271 lines
7.7 KiB
Plaintext
271 lines
7.7 KiB
Plaintext
# Copyright (C) 2005 Tresys Technology, LLC
|
|
|
|
attribute can_modify_kernel_modules;
|
|
neverallow ~can_modify_kernel_modules modules_object_t:file { create append write };
|
|
|
|
# kernel modules
|
|
type modules_object_t;
|
|
files_make_file(modules_object_t)
|
|
|
|
# module loading config
|
|
type modules_conf_t;
|
|
files_make_file(modules_conf_t)
|
|
|
|
# module dependencies
|
|
type modules_dep_t;
|
|
files_make_file(modules_dep_t)
|
|
|
|
type insmod_t;
|
|
domain_make_domain(insmod_t)
|
|
role system_r types insmod_t;
|
|
|
|
type insmod_exec_t;
|
|
domain_make_entrypoint_file(insmod_t,insmod_exec_t)
|
|
|
|
type depmod_t;
|
|
domain_make_domain(depmod_t)
|
|
role system_r types depmod_t;
|
|
|
|
type depmod_exec_t;
|
|
domain_make_entrypoint_file(depmod_t,depmod_exec_t)
|
|
|
|
type update_modules_t;
|
|
domain_make_domain(update_modules_t)
|
|
role system_r types update_modules_t;
|
|
|
|
type update_modules_exec_t;
|
|
domain_make_entrypoint_file(update_modules_t,update_modules_exec_t)
|
|
|
|
type update_modules_tmp_t;
|
|
files_make_file(update_modules_tmp_t)
|
|
|
|
########################################
|
|
#
|
|
# insmod local policy
|
|
#
|
|
|
|
allow insmod_t insmod_exec_t:file { getattr read execute execute_no_trans };
|
|
|
|
# Read module config and dependency information
|
|
allow insmod_t { modules_conf_t modules_dep_t }:file { getattr read };
|
|
|
|
# read modules
|
|
allow insmod_t modules_object_t:dir { getattr search read };
|
|
allow insmod_t modules_object_t:file { getattr read };
|
|
|
|
allow insmod_t self:capability { dac_override net_raw sys_tty_config };
|
|
allow insmod_t self:process { execmem sigchld sigkill sigstop signull signal };
|
|
|
|
allow insmod_t self:udp_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
|
|
allow insmod_t self:rawip_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
|
|
|
|
kernel_transition_from(insmod_t,insmod_exec_t)
|
|
|
|
kernel_load_module(insmod_t)
|
|
|
|
# Rules for /proc/sys/kernel/tainted
|
|
kernel_read_kernel_sysctl(insmod_t)
|
|
kernel_modify_kernel_sysctl(insmod_t)
|
|
kernel_read_hotplug_sysctl(insmod_t)
|
|
|
|
terminal_use_controlling_terminal(insmod_t)
|
|
|
|
devices_write_mtrr(insmod_t)
|
|
devices_get_pseudorandom_data(insmod_t)
|
|
devices_direct_agp_access(insmod_t)
|
|
devices_get_zeros(insmod_t)
|
|
|
|
filesystem_get_persistent_filesystem_attributes(insmod_t)
|
|
|
|
files_read_runtime_system_config(insmod_t)
|
|
files_read_general_system_config(insmod_t)
|
|
files_read_general_shared_resources(insmod_t)
|
|
files_execute_system_config_script(insmod_t)
|
|
|
|
domain_signal_all_domains(insmod_t)
|
|
|
|
libraries_use_dynamic_loader(insmod_t)
|
|
libraries_read_shared_libraries(insmod_t)
|
|
|
|
corecommands_execute_general_programs(insmod_t)
|
|
corecommands_execute_system_programs(insmod_t)
|
|
corecommands_execute_shell(insmod_t)
|
|
|
|
miscfiles_read_localization(insmod_t)
|
|
|
|
logging_send_system_log_message(insmod_t)
|
|
|
|
define(`insmod_mount_optional_policy',`
|
|
mount_transition(insmod_t)
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# Conditional policy logic
|
|
#
|
|
|
|
ifdef(`monolithic_policy',`
|
|
ifdef(`mount.te',`insmod_mount_optional_policy')
|
|
',`
|
|
optional mount { mount_transition_depend }
|
|
ifopt (consoletype) { insmod_mount_optional_policy }
|
|
') dnl end monolithic_policy
|
|
|
|
#
|
|
#
|
|
# TODO rules:
|
|
#
|
|
#
|
|
ifdef(`TODO_list',`
|
|
|
|
# for loading modules at boot time
|
|
allow insmod_t { init_t initrc_t }:fd use;
|
|
allow insmod_t initrc_t:fifo_file { getattr read write };
|
|
|
|
allow insmod_t lib_t:file { getattr read };
|
|
allow insmod_t { var_t var_log_t }:dir search;
|
|
|
|
allow insmod_t privfd:fd use;
|
|
|
|
allow insmod_t apm_bios_t:chr_file { read write };
|
|
|
|
allow insmod_t sound_device_t:chr_file { read ioctl write };
|
|
|
|
ifdef(`xserver.te', `
|
|
allow insmod_t xserver_log_t:file getattr;
|
|
')
|
|
|
|
allow insmod_t sysfs_t:dir search;
|
|
allow insmod_t usbfs_t:dir search;
|
|
allow insmod_t usbfs_t:filesystem mount;
|
|
|
|
allow insmod_t { initrc_devpts_t admin_tty_type }:chr_file { getattr read write };
|
|
allow insmod_t devpts_t:dir { getattr search };
|
|
|
|
# for when /var is not mounted early in the boot
|
|
dontaudit insmod_t file_t:dir search;
|
|
|
|
# for nscd
|
|
dontaudit insmod_t var_run_t:dir search;
|
|
|
|
') dnl if TODO_list
|
|
|
|
########################################
|
|
#
|
|
# depmod local policy
|
|
#
|
|
|
|
allow depmod_t depmod_exec_t:file { getattr read execute execute_no_trans };
