## SELinux utility to run a shell with a new role ####################################### ## ## The per user domain template for the userhelper module. ## ## ##

## This template creates a derived domains which are used ## for userhelper. ##

##

## This template is invoked automatically for each user, and ## generally does not need to be invoked directly ## by policy writers. ##

##
## ## ## The prefix of the user domain (e.g., user ## is the prefix for user_t). ## ## ## ## ## The type of the user domain. ## ## ## ## ## The role associated with the user domain. ## ## # template(`userhelper_per_userdomain_template',` gen_require(` type userhelper_exec_t, userhelper_conf_t; ') ######################################## # # Declarations # type $1_userhelper_t; domain_type($1_userhelper_t) domain_entry_file($1_userhelper_t,userhelper_exec_t) domain_role_change_exemption($1_userhelper_t) domain_obj_id_change_exemption($1_userhelper_t) domain_wide_inherit_fd($1_userhelper_t) domain_subj_id_change_exemption($1_userhelper_t) role system_r types $1_userhelper_t; ######################################## # # Local policy # allow $1_userhelper_t self:capability { setuid setgid net_bind_service dac_override chown sys_tty_config }; allow $1_userhelper_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; allow $1_userhelper_t self:fd use; allow $1_userhelper_t self:fifo_file rw_file_perms; allow $1_userhelper_t self:shm create_shm_perms; allow $1_userhelper_t self:sem create_sem_perms; allow $1_userhelper_t self:msgq create_msgq_perms; allow $1_userhelper_t self:msg { send receive }; allow $1_userhelper_t self:unix_dgram_socket create_socket_perms; allow $1_userhelper_t self:unix_stream_socket create_stream_socket_perms; allow $1_userhelper_t self:unix_dgram_socket sendto; allow $1_userhelper_t self:unix_stream_socket connectto; allow $1_userhelper_t self:sock_file r_file_perms; #Transition to the derived domain. domain_auto_trans($2,userhelper_exec_t,$1_userhelper_t) allow $2 $1_userhelper_t:fd use; allow $1_userhelper_t $2:fd use; allow $1_userhelper_t $2:fifo_file rw_file_perms; allow $1_userhelper_t $2:process sigchld; allow $1_userhelper_t self:process setexec; allow $1_userhelper_t userhelper_conf_t:file rw_file_perms; allow $1_userhelper_t userhelper_conf_t:dir rw_dir_perms; can_exec($1_userhelper_t, userhelper_exec_t) dontaudit $2 $1_userhelper_t:process signal; kernel_read_all_sysctls($1_userhelper_t) kernel_getattr_debugfs($1_userhelper_t) kernel_read_system_state($1_userhelper_t) # Execute shells corecmd_exec_shell($1_userhelper_t) # By default, revert to the calling domain when a program is executed corecmd_bin_domtrans($1_userhelper_t,$2) corecmd_sbin_domtrans($1_userhelper_t,$2) # Inherit descriptors from the current session. domain_use_wide_inherit_fd($1_userhelper_t) # for when the user types "exec userhelper" at the command line domain_sigchld_wide_inherit_fd($1_userhelper_t) dev_read_urand($1_userhelper_t) # Read /dev directories and any symbolic links. dev_list_all_dev_nodes($1_userhelper_t) files_list_var_lib($1_userhelper_t) # Write to utmp. files_filetrans_pid($1_userhelper_t,initrc_var_run_t) # Read the /etc/security/default_type file files_read_etc_files($1_userhelper_t) # Read /var. files_read_var_files($1_userhelper_t) files_read_var_symlinks($1_userhelper_t) # for some PAM modules and for cwd files_search_home($1_userhelper_t) fs_search_auto_mountpoints($1_userhelper_t) fs_read_nfs_files($1_userhelper_t) fs_read_nfs_symlinks($1_userhelper_t) # Allow $1_userhelper to obtain contexts to relabel TTYs selinux_get_fs_mount($1_userhelper_t) selinux_validate_context($1_userhelper_t) selinux_compute_access_vector($1_userhelper_t) selinux_compute_create_context($1_userhelper_t) selinux_compute_relabel_context($1_userhelper_t) selinux_compute_user_contexts($1_userhelper_t) # Read the devpts root directory. term_list_ptys($1_userhelper_t) # Relabel terminals. term_relabel_all_user_ttys($1_userhelper_t) term_relabel_all_user_ptys($1_userhelper_t) # Access terminals. term_use_all_user_ttys($1_userhelper_t) term_use_all_user_ptys($1_userhelper_t) auth_domtrans_chk_passwd($1_userhelper_t) auth_manage_pam_pid($1_userhelper_t) auth_manage_var_auth($1_userhelper_t) auth_search_pam_console_data($1_userhelper_t) # Inherit descriptors from the current session. init_use_fd($1_userhelper_t) # Write to utmp. init_manage_utmp($1_userhelper_t) libs_use_ld_so($1_userhelper_t) libs_use_shared_libs($1_userhelper_t) miscfiles_read_localization($1_userhelper_t) seutil_read_config($1_userhelper_t) seutil_read_default_contexts($1_userhelper_t) userdom_use_unpriv_users_fd($1_userhelper_t) # Allow $1_userhelper_t to transition to user domains. userdom_bin_spec_domtrans_unpriv_users($1_userhelper_t) userdom_sbin_spec_domtrans_unpriv_users($1_userhelper_t) userdom_entry_spec_domtrans_unpriv_users($1_userhelper_t) ifdef(`distro_redhat',` optional_policy(`rpm',` # Allow transitioning to rpm_t, for up2date rpm_domtrans($1_userhelper_t) ') ') tunable_policy(`! secure_mode',` #if we are not in secure mode then we can transition to sysadm_t userdom_bin_spec_domtrans_sysadm($1_userhelper_t) userdom_sbin_spec_domtrans_sysadm($1_userhelper_t) userdom_entry_spec_domtrans_sysadm($1_userhelper_t) ') optional_policy(`logging',` logging_send_syslog_msg($1_userhelper_t) ') optional_policy(`nis',` nis_use_ypbind($1_userhelper_t) ') optional_policy(`nscd',` nscd_socket_use($1_userhelper_t) ') ifdef(`TODO',` allow $1_userhelper_t xdm_t:fd use; allow $1_userhelper_t xdm_var_run_t:dir search; allow $1_userhelper_t xdm_t:fifo_file { getattr read write ioctl }; optional_policy(`gnome-pty-helper.te',` allow $1_userhelper_t gphdomain:fd use; ') optional_policy(`xauth', ` domain_auto_trans($1_userhelper_t, xauth_exec_t, $1_xauth_t) allow $1_userhelper_t $1_xauth_home_t:file { getattr read }; ') optional_policy(`mozilla', ` domain_auto_trans($1_mozilla_t, userhelper_exec_t, $1_userhelper_t) ') # for when the network connection is killed dontaudit unpriv_userdomain $1_userhelper_t:process signal; ') ') ######################################## ## ## Search the userhelper configuration directory. ## ## ## ## Domain allowed access. ## ## # interface(`userhelper_search_config',` gen_require(` type userhelper_conf_t; ') allow $1 userhelper_conf_t:dir search_dir_perms; ') ######################################## ## ## Do not audit attempts to search ## the userhelper configuration directory. ## ## ## ## Domain to not audit. ## ## # interface(`userhelper_dontaudit_search_config',` gen_require(` type userhelper_conf_t; ') dontaudit $1 userhelper_conf_t:dir search_dir_perms; ')