## ## Policy for kernel threads, proc filesystem,and unlabeled processes and objects. ## ## ## This module has initial SIDs. ## ######################################## ## ## Allows to start userland processes ## by transitioning to the specified domain. ## ## ## The process type entered by kernel. ## ## ## The executable type for the entrypoint. ## # interface(`kernel_userland_entry',` gen_require(` type kernel_t; class process sigchld; class fifo_file rw_file_perms; class fd use; ') domain_auto_trans(kernel_t, $2, $1) allow kernel_t $1:fd use; allow $1 kernel_t:fd use; allow $1 kernel_t:fifo_file rw_file_perms; allow $1 kernel_t:process sigchld; ') ######################################## ## ## Allows the kernel to mount filesystems on ## the specified directory type. ## ## ## The type of the directory to use as a mountpoint. ## # interface(`kernel_rootfs_mountpoint',` gen_require(` type kernel_t; class dir mounton; ') allow kernel_t $1:dir mounton; ') ######################################## ## ## Set the process group of kernel threads. ## ## ## Domain allowed access. ## # interface(`kernel_setpgid',` gen_require(` type kernel_t; class process setpgid; ') allow $1 kernel_t:process setpgid; ') ######################################## ## ## Send a SIGCHLD signal to kernel threads. ## ## ## The type of the process sending the signal. ## # interface(`kernel_sigchld',` gen_require(` type kernel_t; class process sigchld; ') allow $1 kernel_t:process sigchld; ') ######################################## ## ## Send a generic signal to kernel threads. ## ## ## The type of the process sending the signal. ## # interface(`kernel_signal',` gen_require(` type kernel_t; class process signal; ') allow kernel_t $1:process signal; ') ######################################## ## ## Allows the kernel to share state information with ## the caller. ## ## ## The type of the process with which to share state information. ## # interface(`kernel_share_state',` gen_require(` type kernel_t; class process share; ') allow kernel_t $1:process share; ') ######################################## ## ## Permits caller to use kernel file descriptors. ## ## ## The type of the process using the descriptors. ## # interface(`kernel_use_fd',` gen_require(` type kernel_t; class fd use; ') allow $1 kernel_t:fd use; ') ######################################## ## ## Do not audit attempts to use ## kernel file descriptors. ## ## ## The type of process not to audit. ## # interface(`kernel_dontaudit_use_fd',` gen_require(` type kernel_t; class fd use; ') dontaudit $1 kernel_t:fd use; ') ######################################## ## ## Read and write kernel unnamed pipes. ## ## ## Domain allowed access. ## # interface(`kernel_rw_pipe',` gen_require(` type kernel_t; class fifo_file { read write }; ') allow $1 kernel_t:fifo_file { read write }; ') ######################################## ## ## Read and write kernel unix datagram sockets. ## ## ## Domain allowed access. ## # interface(`kernel_rw_unix_dgram_socket',` gen_require(` type kernel_t; class unix_dgram_socket { read write ioctl }; ') allow $1 kernel_t:unix_dgram_socket { read write ioctl }; ') ######################################## ## ## Send messages to kernel unix datagram sockets. ## ## ## Domain allowed access. ## # interface(`kernel_sendto_unix_dgram_socket',` gen_require(` type kernel_t; class unix_dgram_socket sendto; ') allow $1 kernel_t:unix_dgram_socket sendto; ') ######################################## ## ## Receive messages from kernel TCP sockets. ## ## ## Domain allowed access. ## # interface(`kernel_tcp_recvfrom',` gen_require(` type kernel_t; class tcp_socket recvfrom; ') allow $1 kernel_t:tcp_socket recvfrom; ') ######################################## ## ## Receive messages from kernel UDP sockets. ## ## ## Domain allowed access. ## # interface(`kernel_udp_recvfrom',` gen_require(` type kernel_t; class udp_socket recvfrom; ') allow $1 kernel_t:udp_socket recvfrom; ') ######################################## ## ## Allows caller to load kernel modules ## ## ## The process type to allow to load kernel modules. ## # interface(`kernel_load_module',` gen_require(` attribute can_load_kernmodule; class capability sys_module; ') allow $1 self:capability sys_module; typeattribute $1 can_load_kernmodule; ') ######################################## ## ## Allows caller to read the ring