make corenetwork generation explicit, rather then on-the-fly
This commit is contained in:
Chris PeBenito
parent
7edd02d4f1
commit
f2e4ab3a99
@ -129,6 +129,8 @@ DISABLEMOD := $(foreach mod,$(shell egrep -v '^[[:blank:]]*\#' $(MOD_DISABLE)),$
|
||||
DETECTED_DIRS := $(shell find $(wildcard policy/modules/*) -maxdepth 0 -type d)
|
||||
ALL_LAYERS := $(filter-out CVS,$(DETECTED_DIRS))
|
||||
DETECTED_MODS := $(foreach dir,$(ALL_LAYERS),$(wildcard ./$(dir)/*.te))
|
||||
GENERATED_MOD := $(basename $(foreach dir,$(ALL_LAYERS),$(wildcard ./$(dir)/*.te.in)))
|
||||
DETECTED_MODS += $(GENERATED_MOD)
|
||||
ALL_MODULES := $(filter-out $(DISABLEMOD),$(DETECTED_MODS))
|
||||
|
||||
PRE_TE_FILES := $(addprefix $(FLASKDIR)/,security_classes initial_sids access_vectors) $(M4SUPPORT) $(POLDIR)/mls
|
||||
@ -226,9 +228,6 @@ tmp/generated_definitions.conf: $(ALL_LAYERS) $(ALL_TE_FILES) $(BASE_MODULE)/cor
|
||||
$(QUIET) for i in $(notdir $(ALL_MODULES)); do \
|
||||
echo "define(\`$$i')" >> $@ ;\
|
||||
done
|
||||
$(QUIET) egrep "^network_(interface|node|port)\(.*\)" $(BASE_MODULE)/corenetwork.te \
|
||||
| m4 $(M4PARAM) -D monolithic_policy -D interface_pass $(M4SUPPORT) $(BASE_MODULE)/corenetwork.if - \
|
||||
| sed -e 's/dollarsone/\$$1/g' -e 's/dollarszero/\$$0/g' >> $@
|
||||
$(QUIET) $(SETTUN) $(TUNABLES) >> $@
|
||||
|
||||
tmp/all_interfaces.conf: $(ALL_INTERFACES)
|
||||
@ -257,6 +256,17 @@ tmp/all_attrs_types.conf tmp/only_te_rules.conf tmp/all_post.conf: tmp/all_te_fi
|
||||
-e '/^sid /d' -e '/^fs_use_(xattr|task|trans)/d' \
|
||||
< tmp/all_te_files.conf > tmp/only_te_rules.conf
|
||||
|
||||
$(MODDIR)/kernel/corenetwork.if: $(MODDIR)/kernel/corenetwork.if.m4 $(MODDIR)/kernel/corenetwork.if.in
|
||||
$(QUIET) cat $(MODDIR)/kernel/corenetwork.if.in > $@
|
||||
$(QUIET) egrep "^[[:blank:]]*network_(interface|node|port)\(.*\)" $(@:.if=.te).in \
|
||||
| m4 $(M4PARAM) -D monolithic_policy $(M4SUPPORT) $(MODDIR)/kernel/corenetwork.if.m4 - \
|
||||
| sed -e 's/dollarsone/\$$1/g' -e 's/dollarszero/\$$0/g' >> $@
|
||||
$(QUIET) echo "## </module>" >> $@
|
||||
|
||||
$(MODDIR)/kernel/corenetwork.te: $(MODDIR)/kernel/corenetwork.te.m4 $(MODDIR)/kernel/corenetwork.te.in
|
||||
$(QUIET) m4 $(M4PARAM) -D monolithic_policy $(M4SUPPORT) $^ \
|
||||
| sed -e 's/dollarsone/\$$1/g' -e 's/dollarszero/\$$0/g' >> $@
|
||||
|
||||
########################################
|
||||
#
|
||||
# Remove the dontaudit rules from the policy.conf
|
||||
|
||||
@ -1,7 +1,6 @@
|
||||
## <module name="corenetwork" layer="kernel">
|
||||
## <summary>Policy controlling access to network objects</summary>
|
||||
|
||||
ifdef(`interface_pass',`',`
|
||||
########################################
|
||||
## <interface name="corenet_tcp_sendrecv_generic_if">
|
||||
## <description>
|
||||
@ -868,571 +867,3 @@ define(`corenet_dontaudit_udp_bind_all_reserved_ports_depend',`
|
||||
|
||||
class udp_socket name_bind;
|
||||
')
|
||||
|
||||
') dnl end if not interface_pass
|
||||
########################################
|
||||
#
|
||||
# This section is processed through m4 to create real interfaces
|
||||
#
|
||||
########################################
|
||||
|
||||
########################################
|
||||
#
|
||||
# Network Interface generated macros
|
||||
#
|
||||
########################################
|
||||
|
||||
define(`create_netif_interfaces',``
|
||||
########################################
|
||||
## <interface name="corenet_tcp_sendrecv_$1">
|
||||
## <description>
|
||||
## Send and receive TCP network traffic on the $1 interface.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="both" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenet_tcp_sendrecv_$1',`
|
||||
requires_block_template(`dollarszero'_depend)
|
||||
|
||||
allow dollarsone $1_netif_t:netif { tcp_send tcp_recv };
|
||||
')
|
||||
|
||||
define(`corenet_tcp_sendrecv_$1_depend',`
|
||||
type $1_netif_t;
|
||||
|
||||
class netif { tcp_send tcp_recv };
|
||||
')
|
||||
|
||||
########################################
|
||||
## <interface name="corenet_udp_send_$1">
|
||||
## <description>
|
||||
## Send UDP network traffic on the $1 interface.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="write" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenet_udp_send_$1',`
|
||||
requires_block_template(`dollarszero'_depend)
|
