diff --git a/abrt.fc b/abrt.fc index 1bd5812..b5fe639 100644 --- a/abrt.fc +++ b/abrt.fc @@ -1,12 +1,16 @@ /etc/abrt(/.*)? gen_context(system_u:object_r:abrt_etc_t,s0) /etc/rc\.d/init\.d/abrt -- gen_context(system_u:object_r:abrt_initrc_exec_t,s0) -/usr/bin/abrt-pyhook-helper -- gen_context(system_u:object_r:abrt_helper_exec_t,s0) +/usr/lib/systemd/system/abrt.* -- gen_context(system_u:object_r:abrt_unit_file_t,s0) -/usr/libexec/abrt-pyhook-helper -- gen_context(system_u:object_r:abrt_helper_exec_t,s0) -/usr/libexec/abrt-hook-python -- gen_context(system_u:object_r:abrt_helper_exec_t,s0) +/usr/bin/abrt-dump-oops -- gen_context(system_u:object_r:abrt_dump_oops_exec_t,s0) +/usr/bin/abrt-pyhook-helper -- gen_context(system_u:object_r:abrt_helper_exec_t,s0) +/usr/bin/abrt-watch-log -- gen_context(system_u:object_r:abrt_watch_log_exec_t,s0) /usr/sbin/abrtd -- gen_context(system_u:object_r:abrt_exec_t,s0) +/usr/sbin/abrt-dbus -- gen_context(system_u:object_r:abrt_exec_t,s0) + +/usr/libexec/abrt-handle-event -- gen_context(system_u:object_r:abrt_handle_event_exec_t,s0) /var/cache/abrt(/.*)? gen_context(system_u:object_r:abrt_var_cache_t,s0) /var/cache/abrt-di(/.*)? gen_context(system_u:object_r:abrt_var_cache_t,s0) @@ -15,6 +19,19 @@ /var/run/abrt\.pid -- gen_context(system_u:object_r:abrt_var_run_t,s0) /var/run/abrtd?\.lock -- gen_context(system_u:object_r:abrt_var_run_t,s0) +/var/run/abrtd?\.socket -- gen_context(system_u:object_r:abrt_var_run_t,s0) /var/run/abrt(/.*)? gen_context(system_u:object_r:abrt_var_run_t,s0) /var/spool/abrt(/.*)? gen_context(system_u:object_r:abrt_var_cache_t,s0) + +# ABRT retrace server +/usr/bin/abrt-retrace-worker -- gen_context(system_u:object_r:abrt_retrace_worker_exec_t,s0) +/usr/bin/coredump2packages -- gen_context(system_u:object_r:abrt_retrace_coredump_exec_t,s0) + +/var/cache/abrt-retrace(/.*)? gen_context(system_u:object_r:abrt_retrace_cache_t,s0) +/var/spool/abrt-retrace(/.*)? gen_context(system_u:object_r:abrt_retrace_spool_t,s0) + +# cjp: new version +/usr/bin/retrace-server-worker -- gen_context(system_u:object_r:abrt_retrace_worker_exec_t,s0) +/var/cache/retrace-server(/.*)? gen_context(system_u:object_r:abrt_retrace_cache_t,s0) +/var/spool/retrace-server(/.*)? gen_context(system_u:object_r:abrt_retrace_spool_t,s0) diff --git a/abrt.if b/abrt.if index 0b827c5..ac79ca6 100644 --- a/abrt.if +++ b/abrt.if @@ -71,12 +71,13 @@ interface(`abrt_read_state',` type abrt_t; ') + kernel_search_proc($1) ps_process_pattern($1, abrt_t) ') ######################################## ## -## Connect to abrt over an unix stream socket. +## Connect to abrt over a unix stream socket. ## ## ## @@ -160,8 +161,26 @@ interface(`abrt_run_helper',` ######################################## ## -## Send and receive messages from -## abrt over dbus. +## Read abrt cache +## +## +## +## Domain allowed access. +## +## +# +interface(`abrt_read_cache',` + gen_require(` + type abrt_var_cache_t; + ') + + read_files_pattern($1, abrt_var_cache_t, abrt_var_cache_t) + read_lnk_files_pattern($1, abrt_var_cache_t, abrt_var_cache_t) +') + +######################################## +## +## Append abrt cache ## ## ## @@ -169,12 +188,33 @@ interface(`abrt_run_helper',` ## ## # -interface(`abrt_cache_manage',` +interface(`abrt_append_cache',` + gen_require(` + type abrt_var_cache_t; + ') + + + allow $1 abrt_var_cache_t:file append_inherited_file_perms; +') + +######################################## +## +## Manage abrt cache +## +## +## +## Domain allowed access. +## +## +# +interface(`abrt_manage_cache',` gen_require(` type abrt_var_cache_t; ') manage_files_pattern($1, abrt_var_cache_t, abrt_var_cache_t) + manage_lnk_files_pattern($1, abrt_var_cache_t, abrt_var_cache_t) + manage_dirs_pattern($1, abrt_var_cache_t, abrt_var_cache_t) ') #################################### @@ -253,6 +293,47 @@ interface(`abrt_manage_pid_files',` manage_files_pattern($1, abrt_var_run_t, abrt_var_run_t) ') +######################################## +## +## Read and write abrt fifo files. +## +## +## +## Domain allowed access. +## +## +# +interface(`abrt_rw_fifo_file',` + gen_require(` + type abrt_t; + ') + + allow $1 abrt_t:fifo_file rw_inherited_fifo_file_perms; +') + +######################################## +## +## Execute abrt server in the abrt domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`abrt_systemctl',` + gen_require(` + type abrt_t; + type abrt_unit_file_t; + ') + + systemd_exec_systemctl($1) + allow $1 abrt_unit_file_t:file read_file_perms; + allow $1 abrt_unit_file_t:service manage_service_perms; + + ps_process_pattern($1, abrt_t) +') + ##################################### ## ## All of the rules required to administrate @@ -276,28 +357,135 @@ interface(`abrt_admin',` type abrt_var_cache_t, abrt_var_log_t; type abrt_var_run_t, abrt_tmp_t; type abrt_initrc_exec_t; + type abrt_unit_file_t; ') - allow $1 abrt_t:process { ptrace signal_perms }; + allow $1 abrt_t:process { signal_perms }; ps_process_pattern($1, abrt_t) + tunable_policy(`deny_ptrace',`',` + allow $1 abrt_t:process ptrace; + ') + init_labeled_script_domtrans($1, abrt_initrc_exec_t) domain_system_change_exemption($1) role_transition $2 abrt_initrc_exec_t system_r; allow $2 system_r; - files_search_etc($1) + files_list_etc($1) admin_pattern($1, abrt_etc_t) - logging_search_logs($1) + logging_list_logs($1) admin_pattern($1, abrt_var_log_t) - files_search_var($1) + files_list_var($1) admin_pattern($1, abrt_var_cache_t) - files_search_pids($1) + files_list_pids($1) admin_pattern($1, abrt_var_run_t) - files_search_tmp($1) + files_list_tmp($1) admin_pattern($1, abrt_tmp_t) + + abrt_systemctl($1) + admin_pattern($1, abrt_unit_file_t) + allow $1 abrt_unit_file_t:service all_service_perms; +') + +#################################### +## +## Execute abrt-retrace in the abrt-retrace domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`abrt_domtrans_retrace_worker',` + gen_require(` + type abrt_retrace_worker_t, abrt_retrace_worker_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, abrt_retrace_worker_exec_t, abrt_retrace_worker_t) +') + +###################################### +## +## Manage abrt retrace server cache +## +## +## +## Domain allowed access. +## +## +# +interface(`abrt_manage_spool_retrace',` + gen_require(` + type abrt_retrace_spool_t; + ') + + manage_dirs_pattern($1, abrt_retrace_spool_t, abrt_retrace_spool_t) + manage_files_pattern($1, abrt_retrace_spool_t, abrt_retrace_spool_t) + manage_lnk_files_pattern($1, abrt_retrace_spool_t, abrt_retrace_spool_t) +') + +##################################### +## +## Read abrt retrace server cache +## +## +## +## Domain allowed access. +## +## +# +interface(`abrt_read_spool_retrace',` + gen_require(` + type abrt_retrace_spool_t; + ') + + list_dirs_pattern($1, abrt_retrace_spool_t, abrt_retrace_spool_t) + read_files_pattern($1, abrt_retrace_spool_t, abrt_retrace_spool_t) + read_lnk_files_pattern($1, abrt_retrace_spool_t, abrt_retrace_spool_t) +') + + +##################################### +## +## Read abrt retrace server cache +## +## +## +## Domain allowed access. +## +## +# +interface(`abrt_read_cache_retrace',` + gen_require(` + type abrt_retrace_cache_t; + ') + + list_dirs_pattern($1, abrt_retrace_cache_t, abrt_retrace_cache_t) + read_files_pattern($1, abrt_retrace_cache_t, abrt_retrace_cache_t) + read_lnk_files_pattern($1, abrt_retrace_cache_t, abrt_retrace_cache_t) +') + +######################################## +## +## Do not audit attempts to write abrt sock files +## +## +## +## Domain to not audit. +## +## +# +interface(`abrt_dontaudit_write_sock_file',` + gen_require(` + type abrt_t; + ') + + dontaudit $1 abrt_t:sock_file write; ') diff --git a/abrt.te b/abrt.te index 30861ec..e42ee9e 100644 --- a/abrt.te +++ b/abrt.te @@ -5,13 +5,34 @@ policy_module(abrt, 1.2.0) # Declarations # -type abrt_t; +## +##

+## Allow ABRT to modify public files +## used for public file transfer services. +##

+## +gen_tunable(abrt_anon_write, false) + +## +##

+## Allow ABRT to run in abrt_handle_event_t domain +## to handle ABRT event scripts +##

+## +gen_tunable(abrt_handle_event, false) + +attribute abrt_domain; + +type abrt_t, abrt_domain; type abrt_exec_t; init_daemon_domain(abrt_t, abrt_exec_t) type abrt_initrc_exec_t; init_script_file(abrt_initrc_exec_t) +type abrt_unit_file_t; +systemd_unit_file(abrt_unit_file_t) + # etc files type abrt_etc_t; files_config_file(abrt_etc_t) @@ -32,9 +53,22 @@ files_type(abrt_var_cache_t) type abrt_var_run_t; files_pid_file(abrt_var_run_t) +type abrt_dump_oops_t, abrt_domain; +type abrt_dump_oops_exec_t; +init_system_domain(abrt_dump_oops_t, abrt_dump_oops_exec_t) + +# type for abrt-handle-event to handle +# ABRT event scripts +type abrt_handle_event_t, abrt_domain; +type abrt_handle_event_exec_t; +application_domain(abrt_handle_event_t, abrt_handle_event_exec_t) +role system_r types abrt_handle_event_t; + # type needed to allow all domains # to handle /var/cache/abrt -type abrt_helper_t; +# type needed to allow all domains +# to handle /var/cache/abrt +type abrt_helper_t, abrt_domain; type abrt_helper_exec_t; application_domain(abrt_helper_t, abrt_helper_exec_t) role system_r types abrt_helper_t; @@ -43,14 +77,40 @@ ifdef(`enable_mcs',` init_ranged_daemon_domain(abrt_t, abrt_exec_t, s0 - mcs_systemhigh) ') +# +# Support for ABRT retrace server +# + +type abrt_retrace_worker_t, abrt_domain; +type abrt_retrace_worker_exec_t; +application_domain(abrt_retrace_worker_t, abrt_retrace_worker_exec_t) +role system_r types abrt_retrace_worker_t; + +type abrt_retrace_coredump_t, abrt_domain; +type abrt_retrace_coredump_exec_t; +application_domain(abrt_retrace_coredump_t, abrt_retrace_coredump_exec_t) +role system_r types abrt_retrace_coredump_t; + +type abrt_retrace_cache_t; +files_type(abrt_retrace_cache_t) + +type abrt_retrace_spool_t; +files_spool_file(abrt_retrace_spool_t) + +# Support abrt-watch log + +type abrt_watch_log_t, abrt_domain; +type abrt_watch_log_exec_t; +init_daemon_domain(abrt_watch_log_t, abrt_watch_log_exec_t) + ######################################## # # abrt local policy # -allow abrt_t self:capability { chown kill setuid setgid sys_nice dac_override }; +allow abrt_t self:capability { chown dac_override fowner fsetid kill setgid setuid sys_nice }; dontaudit abrt_t self:capability sys_rawio; -allow abrt_t self:process { signal signull setsched getsched }; +allow abrt_t self:process { setpgid sigkill signal signull setsched getsched }; allow abrt_t self:fifo_file rw_fifo_file_perms; allow abrt_t self:tcp_socket create_stream_socket_perms; @@ -59,6 +119,7 @@ allow abrt_t self:unix_dgram_socket create_socket_perms; allow abrt_t self:netlink_route_socket r_netlink_socket_perms; # abrt etc files +list_dirs_pattern(abrt_t, abrt_etc_t, abrt_etc_t) rw_files_pattern(abrt_t, abrt_etc_t, abrt_etc_t) # log file @@ -68,7 +129,9 @@ logging_log_filetrans(abrt_t, abrt_var_log_t, file) # abrt tmp files manage_dirs_pattern(abrt_t, abrt_tmp_t, abrt_tmp_t) manage_files_pattern(abrt_t, abrt_tmp_t, abrt_tmp_t) +manage_lnk_files_pattern(abrt_t, abrt_tmp_t, abrt_tmp_t) files_tmp_filetrans(abrt_t, abrt_tmp_t, { file dir }) +can_exec(abrt_t, abrt_tmp_t) # abrt var/cache files manage_files_pattern(abrt_t, abrt_var_cache_t, abrt_var_cache_t) @@ -82,7 +145,10 @@ manage_files_pattern(abrt_t, abrt_var_run_t, abrt_var_run_t) manage_dirs_pattern(abrt_t, abrt_var_run_t, abrt_var_run_t) manage_sock_files_pattern(abrt_t, abrt_var_run_t, abrt_var_run_t) manage_lnk_files_pattern(abrt_t, abrt_var_run_t, abrt_var_run_t) -files_pid_filetrans(abrt_t, abrt_var_run_t, { file dir }) +files_pid_filetrans(abrt_t, abrt_var_run_t, { file dir sock_file }) + +kernel_read_ring_buffer(abrt_t) +kernel_request_load_module(abrt_t) kernel_read_ring_buffer(abrt_t) kernel_read_system_state(abrt_t) @@ -93,7 +159,6 @@ corecmd_exec_shell(abrt_t) corecmd_read_all_executables(abrt_t) corenet_all_recvfrom_netlabel(abrt_t) -corenet_all_recvfrom_unlabeled(abrt_t) corenet_tcp_sendrecv_generic_if(abrt_t) corenet_tcp_sendrecv_generic_node(abrt_t) corenet_tcp_sendrecv_generic_port(abrt_t) @@ -104,6 +169,8 @@ corenet_tcp_connect_all_ports(abrt_t) corenet_sendrecv_http_client_packets(abrt_t) dev_getattr_all_chr_files(abrt_t) +dev_getattr_all_blk_files(abrt_t) +dev_read_rand(abrt_t) dev_read_urand(abrt_t) dev_rw_sysfs(abrt_t) dev_dontaudit_read_raw_memory(abrt_t) @@ -113,7 +180,8 @@ domain_read_all_domains_state(abrt_t) domain_signull_all_domains(abrt_t) files_getattr_all_files(abrt_t) -files_read_etc_files(abrt_t) +files_read_config_files(abrt_t) +files_read_etc_runtime_files(abrt_t) files_read_var_symlinks(abrt_t) files_read_var_lib_files(abrt_t) files_read_usr_files(abrt_t) @@ -121,6 +189,9 @@ files_read_generic_tmp_files(abrt_t) files_read_kernel_modules(abrt_t) files_dontaudit_list_default(abrt_t) files_dontaudit_read_default_files(abrt_t) +files_dontaudit_read_all_symlinks(abrt_t) +files_dontaudit_getattr_all_sockets(abrt_t) +files_list_mnt(abrt_t) fs_list_inotifyfs(abrt_t) fs_getattr_all_fs(abrt_t) @@ -131,22 +202,37 @@ fs_read_nfs_files(abrt_t) fs_read_nfs_symlinks(abrt_t) fs_search_all(abrt_t) -sysnet_read_config(abrt_t) - logging_read_generic_logs(abrt_t) logging_send_syslog_msg(abrt_t) +auth_use_nsswitch(abrt_t) + miscfiles_read_generic_certs(abrt_t) -miscfiles_read_localization(abrt_t) +miscfiles_read_public_files(abrt_t) userdom_dontaudit_read_user_home_content_files(abrt_t) +userdom_dontaudit_read_admin_home_files(abrt_t) + +tunable_policy(`abrt_anon_write',` + miscfiles_manage_public_files(abrt_t) +') + +optional_policy(` + apache_list_modules(abrt_t) + apache_read_modules(abrt_t) +') optional_policy(` dbus_system_domain(abrt_t, abrt_exec_t) ') optional_policy(` - nis_use_ypbind(abrt_t) + dmesg_domtrans(abrt_t) +') + +optional_policy(` + mozilla_plugin_dontaudit_rw_tmp_files(abrt_t) + mozilla_plugin_read_rw_files(abrt_t) ') optional_policy(` @@ -167,6 +253,7 @@ optional_policy(` rpm_exec(abrt_t) rpm_dontaudit_manage_db(abrt_t) rpm_manage_cache(abrt_t) + rpm_manage_log(abrt_t) rpm_manage_pid_files(abrt_t) rpm_read_db(abrt_t) rpm_signull(abrt_t) @@ -178,9 +265,36 @@ optional_policy(` ') optional_policy(` + sosreport_domtrans(abrt_t) + sosreport_read_tmp_files(abrt_t) + sosreport_delete_tmp_files(abrt_t) +') + +optional_policy(` sssd_stream_connect(abrt_t) ') +optional_policy(` + xserver_read_log(abrt_t) +') + +####################################### +# +# abrt-handle-event local policy +# + +allow abrt_handle_event_t self:fifo_file rw_fifo_file_perms; + +tunable_policy(`abrt_handle_event',` + domtrans_pattern(abrt_t, abrt_handle_event_exec_t, abrt_handle_event_t) +',` + can_exec(abrt_t, abrt_handle_event_exec_t) +') + +optional_policy(` + unconfined_domain(abrt_handle_event_t) +') + ######################################## # # abrt--helper local policy @@ -200,9 +314,11 @@ files_var_filetrans(abrt_helper_t, abrt_var_cache_t, { file dir }) read_files_pattern(abrt_helper_t, abrt_var_run_t, abrt_var_run_t) read_lnk_files_pattern(abrt_helper_t, abrt_var_run_t, abrt_var_run_t) +corecmd_read_all_executables(abrt_helper_t) + domain_read_all_domains_state(abrt_helper_t) -files_read_etc_files(abrt_helper_t) +files_dontaudit_all_non_security_leaks(abrt_helper_t) fs_list_inotifyfs(abrt_helper_t) fs_getattr_all_fs(abrt_helper_t) @@ -211,12 +327,11 @@ auth_use_nsswitch(abrt_helper_t) logging_send_syslog_msg(abrt_helper_t) -miscfiles_read_localization(abrt_helper_t) - term_dontaudit_use_all_ttys(abrt_helper_t) term_dontaudit_use_all_ptys(abrt_helper_t) -ifdef(`hide_broken_symptoms', ` +ifdef(`hide_broken_symptoms',` + domain_dontaudit_leaks(abrt_helper_t) userdom_dontaudit_read_user_home_content_files(abrt_helper_t) userdom_dontaudit_read_user_tmp_files(abrt_helper_t) dev_dontaudit_read_all_blk_files(abrt_helper_t) @@ -224,4 +339,148 @@ ifdef(`hide_broken_symptoms', ` dev_dontaudit_write_all_chr_files(abrt_helper_t) dev_dontaudit_write_all_blk_files(abrt_helper_t) fs_dontaudit_rw_anon_inodefs_files(abrt_helper_t) + + optional_policy(` + rpm_dontaudit_leaks(abrt_helper_t) + ') +') + +ifdef(`hide_broken_symptoms',` + gen_require(` + attribute domain; + ') + + allow abrt_t self:capability sys_resource; + allow abrt_t domain:file write; + allow abrt_t domain:process setrlimit; +') + +####################################### +# +# abrt retrace coredump policy +# + +allow abrt_retrace_coredump_t self:fifo_file rw_fifo_file_perms; + +list_dirs_pattern(abrt_retrace_coredump_t, abrt_retrace_cache_t, abrt_retrace_cache_t) +read_files_pattern(abrt_retrace_coredump_t, abrt_retrace_cache_t, abrt_retrace_cache_t) +read_lnk_files_pattern(abrt_retrace_coredump_t, abrt_retrace_cache_t, abrt_retrace_cache_t) + +list_dirs_pattern(abrt_retrace_coredump_t, abrt_retrace_spool_t, abrt_retrace_spool_t) +read_files_pattern(abrt_retrace_coredump_t, abrt_retrace_spool_t, abrt_retrace_spool_t) +read_lnk_files_pattern(abrt_retrace_coredump_t, abrt_retrace_spool_t, abrt_retrace_spool_t) + +corecmd_exec_bin(abrt_retrace_coredump_t) +corecmd_exec_shell(abrt_retrace_coredump_t) + +dev_read_urand(abrt_retrace_coredump_t) + +files_read_usr_files(abrt_retrace_coredump_t) + +logging_send_syslog_msg(abrt_retrace_coredump_t) + +sysnet_dns_name_resolve(abrt_retrace_coredump_t) + +# to install debuginfo packages +optional_policy(` + rpm_exec(abrt_retrace_coredump_t) + rpm_dontaudit_manage_db(abrt_retrace_coredump_t) + rpm_manage_cache(abrt_retrace_coredump_t) + rpm_manage_log(abrt_retrace_coredump_t) + rpm_manage_pid_files(abrt_retrace_coredump_t) + rpm_read_db(abrt_retrace_coredump_t) + rpm_signull(abrt_retrace_coredump_t) ') + +####################################### +# +# abrt retrace worker policy +# + +allow abrt_retrace_worker_t self:capability { setuid }; + +allow abrt_retrace_worker_t self:fifo_file rw_fifo_file_perms; + +domtrans_pattern(abrt_retrace_worker_t, abrt_retrace_coredump_exec_t, abrt_retrace_coredump_t) +allow abrt_retrace_worker_t abrt_retrace_coredump_exec_t:file ioctl; + +manage_dirs_pattern(abrt_retrace_worker_t, abrt_retrace_spool_t, abrt_retrace_spool_t) +manage_files_pattern(abrt_retrace_worker_t, abrt_retrace_spool_t, abrt_retrace_spool_t) +manage_lnk_files_pattern(abrt_retrace_worker_t, abrt_retrace_spool_t, abrt_retrace_spool_t) + +allow abrt_retrace_worker_t abrt_etc_t:file read_file_perms; + +can_exec(abrt_retrace_worker_t, abrt_retrace_worker_exec_t) + +corecmd_exec_bin(abrt_retrace_worker_t) +corecmd_exec_shell(abrt_retrace_worker_t) + +dev_read_urand(abrt_retrace_worker_t) + +files_read_usr_files(abrt_retrace_worker_t) + +logging_send_syslog_msg(abrt_retrace_worker_t) + +sysnet_dns_name_resolve(abrt_retrace_worker_t) + +optional_policy(` + mock_domtrans(abrt_retrace_worker_t) +') + +######################################## +# +# abrt_dump_oops local policy +# + +allow abrt_dump_oops_t self:capability dac_override; +allow abrt_dump_oops_t self:fifo_file rw_fifo_file_perms; +allow abrt_dump_oops_t self:unix_stream_socket create_stream_socket_perms; + +files_search_spool(abrt_dump_oops_t) +manage_dirs_pattern(abrt_dump_oops_t, abrt_var_cache_t, abrt_var_cache_t) +manage_files_pattern(abrt_dump_oops_t, abrt_var_cache_t, abrt_var_cache_t) +manage_lnk_files_pattern(abrt_dump_oops_t, abrt_var_cache_t, abrt_var_cache_t) +files_var_filetrans(abrt_dump_oops_t, abrt_var_cache_t, { file dir }) + +read_files_pattern(abrt_dump_oops_t, abrt_var_run_t, abrt_var_run_t) +read_lnk_files_pattern(abrt_dump_oops_t, abrt_var_run_t, abrt_var_run_t) + +read_files_pattern(abrt_dump_oops_t, abrt_etc_t, abrt_etc_t) + +kernel_read_kernel_sysctls(abrt_dump_oops_t) +kernel_read_ring_buffer(abrt_dump_oops_t) + +domain_use_interactive_fds(abrt_dump_oops_t) + +fs_list_inotifyfs(abrt_dump_oops_t) + +logging_read_generic_logs(abrt_dump_oops_t) +logging_send_syslog_msg(abrt_dump_oops_t) + +####################################### +# +# abrt_watch_log local policy +# + +allow abrt_watch_log_t self:fifo_file rw_fifo_file_perms; +allow abrt_watch_log_t self:unix_stream_socket create_stream_socket_perms; + +read_files_pattern(abrt_watch_log_t, abrt_etc_t, abrt_etc_t) + +domtrans_pattern(abrt_watch_log_t, abrt_dump_oops_exec_t, abrt_dump_oops_t) + +logging_read_all_logs(abrt_watch_log_t) +logging_send_syslog_msg(abrt_watch_log_t) + +optional_policy(` + unconfined_domain(abrt_watch_log_t) +') + +####################################### +# +# Local policy for all abrt domain +# + +kernel_read_system_state(abrt_domain) + +files_read_etc_files(abrt_domain) diff --git a/accountsd.fc b/accountsd.fc index 1adca53..18e0e41 100644 --- a/accountsd.fc +++ b/accountsd.fc @@ -1,3 +1,5 @@ +/usr/lib/systemd/system/accountsd.* -- gen_context(system_u:object_r:accountsd_unit_file_t,s0) + /usr/libexec/accounts-daemon -- gen_context(system_u:object_r:accountsd_exec_t,s0) /var/lib/AccountsService(/.*)? gen_context(system_u:object_r:accountsd_var_lib_t,s0) diff --git a/accountsd.if b/accountsd.if index c0f858d..d75aae9 100644 --- a/accountsd.if +++ b/accountsd.if @@ -5,9 +5,9 @@ ## Execute a domain transition to run accountsd. ## ## -## +## ## Domain allowed access. -## +## ## # interface(`accountsd_domtrans',` @@ -25,7 +25,7 @@ interface(`accountsd_domtrans',` ## ## ## -## Domain allowed access. +## Domain to not audit. ## ## # @@ -118,28 +118,54 @@ interface(`accountsd_manage_lib_files',` ######################################## ## -## All of the rules required to administrate -## an accountsd environment +## Execute accountsd server in the accountsd domain. ## ## ## -## Domain allowed access. +## Domain allowed to transition. ## ## -## +# +interface(`accountsd_systemctl',` + gen_require(` + type accountsd_t; + type accountsd_unit_file_t; + ') + + systemd_exec_systemctl($1) + allow $1 accountsd_unit_file_t:file read_file_perms; + allow $1 accountsd_unit_file_t:service manage_service_perms; + + ps_process_pattern($1, accountsd_t) +') + +######################################## +## +## All of the rules required to administrate +## an accountsd environment +## +## ## -## Role allowed access. +## Domain allowed access. ## ## -## # interface(`accountsd_admin',` gen_require(` type accountsd_t; + type accountsd_unit_file_t; ') - allow $1 accountsd_t:process { ptrace signal_perms getattr }; + allow $1 accountsd_t:process signal_perms; ps_process_pattern($1, accountsd_t) + tunable_policy(`deny_ptrace',`',` + allow $1 acountsd_t:process ptrace; + ') + accountsd_manage_lib_files($1) + + accountsd_systemctl($1) + admin_pattern($1, accountsd_unit_file_t) + allow $1 accountsd_unit_file_t:service all_service_perms; ') diff --git a/accountsd.te b/accountsd.te index 1632f10..f4d7d4d 100644 --- a/accountsd.te +++ b/accountsd.te @@ -1,5 +1,9 @@ policy_module(accountsd, 1.0.0) +gen_require(` + class passwd { passwd chfn chsh rootok crontab }; +') + ######################################## # # Declarations @@ -7,37 +11,46 @@ policy_module(accountsd, 1.0.0) type accountsd_t; type accountsd_exec_t; -dbus_system_domain(accountsd_t, accountsd_exec_t) +init_daemon_domain(accountsd_t, accountsd_exec_t) +role system_r types accountsd_t; type accountsd_var_lib_t; files_type(accountsd_var_lib_t) +type accountsd_unit_file_t; +systemd_unit_file(accountsd_unit_file_t) + ######################################## # # accountsd local policy # -allow accountsd_t self:capability { dac_override setuid setgid sys_ptrace }; +allow accountsd_t self:capability { chown dac_override setuid setgid }; +allow accountsd_t self:process signal; allow accountsd_t self:fifo_file rw_fifo_file_perms; +allow accountsd_t self:passwd { rootok passwd chfn chsh }; manage_dirs_pattern(accountsd_t, accountsd_var_lib_t, accountsd_var_lib_t) manage_files_pattern(accountsd_t, accountsd_var_lib_t, accountsd_var_lib_t) files_var_lib_filetrans(accountsd_t, accountsd_var_lib_t, { file dir }) +kernel_read_system_state(accountsd_t) kernel_read_kernel_sysctls(accountsd_t) corecmd_exec_bin(accountsd_t) +dev_read_sysfs(accountsd_t) + files_read_usr_files(accountsd_t) files_read_mnt_files(accountsd_t) fs_list_inotifyfs(accountsd_t) +fs_getattr_xattr_fs(accountsd_t) fs_read_noxattr_fs_files(accountsd_t) auth_use_nsswitch(accountsd_t) auth_read_shadow(accountsd_t) - -miscfiles_read_localization(accountsd_t) +auth_read_login_records(accountsd_t) logging_send_syslog_msg(accountsd_t) logging_set_loginuid(accountsd_t) @@ -50,8 +63,19 @@ usermanage_domtrans_passwd(accountsd_t) optional_policy(` consolekit_read_log(accountsd_t) + consolekit_dbus_chat(accountsd_t) +') + +optional_policy(` + dbus_system_domain(accountsd_t, accountsd_exec_t) ') optional_policy(` policykit_dbus_chat(accountsd_t) ') + +optional_policy(` + xserver_read_state_xdm(accountsd_t) + xserver_dbus_chat_xdm(accountsd_t) + xserver_manage_xdm_etc_files(accountsd_t) +') diff --git a/acct.if b/acct.if index e66c296..993a1e9 100644 --- a/acct.if +++ b/acct.if @@ -78,3 +78,21 @@ interface(`acct_manage_data',` manage_files_pattern($1, acct_data_t, acct_data_t) manage_lnk_files_pattern($1, acct_data_t, acct_data_t) ') + +######################################## +## +## Dontaudit Attempts to list acct_data directory +## +## +## +## Domain to not audit. +## +## +# +interface(`acct_dontaudit_list_data',` + gen_require(` + type acct_data_t; + ') + + dontaudit $1 acct_data_t:dir list_dir_perms; +') diff --git a/acct.te b/acct.te index 63ef90e..31f524e 100644 --- a/acct.te +++ b/acct.te @@ -49,20 +49,19 @@ corecmd_exec_shell(acct_t) domain_use_interactive_fds(acct_t) -files_read_etc_files(acct_t) files_read_etc_runtime_files(acct_t) files_list_usr(acct_t) # for nscd files_dontaudit_search_pids(acct_t) +auth_use_nsswitch(acct_t) + init_use_fds(acct_t) init_use_script_ptys(acct_t) init_exec_script_files(acct_t) logging_send_syslog_msg(acct_t) -miscfiles_read_localization(acct_t) - userdom_dontaudit_use_unpriv_user_fds(acct_t) userdom_dontaudit_search_user_home_dirs(acct_t) diff --git a/ada.te b/ada.te index 39c75fb..057d8b1 100644 --- a/ada.te +++ b/ada.te @@ -17,7 +17,7 @@ role system_r types ada_t; allow ada_t self:process { execstack execmem }; -userdom_use_user_terminals(ada_t) +userdom_use_inherited_user_terminals(ada_t) optional_policy(` unconfined_domain(ada_t) diff --git a/afs.if b/afs.if index 8559cdc..641044e 100644 --- a/afs.if +++ b/afs.if @@ -97,8 +97,12 @@ interface(`afs_admin',` type afs_t, afs_initrc_exec_t; ') - allow $1 afs_t:process { ptrace signal_perms getattr }; - read_files_pattern($1, afs_t, afs_t) + allow $1 afs_t:process signal_perms; + ps_process_pattern($1, afs_t) + + tunable_policy(`deny_ptrace',`',` + allow $1 afs_t:process ptrace; + ') # Allow afs_admin to restart the afs service afs_initrc_domtrans($1) diff --git a/afs.te b/afs.te index a496fde..8170a8c 100644 --- a/afs.te +++ b/afs.te @@ -71,6 +71,7 @@ role system_r types afs_vlserver_t; # allow afs_t self:capability { sys_admin sys_nice sys_tty_config }; +dontaudit afs_t self:capability dac_override; allow afs_t self:process { setsched signal }; allow afs_t self:udp_socket create_socket_perms; allow afs_t self:fifo_file rw_file_perms; @@ -82,7 +83,6 @@ files_var_filetrans(afs_t, afs_cache_t, { file dir }) kernel_rw_afs_state(afs_t) -corenet_all_recvfrom_unlabeled(afs_t) corenet_all_recvfrom_netlabel(afs_t) corenet_tcp_sendrecv_generic_if(afs_t) corenet_udp_sendrecv_generic_if(afs_t) @@ -103,10 +103,12 @@ fs_read_nfs_symlinks(afs_t) logging_send_syslog_msg(afs_t) -miscfiles_read_localization(afs_t) - sysnet_dns_name_resolve(afs_t) +ifdef(`hide_broken_symptoms',` + kernel_rw_unlabeled_files(afs_t) +') + ######################################## # # AFS bossserver local policy @@ -140,7 +142,6 @@ domtrans_pattern(afs_bosserver_t, afs_vlserver_exec_t, afs_vlserver_t) kernel_read_kernel_sysctls(afs_bosserver_t) -corenet_all_recvfrom_unlabeled(afs_bosserver_t) corenet_all_recvfrom_netlabel(afs_bosserver_t) corenet_tcp_sendrecv_generic_if(afs_bosserver_t) corenet_udp_sendrecv_generic_if(afs_bosserver_t) @@ -156,7 +157,6 @@ files_read_etc_files(afs_bosserver_t) files_list_home(afs_bosserver_t) files_read_usr_files(afs_bosserver_t) -miscfiles_read_localization(afs_bosserver_t) seutil_read_config(afs_bosserver_t) @@ -202,7 +202,6 @@ corenet_tcp_sendrecv_generic_node(afs_fsserver_t) corenet_udp_sendrecv_generic_node(afs_fsserver_t) corenet_tcp_sendrecv_all_ports(afs_fsserver_t) corenet_udp_sendrecv_all_ports(afs_fsserver_t) -corenet_all_recvfrom_unlabeled(afs_fsserver_t) corenet_all_recvfrom_netlabel(afs_fsserver_t) corenet_tcp_bind_generic_node(afs_fsserver_t) corenet_udp_bind_generic_node(afs_fsserver_t) @@ -225,8 +224,6 @@ init_dontaudit_use_script_fds(afs_fsserver_t) logging_send_syslog_msg(afs_fsserver_t) -miscfiles_read_localization(afs_fsserver_t) - seutil_read_config(afs_fsserver_t) sysnet_read_config(afs_fsserver_t) @@ -252,7 +249,6 @@ manage_files_pattern(afs_kaserver_t, afs_logfile_t, afs_logfile_t) kernel_read_kernel_sysctls(afs_kaserver_t) -corenet_all_recvfrom_unlabeled(afs_kaserver_t) corenet_all_recvfrom_netlabel(afs_kaserver_t) corenet_tcp_sendrecv_generic_if(afs_kaserver_t) corenet_udp_sendrecv_generic_if(afs_kaserver_t) @@ -270,7 +266,6 @@ files_read_etc_files(afs_kaserver_t) files_list_home(afs_kaserver_t) files_read_usr_files(afs_kaserver_t) -miscfiles_read_localization(afs_kaserver_t) seutil_read_config(afs_kaserver_t) @@ -296,7 +291,6 @@ manage_files_pattern(afs_ptserver_t, afs_logfile_t, afs_logfile_t) manage_files_pattern(afs_ptserver_t, afs_dbdir_t, afs_pt_db_t) filetrans_pattern(afs_ptserver_t, afs_dbdir_t, afs_pt_db_t, file) -corenet_all_recvfrom_unlabeled(afs_ptserver_t) corenet_all_recvfrom_netlabel(afs_ptserver_t) corenet_tcp_sendrecv_generic_if(afs_ptserver_t) corenet_udp_sendrecv_generic_if(afs_ptserver_t) @@ -310,7 +304,6 @@ corenet_sendrecv_afs_pt_server_packets(afs_ptserver_t) files_read_etc_files(afs_ptserver_t) -miscfiles_read_localization(afs_ptserver_t) sysnet_read_config(afs_ptserver_t) @@ -334,7 +327,6 @@ manage_files_pattern(afs_vlserver_t, afs_logfile_t, afs_logfile_t) manage_files_pattern(afs_vlserver_t, afs_dbdir_t, afs_vl_db_t) filetrans_pattern(afs_vlserver_t, afs_dbdir_t, afs_vl_db_t, file) -corenet_all_recvfrom_unlabeled(afs_vlserver_t) corenet_all_recvfrom_netlabel(afs_vlserver_t) corenet_tcp_sendrecv_generic_if(afs_vlserver_t) corenet_udp_sendrecv_generic_if(afs_vlserver_t) @@ -348,7 +340,6 @@ corenet_sendrecv_afs_vl_server_packets(afs_vlserver_t) files_read_etc_files(afs_vlserver_t) -miscfiles_read_localization(afs_vlserver_t) sysnet_read_config(afs_vlserver_t) diff --git a/aiccu.if b/aiccu.if index 184c9a8..8f77bf5 100644 --- a/aiccu.if +++ b/aiccu.if @@ -79,9 +79,13 @@ interface(`aiccu_admin',` type aiccu_var_run_t; ') - allow $1 aiccu_t:process { ptrace signal_perms }; + allow $1 aiccu_t:process signal_perms; ps_process_pattern($1, aiccu_t) + tunable_policy(`deny_ptrace',`',` + allow $1 aiccu_t:process ptrace; + ') + aiccu_initrc_domtrans($1) domain_system_change_exemption($1) role_transition $2 aiccu_initrc_exec_t system_r; diff --git a/aiccu.te b/aiccu.te index 6d685ba..5a3021d 100644 --- a/aiccu.te +++ b/aiccu.te @@ -44,10 +44,11 @@ kernel_read_system_state(aiccu_t) corecmd_exec_shell(aiccu_t) corenet_all_recvfrom_netlabel(aiccu_t) -corenet_all_recvfrom_unlabeled(aiccu_t) +corenet_tcp_bind_generic_node(aiccu_t) corenet_tcp_sendrecv_generic_if(aiccu_t) corenet_tcp_sendrecv_generic_node(aiccu_t) corenet_tcp_sendrecv_generic_port(aiccu_t) +corenet_sendrecv_sixxsconfig_client_packets(aiccu_t) corenet_tcp_sendrecv_sixxsconfig_port(aiccu_t) corenet_tcp_bind_generic_node(aiccu_t) corenet_tcp_connect_sixxsconfig_port(aiccu_t) @@ -62,9 +63,9 @@ dev_read_urand(aiccu_t) files_read_etc_files(aiccu_t) -logging_send_syslog_msg(aiccu_t) +auth_read_passwd(aiccu_t) -miscfiles_read_localization(aiccu_t) +logging_send_syslog_msg(aiccu_t) optional_policy(` modutils_domtrans_insmod(aiccu_t) diff --git a/aide.fc b/aide.fc index 7798464..62ccdc6 100644 --- a/aide.fc +++ b/aide.fc @@ -3,4 +3,4 @@ /var/lib/aide(/.*) gen_context(system_u:object_r:aide_db_t,mls_systemhigh) /var/log/aide(/.*)? gen_context(system_u:object_r:aide_log_t,mls_systemhigh) -/var/log/aide\.log -- gen_context(system_u:object_r:aide_log_t,mls_systemhigh) +/var/log/aide\.log.* -- gen_context(system_u:object_r:aide_log_t,mls_systemhigh) diff --git a/aide.if b/aide.if index 838d25b..33981e0 100644 --- a/aide.if +++ b/aide.if @@ -60,9 +60,13 @@ interface(`aide_admin',` type aide_t, aide_db_t, aide_log_t; ') - allow $1 aide_t:process { ptrace signal_perms }; + allow $1 aide_t:process signal_perms; ps_process_pattern($1, aide_t) + tunable_policy(`deny_ptrace',`',` + allow $1 aide_t:process ptrace; + ') + files_list_etc($1) admin_pattern($1, aide_db_t) diff --git a/aide.te b/aide.te index 2509dd2..7ada82f 100644 --- a/aide.te +++ b/aide.te @@ -32,6 +32,13 @@ manage_files_pattern(aide_t, aide_log_t, aide_log_t) logging_log_filetrans(aide_t, aide_log_t, file) files_read_all_files(aide_t) +files_read_boot_symlinks(aide_t) +files_read_all_symlinks(aide_t) +files_getattr_all_pipes(aide_t) +files_getattr_all_sockets(aide_t) + +mls_file_read_to_clearance(aide_t) +mls_file_write_to_clearance(aide_t) logging_send_audit_msgs(aide_t) # AIDE can be configured to log to syslog @@ -39,4 +46,4 @@ logging_send_syslog_msg(aide_t) seutil_use_newrole_fds(aide_t) -userdom_use_user_terminals(aide_t) +userdom_use_inherited_user_terminals(aide_t) diff --git a/aisexec.fc b/aisexec.fc index 7b4f4b9..9c2daa5 100644 --- a/aisexec.fc +++ b/aisexec.fc @@ -4,6 +4,6 @@ /var/lib/openais(/.*)? gen_context(system_u:object_r:aisexec_var_lib_t,s0) -/var/log/cluster/aisexec\.log -- gen_context(system_u:object_r:aisexec_var_log_t,s0) +/var/log/cluster/aisexec\.log.* -- gen_context(system_u:object_r:aisexec_var_log_t,s0) /var/run/aisexec\.pid -- gen_context(system_u:object_r:aisexec_var_run_t,s0) diff --git a/aisexec.if b/aisexec.if index 0370dba..c2d68a4 100644 --- a/aisexec.if +++ b/aisexec.if @@ -82,9 +82,13 @@ interface(`aisexecd_admin',` type aisexec_initrc_exec_t; ') - allow $1 aisexec_t:process { ptrace signal_perms }; + allow $1 aisexec_t:process signal_perms; ps_process_pattern($1, aisexec_t) + tunable_policy(`deny_ptrace',`',` + allow $1 aisexec_t:process ptrace; + ') + init_labeled_script_domtrans($1, aisexec_initrc_exec_t) domain_system_change_exemption($1) role_transition $2 aisexec_initrc_exec_t system_r; diff --git a/aisexec.te b/aisexec.te index 50b9b48..bd0ccb4 100644 --- a/aisexec.te +++ b/aisexec.te @@ -64,6 +64,7 @@ files_pid_filetrans(aisexec_t, aisexec_var_run_t, { file sock_file }) kernel_read_system_state(aisexec_t) corecmd_exec_bin(aisexec_t) +corecmd_exec_shell(aisexec_t) corenet_udp_bind_netsupport_port(aisexec_t) corenet_tcp_bind_reserved_port(aisexec_t) @@ -79,8 +80,6 @@ init_rw_script_tmp_files(aisexec_t) logging_send_syslog_msg(aisexec_t) -miscfiles_read_localization(aisexec_t) - userdom_rw_unpriv_user_semaphores(aisexec_t) userdom_rw_unpriv_user_shared_mem(aisexec_t) @@ -89,6 +88,10 @@ optional_policy(` ') optional_policy(` + corosync_domtrans(aisexec_t) +') + +optional_policy(` # to communication with RHCS rhcs_rw_dlm_controld_semaphores(aisexec_t) diff --git a/ajaxterm.fc b/ajaxterm.fc new file mode 100644 index 0000000..aeb1888 --- /dev/null +++ b/ajaxterm.fc @@ -0,0 +1,6 @@ + +/etc/rc\.d/init\.d/ajaxterm -- gen_context(system_u:object_r:ajaxterm_initrc_exec_t,s0) + +/usr/share/ajaxterm/ajaxterm\.py -- gen_context(system_u:object_r:ajaxterm_exec_t,s0) + +/var/run/ajaxterm\.pid -- gen_context(system_u:object_r:ajaxterm_var_run_t,s0) diff --git a/ajaxterm.if b/ajaxterm.if new file mode 100644 index 0000000..7abe946 --- /dev/null +++ b/ajaxterm.if @@ -0,0 +1,90 @@ +## policy for ajaxterm + +######################################## +## +## Execute a domain transition to run ajaxterm. +## +## +## +## Domain allowed access. +## +## +# +interface(`ajaxterm_domtrans',` + gen_require(` + type ajaxterm_t, ajaxterm_exec_t; + ') + + domtrans_pattern($1, ajaxterm_exec_t, ajaxterm_t) +') + +######################################## +## +## Execute ajaxterm server in the ajaxterm domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`ajaxterm_initrc_domtrans',` + gen_require(` + type ajaxterm_initrc_exec_t; + ') + + init_labeled_script_domtrans($1, ajaxterm_initrc_exec_t) +') + +####################################### +## +## Read and write the ajaxterm pty type. +## +## +## +## Domain allowed access. +## +## +# +interface(`ajaxterm_rw_ptys',` + gen_require(` + type ajaxterm_devpts_t; + ') + + allow $1 ajaxterm_devpts_t:chr_file rw_inherited_term_perms; +') + +######################################## +## +## All of the rules required to administrate +## an ajaxterm environment +## +## +## +## Domain allowed access. +## +## +## +## +## Role allowed access. +## +## +## +# +interface(`ajaxterm_admin',` + gen_require(` + type ajaxterm_t, ajaxterm_initrc_exec_t; + ') + + allow $1 ajaxterm_t:process signal_perms; + ps_process_pattern($1, ajaxterm_t) + + tunable_policy(`deny_ptrace',`',` + allow $1 ajaxterm_t:process ptrace; + ') + + ajaxterm_initrc_domtrans($1) + domain_system_change_exemption($1) + role_transition $2 ajaxterm_initrc_exec_t system_r; + allow $2 system_r; +') diff --git a/ajaxterm.te b/ajaxterm.te new file mode 100644 index 0000000..8ba128b --- /dev/null +++ b/ajaxterm.te @@ -0,0 +1,62 @@ +policy_module(ajaxterm, 1.0.0) + +######################################## +# +# Declarations +# + +type ajaxterm_t; +type ajaxterm_exec_t; +init_daemon_domain(ajaxterm_t, ajaxterm_exec_t) + +type ajaxterm_initrc_exec_t; +init_script_file(ajaxterm_initrc_exec_t) + +type ajaxterm_var_run_t; +files_pid_file(ajaxterm_var_run_t) + +type ajaxterm_devpts_t; +term_login_pty(ajaxterm_devpts_t) + +######################################## +# +# ajaxterm local policy +# +allow ajaxterm_t self:capability setuid; +allow ajaxterm_t self:process { setpgid signal }; +allow ajaxterm_t self:fifo_file rw_fifo_file_perms; +allow ajaxterm_t self:unix_stream_socket create_stream_socket_perms; +allow ajaxterm_t self:tcp_socket create_stream_socket_perms; + +allow ajaxterm_t ajaxterm_devpts_t:chr_file { rw_chr_file_perms setattr_chr_file_perms relabelfrom }; +term_create_pty(ajaxterm_t, ajaxterm_devpts_t) + +manage_dirs_pattern(ajaxterm_t, ajaxterm_var_run_t, ajaxterm_var_run_t) +manage_files_pattern(ajaxterm_t, ajaxterm_var_run_t, ajaxterm_var_run_t) +files_pid_filetrans(ajaxterm_t, ajaxterm_var_run_t, { file dir }) + +kernel_read_system_state(ajaxterm_t) + +corecmd_exec_bin(ajaxterm_t) + +corenet_tcp_bind_generic_node(ajaxterm_t) +corenet_tcp_bind_ajaxterm_port(ajaxterm_t) + +dev_read_urand(ajaxterm_t) + +domain_use_interactive_fds(ajaxterm_t) + +files_read_etc_files(ajaxterm_t) +files_read_usr_files(ajaxterm_t) + +sysnet_dns_name_resolve(ajaxterm_t) + +####################################### +# +# SSH component local policy +# + +optional_policy(` + ssh_basic_client_template(ajaxterm, ajaxterm_t, system_r) +') + diff --git a/alsa.fc b/alsa.fc index d362d9c..230a2f6 100644 --- a/alsa.fc +++ b/alsa.fc @@ -11,10 +11,14 @@ HOME_DIR/\.asoundrc -- gen_context(system_u:object_r:alsa_home_t,s0) /sbin/salsa -- gen_context(system_u:object_r:alsa_exec_t,s0) /usr/bin/ainit -- gen_context(system_u:object_r:alsa_exec_t,s0) +/usr/bin/alsaunmute -- gen_context(system_u:object_r:alsa_exec_t,s0) /usr/sbin/alsactl -- gen_context(system_u:object_r:alsa_exec_t,s0) +/usr/sbin/salsa -- gen_context(system_u:object_r:alsa_exec_t,s0) /usr/share/alsa/alsa\.conf gen_context(system_u:object_r:alsa_etc_rw_t,s0) /usr/share/alsa/pcm(/.*)? gen_context(system_u:object_r:alsa_etc_rw_t,s0) /var/lib/alsa(/.*)? gen_context(system_u:object_r:alsa_var_lib_t,s0) + +/usr/lib/systemd/system/alsa.* -- gen_context(system_u:object_r:alsa_unit_file_t,s0) diff --git a/alsa.if b/alsa.if index 1392679..64e685f 100644 --- a/alsa.if +++ b/alsa.if @@ -148,6 +148,7 @@ interface(`alsa_manage_home_files',` userdom_search_user_home_dirs($1) allow $1 alsa_home_t:file manage_file_perms; + alsa_filetrans_home_content($1) ') ######################################## @@ -206,3 +207,69 @@ interface(`alsa_read_lib',` files_search_var_lib($1) read_files_pattern($1, alsa_var_lib_t, alsa_var_lib_t) ') + +######################################## +## +## Transition to alsa named content +## +## +## +## Domain allowed access. +## +## +# +interface(`alsa_filetrans_home_content',` + gen_require(` + type alsa_home_t; + ') + + userdom_user_home_dir_filetrans($1, alsa_home_t, file, ".asoundrc") +') + +######################################## +## +## Transition to alsa named content +## +## +## +## Domain allowed access. +## +## +# +interface(`alsa_filetrans_named_content',` + gen_require(` + type alsa_home_t; + type alsa_etc_rw_t; + type alsa_var_lib_t; + ') + + files_etc_filetrans($1, alsa_etc_rw_t, file, "asound.state") + files_etc_filetrans($1, alsa_etc_rw_t, dir, "pcm") + files_etc_filetrans($1, alsa_etc_rw_t, dir, "asound") + files_usr_filetrans($1, alsa_etc_rw_t, file, "alsa.conf") + files_usr_filetrans($1, alsa_etc_rw_t, dir, "pcm") + files_var_lib_filetrans($1, alsa_var_lib_t, dir, "alsa") +') + +######################################## +## +## Execute alsa server in the alsa domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`alsa_systemctl',` + gen_require(` + type alsa_t; + type alsa_unit_file_t; + ') + + systemd_exec_systemctl($1) + allow $1 alsa_unit_file_t:file read_file_perms; + allow $1 alsa_unit_file_t:service manage_service_perms; + + ps_process_pattern($1, alsa_t) +') diff --git a/alsa.te b/alsa.te index dc1b088..33678e4 100644 --- a/alsa.te +++ b/alsa.te @@ -22,6 +22,9 @@ files_type(alsa_var_lib_t) type alsa_home_t; userdom_user_home_content(alsa_home_t) +type alsa_unit_file_t; +systemd_unit_file(alsa_unit_file_t) + ######################################## # # Local policy @@ -59,7 +62,6 @@ dev_read_sysfs(alsa_t) corecmd_exec_bin(alsa_t) -files_read_etc_files(alsa_t) files_read_usr_files(alsa_t) term_dontaudit_use_console(alsa_t) @@ -72,8 +74,6 @@ init_use_fds(alsa_t) logging_send_syslog_msg(alsa_t) -miscfiles_read_localization(alsa_t) - userdom_manage_unpriv_user_semaphores(alsa_t) userdom_manage_unpriv_user_shared_mem(alsa_t) userdom_search_user_home_dirs(alsa_t) diff --git a/amanda.te b/amanda.te index d8b5abe..a4f5d3a 100644 --- a/amanda.te +++ b/amanda.te @@ -58,7 +58,7 @@ optional_policy(` # allow amanda_t self:capability { chown dac_override setuid kill }; -allow amanda_t self:process { setpgid signal }; +allow amanda_t self:process { getsched setsched setpgid signal }; allow amanda_t self:fifo_file rw_fifo_file_perms; allow amanda_t self:unix_stream_socket create_stream_socket_perms; allow amanda_t self:unix_dgram_socket create_socket_perms; @@ -71,6 +71,7 @@ allow amanda_t amanda_config_t:file read_file_perms; manage_dirs_pattern(amanda_t, amanda_data_t, amanda_data_t) manage_files_pattern(amanda_t, amanda_data_t, amanda_data_t) +manage_lnk_files_pattern(amanda_t, amanda_data_t, amanda_data_t) filetrans_pattern(amanda_t, amanda_config_t, amanda_data_t, { file dir }) allow amanda_t amanda_dumpdates_t:file rw_file_perms; @@ -101,7 +102,6 @@ kernel_dontaudit_read_proc_symlinks(amanda_t) corecmd_exec_shell(amanda_t) corecmd_exec_bin(amanda_t) -corenet_all_recvfrom_unlabeled(amanda_t) corenet_all_recvfrom_netlabel(amanda_t) corenet_tcp_sendrecv_generic_if(amanda_t) corenet_udp_sendrecv_generic_if(amanda_t) @@ -120,7 +120,6 @@ corenet_dontaudit_tcp_bind_all_ports(amanda_t) dev_getattr_all_blk_files(amanda_t) dev_getattr_all_chr_files(amanda_t) -files_read_etc_files(amanda_t) files_read_etc_runtime_files(amanda_t) files_list_all(amanda_t) files_read_all_files(amanda_t) @@ -177,7 +176,6 @@ kernel_read_kernel_sysctls(amanda_recover_t) corecmd_exec_shell(amanda_recover_t) corecmd_exec_bin(amanda_recover_t) -corenet_all_recvfrom_unlabeled(amanda_recover_t) corenet_all_recvfrom_netlabel(amanda_recover_t) corenet_tcp_sendrecv_generic_if(amanda_recover_t) corenet_udp_sendrecv_generic_if(amanda_recover_t) @@ -193,7 +191,6 @@ corenet_sendrecv_amanda_client_packets(amanda_recover_t) domain_use_interactive_fds(amanda_recover_t) -files_read_etc_files(amanda_recover_t) files_read_etc_runtime_files(amanda_recover_t) files_search_tmp(amanda_recover_t) files_search_pids(amanda_recover_t) @@ -205,7 +202,11 @@ fstools_signal(amanda_t) logging_search_logs(amanda_recover_t) -miscfiles_read_localization(amanda_recover_t) -userdom_use_user_terminals(amanda_recover_t) +userdom_use_inherited_user_terminals(amanda_recover_t) userdom_search_user_home_content(amanda_recover_t) + +optional_policy(` + fstools_domtrans(amanda_t) + fstools_signal(amanda_t) +') diff --git a/amavis.fc b/amavis.fc index 446ee16..33c0147 100644 --- a/amavis.fc +++ b/amavis.fc @@ -2,6 +2,7 @@ /etc/amavis(d)?\.conf -- gen_context(system_u:object_r:amavis_etc_t,s0) /etc/amavisd(/.*)? gen_context(system_u:object_r:amavis_etc_t,s0) /etc/rc\.d/init\.d/amavis -- gen_context(system_u:object_r:amavis_initrc_exec_t,s0) +/etc/rc\.d/init\.d/amavisd-snmp -- gen_context(system_u:object_r:amavis_initrc_exec_t,s0) /usr/sbin/amavisd.* -- gen_context(system_u:object_r:amavis_exec_t,s0) /usr/lib/AntiVir/antivir -- gen_context(system_u:object_r:amavis_exec_t,s0) @@ -10,9 +11,10 @@ ifdef(`distro_debian',` /usr/sbin/amavisd-new-cronjob -- gen_context(system_u:object_r:amavis_exec_t,s0) ') +/var/opt/f-secure(/.*)? gen_context(system_u:object_r:amavis_var_lib_t,s0) /var/amavis(/.*)? gen_context(system_u:object_r:amavis_var_lib_t,s0) /var/lib/amavis(/.*)? gen_context(system_u:object_r:amavis_var_lib_t,s0) -/var/log/amavisd\.log -- gen_context(system_u:object_r:amavis_var_log_t,s0) +/var/log/amavisd\.log.* -- gen_context(system_u:object_r:amavis_var_log_t,s0) /var/run/amavis(d)?(/.*)? gen_context(system_u:object_r:amavis_var_run_t,s0) /var/spool/amavisd(/.*)? gen_context(system_u:object_r:amavis_spool_t,s0) /var/virusmails(/.*)? gen_context(system_u:object_r:amavis_quarantine_t,s0) diff --git a/amavis.if b/amavis.if index e31d92a..1aa0718 100644 --- a/amavis.if +++ b/amavis.if @@ -202,6 +202,7 @@ interface(`amavis_create_pid_files',` type amavis_var_run_t; ') + allow $1 amavis_var_run_t:dir rw_dir_perms; allow $1 amavis_var_run_t:file create_file_perms; files_search_pids($1) ') @@ -231,9 +232,13 @@ interface(`amavis_admin',` type amavis_initrc_exec_t; ') - allow $1 amavis_t:process { ptrace signal_perms }; + allow $1 amavis_t:process signal_perms; ps_process_pattern($1, amavis_t) + tunable_policy(`deny_ptrace',`',` + allow $1 amavis_t:process ptrace; + ') + amavis_initrc_domtrans($1) domain_system_change_exemption($1) role_transition $2 amavis_initrc_exec_t system_r; diff --git a/amavis.te b/amavis.te index 505309b..44121c2 100644 --- a/amavis.te +++ b/amavis.te @@ -5,6 +5,13 @@ policy_module(amavis, 1.14.0) # Declarations # +## +##

+## Allow amavis to use JIT compiler +##

+## +gen_tunable(amavis_use_jit, false) + type amavis_t; type amavis_exec_t; domain_type(amavis_t) @@ -38,7 +45,7 @@ type amavis_quarantine_t; files_type(amavis_quarantine_t) type amavis_spool_t; -files_type(amavis_spool_t) +files_spool_file(amavis_spool_t) ######################################## # @@ -49,7 +56,7 @@ allow amavis_t self:capability { kill chown dac_override setgid setuid }; dontaudit amavis_t self:capability sys_tty_config; allow amavis_t self:process { signal sigchld sigkill signull }; allow amavis_t self:fifo_file rw_fifo_file_perms; -allow amavis_t self:unix_stream_socket create_stream_socket_perms; +allow amavis_t self:unix_stream_socket { create_stream_socket_perms connectto }; allow amavis_t self:unix_dgram_socket create_socket_perms; allow amavis_t self:tcp_socket { listen accept }; allow amavis_t self:netlink_route_socket r_netlink_socket_perms; @@ -75,9 +82,11 @@ filetrans_pattern(amavis_t, amavis_spool_t, amavis_var_run_t, sock_file) files_search_spool(amavis_t) # tmp files +manage_dirs_pattern(amavis_t, amavis_tmp_t, amavis_tmp_t) manage_files_pattern(amavis_t, amavis_tmp_t, amavis_tmp_t) +manage_sock_files_pattern(amavis_t, amavis_tmp_t, amavis_tmp_t) allow amavis_t amavis_tmp_t:dir setattr_dir_perms; -files_tmp_filetrans(amavis_t, amavis_tmp_t, file) +files_tmp_filetrans(amavis_t, amavis_tmp_t, { file dir sock_file } ) # var/lib files for amavis manage_dirs_pattern(amavis_t, amavis_var_lib_t, amavis_var_lib_t) @@ -107,7 +116,6 @@ kernel_dontaudit_read_system_state(amavis_t) corecmd_exec_bin(amavis_t) corecmd_exec_shell(amavis_t) -corenet_all_recvfrom_unlabeled(amavis_t) corenet_all_recvfrom_netlabel(amavis_t) corenet_tcp_sendrecv_generic_if(amavis_t) corenet_tcp_sendrecv_generic_node(amavis_t) @@ -125,20 +133,24 @@ corenet_tcp_bind_amavisd_recv_port(amavis_t) corenet_udp_bind_generic_port(amavis_t) corenet_dontaudit_udp_bind_all_ports(amavis_t) corenet_tcp_connect_razor_port(amavis_t) +corenet_tcp_connect_agentx_port(amavis_t) dev_read_rand(amavis_t) dev_read_urand(amavis_t) +dev_read_sysfs(amavis_t) domain_use_interactive_fds(amavis_t) +domain_dontaudit_read_all_domains_state(amavis_t) -files_read_etc_files(amavis_t) files_read_etc_runtime_files(amavis_t) files_read_usr_files(amavis_t) fs_getattr_xattr_fs(amavis_t) +auth_use_nsswitch(amavis_t) auth_dontaudit_read_shadow(amavis_t) +init_read_state(amavis_t) # uses uptime which reads utmp - redhat bug 561383 init_read_utmp(amavis_t) init_stream_connect_script(amavis_t) @@ -146,23 +158,28 @@ init_stream_connect_script(amavis_t) logging_send_syslog_msg(amavis_t) miscfiles_read_generic_certs(amavis_t) -miscfiles_read_localization(amavis_t) -sysnet_dns_name_resolve(amavis_t) sysnet_use_ldap(amavis_t) userdom_dontaudit_search_user_home_dirs(amavis_t) -# Cron handling -cron_use_fds(amavis_t) -cron_use_system_job_fds(amavis_t) -cron_rw_pipes(amavis_t) - -mta_read_config(amavis_t) +tunable_policy(`amavis_use_jit',` + allow amavis_t self:process execmem; +',` + dontaudit amavis_t self:process execmem; +') optional_policy(` clamav_stream_connect(amavis_t) clamav_domtrans_clamscan(amavis_t) + clamav_read_state_clamd(amavis_t) +') + +optional_policy(` + #Cron handling + cron_use_fds(amavis_t) + cron_use_system_job_fds(amavis_t) + cron_rw_pipes(amavis_t) ') optional_policy(` @@ -171,11 +188,16 @@ optional_policy(` ') optional_policy(` + mta_read_config(amavis_t) +') + +optional_policy(` nslcd_stream_connect(amavis_t) ') optional_policy(` postfix_read_config(amavis_t) + postfix_list_spool(amavis_t) ') optional_policy(` @@ -188,6 +210,10 @@ optional_policy(` ') optional_policy(` + snmp_manage_var_lib_files(amavis_t) +') + +optional_policy(` spamassassin_exec(amavis_t) spamassassin_exec_client(amavis_t) spamassassin_read_lib_files(amavis_t) diff --git a/amtu.te b/amtu.te index 057abb0..c75e9e9 100644 --- a/amtu.te +++ b/amtu.te @@ -23,7 +23,7 @@ files_read_etc_files(amtu_t) logging_send_audit_msgs(amtu_t) -userdom_use_user_terminals(amtu_t) +userdom_use_inherited_user_terminals(amtu_t) optional_policy(` nscd_dontaudit_search_pid(amtu_t) diff --git a/anaconda.te b/anaconda.te index e81bdbd..e3a396b 100644 --- a/anaconda.te +++ b/anaconda.te @@ -1,5 +1,9 @@ policy_module(anaconda, 1.6.0) +gen_require(` + class passwd { passwd chfn chsh rootok crontab }; +') + ######################################## # # Declarations @@ -17,27 +21,23 @@ role system_r types anaconda_t; # allow anaconda_t self:process execmem; +allow anaconda_t self:passwd { rootok passwd chfn chsh }; kernel_domtrans_to(anaconda_t, anaconda_exec_t) init_domtrans_script(anaconda_t) -libs_domtrans_ldconfig(anaconda_t) - logging_send_syslog_msg(anaconda_t) modutils_domtrans_insmod(anaconda_t) modutils_domtrans_depmod(anaconda_t) seutil_domtrans_semanage(anaconda_t) +seutil_domtrans_setsebool(anaconda_t) userdom_user_home_dir_filetrans_user_home_content(anaconda_t, { dir file lnk_file fifo_file sock_file }) optional_policy(` - kudzu_domtrans(anaconda_t) -') - -optional_policy(` rpm_domtrans(anaconda_t) rpm_domtrans_script(anaconda_t) ') @@ -51,9 +51,6 @@ optional_policy(` ') optional_policy(` - unconfined_domain(anaconda_t) + unconfined_domain_noaudit(anaconda_t) ') -optional_policy(` - usermanage_domtrans_admin_passwd(anaconda_t) -') diff --git a/apache.fc b/apache.fc index fd9fa07..7263fd1 100644 --- a/apache.fc +++ b/apache.fc @@ -1,39 +1,56 @@ HOME_DIR/((www)|(web)|(public_html))(/.+)? gen_context(system_u:object_r:httpd_user_content_t,s0) +HOME_DIR/((www)|(web)|(public_html))/cgi-bin(/.+)? gen_context(system_u:object_r:httpd_user_script_exec_t,s0) +HOME_DIR/((www)|(web)|(public_html))(/.*)?/\.htaccess -- gen_context(system_u:object_r:httpd_user_htaccess_t,s0) +HOME_DIR/((www)|(web)|(public_html))(/.*)?/logs(/.*)? gen_context(system_u:object_r:httpd_user_ra_content_t,s0) /etc/apache(2)?(/.*)? gen_context(system_u:object_r:httpd_config_t,s0) /etc/apache-ssl(2)?(/.*)? gen_context(system_u:object_r:httpd_config_t,s0) -/etc/drupal(/.*)? gen_context(system_u:object_r:httpd_sys_rw_content_t,s0) +/etc/cherokee(/.*)? gen_context(system_u:object_r:httpd_config_t,s0) +/etc/drupal.* gen_context(system_u:object_r:httpd_sys_rw_content_t,s0) /etc/htdig(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) /etc/httpd(/.*)? gen_context(system_u:object_r:httpd_config_t,s0) /etc/httpd/conf/keytab -- gen_context(system_u:object_r:httpd_keytab_t,s0) /etc/httpd/logs gen_context(system_u:object_r:httpd_log_t,s0) /etc/httpd/modules gen_context(system_u:object_r:httpd_modules_t,s0) +/etc/init\.d/cherokee -- gen_context(system_u:object_r:httpd_initrc_exec_t,s0) /etc/lighttpd(/.*)? gen_context(system_u:object_r:httpd_config_t,s0) /etc/mock/koji(/.*)? gen_context(system_u:object_r:httpd_sys_rw_content_t,s0) /etc/rc\.d/init\.d/httpd -- gen_context(system_u:object_r:httpd_initrc_exec_t,s0) /etc/rc\.d/init\.d/lighttpd -- gen_context(system_u:object_r:httpd_initrc_exec_t,s0) /etc/vhosts -- gen_context(system_u:object_r:httpd_config_t,s0) +/etc/WebCalendar(/.*)? gen_context(system_u:object_r:httpd_sys_rw_content_t,s0) /etc/zabbix/web(/.*)? gen_context(system_u:object_r:httpd_sys_rw_content_t,s0) +/usr/.*\.cgi -- gen_context(system_u:object_r:httpd_sys_script_exec_t,s0) +/opt/.*\.cgi -- gen_context(system_u:object_r:httpd_sys_script_exec_t,s0) +/usr/lib/systemd/system/httpd.* -- gen_context(system_u:object_r:httpd_unit_file_t,s0) +/usr/lib/systemd/system/jetty.* -- gen_context(system_u:object_r:httpd_unit_file_t,s0) + +/usr/libexec/httpd-ssl-pass-dialog -- gen_context(system_u:object_r:httpd_passwd_exec_t,s0) + /srv/([^/]*/)?www(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) /srv/gallery2(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) /usr/bin/htsslpass -- gen_context(system_u:object_r:httpd_helper_exec_t,s0) /usr/bin/mongrel_rails -- gen_context(system_u:object_r:httpd_exec_t,s0) +/usr/share/jetty/bin/jetty.sh -- gen_context(system_u:object_r:httpd_exec_t,s0) + /usr/lib/apache-ssl/.+ -- gen_context(system_u:object_r:httpd_exec_t,s0) /usr/lib/cgi-bin(/.*)? gen_context(system_u:object_r:httpd_sys_script_exec_t,s0) -/usr/lib/dirsrv/cgi-bin(/.*)? gen_context(system_u:object_r:httpd_sys_script_exec_t,s0) -/usr/lib/apache(/.*)? gen_context(system_u:object_r:httpd_modules_t,s0) -/usr/lib/apache2/modules(/.*)? gen_context(system_u:object_r:httpd_modules_t,s0) -/usr/lib/apache(2)?/suexec(2)? -- gen_context(system_u:object_r:httpd_suexec_exec_t,s0) -/usr/lib/cgi-bin/(nph-)?cgiwrap(d)? -- gen_context(system_u:object_r:httpd_suexec_exec_t,s0) -/usr/lib/httpd(/.*)? gen_context(system_u:object_r:httpd_modules_t,s0) -/usr/lib/lighttpd(/.*)? gen_context(system_u:object_r:httpd_modules_t,s0) +/usr/lib/apache(/.*)? gen_context(system_u:object_r:httpd_modules_t,s0) +/usr/lib/apache2/modules(/.*)? gen_context(system_u:object_r:httpd_modules_t,s0) +/usr/lib/apache(2)?/suexec(2)? -- gen_context(system_u:object_r:httpd_suexec_exec_t,s0) +/usr/lib/cgi-bin/(nph-)?cgiwrap(d)? -- gen_context(system_u:object_r:httpd_suexec_exec_t,s0) +/usr/lib/cherokee(/.*)? gen_context(system_u:object_r:httpd_modules_t,s0) +/usr/lib/httpd(/.*)? gen_context(system_u:object_r:httpd_modules_t,s0) +/usr/lib/lighttpd(/.*)? gen_context(system_u:object_r:httpd_modules_t,s0) /usr/sbin/apache(2)? -- gen_context(system_u:object_r:httpd_exec_t,s0) /usr/sbin/apache-ssl(2)? -- gen_context(system_u:object_r:httpd_exec_t,s0) +/usr/sbin/cherokee -- gen_context(system_u:object_r:httpd_exec_t,s0) +/usr/sbin/httpd\.event -- gen_context(system_u:object_r:httpd_exec_t,s0) /usr/sbin/httpd(\.worker)? -- gen_context(system_u:object_r:httpd_exec_t,s0) /usr/sbin/lighttpd -- gen_context(system_u:object_r:httpd_exec_t,s0) /usr/sbin/rotatelogs -- gen_context(system_u:object_r:httpd_rotatelogs_exec_t,s0) @@ -43,8 +60,9 @@ ifdef(`distro_suse', ` /usr/sbin/httpd2-.* -- gen_context(system_u:object_r:httpd_exec_t,s0) ') -/usr/share/dirsrv(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) -/usr/share/drupal(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) +/usr/share/drupal.* gen_context(system_u:object_r:httpd_sys_content_t,s0) +/usr/share/doc/ghc/html(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) + /usr/share/htdig(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) /usr/share/icecast(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) /usr/share/mythweb(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) @@ -54,9 +72,12 @@ ifdef(`distro_suse', ` /usr/share/ntop/html(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) /usr/share/openca/htdocs(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) /usr/share/selinux-policy[^/]*/html(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) +/usr/share/wordpress/.*\.php -- gen_context(system_u:object_r:httpd_sys_script_exec_t,s0) /usr/share/wordpress-mu/wp-config\.php -- gen_context(system_u:object_r:httpd_sys_script_exec_t,s0) /usr/share/wordpress-mu/wp-content(/.*)? gen_context(system_u:object_r:httpd_sys_rw_content_t,s0) /usr/share/wordpress/wp-content/uploads(/.*)? gen_context(system_u:object_r:httpd_sys_rw_content_t,s0) +/usr/share/wordpress/wp-content/upgrade(/.*)? gen_context(system_u:object_r:httpd_sys_rw_content_t,s0) +/usr/share/wordpress/wp-includes/.*\.php -- gen_context(system_u:object_r:httpd_sys_script_exec_t,s0) /var/cache/httpd(/.*)? gen_context(system_u:object_r:httpd_cache_t,s0) /var/cache/lighttpd(/.*)? gen_context(system_u:object_r:httpd_cache_t,s0) @@ -73,31 +94,45 @@ ifdef(`distro_suse', ` /var/cache/ssl.*\.sem -- gen_context(system_u:object_r:httpd_cache_t,s0) /var/lib/cacti/rra(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) +/var/lib/cherokee(/.*)? gen_context(system_u:object_r:httpd_var_lib_t,s0) /var/lib/dav(/.*)? gen_context(system_u:object_r:httpd_var_lib_t,s0) -/var/lib/drupal(/.*)? gen_context(system_u:object_r:httpd_sys_rw_content_t,s0) +/var/lib/php(/.*)? gen_context(system_u:object_r:httpd_var_lib_t,s0) +/var/lib/dokuwiki(/.*)? gen_context(system_u:object_r:httpd_sys_rw_content_t,s0) +/var/lib/drupal.* gen_context(system_u:object_r:httpd_sys_rw_content_t,s0) /var/lib/htdig(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) /var/lib/httpd(/.*)? gen_context(system_u:object_r:httpd_var_lib_t,s0) +/var/lib/lighttpd(/.*)? gen_context(system_u:object_r:httpd_var_lib_t,s0) /var/lib/php/session(/.*)? gen_context(system_u:object_r:httpd_var_run_t,s0) /var/lib/squirrelmail/prefs(/.*)? gen_context(system_u:object_r:httpd_squirrelmail_t,s0) +/var/lib/stickshift/.httpd.d(/.*)? gen_context(system_u:object_r:httpd_config_t,s0) +/var/lib/svn(/.*)? gen_context(system_u:object_r:httpd_sys_rw_content_t,s0) +/var/lib/trac(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) /var/log/apache(2)?(/.*)? gen_context(system_u:object_r:httpd_log_t,s0) /var/log/apache-ssl(2)?(/.*)? gen_context(system_u:object_r:httpd_log_t,s0) /var/log/cacti(/.*)? gen_context(system_u:object_r:httpd_log_t,s0) /var/log/cgiwrap\.log.* -- gen_context(system_u:object_r:httpd_log_t,s0) -/var/log/httpd(/.*)? gen_context(system_u:object_r:httpd_log_t,s0) -/var/log/lighttpd(/.*)? gen_context(system_u:object_r:httpd_log_t,s0) -/var/log/piranha(/.*)? gen_context(system_u:object_r:httpd_log_t,s0) +/var/log/cherokee(/.*)? gen_context(system_u:object_r:httpd_log_t,s0) +/var/log/httpd(/.*)? gen_context(system_u:object_r:httpd_log_t,s0) +/var/log/lighttpd(/.*)? gen_context(system_u:object_r:httpd_log_t,s0) +/var/log/roundcubemail(/.*)? gen_context(system_u:object_r:httpd_log_t,s0) +/var/log/suphp\.log.* -- gen_context(system_u:object_r:httpd_log_t,s0) ifdef(`distro_debian', ` /var/log/horde2(/.*)? gen_context(system_u:object_r:httpd_log_t,s0) ') +/var/lib/pootle/po(/.*)? gen_context(system_u:object_r:httpd_sys_rw_content_t,s0) +/var/lib/rt3/data/RT-Shredder(/.*)? gen_context(system_u:object_r:httpd_var_lib_t,s0) + /var/run/apache.* gen_context(system_u:object_r:httpd_var_run_t,s0) +/var/run/cherokee\.pid -- gen_context(system_u:object_r:httpd_var_run_t,s0) /var/run/gcache_port -s gen_context(system_u:object_r:httpd_var_run_t,s0) /var/run/httpd.* gen_context(system_u:object_r:httpd_var_run_t,s0) /var/run/lighttpd(/.*)? gen_context(system_u:object_r:httpd_var_run_t,s0) /var/run/mod_.* gen_context(system_u:object_r:httpd_var_run_t,s0) /var/run/wsgi.* -s gen_context(system_u:object_r:httpd_var_run_t,s0) +/var/run/user/apache(/.*)? gen_context(system_u:object_r:httpd_tmp_t,s0) /var/spool/gosa(/.*)? gen_context(system_u:object_r:httpd_sys_rw_content_t,s0) /var/spool/squirrelmail(/.*)? gen_context(system_u:object_r:squirrelmail_spool_t,s0) @@ -109,3 +144,25 @@ ifdef(`distro_debian', ` /var/www/cgi-bin(/.*)? gen_context(system_u:object_r:httpd_sys_script_exec_t,s0) /var/www/icons(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) /var/www/perl(/.*)? gen_context(system_u:object_r:httpd_sys_script_exec_t,s0) + +/var/www/html/[^/]*/cgi-bin(/.*)? gen_context(system_u:object_r:httpd_sys_script_exec_t,s0) + +/var/www/html/[^/]*/sites/default/settings\.php -- gen_context(system_u:object_r:httpd_sys_rw_content_t, s0) +/var/www/html/[^/]*/sites/default/files(/.*)? gen_context(system_u:object_r:httpd_sys_rw_content_t, s0) + +/var/www/html/configuration\.php gen_context(system_u:object_r:httpd_sys_rw_content_t,s0) + +/var/www/html/wp-content(/.*)? gen_context(system_u:object_r:httpd_sys_rw_content_t,s0) + +/var/www/gallery/albums(/.*)? gen_context(system_u:object_r:httpd_sys_rw_content_t,s0) + +/var/www/moodledata(/.*)? gen_context(system_u:object_r:httpd_sys_rw_content_t,s0) + +/var/www/svn(/.*)? gen_context(system_u:object_r:httpd_sys_rw_content_t,s0) +/var/www/svn/hooks(/.*)? gen_context(system_u:object_r:httpd_sys_script_exec_t,s0) +/var/www/svn/conf(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) + +/var/log/dirsrv/admin-serv(/.*)? gen_context(system_u:object_r:httpd_log_t,s0) + +/var/run/dirsrv/admin-serv.* gen_context(system_u:object_r:httpd_var_run_t,s0) +/opt/dirsrv/var/run/dirsrv/dsgw/cookies(/.*)? gen_context(system_u:object_r:httpd_var_run_t,s0) diff --git a/apache.if b/apache.if index 6480167..273a121 100644 --- a/apache.if +++ b/apache.if @@ -13,62 +13,46 @@ # template(`apache_content_template',` gen_require(` - attribute httpdcontent; - attribute httpd_exec_scripts; - attribute httpd_script_exec_type; + attribute httpd_exec_scripts, httpd_script_exec_type; type httpd_t, httpd_suexec_t, httpd_log_t; + type httpd_sys_content_t; + attribute httpd_script_type, httpd_content_type; ') - # allow write access to public file transfer - # services files. - gen_tunable(allow_httpd_$1_script_anon_write, false) #This type is for webpages - type httpd_$1_content_t, httpdcontent; # customizable + type httpd_$1_content_t; # customizable; + typeattribute httpd_$1_content_t httpd_content_type; typealias httpd_$1_content_t alias httpd_$1_script_ro_t; files_type(httpd_$1_content_t) # This type is used for .htaccess files - type httpd_$1_htaccess_t; # customizable; + type httpd_$1_htaccess_t, httpd_content_type; # customizable; + typeattribute httpd_$1_htaccess_t httpd_content_type; files_type(httpd_$1_htaccess_t) # Type that CGI scripts run as - type httpd_$1_script_t; + type httpd_$1_script_t, httpd_script_type; domain_type(httpd_$1_script_t) role system_r types httpd_$1_script_t; # This type is used for executable scripts files type httpd_$1_script_exec_t, httpd_script_exec_type; # customizable; - corecmd_shell_entry_type(httpd_$1_script_t) + typeattribute httpd_$1_script_exec_t httpd_content_type; domain_entry_file(httpd_$1_script_t, httpd_$1_script_exec_t) - type httpd_$1_rw_content_t, httpdcontent; # customizable + type httpd_$1_rw_content_t; # customizable + typeattribute httpd_$1_rw_content_t httpd_content_type; typealias httpd_$1_rw_content_t alias { httpd_$1_script_rw_t httpd_$1_content_rw_t }; files_type(httpd_$1_rw_content_t) - type httpd_$1_ra_content_t, httpdcontent; # customizable + type httpd_$1_ra_content_t, httpd_content_type; # customizable + typeattribute httpd_$1_ra_content_t httpd_content_type; typealias httpd_$1_ra_content_t alias { httpd_$1_script_ra_t httpd_$1_content_ra_t }; files_type(httpd_$1_ra_content_t) - read_files_pattern(httpd_t, httpd_$1_content_t, httpd_$1_htaccess_t) - - domtrans_pattern(httpd_suexec_t, httpd_$1_script_exec_t, httpd_$1_script_t) - - allow httpd_t { httpd_$1_content_t httpd_$1_rw_content_t httpd_$1_script_exec_t }:dir search_dir_perms; - allow httpd_suexec_t { httpd_$1_content_t httpd_$1_content_t httpd_$1_rw_content_t httpd_$1_script_exec_t }:dir search_dir_perms; - - allow httpd_$1_script_t self:fifo_file rw_file_perms; - allow httpd_$1_script_t self:unix_stream_socket connectto; - - allow httpd_$1_script_t httpd_t:fifo_file write; - # apache should set close-on-exec - dontaudit httpd_$1_script_t httpd_t:unix_stream_socket { read write }; - # Allow the script process to search the cgi directory, and users directory allow httpd_$1_script_t httpd_$1_content_t:dir search_dir_perms; - append_files_pattern(httpd_$1_script_t, httpd_log_t, httpd_log_t) - logging_search_logs(httpd_$1_script_t) - can_exec(httpd_$1_script_t, httpd_$1_script_exec_t) allow httpd_$1_script_t httpd_$1_script_exec_t:dir list_dir_perms; @@ -86,40 +70,6 @@ template(`apache_content_template',` manage_lnk_files_pattern(httpd_$1_script_t, httpd_$1_rw_content_t, httpd_$1_rw_content_t) manage_fifo_files_pattern(httpd_$1_script_t, httpd_$1_rw_content_t, httpd_$1_rw_content_t) manage_sock_files_pattern(httpd_$1_script_t, httpd_$1_rw_content_t, httpd_$1_rw_content_t) - files_tmp_filetrans(httpd_$1_script_t, httpd_$1_rw_content_t, { dir file lnk_file sock_file fifo_file }) - - kernel_dontaudit_search_sysctl(httpd_$1_script_t) - kernel_dontaudit_search_kernel_sysctl(httpd_$1_script_t) - - dev_read_rand(httpd_$1_script_t) - dev_read_urand(httpd_$1_script_t) - - corecmd_exec_all_executables(httpd_$1_script_t) - - files_exec_etc_files(httpd_$1_script_t) - files_read_etc_files(httpd_$1_script_t) - files_search_home(httpd_$1_script_t) - - libs_exec_ld_so(httpd_$1_script_t) - libs_exec_lib_files(httpd_$1_script_t) - - miscfiles_read_fonts(httpd_$1_script_t) - miscfiles_read_public_files(httpd_$1_script_t) - - seutil_dontaudit_search_config(httpd_$1_script_t) - - tunable_policy(`httpd_enable_cgi && httpd_unified',` - allow httpd_$1_script_t httpdcontent:file entrypoint; - - manage_dirs_pattern(httpd_$1_script_t, httpdcontent, httpdcontent) - manage_files_pattern(httpd_$1_script_t, httpdcontent, httpdcontent) - manage_lnk_files_pattern(httpd_$1_script_t, httpdcontent, httpdcontent) - can_exec(httpd_$1_script_t, httpdcontent) - ') - - tunable_policy(`allow_httpd_$1_script_anon_write',` - miscfiles_manage_public_files(httpd_$1_script_t) - ') # Allow the web server to run scripts and serve pages tunable_policy(`httpd_builtin_scripting',` @@ -128,68 +78,25 @@ template(`apache_content_template',` manage_lnk_files_pattern(httpd_t, httpd_$1_rw_content_t, httpd_$1_rw_content_t) rw_sock_files_pattern(httpd_t, httpd_$1_rw_content_t, httpd_$1_rw_content_t) - allow httpd_t httpd_$1_ra_content_t:dir { list_dir_perms add_entry_dir_perms }; + allow httpd_t httpd_$1_ra_content_t:dir { add_entry_dir_perms }; read_files_pattern(httpd_t, httpd_$1_ra_content_t, httpd_$1_ra_content_t) append_files_pattern(httpd_t, httpd_$1_ra_content_t, httpd_$1_ra_content_t) read_lnk_files_pattern(httpd_t, httpd_$1_ra_content_t, httpd_$1_ra_content_t) - allow httpd_t httpd_$1_content_t:dir list_dir_perms; - read_files_pattern(httpd_t, httpd_$1_content_t, httpd_$1_content_t) - read_lnk_files_pattern(httpd_t, httpd_$1_content_t, httpd_$1_content_t) - - allow httpd_t httpd_$1_content_t:dir list_dir_perms; - read_files_pattern(httpd_t, httpd_$1_content_t, httpd_$1_content_t) - read_lnk_files_pattern(httpd_t, httpd_$1_content_t, httpd_$1_content_t) ') tunable_policy(`httpd_enable_cgi',` allow httpd_$1_script_t httpd_$1_script_exec_t:file entrypoint; + domtrans_pattern(httpd_suexec_t, httpd_$1_script_exec_t, httpd_$1_script_t) + # privileged users run the script: domtrans_pattern(httpd_exec_scripts, httpd_$1_script_exec_t, httpd_$1_script_t) + allow httpd_exec_scripts httpd_$1_script_exec_t:file read_file_perms; + # apache runs the script: domtrans_pattern(httpd_t, httpd_$1_script_exec_t, httpd_$1_script_t) - - allow httpd_t httpd_$1_script_t:process { signal sigkill sigstop }; - allow httpd_t httpd_$1_script_exec_t:dir list_dir_perms; - - allow httpd_$1_script_t self:process { setsched signal_perms }; - allow httpd_$1_script_t self:unix_stream_socket create_stream_socket_perms; - - allow httpd_$1_script_t httpd_t:fd use; - allow httpd_$1_script_t httpd_t:process sigchld; - - kernel_read_system_state(httpd_$1_script_t) - - dev_read_urand(httpd_$1_script_t) - - fs_getattr_xattr_fs(httpd_$1_script_t) - - files_read_etc_runtime_files(httpd_$1_script_t) - files_read_usr_files(httpd_$1_script_t) - - libs_read_lib_files(httpd_$1_script_t) - - miscfiles_read_localization(httpd_$1_script_t) - ') - - optional_policy(` - tunable_policy(`httpd_enable_cgi && allow_ypbind',` - nis_use_ypbind_uncond(httpd_$1_script_t) - ') - ') - - optional_policy(` - postgresql_unpriv_client(httpd_$1_script_t) - - tunable_policy(`httpd_enable_cgi && httpd_can_network_connect_db',` - postgresql_tcp_connect(httpd_$1_script_t) - ') - ') - - optional_policy(` - nscd_socket_use(httpd_$1_script_t) ') ') @@ -211,9 +118,8 @@ template(`apache_content_template',` interface(`apache_role',` gen_require(` attribute httpdcontent; - type httpd_user_content_t, httpd_user_htaccess_t; - type httpd_user_script_t, httpd_user_script_exec_t; - type httpd_user_ra_content_t, httpd_user_rw_content_t; + type httpd_user_content_t, httpd_user_htaccess_t, httpd_user_script_t; + type httpd_user_ra_content_t, httpd_user_rw_content_t, httpd_user_script_exec_t; ') role $1 types httpd_user_script_t; @@ -234,6 +140,13 @@ interface(`apache_role',` relabel_files_pattern($2, httpd_user_ra_content_t, httpd_user_ra_content_t) relabel_lnk_files_pattern($2, httpd_user_ra_content_t, httpd_user_ra_content_t) + manage_dirs_pattern($2, httpd_user_content_t, httpd_user_content_t) + manage_files_pattern($2, httpd_user_content_t, httpd_user_content_t) + manage_lnk_files_pattern($2, httpd_user_content_t, httpd_user_content_t) + relabel_dirs_pattern($2, httpd_user_content_t, httpd_user_content_t) + relabel_files_pattern($2, httpd_user_content_t, httpd_user_content_t) + relabel_lnk_files_pattern($2, httpd_user_content_t, httpd_user_content_t) + manage_dirs_pattern($2, httpd_user_rw_content_t, httpd_user_rw_content_t) manage_files_pattern($2, httpd_user_rw_content_t, httpd_user_rw_content_t) manage_lnk_files_pattern($2, httpd_user_rw_content_t, httpd_user_rw_content_t) @@ -248,6 +161,9 @@ interface(`apache_role',` relabel_files_pattern($2, httpd_user_script_exec_t, httpd_user_script_exec_t) relabel_lnk_files_pattern($2, httpd_user_script_exec_t, httpd_user_script_exec_t) + apache_exec_modules($2) + apache_filetrans_home_content($2) + tunable_policy(`httpd_enable_cgi',` # If a user starts a script by hand it gets the proper context domtrans_pattern($2, httpd_user_script_exec_t, httpd_user_script_t) @@ -317,6 +233,25 @@ interface(`apache_domtrans',` domtrans_pattern($1, httpd_exec_t, httpd_t) ') +###################################### +## +## Allow the specified domain to execute apache +## in the caller domain. +## +## +## +## Domain allowed access. +## +## +# +interface(`apache_exec',` + gen_require(` + type httpd_exec_t; + ') + + can_exec($1, httpd_exec_t) +') + ####################################### ## ## Send a generic signal to apache. @@ -405,7 +340,7 @@ interface(`apache_dontaudit_rw_fifo_file',` type httpd_t; ') - dontaudit $1 httpd_t:fifo_file rw_fifo_file_perms; + dontaudit $1 httpd_t:fifo_file rw_inherited_fifo_file_perms; ') ######################################## @@ -487,7 +422,7 @@ interface(`apache_setattr_cache_dirs',` type httpd_cache_t; ') - allow $1 httpd_cache_t:dir setattr; + allow $1 httpd_cache_t:dir setattr_dir_perms; ') ######################################## @@ -531,6 +466,25 @@ interface(`apache_rw_cache_files',` ######################################## ## ## Allow the specified domain to delete +## Apache cache dirs. +## +## +## +## Domain allowed access. +## +## +# +interface(`apache_delete_cache_dirs',` + gen_require(` + type httpd_cache_t; + ') + + delete_dirs_pattern($1, httpd_cache_t, httpd_cache_t) +') + +######################################## +## +## Allow the specified domain to delete ## Apache cache. ## ## @@ -549,6 +503,26 @@ interface(`apache_delete_cache_files',` ######################################## ## +## Allow the specified domain to search +## apache configuration dirs. +## +## +## +## Domain allowed access. +## +## +# +interface(`apache_search_config',` + gen_require(` + type httpd_config_t; + ') + + files_search_etc($1) + allow $1 httpd_config_t:dir search_dir_perms; +') + +######################################## +## ## Allow the specified domain to read ## apache configuration files. ## @@ -699,7 +673,7 @@ interface(`apache_dontaudit_append_log',` type httpd_log_t; ') - dontaudit $1 httpd_log_t:file { getattr append }; + dontaudit $1 httpd_log_t:file append_file_perms; ') ######################################## @@ -745,6 +719,25 @@ interface(`apache_dontaudit_search_modules',` ######################################## ## +## Allow the specified domain to read +## the apache module directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`apache_read_modules',` + gen_require(` + type httpd_modules_t; + ') + + read_files_pattern($1, httpd_modules_t, httpd_modules_t) +') + +######################################## +## ## Allow the specified domain to list ## the contents of the apache modules ## directory. @@ -761,6 +754,7 @@ interface(`apache_list_modules',` ') allow $1 httpd_modules_t:dir list_dir_perms; + read_lnk_files_pattern($1, httpd_modules_t, httpd_modules_t) ') ######################################## @@ -802,6 +796,43 @@ interface(`apache_domtrans_rotatelogs',` domtrans_pattern($1, httpd_rotatelogs_exec_t, httpd_rotatelogs_t) ') +####################################### +## +## Execute httpd_rotatelogs in the caller domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`apache_exec_rotatelogs',` + gen_require(` + type httpd_rotatelogs_exec_t; + ') + + can_exec($1, httpd_rotatelogs_exec_t) +') + +####################################### +## +## Execute httpd system scripts in the caller domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`apache_exec_sys_script',` + gen_require(` + type httpd_sys_script_exec_t; + ') + + allow $1 httpd_sys_script_exec_t:dir search_dir_perms; + can_exec($1, httpd_sys_script_exec_t) +') + ######################################## ## ## Allow the specified domain to list @@ -819,6 +850,7 @@ interface(`apache_list_sys_content',` ') list_dirs_pattern($1, httpd_sys_content_t, httpd_sys_content_t) + read_lnk_files_pattern($1, httpd_sys_content_t, httpd_sys_content_t) files_search_var($1) ') @@ -846,6 +878,74 @@ interface(`apache_manage_sys_content',` manage_lnk_files_pattern($1, httpd_sys_content_t, httpd_sys_content_t) ') +###################################### +## +## Allow the specified domain to read +## apache system content rw files. +## +## +## +## Domain allowed access. +## +## +## +# +interface(`apache_read_sys_content_rw_files',` + gen_require(` + type httpd_sys_rw_content_t; + ') + + read_files_pattern($1, httpd_sys_rw_content_t, httpd_sys_rw_content_t) +') + +###################################### +## +## Allow the specified domain to manage +## apache system content rw files. +## +## +## +## Domain allowed access. +## +## +## +# +interface(`apache_manage_sys_content_rw',` + gen_require(` + type httpd_sys_rw_content_t; + ') + + files_search_var($1) + manage_dirs_pattern($1, httpd_sys_rw_content_t, httpd_sys_rw_content_t) + manage_files_pattern($1, httpd_sys_rw_content_t, httpd_sys_rw_content_t) + manage_lnk_files_pattern($1, httpd_sys_rw_content_t, httpd_sys_rw_content_t) +') + +######################################## +## +## Allow the specified domain to delete +## apache system content rw files. +## +## +## +## Domain allowed access. +## +## +## +# +interface(`apache_delete_sys_content_rw',` + gen_require(` + type httpd_sys_rw_content_t; + ') + + files_search_tmp($1) + delete_dirs_pattern($1, httpd_sys_rw_content_t, httpd_sys_rw_content_t) + delete_files_pattern($1, httpd_sys_rw_content_t, httpd_sys_rw_content_t) + delete_lnk_files_pattern($1, httpd_sys_rw_content_t, httpd_sys_rw_content_t) + delete_fifo_files_pattern($1, httpd_sys_rw_content_t, httpd_sys_rw_content_t) + delete_sock_files_pattern($1, httpd_sys_rw_content_t, httpd_sys_rw_content_t) +') + ######################################## ## ## Execute all web scripts in the system @@ -862,7 +962,12 @@ interface(`apache_manage_sys_content',` interface(`apache_domtrans_sys_script',` gen_require(` attribute httpdcontent; - type httpd_sys_script_t; + type httpd_sys_script_exec_t; + type httpd_sys_script_t, httpd_sys_content_t; + ') + + tunable_policy(`httpd_enable_cgi',` + domtrans_pattern($1, httpd_sys_script_exec_t, httpd_sys_script_t) ') tunable_policy(`httpd_enable_cgi && httpd_unified',` @@ -921,9 +1026,10 @@ interface(`apache_domtrans_all_scripts',` ## ## ## -## Role allowed access.. +## Role allowed access. ## ## +## # interface(`apache_run_all_scripts',` gen_require(` @@ -950,7 +1056,7 @@ interface(`apache_read_squirrelmail_data',` type httpd_squirrelmail_t; ') - allow $1 httpd_squirrelmail_t:file read_file_perms; + read_files_pattern($1, httpd_squirrelmail_t, httpd_squirrelmail_t) ') ######################################## @@ -1091,6 +1197,25 @@ interface(`apache_read_tmp_files',` read_files_pattern($1, httpd_tmp_t, httpd_tmp_t) ') +###################################### +## +## Dontaudit attempts to read and write +## apache tmp files. +## +## +## +## Domain to not audit. +## +## +# +interface(`apache_dontaudit_rw_tmp_files',` + gen_require(` + type httpd_tmp_t; + ') + + dontaudit $1 httpd_tmp_t:file { read write }; +') + ######################################## ## ## Dontaudit attempts to write @@ -1107,7 +1232,7 @@ interface(`apache_dontaudit_write_tmp_files',` type httpd_tmp_t; ') - dontaudit $1 httpd_tmp_t:file write_file_perms; + dontaudit $1 httpd_tmp_t:file write; ') ######################################## @@ -1148,14 +1273,31 @@ interface(`apache_cgi_domain',` ######################################## ## -## All of the rules required to administrate an apache environment +## Execute httpd server in the httpd domain. ## -## +## ## -## Prefix of the domain. Example, user would be -## the prefix for the uder_t domain. +## Domain allowed to transition. ## ## +# +interface(`httpd_systemctl',` + gen_require(` + type httpd_t; + type httpd_unit_file_t; + ') + + systemd_exec_systemctl($1) + allow $1 httpd_unit_file_t:file read_file_perms; + allow $1 httpd_unit_file_t:service manage_service_perms; + + ps_process_pattern($1, httpd_t) +') + +######################################## +## +## All of the rules required to administrate an apache environment +## ## ## ## Domain allowed access. @@ -1170,19 +1312,21 @@ interface(`apache_cgi_domain',` # interface(`apache_admin',` gen_require(` - attribute httpdcontent; - attribute httpd_script_exec_type; - + attribute httpdcontent, httpd_script_exec_type; type httpd_t, httpd_config_t, httpd_log_t; - type httpd_modules_t, httpd_lock_t; - type httpd_var_run_t, httpd_php_tmp_t; + type httpd_modules_t, httpd_lock_t, httpd_bool_t; + type httpd_var_run_t, httpd_php_tmp_t, httpd_initrc_exec_t; type httpd_suexec_tmp_t, httpd_tmp_t; - type httpd_initrc_exec_t; + type httpd_unit_file_t; ') - allow $1 httpd_t:process { getattr ptrace signal_perms }; + allow $1 httpd_t:process signal_perms; ps_process_pattern($1, httpd_t) + tunable_policy(`deny_ptrace',`',` + allow $1 httpd_t:process ptrace; + ') + init_labeled_script_domtrans($1, httpd_initrc_exec_t) domain_system_change_exemption($1) role_transition $2 httpd_initrc_exec_t system_r; @@ -1191,10 +1335,10 @@ interface(`apache_admin',` apache_manage_all_content($1) miscfiles_manage_public_files($1) - files_search_etc($1) + files_list_etc($1) admin_pattern($1, httpd_config_t) - logging_search_logs($1) + logging_list_logs($1) admin_pattern($1, httpd_log_t) admin_pattern($1, httpd_modules_t) @@ -1205,14 +1349,106 @@ interface(`apache_admin',` admin_pattern($1, httpd_var_run_t) files_pid_filetrans($1, httpd_var_run_t, file) - kernel_search_proc($1) - allow $1 httpd_t:dir list_dir_perms; - - read_lnk_files_pattern($1, httpd_t, httpd_t) - admin_pattern($1, httpdcontent) admin_pattern($1, httpd_script_exec_type) + + seutil_domtrans_setfiles($1) + + files_list_tmp($1) admin_pattern($1, httpd_tmp_t) admin_pattern($1, httpd_php_tmp_t) admin_pattern($1, httpd_suexec_tmp_t) + + httpd_systemctl($1) + admin_pattern($1, httpd_unit_file_t) + allow $1 httpd_unit_file_t:service all_service_perms; + + apache_filetrans_named_content($1) +') + +######################################## +## +## dontaudit read and write an leaked file descriptors +## +## +## +## Domain to not audit. +## +## +# +interface(`apache_dontaudit_leaks',` + gen_require(` + type httpd_t; + type httpd_tmp_t; + ') + + dontaudit $1 httpd_t:fifo_file rw_inherited_fifo_file_perms; + dontaudit $1 httpd_t:tcp_socket { read write }; + dontaudit $1 httpd_t:unix_dgram_socket { read write }; + dontaudit $1 httpd_t:unix_stream_socket { read write }; + dontaudit $1 httpd_tmp_t:file { read write }; +') + +######################################## +## +## Transition to apache named content +## +## +## +## Domain allowed access. +## +## +# +interface(`apache_filetrans_named_content',` + gen_require(` + type httpd_sys_content_t, httpd_sys_rw_content_t; + type httpd_tmp_t; + ') + + + apache_filetrans_home_content($1) + filetrans_pattern($1, httpd_sys_content_t, httpd_sys_rw_content_t, file, "settings.php") + userdom_user_tmp_filetrans($1, httpd_tmp_t, dir, "apache") +') + +######################################## +## +## Allow any httpd_exec_t to be an entrypoint of this domain +## +## +## +## Domain allowed access. +## +## +## +# +interface(`apache_entrypoint',` + gen_require(` + type httpd_exec_t; + ') + allow $1 httpd_exec_t:file entrypoint; +') + +######################################## +## +## Transition to apache home content +## +## +## +## Domain allowed access. +## +## +# +interface(`apache_filetrans_home_content',` + gen_require(` + type httpd_user_content_t, httpd_user_script_exec_t, httpd_user_htaccess_t; + type httpd_user_content_ra_t; + ') + + userdom_user_home_dir_filetrans($1, httpd_user_content_t, dir, "public_html") + userdom_user_home_dir_filetrans($1, httpd_user_content_t, dir, "www") + userdom_user_home_dir_filetrans($1, httpd_user_content_t, dir, "web") + filetrans_pattern($1, httpd_user_content_t, httpd_user_script_exec_t, dir, "cgi-bin") + filetrans_pattern($1, httpd_user_content_t, httpd_user_content_ra_t, dir, "logs") + filetrans_pattern($1, { httpd_user_content_t httpd_user_script_exec_t }, httpd_user_htaccess_t, file, ".htaccess") ') diff --git a/apache.te b/apache.te index 0833afb..25027cb 100644 --- a/apache.te +++ b/apache.te @@ -18,6 +18,8 @@ policy_module(apache, 2.4.0) # Declarations # +selinux_genbool(httpd_bool_t) + ## ##

## Allow Apache to modify public files @@ -25,14 +27,35 @@ policy_module(apache, 2.4.0) ## be labeled public_content_rw_t. ##

## -gen_tunable(allow_httpd_anon_write, false) +gen_tunable(httpd_anon_write, false) ## ##

## Allow Apache to use mod_auth_pam ##

## -gen_tunable(allow_httpd_mod_auth_pam, false) +gen_tunable(httpd_mod_auth_pam, false) + +## +##

+## Allow Apache to use mod_auth_ntlm_winbind +##

+## +gen_tunable(httpd_mod_auth_ntlm_winbind, false) + +## +##

+## Allow httpd scripts and modules execmem/execstack +##

+## +gen_tunable(httpd_execmem, false) + +## +##

+## Allow httpd processes to manage IPA content +##

+## +gen_tunable(httpd_manage_ipa, false) ## ##

@@ -50,6 +73,20 @@ gen_tunable(httpd_can_network_connect, false) ## ##

+## Allow HTTPD scripts and modules to connect to cobbler over the network. +##

+## +gen_tunable(httpd_can_network_connect_cobbler, false) + +## +##

+## Allow HTTPD to connect to port 80 for graceful shutdown +##

+## +gen_tunable(httpd_graceful_shutdown, false) + +## +##

## Allow HTTPD scripts and modules to connect to databases over the network. ##

## @@ -57,12 +94,33 @@ gen_tunable(httpd_can_network_connect_db, false) ## ##

+## Allow httpd to connect to memcache server +##

+## +gen_tunable(httpd_can_network_memcache, false) + +## +##

## Allow httpd to act as a relay ##

## gen_tunable(httpd_can_network_relay, false) ## +##

+## Allow http daemon to connect to zabbix +##

+## +gen_tunable(httpd_can_connect_zabbix, false) + +## +##

+## Allow http daemon to check spam +##

+## +gen_tunable(httpd_can_check_spam, false) + +## ##

## Allow http daemon to send mail ##

@@ -93,6 +151,21 @@ gen_tunable(httpd_enable_ftp_server, false) ## ##

+## Allow httpd to act as a FTP client +## connecting to the ftp port and ephemeral ports +##

+## +gen_tunable(httpd_can_connect_ftp, false) + +## +##

+## Allow httpd to connect to the ldap port +##

+## +gen_tunable(httpd_can_connect_ldap, false) + +## +##

## Allow httpd to read home directories ##

## @@ -100,6 +173,20 @@ gen_tunable(httpd_enable_homedirs, false) ## ##

+## Allow httpd to read user content +##

+## +gen_tunable(httpd_read_user_content, false) + +## +##

+## Allow Apache to run in stickshift mode, not transition to passenger +##

+## +gen_tunable(httpd_run_stickshift, false) + +## +##

## Allow httpd daemon to change its resource limits ##

## @@ -114,6 +201,13 @@ gen_tunable(httpd_ssi_exec, false) ## ##

+## Allow Apache to execute tmp content. +##

+## +gen_tunable(httpd_tmp_exec, false) + +## +##

## Unify HTTPD to communicate with the terminal. ## Needed for entering the passphrase for certificates at ## the terminal. @@ -130,12 +224,26 @@ gen_tunable(httpd_unified, false) ## ##

+## Allow httpd to access openstack ports +##

+## +gen_tunable(httpd_use_openstack, false) + +## +##

## Allow httpd to access cifs file systems ##

## gen_tunable(httpd_use_cifs, false) ## +##

+## Allow httpd to access FUSE file systems +##

+## +gen_tunable(httpd_use_fusefs, false) + +## ##

## Allow httpd to run gpg ##

@@ -149,12 +257,28 @@ gen_tunable(httpd_use_gpg, false) ## gen_tunable(httpd_use_nfs, false) +## +##

+## Allow apache scripts to write to public content, directories/files must be labeled public_rw_content_t. +##

