_xenfs_files',`
+ gen_require(`
+ type xenfs_t;
+ ')
+
+ dontaudit $1 xenfs_t:file manage_file_perms;
+')
+
########################################
##
## Mount all filesystems.
diff --git a/policy/modules/kernel/filesystem.te b/policy/modules/kernel/filesystem.te
index 98214102..12272e55 100644
--- a/policy/modules/kernel/filesystem.te
+++ b/policy/modules/kernel/filesystem.te
@@ -1,5 +1,5 @@
-policy_module(filesystem, 1.12.0)
+policy_module(filesystem, 1.12.1)
########################################
#
@@ -38,7 +38,7 @@ fs_use_xattr xfs gen_context(system_u:object_r:fs_t,s0);
# types, and label the filesystem itself with the specified context.
# This is appropriate for pseudo filesystems that represent objects
# like pipes and sockets, so that these objects are labeled with the same
-# type as the creating task.
+# type as the creating task.
fs_use_task eventpollfs gen_context(system_u:object_r:fs_t,s0);
fs_use_task pipefs gen_context(system_u:object_r:fs_t,s0);
fs_use_task sockfs gen_context(system_u:object_r:fs_t,s0);
@@ -93,7 +93,7 @@ genfscon futexfs / gen_context(system_u:object_r:futexfs_t,s0)
type hugetlbfs_t;
fs_type(hugetlbfs_t)
files_mountpoint(hugetlbfs_t)
-genfscon hugetlbfs / gen_context(system_u:object_r:hugetlbfs_t,s0)
+fs_use_trans hugetlbfs gen_context(system_u:object_r:hugetlbfs_t,s0);
type ibmasmfs_t;
fs_type(ibmasmfs_t)
@@ -174,6 +174,11 @@ fs_use_trans tmpfs gen_context(system_u:object_r:tmpfs_t,s0);
allow tmpfs_t noxattrfs:filesystem associate;
+type xenfs_t;
+fs_noxattr_type(xenfs_t)
+files_mountpoint(xenfs_t)
+genfscon xenfs / gen_context(system_u:object_r:xenfs_t,s0)
+
##############################
#
# Filesystems without extended attribute support
@@ -250,7 +255,6 @@ genfscon lustre / gen_context(system_u:object_r:nfs_t,s0)
genfscon ncpfs / gen_context(system_u:object_r:nfs_t,s0)
genfscon reiserfs / gen_context(system_u:object_r:nfs_t,s0)
genfscon panfs / gen_context(system_u:object_r:nfs_t,s0)
-genfscon xenfs / gen_context(system_u:object_r:nfs_t,s0)
genfscon gadgetfs / gen_context(system_u:object_r:nfs_t,s0)
########################################
@@ -275,7 +279,7 @@ fs_associate_noxattr(noxattrfs)
allow filesystem_unconfined_type filesystem_type:filesystem *;
-# Create/access other files. fs_type is to pick up various
+# Create/access other files. fs_type is to pick up various
# pseudo filesystem types that are applied to both the filesystem
# and its files.
allow filesystem_unconfined_type filesystem_type:{ dir file lnk_file sock_file fifo_file chr_file blk_file } *;
From 290aa8a020b84641043c55f35eb0ee9e73e21287 Mon Sep 17 00:00:00 2001
From: Chris PeBenito
Date: Mon, 23 Nov 2009 13:47:36 -0500
Subject: [PATCH 14/35] Corecommands patch from Dan Walsh.
---
policy/modules/kernel/corecommands.fc | 12 ++++++++++--
policy/modules/kernel/corecommands.if | 2 +-
policy/modules/kernel/corecommands.te | 2 +-
3 files changed, 12 insertions(+), 4 deletions(-)
diff --git a/policy/modules/kernel/corecommands.fc b/policy/modules/kernel/corecommands.fc
index 6b30d664..f1b1de2f 100644
--- a/policy/modules/kernel/corecommands.fc
+++ b/policy/modules/kernel/corecommands.fc
@@ -54,6 +54,8 @@ ifdef(`distro_redhat',`
/etc/cron.weekly/.* -- gen_context(system_u:object_r:bin_t,s0)
/etc/cron.monthly/.* -- gen_context(system_u:object_r:bin_t,s0)
+/etc/dhcp/dhclient\.d(/.*)? gen_context(system_u:object_r:bin_t,s0)
+
/etc/hotplug/.*agent -- gen_context(system_u:object_r:bin_t,s0)
/etc/hotplug/.*rc -- gen_context(system_u:object_r:bin_t,s0)
/etc/hotplug/hotplug\.functions -- gen_context(system_u:object_r:bin_t,s0)
@@ -123,8 +125,9 @@ ifdef(`distro_gentoo',`
#
/sbin -d gen_context(system_u:object_r:bin_t,s0)
/sbin/.* gen_context(system_u:object_r:bin_t,s0)
-/sbin/mkfs\.cramfs -- gen_context(system_u:object_r:bin_t,s0)
/sbin/insmod_ksymoops_clean -- gen_context(system_u:object_r:bin_t,s0)
+/sbin/mkfs\.cramfs -- gen_context(system_u:object_r:bin_t,s0)
+/sbin/nologin -- gen_context(system_u:object_r:shell_exec_t,s0)
#
# /opt
@@ -135,7 +138,6 @@ ifdef(`distro_gentoo',`
/opt/(.*/)?sbin(/.*)? gen_context(system_u:object_r:bin_t,s0)
-/opt/real/RealPlayer/realplay(\.bin)? gen_context(system_u:object_r:bin_t,s0)
ifdef(`distro_gentoo',`
/opt/RealPlayer/realplay(\.bin)? gen_context(system_u:object_r:bin_t,s0)
/opt/RealPlayer/postint(/.*)? gen_context(system_u:object_r:bin_t,s0)
@@ -211,6 +213,8 @@ ifdef(`distro_gentoo',`
/usr/share/apr-0/build/[^/]+\.sh -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/apr-0/build/libtool -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/debconf/.+ -- gen_context(system_u:object_r:bin_t,s0)
+/usr/share/cluster/.*\.sh gen_context(system_u:object_r:bin_t,s0)
+/usr/share/cluster/svclib_nfslock -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/gnucash/finance-quote-check -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/gnucash/finance-quote-helper -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/hal/device-manager/hal-device-manager -- gen_context(system_u:object_r:bin_t,s0)
@@ -220,7 +224,10 @@ ifdef(`distro_gentoo',`
/usr/share/printconf/util/print\.py -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/PackageKit/pk-upgrade-distro\.sh -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/PackageKit/helpers(/.*)? gen_context(system_u:object_r:bin_t,s0)
+/usr/share/sandbox/sandboxX.sh -- gen_context(system_u:object_r:bin_t,s0)
+/usr/share/sectool/.*\.py -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/selinux/devel/policygentool -- gen_context(system_u:object_r:bin_t,s0)
+/usr/share/smolt/client(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/share/shorewall/configpath -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/shorewall-perl(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/share/shorewall-shell(/.*)? gen_context(system_u:object_r:bin_t,s0)
@@ -263,6 +270,7 @@ ifdef(`distro_redhat', `
/usr/share/ssl/misc(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/share/switchdesk/switchdesk-gui\.py -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/system-config-date/system-config-date\.py -- gen_context(system_u:object_r:bin_t,s0)
+/usr/share/system-config-selinux/polgen\.py -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/system-config-selinux/system-config-selinux\.py -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/system-config-display/system-config-display -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/system-config-httpd/system-config-httpd -- gen_context(system_u:object_r:bin_t,s0)
diff --git a/policy/modules/kernel/corecommands.if b/policy/modules/kernel/corecommands.if
index 52bb5938..a6e68d79 100644
--- a/policy/modules/kernel/corecommands.if
+++ b/policy/modules/kernel/corecommands.if
@@ -447,7 +447,7 @@ interface(`corecmd_bin_domtrans',`
type bin_t;
')
- corecmd_bin_spec_domtrans($1,$2)
+ corecmd_bin_spec_domtrans($1, $2)
type_transition $1 bin_t:process $2;
')
diff --git a/policy/modules/kernel/corecommands.te b/policy/modules/kernel/corecommands.te
index 9c152aa7..d5cf8452 100644
--- a/policy/modules/kernel/corecommands.te
+++ b/policy/modules/kernel/corecommands.te
@@ -1,5 +1,5 @@
-policy_module(corecommands, 1.12.0)
+policy_module(corecommands, 1.12.1)
########################################
#
From 910b1d8ecb896e0c3a11dc0f80e6db3dc6be2264 Mon Sep 17 00:00:00 2001
From: Chris PeBenito
Date: Tue, 24 Nov 2009 08:49:15 -0500
Subject: [PATCH 15/35] Files patch from Dan Walsh.
---
policy/modules/kernel/files.if | 97 +++++++++++++++++++++++++++++++++-
policy/modules/kernel/files.te | 4 +-
2 files changed, 98 insertions(+), 3 deletions(-)
diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if
index 57f66ded..4a2865bd 100644
--- a/policy/modules/kernel/files.if
+++ b/policy/modules/kernel/files.if
@@ -1192,6 +1192,26 @@ interface(`files_relabel_config_dirs',`
relabel_dirs_pattern($1, configfile, configfile)
')
+########################################
+##
+## Read config files in /etc.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`files_read_config_files',`
+ gen_require(`
+ attribute configfile;
+ ')
+
+ allow $1 configfile:dir list_dir_perms;
+ read_files_pattern($1, configfile, configfile)
+ read_lnk_files_pattern($1, configfile, configfile)
+')
+
###########################################
##
## Manage all configuration files on filesystem
@@ -1565,6 +1585,25 @@ interface(`files_boot_filetrans',`
filetrans_pattern($1, boot_t, $2, $3)
')
+########################################
+##
+## read files in the /boot directory.
+##
+##
+##
+## Domain allowed access.
+##
+##
+##
+#
+interface(`files_read_boot_files',`
+ gen_require(`
+ type boot_t;
+ ')
+
+ manage_files_pattern($1, boot_t, boot_t)
+')
+
########################################
##
## Create, read, write, and delete files
@@ -1793,6 +1832,25 @@ interface(`files_dontaudit_list_default',`
dontaudit $1 default_t:dir list_dir_perms;
')
+########################################
+##
+## Create, read, write, and delete directories with
+## the default file type.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`files_manage_default_dirs',`
+ gen_require(`
+ type default_t;
+ ')
+
+ manage_dirs_pattern($1, default_t, default_t)
+')
+
########################################
##
## Mount a filesystem on a directory with the default file type.
@@ -1867,6 +1925,25 @@ interface(`files_dontaudit_read_default_files',`
dontaudit $1 default_t:file read_file_perms;
')
+########################################
+##
+## Create, read, write, and delete files with
+## the default file type.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`files_manage_default_files',`
+ gen_require(`
+ type default_t;
+ ')
+
+ manage_files_pattern($1, default_t, default_t)
+')
+
########################################
##
## Read symbolic links with the default file type.
@@ -3489,6 +3566,24 @@ interface(`files_setattr_all_tmp_dirs',`
allow $1 tmpfile:dir { search_dir_perms setattr };
')
+########################################
+##
+## List all tmp directories.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`files_list_all_tmp',`
+ gen_require(`
+ attribute tmpfile;
+ ')
+
+ allow $1 tmpfile:dir list_dir_perms;
+')
+
########################################
##
## Do not audit attempts to get the attributes
@@ -5072,7 +5167,7 @@ interface(`files_polyinstantiate_all',`
selinux_compute_member($1)
# Need sys_admin capability for mounting
- allow $1 self:capability { chown fsetid sys_admin };
+ allow $1 self:capability { chown fsetid sys_admin fowner };
# Need to give access to the directories to be polyinstantiated
allow $1 polydir:dir { create open getattr search write add_name setattr mounton rmdir };
diff --git a/policy/modules/kernel/files.te b/policy/modules/kernel/files.te
index e970d85b..d6e85d3e 100644
--- a/policy/modules/kernel/files.te
+++ b/policy/modules/kernel/files.te
@@ -1,5 +1,5 @@
-policy_module(files, 1.12.0)
+policy_module(files, 1.12.1)
########################################
#
@@ -53,7 +53,7 @@ files_mountpoint(default_t)
#
# etc_t is the type of the system etc directories.
#
-type etc_t;
+type etc_t, configfile;
files_type(etc_t)
# compatibility aliases for removed types:
typealias etc_t alias automount_etc_t;
From 9dfdd48feca4b0b7b4a96949337d60a510368018 Mon Sep 17 00:00:00 2001
From: Chris PeBenito
Date: Tue, 24 Nov 2009 09:04:48 -0500
Subject: [PATCH 16/35] Miscfiles patch from Dan Walsh.
---
policy/modules/system/miscfiles.if | 60 +++++++++++++++++++++++++++++-
policy/modules/system/miscfiles.te | 2 +-
2 files changed, 60 insertions(+), 2 deletions(-)
diff --git a/policy/modules/system/miscfiles.if b/policy/modules/system/miscfiles.if
index 428ce71e..ba77018a 100644
--- a/policy/modules/system/miscfiles.if
+++ b/policy/modules/system/miscfiles.if
@@ -85,6 +85,45 @@ interface(`miscfiles_read_fonts',`
read_lnk_files_pattern($1, fonts_t, fonts_t)
')
+########################################
+##
+## Set the attributes on a fonts directory.
+##
+##
+##
+## Domain allowed access.
+##
+##
+##
+#
+interface(`miscfiles_setattr_fonts_dirs',`
+ gen_require(`
+ type fonts_t;
+ ')
+
+ allow $1 fonts_t:dir setattr;
+')
+
+########################################
+##
+## Do not audit attempts to set the attributes
+## on a fonts directory.
