## Java virtual machine ######################################## ## ## Role access for java ## ## ## ## Role allowed access ## ## ## ## ## User domain for the role ## ## # interface(`java_role',` gen_require(` type java_t, java_exec_t; ') role $1 types java_t; # The user role is authorized for this domain. domtrans_pattern($2, java_exec_t, java_t) allow java_t $2:process signull; # Unrestricted inheritance from the caller. allow $2 java_t:process { noatsecure siginh rlimitinh }; allow java_t $2:unix_stream_socket connectto; allow java_t $2:unix_stream_socket { read write }; allow java_t $2:tcp_socket { read write }; ') ####################################### ## ## The role template for the java module. ## ## ##

## This template creates a derived domains which are used ## for java applications. ##

##
## ## ## The prefix of the user domain (e.g., user ## is the prefix for user_t). ## ## ## ## ## The role associated with the user domain. ## ## ## ## ## The type of the user domain. ## ## # template(`java_role_template',` gen_require(` type java_exec_t; ') type $1_java_t; domain_type($1_java_t) domain_entry_file($1_java_t, java_exec_t) role $2 types $1_java_t; domain_interactive_fd($1_java_t) userdom_unpriv_usertype($1, $1_java_t) userdom_manage_tmpfs_role($2, $1_java_t) allow $1_java_t self:process { ptrace signal getsched execmem execstack }; dontaudit $1_java_t $3:tcp_socket { read write }; allow $3 $1_java_t:process { getattr ptrace noatsecure signal_perms }; domtrans_pattern($3, java_exec_t, $1_java_t) corecmd_bin_domtrans($1_java_t, $1_t) dev_dontaudit_append_rand($1_java_t) files_execmod_all_files($1_java_t) fs_dontaudit_rw_tmpfs_files($1_java_t) optional_policy(` xserver_role($2, $1_java_t) ') ') ######################################## ## ## Run java in javaplugin domain. ## ## ## ## Domain allowed to transition. ## ## # template(`java_domtrans',` gen_require(` type java_t, java_exec_t; ') domtrans_pattern($1, java_exec_t, java_t) ') ######################################## ## ## Execute java in the java domain, and ## allow the specified role the java domain. ## ## ## ## Domain allowed to transition. ## ## ## ## ## Role allowed access. ## ## # interface(`java_run',` gen_require(` type java_t; ') java_domtrans($1) role $2 types java_t; ') ######################################## ## ## Execute the java program in the unconfined java domain. ## ## ## ## Domain allowed to transition. ## ## # interface(`java_domtrans_unconfined',` gen_require(` type unconfined_java_t, java_exec_t; ') domtrans_pattern($1, java_exec_t, unconfined_java_t) corecmd_search_bin($1) ') ######################################## ## ## Execute the java program in the unconfined java domain. ## ## ## ## Domain allowed to transition. ## ## ## ## ## Role allowed access. ## ## # interface(`java_run_unconfined',` gen_require(` type unconfined_java_t; ') java_domtrans_unconfined($1) role $2 types unconfined_java_t; nsplugin_role_notrans($2, unconfined_java_t) ') ######################################## ## ## Execute the java program in the java domain. ## ## ## ## Domain allowed access. ## ## # interface(`java_exec',` gen_require(` type java_exec_t; ') can_exec($1, java_exec_t) ')