324 lines
7.5 KiB
Plaintext
324 lines
7.5 KiB
Plaintext
|
|
policy_module(modutils, 1.10.0)
|
|
|
|
gen_require(`
|
|
bool secure_mode_insmod;
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# Declarations
|
|
#
|
|
|
|
type depmod_t;
|
|
type depmod_exec_t;
|
|
init_system_domain(depmod_t, depmod_exec_t)
|
|
role system_r types depmod_t;
|
|
|
|
type insmod_t;
|
|
type insmod_exec_t;
|
|
application_domain(insmod_t, insmod_exec_t)
|
|
mls_file_write_all_levels(insmod_t)
|
|
role system_r types insmod_t;
|
|
|
|
# module loading config
|
|
type modules_conf_t;
|
|
files_type(modules_conf_t)
|
|
|
|
# module dependencies
|
|
type modules_dep_t;
|
|
files_type(modules_dep_t)
|
|
|
|
type update_modules_t;
|
|
type update_modules_exec_t;
|
|
init_system_domain(update_modules_t, update_modules_exec_t)
|
|
role system_r types update_modules_t;
|
|
|
|
type update_modules_tmp_t;
|
|
files_tmp_file(update_modules_tmp_t)
|
|
|
|
########################################
|
|
#
|
|
# depmod local policy
|
|
#
|
|
|
|
can_exec(depmod_t, depmod_exec_t)
|
|
|
|
# Read conf.modules.
|
|
read_files_pattern(depmod_t, modules_conf_t, modules_conf_t)
|
|
|
|
allow depmod_t modules_dep_t:file manage_file_perms;
|
|
files_kernel_modules_filetrans(depmod_t, modules_dep_t, file)
|
|
|
|
kernel_read_system_state(depmod_t)
|
|
|
|
corecmd_search_bin(depmod_t)
|
|
|
|
domain_use_interactive_fds(depmod_t)
|
|
|
|
files_read_kernel_symbol_table(depmod_t)
|
|
files_read_kernel_modules(depmod_t)
|
|
files_read_etc_runtime_files(depmod_t)
|
|
files_read_etc_files(depmod_t)
|
|
files_read_usr_src_files(depmod_t)
|
|
files_list_usr(depmod_t)
|
|
|
|
fs_getattr_xattr_fs(depmod_t)
|
|
|
|
term_use_console(depmod_t)
|
|
|
|
init_use_fds(depmod_t)
|
|
init_use_script_fds(depmod_t)
|
|
init_use_script_ptys(depmod_t)
|
|
|
|
userdom_use_user_terminals(depmod_t)
|
|
# Read System.map from home directories.
|
|
files_list_home(depmod_t)
|
|
userdom_read_user_home_content_files(depmod_t)
|
|
|
|
ifdef(`distro_ubuntu',`
|
|
optional_policy(`
|
|
unconfined_domain(depmod_t)
|
|
')
|
|
')
|
|
|
|
tunable_policy(`use_nfs_home_dirs',`
|
|
fs_read_nfs_files(depmod_t)
|
|
')
|
|
|
|
tunable_policy(`use_samba_home_dirs',`
|
|
fs_read_cifs_files(depmod_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
rpm_rw_pipes(depmod_t)
|
|
rpm_manage_script_tmp_files(depmod_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
