## ## Policy for kernel threads, proc filesystem, ## and unlabeled processes and objects. ## ## ## This module has initial SIDs. ## ######################################## ## ## Allows to start userland processes ## by transitioning to the specified domain. ## ## ## ## The process type entered by kernel. ## ## ## ## ## The executable type for the entrypoint. ## ## # interface(`kernel_domtrans_to',` gen_require(` type kernel_t; ') domtrans_pattern(kernel_t, $2, $1) ') ######################################## ## ## Allows to start userland processes ## by transitioning to the specified domain, ## with a range transition. ## ## ## ## The process type entered by kernel. ## ## ## ## ## The executable type for the entrypoint. ## ## ## ## ## Range for the domain. ## ## # interface(`kernel_ranged_domtrans_to',` gen_require(` type kernel_t; ') kernel_domtrans_to($1,$2) ifdef(`enable_mcs',` range_transition kernel_t $2:process $3; ') ifdef(`enable_mls',` range_transition kernel_t $2:process $3; mls_rangetrans_target($1) ') ') ######################################## ## ## Allows the kernel to mount filesystems on ## the specified directory type. ## ## ## ## The type of the directory to use as a mountpoint. ## ## # interface(`kernel_rootfs_mountpoint',` gen_require(` type kernel_t; ') allow kernel_t $1:dir mounton; ') ######################################## ## ## Set the process group of kernel threads. ## ## ## ## Domain allowed access. ## ## # interface(`kernel_setpgid',` gen_require(` type kernel_t; ') allow $1 kernel_t:process setpgid; ') ######################################## ## ## Set the priority of kernel threads. ## ## ## ## Domain allowed access. ## ## # interface(`kernel_setsched',` gen_require(` type kernel_t; ') allow $1 kernel_t:process setsched; ') ######################################## ## ## Send a SIGCHLD signal to kernel threads. ## ## ## ## The type of the process sending the signal. ## ## # interface(`kernel_sigchld',` gen_require(` type kernel_t; ') allow $1 kernel_t:process sigchld; ') ######################################## ## ## Send a generic signal to kernel threads. ## ## ## ## The type of the process sending the signal. ## ## # interface(`kernel_signal',` gen_require(` type kernel_t; ') allow kernel_t $1:process signal; ') ######################################## ## ## Allows the kernel to share state information with ## the caller. ## ## ## ## The type of the process with which to share state information. ## ## # interface(`kernel_share_state',` gen_require(` type kernel_t; ') allow kernel_t $1:process share; ') ######################################## ## ## Permits caller to use kernel file descriptors. ## ## ## ## The type of the process using the descriptors. ## ## # interface(`kernel_use_fds',` gen_require(` type kernel_t; ') allow $1 kernel_t:fd use; ') ######################################## ## ## Do not audit attempts to use ## kernel file descriptors. ## ## ## ## The type of process not to audit. ## ## # interface(`kernel_dontaudit_use_fds',` gen_require(` type kernel_t; ') dontaudit $1 kernel_t:fd use; ') ######################################## ## ## Read and write kernel unnamed pipes. ## ## ## ## Domain allowed access. ## ## # interface(`kernel_rw_pipes',` gen_require(` type kernel_t; ') allow $1 kernel_t:fifo_file { read write }; ') ######################################## ## ## Read and write kernel unix datagram sockets. ## ## ## ## Domain allowed access. ## ## # interface(`kernel_rw_unix_dgram_sockets',` gen_require(` type kernel_t; ') allow $1 kernel_t:unix_dgram_socket { read write ioctl }; ') ######################################## ## ## Send messages to kernel unix datagram sockets. ## ## ## ## Domain allowed access. ## ## # interface(`kernel_dgram_send',` gen_require(` type kernel_t; ') allow $1 kernel_t:unix_dgram_socket sendto; ') ######################################## ## ## Receive messages from kernel TCP sockets. (Deprecated) ## ## ## ## Domain allowed access. ## ## # interface(`kernel_tcp_recvfrom',` refpolicywarn(`$0($*) has been deprecated.') ') ######################################## ## ## Send UDP network traffic to the kernel. (Deprecated) ## ## ## ## Domain allowed access. ## ## # interface(`kernel_udp_send',` refpolicywarn(`$0($*) has been deprecated.') ') ######################################## ## ## Receive messages from kernel UDP sockets. (Deprecated) ## ## ## ## Domain allowed access. ## ## # interface(`kernel_udp_recvfrom',` refpolicywarn(`$0($*) has been deprecated.') ') ######################################## ## ## Allows caller to load kernel modules ## ## ## ## The process type to allow to load kernel modules. ## ## # interface(`kernel_load_module',` gen_require(` attribute can_load_kernmodule; ') allow $1 self:capability sys_module; typeattribute $1 can_load_kernmodule; # load_module() calls stop_machine() which # calls sched_setscheduler() allow $1 self:capability