dd14d0d892
permission is checked when using shared libs to execute code in them, which is not the same as just reading the shared libs.
216 lines
7.1 KiB
Plaintext
216 lines
7.1 KiB
Plaintext
# Copyright (C) 2005 Tresys Technology, LLC
|
|
|
|
########################################
|
|
#
|
|
# cron_per_userdomain_template(domain)
|
|
#
|
|
|
|
define(`cron_per_userdomain_template',`
|
|
|
|
# Type of user crontabs once moved to cron spool.
|
|
type $1_cron_spool_t;
|
|
files_make_file($1_cron_spool_t)
|
|
|
|
type $1_crond_t; # user_crond_domain;
|
|
domain_make_domain($1_crond_t);
|
|
corecommands_make_shell_entrypoint($1_crond_t)
|
|
role $1_r types $1_crond_t;
|
|
|
|
type $1_crontab_t;
|
|
domain_make_domain($1_crontab_t)
|
|
domain_make_entrypoint_file($1_crontab_t,crontab_exec_t)
|
|
role $1_r types $1_crontab_t;
|
|
|
|
##############################
|
|
#
|
|
# $1_crond_t local policy
|
|
#
|
|
|
|
allow $1_crond_t self:capability dac_override;
|
|
allow $1_crond_t self:process { sigkill sigstop signull signal setsched };
|
|
allow $1_crond_t self:fifo_file { read getattr write append };
|
|
allow $1_crond_t self:unix_stream_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown listen accept };
|
|
allow $1_crond_t self:unix_dgram_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
|
|
|
|
# The entrypoint interface is not used as this is not
|
|
# a regular entrypoint. Since crontab files are
|
|
# not directly executed, crond must ensure that
|
|
# the crontab file has a type that is appropriate
|
|
# for the domain of the user cron job. It
|
|
# performs an entrypoint permission check
|
|
# for this purpose.
|
|
allow $1_crond_t $1_cron_spool_t:file entrypoint;
|
|
|
|
# Permit a transition from the crond_t domain to this domain.
|
|
# The transition is requested explicitly by the modified crond
|
|
# via setexeccon. There is no way to set up an automatic
|
|
# transition, since crontabs are configuration files, not executables.
|
|
allow crond_t $1_crond_t:process transition;
|
|
dontaudit crond_t $1_crond_t:process { noatsecure siginh rlimitinh };
|
|
|
|
kernel_read_system_state($1_crond_t)
|
|
kernel_read_kernel_sysctl($1_crond_t)
|
|
|
|
# ps does not need to access /boot when run from cron
|
|
bootloader_ignore_search_bootloader_data_directory($1_crond_t)
|
|
|
|
corenetwork_network_tcp_on_all_interfaces($1_crond_t)
|
|
corenetwork_network_raw_on_all_interfaces($1_crond_t)
|
|
corenetwork_network_udp_on_all_interfaces($1_crond_t)
|
|
corenetwork_network_tcp_on_all_nodes($1_crond_t)
|
|
corenetwork_network_raw_on_all_nodes($1_crond_t)
|
|
corenetwork_network_udp_on_all_nodes($1_crond_t)
|
|
corenetwork_network_tcp_on_all_ports($1_crond_t)
|
|
corenetwork_network_udp_on_all_ports($1_crond_t)
|
|
corenetwork_bind_tcp_on_all_nodes($1_crond_t)
|
|
corenetwork_bind_udp_on_all_nodes($1_crond_t)
|
|
|
|
devices_get_pseudorandom_data($1_crond_t)
|
|
|
|
filesystem_get_all_filesystems_attributes($1_crond_t)
|
|
|
|
domain_execute_all_entrypoint_programs($1_crond_t)
|
|
|
|
files_read_general_application_resources($1_crond_t)
|
|
files_execute_system_config_script($1_crond_t)
|
|
# for nscd:
|
|
files_ignore_search_runtime_data_directory($1_crond_t)
|
|
|
|
corecommands_execute_general_programs($1_crond_t)
|
|
corecommands_execute_system_programs($1_crond_t)
|
|
|
|
libraries_use_dynamic_loader($1_crond_t)
|
|
libraries_use_shared_libraries($1_crond_t)
|
|
libraries_execute_library_scripts($1_crond_t)
|
|
libraries_execute_dynamic_loader($1_crond_t)
|
|
|
|
files_read_runtime_system_config($1_crond_t)
|
|
|
|
logging_search_system_log_directory($1_crond_t)
|
|
|
|
selinux_read_config($1_crond_t)
|
|
|
|
miscfiles_read_localization($1_crond_t)
|
|
|
|
tunable_policy(`fcron_crond', `
|
|
allow crond_t $1_cron_spool_t:file { create ioctl read getattr lock write setattr append link unlink rename };
|
|
')
|
|
|
|
ifdef(`TODO',`
|
|
# Access user files and dirs.
|
|
allow $1_crond_t home_root_t:dir search;
|
|
file_type_auto_trans($1_crond_t, $1_home_dir_t, $1_home_t)
