-## Enabling secure mode disallows programs, such as +## disallow programs, such as ## newrole, from transitioning to administrative ## user domains. ##
##-## Disable transitions to insmod. -##
-##-## boolean to determine whether the system permits loading policy, setting -## enforcing mode, and changing boolean values. Set this to true and you -## have to reboot to set it back -##
-##-## Allow unconfined executables to map a memory region as both executable and writable, this is dangerous and the executable should be reported in bugzilla") +## Allow unconfined executables to map a memory region as both executable and writable, this is dangerous and the executable should be reported in bugzilla ##
##-## Allow all unconfined executables to use libraries requiring text relocation that are not labeled textrel_shlib_t") +## Allow all unconfined executables to use libraries requiring text relocation that are not labeled textrel_shlib_t ##
##-## Allow unconfined executables to make their stack executable. This should never, ever be necessary. Probably indicates a badly coded executable, but could indicate an attack. This executable should be reported in bugzilla") +## Allow unconfined executables to make their stack executable. This should never, ever be necessary. Probably indicates a badly coded executable, but could indicate an attack. This executable should be reported in bugzilla ##
##-## Allow email client to various content. -## nfs, samba, removable devices, and user temp -## files -##
-#### Allow any files/directories to be exported read/write via NFS. ##
##+## Support fusefs home directories +##
+#### Allow users to run TCP servers (bind to ports and accept connection from ## the same domain and outside users) disabling this forces FTP passive mode ## and may change other protocols. ##
##+## Allow direct login to the console device. Required for System 390 +##
+##+## This template creates a derived domains which are used +## for execmem applications. +##
+##+## Execute a telepathy executable +## in the specified domain. This allows +## the specified domain to execute any file +## on these filesystems in the specified +## domain. +##
+##+## No interprocess communication (signals, pipes, +## etc.) is provided by this interface since +## the domains are not owned by this module. +##
+##+## This interface was added to handle +## the ssh-agent policy. +##
+##@@ -13,7 +14,15 @@ policy_module(gpg, 2.4.0) ##
+## Allow gpg web domain to modify public files +## used for public file transfer services. +##
+##+## Allow the Irssi IRC Client to connect to any port, +## and to bind to any unreserved port. +##
+##+## Execute a mplayer_exec_t +## in the specified domain. +##
+##+## No interprocess communication (signals, pipes, +## etc.) is provided by this interface since +## the domains are not owned by this module. +##
+##+## Execute a nsplugin_exec_t +## in the specified domain. +##
+##+## No interprocess communication (signals, pipes, +## etc.) is provided by this interface since +## the domains are not owned by this module. +##
+##+## Allow nsplugin code to execmem/execstack +##
+##+## Allow nsplugin code to connect to unreserved ports +##
+##+## This template creates a derived domains which are used +## for java applications. +##
+##+## Execute a openoffice_exec_t +## in the specified domain. +##
+##+## No interprocess communication (signals, pipes, +## etc.) is provided by this interface since +## the domains are not owned by this module. +##
+##-## This template creates a derived domains which are used -## for qemu web browser. -##
-##-## This template is invoked automatically for each user, and -## generally does not need to be invoked directly -## by policy writers. -##
-##+## Execute qemu_exec_t +## in the specified domain. This allows +## the specified domain to qemu programs +## on these filesystems in the specified +## domain. +##
+##+## Execute a telepathy executable +## in the specified domain. This allows +## the specified domain to execute any file +## on these filesystems in the specified +## domain. +##
+##+## No interprocess communication (signals, pipes, +## etc.) is provided by this interface since +## the domains are not owned by this module. +##
+##+## This interface was added to handle +## the ssh-agent policy. +##
+##+## This template creates a derived domains which are used +## for consolehelper applications. +##
+##+## Allow unlabeled_packet_t to be used by all domains that use the network +##
+##+## Allow all domains to use other domains file descriptors +##
+##+## Allow all domains to have the kernel load modules +##
+##
@@ -87,14 +102,17 @@ allow domain self:dir list_dir_perms;
allow domain self:lnk_file { read_lnk_file_perms lock ioctl };
allow domain self:file rw_file_perms;
kernel_read_proc_symlinks(domain)
+kernel_read_crypto_sysctls(domain)
+
# Every domain gets the key ring, so we should default
# to no one allowed to look at it; afs kernel support creates
# a keyring
kernel_dontaudit_search_key(domain)
kernel_dontaudit_link_key(domain)
+kernel_dontaudit_search_debugfs(domain)
# create child processes in the domain
-allow domain self:process { fork sigchld };
+allow domain self:process { fork getsched sigchld };
# Use trusted objects in /dev
dev_rw_null(domain)
@@ -103,6 +121,16 @@ term_use_controlling_term(domain)
# list the root directory
files_list_root(domain)
+# allow all domains to search through default_t directory, since users sometimes
+# place labels within these directories. (samba_share_t) for example.
+files_search_default(domain)
+
+# All executables should be able to search the directory they are in
+corecmd_search_bin(domain)
+
+tunable_policy(`domain_kernel_load_modules',`
+ kernel_request_load_module(domain)
+')
tunable_policy(`global_ssp',`
# enable reading of urandom for all domains:
@@ -113,8 +141,13 @@ tunable_policy(`global_ssp',`
')
optional_policy(`
+ afs_rw_cache(domain)
+')
+
+optional_policy(`
libs_use_ld_so(domain)
libs_use_shared_libs(domain)
+ libs_read_lib_files(domain)
')
optional_policy(`
@@ -125,6 +158,8 @@ optional_policy(`
optional_policy(`
xserver_dontaudit_use_xdm_fds(domain)
xserver_dontaudit_rw_xdm_pipes(domain)
+ xserver_dontaudit_append_xdm_home_files(domain)
+ xserver_dontaudit_write_log(domain)
')
########################################
@@ -143,6 +178,8 @@ allow unconfined_domain_type domain:{ socket_class_set socket key_socket } *;
allow unconfined_domain_type domain:fd use;
allow unconfined_domain_type domain:fifo_file rw_file_perms;
+allow unconfined_domain_type unconfined_domain_type:dbus send_msg;