sys_nice; kernel_setsched($1) ') ######################################## ## ## Allow search the kernel key ring. ## ## ## ## Domain allowed access. ## ## # interface(`kernel_search_key',` gen_require(` type kernel_t; ') allow $1 kernel_t:key search; ') ######################################## ## ## dontaudit search the kernel key ring. ## ## ## ## Domain allowed access. ## ## # interface(`kernel_dontaudit_search_key',` gen_require(` type kernel_t; ') dontaudit $1 kernel_t:key search; ') ######################################## ## ## Allow link to the kernel key ring. ## ## ## ## Domain allowed access. ## ## # interface(`kernel_link_key',` gen_require(` type kernel_t; ') allow $1 kernel_t:key link; ') ######################################## ## ## dontaudit link to the kernel key ring. ## ## ## ## Domain allowed access. ## ## # interface(`kernel_dontaudit_link_key',` gen_require(` type kernel_t; ') dontaudit $1 kernel_t:key link; ') ######################################## ## ## Allows caller to read the ring buffer. ## ## ## ## The process type allowed to read the ring buffer. ## ## ## # interface(`kernel_read_ring_buffer',` gen_require(` type kernel_t; ') allow $1 kernel_t:system syslog_read; ') ######################################## ## ## Do not audit attempts to read the ring buffer. ## ## ## ## The domain to not audit. ## ## # interface(`kernel_dontaudit_read_ring_buffer',` gen_require(` type kernel_t; ') dontaudit $1 kernel_t:system syslog_read; ') ######################################## ## ## Change the level of kernel messages logged to the console. ## ## ## ## Domain allowed access. ## ## ## # interface(`kernel_change_ring_buffer_level',` gen_require(` type kernel_t; ') allow $1 kernel_t:system syslog_console; ') ######################################## ## ## Allows the caller to clear the ring buffer. ## ## ## ## The process type clearing the buffer. ## ## ## # interface(`kernel_clear_ring_buffer',` gen_require(` type kernel_t; ') allow $1 kernel_t:system syslog_mod; ') ######################################## ## ## Get information on all System V IPC objects. ## ## ## ## ## ## # interface(`kernel_get_sysvipc_info',` gen_require(` type kernel_t; ') allow $1 kernel_t:system ipc_info; ') ######################################## ## ## Get the attributes of a kernel debugging filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`kernel_getattr_debugfs',` gen_require(` type debugfs_t; ') allow $1 debugfs_t:filesystem getattr; ') ######################################## ## ## Mount a kernel debugging filesystem. ## ## ## ## The type of the domain mounting the filesystem. ## ## # interface(`kernel_mount_debugfs',` gen_require(` type debugfs_t; ') allow $1 debugfs_t:filesystem mount; ') ######################################## ## ## Unmount a kernel debugging filesystem. ## ## ## ## The type of the domain unmounting the filesystem. ## ## # interface(`kernel_unmount_debugfs',` gen_require(` type debugfs_t; ') allow $1 debugfs_t:filesystem unmount; ') ######################################## ## ## Remount a kernel debugging filesystem. ## ## ## ## The type of the domain remounting the filesystem. ## ## # interface(`kernel_remount_debugfs',` gen_require(` type debugfs_t; ') allow $1 debugfs_t:filesystem remount; ') ######################################## ## ## Search the contents of a kernel debugging filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`kernel_search_debugfs',` gen_require(` type debugfs_t; ') search_dirs_pattern($1,debugfs_t,debugfs_t) ') ######################################## ## ## Read information from the debugging filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`kernel_read_debugfs',` gen_require(` type debugfs_t; ') read_files_pattern($1,debugfs_t,debugfs_t) read_lnk_files_pattern($1,debugfs_t,debugfs_t) list_dirs_pattern($1,debugfs_t,debugfs_t) ') ######################################## ## ## Mount a kernel VM filesystem. ## ## ## ## The type of the domain mounting the filesystem. ## ## # interface(`kernel_mount_kvmfs',` gen_require(` type kvmfs_t; ') allow $1 kvmfs_t:filesystem mount; ') ######################################## ## ## Unmount the proc filesystem. ## ## ## ## The type of the domain unmounting the filesystem. ## ## # interface(`kernel_unmount_proc',` gen_require(` type proc_t; ') allow $1 proc_t:filesystem unmount; ') ######################################## ## ## Get the attributes of the proc filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`kernel_getattr_proc',` gen_require(` type proc_t; ') allow $1 proc_t:filesystem getattr; ') ######################################## ## ## Search directories in /proc. ## ## ## ## Domain allowed access. ## ## # interface(`kernel_search_proc',` gen_require(` type proc_t; ') search_dirs_pattern($1,proc_t,proc_t) ') ######################################## ## ## List the contents of directories in /proc. ## ## ## ## Domain allowed