ptrace from the system Remove 2000 dontaudit rules between confined domains on transition and replace with single dontaudit domain domain:process { noatsecure siginh rlimitinh } ;
1387 lines
47 KiB
Diff
1387 lines
47 KiB
Diff
diff -up serefpolicy-3.10.0/policy/modules/admin/usermanage.if.userdomain serefpolicy-3.10.0/policy/modules/admin/usermanage.if
|
|
--- serefpolicy-3.10.0/policy/modules/admin/usermanage.if.userdomain 2011-10-11 10:15:28.062129903 -0400
|
|
+++ serefpolicy-3.10.0/policy/modules/admin/usermanage.if 2011-10-11 10:15:28.489129089 -0400
|
|
@@ -308,7 +308,7 @@ interface(`usermanage_run_useradd',`
|
|
role $2 types useradd_t;
|
|
|
|
# Add/remove user home directories
|
|
- userdom_manage_home_role($2, useradd_t)
|
|
+ userdom_manage_home_role($2)
|
|
|
|
seutil_run_semanage(useradd_t, $2)
|
|
|
|
diff -up serefpolicy-3.10.0/policy/modules/admin/usermanage.te.userdomain serefpolicy-3.10.0/policy/modules/admin/usermanage.te
|
|
--- serefpolicy-3.10.0/policy/modules/admin/usermanage.te.userdomain 2011-10-11 10:15:28.447129169 -0400
|
|
+++ serefpolicy-3.10.0/policy/modules/admin/usermanage.te 2011-10-11 10:15:28.490129087 -0400
|
|
@@ -512,7 +512,7 @@ seutil_domtrans_setfiles(useradd_t)
|
|
userdom_use_unpriv_users_fds(useradd_t)
|
|
# Add/remove user home directories
|
|
userdom_home_filetrans_user_home_dir(useradd_t)
|
|
-userdom_manage_home_role(system_r, useradd_t)
|
|
+userdom_manage_home(useradd_t)
|
|
|
|
mta_manage_spool(useradd_t)
|
|
|
|
diff -up serefpolicy-3.10.0/policy/modules/apps/execmem.if.userdomain serefpolicy-3.10.0/policy/modules/apps/execmem.if
|
|
--- serefpolicy-3.10.0/policy/modules/apps/execmem.if.userdomain 2011-10-11 10:15:28.472129121 -0400
|
|
+++ serefpolicy-3.10.0/policy/modules/apps/execmem.if 2011-10-11 10:15:28.491129085 -0400
|
|
@@ -57,8 +57,6 @@ template(`execmem_role_template',`
|
|
role $2 types $1_execmem_t;
|
|
|
|
userdom_unpriv_usertype($1, $1_execmem_t)
|
|
- userdom_manage_tmp_role($2, $1_execmem_t)
|
|
- userdom_manage_tmpfs_role($2, $1_execmem_t)
|
|
|
|
allow $1_execmem_t self:process { execmem execstack };
|
|
allow $3 $1_execmem_t:process { getattr ptrace noatsecure signal_perms };
|
|
diff -up serefpolicy-3.10.0/policy/modules/apps/java.if.userdomain serefpolicy-3.10.0/policy/modules/apps/java.if
|
|
--- serefpolicy-3.10.0/policy/modules/apps/java.if.userdomain 2011-10-11 10:15:28.077129873 -0400
|
|
+++ serefpolicy-3.10.0/policy/modules/apps/java.if 2011-10-11 10:15:28.492129083 -0400
|
|
@@ -73,7 +73,8 @@ template(`java_role_template',`
|
|
domain_interactive_fd($1_java_t)
|
|
|
|
userdom_unpriv_usertype($1, $1_java_t)
|
|
- userdom_manage_tmpfs_role($2, $1_java_t)
|
|
+ userdom_manage_tmpfs_role($2)
|
|
+ userdom_manage_tmpfs($1_java_t)
|
|
|
|
allow $1_java_t self:process { ptrace signal getsched execmem execstack };
|
|
|
|
diff -up serefpolicy-3.10.0/policy/modules/apps/mono.if.userdomain serefpolicy-3.10.0/policy/modules/apps/mono.if
|
|
--- serefpolicy-3.10.0/policy/modules/apps/mono.if.userdomain 2011-10-11 10:15:28.082129864 -0400
|
|
+++ serefpolicy-3.10.0/policy/modules/apps/mono.if 2011-10-11 10:15:28.493129081 -0400
|
|
@@ -49,7 +49,8 @@ template(`mono_role_template',`
|
|
corecmd_bin_domtrans($1_mono_t, $1_t)
|
|
|
|
userdom_unpriv_usertype($1, $1_mono_t)
|
|
- userdom_manage_tmpfs_role($2, $1_mono_t)
|
|
+ userdom_manage_tmpfs_role($2)
|
|
+ userdom_manage_tmpfs($1_mono_t)
|
|
|
|
optional_policy(`
|
|
xserver_role($1_r, $1_mono_t)
|
|
diff -up serefpolicy-3.10.0/policy/modules/apps/mozilla.if.userdomain serefpolicy-3.10.0/policy/modules/apps/mozilla.if
|
|
--- serefpolicy-3.10.0/policy/modules/apps/mozilla.if.userdomain 2011-10-11 10:15:28.083129862 -0400
|
|
+++ serefpolicy-3.10.0/policy/modules/apps/mozilla.if 2011-10-11 10:15:28.494129079 -0400
|
|
@@ -51,7 +51,7 @@ interface(`mozilla_role',`
|
|
mozilla_run_plugin(mozilla_t, $1)
|
|
mozilla_dbus_chat($2)
|
|
|
|
- userdom_manage_tmp_role($1, mozilla_t)
|
|
+ userdom_manage_tmp_role($1)
|
|
|
|
optional_policy(`
|
|
nsplugin_role($1, mozilla_t)
|
|
diff -up serefpolicy-3.10.0/policy/modules/apps/nsplugin.if.userdomain serefpolicy-3.10.0/policy/modules/apps/nsplugin.if
|
|
--- serefpolicy-3.10.0/policy/modules/apps/nsplugin.if.userdomain 2011-10-11 10:15:28.087129854 -0400
|
|
+++ serefpolicy-3.10.0/policy/modules/apps/nsplugin.if 2011-10-11 10:15:28.495129077 -0400
|
|
@@ -103,7 +103,7 @@ ifdef(`hide_broken_symptoms', `
|
|
userdom_use_inherited_user_terminals(nsplugin_t)
|
|
userdom_use_inherited_user_terminals(nsplugin_config_t)
|
|
userdom_dontaudit_setattr_user_home_content_files(nsplugin_t)
|
|
- userdom_manage_tmpfs_role($1, nsplugin_t)
|
|
+ userdom_manage_tmpfs_role($1)
|
|
|
|
optional_policy(`
|
|
pulseaudio_role($1, nsplugin_t)
|
|
diff -up serefpolicy-3.10.0/policy/modules/apps/nsplugin.te.userdomain serefpolicy-3.10.0/policy/modules/apps/nsplugin.te
|
|
--- serefpolicy-3.10.0/policy/modules/apps/nsplugin.te.userdomain 2011-10-11 10:15:28.088129853 -0400
|
|
+++ serefpolicy-3.10.0/policy/modules/apps/nsplugin.te 2011-10-11 10:15:28.496129075 -0400
|
|
@@ -286,6 +286,7 @@ userdom_search_user_home_content(nsplugi
|
|
userdom_read_user_home_content_symlinks(nsplugin_config_t)
|
|
userdom_read_user_home_content_files(nsplugin_config_t)
|
|
userdom_dontaudit_search_admin_dir(nsplugin_config_t)
|
|
+userdom_manage_tmpfs(nsplugin_t)
|
|
|
|
tunable_policy(`use_nfs_home_dirs',`
|
|
fs_getattr_nfs(nsplugin_t)
|
|
diff -up serefpolicy-3.10.0/policy/modules/apps/pulseaudio.if.userdomain serefpolicy-3.10.0/policy/modules/apps/pulseaudio.if
|
|
--- serefpolicy-3.10.0/policy/modules/apps/pulseaudio.if.userdomain 2011-10-11 10:15:28.089129851 -0400
|
|
+++ serefpolicy-3.10.0/policy/modules/apps/pulseaudio.if 2011-10-11 10:15:28.497129073 -0400
|
|
@@ -35,9 +35,9 @@ interface(`pulseaudio_role',`
|
|
allow pulseaudio_t $2:unix_stream_socket connectto;
|
|
allow $2 pulseaudio_t:unix_stream_socket connectto;
|
|
|
|
- userdom_manage_home_role($1, pulseaudio_t)
|
|
- userdom_manage_tmp_role($1, pulseaudio_t)
|
|
- userdom_manage_tmpfs_role($1, pulseaudio_t)
|
|
+ userdom_manage_home_role($1)
|
|
+ userdom_manage_tmp_role($1)
|
|
+ userdom_manage_tmpfs_role($1)
