selinux-policy/ephemeral.patch
2011-09-27 19:22:20 +02:00

246 lines
8.8 KiB
Diff

diff --git a/policy/modules/apps/mozilla.te b/policy/modules/apps/mozilla.te
index 68929b9..3370160 100644
--- a/policy/modules/apps/mozilla.te
+++ b/policy/modules/apps/mozilla.te
@@ -116,6 +116,7 @@ corenet_tcp_sendrecv_http_cache_port(mozilla_t)
corenet_tcp_sendrecv_squid_port(mozilla_t)
corenet_tcp_connect_flash_port(mozilla_t)
corenet_tcp_sendrecv_ftp_port(mozilla_t)
+corenet_tcp_connect_ephemeral_port(mozilla_t)
corenet_tcp_sendrecv_ipp_port(mozilla_t)
corenet_tcp_connect_http_port(mozilla_t)
corenet_tcp_connect_http_cache_port(mozilla_t)
diff --git a/policy/modules/apps/sandbox.te b/policy/modules/apps/sandbox.te
index 31c02d2..f61ee10 100644
--- a/policy/modules/apps/sandbox.te
+++ b/policy/modules/apps/sandbox.te
@@ -382,6 +382,7 @@ corenet_tcp_connect_http_cache_port(sandbox_web_type)
corenet_tcp_connect_squid_port(sandbox_web_type)
corenet_tcp_connect_flash_port(sandbox_web_type)
corenet_tcp_connect_ftp_port(sandbox_web_type)
+corenet_tcp_connect_ephemeral_port(sandbox_web_type)
corenet_tcp_connect_ipp_port(sandbox_web_type)
corenet_tcp_connect_streaming_port(sandbox_web_type)
corenet_tcp_connect_pulseaudio_port(sandbox_web_type)
diff --git a/policy/modules/kernel/corenetwork.if.in b/policy/modules/kernel/corenetwork.if.in
index 5a41e58..54e4c81 100644
--- a/policy/modules/kernel/corenetwork.if.in
+++ b/policy/modules/kernel/corenetwork.if.in
@@ -2269,6 +2269,42 @@ interface(`corenet_udp_bind_all_unreserved_ports',`
########################################
## <summary>
+## Bind TCP sockets to all ports > 32768.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`corenet_tcp_bind_all_ephemeral_ports',`
+ gen_require(`
+ attribute ephemeral_port_type;
+ ')
+
+ allow $1 ephemeral_port_type:tcp_socket name_bind;
+')
+
+########################################
+## <summary>
+## Bind UDP sockets to all ports > 32768.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`corenet_udp_bind_all_ephemeral_ports',`
+ gen_require(`
+ attribute ephemeral_port_type;
+ ')
+
+ allow $1 ephemeral_port_type:udp_socket name_bind;
+')
+
+########################################
+## <summary>
## Connect DCCP sockets to reserved ports.
## </summary>
## <param name="domain">
@@ -2341,6 +2377,24 @@ interface(`corenet_tcp_connect_all_unreserved_ports',`
########################################
## <summary>
+## Connect TCP sockets to all ports > 32768.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`corenet_tcp_connect_all_ephemeral_ports',`
+ gen_require(`
+ attribute ephemeral_port_type;
+ ')
+
+ allow $1 ephemeral_port_type:tcp_socket name_connect;
+')
+
+########################################
+## <summary>
## Do not audit attempts to connect DCCP sockets
## all reserved ports.
## </summary>
diff --git a/policy/modules/kernel/corenetwork.te.in b/policy/modules/kernel/corenetwork.te.in
index 5287f7a..f65fb75 100644
--- a/policy/modules/kernel/corenetwork.te.in
+++ b/policy/modules/kernel/corenetwork.te.in
@@ -14,6 +14,7 @@ attribute port_type;
attribute defined_port_type;
attribute reserved_port_type;
attribute unreserved_port_type;
+attribute ephemeral_port_type;
attribute rpc_port_type;
attribute server_packet_type;
@@ -66,11 +67,17 @@ type port_t, port_type;
sid port gen_context(system_u:object_r:port_t,s0)
#
-# port_t is the default type of INET port numbers.
+# unreserved_port_t is the default type of port numbers > 1024 and non ephemeral
#
type unreserved_port_t, port_type, unreserved_port_type;
#
+# ephemeral_port_t is the default type of ephemeral port numbers.
+# cat /proc/sys/net/ipv4/ip_local_port_range
+#
+type ephemeral_port_t, port_type, ephemeral_port_type;