+## +gen_tunable(httpd_sys_script_anon_write, false) + +## +##

+## Allow httpd to communicate with oddjob to start up a service +##

+## +gen_tunable(httpd_use_oddjob, false) + attribute httpdcontent; attribute httpd_user_content_type; +attribute httpd_content_type; # domains that can exec all users scripts attribute httpd_exec_scripts; +attribute httpd_script_type; attribute httpd_script_exec_type; attribute httpd_user_script_exec_type; @@ -173,7 +297,7 @@ files_type(httpd_cache_t) # httpd_config_t is the type given to the configuration files type httpd_config_t; -files_type(httpd_config_t) +files_config_file(httpd_config_t) type httpd_helper_t; type httpd_helper_exec_t; @@ -184,6 +308,9 @@ role system_r types httpd_helper_t; type httpd_initrc_exec_t; init_script_file(httpd_initrc_exec_t) +type httpd_unit_file_t; +systemd_unit_file(httpd_unit_file_t) + type httpd_lock_t; files_lock_file(httpd_lock_t) @@ -223,7 +350,21 @@ files_tmp_file(httpd_suexec_tmp_t) # setup the system domain for system CGI scripts apache_content_template(sys) -typealias httpd_sys_content_t alias ntop_http_content_t; + +optional_policy(` + postgresql_unpriv_client(httpd_sys_script_t) +') + +typeattribute httpd_sys_content_t httpdcontent; # customizable +typeattribute httpd_sys_rw_content_t httpdcontent; # customizable +typeattribute httpd_sys_ra_content_t httpdcontent; # customizable + +# Removal of fastcgi, will cause problems without the following +typealias httpd_sys_script_exec_t alias httpd_fastcgi_script_exec_t; +typealias httpd_sys_content_t alias { httpd_fastcgi_content_t httpd_fastcgi_script_ro_t }; +typealias httpd_sys_rw_content_t alias { httpd_fastcgi_rw_content_t httpd_fastcgi_script_rw_t }; +typealias httpd_sys_ra_content_t alias httpd_fastcgi_script_ra_t; +typealias httpd_sys_script_t alias httpd_fastcgi_script_t; type httpd_tmp_t; files_tmp_file(httpd_tmp_t) @@ -233,6 +374,11 @@ files_tmpfs_file(httpd_tmpfs_t) apache_content_template(user) ubac_constrained(httpd_user_script_t) + +typeattribute httpd_user_content_t httpdcontent; +typeattribute httpd_user_rw_content_t httpdcontent; +typeattribute httpd_user_ra_content_t httpdcontent; + userdom_user_home_content(httpd_user_content_t) userdom_user_home_content(httpd_user_htaccess_t) userdom_user_home_content(httpd_user_script_exec_t) @@ -240,6 +386,7 @@ userdom_user_home_content(httpd_user_ra_content_t) userdom_user_home_content(httpd_user_rw_content_t) typeattribute httpd_user_script_t httpd_script_domains; typealias httpd_user_content_t alias { httpd_staff_content_t httpd_sysadm_content_t }; +typealias httpd_user_content_t alias httpd_unconfined_content_t; typealias httpd_user_content_t alias { httpd_auditadm_content_t httpd_secadm_content_t }; typealias httpd_user_content_t alias { httpd_staff_script_ro_t httpd_sysadm_script_ro_t }; typealias httpd_user_content_t alias { httpd_auditadm_script_ro_t httpd_secadm_script_ro_t }; @@ -261,14 +408,23 @@ files_type(httpd_var_lib_t) type httpd_var_run_t; files_pid_file(httpd_var_run_t) +# Removal of fastcgi, will cause problems without the following +typealias httpd_var_run_t alias httpd_fastcgi_var_run_t; + # File Type of squirrelmail attachments type squirrelmail_spool_t; files_tmp_file(squirrelmail_spool_t) +files_spool_file(squirrelmail_spool_t) optional_policy(` prelink_object_file(httpd_modules_t) ') +type httpd_passwd_t; +type httpd_passwd_exec_t; +application_domain(httpd_passwd_t, httpd_passwd_exec_t) +role system_r types httpd_passwd_t; + ######################################## # # Apache server local policy @@ -288,11 +444,13 @@ allow httpd_t self:unix_dgram_socket { create_socket_perms sendto }; allow httpd_t self:unix_stream_socket { create_stream_socket_perms connectto }; allow httpd_t self:tcp_socket create_stream_socket_perms; allow httpd_t self:udp_socket create_socket_perms; +dontaudit httpd_t self:netlink_audit_socket create_socket_perms; # Allow httpd_t to put files in /var/cache/httpd etc manage_dirs_pattern(httpd_t, httpd_cache_t, httpd_cache_t) manage_files_pattern(httpd_t, httpd_cache_t, httpd_cache_t) manage_lnk_files_pattern(httpd_t, httpd_cache_t, httpd_cache_t) +files_var_filetrans(httpd_t, httpd_cache_t, { file dir }) # Allow the httpd_t to read the web servers config files allow httpd_t httpd_config_t:dir list_dir_perms; @@ -336,8 +494,10 @@ allow httpd_t httpd_sys_script_t:unix_stream_socket connectto; manage_dirs_pattern(httpd_t, httpd_tmp_t, httpd_tmp_t) manage_files_pattern(httpd_t, httpd_tmp_t, httpd_tmp_t) +manage_sock_files_pattern(httpd_t, httpd_tmp_t, httpd_tmp_t) manage_lnk_files_pattern(httpd_t, httpd_tmp_t, httpd_tmp_t) -files_tmp_filetrans(httpd_t, httpd_tmp_t, { file dir lnk_file }) +files_tmp_filetrans(httpd_t, httpd_tmp_t, { file dir lnk_file sock_file }) +userdom_user_tmp_filetrans(httpd_t, httpd_tmp_t, dir) manage_dirs_pattern(httpd_t, httpd_tmpfs_t, httpd_tmpfs_t) manage_files_pattern(httpd_t, httpd_tmpfs_t, httpd_tmpfs_t) @@ -346,8 +506,9 @@ manage_fifo_files_pattern(httpd_t, httpd_tmpfs_t, httpd_tmpfs_t) manage_sock_files_pattern(httpd_t, httpd_tmpfs_t, httpd_tmpfs_t) fs_tmpfs_filetrans(httpd_t, httpd_tmpfs_t, { dir file lnk_file sock_file fifo_file }) +manage_dirs_pattern(httpd_t, httpd_var_lib_t, httpd_var_lib_t) manage_files_pattern(httpd_t, httpd_var_lib_t, httpd_var_lib_t) -files_var_lib_filetrans(httpd_t, httpd_var_lib_t, file) +files_var_lib_filetrans(httpd_t, httpd_var_lib_t, { dir file }) setattr_dirs_pattern(httpd_t, httpd_var_run_t, httpd_var_run_t) manage_dirs_pattern(httpd_t, httpd_var_run_t, httpd_var_run_t) @@ -362,8 +523,10 @@ manage_lnk_files_pattern(httpd_t, squirrelmail_spool_t, squirrelmail_spool_t) kernel_read_kernel_sysctls(httpd_t) # for modules that want to access /proc/meminfo kernel_read_system_state(httpd_t) +kernel_read_network_state(httpd_t) +kernel_read_network_state(httpd_t) +kernel_search_network_sysctl(httpd_t) -corenet_all_recvfrom_unlabeled(httpd_t) corenet_all_recvfrom_netlabel(httpd_t) corenet_tcp_sendrecv_generic_if(httpd_t) corenet_udp_sendrecv_generic_if(httpd_t) @@ -372,11 +535,19 @@ corenet_udp_sendrecv_generic_node(httpd_t) corenet_tcp_sendrecv_all_ports(httpd_t) corenet_udp_sendrecv_all_ports(httpd_t) corenet_tcp_bind_generic_node(httpd_t) +corenet_udp_bind_generic_node(httpd_t) corenet_tcp_bind_http_port(httpd_t) +corenet_udp_bind_http_port(httpd_t) corenet_tcp_bind_http_cache_port(httpd_t) +corenet_tcp_bind_ntop_port(httpd_t) +corenet_tcp_bind_jboss_management_port(httpd_t) +corenet_tcp_bind_jboss_messaging_port(httpd_t) corenet_sendrecv_http_server_packets(httpd_t) +corenet_tcp_bind_puppet_port(httpd_t) # Signal self for shutdown -corenet_tcp_connect_http_port(httpd_t) +tunable_policy(`httpd_graceful_shutdown',` + corenet_tcp_connect_http_port(httpd_t) +') dev_read_sysfs(httpd_t) dev_read_rand(httpd_t) @@ -385,9 +556,14 @@ dev_rw_crypto(httpd_t) fs_getattr_all_fs(httpd_t) fs_search_auto_mountpoints(httpd_t) +fs_read_iso9660_files(httpd_t) +fs_read_anon_inodefs_files(httpd_t) +fs_read_hugetlbfs_files(httpd_t) auth_use_nsswitch(httpd_t) +application_exec_all(httpd_t) + # execute perl corecmd_exec_bin(httpd_t) corecmd_exec_shell(httpd_t) @@ -396,61 +572,114 @@ domain_use_interactive_fds(httpd_t) files_dontaudit_getattr_all_pids(httpd_t) files_read_usr_files(httpd_t) +files_exec_usr_files(httpd_t) files_list_mnt(httpd_t) files_search_spool(httpd_t) +files_read_var_symlinks(httpd_t) files_read_var_lib_files(httpd_t) files_search_home(httpd_t) files_getattr_home_dir(httpd_t) # for modules that want to access /etc/mtab files_read_etc_runtime_files(httpd_t) # Allow httpd_t to have access to files such as nisswitch.conf -files_read_etc_files(httpd_t) # for tomcat files_read_var_lib_symlinks(httpd_t) fs_search_auto_mountpoints(httpd_sys_script_t) +# php uploads a file to /tmp and then execs programs to acton them +manage_dirs_pattern(httpd_sys_script_t, httpd_tmp_t, httpd_tmp_t) +manage_files_pattern(httpd_sys_script_t, httpd_tmp_t, httpd_tmp_t) +manage_sock_files_pattern(httpd_sys_script_t, httpd_tmp_t, httpd_tmp_t) +manage_fifo_files_pattern(httpd_sys_script_t, httpd_tmp_t, httpd_tmp_t) +manage_lnk_files_pattern(httpd_sys_script_t, httpd_tmp_t, httpd_tmp_t) +files_tmp_filetrans(httpd_sys_script_t, httpd_sys_rw_content_t, { dir file lnk_file sock_file fifo_file }) libs_read_lib_files(httpd_t) +ifdef(`hide_broken_symptoms',` + libs_exec_lib_files(httpd_t) +') + logging_send_syslog_msg(httpd_t) -miscfiles_read_localization(httpd_t) miscfiles_read_fonts(httpd_t) miscfiles_read_public_files(httpd_t) miscfiles_read_generic_certs(httpd_t) +miscfiles_read_tetex_data(httpd_t) seutil_dontaudit_search_config(httpd_t) userdom_use_unpriv_users_fds(httpd_t) -tunable_policy(`allow_httpd_anon_write',` +tunable_policy(`httpd_setrlimit',` + allow httpd_t self:process setrlimit; + allow httpd_t self:capability sys_resource; +') + +tunable_policy(`httpd_anon_write',` miscfiles_manage_public_files(httpd_t) ') -ifdef(`TODO', ` # # We need optionals to be able to be within booleans to make this work # -tunable_policy(`allow_httpd_mod_auth_pam',` - auth_domtrans_chk_passwd(httpd_t) +tunable_policy(`httpd_mod_auth_pam',` + auth_domtrans_chkpwd(httpd_t) + logging_send_audit_msgs(httpd_t) ') + +optional_policy(` + tunable_policy(`httpd_mod_auth_ntlm_winbind',` + samba_domtrans_winbind_helper(httpd_t) + ') ') tunable_policy(`httpd_can_network_connect',` corenet_tcp_connect_all_ports(httpd_t) ') +tunable_policy(`httpd_can_network_connect_db',` + corenet_tcp_connect_firebird_port(httpd_t) + corenet_tcp_connect_mssql_port(httpd_t) + corenet_sendrecv_mssql_client_packets(httpd_t) + corenet_tcp_connect_oracle_port(httpd_t) + corenet_sendrecv_oracle_client_packets(httpd_t) +') + +tunable_policy(`httpd_can_network_memcache',` + corenet_tcp_connect_memcache_port(httpd_t) +') + tunable_policy(`httpd_can_network_relay',` # allow httpd to work as a relay corenet_tcp_connect_gopher_port(httpd_t) corenet_tcp_connect_ftp_port(httpd_t) corenet_tcp_connect_http_port(httpd_t) corenet_tcp_connect_http_cache_port(httpd_t) + corenet_tcp_connect_squid_port(httpd_t) corenet_tcp_connect_memcache_port(httpd_t) corenet_sendrecv_gopher_client_packets(httpd_t) corenet_sendrecv_ftp_client_packets(httpd_t) corenet_sendrecv_http_client_packets(httpd_t) corenet_sendrecv_http_cache_client_packets(httpd_t) + corenet_sendrecv_squid_client_packets(httpd_t) + corenet_tcp_connect_all_ephemeral_ports(httpd_t) +') + +tunable_policy(`httpd_execmem',` + allow httpd_t self:process { execmem execstack }; + allow httpd_sys_script_t self:process { execmem execstack }; + allow httpd_suexec_t self:process { execmem execstack }; +') + +tunable_policy(`httpd_enable_cgi && httpd_unified',` + allow httpd_sys_script_t httpd_sys_content_t:file entrypoint; + filetrans_pattern(httpd_sys_script_t, httpd_sys_content_t, httpd_sys_rw_content_t, { file dir lnk_file }) + can_exec(httpd_sys_script_t, httpd_sys_content_t) +') + +tunable_policy(`httpd_sys_script_anon_write',` + miscfiles_manage_public_files(httpd_sys_script_t) ') tunable_policy(`httpd_enable_cgi && httpd_use_nfs',` @@ -461,27 +690,61 @@ tunable_policy(`httpd_enable_cgi && httpd_use_cifs',` fs_cifs_domtrans(httpd_t, httpd_sys_script_t) ') +tunable_policy(`httpd_enable_cgi && httpd_use_fusefs',` + fs_fusefs_domtrans(httpd_t, httpd_sys_script_t) +') + tunable_policy(`httpd_enable_cgi && httpd_unified && httpd_builtin_scripting',` domtrans_pattern(httpd_t, httpdcontent, httpd_sys_script_t) + filetrans_pattern(httpd_t, httpd_sys_content_t, httpd_sys_rw_content_t, { file dir lnk_file }) + manage_dirs_pattern(httpd_t, httpdcontent, httpd_sys_rw_content_t) + manage_files_pattern(httpd_t, httpdcontent, httpd_sys_rw_content_t) + manage_lnk_files_pattern(httpd_t, httpdcontent, httpd_sys_rw_content_t) manage_dirs_pattern(httpd_t, httpdcontent, httpdcontent) manage_files_pattern(httpd_t, httpdcontent, httpdcontent) manage_lnk_files_pattern(httpd_t, httpdcontent, httpdcontent) ') +tunable_policy(`httpd_can_connect_ftp',` + corenet_tcp_connect_ftp_port(httpd_t) + corenet_tcp_connect_all_ephemeral_ports(httpd_t) +') + +tunable_policy(`httpd_can_connect_ldap',` + corenet_tcp_connect_ldap_port(httpd_t) +') + +tunable_policy(`httpd_can_connect_zabbix',` + corenet_tcp_connect_zabbix_port(httpd_t) +') + tunable_policy(`httpd_enable_ftp_server',` corenet_tcp_bind_ftp_port(httpd_t) + corenet_tcp_bind_all_ephemeral_ports(httpd_t) ') -tunable_policy(`httpd_enable_homedirs',` - userdom_read_user_home_content_files(httpd_t) +tunable_policy(`httpd_tmp_exec && httpd_builtin_scripting',` + can_exec(httpd_t, httpd_tmp_t) +') + +tunable_policy(`httpd_tmp_exec && httpd_enable_cgi',` + can_exec(httpd_sys_script_t, httpd_tmp_t) ') tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',` + fs_list_auto_mountpoints(httpd_t) fs_read_nfs_files(httpd_t) fs_read_nfs_symlinks(httpd_t) ') +tunable_policy(`httpd_use_nfs',` + fs_list_auto_mountpoints(httpd_t) + fs_manage_nfs_dirs(httpd_t) + fs_manage_nfs_files(httpd_t) + fs_manage_nfs_symlinks(httpd_t) +') + tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',` fs_read_cifs_files(httpd_t) fs_read_cifs_symlinks(httpd_t) @@ -491,7 +754,22 @@ tunable_policy(`httpd_can_sendmail',` # allow httpd to connect to mail servers corenet_tcp_connect_smtp_port(httpd_t) corenet_sendrecv_smtp_client_packets(httpd_t) + corenet_tcp_connect_pop_port(httpd_t) + corenet_sendrecv_pop_client_packets(httpd_t) mta_send_mail(httpd_t) + mta_signal_system_mail(httpd_t) +') + +tunable_policy(`httpd_use_cifs',` + fs_manage_cifs_dirs(httpd_t) + fs_manage_cifs_files(httpd_t) + fs_manage_cifs_symlinks(httpd_t) +') + +tunable_policy(`httpd_use_fusefs',` + fs_manage_fusefs_dirs(httpd_t) + fs_manage_fusefs_files(httpd_t) + fs_manage_fusefs_symlinks(httpd_t) ') tunable_policy(`httpd_setrlimit',` @@ -511,9 +789,19 @@ tunable_policy(`httpd_ssi_exec',` # to run correctly without this permission, so the permission # are dontaudited here. tunable_policy(`httpd_tty_comm',` - userdom_use_user_terminals(httpd_t) + userdom_use_inherited_user_terminals(httpd_t) + userdom_use_inherited_user_terminals(httpd_suexec_t) ',` userdom_dontaudit_use_user_terminals(httpd_t) + userdom_dontaudit_use_user_terminals(httpd_suexec_t) +') + +optional_policy(` + # Support for ABRT retrace server + # mod_wsgi + abrt_manage_spool_retrace(httpd_t) + abrt_domtrans_retrace_worker(httpd_t) + abrt_read_config(httpd_t) ') optional_policy(` @@ -525,6 +813,9 @@ optional_policy(` ') optional_policy(` + cobbler_list_config(httpd_t) + cobbler_read_config(httpd_t) + cobbler_read_lib_files(httpd_t) cobbler_search_lib(httpd_t) ') @@ -540,6 +831,24 @@ optional_policy(` daemontools_service_domain(httpd_t, httpd_exec_t) ') +optional_policy(` + # needed by FreeIPA + dirsrv_stream_connect(httpd_t) + ldap_stream_connect(httpd_t) +') + +optional_policy(` + dirsrv_manage_config(httpd_t) + dirsrv_manage_log(httpd_t) + dirsrv_manage_var_run(httpd_t) + dirsrv_read_share(httpd_t) + dirsrv_signal(httpd_t) + dirsrv_signull(httpd_t) + dirsrvadmin_manage_config(httpd_t) + dirsrvadmin_manage_tmp(httpd_t) + dirsrvadmin_domtrans_unconfined_script_t(httpd_t) +') + optional_policy(` dbus_system_bus_client(httpd_t) @@ -549,13 +858,24 @@ optional_policy(` ') optional_policy(` + git_read_generic_system_content_files(httpd_t) + gitosis_read_lib_files(httpd_t) +') + +optional_policy(` tunable_policy(`httpd_enable_cgi && httpd_use_gpg',` - gpg_domtrans(httpd_t) + gpg_domtrans_web(httpd_t) ') ') optional_policy(` + jetty_admin(httpd_t) +') + +optional_policy(` kerberos_keytab_template(httpd, httpd_t) + kerberos_tmp_filetrans_host_rcache(httpd_t, "HTTP_23") + kerberos_tmp_filetrans_host_rcache(httpd_t, "HTTP_48") ') optional_policy(` @@ -573,7 +893,21 @@ optional_policy(` ') optional_policy(` + mediawiki_read_tmp_files(httpd_t) + mediawiki_delete_tmp_files(httpd_t) +') + +optional_policy(` + memcached_stream_connect(httpd_t) + + tunable_policy(`httpd_manage_ipa',` + memcached_manage_pid_files(httpd_t) + ') +') + +optional_policy(` # Allow httpd to work with mysql + mysql_read_config(httpd_t) mysql_stream_connect(httpd_t) mysql_rw_db_sockets(httpd_t) @@ -584,6 +918,7 @@ optional_policy(` optional_policy(` nagios_read_config(httpd_t) + nagios_read_log(httpd_t) ') optional_policy(` @@ -594,6 +929,37 @@ optional_policy(` ') optional_policy(` + pwauth_domtrans(httpd_t) +') + +optional_policy(` + tunable_policy(`httpd_run_stickshift', ` + allow httpd_t self:capability { fowner fsetid sys_resource }; + allow httpd_t self:process setexec; + passenger_exec(httpd_t) + passenger_manage_pid_content(httpd_t) + passenger_manage_lib_files(httpd_t) + files_dontaudit_getattr_all_files(httpd_t) + domain_dontaudit_read_all_domains_state(httpd_t) + domain_getpgid_all_domains(httpd_t) + ',` + passenger_domtrans(httpd_t) + passenger_manage_pid_content(httpd_t) + passenger_read_lib_files(httpd_t) + passenger_stream_connect(httpd_t) + passenger_manage_tmp_files(httpd_t) + ') +') + +optional_policy(` + puppet_read_lib(httpd_t) +') + +optional_policy(` + rpc_search_nfs_state_data(httpd_t) +') + +optional_policy(` # Allow httpd to work with postgresql postgresql_stream_connect(httpd_t) postgresql_unpriv_client(httpd_t) @@ -608,6 +974,11 @@ optional_policy(` ') optional_policy(` + smokeping_read_lib_files(httpd_t) +') + +optional_policy(` + files_dontaudit_rw_usr_dirs(httpd_t) snmp_dontaudit_read_snmp_var_lib_files(httpd_t) snmp_dontaudit_write_snmp_var_lib_files(httpd_t) ') @@ -620,6 +991,12 @@ optional_policy(` yam_read_content(httpd_t) ') +optional_policy(` + zarafa_manage_lib_files(httpd_t) + zarafa_stream_connect_server(httpd_t) + zarafa_search_config(httpd_t) +') + ######################################## # # Apache helper local policy @@ -633,7 +1010,11 @@ allow httpd_helper_t httpd_log_t:file append_file_perms; logging_send_syslog_msg(httpd_helper_t) -userdom_use_user_terminals(httpd_helper_t) +userdom_use_inherited_user_terminals(httpd_helper_t) + +tunable_policy(`httpd_tty_comm',` + userdom_use_inherited_user_terminals(httpd_helper_t) +') ######################################## # @@ -671,28 +1052,30 @@ libs_exec_lib_files(httpd_php_t) userdom_use_unpriv_users_fds(httpd_php_t) tunable_policy(`httpd_can_network_connect_db',` - corenet_tcp_connect_mysqld_port(httpd_t) - corenet_sendrecv_mysqld_client_packets(httpd_t) - corenet_tcp_connect_mysqld_port(httpd_sys_script_t) - corenet_sendrecv_mysqld_client_packets(httpd_sys_script_t) - corenet_tcp_connect_mysqld_port(httpd_suexec_t) - corenet_sendrecv_mysqld_client_packets(httpd_suexec_t) - - corenet_tcp_connect_mssql_port(httpd_t) - corenet_sendrecv_mssql_client_packets(httpd_t) - corenet_tcp_connect_mssql_port(httpd_sys_script_t) - corenet_sendrecv_mssql_client_packets(httpd_sys_script_t) - corenet_tcp_connect_mssql_port(httpd_suexec_t) - corenet_sendrecv_mssql_client_packets(httpd_suexec_t) + corenet_tcp_connect_firebird_port(httpd_php_t) + corenet_tcp_connect_mssql_port(httpd_php_t) + corenet_sendrecv_mssql_client_packets(httpd_php_t) + corenet_tcp_connect_oracle_port(httpd_php_t) + corenet_sendrecv_oracle_client_packets(httpd_php_t) ') optional_policy(` mysql_stream_connect(httpd_php_t) + mysql_rw_db_sockets(httpd_php_t) mysql_read_config(httpd_php_t) + + tunable_policy(`httpd_can_network_connect_db',` + mysql_tcp_connect(httpd_php_t) + ') ') optional_policy(` postgresql_stream_connect(httpd_php_t) + postgresql_unpriv_client(httpd_php_t) + + tunable_policy(`httpd_can_network_connect_db',` + postgresql_tcp_connect(httpd_php_t) + ') ') ######################################## @@ -702,6 +1085,7 @@ optional_policy(` allow httpd_suexec_t self:capability { setuid setgid }; allow httpd_suexec_t self:process signal_perms; +allow httpd_suexec_t self:fifo_file rw_fifo_file_perms; allow httpd_suexec_t self:unix_stream_socket create_stream_socket_perms; domtrans_pattern(httpd_t, httpd_suexec_exec_t, httpd_suexec_t) @@ -716,19 +1100,27 @@ manage_dirs_pattern(httpd_suexec_t, httpd_suexec_tmp_t, httpd_suexec_tmp_t) manage_files_pattern(httpd_suexec_t, httpd_suexec_tmp_t, httpd_suexec_tmp_t) files_tmp_filetrans(httpd_suexec_t, httpd_suexec_tmp_t, { file dir }) +can_exec(httpd_suexec_t, httpd_sys_script_exec_t) + +read_files_pattern(httpd_suexec_t, httpd_user_content_t, httpd_user_content_t) +read_files_pattern(httpd_suexec_t, httpd_user_rw_content_t, httpd_user_rw_content_t) +read_files_pattern(httpd_suexec_t, httpd_user_ra_content_t, httpd_user_ra_content_t) + kernel_read_kernel_sysctls(httpd_suexec_t) kernel_list_proc(httpd_suexec_t) kernel_read_proc_symlinks(httpd_suexec_t) dev_read_urand(httpd_suexec_t) +fs_read_iso9660_files(httpd_suexec_t) fs_search_auto_mountpoints(httpd_suexec_t) +application_exec_all(httpd_suexec_t) + # for shell scripts corecmd_exec_bin(httpd_suexec_t) corecmd_exec_shell(httpd_suexec_t) -files_read_etc_files(httpd_suexec_t) files_read_usr_files(httpd_suexec_t) files_dontaudit_search_pids(httpd_suexec_t) files_search_home(httpd_suexec_t) @@ -738,15 +1130,14 @@ auth_use_nsswitch(httpd_suexec_t) logging_search_logs(httpd_suexec_t) logging_send_syslog_msg(httpd_suexec_t) -miscfiles_read_localization(httpd_suexec_t) miscfiles_read_public_files(httpd_suexec_t) +corenet_all_recvfrom_netlabel(httpd_suexec_t) + tunable_policy(`httpd_can_network_connect',` allow httpd_suexec_t self:tcp_socket create_stream_socket_perms; allow httpd_suexec_t self:udp_socket create_socket_perms; - corenet_all_recvfrom_unlabeled(httpd_suexec_t) - corenet_all_recvfrom_netlabel(httpd_suexec_t) corenet_tcp_sendrecv_generic_if(httpd_suexec_t) corenet_udp_sendrecv_generic_if(httpd_suexec_t) corenet_tcp_sendrecv_generic_node(httpd_suexec_t) @@ -757,13 +1148,31 @@ tunable_policy(`httpd_can_network_connect',` corenet_sendrecv_all_client_packets(httpd_suexec_t) ') +tunable_policy(`httpd_can_network_connect_db',` + corenet_tcp_connect_firebird_port(httpd_suexec_t) + corenet_tcp_connect_mssql_port(httpd_suexec_t) + corenet_sendrecv_mssql_client_packets(httpd_suexec_t) + corenet_tcp_connect_oracle_port(httpd_suexec_t) + corenet_sendrecv_oracle_client_packets(httpd_suexec_t) +') + +domain_entry_file(httpd_sys_script_t, httpd_sys_content_t) + +tunable_policy(`httpd_can_sendmail',` + mta_send_mail(httpd_suexec_t) +') + tunable_policy(`httpd_enable_cgi && httpd_unified',` allow httpd_sys_script_t httpdcontent:file entrypoint; domtrans_pattern(httpd_suexec_t, httpdcontent, httpd_sys_script_t) - + manage_dirs_pattern(httpd_sys_script_t, httpdcontent, httpdcontent) + manage_files_pattern(httpd_sys_script_t, httpdcontent, httpdcontent) + manage_sock_files_pattern(httpd_sys_script_t, httpdcontent, httpdcontent) + manage_lnk_files_pattern(httpd_sys_script_t, httpdcontent, httpdcontent) ') tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',` + fs_list_auto_mountpoints(httpd_suexec_t) fs_read_nfs_files(httpd_suexec_t) fs_read_nfs_symlinks(httpd_suexec_t) fs_exec_nfs_files(httpd_suexec_t) @@ -786,6 +1195,25 @@ optional_policy(` dontaudit httpd_suexec_t httpd_t:unix_stream_socket { read write }; ') +optional_policy(` + mysql_stream_connect(httpd_suexec_t) + mysql_rw_db_sockets(httpd_suexec_t) + mysql_read_config(httpd_suexec_t) + + tunable_policy(`httpd_can_network_connect_db',` + mysql_tcp_connect(httpd_suexec_t) + ') +') + +optional_policy(` + postgresql_stream_connect(httpd_suexec_t) + postgresql_unpriv_client(httpd_suexec_t) + + tunable_policy(`httpd_can_network_connect_db',` + postgresql_tcp_connect(httpd_suexec_t) + ') +') + ######################################## # # Apache system script local policy @@ -806,12 +1234,17 @@ read_lnk_files_pattern(httpd_sys_script_t, squirrelmail_spool_t, squirrelmail_sp kernel_read_kernel_sysctls(httpd_sys_script_t) +files_read_var_symlinks(httpd_sys_script_t) files_search_var_lib(httpd_sys_script_t) files_search_spool(httpd_sys_script_t) +logging_inherit_append_all_logs(httpd_sys_script_t) + # Should we add a boolean? apache_domtrans_rotatelogs(httpd_sys_script_t) +auth_use_nsswitch(httpd_sys_script_t) + ifdef(`distro_redhat',` allow httpd_sys_script_t httpd_log_t:file append_file_perms; ') @@ -820,18 +1253,50 @@ tunable_policy(`httpd_can_sendmail',` mta_send_mail(httpd_sys_script_t) ') +optional_policy(` + tunable_policy(`httpd_can_sendmail && httpd_can_check_spam',` + spamassassin_domtrans_client(httpd_t) + ') +') + +tunable_policy(`httpd_can_network_connect_db',` + corenet_tcp_connect_firebird_port(httpd_sys_script_t) + corenet_tcp_connect_mssql_port(httpd_sys_script_t) + corenet_sendrecv_mssql_client_packets(httpd_sys_script_t) + corenet_tcp_connect_oracle_port(httpd_sys_script_t) + corenet_sendrecv_oracle_client_packets(httpd_sys_script_t) +') + +fs_cifs_entry_type(httpd_sys_script_t) +fs_read_iso9660_files(httpd_sys_script_t) +fs_nfs_entry_type(httpd_sys_script_t) + +tunable_policy(`httpd_use_nfs',` + fs_list_auto_mountpoints(httpd_sys_script_t) + fs_manage_nfs_dirs(httpd_sys_script_t) + fs_manage_nfs_files(httpd_sys_script_t) + fs_manage_nfs_symlinks(httpd_sys_script_t) + fs_exec_nfs_files(httpd_sys_script_t) + + fs_list_auto_mountpoints(httpd_suexec_t) + fs_manage_nfs_dirs(httpd_suexec_t) + fs_manage_nfs_files(httpd_suexec_t) + fs_manage_nfs_symlinks(httpd_suexec_t) + fs_exec_nfs_files(httpd_suexec_t) +') + +corenet_all_recvfrom_netlabel(httpd_sys_script_t) + tunable_policy(`httpd_enable_cgi && httpd_can_network_connect',` allow httpd_sys_script_t self:tcp_socket create_stream_socket_perms; allow httpd_sys_script_t self:udp_socket create_socket_perms; - corenet_tcp_bind_all_nodes(httpd_sys_script_t) - corenet_udp_bind_all_nodes(httpd_sys_script_t) - corenet_all_recvfrom_unlabeled(httpd_sys_script_t) - corenet_all_recvfrom_netlabel(httpd_sys_script_t) - corenet_tcp_sendrecv_all_if(httpd_sys_script_t) - corenet_udp_sendrecv_all_if(httpd_sys_script_t) - corenet_tcp_sendrecv_all_nodes(httpd_sys_script_t) - corenet_udp_sendrecv_all_nodes(httpd_sys_script_t) + corenet_tcp_bind_generic_node(httpd_sys_script_t) + corenet_udp_bind_generic_node(httpd_sys_script_t) + corenet_tcp_sendrecv_generic_if(httpd_sys_script_t) + corenet_udp_sendrecv_generic_if(httpd_sys_script_t) + corenet_tcp_sendrecv_generic_node(httpd_sys_script_t) + corenet_udp_sendrecv_generic_node(httpd_sys_script_t) corenet_tcp_sendrecv_all_ports(httpd_sys_script_t) corenet_udp_sendrecv_all_ports(httpd_sys_script_t) corenet_tcp_connect_all_ports(httpd_sys_script_t) @@ -839,14 +1304,39 @@ tunable_policy(`httpd_enable_cgi && httpd_can_network_connect',` ') tunable_policy(`httpd_enable_homedirs',` - userdom_read_user_home_content_files(httpd_sys_script_t) + userdom_search_user_home_dirs(httpd_sys_script_t) ') tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',` + fs_list_auto_mountpoints(httpd_sys_script_t) fs_read_nfs_files(httpd_sys_script_t) fs_read_nfs_symlinks(httpd_sys_script_t) ') +tunable_policy(`httpd_read_user_content',` + userdom_read_user_home_content_files(httpd_sys_script_t) +') + +tunable_policy(`httpd_use_cifs',` + fs_manage_cifs_dirs(httpd_sys_script_t) + fs_manage_cifs_files(httpd_sys_script_t) + fs_manage_cifs_symlinks(httpd_sys_script_t) + fs_manage_cifs_dirs(httpd_suexec_t) + fs_manage_cifs_files(httpd_suexec_t) + fs_manage_cifs_symlinks(httpd_suexec_t) + fs_exec_cifs_files(httpd_suexec_t) +') + +tunable_policy(`httpd_use_fusefs',` + fs_manage_fusefs_dirs(httpd_sys_script_t) + fs_manage_fusefs_files(httpd_sys_script_t) + fs_manage_fusefs_symlinks(httpd_sys_script_t) + fs_manage_fusefs_dirs(httpd_suexec_t) + fs_manage_fusefs_files(httpd_suexec_t) + fs_manage_fusefs_symlinks(httpd_suexec_t) + fs_exec_fusefs_files(httpd_suexec_t) +') + tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',` fs_read_cifs_files(httpd_sys_script_t) fs_read_cifs_symlinks(httpd_sys_script_t) @@ -859,10 +1349,20 @@ optional_policy(` optional_policy(` mysql_stream_connect(httpd_sys_script_t) mysql_rw_db_sockets(httpd_sys_script_t) + mysql_read_config(httpd_sys_script_t) + + tunable_policy(`httpd_can_network_connect_db',` + mysql_tcp_connect(httpd_sys_script_t) + ') ') optional_policy(` postgresql_stream_connect(httpd_sys_script_t) + postgresql_unpriv_client(httpd_sys_script_t) + + tunable_policy(`httpd_can_network_connect_db',` + postgresql_tcp_connect(httpd_sys_script_t) + ') ') ######################################## @@ -878,11 +1378,9 @@ kernel_read_kernel_sysctls(httpd_rotatelogs_t) kernel_dontaudit_list_proc(httpd_rotatelogs_t) kernel_dontaudit_read_proc_symlinks(httpd_rotatelogs_t) -files_read_etc_files(httpd_rotatelogs_t) logging_search_logs(httpd_rotatelogs_t) -miscfiles_read_localization(httpd_rotatelogs_t) ######################################## # @@ -908,11 +1406,141 @@ optional_policy(` tunable_policy(`httpd_enable_cgi && httpd_unified',` allow httpd_user_script_t httpdcontent:file entrypoint; + manage_dirs_pattern(httpd_user_script_t, httpd_user_content_t, httpd_user_content_t) + manage_files_pattern(httpd_user_script_t, httpd_user_content_t, httpd_user_content_t) + manage_dirs_pattern(httpd_user_script_t, httpd_user_ra_content_t, httpd_user_ra_content_t) + manage_files_pattern(httpd_user_script_t, httpd_user_ra_content_t, httpd_user_ra_content_t) ') # allow accessing files/dirs below the users home dir tunable_policy(`httpd_enable_homedirs',` - userdom_search_user_home_dirs(httpd_t) - userdom_search_user_home_dirs(httpd_suexec_t) - userdom_search_user_home_dirs(httpd_user_script_t) + userdom_search_user_home_content(httpd_t) + userdom_search_user_home_content(httpd_suexec_t) + userdom_search_user_home_content(httpd_user_script_t) +') + +tunable_policy(`httpd_read_user_content',` + userdom_read_user_home_content_files(httpd_t) + userdom_read_user_home_content_files(httpd_suexec_t) + userdom_read_user_home_content_files(httpd_user_script_t) +') + +######################################## +# +# httpd_passwd local policy +# + +allow httpd_passwd_t self:fifo_file manage_fifo_file_perms; +allow httpd_passwd_t self:unix_stream_socket create_stream_socket_perms; +allow httpd_passwd_t self:unix_dgram_socket create_socket_perms; + +kernel_read_system_state(httpd_passwd_t) + +corecmd_exec_bin(httpd_passwd_t) +corecmd_exec_shell(httpd_passwd_t) + +dev_read_urand(httpd_passwd_t) + +domain_use_interactive_fds(httpd_passwd_t) + + +auth_use_nsswitch(httpd_passwd_t) + +miscfiles_read_certs(httpd_passwd_t) + +systemd_manage_passwd_run(httpd_passwd_t) +systemd_manage_passwd_run(httpd_t) +#systemd_passwd_agent_dev_template(httpd) + +domtrans_pattern(httpd_t, httpd_passwd_exec_t, httpd_passwd_t) +dontaudit httpd_passwd_t httpd_config_t:file read; + +search_dirs_pattern(httpd_script_type, httpd_sys_content_t, httpd_script_exec_type) +corecmd_shell_entry_type(httpd_script_type) + +allow httpd_script_type self:fifo_file rw_file_perms; +allow httpd_script_type self:unix_stream_socket connectto; + +allow httpd_script_type httpd_t:fifo_file write; +# apache should set close-on-exec +apache_dontaudit_leaks(httpd_script_type) + +append_files_pattern(httpd_script_type, httpd_log_t, httpd_log_t) +logging_search_logs(httpd_script_type) + +kernel_dontaudit_search_sysctl(httpd_script_type) +kernel_dontaudit_search_kernel_sysctl(httpd_script_type) + +dev_read_rand(httpd_script_type) +dev_read_urand(httpd_script_type) + +corecmd_exec_all_executables(httpd_script_type) +application_exec_all(httpd_script_type) + +files_exec_etc_files(httpd_script_type) +files_search_home(httpd_script_type) + +libs_exec_ld_so(httpd_script_type) +libs_exec_lib_files(httpd_script_type) + +miscfiles_read_fonts(httpd_script_type) +miscfiles_read_public_files(httpd_script_type) + +seutil_dontaudit_search_config(httpd_script_type) +allow httpd_t httpd_script_type:unix_stream_socket connectto; + +allow httpd_t httpd_script_exec_type:file read_file_perms; +allow httpd_t httpd_script_exec_type:lnk_file read_lnk_file_perms; +allow httpd_t httpd_script_type:process { signal sigkill sigstop }; +allow httpd_t httpd_script_exec_type:dir list_dir_perms; + +allow httpd_script_type self:process { setsched signal_perms }; +allow httpd_script_type self:unix_stream_socket create_stream_socket_perms; +allow httpd_script_type self:unix_dgram_socket create_socket_perms; + +allow httpd_script_type httpd_t:fd use; +allow httpd_script_type httpd_t:process sigchld; + +dontaudit httpd_script_type httpd_t:tcp_socket { read write }; + +kernel_read_system_state(httpd_script_type) + +dev_read_urand(httpd_script_type) + +fs_getattr_xattr_fs(httpd_script_type) + +files_read_etc_runtime_files(httpd_script_type) +files_read_usr_files(httpd_script_type) + +libs_read_lib_files(httpd_script_type) + +allow httpd_script_type httpd_sys_content_t:dir search_dir_perms; + +tunable_policy(`httpd_enable_cgi && nis_enabled',` + nis_use_ypbind_uncond(httpd_script_type) +') + +optional_policy(` + nscd_socket_use(httpd_script_type) +') + +read_files_pattern(httpd_t, httpd_content_type, httpd_content_type) + +tunable_policy(`httpd_builtin_scripting',` + allow httpd_t httpd_content_type:dir search_dir_perms; + allow httpd_suexec_t httpd_content_type:dir search_dir_perms; + + allow httpd_t httpd_content_type:dir list_dir_perms; + read_files_pattern(httpd_t, httpd_content_type, httpd_content_type) + read_lnk_files_pattern(httpd_t, httpd_content_type, httpd_content_type) + + allow httpd_t httpd_content_type:dir list_dir_perms; + read_files_pattern(httpd_t, httpd_content_type, httpd_content_type) + read_lnk_files_pattern(httpd_t, httpd_content_type, httpd_content_type) +') + +tunable_policy(`httpd_use_openstack',` + corenet_tcp_connect_keystone_port(httpd_sys_script_t) + corenet_tcp_connect_all_ephemeral_ports(httpd_t) + corenet_tcp_connect_glance_port(httpd_sys_script_t) ') diff --git a/apcupsd.fc b/apcupsd.fc index cd07b96..f3506be 100644 --- a/apcupsd.fc +++ b/apcupsd.fc @@ -1,9 +1,13 @@ /etc/rc\.d/init\.d/apcupsd -- gen_context(system_u:object_r:apcupsd_initrc_exec_t,s0) +/usr/lib/systemd/system/apcupsd.* -- gen_context(system_u:object_r:apcupsd_unit_file_t,s0) + /sbin/apcupsd -- gen_context(system_u:object_r:apcupsd_exec_t,s0) /usr/sbin/apcupsd -- gen_context(system_u:object_r:apcupsd_exec_t,s0) +/var/lock/subsys/apcupsd -- gen_context(system_u:object_r:apcupsd_lock_t,s0) + /var/log/apcupsd\.events.* -- gen_context(system_u:object_r:apcupsd_log_t,s0) /var/log/apcupsd\.status.* -- gen_context(system_u:object_r:apcupsd_log_t,s0) @@ -13,3 +17,4 @@ /var/www/apcupsd/upsfstats\.cgi -- gen_context(system_u:object_r:httpd_apcupsd_cgi_script_exec_t,s0) /var/www/apcupsd/upsimage\.cgi -- gen_context(system_u:object_r:httpd_apcupsd_cgi_script_exec_t,s0) /var/www/apcupsd/upsstats\.cgi -- gen_context(system_u:object_r:httpd_apcupsd_cgi_script_exec_t,s0) +/var/www/cgi-bin/apcgui(/.*)? gen_context(system_u:object_r:httpd_apcupsd_cgi_script_exec_t,s0) diff --git a/apcupsd.if b/apcupsd.if index e342775..1fedbe5 100644 --- a/apcupsd.if +++ b/apcupsd.if @@ -123,6 +123,29 @@ interface(`apcupsd_cgi_script_domtrans',` ######################################## ## +## Execute apcupsd server in the apcupsd domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`apcupsd_systemctl',` + gen_require(` + type apcupsd_t; + type apcupsd_unit_file_t; + ') + + systemd_exec_systemctl($1) + allow $1 apcupsd_unit_file_t:file read_file_perms; + allow $1 apcupsd_unit_file_t:service manage_service_perms; + + ps_process_pattern($1, apcupsd_t) +') + +######################################## +## ## All of the rules required to administrate ## an apcupsd environment ## @@ -144,11 +167,16 @@ interface(`apcupsd_admin',` type apcupsd_log_t, apcupsd_lock_t; type apcupsd_var_run_t; type apcupsd_initrc_exec_t; + type apcupsd_unit_file_t; ') - allow $1 apcupsd_t:process { ptrace signal_perms }; + allow $1 apcupsd_t:process signal_perms; ps_process_pattern($1, apcupsd_t) + tunable_policy(`deny_ptrace',`',` + allow $1 apcupsd_t:process ptrace; + ') + apcupsd_initrc_domtrans($1, apcupsd_initrc_exec_t) domain_system_change_exemption($1) role_transition $2 apcupsd_initrc_exec_t system_r; @@ -165,4 +193,8 @@ interface(`apcupsd_admin',` files_list_pids($1) admin_pattern($1, apcupsd_var_run_t) + + apcupsd_systemctl($1) + admin_pattern($1, apcupsd_unit_file_t) + allow $1 apcupsd_unit_file_t:service all_service_perms; ') diff --git a/apcupsd.te b/apcupsd.te index d052bf0..48f0ce4 100644 --- a/apcupsd.te +++ b/apcupsd.te @@ -24,6 +24,9 @@ files_tmp_file(apcupsd_tmp_t) type apcupsd_var_run_t; files_pid_file(apcupsd_var_run_t) +type apcupsd_unit_file_t; +systemd_unit_file(apcupsd_unit_file_t) + ######################################## # # apcupsd local policy @@ -53,7 +56,6 @@ kernel_read_system_state(apcupsd_t) corecmd_exec_bin(apcupsd_t) corecmd_exec_shell(apcupsd_t) -corenet_all_recvfrom_unlabeled(apcupsd_t) corenet_all_recvfrom_netlabel(apcupsd_t) corenet_tcp_sendrecv_generic_if(apcupsd_t) corenet_tcp_sendrecv_generic_node(apcupsd_t) @@ -76,24 +78,29 @@ files_etc_filetrans_etc_runtime(apcupsd_t, file) # https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=240805 term_use_unallocated_ttys(apcupsd_t) +term_use_usb_ttys(apcupsd_t) #apcupsd runs shutdown, probably need a shutdown domain init_rw_utmp(apcupsd_t) init_telinit(apcupsd_t) -logging_send_syslog_msg(apcupsd_t) +auth_read_passwd(apcupsd_t) -miscfiles_read_localization(apcupsd_t) +logging_send_syslog_msg(apcupsd_t) sysnet_dns_name_resolve(apcupsd_t) -userdom_use_user_ttys(apcupsd_t) +userdom_use_inherited_user_ttys(apcupsd_t) optional_policy(` hostname_exec(apcupsd_t) ') optional_policy(` + shutdown_domtrans(apcupsd_t) +') + +optional_policy(` mta_send_mail(apcupsd_t) mta_system_content(apcupsd_tmp_t) ') @@ -113,7 +120,6 @@ optional_policy(` allow httpd_apcupsd_cgi_script_t self:tcp_socket create_stream_socket_perms; allow httpd_apcupsd_cgi_script_t self:udp_socket create_socket_perms; - corenet_all_recvfrom_unlabeled(httpd_apcupsd_cgi_script_t) corenet_all_recvfrom_netlabel(httpd_apcupsd_cgi_script_t) corenet_tcp_sendrecv_generic_if(httpd_apcupsd_cgi_script_t) corenet_tcp_sendrecv_generic_node(httpd_apcupsd_cgi_script_t) diff --git a/apm.fc b/apm.fc index 0123777..f2f0c35 100644 --- a/apm.fc +++ b/apm.fc @@ -1,3 +1,4 @@ +/usr/lib/systemd/system/apmd.* -- gen_context(system_u:object_r:apmd_unit_file_t,s0) # # /usr diff --git a/apm.if b/apm.if index 1ea99b2..0b668ae 100644 --- a/apm.if +++ b/apm.if @@ -89,7 +89,7 @@ interface(`apm_append_log',` ') logging_search_logs($1) - allow $1 apmd_log_t:file append; + allow $1 apmd_log_t:file append_file_perms; ') ######################################## @@ -108,6 +108,28 @@ interface(`apm_stream_connect',` ') files_search_pids($1) - allow $1 apmd_var_run_t:sock_file write; - allow $1 apmd_t:unix_stream_socket connectto; + stream_connect_pattern($1, apmd_var_run_t, apmd_var_run_t, apmd_t) +') + +######################################## +## +## Execute apmd server in the apmd domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`apmd_systemctl',` + gen_require(` + type apmd_t; + type apmd_unit_file_t; + ') + + systemd_exec_systemctl($1) + allow $1 apmd_unit_file_t:file read_file_perms; + allow $1 apmd_unit_file_t:service manage_service_perms; + + ps_process_pattern($1, apmd_t) ') diff --git a/apm.te b/apm.te index 1c8c27e..ad4b698 100644 --- a/apm.te +++ b/apm.te @@ -4,6 +4,7 @@ policy_module(apm, 1.11.0) # # Declarations # + type apmd_t; type apmd_exec_t; init_daemon_domain(apmd_t, apmd_exec_t) @@ -32,6 +33,9 @@ ifdef(`distro_suse',` files_type(apmd_var_lib_t) ') +type apmd_unit_file_t; +systemd_unit_file(apmd_unit_file_t) + ######################################## # # apm client Local policy @@ -45,7 +49,7 @@ dev_rw_apm_bios(apm_t) fs_getattr_xattr_fs(apm_t) -term_use_all_terms(apm_t) +term_use_all_inherited_terms(apm_t) domain_use_interactive_fds(apm_t) @@ -59,9 +63,10 @@ logging_send_syslog_msg(apm_t) # mknod: controlling an orderly resume of PCMCIA requires creating device # nodes 254,{0,1,2} for some reason. allow apmd_t self:capability { sys_admin sys_nice sys_time kill mknod }; -dontaudit apmd_t self:capability { setuid dac_override dac_read_search sys_ptrace sys_tty_config }; +dontaudit apmd_t self:capability { setuid dac_override dac_read_search sys_tty_config }; allow apmd_t self:process { signal_perms getsession }; allow apmd_t self:fifo_file rw_fifo_file_perms; +allow apmd_t self:netlink_socket create_socket_perms; allow apmd_t self:unix_dgram_socket create_socket_perms; allow apmd_t self:unix_stream_socket create_stream_socket_perms; @@ -81,6 +86,8 @@ kernel_rw_all_sysctls(apmd_t) kernel_read_system_state(apmd_t) kernel_write_proc_files(apmd_t) +dev_read_input(apmd_t) +dev_read_mouse(apmd_t) dev_read_realtime_clock(apmd_t) dev_read_urand(apmd_t) dev_rw_apm_bios(apmd_t) @@ -114,6 +121,8 @@ files_dontaudit_getattr_all_symlinks(apmd_t) # Excessive? files_dontaudit_getattr_all_pipes(apmd_t) # Excessive? files_dontaudit_getattr_all_sockets(apmd_t) # Excessive? +auth_use_nsswitch(apmd_t) + init_domtrans_script(apmd_t) init_rw_utmp(apmd_t) init_telinit(apmd_t) @@ -124,13 +133,13 @@ libs_exec_lib_files(apmd_t) logging_send_syslog_msg(apmd_t) logging_send_audit_msgs(apmd_t) -miscfiles_read_localization(apmd_t) miscfiles_read_hwdata(apmd_t) modutils_domtrans_insmod(apmd_t) modutils_read_module_config(apmd_t) seutil_dontaudit_read_config(apmd_t) +seutil_sigchld_newrole(apmd_t) userdom_dontaudit_use_unpriv_user_fds(apmd_t) userdom_dontaudit_search_user_home_dirs(apmd_t) @@ -142,9 +151,8 @@ ifdef(`distro_redhat',` can_exec(apmd_t, apmd_var_run_t) - # ifconfig_exec_t needs to be run in its own domain for Red Hat optional_policy(` - sysnet_domtrans_ifconfig(apmd_t) + fstools_domtrans(apmd_t) ') optional_policy(` @@ -155,6 +163,15 @@ ifdef(`distro_redhat',` netutils_domtrans(apmd_t) ') + # ifconfig_exec_t needs to be run in its own domain for Red Hat + optional_policy(` + sssd_search_lib(apmd_t) + ') + + optional_policy(` + sysnet_domtrans_ifconfig(apmd_t) + ') + ',` # for ifconfig which is run all the time kernel_dontaudit_search_sysctl(apmd_t) @@ -181,6 +198,12 @@ optional_policy(` ') optional_policy(` + devicekit_manage_pid_files(apmd_t) + devicekit_manage_log_files(apmd_t) + devicekit_relabel_log_files(apmd_t) +') + +optional_policy(` dbus_system_bus_client(apmd_t) optional_policy(` @@ -209,8 +232,13 @@ optional_policy(` pcmcia_domtrans_cardctl(apmd_t) ') + +optional_policy(` + shutdown_domtrans(apmd_t) +') + optional_policy(` - seutil_sigchld_newrole(apmd_t) + systemd_dbus_chat_logind(apmd_t) ') optional_policy(` diff --git a/apt.te b/apt.te index 8555315..af9bcbe 100644 --- a/apt.te +++ b/apt.te @@ -94,7 +94,6 @@ kernel_read_kernel_sysctls(apt_t) corecmd_exec_bin(apt_t) corecmd_exec_shell(apt_t) -corenet_all_recvfrom_unlabeled(apt_t) corenet_all_recvfrom_netlabel(apt_t) corenet_tcp_sendrecv_generic_if(apt_t) corenet_udp_sendrecv_generic_if(apt_t) @@ -121,20 +120,18 @@ fs_getattr_all_fs(apt_t) term_create_pty(apt_t, apt_devpts_t) term_list_ptys(apt_t) -term_use_all_terms(apt_t) +term_use_all_inherited_terms(apt_t) libs_exec_ld_so(apt_t) libs_exec_lib_files(apt_t) logging_send_syslog_msg(apt_t) -miscfiles_read_localization(apt_t) - seutil_use_newrole_fds(apt_t) sysnet_read_config(apt_t) -userdom_use_user_terminals(apt_t) +userdom_use_inherited_user_terminals(apt_t) # with boolean, for cron-apt and such? #optional_policy(` diff --git a/arpwatch.fc b/arpwatch.fc index a86a6c7..ab50afe 100644 --- a/arpwatch.fc +++ b/arpwatch.fc @@ -1,5 +1,7 @@ /etc/rc\.d/init\.d/arpwatch -- gen_context(system_u:object_r:arpwatch_initrc_exec_t,s0) +/usr/lib/systemd/system/arpwatch.* -- gen_context(system_u:object_r:arpwatch_unit_file_t,s0) + # # /usr # diff --git a/arpwatch.if b/arpwatch.if index c804110..06a516f 100644 --- a/arpwatch.if +++ b/arpwatch.if @@ -115,6 +115,29 @@ interface(`arpwatch_dontaudit_rw_packet_sockets',` ######################################## ## +## Execute arpwatch server in the arpwatch domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`arpwatch_systemctl',` + gen_require(` + type arpwatch_t; + type arpwatch_unit_file_t; + ') + + systemd_exec_systemctl($1) + allow $1 arpwatch_unit_file_t:file read_file_perms; + allow $1 arpwatch_unit_file_t:service manage_service_perms; + + ps_process_pattern($1, arpwatch_t) +') + +######################################## +## ## All of the rules required to administrate ## an arpwatch environment ## @@ -135,11 +158,16 @@ interface(`arpwatch_admin',` type arpwatch_t, arpwatch_tmp_t; type arpwatch_data_t, arpwatch_var_run_t; type arpwatch_initrc_exec_t; + type arpwatch_unit_file_t; ') - allow $1 arpwatch_t:process { ptrace signal_perms getattr }; + allow $1 arpwatch_t:process signal_perms; ps_process_pattern($1, arpwatch_t) + tunable_policy(`deny_ptrace',`',` + allow $1 arpwatch_t:process ptrace; + ') + arpwatch_initrc_domtrans($1) domain_system_change_exemption($1) role_transition $2 arpwatch_initrc_exec_t system_r; @@ -153,4 +181,8 @@ interface(`arpwatch_admin',` files_list_pids($1) admin_pattern($1, arpwatch_var_run_t) + + arpwatch_systemctl($1) + admin_pattern($1, arpwatch_unit_file_t) + allow $1 arpwatch_unit_file_t:service all_service_perms; ') diff --git a/arpwatch.te b/arpwatch.te index 804135f..8d012f7 100644 --- a/arpwatch.te +++ b/arpwatch.te @@ -21,6 +21,9 @@ files_tmp_file(arpwatch_tmp_t) type arpwatch_var_run_t; files_pid_file(arpwatch_var_run_t) +type arpwatch_unit_file_t; +systemd_unit_file(arpwatch_unit_file_t) + ######################################## # # Local policy @@ -34,6 +37,7 @@ allow arpwatch_t self:tcp_socket { connect create_stream_socket_perms }; allow arpwatch_t self:udp_socket create_socket_perms; allow arpwatch_t self:packet_socket create_socket_perms; allow arpwatch_t self:socket create_socket_perms; +allow arpwatch_t self:netlink_socket create_socket_perms; manage_dirs_pattern(arpwatch_t, arpwatch_data_t, arpwatch_data_t) manage_files_pattern(arpwatch_t, arpwatch_data_t, arpwatch_data_t) @@ -47,12 +51,12 @@ manage_files_pattern(arpwatch_t, arpwatch_var_run_t, arpwatch_var_run_t) files_pid_filetrans(arpwatch_t, arpwatch_var_run_t, file) kernel_read_network_state(arpwatch_t) +# meminfo +kernel_read_system_state(arpwatch_t) kernel_read_kernel_sysctls(arpwatch_t) -kernel_list_proc(arpwatch_t) kernel_read_proc_symlinks(arpwatch_t) kernel_request_load_module(arpwatch_t) -corenet_all_recvfrom_unlabeled(arpwatch_t) corenet_all_recvfrom_netlabel(arpwatch_t) corenet_tcp_sendrecv_generic_if(arpwatch_t) corenet_udp_sendrecv_generic_if(arpwatch_t) @@ -74,7 +78,6 @@ corecmd_read_bin_symlinks(arpwatch_t) domain_use_interactive_fds(arpwatch_t) -files_read_etc_files(arpwatch_t) files_read_usr_files(arpwatch_t) files_search_var_lib(arpwatch_t) @@ -82,8 +85,6 @@ auth_use_nsswitch(arpwatch_t) logging_send_syslog_msg(arpwatch_t) -miscfiles_read_localization(arpwatch_t) - userdom_dontaudit_search_user_home_dirs(arpwatch_t) userdom_dontaudit_use_unpriv_user_fds(arpwatch_t) diff --git a/asterisk.if b/asterisk.if index b6168fd..313c6e4 100644 --- a/asterisk.if +++ b/asterisk.if @@ -105,9 +105,13 @@ interface(`asterisk_admin',` type asterisk_initrc_exec_t; ') - allow $1 asterisk_t:process { ptrace signal_perms getattr }; + allow $1 asterisk_t:process signal_perms; ps_process_pattern($1, asterisk_t) + tunable_policy(`deny_ptrace',`',` + allow $1 asterisk_t:process ptrace; + ') + init_labeled_script_domtrans($1, asterisk_initrc_exec_t) domain_system_change_exemption($1) role_transition $2 asterisk_initrc_exec_t system_r; diff --git a/asterisk.te b/asterisk.te index 159610b..164b672 100644 --- a/asterisk.te +++ b/asterisk.te @@ -20,10 +20,11 @@ type asterisk_log_t; logging_log_file(asterisk_log_t) type asterisk_spool_t; -files_type(asterisk_spool_t) +files_spool_file(asterisk_spool_t) type asterisk_tmp_t; files_tmp_file(asterisk_tmp_t) +mta_system_content(asterisk_tmp_t) type asterisk_tmpfs_t; files_tmpfs_file(asterisk_tmpfs_t) @@ -40,8 +41,8 @@ files_pid_file(asterisk_var_run_t) # # dac_override for /var/run/asterisk -allow asterisk_t self:capability { dac_override setgid setuid sys_nice net_admin chown }; -dontaudit asterisk_t self:capability sys_tty_config; +allow asterisk_t self:capability { dac_override chown setgid setuid sys_nice net_admin }; +dontaudit asterisk_t self:capability { sys_module sys_tty_config }; allow asterisk_t self:process { getsched setsched signal_perms getcap setcap }; allow asterisk_t self:fifo_file rw_fifo_file_perms; allow asterisk_t self:sem create_sem_perms; @@ -77,11 +78,13 @@ fs_tmpfs_filetrans(asterisk_t, asterisk_tmpfs_t, { dir file lnk_file sock_file f manage_files_pattern(asterisk_t, asterisk_var_lib_t, asterisk_var_lib_t) files_var_lib_filetrans(asterisk_t, asterisk_var_lib_t, file) +manage_dirs_pattern(asterisk_t, asterisk_var_run_t, asterisk_var_run_t) manage_files_pattern(asterisk_t, asterisk_var_run_t, asterisk_var_run_t) manage_fifo_files_pattern(asterisk_t, asterisk_var_run_t, asterisk_var_run_t) manage_sock_files_pattern(asterisk_t, asterisk_var_run_t, asterisk_var_run_t) -files_pid_filetrans(asterisk_t, asterisk_var_run_t, file) +files_pid_filetrans(asterisk_t, asterisk_var_run_t, { dir file }) +kernel_read_network_state(asterisk_t) kernel_read_system_state(asterisk_t) kernel_read_kernel_sysctls(asterisk_t) kernel_request_load_module(asterisk_t) @@ -89,7 +92,6 @@ kernel_request_load_module(asterisk_t) corecmd_exec_bin(asterisk_t) corecmd_exec_shell(asterisk_t) -corenet_all_recvfrom_unlabeled(asterisk_t) corenet_all_recvfrom_netlabel(asterisk_t) corenet_tcp_sendrecv_generic_if(asterisk_t) corenet_udp_sendrecv_generic_if(asterisk_t) @@ -109,9 +111,13 @@ corenet_tcp_bind_generic_port(asterisk_t) corenet_udp_bind_generic_port(asterisk_t) corenet_dontaudit_udp_bind_all_ports(asterisk_t) corenet_sendrecv_generic_server_packets(asterisk_t) +corenet_tcp_connect_festival_port(asterisk_t) +corenet_tcp_connect_jabber_client_port(asterisk_t) +corenet_tcp_connect_pktcable_port(asterisk_t) corenet_tcp_connect_postgresql_port(asterisk_t) corenet_tcp_connect_snmp_port(asterisk_t) corenet_tcp_connect_sip_port(asterisk_t) +corenet_tcp_connect_jabber_client_port(asterisk_t) dev_rw_generic_usb_dev(asterisk_t) dev_read_sysfs(asterisk_t) @@ -122,11 +128,11 @@ dev_read_urand(asterisk_t) domain_use_interactive_fds(asterisk_t) -files_read_etc_files(asterisk_t) files_search_spool(asterisk_t) # demo files installed in /usr/share/asterisk/sounds/demo-instruct.gsm # are labeled usr_t files_read_usr_files(asterisk_t) +files_dontaudit_search_home(asterisk_t) fs_getattr_all_fs(asterisk_t) fs_list_inotifyfs(asterisk_t) @@ -137,12 +143,14 @@ auth_use_nsswitch(asterisk_t) logging_send_syslog_msg(asterisk_t) -miscfiles_read_localization(asterisk_t) - userdom_dontaudit_use_unpriv_user_fds(asterisk_t) userdom_dontaudit_search_user_home_dirs(asterisk_t) optional_policy(` + alsa_read_rw_config(asterisk_t) +') + +optional_policy(` mysql_stream_connect(asterisk_t) ') diff --git a/automount.fc b/automount.fc index f16ab68..e4178a4 100644 --- a/automount.fc +++ b/automount.fc @@ -4,6 +4,8 @@ /etc/apm/event\.d/autofs -- gen_context(system_u:object_r:automount_exec_t,s0) /etc/rc\.d/init\.d/autofs -- gen_context(system_u:object_r:automount_initrc_exec_t,s0) +/usr/lib/systemd/system/autofs.* -- gen_context(system_u:object_r:automount_unit_file_t,s0) + # # /usr # diff --git a/automount.if b/automount.if index d80a16b..ef740ef 100644 --- a/automount.if +++ b/automount.if @@ -29,7 +29,6 @@ interface(`automount_domtrans',` ## ## # -# interface(`automount_signal',` gen_require(` type automount_t; @@ -123,7 +122,30 @@ interface(`automount_dontaudit_getattr_tmp_dirs',` type automount_tmp_t; ') - dontaudit $1 automount_tmp_t:dir getattr; + dontaudit $1 automount_tmp_t:dir getattr_dir_perms; +') + +######################################## +## +## Execute automount server in the automount domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`automount_systemctl',` + gen_require(` + type automount_t; + type automount_unit_file_t; + ') + + systemd_exec_systemctl($1) + allow $1 automount_unit_file_t:file read_file_perms; + allow $1 automount_unit_file_t:service manage_service_perms; + + ps_process_pattern($1, automount_t) ') ######################################## @@ -147,11 +169,16 @@ interface(`automount_admin',` gen_require(` type automount_t, automount_lock_t, automount_tmp_t; type automount_var_run_t, automount_initrc_exec_t; + type automount_unit_file_t; ') - allow $1 automount_t:process { ptrace signal_perms getattr }; + allow $1 automount_t:process signal_perms; ps_process_pattern($1, automount_t) + tunable_policy(`deny_ptrace',`',` + allow $1 automount_t:process ptrace; + ') + init_labeled_script_domtrans($1, automount_initrc_exec_t) domain_system_change_exemption($1) role_transition $2 automount_initrc_exec_t system_r; @@ -165,4 +192,8 @@ interface(`automount_admin',` files_list_pids($1) admin_pattern($1, automount_var_run_t) + + automount_systemctl($1) + admin_pattern($1, automount_unit_file_t) + allow $1 automount_unit_file_t:service all_service_perms; ') diff --git a/automount.te b/automount.te index 39799db..9c2d82f 100644 --- a/automount.te +++ b/automount.te @@ -22,6 +22,9 @@ type automount_tmp_t; files_tmp_file(automount_tmp_t) files_mountpoint(automount_tmp_t) +type automount_unit_file_t; +systemd_unit_file(automount_unit_file_t) + ######################################## # # Local policy @@ -64,6 +67,7 @@ kernel_read_network_state(automount_t) kernel_list_proc(automount_t) kernel_dontaudit_search_xen_state(automount_t) +files_read_usr_files(automount_t) files_search_boot(automount_t) # Automount is slowly adding all mount functionality internally files_search_all(automount_t) @@ -79,7 +83,6 @@ fs_search_all(automount_t) corecmd_exec_bin(automount_t) corecmd_exec_shell(automount_t) -corenet_all_recvfrom_unlabeled(automount_t) corenet_all_recvfrom_netlabel(automount_t) corenet_tcp_sendrecv_generic_if(automount_t) corenet_udp_sendrecv_generic_if(automount_t) @@ -113,7 +116,6 @@ files_dontaudit_write_var_dirs(automount_t) files_getattr_all_dirs(automount_t) files_list_mnt(automount_t) files_getattr_home_dir(automount_t) -files_read_etc_files(automount_t) files_read_etc_runtime_files(automount_t) # for if the mount point is not labelled files_getattr_isid_type_dirs(automount_t) @@ -140,13 +142,8 @@ auth_use_nsswitch(automount_t) logging_send_syslog_msg(automount_t) logging_search_logs(automount_t) -miscfiles_read_localization(automount_t) miscfiles_read_generic_certs(automount_t) -# Run mount in the mount_t domain. -mount_domtrans(automount_t) -mount_signal(automount_t) - userdom_dontaudit_use_unpriv_user_fds(automount_t) userdom_dontaudit_search_user_home_dirs(automount_t) @@ -155,6 +152,13 @@ optional_policy(` ') optional_policy(` + # Run mount in the mount_t domain. + mount_domtrans(automount_t) + mount_domtrans_showmount(automount_t) + mount_signal(automount_t) +') + +optional_policy(` fstools_domtrans(automount_t) ') diff --git a/avahi.fc b/avahi.fc index 7e36549..010b2bc 100644 --- a/avahi.fc +++ b/avahi.fc @@ -1,5 +1,7 @@ /etc/rc\.d/init\.d/avahi.* -- gen_context(system_u:object_r:avahi_initrc_exec_t,s0) +/usr/lib/systemd/system/avahi.* -- gen_context(system_u:object_r:avahi_unit_file_t,s0) + /usr/sbin/avahi-daemon -- gen_context(system_u:object_r:avahi_exec_t,s0) /usr/sbin/avahi-dnsconfd -- gen_context(system_u:object_r:avahi_exec_t,s0) /usr/sbin/avahi-autoipd -- gen_context(system_u:object_r:avahi_exec_t,s0) diff --git a/avahi.if b/avahi.if index 61c74bc..17b3ecc 100644 --- a/avahi.if +++ b/avahi.if @@ -133,6 +133,29 @@ interface(`avahi_dontaudit_search_pid',` ######################################## ## +## Execute avahi server in the avahi domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`avahi_systemctl',` + gen_require(` + type avahi_t; + type avahi_unit_file_t; + ') + + systemd_exec_systemctl($1) + allow $1 avahi_unit_file_t:file read_file_perms; + allow $1 avahi_unit_file_t:service manage_service_perms; + + ps_process_pattern($1, avahi_t) +') + +######################################## +## ## All of the rules required to administrate ## an avahi environment ## @@ -151,11 +174,16 @@ interface(`avahi_dontaudit_search_pid',` interface(`avahi_admin',` gen_require(` type avahi_t, avahi_var_run_t, avahi_initrc_exec_t; + type avahi_unit_file_t; ') - allow $1 avahi_t:process { ptrace signal_perms }; + allow $1 avahi_t:process signal_perms; ps_process_pattern($1, avahi_t) + tunable_policy(`deny_ptrace',`',` + allow $1 avahi_t:process ptrace; + ') + init_labeled_script_domtrans($1, avahi_initrc_exec_t) domain_system_change_exemption($1) role_transition $2 avahi_initrc_exec_t system_r; @@ -163,4 +191,8 @@ interface(`avahi_admin',` files_list_pids($1) admin_pattern($1, avahi_var_run_t) + + avahi_systemctl($1) + admin_pattern($1, avahi_unit_file_t) + allow $1 avahi_unit_file_t:service all_service_perms; ') diff --git a/avahi.te b/avahi.te index a7a0e71..34bc1be 100644 --- a/avahi.te +++ b/avahi.te @@ -17,6 +17,10 @@ files_pid_file(avahi_var_lib_t) type avahi_var_run_t; files_pid_file(avahi_var_run_t) +init_sock_file(avahi_var_run_t) + +type avahi_unit_file_t; +systemd_unit_file(avahi_unit_file_t) ######################################## # @@ -46,11 +50,11 @@ files_pid_filetrans(avahi_t, avahi_var_run_t, { dir file }) kernel_read_system_state(avahi_t) kernel_read_kernel_sysctls(avahi_t) kernel_read_network_state(avahi_t) +kernel_request_load_module(avahi_t) corecmd_exec_bin(avahi_t) corecmd_exec_shell(avahi_t) -corenet_all_recvfrom_unlabeled(avahi_t) corenet_all_recvfrom_netlabel(avahi_t) corenet_tcp_sendrecv_generic_if(avahi_t) corenet_udp_sendrecv_generic_if(avahi_t) @@ -73,8 +77,8 @@ fs_search_auto_mountpoints(avahi_t) fs_list_inotifyfs(avahi_t) domain_use_interactive_fds(avahi_t) +domain_dontaudit_signull_all_domains(avahi_t) -files_read_etc_files(avahi_t) files_read_etc_runtime_files(avahi_t) files_read_usr_files(avahi_t) @@ -85,13 +89,14 @@ init_signull_script(avahi_t) logging_send_syslog_msg(avahi_t) -miscfiles_read_localization(avahi_t) miscfiles_read_generic_certs(avahi_t) sysnet_domtrans_ifconfig(avahi_t) sysnet_manage_config(avahi_t) sysnet_etc_filetrans_config(avahi_t) +systemd_login_signull(avahi_t) + userdom_dontaudit_use_unpriv_user_fds(avahi_t) userdom_dontaudit_search_user_home_dirs(avahi_t) @@ -104,6 +109,10 @@ optional_policy(` ') optional_policy(` + rpcbind_signull(avahi_t) +') + +optional_policy(` seutil_sigchld_newrole(avahi_t) ') diff --git a/awstats.if b/awstats.if index 283ff0d..53f9ba1 100644 --- a/awstats.if +++ b/awstats.if @@ -5,6 +5,25 @@ ######################################## ## +## Execute the awstats program in the awstats domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`awstats_domtrans',` + gen_require(` + type awstats_t, awstats_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, awstats_exec_t, awstats_t) +') + +######################################## +## ## Read and write awstats unnamed pipes. ## ## diff --git a/awstats.te b/awstats.te index 6bd3ad3..5f88742 100644 --- a/awstats.te +++ b/awstats.te @@ -55,7 +55,6 @@ libs_read_lib_files(awstats_t) logging_read_generic_logs(awstats_t) -miscfiles_read_localization(awstats_t) sysnet_dns_name_resolve(awstats_t) diff --git a/backup.te b/backup.te index 0bfc958..81fc8bd 100644 --- a/backup.te +++ b/backup.te @@ -36,7 +36,6 @@ kernel_read_kernel_sysctls(backup_t) corecmd_exec_bin(backup_t) corecmd_exec_shell(backup_t) -corenet_all_recvfrom_unlabeled(backup_t) corenet_all_recvfrom_netlabel(backup_t) corenet_tcp_sendrecv_generic_if(backup_t) corenet_udp_sendrecv_generic_if(backup_t) @@ -70,7 +69,7 @@ logging_send_syslog_msg(backup_t) sysnet_read_config(backup_t) -userdom_use_user_terminals(backup_t) +userdom_use_inherited_user_terminals(backup_t) optional_policy(` cron_system_entry(backup_t, backup_exec_t) diff --git a/bacula.te b/bacula.te index fc4ba2a..813e5c1 100644 --- a/bacula.te +++ b/bacula.te @@ -111,7 +111,6 @@ domain_use_interactive_fds(bacula_admin_t) files_read_etc_files(bacula_admin_t) -miscfiles_read_localization(bacula_admin_t) sysnet_dns_name_resolve(bacula_admin_t) diff --git a/bcfg2.fc b/bcfg2.fc index f5413da..9e06a9d 100644 --- a/bcfg2.fc +++ b/bcfg2.fc @@ -1,5 +1,7 @@ /etc/rc\.d/init\.d/bcfg2 -- gen_context(system_u:object_r:bcfg2_initrc_exec_t,s0) +/usr/lib/systemd/system/bcfg2-server.* -- gen_context(system_u:object_r:bcfg2_unit_file_t,s0) + /usr/sbin/bcfg2-server -- gen_context(system_u:object_r:bcfg2_exec_t,s0) /var/lib/bcfg2(/.*)? gen_context(system_u:object_r:bcfg2_var_lib_t,s0) diff --git a/bcfg2.if b/bcfg2.if index b289d93..070f22b 100644 --- a/bcfg2.if +++ b/bcfg2.if @@ -115,6 +115,31 @@ interface(`bcfg2_manage_lib_dirs',` ######################################## ## +## Execute bcfg2 server in the bcfg2 domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`bcfg2_systemctl',` + gen_require(` + type bcfg2_t; + type bcfg2_unit_file_t; + ') + + systemd_exec_systemctl($1) + systemd_read_fifo_file_passwd_run($1) + allow $1 bcfg2_unit_file_t:file read_file_perms; + allow $1 bcfg2_unit_file_t:service manage_service_perms; + + ps_process_pattern($1, bcfg2_t) +') + + +######################################## +## ## All of the rules required to administrate ## an bcfg2 environment ## @@ -135,6 +160,7 @@ interface(`bcfg2_admin',` type bcfg2_t; type bcfg2_initrc_exec_t; type bcfg2_var_lib_t; + type bcfg2_unit_file_t; ') allow $1 bcfg2_t:process { ptrace signal_perms }; @@ -147,4 +173,13 @@ interface(`bcfg2_admin',` files_search_var_lib($1) admin_pattern($1, bcfg2_var_lib_t) + + bcfg2_systemctl($1) + admin_pattern($1, bcfg2_unit_file_t) + allow $1 bcfg2_unit_file_t:service all_service_perms; + + optional_policy(` + systemd_passwd_agent_exec($1) + systemd_read_fifo_file_passwd_run($1) + ') ') diff --git a/bcfg2.te b/bcfg2.te index cf8e59f..ad57d4a 100644 --- a/bcfg2.te +++ b/bcfg2.te @@ -15,6 +15,9 @@ init_script_file(bcfg2_initrc_exec_t) type bcfg2_var_lib_t; files_type(bcfg2_var_lib_t) +type bcfg2_unit_file_t; +systemd_unit_file(bcfg2_unit_file_t) + type bcfg2_var_run_t; files_pid_file(bcfg2_var_run_t) @@ -36,6 +39,8 @@ files_pid_filetrans(bcfg2_t, bcfg2_var_run_t, file ) kernel_read_system_state(bcfg2_t) +corenet_tcp_bind_cyphesis_port(bcfg2_t) + corecmd_exec_bin(bcfg2_t) dev_read_urand(bcfg2_t) @@ -47,5 +52,3 @@ files_read_usr_files(bcfg2_t) auth_use_nsswitch(bcfg2_t) logging_send_syslog_msg(bcfg2_t) - -miscfiles_read_localization(bcfg2_t) diff --git a/bind.fc b/bind.fc index 59aa54f..b01072c 100644 --- a/bind.fc +++ b/bind.fc @@ -4,6 +4,11 @@ /etc/rndc.* -- gen_context(system_u:object_r:named_conf_t,s0) /etc/rndc\.key -- gen_context(system_u:object_r:dnssec_t,s0) /etc/unbound(/.*)? gen_context(system_u:object_r:named_conf_t,s0) +/etc/unbound/.*\.key -- gen_context(system_u:object_r:dnssec_t,s0) +/etc/dnssec-trigger/dnssec_trigger_server\.key -- gen_context(system_u:object_r:dnssec_t,s0) + +/usr/lib/systemd/system/unbound.* -- gen_context(system_u:object_r:named_unit_file_t,s0) +/usr/lib/systemd/system/named.* -- gen_context(system_u:object_r:named_unit_file_t,s0) /usr/sbin/lwresd -- gen_context(system_u:object_r:named_exec_t,s0) /usr/sbin/named -- gen_context(system_u:object_r:named_exec_t,s0) diff --git a/bind.if b/bind.if index 44a1e3d..9b50c13 100644 --- a/bind.if +++ b/bind.if @@ -20,6 +20,29 @@ interface(`bind_initrc_domtrans',` ######################################## ## +## Execute bind server in the bind domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`bind_systemctl',` + gen_require(` + type named_unit_file_t; + type named_t; + ') + + systemd_exec_systemctl($1) + allow $1 named_unit_file_t:file read_file_perms; + allow $1 named_unit_file_t:service manage_service_perms; + + ps_process_pattern($1, named_t) +') + +######################################## +## ## Execute ndc in the ndc domain. ## ## @@ -186,7 +209,7 @@ interface(`bind_write_config',` ') write_files_pattern($1, named_conf_t, named_conf_t) - allow $1 named_conf_t:file setattr; + allow $1 named_conf_t:file setattr_file_perms; ') ######################################## @@ -210,6 +233,25 @@ interface(`bind_manage_config_dirs',` ######################################## ## +## Create, read, write, and delete +## BIND configuration files. +## +## +## +## Domain allowed access. +## +## +# +interface(`bind_manage_config',` + gen_require(` + type named_conf_t; + ') + + manage_files_pattern($1, named_conf_t, named_conf_t) +') + +######################################## +## ## Search the BIND cache directory. ## ## @@ -266,7 +308,7 @@ interface(`bind_setattr_pid_dirs',` type named_var_run_t; ') - allow $1 named_var_run_t:dir setattr; + allow $1 named_var_run_t:dir setattr_dir_perms; ') ######################################## @@ -284,7 +326,7 @@ interface(`bind_setattr_zone_dirs',` type named_zone_t; ') - allow $1 named_zone_t:dir setattr; + allow $1 named_zone_t:dir setattr_dir_perms; ') ######################################## @@ -308,6 +350,27 @@ interface(`bind_read_zone',` ######################################## ## +## Read BIND zone files. +## +## +## +## Domain allowed access. +## +## +# +interface(`bind_read_log',` + gen_require(` + type named_zone_t; + type named_log_t; + ') + + files_search_var($1) + allow $1 named_zone_t:dir search_dir_perms; + read_files_pattern($1, named_log_t, named_log_t) +') + +######################################## +## ## Manage BIND zone files. ## ## @@ -359,18 +422,26 @@ interface(`bind_udp_chat_named',` interface(`bind_admin',` gen_require(` type named_t, named_tmp_t, named_log_t; - type named_conf_t, named_var_lib_t, named_var_run_t; - type named_cache_t, named_zone_t; - type dnssec_t, ndc_t; - type named_initrc_exec_t; + type named_conf_t, named_var_run_t, named_cache_t; + type named_zone_t, named_initrc_exec_t; + type dnssec_t, ndc_t, named_keytab_t; + type named_unit_file_t; ') - allow $1 named_t:process { ptrace signal_perms }; + allow $1 named_t:process signal_perms; ps_process_pattern($1, named_t) - allow $1 ndc_t:process { ptrace signal_perms }; + tunable_policy(`deny_ptrace',`',` + allow $1 named_t:process ptrace; + ') + + allow $1 ndc_t:process signal_perms; ps_process_pattern($1, ndc_t) + tunable_policy(`deny_ptrace',`',` + allow $1 ndc_t:process ptrace; + ') + bind_run_ndc($1, $2) init_labeled_script_domtrans($1, named_initrc_exec_t) @@ -391,9 +462,12 @@ interface(`bind_admin',` admin_pattern($1, named_zone_t) admin_pattern($1, dnssec_t) - files_list_var_lib($1) - admin_pattern($1, named_var_lib_t) + admin_pattern($1, named_keytab_t) files_list_pids($1) admin_pattern($1, named_var_run_t) + + admin_pattern($1, named_unit_file_t) + bind_systemctl($1) + allow $1 named_unit_file_t:service all_service_perms; ') diff --git a/bind.te b/bind.te index 0968cb4..d81a285 100644 --- a/bind.te +++ b/bind.te @@ -6,6 +6,13 @@ policy_module(bind, 1.11.0) # ## +##

+## Allow BIND to bind apache port. +##

+## +gen_tunable(named_bind_http_port, false) + +## ##

## Allow BIND to write the master zone files. ## Generally this is used for dynamic DNS or zone transfers. @@ -16,6 +23,7 @@ gen_tunable(named_write_master_zones, false) # for DNSSEC key files type dnssec_t; files_security_file(dnssec_t) +files_mountpoint(dnssec_t) type named_t; type named_exec_t; @@ -27,7 +35,7 @@ init_system_domain(named_t, named_checkconf_exec_t) # A type for configuration files of named. type named_conf_t; -files_type(named_conf_t) +files_config_file(named_conf_t) files_mountpoint(named_conf_t) # for secondary zone files @@ -37,6 +45,9 @@ files_type(named_cache_t) type named_initrc_exec_t; init_script_file(named_initrc_exec_t) +type named_unit_file_t; +systemd_unit_file(named_unit_file_t) + type named_log_t; logging_log_file(named_log_t) @@ -89,9 +100,10 @@ manage_dirs_pattern(named_t, named_tmp_t, named_tmp_t) manage_files_pattern(named_t, named_tmp_t, named_tmp_t) files_tmp_filetrans(named_t, named_tmp_t, { file dir }) +manage_dirs_pattern(named_t, named_var_run_t, named_var_run_t) manage_files_pattern(named_t, named_var_run_t, named_var_run_t) manage_sock_files_pattern(named_t, named_var_run_t, named_var_run_t) -files_pid_filetrans(named_t, named_var_run_t, { file sock_file }) +files_pid_filetrans(named_t, named_var_run_t, { file sock_file dir }) # read zone files allow named_t named_zone_t:dir list_dir_perms; @@ -104,7 +116,6 @@ kernel_read_network_state(named_t) corecmd_search_bin(named_t) -corenet_all_recvfrom_unlabeled(named_t) corenet_all_recvfrom_netlabel(named_t) corenet_tcp_sendrecv_generic_if(named_t) corenet_udp_sendrecv_generic_if(named_t) @@ -131,7 +142,6 @@ dev_read_urand(named_t) domain_use_interactive_fds(named_t) -files_read_etc_files(named_t) files_read_etc_runtime_files(named_t) fs_getattr_all_fs(named_t) @@ -141,12 +151,15 @@ auth_use_nsswitch(named_t) logging_send_syslog_msg(named_t) -miscfiles_read_localization(named_t) miscfiles_read_generic_certs(named_t) userdom_dontaudit_use_unpriv_user_fds(named_t) userdom_dontaudit_search_user_home_dirs(named_t) +tunable_policy(`named_bind_http_port',` + corenet_tcp_bind_http_port(named_t) +') + tunable_policy(`named_write_master_zones',` manage_dirs_pattern(named_t, named_zone_t, named_zone_t) manage_files_pattern(named_t, named_zone_t, named_zone_t) @@ -154,6 +167,12 @@ tunable_policy(`named_write_master_zones',` ') optional_policy(` + # needed by FreeIPA with DNS support + dirsrv_stream_connect(named_t) + ldap_stream_connect(named_t) +') + +optional_policy(` init_dbus_chat_script(named_t) sysnet_dbus_chat_dhcpc(named_t) @@ -199,6 +218,7 @@ optional_policy(` # cjp: why net_admin?! allow ndc_t self:capability { dac_override net_admin }; +allow ndc_t self:capability2 block_suspend; allow ndc_t self:process { fork signal_perms }; allow ndc_t self:fifo_file rw_fifo_file_perms; allow ndc_t self:unix_stream_socket { connect create_stream_socket_perms }; @@ -211,13 +231,13 @@ allow ndc_t dnssec_t:lnk_file { getattr read }; stream_connect_pattern(ndc_t, named_var_run_t, named_var_run_t, named_t) allow ndc_t named_conf_t:file read_file_perms; -allow ndc_t named_conf_t:lnk_file { getattr read }; +allow ndc_t named_conf_t:lnk_file read_lnk_file_perms; allow ndc_t named_zone_t:dir search_dir_perms; +kernel_read_system_state(ndc_t) kernel_read_kernel_sysctls(ndc_t) -corenet_all_recvfrom_unlabeled(ndc_t) corenet_all_recvfrom_netlabel(ndc_t) corenet_tcp_sendrecv_generic_if(ndc_t) corenet_tcp_sendrecv_generic_node(ndc_t) @@ -228,28 +248,26 @@ corenet_sendrecv_rndc_client_packets(ndc_t) domain_use_interactive_fds(ndc_t) -files_read_etc_files(ndc_t) files_search_pids(ndc_t) fs_getattr_xattr_fs(ndc_t) +auth_use_nsswitch(ndc_t) + init_use_fds(ndc_t) init_use_script_ptys(ndc_t) logging_send_syslog_msg(ndc_t) -miscfiles_read_localization(ndc_t) +userdom_use_inherited_user_terminals(ndc_t) sysnet_read_config(ndc_t) -sysnet_dns_name_resolve(ndc_t) - -userdom_use_user_terminals(ndc_t) term_dontaudit_use_console(ndc_t) # for /etc/rndc.key ifdef(`distro_redhat',` - allow ndc_t named_conf_t:dir search; + allow ndc_t named_conf_t:dir search_dir_perms; ') optional_policy(` diff --git a/bitlbee.fc b/bitlbee.fc index 0197980..909ce04 100644 --- a/bitlbee.fc +++ b/bitlbee.fc @@ -1,6 +1,13 @@ /etc/rc\.d/init\.d/bitlbee -- gen_context(system_u:object_r:bitlbee_initrc_exec_t,s0) /etc/bitlbee(/.*)? gen_context(system_u:object_r:bitlbee_conf_t,s0) +/usr/bin/bip -- gen_context(system_u:object_r:bitlbee_exec_t,s0) /usr/sbin/bitlbee -- gen_context(system_u:object_r:bitlbee_exec_t,s0) /var/lib/bitlbee(/.*)? gen_context(system_u:object_r:bitlbee_var_t,s0) + +/var/log/bip(/.*)? gen_context(system_u:object_r:bitlbee_log_t,s0) + +/var/run/bitlbee\.pid -- gen_context(system_u:object_r:bitlbee_var_run_t,s0) +/var/run/bitlbee\.sock -s gen_context(system_u:object_r:bitlbee_var_run_t,s0) +/var/run/bip(/.*)? gen_context(system_u:object_r:bitlbee_var_run_t,s0) diff --git a/bitlbee.if b/bitlbee.if index de0bd67..1df2048 100644 --- a/bitlbee.if +++ b/bitlbee.if @@ -43,9 +43,13 @@ interface(`bitlbee_admin',` type bitlbee_initrc_exec_t; ') - allow $1 bitlbee_t:process { ptrace signal_perms }; + allow $1 bitlbee_t:process signal_perms; ps_process_pattern($1, bitlbee_t) + tunable_policy(`deny_ptrace',`',` + allow $1 bitlbee_t:process ptrace; + ') + init_labeled_script_domtrans($1, bitlbee_initrc_exec_t) domain_system_change_exemption($1) role_transition $2 bitlbee_initrc_exec_t system_r; diff --git a/bitlbee.te b/bitlbee.te index f4e7ad3..5929e57 100644 --- a/bitlbee.te +++ b/bitlbee.te @@ -22,36 +22,56 @@ files_tmp_file(bitlbee_tmp_t) type bitlbee_var_t; files_type(bitlbee_var_t) +type bitlbee_log_t; +logging_log_file(bitlbee_log_t) + +type bitlbee_var_run_t; +files_pid_file(bitlbee_var_run_t) + ######################################## # # Local policy # -allow bitlbee_t self:capability { setgid setuid }; -allow bitlbee_t self:process signal; +allow bitlbee_t self:capability { dac_override kill setgid setuid sys_nice }; +allow bitlbee_t self:process { setsched signal }; + +allow bitlbee_t self:fifo_file rw_fifo_file_perms; allow bitlbee_t self:udp_socket create_socket_perms; allow bitlbee_t self:tcp_socket { create_stream_socket_perms connected_stream_socket_perms }; allow bitlbee_t self:unix_stream_socket create_stream_socket_perms; -allow bitlbee_t self:fifo_file rw_fifo_file_perms; +allow bitlbee_t self:netlink_route_socket r_netlink_socket_perms; bitlbee_read_config(bitlbee_t) # tmp files manage_files_pattern(bitlbee_t, bitlbee_tmp_t, bitlbee_tmp_t) -files_tmp_filetrans(bitlbee_t, bitlbee_tmp_t, file) +manage_dirs_pattern(bitlbee_t, bitlbee_tmp_t, bitlbee_tmp_t) +files_tmp_filetrans(bitlbee_t, bitlbee_tmp_t, { dir file }) # user account information is read and edited at runtime; give the usual # r/w access to bitlbee_var_t manage_files_pattern(bitlbee_t, bitlbee_var_t, bitlbee_var_t) files_var_lib_filetrans(bitlbee_t, bitlbee_var_t, file) +# log files +manage_dirs_pattern(bitlbee_t, bitlbee_log_t, bitlbee_log_t) +manage_files_pattern(bitlbee_t, bitlbee_log_t, bitlbee_log_t) + +manage_dirs_pattern(bitlbee_t, bitlbee_var_run_t, bitlbee_var_run_t) +manage_files_pattern(bitlbee_t, bitlbee_var_run_t, bitlbee_var_run_t) +manage_sock_files_pattern(bitlbee_t, bitlbee_var_run_t, bitlbee_var_run_t) +files_pid_filetrans(bitlbee_t, bitlbee_var_run_t, { dir file sock_file }) + kernel_read_system_state(bitlbee_t) -corenet_all_recvfrom_unlabeled(bitlbee_t) corenet_udp_sendrecv_generic_if(bitlbee_t) corenet_udp_sendrecv_generic_node(bitlbee_t) corenet_tcp_sendrecv_generic_if(bitlbee_t) corenet_tcp_sendrecv_generic_node(bitlbee_t) +corenet_tcp_bind_generic_node(bitlbee_t) +corenet_tcp_connect_gatekeeper_port(bitlbee_t) +corenet_tcp_connect_ircd_port(bitlbee_t) # Allow bitlbee to connect to jabber servers corenet_tcp_connect_jabber_client_port(bitlbee_t) corenet_tcp_sendrecv_jabber_client_port(bitlbee_t) @@ -69,11 +89,15 @@ corenet_tcp_connect_http_port(bitlbee_t) corenet_tcp_sendrecv_http_port(bitlbee_t) corenet_tcp_connect_http_cache_port(bitlbee_t) corenet_tcp_sendrecv_http_cache_port(bitlbee_t) +corenet_tcp_bind_ircd_port(bitlbee_t) +corenet_tcp_sendrecv_ircd_port(bitlbee_t) +corenet_sendrecv_ircd_server_packets(bitlbee_t) +corenet_tcp_bind_interwise_port(bitlbee_t) +corenet_tcp_sendrecv_interwise_port(bitlbee_t) dev_read_rand(bitlbee_t) dev_read_urand(bitlbee_t) -files_read_etc_files(bitlbee_t) files_search_pids(bitlbee_t) # grant read-only access to the user help files files_read_usr_files(bitlbee_t) @@ -84,10 +108,6 @@ auth_use_nsswitch(bitlbee_t) logging_send_syslog_msg(bitlbee_t) -miscfiles_read_localization(bitlbee_t) - -sysnet_dns_name_resolve(bitlbee_t) - optional_policy(` # normally started from inetd using tcpwrappers, so use those entry points tcpd_wrapped_domain(bitlbee_t, bitlbee_exec_t) diff --git a/blueman.fc b/blueman.fc index 6355318..98ba16a 100644 --- a/blueman.fc +++ b/blueman.fc @@ -1,3 +1,4 @@ + /usr/libexec/blueman-mechanism -- gen_context(system_u:object_r:blueman_exec_t,s0) /var/lib/blueman(/.*)? gen_context(system_u:object_r:blueman_var_lib_t,s0) diff --git a/blueman.te b/blueman.te index 70969fa..1adc748 100644 --- a/blueman.te +++ b/blueman.te @@ -7,7 +7,6 @@ policy_module(blueman, 1.0.0) type blueman_t; type blueman_exec_t; -dbus_system_domain(blueman_t, blueman_exec_t) init_daemon_domain(blueman_t, blueman_exec_t) type blueman_var_lib_t; @@ -39,8 +38,18 @@ auth_use_nsswitch(blueman_t) logging_send_syslog_msg(blueman_t) -miscfiles_read_localization(blueman_t) - optional_policy(` avahi_domtrans(blueman_t) ') + +optional_policy(` + dbus_system_domain(blueman_t, blueman_exec_t) +') + +optional_policy(` + gnome_search_gconf(blueman_t) +') + +optional_policy(` + xserver_read_state_xdm(blueman_t) +') diff --git a/bluetooth.fc b/bluetooth.fc index dc687e6..e0255eb 100644 --- a/bluetooth.fc +++ b/bluetooth.fc @@ -7,6 +7,8 @@ /etc/rc\.d/init\.d/dund -- gen_context(system_u:object_r:bluetooth_initrc_exec_t,s0) /etc/rc\.d/init\.d/pand -- gen_context(system_u:object_r:bluetooth_initrc_exec_t,s0) +/usr/lib/systemd/system/bluetooth.* -- gen_context(system_u:object_r:bluetooth_unit_file_t,s0) + # # /usr # diff --git a/bluetooth.if b/bluetooth.if index 3e45431..540f783 100644 --- a/bluetooth.if +++ b/bluetooth.if @@ -27,7 +27,11 @@ interface(`bluetooth_role',` # allow ps to show cdrecord and allow the user to kill it ps_process_pattern($2, bluetooth_helper_t) - allow $2 bluetooth_helper_t:process signal; + allow $2 bluetooth_helper_t:process signal_perms; + + tunable_policy(`deny_ptrace',`',` + allow $2 bluetooth_helper_t:process ptrace; + ') manage_dirs_pattern($2, bluetooth_helper_tmp_t, bluetooth_helper_tmp_t) manage_files_pattern($2, bluetooth_helper_tmp_t, bluetooth_helper_tmp_t) @@ -35,6 +39,8 @@ interface(`bluetooth_role',` manage_dirs_pattern($2, bluetooth_helper_tmpfs_t, bluetooth_helper_tmpfs_t) manage_files_pattern($2, bluetooth_helper_tmpfs_t, bluetooth_helper_tmpfs_t) + + bluetooth_stream_connect($2) ') ##################################### @@ -91,7 +97,7 @@ interface(`bluetooth_read_config',` type bluetooth_conf_t; ') - allow $1 bluetooth_conf_t:file { getattr read ioctl }; + allow $1 bluetooth_conf_t:file read_file_perms; ') ######################################## @@ -117,6 +123,27 @@ interface(`bluetooth_dbus_chat',` ######################################## ##

+## dontaudit Send and receive messages from +## bluetooth over dbus. +## +## +## +## Domain to not audit. +## +## +# +interface(`bluetooth_dontaudit_dbus_chat',` + gen_require(` + type bluetooth_t; + class dbus send_msg; + ') + + dontaudit $1 bluetooth_t:dbus send_msg; + dontaudit bluetooth_t $1:dbus send_msg; +') + +######################################## +## ## Execute bluetooth_helper in the bluetooth_helper domain. (Deprecated) ## ## @@ -157,7 +184,7 @@ interface(`bluetooth_run_helper',` ######################################## ## -## Read bluetooth helper state files. +## Do not audit attempts to read bluetooth helper state files. ## ## ## @@ -170,8 +197,31 @@ interface(`bluetooth_dontaudit_read_helper_state',` type bluetooth_helper_t; ') - dontaudit $1 bluetooth_helper_t:dir search; - dontaudit $1 bluetooth_helper_t:file { read getattr }; + dontaudit $1 bluetooth_helper_t:dir search_dir_perms; + dontaudit $1 bluetooth_helper_t:file read_file_perms; +') + +######################################## +## +## Execute bluetooth server in the bluetooth domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`bluetooth_systemctl',` + gen_require(` + type bluetooth_t; + type bluetooth_unit_file_t; + ') + + systemd_exec_systemctl($1) + allow $1 bluetooth_unit_file_t:file read_file_perms; + allow $1 bluetooth_unit_file_t:service manage_service_perms; + + ps_process_pattern($1, bluetooth_t) ') ######################################## @@ -193,15 +243,19 @@ interface(`bluetooth_dontaudit_read_helper_state',` # interface(`bluetooth_admin',` gen_require(` - type bluetooth_t, bluetooth_tmp_t, bluetooth_lock_t; - type bluetooth_spool_t, bluetooth_var_lib_t, bluetooth_var_run_t; + type bluetooth_t, bluetooth_lock_t; + type bluetooth_var_lib_t, bluetooth_var_run_t, bluetooth_initrc_exec_t; type bluetooth_conf_t, bluetooth_conf_rw_t; - type bluetooth_initrc_exec_t; + type bluetooth_unit_file_t; ') - allow $1 bluetooth_t:process { ptrace signal_perms }; + allow $1 bluetooth_t:process signal_perms; ps_process_pattern($1, bluetooth_t) + tunable_policy(`deny_ptrace',`',` + allow $1 bluetooth_t:process ptrace; + ') + init_labeled_script_domtrans($1, bluetooth_initrc_exec_t) domain_system_change_exemption($1) role_transition $2 bluetooth_initrc_exec_t system_r; @@ -225,4 +279,8 @@ interface(`bluetooth_admin',` files_list_pids($1) admin_pattern($1, bluetooth_var_run_t) + + bluetooth_systemctl($1) + admin_pattern($1, bluetooth_unit_file_t) + allow $1 bluetooth_unit_file_t:service all_service_perms; ') diff --git a/bluetooth.te b/bluetooth.te index d3019b3..aed14bb 100644 --- a/bluetooth.te +++ b/bluetooth.te @@ -4,12 +4,13 @@ policy_module(bluetooth, 3.4.0) # # Declarations # + type bluetooth_t; type bluetooth_exec_t; init_daemon_domain(bluetooth_t, bluetooth_exec_t) type bluetooth_conf_t; -files_type(bluetooth_conf_t) +files_config_file(bluetooth_conf_t) type bluetooth_conf_rw_t; files_type(bluetooth_conf_rw_t) @@ -45,6 +46,9 @@ files_type(bluetooth_var_lib_t) type bluetooth_var_run_t; files_pid_file(bluetooth_var_run_t) +type bluetooth_unit_file_t; +systemd_unit_file(bluetooth_unit_file_t) + ######################################## # # Bluetooth services local policy @@ -96,7 +100,6 @@ kernel_request_load_module(bluetooth_t) #search debugfs - redhat bug 548206 kernel_search_debugfs(bluetooth_t) -corenet_all_recvfrom_unlabeled(bluetooth_t) corenet_all_recvfrom_netlabel(bluetooth_t) corenet_tcp_sendrecv_generic_if(bluetooth_t) corenet_udp_sendrecv_generic_if(bluetooth_t) @@ -127,7 +130,6 @@ corecmd_exec_shell(bluetooth_t) domain_use_interactive_fds(bluetooth_t) domain_dontaudit_search_all_domains_state(bluetooth_t) -files_read_etc_files(bluetooth_t) files_read_etc_runtime_files(bluetooth_t) files_read_usr_files(bluetooth_t) @@ -135,7 +137,6 @@ auth_use_nsswitch(bluetooth_t) logging_send_syslog_msg(bluetooth_t) -miscfiles_read_localization(bluetooth_t) miscfiles_read_fonts(bluetooth_t) miscfiles_read_hwdata(bluetooth_t) @@ -144,6 +145,10 @@ userdom_dontaudit_use_user_terminals(bluetooth_t) userdom_dontaudit_search_user_home_dirs(bluetooth_t) optional_policy(` + devicekit_dbus_chat_power(bluetooth_t) +') + +optional_policy(` dbus_system_bus_client(bluetooth_t) dbus_connect_system_bus(bluetooth_t) @@ -212,17 +217,16 @@ corecmd_exec_shell(bluetooth_helper_t) domain_read_all_domains_state(bluetooth_helper_t) -files_read_etc_files(bluetooth_helper_t) files_read_etc_runtime_files(bluetooth_helper_t) files_read_usr_files(bluetooth_helper_t) files_dontaudit_list_default(bluetooth_helper_t) +auth_use_nsswitch(bluetooth_helper_t) + locallogin_dontaudit_use_fds(bluetooth_helper_t) logging_send_syslog_msg(bluetooth_helper_t) -miscfiles_read_localization(bluetooth_helper_t) - sysnet_read_config(bluetooth_helper_t) optional_policy(` diff --git a/boinc.fc b/boinc.fc new file mode 100644 index 0000000..bda740a --- /dev/null +++ b/boinc.fc @@ -0,0 +1,12 @@ + +/etc/rc\.d/init\.d/boinc-client -- gen_context(system_u:object_r:boinc_initrc_exec_t,s0) + +/usr/bin/boinc_client -- gen_context(system_u:object_r:boinc_exec_t,s0) + +/usr/lib/systemd/system/boinc-client\.service -- gen_context(system_u:object_r:boinc_unit_file_t,s0) + +/var/lib/boinc(/.*)? gen_context(system_u:object_r:boinc_var_lib_t,s0) +/var/lib/boinc/projects(/.*)? gen_context(system_u:object_r:boinc_project_var_lib_t,s0) +/var/lib/boinc/slots(/.*)? gen_context(system_u:object_r:boinc_project_var_lib_t,s0) + +/var/log/boinc\.log.* -- gen_context(system_u:object_r:boinc_log_t,s0) diff --git a/boinc.if b/boinc.if new file mode 100644 index 0000000..9d891b7 --- /dev/null +++ b/boinc.if @@ -0,0 +1,188 @@ +## policy for boinc + +######################################## +## +## Execute a domain transition to run boinc. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`boinc_domtrans',` + gen_require(` + type boinc_t, boinc_exec_t; + ') + + domtrans_pattern($1, boinc_exec_t, boinc_t) +') + +####################################### +## +## Execute boinc server in the boinc domain. +## +## +## +## Domain allowed access. +## +## +# +interface(`boinc_initrc_domtrans',` + gen_require(` + type boinc_initrc_exec_t; + ') + + init_labeled_script_domtrans($1, boinc_initrc_exec_t) +') + +######################################## +## +## Search boinc lib directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`boinc_search_lib',` + gen_require(` + type boinc_var_lib_t; + ') + + allow $1 boinc_var_lib_t:dir search_dir_perms; + files_search_var_lib($1) +') + +######################################## +## +## Read boinc lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`boinc_read_lib_files',` + gen_require(` + type boinc_var_lib_t; + ') + + files_search_var_lib($1) + read_files_pattern($1, boinc_var_lib_t, boinc_var_lib_t) +') + +######################################## +## +## Create, read, write, and delete +## boinc lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`boinc_manage_lib_files',` + gen_require(` + type boinc_var_lib_t; + ') + + files_search_var_lib($1) + manage_files_pattern($1, boinc_var_lib_t, boinc_var_lib_t) +') + +######################################## +## +## Manage boinc var_lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`boinc_manage_var_lib',` + gen_require(` + type boinc_var_lib_t; + ') + + files_search_var_lib($1) + manage_dirs_pattern($1, boinc_var_lib_t, boinc_var_lib_t) + manage_files_pattern($1, boinc_var_lib_t, boinc_var_lib_t) + manage_lnk_files_pattern($1, boinc_var_lib_t, boinc_var_lib_t) +') + +####################################### +## +## Execute boinc server in the boinc domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`boinc_systemctl',` + gen_require(` + type boinc_t; + type boinc_unit_file_t; + ') + + systemd_exec_systemctl($1) + allow $1 boinc_unit_file_t:file read_file_perms; + allow $1 boinc_unit_file_t:service manage_service_perms; + + ps_process_pattern($1, boinc_t) +') + +######################################## +## +## All of the rules required to administrate +## an boinc environment. +## +## +## +## Domain allowed access. +## +## +## +## +## Role allowed access. +## +## +## +# +interface(`boinc_admin',` + gen_require(` + type boinc_t, boinc_initrc_exec_t, boinc_var_lib_t; + type boinc_unit_file_t; + ') + + allow $1 boinc_t:process signal_perms; + ps_process_pattern($1, boinc_t) + + tunable_policy(`deny_ptrace',`',` + allow $1 boic_t:process ptrace; + ') + + boinc_initrc_domtrans($1) + domain_system_change_exemption($1) + role_transition $2 boinc_initrc_exec_t system_r; + allow $2 system_r; + + files_list_var_lib($1) + admin_pattern($1, boinc_var_lib_t) + + boinc_systemctl($1) + admin_pattern($1, boinc_unit_file_t) + + allow $1 boinc_unit_file_t:service all_service_perms; + + optional_policy(` + systemd_passwd_agent_exec($1) + systemd_read_fifo_file_passwd_run($1) + ') +') diff --git a/boinc.te b/boinc.te new file mode 100644 index 0000000..5c1ab25 --- /dev/null +++ b/boinc.te @@ -0,0 +1,198 @@ +policy_module(boinc, 1.0.0) + +######################################## +# +# Declarations +# + +attribute boinc_domain; + +type boinc_t, boinc_domain; +type boinc_exec_t; +init_daemon_domain(boinc_t, boinc_exec_t) + +type boinc_initrc_exec_t; +init_script_file(boinc_initrc_exec_t) + +type boinc_tmp_t; +files_tmp_file(boinc_tmp_t) + +type boinc_tmpfs_t; +files_tmpfs_file(boinc_tmpfs_t) + +type boinc_var_lib_t; +files_type(boinc_var_lib_t) + +type boinc_log_t; +logging_log_file(boinc_log_t) + +type boinc_unit_file_t; +systemd_unit_file(boinc_unit_file_t) + +type boinc_project_t; +domain_type(boinc_project_t) +role system_r types boinc_project_t; + +type boinc_project_tmp_t; +files_tmp_file(boinc_project_tmp_t) + +type boinc_project_var_lib_t; +files_type(boinc_project_var_lib_t) + +####################################### +# +# boinc domain local policy +# + +allow boinc_domain self:fifo_file rw_fifo_file_perms; +allow boinc_domain self:sem create_sem_perms; + +manage_dirs_pattern(boinc_domain, boinc_var_lib_t, boinc_var_lib_t) +manage_files_pattern(boinc_domain, boinc_var_lib_t, boinc_var_lib_t) +manage_lnk_files_pattern(boinc_domain, boinc_var_lib_t, boinc_var_lib_t) + +# needs read /proc/interrupts +kernel_read_system_state(boinc_domain) + +corecmd_exec_bin(boinc_domain) +corecmd_exec_shell(boinc_domain) + +dev_read_rand(boinc_domain) +dev_read_urand(boinc_domain) +dev_read_sysfs(boinc_domain) +dev_rw_xserver_misc(boinc_domain) + +domain_read_all_domains_state(boinc_domain) + +files_read_etc_files(boinc_domain) +files_read_etc_runtime_files(boinc_domain) +files_read_usr_files(boinc_domain) + +fs_getattr_all_fs(boinc_domain) + +miscfiles_read_fonts(boinc_domain) + +optional_policy(` + sysnet_dns_name_resolve(boinc_domain) +') + +######################################## +# +# boinc local policy +# + +allow boinc_t self:process { setsched setpgid signull sigkill }; + +allow boinc_t self:unix_stream_socket create_stream_socket_perms; +allow boinc_t self:tcp_socket create_stream_socket_perms; +allow boinc_t self:shm create_shm_perms; + +manage_dirs_pattern(boinc_t, boinc_tmp_t, boinc_tmp_t) +manage_files_pattern(boinc_t, boinc_tmp_t, boinc_tmp_t) +files_tmp_filetrans(boinc_t, boinc_tmp_t, { dir file }) + +manage_files_pattern(boinc_t, boinc_tmpfs_t, boinc_tmpfs_t) +fs_tmpfs_filetrans(boinc_t, boinc_tmpfs_t, file) + +exec_files_pattern(boinc_t, boinc_var_lib_t, boinc_var_lib_t) +# this should be created by default by boinc +# we need this label for transition to boinc_project_t +# other boinc lib files will end up with boinc_var_lib_t +filetrans_pattern(boinc_t, boinc_var_lib_t, boinc_project_var_lib_t, dir, "slots") +filetrans_pattern(boinc_t, boinc_var_lib_t, boinc_project_var_lib_t, dir, "projects") + +manage_dirs_pattern(boinc_t, boinc_project_var_lib_t, boinc_project_var_lib_t) +manage_files_pattern(boinc_t, boinc_project_var_lib_t, boinc_project_var_lib_t) + +manage_files_pattern(boinc_t, boinc_log_t, boinc_log_t) +logging_log_filetrans(boinc_t, boinc_log_t, { file }) + +kernel_search_vm_sysctl(boinc_t) + +files_getattr_all_dirs(boinc_t) +files_getattr_all_files(boinc_t) + +corenet_all_recvfrom_netlabel(boinc_t) +corenet_tcp_sendrecv_generic_if(boinc_t) +corenet_udp_sendrecv_generic_if(boinc_t) +corenet_tcp_sendrecv_generic_node(boinc_t) +corenet_udp_sendrecv_generic_node(boinc_t) +corenet_tcp_sendrecv_all_ports(boinc_t) +corenet_udp_sendrecv_all_ports(boinc_t) +corenet_tcp_bind_generic_node(boinc_t) +corenet_udp_bind_generic_node(boinc_t) +corenet_tcp_bind_boinc_port(boinc_t) +corenet_tcp_bind_boinc_client_ctrl_port(boinc_t) +corenet_tcp_connect_boinc_port(boinc_t) +corenet_tcp_connect_http_port(boinc_t) +corenet_tcp_connect_http_cache_port(boinc_t) + +files_dontaudit_getattr_boot_dirs(boinc_t) + +auth_read_passwd(boinc_t) + +term_getattr_all_ptys(boinc_t) +term_getattr_unallocated_ttys(boinc_t) + +init_read_utmp(boinc_t) + +logging_send_syslog_msg(boinc_t) + +optional_policy(` + mta_send_mail(boinc_t) +') + +######################################## +# +# boinc-projects local policy +# + +allow boinc_project_t self:capability { setuid setgid }; + +domtrans_pattern(boinc_t, boinc_project_var_lib_t, boinc_project_t) +allow boinc_t boinc_project_t:process sigkill; +allow boinc_t boinc_project_t:process noatsecure; + +allow boinc_project_t self:process { ptrace setcap getcap setpgid setsched signal signull sigkill sigstop }; +allow boinc_project_t self:process { execmem execstack }; + +manage_dirs_pattern(boinc_project_t, boinc_project_tmp_t, boinc_project_tmp_t) +manage_files_pattern(boinc_project_t, boinc_project_tmp_t, boinc_project_tmp_t) +manage_sock_files_pattern(boinc_project_t, boinc_project_tmp_t, boinc_project_tmp_t) +files_tmp_filetrans(boinc_project_t, boinc_project_tmp_t, { dir file sock_file}) + +allow boinc_project_t boinc_project_var_lib_t:file entrypoint; +exec_files_pattern(boinc_project_t, boinc_project_var_lib_t, boinc_project_var_lib_t) +manage_dirs_pattern(boinc_project_t, boinc_project_var_lib_t, boinc_project_var_lib_t) +manage_files_pattern(boinc_project_t, boinc_project_var_lib_t, boinc_project_var_lib_t) +files_var_lib_filetrans(boinc_project_t, boinc_project_var_lib_t, dir, "projects") +files_var_lib_filetrans(boinc_project_t, boinc_project_var_lib_t, dir, "slots" ) + +allow boinc_project_t boinc_project_var_lib_t:file execmod; + +allow boinc_project_t boinc_t:shm rw_shm_perms; +allow boinc_project_t boinc_tmpfs_t:file rw_inherited_file_perms; + +kernel_read_kernel_sysctls(boinc_project_t) +kernel_search_vm_sysctl(boinc_project_t) +kernel_read_network_state(boinc_project_t) + +corenet_tcp_connect_boinc_port(boinc_project_t) + +files_dontaudit_search_home(boinc_project_t) + +# needed by java +fs_read_hugetlbfs_files(boinc_project_t) + +optional_policy(` + gnome_read_gconf_config(boinc_project_t) +') + +optional_policy(` + java_exec(boinc_project_t) +') + +# until solution for VirtualBox, java .. +optional_policy(` + unconfined_domain(boinc_project_t) +') diff --git a/brctl.if b/brctl.if index 2c2cdb6..73b3814 100644 --- a/brctl.if +++ b/brctl.if @@ -18,3 +18,28 @@ interface(`brctl_domtrans',` corecmd_search_bin($1) domtrans_pattern($1, brctl_exec_t, brctl_t) ') + +##################################### +## +## Execute brctl in the brctl domain. +## +## +## +## Domain allowed to transition. +## +## +## +## +## Role allowed access. +## +## +## +# +interface(`brctl_run',` + gen_require(` + type brctl_t, brctl_exec_t; + ') + + brctl_domtrans($1) + role $2 types brctl_t; +') diff --git a/brctl.te b/brctl.te index 9a62a1d..283f4fa 100644 --- a/brctl.te +++ b/brctl.te @@ -36,7 +36,6 @@ files_read_etc_files(brctl_t) term_dontaudit_use_console(brctl_t) -miscfiles_read_localization(brctl_t) optional_policy(` xen_append_log(brctl_t) diff --git a/bugzilla.if b/bugzilla.if index de89d0f..86e4ee7 100644 --- a/bugzilla.if +++ b/bugzilla.if @@ -48,23 +48,24 @@ interface(`bugzilla_dontaudit_rw_stream_sockets',` ## Domain allowed access. ## ## -## -## -## The role to be allowed to manage the bugzilla domain. -## -## -## # interface(`bugzilla_admin',` gen_require(` type httpd_bugzilla_script_t, httpd_bugzilla_content_t, httpd_bugzilla_ra_content_t; type httpd_bugzilla_rw_content_t, httpd_bugzilla_script_exec_t; - type httpd_bugzilla_htaccess_t; + type httpd_bugzilla_htaccess_t, httpd_bugzilla_tmp_t; ') - allow $1 httpd_bugzilla_script_t:process { ptrace signal_perms }; + allow $1 httpd_bugzilla_script_t:process signal_perms; ps_process_pattern($1, httpd_bugzilla_script_t) + tunable_policy(`deny_ptrace',`',` + allow $1 httpd_bugzilla_script_t:process ptrace; + ') + + files_list_tmp($1) + admin_pattern($1, httpd_bugzilla_tmp_t) + files_list_var_lib(httpd_bugzilla_script_t) apache_list_sys_content($1) diff --git a/bugzilla.te b/bugzilla.te index 048abbf..dece084 100644 --- a/bugzilla.te +++ b/bugzilla.te @@ -7,6 +7,9 @@ policy_module(bugzilla, 1.0.0) apache_content_template(bugzilla) +type httpd_bugzilla_tmp_t; +files_tmp_file(httpd_bugzilla_tmp_t) + ######################################## # # bugzilla local policy @@ -16,7 +19,6 @@ allow httpd_bugzilla_script_t self:netlink_route_socket r_netlink_socket_perms; allow httpd_bugzilla_script_t self:tcp_socket create_stream_socket_perms; allow httpd_bugzilla_script_t self:udp_socket create_socket_perms; -corenet_all_recvfrom_unlabeled(httpd_bugzilla_script_t) corenet_all_recvfrom_netlabel(httpd_bugzilla_script_t) corenet_tcp_sendrecv_generic_if(httpd_bugzilla_script_t) corenet_udp_sendrecv_generic_if(httpd_bugzilla_script_t) @@ -31,8 +33,14 @@ corenet_tcp_connect_smtp_port(httpd_bugzilla_script_t) corenet_sendrecv_postgresql_client_packets(httpd_bugzilla_script_t) corenet_sendrecv_mysqld_client_packets(httpd_bugzilla_script_t) +manage_dirs_pattern(httpd_bugzilla_script_t, httpd_bugzilla_tmp_t, httpd_bugzilla_tmp_t) +manage_files_pattern(httpd_bugzilla_script_t, httpd_bugzilla_tmp_t, httpd_bugzilla_tmp_t) +files_tmp_filetrans(httpd_bugzilla_script_t, httpd_bugzilla_tmp_t, { file dir }) + files_search_var_lib(httpd_bugzilla_script_t) +auth_read_passwd(httpd_bugzilla_script_t) + sysnet_read_config(httpd_bugzilla_script_t) sysnet_use_ldap(httpd_bugzilla_script_t) diff --git a/cachefilesd.fc b/cachefilesd.fc new file mode 100644 index 0000000..aa03fc8 --- /dev/null +++ b/cachefilesd.fc @@ -0,0 +1,34 @@ +############################################################################### +# +# Copyright (C) 2006 Red Hat, Inc. All Rights Reserved. +# Written by David Howells (dhowells@redhat.com) +# Karl MacMillan (kmacmill@redhat.com) +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public License +# as published by the Free Software Foundation; either version +# 2 of the License, or (at your option) any later version. +# +############################################################################### + +# +# Define the contexts to be assigned to various files and directories of +# importance to the CacheFiles kernel module and userspace management daemon. +# + +# cachefilesd executable will have: +# label: system_u:object_r:cachefilesd_exec_t +# MLS sensitivity: s0 +# MCS categories: + +/dev/cachefiles -c gen_context(system_u:object_r:cachefiles_dev_t,s0) + +/sbin/cachefilesd -- gen_context(system_u:object_r:cachefilesd_exec_t,s0) + +/usr/sbin/cachefilesd -- gen_context(system_u:object_r:cachefilesd_exec_t,s0) + +/var/cache/fscache(/.*)? gen_context(system_u:object_r:cachefiles_var_t,s0) + +/var/fscache(/.*)? gen_context(system_u:object_r:cachefiles_var_t,s0) + +/var/run/cachefilesd\.pid -- gen_context(system_u:object_r:cachefilesd_var_run_t,s0) diff --git a/cachefilesd.if b/cachefilesd.if new file mode 100644 index 0000000..3b41945 --- /dev/null +++ b/cachefilesd.if @@ -0,0 +1,35 @@ +############################################################################### +# +# Copyright (C) 2006 Red Hat, Inc. All Rights Reserved. +# Written by David Howells (dhowells@redhat.com) +# Karl MacMillan (kmacmill@redhat.com) +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public License +# as published by the Free Software Foundation; either version +# 2 of the License, or (at your option) any later version. +# +############################################################################### + +# +# Define the policy interface for the CacheFiles userspace management daemon. +# +## policy for cachefilesd + +######################################## +## +## Execute a domain transition to run cachefilesd. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`cachefilesd_domtrans',` + gen_require(` + type cachefilesd_t, cachefilesd_exec_t; + ') + + domtrans_pattern($1, cachefilesd_exec_t, cachefilesd_t) +') diff --git a/cachefilesd.te b/cachefilesd.te new file mode 100644 index 0000000..3eda1b1 --- /dev/null +++ b/cachefilesd.te @@ -0,0 +1,144 @@ +############################################################################### +# +# Copyright (C) 2006, 2010 Red Hat, Inc. All Rights Reserved. +# Written by David Howells (dhowells@redhat.com) +# Karl MacMillan (kmacmill@redhat.com) +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public License +# as published by the Free Software Foundation; either version +# 2 of the License, or (at your option) any later version. +# +############################################################################### + +# +# This security policy governs access by the CacheFiles kernel module and +# userspace management daemon to the files and directories in the on-disk +# cache, on behalf of the processes accessing the cache through a network +# filesystem such as NFS +# +policy_module(cachefilesd, 1.0.17) + +############################################################################### +# +# Declarations +# + +# +# Files in the cache are created by the cachefiles module with security ID +# cachefiles_var_t +# +type cachefiles_var_t; +files_type(cachefiles_var_t) + +# +# The /dev/cachefiles character device has security ID cachefiles_dev_t +# +type cachefiles_dev_t; +dev_node(cachefiles_dev_t) + +# +# The cachefilesd daemon normally runs with security ID cachefilesd_t +# +type cachefilesd_t; +type cachefilesd_exec_t; +init_daemon_domain(cachefilesd_t, cachefilesd_exec_t) + +# +# The cachefilesd daemon pid file context +# +type cachefilesd_var_run_t; +files_pid_file(cachefilesd_var_run_t) + +# +# The CacheFiles kernel module causes processes accessing the cache files to do +# so acting as security ID cachefiles_kernel_t +# +type cachefiles_kernel_t; +domain_type(cachefiles_kernel_t) +domain_obj_id_change_exemption(cachefiles_kernel_t) +role system_r types cachefiles_kernel_t; + +############################################################################### +# +# Permit RPM to deal with files in the cache +# +optional_policy(` + rpm_use_script_fds(cachefilesd_t) +') + +############################################################################### +# +# cachefilesd local policy +# +# These define what cachefilesd is permitted to do. This doesn't include very +# much: startup stuff, logging, pid file, scanning the cache superstructure and +# deleting files from the cache. It is not permitted to read/write files in +# the cache. +# +# Check in /usr/share/selinux/devel/include/ for macros to use instead of allow +# rules. +# +allow cachefilesd_t self:capability { setuid setgid sys_admin dac_override }; + +# Allow manipulation of pid file +allow cachefilesd_t cachefilesd_var_run_t:file create_file_perms; +manage_files_pattern(cachefilesd_t, cachefilesd_var_run_t, cachefilesd_var_run_t) +manage_dirs_pattern(cachefilesd_t, cachefilesd_var_run_t, cachefilesd_var_run_t) +files_pid_filetrans(cachefilesd_t, cachefilesd_var_run_t, file) +files_create_as_is_all_files(cachefilesd_t) + +# Allow access to cachefiles device file +allow cachefilesd_t cachefiles_dev_t:chr_file rw_file_perms; + +# Allow access to cache superstructure +manage_dirs_pattern(cachefilesd_t, cachefiles_var_t, cachefiles_var_t) +manage_files_pattern(cachefilesd_t, cachefiles_var_t, cachefiles_var_t) + +# Permit statfs on the backing filesystem +fs_getattr_xattr_fs(cachefilesd_t) + +# Basic access +files_read_etc_files(cachefilesd_t) +logging_send_syslog_msg(cachefilesd_t) +init_dontaudit_use_script_ptys(cachefilesd_t) +term_dontaudit_use_generic_ptys(cachefilesd_t) +term_dontaudit_getattr_unallocated_ttys(cachefilesd_t) + +############################################################################### +# +# When cachefilesd invokes the kernel module to begin caching, it has to tell +# the kernel module the security context in which it should act, and this +# policy has to approve that. +# +# There are two parts to this: +# +# (1) the security context used by the module to access files in the cache, +# as set by the 'secctx' command in /etc/cachefilesd.conf, and +# +allow cachefilesd_t cachefiles_kernel_t:kernel_service { use_as_override }; + +# +# (2) the label that will be assigned to new files and directories created in +# the cache by the module, which will be the same as the label on the +# directory pointed to by the 'dir' command. +# +allow cachefilesd_t cachefiles_var_t:kernel_service { create_files_as }; + +############################################################################### +# +# cachefiles kernel module local policy +# +# This governs what the kernel module is allowed to do the contents of the +# cache. +# +allow cachefiles_kernel_t self:capability { dac_override dac_read_search }; + +manage_dirs_pattern(cachefiles_kernel_t, cachefiles_var_t, cachefiles_var_t) +manage_files_pattern(cachefiles_kernel_t, cachefiles_var_t, cachefiles_var_t) + +fs_getattr_xattr_fs(cachefiles_kernel_t) + +dev_search_sysfs(cachefiles_kernel_t) + +init_sigchld_script(cachefiles_kernel_t) diff --git a/calamaris.te b/calamaris.te index b13fb66..8926e84 100644 --- a/calamaris.te +++ b/calamaris.te @@ -39,7 +39,6 @@ kernel_read_system_state(calamaris_t) corecmd_exec_bin(calamaris_t) -corenet_all_recvfrom_unlabeled(calamaris_t) corenet_all_recvfrom_netlabel(calamaris_t) corenet_tcp_sendrecv_generic_if(calamaris_t) corenet_udp_sendrecv_generic_if(calamaris_t) @@ -51,7 +50,6 @@ corenet_udp_sendrecv_all_ports(calamaris_t) dev_read_urand(calamaris_t) files_search_pids(calamaris_t) -files_read_etc_files(calamaris_t) files_read_usr_files(calamaris_t) files_read_var_files(calamaris_t) files_read_etc_runtime_files(calamaris_t) @@ -62,8 +60,6 @@ auth_use_nsswitch(calamaris_t) logging_send_syslog_msg(calamaris_t) -miscfiles_read_localization(calamaris_t) - userdom_dontaudit_list_user_home_dirs(calamaris_t) optional_policy(` diff --git a/callweaver.fc b/callweaver.fc new file mode 100644 index 0000000..3e15c63 --- /dev/null +++ b/callweaver.fc @@ -0,0 +1,11 @@ +/etc/rc\.d/init\.d/callweaver -- gen_context(system_u:object_r:callweaver_initrc_exec_t,s0) + +/usr/sbin/callweaver -- gen_context(system_u:object_r:callweaver_exec_t,s0) + +/var/lib/callweaver(/.*)? gen_context(system_u:object_r:callweaver_var_lib_t,s0) + +/var/log/callweaver(/.*)? gen_context(system_u:object_r:callweaver_log_t,s0) + +/var/run/callweaver(/.*)? gen_context(system_u:object_r:callweaver_var_run_t,s0) + +/var/spool/callweaver(/.*)? gen_context(system_u:object_r:callweaver_spool_t,s0) diff --git a/callweaver.if b/callweaver.if new file mode 100644 index 0000000..e07d3b8 --- /dev/null +++ b/callweaver.if @@ -0,0 +1,362 @@ +## Open source PBX project. + +######################################## +## +## Execute callweaver in the +## callweaver domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`callweaver_domtrans',` + gen_require(` + type callweaver_t, callweaver_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, callweaver_exec_t, callweaver_t) +') + +######################################## +## +## Execute callweaver in the +## callers domain. +## +## +## +## Domain allowed access. +## +## +# +interface(`callweaver_exec',` + gen_require(` + type callweaver_exec_t; + ') + + corecmd_search_bin($1) + can_exec($1, callweaver_exec_t) +') + +######################################## +## +## Execute callweaver in the +## callweaver domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`callweaver_initrc_domtrans',` + gen_require(` + type callweaver_initrc_exec_t; + ') + + init_labeled_script_domtrans($1, callweaver_initrc_exec_t) +') + +######################################## +## +## Read callweaver log files. +## +## +## +## Domain allowed access. +## +## +# +interface(`callweaver_read_log',` + gen_require(` + type callweaver_log_t; + ') + + logging_search_logs($1) + read_files_pattern($1, callweaver_log_t, callweaver_log_t) +') + +######################################## +## +## Append to callweaver log files. +## +## +## +## Domain allowed access. +## +## +# +interface(`callweaver_append_log',` + gen_require(` + type callweaver_log_t; + ') + + logging_search_logs($1) + append_files_pattern($1, callweaver_log_t, callweaver_log_t) +') + +######################################## +## +## Manage callweaver log files +## +## +## +## Domain allowed access. +## +## +# +interface(`callweaver_manage_log',` + gen_require(` + type callweaver_log_t; + ') + + logging_search_logs($1) + manage_dirs_pattern($1, callweaver_log_t, callweaver_log_t) + manage_files_pattern($1, callweaver_log_t, callweaver_log_t) + manage_lnk_files_pattern($1, callweaver_log_t, callweaver_log_t) +') + +######################################## +## +## Search callweaver lib directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`callweaver_search_lib',` + gen_require(` + type callweaver_var_lib_t; + ') + + allow $1 callweaver_var_lib_t:dir search_dir_perms; + files_search_var_lib($1) +') + +######################################## +## +## Read callweaver lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`callweaver_read_lib_files',` + gen_require(` + type callweaver_var_lib_t; + ') + + files_search_var_lib($1) + read_files_pattern($1, callweaver_var_lib_t, callweaver_var_lib_t) +') + +######################################## +## +## Manage callweaver lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`callweaver_manage_lib_files',` + gen_require(` + type callweaver_var_lib_t; + ') + + files_search_var_lib($1) + manage_files_pattern($1, callweaver_var_lib_t, callweaver_var_lib_t) +') + +######################################## +## +## Manage callweaver lib directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`callweaver_manage_lib_dirs',` + gen_require(` + type callweaver_var_lib_t; + ') + + files_search_var_lib($1) + manage_dirs_pattern($1, callweaver_var_lib_t, callweaver_var_lib_t) +') + + +######################################## +## +## Read callweaver PID files. +## +## +## +## Domain allowed access. +## +## +# +interface(`callweaver_read_pid_files',` + gen_require(` + type callweaver_var_run_t; + ') + + files_search_pids($1) + allow $1 callweaver_var_run_t:file read_file_perms; +') + +######################################## +## +## Connect to callweaver over a unix stream socket. +## +## +## +## Domain allowed access. +## +## +# +interface(`callweaver_stream_connect',` + gen_require(` + type callweaver_t, callweaver_var_run_t; + ') + + files_search_pids($1) + stream_connect_pattern($1, callweaver_var_run_t, callweaver_var_run_t, callweaver_t) +') + +######################################## +## +## Search callweaver spool directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`callweaver_search_spool',` + gen_require(` + type callweaver_spool_t; + ') + + allow $1 callweaver_spool_t:dir search_dir_perms; + files_search_spool($1) +') + +######################################## +## +## Read callweaver spool files. +## +## +## +## Domain allowed access. +## +## +# +interface(`callweaver_read_spool_files',` + gen_require(` + type callweaver_spool_t; + ') + + files_search_spool($1) + read_files_pattern($1, callweaver_spool_t, callweaver_spool_t) +') + +######################################## +## +## Manage callweaver spool files. +## +## +## +## Domain allowed access. +## +## +# +interface(`callweaver_manage_spool_files',` + gen_require(` + type callweaver_spool_t; + ') + + files_search_spool($1) + manage_files_pattern($1, callweaver_spool_t, callweaver_spool_t) +') + +######################################## +## +## Manage callweaver spool dirs. +## +## +## +## Domain allowed access. +## +## +# +interface(`callweaver_manage_spool_dirs',` + gen_require(` + type callweaver_spool_t; + ') + + files_search_spool($1) + manage_dirs_pattern($1, callweaver_spool_t, callweaver_spool_t) +') + +######################################## +## +## All of the rules required to administrate +## an callweaver environment +## +## +## +## Domain allowed access. +## +## +## +## +## Role allowed access. +## +## +## +# +interface(`callweaver_admin',` + gen_require(` + type callweaver_t; + type callweaver_initrc_exec_t; + type callweaver_log_t; + type callweaver_var_lib_t; + type callweaver_var_run_t; + type callweaver_spool_t; + ') + + allow $1 callweaver_t:process signal_perms; + ps_process_pattern($1, callweaver_t) + + tunable_policy(`deny_ptrace',`',` + allow $1 callweaver_t:process ptrace; + ') + + callweaver_initrc_domtrans($1) + domain_system_change_exemption($1) + role_transition $2 callweaver_initrc_exec_t system_r; + allow $2 system_r; + + logging_search_logs($1) + admin_pattern($1, callweaver_log_t) + + files_search_var_lib($1) + admin_pattern($1, callweaver_var_lib_t) + + files_search_pids($1) + admin_pattern($1, callweaver_var_run_t) + + files_search_spool($1) + admin_pattern($1, callweaver_spool_t) +') diff --git a/callweaver.te b/callweaver.te new file mode 100644 index 0000000..978f92f --- /dev/null +++ b/callweaver.te @@ -0,0 +1,75 @@ +policy_module(callweaver,1.0.0) + +######################################## +# +# Declarations +# + +type callweaver_t; +type callweaver_exec_t; +init_daemon_domain(callweaver_t, callweaver_exec_t) + +type callweaver_initrc_exec_t; +init_script_file(callweaver_initrc_exec_t) + +type callweaver_log_t; +logging_log_file(callweaver_log_t) + +type callweaver_var_lib_t; +files_type(callweaver_var_lib_t) + +type callweaver_var_run_t; +files_pid_file(callweaver_var_run_t) + +type callweaver_spool_t; +files_spool_file(callweaver_spool_t) + +######################################## +# +# callweaver local policy +# + +allow callweaver_t self:capability { setuid sys_nice setgid }; +allow callweaver_t self:process { setsched signal }; +allow callweaver_t self:fifo_file rw_fifo_file_perms; +allow callweaver_t self:unix_stream_socket create_stream_socket_perms; + +manage_dirs_pattern(callweaver_t, callweaver_log_t, callweaver_log_t) +manage_files_pattern(callweaver_t, callweaver_log_t, callweaver_log_t) +logging_log_filetrans(callweaver_t, callweaver_log_t, { dir file } ) + +manage_dirs_pattern(callweaver_t, callweaver_var_lib_t, callweaver_var_lib_t) +manage_files_pattern(callweaver_t, callweaver_var_lib_t, callweaver_var_lib_t) +files_var_lib_filetrans(callweaver_t, callweaver_var_lib_t, { dir file } ) + +manage_dirs_pattern(callweaver_t, callweaver_var_run_t, callweaver_var_run_t) +manage_files_pattern(callweaver_t, callweaver_var_run_t, callweaver_var_run_t) +manage_sock_files_pattern(callweaver_t, callweaver_var_run_t, callweaver_var_run_t) +files_pid_filetrans(callweaver_t, callweaver_var_run_t, { dir file sock_file }) + +manage_dirs_pattern(callweaver_t, callweaver_spool_t, callweaver_spool_t) +manage_files_pattern(callweaver_t, callweaver_spool_t, callweaver_spool_t) +manage_lnk_files_pattern(callweaver_t, callweaver_spool_t, callweaver_spool_t) +files_spool_filetrans(callweaver_t, callweaver_spool_t, { dir file }) + +allow callweaver_t self:tcp_socket create_stream_socket_perms; +allow callweaver_t self:udp_socket create_socket_perms; + +kernel_read_sysctl(callweaver_t) +kernel_read_kernel_sysctls(callweaver_t) + +corenet_udp_bind_asterisk_port(callweaver_t) +corenet_udp_bind_generic_port(callweaver_t) +corenet_udp_bind_sip_port(callweaver_t) + +dev_manage_generic_symlinks(callweaver_t) + +domain_use_interactive_fds(callweaver_t) + + +term_getattr_pty_fs(callweaver_t) +term_use_generic_ptys(callweaver_t) +term_use_ptmx(callweaver_t) + +auth_use_nsswitch(callweaver_t) + diff --git a/canna.fc b/canna.fc index 5432d0e..f77df02 100644 --- a/canna.fc +++ b/canna.fc @@ -20,4 +20,4 @@ /var/run/\.iroha_unix -d gen_context(system_u:object_r:canna_var_run_t,s0) /var/run/\.iroha_unix/.* -s gen_context(system_u:object_r:canna_var_run_t,s0) -/var/run/wnn-unix(/.*) gen_context(system_u:object_r:canna_var_run_t,s0) +/var/run/wnn-unix(/.*)? gen_context(system_u:object_r:canna_var_run_t,s0) diff --git a/canna.if b/canna.if index 4a26b0c..00b64dc 100644 --- a/canna.if +++ b/canna.if @@ -42,9 +42,13 @@ interface(`canna_admin',` type canna_var_run_t, canna_initrc_exec_t; ') - allow $1 canna_t:process { ptrace signal_perms }; + allow $1 canna_t:process signal_perms; ps_process_pattern($1, canna_t) + tunable_policy(`deny_ptrace',`',` + allow $1 canna_t:process ptrace; + ') + init_labeled_script_domtrans($1, canna_initrc_exec_t) domain_system_change_exemption($1) role_transition $2 canna_initrc_exec_t system_r; diff --git a/canna.te b/canna.te index 1d25efe..910b94c 100644 --- a/canna.te +++ b/canna.te @@ -34,7 +34,7 @@ allow canna_t self:unix_dgram_socket create_stream_socket_perms; allow canna_t self:tcp_socket create_stream_socket_perms; manage_files_pattern(canna_t, canna_log_t, canna_log_t) -allow canna_t canna_log_t:dir setattr; +allow canna_t canna_log_t:dir setattr_dir_perms; logging_log_filetrans(canna_t, canna_log_t, { file dir }) manage_dirs_pattern(canna_t, canna_var_lib_t, canna_var_lib_t) @@ -50,7 +50,6 @@ files_pid_filetrans(canna_t, canna_var_run_t, { dir file sock_file }) kernel_read_kernel_sysctls(canna_t) kernel_read_system_state(canna_t) -corenet_all_recvfrom_unlabeled(canna_t) corenet_all_recvfrom_netlabel(canna_t) corenet_tcp_sendrecv_generic_if(canna_t) corenet_tcp_sendrecv_generic_node(canna_t) @@ -73,8 +72,6 @@ files_dontaudit_read_root_files(canna_t) logging_send_syslog_msg(canna_t) -miscfiles_read_localization(canna_t) - sysnet_read_config(canna_t) userdom_dontaudit_use_unpriv_user_fds(canna_t) diff --git a/ccs.fc b/ccs.fc index 8a7177d..bc4f6e7 100644 --- a/ccs.fc +++ b/ccs.fc @@ -2,5 +2,7 @@ /sbin/ccsd -- gen_context(system_u:object_r:ccs_exec_t,s0) +/usr/sbin/ccsd -- gen_context(system_u:object_r:ccs_exec_t,s0) + /var/run/cluster/ccsd\.pid -- gen_context(system_u:object_r:ccs_var_run_t,s0) /var/run/cluster/ccsd\.sock -s gen_context(system_u:object_r:ccs_var_run_t,s0) diff --git a/ccs.te b/ccs.te index 4c90b57..30265d4 100644 --- a/ccs.te +++ b/ccs.te @@ -10,7 +10,7 @@ type ccs_exec_t; init_daemon_domain(ccs_t, ccs_exec_t) type cluster_conf_t; -files_type(cluster_conf_t) +files_config_file(cluster_conf_t) type ccs_tmp_t; files_tmp_file(ccs_tmp_t) @@ -34,7 +34,7 @@ files_pid_file(ccs_var_run_t) allow ccs_t self:capability { ipc_owner ipc_lock sys_nice sys_resource sys_admin }; allow ccs_t self:process { signal setrlimit setsched }; -dontaudit ccs_t self:process ptrace; + allow ccs_t self:fifo_file rw_fifo_file_perms; allow ccs_t self:unix_stream_socket { connectto create_stream_socket_perms }; allow ccs_t self:unix_dgram_socket create_socket_perms; @@ -61,7 +61,7 @@ manage_dirs_pattern(ccs_t, ccs_var_lib_t, ccs_var_lib_t) manage_files_pattern(ccs_t, ccs_var_lib_t, ccs_var_lib_t) files_var_lib_filetrans(ccs_t, ccs_var_lib_t, { file dir }) -allow ccs_t ccs_var_log_t:dir setattr; +allow ccs_t ccs_var_log_t:dir setattr_dir_perms; manage_files_pattern(ccs_t, ccs_var_log_t, ccs_var_log_t) manage_sock_files_pattern(ccs_t, ccs_var_log_t, ccs_var_log_t) logging_log_filetrans(ccs_t, ccs_var_log_t, { sock_file file dir }) @@ -77,7 +77,6 @@ kernel_read_kernel_sysctls(ccs_t) corecmd_list_bin(ccs_t) corecmd_exec_bin(ccs_t) -corenet_all_recvfrom_unlabeled(ccs_t) corenet_all_recvfrom_netlabel(ccs_t) corenet_tcp_sendrecv_generic_if(ccs_t) corenet_udp_sendrecv_generic_if(ccs_t) @@ -97,11 +96,10 @@ files_read_etc_files(ccs_t) files_read_etc_runtime_files(ccs_t) init_rw_script_tmp_files(ccs_t) +init_signal(ccs_t) logging_send_syslog_msg(ccs_t) -miscfiles_read_localization(ccs_t) - sysnet_dns_name_resolve(ccs_t) userdom_manage_unpriv_user_shared_mem(ccs_t) @@ -118,5 +116,10 @@ optional_policy(` ') optional_policy(` + qpidd_rw_semaphores(ccs_t) + qpidd_rw_shm(ccs_t) +') + +optional_policy(` unconfined_use_fds(ccs_t) ') diff --git a/cdrecord.te b/cdrecord.te index 4626931..93e1495 100644 --- a/cdrecord.te +++ b/cdrecord.te @@ -52,10 +52,8 @@ storage_write_scsi_generic(cdrecord_t) logging_send_syslog_msg(cdrecord_t) -miscfiles_read_localization(cdrecord_t) - # write to the user domain tty. -userdom_use_user_terminals(cdrecord_t) +userdom_use_inherited_user_terminals(cdrecord_t) userdom_read_user_home_content_files(cdrecord_t) # Handle nfs home dirs @@ -108,11 +106,7 @@ tunable_policy(`cdrecord_read_content',` userdom_dontaudit_read_user_home_content_files(cdrecord_t) ') -tunable_policy(`use_nfs_home_dirs',` - files_search_mnt(cdrecord_t) - fs_read_nfs_files(cdrecord_t) - fs_read_nfs_symlinks(cdrecord_t) -') +userdom_home_manager(cdrecord_t) optional_policy(` resmgr_stream_connect(cdrecord_t) diff --git a/certmaster.if b/certmaster.if index fa62787..4230c25 100644 --- a/certmaster.if +++ b/certmaster.if @@ -116,19 +116,23 @@ interface(`certmaster_manage_log',` interface(`certmaster_admin',` gen_require(` type certmaster_t, certmaster_var_run_t, certmaster_var_lib_t; - type certmaster_etc_rw_t, certmaster_var_log_t; - type certmaster_initrc_exec_t; + type certmaster_etc_rw_t, certmaster_var_log_t, certmaster_initrc_exec_t; ') - allow $1 certmaster_t:process { ptrace signal_perms }; + allow $1 certmaster_t:process signal_perms; ps_process_pattern($1, certmaster_t) + tunable_policy(`deny_ptrace',`',` + allow $1 certmaster_t:process ptrace; + ') + init_labeled_script_domtrans($1, certmaster_initrc_exec_t) domain_system_change_exemption($1) role_transition $2 certmaster_initrc_exec_t system_r; allow $2 system_r; files_list_etc($1) + miscfiles_manage_generic_cert_dirs($1) miscfiles_manage_generic_cert_files($1) diff --git a/certmaster.te b/certmaster.te index 3384132..e40c81c 100644 --- a/certmaster.te +++ b/certmaster.te @@ -53,19 +53,20 @@ files_pid_filetrans(certmaster_t ,certmaster_var_run_t, { file sock_file }) # read meminfo kernel_read_system_state(certmaster_t) -corecmd_search_bin(certmaster_t) -corecmd_getattr_bin_files(certmaster_t) +corecmd_exec_bin(certmaster_t) corenet_tcp_bind_generic_node(certmaster_t) corenet_tcp_bind_certmaster_port(certmaster_t) +dev_read_urand(certmaster_t) + files_search_etc(certmaster_t) +files_read_usr_files(certmaster_t) files_list_var(certmaster_t) files_search_var_lib(certmaster_t) auth_use_nsswitch(certmaster_t) -miscfiles_read_localization(certmaster_t) miscfiles_manage_generic_cert_dirs(certmaster_t) miscfiles_manage_generic_cert_files(certmaster_t) diff --git a/certmonger.fc b/certmonger.fc index 5ad1a52..e66fcf6 100644 --- a/certmonger.fc +++ b/certmonger.fc @@ -4,3 +4,5 @@ /var/lib/certmonger(/.*)? gen_context(system_u:object_r:certmonger_var_lib_t,s0) /var/run/certmonger.pid -- gen_context(system_u:object_r:certmonger_var_run_t,s0) + +/usr/lib/ipa/certmonger(/.*)? gen_context(system_u:object_r:certmonger_unconfined_exec_t,s0) diff --git a/certmonger.if b/certmonger.if index 7a6e5ba..7475aa5 100644 --- a/certmonger.if +++ b/certmonger.if @@ -158,7 +158,11 @@ interface(`certmonger_admin',` ') ps_process_pattern($1, certmonger_t) - allow $1 certmonger_t:process { ptrace signal_perms }; + allow $1 certmonger_t:process signal_perms; + + tunable_policy(`deny_ptrace',`',` + allow $1 certmonger_t:process ptrace; + ') # Allow certmonger_t to restart the apache service certmonger_initrc_domtrans($1) @@ -166,9 +170,9 @@ interface(`certmonger_admin',` role_transition $2 certmonger_initrc_exec_t system_r; allow $2 system_r; - files_search_var_lib($1) + files_list_var_lib($1) admin_pattern($1, certmonger_var_lib_t) - files_search_pids($1) + files_list_pids($1) admin_pattern($1, certmonger_var_run_t) ') diff --git a/certmonger.te b/certmonger.te index c3e3f79..59ccf7e 100644 --- a/certmonger.te +++ b/certmonger.te @@ -18,12 +18,17 @@ files_pid_file(certmonger_var_run_t) type certmonger_var_lib_t; files_type(certmonger_var_lib_t) +type certmonger_unconfined_exec_t; +application_executable_file(certmonger_unconfined_exec_t) + ######################################## # # certmonger local policy # -allow certmonger_t self:capability { kill sys_nice }; +allow certmonger_t self:capability { dac_override dac_read_search setgid setuid kill sys_nice }; +dontaudit certmonger_t self:capability sys_tty_config; + allow certmonger_t self:process { getsched setsched sigkill }; allow certmonger_t self:fifo_file rw_file_perms; allow certmonger_t self:unix_stream_socket create_stream_socket_perms; @@ -38,25 +43,46 @@ manage_dirs_pattern(certmonger_t, certmonger_var_run_t, certmonger_var_run_t) manage_files_pattern(certmonger_t, certmonger_var_run_t, certmonger_var_run_t) files_pid_filetrans(certmonger_t, certmonger_var_run_t, { file dir }) +kernel_read_kernel_sysctls(certmonger_t) +kernel_read_system_state(certmonger_t) + +corecmd_exec_bin(certmonger_t) +corecmd_exec_shell(certmonger_t) + corenet_tcp_sendrecv_generic_if(certmonger_t) corenet_tcp_sendrecv_generic_node(certmonger_t) corenet_tcp_sendrecv_all_ports(certmonger_t) corenet_tcp_connect_certmaster_port(certmonger_t) +corenet_tcp_connect_http_port(certmonger_t) +corenet_tcp_connect_pki_ca_port(certmonger_t) dev_read_urand(certmonger_t) domain_use_interactive_fds(certmonger_t) -files_read_etc_files(certmonger_t) files_read_usr_files(certmonger_t) files_list_tmp(certmonger_t) +auth_use_nsswitch(certmonger_t) +auth_rw_cache(certmonger_t) + +init_getattr_all_script_files(certmonger_t) + logging_send_syslog_msg(certmonger_t) -miscfiles_read_localization(certmonger_t) miscfiles_manage_generic_cert_files(certmonger_t) -sysnet_dns_name_resolve(certmonger_t) +userdom_search_user_home_content(certmonger_t) + +optional_policy(` + apache_search_config(certmonger_t) + apache_signal(certmonger_t) + apache_signull(certmonger_t) +') + +optional_policy(` + bind_search_cache(certmonger_t) +') optional_policy(` dbus_system_bus_client(certmonger_t) @@ -64,9 +90,42 @@ optional_policy(` ') optional_policy(` + dirsrv_manage_config(certmonger_t) + dirsrv_signal(certmonger_t) + dirsrv_signull(certmonger_t) +') + +optional_policy(` kerberos_use(certmonger_t) + kerberos_read_keytab(certmonger_t) ') optional_policy(` + pcscd_read_pub_files(certmonger_t) pcscd_stream_connect(certmonger_t) ') + +######################################## +# +# certmonger_unconfined_script_t local policy +# + +optional_policy(` + type certmonger_unconfined_t; + domain_type(certmonger_unconfined_t) + + domain_entry_file(certmonger_unconfined_t, certmonger_unconfined_exec_t) + role system_r types certmonger_unconfined_t; + + domtrans_pattern(certmonger_t, certmonger_unconfined_exec_t, certmonger_unconfined_t) + + unconfined_domain(certmonger_unconfined_t) + + allow certmonger_t certmonger_unconfined_exec_t:dir search_dir_perms; + allow certmonger_t certmonger_unconfined_exec_t:dir read_file_perms; + allow certmonger_t certmonger_unconfined_exec_t:file ioctl; + + init_domtrans_script(certmonger_unconfined_t) + + unconfined_domain(certmonger_unconfined_t) +') diff --git a/certwatch.te b/certwatch.te index e07cef5..55051ce 100644 --- a/certwatch.te +++ b/certwatch.te @@ -27,15 +27,15 @@ files_list_tmp(certwatch_t) fs_list_inotifyfs(certwatch_t) auth_manage_cache(certwatch_t) +auth_read_passwd(certwatch_t) auth_var_filetrans_cache(certwatch_t) logging_send_syslog_msg(certwatch_t) miscfiles_read_all_certs(certwatch_t) -miscfiles_read_localization(certwatch_t) -userdom_use_user_terminals(certwatch_t) -userdom_dontaudit_list_user_home_dirs(certwatch_t) +userdom_use_inherited_user_terminals(certwatch_t) +userdom_dontaudit_list_admin_dir(certwatch_t) optional_policy(` apache_exec_modules(certwatch_t) diff --git a/cfengine.fc b/cfengine.fc new file mode 100644 index 0000000..4c52fa3 --- /dev/null +++ b/cfengine.fc @@ -0,0 +1,12 @@ + +/usr/sbin/cf-serverd -- gen_context(system_u:object_r:cfengine_serverd_exec_t,s0) +/usr/sbin/cf-execd -- gen_context(system_u:object_r:cfengine_execd_exec_t,s0) +/usr/sbin/cf-monitord -- gen_context(system_u:object_r:cfengine_monitord_exec_t,s0) + +/etc/rc\.d/init\.d/cf-serverd -- gen_context(system_u:object_r:cfengine_initrc_exec_t,s0) +/etc/rc\.d/init\.d/cf-monitord -- gen_context(system_u:object_r:cfengine_initrc_exec_t,s0) +/etc/rc\.d/init\.d/cf-execd -- gen_context(system_u:object_r:cfengine_initrc_exec_t,s0) + +/var/cfengine(/.*)? gen_context(system_u:object_r:cfengine_var_lib_t,s0) +/var/cfengine/outputs(/.*)? gen_context(system_u:object_r:cfengine_var_log_t,s0) + diff --git a/cfengine.if b/cfengine.if new file mode 100644 index 0000000..1a59a7a --- /dev/null +++ b/cfengine.if @@ -0,0 +1,144 @@ + +## policy for cfengine + +###################################### +## +## Creates types and rules for a basic +## cfengine init daemon domain. +## +## +## +## Prefix for the domain. +## +## +# +template(`cfengine_domain_template',` + gen_require(` + attribute cfengine_domain; + ') + + ############################## + # + # Declarations + # + + type cfengine_$1_t, cfengine_domain; + type cfengine_$1_exec_t; + init_daemon_domain(cfengine_$1_t, cfengine_$1_exec_t) + + logging_send_syslog_msg(cfengine_$1_t) +') + +######################################## +## +## Transition to cfengine. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`cfengine_domtrans_server',` + gen_require(` + type cfengine_server_t, cfengine_server_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, cfengine_server_exec_t, cfengine_server_t) +') + +####################################### +## +## Search cfengine lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`cfengine_search_lib_files',` + gen_require(` + type cfengine_var_lib_t; + ') + + allow $1 cfengine_var_lib_t:dir search_dir_perms; +') + +######################################## +## +## Read cfengine lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`cfengine_read_lib_files',` + gen_require(` + type cfengine_var_lib_t; + ') + + files_search_var_lib($1) + read_files_pattern($1, cfengine_var_lib_t, cfengine_var_lib_t) +') + +###################################### +## +## Allow the specified domain to read cfengine's log files. +## +## +## +## Domain allowed access. +## +## +# +interface(`cfengine_read_log',` + gen_require(` + type cfengine_var_log_t; + ') + + logging_search_logs($1) + files_search_var_lib($1) + cfengine_search_lib_files($1) + read_files_pattern($1, cfengine_var_log_t, cfengine_var_log_t) +') + +##################################### +## +## Allow the specified domain to append cfengine's log files. +## +## +## +## Domain allowed access. +## +## +# +interface(`cfengine_append_inherited_log',` + gen_require(` + type cfengine_var_log_t; + ') + + cfengine_search_lib_files($1) + allow $1 cfengine_var_log_t:file { getattr append ioctl lock }; +') + +#################################### +## +## Dontaudit the specified domain to write cfengine's log files. +## +## +## +## Domain allowed access. +## +## +# +interface(`cfengine_dontaudit_write_log',` + gen_require(` + type cfengine_var_log_t; + ') + + dontaudit $1 cfengine_var_log_t:file write; +') diff --git a/cfengine.te b/cfengine.te new file mode 100644 index 0000000..02a13fa --- /dev/null +++ b/cfengine.te @@ -0,0 +1,96 @@ +policy_module(cfengine, 1.0.0) + +######################################## +# +# Declarations +# + +attribute cfengine_domain; + +cfengine_domain_template(serverd) +cfengine_domain_template(execd) +cfengine_domain_template(monitord) + +type cfengine_initrc_exec_t; +init_script_file(cfengine_initrc_exec_t) + +type cfengine_var_lib_t; +files_type(cfengine_var_lib_t) + +type cfengine_var_log_t; +logging_log_file(cfengine_var_log_t) + +####################################### +# +# cfengine domain local policy +# + +allow cfengine_domain self:fifo_file rw_fifo_file_perms; +allow cfengine_domain self:unix_stream_socket create_stream_socket_perms; + +manage_dirs_pattern(cfengine_domain, cfengine_var_lib_t, cfengine_var_lib_t) +manage_files_pattern(cfengine_domain, cfengine_var_lib_t, cfengine_var_lib_t) +manage_lnk_files_pattern(cfengine_domain, cfengine_var_lib_t, cfengine_var_lib_t) +files_var_lib_filetrans(cfengine_domain, cfengine_var_lib_t, { dir file }) + +manage_files_pattern(cfengine_domain, cfengine_var_log_t,cfengine_var_log_t) +manage_dirs_pattern(cfengine_domain, cfengine_var_log_t,cfengine_var_log_t) +logging_log_filetrans(cfengine_domain,cfengine_var_log_t,{ dir file }) + +kernel_read_system_state(cfengine_domain) + +corecmd_exec_bin(cfengine_domain) +corecmd_exec_shell(cfengine_domain) + +dev_read_urand(cfengine_domain) +dev_read_sysfs(cfengine_domain) + +sysnet_dns_name_resolve(cfengine_domain) +sysnet_domtrans_ifconfig(cfengine_domain) + +files_read_etc_files(cfengine_domain) + +######################################## +# +# cfengine-server local policy +# + +allow cfengine_serverd_t self:capability { chown kill setgid setuid sys_chroot }; +allow cfengine_serverd_t self:process { fork setfscreate signal }; + +domain_use_interactive_fds(cfengine_serverd_t) + +auth_use_nsswitch(cfengine_serverd_t) + +######################################## +# +# cfengine_exec local policy +# + +allow cfengine_execd_t self:capability { chown kill setgid setuid sys_chroot }; +allow cfengine_execd_t self:process { fork setfscreate signal }; + +kernel_read_sysctl(cfengine_execd_t) + +domain_read_all_domains_state(cfengine_execd_t) +domain_use_interactive_fds(cfengine_execd_t) + +auth_use_nsswitch(cfengine_execd_t) + +######################################## +# +# cfengine_monitord local policy +# + +allow cfengine_monitord_t self:capability { chown kill setgid setuid sys_chroot }; +allow cfengine_monitord_t self:process { fork setfscreate signal }; + +kernel_read_hotplug_sysctls(cfengine_monitord_t) +kernel_read_network_state(cfengine_monitord_t) + +domain_read_all_domains_state(cfengine_monitord_t) +domain_use_interactive_fds(cfengine_monitord_t) + +fs_getattr_xattr_fs(cfengine_monitord_t) + +auth_use_nsswitch(cfengine_monitord_t) diff --git a/cgroup.fc b/cgroup.fc index b6bb46c..9a2bf65 100644 --- a/cgroup.fc +++ b/cgroup.fc @@ -11,5 +11,9 @@ /sbin/cgrulesengd -- gen_context(system_u:object_r:cgred_exec_t,s0) /sbin/cgclear -- gen_context(system_u:object_r:cgclear_exec_t,s0) -/var/log/cgrulesengd\.log -- gen_context(system_u:object_r:cgred_log_t,s0) +/usr/sbin/cgconfigparser -- gen_context(system_u:object_r:cgconfig_exec_t,s0) +/usr/sbin/cgrulesengd -- gen_context(system_u:object_r:cgred_exec_t,s0) +/usr/sbin/cgclear -- gen_context(system_u:object_r:cgclear_exec_t,s0) + +/var/log/cgrulesengd\.log.* -- gen_context(system_u:object_r:cgred_log_t,s0) /var/run/cgred.* gen_context(system_u:object_r:cgred_var_run_t,s0) diff --git a/cgroup.if b/cgroup.if index 33facaf..c624aaa 100644 --- a/cgroup.if +++ b/cgroup.if @@ -171,15 +171,27 @@ interface(`cgroup_admin',` type cgrules_etc_t, cgclear_t; ') - allow $1 cgclear_t:process { ptrace signal_perms }; + allow $1 cgclear_t:process signal_perms; ps_process_pattern($1, cgclear_t) - allow $1 cgconfig_t:process { ptrace signal_perms }; + tunable_policy(`deny_ptrace',`',` + allow $1 cglcear_t:process ptrace; + ') + + allow $1 cgconfig_t:process signal_perms; ps_process_pattern($1, cgconfig_t) - allow $1 cgred_t:process { ptrace signal_perms }; + tunable_policy(`deny_ptrace',`',` + allow $1 cgconfig_t:process ptrace; + ') + + allow $1 cgred_t:process signal_perms; ps_process_pattern($1, cgred_t) + tunable_policy(`deny_ptrace',`',` + allow $1 cgred_t:process ptrace; + ') + admin_pattern($1, cgconfig_etc_t) admin_pattern($1, cgrules_etc_t) files_list_etc($1) diff --git a/cgroup.te b/cgroup.te index 806191a..6b8ab32 100644 --- a/cgroup.te +++ b/cgroup.te @@ -25,8 +25,8 @@ files_pid_file(cgred_var_run_t) type cgrules_etc_t; files_config_file(cgrules_etc_t) -type cgconfig_t; -type cgconfig_exec_t; +type cgconfig_t alias cgconfigparser_t; +type cgconfig_exec_t alias cgconfigparser_exec_t; init_daemon_domain(cgconfig_t, cgconfig_exec_t) type cgconfig_initrc_exec_t; @@ -42,6 +42,9 @@ files_config_file(cgconfig_etc_t) allow cgclear_t self:capability { dac_read_search dac_override sys_admin }; +read_files_pattern(cgclear_t, cgconfig_etc_t, cgconfig_etc_t) + + kernel_read_system_state(cgclear_t) domain_setpriority_all_domains(cgclear_t) @@ -64,7 +67,6 @@ kernel_list_unlabeled(cgconfig_t) kernel_read_system_state(cgconfig_t) # /etc/nsswitch.conf, /etc/passwd -files_read_etc_files(cgconfig_t) fs_manage_cgroup_dirs(cgconfig_t) fs_manage_cgroup_files(cgconfig_t) @@ -72,12 +74,15 @@ fs_mount_cgroup(cgconfig_t) fs_mounton_cgroup(cgconfig_t) fs_unmount_cgroup(cgconfig_t) +auth_use_nsswitch(cgconfig_t) + ######################################## # # cgred personal policy. # -allow cgred_t self:capability { chown fsetid net_admin sys_admin sys_ptrace dac_override }; +allow cgred_t self:capability { chown fsetid net_admin sys_admin dac_override sys_ptrace }; + allow cgred_t self:netlink_socket { write bind create read }; allow cgred_t self:unix_dgram_socket { write create connect }; @@ -86,6 +91,9 @@ logging_log_filetrans(cgred_t, cgred_log_t, file) allow cgred_t cgrules_etc_t:file read_file_perms; +manage_files_pattern(cgred_t, cgred_log_t, cgred_log_t) +logging_log_filetrans(cgred_t, cgred_log_t, file) + # rc script creates pid file manage_files_pattern(cgred_t, cgred_var_run_t, cgred_var_run_t) manage_sock_files_pattern(cgred_t, cgred_var_run_t, cgred_var_run_t) @@ -100,10 +108,9 @@ files_getattr_all_files(cgred_t) files_getattr_all_sockets(cgred_t) files_read_all_symlinks(cgred_t) # /etc/group -files_read_etc_files(cgred_t) fs_write_cgroup_files(cgred_t) -logging_send_syslog_msg(cgred_t) +auth_use_nsswitch(cgred_t) -miscfiles_read_localization(cgred_t) +logging_send_syslog_msg(cgred_t) diff --git a/chrome.fc b/chrome.fc new file mode 100644 index 0000000..88107d7 --- /dev/null +++ b/chrome.fc @@ -0,0 +1,6 @@ +/opt/google/chrome/chrome-sandbox -- gen_context(system_u:object_r:chrome_sandbox_exec_t,s0) + +/usr/lib/chromium-browser/chrome-sandbox -- gen_context(system_u:object_r:chrome_sandbox_exec_t,s0) + +/opt/google/chrome/nacl_helper_bootstrap -- gen_context(system_u:object_r:chrome_sandbox_nacl_exec_t,s0) +/usr/lib/chromium-browser/nacl_helper_bootstrap -- gen_context(system_u:object_r:chrome_sandbox_nacl_exec_t,s0) diff --git a/chrome.if b/chrome.if new file mode 100644 index 0000000..efebae7 --- /dev/null +++ b/chrome.if @@ -0,0 +1,134 @@ + +## policy for chrome + +######################################## +## +## Execute a domain transition to run chrome_sandbox. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`chrome_domtrans_sandbox',` + gen_require(` + type chrome_sandbox_t, chrome_sandbox_exec_t; + ') + + domtrans_pattern($1, chrome_sandbox_exec_t, chrome_sandbox_t) + ps_process_pattern(chrome_sandbox_t, $1) + + allow $1 chrome_sandbox_t:fd use; + + ifdef(`hide_broken_symptoms',` + fs_dontaudit_rw_anon_inodefs_files(chrome_sandbox_t) + ') +') + + +######################################## +## +## Execute chrome_sandbox in the chrome_sandbox domain, and +## allow the specified role the chrome_sandbox domain. +## +## +## +## Domain allowed access +## +## +## +## +## The role to be allowed the chrome_sandbox domain. +## +## +# +interface(`chrome_run_sandbox',` + gen_require(` + type chrome_sandbox_t; + type chrome_sandbox_nacl_t; + ') + + chrome_domtrans_sandbox($1) + role $2 types chrome_sandbox_t; + role $2 types chrome_sandbox_nacl_t; +') + +######################################## +## +## Role access for chrome sandbox +## +## +## +## Role allowed access +## +## +## +## +## User domain for the role +## +## +# +interface(`chrome_role_notrans',` + gen_require(` + type chrome_sandbox_t; + type chrome_sandbox_tmpfs_t; + type chrome_sandbox_nacl_t; + ') + + role $1 types chrome_sandbox_t; + role $1 types chrome_sandbox_nacl_t; + + ps_process_pattern($2, chrome_sandbox_t) + allow $2 chrome_sandbox_t:process signal_perms; + + allow chrome_sandbox_t $2:unix_dgram_socket { read write }; + allow $2 chrome_sandbox_t:unix_dgram_socket { read write }; + allow chrome_sandbox_t $2:unix_stream_socket { getattr read write }; + dontaudit chrome_sandbox_t $2:unix_stream_socket shutdown; + allow chrome_sandbox_nacl_t $2:unix_stream_socket { getattr read write }; + allow $2 chrome_sandbox_nacl_t:unix_stream_socket { getattr read write }; + allow $2 chrome_sandbox_t:unix_stream_socket { getattr read write }; + + allow $2 chrome_sandbox_t:shm rw_shm_perms; + + allow $2 chrome_sandbox_tmpfs_t:file rw_file_perms; +') + +######################################## +## +## Role access for chrome sandbox +## +## +## +## Role allowed access +## +## +## +## +## User domain for the role +## +## +# +interface(`chrome_role',` + chrome_role_notrans($1, $2) + chrome_domtrans_sandbox($2) +') + +######################################## +## +## Dontaudit read/write to a chrome_sandbox leaks +## +## +## +## Domain to not audit. +## +## +# +interface(`chrome_dontaudit_sandbox_leaks',` + gen_require(` + type chrome_sandbox_t; + ') + + dontaudit $1 chrome_sandbox_t:unix_stream_socket { read write }; +') diff --git a/chrome.te b/chrome.te new file mode 100644 index 0000000..0444bb3 --- /dev/null +++ b/chrome.te @@ -0,0 +1,183 @@ +policy_module(chrome,1.0.0) + +######################################## +# +# Declarations +# + +type chrome_sandbox_t; +type chrome_sandbox_exec_t; +application_domain(chrome_sandbox_t, chrome_sandbox_exec_t) +role system_r types chrome_sandbox_t; +ubac_constrained(chrome_sandbox_t) + +type chrome_sandbox_tmp_t; +files_tmp_file(chrome_sandbox_tmp_t) + +type chrome_sandbox_tmpfs_t; +files_tmpfs_file(chrome_sandbox_tmpfs_t) +ubac_constrained(chrome_sandbox_tmpfs_t) + +type chrome_sandbox_nacl_t; +type chrome_sandbox_nacl_exec_t; +application_domain(chrome_sandbox_nacl_t, chrome_sandbox_nacl_exec_t) +role system_r types chrome_sandbox_nacl_t; +ubac_constrained(chrome_sandbox_nacl_t) + +######################################## +# +# chrome_sandbox local policy +# +allow chrome_sandbox_t self:capability { chown dac_override fsetid setgid setuid sys_admin sys_chroot sys_ptrace }; +allow chrome_sandbox_t self:process { signal_perms setrlimit execmem execstack }; +allow chrome_sandbox_t self:process setsched; +allow chrome_sandbox_t self:fifo_file manage_file_perms; +allow chrome_sandbox_t self:unix_stream_socket create_stream_socket_perms; +allow chrome_sandbox_t self:unix_dgram_socket { create_socket_perms sendto }; +allow chrome_sandbox_t self:shm create_shm_perms; +allow chrome_sandbox_t self:netlink_route_socket r_netlink_socket_perms; +dontaudit chrome_sandbox_t self:memprotect mmap_zero; + +manage_dirs_pattern(chrome_sandbox_t, chrome_sandbox_tmp_t, chrome_sandbox_tmp_t) +manage_files_pattern(chrome_sandbox_t, chrome_sandbox_tmp_t, chrome_sandbox_tmp_t) +files_tmp_filetrans(chrome_sandbox_t, chrome_sandbox_tmp_t, { dir file }) + +manage_files_pattern(chrome_sandbox_t, chrome_sandbox_tmpfs_t, chrome_sandbox_tmpfs_t) +fs_tmpfs_filetrans(chrome_sandbox_t, chrome_sandbox_tmpfs_t, file) + +kernel_read_system_state(chrome_sandbox_t) +kernel_read_kernel_sysctls(chrome_sandbox_t) + +fs_manage_cgroup_dirs(chrome_sandbox_t) +fs_manage_cgroup_files(chrome_sandbox_t) +fs_read_dos_files(chrome_sandbox_t) + +corecmd_exec_bin(chrome_sandbox_t) + +corenet_all_recvfrom_netlabel(chrome_sandbox_t) +corenet_tcp_connect_asterisk_port(chrome_sandbox_t) +corenet_tcp_connect_flash_port(chrome_sandbox_t) +corenet_tcp_connect_streaming_port(chrome_sandbox_t) +corenet_tcp_connect_pulseaudio_port(chrome_sandbox_t) +corenet_tcp_connect_http_port(chrome_sandbox_t) +corenet_tcp_connect_http_cache_port(chrome_sandbox_t) +corenet_tcp_connect_squid_port(chrome_sandbox_t) +corenet_tcp_sendrecv_generic_if(chrome_sandbox_t) +corenet_tcp_sendrecv_generic_node(chrome_sandbox_t) +corenet_tcp_connect_ipp_port(chrome_sandbox_t) +corenet_tcp_connect_speech_port(chrome_sandbox_t) + +domain_dontaudit_read_all_domains_state(chrome_sandbox_t) + +dev_read_urand(chrome_sandbox_t) +dev_read_sysfs(chrome_sandbox_t) +dev_rwx_zero(chrome_sandbox_t) +dev_dontaudit_getattr_all_chr_files(chrome_sandbox_t) + +files_read_etc_files(chrome_sandbox_t) +files_read_usr_files(chrome_sandbox_t) + +fs_dontaudit_getattr_all_fs(chrome_sandbox_t) + +userdom_rw_inherited_user_tmpfs_files(chrome_sandbox_t) +userdom_execute_user_tmpfs_files(chrome_sandbox_t) + +userdom_use_user_ptys(chrome_sandbox_t) +userdom_write_inherited_user_tmp_files(chrome_sandbox_t) +userdom_read_inherited_user_home_content_files(chrome_sandbox_t) +userdom_dontaudit_use_user_terminals(chrome_sandbox_t) +userdom_search_user_home_content(chrome_sandbox_t) +# This one we should figure a way to make it more secure +userdom_manage_home_certs(chrome_sandbox_t) + +miscfiles_read_fonts(chrome_sandbox_t) + +sysnet_dns_name_resolve(chrome_sandbox_t) + +optional_policy(` + gnome_rw_inherited_config(chrome_sandbox_t) + gnome_read_home_config(chrome_sandbox_t) +') + +optional_policy(` + xserver_use_user_fonts(chrome_sandbox_t) + xserver_user_x_domain_template(chrome_sandbox, chrome_sandbox_t, chrome_sandbox_tmpfs_t) +') + +tunable_policy(`use_nfs_home_dirs',` + fs_search_nfs(chrome_sandbox_t) + fs_exec_nfs_files(chrome_sandbox_t) + fs_read_nfs_files(chrome_sandbox_t) + fs_rw_inherited_nfs_files(chrome_sandbox_t) + fs_read_nfs_symlinks(chrome_sandbox_t) + fs_dontaudit_append_nfs_files(chrome_sandbox_t) +') + +tunable_policy(`use_samba_home_dirs',` + fs_search_cifs(chrome_sandbox_t) + fs_exec_cifs_files(chrome_sandbox_t) + fs_rw_inherited_cifs_files(chrome_sandbox_t) + fs_read_cifs_files(chrome_sandbox_t) + fs_read_cifs_symlinks(chrome_sandbox_t) + fs_dontaudit_append_cifs_files(chrome_sandbox_t) +') + +tunable_policy(`use_fusefs_home_dirs',` + fs_search_fusefs(chrome_sandbox_t) + fs_read_fusefs_files(chrome_sandbox_t) + fs_exec_fusefs_files(chrome_sandbox_t) + fs_read_fusefs_symlinks(chrome_sandbox_t) +') + +optional_policy(` + sandbox_use_ptys(chrome_sandbox_t) +') + + +######################################## +# +# chrome_sandbox_nacl local policy +# + +allow chrome_sandbox_nacl_t self:process { execmem setsched }; +allow chrome_sandbox_nacl_t self:fifo_file manage_fifo_file_perms; +allow chrome_sandbox_nacl_t self:unix_stream_socket create_stream_socket_perms; +allow chrome_sandbox_nacl_t self:shm create_shm_perms; +allow chrome_sandbox_nacl_t self:unix_dgram_socket { create_socket_perms sendto }; +allow chrome_sandbox_nacl_t chrome_sandbox_t:unix_stream_socket { getattr write read }; +allow chrome_sandbox_t chrome_sandbox_nacl_t:unix_stream_socket { getattr write read }; +allow chrome_sandbox_nacl_t chrome_sandbox_t:unix_dgram_socket { read write }; + +allow chrome_sandbox_nacl_t chrome_sandbox_t:shm rw_shm_perms; +allow chrome_sandbox_nacl_t chrome_sandbox_tmpfs_t:file rw_inherited_file_perms; +allow chrome_sandbox_t chrome_sandbox_nacl_t:process { sigkill sigstop signull signal share }; + +manage_files_pattern(chrome_sandbox_nacl_t, chrome_sandbox_tmpfs_t, chrome_sandbox_tmpfs_t) +fs_tmpfs_filetrans(chrome_sandbox_nacl_t, chrome_sandbox_tmpfs_t, file) + +domain_use_interactive_fds(chrome_sandbox_nacl_t) + +dontaudit chrome_sandbox_nacl_t self:memprotect mmap_zero; + +domtrans_pattern(chrome_sandbox_t, chrome_sandbox_nacl_exec_t, chrome_sandbox_nacl_t) +ps_process_pattern(chrome_sandbox_t, chrome_sandbox_nacl_t) + +kernel_read_system_state(chrome_sandbox_nacl_t) + +dev_read_urand(chrome_sandbox_nacl_t) +dev_read_sysfs(chrome_sandbox_nacl_t) + +files_read_etc_files(chrome_sandbox_nacl_t) + + +corecmd_sbin_entry_type(chrome_sandbox_nacl_t) + +userdom_use_inherited_user_ptys(chrome_sandbox_nacl_t) +userdom_rw_inherited_user_tmpfs_files(chrome_sandbox_nacl_t) +userdom_execute_user_tmpfs_files(chrome_sandbox_nacl_t) +userdom_rw_inherited_user_tmp_files(chrome_sandbox_nacl_t) +userdom_dontaudit_read_user_home_content_files(chrome_sandbox_nacl_t) + +optional_policy(` + gnome_dontaudit_write_config_files(chrome_sandbox_nacl_t) +') diff --git a/chronyd.fc b/chronyd.fc index fd8cd0b..f33885f 100644 --- a/chronyd.fc +++ b/chronyd.fc @@ -2,8 +2,12 @@ /etc/rc\.d/init\.d/chronyd -- gen_context(system_u:object_r:chronyd_initrc_exec_t,s0) +/usr/lib/systemd/system/chrony.* -- gen_context(system_u:object_r:chronyd_unit_file_t,s0) + /usr/sbin/chronyd -- gen_context(system_u:object_r:chronyd_exec_t,s0) /var/lib/chrony(/.*)? gen_context(system_u:object_r:chronyd_var_lib_t,s0) /var/log/chrony(/.*)? gen_context(system_u:object_r:chronyd_var_log_t,s0) /var/run/chronyd\.pid -- gen_context(system_u:object_r:chronyd_var_run_t,s0) +/var/run/chronyd(/.*) gen_context(system_u:object_r:chronyd_var_run_t,s0) +/var/run/chronyd\.sock gen_context(system_u:object_r:chronyd_var_run_t,s0) diff --git a/chronyd.if b/chronyd.if index 9a0da94..113eae2 100644 --- a/chronyd.if +++ b/chronyd.if @@ -19,6 +19,24 @@ interface(`chronyd_domtrans',` domtrans_pattern($1, chronyd_exec_t, chronyd_t) ') +######################################## +## +## Execute chronyd server in the chronyd domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`chronyd_initrc_domtrans',` + gen_require(` + type chronyd_initrc_exec_t; + ') + + init_labeled_script_domtrans($1, chronyd_initrc_exec_t) +') + #################################### ## ## Execute chronyd @@ -56,6 +74,125 @@ interface(`chronyd_read_log',` read_files_pattern($1, chronyd_var_log_t, chronyd_var_log_t) ') +######################################## +## +## Read and write chronyd shared memory. +## +## +## +## Domain allowed access. +## +## +# +interface(`chronyd_rw_shm',` + gen_require(` + type chronyd_t, chronyd_tmpfs_t; + ') + + allow $1 chronyd_t:shm rw_shm_perms; + allow $1 chronyd_tmpfs_t:dir list_dir_perms; + rw_files_pattern($1, chronyd_tmpfs_t, chronyd_tmpfs_t) + read_lnk_files_pattern($1, chronyd_tmpfs_t, chronyd_tmpfs_t) + fs_search_tmpfs($1) +') + +######################################## +## +## Read chronyd keys files. +## +## +## +## Domain allowed access. +## +## +# +interface(`chronyd_read_keys',` + gen_require(` + type chronyd_keys_t; + ') + + read_files_pattern($1, chronyd_keys_t, chronyd_keys_t) +') + +######################################## +## +## Append chronyd keys files. +## +## +## +## Domain allowed access. +## +## +# +interface(`chronyd_append_keys',` + gen_require(` + type chronyd_keys_t; + ') + + append_files_pattern($1, chronyd_keys_t, chronyd_keys_t) +') + +######################################## +## +## Execute chronyd server in the chronyd domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`chronyd_systemctl',` + gen_require(` + type chronyd_t; + type chronyd_unit_file_t; + ') + + systemd_exec_systemctl($1) + allow $1 chronyd_unit_file_t:file read_file_perms; + allow $1 chronyd_unit_file_t:service manage_service_perms; + + ps_process_pattern($1, chronyd_t) +') + +######################################## +## +## Connect to chronyd over a unix stream socket. +## +## +## +## Domain allowed access. +## +## +# +interface(`chronyd_stream_connect',` + gen_require(` + type chronyd_t, chronyd_var_run_t; + ') + + files_search_pids($1) + stream_connect_pattern($1, chronyd_var_run_t, chronyd_var_run_t, chronyd_t) +') + +######################################## +## +## Send to chronyd over a unix domain +## datagram socket. +## +## +## +## Domain allowed access. +## +## +# +interface(`chronyd_dgram_send',` + gen_require(` + type chronyd_t; + ') + + allow $1 chronyd_t:unix_dgram_socket sendto; +') + #################################### ## ## All of the rules required to administrate @@ -75,31 +212,38 @@ interface(`chronyd_read_log',` # interface(`chronyd_admin',` gen_require(` - type chronyd_t, chronyd_var_log_t; - type chronyd_var_run_t, chronyd_var_lib_t; - type chronyd_initrc_exec_t, chronyd_keys_t; + type chronyd_t, chronyd_var_log_t, chronyd_var_run_t; + type chronyd_var_lib_t, chronyd_tmpfs_t, chronyd_initrc_exec_t; + type chronyd_keys_t, chronyd_unit_file_t; ') - allow $1 chronyd_t:process { ptrace signal_perms }; + allow $1 chronyd_t:process signal_perms; ps_process_pattern($1, chronyd_t) + tunable_policy(`deny_ptrace',`',` + allow $1 chronyd_t:process ptrace; + ') + init_labeled_script_domtrans($1, chronyd_initrc_exec_t) domain_system_change_exemption($1) role_transition $2 chronyd_initrc_exec_t system_r; allow $2 system_r; - files_search_etc($1) + files_list_etc($1) admin_pattern($1, chronyd_keys_t) - logging_search_logs($1) + logging_list_logs($1) admin_pattern($1, chronyd_var_log_t) - files_search_var_lib($1) + files_list_var_lib($1) admin_pattern($1, chronyd_var_lib_t) - files_search_pids($1) + files_list_pids($1) admin_pattern($1, chronyd_var_run_t) - files_search_tmp($1) - admin_pattern($1, chronyd_tmp_t) + admin_pattern($1, chronyd_tmpfs_t) + + admin_pattern($1, chronyd_unit_file_t) + chronyd_systemctl($1) + allow $1 chronyd_unit_file_t:service all_service_perms; ') diff --git a/chronyd.te b/chronyd.te index fa82327..ab88d78 100644 --- a/chronyd.te +++ b/chronyd.te @@ -15,6 +15,12 @@ init_script_file(chronyd_initrc_exec_t) type chronyd_keys_t; files_type(chronyd_keys_t) +type chronyd_tmpfs_t; +files_tmpfs_file(chronyd_tmpfs_t) + +type chronyd_unit_file_t; +systemd_unit_file(chronyd_unit_file_t) + type chronyd_var_lib_t; files_type(chronyd_var_lib_t) @@ -30,13 +36,18 @@ files_pid_file(chronyd_var_run_t) # allow chronyd_t self:capability { dac_override ipc_lock setuid setgid sys_resource sys_time }; -allow chronyd_t self:process { getcap setcap setrlimit }; +allow chronyd_t self:process { getcap setcap setrlimit signal }; allow chronyd_t self:shm create_shm_perms; allow chronyd_t self:udp_socket create_socket_perms; allow chronyd_t self:unix_dgram_socket create_socket_perms; +allow chronyd_t self:fifo_file rw_fifo_file_perms; allow chronyd_t chronyd_keys_t:file read_file_perms; +manage_dirs_pattern(chronyd_t, chronyd_tmpfs_t, chronyd_tmpfs_t) +manage_files_pattern(chronyd_t, chronyd_tmpfs_t, chronyd_tmpfs_t) +fs_tmpfs_filetrans(chronyd_t, chronyd_tmpfs_t, { dir file }) + manage_files_pattern(chronyd_t, chronyd_var_lib_t, chronyd_var_lib_t) manage_dirs_pattern(chronyd_t, chronyd_var_lib_t, chronyd_var_lib_t) manage_sock_files_pattern(chronyd_t, chronyd_var_lib_t, chronyd_var_lib_t) @@ -48,8 +59,15 @@ logging_log_filetrans(chronyd_t, chronyd_var_log_t, { file dir }) manage_files_pattern(chronyd_t, chronyd_var_run_t, chronyd_var_run_t) manage_dirs_pattern(chronyd_t, chronyd_var_run_t, chronyd_var_run_t) -files_pid_filetrans(chronyd_t, chronyd_var_run_t, file) +manage_sock_files_pattern(chronyd_t, chronyd_var_run_t, chronyd_var_run_t) +files_pid_filetrans(chronyd_t, chronyd_var_run_t, { dir file sock_file }) + +kernel_read_system_state(chronyd_t) +kernel_read_network_state(chronyd_t) + +corecmd_exec_shell(chronyd_t) +corenet_udp_bind_generic_node(chronyd_t) corenet_udp_bind_ntp_port(chronyd_t) # bind to udp/323 corenet_udp_bind_chronyd_port(chronyd_t) @@ -61,7 +79,7 @@ auth_use_nsswitch(chronyd_t) logging_send_syslog_msg(chronyd_t) -miscfiles_read_localization(chronyd_t) +mta_send_mail(chronyd_t) optional_policy(` gpsd_rw_shm(chronyd_t) diff --git a/cipe.te b/cipe.te index 8e1ef38..08b238c 100644 --- a/cipe.te +++ b/cipe.te @@ -28,7 +28,6 @@ kernel_read_system_state(ciped_t) corecmd_exec_shell(ciped_t) corecmd_exec_bin(ciped_t) -corenet_all_recvfrom_unlabeled(ciped_t) corenet_all_recvfrom_netlabel(ciped_t) corenet_udp_sendrecv_generic_if(ciped_t) corenet_udp_sendrecv_generic_node(ciped_t) @@ -53,8 +52,6 @@ fs_search_auto_mountpoints(ciped_t) logging_send_syslog_msg(ciped_t) -miscfiles_read_localization(ciped_t) - sysnet_read_config(ciped_t) userdom_dontaudit_use_unpriv_user_fds(ciped_t) diff --git a/clamav.fc b/clamav.fc index e8e9a21..22986ef 100644 --- a/clamav.fc +++ b/clamav.fc @@ -8,9 +8,13 @@ /usr/sbin/clamd -- gen_context(system_u:object_r:clamd_exec_t,s0) /usr/sbin/clamav-milter -- gen_context(system_u:object_r:clamd_exec_t,s0) +/usr/lib/systemd/system/clamd.* -- gen_context(system_u:object_r:clamd_unit_file_t,s0) + /var/clamav(/.*)? gen_context(system_u:object_r:clamd_var_lib_t,s0) /var/lib/clamav(/.*)? gen_context(system_u:object_r:clamd_var_lib_t,s0) +/var/lib/clamd.* gen_context(system_u:object_r:clamd_var_lib_t,s0) /var/log/clamav.* gen_context(system_u:object_r:clamd_var_log_t,s0) +/var/log/freshclam.* -- gen_context(system_u:object_r:freshclam_var_log_t,s0) /var/log/clamav/freshclam.* -- gen_context(system_u:object_r:freshclam_var_log_t,s0) /var/log/clamd.* gen_context(system_u:object_r:clamd_var_log_t,s0) /var/run/amavis(d)?/clamd\.pid -- gen_context(system_u:object_r:clamd_var_run_t,s0) diff --git a/clamav.if b/clamav.if index bbac14a..99c5cca 100644 --- a/clamav.if +++ b/clamav.if @@ -33,6 +33,7 @@ interface(`clamav_stream_connect',` type clamd_t, clamd_var_run_t; ') + files_search_pids($1) stream_connect_pattern($1, clamd_var_run_t, clamd_var_run_t, clamd_t) ') @@ -133,6 +134,68 @@ interface(`clamav_exec_clamscan',` ######################################## ## +## Manage clamd pid content. +## +## +## +## Domain allowed access. +## +## +# +interface(`clamav_manage_clamd_pid',` + gen_require(` + type clamd_var_run_t; + ') + + manage_dirs_pattern($1, clamd_var_run_t, clamd_var_run_t) + manage_files_pattern($1, clamd_var_run_t, clamd_var_run_t) +') + +####################################### +## +## Read clamd state files. +## +## +## +## Domain allowed access. +## +## +# +interface(`clamav_read_state_clamd',` + gen_require(` + type clamd_t; + ') + + kernel_search_proc($1) + ps_process_pattern($1, clamd_t) +') + +####################################### +## +## Execute clamd server in the clamd domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`clamd_systemctl',` + gen_require(` + type clamd_t; + type clamd_unit_file_t; + ') + + systemd_exec_systemctl($1) + systemd_read_fifo_file_passwd_run($1) + allow $1 clamd_unit_file_t:file read_file_perms; + allow $1 clamd_unit_file_t:service manage_service_perms; + + ps_process_pattern($1, clamd_t) +') + +######################################## +## ## All of the rules required to administrate ## an clamav environment ## @@ -151,19 +214,25 @@ interface(`clamav_exec_clamscan',` interface(`clamav_admin',` gen_require(` type clamd_t, clamd_etc_t, clamd_tmp_t; - type clamd_var_log_t, clamd_var_lib_t; - type clamd_var_run_t, clamscan_t, clamscan_tmp_t; - type clamd_initrc_exec_t; + type clamd_var_log_t, clamd_var_lib_t, clamd_var_run_t; + type clamscan_t, clamscan_tmp_t, clamd_initrc_exec_t; type freshclam_t, freshclam_var_log_t; + type clamd_unit_file_t; ') - allow $1 clamd_t:process { ptrace signal_perms }; + allow $1 clamd_t:process signal_perms; ps_process_pattern($1, clamd_t) - allow $1 clamscan_t:process { ptrace signal_perms }; + tunable_policy(`deny_ptrace',`',` + allow $1 clamd_t:process ptrace; + allow $1 clamscan_t:process ptrace; + allow $1 freshclam_t:process ptrace; + ') + + allow $1 clamscan_t:process signal_perms; ps_process_pattern($1, clamscan_t) - allow $1 freshclam_t:process { ptrace signal_perms }; + allow $1 freshclam_t:process signal_perms; ps_process_pattern($1, freshclam_t) init_labeled_script_domtrans($1, clamd_initrc_exec_t) @@ -171,6 +240,10 @@ interface(`clamav_admin',` role_transition $2 clamd_initrc_exec_t system_r; allow $2 system_r; + clamd_systemctl($1) + admin_pattern($1, clamd_unit_file_t) + allow $1 clamd_unit_file_t:service all_service_perms; + files_list_etc($1) admin_pattern($1, clamd_etc_t) @@ -189,4 +262,10 @@ interface(`clamav_admin',` admin_pattern($1, clamscan_tmp_t) admin_pattern($1, freshclam_var_log_t) + + optional_policy(` + systemd_passwd_agent_exec($1) + systemd_read_fifo_file_passwd_run($1) + ') + ') diff --git a/clamav.te b/clamav.te index a10350e..0294412 100644 --- a/clamav.te +++ b/clamav.te @@ -1,9 +1,23 @@ policy_module(clamav, 1.10.0) ## -##