access. ## ## # interface(`kernel_list_proc',` gen_require(` type proc_t; ') list_dirs_pattern($1,proc_t,proc_t) ') ######################################## ## ## Do not audit attempts to list the ## contents of directories in /proc. ## ## ## ## Domain to not audit. ## ## # interface(`kernel_dontaudit_list_proc',` gen_require(` type proc_t; ') dontaudit $1 proc_t:dir list_dir_perms; ') ######################################## ## ## Get the attributes of files in /proc. ## ## ## ## Domain allowed access. ## ## # interface(`kernel_getattr_proc_files',` gen_require(` type proc_t; ') getattr_files_pattern($1,proc_t,proc_t) ') ######################################## ## ## Read symbolic links in /proc. ## ## ## ## Domain allowed access. ## ## # interface(`kernel_read_proc_symlinks',` gen_require(` type proc_t; ') read_lnk_files_pattern($1,proc_t,proc_t) ') ######################################## ## ## Allows caller to read system state information in proc. ## ## ## ## The process type reading the system state information. ## ## ## # interface(`kernel_read_system_state',` gen_require(` type proc_t; ') read_files_pattern($1,proc_t,proc_t) read_lnk_files_pattern($1,proc_t,proc_t) list_dirs_pattern($1,proc_t,proc_t) ') ######################################## ## ## Write to generic proc entries. ## ## ## ## Domain allowed access. ## ## ## # # cjp: this should probably go away. any # file thats writable in proc should really # have its own label. # interface(`kernel_write_proc_files',` gen_require(` type proc_t; ') write_files_pattern($1,proc_t,proc_t) ') ######################################## ## ## Do not audit attempts by caller to ## read system state information in proc. ## ## ## ## The process type not to audit. ## ## # interface(`kernel_dontaudit_read_system_state',` gen_require(` type proc_t; ') dontaudit $1 proc_t:file { getattr read }; ') ######################################## ## ## Do not audit attempts by caller to ## read system state information in proc. ## ## ## ## The process type not to audit. ## ## # interface(`kernel_dontaudit_read_proc_symlinks',` gen_require(` type proc_t; ') dontaudit $1 proc_t:lnk_file read; ') ####################################### ## ## Allow caller to read and write state information for AFS. ## ## ## ## Domain allowed access. ## ## ## # interface(`kernel_rw_afs_state',` gen_require(` type proc_t, proc_afs_t; ') list_dirs_pattern($1,proc_t,proc_t) rw_files_pattern($1,proc_afs_t,proc_afs_t) ') ####################################### ## ## Allow caller to read the state information for software raid. ## ## ## ## The process type reading software raid state. ## ## ## # interface(`kernel_read_software_raid_state',` gen_require(` type proc_t, proc_mdstat_t; ') read_files_pattern($1,proc_t,proc_mdstat_t) list_dirs_pattern($1,proc_t,proc_t) ') ####################################### ## ## Allow caller to read and set the state information for software raid. ## ## ## ## The process type reading software raid state. ## ## # interface(`kernel_rw_software_raid_state',` gen_require(` type proc_t, proc_mdstat_t; ') rw_files_pattern($1,proc_t,proc_mdstat_t) list_dirs_pattern($1,proc_t,proc_t) ') ######################################## ## ## Allows caller to get attribues of core kernel interface. ## ## ## ## The process type getting the attibutes. ## ## # interface(`kernel_getattr_core_if',` gen_require(` type proc_t, proc_kcore_t; ') getattr_files_pattern($1,proc_t,proc_kcore_t) list_dirs_pattern($1,proc_t,proc_t) ') ######################################## ## ## Do not audit attempts to get the attributes of ## core kernel interfaces. ## ## ## ## The process type to not audit. ## ## # interface(`kernel_dontaudit_getattr_core_if',` gen_require(` type proc_kcore_t; ') dontaudit $1 proc_kcore_t:file getattr; ') ######################################## ## ## Allow caller to read kernel messages ## using the /proc/kmsg interface. ## ## ## ## The process type reading the messages. ## ## # interface(`kernel_read_messages',` gen_require(` attribute can_receive_kernel_messages; type proc_kmsg_t, proc_t; ') read_files_pattern($1,proc_t,proc_kmsg_t) typeattribute $1 can_receive_kernel_messages; ') ######################################## ## ## Allow caller to get the attributes of kernel message ## interface (/proc/kmsg). ## ## ## ## The process type getting the attributes. ## ## # interface(`kernel_getattr_message_if',` gen_require(` type proc_kmsg_t, proc_t; ') getattr_files_pattern($1,proc_t,proc_kmsg_t) ') ######################################## ## ## Do not audit attempts by caller to get the attributes of kernel ## message interfaces. ## ## ## ## The process type not to audit. ## ## # interface(`kernel_dontaudit_getattr_message_if',` gen_require(` type proc_kmsg_t, proc_t; ') dontaudit $1 proc_kmsg_t:file getattr; ') ######################################## ## ## Do not audit attempts to search the network ## state