+##
+##
+##
+## Domain allowed access.
+##
+##
+##
+#
+interface(`miscfiles_dontaudit_setattr_fonts_dirs',`
+ gen_require(`
+ type fonts_t;
+ ')
+
+ dontaudit $1 fonts_t:dir setattr;
+')
+
########################################
##
## Do not audit attempts to write fonts.
@@ -253,6 +292,25 @@ interface(`miscfiles_legacy_read_localization',`
allow $1 locale_t:file execute;
')
+########################################
+##
+## Search man pages.
+##
+##
+##
+## Domain to not audit.
+##
+##
+#
+interface(`miscfiles_search_man_pages',`
+ gen_require(`
+ type man_t;
+ ')
+
+ allow $1 man_t:dir search_dir_perms;
+ files_search_usr($1)
+')
+
########################################
##
## Do not audit attempts to search man pages.
@@ -268,7 +326,7 @@ interface(`miscfiles_dontaudit_search_man_pages',`
type man_t;
')
- dontaudit $1 man_t:dir search;
+ dontaudit $1 man_t:dir search_dir_perms;
')
########################################
diff --git a/policy/modules/system/miscfiles.te b/policy/modules/system/miscfiles.te
index aa77a21b..ef9d197b 100644
--- a/policy/modules/system/miscfiles.te
+++ b/policy/modules/system/miscfiles.te
@@ -1,5 +1,5 @@
-policy_module(miscfiles, 1.7.0)
+policy_module(miscfiles, 1.7.1)
########################################
#
From bd34ef71df6b7b98713e1c298e25d2c3e6458f24 Mon Sep 17 00:00:00 2001
From: Chris PeBenito
Date: Tue, 24 Nov 2009 09:19:45 -0500
Subject: [PATCH 17/35] LVM patch from Dan Walsh.
---
policy/modules/system/lvm.if | 39 ++++++++++++++++++++++++++++++++++++
policy/modules/system/lvm.te | 24 +++++++++++++++++++---
2 files changed, 60 insertions(+), 3 deletions(-)
diff --git a/policy/modules/system/lvm.if b/policy/modules/system/lvm.if
index 0666bb61..809cf34b 100644
--- a/policy/modules/system/lvm.if
+++ b/policy/modules/system/lvm.if
@@ -19,6 +19,26 @@ interface(`lvm_domtrans',`
domtrans_pattern($1, lvm_exec_t, lvm_t)
')
+########################################
+##
+## Execute lvm programs in the caller domain.
+##
+##
+##
+## The type of the process performing this action.
+##
+##
+#
+interface(`lvm_exec',`
+ gen_require(`
+ type lvm_exec_t;
+ ')
+
+ corecmd_search_sbin($1)
+ can_exec($1, lvm_exec_t)
+
+')
+
########################################
##
## Execute lvm programs in the lvm domain.
@@ -85,3 +105,22 @@ interface(`lvm_manage_config',`
manage_dirs_pattern($1, lvm_etc_t, lvm_etc_t)
manage_files_pattern($1, lvm_etc_t, lvm_etc_t)
')
+
+######################################
+##
+## Execute a domain transition to run clvmd.
+##
+##
+##
+## Domain allowed to transition.
+##
+##
+#
+interface(`lvm_domtrans_clvmd',`
+ gen_require(`
+ type clvmd_t, clvmd_exec_t;
+ ')
+
+ corecmd_search_bin($1)
+ domtrans_pattern($1,clvmd_exec_t,clvmd_t)
+')
diff --git a/policy/modules/system/lvm.te b/policy/modules/system/lvm.te
index 8fcc7d36..69e65e43 100644
--- a/policy/modules/system/lvm.te
+++ b/policy/modules/system/lvm.te
@@ -1,5 +1,5 @@
-policy_module(lvm, 1.11.0)
+policy_module(lvm, 1.11.1)
########################################
#
@@ -10,6 +10,9 @@ type clvmd_t;
type clvmd_exec_t;
init_daemon_domain(clvmd_t, clvmd_exec_t)
+type clvmd_initrc_exec_t;
+init_script_file(clvmd_initrc_exec_t)
+
type clvmd_var_run_t;
files_pid_file(clvmd_var_run_t)
@@ -102,6 +105,7 @@ fs_getattr_all_fs(clvmd_t)
fs_search_auto_mountpoints(clvmd_t)
fs_dontaudit_list_tmpfs(clvmd_t)
fs_dontaudit_read_removable_files(clvmd_t)
+fs_rw_anon_inodefs_files(clvmd_t)
storage_dontaudit_getattr_removable_dev(clvmd_t)
storage_manage_fixed_disk(clvmd_t)
@@ -168,7 +172,7 @@ allow lvm_t self:process { sigchld sigkill sigstop signull signal };
# LVM will complain a lot if it cannot set its priority.
allow lvm_t self:process setsched;
allow lvm_t self:file rw_file_perms;
-allow lvm_t self:fifo_file rw_fifo_file_perms;
+allow lvm_t self:fifo_file manage_fifo_file_perms;
allow lvm_t self:unix_dgram_socket create_socket_perms;
allow lvm_t self:netlink_kobject_uevent_socket create_socket_perms;
@@ -214,6 +218,7 @@ kernel_read_kernel_sysctls(lvm_t)
# it has no reason to need this
kernel_dontaudit_getattr_core_if(lvm_t)
kernel_use_fds(lvm_t)
+kernel_search_debugfs(lvm_t)
corecmd_exec_bin(lvm_t)
corecmd_exec_shell(lvm_t)
@@ -255,6 +260,10 @@ fs_list_tmpfs(lvm_t)
fs_read_tmpfs_symlinks(lvm_t)
fs_dontaudit_read_removable_files(lvm_t)
fs_dontaudit_getattr_tmpfs_files(lvm_t)
+fs_rw_anon_inodefs_files(lvm_t)
+
+mls_file_read_all_levels(lvm_t)
+mls_file_write_to_clearance(lvm_t)
selinux_get_fs_mount(lvm_t)
selinux_validate_context(lvm_t)
@@ -274,9 +283,12 @@ storage_dev_filetrans_fixed_disk(lvm_t)
# Access raw devices and old /dev/lvm (c 109,0). Is this needed?
storage_manage_fixed_disk(lvm_t)
+term_use_all_terms(lvm_t)
+
init_use_fds(lvm_t)
init_dontaudit_getattr_initctl(lvm_t)
init_use_script_ptys(lvm_t)
+init_read_script_state(lvm_t)
logging_send_syslog_msg(lvm_t)
@@ -313,7 +325,9 @@ optional_policy(`
optional_policy(`
dbus_system_bus_client(lvm_t)
- hal_dbus_chat(lvm_t)
+ optional_policy(`
+ hal_dbus_chat(lvm_t)
+ ')
')
optional_policy(`
@@ -328,6 +342,10 @@ optional_policy(`
udev_read_db(lvm_t)
')
+optional_policy(`
+ virt_manage_images(lvm_t)
+')
+
optional_policy(`
xen_append_log(lvm_t)
xen_dontaudit_rw_unix_stream_sockets(lvm_t)
From 0a119a01427cf94c15f07bb30ccec40d500a8baa Mon Sep 17 00:00:00 2001
From: Chris PeBenito
Date: Tue, 24 Nov 2009 09:41:03 -0500
Subject: [PATCH 18/35] Setrans patch from Dan Walsh.
---
policy/modules/system/setrans.if | 19 +++++++++++++++++++
policy/modules/system/setrans.te | 2 +-
2 files changed, 20 insertions(+), 1 deletion(-)
diff --git a/policy/modules/system/setrans.if b/policy/modules/system/setrans.if
index dea7f557..8de660e3 100644
--- a/policy/modules/system/setrans.if
+++ b/policy/modules/system/setrans.if
@@ -1,5 +1,24 @@
## SELinux MLS/MCS label translation service.
+########################################
+##
+## Execute setrans server in the setrans domain.
+##
+##
+##
+## The type of the process performing this action.
+##
+##
+#
+#
+interface(`setrans_initrc_domtrans',`
+ gen_require(`
+ type setrans_initrc_exec_t;
+ ')
+
+ init_labeled_script_domtrans($1, setrans_initrc_exec_t)
+')
+
#######################################
##
## Allow a domain to translate contexts.
diff --git a/policy/modules/system/setrans.te b/policy/modules/system/setrans.te
index a34ab149..98ffab70 100644
--- a/policy/modules/system/setrans.te
+++ b/policy/modules/system/setrans.te
@@ -1,5 +1,5 @@
-policy_module(setrans, 1.6.0)
+policy_module(setrans, 1.6.1)
gen_require(`
class context contains;
From 0f982dada26fe04fb62da8be024785f62828155f Mon Sep 17 00:00:00 2001
From: Chris PeBenito
Date: Tue, 24 Nov 2009 11:08:22 -0500
Subject: [PATCH 19/35] ISCSI patch from Dan Walsh.
---
policy/modules/system/iscsi.if | 39 ++++++++++++++++++++++++++++++++++
policy/modules/system/iscsi.te | 7 +++---
2 files changed, 43 insertions(+), 3 deletions(-)
diff --git a/policy/modules/system/iscsi.if b/policy/modules/system/iscsi.if
index 6f0b2063..88e3b32c 100644
--- a/policy/modules/system/iscsi.if
+++ b/policy/modules/system/iscsi.if
@@ -17,3 +17,42 @@ interface(`iscsid_domtrans',`
domtrans_pattern($1, iscsid_exec_t, iscsid_t)
')
+
+########################################
+##
+## Connect to ISCSI using a unix domain stream socket.
+##
+##
+##
+## The type of the process performing this action.
+##
+##
+#
+interface(`iscsi_stream_connect',`
+ gen_require(`
+ type iscsid_t, iscsi_var_lib_t;
+ ')
+
+ files_search_pids($1)
+ stream_connect_pattern($1, iscsi_var_lib_t, iscsi_var_lib_t, iscsid_t)
+')
+
+########################################
+##
+## Read iscsi lib files.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`iscsi_read_lib_files',`
+ gen_require(`
+ type iscsi_var_lib_t;
+ ')
+
+ read_files_pattern($1, iscsi_var_lib_t, iscsi_var_lib_t)
+ allow $1 iscsi_var_lib_t:dir list_dir_perms;
+ files_search_var_lib($1)
+')
diff --git a/policy/modules/system/iscsi.te b/policy/modules/system/iscsi.te
index c5109dff..e53aa29d 100644
--- a/policy/modules/system/iscsi.te
+++ b/policy/modules/system/iscsi.te
@@ -1,5 +1,5 @@
-policy_module(iscsi, 1.6.0)
+policy_module(iscsi, 1.6.1)
########################################
#
@@ -55,6 +55,7 @@ manage_files_pattern(iscsid_t, iscsi_var_run_t, iscsi_var_run_t)
files_pid_filetrans(iscsid_t, iscsi_var_run_t, file)
kernel_read_system_state(iscsid_t)
+kernel_search_debugfs(iscsid_t)
corenet_all_recvfrom_unlabeled(iscsid_t)
corenet_all_recvfrom_netlabel(iscsid_t)
@@ -73,6 +74,6 @@ files_read_etc_files(iscsid_t)
logging_send_syslog_msg(iscsid_t)
-miscfiles_read_localization(iscsid_t)
+auth_use_nsswitch(iscsid_t)
-sysnet_dns_name_resolve(iscsid_t)
+miscfiles_read_localization(iscsid_t)
From dccbb80cb021d86375f1e4ff2488f126cd6ab1cf Mon Sep 17 00:00:00 2001
From: Chris PeBenito
Date: Tue, 24 Nov 2009 11:11:38 -0500
Subject: [PATCH 20/35] Whitespace cleanup.
---
policy/modules/kernel/files.if | 20 ++++++++---------
policy/modules/kernel/files.te | 2 +-
policy/modules/kernel/storage.te | 2 +-
policy/modules/kernel/terminal.if | 14 ++++++------
policy/modules/kernel/terminal.te | 2 +-
policy/modules/system/lvm.if | 35 +++++++++++++++---------------
policy/modules/system/lvm.te | 4 ++--
policy/modules/system/miscfiles.if | 4 ++--
8 files changed, 41 insertions(+), 42 deletions(-)
diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if
index 4a2865bd..f5b78805 100644
--- a/policy/modules/kernel/files.if
+++ b/policy/modules/kernel/files.if
@@ -100,7 +100,7 @@ interface(`files_pid_file',`
########################################
##
-## Make the specified type a
+## Make the specified type a
## configuration file.
##
##
@@ -119,7 +119,7 @@ interface(`files_config_file',`
########################################
##
-## Make the specified type a
+## Make the specified type a
## polyinstantiated directory.
##
##
@@ -1070,7 +1070,7 @@ interface(`files_dontaudit_search_all_dirs',`
##
##
#
-# dwalsh: This interface is to allow quotacheck to work on a
+# dwalsh: This interface is to allow quotacheck to work on a
# a filesystem mounted with the --context switch
# https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=212957
#
@@ -1214,7 +1214,7 @@ interface(`files_read_config_files',`
###########################################
##
-## Manage all configuration files on filesystem
+## Manage all configuration files on filesystem
##
##
##
@@ -1233,7 +1233,7 @@ interface(`files_manage_config_files',`
#######################################
##
-## Relabel configuration files
+## Relabel configuration files
##
##
##
@@ -2636,7 +2636,7 @@ interface(`files_manage_isid_type_symlinks',`
########################################
##
-## Read and write block device nodes on new filesystems
+## Read and write block device nodes on new filesystems
## that have not yet been labeled.
##
##
@@ -3587,7 +3587,7 @@ interface(`files_list_all_tmp',`
########################################
##
## Do not audit attempts to get the attributes
-## of all tmp files.
