## SELinux utility to run a shell with a new role ####################################### ## ## The role template for the userhelper module. ## ## ## ## The prefix of the user role (e.g., user ## is the prefix for user_r). ## ## ## ## ## The user role. ## ## ## ## ## The user domain associated with the role. ## ## # template(`userhelper_role_template',` gen_require(` attribute userhelper_type; type userhelper_exec_t, userhelper_conf_t; class dbus send_msg; ') ######################################## # # Declarations # type $1_userhelper_t, userhelper_type; application_domain($1_userhelper_t, userhelper_exec_t) domain_role_change_exemption($1_userhelper_t) domain_obj_id_change_exemption($1_userhelper_t) domain_interactive_fd($1_userhelper_t) domain_subj_id_change_exemption($1_userhelper_t) ubac_constrained($1_userhelper_t) role $2 types $1_userhelper_t; ######################################## # # Local policy # allow $1_userhelper_t self:capability { setuid setgid net_bind_service dac_override chown sys_tty_config }; allow $1_userhelper_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; allow $1_userhelper_t self:process setexec; allow $1_userhelper_t self:fd use; allow $1_userhelper_t self:fifo_file rw_fifo_file_perms; allow $1_userhelper_t self:shm create_shm_perms; allow $1_userhelper_t self:sem create_sem_perms; allow $1_userhelper_t self:msgq create_msgq_perms; allow $1_userhelper_t self:msg { send receive }; allow $1_userhelper_t self:unix_dgram_socket create_socket_perms; allow $1_userhelper_t self:unix_stream_socket create_stream_socket_perms; allow $1_userhelper_t self:unix_dgram_socket sendto; allow $1_userhelper_t self:unix_stream_socket connectto; allow $1_userhelper_t self:sock_file read_sock_file_perms; #Transition to the derived domain. domtrans_pattern($3, userhelper_exec_t, $1_userhelper_t) allow $1_userhelper_t userhelper_conf_t:dir rw_dir_perms; rw_files_pattern($1_userhelper_t, userhelper_conf_t, userhelper_conf_t) can_exec($1_userhelper_t, userhelper_exec_t) dontaudit $3 $1_userhelper_t:process signal; kernel_read_all_sysctls($1_userhelper_t) kernel_getattr_debugfs($1_userhelper_t) kernel_read_system_state($1_userhelper_t) # Execute shells corecmd_exec_shell($1_userhelper_t) # By default, revert to the calling domain when a program is executed corecmd_bin_domtrans($1_userhelper_t, $3) # Inherit descriptors from the current session. domain_use_interactive_fds($1_userhelper_t) # for when the user types "exec userhelper" at the command line domain_sigchld_interactive_fds($1_userhelper_t) dev_read_urand($1_userhelper_t) # Read /dev directories and any symbolic links. dev_list_all_dev_nodes($1_userhelper_t) files_list_var_lib($1_userhelper_t) # Read the /etc/security/default_type file files_read_etc_files($1_userhelper_t) # Read /var. files_read_var_files($1_userhelper_t) files_read_var_symlinks($1_userhelper_t) # for some PAM modules and for cwd files_search_home($1_userhelper_t) fs_search_auto_mountpoints($1_userhelper_t) fs_read_nfs_files($1_userhelper_t) fs_read_nfs_symlinks($1_userhelper_t) # Allow $1_userhelper to obtain contexts to relabel TTYs selinux_get_fs_mount($1_userhelper_t) selinux_validate_context($1_userhelper_t) selinux_compute_access_vector($1_userhelper_t) selinux_compute_create_context($1_userhelper_t) selinux_compute_relabel_context($1_userhelper_t) selinux_compute_user_contexts($1_userhelper_t) # Read the devpts root directory. term_list_ptys($1_userhelper_t) # Relabel terminals. term_relabel_all_ttys($1_userhelper_t) term_relabel_all_ptys($1_userhelper_t) # Access