||||
|
||||
allow dollarsone $1_netif_t:netif udp_send;
|
||||
')
|
||||
|
||||
define(`corenet_udp_send_$1_depend',`
|
||||
type $1_netif_t;
|
||||
|
||||
class netif udp_send;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <interface name="corenet_udp_receive_$1">
|
||||
## <description>
|
||||
## Receive UDP network traffic on the $1 interface.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="read" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenet_udp_receive_$1',`
|
||||
requires_block_template(`dollarszero'_depend)
|
||||
|
||||
allow dollarsone $1_netif_t:netif udp_recv;
|
||||
')
|
||||
|
||||
define(`corenet_udp_receive_$1_depend',`
|
||||
type $1_netif_t;
|
||||
|
||||
class netif udp_recv;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <interface name="corenetwork_sendrecv_udp_on_$1_interface">
|
||||
## <description>
|
||||
## Send and receive UDP network traffic on the $1 interface.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="both" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenet_udp_sendrecv_$1',`
|
||||
corenet_udp_send_$1(dollarsone)
|
||||
corenet_udp_receive_$1(dollarsone)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <interface name="corenet_raw_send_$1">
|
||||
## <description>
|
||||
## Send raw IP packets on the $1 interface.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="write" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenet_raw_send_$1',`
|
||||
requires_block_template(`dollarszero'_depend)
|
||||
|
||||
allow dollarsone $1_netif_t:netif rawip_send;
|
||||
allow dollarsone self:capability net_raw;
|
||||
')
|
||||
|
||||
define(`corenet_raw_send_$1_depend',`
|
||||
type $1_netif_t;
|
||||
|
||||
class netif rawip_send;
|
||||
class capability net_raw;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <interface name="corenet_raw_receive_$1">
|
||||
## <description>
|
||||
## Receive raw IP packets on the $1 interface.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="read" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenet_raw_receive_$1',`
|
||||
requires_block_template(`dollarszero'_depend)
|
||||
|
||||
allow dollarsone $1_netif_t:netif rawip_recv;
|
||||
')
|
||||
|
||||
define(`corenet_raw_receive_$1_depend',`
|
||||
type $1_netif_t;
|
||||
|
||||
class netif rawip_recv;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <interface name="corenet_raw_sendrecv_$1">
|
||||
## <description>
|
||||
## Send and receive raw IP packets on the $1 interface.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="both" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenet_raw_sendrecv_$1',`
|
||||
corenet_raw_send_$1(dollarsone)
|
||||
corenet_raw_receive_$1(dollarsone)
|
||||
')
|
||||
'') dnl end create_netif_interfaces
|
||||
|
||||
########################################
|
||||
#
|
||||
# Network node generated macros
|
||||
#
|
||||
########################################
|
||||
|
||||
define(`create_node_interfaces',``
|
||||
########################################
|
||||
## <interface name="corenet_tcp_sendrecv_$1_node">
|
||||
## <description>
|
||||
## Send and receive TCP traffic on the $1 node.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="both" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenet_tcp_sendrecv_$1_node',`
|
||||
requires_block_template(`dollarszero'_depend)
|
||||
|
||||
allow dollarsone $1_node_t:node { tcp_send tcp_recv };
|
||||
')
|
||||
|
||||
define(`corenet_tcp_sendrecv_$1_node_depend',`
|
||||
type $1_node_t;
|
||||
|
||||
class node { tcp_send tcp_recv };
|
||||
')
|
||||
|
||||
########################################
|
||||
## <interface name="corenet_udp_send_$1_node">
|
||||
## <description>
|
||||
## Send UDP traffic on the $1 node.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="write" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenet_udp_send_$1_node',`
|
||||
requires_block_template(`dollarszero'_depend)
|
||||
|
||||
allow dollarsone $1_node_t:node udp_send;
|
||||
')
|
||||
|
||||
define(`corenet_udp_send_$1_node_depend',`
|
||||
type $1_node_t;
|
||||
|
||||
class node udp_send;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <interface name="corenet_udp_receive_$1_node">
|
||||
## <description>
|
||||
## Receive UDP traffic on the $1 node.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="read" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenet_udp_receive_$1_node',`
|