|
|
|
|
allow $2 pulseaudio_t:dbus send_msg;
|
|
allow pulseaudio_t $2:dbus { acquire_svc send_msg };
|
|
diff -up serefpolicy-3.10.0/policy/modules/apps/pulseaudio.te.userdomain serefpolicy-3.10.0/policy/modules/apps/pulseaudio.te
|
|
--- serefpolicy-3.10.0/policy/modules/apps/pulseaudio.te.userdomain 2011-10-11 10:15:28.091129847 -0400
|
|
+++ serefpolicy-3.10.0/policy/modules/apps/pulseaudio.te 2011-10-11 10:15:28.498129071 -0400
|
|
@@ -95,6 +95,10 @@ logging_send_syslog_msg(pulseaudio_t)
|
|
|
|
miscfiles_read_localization(pulseaudio_t)
|
|
|
|
+userdom_manage_home(pulseaudio_t)
|
|
+userdom_manage_tmp(pulseaudio_t)
|
|
+userdom_manage_tmpfs(pulseaudio_t)
|
|
+
|
|
optional_policy(`
|
|
alsa_read_rw_config(pulseaudio_t)
|
|
')
|
|
diff -up serefpolicy-3.10.0/policy/modules/apps/userhelper.if.userdomain serefpolicy-3.10.0/policy/modules/apps/userhelper.if
|
|
--- serefpolicy-3.10.0/policy/modules/apps/userhelper.if.userdomain 2011-10-11 10:15:28.102129826 -0400
|
|
+++ serefpolicy-3.10.0/policy/modules/apps/userhelper.if 2011-10-11 10:15:28.498129071 -0400
|
|
@@ -294,7 +294,7 @@ template(`userhelper_console_role_templa
|
|
|
|
auth_use_pam($1_consolehelper_t)
|
|
|
|
- userdom_manage_tmpfs_role($2, $1_consolehelper_t)
|
|
+ userdom_manage_tmpfs_role($2)
|
|
|
|
optional_policy(`
|
|
dbus_connect_session_bus($1_consolehelper_t)
|
|
diff -up serefpolicy-3.10.0/policy/modules/apps/userhelper.te.userdomain serefpolicy-3.10.0/policy/modules/apps/userhelper.te
|
|
--- serefpolicy-3.10.0/policy/modules/apps/userhelper.te.userdomain 2011-10-11 10:15:28.102129826 -0400
|
|
+++ serefpolicy-3.10.0/policy/modules/apps/userhelper.te 2011-10-11 10:15:28.499129069 -0400
|
|
@@ -65,6 +65,7 @@ userhelper_exec(consolehelper_domain)
|
|
userdom_use_user_ptys(consolehelper_domain)
|
|
userdom_use_user_ttys(consolehelper_domain)
|
|
userdom_read_user_home_content_files(consolehelper_domain)
|
|
+userdom_manage_tmpfs(consolehelper_domain)
|
|
|
|
optional_policy(`
|
|
gnome_read_gconf_home_files(consolehelper_domain)
|
|
diff -up serefpolicy-3.10.0/policy/modules/apps/wine.if.userdomain serefpolicy-3.10.0/policy/modules/apps/wine.if
|
|
--- serefpolicy-3.10.0/policy/modules/apps/wine.if.userdomain 2011-10-11 10:15:28.105129820 -0400
|
|
+++ serefpolicy-3.10.0/policy/modules/apps/wine.if 2011-10-11 10:15:28.499129069 -0400
|
|
@@ -105,7 +105,8 @@ template(`wine_role_template',`
|
|
corecmd_bin_domtrans($1_wine_t, $1_t)
|
|
|
|
userdom_unpriv_usertype($1, $1_wine_t)
|
|
- userdom_manage_tmpfs_role($2, $1_wine_t)
|
|
+ userdom_manage_tmpfs_role($2)
|
|
+ userdom_manage_tmpfs($1_wine_t)
|
|
|
|
domain_mmap_low($1_wine_t)
|
|
|
|
diff -up serefpolicy-3.10.0/policy/modules/apps/wm.if.userdomain serefpolicy-3.10.0/policy/modules/apps/wm.if
|
|
--- serefpolicy-3.10.0/policy/modules/apps/wm.if.userdomain 2011-10-11 10:15:28.107129816 -0400
|
|
+++ serefpolicy-3.10.0/policy/modules/apps/wm.if 2011-10-11 10:15:28.500129068 -0400
|
|
@@ -77,9 +77,13 @@ template(`wm_role_template',`
|
|
miscfiles_read_fonts($1_wm_t)
|
|
miscfiles_read_localization($1_wm_t)
|
|
|
|
- userdom_manage_home_role($2, $1_wm_t)
|
|
- userdom_manage_tmpfs_role($2, $1_wm_t)
|
|
- userdom_manage_tmp_role($2, $1_wm_t)
|
|
+ userdom_manage_home_role($2)
|
|
+ userdom_manage_home($1_wm_t)
|
|
+ userdom_manage_tmpfs_role($2)
|
|
+ userdom_manage_tmpfs($1_wm_t)
|
|
+ userdom_manage_tmp_role($2)
|
|
+ userdom_manage_tmp($1_wm_t)
|
|
+
|
|
userdom_exec_user_tmp_files($1_wm_t)
|
|
|
|
optional_policy(`
|
|
diff -up serefpolicy-3.10.0/policy/modules/roles/sysadm.te.userdomain serefpolicy-3.10.0/policy/modules/roles/sysadm.te
|
|
--- serefpolicy-3.10.0/policy/modules/roles/sysadm.te.userdomain 2011-10-11 10:15:28.000000000 -0400
|
|
+++ serefpolicy-3.10.0/policy/modules/roles/sysadm.te 2011-10-11 10:16:15.471039586 -0400
|
|
@@ -60,7 +60,8 @@ sysnet_filetrans_named_content(sysadm_t)
|
|
# Add/remove user home directories
|
|
userdom_manage_user_home_dirs(sysadm_t)
|
|
userdom_home_filetrans_user_home_dir(sysadm_t)
|
|
-userdom_manage_tmp_role(sysadm_r, sysadm_t)
|
|
+userdom_manage_tmp_role(sysadm_r)
|
|
+userdom_manage_tmp(sysadm_t)
|
|
|
|
optional_policy(`
|
|
ssh_filetrans_admin_home_content(sysadm_t)
|
|
diff -up serefpolicy-3.10.0/policy/modules/roles/unconfineduser.te.userdomain serefpolicy-3.10.0/policy/modules/roles/unconfineduser.te
|
|
--- serefpolicy-3.10.0/policy/modules/roles/unconfineduser.te.userdomain 2011-10-11 10:15:28.476129113 -0400
|
|
+++ serefpolicy-3.10.0/policy/modules/roles/unconfineduser.te 2011-10-11 10:15:28.501129066 -0400
|
|
@@ -45,9 +45,12 @@ gen_tunable(unconfined_login, true)
|
|
# calls is not correct, however we dont currently
|
|
# have another method to add access to these types
|
|
userdom_base_user_template(unconfined)
|
|
-userdom_manage_home_role(unconfined_r, unconfined_t)
|
|
-userdom_manage_tmp_role(unconfined_r, unconfined_t)
|
|
-userdom_manage_tmpfs_role(unconfined_r, unconfined_t)
|
|
+userdom_manage_home_role(unconfined_r)
|
|
+userdom_user_home_dir_filetrans_user_home_content(unconfined_t, { dir file lnk_file sock_file fifo_file })
|
|
+userdom_manage_tmp_role(unconfined_r)
|
|
+userdom_manage_tmp(unconfined_t)
|
|
+userdom_manage_tmpfs_role(unconfined_r)
|
|
+userdom_manage_tmpfs(unconfined_t)
|
|
userdom_unpriv_usertype(unconfined, unconfined_t)
|
|
|
|
type unconfined_exec_t;
|
|
diff -up serefpolicy-3.10.0/policy/modules/services/rshd.te.userdomain serefpolicy-3.10.0/policy/modules/services/rshd.te
|
|
--- serefpolicy-3.10.0/policy/modules/services/rshd.te.userdomain 2011-10-11 10:15:28.333129386 -0400
|
|
+++ serefpolicy-3.10.0/policy/modules/services/rshd.te 2011-10-11 10:15:28.502129064 -0400
|
|
@@ -66,7 +66,7 @@ seutil_read_config(rshd_t)
|
|
seutil_read_default_contexts(rshd_t)
|
|
|
|
userdom_search_user_home_content(rshd_t)
|
|
-userdom_manage_tmp_role(system_r, rshd_t)
|
|
+userdom_manage_tmp(rshd_t)
|
|
|
|
tunable_policy(`use_nfs_home_dirs',`
|
|
fs_read_nfs_files(rshd_t)
|
|
diff -up serefpolicy-3.10.0/policy/modules/services/ssh.if.userdomain serefpolicy-3.10.0/policy/modules/services/ssh.if
|
|
--- serefpolicy-3.10.0/policy/modules/services/ssh.if.userdomain 2011-10-11 10:15:28.354129346 -0400