buffer. ## ## ## The process type allowed to read the ring buffer. ## # interface(`kernel_read_ring_buffer',` gen_require(` type kernel_t; class system syslog_read; ') allow $1 kernel_t:system syslog_read; ') ######################################## ## ## Do not audit attempts to read the ring buffer. ## ## ## The domain to not audit. ## # interface(`kernel_dontaudit_read_ring_buffer',` gen_require(` type kernel_t; class system syslog_read; ') dontaudit $1 kernel_t:system syslog_read; ') ######################################## ## ## Change the level of kernel messages logged to the console. ## ## ## Domain allowed access. ## # interface(`kernel_change_ring_buffer_level',` gen_require(` type kernel_t; class system syslog_console; ') allow $1 kernel_t:system syslog_console; ') ######################################## ## ## Allows the caller to clear the ring buffer. ## ## ## The process type clearing the buffer. ## # interface(`kernel_clear_ring_buffer',` gen_require(` type kernel_t; class system syslog_mod; ') allow $1 kernel_t:system syslog_mod; ') ######################################## ## ## Get information on all System V IPC objects. ## ## ## ## # interface(`kernel_get_sysvipc_info',` gen_require(` type kernel_t; class system ipc_info; ') allow $1 kernel_t:system ipc_info; ') ######################################## ## ## Get the attributes of a kernel debugging filesystem. ## ## ## Domain allowed access. ## # interface(`kernel_getattr_debugfs',` gen_require(` type debugfs_t; ') allow $1 debugfs_t:filesystem getattr; ') ######################################## ## ## Mount a kernel debugging filesystem. ## ## ## The type of the domain mounting the filesystem. ## # interface(`kernel_mount_debugfs',` gen_require(` type debugfs_t; ') allow $1 debugfs_t:filesystem mount; ') ######################################## ## ## Unmount a kernel debugging filesystem. ## ## ## The type of the domain unmounting the filesystem. ## # interface(`kernel_unmount_debugfs',` gen_require(` type debugfs_t; ') allow $1 debugfs_t:filesystem unmount; ') ######################################## ## ## Remount a kernel debugging filesystem. ## ## ## The type of the domain remounting the filesystem. ## # interface(`kernel_remount_debugfs',` gen_require(` type debugfs_t; ') allow $1 debugfs_t:filesystem remount; ') ######################################## ## ## Search the contents of a kernel debugging filesystem. ## ## ## Domain allowed access. ## # interface(`kernel_search_debugfs',` gen_require(` type debugfs_t; ') allow $1 debugfs_t:dir search; ') ######################################## ## ## Read information from the debugging filesystem. ## ## ## Domain allowed access. ## # interface(`kernel_read_debugfs',` gen_require(` type debugfs_t; ') allow $1 debugfs_t:dir r_file_perms; allow $1 debugfs_t:file r_file_perms; allow $1 debugfs_t:lnk_file { getattr read }; ') ######################################## ## ## Get the attributes of the proc filesystem. ## ## ## Domain allowed access. ## # interface(`kernel_getattr_proc',` gen_require(` type proc_t; class filesystem getattr; ') allow $1 proc_t:filesystem getattr; ') ######################################## ## ## Search directories in /proc. ## ## ## Domain allowed access. ## # interface(`kernel_search_proc',` gen_require(` type proc_t; class dir search; ') allow $1 proc_t:dir search; ') ######################################## ## ## List the contents of directories in /proc. ## ## ## Domain allowed access. ## # interface(`kernel_list_proc',` gen_require(` type proc_t; class dir r_dir_perms; ') allow $1 proc_t:dir r_dir_perms; ') ######################################## ## ## Do not audit attempts to list the ## contents of directories in /proc. ## ## ## Domain to not audit. ## # interface(`kernel_dontaudit_list_proc',` gen_require(` type proc_t; ') dontaudit $1 proc_t:dir list_dir_perms; ') ######################################## ## ## Get the attributes of files in /proc. ## ## ## Domain allowed access. ## # interface(`kernel_getattr_proc_files',` gen_require(` type proc_t; ') allow $1 proc_t:dir search; allow $1 proc_t:file getattr; ') ######################################## ## ## Read symbolic links in /proc. ## ## ## Domain allowed access. ## # interface(`kernel_read_proc_symlinks',` gen_require(` type proc_t; class dir search; class lnk_file { getattr read }; ') allow $1 proc_t:dir search; allow $1 proc_t:lnk_file { getattr read }; ') ######################################## ## ## Allows caller to read system state information in proc. ## ## ## The process type reading the system state information. ## # interface(`kernel_read_system_state',` gen_require(` type proc_t; ') allow $1 proc_t:dir r_dir_perms; allow $1 proc_t:lnk_file { getattr read }; allow $1 proc_t:file r_file_perms; ') ######################################## ## ## Write to generic proc entries. ## ## ## Domain allowed access. ## # # cjp: this should probably go away. any # file thats writable in proc should really # have its own label. # interface(`kernel_write_proc_file',` gen_require(` type proc_t; ') allow $1 proc_t:dir search; allow $1 proc_t:file { append write }; ') ######################################## ## ## Do not audit attempts by caller to ## read system state information in proc. ## ## ## The process type not to audit. ## # interface(`kernel_dontaudit_read_system_state',` gen_require(` type proc_t; class file read; ') dontaudit $1 proc_t:file read; ') ######################################## ## ## Do not audit attempts by caller to ## read system state information in proc. ## ## ## The process type not to audit. ## # interface(`kernel_dontaudit_read_proc_symlink',` gen_require(` type proc_t; class lnk_file read; ') dontaudit $1 proc_t:lnk_file read; ') ####################################### ## ## Allow caller to read the state information for software raid. ## ## ## The process type reading software raid state. ## # interface(`kernel_read_software_raid_state',` gen_require(` type proc_t, proc_mdstat_t; class dir r_dir_perms; class file r_file_perms; ') allow $1 proc_t:dir r_dir_perms; allow $1 proc_mdstat_t:file r_file_perms; ') ####################################### ## ## Allow caller to read and set the state information for software raid. ## ## ## The process type reading software raid state. ## # interface(`kernel_rw_software_raid_state',` gen_require(` type proc_t, proc_mdstat_t; class dir r_dir_perms; class file rw_file_perms; ') allow $1 proc_t:dir r_dir_perms; allow $1 proc_mdstat_t:file rw_file_perms; ') ######################################## ## ## Allows caller to get attribues of core kernel interface. ## ## ## The process type getting the attibutes. ## # interface(`kernel_getattr_core',` gen_require(` type proc_t, proc_kcore_t; class dir { search getattr read }; class file getattr; ') allow $1 proc_t:dir r_dir_perms; allow $1 proc_kcore_t:file getattr; ') ######################################## ## ## Do not audit attempts to get the attributes of ## core kernel interfaces. ## ## ## The process type to not audit. ## # interface(`kernel_dontaudit_getattr_core',` gen_require(` type proc_kcore_t; class file getattr; ') dontaudit $1 proc_kcore_t:file getattr; ') ######################################## ## ## Allow caller to read kernel messages ## using the /proc/kmsg interface. ## ## ## The process type reading the messages. ## # interface(`kernel_read_messages',` gen_require(` attribute can_receive_kernel_messages; type proc_kmsg_t, proc_t; class dir search; class file r_file_perms; ') allow $1 proc_t:dir search; allow $1 proc_kmsg_t:file r_file_perms; typeattribute $1 can_receive_kernel_messages; ') ######################################## ## ## Allow caller to get the attributes of kernel message ## interface (/proc/kmsg). ## ## ## The process type getting the attributes. ## # interface(`kernel_getattr_message_if',` gen_require(` type proc_kmsg_t, proc_t; class dir search; class file getattr; ') allow $1 proc_t:dir search; allow $1 proc_kmsg_t:file getattr; ') ######################################## ## ## Do not audit attempts by caller to get the attributes of kernel ## message interfaces. ## ## ## The process type not to audit. ## # interface(`kernel_dontaudit_getattr_message_if',` gen_require(` type proc_kmsg_t, proc_t; class file getattr; ') dontaudit $1 proc_kmsg_t:file getattr; ') ######################################## ## ## Do not audit attempts to search the network ## state directory. ## ## ## The process type reading the state. ## ## # interface(`kernel_dontaudit_search_network_state',` gen_require(` type proc_net_t; class dir search; ') dontaudit $1 proc_net_t:dir search; ') ######################################## ## ## Allow searching of network state