# Read System.map from home directories.
|
|
unconfined_domain(depmod_t)
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# insmod local policy
|
|
#
|
|
|
|
allow insmod_t self:capability { dac_override net_raw sys_nice sys_tty_config };
|
|
allow insmod_t self:process { execmem sigchld sigkill sigstop signull signal };
|
|
|
|
allow insmod_t self:udp_socket create_socket_perms;
|
|
allow insmod_t self:rawip_socket create_socket_perms;
|
|
|
|
# Read module config and dependency information
|
|
list_dirs_pattern(insmod_t, modules_conf_t, modules_conf_t)
|
|
read_files_pattern(insmod_t, modules_conf_t, modules_conf_t)
|
|
list_dirs_pattern(insmod_t, modules_dep_t, modules_dep_t)
|
|
read_files_pattern(insmod_t, modules_dep_t, modules_dep_t)
|
|
|
|
can_exec(insmod_t, insmod_exec_t)
|
|
|
|
kernel_load_module(insmod_t)
|
|
kernel_read_system_state(insmod_t)
|
|
kernel_read_network_state(insmod_t)
|
|
kernel_write_proc_files(insmod_t)
|
|
kernel_mount_debugfs(insmod_t)
|
|
kernel_mount_kvmfs(insmod_t)
|
|
kernel_read_debugfs(insmod_t)
|
|
# Rules for /proc/sys/kernel/tainted
|
|
kernel_read_kernel_sysctls(insmod_t)
|
|
kernel_rw_kernel_sysctl(insmod_t)
|
|
kernel_read_hotplug_sysctls(insmod_t)
|
|
kernel_setsched(insmod_t)
|
|
|
|
corecmd_exec_bin(insmod_t)
|
|
corecmd_exec_shell(insmod_t)
|
|
|
|
dev_rw_sysfs(insmod_t)
|
|
dev_search_usbfs(insmod_t)
|
|
dev_rw_mtrr(insmod_t)
|
|
dev_read_urand(insmod_t)
|
|
dev_rw_agp(insmod_t)
|
|
dev_read_sound(insmod_t)
|
|
dev_write_sound(insmod_t)
|
|
dev_rw_apm_bios(insmod_t)
|
|
|
|
domain_signal_all_domains(insmod_t)
|
|
domain_use_interactive_fds(insmod_t)
|
|
|
|
files_read_kernel_modules(insmod_t)
|
|
files_read_etc_runtime_files(insmod_t)
|
|
files_read_etc_files(insmod_t)
|
|
files_read_usr_files(insmod_t)
|
|
files_exec_etc_files(insmod_t)
|
|
# for nscd:
|
|
files_dontaudit_search_pids(insmod_t)
|
|
# for when /var is not mounted early in the boot:
|
|
files_dontaudit_search_isid_type_dirs(insmod_t)
|
|
# for locking: (cjp: ????)
|
|
files_write_kernel_modules(insmod_t)
|
|
|
|
fs_getattr_xattr_fs(insmod_t)
|
|
fs_dontaudit_use_tmpfs_chr_dev(insmod_t)
|
|
|
|
init_rw_initctl(insmod_t)
|
|
init_use_fds(insmod_t)
|
|
init_use_script_fds(insmod_t)
|
|
init_use_script_ptys(insmod_t)
|
|
|
|
logging_send_syslog_msg(insmod_t)
|
|
logging_search_logs(insmod_t)
|
|
|
|
miscfiles_read_localization(insmod_t)
|
|
|
|
seutil_read_file_contexts(insmod_t)
|
|
|
|
userdom_use_user_terminals(insmod_t)
|
|
|
|
userdom_dontaudit_search_user_home_dirs(insmod_t)
|
|
|
|
if( ! secure_mode_insmod ) {
|
|
kernel_domtrans_to(insmod_t, insmod_exec_t)
|
|
}
|
|
|
|
optional_policy(`
|
|
alsa_domtrans(insmod_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
firstboot_dontaudit_rw_pipes(insmod_t)
|
|
firstboot_dontaudit_rw_stream_sockets(insmod_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
hal_write_log(insmod_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
hotplug_search_config(insmod_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
mount_domtrans(insmod_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
nis_use_ypbind(insmod_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
nscd_socket_use(insmod_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
fs_manage_ramfs_files(insmod_t)
|
|
|
|