-## Allow clamd to use JIT compiler -##

+##

+## Allow clamscan to read user content +##

+## +gen_tunable(clamscan_read_user_content, false) + +## +##

+## Allow clamscan to non security files on a system +##

+## +gen_tunable(clamscan_can_scan_system, false) + +## +##

+## Allow clamd to use JIT compiler +##

## gen_tunable(clamd_use_jit, false) @@ -24,6 +38,9 @@ files_config_file(clamd_etc_t) type clamd_initrc_exec_t; init_script_file(clamd_initrc_exec_t) +type clamd_unit_file_t; +systemd_unit_file(clamd_unit_file_t) + # tmp files type clamd_tmp_t; files_tmp_file(clamd_tmp_t) @@ -64,6 +81,8 @@ logging_log_file(freshclam_var_log_t) allow clamd_t self:capability { kill setgid setuid dac_override }; dontaudit clamd_t self:capability sys_tty_config; +allow clamd_t self:process signal; + allow clamd_t self:fifo_file rw_fifo_file_perms; allow clamd_t self:unix_stream_socket { create_stream_socket_perms connectto }; allow clamd_t self:unix_dgram_socket create_socket_perms; @@ -80,6 +99,7 @@ manage_files_pattern(clamd_t, clamd_tmp_t, clamd_tmp_t) files_tmp_filetrans(clamd_t, clamd_tmp_t, { file dir }) # var/lib files for clamd +manage_sock_files_pattern(clamd_t, clamd_var_lib_t, clamd_var_lib_t) manage_dirs_pattern(clamd_t, clamd_var_lib_t, clamd_var_lib_t) manage_files_pattern(clamd_t, clamd_var_lib_t, clamd_var_lib_t) @@ -89,9 +109,10 @@ manage_files_pattern(clamd_t, clamd_var_log_t, clamd_var_log_t) logging_log_filetrans(clamd_t, clamd_var_log_t, { dir file }) # pid file +manage_dirs_pattern(clamd_t, clamd_var_run_t, clamd_var_run_t) manage_files_pattern(clamd_t, clamd_var_run_t, clamd_var_run_t) manage_sock_files_pattern(clamd_t, clamd_var_run_t, clamd_var_run_t) -files_pid_filetrans(clamd_t, clamd_var_run_t, { file dir }) +files_pid_filetrans(clamd_t, clamd_var_run_t, { sock_file file dir }) kernel_dontaudit_list_proc(clamd_t) kernel_read_sysctl(clamd_t) @@ -100,7 +121,6 @@ kernel_read_system_state(clamd_t) corecmd_exec_shell(clamd_t) -corenet_all_recvfrom_unlabeled(clamd_t) corenet_all_recvfrom_netlabel(clamd_t) corenet_tcp_sendrecv_generic_if(clamd_t) corenet_tcp_sendrecv_generic_node(clamd_t) @@ -110,6 +130,7 @@ corenet_tcp_bind_generic_node(clamd_t) corenet_tcp_bind_clamd_port(clamd_t) corenet_tcp_bind_generic_port(clamd_t) corenet_tcp_connect_generic_port(clamd_t) +corenet_tcp_connect_clamd_port(clamd_t) corenet_sendrecv_clamd_server_packets(clamd_t) dev_read_rand(clamd_t) @@ -117,7 +138,6 @@ dev_read_urand(clamd_t) domain_use_interactive_fds(clamd_t) -files_read_etc_files(clamd_t) files_read_etc_runtime_files(clamd_t) files_search_spool(clamd_t) @@ -125,15 +145,6 @@ auth_use_nsswitch(clamd_t) logging_send_syslog_msg(clamd_t) -miscfiles_read_localization(clamd_t) - -cron_use_fds(clamd_t) -cron_use_system_job_fds(clamd_t) -cron_rw_pipes(clamd_t) - -mta_read_config(clamd_t) -mta_send_mail(clamd_t) - optional_policy(` amavis_read_lib_files(clamd_t) amavis_read_spool_files(clamd_t) @@ -142,13 +153,31 @@ optional_policy(` ') optional_policy(` + cron_use_fds(clamd_t) + cron_use_system_job_fds(clamd_t) + cron_rw_pipes(clamd_t) +') + +optional_policy(` exim_read_spool_files(clamd_t) ') +optional_policy(` + mta_read_config(clamd_t) + mta_send_mail(clamd_t) +') + +optional_policy(` + spamd_stream_connect(clamd_t) + spamassassin_read_pid_files(clamd_t) +') + tunable_policy(`clamd_use_jit',` allow clamd_t self:process execmem; -', ` + allow clamscan_t self:process execmem; +',` dontaudit clamd_t self:process execmem; + dontaudit clamscan_t self:process execmem; ') ######################################## @@ -178,17 +207,25 @@ files_pid_filetrans(freshclam_t, clamd_var_run_t, file) # log files (own logfiles only) manage_files_pattern(freshclam_t, freshclam_var_log_t, freshclam_var_log_t) -allow freshclam_t freshclam_var_log_t:dir setattr; -allow freshclam_t clamd_var_log_t:dir search_dir_perms; +allow freshclam_t freshclam_var_log_t:dir setattr_dir_perms; +read_files_pattern(freshclam_t, clamd_var_log_t, clamd_var_log_t) logging_log_filetrans(freshclam_t, freshclam_var_log_t, file) -corenet_all_recvfrom_unlabeled(freshclam_t) +kernel_read_kernel_sysctls(freshclam_t) +kernel_read_network_state(freshclam_t) +kernel_read_system_state(freshclam_t) + +corecmd_exec_shell(freshclam_t) +corecmd_exec_bin(freshclam_t) + corenet_all_recvfrom_netlabel(freshclam_t) corenet_tcp_sendrecv_generic_if(freshclam_t) corenet_tcp_sendrecv_generic_node(freshclam_t) corenet_tcp_sendrecv_all_ports(freshclam_t) corenet_tcp_sendrecv_clamd_port(freshclam_t) corenet_tcp_connect_http_port(freshclam_t) +corenet_tcp_connect_clamd_port(freshclam_t) +corenet_tcp_connect_squid_port(freshclam_t) corenet_sendrecv_http_client_packets(freshclam_t) dev_read_rand(freshclam_t) @@ -196,27 +233,30 @@ dev_read_urand(freshclam_t) domain_use_interactive_fds(freshclam_t) -files_read_etc_files(freshclam_t) files_read_etc_runtime_files(freshclam_t) auth_use_nsswitch(freshclam_t) logging_send_syslog_msg(freshclam_t) -miscfiles_read_localization(freshclam_t) - clamav_stream_connect(freshclam_t) -optional_policy(` - cron_system_entry(freshclam_t, freshclam_exec_t) -') +userdom_stream_connect(freshclam_t) tunable_policy(`clamd_use_jit',` allow freshclam_t self:process execmem; -', ` +',` dontaudit freshclam_t self:process execmem; ') +optional_policy(` + clamd_systemctl(freshclam_t) +') + +optional_policy(` + cron_system_entry(freshclam_t, freshclam_exec_t) +') + ######################################## # # clamscam local policy @@ -242,15 +282,34 @@ files_tmp_filetrans(clamscan_t, clamscan_tmp_t, { file dir }) manage_files_pattern(clamscan_t, clamd_var_lib_t, clamd_var_lib_t) allow clamscan_t clamd_var_lib_t:dir list_dir_perms; -corenet_all_recvfrom_unlabeled(clamscan_t) +read_files_pattern(clamscan_t, clamd_var_run_t, clamd_var_run_t) +allow clamscan_t clamd_var_run_t:dir list_dir_perms; + +kernel_read_system_state(clamscan_t) + corenet_all_recvfrom_netlabel(clamscan_t) corenet_tcp_sendrecv_generic_if(clamscan_t) corenet_tcp_sendrecv_generic_node(clamscan_t) corenet_tcp_sendrecv_all_ports(clamscan_t) corenet_tcp_sendrecv_clamd_port(clamscan_t) +corenet_tcp_bind_generic_node(clamscan_t) corenet_tcp_connect_clamd_port(clamscan_t) +corecmd_read_all_executables(clamscan_t) + +tunable_policy(`clamscan_read_user_content',` + userdom_read_user_home_content_files(clamscan_t) + userdom_dontaudit_read_user_home_content_files(clamscan_t) +') + +tunable_policy(`clamscan_can_scan_system',` + files_read_non_security_files(clamscan_t) + files_getattr_all_pipes(clamscan_t) + files_getattr_all_sockets(clamscan_t) +') + kernel_read_kernel_sysctls(clamscan_t) +kernel_read_system_state(clamscan_t) files_read_etc_files(clamscan_t) files_read_etc_runtime_files(clamscan_t) @@ -259,15 +318,19 @@ files_search_var_lib(clamscan_t) init_read_utmp(clamscan_t) init_dontaudit_write_utmp(clamscan_t) -miscfiles_read_localization(clamscan_t) miscfiles_read_public_files(clamscan_t) clamav_stream_connect(clamscan_t) -mta_send_mail(clamscan_t) +sysnet_read_config(clamscan_t) + +optional_policy(` + mta_send_mail(clamscan_t) + mta_read_queue(clamscan_t) +') optional_policy(` - amavis_read_spool_files(clamscan_t) + amavis_manage_spool_files(clamscan_t) ') optional_policy(` diff --git a/clockspeed.te b/clockspeed.te index b40f3f7..e8c9c35 100644 --- a/clockspeed.te +++ b/clockspeed.te @@ -26,7 +26,6 @@ allow clockspeed_cli_t self:udp_socket create_socket_perms; read_files_pattern(clockspeed_cli_t, clockspeed_var_lib_t, clockspeed_var_lib_t) -corenet_all_recvfrom_unlabeled(clockspeed_cli_t) corenet_all_recvfrom_netlabel(clockspeed_cli_t) corenet_udp_sendrecv_generic_if(clockspeed_cli_t) corenet_udp_sendrecv_generic_node(clockspeed_cli_t) @@ -36,9 +35,8 @@ corenet_sendrecv_ntp_client_packets(clockspeed_cli_t) files_list_var_lib(clockspeed_cli_t) files_read_etc_files(clockspeed_cli_t) -miscfiles_read_localization(clockspeed_cli_t) -userdom_use_user_terminals(clockspeed_cli_t) +userdom_use_inherited_user_terminals(clockspeed_cli_t) ######################################## # @@ -53,7 +51,6 @@ allow clockspeed_srv_t self:unix_stream_socket create_socket_perms; manage_files_pattern(clockspeed_srv_t, clockspeed_var_lib_t, clockspeed_var_lib_t) manage_fifo_files_pattern(clockspeed_srv_t, clockspeed_var_lib_t, clockspeed_var_lib_t) -corenet_all_recvfrom_unlabeled(clockspeed_srv_t) corenet_all_recvfrom_netlabel(clockspeed_srv_t) corenet_udp_sendrecv_generic_if(clockspeed_srv_t) corenet_udp_sendrecv_generic_node(clockspeed_srv_t) @@ -65,7 +62,6 @@ corenet_sendrecv_clockspeed_server_packets(clockspeed_srv_t) files_read_etc_files(clockspeed_srv_t) files_list_var_lib(clockspeed_srv_t) -miscfiles_read_localization(clockspeed_srv_t) optional_policy(` daemontools_service_domain(clockspeed_srv_t, clockspeed_srv_exec_t) diff --git a/clogd.te b/clogd.te index 6077339..d44d33f 100644 --- a/clogd.te +++ b/clogd.te @@ -46,8 +46,6 @@ storage_raw_write_fixed_disk(clogd_t) logging_send_syslog_msg(clogd_t) -miscfiles_read_localization(clogd_t) - optional_policy(` aisexec_stream_connect(clogd_t) corosync_stream_connect(clogd_t) diff --git a/cloudform.fc b/cloudform.fc new file mode 100644 index 0000000..61ab864 --- /dev/null +++ b/cloudform.fc @@ -0,0 +1,20 @@ +/etc/rc\.d/init\.d/iwhd -- gen_context(system_u:object_r:iwhd_initrc_exec_t,s0) +/etc/rc\.d/init\.d/mongod -- gen_context(system_u:object_r:mongod_initrc_exec_t,s0) + +/usr/bin/deltacloudd -- gen_context(system_u:object_r:deltacloudd_exec_t,s0) +/usr/bin/iwhd -- gen_context(system_u:object_r:iwhd_exec_t,s0) +/usr/bin/mongod -- gen_context(system_u:object_r:mongod_exec_t,s0) + +/usr/share/aeolus-conductor/dbomatic/dbomatic -- gen_context(system_u:object_r:mongod_exec_t,s0) + +/var/lib/iwhd(/.*)? gen_context(system_u:object_r:iwhd_var_lib_t,s0) +/var/lib/mongodb(/.*)? gen_context(system_u:object_r:mongod_var_lib_t,s0) + +/var/log/deltacloud-core(/.*)? gen_context(system_u:object_r:deltacloudd_log_t,s0) +/var/log/iwhd\.log.* -- gen_context(system_u:object_r:iwhd_log_t,s0) +/var/log/mongodb(/.*)? gen_context(system_u:object_r:mongod_log_t,s0) +/var/log/aeolus-conductor/dbomatic\.log.* -- gen_context(system_u:object_r:mongod_log_t,s0) + +/var/run/mongodb(/.*)? gen_context(system_u:object_r:mongod_var_run_t,s0) +/var/run/aeolus/dbomatic\.pid -- gen_context(system_u:object_r:mongod_var_run_t,s0) +/var/run/iwhd\.pid -- gen_context(system_u:object_r:iwhd_var_run_t,s0) diff --git a/cloudform.if b/cloudform.if new file mode 100644 index 0000000..7f55959 --- /dev/null +++ b/cloudform.if @@ -0,0 +1,40 @@ +## cloudform policy + +####################################### +## +## Creates types and rules for a basic +## cloudform daemon domain. +## +## +## +## Prefix for the domain. +## +## +# +template(`cloudform_domain_template',` + gen_require(` + attribute cloudform_domain; + ') + + type $1_t, cloudform_domain; + type $1_exec_t; + init_daemon_domain($1_t, $1_exec_t) +') + +###################################### +## +## Execute mongod in the caller domain. +## +## +## +## Domain allowed access. +## +## +# +interface(`cloudform_exec_mongod',` + gen_require(` + type mongod_exec_t; + ') + + can_exec($1, mongod_exec_t) +') diff --git a/cloudform.te b/cloudform.te new file mode 100644 index 0000000..1f85fcb --- /dev/null +++ b/cloudform.te @@ -0,0 +1,198 @@ +policy_module(cloudform, 1.0) +######################################## +# +# Declarations +# + +attribute cloudform_domain; + +cloudform_domain_template(deltacloudd) +cloudform_domain_template(iwhd) +cloudform_domain_template(mongod) + +type deltacloudd_log_t; +logging_log_file(deltacloudd_log_t) + +type deltacloudd_var_run_t; +files_pid_file(deltacloudd_var_run_t) + +type deltacloudd_tmp_t; +files_tmp_file(deltacloudd_tmp_t) + +type iwhd_initrc_exec_t; +init_script_file(iwhd_initrc_exec_t) + +type iwhd_var_lib_t; +files_type(iwhd_var_lib_t) + +type iwhd_var_run_t; +files_pid_file(iwhd_var_run_t) + +type mongod_initrc_exec_t; +init_script_file(mongod_initrc_exec_t) + +type mongod_log_t; +logging_log_file(mongod_log_t) + +type mongod_var_lib_t; +files_type(mongod_var_lib_t) + +type mongod_tmp_t; +files_tmp_file(mongod_tmp_t) + +type mongod_var_run_t; +files_pid_file(mongod_var_run_t) + +type iwhd_log_t; +logging_log_file(iwhd_log_t) + +######################################## +# +# cloudform_domain local policy +# + +allow cloudform_domain self:fifo_file rw_fifo_file_perms; +allow cloudform_domain self:tcp_socket create_stream_socket_perms; + +kernel_read_system_state(cloudform_domain) + +dev_read_rand(cloudform_domain) +dev_read_urand(cloudform_domain) + +files_read_etc_files(cloudform_domain) + +auth_read_passwd(cloudform_domain) + +miscfiles_read_certs(cloudform_domain) + +######################################## +# +# deltacloudd local policy +# + +allow deltacloudd_t self:capability { dac_override setuid setgid }; + +allow deltacloudd_t self:netlink_route_socket r_netlink_socket_perms; +allow deltacloudd_t self:udp_socket create_socket_perms; + +allow deltacloudd_t self:process signal; + +allow deltacloudd_t self:fifo_file rw_fifo_file_perms; +allow deltacloudd_t self:tcp_socket create_stream_socket_perms; +allow deltacloudd_t self:unix_stream_socket create_stream_socket_perms; + +manage_dirs_pattern(deltacloudd_t, deltacloudd_tmp_t, deltacloudd_tmp_t) +manage_files_pattern(deltacloudd_t, deltacloudd_tmp_t, deltacloudd_tmp_t) +files_tmp_filetrans(deltacloudd_t, deltacloudd_tmp_t, { file dir }) + +manage_files_pattern(deltacloudd_t, deltacloudd_var_run_t, deltacloudd_var_run_t) +manage_dirs_pattern(deltacloudd_t, deltacloudd_var_run_t, deltacloudd_var_run_t) +manage_lnk_files_pattern(deltacloudd_t, deltacloudd_var_run_t, deltacloudd_var_run_t) +files_pid_filetrans(deltacloudd_t, deltacloudd_var_run_t, { file dir }) + +manage_files_pattern(deltacloudd_t, deltacloudd_log_t, deltacloudd_log_t) +manage_dirs_pattern(deltacloudd_t, deltacloudd_log_t, deltacloudd_log_t) +logging_log_filetrans(deltacloudd_t, deltacloudd_log_t, { file dir }) + +kernel_read_kernel_sysctls(deltacloudd_t) +kernel_read_system_state(deltacloudd_t) + +corecmd_exec_bin(deltacloudd_t) + +corenet_tcp_bind_generic_node(deltacloudd_t) +corenet_tcp_bind_generic_port(deltacloudd_t) + +auth_use_nsswitch(deltacloudd_t) + +files_read_usr_files(deltacloudd_t) + +logging_send_syslog_msg(deltacloudd_t) + +optional_policy(` + sysnet_read_config(deltacloudd_t) +') + +######################################## +# +# iwhd local policy +# + +allow iwhd_t self:capability { chown kill }; +allow iwhd_t self:process { fork }; + +allow iwhd_t self:netlink_route_socket r_netlink_socket_perms; +allow iwhd_t self:unix_stream_socket create_stream_socket_perms; + +manage_dirs_pattern(iwhd_t, iwhd_var_lib_t, iwhd_var_lib_t) +manage_files_pattern(iwhd_t, iwhd_var_lib_t, iwhd_var_lib_t) + +manage_files_pattern(iwhd_t, iwhd_log_t, iwhd_log_t) +logging_log_filetrans(iwhd_t, iwhd_log_t, { file }) + +manage_dirs_pattern(iwhd_t, iwhd_var_run_t, iwhd_var_run_t) +manage_files_pattern(iwhd_t, iwhd_var_run_t, iwhd_var_run_t) +files_pid_filetrans(iwhd_t, iwhd_var_run_t, { dir file }) + +kernel_read_system_state(iwhd_t) + +corenet_tcp_bind_generic_node(iwhd_t) +corenet_tcp_bind_websm_port(iwhd_t) +corenet_tcp_connect_all_ports(iwhd_t) + +dev_read_rand(iwhd_t) +dev_read_urand(iwhd_t) + +userdom_home_manager(iwhd_t) + +######################################## +# +# mongod local policy +# + +allow mongod_t self:process { execmem setsched signal }; + +allow mongod_t self:netlink_route_socket r_netlink_socket_perms; +allow mongod_t self:unix_stream_socket create_stream_socket_perms; +allow mongod_t self:udp_socket create_socket_perms; + +manage_dirs_pattern(mongod_t, mongod_log_t, mongod_log_t) +manage_files_pattern(mongod_t, mongod_log_t, mongod_log_t) +logging_log_filetrans(mongod_t, mongod_log_t, file, "dbomatic.log") + +manage_dirs_pattern(mongod_t, mongod_var_lib_t, mongod_var_lib_t) +manage_files_pattern(mongod_t, mongod_var_lib_t, mongod_var_lib_t) + +manage_dirs_pattern(mongod_t, mongod_tmp_t, mongod_tmp_t) +manage_files_pattern(mongod_t, mongod_tmp_t, mongod_tmp_t) +manage_sock_files_pattern(mongod_t, mongod_tmp_t, mongod_tmp_t) +files_tmp_filetrans(mongod_t, mongod_tmp_t, { file dir sock_file }) + +manage_dirs_pattern(mongod_t, mongod_var_run_t, mongod_var_run_t) +manage_files_pattern(mongod_t, mongod_var_run_t, mongod_var_run_t) +#needed by dbomatic +files_pid_filetrans(mongod_t, mongod_var_run_t, { file }) + +corecmd_exec_bin(mongod_t) +corecmd_exec_shell(mongod_t) + +corenet_tcp_bind_generic_node(mongod_t) +corenet_tcp_bind_mongod_port(mongod_t) +corenet_tcp_connect_postgresql_port(mongod_t) + +kernel_read_vm_sysctls(mongod_t) +kernel_read_system_state(mongod_t) + +files_read_usr_files(mongod_t) + +optional_policy(` + mysql_stream_connect(mongod_t) +') + +optional_policy(` + postgresql_stream_connect(mongod_t) +') + +optional_policy(` + sysnet_dns_name_resolve(mongod_t) +') + diff --git a/cmirrord.if b/cmirrord.if index f8463c0..126b293 100644 --- a/cmirrord.if +++ b/cmirrord.if @@ -70,10 +70,11 @@ interface(`cmirrord_rw_shm',` type cmirrord_t, cmirrord_tmpfs_t; ') - allow $1 cmirrord_t:shm rw_shm_perms; + allow $1 cmirrord_t:shm { rw_shm_perms destroy }; allow $1 cmirrord_tmpfs_t:dir list_dir_perms; rw_files_pattern($1, cmirrord_tmpfs_t, cmirrord_tmpfs_t) + delete_files_pattern($1, cmirrord_tmpfs_t, cmirrord_tmpfs_t) read_lnk_files_pattern($1, cmirrord_tmpfs_t, cmirrord_tmpfs_t) fs_search_tmpfs($1) ') @@ -100,9 +101,13 @@ interface(`cmirrord_admin',` type cmirrord_t, cmirrord_initrc_exec_t, cmirrord_var_run_t; ') - allow $1 cmirrord_t:process { ptrace signal_perms }; + allow $1 cmirrord_t:process signal_perms; ps_process_pattern($1, cmirrord_t) + tunable_policy(`deny_ptrace',`',` + allow $1 cmorrord_t:process ptrace; + ') + cmirrord_initrc_domtrans($1) domain_system_change_exemption($1) role_transition $2 cmirrord_initrc_exec_t system_r; diff --git a/cmirrord.te b/cmirrord.te index 28fdd8a..5605ed7 100644 --- a/cmirrord.te +++ b/cmirrord.te @@ -51,8 +51,6 @@ seutil_read_file_contexts(cmirrord_t) logging_send_syslog_msg(cmirrord_t) -miscfiles_read_localization(cmirrord_t) - optional_policy(` corosync_stream_connect(cmirrord_t) ') diff --git a/cobbler.fc b/cobbler.fc index 1cf6c4e..0858f92 100644 --- a/cobbler.fc +++ b/cobbler.fc @@ -1,7 +1,35 @@ -/etc/cobbler(/.*)? gen_context(system_u:object_r:cobbler_etc_t, s0) -/etc/rc\.d/init\.d/cobblerd -- gen_context(system_u:object_r:cobblerd_initrc_exec_t, s0) -/usr/bin/cobblerd -- gen_context(system_u:object_r:cobblerd_exec_t, s0) +/etc/cobbler(/.*)? gen_context(system_u:object_r:cobbler_etc_t,s0) + +/etc/rc\.d/init\.d/cobblerd -- gen_context(system_u:object_r:cobblerd_initrc_exec_t,s0) + +/usr/lib/systemd/system/cobblerd.* -- gen_context(system_u:object_r:cobblerd_unit_file_t,s0) + +/usr/bin/cobblerd -- gen_context(system_u:object_r:cobblerd_exec_t,s0) + +/var/lib/cobbler(/.*)? gen_context(system_u:object_r:cobbler_var_lib_t,s0) + +/var/lib/tftpboot/etc(/.*)? gen_context(system_u:object_r:cobbler_var_lib_t,s0) +/var/lib/tftpboot/grub(/.*)? gen_context(system_u:object_r:cobbler_var_lib_t,s0) +/var/lib/tftpboot/images(/.*)? gen_context(system_u:object_r:cobbler_var_lib_t,s0) +/var/lib/tftpboot/memdisk -- gen_context(system_u:object_r:cobbler_var_lib_t,s0) +/var/lib/tftpboot/menu\.c32 -- gen_context(system_u:object_r:cobbler_var_lib_t,s0) +/var/lib/tftpboot/ppc(/.*)? gen_context(system_u:object_r:cobbler_var_lib_t,s0) +/var/lib/tftpboot/pxelinux\.0 -- gen_context(system_u:object_r:cobbler_var_lib_t,s0) +/var/lib/tftpboot/pxelinux\.cfg(/.*)? gen_context(system_u:object_r:cobbler_var_lib_t,s0) +/var/lib/tftpboot/s390x(/.*)? gen_context(system_u:object_r:cobbler_var_lib_t,s0) +/var/lib/tftpboot/yaboot -- gen_context(system_u:object_r:cobbler_var_lib_t,s0) + +/var/log/cobbler(/.*)? gen_context(system_u:object_r:cobbler_var_log_t,s0) + +# This should removable when cobbler package installs /var/www/cobbler/rendered +/var/www/cobbler(/.*)? gen_context(system_u:object_r:httpd_cobbler_content_t,s0) + +/var/www/cobbler/images(/.*)? gen_context(system_u:object_r:cobbler_var_lib_t,s0) +/var/www/cobbler/ks_mirror(/.*)? gen_context(system_u:object_r:cobbler_var_lib_t,s0) +/var/www/cobbler/links(/.*)? gen_context(system_u:object_r:cobbler_var_lib_t,s0) +/var/www/cobbler/localmirror(/.*)? gen_context(system_u:object_r:cobbler_var_lib_t,s0) +/var/www/cobbler/pub(/.*)? gen_context(system_u:object_r:cobbler_var_lib_t,s0) +/var/www/cobbler/rendered(/.*)? gen_context(system_u:object_r:cobbler_var_lib_t,s0) +/var/www/cobbler/repo_mirror(/.*)? gen_context(system_u:object_r:cobbler_var_lib_t,s0) -/var/lib/cobbler(/.*)? gen_context(system_u:object_r:cobbler_var_lib_t, s0) -/var/log/cobbler(/.*)? gen_context(system_u:object_r:cobbler_var_log_t, s0) diff --git a/cobbler.if b/cobbler.if index 116d60f..e2c6ec6 100644 --- a/cobbler.if +++ b/cobbler.if @@ -1,12 +1,12 @@ ## Cobbler installation server. ## ##

-## Cobbler is a Linux installation server that allows for -## rapid setup of network installation environments. It -## glues together and automates many associated Linux -## tasks so you do not have to hop between lots of various -## commands and applications when rolling out new systems, -## and, in some cases, changing existing ones. +## Cobbler is a Linux installation server that allows for +## rapid setup of network installation environments. It +## glues together and automates many associated Linux +## tasks so you do not have to hop between lots of various +## commands and applications when rolling out new systems, +## and, in some cases, changing existing ones. ##

## @@ -15,9 +15,9 @@ ## Execute a domain transition to run cobblerd. ## ## -## +## ## Domain allowed to transition. -## +## ## # interface(`cobblerd_domtrans',` @@ -26,6 +26,7 @@ interface(`cobblerd_domtrans',` ') domtrans_pattern($1, cobblerd_exec_t, cobblerd_t) + corecmd_search_bin($1) ') ######################################## @@ -48,7 +49,7 @@ interface(`cobblerd_initrc_domtrans',` ######################################## ## -## Read Cobbler content in /etc +## List Cobbler configuration. ## ## ## @@ -56,19 +57,18 @@ interface(`cobblerd_initrc_domtrans',` ## ## # -interface(`cobbler_read_config',` +interface(`cobbler_list_config',` gen_require(` type cobbler_etc_t; ') - read_files_pattern($1, cobbler_etc_t, cobbler_etc_t) + list_dirs_pattern($1, cobbler_etc_t, cobbler_etc_t) files_search_etc($1) ') ######################################## ## -## Do not audit attempts to read and write -## Cobbler log files (leaked fd). +## Read Cobbler configuration files. ## ## ## @@ -76,12 +76,13 @@ interface(`cobbler_read_config',` ## ## # -interface(`cobbler_dontaudit_rw_log',` +interface(`cobbler_read_config',` gen_require(` - type cobbler_var_log_t; + type cobbler_etc_t; ') - dontaudit $1 cobbler_var_log_t:file rw_file_perms; + read_files_pattern($1, cobbler_etc_t, cobbler_etc_t) + files_search_etc($1) ') ######################################## @@ -100,6 +101,7 @@ interface(`cobbler_search_lib',` ') search_dirs_pattern($1, cobbler_var_lib_t, cobbler_var_lib_t) + read_lnk_files_pattern($1, cobbler_var_lib_t, cobbler_var_lib_t) files_search_var_lib($1) ') @@ -119,6 +121,7 @@ interface(`cobbler_read_lib_files',` ') read_files_pattern($1, cobbler_var_lib_t, cobbler_var_lib_t) + read_lnk_files_pattern($1, cobbler_var_lib_t, cobbler_var_lib_t) files_search_var_lib($1) ') @@ -137,12 +140,56 @@ interface(`cobbler_manage_lib_files',` type cobbler_var_lib_t; ') + manage_dirs_pattern($1, cobbler_var_lib_t, cobbler_var_lib_t) manage_files_pattern($1, cobbler_var_lib_t, cobbler_var_lib_t) + manage_lnk_files_pattern($1, cobbler_var_lib_t, cobbler_var_lib_t) files_search_var_lib($1) ') ######################################## ## +## Do not audit attempts to read and write +## Cobbler log files (leaked fd). +## +## +## +## Domain to not audit. +## +## +# +interface(`cobbler_dontaudit_rw_log',` + gen_require(` + type cobbler_var_log_t; + ') + + dontaudit $1 cobbler_var_log_t:file rw_inherited_file_perms; +') + +######################################## +## +## Execute cobblerd server in the cobblerd domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`cobblerd_systemctl',` + gen_require(` + type cobblerd_t; + type cobblerd_unit_file_t; + ') + + systemd_exec_systemctl($1) + allow $1 cobblerd_unit_file_t:file read_file_perms; + allow $1 cobblerd_unit_file_t:service manage_service_perms; + + ps_process_pattern($1, cobblerd_t) +') + +######################################## +## ## All of the rules required to administrate ## an cobblerd environment ## @@ -161,25 +208,43 @@ interface(`cobbler_manage_lib_files',` interface(`cobblerd_admin',` gen_require(` type cobblerd_t, cobbler_var_lib_t, cobbler_var_log_t; - type cobbler_etc_t, cobblerd_initrc_exec_t; + type cobbler_etc_t, cobblerd_initrc_exec_t, httpd_cobbler_content_t; + type httpd_cobbler_content_ra_t, httpd_cobbler_content_rw_t; + type cobblerd_unit_file_t; ') - allow $1 cobblerd_t:process { ptrace signal_perms getattr }; - read_files_pattern($1, cobblerd_t, cobblerd_t) + allow $1 cobblerd_t:process signal_perms; + ps_process_pattern($1, cobblerd_t) - files_search_etc($1) + tunable_policy(`deny_ptrace',`',` + allow $1 cobblerd_t:process ptrace; + ') + + files_list_etc($1) admin_pattern($1, cobbler_etc_t) files_list_var_lib($1) admin_pattern($1, cobbler_var_lib_t) - logging_search_logs($1) + logging_list_logs($1) admin_pattern($1, cobbler_var_log_t) + apache_list_sys_content($1) + admin_pattern($1, httpd_cobbler_content_t) + admin_pattern($1, httpd_cobbler_content_ra_t) admin_pattern($1, httpd_cobbler_content_rw_t) cobblerd_initrc_domtrans($1) domain_system_change_exemption($1) role_transition $2 cobblerd_initrc_exec_t system_r; allow $2 system_r; + + optional_policy(` + # traverse /var/lib/tftpdir to get to cobbler_var_lib_t there. + tftp_search_rw_content($1) + ') + + cobblerd_systemctl($1) + admin_pattern($1, cobblerd_unit_file_t) + allow $1 cobblerd_unit_file_t:service all_service_perms; ') diff --git a/cobbler.te b/cobbler.te index 0258b48..9e6608d 100644 --- a/cobbler.te +++ b/cobbler.te @@ -6,13 +6,35 @@ policy_module(cobbler, 1.1.0) # ## -##

-## Allow Cobbler to modify public files -## used for public file transfer services. -##

+##

+## Allow Cobbler to modify public files +## used for public file transfer services. +##

## gen_tunable(cobbler_anon_write, false) +## +##

+## Allow Cobbler to connect to the +## network using TCP. +##

+## +gen_tunable(cobbler_can_network_connect, false) + +## +##

+## Allow Cobbler to access cifs file systems. +##

+## +gen_tunable(cobbler_use_cifs, false) + +## +##

+## Allow Cobbler to access nfs file systems. +##

+## +gen_tunable(cobbler_use_nfs, false) + type cobblerd_t; type cobblerd_exec_t; init_daemon_domain(cobblerd_t, cobblerd_exec_t) @@ -26,25 +48,43 @@ files_config_file(cobbler_etc_t) type cobbler_var_log_t; logging_log_file(cobbler_var_log_t) -type cobbler_var_lib_t; +type cobbler_var_lib_t alias cobbler_content_t; files_type(cobbler_var_lib_t) +type cobbler_tmp_t; +files_tmp_file(cobbler_tmp_t) + +type cobblerd_unit_file_t; +systemd_unit_file(cobblerd_unit_file_t) + ######################################## # # Cobbler personal policy. # -allow cobblerd_t self:capability { chown dac_override fowner sys_nice }; +allow cobblerd_t self:capability { chown dac_override fowner fsetid sys_nice }; +dontaudit cobblerd_t self:capability sys_tty_config; + allow cobblerd_t self:process { getsched setsched signal }; allow cobblerd_t self:fifo_file rw_fifo_file_perms; +allow cobblerd_t self:netlink_route_socket create_netlink_socket_perms; allow cobblerd_t self:tcp_socket create_stream_socket_perms; +allow cobblerd_t self:udp_socket create_socket_perms; +allow cobblerd_t self:unix_dgram_socket create_socket_perms; list_dirs_pattern(cobblerd_t, cobbler_etc_t, cobbler_etc_t) read_files_pattern(cobblerd_t, cobbler_etc_t, cobbler_etc_t) +# Something that runs in the cobberd_t domain tries to relabelfrom cobbler_var_lib_t dir to httpd_sys_content_t. +dontaudit cobblerd_t cobbler_var_lib_t:dir relabel_dir_perms; + manage_dirs_pattern(cobblerd_t, cobbler_var_lib_t, cobbler_var_lib_t) manage_files_pattern(cobblerd_t, cobbler_var_lib_t, cobbler_var_lib_t) -files_var_lib_filetrans(cobblerd_t, cobbler_var_lib_t, { dir file }) +manage_lnk_files_pattern(cobblerd_t, cobbler_var_lib_t, cobbler_var_lib_t) +files_var_lib_filetrans(cobblerd_t, cobbler_var_lib_t, { dir file lnk_file }) + +# Something really needs to write to cobbler.log. Ideally this should not be happening. +allow cobblerd_t cobbler_var_log_t:file write; append_files_pattern(cobblerd_t, cobbler_var_log_t, cobbler_var_log_t) create_files_pattern(cobblerd_t, cobbler_var_log_t, cobbler_var_log_t) @@ -52,57 +92,131 @@ read_files_pattern(cobblerd_t, cobbler_var_log_t, cobbler_var_log_t) setattr_files_pattern(cobblerd_t, cobbler_var_log_t, cobbler_var_log_t) logging_log_filetrans(cobblerd_t, cobbler_var_log_t, file) +manage_dirs_pattern(cobblerd_t, cobbler_tmp_t, cobbler_tmp_t) +manage_files_pattern(cobblerd_t, cobbler_tmp_t, cobbler_tmp_t) +files_tmp_filetrans(cobblerd_t, cobbler_tmp_t, { dir file }) + kernel_read_system_state(cobblerd_t) +kernel_dontaudit_search_network_state(cobblerd_t) + +auth_read_passwd(cobblerd_t) corecmd_exec_bin(cobblerd_t) corecmd_exec_shell(cobblerd_t) corenet_all_recvfrom_netlabel(cobblerd_t) -corenet_all_recvfrom_unlabeled(cobblerd_t) corenet_sendrecv_cobbler_server_packets(cobblerd_t) corenet_tcp_bind_cobbler_port(cobblerd_t) corenet_tcp_bind_generic_node(cobblerd_t) corenet_tcp_sendrecv_generic_if(cobblerd_t) corenet_tcp_sendrecv_generic_node(cobblerd_t) corenet_tcp_sendrecv_generic_port(cobblerd_t) +corenet_tcp_sendrecv_cobbler_port(cobblerd_t) +# sync and rsync to ftp and http are permitted by default, for any other media use cobbler_can_network_connect. +corenet_tcp_connect_ftp_port(cobblerd_t) +corenet_tcp_connect_all_ephemeral_ports(cobblerd_t) +corenet_tcp_sendrecv_ftp_port(cobblerd_t) +corenet_sendrecv_ftp_client_packets(cobblerd_t) +corenet_tcp_connect_http_port(cobblerd_t) +corenet_tcp_sendrecv_http_port(cobblerd_t) +corenet_sendrecv_http_client_packets(cobblerd_t) dev_read_urand(cobblerd_t) +domain_dontaudit_exec_all_entry_files(cobblerd_t) +domain_dontaudit_read_all_domains_state(cobblerd_t) + +files_read_etc_files(cobblerd_t) +# mtab +files_read_etc_runtime_files(cobblerd_t) files_read_usr_files(cobblerd_t) files_list_boot(cobblerd_t) +files_read_boot_files(cobblerd_t) files_list_tmp(cobblerd_t) -# read /etc/nsswitch.conf -files_read_etc_files(cobblerd_t) -miscfiles_read_localization(cobblerd_t) +# read from mounted images (install media) +fs_read_iso9660_files(cobblerd_t) + +auth_read_passwd(cobblerd_t) + +init_dontaudit_read_all_script_files(cobblerd_t) + +term_use_console(cobblerd_t) + +logging_send_syslog_msg(cobblerd_t) + miscfiles_read_public_files(cobblerd_t) +selinux_get_enforce_mode(cobblerd_t) + sysnet_read_config(cobblerd_t) sysnet_rw_dhcp_config(cobblerd_t) sysnet_write_config(cobblerd_t) +userdom_dontaudit_use_user_terminals(cobblerd_t) +userdom_dontaudit_search_user_home_dirs(cobblerd_t) +userdom_dontaudit_search_admin_dir(cobblerd_t) + tunable_policy(`cobbler_anon_write',` miscfiles_manage_public_files(cobblerd_t) ') +tunable_policy(`cobbler_can_network_connect',` + corenet_tcp_connect_all_ports(cobblerd_t) + corenet_tcp_sendrecv_all_ports(cobblerd_t) + corenet_sendrecv_all_client_packets(cobblerd_t) +') + +tunable_policy(`cobbler_use_cifs',` + fs_manage_cifs_dirs(cobblerd_t) + fs_manage_cifs_files(cobblerd_t) + fs_manage_cifs_symlinks(cobblerd_t) +') + +tunable_policy(`cobbler_use_nfs',` + fs_manage_nfs_dirs(cobblerd_t) + fs_manage_nfs_files(cobblerd_t) + fs_manage_nfs_symlinks(cobblerd_t) +') + +optional_policy(` + # Cobbler traverses /var/www to get to /var/www/cobbler/* + apache_search_sys_content(cobblerd_t) +') + optional_policy(` bind_read_config(cobblerd_t) bind_write_config(cobblerd_t) bind_domtrans_ndc(cobblerd_t) bind_domtrans(cobblerd_t) bind_initrc_domtrans(cobblerd_t) + bind_systemctl(cobblerd_t) bind_manage_zone(cobblerd_t) ') optional_policy(` + certmaster_exec(cobblerd_t) +') + +optional_policy(` dhcpd_domtrans(cobblerd_t) dhcpd_initrc_domtrans(cobblerd_t) + dhcpd_systemctl(cobblerd_t) ') optional_policy(` dnsmasq_domtrans(cobblerd_t) dnsmasq_initrc_domtrans(cobblerd_t) dnsmasq_write_config(cobblerd_t) + dnsmasq_systemctl(cobblerd_t) +') + +optional_policy(` + gnome_dontaudit_search_config(cobblerd_t) +') + +optional_policy(` + puppet_domtrans_puppetca(cobblerd_t) ') optional_policy(` @@ -110,12 +224,21 @@ optional_policy(` ') optional_policy(` - rsync_read_config(cobblerd_t) - rsync_write_config(cobblerd_t) + rsync_exec(cobblerd_t) + rsync_manage_config(cobblerd_t) + # cobbler creates /etc/rsync.conf if its not there. + rsync_filetrans_config(cobblerd_t, file) ') optional_policy(` - tftp_manage_rw_content(cobblerd_t) + # Cobbler puts objects in both /var/lib/tftpdir as well as /var/lib/tftpdir/images. + # tftp_manage_rw_content(cobblerd_t) can be used instead if: + # 1. cobbler package installs /var/lib/tftpdir/images. + # 2. no FILES in /var/lib/TFTPDIR are hard linked. + # Cobbler also creates other directories in /var/lib/tftpdir (etc, s390x, ppc, pxelinux.cfg) + # are any of those hard linked? + tftp_filetrans_tftpdir(cobblerd_t, cobbler_var_lib_t, { dir file }) + tftp_manage_config(cobblerd_t) ') ######################################## @@ -124,5 +247,6 @@ optional_policy(` # apache_content_template(cobbler) +list_dirs_pattern(cobblerd_t, httpd_cobbler_content_t, httpd_cobbler_content_t) manage_dirs_pattern(cobblerd_t, httpd_cobbler_content_rw_t, httpd_cobbler_content_rw_t) manage_files_pattern(cobblerd_t, httpd_cobbler_content_rw_t, httpd_cobbler_content_rw_t) diff --git a/collectd.fc b/collectd.fc new file mode 100644 index 0000000..2e1007b --- /dev/null +++ b/collectd.fc @@ -0,0 +1,13 @@ + +/etc/rc\.d/init\.d/collectd -- gen_context(system_u:object_r:collectd_initrc_exec_t,s0) + +/usr/lib/systemd/system/collectd.* -- gen_context(system_u:object_r:collectd_unit_file_t,s0) + +/usr/sbin/collectd -- gen_context(system_u:object_r:collectd_exec_t,s0) + +/var/lib/collectd(/.*)? gen_context(system_u:object_r:collectd_var_lib_t,s0) + +/var/run/collectd\.pid gen_context(system_u:object_r:collectd_var_run_t,s0) + +/usr/share/collectd/collection3/bin/.*\.cgi -- gen_context(system_u:object_r:httpd_collectd_script_exec_t,s0) + diff --git a/collectd.if b/collectd.if new file mode 100644 index 0000000..40415f8 --- /dev/null +++ b/collectd.if @@ -0,0 +1,186 @@ + +## policy for collectd + +######################################## +## +## Transition to collectd. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`collectd_domtrans',` + gen_require(` + type collectd_t, collectd_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, collectd_exec_t, collectd_t) +') + + +######################################## +## +## Execute collectd server in the collectd domain. +## +## +## +## Domain allowed access. +## +## +# +interface(`collectd_initrc_domtrans',` + gen_require(` + type collectd_initrc_exec_t; + ') + + init_labeled_script_domtrans($1, collectd_initrc_exec_t) +') + + +######################################## +## +## Search collectd lib directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`collectd_search_lib',` + gen_require(` + type collectd_var_lib_t; + ') + + allow $1 collectd_var_lib_t:dir search_dir_perms; + files_search_var_lib($1) +') + +######################################## +## +## Read collectd lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`collectd_read_lib_files',` + gen_require(` + type collectd_var_lib_t; + ') + + files_search_var_lib($1) + read_files_pattern($1, collectd_var_lib_t, collectd_var_lib_t) +') + +######################################## +## +## Manage collectd lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`collectd_manage_lib_files',` + gen_require(` + type collectd_var_lib_t; + ') + + files_search_var_lib($1) + manage_files_pattern($1, collectd_var_lib_t, collectd_var_lib_t) +') + +######################################## +## +## Manage collectd lib directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`collectd_manage_lib_dirs',` + gen_require(` + type collectd_var_lib_t; + ') + + files_search_var_lib($1) + manage_dirs_pattern($1, collectd_var_lib_t, collectd_var_lib_t) +') + +######################################## +## +## Execute collectd server in the collectd domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`collectd_systemctl',` + gen_require(` + type collectd_t; + type collectd_unit_file_t; + ') + + systemd_exec_systemctl($1) + allow $1 collectd_unit_file_t:file read_file_perms; + allow $1 collectd_unit_file_t:service manage_service_perms; + + ps_process_pattern($1, collectd_t) +') + +######################################## +## +## All of the rules required to administrate +## an collectd environment +## +## +## +## Domain allowed access. +## +## +## +## +## Role allowed access. +## +## +## +# +interface(`collectd_admin',` + gen_require(` + type collectd_t; + type collectd_initrc_exec_t; + type collectd_var_lib_t; + type collectd_unit_file_t; + ') + + allow $1 collectd_t:process signal_perms; + ps_process_pattern($1, collectd_t) + + tunable_policy(`deny_ptrace',`',` + allow $1 collectd_t:process ptrace; + ') + + collectd_initrc_domtrans($1) + domain_system_change_exemption($1) + role_transition $2 collectd_initrc_exec_t system_r; + allow $2 system_r; + + files_search_var_lib($1) + admin_pattern($1, collectd_var_lib_t) + + collectd_systemctl($1) + admin_pattern($1, collectd_unit_file_t) + allow $1 collectd_unit_file_t:service all_service_perms; +') + diff --git a/collectd.te b/collectd.te new file mode 100644 index 0000000..cb6dbe6 --- /dev/null +++ b/collectd.te @@ -0,0 +1,89 @@ +policy_module(collectd, 1.0.0) + +######################################## +# +# Declarations +# + +## +##

+## Allow collectd to connect to the +## network using TCP. +##

+## +gen_tunable(collectd_can_network_connect, false) + +type collectd_t; +type collectd_exec_t; +init_daemon_domain(collectd_t, collectd_exec_t) + +type collectd_initrc_exec_t; +init_script_file(collectd_initrc_exec_t) + +type collectd_var_lib_t; +files_type(collectd_var_lib_t) + +type collectd_var_run_t; +files_pid_file(collectd_var_run_t) + +type collectd_unit_file_t; +systemd_unit_file(collectd_unit_file_t) + +######################################## +# +# collectd local policy +# + +allow collectd_t self:capability { ipc_lock sys_nice }; +allow collectd_t self:process { getsched setsched signal fork }; + +allow collectd_t self:fifo_file rw_fifo_file_perms; +allow collectd_t self:packet_socket create_socket_perms; +allow collectd_t self:unix_stream_socket create_stream_socket_perms; + +manage_dirs_pattern(collectd_t, collectd_var_lib_t, collectd_var_lib_t) +manage_files_pattern(collectd_t, collectd_var_lib_t, collectd_var_lib_t) +files_var_lib_filetrans(collectd_t, collectd_var_lib_t, { dir file }) + +manage_dirs_pattern(collectd_t, collectd_var_run_t, collectd_var_run_t) +manage_files_pattern(collectd_t, collectd_var_run_t, collectd_var_run_t) +files_pid_filetrans(collectd_t, collectd_var_run_t, { dir file }) + +domain_use_interactive_fds(collectd_t) + +kernel_read_network_state(collectd_t) +kernel_read_net_sysctls(collectd_t) +kernel_read_system_state(collectd_t) + +dev_read_sysfs(collectd_t) +dev_read_urand(collectd_t) +dev_read_rand(collectd_t) + +files_getattr_all_dirs(collectd_t) +files_read_etc_files(collectd_t) +files_read_usr_files(collectd_t) + +fs_getattr_all_fs(collectd_t) + +logging_send_syslog_msg(collectd_t) + +sysnet_dns_name_resolve(collectd_t) + +tunable_policy(`collectd_can_network_connect',` + corenet_tcp_connect_all_ports(collectd_t) + corenet_tcp_sendrecv_all_ports(collectd_t) + corenet_sendrecv_all_client_packets(collectd_t) +') + +optional_policy(` + apache_content_template(collectd) + + files_search_var_lib(httpd_collectd_script_t) + read_files_pattern(httpd_collectd_script_t, collectd_var_lib_t, collectd_var_lib_t) + list_dirs_pattern(httpd_collectd_script_t, collectd_var_lib_t, collectd_var_lib_t) + miscfiles_setattr_fonts_cache_dirs(httpd_collectd_script_t) +') + +optional_policy(` + virt_read_config(collectd_t) +') diff --git a/colord.fc b/colord.fc index 78b2fea..ef975ac 100644 --- a/colord.fc +++ b/colord.fc @@ -1,4 +1,7 @@ /usr/libexec/colord -- gen_context(system_u:object_r:colord_exec_t,s0) +/usr/libexec/colord-sane -- gen_context(system_u:object_r:colord_exec_t,s0) + +/usr/lib/systemd/system/colord.* -- gen_context(system_u:object_r:colord_unit_file_t,s0) /var/lib/color(/.*)? gen_context(system_u:object_r:colord_var_lib_t,s0) /var/lib/colord(/.*)? gen_context(system_u:object_r:colord_var_lib_t,s0) diff --git a/colord.if b/colord.if index 733e4e6..fa2c3cb 100644 --- a/colord.if +++ b/colord.if @@ -57,3 +57,26 @@ interface(`colord_read_lib_files',` files_search_var_lib($1) read_files_pattern($1, colord_var_lib_t, colord_var_lib_t) ') + +######################################## +## +## Execute colord server in the colord domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`colord_systemctl',` + gen_require(` + type colord_t; + type colord_unit_file_t; + ') + + systemd_exec_systemctl($1) + allow $1 colord_unit_file_t:file read_file_perms; + allow $1 colord_unit_file_t:service manage_service_perms; + + ps_process_pattern($1, colord_t) +') diff --git a/colord.te b/colord.te index 74505cc..fc79c02 100644 --- a/colord.te +++ b/colord.te @@ -8,6 +8,7 @@ policy_module(colord, 1.0.0) type colord_t; type colord_exec_t; dbus_system_domain(colord_t, colord_exec_t) +init_daemon_domain(colord_t, colord_exec_t) type colord_tmp_t; files_tmp_file(colord_tmp_t) @@ -18,14 +19,20 @@ files_tmpfs_file(colord_tmpfs_t) type colord_var_lib_t; files_type(colord_var_lib_t) +type colord_unit_file_t; +systemd_unit_file(colord_unit_file_t) + ######################################## # # colord local policy # allow colord_t self:capability { dac_read_search dac_override }; +dontaudit colord_t self:capability sys_admin; allow colord_t self:process signal; allow colord_t self:fifo_file rw_fifo_file_perms; allow colord_t self:netlink_kobject_uevent_socket create_socket_perms; +allow colord_t self:tcp_socket create_stream_socket_perms; +allow colord_t self:shm create_shm_perms; allow colord_t self:udp_socket create_socket_perms; allow colord_t self:unix_dgram_socket create_socket_perms; @@ -41,15 +48,22 @@ manage_dirs_pattern(colord_t, colord_var_lib_t, colord_var_lib_t) manage_files_pattern(colord_t, colord_var_lib_t, colord_var_lib_t) files_var_lib_filetrans(colord_t, colord_var_lib_t, { file dir }) -kernel_getattr_proc_files(colord_t) +kernel_read_network_state(colord_t) +kernel_read_system_state(colord_t) kernel_read_device_sysctls(colord_t) +kernel_request_load_module(colord_t) + +# reads *.ini files +corecmd_exec_bin(colord_t) +corecmd_exec_shell(colord_t) -corenet_all_recvfrom_unlabeled(colord_t) corenet_all_recvfrom_netlabel(colord_t) corenet_udp_bind_generic_node(colord_t) corenet_udp_bind_ipp_port(colord_t) corenet_tcp_connect_ipp_port(colord_t) +dev_read_raw_memory(colord_t) +dev_write_raw_memory(colord_t) dev_read_video_dev(colord_t) dev_write_video_dev(colord_t) dev_rw_printer(colord_t) @@ -62,22 +76,35 @@ dev_rw_generic_usb_dev(colord_t) domain_use_interactive_fds(colord_t) files_list_mnt(colord_t) -files_read_etc_files(colord_t) files_read_usr_files(colord_t) +fs_search_all(colord_t) +fs_getattr_noxattr_fs(colord_t) +fs_dontaudit_getattr_all_fs(colord_t) +fs_list_noxattr_fs(colord_t) fs_read_noxattr_fs_files(colord_t) +storage_getattr_fixed_disk_dev(colord_t) +storage_getattr_removable_dev(colord_t) +storage_read_scsi_generic(colord_t) +storage_write_scsi_generic(colord_t) + +auth_use_nsswitch(colord_t) + logging_send_syslog_msg(colord_t) -miscfiles_read_localization(colord_t) +fs_getattr_tmpfs(colord_t) +userdom_rw_user_tmpfs_files(colord_t) -sysnet_dns_name_resolve(colord_t) +userdom_home_reader(colord_t) tunable_policy(`use_nfs_home_dirs',` + fs_getattr_nfs(colord_t) fs_read_nfs_files(colord_t) ') tunable_policy(`use_samba_home_dirs',` + fs_getattr_cifs(colord_t) fs_read_cifs_files(colord_t) ') @@ -89,6 +116,12 @@ optional_policy(` ') optional_policy(` + gnome_read_home_icc_data_content(colord_t) + # Fixes lots of breakage in F16 on upgrade + gnome_read_generic_data_home_files(colord_t) +') + +optional_policy(` policykit_dbus_chat(colord_t) policykit_domtrans_auth(colord_t) policykit_read_lib(colord_t) @@ -96,5 +129,19 @@ optional_policy(` ') optional_policy(` + sysnet_exec_ifconfig(colord_t) +') + +optional_policy(` udev_read_db(colord_t) ') + +optional_policy(` + xserver_dbus_chat_xdm(colord_t) + # /var/lib/gdm/.local/share/icc/edid-0a027915105823af34f99b1704e80336.icc + xserver_read_inherited_xdm_lib_files(colord_t) +') + +optional_policy(` + zoneminder_rw_tmpfs_files(colord_t) +') diff --git a/comsat.te b/comsat.te index 3d121fd..b64c98c 100644 --- a/comsat.te +++ b/comsat.te @@ -39,7 +39,6 @@ kernel_read_kernel_sysctls(comsat_t) kernel_read_network_state(comsat_t) kernel_read_system_state(comsat_t) -corenet_all_recvfrom_unlabeled(comsat_t) corenet_all_recvfrom_netlabel(comsat_t) corenet_tcp_sendrecv_generic_if(comsat_t) corenet_udp_sendrecv_generic_if(comsat_t) @@ -51,7 +50,6 @@ dev_read_urand(comsat_t) fs_getattr_xattr_fs(comsat_t) -files_read_etc_files(comsat_t) files_list_usr(comsat_t) files_search_spool(comsat_t) files_search_home(comsat_t) @@ -63,8 +61,6 @@ init_dontaudit_write_utmp(comsat_t) logging_send_syslog_msg(comsat_t) -miscfiles_read_localization(comsat_t) - userdom_dontaudit_getattr_user_ttys(comsat_t) mta_getattr_spool(comsat_t) diff --git a/condor.fc b/condor.fc new file mode 100644 index 0000000..b3a5b51 --- /dev/null +++ b/condor.fc @@ -0,0 +1,21 @@ +/usr/lib/systemd/system/condor.* -- gen_context(system_u:object_r:condor_unit_file_t,s0) + +/usr/sbin/condor_master -- gen_context(system_u:object_r:condor_master_exec_t,s0) +/usr/sbin/condor_collector -- gen_context(system_u:object_r:condor_collector_exec_t,s0) +/usr/sbin/condor_negotiator -- gen_context(system_u:object_r:condor_negotiator_exec_t,s0) +/usr/sbin/condor_schedd -- gen_context(system_u:object_r:condor_schedd_exec_t,s0) +/usr/sbin/condor_startd -- gen_context(system_u:object_r:condor_startd_exec_t,s0) +/usr/sbin/condor_starter -- gen_context(system_u:object_r:condor_startd_exec_t,s0) +/usr/sbin/condor_procd -- gen_context(system_u:object_r:condor_procd_exec_t,s0) + +/var/lib/condor(/.*)? gen_context(system_u:object_r:condor_var_lib_t,s0) + +/var/lib/condor/execute(/.*)? gen_context(system_u:object_r:condor_var_lib_t,s0) + +/var/lib/condor/spool(/.*)? gen_context(system_u:object_r:condor_var_lib_t,s0) + +/var/lock/condor(/.*)? gen_context(system_u:object_r:condor_var_lock_t,s0) + +/var/log/condor(/.*)? gen_context(system_u:object_r:condor_log_t,s0) + +/var/run/condor(/.*)? gen_context(system_u:object_r:condor_var_run_t,s0) diff --git a/condor.if b/condor.if new file mode 100644 index 0000000..1fc1576 --- /dev/null +++ b/condor.if @@ -0,0 +1,391 @@ + +## policy for condor + +##################################### +## +## Creates types and rules for a basic +## condor init daemon domain. +## +## +## +## Prefix for the domain. +## +## +# +template(`condor_domain_template',` + gen_require(` + type condor_master_t; + attribute condor_domain; + ') + + ############################# + # + # Declarations + # + + type condor_$1_t, condor_domain; + type condor_$1_exec_t; + init_daemon_domain(condor_$1_t, condor_$1_exec_t) + role system_r types condor_$1_t; + + domtrans_pattern(condor_master_t, condor_$1_exec_t, condor_$1_t) + allow condor_master_t condor_$1_exec_t:file ioctl; + + auth_use_nsswitch(condor_$1_t) + + logging_send_syslog_msg(condor_$1_t) +') + +######################################## +## +## Transition to condor. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`condor_domtrans',` + gen_require(` + type condor_t, condor_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, condor_exec_t, condor_t) +') + +####################################### +## +## Allows to start userland processes +## by transitioning to the specified domain, +## with a range transition. +## +## +## +## The process type entered by condor_startd. +## +## +## +## +## The executable type for the entrypoint. +## +## +## +## +## Range for the domain. +## +## +# +interface(`condor_startd_ranged_domtrans_to',` + gen_require(` + type sshd_t; + ') + condor_startd_domtrans_to($1, $2) + + + ifdef(`enable_mcs',` + range_transition condor_startd_t $2:process $3; + ') + +') + +####################################### +## +## Allows to start userlandprocesses +## by transitioning to the specified domain. +## +## +## +## The process type entered by condor_startd. +## +## +## +## +## The executable type for the entrypoint. +## +## +# +interface(`condor_startd_domtrans_to',` + gen_require(` + type condor_startd_t; + ') + + domtrans_pattern(condor_startd_t, $2, $1) +') + +######################################## +## +## Read condor's log files. +## +## +## +## Domain allowed access. +## +## +## +# +interface(`condor_read_log',` + gen_require(` + type condor_log_t; + ') + + logging_search_logs($1) + read_files_pattern($1, condor_log_t, condor_log_t) +') + +######################################## +## +## Append to condor log files. +## +## +## +## Domain allowed access. +## +## +# +interface(`condor_append_log',` + gen_require(` + type condor_log_t; + ') + + logging_search_logs($1) + append_files_pattern($1, condor_log_t, condor_log_t) +') + +######################################## +## +## Manage condor log files +## +## +## +## Domain allowed access. +## +## +# +interface(`condor_manage_log',` + gen_require(` + type condor_log_t; + ') + + logging_search_logs($1) + manage_dirs_pattern($1, condor_log_t, condor_log_t) + manage_files_pattern($1, condor_log_t, condor_log_t) + manage_lnk_files_pattern($1, condor_log_t, condor_log_t) +') + +######################################## +## +## Search condor lib directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`condor_search_lib',` + gen_require(` + type condor_var_lib_t; + ') + + allow $1 condor_var_lib_t:dir search_dir_perms; + files_search_var_lib($1) +') + +######################################## +## +## Read condor lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`condor_read_lib_files',` + gen_require(` + type condor_var_lib_t; + ') + + files_search_var_lib($1) + read_files_pattern($1, condor_var_lib_t, condor_var_lib_t) +') + +###################################### +## +## Read and write condor lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`condor_rw_lib_files',` + gen_require(` + type condor_var_lib_t; + ') + + files_search_var_lib($1) + rw_files_pattern($1, condor_var_lib_t, condor_var_lib_t) +') + +######################################## +## +## Manage condor lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`condor_manage_lib_files',` + gen_require(` + type condor_var_lib_t; + ') + + files_search_var_lib($1) + manage_files_pattern($1, condor_var_lib_t, condor_var_lib_t) +') + +######################################## +## +## Manage condor lib directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`condor_manage_lib_dirs',` + gen_require(` + type condor_var_lib_t; + ') + + files_search_var_lib($1) + manage_dirs_pattern($1, condor_var_lib_t, condor_var_lib_t) +') + +######################################## +## +## Read condor PID files. +## +## +## +## Domain allowed access. +## +## +# +interface(`condor_read_pid_files',` + gen_require(` + type condor_var_run_t; + ') + + files_search_pids($1) + allow $1 condor_var_run_t:file read_file_perms; +') + +######################################## +## +## Execute condor server in the condor domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`condor_systemctl',` + gen_require(` + type condor_t; + type condor_unit_file_t; + ') + + systemd_exec_systemctl($1) + systemd_read_fifo_file_passwd_run($1) + allow $1 condor_unit_file_t:file read_file_perms; + allow $1 condor_unit_file_t:service manage_service_perms; + + ps_process_pattern($1, condor_t) +') + + +####################################### +## +## Read and write condor_startd server TCP sockets. +## +## +## +## Domain allowed access. +## +## +# +interface(`condor_rw_tcp_sockets_startd',` + gen_require(` + type condor_startd_t; + ') + + allow $1 condor_startd_t:tcp_socket rw_socket_perms; +') + +###################################### +## +## Read and write condor_schedd server TCP sockets. +## +## +## +## Domain allowed access. +## +## +# +interface(`condor_rw_tcp_sockets_schedd',` + gen_require(` + type condor_schedd_t; + ') + + allow $1 condor_schedd_t:tcp_socket rw_socket_perms; +') + +######################################## +## +## All of the rules required to administrate +## an condor environment +## +## +## +## Domain allowed access. +## +## +# +interface(`condor_admin',` + gen_require(` + type condor_t; + type condor_log_t; + type condor_var_lib_t; + type condor_var_run_t; + type condor_unit_file_t; + ') + + allow $1 condor_t:process { ptrace signal_perms }; + ps_process_pattern($1, condor_t) + + logging_search_logs($1) + admin_pattern($1, condor_log_t) + + files_search_var_lib($1) + admin_pattern($1, condor_var_lib_t) + + files_search_pids($1) + admin_pattern($1, condor_var_run_t) + + condor_systemctl($1) + admin_pattern($1, condor_unit_file_t) + allow $1 condor_unit_file_t:service all_service_perms; + optional_policy(` + systemd_passwd_agent_exec($1) + systemd_read_fifo_file_passwd_run($1) + ') +') diff --git a/condor.te b/condor.te new file mode 100644 index 0000000..8c88a6b --- /dev/null +++ b/condor.te @@ -0,0 +1,226 @@ +policy_module(condor, 1.0.0) + +######################################## +# +# Declarations +# + +## +##

+## Allow codnor domain to connect to the network using TCP. +##

+## +gen_tunable(condor_domain_can_network_connect, false) + +attribute condor_domain; + +type condor_master_t, condor_domain; +type condor_master_exec_t; +init_daemon_domain(condor_master_t, condor_master_exec_t) + +condor_domain_template(collector) +condor_domain_template(negotiator) +condor_domain_template(schedd) +condor_domain_template(startd) +condor_domain_template(procd) + +type condor_schedd_tmp_t; +files_tmp_file(condor_schedd_tmp_t) + +type condor_startd_tmp_t; +files_tmp_file(condor_startd_tmp_t) + +type condor_startd_tmpfs_t; +files_tmpfs_file(condor_startd_tmpfs_t) + +type condor_log_t; +logging_log_file(condor_log_t) + +type condor_var_lib_t; +files_type(condor_var_lib_t) + +type condor_var_lock_t; +files_lock_file(condor_var_lock_t) + +type condor_var_run_t; +files_pid_file(condor_var_run_t) + +type condor_unit_file_t; +systemd_unit_file(condor_unit_file_t) + +######################################## +# +# condor domain local policy +# + +allow condor_domain self:process signal_perms; +allow condor_domain self:fifo_file rw_fifo_file_perms; + +allow condor_domain self:tcp_socket create_stream_socket_perms; +allow condor_domain self:udp_socket create_socket_perms; +allow condor_domain self:unix_stream_socket create_stream_socket_perms; + +allow condor_domain condor_master_t:process signull; +allow condor_domain condor_master_t:tcp_socket getattr; + +manage_dirs_pattern(condor_domain, condor_log_t, condor_log_t) +manage_files_pattern(condor_domain, condor_log_t, condor_log_t) +logging_log_filetrans(condor_domain, condor_log_t, { dir file }) + +manage_dirs_pattern(condor_domain, condor_var_lib_t, condor_var_lib_t) +manage_files_pattern(condor_domain, condor_var_lib_t, condor_var_lib_t) +files_var_lib_filetrans(condor_domain, condor_var_lib_t, { dir file }) + +manage_dirs_pattern(condor_domain, condor_var_lock_t, condor_var_lock_t) +manage_files_pattern(condor_domain, condor_var_lock_t, condor_var_lock_t) +files_lock_filetrans(condor_domain, condor_var_lock_t, { dir file }) + +manage_dirs_pattern(condor_domain, condor_var_run_t, condor_var_run_t) +manage_files_pattern(condor_domain, condor_var_run_t, condor_var_run_t) +manage_fifo_files_pattern(condor_domain, condor_var_run_t, condor_var_run_t) +files_pid_filetrans(condor_domain, condor_var_run_t, { dir file fifo_file }) + +kernel_read_system_state(condor_domain) +kernel_read_network_state(condor_domain) +kernel_read_kernel_sysctls(condor_domain) + +corecmd_exec_bin(condor_domain) +corecmd_exec_shell(condor_domain) + +corenet_tcp_connect_condor_port(condor_domain) +corenet_tcp_connect_all_ephemeral_ports(condor_domain) + +domain_use_interactive_fds(condor_domain) + +dev_read_rand(condor_domain) +dev_read_urand(condor_domain) +dev_read_sysfs(condor_domain) + +files_read_etc_files(condor_domain) + +tunable_policy(`condor_domain_can_network_connect',` + corenet_tcp_connect_all_ports(condor_domain) +') + +optional_policy(` + rhcs_stream_connect_cluster(condor_domain) +') + +optional_policy(` + sysnet_dns_name_resolve(condor_domain) +') + +##################################### +# +# condor master local policy +# + +allow condor_master_t self:capability { setuid setgid dac_override sys_ptrace }; + +allow condor_master_t condor_domain:process signal; + +corenet_tcp_bind_condor_port(condor_master_t) +corenet_udp_bind_condor_port(condor_master_t) +corenet_tcp_connect_amqp_port(condor_master_t) + +domain_read_all_domains_state(condor_master_t) + +###################################### +# +# condor collector local policy +# + +allow condor_collector_t self:capability { setuid setgid }; + +allow condor_collector_t condor_master_t:tcp_socket rw_stream_socket_perms; +allow condor_collector_t condor_master_t:udp_socket rw_socket_perms; + +kernel_read_network_state(condor_collector_t) + +##################################### +# +# condor negotiator local policy +# +allow condor_negotiator_t self:capability { setuid setgid }; +allow condor_negotiator_t condor_master_t:tcp_socket rw_stream_socket_perms; +allow condor_negotiator_t condor_master_t:udp_socket getattr; + +corenet_tcp_connect_all_ephemeral_ports(condor_negotiator_t) + +###################################### +# +# condor procd local policy +# + +allow condor_procd_t self:capability { fowner chown dac_override sys_ptrace }; + +domain_read_all_domains_state(condor_procd_t) + +####################################### +# +# condor schedd local policy +# + +domtrans_pattern(condor_schedd_t, condor_procd_exec_t, condor_procd_t) +domtrans_pattern(condor_schedd_t, condor_startd_exec_t, condor_startd_t) + +# dac_override because of /var/log/condor +allow condor_schedd_t self:capability { setuid chown setgid dac_override }; +allow condor_schedd_t condor_master_t:tcp_socket rw_stream_socket_perms; +allow condor_schedd_t condor_master_t:udp_socket getattr; + +allow condor_schedd_t condor_var_lock_t:dir manage_file_perms; + +manage_dirs_pattern(condor_schedd_t, condor_schedd_tmp_t, condor_schedd_tmp_t) +manage_files_pattern(condor_schedd_t, condor_schedd_tmp_t, condor_schedd_tmp_t) +files_tmp_filetrans(condor_schedd_t, condor_schedd_tmp_t, { file dir }) +allow condor_schedd_t condor_schedd_tmp_t:file { relabelfrom relabelto }; + +corenet_tcp_connect_all_ephemeral_ports(condor_schedd_t) + +##################################### +# +# condor startd local policy +# + +# also needed by java +allow condor_startd_t self:capability { setuid net_admin setgid dac_override }; +allow condor_startd_t self:process execmem; + +manage_dirs_pattern(condor_startd_t, condor_startd_tmp_t, condor_startd_tmp_t) +manage_files_pattern(condor_startd_t, condor_startd_tmp_t, condor_startd_tmp_t) +files_tmp_filetrans(condor_startd_t, condor_startd_tmp_t, { file dir }) +allow condor_startd_t condor_startd_tmp_t:file { relabelfrom relabelto }; + +manage_dirs_pattern(condor_startd_t, condor_startd_tmpfs_t, condor_startd_tmpfs_t) +manage_files_pattern(condor_startd_t, condor_startd_tmpfs_t, condor_startd_tmpfs_t) +fs_tmpfs_filetrans(condor_startd_t, condor_startd_tmpfs_t, { dir file }) + +can_exec(condor_startd_t, condor_startd_exec_t) + +domain_read_all_domains_state(condor_startd_t) + +mcs_process_set_categories(condor_startd_t) + +init_domtrans_script(condor_startd_t) +init_initrc_domain(condor_startd_t) + +libs_exec_lib_files(condor_startd_t) + +files_read_usr_files(condor_startd_t) + +optional_policy(` + ssh_basic_client_template(condor_startd, condor_startd_t, system_r) + ssh_domtrans(condor_startd_t) + + manage_files_pattern(condor_startd_ssh_t, condor_var_lib_t, condor_var_lib_t) + manage_dirs_pattern(condor_startd_ssh_t, condor_var_lib_t, condor_var_lib_t) + + optional_policy(` + kerberos_use(condor_startd_ssh_t) + ') +') + +optional_policy(` + unconfined_domain(condor_startd_t) +') diff --git a/consolekit.fc b/consolekit.fc index 32233ab..7058d21 100644 --- a/consolekit.fc +++ b/consolekit.fc @@ -1,3 +1,5 @@ +/usr/lib/systemd/system/console-kit.* -- gen_context(system_u:object_r:consolekit_unit_file_t,s0) + /usr/sbin/console-kit-daemon -- gen_context(system_u:object_r:consolekit_exec_t,s0) /var/log/ConsoleKit(/.*)? gen_context(system_u:object_r:consolekit_log_t,s0) diff --git a/consolekit.if b/consolekit.if index fd15dfe..aac1e5d 100644 --- a/consolekit.if +++ b/consolekit.if @@ -20,6 +20,27 @@ interface(`consolekit_domtrans',` ######################################## ## +## dontaudit Send and receive messages from +## consolekit over dbus. +## +## +## +## Domain to not audit. +## +## +# +interface(`consolekit_dontaudit_dbus_chat',` + gen_require(` + type consolekit_t; + class dbus send_msg; + ') + + dontaudit $1 consolekit_t:dbus send_msg; + dontaudit consolekit_t $1:dbus send_msg; +') + +######################################## +## ## Send and receive messages from ## consolekit over dbus. ## @@ -41,6 +62,24 @@ interface(`consolekit_dbus_chat',` ######################################## ## +## Dontaudit attempts to read consolekit log files. +## +## +## +## Domain to not audit. +## +## +# +interface(`consolekit_dontaudit_read_log',` + gen_require(` + type consolekit_log_t; + ') + + dontaudit $1 consolekit_log_t:file read_file_perms; +') + +######################################## +## ## Read consolekit log files. ## ## @@ -96,3 +135,64 @@ interface(`consolekit_read_pid_files',` allow $1 consolekit_var_run_t:dir list_dir_perms; read_files_pattern($1, consolekit_var_run_t, consolekit_var_run_t) ') + +######################################## +## +## List consolekit PID files. +## +## +## +## Domain allowed access. +## +## +# +interface(`consolekit_list_pid_files',` + gen_require(` + type consolekit_var_run_t; + ') + + files_search_pids($1) + list_dirs_pattern($1, consolekit_var_run_t, consolekit_var_run_t) +') + +######################################## +## +## Allow the domain to read consolekit state files in /proc. +## +## +## +## Domain allowed access. +## +## +# +interface(`consolekit_read_state',` + gen_require(` + type consolekit_t; + ') + + kernel_search_proc($1) + ps_process_pattern($1, consolekit_t) +') + +######################################## +## +## Execute consolekit server in the consolekit domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`consolekit_systemctl',` + gen_require(` + type consolekit_t; + type consolekit_unit_file_t; + ') + + systemd_exec_systemctl($1) + allow $1 consolekit_unit_file_t:file read_file_perms; + allow $1 consolekit_unit_file_t:service manage_service_perms; + + ps_process_pattern($1, consolekit_t) +') diff --git a/consolekit.te b/consolekit.te index 6f2896d..ca0b28a 100644 --- a/consolekit.te +++ b/consolekit.te @@ -15,12 +15,19 @@ logging_log_file(consolekit_log_t) type consolekit_var_run_t; files_pid_file(consolekit_var_run_t) +type consolekit_tmpfs_t; +files_tmpfs_file(consolekit_tmpfs_t) + +type consolekit_unit_file_t; +systemd_unit_file(consolekit_unit_file_t) + ######################################## # # consolekit local policy # allow consolekit_t self:capability { chown setuid setgid sys_tty_config dac_override sys_nice sys_ptrace }; + allow consolekit_t self:process { getsched signal }; allow consolekit_t self:fifo_file rw_fifo_file_perms; allow consolekit_t self:unix_stream_socket create_stream_socket_perms; @@ -43,9 +50,7 @@ dev_read_sysfs(consolekit_t) domain_read_all_domains_state(consolekit_t) domain_use_interactive_fds(consolekit_t) -domain_dontaudit_ptrace_all_domains(consolekit_t) -files_read_etc_files(consolekit_t) files_read_usr_files(consolekit_t) # needs to read /var/lib/dbus/machine-id files_read_var_lib_files(consolekit_t) @@ -67,17 +72,17 @@ init_rw_utmp(consolekit_t) logging_send_syslog_msg(consolekit_t) logging_send_audit_msgs(consolekit_t) -miscfiles_read_localization(consolekit_t) +systemd_exec_systemctl(consolekit_t) +userdom_read_all_users_state(consolekit_t) userdom_dontaudit_read_user_home_content_files(consolekit_t) +userdom_dontaudit_getattr_admin_home_files(consolekit_t) userdom_read_user_tmp_files(consolekit_t) -tunable_policy(`use_nfs_home_dirs',` - fs_read_nfs_files(consolekit_t) -') +userdom_home_reader(consolekit_t) -tunable_policy(`use_samba_home_dirs',` - fs_read_cifs_files(consolekit_t) +optional_policy(` + cron_read_system_job_lib_files(consolekit_t) ') optional_policy(` @@ -97,7 +102,7 @@ optional_policy(` ') optional_policy(` - hal_ptrace(consolekit_t) + networkmanager_append_log(consolekit_t) ') optional_policy(` @@ -108,9 +113,10 @@ optional_policy(` ') optional_policy(` - type consolekit_tmpfs_t; - files_tmpfs_file(consolekit_tmpfs_t) + shutdown_domtrans(consolekit_t) +') +optional_policy(` xserver_read_xdm_pid(consolekit_t) xserver_read_user_xauth(consolekit_t) xserver_non_drawing_client(consolekit_t) @@ -126,6 +132,5 @@ optional_policy(` ') optional_policy(` - #reading .Xauthity unconfined_stream_connect(consolekit_t) ') diff --git a/corosync.fc b/corosync.fc index 3a6d7eb..a12daf2 100644 --- a/corosync.fc +++ b/corosync.fc @@ -1,12 +1,17 @@ /etc/rc\.d/init\.d/corosync -- gen_context(system_u:object_r:corosync_initrc_exec_t,s0) +/usr/lib/systemd/system/corosync.* -- gen_context(system_u:object_r:corosync_unit_file_t,s0) + /usr/sbin/corosync -- gen_context(system_u:object_r:corosync_exec_t,s0) +/usr/sbin/corosync-notifyd -- gen_context(system_u:object_r:corosync_exec_t,s0) /usr/sbin/ccs_tool -- gen_context(system_u:object_r:corosync_exec_t,s0) +/usr/sbin/cman_tool -- gen_context(system_u:object_r:corosync_exec_t,s0) /var/lib/corosync(/.*)? gen_context(system_u:object_r:corosync_var_lib_t,s0) -/var/log/cluster/corosync\.log -- gen_context(system_u:object_r:corosync_var_log_t,s0) +/var/log/cluster/corosync\.log.* -- gen_context(system_u:object_r:corosync_var_log_t,s0) /var/run/cman_.* -s gen_context(system_u:object_r:corosync_var_run_t,s0) /var/run/corosync\.pid -- gen_context(system_u:object_r:corosync_var_run_t,s0) +/var/run/rsctmp(/.*)? gen_context(system_u:object_r:corosync_var_run_t,s0) diff --git a/corosync.if b/corosync.if index 5220c9d..885b25d 100644 --- a/corosync.if +++ b/corosync.if @@ -18,6 +18,25 @@ interface(`corosync_domtrans',` domtrans_pattern($1, corosync_exec_t, corosync_t) ') +###################################### +## +## Execute corosync in the caller domain. +## +## +## +## Domain allowed access. +## +## +# +interface(`corosync_exec',` + gen_require(` + type corosync_exec_t; + ') + + corecmd_search_bin($1) + can_exec($1, corosync_exec_t) +') + ####################################### ## ## Allow the specified domain to read corosync's log files. @@ -52,14 +71,58 @@ interface(`corosync_read_log',` interface(`corosync_stream_connect',` gen_require(` type corosync_t, corosync_var_run_t; + type corosync_var_lib_t; ') files_search_pids($1) + stream_connect_pattern($1, corosync_var_lib_t, corosync_var_lib_t, corosync_t) stream_connect_pattern($1, corosync_var_run_t, corosync_var_run_t, corosync_t) ') ###################################### ## +## Allow the specified domain to read/write corosync's tmpfs files. +## +## +## +## Domain allowed access. +## +## +# +interface(`corosync_rw_tmpfs',` + gen_require(` + type corosync_tmpfs_t; + ') + + rw_files_pattern($1, corosync_tmpfs_t, corosync_tmpfs_t) + +') + +######################################## +## +## Execute corosync server in the corosync domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`corosync_systemctl',` + gen_require(` + type corosync_t; + type corosync_unit_file_t; + ') + + systemd_exec_systemctl($1) + allow $1 corosync_unit_file_t:file read_file_perms; + allow $1 corosync_unit_file_t:service manage_service_perms; + + ps_process_pattern($1, corosync_t) +') + +###################################### +## ## All of the rules required to administrate ## an corosync environment ## @@ -80,11 +143,16 @@ interface(`corosyncd_admin',` type corosync_t, corosync_var_lib_t, corosync_var_log_t; type corosync_var_run_t, corosync_tmp_t, corosync_tmpfs_t; type corosync_initrc_exec_t; + type corosync_unit_file_t; ') - allow $1 corosync_t:process { ptrace signal_perms }; + allow $1 corosync_t:process signal_perms; ps_process_pattern($1, corosync_t) + tunable_policy(`deny_ptrace',`',` + allow $1 corosync_t:process ptrace; + ') + init_labeled_script_domtrans($1, corosync_initrc_exec_t) domain_system_change_exemption($1) role_transition $2 corosync_initrc_exec_t system_r; @@ -103,4 +171,8 @@ interface(`corosyncd_admin',` files_list_pids($1) admin_pattern($1, corosync_var_run_t) + + corosync_systemctl($1) + admin_pattern($1, corosync_unit_file_t) + allow $1 corosync_unit_file_t:service all_service_perms; ') diff --git a/corosync.te b/corosync.te index 04969e5..fb6fe25 100644 --- a/corosync.te +++ b/corosync.te @@ -8,6 +8,7 @@ policy_module(corosync, 1.0.0) type corosync_t; type corosync_exec_t; init_daemon_domain(corosync_t, corosync_exec_t) +domain_obj_id_change_exemption(corosync_t) type corosync_initrc_exec_t; init_script_file(corosync_initrc_exec_t) @@ -27,23 +28,32 @@ logging_log_file(corosync_var_log_t) type corosync_var_run_t; files_pid_file(corosync_var_run_t) +type corosync_unit_file_t; +systemd_unit_file(corosync_unit_file_t) + ######################################## # # corosync local policy # -allow corosync_t self:capability { sys_nice sys_resource ipc_lock }; -allow corosync_t self:process { setrlimit setsched signal }; +allow corosync_t self:capability { dac_override setuid setgid sys_nice sys_admin sys_resource ipc_lock }; +# for hearbeat +allow corosync_t self:capability { net_raw chown }; +allow corosync_t self:process { setpgid setrlimit setsched signal signull }; allow corosync_t self:fifo_file rw_fifo_file_perms; allow corosync_t self:sem create_sem_perms; +allow corosync_t self:shm create_shm_perms; allow corosync_t self:unix_stream_socket { create_stream_socket_perms connectto }; allow corosync_t self:unix_dgram_socket create_socket_perms; allow corosync_t self:udp_socket create_socket_perms; +can_exec(corosync_t, corosync_exec_t) + manage_dirs_pattern(corosync_t, corosync_tmp_t, corosync_tmp_t) manage_files_pattern(corosync_t, corosync_tmp_t, corosync_tmp_t) files_tmp_filetrans(corosync_t, corosync_tmp_t, { file dir }) +allow corosync_t corosync_tmp_t:file { relabelfrom relabelto }; manage_dirs_pattern(corosync_t, corosync_tmpfs_t, corosync_tmpfs_t) manage_files_pattern(corosync_t, corosync_tmpfs_t, corosync_tmpfs_t) @@ -52,7 +62,8 @@ fs_tmpfs_filetrans(corosync_t, corosync_tmpfs_t, { dir file }) manage_files_pattern(corosync_t, corosync_var_lib_t, corosync_var_lib_t) manage_dirs_pattern(corosync_t, corosync_var_lib_t, corosync_var_lib_t) manage_sock_files_pattern(corosync_t, corosync_var_lib_t, corosync_var_lib_t) -files_var_lib_filetrans(corosync_t, corosync_var_lib_t, { file dir sock_file }) +manage_fifo_files_pattern(corosync_t, corosync_var_lib_t,corosync_var_lib_t) +files_var_lib_filetrans(corosync_t,corosync_var_lib_t, { file dir fifo_file sock_file }) manage_files_pattern(corosync_t, corosync_var_log_t, corosync_var_log_t) manage_sock_files_pattern(corosync_t, corosync_var_log_t, corosync_var_log_t) @@ -60,11 +71,16 @@ logging_log_filetrans(corosync_t, corosync_var_log_t, { sock_file file }) manage_files_pattern(corosync_t, corosync_var_run_t, corosync_var_run_t) manage_sock_files_pattern(corosync_t, corosync_var_run_t, corosync_var_run_t) -files_pid_filetrans(corosync_t, corosync_var_run_t, { file sock_file }) +manage_dirs_pattern(corosync_t, corosync_var_run_t,corosync_var_run_t) +files_pid_filetrans(corosync_t, corosync_var_run_t, { file sock_file dir }) kernel_read_system_state(corosync_t) +kernel_read_network_state(corosync_t) +kernel_read_net_sysctls(corosync_t) +kernel_read_kernel_sysctls(corosync_t) corecmd_exec_bin(corosync_t) +corecmd_exec_shell(corosync_t) corenet_udp_bind_netsupport_port(corosync_t) @@ -73,31 +89,65 @@ dev_read_urand(corosync_t) domain_read_all_domains_state(corosync_t) files_manage_mounttab(corosync_t) +files_read_usr_files(corosync_t) auth_use_nsswitch(corosync_t) +init_domtrans_script(corosync_t) init_read_script_state(corosync_t) init_rw_script_tmp_files(corosync_t) logging_send_syslog_msg(corosync_t) -miscfiles_read_localization(corosync_t) - +userdom_read_user_tmp_files(corosync_t) +userdom_delete_user_tmpfs_files(corosync_t) userdom_rw_user_tmpfs_files(corosync_t) optional_policy(` + fs_manage_tmpfs_files(corosync_t) + init_manage_script_status_files(corosync_t) +') + +optional_policy(` ccs_read_config(corosync_t) ') optional_policy(` - # to communication with RHCS - rhcs_rw_dlm_controld_semaphores(corosync_t) + cmirrord_rw_shm(corosync_t) +') + +optional_policy(` + dbus_system_bus_client(corosync_t) +') - rhcs_rw_fenced_semaphores(corosync_t) +optional_policy(` + drbd_domtrans(corosync_t) +') + +optional_policy(` + lvm_rw_clvmd_tmpfs_files(corosync_t) + lvm_delete_clvmd_tmpfs_files(corosync_t) +') - rhcs_rw_gfs_controld_semaphores(corosync_t) +optional_policy(` + qpidd_rw_shm(corosync_t) ') optional_policy(` + rhcs_getattr_fenced(corosync_t) + # to communication with RHCS + rhcs_rw_cluster_shm(corosync_t) + rhcs_rw_cluster_semaphores(corosync_t) + rhcs_stream_connect_cluster(corosync_t) + rhcs_read_cluster_lib_files(corosync_t) + rhcs_manage_cluster_lib_files(corosync_t) + rhcs_relabel_cluster_lib_files(corosync_t) +') + +optional_policy(` + # should be removed in F19 + # workaround because we switch hearbeat from corosync to rgmanager + rgmanager_manage_files(corosync_t) + rgmanager_manage_tmpfs_files(corosync_t) ') diff --git a/couchdb.fc b/couchdb.fc new file mode 100644 index 0000000..196461b --- /dev/null +++ b/couchdb.fc @@ -0,0 +1,11 @@ +/etc/couchdb(/.*)? gen_context(system_u:object_r:couchdb_etc_t,s0) + +/usr/bin/couchdb -- gen_context(system_u:object_r:couchdb_exec_t,s0) + +/usr/lib/systemd/system/couchdb.* -- gen_context(system_u:object_r:couchdb_unit_file_t,s0) + +/var/lib/couchdb(/.*)? gen_context(system_u:object_r:couchdb_var_lib_t,s0) + +/var/log/couchdb(/.*)? gen_context(system_u:object_r:couchdb_log_t,s0) + +/var/run/couchdb(/.*)? gen_context(system_u:object_r:couchdb_var_run_t,s0) diff --git a/couchdb.if b/couchdb.if new file mode 100644 index 0000000..3e17383 --- /dev/null +++ b/couchdb.if @@ -0,0 +1,244 @@ + +## policy for couchdb + +######################################## +## +## Transition to couchdb. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`couchdb_domtrans',` + gen_require(` + type couchdb_t, couchdb_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, couchdb_exec_t, couchdb_t) +') +######################################## +## +## Read couchdb's log files. +## +## +## +## Domain allowed access. +## +## +## +# +interface(`couchdb_read_log',` + gen_require(` + type couchdb_log_t; + ') + + logging_search_logs($1) + read_files_pattern($1, couchdb_log_t, couchdb_log_t) +') + +######################################## +## +## Append to couchdb log files. +## +## +## +## Domain allowed access. +## +## +# +interface(`couchdb_append_log',` + gen_require(` + type couchdb_log_t; + ') + + logging_search_logs($1) + append_files_pattern($1, couchdb_log_t, couchdb_log_t) +') + +######################################## +## +## Manage couchdb log files +## +## +## +## Domain allowed access. +## +## +# +interface(`couchdb_manage_log',` + gen_require(` + type couchdb_log_t; + ') + + logging_search_logs($1) + manage_dirs_pattern($1, couchdb_log_t, couchdb_log_t) + manage_files_pattern($1, couchdb_log_t, couchdb_log_t) + manage_lnk_files_pattern($1, couchdb_log_t, couchdb_log_t) +') + +######################################## +## +## Search couchdb lib directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`couchdb_search_lib',` + gen_require(` + type couchdb_var_lib_t; + ') + + allow $1 couchdb_var_lib_t:dir search_dir_perms; + files_search_var_lib($1) +') + +######################################## +## +## Read couchdb lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`couchdb_read_lib_files',` + gen_require(` + type couchdb_var_lib_t; + ') + + files_search_var_lib($1) + read_files_pattern($1, couchdb_var_lib_t, couchdb_var_lib_t) +') + +######################################## +## +## Manage couchdb lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`couchdb_manage_lib_files',` + gen_require(` + type couchdb_var_lib_t; + ') + + files_search_var_lib($1) + manage_files_pattern($1, couchdb_var_lib_t, couchdb_var_lib_t) +') + +######################################## +## +## Manage couchdb lib directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`couchdb_manage_lib_dirs',` + gen_require(` + type couchdb_var_lib_t; + ') + + files_search_var_lib($1) + manage_dirs_pattern($1, couchdb_var_lib_t, couchdb_var_lib_t) +') + +######################################## +## +## Read couchdb PID files. +## +## +## +## Domain allowed access. +## +## +# +interface(`couchdb_read_pid_files',` + gen_require(` + type couchdb_var_run_t; + ') + + files_search_pids($1) + allow $1 couchdb_var_run_t:file read_file_perms; +') + +######################################## +## +## Execute couchdb server in the couchdb domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`couchdb_systemctl',` + gen_require(` + type couchdb_t; + type couchdb_unit_file_t; + ') + + systemd_exec_systemctl($1) + systemd_read_fifo_file_passwd_run($1) + allow $1 couchdb_unit_file_t:file read_file_perms; + allow $1 couchdb_unit_file_t:service manage_service_perms; + + ps_process_pattern($1, couchdb_t) +') + + +######################################## +## +## All of the rules required to administrate +## an couchdb environment +## +## +## +## Domain allowed access. +## +## +## +# +interface(`couchdb_admin',` + gen_require(` + type couchdb_t, couchdb_etc_t, couchdb_log_t; + type couchdb_var_lib_t, couchdb_var_run_t; + type couchdb_unit_file_t; + ') + + allow $1 couchdb_t:process { ptrace signal_perms }; + ps_process_pattern($1, couchdb_t) + + logging_search_logs($1) + admin_pattern($1, couchdb_log_t) + + files_search_etc($1) + admin_pattern($1, couchdb_etc_t) + + files_search_var_lib($1) + admin_pattern($1, couchdb_var_lib_t) + + files_search_pids($1) + admin_pattern($1, couchdb_var_run_t) + + admin_pattern($1, couchdb_unit_file_t) + couchdb_systemctl($1) + allow $1 couchdb_unit_file_t:service all_service_perms; + + optional_policy(` + systemd_passwd_agent_exec($1) + systemd_read_fifo_file_passwd_run($1) + ') +') diff --git a/couchdb.te b/couchdb.te new file mode 100644 index 0000000..4b0535f --- /dev/null +++ b/couchdb.te @@ -0,0 +1,83 @@ +policy_module(couchdb, 1.0.0) + +######################################## +# +# Declarations +# + +type couchdb_t; +type couchdb_exec_t; +init_daemon_domain(couchdb_t, couchdb_exec_t) + +type couchdb_etc_t; +files_config_file(couchdb_etc_t) + +type couchdb_tmp_t; +files_tmp_file(couchdb_tmp_t) + +type couchdb_log_t; +logging_log_file(couchdb_log_t) + +type couchdb_var_lib_t; +files_type(couchdb_var_lib_t) + +type couchdb_var_run_t; +files_pid_file(couchdb_var_run_t) + +type couchdb_unit_file_t; +systemd_unit_file(couchdb_unit_file_t) + +######################################## +# +# couchdb local policy +# +allow couchdb_t self:process { setsched signal signull sigkill }; +allow couchdb_t self:fifo_file rw_fifo_file_perms; +allow couchdb_t self:unix_stream_socket create_stream_socket_perms; +allow couchdb_t self:tcp_socket create_stream_socket_perms; +allow couchdb_t self:udp_socket create_socket_perms; + +allow couchdb_t couchdb_etc_t:dir list_dir_perms; +read_files_pattern(couchdb_t, couchdb_etc_t, couchdb_etc_t) + +manage_dirs_pattern(couchdb_t, couchdb_log_t, couchdb_log_t) +manage_files_pattern(couchdb_t, couchdb_log_t, couchdb_log_t) +logging_log_filetrans(couchdb_t, couchdb_log_t, { dir file }) + +manage_dirs_pattern(couchdb_t, couchdb_tmp_t, couchdb_tmp_t) +manage_files_pattern(couchdb_t, couchdb_tmp_t, couchdb_tmp_t) +files_tmp_filetrans(couchdb_t, couchdb_tmp_t, { dir file }) + +manage_dirs_pattern(couchdb_t, couchdb_var_lib_t, couchdb_var_lib_t) +manage_files_pattern(couchdb_t, couchdb_var_lib_t, couchdb_var_lib_t) +files_var_lib_filetrans(couchdb_t, couchdb_var_lib_t, { dir file }) + +manage_dirs_pattern(couchdb_t, couchdb_var_run_t, couchdb_var_run_t) +manage_files_pattern(couchdb_t, couchdb_var_run_t, couchdb_var_run_t) +files_pid_filetrans(couchdb_t, couchdb_var_run_t, { dir file }) + +can_exec(couchdb_t, couchdb_exec_t) + +kernel_read_system_state(couchdb_t) + +corecmd_exec_bin(couchdb_t) +corecmd_exec_shell(couchdb_t) + +corenet_tcp_bind_generic_node(couchdb_t) +corenet_udp_bind_generic_node(couchdb_t) +corenet_tcp_bind_couchdb_port(couchdb_t) + +dev_list_sysfs(couchdb_t) +dev_read_sysfs(couchdb_t) +dev_read_urand(couchdb_t) + +domain_use_interactive_fds(couchdb_t) + +files_read_usr_files(couchdb_t) + +fs_getattr_xattr_fs(couchdb_t) + +auth_use_nsswitch(couchdb_t) + +libs_exec_lib_files(couchdb_t) + diff --git a/courier.fc b/courier.fc index 47dfa07..1beadbd 100644 --- a/courier.fc +++ b/courier.fc @@ -8,15 +8,15 @@ /usr/sbin/courierldapaliasd -- gen_context(system_u:object_r:courier_exec_t,s0) /usr/sbin/couriertcpd -- gen_context(system_u:object_r:courier_tcpd_exec_t,s0) -/usr/lib/courier/(courier-)?authlib/.* -- gen_context(system_u:object_r:courier_authdaemon_exec_t,s0) -/usr/lib/courier/courier/.* -- gen_context(system_u:object_r:courier_exec_t,s0) -/usr/lib/courier/courier/courierpop.* -- gen_context(system_u:object_r:courier_pop_exec_t,s0) -/usr/lib/courier/courier/imaplogin -- gen_context(system_u:object_r:courier_pop_exec_t,s0) -/usr/lib/courier/courier/pcpd -- gen_context(system_u:object_r:courier_pcp_exec_t,s0) -/usr/lib/courier/imapd -- gen_context(system_u:object_r:courier_pop_exec_t,s0) -/usr/lib/courier/pop3d -- gen_context(system_u:object_r:courier_pop_exec_t,s0) +/usr/lib/courier/authlib/.* -- gen_context(system_u:object_r:courier_authdaemon_exec_t,s0) +/usr/lib/courier/courier/.* -- gen_context(system_u:object_r:courier_exec_t,s0) +/usr/lib/courier/courier/courierpop.* -- gen_context(system_u:object_r:courier_pop_exec_t,s0) +/usr/lib/courier/courier/imaplogin -- gen_context(system_u:object_r:courier_pop_exec_t,s0) +/usr/lib/courier/courier/pcpd -- gen_context(system_u:object_r:courier_pcp_exec_t,s0) +/usr/lib/courier/imapd -- gen_context(system_u:object_r:courier_pop_exec_t,s0) +/usr/lib/courier/pop3d -- gen_context(system_u:object_r:courier_pop_exec_t,s0) /usr/lib/courier/rootcerts(/.*)? gen_context(system_u:object_r:courier_etc_t,s0) -/usr/lib/courier/sqwebmail/cleancache\.pl -- gen_context(system_u:object_r:sqwebmail_cron_exec_t,s0) +/usr/lib/courier/sqwebmail/cleancache\.pl -- gen_context(system_u:object_r:sqwebmail_cron_exec_t,s0) ifdef(`distro_gentoo',` /usr/lib/courier-imap/couriertcpd -- gen_context(system_u:object_r:courier_tcpd_exec_t,s0) diff --git a/courier.if b/courier.if index 9971337..476f1e2 100644 --- a/courier.if +++ b/courier.if @@ -50,7 +50,6 @@ template(`courier_domain_template',` corecmd_exec_bin(courier_$1_t) - corenet_all_recvfrom_unlabeled(courier_$1_t) corenet_all_recvfrom_netlabel(courier_$1_t) corenet_tcp_sendrecv_generic_if(courier_$1_t) corenet_udp_sendrecv_generic_if(courier_$1_t) @@ -104,6 +103,25 @@ interface(`courier_domtrans_authdaemon',` domtrans_pattern($1, courier_authdaemon_exec_t, courier_authdaemon_t) ') +####################################### +## +## Connect to courier-authdaemon over a unix stream socket. +## +## +## +## Domain allowed access. +## +## +# +interface(`courier_stream_connect_authdaemon',` + gen_require(` + type courier_authdaemon_t, courier_spool_t; + ') + + files_search_spool($1) + stream_connect_pattern($1, courier_spool_t, courier_spool_t, courier_authdaemon_t) +') + ######################################## ## ## Execute the courier POP3 and IMAP server with @@ -138,6 +156,7 @@ interface(`courier_read_config',` type courier_etc_t; ') + files_search_etc($1) read_files_pattern($1, courier_etc_t, courier_etc_t) ') @@ -157,6 +176,7 @@ interface(`courier_manage_spool_dirs',` type courier_spool_t; ') + files_search_spool($1) manage_dirs_pattern($1, courier_spool_t, courier_spool_t) ') @@ -176,6 +196,7 @@ interface(`courier_manage_spool_files',` type courier_spool_t; ') + files_search_spool($1) manage_files_pattern($1, courier_spool_t, courier_spool_t) ') @@ -183,7 +204,7 @@ interface(`courier_manage_spool_files',` ## ## Read courier spool files. ## -## +## ## ## Domain allowed access. ## @@ -194,6 +215,7 @@ interface(`courier_read_spool',` type courier_spool_t; ') + files_search_spool($1) read_files_pattern($1, courier_spool_t, courier_spool_t) ') diff --git a/courier.te b/courier.te index d034450..820c10b 100644 --- a/courier.te +++ b/courier.te @@ -15,7 +15,7 @@ courier_domain_template(pcp) courier_domain_template(pop) type courier_spool_t; -files_type(courier_spool_t) +files_spool_file(courier_spool_t) courier_domain_template(tcpd) @@ -68,7 +68,6 @@ auth_domtrans_chk_passwd(courier_authdaemon_t) libs_read_lib_files(courier_authdaemon_t) -miscfiles_read_localization(courier_authdaemon_t) # should not be needed! userdom_search_user_home_dirs(courier_authdaemon_t) @@ -95,9 +94,8 @@ allow courier_pop_t courier_authdaemon_t:process sigchld; allow courier_pop_t courier_tcpd_t:{ unix_stream_socket tcp_socket } rw_stream_socket_perms; # inherits file handle - should it? -allow courier_pop_t courier_var_lib_t:file { read write }; +allow courier_pop_t courier_var_lib_t:file rw_inherited_file_perms; -miscfiles_read_localization(courier_pop_t) courier_domtrans_authdaemon(courier_pop_t) @@ -132,7 +130,6 @@ corenet_sendrecv_pop_server_packets(courier_tcpd_t) dev_read_rand(courier_tcpd_t) dev_read_urand(courier_tcpd_t) -miscfiles_read_localization(courier_tcpd_t) courier_domtrans_pop(courier_tcpd_t) diff --git a/cpucontrol.fc b/cpucontrol.fc index 789c8c7..d1723f5 100644 --- a/cpucontrol.fc +++ b/cpucontrol.fc @@ -3,6 +3,7 @@ /sbin/microcode_ctl -- gen_context(system_u:object_r:cpucontrol_exec_t,s0) +/usr/sbin/microcode_ctl -- gen_context(system_u:object_r:cpucontrol_exec_t,s0) /usr/sbin/cpufreqd -- gen_context(system_u:object_r:cpuspeed_exec_t,s0) /usr/sbin/cpuspeed -- gen_context(system_u:object_r:cpuspeed_exec_t,s0) /usr/sbin/powernowd -- gen_context(system_u:object_r:cpuspeed_exec_t,s0) diff --git a/cpucontrol.te b/cpucontrol.te index 13d2f63..1a00094 100644 --- a/cpucontrol.te +++ b/cpucontrol.te @@ -10,7 +10,7 @@ type cpucontrol_exec_t; init_system_domain(cpucontrol_t, cpucontrol_exec_t) type cpucontrol_conf_t; -files_type(cpucontrol_conf_t) +files_config_file(cpucontrol_conf_t) type cpuspeed_t; type cpuspeed_exec_t; @@ -105,8 +105,6 @@ init_use_script_ptys(cpuspeed_t) logging_send_syslog_msg(cpuspeed_t) -miscfiles_read_localization(cpuspeed_t) - userdom_dontaudit_use_unpriv_user_fds(cpuspeed_t) optional_policy(` diff --git a/cpufreqselector.te b/cpufreqselector.te index f77d58a..f3d98a9 100644 --- a/cpufreqselector.te +++ b/cpufreqselector.te @@ -14,9 +14,10 @@ application_domain(cpufreqselector_t, cpufreqselector_exec_t) # cpufreq-selector local policy # -allow cpufreqselector_t self:capability { sys_nice sys_ptrace }; +allow cpufreqselector_t self:capability sys_nice; allow cpufreqselector_t self:process getsched; allow cpufreqselector_t self:fifo_file rw_fifo_file_perms; +allow cpufreqselector_t self:process getsched; kernel_read_system_state(cpufreqselector_t) @@ -27,13 +28,15 @@ corecmd_search_bin(cpufreqselector_t) dev_rw_sysfs(cpufreqselector_t) -miscfiles_read_localization(cpufreqselector_t) +kernel_read_system_state(cpufreqselector_t) + userdom_read_all_users_state(cpufreqselector_t) -userdom_dontaudit_search_user_home_dirs(cpufreqselector_t) +userdom_dontaudit_search_admin_dir(cpufreqselector_t) optional_policy(` dbus_system_domain(cpufreqselector_t, cpufreqselector_exec_t) + init_daemon_domain(cpufreqselector_t, cpufreqselector_exec_t) optional_policy(` consolekit_dbus_chat(cpufreqselector_t) @@ -53,3 +56,7 @@ optional_policy(` policykit_read_lib(cpufreqselector_t) policykit_read_reload(cpufreqselector_t) ') + +optional_policy(` + xserver_dbus_chat_xdm(cpufreqselector_t) +') diff --git a/cron.fc b/cron.fc index 3559a05..224142a 100644 --- a/cron.fc +++ b/cron.fc @@ -3,6 +3,9 @@ /etc/cron\.d(/.*)? gen_context(system_u:object_r:system_cron_spool_t,s0) /etc/crontab -- gen_context(system_u:object_r:system_cron_spool_t,s0) +/usr/lib/systemd/system/atd.* -- gen_context(system_u:object_r:crond_unit_file_t,s0) +/usr/lib/systemd/system/crond.* -- gen_context(system_u:object_r:crond_unit_file_t,s0) + /usr/bin/at -- gen_context(system_u:object_r:crontab_exec_t,s0) /usr/bin/(f)?crontab -- gen_context(system_u:object_r:crontab_exec_t,s0) @@ -12,20 +15,34 @@ /usr/sbin/fcron -- gen_context(system_u:object_r:crond_exec_t,s0) /usr/sbin/fcronsighup -- gen_context(system_u:object_r:crontab_exec_t,s0) +/var/log/rpmpkgs.* -- gen_context(system_u:object_r:cron_log_t,s0) + /var/run/anacron\.pid -- gen_context(system_u:object_r:crond_var_run_t,s0) /var/run/atd\.pid -- gen_context(system_u:object_r:crond_var_run_t,s0) /var/run/crond?\.pid -- gen_context(system_u:object_r:crond_var_run_t,s0) -/var/run/crond\.reboot -- gen_context(system_u:object_r:crond_var_run_t,s0) +/var/run/crond?\.reboot -- gen_context(system_u:object_r:crond_var_run_t,s0) /var/run/fcron\.fifo -s gen_context(system_u:object_r:crond_var_run_t,s0) /var/run/fcron\.pid -- gen_context(system_u:object_r:crond_var_run_t,s0) +/var/run/.*cron.* -- gen_context(system_u:object_r:crond_var_run_t,s0) /var/spool/anacron(/.*)? gen_context(system_u:object_r:system_cron_spool_t,s0) /var/spool/at(/.*)? gen_context(system_u:object_r:user_cron_spool_t,s0) -/var/spool/cron -d gen_context(system_u:object_r:cron_spool_t,s0) +/var/spool/cron -d gen_context(system_u:object_r:user_cron_spool_t,s0) #/var/spool/cron/root -- gen_context(system_u:object_r:sysadm_cron_spool_t,s0) /var/spool/cron/[^/]* -- <> +ifdef(`distro_gentoo',` +/var/spool/cron/lastrun -d gen_context(system_u:object_r:crond_tmp_t,s0) +/var/spool/cron/lastrun/[^/]* -- <> +') + +ifdef(`distro_suse', ` +/var/spool/cron/lastrun -d gen_context(system_u:object_r:crond_tmp_t,s0) +/var/spool/cron/lastrun/[^/]* -- <> +/var/spool/cron/tabs -d gen_context(system_u:object_r:cron_spool_t,s0) +') + /var/spool/cron/crontabs -d gen_context(system_u:object_r:cron_spool_t,s0) /var/spool/cron/crontabs/.* -- <> #/var/spool/cron/crontabs/root -- gen_context(system_u:object_r:sysadm_cron_spool_t,s0) @@ -36,8 +53,10 @@ /var/spool/fcron/systab -- gen_context(system_u:object_r:system_cron_spool_t,s0) /var/spool/fcron/new\.systab -- gen_context(system_u:object_r:system_cron_spool_t,s0) +/var/lib/glpi/files(/.*)? gen_context(system_u:object_r:cron_var_lib_t,s0) + ifdef(`distro_debian',` -/var/log/prelink.log -- gen_context(system_u:object_r:cron_log_t,s0) +/var/log/prelink.log.* -- gen_context(system_u:object_r:cron_log_t,s0) /var/spool/cron/atjobs -d gen_context(system_u:object_r:cron_spool_t,s0) /var/spool/cron/atjobs/[^/]* -- <> diff --git a/cron.if b/cron.if index 6e12dc7..905f7d9 100644 --- a/cron.if +++ b/cron.if @@ -12,12 +12,17 @@ ## # template(`cron_common_crontab_template',` + gen_require(` + attribute crontab_domain; + type crontab_exec_t; + ') + ############################## # # Declarations # - type $1_t; + type $1_t, crontab_domain; userdom_user_application_domain($1_t, crontab_exec_t) type $1_tmp_t; @@ -28,63 +33,17 @@ template(`cron_common_crontab_template',` # Local policy # - # dac_override is to create the file in the directory under /tmp - allow $1_t self:capability { fowner setuid setgid chown dac_override }; - allow $1_t self:process { setsched signal_perms }; - allow $1_t self:fifo_file rw_fifo_file_perms; - - allow $1_t $1_tmp_t:file manage_file_perms; - files_tmp_filetrans($1_t, $1_tmp_t, file) - - # create files in /var/spool/cron - manage_files_pattern($1_t, { cron_spool_t user_cron_spool_t }, user_cron_spool_t) - filetrans_pattern($1_t, cron_spool_t, user_cron_spool_t, file) - files_list_spool($1_t) - - # crontab signals crond by updating the mtime on the spooldir - allow $1_t cron_spool_t:dir setattr; - - kernel_read_system_state($1_t) - - # for the checks used by crontab -u - selinux_dontaudit_search_fs($1_t) - - fs_getattr_xattr_fs($1_t) - - domain_use_interactive_fds($1_t) - - files_read_etc_files($1_t) - files_read_usr_files($1_t) - files_dontaudit_search_pids($1_t) + manage_dirs_pattern($1_t, $1_tmp_t, $1_tmp_t) + manage_files_pattern($1_t, $1_tmp_t, $1_tmp_t) + files_tmp_filetrans($1_t, $1_tmp_t, { dir file }) auth_domtrans_chk_passwd($1_t) + auth_use_nsswitch($1_t) logging_send_syslog_msg($1_t) - logging_send_audit_msgs($1_t) - - init_dontaudit_write_utmp($1_t) - init_read_utmp($1_t) - miscfiles_read_localization($1_t) + userdom_home_reader($1_t) - seutil_read_config($1_t) - - userdom_manage_user_tmp_dirs($1_t) - userdom_manage_user_tmp_files($1_t) - # Access terminals. - userdom_use_user_terminals($1_t) - # Read user crontabs - userdom_read_user_home_content_files($1_t) - - tunable_policy(`fcron_crond',` - # fcron wants an instant update of a crontab change for the administrator - # also crontab does a security check for crontab -u - dontaudit $1_t crond_t:process signal; - ') - - optional_policy(` - nscd_socket_use($1_t) - ') ') ######################################## @@ -101,10 +60,12 @@ template(`cron_common_crontab_template',` ## User domain for the role ## ## +## # interface(`cron_role',` gen_require(` type cronjob_t, crontab_t, crontab_exec_t; + type user_cron_spool_t, crond_t; ') role $1 types { cronjob_t crontab_t }; @@ -115,9 +76,20 @@ interface(`cron_role',` # Transition from the user domain to the derived domain. domtrans_pattern($2, crontab_exec_t, crontab_t) + allow crond_t $2:process transition; + dontaudit crond_t $2:process { noatsecure siginh rlimitinh }; + allow $2 crond_t:process sigchld; + + # needs to be authorized SELinux context for cron + allow $2 user_cron_spool_t:file { getattr read write ioctl entrypoint }; + # crontab shows up in user ps ps_process_pattern($2, crontab_t) - allow $2 crontab_t:process signal; + allow $2 crontab_t:process signal_perms; + + tunable_policy(`deny_ptrace',`',` + allow $2 crontab_t:process ptrace; + ') # Run helper programs as the user domain #corecmd_bin_domtrans(crontab_t, $2) @@ -150,29 +122,21 @@ interface(`cron_role',` ## User domain for the role ## ## +## # interface(`cron_unconfined_role',` gen_require(` - type unconfined_cronjob_t, crontab_t, crontab_tmp_t, crontab_exec_t; + type unconfined_cronjob_t; ') - role $1 types { unconfined_cronjob_t crontab_t }; + role $1 types unconfined_cronjob_t; # cronjob shows up in user ps ps_process_pattern($2, unconfined_cronjob_t) - - # Transition from the user domain to the derived domain. - domtrans_pattern($2, crontab_exec_t, crontab_t) - - # crontab shows up in user ps - ps_process_pattern($2, crontab_t) - allow $2 crontab_t:process signal; - - # Run helper programs as the user domain - #corecmd_bin_domtrans(crontab_t, $2) - #corecmd_shell_domtrans(crontab_t, $2) - corecmd_exec_bin(crontab_t) - corecmd_exec_shell(crontab_t) + allow $2 unconfined_cronjob_t:process signal_perms; + tunable_policy(`deny_ptrace',`',` + allow $2 unconfined_cronjob_t:process ptrace; + ') optional_policy(` gen_require(` @@ -180,9 +144,8 @@ interface(`cron_unconfined_role',` ') dbus_stub(unconfined_cronjob_t) - allow unconfined_cronjob_t $2:dbus send_msg; - ') + ') ') ######################################## @@ -199,6 +162,7 @@ interface(`cron_unconfined_role',` ## User domain for the role ## ## +## # interface(`cron_admin_role',` gen_require(` @@ -219,7 +183,10 @@ interface(`cron_admin_role',` # crontab shows up in user ps ps_process_pattern($2, admin_crontab_t) - allow $2 admin_crontab_t:process signal; + allow $2 admin_crontab_t:process signal_perms; + tunable_policy(`deny_ptrace',`',` + allow $2 admin_crontab_t:process ptrace; + ') # Run helper programs as the user domain #corecmd_bin_domtrans(admin_crontab_t, $2) @@ -263,6 +230,9 @@ interface(`cron_system_entry',` domtrans_pattern(crond_t, $2, $1) role system_r types $1; + + allow $1 crond_t:fifo_file rw_fifo_file_perms; + allow $1 system_cronjob_t:fifo_file rw_fifo_file_perms; ') ######################################## @@ -303,7 +273,7 @@ interface(`cron_exec',` ######################################## ## -## Execute crond server in the nscd domain. +## Execute crond server in the crond domain. ## ## ## @@ -321,6 +291,29 @@ interface(`cron_initrc_domtrans',` ######################################## ## +## Execute crond server in the crond domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`cron_systemctl',` + gen_require(` + type crond_unit_file_t; + type crond_t; + ') + + systemd_exec_systemctl($1) + allow $1 crond_unit_file_t:file read_file_perms; + allow $1 crond_unit_file_t:service manage_service_perms; + + ps_process_pattern($1, crond_t) +') + +######################################## +## ## Inherit and use a file descriptor ## from the cron daemon. ## @@ -358,6 +351,24 @@ interface(`cron_sigchld',` ######################################## ## +## Send a generic signal to cron daemon. +## +## +## +## Domain allowed access. +## +## +# +interface(`cron_signal',` + gen_require(` + type crond_t; + ') + + allow $1 crond_t:process signal; +') + +######################################## +## ## Read a cron daemon unnamed pipe. ## ## @@ -376,6 +387,47 @@ interface(`cron_read_pipes',` ######################################## ## +## Read crond state files. +## +## +## +## Domain allowed access. +## +## +# +interface(`cron_read_state_crond',` + gen_require(` + type crond_t; + ') + + kernel_search_proc($1) + ps_process_pattern($1, crond_t) +') + + +######################################## +## +## Send and receive messages from +## crond over dbus. +## +## +## +## Domain allowed access. +## +## +# +interface(`cron_dbus_chat_crond',` + gen_require(` + type crond_t; + class dbus send_msg; + ') + + allow $1 crond_t:dbus send_msg; + allow crond_t $1:dbus send_msg; +') + +######################################## +## ## Do not audit attempts to write cron daemon unnamed pipes. ## ## @@ -407,7 +459,43 @@ interface(`cron_rw_pipes',` type crond_t; ') - allow $1 crond_t:fifo_file { getattr read write }; + allow $1 crond_t:fifo_file rw_inherited_fifo_file_perms; +') + +######################################## +## +## Read and write inherited user spool files. +## +## +## +## Domain allowed access. +## +## +# +interface(`cron_rw_inherited_user_spool_files',` + gen_require(` + type user_cron_spool_t; + ') + + allow $1 user_cron_spool_t:file rw_inherited_file_perms; +') + +######################################## +## +## Read and write inherited spool files. +## +## +## +## Domain allowed access. +## +## +# +interface(`cron_rw_inherited_spool_files',` + gen_require(` + type cron_spool_t; + ') + + allow $1 cron_spool_t:file rw_inherited_file_perms; ') ######################################## @@ -467,6 +555,25 @@ interface(`cron_search_spool',` ######################################## ## +## Search the directory containing user cron tables. +## +## +## +## Domain allowed access. +## +## +# +interface(`cron_manage_system_spool',` + gen_require(` + type cron_system_spool_t; + ') + + files_search_spool($1) + manage_files_pattern($1, cron_system_spool_t, cron_system_spool_t) +') + +######################################## +## ## Manage pid files used by cron ## ## @@ -480,6 +587,7 @@ interface(`cron_manage_pid_files',` type crond_var_run_t; ') + files_search_pids($1) manage_files_pattern($1, crond_var_run_t, crond_var_run_t) ') @@ -535,7 +643,7 @@ interface(`cron_write_system_job_pipes',` type system_cronjob_t; ') - allow $1 system_cronjob_t:file write; + allow $1 system_cronjob_t:fifo_file write; ') ######################################## @@ -553,7 +661,7 @@ interface(`cron_rw_system_job_pipes',` type system_cronjob_t; ') - allow $1 system_cronjob_t:fifo_file rw_fifo_file_perms; + allow $1 system_cronjob_t:fifo_file rw_inherited_fifo_file_perms; ') ######################################## @@ -586,11 +694,14 @@ interface(`cron_rw_system_job_stream_sockets',` # interface(`cron_read_system_job_tmp_files',` gen_require(` - type system_cronjob_tmp_t; + type system_cronjob_tmp_t, cron_var_run_t; ') files_search_tmp($1) allow $1 system_cronjob_tmp_t:file read_file_perms; + + files_search_pids($1) + allow $1 cron_var_run_t:file read_file_perms; ') ######################################## @@ -626,7 +737,47 @@ interface(`cron_dontaudit_append_system_job_tmp_files',` interface(`cron_dontaudit_write_system_job_tmp_files',` gen_require(` type system_cronjob_tmp_t; + type cron_var_run_t; ') dontaudit $1 system_cronjob_tmp_t:file write_file_perms; + dontaudit $1 cron_var_run_t:file write_file_perms; +') + +######################################## +## +## Read temporary files from the system cron jobs. +## +## +## +## Domain allowed access. +## +## +# +interface(`cron_read_system_job_lib_files',` + gen_require(` + type system_cronjob_var_lib_t; + ') + + files_search_var_lib($1) + read_files_pattern($1, system_cronjob_var_lib_t, system_cronjob_var_lib_t) +') + +######################################## +## +## Manage files from the system cron jobs. +## +## +## +## Domain allowed access. +## +## +# +interface(`cron_manage_system_job_lib_files',` + gen_require(` + type system_cronjob_var_lib_t; + ') + + files_search_var_lib($1) + manage_files_pattern($1, system_cronjob_var_lib_t, system_cronjob_var_lib_t) ') diff --git a/cron.te b/cron.te index b357856..d50a6a7 100644 --- a/cron.te +++ b/cron.te @@ -1,4 +1,4 @@ -policy_module(cron, 2.4.0) +policy_module(cron, 2.2.1) gen_require(` class passwd rootok; @@ -10,35 +10,36 @@ gen_require(` # ## -##

-## Allow system cron jobs to relabel filesystem -## for restoring file contexts. -##

+##

+## Allow system cron jobs to relabel filesystem +## for restoring file contexts. +##