+
# Act upon any other process.
allow unconfined_domain_type domain:process ~{ transition dyntransition execmem execstack execheap };
@@ -160,3 +197,91 @@ allow unconfined_domain_type domain:key *;
# receive from all domains over labeled networking
domain_all_recvfrom_all_domains(unconfined_domain_type)
+
+selinux_getattr_fs(domain)
+selinux_search_fs(domain)
+selinux_dontaudit_read_fs(domain)
+
+optional_policy(`
+ seutil_dontaudit_read_config(domain)
+')
+
+optional_policy(`
+ init_sigchld(domain)
+ init_signull(domain)
+')
+
+ifdef(`distro_redhat',`
+ files_search_mnt(domain)
+ optional_policy(`
+ unconfined_use_fds(domain)
+ ')
+')
+
+# these seem questionable:
+
+optional_policy(`
+ abrt_domtrans_helper(domain)
+ abrt_read_pid_files(domain)
+ abrt_read_state(domain)
+ abrt_signull(domain)
+')
+
+optional_policy(`
+ rpm_use_fds(domain)
+ rpm_read_pipes(domain)
+ rpm_search_log(domain)
+ rpm_append_tmp_files(domain)
+ rpm_dontaudit_leaks(domain)
+ rpm_read_script_tmp_files(domain)
+ rpm_inherited_fifo(domain)
+')
+
+optional_policy(`
+ sosreport_append_tmp_files(domain)
+')
+
+tunable_policy(`allow_domain_fd_use',`
+ # Allow all domains to use fds past to them
+ allow domain domain:fd use;
+')
+
+optional_policy(`
+ cron_dontaudit_write_system_job_tmp_files(domain)
+ cron_rw_pipes(domain)
+ cron_rw_system_job_pipes(domain)
+')
+
+ifdef(`hide_broken_symptoms',`
+ dontaudit domain self:udp_socket listen;
+ allow domain domain:key { link search };
+ dontaudit domain domain:socket_class_set { read write };
+ dontaudit domain self:capability sys_module;
+')
+
+optional_policy(`
+ hal_dontaudit_read_pid_files(domain)
+')
+
+optional_policy(`
+ ipsec_match_default_spd(domain)
+')
+
+optional_policy(`
+ ifdef(`hide_broken_symptoms',`
+ afs_rw_udp_sockets(domain)
+ ')
+')
+
+optional_policy(`
+ ssh_rw_pipes(domain)
+')
+
+optional_policy(`
+ unconfined_dontaudit_rw_pipes(domain)
+ unconfined_sigchld(domain)
+')
+
+# broken kernel
+dontaudit can_change_object_identity can_change_object_identity:key link;
+
diff --git a/policy/modules/kernel/files.fc b/policy/modules/kernel/files.fc
index c19518a..12e8e9c 100644
--- a/policy/modules/kernel/files.fc
+++ b/policy/modules/kernel/files.fc
@@ -18,6 +18,7 @@ ifdef(`distro_redhat',`
/fsckoptions -- gen_context(system_u:object_r:etc_runtime_t,s0)
/halt -- gen_context(system_u:object_r:etc_runtime_t,s0)
/poweroff -- gen_context(system_u:object_r:etc_runtime_t,s0)
+/[^/]+ -- gen_context(system_u:object_r:etc_runtime_t,s0)
')
ifdef(`distro_suse',`
@@ -53,10 +54,17 @@ ifdef(`distro_suse',`
/etc/ioctl\.save -- gen_context(system_u:object_r:etc_runtime_t,s0)
/etc/killpower -- gen_context(system_u:object_r:etc_runtime_t,s0)
/etc/localtime -l gen_context(system_u:object_r:etc_t,s0)
-/etc/mtab -- gen_context(system_u:object_r:etc_runtime_t,s0)
-/etc/mtab\.fuselock -- gen_context(system_u:object_r:etc_runtime_t,s0)
+/etc/machine-id -- gen_context(system_u:object_r:etc_runtime_t,s0)
+/etc/mtab.* -- gen_context(system_u:object_r:etc_runtime_t,s0)
/etc/nohotplug -- gen_context(system_u:object_r:etc_runtime_t,s0)
/etc/nologin.* -- gen_context(system_u:object_r:etc_runtime_t,s0)
+/etc/securetty -- gen_context(system_u:object_r:etc_runtime_t,s0)
+
+/etc/sysctl\.conf(\.old)? -- gen_context(system_u:object_r:system_conf_t,s0)
+/etc/sysconfig/ebtables.* -- gen_context(system_u:object_r:system_conf_t,s0)
+/etc/sysconfig/ip6?tables.* -- gen_context(system_u:object_r:system_conf_t,s0)
+/etc/sysconfig/ipvsadm.* -- gen_context(system_u:object_r:system_conf_t,s0)
+/etc/sysconfig/system-config-firewall.* -- gen_context(system_u:object_r:system_conf_t,s0)
/etc/cups/client\.conf -- gen_context(system_u:object_r:etc_t,s0)
@@ -68,7 +76,10 @@ ifdef(`distro_suse',`
/etc/sysconfig/hwconf -- gen_context(system_u:object_r:etc_runtime_t,s0)
/etc/sysconfig/iptables\.save -- gen_context(system_u:object_r:etc_runtime_t,s0)
-/etc/sysconfig/firstboot -- gen_context(system_u:object_r:etc_runtime_t,s0)
+
+/etc/xorg\.conf\.d/00-system-setup-keyboard\.conf -- gen_context(system_u:object_r:etc_runtime_t,s0)
+/etc/X11/xorg\.conf\.d/00-system-setup-keyboard\.conf -- gen_context(system_u:object_r:etc_runtime_t,s0)
+
ifdef(`distro_gentoo', `
/etc/profile\.env -- gen_context(system_u:object_r:etc_runtime_t,s0)
@@ -102,10 +113,9 @@ HOME_ROOT/lost\+found/.* <
+## Allow shared library text relocations in tmp files.
