From 21871a5cf623e701468454701849323eb144ce2d Mon Sep 17 00:00:00 2001 From: Chris PeBenito Date: Jun 21 2005 17:01:45 +0000 Subject: work on newrole policy --- diff --git a/refpolicy/policy/global_tunables b/refpolicy/policy/global_tunables index a292811..bfabd20 100644 --- a/refpolicy/policy/global_tunables +++ b/refpolicy/policy/global_tunables @@ -40,6 +40,13 @@ gen_tunable(fcron_crond,false) ## gen_tunable(read_default_t,false) +## +## Enabling secure mode disallows programs, such as +## newrole, from transitioning to administrative +## user domains. +## +gen_bool(secure_mode,false) + ## ## Allow staff_r users to search the sysadm home ## dir and read files (such as ~/.bashrc) diff --git a/refpolicy/policy/modules/kernel/terminal.if b/refpolicy/policy/modules/kernel/terminal.if index 90ea8a1..c41a065 100644 --- a/refpolicy/policy/modules/kernel/terminal.if +++ b/refpolicy/policy/modules/kernel/terminal.if @@ -403,6 +403,27 @@ define(`term_dontaudit_use_all_user_ptys',` ') ######################################## +## +## +## Relabel from and to all user +## user pty device nodes. +## +## +## The type of the process performing this action. +## +## +# +define(`term_relabel_all_user_ptys',` + gen_require(` + attribute ptynode; + class chr_file { relabelfrom relabelto }; + ') + + dev_list_all_dev_nodes($1) + allow $1 ptynode:chr_file { relabelfrom relabelto }; +') + +######################################## ## ## ## Get the attributes of all unallocated diff --git a/refpolicy/policy/modules/system/selinuxutil.te b/refpolicy/policy/modules/system/selinuxutil.te index a178716..739518b 100644 --- a/refpolicy/policy/modules/system/selinuxutil.te +++ b/refpolicy/policy/modules/system/selinuxutil.te @@ -128,11 +128,6 @@ libs_use_shared_libs(checkpolicy_t) userdom_use_all_user_fd(checkpolicy_t) -ifdef(`TODO',` -# Read the devpts root directory. -ifdef(`sshd.te',`allow checkpolicy_t sshd_devpts_t:dir r_dir_perms;') -') dnl endif TODO - ######################################## # # Load_policy local policy @@ -210,6 +205,8 @@ selinux_compute_user_contexts(newrole_t) term_use_all_user_ttys(newrole_t) term_use_all_user_ptys(newrole_t) +term_relabel_all_user_ttys(newrole_t) +term_relabel_all_user_ptys(newrole_t) auth_domtrans_chk_passwd(newrole_t) @@ -229,6 +226,14 @@ miscfiles_read_localization(newrole_t) userdom_use_unpriv_users_fd(newrole_t) +# if secure mode is enabled, then newrole +# can only transition to unprivileged users +if(secure_mode) { + userdom_spec_domtrans_unpriv_users(newrole_t) +} else { + userdom_spec_domtrans_all_users(newrole_t) +} + ifdef(`TODO',` can_ypbind(newrole) @@ -239,29 +244,10 @@ allow newrole_t autofs_t:dir { search getattr }; # for when the user types "exec newrole" at the command line allow newrole_t privfd:process sigchld; -# Execute /sbin/pwdb_chkpwd to check the password. -allow newrole_t sbin_t:dir r_dir_perms; - -# Execute shells -allow newrole_t bin_t:dir r_dir_perms; -allow newrole_t bin_t:lnk_file read; - -# Allow newrole_t to transition to user domains. -bool secure_mode false; -domain_trans(newrole_t, shell_exec_t, unpriv_userdomain) -if(!secure_mode) -{ - # if we are not in secure mode then we can transition to sysadm_t - domain_trans(newrole_t, shell_exec_t, sysadm_t) -} - # Read /var. allow newrole_t var_t:dir r_dir_perms; allow newrole_t var_t:notdevfile_class_set r_file_perms; -# Relabel terminals. -allow newrole_t { ttyfile ptyfile }:chr_file { relabelfrom relabelto }; - ifdef(`gnome-pty-helper.te', `allow newrole_t gphdomain:fd use;') # for some PAM modules and for cwd @@ -308,10 +294,6 @@ logging_send_syslog_msg(restorecon_t) userdom_use_all_user_fd(restorecon_t) -optional_policy(`hotplug.te',` - hotplug_use_fd(restorecon_t) -') - # relabeling rules kernel_relabel_unlabeled(restorecon_t) dev_relabel_all_dev_nodes(restorecon_t) @@ -328,6 +310,10 @@ ifdef(`distro_redhat', ` fs_relabel_tmpfs_character_devices(restorecon_t) ') +optional_policy(`hotplug.te',` + hotplug_use_fd(restorecon_t) +') + ifdef(`TODO',` # for upgrading glibc and other shared objects - without this the upgrade @@ -395,13 +381,15 @@ ifdef(`targeted_policy',`',` logging_send_syslog_msg(run_init_t) ') dnl end ifdef targeted policy + ifdef(`TODO',` ifdef(`distro_gentoo', ` # Gentoo integrated run_init+open_init_pty-runscript: - domain_auto_trans(sysadm_t,initrc_exec_t,run_init_t) domain_entry_file(run_init_t,initrc_exec_t) + domain_auto_trans(sysadm_t,initrc_exec_t,run_init_t) ') + ') dnl end TODO ######################################## diff --git a/refpolicy/policy/modules/system/userdomain.if b/refpolicy/policy/modules/system/userdomain.if index 229bd81..2f804f7 100644 --- a/refpolicy/policy/modules/system/userdomain.if +++ b/refpolicy/policy/modules/system/userdomain.if @@ -821,12 +821,31 @@ define(`admin_domain_template',` ## # define(`userdom_spec_domtrans_all_users',` - gen_require(`$0'_depend) + gen_require(` + attribute userdomain; + ') + corecmd_shell_spec_domtrans($1,userdomain) ') -define(`userdom_spec_domtrans_all_users_depend',` - type sysadm_t; +######################################## +## +## +## Execute a shell in all unprivileged user domains. This +## is an explicit transition, requiring the +## caller to use setexeccon(). +## +## +## The type of the process performing this action. +## +## +# +define(`userdom_spec_domtrans_unpriv_users',` + gen_require(` + attribute unpriv_userdomain; + ') + + corecmd_shell_spec_domtrans($1,unpriv_userdomain) ') ######################################## diff --git a/refpolicy/policy/support/misc_macros.spt b/refpolicy/policy/support/misc_macros.spt index b4f4a2a..8b3b94c 100644 --- a/refpolicy/policy/support/misc_macros.spt +++ b/refpolicy/policy/support/misc_macros.spt @@ -19,6 +19,10 @@ define(`shiftn',`ifelse($1,0,`shift($*)',`shiftn(decr($1),shift(shift($*)))')') # define(`context_template',`ifdef(`enable_mls',`$1:$2',`$1')') dnl +######################################## +# +# can_exec(domain,executable) +# define(`can_exec',` gen_require(` class file { rx_file_perms execute_no_trans }; @@ -26,3 +30,11 @@ define(`can_exec',` allow $1 $2:file { rx_file_perms execute_no_trans }; ') + +######################################## +# +# gen_bool(name,default_value) +# +define(`gen_bool',` + bool $1 dflt_or_overr(`$1'_conf,$2); +')