## gen_tunable(cron_can_relabel, false) ## -##

-## Enable extra rules in the cron domain -## to support fcron. -##

+##

+## Enable extra rules in the cron domain +## to support fcron. +##

## gen_tunable(fcron_crond, false) +attribute crontab_domain; attribute cron_spool_type; type anacron_exec_t; application_executable_file(anacron_exec_t) type cron_spool_t; -files_type(cron_spool_t) +files_spool_file(cron_spool_t) # var/lib files type cron_var_lib_t; files_type(cron_var_lib_t) type cron_var_run_t; -files_type(cron_var_run_t) +files_pid_file(cron_var_run_t) # var/log files type cron_log_t; @@ -61,11 +62,17 @@ domain_cron_exemption_source(crond_t) type crond_initrc_exec_t; init_script_file(crond_initrc_exec_t) +type crond_unit_file_t; +systemd_unit_file(crond_unit_file_t) + type crond_tmp_t; files_tmp_file(crond_tmp_t) +files_poly_parent(crond_tmp_t) +mta_system_content(crond_tmp_t) type crond_var_run_t; files_pid_file(crond_var_run_t) +mta_system_content(crond_var_run_t) type crontab_exec_t; application_executable_file(crontab_exec_t) @@ -79,14 +86,16 @@ typealias crontab_t alias { user_crontab_t staff_crontab_t }; typealias crontab_t alias { auditadm_crontab_t secadm_crontab_t }; typealias crontab_tmp_t alias { user_crontab_tmp_t staff_crontab_tmp_t }; typealias crontab_tmp_t alias { auditadm_crontab_tmp_t secadm_crontab_tmp_t }; +allow admin_crontab_t crond_t:process signal; type system_cron_spool_t, cron_spool_type; -files_type(system_cron_spool_t) +files_spool_file(system_cron_spool_t) type system_cronjob_t alias system_crond_t; init_daemon_domain(system_cronjob_t, anacron_exec_t) corecmd_shell_entry_type(system_cronjob_t) role system_r types system_cronjob_t; +domtrans_pattern(crond_t, anacron_exec_t, system_cronjob_t) type system_cronjob_lock_t alias system_crond_lock_t; files_lock_file(system_cronjob_lock_t) @@ -94,10 +103,6 @@ files_lock_file(system_cronjob_lock_t) type system_cronjob_tmp_t alias system_crond_tmp_t; files_tmp_file(system_cronjob_tmp_t) -ifdef(`enable_mcs',` - init_ranged_daemon_domain(crond_t, crond_exec_t, s0 - mcs_systemhigh) -') - type unconfined_cronjob_t; domain_type(unconfined_cronjob_t) domain_cron_exemption_target(unconfined_cronjob_t) @@ -106,8 +111,20 @@ domain_cron_exemption_target(unconfined_cronjob_t) type user_cron_spool_t, cron_spool_type; typealias user_cron_spool_t alias { staff_cron_spool_t sysadm_cron_spool_t unconfined_cron_spool_t }; typealias user_cron_spool_t alias { auditadm_cron_spool_t secadm_cron_spool_t }; -files_type(user_cron_spool_t) +files_spool_file(user_cron_spool_t) ubac_constrained(user_cron_spool_t) +mta_system_content(user_cron_spool_t) + +type system_cronjob_var_lib_t; +files_type(system_cronjob_var_lib_t) +typealias system_cronjob_var_lib_t alias system_crond_var_lib_t; + +type system_cronjob_var_run_t; +files_pid_file(system_cronjob_var_run_t) + +ifdef(`enable_mcs',` + init_ranged_daemon_domain(crond_t, crond_exec_t, s0 - mcs_systemhigh) +') ######################################## # @@ -115,7 +132,7 @@ ubac_constrained(user_cron_spool_t) # # Allow our crontab domain to unlink a user cron spool file. -allow admin_crontab_t user_cron_spool_t:file { getattr read unlink }; +allow admin_crontab_t user_cron_spool_t:file { read_file_perms delete_file_perms }; # Manipulate other users crontab. selinux_get_fs_mount(admin_crontab_t) @@ -125,7 +142,7 @@ selinux_compute_create_context(admin_crontab_t) selinux_compute_relabel_context(admin_crontab_t) selinux_compute_user_contexts(admin_crontab_t) -tunable_policy(`fcron_crond', ` +tunable_policy(`fcron_crond',` # fcron wants an instant update of a crontab change for the administrator # also crontab does a security check for crontab -u allow admin_crontab_t self:process setfscreate; @@ -136,9 +153,9 @@ tunable_policy(`fcron_crond', ` # Cron daemon local policy # -allow crond_t self:capability { dac_override setgid setuid sys_nice dac_read_search }; +allow crond_t self:capability { dac_override chown fowner setgid setuid sys_nice dac_read_search }; dontaudit crond_t self:capability { sys_resource sys_tty_config }; -allow crond_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; +allow crond_t self:process ~{ ptrace setcurrent setexec setfscreate execmem execstack execheap }; allow crond_t self:process { setexec setfscreate }; allow crond_t self:fd use; allow crond_t self:fifo_file rw_fifo_file_perms; @@ -151,6 +168,7 @@ allow crond_t self:sem create_sem_perms; allow crond_t self:msgq create_msgq_perms; allow crond_t self:msg { send receive }; allow crond_t self:key { search write link }; +dontaudit crond_t self:netlink_audit_socket nlmsg_tty_audit; manage_files_pattern(crond_t, cron_log_t, cron_log_t) logging_log_filetrans(crond_t, cron_log_t, file) @@ -187,27 +205,47 @@ fs_list_inotifyfs(crond_t) # need auth_chkpwd to check for locked accounts. auth_domtrans_chk_passwd(crond_t) +auth_manage_var_auth(crond_t) corecmd_exec_shell(crond_t) corecmd_list_bin(crond_t) +corecmd_exec_bin(crond_t) corecmd_read_bin_symlinks(crond_t) domain_use_interactive_fds(crond_t) +domain_subj_id_change_exemption(crond_t) +domain_role_change_exemption(crond_t) files_read_usr_files(crond_t) files_read_etc_runtime_files(crond_t) -files_read_etc_files(crond_t) files_read_generic_spool(crond_t) files_list_usr(crond_t) # Read from /var/spool/cron. files_search_var_lib(crond_t) files_search_default(crond_t) +fs_manage_cgroup_dirs(crond_t) +fs_manage_cgroup_files(crond_t) + +# needed by "crontab -e" +mls_file_read_all_levels(crond_t) +mls_file_write_all_levels(crond_t) + +# needed because of kernel check of transition +mls_process_set_level(crond_t) + +# to make cronjob working +mls_fd_share_all_levels(crond_t) +mls_trusted_object(crond_t) + +init_read_state(crond_t) init_rw_utmp(crond_t) init_spec_domtrans_script(crond_t) +auth_manage_var_auth(crond_t) auth_use_nsswitch(crond_t) +logging_send_audit_msgs(crond_t) logging_send_syslog_msg(crond_t) logging_set_loginuid(crond_t) @@ -215,25 +253,27 @@ seutil_read_config(crond_t) seutil_read_default_contexts(crond_t) seutil_sigchld_newrole(crond_t) -miscfiles_read_localization(crond_t) userdom_use_unpriv_users_fds(crond_t) # Not sure why this is needed userdom_list_user_home_dirs(crond_t) +userdom_list_admin_dir(crond_t) +userdom_manage_all_users_keys(crond_t) mta_send_mail(crond_t) +mta_system_content(cron_spool_t) ifdef(`distro_debian',` # pam_limits is used allow crond_t self:process setrlimit; - optional_policy(` - # Debian logcheck has the home dir set to its cache - logwatch_search_cache_dir(crond_t) - ') ') -ifdef(`distro_redhat', ` +optional_policy(` + logwatch_search_cache_dir(crond_t) +') + +ifdef(`distro_redhat',` # Run the rpm program in the rpm_t domain. Allow creation of RPM log files # via redirection of standard out. optional_policy(` @@ -241,7 +281,7 @@ ifdef(`distro_redhat', ` ') ') -tunable_policy(`allow_polyinstantiation',` +tunable_policy(`polyinstantiation_enabled',` files_polyinstantiate_all(crond_t) ') @@ -250,11 +290,27 @@ tunable_policy(`fcron_crond', ` ') optional_policy(` + apache_search_sys_content(crond_t) +') + +optional_policy(` + djbdns_search_tinydns_keys(crond_t) + djbdns_link_tinydns_keys(crond_t) +') + +optional_policy(` locallogin_search_keys(crond_t) locallogin_link_keys(crond_t) ') optional_policy(` + # these should probably be unconfined_crond_t + dbus_system_bus_client(crond_t) + init_dbus_send_script(crond_t) + init_dbus_chat(crond_t) +') + +optional_policy(` amanda_search_var_lib(crond_t) ') @@ -264,6 +320,8 @@ optional_policy(` optional_policy(` hal_dbus_chat(crond_t) + hal_write_log(crond_t) + hal_dbus_chat(system_cronjob_t) ') optional_policy(` @@ -286,15 +344,25 @@ optional_policy(` ') optional_policy(` + systemd_use_fds_logind(crond_t) + systemd_write_inherited_logind_sessions_pipes(crond_t) +') + +optional_policy(` udev_read_db(crond_t) ') +optional_policy(` + vnstatd_search_lib(crond_t) +') + ######################################## # # System cron process domain # allow system_cronjob_t self:capability { dac_override dac_read_search chown setgid setuid fowner net_bind_service fsetid sys_nice }; + allow system_cronjob_t self:process { signal_perms getsched setsched }; allow system_cronjob_t self:fifo_file rw_fifo_file_perms; allow system_cronjob_t self:passwd rootok; @@ -306,10 +374,19 @@ logging_log_filetrans(system_cronjob_t, cron_log_t, file) # This is to handle /var/lib/misc directory. Used currently # by prelink var/lib files for cron -allow system_cronjob_t cron_var_lib_t:file manage_file_perms; +allow system_cronjob_t cron_var_lib_t:file { manage_file_perms relabel_file_perms }; files_var_lib_filetrans(system_cronjob_t, cron_var_lib_t, file) +allow system_cronjob_t cron_var_run_t:file manage_file_perms; +files_pid_filetrans(system_cronjob_t, cron_var_run_t, file) + allow system_cronjob_t system_cron_spool_t:file read_file_perms; + +mls_file_read_to_clearance(system_cronjob_t) + +# anacron forces the following +manage_files_pattern(system_cronjob_t, system_cron_spool_t, system_cron_spool_t) + # The entrypoint interface is not used as this is not # a regular entrypoint. Since crontab files are # not directly executed, crond must ensure that @@ -329,6 +406,7 @@ allow crond_t system_cronjob_t:fd use; allow system_cronjob_t crond_t:fd use; allow system_cronjob_t crond_t:fifo_file rw_file_perms; allow system_cronjob_t crond_t:process sigchld; +allow crond_t system_cronjob_t:key manage_key_perms; # Write /var/lock/makewhatis.lock. allow system_cronjob_t system_cronjob_lock_t:file manage_file_perms; @@ -340,11 +418,16 @@ manage_lnk_files_pattern(system_cronjob_t, crond_tmp_t, system_cronjob_tmp_t) filetrans_pattern(system_cronjob_t, crond_tmp_t, system_cronjob_tmp_t, { file lnk_file }) files_tmp_filetrans(system_cronjob_t, system_cronjob_tmp_t, file) +# var/lib files for system_crond +files_search_var_lib(system_cronjob_t) +manage_files_pattern(system_cronjob_t, system_cronjob_var_lib_t, system_cronjob_var_lib_t) + # Read from /var/spool/cron. allow system_cronjob_t cron_spool_t:dir list_dir_perms; -allow system_cronjob_t cron_spool_t:file read_file_perms; +allow system_cronjob_t cron_spool_t:file rw_file_perms; kernel_read_kernel_sysctls(system_cronjob_t) +kernel_read_network_state(system_cronjob_t) kernel_read_system_state(system_cronjob_t) kernel_read_software_raid_state(system_cronjob_t) @@ -353,7 +436,6 @@ files_dontaudit_search_boot(system_cronjob_t) corecmd_exec_all_executables(system_cronjob_t) -corenet_all_recvfrom_unlabeled(system_cronjob_t) corenet_all_recvfrom_netlabel(system_cronjob_t) corenet_tcp_sendrecv_generic_if(system_cronjob_t) corenet_udp_sendrecv_generic_if(system_cronjob_t) @@ -365,6 +447,7 @@ corenet_udp_sendrecv_all_ports(system_cronjob_t) dev_getattr_all_blk_files(system_cronjob_t) dev_getattr_all_chr_files(system_cronjob_t) dev_read_urand(system_cronjob_t) +dev_read_sysfs(system_cronjob_t) fs_getattr_all_fs(system_cronjob_t) fs_getattr_all_files(system_cronjob_t) @@ -376,7 +459,6 @@ fs_getattr_all_sockets(system_cronjob_t) domain_dontaudit_read_all_domains_state(system_cronjob_t) files_exec_etc_files(system_cronjob_t) -files_read_etc_files(system_cronjob_t) files_read_etc_runtime_files(system_cronjob_t) files_list_all(system_cronjob_t) files_getattr_all_dirs(system_cronjob_t) @@ -391,6 +473,7 @@ files_dontaudit_search_pids(system_cronjob_t) # Access other spool directories like # /var/spool/anacron and /var/spool/slrnpull. files_manage_generic_spool(system_cronjob_t) +files_create_boot_flag(system_cronjob_t) init_use_script_fds(system_cronjob_t) init_read_utmp(system_cronjob_t) @@ -408,13 +491,14 @@ logging_read_generic_logs(system_cronjob_t) logging_send_audit_msgs(system_cronjob_t) logging_send_syslog_msg(system_cronjob_t) -miscfiles_read_localization(system_cronjob_t) miscfiles_manage_man_pages(system_cronjob_t) seutil_read_config(system_cronjob_t) -ifdef(`distro_redhat', ` +ifdef(`distro_redhat',` # Run the rpm program in the rpm_t domain. Allow creation of RPM log files + allow crond_t system_cron_spool_t:file manage_file_perms; + # via redirection of standard out. optional_policy(` rpm_manage_log(system_cronjob_t) @@ -439,6 +523,8 @@ optional_policy(` apache_read_config(system_cronjob_t) apache_read_log(system_cronjob_t) apache_read_sys_content(system_cronjob_t) + apache_delete_cache_dirs(system_cronjob_t) + apache_delete_cache_files(system_cronjob_t) ') optional_policy(` @@ -446,6 +532,14 @@ optional_policy(` ') optional_policy(` + dbus_system_bus_client(system_cronjob_t) +') + +optional_policy(` + exim_read_spool_files(system_cronjob_t) +') + +optional_policy(` ftp_read_log(system_cronjob_t) ') @@ -456,6 +550,10 @@ optional_policy(` ') optional_policy(` + livecd_read_tmp_files(system_cronjob_t) +') + +optional_policy(` lpd_list_spool(system_cronjob_t) ') @@ -464,7 +562,9 @@ optional_policy(` ') optional_policy(` + mta_read_config(system_cronjob_t) mta_send_mail(system_cronjob_t) + mta_system_content(system_cron_spool_t) ') optional_policy(` @@ -472,6 +572,10 @@ optional_policy(` ') optional_policy(` + networkmanager_dbus_chat(system_cronjob_t) +') + +optional_policy(` postfix_read_config(system_cronjob_t) ') @@ -480,7 +584,7 @@ optional_policy(` prelink_manage_lib(system_cronjob_t) prelink_manage_log(system_cronjob_t) prelink_read_cache(system_cronjob_t) - prelink_relabelfrom_lib(system_cronjob_t) + prelink_relabel_lib(system_cronjob_t) ') optional_policy(` @@ -495,6 +599,7 @@ optional_policy(` optional_policy(` spamassassin_manage_lib_files(system_cronjob_t) + spamassassin_manage_home_client(system_cronjob_t) ') optional_policy(` @@ -502,7 +607,18 @@ optional_policy(` ') optional_policy(` + systemd_dbus_chat_logind(system_cronjob_t) + systemd_write_inherited_logind_sessions_pipes(system_cronjob_t) +') + +optional_policy(` + unconfined_domain(crond_t) unconfined_domain(system_cronjob_t) +') + +optional_policy(` + unconfined_shell_domtrans(crond_t) + unconfined_dbus_send(crond_t) userdom_user_home_dir_filetrans_user_home_content(system_cronjob_t, { dir file lnk_file fifo_file sock_file }) ') @@ -542,7 +658,6 @@ kernel_read_kernel_sysctls(cronjob_t) # ps does not need to access /boot when run from cron files_dontaudit_search_boot(cronjob_t) -corenet_all_recvfrom_unlabeled(cronjob_t) corenet_all_recvfrom_netlabel(cronjob_t) corenet_tcp_sendrecv_generic_if(cronjob_t) corenet_udp_sendrecv_generic_if(cronjob_t) @@ -579,7 +694,6 @@ logging_search_logs(cronjob_t) seutil_read_config(cronjob_t) -miscfiles_read_localization(cronjob_t) userdom_manage_user_tmp_files(cronjob_t) userdom_manage_user_tmp_symlinks(cronjob_t) @@ -595,9 +709,12 @@ userdom_manage_user_home_content_sockets(cronjob_t) #userdom_user_home_dir_filetrans_user_home_content(cronjob_t, notdevfile_class_set) list_dirs_pattern(crond_t, user_cron_spool_t, user_cron_spool_t) +rw_dirs_pattern(crond_t, user_cron_spool_t, user_cron_spool_t) read_files_pattern(crond_t, user_cron_spool_t, user_cron_spool_t) +read_lnk_files_pattern(crond_t, user_cron_spool_t, user_cron_spool_t) +allow crond_t user_cron_spool_t:file manage_lnk_file_perms; -tunable_policy(`fcron_crond', ` +tunable_policy(`fcron_crond',` allow crond_t user_cron_spool_t:file manage_file_perms; ') @@ -626,3 +743,76 @@ optional_policy(` unconfined_domain(unconfined_cronjob_t) ') + +############################## +# +# crontab common policy +# + +# dac_override is to create the file in the directory under /tmp +allow crontab_domain self:capability { fowner setuid setgid chown dac_override }; +allow crontab_domain self:process { getcap setsched signal_perms }; +allow crontab_domain self:fifo_file rw_fifo_file_perms; + +allow crontab_domain crond_t:process signal; +allow crontab_domain crond_var_run_t:file read_file_perms; + +# create files in /var/spool/cron +manage_files_pattern(crontab_domain, { cron_spool_t user_cron_spool_t }, user_cron_spool_t) +filetrans_pattern(crontab_domain, cron_spool_t, user_cron_spool_t, file) +files_list_spool(crontab_domain) + +# crontab signals crond by updating the mtime on the spooldir +allow crontab_domain cron_spool_t:dir setattr_dir_perms; + +kernel_read_system_state(crontab_domain) + +# for the checks used by crontab -u +selinux_dontaudit_search_fs(crontab_domain) + +fs_getattr_xattr_fs(crontab_domain) +fs_manage_cgroup_dirs(crontab_domain) +fs_manage_cgroup_files(crontab_domain) + +domain_use_interactive_fds(crontab_domain) + +files_read_etc_files(crontab_domain) +files_read_usr_files(crontab_domain) +files_dontaudit_search_pids(crontab_domain) + +fs_dontaudit_rw_anon_inodefs_files(crontab_domain) + +auth_rw_var_auth(crontab_domain) + +logging_send_audit_msgs(crontab_domain) +logging_set_loginuid(crontab_domain) + +init_dontaudit_write_utmp(crontab_domain) +init_read_utmp(crontab_domain) +init_read_state(crontab_domain) + + +seutil_read_config(crontab_domain) + +userdom_manage_user_tmp_dirs(crontab_domain) +userdom_manage_user_tmp_files(crontab_domain) +# Access terminals. +userdom_use_inherited_user_terminals(crontab_domain) +# Read user crontabs +userdom_read_user_home_content_files(crontab_domain) +userdom_read_user_home_content_symlinks(crontab_domain) + +tunable_policy(`fcron_crond',` + # fcron wants an instant update of a crontab change for the administrator + # also crontab does a security check for crontab -u + dontaudit crontab_domain crond_t:process signal; +') + +optional_policy(` + ssh_dontaudit_use_ptys(crontab_domain) +') + +optional_policy(` + openshift_dontaudit_rw_inherited_fifo_files(crontab_domain) + openshift_transition(system_cronjob_t) +') diff --git a/ctdbd.fc b/ctdbd.fc new file mode 100644 index 0000000..2db6b61 --- /dev/null +++ b/ctdbd.fc @@ -0,0 +1,18 @@ + +/etc/rc\.d/init\.d/ctdb -- gen_context(system_u:object_r:ctdbd_initrc_exec_t,s0) + +/etc/ctdb(/.*)? gen_context(system_u:object_r:ctdbd_var_lib_t,s0) + +/usr/sbin/ctdbd -- gen_context(system_u:object_r:ctdbd_exec_t,s0) + +/var/log/log\.ctdb -- gen_context(system_u:object_r:ctdbd_log_t,s0) + +/var/spool/ctdb(/.*)? gen_context(system_u:object_r:ctdbd_spool_t,s0) + +/var/run/ctdbd(/.*)? gen_context(system_u:object_r:ctdbd_var_run_t,s0) + + +/var/ctdbd(/.*)? gen_context(system_u:object_r:ctdbd_var_lib_t,s0) +/var/ctdb(/.*)? gen_context(system_u:object_r:ctdbd_var_lib_t,s0) +/var/lib/ctdbd(/.*)? gen_context(system_u:object_r:ctdbd_var_lib_t,s0) + diff --git a/ctdbd.if b/ctdbd.if new file mode 100644 index 0000000..4f7d237 --- /dev/null +++ b/ctdbd.if @@ -0,0 +1,259 @@ + +## policy for ctdbd + +######################################## +## +## Transition to ctdbd. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`ctdbd_domtrans',` + gen_require(` + type ctdbd_t, ctdbd_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, ctdbd_exec_t, ctdbd_t) +') + +######################################## +## +## Execute ctdbd server in the ctdbd domain. +## +## +## +## Domain allowed access. +## +## +# +interface(`ctdbd_initrc_domtrans',` + gen_require(` + type ctdbd_initrc_exec_t; + ') + + init_labeled_script_domtrans($1, ctdbd_initrc_exec_t) +') + +######################################## +## +## Read ctdbd's log files. +## +## +## +## Domain allowed access. +## +## +## +# +interface(`ctdbd_read_log',` + gen_require(` + type ctdbd_log_t; + ') + + logging_search_logs($1) + read_files_pattern($1, ctdbd_log_t, ctdbd_log_t) +') + +######################################## +## +## Append to ctdbd log files. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`ctdbd_append_log',` + gen_require(` + type ctdbd_log_t; + ') + + logging_search_logs($1) + append_files_pattern($1, ctdbd_log_t, ctdbd_log_t) +') + +######################################## +## +## Manage ctdbd log files +## +## +## +## Domain to not audit. +## +## +# +interface(`ctdbd_manage_log',` + gen_require(` + type ctdbd_log_t; + ') + + logging_search_logs($1) + manage_dirs_pattern($1, ctdbd_log_t, ctdbd_log_t) + manage_files_pattern($1, ctdbd_log_t, ctdbd_log_t) + manage_lnk_files_pattern($1, ctdbd_log_t, ctdbd_log_t) +') + +######################################## +## +## Search ctdbd lib directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`ctdbd_search_lib',` + gen_require(` + type ctdbd_var_lib_t; + ') + + allow $1 ctdbd_var_lib_t:dir search_dir_perms; + files_search_var_lib($1) +') + +######################################## +## +## Read ctdbd lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`ctdbd_read_lib_files',` + gen_require(` + type ctdbd_var_lib_t; + ') + + files_search_var_lib($1) + read_files_pattern($1, ctdbd_var_lib_t, ctdbd_var_lib_t) +') + +######################################## +## +## Manage ctdbd lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`ctdbd_manage_lib_files',` + gen_require(` + type ctdbd_var_lib_t; + ') + + files_search_var_lib($1) + manage_files_pattern($1, ctdbd_var_lib_t, ctdbd_var_lib_t) +') + +######################################## +## +## Manage ctdbd lib directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`ctdbd_manage_lib_dirs',` + gen_require(` + type ctdbd_var_lib_t; + ') + + files_search_var_lib($1) + manage_dirs_pattern($1, ctdbd_var_lib_t, ctdbd_var_lib_t) +') + +######################################## +## +## Read ctdbd PID files. +## +## +## +## Domain allowed access. +## +## +# +interface(`ctdbd_read_pid_files',` + gen_require(` + type ctdbd_var_run_t; + ') + + files_search_pids($1) + allow $1 ctdbd_var_run_t:file read_file_perms; +') + +####################################### +## +## Connect to ctdbd over a unix stream socket. +## +## +## +## Domain allowed access. +## +## +# +interface(`ctdbd_stream_connect',` + gen_require(` + type ctdbd_t, ctdbd_var_run_t, ctdbd_tmp_t; + ') + + files_search_pids($1) + stream_connect_pattern($1, ctdbd_var_run_t, ctdbd_var_run_t, ctdbd_t) + stream_connect_pattern($1, ctdbd_tmp_t, ctdbd_tmp_t, ctdbd_t) +') + +######################################## +## +## All of the rules required to administrate +## an ctdbd environment +## +## +## +## Domain allowed access. +## +## +## +## +## Role allowed access. +## +## +## +# +interface(`ctdbd_admin',` + gen_require(` + type ctdbd_t, ctdbd_initrc_exec_t; + type ctdbd_log_t, ctdbd_var_lib_t, ctdbd_var_run_t; + ') + + allow $1 ctdbd_t:process signal_perms; + ps_process_pattern($1, ctdbd_t) + tunable_policy(`deny_ptrace',`',` + allow $1 ctdbd_t:process ptrace; + ') + + ctdbd_initrc_domtrans($1) + domain_system_change_exemption($1) + role_transition $2 ctdbd_initrc_exec_t system_r; + allow $2 system_r; + + logging_search_logs($1) + admin_pattern($1, ctdbd_log_t) + + files_search_var_lib($1) + admin_pattern($1, ctdbd_var_lib_t) + + files_search_pids($1) + admin_pattern($1, ctdbd_var_run_t) +') + diff --git a/ctdbd.te b/ctdbd.te new file mode 100644 index 0000000..8b2fdba --- /dev/null +++ b/ctdbd.te @@ -0,0 +1,113 @@ +policy_module(ctdbd, 1.0.0) + +######################################## +# +# Declarations +# + +type ctdbd_t; +type ctdbd_exec_t; +init_daemon_domain(ctdbd_t, ctdbd_exec_t) + +type ctdbd_initrc_exec_t; +init_script_file(ctdbd_initrc_exec_t) + +type ctdbd_log_t; +logging_log_file(ctdbd_log_t) + +type ctdbd_spool_t; +files_type(ctdbd_spool_t) +#files_spool_file(ctdbd_spool_t) + +type ctdbd_tmp_t; +files_tmp_file(ctdbd_tmp_t) + +type ctdbd_var_lib_t; +files_type(ctdbd_var_lib_t) + +type ctdbd_var_run_t; +files_pid_file(ctdbd_var_run_t) + +######################################## +# +# ctdbd local policy +# + +allow ctdbd_t self:capability { chown ipc_lock net_admin net_raw sys_nice }; +allow ctdbd_t self:process { setpgid signal_perms setsched }; + +allow ctdbd_t self:fifo_file rw_fifo_file_perms; +allow ctdbd_t self:unix_stream_socket { connectto create_stream_socket_perms }; +allow ctdbd_t self:netlink_route_socket r_netlink_socket_perms; +allow ctdbd_t self:packet_socket create_socket_perms; +allow ctdbd_t self:tcp_socket create_stream_socket_perms; + +manage_dirs_pattern(ctdbd_t, ctdbd_log_t, ctdbd_log_t) +manage_files_pattern(ctdbd_t, ctdbd_log_t, ctdbd_log_t) +logging_log_filetrans(ctdbd_t, ctdbd_log_t, { dir file } ) + +manage_files_pattern(ctdbd_t, ctdbd_tmp_t, ctdbd_tmp_t) +manage_sock_files_pattern(ctdbd_t, ctdbd_tmp_t, ctdbd_tmp_t) +files_tmp_filetrans(ctdbd_t, ctdbd_tmp_t, { file sock_file}) + +manage_dirs_pattern(ctdbd_t, ctdbd_spool_t, ctdbd_spool_t) +manage_files_pattern(ctdbd_t, ctdbd_spool_t, ctdbd_spool_t) +manage_lnk_files_pattern(ctdbd_t, ctdbd_spool_t, ctdbd_spool_t) +files_spool_filetrans(ctdbd_t, ctdbd_spool_t, { dir file }) + +exec_files_pattern(ctdbd_t, ctdbd_var_lib_t, ctdbd_var_lib_t) +manage_dirs_pattern(ctdbd_t, ctdbd_var_lib_t, ctdbd_var_lib_t) +manage_files_pattern(ctdbd_t, ctdbd_var_lib_t, ctdbd_var_lib_t) +files_var_lib_filetrans(ctdbd_t, ctdbd_var_lib_t, { dir file } ) + +manage_dirs_pattern(ctdbd_t, ctdbd_var_run_t, ctdbd_var_run_t) +manage_files_pattern(ctdbd_t, ctdbd_var_run_t, ctdbd_var_run_t) +files_pid_filetrans(ctdbd_t, ctdbd_var_run_t, { dir file }) + +kernel_read_network_state(ctdbd_t) +kernel_rw_net_sysctls(ctdbd_t) +kernel_read_system_state(ctdbd_t) + +corenet_tcp_bind_generic_node(ctdbd_t) +corenet_tcp_bind_ctdb_port(ctdbd_t) +corenet_tcp_connect_ctdb_port(ctdbd_t) + +corecmd_exec_bin(ctdbd_t) +corecmd_exec_shell(ctdbd_t) + +dev_read_sysfs(ctdbd_t) +dev_read_urand(ctdbd_t) + +domain_use_interactive_fds(ctdbd_t) +domain_dontaudit_read_all_domains_state(ctdbd_t) + +files_read_etc_files(ctdbd_t) +files_search_all_mountpoints(ctdbd_t) + +logging_send_syslog_msg(ctdbd_t) + +miscfiles_read_public_files(ctdbd_t) + + +optional_policy(` + consoletype_exec(ctdbd_t) +') + +optional_policy(` + hostname_exec(ctdbd_t) +') + +optional_policy(` + iptables_domtrans(ctdbd_t) +') + +optional_policy(` + samba_initrc_domtrans(ctdbd_t) + samba_domtrans_net(ctdbd_t) + samba_rw_var_files(ctdbd_t) + samba_systemctl(ctdbd_t) +') + +optional_policy(` + sysnet_domtrans_ifconfig(ctdbd_t) +') diff --git a/cups.fc b/cups.fc index 848bb92..624fc09 100644 --- a/cups.fc +++ b/cups.fc @@ -19,7 +19,10 @@ /etc/printcap.* -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0) +/usr/lib/systemd/system/cups.* -- gen_context(system_u:object_r:cupsd_unit_file_t,s0) + /lib/udev/udev-configure-printer -- gen_context(system_u:object_r:cupsd_config_exec_t,s0) +/usr/lib/udev/udev-configure-printer -- gen_context(system_u:object_r:cupsd_config_exec_t,s0) /opt/gutenprint/ppds(/.*)? gen_context(system_u:object_r:cupsd_rw_etc_t,s0) @@ -52,6 +55,7 @@ /var/lib/cups/certs -d gen_context(system_u:object_r:cupsd_rw_etc_t,s0) /var/lib/cups/certs/.* -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0) +/usr/lib/bjlib(/.*)? gen_context(system_u:object_r:cupsd_rw_etc_t,mls_systemhigh) /var/lib/hp(/.*)? gen_context(system_u:object_r:hplip_var_lib_t,s0) @@ -60,10 +64,18 @@ /var/ccpd(/.*)? gen_context(system_u:object_r:cupsd_var_run_t,s0) /var/ekpd(/.*)? gen_context(system_u:object_r:cupsd_var_run_t,s0) -/var/run/cups(/.*)? gen_context(system_u:object_r:cupsd_var_run_t,s0) +/var/run/cups(/.*)? gen_context(system_u:object_r:cupsd_var_run_t,mls_systemhigh) /var/run/hp.*\.pid -- gen_context(system_u:object_r:hplip_var_run_t,s0) /var/run/hp.*\.port -- gen_context(system_u:object_r:hplip_var_run_t,s0) /var/run/ptal-printd(/.*)? gen_context(system_u:object_r:ptal_var_run_t,s0) /var/run/ptal-mlcd(/.*)? gen_context(system_u:object_r:ptal_var_run_t,s0) /var/run/udev-configure-printer(/.*)? gen_context(system_u:object_r:cupsd_config_var_run_t,s0) /var/turboprint(/.*)? gen_context(system_u:object_r:cupsd_var_run_t,s0) + +/usr/Brother/fax/.*\.log.* gen_context(system_u:object_r:cupsd_log_t,s0) +/usr/Brother/(.*/)?inf(/.*)? gen_context(system_u:object_r:cupsd_rw_etc_t,s0) +/usr/Printer/(.*/)?inf(/.*)? gen_context(system_u:object_r:cupsd_rw_etc_t,s0) + +/usr/local/linuxprinter/ppd(/.*)? gen_context(system_u:object_r:cupsd_rw_etc_t,s0) + +/opt/brother/Printers(.*/)?inf(/.*)? gen_context(system_u:object_r:cupsd_rw_etc_t,s0) diff --git a/cups.if b/cups.if index 305ddf4..11d010a 100644 --- a/cups.if +++ b/cups.if @@ -9,6 +9,11 @@ ## Domain allowed access. ## ## +## +## +## Domain allowed access. +## +## # interface(`cups_backend',` gen_require(` @@ -190,10 +195,12 @@ interface(`cups_dbus_chat_config',` interface(`cups_read_config',` gen_require(` type cupsd_etc_t, cupsd_rw_etc_t; + type hplip_etc_t; ') files_search_etc($1) read_files_pattern($1, cupsd_etc_t, cupsd_etc_t) + read_files_pattern($1, hplip_etc_t, hplip_etc_t) read_files_pattern($1, cupsd_etc_t, cupsd_rw_etc_t) ') @@ -296,6 +303,29 @@ interface(`cups_stream_connect_ptal',` ######################################## ## +## Execute cupsd server in the cupsd domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`cupsd_systemctl',` + gen_require(` + type cupsd_t; + type cupsd_unit_file_t; + ') + + systemd_exec_systemctl($1) + allow $1 cupsd_unit_file_t:file read_file_perms; + allow $1 cupsd_unit_file_t:service manage_service_perms; + + ps_process_pattern($1, cupsd_t) +') + +######################################## +## ## All of the rules required to administrate ## an cups environment ## @@ -314,16 +344,20 @@ interface(`cups_stream_connect_ptal',` interface(`cups_admin',` gen_require(` type cupsd_t, cupsd_tmp_t, cupsd_lpd_tmp_t; - type cupsd_etc_t, cupsd_log_t, cupsd_spool_t; - type cupsd_config_var_run_t, cupsd_lpd_var_run_t; - type cupsd_var_run_t, ptal_etc_t; - type ptal_var_run_t, hplip_var_run_t; - type cupsd_initrc_exec_t; + type cupsd_etc_t, cupsd_log_t, hplip_etc_t; + type cupsd_config_var_run_t, cupsd_lpd_var_run_t, cupsd_initrc_exec_t; + type cupsd_var_run_t, ptal_etc_t, hplip_var_run_t; + type ptal_var_run_t; + type cupsd_unit_file_t; ') - allow $1 cupsd_t:process { ptrace signal_perms }; + allow $1 cupsd_t:process signal_perms; ps_process_pattern($1, cupsd_t) + tunable_policy(`deny_ptrace',`',` + allow $1 cupsd_t:process ptrace; + ') + init_labeled_script_domtrans($1, cupsd_initrc_exec_t) domain_system_change_exemption($1) role_transition $2 cupsd_initrc_exec_t system_r; @@ -350,9 +384,42 @@ interface(`cups_admin',` admin_pattern($1, cupsd_var_run_t) files_list_pids($1) + admin_pattern($1, hplip_etc_t) + admin_pattern($1, hplip_var_run_t) admin_pattern($1, ptal_etc_t) admin_pattern($1, ptal_var_run_t) + + cupsd_systemctl($1) + admin_pattern($1, cupsd_unit_file_t) + allow $1 cupsd_unit_file_t:service all_service_perms; +') + +######################################## +## +## Transition to cups named content +## +## +## +## Domain allowed access. +## +## +# +interface(`cups_filetrans_named_content',` + gen_require(` + type cups_rw_etc_t; + type cups_etc_t; + ') + + filetrans_pattern($1, cups_etc_t, cups_rw_etc_t, file, "classes.conf") + filetrans_pattern($1, cups_etc_t, cups_rw_etc_t, file, "printers.conf") + filetrans_pattern($1, cups_etc_t, cups_rw_etc_t, file, "printers.conf.O") + filetrans_pattern($1, cups_etc_t, cups_rw_etc_t, file, "cupsd.conf") + filetrans_pattern($1, cups_etc_t, cups_rw_etc_t, file, "cupsd.conf.default") + filetrans_pattern($1, cups_etc_t, cups_rw_etc_t, file, "lpoptions") + filetrans_pattern($1, cups_etc_t, cups_rw_etc_t, file, "subscriptions.conf") + filetrans_pattern($1, cups_etc_t, cups_rw_etc_t, file, "subscriptions.conf.O") + filetrans_pattern($1, cups_etc_t, cups_rw_etc_t, file, "ppds.dat") ') diff --git a/cups.te b/cups.te index e5a8924..8754ea4 100644 --- a/cups.te +++ b/cups.te @@ -15,6 +15,7 @@ files_pid_file(cupsd_config_var_run_t) type cupsd_t; type cupsd_exec_t; init_daemon_domain(cupsd_t, cupsd_exec_t) +mls_trusted_object(cupsd_t) type cupsd_etc_t; files_config_file(cupsd_etc_t) @@ -60,6 +61,9 @@ type cupsd_var_run_t; files_pid_file(cupsd_var_run_t) mls_trusted_object(cupsd_var_run_t) +type cupsd_unit_file_t; +systemd_unit_file(cupsd_unit_file_t) + type hplip_t; type hplip_exec_t; init_daemon_domain(hplip_t, hplip_exec_t) @@ -104,6 +108,7 @@ ifdef(`enable_mls',` # /usr/lib/cups/backend/serial needs sys_admin(?!) allow cupsd_t self:capability { ipc_lock sys_admin dac_override dac_read_search kill setgid setuid fsetid net_bind_service fowner chown dac_override sys_rawio sys_resource sys_tty_config }; dontaudit cupsd_t self:capability { sys_tty_config net_admin }; +allow cupsd_t self:capability2 { block_suspend }; allow cupsd_t self:process { getpgid setpgid setsched signal_perms }; allow cupsd_t self:fifo_file rw_fifo_file_perms; allow cupsd_t self:unix_stream_socket { create_stream_socket_perms connectto }; @@ -123,6 +128,7 @@ read_lnk_files_pattern(cupsd_t, cupsd_etc_t, cupsd_etc_t) files_search_etc(cupsd_t) manage_files_pattern(cupsd_t, cupsd_interface_t, cupsd_interface_t) +can_exec(cupsd_t, cupsd_interface_t) manage_dirs_pattern(cupsd_t, cupsd_etc_t, cupsd_rw_etc_t) manage_files_pattern(cupsd_t, cupsd_etc_t, cupsd_rw_etc_t) @@ -137,6 +143,7 @@ allow cupsd_t cupsd_exec_t:lnk_file read_lnk_file_perms; allow cupsd_t cupsd_lock_t:file manage_file_perms; files_lock_filetrans(cupsd_t, cupsd_lock_t, file) +manage_dirs_pattern(cupsd_t, cupsd_log_t, cupsd_log_t) manage_files_pattern(cupsd_t, cupsd_log_t, cupsd_log_t) allow cupsd_t cupsd_log_t:dir setattr; logging_log_filetrans(cupsd_t, cupsd_log_t, { file dir }) @@ -146,11 +153,12 @@ manage_files_pattern(cupsd_t, cupsd_tmp_t, cupsd_tmp_t) manage_fifo_files_pattern(cupsd_t, cupsd_tmp_t, cupsd_tmp_t) files_tmp_filetrans(cupsd_t, cupsd_tmp_t, { file dir fifo_file }) -allow cupsd_t cupsd_var_run_t:dir setattr; +allow cupsd_t cupsd_var_run_t:dir setattr_dir_perms; +manage_dirs_pattern(cupsd_t, cupsd_var_run_t, cupsd_var_run_t) manage_files_pattern(cupsd_t, cupsd_var_run_t, cupsd_var_run_t) manage_sock_files_pattern(cupsd_t, cupsd_var_run_t, cupsd_var_run_t) manage_fifo_files_pattern(cupsd_t, cupsd_var_run_t, cupsd_var_run_t) -files_pid_filetrans(cupsd_t, cupsd_var_run_t, { file fifo_file }) +files_pid_filetrans(cupsd_t, cupsd_var_run_t, { dir file fifo_file }) allow cupsd_t hplip_t:process { signal sigkill }; @@ -159,14 +167,13 @@ read_files_pattern(cupsd_t, hplip_etc_t, hplip_etc_t) allow cupsd_t hplip_var_run_t:file read_file_perms; stream_connect_pattern(cupsd_t, ptal_var_run_t, ptal_var_run_t, ptal_t) -allow cupsd_t ptal_var_run_t : sock_file setattr; +allow cupsd_t ptal_var_run_t:sock_file setattr_sock_file_perms; kernel_read_system_state(cupsd_t) kernel_read_network_state(cupsd_t) kernel_read_all_sysctls(cupsd_t) kernel_request_load_module(cupsd_t) -corenet_all_recvfrom_unlabeled(cupsd_t) corenet_all_recvfrom_netlabel(cupsd_t) corenet_tcp_sendrecv_generic_if(cupsd_t) corenet_udp_sendrecv_generic_if(cupsd_t) @@ -211,6 +218,7 @@ mls_rangetrans_target(cupsd_t) mls_socket_write_all_levels(cupsd_t) mls_fd_use_all_levels(cupsd_t) +term_use_usb_ttys(cupsd_t) term_use_unallocated_ttys(cupsd_t) term_search_ptys(cupsd_t) @@ -220,11 +228,12 @@ corecmd_exec_bin(cupsd_t) domain_use_interactive_fds(cupsd_t) +files_getattr_boot_dirs(cupsd_t) files_list_spool(cupsd_t) -files_read_etc_files(cupsd_t) files_read_etc_runtime_files(cupsd_t) # read python modules files_read_usr_files(cupsd_t) +files_exec_usr_files(cupsd_t) # for /var/lib/defoma files_read_var_lib_files(cupsd_t) files_list_world_readable(cupsd_t) @@ -258,7 +267,6 @@ libs_exec_lib_files(cupsd_t) logging_send_audit_msgs(cupsd_t) logging_send_syslog_msg(cupsd_t) -miscfiles_read_localization(cupsd_t) # invoking ghostscript needs to read fonts miscfiles_read_fonts(cupsd_t) miscfiles_setattr_fonts_cache_dirs(cupsd_t) @@ -270,12 +278,6 @@ files_dontaudit_list_home(cupsd_t) userdom_dontaudit_use_unpriv_user_fds(cupsd_t) userdom_dontaudit_search_user_home_content(cupsd_t) -# Write to /var/spool/cups. -lpd_manage_spool(cupsd_t) -lpd_read_config(cupsd_t) -lpd_exec_lpr(cupsd_t) -lpd_relabel_spool(cupsd_t) - optional_policy(` apm_domtrans_client(cupsd_t) ') @@ -287,6 +289,8 @@ optional_policy(` optional_policy(` dbus_system_bus_client(cupsd_t) + init_dbus_chat(cupsd_t) + userdom_dbus_send_all_users(cupsd_t) optional_policy(` @@ -297,8 +301,10 @@ optional_policy(` hal_dbus_chat(cupsd_t) ') + # talk to processes that do not have policy optional_policy(` unconfined_dbus_chat(cupsd_t) + files_write_generic_pid_pipes(cupsd_t) ') ') @@ -311,10 +317,23 @@ optional_policy(` ') optional_policy(` + kerberos_tmp_filetrans_host_rcache(cupsd_t, "host_0") + kerberos_manage_host_rcache(cupsd_t) +') + +optional_policy(` logrotate_domtrans(cupsd_t) ') optional_policy(` + # Write to /var/spool/cups. + lpd_manage_spool(cupsd_t) + lpd_read_config(cupsd_t) + lpd_exec_lpr(cupsd_t) + lpd_relabel_spool(cupsd_t) +') + +optional_policy(` mta_send_mail(cupsd_t) ') @@ -322,6 +341,8 @@ optional_policy(` # cups execs smbtool which reads samba_etc_t files samba_read_config(cupsd_t) samba_rw_var_files(cupsd_t) + # needed by smbspool + samba_stream_connect_nmbd(cupsd_t) ') optional_policy(` @@ -371,8 +392,9 @@ files_tmp_filetrans(cupsd_config_t, cupsd_tmp_t, { lnk_file file dir }) allow cupsd_config_t cupsd_var_run_t:file read_file_perms; +manage_dirs_pattern(cupsd_config_t, cupsd_config_var_run_t, cupsd_config_var_run_t) manage_files_pattern(cupsd_config_t, cupsd_config_var_run_t, cupsd_config_var_run_t) -files_pid_filetrans(cupsd_config_t, cupsd_config_var_run_t, file) +files_pid_filetrans(cupsd_config_t, cupsd_config_var_run_t, { dir file }) domtrans_pattern(cupsd_config_t, hplip_exec_t, hplip_t) @@ -381,7 +403,6 @@ read_files_pattern(cupsd_config_t, hplip_etc_t, hplip_etc_t) kernel_read_system_state(cupsd_config_t) kernel_read_all_sysctls(cupsd_config_t) -corenet_all_recvfrom_unlabeled(cupsd_config_t) corenet_all_recvfrom_netlabel(cupsd_config_t) corenet_tcp_sendrecv_generic_if(cupsd_config_t) corenet_tcp_sendrecv_generic_node(cupsd_config_t) @@ -407,7 +428,6 @@ domain_use_interactive_fds(cupsd_config_t) domain_dontaudit_search_all_domains_state(cupsd_config_t) files_read_usr_files(cupsd_config_t) -files_read_etc_files(cupsd_config_t) files_read_etc_runtime_files(cupsd_config_t) files_read_var_symlinks(cupsd_config_t) @@ -418,18 +438,17 @@ auth_use_nsswitch(cupsd_config_t) logging_send_syslog_msg(cupsd_config_t) -miscfiles_read_localization(cupsd_config_t) miscfiles_read_hwdata(cupsd_config_t) seutil_dontaudit_search_config(cupsd_config_t) userdom_dontaudit_use_unpriv_user_fds(cupsd_config_t) userdom_dontaudit_search_user_home_dirs(cupsd_config_t) +userdom_rw_user_tmp_files(cupsd_config_t) +userdom_read_user_tmp_symlinks(cupsd_config_t) cups_stream_connect(cupsd_config_t) -lpd_read_config(cupsd_config_t) - ifdef(`distro_redhat',` optional_policy(` rpm_read_db(cupsd_config_t) @@ -453,6 +472,10 @@ optional_policy(` ') optional_policy(` + gnome_dontaudit_search_config(cupsd_config_t) +') + +optional_policy(` hal_domtrans(cupsd_config_t) hal_read_tmp_files(cupsd_config_t) hal_dontaudit_use_fds(hplip_t) @@ -467,6 +490,10 @@ optional_policy(` ') optional_policy(` + lpd_read_config(cupsd_config_t) +') + +optional_policy(` policykit_dbus_chat(cupsd_config_t) userdom_read_all_users_state(cupsd_config_t) ') @@ -526,7 +553,6 @@ kernel_read_kernel_sysctls(cupsd_lpd_t) kernel_read_system_state(cupsd_lpd_t) kernel_read_network_state(cupsd_lpd_t) -corenet_all_recvfrom_unlabeled(cupsd_lpd_t) corenet_all_recvfrom_netlabel(cupsd_lpd_t) corenet_tcp_sendrecv_generic_if(cupsd_lpd_t) corenet_udp_sendrecv_generic_if(cupsd_lpd_t) @@ -537,19 +563,18 @@ corenet_udp_sendrecv_all_ports(cupsd_lpd_t) corenet_tcp_bind_generic_node(cupsd_lpd_t) corenet_udp_bind_generic_node(cupsd_lpd_t) corenet_tcp_connect_ipp_port(cupsd_lpd_t) +corenet_tcp_connect_printer_port(cupsd_lpd_t) dev_read_urand(cupsd_lpd_t) dev_read_rand(cupsd_lpd_t) fs_getattr_xattr_fs(cupsd_lpd_t) -files_read_etc_files(cupsd_lpd_t) auth_use_nsswitch(cupsd_lpd_t) logging_send_syslog_msg(cupsd_lpd_t) -miscfiles_read_localization(cupsd_lpd_t) miscfiles_setattr_fonts_cache_dirs(cupsd_lpd_t) cups_stream_connect(cupsd_lpd_t) @@ -577,7 +602,6 @@ fs_rw_anon_inodefs_files(cups_pdf_t) kernel_read_system_state(cups_pdf_t) -files_read_etc_files(cups_pdf_t) files_read_usr_files(cups_pdf_t) corecmd_exec_shell(cups_pdf_t) @@ -585,25 +609,23 @@ corecmd_exec_bin(cups_pdf_t) auth_use_nsswitch(cups_pdf_t) -miscfiles_read_localization(cups_pdf_t) miscfiles_read_fonts(cups_pdf_t) +miscfiles_setattr_fonts_cache_dirs(cups_pdf_t) userdom_home_filetrans_user_home_dir(cups_pdf_t) +userdom_user_home_dir_filetrans_pattern(cups_pdf_t, { file dir }) userdom_manage_user_home_content_dirs(cups_pdf_t) userdom_manage_user_home_content_files(cups_pdf_t) +userdom_dontaudit_search_admin_dir(cups_pdf_t) -lpd_manage_spool(cups_pdf_t) - - -tunable_policy(`use_nfs_home_dirs',` - fs_search_auto_mountpoints(cups_pdf_t) - fs_manage_nfs_dirs(cups_pdf_t) - fs_manage_nfs_files(cups_pdf_t) +optional_policy(` + lpd_manage_spool(cups_pdf_t) ') -tunable_policy(`use_samba_home_dirs',` - fs_manage_cifs_dirs(cups_pdf_t) - fs_manage_cifs_files(cups_pdf_t) +userdom_home_manager(cups_pdf_t) + +optional_policy(` + gnome_read_config(cups_pdf_t) ') ######################################## @@ -647,7 +669,6 @@ files_pid_filetrans(hplip_t, hplip_var_run_t, file) kernel_read_system_state(hplip_t) kernel_read_kernel_sysctls(hplip_t) -corenet_all_recvfrom_unlabeled(hplip_t) corenet_all_recvfrom_netlabel(hplip_t) corenet_tcp_sendrecv_generic_if(hplip_t) corenet_udp_sendrecv_generic_if(hplip_t) @@ -661,10 +682,10 @@ corenet_tcp_bind_generic_node(hplip_t) corenet_udp_bind_generic_node(hplip_t) corenet_tcp_bind_hplip_port(hplip_t) corenet_tcp_connect_hplip_port(hplip_t) -corenet_tcp_connect_ipp_port(hplip_t) -corenet_sendrecv_hplip_client_packets(hplip_t) -corenet_receive_hplip_server_packets(hplip_t) +corenet_tcp_bind_glance_port(hplip_t) +corenet_tcp_connect_glance_port(hplip_t) corenet_udp_bind_howl_port(hplip_t) +corenet_tcp_connect_ipp_port(hplip_t) dev_read_sysfs(hplip_t) dev_rw_printer(hplip_t) @@ -685,19 +706,23 @@ domain_use_interactive_fds(hplip_t) files_read_etc_files(hplip_t) files_read_etc_runtime_files(hplip_t) files_read_usr_files(hplip_t) +files_dontaudit_write_usr_dirs(hplip_t) -logging_send_syslog_msg(hplip_t) +auth_read_passwd(hplip_t) -miscfiles_read_localization(hplip_t) +logging_send_syslog_msg(hplip_t) sysnet_read_config(hplip_t) userdom_dontaudit_use_unpriv_user_fds(hplip_t) userdom_dontaudit_search_user_home_dirs(hplip_t) userdom_dontaudit_search_user_home_content(hplip_t) +userdom_dbus_send_all_users(hplip_t) -lpd_read_config(hplip_t) -lpd_manage_spool(hplip_t) +optional_policy(` + lpd_read_config(hplip_t) + lpd_manage_spool(hplip_t) +') optional_policy(` dbus_system_bus_client(hplip_t) @@ -743,7 +768,6 @@ kernel_read_kernel_sysctls(ptal_t) kernel_list_proc(ptal_t) kernel_read_proc_symlinks(ptal_t) -corenet_all_recvfrom_unlabeled(ptal_t) corenet_all_recvfrom_netlabel(ptal_t) corenet_tcp_sendrecv_generic_if(ptal_t) corenet_tcp_sendrecv_generic_node(ptal_t) @@ -760,13 +784,10 @@ fs_search_auto_mountpoints(ptal_t) domain_use_interactive_fds(ptal_t) -files_read_etc_files(ptal_t) files_read_etc_runtime_files(ptal_t) logging_send_syslog_msg(ptal_t) -miscfiles_read_localization(ptal_t) - sysnet_read_config(ptal_t) userdom_dontaudit_use_unpriv_user_fds(ptal_t) diff --git a/cvs.if b/cvs.if index c43ff4c..5da88b5 100644 --- a/cvs.if +++ b/cvs.if @@ -1,5 +1,23 @@ ## Concurrent versions system +###################################### +## +## Dontaudit Attempts to list the CVS data and metadata. +## +## +## +## Domain to not audit. +## +## +# +interface(`cvs_dontaudit_list_data',` + gen_require(` + type cvs_data_t; + ') + + dontaudit $1 cvs_data_t:dir list_dir_perms; +') + ######################################## ## ## Read the CVS data and metadata. @@ -58,14 +76,17 @@ interface(`cvs_exec',` # interface(`cvs_admin',` gen_require(` - type cvs_t, cvs_tmp_t; + type cvs_t, cvs_tmp_t, cvs_initrc_exec_t; type cvs_data_t, cvs_var_run_t; - type cvs_initrc_exec_t; ') - allow $1 cvs_t:process { ptrace signal_perms }; + allow $1 cvs_t:process signal_perms; ps_process_pattern($1, cvs_t) + tunable_policy(`deny_ptrace',`',` + allow $1 cvs_t:process ptrace; + ') + # Allow cvs_t to restart the apache service init_labeled_script_domtrans($1, cvs_initrc_exec_t) domain_system_change_exemption($1) diff --git a/cvs.te b/cvs.te index 88e7e97..b475317 100644 --- a/cvs.te +++ b/cvs.te @@ -10,7 +10,7 @@ policy_module(cvs, 1.9.0) ## Allow cvs daemon to read shadow ##

## -gen_tunable(allow_cvs_read_shadow, false) +gen_tunable(cvs_read_shadow, false) type cvs_t; type cvs_exec_t; @@ -35,12 +35,12 @@ files_pid_file(cvs_var_run_t) # Local policy # +allow cvs_t self:capability { setuid setgid }; allow cvs_t self:process signal_perms; allow cvs_t self:fifo_file rw_fifo_file_perms; allow cvs_t self:tcp_socket connected_stream_socket_perms; # for identd; cjp: this should probably only be inetd_child rules? allow cvs_t self:netlink_tcpdiag_socket r_netlink_socket_perms; -allow cvs_t self:capability { setuid setgid }; manage_dirs_pattern(cvs_t, cvs_data_t, cvs_data_t) manage_files_pattern(cvs_t, cvs_data_t, cvs_data_t) @@ -57,7 +57,6 @@ kernel_read_kernel_sysctls(cvs_t) kernel_read_system_state(cvs_t) kernel_read_network_state(cvs_t) -corenet_all_recvfrom_unlabeled(cvs_t) corenet_all_recvfrom_netlabel(cvs_t) corenet_tcp_sendrecv_generic_if(cvs_t) corenet_udp_sendrecv_generic_if(cvs_t) @@ -76,21 +75,22 @@ auth_use_nsswitch(cvs_t) corecmd_exec_bin(cvs_t) corecmd_exec_shell(cvs_t) -files_read_etc_files(cvs_t) files_read_etc_runtime_files(cvs_t) # for identd; cjp: this should probably only be inetd_child rules? files_search_home(cvs_t) +init_dontaudit_read_utmp(cvs_t) + logging_send_syslog_msg(cvs_t) logging_send_audit_msgs(cvs_t) -miscfiles_read_localization(cvs_t) - mta_send_mail(cvs_t) +userdom_dontaudit_search_user_home_dirs(cvs_t) + # cjp: typeattribute doesnt work in conditionals yet auth_can_read_shadow_passwords(cvs_t) -tunable_policy(`allow_cvs_read_shadow',` +tunable_policy(`cvs_read_shadow',` allow cvs_t self:capability dac_override; auth_tunable_read_shadow(cvs_t) ') @@ -112,4 +112,5 @@ optional_policy(` read_files_pattern(httpd_cvs_script_t, cvs_data_t, cvs_data_t) manage_dirs_pattern(httpd_cvs_script_t, cvs_tmp_t, cvs_tmp_t) manage_files_pattern(httpd_cvs_script_t, cvs_tmp_t, cvs_tmp_t) + files_tmp_filetrans(httpd_cvs_script_t, cvs_tmp_t, { file dir }) ') diff --git a/cyphesis.te b/cyphesis.te index 25897c9..814bdae 100644 --- a/cyphesis.te +++ b/cyphesis.te @@ -48,7 +48,6 @@ kernel_read_kernel_sysctls(cyphesis_t) corecmd_search_bin(cyphesis_t) corecmd_getattr_bin_files(cyphesis_t) -corenet_all_recvfrom_unlabeled(cyphesis_t) corenet_tcp_sendrecv_generic_if(cyphesis_t) corenet_tcp_sendrecv_generic_node(cyphesis_t) corenet_tcp_sendrecv_all_ports(cyphesis_t) @@ -66,8 +65,6 @@ files_read_usr_files(cyphesis_t) logging_send_syslog_msg(cyphesis_t) -miscfiles_read_localization(cyphesis_t) - sysnet_dns_name_resolve(cyphesis_t) # cyphesis wants to talk to avahi via dbus diff --git a/cyrus.if b/cyrus.if index e4e86d0..4203ea9 100644 --- a/cyrus.if +++ b/cyrus.if @@ -20,6 +20,25 @@ interface(`cyrus_manage_data',` manage_files_pattern($1, cyrus_var_lib_t, cyrus_var_lib_t) ') +####################################### +## +## Allow write cyrus data files. +## +## +## +## Domain allowed access. +## +## +# +interface(`cyrus_write_data',` + gen_require(` + type cyrus_var_lib_t; + ') + + files_search_var_lib($1) + write_files_pattern($1, cyrus_var_lib_t, cyrus_var_lib_t) +') + ######################################## ## ## Connect to Cyrus using a unix domain stream socket. @@ -62,9 +81,13 @@ interface(`cyrus_admin',` type cyrus_var_run_t, cyrus_initrc_exec_t; ') - allow $1 cyrus_t:process { ptrace signal_perms }; + allow $1 cyrus_t:process signal_perms; ps_process_pattern($1, cyrus_t) + tunable_policy(`deny_ptrace',`',` + allow $1 cyrus_t:process ptrace; + ') + init_labeled_script_domtrans($1, cyrus_initrc_exec_t) domain_system_change_exemption($1) role_transition $2 cyrus_initrc_exec_t system_r; diff --git a/cyrus.te b/cyrus.te index 097fdcc..fb6e6da 100644 --- a/cyrus.te +++ b/cyrus.te @@ -26,7 +26,7 @@ files_pid_file(cyrus_var_run_t) # Local policy # -allow cyrus_t self:capability { dac_override net_bind_service setgid setuid sys_resource }; +allow cyrus_t self:capability { fsetid dac_override net_bind_service setgid setuid sys_resource }; dontaudit cyrus_t self:capability sys_tty_config; allow cyrus_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; allow cyrus_t self:process setrlimit; @@ -62,7 +62,6 @@ kernel_read_kernel_sysctls(cyrus_t) kernel_read_system_state(cyrus_t) kernel_read_all_sysctls(cyrus_t) -corenet_all_recvfrom_unlabeled(cyrus_t) corenet_all_recvfrom_netlabel(cyrus_t) corenet_tcp_sendrecv_generic_if(cyrus_t) corenet_udp_sendrecv_generic_if(cyrus_t) @@ -73,6 +72,7 @@ corenet_udp_sendrecv_all_ports(cyrus_t) corenet_tcp_bind_generic_node(cyrus_t) corenet_tcp_bind_mail_port(cyrus_t) corenet_tcp_bind_lmtp_port(cyrus_t) +corenet_tcp_bind_innd_port(cyrus_t) corenet_tcp_bind_pop_port(cyrus_t) corenet_tcp_bind_sieve_port(cyrus_t) corenet_tcp_connect_all_ports(cyrus_t) @@ -93,7 +93,6 @@ corecmd_exec_bin(cyrus_t) domain_use_interactive_fds(cyrus_t) files_list_var_lib(cyrus_t) -files_read_etc_files(cyrus_t) files_read_etc_runtime_files(cyrus_t) files_read_usr_files(cyrus_t) @@ -103,7 +102,6 @@ libs_exec_lib_files(cyrus_t) logging_send_syslog_msg(cyrus_t) -miscfiles_read_localization(cyrus_t) miscfiles_read_generic_certs(cyrus_t) sysnet_read_config(cyrus_t) @@ -119,6 +117,10 @@ optional_policy(` ') optional_policy(` + dirsrv_stream_connect(cyrus_t) +') + +optional_policy(` kerberos_keytab_template(cyrus, cyrus_t) ') @@ -135,6 +137,7 @@ optional_policy(` ') optional_policy(` + files_dontaudit_write_usr_dirs(cyrus_t) snmp_read_snmp_var_lib_files(cyrus_t) snmp_dontaudit_write_snmp_var_lib_files(cyrus_t) snmp_stream_connect(cyrus_t) diff --git a/daemontools.if b/daemontools.if index ce3e676..0158314 100644 --- a/daemontools.if +++ b/daemontools.if @@ -210,3 +210,4 @@ interface(`daemontools_manage_svc',` allow $1 svc_svc_t:file manage_file_perms; allow $1 svc_svc_t:lnk_file { read create }; ') + diff --git a/daemontools.te b/daemontools.te index dcc5f1c..c6fa5c0 100644 --- a/daemontools.te +++ b/daemontools.te @@ -38,7 +38,10 @@ files_type(svc_svc_t) # multilog creates /service/*/log/status manage_files_pattern(svc_multilog_t, svc_svc_t, svc_svc_t) +term_write_console(svc_multilog_t) + init_use_fds(svc_multilog_t) +init_dontaudit_use_script_fds(svc_multilog_t) # writes to /var/log/*/* logging_manage_generic_logs(svc_multilog_t) @@ -69,6 +72,8 @@ dev_read_urand(svc_run_t) corecmd_exec_bin(svc_run_t) corecmd_exec_shell(svc_run_t) +term_write_console(svc_run_t) + files_read_etc_files(svc_run_t) files_read_etc_runtime_files(svc_run_t) files_search_pids(svc_run_t) @@ -99,12 +104,19 @@ allow svc_start_t self:unix_stream_socket create_socket_perms; can_exec(svc_start_t, svc_start_exec_t) +mmap_files_pattern(svc_start_t, svc_svc_t, svc_svc_t) + kernel_read_kernel_sysctls(svc_start_t) kernel_read_system_state(svc_start_t) corecmd_exec_bin(svc_start_t) corecmd_exec_shell(svc_start_t) +corenet_tcp_bind_generic_node(svc_start_t) +corenet_tcp_bind_generic_port(svc_start_t) + +term_write_console(svc_start_t) + files_read_etc_files(svc_start_t) files_read_etc_runtime_files(svc_start_t) files_search_var(svc_start_t) @@ -114,5 +126,3 @@ daemontools_domtrans_run(svc_start_t) daemontools_manage_svc(svc_start_t) logging_send_syslog_msg(svc_start_t) - -miscfiles_read_localization(svc_start_t) diff --git a/dante.te b/dante.te index 9636326..637fc71 100644 --- a/dante.te +++ b/dante.te @@ -10,7 +10,7 @@ type dante_exec_t; init_daemon_domain(dante_t, dante_exec_t) type dante_conf_t; -files_type(dante_conf_t) +files_config_file(dante_conf_t) type dante_var_run_t; files_pid_file(dante_var_run_t) @@ -37,7 +37,6 @@ kernel_read_kernel_sysctls(dante_t) kernel_list_proc(dante_t) kernel_read_proc_symlinks(dante_t) -corenet_all_recvfrom_unlabeled(dante_t) corenet_all_recvfrom_netlabel(dante_t) corenet_tcp_sendrecv_generic_if(dante_t) corenet_udp_sendrecv_generic_if(dante_t) @@ -46,7 +45,6 @@ corenet_udp_sendrecv_generic_node(dante_t) corenet_tcp_sendrecv_all_ports(dante_t) corenet_udp_sendrecv_all_ports(dante_t) corenet_tcp_bind_generic_node(dante_t) -corenet_tcp_bind_socks_port(dante_t) dev_read_sysfs(dante_t) @@ -62,8 +60,6 @@ init_write_utmp(dante_t) logging_send_syslog_msg(dante_t) -miscfiles_read_localization(dante_t) - sysnet_read_config(dante_t) userdom_dontaudit_use_unpriv_user_fds(dante_t) diff --git a/dbadm.te b/dbadm.te index 1875064..2adc35f 100644 --- a/dbadm.te +++ b/dbadm.te @@ -28,7 +28,7 @@ userdom_base_user_template(dbadm) # database admin local policy # -allow dbadm_t self:capability { dac_override dac_read_search sys_ptrace }; +allow dbadm_t self:capability { dac_override dac_read_search }; files_dontaudit_search_all_dirs(dbadm_t) files_delete_generic_locks(dbadm_t) @@ -37,6 +37,7 @@ files_list_var(dbadm_t) selinux_get_enforce_mode(dbadm_t) logging_send_syslog_msg(dbadm_t) +logging_send_audit_msgs(dbadm_t) userdom_dontaudit_search_user_home_dirs(dbadm_t) @@ -58,3 +59,7 @@ optional_policy(` optional_policy(` postgresql_admin(dbadm_t, dbadm_r) ') + +optional_policy(` + sudo_role_template(dbadm, dbadm_r, dbadm_t) +') diff --git a/dbskk.te b/dbskk.te index 1445f97..8ca064c 100644 --- a/dbskk.te +++ b/dbskk.te @@ -47,7 +47,6 @@ kernel_read_kernel_sysctls(dbskkd_t) kernel_read_system_state(dbskkd_t) kernel_read_network_state(dbskkd_t) -corenet_all_recvfrom_unlabeled(dbskkd_t) corenet_all_recvfrom_netlabel(dbskkd_t) corenet_tcp_sendrecv_generic_if(dbskkd_t) corenet_udp_sendrecv_generic_if(dbskkd_t) @@ -60,10 +59,7 @@ dev_read_urand(dbskkd_t) fs_getattr_xattr_fs(dbskkd_t) -files_read_etc_files(dbskkd_t) auth_use_nsswitch(dbskkd_t) logging_send_syslog_msg(dbskkd_t) - -miscfiles_read_localization(dbskkd_t) diff --git a/dbus.fc b/dbus.fc index e6345ce..31f269b 100644 --- a/dbus.fc +++ b/dbus.fc @@ -4,6 +4,7 @@ ifdef(`distro_redhat',` /lib/dbus-1/dbus-daemon-launch-helper -- gen_context(system_u:object_r:dbusd_exec_t,s0) +/usr/lib/dbus-1/dbus-daemon-launch-helper -- gen_context(system_u:object_r:dbusd_exec_t,s0) ') /usr/bin/dbus-daemon(-1)? -- gen_context(system_u:object_r:dbusd_exec_t,s0) diff --git a/dbus.if b/dbus.if index fb4bf82..5ccacb1 100644 --- a/dbus.if +++ b/dbus.if @@ -41,9 +41,9 @@ interface(`dbus_stub',` template(`dbus_role_template',` gen_require(` class dbus { send_msg acquire_svc }; - - attribute session_bus_type; + attribute dbusd_unconfined, session_bus_type; type system_dbusd_t, session_dbusd_tmp_t, dbusd_exec_t, dbusd_etc_t; + type $1_t; ') ############################## @@ -52,117 +52,43 @@ template(`dbus_role_template',` # type $1_dbusd_t, session_bus_type; - domain_type($1_dbusd_t) - domain_entry_file($1_dbusd_t, dbusd_exec_t) + application_domain($1_dbusd_t, dbusd_exec_t) ubac_constrained($1_dbusd_t) role $2 types $1_dbusd_t; + userdom_home_manager($1_dbusd_t) + ############################## # # Local policy # - allow $1_dbusd_t self:process { getattr sigkill signal }; - dontaudit $1_dbusd_t self:process ptrace; - allow $1_dbusd_t self:file { getattr read write }; - allow $1_dbusd_t self:fifo_file rw_fifo_file_perms; - allow $1_dbusd_t self:dbus { send_msg acquire_svc }; - allow $1_dbusd_t self:unix_stream_socket create_stream_socket_perms; - allow $1_dbusd_t self:unix_dgram_socket create_socket_perms; - allow $1_dbusd_t self:tcp_socket create_stream_socket_perms; - allow $1_dbusd_t self:netlink_selinux_socket create_socket_perms; - # For connecting to the bus allow $3 $1_dbusd_t:unix_stream_socket connectto; # SE-DBus specific permissions - allow $3 $1_dbusd_t:dbus { send_msg acquire_svc }; + allow { dbusd_unconfined $3 } $1_dbusd_t:dbus { send_msg acquire_svc }; allow $3 system_dbusd_t:dbus { send_msg acquire_svc }; - allow $1_dbusd_t dbusd_etc_t:dir list_dir_perms; - read_files_pattern($1_dbusd_t, dbusd_etc_t, dbusd_etc_t) - read_lnk_files_pattern($1_dbusd_t, dbusd_etc_t, dbusd_etc_t) + domtrans_pattern($3, dbusd_exec_t, $1_dbusd_t) - manage_dirs_pattern($1_dbusd_t, session_dbusd_tmp_t, session_dbusd_tmp_t) - manage_files_pattern($1_dbusd_t, session_dbusd_tmp_t, session_dbusd_tmp_t) - files_tmp_filetrans($1_dbusd_t, session_dbusd_tmp_t, { file dir }) + ps_process_pattern($3, $1_dbusd_t) + allow $3 $1_dbusd_t:process signal_perms; - domtrans_pattern($3, dbusd_exec_t, $1_dbusd_t) - allow $3 $1_dbusd_t:process { signull sigkill signal }; + tunable_policy(`deny_ptrace',`',` + allow $3 $1_dbusd_t:process ptrace; + ') # cjp: this seems very broken - corecmd_bin_domtrans($1_dbusd_t, $3) + corecmd_bin_domtrans($1_dbusd_t, $1_t) + corecmd_shell_domtrans($1_dbusd_t, $1_t) allow $1_dbusd_t $3:process sigkill; allow $3 $1_dbusd_t:fd use; allow $3 $1_dbusd_t:fifo_file rw_fifo_file_perms; - allow $3 $1_dbusd_t:process sigchld; - - kernel_read_system_state($1_dbusd_t) - kernel_read_kernel_sysctls($1_dbusd_t) - - corecmd_list_bin($1_dbusd_t) - corecmd_read_bin_symlinks($1_dbusd_t) - corecmd_read_bin_files($1_dbusd_t) - corecmd_read_bin_pipes($1_dbusd_t) - corecmd_read_bin_sockets($1_dbusd_t) - - corenet_all_recvfrom_unlabeled($1_dbusd_t) - corenet_all_recvfrom_netlabel($1_dbusd_t) - corenet_tcp_sendrecv_generic_if($1_dbusd_t) - corenet_tcp_sendrecv_generic_node($1_dbusd_t) - corenet_tcp_sendrecv_all_ports($1_dbusd_t) - corenet_tcp_bind_generic_node($1_dbusd_t) - corenet_tcp_bind_reserved_port($1_dbusd_t) - - dev_read_urand($1_dbusd_t) - - domain_use_interactive_fds($1_dbusd_t) - domain_read_all_domains_state($1_dbusd_t) - - files_read_etc_files($1_dbusd_t) - files_list_home($1_dbusd_t) - files_read_usr_files($1_dbusd_t) - files_dontaudit_search_var($1_dbusd_t) - - fs_getattr_romfs($1_dbusd_t) - fs_getattr_xattr_fs($1_dbusd_t) - fs_list_inotifyfs($1_dbusd_t) - fs_dontaudit_list_nfs($1_dbusd_t) - - selinux_get_fs_mount($1_dbusd_t) - selinux_validate_context($1_dbusd_t) - selinux_compute_access_vector($1_dbusd_t) - selinux_compute_create_context($1_dbusd_t) - selinux_compute_relabel_context($1_dbusd_t) - selinux_compute_user_contexts($1_dbusd_t) - - auth_read_pam_console_data($1_dbusd_t) + auth_use_nsswitch($1_dbusd_t) - logging_send_audit_msgs($1_dbusd_t) logging_send_syslog_msg($1_dbusd_t) - - miscfiles_read_localization($1_dbusd_t) - - seutil_read_config($1_dbusd_t) - seutil_read_default_contexts($1_dbusd_t) - - term_use_all_terms($1_dbusd_t) - - userdom_read_user_home_content_files($1_dbusd_t) - - ifdef(`hide_broken_symptoms', ` - dontaudit $3 $1_dbusd_t:netlink_selinux_socket { read write }; - ') - - optional_policy(` - hal_dbus_chat($1_dbusd_t) - ') - - optional_policy(` - xserver_use_xdm_fds($1_dbusd_t) - xserver_rw_xdm_pipes($1_dbusd_t) - ') ') ####################################### @@ -181,11 +107,12 @@ interface(`dbus_system_bus_client',` type system_dbusd_t, system_dbusd_t; type system_dbusd_var_run_t, system_dbusd_var_lib_t; class dbus send_msg; + attribute dbusd_unconfined; ') # SE-DBus specific permissions allow $1 { system_dbusd_t self }:dbus send_msg; - allow system_dbusd_t $1:dbus send_msg; + allow { system_dbusd_t dbusd_unconfined } $1:dbus send_msg; read_files_pattern($1, system_dbusd_var_lib_t, system_dbusd_var_lib_t) files_search_var_lib($1) @@ -198,6 +125,34 @@ interface(`dbus_system_bus_client',` ####################################### ## +## Creating connections to specified +## DBUS sessions. +## +## +## +## The prefix of the user role (e.g., user +## is the prefix for user_r). +## +## +## +## +## Domain allowed access. +## +## +# +interface(`dbus_session_client',` + gen_require(` + class dbus send_msg; + type $1_dbusd_t; + ') + + allow $2 $1_dbusd_t:fd use; + allow $2 { $1_dbusd_t self }:dbus send_msg; + allow $2 $1_dbusd_t:unix_stream_socket connectto; +') + +####################################### +## ## Template for creating connections to ## a user DBUS. ## @@ -219,7 +174,7 @@ interface(`dbus_session_bus_client',` # For connecting to the bus allow $1 session_bus_type:unix_stream_socket connectto; - dontaudit $1 session_bus_type:fd use; + allow session_bus_type $1:process sigkill; ') ######################################## @@ -324,6 +279,11 @@ interface(`dbus_connect_session_bus',` ## Allow a application domain to be started ## by the session dbus. ## +## +## +## User domain prefix to be used. +## +## ## ## ## Type to be used as a domain. @@ -338,13 +298,13 @@ interface(`dbus_connect_session_bus',` # interface(`dbus_session_domain',` gen_require(` - attribute session_bus_type; + type $1_dbusd_t; ') - domtrans_pattern(session_bus_type, $2, $1) + domtrans_pattern($1_dbusd_t, $2, $3) - dbus_session_bus_client($1) - dbus_connect_session_bus($1) + dbus_session_bus_client($3) + dbus_connect_session_bus($3) ') ######################################## @@ -423,27 +383,16 @@ interface(`dbus_system_bus_unconfined',` # interface(`dbus_system_domain',` gen_require(` + attribute system_bus_type; type system_dbusd_t; role system_r; ') + typeattribute $1 system_bus_type; domain_type($1) domain_entry_file($1, $2) - role system_r types $1; - domtrans_pattern(system_dbusd_t, $2, $1) - - dbus_system_bus_client($1) - dbus_connect_system_bus($1) - - ps_process_pattern(system_dbusd_t, $1) - - userdom_read_all_users_state($1) - - ifdef(`hide_broken_symptoms', ` - dontaudit $1 system_dbusd_t:netlink_selinux_socket { read write }; - ') ') ######################################## @@ -466,26 +415,25 @@ interface(`dbus_use_system_bus_fds',` ######################################## ## -## Dontaudit Read, and write system dbus TCP sockets. +## Allow unconfined access to the system DBUS. ## ## ## -## Domain to not audit. +## Domain allowed access. ## ## # -interface(`dbus_dontaudit_system_bus_rw_tcp_sockets',` +interface(`dbus_unconfined',` gen_require(` - type system_dbusd_t; + attribute dbusd_unconfined; ') - allow $1 system_dbusd_t:tcp_socket { read write }; - allow $1 system_dbusd_t:fd use; + typeattribute $1 dbusd_unconfined; ') ######################################## ## -## Allow unconfined access to the system DBUS. +## Delete all dbus pid files ## ## ## @@ -493,10 +441,51 @@ interface(`dbus_dontaudit_system_bus_rw_tcp_sockets',` ## ## # -interface(`dbus_unconfined',` +interface(`dbus_delete_pid_files',` gen_require(` - attribute dbusd_unconfined; + type system_dbusd_var_run_t; ') - typeattribute $1 dbusd_unconfined; + files_search_pids($1) + delete_files_pattern($1, system_dbusd_var_run_t, system_dbusd_var_run_t) +') + +######################################## +## +## Do not audit attempts to connect to +## session bus types with a unix +## stream socket. +## +## +## +## Domain to not audit. +## +## +# +interface(`dbus_dontaudit_stream_connect_session_bus',` + gen_require(` + attribute session_bus_type; + ') + + dontaudit $1 session_bus_type:unix_stream_socket connectto; +') + +######################################## +## +## Do not audit attempts to send dbus +## messages to session bus types. +## +## +## +## Domain to not audit. +## +## +# +interface(`dbus_dontaudit_chat_session_bus',` + gen_require(` + attribute session_bus_type; + class dbus send_msg; + ') + + dontaudit $1 session_bus_type:dbus send_msg; ') diff --git a/dbus.te b/dbus.te index 625cb32..a06cfa2 100644 --- a/dbus.te +++ b/dbus.te @@ -10,6 +10,7 @@ gen_require(` # attribute dbusd_unconfined; +attribute system_bus_type; attribute session_bus_type; type dbusd_etc_t; @@ -35,6 +36,7 @@ files_type(system_dbusd_var_lib_t) type system_dbusd_var_run_t; files_pid_file(system_dbusd_var_run_t) +init_sock_file(system_dbusd_var_run_t) ifdef(`enable_mcs',` init_ranged_system_domain(system_dbusd_t, dbusd_exec_t, s0 - mcs_systemhigh) @@ -51,9 +53,9 @@ ifdef(`enable_mls',` # dac_override: /var/run/dbus is owned by messagebus on Debian # cjp: dac_override should probably go in a distro_debian -allow system_dbusd_t self:capability { dac_override setgid setpcap setuid }; +allow system_dbusd_t self:capability { sys_resource dac_override setgid setpcap setuid }; dontaudit system_dbusd_t self:capability sys_tty_config; -allow system_dbusd_t self:process { getattr getsched signal_perms setpgid getcap setcap }; +allow system_dbusd_t self:process { getattr getsched signal_perms setpgid getcap setcap setrlimit }; allow system_dbusd_t self:fifo_file rw_fifo_file_perms; allow system_dbusd_t self:dbus { send_msg acquire_svc }; allow system_dbusd_t self:unix_stream_socket { connectto create_stream_socket_perms connectto }; @@ -73,9 +75,10 @@ files_tmp_filetrans(system_dbusd_t, system_dbusd_tmp_t, { file dir }) read_files_pattern(system_dbusd_t, system_dbusd_var_lib_t, system_dbusd_var_lib_t) +manage_dirs_pattern(system_dbusd_t, system_dbusd_var_run_t, system_dbusd_var_run_t) manage_files_pattern(system_dbusd_t, system_dbusd_var_run_t, system_dbusd_var_run_t) manage_sock_files_pattern(system_dbusd_t, system_dbusd_var_run_t, system_dbusd_var_run_t) -files_pid_filetrans(system_dbusd_t, system_dbusd_var_run_t, file) +files_pid_filetrans(system_dbusd_t, system_dbusd_var_run_t, { file dir }) kernel_read_system_state(system_dbusd_t) kernel_read_kernel_sysctls(system_dbusd_t) @@ -83,6 +86,8 @@ kernel_read_kernel_sysctls(system_dbusd_t) dev_read_urand(system_dbusd_t) dev_read_sysfs(system_dbusd_t) +files_rw_inherited_non_security_files(system_dbusd_t) + fs_getattr_all_fs(system_dbusd_t) fs_list_inotifyfs(system_dbusd_t) fs_search_auto_mountpoints(system_dbusd_t) @@ -110,22 +115,24 @@ auth_read_pam_console_data(system_dbusd_t) corecmd_list_bin(system_dbusd_t) corecmd_read_bin_pipes(system_dbusd_t) corecmd_read_bin_sockets(system_dbusd_t) +# needed for system-tools-backends +corecmd_exec_shell(system_dbusd_t) domain_use_interactive_fds(system_dbusd_t) domain_read_all_domains_state(system_dbusd_t) -files_read_etc_files(system_dbusd_t) files_list_home(system_dbusd_t) files_read_usr_files(system_dbusd_t) init_use_fds(system_dbusd_t) init_use_script_ptys(system_dbusd_t) +init_bin_domtrans_spec(system_dbusd_t) init_domtrans_script(system_dbusd_t) +init_rw_stream_sockets(system_dbusd_t) logging_send_audit_msgs(system_dbusd_t) logging_send_syslog_msg(system_dbusd_t) -miscfiles_read_localization(system_dbusd_t) miscfiles_read_generic_certs(system_dbusd_t) seutil_read_config(system_dbusd_t) @@ -135,11 +142,31 @@ seutil_sigchld_newrole(system_dbusd_t) userdom_dontaudit_use_unpriv_user_fds(system_dbusd_t) userdom_dontaudit_search_user_home_dirs(system_dbusd_t) +userdom_home_reader(system_dbusd_t) + optional_policy(` bind_domtrans(system_dbusd_t) ') optional_policy(` + bluetooth_stream_connect(system_dbusd_t) +') + +optional_policy(` + gnome_exec_gconf(system_dbusd_t) + gnome_read_inherited_home_icc_data_files(system_dbusd_t) +') + +optional_policy(` + cpufreqselector_dbus_chat(system_dbusd_t) +') + +optional_policy(` + networkmanager_initrc_domtrans(system_dbusd_t) + networkmanager_systemctl(system_dbusd_t) +') + +optional_policy(` policykit_dbus_chat(system_dbusd_t) policykit_domtrans_auth(system_dbusd_t) policykit_search_lib(system_dbusd_t) @@ -150,12 +177,157 @@ optional_policy(` ') optional_policy(` + systemd_use_fds_logind(system_dbusd_t) + systemd_write_inherited_logind_sessions_pipes(system_dbusd_t) + systemd_write_inhibit_pipes(system_dbusd_t) +') + +optional_policy(` udev_read_db(system_dbusd_t) ') +optional_policy(` + # /var/lib/gdm/.local/share/icc/edid-0a027915105823af34f99b1704e80336.icc + xserver_read_inherited_xdm_lib_files(system_dbusd_t) +') + +######################################## +# +# system_bus_type rules +# +role system_r types system_bus_type; + +fs_search_all(system_bus_type) + +dbus_system_bus_client(system_bus_type) +dbus_connect_system_bus(system_bus_type) + +init_stream_connect(system_bus_type) +init_dgram_send(system_bus_type) +init_use_fds(system_bus_type) +init_rw_stream_sockets(system_bus_type) + +ps_process_pattern(system_dbusd_t, system_bus_type) + +userdom_dontaudit_search_admin_dir(system_bus_type) +userdom_read_all_users_state(system_bus_type) + +optional_policy(` + abrt_stream_connect(system_bus_type) +') + +optional_policy(` + rpm_script_dbus_chat(system_bus_type) +') + +optional_policy(` + unconfined_dbus_send(system_bus_type) +') + +ifdef(`hide_broken_symptoms',` + dontaudit system_bus_type system_dbusd_t:netlink_selinux_socket { read write }; +') + +######################################## +# +# session_bus_type rules +# +allow session_bus_type self:capability2 block_suspend; +dontaudit session_bus_type self:capability sys_resource; +allow session_bus_type self:process { getattr sigkill signal }; +dontaudit session_bus_type self:process setrlimit; +allow session_bus_type self:file { getattr read write }; +allow session_bus_type self:fifo_file rw_fifo_file_perms; +allow session_bus_type self:dbus { send_msg acquire_svc }; +allow session_bus_type self:unix_stream_socket create_stream_socket_perms; +allow session_bus_type self:unix_dgram_socket create_socket_perms; +allow session_bus_type self:tcp_socket create_stream_socket_perms; +allow session_bus_type self:netlink_selinux_socket create_socket_perms; + +allow session_bus_type dbusd_etc_t:dir list_dir_perms; +read_files_pattern(session_bus_type, dbusd_etc_t, dbusd_etc_t) +read_lnk_files_pattern(session_bus_type, dbusd_etc_t, dbusd_etc_t) + +manage_dirs_pattern(session_bus_type, session_dbusd_tmp_t, session_dbusd_tmp_t) +manage_files_pattern(session_bus_type, session_dbusd_tmp_t, session_dbusd_tmp_t) +files_tmp_filetrans(session_bus_type, session_dbusd_tmp_t, { file dir }) + +kernel_read_system_state(session_bus_type) +kernel_read_kernel_sysctls(session_bus_type) + +corecmd_list_bin(session_bus_type) +corecmd_read_bin_symlinks(session_bus_type) +corecmd_read_bin_files(session_bus_type) +corecmd_read_bin_pipes(session_bus_type) +corecmd_read_bin_sockets(session_bus_type) + +corenet_tcp_sendrecv_generic_if(session_bus_type) +corenet_tcp_sendrecv_generic_node(session_bus_type) +corenet_tcp_sendrecv_all_ports(session_bus_type) +corenet_tcp_bind_generic_node(session_bus_type) +corenet_tcp_bind_reserved_port(session_bus_type) + +dev_read_urand(session_bus_type) + +domain_use_interactive_fds(session_bus_type) +domain_read_all_domains_state(session_bus_type) + +files_list_home(session_bus_type) +files_read_usr_files(session_bus_type) +files_dontaudit_search_var(session_bus_type) + +fs_getattr_romfs(session_bus_type) +fs_getattr_xattr_fs(session_bus_type) +fs_list_inotifyfs(session_bus_type) +fs_dontaudit_list_nfs(session_bus_type) + +selinux_get_fs_mount(session_bus_type) +selinux_validate_context(session_bus_type) +selinux_compute_access_vector(session_bus_type) +selinux_compute_create_context(session_bus_type) +selinux_compute_relabel_context(session_bus_type) +selinux_compute_user_contexts(session_bus_type) + +auth_read_pam_console_data(session_bus_type) + +logging_send_audit_msgs(session_bus_type) + +seutil_read_config(session_bus_type) +seutil_read_default_contexts(session_bus_type) + +term_use_all_inherited_terms(session_bus_type) + +userdom_dontaudit_search_admin_dir(session_bus_type) +userdom_manage_user_home_content_dirs(session_bus_type) +userdom_manage_user_home_content_files(session_bus_type) +userdom_user_home_dir_filetrans_user_home_content(session_bus_type, { dir file }) + +optional_policy(` + gnome_read_gconf_home_files(session_bus_type) +') + +optional_policy(` + hal_dbus_chat(session_bus_type) +') + +optional_policy(` + thumb_domtrans(session_bus_type) +') + +optional_policy(` + xserver_search_xdm_lib(session_bus_type) + xserver_use_xdm_fds(session_bus_type) + xserver_rw_xdm_pipes(session_bus_type) + xserver_use_xdm_fds(session_bus_type) + xserver_rw_xdm_pipes(session_bus_type) + xserver_append_xdm_home_files(session_bus_type) +') + ######################################## # # Unconfined access to this module # allow dbusd_unconfined session_bus_type:dbus all_dbus_perms; +allow dbusd_unconfined dbusd_unconfined:dbus all_dbus_perms; +allow session_bus_type dbusd_unconfined:dbus send_msg; diff --git a/dcc.if b/dcc.if index 784753e..bf65e7d 100644 --- a/dcc.if +++ b/dcc.if @@ -168,6 +168,6 @@ interface(`dcc_stream_connect_dccifd',` type dcc_var_t, dccifd_var_run_t, dccifd_t; ') - files_search_var($1) + files_search_pids($1) stream_connect_pattern($1, dcc_var_t, dccifd_var_run_t, dccifd_t) ') diff --git a/dcc.te b/dcc.te index 5178337..46bbbed 100644 --- a/dcc.te +++ b/dcc.te @@ -36,7 +36,7 @@ type dcc_var_t; files_type(dcc_var_t) type dcc_var_run_t; -files_type(dcc_var_run_t) +files_pid_file(dcc_var_run_t) type dccd_t; type dccd_exec_t; @@ -95,22 +95,18 @@ allow cdcc_t dcc_var_t:dir list_dir_perms; read_files_pattern(cdcc_t, dcc_var_t, dcc_var_t) read_lnk_files_pattern(cdcc_t, dcc_var_t, dcc_var_t) -corenet_all_recvfrom_unlabeled(cdcc_t) corenet_all_recvfrom_netlabel(cdcc_t) corenet_udp_sendrecv_generic_if(cdcc_t) corenet_udp_sendrecv_generic_node(cdcc_t) corenet_udp_sendrecv_all_ports(cdcc_t) -files_read_etc_files(cdcc_t) files_read_etc_runtime_files(cdcc_t) auth_use_nsswitch(cdcc_t) logging_send_syslog_msg(cdcc_t) -miscfiles_read_localization(cdcc_t) - -userdom_use_user_terminals(cdcc_t) +userdom_use_inherited_user_terminals(cdcc_t) ######################################## # @@ -134,14 +130,12 @@ read_lnk_files_pattern(dcc_client_t, dcc_var_t, dcc_var_t) kernel_read_system_state(dcc_client_t) -corenet_all_recvfrom_unlabeled(dcc_client_t) corenet_all_recvfrom_netlabel(dcc_client_t) corenet_udp_sendrecv_generic_if(dcc_client_t) corenet_udp_sendrecv_generic_node(dcc_client_t) corenet_udp_sendrecv_all_ports(dcc_client_t) corenet_udp_bind_generic_node(dcc_client_t) -files_read_etc_files(dcc_client_t) files_read_etc_runtime_files(dcc_client_t) fs_getattr_all_fs(dcc_client_t) @@ -150,9 +144,7 @@ auth_use_nsswitch(dcc_client_t) logging_send_syslog_msg(dcc_client_t) -miscfiles_read_localization(dcc_client_t) - -userdom_use_user_terminals(dcc_client_t) +userdom_use_inherited_user_terminals(dcc_client_t) optional_policy(` amavis_read_spool_files(dcc_client_t) @@ -182,22 +174,18 @@ manage_lnk_files_pattern(dcc_dbclean_t, dcc_var_t, dcc_var_t) kernel_read_system_state(dcc_dbclean_t) -corenet_all_recvfrom_unlabeled(dcc_dbclean_t) corenet_all_recvfrom_netlabel(dcc_dbclean_t) corenet_udp_sendrecv_generic_if(dcc_dbclean_t) corenet_udp_sendrecv_generic_node(dcc_dbclean_t) corenet_udp_sendrecv_all_ports(dcc_dbclean_t) -files_read_etc_files(dcc_dbclean_t) files_read_etc_runtime_files(dcc_dbclean_t) auth_use_nsswitch(dcc_dbclean_t) logging_send_syslog_msg(dcc_dbclean_t) -miscfiles_read_localization(dcc_dbclean_t) - -userdom_use_user_terminals(dcc_dbclean_t) +userdom_use_inherited_user_terminals(dcc_dbclean_t) ######################################## # @@ -238,7 +226,6 @@ files_pid_filetrans(dccd_t, dccd_var_run_t, { dir file }) kernel_read_system_state(dccd_t) kernel_read_kernel_sysctls(dccd_t) -corenet_all_recvfrom_unlabeled(dccd_t) corenet_all_recvfrom_netlabel(dccd_t) corenet_udp_sendrecv_generic_if(dccd_t) corenet_udp_sendrecv_generic_node(dccd_t) @@ -251,7 +238,6 @@ dev_read_sysfs(dccd_t) domain_use_interactive_fds(dccd_t) -files_read_etc_files(dccd_t) files_read_etc_runtime_files(dccd_t) fs_getattr_all_fs(dccd_t) @@ -261,8 +247,6 @@ auth_use_nsswitch(dccd_t) logging_send_syslog_msg(dccd_t) -miscfiles_read_localization(dccd_t) - userdom_dontaudit_use_unpriv_user_fds(dccd_t) userdom_dontaudit_search_user_home_dirs(dccd_t) @@ -306,7 +290,6 @@ files_pid_filetrans(dccifd_t, dccifd_var_run_t, file) kernel_read_system_state(dccifd_t) kernel_read_kernel_sysctls(dccifd_t) -corenet_all_recvfrom_unlabeled(dccifd_t) corenet_all_recvfrom_netlabel(dccifd_t) corenet_udp_sendrecv_generic_if(dccifd_t) corenet_udp_sendrecv_generic_node(dccifd_t) @@ -316,7 +299,6 @@ dev_read_sysfs(dccifd_t) domain_use_interactive_fds(dccifd_t) -files_read_etc_files(dccifd_t) files_read_etc_runtime_files(dccifd_t) fs_getattr_all_fs(dccifd_t) @@ -326,8 +308,6 @@ auth_use_nsswitch(dccifd_t) logging_send_syslog_msg(dccifd_t) -miscfiles_read_localization(dccifd_t) - userdom_dontaudit_use_unpriv_user_fds(dccifd_t) userdom_dontaudit_search_user_home_dirs(dccifd_t) @@ -370,7 +350,6 @@ files_pid_filetrans(dccm_t, dccm_var_run_t, file) kernel_read_system_state(dccm_t) kernel_read_kernel_sysctls(dccm_t) -corenet_all_recvfrom_unlabeled(dccm_t) corenet_all_recvfrom_netlabel(dccm_t) corenet_udp_sendrecv_generic_if(dccm_t) corenet_udp_sendrecv_generic_node(dccm_t) @@ -380,7 +359,6 @@ dev_read_sysfs(dccm_t) domain_use_interactive_fds(dccm_t) -files_read_etc_files(dccm_t) files_read_etc_runtime_files(dccm_t) fs_getattr_all_fs(dccm_t) @@ -390,8 +368,6 @@ auth_use_nsswitch(dccm_t) logging_send_syslog_msg(dccm_t) -miscfiles_read_localization(dccm_t) - userdom_dontaudit_use_unpriv_user_fds(dccm_t) userdom_dontaudit_search_user_home_dirs(dccm_t) diff --git a/ddclient.if b/ddclient.if index 0a1a61b..64742c6 100644 --- a/ddclient.if +++ b/ddclient.if @@ -64,13 +64,17 @@ interface(`ddclient_run',` interface(`ddclient_admin',` gen_require(` type ddclient_t, ddclient_etc_t, ddclient_log_t; - type ddclient_var_t, ddclient_var_lib_t; - type ddclient_var_run_t, ddclient_initrc_exec_t; + type ddclient_var_t, ddclient_var_lib_t, ddclient_initrc_exec_t; + type ddclient_var_run_t; ') - allow $1 ddclient_t:process { ptrace signal_perms }; + allow $1 ddclient_t:process signal_perms; ps_process_pattern($1, ddclient_t) + tunable_policy(`deny_ptrace',`',` + allow $1 ddclient_t:process ptrace; + ') + init_labeled_script_domtrans($1, ddclient_initrc_exec_t) domain_system_change_exemption($1) role_transition $2 ddclient_initrc_exec_t system_r; diff --git a/ddclient.te b/ddclient.te index 24ba98a..318a5a1 100644 --- a/ddclient.te +++ b/ddclient.te @@ -18,6 +18,9 @@ init_script_file(ddclient_initrc_exec_t) type ddclient_log_t; logging_log_file(ddclient_log_t) +type ddclient_tmp_t; +files_tmp_file(ddclient_tmp_t) + type ddclient_var_t; files_type(ddclient_var_t) @@ -32,17 +35,23 @@ files_pid_file(ddclient_var_run_t) # Declarations # + dontaudit ddclient_t self:capability sys_tty_config; allow ddclient_t self:process signal_perms; allow ddclient_t self:fifo_file rw_fifo_file_perms; allow ddclient_t self:tcp_socket create_socket_perms; allow ddclient_t self:udp_socket create_socket_perms; +allow ddclient_t self:netlink_route_socket r_netlink_socket_perms; -allow ddclient_t ddclient_etc_t:file read_file_perms; +read_files_pattern(ddclient_t, ddclient_etc_t, ddclient_etc_t) +setattr_files_pattern(ddclient_t, ddclient_etc_t, ddclient_etc_t) allow ddclient_t ddclient_log_t:file manage_file_perms; logging_log_filetrans(ddclient_t, ddclient_log_t, file) +manage_files_pattern(ddclient_t, ddclient_tmp_t, ddclient_tmp_t) +files_tmp_filetrans(ddclient_t, ddclient_tmp_t, { file }) + manage_dirs_pattern(ddclient_t, ddclient_var_t, ddclient_var_t) manage_files_pattern(ddclient_t, ddclient_var_t, ddclient_var_t) manage_lnk_files_pattern(ddclient_t, ddclient_var_t, ddclient_var_t) @@ -62,11 +71,11 @@ kernel_read_software_raid_state(ddclient_t) kernel_getattr_core_if(ddclient_t) kernel_getattr_message_if(ddclient_t) kernel_read_kernel_sysctls(ddclient_t) +kernel_search_network_sysctl(ddclient_t) corecmd_exec_shell(ddclient_t) corecmd_exec_bin(ddclient_t) -corenet_all_recvfrom_unlabeled(ddclient_t) corenet_all_recvfrom_netlabel(ddclient_t) corenet_tcp_sendrecv_generic_if(ddclient_t) corenet_udp_sendrecv_generic_if(ddclient_t) @@ -74,6 +83,8 @@ corenet_tcp_sendrecv_generic_node(ddclient_t) corenet_udp_sendrecv_generic_node(ddclient_t) corenet_tcp_sendrecv_all_ports(ddclient_t) corenet_udp_sendrecv_all_ports(ddclient_t) +corenet_tcp_bind_generic_node(ddclient_t) +corenet_udp_bind_generic_node(ddclient_t) corenet_tcp_connect_all_ports(ddclient_t) corenet_sendrecv_all_client_packets(ddclient_t) @@ -89,9 +100,11 @@ files_read_usr_files(ddclient_t) fs_getattr_all_fs(ddclient_t) fs_search_auto_mountpoints(ddclient_t) +auth_read_passwd(ddclient_t) + logging_send_syslog_msg(ddclient_t) -miscfiles_read_localization(ddclient_t) +mta_send_mail(ddclient_t) sysnet_exec_ifconfig(ddclient_t) sysnet_read_config(ddclient_t) diff --git a/ddcprobe.te b/ddcprobe.te index 5e062bc..c85c30d 100644 --- a/ddcprobe.te +++ b/ddcprobe.te @@ -40,12 +40,15 @@ term_use_all_ptys(ddcprobe_t) libs_read_lib_files(ddcprobe_t) -miscfiles_read_localization(ddcprobe_t) -modutils_read_module_deps(ddcprobe_t) - -userdom_use_user_terminals(ddcprobe_t) +userdom_use_inherited_user_terminals(ddcprobe_t) userdom_use_all_users_fds(ddcprobe_t) -#reh why? this does not seem even necessary to function properly -kudzu_getattr_exec_files(ddcprobe_t) +optional_policy(` + #reh why? this does not seem even necessary to function properly + kudzu_getattr_exec_files(ddcprobe_t) +') + +optional_policy(` + modutils_read_module_deps(ddcprobe_t) +') diff --git a/denyhosts.if b/denyhosts.if index 567865f..b5e9376 100644 --- a/denyhosts.if +++ b/denyhosts.if @@ -59,6 +59,7 @@ interface(`denyhosts_initrc_domtrans', ` ## Role allowed access. ## ## +## # interface(`denyhosts_admin', ` gen_require(` @@ -66,20 +67,24 @@ interface(`denyhosts_admin', ` type denyhosts_var_log_t, denyhosts_initrc_exec_t; ') - allow $1 denyhosts_t:process { ptrace signal_perms }; + allow $1 denyhosts_t:process signal_perms; ps_process_pattern($1, denyhosts_t) + tunable_policy(`deny_ptrace',`',` + allow $1 denyhosts_t:process ptrace; + ') + denyhosts_initrc_domtrans($1) domain_system_change_exemption($1) role_transition $2 denyhosts_initrc_exec_t system_r; allow $2 system_r; - files_search_var_lib($1) + files_list_var_lib($1) admin_pattern($1, denyhosts_var_lib_t) - logging_search_logs($1) + logging_list_logs($1) admin_pattern($1, denyhosts_var_log_t) - files_search_locks($1) + files_list_locks($1) admin_pattern($1, denyhosts_var_lock_t) ') diff --git a/denyhosts.te b/denyhosts.te index 8ba9425..2030529 100644 --- a/denyhosts.te +++ b/denyhosts.te @@ -25,6 +25,9 @@ logging_log_file(denyhosts_var_log_t) # # DenyHosts personal policy. # +# Bug #588563 +allow denyhosts_t self:capability sys_tty_config; +allow denyhosts_t self:fifo_file rw_fifo_file_perms; allow denyhosts_t self:netlink_route_socket create_netlink_socket_perms; allow denyhosts_t self:tcp_socket create_socket_perms; @@ -43,26 +46,30 @@ read_files_pattern(denyhosts_t, denyhosts_var_log_t, denyhosts_var_log_t) setattr_files_pattern(denyhosts_t, denyhosts_var_log_t, denyhosts_var_log_t) logging_log_filetrans(denyhosts_t, denyhosts_var_log_t, file) +kernel_read_network_state(denyhosts_t) kernel_read_system_state(denyhosts_t) +kernel_read_network_state(denyhosts_t) +corecmd_exec_shell(denyhosts_t) corecmd_exec_bin(denyhosts_t) -corenet_all_recvfrom_unlabeled(denyhosts_t) corenet_all_recvfrom_netlabel(denyhosts_t) corenet_tcp_sendrecv_generic_if(denyhosts_t) corenet_tcp_sendrecv_generic_node(denyhosts_t) corenet_tcp_bind_generic_node(denyhosts_t) corenet_tcp_connect_smtp_port(denyhosts_t) +corenet_tcp_connect_sype_port(denyhosts_t) corenet_sendrecv_smtp_client_packets(denyhosts_t) dev_read_urand(denyhosts_t) -files_read_etc_files(denyhosts_t) +files_read_usr_files(denyhosts_t) + +auth_use_nsswitch(denyhosts_t) # /var/log/secure logging_read_generic_logs(denyhosts_t) - -miscfiles_read_localization(denyhosts_t) +logging_send_syslog_msg(denyhosts_t) sysnet_manage_config(denyhosts_t) sysnet_etc_filetrans_config(denyhosts_t) @@ -70,3 +77,7 @@ sysnet_etc_filetrans_config(denyhosts_t) optional_policy(` cron_system_entry(denyhosts_t, denyhosts_exec_t) ') + +optional_policy(` + gnome_dontaudit_search_config(denyhosts_t) +') diff --git a/devicekit.fc b/devicekit.fc index 9af85c8..5483806 100644 --- a/devicekit.fc +++ b/devicekit.fc @@ -1,3 +1,8 @@ +/lib/udev/udisks-part-id -- gen_context(system_u:object_r:devicekit_disk_exec_t,s0) +/lib/udisks2/udisksd -- gen_context(system_u:object_r:devicekit_disk_exec_t,s0) + +/usr/lib/udev/udisks-part-id -- gen_context(system_u:object_r:devicekit_disk_exec_t,s0) +/usr/lib/udisks2/udisksd -- gen_context(system_u:object_r:devicekit_disk_exec_t,s0) /usr/lib/udisks/udisks-daemon -- gen_context(system_u:object_r:devicekit_disk_exec_t,s0) /usr/libexec/devkit-daemon -- gen_context(system_u:object_r:devicekit_exec_t,s0) @@ -6,15 +11,16 @@ /usr/libexec/udisks-daemon -- gen_context(system_u:object_r:devicekit_disk_exec_t,s0) /usr/libexec/upowerd -- gen_context(system_u:object_r:devicekit_power_exec_t,s0) -ifdef(`distro_debian',` -/usr/lib/upower/upowerd -- gen_context(system_u:object_r:devicekit_power_exec_t,s0) -') - /var/lib/DeviceKit-.* gen_context(system_u:object_r:devicekit_var_lib_t,s0) /var/lib/upower(/.*)? gen_context(system_u:object_r:devicekit_var_lib_t,s0) -/var/lib/udisks(/.*)? gen_context(system_u:object_r:devicekit_var_lib_t,s0) +/var/lib/udisks.* gen_context(system_u:object_r:devicekit_var_lib_t,s0) + +/var/log/pm-powersave\.log.* -- gen_context(system_u:object_r:devicekit_var_log_t,s0) +/var/log/pm-suspend\.log.* -- gen_context(system_u:object_r:devicekit_var_log_t,s0) /var/run/devkit(/.*)? gen_context(system_u:object_r:devicekit_var_run_t,s0) /var/run/DeviceKit-disks(/.*)? gen_context(system_u:object_r:devicekit_var_run_t,s0) -/var/run/udisks(/.*)? gen_context(system_u:object_r:devicekit_var_run_t,s0) +/var/run/pm-utils(/.*)? gen_context(system_u:object_r:devicekit_var_run_t,s0) + +/var/run/udisks.* gen_context(system_u:object_r:devicekit_var_run_t,s0) /var/run/upower(/.*)? gen_context(system_u:object_r:devicekit_var_run_t,s0) diff --git a/devicekit.if b/devicekit.if index f706b99..aa049fc 100644 --- a/devicekit.if +++ b/devicekit.if @@ -20,6 +20,24 @@ interface(`devicekit_domtrans',` ######################################## ## +## Execute a domain transition to run devicekit_disk. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`devicekit_domtrans_disk',` + gen_require(` + type devicekit_disk_t, devicekit_disk_exec_t; + ') + + domtrans_pattern($1, devicekit_disk_exec_t, devicekit_disk_t) +') + +######################################## +## ## Send to devicekit over a unix domain ## datagram socket. ## @@ -81,6 +99,45 @@ interface(`devicekit_dbus_chat_disk',` ######################################## ## +## Use file descriptors for devicekit_disk. +## +## +## +## Domain allowed access. +## +## +# +interface(`devicekit_use_fds_disk',` + gen_require(` + type devicekit_disk_t; + ') + + allow $1 devicekit_disk_t:fd use; +') + +######################################## +## +## Dontaudit Send and receive messages from +## devicekit disk over dbus. +## +## +## +## Domain to not audit. +## +## +# +interface(`devicekit_dontaudit_dbus_chat_disk',` + gen_require(` + type devicekit_disk_t; + class dbus send_msg; + ') + + dontaudit $1 devicekit_disk_t:dbus send_msg; + dontaudit devicekit_disk_t $1:dbus send_msg; +') + +######################################## +## ## Send signal devicekit power ## ## @@ -118,6 +175,62 @@ interface(`devicekit_dbus_chat_power',` allow devicekit_power_t $1:dbus send_msg; ') +####################################### +## +## Append inherited devicekit log files. +## +## +## +## Domain allowed access. +## +## +# +interface(`devicekit_append_inherited_log_files',` + gen_require(` + type devicekit_var_log_t; + ') + + allow $1 devicekit_var_log_t:file append_inherited_file_perms; +') + +####################################### +## +## Do not audit attempts to write the devicekit +## log files. +## +## +## +## Domain to not audit. +## +## +# +interface(`devicekit_dontaudit_rw_log',` + gen_require(` + type devicekit_var_log_t; + ') + + dontaudit $1 devicekit_var_log_t:file rw_file_perms; +') + +######################################## +## +## Allow the domain to read devicekit_power state files in /proc. +## +## +## +## Domain allowed access. +## +## +# +interface(`devicekit_read_state_power',` + gen_require(` + type devicekit_power_t; + ') + + kernel_search_proc($1) + ps_process_pattern($1, devicekit_power_t) +') + ######################################## ## ## Read devicekit PID files. @@ -139,22 +252,93 @@ interface(`devicekit_read_pid_files',` ######################################## ## -## All of the rules required to administrate -## an devicekit environment +## Do not audit attempts to read +## devicekit PID files. +## +## +## +## Domain to not audit. +## +## +# +interface(`devicekit_dontaudit_read_pid_files',` + gen_require(` + type devicekit_var_run_t; + ') + + dontaudit $1 devicekit_var_run_t:file read_inherited_file_perms; +') + + +######################################## +## +## Manage devicekit PID files. ## ## ## ## Domain allowed access. ## ## -## +# +interface(`devicekit_manage_pid_files',` + gen_require(` + type devicekit_var_run_t; + ') + + files_search_pids($1) + manage_dirs_pattern($1, devicekit_var_run_t, devicekit_var_run_t) + manage_files_pattern($1, devicekit_var_run_t, devicekit_var_run_t) + files_pid_filetrans($1, devicekit_var_run_t, dir, "pm-utils") +') + +####################################### +## +## Relabel devicekit LOG files. +## +## +## +## Domain allowed access. +## +## +# +interface(`devicekit_relabel_log_files',` + gen_require(` + type devicekit_var_log_t; + ') + + logging_search_logs($1) + relabel_files_pattern($1, devicekit_var_log_t, devicekit_var_log_t) +') + +######################################## +## +## Manage devicekit LOG files. +## +## ## -## The role to be allowed to manage the devicekit domain. +## Domain allowed access. ## ## -## +# +interface(`devicekit_manage_log_files',` + gen_require(` + type devicekit_var_log_t; + ') + + logging_search_logs($1) + manage_files_pattern($1, devicekit_var_log_t, devicekit_var_log_t) + #logging_log_filetrans($1, devicekit_var_log_t, file, "pm-powersave.log") + #logging_log_filetrans($1, devicekit_var_log_t, file, "pm-suspend.log") +') + +######################################## +## +## All of the rules required to administrate +## an devicekit environment +## +## ## -## The type of the user terminal. +## Domain allowed access. ## ## ## @@ -165,21 +349,46 @@ interface(`devicekit_admin',` type devicekit_var_lib_t, devicekit_var_run_t, devicekit_tmp_t; ') - allow $1 devicekit_t:process { ptrace signal_perms getattr }; + allow $1 devicekit_t:process signal_perms; ps_process_pattern($1, devicekit_t) + tunable_policy(`deny_ptrace',`',` + allow $1 devicekit_t:process ptrace; + allow $1 devicekit_disk_t:process ptrace; + allow $1 devicekit_power_t:process ptrace; + ') - allow $1 devicekit_disk_t:process { ptrace signal_perms getattr }; + allow $1 devicekit_disk_t:process signal_perms; ps_process_pattern($1, devicekit_disk_t) - allow $1 devicekit_power_t:process { ptrace signal_perms getattr }; + allow $1 devicekit_power_t:process signal_perms; ps_process_pattern($1, devicekit_power_t) admin_pattern($1, devicekit_tmp_t) - files_search_tmp($1) + files_list_tmp($1) admin_pattern($1, devicekit_var_lib_t) - files_search_var_lib($1) + files_list_var_lib($1) admin_pattern($1, devicekit_var_run_t) - files_search_pids($1) + files_list_pids($1) +') + +######################################## +## +## Transition to devicekit named content +## +## +## +## Domain allowed access. +## +## +# +interface(`devicekit_filetrans_named_content',` + gen_require(` + type devicekit_var_run_t, devicekit_var_log_t; + ') + + files_pid_filetrans($1, devicekit_var_run_t, dir, "pm-utils") + #logging_log_filetrans($1, devicekit_var_log_t, file, "pm-powersave.log") + #logging_log_filetrans($1, devicekit_var_log_t, file, "pm-suspend.log") ') diff --git a/devicekit.te b/devicekit.te index 1819518..4848cfe 100644 --- a/devicekit.te +++ b/devicekit.te @@ -7,15 +7,15 @@ policy_module(devicekit, 1.2.0) type devicekit_t; type devicekit_exec_t; -dbus_system_domain(devicekit_t, devicekit_exec_t) +init_daemon_domain(devicekit_t, devicekit_exec_t) type devicekit_power_t; type devicekit_power_exec_t; -dbus_system_domain(devicekit_power_t, devicekit_power_exec_t) +init_daemon_domain(devicekit_power_t, devicekit_power_exec_t) type devicekit_disk_t; type devicekit_disk_exec_t; -dbus_system_domain(devicekit_disk_t, devicekit_disk_exec_t) +init_daemon_domain(devicekit_disk_t, devicekit_disk_exec_t) type devicekit_tmp_t; files_tmp_file(devicekit_tmp_t) @@ -26,6 +26,9 @@ files_pid_file(devicekit_var_run_t) type devicekit_var_lib_t; files_type(devicekit_var_lib_t) +type devicekit_var_log_t; +logging_log_file(devicekit_var_log_t) + ######################################## # # DeviceKit local policy @@ -42,11 +45,10 @@ kernel_read_system_state(devicekit_t) dev_read_sysfs(devicekit_t) dev_read_urand(devicekit_t) -files_read_etc_files(devicekit_t) -miscfiles_read_localization(devicekit_t) optional_policy(` + dbus_system_domain(devicekit_t, devicekit_exec_t) dbus_system_bus_client(devicekit_t) allow devicekit_t devicekit_disk_t:dbus send_msg; @@ -62,7 +64,8 @@ optional_policy(` # DeviceKit disk local policy # -allow devicekit_disk_t self:capability { chown setuid setgid dac_override fowner fsetid net_admin sys_admin sys_nice sys_ptrace sys_rawio }; +allow devicekit_disk_t self:capability { chown setuid setgid dac_override fowner fsetid net_admin sys_admin sys_nice sys_rawio }; + allow devicekit_disk_t self:process { getsched signal_perms }; allow devicekit_disk_t self:fifo_file rw_fifo_file_perms; allow devicekit_disk_t self:netlink_kobject_uevent_socket create_socket_perms; @@ -75,10 +78,14 @@ manage_dirs_pattern(devicekit_disk_t, devicekit_var_lib_t, devicekit_var_lib_t) manage_files_pattern(devicekit_disk_t, devicekit_var_lib_t, devicekit_var_lib_t) files_var_lib_filetrans(devicekit_disk_t, devicekit_var_lib_t, dir) +allow devicekit_disk_t devicekit_var_run_t:dir mounton; manage_dirs_pattern(devicekit_disk_t, devicekit_var_run_t, devicekit_var_run_t) manage_files_pattern(devicekit_disk_t, devicekit_var_run_t, devicekit_var_run_t) files_pid_filetrans(devicekit_disk_t, devicekit_var_run_t, { file dir }) +files_filetrans_named_content(devicekit_disk_t) +kernel_list_unlabeled(devicekit_disk_t) +kernel_dontaudit_getattr_unlabeled_files(devicekit_disk_t) kernel_getattr_message_if(devicekit_disk_t) kernel_read_fs_sysctls(devicekit_disk_t) kernel_read_network_state(devicekit_disk_t) @@ -97,6 +104,7 @@ dev_getattr_usbfs_dirs(devicekit_disk_t) dev_manage_generic_files(devicekit_disk_t) dev_getattr_all_chr_files(devicekit_disk_t) dev_getattr_mtrr_dev(devicekit_disk_t) +dev_rw_generic_blk_files(devicekit_disk_t) domain_getattr_all_pipes(devicekit_disk_t) domain_getattr_all_sockets(devicekit_disk_t) @@ -105,14 +113,16 @@ domain_read_all_domains_state(devicekit_disk_t) files_dontaudit_read_all_symlinks(devicekit_disk_t) files_getattr_all_sockets(devicekit_disk_t) -files_getattr_all_mountpoints(devicekit_disk_t) +files_getattr_all_dirs(devicekit_disk_t) files_getattr_all_files(devicekit_disk_t) +files_getattr_all_pipes(devicekit_disk_t) +files_manage_boot_dirs(devicekit_disk_t) files_manage_isid_type_dirs(devicekit_disk_t) files_manage_mnt_dirs(devicekit_disk_t) -files_read_etc_files(devicekit_disk_t) files_read_etc_runtime_files(devicekit_disk_t) files_read_usr_files(devicekit_disk_t) +fs_getattr_all_fs(devicekit_disk_t) fs_list_inotifyfs(devicekit_disk_t) fs_manage_fusefs_dirs(devicekit_disk_t) fs_mount_all_fs(devicekit_disk_t) @@ -127,16 +137,18 @@ storage_raw_write_fixed_disk(devicekit_disk_t) storage_raw_read_removable_device(devicekit_disk_t) storage_raw_write_removable_device(devicekit_disk_t) -term_use_all_terms(devicekit_disk_t) +term_use_all_inherited_terms(devicekit_disk_t) auth_use_nsswitch(devicekit_disk_t) -miscfiles_read_localization(devicekit_disk_t) +logging_send_syslog_msg(devicekit_disk_t) userdom_read_all_users_state(devicekit_disk_t) userdom_search_user_home_dirs(devicekit_disk_t) +userdom_manage_user_tmp_dirs(devicekit_disk_t) optional_policy(` + dbus_system_domain(devicekit_disk_t, devicekit_disk_exec_t) dbus_system_bus_client(devicekit_disk_t) allow devicekit_disk_t devicekit_t:dbus send_msg; @@ -170,6 +182,10 @@ optional_policy(` ') optional_policy(` + systemd_read_logind_sessions_files(devicekit_disk_t) +') + +optional_policy(` udev_domtrans(devicekit_disk_t) udev_read_db(devicekit_disk_t) ') @@ -178,55 +194,83 @@ optional_policy(` virt_manage_images(devicekit_disk_t) ') +optional_policy(` + unconfined_domain(devicekit_t) + unconfined_domain(devicekit_power_t) + unconfined_domain(devicekit_disk_t) +') + ######################################## # # DeviceKit-Power local policy # -allow devicekit_power_t self:capability { dac_override net_admin sys_admin sys_tty_config sys_nice sys_ptrace }; -allow devicekit_power_t self:process getsched; +allow devicekit_power_t self:capability { dac_override net_admin sys_admin sys_tty_config sys_nice }; +allow devicekit_power_t self:process { getsched signal_perms }; allow devicekit_power_t self:fifo_file rw_fifo_file_perms; allow devicekit_power_t self:unix_dgram_socket create_socket_perms; allow devicekit_power_t self:netlink_kobject_uevent_socket create_socket_perms; +manage_files_pattern(devicekit_power_t, devicekit_var_log_t, devicekit_var_log_t) +logging_log_filetrans(devicekit_power_t, devicekit_var_log_t, file) + +manage_dirs_pattern(devicekit_power_t, devicekit_tmp_t, devicekit_tmp_t) +manage_files_pattern(devicekit_power_t, devicekit_tmp_t, devicekit_tmp_t) +files_tmp_filetrans(devicekit_power_t, devicekit_tmp_t, { file dir }) + manage_dirs_pattern(devicekit_power_t, devicekit_var_lib_t, devicekit_var_lib_t) manage_files_pattern(devicekit_power_t, devicekit_var_lib_t, devicekit_var_lib_t) files_var_lib_filetrans(devicekit_power_t, devicekit_var_lib_t, dir) +manage_files_pattern(devicekit_power_t, devicekit_var_log_t, devicekit_var_log_t) +logging_log_filetrans(devicekit_power_t, devicekit_var_log_t, file) + +manage_files_pattern(devicekit_power_t, devicekit_var_run_t, devicekit_var_run_t) +manage_dirs_pattern(devicekit_power_t, devicekit_var_run_t, devicekit_var_run_t) +files_pid_filetrans(devicekit_power_t, devicekit_var_run_t, dir) + +kernel_read_fs_sysctls(devicekit_power_t) kernel_read_network_state(devicekit_power_t) kernel_read_system_state(devicekit_power_t) kernel_rw_hotplug_sysctls(devicekit_power_t) kernel_rw_kernel_sysctl(devicekit_power_t) +kernel_rw_vm_sysctls(devicekit_power_t) kernel_search_debugfs(devicekit_power_t) kernel_write_proc_files(devicekit_power_t) +kernel_setsched(devicekit_power_t) corecmd_exec_bin(devicekit_power_t) corecmd_exec_shell(devicekit_power_t) -consoletype_exec(devicekit_power_t) - domain_read_all_domains_state(devicekit_power_t) dev_read_input(devicekit_power_t) +dev_read_urand(devicekit_power_t) dev_rw_generic_usb_dev(devicekit_power_t) dev_rw_generic_chr_files(devicekit_power_t) dev_rw_netcontrol(devicekit_power_t) dev_rw_sysfs(devicekit_power_t) +dev_read_rand(devicekit_power_t) +dev_getattr_all_chr_files(devicekit_power_t) files_read_kernel_img(devicekit_power_t) -files_read_etc_files(devicekit_power_t) +files_read_etc_runtime_files(devicekit_power_t) files_read_usr_files(devicekit_power_t) +files_dontaudit_list_mnt(devicekit_power_t) fs_list_inotifyfs(devicekit_power_t) +fs_getattr_all_fs(devicekit_power_t) -term_use_all_terms(devicekit_power_t) +term_use_all_inherited_terms(devicekit_power_t) auth_use_nsswitch(devicekit_power_t) -miscfiles_read_localization(devicekit_power_t) + +seutil_exec_setfiles(devicekit_power_t) sysnet_read_config(devicekit_power_t) sysnet_domtrans_ifconfig(devicekit_power_t) +sysnet_domtrans_dhcpc(devicekit_power_t) userdom_read_all_users_state(devicekit_power_t) @@ -235,10 +279,16 @@ optional_policy(` ') optional_policy(` + consoletype_exec(devicekit_power_t) +') + +optional_policy(` cron_initrc_domtrans(devicekit_power_t) + cron_systemctl(devicekit_power_t) ') optional_policy(` + dbus_system_domain(devicekit_power_t, devicekit_power_exec_t) dbus_system_bus_client(devicekit_power_t) allow devicekit_power_t devicekit_t:dbus send_msg; @@ -261,14 +311,21 @@ optional_policy(` ') optional_policy(` + gnome_manage_home_config(devicekit_power_t) +') + +optional_policy(` hal_domtrans_mac(devicekit_power_t) - hal_manage_log(devicekit_power_t) hal_manage_pid_dirs(devicekit_power_t) hal_manage_pid_files(devicekit_power_t) hal_dbus_chat(devicekit_power_t) ') optional_policy(` + networkmanager_domtrans(devicekit_power_t) +') + +optional_policy(` policykit_dbus_chat(devicekit_power_t) policykit_domtrans_auth(devicekit_power_t) policykit_read_lib(devicekit_power_t) @@ -276,9 +333,31 @@ optional_policy(` ') optional_policy(` + modutils_domtrans_insmod(devicekit_power_t) +') + +optional_policy(` + mount_domtrans(devicekit_power_t) +') + +optional_policy(` + readahead_domtrans(devicekit_power_t) +') + +optional_policy(` udev_read_db(devicekit_power_t) ') optional_policy(` + usbmuxd_stream_connect(devicekit_power_t) +') + +optional_policy(` vbetool_domtrans(devicekit_power_t) ') + +optional_policy(` + corenet_tcp_connect_xserver_port(devicekit_power_t) + xserver_stream_connect(devicekit_power_t) +') + diff --git a/dhcp.fc b/dhcp.fc index 767e0c7..9553bcf 100644 --- a/dhcp.fc +++ b/dhcp.fc @@ -1,8 +1,10 @@ -/etc/rc\.d/init\.d/dhcpd -- gen_context(system_u:object_r:dhcpd_initrc_exec_t,s0) +/etc/rc\.d/init\.d/dhcpd(6)? -- gen_context(system_u:object_r:dhcpd_initrc_exec_t,s0) + +/usr/lib/systemd/system/dhcpcd.* -- gen_context(system_u:object_r:dhcpd_unit_file_t,s0) /usr/sbin/dhcpd.* -- gen_context(system_u:object_r:dhcpd_exec_t,s0) /var/lib/dhcpd(/.*)? gen_context(system_u:object_r:dhcpd_state_t,s0) /var/lib/dhcp(3)?/dhcpd\.leases.* -- gen_context(system_u:object_r:dhcpd_state_t,s0) -/var/run/dhcpd\.pid -- gen_context(system_u:object_r:dhcpd_var_run_t,s0) +/var/run/dhcpd(6)?\.pid -- gen_context(system_u:object_r:dhcpd_var_run_t,s0) diff --git a/dhcp.if b/dhcp.if index 5e2cea8..2ab8a14 100644 --- a/dhcp.if +++ b/dhcp.if @@ -36,7 +36,7 @@ interface(`dhcpd_setattr_state_files',` ') sysnet_search_dhcp_state($1) - allow $1 dhcpd_state_t:file setattr; + allow $1 dhcpd_state_t:file setattr_file_perms; ') ######################################## @@ -60,6 +60,30 @@ interface(`dhcpd_initrc_domtrans',` ######################################## ## +## Execute dhcpd server in the dhcpd domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`dhcpd_systemctl',` + gen_require(` + type dhcpd_unit_file_t; + type dhcpd_t; + ') + + systemd_exec_systemctl($1) + systemd_search_unit_dirs($1) + allow $1 dhcpd_unit_file_t:file read_file_perms; + allow $1 dhcpd_unit_file_t:service manage_service_perms; + + ps_process_pattern($1, dhcpd_t) +') + +######################################## +## ## All of the rules required to administrate ## an dhcp environment ## @@ -77,12 +101,16 @@ interface(`dhcpd_initrc_domtrans',` # interface(`dhcpd_admin',` gen_require(` - type dhcpd_t; type dhcpd_tmp_t; type dhcpd_state_t; + type dhcpd_t, dhcpd_tmp_t, dhcpd_state_t; type dhcpd_var_run_t, dhcpd_initrc_exec_t; + type dhcpd_unit_file_t; ') - allow $1 dhcpd_t:process { ptrace signal_perms }; + allow $1 dhcpd_t:process signal_perms; ps_process_pattern($1, dhcpd_t) + tunable_policy(`deny_ptrace',`',` + allow $1 dhcpd_t:process ptrace; + ') init_labeled_script_domtrans($1, dhcpd_initrc_exec_t) domain_system_change_exemption($1) @@ -96,4 +124,8 @@ interface(`dhcpd_admin',` files_list_pids($1) admin_pattern($1, dhcpd_var_run_t) + + dhcpd_systemctl($1) + admin_pattern($1, dhcpd_unit_file_t) + allow $1 dhcpd_unit_file_t:service all_service_perms; ') diff --git a/dhcp.te b/dhcp.te index ed07b26..c57c350 100644 --- a/dhcp.te +++ b/dhcp.te @@ -19,6 +19,9 @@ init_daemon_domain(dhcpd_t, dhcpd_exec_t) type dhcpd_initrc_exec_t; init_script_file(dhcpd_initrc_exec_t) +type dhcpd_unit_file_t; +systemd_unit_file(dhcpd_unit_file_t) + type dhcpd_state_t; files_type(dhcpd_state_t) @@ -33,9 +36,9 @@ files_pid_file(dhcpd_var_run_t) # Local policy # -allow dhcpd_t self:capability { net_raw sys_resource }; +allow dhcpd_t self:capability { dac_override sys_chroot net_raw setgid setuid sys_resource }; dontaudit dhcpd_t self:capability { net_admin sys_tty_config }; -allow dhcpd_t self:process signal_perms; +allow dhcpd_t self:process { getcap setcap signal_perms }; allow dhcpd_t self:fifo_file rw_fifo_file_perms; allow dhcpd_t self:unix_dgram_socket create_socket_perms; allow dhcpd_t self:unix_stream_socket create_socket_perms; @@ -61,7 +64,6 @@ kernel_read_system_state(dhcpd_t) kernel_read_kernel_sysctls(dhcpd_t) kernel_read_network_state(dhcpd_t) -corenet_all_recvfrom_unlabeled(dhcpd_t) corenet_all_recvfrom_netlabel(dhcpd_t) corenet_tcp_sendrecv_generic_if(dhcpd_t) corenet_udp_sendrecv_generic_if(dhcpd_t) @@ -80,7 +82,7 @@ corenet_tcp_connect_all_ports(dhcpd_t) corenet_sendrecv_dhcpd_server_packets(dhcpd_t) corenet_sendrecv_pxe_server_packets(dhcpd_t) corenet_sendrecv_all_client_packets(dhcpd_t) -# Needed to detect open number of interfaces (common/discover.c::begin_iface_scan) +corenet_dontaudit_udp_bind_all_reserved_ports(dhcpd_t) corenet_udp_bind_all_unreserved_ports(dhcpd_t) dev_read_sysfs(dhcpd_t) @@ -94,7 +96,6 @@ corecmd_exec_bin(dhcpd_t) domain_use_interactive_fds(dhcpd_t) -files_read_etc_files(dhcpd_t) files_read_usr_files(dhcpd_t) files_read_etc_runtime_files(dhcpd_t) files_search_var_lib(dhcpd_t) @@ -103,19 +104,26 @@ auth_use_nsswitch(dhcpd_t) logging_send_syslog_msg(dhcpd_t) -miscfiles_read_localization(dhcpd_t) - sysnet_read_dhcp_config(dhcpd_t) userdom_dontaudit_use_unpriv_user_fds(dhcpd_t) userdom_dontaudit_search_user_home_dirs(dhcpd_t) +tunable_policy(`dhcpd_use_ldap',` + sysnet_use_ldap(dhcpd_t) +') + ifdef(`distro_gentoo',` allow dhcpd_t self:capability { chown dac_override setgid setuid sys_chroot }; ') -tunable_policy(`dhcpd_use_ldap',` - sysnet_use_ldap(dhcpd_t) +optional_policy(` + # used for dynamic DNS + bind_read_dnssec_keys(dhcpd_t) +') + +optional_policy(` + cobbler_dontaudit_rw_log(dhcpd_t) ') optional_policy(` diff --git a/dictd.if b/dictd.if index a0d23ce..83a7ca5 100644 --- a/dictd.if +++ b/dictd.if @@ -38,8 +38,11 @@ interface(`dictd_admin',` type dictd_var_run_t, dictd_initrc_exec_t; ') - allow $1 dictd_t:process { ptrace signal_perms }; + allow $1 dictd_t:process signal_perms; ps_process_pattern($1, dictd_t) + tunable_policy(`deny_ptrace',`',` + allow $1 dictd_t:process ptrace; + ') init_labeled_script_domtrans($1, dictd_initrc_exec_t) domain_system_change_exemption($1) diff --git a/dictd.te b/dictd.te index d2d9359..b14ece6 100644 --- a/dictd.te +++ b/dictd.te @@ -45,7 +45,6 @@ files_pid_filetrans(dictd_t, dictd_var_run_t, file) kernel_read_system_state(dictd_t) kernel_read_kernel_sysctls(dictd_t) -corenet_all_recvfrom_unlabeled(dictd_t) corenet_all_recvfrom_netlabel(dictd_t) corenet_tcp_sendrecv_generic_if(dictd_t) corenet_raw_sendrecv_generic_if(dictd_t) @@ -66,30 +65,19 @@ fs_search_auto_mountpoints(dictd_t) domain_use_interactive_fds(dictd_t) -files_read_etc_files(dictd_t) files_read_etc_runtime_files(dictd_t) files_read_usr_files(dictd_t) files_search_var_lib(dictd_t) # for checking for nscd files_dontaudit_search_pids(dictd_t) -logging_send_syslog_msg(dictd_t) - -miscfiles_read_localization(dictd_t) +auth_use_nsswitch(dictd_t) -sysnet_read_config(dictd_t) +logging_send_syslog_msg(dictd_t) userdom_dontaudit_use_unpriv_user_fds(dictd_t) optional_policy(` - nis_use_ypbind(dictd_t) -') - -optional_policy(` - nscd_socket_use(dictd_t) -') - -optional_policy(` seutil_sigchld_newrole(dictd_t) ') diff --git a/dirsrv-admin.fc b/dirsrv-admin.fc new file mode 100644 index 0000000..fdf5675 --- /dev/null +++ b/dirsrv-admin.fc @@ -0,0 +1,15 @@ +/etc/dirsrv/admin-serv(/.*)? gen_context(system_u:object_r:dirsrvadmin_config_t,s0) + +/etc/dirsrv/dsgw(/.*)? gen_context(system_u:object_r:dirsrvadmin_config_t,s0) + +/usr/sbin/restart-ds-admin -- gen_context(system_u:object_r:dirsrvadmin_exec_t,s0) +/usr/sbin/start-ds-admin -- gen_context(system_u:object_r:dirsrvadmin_exec_t,s0) +/usr/sbin/stop-ds-admin -- gen_context(system_u:object_r:dirsrvadmin_exec_t,s0) + +/usr/lib/dirsrv/cgi-bin(/.*)? gen_context(system_u:object_r:httpd_dirsrvadmin_script_exec_t,s0) +/usr/lib/dirsrv/dsgw-cgi-bin(/.*)? gen_context(system_u:object_r:httpd_dirsrvadmin_script_exec_t,s0) + +/usr/lib/dirsrv/cgi-bin/ds_create -- gen_context(system_u:object_r:dirsrvadmin_unconfined_script_exec_t,s0) +/usr/lib/dirsrv/cgi-bin/ds_remove -- gen_context(system_u:object_r:dirsrvadmin_unconfined_script_exec_t,s0) + +/var/lock/subsys/dirsrv -- gen_context(system_u:object_r:dirsrvadmin_lock_t,s0) diff --git a/dirsrv-admin.if b/dirsrv-admin.if new file mode 100644 index 0000000..332a1c9 --- /dev/null +++ b/dirsrv-admin.if @@ -0,0 +1,134 @@ +## Administration Server for Directory Server, dirsrv-admin. + +######################################## +## +## Exec dirsrv-admin programs. +## +## +## +## Domain allowed access. +## +## +# +interface(`dirsrvadmin_run_exec',` + gen_require(` + type dirsrvadmin_exec_t; + ') + + allow $1 dirsrvadmin_exec_t:dir search_dir_perms; + can_exec($1, dirsrvadmin_exec_t) +') + +######################################## +## +## Exec cgi programs. +## +## +## +## Domain allowed access. +## +## +# +interface(`dirsrvadmin_run_httpd_script_exec',` + gen_require(` + type httpd_dirsrvadmin_script_exec_t; + ') + + allow $1 httpd_dirsrvadmin_script_exec_t:dir search_dir_perms; + can_exec($1, httpd_dirsrvadmin_script_exec_t) +') + +######################################## +## +## Manage dirsrv-adminserver configuration files. +## +## +## +## Domain allowed access. +## +## +# +interface(`dirsrvadmin_read_config',` + gen_require(` + type dirsrvadmin_config_t; + ') + + read_files_pattern($1, dirsrvadmin_config_t, dirsrvadmin_config_t) +') + +######################################## +## +## Manage dirsrv-adminserver configuration files. +## +## +## +## Domain allowed access. +## +## +# +interface(`dirsrvadmin_manage_config',` + gen_require(` + type dirsrvadmin_config_t; + ') + + allow $1 dirsrvadmin_config_t:dir manage_dir_perms; + allow $1 dirsrvadmin_config_t:file manage_file_perms; +') + +####################################### +## +## Read dirsrv-adminserver tmp files. +## +## +## +## Domain allowed access. +## +## +# +interface(`dirsrvadmin_read_tmp',` + gen_require(` + type dirsrvadmin_tmp_t; + ') + + read_files_pattern($1, dirsrvadmin_tmp_t, dirsrvadmin_tmp_t) +') + +######################################## +## +## Manage dirsrv-adminserver tmp files. +## +## +## +## Domain allowed access. +## +## +# +interface(`dirsrvadmin_manage_tmp',` + gen_require(` + type dirsrvadmin_tmp_t; + ') + + manage_files_pattern($1, dirsrvadmin_tmp_t, dirsrvadmin_tmp_t) + manage_dirs_pattern($1, dirsrvadmin_tmp_t, dirsrvadmin_tmp_t) +') + +####################################### +## +## Execute admin cgi programs in caller domain. +## +## +## +## Domain allowed access. +## +## +# +interface(`dirsrvadmin_domtrans_unconfined_script_t',` + gen_require(` + type dirsrvadmin_unconfined_script_t; + type dirsrvadmin_unconfined_script_exec_t; + ') + + domtrans_pattern($1, dirsrvadmin_unconfined_script_exec_t, dirsrvadmin_unconfined_script_t) + allow $1 dirsrvadmin_unconfined_script_t:process signal_perms; + +') diff --git a/dirsrv-admin.te b/dirsrv-admin.te new file mode 100644 index 0000000..3ec40c2 --- /dev/null +++ b/dirsrv-admin.te @@ -0,0 +1,142 @@ +policy_module(dirsrv-admin,1.0.0) + +######################################## +# +# Declarations for the daemon +# + +type dirsrvadmin_t; +type dirsrvadmin_exec_t; +init_daemon_domain(dirsrvadmin_t, dirsrvadmin_exec_t) +role system_r types dirsrvadmin_t; + +type dirsrvadmin_config_t; +files_type(dirsrvadmin_config_t) + +type dirsrvadmin_lock_t; +files_lock_file(dirsrvadmin_lock_t) + +type dirsrvadmin_tmp_t; +files_tmp_file(dirsrvadmin_tmp_t) + +type dirsrvadmin_unconfined_script_t; +type dirsrvadmin_unconfined_script_exec_t; +domain_type(dirsrvadmin_unconfined_script_t) +domain_entry_file(dirsrvadmin_unconfined_script_t, dirsrvadmin_unconfined_script_exec_t) +corecmd_shell_entry_type(dirsrvadmin_unconfined_script_t) +role system_r types dirsrvadmin_unconfined_script_t; + +######################################## +# +# Local policy for the daemon +# +allow dirsrvadmin_t self:fifo_file rw_fifo_file_perms; +allow dirsrvadmin_t self:capability { dac_read_search dac_override sys_tty_config sys_resource }; +allow dirsrvadmin_t self:process setrlimit; + +manage_files_pattern(dirsrvadmin_t, dirsrvadmin_tmp_t, dirsrvadmin_tmp_t) +manage_dirs_pattern(dirsrvadmin_t, dirsrvadmin_tmp_t, dirsrvadmin_tmp_t) +files_tmp_filetrans(dirsrvadmin_t, dirsrvadmin_tmp_t, { file dir }) + +kernel_read_system_state(dirsrvadmin_t) + +corecmd_exec_bin(dirsrvadmin_t) +corecmd_read_bin_symlinks(dirsrvadmin_t) +corecmd_search_bin(dirsrvadmin_t) +corecmd_shell_entry_type(dirsrvadmin_t) + +files_exec_etc_files(dirsrvadmin_t) + +libs_exec_ld_so(dirsrvadmin_t) + +logging_search_logs(dirsrvadmin_t) + + +# Needed for stop and restart scripts +dirsrv_read_var_run(dirsrvadmin_t) + +optional_policy(` + apache_domtrans(dirsrvadmin_t) + apache_signal(dirsrvadmin_t) +') + +######################################## +# +# Local policy for the CGIs +# +# +# +# Create a domain for the CGI scripts + +optional_policy(` + apache_content_template(dirsrvadmin) + + allow httpd_dirsrvadmin_script_t self:process { getsched getpgid }; + allow httpd_dirsrvadmin_script_t self:capability { setuid net_bind_service setgid chown sys_nice kill dac_read_search dac_override }; + allow httpd_dirsrvadmin_script_t self:tcp_socket create_stream_socket_perms; + allow httpd_dirsrvadmin_script_t self:udp_socket create_socket_perms; + allow httpd_dirsrvadmin_script_t self:unix_dgram_socket create_socket_perms; + allow httpd_dirsrvadmin_script_t self:netlink_route_socket r_netlink_socket_perms; + allow httpd_dirsrvadmin_script_t self:sem create_sem_perms; + + + manage_files_pattern(httpd_dirsrvadmin_script_t, dirsrvadmin_lock_t, dirsrvadmin_lock_t) + files_lock_filetrans(httpd_dirsrvadmin_script_t, dirsrvadmin_lock_t, { file }) + + kernel_read_kernel_sysctls(httpd_dirsrvadmin_script_t) + + corenet_all_recvfrom_netlabel(httpd_dirsrvadmin_script_t) + corenet_tcp_connect_generic_port(httpd_dirsrvadmin_script_t) + corenet_tcp_connect_ldap_port(httpd_dirsrvadmin_script_t) + corenet_tcp_connect_http_port(httpd_dirsrvadmin_script_t) + + files_search_var_lib(httpd_dirsrvadmin_script_t) + + sysnet_read_config(httpd_dirsrvadmin_script_t) + + manage_files_pattern(httpd_dirsrvadmin_script_t, dirsrvadmin_tmp_t, dirsrvadmin_tmp_t) + manage_dirs_pattern(httpd_dirsrvadmin_script_t, dirsrvadmin_tmp_t, dirsrvadmin_tmp_t) + files_tmp_filetrans(httpd_dirsrvadmin_script_t, dirsrvadmin_tmp_t, { file dir }) + + # The CGI scripts must be able to manage dirsrv-admin + dirsrvadmin_run_exec(httpd_dirsrvadmin_script_t) + dirsrvadmin_manage_config(httpd_dirsrvadmin_script_t) + dirsrv_domtrans(httpd_dirsrvadmin_script_t) + dirsrv_signal(httpd_dirsrvadmin_script_t) + dirsrv_signull(httpd_dirsrvadmin_script_t) + dirsrv_manage_log(httpd_dirsrvadmin_script_t) + dirsrv_manage_var_lib(httpd_dirsrvadmin_script_t) + dirsrv_pid_filetrans(httpd_dirsrvadmin_script_t) + dirsrv_manage_var_run(httpd_dirsrvadmin_script_t) + dirsrv_manage_config(httpd_dirsrvadmin_script_t) + dirsrv_read_share(httpd_dirsrvadmin_script_t) +') + +####################################### +# +# Local policy for the admin CGIs +# +# + + +manage_files_pattern(dirsrvadmin_unconfined_script_t, dirsrvadmin_tmp_t, dirsrvadmin_tmp_t) +manage_dirs_pattern(dirsrvadmin_unconfined_script_t, dirsrvadmin_tmp_t, dirsrvadmin_tmp_t) +files_tmp_filetrans(dirsrvadmin_unconfined_script_t, dirsrvadmin_tmp_t, { file dir }) + +# needed because of filetrans rules +dirsrvadmin_run_exec(dirsrvadmin_unconfined_script_t) +dirsrvadmin_manage_config(dirsrvadmin_unconfined_script_t) +dirsrv_domtrans(dirsrvadmin_unconfined_script_t) +dirsrv_signal(dirsrvadmin_unconfined_script_t) +dirsrv_signull(dirsrvadmin_unconfined_script_t) +dirsrv_manage_log(dirsrvadmin_unconfined_script_t) +dirsrv_manage_var_lib(dirsrvadmin_unconfined_script_t) +dirsrv_pid_filetrans(dirsrvadmin_unconfined_script_t) +dirsrv_manage_var_run(dirsrvadmin_unconfined_script_t) +dirsrv_manage_config(dirsrvadmin_unconfined_script_t) +dirsrv_read_share(dirsrvadmin_unconfined_script_t) + +optional_policy(` + unconfined_domain(dirsrvadmin_unconfined_script_t) +') + diff --git a/dirsrv.fc b/dirsrv.fc new file mode 100644 index 0000000..0ea1ebb --- /dev/null +++ b/dirsrv.fc @@ -0,0 +1,23 @@ +/etc/dirsrv(/.*)? gen_context(system_u:object_r:dirsrv_config_t,s0) + +/usr/sbin/ns-slapd -- gen_context(system_u:object_r:dirsrv_exec_t,s0) +/usr/sbin/ldap-agent -- gen_context(system_u:object_r:initrc_exec_t,s0) +/usr/sbin/ldap-agent-bin -- gen_context(system_u:object_r:dirsrv_snmp_exec_t,s0) +/usr/sbin/start-dirsrv -- gen_context(system_u:object_r:initrc_exec_t,s0) +/usr/sbin/restart-dirsrv -- gen_context(system_u:object_r:initrc_exec_t,s0) + +/usr/share/dirsrv(/.*)? gen_context(system_u:object_r:dirsrv_share_t,s0) + +/var/run/dirsrv(/.*)? gen_context(system_u:object_r:dirsrv_var_run_t,s0) +/var/run/ldap-agent\.pid gen_context(system_u:object_r:dirsrv_snmp_var_run_t,s0) + +# BZ: +/var/run/slapd.* -s gen_context(system_u:object_r:slapd_var_run_t,s0) + +/var/lib/dirsrv(/.*)? gen_context(system_u:object_r:dirsrv_var_lib_t,s0) + +/var/lock/dirsrv(/.*)? gen_context(system_u:object_r:dirsrv_var_lock_t,s0) + +/var/log/dirsrv(/.*)? gen_context(system_u:object_r:dirsrv_var_log_t,s0) + +/var/log/dirsrv/ldap-agent.log.* gen_context(system_u:object_r:dirsrv_snmp_var_log_t,s0) diff --git a/dirsrv.if b/dirsrv.if new file mode 100644 index 0000000..b214253 --- /dev/null +++ b/dirsrv.if @@ -0,0 +1,208 @@ +## policy for dirsrv + +######################################## +## +## Execute a domain transition to run dirsrv. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`dirsrv_domtrans',` + gen_require(` + type dirsrv_t, dirsrv_exec_t; + ') + + domtrans_pattern($1, dirsrv_exec_t,dirsrv_t) +') + + +######################################## +## +## Allow caller to signal dirsrv. +## +## +## +## Domain allowed access. +## +## +# +interface(`dirsrv_signal',` + gen_require(` + type dirsrv_t; + ') + + allow $1 dirsrv_t:process signal; +') + + +######################################## +## +## Send a null signal to dirsrv. +## +## +## +## Domain allowed access. +## +## +# +interface(`dirsrv_signull',` + gen_require(` + type dirsrv_t; + ') + + allow $1 dirsrv_t:process signull; +') + +####################################### +## +## Allow a domain to manage dirsrv logs. +## +## +## +## Domain allowed access. +## +## +# +interface(`dirsrv_manage_log',` + gen_require(` + type dirsrv_var_log_t; + ') + + allow $1 dirsrv_var_log_t:dir manage_dir_perms; + allow $1 dirsrv_var_log_t:file manage_file_perms; + allow $1 dirsrv_var_log_t:fifo_file manage_fifo_file_perms; +') + +####################################### +## +## Allow a domain to manage dirsrv /var/lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`dirsrv_manage_var_lib',` + gen_require(` + type dirsrv_var_lib_t; + ') + allow $1 dirsrv_var_lib_t:dir manage_dir_perms; + allow $1 dirsrv_var_lib_t:file manage_file_perms; +') + +######################################## +## +## Connect to dirsrv over a unix stream socket. +## +## +## +## Domain allowed access. +## +## +# +interface(`dirsrv_stream_connect',` + gen_require(` + type dirsrv_t, dirsrv_var_run_t; + ') + + files_search_pids($1) + stream_connect_pattern($1, dirsrv_var_run_t, dirsrv_var_run_t, dirsrv_t) +') + +####################################### +## +## Allow a domain to manage dirsrv /var/run files. +## +## +## +## Domain allowed access. +## +## +# +interface(`dirsrv_manage_var_run',` + gen_require(` + type dirsrv_var_run_t; + ') + allow $1 dirsrv_var_run_t:dir manage_dir_perms; + allow $1 dirsrv_var_run_t:file manage_file_perms; + allow $1 dirsrv_var_run_t:sock_file manage_file_perms; +') + +###################################### +## +## Allow a domain to create dirsrv pid directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`dirsrv_pid_filetrans',` + gen_require(` + type dirsrv_var_run_t; + ') + # Allow creating a dir in /var/run with this type + files_pid_filetrans($1, dirsrv_var_run_t, dir) +') + +####################################### +## +## Allow a domain to read dirsrv /var/run files. +## +## +## +## Domain allowed access. +## +## +# +interface(`dirsrv_read_var_run',` + gen_require(` + type dirsrv_var_run_t; + ') + allow $1 dirsrv_var_run_t:dir list_dir_perms; + allow $1 dirsrv_var_run_t:file read_file_perms; +') + +######################################## +## +## Manage dirsrv configuration files. +## +## +## +## Domain allowed access. +## +## +# +interface(`dirsrv_manage_config',` + gen_require(` + type dirsrv_config_t; + ') + + allow $1 dirsrv_config_t:dir manage_dir_perms; + allow $1 dirsrv_config_t:file manage_file_perms; +') + +######################################## +## +## Read dirsrv share files. +## +## +## +## Domain allowed access. +## +## +# +interface(`dirsrv_read_share',` + gen_require(` + type dirsrv_share_t; + ') + + allow $1 dirsrv_share_t:dir list_dir_perms; + allow $1 dirsrv_share_t:file read_file_perms; + allow $1 dirsrv_share_t:lnk_file read; +') diff --git a/dirsrv.te b/dirsrv.te new file mode 100644 index 0000000..7f0b4f6 --- /dev/null +++ b/dirsrv.te @@ -0,0 +1,193 @@ +policy_module(dirsrv,1.0.0) + +######################################## +# +# Declarations +# + +# main daemon +type dirsrv_t; +type dirsrv_exec_t; +domain_type(dirsrv_t) +init_daemon_domain(dirsrv_t, dirsrv_exec_t) + +type dirsrv_snmp_t; +type dirsrv_snmp_exec_t; +domain_type(dirsrv_snmp_t) +init_daemon_domain(dirsrv_snmp_t, dirsrv_snmp_exec_t) + +type dirsrv_var_lib_t; +files_type(dirsrv_var_lib_t) + +type dirsrv_var_log_t; +logging_log_file(dirsrv_var_log_t) + +type dirsrv_snmp_var_log_t; +logging_log_file(dirsrv_snmp_var_log_t) + +type dirsrv_var_run_t; +files_pid_file(dirsrv_var_run_t) + +type dirsrv_snmp_var_run_t; +files_pid_file(dirsrv_snmp_var_run_t) + +type dirsrv_var_lock_t; +files_lock_file(dirsrv_var_lock_t) + +type dirsrv_config_t; +files_type(dirsrv_config_t) + +type dirsrv_tmp_t; +files_tmp_file(dirsrv_tmp_t) + +type dirsrv_tmpfs_t; +files_tmpfs_file(dirsrv_tmpfs_t) + +type dirsrv_share_t; +files_type(dirsrv_share_t); + +######################################## +# +# dirsrv local policy +# +allow dirsrv_t self:process { getsched setsched setfscreate signal_perms}; +allow dirsrv_t self:capability { sys_nice setuid setgid fsetid chown dac_override fowner }; +allow dirsrv_t self:fifo_file manage_fifo_file_perms; +allow dirsrv_t self:sem create_sem_perms; +allow dirsrv_t self:tcp_socket create_stream_socket_perms; + +manage_files_pattern(dirsrv_t, dirsrv_tmpfs_t, dirsrv_tmpfs_t) +fs_tmpfs_filetrans(dirsrv_t, dirsrv_tmpfs_t, file) + +manage_dirs_pattern(dirsrv_t, dirsrv_var_lib_t, dirsrv_var_lib_t) +manage_files_pattern(dirsrv_t, dirsrv_var_lib_t, dirsrv_var_lib_t) +manage_sock_files_pattern(dirsrv_t, dirsrv_var_lib_t, dirsrv_var_lib_t) +files_var_lib_filetrans(dirsrv_t,dirsrv_var_lib_t, { file dir sock_file }) + +manage_dirs_pattern(dirsrv_t, dirsrv_var_log_t, dirsrv_var_log_t) +manage_files_pattern(dirsrv_t, dirsrv_var_log_t, dirsrv_var_log_t) +manage_fifo_files_pattern(dirsrv_t, dirsrv_var_log_t, dirsrv_var_log_t) +allow dirsrv_t dirsrv_var_log_t:dir { setattr }; +logging_log_filetrans(dirsrv_t,dirsrv_var_log_t,{ sock_file file dir }) + +manage_dirs_pattern(dirsrv_t, dirsrv_var_run_t, dirsrv_var_run_t) +manage_files_pattern(dirsrv_t, dirsrv_var_run_t, dirsrv_var_run_t) +manage_sock_files_pattern(dirsrv_t, dirsrv_var_run_t, dirsrv_var_run_t) +files_pid_filetrans(dirsrv_t, dirsrv_var_run_t, { file dir sock_file }) + +manage_files_pattern(dirsrv_t, dirsrv_var_lock_t, dirsrv_var_lock_t) +manage_dirs_pattern(dirsrv_t, dirsrv_var_lock_t, dirsrv_var_lock_t) +files_lock_filetrans(dirsrv_t, dirsrv_var_lock_t, file) +files_setattr_lock_dirs(dirsrv_t) + +manage_files_pattern(dirsrv_t, dirsrv_config_t, dirsrv_config_t) +manage_dirs_pattern(dirsrv_t, dirsrv_config_t, dirsrv_config_t) +manage_lnk_files_pattern(dirsrv_t, dirsrv_config_t, dirsrv_config_t) + +manage_files_pattern(dirsrv_t, dirsrv_tmp_t, dirsrv_tmp_t) +manage_dirs_pattern(dirsrv_t, dirsrv_tmp_t, dirsrv_tmp_t) +files_tmp_filetrans(dirsrv_t, dirsrv_tmp_t, { file dir }) +allow dirsrv_t dirsrv_tmp_t:file relabel_file_perms; + +kernel_read_system_state(dirsrv_t) +kernel_read_kernel_sysctls(dirsrv_t) + +corecmd_search_bin(dirsrv_t) + +corenet_all_recvfrom_netlabel(dirsrv_t) +corenet_tcp_sendrecv_generic_if(dirsrv_t) +corenet_tcp_sendrecv_generic_node(dirsrv_t) +corenet_tcp_sendrecv_all_ports(dirsrv_t) +corenet_tcp_bind_generic_node(dirsrv_t) +corenet_tcp_bind_ldap_port(dirsrv_t) +corenet_tcp_bind_dogtag_port(dirsrv_t) +corenet_tcp_bind_all_rpc_ports(dirsrv_t) +corenet_udp_bind_all_rpc_ports(dirsrv_t) +corenet_tcp_connect_all_ports(dirsrv_t) +corenet_sendrecv_ldap_server_packets(dirsrv_t) +corenet_sendrecv_all_client_packets(dirsrv_t) + +dev_read_sysfs(dirsrv_t) +dev_read_urand(dirsrv_t) + +files_read_etc_files(dirsrv_t) +files_read_usr_symlinks(dirsrv_t) + +fs_getattr_all_fs(dirsrv_t) + +auth_use_pam(dirsrv_t) + +logging_send_syslog_msg(dirsrv_t) + +sysnet_dns_name_resolve(dirsrv_t) + +optional_policy(` + apache_dontaudit_leaks(dirsrv_t) +') + +optional_policy(` + dirsrvadmin_read_tmp(dirsrv_t) +') + + +optional_policy(` + kerberos_use(dirsrv_t) + kerberos_tmp_filetrans_host_rcache(dirsrv_t, "ldapmap1_0") + kerberos_tmp_filetrans_host_rcache(dirsrv_t, "ldap_487") + kerberos_tmp_filetrans_host_rcache(dirsrv_t, "ldap_55") +') + +# FIPS mode +optional_policy(` + prelink_exec(dirsrv_t) +') + +optional_policy(` + rpcbind_stream_connect(dirsrv_t) +') + +######################################## +# +# dirsrv-snmp local policy +# +allow dirsrv_snmp_t self:capability { dac_override dac_read_search }; +allow dirsrv_snmp_t self:fifo_file rw_fifo_file_perms; + +rw_files_pattern(dirsrv_snmp_t, dirsrv_tmpfs_t, dirsrv_tmpfs_t) + +read_files_pattern(dirsrv_snmp_t, dirsrv_var_run_t, dirsrv_var_run_t) + +read_files_pattern(dirsrv_snmp_t, dirsrv_config_t, dirsrv_config_t) + +manage_files_pattern(dirsrv_snmp_t, dirsrv_snmp_var_run_t, dirsrv_snmp_var_run_t) +files_pid_filetrans(dirsrv_snmp_t, dirsrv_snmp_var_run_t, { file sock_file }) +search_dirs_pattern(dirsrv_snmp_t, dirsrv_var_run_t, dirsrv_var_run_t) + +manage_files_pattern(dirsrv_snmp_t, dirsrv_var_log_t, dirsrv_snmp_var_log_t); +filetrans_pattern(dirsrv_snmp_t, dirsrv_var_log_t, dirsrv_snmp_var_log_t, file) + +corenet_tcp_connect_agentx_port(dirsrv_snmp_t) + +dev_read_rand(dirsrv_snmp_t) +dev_read_urand(dirsrv_snmp_t) + +domain_use_interactive_fds(dirsrv_snmp_t) + +#files_manage_var_files(dirsrv_snmp_t) +files_read_etc_files(dirsrv_snmp_t) +files_read_usr_files(dirsrv_snmp_t) + +fs_getattr_tmpfs(dirsrv_snmp_t) +fs_search_tmpfs(dirsrv_snmp_t) + + +sysnet_read_config(dirsrv_snmp_t) +sysnet_dns_name_resolve(dirsrv_snmp_t) + +optional_policy(` + snmp_dontaudit_read_snmp_var_lib_files(dirsrv_snmp_t) + snmp_dontaudit_write_snmp_var_lib_files(dirsrv_snmp_t) + snmp_manage_var_lib_dirs(dirsrv_snmp_t) + snmp_manage_var_lib_files(dirsrv_snmp_t) + snmp_stream_connect(dirsrv_snmp_t) +') diff --git a/distcc.te b/distcc.te index 54d93e8..16d2e18 100644 --- a/distcc.te +++ b/distcc.te @@ -44,7 +44,6 @@ files_pid_filetrans(distccd_t, distccd_var_run_t, file) kernel_read_system_state(distccd_t) kernel_read_kernel_sysctls(distccd_t) -corenet_all_recvfrom_unlabeled(distccd_t) corenet_all_recvfrom_netlabel(distccd_t) corenet_tcp_sendrecv_generic_if(distccd_t) corenet_udp_sendrecv_generic_if(distccd_t) @@ -73,8 +72,6 @@ libs_exec_lib_files(distccd_t) logging_send_syslog_msg(distccd_t) -miscfiles_read_localization(distccd_t) - sysnet_read_config(distccd_t) userdom_dontaudit_use_unpriv_user_fds(distccd_t) diff --git a/djbdns.if b/djbdns.if index ade3079..41a21f1 100644 --- a/djbdns.if +++ b/djbdns.if @@ -34,7 +34,6 @@ template(`djbdns_daemontools_domain_template',` allow djbdns_$1_t djbdns_$1_conf_t:dir list_dir_perms; allow djbdns_$1_t djbdns_$1_conf_t:file read_file_perms; - corenet_all_recvfrom_unlabeled(djbdns_$1_t) corenet_all_recvfrom_netlabel(djbdns_$1_t) corenet_tcp_sendrecv_generic_if(djbdns_$1_t) corenet_udp_sendrecv_generic_if(djbdns_$1_t) diff --git a/djbdns.te b/djbdns.te index 03b5286..62fbae1 100644 --- a/djbdns.te +++ b/djbdns.te @@ -39,6 +39,9 @@ allow djbdns_axfrdns_t djbdns_tinydns_conf_t:file read_file_perms; files_search_var(djbdns_axfrdns_t) +daemontools_ipc_domain(djbdns_axfrdns_t) +daemontools_read_svc(djbdns_axfrdns_t) + ucspitcp_service_domain(djbdns_axfrdns_t, djbdns_axfrdns_exec_t) ######################################## diff --git a/dkim.fc b/dkim.fc index bf4321a..1820764 100644 --- a/dkim.fc +++ b/dkim.fc @@ -9,6 +9,7 @@ /var/run/dkim-filter(/.*)? gen_context(system_u:object_r:dkim_milter_data_t,s0) /var/run/dkim-milter(/.*)? gen_context(system_u:object_r:dkim_milter_data_t,s0) /var/run/dkim-milter\.pid -- gen_context(system_u:object_r:dkim_milter_data_t,s0) + /var/run/opendkim(/.*)? gen_context(system_u:object_r:dkim_milter_data_t,s0) /var/spool/opendkim(/.*)? gen_context(system_u:object_r:dkim_milter_data_t,s0) diff --git a/dmidecode.te b/dmidecode.te index d6356b5..5db989e 100644 --- a/dmidecode.te +++ b/dmidecode.te @@ -27,4 +27,4 @@ files_list_usr(dmidecode_t) locallogin_use_fds(dmidecode_t) -userdom_use_user_terminals(dmidecode_t) +userdom_use_inherited_user_terminals(dmidecode_t) diff --git a/dnsmasq.fc b/dnsmasq.fc index b886676..3d5ca2b 100644 --- a/dnsmasq.fc +++ b/dnsmasq.fc @@ -1,12 +1,14 @@ /etc/dnsmasq\.conf -- gen_context(system_u:object_r:dnsmasq_etc_t, s0) /etc/rc\.d/init\.d/dnsmasq -- gen_context(system_u:object_r:dnsmasq_initrc_exec_t,s0) +/usr/lib/systemd/system/dnsmasq.* -- gen_context(system_u:object_r:dnsmasq_unit_file_t,s0) + /usr/sbin/dnsmasq -- gen_context(system_u:object_r:dnsmasq_exec_t,s0) /var/lib/misc/dnsmasq\.leases -- gen_context(system_u:object_r:dnsmasq_lease_t,s0) /var/lib/dnsmasq(/.*)? gen_context(system_u:object_r:dnsmasq_lease_t,s0) -/var/log/dnsmasq\.log gen_context(system_u:object_r:dnsmasq_var_log_t,s0) +/var/log/dnsmasq.* -- gen_context(system_u:object_r:dnsmasq_var_log_t,s0) /var/run/dnsmasq\.pid -- gen_context(system_u:object_r:dnsmasq_var_run_t,s0) /var/run/libvirt/network(/.*)? gen_context(system_u:object_r:dnsmasq_var_run_t,s0) diff --git a/dnsmasq.if b/dnsmasq.if index 9bd812b..53f895e 100644 --- a/dnsmasq.if +++ b/dnsmasq.if @@ -10,7 +10,6 @@ ## ## # -# interface(`dnsmasq_domtrans',` gen_require(` type dnsmasq_exec_t, dnsmasq_t; @@ -20,6 +19,24 @@ interface(`dnsmasq_domtrans',` domtrans_pattern($1, dnsmasq_exec_t, dnsmasq_t) ') +####################################### +## +## Execute dnsmasq server in the caller domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`dnsmasq_exec',` + gen_require(` + type dnsmasq_exec_t; + ') + + can_exec($1, dnsmasq_exec_t) +') + ######################################## ## ## Execute the dnsmasq init script in the init script domain. @@ -41,6 +58,29 @@ interface(`dnsmasq_initrc_domtrans',` ######################################## ## +## Execute dnsmasq server in the dnsmasq domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`dnsmasq_systemctl',` + gen_require(` + type dnsmasq_unit_file_t; + type dnsmasq_t; + ') + + systemd_exec_systemctl($1) + allow $1 dnsmasq_unit_file_t:file read_file_perms; + allow $1 dnsmasq_unit_file_t:service manage_service_perms; + + ps_process_pattern($1, dnsmasq_t) +') + +######################################## +## ## Send dnsmasq a signal ## ## @@ -144,18 +184,18 @@ interface(`dnsmasq_write_config',` ## ## # -# interface(`dnsmasq_delete_pid_files',` gen_require(` type dnsmasq_var_run_t; ') + files_search_pids($1) delete_files_pattern($1, dnsmasq_var_run_t, dnsmasq_var_run_t) ') ######################################## ## -## Read dnsmasq pid files +## Manage dnsmasq pid files ## ## ## @@ -163,17 +203,99 @@ interface(`dnsmasq_delete_pid_files',` ## ## # +interface(`dnsmasq_manage_pid_files',` + gen_require(` + type dnsmasq_var_run_t; + ') + + files_search_pids($1) + manage_files_pattern($1, dnsmasq_var_run_t, dnsmasq_var_run_t) +') + +######################################## +## +## Read dnsmasq pid files +## +## +## +## Domain allowed access. +## +## # interface(`dnsmasq_read_pid_files',` gen_require(` type dnsmasq_var_run_t; ') + files_search_pids($1) read_files_pattern($1, dnsmasq_var_run_t, dnsmasq_var_run_t) ') ######################################## ## +## Create dnsmasq pid dirs +## +## +## +## Domain allowed access. +## +## +# +interface(`dnsmasq_create_pid_dirs',` + gen_require(` + type dnsmasq_var_run_t; + ') + + files_search_pids($1) + create_dirs_pattern($1, dnsmasq_var_run_t, dnsmasq_var_run_t) +') + +######################################## +## +## Transition to dnsmasq named content +## +## +## +## Domain allowed access. +## +## +## +## +## The type of the directory for the object to be created. +## +## +# +interface(`dnsmasq_filetrans_named_content_fromdir',` + gen_require(` + type dnsmasq_var_run_t; + ') + + filetrans_pattern($1, $2, dnsmasq_var_run_t, dir, "network") + filetrans_pattern($1, $2, dnsmasq_var_run_t, file, "dnsmasq.pid") +') + +######################################## +## +## Transition to dnsmasq named content +## +## +## +## Domain allowed access. +## +## +# +interface(`dnsmasq_filetrans_named_content',` + gen_require(` + type dnsmasq_var_run_t; + ') + + files_pid_filetrans($1, dnsmasq_var_run_t, dir, "network") + files_pid_filetrans($1, dnsmasq_var_run_t, file, "dnsmasq.pid") + virt_pid_filetrans($1, dnsmasq_var_run_t, file, "network") +') + +######################################## +## ## All of the rules required to administrate ## an dnsmasq environment ## @@ -193,10 +315,14 @@ interface(`dnsmasq_admin',` gen_require(` type dnsmasq_t, dnsmasq_lease_t, dnsmasq_var_run_t; type dnsmasq_initrc_exec_t; + type dnsmasq_unit_file_t; ') - allow $1 dnsmasq_t:process { ptrace signal_perms }; + allow $1 dnsmasq_t:process signal_perms; ps_process_pattern($1, dnsmasq_t) + tunable_policy(`deny_ptrace',`',` + allow $1 dnsmasq_t:process ptrace; + ') init_labeled_script_domtrans($1, dnsmasq_initrc_exec_t) domain_system_change_exemption($1) @@ -208,4 +334,8 @@ interface(`dnsmasq_admin',` files_list_pids($1) admin_pattern($1, dnsmasq_var_run_t) + + dnsmasq_systemctl($1) + admin_pattern($1, dnsmasq_unit_file_t) + allow $1 dnsmasq_unit_file_t:service all_service_perms; ') diff --git a/dnsmasq.te b/dnsmasq.te index fdaeeba..2b18093 100644 --- a/dnsmasq.te +++ b/dnsmasq.te @@ -24,6 +24,9 @@ logging_log_file(dnsmasq_var_log_t) type dnsmasq_var_run_t; files_pid_file(dnsmasq_var_run_t) +type dnsmasq_unit_file_t; +systemd_unit_file(dnsmasq_unit_file_t) + ######################################## # # Local policy @@ -48,13 +51,15 @@ files_var_lib_filetrans(dnsmasq_t, dnsmasq_lease_t, file) manage_files_pattern(dnsmasq_t, dnsmasq_var_log_t, dnsmasq_var_log_t) logging_log_filetrans(dnsmasq_t, dnsmasq_var_log_t, file) +manage_dirs_pattern(dnsmasq_t, dnsmasq_var_run_t, dnsmasq_var_run_t) manage_files_pattern(dnsmasq_t, dnsmasq_var_run_t, dnsmasq_var_run_t) -files_pid_filetrans(dnsmasq_t, dnsmasq_var_run_t, file) +files_pid_filetrans(dnsmasq_t, dnsmasq_var_run_t, { dir file }) kernel_read_kernel_sysctls(dnsmasq_t) kernel_read_system_state(dnsmasq_t) +kernel_read_network_state(dnsmasq_t) +kernel_request_load_module(dnsmasq_t) -corenet_all_recvfrom_unlabeled(dnsmasq_t) corenet_all_recvfrom_netlabel(dnsmasq_t) corenet_tcp_sendrecv_generic_if(dnsmasq_t) corenet_udp_sendrecv_generic_if(dnsmasq_t) @@ -76,7 +81,6 @@ dev_read_urand(dnsmasq_t) domain_use_interactive_fds(dnsmasq_t) -files_read_etc_files(dnsmasq_t) files_read_etc_runtime_files(dnsmasq_t) fs_getattr_all_fs(dnsmasq_t) @@ -86,8 +90,6 @@ auth_use_nsswitch(dnsmasq_t) logging_send_syslog_msg(dnsmasq_t) -miscfiles_read_localization(dnsmasq_t) - userdom_dontaudit_use_unpriv_user_fds(dnsmasq_t) userdom_dontaudit_search_user_home_dirs(dnsmasq_t) @@ -96,7 +98,20 @@ optional_policy(` ') optional_policy(` + cron_manage_pid_files(dnsmasq_t) +') + +optional_policy(` dbus_system_bus_client(dnsmasq_t) + dbus_connect_system_bus(dnsmasq_t) +') + +optional_policy(` + networkmanager_read_pid_files(dnsmasq_t) +') + +optional_policy(` + ppp_read_pid_files(dnsmasq_t) ') optional_policy(` @@ -113,5 +128,7 @@ optional_policy(` optional_policy(` virt_manage_lib_files(dnsmasq_t) + virt_read_lib_files(dnsmasq_t) virt_read_pid_files(dnsmasq_t) + virt_pid_filetrans(dnsmasq_t, dnsmasq_var_run_t, { dir file }) ') diff --git a/dnssec.fc b/dnssec.fc new file mode 100644 index 0000000..9e231a8 --- /dev/null +++ b/dnssec.fc @@ -0,0 +1,3 @@ +/usr/sbin/dnssec-triggerd -- gen_context(system_u:object_r:dnssec_trigger_exec_t,s0) + +/var/run/dnssec.* gen_context(system_u:object_r:dnssec_trigger_var_run_t,s0) diff --git a/dnssec.if b/dnssec.if new file mode 100644 index 0000000..a952041 --- /dev/null +++ b/dnssec.if @@ -0,0 +1,64 @@ + +## policy for dnssec_trigger + +######################################## +## +## Transition to dnssec_trigger. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`dnssec_trigger_domtrans',` + gen_require(` + type dnssec_trigger_t, dnssec_trigger_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, dnssec_trigger_exec_t, dnssec_trigger_t) +') +######################################## +## +## Read dnssec_trigger PID files. +## +## +## +## Domain allowed access. +## +## +# +interface(`dnssec_trigger_read_pid_files',` + gen_require(` + type dnssec_trigger_var_run_t; + ') + + files_search_pids($1) + allow $1 dnssec_trigger_var_run_t:file read_file_perms; +') + + +######################################## +## +## All of the rules required to administrate +## an dnssec_trigger environment +## +## +## +## Domain allowed access. +## +## +# +interface(`dnssec_trigger_admin',` + gen_require(` + type dnssec_trigger_t; + type dnssec_trigger_var_run_t; + ') + + allow $1 dnssec_trigger_t:process { ptrace signal_perms }; + ps_process_pattern($1, dnssec_trigger_t) + + files_search_pids($1) + admin_pattern($1, dnssec_trigger_var_run_t) +') diff --git a/dnssec.te b/dnssec.te new file mode 100644 index 0000000..25daf6c --- /dev/null +++ b/dnssec.te @@ -0,0 +1,59 @@ +policy_module(dnssec, 1.0.0) + +######################################## +# +# Declarations +# + +type dnssec_trigger_t; +type dnssec_trigger_exec_t; +init_daemon_domain(dnssec_trigger_t, dnssec_trigger_exec_t) + +type dnssec_trigger_var_run_t; +files_pid_file(dnssec_trigger_var_run_t) + +######################################## +# +# dnssec_trigger local policy +# +allow dnssec_trigger_t self:capability linux_immutable; +allow dnssec_trigger_t self:process signal; +allow dnssec_trigger_t self:fifo_file rw_fifo_file_perms; +allow dnssec_trigger_t self:unix_stream_socket create_stream_socket_perms; +allow dnssec_trigger_t self:tcp_socket create_stream_socket_perms; +allow dnssec_trigger_t self:udp_socket create_socket_perms; + +manage_dirs_pattern(dnssec_trigger_t, dnssec_trigger_var_run_t, dnssec_trigger_var_run_t) +manage_files_pattern(dnssec_trigger_t, dnssec_trigger_var_run_t, dnssec_trigger_var_run_t) +files_pid_filetrans(dnssec_trigger_t, dnssec_trigger_var_run_t, { dir file }) + +kernel_read_system_state(dnssec_trigger_t) + +corecmd_exec_bin(dnssec_trigger_t) +corecmd_exec_shell(dnssec_trigger_t) + +corenet_tcp_bind_generic_node(dnssec_trigger_t) +corenet_tcp_bind_dnssec_port(dnssec_trigger_t) +corenet_tcp_connect_rndc_port(dnssec_trigger_t) +corenet_tcp_connect_http_port(dnssec_trigger_t) + +dev_read_urand(dnssec_trigger_t) + +domain_use_interactive_fds(dnssec_trigger_t) + +files_read_etc_runtime_files(dnssec_trigger_t) +files_read_etc_files(dnssec_trigger_t) + +logging_send_syslog_msg(dnssec_trigger_t) + +auth_read_passwd(dnssec_trigger_t) + +sysnet_dns_name_resolve(dnssec_trigger_t) +sysnet_manage_config(dnssec_trigger_t) + +optional_policy(` + bind_read_config(dnssec_trigger_t) + bind_read_dnssec_keys(dnssec_trigger_t) +') + + diff --git a/dovecot.fc b/dovecot.fc index 3a3ecb2..4448055 100644 --- a/dovecot.fc +++ b/dovecot.fc @@ -2,7 +2,7 @@ # # /etc # -/etc/dovecot(/.*)?* gen_context(system_u:object_r:dovecot_etc_t,s0) +/etc/dovecot(/.*)? gen_context(system_u:object_r:dovecot_etc_t,s0) /etc/dovecot\.conf.* gen_context(system_u:object_r:dovecot_etc_t,s0) /etc/dovecot\.passwd.* gen_context(system_u:object_r:dovecot_passwd_t,s0) @@ -24,12 +24,13 @@ ifdef(`distro_debian',` ifdef(`distro_debian', ` /usr/lib/dovecot/dovecot-auth -- gen_context(system_u:object_r:dovecot_auth_exec_t,s0) +/usr/lib/dovecot/deliver -- gen_context(system_u:object_r:dovecot_deliver_exec_t,s0) ') ifdef(`distro_redhat', ` /usr/libexec/dovecot/auth -- gen_context(system_u:object_r:dovecot_auth_exec_t,s0) /usr/libexec/dovecot/deliver -- gen_context(system_u:object_r:dovecot_deliver_exec_t,s0) -/usr/libexec/dovecot/deliver-lda -- gen_context(system_u:object_r:dovecot_deliver_exec_t,s0) +/usr/libexec/dovecot/dovecot-lda -- gen_context(system_u:object_r:dovecot_deliver_exec_t,s0) /usr/libexec/dovecot/dovecot-auth -- gen_context(system_u:object_r:dovecot_auth_exec_t,s0) ') @@ -37,6 +38,7 @@ ifdef(`distro_redhat', ` # /var # /var/run/dovecot(-login)?(/.*)? gen_context(system_u:object_r:dovecot_var_run_t,s0) +/var/run/dovecot/login/ssl-parameters.dat -- gen_context(system_u:object_r:dovecot_var_lib_t,s0) /var/lib/dovecot(/.*)? gen_context(system_u:object_r:dovecot_var_lib_t,s0) diff --git a/dovecot.if b/dovecot.if index e1d7dc5..df96c0d 100644 --- a/dovecot.if +++ b/dovecot.if @@ -1,5 +1,24 @@ ## Dovecot POP and IMAP mail server +####################################### +## +## Connect to dovecot unix domain stream socket. +## +## +## +## Domain allowed access. +## +## +# +interface(`dovecot_stream_connect',` + gen_require(` + type dovecot_t, dovecot_var_run_t; + ') + + files_search_pids($1) + stream_connect_pattern($1, dovecot_var_run_t, dovecot_var_run_t, dovecot_t) +') + ######################################## ## ## Connect to dovecot auth unix domain stream socket. @@ -16,6 +35,7 @@ interface(`dovecot_stream_connect_auth',` type dovecot_auth_t, dovecot_var_run_t; ') + files_search_pids($1) stream_connect_pattern($1, dovecot_var_run_t, dovecot_var_run_t, dovecot_auth_t) ') @@ -52,6 +72,7 @@ interface(`dovecot_manage_spool',` type dovecot_spool_t; ') + files_search_spool($1) manage_files_pattern($1, dovecot_spool_t, dovecot_spool_t) manage_lnk_files_pattern($1, dovecot_spool_t, dovecot_spool_t) ') @@ -74,6 +95,25 @@ interface(`dovecot_dontaudit_unlink_lib_files',` dontaudit $1 dovecot_var_lib_t:file unlink; ') +###################################### +## +## Allow attempts to write inherited +## dovecot tmp files. +## +## +## +## Domain to not audit. +## +## +# +interface(`dovecot_write_inherited_tmp_files',` + gen_require(` + type dovecot_tmp_t; + ') + + allow $1 dovecot_tmp_t:file write; +') + ######################################## ## ## All of the rules required to administrate @@ -93,16 +133,17 @@ interface(`dovecot_dontaudit_unlink_lib_files',` # interface(`dovecot_admin',` gen_require(` - type dovecot_t, dovecot_etc_t, dovecot_log_t; - type dovecot_spool_t, dovecot_var_lib_t; - type dovecot_var_run_t; - - type dovecot_cert_t, dovecot_passwd_t; - type dovecot_initrc_exec_t; + type dovecot_t, dovecot_etc_t, dovecot_auth_tmp_t; + type dovecot_spool_t, dovecot_var_lib_t, dovecot_var_log_t; + type dovecot_var_run_t, dovecot_tmp_t, dovecot_keytab_t; + type dovecot_cert_t, dovecot_passwd_t, dovecot_initrc_exec_t; ') - allow $1 dovecot_t:process { ptrace signal_perms }; + allow $1 dovecot_t:process signal_perms; ps_process_pattern($1, dovecot_t) + tunable_policy(`deny_ptrace',`',` + allow $1 dovecot_t:process ptrace; + ') init_labeled_script_domtrans($1, dovecot_initrc_exec_t) domain_system_change_exemption($1) @@ -112,8 +153,11 @@ interface(`dovecot_admin',` files_list_etc($1) admin_pattern($1, dovecot_etc_t) - logging_list_logs($1) - admin_pattern($1, dovecot_log_t) + files_list_tmp($1) + admin_pattern($1, dovecot_auth_tmp_t) + admin_pattern($1, dovecot_tmp_t) + + admin_pattern($1, dovecot_keytab_t) files_list_spool($1) admin_pattern($1, dovecot_spool_t) @@ -121,6 +165,9 @@ interface(`dovecot_admin',` files_list_var_lib($1) admin_pattern($1, dovecot_var_lib_t) + logging_search_logs($1) + admin_pattern($1, dovecot_var_log_t) + files_list_pids($1) admin_pattern($1, dovecot_var_run_t) diff --git a/dovecot.te b/dovecot.te index 2df7766..30a0afe 100644 --- a/dovecot.te +++ b/dovecot.te @@ -4,11 +4,13 @@ policy_module(dovecot, 1.14.0) # # Declarations # -type dovecot_t; +attribute dovecot_domain; + +type dovecot_t, dovecot_domain; type dovecot_exec_t; init_daemon_domain(dovecot_t, dovecot_exec_t) -type dovecot_auth_t; +type dovecot_auth_t, dovecot_domain; type dovecot_auth_exec_t; domain_type(dovecot_auth_t) domain_entry_file(dovecot_auth_t, dovecot_auth_exec_t) @@ -18,14 +20,17 @@ type dovecot_auth_tmp_t; files_tmp_file(dovecot_auth_tmp_t) type dovecot_cert_t; -files_type(dovecot_cert_t) +miscfiles_cert_type(dovecot_cert_t) -type dovecot_deliver_t; +type dovecot_deliver_t, dovecot_domain; type dovecot_deliver_exec_t; domain_type(dovecot_deliver_t) domain_entry_file(dovecot_deliver_t, dovecot_deliver_exec_t) role system_r types dovecot_deliver_t; +type dovecot_deliver_tmp_t; +files_tmp_file(dovecot_deliver_tmp_t) + type dovecot_etc_t; files_config_file(dovecot_etc_t) @@ -36,7 +41,7 @@ type dovecot_passwd_t; files_type(dovecot_passwd_t) type dovecot_spool_t; -files_type(dovecot_spool_t) +files_spool_file(dovecot_spool_t) type dovecot_tmp_t; files_tmp_file(dovecot_tmp_t) @@ -51,17 +56,37 @@ logging_log_file(dovecot_var_log_t) type dovecot_var_run_t; files_pid_file(dovecot_var_run_t) +####################################### +# +# dovecot domain local policy +# + +allow dovecot_domain self:capability2 block_suspend; + +allow dovecot_domain self:unix_dgram_socket create_socket_perms; +allow dovecot_domain self:fifo_file rw_fifo_file_perms; + +kernel_read_all_sysctls(dovecot_domain) +kernel_read_system_state(dovecot_domain) + +corecmd_exec_bin(dovecot_domain) + +dev_read_sysfs(dovecot_domain) +dev_read_rand(dovecot_domain) +dev_read_urand(dovecot_domain) + +# Dovecot now has quota support and it uses getmntent() to find the mountpoints. +files_read_etc_runtime_files(dovecot_domain) + ######################################## # # dovecot local policy # -allow dovecot_t self:capability { dac_override dac_read_search chown kill net_bind_service setgid setuid sys_chroot }; +allow dovecot_t self:capability { dac_override dac_read_search chown fsetid kill net_bind_service setgid setuid sys_chroot }; dontaudit dovecot_t self:capability sys_tty_config; -allow dovecot_t self:process { setrlimit signal_perms getcap setcap }; -allow dovecot_t self:fifo_file rw_fifo_file_perms; +allow dovecot_t self:process { setrlimit signal_perms getcap setcap setsched }; allow dovecot_t self:tcp_socket create_stream_socket_perms; -allow dovecot_t self:unix_dgram_socket create_socket_perms; allow dovecot_t self:unix_stream_socket { create_stream_socket_perms connectto }; domtrans_pattern(dovecot_t, dovecot_auth_exec_t, dovecot_auth_t) @@ -72,7 +97,9 @@ allow dovecot_t dovecot_cert_t:dir list_dir_perms; read_files_pattern(dovecot_t, dovecot_cert_t, dovecot_cert_t) read_lnk_files_pattern(dovecot_t, dovecot_cert_t, dovecot_cert_t) -allow dovecot_t dovecot_etc_t:file read_file_perms; +allow dovecot_t dovecot_etc_t:dir list_dir_perms; +read_files_pattern(dovecot_t, dovecot_etc_t, dovecot_etc_t) +read_lnk_files_pattern(dovecot_t, dovecot_etc_t, dovecot_etc_t) files_search_etc(dovecot_t) can_exec(dovecot_t, dovecot_exec_t) @@ -94,15 +121,13 @@ manage_dirs_pattern(dovecot_t, dovecot_spool_t, dovecot_spool_t) manage_files_pattern(dovecot_t, dovecot_spool_t, dovecot_spool_t) manage_lnk_files_pattern(dovecot_t, dovecot_spool_t, dovecot_spool_t) +manage_dirs_pattern(dovecot_t, dovecot_var_run_t, dovecot_var_run_t) manage_files_pattern(dovecot_t, dovecot_var_run_t, dovecot_var_run_t) manage_lnk_files_pattern(dovecot_t, dovecot_var_run_t, dovecot_var_run_t) manage_sock_files_pattern(dovecot_t, dovecot_var_run_t, dovecot_var_run_t) -files_pid_filetrans(dovecot_t, dovecot_var_run_t, file) - -kernel_read_kernel_sysctls(dovecot_t) -kernel_read_system_state(dovecot_t) +manage_fifo_files_pattern(dovecot_t, dovecot_var_run_t, dovecot_var_run_t) +files_pid_filetrans(dovecot_t, dovecot_var_run_t, { dir file fifo_file }) -corenet_all_recvfrom_unlabeled(dovecot_t) corenet_all_recvfrom_netlabel(dovecot_t) corenet_tcp_sendrecv_generic_if(dovecot_t) corenet_tcp_sendrecv_generic_node(dovecot_t) @@ -110,41 +135,36 @@ corenet_tcp_sendrecv_all_ports(dovecot_t) corenet_tcp_bind_generic_node(dovecot_t) corenet_tcp_bind_mail_port(dovecot_t) corenet_tcp_bind_pop_port(dovecot_t) +corenet_tcp_bind_lmtp_port(dovecot_t) corenet_tcp_bind_sieve_port(dovecot_t) corenet_tcp_connect_all_ports(dovecot_t) corenet_tcp_connect_postgresql_port(dovecot_t) corenet_sendrecv_pop_server_packets(dovecot_t) corenet_sendrecv_all_client_packets(dovecot_t) -dev_read_sysfs(dovecot_t) -dev_read_urand(dovecot_t) - fs_getattr_all_fs(dovecot_t) fs_getattr_all_dirs(dovecot_t) fs_search_auto_mountpoints(dovecot_t) fs_list_inotifyfs(dovecot_t) -corecmd_exec_bin(dovecot_t) - domain_use_interactive_fds(dovecot_t) -files_read_etc_files(dovecot_t) files_search_spool(dovecot_t) files_search_tmp(dovecot_t) files_dontaudit_list_default(dovecot_t) -# Dovecot now has quota support and it uses getmntent() to find the mountpoints. -files_read_etc_runtime_files(dovecot_t) +files_dontaudit_search_all_dirs(dovecot_t) files_search_all_mountpoints(dovecot_t) +files_read_var_lib_files(dovecot_t) init_getattr_utmp(dovecot_t) auth_use_nsswitch(dovecot_t) -logging_send_syslog_msg(dovecot_t) - miscfiles_read_generic_certs(dovecot_t) -miscfiles_read_localization(dovecot_t) +logging_send_syslog_msg(dovecot_t) + +userdom_home_manager(dovecot_t) userdom_dontaudit_use_unpriv_user_fds(dovecot_t) userdom_manage_user_home_content_dirs(dovecot_t) userdom_manage_user_home_content_files(dovecot_t) @@ -153,10 +173,23 @@ userdom_manage_user_home_content_pipes(dovecot_t) userdom_manage_user_home_content_sockets(dovecot_t) userdom_user_home_dir_filetrans_user_home_content(dovecot_t, { dir file lnk_file fifo_file sock_file }) -mta_manage_spool(dovecot_t) +optional_policy(` + mta_manage_home_rw(dovecot_t) + mta_manage_spool(dovecot_t) +') + +optional_policy(` + kerberos_keytab_template(dovecot_t, dovecot_t) + kerberos_tmp_filetrans_host_rcache(dovecot_t, "imap_0") +') + +optional_policy(` + gnome_manage_data(dovecot_t) +') optional_policy(` - kerberos_keytab_template(dovecot, dovecot_t) + postfix_manage_private_sockets(dovecot_t) + postfix_search_spool(dovecot_t) ') optional_policy(` @@ -164,6 +197,11 @@ optional_policy(` ') optional_policy(` + # Handle sieve scripts + sendmail_domtrans(dovecot_t) +') + +optional_policy(` seutil_sigchld_newrole(dovecot_t) ') @@ -180,16 +218,17 @@ optional_policy(` # dovecot auth local policy # -allow dovecot_auth_t self:capability { chown dac_override setgid setuid }; -allow dovecot_auth_t self:process { signal_perms getcap setcap }; -allow dovecot_auth_t self:fifo_file rw_fifo_file_perms; -allow dovecot_auth_t self:unix_dgram_socket create_socket_perms; +allow dovecot_auth_t self:capability { chown dac_override ipc_lock setgid setuid sys_nice }; +allow dovecot_auth_t self:process { getsched setsched signal_perms getcap setcap }; allow dovecot_auth_t self:unix_stream_socket create_stream_socket_perms; allow dovecot_auth_t dovecot_t:unix_stream_socket { connectto rw_stream_socket_perms }; read_files_pattern(dovecot_auth_t, dovecot_passwd_t, dovecot_passwd_t) +read_files_pattern(dovecot_auth_t, dovecot_etc_t, dovecot_etc_t) +read_lnk_files_pattern(dovecot_auth_t, dovecot_etc_t, dovecot_etc_t) + manage_dirs_pattern(dovecot_auth_t, dovecot_auth_tmp_t, dovecot_auth_tmp_t) manage_files_pattern(dovecot_auth_t, dovecot_auth_tmp_t, dovecot_auth_tmp_t) files_tmp_filetrans(dovecot_auth_t, dovecot_auth_tmp_t, { file dir }) @@ -198,32 +237,27 @@ allow dovecot_auth_t dovecot_var_run_t:dir list_dir_perms; manage_sock_files_pattern(dovecot_auth_t, dovecot_var_run_t, dovecot_var_run_t) dovecot_stream_connect_auth(dovecot_auth_t) -kernel_read_all_sysctls(dovecot_auth_t) -kernel_read_system_state(dovecot_auth_t) - logging_send_audit_msgs(dovecot_auth_t) -logging_send_syslog_msg(dovecot_auth_t) - -dev_read_urand(dovecot_auth_t) auth_domtrans_chk_passwd(dovecot_auth_t) auth_use_nsswitch(dovecot_auth_t) -files_read_etc_files(dovecot_auth_t) -files_read_etc_runtime_files(dovecot_auth_t) +logging_send_syslog_msg(dovecot_auth_t) + files_search_pids(dovecot_auth_t) files_read_usr_files(dovecot_auth_t) files_read_usr_symlinks(dovecot_auth_t) files_read_var_lib_files(dovecot_auth_t) files_search_tmp(dovecot_auth_t) -files_read_var_lib_files(dovecot_t) -init_rw_utmp(dovecot_auth_t) +fs_getattr_xattr_fs(dovecot_auth_t) -miscfiles_read_localization(dovecot_auth_t) +init_rw_utmp(dovecot_auth_t) seutil_dontaudit_search_config(dovecot_auth_t) +sysnet_use_ldap(dovecot_auth_t) + optional_policy(` kerberos_use(dovecot_auth_t) @@ -236,6 +270,8 @@ optional_policy(` optional_policy(` mysql_search_db(dovecot_auth_t) mysql_stream_connect(dovecot_auth_t) + mysql_read_config(dovecot_auth_t) + mysql_tcp_connect(dovecot_auth_t) ') optional_policy(` @@ -243,6 +279,8 @@ optional_policy(` ') optional_policy(` + postfix_manage_private_sockets(dovecot_auth_t) + postfix_rw_master_pipes(dovecot_deliver_t) postfix_search_spool(dovecot_auth_t) ') @@ -250,25 +288,32 @@ optional_policy(` # # dovecot deliver local policy # -allow dovecot_deliver_t self:unix_dgram_socket create_socket_perms; allow dovecot_deliver_t dovecot_t:process signull; -allow dovecot_deliver_t dovecot_etc_t:file read_file_perms; -allow dovecot_deliver_t dovecot_var_run_t:dir list_dir_perms; +allow dovecot_deliver_t dovecot_etc_t:dir list_dir_perms; +read_files_pattern(dovecot_deliver_t, dovecot_etc_t, dovecot_etc_t) +read_lnk_files_pattern(dovecot_deliver_t, dovecot_etc_t, dovecot_etc_t) + +allow dovecot_deliver_t dovecot_cert_t:dir search_dir_perms; -kernel_read_all_sysctls(dovecot_deliver_t) -kernel_read_system_state(dovecot_deliver_t) +append_files_pattern(dovecot_deliver_t, dovecot_var_log_t, dovecot_var_log_t) -files_read_etc_files(dovecot_deliver_t) -files_read_etc_runtime_files(dovecot_deliver_t) +manage_dirs_pattern(dovecot_deliver_t, dovecot_deliver_tmp_t, dovecot_deliver_tmp_t) +manage_files_pattern(dovecot_deliver_t, dovecot_deliver_tmp_t, dovecot_deliver_tmp_t) +files_tmp_filetrans(dovecot_deliver_t, dovecot_deliver_tmp_t, { file dir }) + +allow dovecot_deliver_t dovecot_var_run_t:dir list_dir_perms; +read_files_pattern(dovecot_deliver_t, dovecot_var_run_t, dovecot_var_run_t) +read_sock_files_pattern(dovecot_deliver_t, dovecot_var_run_t, dovecot_var_run_t) +dovecot_stream_connect(dovecot_deliver_t) + +can_exec(dovecot_deliver_t, dovecot_deliver_exec_t) auth_use_nsswitch(dovecot_deliver_t) +logging_append_all_logs(dovecot_deliver_t) logging_send_syslog_msg(dovecot_deliver_t) -logging_search_logs(dovecot_auth_t) - -miscfiles_read_localization(dovecot_deliver_t) dovecot_stream_connect_auth(dovecot_deliver_t) @@ -283,24 +328,23 @@ userdom_manage_user_home_content_pipes(dovecot_deliver_t) userdom_manage_user_home_content_sockets(dovecot_deliver_t) userdom_user_home_dir_filetrans_user_home_content(dovecot_deliver_t, { dir file lnk_file fifo_file sock_file }) -tunable_policy(`use_nfs_home_dirs',` - fs_manage_nfs_dirs(dovecot_deliver_t) - fs_manage_nfs_files(dovecot_deliver_t) - fs_manage_nfs_symlinks(dovecot_deliver_t) - fs_manage_nfs_dirs(dovecot_t) - fs_manage_nfs_files(dovecot_t) - fs_manage_nfs_symlinks(dovecot_t) -') +userdom_home_manager(dovecot_deliver_t) -tunable_policy(`use_samba_home_dirs',` - fs_manage_cifs_dirs(dovecot_deliver_t) - fs_manage_cifs_files(dovecot_deliver_t) - fs_manage_cifs_symlinks(dovecot_deliver_t) - fs_manage_cifs_dirs(dovecot_t) - fs_manage_cifs_files(dovecot_t) - fs_manage_cifs_symlinks(dovecot_t) +optional_policy(` + gnome_manage_data(dovecot_deliver_t) ') optional_policy(` mta_manage_spool(dovecot_deliver_t) + mta_read_queue(dovecot_deliver_t) + mta_manage_home_rw(dovecot_deliver_t) +') + +optional_policy(` + postfix_use_fds_master(dovecot_deliver_t) +') + +optional_policy(` + # Handle sieve scripts + sendmail_domtrans(dovecot_deliver_t) ') diff --git a/dpkg.if b/dpkg.if index 4d32b42..78736d8 100644 --- a/dpkg.if +++ b/dpkg.if @@ -62,11 +62,18 @@ interface(`dpkg_domtrans_script',` # interface(`dpkg_run',` gen_require(` - attribute_role dpkg_roles; + #attribute_role dpkg_roles; + type dpkg_t, dpkg_script_t; ') + #dpkg_domtrans($1) + #roleattribute $2 dpkg_roles; + dpkg_domtrans($1) - roleattribute $2 dpkg_roles; + role $2 types dpkg_t; + role $2 types dpkg_script_t; + seutil_run_loadpolicy(dpkg_script_t, $2) + ') ######################################## diff --git a/dpkg.te b/dpkg.te index 52725c4..934ce11 100644 --- a/dpkg.te +++ b/dpkg.te @@ -5,8 +5,8 @@ policy_module(dpkg, 1.10.0) # Declarations # -attribute_role dpkg_roles; -roleattribute system_r dpkg_roles; +#attribute_role dpkg_roles; +#roleattribute system_r dpkg_roles; type dpkg_t; type dpkg_exec_t; @@ -17,7 +17,8 @@ domain_obj_id_change_exemption(dpkg_t) domain_role_change_exemption(dpkg_t) domain_system_change_exemption(dpkg_t) domain_interactive_fd(dpkg_t) -role dpkg_roles types dpkg_t; +#role dpkg_roles types dpkg_t; +role system_r types dpkg_t; # lockfile type dpkg_lock_t; @@ -41,7 +42,8 @@ corecmd_shell_entry_type(dpkg_script_t) domain_obj_id_change_exemption(dpkg_script_t) domain_system_change_exemption(dpkg_script_t) domain_interactive_fd(dpkg_script_t) -role dpkg_roles types dpkg_script_t; +#role dpkg_roles types dpkg_script_t; +role system_r types dpkg_script_t; type dpkg_script_tmp_t; files_tmp_file(dpkg_script_tmp_t) @@ -92,7 +94,6 @@ kernel_read_kernel_sysctls(dpkg_t) corecmd_exec_all_executables(dpkg_t) # TODO: do we really need all networking? -corenet_all_recvfrom_unlabeled(dpkg_t) corenet_all_recvfrom_netlabel(dpkg_t) corenet_tcp_sendrecv_generic_if(dpkg_t) corenet_raw_sendrecv_generic_if(dpkg_t) @@ -152,9 +153,12 @@ files_exec_etc_files(dpkg_t) init_domtrans_script(dpkg_t) init_use_script_ptys(dpkg_t) +#libs_exec_ld_so(dpkg_t) +#libs_exec_lib_files(dpkg_t) +#libs_run_ldconfig(dpkg_t, dpkg_roles) libs_exec_ld_so(dpkg_t) libs_exec_lib_files(dpkg_t) -libs_run_ldconfig(dpkg_t, dpkg_roles) +libs_domtrans_ldconfig(dpkg_t) logging_send_syslog_msg(dpkg_t) @@ -195,20 +199,30 @@ domain_signal_all_domains(dpkg_t) domain_signull_all_domains(dpkg_t) files_read_etc_runtime_files(dpkg_t) files_exec_usr_files(dpkg_t) -miscfiles_read_localization(dpkg_t) -modutils_run_depmod(dpkg_t, dpkg_roles) -modutils_run_insmod(dpkg_t, dpkg_roles) -seutil_run_loadpolicy(dpkg_t, dpkg_roles) -seutil_run_setfiles(dpkg_t, dpkg_roles) +#modutils_run_depmod(dpkg_t, dpkg_roles) +#modutils_run_insmod(dpkg_t, dpkg_roles) +#seutil_run_loadpolicy(dpkg_t, dpkg_roles) +#seutil_run_setfiles(dpkg_t, dpkg_roles) userdom_use_all_users_fds(dpkg_t) optional_policy(` mta_send_mail(dpkg_t) ') + + optional_policy(` - usermanage_run_groupadd(dpkg_t, dpkg_roles) - usermanage_run_useradd(dpkg_t, dpkg_roles) + modutils_domtrans_depmod(dpkg_t) + modutils_domtrans_insmod(dpkg_t) + seutil_domtrans_loadpolicy(dpkg_t) + seutil_domtrans_setfiles(dpkg_t) + usermanage_domtrans_groupadd(dpkg_t) + usermanage_domtrans_useradd(dpkg_t) ') +#optional_policy(` +# usermanage_run_groupadd(dpkg_t, dpkg_roles) +# usermanage_run_useradd(dpkg_t, dpkg_roles) +#') + ######################################## # # dpkg-script Local policy @@ -296,21 +310,20 @@ init_use_script_fds(dpkg_script_t) libs_exec_ld_so(dpkg_script_t) libs_exec_lib_files(dpkg_script_t) -libs_run_ldconfig(dpkg_script_t, dpkg_roles) +libs_domtrans_ldconfig(dpkg_script_t) +#libs_run_ldconfig(dpkg_script_t, dpkg_roles) logging_send_syslog_msg(dpkg_script_t) -miscfiles_read_localization(dpkg_script_t) - -modutils_run_depmod(dpkg_script_t, dpkg_roles) -modutils_run_insmod(dpkg_script_t, dpkg_roles) +#modutils_run_depmod(dpkg_script_t, dpkg_roles) +#modutils_run_insmod(dpkg_script_t, dpkg_roles) -seutil_run_loadpolicy(dpkg_script_t, dpkg_roles) -seutil_run_setfiles(dpkg_script_t, dpkg_roles) +#seutil_run_loadpolicy(dpkg_script_t, dpkg_roles) +#seutil_run_setfiles(dpkg_script_t, dpkg_roles) userdom_use_all_users_fds(dpkg_script_t) -tunable_policy(`allow_execmem',` +tunable_policy(`selinuxuser_execmem',` allow dpkg_script_t self:process execmem; ') @@ -319,9 +332,9 @@ optional_policy(` apt_use_fds(dpkg_script_t) ') -optional_policy(` - bootloader_run(dpkg_script_t, dpkg_roles) -') +#optional_policy(` +# bootloader_run(dpkg_script_t, dpkg_roles) +#') optional_policy(` mta_send_mail(dpkg_script_t) @@ -335,7 +348,7 @@ optional_policy(` unconfined_domain(dpkg_script_t) ') -optional_policy(` - usermanage_run_groupadd(dpkg_script_t, dpkg_roles) - usermanage_run_useradd(dpkg_script_t, dpkg_roles) -') +#optional_policy(` +# usermanage_run_groupadd(dpkg_script_t, dpkg_roles) +# usermanage_run_useradd(dpkg_script_t, dpkg_roles) +#') diff --git a/drbd.fc b/drbd.fc new file mode 100644 index 0000000..60c19b9 --- /dev/null +++ b/drbd.fc @@ -0,0 +1,12 @@ + +/sbin/drbdadm -- gen_context(system_u:object_r:drbd_exec_t,s0) +/sbin/drbdsetup -- gen_context(system_u:object_r:drbd_exec_t,s0) + +/usr/lib/ocf/resource.\d/linbit/drbd -- gen_context(system_u:object_r:drbd_exec_t,s0) + +/usr/sbin/drbdadm -- gen_context(system_u:object_r:drbd_exec_t,s0) +/usr/sbin/drbdsetup -- gen_context(system_u:object_r:drbd_exec_t,s0) + +/var/lib/drbd(/.*)? gen_context(system_u:object_r:drbd_var_lib_t,s0) + + diff --git a/drbd.if b/drbd.if new file mode 100644 index 0000000..659d051 --- /dev/null +++ b/drbd.if @@ -0,0 +1,127 @@ + +## policy for drbd + +######################################## +## +## Execute a domain transition to run drbd. +## +## +## +## Domain allowed access. +## +## +# +interface(`drbd_domtrans',` + gen_require(` + type drbd_t, drbd_exec_t; + ') + + domtrans_pattern($1, drbd_exec_t, drbd_t) +') + +######################################## +## +## Search drbd lib directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`drbd_search_lib',` + gen_require(` + type drbd_var_lib_t; + ') + + allow $1 drbd_var_lib_t:dir search_dir_perms; + files_search_var_lib($1) +') + +######################################## +## +## Read drbd lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`drbd_read_lib_files',` + gen_require(` + type drbd_var_lib_t; + ') + + files_search_var_lib($1) + read_files_pattern($1, drbd_var_lib_t, drbd_var_lib_t) +') + +######################################## +## +## Create, read, write, and delete +## drbd lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`drbd_manage_lib_files',` + gen_require(` + type drbd_var_lib_t; + ') + + files_search_var_lib($1) + manage_files_pattern($1, drbd_var_lib_t, drbd_var_lib_t) +') + +######################################## +## +## Manage drbd lib dirs files. +## +## +## +## Domain allowed access. +## +## +# +interface(`drbd_manage_lib_dirs',` + gen_require(` + type drbd_var_lib_t; + ') + + files_search_var_lib($1) + manage_dirs_pattern($1, drbd_var_lib_t, drbd_var_lib_t) +') + + +######################################## +## +## All of the rules required to administrate +## an drbd environment +## +## +## +## Domain allowed access. +## +## +# +interface(`drbd_admin',` + gen_require(` + type drbd_t; + type drbd_var_lib_t; + ') + + allow $1 drbd_t:process signal_perms; + ps_process_pattern($1, drbd_t) + tunable_policy(`deny_ptrace',`',` + allow $1 drbd_t:process ptrace; + ') + + files_search_var_lib($1) + admin_pattern($1, drbd_var_lib_t) + +') + diff --git a/drbd.te b/drbd.te new file mode 100644 index 0000000..2f3efe7 --- /dev/null +++ b/drbd.te @@ -0,0 +1,51 @@ +policy_module(drbd, 1.0.0) + +######################################## +# +# Declarations +# + +type drbd_t; +type drbd_exec_t; +init_daemon_domain(drbd_t, drbd_exec_t) + +type drbd_var_lib_t; +files_type(drbd_var_lib_t) + +type drbd_lock_t; +files_lock_file(drbd_lock_t) + +######################################## +# +# drbd local policy +# + +allow drbd_t self:capability { kill net_admin }; +dontaudit drbd_t self:capability sys_tty_config; +allow drbd_t self:fifo_file rw_fifo_file_perms; +allow drbd_t self:unix_stream_socket create_stream_socket_perms; +allow drbd_t self:netlink_socket create_socket_perms; +allow drbd_t self:netlink_route_socket rw_netlink_socket_perms; + +manage_dirs_pattern(drbd_t, drbd_var_lib_t, drbd_var_lib_t) +manage_files_pattern(drbd_t, drbd_var_lib_t, drbd_var_lib_t) +manage_lnk_files_pattern(drbd_t, drbd_var_lib_t, drbd_var_lib_t) +files_var_lib_filetrans(drbd_t, drbd_var_lib_t, { dir file } ) + +manage_files_pattern(drbd_t, drbd_lock_t, drbd_lock_t) +files_lock_filetrans(drbd_t, drbd_lock_t, file) + +can_exec(drbd_t, drbd_exec_t) + +kernel_read_system_state(drbd_t) + +dev_read_sysfs(drbd_t) +dev_read_rand(drbd_t) +dev_read_urand(drbd_t) + +files_read_etc_files(drbd_t) + +storage_raw_read_fixed_disk(drbd_t) + + +sysnet_dns_name_resolve(drbd_t) diff --git a/dspam.fc b/dspam.fc new file mode 100644 index 0000000..cc0815b --- /dev/null +++ b/dspam.fc @@ -0,0 +1,16 @@ + +/etc/rc\.d/init\.d/dspam -- gen_context(system_u:object_r:dspam_initrc_exec_t,s0) + +/usr/bin/dspam -- gen_context(system_u:object_r:dspam_exec_t,s0) + +/var/lib/dspam(/.*)? gen_context(system_u:object_r:dspam_var_lib_t,s0) + +/var/log/dspam(/.*)? gen_context(system_u:object_r:dspam_log_t,s0) + +/var/run/dspam(/.*)? gen_context(system_u:object_r:dspam_var_run_t,s0) + +# web + +/usr/share/dspam-web/dspam\.cgi -- gen_context(system_u:object_r:httpd_dspam_script_exec_t,s0) + +/var/lib/dspam/data(/.*)? gen_context(system_u:object_r:httpd_dspam_content_rw_t,s0) diff --git a/dspam.if b/dspam.if new file mode 100644 index 0000000..a446210 --- /dev/null +++ b/dspam.if @@ -0,0 +1,267 @@ + +## policy for dspam + + +######################################## +## +## Execute a domain transition to run dspam. +## +## +## +## Domain allowed access. +## +## +# +interface(`dspam_domtrans',` + gen_require(` + type dspam_t, dspam_exec_t; + ') + + domtrans_pattern($1, dspam_exec_t, dspam_t) +') + + +######################################## +## +## Execute dspam server in the dspam domain. +## +## +## +## The type of the process performing this action. +## +## +# +interface(`dspam_initrc_domtrans',` + gen_require(` + type dspam_initrc_exec_t; + ') + + init_labeled_script_domtrans($1, dspam_initrc_exec_t) +') + +######################################## +## +## Allow the specified domain to read dspam's log files. +## +## +## +## Domain allowed access. +## +## +## +# +interface(`dspam_read_log',` + gen_require(` + type dspam_log_t; + ') + + logging_search_logs($1) + read_files_pattern($1, dspam_log_t, dspam_log_t) +') + +######################################## +## +## Allow the specified domain to append +## dspam log files. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`dspam_append_log',` + gen_require(` + type dspam_log_t; + ') + + logging_search_logs($1) + append_files_pattern($1, dspam_log_t, dspam_log_t) +') + +######################################## +## +## Allow domain to manage dspam log files +## +## +## +## Domain to not audit. +## +## +# +interface(`dspam_manage_log',` + gen_require(` + type dspam_log_t; + ') + + logging_search_logs($1) + manage_dirs_pattern($1, dspam_log_t, dspam_log_t) + manage_files_pattern($1, dspam_log_t, dspam_log_t) + manage_lnk_files_pattern($1, dspam_log_t, dspam_log_t) +') + +######################################## +## +## Search dspam lib directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`dspam_search_lib',` + gen_require(` + type dspam_var_lib_t; + ') + + allow $1 dspam_var_lib_t:dir search_dir_perms; + files_search_var_lib($1) +') + +######################################## +## +## Read dspam lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`dspam_read_lib_files',` + gen_require(` + type dspam_var_lib_t; + ') + + files_search_var_lib($1) + read_files_pattern($1, dspam_var_lib_t, dspam_var_lib_t) +') + +######################################## +## +## Create, read, write, and delete +## dspam lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`dspam_manage_lib_files',` + gen_require(` + type dspam_var_lib_t; + ') + + files_search_var_lib($1) + manage_files_pattern($1, dspam_var_lib_t, dspam_var_lib_t) +') + +######################################## +## +## Manage dspam lib dirs files. +## +## +## +## Domain allowed access. +## +## +# +interface(`dspam_manage_lib_dirs',` + gen_require(` + type dspam_var_lib_t; + ') + + files_search_var_lib($1) + manage_dirs_pattern($1, dspam_var_lib_t, dspam_var_lib_t) +') + + +######################################## +## +## Read dspam PID files. +## +## +## +## Domain allowed access. +## +## +# +interface(`dspam_read_pid_files',` + gen_require(` + type dspam_var_run_t; + ') + + files_search_pids($1) + allow $1 dspam_var_run_t:file read_file_perms; +') + +####################################### +## +## Connect to DSPAM using a unix domain stream socket. +## +## +## +## Domain allowed access. +## +## +# +interface(`dspam_stream_connect',` + gen_require(` + type dspam_t, dspam_var_run_t, dspam_tmp_t; + ') + + files_search_pids($1) + files_search_tmp($1) + stream_connect_pattern($1, dspam_var_run_t, dspam_var_run_t, dspam_t) + stream_connect_pattern($1, dspam_tmp_t, dspam_tmp_t, dspam_t) +') + +######################################## +## +## All of the rules required to administrate +## an dspam environment +## +## +## +## Domain allowed access. +## +## +## +## +## Role allowed access. +## +## +## +# +interface(`dspam_admin',` + gen_require(` + type dspam_t; + type dspam_initrc_exec_t; + type dspam_log_t; + type dspam_var_lib_t; + type dspam_var_run_t; + ') + + allow $1 dspam_t:process signal_perms; + ps_process_pattern($1, dspam_t) + tunable_policy(`deny_ptrace',`',` + allow $1 dspam_t:process ptrace; + ') + + dspam_initrc_domtrans($1) + domain_system_change_exemption($1) + role_transition $2 dspam_initrc_exec_t system_r; + allow $2 system_r; + + logging_search_logs($1) + admin_pattern($1, dspam_log_t) + + files_search_var_lib($1) + admin_pattern($1, dspam_var_lib_t) + + files_search_pids($1) + admin_pattern($1, dspam_var_run_t) + +') diff --git a/dspam.te b/dspam.te new file mode 100644 index 0000000..a37d7ea --- /dev/null +++ b/dspam.te @@ -0,0 +1,90 @@ + +policy_module(dspam, 1.0.0) + +######################################## +# +# Declarations +# + +type dspam_t; +type dspam_exec_t; +init_daemon_domain(dspam_t, dspam_exec_t) + +type dspam_initrc_exec_t; +init_script_file(dspam_initrc_exec_t) + +type dspam_log_t; +logging_log_file(dspam_log_t) + +type dspam_var_lib_t; +files_type(dspam_var_lib_t) + +type dspam_var_run_t; +files_pid_file(dspam_var_run_t) + +# FIXME +# /tmp/dspam.sock +type dspam_tmp_t; +files_tmp_file(dspam_tmp_t) + +######################################## +# +# dspam local policy +# + +allow dspam_t self:capability net_admin; + +allow dspam_t self:process { signal }; + +allow dspam_t self:fifo_file rw_fifo_file_perms; +allow dspam_t self:unix_stream_socket create_stream_socket_perms; + +manage_dirs_pattern(dspam_t, dspam_log_t, dspam_log_t) +manage_files_pattern(dspam_t, dspam_log_t, dspam_log_t) + +manage_dirs_pattern(dspam_t, dspam_var_lib_t, dspam_var_lib_t) +manage_files_pattern(dspam_t, dspam_var_lib_t, dspam_var_lib_t) + +manage_dirs_pattern(dspam_t, dspam_var_run_t, dspam_var_run_t) +manage_files_pattern(dspam_t, dspam_var_run_t, dspam_var_run_t) + +manage_sock_files_pattern(dspam_t, dspam_tmp_t, dspam_tmp_t) +files_tmp_filetrans(dspam_t, dspam_tmp_t, { sock_file }) + +# need to add the port tcp/10026 to corenetwork.te.in +#allow dspam_t port_t:tcp_socket name_connect; + + +auth_use_nsswitch(dspam_t) + +# for RHEL5 +libs_use_ld_so(dspam_t) +libs_use_shared_libs(dspam_t) +libs_read_lib_files(dspam_t) + +logging_send_syslog_msg(dspam_t) + +optional_policy(` + mysql_tcp_connect(dspam_t) + mysql_search_db(dspam_t) + mysql_stream_connect(dspam_t) +') + +optional_policy(` + postgresql_tcp_connect(dspam_t) + postgresql_stream_connect(dspam_t) +') + +####################################### +# +# dspam web local policy. +# + +optional_policy(` + apache_content_template(dspam) + + list_dirs_pattern(dspam_t, httpd_dspam_content_t, httpd_dspam_content_t) + manage_dirs_pattern(dspam_t, httpd_dspam_content_rw_t, httpd_dspam_content_rw_t) + manage_files_pattern(dspam_t, httpd_dspam_content_rw_t, httpd_dspam_content_rw_t) +') + diff --git a/entropyd.te b/entropyd.te index b6ac808..5061237 100644 --- a/entropyd.te +++ b/entropyd.te @@ -42,7 +42,6 @@ dev_write_urand(entropyd_t) dev_read_rand(entropyd_t) dev_write_rand(entropyd_t) -files_read_etc_files(entropyd_t) files_read_usr_files(entropyd_t) fs_getattr_all_fs(entropyd_t) @@ -52,7 +51,7 @@ domain_use_interactive_fds(entropyd_t) logging_send_syslog_msg(entropyd_t) -miscfiles_read_localization(entropyd_t) +auth_use_nsswitch(entropyd_t) userdom_dontaudit_use_unpriv_user_fds(entropyd_t) userdom_dontaudit_search_user_home_dirs(entropyd_t) diff --git a/evolution.te b/evolution.te index 73cb712..2c6f3bc 100644 --- a/evolution.te +++ b/evolution.te @@ -146,7 +146,6 @@ corecmd_exec_shell(evolution_t) # Run various programs corecmd_exec_bin(evolution_t) -corenet_all_recvfrom_unlabeled(evolution_t) corenet_all_recvfrom_netlabel(evolution_t) corenet_tcp_sendrecv_generic_if(evolution_t) corenet_udp_sendrecv_generic_if(evolution_t) @@ -181,19 +180,17 @@ dev_read_urand(evolution_t) domain_dontaudit_read_all_domains_state(evolution_t) -files_read_etc_files(evolution_t) files_read_usr_files(evolution_t) files_read_usr_symlinks(evolution_t) files_read_var_files(evolution_t) fs_search_auto_mountpoints(evolution_t) -logging_send_syslog_msg(evolution_t) +auth_use_nsswitch(evolution_t) -miscfiles_read_localization(evolution_t) +logging_send_syslog_msg(evolution_t) sysnet_read_config(evolution_t) -sysnet_dns_name_resolve(evolution_t) udev_read_state(evolution_t) @@ -201,7 +198,7 @@ userdom_rw_user_tmp_files(evolution_t) userdom_manage_user_tmp_dirs(evolution_t) userdom_manage_user_tmp_sockets(evolution_t) userdom_manage_user_tmp_files(evolution_t) -userdom_use_user_terminals(evolution_t) +userdom_use_inherited_user_terminals(evolution_t) # FIXME: suppress access to .local/.icons/.themes until properly implemented # FIXME: suppress access to .gaim/blist.xml (buddy list synchronization) # until properly implemented @@ -357,12 +354,12 @@ allow evolution_alarm_t evolution_server_orbit_tmp_t:sock_file write; dev_read_urand(evolution_alarm_t) -files_read_etc_files(evolution_alarm_t) files_read_usr_files(evolution_alarm_t) fs_search_auto_mountpoints(evolution_alarm_t) -miscfiles_read_localization(evolution_alarm_t) +auth_use_nsswitch(evolution_alarm_t) + # Access evolution home userdom_search_user_home_dirs(evolution_alarm_t) @@ -439,13 +436,13 @@ corecmd_exec_bin(evolution_exchange_t) dev_read_urand(evolution_exchange_t) -files_read_etc_files(evolution_exchange_t) files_read_usr_files(evolution_exchange_t) # Access evolution home fs_search_auto_mountpoints(evolution_exchange_t) -miscfiles_read_localization(evolution_exchange_t) +auth_use_nsswitch(evolution_exchange_t) + userdom_write_user_tmp_sockets(evolution_exchange_t) # Access evolution home @@ -506,7 +503,6 @@ kernel_read_system_state(evolution_server_t) corecmd_exec_shell(evolution_server_t) # Obtain weather data via http (read server name from xml file in /usr) -corenet_all_recvfrom_unlabeled(evolution_server_t) corenet_all_recvfrom_netlabel(evolution_server_t) corenet_tcp_sendrecv_generic_if(evolution_server_t) corenet_tcp_sendrecv_generic_node(evolution_server_t) @@ -519,19 +515,18 @@ corenet_sendrecv_http_cache_client_packets(evolution_server_t) dev_read_urand(evolution_server_t) -files_read_etc_files(evolution_server_t) # Obtain weather data via http (read server name from xml file in /usr) files_read_usr_files(evolution_server_t) fs_search_auto_mountpoints(evolution_server_t) -miscfiles_read_localization(evolution_server_t) +auth_use_nsswitch(evolution_server_t) + # Look in /etc/pki miscfiles_read_generic_certs(evolution_server_t) # Talk to ldap (address book) sysnet_read_config(evolution_server_t) -sysnet_dns_name_resolve(evolution_server_t) sysnet_use_ldap(evolution_server_t) # Access evolution home @@ -573,7 +568,6 @@ allow evolution_webcal_t evolution_webcal_tmpfs_t:sock_file manage_sock_file_per allow evolution_webcal_t evolution_webcal_tmpfs_t:fifo_file manage_fifo_file_perms; fs_tmpfs_filetrans(evolution_webcal_t, evolution_webcal_tmpfs_t, { dir file lnk_file sock_file fifo_file }) -corenet_all_recvfrom_unlabeled(evolution_webcal_t) corenet_all_recvfrom_netlabel(evolution_webcal_t) corenet_tcp_sendrecv_generic_if(evolution_webcal_t) corenet_raw_sendrecv_generic_if(evolution_webcal_t) @@ -586,9 +580,9 @@ corenet_tcp_connect_http_port(evolution_webcal_t) corenet_sendrecv_http_client_packets(evolution_webcal_t) corenet_sendrecv_http_cache_client_packets(evolution_webcal_t) -# Networking capability - connect to website and handle ics link +auth_use_nsswitch(evolution_webcal_t) + sysnet_read_config(evolution_webcal_t) -sysnet_dns_name_resolve(evolution_webcal_t) # Search home directory (?) userdom_search_user_home_dirs(evolution_webcal_t) diff --git a/exim.fc b/exim.fc index 298f066..02c2561 100644 --- a/exim.fc +++ b/exim.fc @@ -1,4 +1,9 @@ + +/etc/rc\.d/init\.d/exim -- gen_context(system_u:object_r:exim_initrc_exec_t,s0) + /usr/sbin/exim[0-9]? -- gen_context(system_u:object_r:exim_exec_t,s0) +/usr/sbin/exim_tidydb -- gen_context(system_u:object_r:exim_exec_t,s0) + /var/log/exim[0-9]?(/.*)? gen_context(system_u:object_r:exim_log_t,s0) /var/run/exim[0-9]?\.pid -- gen_context(system_u:object_r:exim_var_run_t,s0) /var/spool/exim[0-9]?(/.*)? gen_context(system_u:object_r:exim_spool_t,s0) diff --git a/exim.if b/exim.if index 6bef7f8..ba138e8 100644 --- a/exim.if +++ b/exim.if @@ -20,6 +20,49 @@ interface(`exim_domtrans',` ######################################## ## +## Execute the mailman program in the mailman domain. +## +## +## +## Domain allowed to transition. +## +## +## +## +## The role to allow the mailman domain. +## +## +## +# +interface(`exim_run',` + gen_require(` + type exim_t; + ') + + exim_domtrans($1) + role $2 types exim_t; +') + +######################################## +## +## Execute exim in the exim domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`exim_initrc_domtrans',` + gen_require(` + type exim_initrc_exec_t; + ') + + init_labeled_script_domtrans($1, exim_initrc_exec_t) +') + +######################################## +## ## Do not audit attempts to read, ## exim tmp files ## @@ -194,3 +237,49 @@ interface(`exim_manage_spool_files',` manage_files_pattern($1, exim_spool_t, exim_spool_t) files_search_spool($1) ') + +######################################## +## +## All of the rules required to administrate +## an exim environment. +## +## +## +## Domain allowed access. +## +## +## +## +## Role allowed access. +## +## +# +interface(`exim_admin',` + gen_require(` + type exim_t, exim_initrc_exec_t, exim_log_t; + type exim_tmp_t, exim_spool_t, exim_var_run_t; + ') + + allow $1 exim_t:process signal_perms; + ps_process_pattern($1, exim_t) + tunable_policy(`deny_ptrace',`',` + allow $1 exim_t:process ptrace; + ') + + exim_initrc_domtrans($1) + domain_system_change_exemption($1) + role_transition $2 exim_initrc_exec_t system_r; + allow $2 system_r; + + logging_list_logs($1) + admin_pattern($1, exim_log_t) + + files_list_tmp($1) + admin_pattern($1, exim_tmp_t) + + files_list_spool($1) + admin_pattern($1, exim_spool_t) + + files_list_pids($1) + admin_pattern($1, exim_var_run_t) +') diff --git a/exim.te b/exim.te index f28f64b..91758d5 100644 --- a/exim.te +++ b/exim.te @@ -35,11 +35,14 @@ mta_mailserver_user_agent(exim_t) application_executable_file(exim_exec_t) mta_agent_executable(exim_exec_t) +type exim_initrc_exec_t; +init_script_file(exim_initrc_exec_t) + type exim_log_t; logging_log_file(exim_log_t) type exim_spool_t; -files_type(exim_spool_t) +files_spool_file(exim_spool_t) type exim_tmp_t; files_tmp_file(exim_tmp_t) @@ -79,11 +82,10 @@ files_pid_filetrans(exim_t, exim_var_run_t, { file dir }) kernel_read_kernel_sysctls(exim_t) kernel_read_network_state(exim_t) -kernel_dontaudit_read_system_state(exim_t) +kernel_read_system_state(exim_t) corecmd_search_bin(exim_t) -corenet_all_recvfrom_unlabeled(exim_t) corenet_all_recvfrom_netlabel(exim_t) corenet_tcp_sendrecv_generic_if(exim_t) corenet_udp_sendrecv_generic_if(exim_t) @@ -108,7 +110,7 @@ domain_use_interactive_fds(exim_t) files_search_usr(exim_t) files_search_var(exim_t) -files_read_etc_files(exim_t) +files_read_usr_files(exim_t) files_read_etc_runtime_files(exim_t) files_getattr_all_mountpoints(exim_t) @@ -119,7 +121,6 @@ auth_use_nsswitch(exim_t) logging_send_syslog_msg(exim_t) -miscfiles_read_localization(exim_t) miscfiles_read_generic_certs(exim_t) userdom_dontaudit_search_user_home_dirs(exim_t) @@ -162,6 +163,10 @@ optional_policy(` ') optional_policy(` + dovecot_stream_connect(exim_t) +') + +optional_policy(` kerberos_keytab_template(exim, exim_t) ') @@ -171,6 +176,10 @@ optional_policy(` ') optional_policy(` + nagios_search_spool(exim_t) +') + +optional_policy(` tunable_policy(`exim_can_connect_db',` mysql_stream_connect(exim_t) ') @@ -184,6 +193,7 @@ optional_policy(` optional_policy(` procmail_domtrans(exim_t) + procmail_read_home_files(exim_t) ') optional_policy(` diff --git a/fail2ban.fc b/fail2ban.fc index 0de2b83..6de0fca 100644 --- a/fail2ban.fc +++ b/fail2ban.fc @@ -4,5 +4,5 @@ /usr/bin/fail2ban-server -- gen_context(system_u:object_r:fail2ban_exec_t,s0) /var/lib/fail2ban(/.*)? gen_context(system_u:object_r:fail2ban_var_lib_t,s0) -/var/log/fail2ban\.log -- gen_context(system_u:object_r:fail2ban_log_t,s0) +/var/log/fail2ban\.log.* -- gen_context(system_u:object_r:fail2ban_log_t,s0) /var/run/fail2ban.* gen_context(system_u:object_r:fail2ban_var_run_t,s0) diff --git a/fail2ban.if b/fail2ban.if index f590a1f..b1b13b0 100644 --- a/fail2ban.if +++ b/fail2ban.if @@ -40,7 +40,26 @@ interface(`fail2ban_stream_connect',` ######################################## ## -## Read and write to an fail2ban unix stream socket. +## Read and write inherited temporary files. +## +## +## +## Domain allowed access. +## +## +# +interface(`fail2ban_rw_inherited_tmp_files',` + gen_require(` + type fail2ban_tmp_t; + ') + + files_search_tmp($1) + allow $1 fail2ban_tmp_t:file rw_inherited_file_perms; +') + +######################################## +## +## Read and write to an fail2ba unix stream socket. ## ## ## @@ -72,7 +91,7 @@ interface(`fail2ban_read_lib_files',` ') files_search_var_lib($1) - allow $1 fail2ban_var_lib_t:file read_file_perms; + read_files_pattern($1, fail2ban_var_lib_t, fail2ban_var_lib_t) ') ######################################## @@ -138,6 +157,26 @@ interface(`fail2ban_read_pid_files',` ######################################## ## +## dontaudit read and write an leaked file descriptors +## +## +## +## Domain to not audit. +## +## +# +interface(`fail2ban_dontaudit_leaks',` + gen_require(` + type fail2ban_t; + ') + + dontaudit $1 fail2ban_t:tcp_socket { read write }; + dontaudit $1 fail2ban_t:unix_dgram_socket { read write }; + dontaudit $1 fail2ban_t:unix_stream_socket { read write }; +') + +######################################## +## ## All of the rules required to administrate ## an fail2ban environment ## @@ -155,12 +194,16 @@ interface(`fail2ban_read_pid_files',` # interface(`fail2ban_admin',` gen_require(` - type fail2ban_t, fail2ban_log_t; - type fail2ban_var_run_t, fail2ban_initrc_exec_t; + type fail2ban_t, fail2ban_log_t, fail2ban_initrc_exec_t; + type fail2ban_var_run_t, fail2ban_var_lib_t, fail2ban_tmp_t; + type fail2ban_client_t; ') - allow $1 fail2ban_t:process { ptrace signal_perms }; - ps_process_pattern($1, fail2ban_t) + allow $1 { fail2ban_t fail2ban_client_t }:process signal_perms; + ps_process_pattern($1, { fail2ban_t fail2ban_client_t }) + tunable_policy(`deny_ptrace',`',` + allow $1 { fail2ban_t fail2ban_client_t }:process ptrace; + ') init_labeled_script_domtrans($1, fail2ban_initrc_exec_t) domain_system_change_exemption($1) @@ -172,4 +215,10 @@ interface(`fail2ban_admin',` files_list_pids($1) admin_pattern($1, fail2ban_var_run_t) + + files_list_var_lib($1) + admin_pattern($1, fail2ban_var_lib_t) + + files_list_tmp($1) + admin_pattern($1, fail2ban_tmp_t) ') diff --git a/fail2ban.te b/fail2ban.te index 2a69e5e..5dccf2c 100644 --- a/fail2ban.te +++ b/fail2ban.te @@ -23,12 +23,19 @@ files_type(fail2ban_var_lib_t) type fail2ban_var_run_t; files_pid_file(fail2ban_var_run_t) +type fail2ban_tmp_t; +files_tmp_file(fail2ban_tmp_t) + +type fail2ban_client_t; +type fail2ban_client_exec_t; +init_daemon_domain(fail2ban_client_t, fail2ban_client_exec_t) + ######################################## # -# fail2ban local policy +# fail2ban server local policy # -allow fail2ban_t self:capability { sys_tty_config }; +allow fail2ban_t self:capability { dac_read_search dac_override sys_tty_config }; allow fail2ban_t self:process signal; allow fail2ban_t self:fifo_file rw_fifo_file_perms; allow fail2ban_t self:unix_stream_socket { connectto create_stream_socket_perms }; @@ -36,7 +43,7 @@ allow fail2ban_t self:unix_dgram_socket create_socket_perms; allow fail2ban_t self:tcp_socket create_stream_socket_perms; # log files -allow fail2ban_t fail2ban_log_t:dir setattr; +allow fail2ban_t fail2ban_log_t:dir setattr_dir_perms; manage_files_pattern(fail2ban_t, fail2ban_log_t, fail2ban_log_t) logging_log_filetrans(fail2ban_t, fail2ban_log_t, file) @@ -50,12 +57,16 @@ manage_sock_files_pattern(fail2ban_t, fail2ban_var_run_t, fail2ban_var_run_t) manage_files_pattern(fail2ban_t, fail2ban_var_run_t, fail2ban_var_run_t) files_pid_filetrans(fail2ban_t, fail2ban_var_run_t, { dir file sock_file }) +manage_dirs_pattern(fail2ban_t, fail2ban_tmp_t, fail2ban_tmp_t) +manage_files_pattern(fail2ban_t, fail2ban_tmp_t, fail2ban_tmp_t) +exec_files_pattern(fail2ban_t, fail2ban_tmp_t, fail2ban_tmp_t) +files_tmp_filetrans(fail2ban_t, fail2ban_tmp_t, { dir file }) + kernel_read_system_state(fail2ban_t) corecmd_exec_bin(fail2ban_t) corecmd_exec_shell(fail2ban_t) -corenet_all_recvfrom_unlabeled(fail2ban_t) corenet_all_recvfrom_netlabel(fail2ban_t) corenet_tcp_sendrecv_generic_if(fail2ban_t) corenet_tcp_sendrecv_generic_node(fail2ban_t) @@ -66,8 +77,8 @@ corenet_sendrecv_whois_client_packets(fail2ban_t) dev_read_urand(fail2ban_t) domain_use_interactive_fds(fail2ban_t) +domain_dontaudit_read_all_domains_state(fail2ban_t) -files_read_etc_files(fail2ban_t) files_read_etc_runtime_files(fail2ban_t) files_read_usr_files(fail2ban_t) files_list_var(fail2ban_t) @@ -81,10 +92,11 @@ auth_use_nsswitch(fail2ban_t) logging_read_all_logs(fail2ban_t) logging_send_syslog_msg(fail2ban_t) -miscfiles_read_localization(fail2ban_t) - mta_send_mail(fail2ban_t) +sysnet_manage_config(fail2ban_t) +sysnet_filetrans_named_content(fail2ban_t) + optional_policy(` apache_read_log(fail2ban_t) ') @@ -94,5 +106,43 @@ optional_policy(` ') optional_policy(` + gnome_dontaudit_search_config(fail2ban_t) +') + +optional_policy(` iptables_domtrans(fail2ban_t) ') + +optional_policy(` + libs_exec_ldconfig(fail2ban_t) +') + +optional_policy(` + shorewall_domtrans(fail2ban_t) +') + +######################################## +# +# fail2ban client local policy +# + +domtrans_pattern(fail2ban_client_t, fail2ban_exec_t, fail2ban_t) + +stream_connect_pattern(fail2ban_client_t, fail2ban_var_run_t, fail2ban_var_run_t, fail2ban_t) + +kernel_read_system_state(fail2ban_client_t) + +# python +corecmd_exec_bin(fail2ban_client_t) + +# nsswitch.conf, passwd +files_read_usr_files(fail2ban_client_t) +files_search_pids(fail2ban_client_t) + +auth_read_passwd(fail2ban_client_t) + + +optional_policy(` + gnome_dontaudit_search_config(fail2ban_client_t) +') + diff --git a/fcoemon.fc b/fcoemon.fc new file mode 100644 index 0000000..83279fb --- /dev/null +++ b/fcoemon.fc @@ -0,0 +1,5 @@ + +/usr/sbin/fcoemon -- gen_context(system_u:object_r:fcoemon_exec_t,s0) + +/var/run/fcm(/.*)? gen_context(system_u:object_r:fcoemon_var_run_t,s0) +/var/run/fcoemon\.pid -- gen_context(system_u:object_r:fcoemon_var_run_t,s0) diff --git a/fcoemon.if b/fcoemon.if new file mode 100644 index 0000000..33508c1 --- /dev/null +++ b/fcoemon.if @@ -0,0 +1,88 @@ + +## policy for fcoemon + +######################################## +## +## Transition to fcoemon. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`fcoemon_domtrans',` + gen_require(` + type fcoemon_t, fcoemon_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, fcoemon_exec_t, fcoemon_t) +') + + +######################################## +## +## Read fcoemon PID files. +## +## +## +## Domain allowed access. +## +## +# +interface(`fcoemon_read_pid_files',` + gen_require(` + type fcoemon_var_run_t; + ') + + files_search_pids($1) + allow $1 fcoemon_var_run_t:file read_file_perms; +') + +####################################### +## +## Send to a fcoemon unix dgram socket. +## +## +## +## Domain allowed access. +## +## +# +interface(`fcoemon_dgram_send',` + gen_require(` + type fcoemon_t; + ') + + allow $1 fcoemon_t:unix_dgram_socket sendto; +') + +######################################## +## +## All of the rules required to administrate +## an fcoemon environment +## +## +## +## Domain allowed access. +## +## +# +interface(`fcoemon_admin',` + gen_require(` + type fcoemon_t; + type fcoemon_var_run_t; + ') + + allow $1 fcoemon_t:process signal_perms; + ps_process_pattern($1, fcoemon_t) + tunable_policy(`deny_ptrace',`',` + allow $1 fcoemon_t:process ptrace; + ') + + files_search_pids($1) + admin_pattern($1, fcoemon_var_run_t) + +') + diff --git a/fcoemon.te b/fcoemon.te new file mode 100644 index 0000000..724ca0d --- /dev/null +++ b/fcoemon.te @@ -0,0 +1,44 @@ +policy_module(fcoemon, 1.0.0) + +######################################## +# +# Declarations +# + +type fcoemon_t; +type fcoemon_exec_t; +init_daemon_domain(fcoemon_t, fcoemon_exec_t) + +type fcoemon_var_run_t; +files_pid_file(fcoemon_var_run_t) + +######################################## +# +# fcoemon local policy +# + +# dac_override +# /var/rnn/fcm/fcm_clif socket is owned by root +allow fcoemon_t self:capability { net_admin dac_override }; +allow fcoemon_t self:capability { kill }; + +allow fcoemon_t self:fifo_file rw_fifo_file_perms; +allow fcoemon_t self:unix_stream_socket create_stream_socket_perms; +allow fcoemon_t self:netlink_socket create_socket_perms; +allow fcoemon_t self:netlink_route_socket create_netlink_socket_perms; + +manage_dirs_pattern(fcoemon_t, fcoemon_var_run_t, fcoemon_var_run_t) +manage_files_pattern(fcoemon_t, fcoemon_var_run_t, fcoemon_var_run_t) +manage_sock_files_pattern(fcoemon_t, fcoemon_var_run_t, fcoemon_var_run_t) +files_pid_filetrans(fcoemon_t, fcoemon_var_run_t, { dir file sock_file }) + +files_read_etc_files(fcoemon_t) + +dev_read_sysfs(fcoemon_t) + +logging_send_syslog_msg(fcoemon_t) + +optional_policy(` + lldpad_dgram_send(fcoemon_t) +') + diff --git a/fetchmail.fc b/fetchmail.fc index 39928d5..65dc228 100644 --- a/fetchmail.fc +++ b/fetchmail.fc @@ -1,3 +1,9 @@ +# +# /HOME +# +HOME_DIR/\.fetchmailrc -- gen_context(system_u:object_r:fetchmail_home_t, s0) +/root/\.fetchmailrc -- gen_context(system_u:object_r:fetchmail_home_t, s0) + # # /etc diff --git a/fetchmail.if b/fetchmail.if index 6537214..8629354 100644 --- a/fetchmail.if +++ b/fetchmail.if @@ -18,7 +18,11 @@ interface(`fetchmail_admin',` type fetchmail_var_run_t; ') + allow $1 fetchmail_t:process signal_perms; ps_process_pattern($1, fetchmail_t) + tunable_policy(`deny_ptrace',`',` + allow $1 fetchmail_t:process ptrace; + ') files_list_etc($1) admin_pattern($1, fetchmail_etc_t) diff --git a/fetchmail.te b/fetchmail.te index ac6626e..18ef6a0 100644 --- a/fetchmail.te +++ b/fetchmail.te @@ -10,6 +10,9 @@ type fetchmail_exec_t; init_daemon_domain(fetchmail_t, fetchmail_exec_t) application_executable_file(fetchmail_exec_t) +type fetchmail_home_t; +userdom_user_home_content(fetchmail_home_t) + type fetchmail_var_run_t; files_pid_file(fetchmail_var_run_t) @@ -41,6 +44,11 @@ manage_dirs_pattern(fetchmail_t, fetchmail_var_run_t, fetchmail_var_run_t) manage_files_pattern(fetchmail_t, fetchmail_var_run_t, fetchmail_var_run_t) files_pid_filetrans(fetchmail_t, fetchmail_var_run_t, { dir file }) +list_dirs_pattern(fetchmail_t, fetchmail_home_t, fetchmail_home_t) +read_files_pattern(fetchmail_t, fetchmail_home_t, fetchmail_home_t) +userdom_search_user_home_dirs(fetchmail_t) +userdom_search_admin_dir(fetchmail_t) + kernel_read_kernel_sysctls(fetchmail_t) kernel_list_proc(fetchmail_t) kernel_getattr_proc_files(fetchmail_t) @@ -51,7 +59,6 @@ kernel_dontaudit_read_system_state(fetchmail_t) corecmd_exec_bin(fetchmail_t) corecmd_exec_shell(fetchmail_t) -corenet_all_recvfrom_unlabeled(fetchmail_t) corenet_all_recvfrom_netlabel(fetchmail_t) corenet_tcp_sendrecv_generic_if(fetchmail_t) corenet_udp_sendrecv_generic_if(fetchmail_t) @@ -79,7 +86,6 @@ domain_use_interactive_fds(fetchmail_t) logging_send_syslog_msg(fetchmail_t) -miscfiles_read_localization(fetchmail_t) miscfiles_read_generic_certs(fetchmail_t) sysnet_read_config(fetchmail_t) @@ -88,6 +94,10 @@ userdom_dontaudit_use_unpriv_user_fds(fetchmail_t) userdom_dontaudit_search_user_home_dirs(fetchmail_t) optional_policy(` + kerberos_use(fetchmail_t) +') + +optional_policy(` procmail_domtrans(fetchmail_t) ') diff --git a/finger.te b/finger.te index 9b7036a..864b94a 100644 --- a/finger.te +++ b/finger.te @@ -46,7 +46,6 @@ logging_log_filetrans(fingerd_t, fingerd_log_t, file) kernel_read_kernel_sysctls(fingerd_t) kernel_read_system_state(fingerd_t) -corenet_all_recvfrom_unlabeled(fingerd_t) corenet_all_recvfrom_netlabel(fingerd_t) corenet_tcp_sendrecv_generic_if(fingerd_t) corenet_udp_sendrecv_generic_if(fingerd_t) @@ -66,6 +65,7 @@ term_getattr_all_ttys(fingerd_t) term_getattr_all_ptys(fingerd_t) auth_read_lastlog(fingerd_t) +auth_use_nsswitch(fingerd_t) corecmd_exec_bin(fingerd_t) corecmd_exec_shell(fingerd_t) @@ -73,7 +73,6 @@ corecmd_exec_shell(fingerd_t) domain_use_interactive_fds(fingerd_t) files_search_home(fingerd_t) -files_read_etc_files(fingerd_t) files_read_etc_runtime_files(fingerd_t) init_read_utmp(fingerd_t) @@ -85,7 +84,6 @@ mta_getattr_spool(fingerd_t) sysnet_read_config(fingerd_t) -miscfiles_read_localization(fingerd_t) # stop it accessing sub-directories, prevents checking a Maildir for new mail, # have to change this when we create a type for Maildir diff --git a/firewalld.fc b/firewalld.fc new file mode 100644 index 0000000..f440549 --- /dev/null +++ b/firewalld.fc @@ -0,0 +1,13 @@ + +/etc/rc\.d/init\.d/firewalld -- gen_context(system_u:object_r:firewalld_initrc_exec_t,s0) + +/etc/firewalld(/.*)? gen_context(system_u:object_r:firewalld_etc_rw_t,s0) + +/usr/lib/systemd/system/firewalld.* -- gen_context(system_u:object_r:firewalld_unit_file_t,s0) + +/usr/sbin/firewalld -- gen_context(system_u:object_r:firewalld_exec_t,s0) + +/var/log/firewalld -- gen_context(system_u:object_r:firewalld_var_log_t,s0) + +/var/run/firewalld(/.*)? gen_context(system_u:object_r:firewalld_var_run_t,s0) +/var/run/firewalld\.pid -- gen_context(system_u:object_r:firewalld_var_run_t,s0) diff --git a/firewalld.if b/firewalld.if new file mode 100644 index 0000000..c4c7510 --- /dev/null +++ b/firewalld.if @@ -0,0 +1,130 @@ +## policy for firewalld + +######################################## +## +## Execute a domain transition to run firewalld. +## +## +## +## Domain allowed access. +## +## +# +interface(`firewalld_domtrans',` + gen_require(` + type firewalld_t, firewalld_exec_t; + ') + + domtrans_pattern($1, firewalld_exec_t, firewalld_t) +') + + +######################################## +## +## Execute firewalld server in the firewalld domain. +## +## +## +## The type of the process performing this action. +## +## +# +interface(`firewalld_initrc_domtrans',` + gen_require(` + type firewalld_initrc_exec_t; + ') + + init_labeled_script_domtrans($1, firewalld_initrc_exec_t) +') + +######################################## +## +## Execute firewalld server in the firewalld domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`firewalld_systemctl',` + gen_require(` + type firewalld_t; + type firewalld_unit_file_t; + ') + + systemd_exec_systemctl($1) + allow $1 firewalld_unit_file_t:file read_file_perms; + allow $1 firewalld_unit_file_t:service manage_service_perms; + + ps_process_pattern($1, firewalld_t) +') + +######################################## +## +## Send and receive messages from +## firewalld over dbus. +## +## +## +## Domain allowed access. +## +## +# +interface(`firewalld_dbus_chat',` + gen_require(` + type firewalld_t; + class dbus send_msg; + ') + + allow $1 firewalld_t:dbus send_msg; + allow firewalld_t $1:dbus send_msg; +') + +######################################## +## +## All of the rules required to administrate +## an firewalld environment +## +## +## +## Domain allowed access. +## +## +## +## +## Role allowed access. +## +## +## +# +interface(`firewalld_admin',` + gen_require(` + type firewalld_t, firewalld_initrc_exec_t; + type firewall_etc_rw_t, firewalld_var_run_t; + type firewalld_var_log_t; + ') + + allow $1 firewalld_t:process signal_perms; + ps_process_pattern($1, firewalld_t) + tunable_policy(`deny_ptrace',`',` + allow $1 firewalld_t:process ptrace; + ') + + firewalld_initrc_domtrans($1) + domain_system_change_exemption($1) + role_transition $2 firewalld_initrc_exec_t system_r; + allow $2 system_r; + + files_search_pids($1) + admin_pattern($1, firewalld_var_run_t) + + logging_search_logs($1) + admin_pattern($1, firewalld_var_log_t) + + admin_pattern($1, firewall_etc_rw_t) + + admin_pattern($1, firewalld_unit_file_t) + firewalld_systemctl($1) + allow $1 firewalld_unit_file_t:service all_service_perms; +') diff --git a/firewalld.te b/firewalld.te new file mode 100644 index 0000000..1ee400c --- /dev/null +++ b/firewalld.te @@ -0,0 +1,89 @@ + +policy_module(firewalld,1.0.0) + +######################################## +# +# Declarations +# + +type firewalld_t; +type firewalld_exec_t; +init_daemon_domain(firewalld_t, firewalld_exec_t) + +type firewalld_initrc_exec_t; +init_script_file(firewalld_initrc_exec_t) + +type firewalld_etc_rw_t; +files_config_file(firewalld_etc_rw_t) + +type firewalld_var_log_t; +logging_log_file(firewalld_var_log_t) + +type firewalld_var_run_t; +files_pid_file(firewalld_var_run_t) + +type firewalld_unit_file_t; +systemd_unit_file(firewalld_unit_file_t) + +######################################## +# +# firewalld local policy +# +dontaudit firewalld_t self:capability sys_tty_config; +allow firewalld_t self:fifo_file rw_fifo_file_perms; +allow firewalld_t self:unix_stream_socket create_stream_socket_perms; + +manage_dirs_pattern(firewalld_t, firewalld_etc_rw_t, firewalld_etc_rw_t) +manage_files_pattern(firewalld_t, firewalld_etc_rw_t, firewalld_etc_rw_t) + +append_files_pattern(firewalld_t, firewalld_var_log_t, firewalld_var_log_t) +create_files_pattern(firewalld_t, firewalld_var_log_t, firewalld_var_log_t) +read_files_pattern(firewalld_t, firewalld_var_log_t, firewalld_var_log_t) +setattr_files_pattern(firewalld_t, firewalld_var_log_t, firewalld_var_log_t) +logging_log_filetrans(firewalld_t, firewalld_var_log_t, file) + +# should be fixed to cooperate with systemd to create /var/run/firewalld directory +manage_files_pattern(firewalld_t, firewalld_var_run_t, firewalld_var_run_t) +files_pid_filetrans(firewalld_t, firewalld_var_run_t, { file }) + +kernel_read_network_state(firewalld_t) +kernel_read_system_state(firewalld_t) + +corecmd_exec_bin(firewalld_t) +corecmd_exec_shell(firewalld_t) + +dev_read_urand(firewalld_t) + +domain_use_interactive_fds(firewalld_t) + +files_read_etc_files(firewalld_t) +files_read_usr_files(firewalld_t) + +fs_getattr_xattr_fs(firewalld_t) + +auth_read_passwd(firewalld_t) + +logging_send_syslog_msg(firewalld_t) + +seutil_exec_setfiles(firewalld_t) +seutil_read_file_contexts(firewalld_t) + +optional_policy(` + dbus_system_domain(firewalld_t, firewalld_exec_t) + + optional_policy(` + policykit_dbus_chat(firewalld_t) + ') + + optional_policy(` + networkmanager_dbus_chat(firewalld_t) + ') +') + +optional_policy(` + iptables_domtrans(firewalld_t) +') + +optional_policy(` + modutils_domtrans_insmod(firewalld_t) +') diff --git a/firewallgui.fc b/firewallgui.fc new file mode 100644 index 0000000..ce498b3 --- /dev/null +++ b/firewallgui.fc @@ -0,0 +1,3 @@ + +/usr/share/system-config-firewall/system-config-firewall-mechanism.py -- gen_context(system_u:object_r:firewallgui_exec_t,s0) + diff --git a/firewallgui.if b/firewallgui.if new file mode 100644 index 0000000..2bd5790 --- /dev/null +++ b/firewallgui.if @@ -0,0 +1,41 @@ + +## policy for firewallgui + +######################################## +## +## Send and receive messages from +## firewallgui over dbus. +## +## +## +## Domain allowed access. +## +## +# +interface(`firewallgui_dbus_chat',` + gen_require(` + type firewallgui_t; + class dbus send_msg; + ') + + allow $1 firewallgui_t:dbus send_msg; + allow firewallgui_t $1:dbus send_msg; +') + +######################################## +## +## Read and write firewallgui unnamed pipes. +## +## +## +## Domain to not audit. +## +## +# +interface(`firewallgui_dontaudit_rw_pipes',` + gen_require(` + type firewallgui_t; + ') + + dontaudit $1 firewallgui_t:fifo_file rw_inherited_fifo_file_perms; +') diff --git a/firewallgui.te b/firewallgui.te new file mode 100644 index 0000000..6bd855e --- /dev/null +++ b/firewallgui.te @@ -0,0 +1,73 @@ +policy_module(firewallgui,1.0.0) + +######################################## +# +# Declarations +# + +type firewallgui_t; +type firewallgui_exec_t; +dbus_system_domain(firewallgui_t, firewallgui_exec_t) +init_daemon_domain(firewallgui_t, firewallgui_exec_t) + +type firewallgui_tmp_t; +files_tmp_file(firewallgui_tmp_t) + +######################################## +# +# firewallgui local policy +# + +allow firewallgui_t self:capability { net_admin sys_rawio } ; +allow firewallgui_t self:fifo_file rw_fifo_file_perms; + +manage_files_pattern(firewallgui_t,firewallgui_tmp_t,firewallgui_tmp_t) +manage_dirs_pattern(firewallgui_t,firewallgui_tmp_t,firewallgui_tmp_t) +files_tmp_filetrans(firewallgui_t,firewallgui_tmp_t, { file dir }) + +kernel_read_system_state(firewallgui_t) +kernel_read_network_state(firewallgui_t) +kernel_rw_net_sysctls(firewallgui_t) +kernel_rw_kernel_sysctl(firewallgui_t) +kernel_rw_vm_sysctls(firewallgui_t) + +corecmd_exec_shell(firewallgui_t) +corecmd_exec_bin(firewallgui_t) + +dev_read_urand(firewallgui_t) +dev_read_sysfs(firewallgui_t) + +files_manage_system_conf_files(firewallgui_t) +files_etc_filetrans_system_conf(firewallgui_t) +files_read_usr_files(firewallgui_t) +files_search_kernel_modules(firewallgui_t) +files_list_kernel_modules(firewallgui_t) + +auth_use_nsswitch(firewallgui_t) + + +seutil_read_config(firewallgui_t) + +userdom_dontaudit_search_user_home_dirs(firewallgui_t) + +optional_policy(` + consoletype_exec(firewallgui_t) +') + +optional_policy(` + gnome_read_gconf_home_files(firewallgui_t) +') + +optional_policy(` + iptables_domtrans(firewallgui_t) + iptables_initrc_domtrans(firewallgui_t) + iptables_systemctl(firewallgui_t) +') + +optional_policy(` + modutils_getattr_module_deps(firewallgui_t) +') + +optional_policy(` + policykit_dbus_chat(firewallgui_t) +') diff --git a/firstboot.if b/firstboot.if index 8fa451c..f3a67c9 100644 --- a/firstboot.if +++ b/firstboot.if @@ -85,6 +85,25 @@ interface(`firstboot_dontaudit_use_fds',` ######################################## ## +## dontaudit read and write an leaked file descriptors +## +## +## +## Domain to not audit. +## +## +# +interface(`firstboot_dontaudit_leaks',` + gen_require(` + type firstboot_t; + ') + + dontaudit $1 firstboot_t:socket_class_set { read write }; + dontaudit $1 firstboot_t:fifo_file rw_inherited_fifo_file_perms; +') + +######################################## +## ## Write to a firstboot unnamed pipe. ## ## @@ -98,6 +117,7 @@ interface(`firstboot_write_pipes',` type firstboot_t; ') + allow $1 firstboot_t:fd use; allow $1 firstboot_t:fifo_file write; ') diff --git a/firstboot.te b/firstboot.te index c4d8998..0647c46 100644 --- a/firstboot.te +++ b/firstboot.te @@ -1,7 +1,7 @@ policy_module(firstboot, 1.12.0) gen_require(` - class passwd rootok; + class passwd { passwd chfn chsh rootok crontab }; ') ######################################## @@ -29,14 +29,16 @@ allow firstboot_t self:process setfscreate; allow firstboot_t self:fifo_file rw_fifo_file_perms; allow firstboot_t self:tcp_socket create_stream_socket_perms; allow firstboot_t self:unix_stream_socket { connect create }; -allow firstboot_t self:passwd rootok; +allow firstboot_t self:passwd { rootok passwd chfn chsh }; allow firstboot_t firstboot_etc_t:file read_file_perms; +files_manage_generic_tmp_dirs(firstboot_t) +files_manage_generic_tmp_files(firstboot_t) + kernel_read_system_state(firstboot_t) kernel_read_kernel_sysctls(firstboot_t) -corenet_all_recvfrom_unlabeled(firstboot_t) corenet_all_recvfrom_netlabel(firstboot_t) corenet_tcp_sendrecv_generic_if(firstboot_t) corenet_tcp_sendrecv_generic_node(firstboot_t) @@ -62,6 +64,8 @@ files_read_usr_files(firstboot_t) files_manage_var_dirs(firstboot_t) files_manage_var_files(firstboot_t) files_manage_var_symlinks(firstboot_t) +files_create_boot_flag(firstboot_t) +files_delete_boot_flag(firstboot_t) init_domtrans_script(firstboot_t) init_rw_utmp(firstboot_t) @@ -73,14 +77,10 @@ locallogin_use_fds(firstboot_t) logging_send_syslog_msg(firstboot_t) -miscfiles_read_localization(firstboot_t) +sysnet_dns_name_resolve(firstboot_t) -modutils_domtrans_insmod(firstboot_t) -modutils_domtrans_depmod(firstboot_t) -modutils_read_module_config(firstboot_t) -modutils_read_module_deps(firstboot_t) +userdom_use_inherited_user_terminals(firstboot_t) -userdom_use_user_terminals(firstboot_t) # Add/remove user home directories userdom_manage_user_home_content_dirs(firstboot_t) userdom_manage_user_home_content_files(firstboot_t) @@ -91,10 +91,6 @@ userdom_home_filetrans_user_home_dir(firstboot_t) userdom_user_home_dir_filetrans_user_home_content(firstboot_t, { dir file lnk_file fifo_file sock_file }) optional_policy(` - consoletype_domtrans(firstboot_t) -') - -optional_policy(` dbus_system_bus_client(firstboot_t) optional_policy(` @@ -103,7 +99,10 @@ optional_policy(` ') optional_policy(` - nis_use_ypbind(firstboot_t) + modutils_domtrans_insmod(firstboot_t) + modutils_domtrans_depmod(firstboot_t) + modutils_read_module_config(firstboot_t) + modutils_read_module_deps(firstboot_t) ') optional_policy(` @@ -113,18 +112,11 @@ optional_policy(` optional_policy(` unconfined_domtrans(firstboot_t) # The big hammer - unconfined_domain(firstboot_t) -') - -optional_policy(` - usermanage_domtrans_chfn(firstboot_t) - usermanage_domtrans_groupadd(firstboot_t) - usermanage_domtrans_passwd(firstboot_t) - usermanage_domtrans_useradd(firstboot_t) - usermanage_domtrans_admin_passwd(firstboot_t) + unconfined_domain_noaudit(firstboot_t) ') optional_policy(` + gnome_admin_home_gconf_filetrans(firstboot_t, dir) gnome_manage_config(firstboot_t) ') @@ -132,4 +124,5 @@ optional_policy(` xserver_domtrans(firstboot_t) xserver_rw_shm(firstboot_t) xserver_unconfined(firstboot_t) + xserver_stream_connect(firstboot_t) ') diff --git a/fprintd.if b/fprintd.if index ebad8c4..640293e 100644 --- a/fprintd.if +++ b/fprintd.if @@ -38,4 +38,3 @@ interface(`fprintd_dbus_chat',` allow $1 fprintd_t:dbus send_msg; allow fprintd_t $1:dbus send_msg; ') - diff --git a/fprintd.te b/fprintd.te index 7df52c7..523df56 100644 --- a/fprintd.te +++ b/fprintd.te @@ -7,7 +7,7 @@ policy_module(fprintd, 1.1.0) type fprintd_t; type fprintd_exec_t; -dbus_system_domain(fprintd_t, fprintd_exec_t) +init_daemon_domain(fprintd_t, fprintd_exec_t) type fprintd_var_lib_t; files_type(fprintd_var_lib_t) @@ -17,9 +17,10 @@ files_type(fprintd_var_lib_t) # Local policy # -allow fprintd_t self:capability sys_ptrace; +allow fprintd_t self:capability sys_nice; + allow fprintd_t self:fifo_file rw_fifo_file_perms; -allow fprintd_t self:process { getsched signal }; +allow fprintd_t self:process { getsched setsched signal sigkill }; manage_dirs_pattern(fprintd_t, fprintd_var_lib_t, fprintd_var_lib_t) manage_files_pattern(fprintd_t, fprintd_var_lib_t, fprintd_var_lib_t) @@ -33,14 +34,12 @@ dev_list_usbfs(fprintd_t) dev_rw_generic_usb_dev(fprintd_t) dev_read_sysfs(fprintd_t) -files_read_etc_files(fprintd_t) files_read_usr_files(fprintd_t) fs_getattr_all_fs(fprintd_t) auth_use_nsswitch(fprintd_t) -miscfiles_read_localization(fprintd_t) userdom_use_user_ptys(fprintd_t) userdom_read_all_users_state(fprintd_t) @@ -50,8 +49,13 @@ optional_policy(` ') optional_policy(` + dbus_system_domain(fprintd_t, fprintd_exec_t) +') + +optional_policy(` policykit_read_reload(fprintd_t) policykit_read_lib(fprintd_t) policykit_dbus_chat(fprintd_t) policykit_domtrans_auth(fprintd_t) + policykit_dbus_chat_auth(fprintd_t) ') diff --git a/ftp.fc b/ftp.fc index 69dcd2a..4d97da7 100644 --- a/ftp.fc +++ b/ftp.fc @@ -6,6 +6,9 @@ /etc/rc\.d/init\.d/vsftpd -- gen_context(system_u:object_r:ftpd_initrc_exec_t,s0) /etc/rc\.d/init\.d/proftpd -- gen_context(system_u:object_r:ftpd_initrc_exec_t,s0) +/usr/lib/systemd/system/vsftpd.* -- gen_context(system_u:object_r:iptables_unit_file_t,s0) +/usr/lib/systemd/system/proftpd.* -- gen_context(system_u:object_r:iptables_unit_file_t,s0) + # # /usr # @@ -29,3 +32,4 @@ /var/log/vsftpd.* -- gen_context(system_u:object_r:xferlog_t,s0) /var/log/xferlog.* -- gen_context(system_u:object_r:xferlog_t,s0) /var/log/xferreport.* -- gen_context(system_u:object_r:xferlog_t,s0) +/usr/libexec/webmin/vsftpd/webalizer/xfer_log -- gen_context(system_u:object_r:xferlog_t,s0) diff --git a/ftp.if b/ftp.if index 9d3201b..6e75e3d 100644 --- a/ftp.if +++ b/ftp.if @@ -1,5 +1,66 @@ ## File transfer protocol service +###################################### +## +## Execute a domain transition to run ftpd. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`ftp_domtrans',` + gen_require(` + type ftpd_t, ftpd_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1,ftpd_exec_t, ftpd_t) + +') + +####################################### +## +## Execute ftpd server in the ftpd domain. +## +## +## +## The type of the process performing this action. +## +## +# +interface(`ftp_initrc_domtrans',` + gen_require(` + type ftpd_initrc_exec_t; + ') + + init_labeled_script_domtrans($1, ftpd_initrc_exec_t) +') + +######################################## +## +## Execute ftpd server in the ftpd domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`ftp_systemctl',` + gen_require(` + type ftpd_unit_file_t; + type ftpd_t; + ') + + systemd_exec_systemctl($1) + allow $1 ftpd_unit_file_t:file read_file_perms; + allow $1 ftpd_unit_file_t:service manage_service_perms; + + ps_process_pattern($1, ftpd_t) +') + ####################################### ## ## Allow domain dyntransition to sftpd_anon domain. @@ -174,10 +235,14 @@ interface(`ftp_admin',` type ftpd_etc_t, ftpd_lock_t; type ftpd_var_run_t, xferlog_t; type ftpd_initrc_exec_t; + type ftpd_unit_file_t; ') - allow $1 ftpd_t:process { ptrace signal_perms }; + allow $1 ftpd_t:process signal_perms; ps_process_pattern($1, ftpd_t) + tunable_policy(`deny_ptrace',`',` + allow $1 ftpd_t:process ptrace; + ') init_labeled_script_domtrans($1, ftpd_initrc_exec_t) domain_system_change_exemption($1) @@ -203,4 +268,8 @@ interface(`ftp_admin',` logging_list_logs($1) admin_pattern($1, xferlog_t) + + ftp_systemctl($1) + admin_pattern($1, ftpd_unit_file_t) + allow $1 ftpd_unit_file_t:service all_service_perms; ') diff --git a/ftp.te b/ftp.te index 80026bb..1f7e8e4 100644 --- a/ftp.te +++ b/ftp.te @@ -12,7 +12,7 @@ policy_module(ftp, 1.14.0) ## public_content_rw_t. ##

