policy_module(mplayer, 2.0.1) ######################################## # # Declarations # ## ##

## Allow mplayer executable stack ##

##
gen_tunable(allow_mplayer_execstack, false) type mencoder_t; type mencoder_exec_t; typealias mencoder_t alias { user_mencoder_t staff_mencoder_t sysadm_mencoder_t }; typealias mencoder_t alias { auditadm_mencoder_t secadm_mencoder_t }; application_domain(mencoder_t, mencoder_exec_t) ubac_constrained(mencoder_t) type mplayer_t; type mplayer_exec_t; typealias mplayer_t alias { user_mplayer_t staff_mplayer_t sysadm_mplayer_t }; typealias mplayer_t alias { auditadm_mplayer_t secadm_mplayer_t }; application_domain(mplayer_t, mplayer_exec_t) ubac_constrained(mplayer_t) type mplayer_etc_t; files_config_file(mplayer_etc_t) type mplayer_home_t; typealias mplayer_home_t alias { user_mplayer_home_t staff_mplayer_home_t sysadm_mplayer_home_t }; typealias mplayer_home_t alias { auditadm_mplayer_home_t secadm_mplayer_home_t }; files_poly_member(mplayer_home_t) userdom_user_home_content(mplayer_home_t) type mplayer_tmpfs_t; typealias mplayer_tmpfs_t alias { user_mplayer_tmpfs_t staff_mplayer_tmpfs_t sysadm_mplayer_tmpfs_t }; typealias mplayer_tmpfs_t alias { auditadm_mplayer_tmpfs_t secadm_mplayer_tmpfs_t }; files_tmpfs_file(mplayer_tmpfs_t) ubac_constrained(mplayer_tmpfs_t) ######################################## # # mencoder local policy # manage_dirs_pattern(mencoder_t, mplayer_home_t, mplayer_home_t) manage_files_pattern(mencoder_t, mplayer_home_t, mplayer_home_t) manage_lnk_files_pattern(mencoder_t, mplayer_home_t, mplayer_home_t) # Read global config allow mencoder_t mplayer_etc_t:dir list_dir_perms; read_files_pattern(mencoder_t, mplayer_etc_t, mplayer_etc_t) read_lnk_files_pattern(mencoder_t, mplayer_etc_t, mplayer_etc_t) # Read /proc files and directories # Necessary for /proc/meminfo, /proc/cpuinfo, etc.. kernel_read_system_state(mencoder_t) # Sysctl on kernel version kernel_read_kernel_sysctls(mencoder_t) # Required for win32 binary loader dev_rwx_zero(mencoder_t) # Access to DVD/CD/V4L dev_read_video_dev(mencoder_t) # Read data in /usr/share (fonts, icons..) files_read_usr_files(mencoder_t) files_read_usr_symlinks(mencoder_t) fs_search_auto_mountpoints(mencoder_t) # Access to DVD/CD/V4L storage_raw_read_removable_device(mencoder_t) miscfiles_read_localization(mencoder_t) userdom_use_user_terminals(mencoder_t) # Handle removable media, /tmp, and /home userdom_list_user_tmp(mencoder_t) userdom_read_user_tmp_files(mencoder_t) userdom_read_user_tmp_symlinks(mencoder_t) userdom_read_user_home_content_files(mencoder_t) userdom_read_user_home_content_symlinks(mencoder_t) # Read content to encode ifndef(`enable_mls',` fs_search_removable(mencoder_t) fs_read_removable_files(mencoder_t) fs_read_removable_symlinks(mencoder_t) ') tunable_policy(`allow_execmem',` allow mencoder_t self:process execmem; ') tunable_policy(`allow_execmod',` dev_execmod_zero(mencoder_t) ') tunable_policy(`allow_mplayer_execstack',` allow mencoder_t self:process { execmem execstack }; ') tunable_policy(`use_nfs_home_dirs',` fs_manage_nfs_dirs(mencoder_t) fs_manage_nfs_files(mencoder_t) fs_manage_nfs_symlinks(mencoder_t) ') tunable_policy(`use_samba_home_dirs',` fs_manage_cifs_dirs(mencoder_t) fs_manage_cifs_files(mencoder_t) fs_manage_cifs_symlinks(mencoder_t) ') # Read content to encode tunable_policy(`use_nfs_home_dirs',` fs_list_auto_mountpoints(mencoder_t) files_list_home(mencoder_t) fs_read_nfs_files(mencoder_t) fs_read_nfs_symlinks(mencoder_t) ',` files_dontaudit_list_home(mencoder_t) fs_dontaudit_list_auto_mountpoints(mencoder_t) fs_dontaudit_read_nfs_files(mencoder_t) fs_dontaudit_list_nfs(mencoder_t) ') tunable_policy(`use_samba_home_dirs',` fs_list_auto_mountpoints(mencoder_t) files_list_home(mencoder_t) fs_read_cifs_files(mencoder_t) fs_read_cifs_symlinks(mencoder_t) ',` files_dontaudit_list_home(mencoder_t) fs_dontaudit_list_auto_mountpoints(mencoder_t) fs_dontaudit_read_cifs_files(mencoder_t) fs_dontaudit_list_cifs(mencoder_t) ') tunable_policy(`read_default_t',` files_list_default(mencoder_t) files_read_default_files(mencoder_t) files_read_default_symlinks(mencoder_t) ',` files_dontaudit_read_default_files(mencoder_t) files_dontaudit_list_default(mencoder_t) ') ######################################## # # mplayer local policy # allow