|
|
+++ serefpolicy-3.10.0/policy/modules/services/ssh.if 2011-10-11 10:15:28.503129062 -0400
|
|
@@ -380,7 +380,7 @@ template(`ssh_role_template',`
|
|
manage_lnk_files_pattern($3, ssh_home_t, ssh_home_t)
|
|
manage_sock_files_pattern($3, ssh_home_t, ssh_home_t)
|
|
userdom_search_user_home_dirs($1_t)
|
|
- userdom_manage_tmp_role($2, ssh_t)
|
|
+ userdom_manage_tmp(ssh_t)
|
|
|
|
##############################
|
|
#
|
|
diff -up serefpolicy-3.10.0/policy/modules/services/ssh.te.userdomain serefpolicy-3.10.0/policy/modules/services/ssh.te
|
|
--- serefpolicy-3.10.0/policy/modules/services/ssh.te.userdomain 2011-10-11 10:15:28.355129344 -0400
|
|
+++ serefpolicy-3.10.0/policy/modules/services/ssh.te 2011-10-11 10:15:28.503129062 -0400
|
|
@@ -200,6 +200,7 @@ userdom_read_user_tmp_files(ssh_t)
|
|
userdom_write_user_tmp_files(ssh_t)
|
|
userdom_read_user_home_content_symlinks(ssh_t)
|
|
userdom_read_home_certs(ssh_t)
|
|
+userdom_manage_tmp(ssh_t)
|
|
|
|
tunable_policy(`allow_ssh_keysign',`
|
|
domtrans_pattern(ssh_t, ssh_keysign_exec_t, ssh_keysign_t)
|
|
@@ -280,7 +281,7 @@ corenet_sendrecv_xserver_server_packets(
|
|
|
|
userdom_read_user_home_content_files(sshd_t)
|
|
userdom_read_user_home_content_symlinks(sshd_t)
|
|
-userdom_manage_tmp_role(system_r, sshd_t)
|
|
+userdom_manage_tmp(sshd_t)
|
|
userdom_spec_domtrans_unpriv_users(sshd_t)
|
|
userdom_signal_unpriv_users(sshd_t)
|
|
userdom_dyntransition_unpriv_users(sshd_t)
|
|
diff -up serefpolicy-3.10.0/policy/modules/services/sssd.te.userdomain serefpolicy-3.10.0/policy/modules/services/sssd.te
|
|
--- serefpolicy-3.10.0/policy/modules/services/sssd.te.userdomain 2011-10-11 10:15:28.356129342 -0400
|
|
+++ serefpolicy-3.10.0/policy/modules/services/sssd.te 2011-10-11 10:15:28.504129060 -0400
|
|
@@ -92,7 +92,7 @@ miscfiles_read_generic_certs(sssd_t)
|
|
sysnet_dns_name_resolve(sssd_t)
|
|
sysnet_use_ldap(sssd_t)
|
|
|
|
-userdom_manage_tmp_role(system_r, sssd_t)
|
|
+userdom_manage_tmp(sssd_t)
|
|
|
|
optional_policy(`
|
|
dbus_system_bus_client(sssd_t)
|
|
diff -up serefpolicy-3.10.0/policy/modules/services/xserver.te.userdomain serefpolicy-3.10.0/policy/modules/services/xserver.te
|
|
--- serefpolicy-3.10.0/policy/modules/services/xserver.te.userdomain 2011-10-11 10:15:28.480129106 -0400
|
|
+++ serefpolicy-3.10.0/policy/modules/services/xserver.te 2011-10-11 10:15:28.505129058 -0400
|
|
@@ -671,7 +671,7 @@ userdom_stream_connect(xdm_t)
|
|
userdom_manage_user_tmp_dirs(xdm_t)
|
|
userdom_manage_user_tmp_files(xdm_t)
|
|
userdom_manage_user_tmp_sockets(xdm_t)
|
|
-userdom_manage_tmpfs_role(system_r, xdm_t)
|
|
+userdom_manage_tmpfs(xdm_t)
|
|
|
|
application_signal(xdm_t)
|
|
|
|
diff -up serefpolicy-3.10.0/policy/modules/system/userdomain.if.userdomain serefpolicy-3.10.0/policy/modules/system/userdomain.if
|
|
--- serefpolicy-3.10.0/policy/modules/system/userdomain.if.userdomain 2011-10-11 10:15:28.482129102 -0400
|
|
+++ serefpolicy-3.10.0/policy/modules/system/userdomain.if 2011-10-11 10:15:28.506129056 -0400
|
|
@@ -35,21 +35,14 @@ template(`userdom_base_user_template',`
|
|
type $1_t, userdomain, $1_usertype;
|
|
domain_type($1_t)
|
|
role $1_r;
|
|
- corecmd_shell_entry_type($1_t)
|
|
- corecmd_bin_entry_type($1_t)
|
|
domain_user_exemption_target($1_t)
|
|
ubac_constrained($1_t)
|
|
role $1_r types $1_t;
|
|
allow system_r $1_r;
|
|
|
|
- term_user_pty($1_t, user_devpts_t)
|
|
-
|
|
- term_user_tty($1_t, user_tty_device_t)
|
|
- term_dontaudit_getattr_generic_ptys($1_t)
|
|
-
|
|
allow $1_usertype $1_usertype:process { ptrace signal_perms getsched setsched share getpgid setpgid getcap setcap getsession getattr };
|
|
allow $1_usertype $1_usertype:fd use;
|
|
- allow $1_usertype $1_t:key { create view read write search link setattr };
|
|
+ allow $1_usertype $1_usertype:key { create view read write search link setattr };
|
|
|
|
allow $1_usertype $1_usertype:fifo_file rw_fifo_file_perms;
|
|
allow $1_usertype $1_usertype:unix_dgram_socket { create_socket_perms sendto };
|
|
@@ -61,114 +54,7 @@ template(`userdom_base_user_template',`
|
|
allow $1_usertype $1_usertype:context contains;
|
|
dontaudit $1_usertype $1_usertype:socket create;
|
|
|
|
- allow $1_usertype user_devpts_t:chr_file { setattr rw_chr_file_perms };
|
|
- term_create_pty($1_usertype, user_devpts_t)
|
|
- # avoid annoying messages on terminal hangup on role change
|
|
- dontaudit $1_usertype user_devpts_t:chr_file ioctl;
|
|
-
|
|
- allow $1_usertype user_tty_device_t:chr_file { setattr rw_chr_file_perms };
|
|
- # avoid annoying messages on terminal hangup on role change
|
|
- dontaudit $1_usertype user_tty_device_t:chr_file ioctl;
|
|
-
|
|
- application_exec_all($1_usertype)
|
|
-
|
|
- kernel_read_kernel_sysctls($1_usertype)
|
|
- kernel_read_all_sysctls($1_usertype)
|
|
- kernel_dontaudit_list_unlabeled($1_usertype)
|
|
- kernel_dontaudit_getattr_unlabeled_files($1_usertype)
|
|
- kernel_dontaudit_getattr_unlabeled_symlinks($1_usertype)
|
|
- kernel_dontaudit_getattr_unlabeled_pipes($1_usertype)
|
|
- kernel_dontaudit_getattr_unlabeled_sockets($1_usertype)
|
|
- kernel_dontaudit_getattr_unlabeled_blk_files($1_usertype)
|
|
- kernel_dontaudit_getattr_unlabeled_chr_files($1_usertype)
|
|
- kernel_dontaudit_list_proc($1_usertype)
|
|
-
|
|
- dev_dontaudit_getattr_all_blk_files($1_usertype)
|
|
- dev_dontaudit_getattr_all_chr_files($1_usertype)
|
|
- dev_getattr_mtrr_dev($1_t)
|
|
-
|
|
- # When the user domain runs ps, there will be a number of access
|
|
- # denials when ps tries to search /proc. Do not audit these denials.
|
|
- domain_dontaudit_read_all_domains_state($1_usertype)
|
|
- domain_dontaudit_getattr_all_domains($1_usertype)
|
|
- domain_dontaudit_getsession_all_domains($1_usertype)
|
|
- dev_dontaudit_all_access_check($1_usertype)
|
|
-
|
|
- files_read_etc_files($1_usertype)
|
|
- files_list_mnt($1_usertype)
|
|
- files_list_var($1_usertype)
|
|
- files_read_mnt_files($1_usertype)
|
|
- files_dontaudit_access_check_mnt($1_usertype)
|
|
- files_read_etc_runtime_files($1_usertype)
|
|
- files_read_usr_files($1_usertype)
|
|
- files_read_usr_src_files($1_usertype)
|
|
- # Read directories and files with the readable_t type.