||||
requires_block_template(`dollarszero'_depend)
|
||||
|
||||
allow dollarsone $1_node_t:node udp_recv;
|
||||
')
|
||||
|
||||
define(`corenet_udp_receive_$1_node_depend',`
|
||||
type $1_node_t;
|
||||
|
||||
class node udp_recv;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <interface name="corenet_udp_sendrecv_$1_node">
|
||||
## <description>
|
||||
## Send and receive UDP traffic on the $1 node.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="both" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenet_udp_sendrecv_$1_node',`
|
||||
corenet_udp_send_$1_node(dollarsone)
|
||||
corenet_udp_receive_$1_node(dollarsone)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <interface name="corenet_raw_send_$1_node">
|
||||
## <description>
|
||||
## Send raw IP packets on the $1 node.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="write" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenet_raw_send_$1_node',`
|
||||
requires_block_template(`dollarszero'_depend)
|
||||
|
||||
allow dollarsone $1_node_t:node rawip_send;
|
||||
allow dollarsone self:capability net_raw;
|
||||
')
|
||||
|
||||
define(`corenet_raw_send_$1_node_depend',`
|
||||
type $1_node_t;
|
||||
|
||||
class node rawip_send;
|
||||
class capability net_raw;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <interface name="corenet_raw_receive_$1_node">
|
||||
## <description>
|
||||
## Receive raw IP packets on the $1 node.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="write" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenet_raw_receive_$1_node',`
|
||||
requires_block_template(`dollarszero'_depend)
|
||||
|
||||
allow dollarsone $1_node_t:node rawip_recv;
|
||||
')
|
||||
|
||||
define(`corenet_raw_receive_$1_node_depend',`
|
||||
type $1_node_t;
|
||||
|
||||
class node rawip_recv;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <interface name="corenet_raw_sendrecv_$1_node">
|
||||
## <description>
|
||||
## Send and receive raw IP packets on the $1 node.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="both" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenet_raw_sendrecv_$1_node',`
|
||||
corenet_raw_send_$1_node(dollarsone)
|
||||
corenet_raw_receive_$1_node(dollarsone)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <interface name="corenet_tcp_bind_$1_node">
|
||||
## <description>
|
||||
## Bind TCP sockets to node $1.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="none"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenet_tcp_bind_$1_node',`
|
||||
requires_block_template(`dollarszero'_depend)
|
||||
|
||||
allow dollarsone $1_node_t:tcp_socket node_bind;
|
||||
')
|
||||
|
||||
define(`corenet_tcp_bind_$1_node_depend',`
|
||||
type $1_node_t;
|
||||
|
||||
class tcp_socket node_bind;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <interface name="corenet_udp_bind_$1_node">
|
||||
## <description>
|
||||
## Bind UDP sockets to the $1 node.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="none"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenet_udp_bind_$1_node',`
|
||||
requires_block_template(`dollarszero'_depend)
|
||||
|
||||
allow dollarsone $1_node_t:udp_socket node_bind;
|
||||
')
|
||||
|
||||
define(`corenet_udp_bind_$1_node_depend',`
|
||||
type $1_node_t;
|
||||
|
||||
class udp_socket node_bind;
|
||||
')
|
||||
'') dnl end create_node_interfaces
|
||||
|
||||
########################################
|
||||
#
|
||||
# Network port generated macros
|
||||
#
|
||||
########################################
|
||||
|
||||
define(`create_port_interfaces',``
|
||||
########################################
|
||||
## <interface name="corenet_tcp_sendrecv_$1_port">
|
||||
## <description>
|
||||
## Send and receive TCP traffic on the $1 port.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="both" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenet_tcp_sendrecv_$1_port',`
|
||||
requires_block_template(`dollarszero'_depend)
|
||||
|
||||
allow dollarsone $1_port_t:tcp_socket { send_msg recv_msg };
|
||||
')
|
||||
|
||||
define(`corenet_tcp_sendrecv_$1_port_depend',`
|
||||
type $1_port_t;
|
||||
|
||||
class tcp_socket { send_msg recv_msg };
|
||||
')
|
||||
|
||||
########################################
|
||||