+##
+## This is added to support java policy.
+##
+## Make the specified type usable for spool files. +## This will also make the type usable for files, making +## calls to files_type() redundant. Failure to use this interface +## for a spool file may result in problems with +## purging spool files. +##
+##+## Related interfaces: +##
+##+## Example usage with a domain that can create and +## write its spool file in the system spool file +## directories (/var/spool): +##
+##+## type myspoolfile_t; +## files_spool_file(myfile_spool_t) +## allow mydomain_t myfile_spool_t:file { create_file_perms write_file_perms }; +## files_spool_filetrans(mydomain_t, myfile_spool_t, file) +##
+##+## Create a core file in /, +##
+##+## Create a default_t direcrory +##
+#### Allow the specified domain to -## et the attributes of all filesystems. +## get the attributes of all filesystems. ## Example attributes: ##
##+## Receive Raw IP packets from an unlabeled connection. +##
+##+## The corenetwork interface corenet_raw_recv_unlabeled() should +## be used instead of this one. +##
+##+## disallow programs and users from transitioning to insmod domain. +##
+##+## Make specified process type MCS untrusted. This +## prevents this process from sending signals to other processes +## with different mcs labels +## object. +##
+##+## prevent all confined domains from loading policy, setting +## enforcing mode, and changing boolean values. Set this to true and you +## have to reboot to set it back +##
+##+## Change from the unconfineduser role to +## the specified role. +##
+##+## This is an interface to support third party modules +## and its use is not allowed in upstream reference +## policy. +##
+##+## Allow unconfined to execute the specified program in +## the specified domain. +##
+##+## This is a interface to support third party modules +## and its use is not allowed in upstream reference +## policy. +##
+##+## Allow unconfined to execute the specified program in +## the specified domain. Allow the specified domain the +## unconfined role and use of unconfined user terminals. +##
+##+## This is a interface to support third party modules +## and its use is not allowed in upstream reference +## policy. +##
+##+## Do not audit attempts to read or write +## unconfined domain tcp sockets. +##
+##+## This interface was added due to a broken +## symptom in ldconfig. +##
+##+## Do not audit attempts to read or write +## unconfined domain packet sockets. +##
+##+## This interface was added due to a broken +## symptom. +##
+##+## allow unconfined users to transition to the nsplugin domains when running nspluginviewer +##
+##+## allow unconfined users to transition to the chrome sandbox domains when running chrome-sandbox +##
+##+## Allow unconfined users to transition to the Mozilla plugin domain when running xulrunner plugin-container. +##
+##+## Allow vidio playing tools to tun unconfined +##
+##+## Allow a user to login as an unconfined domain +##
+##-## Allow xguest to configure Network Manager +## Allow xguest users to configure Network Manager and connect to apache ports ##
##-## Allow xguest to use blue tooth devices +## Allow xguest users to use blue tooth devices ##
##+## Allow ABRT to modify public files +## used for public file transfer services. +##
+##+## Allow ABRT to run in abrt_handle_event_t domain +## to handle ABRT event scripts +##
+##-## Allow Apache to modify public files -## used for public file transfer services. Directories/Files must -## be labeled public_content_rw_t. -##
+##+## Allow Apache to modify public files +## used for public file transfer services. Directories/Files must +## be labeled public_content_rw_t. +##
##-## Allow Apache to use mod_auth_pam -##
+##+## Allow Apache to use mod_auth_pam +##
##-## Allow httpd to use built in scripting (usually php) -##
+##+## Allow Apache to use mod_auth_ntlm_winbind +##
+##+## Allow httpd scripts and modules execmem/execstack +##
+##+## Allow httpd daemon to change system limits +##
+##+## Allow httpd to use built in scripting (usually php) +##
##-## Allow HTTPD scripts and modules to connect to the network using TCP. -##
+##+## Allow HTTPD scripts and modules to connect to the network using any TCP port. +##
##-## Allow HTTPD scripts and modules to connect to databases over the network. -##
+##+## Allow HTTPD scripts and modules to connect to cobbler over the network. +##
+##+## Allow HTTPD scripts and modules to connect to databases over the network. +##
##-## Allow httpd to act as a relay -##
+##+## Allow httpd to connect to memcache server +##
+##+## Allow httpd to act as a relay +##
##-## Allow http daemon to send mail -##
+##+## Allow http daemon to send mail +##
##-## Allow Apache to communicate with avahi service via dbus -##
+##+## Allow http daemon to check spam +##
+##+## Allow Apache to communicate with avahi service via dbus +##
##-## Allow httpd cgi support -##
+##+## Allow httpd to execute cgi scripts +##
##-## Allow httpd to act as a FTP server by -## listening on the ftp port. -##
+##+## Allow httpd to act as a FTP server by +## listening on the ftp port. +##
##-## Allow httpd to read home directories -##
+##+## Allow httpd to act as a FTP client +## connecting to the ftp port and ephemeral ports +##
+##+## Allow httpd to read home directories +##
##-## Allow HTTPD to run SSI executables in the same domain as system CGI scripts. -##
+##+## Allow httpd to read user content +##
+##+## Allow HTTPD to run SSI executables in the same domain as system CGI scripts. +##