+## of all tmp files.
##
##
##
@@ -3606,7 +3606,7 @@ interface(`files_dontaudit_getattr_all_tmp_files',`
########################################
##
## Allow attempts to get the attributes
-## of all tmp files.
+## of all tmp files.
##
##
##
@@ -3625,7 +3625,7 @@ interface(`files_getattr_all_tmp_files',`
########################################
##
## Do not audit attempts to get the attributes
-## of all tmp sock_file.
+## of all tmp sock_file.
##
##
##
@@ -4430,7 +4430,7 @@ interface(`files_rw_var_lib_dirs',`
gen_require(`
type var_lib_t;
')
-
+
rw_dirs_pattern($1, var_lib_t, var_lib_t)
')
diff --git a/policy/modules/kernel/files.te b/policy/modules/kernel/files.te
index d6e85d3e..7b08d20e 100644
--- a/policy/modules/kernel/files.te
+++ b/policy/modules/kernel/files.te
@@ -220,7 +220,7 @@ fs_associate_tmpfs(tmpfsfile)
allow files_unconfined_type file_type:{ file chr_file } ~execmod;
allow files_unconfined_type file_type:{ dir lnk_file sock_file fifo_file blk_file } *;
-# Mount/unmount any filesystem with the context= option.
+# Mount/unmount any filesystem with the context= option.
allow files_unconfined_type file_type:filesystem *;
tunable_policy(`allow_execmod',`
diff --git a/policy/modules/kernel/storage.te b/policy/modules/kernel/storage.te
index dab6e3e9..fc46c28e 100644
--- a/policy/modules/kernel/storage.te
+++ b/policy/modules/kernel/storage.te
@@ -13,7 +13,7 @@ attribute scsi_generic_write;
attribute storage_unconfined_type;
#
-# fixed_disk_device_t is the type of
+# fixed_disk_device_t is the type of
# /dev/hd* and /dev/sd*.
#
type fixed_disk_device_t;
diff --git a/policy/modules/kernel/terminal.if b/policy/modules/kernel/terminal.if
index 8e907629..22fa1c56 100644
--- a/policy/modules/kernel/terminal.if
+++ b/policy/modules/kernel/terminal.if
@@ -595,18 +595,18 @@ interface(`term_dontaudit_use_generic_ptys',`
#######################################
##
-## Set the attributes of the tty device
+## Set the attributes of the tty device
##
##
-##
-## Domain allowed access.
-##
+##
+## Domain allowed access.
+##
##
#
interface(`term_setattr_controlling_term',`
- gen_require(`
- type devtty_t;
- ')
+ gen_require(`
+ type devtty_t;
+ ')
dev_list_all_dev_nodes($1)
allow $1 devtty_t:chr_file setattr;
diff --git a/policy/modules/kernel/terminal.te b/policy/modules/kernel/terminal.te
index ba8d5b68..ba856619 100644
--- a/policy/modules/kernel/terminal.te
+++ b/policy/modules/kernel/terminal.te
@@ -22,7 +22,7 @@ type console_device_t;
dev_node(console_device_t)
#
-# devpts_t is the type of the devpts file system and
+# devpts_t is the type of the devpts file system and
# the type of the root directory of the file system.
#
type devpts_t;
diff --git a/policy/modules/system/lvm.if b/policy/modules/system/lvm.if
index 809cf34b..a64ff3ed 100644
--- a/policy/modules/system/lvm.if
+++ b/policy/modules/system/lvm.if
@@ -21,24 +21,23 @@ interface(`lvm_domtrans',`
########################################
##
-## Execute lvm programs in the caller domain.
+## Execute lvm programs in the caller domain.
##
##
-##
-## The type of the process performing this action.
-##
+##
+## The type of the process performing this action.
+##
##
#
interface(`lvm_exec',`
- gen_require(`
- type lvm_exec_t;
- ')
-
- corecmd_search_sbin($1)
- can_exec($1, lvm_exec_t)
+ gen_require(`
+ type lvm_exec_t;
+ ')
+ corecmd_search_sbin($1)
+ can_exec($1, lvm_exec_t)
')
-
+
########################################
##
## Execute lvm programs in the lvm domain.
@@ -108,19 +107,19 @@ interface(`lvm_manage_config',`
######################################
##
-## Execute a domain transition to run clvmd.
+## Execute a domain transition to run clvmd.
##
##
##
-## Domain allowed to transition.
+## Domain allowed to transition.
##
##
#
interface(`lvm_domtrans_clvmd',`
- gen_require(`
- type clvmd_t, clvmd_exec_t;
- ')
+ gen_require(`
+ type clvmd_t, clvmd_exec_t;
+ ')
- corecmd_search_bin($1)
- domtrans_pattern($1,clvmd_exec_t,clvmd_t)
+ corecmd_search_bin($1)
+ domtrans_pattern($1, clvmd_exec_t, clvmd_t)
')
diff --git a/policy/modules/system/lvm.te b/policy/modules/system/lvm.te
index 69e65e43..3c752284 100644
--- a/policy/modules/system/lvm.te
+++ b/policy/modules/system/lvm.te
@@ -196,12 +196,12 @@ files_lock_filetrans(lvm_t, lvm_lock_t, file)
manage_dirs_pattern(lvm_t, lvm_var_lib_t, lvm_var_lib_t)
manage_files_pattern(lvm_t, lvm_var_lib_t, lvm_var_lib_t)
-files_var_lib_filetrans(lvm_t, lvm_var_lib_t,{ dir file })
+files_var_lib_filetrans(lvm_t, lvm_var_lib_t, { dir file })
manage_dirs_pattern(lvm_t, lvm_var_run_t, lvm_var_run_t)
manage_files_pattern(lvm_t, lvm_var_run_t, lvm_var_run_t)
manage_sock_files_pattern(lvm_t, lvm_var_run_t, lvm_var_run_t)
-files_pid_filetrans(lvm_t, lvm_var_run_t,{ file sock_file })
+files_pid_filetrans(lvm_t, lvm_var_run_t, { file sock_file })
read_files_pattern(lvm_t, lvm_etc_t, lvm_etc_t)
read_lnk_files_pattern(lvm_t, lvm_etc_t, lvm_etc_t)
diff --git a/policy/modules/system/miscfiles.if b/policy/modules/system/miscfiles.if
index ba77018a..783f38ef 100644
--- a/policy/modules/system/miscfiles.if
+++ b/policy/modules/system/miscfiles.if
@@ -416,8 +416,8 @@ interface(`miscfiles_read_public_files',`
')
allow $1 { public_content_t public_content_rw_t }:dir list_dir_perms;
- read_files_pattern($1,{ public_content_t public_content_rw_t },{ public_content_t public_content_rw_t })
- read_lnk_files_pattern($1,{ public_content_t public_content_rw_t },{ public_content_t public_content_rw_t })
+ read_files_pattern($1, { public_content_t public_content_rw_t }, { public_content_t public_content_rw_t })
+ read_lnk_files_pattern($1, { public_content_t public_content_rw_t }, { public_content_t public_content_rw_t })
')
########################################
From 5ed061769ebdce06e56fb7131674b2bc382ca05b Mon Sep 17 00:00:00 2001
From: Chris PeBenito
Date: Tue, 24 Nov 2009 11:47:12 -0500
Subject: [PATCH 21/35] Application patch from Dan Walsh.
---
policy/modules/system/application.if | 20 +++++++++++++++++++-
policy/modules/system/application.te | 6 +++++-
2 files changed, 24 insertions(+), 2 deletions(-)
diff --git a/policy/modules/system/application.if b/policy/modules/system/application.if
index 8e4b8c22..06e7b0a8 100644
--- a/policy/modules/system/application.if
+++ b/policy/modules/system/application.if
@@ -99,5 +99,23 @@ interface(`application_exec_all',`
interface(`application_domain',`
application_type($1)
application_executable_file($2)
- domain_entry_file($1,$2)
+ domain_entry_file($1, $2)
+')
+
+########################################
+##
+## Send signull to all application domains.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`application_signull',`
+ gen_require(`
+ attribute application_domain_type;
+ ')
+
+ allow $1 application_domain_type:process signull;
')
diff --git a/policy/modules/system/application.te b/policy/modules/system/application.te
index c80f2cea..5fa76a69 100644
--- a/policy/modules/system/application.te
+++ b/policy/modules/system/application.te
@@ -1,5 +1,5 @@
-policy_module(application, 1.1.0)
+policy_module(application, 1.1.1)
# Attribute of user applications
attribute application_domain_type;
@@ -11,3 +11,7 @@ optional_policy(`
ssh_sigchld(application_domain_type)
ssh_rw_stream_sockets(application_domain_type)
')
+
+optional_policy(`
+ sudo_sigchld(application_domain_type)
+')
From 832c1be4caaecf8659405cee985e556fede92a19 Mon Sep 17 00:00:00 2001
From: Chris PeBenito
Date: Tue, 24 Nov 2009 14:09:10 -0500
Subject: [PATCH 22/35] IPSEC patch from Dan Walsh.
---
policy/modules/system/ipsec.fc | 3 ++
policy/modules/system/ipsec.if | 25 +++++++++++++++++
policy/modules/system/ipsec.te | 51 ++++++++++++++++++++++++++++++----
3 files changed, 73 insertions(+), 6 deletions(-)
diff --git a/policy/modules/system/ipsec.fc b/policy/modules/system/ipsec.fc
index d65ef1ea..7dbf57e5 100644
--- a/policy/modules/system/ipsec.fc
+++ b/policy/modules/system/ipsec.fc
@@ -1,3 +1,6 @@
+/etc/rc\.d/init\.d/ipsec -- gen_context(system_u:object_r:ipsec_initrc_exec_t,s0)
+/etc/rc\.d/init\.d/racoon -- gen_context(system_u:object_r:ipsec_initrc_exec_t,s0)
+
/etc/ipsec\.secrets -- gen_context(system_u:object_r:ipsec_key_file_t,s0)
/etc/ipsec\.conf -- gen_context(system_u:object_r:ipsec_conf_file_t,s0)
/etc/racoon/psk\.txt -- gen_context(system_u:object_r:ipsec_key_file_t,s0)
diff --git a/policy/modules/system/ipsec.if b/policy/modules/system/ipsec.if
index a162c772..7ed91dd0 100644
--- a/policy/modules/system/ipsec.if
+++ b/policy/modules/system/ipsec.if
@@ -187,6 +187,31 @@ interface(`ipsec_domtrans_racoon',`
domtrans_pattern($1, racoon_exec_t, racoon_t)
')
+########################################
+##
+## Execute racoon and allow the specified role the domain.
+##
+##
+##
+## Domain allowed access.
+##
+##
+##
+##
+## Role allowed access.
+##
+##
+##
+#
+interface(`ipsec_run_racoon',`
+ gen_require(`
+ type racoon_t;
+ ')
+
+ ipsec_domtrans_racoon($1)
+ role $2 types racoon_t;
+')