## <interface name="corenet_udp_send_$1_port">
|
||||
## <description>
|
||||
## Send UDP traffic on the $1 port.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="write" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenet_udp_send_$1_port',`
|
||||
requires_block_template(`dollarszero'_depend)
|
||||
|
||||
allow dollarsone $1_port_t:udp_socket send_msg;
|
||||
')
|
||||
|
||||
define(`corenet_udp_send_$1_port_depend',`
|
||||
type $1_port_t;
|
||||
|
||||
class udp_socket send_msg;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <interface name="corenet_udp_receive_$1_port">
|
||||
## <description>
|
||||
## Receive UDP traffic on the $1 port.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="read" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenet_udp_receive_$1_port',`
|
||||
requires_block_template(`dollarszero'_depend)
|
||||
|
||||
allow dollarsone $1_port_t:udp_socket recv_msg;
|
||||
')
|
||||
|
||||
define(`corenet_udp_receive_$1_port_depend',`
|
||||
type $1_port_t;
|
||||
|
||||
class udp_socket recv_msg;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <interface name="corenetwork_sendrecv_udp_on_$1_port">
|
||||
## <description>
|
||||
## Send and receive UDP traffic on the $1 port.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="both" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenet_udp_sendrecv_$1_port',`
|
||||
corenet_udp_send_$1_port(dollarsone)
|
||||
corenet_udp_receive_$1_port(dollarsone)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <interface name="corenet_tcp_bind_$1_port">
|
||||
## <description>
|
||||
## Bind TCP sockets to the $1 port.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="none"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenet_tcp_bind_$1_port',`
|
||||
requires_block_template(`dollarszero'_depend)
|
||||
allow dollarsone $1_port_t:tcp_socket name_bind;
|
||||
$2
|
||||
')
|
||||
|
||||
define(`corenet_tcp_bind_$1_port_depend',`
|
||||
type $1_port_t;
|
||||
|
||||
class tcp_socket name_bind;
|
||||
$3
|
||||
')
|
||||
|
||||
########################################
|
||||
## <interface name="corenet_udp_bind_$1_port">
|
||||
## <description>
|
||||
## Bind UDP sockets to the $1 port.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="none"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenet_udp_bind_$1_port',`
|
||||
requires_block_template(`dollarszero'_depend)
|
||||
|
||||
allow dollarsone $1_port_t:udp_socket name_bind;
|
||||
$2
|
||||
')
|
||||
|
||||
define(`corenet_udp_bind_$1_port_depend',`
|
||||
type $1_port_t;
|
||||
|
||||
class udp_socket name_bind;
|
||||
$3
|
||||
')
|
||||
'') dnl end create_port_interfaces
|
||||
|
||||
#
|
||||
# network_interface(linux_interfacename,mls_sensitivity)
|
||||
#
|
||||
define(`network_interface',`
|
||||
ifdef(`interface_pass',`
|
||||
create_netif_interfaces($1)
|
||||
',`
|
||||
type $1_netif_t alias netif_$1_t, netif_type;
|
||||
requires_block_template(`type unlabeled_t')
|
||||
netifcon $1 context_template(system_u:object_r:$1_netif_t,$2) context_template(system_u:object_r:unlabeled_t,$2)
|
||||
')
|
||||
')
|
||||
|
||||
#
|
||||
# network_node(node_name,mls_sensitivity,address,netmask)
|
||||
#
|
||||
define(`network_node',`
|
||||
ifdef(`interface_pass',`
|
||||
create_node_interfaces($1)
|
||||
',`
|
||||
type $1_node_t alias node_$1_t, node_type;
|
||||
nodecon $3 $4 context_template(system_u:object_r:$1_node_t,$2)
|
||||
')
|
||||
')
|
||||
|
||||
define(`determine_reserved_capability',`dnl
|
||||
ifelse(eval($2 < 1024),1,``allow' dollarsone self:capability net_bind_service;',`dnl
|
||||
ifelse($4,`',`',`determine_reserved_capability(shiftn(3,$*))')dnl end inner ifelse
|
||||
')dnl end outer ifelse
|
||||
') dnl end determine reserved capability
|
||||
|
||||
define(`determine_reserved_capability_depend',`dnl
|
||||
ifelse(eval($2 < 1024),1,`class capability net_bind_service;',`dnl
|
||||
ifelse($4,`',`',`determine_reserved_capability_depend(shiftn(3,$*))')dnl end inner ifelse
|
||||
')dnl end outer ifelse
|
||||
') dnl end determine reserved capability depend
|
||||
|
||||
define(`declare_ports',`dnl
|
||||
ifelse(eval($3 < 1024),1,`typeattribute $1 reserved_port_type;',`dnl')
|
||||
portcon $2 $3 context_template(system_u:object_r:$1,$4)
|
||||
ifelse(`$5',`',`',`declare_ports($1,shiftn(4,$*))')dnl
|
||||
')