directory. ## ## ## The process type reading the state. ## ## # interface(`kernel_search_network_state',` gen_require(` type proc_net_t; ') allow $1 proc_net_t:dir search; ') ######################################## ## ## Allow caller to read the network state information. ## ## ## The process type reading the state. ## ## # interface(`kernel_read_network_state',` gen_require(` type proc_t, proc_net_t; ') allow $1 proc_t:dir search; allow $1 proc_net_t:dir r_dir_perms; allow $1 proc_net_t:file r_file_perms; allow $1 proc_net_t:lnk_file { getattr read }; ') ######################################## ## ## Allow caller to read the network state symbolic links. ## ## ## The process type reading the state. ## ## # interface(`kernel_read_network_state_symlinks',` gen_require(` type proc_t, proc_net_t; class dir r_dir_perms; class lnk_file r_file_perms; ') allow $1 proc_t:dir search; allow $1 proc_net_t:dir r_dir_perms; allow $1 proc_net_t:lnk_file r_file_perms; ') ######################################## ## ## Do not audit attempts by caller to search ## the base directory of sysctls. ## ## ## The process type not to audit. ## ## # interface(`kernel_dontaudit_search_sysctl',` gen_require(` type sysctl_t; ') dontaudit $1 sysctl_t:dir search; ') ######################################## ## ## Allow access to read sysctl directories. ## ## ## The process type to allow to read sysctl directories. ## ## # interface(`kernel_read_sysctl',` gen_require(` type sysctl_t; class dir r_dir_perms; ') allow $1 sysctl_t:dir r_dir_perms; ') ######################################## ## ## Allow caller to read the device sysctls. ## ## ## The process type to allow to read the device sysctls. ## # interface(`kernel_read_device_sysctl',` gen_require(` type proc_t, sysctl_t, sysctl_dev_t; ') allow $1 proc_t:dir search; allow $1 sysctl_t:dir r_dir_perms; allow $1 sysctl_dev_t:dir r_dir_perms; allow $1 sysctl_dev_t:file r_file_perms; ') ######################################## ## ## Read and write device sysctls. ## ## ## Domain allowed access. ## # interface(`kernel_rw_device_sysctl',` gen_require(` type proc_t, sysctl_t, sysctl_dev_t; ') allow $1 proc_t:dir search; allow $1 sysctl_t:dir r_dir_perms; allow $1 sysctl_dev_t:file rw_file_perms; ') ######################################## ## ## Allow caller to search virtual memory sysctls. ## ## ## Domain allowed access. ## ## # interface(`kernel_search_vm_sysctl',` gen_require(` type proc_t, sysctl_t, sysctl_vm_t; ') allow $1 { proc_t sysctl_t sysctl_vm_t }:dir search_dir_perms; ') ######################################## ## ## Allow caller to read virtual memory sysctls. ## ## ## Domain allowed access. ## ## # interface(`kernel_read_vm_sysctl',` gen_require(` type proc_t, sysctl_t, sysctl_vm_t; ') allow $1 proc_t:dir search; allow $1 sysctl_t:dir r_dir_perms; allow $1 sysctl_vm_t:file r_file_perms; ') ######################################## ## ## Read and write virtual memory sysctls. ## ## ## Domain allowed access. ## # interface(`kernel_rw_vm_sysctl',` gen_require(` type proc_t, sysctl_t, sysctl_vm_t; ') allow $1 proc_t:dir search; allow $1 sysctl_t:dir r_dir_perms; allow $1 sysctl_vm_t:file rw_file_perms; ') ######################################## ## ## Search network sysctl directories. ## ## ## Domain allowed access. ## # interface(`kernel_search_network_sysctl',` gen_require(` type proc_t, sysctl_t, sysctl_net_t; ') allow $1 { proc_t sysctl_t sysctl_net_t }:dir search; ') ######################################## ## ## Do not audit attempts by caller to search network sysctl directories. ## ## ## The process type not to audit. ## # interface(`kernel_dontaudit_search_network_sysctl',` gen_require(` type sysctl_net_t; ') dontaudit $1 sysctl_net_t:dir search; ') ######################################## ## ## Allow caller to read network sysctls. ## ## ## Domain allowed access. ## ## # interface(`kernel_read_net_sysctl',` gen_require(` type proc_t, sysctl_t, sysctl_net_t; ') allow $1 proc_t:dir search; allow $1 sysctl_t:dir r_dir_perms; allow $1 sysctl_net_t:dir r_dir_perms; allow $1 sysctl_net_t:file r_file_perms; ') ######################################## ## ## Allow caller to modiry contents of sysctl network files. ## ## ## Domain allowed access. ## # interface(`kernel_rw_net_sysctl',` gen_require(` type proc_t, sysctl_t, sysctl_net_t; class dir r_dir_perms; class file