##-## Unify HTTPD to communicate with the terminal. -## Needed for entering the passphrase for certificates at -## the terminal. -##
+##+## Allow Apache to execute tmp content. +##
+##+## Unify HTTPD to communicate with the terminal. +## Needed for entering the passphrase for certificates at +## the terminal. +##
##-## Unify HTTPD handling of all content files. -##
+##+## Unify HTTPD handling of all content files. +##
##-## Allow httpd to access cifs file systems -##
+##+## Allow httpd to access cifs file systems +##
##-## Allow httpd to run gpg -##
+##+## Allow httpd to run gpg in gpg-web domain +##
##-## Allow httpd to access nfs file systems -##
+##+## Allow httpd to access nfs file systems +##
##+## Allow apache scripts to write to public content. Directories/Files must be labeled public_rw_content_t. +##
+##-## Allow BIND to write the master zone files. -## Generally this is used for dynamic DNS or zone transfers. -##
+##+## Allow BIND to bind apache port. +##
+##+## Allow BIND to write the master zone files. +## Generally this is used for dynamic DNS or zone transfers. +##
##-## Allow clamd to use JIT compiler -##
+##+## Allow clamscan to read user content +##
+##+## Allow clamd to use JIT compiler +##
##-## Cobbler is a Linux installation server that allows for -## rapid setup of network installation environments. It -## glues together and automates many associated Linux -## tasks so you do not have to hop between lots of various -## commands and applications when rolling out new systems, -## and, in some cases, changing existing ones. +## Cobbler is a Linux installation server that allows for +## rapid setup of network installation environments. It +## glues together and automates many associated Linux +## tasks so you do not have to hop between lots of various +## commands and applications when rolling out new systems, +## and, in some cases, changing existing ones. ##
##-## Allow Cobbler to modify public files -## used for public file transfer services. -##
+##+## Allow Cobbler to modify public files +## used for public file transfer services. +##
##+## Allow Cobbler to connect to the +## network using TCP. +##
+##+## Allow Cobbler to access cifs file systems. +##
+##+## Allow Cobbler to access nfs file systems. +##
+##-## Allow system cron jobs to relabel filesystem -## for restoring file contexts. -##
+##+## Allow system cron jobs to relabel filesystem +## for restoring file contexts. +##
##-## Enable extra rules in the cron domain -## to support fcron. -##
+##+## Enable extra rules in the cron domain +## to support fcron. +##
##-## Allow cvs daemon to read shadow -##
+##+## Allow cvs daemon to read shadow +##
##-## Allow exim to connect to databases (postgres, mysql) -##
+##+## Allow exim to connect to databases (PostgreSQL, MySQL) +##
##-## Allow exim to read unprivileged user files. -##
+##+## Allow exim to read unprivileged user files. +##
##-## Allow exim to create, read, write, and delete -## unprivileged user files. -##
+##+## Allow exim to create, read, write, and delete +## unprivileged user files. +##
##+## Allow ftp servers to use connect to mysql database +##
+#### Allow ftp to read and write files in the user home directories ##
##+## Allow internal-sftp to read and write files +## in the user ssh home directories. +##
+##+## A really simple TCP git daemon that normally listens on +## port DEFAULT_GIT_PORT aka 9418. It waits for a +## connection asking for a service, and will serve that +## service if it is enabled. +##
+##+## Allow Git daemon system to search home directories. +##
+##+## Allow Git daemon system to access cifs file systems. +##
+##+## Allow Git daemon system to access nfs file systems. +##
+##+## Allow Git daemon session to bind +## tcp sockets to all unreserved ports. +##
+##+## Allow icecast to connect to all ports, not just +## sound ports. +##
+##-## Allow confined applications to run with kerberos. -##
+##+## Allow confined applications to run with kerberos. +##
##-## Use lpd server instead of cups -##
+##+## Use lpd server instead of cups +##
##+## Allow mock to read files in home directories. +##
+##-## Allow mysqld to connect to all ports -##
+##+## Allow mysqld to connect to all ports +##
##+## Allow confined applications to use nscd shared memory. +##
+##-## Allow openvpn to read home directories -##
+##+## Allow openvpn to read home directories +##
##+## Allow piranha-lvs domain to connect to the network using TCP. +##
+##+## Determine whether polipo can +## access cifs file systems. +##
+##+## Determine whether Polipo can +## access nfs file systems. +##
+##+## Determine whether Polipo session daemon +## can bind tcp sockets to all unreserved ports. +##
+##+## Determine whether calling user domains +## can execute Polipo daemon in the +## polipo_session_t domain. +##
+##+## Determine whether Polipo session daemon +## can send syslog messages. +##
+##+## Allow postfix_local domain full write access to mail_spool directories +##
+##-## Allow unprived users to execute DDL statement -##
+##+## Allow unprivileged users to execute DDL statement +##
##-## Allow database admins to execute DML statement -##
+##+## Allow database admins to execute DML statement +##
##-## Allow pppd to load kernel modules for certain modems -##
+##+## Allow pppd to load kernel modules for certain modems +##
##-## Allow pppd to be run for a regular user -##
+##+## Allow pppd to be run for a regular user +##
##-## Allow privoxy to connect to all ports, not just -## HTTP, FTP, and Gopher ports. -##
+##+## Allow privoxy to connect to all ports, not just +## HTTP, FTP, and Gopher ports. +##