## -gen_tunable(allow_ftpd_anon_write, false) +gen_tunable(ftpd_anon_write, false) ## ##

@@ -20,7 +20,7 @@ gen_tunable(allow_ftpd_anon_write, false) ## read/write all files on the system, governed by DAC. ##

## -gen_tunable(allow_ftpd_full_access, false) +gen_tunable(ftpd_full_access, false) ## ##

@@ -28,7 +28,7 @@ gen_tunable(allow_ftpd_full_access, false) ## used for public file transfer services. ##

## -gen_tunable(allow_ftpd_use_cifs, false) +gen_tunable(ftpd_use_cifs, false) ## ##

@@ -36,7 +36,28 @@ gen_tunable(allow_ftpd_use_cifs, false) ## used for public file transfer services. ##

## -gen_tunable(allow_ftpd_use_nfs, false) +gen_tunable(ftpd_use_nfs, false) + +## +##

+## Allow ftp servers to connect to mysql database ports +##

+## +gen_tunable(ftpd_connect_db, false) + +## +##

+## Allow ftp servers to use bind to all unreserved ports for passive mode +##

+## +gen_tunable(ftpd_use_passive_mode, false) + +## +##

+## Allow ftp servers to connect to all ports > 1023 +##

+## +gen_tunable(ftpd_connect_all_unreserved, false) ## ##

@@ -70,6 +91,14 @@ gen_tunable(sftpd_enable_homedirs, false) ## gen_tunable(sftpd_full_access, false) +## +##

+## Allow internal-sftp to read and write files +## in the user ssh home directories. +##

+## +gen_tunable(sftpd_write_ssh_home, false) + type anon_sftpd_t; typealias anon_sftpd_t alias sftpd_anon_t; domain_type(anon_sftpd_t) @@ -85,6 +114,9 @@ files_config_file(ftpd_etc_t) type ftpd_initrc_exec_t; init_script_file(ftpd_initrc_exec_t) +type ftpd_unit_file_t; +systemd_unit_file(ftpd_unit_file_t) + type ftpd_lock_t; files_lock_file(ftpd_lock_t) @@ -115,6 +147,10 @@ ifdef(`enable_mcs',` init_ranged_daemon_domain(ftpd_t, ftpd_exec_t, s0 - mcs_systemhigh) ') +ifdef(`enable_mls',` + init_ranged_daemon_domain(ftpd_t, ftpd_exec_t, mls_systemhigh) +') + ######################################## # # anon-sftp local policy @@ -133,7 +169,7 @@ tunable_policy(`sftpd_anon_write',` # ftpd local policy # -allow ftpd_t self:capability { chown fowner fsetid setgid setuid sys_chroot sys_nice sys_resource }; +allow ftpd_t self:capability { chown fowner fsetid ipc_lock kill setgid setuid sys_chroot sys_admin sys_nice sys_resource }; dontaudit ftpd_t self:capability sys_tty_config; allow ftpd_t self:process { getcap getpgid setcap setsched setrlimit signal_perms }; allow ftpd_t self:fifo_file rw_fifo_file_perms; @@ -151,7 +187,6 @@ files_lock_filetrans(ftpd_t, ftpd_lock_t, file) manage_dirs_pattern(ftpd_t, ftpd_tmp_t, ftpd_tmp_t) manage_files_pattern(ftpd_t, ftpd_tmp_t, ftpd_tmp_t) -files_tmp_filetrans(ftpd_t, ftpd_tmp_t, { file dir }) manage_dirs_pattern(ftpd_t, ftpd_tmpfs_t, ftpd_tmpfs_t) manage_files_pattern(ftpd_t, ftpd_tmpfs_t, ftpd_tmpfs_t) @@ -163,13 +198,13 @@ fs_tmpfs_filetrans(ftpd_t, ftpd_tmpfs_t, { dir file lnk_file sock_file fifo_file manage_dirs_pattern(ftpd_t, ftpd_var_run_t, ftpd_var_run_t) manage_files_pattern(ftpd_t, ftpd_var_run_t, ftpd_var_run_t) manage_sock_files_pattern(ftpd_t, ftpd_var_run_t, ftpd_var_run_t) -files_pid_filetrans(ftpd_t, ftpd_var_run_t, { file dir} ) +files_pid_filetrans(ftpd_t, ftpd_var_run_t, { file dir }) # proftpd requires the client side to bind a socket so that # it can stat the socket to perform access control decisions, # since getsockopt with SO_PEERCRED is not available on all # proftpd-supported OSs -allow ftpd_t ftpdctl_tmp_t:sock_file { getattr unlink }; +allow ftpd_t ftpdctl_tmp_t:sock_file delete_sock_file_perms; # Create and modify /var/log/xferlog. manage_files_pattern(ftpd_t, xferlog_t, xferlog_t) @@ -177,14 +212,13 @@ logging_log_filetrans(ftpd_t, xferlog_t, file) kernel_read_kernel_sysctls(ftpd_t) kernel_read_system_state(ftpd_t) -kernel_search_network_state(ftpd_t) +kernel_read_network_state(ftpd_t) dev_read_sysfs(ftpd_t) dev_read_urand(ftpd_t) corecmd_exec_bin(ftpd_t) -corenet_all_recvfrom_unlabeled(ftpd_t) corenet_all_recvfrom_netlabel(ftpd_t) corenet_tcp_sendrecv_generic_if(ftpd_t) corenet_udp_sendrecv_generic_if(ftpd_t) @@ -196,9 +230,8 @@ corenet_tcp_bind_generic_node(ftpd_t) corenet_tcp_bind_ftp_port(ftpd_t) corenet_tcp_bind_ftp_data_port(ftpd_t) corenet_tcp_bind_generic_port(ftpd_t) -corenet_tcp_bind_all_unreserved_ports(ftpd_t) -corenet_dontaudit_tcp_bind_all_ports(ftpd_t) -corenet_tcp_connect_all_ports(ftpd_t) +corenet_tcp_bind_all_ephemeral_ports(ftpd_t) +corenet_tcp_connect_all_ephemeral_ports(ftpd_t) corenet_sendrecv_ftp_server_packets(ftpd_t) domain_use_interactive_fds(ftpd_t) @@ -212,13 +245,11 @@ fs_search_auto_mountpoints(ftpd_t) fs_getattr_all_fs(ftpd_t) fs_search_fusefs(ftpd_t) -auth_use_nsswitch(ftpd_t) -auth_domtrans_chk_passwd(ftpd_t) -# Append to /var/log/wtmp. -auth_append_login_records(ftpd_t) +auth_use_pam(ftpd_t) #kerberized ftp requires the following auth_write_login_records(ftpd_t) auth_rw_faillog(ftpd_t) +auth_manage_var_auth(ftpd_t) init_rw_utmp(ftpd_t) @@ -226,7 +257,6 @@ logging_send_audit_msgs(ftpd_t) logging_send_syslog_msg(ftpd_t) logging_set_loginuid(ftpd_t) -miscfiles_read_localization(ftpd_t) miscfiles_read_public_files(ftpd_t) seutil_dontaudit_search_config(ftpd_t) @@ -237,31 +267,39 @@ sysnet_use_ldap(ftpd_t) userdom_dontaudit_use_unpriv_user_fds(ftpd_t) userdom_dontaudit_search_user_home_dirs(ftpd_t) -tunable_policy(`allow_ftpd_anon_write',` +tunable_policy(`ftpd_anon_write',` miscfiles_manage_public_files(ftpd_t) ') -tunable_policy(`allow_ftpd_use_cifs',` +tunable_policy(`ftpd_use_cifs',` fs_read_cifs_files(ftpd_t) fs_read_cifs_symlinks(ftpd_t) ') -tunable_policy(`allow_ftpd_use_cifs && allow_ftpd_anon_write',` +tunable_policy(`ftpd_use_cifs && ftpd_anon_write',` fs_manage_cifs_files(ftpd_t) ') -tunable_policy(`allow_ftpd_use_nfs',` +tunable_policy(`ftpd_use_nfs',` fs_read_nfs_files(ftpd_t) fs_read_nfs_symlinks(ftpd_t) ') -tunable_policy(`allow_ftpd_use_nfs && allow_ftpd_anon_write',` +tunable_policy(`ftpd_use_nfs && ftpd_anon_write',` fs_manage_nfs_files(ftpd_t) ') -tunable_policy(`allow_ftpd_full_access',` +tunable_policy(`ftpd_full_access',` allow ftpd_t self:capability { dac_override dac_read_search }; - files_manage_non_auth_files(ftpd_t) + files_manage_non_security_files(ftpd_t) +') + +tunable_policy(`ftpd_use_passive_mode',` + corenet_tcp_bind_all_unreserved_ports(ftpd_t) +') + +tunable_policy(`ftpd_connect_all_unreserved',` + corenet_tcp_connect_all_unreserved_ports(ftpd_t) ') tunable_policy(`ftp_home_dir',` @@ -270,10 +308,13 @@ tunable_policy(`ftp_home_dir',` # allow access to /home files_list_home(ftpd_t) userdom_read_user_home_content_files(ftpd_t) - userdom_manage_user_home_content_dirs(ftpd_t) - userdom_manage_user_home_content_files(ftpd_t) - userdom_manage_user_home_content_symlinks(ftpd_t) - userdom_user_home_dir_filetrans_user_home_content(ftpd_t, { dir file lnk_file }) + userdom_manage_user_home_content(ftpd_t) + userdom_manage_user_tmp_files(ftpd_t) + userdom_tmp_filetrans_user_tmp(ftpd_t, file) +',` + # Needed for permissive mode, to make sure everything gets labeled correctly + userdom_user_home_dir_filetrans_pattern(ftpd_t, { dir file lnk_file }) + files_tmp_filetrans(ftpd_t, ftpd_tmp_t, { file dir }) ') tunable_policy(`ftp_home_dir && use_nfs_home_dirs',` @@ -309,10 +350,35 @@ optional_policy(` ') optional_policy(` + fail2ban_read_lib_files(ftpd_t) +') + +optional_policy(` selinux_validate_context(ftpd_t) kerberos_keytab_template(ftpd, ftpd_t) - kerberos_manage_host_rcache(ftpd_t) + # this part of auth_use_pam + #kerberos_manage_host_rcache(ftpd_t) + kerberos_tmp_filetrans_host_rcache(ftpd_t, "host_0") +') + +optional_policy(` + tunable_policy(`ftpd_connect_db',` + mysql_stream_connect(ftpd_t) + ') +') + +optional_policy(` + tunable_policy(`ftpd_connect_db',` + postgresql_stream_connect(ftpd_t) + ') +') + +optional_policy(` + tunable_policy(`ftpd_connect_db',` + mysql_tcp_connect(ftpd_t) + postgresql_tcp_connect(ftpd_t) + ') ') optional_policy(` @@ -347,16 +413,17 @@ optional_policy(` # Allow ftpdctl to talk to ftpd over a socket connection stream_connect_pattern(ftpdctl_t, ftpd_var_run_t, ftpd_var_run_t, ftpd_t) +files_search_pids(ftpdctl_t) # ftpdctl creates a socket so that the daemon can perform # access control decisions (see comments in ftpd_t rules above) -allow ftpdctl_t ftpdctl_tmp_t:sock_file { create setattr }; +allow ftpdctl_t ftpdctl_tmp_t:sock_file manage_sock_file_perms; files_tmp_filetrans(ftpdctl_t, ftpdctl_tmp_t, sock_file) # Allow ftpdctl to read config files files_read_etc_files(ftpdctl_t) -userdom_use_user_terminals(ftpdctl_t) +userdom_use_inherited_user_terminals(ftpdctl_t) ######################################## # @@ -365,18 +432,32 @@ userdom_use_user_terminals(ftpdctl_t) files_read_etc_files(sftpd_t) + # allow read access to /home by default userdom_read_user_home_content_files(sftpd_t) userdom_read_user_home_content_symlinks(sftpd_t) +userdom_dontaudit_list_admin_dir(sftpd_t) + +tunable_policy(`sftpd_full_access',` + allow sftpd_t self:capability { dac_override dac_read_search }; + fs_read_noxattr_fs_files(sftpd_t) + files_manage_non_security_files(sftpd_t) +') + +tunable_policy(`sftpd_write_ssh_home',` + ssh_manage_home_files(sftpd_t) +') tunable_policy(`sftpd_enable_homedirs',` allow sftpd_t self:capability { dac_override dac_read_search }; # allow access to /home files_list_home(sftpd_t) - userdom_manage_user_home_content_files(sftpd_t) - userdom_manage_user_home_content_dirs(sftpd_t) - userdom_user_home_dir_filetrans_user_home_content(sftpd_t, { dir file }) + userdom_read_user_home_content_files(sftpd_t) + userdom_manage_user_home_content(sftpd_t) +',` + # Needed for permissive mode, to make sure everything gets labeled correctly + userdom_user_home_dir_filetrans_pattern(sftpd_t, { dir file lnk_file }) ') tunable_policy(`sftpd_enable_homedirs && use_nfs_home_dirs',` @@ -394,19 +475,7 @@ tunable_policy(`sftpd_enable_homedirs && use_samba_home_dirs',` tunable_policy(`sftpd_full_access',` allow sftpd_t self:capability { dac_override dac_read_search }; fs_read_noxattr_fs_files(sftpd_t) - files_manage_non_auth_files(sftpd_t) -') - -tunable_policy(`use_samba_home_dirs',` - # allow read access to /home by default - fs_list_cifs(sftpd_t) - fs_read_cifs_files(sftpd_t) - fs_read_cifs_symlinks(sftpd_t) + files_manage_non_security_files(sftpd_t) ') -tunable_policy(`use_nfs_home_dirs',` - # allow read access to /home by default - fs_list_nfs(sftpd_t) - fs_read_nfs_files(sftpd_t) - fs_read_nfs_symlinks(ftpd_t) -') +userdom_home_reader(sftpd_t) diff --git a/games.te b/games.te index b73d33c..86955c8 100644 --- a/games.te +++ b/games.te @@ -75,8 +75,6 @@ init_use_script_ptys(games_srv_t) logging_send_syslog_msg(games_srv_t) -miscfiles_read_localization(games_srv_t) - userdom_dontaudit_use_unpriv_user_fds(games_srv_t) userdom_dontaudit_search_user_home_dirs(games_srv_t) @@ -120,7 +118,6 @@ kernel_read_system_state(games_t) corecmd_exec_bin(games_t) -corenet_all_recvfrom_unlabeled(games_t) corenet_all_recvfrom_netlabel(games_t) corenet_tcp_sendrecv_generic_if(games_t) corenet_udp_sendrecv_generic_if(games_t) @@ -152,7 +149,6 @@ init_dontaudit_rw_utmp(games_t) logging_dontaudit_search_logs(games_t) miscfiles_read_man_pages(games_t) -miscfiles_read_localization(games_t) sysnet_read_config(games_t) @@ -163,7 +159,7 @@ userdom_manage_user_tmp_sockets(games_t) # Suppress .icons denial until properly implemented userdom_dontaudit_read_user_home_content_files(games_t) -tunable_policy(`allow_execmem',` +tunable_policy(`deny_execmem',`', ` allow games_t self:process execmem; ') diff --git a/gatekeeper.te b/gatekeeper.te index 99a94de..8b84eda 100644 --- a/gatekeeper.te +++ b/gatekeeper.te @@ -33,7 +33,7 @@ allow gatekeeper_t self:fifo_file rw_fifo_file_perms; allow gatekeeper_t self:tcp_socket create_stream_socket_perms; allow gatekeeper_t self:udp_socket create_socket_perms; -allow gatekeeper_t gatekeeper_etc_t:lnk_file { getattr read }; +allow gatekeeper_t gatekeeper_etc_t:lnk_file read_lnk_file_perms; allow gatekeeper_t gatekeeper_etc_t:file read_file_perms; files_search_etc(gatekeeper_t) @@ -52,7 +52,6 @@ kernel_read_kernel_sysctls(gatekeeper_t) corecmd_list_bin(gatekeeper_t) -corenet_all_recvfrom_unlabeled(gatekeeper_t) corenet_all_recvfrom_netlabel(gatekeeper_t) corenet_tcp_sendrecv_generic_if(gatekeeper_t) corenet_udp_sendrecv_generic_if(gatekeeper_t) @@ -79,8 +78,6 @@ fs_search_auto_mountpoints(gatekeeper_t) logging_send_syslog_msg(gatekeeper_t) -miscfiles_read_localization(gatekeeper_t) - sysnet_read_config(gatekeeper_t) userdom_dontaudit_use_unpriv_user_fds(gatekeeper_t) diff --git a/gift.te b/gift.te index 4975343..1c20b64 100644 --- a/gift.te +++ b/gift.te @@ -52,7 +52,6 @@ domtrans_pattern(gift_t, giftd_exec_t, giftd_t) kernel_read_system_state(gift_t) # Connect to gift daemon -corenet_all_recvfrom_unlabeled(gift_t) corenet_all_recvfrom_netlabel(gift_t) corenet_tcp_sendrecv_generic_if(gift_t) corenet_tcp_sendrecv_generic_node(gift_t) @@ -67,17 +66,7 @@ sysnet_read_config(gift_t) # giftui looks in .icons, .themes. userdom_dontaudit_read_user_home_content_files(gift_t) -tunable_policy(`use_nfs_home_dirs',` - fs_manage_nfs_dirs(gift_t) - fs_manage_nfs_files(gift_t) - fs_manage_nfs_symlinks(gift_t) -') - -tunable_policy(`use_samba_home_dirs',` - fs_manage_cifs_dirs(gift_t) - fs_manage_cifs_files(gift_t) - fs_manage_cifs_symlinks(gift_t) -') +userdom_home_manager(gift_t) optional_policy(` nscd_socket_use(gift_t) @@ -106,7 +95,6 @@ kernel_read_system_state(giftd_t) kernel_read_kernel_sysctls(giftd_t) # Serve content on various p2p networks. Ports can be random. -corenet_all_recvfrom_unlabeled(giftd_t) corenet_all_recvfrom_netlabel(giftd_t) corenet_tcp_sendrecv_generic_if(giftd_t) corenet_udp_sendrecv_generic_if(giftd_t) @@ -125,20 +113,8 @@ files_read_usr_files(giftd_t) # Read /etc/mtab files_read_etc_runtime_files(giftd_t) -miscfiles_read_localization(giftd_t) sysnet_read_config(giftd_t) -userdom_use_user_terminals(giftd_t) - -tunable_policy(`use_nfs_home_dirs',` - fs_manage_nfs_dirs(giftd_t) - fs_manage_nfs_files(giftd_t) - fs_manage_nfs_symlinks(giftd_t) -') - -tunable_policy(`use_samba_home_dirs',` - fs_manage_cifs_dirs(giftd_t) - fs_manage_cifs_files(giftd_t) - fs_manage_cifs_symlinks(giftd_t) -') +userdom_use_inherited_user_terminals(giftd_t) +userdom_home_manager(gitd_t) diff --git a/git.fc b/git.fc index 13e72a7..a4dc0b9 100644 --- a/git.fc +++ b/git.fc @@ -1,11 +1,15 @@ HOME_DIR/public_git(/.*)? gen_context(system_u:object_r:git_user_content_t,s0) +/srv/git(/.*)? gen_context(system_u:object_r:git_sys_content_t,s0) + /usr/libexec/git-core/git-daemon -- gen_context(system_u:object_r:gitd_exec_t,s0) /var/cache/cgit(/.*)? gen_context(system_u:object_r:httpd_git_rw_content_t,s0) +/var/cache/gitweb-caching(/.*)? gen_context(system_u:object_r:httpd_git_rw_content_t,s0) /var/lib/git(/.*)? gen_context(system_u:object_r:git_sys_content_t,s0) /var/www/cgi-bin/cgit -- gen_context(system_u:object_r:httpd_git_script_exec_t,s0) /var/www/git(/.*)? gen_context(system_u:object_r:httpd_git_content_t,s0) /var/www/git/gitweb\.cgi -- gen_context(system_u:object_r:httpd_git_script_exec_t,s0) +/var/www/gitweb-caching/gitweb\.cgi -- gen_context(system_u:object_r:httpd_git_script_exec_t,s0) diff --git a/git.if b/git.if index b0242d9..a9e6842 100644 --- a/git.if +++ b/git.if @@ -15,9 +15,9 @@ ## ## # -template(`git_role',` +template(`git_session_role',` gen_require(` - type git_session_t, gitd_exec_t, git_user_content_t; + type git_session_t, gitd_exec_t; ') ######################################## @@ -32,19 +32,494 @@ template(`git_role',` # Policy # - manage_dirs_pattern($2, git_user_content_t, git_user_content_t) - relabel_dirs_pattern($2, git_user_content_t, git_user_content_t) - - exec_files_pattern($2, git_user_content_t, git_user_content_t) - manage_files_pattern($2, git_user_content_t, git_user_content_t) - relabel_files_pattern($2, git_user_content_t, git_user_content_t) - - allow $2 git_session_t:process { ptrace signal_perms }; + allow $2 git_session_t:process signal_perms; ps_process_pattern($2, git_session_t) + tunable_policy(`deny_ptrace',`',` + allow $2 git_session_t:process ptrace; + ') + tunable_policy(`git_session_users',` domtrans_pattern($2, gitd_exec_t, git_session_t) ',` can_exec($2, gitd_exec_t) ') ') + +######################################## +## +## Create a set of derived types for Git +## daemon shared repository content. +## +## +## +## The prefix to be used for deriving type names. +## +## +# +template(`git_content_template',` + gen_require(` + attribute git_system_content, git_content; + ') + + ######################################## + # + # Git daemon content shared declarations. + # + + type git_$1_content_t, git_system_content, git_content; + files_type(git_$1_content_t) +') + +######################################## +## +## Create a set of derived types for Git +## daemon shared repository roles. +## +## +## +## The prefix to be used for deriving type names. +## +## +# +template(`git_role_template',` + gen_require(` + class context contains; + role system_r; + ') + + ######################################## + # + # Git daemon role shared declarations. + # + + attribute $1_usertype; + + type $1_t; + userdom_unpriv_usertype($1, $1_t) + domain_type($1_t) + + role $1_r types $1_t; + allow system_r $1_r; + + ######################################## + # + # Git daemon role shared policy. + # + + allow $1_t self:context contains; + allow $1_t self:fifo_file rw_fifo_file_perms; + + corecmd_exec_bin($1_t) + corecmd_bin_entry_type($1_t) + corecmd_shell_entry_type($1_t) + + domain_interactive_fd($1_t) + domain_user_exemption_target($1_t) + + kernel_read_system_state($1_t) + + files_read_etc_files($1_t) + files_dontaudit_search_home($1_t) + + + git_rwx_generic_system_content($1_t) + + ssh_rw_stream_sockets($1_t) + + tunable_policy(`git_system_use_cifs',` + fs_exec_cifs_files($1_t) + fs_manage_cifs_dirs($1_t) + fs_manage_cifs_files($1_t) + ') + + tunable_policy(`git_system_use_nfs',` + fs_exec_nfs_files($1_t) + fs_manage_nfs_dirs($1_t) + fs_manage_nfs_files($1_t) + ') + + optional_policy(` + nscd_read_pid($1_t) + ') +') + +####################################### +## +## Allow specified domain access to the +## specified Git daemon content. +## +## +## +## Domain allowed access. +## +## +## +## +## Type of the object that access is allowed to. +## +## +# +interface(`git_content_delegation',` + gen_require(` + type $1, $2; + ') + + exec_files_pattern($1, $2, $2) + manage_dirs_pattern($1, $2, $2) + manage_files_pattern($1, $2, $2) + files_search_var_lib($1) + + tunable_policy(`git_system_use_cifs',` + fs_exec_cifs_files($1) + fs_manage_cifs_dirs($1) + fs_manage_cifs_files($1) + ') + + tunable_policy(`git_system_use_nfs',` + fs_exec_nfs_files($1) + fs_manage_nfs_dirs($1) + fs_manage_nfs_files($1) + ') +') + +######################################## +## +## Allow the specified domain to manage +## and execute all Git daemon content. +## +## +## +## Domain allowed access. +## +## +# +interface(`git_rwx_all_content',` + gen_require(` + attribute git_content; + ') + + exec_files_pattern($1, git_content, git_content) + manage_dirs_pattern($1, git_content, git_content) + manage_files_pattern($1, git_content, git_content) + userdom_search_user_home_dirs($1) + files_search_var_lib($1) + + tunable_policy(`git_system_use_cifs',` + fs_exec_cifs_files($1) + fs_manage_cifs_dirs($1) + fs_manage_cifs_files($1) + ') + + tunable_policy(`git_system_use_nfs',` + fs_exec_nfs_files($1) + fs_manage_nfs_dirs($1) + fs_manage_nfs_files($1) + ') +') + +######################################## +## +## Allow the specified domain to manage +## and execute all Git daemon system content. +## +## +## +## Domain allowed access. +## +## +# +interface(`git_rwx_all_system_content',` + gen_require(` + attribute git_system_content; + ') + + exec_files_pattern($1, git_system_content, git_system_content) + manage_dirs_pattern($1, git_system_content, git_system_content) + manage_files_pattern($1, git_system_content, git_system_content) + files_search_var_lib($1) + + tunable_policy(`git_system_use_cifs',` + fs_exec_cifs_files($1) + fs_manage_cifs_dirs($1) + fs_manage_cifs_files($1) + ') + + tunable_policy(`git_system_use_nfs',` + fs_exec_nfs_files($1) + fs_manage_nfs_dirs($1) + fs_manage_nfs_files($1) + ') +') + +######################################## +## +## Allow the specified domain to manage +## and execute Git daemon generic system content. +## +## +## +## Domain allowed access. +## +## +# +interface(`git_rwx_generic_system_content',` + gen_require(` + type git_sys_content_t; + ') + + exec_files_pattern($1, git_sys_content_t, git_sys_content_t) + manage_dirs_pattern($1, git_sys_content_t, git_sys_content_t) + manage_files_pattern($1, git_sys_content_t, git_sys_content_t) + files_search_var_lib($1) + + tunable_policy(`git_system_use_cifs',` + fs_exec_cifs_files($1) + fs_manage_cifs_dirs($1) + fs_manage_cifs_files($1) + ') + + tunable_policy(`git_system_use_nfs',` + fs_exec_nfs_files($1) + fs_manage_nfs_dirs($1) + fs_manage_nfs_files($1) + ') +') + +######################################## +## +## Allow the specified domain to read +## all Git daemon content files. +## +## +## +## Domain allowed access. +## +## +# +interface(`git_read_all_content_files',` + gen_require(` + attribute git_content; + ') + + list_dirs_pattern($1, git_content, git_content) + read_files_pattern($1, git_content, git_content) + userdom_search_user_home_dirs($1) + files_search_var_lib($1) + + tunable_policy(`git_system_use_cifs',` + fs_list_cifs($1) + fs_read_cifs_files($1) + ') + + tunable_policy(`git_system_use_nfs',` + fs_list_nfs($1) + fs_read_nfs_files($1) + ') +') + +######################################## +## +## Allow the specified domain to read +## Git daemon session content files. +## +## +## +## Domain allowed access. +## +## +# +interface(`git_read_session_content_files',` + gen_require(` + type git_user_content_t; + ') + + list_dirs_pattern($1, git_user_content_t, git_user_content_t) + read_files_pattern($1, git_user_content_t, git_user_content_t) + userdom_search_user_home_dirs($1) +') + +####################################### +## +## Dontaudit the specified domain to read +## Git daemon session content files. +## +## +## +## Domain to not audit. +## +## +# +interface(`git_dontaudit_read_session_content_files',` + gen_require(` + type git_user_content_t; + ') + + dontaudit $1 git_user_content_t:file read_file_perms; +') + +######################################## +## +## Allow the specified domain to read +## all Git daemon system content files. +## +## +## +## Domain allowed access. +## +## +# +interface(`git_read_all_system_content_files',` + gen_require(` + attribute git_system_content; + ') + + list_dirs_pattern($1, git_system_content, git_system_content) + read_files_pattern($1, git_system_content, git_system_content) + files_search_var_lib($1) + + tunable_policy(`git_system_use_cifs',` + fs_list_cifs($1) + fs_read_cifs_files($1) + ') + + tunable_policy(`git_system_use_nfs',` + fs_list_nfs($1) + fs_read_nfs_files($1) + ') +') + +######################################## +## +## Allow the specified domain to read +## Git daemon generic system content files. +## +## +## +## Domain allowed access. +## +## +# +interface(`git_read_generic_system_content_files',` + gen_require(` + type git_sys_content_t; + ') + + list_dirs_pattern($1, git_sys_content_t, git_sys_content_t) + read_files_pattern($1, git_sys_content_t, git_sys_content_t) + files_search_var_lib($1) + + tunable_policy(`git_system_use_cifs',` + fs_list_cifs($1) + fs_read_cifs_files($1) + ') + + tunable_policy(`git_system_use_nfs',` + fs_list_nfs($1) + fs_read_nfs_files($1) + ') +') + +######################################## +## +## Allow the specified domain to relabel +## all Git daemon content. +## +## +## +## Domain allowed access. +## +## +# +interface(`git_relabel_all_content',` + gen_require(` + attribute git_content; + ') + + relabel_dirs_pattern($1, git_content, git_content) + relabel_files_pattern($1, git_content, git_content) + userdom_search_user_home_dirs($1) + files_search_var_lib($1) +') + +######################################## +## +## Allow the specified domain to relabel +## all Git daemon system content. +## +## +## +## Domain allowed access. +## +## +# +interface(`git_relabel_all_system_content',` + gen_require(` + attribute git_system_content; + ') + + relabel_dirs_pattern($1, git_system_content, git_system_content) + relabel_files_pattern($1, git_system_content, git_system_content) + files_search_var_lib($1) +') + +######################################## +## +## Allow the specified domain to relabel +## Git daemon generic system content. +## +## +## +## Domain allowed access. +## +## +# +interface(`git_relabel_generic_system_content',` + gen_require(` + type git_sys_content_t; + ') + + relabel_dirs_pattern($1, git_sys_content_t, git_sys_content_t) + relabel_files_pattern($1, git_sys_content_t, git_sys_content_t) + files_search_var_lib($1) +') + +######################################## +## +## Allow the specified domain to relabel +## Git daemon session content. +## +## +## +## Domain allowed access. +## +## +# +interface(`git_relabel_session_content',` + gen_require(` + type git_user_content_t; + ') + + relabel_dirs_pattern($1, git_user_content_t, git_user_content_t) + relabel_files_pattern($1, git_user_content_t, git_user_content_t) + userdom_search_user_home_dirs($1) +') + +######################################## +## +## Create Git user content with a +## named file transition. +## +## +## +## Domain allowed access. +## +## +# +interface(`git_filetrans_user_content',` + gen_require(` + type git_user_content_t; + ') + + userdom_user_home_dir_filetrans($1, git_user_content_t, dir, "public_git") +') diff --git a/git.te b/git.te index 6e8e1f3..220db13 100644 --- a/git.te +++ b/git.te @@ -31,20 +31,21 @@ gen_tunable(git_cgi_use_nfs, false) ## ##

-## Determine whether calling user domains -## can execute Git daemon in the -## git_session_t domain. +## Determine whether Git session daemon +## can bind TCP sockets to all +## unreserved ports. ##

## -gen_tunable(git_session_users, false) +gen_tunable(git_session_bind_all_unreserved_ports, false) ## ##

-## Determine whether Git session daemons -## can send syslog messages. +## Determine whether calling user domains +## can execute Git daemon in the +## git_session_t domain. ##

## -gen_tunable(git_session_send_syslog_msg, false) +gen_tunable(git_session_users, false) ## ##

@@ -71,6 +72,10 @@ gen_tunable(git_system_use_cifs, false) gen_tunable(git_system_use_nfs, false) attribute git_daemon; +attribute git_system_content; +attribute git_content; + +role git_shell_r; apache_content_template(git) @@ -79,13 +84,16 @@ type gitd_exec_t; inetd_service_domain(git_system_t, gitd_exec_t) type git_session_t, git_daemon; -userdom_user_application_domain(git_session_t, gitd_exec_t) +application_domain(git_session_t, gitd_exec_t) +ubac_constrained(git_session_t) -type git_sys_content_t; +type git_sys_content_t, git_content, git_system_content; files_type(git_sys_content_t) +typealias git_sys_content_t alias { git_data_t git_system_content_t }; -type git_user_content_t; +type git_user_content_t, git_content; userdom_user_home_content(git_user_content_t) +typealias git_user_content_t alias git_session_content_t; ######################################## # @@ -99,7 +107,6 @@ read_files_pattern(git_session_t, git_user_content_t, git_user_content_t) userdom_search_user_home_dirs(git_session_t) corenet_all_recvfrom_netlabel(git_session_t) -corenet_all_recvfrom_unlabeled(git_session_t) corenet_tcp_bind_generic_node(git_session_t) corenet_tcp_sendrecv_generic_if(git_session_t) corenet_tcp_sendrecv_generic_node(git_session_t) @@ -112,10 +119,13 @@ auth_use_nsswitch(git_session_t) userdom_use_user_terminals(git_session_t) -tunable_policy(`git_session_send_syslog_msg',` - logging_send_syslog_msg(git_session_t) +tunable_policy(`git_session_bind_all_unreserved_ports',` + corenet_tcp_bind_all_unreserved_ports(git_session_t) + corenet_sendrecv_generic_server_packets(git_session_t) ') +logging_send_syslog_msg(git_session_t) + tunable_policy(`use_nfs_home_dirs',` fs_read_nfs_files(git_session_t) ',` @@ -133,8 +143,8 @@ tunable_policy(`use_samba_home_dirs',` # Git system policy # -list_dirs_pattern(git_system_t, git_sys_content_t, git_sys_content_t) -read_files_pattern(git_system_t, git_sys_content_t, git_sys_content_t) +list_dirs_pattern(git_system_t, git_content, git_content) +read_files_pattern(git_system_t, git_content, git_content) files_search_var_lib(git_system_t) auth_use_nsswitch(git_system_t) @@ -174,8 +184,8 @@ tunable_policy(`git_system_use_nfs',` # Git CGI policy # -list_dirs_pattern(httpd_git_script_t, { git_sys_content_t git_user_content_t }, { git_sys_content_t git_user_content_t }) -read_files_pattern(httpd_git_script_t, { git_sys_content_t git_user_content_t }, { git_sys_content_t git_user_content_t }) +list_dirs_pattern(httpd_git_script_t, git_content, git_content) +read_files_pattern(httpd_git_script_t, git_content, git_content) files_search_var_lib(httpd_git_script_t) files_dontaudit_getattr_tmp_dirs(httpd_git_script_t) @@ -225,4 +235,10 @@ files_read_usr_files(git_daemon) fs_search_auto_mountpoints(git_daemon) -miscfiles_read_localization(git_daemon) + +######################################## +# +# Git-shell private policy. +# +git_role_template(git_shell) +gen_user(git_shell_u, user, git_shell_r, s0, s0) diff --git a/gitosis.fc b/gitosis.fc index 24f6441..4de3a6b 100644 --- a/gitosis.fc +++ b/gitosis.fc @@ -6,4 +6,4 @@ ifdef(`distro_debian',` /usr/bin/gl-auth-command -- gen_context(system_u:object_r:gitosis_exec_t,s0) /var/lib/gitosis(/.*)? gen_context(system_u:object_r:gitosis_var_lib_t,s0) -/var/lib/gitolite(/.*)? gen_context(system_u:object_r:gitosis_var_lib_t,s0) +/var/lib/gitolite(3)?(/.*)? gen_context(system_u:object_r:gitosis_var_lib_t,s0) diff --git a/gitosis.te b/gitosis.te index 0eb75f4..3607a5b 100644 --- a/gitosis.te +++ b/gitosis.te @@ -5,6 +5,13 @@ policy_module(gitosis, 1.3.0) # Declarations # +## +##