rw_file_perms; ') allow $1 proc_t:dir search; allow $1 sysctl_t:dir r_dir_perms; allow $1 sysctl_net_t:dir r_dir_perms; allow $1 sysctl_net_t:file rw_file_perms; ') ######################################## ## ## Allow caller to read unix domain ## socket sysctls. ## ## ## Domain allowed access. ## # interface(`kernel_read_unix_sysctl',` gen_require(` type proc_t, sysctl_t, sysctl_net_t, sysctl_net_unix_t; class dir r_dir_perms; class file r_file_perms; ') allow $1 proc_t:dir search; allow $1 sysctl_t:dir r_dir_perms; allow $1 sysctl_net_t:dir r_dir_perms; allow $1 sysctl_net_unix_t:file r_file_perms; ') ######################################## ## ## Read and write unix domain ## socket sysctls. ## ## ## Domain allowed access. ## # interface(`kernel_rw_unix_sysctl',` gen_require(` type proc_t, sysctl_t, sysctl_net_t, sysctl_net_unix_t; class dir r_dir_perms; class file rw_file_perms; ') allow $1 proc_t:dir search; allow $1 sysctl_t:dir r_dir_perms; allow $1 sysctl_net_t:dir r_dir_perms; allow $1 sysctl_net_unix_t:file rw_file_perms; ') ######################################## ## ## Read the hotplug sysctl. ## ## ## Domain allowed access. ## # interface(`kernel_read_hotplug_sysctl',` gen_require(` type proc_t, sysctl_t, sysctl_kernel_t, sysctl_hotplug_t; class dir r_dir_perms; class file r_file_perms; ') allow $1 proc_t:dir search; allow $1 sysctl_t:dir r_dir_perms; allow $1 sysctl_kernel_t:dir r_dir_perms; allow $1 sysctl_hotplug_t:file r_file_perms; ') ######################################## ## ## Read and write the hotplug sysctl. ## ## ## Domain allowed access. ## # interface(`kernel_rw_hotplug_sysctl',` gen_require(` type proc_t, sysctl_t, sysctl_kernel_t, sysctl_hotplug_t; class dir r_dir_perms; class file rw_file_perms; ') allow $1 proc_t:dir search; allow $1 sysctl_t:dir r_dir_perms; allow $1 sysctl_kernel_t:dir r_dir_perms; allow $1 sysctl_hotplug_t:file rw_file_perms; ') ######################################## ## ## Read the modprobe sysctl. ## ## ## Domain allowed access. ## # interface(`kernel_read_modprobe_sysctl',` gen_require(` type proc_t, sysctl_t, sysctl_kernel_t, sysctl_modprobe_t; class dir r_dir_perms; class file r_file_perms; ') allow $1 proc_t:dir search; allow $1 sysctl_t:dir r_dir_perms; allow $1 sysctl_kernel_t:dir r_dir_perms; allow $1 sysctl_modprobe_t:file r_file_perms; ') ######################################## ## ## Read and write the modprobe sysctl. ## ## ## Domain allowed access. ## # interface(`kernel_rw_modprobe_sysctl',` gen_require(` type proc_t, sysctl_t, sysctl_kernel_t, sysctl_modprobe_t; class dir r_dir_perms; class file rw_file_perms; ') allow $1 proc_t:dir search; allow $1 sysctl_t:dir r_dir_perms; allow $1 sysctl_kernel_t:dir r_dir_perms; allow $1 sysctl_modprobe_t:file rw_file_perms; ') ######################################## ## ## Do not audit attempts to search generic kernel sysctls. ## ## ## Domain to not audit. ## # interface(`kernel_dontaudit_search_kernel_sysctl',` gen_require(` type sysctl_kernel_t; ') dontaudit $1 sysctl_kernel_t:dir search; ') ######################################## ## ## Read generic kernel sysctls. ## ## ## Domain allowed access. ## # interface(`kernel_read_kernel_sysctl',` gen_require(` type proc_t, sysctl_t, sysctl_kernel_t; class dir r_dir_perms; class file r_file_perms; ') allow $1 proc_t:dir search; allow $1 sysctl_t:dir r_dir_perms; allow $1 sysctl_kernel_t:dir r_dir_perms; allow $1 sysctl_kernel_t:file r_file_perms; ') ######################################## ## ## Do not audit attempts to write generic kernel sysctls. ## ## ## Domain to not audit. ## # interface(`kernel_dontaudit_write_kernel_sysctl',` gen_require(` type sysctl_kernel_t; class file write; ') dontaudit $1 sysctl_kernel_t:file write; ') ######################################## ## ## Read and write generic kernel sysctls. ## ## ## Domain allowed access. ## # interface(`kernel_rw_kernel_sysctl',` gen_require(` type proc_t, sysctl_t, sysctl_kernel_t; class dir r_dir_perms; class file rw_file_perms; ') allow $1 proc_t:dir search; allow $1 sysctl_t:dir r_dir_perms; allow $1 sysctl_kernel_t:dir r_dir_perms; allow $1 sysctl_kernel_t:file rw_file_perms; ') ######################################## ## ## Read filesystem sysctls. ## ## ## Domain allowed access. ## # interface(`kernel_read_fs_sysctl',` gen_require(` type proc_t, sysctl_t, sysctl_fs_t; class dir