directory. ## ## ## ## The process type reading the state. ## ## ## # interface(`kernel_dontaudit_search_network_state',` gen_require(` type proc_net_t; ') dontaudit $1 proc_net_t:dir search; ') ######################################## ## ## Allow searching of network state directory. ## ## ## ## The process type reading the state. ## ## ## # interface(`kernel_search_network_state',` gen_require(` type proc_net_t; ') search_dirs_pattern($1,proc_t,proc_net_t) ') ######################################## ## ## Allow caller to read the network state information. ## ## ## ## The process type reading the state. ## ## ## # interface(`kernel_read_network_state',` gen_require(` type proc_t, proc_net_t; ') read_files_pattern($1,{ proc_t proc_net_t },proc_net_t) read_lnk_files_pattern($1,{ proc_t proc_net_t },proc_net_t) list_dirs_pattern($1,proc_t,proc_net_t) ') ######################################## ## ## Allow caller to read the network state symbolic links. ## ## ## ## The process type reading the state. ## ## # interface(`kernel_read_network_state_symlinks',` gen_require(` type proc_t, proc_net_t; ') read_lnk_files_pattern($1,{ proc_t proc_net_t },proc_net_t) list_dirs_pattern($1,proc_t,proc_net_t) ') ######################################## ## ## Allow searching of xen state directory. ## ## ## ## The process type reading the state. ## ## ## # interface(`kernel_search_xen_state',` gen_require(` type proc_t, proc_xen_t; ') search_dirs_pattern($1,proc_t,proc_xen_t) ') ######################################## ## ## Do not audit attempts to search the xen ## state directory. ## ## ## ## The process type reading the state. ## ## ## # interface(`kernel_dontaudit_search_xen_state',` gen_require(` type proc_xen_t; ') dontaudit $1 proc_xen_t:dir search; ') ######################################## ## ## Allow caller to read the xen state information. ## ## ## ## The process type reading the state. ## ## ## # interface(`kernel_read_xen_state',` gen_require(` type proc_t, proc_xen_t; ') read_files_pattern($1,{ proc_t proc_xen_t },proc_xen_t) read_lnk_files_pattern($1,{ proc_t proc_xen_t },proc_xen_t) list_dirs_pattern($1,proc_t,proc_xen_t) ') ######################################## ## ## Allow caller to read the xen state symbolic links. ## ## ## ## The process type reading the state. ## ## ## # interface(`kernel_read_xen_state_symlinks',` gen_require(` type proc_t, proc_xen_t; ') read_lnk_files_pattern($1,{ proc_t proc_xen_t },proc_xen_t) list_dirs_pattern($1,proc_t,proc_xen_t) ') ######################################## ## ## Allow caller to write xen state information. ## ## ## ## The process type writing the state. ## ## ## # interface(`kernel_write_xen_state',` gen_require(` type proc_t, proc_xen_t; ') write_files_pattern($1,{ proc_t proc_xen_t },proc_xen_t) ') ######################################## ## ## Do not audit attempts to list all proc directories. ## ## ## ## Domain to not audit. ## ## # interface(`kernel_dontaudit_list_all_proc',` gen_require(` attribute proc_type; ') dontaudit $1 proc_type:dir list_dir_perms; ') ######################################## ## ## Do not audit attempts by caller to search ## the base directory of sysctls. ## ## ## ## The process type not to audit. ## ## ## # interface(`kernel_dontaudit_search_sysctl',` gen_require(` type sysctl_t; ') dontaudit $1 sysctl_t:dir search; ') ######################################## ## ## Allow access to read sysctl directories. ## ## ## ## The process type to allow to read sysctl directories. ## ## ## # interface(`kernel_read_sysctl',` gen_require(` type sysctl_t; ') list_dirs_pattern($1,proc_t,sysctl_t) ') ######################################## ## ## Allow caller to read the device sysctls. ## ## ## ## The process type to allow to read the device sysctls. ## ## ## # interface(`kernel_read_device_sysctls',` gen_require(` type proc_t, sysctl_t, sysctl_dev_t; ') read_files_pattern($1,{ proc_t sysctl_t sysctl_dev_t },sysctl_dev_t) list_dirs_pattern($1,{ proc_t sysctl_t },sysctl_dev_t) ') ######################################## ## ## Read and write device sysctls. ## ## ## ## Domain allowed access. ## ## ## # interface(`kernel_rw_device_sysctls',` gen_require(` type proc_t, sysctl_t, sysctl_dev_t; ') rw_files_pattern($1,{ proc_t sysctl_t sysctl_dev_t },sysctl_dev_t) list_dirs_pattern($1,{ proc_t sysctl_t },sysctl_dev_t) ') ######################################## ## ## Allow caller to search virtual memory sysctls. ## ## ## ## Domain allowed access. ## ## # interface(`kernel_search_vm_sysctl',` gen_require(` type proc_t, sysctl_t, sysctl_vm_t; ') search_dirs_pattern($1,{ proc_t sysctl_t },sysctl_vm_t) ') ######################################## ## ## Allow caller to read virtual memory sysctls. ## ## ## ## Domain allowed access. ## ## ## # interface(`kernel_read_vm_sysctls',` gen_require(` type proc_t, sysctl_t, sysctl_vm_t; ') read_files_pattern($1,{ proc_t sysctl_t sysctl_vm_t },sysctl_vm_t) list_dirs_pattern($1,{ proc_t sysctl_t },sysctl_vm_t) ') ######################################## ## ## Read and write virtual memory sysctls. ## ## ## ## Domain allowed access. ## ## ## # interface(`kernel_rw_vm_sysctls',` gen_require(` type proc_t, sysctl_t, sysctl_vm_t; ') rw_files_pattern($1,{ proc_t sysctl_t sysctl_vm_t },sysctl_vm_t) list_dirs_pattern($1,{ proc_t sysctl_t },sysctl_vm_t) # hal needs this allow $1 sysctl_vm_t:dir write; ') ######################################## ## ## Search network sysctl directories. ## ## ## ## Domain allowed access. ## ## # interface(`kernel_search_network_sysctl',` gen_require(` type proc_t, sysctl_t, sysctl_net_t; ') search_dirs_pattern($1,{ proc_t sysctl_t },sysctl_net_t) ') ######################################## ## ## Do not audit attempts by caller to search network sysctl directories. ## ## ## ## The process type not to audit. ## ## # interface(`kernel_dontaudit_search_network_sysctl',` gen_require(` type sysctl_net_t; ') dontaudit $1 sysctl_net_t:dir search; ') ######################################## ## ## Allow caller to read network sysctls. ## ## ## ## Domain allowed access. ## ## ## # interface(`kernel_read_net_sysctls',` gen_require(` type proc_t, sysctl_t, sysctl_net_t; ') read_files_pattern($1,{ proc_t sysctl_t sysctl_net_t },sysctl_net_t) list_dirs_pattern($1,{ proc_t sysctl_t },sysctl_net_t) ') ######################################## ## ## Allow caller to modiry contents of sysctl network files. ## ## ## ## Domain allowed access. ## ## ## # interface(`kernel_rw_net_sysctls',` gen_require(` type proc_t, sysctl_t, sysctl_net_t; ') rw_files_pattern($1,{ proc_t sysctl_t sysctl_net_t },sysctl_net_t) list_dirs_pattern($1,{ proc_t sysctl_t },sysctl_net_t) ') ######################################## ## ## Allow caller to read unix domain ## socket sysctls. ## ## ## ## Domain allowed access. ## ## ## # interface(`kernel_read_unix_sysctls',` gen_require(` type proc_t, sysctl_t, sysctl_net_t, sysctl_net_unix_t; ') read_files_pattern($1,{ proc_t sysctl_t sysctl_net_t },sysctl_net_unix_t) list_dirs_pattern($1,{ proc_t sysctl_t },sysctl_net_t) ') ######################################## ## ## Read and write unix domain ## socket sysctls. ## ## ## ## Domain allowed access. ## ## ## # interface(`kernel_rw_unix_sysctls',` gen_require(` type proc_t, sysctl_t, sysctl_net_t, sysctl_net_unix_t; ') rw_files_pattern($1,{ proc_t sysctl_t sysctl_net_t },sysctl_net_unix_t) list_dirs_pattern($1,{ proc_t sysctl_t },sysctl_net_t) ') ######################################## ## ## Read the hotplug sysctl. ## ## ## ## Domain allowed access. ## ## ## # interface(`kernel_read_hotplug_sysctls',` gen_require(` type proc_t, sysctl_t, sysctl_kernel_t, sysctl_hotplug_t; ') read_files_pattern($1,{ proc_t sysctl_t sysctl_kernel_t },sysctl_hotplug_t) list_dirs_pattern($1,{ proc_t sysctl_t },sysctl_kernel_t) ') ######################################## ## ## Read and write the hotplug sysctl. ## ## ## ## Domain allowed access. ## ## ## # interface(`kernel_rw_hotplug_sysctls',` gen_require(` type proc_t, sysctl_t, sysctl_kernel_t, sysctl_hotplug_t; ') rw_files_pattern($1,{ proc_t sysctl_t sysctl_kernel_t },sysctl_hotplug_t) list_dirs_pattern($1,{ proc_t sysctl_t },sysctl_kernel_t) ') ######################################## ## ## Read the modprobe sysctl. ## ## ## ## Domain allowed access. ## ## ## # interface(`kernel_read_modprobe_sysctls',` gen_require(` type proc_t, sysctl_t, sysctl_kernel_t, sysctl_modprobe_t; ') read_files_pattern($1,{ proc_t sysctl_t sysctl_kernel_t },sysctl_modprobe_t) list_dirs_pattern($1,{ proc_t sysctl_t },sysctl_kernel_t) ') ######################################## ## ## Read and write the modprobe sysctl. ## ## ## ## Domain allowed access. ## ## ## # interface(`kernel_rw_modprobe_sysctls',` gen_require(` type proc_t, sysctl_t, sysctl_kernel_t, sysctl_modprobe_t; ') rw_files_pattern($1,{ proc_t sysctl_t sysctl_kernel_t },sysctl_modprobe_t) list_dirs_pattern($1,{ proc_t sysctl_t },sysctl_kernel_t) ') ######################################## ## ## Do not audit attempts to search generic kernel sysctls. ## ## ## ## Domain to not audit. ## ## # interface(`kernel_dontaudit_search_kernel_sysctl',` gen_require(` type sysctl_kernel_t; ') dontaudit $1 sysctl_kernel_t:dir search; ') ######################################## ## ## Read generic kernel sysctls. ## ## ## ## Domain allowed access. ## ## # interface(`kernel_read_kernel_sysctls',` gen_require(` type proc_t, sysctl_t, sysctl_kernel_t; ') read_files_pattern($1,{ proc_t sysctl_t sysctl_kernel_t },sysctl_kernel_t) list_dirs_pattern($1,{ proc_t sysctl_t },sysctl_kernel_t) ') ######################################## ## ## Do not audit attempts to write generic kernel sysctls. ## ## ## ## Domain to not audit. ## ## # interface(`kernel_dontaudit_write_kernel_sysctl',` gen_require(` type sysctl_kernel_t; ') dontaudit $1 sysctl_kernel_t:file