|
|
- # This type is a general type for "world"-readable files.
|
|
- files_list_world_readable($1_usertype)
|
|
- files_read_world_readable_files($1_usertype)
|
|
- files_read_world_readable_symlinks($1_usertype)
|
|
- files_read_world_readable_pipes($1_usertype)
|
|
- files_read_world_readable_sockets($1_usertype)
|
|
- # old broswer_domain():
|
|
- files_dontaudit_getattr_all_dirs($1_usertype)
|
|
- files_dontaudit_list_non_security($1_usertype)
|
|
- files_dontaudit_getattr_all_files($1_usertype)
|
|
- files_dontaudit_getattr_non_security_symlinks($1_usertype)
|
|
- files_dontaudit_getattr_non_security_pipes($1_usertype)
|
|
- files_dontaudit_getattr_non_security_sockets($1_usertype)
|
|
- files_dontaudit_setattr_etc_runtime_files($1_usertype)
|
|
-
|
|
- files_exec_usr_files($1_t)
|
|
-
|
|
- fs_list_cgroup_dirs($1_usertype)
|
|
- fs_dontaudit_rw_cgroup_files($1_usertype)
|
|
-
|
|
- storage_rw_fuse($1_usertype)
|
|
-
|
|
auth_use_nsswitch($1_t)
|
|
-
|
|
- init_stream_connect($1_usertype)
|
|
- # The library functions always try to open read-write first,
|
|
- # then fall back to read-only if it fails.
|
|
- init_dontaudit_rw_utmp($1_usertype)
|
|
-
|
|
- libs_exec_ld_so($1_usertype)
|
|
-
|
|
- logging_send_audit_msgs($1_t)
|
|
-
|
|
- miscfiles_read_localization($1_t)
|
|
- miscfiles_read_generic_certs($1_t)
|
|
-
|
|
- miscfiles_read_all_certs($1_usertype)
|
|
- miscfiles_read_localization($1_usertype)
|
|
- miscfiles_read_man_pages($1_usertype)
|
|
- miscfiles_read_public_files($1_usertype)
|
|
-
|
|
- systemd_dbus_chat_logind($1_usertype)
|
|
-
|
|
- tunable_policy(`allow_execmem',`
|
|
- # Allow loading DSOs that require executable stack.
|
|
- allow $1_t self:process execmem;
|
|
- ')
|
|
-
|
|
- tunable_policy(`allow_execmem && allow_execstack',`
|
|
- # Allow making the stack executable via mprotect.
|
|
- allow $1_t self:process execstack;
|
|
- ')
|
|
-
|
|
- optional_policy(`
|
|
- abrt_stream_connect($1_usertype)
|
|
- ')
|
|
-
|
|
- optional_policy(`
|
|
- fs_list_cgroup_dirs($1_usertype)
|
|
- ')
|
|
-
|
|
- optional_policy(`
|
|
- ssh_rw_stream_sockets($1_usertype)
|
|
- ssh_delete_tmp($1_t)
|
|
- ssh_signal($1_t)
|
|
- ')
|
|
')
|
|
|
|
#######################################
|
|
@@ -242,6 +128,22 @@ interface(`userdom_ro_home_role',`
|
|
## The user role
|
|
## </summary>
|
|
## </param>
|
|
+## <rolebase/>
|
|
+#
|
|
+interface(`userdom_manage_home_role',`
|
|
+ gen_require(`
|
|
+ type user_home_dir_t;
|
|
+ attribute user_home_type;
|
|
+ ')
|
|
+
|
|
+ role $1 types { user_home_type user_home_dir_t };
|
|
+')
|
|
+
|
|
+#######################################
|
|
+## <summary>
|
|
+## Allow a home directory for which the
|
|
+## role has full access.
|
|
+## </summary>
|
|
## <param name="userdomain">
|
|
## <summary>
|
|
## The user domain
|
|
@@ -249,61 +151,58 @@ interface(`userdom_ro_home_role',`
|
|
## </param>
|
|
## <rolebase/>
|
|
#
|
|
-interface(`userdom_manage_home_role',`
|
|
+interface(`userdom_manage_home',`
|
|
gen_require(`
|
|
type user_home_t, user_home_dir_t;
|
|
attribute user_home_type;
|
|
')
|
|
|
|
- role $1 types { user_home_type user_home_dir_t };
|
|
-
|
|
##############################
|
|
#
|
|
# Domain access to home dir
|
|
#
|
|
-
|
|
- type_member $2 user_home_dir_t:dir user_home_dir_t;
|
|
+ type_member $1 user_home_dir_t:dir user_home_dir_t;
|
|
|
|
# full control of the home directory
|
|
- allow $2 user_home_t:dir mounton;
|
|
- allow $2 user_home_t:file entrypoint;
|
|
+ allow $1 user_home_t:dir mounton;
|
|
+ allow $1 user_home_t:file entrypoint;
|
|
|
|
- allow $2 user_home_type:dir_file_class_set { relabelto relabelfrom };
|
|
- allow $2 user_home_dir_t:lnk_file read_lnk_file_perms;
|
|
- manage_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
|
|
- manage_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
|
|
- manage_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
|
|
- manage_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
|
|
- manage_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
|
|
- relabel_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
|
|
- relabel_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
|
|
- relabel_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
|
|
- relabel_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
|
|
- relabel_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
|
|
- filetrans_pattern($2, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
|
|
- files_list_home($2)
|
|
+ allow $1 user_home_type:dir_file_class_set { relabelto relabelfrom };
|
|
+ allow $1 user_home_dir_t:lnk_file read_lnk_file_perms;
|
|
+ manage_dirs_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
|
|
+ manage_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
|
|
+ manage_lnk_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
|
|
+ manage_sock_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
|
|
+ manage_fifo_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
|
|
+ relabel_dirs_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
|
|
+ relabel_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
|
|
+ relabel_lnk_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
|
|
+ relabel_sock_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
|
|
+ relabel_fifo_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
|
|
+ filetrans_pattern($1, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
|
|
+ files_list_home($1)
|
|
|
|
# cjp: this should probably be removed:
|
|
- allow $2 user_home_dir_t:dir { manage_dir_perms relabel_dir_perms };
|
|
+ allow $1 user_home_dir_t:dir { manage_dir_perms relabel_dir_perms };
|
|
|
|
tunable_policy(`use_nfs_home_dirs',`
|
|
- fs_mount_nfs($2)
|
|
- fs_mounton_nfs($2)
|
|
- fs_manage_nfs_dirs($2)
|
|
- fs_manage_nfs_files($2)
|
|
- fs_manage_nfs_symlinks($2)
|
|
- fs_manage_nfs_named_sockets($2)
|
|
- fs_manage_nfs_named_pipes($2)
|
|
+ fs_mount_nfs($1)
|
|
+ fs_mounton_nfs($1)
|
|
+ fs_manage_nfs_dirs($1)
|
|
+ fs_manage_nfs_files($1)
|
|
+ fs_manage_nfs_symlinks($1)
|
|
+ fs_manage_nfs_named_sockets($1)
|
|
+ fs_manage_nfs_named_pipes($1)
|
|
')
|
|
|
|
tunable_policy(`use_samba_home_dirs',`
|
|
- fs_mount_cifs($2)
|
|
- fs_mounton_cifs($2)
|
|
- fs_manage_cifs_dirs($2)
|
|
- fs_manage_cifs_files($2)
|
|
- fs_manage_cifs_symlinks($2)
|
|
- fs_manage_cifs_named_sockets($2)
|
|
- fs_manage_cifs_named_pipes($2)
|
|
+ fs_mount_cifs($1)
|
|
+ fs_mounton_cifs($1)
|
|
+ fs_manage_cifs_dirs($1)
|
|
+ fs_manage_cifs_files($1)
|
|
+ fs_manage_cifs_symlinks($1)
|
|
+ fs_manage_cifs_named_sockets($1)
|
|
+ fs_manage_cifs_named_pipes($1)
|
|
')
|
|
')
