## ## Policy for kernel security interface, in particular, selinuxfs. ## ## ## Contains the policy for the kernel SELinux security interface. ## ######################################## ## ## Make the specified type used for labeling SELinux Booleans. ## This interface is only usable in the base module. ## ## ##

## Make the specified type used for labeling SELinux Booleans. ##

##

## This makes use of genfscon statements, which are only ## available in the base module. Thus any module which calls this ## interface must be included in the base module. ##

##
## ## ## Type used for labeling a Boolean. ## ## ## ## ## Name of the Boolean. ## ## # interface(`selinux_labeled_boolean',` gen_require(` attribute boolean_type; ') typeattribute $1 boolean_type; # because of this statement, any module which # calls this interface must be in the base module: genfscon selinuxfs /booleans/$2 gen_context(system_u:object_r:$1,s0) ') ######################################## ## ## Get the mountpoint of the selinuxfs filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`selinux_get_fs_mount',` gen_require(` type security_t; ') # starting in libselinux 2.0.5, init_selinuxmnt() will # attempt to short circuit by checking if SELINUXMNT # (/selinux) is already a selinuxfs allow $1 security_t:filesystem getattr; # read /proc/filesystems to see if selinuxfs is supported # then read /proc/self/mount to see where selinuxfs is mounted kernel_read_system_state($1) ') ######################################## ## ## Do not audit attempts to get the mountpoint ## of the selinuxfs filesystem. ## ## ## ## Domain to not audit. ## ## # interface(`selinux_dontaudit_get_fs_mount',` gen_require(` type security_t; ') # starting in libselinux 2.0.5, init_selinuxmnt() will # attempt to short circuit by checking if SELINUXMNT # (/selinux) is already a selinuxfs dontaudit $1 security_t:filesystem getattr; # read /proc/filesystems to see if selinuxfs is supported # then read /proc/self/mount to see where selinuxfs is mounted kernel_dontaudit_read_system_state($1) ') ######################################## ## ## Get the attributes of the selinuxfs filesystem ## ## ## ## Domain allowed access. ## ## # interface(`selinux_getattr_fs',` gen_require(` type security_t; ') allow $1 security_t:filesystem getattr; ') ######################################## ## ## Do not audit attempts to get the ## attributes of the selinuxfs filesystem ## ## ## ## Domain to not audit. ## ## # interface(`selinux_dontaudit_getattr_fs',` gen_require(` type security_t; ') dontaudit $1 security_t:filesystem getattr; ') ######################################## ## ## Do not audit attempts to get the ## attributes of the selinuxfs directory. ## ## ## ## Domain to not audit. ## ## # interface(`selinux_dontaudit_getattr_dir',` gen_require(` type security_t; ') dontaudit $1 security_t:dir getattr; ') ######################################## ## ## Search selinuxfs. ## ## ## ## Domain allowed access. ## ## # interface(`selinux_search_fs',` gen_require(` type security_t; ') allow $1 security_t:dir search_dir_perms; ') ######################################## ## ## Do not audit attempts to search selinuxfs. ## ## ## ## Domain to not audit. ## ## # interface(`selinux_dontaudit_search_fs',` gen_require(` type security_t; ') dontaudit $1 security_t:dir search_dir_perms; ') ######################################## ## ## Do not audit attempts to read ## generic selinuxfs entries ## ## ## ## Domain to not audit. ## ## # interface(`selinux_dontaudit_read_fs',` gen_require(` type security_t; ') dontaudit $1 security_t:dir search_dir_perms; dontaudit $1 security_t:file read_file_perms; ') ######################################## ## ## Allows the caller to get the mode of policy enforcement ## (enforcing or permissive mode). ## ## ## ## The process type to allow to get the enforcing mode. ## ## ## # interface(`selinux_get_enforce_mode',` gen_require(` type security_t; ') allow $1 security_t:dir list_dir_perms; allow $1 security_t:file read_file_perms; ') ######################################## ## ## Allow caller to set the mode of policy enforcement ## (enforcing or permissive mode). ## ## ##

## Allow caller to set the mode of policy enforcement ## (enforcing or permissive mode). ##

##

## Since this is a security event, this action is ## always audited. ##

##
## ## ## The process type to allow to set the enforcement mode. ## ## ## # interface(`selinux_set_enforce_mode',` gen_require(` type security_t; attribute can_setenforce; bool secure_mode_policyload; ') allow $1 security_t:dir list_dir_perms; allow $1 security_t:file rw_file_perms; typeattribute $1 can_setenforce; if(!secure_mode_policyload) { allow $1 security_t:security setenforce; ifdef(`distro_rhel4',` # needed for systems without audit support auditallow $1 security_t:security setenforce; ') } ') ######################################## ## ## Allow caller to load the policy into the kernel. ## ## ## ## The process type that will load the policy. ## ## # interface(`selinux_load_policy',` gen_require(` type security_t; attribute can_load_policy; bool secure_mode_policyload; ') allow $1 security_t:dir list_dir_perms; allow $1 security_t:file rw_file_perms; typeattribute $1 can_load_policy; if(!secure_mode_policyload) { allow $1 security_t:security load_policy; ifdef(`distro_rhel4',` # needed for systems without audit support auditallow $1 security_t:security load_policy; ') } ') ######################################## ## ## Allow caller to set the state of Booleans to ## enable or disable conditional portions of the policy. (Deprecated) ## ## ##