+
########################################
##
## Execute setkey in the setkey domain.
diff --git a/policy/modules/system/ipsec.te b/policy/modules/system/ipsec.te
index 8f18cbc2..d65140fb 100644
--- a/policy/modules/system/ipsec.te
+++ b/policy/modules/system/ipsec.te
@@ -1,11 +1,18 @@
-policy_module(ipsec, 1.10.0)
+policy_module(ipsec, 1.10.1)
########################################
#
# Declarations
#
+##
+##
+## Allow racoon to read shadow
+##
+##
+gen_tunable(racoon_read_shadow, false)
+
type ipsec_t;
type ipsec_exec_t;
init_daemon_domain(ipsec_t, ipsec_exec_t)
@@ -15,6 +22,9 @@ role system_r types ipsec_t;
type ipsec_conf_file_t;
files_type(ipsec_conf_file_t)
+type ipsec_initrc_exec_t;
+init_script_file(ipsec_initrc_exec_t)
+
# type for file(s) containing ipsec keys - RSA or preshared
type ipsec_key_file_t;
files_type(ipsec_key_file_t)
@@ -43,6 +53,9 @@ type racoon_exec_t;
init_daemon_domain(racoon_t, racoon_exec_t)
role system_r types racoon_t;
+type racoon_tmp_t;
+files_tmp_file(racoon_tmp_t)
+
type setkey_t;
type setkey_exec_t;
init_system_domain(setkey_t, setkey_exec_t)
@@ -53,21 +66,23 @@ role system_r types setkey_t;
# ipsec Local policy
#
-allow ipsec_t self:capability { net_admin dac_override dac_read_search };
+allow ipsec_t self:capability { net_admin dac_override dac_read_search sys_nice };
dontaudit ipsec_t self:capability sys_tty_config;
-allow ipsec_t self:process { signal setsched };
+allow ipsec_t self:process { getcap setcap getsched signal setsched };
allow ipsec_t self:tcp_socket create_stream_socket_perms;
allow ipsec_t self:udp_socket create_socket_perms;
allow ipsec_t self:key_socket create_socket_perms;
allow ipsec_t self:fifo_file read_fifo_file_perms;
allow ipsec_t self:netlink_xfrm_socket { create_netlink_socket_perms nlmsg_write };
+allow ipsec_t ipsec_initrc_exec_t:file read_file_perms;
+
allow ipsec_t ipsec_conf_file_t:dir list_dir_perms;
read_files_pattern(ipsec_t, ipsec_conf_file_t, ipsec_conf_file_t)
read_lnk_files_pattern(ipsec_t, ipsec_conf_file_t, ipsec_conf_file_t)
allow ipsec_t ipsec_key_file_t:dir list_dir_perms;
-read_files_pattern(ipsec_t, ipsec_key_file_t, ipsec_key_file_t)
+manage_files_pattern(ipsec_t, ipsec_key_file_t, ipsec_key_file_t)
read_lnk_files_pattern(ipsec_t, ipsec_key_file_t, ipsec_key_file_t)
manage_files_pattern(ipsec_t, ipsec_var_run_t, ipsec_var_run_t)
@@ -82,7 +97,7 @@ can_exec(ipsec_t, ipsec_mgmt_exec_t)
# so try flipping back into the ipsec_mgmt_t domain
corecmd_shell_domtrans(ipsec_t, ipsec_mgmt_t)
allow ipsec_mgmt_t ipsec_t:fd use;
-allow ipsec_mgmt_t ipsec_t:fifo_file rw_file_perms;
+allow ipsec_mgmt_t ipsec_t:fifo_file rw_fifo_file_perms;
allow ipsec_mgmt_t ipsec_t:process sigchld;
kernel_read_kernel_sysctls(ipsec_t)
@@ -92,6 +107,7 @@ kernel_read_proc_symlinks(ipsec_t)
kernel_read_system_state(ipsec_t)
kernel_read_network_state(ipsec_t)
kernel_read_software_raid_state(ipsec_t)
+kernel_request_load_module(ipsec_t)
kernel_getattr_core_if(ipsec_t)
kernel_getattr_message_if(ipsec_t)
@@ -120,7 +136,9 @@ dev_read_urand(ipsec_t)
domain_use_interactive_fds(ipsec_t)
+files_list_tmp(ipsec_t)
files_read_etc_files(ipsec_t)
+files_read_usr_files(ipsec_t)
fs_getattr_all_fs(ipsec_t)
fs_search_auto_mountpoints(ipsec_t)
@@ -159,7 +177,7 @@ allow ipsec_mgmt_t self:unix_stream_socket create_stream_socket_perms;
allow ipsec_mgmt_t self:tcp_socket create_stream_socket_perms;
allow ipsec_mgmt_t self:udp_socket create_socket_perms;
allow ipsec_mgmt_t self:key_socket create_socket_perms;
-allow ipsec_mgmt_t self:fifo_file rw_file_perms;
+allow ipsec_mgmt_t self:fifo_file rw_fifo_file_perms;
allow ipsec_mgmt_t ipsec_mgmt_lock_t:file manage_file_perms;
files_lock_filetrans(ipsec_mgmt_t, ipsec_mgmt_lock_t, file)
@@ -280,6 +298,15 @@ allow racoon_t self:unix_dgram_socket { connect create ioctl write };
allow racoon_t self:netlink_selinux_socket { bind create read };
allow racoon_t self:udp_socket create_socket_perms;
allow racoon_t self:key_socket create_socket_perms;
+allow racoon_t self:fifo_file rw_fifo_file_perms;
+
+manage_dirs_pattern(racoon_t, racoon_tmp_t, racoon_tmp_t)
+manage_files_pattern(racoon_t, racoon_tmp_t, racoon_tmp_t)
+files_tmp_filetrans(racoon_t, racoon_tmp_t, { dir file })
+
+can_exec(racoon_t, racoon_exec_t)
+
+can_exec(racoon_t, setkey_exec_t)
# manage pid file
manage_files_pattern(racoon_t, ipsec_var_run_t, ipsec_var_run_t)
@@ -297,6 +324,9 @@ read_lnk_files_pattern(racoon_t, ipsec_key_file_t, ipsec_key_file_t)
kernel_read_system_state(racoon_t)
kernel_read_network_state(racoon_t)
+corecmd_exec_shell(racoon_t)
+corecmd_exec_bin(racoon_t)
+
corenet_all_recvfrom_unlabeled(racoon_t)
corenet_tcp_sendrecv_all_if(racoon_t)
corenet_udp_sendrecv_all_if(racoon_t)
@@ -314,6 +344,8 @@ domain_ipsec_setcontext_all_domains(racoon_t)
files_read_etc_files(racoon_t)
+fs_dontaudit_getattr_xattr_fs(racoon_t)
+
# allow racoon to use avc_has_perm to check context on proposed SA
selinux_compute_access_vector(racoon_t)
@@ -328,6 +360,13 @@ logging_send_audit_msgs(racoon_t)
miscfiles_read_localization(racoon_t)
+sysnet_exec_ifconfig(racoon_t)
+
+auth_can_read_shadow_passwords(racoon_t)
+tunable_policy(`racoon_read_shadow',`
+ auth_tunable_read_shadow(racoon_t)
+')
+
########################################
#
# Setkey local policy
From 837163cfe78986b0a3a3e3eac037c9a21e711ab9 Mon Sep 17 00:00:00 2001
From: Chris PeBenito
Date: Wed, 25 Nov 2009 09:44:14 -0500
Subject: [PATCH 23/35] UDEV patch from Dan Walsh.
---
policy/modules/system/udev.fc | 3 +++
policy/modules/system/udev.if | 38 +++++++++++++++++++++++++++++++++++
policy/modules/system/udev.te | 33 ++++++++++++++++++++++++++++--
3 files changed, 72 insertions(+), 2 deletions(-)
diff --git a/policy/modules/system/udev.fc b/policy/modules/system/udev.fc
index 9b924c39..53c2e97b 100644
--- a/policy/modules/system/udev.fc
+++ b/policy/modules/system/udev.fc
@@ -6,8 +6,11 @@
/etc/hotplug\.d/default/udev.* -- gen_context(system_u:object_r:udev_helper_exec_t,s0)
+/etc/udev/rules.d(/.*)? gen_context(system_u:object_r:udev_var_run_t,s0)
/etc/udev/scripts/.+ -- gen_context(system_u:object_r:udev_helper_exec_t,s0)
+/lib/udev/udev-acl -- gen_context(system_u:object_r:udev_exec_t,s0)
+
/sbin/start_udev -- gen_context(system_u:object_r:udev_exec_t,s0)
/sbin/udev -- gen_context(system_u:object_r:udev_exec_t,s0)
/sbin/udevadm -- gen_context(system_u:object_r:udev_exec_t,s0)
diff --git a/policy/modules/system/udev.if b/policy/modules/system/udev.if
index beec752c..0bd4103e 100644
--- a/policy/modules/system/udev.if
+++ b/policy/modules/system/udev.if
@@ -1,5 +1,23 @@
## Policy for udev.
+########################################
+##
+## Send generic signals to udev.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`udev_signal',`
+ gen_require(`
+ type udev_t;
+ ')
+
+ allow $1 udev_t:process signal;
+')
+
########################################
##
## Execute udev in the udev domain.
@@ -169,3 +187,23 @@ interface(`udev_rw_db',`
dev_list_all_dev_nodes($1)
allow $1 udev_tbl_t:file rw_file_perms;
')
+
+########################################
+##
+## Create, read, write, and delete
+## udev pid files.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`udev_manage_pid_files',`
+ gen_require(`
+ type udev_var_run_t;
+ ')
+
+ files_search_var_lib($1)
+ manage_files_pattern($1, udev_var_run_t, udev_var_run_t)
+')
diff --git a/policy/modules/system/udev.te b/policy/modules/system/udev.te
index 132115c5..c86fad8e 100644
--- a/policy/modules/system/udev.te
+++ b/policy/modules/system/udev.te
@@ -1,5 +1,5 @@
-policy_module(udev, 1.11.0)
+policy_module(udev, 1.11.1)
########################################
#
@@ -66,9 +66,11 @@ dev_filetrans(udev_t, udev_tbl_t, file)
manage_dirs_pattern(udev_t, udev_var_run_t, udev_var_run_t)
manage_files_pattern(udev_t, udev_var_run_t, udev_var_run_t)
+manage_lnk_files_pattern(udev_t, udev_var_run_t, udev_var_run_t)
files_pid_filetrans(udev_t, udev_var_run_t, { dir file })
kernel_read_system_state(udev_t)
+kernel_request_load_module(udev_t)
kernel_getattr_core_if(udev_t)
kernel_use_fds(udev_t)
kernel_read_device_sysctls(udev_t)
@@ -99,7 +101,7 @@ dev_relabel_all_dev_nodes(udev_t)
dev_relabel_generic_symlinks(udev_t)
domain_read_all_domains_state(udev_t)
-domain_dontaudit_ptrace_all_domains(udev_t) #pidof triggers these
+domain_dontaudit_ptrace_all_domains(udev_t) #pidof triggers these
files_read_usr_files(udev_t)
files_read_etc_runtime_files(udev_t)
@@ -111,6 +113,7 @@ files_search_mnt(udev_t)
fs_getattr_all_fs(udev_t)
fs_list_inotifyfs(udev_t)
+fs_rw_anon_inodefs_files(udev_t)
mcs_ptrace_all(udev_t)
@@ -140,6 +143,7 @@ logging_send_syslog_msg(udev_t)
logging_send_audit_msgs(udev_t)
miscfiles_read_localization(udev_t)
+miscfiles_read_hwdata(udev_t)
modutils_domtrans_insmod(udev_t)
# read modules.inputmap:
@@ -193,6 +197,10 @@ optional_policy(`
alsa_read_rw_config(udev_t)
')
+optional_policy(`
+ bluetooth_domtrans(udev_t)
+')
+
optional_policy(`
brctl_domtrans(udev_t)
')
@@ -205,10 +213,19 @@ optional_policy(`
consoletype_exec(udev_t)
')
+optional_policy(`
+ cups_domtrans_config(udev_t)
+')
+
optional_policy(`
dbus_system_bus_client(udev_t)
')
+optional_policy(`
+ devicekit_read_pid_files(udev_t)
+ devicekit_dgram_send(udev_t)
+')
+
optional_policy(`
lvm_domtrans(udev_t)
')
@@ -227,6 +244,10 @@ optional_policy(`
hotplug_search_pids(udev_t)
')
+optional_policy(`
+ mount_domtrans(udev_t)
+')
+
optional_policy(`
openct_read_pid_files(udev_t)
openct_domtrans(udev_t)
@@ -241,6 +262,14 @@ optional_policy(`
raid_domtrans_mdadm(udev_t)
')
+optional_policy(`
+ unconfined_signal(udev_t)
+')
+
+optional_policy(`
+ vbetool_domtrans(udev_t)
+')
+
optional_policy(`
kernel_write_xen_state(udev_t)
kernel_read_xen_state(udev_t)
From e21162e4711ef28736c4dfcd34c4bc318b097064 Mon Sep 17 00:00:00 2001
From: Chris PeBenito
Date: Wed, 25 Nov 2009 10:04:40 -0500
Subject: [PATCH 24/35] Kdump reads the kernel core.
---
policy/modules/kernel/kernel.if | 1 +
policy/modules/kernel/kernel.te | 2 +-
policy/modules/system/kdump.te | 3 ++-
3 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/policy/modules/kernel/kernel.if b/policy/modules/kernel/kernel.if
index f8fad776..8a970d5f 100644
--- a/policy/modules/kernel/kernel.if
+++ b/policy/modules/kernel/kernel.if
@@ -974,6 +974,7 @@ interface(`kernel_read_core_if',`
attribute can_dump_kernel;
')
+ allow $1 self:capability sys_rawio;
read_files_pattern($1, proc_t, proc_kcore_t)
list_dirs_pattern($1, proc_t, proc_t)
diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te
index 42a4d056..400bee58 100644
--- a/policy/modules/kernel/kernel.te
+++ b/policy/modules/kernel/kernel.te
@@ -1,5 +1,5 @@
-policy_module(kernel, 1.11.1)
+policy_module(kernel, 1.11.2)
########################################
#
diff --git a/policy/modules/system/kdump.te b/policy/modules/system/kdump.te
index a5a75262..fe642788 100644
--- a/policy/modules/system/kdump.te
+++ b/policy/modules/system/kdump.te
@@ -1,5 +1,5 @@
-policy_module(kdump, 1.0.0)
+policy_module(kdump, 1.0.1)
#######################################
#
@@ -29,6 +29,7 @@ files_read_etc_runtime_files(kdump_t)
files_read_kernel_img(kdump_t)
kernel_read_system_state(kdump_t)
+kernel_read_core_if(kdump_t)
dev_read_framebuffer(kdump_t)
dev_read_sysfs(kdump_t)
From 77c71b54e501adc2c20c4eb1822ddea0467d155a Mon Sep 17 00:00:00 2001
From: Chris PeBenito
Date: Wed, 25 Nov 2009 10:27:31 -0500
Subject: [PATCH 25/35] Fstools and Xen patches from Dan Walsh.
