rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity
a668127367
selinux-policy/policy/modules/roles/unconfineduser.te
Dan Walsh 03527520de firstboot is leaking a netlink_route socket into iptables. We need to dontaudit 
tmpfs_t/devpts_t files can be stored on device_t file system
unconfined_mono_t can pass file descriptors to chrome_sandbox, so need transition from all unoconfined users types
Hald can connect to user processes over streams
xdm_t now changes the brightness level on the system
mdadm needs to manage hugetlbfs filesystems
2010-09-01 09:47:50 -04:00

463 lines
10 KiB
Plaintext
Raw Blame History

policy_module(unconfineduser, 1.0.0)
########################################
#
# Declarations
#
attribute unconfined_login_domain;
## <desc>
## <p>
## Transition to confined nsplugin domains from unconfined user
## </p>
## </desc>
gen_tunable(allow_unconfined_nsplugin_transition, false)
## <desc>
## <p>
## Allow a user to login as an unconfined domain
## </p>
## </desc>
gen_tunable(unconfined_login, true)
## <desc>
## <p>
## Transition to confined qemu domains from unconfined user
## </p>
## </desc>
gen_tunable(allow_unconfined_qemu_transition, false)
# usage in this module of types created by these
# calls is not correct, however we dont currently
# have another method to add access to these types
userdom_base_user_template(unconfined)
userdom_manage_home_role(unconfined_r, unconfined_t)
userdom_manage_tmp_role(unconfined_r, unconfined_t)
userdom_manage_tmpfs_role(unconfined_r, unconfined_t)
userdom_unpriv_usertype(unconfined, unconfined_t)
type unconfined_exec_t;
init_system_domain(unconfined_t, unconfined_exec_t)
role unconfined_r types unconfined_t;
role_transition system_r unconfined_exec_t unconfined_r;
allow system_r unconfined_r;
domain_user_exemption_target(unconfined_t)
allow system_r unconfined_r;
allow unconfined_r system_r;
init_script_role_transition(unconfined_r)
role system_r types unconfined_t;
typealias unconfined_t alias unconfined_crontab_t;
type unconfined_notrans_t;
type unconfined_notrans_exec_t;
init_system_domain(unconfined_notrans_t, unconfined_notrans_exec_t)
role unconfined_r types unconfined_notrans_t;
########################################
#
# Local policy
#
dontaudit unconfined_t self:dir write;
dontaudit unconfined_t self:file setattr;
allow unconfined_t self:system syslog_read;
dontaudit unconfined_t self:capability sys_module;
files_create_boot_flag(unconfined_t)
files_create_default_dir(unconfined_t)
files_root_filetrans_default(unconfined_t, dir)
mcs_killall(unconfined_t)
mcs_ptrace_all(unconfined_t)
mls_file_write_all_levels(unconfined_t)
init_run_daemon(unconfined_t, unconfined_r)
init_domtrans_script(unconfined_t)
init_telinit(unconfined_t)
libs_run_ldconfig(unconfined_t, unconfined_r)
logging_send_syslog_msg(unconfined_t)
logging_run_auditctl(unconfined_t, unconfined_r)
mount_run_unconfined(unconfined_t, unconfined_r)
# Unconfined running as system_r
mount_domtrans_unconfined(unconfined_t)
seutil_run_setsebool(unconfined_t, unconfined_r)
seutil_run_setfiles(unconfined_t, unconfined_r)
seutil_run_semanage(unconfined_t, unconfined_r)
unconfined_domain_noaudit(unconfined_t)
userdom_user_home_dir_filetrans_user_home_content(unconfined_t, { dir file lnk_file fifo_file sock_file })
usermanage_run_passwd(unconfined_t, unconfined_r)
usermanage_run_chfn(unconfined_t, unconfined_r)
tunable_policy(`allow_execmem',`
allow unconfined_t self:process execmem;
')
tunable_policy(`allow_execmem && allow_execstack',`
allow unconfined_t self:process execstack;
')
tunable_policy(`allow_execmod',`
userdom_execmod_user_home_files(unconfined_usertype)