+
+#
# reserved_port_t is the type of INET port numbers below 1024.
#
type reserved_port_t, port_type, reserved_port_type;
@@ -293,9 +300,12 @@ portcon tcp 512-1023 gen_context(system_u:object_r:hi_reserved_port_t, s0)
portcon udp 512-1023 gen_context(system_u:object_r:hi_reserved_port_t, s0)
portcon tcp 1-511 gen_context(system_u:object_r:reserved_port_t, s0)
portcon udp 1-511 gen_context(system_u:object_r:reserved_port_t, s0)
-portcon udp 1024-65535 gen_context(system_u:object_r:unreserved_port_t, s0)
-portcon tcp 1024-65535 gen_context(system_u:object_r:unreserved_port_t, s0)
-
+portcon tcp 1024-32767 gen_context(system_u:object_r:unreserved_port_t, s0)
+portcon tcp 32768-61000 gen_context(system_u:object_r:ephemeral_port_t, s0)
+portcon tcp 61001-65535 gen_context(system_u:object_r:unreserved_port_t, s0)
+portcon udp 1024-32767 gen_context(system_u:object_r:unreserved_port_t, s0)
+portcon udp 32768-61000 gen_context(system_u:object_r:ephemeral_port_t, s0)
+portcon udp 61001-65535 gen_context(system_u:object_r:unreserved_port_t, s0)
########################################
#
# Network nodes
diff --git a/policy/modules/kernel/corenetwork.te.m4 b/policy/modules/kernel/corenetwork.te.m4
index 49f27ca..e8acd10 100644
--- a/policy/modules/kernel/corenetwork.te.m4
+++ b/policy/modules/kernel/corenetwork.te.m4
@@ -81,7 +81,13 @@ declare_nodes($1_node_t,shift($*))
define(`declare_ports',`dnl
ifelse(eval(range_start($3) < 1024),1,`typeattribute $1 reserved_port_type;
ifelse(eval(range_start($3) >= 512),1,`typeattribute $1 rpc_port_type;',`dnl')
-',`typeattribute $1 unreserved_port_type;')
+',`
+ifelse(eval(range_start($3) < 32768),1,`typeattribute $1 unreserved_port_type;',`
+ ifelse(eval(range_start($3) > 61001),1,`typeattribute $1 unreserved_port_type;',`
+ typeattribute $1 ephemeral_port_type;
+ ')
+ ')
+')
portcon $2 $3 gen_context(system_u:object_r:$1,$4)
ifelse(`$5',`',`',`declare_ports($1,shiftn(4,$*))')dnl
')
diff --git a/policy/modules/services/apache.te b/policy/modules/services/apache.te
index 8596b90..9f37c11 100644
--- a/policy/modules/services/apache.te
+++ b/policy/modules/services/apache.te
@@ -137,6 +137,14 @@ gen_tunable(httpd_enable_ftp_server, false)
## <desc>
## <p>
+## Allow httpd to act as a FTP client
+## connecting to the ftp port and ephemeral ports
+## </p>
+## </desc>
+gen_tunable(httpd_can_connect_ftp, false)
+
+## <desc>
+## <p>
## Allow httpd to read home directories
## </p>
## </desc>
@@ -583,6 +591,7 @@ tunable_policy(`httpd_can_network_relay',`
corenet_sendrecv_http_client_packets(httpd_t)
corenet_sendrecv_http_cache_client_packets(httpd_t)
corenet_sendrecv_squid_client_packets(httpd_t)
+ corenet_tcp_connect_ephermeral_ports(httpd_t)
')
tunable_policy(`httpd_execmem',`
@@ -621,8 +630,14 @@ tunable_policy(`httpd_enable_cgi && httpd_unified && httpd_builtin_scripting',`
manage_lnk_files_pattern(httpd_t, httpdcontent, httpdcontent)
')
+tunable_policy(`httpd_can_network_connect_ftp',`
+ corenet_tcp_connect_ftp_port(httpd_t)
+ corenet_tcp_connect_ephemeral_ports(httpd_t)
+')
+
tunable_policy(`httpd_enable_ftp_server',`
corenet_tcp_bind_ftp_port(httpd_t)
+ corenet_tcp_bind_ephemeral_port(httpd_t)
')
tunable_policy(`httpd_tmp_exec && httpd_builtin_scripting',`
diff --git a/policy/modules/services/cobbler.te b/policy/modules/services/cobbler.te
index 2607914..cb33e76 100644
--- a/policy/modules/services/cobbler.te
+++ b/policy/modules/services/cobbler.te
@@ -110,6 +110,7 @@ corenet_tcp_sendrecv_generic_port(cobblerd_t)
corenet_tcp_sendrecv_cobbler_port(cobblerd_t)
# sync and rsync to ftp and http are permitted by default, for any other media use cobbler_can_network_connect.
corenet_tcp_connect_ftp_port(cobblerd_t)
+corenet_tcp_connect_ephemeral_port(ftpd_t)
corenet_tcp_sendrecv_ftp_port(cobblerd_t)
corenet_sendrecv_ftp_client_packets(cobblerd_t)
corenet_tcp_connect_http_port(cobblerd_t)
diff --git a/policy/modules/services/ftp.te b/policy/modules/services/ftp.te
index 9a1355e..f807210 100644
--- a/policy/modules/services/ftp.te
+++ b/policy/modules/services/ftp.te
@@ -218,9 +218,8 @@ corenet_tcp_bind_generic_node(ftpd_t)
corenet_tcp_bind_ftp_port(ftpd_t)
corenet_tcp_bind_ftp_data_port(ftpd_t)
corenet_tcp_bind_generic_port(ftpd_t)
-corenet_tcp_bind_all_unreserved_ports(ftpd_t)
-corenet_dontaudit_tcp_bind_all_ports(ftpd_t)
-corenet_tcp_connect_all_ports(ftpd_t)
+corenet_tcp_bind_all_ephemeral_ports(ftpd_t)
+corenet_tcp_connect_all_ephemeral_ports(ftpd_t)
corenet_sendrecv_ftp_server_packets(ftpd_t)
domain_use_interactive_fds(ftpd_t)
diff --git a/policy/modules/services/mock.te b/policy/modules/services/mock.te
index 1b9893a..a8eaa4d 100644
--- a/policy/modules/services/mock.te
+++ b/policy/modules/services/mock.te
@@ -87,7 +87,7 @@ corecmd_dontaudit_exec_all_executables(mock_t)
corenet_tcp_connect_http_port(mock_t)
corenet_tcp_connect_ftp_port(mock_t)
-corenet_tcp_connect_all_unreserved_ports(mock_t)
+corenet_tcp_connect_ephemeral_port(mock_t)
dev_read_urand(mock_t)
dev_read_sysfs(mock_t)