|
|
|
|
@@ -316,6 +215,21 @@ interface(`userdom_manage_home_role',`
|
|
## Role allowed access.
|
|
## </summary>
|
|
## </param>
|
|
+## <rolebase/>
|
|
+#
|
|
+interface(`userdom_manage_tmp_role',`
|
|
+ gen_require(`
|
|
+ attribute user_tmp_type;
|
|
+ type user_tmp_t;
|
|
+ ')
|
|
+
|
|
+ role $1 types user_tmp_t;
|
|
+')
|
|
+
|
|
+#######################################
|
|
+## <summary>
|
|
+## Manage user temporary files
|
|
+## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
@@ -323,27 +237,25 @@ interface(`userdom_manage_home_role',`
|
|
## </param>
|
|
## <rolebase/>
|
|
#
|
|
-interface(`userdom_manage_tmp_role',`
|
|
+interface(`userdom_manage_tmp',`
|
|
gen_require(`
|
|
attribute user_tmp_type;
|
|
type user_tmp_t;
|
|
')
|
|
|
|
- role $1 types user_tmp_t;
|
|
-
|
|
- files_poly_member_tmp($2, user_tmp_t)
|
|
+ files_poly_member_tmp($1, user_tmp_t)
|
|
|
|
- manage_dirs_pattern($2, user_tmp_type, user_tmp_type)
|
|
- manage_files_pattern($2, user_tmp_type, user_tmp_type)
|
|
- manage_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
|
|
- manage_sock_files_pattern($2, user_tmp_type, user_tmp_type)
|
|
- manage_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
|
|
- files_tmp_filetrans($2, user_tmp_t, { dir file lnk_file sock_file fifo_file })
|
|
- relabel_dirs_pattern($2, user_tmp_type, user_tmp_type)
|
|
- relabel_files_pattern($2, user_tmp_type, user_tmp_type)
|
|
- relabel_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
|
|
- relabel_sock_files_pattern($2, user_tmp_type, user_tmp_type)
|
|
- relabel_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
|
|
+ manage_dirs_pattern($1, user_tmp_type, user_tmp_type)
|
|
+ manage_files_pattern($1, user_tmp_type, user_tmp_type)
|
|
+ manage_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
|
|
+ manage_sock_files_pattern($1, user_tmp_type, user_tmp_type)
|
|
+ manage_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
|
|
+ files_tmp_filetrans($1, user_tmp_t, { dir file lnk_file sock_file fifo_file })
|
|
+ relabel_dirs_pattern($1, user_tmp_type, user_tmp_type)
|
|
+ relabel_files_pattern($1, user_tmp_type, user_tmp_type)
|
|
+ relabel_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
|
|
+ relabel_sock_files_pattern($1, user_tmp_type, user_tmp_type)
|
|
+ relabel_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
|
|
')
|
|
|
|
#######################################
|
|
@@ -424,6 +336,21 @@ interface(`userdom_exec_user_tmp_files',
|
|
## Role allowed access.
|
|
## </summary>
|
|
## </param>
|
|
+## <rolecap/>
|
|
+#
|
|
+interface(`userdom_manage_tmpfs_role',`
|
|
+ gen_require(`
|
|
+ attribute user_tmpfs_type;
|
|
+ type user_tmpfs_t;
|
|
+ ')
|
|
+
|
|
+ role $1 types user_tmpfs_t;
|
|
+')
|
|
+
|
|
+#######################################
|
|
+## <summary>
|
|
+## Allow access for the user tmpfs type
|
|
+## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
@@ -431,25 +358,23 @@ interface(`userdom_exec_user_tmp_files',
|
|
## </param>
|
|
## <rolecap/>
|
|
#
|
|
-interface(`userdom_manage_tmpfs_role',`
|
|
+interface(`userdom_manage_tmpfs',`
|
|
gen_require(`
|
|
attribute user_tmpfs_type;
|
|
type user_tmpfs_t;
|
|
')
|
|
|
|
- role $1 types user_tmpfs_t;
|
|
-
|
|
- manage_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
|
|
- manage_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
|
|
- manage_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
|
|
- manage_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
|
|
- manage_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
|
|
- fs_tmpfs_filetrans($2, user_tmpfs_t, { dir file lnk_file sock_file fifo_file })
|
|
- relabel_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
|
|
- relabel_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
|
|
- relabel_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
|
|
- relabel_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
|
|
- relabel_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
|
|
+ manage_dirs_pattern($1, user_tmpfs_type, user_tmpfs_type)
|
|
+ manage_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
|
|
+ manage_lnk_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
|
|
+ manage_sock_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
|
|
+ manage_fifo_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
|
|
+ fs_tmpfs_filetrans($1, user_tmpfs_t, { dir file lnk_file sock_file fifo_file })
|
|
+ relabel_dirs_pattern($1, user_tmpfs_type, user_tmpfs_type)
|
|
+ relabel_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
|
|
+ relabel_lnk_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
|
|
+ relabel_sock_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
|
|
+ relabel_fifo_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
|
|
')
|
|
|
|
#######################################
|
|
@@ -578,260 +503,31 @@ template(`userdom_change_password_templa
|
|
template(`userdom_common_user_template',`
|
|
gen_require(`
|
|
attribute unpriv_userdomain;
|
|
+ attribute common_userdomain;
|
|
')
|
|
|
|
- userdom_basic_networking($1_usertype)
|
|
-
|
|
- ##############################
|
|
- #
|
|
- # User domain Local policy
|
|
- #
|
|
-
|
|
- # evolution and gnome-session try to create a netlink socket
|
|
- dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
|
|
- dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
|
|
- allow $1_t self:netlink_kobject_uevent_socket create_socket_perms;
|
|
- allow $1_t self:socket create_socket_perms;
|
|
-
|
|
- allow $1_usertype unpriv_userdomain:fd use;
|
|
-
|
|
- kernel_read_system_state($1_usertype)
|
|
- kernel_read_network_state($1_usertype)
|
|
- kernel_read_software_raid_state($1_usertype)
|
|
- kernel_read_net_sysctls($1_usertype)
|
|
- # Very permissive allowing every domain to see every type:
|
|
- kernel_get_sysvipc_info($1_usertype)
|
|
- # Find CDROM devices:
|
|
- kernel_read_device_sysctls($1_usertype)
|
|
- kernel_request_load_module($1_usertype)
|
|
-
|
|
- corenet_udp_bind_generic_node($1_usertype)
|
|
- corenet_udp_bind_generic_port($1_usertype)
|
|
-
|
|
- dev_read_rand($1_usertype)
|
|
- dev_write_sound($1_usertype)
|
|
- dev_read_sound($1_usertype)
|
|
- dev_read_sound_mixer($1_usertype)
|
|
- dev_write_sound_mixer($1_usertype)
|
|
-
|
|
- files_exec_etc_files($1_usertype)
|
|
- files_search_locks($1_usertype)
|
|
- # Check to see if cdrom is mounted
|
|
- files_search_mnt($1_usertype)
|
|
- # cjp: perhaps should cut back on file reads:
|
|
- files_read_var_files($1_usertype)
|
|
- files_read_var_symlinks($1_usertype)
|
|
- files_read_generic_spool($1_usertype)
|
|
- files_read_var_lib_files($1_usertype)
|
|
- # Stat lost+found.
|
|
- files_getattr_lost_found_dirs($1_usertype)
|
|
- files_read_config_files($1_usertype)
|
|
- fs_read_noxattr_fs_files($1_usertype)
|
|
- fs_read_noxattr_fs_symlinks($1_usertype)
|
|
- fs_rw_cgroup_files($1_usertype)
|
|
-
|
|
- application_getattr_socket($1_usertype)
|
|
-
|
|
- logging_send_syslog_msg($1_usertype)
|
|
- logging_send_audit_msgs($1_usertype)
|
|
- selinux_get_enforce_mode($1_usertype)
|
|
-
|
|
- # cjp: some of this probably can be removed
|
|
- selinux_get_fs_mount($1_usertype)
|
|
- selinux_validate_context($1_usertype)
|
|
- selinux_compute_access_vector($1_usertype)
|
|
- selinux_compute_create_context($1_usertype)
|
|
- selinux_compute_relabel_context($1_usertype)
|
|
- selinux_compute_user_contexts($1_usertype)
|
|
-
|
|
- # for eject
|
|
- storage_getattr_fixed_disk_dev($1_usertype)
|
|
+ typeattribute $1_t common_userdomain;
|
|
|
|
- auth_read_login_records($1_usertype)
|
|
- auth_run_pam($1_t,$1_r)
|
|
- auth_run_utempter($1_t,$1_r)
|
|
+ userdom_basic_networking(common_userdomain)
|
|
|
|
- init_read_utmp($1_usertype)
|
|
-
|
|
- seutil_read_file_contexts($1_usertype)
|
|
- seutil_read_default_contexts($1_usertype)
|
|
- seutil_run_newrole($1_t,$1_r)
|
|
- seutil_exec_checkpolicy($1_t)
|
|
- seutil_exec_setfiles($1_usertype)
|
|
- # for when the network connection is killed
|
|
- # this is needed when a login role can change
|
|
- # to this one.