|
||||
|
||||
#
|
||||
# network_port(port_name,protocol portnum mls_sensitivity [,protocol portnum mls_sensitivity[,...]])
|
||||
#
|
||||
define(`network_port',`
|
||||
ifdef(`interface_pass',`
|
||||
create_port_interfaces($1,determine_reserved_capability(shift($*)),determine_reserved_capability_depend(shift($*)))
|
||||
',`
|
||||
type $1_port_t, port_type;
|
||||
declare_ports($1_port_t,shift($*))
|
||||
')
|
||||
')
|
||||
|
||||
ifdef(`interface_pass',`',`
|
||||
## </module>
|
||||
')
|
||||
541
refpolicy/policy/modules/kernel/corenetwork.if.m4
Normal file
541
refpolicy/policy/modules/kernel/corenetwork.if.m4
Normal file
@ -0,0 +1,541 @@
|
||||
########################################
|
||||
#
|
||||
# Network Interface generated macros
|
||||
#
|
||||
########################################
|
||||
|
||||
define(`create_netif_interfaces',``
|
||||
########################################
|
||||
## <interface name="corenet_tcp_sendrecv_$1">
|
||||
## <description>
|
||||
## Send and receive TCP network traffic on the $1 interface.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="both" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenet_tcp_sendrecv_$1',`
|
||||
requires_block_template(`dollarszero'_depend)
|
||||
|
||||
allow dollarsone $1_netif_t:netif { tcp_send tcp_recv };
|
||||
')
|
||||
|
||||
define(`corenet_tcp_sendrecv_$1_depend',`
|
||||
type $1_netif_t;
|
||||
|
||||
class netif { tcp_send tcp_recv };
|
||||
')
|
||||
|
||||
########################################
|
||||
## <interface name="corenet_udp_send_$1">
|
||||
## <description>
|
||||
## Send UDP network traffic on the $1 interface.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="write" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenet_udp_send_$1',`
|
||||
requires_block_template(`dollarszero'_depend)
|
||||
|
||||
allow dollarsone $1_netif_t:netif udp_send;
|
||||
')
|
||||
|
||||
define(`corenet_udp_send_$1_depend',`
|
||||
type $1_netif_t;
|
||||
|
||||
class netif udp_send;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <interface name="corenet_udp_receive_$1">
|
||||
## <description>
|
||||
## Receive UDP network traffic on the $1 interface.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="read" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenet_udp_receive_$1',`
|
||||
requires_block_template(`dollarszero'_depend)
|
||||
|
||||
allow dollarsone $1_netif_t:netif udp_recv;
|
||||
')
|
||||
|
||||
define(`corenet_udp_receive_$1_depend',`
|
||||
type $1_netif_t;
|
||||
|
||||
class netif udp_recv;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <interface name="corenetwork_sendrecv_udp_on_$1_interface">
|
||||
## <description>
|
||||
## Send and receive UDP network traffic on the $1 interface.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="both" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenet_udp_sendrecv_$1',`
|
||||
corenet_udp_send_$1(dollarsone)
|
||||
corenet_udp_receive_$1(dollarsone)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <interface name="corenet_raw_send_$1">
|
||||
## <description>
|
||||
## Send raw IP packets on the $1 interface.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="write" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenet_raw_send_$1',`
|
||||
requires_block_template(`dollarszero'_depend)
|
||||
|
||||
allow dollarsone $1_netif_t:netif rawip_send;
|
||||
allow dollarsone self:capability net_raw;
|
||||
')
|
||||
|
||||
define(`corenet_raw_send_$1_depend',`
|
||||
type $1_netif_t;
|
||||
|
||||
class netif rawip_send;
|
||||
class capability net_raw;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <interface name="corenet_raw_receive_$1">
|
||||
## <description>
|
||||
## Receive raw IP packets on the $1 interface.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="read" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenet_raw_receive_$1',`
|
||||
requires_block_template(`dollarszero'_depend)
|
||||
|
||||
allow dollarsone $1_netif_t:netif rawip_recv;
|
||||
')
|
||||
|
||||
define(`corenet_raw_receive_$1_depend',`
|
||||
type $1_netif_t;
|
||||
|
||||
class netif rawip_recv;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <interface name="corenet_raw_sendrecv_$1">