|
|
|
|
# Run scripts in user home directory and access shared libs.
|
|
can_exec($1_crond_t, $1_home_t)
|
|
|
|
file_type_auto_trans($1_crond_t, tmp_t, $1_tmp_t)
|
|
|
|
ifdef(`mta.te', `
|
|
domain_auto_trans($1_crond_t, sendmail_exec_t, $1_mail_t)
|
|
allow $1_crond_t sendmail_exec_t:lnk_file { getattr read };
|
|
|
|
# $1_mail_t should only be reading from the cron fifo not needing to write
|
|
dontaudit $1_mail_t crond_t:fifo_file write;
|
|
allow mta_user_agent $1_crond_t:fd use;
|
|
')
|
|
|
|
# This domain is granted permissions common to most domains.
|
|
can_ypbind($1_crond_t)
|
|
allow $1_crond_t var_spool_t:dir search;
|
|
allow $1_crond_t var_t:dir r_dir_perms;
|
|
allow $1_crond_t var_t:file { getattr read ioctl };
|
|
|
|
# quiet other ps operations
|
|
dontaudit $1_crond_t domain:dir { getattr search };
|
|
') dnl endif TODO
|
|
|
|
##############################
|
|
#
|
|
# $1_crontab_t local policy
|
|
#
|
|
|
|
# for ^Z
|
|
allow $1_t $1_crontab_t:process signal;
|
|
|
|
# Allow crond to read those crontabs in cron spool.
|
|
allow crond_t $1_cron_spool_t:file { getattr read };
|
|
|
|
# dac_override is to create the file in the directory under /tmp
|
|
allow $1_crontab_t self:capability { setuid setgid chown dac_override };
|
|
allow $1_crontab_t self:process { sigkill sigstop signull signal };
|
|
|
|
# create files in /var/spool/cron
|
|
allow $1_crontab_t $1_cron_spool_t:file { create ioctl read getattr lock write setattr append link unlink rename };
|
|
allow $1_crontab_t cron_spool_t:dir { getattr search read write add_name remove_name };
|
|
type_transition $1_crontab_t $1_cron_spool_t:file system_crond_tmp_t;
|
|
|
|
# crontab signals crond by updating the mtime on the spooldir
|
|
allow $1_crontab_t cron_spool_t:dir setattr;
|
|
|
|
allow $1_crontab_t crond_log_t:file { getattr read append };
|
|
|
|
filesystem_get_persistent_filesystem_attributes($1_crontab_t)
|
|
|
|
domain_use_widely_inheritable_file_descriptors($1_crontab_t)
|
|
|
|
files_read_general_system_config($1_crontab_t)
|
|
|
|
libraries_use_dynamic_loader($1_crontab_t)
|
|
libraries_use_shared_libraries($1_crontab_t)
|
|
|
|
logging_send_system_log_message($1_crontab_t)
|
|
|
|
miscfiles_read_localization($1_crontab_t)
|
|
|
|
ifdef(`TODO',`
|
|
|
|
# Transition from the user domain to the derived domain.
|
|
domain_auto_trans($1_t, crontab_exec_t, $1_crontab_t)
|
|
|
|
can_ps($1_t, $1_crontab_t)
|
|
|
|
dontaudit $1_crontab_t proc_t:dir search;
|
|
dontaudit $1_crontab_t selinux_config_t:dir search;
|
|
# for the checks used by crontab -u
|
|
dontaudit $1_crontab_t security_t:dir search;
|
|
|
|
# Type for temporary files.
|
|
file_type_auto_trans($1_crontab_t, tmp_t, $1_tmp_t, { dir file })
|
|
|
|
# Use the type when creating files in /var/spool/cron.
|
|
allow sysadm_crontab_t $1_cron_spool_t:file { getattr read };
|
|
|
|
tunable_policy(`fcron_crond', `
|
|
# fcron wants an instant update of a crontab change for the administrator
|
|
# also crontab does a security check for crontab -u
|
|
ifelse(`$1', `sysadm', `
|
|
allow $1_crontab_t self:process setfscreate;
|
|
kernel_get_selinuxfs_mount_point($1_crontab_t)
|
|
', `
|
|
dontaudit $1_crontab_t crond_t:process signal;
|
|
')dnl end ifelse
|
|
')dnl end ifdef fcron
|
|
|
|
# Run helper programs as $1_t
|
|
allow $1_crontab_t { bin_t sbin_t }:dir search;
|
|
allow $1_crontab_t bin_t:lnk_file read;
|
|
domain_auto_trans($1_crontab_t, { bin_t sbin_t shell_exec_t }, $1_t)
|
|
|
|
# Read user crontabs
|
|
allow $1_crontab_t { $1_home_t $1_home_dir_t }:dir r_dir_perms;
|
|
allow $1_crontab_t $1_home_t:file r_file_perms;
|
|
dontaudit $1_crontab_t $1_home_dir_t:dir write;
|
|
|
|
# Access terminals.
|
|
allow $1_crontab_t devpts_t:dir { read search getattr };
|
|
allow $1_crontab_t $1_tty_device_t:chr_file { read write getattr ioctl };
|
|
allow $1_crontab_t $1_devpts_t:chr_file { read write getattr ioctl };
|
|
|
|
# Inherit and use descriptors from gnome-pty-helper.
|
|
ifdef(`gnome-pty-helper.te', `allow $1_crontab_t $1_gph_t:fd use;')
|
|
|
|
dontaudit $1_crontab_t var_run_t:dir search;
|
|
') dnl endif TODO
|
|
')
|