terminals. term_use_all_ttys($1_userhelper_t) term_use_all_ptys($1_userhelper_t) auth_domtrans_chk_passwd($1_userhelper_t) auth_manage_pam_pid($1_userhelper_t) auth_manage_var_auth($1_userhelper_t) auth_search_pam_console_data($1_userhelper_t) # Inherit descriptors from the current session. init_use_fds($1_userhelper_t) # Write to utmp. init_manage_utmp($1_userhelper_t) init_pid_filetrans_utmp($1_userhelper_t) miscfiles_read_localization($1_userhelper_t) seutil_read_config($1_userhelper_t) seutil_read_default_contexts($1_userhelper_t) # Allow $1_userhelper_t to transition to user domains. userdom_bin_spec_domtrans_unpriv_users($1_userhelper_t) userdom_entry_spec_domtrans_unpriv_users($1_userhelper_t) ifdef(`distro_redhat',` optional_policy(` # Allow transitioning to rpm_t, for up2date rpm_domtrans($1_userhelper_t) ') ') optional_policy(` logging_send_syslog_msg($1_userhelper_t) ') optional_policy(` nis_use_ypbind($1_userhelper_t) ') optional_policy(` nscd_socket_use($1_userhelper_t) ') optional_policy(` tunable_policy(`! secure_mode',` #if we are not in secure mode then we can transition to sysadm_t sysadm_bin_spec_domtrans($1_userhelper_t) sysadm_entry_spec_domtrans($1_userhelper_t) ') ') ') ######################################## ## ## Search the userhelper configuration directory. ## ## ## ## Domain allowed access. ## ## # interface(`userhelper_search_config',` gen_require(` type userhelper_conf_t; ') allow $1 userhelper_conf_t:dir search_dir_perms; ') ######################################## ## ## Do not audit attempts to search ## the userhelper configuration directory. ## ## ## ## Domain to not audit. ## ## # interface(`userhelper_dontaudit_search_config',` gen_require(` type userhelper_conf_t; ') dontaudit $1 userhelper_conf_t:dir search_dir_perms; ') ######################################## ## ## Allow domain to use userhelper file descriptor. ## ## ## ## Domain allowed access. ## ## # interface(`userhelper_use_fd',` gen_require(` attribute userhelper_type; ') allow $1 userhelper_type:fd use; ') ######################################## ## ## Allow domain to send sigchld to userhelper. ## ## ## ## Domain allowed access. ## ## # interface(`userhelper_sigchld',` gen_require(` attribute userhelper_type; ') allow $1 userhelper_type:process sigchld; ') ######################################## ## ## Execute the userhelper program in the caller domain. ## ## ## ## Domain allowed access. ## ## # interface(`userhelper_exec',` gen_require(` type userhelper_exec_t; ') can_exec($1, userhelper_exec_t) ') ####################################### ## ## The role template for the consolehelper module. ## ## ##

## This template creates a derived domains which are used ## for consolehelper applications. ##

##
## ## ## The prefix of the user domain (e.g., user ## is the prefix for user_t). ## ## ## ## ## The role associated with the user domain. ## ## ## ## ## The type of the user domain. ## ## # template(`userhelper_console_role_template',` gen_require(` type consolehelper_exec_t; attribute consolehelper_domain; class dbus send_msg; ') type $1_consolehelper_t, consolehelper_domain; domain_type($1_consolehelper_t) domain_entry_file($1_consolehelper_t, consolehelper_exec_t) role $2 types $1_consolehelper_t; domtrans_pattern($3, consolehelper_exec_t, $1_consolehelper_t) allow $3 $1_consolehelper_t:dbus send_msg; allow $1_consolehelper_t $3:dbus send_msg; auth_use_pam($1_consolehelper_t) optional_policy(` shutdown_run($1_consolehelper_t, $2) shutdown_send_sigchld($3) ') optional_policy(` xserver_read_xdm_pid($1_consolehelper_t) ') ')