r_dir_perms; class file r_file_perms; ') allow $1 proc_t:dir search; allow $1 sysctl_t:dir r_dir_perms; allow $1 sysctl_fs_t:dir r_dir_perms; allow $1 sysctl_fs_t:file r_file_perms; ') ######################################## ## ## Read and write fileystem sysctls. ## ## ## Domain allowed access. ## # interface(`kernel_rw_fs_sysctl',` gen_require(` type proc_t, sysctl_t, sysctl_fs_t; class dir r_dir_perms; class file rw_file_perms; ') allow $1 proc_t:dir search; allow $1 sysctl_t:dir r_dir_perms; allow $1 sysctl_fs_t:dir r_dir_perms; allow $1 sysctl_fs_t:file rw_file_perms; ') ######################################## ## ## Read IRQ sysctls. ## ## ## Domain allowed access. ## # interface(`kernel_read_irq_sysctl',` gen_require(` type proc_t, sysctl_irq_t; class dir r_dir_perms; class file r_file_perms; ') allow $1 proc_t:dir search; allow $1 sysctl_irq_t:dir r_dir_perms; allow $1 sysctl_irq_t:file r_file_perms; ') ######################################## ## ## Read and write IRQ sysctls. ## ## ## Domain allowed access. ## ## # interface(`kernel_rw_irq_sysctl',` gen_require(` type proc_t, sysctl_irq_t; class dir r_dir_perms; class file rw_file_perms; ') allow $1 proc_t:dir search; allow $1 sysctl_irq_t:dir r_dir_perms; allow $1 sysctl_irq_t:file rw_file_perms; ') ######################################## # # kernel_read_rpc_sysctl(domain) # interface(`kernel_read_rpc_sysctl',` gen_require(` type proc_t, proc_net_t, sysctl_rpc_t; class dir r_dir_perms; class file r_file_perms; ') allow $1 proc_t:dir search; allow $1 proc_net_t:dir search; allow $1 sysctl_rpc_t:dir r_dir_perms; allow $1 sysctl_rpc_t:file r_file_perms; ') ######################################## # # kernel_rw_rpc_sysctl(domain) # interface(`kernel_rw_rpc_sysctl',` gen_require(` type proc_t, proc_net_t, sysctl_rpc_t; class dir r_dir_perms; class file rw_file_perms; ') allow $1 proc_t:dir search; allow $1 proc_net_t:dir search; allow $1 sysctl_rpc_t:dir r_dir_perms; allow $1 sysctl_rpc_t:file rw_file_perms; ') ######################################## ## ## Allow caller to read all sysctls. ## ## ## Domain allowed access. ## # interface(`kernel_read_all_sysctl',` gen_require(` attribute sysctl_type; type proc_t, proc_net_t; class dir r_dir_perms; class file r_file_perms; ') # proc_net_t for /proc/net/rpc sysctls allow $1 { proc_t proc_net_t }:dir search; allow $1 sysctl_type:dir r_dir_perms; allow $1 sysctl_type:file r_file_perms; ') ######################################## ## ## Read and write all sysctls. ## ## ## Domain allowed access. ## # interface(`kernel_rw_all_sysctl',` gen_require(` attribute sysctl_type; type proc_t, proc_net_t; class dir r_dir_perms; class file { rw_file_perms setattr }; ') # proc_net_t for /proc/net/rpc sysctls allow $1 { proc_t proc_net_t }:dir search; allow $1 sysctl_type:dir r_dir_perms; allow $1 sysctl_type:file { rw_file_perms setattr }; ') ######################################## ## ## Send a kill signal to unlabeled processes. ## ## ## Domain allowed access. ## # interface(`kernel_kill_unlabeled',` gen_require(` type unlabeled_t; class process sigkill; ') allow $1 unlabeled_t:process sigkill; ') ######################################## ## ## Send general signals to unlabeled processes. ## ## ## Domain allowed access. ## # interface(`kernel_signal_unlabeled',` gen_require(` type unlabeled_t; class process signal; ') allow $1 unlabeled_t:process signal; ') ######################################## ## ## Send a null signal to unlabeled processes. ## ## ## Domain allowed access. ## # interface(`kernel_signull_unlabeled',` gen_require(` type unlabeled_t; class process signull; ') allow $1 unlabeled_t:process signull; ') ######################################## ## ## Send a stop signal to unlabeled processes. ## ## ## Domain allowed access. ## # interface(`kernel_sigstop_unlabeled',` gen_require(` type unlabeled_t; class process sigstop; ') allow $1 unlabeled_t:process sigstop; ') ######################################## ## ## Send a child terminated signal to unlabeled processes. ## ## ## Domain allowed access. ## # interface(`kernel_sigchld_unlabeled',` gen_require(` type unlabeled_t; class process sigchld; ') allow $1 unlabeled_t:process sigchld; ') ######################################## ## ## List unlabeled directories. ## ## ## Domain allowed access. ## # interface(`kernel_list_unlabeled',` gen_require(` type