selinux-policy/policy/constraints
2010-08-26 09:41:21 -04:00

240 lines
5.9 KiB
Plaintext

#
# Define the constraints
#
# constrain class_set perm_set expression ;
#
# expression : ( expression )
# | not expression
# | expression and expression
# | expression or expression
# | u1 op u2
# | r1 role_op r2
# | t1 op t2
# | u1 op names
# | u2 op names
# | r1 op names
# | r2 op names
# | t1 op names
# | t2 op names
#
# op : == | !=
# role_op : == | != | eq | dom | domby | incomp
#
# names : name | { name_list }
# name_list : name | name_list name
#
define(`basic_ubac_conditions',`
ifdef(`enable_ubac',`
u1 == u2
or u1 == system_u
or u2 == system_u
or t1 != ubac_constrained_type
or t2 != ubac_constrained_type
')
')
define(`basic_ubac_constraint',`
ifdef(`enable_ubac',`
constrain $1 all_$1_perms
(
basic_ubac_conditions
);
')
')
define(`exempted_ubac_constraint',`
ifdef(`enable_ubac',`
constrain $1 all_$1_perms
(
basic_ubac_conditions
or t1 == $2
);
')
')
########################################
#
# File rules
#
exempted_ubac_constraint(dir, ubacfile)
exempted_ubac_constraint(file, ubacfile)
exempted_ubac_constraint(lnk_file, ubacfile)
exempted_ubac_constraint(fifo_file, ubacfile)
exempted_ubac_constraint(sock_file, ubacfile)
exempted_ubac_constraint(chr_file, ubacfile)
exempted_ubac_constraint(blk_file, ubacfile)
# SELinux object identity change constraint:
constrain dir_file_class_set { create relabelto relabelfrom }
(
u1 == u2
or t1 == can_change_object_identity
);
########################################
#
# Process rules
#
ifdef(`enable_ubac',`
constrain process { sigchld sigkill sigstop signull signal ptrace getsched setsched getsession getpgid setpgid getcap setcap share getattr setrlimit }
(
basic_ubac_conditions
or t1 == ubacproc
);
')
constrain process { transition noatsecure siginh rlimitinh }
(
u1 == u2
or ( t1 == can_change_process_identity and t2 == process_user_target )
or ( t1 == cron_source_domain and ( t2 == cron_job_domain or u2 == system_u ) )
or ( t1 == can_system_change and u2 == system_u )
or ( t1 == process_uncond_exempt )
);
constrain process { transition noatsecure siginh rlimitinh }
(
r1 == r2
or ( t1 == can_change_process_role and t2 == process_user_target )
or ( t1 == cron_source_domain and t2 == cron_job_domain )
or ( t1 == can_system_change and r2 == system_r )
or ( t1 == process_uncond_exempt )
);
constrain process dyntransition
(
u1 == u2 and r1 == r2
);
# These permissions do not have ubac constraints:
# fork
# setexec
# setfscreate
# setcurrent
# execmem
# execstack
# execheap
# setkeycreate
# setsockcreate
########################################
#
# File descriptor rules
#
exempted_ubac_constraint(fd, ubacfd)
########################################
#
# Socket rules
#
exempted_ubac_constraint(socket, ubacsock)
exempted_ubac_constraint(tcp_socket, ubacsock)
exempted_ubac_constraint(udp_socket, ubacsock)
exempted_ubac_constraint(rawip_socket, ubacsock)
exempted_ubac_constraint(netlink_socket, ubacsock)
exempted_ubac_constraint(packet_socket, ubacsock)
exempted_ubac_constraint(key_socket, ubacsock)
exempted_ubac_constraint(unix_stream_socket, ubacsock)
exempted_ubac_constraint(unix_dgram_socket, ubacsock)
exempted_ubac_constraint(netlink_route_socket, ubacsock)
exempted_ubac_constraint(netlink_firewall_socket, ubacsock)
exempted_ubac_constraint(netlink_tcpdiag_socket, ubacsock)
exempted_ubac_constraint(netlink_nflog_socket, ubacsock)
exempted_ubac_constraint(netlink_xfrm_socket, ubacsock)
exempted_ubac_constraint(netlink_selinux_socket, ubacsock)
exempted_ubac_constraint(netlink_audit_socket, ubacsock)
exempted_ubac_constraint(netlink_ip6fw_socket, ubacsock)
exempted_ubac_constraint(netlink_dnrt_socket, ubacsock)
exempted_ubac_constraint(netlink_kobject_uevent_socket, ubacsock)
exempted_ubac_constraint(appletalk_socket, ubacsock)
exempted_ubac_constraint(dccp_socket, ubacsock)
constrain socket_class_set { create relabelto relabelfrom }
(
u1 == u2
or t1 == can_change_object_identity
);
########################################
#
# SysV IPC rules
exempted_ubac_constraint(sem, ubacipc)
exempted_ubac_constraint(msg, ubacipc)
exempted_ubac_constraint(msgq, ubacipc)
exempted_ubac_constraint(shm, ubacipc)
exempted_ubac_constraint(ipc, ubacipc)
########################################
#
# X Windows rules
#
exempted_ubac_constraint(x_drawable, ubacxwin)
exempted_ubac_constraint(x_screen, ubacxwin)
exempted_ubac_constraint(x_gc, ubacxwin)
exempted_ubac_constraint(x_font, ubacxwin)
exempted_ubac_constraint(x_colormap, ubacxwin)
exempted_ubac_constraint(x_property, ubacxwin)
exempted_ubac_constraint(x_selection, ubacxwin)
exempted_ubac_constraint(x_cursor, ubacxwin)
exempted_ubac_constraint(x_client, ubacxwin)
exempted_ubac_constraint(x_device, ubacxwin)
exempted_ubac_constraint(x_server, ubacxwin)
exempted_ubac_constraint(x_extension, ubacxwin)
exempted_ubac_constraint(x_resource, ubacxwin)
exempted_ubac_constraint(x_event, ubacxwin)
exempted_ubac_constraint(x_synthetic_event, ubacxwin)
exempted_ubac_constraint(x_application_data, ubacxwin)
########################################
#
# D-BUS rules
#
exempted_ubac_constraint(dbus, ubacdbus)
########################################
#
# Key rules
#
exempted_ubac_constraint(key, ubackey)
########################################
#
# Database rules
#
exempted_ubac_constraint(db_database, ubacdb)
exempted_ubac_constraint(db_table, ubacdb)
exempted_ubac_constraint(db_procedure, ubacdb)
exempted_ubac_constraint(db_column, ubacdb)
exempted_ubac_constraint(db_tuple, ubacdb)
exempted_ubac_constraint(db_blob, ubacdb)
basic_ubac_constraint(association)
basic_ubac_constraint(peer)
# These classes have no UBAC restrictions
# class security
# class system
# class capability
# class memprotect
# class passwd
# class node
# class netif
# class packet
# class capability2
# class nscd
# class context
undefine(`basic_ubac_constraint')
undefine(`basic_ubac_conditions')
undefine(`exempted_ubac_constraint')