|
|
- seutil_dontaudit_signal_newrole($1_t)
|
|
-
|
|
- tunable_policy(`user_direct_mouse',`
|
|
- dev_read_mouse($1_usertype)
|
|
- ')
|
|
-
|
|
- tunable_policy(`user_ttyfile_stat',`
|
|
- term_getattr_all_ttys($1_t)
|
|
- ')
|
|
-
|
|
- optional_policy(`
|
|
- # Allow graphical boot to check battery lifespan
|
|
- apm_stream_connect($1_usertype)
|
|
- ')
|
|
-
|
|
- optional_policy(`
|
|
- canna_stream_connect($1_usertype)
|
|
- ')
|
|
-
|
|
- optional_policy(`
|
|
- chrome_role($1_r, $1_usertype)
|
|
- ')
|
|
-
|
|
- optional_policy(`
|
|
- colord_read_lib_files($1_usertype)
|
|
- ')
|
|
-
|
|
- optional_policy(`
|
|
- dbus_system_bus_client($1_usertype)
|
|
-
|
|
- allow $1_usertype $1_usertype:dbus send_msg;
|
|
-
|
|
- optional_policy(`
|
|
- avahi_dbus_chat($1_usertype)
|
|
- ')
|
|
-
|
|
- optional_policy(`
|
|
- policykit_dbus_chat($1_usertype)
|
|
- ')
|
|
-
|
|
- optional_policy(`
|
|
- bluetooth_dbus_chat($1_usertype)
|
|
- ')
|
|
-
|
|
- optional_policy(`
|
|
- consolekit_dbus_chat($1_usertype)
|
|
- consolekit_read_log($1_usertype)
|
|
- ')
|
|
-
|
|
- optional_policy(`
|
|
- devicekit_dbus_chat($1_usertype)
|
|
- devicekit_dbus_chat_power($1_usertype)
|
|
- devicekit_dbus_chat_disk($1_usertype)
|
|
- ')
|
|
-
|
|
- optional_policy(`
|
|
- evolution_dbus_chat($1_usertype)
|
|
- evolution_alarm_dbus_chat($1_usertype)
|
|
- ')
|
|
-
|
|
- optional_policy(`
|
|
- gnome_dbus_chat_gconfdefault($1_usertype)
|
|
- ')
|
|
-
|
|
- optional_policy(`
|
|
- hal_dbus_chat($1_usertype)
|
|
- ')
|
|
-
|
|
- optional_policy(`
|
|
- kde_dbus_chat_backlighthelper($1_usertype)
|
|
- ')
|
|
-
|
|
- optional_policy(`
|
|
- modemmanager_dbus_chat($1_usertype)
|
|
- ')
|
|
-
|
|
- optional_policy(`
|
|
- networkmanager_dbus_chat($1_usertype)
|
|
- networkmanager_read_lib_files($1_usertype)
|
|
- ')
|
|
-
|
|
- optional_policy(`
|
|
- vpn_dbus_chat($1_usertype)
|
|
- ')
|
|
- ')
|
|
-
|
|
- optional_policy(`
|
|
- git_session_role($1_r, $1_usertype)
|
|
- ')
|
|
-
|
|
- optional_policy(`
|
|
- inetd_use_fds($1_usertype)
|
|
- inetd_rw_tcp_sockets($1_usertype)
|
|
- ')
|
|
-
|
|
- optional_policy(`
|
|
- inn_read_config($1_usertype)
|
|
- inn_read_news_lib($1_usertype)
|
|
- inn_read_news_spool($1_usertype)
|
|
- ')
|
|
-
|
|
- optional_policy(`
|
|
- lircd_stream_connect($1_usertype)
|
|
- ')
|
|
-
|
|
- optional_policy(`
|
|
- locate_read_lib_files($1_usertype)
|
|
- ')
|
|
-
|
|
- # for running depmod as part of the kernel packaging process
|
|
- optional_policy(`
|
|
- modutils_read_module_config($1_usertype)
|
|
- ')
|
|
-
|
|
- optional_policy(`
|
|
- mta_rw_spool($1_usertype)
|
|
- mta_manage_queue($1_usertype)
|
|
- mta_filetrans_home_content($1_usertype)
|
|
- ')
|
|
-
|
|
- optional_policy(`
|
|
- nsplugin_role($1_r, $1_usertype)
|
|
- ')
|
|
-
|
|
- optional_policy(`
|
|
- tunable_policy(`allow_user_mysql_connect',`
|
|
- mysql_stream_connect($1_t)
|
|
- ')
|
|
- ')
|
|
-
|
|
- optional_policy(`
|
|
- oident_manage_user_content($1_t)
|
|
- oident_relabel_user_content($1_t)
|
|
- ')
|
|
-
|
|
- optional_policy(`
|
|
- # to allow monitoring of pcmcia status
|
|
- pcmcia_read_pid($1_usertype)
|
|
- ')
|
|
-
|
|
- optional_policy(`
|
|
- pcscd_read_pub_files($1_usertype)
|
|
- pcscd_stream_connect($1_usertype)
|
|
- ')
|
|
-
|
|
- optional_policy(`
|
|
- tunable_policy(`allow_user_postgresql_connect',`
|
|
- postgresql_stream_connect($1_usertype)
|
|
- postgresql_tcp_connect($1_usertype)
|
|
- ')
|
|
- ')
|
|
-
|
|
- optional_policy(`
|
|
- resmgr_stream_connect($1_usertype)
|
|
- ')
|
|
+ auth_run_pam(common_userdomain,$1_r)
|
|
+ auth_run_utempter(common_userdomain,$1_r)
|
|
+ seutil_run_newrole(common_userdomain,$1_r)
|
|
|
|
optional_policy(`
|
|
- rpc_dontaudit_getattr_exports($1_usertype)
|
|
- rpc_manage_nfs_rw_content($1_usertype)
|
|
+ chrome_role($1_r, common_userdomain)
|
|
')
|
|
|
|
optional_policy(`
|
|
- rpcbind_stream_connect($1_usertype)
|
|
+ git_session_role($1_r, common_userdomain)
|
|
')
|
|
|
|
optional_policy(`
|
|
- samba_stream_connect_winbind($1_usertype)
|
|
+ nsplugin_role($1_r, common_userdomain)
|
|
')
|
|
|
|
optional_policy(`
|
|
- sandbox_transition($1_usertype, $1_r)
|
|
+ sandbox_transition(common_userdomain, $1_r)
|
|
')
|
|
|
|
optional_policy(`
|
|
@@ -839,11 +535,7 @@ template(`userdom_common_user_template',
|
|
')
|
|
|
|
optional_policy(`
|
|
- slrnpull_search_spool($1_usertype)
|
|
- ')
|
|
-
|
|
- optional_policy(`
|
|
- thumb_role($1_r, $1_usertype)
|
|
+ thumb_role($1_r, common_userdomain)
|
|
')
|
|
')
|
|
|
|
@@ -872,10 +564,9 @@ template(`userdom_login_user_template',
|
|
|
|
userdom_base_user_template($1)
|
|
|
|
- userdom_manage_home_role($1_r, $1_usertype)
|
|
-
|
|
- userdom_manage_tmp_role($1_r, $1_usertype)
|
|
- userdom_manage_tmpfs_role($1_r, $1_usertype)
|
|
+ userdom_manage_home_role($1_r)
|
|
+ userdom_manage_tmp_role($1_r)
|
|
+ userdom_manage_tmpfs_role($1_r)
|
|
|
|
ifelse(`$1',`unconfined',`',`
|
|
gen_tunable(allow_$1_exec_content, true)
|
|
@@ -1010,9 +701,6 @@ template(`userdom_restricted_user_templa
|
|
typeattribute $1_t unpriv_userdomain;
|
|
domain_interactive_fd($1_t)
|
|
|
|
- allow $1_usertype self:netlink_kobject_uevent_socket create_socket_perms;
|
|
- dontaudit $1_usertype self:netlink_audit_socket create_socket_perms;
|
|
-
|
|
##############################
|
|
#
|
|
# Local policy
|
|
@@ -3929,6 +3617,10 @@ template(`userdom_unpriv_usertype',`
|
|
|
|
auth_use_nsswitch($2)
|
|
ubac_constrained($2)
|
|
+
|
|
+ userdom_manage_home_role($1_r)
|
|
+ userdom_manage_tmp_role($1_r)
|
|
+ userdom_manage_tmpfs_role($1_r)
|
|
')
|
|
|
|
########################################
|
|
diff -up serefpolicy-3.10.0/policy/modules/system/userdomain.te.userdomain serefpolicy-3.10.0/policy/modules/system/userdomain.te
|
|
--- serefpolicy-3.10.0/policy/modules/system/userdomain.te.userdomain 2011-10-11 10:15:28.427129208 -0400
|
|
+++ serefpolicy-3.10.0/policy/modules/system/userdomain.te 2011-10-11 10:15:28.507129054 -0400
|
|
@@ -69,6 +69,8 @@ attribute userdomain;
|
|
|
|
# unprivileged user domains
|
|
attribute unpriv_userdomain;
|
|
+# common user domains
|
|
+attribute common_userdomain;
|
|
|
|
attribute untrusted_content_type;
|
|
attribute untrusted_content_tmp_type;
|
|
@@ -141,16 +143,17 @@ miscfiles_cert_type(home_cert_t)
|
|
userdom_user_home_content(home_cert_t)
|
|
ubac_constrained(home_cert_t)
|
|
|
|
-tunable_policy(`allow_console_login',`
|
|
- term_use_console(userdomain)
|
|
-')
|
|
-
|
|
-allow userdomain userdomain:process signull;
|
|
+allow unpriv_userdomain self:netlink_kobject_uevent_socket create_socket_perms;
|
|
+dontaudit unpriv_userdomain self:netlink_audit_socket create_socket_perms;
|
|
|
|
# Nautilus causes this avc
|
|
dontaudit unpriv_userdomain self:dir setattr;
|
|
allow unpriv_userdomain self:key manage_key_perms;