unlabeled_t; ') allow $1 unlabeled_t:dir r_dir_perms; ') ######################################## ## ## Do not audit attempts to list unlabeled directories. ## ## ## Domain allowed access. ## # interface(`kernel_dontaudit_list_unlabeled',` gen_require(` type unlabeled_t; ') dontaudit $1 unlabeled_t:dir list_dir_perms; ') ######################################## ## ## Read and write unlabeled directories. ## ## ## Domain allowed access. ## # interface(`kernel_rw_unlabeled_dir',` gen_require(` type unlabeled_t; ') allow $1 unlabeled_t:dir rw_dir_perms; ') ######################################## ## ## Do not audit attempts by caller to get the ## attributes of an unlabeled file. ## ## ## The process type not to audit. ## # interface(`kernel_dontaudit_getattr_unlabeled_file',` gen_require(` type unlabeled_t; ') dontaudit $1 unlabeled_t:file getattr; ') ######################################## ## ## Do not audit attempts by caller to ## read an unlabeled file. ## ## ## Domain to not audit. ## # interface(`kernel_dontaudit_read_unlabeled_file',` gen_require(` type unlabeled_t; ') dontaudit $1 unlabeled_t:file { getattr read }; ') ######################################## ## ## Do not audit attempts by caller to get the ## attributes of unlabeled symbolic links. ## ## ## The process type not to audit. ## # interface(`kernel_dontaudit_getattr_unlabeled_symlinks',` gen_require(` type unlabeled_t; ') dontaudit $1 unlabeled_t:lnk_file getattr; ') ######################################## ## ## Do not audit attempts by caller to get the ## attributes of unlabeled named pipes. ## ## ## The process type not to audit. ## # interface(`kernel_dontaudit_getattr_unlabeled_pipes',` gen_require(` type unlabeled_t; ') dontaudit $1 unlabeled_t:fifo_file getattr; ') ######################################## ## ## Do not audit attempts by caller to get the ## attributes of unlabeled named sockets. ## ## ## The process type not to audit. ## # interface(`kernel_dontaudit_getattr_unlabeled_sockets',` gen_require(` type unlabeled_t; ') dontaudit $1 unlabeled_t:sock_file getattr; ') ######################################## ## ## Do not audit attempts by caller to get attributes for ## unlabeled block devices. ## ## ## The process type not to audit. ## # interface(`kernel_dontaudit_getattr_unlabeled_blk_dev',` gen_require(` type unlabeled_t; ') dontaudit $1 unlabeled_t:blk_file getattr; ') ######################################## ## ## Read and write unlabeled block device nodes. ## ## ## Domain allowed access. ## # interface(`kernel_use_unlabeled_blk_dev',` gen_require(` type unlabeled_t; ') allow $1 unlabeled_t:blk_file getattr; ') ######################################## ## ## Do not audit attempts by caller to get attributes for ## unlabeled character devices. ## ## ## The process type not to audit. ## # interface(`kernel_dontaudit_getattr_unlabeled_chr_dev',` gen_require(` type unlabeled_t; ') dontaudit $1 unlabeled_t:chr_file getattr; ') ######################################## ## ## Allow caller to relabel unlabeled objects. ## ## ## The process type relabeling the objects. ## # interface(`kernel_relabel_unlabeled',` gen_require(` type unlabeled_t; gen_require_set({ getattr relabelfrom },dir_file_class_set) ') allow $1 unlabeled_t:dir_file_class_set { getattr relabelfrom }; ') ######################################## ## ## Send and receive messages from an ## unlabeled IPSEC association. ## ## ##

## Send and receive messages from an ## unlabeled IPSEC association. Network ## connections that are not protected ## by IPSEC have use an unlabeled ## assocation. ##

##

## The corenetwork interface ## corenet_sendrecv_no_ipsec() should ## be used instead of this one. ##

##
## ## Domain allowed access. ## # interface(`kernel_sendrecv_unlabeled_association',` gen_require(` type unlabeled_t; ') allow $1 unlabeled_t:association { sendto recvfrom }; ') ######################################## ## ## Unconfined access to the kernel. ## ## ## Domain allowed access. ## # interface(`kernel_unconfined',` gen_require(` type kernel_t, unlabeled_t, sysctl_t; attribute proc_type, sysctl_type; attribute kern_unconfined; attribute can_load_kernmodule, can_receive_kernel_messages; class dir r_dir_perms; class file { rw_file_perms setattr }; ') allow $1 proc_type:{ dir file } *; allow $1 sysctl_t:{ dir file } *; allow $1 kernel_t:system *; allow $1 