## Allow caller to set the state of Booleans to ## enable or disable conditional portions of the policy. ##

##

## Since this is a security event, this action is ## always audited. ##

##

## This interface has been deprecated. Please use ## selinux_set_generic_booleans() or selinux_set_all_booleans() ## instead. ##

##
## ## ## The process type allowed to set the Boolean. ## ## ## # interface(`selinux_set_boolean',` refpolicywarn(`$0($*) has been deprecated, use selinux_set_generic_booleans() instead.') selinux_set_generic_booleans($1) ') ######################################## ## ## Allow caller to set the state of generic Booleans to ## enable or disable conditional portions of the policy. ## ## ##

## Allow caller to set the state of generic Booleans to ## enable or disable conditional portions of the policy. ##

##

## Since this is a security event, this action is ## always audited. ##

##
## ## ## The process type allowed to set the Boolean. ## ## ## # interface(`selinux_set_generic_booleans',` gen_require(` type security_t; bool secure_mode_policyload; ') allow $1 security_t:dir list_dir_perms; allow $1 security_t:file rw_file_perms; if(!secure_mode_policyload) { allow $1 security_t:security setbool; ifdef(`distro_rhel4',` # needed for systems without audit support auditallow $1 security_t:security setbool; ') } ') ######################################## ## ## Allow caller to set the state of all Booleans to ## enable or disable conditional portions of the policy. ## ## ##

## Allow caller to set the state of all Booleans to ## enable or disable conditional portions of the policy. ##

##

## Since this is a security event, this action is ## always audited. ##

##
## ## ## The process type allowed to set the Boolean. ## ## ## # interface(`selinux_set_all_booleans',` gen_require(` type security_t; attribute boolean_type; bool secure_mode_policyload; ') allow $1 security_t:dir list_dir_perms; allow $1 boolean_type:file rw_file_perms; if(!secure_mode_policyload) { allow $1 security_t:security setbool; ifdef(`distro_rhel4',` # needed for systems without audit support auditallow $1 security_t:security setbool; ') } ') ######################################## ## ## Allow caller to set SELinux access vector cache parameters. ## ## ##

## Allow caller to set SELinux access vector cache parameters. ## The allows the domain to set performance related parameters ## of the AVC, such as cache threshold. ##

##

## Since this is a security event, this action is ## always audited. ##

##
## ## ## The process type to allow to set security parameters. ## ## ## # interface(`selinux_set_parameters',` gen_require(` type security_t; attribute can_setsecparam; ') allow $1 security_t:dir list_dir_perms; allow $1 security_t:file rw_file_perms; allow $1 security_t:security setsecparam; auditallow $1 security_t:security setsecparam; typeattribute $1 can_setsecparam; ') ######################################## ## ## Allows caller to validate security contexts. ## ## ## ## The process type permitted to validate contexts. ## ## ## # interface(`selinux_validate_context',` gen_require(` type security_t; ') allow $1 security_t:dir list_dir_perms; allow $1 security_t:file rw_file_perms; allow $1 security_t:security check_context; ') ######################################## ## ## Do not audit attempts to validate security contexts. ## ## ## ## Domain to not audit. ## ## ## # interface(`selinux_dontaudit_validate_context',` gen_require(` type security_t; ') dontaudit $1 security_t:dir list_dir_perms; dontaudit $1 security_t:file rw_file_perms; dontaudit $1 security_t:security check_context; ') ######################################## ## ## Allows caller to compute an access vector. ## ## ## ## The process type allowed to compute an access vector. ## ## ## # interface(`selinux_compute_access_vector',` gen_require(` type security_t; ') allow $1 security_t:dir list_dir_perms; allow $1 security_t:file rw_file_perms; allow $1 security_t:security compute_av; ') ######################################## ## ## Calculate the default type for object creation. ## ## ## ## Domain allowed access. ## ## ## # interface(`selinux_compute_create_context',` gen_require(` type security_t; ') allow $1 security_t:dir list_dir_perms; allow $1 security_t:file rw_file_perms; allow $1 security_t:security compute_create; ') ######################################## ## ## Allows caller to compute polyinstatntiated ## directory members. ## ## ## ## Domain allowed access. ## ## # interface(`selinux_compute_member',` gen_require(` type security_t; ') allow $1 security_t:dir list_dir_perms; allow $1 security_t:file rw_file_perms; allow $1 security_t:security compute_member; ') ######################################## ## ## Calculate the context for relabeling objects. ## ## ##

## Calculate the context for relabeling objects. ## This is determined by using the type_change ## rules in the policy, and is generally used ## for determining the context for relabeling ## a terminal when a user logs in. ##

##
## ## ## Domain allowed access. ## ## # interface(`selinux_compute_relabel_context',` gen_require(` type security_t; ') allow $1 security_t:dir list_dir_perms; allow $1 security_t:file rw_file_perms; allow $1 security_t:security compute_relabel; ') ######################################## ## ## Allows caller to compute possible contexts for a user. ## ## ## ## The process type allowed to compute user contexts. ## ## # interface(`selinux_compute_user_contexts',` gen_require(` type security_t; ') allow $1 security_t:dir list_dir_perms; allow $1 security_t:file rw_file_perms; allow $1 security_t:security compute_user; ') ######################################## ## ## Unconfined access to the SELinux kernel security server. ## ## ## ## Domain allowed access. ## ## # interface(`selinux_unconfined',` gen_require(` attribute selinux_unconfined_type; ') typeattribute $1 selinux_unconfined_type; ')