---
policy/modules/system/fstools.fc | 1 +
policy/modules/system/fstools.te | 4 +-
policy/modules/system/xen.fc | 6 ++
policy/modules/system/xen.if | 30 ++++++-
policy/modules/system/xen.te | 142 ++++++++++++++++++++++++++-----
5 files changed, 161 insertions(+), 22 deletions(-)
diff --git a/policy/modules/system/fstools.fc b/policy/modules/system/fstools.fc
index 7432278c..cf61a559 100644
--- a/policy/modules/system/fstools.fc
+++ b/policy/modules/system/fstools.fc
@@ -6,6 +6,7 @@
/sbin/dump -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/sbin/dumpe2fs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/sbin/e2fsck -- gen_context(system_u:object_r:fsadm_exec_t,s0)
+/sbin/e4fsck -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/sbin/e2label -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/sbin/fdisk -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/sbin/findfs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
diff --git a/policy/modules/system/fstools.te b/policy/modules/system/fstools.te
index d1ce63c9..1bab1913 100644
--- a/policy/modules/system/fstools.te
+++ b/policy/modules/system/fstools.te
@@ -1,5 +1,5 @@
-policy_module(fstools, 1.13.0)
+policy_module(fstools, 1.13.1)
########################################
#
@@ -144,6 +144,7 @@ logging_send_syslog_msg(fsadm_t)
miscfiles_read_localization(fsadm_t)
modutils_read_module_config(fsadm_t)
+modutils_read_module_deps(fsadm_t)
seutil_read_config(fsadm_t)
@@ -177,4 +178,5 @@ optional_policy(`
optional_policy(`
xen_append_log(fsadm_t)
+ xen_rw_image_files(fsadm_t)
')
diff --git a/policy/modules/system/xen.fc b/policy/modules/system/xen.fc
index 0d60e80e..8c827f8f 100644
--- a/policy/modules/system/xen.fc
+++ b/policy/modules/system/xen.fc
@@ -2,6 +2,8 @@
/usr/bin/virsh -- gen_context(system_u:object_r:xm_exec_t,s0)
+/usr/sbin/evtchnd -- gen_context(system_u:object_r:evtchnd_exec_t,s0)
+
ifdef(`distro_debian',`
/usr/lib/xen-[^/]*/bin/xenconsoled -- gen_context(system_u:object_r:xenconsoled_exec_t,s0)
/usr/lib/xen-[^/]*/bin/xend -- gen_context(system_u:object_r:xend_exec_t,s0)
@@ -19,14 +21,18 @@ ifdef(`distro_debian',`
/var/lib/xend(/.*)? gen_context(system_u:object_r:xend_var_lib_t,s0)
/var/lib/xenstored(/.*)? gen_context(system_u:object_r:xenstored_var_lib_t,s0)
+/var/log/evtchnd\.log -- gen_context(system_u:object_r:evtchnd_var_log_t,s0)
/var/log/xen(/.*)? gen_context(system_u:object_r:xend_var_log_t,s0)
/var/log/xen-hotplug\.log -- gen_context(system_u:object_r:xend_var_log_t,s0)
/var/log/xend\.log -- gen_context(system_u:object_r:xend_var_log_t,s0)
/var/log/xend-debug\.log -- gen_context(system_u:object_r:xend_var_log_t,s0)
+/var/run/evtchnd -s gen_context(system_u:object_r:evtchnd_var_run_t,s0)
+/var/run/evtchnd\.pid -- gen_context(system_u:object_r:evtchnd_var_run_t,s0)
/var/run/xenconsoled\.pid -- gen_context(system_u:object_r:xenconsoled_var_run_t,s0)
/var/run/xend(/.*)? gen_context(system_u:object_r:xend_var_run_t,s0)
/var/run/xend\.pid -- gen_context(system_u:object_r:xend_var_run_t,s0)
+/var/run/xenner(/.*)? gen_context(system_u:object_r:xend_var_run_t,s0)
/var/run/xenstore\.pid -- gen_context(system_u:object_r:xenstored_var_run_t,s0)
/var/run/xenstored(/.*)? gen_context(system_u:object_r:xenstored_var_run_t,s0)
diff --git a/policy/modules/system/xen.if b/policy/modules/system/xen.if
index 0b1878c3..76010795 100644
--- a/policy/modules/system/xen.if
+++ b/policy/modules/system/xen.if
@@ -71,7 +71,30 @@ interface(`xen_read_image_files',`
')
files_list_var_lib($1)
- read_files_pattern($1,{ xend_var_lib_t xen_image_t },xen_image_t)
+
+ list_dirs_pattern($1, xend_var_lib_t, xend_var_lib_t)
+ read_files_pattern($1, { xend_var_lib_t xen_image_t }, xen_image_t)
+')
+
+########################################
+##
+## Allow the specified domain to read/write
+## xend image files.
+##
+##
+##
+## Domain allowed to transition.
+##
+##
+#
+interface(`xen_rw_image_files',`
+ gen_require(`
+ type xen_image_t, xend_var_lib_t;
+ ')
+
+ files_list_var_lib($1)
+ allow $1 xend_var_lib_t:dir search_dir_perms;
+ rw_files_pattern($1, xen_image_t, xen_image_t)
')
########################################
@@ -167,11 +190,14 @@ interface(`xen_stream_connect_xenstore',`
#
interface(`xen_stream_connect',`
gen_require(`
- type xend_t, xend_var_run_t;
+ type xend_t, xend_var_run_t, xend_var_lib_t;
')
files_search_pids($1)
stream_connect_pattern($1, xend_var_run_t, xend_var_run_t, xend_t)
+
+ files_search_var_lib($1)
+ stream_connect_pattern($1, xend_var_lib_t, xend_var_lib_t, xend_t)
')
########################################
diff --git a/policy/modules/system/xen.te b/policy/modules/system/xen.te
index 40410a73..5dc22924 100644
--- a/policy/modules/system/xen.te
+++ b/policy/modules/system/xen.te
@@ -1,11 +1,30 @@
-policy_module(xen, 1.9.0)
+policy_module(xen, 1.9.1)
########################################
#
# Declarations
#
+##
+##
+## Allow xen to manage nfs files
+##
+##
+gen_tunable(xen_use_nfs, false)
+
+type evtchnd_t;
+type evtchnd_exec_t;
+init_daemon_domain(evtchnd_t, evtchnd_exec_t)
+
+# log files
+type evtchnd_var_log_t;
+logging_log_file(evtchnd_var_log_t)
+
+# pid files
+type evtchnd_var_run_t;
+files_pid_file(evtchnd_var_run_t)
+
# console ptys
type xen_devpts_t;
term_pty(xen_devpts_t)
@@ -42,26 +61,30 @@ logging_log_file(xend_var_log_t)
# pid files
type xend_var_run_t;
files_pid_file(xend_var_run_t)
+files_mountpoint(xend_var_run_t)
type xenstored_t;
type xenstored_exec_t;
-domain_type(xenstored_t)
-domain_entry_file(xenstored_t, xenstored_exec_t)
-role system_r types xenstored_t;
+init_daemon_domain(xenstored_t, xenstored_exec_t)
+
+type xenstored_tmp_t;
+files_tmp_file(xenstored_tmp_t)
# var/lib files
type xenstored_var_lib_t;
files_type(xenstored_var_lib_t)
+# log files
+type xenstored_var_log_t;
+logging_log_file(xenstored_var_log_t)
+
# pid files
type xenstored_var_run_t;
files_pid_file(xenstored_var_run_t)
type xenconsoled_t;
type xenconsoled_exec_t;
-domain_type(xenconsoled_t)
-domain_entry_file(xenconsoled_t, xenconsoled_exec_t)
-role system_r types xenconsoled_t;
+init_daemon_domain(xenconsoled_t, xenconsoled_exec_t)
# pid files
type xenconsoled_var_run_t;
@@ -72,6 +95,20 @@ type xm_exec_t;
domain_type(xm_t)
init_system_domain(xm_t, xm_exec_t)
+#######################################
+#
+# evtchnd local policy
+#
+
+manage_dirs_pattern(evtchnd_t, evtchnd_var_log_t, evtchnd_var_log_t)
+manage_files_pattern(evtchnd_t, evtchnd_var_log_t, evtchnd_var_log_t)
+logging_log_filetrans(evtchnd_t, evtchnd_var_log_t, { file dir })
+
+manage_dirs_pattern(evtchnd_t, evtchnd_var_run_t, evtchnd_var_run_t)
+manage_files_pattern(evtchnd_t, evtchnd_var_run_t, evtchnd_var_run_t)
+manage_sock_files_pattern(evtchnd_t, evtchnd_var_run_t, evtchnd_var_run_t)
+files_pid_filetrans(evtchnd_t, evtchnd_var_run_t, { file sock_file dir })
+
########################################
#
# xend local policy
@@ -95,7 +132,7 @@ manage_files_pattern(xend_t, xen_image_t, xen_image_t)
read_lnk_files_pattern(xend_t, xen_image_t, xen_image_t)
rw_blk_files_pattern(xend_t, xen_image_t, xen_image_t)
-allow xend_t xenctl_t:fifo_file manage_file_perms;
+allow xend_t xenctl_t:fifo_file manage_fifo_file_perms;
dev_filetrans(xend_t, xenctl_t, fifo_file)
manage_files_pattern(xend_t, xend_tmp_t, xend_tmp_t)
@@ -103,31 +140,30 @@ manage_dirs_pattern(xend_t, xend_tmp_t, xend_tmp_t)
files_tmp_filetrans(xend_t, xend_tmp_t, { file dir })
# pid file
-allow xend_t xend_var_run_t:dir setattr;
+manage_dirs_pattern(xend_t, xend_var_run_t, xend_var_run_t)
manage_files_pattern(xend_t, xend_var_run_t, xend_var_run_t)
manage_sock_files_pattern(xend_t, xend_var_run_t, xend_var_run_t)
manage_fifo_files_pattern(xend_t, xend_var_run_t, xend_var_run_t)
-files_pid_filetrans(xend_t, xend_var_run_t, { file sock_file fifo_file })
+files_pid_filetrans(xend_t, xend_var_run_t, { file sock_file fifo_file dir })
# log files
-allow xend_t xend_var_log_t:dir setattr;
+manage_dirs_pattern(xend_t, xend_var_log_t, xend_var_log_t)
manage_files_pattern(xend_t, xend_var_log_t, xend_var_log_t)
manage_sock_files_pattern(xend_t, xend_var_log_t, xend_var_log_t)
-logging_log_filetrans(xend_t, xend_var_log_t,{ sock_file file dir })
+logging_log_filetrans(xend_t, xend_var_log_t, { sock_file file dir })
# var/lib files for xend
manage_dirs_pattern(xend_t, xend_var_lib_t, xend_var_lib_t)
manage_files_pattern(xend_t, xend_var_lib_t, xend_var_lib_t)
manage_sock_files_pattern(xend_t, xend_var_lib_t, xend_var_lib_t)
manage_fifo_files_pattern(xend_t, xend_var_lib_t, xend_var_lib_t)
-files_var_lib_filetrans(xend_t, xend_var_lib_t,{ file dir })
+files_var_lib_filetrans(xend_t, xend_var_lib_t, { file dir })
# transition to store
domtrans_pattern(xend_t, xenstored_exec_t, xenstored_t)
# transition to console
-domain_auto_trans(xend_t, xenconsoled_exec_t, xenconsoled_t)
-allow xenconsoled_t xend_t:fd use;
+domtrans_pattern(xend_t, xenconsoled_exec_t, xenconsoled_t)
kernel_read_kernel_sysctls(xend_t)
kernel_read_system_state(xend_t)
@@ -183,6 +219,8 @@ term_use_generic_ptys(xend_t)
term_use_ptmx(xend_t)
term_getattr_pty_fs(xend_t)
+init_stream_connect_script(xend_t)
+
locallogin_dontaudit_use_fds(xend_t)
logging_send_syslog_msg(xend_t)
@@ -207,6 +245,10 @@ xen_stream_connect_xenstore(xend_t)
netutils_domtrans(xend_t)
+optional_policy(`
+ brctl_domtrans(xend_t)
+')
+
optional_policy(`
consoletype_exec(xend_t)
')
@@ -239,6 +281,10 @@ domain_dontaudit_ptrace_all_domains(xenconsoled_t)
files_read_usr_files(xenconsoled_t)
+fs_list_tmpfs(xenconsoled_t)
+fs_manage_xenfs_dirs(xenconsoled_t)
+fs_manage_xenfs_files(xenconsoled_t)
+
term_create_pty(xenconsoled_t, xen_devpts_t)
term_use_generic_ptys(xenconsoled_t)
term_use_console(xenconsoled_t)
@@ -248,7 +294,7 @@ init_use_script_ptys(xenconsoled_t)
miscfiles_read_localization(xenconsoled_t)
-xen_append_log(xenconsoled_t)
+xen_manage_log(xenconsoled_t)
xen_stream_connect_xenstore(xenconsoled_t)
########################################
@@ -256,20 +302,32 @@ xen_stream_connect_xenstore(xenconsoled_t)
# Xen store local policy
#
-allow xenstored_t self:capability { dac_override mknod ipc_lock };
+allow xenstored_t self:capability { dac_override mknod ipc_lock sys_resource };
allow xenstored_t self:unix_stream_socket create_stream_socket_perms;
allow xenstored_t self:unix_dgram_socket create_socket_perms;
+manage_files_pattern(xenstored_t, xenstored_tmp_t, xenstored_tmp_t)
+manage_dirs_pattern(xenstored_t, xenstored_tmp_t, xenstored_tmp_t)
+files_tmp_filetrans(xenstored_t, xenstored_tmp_t, { file dir })
+
# pid file
manage_files_pattern(xenstored_t, xenstored_var_run_t, xenstored_var_run_t)
manage_sock_files_pattern(xenstored_t, xenstored_var_run_t, xenstored_var_run_t)
files_pid_filetrans(xenstored_t, xenstored_var_run_t, { file sock_file })
+# log files
+manage_dirs_pattern(xenstored_t, xenstored_var_log_t, xenstored_var_log_t)
+manage_files_pattern(xenstored_t, xenstored_var_log_t, xenstored_var_log_t)
+manage_sock_files_pattern(xenstored_t, xenstored_var_log_t, xenstored_var_log_t)
+logging_log_filetrans(xenstored_t, xenstored_var_log_t, { sock_file file dir })
+
# var/lib files for xenstored
manage_dirs_pattern(xenstored_t, xenstored_var_lib_t, xenstored_var_lib_t)
manage_files_pattern(xenstored_t, xenstored_var_lib_t, xenstored_var_lib_t)
manage_sock_files_pattern(xenstored_t, xenstored_var_lib_t, xenstored_var_lib_t)
-files_var_lib_filetrans(xenstored_t, xenstored_var_lib_t,{ file dir sock_file })
+files_var_lib_filetrans(xenstored_t, xenstored_var_lib_t, { file dir sock_file })
+
+stream_connect_pattern(xenstored_t, evtchnd_var_run_t, evtchnd_var_run_t, evtchnd_t)
kernel_write_xen_state(xenstored_t)
kernel_read_xen_state(xenstored_t)
@@ -304,6 +362,7 @@ xen_append_log(xenstored_t)
#
allow xm_t self:capability { dac_override ipc_lock sys_tty_config };
+allow xm_t self:process { getsched signal };