rhgb_use_fds(insmod_t)
|
|
rhgb_dontaudit_use_ptys(insmod_t)
|
|
|
|
xserver_dontaudit_write_log(insmod_t)
|
|
xserver_stream_connect(insmod_t)
|
|
xserver_dontaudit_rw_stream_sockets(insmod_t)
|
|
|
|
ifdef(`hide_broken_symptoms',`
|
|
xserver_dontaudit_rw_tcp_sockets(insmod_t)
|
|
')
|
|
')
|
|
|
|
optional_policy(`
|
|
rpm_rw_pipes(insmod_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
unconfined_domain(insmod_t)
|
|
unconfined_dontaudit_rw_pipes(insmod_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
# cjp: why is this needed:
|
|
dev_rw_xserver_misc(insmod_t)
|
|
|
|
xserver_getattr_log(insmod_t)
|
|
')
|
|
|
|
#################################
|
|
#
|
|
# update-modules local policy
|
|
#
|
|
|
|
allow update_modules_t self:fifo_file rw_fifo_file_perms;
|
|
|
|
allow update_modules_t modules_dep_t:file rw_file_perms;
|
|
|
|
can_exec(update_modules_t, insmod_exec_t)
|
|
can_exec(update_modules_t, update_modules_exec_t)
|
|
|
|
# manage module loading configuration
|
|
manage_files_pattern(update_modules_t, modules_conf_t, modules_conf_t)
|
|
files_kernel_modules_filetrans(update_modules_t, modules_conf_t, file)
|
|
files_etc_filetrans(update_modules_t, modules_conf_t, file)
|
|
|
|
# transition to depmod
|
|
domain_auto_trans(update_modules_t, depmod_exec_t, depmod_t)
|
|
allow update_modules_t depmod_t:fd use;
|
|
allow depmod_t update_modules_t:fd use;
|
|
allow depmod_t update_modules_t:fifo_file rw_file_perms;
|
|
allow depmod_t update_modules_t:process sigchld;
|
|
|
|
manage_dirs_pattern(update_modules_t, update_modules_tmp_t, update_modules_tmp_t)
|
|
manage_files_pattern(update_modules_t, update_modules_tmp_t, update_modules_tmp_t)
|
|
files_tmp_filetrans(update_modules_t, update_modules_tmp_t, { file dir })
|
|
|
|
kernel_read_kernel_sysctls(update_modules_t)
|
|
kernel_read_system_state(update_modules_t)
|
|
|
|
corecmd_exec_bin(update_modules_t)
|
|
corecmd_exec_shell(update_modules_t)
|
|
|
|
dev_read_urand(update_modules_t)
|
|
|
|
domain_use_interactive_fds(update_modules_t)
|
|
|
|
files_read_etc_runtime_files(update_modules_t)
|
|
files_read_etc_files(update_modules_t)
|
|
files_exec_etc_files(update_modules_t)
|
|
|
|
fs_getattr_xattr_fs(update_modules_t)
|
|
|
|
term_use_console(update_modules_t)
|
|
|
|
init_use_fds(update_modules_t)
|
|
init_use_script_fds(update_modules_t)
|
|
init_use_script_ptys(update_modules_t)
|
|
|
|
logging_send_syslog_msg(update_modules_t)
|
|
|
|
miscfiles_read_localization(update_modules_t)
|
|
|
|
userdom_use_user_terminals(update_modules_t)
|
|
userdom_dontaudit_search_user_home_dirs(update_modules_t)
|
|
|
|
ifdef(`distro_gentoo',`
|
|
files_search_pids(update_modules_t)
|
|
files_getattr_usr_src_files(update_modules_t)
|
|
files_list_isid_type_dirs(update_modules_t) # /var
|
|
|
|
# update-modules on Gentoo throws errors when run because it
|
|
# sources /etc/init.d/functions.sh, which always scans
|
|
# /var/lib/init.d to set SOFTLEVEL environment var.
|
|
# This is never used by update-modules.
|
|
files_dontaudit_search_var_lib(update_modules_t)
|
|
init_dontaudit_read_script_status_files(update_modules_t)
|
|
|
|
optional_policy(`
|
|
consoletype_exec(update_modules_t)
|
|
')
|
|
')
|
|
|
|
ifdef(`distro_ubuntu',`
|
|
optional_policy(`
|
|
unconfined_domain(update_modules_t)
|
|
')
|
|
')
|