')
tunable_policy(`unconfined_login',`
corecmd_shell_domtrans(unconfined_login_domain,unconfined_t)
allow unconfined_t unconfined_login_domain:fd use;
allow unconfined_t unconfined_login_domain:fifo_file rw_file_perms;
allow unconfined_t unconfined_login_domain:process sigchld;
')
optional_policy(`
gen_require(`
attribute unconfined_usertype;
')
nsplugin_role_notrans(unconfined_r, unconfined_usertype)
optional_policy(`
tunable_policy(`allow_unconfined_nsplugin_transition',`
nsplugin_domtrans(unconfined_usertype)
nsplugin_domtrans_config(unconfined_usertype)
')
')
optional_policy(`
abrt_dbus_chat(unconfined_usertype)
abrt_run_helper(unconfined_usertype, unconfined_r)
')
optional_policy(`
avahi_dbus_chat(unconfined_usertype)
')
optional_policy(`
certmonger_dbus_chat(unconfined_usertype)
')
optional_policy(`
devicekit_dbus_chat(unconfined_usertype)
devicekit_dbus_chat_disk(unconfined_usertype)
devicekit_dbus_chat_power(unconfined_usertype)
')
optional_policy(`
hal_dbus_chat(unconfined_usertype)
')
optional_policy(`
iptables_run(unconfined_usertype, unconfined_r)
')
optional_policy(`
networkmanager_dbus_chat(unconfined_usertype)
')
optional_policy(`
policykit_role(unconfined_r, unconfined_usertype)
')
optional_policy(`
rtkit_scheduled(unconfined_usertype)
')
optional_policy(`
setroubleshoot_dbus_chat(unconfined_usertype)
setroubleshoot_dbus_chat_fixit(unconfined_t)
')
optional_policy(`
sandbox_transition(unconfined_usertype, unconfined_r)
')
optional_policy(`
shutdown_run(unconfined_t, unconfined_r)
')
optional_policy(`
tzdata_run(unconfined_usertype, unconfined_r)
')
optional_policy(`
gen_require(`
type user_tmpfs_t;
')
xserver_rw_session(unconfined_usertype, user_tmpfs_t)
xserver_run_xauth(unconfined_usertype, unconfined_r)
xserver_dbus_chat_xdm(unconfined_usertype)
')
')
ifdef(`distro_gentoo',`
seutil_run_runinit(unconfined_t, unconfined_r)
seutil_init_script_run_runinit(unconfined_t, unconfined_r)
')
optional_policy(`
accountsd_dbus_chat(unconfined_t)
')
optional_policy(`
ada_run(unconfined_t, unconfined_r)
')
optional_policy(`
apache_run_helper(unconfined_t, unconfined_r)
')
optional_policy(`
bind_run_ndc(unconfined_t, unconfined_r)
')
optional_policy(`
bootloader_run(unconfined_t, unconfined_r)
')
optional_policy(`
cron_unconfined_role(unconfined_r, unconfined_t)
')
optional_policy(`
chrome_role(unconfined_r, unconfined_usertype)
')
optional_policy(`
dbus_role_template(unconfined, unconfined_r, unconfined_t)
optional_policy(`
unconfined_domain(unconfined_dbusd_t)
unconfined_execmem_domtrans(unconfined_dbusd_t)
optional_policy(`
xserver_rw_shm(unconfined_dbusd_t)
')
')
init_dbus_chat(unconfined_usertype)
init_dbus_chat_script(unconfined_usertype)
dbus_stub(unconfined_t)
optional_policy(`
bluetooth_dbus_chat(unconfined_usertype)
')
optional_policy(`
consolekit_dbus_chat(unconfined_usertype)
')
optional_policy(`
cups_dbus_chat_config(unconfined_usertype)
')
optional_policy(`
fprintd_dbus_chat(unconfined_usertype)
')
optional_policy(`
gnomeclock_dbus_chat(unconfined_usertype)
gnome_dbus_chat_gconfdefault(unconfined_usertype)
')
optional_policy(`
ipsec_mgmt_dbus_chat(unconfined_usertype)
')
optional_policy(`
kerneloops_dbus_chat(unconfined_usertype)
')
optional_policy(`
oddjob_dbus_chat(unconfined_usertype)
')
optional_policy(`
vpn_dbus_chat(unconfined_usertype)
')
')
optional_policy(`
firewallgui_dbus_chat(unconfined_usertype)
')
optional_policy(`
firstboot_run(unconfined_t, unconfined_r)
')
optional_policy(`
ftp_run_ftpdctl(unconfined_t, unconfined_r)
')
optional_policy(`
gpsd_run(unconfined_t, unconfined_r)
')
optional_policy(`