##+## Allow Puppet client to manage all file +## types. +##
+##-## Allow Puppet client to manage all file -## types. +## Allow Puppet master to use connect to MySQL and PostgreSQL database ##
##-## Allow rgmanager domain to connect to the network using TCP. -##
+##+## Allow rgmanager domain to connect to the network using TCP. +##
##-## Allow fenced domain to connect to the network using TCP. -##
+##+## Allow fenced domain to connect to the network using TCP. +##
##+## Allow fenced domain to execute ssh. +##
+##-## Allow gssd to read temp directory. For access to kerberos tgt. -##
+##+## Allow gssd to read temp directory. For access to kerberos tgt. +##
##-## Allow nfs servers to modify public files -## used for public file transfer services. Files/Directories must be -## labeled public_content_rw_t. -##
+##+## Allow nfs servers to modify public files +## used for public file transfer services. Files/Directories must be +## labeled public_content_rw_t. +##
##+## Allow rsync to run as a client +##
+#### Allow rsync to export any files/directories read only. ##
##-## Allow user spamassassin clients to use the network. -##
+##+## Allow user spamassassin clients to use the network. +##
##-## Allow spamd to read/write user home directories. -##
+##+## Allow spamd to read/write user home directories. +##
##-## Allow squid to connect to all ports, not just -## HTTP, FTP, and Gopher ports. -##
+##+## Allow squid to connect to all ports, not just +## HTTP, FTP, and Gopher ports. +##
##-## Allow squid to run as a transparent proxy (TPROXY) -##
+##+## Allow squid to run as a transparent proxy (TPROXY) +##
##-## allow host key based authentication -##
+##+## allow host key based authentication +##
##+## Allow ssh logins as sysadm_r:sysadm_t +##
+##+## allow sshd to forward port connections +##
+##-## Allow ssh logins as sysadm_r:sysadm_t +## Allow ssh with chroot env to read and write files +## in the user home directories ##
##-## Allow tftp to modify public files -## used for public file transfer services. -##
+##+## Allow tftp to modify public files +## used for public file transfer services. +##
##-## Allow varnishd to connect to all ports, -## not just HTTP. -##
+##+## Allow varnishd to connect to all ports, +## not just HTTP. +##
##-## Allow virt to use serial/parallell communication ports -##
+##+## Allow confined virtual guests to use serial/parallel communication ports +##
##-## Allow virt to read fuse files -##
+##+## Allow confined virtual guests to read fuse files +##
##-## Allow virt to manage nfs files -##
+##+## Allow confined virtual guests to manage nfs files +##
##-## Allow virt to manage cifs files -##
+##+## Allow confined virtual guests to manage cifs files +##
##-## Allow virt to manage device configuration, (pci) -##
+##+## Allow confined virtual guests to manage device configuration, (pci) +##
##-## Allow virt to use usb devices -##
+##+## Allow confined virtual guests to interact with the sanlock +##
+##+## Allow confined virtual guests to interact with the xserver +##
+##+## Allow confined virtual guests to use usb devices +##
##-## Allows clients to write to the X server shared -## memory segments. -##
+##+## Allows clients to write to the X server shared +## memory segments. +##
##+## Allows XServer to execute writable memory +##
+##-## Allow xdm logins as sysadm +## Allow the graphical login program to execute bootloader ##
##+## Allow the graphical login program to login directly as sysadm_r:sysadm_t +##
+##-## Support X userspace object manager -##
+##+## Support X userspace object manager +##
##+## Allow regular users direct dri device access +##
+##-## Allow zebra daemon to write it configuration files -##
+##+## Allow zebra daemon to write it configuration files +##
##+## Allow users to login using a radius server +##
+##+## Allow users to login using a sssd server +##
+##+## Execute a init script in a specified role +##
+##+## No interprocess communication (signals, pipes, +## etc.) is provided by this interface since +## the domains are not owned by this module. +##
+##+## This defines a type that init can create sock_file within for +## impersonation purposes +##
+##+## Enable support for systemd as the init program. +##
+##+## Allow all daemons to use tcp wrappers. +##
+##+## Allow all daemons the ability to read/write terminals +##
+##+## Allow all daemons to write corefiles to / +##
+##+## Allow the specified domain to create an object +## in the general system log directories (e.g., /var/log) +## with a private type. Typically this is used for creating +## private log files in /var/log with the private type instead +## of the general system log type. To accomplish this goal, +## either the program must be SELinux-aware, or use this interface. +##
+##+## Related interfaces: +##
+##+## Example usage with a domain that can create +## and append to a private log file stored in the +## general directories (e.g., /var/log): +##
+##+## type mylogfile_t; +## logging_log_file(mylogfile_t) +## allow mydomain_t mylogfile_t:file { create_file_perms append_file_perms }; +## logging_log_filetrans(mydomain_t, mylogfile_t, file) +##
+##+## Allow syslogd daemon to send mail +##
+##+## Execute dhclient script in a specified role +##
+##+## No interprocess communication (signals, pipes, +## etc.) is provided by this interface since +## the domains are not owned by this module. +##
+##+## Allow dhcpc client applications to execute iptables commands +##
+##-## Allow unconfined to execute the specified program in -## the specified domain. -##