# internal communication is often done using fifo and unix sockets.
allow xm_t self:fifo_file rw_fifo_file_perms;
@@ -312,6 +371,7 @@ allow xm_t self:tcp_socket create_stream_socket_perms;
manage_files_pattern(xm_t, xend_var_lib_t, xend_var_lib_t)
manage_fifo_files_pattern(xm_t, xend_var_lib_t, xend_var_lib_t)
+manage_sock_files_pattern(xm_t, xend_var_lib_t, xend_var_lib_t)
files_search_var_lib(xm_t)
allow xm_t xen_image_t:dir rw_dir_perms;
@@ -320,16 +380,19 @@ allow xm_t xen_image_t:blk_file read_blk_file_perms;
kernel_read_system_state(xm_t)
kernel_read_kernel_sysctls(xm_t)
+kernel_read_sysctl(xm_t)
kernel_read_xen_state(xm_t)
kernel_write_xen_state(xm_t)
corecmd_exec_bin(xm_t)
+corecmd_exec_shell(xm_t)
corenet_tcp_sendrecv_generic_if(xm_t)
corenet_tcp_sendrecv_generic_node(xm_t)
corenet_tcp_connect_soundd_port(xm_t)
dev_read_urand(xm_t)
+dev_read_sysfs(xm_t)
files_read_etc_runtime_files(xm_t)
files_read_usr_files(xm_t)
@@ -337,17 +400,58 @@ files_list_mnt(xm_t)
# Some common macros (you might be able to remove some)
files_read_etc_files(xm_t)
+fs_getattr_all_fs(xm_t)
+fs_manage_xenfs_dirs(xm_t)
+fs_manage_xenfs_files(xm_t)
+
storage_raw_read_fixed_disk(xm_t)
term_use_all_terms(xm_t)
+init_stream_connect_script(xm_t)
init_rw_script_stream_sockets(xm_t)
init_use_fds(xm_t)
miscfiles_read_localization(xm_t)
-sysnet_read_config(xm_t)
+sysnet_dns_name_resolve(xm_t)
xen_append_log(xm_t)
xen_stream_connect(xm_t)
xen_stream_connect_xenstore(xm_t)
+
+optional_policy(`
+ virt_manage_images(xm_t)
+ virt_stream_connect(xm_t)
+')
+
+########################################
+#
+# SSH component local policy
+#
+optional_policy(`
+ ssh_basic_client_template(xm, xm_t, system_r)
+
+ kernel_read_xen_state(xm_ssh_t)
+ kernel_write_xen_state(xm_ssh_t)
+
+ fs_manage_xenfs_dirs(xm_ssh_t)
+ fs_manage_xenfs_files(xm_ssh_t)
+
+ #Should have a boolean wrapping these
+ fs_list_auto_mountpoints(xend_t)
+ files_search_mnt(xend_t)
+ fs_getattr_all_fs(xend_t)
+ fs_read_dos_files(xend_t)
+ fs_manage_xenfs_dirs(xend_t)
+ fs_manage_xenfs_files(xend_t)
+
+ tunable_policy(`xen_use_nfs',`
+ fs_manage_nfs_files(xend_t)
+ fs_read_nfs_symlinks(xend_t)
+ ')
+
+ optional_policy(`
+ unconfined_domain(xend_t)
+ ')
+')
From c8d563fcbcf08d906d2be3cbab8e0113f6b5cafb Mon Sep 17 00:00:00 2001
From: Chris PeBenito
Date: Wed, 25 Nov 2009 10:52:16 -0500
Subject: [PATCH 26/35] Permission set updates from Dan Walsh.
---
policy/support/obj_perm_sets.spt | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/policy/support/obj_perm_sets.spt b/policy/support/obj_perm_sets.spt
index e3939d64..caa81213 100644
--- a/policy/support/obj_perm_sets.spt
+++ b/policy/support/obj_perm_sets.spt
@@ -201,7 +201,7 @@ define(`getattr_file_perms',`{ getattr }')
define(`setattr_file_perms',`{ setattr }')
define(`read_file_perms',`{ getattr open read lock ioctl }')
define(`mmap_file_perms',`{ getattr open read execute ioctl }')
-define(`exec_file_perms',`{ getattr open read execute execute_no_trans }')
+define(`exec_file_perms',`{ getattr open read execute ioctl execute_no_trans }')
define(`append_file_perms',`{ getattr open append lock ioctl }')
define(`write_file_perms',`{ getattr open write append lock ioctl }')
define(`rw_file_perms',`{ getattr open read write append ioctl lock }')
@@ -225,7 +225,7 @@ define(`rw_lnk_file_perms',`{ getattr read write lock ioctl }')
define(`create_lnk_file_perms',`{ create getattr }')
define(`rename_lnk_file_perms',`{ getattr rename }')
define(`delete_lnk_file_perms',`{ getattr unlink }')
-define(`manage_lnk_file_perms',`{ create read getattr setattr unlink rename }')
+define(`manage_lnk_file_perms',`{ create read getattr setattr link unlink rename }')
define(`relabelfrom_lnk_file_perms',`{ getattr relabelfrom }')
define(`relabelto_lnk_file_perms',`{ getattr relabelto }')
define(`relabel_lnk_file_perms',`{ getattr relabelfrom relabelto }')
@@ -312,3 +312,8 @@ define(`rw_term_perms', `{ getattr open read write ioctl }')
#
define(`client_stream_socket_perms', `{ create ioctl read getattr write setattr append bind getopt setopt shutdown }')
define(`server_stream_socket_perms', `{ client_stream_socket_perms listen accept }')
+
+#
+# Keys
+#
+define(`manage_key_perms', `{ create link read search setattr view write } ')
From 0cad9a734eba3a9b6f619c0bf909d1b99c7e59dd Mon Sep 17 00:00:00 2001
From: Chris PeBenito
Date: Wed, 25 Nov 2009 11:17:19 -0500
Subject: [PATCH 27/35] RAID patch from Dan Walsh.
---
policy/modules/system/raid.fc | 1 +
policy/modules/system/raid.te | 9 ++++++++-
2 files changed, 9 insertions(+), 1 deletion(-)
diff --git a/policy/modules/system/raid.fc b/policy/modules/system/raid.fc
index 0709927c..ed9c70d4 100644
--- a/policy/modules/system/raid.fc
+++ b/policy/modules/system/raid.fc
@@ -1,3 +1,4 @@
+/dev/.mdadm.map -- gen_context(system_u:object_r:mdadm_map_t,s0)
/sbin/mdadm -- gen_context(system_u:object_r:mdadm_exec_t,s0)
/sbin/mdmpd -- gen_context(system_u:object_r:mdadm_exec_t,s0)
diff --git a/policy/modules/system/raid.te b/policy/modules/system/raid.te
index 9814e675..7b239402 100644
--- a/policy/modules/system/raid.te
+++ b/policy/modules/system/raid.te
@@ -1,5 +1,5 @@
-policy_module(raid, 1.9.0)
+policy_module(raid, 1.9.1)
########################################
#
@@ -11,6 +11,9 @@ type mdadm_exec_t;
init_daemon_domain(mdadm_t, mdadm_exec_t)
role system_r types mdadm_t;
+type mdadm_map_t;
+files_type(mdadm_map_t)
+
type mdadm_var_run_t;
files_pid_file(mdadm_var_run_t)
@@ -24,6 +27,10 @@ dontaudit mdadm_t self:capability sys_tty_config;
allow mdadm_t self:process { sigchld sigkill sigstop signull signal };
allow mdadm_t self:fifo_file rw_fifo_file_perms;
+# create .mdadm files in /dev
+allow mdadm_t mdadm_map_t:file manage_file_perms;
+dev_filetrans(mdadm_t, mdadm_map_t, file)
+
manage_files_pattern(mdadm_t, mdadm_var_run_t, mdadm_var_run_t)
files_pid_filetrans(mdadm_t, mdadm_var_run_t, file)
From d913e793aeb2b07a8c7ff3e04f35930548a732e0 Mon Sep 17 00:00:00 2001
From: Chris PeBenito
Date: Wed, 25 Nov 2009 15:12:52 -0500
Subject: [PATCH 28/35] Kismet and tzdata patches from Dan Walsh.
---
policy/modules/admin/kismet.fc | 2 ++
policy/modules/admin/kismet.te | 10 +++++++++-
policy/modules/admin/tzdata.te | 2 ++
3 files changed, 13 insertions(+), 1 deletion(-)
diff --git a/policy/modules/admin/kismet.fc b/policy/modules/admin/kismet.fc
index d4daa527..dae60e5e 100644
--- a/policy/modules/admin/kismet.fc
+++ b/policy/modules/admin/kismet.fc
@@ -1,3 +1,5 @@
+HOME_DIR/\.kismet(/.*)? gen_context(system_u:object_r:kismet_home_t,s0)
+
/usr/bin/kismet -- gen_context(system_u:object_r:kismet_exec_t,s0)
/var/lib/kismet(/.*)? gen_context(system_u:object_r:kismet_var_lib_t,s0)
/var/log/kismet(/.*)? gen_context(system_u:object_r:kismet_log_t,s0)
diff --git a/policy/modules/admin/kismet.te b/policy/modules/admin/kismet.te
index d39aaada..b645b3c5 100644
--- a/policy/modules/admin/kismet.te
+++ b/policy/modules/admin/kismet.te
@@ -1,5 +1,5 @@
-policy_module(kismet, 1.4.0)
+policy_module(kismet, 1.4.1)
########################################
#
@@ -11,6 +11,9 @@ type kismet_exec_t;
application_domain(kismet_t, kismet_exec_t)
role system_r types kismet_t;
+type kismet_home_t;
+userdom_user_home_content(kismet_home_t)
+
type kismet_log_t;
logging_log_file(kismet_log_t)
@@ -39,6 +42,11 @@ allow kismet_t self:unix_dgram_socket { create_socket_perms sendto };
allow kismet_t self:unix_stream_socket create_stream_socket_perms;
allow kismet_t self:tcp_socket create_stream_socket_perms;
+manage_dirs_pattern(kismet_t, kismet_home_t, kismet_home_t)
+manage_files_pattern(kismet_t, kismet_home_t, kismet_home_t)
+manage_lnk_files_pattern(kismet_t, kismet_home_t, kismet_home_t)
+userdom_user_home_dir_filetrans(kismet_t, kismet_home_t, { file dir })
+
manage_files_pattern(kismet_t, kismet_log_t, kismet_log_t)
allow kismet_t kismet_log_t:dir setattr;
logging_log_filetrans(kismet_t, kismet_log_t, { file dir })
diff --git a/policy/modules/admin/tzdata.te b/policy/modules/admin/tzdata.te
index 5c744965..0e029774 100644
--- a/policy/modules/admin/tzdata.te
+++ b/policy/modules/admin/tzdata.te
@@ -19,6 +19,8 @@ application_domain(tzdata_t, tzdata_exec_t)
files_read_etc_files(tzdata_t)
files_search_spool(tzdata_t)
+fs_getattr_xattr_fs(tzdata_t)
+
term_dontaudit_list_ptys(tzdata_t)
locallogin_dontaudit_use_fds(tzdata_t)
From 7491a9ed62484bc4639168c06c4dfb7838365ad0 Mon Sep 17 00:00:00 2001
From: Chris PeBenito
Date: Tue, 1 Dec 2009 09:23:11 -0500
Subject: [PATCH 29/35] Iptables and modutils patches from Dan Walsh.