|
||||
## <description>
|
||||
## Send and receive raw IP packets on the $1 interface.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="both" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenet_raw_sendrecv_$1',`
|
||||
corenet_raw_send_$1(dollarsone)
|
||||
corenet_raw_receive_$1(dollarsone)
|
||||
')
|
||||
'') dnl end create_netif_interfaces
|
||||
|
||||
########################################
|
||||
#
|
||||
# Network node generated macros
|
||||
#
|
||||
########################################
|
||||
|
||||
define(`create_node_interfaces',``
|
||||
########################################
|
||||
## <interface name="corenet_tcp_sendrecv_$1_node">
|
||||
## <description>
|
||||
## Send and receive TCP traffic on the $1 node.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="both" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenet_tcp_sendrecv_$1_node',`
|
||||
requires_block_template(`dollarszero'_depend)
|
||||
|
||||
allow dollarsone $1_node_t:node { tcp_send tcp_recv };
|
||||
')
|
||||
|
||||
define(`corenet_tcp_sendrecv_$1_node_depend',`
|
||||
type $1_node_t;
|
||||
|
||||
class node { tcp_send tcp_recv };
|
||||
')
|
||||
|
||||
########################################
|
||||
## <interface name="corenet_udp_send_$1_node">
|
||||
## <description>
|
||||
## Send UDP traffic on the $1 node.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="write" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenet_udp_send_$1_node',`
|
||||
requires_block_template(`dollarszero'_depend)
|
||||
|
||||
allow dollarsone $1_node_t:node udp_send;
|
||||
')
|
||||
|
||||
define(`corenet_udp_send_$1_node_depend',`
|
||||
type $1_node_t;
|
||||
|
||||
class node udp_send;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <interface name="corenet_udp_receive_$1_node">
|
||||
## <description>
|
||||
## Receive UDP traffic on the $1 node.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="read" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenet_udp_receive_$1_node',`
|
||||
requires_block_template(`dollarszero'_depend)
|
||||
|
||||
allow dollarsone $1_node_t:node udp_recv;
|
||||
')
|
||||
|
||||
define(`corenet_udp_receive_$1_node_depend',`
|
||||
type $1_node_t;
|
||||
|
||||
class node udp_recv;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <interface name="corenet_udp_sendrecv_$1_node">
|
||||
## <description>
|
||||
## Send and receive UDP traffic on the $1 node.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="both" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenet_udp_sendrecv_$1_node',`
|
||||
corenet_udp_send_$1_node(dollarsone)
|
||||
corenet_udp_receive_$1_node(dollarsone)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <interface name="corenet_raw_send_$1_node">
|
||||
## <description>
|
||||
## Send raw IP packets on the $1 node.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="write" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenet_raw_send_$1_node',`
|
||||
requires_block_template(`dollarszero'_depend)
|
||||
|
||||
allow dollarsone $1_node_t:node rawip_send;
|
||||
allow dollarsone self:capability net_raw;
|
||||
')
|
||||
|
||||
define(`corenet_raw_send_$1_node_depend',`
|
||||
type $1_node_t;
|
||||
|
||||
class node rawip_send;
|
||||
class capability net_raw;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <interface name="corenet_raw_receive_$1_node">
|
||||
## <description>
|
||||
## Receive raw IP packets on the $1 node.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="write" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenet_raw_receive_$1_node',`
|
||||
requires_block_template(`dollarszero'_depend)
|
||||
|
||||
allow dollarsone $1_node_t:node rawip_recv;
|
||||
')
|
||||
|
||||
define(`corenet_raw_receive_$1_node_depend',`
|
||||
type $1_node_t;
|
||||
|
||||
class node rawip_recv;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <interface name="corenet_raw_sendrecv_$1_node">
|
||||
## <description>
|
||||
## Send and receive raw IP packets on the $1 node.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="both" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenet_raw_sendrecv_$1_node',`
|
||||