-##-## This is a interface to support third party modules -## and its use is not allowed in upstream reference -## policy. -##
-##-## Allow unconfined to execute the specified program in -## the specified domain. Allow the specified domain the -## unconfined role and use of unconfined user terminals. -##
-##-## This is a interface to support third party modules -## and its use is not allowed in upstream reference -## policy. -##
-##-## Do not audit attempts to read or write -## unconfined domain tcp sockets. -##
-##-## This interface was added due to a broken -## symptom in ldconfig. -##
-##-## Allow the specified domain to read and write user -## TTYs and PTYs. This will allow the domain to -## interact with the user via the terminal. Typically -## all interactive applications will require this -## access. -##
-##-## However, this also allows the applications to spy -## on user sessions or inject information into the -## user session. Thus, this access should likely -## not be allowed for non-interactive domains. -##
-##+## Allow the specified domain to read and write inherited user +## TTYs and PTYs. This will allow the domain to +## interact with the user via the terminal. Typically +## all interactive applications will require this +## access. +##
+##+## Execute a file in a user home directory +## in the specified domain. +##
+##+## No interprocess communication (signals, pipes, +## etc.) is provided by this interface since +## the domains are not owned by this module. +##
+##+## Execute a file in a user tmp directory +## in the specified domain. +##
+##+## No interprocess communication (signals, pipes, +## etc.) is provided by this interface since +## the domains are not owned by this module. +##
+##-## Allow users to connect to mysql +## Allow users to connect to the local mysql server ##
##+## Allow user music sharing +##
+##+## Allow user processes to change their priority +##
+#### Allow w to display everyone ##
##@@ -65,6 +66,7 @@ type xen_image_t; # customizable files_type(xen_image_t) # xen_image_t can be assigned to blk devices dev_node(xen_image_t) +virt_image(xen_image_t) type xenctl_t; files_type(xenctl_t) @@ -121,11 +123,6 @@ init_daemon_domain(xenconsoled_t, xenconsoled_exec_t) type xenconsoled_var_run_t; files_pid_file(xenconsoled_var_run_t) -type xm_t; -type xm_exec_t; -domain_type(xm_t) -init_system_domain(xm_t, xm_exec_t) - ######################################## # # blktap local policy @@ -208,7 +205,7 @@ tunable_policy(`xend_run_qemu',` # xend local policy # -allow xend_t self:capability { dac_override ipc_lock net_admin setuid sys_nice sys_tty_config net_raw }; +allow xend_t self:capability { dac_override ipc_lock net_admin setuid sys_admin sys_nice sys_tty_config net_raw }; dontaudit xend_t self:capability { sys_ptrace }; allow xend_t self:process { signal sigkill }; dontaudit xend_t self:process ptrace; @@ -320,12 +317,9 @@ locallogin_dontaudit_use_fds(xend_t) logging_send_syslog_msg(xend_t) -lvm_domtrans(xend_t) - miscfiles_read_localization(xend_t) miscfiles_read_hwdata(xend_t) -mount_domtrans(xend_t) sysnet_domtrans_dhcpc(xend_t) sysnet_signal_dhcpc(xend_t) @@ -339,8 +333,6 @@ userdom_dontaudit_search_user_home_dirs(xend_t) xen_stream_connect_xenstore(xend_t) -netutils_domtrans(xend_t) - optional_policy(` brctl_domtrans(xend_t) ') @@ -349,6 +341,22 @@ optional_policy(` consoletype_exec(xend_t) ') +optional_policy(` + lvm_domtrans(xend_t) +') + +optional_policy(` + mount_domtrans(xend_t) +') + +optional_policy(` + netutils_domtrans(xend_t) +') + +optional_policy(` + virt_read_config(xend_t) +') + ######################################## # # Xen console local policy @@ -413,9 +421,10 @@ manage_dirs_pattern(xenstored_t, xenstored_tmp_t, xenstored_tmp_t) files_tmp_filetrans(xenstored_t, xenstored_tmp_t, { file dir }) # pid file +manage_dirs_pattern(xenstored_t, xenstored_var_run_t, xenstored_var_run_t) manage_files_pattern(xenstored_t, xenstored_var_run_t, xenstored_var_run_t) manage_sock_files_pattern(xenstored_t, xenstored_var_run_t, xenstored_var_run_t) -files_pid_filetrans(xenstored_t, xenstored_var_run_t, { file sock_file }) +files_pid_filetrans(xenstored_t, xenstored_var_run_t, { file sock_file dir }) # log files manage_dirs_pattern(xenstored_t, xenstored_var_log_t, xenstored_var_log_t) @@ -442,9 +451,11 @@ files_read_etc_files(xenstored_t) files_read_usr_files(xenstored_t) +fs_search_xenfs(xenstored_t) fs_manage_xenfs_files(xenstored_t) term_use_generic_ptys(xenstored_t) +term_use_console(xenconsoled_t) init_use_fds(xenstored_t) init_use_script_ptys(xenstored_t) @@ -457,96 +468,9 @@ xen_append_log(xenstored_t) ######################################## # -# xm local policy -# - -allow xm_t self:capability { dac_override ipc_lock sys_tty_config }; -allow xm_t self:process { getsched signal }; - -# internal communication is often done using fifo and unix sockets. -allow xm_t self:fifo_file rw_fifo_file_perms; -allow xm_t self:unix_stream_socket { create_stream_socket_perms connectto }; -allow xm_t self:tcp_socket create_stream_socket_perms; - -manage_files_pattern(xm_t, xend_var_lib_t, xend_var_lib_t) -manage_fifo_files_pattern(xm_t, xend_var_lib_t, xend_var_lib_t) -manage_sock_files_pattern(xm_t, xend_var_lib_t, xend_var_lib_t) -files_search_var_lib(xm_t) - -allow xm_t xen_image_t:dir rw_dir_perms; -allow xm_t xen_image_t:file read_file_perms; -allow xm_t xen_image_t:blk_file