|
|
|
|
+userdom_manage_home(unpriv_userdomain)
|
|
+userdom_manage_tmp(unpriv_userdomain)
|
|
+userdom_manage_tmpfs(unpriv_userdomain)
|
|
+
|
|
optional_policy(`
|
|
alsa_read_rw_config(unpriv_userdomain)
|
|
alsa_manage_home_files(unpriv_userdomain)
|
|
@@ -158,6 +161,125 @@ optional_policy(`
|
|
alsa_filetrans_named_content(unpriv_userdomain)
|
|
')
|
|
|
|
+tunable_policy(`allow_console_login',`
|
|
+ term_use_console(userdomain)
|
|
+')
|
|
+
|
|
+allow userdomain userdomain:process signull;
|
|
+
|
|
+allow userdomain user_devpts_t:chr_file { setattr rw_chr_file_perms };
|
|
+term_create_pty(userdomain, user_devpts_t)
|
|
+# avoid annoying messages on terminal hangup on role change
|
|
+dontaudit userdomain user_devpts_t:chr_file ioctl;
|
|
+
|
|
+allow userdomain user_tty_device_t:chr_file { setattr rw_chr_file_perms };
|
|
+# avoid annoying messages on terminal hangup on role change
|
|
+dontaudit userdomain user_tty_device_t:chr_file ioctl;
|
|
+
|
|
+corecmd_shell_entry_type(userdomain)
|
|
+corecmd_bin_entry_type(userdomain)
|
|
+
|
|
+term_user_pty(userdomain, user_devpts_t)
|
|
+
|
|
+term_user_tty(userdomain, user_tty_device_t)
|
|
+term_dontaudit_getattr_generic_ptys(userdomain)
|
|
+
|
|
+application_exec_all(userdomain)
|
|
+
|
|
+kernel_read_kernel_sysctls(userdomain)
|
|
+kernel_read_all_sysctls(userdomain)
|
|
+kernel_dontaudit_list_unlabeled(userdomain)
|
|
+kernel_dontaudit_getattr_unlabeled_files(userdomain)
|
|
+kernel_dontaudit_getattr_unlabeled_symlinks(userdomain)
|
|
+kernel_dontaudit_getattr_unlabeled_pipes(userdomain)
|
|
+kernel_dontaudit_getattr_unlabeled_sockets(userdomain)
|
|
+kernel_dontaudit_getattr_unlabeled_blk_files(userdomain)
|
|
+kernel_dontaudit_getattr_unlabeled_chr_files(userdomain)
|
|
+kernel_dontaudit_list_proc(userdomain)
|
|
+
|
|
+dev_dontaudit_getattr_all_blk_files(userdomain)
|
|
+dev_dontaudit_getattr_all_chr_files(userdomain)
|
|
+dev_getattr_mtrr_dev(userdomain)
|
|
+
|
|
+# When the user domain runs ps, there will be a number of access
|
|
+# denials when ps tries to search /proc. Do not audit these denials.
|
|
+domain_dontaudit_read_all_domains_state(userdomain)
|
|
+domain_dontaudit_getattr_all_domains(userdomain)
|
|
+domain_dontaudit_getsession_all_domains(userdomain)
|
|
+dev_dontaudit_all_access_check(userdomain)
|
|
+
|
|
+files_read_etc_files(userdomain)
|
|
+files_list_mnt(userdomain)
|
|
+files_list_var(userdomain)
|
|
+files_read_mnt_files(userdomain)
|
|
+files_dontaudit_access_check_mnt(userdomain)
|
|
+files_read_etc_runtime_files(userdomain)
|
|
+files_read_usr_files(userdomain)
|
|
+files_read_usr_src_files(userdomain)
|
|
+# Read directories and files with the readable_t type.
|
|
+# This type is a general type for "world"-readable files.
|
|
+files_list_world_readable(userdomain)
|
|
+files_read_world_readable_files(userdomain)
|
|
+files_read_world_readable_symlinks(userdomain)
|
|
+files_read_world_readable_pipes(userdomain)
|
|
+files_read_world_readable_sockets(userdomain)
|
|
+# old broswer_domain():
|
|
+files_dontaudit_getattr_all_dirs(userdomain)
|
|
+files_dontaudit_list_non_security(userdomain)
|
|
+files_dontaudit_getattr_all_files(userdomain)
|
|
+files_dontaudit_getattr_non_security_symlinks(userdomain)
|
|
+files_dontaudit_getattr_non_security_pipes(userdomain)
|
|
+files_dontaudit_getattr_non_security_sockets(userdomain)
|
|
+files_dontaudit_setattr_etc_runtime_files(userdomain)
|
|
+
|
|
+files_exec_usr_files(userdomain)
|
|
+
|
|
+fs_list_cgroup_dirs(userdomain)
|
|
+fs_dontaudit_rw_cgroup_files(userdomain)
|
|
+
|
|
+storage_rw_fuse(userdomain)
|
|
+
|
|
+init_stream_connect(userdomain)
|
|
+# The library functions always try to open read-write first,
|
|
+# then fall back to read-only if it fails.
|
|
+init_dontaudit_rw_utmp(userdomain)
|
|
+libs_exec_ld_so(userdomain)
|
|
+logging_send_audit_msgs(userdomain)
|
|
+
|
|
+miscfiles_read_localization(userdomain)
|
|
+miscfiles_read_generic_certs(userdomain)
|
|
+
|
|
+miscfiles_read_all_certs(userdomain)
|
|
+miscfiles_read_localization(userdomain)
|
|
+miscfiles_read_man_pages(userdomain)
|
|
+miscfiles_read_public_files(userdomain)
|
|
+
|
|
+systemd_dbus_chat_logind(userdomain)
|
|
+
|
|
+tunable_policy(`allow_execmem',`
|
|
+ # Allow loading DSOs that require executable stack.
|
|
+ allow userdomain self:process execmem;
|
|
+')
|
|
+
|
|
+tunable_policy(`allow_execmem && allow_execstack',`
|
|
+ # Allow making the stack executable via mprotect.
|
|
+ allow userdomain self:process execstack;
|
|
+')
|
|
+
|
|
+optional_policy(`
|
|
+ abrt_stream_connect(userdomain)
|
|
+')
|
|
+
|
|
+optional_policy(`
|
|
+ fs_list_cgroup_dirs(userdomain)
|
|
+')
|
|
+
|
|
+optional_policy(`
|
|
+ ssh_rw_stream_sockets(userdomain)
|
|
+ ssh_delete_tmp(userdomain)
|
|
+ ssh_signal(userdomain)
|
|
+')
|
|
+
|
|
optional_policy(`
|
|
gnome_filetrans_home_content(userdomain)
|
|
')
|
|
@@ -173,3 +295,240 @@ optional_policy(`
|
|
optional_policy(`
|
|
xserver_filetrans_home_content(userdomain)
|
|
')
|
|
+
|
|
+##############################
|
|
+#
|
|
+# Common User domain Local policy
|
|
+#
|
|
+
|
|
+# evolution and gnome-session try to create a netlink socket
|
|
+dontaudit common_userdomain self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
|
|
+dontaudit common_userdomain self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
|
|
+allow common_userdomain self:netlink_kobject_uevent_socket create_socket_perms;
|
|
+allow common_userdomain self:socket create_socket_perms;
|
|
+
|
|
+allow common_userdomain unpriv_userdomain:fd use;
|
|
+
|
|
+kernel_read_system_state(common_userdomain)
|
|
+kernel_read_network_state(common_userdomain)
|
|
+kernel_read_software_raid_state(common_userdomain)
|
|
+kernel_read_net_sysctls(common_userdomain)
|
|
+# Very permissive allowing every domain to see every type:
|
|
+kernel_get_sysvipc_info(common_userdomain)
|
|
+# Find CDROM devices:
|
|
+kernel_read_device_sysctls(common_userdomain)
|
|
+kernel_request_load_module(common_userdomain)
|
|
+
|
|
+corenet_udp_bind_generic_node(common_userdomain)
|
|
+corenet_udp_bind_generic_port(common_userdomain)
|
|
+
|
|
+dev_read_rand(common_userdomain)
|
|
+dev_write_sound(common_userdomain)
|
|
+dev_read_sound(common_userdomain)
|
|
+dev_read_sound_mixer(common_userdomain)
|
|
+dev_write_sound_mixer(common_userdomain)
|
|
+
|
|
+files_exec_etc_files(common_userdomain)
|
|
+files_search_locks(common_userdomain)
|
|
+# Check to see if cdrom is mounted
|
|
+files_search_mnt(common_userdomain)
|
|
+# cjp: perhaps should cut back on file reads:
|
|
+files_read_var_files(common_userdomain)
|
|
+files_read_var_symlinks(common_userdomain)
|
|
+files_read_generic_spool(common_userdomain)
|
|
+files_read_var_lib_files(common_userdomain)
|
|
+# Stat lost+found.