java_run_unconfined(unconfined_t, unconfined_r)
')
optional_policy(`
livecd_run(unconfined_t, unconfined_r)
')
optional_policy(`
lpd_run_checkpc(unconfined_t, unconfined_r)
')
optional_policy(`
modutils_run_update_mods(unconfined_t, unconfined_r)
')
optional_policy(`
mono_role_template(unconfined, unconfined_r, unconfined_t)
unconfined_domain_noaudit(unconfined_mono_t)
role system_r types unconfined_mono_t;
')
optional_policy(`
mozilla_run_plugin(unconfined_usertype, unconfined_r)
')
optional_policy(`
ncftool_run(unconfined_t, unconfined_r)
')
optional_policy(`
oddjob_run_mkhomedir(unconfined_t, unconfined_r)
')
optional_policy(`
prelink_run(unconfined_t, unconfined_r)
')
optional_policy(`
portmap_run_helper(unconfined_t, unconfined_r)
')
#optional_policy(`
# ppp_run(unconfined_t, unconfined_r)
#')
optional_policy(`
qemu_unconfined_role(unconfined_r)
tunable_policy(`allow_unconfined_qemu_transition',`
qemu_domtrans(unconfined_t)
',`
qemu_domtrans_unconfined(unconfined_t)
')
')
optional_policy(`
rpm_run(unconfined_t, unconfined_r)
# Allow SELinux aware applications to request rpm_script execution
rpm_transition_script(unconfined_t)
rpm_dbus_chat(unconfined_t)
')
optional_policy(`
samba_role_notrans(unconfined_r)
samba_run_unconfined_net(unconfined_t, unconfined_r)
# samba_run_winbind_helper(unconfined_t, unconfined_r)
samba_run_smbcontrol(unconfined_t, unconfined_r)
')
optional_policy(`
sendmail_run_unconfined(unconfined_t, unconfined_r)
')
optional_policy(`
sysnet_run_dhcpc(unconfined_t, unconfined_r)
sysnet_dbus_chat_dhcpc(unconfined_t)
sysnet_role_transition_dhcpc(unconfined_r)
')
optional_policy(`
telepathy_dbus_session_role(unconfined_r, unconfined_t)
')
optional_policy(`
vbetool_run(unconfined_t, unconfined_r)
')
optional_policy(`
virt_transition_svirt(unconfined_t, unconfined_r)
')
optional_policy(`
vpn_run(unconfined_t, unconfined_r)
')
optional_policy(`
webalizer_run(unconfined_t, unconfined_r)
')
optional_policy(`
wine_run(unconfined_t, unconfined_r)
')
optional_policy(`
xserver_run(unconfined_t, unconfined_r)
')
########################################
#
# Unconfined Execmem Local policy
#
optional_policy(`
execmem_role_template(unconfined, unconfined_r, unconfined_t)
typealias unconfined_execmem_t alias execmem_t;
typealias unconfined_execmem_t alias unconfined_openoffice_t;
unconfined_domain_noaudit(unconfined_execmem_t)
allow unconfined_execmem_t unconfined_t:process transition;
rpm_transition_script(unconfined_execmem_t)
role system_r types unconfined_execmem_t;
optional_policy(`
init_dbus_chat_script(unconfined_execmem_t)
dbus_system_bus_client(unconfined_execmem_t)
unconfined_dbus_chat(unconfined_execmem_t)
unconfined_dbus_connect(unconfined_execmem_t)
')
optional_policy(`
tunable_policy(`allow_unconfined_nsplugin_transition',`', `
nsplugin_exec_domtrans(unconfined_t, unconfined_execmem_t)
')
')
optional_policy(`
openoffice_exec_domtrans(unconfined_t, unconfined_execmem_t)
')
')
########################################
#
# Unconfined notrans Local policy
#
allow unconfined_notrans_t self:process { execstack execmem };
unconfined_domain_noaudit(unconfined_notrans_t)
userdom_unpriv_usertype(unconfined, unconfined_notrans_t)
domtrans_pattern(unconfined_t, unconfined_notrans_exec_t, unconfined_notrans_t)
# Allow SELinux aware applications to request rpm_script execution
rpm_transition_script(unconfined_notrans_t)
domain_ptrace_all_domains(unconfined_notrans_t)
########################################
#
# Unconfined mount local policy
#
gen_user(unconfined_u, user, unconfined_r system_r, s0, s0 - mls_systemhigh, mcs_allcats)
Reference in New Issue View Git Blame Copy Permalink