mplayer_t self:process { signal_perms getsched }; allow mplayer_t self:fifo_file rw_fifo_file_perms; allow mplayer_t self:sem create_sem_perms; manage_dirs_pattern(mplayer_t, mplayer_home_t, mplayer_home_t) manage_files_pattern(mplayer_t, mplayer_home_t, mplayer_home_t) manage_lnk_files_pattern(mplayer_t, mplayer_home_t, mplayer_home_t) userdom_search_user_home_dirs(mplayer_t) manage_files_pattern(mplayer_t, mplayer_tmpfs_t, mplayer_tmpfs_t) manage_lnk_files_pattern(mplayer_t, mplayer_tmpfs_t, mplayer_tmpfs_t) manage_fifo_files_pattern(mplayer_t, mplayer_tmpfs_t, mplayer_tmpfs_t) manage_sock_files_pattern(mplayer_t, mplayer_tmpfs_t, mplayer_tmpfs_t) fs_tmpfs_filetrans(mplayer_t, mplayer_tmpfs_t,{ dir file lnk_file sock_file fifo_file }) # Read global config allow mplayer_t mplayer_etc_t:dir list_dir_perms; read_files_pattern(mplayer_t, mplayer_etc_t, mplayer_etc_t) read_lnk_files_pattern(mplayer_t, mplayer_etc_t, mplayer_etc_t) kernel_dontaudit_list_unlabeled(mplayer_t) kernel_dontaudit_getattr_unlabeled_files(mplayer_t) kernel_dontaudit_read_unlabeled_files(mplayer_t) # Necessary for /proc/meminfo, /proc/cpuinfo, etc.. kernel_read_system_state(mplayer_t) # Sysctl on kernel version kernel_read_kernel_sysctls(mplayer_t) # Run bash/sed (??) corecmd_exec_bin(mplayer_t) corecmd_exec_shell(mplayer_t) # Required for win32 binary loader dev_rwx_zero(mplayer_t) # Access to DVD/CD/V4L dev_read_video_dev(mplayer_t) # Audio, alsa.conf dev_read_sound_mixer(mplayer_t) dev_write_sound_mixer(mplayer_t) # RTC clock dev_read_realtime_clock(mplayer_t) # Access to DVD/CD/V4L storage_raw_read_removable_device(mplayer_t) files_read_etc_files(mplayer_t) files_dontaudit_list_non_security(mplayer_t) files_dontaudit_getattr_non_security_files(mplayer_t) files_read_non_security_files(mplayer_t) # Unfortunately the ancient file dialog starts in / files_list_home(mplayer_t) # Read /etc/mtab files_read_etc_runtime_files(mplayer_t) # Read data in /usr/share (fonts, icons..) files_read_usr_files(mplayer_t) files_read_usr_symlinks(mplayer_t) fs_dontaudit_getattr_all_fs(mplayer_t) fs_search_auto_mountpoints(mplayer_t) fs_list_inotifyfs(mplayer_t) miscfiles_read_localization(mplayer_t) miscfiles_read_fonts(mplayer_t) userdom_use_user_terminals(mplayer_t) # Read media files userdom_list_user_tmp(mplayer_t) userdom_read_user_tmp_files(mplayer_t) userdom_read_user_tmp_symlinks(mplayer_t) userdom_read_user_home_content_files(mplayer_t) userdom_read_user_home_content_symlinks(mplayer_t) xserver_user_x_domain_template(mplayer, mplayer_t, mplayer_tmpfs_t) # Read songs ifdef(`enable_mls',`',` fs_search_removable(mplayer_t) fs_read_removable_files(mplayer_t) fs_read_removable_symlinks(mplayer_t) ') tunable_policy(`allow_execmem',` allow mplayer_t self:process execmem; ') tunable_policy(`allow_execmod',` dev_execmod_zero(mplayer_t) ') tunable_policy(`allow_mplayer_execstack',` allow mplayer_t self:process { execmem execstack }; ') tunable_policy(`use_nfs_home_dirs',` fs_manage_nfs_dirs(mplayer_t) fs_manage_nfs_files(mplayer_t) fs_manage_nfs_symlinks(mplayer_t) ') tunable_policy(`use_samba_home_dirs',` fs_manage_cifs_dirs(mplayer_t) fs_manage_cifs_files(mplayer_t) fs_manage_cifs_symlinks(mplayer_t) ') # Legacy domain issues tunable_policy(`allow_mplayer_execstack',` allow mplayer_t mplayer_tmpfs_t:file execute; ') # Read songs tunable_policy(`use_nfs_home_dirs',` fs_list_auto_mountpoints(mplayer_t) files_list_home(mplayer_t) fs_read_nfs_files(mplayer_t) fs_read_nfs_symlinks(mplayer_t) ',` files_dontaudit_list_home(mplayer_t) fs_dontaudit_list_auto_mountpoints(mplayer_t) fs_dontaudit_read_nfs_files(mplayer_t) fs_dontaudit_list_nfs(mplayer_t) ') tunable_policy(`use_samba_home_dirs',` fs_list_auto_mountpoints(mplayer_t) files_list_home(mplayer_t) fs_read_cifs_files(mplayer_t) fs_read_cifs_symlinks(mplayer_t) ',` files_dontaudit_list_home(mplayer_t) fs_dontaudit_list_auto_mountpoints(mplayer_t) fs_dontaudit_read_cifs_files(mplayer_t) fs_dontaudit_list_cifs(mplayer_t) ') tunable_policy(`read_default_t',` files_list_default(mplayer_t) files_read_default_files(mplayer_t) files_read_default_symlinks(mplayer_t) ',` files_dontaudit_read_default_files(mplayer_t) files_dontaudit_list_default(mplayer_t) ') optional_policy(` alsa_read_rw_config(mplayer_t) ') optional_policy(` nscd_socket_use(mplayer_t) ')