corenet_raw_send_$1_node(dollarsone)
|
||||
corenet_raw_receive_$1_node(dollarsone)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <interface name="corenet_tcp_bind_$1_node">
|
||||
## <description>
|
||||
## Bind TCP sockets to node $1.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="none"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenet_tcp_bind_$1_node',`
|
||||
requires_block_template(`dollarszero'_depend)
|
||||
|
||||
allow dollarsone $1_node_t:tcp_socket node_bind;
|
||||
')
|
||||
|
||||
define(`corenet_tcp_bind_$1_node_depend',`
|
||||
type $1_node_t;
|
||||
|
||||
class tcp_socket node_bind;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <interface name="corenet_udp_bind_$1_node">
|
||||
## <description>
|
||||
## Bind UDP sockets to the $1 node.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="none"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenet_udp_bind_$1_node',`
|
||||
requires_block_template(`dollarszero'_depend)
|
||||
|
||||
allow dollarsone $1_node_t:udp_socket node_bind;
|
||||
')
|
||||
|
||||
define(`corenet_udp_bind_$1_node_depend',`
|
||||
type $1_node_t;
|
||||
|
||||
class udp_socket node_bind;
|
||||
')
|
||||
'') dnl end create_node_interfaces
|
||||
|
||||
########################################
|
||||
#
|
||||
# Network port generated macros
|
||||
#
|
||||
########################################
|
||||
|
||||
define(`create_port_interfaces',``
|
||||
########################################
|
||||
## <interface name="corenet_tcp_sendrecv_$1_port">
|
||||
## <description>
|
||||
## Send and receive TCP traffic on the $1 port.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="both" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenet_tcp_sendrecv_$1_port',`
|
||||
requires_block_template(`dollarszero'_depend)
|
||||
|
||||
allow dollarsone $1_port_t:tcp_socket { send_msg recv_msg };
|
||||
')
|
||||
|
||||
define(`corenet_tcp_sendrecv_$1_port_depend',`
|
||||
type $1_port_t;
|
||||
|
||||
class tcp_socket { send_msg recv_msg };
|
||||
')
|
||||
|
||||
########################################
|
||||
## <interface name="corenet_udp_send_$1_port">
|
||||
## <description>
|
||||
## Send UDP traffic on the $1 port.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="write" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenet_udp_send_$1_port',`
|
||||
requires_block_template(`dollarszero'_depend)
|
||||
|
||||
allow dollarsone $1_port_t:udp_socket send_msg;
|
||||
')
|
||||
|
||||
define(`corenet_udp_send_$1_port_depend',`
|
||||
type $1_port_t;
|
||||
|
||||
class udp_socket send_msg;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <interface name="corenet_udp_receive_$1_port">
|
||||
## <description>
|
||||
## Receive UDP traffic on the $1 port.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="read" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenet_udp_receive_$1_port',`
|
||||
requires_block_template(`dollarszero'_depend)
|
||||
|
||||
allow dollarsone $1_port_t:udp_socket recv_msg;
|
||||
')
|
||||
|
||||
define(`corenet_udp_receive_$1_port_depend',`
|
||||
type $1_port_t;
|
||||
|
||||
class udp_socket recv_msg;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <interface name="corenetwork_sendrecv_udp_on_$1_port">
|
||||
## <description>
|
||||
## Send and receive UDP traffic on the $1 port.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="both" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenet_udp_sendrecv_$1_port',`
|
||||
corenet_udp_send_$1_port(dollarsone)
|
||||
corenet_udp_receive_$1_port(dollarsone)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <interface name="corenet_tcp_bind_$1_port">
|
||||
## <description>
|
||||
## Bind TCP sockets to the $1 port.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="none"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenet_tcp_bind_$1_port',`
|
||||
requires_block_template(`dollarszero'_depend)
|
||||
allow dollarsone $1_port_t:tcp_socket name_bind;
|
||||
$2
|
||||
')
|
||||
|
||||
define(`corenet_tcp_bind_$1_port_depend',`
|
||||
type $1_port_t;
|
||||
|
||||
class tcp_socket name_bind;
|
||||
$3
|
||||
')
|
||||
|
||||
########################################