---
policy/modules/system/iptables.fc | 18 ++++--
policy/modules/system/iptables.if | 96 +++++++++++++++++++++++++++++++
policy/modules/system/iptables.te | 16 +++++-
policy/modules/system/modutils.fc | 1 +
policy/modules/system/modutils.if | 45 +++++++++++++--
policy/modules/system/modutils.te | 57 ++++++++++++------
6 files changed, 206 insertions(+), 27 deletions(-)
diff --git a/policy/modules/system/iptables.fc b/policy/modules/system/iptables.fc
index ac6c7899..13f62a6e 100644
--- a/policy/modules/system/iptables.fc
+++ b/policy/modules/system/iptables.fc
@@ -1,7 +1,13 @@
-/sbin/ip6tables.* -- gen_context(system_u:object_r:iptables_exec_t,s0)
-/sbin/ipchains.* -- gen_context(system_u:object_r:iptables_exec_t,s0)
-/sbin/iptables.* -- gen_context(system_u:object_r:iptables_exec_t,s0)
+/etc/rc\.d/init\.d/ip6?tables -- gen_context(system_u:object_r:iptables_initrc_exec_t,s0)
+/etc/sysconfig/ip6?tables.* -- gen_context(system_u:object_r:iptables_conf_t,s0)
+/etc/sysconfig/system-config-firewall.* -- gen_context(system_u:object_r:iptables_conf_t,s0)
-/usr/sbin/ip6tables.* -- gen_context(system_u:object_r:iptables_exec_t,s0)
-/usr/sbin/ipchains.* -- gen_context(system_u:object_r:iptables_exec_t,s0)
-/usr/sbin/iptables.* -- gen_context(system_u:object_r:iptables_exec_t,s0)
+/sbin/ipchains.* -- gen_context(system_u:object_r:iptables_exec_t,s0)
+/sbin/ip6?tables -- gen_context(system_u:object_r:iptables_exec_t,s0)
+/sbin/ip6?tables-restore -- gen_context(system_u:object_r:iptables_exec_t,s0)
+/sbin/ip6?tables-multi -- gen_context(system_u:object_r:iptables_exec_t,s0)
+
+/usr/sbin/ipchains.* -- gen_context(system_u:object_r:iptables_exec_t,s0)
+/usr/sbin/iptables -- gen_context(system_u:object_r:iptables_exec_t,s0)
+/usr/sbin/iptables-multi -- gen_context(system_u:object_r:iptables_exec_t,s0)
+/usr/sbin/iptables-restore -- gen_context(system_u:object_r:iptables_exec_t,s0)
diff --git a/policy/modules/system/iptables.if b/policy/modules/system/iptables.if
index 90127837..6aca04d0 100644
--- a/policy/modules/system/iptables.if
+++ b/policy/modules/system/iptables.if
@@ -69,3 +69,99 @@ interface(`iptables_exec',`
corecmd_search_bin($1)
can_exec($1, iptables_exec_t)
')
+
+#####################################
+##
+## Execute iptables in the iptables domain.
+##
+##
+##
+## The type of the process performing this action.
+##
+##
+#
+interface(`iptables_initrc_domtrans',`
+ gen_require(`
+ type iptables_initrc_exec_t;
+ ')
+
+ init_labeled_script_domtrans($1, iptables_initrc_exec_t)
+')
+
+#####################################
+##
+## Set the attributes of iptables config files.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`iptables_setattr_config',`
+ gen_require(`
+ type iptables_conf_t;
+ ')
+
+ files_search_etc($1)
+ allow $1 iptables_conf_t:file setattr;
+')
+
+#####################################
+##
+## Read iptables config files.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`iptables_read_config',`
+ gen_require(`
+ type iptables_conf_t;
+ ')
+
+ files_search_etc($1)
+ allow $1 iptables_conf_t:dir list_dir_perms;
+ read_files_pattern($1, iptables_conf_t, iptables_conf_t)
+')
+
+#####################################
+##
+## Create files in /etc with the type used for
+## the iptables config files.
+##
+##
+##
+## The type of the process performing this action.
+##
+##
+#
+interface(`iptables_etc_filetrans_config',`
+ gen_require(`
+ type iptables_conf_t;
+ ')
+
+ files_etc_filetrans($1, iptables_conf_t, file)
+')
+
+###################################
+##
+## Manage iptables config files.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`iptables_manage_config',`
+ gen_require(`
+ type iptables_conf_t;
+ type etc_t;
+ ')
+
+ files_search_etc($1)
+ manage_files_pattern($1, iptables_conf_t, iptables_conf_t)
+')
diff --git a/policy/modules/system/iptables.te b/policy/modules/system/iptables.te
index 7ad25444..7626034a 100644
--- a/policy/modules/system/iptables.te
+++ b/policy/modules/system/iptables.te
@@ -1,5 +1,5 @@
-policy_module(iptables, 1.10.0)
+policy_module(iptables, 1.10.1)
########################################
#
@@ -11,6 +11,12 @@ type iptables_exec_t;
init_system_domain(iptables_t, iptables_exec_t)
role system_r types iptables_t;
+type iptables_initrc_exec_t;
+init_script_file(iptables_initrc_exec_t)
+
+type iptables_conf_t;
+files_config_file(iptables_conf_t)
+
type iptables_tmp_t;
files_tmp_file(iptables_tmp_t)
@@ -27,6 +33,9 @@ dontaudit iptables_t self:capability sys_tty_config;
allow iptables_t self:process { sigchld sigkill sigstop signull signal };
allow iptables_t self:rawip_socket create_socket_perms;
+manage_files_pattern(iptables_t, iptables_conf_t, iptables_conf_t)
+files_etc_filetrans(iptables_t, iptables_conf_t, file)
+
manage_files_pattern(iptables_t, iptables_var_run_t, iptables_var_run_t)
files_pid_filetrans(iptables_t, iptables_var_run_t, file)
@@ -36,6 +45,7 @@ allow iptables_t iptables_tmp_t:dir manage_dir_perms;
allow iptables_t iptables_tmp_t:file manage_file_perms;
files_tmp_filetrans(iptables_t, iptables_tmp_t, { file dir })
+kernel_request_load_module(iptables_t)
kernel_read_system_state(iptables_t)
kernel_read_network_state(iptables_t)
kernel_read_kernel_sysctls(iptables_t)
@@ -99,6 +109,10 @@ optional_policy(`
ppp_dontaudit_use_fds(iptables_t)
')
+optional_policy(`
+ psad_rw_tmp_files(iptables_t)
+')
+
optional_policy(`
rhgb_dontaudit_use_ptys(iptables_t)
')
diff --git a/policy/modules/system/modutils.fc b/policy/modules/system/modutils.fc
index 688afeb8..532181a5 100644
--- a/policy/modules/system/modutils.fc
+++ b/policy/modules/system/modutils.fc
@@ -1,6 +1,7 @@
/etc/modules\.conf.* -- gen_context(system_u:object_r:modules_conf_t,s0)
/etc/modprobe\.conf.* -- gen_context(system_u:object_r:modules_conf_t,s0)
+/etc/modprobe\.d(/.*)? gen_context(system_u:object_r:modules_conf_t,s0)
ifdef(`distro_gentoo',`
# gentoo init scripts still manage this file
diff --git a/policy/modules/system/modutils.if b/policy/modules/system/modutils.if
index ce4ac17e..e1057e3d 100644
--- a/policy/modules/system/modutils.if
+++ b/policy/modules/system/modutils.if
@@ -1,5 +1,23 @@
## Policy for kernel module utilities
+######################################
+##
+## Getattr the dependencies of kernel modules.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`modutils_getattr_module_deps',`
+ gen_require(`
+ type modules_dep_t;
+ ')
+
+ getattr_files_pattern($1, modules_object_t, modules_dep_t)
+')
+
########################################
##
## Read the dependencies of kernel modules.
@@ -41,8 +59,8 @@ interface(`modutils_read_module_config',`
files_search_etc($1)
files_search_boot($1)
- allow $1 modules_conf_t:file read_file_perms;
- allow $1 modules_conf_t:lnk_file read_lnk_file_perms;
+ read_files_pattern($1, modules_conf_t, modules_conf_t)
+ read_lnk_files_pattern($1, modules_conf_t, modules_conf_t)
')
########################################
@@ -61,7 +79,7 @@ interface(`modutils_rename_module_config',`
type modules_conf_t;
')
- allow $1 modules_conf_t:file rename_file_perms;
+ rename_files_pattern($1, modules_conf_t, modules_conf_t)
')
########################################
@@ -80,7 +98,26 @@ interface(`modutils_delete_module_config',`
type modules_conf_t;
')
- allow $1 modules_conf_t:file unlink;
+ delete_files_pattern($1, modules_conf_t, modules_conf_t)
+')
+
+########################################
+##
+## Manage files with the configuration options used when
+## loading modules.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`modutils_manage_module_config',`
+ gen_require(`
+ type modules_conf_t;
+ ')
+
+ manage_files_pattern($1, modules_conf_t, modules_conf_t)
')
########################################
diff --git a/policy/modules/system/modutils.te b/policy/modules/system/modutils.te
index 87b8b7e1..20f4fa87 100644
--- a/policy/modules/system/modutils.te
+++ b/policy/modules/system/modutils.te
@@ -1,5 +1,5 @@
-policy_module(modutils, 1.9.0)
+policy_module(modutils, 1.9.1)
gen_require(`
bool secure_mode_insmod;
@@ -45,7 +45,7 @@ files_tmp_file(update_modules_tmp_t)
can_exec(depmod_t, depmod_exec_t)
# Read conf.modules.
-allow depmod_t modules_conf_t:file read_file_perms;
+read_files_pattern(depmod_t, modules_conf_t, modules_conf_t)
allow depmod_t modules_dep_t:file manage_file_perms;
files_kernel_modules_filetrans(depmod_t, modules_dep_t, file)
@@ -82,8 +82,22 @@ ifdef(`distro_ubuntu',`
')
')
+tunable_policy(`use_nfs_home_dirs',`
+ fs_read_nfs_files(depmod_t)
+')
+
+tunable_policy(`use_samba_home_dirs',`
+ fs_read_cifs_files(depmod_t)
+')
+
optional_policy(`
rpm_rw_pipes(depmod_t)
+ rpm_manage_script_tmp_files(depmod_t)
+')
+
+optional_policy(`
+ # Read System.map from home directories.
+ unconfined_domain(depmod_t)
')
########################################
@@ -91,19 +105,23 @@ optional_policy(`
# insmod local policy
#
-allow insmod_t self:capability { dac_override net_raw sys_tty_config };
+allow insmod_t self:capability { dac_override net_raw sys_nice sys_tty_config };
allow insmod_t self:process { execmem sigchld sigkill sigstop signull signal };
-allow insmod_t self:udp_socket create_socket_perms;
-allow insmod_t self:rawip_socket create_socket_perms;
+allow insmod_t self:udp_socket create_socket_perms;
+allow insmod_t self:rawip_socket create_socket_perms;
# Read module config and dependency information
-allow insmod_t { modules_conf_t modules_dep_t }:file read_file_perms;
+list_dirs_pattern(insmod_t, modules_conf_t, modules_conf_t)
+read_files_pattern(insmod_t, modules_conf_t, modules_conf_t)
+list_dirs_pattern(insmod_t, modules_dep_t, modules_dep_t)
+read_files_pattern(insmod_t, modules_dep_t, modules_dep_t)
can_exec(insmod_t, insmod_exec_t)
kernel_load_module(insmod_t)
kernel_read_system_state(insmod_t)
+kernel_read_network_state(insmod_t)
kernel_write_proc_files(insmod_t)
kernel_mount_debugfs(insmod_t)
kernel_mount_kvmfs(insmod_t)
@@ -112,6 +130,7 @@ kernel_read_debugfs(insmod_t)
kernel_read_kernel_sysctls(insmod_t)
kernel_rw_kernel_sysctl(insmod_t)
kernel_read_hotplug_sysctls(insmod_t)
+kernel_setsched(insmod_t)
corecmd_exec_bin(insmod_t)
corecmd_exec_shell(insmod_t)
@@ -124,9 +143,6 @@ dev_rw_agp(insmod_t)
dev_read_sound(insmod_t)
dev_write_sound(insmod_t)
dev_rw_apm_bios(insmod_t)
-# cjp: why is this needed? insmod cannot mounton any dir
-# and it also transitions to mount
-dev_mount_usbfs(insmod_t)
domain_signal_all_domains(insmod_t)
domain_use_interactive_fds(insmod_t)
@@ -159,16 +175,25 @@ seutil_read_file_contexts(insmod_t)
userdom_use_user_terminals(insmod_t)
-ifdef(`distro_ubuntu',`
- optional_policy(`
- unconfined_domain(insmod_t)
- ')
-')
+userdom_dontaudit_search_user_home_dirs(insmod_t)
if( ! secure_mode_insmod ) {
kernel_domtrans_to(insmod_t, insmod_exec_t)
}
+optional_policy(`
+ alsa_domtrans(insmod_t)
+')
+
+optional_policy(`
+ firstboot_dontaudit_rw_pipes(insmod_t)
+ firstboot_dontaudit_rw_stream_sockets(insmod_t)
+')
+
+optional_policy(`
+ hal_write_log(insmod_t)
+')
+
optional_policy(`
hotplug_search_config(insmod_t)
')
@@ -205,7 +230,7 @@ optional_policy(`
')
optional_policy(`
- unconfined_dontaudit_rw_pipes(insmod_t)
+ unconfined_domain(insmod_t)
')
optional_policy(`
@@ -228,7 +253,7 @@ can_exec(update_modules_t, insmod_exec_t)
can_exec(update_modules_t, update_modules_exec_t)
# manage module loading configuration
-allow update_modules_t modules_conf_t:file manage_file_perms;
+manage_files_pattern(update_modules_t, modules_conf_t, modules_conf_t)
files_kernel_modules_filetrans(update_modules_t, modules_conf_t, file)
files_etc_filetrans(update_modules_t, modules_conf_t, file)
From 962d6fb9b0128bb86c42cb80f9a07121fbf1577c Mon Sep 17 00:00:00 2001
From: Chris PeBenito
Date: Tue, 1 Dec 2009 10:29:51 -0500
Subject: [PATCH 30/35] Calamaris patch from Dan Walsh.