+## Allow gitisis daemon to send mail +##

+## +gen_tunable(gitosis_can_sendmail, false) + type gitosis_t; type gitosis_exec_t; application_domain(gitosis_t, gitosis_exec_t) @@ -36,6 +43,11 @@ files_read_etc_files(gitosis_t) files_read_usr_files(gitosis_t) files_search_var_lib(gitosis_t) -miscfiles_read_localization(gitosis_t) sysnet_read_config(gitosis_t) + +corenet_tcp_bind_all_ports(gitosis_t) + +tunable_policy(`gitosis_can_sendmail',` + mta_send_mail(gitosis_t) +') diff --git a/glance.if b/glance.if index 7ff9d6d..6b0a7ff 100644 --- a/glance.if +++ b/glance.if @@ -24,9 +24,9 @@ interface(`glance_domtrans_registry',` ## Transition to glance api. ## ## -## +## ## Domain allowed to transition. -## +## ## # interface(`glance_domtrans_api',` @@ -238,6 +238,10 @@ interface(`glance_admin',` allow $1 glance_registry_t:process signal_perms; ps_process_pattern($1, glance_registry_t) + tunable_policy(`deny_ptrace',`',` + allow $1 glance_registry_t:process ptrace; + allow $1 glance_api_t:process ptrace; + ') allow $1 glance_api_t:process signal_perms; ps_process_pattern($1, glance_api_t) diff --git a/glance.te b/glance.te index 4afb81f..de519e6 100644 --- a/glance.te +++ b/glance.te @@ -57,13 +57,17 @@ manage_files_pattern(glance_domain, glance_var_run_t, glance_var_run_t) kernel_read_system_state(glance_domain) corecmd_exec_bin(glance_domain) +corecmd_exec_shell(glance_domain) dev_read_urand(glance_domain) files_read_etc_files(glance_domain) files_read_usr_files(glance_domain) -miscfiles_read_localization(glance_domain) +auth_read_passwd(glance_domain) + +libs_exec_ldconfig(glance_domain) + optional_policy(` sysnet_dns_name_resolve(glance_domain) @@ -80,6 +84,14 @@ files_tmp_filetrans(glance_registry_t, glance_registry_tmp_t, { file dir }) corenet_tcp_bind_generic_node(glance_registry_t) corenet_tcp_bind_glance_registry_port(glance_registry_t) +corenet_tcp_connect_mysqld_port(glance_registry_t) +corenet_tcp_connect_all_ephemeral_ports(glance_registry_t) + +logging_send_syslog_msg(glance_registry_t) + +optional_policy(` + mysql_stream_connect(glance_registry_t) +') ######################################## # @@ -94,11 +106,15 @@ can_exec(glance_api_t, glance_tmp_t) corecmd_exec_shell(glance_api_t) corenet_tcp_bind_generic_node(glance_api_t) +corenet_tcp_bind_glance_port(glance_api_t) corenet_tcp_bind_hplip_port(glance_api_t) corenet_tcp_connect_glance_registry_port(glance_api_t) +corenet_tcp_connect_all_ephemeral_ports(glance_api_t) dev_read_urand(glance_api_t) fs_getattr_xattr_fs(glance_api_t) -libs_exec_ldconfig(glance_api_t) +optional_policy(` + mysql_stream_connect(glance_api_t) +') diff --git a/glusterd.fc b/glusterd.fc new file mode 100644 index 0000000..6418e39 --- /dev/null +++ b/glusterd.fc @@ -0,0 +1,16 @@ + +/etc/rc\.d/init\.d/glusterd -- gen_context(system_u:object_r:glusterd_initrc_exec_t,s0) + +/etc/glusterfs(/.*)? gen_context(system_u:object_r:glusterd_etc_t,s0) +/etc/glusterd(/.*)? gen_context(system_u:object_r:glusterd_etc_t,s0) + +/usr/sbin/glusterd -- gen_context(system_u:object_r:glusterd_initrc_exec_t,s0) +/usr/sbin/glusterfsd -- gen_context(system_u:object_r:glusterd_exec_t,s0) + +/opt/glusterfs/[^/]+/sbin/glusterfsd -- gen_context(system_u:object_r:glusterd_exec_t,s0) + +/var/log/glusterfs(/.*)? gen_context(system_u:object_r:glusterd_log_t,s0) + +/var/run/glusterd(/.*)? gen_context(system_u:object_r:glusterd_var_run_t,s0) +/var/run/glusterd\.pid -- gen_context(system_u:object_r:glusterd_var_run_t,s0) + diff --git a/glusterd.if b/glusterd.if new file mode 100644 index 0000000..e15bbb0 --- /dev/null +++ b/glusterd.if @@ -0,0 +1,146 @@ + +## policy for glusterd + + +######################################## +## +## Transition to glusterd. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`glusterd_domtrans',` + gen_require(` + type glusterd_t, glusterd_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, glusterd_exec_t, glusterd_t) +') + + +######################################## +## +## Execute glusterd server in the glusterd domain. +## +## +## +## Domain allowed access. +## +## +# +interface(`glusterd_initrc_domtrans',` + gen_require(` + type glusterd_initrc_exec_t; + ') + + init_labeled_script_domtrans($1, glusterd_initrc_exec_t) +') + + +######################################## +## +## Read glusterd's log files. +## +## +## +## Domain allowed access. +## +## +## +# +interface(`glusterd_read_log',` + gen_require(` + type glusterd_log_t; + ') + + logging_search_logs($1) + read_files_pattern($1, glusterd_log_t, glusterd_log_t) +') + +######################################## +## +## Append to glusterd log files. +## +## +## +## Domain allowed access. +## +## +# +interface(`glusterd_append_log',` + gen_require(` + type glusterd_log_t; + ') + + logging_search_logs($1) + append_files_pattern($1, glusterd_log_t, glusterd_log_t) +') + +######################################## +## +## Manage glusterd log files +## +## +## +## Domain allowed access. +## +## +# +interface(`glusterd_manage_log',` + gen_require(` + type glusterd_log_t; + ') + + logging_search_logs($1) + manage_dirs_pattern($1, glusterd_log_t, glusterd_log_t) + manage_files_pattern($1, glusterd_log_t, glusterd_log_t) + manage_lnk_files_pattern($1, glusterd_log_t, glusterd_log_t) +') + +######################################## +## +## All of the rules required to administrate +## an glusterd environment +## +## +## +## Domain allowed access. +## +## +## +## +## Role allowed access. +## +## +## +# +interface(`glusterd_admin',` + gen_require(` + type glusterd_t; + type glusterd_initrc_exec_t; + type glusterd_log_t; + type glusterd_tmp_t; + type glusterd_etc_t; + ') + + allow $1 glusterd_t:process { ptrace signal_perms }; + ps_process_pattern($1, glusterd_t) + + glusterd_initrc_domtrans($1) + domain_system_change_exemption($1) + role_transition $2 glusterd_initrc_exec_t system_r; + allow $2 system_r; + + logging_search_logs($1) + admin_pattern($1, glusterd_log_t) + + admin_pattern($1, glusterd_tmp_t) + + admin_pattern($1, glusterd_etc_t) + +') + diff --git a/glusterd.te b/glusterd.te new file mode 100644 index 0000000..d35f2b0 --- /dev/null +++ b/glusterd.te @@ -0,0 +1,101 @@ +policy_module(glusterd, 1.0.0) + +######################################## +# +# Declarations +# + +type glusterd_t; +type glusterd_exec_t; +init_daemon_domain(glusterd_t, glusterd_exec_t) + +type glusterd_etc_t; +files_type(glusterd_etc_t) + +type glusterd_tmp_t; +files_tmp_file(glusterd_tmp_t) + +type glusterd_initrc_exec_t; +init_script_file(glusterd_initrc_exec_t) + +type glusterd_log_t; +logging_log_file(glusterd_log_t) + +type glusterd_var_run_t; +files_pid_file(glusterd_var_run_t) + +type glusterd_var_lib_t; +files_type(glusterd_var_lib_t); + + +######################################## +# +# glusterd local policy +# + +allow glusterd_t self:capability { net_bind_service sys_admin dac_override chown dac_read_search fowner }; +allow glusterd_t self:process { setrlimit signal }; +allow glusterd_t self:capability sys_resource; + +allow glusterd_t self:fifo_file rw_fifo_file_perms; +allow glusterd_t self:netlink_route_socket r_netlink_socket_perms; +allow glusterd_t self:tcp_socket create_stream_socket_perms; +allow glusterd_t self:udp_socket create_socket_perms; +allow glusterd_t self:unix_stream_socket create_stream_socket_perms; +allow glusterd_t self:unix_dgram_socket create_socket_perms; + +manage_dirs_pattern(glusterd_t, glusterd_tmp_t, glusterd_tmp_t) +manage_files_pattern(glusterd_t, glusterd_tmp_t, glusterd_tmp_t) +manage_sock_files_pattern(glusterd_t, glusterd_tmp_t, glusterd_tmp_t) +files_tmp_filetrans(glusterd_t, glusterd_tmp_t, { dir file sock_file }) +userdom_user_tmp_filetrans(glusterd_t, glusterd_tmp_t, { dir file sock_file }) + +manage_dirs_pattern(glusterd_t, glusterd_log_t, glusterd_log_t) +manage_files_pattern(glusterd_t, glusterd_log_t, glusterd_log_t) +logging_log_filetrans(glusterd_t, glusterd_log_t, { dir file }) + +manage_dirs_pattern(glusterd_t, glusterd_var_run_t, glusterd_var_run_t) +manage_files_pattern(glusterd_t, glusterd_var_run_t, glusterd_var_run_t) +files_pid_filetrans(glusterd_t, glusterd_var_run_t, { dir file }) + +manage_dirs_pattern(glusterd_t, glusterd_var_lib_t, glusterd_var_lib_t) +manage_files_pattern(glusterd_t, glusterd_var_lib_t, glusterd_var_lib_t) +files_var_lib_filetrans(glusterd_t, glusterd_var_lib_t, { dir file }) + +manage_dirs_pattern(glusterd_t, glusterd_etc_t, glusterd_etc_t) +manage_files_pattern(glusterd_t, glusterd_etc_t, glusterd_etc_t) +files_etc_filetrans(glusterd_t, glusterd_etc_t, { dir file }, "glusterfs") + +can_exec(glusterd_t, glusterd_exec_t) + +kernel_read_system_state(glusterd_t) + +corecmd_exec_bin(glusterd_t) +corecmd_exec_shell(glusterd_t) + +domain_use_interactive_fds(glusterd_t) + +corenet_tcp_bind_generic_node(glusterd_t) +corenet_tcp_bind_generic_port(glusterd_t) +corenet_tcp_bind_all_reserved_ports(glusterd_t) +corenet_udp_bind_all_rpc_ports(glusterd_t) +corenet_tcp_connect_unreserved_ports(glusterd_t) +corenet_udp_bind_generic_node(glusterd_t) +corenet_udp_bind_ipp_port(glusterd_t) + +dev_read_sysfs(glusterd_t) +dev_read_urand(glusterd_t) + +files_read_usr_files(glusterd_t) +files_rw_pid_dirs(glusterd_t) + +# Why is this needed +#files_manage_urandom_seed(glusterd_t) + +auth_use_nsswitch(glusterd_t) + +logging_send_syslog_msg(glusterd_t) + +sysnet_read_config(glusterd_t) + +userdom_manage_user_home_dirs(glusterd_t) diff --git a/gnome.fc b/gnome.fc index 00a19e3..17006fc 100644 --- a/gnome.fc +++ b/gnome.fc @@ -1,9 +1,54 @@ -HOME_DIR/\.config/gtk-.* gen_context(system_u:object_r:gnome_home_t,s0) +HOME_DIR/\.cache(/.*)? gen_context(system_u:object_r:cache_home_t,s0) +HOME_DIR/\.color/icc(/.*)? gen_context(system_u:object_r:icc_data_home_t,s0) +HOME_DIR/\.dbus(/.*)? gen_context(system_u:object_r:dbus_home_t,s0) +HOME_DIR/\.config(/.*)? gen_context(system_u:object_r:config_home_t,s0) +HOME_DIR/\.kde(/.*)? gen_context(system_u:object_r:config_home_t,s0) +HOME_DIR/\.nv(/.*)? gen_context(system_u:object_r:cache_home_t,s0) HOME_DIR/\.gconf(d)?(/.*)? gen_context(system_u:object_r:gconf_home_t,s0) HOME_DIR/\.gnome2(/.*)? gen_context(system_u:object_r:gnome_home_t,s0) +HOME_DIR/\.gnome2/keyrings(/.*)? gen_context(system_u:object_r:gkeyringd_gnome_home_t,s0) +HOME_DIR/\.grl-bookmarks gen_context(system_u:object_r:gstreamer_home_t,s0) +HOME_DIR/\.grl-metadata-store gen_context(system_u:object_r:gstreamer_home_t,s0) +HOME_DIR/\.grl-bookmarks gen_context(system_u:object_r:gstreamer_home_t,s0) +HOME_DIR/\.gstreamer-.* gen_context(system_u:object_r:gstreamer_home_t,s0) +HOME_DIR/\.orc(/.*)? gen_context(system_u:object_r:gstreamer_home_t,s0) +HOME_DIR/\.local.* gen_context(system_u:object_r:gconf_home_t,s0) +HOME_DIR/\.local/share(/.*)? gen_context(system_u:object_r:data_home_t,s0) +HOME_DIR/\.local/share/icc(/.*)? gen_context(system_u:object_r:icc_data_home_t,s0) +HOME_DIR/\.Xdefaults gen_context(system_u:object_r:config_home_t,s0) +HOME_DIR/\.xine(/.*)? gen_context(system_u:object_r:config_home_t,s0) + +/var/run/user/[^/]*/\.orc(/.*)? gen_context(system_u:object_r:gstreamer_home_t,s0) +/var/run/user/[^/]*/dconf(/.*)? gen_context(system_u:object_r:config_home_t,s0) +/var/run/user/[^/]*/keyring.* gen_context(system_u:object_r:gkeyringd_tmp_t,s0) + +/root/\.cache(/.*)? gen_context(system_u:object_r:cache_home_t,s0) +/root/\.color/icc(/.*)? gen_context(system_u:object_r:icc_data_home_t,s0) +/root/\.config(/.*)? gen_context(system_u:object_r:config_home_t,s0) +/root/\.kde(/.*)? gen_context(system_u:object_r:config_home_t,s0) +/root/\.gconf(d)?(/.*)? gen_context(system_u:object_r:gconf_home_t,s0) +/root/\.dbus(/.*)? gen_context(system_u:object_r:dbus_home_t,s0) +/root/\.gnome2(/.*)? gen_context(system_u:object_r:gnome_home_t,s0) +/root/\.gnome2/keyrings(/.*)? gen_context(system_u:object_r:gkeyringd_gnome_home_t,s0) +/root/\.gstreamer-.* gen_context(system_u:object_r:gstreamer_home_t,s0) +/root/\.local.* gen_context(system_u:object_r:gconf_home_t,s0) +/root/\.local/share(/.*)? gen_context(system_u:object_r:data_home_t,s0) +/root/\.local/share/icc(/.*)? gen_context(system_u:object_r:icc_data_home_t,s0) +/root/\.Xdefaults gen_context(system_u:object_r:config_home_t,s0) +/root/\.xine(/.*)? gen_context(system_u:object_r:config_home_t,s0) /etc/gconf(/.*)? gen_context(system_u:object_r:gconf_etc_t,s0) /tmp/gconfd-USER/.* -- gen_context(system_u:object_r:gconf_tmp_t,s0) -/usr/libexec/gconfd-2 -- gen_context(system_u:object_r:gconfd_exec_t,s0) +/usr/share/config(/.*)? gen_context(system_u:object_r:config_usr_t,s0) + +/usr/bin/gnome-keyring-daemon -- gen_context(system_u:object_r:gkeyringd_exec_t,s0) + +# Don't use because toolchain is broken +#/usr/libexec/gconfd-2 -- gen_context(system_u:object_r:gconfd_exec_t,s0) + +/usr/libexec/gconf-defaults-mechanism -- gen_context(system_u:object_r:gconfdefaultsm_exec_t,s0) + +/usr/libexec/gnome-system-monitor-mechanism -- gen_context(system_u:object_r:gnomesystemmm_exec_t,s0) +/usr/libexec/kde(3|4)/ksysguardprocesslist_helper -- gen_context(system_u:object_r:gnomesystemmm_exec_t,s0) diff --git a/gnome.if b/gnome.if index f5afe78..c8cd7db 100644 --- a/gnome.if +++ b/gnome.if @@ -1,44 +1,958 @@ ## GNU network object model environment (GNOME) -############################################################ +########################################################### ## -## Role access for gnome +## Role access for gnome ## ## +## +## Role allowed access +## +## +## +## +## User domain for the role +## +## +# +interface(`gnome_role',` + gen_require(` + type gconfd_t, gconfd_exec_t; + type gconf_tmp_t; + ') + + role $1 types gconfd_t; + + domain_auto_trans($2, gconfd_exec_t, gconfd_t) + allow gconfd_t $2:fd use; + allow gconfd_t $2:fifo_file write; + allow gconfd_t $2:unix_stream_socket connectto; + + ps_process_pattern($2, gconfd_t) + + #gnome_stream_connect_gconf_template($1, $2) + read_files_pattern($2, gconf_tmp_t, gconf_tmp_t) + allow $2 gconfd_t:unix_stream_socket connectto; +') + +###################################### +## +## The role template for the gnome-keyring-daemon. +## +## +## +## The user domain associated with the role. +## +## +## +## +## The user prefix. +## +## +## +## +## The user role. +## +## +# +interface(`gnome_role_gkeyringd',` + gen_require(` + attribute gkeyringd_domain; + attribute gnomedomain; + type gnome_home_t; + type gkeyringd_exec_t, gkeyringd_tmp_t, gkeyringd_gnome_home_t; + class dbus send_msg; + ') + + type $1_gkeyringd_t, gnomedomain, gkeyringd_domain; + typealias $1_gkeyringd_t alias gkeyringd_$1_t; + application_domain($1_gkeyringd_t, gkeyringd_exec_t) + ubac_constrained($1_gkeyringd_t) + domain_user_exemption_target($1_gkeyringd_t) + + userdom_home_manager($1_gkeyringd_t) + + role $2 types $1_gkeyringd_t; + + domtrans_pattern($3, gkeyringd_exec_t, $1_gkeyringd_t) + + allow $3 gkeyringd_gnome_home_t:dir { relabel_dir_perms manage_dir_perms }; + allow $3 gkeyringd_gnome_home_t:file { relabel_file_perms manage_file_perms }; + + allow $3 gkeyringd_tmp_t:dir { relabel_dir_perms manage_dir_perms }; + allow $3 gkeyringd_tmp_t:sock_file { relabel_sock_file_perms manage_sock_file_perms }; + + corecmd_bin_domtrans($1_gkeyringd_t, $1_t) + corecmd_shell_domtrans($1_gkeyringd_t, $1_t) + allow $1_gkeyringd_t $3:process sigkill; + allow $3 $1_gkeyringd_t:fd use; + allow $3 $1_gkeyringd_t:fifo_file rw_fifo_file_perms; + + ps_process_pattern($1_gkeyringd_t, $3) + + auth_use_nsswitch($1_gkeyringd_t) + + logging_send_syslog_msg($1_gkeyringd_t) + + ps_process_pattern($3, $1_gkeyringd_t) + allow $3 $1_gkeyringd_t:process signal_perms; + dontaudit $3 gkeyringd_exec_t:file entrypoint; + + stream_connect_pattern($3, gkeyringd_tmp_t, gkeyringd_tmp_t, $1_gkeyringd_t) + + allow $1_gkeyringd_t $3:dbus send_msg; + allow $3 $1_gkeyringd_t:dbus send_msg; + optional_policy(` + dbus_session_domain($1, gkeyringd_exec_t, $1_gkeyringd_t) + dbus_session_bus_client($1_gkeyringd_t) + gnome_home_dir_filetrans($1_gkeyringd_t) + gnome_manage_generic_home_dirs($1_gkeyringd_t) + gnome_read_generic_data_home_files($1_gkeyringd_t) + + optional_policy(` + telepathy_mission_control_read_state($1_gkeyringd_t) + ') + ') +') + +######################################## +## +## gconf connection template. +## +## +## +## Domain allowed access. +## +## +# +interface(`gnome_stream_connect_gconf',` + gen_require(` + type gconfd_t, gconf_tmp_t; + ') + + read_files_pattern($1, gconf_tmp_t, gconf_tmp_t) + allow $1 gconfd_t:unix_stream_socket connectto; +') + +######################################## +## +## Connect to gkeyringd with a unix stream socket. +## +## +## +## Domain allowed access. +## +## +# +interface(`gnome_stream_connect_gkeyringd',` + gen_require(` + attribute gkeyringd_domain; + type gkeyringd_tmp_t; + type gconf_tmp_t; + type cache_home_t; + ') + + allow $1 gconf_tmp_t:dir search_dir_perms; + userdom_search_user_tmp_dirs($1) + stream_connect_pattern($1, gkeyringd_tmp_t, gkeyringd_tmp_t, gkeyringd_domain) + stream_connect_pattern($1, cache_home_t, cache_home_t, gkeyringd_domain) +') + +######################################## +## +## Run gconfd in gconfd domain. +## +## +## +## Domain allowed access. +## +## +# +interface(`gnome_domtrans_gconfd',` + gen_require(` + type gconfd_t, gconfd_exec_t; + ') + + domtrans_pattern($1, gconfd_exec_t, gconfd_t) +') + +######################################## +## +## Dontaudit read gnome homedir content (.config) +## +## +## +## Domain to not audit. +## +## +# +interface(`gnome_dontaudit_read_config',` + gen_require(` + attribute gnome_home_type; + ') + + dontaudit $1 gnome_home_type:dir read_inherited_file_perms; +') + +######################################## +## +## Dontaudit search gnome homedir content (.config) +## +## +## +## Domain to not audit. +## +## +# +interface(`gnome_dontaudit_search_config',` + gen_require(` + attribute gnome_home_type; + ') + + dontaudit $1 gnome_home_type:dir search_dir_perms; +') + +######################################## +## +## Dontaudit write gnome homedir content (.config) +## +## +## +## Domain to not audit. +## +## +# +interface(`gnome_dontaudit_write_config_files',` + gen_require(` + attribute gnome_home_type; + ') + + dontaudit $1 gnome_home_type:file write; +') + +######################################## +## +## manage gnome homedir content (.config) +## +## +## +## Domain allowed access. +## +## +# +interface(`gnome_manage_config',` + gen_require(` + attribute gnome_home_type; + ') + + allow $1 gnome_home_type:dir manage_dir_perms; + allow $1 gnome_home_type:file manage_file_perms; + allow $1 gnome_home_type:lnk_file manage_lnk_file_perms; + userdom_search_user_home_dirs($1) +') + +######################################## +## +## Send general signals to all gconf domains. +## +## +## +## Domain allowed access. +## +## +# +interface(`gnome_signal_all',` + gen_require(` + attribute gnomedomain; + ') + + allow $1 gnomedomain:process signal; +') + +######################################## +## +## Create objects in a Gnome cache home directory +## with an automatic type transition to +## a specified private type. +## +## +## +## Domain allowed access. +## +## +## +## +## The type of the object to create. +## +## +## +## +## The class of the object to be created. +## +## +# +interface(`gnome_cache_filetrans',` + gen_require(` + type cache_home_t; + ') + + filetrans_pattern($1, cache_home_t, $2, $3, $4) + userdom_search_user_home_dirs($1) +') + +######################################## +## +## Create objects in a Gnome cache home directory +## with an automatic type transition to +## a specified private type. +## +## +## +## Domain allowed access. +## +## +## +## +## The type of the object to create. +## +## +## +## +## The class of the object to be created. +## +## +# +interface(`gnome_config_filetrans',` + gen_require(` + type config_home_t; + ') + + filetrans_pattern($1, config_home_t, $2, $3, $4) + userdom_search_user_home_dirs($1) +') + +######################################## +## +## Read generic cache home files (.cache) +## +## +## +## Domain allowed access. +## +## +# +interface(`gnome_read_generic_cache_files',` + gen_require(` + type cache_home_t; + ') + + read_files_pattern($1, cache_home_t, cache_home_t) + userdom_search_user_home_dirs($1) +') + +######################################## +## +## Set attributes of cache home dir (.cache) +## +## +## +## Domain allowed access. +## +## +# +interface(`gnome_setattr_cache_home_dir',` + gen_require(` + type cache_home_t; + ') + + setattr_dirs_pattern($1, cache_home_t, cache_home_t) + userdom_search_user_home_dirs($1) +') + +######################################## +## +## Manage cache home dir (.cache) +## +## +## +## Domain allowed access. +## +## +# +interface(`gnome_manage_cache_home_dir',` + gen_require(` + type cache_home_t; + ') + + manage_dirs_pattern($1, cache_home_t, cache_home_t) + userdom_search_user_home_dirs($1) +') + +######################################## +## +## append to generic cache home files (.cache) +## +## +## +## Domain allowed access. +## +## +# +interface(`gnome_append_generic_cache_files',` + gen_require(` + type cache_home_t; + ') + + append_files_pattern($1, cache_home_t, cache_home_t) + userdom_search_user_home_dirs($1) +') + +######################################## +## +## write to generic cache home files (.cache) +## +## +## +## Domain allowed access. +## +## +# +interface(`gnome_write_generic_cache_files',` + gen_require(` + type cache_home_t; + ') + + write_files_pattern($1, cache_home_t, cache_home_t) + userdom_search_user_home_dirs($1) +') + +######################################## +## +## Manage a sock_file in the generic cache home files (.cache) +## +## +## +## Domain allowed access. +## +## +# +interface(`gnome_manage_generic_cache_sockets',` + gen_require(` + type cache_home_t; + ') + + userdom_search_user_home_dirs($1) + manage_sock_files_pattern($1, cache_home_t, cache_home_t) +') + +######################################## +## +## Dontaudit read/write to generic cache home files (.cache) +## +## +## +## Domain to not audit. +## +## +# +interface(`gnome_dontaudit_rw_generic_cache_files',` + gen_require(` + type cache_home_t; + ') + + dontaudit $1 cache_home_t:file rw_inherited_file_perms; +') + +######################################## +## +## read gnome homedir content (.config) +## +## +## +## Domain allowed access. +## +## +# +interface(`gnome_read_config',` + gen_require(` + attribute gnome_home_type; + ') + + list_dirs_pattern($1, gnome_home_type, gnome_home_type) + read_files_pattern($1, gnome_home_type, gnome_home_type) + read_lnk_files_pattern($1, gnome_home_type, gnome_home_type) +') + +######################################## +## +## Create objects in a Gnome gconf home directory +## with an automatic type transition to +## a specified private type. +## +## +## +## Domain allowed access. +## +## +## +## +## The type of the object to create. +## +## +## +## +## The class of the object to be created. +## +## +# +interface(`gnome_data_filetrans',` + gen_require(` + type data_home_t; + ') + + filetrans_pattern($1, data_home_t, $2, $3, $4) + gnome_search_gconf($1) +') + +####################################### +## +## Read generic data home files. +## +## +## +## Domain allowed access. +## +## +# +interface(`gnome_read_generic_data_home_files',` + gen_require(` + type data_home_t, gconf_home_t; + ') + + read_files_pattern($1, { gconf_home_t data_home_t }, data_home_t) +') + +####################################### +## +## Manage gconf data home files +## +## +## +## Domain allowed access. +## +## +# +interface(`gnome_manage_data',` + gen_require(` + type data_home_t; + type gconf_home_t; + ') + + allow $1 gconf_home_t:dir search_dir_perms; + manage_dirs_pattern($1, data_home_t, data_home_t) + manage_files_pattern($1, data_home_t, data_home_t) + manage_lnk_files_pattern($1, data_home_t, data_home_t) +') + +######################################## +## +## Read icc data home content. +## +## +## +## Domain allowed access. +## +## +# +interface(`gnome_read_home_icc_data_content',` + gen_require(` + type icc_data_home_t, gconf_home_t, data_home_t; + ') + + userdom_search_user_home_dirs($1) + allow $1 { gconf_home_t data_home_t }:dir search_dir_perms; + list_dirs_pattern($1, icc_data_home_t, icc_data_home_t) + read_files_pattern($1, icc_data_home_t, icc_data_home_t) + read_lnk_files_pattern($1, icc_data_home_t, icc_data_home_t) +') + +######################################## +## +## Read inherited icc data home files. +## +## +## +## Domain allowed access. +## +## +# +interface(`gnome_read_inherited_home_icc_data_files',` + gen_require(` + type icc_data_home_t; + ') + + allow $1 icc_data_home_t:file read_inherited_file_perms; +') + +######################################## +## +## Create gconf_home_t objects in the /root directory +## +## +## +## Domain allowed access. +## +## +## +## +## The class of the object to be created. +## +## +# +interface(`gnome_admin_home_gconf_filetrans',` + gen_require(` + type gconf_home_t; + ') + + userdom_admin_home_dir_filetrans($1, gconf_home_t, $2) +') + +######################################## +## +## Do not audit attempts to read +## inherited gconf config files. +## +## +## +## Domain to not audit. +## +## +# +interface(`gnome_dontaudit_read_inherited_gconf_config_files',` + gen_require(` + type gconf_etc_t; + ') + + dontaudit $1 gconf_etc_t:file read_inherited_file_perms; +') + +######################################## +## +## read gconf config files +## +## +## +## Domain allowed access. +## +## +# +interface(`gnome_read_gconf_config',` + gen_require(` + type gconf_etc_t; + ') + + allow $1 gconf_etc_t:dir list_dir_perms; + read_files_pattern($1, gconf_etc_t, gconf_etc_t) + files_search_etc($1) +') + +####################################### +## +## Manage gconf config files +## +## +## +## Domain allowed access. +## +## +# +interface(`gnome_manage_gconf_config',` + gen_require(` + type gconf_etc_t; + ') + + allow $1 gconf_etc_t:dir list_dir_perms; + manage_files_pattern($1, gconf_etc_t, gconf_etc_t) +') + +######################################## +## +## Execute gconf programs in +## in the caller domain. +## +## +## +## Domain allowed access. +## +## +# +interface(`gnome_exec_gconf',` + gen_require(` + type gconfd_exec_t; + ') + + can_exec($1, gconfd_exec_t) +') + +######################################## +## +## Execute gnome keyringd in the caller domain. +## +## +## +## Domain allowed access. +## +## +# +interface(`gnome_exec_keyringd',` + gen_require(` + type gkeyringd_exec_t; + ') + + can_exec($1, gkeyringd_exec_t) + corecmd_search_bin($1) +') + +######################################## +## +## Read gconf home files +## +## +## +## Domain allowed access. +## +## +# +interface(`gnome_read_gconf_home_files',` + gen_require(` + type gconf_home_t; + type data_home_t; + ') + + userdom_search_user_home_dirs($1) + allow $1 gconf_home_t:dir list_dir_perms; + allow $1 data_home_t:dir list_dir_perms; + read_files_pattern($1, gconf_home_t, gconf_home_t) + read_files_pattern($1, data_home_t, data_home_t) + read_lnk_files_pattern($1, gconf_home_t, gconf_home_t) + read_lnk_files_pattern($1, data_home_t, data_home_t) +') + +######################################## +## +## Search gkeyringd temporary directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`gnome_search_gkeyringd_tmp_dirs',` + gen_require(` + type gkeyringd_tmp_t; + ') + + files_search_tmp($1) + allow $1 gkeyringd_tmp_t:dir search_dir_perms; +') + +######################################## +## +## List gkeyringd temporary directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`gnome_list_gkeyringd_tmp_dirs',` + gen_require(` + type gkeyringd_tmp_t; + ') + + files_search_tmp($1) + allow $1 gkeyringd_tmp_t:dir list_dir_perms; +') + +######################################## +## +## search gconf homedir (.local) +## +## +## +## Domain allowed access. +## +## +# +interface(`gnome_search_gconf',` + gen_require(` + type gconf_home_t; + ') + + allow $1 gconf_home_t:dir search_dir_perms; + userdom_search_user_home_dirs($1) +') + +######################################## +## +## Set attributes of Gnome config dirs. +## +## +## +## Domain allowed access. +## +## +# +interface(`gnome_setattr_config_dirs',` + gen_require(` + type gnome_home_t; + ') + + setattr_dirs_pattern($1, gnome_home_t, gnome_home_t) + files_search_home($1) +') + +######################################## +## +## Manage generic gnome home files. +## +## +## +## Domain allowed access. +## +## +# +interface(`gnome_manage_generic_home_files',` + gen_require(` + type gnome_home_t; + ') + + userdom_search_user_home_dirs($1) + manage_files_pattern($1, gnome_home_t, gnome_home_t) +') + +######################################## +## +## Manage generic gnome home directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`gnome_manage_generic_home_dirs',` + gen_require(` + type gnome_home_t; + ') + + userdom_search_user_home_dirs($1) + allow $1 gnome_home_t:dir manage_dir_perms; +') + +######################################## +## +## Append gconf home files +## +## +## +## Domain allowed access. +## +## +# +interface(`gnome_append_gconf_home_files',` + gen_require(` + type gconf_home_t; + ') + + append_files_pattern($1, gconf_home_t, gconf_home_t) +') + +######################################## +## +## manage gconf home files +## +## ## -## Role allowed access +## Domain allowed access. ## ## +# +interface(`gnome_manage_gconf_home_files',` + gen_require(` + type gconf_home_t; + ') + + allow $1 gconf_home_t:dir list_dir_perms; + manage_files_pattern($1, gconf_home_t, gconf_home_t) +') + +######################################## +## +## Connect to gnome over a unix stream socket. +## ## ## -## User domain for the role +## Domain allowed access. +## +## +## +## +## The type of the user domain. ## ## # -interface(`gnome_role',` +interface(`gnome_stream_connect',` gen_require(` - type gconfd_t, gconfd_exec_t; - type gconf_tmp_t; + attribute gnome_home_type; ') - role $1 types gconfd_t; + # Connect to pulseaudit server + stream_connect_pattern($1, gnome_home_type, gnome_home_type, $2) +') + +######################################## +## +## list gnome homedir content (.config) +## +## +## +## Domain allowed access. +## +## +# +interface(`gnome_list_home_config',` + gen_require(` + type config_home_t; + ') - domain_auto_trans($2, gconfd_exec_t, gconfd_t) - allow gconfd_t $2:fd use; - allow gconfd_t $2:fifo_file write; - allow gconfd_t $2:unix_stream_socket connectto; + allow $1 config_home_t:dir list_dir_perms; +') - ps_process_pattern($2, gconfd_t) +######################################## +## +## Set attributes of gnome homedir content (.config) +## +## +## +## Domain allowed access. +## +## +# +interface(`gnome_setattr_home_config',` + gen_require(` + type config_home_t; + ') - #gnome_stream_connect_gconf_template($1, $2) - read_files_pattern($2, gconf_tmp_t, gconf_tmp_t) - allow $2 gconfd_t:unix_stream_socket connectto; + setattr_dirs_pattern($1, config_home_t, config_home_t) + userdom_search_user_home_dirs($1) ') ######################################## ## -## Execute gconf programs in -## in the caller domain. +## read gnome homedir content (.config) ## ## ## @@ -46,37 +960,91 @@ interface(`gnome_role',` ## ## # -interface(`gnome_exec_gconf',` +interface(`gnome_read_home_config',` gen_require(` - type gconfd_exec_t; + type config_home_t; ') - can_exec($1, gconfd_exec_t) + list_dirs_pattern($1, config_home_t, config_home_t) + read_files_pattern($1, config_home_t, config_home_t) + read_lnk_files_pattern($1, config_home_t, config_home_t) +') + +####################################### +## +## delete gnome homedir content (.config) +## +## +## +## Domain allowed access. +## +## +# +interface(`gnome_delete_home_config',` + gen_require(` + type config_home_t; + ') + + delete_files_pattern($1, config_home_t, config_home_t) +') + +####################################### +## +## setattr gnome homedir content (.config) +## +## +## +## Domain allowed access. +## +## +# +interface(`gnome_setattr_home_config_dirs',` + gen_require(` + type config_home_t; + ') + + setattr_dirs_pattern($1, config_home_t, config_home_t) ') ######################################## ## -## Read gconf config files. +## manage gnome homedir content (.config) ## -## +## ## ## Domain allowed access. ## ## # -template(`gnome_read_gconf_config',` +interface(`gnome_manage_home_config',` gen_require(` - type gconf_etc_t; + type config_home_t; ') - allow $1 gconf_etc_t:dir list_dir_perms; - read_files_pattern($1, gconf_etc_t, gconf_etc_t) - files_search_etc($1) + manage_files_pattern($1, config_home_t, config_home_t) ') ####################################### ## -## Create, read, write, and delete gconf config files. +## delete gnome homedir content (.config) +## +## +## +## Domain allowed access. +## +## +# +interface(`gnome_delete_home_config_dirs',` + gen_require(` + type config_home_t; + ') + + delete_dirs_pattern($1, config_home_t, config_home_t) +') + +######################################## +## +## manage gnome homedir content (.config) ## ## ## @@ -84,37 +1052,100 @@ template(`gnome_read_gconf_config',` ## ## # -interface(`gnome_manage_gconf_config',` +interface(`gnome_manage_home_config_dirs',` gen_require(` - type gconf_etc_t; + type config_home_t; ') - manage_files_pattern($1, gconf_etc_t, gconf_etc_t) - files_search_etc($1) + manage_dirs_pattern($1, config_home_t, config_home_t) ') ######################################## ## -## gconf connection template. +## manage gstreamer home content files. ## -## +## ## ## Domain allowed access. ## ## # -interface(`gnome_stream_connect_gconf',` +interface(`gnome_manage_gstreamer_home_files',` gen_require(` - type gconfd_t, gconf_tmp_t; + type gstreamer_home_t; ') - read_files_pattern($1, gconf_tmp_t, gconf_tmp_t) - allow $1 gconfd_t:unix_stream_socket connectto; + manage_files_pattern($1, gstreamer_home_t, gstreamer_home_t) + gnome_filetrans_gstreamer_home_content($1) +') + +###################################### +## +## Allow to execute gstreamer home content files. +## +## +## +## Domain allowed access. +## +## +# +interface(`gnome_exec_gstreamer_home_files',` + gen_require(` + type gstreamer_home_t; + ') + + can_exec($1, gstreamer_home_t) +') + +####################################### +## +## file name transition gstreamer home content files. +## +## +## +## Domain allowed access. +## +## +# +interface(`gnome_filetrans_gstreamer_home_content',` + gen_require(` + type gstreamer_home_t; + ') + + userdom_user_home_dir_filetrans($1, gstreamer_home_t, file, ".grl-bookmarks") + userdom_user_home_dir_filetrans($1, gstreamer_home_t, file, ".grl-metadata-store") + userdom_user_home_dir_filetrans($1, gstreamer_home_t, file, ".grl-podcasts") + userdom_user_home_dir_filetrans($1, gstreamer_home_t, dir, ".gstreamer-0.12") + userdom_user_home_dir_filetrans($1, gstreamer_home_t, dir, ".gstreamer-0.10") + userdom_user_home_dir_filetrans($1, gstreamer_home_t, dir, ".gstreamer-1.0") + userdom_user_home_dir_filetrans($1, gstreamer_home_t, dir, ".gstreamer-1.2") + userdom_user_home_dir_filetrans($1, gstreamer_home_t, dir, ".gstreamer-10") + userdom_user_home_dir_filetrans($1, gstreamer_home_t, dir, ".gstreamer-12") + userdom_user_home_dir_filetrans($1, gstreamer_home_t, dir, ".orc") + userdom_user_tmp_filetrans($1, gstreamer_home_t, dir, ".orc") +') + +####################################### +## +## manage gstreamer home content files. +## +## +## +## Domain allowed access. +## +## +# +interface(`gnome_manage_gstreamer_home_dirs',` + gen_require(` + type gstreamer_home_t; + ') + + manage_dirs_pattern($1, gstreamer_home_t, gstreamer_home_t) ') ######################################## ## -## Run gconfd in gconfd domain. +## Read/Write all inherited gnome home config ## ## ## @@ -122,17 +1153,36 @@ interface(`gnome_stream_connect_gconf',` ## ## # -interface(`gnome_domtrans_gconfd',` +interface(`gnome_rw_inherited_config',` gen_require(` - type gconfd_t, gconfd_exec_t; + attribute gnome_home_type; ') - domtrans_pattern($1, gconfd_exec_t, gconfd_t) + allow $1 gnome_home_type:file rw_inherited_file_perms; ') ######################################## ## -## Set attributes of Gnome config dirs. +## Dontaudit Read/Write all inherited gnome home config +## +## +## +## Domain to not audit. +## +## +# +interface(`gnome_dontaudit_rw_inherited_config',` + gen_require(` + attribute gnome_home_type; + ') + + dontaudit $1 gnome_home_type:file rw_inherited_file_perms; +') + +######################################## +## +## Send and receive messages from +## gconf system service over dbus. ## ## ## @@ -140,51 +1190,274 @@ interface(`gnome_domtrans_gconfd',` ## ## # -interface(`gnome_setattr_config_dirs',` +interface(`gnome_dbus_chat_gconfdefault',` gen_require(` - type gnome_home_t; + type gconfdefaultsm_t; + class dbus send_msg; ') - setattr_dirs_pattern($1, gnome_home_t, gnome_home_t) - files_search_home($1) + allow $1 gconfdefaultsm_t:dbus send_msg; + allow gconfdefaultsm_t $1:dbus send_msg; ') ######################################## ## -## Read gnome homedir content (.config) +## Send and receive messages from +## gkeyringd over dbus. ## -## +## ## ## Domain allowed access. ## ## # -template(`gnome_read_config',` +interface(`gnome_dbus_chat_gkeyringd',` gen_require(` - type gnome_home_t; + attribute gkeyringd_domain; + class dbus send_msg; ') - list_dirs_pattern($1, gnome_home_t, gnome_home_t) - read_files_pattern($1, gnome_home_t, gnome_home_t) - read_lnk_files_pattern($1, gnome_home_t, gnome_home_t) + allow $1 gkeyringd_domain:dbus send_msg; + allow gkeyringd_domain $1:dbus send_msg; ') ######################################## ## -## manage gnome homedir content (.config) +## Send signull signal to gkeyringd processes. ## -## +## ## ## Domain allowed access. ## ## # -interface(`gnome_manage_config',` +interface(`gnome_signull_gkeyringd',` + gen_require(` + attribute gkeyringd_domain; + ') + + allow $1 gkeyringd_domain:process signull; +') + +######################################## +## +## Allow the domain to read gkeyringd state files in /proc. +## +## +## +## Domain allowed access. +## +## +# +interface(`gnome_read_gkeyringd_state',` + gen_require(` + attribute gkeyringd_domain; + ') + + ps_process_pattern($1, gkeyringd_domain) +') + +######################################## +## +## Create directories in user home directories +## with the gnome home file type. +## +## +## +## Domain allowed access. +## +## +# +interface(`gnome_home_dir_filetrans',` gen_require(` type gnome_home_t; ') - allow $1 gnome_home_t:dir manage_dir_perms; - allow $1 gnome_home_t:file manage_file_perms; + userdom_user_home_dir_filetrans($1, gnome_home_t, dir) userdom_search_user_home_dirs($1) ') + +###################################### +## +## Allow read kde config content +## +## +## +## Domain allowed access. +## +## +# +interface(`gnome_read_usr_config',` + gen_require(` + type config_usr_t; + ') + + files_search_usr($1) + list_dirs_pattern($1, config_usr_t, config_usr_t) + read_files_pattern($1, config_usr_t, config_usr_t) + read_lnk_files_pattern($1, config_usr_t, config_usr_t) +') + +####################################### +## +## Allow manage kde config content +## +## +## +## Domain allowed access. +## +## +# +interface(`gnome_manage_usr_config',` + gen_require(` + type config_usr_t; + ') + + files_search_usr($1) + manage_dirs_pattern($1, config_usr_t, config_usr_t) + manage_files_pattern($1, config_usr_t, config_usr_t) + manage_lnk_files_pattern($1, config_usr_t, config_usr_t) +') + +######################################## +## +## Execute gnome-keyring in the user gkeyring domain +## +## +## +## Domain allowed access +## +## +# +interface(`gnome_transition_gkeyringd',` + gen_require(` + attribute gkeyringd_domain; + ') + + allow $1 gkeyringd_domain:process transition; + dontaudit $1 gkeyringd_domain:process { noatsecure siginh rlimitinh }; + allow gkeyringd_domain $1:process { sigchld signull }; + allow gkeyringd_domain $1:fifo_file rw_inherited_fifo_file_perms; +') + +######################################## +## +## Create gnome content in the user home directory +## with an correct label. +## +## +## +## Domain allowed access. +## +## +# +interface(`gnome_filetrans_home_content',` + +gen_require(` + type config_home_t; + type cache_home_t; + type gconf_home_t; + type gnome_home_t; + type data_home_t, icc_data_home_t; + type gkeyringd_gnome_home_t; +') + + userdom_user_home_dir_filetrans($1, config_home_t, dir, ".config") + userdom_user_home_dir_filetrans($1, config_home_t, file, ".Xdefaults") + userdom_user_home_dir_filetrans($1, config_home_t, dir, ".xine") + userdom_user_home_dir_filetrans($1, cache_home_t, dir, ".cache") + userdom_user_home_dir_filetrans($1, cache_home_t, dir, ".nv") + userdom_user_home_dir_filetrans($1, config_home_t, dir, ".kde") + userdom_user_home_dir_filetrans($1, gconf_home_t, dir, ".gconf") + userdom_user_home_dir_filetrans($1, gconf_home_t, dir, ".gconfd") + userdom_user_home_dir_filetrans($1, gconf_home_t, dir, ".local") + userdom_user_home_dir_filetrans($1, gnome_home_t, dir, ".gnome2") + + # ~/.color/icc: legacy + userdom_user_home_content_filetrans($1, icc_data_home_t, dir, "icc") + filetrans_pattern($1, gnome_home_t, gkeyringd_gnome_home_t, dir, "keyrings") + filetrans_pattern($1, gconf_home_t, data_home_t, dir, "share") + filetrans_pattern($1, data_home_t, icc_data_home_t, dir, "icc") + userdom_user_tmp_filetrans($1, config_home_t, dir, "dconf") + gnome_filetrans_gstreamer_home_content($1) +') + +######################################## +## +## Create gnome directory in the /root directory +## with an correct label. +## +## +## +## Domain allowed access. +## +## +# +interface(`gnome_filetrans_admin_home_content',` + +gen_require(` + type config_home_t; + type cache_home_t; + type gstreamer_home_t; + type gconf_home_t; + type gnome_home_t; + type icc_data_home_t; +') + + userdom_admin_home_dir_filetrans($1, config_home_t, dir, ".config") + userdom_admin_home_dir_filetrans($1, config_home_t, file, ".Xdefaults") + userdom_admin_home_dir_filetrans($1, config_home_t, dir, ".xine") + userdom_admin_home_dir_filetrans($1, cache_home_t, dir, ".cache") + userdom_admin_home_dir_filetrans($1, config_home_t, dir, ".kde") + userdom_admin_home_dir_filetrans($1, gconf_home_t, dir, ".gconf") + userdom_admin_home_dir_filetrans($1, gconf_home_t, dir, ".gconfd") + userdom_admin_home_dir_filetrans($1, gconf_home_t, dir, ".local") + userdom_admin_home_dir_filetrans($1, gnome_home_t, dir, ".gnome2") + gnome_filetrans_gstreamer_home_content($1) + # /root/.color/icc: legacy + userdom_admin_home_dir_filetrans($1, icc_data_home_t, dir, "icc") +') + +###################################### +## +## Execute gnome-keyring executable +## in the specified domain. +## +## +##

+## Execute a telepathy executable +## in the specified domain. This allows +## the specified domain to execute any file +## on these filesystems in the specified +## domain. +##

+##

+## No interprocess communication (signals, pipes, +## etc.) is provided by this interface since +## the domains are not owned by this module. +##

+##

+## This interface was added to handle +## the ssh-agent policy. +##

+## +## +## +## Domain allowed to transition. +## +## +## +## +## The type of the new process. +## +## +# +interface(`gnome_command_domtrans_gkeyringd', ` + gen_require(` + type gkeyringd_exec_t; + ') + + allow $2 gkeyringd_exec_t:file entrypoint; + domain_transition_pattern($1, gkeyringd_exec_t, $2) + type_transition $1 gkeyringd_exec_t:process $2; +') diff --git a/gnome.te b/gnome.te index 783c5fb..e011e80 100644 --- a/gnome.te +++ b/gnome.te @@ -6,11 +6,31 @@ policy_module(gnome, 2.2.0) # attribute gnomedomain; +attribute gnome_home_type; +attribute gkeyringd_domain; type gconf_etc_t; files_config_file(gconf_etc_t) -type gconf_home_t; +type data_home_t, gnome_home_type; +userdom_user_home_content(data_home_t) + +type config_home_t, gnome_home_type; +userdom_user_home_content(config_home_t) + +type cache_home_t, gnome_home_type; +userdom_user_home_content(cache_home_t) + +type gstreamer_home_t, gnome_home_type; +userdom_user_home_content(gstreamer_home_t) + +type dbus_home_t, gnome_home_type; +userdom_user_home_content(dbus_home_t) + +type icc_data_home_t, gnome_home_type; +userdom_user_home_content(icc_data_home_t) + +type gconf_home_t, gnome_home_type; typealias gconf_home_t alias { user_gconf_home_t staff_gconf_home_t sysadm_gconf_home_t }; typealias gconf_home_t alias { auditadm_gconf_home_t secadm_gconf_home_t }; typealias gconf_home_t alias unconfined_gconf_home_t; @@ -28,12 +48,33 @@ typealias gconfd_t alias { user_gconfd_t staff_gconfd_t sysadm_gconfd_t }; typealias gconfd_t alias { auditadm_gconfd_t secadm_gconfd_t }; userdom_user_application_domain(gconfd_t, gconfd_exec_t) -type gnome_home_t; +type gnome_home_t, gnome_home_type; typealias gnome_home_t alias { user_gnome_home_t staff_gnome_home_t sysadm_gnome_home_t }; typealias gnome_home_t alias { auditadm_gnome_home_t secadm_gnome_home_t }; typealias gnome_home_t alias unconfined_gnome_home_t; userdom_user_home_content(gnome_home_t) +# type KDE /usr/share/config files +type config_usr_t; +files_type(config_usr_t) + +type gkeyringd_exec_t; +corecmd_executable_file(gkeyringd_exec_t) + +type gkeyringd_gnome_home_t; +userdom_user_home_content(gkeyringd_gnome_home_t) + +type gkeyringd_tmp_t; +userdom_user_tmp_content(gkeyringd_tmp_t) + +type gconfdefaultsm_t; +type gconfdefaultsm_exec_t; +init_daemon_domain(gconfdefaultsm_t, gconfdefaultsm_exec_t) + +type gnomesystemmm_t; +type gnomesystemmm_exec_t; +init_daemon_domain(gnomesystemmm_t, gnomesystemmm_exec_t) + ############################## # # Local Policy @@ -57,7 +98,6 @@ dev_read_urand(gconfd_t) files_read_etc_files(gconfd_t) -miscfiles_read_localization(gconfd_t) logging_send_syslog_msg(gconfd_t) @@ -73,3 +113,160 @@ optional_policy(` xserver_use_xdm_fds(gconfd_t) xserver_rw_xdm_pipes(gconfd_t) ') + +####################################### +# +# gconf-defaults-mechanisms local policy +# + +allow gconfdefaultsm_t self:capability { dac_override sys_nice }; +allow gconfdefaultsm_t self:process getsched; +allow gconfdefaultsm_t self:fifo_file rw_fifo_file_perms; + +corecmd_search_bin(gconfdefaultsm_t) + +files_read_etc_files(gconfdefaultsm_t) +files_read_usr_files(gconfdefaultsm_t) + + +gnome_manage_gconf_home_files(gconfdefaultsm_t) +gnome_manage_gconf_config(gconfdefaultsm_t) + +userdom_read_all_users_state(gconfdefaultsm_t) +userdom_search_user_home_dirs(gconfdefaultsm_t) + +userdom_dontaudit_search_admin_dir(gconfdefaultsm_t) + +optional_policy(` + consolekit_dbus_chat(gconfdefaultsm_t) +') + +optional_policy(` + dbus_system_domain(gconfdefaultsm_t, gconfdefaultsm_exec_t) +') + +optional_policy(` + nscd_dontaudit_search_pid(gconfdefaultsm_t) +') + +optional_policy(` + policykit_domtrans_auth(gconfdefaultsm_t) + policykit_dbus_chat(gconfdefaultsm_t) + policykit_read_lib(gconfdefaultsm_t) + policykit_read_reload(gconfdefaultsm_t) +') + +userdom_home_manager(gconfdefaultsm_t) + +####################################### +# +# gnome-system-monitor-mechanisms local policy +# + +allow gnomesystemmm_t self:capability sys_nice; +allow gnomesystemmm_t self:fifo_file rw_fifo_file_perms; + +rw_files_pattern(gnomesystemmm_t, config_usr_t, config_usr_t) + +kernel_read_system_state(gnomesystemmm_t) + +corecmd_search_bin(gnomesystemmm_t) + +domain_kill_all_domains(gnomesystemmm_t) +domain_search_all_domains_state(gnomesystemmm_t) +domain_setpriority_all_domains(gnomesystemmm_t) +domain_signal_all_domains(gnomesystemmm_t) +domain_sigstop_all_domains(gnomesystemmm_t) + +files_read_etc_files(gnomesystemmm_t) +files_read_usr_files(gnomesystemmm_t) + +fs_getattr_xattr_fs(gnomesystemmm_t) + +logging_send_syslog_msg(gnomesystemmm_t) + +userdom_read_all_users_state(gnomesystemmm_t) +userdom_dontaudit_search_admin_dir(gnomesystemmm_t) + +optional_policy(` + consolekit_dbus_chat(gnomesystemmm_t) +') + +optional_policy(` + dbus_system_domain(gnomesystemmm_t, gnomesystemmm_exec_t) +') + +optional_policy(` + nscd_dontaudit_search_pid(gnomesystemmm_t) +') + +optional_policy(` + policykit_dbus_chat(gnomesystemmm_t) + policykit_domtrans_auth(gnomesystemmm_t) + policykit_read_lib(gnomesystemmm_t) + policykit_read_reload(gnomesystemmm_t) +') + +###################################### +# +# gnome-keyring-daemon local policy +# + +allow gkeyringd_domain self:capability ipc_lock; +allow gkeyringd_domain self:process { getcap getsched setcap signal }; +allow gkeyringd_domain self:fifo_file rw_fifo_file_perms; +allow gkeyringd_domain self:unix_stream_socket { connectto accept listen }; + +dontaudit gkeyringd_domain config_home_t:file write; + +manage_dirs_pattern(gkeyringd_domain, gkeyringd_gnome_home_t, gkeyringd_gnome_home_t) +manage_files_pattern(gkeyringd_domain, gkeyringd_gnome_home_t, gkeyringd_gnome_home_t) +filetrans_pattern(gkeyringd_domain, gnome_home_t, gkeyringd_gnome_home_t, dir) + +manage_dirs_pattern(gkeyringd_domain, gkeyringd_tmp_t, gkeyringd_tmp_t) +manage_sock_files_pattern(gkeyringd_domain, gkeyringd_tmp_t, gkeyringd_tmp_t) +files_tmp_filetrans(gkeyringd_domain, gkeyringd_tmp_t, dir) +userdom_user_tmp_filetrans(gkeyringd_domain, gkeyringd_tmp_t, { sock_file dir }) + +kernel_read_system_state(gkeyringd_domain) +kernel_read_crypto_sysctls(gkeyringd_domain) + +corecmd_search_bin(gkeyringd_domain) + +dev_read_rand(gkeyringd_domain) +dev_read_urand(gkeyringd_domain) +dev_read_sysfs(gkeyringd_domain) + +files_read_etc_files(gkeyringd_domain) +files_read_usr_files(gkeyringd_domain) +# for nscd? +files_search_pids(gkeyringd_domain) + +fs_getattr_xattr_fs(gkeyringd_domain) +fs_getattr_tmpfs(gkeyringd_domain) + +selinux_getattr_fs(gkeyringd_domain) + +userdom_user_home_dir_filetrans(gkeyringd_domain, gnome_home_t, dir) + +optional_policy(` + xserver_append_xdm_home_files(gkeyringd_domain) + xserver_read_xdm_home_files(gkeyringd_domain) + xserver_use_xdm_fds(gkeyringd_domain) +') + +optional_policy(` + gnome_read_home_config(gkeyringd_domain) + gnome_read_generic_cache_files(gkeyringd_domain) + gnome_write_generic_cache_files(gkeyringd_domain) + gnome_manage_cache_home_dir(gkeyringd_domain) + gnome_manage_generic_cache_sockets(gkeyringd_domain) +') + +optional_policy(` + ssh_read_user_home_files(gkeyringd_domain) +') + +domain_use_interactive_fds(gnomedomain) + +userdom_use_inherited_user_terminals(gnomedomain) diff --git a/gnomeclock.fc b/gnomeclock.fc index 462de63..5df751b 100644 --- a/gnomeclock.fc +++ b/gnomeclock.fc @@ -1,2 +1,6 @@ + /usr/libexec/gnome-clock-applet-mechanism -- gen_context(system_u:object_r:gnomeclock_exec_t,s0) +/usr/libexec/gsd-datetime-mechanism -- gen_context(system_u:object_r:gnomeclock_exec_t,s0) + +/usr/libexec/kde(3|4)/kcmdatetimehelper -- gen_context(system_u:object_r:gnomeclock_exec_t,s0) diff --git a/gnomeclock.if b/gnomeclock.if index 671d8fd..25c7ab8 100644 --- a/gnomeclock.if +++ b/gnomeclock.if @@ -63,3 +63,24 @@ interface(`gnomeclock_dbus_chat',` allow $1 gnomeclock_t:dbus send_msg; allow gnomeclock_t $1:dbus send_msg; ') + +######################################## +## +## Do not audit send and receive messages from +## gnomeclock over dbus. +## +## +## +## Domain to not audit. +## +## +# +interface(`gnomeclock_dontaudit_dbus_chat',` + gen_require(` + type gnomeclock_t; + class dbus send_msg; + ') + + dontaudit $1 gnomeclock_t:dbus send_msg; + dontaudit gnomeclock_t $1:dbus send_msg; +') diff --git a/gnomeclock.te b/gnomeclock.te index 4fde46b..74a2212 100644 --- a/gnomeclock.te +++ b/gnomeclock.te @@ -7,38 +7,76 @@ policy_module(gnomeclock, 1.0.0) type gnomeclock_t; type gnomeclock_exec_t; -dbus_system_domain(gnomeclock_t, gnomeclock_exec_t) +init_daemon_domain(gnomeclock_t, gnomeclock_exec_t) ######################################## # # gnomeclock local policy # -allow gnomeclock_t self:capability { sys_nice sys_time sys_ptrace }; -allow gnomeclock_t self:process { getattr getsched }; +allow gnomeclock_t self:capability { sys_nice sys_time }; +allow gnomeclock_t self:process { getattr getsched signal }; allow gnomeclock_t self:fifo_file rw_fifo_file_perms; allow gnomeclock_t self:unix_stream_socket create_stream_socket_perms; +allow gnomeclock_t self:unix_dgram_socket create_socket_perms; + +kernel_read_system_state(gnomeclock_t) corecmd_exec_bin(gnomeclock_t) +corecmd_exec_shell(gnomeclock_t) +corecmd_dontaudit_access_check_bin(gnomeclock_t) + +corenet_tcp_connect_time_port(gnomeclock_t) -files_read_etc_files(gnomeclock_t) +dev_read_sysfs(gnomeclock_t) + +files_read_etc_runtime_files(gnomeclock_t) files_read_usr_files(gnomeclock_t) +fs_getattr_xattr_fs(gnomeclock_t) + auth_use_nsswitch(gnomeclock_t) -clock_domtrans(gnomeclock_t) +logging_send_syslog_msg(gnomeclock_t) -miscfiles_read_localization(gnomeclock_t) miscfiles_manage_localization(gnomeclock_t) miscfiles_etc_filetrans_localization(gnomeclock_t) userdom_read_all_users_state(gnomeclock_t) optional_policy(` + chronyd_systemctl(gnomeclock_t) +') + +optional_policy(` + clock_domtrans(gnomeclock_t) +') + +optional_policy(` consolekit_dbus_chat(gnomeclock_t) ') optional_policy(` + consoletype_exec(gnomeclock_t) +') + +optional_policy(` +dbus_system_domain(gnomeclock_t, gnomeclock_exec_t) +') + +optional_policy(` + gnome_manage_usr_config(gnomeclock_t) +') + +optional_policy(` + ntp_domtrans_ntpdate(gnomeclock_t) + ntp_initrc_domtrans(gnomeclock_t) + init_dontaudit_getattr_all_script_files(gnomeclock_t) + init_dontaudit_getattr_exec(gnomeclock_t) + ntp_systemctl(gnomeclock_t) +') + +optional_policy(` policykit_dbus_chat(gnomeclock_t) policykit_domtrans_auth(gnomeclock_t) policykit_read_lib(gnomeclock_t) diff --git a/gpg.fc b/gpg.fc index 5207fc2..2dd4ff9 100644 --- a/gpg.fc +++ b/gpg.fc @@ -1,6 +1,8 @@ HOME_DIR/\.gnupg(/.+)? gen_context(system_u:object_r:gpg_secret_t,s0) HOME_DIR/\.gnupg/log-socket gen_context(system_u:object_r:gpg_agent_tmp_t,s0) +/root/\.gnupg(/.+)? gen_context(system_u:object_r:gpg_secret_t,s0) + /usr/bin/gpg(2)? -- gen_context(system_u:object_r:gpg_exec_t,s0) /usr/bin/gpgsm -- gen_context(system_u:object_r:gpg_exec_t,s0) /usr/bin/gpg-agent -- gen_context(system_u:object_r:gpg_agent_exec_t,s0) diff --git a/gpg.if b/gpg.if index 6d50300..46cc164 100644 --- a/gpg.if +++ b/gpg.if @@ -54,15 +54,16 @@ interface(`gpg_role',` manage_sock_files_pattern($2, gpg_pinentry_tmp_t, gpg_pinentry_tmp_t) relabel_sock_files_pattern($2, gpg_pinentry_tmp_t, gpg_pinentry_tmp_t) + allow gpg_pinentry_t $2:fifo_file { read write }; + optional_policy(` gpg_pinentry_dbus_chat($2) ') + allow $2 gpg_agent_t:unix_stream_socket { rw_socket_perms connectto }; ifdef(`hide_broken_symptoms',` #Leaked File Descriptors - dontaudit gpg_t $2:socket_class_set { getattr read write }; dontaudit gpg_t $2:fifo_file rw_fifo_file_perms; - dontaudit gpg_agent_t $2:socket_class_set { getattr read write }; dontaudit gpg_agent_t $2:fifo_file rw_fifo_file_perms; ') ') @@ -85,13 +86,13 @@ interface(`gpg_domtrans',` domtrans_pattern($1, gpg_exec_t, gpg_t) ') -######################################## +###################################### ## -## Execute the gpg application without transitioning +## Execute gpg in the caller domain. ## ## ## -## Domain allowed to execute gpg +## Domain allowed access. ## ## # @@ -100,9 +101,47 @@ interface(`gpg_exec',` type gpg_exec_t; ') + corecmd_search_bin($1) can_exec($1, gpg_exec_t) ') +###################################### +## +## Transition to a gpg web domain. +## +## +## +## Domain allowed access. +## +## +# +interface(`gpg_domtrans_web',` + gen_require(` + type gpg_web_t, gpg_exec_t; + ') + + domtrans_pattern($1, gpg_exec_t, gpg_web_t) +') + +###################################### +## +## Make gpg an entrypoint for +## the specified domain. +## +## +## +## The domain for which cifs_t is an entrypoint. +## +## +# +interface(`gpg_entry_type',` + gen_require(` + type gpg_exec_t; + ') + + domain_entry_file($1, gpg_exec_t) +') + ######################################## ## ## Send generic signals to user gpg processes. diff --git a/gpg.te b/gpg.te index 72a113e..fd9ad06 100644 --- a/gpg.te +++ b/gpg.te @@ -4,6 +4,7 @@ policy_module(gpg, 2.6.0) # # Declarations # +attribute gpgdomain; ## ##

@@ -13,23 +14,34 @@ policy_module(gpg, 2.6.0) ## gen_tunable(gpg_agent_env_file, false) -type gpg_t; +## +##

+## Allow gpg web domain to modify public files +## used for public file transfer services. +##

+## +gen_tunable(gpg_web_anon_write, false) + +type gpg_t, gpgdomain; type gpg_exec_t; typealias gpg_t alias { user_gpg_t staff_gpg_t sysadm_gpg_t }; typealias gpg_t alias { auditadm_gpg_t secadm_gpg_t }; -userdom_user_application_domain(gpg_t, gpg_exec_t) +application_domain(gpg_t, gpg_exec_t) +ubac_constrained(gpg_t) role system_r types gpg_t; type gpg_agent_t; type gpg_agent_exec_t; typealias gpg_agent_t alias { user_gpg_agent_t staff_gpg_agent_t sysadm_gpg_agent_t }; typealias gpg_agent_t alias { auditadm_gpg_agent_t secadm_gpg_agent_t }; -userdom_user_application_domain(gpg_agent_t, gpg_agent_exec_t) +application_domain(gpg_agent_t, gpg_agent_exec_t) +ubac_constrained(gpg_agent_t) type gpg_agent_tmp_t; typealias gpg_agent_tmp_t alias { user_gpg_agent_tmp_t staff_gpg_agent_tmp_t sysadm_gpg_agent_tmp_t }; typealias gpg_agent_tmp_t alias { auditadm_gpg_agent_tmp_t secadm_gpg_agent_tmp_t }; -userdom_user_tmp_file(gpg_agent_tmp_t) +files_tmp_file(gpg_agent_tmp_t) +ubac_constrained(gpg_agent_tmp_t) type gpg_secret_t; typealias gpg_secret_t alias { user_gpg_secret_t staff_gpg_secret_t sysadm_gpg_secret_t }; @@ -40,32 +52,43 @@ type gpg_helper_t; type gpg_helper_exec_t; typealias gpg_helper_t alias { user_gpg_helper_t staff_gpg_helper_t sysadm_gpg_helper_t }; typealias gpg_helper_t alias { auditadm_gpg_helper_t secadm_gpg_helper_t }; -userdom_user_application_domain(gpg_helper_t, gpg_helper_exec_t) +application_domain(gpg_helper_t, gpg_helper_exec_t) +ubac_constrained(gpg_helper_t) role system_r types gpg_helper_t; type gpg_pinentry_t; type pinentry_exec_t; typealias gpg_pinentry_t alias { user_gpg_pinentry_t staff_gpg_pinentry_t sysadm_gpg_pinentry_t }; typealias gpg_pinentry_t alias { auditadm_gpg_pinentry_t secadm_gpg_pinentry_t }; -userdom_user_application_domain(gpg_pinentry_t, pinentry_exec_t) +application_domain(gpg_pinentry_t, pinentry_exec_t) +ubac_constrained(gpg_pinentry_t) type gpg_pinentry_tmp_t; -userdom_user_tmp_file(gpg_pinentry_tmp_t) +files_tmp_file(gpg_pinentry_tmp_t) +ubac_constrained(gpg_pinentry_tmp_t) type gpg_pinentry_tmpfs_t; -userdom_user_tmpfs_file(gpg_pinentry_tmpfs_t) +files_tmpfs_file(gpg_pinentry_tmpfs_t) +ubac_constrained(gpg_pinentry_tmpfs_t) + +type gpg_web_t; +domain_type(gpg_web_t) +gpg_entry_type(gpg_web_t) +role system_r types gpg_web_t; ######################################## # # GPG local policy # -allow gpg_t self:capability { ipc_lock setuid }; -# setrlimit is for ulimit -c 0 -allow gpg_t self:process { signal signull setrlimit getcap setcap setpgid }; +allow gpgdomain self:capability { ipc_lock setuid }; +allow gpgdomain self:process { getsched setsched }; +#at setrlimit is for ulimit -c 0 +allow gpgdomain self:process { signal signull setrlimit getcap setcap setpgid }; +dontaudit gpgdomain self:netlink_audit_socket r_netlink_socket_perms; -allow gpg_t self:fifo_file rw_fifo_file_perms; -allow gpg_t self:tcp_socket create_stream_socket_perms; +allow gpgdomain self:fifo_file rw_fifo_file_perms; +allow gpgdomain self:tcp_socket create_stream_socket_perms; manage_dirs_pattern(gpg_t, gpg_agent_tmp_t, gpg_agent_tmp_t) manage_files_pattern(gpg_t, gpg_agent_tmp_t, gpg_agent_tmp_t) @@ -77,6 +100,7 @@ domtrans_pattern(gpg_t, gpg_agent_exec_t, gpg_agent_t) domtrans_pattern(gpg_t, gpg_helper_exec_t, gpg_helper_t) allow gpg_t gpg_secret_t:dir create_dir_perms; +manage_sock_files_pattern(gpg_t, gpg_secret_t, gpg_secret_t) manage_files_pattern(gpg_t, gpg_secret_t, gpg_secret_t) manage_lnk_files_pattern(gpg_t, gpg_secret_t, gpg_secret_t) userdom_user_home_dir_filetrans(gpg_t, gpg_secret_t, dir) @@ -86,7 +110,6 @@ kernel_read_sysctl(gpg_t) corecmd_exec_shell(gpg_t) corecmd_exec_bin(gpg_t) -corenet_all_recvfrom_unlabeled(gpg_t) corenet_all_recvfrom_netlabel(gpg_t) corenet_tcp_sendrecv_generic_if(gpg_t) corenet_udp_sendrecv_generic_if(gpg_t) @@ -106,7 +129,6 @@ fs_list_inotifyfs(gpg_t) domain_use_interactive_fds(gpg_t) -files_read_etc_files(gpg_t) files_read_usr_files(gpg_t) files_dontaudit_search_var(gpg_t) @@ -114,24 +136,26 @@ auth_use_nsswitch(gpg_t) logging_send_syslog_msg(gpg_t) -miscfiles_read_localization(gpg_t) - -userdom_use_user_terminals(gpg_t) +userdom_use_inherited_user_terminals(gpg_t) # sign/encrypt user files -userdom_manage_user_tmp_files(gpg_t) +userdom_manage_all_user_tmp_content(gpg_t) +#userdom_manage_user_home_content(gpg_t) userdom_manage_user_home_content_files(gpg_t) +userdom_manage_user_home_content_dirs(gpg_t) userdom_user_home_dir_filetrans_user_home_content(gpg_t, file) +userdom_stream_connect(gpg_t) mta_write_config(gpg_t) -tunable_policy(`use_nfs_home_dirs',` - fs_manage_nfs_dirs(gpg_t) - fs_manage_nfs_files(gpg_t) +userdom_home_manager(gpg_t) + +optional_policy(` + gnome_read_config(gpg_t) + gnome_stream_connect_gkeyringd(gpg_t) ') -tunable_policy(`use_samba_home_dirs',` - fs_manage_cifs_dirs(gpg_t) - fs_manage_cifs_files(gpg_t) +optional_policy(` + mta_read_spool(gpg_t) ') optional_policy(` @@ -140,15 +164,19 @@ optional_policy(` ') optional_policy(` - xserver_use_xdm_fds(gpg_t) - xserver_rw_xdm_pipes(gpg_t) + spamassassin_read_spamd_tmp_files(gpg_t) ') optional_policy(` - cron_system_entry(gpg_t, gpg_exec_t) - cron_read_system_job_tmp_files(gpg_t) + xserver_use_xdm_fds(gpg_t) + xserver_rw_xdm_pipes(gpg_t) ') +#optional_policy(` +# cron_system_entry(gpg_t, gpg_exec_t) +# cron_read_system_job_tmp_files(gpg_t) +#') + ######################################## # # GPG helper local policy @@ -166,7 +194,6 @@ allow gpg_helper_t self:udp_socket { connect connected_socket_perms }; dontaudit gpg_helper_t gpg_secret_t:file read; -corenet_all_recvfrom_unlabeled(gpg_helper_t) corenet_all_recvfrom_netlabel(gpg_helper_t) corenet_tcp_sendrecv_generic_if(gpg_helper_t) corenet_raw_sendrecv_generic_if(gpg_helper_t) @@ -180,11 +207,10 @@ corenet_tcp_bind_generic_node(gpg_helper_t) corenet_udp_bind_generic_node(gpg_helper_t) corenet_tcp_connect_all_ports(gpg_helper_t) -files_read_etc_files(gpg_helper_t) auth_use_nsswitch(gpg_helper_t) -userdom_use_user_terminals(gpg_helper_t) +userdom_use_inherited_user_terminals(gpg_helper_t) tunable_policy(`use_nfs_home_dirs',` fs_dontaudit_rw_nfs_files(gpg_helper_t) @@ -198,15 +224,17 @@ tunable_policy(`use_samba_home_dirs',` # # GPG agent local policy # +domtrans_pattern(gpg_t, gpg_agent_exec_t, gpg_agent_t) # rlimit: gpg-agent wants to prevent coredumps allow gpg_agent_t self:process setrlimit; -allow gpg_agent_t self:unix_stream_socket create_stream_socket_perms ; +allow gpg_agent_t self:unix_stream_socket { create_stream_socket_perms connectto } ; allow gpg_agent_t self:fifo_file rw_fifo_file_perms; # read and write ~/.gnupg (gpg-agent stores secret keys in ~/.gnupg/private-keys-v1.d ) manage_dirs_pattern(gpg_agent_t, gpg_secret_t, gpg_secret_t) +manage_sock_files_pattern(gpg_agent_t, gpg_secret_t, gpg_secret_t) manage_files_pattern(gpg_agent_t, gpg_secret_t, gpg_secret_t) manage_lnk_files_pattern(gpg_agent_t, gpg_secret_t, gpg_secret_t) @@ -223,43 +251,34 @@ corecmd_read_bin_symlinks(gpg_agent_t) corecmd_search_bin(gpg_agent_t) corecmd_exec_shell(gpg_agent_t) +dev_read_rand(gpg_agent_t) dev_read_urand(gpg_agent_t) domain_use_interactive_fds(gpg_agent_t) fs_dontaudit_list_inotifyfs(gpg_agent_t) -miscfiles_read_localization(gpg_agent_t) # Write to the user domain tty. -userdom_use_user_terminals(gpg_agent_t) +userdom_use_inherited_user_terminals(gpg_agent_t) # read and write ~/.gnupg (gpg-agent stores secret keys in ~/.gnupg/private-keys-v1.d ) userdom_search_user_home_dirs(gpg_agent_t) ifdef(`hide_broken_symptoms',` userdom_dontaudit_read_user_tmp_files(gpg_agent_t) + userdom_dontaudit_write_user_tmp_files(gpg_agent_t) ') tunable_policy(`gpg_agent_env_file',` # write ~/.gpg-agent-info or a similar to the users home dir # or subdir (gpg-agent --write-env-file option) # - userdom_user_home_dir_filetrans_user_home_content(gpg_agent_t, file) + userdom_user_home_dir_filetrans_user_home_content(gpg_agent_t, { dir file }) userdom_manage_user_home_content_dirs(gpg_agent_t) userdom_manage_user_home_content_files(gpg_agent_t) ') -tunable_policy(`use_nfs_home_dirs',` - fs_manage_nfs_dirs(gpg_agent_t) - fs_manage_nfs_files(gpg_agent_t) - fs_manage_nfs_symlinks(gpg_agent_t) -') - -tunable_policy(`use_samba_home_dirs',` - fs_manage_cifs_dirs(gpg_agent_t) - fs_manage_cifs_files(gpg_agent_t) - fs_manage_cifs_symlinks(gpg_agent_t) -') +userdom_home_manager(gpg_agent_t) optional_policy(` mozilla_dontaudit_rw_user_home_files(gpg_agent_t) @@ -294,10 +313,10 @@ fs_tmpfs_filetrans(gpg_pinentry_t, gpg_pinentry_tmpfs_t, { file dir }) # read /proc/meminfo kernel_read_system_state(gpg_pinentry_t) +corecmd_exec_shell(gpg_pinentry_t) corecmd_exec_bin(gpg_pinentry_t) corenet_all_recvfrom_netlabel(gpg_pinentry_t) -corenet_all_recvfrom_unlabeled(gpg_pinentry_t) corenet_sendrecv_pulseaudio_client_packets(gpg_pinentry_t) corenet_tcp_bind_generic_node(gpg_pinentry_t) corenet_tcp_connect_pulseaudio_port(gpg_pinentry_t) @@ -310,7 +329,6 @@ dev_read_rand(gpg_pinentry_t) files_read_usr_files(gpg_pinentry_t) # read /etc/X11/qtrc -files_read_etc_files(gpg_pinentry_t) fs_dontaudit_list_inotifyfs(gpg_pinentry_t) fs_getattr_tmpfs(gpg_pinentry_t) @@ -320,18 +338,19 @@ auth_use_nsswitch(gpg_pinentry_t) logging_send_syslog_msg(gpg_pinentry_t) miscfiles_read_fonts(gpg_pinentry_t) -miscfiles_read_localization(gpg_pinentry_t) # for .Xauthority userdom_read_user_home_content_files(gpg_pinentry_t) userdom_read_user_tmpfs_files(gpg_pinentry_t) +# Bug: user pulseaudio files need open,read and unlink: +allow gpg_pinentry_t user_tmpfs_t:file unlink; +userdom_signull_unpriv_users(gpg_pinentry_t) +userdom_use_user_terminals(gpg_pinentry_t) -tunable_policy(`use_nfs_home_dirs',` - fs_read_nfs_files(gpg_pinentry_t) -') +userdom_home_reader(gpg_pinentry_t) -tunable_policy(`use_samba_home_dirs',` - fs_read_cifs_files(gpg_pinentry_t) +optional_policy(` + gnome_read_home_config(gpg_pinentry_t) ') optional_policy(` @@ -340,6 +359,12 @@ optional_policy(` ') optional_policy(` + gnome_write_generic_cache_files(gpg_pinentry_t) + gnome_read_generic_cache_files(gpg_pinentry_t) + gnome_read_gconf_home_files(gpg_pinentry_t) +') + +optional_policy(` pulseaudio_exec(gpg_pinentry_t) pulseaudio_rw_home_files(gpg_pinentry_t) pulseaudio_setattr_home_dir(gpg_pinentry_t) @@ -349,4 +374,27 @@ optional_policy(` optional_policy(` xserver_user_x_domain_template(gpg_pinentry, gpg_pinentry_t, gpg_pinentry_tmpfs_t) + +') + +############################# +# +# gpg web local policy +# + +allow gpg_web_t self:process setrlimit; + +dev_read_rand(gpg_web_t) +dev_read_urand(gpg_web_t) + +can_exec(gpg_web_t, gpg_exec_t) + +files_read_usr_files(gpg_web_t) + + +apache_dontaudit_rw_tmp_files(gpg_web_t) +apache_manage_sys_content_rw(gpg_web_t) + +tunable_policy(`gpg_web_anon_write',` + miscfiles_manage_public_files(gpg_web_t) ') diff --git a/gpm.if b/gpm.if index 7d97298..d6b2959 100644 --- a/gpm.if +++ b/gpm.if @@ -16,8 +16,8 @@ interface(`gpm_stream_connect',` type gpmctl_t, gpm_t; ') - allow $1 gpmctl_t:sock_file rw_sock_file_perms; - allow $1 gpm_t:unix_stream_socket connectto; + dev_list_all_dev_nodes($1) + stream_connect_pattern($1, gpmctl_t, gpmctl_t, gpm_t) ') ######################################## @@ -37,7 +37,7 @@ interface(`gpm_getattr_gpmctl',` ') dev_list_all_dev_nodes($1) - allow $1 gpmctl_t:sock_file getattr; + allow $1 gpmctl_t:sock_file getattr_sock_file_perms; ') ######################################## @@ -57,7 +57,7 @@ interface(`gpm_dontaudit_getattr_gpmctl',` type gpmctl_t; ') - dontaudit $1 gpmctl_t:sock_file getattr; + dontaudit $1 gpmctl_t:sock_file getattr_sock_file_perms; ') ######################################## @@ -77,5 +77,5 @@ interface(`gpm_setattr_gpmctl',` ') dev_list_all_dev_nodes($1) - allow $1 gpmctl_t:sock_file setattr; + allow $1 gpmctl_t:sock_file setattr_sock_file_perms; ') diff --git a/gpm.te b/gpm.te index a627b34..0120907 100644 --- a/gpm.te +++ b/gpm.te @@ -10,7 +10,7 @@ type gpm_exec_t; init_daemon_domain(gpm_t, gpm_exec_t) type gpm_conf_t; -files_type(gpm_conf_t) +files_config_file(gpm_conf_t) type gpm_tmp_t; files_tmp_file(gpm_tmp_t) @@ -65,10 +65,9 @@ domain_use_interactive_fds(gpm_t) logging_send_syslog_msg(gpm_t) -miscfiles_read_localization(gpm_t) - userdom_dontaudit_use_unpriv_user_fds(gpm_t) userdom_dontaudit_search_user_home_dirs(gpm_t) +userdom_use_inherited_user_terminals(gpm_t) optional_policy(` seutil_sigchld_newrole(gpm_t) diff --git a/gpsd.te b/gpsd.te index 03742d8..4fefc6e 100644 --- a/gpsd.te +++ b/gpsd.te @@ -24,8 +24,9 @@ files_pid_file(gpsd_var_run_t) # gpsd local policy # -allow gpsd_t self:capability { fowner fsetid setuid setgid sys_nice sys_tty_config }; -allow gpsd_t self:process setsched; +allow gpsd_t self:capability { fowner fsetid setuid setgid sys_nice sys_time sys_tty_config }; +dontaudit gpsd_t self:capability { dac_read_search dac_override }; +allow gpsd_t self:process { setsched signal_perms }; allow gpsd_t self:shm create_shm_perms; allow gpsd_t self:unix_dgram_socket { create_socket_perms sendto }; allow gpsd_t self:tcp_socket create_stream_socket_perms; @@ -38,22 +39,34 @@ manage_files_pattern(gpsd_t, gpsd_var_run_t, gpsd_var_run_t) manage_sock_files_pattern(gpsd_t, gpsd_var_run_t, gpsd_var_run_t) files_pid_filetrans(gpsd_t, gpsd_var_run_t, { file sock_file }) -corenet_all_recvfrom_unlabeled(gpsd_t) +kernel_list_proc(gpsd_t) +kernel_request_load_module(gpsd_t) + corenet_all_recvfrom_netlabel(gpsd_t) corenet_tcp_sendrecv_generic_if(gpsd_t) corenet_tcp_sendrecv_generic_node(gpsd_t) corenet_tcp_sendrecv_all_ports(gpsd_t) -corenet_tcp_bind_all_nodes(gpsd_t) +corenet_tcp_bind_generic_node(gpsd_t) corenet_tcp_bind_gpsd_port(gpsd_t) +dev_read_sysfs(gpsd_t) +dev_rw_realtime_clock(gpsd_t) + +domain_dontaudit_read_all_domains_state(gpsd_t) + term_use_unallocated_ttys(gpsd_t) term_setattr_unallocated_ttys(gpsd_t) +term_use_usb_ttys(gpsd_t) auth_use_nsswitch(gpsd_t) logging_send_syslog_msg(gpsd_t) -miscfiles_read_localization(gpsd_t) +optional_policy(` + chronyd_rw_shm(gpsd_t) + chronyd_stream_connect(gpsd_t) + chronyd_dgram_send(gpsd_t) +') optional_policy(` dbus_system_bus_client(gpsd_t) diff --git a/guest.te b/guest.te index 1cb7311..1de82b2 100644 --- a/guest.te +++ b/guest.te @@ -9,9 +9,15 @@ role guest_r; userdom_restricted_user_template(guest) +kernel_read_system_state(guest_t) + ######################################## # # Local policy # -#gen_user(guest_u,, guest_r, s0, s0) +optional_policy(` + apache_role(guest_r, guest_t) +') + +gen_user(guest_u, user, guest_r, s0, s0) diff --git a/hadoop.if b/hadoop.if index 2d0b4e1..6649814 100644 --- a/hadoop.if +++ b/hadoop.if @@ -89,7 +89,6 @@ template(`hadoop_domain_template',` corecmd_exec_bin(hadoop_$1_t) corecmd_exec_shell(hadoop_$1_t) - corenet_all_recvfrom_unlabeled(hadoop_$1_t) corenet_all_recvfrom_netlabel(hadoop_$1_t) corenet_tcp_bind_all_nodes(hadoop_$1_t) corenet_tcp_sendrecv_generic_if(hadoop_$1_t) @@ -120,7 +119,6 @@ template(`hadoop_domain_template',` logging_send_audit_msgs(hadoop_$1_t) logging_send_syslog_msg(hadoop_$1_t) - miscfiles_read_localization(hadoop_$1_t) sysnet_read_config(hadoop_$1_t) @@ -191,7 +189,6 @@ template(`hadoop_domain_template',` logging_send_syslog_msg(hadoop_$1_initrc_t) logging_send_audit_msgs(hadoop_$1_initrc_t) - miscfiles_read_localization(hadoop_$1_initrc_t) userdom_dontaudit_search_user_home_dirs(hadoop_$1_initrc_t) @@ -224,14 +221,21 @@ interface(`hadoop_role',` hadoop_domtrans($2) role $1 types hadoop_t; - allow $2 hadoop_t:process { ptrace signal_perms }; + allow $2 hadoop_t:process signal_perms; ps_process_pattern($2, hadoop_t) + tunable_policy(`deny_ptrace',`',` + allow $2 hadoop_t:process ptrace; + ') hadoop_domtrans_zookeeper_client($2) role $1 types zookeeper_t; - allow $2 zookeeper_t:process { ptrace signal_perms }; + allow $2 zookeeper_t:process signal_perms; ps_process_pattern($2, zookeeper_t) + tunable_policy(`deny_ptrace',`',` + allow $2 zookeeper_t:process ptrace; + ') + ') ######################################## diff --git a/hadoop.te b/hadoop.te index c81c58a..86e3d1d 100644 --- a/hadoop.te +++ b/hadoop.te @@ -123,7 +123,6 @@ kernel_read_system_state(hadoop_t) corecmd_exec_bin(hadoop_t) corecmd_exec_shell(hadoop_t) -corenet_all_recvfrom_unlabeled(hadoop_t) corenet_all_recvfrom_netlabel(hadoop_t) corenet_tcp_sendrecv_generic_if(hadoop_t) corenet_udp_sendrecv_generic_if(hadoop_t) @@ -151,20 +150,22 @@ dev_read_urand(hadoop_t) domain_use_interactive_fds(hadoop_t) files_dontaudit_search_spool(hadoop_t) -files_read_etc_files(hadoop_t) files_read_usr_files(hadoop_t) fs_getattr_xattr_fs(hadoop_t) -miscfiles_read_localization(hadoop_t) +auth_use_nsswitch(hadoop_t) -sysnet_read_config(hadoop_t) -userdom_use_user_terminals(hadoop_t) +userdom_use_inherited_user_terminals(hadoop_t) -java_exec(hadoop_t) +optional_policy(` + java_exec(hadoop_t) +') -kerberos_use(hadoop_t) +optional_policy(` + kerberos_use(hadoop_t) +') optional_policy(` nis_use_ypbind(hadoop_t) @@ -311,7 +312,6 @@ kernel_read_system_state(zookeeper_t) corecmd_exec_bin(zookeeper_t) corecmd_exec_shell(zookeeper_t) -corenet_all_recvfrom_unlabeled(zookeeper_t) corenet_all_recvfrom_netlabel(zookeeper_t) corenet_tcp_sendrecv_generic_if(zookeeper_t) corenet_udp_sendrecv_generic_if(zookeeper_t) @@ -333,20 +333,18 @@ dev_read_urand(zookeeper_t) domain_use_interactive_fds(zookeeper_t) -files_read_etc_files(zookeeper_t) files_read_usr_files(zookeeper_t) -miscfiles_read_localization(zookeeper_t) +auth_use_nsswitch(zookeeper_t) + sysnet_read_config(zookeeper_t) -userdom_use_user_terminals(zookeeper_t) +userdom_use_inherited_user_terminals(zookeeper_t) userdom_dontaudit_search_user_home_dirs(zookeeper_t) -java_exec(zookeeper_t) - optional_policy(` - nscd_socket_use(zookeeper_t) + java_exec(zookeeper_t) ') ######################################## @@ -393,7 +391,6 @@ kernel_read_system_state(zookeeper_server_t) corecmd_exec_bin(zookeeper_server_t) corecmd_exec_shell(zookeeper_server_t) -corenet_all_recvfrom_unlabeled(zookeeper_server_t) corenet_all_recvfrom_netlabel(zookeeper_server_t) corenet_tcp_sendrecv_generic_if(zookeeper_server_t) corenet_udp_sendrecv_generic_if(zookeeper_server_t) @@ -421,15 +418,14 @@ dev_read_rand(zookeeper_server_t) dev_read_sysfs(zookeeper_server_t) dev_read_urand(zookeeper_server_t) -files_read_etc_files(zookeeper_server_t) files_read_usr_files(zookeeper_server_t) fs_getattr_xattr_fs(zookeeper_server_t) logging_send_syslog_msg(zookeeper_server_t) -miscfiles_read_localization(zookeeper_server_t) - sysnet_read_config(zookeeper_server_t) -java_exec(zookeeper_server_t) +optional_policy(` + java_exec(zookeeper_server_t) +') diff --git a/hal.if b/hal.if index 7cf6763..9d2be6b 100644 --- a/hal.if +++ b/hal.if @@ -69,7 +69,9 @@ interface(`hal_ptrace',` type hald_t; ') - allow $1 hald_t:process ptrace; + tunable_policy(`deny_ptrace',`',` + allow $1 hald_t:process ptrace; + ') ') ######################################## @@ -431,3 +433,22 @@ interface(`hal_manage_pid_files',` files_search_pids($1) manage_files_pattern($1, hald_var_run_t, hald_var_run_t) ') + +####################################### +## +## Do not audit attempts to read +## hald PID files. +## +## +## +## Domain to not audit. +## +## +# +interface(`hal_dontaudit_read_pid_files',` + gen_require(` + type hald_var_run_t; + ') + + dontaudit $1 hald_var_run_t:file read_inherited_file_perms; +') diff --git a/hal.te b/hal.te index e0476cb..0caa5ba 100644 --- a/hal.te +++ b/hal.te @@ -54,6 +54,9 @@ files_pid_file(hald_var_run_t) type hald_var_lib_t; files_type(hald_var_lib_t) +typealias hald_log_t alias pmtools_log_t; +typealias hald_var_run_t alias pmtools_var_run_t; + ######################################## # # Local policy @@ -61,7 +64,7 @@ files_type(hald_var_lib_t) # execute openvt which needs setuid allow hald_t self:capability { chown setuid setgid kill net_admin sys_admin sys_nice dac_override dac_read_search mknod sys_rawio sys_tty_config }; -dontaudit hald_t self:capability {sys_ptrace sys_tty_config }; +dontaudit hald_t self:capability sys_tty_config; allow hald_t self:process { getsched getattr signal_perms }; allow hald_t self:fifo_file rw_fifo_file_perms; allow hald_t self:unix_stream_socket { create_stream_socket_perms connectto }; @@ -99,6 +102,7 @@ kernel_read_fs_sysctls(hald_t) kernel_rw_irq_sysctls(hald_t) kernel_rw_vm_sysctls(hald_t) kernel_write_proc_files(hald_t) +kernel_rw_net_sysctls(hald_t) kernel_search_network_sysctl(hald_t) kernel_setsched(hald_t) kernel_request_load_module(hald_t) @@ -107,7 +111,6 @@ auth_read_pam_console_data(hald_t) corecmd_exec_all_executables(hald_t) -corenet_all_recvfrom_unlabeled(hald_t) corenet_all_recvfrom_netlabel(hald_t) corenet_tcp_sendrecv_generic_if(hald_t) corenet_udp_sendrecv_generic_if(hald_t) @@ -139,7 +142,6 @@ domain_read_all_domains_state(hald_t) domain_dontaudit_ptrace_all_domains(hald_t) files_exec_etc_files(hald_t) -files_read_etc_files(hald_t) files_rw_etc_runtime_files(hald_t) files_manage_mnt_dirs(hald_t) files_manage_mnt_files(hald_t) @@ -201,7 +203,6 @@ logging_send_audit_msgs(hald_t) logging_send_syslog_msg(hald_t) logging_search_logs(hald_t) -miscfiles_read_localization(hald_t) miscfiles_read_hwdata(hald_t) modutils_domtrans_insmod(hald_t) @@ -372,7 +373,6 @@ dev_setattr_generic_usb_dev(hald_acl_t) dev_setattr_usbfs_files(hald_acl_t) files_read_usr_files(hald_acl_t) -files_read_etc_files(hald_acl_t) fs_getattr_all_fs(hald_acl_t) @@ -385,8 +385,6 @@ auth_use_nsswitch(hald_acl_t) logging_send_syslog_msg(hald_acl_t) -miscfiles_read_localization(hald_acl_t) - optional_policy(` policykit_dbus_chat(hald_acl_t) policykit_domtrans_auth(hald_acl_t) @@ -418,14 +416,11 @@ dev_write_raw_memory(hald_mac_t) dev_read_sysfs(hald_mac_t) files_read_usr_files(hald_mac_t) -files_read_etc_files(hald_mac_t) auth_use_nsswitch(hald_mac_t) logging_send_syslog_msg(hald_mac_t) -miscfiles_read_localization(hald_mac_t) - ######################################## # # Local hald sonypic policy @@ -446,7 +441,6 @@ write_files_pattern(hald_sonypic_t, hald_log_t, hald_log_t) files_read_usr_files(hald_sonypic_t) -miscfiles_read_localization(hald_sonypic_t) ######################################## # @@ -465,10 +459,8 @@ write_files_pattern(hald_keymap_t, hald_log_t, hald_log_t) dev_rw_input_dev(hald_keymap_t) -files_read_etc_files(hald_keymap_t) files_read_usr_files(hald_keymap_t) -miscfiles_read_localization(hald_keymap_t) ######################################## # @@ -504,7 +496,6 @@ kernel_search_network_sysctl(hald_dccm_t) dev_read_urand(hald_dccm_t) -corenet_all_recvfrom_unlabeled(hald_dccm_t) corenet_all_recvfrom_netlabel(hald_dccm_t) corenet_tcp_sendrecv_generic_if(hald_dccm_t) corenet_udp_sendrecv_generic_if(hald_dccm_t) @@ -518,14 +509,12 @@ corenet_udp_bind_dhcpc_port(hald_dccm_t) corenet_tcp_bind_ftp_port(hald_dccm_t) corenet_tcp_bind_dccm_port(hald_dccm_t) -logging_send_syslog_msg(hald_dccm_t) - files_read_usr_files(hald_dccm_t) -miscfiles_read_localization(hald_dccm_t) - hal_dontaudit_rw_dgram_sockets(hald_dccm_t) +logging_send_syslog_msg(hald_dccm_t) + optional_policy(` dbus_system_bus_client(hald_dccm_t) ') diff --git a/hddtemp.if b/hddtemp.if index 87b4531..901d905 100644 --- a/hddtemp.if +++ b/hddtemp.if @@ -60,8 +60,11 @@ interface(`hddtemp_admin',` type hddtemp_t, hddtemp_etc_t, hddtemp_initrc_exec_t; ') - allow $1 hddtemp_t:process { ptrace signal_perms }; + allow $1 hddtemp_t:process signal_perms; ps_process_pattern($1, hddtemp_t) + tunable_policy(`deny_ptrace',`',` + allow $1 hddtemp_t:process ptrace; + ') init_labeled_script_domtrans($1, hddtemp_initrc_exec_t) domain_system_change_exemption($1) @@ -69,9 +72,5 @@ interface(`hddtemp_admin',` allow $2 system_r; admin_pattern($1, hddtemp_etc_t) - files_search_etc($1) - - allow $1 hddtemp_t:dir list_dir_perms; - read_lnk_files_pattern($1, hddtemp_t, hddtemp_t) - kernel_search_proc($1) + files_list_etc($1) ') diff --git a/hddtemp.te b/hddtemp.te index c234b32..41d985d 100644 --- a/hddtemp.te +++ b/hddtemp.te @@ -28,7 +28,6 @@ allow hddtemp_t self:udp_socket create_socket_perms; allow hddtemp_t hddtemp_etc_t:file read_file_perms; -corenet_all_recvfrom_unlabeled(hddtemp_t) corenet_all_recvfrom_netlabel(hddtemp_t) corenet_tcp_sendrecv_generic_if(hddtemp_t) corenet_tcp_sendrecv_generic_node(hddtemp_t) @@ -38,12 +37,13 @@ corenet_tcp_bind_hddtemp_port(hddtemp_t) corenet_sendrecv_hddtemp_server_packets(hddtemp_t) corenet_tcp_sendrecv_hddtemp_port(hddtemp_t) -files_search_etc(hddtemp_t) +files_read_etc_files(hddtemp_t) files_read_usr_files(hddtemp_t) storage_raw_read_fixed_disk(hddtemp_t) - +storage_raw_read_removable_device(hddtemp_t) logging_send_syslog_msg(hddtemp_t) -miscfiles_read_localization(hddtemp_t) - +optional_policy(` + sysnet_dns_name_resolve(hddtemp_t) +') diff --git a/howl.te b/howl.te index 6ad2d3c..b23d54a 100644 --- a/howl.te +++ b/howl.te @@ -33,7 +33,6 @@ kernel_request_load_module(howl_t) kernel_list_proc(howl_t) kernel_read_proc_symlinks(howl_t) -corenet_all_recvfrom_unlabeled(howl_t) corenet_all_recvfrom_netlabel(howl_t) corenet_tcp_sendrecv_generic_if(howl_t) corenet_udp_sendrecv_generic_if(howl_t) @@ -60,8 +59,6 @@ init_rw_utmp(howl_t) logging_send_syslog_msg(howl_t) -miscfiles_read_localization(howl_t) - sysnet_read_config(howl_t) userdom_dontaudit_use_unpriv_user_fds(howl_t) diff --git a/i18n_input.te b/i18n_input.te index 5fc89c4..087c2d0 100644 --- a/i18n_input.te +++ b/i18n_input.te @@ -36,7 +36,6 @@ can_exec(i18n_input_t, i18n_input_exec_t) kernel_read_kernel_sysctls(i18n_input_t) kernel_read_system_state(i18n_input_t) -corenet_all_recvfrom_unlabeled(i18n_input_t) corenet_all_recvfrom_netlabel(i18n_input_t) corenet_tcp_sendrecv_generic_if(i18n_input_t) corenet_udp_sendrecv_generic_if(i18n_input_t) @@ -68,22 +67,11 @@ init_stream_connect_script(i18n_input_t) logging_send_syslog_msg(i18n_input_t) -miscfiles_read_localization(i18n_input_t) - sysnet_read_config(i18n_input_t) userdom_dontaudit_use_unpriv_user_fds(i18n_input_t) userdom_read_user_home_content_files(i18n_input_t) - -tunable_policy(`use_nfs_home_dirs',` - fs_read_nfs_files(i18n_input_t) - fs_read_nfs_symlinks(i18n_input_t) -') - -tunable_policy(`use_samba_home_dirs',` - fs_read_cifs_files(i18n_input_t) - fs_read_cifs_symlinks(i18n_input_t) -') +userdom_home_reader(i18n_input_t) optional_policy(` canna_stream_connect(i18n_input_t) diff --git a/icecast.if b/icecast.if index ecab47a..6eddc6d 100644 --- a/icecast.if +++ b/icecast.if @@ -173,7 +173,11 @@ interface(`icecast_admin',` type icecast_t, icecast_initrc_exec_t; ') + allow $1 icecast_t:process signal_perms; ps_process_pattern($1, icecast_t) + tunable_policy(`deny_ptrace',`',` + allow $1 icecast_t:process ptrace; + ') # Allow icecast_t to restart the apache service icecast_initrc_domtrans($1) @@ -184,5 +188,4 @@ interface(`icecast_admin',` icecast_manage_pid_files($1) icecast_manage_log($1) - ') diff --git a/icecast.te b/icecast.te index fdb7e9a..b910581 100644 --- a/icecast.te +++ b/icecast.te @@ -5,6 +5,14 @@ policy_module(icecast, 1.1.0) # Declarations # +## +##

+## Allow icecast to connect to all ports, not just +## sound ports. +##

+## +gen_tunable(icecast_connect_any, false) + type icecast_t; type icecast_exec_t; init_daemon_domain(icecast_t, icecast_exec_t) @@ -39,18 +47,24 @@ files_pid_filetrans(icecast_t, icecast_var_run_t, { file dir }) kernel_read_system_state(icecast_t) +dev_read_sysfs(icecast_t) +dev_read_urand(icecast_t) +dev_read_rand(icecast_t) + corenet_tcp_bind_soundd_port(icecast_t) +corenet_tcp_connect_soundd_port(icecast_t) + +tunable_policy(`icecast_connect_any',` + corenet_tcp_connect_all_ports(icecast_t) + corenet_tcp_bind_all_ports(icecast_t) + corenet_sendrecv_all_client_packets(icecast_t) +') # Init script handling domain_use_interactive_fds(icecast_t) -files_read_etc_files(icecast_t) - auth_use_nsswitch(icecast_t) -miscfiles_read_localization(icecast_t) - -sysnet_dns_name_resolve(icecast_t) optional_policy(` apache_read_sys_content(icecast_t) diff --git a/ifplugd.if b/ifplugd.if index dfb4232..35343f8 100644 --- a/ifplugd.if +++ b/ifplugd.if @@ -113,11 +113,11 @@ interface(`ifplugd_read_pid_files',` # interface(`ifplugd_admin',` gen_require(` - type ifplugd_t, ifplugd_etc_t; - type ifplugd_var_run_t, ifplugd_initrc_exec_t; + type ifplugd_t, ifplugd_etc_t, ifplugd_var_run_t; + type ifplugd_initrc_exec_t; ') - allow $1 ifplugd_t:process { ptrace signal_perms }; + allow $1 ifplugd_t:process signal_perms; ps_process_pattern($1, ifplugd_t) init_labeled_script_domtrans($1, ifplugd_initrc_exec_t) diff --git a/ifplugd.te b/ifplugd.te index 978c32f..05927a7 100644 --- a/ifplugd.te +++ b/ifplugd.te @@ -11,7 +11,7 @@ init_daemon_domain(ifplugd_t, ifplugd_exec_t) # config files type ifplugd_etc_t; -files_type(ifplugd_etc_t) +files_config_file(ifplugd_etc_t) type ifplugd_initrc_exec_t; init_script_file(ifplugd_initrc_exec_t) @@ -26,7 +26,7 @@ files_pid_file(ifplugd_var_run_t) # allow ifplugd_t self:capability { net_admin sys_nice net_bind_service }; -dontaudit ifplugd_t self:capability { sys_tty_config sys_ptrace }; +dontaudit ifplugd_t self:capability sys_tty_config; allow ifplugd_t self:process { signal signull }; allow ifplugd_t self:fifo_file rw_fifo_file_perms; allow ifplugd_t self:tcp_socket create_stream_socket_perms; @@ -54,15 +54,14 @@ corecmd_exec_bin(ifplugd_t) # reading of hardware information dev_read_sysfs(ifplugd_t) +#domain_read_all_domains_state(ifplugd_t) domain_read_confined_domains_state(ifplugd_t) -domain_dontaudit_read_all_domains_state(ifplugd_t) +#domain_dontaudit_read_all_domains_state(ifplugd_t) auth_use_nsswitch(ifplugd_t) logging_send_syslog_msg(ifplugd_t) -miscfiles_read_localization(ifplugd_t) - netutils_domtrans(ifplugd_t) # transition to ifconfig & dhcpc sysnet_domtrans_ifconfig(ifplugd_t) diff --git a/imaze.fc b/imaze.fc index 8d455ba..58729cb 100644 --- a/imaze.fc +++ b/imaze.fc @@ -1,4 +1,4 @@ /usr/games/imazesrv -- gen_context(system_u:object_r:imazesrv_exec_t,s0) /usr/share/games/imaze(/.*)? gen_context(system_u:object_r:imazesrv_data_t,s0) -/var/log/imaze\.log -- gen_context(system_u:object_r:imazesrv_log_t,s0) +/var/log/imaze\.log.* -- gen_context(system_u:object_r:imazesrv_log_t,s0) diff --git a/imaze.te b/imaze.te index 0778af8..66fb4ae 100644 --- a/imaze.te +++ b/imaze.te @@ -54,7 +54,6 @@ kernel_read_kernel_sysctls(imazesrv_t) kernel_list_proc(imazesrv_t) kernel_read_proc_symlinks(imazesrv_t) -corenet_all_recvfrom_unlabeled(imazesrv_t) corenet_all_recvfrom_netlabel(imazesrv_t) corenet_tcp_sendrecv_generic_if(imazesrv_t) corenet_udp_sendrecv_generic_if(imazesrv_t) @@ -79,8 +78,6 @@ fs_search_auto_mountpoints(imazesrv_t) logging_send_syslog_msg(imazesrv_t) -miscfiles_read_localization(imazesrv_t) - sysnet_read_config(imazesrv_t) userdom_use_unpriv_users_fds(imazesrv_t) diff --git a/inetd.fc b/inetd.fc index 39d5baa..4288778 100644 --- a/inetd.fc +++ b/inetd.fc @@ -7,6 +7,6 @@ /usr/sbin/rlinetd -- gen_context(system_u:object_r:inetd_exec_t,s0) /usr/sbin/xinetd -- gen_context(system_u:object_r:inetd_exec_t,s0) -/var/log/(x)?inetd\.log -- gen_context(system_u:object_r:inetd_log_t,s0) +/var/log/(x)?inetd\.log.* -- gen_context(system_u:object_r:inetd_log_t,s0) /var/run/(x)?inetd\.pid -- gen_context(system_u:object_r:inetd_var_run_t,s0) diff --git a/inetd.if b/inetd.if index df48e5e..161814e 100644 --- a/inetd.if +++ b/inetd.if @@ -37,6 +37,10 @@ interface(`inetd_core_service_domain',` domtrans_pattern(inetd_t, $2, $1) allow inetd_t $1:process { siginh sigkill }; + + optional_policy(` + abrt_stream_connect($1) + ') ') ######################################## diff --git a/inetd.te b/inetd.te index 10f25d3..ec4cd54 100644 --- a/inetd.te +++ b/inetd.te @@ -38,9 +38,9 @@ ifdef(`enable_mcs',` # Local policy # -allow inetd_t self:capability { setuid setgid sys_resource }; +allow inetd_t self:capability { setuid setgid }; dontaudit inetd_t self:capability sys_tty_config; -allow inetd_t self:process { setsched setexec setrlimit }; +allow inetd_t self:process { setsched setexec }; allow inetd_t self:fifo_file rw_fifo_file_perms; allow inetd_t self:tcp_socket create_stream_socket_perms; allow inetd_t self:udp_socket create_socket_perms; @@ -65,7 +65,6 @@ kernel_tcp_recvfrom_unlabeled(inetd_t) corecmd_bin_domtrans(inetd_t, inetd_child_t) # base networking: -corenet_all_recvfrom_unlabeled(inetd_t) corenet_all_recvfrom_netlabel(inetd_t) corenet_tcp_sendrecv_generic_if(inetd_t) corenet_udp_sendrecv_generic_if(inetd_t) @@ -89,16 +88,19 @@ corenet_tcp_bind_ftp_port(inetd_t) corenet_udp_bind_ftp_port(inetd_t) corenet_tcp_bind_inetd_child_port(inetd_t) corenet_udp_bind_inetd_child_port(inetd_t) +corenet_tcp_bind_echo_port(inetd_t) +corenet_udp_bind_echo_port(inetd_t) +corenet_tcp_bind_time_port(inetd_t) +corenet_udp_bind_time_port(inetd_t) corenet_tcp_bind_ircd_port(inetd_t) corenet_udp_bind_ktalkd_port(inetd_t) -corenet_tcp_bind_pop_port(inetd_t) corenet_tcp_bind_printer_port(inetd_t) corenet_udp_bind_rlogind_port(inetd_t) corenet_udp_bind_rsh_port(inetd_t) corenet_tcp_bind_rsh_port(inetd_t) corenet_tcp_bind_rsync_port(inetd_t) corenet_udp_bind_rsync_port(inetd_t) -corenet_tcp_bind_stunnel_port(inetd_t) +#corenet_tcp_bind_stunnel_port(inetd_t) corenet_tcp_bind_swat_port(inetd_t) corenet_udp_bind_swat_port(inetd_t) corenet_tcp_bind_telnetd_port(inetd_t) @@ -119,7 +121,7 @@ corenet_sendrecv_ktalkd_server_packets(inetd_t) corenet_sendrecv_printer_server_packets(inetd_t) corenet_sendrecv_rsh_server_packets(inetd_t) corenet_sendrecv_rsync_server_packets(inetd_t) -corenet_sendrecv_stunnel_server_packets(inetd_t) +#corenet_sendrecv_stunnel_server_packets(inetd_t) corenet_sendrecv_swat_server_packets(inetd_t) corenet_sendrecv_tftp_server_packets(inetd_t) @@ -137,20 +139,20 @@ corecmd_read_bin_symlinks(inetd_t) domain_use_interactive_fds(inetd_t) -files_read_etc_files(inetd_t) files_read_etc_runtime_files(inetd_t) auth_use_nsswitch(inetd_t) logging_send_syslog_msg(inetd_t) -miscfiles_read_localization(inetd_t) - # xinetd needs MLS override privileges to work mls_fd_share_all_levels(inetd_t) mls_socket_read_to_clearance(inetd_t) mls_socket_write_to_clearance(inetd_t) +mls_net_outbound_all_levels(inetd_t) mls_process_set_level(inetd_t) +#706086 +mls_net_outbound_all_levels(inetd_t) sysnet_read_config(inetd_t) @@ -177,6 +179,10 @@ optional_policy(` ') optional_policy(` + tftp_read_config(inetd_t) +') + +optional_policy(` udev_read_db(inetd_t) ') @@ -210,7 +216,6 @@ kernel_read_kernel_sysctls(inetd_child_t) kernel_read_system_state(inetd_child_t) kernel_read_network_state(inetd_child_t) -corenet_all_recvfrom_unlabeled(inetd_child_t) corenet_all_recvfrom_netlabel(inetd_child_t) corenet_tcp_sendrecv_generic_if(inetd_child_t) corenet_udp_sendrecv_generic_if(inetd_child_t) @@ -223,15 +228,12 @@ dev_read_urand(inetd_child_t) fs_getattr_xattr_fs(inetd_child_t) -files_read_etc_files(inetd_child_t) files_read_etc_runtime_files(inetd_child_t) auth_use_nsswitch(inetd_child_t) logging_send_syslog_msg(inetd_child_t) -miscfiles_read_localization(inetd_child_t) - sysnet_read_config(inetd_child_t) optional_policy(` diff --git a/inn.if b/inn.if index ebc9e0d..2c4b5da 100644 --- a/inn.if +++ b/inn.if @@ -93,6 +93,7 @@ interface(`inn_read_config',` type innd_etc_t; ') + files_search_etc($1) allow $1 innd_etc_t:dir list_dir_perms; allow $1 innd_etc_t:file read_file_perms; allow $1 innd_etc_t:lnk_file read_lnk_file_perms; @@ -113,6 +114,7 @@ interface(`inn_read_news_lib',` type innd_var_lib_t; ') + files_search_var_lib($1) allow $1 innd_var_lib_t:dir list_dir_perms; allow $1 innd_var_lib_t:file read_file_perms; allow $1 innd_var_lib_t:lnk_file read_lnk_file_perms; @@ -133,6 +135,7 @@ interface(`inn_read_news_spool',` type news_spool_t; ') + files_search_spool($1) allow $1 news_spool_t:dir list_dir_perms; allow $1 news_spool_t:file read_file_perms; allow $1 news_spool_t:lnk_file read_lnk_file_perms; @@ -195,12 +198,15 @@ interface(`inn_domtrans',` interface(`inn_admin',` gen_require(` type innd_t, innd_etc_t, innd_log_t; - type news_spool_t, innd_var_lib_t; - type innd_var_run_t, innd_initrc_exec_t; + type news_spool_t, innd_var_lib_t, innd_var_run_t; + type innd_initrc_exec_t; ') - allow $1 innd_t:process { ptrace signal_perms }; + allow $1 innd_t:process signal_perms; ps_process_pattern($1, innd_t) + tunable_policy(`deny_ptrace',`',` + allow $1 innd_t:process ptrace; + ') init_labeled_script_domtrans($1, innd_initrc_exec_t) domain_system_change_exemption($1) diff --git a/inn.te b/inn.te index 7311364..bc6aed8 100644 --- a/inn.te +++ b/inn.te @@ -4,6 +4,7 @@ policy_module(inn, 1.10.0) # # Declarations # + type innd_t; type innd_exec_t; init_daemon_domain(innd_t, innd_exec_t) @@ -25,11 +26,13 @@ files_pid_file(innd_var_run_t) type news_spool_t; files_mountpoint(news_spool_t) +files_spool_file(news_spool_t) ######################################## # # Local policy # + allow innd_t self:capability { dac_override kill setgid setuid }; dontaudit innd_t self:capability sys_tty_config; allow innd_t self:process { setsched signal_perms }; @@ -46,7 +49,7 @@ read_lnk_files_pattern(innd_t, innd_etc_t, innd_etc_t) can_exec(innd_t, innd_exec_t) manage_files_pattern(innd_t, innd_log_t, innd_log_t) -allow innd_t innd_log_t:dir setattr; +allow innd_t innd_log_t:dir setattr_dir_perms; logging_log_filetrans(innd_t, innd_log_t, file) manage_dirs_pattern(innd_t, innd_var_lib_t, innd_var_lib_t) @@ -56,7 +59,7 @@ files_var_lib_filetrans(innd_t, innd_var_lib_t, file) manage_dirs_pattern(innd_t, innd_var_run_t, innd_var_run_t) manage_files_pattern(innd_t, innd_var_run_t, innd_var_run_t) manage_sock_files_pattern(innd_t, innd_var_run_t, innd_var_run_t) -files_pid_filetrans(innd_t, innd_var_run_t, file) +files_pid_filetrans(innd_t, innd_var_run_t, { dir file }) manage_dirs_pattern(innd_t, news_spool_t, news_spool_t) manage_files_pattern(innd_t, news_spool_t, news_spool_t) @@ -65,7 +68,6 @@ manage_lnk_files_pattern(innd_t, news_spool_t, news_spool_t) kernel_read_kernel_sysctls(innd_t) kernel_read_system_state(innd_t) -corenet_all_recvfrom_unlabeled(innd_t) corenet_all_recvfrom_netlabel(innd_t) corenet_tcp_sendrecv_generic_if(innd_t) corenet_udp_sendrecv_generic_if(innd_t) @@ -97,14 +99,13 @@ files_read_usr_files(innd_t) logging_send_syslog_msg(innd_t) -miscfiles_read_localization(innd_t) - seutil_dontaudit_search_config(innd_t) sysnet_read_config(innd_t) userdom_dontaudit_use_unpriv_user_fds(innd_t) userdom_dontaudit_search_user_home_dirs(innd_t) +userdom_dgram_send(innd_t) mta_send_mail(innd_t) diff --git a/irc.fc b/irc.fc index 65ece18..6bfdfd3 100644 --- a/irc.fc +++ b/irc.fc @@ -2,10 +2,14 @@ # /home # HOME_DIR/\.ircmotd -- gen_context(system_u:object_r:irc_home_t,s0) +HOME_DIR/\.irssi(/.*)? gen_context(system_u:object_r:irssi_home_t,s0) + +/etc/irssi\.conf -- gen_context(system_u:object_r:irssi_etc_t,s0) # # /usr # /usr/bin/[st]irc -- gen_context(system_u:object_r:irc_exec_t,s0) /usr/bin/ircII -- gen_context(system_u:object_r:irc_exec_t,s0) +/usr/bin/irssi -- gen_context(system_u:object_r:irssi_exec_t,s0) /usr/bin/tinyirc -- gen_context(system_u:object_r:irc_exec_t,s0) diff --git a/irc.if b/irc.if index 4f9dc90..65da2c6 100644 --- a/irc.if +++ b/irc.if @@ -18,9 +18,11 @@ interface(`irc_role',` gen_require(` type irc_t, irc_exec_t; + type irssi_t, irssi_exec_t, irssi_home_t; ') role $1 types irc_t; + role $1 types irssi_t; # Transition from the user domain to the derived domain. domtrans_pattern($2, irc_exec_t, irc_t) @@ -28,4 +30,38 @@ interface(`irc_role',` # allow ps to show irc ps_process_pattern($2, irc_t) allow $2 irc_t:process signal; + + domtrans_pattern($2, irssi_exec_t, irssi_t) + + allow $2 irssi_t:process signal_perms; + ps_process_pattern($2, irssi_t) + + manage_dirs_pattern($2, irssi_home_t, irssi_home_t) + manage_files_pattern($2, irssi_home_t, irssi_home_t) + manage_lnk_files_pattern($2, irssi_home_t, irssi_home_t) + + relabel_dirs_pattern($2, irssi_home_t, irssi_home_t) + relabel_files_pattern($2, irssi_home_t, irssi_home_t) + relabel_lnk_files_pattern($2, irssi_home_t, irssi_home_t) + + irc_filetrans_home_content($2) +') + +######################################## +## +## Transition to alsa named content +## +## +## +## Domain allowed access. +## +## +# +interface(`irc_filetrans_home_content',` + gen_require(` + type irc_home_t; + ') + + userdom_user_home_dir_filetrans($1, irc_home_t, file, ".ircmotd") + userdom_user_home_dir_filetrans($1, irc_home_t, dir, ".irssi") ') diff --git a/irc.te b/irc.te index 6e2dbd2..73e129e 100644 --- a/irc.te +++ b/irc.te @@ -19,7 +19,31 @@ userdom_user_home_content(irc_home_t) type irc_tmp_t; typealias irc_tmp_t alias { user_irc_tmp_t staff_irc_tmp_t sysadm_irc_tmp_t }; typealias irc_tmp_t alias { auditadm_irc_tmp_t secadm_irc_tmp_t }; -userdom_user_tmp_file(irc_tmp_t) +userdom_user_home_content(irc_tmp_t) + +######################################## +# +# Irssi personal declarations. +# + +## +##

+## Allow the Irssi IRC Client to connect to any port, +## and to bind to any unreserved port. +##

+## +gen_tunable(irssi_use_full_network, false) + +type irssi_t; +type irssi_exec_t; +application_domain(irssi_t, irssi_exec_t) +ubac_constrained(irssi_t) + +type irssi_etc_t; +files_config_file(irssi_etc_t) + +type irssi_home_t; +userdom_user_home_content(irssi_home_t) ######################################## # @@ -33,7 +57,7 @@ allow irc_t self:udp_socket create_socket_perms; manage_dirs_pattern(irc_t, irc_home_t, irc_home_t) manage_files_pattern(irc_t, irc_home_t, irc_home_t) manage_lnk_files_pattern(irc_t, irc_home_t, irc_home_t) -userdom_user_home_dir_filetrans(irc_t, irc_home_t, { dir file lnk_file }) +irc_filetrans_home_content(irc_t) # access files under /tmp manage_dirs_pattern(irc_t, irc_tmp_t, irc_tmp_t) @@ -45,7 +69,6 @@ files_tmp_filetrans(irc_t, irc_tmp_t, { file dir lnk_file sock_file fifo_file }) kernel_read_proc_symlinks(irc_t) -corenet_all_recvfrom_unlabeled(irc_t) corenet_all_recvfrom_netlabel(irc_t) corenet_tcp_sendrecv_generic_if(irc_t) corenet_udp_sendrecv_generic_if(irc_t) @@ -75,7 +98,6 @@ term_list_ptys(irc_t) init_read_utmp(irc_t) init_dontaudit_lock_utmp(irc_t) -miscfiles_read_localization(irc_t) # Inherit and use descriptors from newrole. seutil_use_newrole_fds(irc_t) @@ -83,20 +105,74 @@ seutil_use_newrole_fds(irc_t) sysnet_read_config(irc_t) # Write to the user domain tty. -userdom_use_user_terminals(irc_t) +userdom_use_inherited_user_terminals(irc_t) -tunable_policy(`use_nfs_home_dirs',` - fs_manage_nfs_dirs(irc_t) - fs_manage_nfs_files(irc_t) - fs_manage_nfs_symlinks(irc_t) +userdom_home_manager(irc_t) + +optional_policy(` + nis_use_ypbind(irc_t) ') -tunable_policy(`use_samba_home_dirs',` - fs_manage_cifs_dirs(irc_t) - fs_manage_cifs_files(irc_t) - fs_manage_cifs_symlinks(irc_t) +######################################## +# +# Irssi personal declarations. +# + +allow irssi_t self:process { signal sigkill }; +allow irssi_t self:fifo_file rw_fifo_file_perms; +allow irssi_t self:tcp_socket create_stream_socket_perms; + +read_files_pattern(irssi_t, irssi_etc_t, irssi_etc_t) + +manage_dirs_pattern(irssi_t, irssi_home_t, irssi_home_t) +manage_files_pattern(irssi_t, irssi_home_t, irssi_home_t) +manage_lnk_files_pattern(irssi_t, irssi_home_t, irssi_home_t) +irc_filetrans_home_content(irssi_t) +userdom_search_user_home_dirs(irssi_t) + +kernel_read_system_state(irssi_t) + +corecmd_search_bin(irssi_t) +corecmd_read_bin_symlinks(irssi_t) + +corenet_tcp_connect_ircd_port(irssi_t) +corenet_tcp_sendrecv_ircd_port(irssi_t) +corenet_sendrecv_ircd_client_packets(irssi_t) + +# tcp:7000 is often used for SSL irc +corenet_tcp_connect_gatekeeper_port(irssi_t) +corenet_tcp_sendrecv_gatekeeper_port(irssi_t) +corenet_sendrecv_gatekeeper_client_packets(irssi_t) + +# Privoxy +corenet_tcp_connect_http_cache_port(irssi_t) +corenet_tcp_sendrecv_http_cache_port(irssi_t) +corenet_sendrecv_http_cache_client_packets(irssi_t) + +corenet_tcp_bind_generic_node(irssi_t) + +dev_read_urand(irssi_t) +# irssi-otr genkey. +dev_read_rand(irssi_t) + +files_read_usr_files(irssi_t) + +fs_search_auto_mountpoints(irssi_t) + +auth_use_nsswitch(irssi_t) + + +userdom_use_inherited_user_terminals(irssi_t) + +tunable_policy(`irssi_use_full_network', ` + corenet_tcp_bind_all_unreserved_ports(irssi_t) + corenet_tcp_connect_all_ports(irssi_t) + corenet_sendrecv_generic_server_packets(irssi_t) + corenet_sendrecv_all_client_packets(irssi_t) ') +userdom_home_manager(irssi_t) + optional_policy(` - nis_use_ypbind(irc_t) + automount_dontaudit_getattr_tmp_dirs(irssi_t) ') diff --git a/ircd.te b/ircd.te index 75ab1e2..603ea55 100644 --- a/ircd.te +++ b/ircd.te @@ -49,7 +49,6 @@ kernel_read_kernel_sysctls(ircd_t) corecmd_search_bin(ircd_t) -corenet_all_recvfrom_unlabeled(ircd_t) corenet_all_recvfrom_netlabel(ircd_t) corenet_tcp_sendrecv_generic_if(ircd_t) corenet_udp_sendrecv_generic_if(ircd_t) @@ -73,8 +72,6 @@ fs_search_auto_mountpoints(ircd_t) logging_send_syslog_msg(ircd_t) -miscfiles_read_localization(ircd_t) - sysnet_read_config(ircd_t) userdom_dontaudit_use_unpriv_user_fds(ircd_t) diff --git a/irqbalance.te b/irqbalance.te index 9aeeaf9..a91de65 100644 --- a/irqbalance.te +++ b/irqbalance.te @@ -19,6 +19,12 @@ files_pid_file(irqbalance_var_run_t) allow irqbalance_t self:capability { setpcap net_admin }; dontaudit irqbalance_t self:capability sys_tty_config; + +ifdef(`hide_broken_symptoms',` + # caused by some bogus kernel code + dontaudit irqbalance_t self:capability sys_module; +') + allow irqbalance_t self:process { getcap setcap signal_perms }; allow irqbalance_t self:udp_socket create_socket_perms; @@ -42,8 +48,6 @@ domain_use_interactive_fds(irqbalance_t) logging_send_syslog_msg(irqbalance_t) -miscfiles_read_localization(irqbalance_t) - userdom_dontaudit_use_unpriv_user_fds(irqbalance_t) userdom_dontaudit_search_user_home_dirs(irqbalance_t) diff --git a/iscsi.fc b/iscsi.fc index 14d9670..6825edc 100644 --- a/iscsi.fc +++ b/iscsi.fc @@ -1,7 +1,16 @@ /sbin/iscsid -- gen_context(system_u:object_r:iscsid_exec_t,s0) /sbin/brcm_iscsiuio -- gen_context(system_u:object_r:iscsid_exec_t,s0) +/sbin/iscsiuio -- gen_context(system_u:object_r:iscsid_exec_t,s0) /var/lib/iscsi(/.*)? gen_context(system_u:object_r:iscsi_var_lib_t,s0) + /var/lock/iscsi(/.*)? gen_context(system_u:object_r:iscsi_lock_t,s0) -/var/log/brcm-iscsi\.log -- gen_context(system_u:object_r:iscsi_log_t,s0) + +/var/log/brcm-iscsi\.log.* -- gen_context(system_u:object_r:iscsi_log_t,s0) +/var/log/iscsiuio\.log.* -- gen_context(system_u:object_r:iscsi_log_t,s0) + /var/run/iscsid\.pid -- gen_context(system_u:object_r:iscsi_var_run_t,s0) + +/usr/sbin/iscsid -- gen_context(system_u:object_r:iscsid_exec_t,s0) +/usr/sbin/brcm_iscsiuio -- gen_context(system_u:object_r:iscsid_exec_t,s0) +/usr/sbin/iscsiuio -- gen_context(system_u:object_r:iscsid_exec_t,s0) diff --git a/iscsi.te b/iscsi.te index 8bcfa2f..f71614d 100644 --- a/iscsi.te +++ b/iscsi.te @@ -31,7 +31,6 @@ files_pid_file(iscsi_var_run_t) # allow iscsid_t self:capability { dac_override ipc_lock net_admin net_raw sys_admin sys_nice sys_resource }; -dontaudit iscsid_t self:capability sys_ptrace; allow iscsid_t self:process { setrlimit setsched signal }; allow iscsid_t self:fifo_file rw_fifo_file_perms; allow iscsid_t self:unix_stream_socket { create_stream_socket_perms connectto }; @@ -66,8 +65,8 @@ files_pid_filetrans(iscsid_t, iscsi_var_run_t, file) kernel_read_network_state(iscsid_t) kernel_read_system_state(iscsid_t) +kernel_setsched(iscsid_t) -corenet_all_recvfrom_unlabeled(iscsid_t) corenet_all_recvfrom_netlabel(iscsid_t) corenet_tcp_sendrecv_generic_if(iscsid_t) corenet_tcp_sendrecv_generic_node(iscsid_t) @@ -75,14 +74,16 @@ corenet_tcp_sendrecv_all_ports(iscsid_t) corenet_tcp_connect_http_port(iscsid_t) corenet_tcp_connect_iscsi_port(iscsid_t) corenet_tcp_connect_isns_port(iscsid_t) +corenet_tcp_connect_winshadow_port(iscsid_t) dev_rw_sysfs(iscsid_t) dev_rw_userio_dev(iscsid_t) +dev_read_raw_memory(iscsid_t) +dev_write_raw_memory(iscsid_t) domain_use_interactive_fds(iscsid_t) domain_dontaudit_read_all_domains_state(iscsid_t) -files_read_etc_files(iscsid_t) auth_use_nsswitch(iscsid_t) @@ -90,8 +91,6 @@ init_stream_connect_script(iscsid_t) logging_send_syslog_msg(iscsid_t) -miscfiles_read_localization(iscsid_t) - optional_policy(` tgtd_manage_semaphores(iscsid_t) ') diff --git a/isnsd.fc b/isnsd.fc new file mode 100644 index 0000000..3e29080 --- /dev/null +++ b/isnsd.fc @@ -0,0 +1,8 @@ +/etc/rc\.d/init\.d/isnsd -- gen_context(system_u:object_r:isnsd_initrc_exec_t,s0) + +/usr/sbin/isnsd -- gen_context(system_u:object_r:isnsd_exec_t,s0) + +/var/lib/isns(/.*)? gen_context(system_u:object_r:isnsd_var_lib_t,s0) + +/var/run/isnsd\.pid -- gen_context(system_u:object_r:isnsd_var_run_t,s0) +/var/run/isnsctl -s gen_context(system_u:object_r:isnsd_var_run_t,s0) diff --git a/isnsd.if b/isnsd.if new file mode 100644 index 0000000..1b3514a --- /dev/null +++ b/isnsd.if @@ -0,0 +1,181 @@ + +## policy for isnsd + + +######################################## +## +## Transition to isnsd. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`isnsd_domtrans',` + gen_require(` + type isnsd_t, isnsd_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, isnsd_exec_t, isnsd_t) +') + + +######################################## +## +## Execute isnsd server in the isnsd domain. +## +## +## +## Domain allowed access. +## +## +# +interface(`isnsd_initrc_domtrans',` + gen_require(` + type isnsd_initrc_exec_t; + ') + + init_labeled_script_domtrans($1, isnsd_initrc_exec_t) +') + + +######################################## +## +## Search isnsd lib directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`isnsd_search_lib',` + gen_require(` + type isnsd_var_lib_t; + ') + + allow $1 isnsd_var_lib_t:dir search_dir_perms; + files_search_var_lib($1) +') + +######################################## +## +## Read isnsd lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`isnsd_read_lib_files',` + gen_require(` + type isnsd_var_lib_t; + ') + + files_search_var_lib($1) + read_files_pattern($1, isnsd_var_lib_t, isnsd_var_lib_t) +') + +######################################## +## +## Manage isnsd lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`isnsd_manage_lib_files',` + gen_require(` + type isnsd_var_lib_t; + ') + + files_search_var_lib($1) + manage_files_pattern($1, isnsd_var_lib_t, isnsd_var_lib_t) +') + +######################################## +## +## Manage isnsd lib directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`isnsd_manage_lib_dirs',` + gen_require(` + type isnsd_var_lib_t; + ') + + files_search_var_lib($1) + manage_dirs_pattern($1, isnsd_var_lib_t, isnsd_var_lib_t) +') + + +######################################## +## +## Read isnsd PID files. +## +## +## +## Domain allowed access. +## +## +# +interface(`isnsd_read_pid_files',` + gen_require(` + type isnsd_var_run_t; + ') + + files_search_pids($1) + allow $1 isnsd_var_run_t:file read_file_perms; +') + + +######################################## +## +## All of the rules required to administrate +## an isnsd environment +## +## +## +## Domain allowed access. +## +## +## +## +## Role allowed access. +## +## +## +# +interface(`isnsd_admin',` + gen_require(` + type isnsd_t; + type isnsd_initrc_exec_t; + type isnsd_var_lib_t; + type isnsd_var_run_t; + ') + + allow $1 isnsd_t:process { ptrace signal_perms }; + ps_process_pattern($1, isnsd_t) + + isnsd_initrc_domtrans($1) + domain_system_change_exemption($1) + role_transition $2 isnsd_initrc_exec_t system_r; + allow $2 system_r; + + files_search_var_lib($1) + admin_pattern($1, isnsd_var_lib_t) + + files_search_pids($1) + admin_pattern($1, isnsd_var_run_t) + +') + diff --git a/isnsd.te b/isnsd.te new file mode 100644 index 0000000..fa4b4d7 --- /dev/null +++ b/isnsd.te @@ -0,0 +1,51 @@ +policy_module(isnsd, 1.0.0) + +######################################## +# +# Declarations +# + +type isnsd_t; +type isnsd_exec_t; +init_daemon_domain(isnsd_t, isnsd_exec_t) + +type isnsd_initrc_exec_t; +init_script_file(isnsd_initrc_exec_t) + +type isnsd_var_lib_t; +files_type(isnsd_var_lib_t) + +type isnsd_var_run_t; +files_pid_file(isnsd_var_run_t) + +######################################## +# +# isnsd local policy +# + +allow isnsd_t self:capability { kill }; +allow isnsd_t self:process { signal }; + +allow isnsd_t self:fifo_file rw_fifo_file_perms; +allow isnsd_t self:udp_socket { listen }; +allow isnsd_t self:unix_stream_socket create_stream_socket_perms; + +manage_dirs_pattern(isnsd_t, isnsd_var_lib_t, isnsd_var_lib_t) +manage_files_pattern(isnsd_t, isnsd_var_lib_t, isnsd_var_lib_t) +files_var_lib_filetrans(isnsd_t, isnsd_var_lib_t, { dir file }) + +manage_dirs_pattern(isnsd_t, isnsd_var_run_t, isnsd_var_run_t) +manage_sock_files_pattern(isnsd_t, isnsd_var_run_t, isnsd_var_run_t) +manage_files_pattern(isnsd_t, isnsd_var_run_t, isnsd_var_run_t) +files_pid_filetrans(isnsd_t, isnsd_var_run_t, { dir file sock_file }) + +corenet_tcp_bind_generic_node(isnsd_t) +corenet_tcp_bind_isns_port(isnsd_t) + +domain_use_interactive_fds(isnsd_t) + +files_read_etc_files(isnsd_t) + +logging_send_syslog_msg(isnsd_t) + +sysnet_dns_name_resolve(isnsd_t) diff --git a/jabber.fc b/jabber.fc index da6f4b4..bd02cc8 100644 --- a/jabber.fc +++ b/jabber.fc @@ -1,10 +1,18 @@ -/etc/rc\.d/init\.d/jabber -- gen_context(system_u:object_r:jabberd_initrc_exec_t,s0) +/etc/rc\.d/init\.d/jabberd -- gen_context(system_u:object_r:jabberd_initrc_exec_t,s0) -/usr/sbin/ejabberd -- gen_context(system_u:object_r:jabberd_exec_t,s0) -/usr/sbin/jabberd -- gen_context(system_u:object_r:jabberd_exec_t,s0) +/usr/bin/router -- gen_context(system_u:object_r:jabberd_router_exec_t,s0) +/usr/bin/c2s -- gen_context(system_u:object_r:jabberd_router_exec_t,s0) +/usr/bin/s2s -- gen_context(system_u:object_r:jabberd_exec_t,s0) +/usr/bin/sm -- gen_context(system_u:object_r:jabberd_exec_t,s0) -/var/lib/ejabberd(/.*)? gen_context(system_u:object_r:jabberd_var_lib_t,s0) -/var/lib/jabber(/.*)? gen_context(system_u:object_r:jabberd_var_lib_t,s0) +/var/lib/jabberd(/.*)? gen_context(system_u:object_r:jabberd_var_lib_t,s0) -/var/log/ejabberd(/.*)? gen_context(system_u:object_r:jabberd_log_t,s0) -/var/log/jabber(/.*)? gen_context(system_u:object_r:jabberd_log_t,s0) +# pyicq-t + +/usr/share/pyicq-t/PyICQt\.py -- gen_context(system_u:object_r:pyicqt_exec_t,s0) + +/var/log/pyicq-t\.log.* gen_context(system_u:object_r:pyicqt_log_t,s0) + +/var/run/pyicq-t(/.*)? gen_context(system_u:object_r:pyicqt_var_run_t,s0) + +/var/spool/pyicq-t(/.*)? gen_context(system_u:object_r:pyicqt_var_spool_t,s0) diff --git a/jabber.if b/jabber.if index 9878499..5bc1ca2 100644 --- a/jabber.if +++ b/jabber.if @@ -1,8 +1,74 @@ ## Jabber instant messaging server -######################################## +##################################### +## +## Creates types and rules for a basic +## jabber init daemon domain. +## +## +## +## Prefix for the domain. +## +## +# +template(`jabber_domain_template',` + gen_require(` + attribute jabberd_domain; + ') + + ############################## + # + # $1_t declarations + # + + type $1_t, jabberd_domain; + type $1_exec_t; + init_daemon_domain($1_t, $1_exec_t) + + corenet_all_recvfrom_netlabel($1_t) + + logging_send_syslog_msg($1_t) +') + +####################################### +## +## Execute a domain transition to run jabberd services +## +## +## +## Domain allowed to transition. +## +## +# +interface(`jabber_domtrans_jabberd',` + gen_require(` + type jabberd_t, jabberd_exec_t; + ') + + domtrans_pattern($1, jabberd_exec_t, jabberd_t) +') + +###################################### ## -## Connect to jabber over a TCP socket (Deprecated) +## Execute a domain transition to run jabberd router service +## +## +## +## Domain allowed to transition. +## +## +# +interface(`jabber_domtrans_jabberd_router',` + gen_require(` + type jabberd_router_t, jabberd_router_exec_t; + ') + + domtrans_pattern($1, jabberd_router_exec_t, jabberd_router_t) +') + +####################################### +## +## Read jabberd lib files. ## ## ## @@ -10,8 +76,51 @@ ## ## # -interface(`jabber_tcp_connect',` - refpolicywarn(`$0($*) has been deprecated.') +interface(`jabberd_read_lib_files',` + gen_require(` + type jabberd_var_lib_t; + ') + + files_search_var_lib($1) + read_files_pattern($1, jabberd_var_lib_t, jabberd_var_lib_t) +') + +####################################### +## +## Dontaudit inherited read jabberd lib files. +## +## +## +## Domain to not audit. +## +## +# +interface(`jabberd_dontaudit_read_lib_files',` + gen_require(` + type jabberd_var_lib_t; + ') + + dontaudit $1 jabberd_var_lib_t:file read_inherited_file_perms; +') + +####################################### +## +## Create, read, write, and delete +## jabberd lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`jabberd_manage_lib_files',` + gen_require(` + type jabberd_var_lib_t; + ') + + files_search_var_lib($1) + manage_files_pattern($1, jabberd_var_lib_t, jabberd_var_lib_t) ') ######################################## @@ -33,24 +142,25 @@ interface(`jabber_tcp_connect',` # interface(`jabber_admin',` gen_require(` - type jabberd_t, jabberd_log_t, jabberd_var_lib_t; - type jabberd_var_run_t, jabberd_initrc_exec_t; + type jabberd_t, jabberd_var_lib_t; + type jabberd_initrc_exec_t, jabberd_router_t; ') - allow $1 jabberd_t:process { ptrace signal_perms }; + allow $1 jabberd_t:process signal_perms; ps_process_pattern($1, jabberd_t) + tunable_policy(`deny_ptrace',`',` + allow $1 jabberd_t:process ptrace; + allow $1 jabberd_router_t:process ptrace; + ') + + allow $1 jabberd_router_t:process signal_perms; + ps_process_pattern($1, jabberd_router_t) init_labeled_script_domtrans($1, jabberd_initrc_exec_t) domain_system_change_exemption($1) role_transition $2 jabberd_initrc_exec_t system_r; allow $2 system_r; - logging_list_logs($1) - admin_pattern($1, jabberd_log_t) - files_list_var_lib($1) admin_pattern($1, jabberd_var_lib_t) - - files_list_pids($1) - admin_pattern($1, jabberd_var_run_t) ') diff --git a/jabber.te b/jabber.te index 53e53ca..919967b 100644 --- a/jabber.te +++ b/jabber.te @@ -1,94 +1,148 @@ -policy_module(jabber, 1.9.0) +policy_module(jabber, 1.8.0) ######################################## # # Declarations # -type jabberd_t; -type jabberd_exec_t; -init_daemon_domain(jabberd_t, jabberd_exec_t) +attribute jabberd_domain; + +jabber_domain_template(jabberd) +jabber_domain_template(jabberd_router) +jabber_domain_template(pyicqt) type jabberd_initrc_exec_t; init_script_file(jabberd_initrc_exec_t) -type jabberd_log_t; -logging_log_file(jabberd_log_t) - +# type which includes log/pid files pro jabberd components type jabberd_var_lib_t; files_type(jabberd_var_lib_t) -type jabberd_var_run_t; -files_pid_file(jabberd_var_run_t) +# pyicq-t types +type pyicqt_log_t; +logging_log_file(pyicqt_log_t); -######################################## +type pyicqt_var_spool_t; +files_spool_file(pyicqt_var_spool_t) + +type pyicqt_var_run_t; +files_pid_file(pyicqt_var_run_t) + +###################################### # -# Local policy +# Local policy for jabberd-router and c2s components # -allow jabberd_t self:capability dac_override; -dontaudit jabberd_t self:capability sys_tty_config; -allow jabberd_t self:process signal_perms; -allow jabberd_t self:fifo_file read_fifo_file_perms; -allow jabberd_t self:tcp_socket create_stream_socket_perms; -allow jabberd_t self:udp_socket create_socket_perms; +allow jabberd_router_t self:netlink_route_socket r_netlink_socket_perms; -manage_files_pattern(jabberd_t, jabberd_var_lib_t, jabberd_var_lib_t) -files_var_lib_filetrans(jabberd_t, jabberd_var_lib_t, file) - -manage_files_pattern(jabberd_t, jabberd_log_t, jabberd_log_t) -logging_log_filetrans(jabberd_t, jabberd_log_t, { file dir }) - -manage_files_pattern(jabberd_t, jabberd_var_run_t, jabberd_var_run_t) -files_pid_filetrans(jabberd_t, jabberd_var_run_t, file) - -kernel_read_kernel_sysctls(jabberd_t) -kernel_list_proc(jabberd_t) -kernel_read_proc_symlinks(jabberd_t) - -corenet_all_recvfrom_unlabeled(jabberd_t) -corenet_all_recvfrom_netlabel(jabberd_t) -corenet_tcp_sendrecv_generic_if(jabberd_t) -corenet_udp_sendrecv_generic_if(jabberd_t) -corenet_tcp_sendrecv_generic_node(jabberd_t) -corenet_udp_sendrecv_generic_node(jabberd_t) -corenet_tcp_sendrecv_all_ports(jabberd_t) -corenet_udp_sendrecv_all_ports(jabberd_t) -corenet_tcp_bind_generic_node(jabberd_t) -corenet_tcp_bind_jabber_client_port(jabberd_t) -corenet_tcp_bind_jabber_interserver_port(jabberd_t) -corenet_sendrecv_jabber_client_server_packets(jabberd_t) -corenet_sendrecv_jabber_interserver_server_packets(jabberd_t) +manage_files_pattern(jabberd_router_t, jabberd_var_lib_t, jabberd_var_lib_t) +manage_dirs_pattern(jabberd_router_t, jabberd_var_lib_t, jabberd_var_lib_t) -dev_read_sysfs(jabberd_t) -# For SSL -dev_read_rand(jabberd_t) +kernel_read_network_state(jabberd_router_t) -domain_use_interactive_fds(jabberd_t) +corenet_tcp_bind_jabber_client_port(jabberd_router_t) +corenet_tcp_bind_jabber_router_port(jabberd_router_t) +corenet_tcp_connect_jabber_router_port(jabberd_router_t) +corenet_sendrecv_jabber_router_server_packets(jabberd_router_t) +corenet_sendrecv_jabber_client_server_packets(jabberd_router_t) -files_read_etc_files(jabberd_t) -files_read_etc_runtime_files(jabberd_t) +fs_getattr_all_fs(jabberd_router_t) -fs_getattr_all_fs(jabberd_t) -fs_search_auto_mountpoints(jabberd_t) +miscfiles_read_generic_certs(jabberd_router_t) -logging_send_syslog_msg(jabberd_t) +optional_policy(` + kerberos_use(jabberd_router_t) +') -miscfiles_read_localization(jabberd_t) +optional_policy(` + nis_use_ypbind(jabberd_router_t) +') -sysnet_read_config(jabberd_t) +##################################### +# +# Local policy for other jabberd components +# + +manage_files_pattern(jabberd_t, jabberd_var_lib_t, jabberd_var_lib_t) +manage_dirs_pattern(jabberd_t, jabberd_var_lib_t, jabberd_var_lib_t) + +corenet_tcp_bind_jabber_interserver_port(jabberd_t) +corenet_tcp_connect_jabber_router_port(jabberd_t) userdom_dontaudit_use_unpriv_user_fds(jabberd_t) userdom_dontaudit_search_user_home_dirs(jabberd_t) optional_policy(` - nis_use_ypbind(jabberd_t) + seutil_sigchld_newrole(jabberd_t) ') optional_policy(` - seutil_sigchld_newrole(jabberd_t) + udev_read_db(jabberd_t) ') +###################################### +# +# Local policy for pyicq-t +# + +# need for /var/log/pyicq-t.log +manage_files_pattern(pyicqt_t, pyicqt_log_t, pyicqt_log_t) +logging_log_filetrans(pyicqt_t, pyicqt_log_t, file) + +manage_files_pattern(pyicqt_t, pyicqt_var_run_t, pyicqt_var_run_t); + +files_search_spool(pyicqt_t) +manage_files_pattern(pyicqt_t, pyicqt_var_spool_t, pyicqt_var_spool_t); + +corenet_tcp_bind_jabber_router_port(pyicqt_t) +corenet_tcp_connect_jabber_router_port(pyicqt_t) + +corecmd_exec_bin(pyicqt_t) + +dev_read_urand(pyicqt_t); + +files_read_usr_files(pyicqt_t) + +auth_use_nsswitch(pyicqt_t); + +# for RHEL5 +libs_use_ld_so(pyicqt_t) +libs_use_shared_libs(pyicqt_t) + +# needed for pyicq-t-mysql optional_policy(` - udev_read_db(jabberd_t) + corenet_tcp_connect_mysqld_port(pyicqt_t) +') + +optional_policy(` + sysnet_use_ldap(pyicqt_t) ') + +####################################### +# +# Local policy for jabberd domains +# + +allow jabberd_domain self:process signal_perms; +allow jabberd_domain self:fifo_file rw_fifo_file_perms; +allow jabberd_domain self:tcp_socket create_stream_socket_perms; +allow jabberd_domain self:udp_socket create_socket_perms; + +kernel_read_system_state(jabberd_domain) + +corenet_tcp_sendrecv_generic_if(jabberd_domain) +corenet_udp_sendrecv_generic_if(jabberd_domain) +corenet_tcp_sendrecv_generic_node(jabberd_domain) +corenet_udp_sendrecv_generic_node(jabberd_domain) +corenet_tcp_sendrecv_all_ports(jabberd_domain) +corenet_udp_sendrecv_all_ports(jabberd_domain) +corenet_tcp_bind_generic_node(jabberd_domain) + +dev_read_urand(jabberd_domain) +dev_read_urand(jabberd_domain) +dev_read_sysfs(jabberd_domain) + +files_read_etc_files(jabberd_domain) +files_read_etc_runtime_files(jabberd_domain) + +sysnet_read_config(jabberd_domain) diff --git a/java.fc b/java.fc index bc1a419..f630930 100644 --- a/java.fc +++ b/java.fc @@ -28,8 +28,6 @@ /usr/lib/opera(/.*)?/opera -- gen_context(system_u:object_r:java_exec_t,s0) /usr/lib/opera(/.*)?/works -- gen_context(system_u:object_r:java_exec_t,s0) -/usr/local/matlab.*/bin.*/MATLAB.* -- gen_context(system_u:object_r:java_exec_t,s0) - /usr/matlab.*/bin.*/MATLAB.* -- gen_context(system_u:object_r:java_exec_t,s0) ifdef(`distro_redhat',` diff --git a/java.te b/java.te index ff52c16..bdb4610 100644 --- a/java.te +++ b/java.te @@ -10,7 +10,7 @@ policy_module(java, 2.6.0) ## Allow java executable stack ##