write; ') ######################################## ## ## Read and write generic kernel sysctls. ## ## ## ## Domain allowed access. ## ## ## # interface(`kernel_rw_kernel_sysctl',` gen_require(` type proc_t, sysctl_t, sysctl_kernel_t; ') rw_files_pattern($1,{ proc_t sysctl_t sysctl_kernel_t },sysctl_kernel_t) list_dirs_pattern($1,{ proc_t sysctl_t },sysctl_kernel_t) ') ######################################## ## ## Read filesystem sysctls. ## ## ## ## Domain allowed access. ## ## ## # interface(`kernel_read_fs_sysctls',` gen_require(` type proc_t, sysctl_t, sysctl_fs_t; ') read_files_pattern($1,{ proc_t sysctl_t sysctl_fs_t },sysctl_fs_t) list_dirs_pattern($1,{ proc_t sysctl_t },sysctl_fs_t) ') ######################################## ## ## Read and write fileystem sysctls. ## ## ## ## Domain allowed access. ## ## ## # interface(`kernel_rw_fs_sysctls',` gen_require(` type proc_t, sysctl_t, sysctl_fs_t; ') rw_files_pattern($1,{ proc_t sysctl_t sysctl_fs_t },sysctl_fs_t) list_dirs_pattern($1,{ proc_t sysctl_t },sysctl_fs_t) ') ######################################## ## ## Read IRQ sysctls. ## ## ## ## Domain allowed access. ## ## ## # interface(`kernel_read_irq_sysctls',` gen_require(` type proc_t, sysctl_irq_t; ') read_files_pattern($1,{ proc_t sysctl_irq_t },sysctl_irq_t) list_dirs_pattern($1,proc_t,sysctl_irq_t) ') ######################################## ## ## Read and write IRQ sysctls. ## ## ## ## Domain allowed access. ## ## ## # interface(`kernel_rw_irq_sysctls',` gen_require(` type proc_t, sysctl_irq_t; ') rw_files_pattern($1,{ proc_t sysctl_irq_t },sysctl_irq_t) list_dirs_pattern($1,proc_t,sysctl_irq_t) ') ######################################## ## ## Read RPC sysctls. ## ## ## ## Domain allowed access. ## ## ## # interface(`kernel_read_rpc_sysctls',` gen_require(` type proc_t, proc_net_t, sysctl_rpc_t; ') read_files_pattern($1,{ proc_t proc_net_t sysctl_rpc_t },sysctl_rpc_t) list_dirs_pattern($1,{ proc_t proc_net_t },sysctl_rpc_t) ') ######################################## ## ## Read and write RPC sysctls. ## ## ## ## Domain allowed access. ## ## ## # interface(`kernel_rw_rpc_sysctls',` gen_require(` type proc_t, proc_net_t, sysctl_rpc_t; ') rw_files_pattern($1,{ proc_t proc_net_t sysctl_rpc_t },sysctl_rpc_t) list_dirs_pattern($1,{ proc_t proc_net_t },sysctl_rpc_t) ') ######################################## ## ## Do not audit attempts to list all sysctl directories. ## ## ## ## Domain to not audit. ## ## # interface(`kernel_dontaudit_list_all_sysctls',` gen_require(` attribute sysctl_type; ') dontaudit $1 sysctl_type:dir list_dir_perms; ') ######################################## ## ## Allow caller to read all sysctls. ## ## ## ## Domain allowed access. ## ## ## # interface(`kernel_read_all_sysctls',` gen_require(` attribute sysctl_type; type proc_t, proc_net_t; ') # proc_net_t for /proc/net/rpc sysctls read_files_pattern($1,{ proc_t proc_net_t sysctl_type },sysctl_type) list_dirs_pattern($1,{ proc_t proc_net_t },sysctl_type) ') ######################################## ## ## Read and write all sysctls. ## ## ## ## Domain allowed access. ## ## ## # interface(`kernel_rw_all_sysctls',` gen_require(` attribute sysctl_type; type proc_t, proc_net_t; ') # proc_net_t for /proc/net/rpc sysctls rw_files_pattern($1,{ proc_t proc_net_t sysctl_type },sysctl_type) allow $1 sysctl_type:dir list_dir_perms; # why is setattr needed? allow $1 sysctl_type:file setattr; ') ######################################## ## ## Send a kill signal to unlabeled processes. ## ## ## ## Domain allowed access. ## ## # interface(`kernel_kill_unlabeled',` gen_require(` type unlabeled_t; ') allow $1 unlabeled_t:process sigkill; ') ######################################## ## ## Send general signals to unlabeled processes. ## ## ## ## Domain allowed access. ## ## # interface(`kernel_signal_unlabeled',` gen_require(` type unlabeled_t; ') allow $1 unlabeled_t:process signal; ') ######################################## ## ## Send a null signal to unlabeled processes. ## ## ## ## Domain allowed access. ## ## # interface(`kernel_signull_unlabeled',` gen_require(` type unlabeled_t; ') allow $1 unlabeled_t:process signull; ') ######################################## ## ## Send a stop signal to unlabeled processes. ## ## ## ## Domain allowed access. ## ## # interface(`kernel_sigstop_unlabeled',` gen_require(` type unlabeled_t; ') allow $1 unlabeled_t:process sigstop; ') ######################################## ## ## Send a child terminated signal to unlabeled processes. ## ## ## ## Domain allowed access. ## ## # interface(`kernel_sigchld_unlabeled',` gen_require(` type unlabeled_t; ') allow $1 unlabeled_t:process sigchld; ') ######################################## ## ## List unlabeled directories. ## ## ## ## Domain allowed access. ## ## # interface(`kernel_list_unlabeled',` gen_require(` type unlabeled_t; ') allow $1 unlabeled_t:dir list_dir_perms; ') ######################################## ## ## Read