---
policy/modules/apps/calamaris.te | 10 +++-------
1 file changed, 3 insertions(+), 7 deletions(-)
diff --git a/policy/modules/apps/calamaris.te b/policy/modules/apps/calamaris.te
index 31d2978b..01c19b78 100644
--- a/policy/modules/apps/calamaris.te
+++ b/policy/modules/apps/calamaris.te
@@ -1,5 +1,5 @@
-policy_module(calamaris, 1.5.0)
+policy_module(calamaris, 1.5.1)
########################################
#
@@ -59,12 +59,12 @@ files_read_etc_runtime_files(calamaris_t)
libs_read_lib_files(calamaris_t)
+auth_use_nsswitch(calamaris_t)
+
logging_send_syslog_msg(calamaris_t)
miscfiles_read_localization(calamaris_t)
-sysnet_read_config(calamaris_t)
-
userdom_dontaudit_list_user_home_dirs(calamaris_t)
squid_read_log(calamaris_t)
@@ -80,7 +80,3 @@ optional_policy(`
optional_policy(`
mta_send_mail(calamaris_t)
')
-
-optional_policy(`
- nis_use_ypbind(calamaris_t)
-')
From 36ded4bd3696192a1d1b5b0b64be289d8669af09 Mon Sep 17 00:00:00 2001
From: Chris PeBenito
Date: Tue, 1 Dec 2009 10:30:07 -0500
Subject: [PATCH 31/35] GPG patch from Dan Walsh.
---
policy/modules/apps/gpg.te | 45 +++++++++++++++++++++++++-------------
1 file changed, 30 insertions(+), 15 deletions(-)
diff --git a/policy/modules/apps/gpg.te b/policy/modules/apps/gpg.te
index 5e664500..b8c96f64 100644
--- a/policy/modules/apps/gpg.te
+++ b/policy/modules/apps/gpg.te
@@ -1,5 +1,5 @@
-policy_module(gpg, 2.2.0)
+policy_module(gpg, 2.2.1)
########################################
#
@@ -104,11 +104,36 @@ files_dontaudit_search_var(gpg_t)
auth_use_nsswitch(gpg_t)
-miscfiles_read_localization(gpg_t)
-
logging_send_syslog_msg(gpg_t)
+miscfiles_read_localization(gpg_t)
+
userdom_use_user_terminals(gpg_t)
+# sign/encrypt user files
+userdom_manage_user_tmp_files(gpg_t)
+userdom_manage_user_home_content_files(gpg_t)
+
+mta_write_config(gpg_t)
+
+tunable_policy(`use_nfs_home_dirs',`
+ fs_manage_nfs_dirs(gpg_t)
+ fs_manage_nfs_files(gpg_t)
+')
+
+tunable_policy(`use_samba_home_dirs',`
+ fs_manage_cifs_dirs(gpg_t)
+ fs_manage_cifs_files(gpg_t)
+')
+
+optional_policy(`
+ xserver_use_xdm_fds(gpg_t)
+ xserver_rw_xdm_pipes(gpg_t)
+')
+
+optional_policy(`
+ cron_system_entry(gpg_t, gpg_exec_t)
+ cron_read_system_job_tmp_files(gpg_t)
+')
########################################
#
@@ -146,23 +171,13 @@ files_read_etc_files(gpg_helper_t)
auth_use_nsswitch(gpg_helper_t)
userdom_use_user_terminals(gpg_helper_t)
-# sign/encrypt user files
-userdom_manage_user_tmp_files(gpg_t)
-userdom_manage_user_home_content_files(gpg_t)
tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(gpg_t)
- fs_manage_nfs_files(gpg_t)
+ fs_dontaudit_rw_nfs_files(gpg_helper_t)
')
tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(gpg_t)
- fs_manage_cifs_files(gpg_t)
-')
-
-optional_policy(`
- xserver_use_xdm_fds(gpg_t)
- xserver_rw_xdm_pipes(gpg_t)
+ fs_dontaudit_rw_cifs_files(gpg_helper_t)
')
########################################
From b77daab0edf3104515f44d450fa7ef399d569b02 Mon Sep 17 00:00:00 2001
From: Chris PeBenito
Date: Tue, 1 Dec 2009 10:30:30 -0500
Subject: [PATCH 32/35] Mozilla patch from Dan Walsh.
---
policy/modules/apps/mozilla.if | 44 ++++++++++++++++++++++++++++++++++
policy/modules/apps/mozilla.te | 12 ++++++++--
2 files changed, 54 insertions(+), 2 deletions(-)
diff --git a/policy/modules/apps/mozilla.if b/policy/modules/apps/mozilla.if
index 53c0e820..61ac7206 100644
--- a/policy/modules/apps/mozilla.if
+++ b/policy/modules/apps/mozilla.if
@@ -45,6 +45,12 @@ interface(`mozilla_role',`
relabel_dirs_pattern($2, mozilla_home_t, mozilla_home_t)
relabel_files_pattern($2, mozilla_home_t, mozilla_home_t)
relabel_lnk_files_pattern($2, mozilla_home_t, mozilla_home_t)
+
+ mozilla_dbus_chat($2)
+
+ optional_policy(`
+ pulseaudio_role($1, mozilla_t)
+ ')
')
########################################
@@ -64,6 +70,7 @@ interface(`mozilla_read_user_home_files',`
allow $1 mozilla_home_t:dir list_dir_perms;
allow $1 mozilla_home_t:file read_file_perms;
+ allow $1 mozilla_home_t:lnk_file read_lnk_file_perms;
userdom_search_user_home_dirs($1)
')
@@ -86,6 +93,43 @@ interface(`mozilla_write_user_home_files',`
userdom_search_user_home_dirs($1)
')
+########################################
+##
+## Dontaudit attempts to read/write mozilla home directory content
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`mozilla_dontaudit_rw_user_home_files',`
+ gen_require(`
+ type mozilla_home_t;
+ ')
+
+ dontaudit $1 mozilla_home_t:file rw_file_perms;
+')
+
+########################################
+##
+## Dontaudit attempts to write mozilla home directory content
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`mozilla_dontaudit_manage_user_home_files',`
+ gen_require(`
+ type mozilla_home_t;
+ ')
+
+ dontaudit $1 mozilla_home_t:dir manage_dir_perms;
+ dontaudit $1 mozilla_home_t:file manage_file_perms;
+')
+
########################################
##
## Run mozilla in the mozilla domain.
diff --git a/policy/modules/apps/mozilla.te b/policy/modules/apps/mozilla.te
index 7957bc93..e7428a1c 100644
--- a/policy/modules/apps/mozilla.te
+++ b/policy/modules/apps/mozilla.te
@@ -1,5 +1,5 @@
-policy_module(mozilla, 2.1.0)
+policy_module(mozilla, 2.1.1)
########################################
#
@@ -59,6 +59,7 @@ manage_dirs_pattern(mozilla_t, mozilla_home_t, mozilla_home_t)
manage_files_pattern(mozilla_t, mozilla_home_t, mozilla_home_t)
manage_lnk_files_pattern(mozilla_t, mozilla_home_t, mozilla_home_t)
userdom_search_user_home_dirs(mozilla_t)
+userdom_user_home_dir_filetrans(mozilla_t, mozilla_home_t, dir)
# Mozpluggerrc
allow mozilla_t mozilla_conf_t:file read_file_perms;
@@ -75,7 +76,7 @@ kernel_read_network_state(mozilla_t)
kernel_read_system_state(mozilla_t)
kernel_read_net_sysctls(mozilla_t)
-# Look for plugins
+# Look for plugins
corecmd_list_bin(mozilla_t)
# for bash - old mozilla binary
corecmd_exec_shell(mozilla_t)
@@ -97,6 +98,7 @@ corenet_tcp_connect_http_cache_port(mozilla_t)
corenet_tcp_connect_ftp_port(mozilla_t)
corenet_tcp_connect_ipp_port(mozilla_t)
corenet_tcp_connect_generic_port(mozilla_t)
+corenet_tcp_connect_soundd_port(mozilla_t)
corenet_sendrecv_http_client_packets(mozilla_t)
corenet_sendrecv_http_cache_client_packets(mozilla_t)
corenet_sendrecv_ftp_client_packets(mozilla_t)
@@ -114,6 +116,8 @@ dev_read_sound(mozilla_t)
dev_dontaudit_rw_dri(mozilla_t)
dev_getattr_sysfs_dirs(mozilla_t)
+domain_dontaudit_read_all_domains_state(mozilla_t)
+
files_read_etc_runtime_files(mozilla_t)
files_read_usr_files(mozilla_t)
files_read_etc_files(mozilla_t)
@@ -231,6 +235,10 @@ optional_policy(`
optional_policy(`
dbus_system_bus_client(mozilla_t)
dbus_session_bus_client(mozilla_t)
+
+ optional_policy(`
+ networkmanager_dbus_chat(mozilla_t)
+ ')
')
optional_policy(`
From 6394ea61434fd5f22233e44edbc7c4a98cba84e4 Mon Sep 17 00:00:00 2001
From: Chris PeBenito
Date: Tue, 1 Dec 2009 10:30:50 -0500
Subject: [PATCH 33/35] Podsleuth patch from Dan Walsh.
---
policy/modules/apps/podsleuth.te | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/policy/modules/apps/podsleuth.te b/policy/modules/apps/podsleuth.te
index ba4de0ce..04db46b5 100644
--- a/policy/modules/apps/podsleuth.te
+++ b/policy/modules/apps/podsleuth.te
@@ -1,5 +1,5 @@
-policy_module(podsleuth, 1.2.0)
+policy_module(podsleuth, 1.2.1)
########################################
#
@@ -71,6 +71,8 @@ miscfiles_read_localization(podsleuth_t)
sysnet_dns_name_resolve(podsleuth_t)
+userdom_signal_unpriv_users(podsleuth_t)
+
optional_policy(`
dbus_system_bus_client(podsleuth_t)
From d7776f58c2fab79e2e30d4a03239f77a3a8afdac Mon Sep 17 00:00:00 2001
From: Chris PeBenito
Date: Tue, 1 Dec 2009 10:31:17 -0500
Subject: [PATCH 34/35] Screen patch from Dan Walsh.
---
policy/modules/apps/screen.if | 5 +++++
policy/modules/apps/screen.te | 2 +-
2 files changed, 6 insertions(+), 1 deletion(-)
diff --git a/policy/modules/apps/screen.if b/policy/modules/apps/screen.if
index d14975ba..3a5e0ea5 100644
--- a/policy/modules/apps/screen.if
+++ b/policy/modules/apps/screen.if
@@ -80,6 +80,11 @@ template(`screen_role_template',`
relabel_files_pattern($3, screen_home_t, screen_home_t)
relabel_lnk_files_pattern($3, screen_home_t, screen_home_t)
+ manage_dirs_pattern($3, screen_var_run_t, screen_var_run_t)
+ manage_files_pattern($3, screen_var_run_t, screen_var_run_t)
+ manage_lnk_files_pattern($3, screen_var_run_t, screen_var_run_t)
+ manage_fifo_files_pattern($3, screen_var_run_t, screen_var_run_t)
+
kernel_read_system_state($1_screen_t)
kernel_read_kernel_sysctls($1_screen_t)
diff --git a/policy/modules/apps/screen.te b/policy/modules/apps/screen.te
index e5bb2476..3a80da11 100644
--- a/policy/modules/apps/screen.te
+++ b/policy/modules/apps/screen.te
@@ -1,5 +1,5 @@
-policy_module(screen, 2.2.0)
+policy_module(screen, 2.2.1)
########################################
#
From 46b03739acbb8595a579780956fccf8614a6cccc Mon Sep 17 00:00:00 2001
From: Chris PeBenito
Date: Tue, 1 Dec 2009 10:31:28 -0500
Subject: [PATCH 35/35] Seunshare patch from Dan Walsh.
---
policy/modules/apps/seunshare.if | 8 ++++++++
policy/modules/apps/seunshare.te | 14 ++++++++++++--
2 files changed, 20 insertions(+), 2 deletions(-)
diff --git a/policy/modules/apps/seunshare.if b/policy/modules/apps/seunshare.if
index dbdf4485..7f47897b 100644
--- a/policy/modules/apps/seunshare.if
+++ b/policy/modules/apps/seunshare.if
@@ -41,6 +41,14 @@ interface(`seunshare_run',`
seunshare_domtrans($1)
role $2 types seunshare_t;
+
+ allow $1 seunshare_t:process signal_perms;
+
+ ifdef(`hide_broken_symptoms', `
+ dontaudit seunshare_t $1:tcp_socket rw_socket_perms;
+ dontaudit seunshare_t $1:udp_socket rw_socket_perms;
+ dontaudit seunshare_t $1:unix_stream_socket rw_socket_perms;
+ ')
')
########################################
diff --git a/policy/modules/apps/seunshare.te b/policy/modules/apps/seunshare.te
index dcec4bf1..5e810f26 100644
--- a/policy/modules/apps/seunshare.te
+++ b/policy/modules/apps/seunshare.te
@@ -1,5 +1,5 @@
-policy_module(seunshare, 1.0.0)
+policy_module(seunshare, 1.0.1)
########################################
#
@@ -16,7 +16,7 @@ role system_r types seunshare_t;
# seunshare local policy
#
-allow seunshare_t self:capability setpcap;
+allow seunshare_t self:capability { setuid dac_override setpcap sys_admin };
allow seunshare_t self:process { setexec signal getcap setcap };
allow seunshare_t self:fifo_file rw_file_perms;
@@ -30,6 +30,16 @@ files_mounton_all_poly_members(seunshare_t)
auth_use_nsswitch(seunshare_t)
+logging_send_syslog_msg(seunshare_t)
+
miscfiles_read_localization(seunshare_t)
userdom_use_user_terminals(seunshare_t)
+
+ifdef(`hide_broken_symptoms', `
+ fs_dontaudit_rw_anon_inodefs_files(seunshare_t)
+
+ optional_policy(`
+ mozilla_dontaudit_manage_user_home_files(seunshare_t)
+ ')
+')