## -gen_tunable(allow_java_execstack, false) +gen_tunable(java_execstack, false) type java_t; type java_exec_t; @@ -62,7 +62,6 @@ kernel_read_system_state(java_t) # Search bin directory under java for java executable corecmd_search_bin(java_t) -corenet_all_recvfrom_unlabeled(java_t) corenet_all_recvfrom_netlabel(java_t) corenet_tcp_sendrecv_generic_if(java_t) corenet_udp_sendrecv_generic_if(java_t) @@ -91,7 +90,6 @@ fs_dontaudit_rw_tmpfs_files(java_t) logging_send_syslog_msg(java_t) -miscfiles_read_localization(java_t) # Read global fonts and font config miscfiles_read_fonts(java_t) @@ -108,7 +106,7 @@ userdom_manage_user_home_content_sockets(java_t) userdom_user_home_dir_filetrans_user_home_content(java_t, { file lnk_file sock_file fifo_file }) userdom_write_user_tmp_sockets(java_t) -tunable_policy(`allow_java_execstack',` +tunable_policy(`java_execstack',` allow java_t self:process execstack; allow java_t java_tmp_t:file execute; diff --git a/jetty.fc b/jetty.fc new file mode 100644 index 0000000..1725b7e --- /dev/null +++ b/jetty.fc @@ -0,0 +1,9 @@ + +/var/cache/jetty(/.*)? gen_context(system_u:object_r:jetty_cache_t,s0) + +/var/lib/jetty(/.*)? gen_context(system_u:object_r:jetty_var_lib_t,s0) + +/var/log/jetty(/.*)? gen_context(system_u:object_r:jetty_log_t,s0) + +/var/run/jetty(/.*)? gen_context(system_u:object_r:jetty_var_run_t,s0) + diff --git a/jetty.if b/jetty.if new file mode 100644 index 0000000..2abc285 --- /dev/null +++ b/jetty.if @@ -0,0 +1,268 @@ + +## policy for jetty + +######################################## +## +## Search jetty cache directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`jetty_search_cache',` + gen_require(` + type jetty_cache_t; + ') + + allow $1 jetty_cache_t:dir search_dir_perms; + files_search_var($1) +') + +######################################## +## +## Read jetty cache files. +## +## +## +## Domain allowed access. +## +## +# +interface(`jetty_read_cache_files',` + gen_require(` + type jetty_cache_t; + ') + + files_search_var($1) + read_files_pattern($1, jetty_cache_t, jetty_cache_t) +') + +######################################## +## +## Create, read, write, and delete +## jetty cache files. +## +## +## +## Domain allowed access. +## +## +# +interface(`jetty_manage_cache_files',` + gen_require(` + type jetty_cache_t; + ') + + files_search_var($1) + manage_files_pattern($1, jetty_cache_t, jetty_cache_t) +') + +######################################## +## +## Manage jetty cache dirs. +## +## +## +## Domain allowed access. +## +## +# +interface(`jetty_manage_cache_dirs',` + gen_require(` + type jetty_cache_t; + ') + + files_search_var($1) + manage_dirs_pattern($1, jetty_cache_t, jetty_cache_t) +') + +######################################## +## +## Read jetty's log files. +## +## +## +## Domain allowed access. +## +## +## +# +interface(`jetty_read_log',` + gen_require(` + type jetty_log_t; + ') + + logging_search_logs($1) + read_files_pattern($1, jetty_log_t, jetty_log_t) +') + +######################################## +## +## Append to jetty log files. +## +## +## +## Domain allowed access. +## +## +# +interface(`jetty_append_log',` + gen_require(` + type jetty_log_t; + ') + + logging_search_logs($1) + append_files_pattern($1, jetty_log_t, jetty_log_t) +') + +######################################## +## +## Manage jetty log files +## +## +## +## Domain allowed access. +## +## +# +interface(`jetty_manage_log',` + gen_require(` + type jetty_log_t; + ') + + logging_search_logs($1) + manage_dirs_pattern($1, jetty_log_t, jetty_log_t) + manage_files_pattern($1, jetty_log_t, jetty_log_t) + manage_lnk_files_pattern($1, jetty_log_t, jetty_log_t) +') + +######################################## +## +## Search jetty lib directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`jetty_search_lib',` + gen_require(` + type jetty_var_lib_t; + ') + + allow $1 jetty_var_lib_t:dir search_dir_perms; + files_search_var_lib($1) +') + +######################################## +## +## Read jetty lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`jetty_read_lib_files',` + gen_require(` + type jetty_var_lib_t; + ') + + files_search_var_lib($1) + read_files_pattern($1, jetty_var_lib_t, jetty_var_lib_t) +') + +######################################## +## +## Manage jetty lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`jetty_manage_lib_files',` + gen_require(` + type jetty_var_lib_t; + ') + + files_search_var_lib($1) + manage_files_pattern($1, jetty_var_lib_t, jetty_var_lib_t) +') + +######################################## +## +## Manage jetty lib directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`jetty_manage_lib_dirs',` + gen_require(` + type jetty_var_lib_t; + ') + + files_search_var_lib($1) + manage_dirs_pattern($1, jetty_var_lib_t, jetty_var_lib_t) +') + +######################################## +## +## Read jetty PID files. +## +## +## +## Domain allowed access. +## +## +# +interface(`jetty_read_pid_files',` + gen_require(` + type jetty_var_run_t; + ') + + files_search_pids($1) + allow $1 jetty_var_run_t:file read_file_perms; +') + + +######################################## +## +## All of the rules required to administrate +## an jetty environment +## +## +## +## Domain allowed access. +## +## +## +# +interface(`jetty_admin',` + gen_require(` + type jetty_cache_t; + type jetty_log_t; + type jetty_var_lib_t; + type jetty_var_run_t; + ') + + files_search_var($1) + admin_pattern($1, jetty_cache_t) + + logging_search_logs($1) + admin_pattern($1, jetty_log_t) + + files_search_var_lib($1) + admin_pattern($1, jetty_var_lib_t) + + files_search_pids($1) + admin_pattern($1, jetty_var_run_t) +') diff --git a/jetty.te b/jetty.te new file mode 100644 index 0000000..af510ea --- /dev/null +++ b/jetty.te @@ -0,0 +1,25 @@ +policy_module(jetty, 1.0.0) + +######################################## +# +# Declarations +# + +type jetty_cache_t; +files_type(jetty_cache_t) + +type jetty_log_t; +logging_log_file(jetty_log_t) + +type jetty_var_lib_t; +files_type(jetty_var_lib_t) + +type jetty_var_run_t; +files_pid_file(jetty_var_run_t) + +######################################## +# +# jetty local policy +# + +# No local policy. This module just contains type definitions diff --git a/jockey.fc b/jockey.fc new file mode 100644 index 0000000..a59ad8d --- /dev/null +++ b/jockey.fc @@ -0,0 +1,6 @@ +/usr/share/jockey/jockey-backend -- gen_context(system_u:object_r:jockey_exec_t,s0) + +/var/cache/jockey(/.*)? gen_context(system_u:object_r:jockey_cache_t,s0) + +/var/log/jockey(/.*)? gen_context(system_u:object_r:jockey_var_log_t,s0) +/var/log/jockey\.log.* -- gen_context(system_u:object_r:jockey_var_log_t,s0) diff --git a/jockey.if b/jockey.if new file mode 100644 index 0000000..868c7d0 --- /dev/null +++ b/jockey.if @@ -0,0 +1,126 @@ + +## policy for jockey + +######################################## +## +## Transition to jockey. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`jockey_domtrans',` + gen_require(` + type jockey_t, jockey_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, jockey_exec_t, jockey_t) +') + +######################################## +## +## Search jockey cache directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`jockey_search_cache',` + gen_require(` + type jockey_cache_t; + ') + + allow $1 jockey_cache_t:dir search_dir_perms; + files_search_var($1) +') + +######################################## +## +## Read jockey cache files. +## +## +## +## Domain allowed access. +## +## +# +interface(`jockey_read_cache_files',` + gen_require(` + type jockey_cache_t; + ') + + files_search_var($1) + read_files_pattern($1, jockey_cache_t, jockey_cache_t) +') + +######################################## +## +## Create, read, write, and delete +## jockey cache files. +## +## +## +## Domain allowed access. +## +## +# +interface(`jockey_manage_cache_files',` + gen_require(` + type jockey_cache_t; + ') + + files_search_var($1) + manage_files_pattern($1, jockey_cache_t, jockey_cache_t) +') + +######################################## +## +## Manage jockey cache dirs. +## +## +## +## Domain allowed access. +## +## +# +interface(`jockey_manage_cache_dirs',` + gen_require(` + type jockey_cache_t; + ') + + files_search_var($1) + manage_dirs_pattern($1, jockey_cache_t, jockey_cache_t) +') + +######################################## +## +## All of the rules required to administrate +## an jockey environment +## +## +## +## Domain allowed access. +## +## +# +interface(`jockey_admin',` + gen_require(` + type jockey_t; + type jockey_cache_t; + ') + + allow $1 jockey_t:process { ptrace signal_perms }; + ps_process_pattern($1, jockey_t) + + files_search_var($1) + admin_pattern($1, jockey_cache_t) + optional_policy(` + systemd_passwd_agent_exec($1) + systemd_read_fifo_file_passwd_run($1) + ') +') diff --git a/jockey.te b/jockey.te new file mode 100644 index 0000000..5ca0ec0 --- /dev/null +++ b/jockey.te @@ -0,0 +1,55 @@ +policy_module(jockey, 1.0.0) + +######################################## +# +# Declarations +# + +type jockey_t; +type jockey_exec_t; +init_daemon_domain(jockey_t, jockey_exec_t) + +type jockey_cache_t; +files_type(jockey_cache_t) + +type jockey_var_log_t; +logging_log_file(jockey_var_log_t) + +######################################## +# +# jockey local policy +# +allow jockey_t self:fifo_file rw_fifo_file_perms; + +manage_dirs_pattern(jockey_t, jockey_cache_t, jockey_cache_t) +manage_files_pattern(jockey_t, jockey_cache_t, jockey_cache_t) +manage_lnk_files_pattern(jockey_t, jockey_cache_t, jockey_cache_t) +files_var_filetrans(jockey_t, jockey_cache_t, { dir file }) + +manage_files_pattern(jockey_t, jockey_var_log_t, jockey_var_log_t) +manage_dirs_pattern(jockey_t, jockey_var_log_t, jockey_var_log_t) +logging_log_filetrans(jockey_t, jockey_var_log_t, { file dir }) + +corecmd_exec_bin(jockey_t) +corecmd_exec_shell(jockey_t) + +dev_read_rand(jockey_t) +dev_read_urand(jockey_t) + +dev_read_sysfs(jockey_t) + +domain_use_interactive_fds(jockey_t) + +files_read_etc_files(jockey_t) +files_read_usr_files(jockey_t) + + +optional_policy(` + dbus_system_domain(jockey_t, jockey_exec_t) +') + +optional_policy(` + modutils_domtrans_insmod(jockey_t) + modutils_read_module_config(jockey_t) + modutils_list_module_config(jockey_t) +') diff --git a/kde.fc b/kde.fc new file mode 100644 index 0000000..25e4b68 --- /dev/null +++ b/kde.fc @@ -0,0 +1 @@ +#/usr/libexec/kde(3|4)/backlighthelper -- gen_context(system_u:object_r:kdebacklighthelper_exec_t,s0) diff --git a/kde.if b/kde.if new file mode 100644 index 0000000..cf65577 --- /dev/null +++ b/kde.if @@ -0,0 +1,22 @@ +## Policy for KDE components + +####################################### +## +## Send and receive messages from +## firewallgui over dbus. +## +## +## +## Domain allowed access. +## +## +# +interface(`kde_dbus_chat_backlighthelper',` + gen_require(` + type kdebacklighthelper_t; + class dbus send_msg; + ') + + allow $1 kdebacklighthelper_t:dbus send_msg; + allow kdebacklighthelper_t $1:dbus send_msg; +') diff --git a/kde.te b/kde.te new file mode 100644 index 0000000..7b4b5ff --- /dev/null +++ b/kde.te @@ -0,0 +1,42 @@ +policy_module(kde,1.0.0) + +######################################## +# +# Declarations +# + +type kdebacklighthelper_t; +type kdebacklighthelper_exec_t; +init_daemon_domain(kdebacklighthelper_t, kdebacklighthelper_exec_t) + +######################################## +# +# backlighthelper local policy +# +allow kdebacklighthelper_t self:fifo_file rw_fifo_file_perms; + +kernel_read_system_state(kdebacklighthelper_t) + +# r/w brightness values +dev_rw_sysfs(kdebacklighthelper_t) + +files_read_etc_files(kdebacklighthelper_t) +files_read_etc_runtime_files(kdebacklighthelper_t) +files_read_usr_files(kdebacklighthelper_t) + +fs_getattr_all_fs(kdebacklighthelper_t) + +logging_send_syslog_msg(kdebacklighthelper_t) + +optional_policy(` + dbus_system_domain(kdebacklighthelper_t, kdebacklighthelper_exec_t) +') + +optional_policy(` + consolekit_dbus_chat(kdebacklighthelper_t) +') + +optional_policy(` + policykit_dbus_chat(kdebacklighthelper_t) +') + diff --git a/kdump.fc b/kdump.fc index c66934f..dd91210 100644 --- a/kdump.fc +++ b/kdump.fc @@ -3,3 +3,11 @@ /sbin/kdump -- gen_context(system_u:object_r:kdump_exec_t,s0) /sbin/kexec -- gen_context(system_u:object_r:kdump_exec_t,s0) + + +/usr/lib/systemd/system/kdump\.service -- gen_context(system_u:object_r:kdumpctl_unit_file_t,s0) + +/usr/bin/kdumpctl -- gen_context(system_u:object_r:kdumpctl_exec_t,s0) +/usr/sbin/kdump -- gen_context(system_u:object_r:kdump_exec_t,s0) +/usr/sbin/kexec -- gen_context(system_u:object_r:kdump_exec_t,s0) + diff --git a/kdump.if b/kdump.if index 4198ff5..d1ab262 100644 --- a/kdump.if +++ b/kdump.if @@ -37,6 +37,30 @@ interface(`kdump_initrc_domtrans',` init_labeled_script_domtrans($1, kdump_initrc_exec_t) ') +######################################## +## +## Execute kdump server in the kdump domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`kdump_systemctl',` + gen_require(` + type kdump_unit_file_t; + type kdump_t; + ') + + systemd_exec_systemctl($1) + systemd_search_unit_dirs($1) + allow $1 kdump_unit_file_t:file read_file_perms; + allow $1 kdump_unit_file_t:service all_service_perms; + + ps_process_pattern($1, kdump_t) +') + ##################################### ## ## Read kdump configuration file. @@ -56,6 +80,24 @@ interface(`kdump_read_config',` allow $1 kdump_etc_t:file read_file_perms; ') +##################################### +## +## Dontaudit read kdump configuration file. +## +## +## +## Domain to not audit. +## +## +# +interface(`kdump_dontaudit_read_config',` + gen_require(` + type kdump_etc_t; + ') + + dontaudit $1 kdump_etc_t:file read_inherited_file_perms; +') + #################################### ## ## Manage kdump configuration file. @@ -75,6 +117,27 @@ interface(`kdump_manage_config',` allow $1 kdump_etc_t:file manage_file_perms; ') +################################### +## +## Manage kdump /var/tmp files. +## +## +## +## Domain allowed access. +## +## +# +interface(`kdump_manage_kdumpctl_tmp_files',` + gen_require(` + type kdumpctl_tmp_t; + ') + + files_search_tmp($1) + manage_files_pattern($1, kdumpctl_tmp_t, kdumpctl_tmp_t) + manage_dirs_pattern($1, kdumpctl_tmp_t, kdumpctl_tmp_t) + manage_lnk_files_pattern($1, kdumpctl_tmp_t, kdumpctl_tmp_t) +') + ###################################### ## ## All of the rules required to administrate @@ -96,10 +159,14 @@ interface(`kdump_admin',` gen_require(` type kdump_t, kdump_etc_t; type kdump_initrc_exec_t; + type kdump_unit_file_t; ') - allow $1 kdump_t:process { ptrace signal_perms }; + allow $1 kdump_t:process signal_perms; ps_process_pattern($1, kdump_t) + tunable_policy(`deny_ptrace',`',` + allow $1 kdump_t:process ptrace; + ') init_labeled_script_domtrans($1, kdump_initrc_exec_t) domain_system_change_exemption($1) @@ -108,4 +175,8 @@ interface(`kdump_admin',` files_search_etc($1) admin_pattern($1, kdump_etc_t) + + kdump_systemctl($1) + admin_pattern($1, kdump_unit_file_t) + allow $1 kdump_unit_file_t:service all_service_perms; ') diff --git a/kdump.te b/kdump.te index b29d8e2..766151a 100644 --- a/kdump.te +++ b/kdump.te @@ -15,6 +15,20 @@ files_config_file(kdump_etc_t) type kdump_initrc_exec_t; init_script_file(kdump_initrc_exec_t) +type kdump_unit_file_t; +systemd_unit_file(kdump_unit_file_t) + +type kdumpctl_t; +type kdumpctl_exec_t; +init_daemon_domain(kdumpctl_t, kdumpctl_exec_t) +init_initrc_domain(kdumpctl_t) + +type kdumpctl_unit_file_t; +systemd_unit_file(kdumpctl_unit_file_t) + +type kdumpctl_tmp_t; +files_tmp_file(kdumpctl_tmp_t) + ##################################### # # kdump local policy @@ -24,6 +38,7 @@ allow kdump_t self:capability { sys_boot dac_override }; read_files_pattern(kdump_t, kdump_etc_t, kdump_etc_t) +files_read_etc_files(kdump_t) files_read_etc_runtime_files(kdump_t) files_read_kernel_img(kdump_t) @@ -36,3 +51,82 @@ dev_read_framebuffer(kdump_t) dev_read_sysfs(kdump_t) term_use_console(kdump_t) + +####################################### +# +# kdumpctl local policy +# + +#cjp:almost all rules are needed by dracut + +kdump_domtrans(kdumpctl_t) + +allow kdumpctl_t self:capability dac_override; +allow kdumpctl_t self:process setfscreate; + +allow kdumpctl_t self:fifo_file rw_fifo_file_perms; +allow kdumpctl_t self:unix_stream_socket create_stream_socket_perms; + +manage_dirs_pattern(kdumpctl_t, kdumpctl_tmp_t, kdumpctl_tmp_t) +manage_files_pattern(kdumpctl_t, kdumpctl_tmp_t, kdumpctl_tmp_t) +manage_lnk_files_pattern(kdumpctl_t, kdumpctl_tmp_t, kdumpctl_tmp_t) +files_tmp_filetrans(kdumpctl_t, kdumpctl_tmp_t, { file dir lnk_file }) + +read_files_pattern(kdumpctl_t, kdump_etc_t, kdump_etc_t) + +kernel_read_system_state(kdumpctl_t) + +corecmd_exec_bin(kdumpctl_t) +corecmd_exec_shell(kdumpctl_t) + +dev_read_sysfs(kdumpctl_t) +# dracut +dev_manage_all_dev_nodes(kdumpctl_t) + +domain_use_interactive_fds(kdumpctl_t) + +files_create_kernel_img(kdumpctl_t) +files_read_etc_files(kdumpctl_t) +files_read_etc_runtime_files(kdumpctl_t) +files_read_usr_files(kdumpctl_t) +files_read_kernel_modules(kdumpctl_t) +files_getattr_all_dirs(kdumpctl_t) + +fs_getattr_all_fs(kdumpctl_t) + +application_executable_ioctl(kdumpctl_t) + +auth_read_passwd(kdumpctl_t) + +init_exec(kdumpctl_t) +systemd_exec_systemctl(kdumpctl_t) + +libs_exec_ld_so(kdumpctl_t) + +logging_send_syslog_msg(kdumpctl_t) + +optional_policy(` + gpg_exec(kdumpctl_t) +') + +optional_policy(` + lvm_read_config(kdumpctl_t) +') + +optional_policy(` + modutils_domtrans_insmod(kdumpctl_t) + modutils_list_module_config(kdumpctl_t) + modutils_read_module_config(kdumpctl_t) +') + +optional_policy(` + plymouthd_domtrans_plymouth(kdumpctl_t) +') + +optional_policy(` + ssh_exec(kdumpctl_t) +') + +optional_policy(` + unconfined_domain(kdumpctl_t) +') diff --git a/kdumpgui.te b/kdumpgui.te index 0c52f60..2b8ea1e 100644 --- a/kdumpgui.te +++ b/kdumpgui.te @@ -7,7 +7,10 @@ policy_module(kdumpgui, 1.1.0) type kdumpgui_t; type kdumpgui_exec_t; -dbus_system_domain(kdumpgui_t, kdumpgui_exec_t) +init_daemon_domain(kdumpgui_t, kdumpgui_exec_t) + +type kdumpgui_tmp_t; +files_tmp_file(kdumpgui_tmp_t) ###################################### # @@ -18,6 +21,10 @@ allow kdumpgui_t self:capability { net_admin sys_admin sys_rawio }; allow kdumpgui_t self:fifo_file rw_fifo_file_perms; allow kdumpgui_t self:netlink_kobject_uevent_socket create_socket_perms; +manage_dirs_pattern(kdumpgui_t, kdumpgui_tmp_t, kdumpgui_tmp_t) +manage_files_pattern(kdumpgui_t, kdumpgui_tmp_t, kdumpgui_tmp_t) +files_tmp_filetrans(kdumpgui_t, kdumpgui_tmp_t, { dir file }) + kernel_read_system_state(kdumpgui_t) kernel_read_network_state(kdumpgui_t) @@ -36,6 +43,8 @@ files_manage_etc_runtime_files(kdumpgui_t) files_etc_filetrans_etc_runtime(kdumpgui_t, file) files_read_usr_files(kdumpgui_t) +fs_read_dos_files(kdumpgui_t) + storage_raw_read_fixed_disk(kdumpgui_t) storage_raw_write_fixed_disk(kdumpgui_t) @@ -43,21 +52,36 @@ auth_use_nsswitch(kdumpgui_t) logging_send_syslog_msg(kdumpgui_t) -miscfiles_read_localization(kdumpgui_t) +mount_exec(kdumpgui_t) init_dontaudit_read_all_script_files(kdumpgui_t) +userdom_dontaudit_search_admin_dir(kdumpgui_t) + +optional_policy(` + bootloader_exec(kdumpgui_t) +') + optional_policy(` consoletype_exec(kdumpgui_t) ') optional_policy(` + consoletype_exec(kdumpgui_t) +') + +optional_policy(` + dbus_system_domain(kdumpgui_t, kdumpgui_exec_t) +') + +optional_policy(` dev_rw_lvm_control(kdumpgui_t) ') optional_policy(` kdump_manage_config(kdumpgui_t) kdump_initrc_domtrans(kdumpgui_t) + kdump_systemctl(kdumpgui_t) ') optional_policy(` diff --git a/kerberos.fc b/kerberos.fc index 3525d24..f370f94 100644 --- a/kerberos.fc +++ b/kerberos.fc @@ -13,13 +13,13 @@ HOME_DIR/\.k5login -- gen_context(system_u:object_r:krb5_home_t,s0) /etc/rc\.d/init\.d/krb524d -- gen_context(system_u:object_r:kerberos_initrc_exec_t,s0) /etc/rc\.d/init\.d/krb5kdc -- gen_context(system_u:object_r:kerberos_initrc_exec_t,s0) -/usr/(local/)?(kerberos/)?sbin/krb5kdc -- gen_context(system_u:object_r:krb5kdc_exec_t,s0) -/usr/(local/)?(kerberos/)?sbin/kadmind -- gen_context(system_u:object_r:kadmind_exec_t,s0) +/usr/(kerberos/)?sbin/krb5kdc -- gen_context(system_u:object_r:krb5kdc_exec_t,s0) +/usr/(kerberos/)?sbin/kadmind -- gen_context(system_u:object_r:kadmind_exec_t,s0) /usr/kerberos/sbin/kadmin\.local -- gen_context(system_u:object_r:kadmind_exec_t,s0) /usr/kerberos/sbin/kpropd -- gen_context(system_u:object_r:kpropd_exec_t,s0) -/usr/local/var/krb5kdc(/.*)? gen_context(system_u:object_r:krb5kdc_conf_t,s0) -/usr/local/var/krb5kdc/principal.* gen_context(system_u:object_r:krb5kdc_principal_t,s0) +/usr/var/krb5kdc(/.*)? gen_context(system_u:object_r:krb5kdc_conf_t,s0) +/usr/var/krb5kdc/principal.* gen_context(system_u:object_r:krb5kdc_principal_t,s0) /var/kerberos/krb5kdc(/.*)? gen_context(system_u:object_r:krb5kdc_conf_t,s0) /var/kerberos/krb5kdc/from_master.* gen_context(system_u:object_r:krb5kdc_lock_t,s0) @@ -27,7 +27,16 @@ HOME_DIR/\.k5login -- gen_context(system_u:object_r:krb5_home_t,s0) /var/kerberos/krb5kdc/principal.* gen_context(system_u:object_r:krb5kdc_principal_t,s0) /var/kerberos/krb5kdc/principal.*\.ok gen_context(system_u:object_r:krb5kdc_lock_t,s0) -/var/log/krb5kdc\.log gen_context(system_u:object_r:krb5kdc_log_t,s0) -/var/log/kadmin(d)?\.log gen_context(system_u:object_r:kadmind_log_t,s0) +/var/log/krb5kdc\.log.* gen_context(system_u:object_r:krb5kdc_log_t,s0) +/var/log/kadmin(d)?\.log.* gen_context(system_u:object_r:kadmind_log_t,s0) + +/var/cache/krb5rcache(/.*)? gen_context(system_u:object_r:krb5_host_rcache_t,s0) /var/tmp/host_0 -- gen_context(system_u:object_r:krb5_host_rcache_t,s0) +/var/tmp/HTTP_23 -- gen_context(system_u:object_r:krb5_host_rcache_t,s0) +/var/tmp/HTTP_48 -- gen_context(system_u:object_r:krb5_host_rcache_t,s0) +/var/tmp/imap_0 -- gen_context(system_u:object_r:krb5_host_rcache_t,s0) +/var/tmp/nfs_0 -- gen_context(system_u:object_r:krb5_host_rcache_t,s0) +/var/tmp/ldapmap1_0 -- gen_context(system_u:object_r:krb5_host_rcache_t,s0) +/var/tmp/ldap_487 -- gen_context(system_u:object_r:krb5_host_rcache_t,s0) +/var/tmp/ldap_55 -- gen_context(system_u:object_r:krb5_host_rcache_t,s0) diff --git a/kerberos.if b/kerberos.if index 604f67b..c9bcb42 100644 --- a/kerberos.if +++ b/kerberos.if @@ -84,12 +84,10 @@ interface(`kerberos_use',` selinux_dontaudit_validate_context($1) seutil_dontaudit_read_file_contexts($1) - tunable_policy(`allow_kerberos',` + tunable_policy(`kerberos_enabled',` allow $1 self:tcp_socket create_socket_perms; allow $1 self:udp_socket create_socket_perms; - corenet_all_recvfrom_unlabeled($1) - corenet_all_recvfrom_netlabel($1) corenet_tcp_sendrecv_generic_if($1) corenet_udp_sendrecv_generic_if($1) corenet_tcp_sendrecv_generic_node($1) @@ -103,11 +101,12 @@ interface(`kerberos_use',` corenet_sendrecv_kerberos_client_packets($1) corenet_sendrecv_ocsp_client_packets($1) - allow $1 krb5_host_rcache_t:file getattr; + allow $1 krb5_host_rcache_t:dir search_dir_perms; + allow $1 krb5_host_rcache_t:file getattr_file_perms; ') optional_policy(` - tunable_policy(`allow_kerberos',` + tunable_policy(`kerberos_enabled',` pcscd_stream_connect($1) ') ') @@ -218,6 +217,25 @@ interface(`kerberos_rw_keytab',` ######################################## ## +## Create keytab file in /etc +## +## +## +## Domain allowed access. +## +## +# +interface(`kerberos_etc_filetrans_keytab',` + gen_require(` + type krb5_keytab_t; + ') + + allow $1 krb5_keytab_t:file manage_file_perms; + files_etc_filetrans($1, krb5_keytab_t, file, $2) +') + +######################################## +## ## Create a derived type for kerberos keytab ## ## @@ -282,42 +300,21 @@ interface(`kerberos_manage_host_rcache',` # does not work in conditionals domain_obj_id_change_exemption($1) - tunable_policy(`allow_kerberos',` + tunable_policy(`kerberos_enabled',` allow $1 self:process setfscreate; selinux_validate_context($1) seutil_read_file_contexts($1) - allow $1 krb5_host_rcache_t:file manage_file_perms; + files_rw_generic_tmp_dir($1) + manage_files_pattern($1, krb5_host_rcache_t, krb5_host_rcache_t) files_search_tmp($1) ') ') ######################################## ## -## Connect to krb524 service -## -## -## -## Domain allowed access. -## -## -# -interface(`kerberos_connect_524',` - tunable_policy(`allow_kerberos',` - allow $1 self:udp_socket create_socket_perms; - - corenet_all_recvfrom_unlabeled($1) - corenet_udp_sendrecv_generic_if($1) - corenet_udp_sendrecv_generic_node($1) - corenet_udp_sendrecv_kerberos_master_port($1) - corenet_sendrecv_kerberos_master_client_packets($1) - ') -') - -######################################## -## ## All of the rules required to administrate ## an kerberos environment ## @@ -338,18 +335,22 @@ interface(`kerberos_admin',` type kadmind_t, krb5kdc_t, kerberos_initrc_exec_t; type kadmind_log_t, kadmind_tmp_t, kadmind_var_run_t; type krb5_conf_t, krb5_keytab_t, krb5kdc_conf_t; - type krb5kdc_principal_t, krb5kdc_tmp_t; + type krb5kdc_principal_t, krb5kdc_tmp_t, kpropd_t; type krb5kdc_var_run_t, krb5_host_rcache_t; - type kpropd_t; ') - allow $1 kadmind_t:process { ptrace signal_perms }; + allow $1 kadmind_t:process signal_perms; ps_process_pattern($1, kadmind_t) + tunable_policy(`deny_ptrace',`',` + allow $1 kadmind_t:process ptrace; + allow $1 krb5kdc_t:process ptrace; + allow $1 kpropd_t:process ptrace; + ') - allow $1 krb5kdc_t:process { ptrace signal_perms }; + allow $1 krb5kdc_t:process signal_perms; ps_process_pattern($1, krb5kdc_t) - allow $1 kpropd_t:process { ptrace signal_perms }; + allow $1 kpropd_t:process signal_perms; ps_process_pattern($1, kpropd_t) init_labeled_script_domtrans($1, kerberos_initrc_exec_t) @@ -378,3 +379,115 @@ interface(`kerberos_admin',` admin_pattern($1, krb5kdc_var_run_t) ') + +######################################## +## +## Type transition files created in /tmp +## to the krb5_host_rcache type. +## +## +## +## Domain allowed access. +## +## +# +interface(`kerberos_tmp_filetrans_host_rcache',` + gen_require(` + type krb5_host_rcache_t; + ') + + manage_files_pattern($1, krb5_host_rcache_t, krb5_host_rcache_t) + files_tmp_filetrans($1, krb5_host_rcache_t, file, $2) +') + +######################################## +## +## read kerberos homedir content (.k5login) +## +## +## +## Domain allowed access. +## +## +# +interface(`kerberos_read_home_content',` + gen_require(` + type krb5_home_t; + ') + + userdom_search_user_home_dirs($1) + read_files_pattern($1, krb5_home_t, krb5_home_t) +') + +######################################## +## +## create kerberos content in the in the /root directory +## with an correct label. +## +## +## +## Domain allowed access. +## +## +# +interface(`kerberos_filetrans_admin_home_content',` + gen_require(` + type krb5_home_t; + ') + + userdom_admin_home_dir_filetrans($1, krb5_home_t, file, ".k5login") +') + +######################################## +## +## Transition to kerberos named content +## +## +## +## Domain allowed access. +## +## +# +interface(`kerberos_filetrans_home_content',` + gen_require(` + type krb5_home_t; + ') + + userdom_user_home_dir_filetrans($1, krb5_home_t, file, ".k5login") +') + +######################################## +## +## Transition to kerberos named content +## +## +## +## Domain allowed access. +## +## +# +interface(`kerberos_filetrans_named_content',` + gen_require(` + type krb5_conf_t, krb5_keytab_t, krb5kdc_conf_t; + type krb5kdc_principal_t; + ') + + files_etc_filetrans($1, krb5_conf_t, file, "krb5.conf") + filetrans_pattern($1, krb5kdc_conf_t, krb5_keytab_t, file, "kadm5.keytab") + filetrans_pattern($1, krb5kdc_conf_t, krb5kdc_principal_t, file, "principal") + filetrans_pattern($1, krb5kdc_conf_t, krb5kdc_principal_t, file, "principal0") + filetrans_pattern($1, krb5kdc_conf_t, krb5kdc_principal_t, file, "principal1") + #filetrans_pattern($1, krb5kdc_conf_t, krb5kdc_principal_t, file, "principal1") + + kerberos_etc_filetrans_keytab($1, "krb5.keytab") + kerberos_filetrans_admin_home_content($1) + + kerberos_tmp_filetrans_host_rcache($1, "host_0") + kerberos_tmp_filetrans_host_rcache($1, "HTTP_23") + kerberos_tmp_filetrans_host_rcache($1, "HTTP_48") + kerberos_tmp_filetrans_host_rcache($1, "imap_0") + kerberos_tmp_filetrans_host_rcache($1, "nfs_0") + kerberos_tmp_filetrans_host_rcache($1, "ldapmap1_0") + kerberos_tmp_filetrans_host_rcache($1, "ldap_487") + kerberos_tmp_filetrans_host_rcache($1, "ldap_55") +') diff --git a/kerberos.te b/kerberos.te index 6a95faf..29c848f 100644 --- a/kerberos.te +++ b/kerberos.te @@ -10,7 +10,7 @@ policy_module(kerberos, 1.11.0) ## Allow confined applications to run with kerberos. ##

## -gen_tunable(allow_kerberos, false) +gen_tunable(kerberos_enabled, false) type kadmind_t; type kadmind_exec_t; @@ -35,12 +35,12 @@ init_daemon_domain(kpropd_t, kpropd_exec_t) domain_obj_id_change_exemption(kpropd_t) type krb5_conf_t; -files_type(krb5_conf_t) +files_config_file(krb5_conf_t) type krb5_home_t; userdom_user_home_content(krb5_home_t) -type krb5_host_rcache_t; +type krb5_host_rcache_t alias saslauthd_tmp_t; files_tmp_file(krb5_host_rcache_t) # types for general configuration files in /etc @@ -49,10 +49,11 @@ files_security_file(krb5_keytab_t) # types for KDC configs and principal file(s) type krb5kdc_conf_t; -files_type(krb5kdc_conf_t) +files_config_file(krb5kdc_conf_t) type krb5kdc_lock_t; -files_type(krb5kdc_lock_t) +files_lock_file(krb5kdc_lock_t) + # types for KDC principal file(s) type krb5kdc_principal_t; @@ -80,7 +81,7 @@ files_pid_file(krb5kdc_var_run_t) # Use capabilities. Surplus capabilities may be allowed. allow kadmind_t self:capability { setuid setgid chown fowner dac_override sys_nice }; dontaudit kadmind_t self:capability sys_tty_config; -allow kadmind_t self:process { setfscreate signal_perms }; +allow kadmind_t self:process { setfscreate setsched getsched signal_perms }; allow kadmind_t self:netlink_route_socket r_netlink_socket_perms; allow kadmind_t self:unix_dgram_socket { connect create write }; allow kadmind_t self:tcp_socket connected_stream_socket_perms; @@ -93,9 +94,9 @@ allow kadmind_t krb5_conf_t:file read_file_perms; dontaudit kadmind_t krb5_conf_t:file write; read_files_pattern(kadmind_t, krb5kdc_conf_t, krb5kdc_conf_t) -dontaudit kadmind_t krb5kdc_conf_t:file { write setattr }; +dontaudit kadmind_t krb5kdc_conf_t:file { write_file_perms setattr_file_perms }; -allow kadmind_t krb5kdc_lock_t:file { rw_file_perms setattr }; +allow kadmind_t krb5kdc_lock_t:file { rw_file_perms setattr_file_perms }; allow kadmind_t krb5kdc_principal_t:file manage_file_perms; filetrans_pattern(kadmind_t, krb5kdc_conf_t, krb5kdc_principal_t, file) @@ -115,7 +116,6 @@ kernel_read_network_state(kadmind_t) kernel_read_proc_symlinks(kadmind_t) kernel_read_system_state(kadmind_t) -corenet_all_recvfrom_unlabeled(kadmind_t) corenet_all_recvfrom_netlabel(kadmind_t) corenet_tcp_sendrecv_generic_if(kadmind_t) corenet_udp_sendrecv_generic_if(kadmind_t) @@ -126,10 +126,13 @@ corenet_udp_sendrecv_all_ports(kadmind_t) corenet_tcp_bind_generic_node(kadmind_t) corenet_udp_bind_generic_node(kadmind_t) corenet_tcp_bind_kerberos_admin_port(kadmind_t) +corenet_tcp_bind_kerberos_password_port(kadmind_t) corenet_udp_bind_kerberos_admin_port(kadmind_t) +corenet_udp_bind_kerberos_password_port(kadmind_t) corenet_tcp_bind_reserved_port(kadmind_t) corenet_dontaudit_tcp_bind_all_reserved_ports(kadmind_t) corenet_sendrecv_kerberos_admin_server_packets(kadmind_t) +corenet_sendrecv_kerberos_password_server_packets(kadmind_t) dev_read_sysfs(kadmind_t) dev_read_rand(kadmind_t) @@ -149,7 +152,7 @@ selinux_validate_context(kadmind_t) logging_send_syslog_msg(kadmind_t) -miscfiles_read_localization(kadmind_t) +miscfiles_read_generic_certs(kadmind_t) seutil_read_file_contexts(kadmind_t) @@ -164,6 +167,10 @@ optional_policy(` ') optional_policy(` + dirsrv_stream_connect(kadmind_t) +') + +optional_policy(` nis_use_ypbind(kadmind_t) ') @@ -197,13 +204,12 @@ can_exec(krb5kdc_t, krb5kdc_exec_t) read_files_pattern(krb5kdc_t, krb5kdc_conf_t, krb5kdc_conf_t) dontaudit krb5kdc_t krb5kdc_conf_t:file write; -allow krb5kdc_t krb5kdc_lock_t:file { rw_file_perms setattr }; +allow krb5kdc_t krb5kdc_lock_t:file { rw_file_perms setattr_file_perms }; allow krb5kdc_t krb5kdc_log_t:file manage_file_perms; logging_log_filetrans(krb5kdc_t, krb5kdc_log_t, file) -allow krb5kdc_t krb5kdc_principal_t:file read_file_perms; -dontaudit krb5kdc_t krb5kdc_principal_t:file write; +allow krb5kdc_t krb5kdc_principal_t:file rw_file_perms; manage_dirs_pattern(krb5kdc_t, krb5kdc_tmp_t, krb5kdc_tmp_t) manage_files_pattern(krb5kdc_t, krb5kdc_tmp_t, krb5kdc_tmp_t) @@ -221,7 +227,6 @@ kernel_search_network_sysctl(krb5kdc_t) corecmd_exec_bin(krb5kdc_t) -corenet_all_recvfrom_unlabeled(krb5kdc_t) corenet_all_recvfrom_netlabel(krb5kdc_t) corenet_tcp_sendrecv_generic_if(krb5kdc_t) corenet_udp_sendrecv_generic_if(krb5kdc_t) @@ -253,7 +258,7 @@ selinux_validate_context(krb5kdc_t) logging_send_syslog_msg(krb5kdc_t) -miscfiles_read_localization(krb5kdc_t) +miscfiles_read_generic_certs(krb5kdc_t) seutil_read_file_contexts(krb5kdc_t) @@ -268,6 +273,10 @@ optional_policy(` ') optional_policy(` + dirsrv_stream_connect(krb5kdc_t) +') + +optional_policy(` nis_use_ypbind(krb5kdc_t) ') @@ -308,7 +317,6 @@ files_tmp_filetrans(kpropd_t, krb5kdc_tmp_t, { file dir }) corecmd_exec_bin(kpropd_t) -corenet_all_recvfrom_unlabeled(kpropd_t) corenet_tcp_sendrecv_generic_if(kpropd_t) corenet_tcp_sendrecv_generic_node(kpropd_t) corenet_tcp_sendrecv_all_ports(kpropd_t) @@ -324,8 +332,6 @@ selinux_validate_context(kpropd_t) logging_send_syslog_msg(kpropd_t) -miscfiles_read_localization(kpropd_t) - seutil_read_file_contexts(kpropd_t) sysnet_dns_name_resolve(kpropd_t) diff --git a/kerneloops.if b/kerneloops.if index 835b16b..8a98c76 100644 --- a/kerneloops.if +++ b/kerneloops.if @@ -99,17 +99,20 @@ interface(`kerneloops_manage_tmp_files',` # interface(`kerneloops_admin',` gen_require(` - type kerneloops_t, kerneloops_initrc_exec_t; - type kerneloops_tmp_t; + type kerneloops_t, kerneloops_initrc_exec_t, kerneloops_tmp_t; ') - allow $1 kerneloops_t:process { ptrace signal_perms }; + allow $1 kerneloops_t:process signal_perms; ps_process_pattern($1, kerneloops_t) + tunable_policy(`deny_ptrace',`',` + allow $1 kerneloops_t:process ptrace; + ') init_labeled_script_domtrans($1, kerneloops_initrc_exec_t) domain_system_change_exemption($1) role_transition $2 kerneloops_initrc_exec_t system_r; allow $2 system_r; + files_list_tmp($1) admin_pattern($1, kerneloops_tmp_t) ') diff --git a/kerneloops.te b/kerneloops.te index 6b35547..5c641b9 100644 --- a/kerneloops.te +++ b/kerneloops.te @@ -32,7 +32,6 @@ kernel_read_ring_buffer(kerneloops_t) # Init script handling domain_use_interactive_fds(kerneloops_t) -corenet_all_recvfrom_unlabeled(kerneloops_t) corenet_all_recvfrom_netlabel(kerneloops_t) corenet_tcp_sendrecv_generic_if(kerneloops_t) corenet_tcp_sendrecv_generic_node(kerneloops_t) @@ -40,15 +39,12 @@ corenet_tcp_sendrecv_all_ports(kerneloops_t) corenet_tcp_bind_http_port(kerneloops_t) corenet_tcp_connect_http_port(kerneloops_t) -files_read_etc_files(kerneloops_t) auth_use_nsswitch(kerneloops_t) logging_send_syslog_msg(kerneloops_t) logging_read_generic_logs(kerneloops_t) -miscfiles_read_localization(kerneloops_t) - optional_policy(` dbus_system_domain(kerneloops_t, kerneloops_exec_t) ') diff --git a/keyboardd.fc b/keyboardd.fc new file mode 100644 index 0000000..485aacc --- /dev/null +++ b/keyboardd.fc @@ -0,0 +1,2 @@ + +/usr/bin/system-setup-keyboard -- gen_context(system_u:object_r:keyboardd_exec_t,s0) diff --git a/keyboardd.if b/keyboardd.if new file mode 100644 index 0000000..6134ef2 --- /dev/null +++ b/keyboardd.if @@ -0,0 +1,39 @@ + +## policy for system-setup-keyboard daemon + +######################################## +## +## Execute a domain transition to run keyboard setup daemon. +## +## +## +## Domain allowed access. +## +## +# +interface(`keyboardd_domtrans',` + gen_require(` + type keyboardd_t, keyboardd_exec_t; + ') + + domtrans_pattern($1, keyboardd_exec_t, keyboardd_t) +') + +###################################### +## +## Allow attempts to read to +## keyboardd unnamed pipes. +## +## +## +## Domain allowed access. +## +## +# +interface(`keyboardd_read_pipes',` + gen_require(` + type keyboardd_t; + ') + + allow $1 keyboardd_t:fifo_file read_fifo_file_perms; +') diff --git a/keyboardd.te b/keyboardd.te new file mode 100644 index 0000000..081ae84 --- /dev/null +++ b/keyboardd.te @@ -0,0 +1,25 @@ + +policy_module(keyboardd, 1.0.0) + +######################################## +# +# Declarations +# + +type keyboardd_t; +type keyboardd_exec_t; +init_daemon_domain(keyboardd_t, keyboardd_exec_t) + +######################################## +# +# keyboardd local policy +# + +allow keyboardd_t self:fifo_file rw_fifo_file_perms; +allow keyboardd_t self:unix_stream_socket create_stream_socket_perms; + +files_manage_etc_runtime_files(keyboardd_t) +files_etc_filetrans_etc_runtime(keyboardd_t, file) + +files_read_etc_files(keyboardd_t) + diff --git a/keystone.fc b/keystone.fc new file mode 100644 index 0000000..408d6c0 --- /dev/null +++ b/keystone.fc @@ -0,0 +1,7 @@ +/usr/bin/keystone-all -- gen_context(system_u:object_r:keystone_exec_t,s0) + +/usr/lib/systemd/system/openstack-keystone.* -- gen_context(system_u:object_r:keystone_unit_file_t,s0) + +/var/lib/keystone(/.*)? gen_context(system_u:object_r:keystone_var_lib_t,s0) + +/var/log/keystone(/.*)? gen_context(system_u:object_r:keystone_log_t,s0) diff --git a/keystone.if b/keystone.if new file mode 100644 index 0000000..f20248c --- /dev/null +++ b/keystone.if @@ -0,0 +1,218 @@ + +## policy for keystone + +######################################## +## +## Transition to keystone. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`keystone_domtrans',` + gen_require(` + type keystone_t, keystone_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, keystone_exec_t, keystone_t) +') +######################################## +## +## Read keystone's log files. +## +## +## +## Domain allowed access. +## +## +## +# +interface(`keystone_read_log',` + gen_require(` + type keystone_log_t; + ') + + logging_search_logs($1) + read_files_pattern($1, keystone_log_t, keystone_log_t) +') + +######################################## +## +## Append to keystone log files. +## +## +## +## Domain allowed access. +## +## +# +interface(`keystone_append_log',` + gen_require(` + type keystone_log_t; + ') + + logging_search_logs($1) + append_files_pattern($1, keystone_log_t, keystone_log_t) +') + +######################################## +## +## Manage keystone log files +## +## +## +## Domain allowed access. +## +## +# +interface(`keystone_manage_log',` + gen_require(` + type keystone_log_t; + ') + + logging_search_logs($1) + manage_dirs_pattern($1, keystone_log_t, keystone_log_t) + manage_files_pattern($1, keystone_log_t, keystone_log_t) + manage_lnk_files_pattern($1, keystone_log_t, keystone_log_t) +') + +######################################## +## +## Search keystone lib directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`keystone_search_lib',` + gen_require(` + type keystone_var_lib_t; + ') + + allow $1 keystone_var_lib_t:dir search_dir_perms; + files_search_var_lib($1) +') + +######################################## +## +## Read keystone lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`keystone_read_lib_files',` + gen_require(` + type keystone_var_lib_t; + ') + + files_search_var_lib($1) + read_files_pattern($1, keystone_var_lib_t, keystone_var_lib_t) +') + +######################################## +## +## Manage keystone lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`keystone_manage_lib_files',` + gen_require(` + type keystone_var_lib_t; + ') + + files_search_var_lib($1) + manage_files_pattern($1, keystone_var_lib_t, keystone_var_lib_t) +') + +######################################## +## +## Manage keystone lib directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`keystone_manage_lib_dirs',` + gen_require(` + type keystone_var_lib_t; + ') + + files_search_var_lib($1) + manage_dirs_pattern($1, keystone_var_lib_t, keystone_var_lib_t) +') + +######################################## +## +## Execute keystone server in the keystone domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`keystone_systemctl',` + gen_require(` + type keystone_t; + type keystone_unit_file_t; + ') + + systemd_exec_systemctl($1) + systemd_read_fifo_file_passwd_run($1) + allow $1 keystone_unit_file_t:file read_file_perms; + allow $1 keystone_unit_file_t:service manage_service_perms; + + ps_process_pattern($1, keystone_t) +') + + +######################################## +## +## All of the rules required to administrate +## an keystone environment +## +## +## +## Domain allowed access. +## +## +# +interface(`keystone_admin',` + gen_require(` + type keystone_t; + type keystone_log_t; + type keystone_var_lib_t; + type keystone_unit_file_t; + ') + + allow $1 keystone_t:process { ptrace signal_perms }; + ps_process_pattern($1, keystone_t) + + logging_search_logs($1) + admin_pattern($1, keystone_log_t) + + files_search_var_lib($1) + admin_pattern($1, keystone_var_lib_t) + + keystone_systemctl($1) + admin_pattern($1, keystone_unit_file_t) + allow $1 keystone_unit_file_t:service all_service_perms; + optional_policy(` + systemd_passwd_agent_exec($1) + systemd_read_fifo_file_passwd_run($1) + ') +') diff --git a/keystone.te b/keystone.te new file mode 100644 index 0000000..a6606f3 --- /dev/null +++ b/keystone.te @@ -0,0 +1,68 @@ +policy_module(keystone, 1.0.0) + +######################################## +# +# Declarations +# + +type keystone_t; +type keystone_exec_t; +init_daemon_domain(keystone_t, keystone_exec_t) + +type keystone_log_t; +logging_log_file(keystone_log_t) + +type keystone_var_lib_t; +files_type(keystone_var_lib_t) + +type keystone_tmp_t; +files_tmp_file(keystone_tmp_t) + +type keystone_unit_file_t; +systemd_unit_file(keystone_unit_file_t) + +######################################## +# +# keystone local policy +# +allow keystone_t self:fifo_file rw_fifo_file_perms; +allow keystone_t self:unix_stream_socket create_stream_socket_perms; +allow keystone_t self:tcp_socket create_stream_socket_perms; + +manage_dirs_pattern(keystone_t, keystone_log_t, keystone_log_t) +manage_files_pattern(keystone_t, keystone_log_t, keystone_log_t) +logging_log_filetrans(keystone_t, keystone_log_t, { dir file }) + +manage_dirs_pattern(keystone_t, keystone_tmp_t, keystone_tmp_t) +manage_files_pattern(keystone_t, keystone_tmp_t, keystone_tmp_t) +manage_lnk_files_pattern(keystone_t, keystone_tmp_t, keystone_tmp_t) +files_tmp_filetrans(keystone_t, keystone_tmp_t, { file dir lnk_file }) +can_exec(keystone_t, keystone_tmp_t) + +manage_dirs_pattern(keystone_t, keystone_var_lib_t, keystone_var_lib_t) +manage_files_pattern(keystone_t, keystone_var_lib_t, keystone_var_lib_t) +files_var_lib_filetrans(keystone_t, keystone_var_lib_t, { dir file }) + +kernel_read_system_state(keystone_t) + +corecmd_exec_bin(keystone_t) +corecmd_exec_shell(keystone_t) + +corenet_tcp_bind_keystone_port(keystone_t) +corenet_tcp_bind_generic_node(keystone_t) + +dev_read_urand(keystone_t) + +domain_use_interactive_fds(keystone_t) + +files_read_etc_files(keystone_t) +files_read_usr_files(keystone_t) + +auth_use_pam(keystone_t) + +libs_exec_ldconfig(keystone_t) + + +optional_policy(` + mysql_stream_connect(keystone_t) +') diff --git a/kismet.if b/kismet.if index c18c920..582f7f3 100644 --- a/kismet.if +++ b/kismet.if @@ -239,7 +239,10 @@ interface(`kismet_admin',` ') ps_process_pattern($1, kismet_t) - allow $1 kismet_t:process { ptrace signal_perms }; + allow $1 kismet_t:process signal_perms; + tunable_policy(`deny_ptrace',`',` + allow $1 kismet_t:process ptrace; + ') kismet_manage_pid_files($1) kismet_manage_lib($1) diff --git a/kismet.te b/kismet.te index 9dd6880..77c768b 100644 --- a/kismet.te +++ b/kismet.te @@ -74,24 +74,21 @@ kernel_read_network_state(kismet_t) corecmd_exec_bin(kismet_t) -corenet_all_recvfrom_unlabeled(kismet_t) corenet_all_recvfrom_netlabel(kismet_t) corenet_tcp_sendrecv_generic_if(kismet_t) corenet_tcp_sendrecv_generic_node(kismet_t) corenet_tcp_sendrecv_all_ports(kismet_t) corenet_tcp_bind_generic_node(kismet_t) -corenet_tcp_bind_kismet_port(kismet_t) -corenet_tcp_connect_kismet_port(kismet_t) +corenet_tcp_bind_rtsclient_port(kismet_t) +corenet_tcp_connect_rtsclient_port(kismet_t) corenet_tcp_connect_pulseaudio_port(kismet_t) auth_use_nsswitch(kismet_t) -files_read_etc_files(kismet_t) files_read_usr_files(kismet_t) -miscfiles_read_localization(kismet_t) -userdom_use_user_terminals(kismet_t) +userdom_use_inherited_user_terminals(kismet_t) userdom_read_user_tmpfs_files(kismet_t) optional_policy(` diff --git a/ksmtuned.fc b/ksmtuned.fc index 9c0c835..8360166 100644 --- a/ksmtuned.fc +++ b/ksmtuned.fc @@ -3,3 +3,5 @@ /usr/sbin/ksmtuned -- gen_context(system_u:object_r:ksmtuned_exec_t,s0) /var/run/ksmtune\.pid -- gen_context(system_u:object_r:ksmtuned_var_run_t,s0) + +/var/log/ksmtuned.* gen_context(system_u:object_r:ksmtuned_log_t,s0) diff --git a/ksmtuned.if b/ksmtuned.if index 6fd0b4c..568f842 100644 --- a/ksmtuned.if +++ b/ksmtuned.if @@ -55,12 +55,14 @@ interface(`ksmtuned_initrc_domtrans',` # interface(`ksmtuned_admin',` gen_require(` - type ksmtuned_t, ksmtuned_var_run_t; - type ksmtuned_initrc_exec_t; + type ksmtuned_t, ksmtuned_var_run_t, ksmtuned_initrc_exec_t; ') - allow $1 ksmtuned_t:process { ptrace signal_perms }; - ps_process_pattern(ksmtumed_t) + allow $1 ksmtuned_t:process signal_perms; + ps_process_pattern($1, ksmtuned_t) + tunable_policy(`deny_ptrace',`',` + allow $1 ksmtuned_t:process ptrace; + ') files_list_pids($1) admin_pattern($1, ksmtuned_var_run_t) diff --git a/ksmtuned.te b/ksmtuned.te index a73b7a1..d143b12 100644 --- a/ksmtuned.te +++ b/ksmtuned.te @@ -9,6 +9,9 @@ type ksmtuned_t; type ksmtuned_exec_t; init_daemon_domain(ksmtuned_t, ksmtuned_exec_t) +type ksmtuned_log_t; +logging_log_file(ksmtuned_log_t) + type ksmtuned_initrc_exec_t; init_script_file(ksmtuned_initrc_exec_t) @@ -20,9 +23,13 @@ files_pid_file(ksmtuned_var_run_t) # ksmtuned local policy # -allow ksmtuned_t self:capability { sys_ptrace sys_tty_config }; +allow ksmtuned_t self:capability sys_tty_config; allow ksmtuned_t self:fifo_file rw_file_perms; +manage_dirs_pattern(ksmtuned_t, ksmtuned_log_t, ksmtuned_log_t) +manage_files_pattern(ksmtuned_t, ksmtuned_log_t, ksmtuned_log_t) +logging_log_filetrans(ksmtuned_t, ksmtuned_log_t, { file dir }) + manage_files_pattern(ksmtuned_t, ksmtuned_var_run_t, ksmtuned_var_run_t) files_pid_filetrans(ksmtuned_t, ksmtuned_var_run_t, file) @@ -31,9 +38,16 @@ kernel_read_system_state(ksmtuned_t) dev_rw_sysfs(ksmtuned_t) domain_read_all_domains_state(ksmtuned_t) +domain_dontaudit_read_all_domains_state(ksmtuned_t) corecmd_exec_bin(ksmtuned_t) +corecmd_exec_shell(ksmtuned_t) + + +mls_file_read_to_clearance(ksmtuned_t) + +term_use_all_inherited_terms(ksmtuned_t) -files_read_etc_files(ksmtuned_t) +auth_use_nsswitch(ksmtuned_t) -miscfiles_read_localization(ksmtuned_t) +logging_send_syslog_msg(ksmtuned_t) diff --git a/ktalk.te b/ktalk.te index ca5cfdf..a4457d0 100644 --- a/ktalk.te +++ b/ktalk.te @@ -52,7 +52,6 @@ kernel_read_kernel_sysctls(ktalkd_t) kernel_read_system_state(ktalkd_t) kernel_read_network_state(ktalkd_t) -corenet_all_recvfrom_unlabeled(ktalkd_t) corenet_all_recvfrom_netlabel(ktalkd_t) corenet_tcp_sendrecv_generic_if(ktalkd_t) corenet_udp_sendrecv_generic_if(ktalkd_t) @@ -65,15 +64,12 @@ dev_read_urand(ktalkd_t) fs_getattr_xattr_fs(ktalkd_t) -files_read_etc_files(ktalkd_t) term_search_ptys(ktalkd_t) -term_use_all_terms(ktalkd_t) +term_use_all_inherited_terms(ktalkd_t) auth_use_nsswitch(ktalkd_t) init_read_utmp(ktalkd_t) logging_send_syslog_msg(ktalkd_t) - -miscfiles_read_localization(ktalkd_t) diff --git a/kudzu.fc b/kudzu.fc index dd88f74..3317a0c 100644 --- a/kudzu.fc +++ b/kudzu.fc @@ -2,4 +2,5 @@ /sbin/kmodule -- gen_context(system_u:object_r:kudzu_exec_t,s0) /sbin/kudzu -- gen_context(system_u:object_r:kudzu_exec_t,s0) +/usr/sbin/kmodule -- gen_context(system_u:object_r:kudzu_exec_t,s0) /usr/sbin/kudzu -- gen_context(system_u:object_r:kudzu_exec_t,s0) diff --git a/kudzu.te b/kudzu.te index 4f7bd3c..74cc11d 100644 --- a/kudzu.te +++ b/kudzu.te @@ -20,7 +20,7 @@ files_pid_file(kudzu_var_run_t) # Local policy # -allow kudzu_t self:capability { dac_override sys_admin sys_ptrace sys_rawio net_admin sys_tty_config mknod }; +allow kudzu_t self:capability { dac_override sys_admin sys_rawio net_admin sys_tty_config mknod }; dontaudit kudzu_t self:capability sys_tty_config; allow kudzu_t self:process { signal_perms execmem }; allow kudzu_t self:fifo_file rw_fifo_file_perms; @@ -109,17 +109,10 @@ libs_read_lib_files(kudzu_t) logging_send_syslog_msg(kudzu_t) miscfiles_read_hwdata(kudzu_t) -miscfiles_read_localization(kudzu_t) - -modutils_read_module_config(kudzu_t) -modutils_read_module_deps(kudzu_t) -modutils_rename_module_config(kudzu_t) -modutils_delete_module_config(kudzu_t) -modutils_domtrans_insmod(kudzu_t) sysnet_read_config(kudzu_t) -userdom_use_user_terminals(kudzu_t) +userdom_use_inherited_user_terminals(kudzu_t) userdom_dontaudit_use_unpriv_user_fds(kudzu_t) userdom_search_user_home_dirs(kudzu_t) @@ -128,6 +121,14 @@ optional_policy(` ') optional_policy(` + modutils_read_module_config(kudzu_t) + modutils_read_module_deps(kudzu_t) + modutils_rename_module_config(kudzu_t) + modutils_delete_module_config(kudzu_t) + modutils_domtrans_insmod(kudzu_t) +') + +optional_policy(` nscd_socket_use(kudzu_t) ') diff --git a/l2tpd.fc b/l2tpd.fc new file mode 100644 index 0000000..6b27066 --- /dev/null +++ b/l2tpd.fc @@ -0,0 +1,18 @@ +/etc/prol2tp(/.*)? gen_context(system_u:object_r:l2tp_etc_t,s0) + +/etc/rc\.d/init\.d/openl2tpd -- gen_context(system_u:object_r:l2tpd_initrc_exec_t,s0) +/etc/rc\.d/init\.d/prol2tpd -- gen_context(system_u:object_r:l2tpd_initrc_exec_t,s0) +/etc/rc\.d/init\.d/xl2tpd -- gen_context(system_u:object_r:l2tpd_initrc_exec_t,s0) + +/etc/sysconfig/prol2tpd -- gen_context(system_u:object_r:l2tp_etc_t,s0) + +/usr/sbin/openl2tpd -- gen_context(system_u:object_r:l2tpd_exec_t,s0) +/usr/sbin/prol2tpd -- gen_context(system_u:object_r:l2tpd_exec_t,s0) +/usr/sbin/xl2tpd -- gen_context(system_u:object_r:l2tpd_exec_t,s0) + +/var/run/openl2tpd\.pid -- gen_context(system_u:object_r:l2tpd_var_run_t,s0) +/var/run/prol2tpd(/.*)? gen_context(system_u:object_r:l2tpd_var_run_t,s0) +/var/run/prol2tpd\.ctl -s gen_context(system_u:object_r:l2tpd_var_run_t,s0) +/var/run/prol2tpd\.pid -- gen_context(system_u:object_r:l2tpd_var_run_t,s0) +/var/run/xl2tpd(/.*)? gen_context(system_u:object_r:l2tpd_var_run_t,s0) +/var/run/xl2tpd\.pid -- gen_context(system_u:object_r:l2tpd_var_run_t,s0) diff --git a/l2tpd.if b/l2tpd.if new file mode 100644 index 0000000..562d25b --- /dev/null +++ b/l2tpd.if @@ -0,0 +1,178 @@ +## Layer 2 Tunneling Protocol daemons. + +######################################## +## +## Transition to l2tpd. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`l2tpd_domtrans',` + gen_require(` + type l2tpd_t, l2tpd_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, l2tpd_exec_t, l2tpd_t) +') + +######################################## +## +## Execute l2tpd server in the l2tpd domain. +## +## +## +## Domain allowed access. +## +## +# +interface(`l2tpd_initrc_domtrans',` + gen_require(` + type l2tpd_initrc_exec_t; + ') + + init_labeled_script_domtrans($1, l2tpd_initrc_exec_t) +') + +######################################## +## +## Send to l2tpd via a unix dgram socket. +## +## +## +## Domain allowed access. +## +## +# +interface(`l2tpd_dgram_send',` + gen_require(` + type l2tpd_t, l2tpd_tmp_t, l2tpd_var_run_t; + ') + + files_search_tmp($1) + dgram_send_pattern($1, { l2tpd_tmp_t l2tpd_var_run_t }, { l2tpd_tmp_t l2tpd_var_run_t }, l2tpd_t) +') + +######################################## +## +## Read and write l2tpd sockets. +## +## +## +## Domain allowed access. +## +## +# +interface(`l2tpd_rw_socket',` + gen_require(` + type l2tpd_t; + ') + + allow $1 l2tpd_t:socket rw_socket_perms; +') + +######################################## +## +## Read l2tpd PID files. +## +## +## +## Domain allowed access. +## +## +# +interface(`l2tpd_read_pid_files',` + gen_require(` + type l2tpd_var_run_t; + ') + + files_search_pids($1) + allow $1 l2tpd_var_run_t:file read_file_perms; +') + +##################################### +## +## Connect to l2tpd over a unix domain +## stream socket. +## +## +## +## Domain allowed access. +## +## +# +interface(`l2tpd_stream_connect',` + gen_require(` + type l2tpd_t, l2tpd_var_run_t, l2tpd_tmp_t; + ') + + files_search_pids($1) + stream_connect_pattern($1, l2tpd_tmp_t, l2tpd_tmp_t, l2tpd_t) + stream_connect_pattern($1, l2tpd_var_run_t, l2tpd_var_run_t, l2tpd_t) +') + +######################################## +## +## Read and write l2tpd unnamed pipes. +## +## +## +## Domain allowed access. +## +## +# +interface(`l2tpd_rw_pipes',` + gen_require(` + type l2tpd_t; + ') + + allow $1 l2tpd_t:fifo_file rw_fifo_file_perms; +') + +######################################## +## +## All of the rules required to administrate +## an l2tpd environment +## +## +## +## Domain allowed access. +## +## +## +## +## Role allowed access. +## +## +## +# +interface(`l2tpd_admin',` + gen_require(` + type l2tpd_t, l2tpd_initrc_exec_t, l2tpd_var_run_t; + type l2tp_etc_t, l2tpd_tmp_t; + ') + + allow $1 l2tpd_t:process signal_perms; + ps_process_pattern($1, l2tpd_t) + + tunable_policy(`deny_ptrace',`',` + allow $1 l2tpd_t:process ptrace; + ') + + l2tpd_initrc_domtrans($1) + domain_system_change_exemption($1) + role_transition $2 l2tpd_initrc_exec_t system_r; + allow $2 system_r; + + files_search_etc($1) + admin_pattern($1, l2tp_etc_t) + + files_search_pids($1) + admin_pattern($1, l2tpd_var_run_t) + + files_search_tmp($1) + admin_pattern($1, l2tpd_tmp_t) +') diff --git a/l2tpd.te b/l2tpd.te new file mode 100644 index 0000000..363eeba --- /dev/null +++ b/l2tpd.te @@ -0,0 +1,98 @@ +policy_module(l2tpd, 1.0.0) + +######################################## +# +# Declarations +# + +type l2tpd_t; +type l2tpd_exec_t; +init_daemon_domain(l2tpd_t, l2tpd_exec_t) + +type l2tpd_initrc_exec_t; +init_script_file(l2tpd_initrc_exec_t) + +type l2tp_etc_t; +files_config_file(l2tp_etc_t) + +type l2tpd_tmp_t; +files_tmp_file(l2tpd_tmp_t) + +type l2tpd_var_run_t; +files_pid_file(l2tpd_var_run_t) + +######################################## +# +# Local policy +# + +allow l2tpd_t self:capability { net_admin net_bind_service }; +allow l2tpd_t self:process signal; +allow l2tpd_t self:fifo_file rw_fifo_file_perms; +allow l2tpd_t self:netlink_socket create_socket_perms; +allow l2tpd_t self:rawip_socket create_socket_perms; +allow l2tpd_t self:socket create_socket_perms; +allow l2tpd_t self:tcp_socket create_stream_socket_perms; +allow l2tpd_t self:unix_dgram_socket sendto; +allow l2tpd_t self:unix_stream_socket create_stream_socket_perms; + +read_files_pattern(l2tpd_t, l2tp_etc_t, l2tp_etc_t) + +manage_dirs_pattern(l2tpd_t, l2tpd_var_run_t, l2tpd_var_run_t) +manage_files_pattern(l2tpd_t, l2tpd_var_run_t, l2tpd_var_run_t) +manage_sock_files_pattern(l2tpd_t, l2tpd_var_run_t, l2tpd_var_run_t) +manage_fifo_files_pattern(l2tpd_t, l2tpd_var_run_t, l2tpd_var_run_t) +files_pid_filetrans(l2tpd_t, l2tpd_var_run_t, { dir file sock_file fifo_file }) + +manage_sock_files_pattern(l2tpd_t, l2tpd_tmp_t, l2tpd_tmp_t) +files_tmp_filetrans(l2tpd_t, l2tpd_tmp_t, sock_file) + +corenet_all_recvfrom_netlabel(l2tpd_t) +corenet_raw_sendrecv_generic_if(l2tpd_t) +corenet_tcp_sendrecv_generic_if(l2tpd_t) +corenet_udp_sendrecv_generic_if(l2tpd_t) +corenet_raw_bind_generic_node(l2tpd_t) +corenet_tcp_bind_generic_node(l2tpd_t) +corenet_udp_bind_generic_node(l2tpd_t) +corenet_raw_sendrecv_generic_node(l2tpd_t) +corenet_tcp_sendrecv_generic_node(l2tpd_t) +corenet_udp_sendrecv_generic_node(l2tpd_t) + +corenet_tcp_bind_all_rpc_ports(l2tpd_t) +corenet_udp_bind_all_rpc_ports(l2tpd_t) +corenet_udp_bind_generic_port(l2tpd_t) + +corenet_udp_bind_l2tp_port(l2tpd_t) +corenet_udp_sendrecv_l2tp_port(l2tpd_t) +corenet_sendrecv_l2tp_server_packets(l2tpd_t) + +kernel_read_system_state(l2tpd_t) +kernel_read_network_state(l2tpd_t) +# net-pf-24 (pppox) +kernel_request_load_module(l2tpd_t) + +term_use_ptmx(l2tpd_t) +term_use_generic_ptys(l2tpd_t) + +# prol2tpc +corecmd_exec_bin(l2tpd_t) + +dev_read_urand(l2tpd_t) + +domain_use_interactive_fds(l2tpd_t) + +files_read_etc_files(l2tpd_t) + +term_use_ptmx(l2tpd_t) + +auth_read_passwd(l2tpd_t) + +logging_send_syslog_msg(l2tpd_t) + +sysnet_dns_name_resolve(l2tpd_t) + +optional_policy(` + ppp_domtrans(l2tpd_t) + ppp_signal(l2tpd_t) + ppp_kill(l2tpd_t) +') diff --git a/ldap.fc b/ldap.fc index c62f23e..40c6b4d 100644 --- a/ldap.fc +++ b/ldap.fc @@ -1,6 +1,11 @@ /etc/ldap/slapd\.conf -- gen_context(system_u:object_r:slapd_etc_t,s0) -/etc/rc\.d/init\.d/ldap -- gen_context(system_u:object_r:slapd_initrc_exec_t,s0) +/etc/openldap/certs(/.*)? gen_context(system_u:object_r:slapd_cert_t,s0) +/etc/openldap/slapd\.d(/.*)? gen_context(system_u:object_r:slapd_db_t,s0) + +/etc/rc\.d/init\.d/slapd -- gen_context(system_u:object_r:slapd_initrc_exec_t,s0) + +/usr/lib/systemd/system/slapd.* -- gen_context(system_u:object_r:iptables_unit_file_t,s0) /usr/sbin/slapd -- gen_context(system_u:object_r:slapd_exec_t,s0) diff --git a/ldap.if b/ldap.if index d6b7b2d..bc0ccb3 100644 --- a/ldap.if +++ b/ldap.if @@ -1,5 +1,64 @@ ## OpenLDAP directory server +####################################### +## +## Execute OpenLDAP in the ldap domain. +## +## +## +## Domain allowed access. +## +## +# +interface(`ldap_domtrans',` + gen_require(` + type slapd_t, slapd_exec_t; + ') + + domtrans_pattern($1, slapd_exec_t, slapd_t) +') + +####################################### +## +## Execute OpenLDAP server in the ldap domain. +## +## +## +## Domain allowed access. +## +## +# +interface(`ldap_initrc_domtrans',` + gen_require(` + type slapd_initrc_exec_t; + ') + + init_labeled_script_domtrans($1, slapd_initrc_exec_t) +') + +######################################## +## +## Execute slapd server in the slapd domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`ldap_systemctl',` + gen_require(` + type slapd_unit_file_t; + type slapd_t; + ') + + systemd_exec_systemctl($1) + allow $1 slapd_unit_file_t:file read_file_perms; + allow $1 slapd_unit_file_t:service manage_service_perms; + + ps_process_pattern($1, slapd_t) +') + ######################################## ## ## Read the contents of the OpenLDAP @@ -21,6 +80,25 @@ interface(`ldap_list_db',` ######################################## ## +## Read the contents of the OpenLDAP +## database files. +## +## +## +## Domain allowed access. +## +## +# +interface(`ldap_read_db_files',` + gen_require(` + type slapd_db_t; + ') + + read_files_pattern($1, slapd_db_t, slapd_db_t) +') + +######################################## +## ## Read the OpenLDAP configuration files. ## ## @@ -94,10 +172,14 @@ interface(`ldap_admin',` type slapd_t, slapd_tmp_t, slapd_replog_t; type slapd_lock_t, slapd_etc_t, slapd_var_run_t; type slapd_initrc_exec_t; + type ldap_unit_file_t; ') - allow $1 slapd_t:process { ptrace signal_perms }; + allow $1 slapd_t:process signal_perms; ps_process_pattern($1, slapd_t) + tunable_policy(`deny_ptrace',`',` + allow $1 slapd_t:process ptrace; + ') init_labeled_script_domtrans($1, slapd_initrc_exec_t) domain_system_change_exemption($1) @@ -109,6 +191,7 @@ interface(`ldap_admin',` admin_pattern($1, slapd_lock_t) + files_list_var_lib($1) admin_pattern($1, slapd_replog_t) files_list_tmp($1) @@ -116,4 +199,8 @@ interface(`ldap_admin',` files_list_pids($1) admin_pattern($1, slapd_var_run_t) + + ldap_systemctl($1) + admin_pattern($1, ldap_unit_file_t) + allow $1 ldap_unit_file_t:service all_service_perms; ') diff --git a/ldap.te b/ldap.te index 64fd1ff..3ee778a 100644 --- a/ldap.te +++ b/ldap.te @@ -10,7 +10,7 @@ type slapd_exec_t; init_daemon_domain(slapd_t, slapd_exec_t) type slapd_cert_t; -files_type(slapd_cert_t) +miscfiles_cert_type(slapd_cert_t) type slapd_db_t; files_type(slapd_db_t) @@ -21,15 +21,24 @@ files_config_file(slapd_etc_t) type slapd_initrc_exec_t; init_script_file(slapd_initrc_exec_t) +type slapd_unit_file_t; +systemd_unit_file(slapd_unit_file_t) + type slapd_lock_t; files_lock_file(slapd_lock_t) type slapd_replog_t; files_type(slapd_replog_t) +type slapd_log_t; +logging_log_file(slapd_log_t) + type slapd_tmp_t; files_tmp_file(slapd_tmp_t) +type slapd_tmpfs_t; +files_tmpfs_file(slapd_tmpfs_t) + type slapd_var_run_t; files_pid_file(slapd_var_run_t) @@ -67,18 +76,25 @@ manage_dirs_pattern(slapd_t, slapd_replog_t, slapd_replog_t) manage_files_pattern(slapd_t, slapd_replog_t, slapd_replog_t) manage_lnk_files_pattern(slapd_t, slapd_replog_t, slapd_replog_t) +manage_dirs_pattern(slapd_t, slapd_log_t, slapd_log_t) +manage_files_pattern(slapd_t, slapd_log_t, slapd_log_t) +logging_log_filetrans(slapd_t, slapd_log_t, { file dir }) + manage_dirs_pattern(slapd_t, slapd_tmp_t, slapd_tmp_t) manage_files_pattern(slapd_t, slapd_tmp_t, slapd_tmp_t) files_tmp_filetrans(slapd_t, slapd_tmp_t, { file dir }) +manage_files_pattern(slapd_t, slapd_tmpfs_t, slapd_tmpfs_t) +fs_tmpfs_filetrans(slapd_t, slapd_tmpfs_t, file) + +manage_dirs_pattern(slapd_t, slapd_var_run_t, slapd_var_run_t) manage_files_pattern(slapd_t, slapd_var_run_t, slapd_var_run_t) manage_sock_files_pattern(slapd_t, slapd_var_run_t, slapd_var_run_t) -files_pid_filetrans(slapd_t, slapd_var_run_t, { file sock_file }) +files_pid_filetrans(slapd_t, slapd_var_run_t, { dir file sock_file }) kernel_read_system_state(slapd_t) kernel_read_kernel_sysctls(slapd_t) -corenet_all_recvfrom_unlabeled(slapd_t) corenet_all_recvfrom_netlabel(slapd_t) corenet_tcp_sendrecv_generic_if(slapd_t) corenet_udp_sendrecv_generic_if(slapd_t) @@ -100,23 +116,25 @@ fs_search_auto_mountpoints(slapd_t) domain_use_interactive_fds(slapd_t) -files_read_etc_files(slapd_t) files_read_etc_runtime_files(slapd_t) files_read_usr_files(slapd_t) files_list_var_lib(slapd_t) auth_use_nsswitch(slapd_t) +auth_rw_cache(slapd_t) logging_send_syslog_msg(slapd_t) miscfiles_read_generic_certs(slapd_t) -miscfiles_read_localization(slapd_t) userdom_dontaudit_use_unpriv_user_fds(slapd_t) userdom_dontaudit_search_user_home_dirs(slapd_t) optional_policy(` kerberos_keytab_template(slapd, slapd_t) + kerberos_tmp_filetrans_host_rcache(slapd_t, "ldapmap1_0") + kerberos_tmp_filetrans_host_rcache(slapd_t, "ldap_487") + kerberos_tmp_filetrans_host_rcache(slapd_t, "ldap_55") ') optional_policy(` diff --git a/likewise.fc b/likewise.fc index 057a4e4..57491fc 100644 --- a/likewise.fc +++ b/likewise.fc @@ -20,7 +20,8 @@ /usr/sbin/netlogond -- gen_context(system_u:object_r:netlogond_exec_t,s0) /usr/sbin/srvsvcd -- gen_context(system_u:object_r:srvsvcd_exec_t,s0) -/var/lib/likewise-open(/.*)? gen_context(system_u:object_r:likewise_var_lib_t,s0) +/var/lib/likewise-open(/.*)? gen_context(system_u:object_r:likewise_var_lib_t,s0) +/var/lib/likewise(/.*)? gen_context(system_u:object_r:likewise_var_lib_t,s0) /var/lib/likewise-open/\.lsassd -s gen_context(system_u:object_r:lsassd_var_socket_t,s0) /var/lib/likewise-open/\.lwiod -s gen_context(system_u:object_r:lwiod_var_socket_t,s0) /var/lib/likewise-open/\.regsd -s gen_context(system_u:object_r:lwregd_var_socket_t,s0) diff --git a/likewise.if b/likewise.if index 771e04b..1072aea 100644 --- a/likewise.if +++ b/likewise.if @@ -63,7 +63,7 @@ template(`likewise_domain_template',` allow $1_t self:tcp_socket create_stream_socket_perms; allow $1_t self:udp_socket create_socket_perms; - allow $1_t likewise_var_lib_t:dir setattr; + allow $1_t likewise_var_lib_t:dir setattr_dir_perms; manage_files_pattern($1_t, $1_var_run_t, $1_var_run_t) files_pid_filetrans($1_t, $1_var_run_t, file) @@ -82,7 +82,6 @@ template(`likewise_domain_template',` logging_send_syslog_msg($1_t) - miscfiles_read_localization($1_t) ') ######################################## diff --git a/likewise.te b/likewise.te index 5ba6cc2..e3f65d6 100644 --- a/likewise.te +++ b/likewise.te @@ -17,7 +17,7 @@ type likewise_var_lib_t; files_type(likewise_var_lib_t) type likewise_pstore_lock_t; -files_type(likewise_pstore_lock_t) +files_lock_file(likewise_pstore_lock_t) type likewise_krb5_ad_t; files_type(likewise_krb5_ad_t) @@ -49,7 +49,6 @@ likewise_domain_template(srvsvcd) stream_connect_pattern(dcerpcd_t, likewise_var_lib_t, lwregd_var_socket_t, lwregd_t) corenet_all_recvfrom_netlabel(dcerpcd_t) -corenet_all_recvfrom_unlabeled(dcerpcd_t) corenet_sendrecv_generic_client_packets(dcerpcd_t) corenet_sendrecv_generic_server_packets(dcerpcd_t) corenet_tcp_sendrecv_generic_if(dcerpcd_t) @@ -73,7 +72,6 @@ stream_connect_pattern(eventlogd_t, likewise_var_lib_t, dcerpcd_var_socket_t, dc stream_connect_pattern(eventlogd_t, likewise_var_lib_t, lwregd_var_socket_t, lwregd_t) corenet_all_recvfrom_netlabel(eventlogd_t) -corenet_all_recvfrom_unlabeled(eventlogd_t) corenet_sendrecv_generic_server_packets(eventlogd_t) corenet_tcp_sendrecv_generic_if(eventlogd_t) corenet_tcp_sendrecv_generic_node(eventlogd_t) @@ -116,7 +114,6 @@ corecmd_exec_bin(lsassd_t) corecmd_exec_shell(lsassd_t) corenet_all_recvfrom_netlabel(lsassd_t) -corenet_all_recvfrom_unlabeled(lsassd_t) corenet_tcp_sendrecv_generic_if(lsassd_t) corenet_tcp_sendrecv_generic_node(lsassd_t) corenet_tcp_sendrecv_generic_port(lsassd_t) @@ -165,7 +162,6 @@ stream_connect_pattern(lwiod_t, likewise_var_lib_t, lwregd_var_socket_t, lwregd_ stream_connect_pattern(lwiod_t, likewise_var_lib_t, lsassd_var_socket_t, lsassd_t) corenet_all_recvfrom_netlabel(lwiod_t) -corenet_all_recvfrom_unlabeled(lwiod_t) corenet_sendrecv_smbd_server_packets(lwiod_t) corenet_sendrecv_smbd_client_packets(lwiod_t) corenet_tcp_sendrecv_generic_if(lwiod_t) @@ -205,7 +201,7 @@ stream_connect_pattern(lwsmd_t, likewise_var_lib_t, lwregd_var_socket_t, lwregd_ # Likewise DC location service local policy # -allow netlogond_t self:capability {dac_override}; +allow netlogond_t self:capability dac_override; manage_files_pattern(netlogond_t, likewise_etc_t, likewise_etc_t) @@ -226,7 +222,6 @@ stream_connect_pattern(srvsvcd_t, likewise_var_lib_t, lwiod_var_socket_t, lwiod_ stream_connect_pattern(srvsvcd_t, likewise_var_lib_t, lwregd_var_socket_t, lwregd_t) corenet_all_recvfrom_netlabel(srvsvcd_t) -corenet_all_recvfrom_unlabeled(srvsvcd_t) corenet_sendrecv_generic_server_packets(srvsvcd_t) corenet_tcp_sendrecv_generic_if(srvsvcd_t) corenet_tcp_sendrecv_generic_node(srvsvcd_t) diff --git a/lircd.fc b/lircd.fc index 49e04e5..69db026 100644 --- a/lircd.fc +++ b/lircd.fc @@ -2,6 +2,7 @@ /etc/rc\.d/init\.d/lirc -- gen_context(system_u:object_r:lircd_initrc_exec_t,s0) /etc/lircd\.conf -- gen_context(system_u:object_r:lircd_etc_t,s0) +/etc/lirc(/.*)? gen_context(system_u:object_r:lircd_etc_t,s0) /usr/sbin/lircd -- gen_context(system_u:object_r:lircd_exec_t,s0) diff --git a/lircd.if b/lircd.if index 418cc81..cdb2561 100644 --- a/lircd.if +++ b/lircd.if @@ -80,8 +80,11 @@ interface(`lircd_admin',` type lircd_initrc_exec_t, lircd_etc_t; ') - allow $1 lircd_t:process { ptrace signal_perms }; + allow $1 lircd_t:process signal_perms; ps_process_pattern($1, lircd_t) + tunable_policy(`deny_ptrace',`',` + allow $1 lircd_t:process ptrace; + ') init_labeled_script_domtrans($1, lircd_initrc_exec_t) domain_system_change_exemption($1) diff --git a/lircd.te b/lircd.te index 6a78de1..1ac01cd 100644 --- a/lircd.te +++ b/lircd.te @@ -13,7 +13,7 @@ type lircd_initrc_exec_t; init_script_file(lircd_initrc_exec_t) type lircd_etc_t; -files_type(lircd_etc_t) +files_config_file(lircd_etc_t) type lircd_var_run_t alias lircd_sock_t; files_pid_file(lircd_var_run_t) @@ -24,6 +24,7 @@ files_pid_file(lircd_var_run_t) # allow lircd_t self:capability { chown kill sys_admin }; +allow lircd_t self:process signal; allow lircd_t self:fifo_file rw_fifo_file_perms; allow lircd_t self:unix_dgram_socket create_socket_perms; allow lircd_t self:tcp_socket create_stream_socket_perms; @@ -44,21 +45,21 @@ corenet_tcp_bind_lirc_port(lircd_t) corenet_tcp_sendrecv_all_ports(lircd_t) corenet_tcp_connect_lirc_port(lircd_t) -dev_read_generic_usb_dev(lircd_t) +dev_rw_generic_usb_dev(lircd_t) # this needs to be reproduced. might not be right dev_read_mouse(lircd_t) dev_filetrans_lirc(lircd_t) dev_rw_lirc(lircd_t) dev_rw_input_dev(lircd_t) +dev_read_sysfs(lircd_t) -files_read_etc_files(lircd_t) +files_read_config_files(lircd_t) files_list_var(lircd_t) files_manage_generic_locks(lircd_t) files_read_all_locks(lircd_t) term_use_ptmx(lircd_t) +term_use_usb_ttys(lircd_t) logging_send_syslog_msg(lircd_t) -miscfiles_read_localization(lircd_t) - sysnet_dns_name_resolve(lircd_t) diff --git a/livecd.if b/livecd.if index ae29d9f..fb7869e 100644 --- a/livecd.if +++ b/livecd.if @@ -36,11 +36,39 @@ interface(`livecd_domtrans',` # interface(`livecd_run',` gen_require(` - attribute_role livecd_roles; + type livecd_t; + type livecd_exec_t; + #attribute_role livecd_roles; ') livecd_domtrans($1) - roleattribute $2 livecd_roles; + #roleattribute $2 livecd_roles; + role $2 types livecd_t; + role_transition $2 livecd_exec_t system_r; + + seutil_run_setfiles_mac(livecd_t, system_r) + + optional_policy(` + mount_run(livecd_t, $2) + ') +') + +######################################## +## +## Dontaudit read/write to a livecd leaks +## +## +## +## Domain to not audit. +## +## +# +interface(`livecd_dontaudit_leaks',` + gen_require(` + type livecd_t; + ') + + dontaudit $1 livecd_t:unix_dgram_socket { read write }; ') ######################################## diff --git a/livecd.te b/livecd.te index 008f718..7a944b5 100644 --- a/livecd.te +++ b/livecd.te @@ -5,13 +5,14 @@ policy_module(livecd, 1.2.0) # Declarations # -attribute_role livecd_roles; -roleattribute system_r livecd_roles; +#attribute_role livecd_roles; +#roleattribute system_r livecd_roles; type livecd_t; type livecd_exec_t; application_domain(livecd_t, livecd_exec_t) -role livecd_roles types livecd_t; +role system_r types livecd_t; +#role livecd_roles types livecd_t; type livecd_tmp_t; files_tmp_file(livecd_tmp_t) @@ -29,15 +30,27 @@ manage_dirs_pattern(livecd_t, livecd_tmp_t, livecd_tmp_t) manage_files_pattern(livecd_t, livecd_tmp_t, livecd_tmp_t) files_tmp_filetrans(livecd_t, livecd_tmp_t, { dir file }) +dev_filetrans_all_named_dev(livecd_t) +storage_filetrans_all_named_dev(livecd_t) +term_filetrans_all_named_dev(livecd_t) + +sysnet_filetrans_named_content(livecd_t) + +#optional_policy(` +# mount_run(livecd_t, livecd_roles) +# seutil_run_setfiles_mac(livecd_t, livecd_roles) +#') + optional_policy(` - mount_run(livecd_t, livecd_roles) + ssh_filetrans_admin_home_content(livecd_t) ') optional_policy(` - hal_dbus_chat(livecd_t) + unconfined_domain_noaudit(livecd_t) ') optional_policy(` - unconfined_domain(livecd_t) + # Allow SELinux aware applications to request rpm_script execution + rpm_transition_script(livecd_t) + rpm_domtrans(livecd_t) ') - diff --git a/lldpad.fc b/lldpad.fc new file mode 100644 index 0000000..83a4348 --- /dev/null +++ b/lldpad.fc @@ -0,0 +1,8 @@ + +/etc/rc\.d/init\.d/lldpad -- gen_context(system_u:object_r:lldpad_initrc_exec_t,s0) + +/usr/sbin/lldpad -- gen_context(system_u:object_r:lldpad_exec_t,s0) + +/var/lib/lldpad(/.*)? gen_context(system_u:object_r:lldpad_var_lib_t,s0) + +/var/run/lldpad\.pid -- gen_context(system_u:object_r:lldpad_var_run_t,s0) diff --git a/lldpad.if b/lldpad.if new file mode 100644 index 0000000..6550968 --- /dev/null +++ b/lldpad.if @@ -0,0 +1,201 @@ + +## policy for lldpad + +######################################## +## +## Transition to lldpad. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`lldpad_domtrans',` + gen_require(` + type lldpad_t, lldpad_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, lldpad_exec_t, lldpad_t) +') + + +######################################## +## +## Execute lldpad server in the lldpad domain. +## +## +## +## Domain allowed access. +## +## +# +interface(`lldpad_initrc_domtrans',` + gen_require(` + type lldpad_initrc_exec_t; + ') + + init_labeled_script_domtrans($1, lldpad_initrc_exec_t) +') + + +######################################## +## +## Search lldpad lib directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`lldpad_search_lib',` + gen_require(` + type lldpad_var_lib_t; + ') + + allow $1 lldpad_var_lib_t:dir search_dir_perms; + files_search_var_lib($1) +') + +######################################## +## +## Read lldpad lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`lldpad_read_lib_files',` + gen_require(` + type lldpad_var_lib_t; + ') + + files_search_var_lib($1) + read_files_pattern($1, lldpad_var_lib_t, lldpad_var_lib_t) +') + +######################################## +## +## Manage lldpad lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`lldpad_manage_lib_files',` + gen_require(` + type lldpad_var_lib_t; + ') + + files_search_var_lib($1) + manage_files_pattern($1, lldpad_var_lib_t, lldpad_var_lib_t) +') + +######################################## +## +## Manage lldpad lib directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`lldpad_manage_lib_dirs',` + gen_require(` + type lldpad_var_lib_t; + ') + + files_search_var_lib($1) + manage_dirs_pattern($1, lldpad_var_lib_t, lldpad_var_lib_t) +') + + +######################################## +## +## Read lldpad PID files. +## +## +## +## Domain allowed access. +## +## +# +interface(`lldpad_read_pid_files',` + gen_require(` + type lldpad_var_run_t; + ') + + files_search_pids($1) + allow $1 lldpad_var_run_t:file read_file_perms; +') + +##################################### +## +## Send to a lldpad unix dgram socket. +## +## +## +## Domain allowed access. +## +## +# +interface(`lldpad_dgram_send',` + gen_require(` + type lldpad_t; + ') + + allow $1 lldpad_t:unix_dgram_socket sendto; + allow lldpad_t $1:unix_dgram_socket sendto; +') + +######################################## +## +## All of the rules required to administrate +## an lldpad environment +## +## +## +## Domain allowed access. +## +## +## +## +## Role allowed access. +## +## +## +# +interface(`lldpad_admin',` + gen_require(` + type lldpad_t; + type lldpad_initrc_exec_t; + type lldpad_var_lib_t; + type lldpad_var_run_t; + ') + + allow $1 lldpad_t:process signal_perms; + ps_process_pattern($1, lldpad_t) + tunable_policy(`deny_ptrace',`',` + allow $1 lldpad_t:process ptrace; + ') + + lldpad_initrc_domtrans($1) + domain_system_change_exemption($1) + role_transition $2 lldpad_initrc_exec_t system_r; + allow $2 system_r; + + files_search_var_lib($1) + admin_pattern($1, lldpad_var_lib_t) + + files_search_pids($1) + admin_pattern($1, lldpad_var_run_t) + +') + diff --git a/lldpad.te b/lldpad.te new file mode 100644 index 0000000..c38f564 --- /dev/null +++ b/lldpad.te @@ -0,0 +1,70 @@ +policy_module(lldpad, 1.0.0) + +######################################## +# +# Declarations +# + +type lldpad_t; +type lldpad_exec_t; +init_daemon_domain(lldpad_t, lldpad_exec_t) + +type lldpad_initrc_exec_t; +init_script_file(lldpad_initrc_exec_t) + +type lldpad_tmpfs_t; +files_tmpfs_file(lldpad_tmpfs_t) + +type lldpad_var_lib_t; +files_type(lldpad_var_lib_t) + +type lldpad_var_run_t; +files_pid_file(lldpad_var_run_t) + +######################################## +# +# lldpad local policy +# + +allow lldpad_t self:capability { net_admin net_raw }; +ifdef(`hide_broken_symptoms',` + # caused by some bogus kernel code + dontaudit lldpad_t self:capability sys_module; +') + +allow lldpad_t self:shm create_shm_perms; +allow lldpad_t self:fifo_file rw_fifo_file_perms; + +allow lldpad_t self:unix_stream_socket create_stream_socket_perms; +allow lldpad_t self:netlink_route_socket create_netlink_socket_perms; +allow lldpad_t self:packet_socket create_socket_perms; +allow lldpad_t self:udp_socket create_socket_perms; + +manage_files_pattern(lldpad_t,lldpad_tmpfs_t,lldpad_tmpfs_t) +fs_tmpfs_filetrans(lldpad_t,lldpad_tmpfs_t,file) + +manage_dirs_pattern(lldpad_t, lldpad_var_lib_t, lldpad_var_lib_t) +manage_files_pattern(lldpad_t, lldpad_var_lib_t, lldpad_var_lib_t) + +manage_dirs_pattern(lldpad_t, lldpad_var_run_t, lldpad_var_run_t) +manage_files_pattern(lldpad_t, lldpad_var_run_t, lldpad_var_run_t) +manage_sock_files_pattern(lldpad_t, lldpad_var_run_t, lldpad_var_run_t) +# this needs to be fixed in lldpad package +# bug: # +files_pid_filetrans(lldpad_t, lldpad_var_run_t, { dir file sock_file }) + +kernel_read_all_sysctls(lldpad_t) +kernel_read_network_state(lldpad_t) +kernel_request_load_module(lldpad_t) + +dev_read_sysfs(lldpad_t) + +files_read_etc_files(lldpad_t) + +logging_send_syslog_msg(lldpad_t) + +userdom_dgram_send(lldpad_t) + +optional_policy(` + fcoemon_dgram_send(lldpad_t) +') diff --git a/loadkeys.fc b/loadkeys.fc index 8549f9f..68be454 100644 --- a/loadkeys.fc +++ b/loadkeys.fc @@ -1,3 +1,3 @@ -/bin/loadkeys -- gen_context(system_u:object_r:loadkeys_exec_t,s0) -/bin/unikeys -- gen_context(system_u:object_r:loadkeys_exec_t,s0) +/usr/bin/loadkeys -- gen_context(system_u:object_r:loadkeys_exec_t,s0) +/usr/bin/unikeys -- gen_context(system_u:object_r:loadkeys_exec_t,s0) diff --git a/loadkeys.te b/loadkeys.te index 2523758..96308b5 100644 --- a/loadkeys.te +++ b/loadkeys.te @@ -31,14 +31,15 @@ files_read_etc_runtime_files(loadkeys_t) term_dontaudit_use_console(loadkeys_t) term_use_unallocated_ttys(loadkeys_t) +auth_read_passwd(loadkeys_t) + init_dontaudit_use_fds(loadkeys_t) init_dontaudit_use_script_ptys(loadkeys_t) locallogin_use_fds(loadkeys_t) -miscfiles_read_localization(loadkeys_t) -userdom_use_user_ttys(loadkeys_t) +userdom_use_inherited_user_ttys(loadkeys_t) userdom_list_user_home_content(loadkeys_t) ifdef(`hide_broken_symptoms',` @@ -46,5 +47,9 @@ ifdef(`hide_broken_symptoms',` ') optional_policy(` + keyboardd_read_pipes(loadkeys_t) +') + +optional_policy(` nscd_dontaudit_search_pid(loadkeys_t) ') diff --git a/lockdev.te b/lockdev.te index 572b5db..1e55f43 100644 --- a/lockdev.te +++ b/lockdev.te @@ -34,4 +34,5 @@ fs_getattr_xattr_fs(lockdev_t) logging_send_syslog_msg(lockdev_t) -userdom_use_user_terminals(lockdev_t) +userdom_use_inherited_user_terminals(lockdev_t) + diff --git a/logrotate.te b/logrotate.te index 7090dae..9811b26 100644 --- a/logrotate.te +++ b/logrotate.te @@ -29,9 +29,7 @@ files_type(logrotate_var_lib_t) # # Change ownership on log files. -allow logrotate_t self:capability { chown dac_override dac_read_search kill fsetid fowner sys_resource sys_nice }; -# for mailx -dontaudit logrotate_t self:capability { setuid setgid sys_ptrace }; +allow logrotate_t self:capability { chown dac_override dac_read_search kill fsetid fowner setuid setgid sys_resource sys_nice }; allow logrotate_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; @@ -39,6 +37,7 @@ allow logrotate_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimi allow logrotate_t self:process setfscreate; allow logrotate_t self:fd use; +allow logrotate_t self:key manage_key_perms; allow logrotate_t self:fifo_file rw_fifo_file_perms; allow logrotate_t self:unix_dgram_socket create_socket_perms; allow logrotate_t self:unix_stream_socket create_stream_socket_perms; @@ -61,6 +60,7 @@ files_tmp_filetrans(logrotate_t, logrotate_tmp_t, { file dir }) # for /var/lib/logrotate.status and /var/lib/logcheck create_dirs_pattern(logrotate_t, logrotate_var_lib_t, logrotate_var_lib_t) manage_files_pattern(logrotate_t, logrotate_var_lib_t, logrotate_var_lib_t) +read_lnk_files_pattern(logrotate_t, logrotate_var_lib_t, logrotate_var_lib_t) files_var_lib_filetrans(logrotate_t, logrotate_var_lib_t, file) kernel_read_system_state(logrotate_t) @@ -75,6 +75,7 @@ fs_list_inotifyfs(logrotate_t) mls_file_read_all_levels(logrotate_t) mls_file_write_all_levels(logrotate_t) mls_file_upgrade(logrotate_t) +mls_process_write_to_clearance(logrotate_t) selinux_get_fs_mount(logrotate_t) selinux_get_enforce_mode(logrotate_t) @@ -85,6 +86,7 @@ auth_use_nsswitch(logrotate_t) # Run helper programs. corecmd_exec_bin(logrotate_t) corecmd_exec_shell(logrotate_t) +corecmd_getattr_all_executables(logrotate_t) domain_signal_all_domains(logrotate_t) domain_use_interactive_fds(logrotate_t) @@ -93,7 +95,6 @@ domain_getattr_all_entry_files(logrotate_t) domain_read_all_domains_state(logrotate_t) files_read_usr_files(logrotate_t) -files_read_etc_files(logrotate_t) files_read_etc_runtime_files(logrotate_t) files_read_all_pids(logrotate_t) files_search_all(logrotate_t) @@ -102,6 +103,7 @@ files_read_var_lib_files(logrotate_t) files_manage_generic_spool(logrotate_t) files_manage_generic_spool_dirs(logrotate_t) files_getattr_generic_locks(logrotate_t) +files_dontaudit_list_mnt(logrotate_t) # cjp: why is this needed? init_domtrans_script(logrotate_t) @@ -112,21 +114,21 @@ logging_send_audit_msgs(logrotate_t) # cjp: why is this needed? logging_exec_all_logs(logrotate_t) -miscfiles_read_localization(logrotate_t) seutil_dontaudit_read_config(logrotate_t) -userdom_use_user_terminals(logrotate_t) +systemd_exec_systemctl(logrotate_t) +systemd_getattr_unit_files(logrotate_t) +init_stream_connect(logrotate_t) + +userdom_use_inherited_user_terminals(logrotate_t) userdom_list_user_home_dirs(logrotate_t) userdom_use_unpriv_users_fds(logrotate_t) - -cron_system_entry(logrotate_t, logrotate_exec_t) -cron_search_spool(logrotate_t) - -mta_send_mail(logrotate_t) +userdom_dontaudit_list_admin_dir(logrotate_t) +userdom_dontaudit_getattr_user_home_content(logrotate_t) ifdef(`distro_debian', ` - allow logrotate_t logrotate_tmp_t:file { relabelfrom relabelto }; + allow logrotate_t logrotate_tmp_t:file relabel_file_perms; # for savelog can_exec(logrotate_t, logrotate_exec_t) @@ -138,7 +140,7 @@ ifdef(`distro_debian', ` ') optional_policy(` - abrt_cache_manage(logrotate_t) + abrt_manage_cache(logrotate_t) ') optional_policy(` @@ -154,6 +156,10 @@ optional_policy(` ') optional_policy(` + awstats_domtrans(logrotate_t) +') + +optional_policy(` asterisk_domtrans(logrotate_t) ') @@ -162,10 +168,20 @@ optional_policy(` ') optional_policy(` + callweaver_exec(logrotate_t) + callweaver_stream_connect(logrotate_t) +') + +optional_policy(` consoletype_exec(logrotate_t) ') optional_policy(` + cron_system_entry(logrotate_t, logrotate_exec_t) + cron_search_spool(logrotate_t) +') + +optional_policy(` cups_domtrans(logrotate_t) ') @@ -178,6 +194,10 @@ optional_policy(` ') optional_policy(` + chronyd_read_keys(logrotate_t) +') + +optional_policy(` icecast_signal(logrotate_t) ') @@ -194,15 +214,19 @@ optional_policy(` ') optional_policy(` + mysql_read_home_content(logrotate_t) mysql_read_config(logrotate_t) mysql_search_db(logrotate_t) mysql_stream_connect(logrotate_t) ') optional_policy(` - psad_domtrans(logrotate_t) + polipo_named_filetrans_log_files(logrotate_t) ') +optional_policy(` + psad_domtrans(logrotate_t) +') optional_policy(` samba_exec_log(logrotate_t) @@ -228,3 +252,14 @@ optional_policy(` optional_policy(` varnishd_manage_log(logrotate_t) ') + +####################################### +# +# logrotate_mail local policy +# + +mta_base_mail_template(logrotate) +mta_sendmail_domtrans(logrotate_t, logrotate_mail_t) +role system_r types logrotate_mail_t; +logging_read_all_logs(logrotate_mail_t) +manage_files_pattern(logrotate_mail_t, logrotate_tmp_t, logrotate_tmp_t) diff --git a/logwatch.fc b/logwatch.fc index 3c7b1e8..1e155f5 100644 --- a/logwatch.fc +++ b/logwatch.fc @@ -1,7 +1,11 @@ /usr/sbin/logcheck -- gen_context(system_u:object_r:logwatch_exec_t,s0) +/usr/sbin/epylog -- gen_context(system_u:object_r:logwatch_exec_t,s0) /usr/share/logwatch/scripts/logwatch\.pl -- gen_context(system_u:object_r:logwatch_exec_t, s0) /var/cache/logwatch(/.*)? gen_context(system_u:object_r:logwatch_cache_t, s0) /var/lib/logcheck(/.*)? gen_context(system_u:object_r:logwatch_cache_t,s0) +/var/lib/epylog(/.*)? gen_context(system_u:object_r:logwatch_cache_t,s0) /var/log/logcheck/.+ -- gen_context(system_u:object_r:logwatch_lock_t,s0) + +/var/run/epylog\.pid gen_context(system_u:object_r:logwatch_var_run_t,s0) diff --git a/logwatch.te b/logwatch.te index 75ce30f..9279c2d 100644 --- a/logwatch.te +++ b/logwatch.te @@ -7,6 +7,7 @@ policy_module(logwatch, 1.11.0) type logwatch_t; type logwatch_exec_t; +init_daemon_domain(logwatch_t, logwatch_exec_t) application_domain(logwatch_t, logwatch_exec_t) role system_r types logwatch_t; @@ -19,6 +20,12 @@ files_lock_file(logwatch_lock_t) type logwatch_tmp_t; files_tmp_file(logwatch_tmp_t) +type logwatch_var_run_t; +files_pid_file(logwatch_var_run_t) + +mta_base_mail_template(logwatch) +role system_r types logwatch_mail_t; + ######################################## # # Local policy @@ -39,6 +46,9 @@ manage_dirs_pattern(logwatch_t, logwatch_tmp_t, logwatch_tmp_t) manage_files_pattern(logwatch_t, logwatch_tmp_t, logwatch_tmp_t) files_tmp_filetrans(logwatch_t, logwatch_tmp_t, { file dir }) +allow logwatch_t logwatch_var_run_t:file manage_file_perms; +files_pid_filetrans(logwatch_t, logwatch_var_run_t, file) + kernel_read_fs_sysctls(logwatch_t) kernel_read_kernel_sysctls(logwatch_t) kernel_read_system_state(logwatch_t) @@ -56,8 +66,8 @@ domain_read_all_domains_state(logwatch_t) files_list_var(logwatch_t) files_read_var_symlinks(logwatch_t) -files_read_etc_files(logwatch_t) files_read_etc_runtime_files(logwatch_t) +files_read_system_conf_files(logwatch_t) files_read_usr_files(logwatch_t) files_search_spool(logwatch_t) files_search_mnt(logwatch_t) @@ -70,6 +80,10 @@ fs_getattr_all_fs(logwatch_t) fs_dontaudit_list_auto_mountpoints(logwatch_t) fs_list_inotifyfs(logwatch_t) +storage_dontaudit_getattr_fixed_disk_dev(logwatch_t) + +mls_file_read_to_clearance(logwatch_t) + term_dontaudit_getattr_pty_dirs(logwatch_t) term_dontaudit_list_ptys(logwatch_t) @@ -84,19 +98,19 @@ libs_read_lib_files(logwatch_t) logging_read_all_logs(logwatch_t) logging_send_syslog_msg(logwatch_t) -miscfiles_read_localization(logwatch_t) - selinux_dontaudit_getattr_dir(logwatch_t) -sysnet_dns_name_resolve(logwatch_t) sysnet_exec_ifconfig(logwatch_t) userdom_dontaudit_search_user_home_dirs(logwatch_t) +userdom_dontaudit_list_admin_dir(logwatch_t) -mta_send_mail(logwatch_t) +#mta_send_mail(logwatch_t) +mta_sendmail_domtrans(logwatch_t, logwatch_mail_t) ifdef(`distro_redhat',` files_search_all(logwatch_t) + files_getattr_all_files(logwatch_t) files_getattr_all_file_type_fs(logwatch_t) ') @@ -145,3 +159,24 @@ optional_policy(` samba_read_log(logwatch_t) samba_read_share_files(logwatch_t) ') + +######################################## +# +# Logwatch mail Local policy +# + +allow logwatch_mail_t self:capability { dac_read_search dac_override }; + +manage_files_pattern(logwatch_mail_t, logwatch_tmp_t, logwatch_tmp_t) + +dev_read_rand(logwatch_mail_t) +dev_read_urand(logwatch_mail_t) +dev_read_sysfs(logwatch_mail_t) + +logging_read_all_logs(logwatch_mail_t) + +mta_read_home(logwatch_mail_t) + +optional_policy(` + cron_use_system_job_fds(logwatch_mail_t) +') diff --git a/lpd.fc b/lpd.fc index 5c9eb68..e4f3c24 100644 --- a/lpd.fc +++ b/lpd.fc @@ -24,7 +24,7 @@ /usr/sbin/lpinfo -- gen_context(system_u:object_r:lpr_exec_t,s0) /usr/sbin/lpmove -- gen_context(system_u:object_r:lpr_exec_t,s0) -/usr/local/linuxprinter/bin/l?lpr -- gen_context(system_u:object_r:lpr_exec_t,s0) +/usr/linuxprinter/bin/l?lpr -- gen_context(system_u:object_r:lpr_exec_t,s0) /usr/share/printconf/.* -- gen_context(system_u:object_r:printconf_t,s0) @@ -35,3 +35,4 @@ /var/spool/cups-pdf(/.*)? gen_context(system_u:object_r:print_spool_t,mls_systemhigh) /var/spool/lpd(/.*)? gen_context(system_u:object_r:print_spool_t,s0) /var/run/lprng(/.*)? gen_context(system_u:object_r:lpd_var_run_t,s0) +/var/spool/turboprint(/.*)? gen_context(system_u:object_r:lpd_var_run_t,mls_systemhigh) diff --git a/lpd.if b/lpd.if index a4f32f5..628b63c 100644 --- a/lpd.if +++ b/lpd.if @@ -14,6 +14,7 @@ ## User domain for the role ## ## +## # interface(`lpd_role',` gen_require(` @@ -27,7 +28,10 @@ interface(`lpd_role',` dontaudit lpr_t $2:unix_stream_socket { read write }; ps_process_pattern($2, lpr_t) - allow $2 lpr_t:process signull; + allow $2 lpr_t:process signal_perms; + tunable_policy(`deny_ptrace',`',` + allow $2 lpr_t:process ptrace; + ') optional_policy(` cups_read_config($2) @@ -153,7 +157,7 @@ interface(`lpd_relabel_spool',` ') files_search_spool($1) - allow $1 print_spool_t:file { relabelto relabelfrom }; + allow $1 print_spool_t:file relabel_file_perms; ') ######################################## @@ -186,7 +190,7 @@ interface(`lpd_read_config',` ## ## # -template(`lpd_domtrans_lpr',` +interface(`lpd_domtrans_lpr',` gen_require(` type lpr_t, lpr_exec_t; ') @@ -196,6 +200,32 @@ template(`lpd_domtrans_lpr',` ######################################## ## +## Execute lpr in the lpr domain, and +## allow the specified role the lpr domain. +## +## +## +## Domain allowed to transition. +## +## +## +## +## Role allowed access. +## +## +## +# +interface(`lpd_run_lpr',` + gen_require(` + type lpr_t; + ') + + lpd_domtrans_lpr($1) + role $2 types lpr_t; +') + +######################################## +## ## Allow the specified domain to execute lpr ## in the caller domain. ## diff --git a/lpd.te b/lpd.te index a03b63a..330ee1d 100644 --- a/lpd.te +++ b/lpd.te @@ -45,14 +45,14 @@ userdom_user_tmp_file(lpr_tmp_t) type print_spool_t; typealias print_spool_t alias { user_print_spool_t staff_print_spool_t sysadm_print_spool_t }; typealias print_spool_t alias { auditadm_print_spool_t secadm_print_spool_t }; -files_type(print_spool_t) +files_spool_file(print_spool_t) ubac_constrained(print_spool_t) type printer_t; files_type(printer_t) type printconf_t; -files_type(printconf_t) +files_config_file(printconf_t) ######################################## # @@ -78,12 +78,11 @@ rw_files_pattern(checkpc_t, print_spool_t, print_spool_t) delete_files_pattern(checkpc_t, print_spool_t, print_spool_t) files_search_spool(checkpc_t) -allow checkpc_t printconf_t:file getattr; +allow checkpc_t printconf_t:file getattr_file_perms; allow checkpc_t printconf_t:dir list_dir_perms; kernel_read_system_state(checkpc_t) -corenet_all_recvfrom_unlabeled(checkpc_t) corenet_all_recvfrom_netlabel(checkpc_t) corenet_tcp_sendrecv_generic_if(checkpc_t) corenet_udp_sendrecv_generic_if(checkpc_t) @@ -102,7 +101,6 @@ corecmd_exec_bin(checkpc_t) domain_use_interactive_fds(checkpc_t) -files_read_etc_files(checkpc_t) files_read_etc_runtime_files(checkpc_t) init_use_script_ptys(checkpc_t) @@ -111,7 +109,7 @@ init_use_fds(checkpc_t) sysnet_read_config(checkpc_t) -userdom_use_user_terminals(checkpc_t) +userdom_use_inherited_user_terminals(checkpc_t) optional_policy(` cron_system_entry(checkpc_t, checkpc_exec_t) @@ -143,9 +141,10 @@ manage_dirs_pattern(lpd_t, lpd_tmp_t, lpd_tmp_t) manage_files_pattern(lpd_t, lpd_tmp_t, lpd_tmp_t) files_tmp_filetrans(lpd_t, lpd_tmp_t, { file dir }) +manage_dirs_pattern(lpd_t, lpd_var_run_t, lpd_var_run_t) manage_files_pattern(lpd_t, lpd_var_run_t, lpd_var_run_t) manage_sock_files_pattern(lpd_t, lpd_var_run_t, lpd_var_run_t) -files_pid_filetrans(lpd_t, lpd_var_run_t, file) +files_pid_filetrans(lpd_t, lpd_var_run_t, { dir file }) # Write to /var/spool/lpd. manage_files_pattern(lpd_t, print_spool_t, print_spool_t) @@ -163,7 +162,6 @@ kernel_read_kernel_sysctls(lpd_t) # bash wants access to /proc/meminfo kernel_read_system_state(lpd_t) -corenet_all_recvfrom_unlabeled(lpd_t) corenet_all_recvfrom_netlabel(lpd_t) corenet_tcp_sendrecv_generic_if(lpd_t) corenet_udp_sendrecv_generic_if(lpd_t) @@ -197,12 +195,10 @@ files_list_var_lib(lpd_t) files_read_var_lib_files(lpd_t) files_read_var_lib_symlinks(lpd_t) # config files for lpd are of type etc_t, probably should change this -files_read_etc_files(lpd_t) logging_send_syslog_msg(lpd_t) miscfiles_read_fonts(lpd_t) -miscfiles_read_localization(lpd_t) sysnet_read_config(lpd_t) @@ -236,9 +232,9 @@ can_exec(lpr_t, lpr_exec_t) # Allow lpd to read, rename, and unlink spool files. allow lpd_t print_spool_t:file { read_file_perms rename_file_perms delete_file_perms }; +kernel_read_system_state(lpr_t) kernel_read_kernel_sysctls(lpr_t) -corenet_all_recvfrom_unlabeled(lpr_t) corenet_all_recvfrom_netlabel(lpr_t) corenet_tcp_sendrecv_generic_if(lpr_t) corenet_udp_sendrecv_generic_if(lpr_t) @@ -256,7 +252,6 @@ domain_use_interactive_fds(lpr_t) files_search_spool(lpr_t) # for lpd config files (should have a new type) -files_read_etc_files(lpr_t) # for test print files_read_usr_files(lpr_t) #Added to cover read_content macro @@ -271,23 +266,24 @@ term_use_generic_ptys(lpr_t) auth_use_nsswitch(lpr_t) -miscfiles_read_localization(lpr_t) userdom_read_user_tmp_symlinks(lpr_t) # Write to the user domain tty. -userdom_use_user_terminals(lpr_t) +userdom_use_inherited_user_terminals(lpr_t) userdom_read_user_home_content_files(lpr_t) userdom_read_user_tmp_files(lpr_t) +userdom_write_user_tmp_sockets(lpr_t) +userdom_stream_connect(lpr_t) tunable_policy(`use_lpd_server',` # lpr can run in lightweight mode, without a local print spooler. - allow lpr_t lpd_var_run_t:dir search; - allow lpr_t lpd_var_run_t:sock_file write; + allow lpr_t lpd_var_run_t:dir search_dir_perms; + allow lpr_t lpd_var_run_t:sock_file write_sock_file_perms; files_read_var_files(lpr_t) # Connect to lpd via a Unix domain socket. - allow lpr_t printer_t:sock_file rw_sock_file_perms; - allow lpr_t lpd_t:unix_stream_socket connectto; + allow lpr_t printer_t:sock_file read_sock_file_perms; + stream_connect_pattern(lpr_t, printer_t, printer_t, lpd_t) # Send SIGHUP to lpd. allow lpr_t lpd_t:process signal; @@ -305,17 +301,7 @@ tunable_policy(`use_lpd_server',` read_lnk_files_pattern(lpr_t, printconf_t, printconf_t) ') -tunable_policy(`use_nfs_home_dirs',` - fs_list_auto_mountpoints(lpr_t) - fs_read_nfs_files(lpr_t) - fs_read_nfs_symlinks(lpr_t) -') - -tunable_policy(`use_samba_home_dirs',` - fs_list_auto_mountpoints(lpr_t) - fs_read_cifs_files(lpr_t) - fs_read_cifs_symlinks(lpr_t) -') +userdom_home_reader(lpr_t) optional_policy(` cups_read_config(lpr_t) @@ -324,5 +310,13 @@ optional_policy(` ') optional_policy(` + gnome_stream_connect_gkeyringd(lpr_t) +') + +optional_policy(` logging_send_syslog_msg(lpr_t) ') + +optional_policy(` + mozilla_plugin_dontaudit_rw_tmp_files(lpr_t) +') diff --git a/mailman.fc b/mailman.fc index 1083f98..c7daa85 100644 --- a/mailman.fc +++ b/mailman.fc @@ -1,11 +1,14 @@ -/usr/lib/mailman/bin/mailmanctl -- gen_context(system_u:object_r:mailman_mail_exec_t,s0) -/usr/lib/mailman/cron/.* -- gen_context(system_u:object_r:mailman_queue_exec_t,s0) -/var/lib/mailman(/.*)? gen_context(system_u:object_r:mailman_data_t,s0) -/var/lib/mailman/archives(/.*)? gen_context(system_u:object_r:mailman_archive_t,s0) -/var/lock/mailman(/.*)? gen_context(system_u:object_r:mailman_lock_t,s0) -/var/log/mailman(/.*)? gen_context(system_u:object_r:mailman_log_t,s0) -/var/run/mailman(/.*)? gen_context(system_u:object_r:mailman_lock_t,s0) +/usr/lib/mailman.*/bin/mailmanctl -- gen_context(system_u:object_r:mailman_mail_exec_t,s0) +/usr/lib/mailman.*/bin/mm-handler.* -- gen_context(system_u:object_r:mailman_mail_exec_t,s0) +/usr/lib/mailman.*/cron/.* -- gen_context(system_u:object_r:mailman_queue_exec_t,s0) +/usr/share/doc/mailman.*/mm-handler.* -- gen_context(system_u:object_r:mailman_mail_exec_t,s0) + +/var/lib/mailman.* gen_context(system_u:object_r:mailman_data_t,s0) +/var/lib/mailman.*/archives(/.*)? gen_context(system_u:object_r:mailman_archive_t,s0) +/var/lock/mailman.* gen_context(system_u:object_r:mailman_lock_t,s0) +/var/log/mailman.* gen_context(system_u:object_r:mailman_log_t,s0) +/var/run/mailman.* gen_context(system_u:object_r:mailman_var_run_t,s0) # # distro_debian @@ -23,12 +26,12 @@ ifdef(`distro_debian', ` # distro_redhat # ifdef(`distro_redhat', ` -/etc/mailman(/.*)? gen_context(system_u:object_r:mailman_data_t,s0) +/etc/mailman.* gen_context(system_u:object_r:mailman_data_t,s0) -/usr/lib/mailman/bin/qrunner -- gen_context(system_u:object_r:mailman_queue_exec_t,s0) -/usr/lib/mailman/cgi-bin/.* -- gen_context(system_u:object_r:mailman_cgi_exec_t,s0) -/usr/lib/mailman/mail/mailman -- gen_context(system_u:object_r:mailman_mail_exec_t,s0) -/usr/lib/mailman/scripts/mailman -- gen_context(system_u:object_r:mailman_mail_exec_t,s0) +/usr/lib/mailman.*/bin/qrunner -- gen_context(system_u:object_r:mailman_queue_exec_t,s0) +/usr/lib/mailman.*/cgi-bin/.* -- gen_context(system_u:object_r:mailman_cgi_exec_t,s0) +/usr/lib/mailman.*/mail/mailman -- gen_context(system_u:object_r:mailman_mail_exec_t,s0) +/usr/lib/mailman.*/scripts/mailman -- gen_context(system_u:object_r:mailman_mail_exec_t,s0) -/var/spool/mailman(/.*)? gen_context(system_u:object_r:mailman_data_t,s0) +/var/spool/mailman.* gen_context(system_u:object_r:mailman_data_t,s0) ') diff --git a/mailman.if b/mailman.if index 67c7fdd..2f226de 100644 --- a/mailman.if +++ b/mailman.if @@ -54,7 +54,6 @@ template(`mailman_domain_template', ` kernel_read_kernel_sysctls(mailman_$1_t) kernel_read_system_state(mailman_$1_t) - corenet_all_recvfrom_unlabeled(mailman_$1_t) corenet_all_recvfrom_netlabel(mailman_$1_t) corenet_tcp_sendrecv_generic_if(mailman_$1_t) corenet_udp_sendrecv_generic_if(mailman_$1_t) @@ -74,7 +73,7 @@ template(`mailman_domain_template', ` corecmd_exec_all_executables(mailman_$1_t) files_exec_etc_files(mailman_$1_t) - files_list_usr(mailman_$1_t) + files_read_usr_files(mailman_$1_t) files_list_var(mailman_$1_t) files_list_var_lib(mailman_$1_t) files_read_var_lib_symlinks(mailman_$1_t) @@ -87,7 +86,6 @@ template(`mailman_domain_template', ` logging_send_syslog_msg(mailman_$1_t) - miscfiles_read_localization(mailman_$1_t) ') ####################################### @@ -108,6 +106,31 @@ interface(`mailman_domtrans',` domtrans_pattern($1, mailman_mail_exec_t, mailman_mail_t) ') +######################################## +## +## Execute the mailman program in the mailman domain. +## +## +## +## Domain allowed to transition. +## +## +## +## +## The role to allow the mailman domain. +## +## +## +# +interface(`mailman_run',` + gen_require(` + type mailman_mail_t; + ') + + mailman_domtrans($1) + role $2 types mailman_mail_t; +') + ####################################### ## ## Execute mailman CGI scripts in the diff --git a/mailman.te b/mailman.te index 22265f0..09080b8 100644 --- a/mailman.te +++ b/mailman.te @@ -19,6 +19,9 @@ logging_log_file(mailman_log_t) type mailman_lock_t; files_lock_file(mailman_lock_t) +type mailman_var_run_t; +files_pid_file(mailman_var_run_t) + mailman_domain_template(mail) init_daemon_domain(mailman_mail_t, mailman_mail_exec_t) @@ -54,6 +57,9 @@ optional_policy(` apache_search_sys_script_state(mailman_cgi_t) apache_read_config(mailman_cgi_t) apache_dontaudit_rw_stream_sockets(mailman_cgi_t) + + postfix_read_config(mailman_cgi_t) + ') ######################################## @@ -69,6 +75,16 @@ manage_dirs_pattern(mailman_mail_t, mailman_archive_t, mailman_archive_t) manage_files_pattern(mailman_mail_t, mailman_archive_t, mailman_archive_t) manage_lnk_files_pattern(mailman_mail_t, mailman_archive_t, mailman_archive_t) +manage_files_pattern(mailman_mail_t, mailman_var_run_t, mailman_var_run_t) +manage_dirs_pattern(mailman_mail_t, mailman_var_run_t, mailman_var_run_t) +files_pid_filetrans(mailman_mail_t, mailman_var_run_t, { file dir }) + +# make NNTP gateway working +corenet_tcp_connect_innd_port(mailman_mail_t) +corenet_tcp_connect_spamd_port(mailman_mail_t) + +dev_read_urand(mailman_mail_t) + files_search_spool(mailman_mail_t) fs_rw_anon_inodefs_files(mailman_mail_t) @@ -81,11 +97,16 @@ optional_policy(` ') optional_policy(` + gnome_dontaudit_search_config(mailman_mail_t) +') + +optional_policy(` cron_read_pipes(mailman_mail_t) ') optional_policy(` postfix_search_spool(mailman_mail_t) + postfix_rw_master_pipes(mailman_mail_t) ') ######################################## @@ -104,6 +125,8 @@ manage_lnk_files_pattern(mailman_queue_t, mailman_archive_t, mailman_archive_t) kernel_read_proc_symlinks(mailman_queue_t) +corenet_tcp_connect_innd_port(mailman_queue_t) + auth_domtrans_chk_passwd(mailman_queue_t) files_dontaudit_search_pids(mailman_queue_t) @@ -125,4 +148,4 @@ optional_policy(` optional_policy(` su_exec(mailman_queue_t) -') \ No newline at end of file +') diff --git a/mailscanner.fc b/mailscanner.fc new file mode 100644 index 0000000..827e22e --- /dev/null +++ b/mailscanner.fc @@ -0,0 +1,11 @@ +/etc/MailScanner(/.*)? gen_context(system_u:object_r:mscan_etc_t,s0) + +/etc/rc\.d/init\.d/MailScanner -- gen_context(system_u:object_r:mscan_initrc_exec_t,s0) + +/etc/sysconfig/MailScanner -- gen_context(system_u:object_r:mscan_etc_t,s0) + +/etc/sysconfig/update_spamassassin -- gen_context(system_u:object_r:mscan_etc_t,s0) + +/usr/sbin/MailScanner -- gen_context(system_u:object_r:mscan_exec_t,s0) + +/var/run/MailScanner\.pid -- gen_context(system_u:object_r:mscan_var_run_t,s0) diff --git a/mailscanner.if b/mailscanner.if new file mode 100644 index 0000000..bd1d48e --- /dev/null +++ b/mailscanner.if @@ -0,0 +1,61 @@ +## E-mail security and anti-spam package for e-mail gateway systems. + +######################################## +## +## Execute a domain transition to run +## MailScanner. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`mailscanner_initrc_domtrans',` + gen_require(` + type mscan_initrc_exec_t; + ') + + init_labeled_script_domtrans($1, mscan_initrc_exec_t) +') + +######################################## +## +## All of the rules required to administrate +## an mailscanner environment. +## +## +## +## Domain allowed access. +## +## +## +## +## Role allowed access. +## +## +## +# +interface(`mailscanner_admin',` + gen_require(` + type mscan_t, mscan_var_run_t, mscan_etc_t; + type mscan_initrc_exec_t; + ') + + mailscanner_initrc_domtrans($1) + domain_system_change_exemption($1) + role_transition $2 mscan_initrc_exec_t system_r; + allow $2 system_r; + + allow $1 mscan_t:process signal_perms; + ps_process_pattern($1, mscan_t) + tunable_policy(`deny_ptrace',`',` + allow $1 mscan_t:process ptrace; + ') + + admin_pattern($1, mscan_etc_t) + files_list_etc($1) + + admin_pattern($1, mscan_var_run_t) + files_list_pids($1) +') diff --git a/mailscanner.te b/mailscanner.te new file mode 100644 index 0000000..45f3262 --- /dev/null +++ b/mailscanner.te @@ -0,0 +1,85 @@ +policy_module(mailscanner, 1.0.0) + +######################################## +# +# Declarations +# + +type mscan_t; +type mscan_exec_t; +init_daemon_domain(mscan_t, mscan_exec_t) + +type mscan_initrc_exec_t; +init_script_file(mscan_initrc_exec_t) + +type mscan_etc_t; +files_config_file(mscan_etc_t) + +type mscan_tmp_t; +files_tmp_file(mscan_tmp_t) + +type mscan_var_run_t; +files_pid_file(mscan_var_run_t) + +######################################## +# +# Local policy +# + +allow mscan_t self:capability { setuid chown setgid dac_override }; +allow mscan_t self:process signal; +allow mscan_t self:fifo_file rw_fifo_file_perms; + +read_files_pattern(mscan_t, mscan_etc_t, mscan_etc_t) + +manage_files_pattern(mscan_t, mscan_var_run_t, mscan_var_run_t) +files_pid_filetrans(mscan_t, mscan_var_run_t, file) + +manage_dirs_pattern(mscan_t, mscan_tmp_t, mscan_tmp_t) +manage_files_pattern(mscan_t, mscan_tmp_t, mscan_tmp_t) +files_tmp_filetrans(mscan_t, mscan_tmp_t, { dir file }) + +can_exec(mscan_t, mscan_exec_t) + +kernel_read_system_state(mscan_t) + +corecmd_exec_bin(mscan_t) +corecmd_exec_shell(mscan_t) + +corenet_tcp_connect_fprot_port(mscan_t) +corenet_tcp_sendrecv_fprot_port(mscan_t) +corenet_sendrecv_fprot_client_packets(mscan_t) +corenet_udp_bind_generic_node(mscan_t) +corenet_udp_bind_generic_port(mscan_t) +corenet_udp_sendrecv_all_ports(mscan_t) +corenet_sendrecv_generic_server_packets(mscan_t) + +dev_read_urand(mscan_t) + +files_read_usr_files(mscan_t) + +fs_getattr_xattr_fs(mscan_t) + +auth_dontaudit_read_shadow(mscan_t) +auth_use_nsswitch(mscan_t) + +logging_send_syslog_msg(mscan_t) + +optional_policy(` + clamav_domtrans_clamscan(mscan_t) + clamav_manage_clamd_pid(mscan_t) +') + +optional_policy(` + mta_send_mail(mscan_t) + mta_manage_queue(mscan_t) +') + +optional_policy(` + procmail_domtrans(mscan_t) +') + +optional_policy(` + spamassassin_read_home_client(mscan_t) + spamassassin_read_lib_files(mscan_t) +') diff --git a/man2html.fc b/man2html.fc new file mode 100644 index 0000000..2907017 --- /dev/null +++ b/man2html.fc @@ -0,0 +1,5 @@ +/usr/lib/man2html/cgi-bin/man/man2html -- gen_context(system_u:object_r:httpd_man2html_script_exec_t,s0) +/usr/lib/man2html/cgi-bin/man/mansec -- gen_context(system_u:object_r:httpd_man2html_script_exec_t,s0) +/usr/lib/man2html/cgi-bin/man/manwhatis -- gen_context(system_u:object_r:httpd_man2html_script_exec_t,s0) + +/var/cache/man2html(/.*)? gen_context(system_u:object_r:httpd_man2html_script_cache_t,s0) diff --git a/man2html.if b/man2html.if new file mode 100644 index 0000000..050157a --- /dev/null +++ b/man2html.if @@ -0,0 +1,127 @@ + +## policy for httpd_man2html_script + +######################################## +## +## Transition to httpd_man2html_script. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`httpd_man2html_script_domtrans',` + gen_require(` + type httpd_man2html_script_t, httpd_man2html_script_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, httpd_man2html_script_exec_t, httpd_man2html_script_t) +') + +######################################## +## +## Search httpd_man2html_script cache directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`httpd_man2html_script_search_cache',` + gen_require(` + type httpd_man2html_script_cache_t; + ') + + allow $1 httpd_man2html_script_cache_t:dir search_dir_perms; + files_search_var($1) +') + +######################################## +## +## Read httpd_man2html_script cache files. +## +## +## +## Domain allowed access. +## +## +# +interface(`httpd_man2html_script_read_cache_files',` + gen_require(` + type httpd_man2html_script_cache_t; + ') + + files_search_var($1) + read_files_pattern($1, httpd_man2html_script_cache_t, httpd_man2html_script_cache_t) +') + +######################################## +## +## Create, read, write, and delete +## httpd_man2html_script cache files. +## +## +## +## Domain allowed access. +## +## +# +interface(`httpd_man2html_script_manage_cache_files',` + gen_require(` + type httpd_man2html_script_cache_t; + ') + + files_search_var($1) + manage_files_pattern($1, httpd_man2html_script_cache_t, httpd_man2html_script_cache_t) +') + +######################################## +## +## Manage httpd_man2html_script cache dirs. +## +## +## +## Domain allowed access. +## +## +# +interface(`httpd_man2html_script_manage_cache_dirs',` + gen_require(` + type httpd_man2html_script_cache_t; + ') + + files_search_var($1) + manage_dirs_pattern($1, httpd_man2html_script_cache_t, httpd_man2html_script_cache_t) +') + + +######################################## +## +## All of the rules required to administrate +## an httpd_man2html_script environment +## +## +## +## Domain allowed access. +## +## +# +interface(`httpd_man2html_script_admin',` + gen_require(` + type httpd_man2html_script_t; + type httpd_man2html_script_cache_t; + ') + + allow $1 httpd_man2html_script_t:process { ptrace signal_perms }; + ps_process_pattern($1, httpd_man2html_script_t) + + files_search_var($1) + admin_pattern($1, httpd_man2html_script_cache_t) + optional_policy(` + systemd_passwd_agent_exec($1) + systemd_read_fifo_file_passwd_run($1) + ') +') diff --git a/man2html.te b/man2html.te new file mode 100644 index 0000000..2fc542b --- /dev/null +++ b/man2html.te @@ -0,0 +1,30 @@ +policy_module(man2html, 1.0.0) + +######################################## +# +# Declarations +# + +apache_content_template(man2html) + +type httpd_man2html_script_cache_t; +files_type(httpd_man2html_script_cache_t) + +######################################## +# +# httpd_man2html_script local policy +# + +allow httpd_man2html_script_t self:process { fork }; + + +manage_dirs_pattern(httpd_man2html_script_t, httpd_man2html_script_cache_t, httpd_man2html_script_cache_t) +manage_files_pattern(httpd_man2html_script_t, httpd_man2html_script_cache_t, httpd_man2html_script_cache_t) +manage_lnk_files_pattern(httpd_man2html_script_t, httpd_man2html_script_cache_t, httpd_man2html_script_cache_t) +files_var_filetrans(httpd_man2html_script_t, httpd_man2html_script_cache_t, { dir file }) + +domain_use_interactive_fds(httpd_man2html_script_t) + +files_read_etc_files(httpd_man2html_script_t) + +miscfiles_read_man_pages(httpd_man2html_script_t) diff --git a/mcelog.fc b/mcelog.fc index 56c43c0..409bbfc 100644 --- a/mcelog.fc +++ b/mcelog.fc @@ -1 +1,5 @@ /usr/sbin/mcelog -- gen_context(system_u:object_r:mcelog_exec_t,s0) + +/var/log/mcelog.* -- gen_context(system_u:object_r:mcelog_log_t,s0) + +/var/run/mcelog.* gen_context(system_u:object_r:mcelog_var_run_t,s0) diff --git a/mcelog.te b/mcelog.te index 5671977..99a63b2 100644 --- a/mcelog.te +++ b/mcelog.te @@ -7,8 +7,14 @@ policy_module(mcelog, 1.1.0) type mcelog_t; type mcelog_exec_t; +init_system_domain(mcelog_t, mcelog_exec_t) application_domain(mcelog_t, mcelog_exec_t) -cron_system_entry(mcelog_t, mcelog_exec_t) + +type mcelog_var_run_t; +files_pid_file(mcelog_var_run_t) + +type mcelog_log_t; +logging_log_file(mcelog_log_t) ######################################## # @@ -17,16 +23,33 @@ cron_system_entry(mcelog_t, mcelog_exec_t) allow mcelog_t self:capability sys_admin; +manage_files_pattern(mcelog_t, mcelog_log_t, mcelog_log_t) +manage_dirs_pattern(mcelog_t, mcelog_log_t, mcelog_log_t) +logging_log_filetrans(mcelog_t, mcelog_log_t, { file dir }) + +manage_files_pattern(mcelog_t, mcelog_var_run_t, mcelog_var_run_t) +manage_dirs_pattern(mcelog_t, mcelog_var_run_t, mcelog_var_run_t) +manage_sock_files_pattern(mcelog_t, mcelog_var_run_t, mcelog_var_run_t) +files_pid_filetrans(mcelog_t, mcelog_var_run_t, { dir file sock_file } ) + kernel_read_system_state(mcelog_t) +corecmd_exec_shell(mcelog_t) +corecmd_exec_bin(mcelog_t) + dev_read_raw_memory(mcelog_t) dev_read_kmsg(mcelog_t) +dev_rw_sysfs(mcelog_t) files_read_etc_files(mcelog_t) # for /dev/mem access mls_file_read_all_levels(mcelog_t) +auth_read_passwd(mcelog_t) + logging_send_syslog_msg(mcelog_t) -miscfiles_read_localization(mcelog_t) +optional_policy(` + cron_system_entry(mcelog_t, mcelog_exec_t) +') diff --git a/mediawiki.if b/mediawiki.if index 98d28b4..1c1d012 100644 --- a/mediawiki.if +++ b/mediawiki.if @@ -1 +1,40 @@ ## Mediawiki policy + +####################################### +## +## Allow the specified domain to read +## mediawiki tmp files. +## +## +## +## Domain allowed access. +## +## +# +interface(`mediawiki_read_tmp_files',` + gen_require(` + type httpd_mediawiki_tmp_t; + ') + + files_search_tmp($1) + read_files_pattern($1, httpd_mediawiki_tmp_t, httpd_mediawiki_tmp_t) + read_lnk_files_pattern($1, httpd_mediawiki_tmp_t, httpd_mediawiki_tmp_t) +') + +####################################### +## +## Delete mediawiki tmp files. +## +## +## +## Domain allowed access. +## +## +# +interface(`mediawiki_delete_tmp_files',` + gen_require(` + type httpd_mediawiki_tmp_t; + ') + + delete_files_pattern($1, httpd_mediawiki_tmp_t, httpd_mediawiki_tmp_t) +') diff --git a/memcached.fc b/memcached.fc index 4d69477..d3b4f39 100644 --- a/memcached.fc +++ b/memcached.fc @@ -2,4 +2,5 @@ /usr/bin/memcached -- gen_context(system_u:object_r:memcached_exec_t,s0) +/var/run/ipa_memcached(/.*)? gen_context(system_u:object_r:memcached_var_run_t,s0) /var/run/memcached(/.*)? gen_context(system_u:object_r:memcached_var_run_t,s0) diff --git a/memcached.if b/memcached.if index db4fd6f..650014e 100644 --- a/memcached.if +++ b/memcached.if @@ -40,6 +40,44 @@ interface(`memcached_read_pid_files',` ######################################## ## +## Manage memcached PID files +## +## +## +## Domain allowed access. +## +## +# +interface(`memcached_manage_pid_files',` + gen_require(` + type memcached_var_run_t; + ') + + files_search_pids($1) + manage_files_pattern($1, memcached_var_run_t, memcached_var_run_t) +') + +######################################## +## +## Connect to memcached over a unix stream socket. +## +## +## +## Domain allowed access. +## +## +# +interface(`memcached_stream_connect',` + gen_require(` + type memcached_t, memcached_var_run_t; + ') + + files_search_pids($1) + stream_connect_pattern($1, memcached_var_run_t, memcached_var_run_t, memcached_t) +') + +######################################## +## ## All of the rules required to administrate ## an memcached environment ## @@ -57,17 +95,20 @@ interface(`memcached_read_pid_files',` # interface(`memcached_admin',` gen_require(` - type memcached_t; - type memcached_initrc_exec_t; + type memcached_t, memcached_initrc_exec_t, memcached_var_run_t; ') - allow $1 memcached_t:process { ptrace signal_perms }; + allow $1 memcached_t:process signal_perms; ps_process_pattern($1, memcached_t) + tunable_policy(`deny_ptrace',`',` + allow $1 memcached_t:process ptrace; + ') init_labeled_script_domtrans($1, memcached_initrc_exec_t) domain_system_change_exemption($1) role_transition $2 memcached_initrc_exec_t system_r; allow $2 system_r; + files_list_pids($1) admin_pattern($1, memcached_var_run_t) ') diff --git a/memcached.te b/memcached.te index b681608..9c4fc55 100644 --- a/memcached.te +++ b/memcached.te @@ -28,7 +28,6 @@ allow memcached_t self:udp_socket { create_socket_perms listen }; allow memcached_t self:fifo_file rw_fifo_file_perms; allow memcached_t self:unix_stream_socket create_stream_socket_perms; -corenet_all_recvfrom_unlabeled(memcached_t) corenet_udp_sendrecv_generic_if(memcached_t) corenet_udp_sendrecv_generic_node(memcached_t) corenet_udp_sendrecv_all_ports(memcached_t) @@ -42,12 +41,12 @@ corenet_udp_bind_memcache_port(memcached_t) manage_dirs_pattern(memcached_t, memcached_var_run_t, memcached_var_run_t) manage_files_pattern(memcached_t, memcached_var_run_t, memcached_var_run_t) -files_pid_filetrans(memcached_t, memcached_var_run_t, { file dir }) +manage_sock_files_pattern(memcached_t, memcached_var_run_t, memcached_var_run_t) +files_pid_filetrans(memcached_t, memcached_var_run_t, { file dir sock_file }) kernel_read_kernel_sysctls(memcached_t) kernel_read_system_state(memcached_t) -files_read_etc_files(memcached_t) term_dontaudit_use_all_ptys(memcached_t) term_dontaudit_use_all_ttys(memcached_t) @@ -55,4 +54,3 @@ term_dontaudit_use_console(memcached_t) auth_use_nsswitch(memcached_t) -miscfiles_read_localization(memcached_t) diff --git a/milter.fc b/milter.fc index 1ec5a6c..9485753 100644 --- a/milter.fc +++ b/milter.fc @@ -1,13 +1,21 @@ +/etc/mail/dkim-milter/keys(/.*)? gen_context(system_u:object_r:dkim_milter_private_key_t,s0) + +/usr/sbin/dkim-filter -- gen_context(system_u:object_r:dkim_milter_exec_t,s0) /usr/sbin/milter-greylist -- gen_context(system_u:object_r:greylist_milter_exec_t,s0) -/usr/sbin/milter-regex -- gen_context(system_u:object_r:regex_milter_exec_t,s0) +/usr/sbin/sqlgrey -- gen_context(system_u:object_r:greylist_milter_exec_t,s0) +/usr/sbin/milter-regex -- gen_context(system_u:object_r:regex_milter_exec_t,s0) /usr/sbin/spamass-milter -- gen_context(system_u:object_r:spamass_milter_exec_t,s0) +/var/lib/dkim-milter(/.*)? gen_context(system_u:object_r:dkim_milter_data_t,s0) /var/lib/milter-greylist(/.*)? gen_context(system_u:object_r:greylist_milter_data_t,s0) +/var/lib/sqlgrey(/.*)? gen_context(system_u:object_r:greylist_milter_data_t,s0) /var/lib/spamass-milter(/.*)? gen_context(system_u:object_r:spamass_milter_state_t,s0) +/var/run/dkim-milter(/.*)? gen_context(system_u:object_r:dkim_milter_data_t,s0) /var/run/milter-greylist(/.*)? gen_context(system_u:object_r:greylist_milter_data_t,s0) /var/run/milter-greylist\.pid -- gen_context(system_u:object_r:greylist_milter_data_t,s0) /var/run/spamass(/.*)? gen_context(system_u:object_r:spamass_milter_data_t,s0) +/var/run/sqlgrey\.pid -- gen_context(system_u:object_r:greylist_milter_data_t,s0) /var/run/spamass-milter(/.*)? gen_context(system_u:object_r:spamass_milter_data_t,s0) /var/run/spamass-milter\.pid -- gen_context(system_u:object_r:spamass_milter_data_t,s0) diff --git a/milter.if b/milter.if index ee72cbe..bdf319a 100644 --- a/milter.if +++ b/milter.if @@ -24,9 +24,13 @@ template(`milter_template',` # Type for the milter data (e.g. the socket used to communicate with the MTA) type $1_milter_data_t, milter_data_type; - files_type($1_milter_data_t) + files_pid_file($1_milter_data_t) + + # Allow communication with MTA over a unix-domain socket + # Note: usage with TCP sockets requires additional policy allow $1_milter_t self:fifo_file rw_fifo_file_perms; + # Allow communication with MTA over a TCP socket allow $1_milter_t self:tcp_socket create_stream_socket_perms; @@ -36,12 +40,13 @@ template(`milter_template',` # Create other data files and directories in the data directory manage_files_pattern($1_milter_t, $1_milter_data_t, $1_milter_data_t) + kernel_dontaudit_read_system_state($1_milter_t) + corenet_tcp_bind_generic_node($1_milter_t) corenet_tcp_bind_milter_port($1_milter_t) files_read_etc_files($1_milter_t) - miscfiles_read_localization($1_milter_t) logging_send_syslog_msg($1_milter_t) ') @@ -61,6 +66,7 @@ interface(`milter_stream_connect_all',` attribute milter_data_type, milter_domains; ') + files_search_pids($1) getattr_dirs_pattern($1, milter_data_type, milter_data_type) stream_connect_pattern($1, milter_data_type, milter_data_type, milter_domains) ') @@ -86,6 +92,24 @@ interface(`milter_getattr_all_sockets',` ######################################## ## +## Allow setattr of milter dirs +## +## +## +## Domain allowed access. +## +## +# +interface(`milter_setattr_all_dirs',` + gen_require(` + attribute milter_data_type; + ') + + setattr_dirs_pattern($1, milter_data_type, milter_data_type) +') + +######################################## +## ## Manage spamassassin milter state ## ## @@ -104,3 +128,22 @@ interface(`milter_manage_spamass_state',` manage_dirs_pattern($1, spamass_milter_state_t, spamass_milter_state_t) manage_lnk_files_pattern($1, spamass_milter_state_t, spamass_milter_state_t) ') + +####################################### +## +## Delete dkim-milter PID files. +## +## +## +## Domain allowed access. +## +## +# +interface(`milter_delete_dkim_pid_files',` + gen_require(` + type dkim_milter_data_t; + ') + + files_search_pids($1) + delete_files_pattern($1, dkim_milter_data_t, dkim_milter_data_t) +') diff --git a/milter.te b/milter.te index 26101cb..efd51a0 100644 --- a/milter.te +++ b/milter.te @@ -9,6 +9,13 @@ policy_module(milter, 1.4.0) attribute milter_domains; attribute milter_data_type; +# support for dkim-milter - domainKeys Identified Mail sender authentication sendmail milter +milter_template(dkim) + +# type for the private key of dkim-milter +type dkim_milter_private_key_t; +files_type(dkim_milter_private_key_t) + # currently-supported milters are milter-greylist, milter-regex and spamass-milter milter_template(greylist) milter_template(regex) @@ -20,6 +27,24 @@ milter_template(spamass) type spamass_milter_state_t; files_type(spamass_milter_state_t) +####################################### +# +# dkim-milter local policy +# + +allow dkim_milter_t self:capability { kill setgid setuid }; +allow dkim_milter_t self:process signal; +allow dkim_milter_t self:tcp_socket create_stream_socket_perms; +allow dkim_milter_t self:unix_stream_socket create_stream_socket_perms; + +read_files_pattern(dkim_milter_t, dkim_milter_private_key_t, dkim_milter_private_key_t) + +auth_use_nsswitch(dkim_milter_t) + +sysnet_dns_name_resolve(dkim_milter_t) + +mta_read_config(dkim_milter_t) + ######################################## # # milter-greylist local policy @@ -33,11 +58,25 @@ files_type(spamass_milter_state_t) allow greylist_milter_t self:capability { chown dac_override setgid setuid sys_nice }; allow greylist_milter_t self:process { setsched getsched }; +allow greylist_milter_t self:tcp_socket create_stream_socket_perms; + # It creates a pid file /var/run/milter-greylist.pid files_pid_filetrans(greylist_milter_t, greylist_milter_data_t, file) kernel_read_kernel_sysctls(greylist_milter_t) +dev_read_rand(greylist_milter_t) +dev_read_urand(greylist_milter_t) + +corecmd_exec_bin(greylist_milter_t) +corecmd_exec_shell(greylist_milter_t) + +corenet_tcp_bind_movaz_ssc_port(greylist_milter_t) +corenet_tcp_connect_movaz_ssc_port(greylist_milter_t) +corenet_tcp_bind_rtsclient_port(greylist_milter_t) + +# perl getgroups() reads a bunch of files in /etc +files_read_etc_files(greylist_milter_t) # Allow the milter to read a GeoIP database in /usr/share files_read_usr_files(greylist_milter_t) # The milter runs from /var/lib/milter-greylist and maintains files there @@ -49,6 +88,14 @@ auth_use_nsswitch(greylist_milter_t) # Config is in /etc/mail/greylist.conf mta_read_config(greylist_milter_t) + +sysnet_read_config(greylist_milter_t) + + +optional_policy(` + mysql_stream_connect(greylist_milter_t) +') + ######################################## # # milter-regex local policy @@ -88,6 +135,8 @@ corecmd_exec_shell(spamass_milter_t) corecmd_read_bin_symlinks(spamass_milter_t) corecmd_search_bin(spamass_milter_t) +auth_use_nsswitch(spamass_milter_t) + mta_send_mail(spamass_milter_t) # The main job of the milter is to pipe spam through spamc and act on the result diff --git a/mock.fc b/mock.fc new file mode 100644 index 0000000..8d0e473 --- /dev/null +++ b/mock.fc @@ -0,0 +1,5 @@ + +/usr/sbin/mock -- gen_context(system_u:object_r:mock_exec_t,s0) + +/var/lib/mock(/.*)? gen_context(system_u:object_r:mock_var_lib_t,s0) +/var/cache/mock(/.*)? gen_context(system_u:object_r:mock_cache_t,s0) diff --git a/mock.if b/mock.if new file mode 100644 index 0000000..7f6f2d6 --- /dev/null +++ b/mock.if @@ -0,0 +1,307 @@ +## policy for mock + +######################################## +## +## Execute a domain transition to run mock. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`mock_domtrans',` + gen_require(` + type mock_t, mock_exec_t; + ') + + domtrans_pattern($1, mock_exec_t, mock_t) +') + +######################################## +## +## Search mock lib directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`mock_search_lib',` + gen_require(` + type mock_var_lib_t; + ') + + allow $1 mock_var_lib_t:dir search_dir_perms; + files_search_var_lib($1) +') + +######################################## +## +## Read mock lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`mock_read_lib_files',` + gen_require(` + type mock_var_lib_t; + ') + + files_search_var_lib($1) + read_files_pattern($1, mock_var_lib_t, mock_var_lib_t) +') + +######################################## +## +## Getattr on mock lib file,dir,sock_file ... +## +## +## +## Domain allowed access. +## +## +# +interface(`mock_getattr_lib',` + gen_require(` + type mock_var_lib_t; + ') + + allow $1 mock_var_lib_t:dir_file_class_set getattr; +') + +######################################## +## +## Create, read, write, and delete +## mock lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`mock_manage_lib_files',` + gen_require(` + type mock_var_lib_t; + ') + + files_search_var_lib($1) + manage_files_pattern($1, mock_var_lib_t, mock_var_lib_t) +') + +######################################## +## +## Manage mock lib dirs files. +## +## +## +## Domain allowed access. +## +## +# +interface(`mock_manage_lib_dirs',` + gen_require(` + type mock_var_lib_t; + ') + + files_search_var_lib($1) + manage_dirs_pattern($1, mock_var_lib_t, mock_var_lib_t) +') + +######################################### +## +## Manage mock lib symlinks. +## +## +## +## Domain allowed access. +## +## +# +interface(`mock_manage_lib_symlinks',` + gen_require(` + type mock_var_lib_t; + ') + + files_search_var_lib($1) + manage_lnk_files_pattern($1, mock_var_lib_t, mock_var_lib_t) +') + +######################################## +## +## Manage mock lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`mock_manage_lib_chr_files',` + gen_require(` + type mock_var_lib_t; + ') + + files_search_var_lib($1) + manage_chr_files_pattern($1, mock_var_lib_t, mock_var_lib_t) +') + +######################################## +## +## Manage mock lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`mock_dontaudit_write_lib_chr_files',` + gen_require(` + type mock_var_lib_t; + ') + + dontaudit $1 mock_var_lib_t:chr_file write; +') + +####################################### +## +## Dontaudit read and write an leaked file descriptors +## +## +## +## Domain to not audit. +## +## +# +interface(`mock_dontaudit_leaks',` + gen_require(` + type mock_tmp_t; + ') + + dontaudit $1 mock_tmp_t:file rw_inherited_file_perms; +') + +######################################## +## +## Execute mock in the mock domain, and +## allow the specified role the mock domain. +## +## +## +## Domain allowed access +## +## +## +## +## The role to be allowed the mock domain. +## +## +## +# +interface(`mock_run',` + gen_require(` + type mock_t; + type mock_build_t; + ') + + mock_domtrans($1) + role $2 types mock_t; + role $2 types mock_build_t; + + optional_policy(` + mount_run(mock_t, $2) + ') +') + +######################################## +## +## Role access for mock +## +## +## +## Role allowed access +## +## +## +## +## User domain for the role +## +## +## +# +interface(`mock_role',` + gen_require(` + type mock_t; + ') + + role $1 types mock_t; + + mock_run($2, $1) + + ps_process_pattern($2, mock_t) + allow $2 mock_t:process signal_perms; + tunable_policy(`deny_ptrace',`',` + allow $2 mock_t:process ptrace; + ') +') + +####################################### +## +## Send a generic signal to mock. +## +## +## +## Domain allowed access. +## +## +# +interface(`mock_signal',` + gen_require(` + type mock_t; + ') + + allow $1 mock_t:process signal; +') + +######################################## +## +## All of the rules required to administrate +## an mock environment +## +## +## +## Domain allowed access. +## +## +# +interface(`mock_admin',` + gen_require(` + type mock_t, mock_var_lib_t; + type mock_build_t, mock_etc_t, mock_tmp_t; + ') + + allow $1 mock_t:process signal_perms; + ps_process_pattern($1, mock_t) + tunable_policy(`deny_ptrace',`',` + allow $1 mock_t:process ptrace; + allow $1 mock_build_t:process ptrace; + ') + + allow $1 mock_build_t:process signal_perms; + ps_process_pattern($1, mock_build_t) + + files_list_var_lib($1) + admin_pattern($1, mock_var_lib_t) + + files_list_tmp($1) + admin_pattern($1, mock_tmp_t) + + files_search_etc($1) + admin_pattern($1, mock_etc_t) +') diff --git a/mock.te b/mock.te new file mode 100644 index 0000000..55ab637 --- /dev/null +++ b/mock.te @@ -0,0 +1,248 @@ +policy_module(mock,1.0.0) + +## +##

