## SELinux utility to run a shell with a new role ####################################### ## ## The per role template for the userhelper module. ## ## ##

## This template creates a derived domains which are used ## for userhelper. ##

##

## This template is invoked automatically for each user, and ## generally does not need to be invoked directly ## by policy writers. ##

##
## ## ## The prefix of the user domain (e.g., user ## is the prefix for user_t). ## ## ## ## ## The type of the user domain. ## ## ## ## ## The role associated with the user domain. ## ## # template(`userhelper_per_role_template',` gen_require(` type userhelper_exec_t, userhelper_conf_t; ') ######################################## # # Declarations # type $1_userhelper_t; application_domain($1_userhelper_t,userhelper_exec_t) domain_role_change_exemption($1_userhelper_t) domain_obj_id_change_exemption($1_userhelper_t) domain_interactive_fd($1_userhelper_t) domain_subj_id_change_exemption($1_userhelper_t) role $3 types $1_userhelper_t; ######################################## # # Local policy # allow $1_userhelper_t self:capability { setuid setgid net_bind_service dac_override chown sys_tty_config }; allow $1_userhelper_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; allow $1_userhelper_t self:process setexec; allow $1_userhelper_t self:fd use; allow $1_userhelper_t self:fifo_file rw_fifo_file_perms; allow $1_userhelper_t self:shm create_shm_perms; allow $1_userhelper_t self:sem create_sem_perms; allow $1_userhelper_t self:msgq create_msgq_perms; allow $1_userhelper_t self:msg { send receive }; allow $1_userhelper_t self:unix_dgram_socket create_socket_perms; allow $1_userhelper_t self:unix_stream_socket create_stream_socket_perms; allow $1_userhelper_t self:unix_dgram_socket sendto; allow $1_userhelper_t self:unix_stream_socket connectto; allow $1_userhelper_t self:sock_file read_sock_file_perms; #Transition to the derived domain. domtrans_pattern($2,userhelper_exec_t,$1_userhelper_t) allow $1_userhelper_t userhelper_conf_t:dir rw_dir_perms; rw_files_pattern($1_userhelper_t,userhelper_conf_t,userhelper_conf_t) can_exec($1_userhelper_t, userhelper_exec_t) dontaudit $2 $1_userhelper_t:process signal; kernel_read_all_sysctls($1_userhelper_t) kernel_getattr_debugfs($1_userhelper_t) kernel_read_system_state($1_userhelper_t) # Execute shells corecmd_exec_shell($1_userhelper_t) # By default, revert to the calling domain when a program is executed corecmd_bin_domtrans($1_userhelper_t,$2) # Inherit descriptors from the current session. domain_use_interactive_fds($1_userhelper_t) # for when the user types "exec userhelper" at the command line domain_sigchld_interactive_fds($1_userhelper_t) dev_read_urand($1_userhelper_t) # Read /dev directories and any symbolic links. dev_list_all_dev_nodes($1_userhelper_t) files_list_var_lib($1_userhelper_t) # Write to utmp. files_pid_filetrans($1_userhelper_t,initrc_var_run_t,file) # Read the /etc/security/default_type file files_read_etc_files($1_userhelper_t) # Read /var. files_read_var_files($1_userhelper_t) files_read_var_symlinks($1_userhelper_t) # for some PAM modules and for cwd files_search_home($1_userhelper_t) fs_search_auto_mountpoints($1_userhelper_t) fs_read_nfs_files($1_userhelper_t) fs_read_nfs_symlinks($1_userhelper_t) # Allow $1_userhelper to obtain contexts to relabel TTYs selinux_get_fs_mount($1_userhelper_t) selinux_validate_context($1_userhelper_t) selinux_compute_access_vector($1_userhelper_t) selinux_compute_create_context($1_userhelper_t) selinux_compute_relabel_context($1_userhelper_t) selinux_compute_user_contexts($1_userhelper_t) # Read the devpts root directory. term_list_ptys($1_userhelper_t) # Relabel terminals. term_relabel_all_user_ttys($1_userhelper_t) term_relabel_all_user_ptys($1_userhelper_t) # Access terminals. term_use_all_user_ttys($1_userhelper_t) term_use_all_user_ptys($1_userhelper_t) auth_domtrans_chk_passwd($1_userhelper_t) auth_manage_pam_pid($1_userhelper_t) auth_manage_var_auth($1_userhelper_t) auth_search_pam_console_data($1_userhelper_t) # Inherit descriptors from the current session. init_use_fds($1_userhelper_t) # Write to utmp. init_manage_utmp($1_userhelper_t) libs_use_ld_so($1_userhelper_t) libs_use_shared_libs($1_userhelper_t) miscfiles_read_localization($1_userhelper_t) seutil_read_config($1_userhelper_t) seutil_read_default_contexts($1_userhelper_t) userdom_use_unpriv_users_fds($1_userhelper_t) # Allow $1_userhelper_t to transition to user domains. userdom_bin_spec_domtrans_unpriv_users($1_userhelper_t) userdom_entry_spec_domtrans_unpriv_users($1_userhelper_t) ifdef(`distro_redhat',` optional_policy(` # Allow transitioning to rpm_t, for up2date rpm_domtrans($1_userhelper_t) ') ') tunable_policy(`! secure_mode',` #if we are not in secure mode then we can transition to sysadm_t sysadm_bin_spec_domtrans($1_userhelper_t) sysadm_entry_spec_domtrans($1_userhelper_t) ') optional_policy(` ethereal_domtrans_user_ethereal($1,$1_userhelper_t) ') optional_policy(` logging_send_syslog_msg($1_userhelper_t) ') optional_policy(` nis_use_ypbind($1_userhelper_t) ') optional_policy(` nscd_socket_use($1_userhelper_t) ') ') ######################################## ## ## Search the userhelper configuration directory. ## ## ## ## Domain allowed access. ## ## # interface(`userhelper_search_config',` gen_require(` type userhelper_conf_t; ') allow $1 userhelper_conf_t:dir search_dir_perms; ') ######################################## ## ## Do not audit attempts to search ## the userhelper configuration directory. ## ## ## ## Domain to not audit. ## ## # interface(`userhelper_dontaudit_search_config',` gen_require(` type userhelper_conf_t; ') dontaudit $1 userhelper_conf_t:dir search_dir_perms; ') ######################################## ## ## Allow domain to use userhelper file descriptor. ## ## ## ## The prefix of the domain, example user is the prefix of user_t. ## ## ## ## ## Domain allowed access. ## ## # template(`userhelper_use_user_fd',` gen_require(` type $1_userhelper_t; ') allow $2 $1_userhelper_t:fd use; ') ######################################## ## ## Allow domain to send sigchld to userhelper. ## ## ## ## The prefix of the domain, example user is the prefix of user_t. ## ## ## ## ## Domain allowed access. ## ## # template(`userhelper_sigchld_user',` gen_require(` type $1_userhelper_t; ') allow $2 $1_userhelper_t:process sigchld; ') ######################################## ## ## Execute the userhelper program in the caller domain. ## ## ## ## The type of the process performing this action. ## ## # interface(`userhelper_exec',` gen_require(` type userhelper_exec_t; ') can_exec($1,userhelper_exec_t) ')