|
|
+files_getattr_lost_found_dirs(common_userdomain)
|
|
+files_read_config_files(common_userdomain)
|
|
+fs_read_noxattr_fs_files(common_userdomain)
|
|
+fs_read_noxattr_fs_symlinks(common_userdomain)
|
|
+fs_rw_cgroup_files(common_userdomain)
|
|
+
|
|
+application_getattr_socket(common_userdomain)
|
|
+
|
|
+logging_send_syslog_msg(common_userdomain)
|
|
+logging_send_audit_msgs(common_userdomain)
|
|
+selinux_get_enforce_mode(common_userdomain)
|
|
+
|
|
+# cjp: some of this probably can be removed
|
|
+selinux_get_fs_mount(common_userdomain)
|
|
+selinux_validate_context(common_userdomain)
|
|
+selinux_compute_access_vector(common_userdomain)
|
|
+selinux_compute_create_context(common_userdomain)
|
|
+selinux_compute_relabel_context(common_userdomain)
|
|
+selinux_compute_user_contexts(common_userdomain)
|
|
+
|
|
+# for eject
|
|
+storage_getattr_fixed_disk_dev(common_userdomain)
|
|
+
|
|
+auth_read_login_records(common_userdomain)
|
|
+
|
|
+init_read_utmp(common_userdomain)
|
|
+
|
|
+seutil_read_file_contexts(common_userdomain)
|
|
+seutil_read_default_contexts(common_userdomain)
|
|
+seutil_exec_checkpolicy(common_userdomain)
|
|
+seutil_exec_setfiles(common_userdomain)
|
|
+# for when the network connection is killed
|
|
+# this is needed when a login role can change
|
|
+# to this one.
|
|
+seutil_dontaudit_signal_newrole(common_userdomain)
|
|
+
|
|
+tunable_policy(`user_direct_mouse',`
|
|
+ dev_read_mouse(common_userdomain)
|
|
+')
|
|
+
|
|
+tunable_policy(`user_ttyfile_stat',`
|
|
+ term_getattr_all_ttys(common_userdomain)
|
|
+')
|
|
+
|
|
+optional_policy(`
|
|
+ # Allow graphical boot to check battery lifespan
|
|
+ apm_stream_connect(common_userdomain)
|
|
+')
|
|
+
|
|
+optional_policy(`
|
|
+ canna_stream_connect(common_userdomain)
|
|
+')
|
|
+
|
|
+optional_policy(`
|
|
+ colord_read_lib_files(common_userdomain)
|
|
+')
|
|
+
|
|
+optional_policy(`
|
|
+ dbus_system_bus_client(common_userdomain)
|
|
+
|
|
+ allow common_userdomain common_userdomain:dbus send_msg;
|
|
+
|
|
+ optional_policy(`
|
|
+ avahi_dbus_chat(common_userdomain)
|
|
+ ')
|
|
+
|
|
+ optional_policy(`
|
|
+ policykit_dbus_chat(common_userdomain)
|
|
+ ')
|
|
+
|
|
+ optional_policy(`
|
|
+ bluetooth_dbus_chat(common_userdomain)
|
|
+ ')
|
|
+
|
|
+ optional_policy(`
|
|
+ consolekit_dbus_chat(common_userdomain)
|
|
+ consolekit_read_log(common_userdomain)
|
|
+ ')
|
|
+
|
|
+ optional_policy(`
|
|
+ devicekit_dbus_chat(common_userdomain)
|
|
+ devicekit_dbus_chat_power(common_userdomain)
|
|
+ devicekit_dbus_chat_disk(common_userdomain)
|
|
+ ')
|
|
+
|
|
+ optional_policy(`
|
|
+ evolution_dbus_chat(common_userdomain)
|
|
+ evolution_alarm_dbus_chat(common_userdomain)
|
|
+ ')
|
|
+
|
|
+ optional_policy(`
|
|
+ gnome_dbus_chat_gconfdefault(common_userdomain)
|
|
+ ')
|
|
+
|
|
+ optional_policy(`
|
|
+ hal_dbus_chat(common_userdomain)
|
|
+ ')
|
|
+
|
|
+ optional_policy(`
|
|
+ kde_dbus_chat_backlighthelper(common_userdomain)
|
|
+ ')
|
|
+
|
|
+ optional_policy(`
|
|
+ modemmanager_dbus_chat(common_userdomain)
|
|
+ ')
|
|
+
|
|
+ optional_policy(`
|
|
+ networkmanager_dbus_chat(common_userdomain)
|
|
+ networkmanager_read_lib_files(common_userdomain)
|
|
+ ')
|
|
+
|
|
+ optional_policy(`
|
|
+ vpn_dbus_chat(common_userdomain)
|
|
+ ')
|
|
+')
|
|
+
|
|
+optional_policy(`
|
|
+ inetd_use_fds(common_userdomain)
|
|
+ inetd_rw_tcp_sockets(common_userdomain)
|
|
+')
|
|
+
|
|
+optional_policy(`
|
|
+ inn_read_config(common_userdomain)
|
|
+ inn_read_news_lib(common_userdomain)
|
|
+ inn_read_news_spool(common_userdomain)
|
|
+')
|
|
+
|
|
+optional_policy(`
|
|
+ lircd_stream_connect(common_userdomain)
|
|
+')
|
|
+
|
|
+optional_policy(`
|
|
+ locate_read_lib_files(common_userdomain)
|
|
+')
|
|
+
|
|
+# for running depmod as part of the kernel packaging process
|
|
+optional_policy(`
|
|
+ modutils_read_module_config(common_userdomain)
|
|
+')
|
|
+
|
|
+optional_policy(`
|
|
+ mta_rw_spool(common_userdomain)
|
|
+ mta_manage_queue(common_userdomain)
|
|
+ mta_filetrans_home_content(common_userdomain)
|
|
+')
|
|
+
|
|
+optional_policy(`
|
|
+ tunable_policy(`allow_user_mysql_connect',`
|
|
+ mysql_stream_connect(common_userdomain)
|
|
+ ')
|
|
+')
|
|
+
|
|
+optional_policy(`
|
|
+ oident_manage_user_content(common_userdomain)
|
|
+ oident_relabel_user_content(common_userdomain)
|
|
+')
|
|
+
|
|
+optional_policy(`
|
|
+ # to allow monitoring of pcmcia status
|
|
+ pcmcia_read_pid(common_userdomain)
|
|
+')
|
|
+
|
|
+optional_policy(`
|
|
+ pcscd_read_pub_files(common_userdomain)
|
|
+ pcscd_stream_connect(common_userdomain)
|
|
+')
|
|
+
|
|
+optional_policy(`
|
|
+ tunable_policy(`allow_user_postgresql_connect',`
|
|
+ postgresql_stream_connect(common_userdomain)
|
|
+ postgresql_tcp_connect(common_userdomain)
|
|
+ ')
|
|
+')
|
|
+
|
|
+optional_policy(`
|
|
+ resmgr_stream_connect(common_userdomain)
|
|
+')
|
|
+
|
|
+optional_policy(`
|
|
+ rpc_dontaudit_getattr_exports(common_userdomain)
|
|
+ rpc_manage_nfs_rw_content(common_userdomain)
|
|
+')
|
|
+
|
|
+optional_policy(`
|
|
+ rpcbind_stream_connect(common_userdomain)
|
|
+')
|
|
+
|
|
+optional_policy(`
|
|
+ samba_stream_connect_winbind(common_userdomain)
|
|
+')
|
|
+
|
|
+optional_policy(`
|
|
+ slrnpull_search_spool(common_userdomain)
|
|
+')
|