the process state (/proc/pid) of all unlabeled_t. ## ## ## ## Domain allowed access. ## ## # interface(`kernel_read_unlabeled_state',` gen_require(` type unlabeled_t; ') allow $1 unlabeled_t:dir list_dir_perms; read_files_pattern($1,unlabeled_t,unlabeled_t) read_lnk_files_pattern($1,unlabeled_t,unlabeled_t) ') ######################################## ## ## Do not audit attempts to list unlabeled directories. ## ## ## ## Domain allowed access. ## ## # interface(`kernel_dontaudit_list_unlabeled',` gen_require(` type unlabeled_t; ') dontaudit $1 unlabeled_t:dir list_dir_perms; ') ######################################## ## ## Read and write unlabeled directories. ## ## ## ## Domain allowed access. ## ## # interface(`kernel_rw_unlabeled_dirs',` gen_require(` type unlabeled_t; ') allow $1 unlabeled_t:dir rw_dir_perms; ') ######################################## ## ## Do not audit attempts by caller to get the ## attributes of an unlabeled file. ## ## ## ## The process type not to audit. ## ## # interface(`kernel_dontaudit_getattr_unlabeled_files',` gen_require(` type unlabeled_t; ') dontaudit $1 unlabeled_t:file getattr; ') ######################################## ## ## Do not audit attempts by caller to ## read an unlabeled file. ## ## ## ## Domain to not audit. ## ## # interface(`kernel_dontaudit_read_unlabeled_files',` gen_require(` type unlabeled_t; ') dontaudit $1 unlabeled_t:file { getattr read }; ') ######################################## ## ## Do not audit attempts by caller to get the ## attributes of unlabeled symbolic links. ## ## ## ## The process type not to audit. ## ## # interface(`kernel_dontaudit_getattr_unlabeled_symlinks',` gen_require(` type unlabeled_t; ') dontaudit $1 unlabeled_t:lnk_file getattr; ') ######################################## ## ## Do not audit attempts by caller to get the ## attributes of unlabeled named pipes. ## ## ## ## The process type not to audit. ## ## # interface(`kernel_dontaudit_getattr_unlabeled_pipes',` gen_require(` type unlabeled_t; ') dontaudit $1 unlabeled_t:fifo_file getattr; ') ######################################## ## ## Do not audit attempts by caller to get the ## attributes of unlabeled named sockets. ## ## ## ## The process type not to audit. ## ## # interface(`kernel_dontaudit_getattr_unlabeled_sockets',` gen_require(` type unlabeled_t; ') dontaudit $1 unlabeled_t:sock_file getattr; ') ######################################## ## ## Do not audit attempts by caller to get attributes for ## unlabeled block devices. ## ## ## ## The process type not to audit. ## ## # interface(`kernel_dontaudit_getattr_unlabeled_blk_files',` gen_require(` type unlabeled_t; ') dontaudit $1 unlabeled_t:blk_file getattr; ') ######################################## ## ## Read and write unlabeled block device nodes. ## ## ## ## Domain allowed access. ## ## # interface(`kernel_rw_unlabeled_blk_files',` gen_require(` type unlabeled_t; ') allow $1 unlabeled_t:blk_file getattr; ') ######################################## ## ## Do not audit attempts by caller to get attributes for ## unlabeled character devices. ## ## ## ## The process type not to audit. ## ## # interface(`kernel_dontaudit_getattr_unlabeled_chr_files',` gen_require(` type unlabeled_t; ') dontaudit $1 unlabeled_t:chr_file getattr; ') ######################################## ## ## Allow caller to relabel unlabeled directories. ## ## ## ## Domain allowed access. ## ## # interface(`kernel_relabelfrom_unlabeled_dirs',` gen_require(` type unlabeled_t; ') allow $1 unlabeled_t:dir { getattr search read relabelfrom }; ') ######################################## ## ## Allow caller to relabel unlabeled files. ## ## ## ## Domain allowed access. ## ## # interface(`kernel_relabelfrom_unlabeled_files',` gen_require(` type unlabeled_t; ') kernel_list_unlabeled($1) allow $1 unlabeled_t:file { getattr relabelfrom }; ') ######################################## ## ## Allow caller to relabel unlabeled symbolic links. ## ## ## ## Domain allowed access. ## ## # interface(`kernel_relabelfrom_unlabeled_symlinks',` gen_require(` type unlabeled_t; ') kernel_list_unlabeled($1) allow $1 unlabeled_t:lnk_file { getattr relabelfrom }; ') ######################################## ## ## Allow caller to relabel unlabeled named pipes. ## ## ## ## Domain allowed access. ## ## # interface(`kernel_relabelfrom_unlabeled_pipes',` gen_require(` type unlabeled_t; ') kernel_list_unlabeled($1) allow $1 unlabeled_t:fifo_file { getattr relabelfrom }; ') ######################################## ## ## Allow caller to relabel unlabeled named sockets. ## ## ## ## Domain allowed access. ## ## # interface(`kernel_relabelfrom_unlabeled_sockets',` gen_require(` type unlabeled_t; ') kernel_list_unlabeled($1) allow $1 unlabeled_t:sock_file { getattr relabelfrom }; ') ######################################## ## ## Send and receive messages from an ## unlabeled IPSEC association. ## ## ##