unlabeled_t:dir_file_class_set *; allow $1 unlabeled_t:filesystem *; allow $1 unlabeled_t:association *; typeattribute $1 can_load_kernmodule, can_receive_kernel_messages; typeattribute $1 kern_unconfined; kernel_rw_all_sysctl($1) ') ################################################################################ # # Reversed interfaces # # The following are reversed interfaces, meaning the point of view of the caller # of the interface is the object (target) type, rather than the subject (source) # type, like all other interfaces in the policy. These interfaces are here to # decouple policy from the base module, and should not be used anywhere else. # ################################################################################ ######################################## ## ## Allow the kernel to send a SIGCHLD ## signal to the specified domain. ## ## ## Domain receiving the SIGCHLD. ## # interface(`kernel_sigchld_from',` gen_require(` type kernel_t; class process sigchld; ') allow kernel_t $1:process sigchld; ') ######################################## ## ## Allow unlabeled processes to send a SIGCHLD ## signal to the specified domain. ## ## ## Domain receiving the SIGCHLD. ## # interface(`kernel_sigchld_from_unlabeled',` gen_require(` type unlabeled_t; class process sigchld; ') allow unlabeled_t $1:process sigchld; ') ######################################## ## ## Allow the kernel to search the ## specified directory. ## ## ## Directory type to search. ## # interface(`kernel_search_from',` gen_require(` type kernel_t; class dir search; ') allow kernel_t $1:dir search; ') ######################################## ## ## Allow the kernel to read the contents ## of the specified directory. ## ## ## Directory type to list. ## # interface(`kernel_list_from',` gen_require(` type kernel_t; class dir r_dir_perms; ') allow kernel_t $1:dir r_dir_perms; ') ######################################## ## ## Allow the kernel to read the ## specified file. ## ## ## Directory type to list. ## # interface(`kernel_read_file_from',` gen_require(` type kernel_t; class dir r_dir_perms; ') allow kernel_t $1:file r_file_perms; ') ######################################## ## ## Use the specified types for /lib directory ## and use the dynamic link/loader for automatic loading ## of shared libraries, and the link/loader ## cache. ## ## ## The type of the lib directories. ## ## ## The type of the dynamic link/loader. ## ## ## The type of the dynamic link/loader cache. ## # interface(`kernel_use_ld_so_from',` gen_require(` type kernel_t; class dir r_dir_perms; class lnk_file r_file_perms; class file rx_file_perms; ') files_list_etc(kernel_t) allow kernel_t $1:dir r_dir_perms; allow kernel_t $1:lnk_file r_file_perms; allow kernel_t $2:lnk_file r_file_perms; allow kernel_t $2:file rx_file_perms; allow kernel_t $3:file r_file_perms; ') ######################################## ## ## Allow the kernel to load and execute ## functions from the specified shared libraries. ## ## ## The type of the lib directories. ## ## ## Shared library type. ## # interface(`kernel_use_shared_libs_from',` gen_require(` type kernel_t; class lnk_file r_file_perms; class file rx_file_perms; ') allow kernel_t $1:dir r_dir_perms; allow kernel_t $1:lnk_file r_file_perms; allow kernel_t $2:lnk_file r_file_perms; allow kernel_t $2:file rx_file_perms; ') ####################################### ## ## Allow the kernel to send a syslog ## message to the specified domain, ## connecting over the specified named ## socket. ## ## ## The type of the named socket file. ## ## ## The domain of the syslog daemon. ## # interface(`kernel_send_syslog_msg_from',` gen_require(` type syslogd_t, devlog_t; class lnk_file read; class sock_file rw_file_perms; class unix_dgram_socket sendto; class unix_stream_socket connectto; ') allow kernel_t $1:lnk_file read; allow kernel_t $1:sock_file rw_file_perms; # the type of socket depends on the syslog daemon allow kernel_t $2:unix_dgram_socket sendto; allow kernel_t $2:unix_stream_socket connectto; ') ######################################## ## ## Allow the kernel to send UDP network traffic ## the specified domain. ## ## ## The type of the receiving domain. ## # interface(`kernel_udp_sendfrom',` gen_require(` type kernel_t; class udp_socket { sendto recvfrom }; ') allow kernel_t $1:udp_socket sendto; allow $1 kernel_t:udp_socket recvfrom; ')