diff --git a/Changelog b/Changelog index 88188c3..63055c9 100644 --- a/Changelog +++ b/Changelog @@ -1,3 +1,5 @@ +- Add support for network interfaces with access controlled by a Boolean + from the CLIP project. - Several fixes from the CLIP project. - Add support for labeled Booleans. - Remove node definitions and change node usage to generic nodes. diff --git a/Makefile b/Makefile index 12c9128..8beede9 100644 --- a/Makefile +++ b/Makefile @@ -397,7 +397,7 @@ $(moddir)/kernel/corenetwork.if: $(moddir)/kernel/corenetwork.te.in $(moddir)/ke @echo "# $(notdir $@).in or $(notdir $@).m4 file should be modified." >> $@ @echo "#" >> $@ $(verbose) cat $@.in >> $@ - $(verbose) $(GREP) "^[[:blank:]]*network_(interface|node|port|packet)\(.*\)" $< \ + $(verbose) $(GREP) "^[[:blank:]]*network_(interface|node|port|packet)(_controlled)?\(.*\)" $< \ | $(M4) -D self_contained_policy $(M4PARAM) $@.m4 - \ | $(SED) -e 's/dollarsone/\$$1/g' -e 's/dollarszero/\$$0/g' >> $@ diff --git a/policy/modules/kernel/corenetwork.if.m4 b/policy/modules/kernel/corenetwork.if.m4 index a83e89f..8e0f9cd 100644 --- a/policy/modules/kernel/corenetwork.if.m4 +++ b/policy/modules/kernel/corenetwork.if.m4 @@ -140,6 +140,147 @@ interface(`corenet_raw_sendrecv_$1_if',` ') '') dnl end create_netif_interfaces +# create confined network interfaces controlled by the network_enabled boolean +# do not call this macro for loop back +define(`create_netif_interfaces_controlled',`` +######################################## +## +## Send and receive TCP network traffic on the $1 interface. +## +## +## +## Domain allowed access. +## +## +## +# +interface(`corenet_tcp_sendrecv_$1_if',` + gen_require(` + $3 $1_$2; + ') + + if (network_enabled) { + allow dollarsone $1_$2:netif { tcp_send tcp_recv egress ingress }; + } +') + +######################################## +## +## Send UDP network traffic on the $1 interface. +## +## +## +## Domain allowed access. +## +## +## +# +interface(`corenet_udp_send_$1_if',` + gen_require(` + $3 $1_$2; + ') + + if (network_enabled) { + allow dollarsone $1_$2:netif { udp_send egress }; + } +') + +######################################## +## +## Receive UDP network traffic on the $1 interface. +## +## +## +## Domain allowed access. +## +## +## +# +interface(`corenet_udp_receive_$1_if',` + gen_require(` + $3 $1_$2; + ') + + if (network_enabled) { + allow dollarsone $1_$2:netif { udp_recv ingress }; + } +') + +######################################## +## +## Send and receive UDP network traffic on the $1 interface. +## +## +## +## Domain allowed access. +## +## +## +# +interface(`corenet_udp_sendrecv_$1_if',` + corenet_udp_send_$1_if(dollarsone) + corenet_udp_receive_$1_if(dollarsone) +') + +######################################## +## +## Send raw IP packets on the $1 interface. +## +## +## +## Domain allowed access. +## +## +## +# +interface(`corenet_raw_send_$1_if',` + gen_require(` + $3 $1_$2; + ') + + if (network_enabled) { + allow dollarsone $1_$2:netif { rawip_send egress }; + } +') + +######################################## +## +## Receive raw IP packets on the $1 interface. +## +## +## +## Domain allowed access. +## +## +## +# +interface(`corenet_raw_receive_$1_if',` + gen_require(` + $3 $1_$2; + ') + + if (network_enabled) { + allow dollarsone $1_$2:netif { rawip_recv ingress }; + } +') + +######################################## +## +## Send and receive raw IP packets on the $1 interface. +## +## +## +## Domain allowed access. +## +## +## +# +interface(`corenet_raw_sendrecv_$1_if',` + corenet_raw_send_$1_if(dollarsone) + corenet_raw_receive_$1_if(dollarsone) +') +'') dnl end create_netif_interfaces_controlled + ######################################## # # Network node generated macros @@ -641,9 +782,15 @@ interface(`corenet_relabelto_$1_packets',` define(`create_netif_type_interfaces',` create_netif_interfaces($1,netif_t,type) ') +define(`create_netif_type_interfaces_controlled',` +create_netif_interfaces_controlled($1,netif_t,type) +') define(`create_netif_attrib_interfaces',` create_netif_interfaces($1,netif,attribute) ') +define(`create_netif_attrib_interfaces_controlled',` +create_netif_interfaces_controlled($1,netif,attribute) +') # # network_interface(linux_interfacename,mls_sensitivity) @@ -652,6 +799,10 @@ define(`network_interface',` create_netif_type_interfaces($1) ') +define(`network_interface_controlled',` +create_netif_type_interfaces_controlled($1) +') + # # create_node_*_interfaces(node_name) # diff --git a/policy/modules/kernel/corenetwork.te.in b/policy/modules/kernel/corenetwork.te.in index ab1a321..49e3b43 100644 --- a/policy/modules/kernel/corenetwork.te.in +++ b/policy/modules/kernel/corenetwork.te.in @@ -1,5 +1,5 @@ -policy_module(corenetwork, 1.11.1) +policy_module(corenetwork, 1.11.2) ######################################## # diff --git a/policy/modules/kernel/corenetwork.te.m4 b/policy/modules/kernel/corenetwork.te.m4 index c8ed292..27b4bb6 100644 --- a/policy/modules/kernel/corenetwork.te.m4 +++ b/policy/modules/kernel/corenetwork.te.m4 @@ -39,6 +39,21 @@ type $1_netif_t alias netif_$1_t, netif_type; declare_netifs($1_netif_t,shift($*)) ') +define(`network_interface_controlled',` +ifdef(`__network_enabled_declared__',`',` +## +##

+## Enable network traffic on all controlled interfaces. +##

+##
+gen_bool(network_enabled, true) +define(`__network_enabled_declared__') +') +gen_require(``type unlabeled_t;'') +type $1_netif_t alias netif_$1_t, netif_type; +declare_netifs($1_netif_t,shift($*)) +') + define(`declare_nodes',`dnl nodecon $3 $4 gen_context(system_u:object_r:$1,$2) ifelse(`$5',`',`',`declare_nodes($1,shiftn(4,$*))')dnl