## Send and receive messages from an ## unlabeled IPSEC association. Network ## connections that are not protected ## by IPSEC have use an unlabeled ## assocation. ##

##

## The corenetwork interface ## corenet_non_ipsec_sendrecv() should ## be used instead of this one. ##

##
## ## ## Domain allowed access. ## ## # interface(`kernel_sendrecv_unlabeled_association',` gen_require(` type unlabeled_t; ') allow $1 unlabeled_t:association { sendto recvfrom }; # temporary hack until labeling on packets is supported allow $1 unlabeled_t:packet { send recv }; ') ######################################## ## ## Do not audit attempts to send and receive messages ## from an unlabeled IPSEC association. ## ## ##

## Do not audit attempts to send and receive messages ## from an unlabeled IPSEC association. Network ## connections that are not protected ## by IPSEC have use an unlabeled ## assocation. ##

##

## The corenetwork interface ## corenet_dontaudit_non_ipsec_sendrecv() should ## be used instead of this one. ##

##
## ## ## Domain to not audit. ## ## # interface(`kernel_dontaudit_sendrecv_unlabeled_association',` gen_require(` type unlabeled_t; ') dontaudit $1 unlabeled_t:association { sendto recvfrom }; ') ######################################## ## ## Receive TCP packets from an unlabeled connection. ## ## ##

## Receive TCP packets from an unlabeled connection. ##

##

## The corenetwork interface corenet_tcp_recv_unlabeled() should ## be used instead of this one. ##

##
## ## ## Domain allowed access. ## ## # interface(`kernel_tcp_recvfrom_unlabeled',` gen_require(` type unlabeled_t; ') allow $1 unlabeled_t:tcp_socket recvfrom; ') ######################################## ## ## Do not audit attempts to receive TCP packets from an unlabeled ## connection. ## ## ##

## Do not audit attempts to receive TCP packets from an unlabeled ## connection. ##

##

## The corenetwork interface corenet_dontaudit_tcp_recv_unlabeled() ## should be used instead of this one. ##

##
## ## ## Domain to not audit. ## ## # interface(`kernel_dontaudit_tcp_recvfrom_unlabeled',` gen_require(` type unlabeled_t; ') dontaudit $1 unlabeled_t:tcp_socket recvfrom; ') ######################################## ## ## Receive UDP packets from an unlabeled connection. ## ## ##

## Receive UDP packets from an unlabeled connection. ##

##

## The corenetwork interface corenet_udp_recv_unlabeled() should ## be used instead of this one. ##

##
## ## ## Domain allowed access. ## ## # interface(`kernel_udp_recvfrom_unlabeled',` gen_require(` type unlabeled_t; ') allow $1 unlabeled_t:udp_socket recvfrom; ') ######################################## ## ## Do not audit attempts to receive UDP packets from an unlabeled ## connection. ## ## ##

## Do not audit attempts to receive UDP packets from an unlabeled ## connection. ##

##

## The corenetwork interface corenet_dontaudit_udp_recv_unlabeled() ## should be used instead of this one. ##

##
## ## ## Domain to not audit. ## ## # interface(`kernel_dontaudit_udp_recvfrom_unlabeled',` gen_require(` type unlabeled_t; ') dontaudit $1 unlabeled_t:udp_socket recvfrom; ') ######################################## ## ## Receive Raw IP packets from an unlabeled connection. ## ## ##

## Receive Raw IP packets from an unlabeled connection. ##

##

## The corenetwork interface corenet_raw_recv_unlabeled() should ## be used instead of this one. ##

##
## ## ## Domain allowed access. ## ## # interface(`kernel_raw_recvfrom_unlabeled',` gen_require(` type unlabeled_t; ') allow $1 unlabeled_t:rawip_socket recvfrom; ') ######################################## ## ## Do not audit attempts to receive Raw IP packets from an unlabeled ## connection. ## ## ##

## Do not audit attempts to receive Raw IP packets from an unlabeled ## connection. ##

##

## The corenetwork interface corenet_dontaudit_raw_recv_unlabeled() ## should be used instead of this one. ##

##
## ## ## Domain to not audit. ## ## # interface(`kernel_dontaudit_raw_recvfrom_unlabeled',` gen_require(` type unlabeled_t; ') dontaudit $1 unlabeled_t:rawip_socket recvfrom; ') ######################################## ## ## Send and receive unlabeled packets. ## ## ##

## Send and receive unlabeled packets. ## These packets do not match any netfilter ## SECMARK rules. ##

##

## The corenetwork interface ## corenet_sendrecv_unlabeled_packets() should ## be used instead of this one. ##

##
## ## ## Domain allowed access. ## ## # interface(`kernel_sendrecv_unlabeled_packets',` gen_require(` type unlabeled_t; ') allow $1 unlabeled_t:packet { send recv }; ') ######################################## ## ## Receive packets from an unlabeled peer. ## ## ##

## Receive packets from an unlabeled peer, these packets do not have any ## peer labeling information present. ##

##

## The corenetwork interface corenet_recvfrom_unlabeled_peer() should ## be used instead of this one. ##

##
## ## ## Domain allowed access. ## ## # interface(`kernel_recvfrom_unlabeled_peer',` gen_require(` type unlabeled_t; ') allow $1 unlabeled_t:peer recv; ') ######################################## ## ## Do not audit attempts to receive packets from an unlabeled peer. ## ## ##

## Do not audit attempts to receive packets from an unlabeled peer, ## these packets do not have any peer labeling information present. ##

##

## The corenetwork interface corenet_dontaudit_*_recvfrom_unlabeled() ## should be used instead of this one. ##

##
## ## ## Domain to not audit. ## ## # interface(`kernel_dontaudit_recvfrom_unlabeled_peer',` gen_require(` type unlabeled_t; ') dontaudit $1 unlabeled_t:peer recv; ') ######################################## ## ## Unconfined access to kernel module resources. ## ## ## ## Domain allowed access. ## ## # interface(`kernel_unconfined',` gen_require(` attribute kern_unconfined; ') typeattribute $1 kern_unconfined; ')