read_blk_file_perms; - -kernel_read_system_state(xm_t) -kernel_read_kernel_sysctls(xm_t) -kernel_read_sysctl(xm_t) -kernel_read_xen_state(xm_t) -kernel_write_xen_state(xm_t) - -corecmd_exec_bin(xm_t) -corecmd_exec_shell(xm_t) - -corenet_tcp_sendrecv_generic_if(xm_t) -corenet_tcp_sendrecv_generic_node(xm_t) -corenet_tcp_connect_soundd_port(xm_t) - -dev_read_urand(xm_t) -dev_read_sysfs(xm_t) - -files_read_etc_runtime_files(xm_t) -files_read_usr_files(xm_t) -files_list_mnt(xm_t) -# Some common macros (you might be able to remove some) -files_read_etc_files(xm_t) - -fs_getattr_all_fs(xm_t) -fs_manage_xenfs_dirs(xm_t) -fs_manage_xenfs_files(xm_t) - -term_use_all_terms(xm_t) - -init_stream_connect_script(xm_t) -init_rw_script_stream_sockets(xm_t) -init_use_fds(xm_t) - -miscfiles_read_localization(xm_t) - -sysnet_dns_name_resolve(xm_t) - -xen_append_log(xm_t) -xen_stream_connect(xm_t) -xen_stream_connect_xenstore(xm_t) - -optional_policy(` - dbus_system_bus_client(xm_t) - - optional_policy(` - hal_dbus_chat(xm_t) - ') -') - -optional_policy(` - virt_domtrans(xm_t) - virt_manage_images(xm_t) - virt_manage_config(xm_t) - virt_stream_connect(xm_t) -') - -######################################## -# # SSH component local policy # optional_policy(` - ssh_basic_client_template(xm, xm_t, system_r) - - kernel_read_xen_state(xm_ssh_t) - kernel_write_xen_state(xm_ssh_t) - - files_search_tmp(xm_ssh_t) - - fs_manage_xenfs_dirs(xm_ssh_t) - fs_manage_xenfs_files(xm_ssh_t) - #Should have a boolean wrapping these fs_list_auto_mountpoints(xend_t) files_search_mnt(xend_t) @@ -559,8 +483,4 @@ optional_policy(` fs_manage_nfs_files(xend_t) fs_read_nfs_symlinks(xend_t) ') - - optional_policy(` - unconfined_domain(xend_t) - ') ') diff --git a/policy/support/file_patterns.spt b/policy/support/file_patterns.spt index bdd500c..4719351 100644 --- a/policy/support/file_patterns.spt +++ b/policy/support/file_patterns.spt @@ -535,7 +535,7 @@ define(`filetrans_add_pattern',` define(`filetrans_pattern',` allow $1 $2:dir rw_dir_perms; - type_transition $1 $2:$4 $3; + type_transition $1 $2:$4 $3 $5; ') define(`admin_pattern',` diff --git a/policy/support/misc_patterns.spt b/policy/support/misc_patterns.spt index 22ca011..823794e 100644 --- a/policy/support/misc_patterns.spt +++ b/policy/support/misc_patterns.spt @@ -15,7 +15,7 @@ define(`spec_domtrans_pattern',` domain_transition_pattern($1,$2,$3) allow $3 $1:fd use; - allow $3 $1:fifo_file rw_fifo_file_perms; + allow $3 $1:fifo_file rw_inherited_fifo_file_perms; allow $3 $1:process sigchld; ') @@ -34,7 +34,7 @@ define(`domtrans_pattern',` domain_auto_transition_pattern($1,$2,$3) allow $3 $1:fd use; - allow $3 $1:fifo_file rw_fifo_file_perms; + allow $3 $1:fifo_file rw_inherited_fifo_file_perms; allow $3 $1:process sigchld; ') diff --git a/policy/support/obj_perm_sets.spt b/policy/support/obj_perm_sets.spt index f7380b3..fb62555 100644 --- a/policy/support/obj_perm_sets.spt +++ b/policy/support/obj_perm_sets.spt @@ -28,8 +28,7 @@ define(`devfile_class_set', `{ chr_file blk_file }') # # All socket classes. # -define(`socket_class_set', `{ tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket appletalk_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_ip6fw_socket netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket }') - +define(`socket_class_set', `{ socket dccp_socket tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket appletalk_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_ip6fw_socket netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket }') # # Datagram socket classes. @@ -105,7 +104,7 @@ define(`mount_fs_perms', `{ mount remount unmount getattr }') # # Permissions for using sockets. # -define(`rw_socket_perms', `{ ioctl read getattr write setattr append bind connect getopt setopt shutdown }') +define(`rw_socket_perms', `{ ioctl read getattr lock write setattr append bind connect getopt setopt shutdown }') # # Permissions for creating and using sockets. @@ -199,12 +198,15 @@ define(`relabel_dir_perms',`{ getattr relabelfrom relabelto }') # define(`getattr_file_perms',`{ getattr }') define(`setattr_file_perms',`{ setattr }') -define(`read_file_perms',`{ getattr open read lock ioctl }') +define(`read_inherited_file_perms',`{ getattr read ioctl lock }') +define(`read_file_perms',`{ open read_inherited_file_perms }') define(`mmap_file_perms',`{ getattr open read execute ioctl }') define(`exec_file_perms',`{ getattr open read execute ioctl execute_no_trans }') -define(`append_file_perms',`{ getattr open append lock ioctl }') +define(`append_inherited_file_perms',`{ getattr append }') +define(`append_file_perms',`{ open lock ioctl append_inherited_file_perms }') define(`write_file_perms',`{ getattr open write append lock ioctl }') -define(`rw_file_perms',`{ getattr open read write append ioctl lock }') +define(`rw_inherited_file_perms',`{ getattr read write append ioctl lock }') +define(`rw_file_perms',`{ open rw_inherited_file_perms }') define(`create_file_perms',`{ getattr create open }') define(`rename_file_perms',`{ getattr rename }') define(`delete_file_perms',`{ getattr unlink }') @@ -225,7 +227,7 @@ define(`rw_lnk_file_perms',`{ getattr read write lock ioctl }') define(`create_lnk_file_perms',`{ create getattr }') define(`rename_lnk_file_perms',`{ getattr rename }') define(`delete_lnk_file_perms',`{ getattr unlink }') -define(`manage_lnk_file_perms',`{ create read write getattr setattr link unlink rename }') +define(`manage_lnk_file_perms',`{ create getattr setattr read write append rename link unlink ioctl lock }') define(`relabelfrom_lnk_file_perms',`{ getattr relabelfrom }') define(`relabelto_lnk_file_perms',`{ getattr relabelto }') define(`relabel_lnk_file_perms',`{ getattr relabelfrom relabelto }') @@ -238,7 +240,8 @@ define(`setattr_fifo_file_perms',`{ setattr }') define(`read_fifo_file_perms',`{ getattr open read lock ioctl }') define(`append_fifo_file_perms',`{ getattr open append lock ioctl }') define(`write_fifo_file_perms',`{ getattr open write append lock ioctl }') -define(`rw_fifo_file_perms',`{ getattr open read write append ioctl lock }') +define(`rw_inherited_fifo_file_perms',`{ getattr read write append ioctl lock }') +define(`rw_fifo_file_perms',`{ open rw_inherited_fifo_file_perms }') define(`create_fifo_file_perms',`{ getattr create open }') define(`rename_fifo_file_perms',`{ getattr rename }') define(`delete_fifo_file_perms',`{ getattr unlink }') @@ -254,7 +257,8 @@ define(`getattr_sock_file_perms',`{ getattr }') define(`setattr_sock_file_perms',`{ setattr }') define(`read_sock_file_perms',`{ getattr open read }') define(`write_sock_file_perms',`{ getattr write open append }') -define(`rw_sock_file_perms',`{ getattr open read write append }') +define(`rw_inherited_sock_file_perms',`{ getattr read write append }') +define(`rw_sock_file_perms',`{ open rw_inherited_sock_file_perms }') define(`create_sock_file_perms',`{ getattr create open }') define(`rename_sock_file_perms',`{ getattr rename }') define(`delete_sock_file_perms',`{ getattr unlink }') @@ -271,7 +275,8 @@ define(`setattr_blk_file_perms',`{ setattr }') define(`read_blk_file_perms',`{ getattr open read lock ioctl }') define(`append_blk_file_perms',`{ getattr open append lock ioctl }') define(`write_blk_file_perms',`{ getattr open write append lock ioctl }') -define(`rw_blk_file_perms',`{ getattr open read write append ioctl lock }') +define(`rw_inherited_blk_file_perms',`{ getattr read write append ioctl lock }') +define(`rw_blk_file_perms',`{ open rw_inherited_blk_file_perms }') define(`create_blk_file_perms',`{ getattr create }') define(`rename_blk_file_perms',`{ getattr rename }') define(`delete_blk_file_perms',`{ getattr unlink }') @@ -288,7 +293,8 @@ define(`setattr_chr_file_perms',`{ setattr }') define(`read_chr_file_perms',`{ getattr open read lock ioctl }') define(`append_chr_file_perms',`{ getattr open append lock ioctl }') define(`write_chr_file_perms',`{ getattr open write append lock ioctl }') -define(`rw_chr_file_perms',`{ getattr open read write append ioctl lock }') +define(`rw_inherited_chr_file_perms',`{ getattr read write append ioctl lock }') +define(`rw_chr_file_perms',`{ open rw_inherited_chr_file_perms }') define(`create_chr_file_perms',`{ getattr create }') define(`rename_chr_file_perms',`{ getattr rename }') define(`delete_chr_file_perms',`{ getattr unlink }') @@ -305,7 +311,8 @@ define(`relabel_chr_file_perms',`{ getattr relabelfrom relabelto }') # # Use (read and write) terminals # -define(`rw_term_perms', `{ getattr open read write append ioctl }') +define(`rw_inherited_term_perms', `{ getattr read write append ioctl }') +define(`rw_term_perms', `{ rw_inherited_term_perms open }') # # Sockets @@ -317,3 +324,15 @@ define(`server_stream_socket_perms', `{ client_stream_socket_perms listen accept # Keys # define(`manage_key_perms', `{ create link read search setattr view write } ') + +# +# All +# +define(`all_capabilities', `{ chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap } +') + +define(`all_nscd_perms', `{ getserv getpwd getgrp gethost getstat admin shmempwd shmemgrp shmemhost shmemserv } ') +define(`all_dbus_perms', `{ acquire_svc send_msg } ') +define(`all_passwd_perms', `{ passwd chfn chsh rootok crontab } ') +define(`all_service_perms', `{ start stop status reload kill } ') +define(`all_association_perms', `{ sendto recvfrom setcontext polmatch } ') diff --git a/policy/users b/policy/users index c4ebc7e..30d6d7a 100644 --- a/policy/users +++ b/policy/users @@ -15,7 +15,7 @@ # and a user process should never be assigned the system user # identity. # -gen_user(system_u,, system_r, s0, s0 - mls_systemhigh, mcs_allcats) +gen_user(system_u,, system_r unconfined_r, s0, s0 - mls_systemhigh, mcs_allcats) # # user_u is a generic user identity for Linux users who have no @@ -24,12 +24,9 @@ gen_user(system_u,, system_r, s0, s0 - mls_systemhigh, mcs_allcats) # SELinux user identity for a Linux user. If you do not want to # permit any access to such users, then remove this entry. # -gen_user(user_u, user, user_r, s0, s0) -gen_user(staff_u, staff, staff_r sysadm_r ifdef(`enable_mls',`secadm_r auditadm_r'), s0, s0 - mls_systemhigh, mcs_allcats) -gen_user(sysadm_u, sysadm, sysadm_r, s0, s0 - mls_systemhigh, mcs_allcats) - -# Until order dependence is fixed for users: -gen_user(unconfined_u, unconfined, unconfined_r, s0, s0 - mls_systemhigh, mcs_allcats) +gen_user(user_u, user, user_r, s0, s0 - mls_systemhigh, mcs_allcats) +gen_user(staff_u, user, staff_r system_r sysadm_r ifdef(`enable_mls',`secadm_r auditadm_r'), s0, s0 - mls_systemhigh, mcs_allcats) +gen_user(sysadm_u, user, sysadm_r, s0, s0 - mls_systemhigh, mcs_allcats) # # The following users correspond to Unix identities. @@ -38,8 +35,4 @@ gen_user(unconfined_u, unconfined, unconfined_r, s0, s0 - mls_systemhigh, mcs_al # role should use the staff_r role instead of the user_r role when # not in the sysadm_r. # -ifdef(`direct_sysadm_daemon',` - gen_user(root, sysadm, sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r') system_r, s0, s0 - mls_systemhigh, mcs_allcats) -',` - gen_user(root, sysadm, sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r'), s0, s0 - mls_systemhigh, mcs_allcats) -') +gen_user(root, user, unconfined_r sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r') system_r, s0, s0 - mls_systemhigh, mcs_allcats)