|
|
|
|
# Read conf.modules.
|
|
allow depmod_t modules_conf_t:file { getattr read };
|
|
|
|
# Read module objects.
|
|
allow depmod_t modules_object_t:dir { getattr search read };
|
|
allow depmod_t modules_object_t:{ file lnk_file } { getattr read };
|
|
|
|
# Create modules.dep.
|
|
allow depmod_t modules_object_t:dir { read getattr lock search ioctl add_name remove_name write };
|
|
allow depmod_t modules_dep_t:file { create ioctl read getattr lock write setattr append link unlink rename };
|
|
type_transition depmod_t modules_object_t:file modules_dep_t;
|
|
|
|
kernel_read_system_state(depmod_t)
|
|
|
|
filesystem_get_persistent_filesystem_attributes(depmod_t)
|
|
|
|
terminal_use_console(depmod_t)
|
|
|
|
bootloader_read_kernel_symbol_table(depmod_t)
|
|
|
|
files_read_runtime_system_config(depmod_t)
|
|
files_read_general_system_config(depmod_t)
|
|
|
|
libraries_use_dynamic_loader(depmod_t)
|
|
libraries_read_shared_libraries(depmod_t)
|
|
|
|
ifdef(`TODO',`
|
|
r_dir_file(depmod_t, src_t)
|
|
|
|
domain_auto_trans(initrc_t, depmod_exec_t, depmod_t)
|
|
allow depmod_t { bin_t sbin_t }:dir search;
|
|
|
|
domain_auto_trans(sysadm_t, depmod_exec_t, depmod_t)
|
|
|
|
# Inherit and use descriptors from init and login programs.
|
|
allow depmod_t { init_t privfd }:fd use;
|
|
|
|
# read system.map
|
|
allow depmod_t boot_t:file { getattr read };
|
|
|
|
# Access terminals.
|
|
allow depmod_t { initrc_devpts_t admin_tty_type }:chr_file rw_file_perms;
|
|
ifdef(`gnome-pty-helper.te', `allow depmod_t sysadm_gph_t:fd use;')
|
|
|
|
# Read System.map from home directories.
|
|
allow depmod_t { home_root_t staff_home_dir_t sysadm_home_dir_t }:dir r_dir_perms;
|
|
r_dir_file(depmod_t, { staff_home_t sysadm_home_t })
|
|
') dnl end ifdef TODO
|
|
|
|
#################################
|
|
#
|
|
# update-modules local policy
|
|
#
|
|
|
|
allow update_modules_t self:fifo_file { getattr read write };
|
|
|
|
allow update_modules_t modules_dep_t:file { getattr read write };
|
|
|
|
allow update_modules_t insmod_exec_t:file { getattr read execute execute_no_trans };
|
|
allow update_modules_t update_modules_exec_t:file { getattr read execute execute_no_trans };
|
|
|
|
allow update_modules_t modules_object_t:dir { read getattr lock search ioctl add_name remove_name write };
|
|
allow update_modules_t modules_conf_t:file { create ioctl read getattr lock write setattr append link unlink rename };
|
|
type_transition update_modules_t modules_object_t:file modules_conf_t;
|
|
|
|
allow update_modules_t depmod_exec_t:file { getattr read execute };
|
|
type_transition update_modules_t depmod_exec_t:process depmod_t;
|
|
|
|
kernel_read_kernel_sysctl(update_modules_t)
|
|
kernel_read_system_state(update_modules_t)
|
|
|
|
devices_get_pseudorandom_data(update_modules_t)
|
|
|
|
filesystem_get_persistent_filesystem_attributes(update_modules_t)
|
|
|
|
terminal_use_console(update_modules_t)
|
|
terminal_use_controlling_terminal(update_modules_t)
|
|
|
|
files_read_runtime_system_config(update_modules_t)
|
|
files_read_general_system_config(update_modules_t)
|
|
files_execute_system_config_script(update_modules_t)
|
|
|
|
corecommands_execute_general_programs(update_modules_t)
|
|
corecommands_execute_system_programs(update_modules_t)
|
|
corecommands_execute_shell(update_modules_t)
|
|
|
|
libraries_use_dynamic_loader(update_modules_t)
|
|
libraries_read_shared_libraries(update_modules_t)
|
|
|
|
logging_send_system_log_message(update_modules_t)
|
|
|
|
miscfiles_read_localization(update_modules_t)
|
|
|
|
ifdef(`TODO',`
|
|
role sysadm_r types update_modules_t;
|
|
|
|
domain_auto_trans({ initrc_t sysadm_t }, update_modules_exec_t, update_modules_t)
|
|
allow update_modules_t privfd:fd use;
|
|
allow update_modules_t init_t:fd use;
|
|
|
|
allow update_modules_t { initrc_devpts_t admin_tty_type }:chr_file rw_file_perms;
|
|
allow update_modules_t devpts_t:dir search;
|
|
|
|
dontaudit update_modules_t sysadm_home_dir_t:dir search;
|
|
|
|
allow update_modules_t lib_t:file { getattr read };
|
|
|
|
file_type_auto_trans(update_modules_t, etc_t, modules_conf_t, file)
|
|
|
|
tmp_domain(update_modules)
|
|
') dnl endif TODO
|