|
||||
## <interface name="corenet_udp_bind_$1_port">
|
||||
## <description>
|
||||
## Bind UDP sockets to the $1 port.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="none"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenet_udp_bind_$1_port',`
|
||||
requires_block_template(`dollarszero'_depend)
|
||||
|
||||
allow dollarsone $1_port_t:udp_socket name_bind;
|
||||
$2
|
||||
')
|
||||
|
||||
define(`corenet_udp_bind_$1_port_depend',`
|
||||
type $1_port_t;
|
||||
|
||||
class udp_socket name_bind;
|
||||
$3
|
||||
')
|
||||
'') dnl end create_port_interfaces
|
||||
|
||||
#
|
||||
# network_interface(linux_interfacename,mls_sensitivity)
|
||||
#
|
||||
define(`network_interface',`
|
||||
create_netif_interfaces($1)
|
||||
')
|
||||
|
||||
#
|
||||
# network_node(node_name,mls_sensitivity,address,netmask)
|
||||
#
|
||||
define(`network_node',`
|
||||
create_node_interfaces($1)
|
||||
')
|
||||
|
||||
# These next three macros have formatting, and should not me indented
|
||||
define(`determine_reserved_capability',`dnl
|
||||
ifelse(eval($2 < 1024),1,``allow' dollarsone self:capability net_bind_service;',`dnl
|
||||
ifelse($4,`',`',`determine_reserved_capability(shiftn(3,$*))')dnl end inner ifelse
|
||||
')dnl end outer ifelse
|
||||
') dnl end determine reserved capability
|
||||
|
||||
define(`determine_reserved_capability_depend',`dnl
|
||||
ifelse(eval($2 < 1024),1,`class capability net_bind_service;',`dnl
|
||||
ifelse($4,`',`',`determine_reserved_capability_depend(shiftn(3,$*))')dnl end inner ifelse
|
||||
')dnl end outer ifelse
|
||||
') dnl end determine reserved capability depend
|
||||
|
||||
define(`declare_ports',`dnl
|
||||
ifelse(eval($3 < 1024),1,`typeattribute $1 reserved_port_type;',`dnl')
|
||||
portcon $2 $3 context_template(system_u:object_r:$1,$4)
|
||||
ifelse(`$5',`',`',`declare_ports($1,shiftn(4,$*))')dnl
|
||||
')
|
||||
|
||||
#
|
||||
# network_port(port_name,protocol portnum mls_sensitivity [,protocol portnum mls_sensitivity[,...]])
|
||||
#
|
||||
define(`network_port',`
|
||||
create_port_interfaces($1,determine_reserved_capability(shift($*)),determine_reserved_capability_depend(shift($*)))
|
||||
')
|
||||
43
refpolicy/policy/modules/kernel/corenetwork.te.m4
Normal file
43
refpolicy/policy/modules/kernel/corenetwork.te.m4
Normal file
@ -0,0 +1,43 @@
|
||||
#
|
||||
# network_interface(linux_interfacename,mls_sensitivity)
|
||||
#
|
||||
define(`network_interface',`
|
||||
requires_block_template(`type unlabeled_t')
|
||||
type $1_netif_t alias netif_$1_t, netif_type;
|
||||
netifcon $1 context_template(system_u:object_r:$1_netif_t,$2) context_template(system_u:object_r:unlabeled_t,$2)
|
||||
')
|
||||
|
||||
#
|
||||
# network_node(node_name,mls_sensitivity,address,netmask)
|
||||
#
|
||||
define(`network_node',`
|
||||
type $1_node_t alias node_$1_t, node_type;
|
||||
nodecon $3 $4 context_template(system_u:object_r:$1_node_t,$2)
|
||||
')
|
||||
|
||||
# These next three macros have formatting, and should not me indented
|
||||
define(`determine_reserved_capability',`dnl
|
||||
ifelse(eval($2 < 1024),1,``allow' dollarsone self:capability net_bind_service;',`dnl
|
||||
ifelse($4,`',`',`determine_reserved_capability(shiftn(3,$*))')dnl end inner ifelse
|
||||
')dnl end outer ifelse
|
||||
') dnl end determine reserved capability
|
||||
|
||||
define(`determine_reserved_capability_depend',`dnl
|
||||
ifelse(eval($2 < 1024),1,`class capability net_bind_service;',`dnl
|
||||
ifelse($4,`',`',`determine_reserved_capability_depend(shiftn(3,$*))')dnl end inner ifelse
|
||||
')dnl end outer ifelse
|
||||
') dnl end determine reserved capability depend
|
||||
|
||||
define(`declare_ports',`dnl
|
||||
ifelse(eval($3 < 1024),1,`typeattribute $1 reserved_port_type;',`dnl')
|
||||
portcon $2 $3 context_template(system_u:object_r:$1,$4)
|
||||
ifelse(`$5',`',`',`declare_ports($1,shiftn(4,$*))')dnl
|
||||
')
|
||||
|
||||
#
|
||||
# network_port(port_name,protocol portnum mls_sensitivity [,protocol portnum mls_sensitivity[,...]])
|
||||
#
|
||||
define(`network_port',`
|
||||
type $1_port_t, port_type;
|
||||
declare_ports($1_port_t,shift($*))
|
||||
')
|
||||
Loading…
Reference in New Issue
Block a user