+## Allow mock to read files in home directories. +##

+## +gen_tunable(mock_enable_homedirs, false) + +######################################## +# +# Declarations +# + +type mock_t; +type mock_exec_t; +application_domain(mock_t, mock_exec_t) +domain_role_change_exemption(mock_t) +domain_system_change_exemption(mock_t) +role system_r types mock_t; + +type mock_build_t; +type mock_build_exec_t; +application_domain(mock_build_t, mock_build_exec_t) +role system_r types mock_build_t; + +type mock_cache_t; +files_type(mock_cache_t) + +type mock_tmp_t; +files_tmp_file(mock_tmp_t) + +type mock_var_lib_t; +files_type(mock_var_lib_t) + +type mock_etc_t; +files_config_file(mock_etc_t) + +######################################## +# +# mock local policy +# + +allow mock_t self:capability { sys_admin setfcap setuid sys_chroot chown audit_write dac_override sys_nice mknod fsetid setgid fowner }; +allow mock_t self:process { siginh noatsecure signal_perms transition rlimitinh setsched setpgid }; +# Needed because mock can run java and mono withing build environment +allow mock_t self:process { execmem execstack }; +dontaudit mock_t self:process { siginh noatsecure rlimitinh }; +allow mock_t self:fifo_file manage_fifo_file_perms; +allow mock_t self:unix_stream_socket create_stream_socket_perms; +allow mock_t self:unix_dgram_socket create_socket_perms; + +manage_dirs_pattern(mock_t, mock_cache_t, mock_cache_t) +manage_files_pattern(mock_t, mock_cache_t, mock_cache_t) +manage_lnk_files_pattern(mock_t, mock_cache_t, mock_cache_t) +files_var_filetrans(mock_t, mock_cache_t, { dir file } ) + +read_files_pattern(mock_t, mock_etc_t, mock_etc_t) +read_lnk_files_pattern(mock_t, mock_etc_t, mock_etc_t) + +manage_dirs_pattern(mock_t, mock_tmp_t, mock_tmp_t) +manage_files_pattern(mock_t, mock_tmp_t, mock_tmp_t) +manage_lnk_files_pattern(mock_t, mock_tmp_t, mock_tmp_t) +files_tmp_filetrans(mock_t, mock_tmp_t, { dir file lnk_file }) + +manage_dirs_pattern(mock_t, mock_var_lib_t, mock_var_lib_t) +manage_files_pattern(mock_t, mock_var_lib_t, mock_var_lib_t) +manage_lnk_files_pattern(mock_t, mock_var_lib_t, mock_var_lib_t) +manage_blk_files_pattern(mock_t, mock_var_lib_t, mock_var_lib_t) +manage_chr_files_pattern(mock_t, mock_var_lib_t, mock_var_lib_t) +files_var_lib_filetrans(mock_t, mock_var_lib_t, { dir file }) +allow mock_t mock_var_lib_t:dir mounton; +allow mock_t mock_var_lib_t:dir relabel_dir_perms; +allow mock_t mock_var_lib_t:file relabel_file_perms; + +kernel_list_proc(mock_t) +kernel_read_irq_sysctls(mock_t) +kernel_read_system_state(mock_t) +kernel_read_network_state(mock_t) +kernel_read_kernel_sysctls(mock_t) +kernel_request_load_module(mock_t) +kernel_dontaudit_setattr_proc_dirs(mock_t) +kernel_read_fs_sysctls(mock_t) + +corecmd_exec_bin(mock_t) +corecmd_exec_shell(mock_t) +corecmd_dontaudit_exec_all_executables(mock_t) + +corenet_tcp_connect_git_port(mock_t) +corenet_tcp_connect_http_port(mock_t) +corenet_tcp_connect_ftp_port(mock_t) +corenet_tcp_connect_all_ephemeral_ports(mock_t) + +dev_read_urand(mock_t) +dev_read_sysfs(mock_t) +dev_setattr_sysfs_dirs(mock_t) + +domain_read_all_domains_state(mock_t) +domain_use_interactive_fds(mock_t) + +files_read_etc_runtime_files(mock_t) +files_read_usr_files(mock_t) +files_dontaudit_list_boot(mock_t) + +fs_getattr_all_fs(mock_t) +fs_search_all(mock_t) +fs_manage_cgroup_dirs(mock_t) +files_list_isid_type_dirs(mock_t) + +selinux_get_enforce_mode(mock_t) + +term_search_ptys(mock_t) + +auth_use_nsswitch(mock_t) + +init_exec(mock_t) +init_dontaudit_stream_connect(mock_t) + +libs_exec_ldconfig(mock_t) + +logging_send_audit_msgs(mock_t) +logging_send_syslog_msg(mock_t) + +userdom_use_user_ptys(mock_t) + +files_search_home(mock_t) + +tunable_policy(`mock_enable_homedirs',` + userdom_manage_user_home_content_dirs(mock_t) + userdom_manage_user_home_content_files(mock_t) +') + +tunable_policy(`mock_enable_homedirs && use_nfs_home_dirs',` + rpc_search_nfs_state_data(mock_t) + fs_list_auto_mountpoints(mock_t) + fs_manage_nfs_files(mock_t) +') + +tunable_policy(`mock_enable_homedirs && use_samba_home_dirs',` + fs_list_auto_mountpoints(mock_t) + fs_read_cifs_files(mock_t) + fs_manage_cifs_files(mock_t) +') + +optional_policy(` + abrt_read_spool_retrace(mock_t) + abrt_read_cache_retrace(mock_t) + abrt_stream_connect(mock_t) +') + +optional_policy(` + rpm_exec(mock_t) +') + +optional_policy(` + mount_domtrans(mock_t) +') + +optional_policy(` + apache_read_sys_content_rw_files(mock_t) +') + +######################################## +# +# mock_build local policy +# +allow mock_build_t self:capability { sys_admin setfcap setuid sys_chroot chown dac_override sys_nice mknod fsetid setgid fowner }; +dontaudit mock_build_t self:capability audit_write; +allow mock_build_t self:process { fork setsched setpgid signal_perms }; +allow mock_build_t self:netlink_audit_socket { create_socket_perms nlmsg_relay }; +# Needed because mock can run java and mono withing build environment +allow mock_build_t self:process { execmem execstack }; +dontaudit mock_build_t self:process { siginh noatsecure rlimitinh }; +allow mock_build_t self:fifo_file manage_fifo_file_perms; +allow mock_build_t self:unix_stream_socket create_stream_socket_perms; +allow mock_build_t self:unix_dgram_socket create_socket_perms; +allow mock_build_t self:dir list_dir_perms; +allow mock_build_t self:dir read_file_perms; + +ps_process_pattern(mock_t, mock_build_t) +allow mock_t mock_build_t:process signal_perms; +domtrans_pattern(mock_t, mock_build_exec_t, mock_build_t) +domtrans_pattern(mock_t, mock_tmp_t, mock_build_t) +domain_entry_file(mock_build_t, mock_tmp_t) +domtrans_pattern(mock_t, mock_var_lib_t, mock_build_t) +domain_entry_file(mock_build_t, mock_var_lib_t) + +manage_dirs_pattern(mock_build_t, mock_cache_t, mock_cache_t) +manage_files_pattern(mock_build_t, mock_cache_t, mock_cache_t) +manage_lnk_files_pattern(mock_build_t, mock_cache_t, mock_cache_t) +files_var_filetrans(mock_build_t, mock_cache_t, { dir file } ) + +manage_dirs_pattern(mock_build_t, mock_tmp_t, mock_tmp_t) +manage_files_pattern(mock_build_t, mock_tmp_t, mock_tmp_t) +files_tmp_filetrans(mock_build_t, mock_tmp_t, { dir file }) +can_exec(mock_build_t, mock_tmp_t) + +manage_dirs_pattern(mock_build_t, mock_var_lib_t, mock_var_lib_t) +manage_files_pattern(mock_build_t, mock_var_lib_t, mock_var_lib_t) +manage_lnk_files_pattern(mock_build_t, mock_var_lib_t, mock_var_lib_t) +manage_blk_files_pattern(mock_build_t, mock_var_lib_t, mock_var_lib_t) +manage_chr_files_pattern(mock_build_t, mock_var_lib_t, mock_var_lib_t) +files_var_lib_filetrans(mock_build_t, mock_var_lib_t, { dir file }) +can_exec(mock_build_t, mock_var_lib_t) +allow mock_build_t mock_var_lib_t:dir mounton; +allow mock_build_t mock_var_lib_t:dir relabel_dir_perms; +allow mock_build_t mock_var_lib_t:file relabel_file_perms; + +kernel_list_proc(mock_build_t) +kernel_read_irq_sysctls(mock_build_t) +kernel_read_system_state(mock_build_t) +kernel_read_network_state(mock_build_t) +kernel_read_kernel_sysctls(mock_build_t) +kernel_request_load_module(mock_build_t) +kernel_dontaudit_setattr_proc_dirs(mock_build_t) + +corecmd_exec_bin(mock_build_t) +corecmd_exec_shell(mock_build_t) +corecmd_dontaudit_exec_all_executables(mock_build_t) + +dev_getattr_all_chr_files(mock_build_t) +dev_dontaudit_list_all_dev_nodes(mock_build_t) +dev_dontaudit_getattr_all(mock_build_t) +fs_getattr_all_dirs(mock_build_t) +dev_read_sysfs(mock_build_t) + +domain_dontaudit_read_all_domains_state(mock_build_t) +domain_use_interactive_fds(mock_build_t) + +files_read_usr_files(mock_build_t) +files_dontaudit_list_boot(mock_build_t) + +fs_getattr_all_fs(mock_build_t) +fs_manage_cgroup_dirs(mock_build_t) + +selinux_get_enforce_mode(mock_build_t) + +auth_use_nsswitch(mock_build_t) + +init_exec(mock_build_t) +init_dontaudit_stream_connect(mock_build_t) + +libs_exec_ldconfig(mock_build_t) + + +tunable_policy(`mock_enable_homedirs',` + userdom_read_user_home_content_files(mock_build_t) +') diff --git a/modemmanager.te b/modemmanager.te index b3ace16..41f9aa5 100644 --- a/modemmanager.te +++ b/modemmanager.te @@ -7,7 +7,7 @@ policy_module(modemmanager, 1.1.0) type modemmanager_t; type modemmanager_exec_t; -dbus_system_domain(modemmanager_t, modemmanager_exec_t) +init_daemon_domain(modemmanager_t, modemmanager_exec_t) typealias modemmanager_t alias ModemManager_t; typealias modemmanager_exec_t alias ModemManager_exec_t; @@ -16,7 +16,8 @@ typealias modemmanager_exec_t alias ModemManager_exec_t; # ModemManager local policy # -allow modemmanager_t self:process signal; +allow modemmanager_t self:capability { net_admin sys_admin sys_tty_config }; +allow modemmanager_t self:process { getsched signal }; allow modemmanager_t self:fifo_file rw_file_perms; allow modemmanager_t self:unix_stream_socket create_stream_socket_perms; allow modemmanager_t self:netlink_kobject_uevent_socket create_socket_perms; @@ -28,13 +29,29 @@ dev_rw_modem(modemmanager_t) files_read_etc_files(modemmanager_t) -term_use_unallocated_ttys(modemmanager_t) +term_use_generic_ptys(modemmanager_t) +term_use_unallocated_ttys(modemmanager_t) # this should be reproduced, might have been mislabelled usbtty_device_t +term_use_usb_ttys(modemmanager_t) -miscfiles_read_localization(modemmanager_t) +xserver_read_state_xdm(modemmanager_t) logging_send_syslog_msg(modemmanager_t) -networkmanager_dbus_chat(modemmanager_t) +optional_policy(` + dbus_system_domain(modemmanager_t, modemmanager_exec_t) +') + +optional_policy(` + networkmanager_dbus_chat(modemmanager_t) +') + +optional_policy(` + devicekit_dbus_chat_power(modemmanager_t) +') + +optional_policy(` + policykit_dbus_chat(modemmanager_t) +') optional_policy(` udev_read_db(modemmanager_t) diff --git a/mojomojo.if b/mojomojo.if index 657a9fc..7022903 100644 --- a/mojomojo.if +++ b/mojomojo.if @@ -10,27 +10,26 @@ ## Domain allowed access. ## ## -## -## -## Role allowed access. -## -## -## # interface(`mojomojo_admin',` gen_require(` - type httpd_mojomojo_script_t; - type httpd_mojomojo_content_t, httpd_mojomojo_ra_content_t; - type httpd_mojomojo_rw_content_t; - type httpd_mojomojo_script_exec_t, httpd_mojomojo_htaccess_t; + type httpd_mojomojo_script_t, httpd_mojomojo_content_t, httpd_mojomojo_ra_content_t; + type httpd_mojomojo_rw_content_t, httpd_mojomojo_tmp_t, httpd_mojomojo_htaccess_t; + type httpd_mojomojo_script_exec_t, httpd_mojomo_script_t; ') - allow $1 httpd_mojomojo_script_t:process { ptrace signal_perms }; + allow $1 httpd_mojomojo_script_t:process signal_perms; ps_process_pattern($1, httpd_mojomojo_script_t) + tunable_policy(`deny_ptrace',`',` + allow $1 httpd_mojomo_script_t:process ptrace; + ') + + files_list_tmp($1) + admin_pattern($1, httpd_mojomojo_tmp_t) - files_search_var_lib(httpd_mojomojo_script_t) + files_list_var_lib(httpd_mojomojo_script_t) - apache_search_sys_content($1) + apache_list_sys_content($1) admin_pattern($1, httpd_mojomojo_script_exec_t) admin_pattern($1, httpd_mojomojo_script_t) admin_pattern($1, httpd_mojomojo_content_t) diff --git a/mojomojo.te b/mojomojo.te index 83f002c..ed69996 100644 --- a/mojomojo.te +++ b/mojomojo.te @@ -7,6 +7,9 @@ policy_module(mojomojo, 1.0.0) apache_content_template(mojomojo) +type httpd_mojomojo_tmp_t; +files_tmp_file(httpd_mojomojo_tmp_t) + ######################################## # # mojomojo local policy @@ -14,6 +17,10 @@ apache_content_template(mojomojo) allow httpd_mojomojo_script_t httpd_t:unix_stream_socket rw_stream_socket_perms; +manage_dirs_pattern(httpd_mojomojo_script_t, httpd_mojomojo_tmp_t, httpd_mojomojo_tmp_t) +manage_files_pattern(httpd_mojomojo_script_t, httpd_mojomojo_tmp_t, httpd_mojomojo_tmp_t) +files_tmp_filetrans(httpd_mojomojo_script_t, httpd_mojomojo_tmp_t, { file dir }) + corenet_tcp_connect_postgresql_port(httpd_mojomojo_script_t) corenet_tcp_connect_mysqld_port(httpd_mojomojo_script_t) corenet_tcp_connect_smtp_port(httpd_mojomojo_script_t) diff --git a/mono.te b/mono.te index dff0f12..ecab36d 100644 --- a/mono.te +++ b/mono.te @@ -15,7 +15,7 @@ init_system_domain(mono_t, mono_exec_t) # Local policy # -allow mono_t self:process { ptrace signal getsched execheap execmem execstack }; +allow mono_t self:process { signal getsched execheap execmem execstack }; init_dbus_chat_script(mono_t) diff --git a/monop.te b/monop.te index 6647a35..f3b35e1 100644 --- a/monop.te +++ b/monop.te @@ -42,7 +42,6 @@ kernel_read_kernel_sysctls(monopd_t) kernel_list_proc(monopd_t) kernel_read_proc_symlinks(monopd_t) -corenet_all_recvfrom_unlabeled(monopd_t) corenet_all_recvfrom_netlabel(monopd_t) corenet_tcp_sendrecv_generic_if(monopd_t) corenet_udp_sendrecv_generic_if(monopd_t) @@ -65,8 +64,6 @@ fs_search_auto_mountpoints(monopd_t) logging_send_syslog_msg(monopd_t) -miscfiles_read_localization(monopd_t) - sysnet_read_config(monopd_t) userdom_dontaudit_use_unpriv_user_fds(monopd_t) diff --git a/mozilla.fc b/mozilla.fc index 3a73e74..60e7237 100644 --- a/mozilla.fc +++ b/mozilla.fc @@ -2,8 +2,17 @@ HOME_DIR/\.config/chromium(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0 HOME_DIR/\.galeon(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) HOME_DIR/\.java(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) HOME_DIR/\.mozilla(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) +HOME_DIR/\.thunderbird(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) HOME_DIR/\.netscape(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) HOME_DIR/\.phoenix(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) +HOME_DIR/\.adobe(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) +HOME_DIR/\.macromedia(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) +HOME_DIR/\.gnash(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) +HOME_DIR/\.gcjwebplugin(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) +HOME_DIR/\.icedteaplugin(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) +HOME_DIR/\.spicec(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) +HOME_DIR/\.ICAClient(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) +HOME_DIR/zimbrauserdata(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) # # /bin @@ -16,6 +25,12 @@ HOME_DIR/\.phoenix(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) /usr/bin/mozilla-[0-9].* -- gen_context(system_u:object_r:mozilla_exec_t,s0) /usr/bin/mozilla-bin-[0-9].* -- gen_context(system_u:object_r:mozilla_exec_t,s0) +ifdef(`distro_redhat',` +/usr/bin/nspluginscan -- gen_context(system_u:object_r:mozilla_plugin_exec_t,s0) +/usr/bin/nspluginviewer -- gen_context(system_u:object_r:mozilla_plugin_exec_t,s0) +/usr/lib/nspluginwrapper/npviewer.bin -- gen_context(system_u:object_r:mozilla_plugin_exec_t,s0) +') + ifdef(`distro_debian',` /usr/lib/iceweasel/iceweasel -- gen_context(system_u:object_r:mozilla_exec_t,s0) ') @@ -23,11 +38,20 @@ ifdef(`distro_debian',` # # /lib # -/usr/lib/galeon/galeon -- gen_context(system_u:object_r:mozilla_exec_t,s0) + +/usr/lib/galeon/galeon -- gen_context(system_u:object_r:mozilla_exec_t,s0) /usr/lib/netscape/.+/communicator/communicator-smotif\.real -- gen_context(system_u:object_r:mozilla_exec_t,s0) -/usr/lib/netscape/base-4/wrapper -- gen_context(system_u:object_r:mozilla_exec_t,s0) -/usr/lib/mozilla[^/]*/reg.+ -- gen_context(system_u:object_r:mozilla_exec_t,s0) -/usr/lib/mozilla[^/]*/mozilla-.* -- gen_context(system_u:object_r:mozilla_exec_t,s0) -/usr/lib/firefox[^/]*/mozilla-.* -- gen_context(system_u:object_r:mozilla_exec_t,s0) +/usr/lib/netscape/base-4/wrapper -- gen_context(system_u:object_r:mozilla_exec_t,s0) +/usr/lib/mozilla[^/]*/reg.+ -- gen_context(system_u:object_r:mozilla_exec_t,s0) +/usr/lib/mozilla[^/]*/mozilla-.* -- gen_context(system_u:object_r:mozilla_exec_t,s0) +/usr/lib/firefox[^/]*/mozilla-.* -- gen_context(system_u:object_r:mozilla_exec_t,s0) /usr/lib/[^/]*firefox[^/]*/firefox-bin -- gen_context(system_u:object_r:mozilla_exec_t,s0) -/usr/lib/[^/]*firefox[^/]*/firefox -- gen_context(system_u:object_r:mozilla_exec_t,s0) +/usr/lib/[^/]*firefox[^/]*/firefox -- gen_context(system_u:object_r:mozilla_exec_t,s0) + +/usr/lib/xulrunner[^/]*/plugin-container -- gen_context(system_u:object_r:mozilla_plugin_exec_t,s0) + +/usr/lib/mozilla/plugins-wrapped(/.*)? gen_context(system_u:object_r:mozilla_plugin_rw_t,s0) + +ifdef(`distro_redhat',` +/usr/lib/nspluginwrapper/plugin-config -- gen_context(system_u:object_r:mozilla_plugin_config_exec_t,s0) +') diff --git a/mozilla.if b/mozilla.if index b397fde..36e1117 100644 --- a/mozilla.if +++ b/mozilla.if @@ -18,10 +18,11 @@ interface(`mozilla_role',` gen_require(` type mozilla_t, mozilla_exec_t, mozilla_home_t; - attribute_role mozilla_roles; + #attribute_role mozilla_roles; ') - roleattribute $1 mozilla_roles; + #roleattribute $1 mozilla_roles; + role $1 types mozilla_t; domain_auto_trans($2, mozilla_exec_t, mozilla_t) # Unrestricted inheritance from the caller. @@ -47,7 +48,24 @@ interface(`mozilla_role',` relabel_files_pattern($2, mozilla_home_t, mozilla_home_t) relabel_lnk_files_pattern($2, mozilla_home_t, mozilla_home_t) + #should be remove then with adding of roleattribute + mozilla_run_plugin(mozilla_t, $1) mozilla_dbus_chat($2) + + userdom_manage_tmp_role($1, mozilla_t) + + optional_policy(` + nsplugin_role($1, mozilla_t) + ') + + optional_policy(` + pulseaudio_role($1, mozilla_t) + pulseaudio_filetrans_admin_home_content(mozilla_t) + pulseaudio_filetrans_home_content(mozilla_t) + ') + + mozilla_filetrans_home_content($2) + ') ######################################## @@ -105,7 +123,7 @@ interface(`mozilla_dontaudit_rw_user_home_files',` type mozilla_home_t; ') - dontaudit $1 mozilla_home_t:file rw_file_perms; + dontaudit $1 mozilla_home_t:file rw_inherited_file_perms; ') ######################################## @@ -193,11 +211,34 @@ interface(`mozilla_domtrans',` # interface(`mozilla_domtrans_plugin',` gen_require(` - type mozilla_plugin_t, mozilla_plugin_exec_t, mozilla_plugin_tmpfs_t; + type mozilla_plugin_t, mozilla_plugin_exec_t; + type mozilla_plugin_config_t, mozilla_plugin_config_exec_t; + type mozilla_plugin_rw_t; class dbus send_msg; ') domtrans_pattern($1, mozilla_plugin_exec_t, mozilla_plugin_t) + domtrans_pattern($1, mozilla_plugin_config_exec_t, mozilla_plugin_config_t) + allow mozilla_plugin_t $1:process signull; + allow $1 mozilla_plugin_t:unix_stream_socket { connectto rw_socket_perms }; + allow $1 mozilla_plugin_t:fd use; + + allow mozilla_plugin_t $1:unix_stream_socket rw_socket_perms; + allow mozilla_plugin_t $1:unix_dgram_socket { sendto rw_socket_perms }; + allow mozilla_plugin_t $1:shm { rw_shm_perms destroy }; + allow mozilla_plugin_t $1:sem create_sem_perms; + + ps_process_pattern($1, mozilla_plugin_t) + allow $1 mozilla_plugin_t:process signal_perms; + + list_dirs_pattern($1, mozilla_plugin_rw_t, mozilla_plugin_rw_t) + read_files_pattern($1, mozilla_plugin_rw_t, mozilla_plugin_rw_t) + read_lnk_files_pattern($1, mozilla_plugin_rw_t, mozilla_plugin_rw_t) + can_exec($1, mozilla_plugin_rw_t) + + allow $1 mozilla_plugin_t:dbus send_msg; + allow mozilla_plugin_t $1:dbus send_msg; + allow mozilla_plugin_t $1:process signull; ') @@ -224,6 +265,31 @@ interface(`mozilla_run_plugin',` mozilla_domtrans_plugin($1) role $2 types mozilla_plugin_t; + role $2 types mozilla_plugin_config_t; +') + +####################################### +## +## Execute qemu unconfined programs in the role. +## +## +## +## The role to allow the mozilla_plugin domain. +## +## +## +# +interface(`mozilla_role_plugin',` + gen_require(` + type mozilla_plugin_t; + ') + + role $1 types mozilla_plugin_t; + role $1 types mozilla_plugin_config_t; + + optional_policy(` + lpd_run_lpr(mozilla_plugin_t, $1) + ') ') ######################################## @@ -265,9 +331,27 @@ interface(`mozilla_rw_tcp_sockets',` allow $1 mozilla_t:tcp_socket rw_socket_perms; ') +####################################### +## +## Read mozilla_plugin tmpfs files +## +## +## +## Domain allowed access +## +## +# +interface(`mozilla_plugin_read_tmpfs_files',` + gen_require(` + type mozilla_plugin_tmpfs_t; + ') + + allow $1 mozilla_plugin_tmpfs_t:file read_file_perms; +') + ######################################## ## -## Read mozilla_plugin tmpfs files +## Delete mozilla_plugin tmpfs files ## ## ## @@ -275,28 +359,118 @@ interface(`mozilla_rw_tcp_sockets',` ## ## # -interface(`mozilla_plugin_read_tmpfs_files',` +interface(`mozilla_plugin_delete_tmpfs_files',` gen_require(` type mozilla_plugin_tmpfs_t; ') - allow $1 mozilla_plugin_tmpfs_t:file read_file_perms; + allow $1 mozilla_plugin_tmpfs_t:file delete_file_perms; ') ######################################## ## -## Delete mozilla_plugin tmpfs files +## Dontaudit read/write to a mozilla_plugin leaks ## ## ## -## Domain allowed access +## Domain to not audit. ## ## # -interface(`mozilla_plugin_delete_tmpfs_files',` +interface(`mozilla_plugin_dontaudit_leaks',` gen_require(` - type mozilla_plugin_tmpfs_t; + type mozilla_plugin_t; ') - allow $1 mozilla_plugin_tmpfs_t:file unlink; + dontaudit $1 mozilla_plugin_t:unix_stream_socket { read write }; ') + +####################################### +## +## Dontaudit read/write to a mozilla_plugin tmp files. +## +## +## +## Domain to not audit. +## +## +# +interface(`mozilla_plugin_dontaudit_rw_tmp_files',` + gen_require(` + type mozilla_plugin_tmp_t; + ') + + dontaudit $1 mozilla_plugin_tmp_t:file { read write }; +') + +######################################## +## +## Create, read, write, and delete +## mozilla_plugin rw files. +## +## +## +## Domain allowed access. +## +## +# +interface(`mozilla_plugin_manage_rw_files',` + gen_require(` + type mozilla_plugin_rw_t; + ') + + allow $1 mozilla_plugin_rw_t:file manage_file_perms; + allow $1 mozilla_plugin_rw_t:dir rw_dir_perms; +') + +######################################## +## +## read mozilla_plugin rw files. +## +## +## +## Domain allowed access. +## +## +# +interface(`mozilla_plugin_read_rw_files',` + gen_require(` + type mozilla_plugin_rw_t; + ') + + read_files_pattern($1, mozilla_plugin_rw_t, mozilla_plugin_rw_t) +') + +######################################## +## +## Create mozilla content in the user home directory +## with an correct label. +## +## +## +## Domain allowed access. +## +## +# +interface(`mozilla_filetrans_home_content',` + + gen_require(` + type mozilla_home_t; + ') + + userdom_user_home_dir_filetrans($1, mozilla_home_t, dir, ".galeon") + userdom_user_home_dir_filetrans($1, mozilla_home_t, dir, ".java") + userdom_user_home_dir_filetrans($1, mozilla_home_t, dir, ".mozilla") + userdom_user_home_dir_filetrans($1, mozilla_home_t, dir, ".thunderbird") + userdom_user_home_dir_filetrans($1, mozilla_home_t, dir, ".netscape") + userdom_user_home_dir_filetrans($1, mozilla_home_t, dir, ".phoenix") + userdom_user_home_dir_filetrans($1, mozilla_home_t, dir, ".adobe") + userdom_user_home_dir_filetrans($1, mozilla_home_t, dir, ".macromedia") + userdom_user_home_dir_filetrans($1, mozilla_home_t, dir, ".gnash") + userdom_user_home_dir_filetrans($1, mozilla_home_t, dir, ".gcjwebplugin") + userdom_user_home_dir_filetrans($1, mozilla_home_t, dir, ".icedteaplugin") + userdom_user_home_dir_filetrans($1, mozilla_home_t, dir, ".spicec") + userdom_user_home_dir_filetrans($1, mozilla_home_t, dir, ".ICAClient") + userdom_user_home_dir_filetrans($1, mozilla_home_t, dir, "zimbrauserdata") +') + diff --git a/mozilla.te b/mozilla.te index d4fcb75..7cb6170 100644 --- a/mozilla.te +++ b/mozilla.te @@ -7,19 +7,34 @@ policy_module(mozilla, 2.6.0) ## ##

+## Allow mozilla plugin domain to connect to the network using TCP. +##

+## +gen_tunable(mozilla_plugin_can_network_connect, false) + +## +##

## Allow confined web browsers to read home directory content ##

## gen_tunable(mozilla_read_content, false) -attribute_role mozilla_roles; +## +##

+## Allow mozilla_plugins to create random content in the users home directory +##

+## +gen_tunable(mozilla_plugin_enable_homedirs, false) + +#attribute_role mozilla_roles; type mozilla_t; type mozilla_exec_t; typealias mozilla_t alias { user_mozilla_t staff_mozilla_t sysadm_mozilla_t }; typealias mozilla_t alias { auditadm_mozilla_t secadm_mozilla_t }; userdom_user_application_domain(mozilla_t, mozilla_exec_t) -role mozilla_roles types mozilla_t; +#role mozilla_roles types mozilla_t; +role system_r types mozilla_t; type mozilla_conf_t; files_config_file(mozilla_conf_t) @@ -32,14 +47,26 @@ userdom_user_home_content(mozilla_home_t) type mozilla_plugin_t; type mozilla_plugin_exec_t; application_domain(mozilla_plugin_t, mozilla_plugin_exec_t) -role mozilla_roles types mozilla_plugin_t; +#role mozilla_roles types mozilla_plugin_t; +role system_r types mozilla_plugin_t; type mozilla_plugin_tmp_t; +userdom_user_tmp_content(mozilla_plugin_tmp_t) userdom_user_tmp_file(mozilla_plugin_tmp_t) type mozilla_plugin_tmpfs_t; +userdom_user_tmpfs_content(mozilla_plugin_tmpfs_t) userdom_user_tmpfs_file(mozilla_plugin_tmpfs_t) +type mozilla_plugin_rw_t; +files_type(mozilla_plugin_rw_t) + +type mozilla_plugin_config_t; +type mozilla_plugin_config_exec_t; +application_domain(mozilla_plugin_config_t, mozilla_plugin_config_exec_t) +#role mozilla_roles types mozilla_plugin_config_t; +role system_r types mozilla_plugin_config_t; + type mozilla_tmp_t; userdom_user_tmp_file(mozilla_tmp_t) @@ -100,7 +127,6 @@ corecmd_exec_shell(mozilla_t) corecmd_exec_bin(mozilla_t) # Browse the web, connect to printer -corenet_all_recvfrom_unlabeled(mozilla_t) corenet_all_recvfrom_netlabel(mozilla_t) corenet_tcp_sendrecv_generic_if(mozilla_t) corenet_raw_sendrecv_generic_if(mozilla_t) @@ -110,6 +136,7 @@ corenet_tcp_sendrecv_http_port(mozilla_t) corenet_tcp_sendrecv_http_cache_port(mozilla_t) corenet_tcp_sendrecv_squid_port(mozilla_t) corenet_tcp_sendrecv_ftp_port(mozilla_t) +corenet_tcp_connect_all_ephemeral_ports(mozilla_t) corenet_tcp_sendrecv_ipp_port(mozilla_t) corenet_tcp_connect_http_port(mozilla_t) corenet_tcp_connect_http_cache_port(mozilla_t) @@ -140,7 +167,6 @@ domain_dontaudit_read_all_domains_state(mozilla_t) files_read_etc_runtime_files(mozilla_t) files_read_usr_files(mozilla_t) -files_read_etc_files(mozilla_t) # /var/lib files_read_var_lib_files(mozilla_t) # interacting with gstreamer @@ -151,42 +177,34 @@ files_dontaudit_getattr_boot_dirs(mozilla_t) fs_dontaudit_getattr_all_fs(mozilla_t) fs_search_auto_mountpoints(mozilla_t) fs_list_inotifyfs(mozilla_t) -fs_rw_tmpfs_files(mozilla_t) +fs_rw_inherited_tmpfs_files(mozilla_t) term_dontaudit_getattr_pty_dirs(mozilla_t) +auth_use_nsswitch(mozilla_t) + logging_send_syslog_msg(mozilla_t) miscfiles_read_fonts(mozilla_t) -miscfiles_read_localization(mozilla_t) miscfiles_dontaudit_setattr_fonts_dirs(mozilla_t) -# Browse the web, connect to printer -sysnet_dns_name_resolve(mozilla_t) - -userdom_use_user_ptys(mozilla_t) +userdom_use_inherited_user_ptys(mozilla_t) -mozilla_run_plugin(mozilla_t, mozilla_roles) +#mozilla_run_plugin(mozilla_t, mozilla_roles) xserver_user_x_domain_template(mozilla, mozilla_t, mozilla_tmpfs_t) xserver_dontaudit_read_xdm_tmp_files(mozilla_t) xserver_dontaudit_getattr_xdm_tmp_sockets(mozilla_t) -tunable_policy(`allow_execmem',` - allow mozilla_t self:process { execmem execstack }; +tunable_policy(`selinuxuser_execstack',` + allow mozilla_t self:process execstack; ') -tunable_policy(`use_nfs_home_dirs',` - fs_manage_nfs_dirs(mozilla_t) - fs_manage_nfs_files(mozilla_t) - fs_manage_nfs_symlinks(mozilla_t) +tunable_policy(`deny_execmem',`',` + allow mozilla_t self:process execmem; ') -tunable_policy(`use_samba_home_dirs',` - fs_manage_cifs_dirs(mozilla_t) - fs_manage_cifs_files(mozilla_t) - fs_manage_cifs_symlinks(mozilla_t) -') +userdom_home_manager(mozilla_t) # Uploads, local html tunable_policy(`mozilla_read_content && use_nfs_home_dirs',` @@ -263,6 +281,7 @@ optional_policy(` optional_policy(` gnome_stream_connect_gconf(mozilla_t) gnome_manage_config(mozilla_t) + gnome_manage_gconf_home_files(mozilla_t) ') optional_policy(` @@ -283,7 +302,8 @@ optional_policy(` ') optional_policy(` - pulseaudio_role(mozilla_roles, mozilla_t) + #pulseaudio_role(mozilla_roles, mozilla_t) + pulseaudio_exec(mozilla_t) pulseaudio_stream_connect(mozilla_t) pulseaudio_manage_home_files(mozilla_t) ') @@ -297,25 +317,35 @@ optional_policy(` # mozilla_plugin local policy # -dontaudit mozilla_plugin_t self:capability { sys_ptrace }; -allow mozilla_plugin_t self:process { setsched signal_perms execmem }; -allow mozilla_plugin_t self:fifo_file manage_fifo_file_perms; -allow mozilla_plugin_t self:unix_stream_socket { connectto create_stream_socket_perms }; +dontaudit mozilla_plugin_t self:capability { ipc_lock sys_nice sys_tty_config }; + +allow mozilla_plugin_t self:process { setpgid getsched setsched signal_perms execmem execstack setrlimit }; +allow mozilla_plugin_t self:netlink_route_socket r_netlink_socket_perms; allow mozilla_plugin_t self:tcp_socket create_stream_socket_perms; allow mozilla_plugin_t self:udp_socket create_socket_perms; -allow mozilla_plugin_t self:netlink_route_socket r_netlink_socket_perms; allow mozilla_plugin_t self:netlink_kobject_uevent_socket create_socket_perms; + allow mozilla_plugin_t self:sem create_sem_perms; allow mozilla_plugin_t self:shm create_shm_perms; +allow mozilla_plugin_t self:fifo_file manage_fifo_file_perms; +allow mozilla_plugin_t self:unix_dgram_socket sendto; +allow mozilla_plugin_t self:unix_stream_socket { connectto create_stream_socket_perms }; can_exec(mozilla_plugin_t, mozilla_home_t) -read_files_pattern(mozilla_plugin_t, mozilla_home_t, mozilla_home_t) +manage_dirs_pattern(mozilla_plugin_t, mozilla_home_t, mozilla_home_t) +manage_files_pattern(mozilla_plugin_t, mozilla_home_t, mozilla_home_t) +manage_lnk_files_pattern(mozilla_plugin_t, mozilla_home_t, mozilla_home_t) +mozilla_filetrans_home_content(mozilla_plugin_t) manage_dirs_pattern(mozilla_plugin_t, mozilla_plugin_tmp_t, mozilla_plugin_tmp_t) manage_files_pattern(mozilla_plugin_t, mozilla_plugin_tmp_t, mozilla_plugin_tmp_t) +manage_lnk_files_pattern(mozilla_plugin_t, mozilla_plugin_tmp_t, mozilla_plugin_tmp_t) manage_fifo_files_pattern(mozilla_plugin_t, mozilla_plugin_tmp_t, mozilla_plugin_tmp_t) -files_tmp_filetrans(mozilla_plugin_t, mozilla_plugin_tmp_t, { dir file fifo_file }) -userdom_user_tmp_filetrans(mozilla_plugin_t, mozilla_plugin_tmp_t, { dir file fifo_file }) +manage_sock_files_pattern(mozilla_plugin_t, mozilla_plugin_tmp_t, mozilla_plugin_tmp_t) +files_tmp_filetrans(mozilla_plugin_t, mozilla_plugin_tmp_t, { dir file fifo_file sock_file }) +userdom_user_tmp_filetrans(mozilla_plugin_t, mozilla_plugin_tmp_t, { dir file fifo_file sock_file }) +xserver_xdm_tmp_filetrans(mozilla_plugin_t, mozilla_plugin_tmp_t, { dir file fifo_file sock_file lnk_file }) +can_exec(mozilla_plugin_t, mozilla_plugin_tmp_t) manage_files_pattern(mozilla_plugin_t, mozilla_plugin_tmpfs_t, mozilla_plugin_tmpfs_t) manage_lnk_files_pattern(mozilla_plugin_t, mozilla_plugin_tmpfs_t, mozilla_plugin_tmpfs_t) @@ -323,31 +353,50 @@ manage_fifo_files_pattern(mozilla_plugin_t, mozilla_plugin_tmpfs_t, mozilla_plug manage_sock_files_pattern(mozilla_plugin_t, mozilla_plugin_tmpfs_t, mozilla_plugin_tmpfs_t) fs_tmpfs_filetrans(mozilla_plugin_t, mozilla_plugin_tmpfs_t, { file lnk_file sock_file fifo_file }) +allow mozilla_plugin_t mozilla_plugin_rw_t:dir list_dir_perms; +read_lnk_files_pattern(mozilla_plugin_t, mozilla_plugin_rw_t, mozilla_plugin_rw_t) +read_files_pattern(mozilla_plugin_t, mozilla_plugin_rw_t, mozilla_plugin_rw_t) + can_exec(mozilla_plugin_t, mozilla_exec_t) -kernel_read_kernel_sysctls(mozilla_plugin_t) +kernel_read_all_sysctls(mozilla_plugin_t) kernel_read_system_state(mozilla_plugin_t) kernel_read_network_state(mozilla_plugin_t) kernel_request_load_module(mozilla_plugin_t) +kernel_dontaudit_getattr_core_if(mozilla_plugin_t) corecmd_exec_bin(mozilla_plugin_t) corecmd_exec_shell(mozilla_plugin_t) +corecmd_dontaudit_access_all_executables(mozilla_plugin_t) -corenet_all_recvfrom_netlabel(mozilla_plugin_t) -corenet_all_recvfrom_unlabeled(mozilla_plugin_t) -corenet_tcp_sendrecv_generic_if(mozilla_plugin_t) -corenet_tcp_sendrecv_generic_node(mozilla_plugin_t) +corenet_tcp_connect_asterisk_port(mozilla_plugin_t) corenet_tcp_connect_generic_port(mozilla_plugin_t) -corenet_tcp_connect_pulseaudio_port(mozilla_plugin_t) +corenet_tcp_connect_flash_port(mozilla_plugin_t) +corenet_tcp_connect_ftp_port(mozilla_plugin_t) corenet_tcp_connect_http_port(mozilla_plugin_t) +corenet_tcp_connect_gatekeeper_port(mozilla_plugin_t) corenet_tcp_connect_http_cache_port(mozilla_plugin_t) -corenet_tcp_connect_squid_port(mozilla_plugin_t) +corenet_tcp_connect_ipsecnat_port(mozilla_plugin_t) corenet_tcp_connect_ipp_port(mozilla_plugin_t) +corenet_tcp_connect_ircd_port(mozilla_plugin_t) +corenet_tcp_connect_jabber_client_port(mozilla_plugin_t) corenet_tcp_connect_mmcc_port(mozilla_plugin_t) +corenet_tcp_connect_pulseaudio_port(mozilla_plugin_t) corenet_tcp_connect_speech_port(mozilla_plugin_t) +corenet_tcp_connect_squid_port(mozilla_plugin_t) +corenet_tcp_connect_streaming_port(mozilla_plugin_t) +corenet_tcp_connect_soundd_port(mozilla_plugin_t) +corenet_tcp_connect_vnc_port(mozilla_plugin_t) +corenet_tcp_connect_couchdb_port(mozilla_plugin_t) +corenet_tcp_connect_monopd_port(mozilla_plugin_t) +corenet_tcp_connect_all_ephemeral_ports(mozilla_plugin_t) +corenet_tcp_bind_generic_node(mozilla_plugin_t) +corenet_udp_bind_generic_node(mozilla_plugin_t) +corenet_dontaudit_udp_bind_ssdp_port(mozilla_plugin_t) dev_read_rand(mozilla_plugin_t) dev_read_urand(mozilla_plugin_t) +dev_read_generic_usb_dev(mozilla_plugin_t) dev_read_video_dev(mozilla_plugin_t) dev_write_video_dev(mozilla_plugin_t) dev_read_sysfs(mozilla_plugin_t) @@ -356,6 +405,7 @@ dev_write_sound(mozilla_plugin_t) # for nvidia driver dev_rw_xserver_misc(mozilla_plugin_t) dev_dontaudit_rw_dri(mozilla_plugin_t) +dev_dontaudit_getattr_all(mozilla_plugin_t) domain_use_interactive_fds(mozilla_plugin_t) domain_dontaudit_read_all_domains_state(mozilla_plugin_t) @@ -363,55 +413,56 @@ domain_dontaudit_read_all_domains_state(mozilla_plugin_t) files_read_config_files(mozilla_plugin_t) files_read_usr_files(mozilla_plugin_t) files_list_mnt(mozilla_plugin_t) +files_exec_usr_files(mozilla_plugin_t) +fs_rw_inherited_tmpfs_files(mozilla_plugin_t) fs_getattr_all_fs(mozilla_plugin_t) fs_list_dos(mozilla_plugin_t) fs_read_dos_files(mozilla_plugin_t) +application_exec(mozilla_plugin_t) application_dontaudit_signull(mozilla_plugin_t) auth_use_nsswitch(mozilla_plugin_t) +init_dontaudit_getattr_initctl(mozilla_plugin_t) + +libs_exec_ld_so(mozilla_plugin_t) +libs_exec_lib_files(mozilla_plugin_t) + logging_send_syslog_msg(mozilla_plugin_t) -miscfiles_read_localization(mozilla_plugin_t) miscfiles_read_fonts(mozilla_plugin_t) miscfiles_read_generic_certs(mozilla_plugin_t) miscfiles_dontaudit_setattr_fonts_dirs(mozilla_plugin_t) miscfiles_dontaudit_setattr_fonts_cache_dirs(mozilla_plugin_t) -sysnet_dns_name_resolve(mozilla_plugin_t) - term_getattr_all_ttys(mozilla_plugin_t) term_getattr_all_ptys(mozilla_plugin_t) +term_getattr_ptmx(mozilla_plugin_t) userdom_rw_user_tmpfs_files(mozilla_plugin_t) +userdom_delete_user_tmpfs_files(mozilla_plugin_t) userdom_dontaudit_use_user_terminals(mozilla_plugin_t) userdom_manage_user_tmp_sockets(mozilla_plugin_t) userdom_manage_user_tmp_dirs(mozilla_plugin_t) -userdom_read_user_tmp_files(mozilla_plugin_t) +userdom_rw_inherited_user_tmp_files(mozilla_plugin_t) +userdom_delete_user_tmp_files(mozilla_plugin_t) +userdom_rw_inherited_user_home_sock_files(mozilla_plugin_t) +userdom_manage_home_certs(mozilla_plugin_t) userdom_read_user_tmp_symlinks(mozilla_plugin_t) +userdom_stream_connect(mozilla_plugin_t) +userdom_dontaudit_rw_user_tmp_pipes(mozilla_plugin_t) + userdom_read_user_home_content_files(mozilla_plugin_t) userdom_read_user_home_content_symlinks(mozilla_plugin_t) +userdom_read_home_certs(mozilla_plugin_t) +userdom_read_home_audio_files(mozilla_plugin_t) -tunable_policy(`allow_execmem',` - allow mozilla_plugin_t self:process { execmem execstack }; -') - -tunable_policy(`allow_execstack',` - allow mozilla_plugin_t self:process { execstack }; -') - -tunable_policy(`use_nfs_home_dirs',` - fs_manage_nfs_dirs(mozilla_plugin_t) - fs_manage_nfs_files(mozilla_plugin_t) - fs_manage_nfs_symlinks(mozilla_plugin_t) -') +userdom_home_manager(mozilla_plugin_t) -tunable_policy(`use_samba_home_dirs',` - fs_manage_cifs_dirs(mozilla_plugin_t) - fs_manage_cifs_files(mozilla_plugin_t) - fs_manage_cifs_symlinks(mozilla_plugin_t) +tunable_policy(`mozilla_plugin_can_network_connect',` + corenet_tcp_connect_unreserved_ports(mozilla_plugin_t) ') optional_policy(` @@ -422,24 +473,37 @@ optional_policy(` optional_policy(` dbus_system_bus_client(mozilla_plugin_t) dbus_session_bus_client(mozilla_plugin_t) + dbus_connect_session_bus(mozilla_plugin_t) dbus_read_lib_files(mozilla_plugin_t) ') optional_policy(` + git_dontaudit_read_session_content_files(mozilla_plugin_t) +') + + +optional_policy(` gnome_manage_config(mozilla_plugin_t) + gnome_read_usr_config(mozilla_plugin_t) + gnome_filetrans_home_content(mozilla_plugin_t) + gnome_exec_gstreamer_home_files(mozilla_plugin_t) ') optional_policy(` - java_exec(mozilla_plugin_t) + gpm_dontaudit_getattr_gpmctl(mozilla_plugin_t) ') optional_policy(` - mplayer_exec(mozilla_plugin_t) - mplayer_read_user_home_files(mozilla_plugin_t) + java_exec(mozilla_plugin_t) ') +#optional_policy(` +# lpd_run_lpr(mozilla_plugin_t, mozilla_roles) +#') + optional_policy(` - pcscd_stream_connect(mozilla_plugin_t) + mplayer_exec(mozilla_plugin_t) + mplayer_read_user_home_files(mozilla_plugin_t) ') optional_policy(` @@ -447,10 +511,108 @@ optional_policy(` pulseaudio_stream_connect(mozilla_plugin_t) pulseaudio_setattr_home_dir(mozilla_plugin_t) pulseaudio_manage_home_files(mozilla_plugin_t) + pulseaudio_manage_home_symlinks(mozilla_plugin_t) +') + +optional_policy(` + pcscd_stream_connect(mozilla_plugin_t) +') + +optional_policy(` + rtkit_scheduled(mozilla_plugin_t) ') optional_policy(` + udev_read_db(mozilla_plugin_t) +') + +optional_policy(` + xserver_xdm_tmp_filetrans(mozilla_plugin_t, mozilla_plugin_tmp_t, { dir file fifo_file sock_file }) + xserver_dontaudit_read_xdm_tmp_files(mozilla_plugin_t) xserver_read_xdm_pid(mozilla_plugin_t) xserver_stream_connect(mozilla_plugin_t) xserver_use_user_fonts(mozilla_plugin_t) + xserver_read_user_iceauth(mozilla_plugin_t) + xserver_read_user_xauth(mozilla_plugin_t) + xserver_append_xdm_home_files(mozilla_plugin_t) + xserver_dontaudit_xdm_tmp_dirs(mozilla_plugin_t) +') + +######################################## +# +# mozilla_plugin_config local policy +# + +allow mozilla_plugin_config_t self:capability { dac_override dac_read_search sys_nice setuid setgid }; +allow mozilla_plugin_config_t self:process { setsched signal_perms getsched execmem execstack }; + +allow mozilla_plugin_config_t self:fifo_file rw_file_perms; +allow mozilla_plugin_config_t self:unix_stream_socket create_stream_socket_perms; + +dev_search_sysfs(mozilla_plugin_config_t) +dev_read_urand(mozilla_plugin_config_t) +dev_dontaudit_read_rand(mozilla_plugin_config_t) +dev_dontaudit_rw_dri(mozilla_plugin_config_t) + +fs_search_auto_mountpoints(mozilla_plugin_config_t) +fs_list_inotifyfs(mozilla_plugin_config_t) + +can_exec(mozilla_plugin_config_t, mozilla_plugin_rw_t) +manage_dirs_pattern(mozilla_plugin_config_t, mozilla_plugin_rw_t, mozilla_plugin_rw_t) +manage_files_pattern(mozilla_plugin_config_t, mozilla_plugin_rw_t, mozilla_plugin_rw_t) +manage_lnk_files_pattern(mozilla_plugin_config_t, mozilla_plugin_rw_t, mozilla_plugin_rw_t) + +manage_dirs_pattern(mozilla_plugin_config_t, mozilla_home_t, mozilla_home_t) +manage_files_pattern(mozilla_plugin_config_t, mozilla_home_t, mozilla_home_t) +manage_lnk_files_pattern(mozilla_plugin_config_t, mozilla_home_t, mozilla_home_t) + +corecmd_exec_bin(mozilla_plugin_config_t) +corecmd_exec_shell(mozilla_plugin_config_t) + +kernel_read_system_state(mozilla_plugin_config_t) +kernel_request_load_module(mozilla_plugin_config_t) + +domain_use_interactive_fds(mozilla_plugin_config_t) + +files_read_usr_files(mozilla_plugin_config_t) +files_dontaudit_search_home(mozilla_plugin_config_t) +files_list_tmp(mozilla_plugin_config_t) + +auth_use_nsswitch(mozilla_plugin_config_t) + +miscfiles_read_fonts(mozilla_plugin_config_t) + +userdom_search_user_home_content(mozilla_plugin_config_t) +userdom_read_user_home_content_symlinks(mozilla_plugin_config_t) +userdom_read_user_home_content_files(mozilla_plugin_config_t) +userdom_dontaudit_search_admin_dir(mozilla_plugin_config_t) +userdom_use_inherited_user_ptys(mozilla_plugin_config_t) +userdom_dontaudit_use_user_terminals(mozilla_plugin_config_t) + +domtrans_pattern(mozilla_plugin_config_t, mozilla_plugin_exec_t, mozilla_plugin_t) + +optional_policy(` + gnome_dontaudit_rw_inherited_config(mozilla_plugin_config_t) +') + +optional_policy(` + xserver_use_user_fonts(mozilla_plugin_config_t) +') + +ifdef(`distro_redhat',` + typealias mozilla_plugin_t alias nsplugin_t; + typealias mozilla_plugin_exec_t alias nsplugin_exec_t; + typealias mozilla_plugin_rw_t alias nsplugin_rw_t; + typealias mozilla_plugin_tmp_t alias nsplugin_tmp_t; + typealias mozilla_home_t alias nsplugin_home_t; + typealias mozilla_plugin_config_t alias nsplugin_config_t; + typealias mozilla_plugin_config_exec_t alias nsplugin_config_exec_t; +') + +tunable_policy(`mozilla_plugin_enable_homedirs',` + userdom_user_home_dir_filetrans(mozilla_plugin_t, mozilla_home_t, { dir file }) +') + +tunable_policy(`selinuxuser_execmod',` + userdom_execmod_user_home_files(mozilla_plugin_t) ') diff --git a/mpd.fc b/mpd.fc index ddc14d6..c74bf3d 100644 --- a/mpd.fc +++ b/mpd.fc @@ -6,3 +6,5 @@ /var/lib/mpd(/.*)? gen_context(system_u:object_r:mpd_var_lib_t,s0) /var/lib/mpd/music(/.*)? gen_context(system_u:object_r:mpd_data_t,s0) /var/lib/mpd/playlists(/.*)? gen_context(system_u:object_r:mpd_data_t,s0) + +/var/log/mpd(/.*)? gen_context(system_u:object_r:mpd_log_t,s0) diff --git a/mpd.if b/mpd.if index d72276f..cb8c563 100644 --- a/mpd.if +++ b/mpd.if @@ -244,8 +244,11 @@ interface(`mpd_admin',` type mpd_tmpfs_t; ') - allow $1 mpd_t:process { ptrace signal_perms }; + allow $1 mpd_t:process signal_perms; ps_process_pattern($1, mpd_t) + tunable_policy(`deny_ptrace',`',` + allow $1 mpd_t:process ptrace; + ') mpd_initrc_domtrans($1) domain_system_change_exemption($1) diff --git a/mpd.te b/mpd.te index 7f68872..26a8191 100644 --- a/mpd.te +++ b/mpd.te @@ -44,6 +44,9 @@ allow mpd_t self:unix_stream_socket { connectto create_stream_socket_perms }; allow mpd_t self:unix_dgram_socket { create_socket_perms sendto }; allow mpd_t self:tcp_socket create_stream_socket_perms; allow mpd_t self:netlink_kobject_uevent_socket create_socket_perms; +allow mpd_t self:unix_dgram_socket { create_socket_perms sendto }; + +read_files_pattern(mpd_t, mpd_etc_t, mpd_etc_t) manage_dirs_pattern(mpd_t, mpd_data_t, mpd_data_t) manage_files_pattern(mpd_t, mpd_data_t, mpd_data_t) @@ -51,6 +54,10 @@ manage_lnk_files_pattern(mpd_t, mpd_data_t, mpd_data_t) read_files_pattern(mpd_t, mpd_etc_t, mpd_etc_t) +manage_dirs_pattern(mpd_t, mpd_log_t, mpd_log_t) +manage_files_pattern(mpd_t, mpd_log_t, mpd_log_t) +logging_log_filetrans(mpd_t, mpd_log_t, { dir file lnk_file }) + manage_dirs_pattern(mpd_t, mpd_tmp_t, mpd_tmp_t) manage_files_pattern(mpd_t, mpd_tmp_t, mpd_tmp_t) manage_sock_files_pattern(mpd_t, mpd_tmp_t, mpd_tmp_t) @@ -72,7 +79,6 @@ kernel_read_kernel_sysctls(mpd_t) corecmd_exec_bin(mpd_t) -corenet_all_recvfrom_unlabeled(mpd_t) corenet_all_recvfrom_netlabel(mpd_t) corenet_tcp_sendrecv_generic_if(mpd_t) corenet_tcp_sendrecv_generic_node(mpd_t) @@ -101,7 +107,9 @@ auth_use_nsswitch(mpd_t) logging_send_syslog_msg(mpd_t) -miscfiles_read_localization(mpd_t) +userdom_read_home_audio_files(mpd_t) +userdom_read_user_tmpfs_files(mpd_t) +userdom_home_reader(mpd_t) optional_policy(` alsa_read_rw_config(mpd_t) @@ -122,5 +130,14 @@ optional_policy(` ') optional_policy(` + rtkit_daemon_dontaudit_dbus_chat(mpd_t) +') + +optional_policy(` udev_read_db(mpd_t) ') + +optional_policy(` + xserver_dontaudit_stream_connect(mpd_t) + xserver_dontaudit_read_xdm_pid(mpd_t) +') diff --git a/mplayer.if b/mplayer.if index d8ea41d..8bdc526 100644 --- a/mplayer.if +++ b/mplayer.if @@ -102,3 +102,39 @@ interface(`mplayer_read_user_home_files',` read_files_pattern($1, mplayer_home_t, mplayer_home_t) userdom_search_user_home_dirs($1) ') + +######################################## +## +## Execute mplayer_exec_t +## in the specified domain. +## +## +##

+## Execute a mplayer_exec_t +## in the specified domain. +##

+##

+## No interprocess communication (signals, pipes, +## etc.) is provided by this interface since +## the domains are not owned by this module. +##

+## +## +## +## Domain allowed access. +## +## +## +## +## The type of the new process. +## +## +# +interface(`mplayer_exec_domtrans',` + gen_require(` + type mplayer_exec_t; + ') + + allow $2 mplayer_exec_t:file entrypoint; + domtrans_pattern($1, mplayer_exec_t, $2) +') diff --git a/mplayer.te b/mplayer.te index 0cdea57..321a21a 100644 --- a/mplayer.te +++ b/mplayer.te @@ -10,7 +10,7 @@ policy_module(mplayer, 2.4.0) ## Allow mplayer executable stack ##

## -gen_tunable(allow_mplayer_execstack, false) +gen_tunable(mplayer_execstack, false) type mencoder_t; type mencoder_exec_t; @@ -71,15 +71,15 @@ fs_search_auto_mountpoints(mencoder_t) # Access to DVD/CD/V4L storage_raw_read_removable_device(mencoder_t) -miscfiles_read_localization(mencoder_t) -userdom_use_user_terminals(mencoder_t) +userdom_use_inherited_user_terminals(mencoder_t) # Handle removable media, /tmp, and /home userdom_list_user_tmp(mencoder_t) userdom_read_user_tmp_files(mencoder_t) userdom_read_user_tmp_symlinks(mencoder_t) userdom_read_user_home_content_files(mencoder_t) userdom_read_user_home_content_symlinks(mencoder_t) +userdom_home_manager(mencoder_t) # Read content to encode ifndef(`enable_mls',` @@ -88,58 +88,18 @@ ifndef(`enable_mls',` fs_read_removable_symlinks(mencoder_t) ') -tunable_policy(`allow_execmem',` +tunable_policy(`deny_execmem',`',` allow mencoder_t self:process execmem; ') -tunable_policy(`allow_execmod',` +tunable_policy(`selinuxuser_execmod',` dev_execmod_zero(mencoder_t) ') -tunable_policy(`allow_mplayer_execstack',` +tunable_policy(`mplayer_execstack',` allow mencoder_t self:process { execmem execstack }; ') -tunable_policy(`use_nfs_home_dirs',` - fs_manage_nfs_dirs(mencoder_t) - fs_manage_nfs_files(mencoder_t) - fs_manage_nfs_symlinks(mencoder_t) - -') - -tunable_policy(`use_samba_home_dirs',` - fs_manage_cifs_dirs(mencoder_t) - fs_manage_cifs_files(mencoder_t) - fs_manage_cifs_symlinks(mencoder_t) - -') - -# Read content to encode -tunable_policy(`use_nfs_home_dirs',` - fs_list_auto_mountpoints(mencoder_t) - files_list_home(mencoder_t) - fs_read_nfs_files(mencoder_t) - fs_read_nfs_symlinks(mencoder_t) - -',` - files_dontaudit_list_home(mencoder_t) - fs_dontaudit_list_auto_mountpoints(mencoder_t) - fs_dontaudit_read_nfs_files(mencoder_t) - fs_dontaudit_list_nfs(mencoder_t) -') - -tunable_policy(`use_samba_home_dirs',` - fs_list_auto_mountpoints(mencoder_t) - files_list_home(mencoder_t) - fs_read_cifs_files(mencoder_t) - fs_read_cifs_symlinks(mencoder_t) -',` - files_dontaudit_list_home(mencoder_t) - fs_dontaudit_list_auto_mountpoints(mencoder_t) - fs_dontaudit_read_cifs_files(mencoder_t) - fs_dontaudit_list_cifs(mencoder_t) -') - ######################################## # # mplayer local policy @@ -156,6 +116,7 @@ manage_dirs_pattern(mplayer_t, mplayer_home_t, mplayer_home_t) manage_files_pattern(mplayer_t, mplayer_home_t, mplayer_home_t) manage_lnk_files_pattern(mplayer_t, mplayer_home_t, mplayer_home_t) userdom_user_home_dir_filetrans(mplayer_t, mplayer_home_t, dir) +userdom_search_user_home_dirs(mplayer_t) manage_files_pattern(mplayer_t, mplayer_tmpfs_t, mplayer_tmpfs_t) manage_lnk_files_pattern(mplayer_t, mplayer_tmpfs_t, mplayer_tmpfs_t) @@ -177,7 +138,6 @@ kernel_read_system_state(mplayer_t) kernel_read_kernel_sysctls(mplayer_t) corenet_all_recvfrom_netlabel(mplayer_t) -corenet_all_recvfrom_unlabeled(mplayer_t) corenet_tcp_sendrecv_generic_if(mplayer_t) corenet_tcp_sendrecv_generic_node(mplayer_t) corenet_tcp_bind_generic_node(mplayer_t) @@ -206,7 +166,6 @@ domain_use_interactive_fds(mplayer_t) # Access to DVD/CD/V4L storage_raw_read_removable_device(mplayer_t) -files_read_etc_files(mplayer_t) files_dontaudit_list_non_security(mplayer_t) files_dontaudit_getattr_non_security_files(mplayer_t) files_read_non_security_files(mplayer_t) @@ -222,10 +181,13 @@ fs_dontaudit_getattr_all_fs(mplayer_t) fs_search_auto_mountpoints(mplayer_t) fs_list_inotifyfs(mplayer_t) -miscfiles_read_localization(mplayer_t) +auth_use_nsswitch(mplayer_t) + +logging_send_syslog_msg(mplayer_t) + miscfiles_read_fonts(mplayer_t) -userdom_use_user_terminals(mplayer_t) +userdom_use_inherited_user_terminals(mplayer_t) # Read media files userdom_list_user_tmp(mplayer_t) userdom_read_user_tmp_files(mplayer_t) @@ -233,6 +195,7 @@ userdom_read_user_tmp_symlinks(mplayer_t) userdom_read_user_home_content_files(mplayer_t) userdom_read_user_home_content_symlinks(mplayer_t) userdom_write_user_tmp_sockets(mplayer_t) +userdom_home_manager(mplayer_t) xserver_user_x_domain_template(mplayer, mplayer_t, mplayer_tmpfs_t) @@ -243,62 +206,31 @@ ifdef(`enable_mls',`',` fs_read_removable_symlinks(mplayer_t) ') -tunable_policy(`allow_execmem',` +tunable_policy(`deny_execmem',`',` allow mplayer_t self:process execmem; ') -tunable_policy(`allow_execmod',` +tunable_policy(`selinuxuser_execmod',` dev_execmod_zero(mplayer_t) ') -tunable_policy(`allow_mplayer_execstack',` +tunable_policy(`mplayer_execstack',` allow mplayer_t self:process { execmem execstack }; ') -tunable_policy(`use_nfs_home_dirs',` - fs_manage_nfs_dirs(mplayer_t) - fs_manage_nfs_files(mplayer_t) - fs_manage_nfs_symlinks(mplayer_t) -') -tunable_policy(`use_samba_home_dirs',` - fs_manage_cifs_dirs(mplayer_t) - fs_manage_cifs_files(mplayer_t) - fs_manage_cifs_symlinks(mplayer_t) -') - # Legacy domain issues -tunable_policy(`allow_mplayer_execstack',` +tunable_policy(`mplayer_execstack',` allow mplayer_t mplayer_tmpfs_t:file execute; ') -# Read songs -tunable_policy(`use_nfs_home_dirs',` - fs_list_auto_mountpoints(mplayer_t) - files_list_home(mplayer_t) - fs_read_nfs_files(mplayer_t) - fs_read_nfs_symlinks(mplayer_t) - -',` - files_dontaudit_list_home(mplayer_t) - fs_dontaudit_list_auto_mountpoints(mplayer_t) - fs_dontaudit_read_nfs_files(mplayer_t) - fs_dontaudit_list_nfs(mplayer_t) -') +userdom_home_manager(mplayer_t) -tunable_policy(`use_samba_home_dirs',` - fs_list_auto_mountpoints(mplayer_t) - files_list_home(mplayer_t) - fs_read_cifs_files(mplayer_t) - fs_read_cifs_symlinks(mplayer_t) -',` - files_dontaudit_list_home(mplayer_t) - fs_dontaudit_list_auto_mountpoints(mplayer_t) - fs_dontaudit_read_cifs_files(mplayer_t) - fs_dontaudit_list_cifs(mplayer_t) +optional_policy(` + alsa_read_rw_config(mplayer_t) ') optional_policy(` - alsa_read_rw_config(mplayer_t) + gnome_setattr_config_dirs(mplayer_t) ') optional_policy(` diff --git a/mrtg.te b/mrtg.te index 0e19d80..c203717 100644 --- a/mrtg.te +++ b/mrtg.te @@ -43,9 +43,12 @@ read_lnk_files_pattern(mrtg_t, mrtg_etc_t, mrtg_etc_t) dontaudit mrtg_t mrtg_etc_t:dir write; dontaudit mrtg_t mrtg_etc_t:file { write ioctl }; +manage_dirs_pattern(mrtg_t, mrtg_lock_t, mrtg_lock_t) manage_files_pattern(mrtg_t, mrtg_lock_t, mrtg_lock_t) manage_lnk_files_pattern(mrtg_t, mrtg_lock_t, mrtg_lock_t) +files_lock_filetrans(mrtg_t, mrtg_lock_t, { dir file }) +manage_dirs_pattern(mrtg_t, mrtg_log_t, mrtg_log_t) manage_files_pattern(mrtg_t, mrtg_log_t, mrtg_log_t) logging_log_filetrans(mrtg_t, mrtg_log_t, { file dir }) @@ -62,7 +65,6 @@ kernel_read_kernel_sysctls(mrtg_t) corecmd_exec_bin(mrtg_t) corecmd_exec_shell(mrtg_t) -corenet_all_recvfrom_unlabeled(mrtg_t) corenet_all_recvfrom_netlabel(mrtg_t) corenet_tcp_sendrecv_generic_if(mrtg_t) corenet_udp_sendrecv_generic_if(mrtg_t) @@ -88,7 +90,6 @@ files_getattr_tmp_dirs(mrtg_t) # for uptime files_read_etc_runtime_files(mrtg_t) # read config files -files_read_etc_files(mrtg_t) fs_search_auto_mountpoints(mrtg_t) fs_getattr_xattr_fs(mrtg_t) @@ -108,13 +109,12 @@ libs_read_lib_files(mrtg_t) logging_send_syslog_msg(mrtg_t) -miscfiles_read_localization(mrtg_t) - selinux_dontaudit_getattr_dir(mrtg_t) -userdom_use_user_terminals(mrtg_t) +userdom_use_inherited_user_terminals(mrtg_t) userdom_dontaudit_read_user_home_content_files(mrtg_t) userdom_dontaudit_use_unpriv_user_fds(mrtg_t) +userdom_dontaudit_list_admin_dir(mrtg_t) netutils_domtrans_ping(mrtg_t) diff --git a/mta.fc b/mta.fc index afa18c8..f6e2bb8 100644 --- a/mta.fc +++ b/mta.fc @@ -1,4 +1,8 @@ -HOME_DIR/\.forward -- gen_context(system_u:object_r:mail_forward_t,s0) +HOME_DIR/\.esmtp_queue -- gen_context(system_u:object_r:mail_home_t,s0) +HOME_DIR/\.forward[^/]* -- gen_context(system_u:object_r:mail_home_t,s0) +HOME_DIR/dead\.letter -- gen_context(system_u:object_r:mail_home_t,s0) +HOME_DIR/\.mailrc -- gen_context(system_u:object_r:mail_home_t,s0) +HOME_DIR/Maildir(/.*)? gen_context(system_u:object_r:mail_home_rw_t,s0) /bin/mail(x)? -- gen_context(system_u:object_r:sendmail_exec_t,s0) @@ -11,20 +15,28 @@ ifdef(`distro_redhat',` /etc/postfix/aliases.* gen_context(system_u:object_r:etc_aliases_t,s0) ') -/usr/bin/esmtp -- gen_context(system_u:object_r:sendmail_exec_t,s0) +/root/\.esmtp_queue -- gen_context(system_u:object_r:mail_home_t,s0) +/root/\.forward -- gen_context(system_u:object_r:mail_home_t,s0) +/root/dead\.letter -- gen_context(system_u:object_r:mail_home_t,s0) +/root/\.mailrc -- gen_context(system_u:object_r:mail_home_t,s0) +/root/Maildir(/.*)? gen_context(system_u:object_r:mail_home_rw_t,s0) + +/usr/bin/esmtp -- gen_context(system_u:object_r:sendmail_exec_t,s0) +/usr/bin/mail(x)? -- gen_context(system_u:object_r:sendmail_exec_t,s0) /usr/lib/sendmail -- gen_context(system_u:object_r:sendmail_exec_t,s0) -/usr/lib/courier/bin/sendmail -- gen_context(system_u:object_r:sendmail_exec_t,s0) +/usr/lib/courier/bin/sendmail -- gen_context(system_u:object_r:sendmail_exec_t,s0) -/usr/sbin/rmail -- gen_context(system_u:object_r:sendmail_exec_t,s0) -/usr/sbin/sendmail\.postfix -- gen_context(system_u:object_r:sendmail_exec_t,s0) -/usr/sbin/sendmail(\.sendmail)? -- gen_context(system_u:object_r:sendmail_exec_t,s0) -/usr/sbin/ssmtp -- gen_context(system_u:object_r:sendmail_exec_t,s0) +/usr/sbin/rmail -- gen_context(system_u:object_r:sendmail_exec_t,s0) +/usr/sbin/sendmail\.postfix -- gen_context(system_u:object_r:sendmail_exec_t,s0) +/usr/sbin/sendmail(\.sendmail)? -- gen_context(system_u:object_r:sendmail_exec_t,s0) +/usr/sbin/ssmtp -- gen_context(system_u:object_r:sendmail_exec_t,s0) /var/mail(/.*)? gen_context(system_u:object_r:mail_spool_t,s0) /var/qmail/bin/sendmail -- gen_context(system_u:object_r:sendmail_exec_t,s0) /var/spool/imap(/.*)? gen_context(system_u:object_r:mail_spool_t,s0) -/var/spool/(client)?mqueue(/.*)? gen_context(system_u:object_r:mqueue_spool_t,s0) +/var/spool/(client)?mqueue(/.*)? gen_context(system_u:object_r:mqueue_spool_t,s0) +/var/spool/mqueue\.in(/.*)? gen_context(system_u:object_r:mqueue_spool_t,s0) /var/spool/mail(/.*)? gen_context(system_u:object_r:mail_spool_t,s0) diff --git a/mta.if b/mta.if index 4e2a5ba..c11b2a5 100644 --- a/mta.if +++ b/mta.if @@ -37,6 +37,7 @@ interface(`mta_stub',` ## is the prefix for user_t). ## ## +## # template(`mta_base_mail_template',` @@ -56,92 +57,17 @@ template(`mta_base_mail_template',` type $1_mail_tmp_t; files_tmp_file($1_mail_tmp_t) - ############################## - # - # $1_mail_t local policy - # - - allow $1_mail_t self:capability { setuid setgid chown }; - allow $1_mail_t self:process { signal_perms setrlimit }; - allow $1_mail_t self:tcp_socket create_socket_perms; - - # re-exec itself - can_exec($1_mail_t, sendmail_exec_t) - allow $1_mail_t sendmail_exec_t:lnk_file read_lnk_file_perms; - - kernel_read_system_state($1_mail_t) - kernel_read_kernel_sysctls($1_mail_t) - - corenet_all_recvfrom_unlabeled($1_mail_t) - corenet_all_recvfrom_netlabel($1_mail_t) - corenet_tcp_sendrecv_generic_if($1_mail_t) - corenet_tcp_sendrecv_generic_node($1_mail_t) - corenet_tcp_sendrecv_all_ports($1_mail_t) - corenet_tcp_connect_all_ports($1_mail_t) - corenet_tcp_connect_smtp_port($1_mail_t) - corenet_sendrecv_smtp_client_packets($1_mail_t) - - corecmd_exec_bin($1_mail_t) - - files_read_etc_files($1_mail_t) - files_search_spool($1_mail_t) - # It wants to check for nscd - files_dontaudit_search_pids($1_mail_t) + manage_dirs_pattern($1_mail_t, $1_mail_tmp_t, $1_mail_tmp_t) + manage_files_pattern($1_mail_t, $1_mail_tmp_t, $1_mail_tmp_t) + files_tmp_filetrans($1_mail_t, $1_mail_tmp_t, { file dir }) auth_use_nsswitch($1_mail_t) - init_dontaudit_rw_utmp($1_mail_t) - logging_send_syslog_msg($1_mail_t) - miscfiles_read_localization($1_mail_t) - - optional_policy(` - exim_read_log($1_mail_t) - exim_append_log($1_mail_t) - exim_manage_spool_files($1_mail_t) - ') - optional_policy(` postfix_domtrans_user_mail_handler($1_mail_t) ') - - optional_policy(` - procmail_exec($1_mail_t) - ') - - optional_policy(` - qmail_domtrans_inject($1_mail_t) - ') - - optional_policy(` - gen_require(` - type etc_mail_t, mail_spool_t, mqueue_spool_t; - ') - - manage_dirs_pattern($1_mail_t, $1_mail_tmp_t, $1_mail_tmp_t) - manage_files_pattern($1_mail_t, $1_mail_tmp_t, $1_mail_tmp_t) - files_tmp_filetrans($1_mail_t, $1_mail_tmp_t, { file dir }) - - allow $1_mail_t etc_mail_t:dir search_dir_perms; - - # Write to /var/spool/mail and /var/spool/mqueue. - manage_files_pattern($1_mail_t, mail_spool_t, mail_spool_t) - manage_files_pattern($1_mail_t, mqueue_spool_t, mqueue_spool_t) - - # Check available space. - fs_getattr_xattr_fs($1_mail_t) - - files_read_etc_runtime_files($1_mail_t) - - # Write to /var/log/sendmail.st - sendmail_manage_log($1_mail_t) - sendmail_create_log($1_mail_t) - ') - - optional_policy(` - uucp_manage_spool($1_mail_t) - ') ') ######################################## @@ -169,11 +95,19 @@ interface(`mta_role',` # Transition from the user domain to the derived domain. domtrans_pattern($2, sendmail_exec_t, user_mail_t) - allow $2 sendmail_exec_t:lnk_file { getattr read }; + allow $2 sendmail_exec_t:lnk_file read_lnk_file_perms; allow mta_user_agent $2:fd use; allow mta_user_agent $2:process sigchld; allow mta_user_agent $2:fifo_file { read write }; + + optional_policy(` + exim_run($2, $1) + ') + + optional_policy(` + mailman_run(mta_user_agent, $1) + ') ') ######################################## @@ -220,6 +154,25 @@ interface(`mta_agent_executable',` application_executable_file($1) ') +###################################### +## +## Dontaudit read and write an leaked file descriptors +## +## +## +## Domain to not audit. +## +## +# +interface(`mta_dontaudit_leaks_system_mail',` + gen_require(` + type system_mail_t; + ') + + dontaudit $1 system_mail_t:fifo_file write; + dontaudit $1 system_mail_t:tcp_socket { read write }; +') + ######################################## ## ## Make the specified type by a system MTA. @@ -306,10 +259,15 @@ interface(`mta_mailserver_sender',` interface(`mta_mailserver_delivery',` gen_require(` attribute mailserver_delivery; - type mail_spool_t; ') typeattribute $1 mailserver_delivery; + + userdom_home_manager($1) + + optional_policy(` + mta_rw_delivery_tcp_sockets($1) + ') ') ####################################### @@ -393,12 +351,19 @@ interface(`mta_send_mail',` # interface(`mta_sendmail_domtrans',` gen_require(` - type sendmail_exec_t; + attribute mta_exec_type; + attribute mta_user_agent; ') files_search_usr($1) + allow $1 mta_exec_type:lnk_file read_lnk_file_perms; corecmd_read_bin_symlinks($1) - domain_auto_trans($1, sendmail_exec_t, $2) + + allow $2 mta_exec_type:file entrypoint; + domtrans_pattern($1, mta_exec_type, $2) + allow mta_user_agent $1:fd use; + allow mta_user_agent $1:process sigchld; + allow mta_user_agent $1:fifo_file { read write }; ') ######################################## @@ -411,7 +376,6 @@ interface(`mta_sendmail_domtrans',` ## ## # -# interface(`mta_signal_system_mail',` gen_require(` type system_mail_t; @@ -422,6 +386,60 @@ interface(`mta_signal_system_mail',` ######################################## ## +## Send all user mail client a signal +## +## +## +## Domain allowed access. +## +## +# +interface(`mta_signal_user_agent',` + gen_require(` + attribute mta_user_agent; + ') + + allow $1 mta_user_agent:process signal; +') + +######################################## +## +## Send all user mail client a kill signal +## +## +## +## Domain allowed access. +## +## +# +interface(`mta_kill_user_agent',` + gen_require(` + attribute mta_user_agent; + ') + + allow $1 mta_user_agent:process sigkill; +') + +######################################## +## +## Send system mail client a kill signal +## +## +## +## Domain allowed access. +## +## +# +interface(`mta_kill_system_mail',` + gen_require(` + type system_mail_t; + ') + + allow $1 system_mail_t:process sigkill; +') + +######################################## +## ## Execute sendmail in the caller domain. ## ## @@ -440,6 +458,26 @@ interface(`mta_sendmail_exec',` ######################################## ## +## Check whether sendmail executable +## files are executable. +## +## +## +## Domain allowed access. +## +## +# +interface(`mta_sendmail_access_check',` + gen_require(` + type sendmail_exec_t; + ') + + corecmd_search_bin($1) + allow $1 sendmail_exec_t:file { getattr_file_perms execute }; +') + +######################################## +## ## Read mail server configuration. ## ## @@ -496,6 +534,7 @@ interface(`mta_read_aliases',` files_search_etc($1) allow $1 etc_aliases_t:file read_file_perms; + allow $1 etc_aliases_t:lnk_file read_lnk_file_perms; ') ######################################## @@ -534,7 +573,7 @@ interface(`mta_etc_filetrans_aliases',` type etc_aliases_t; ') - files_etc_filetrans($1, etc_aliases_t, file) + files_etc_filetrans($1, etc_aliases_t, file, $2) ') ######################################## @@ -554,7 +593,7 @@ interface(`mta_rw_aliases',` ') files_search_etc($1) - allow $1 etc_aliases_t:file { rw_file_perms setattr }; + allow $1 etc_aliases_t:file { rw_file_perms setattr_file_perms }; ') ####################################### @@ -576,6 +615,25 @@ interface(`mta_dontaudit_rw_delivery_tcp_sockets',` dontaudit $1 mailserver_delivery:tcp_socket { read write }; ') +###################################### +## +## Allow attempts to read and write TCP +## sockets of mail delivery domains. +## +## +## +## Domain to not audit. +## +## +# +interface(`mta_rw_delivery_tcp_sockets',` + gen_require(` + attribute mailserver_delivery; + ') + + allow $1 mailserver_delivery:tcp_socket { read write }; +') + ####################################### ## ## Connect to all mail servers over TCP. (Deprecated) @@ -648,8 +706,8 @@ interface(`mta_dontaudit_getattr_spool_files',` files_dontaudit_search_spool($1) dontaudit $1 mail_spool_t:dir search_dir_perms; - dontaudit $1 mail_spool_t:lnk_file read; - dontaudit $1 mail_spool_t:file getattr; + dontaudit $1 mail_spool_t:lnk_file read_lnk_file_perms; + dontaudit $1 mail_spool_t:file getattr_file_perms; ') ####################################### @@ -679,7 +737,26 @@ interface(`mta_spool_filetrans',` ') files_search_spool($1) - filetrans_pattern($1, mail_spool_t, $2, $3) + filetrans_pattern($1, mail_spool_t, $2, $3, $4) +') + +####################################### +## +## Read the mail spool. +## +## +## +## Domain allowed access. +## +## +# +interface(`mta_read_spool',` + gen_require(` + type mail_spool_t; + ') + + files_search_spool($1) + read_files_pattern($1, mail_spool_t, mail_spool_t) ') ######################################## @@ -699,8 +776,8 @@ interface(`mta_rw_spool',` files_search_spool($1) allow $1 mail_spool_t:dir list_dir_perms; - allow $1 mail_spool_t:file setattr; - rw_files_pattern($1, mail_spool_t, mail_spool_t) + allow $1 mail_spool_t:file setattr_file_perms; + manage_files_pattern($1, mail_spool_t, mail_spool_t) read_lnk_files_pattern($1, mail_spool_t, mail_spool_t) ') @@ -840,7 +917,7 @@ interface(`mta_dontaudit_rw_queue',` ') dontaudit $1 mqueue_spool_t:dir search_dir_perms; - dontaudit $1 mqueue_spool_t:file { getattr read write }; + dontaudit $1 mqueue_spool_t:file rw_file_perms; ') ######################################## @@ -866,6 +943,36 @@ interface(`mta_manage_queue',` ####################################### ## +## Create private objects in the +## mqueue spool directory. +## +## +## +## Domain allowed access. +## +## +## +## +## The type of the object to be created. +## +## +## +## +## The object class of the object being created. +## +## +# +interface(`mta_spool_filetrans_queue',` + gen_require(` + type mqueue_spool_t; + ') + + files_search_spool($1) + filetrans_pattern($1, mqueue_spool_t, $2, $3, $4) +') + +####################################### +## ## Read sendmail binary. ## ## @@ -901,3 +1008,170 @@ interface(`mta_rw_user_mail_stream_sockets',` allow $1 user_mail_domain:unix_stream_socket rw_socket_perms; ') + +######################################## +## +## Type transition files created in calling dir +## to the mail address aliases type. +## +## +## +## Domain allowed access. +## +## +## +## +## Directory to transition on. +## +## +# +interface(`mta_filetrans_aliases',` + gen_require(` + type etc_aliases_t; + ') + + filetrans_pattern($1, $2, etc_aliases_t, file) +') + +###################################### +## +## ALlow domain to read mail content in the homedir +## +## +## +## Domain allowed access. +## +## +# +interface(`mta_read_home',` + gen_require(` + type mail_home_t; + ') + + userdom_search_user_home_dirs($1) + read_files_pattern($1, mail_home_t, mail_home_t) + + ifdef(`distro_redhat',` + userdom_search_admin_dir($1) + ') +') + +#################################### +## +## ALlow domain to read mail content in the homedir +## +## +## +## Domain allowed access. +## +## +# +interface(`mta_read_home_rw',` + gen_require(` + type mail_home_rw_t; + ') + + userdom_search_user_home_dirs($1) + read_files_pattern($1, mail_home_rw_t, mail_home_rw_t) + + ifdef(`distro_redhat',` + userdom_search_admin_dir($1) + ') +') + +#################################### +## +## Allow domain to manage mail content in the homedir +## +## +## +## Domain allowed access. +## +## +# +interface(`mta_manage_home_rw',` + gen_require(` + type mail_home_rw_t; + ') + + userdom_search_user_home_dirs($1) + manage_files_pattern($1, mail_home_rw_t, mail_home_rw_t) + manage_dirs_pattern($1, mail_home_rw_t, mail_home_rw_t) + read_lnk_files_pattern($1, mail_home_rw_t, mail_home_rw_t) + userdom_user_home_dir_filetrans($1, mail_home_rw_t, dir, "Maildir") + + ifdef(`distro_redhat',` + userdom_search_admin_dir($1) + userdom_admin_home_dir_filetrans($1, mail_home_rw_t, dir, "Maildir") + ') +') + +######################################## +## +## create mail content in the in the /root directory +## with an correct label. +## +## +## +## Domain allowed access. +## +## +# +interface(`mta_filetrans_admin_home_content',` + gen_require(` + type mail_home_t; + type mail_home_rw_t; + ') + + userdom_admin_home_dir_filetrans($1, mail_home_t, file, "dead.letter") + userdom_admin_home_dir_filetrans($1, mail_home_t, file, ".mailrc") + userdom_admin_home_dir_filetrans($1, mail_home_t, file, ".forward") + userdom_admin_home_dir_filetrans($1, mail_home_rw_t, dir, "Maildir") + userdom_admin_home_dir_filetrans($1, mail_home_rw_t, file, ".esmtp_queue") +') + +######################################## +## +## Transition to mta named content +## +## +## +## Domain allowed access. +## +## +# +interface(`mta_filetrans_home_content',` + gen_require(` + type mail_home_t; + type mail_home_rw_t; + ') + + userdom_user_home_dir_filetrans($1, mail_home_t, file, ".mailrc") + userdom_user_home_dir_filetrans($1, mail_home_t, file, "dead.letter") + userdom_user_home_dir_filetrans($1, mail_home_t, file, ".forward") + userdom_user_home_dir_filetrans($1, mail_home_rw_t, dir, "Maildir") + userdom_user_home_dir_filetrans($1, mail_home_rw_t, file, ".esmtp_queue") +') + +######################################## +## +## Transition to apache named content +## +## +## +## Domain allowed access. +## +## +# +interface(`mta_filetrans_named_content',` + gen_require(` + type etc_aliases_t; + type etc_mail_t; + ') + + filetrans_pattern($1, etc_mail_t, etc_aliases_t, { dir file }) + mta_etc_filetrans_aliases($1, "aliases") + mta_etc_filetrans_aliases($1, "aliases.db") + mta_filetrans_home_content($1) + mta_filetrans_admin_home_content($1) +') diff --git a/mta.te b/mta.te index 84a7d66..d80cc61 100644 --- a/mta.te +++ b/mta.te @@ -20,14 +20,19 @@ files_type(etc_aliases_t) type etc_mail_t; files_config_file(etc_mail_t) -type mail_forward_t; -files_type(mail_forward_t) +type mail_home_t alias mail_forward_t; +userdom_user_home_content(mail_home_t) + +type mail_home_rw_t; +userdom_user_home_content(mail_home_rw_t) type mqueue_spool_t; files_mountpoint(mqueue_spool_t) +files_spool_file(mqueue_spool_t) type mail_spool_t; files_mountpoint(mail_spool_t) +files_spool_file(mail_spool_t) type sendmail_exec_t; mta_agent_executable(sendmail_exec_t) @@ -50,21 +55,12 @@ userdom_user_tmp_file(user_mail_tmp_t) # newalias required this, not sure if it is needed in 'if' file allow system_mail_t self:capability { dac_override fowner }; -allow system_mail_t self:fifo_file rw_fifo_file_perms; -read_files_pattern(system_mail_t, etc_mail_t, etc_mail_t) +allow system_mail_t mail_home_t:file manage_file_perms; read_files_pattern(system_mail_t, mailcontent_type, mailcontent_type) -allow system_mail_t mail_forward_t:file read_file_perms; - -allow system_mail_t mta_exec_type:file entrypoint; - -can_exec(system_mail_t, mta_exec_type) - -kernel_read_system_state(system_mail_t) -kernel_read_network_state(system_mail_t) -kernel_request_load_module(system_mail_t) +corecmd_exec_shell(system_mail_t) dev_read_sysfs(system_mail_t) dev_read_rand(system_mail_t) @@ -79,9 +75,22 @@ selinux_getattr_fs(system_mail_t) term_dontaudit_use_unallocated_ttys(system_mail_t) init_use_script_ptys(system_mail_t) +init_dontaudit_rw_stream_socket(system_mail_t) -userdom_use_user_terminals(system_mail_t) +userdom_use_inherited_user_terminals(system_mail_t) userdom_dontaudit_search_user_home_dirs(system_mail_t) +userdom_dontaudit_list_admin_dir(system_mail_t) + +manage_dirs_pattern(system_mail_t, mail_home_rw_t, mail_home_rw_t) +manage_files_pattern(system_mail_t, mail_home_rw_t, mail_home_rw_t) + +allow system_mail_t mail_home_t:file manage_file_perms; +userdom_admin_home_dir_filetrans(system_mail_t, mail_home_t, file) + + +logging_append_all_logs(system_mail_t) + +logging_send_syslog_msg(system_mail_t) optional_policy(` apache_read_squirrelmail_data(system_mail_t) @@ -92,14 +101,26 @@ optional_policy(` apache_dontaudit_rw_stream_sockets(system_mail_t) apache_dontaudit_rw_tcp_sockets(system_mail_t) apache_dontaudit_rw_sys_script_stream_sockets(system_mail_t) + apache_dontaudit_rw_tmp_files(system_mail_t) + + # apache should set close-on-exec + apache_dontaudit_rw_stream_sockets(mta_user_agent) + apache_dontaudit_rw_sys_script_stream_sockets(mta_user_agent) + apache_append_log(mta_user_agent) ') optional_policy(` arpwatch_manage_tmp_files(system_mail_t) - ifdef(`hide_broken_symptoms', ` - arpwatch_dontaudit_rw_packet_sockets(system_mail_t) - ') + ifdef(`hide_broken_symptoms', ` + arpwatch_dontaudit_rw_packet_sockets(system_mail_t) + ') + +') + +optional_policy(` + bugzilla_search_content(system_mail_t) + bugzilla_dontaudit_rw_stream_sockets(system_mail_t) ') optional_policy(` @@ -108,9 +129,15 @@ optional_policy(` ') optional_policy(` + courier_stream_connect_authdaemon(system_mail_t) +') + +optional_policy(` cron_read_system_job_tmp_files(system_mail_t) cron_dontaudit_write_pipes(system_mail_t) cron_rw_system_job_stream_sockets(system_mail_t) + cron_rw_inherited_spool_files(system_mail_t) + cron_rw_inherited_user_spool_files(system_mail_t) ') optional_policy(` @@ -124,12 +151,9 @@ optional_policy(` ') optional_policy(` - exim_domtrans(system_mail_t) - exim_manage_log(system_mail_t) -') - -optional_policy(` fail2ban_append_log(system_mail_t) + fail2ban_dontaudit_leaks(system_mail_t) + fail2ban_rw_inherited_tmp_files(system_mail_t) ') optional_policy(` @@ -146,6 +170,10 @@ optional_policy(` ') optional_policy(` + munin_dontaudit_leaks(system_mail_t) +') + +optional_policy(` nagios_read_tmp_files(system_mail_t) ') @@ -158,22 +186,13 @@ optional_policy(` files_etc_filetrans(system_mail_t, etc_aliases_t, { file lnk_file sock_file fifo_file }) domain_use_interactive_fds(system_mail_t) - - # postfix needs this for newaliases - files_getattr_tmp_dirs(system_mail_t) - - postfix_exec_master(system_mail_t) - postfix_read_config(system_mail_t) - postfix_search_spool(system_mail_t) - - ifdef(`distro_redhat',` - # compatability for old default main.cf - postfix_config_filetrans(system_mail_t, etc_aliases_t, { dir file lnk_file sock_file fifo_file }) - ') ') optional_policy(` qmail_domtrans_inject(system_mail_t) + qmail_manage_spool_dirs(system_mail_t) + qmail_manage_spool_files(system_mail_t) + qmail_rw_spool_pipes(system_mail_t) ') optional_policy(` @@ -189,6 +208,10 @@ optional_policy(` ') optional_policy(` + spamd_stream_connect(system_mail_t) +') + +optional_policy(` smartmon_read_tmp_files(system_mail_t) ') @@ -199,20 +222,23 @@ optional_policy(` arpwatch_search_data(mailserver_delivery) arpwatch_manage_tmp_files(mta_user_agent) - ifdef(`hide_broken_symptoms', ` - arpwatch_dontaudit_rw_packet_sockets(mta_user_agent) - ') - optional_policy(` cron_read_system_job_tmp_files(mta_user_agent) ') ') +ifdef(`hide_broken_symptoms',` + domain_dontaudit_leaks(user_mail_domain) + domain_dontaudit_leaks(mta_user_agent) +') + ######################################## # # Mailserver delivery local policy # +allow mailserver_delivery self:fifo_file rw_inherited_fifo_file_perms; + allow mailserver_delivery mail_spool_t:dir list_dir_perms; create_files_pattern(mailserver_delivery, mail_spool_t, mail_spool_t) read_files_pattern(mailserver_delivery, mail_spool_t, mail_spool_t) @@ -220,21 +246,13 @@ append_files_pattern(mailserver_delivery, mail_spool_t, mail_spool_t) create_lnk_files_pattern(mailserver_delivery, mail_spool_t, mail_spool_t) read_lnk_files_pattern(mailserver_delivery, mail_spool_t, mail_spool_t) -read_files_pattern(mailserver_delivery, mail_forward_t, mail_forward_t) +userdom_search_admin_dir(mailserver_delivery) +read_files_pattern(mailserver_delivery, mail_home_t, mail_home_t) -read_files_pattern(mailserver_delivery, system_mail_tmp_t, system_mail_tmp_t) +manage_dirs_pattern(mailserver_delivery, mail_home_rw_t, mail_home_rw_t) +manage_files_pattern(mailserver_delivery, mail_home_rw_t, mail_home_rw_t) -tunable_policy(`use_samba_home_dirs',` - fs_manage_cifs_dirs(mailserver_delivery) - fs_manage_cifs_files(mailserver_delivery) - fs_manage_cifs_symlinks(mailserver_delivery) -') - -tunable_policy(`use_nfs_home_dirs',` - fs_manage_nfs_dirs(mailserver_delivery) - fs_manage_nfs_files(mailserver_delivery) - fs_manage_nfs_symlinks(mailserver_delivery) -') +read_files_pattern(mailserver_delivery, system_mail_tmp_t, system_mail_tmp_t) optional_policy(` dovecot_manage_spool(mailserver_delivery) @@ -242,6 +260,10 @@ optional_policy(` ') optional_policy(` + logwatch_search_cache_dir(mailserver_delivery) +') + +optional_policy(` # so MTA can access /var/lib/mailman/mail/wrapper files_search_var_lib(mailserver_delivery) @@ -249,6 +271,14 @@ optional_policy(` mailman_read_data_symlinks(mailserver_delivery) ') +optional_policy(` + postfix_rw_master_pipes(mailserver_delivery) +') + +optional_policy(` + uucp_domtrans_uux(mailserver_delivery) +') + ######################################## # # User send mail local policy @@ -256,9 +286,9 @@ optional_policy(` domain_use_interactive_fds(user_mail_t) -userdom_use_user_terminals(user_mail_t) +userdom_use_inherited_user_terminals(user_mail_t) # Write to the user domain tty. cjp: why? -userdom_use_user_terminals(mta_user_agent) +userdom_use_inherited_user_terminals(mta_user_agent) # Create dead.letter in user home directories. userdom_manage_user_home_content_files(user_mail_t) userdom_user_home_dir_filetrans_user_home_content(user_mail_t, file) @@ -270,6 +300,8 @@ userdom_manage_user_home_content_symlinks(mailserver_delivery) userdom_manage_user_home_content_pipes(mailserver_delivery) userdom_manage_user_home_content_sockets(mailserver_delivery) userdom_user_home_dir_filetrans_user_home_content(mailserver_delivery, { dir file lnk_file fifo_file sock_file }) +allow mailserver_delivery mailserver_delivery:fifo_file rw_inherited_fifo_file_perms; + # Read user temporary files. userdom_read_user_tmp_files(user_mail_t) userdom_dontaudit_append_user_tmp_files(user_mail_t) @@ -277,6 +309,8 @@ userdom_dontaudit_append_user_tmp_files(user_mail_t) # files in an appropriate place for mta_user_agent userdom_read_user_tmp_files(mta_user_agent) +dev_read_sysfs(user_mail_t) + tunable_policy(`use_samba_home_dirs',` fs_manage_cifs_files(user_mail_t) fs_manage_cifs_symlinks(user_mail_t) @@ -292,3 +326,120 @@ optional_policy(` postfix_read_config(user_mail_t) postfix_list_spool(user_mail_t) ') + +######################################## +# +# Comman user_mail_domain policy +# + +allow user_mail_domain self:capability { setuid setgid chown }; +allow user_mail_domain self:process { signal_perms setrlimit }; +allow user_mail_domain self:tcp_socket create_socket_perms; +allow user_mail_domain self:fifo_file rw_fifo_file_perms; +allow user_mail_domain mta_exec_type:file entrypoint; + +append_files_pattern(user_mail_domain, mail_home_t, mail_home_t) +read_files_pattern(user_mail_domain, mail_home_t, mail_home_t) + +manage_dirs_pattern(user_mail_domain, mail_home_rw_t, mail_home_rw_t) +manage_files_pattern(user_mail_domain, mail_home_rw_t, mail_home_rw_t) + +read_files_pattern(user_mail_domain, etc_aliases_t, etc_aliases_t) + +can_exec(user_mail_domain, mta_exec_type) + +allow system_mail_t user_mail_domain:file read_file_perms; + +read_files_pattern(user_mail_domain, etc_mail_t, etc_mail_t) + +kernel_read_system_state(user_mail_domain) +kernel_read_network_state(user_mail_domain) +kernel_request_load_module(user_mail_domain) + +dev_read_urand(user_mail_domain) + +files_read_usr_files(user_mail_domain) + +# Write to /var/spool/mail and /var/spool/mqueue. +manage_files_pattern(user_mail_domain, mail_spool_t, mail_spool_t) +manage_files_pattern(user_mail_domain, mqueue_spool_t, mqueue_spool_t) +read_lnk_files_pattern(user_mail_domain, mail_spool_t, mail_spool_t) +read_lnk_files_pattern(user_mail_domain, mqueue_spool_t, mqueue_spool_t) + +# re-exec itself +can_exec(user_mail_domain, sendmail_exec_t) +allow user_mail_domain sendmail_exec_t:lnk_file read_lnk_file_perms; + +kernel_read_system_state(user_mail_domain) +kernel_read_kernel_sysctls(user_mail_domain) + +corenet_tcp_sendrecv_generic_if(user_mail_domain) +corenet_tcp_sendrecv_generic_node(user_mail_domain) +corenet_tcp_sendrecv_all_ports(user_mail_domain) +corenet_tcp_connect_all_ports(user_mail_domain) +corenet_tcp_connect_smtp_port(user_mail_domain) +corenet_sendrecv_smtp_client_packets(user_mail_domain) + +corecmd_exec_bin(user_mail_domain) + +files_read_etc_files(user_mail_domain) +files_search_spool(user_mail_domain) +# It wants to check for nscd +files_dontaudit_search_pids(user_mail_domain) +allow user_mail_domain etc_mail_t:dir search_dir_perms; + +files_read_etc_runtime_files(user_mail_domain) + +# Check available space. +fs_getattr_xattr_fs(user_mail_domain) + +init_dontaudit_rw_utmp(user_mail_domain) + +optional_policy(` + courier_manage_spool_dirs(user_mail_domain) + courier_manage_spool_files(user_mail_domain) + courier_rw_spool_pipes(user_mail_domain) +') + +optional_policy(` + exim_domtrans(user_mail_domain) + exim_manage_log(user_mail_domain) + exim_manage_spool_files(user_mail_domain) +') + +optional_policy(` + # postfix needs this for newaliases + files_getattr_tmp_dirs(user_mail_domain) + + postfix_exec_master(user_mail_domain) + postfix_read_config(user_mail_domain) + postfix_search_spool(user_mail_domain) + postfix_rw_master_pipes(user_mail_domain) + + ifdef(`distro_redhat',` + # compatability for old default main.cf + postfix_config_filetrans(user_mail_domain, etc_aliases_t, { dir file lnk_file sock_file fifo_file }) + ') +') + +optional_policy(` + openshift_rw_inherited_content(mta_user_agent) +') + +optional_policy(` + procmail_exec(user_mail_domain) +') + +optional_policy(` + qmail_domtrans_inject(user_mail_domain) +') + +optional_policy(` + # Write to /var/log/sendmail.st + sendmail_manage_log(user_mail_domain) + sendmail_create_log(user_mail_domain) +') + +optional_policy(` + uucp_manage_spool(user_mail_domain) +') diff --git a/munin.fc b/munin.fc index fd71d69..26597b2 100644 --- a/munin.fc +++ b/munin.fc @@ -41,6 +41,9 @@ /usr/share/munin/plugins/tomcat_.* -- gen_context(system_u:object_r:services_munin_plugin_exec_t,s0) /usr/share/munin/plugins/varnish_.* -- gen_context(system_u:object_r:services_munin_plugin_exec_t,s0) +# selinux plugins +/usr/share/munin/plugins/selinux_avcstat -- gen_context(system_u:object_r:selinux_munin_plugin_exec_t,s0) + # system plugins /usr/share/munin/plugins/acpi -- gen_context(system_u:object_r:system_munin_plugin_exec_t,s0) /usr/share/munin/plugins/cpu.* -- gen_context(system_u:object_r:system_munin_plugin_exec_t,s0) @@ -51,6 +54,7 @@ /usr/share/munin/plugins/irqstats -- gen_context(system_u:object_r:system_munin_plugin_exec_t,s0) /usr/share/munin/plugins/load -- gen_context(system_u:object_r:system_munin_plugin_exec_t,s0) /usr/share/munin/plugins/memory -- gen_context(system_u:object_r:system_munin_plugin_exec_t,s0) +/usr/share/munin/plugins/munin_.* -- gen_context(system_u:object_r:system_munin_plugin_exec_t,s0) /usr/share/munin/plugins/netstat -- gen_context(system_u:object_r:system_munin_plugin_exec_t,s0) /usr/share/munin/plugins/nfs.* -- gen_context(system_u:object_r:system_munin_plugin_exec_t,s0) /usr/share/munin/plugins/open_files -- gen_context(system_u:object_r:system_munin_plugin_exec_t,s0) @@ -63,6 +67,7 @@ /usr/share/munin/plugins/yum -- gen_context(system_u:object_r:system_munin_plugin_exec_t,s0) /var/lib/munin(/.*)? gen_context(system_u:object_r:munin_var_lib_t,s0) +/var/lib/munin/plugin-state(/.*)? gen_context(system_u:object_r:munin_plugin_state_t,s0) /var/log/munin.* gen_context(system_u:object_r:munin_log_t,s0) /var/run/munin(/.*)? gen_context(system_u:object_r:munin_var_run_t,s0) /var/www/html/munin(/.*)? gen_context(system_u:object_r:httpd_munin_content_t,s0) diff --git a/munin.if b/munin.if index c358d8f..7c097ec 100644 --- a/munin.if +++ b/munin.if @@ -13,10 +13,11 @@ # template(`munin_plugin_template',` gen_require(` - type munin_t, munin_exec_t, munin_etc_t; + type munin_t; + attribute munin_plugin_domain; ') - type $1_munin_plugin_t; + type $1_munin_plugin_t, munin_plugin_domain; type $1_munin_plugin_exec_t; typealias $1_munin_plugin_t alias munin_$1_plugin_t; typealias $1_munin_plugin_exec_t alias munin_$1_plugin_exec_t; @@ -36,17 +37,7 @@ template(`munin_plugin_template',` # automatic transition rules from munin domain # to specific munin plugin domain domtrans_pattern(munin_t, $1_munin_plugin_exec_t, $1_munin_plugin_t) - - allow $1_munin_plugin_t munin_exec_t:file read_file_perms; - allow $1_munin_plugin_t munin_t:tcp_socket rw_socket_perms; - - read_lnk_files_pattern($1_munin_plugin_t, munin_etc_t, munin_etc_t) - - kernel_read_system_state($1_munin_plugin_t) - - corecmd_exec_bin($1_munin_plugin_t) - - miscfiles_read_localization($1_munin_plugin_t) + allow munin_t $1_munin_plugin_t:process signal_perms; ') ######################################## @@ -65,9 +56,8 @@ interface(`munin_stream_connect',` type munin_var_run_t, munin_t; ') - allow $1 munin_t:unix_stream_socket connectto; - allow $1 munin_var_run_t:sock_file { getattr write }; files_search_pids($1) + stream_connect_pattern($1, munin_var_run_t, munin_var_run_t, munin_t) ') ####################################### @@ -88,10 +78,28 @@ interface(`munin_read_config',` allow $1 munin_etc_t:dir list_dir_perms; allow $1 munin_etc_t:file read_file_perms; - allow $1 munin_etc_t:lnk_file { getattr read }; + allow $1 munin_etc_t:lnk_file read_lnk_file_perms; files_search_etc($1) ') +###################################### +## +## dontaudit read and write an leaked file descriptors +## +## +## +## Domain to not audit. +## +## +# +interface(`munin_dontaudit_leaks',` + gen_require(` + type munin_t; + ') + + dontaudit $1 munin_t:tcp_socket { read write }; +') + ####################################### ## ## Append to the munin log. @@ -172,12 +180,14 @@ interface(`munin_admin',` gen_require(` type munin_t, munin_etc_t, munin_tmp_t; type munin_log_t, munin_var_lib_t, munin_var_run_t; - type httpd_munin_content_t; - type munin_initrc_exec_t; + type httpd_munin_content_t, munin_initrc_exec_t; ') - allow $1 munin_t:process { ptrace signal_perms }; + allow $1 munin_t:process signal_perms; ps_process_pattern($1, munin_t) + tunable_policy(`deny_ptrace',`',` + allow $1 munin_t:process ptrace; + ') init_labeled_script_domtrans($1, munin_initrc_exec_t) domain_system_change_exemption($1) diff --git a/munin.te b/munin.te index f17583b..14ed0b0 100644 --- a/munin.te +++ b/munin.te @@ -5,6 +5,8 @@ policy_module(munin, 1.8.0) # Declarations # +attribute munin_plugin_domain; + type munin_t alias lrrd_t; type munin_exec_t alias lrrd_exec_t; init_daemon_domain(munin_t, munin_exec_t) @@ -24,6 +26,9 @@ files_tmp_file(munin_tmp_t) type munin_var_lib_t alias lrrd_var_lib_t; files_type(munin_var_lib_t) +type munin_plugin_state_t; +files_type(munin_plugin_state_t) + type munin_var_run_t alias lrrd_var_run_t; files_pid_file(munin_var_run_t) @@ -31,6 +36,8 @@ munin_plugin_template(disk) munin_plugin_template(mail) +munin_plugin_template(selinux) + munin_plugin_template(services) munin_plugin_template(system) @@ -40,7 +47,7 @@ munin_plugin_template(system) # Local policy # -allow munin_t self:capability { chown dac_override setgid setuid }; +allow munin_t self:capability { chown dac_override kill setgid setuid sys_rawio }; dontaudit munin_t self:capability sys_tty_config; allow munin_t self:process { getsched setsched signal_perms }; allow munin_t self:unix_stream_socket { create_stream_socket_perms connectto }; @@ -71,9 +78,12 @@ manage_files_pattern(munin_t, munin_var_lib_t, munin_var_lib_t) manage_lnk_files_pattern(munin_t, munin_var_lib_t, munin_var_lib_t) files_search_var_lib(munin_t) +manage_dirs_pattern(munin_t, munin_var_run_t, munin_var_run_t) manage_files_pattern(munin_t, munin_var_run_t, munin_var_run_t) manage_sock_files_pattern(munin_t, munin_var_run_t, munin_var_run_t) -files_pid_filetrans(munin_t, munin_var_run_t, file) +files_pid_filetrans(munin_t, munin_var_run_t, { file dir }) + +read_files_pattern(munin_t, munin_plugin_state_t, munin_plugin_state_t) kernel_read_system_state(munin_t) kernel_read_network_state(munin_t) @@ -82,7 +92,6 @@ kernel_read_all_sysctls(munin_t) corecmd_exec_bin(munin_t) corecmd_exec_shell(munin_t) -corenet_all_recvfrom_unlabeled(munin_t) corenet_all_recvfrom_netlabel(munin_t) corenet_tcp_sendrecv_generic_if(munin_t) corenet_udp_sendrecv_generic_if(munin_t) @@ -101,7 +110,6 @@ dev_read_urand(munin_t) domain_use_interactive_fds(munin_t) domain_read_all_domains_state(munin_t) -files_read_etc_files(munin_t) files_read_etc_runtime_files(munin_t) files_read_usr_files(munin_t) files_list_spool(munin_t) @@ -115,7 +123,7 @@ logging_send_syslog_msg(munin_t) logging_read_all_logs(munin_t) miscfiles_read_fonts(munin_t) -miscfiles_read_localization(munin_t) +miscfiles_setattr_fonts_cache_dirs(munin_t) sysnet_exec_ifconfig(munin_t) @@ -145,6 +153,7 @@ optional_policy(` optional_policy(` mta_read_config(munin_t) mta_send_mail(munin_t) + mta_list_queue(munin_t) mta_read_queue(munin_t) ') @@ -159,6 +168,7 @@ optional_policy(` optional_policy(` postfix_list_spool(munin_t) + postfix_getattr_spool_files(munin_t) ') optional_policy(` @@ -182,6 +192,7 @@ optional_policy(` # local policy for disk plugins # +allow disk_munin_plugin_t self:capability { sys_admin sys_rawio }; allow disk_munin_plugin_t self:tcp_socket create_stream_socket_perms; rw_files_pattern(disk_munin_plugin_t, munin_var_lib_t, munin_var_lib_t) @@ -190,15 +201,14 @@ corecmd_exec_shell(disk_munin_plugin_t) corenet_tcp_connect_hddtemp_port(disk_munin_plugin_t) -files_read_etc_files(disk_munin_plugin_t) files_read_etc_runtime_files(disk_munin_plugin_t) +files_read_usr_files(disk_munin_plugin_t) -fs_getattr_all_fs(disk_munin_plugin_t) - +dev_getattr_lvm_control(disk_munin_plugin_t) dev_read_sysfs(disk_munin_plugin_t) dev_read_urand(disk_munin_plugin_t) -storage_getattr_fixed_disk_dev(disk_munin_plugin_t) +storage_raw_read_fixed_disk(disk_munin_plugin_t) sysnet_read_config(disk_munin_plugin_t) @@ -221,30 +231,47 @@ rw_files_pattern(mail_munin_plugin_t, munin_var_lib_t, munin_var_lib_t) dev_read_urand(mail_munin_plugin_t) -files_read_etc_files(mail_munin_plugin_t) +logging_read_generic_logs(mail_munin_plugin_t) -fs_getattr_all_fs(mail_munin_plugin_t) +optional_policy(` + exim_read_log(mail_munin_plugin_t) +') -logging_read_generic_logs(mail_munin_plugin_t) +optional_policy(` + mta_read_config(mail_munin_plugin_t) + mta_send_mail(mail_munin_plugin_t) + mta_list_queue(mail_munin_plugin_t) + mta_read_queue(mail_munin_plugin_t) +') -mta_read_config(mail_munin_plugin_t) -mta_send_mail(mail_munin_plugin_t) -mta_read_queue(mail_munin_plugin_t) +optional_policy(` + nscd_socket_use(mail_munin_plugin_t) +') optional_policy(` postfix_read_config(mail_munin_plugin_t) postfix_list_spool(mail_munin_plugin_t) + postfix_getattr_spool_files(mail_munin_plugin_t) ') optional_policy(` sendmail_read_log(mail_munin_plugin_t) ') +################################## +# +# local policy for selinux plugins +# + +selinux_get_enforce_mode(selinux_munin_plugin_t) + ################################### # # local policy for service plugins # +allow services_munin_plugin_t self:shm create_sem_perms; +allow services_munin_plugin_t self:sem create_sem_perms; allow services_munin_plugin_t self:tcp_socket create_stream_socket_perms; allow services_munin_plugin_t self:udp_socket create_socket_perms; allow services_munin_plugin_t self:netlink_route_socket r_netlink_socket_perms; @@ -255,13 +282,10 @@ corenet_tcp_connect_http_port(services_munin_plugin_t) dev_read_urand(services_munin_plugin_t) dev_read_rand(services_munin_plugin_t) -fs_getattr_all_fs(services_munin_plugin_t) - -files_read_etc_files(services_munin_plugin_t) - sysnet_read_config(services_munin_plugin_t) optional_policy(` + cups_read_config(services_munin_plugin_t) cups_stream_connect(services_munin_plugin_t) ') @@ -279,6 +303,10 @@ optional_policy(` ') optional_policy(` + nscd_socket_use(services_munin_plugin_t) +') + +optional_policy(` postgresql_stream_connect(services_munin_plugin_t) ') @@ -286,6 +314,10 @@ optional_policy(` snmp_read_snmp_var_lib_files(services_munin_plugin_t) ') +optional_policy(` + varnishd_read_lib_files(services_munin_plugin_t) +') + ################################## # # local policy for system plugins @@ -295,12 +327,10 @@ allow system_munin_plugin_t self:udp_socket create_socket_perms; rw_files_pattern(system_munin_plugin_t, munin_var_lib_t, munin_var_lib_t) -kernel_read_network_state(system_munin_plugin_t) -kernel_read_all_sysctls(system_munin_plugin_t) - -corecmd_exec_shell(system_munin_plugin_t) +# needed by munin_* plugins +allow system_munin_plugin_t munin_log_t:file read_file_perms; -fs_getattr_all_fs(system_munin_plugin_t) +kernel_read_network_state(system_munin_plugin_t) dev_read_sysfs(system_munin_plugin_t) dev_read_urand(system_munin_plugin_t) @@ -313,3 +343,35 @@ init_read_utmp(system_munin_plugin_t) sysnet_exec_ifconfig(system_munin_plugin_t) term_getattr_unallocated_ttys(system_munin_plugin_t) +term_getattr_all_ttys(system_munin_plugin_t) +term_getattr_all_ptys(system_munin_plugin_t) + +################################ +# +# local policy for munin plugin domains +# + +allow munin_plugin_domain munin_exec_t:file read_file_perms; +allow munin_plugin_domain munin_t:tcp_socket rw_socket_perms; + +# creates plugin state files +manage_files_pattern(munin_plugin_domain, munin_plugin_state_t, munin_plugin_state_t) + +read_lnk_files_pattern(munin_plugin_domain, munin_etc_t, munin_etc_t) + +kernel_read_system_state(munin_plugin_domain) + +corecmd_exec_bin(munin_plugin_domain) +corecmd_exec_shell(munin_plugin_domain) + +files_search_var_lib(munin_plugin_domain) +files_read_usr_files(munin_plugin_domain) + +fs_getattr_all_fs(munin_plugin_domain) + +auth_read_passwd(munin_plugin_domain) + + +optional_policy(` + nscd_socket_use(munin_plugin_domain) +') diff --git a/mysql.fc b/mysql.fc index 716d666..43f60de 100644 --- a/mysql.fc +++ b/mysql.fc @@ -1,6 +1,14 @@ # mysql database server # +# /HOME +# +HOME_DIR/\.my\.cnf -- gen_context(system_u:object_r:mysqld_home_t, s0) +/root/\.my\.cnf -- gen_context(system_u:object_r:mysqld_home_t, s0) + +/usr/lib/systemd/system/mysqld.* -- gen_context(system_u:object_r:mysqld_unit_file_t,s0) + +# # /etc # /etc/my\.cnf -- gen_context(system_u:object_r:mysqld_etc_t,s0) diff --git a/mysql.if b/mysql.if index e9c0982..404ed6d 100644 --- a/mysql.if +++ b/mysql.if @@ -18,6 +18,24 @@ interface(`mysql_domtrans',` domtrans_pattern($1, mysqld_exec_t, mysqld_t) ') +###################################### +## +## Execute MySQL in the caller domain. +## +## +## +## Domain allowed access. +## +## +# +interface(`mysql_exec',` + gen_require(` + type mysqld_exec_t; + ') + + can_exec($1, mysqld_exec_t) +') + ######################################## ## ## Send a generic signal to MySQL. @@ -36,6 +54,24 @@ interface(`mysql_signal',` allow $1 mysqld_t:process signal; ') +####################################### +## +## Send a null signal to mysql. +## +## +## +## Domain allowed access. +## +## +# +interface(`mysql_signull',` + gen_require(` + type mysqld_t; + ') + + allow $1 mysqld_t:process signull; +') + ######################################## ## ## Allow the specified domain to connect to postgresql with a tcp socket. @@ -73,6 +109,7 @@ interface(`mysql_stream_connect',` type mysqld_t, mysqld_var_run_t, mysqld_db_t; ') + files_search_pids($1) stream_connect_pattern($1, mysqld_var_run_t, mysqld_var_run_t, mysqld_t) stream_connect_pattern($1, mysqld_db_t, mysqld_var_run_t, mysqld_t) ') @@ -122,6 +159,26 @@ interface(`mysql_search_db',` ######################################## ## +## List the directories that contain MySQL +## database storage. +## +## +## +## Domain allowed access. +## +## +# +interface(`mysql_list_db',` + gen_require(` + type mysqld_db_t; + ') + + files_search_var_lib($1) + allow $1 mysqld_db_t:dir list_dir_perms; +') + +######################################## +## ## Read and write to the MySQL database directory. ## ## @@ -252,12 +309,12 @@ interface(`mysql_write_log',` ') logging_search_logs($1) - allow $1 mysqld_log_t:file { write_file_perms setattr }; + allow $1 mysqld_log_t:file { write_file_perms setattr_file_perms }; ') ###################################### ## -## Execute MySQL server in the mysql domain. +## Execute MySQL safe script in the mysql safe domain. ## ## ## @@ -273,6 +330,24 @@ interface(`mysql_domtrans_mysql_safe',` domtrans_pattern($1, mysqld_safe_exec_t, mysqld_safe_t) ') +###################################### +## +## Execute MySQL_safe in the caller domain. +## +## +## +## Domain allowed access. +## +## +# +interface(`mysql_safe_exec',` + gen_require(` + type mysqld_safe_exec_t; + ') + + can_exec($1, mysqld_safe_exec_t) +') + ##################################### ## ## Read MySQL PID files. @@ -313,6 +388,67 @@ interface(`mysql_search_pid_files',` ######################################## ## +## Execute mysqld server in the mysqld domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`mysql_systemctl',` + gen_require(` + type mysqld_unit_file_t; + type mysqld_t; + ') + + systemd_exec_systemctl($1) + allow $1 mysqld_unit_file_t:file read_file_perms; + allow $1 mysqld_unit_file_t:service manage_service_perms; + + ps_process_pattern($1, mysqld_t) +') + +######################################## +## +## read mysqld homedir content (.k5login) +## +## +## +## Domain allowed access. +## +## +# +interface(`mysql_read_home_content',` + gen_require(` + type mysqld_home_t; + ') + + userdom_search_user_home_dirs($1) + read_files_pattern($1, mysqld_home_t, mysqld_home_t) +') + +######################################## +## +## Transition to mysqld named content +## +## +## +## Domain allowed access. +## +## +# +interface(`mysql_filetrans_named_content',` + gen_require(` + type mysqld_home_t; + ') + + userdom_admin_home_dir_filetrans($1, mysqld_home_t, file, ".my.cnf") + userdom_user_home_dir_filetrans($1, mysqld_home_t, file, ".my.cnf") +') + +######################################## +## ## All of the rules required to administrate an mysql environment ## ## @@ -329,27 +465,45 @@ interface(`mysql_search_pid_files',` # interface(`mysql_admin',` gen_require(` - type mysqld_t, mysqld_var_run_t; - type mysqld_tmp_t, mysqld_db_t; - type mysqld_etc_t, mysqld_log_t; - type mysqld_initrc_exec_t; + type mysqld_t, mysqld_var_run_t, mysqld_initrc_exec_t; + type mysqld_tmp_t, mysqld_db_t, mysqld_log_t; + type mysqld_etc_t; + type mysqld_home_t; + type mysqld_unit_file_t; ') - allow $1 mysqld_t:process { ptrace signal_perms }; + allow $1 mysqld_t:process signal_perms; ps_process_pattern($1, mysqld_t) + tunable_policy(`deny_ptrace',`',` + allow $1 mysqld_t:process ptrace; + ') init_labeled_script_domtrans($1, mysqld_initrc_exec_t) domain_system_change_exemption($1) role_transition $2 mysqld_initrc_exec_t system_r; allow $2 system_r; + files_list_pids($1) admin_pattern($1, mysqld_var_run_t) admin_pattern($1, mysqld_db_t) + files_list_etc($1) admin_pattern($1, mysqld_etc_t) + logging_list_logs($1) admin_pattern($1, mysqld_log_t) + files_list_tmp($1) admin_pattern($1, mysqld_tmp_t) + + userdom_search_user_home_dirs($1) + files_list_root($1) + admin_pattern($1, mysqld_home_t) + + mysql_systemctl($1) + admin_pattern($1, mysqld_unit_file_t) + allow $1 mysqld_unit_file_t:service all_service_perms; + + mysql_stream_connect($1) ') diff --git a/mysql.te b/mysql.te index 1cf05a3..8855ea2 100644 --- a/mysql.te +++ b/mysql.te @@ -29,6 +29,12 @@ files_type(mysqld_db_t) type mysqld_etc_t alias etc_mysqld_t; files_config_file(mysqld_etc_t) +type mysqld_home_t; +userdom_user_home_content(mysqld_home_t) + +type mysqld_unit_file_t; +systemd_unit_file(mysqld_unit_file_t) + type mysqld_initrc_exec_t; init_script_file(mysqld_initrc_exec_t) @@ -64,11 +70,12 @@ allow mysqld_t self:udp_socket create_socket_perms; manage_dirs_pattern(mysqld_t, mysqld_db_t, mysqld_db_t) manage_files_pattern(mysqld_t, mysqld_db_t, mysqld_db_t) +manage_sock_files_pattern(mysqld_t, mysqld_db_t, mysqld_db_t) manage_lnk_files_pattern(mysqld_t, mysqld_db_t, mysqld_db_t) files_var_lib_filetrans(mysqld_t, mysqld_db_t, { dir file lnk_file }) allow mysqld_t mysqld_etc_t:file read_file_perms; -allow mysqld_t mysqld_etc_t:lnk_file { getattr read }; +allow mysqld_t mysqld_etc_t:lnk_file read_lnk_file_perms; allow mysqld_t mysqld_etc_t:dir list_dir_perms; allow mysqld_t mysqld_log_t:file manage_file_perms; @@ -78,14 +85,21 @@ manage_dirs_pattern(mysqld_t, mysqld_tmp_t, mysqld_tmp_t) manage_files_pattern(mysqld_t, mysqld_tmp_t, mysqld_tmp_t) files_tmp_filetrans(mysqld_t, mysqld_tmp_t, { file dir }) +manage_dirs_pattern(mysqld_t, mysqld_var_run_t, mysqld_var_run_t) manage_files_pattern(mysqld_t, mysqld_var_run_t, mysqld_var_run_t) manage_sock_files_pattern(mysqld_t, mysqld_var_run_t, mysqld_var_run_t) -files_pid_filetrans(mysqld_t, mysqld_var_run_t, { file sock_file }) +files_pid_filetrans(mysqld_t, mysqld_var_run_t, { dir file sock_file }) + +userdom_dontaudit_use_unpriv_user_fds(mysqld_t) +kernel_read_network_state(mysqld_t) kernel_read_system_state(mysqld_t) +kernel_read_network_state(mysqld_t) kernel_read_kernel_sysctls(mysqld_t) -corenet_all_recvfrom_unlabeled(mysqld_t) +corecmd_exec_bin(mysqld_t) +corecmd_exec_shell(mysqld_t) + corenet_all_recvfrom_netlabel(mysqld_t) corenet_tcp_sendrecv_generic_if(mysqld_t) corenet_udp_sendrecv_generic_if(mysqld_t) @@ -110,7 +124,6 @@ domain_use_interactive_fds(mysqld_t) files_getattr_var_lib_dirs(mysqld_t) files_read_etc_runtime_files(mysqld_t) -files_read_etc_files(mysqld_t) files_read_usr_files(mysqld_t) files_search_var_lib(mysqld_t) @@ -118,17 +131,10 @@ auth_use_nsswitch(mysqld_t) logging_send_syslog_msg(mysqld_t) -miscfiles_read_localization(mysqld_t) - sysnet_read_config(mysqld_t) -userdom_dontaudit_use_unpriv_user_fds(mysqld_t) -# for /root/.my.cnf - should not be needed: -userdom_read_user_home_content_files(mysqld_t) - ifdef(`distro_redhat',` - # because Fedora has the sock_file in the database directory - type_transition mysqld_t mysqld_db_t:sock_file mysqld_var_run_t; + filetrans_pattern(mysqld_t, mysqld_db_t, mysqld_var_run_t, sock_file) ') tunable_policy(`mysql_connect_any',` @@ -154,10 +160,11 @@ optional_policy(` # allow mysqld_safe_t self:capability { chown dac_override fowner kill }; -dontaudit mysqld_safe_t self:capability sys_ptrace; +allow mysqld_safe_t self:process { setsched getsched setrlimit }; allow mysqld_safe_t self:fifo_file rw_fifo_file_perms; read_lnk_files_pattern(mysqld_safe_t, mysqld_db_t, mysqld_db_t) +delete_sock_files_pattern(mysqld_safe_t, mysqld_db_t, mysqld_db_t) domtrans_pattern(mysqld_safe_t, mysqld_exec_t, mysqld_t) @@ -170,26 +177,33 @@ kernel_read_system_state(mysqld_safe_t) kernel_read_kernel_sysctls(mysqld_safe_t) corecmd_exec_bin(mysqld_safe_t) +corecmd_exec_shell(mysqld_safe_t) dev_list_sysfs(mysqld_safe_t) domain_read_all_domains_state(mysqld_safe_t) -files_read_etc_files(mysqld_safe_t) +files_dontaudit_search_all_mountpoints(mysqld_safe_t) files_read_usr_files(mysqld_safe_t) files_dontaudit_getattr_all_dirs(mysqld_safe_t) logging_log_filetrans(mysqld_safe_t, mysqld_log_t, file) +logging_send_syslog_msg(mysqld_safe_t) -hostname_exec(mysqld_safe_t) +auth_read_passwd(mysqld_safe_t) -miscfiles_read_localization(mysqld_safe_t) +domain_dontaudit_signull_all_domains(mysqld_safe_t) mysql_manage_db_files(mysqld_safe_t) mysql_read_config(mysqld_safe_t) mysql_search_pid_files(mysqld_safe_t) +mysql_signull(mysqld_safe_t) mysql_write_log(mysqld_safe_t) +optional_policy(` + hostname_exec(mysqld_safe_t) +') + ######################################## # # MySQL Manager Policy @@ -218,7 +232,6 @@ kernel_read_system_state(mysqlmanagerd_t) corecmd_exec_shell(mysqlmanagerd_t) -corenet_all_recvfrom_unlabeled(mysqlmanagerd_t) corenet_all_recvfrom_netlabel(mysqlmanagerd_t) corenet_tcp_sendrecv_generic_if(mysqlmanagerd_t) corenet_tcp_sendrecv_generic_node(mysqlmanagerd_t) @@ -231,9 +244,7 @@ corenet_sendrecv_mysqlmanagerd_client_packets(mysqlmanagerd_t) dev_read_urand(mysqlmanagerd_t) -files_read_etc_files(mysqlmanagerd_t) files_read_usr_files(mysqlmanagerd_t) -miscfiles_read_localization(mysqlmanagerd_t) userdom_getattr_user_home_dirs(mysqlmanagerd_t) diff --git a/nagios.fc b/nagios.fc index 1238f2e..d80b4db 100644 --- a/nagios.fc +++ b/nagios.fc @@ -6,7 +6,7 @@ /usr/s?bin/nagios -- gen_context(system_u:object_r:nagios_exec_t,s0) /usr/s?bin/nrpe -- gen_context(system_u:object_r:nrpe_exec_t,s0) -/usr/lib/cgi-bin/netsaint(/.*)? gen_context(system_u:object_r:httpd_nagios_script_exec_t,s0) +/usr/lib/cgi-bin/netsaint(/.*)? gen_context(system_u:object_r:httpd_nagios_script_exec_t,s0) /usr/lib/nagios/cgi(/.*)? gen_context(system_u:object_r:httpd_nagios_script_exec_t,s0) /var/log/nagios(/.*)? gen_context(system_u:object_r:nagios_log_t,s0) @@ -19,70 +19,75 @@ ifdef(`distro_debian',` /usr/sbin/nagios -- gen_context(system_u:object_r:nagios_exec_t,s0) ') -/usr/lib/cgi-bin/nagios(/.+)? gen_context(system_u:object_r:httpd_nagios_script_exec_t,s0) -/usr/lib/nagios/cgi-bin(/.*)? gen_context(system_u:object_r:httpd_nagios_script_exec_t,s0) +/usr/lib/cgi-bin/nagios(/.+)? gen_context(system_u:object_r:httpd_nagios_script_exec_t,s0) +/usr/lib/nagios/cgi-bin(/.*)? gen_context(system_u:object_r:httpd_nagios_script_exec_t,s0) # admin plugins -/usr/lib/nagios/plugins/check_file_age -- gen_context(system_u:object_r:nagios_admin_plugin_exec_t,s0) +/usr/lib/nagios/plugins/check_file_age -- gen_context(system_u:object_r:nagios_admin_plugin_exec_t,s0) # check disk plugins /usr/lib/nagios/plugins/check_disk -- gen_context(system_u:object_r:nagios_checkdisk_plugin_exec_t,s0) -/usr/lib/nagios/plugins/check_disk_smb -- gen_context(system_u:object_r:nagios_checkdisk_plugin_exec_t,s0) -/usr/lib/nagios/plugins/check_ide_smart -- gen_context(system_u:object_r:nagios_checkdisk_plugin_exec_t,s0) +/usr/lib/nagios/plugins/check_disk_smb -- gen_context(system_u:object_r:nagios_checkdisk_plugin_exec_t,s0) +/usr/lib/nagios/plugins/check_ide_smart -- gen_context(system_u:object_r:nagios_checkdisk_plugin_exec_t,s0) /usr/lib/nagios/plugins/check_linux_raid -- gen_context(system_u:object_r:nagios_checkdisk_plugin_exec_t,s0) # mail plugins -/usr/lib/nagios/plugins/check_mailq -- gen_context(system_u:object_r:nagios_mail_plugin_exec_t,s0) +/usr/lib/nagios/plugins/check_mailq -- gen_context(system_u:object_r:nagios_mail_plugin_exec_t,s0) + +/usr/lib/pnp4nagios(/.*)? gen_context(system_u:object_r:nagios_var_lib_t,s0) # system plugins -/usr/lib/nagios/plugins/check_breeze -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) -/usr/lib/nagios/plugins/check_dummy -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) -/usr/lib/nagios/plugins/check_flexlm -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) +/usr/lib/nagios/plugins/check_breeze -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib/nagios/plugins/check_dummy -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib/nagios/plugins/check_flexlm -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) /usr/lib/nagios/plugins/check_ifoperstatus -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) -/usr/lib/nagios/plugins/check_ifstatus -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) +/usr/lib/nagios/plugins/check_ifstatus -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) /usr/lib/nagios/plugins/check_load -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) /usr/lib/nagios/plugins/check_log -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) /usr/lib/nagios/plugins/check_mrtg -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) -/usr/lib/nagios/plugins/check_mrtgtraf -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) -/usr/lib/nagios/plugins/check_nagios -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) -/usr/lib/nagios/plugins/check_nwstat -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) -/usr/lib/nagios/plugins/check_overcr -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) -/usr/lib/nagios/plugins/check_procs -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) -/usr/lib/nagios/plugins/check_sensors -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) +/usr/lib/nagios/plugins/check_mrtgtraf -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) +/usr/lib/nagios/plugins/check_nagios -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) +/usr/lib/nagios/plugins/check_nwstat -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) +/usr/lib/nagios/plugins/check_overcr -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) +/usr/lib/nagios/plugins/check_procs -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) +/usr/lib/nagios/plugins/check_sensors -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) /usr/lib/nagios/plugins/check_swap -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) -/usr/lib/nagios/plugins/check_users -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) +/usr/lib/nagios/plugins/check_users -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) /usr/lib/nagios/plugins/check_wave -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) # services plugins -/usr/lib/nagios/plugins/check_cluster -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib/nagios/plugins/check_cluster -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) /usr/lib/nagios/plugins/check_dhcp -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) /usr/lib/nagios/plugins/check_dig -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) /usr/lib/nagios/plugins/check_dns -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) /usr/lib/nagios/plugins/check_game -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) -/usr/lib/nagios/plugins/check_fping -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib/nagios/plugins/check_fping -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) /usr/lib/nagios/plugins/check_hpjd -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) /usr/lib/nagios/plugins/check_http -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) /usr/lib/nagios/plugins/check_icmp -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) /usr/lib/nagios/plugins/check_ircd -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) /usr/lib/nagios/plugins/check_ldap -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) -/usr/lib/nagios/plugins/check_mysql -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib/nagios/plugins/check_mysql -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) /usr/lib/nagios/plugins/check_mysql_query -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) /usr/lib/nagios/plugins/check_nrpe -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) /usr/lib/nagios/plugins/check_nt -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) -/usr/lib/nagios/plugins/check_ntp.* -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) -/usr/lib/nagios/plugins/check_oracle -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) -/usr/lib/nagios/plugins/check_pgsql -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib/nagios/plugins/check_ntp.* -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib/nagios/plugins/check_oracle -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib/nagios/plugins/check_pgsql -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) /usr/lib/nagios/plugins/check_ping -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) -/usr/lib/nagios/plugins/check_radius -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib/nagios/plugins/check_radius -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) /usr/lib/nagios/plugins/check_real -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) /usr/lib/nagios/plugins/check_rpc -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) /usr/lib/nagios/plugins/check_tcp -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) /usr/lib/nagios/plugins/check_time -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) /usr/lib/nagios/plugins/check_sip -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) /usr/lib/nagios/plugins/check_smtp -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) -/usr/lib/nagios/plugins/check_snmp.* -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib/nagios/plugins/check_snmp.* -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) /usr/lib/nagios/plugins/check_ssh -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) /usr/lib/nagios/plugins/check_ups -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) # unconfined plugins -/usr/lib/nagios/plugins/check_by_ssh -- gen_context(system_u:object_r:nagios_unconfined_plugin_exec_t,s0) +/usr/lib/nagios/plugins/check_by_ssh -- gen_context(system_u:object_r:nagios_unconfined_plugin_exec_t,s0) + +# eventhandlers +/usr/lib/nagios/plugins/eventhandlers(/.*) gen_context(system_u:object_r:nagios_eventhandler_plugin_exec_t,s0) diff --git a/nagios.if b/nagios.if index 8581040..7d8e93b 100644 --- a/nagios.if +++ b/nagios.if @@ -12,31 +12,22 @@ ## # template(`nagios_plugin_template',` - gen_require(` + attribute nagios_plugin_domain; type nagios_t, nrpe_t; - type nagios_log_t; ') - type nagios_$1_plugin_t; + type nagios_$1_plugin_t, nagios_plugin_domain; type nagios_$1_plugin_exec_t; application_domain(nagios_$1_plugin_t, nagios_$1_plugin_exec_t) role system_r types nagios_$1_plugin_t; - allow nagios_$1_plugin_t self:fifo_file rw_fifo_file_perms; - domtrans_pattern(nrpe_t, nagios_$1_plugin_exec_t, nagios_$1_plugin_t) + allow nagios_t nagios_$1_plugin_exec_t:file ioctl; # needed by command.cfg domtrans_pattern(nagios_t, nagios_$1_plugin_exec_t, nagios_$1_plugin_t) - allow nagios_t nagios_$1_plugin_t:process signal_perms; - - # cjp: leaked file descriptor - dontaudit nagios_$1_plugin_t nrpe_t:tcp_socket { read write }; - dontaudit nagios_$1_plugin_t nagios_log_t:file { read write }; - - miscfiles_read_localization(nagios_$1_plugin_t) ') ######################################## @@ -49,7 +40,6 @@ template(`nagios_plugin_template',` ## Domain to not audit. ## ## -## # interface(`nagios_dontaudit_rw_pipes',` gen_require(` @@ -159,6 +149,26 @@ interface(`nagios_read_tmp_files',` ######################################## ## +## Allow the specified domain to read +## nagios temporary files. +## +## +## +## Domain allowed access. +## +## +# +interface(`nagios_rw_inerited_tmp_files',` + gen_require(` + type nagios_tmp_t; + ') + + allow $1 nagios_tmp_t:file rw_inherited_file_perms; + files_search_tmp($1) +') + +######################################## +## ## Execute the nagios NRPE with ## a domain transition. ## @@ -195,15 +205,16 @@ interface(`nagios_domtrans_nrpe',` # interface(`nagios_admin',` gen_require(` - type nagios_t, nrpe_t; - type nagios_tmp_t, nagios_log_t; - type nagios_etc_t, nrpe_etc_t; - type nagios_spool_t, nagios_var_run_t; - type nagios_initrc_exec_t; + type nagios_t, nrpe_t, nagios_initrc_exec_t; + type nagios_tmp_t, nagios_log_t, nagios_var_run_t; + type nagios_etc_t, nrpe_etc_t, nagios_spool_t; ') - allow $1 nagios_t:process { ptrace signal_perms }; + allow $1 nagios_t:process signal_perms; ps_process_pattern($1, nagios_t) + tunable_policy(`deny_ptrace',`',` + allow $1 nagios_t:process ptrace; + ') init_labeled_script_domtrans($1, nagios_initrc_exec_t) domain_system_change_exemption($1) diff --git a/nagios.te b/nagios.te index c3e2a2d..a40f13f 100644 --- a/nagios.te +++ b/nagios.te @@ -5,6 +5,8 @@ policy_module(nagios, 1.12.0) # Declarations # +attribute nagios_plugin_domain; + type nagios_t; type nagios_exec_t; init_daemon_domain(nagios_t, nagios_exec_t) @@ -25,7 +27,10 @@ type nagios_var_run_t; files_pid_file(nagios_var_run_t) type nagios_spool_t; -files_type(nagios_spool_t) +files_spool_file(nagios_spool_t) + +type nagios_var_lib_t; +files_type(nagios_var_lib_t) nagios_plugin_template(admin) nagios_plugin_template(checkdisk) @@ -33,6 +38,10 @@ nagios_plugin_template(mail) nagios_plugin_template(services) nagios_plugin_template(system) nagios_plugin_template(unconfined) +nagios_plugin_template(eventhandler) + +type nagios_eventhandler_plugin_tmp_t; +files_tmp_file(nagios_eventhandler_plugin_tmp_t) type nagios_system_plugin_tmp_t; files_tmp_file(nagios_system_plugin_tmp_t) @@ -77,13 +86,17 @@ files_pid_filetrans(nagios_t, nagios_var_run_t, file) manage_fifo_files_pattern(nagios_t, nagios_spool_t, nagios_spool_t) files_spool_filetrans(nagios_t, nagios_spool_t, fifo_file) +manage_files_pattern(nagios_t, nagios_var_lib_t, nagios_var_lib_t) +manage_fifo_files_pattern(nagios_t, nagios_var_lib_t, nagios_var_lib_t) +files_var_lib_filetrans(nagios_t, nagios_var_lib_t, { file dir }) + kernel_read_system_state(nagios_t) kernel_read_kernel_sysctls(nagios_t) +kernel_read_software_raid_state(nagios_t) corecmd_exec_bin(nagios_t) corecmd_exec_shell(nagios_t) -corenet_all_recvfrom_unlabeled(nagios_t) corenet_all_recvfrom_netlabel(nagios_t) corenet_tcp_sendrecv_generic_if(nagios_t) corenet_udp_sendrecv_generic_if(nagios_t) @@ -103,31 +116,27 @@ domain_use_interactive_fds(nagios_t) # for ps domain_read_all_domains_state(nagios_t) -files_read_etc_files(nagios_t) files_read_etc_runtime_files(nagios_t) files_read_kernel_symbol_table(nagios_t) files_search_spool(nagios_t) +files_read_usr_files(nagios_t) fs_getattr_all_fs(nagios_t) fs_search_auto_mountpoints(nagios_t) -# for who -init_read_utmp(nagios_t) - auth_use_nsswitch(nagios_t) logging_send_syslog_msg(nagios_t) -miscfiles_read_localization(nagios_t) userdom_dontaudit_use_unpriv_user_fds(nagios_t) userdom_dontaudit_search_user_home_dirs(nagios_t) mta_send_mail(nagios_t) +mta_signal_system_mail(nagios_t) +mta_kill_system_mail(nagios_t) optional_policy(` - netutils_domtrans_ping(nagios_t) - netutils_signal_ping(nagios_t) netutils_kill_ping(nagios_t) ') @@ -143,6 +152,7 @@ optional_policy(` # # Nagios CGI local policy # + optional_policy(` apache_content_template(nagios) typealias httpd_nagios_script_t alias nagios_cgi_t; @@ -180,29 +190,30 @@ optional_policy(` # allow nrpe_t self:capability { setuid setgid }; -dontaudit nrpe_t self:capability {sys_tty_config sys_resource}; +dontaudit nrpe_t self:capability { sys_tty_config sys_resource }; allow nrpe_t self:process { setpgid signal_perms setsched setrlimit }; allow nrpe_t self:fifo_file rw_fifo_file_perms; allow nrpe_t self:tcp_socket create_stream_socket_perms; +read_files_pattern(nrpe_t, nrpe_etc_t, nrpe_etc_t) + domtrans_pattern(nrpe_t, nagios_checkdisk_plugin_exec_t, nagios_checkdisk_plugin_t) -read_files_pattern(nrpe_t, nagios_etc_t, nrpe_etc_t) +read_files_pattern(nrpe_t, nagios_etc_t, nagios_etc_t) files_search_etc(nrpe_t) manage_files_pattern(nrpe_t, nrpe_var_run_t, nrpe_var_run_t) files_pid_filetrans(nrpe_t, nrpe_var_run_t, file) -kernel_read_kernel_sysctls(nrpe_t) -kernel_read_software_raid_state(nrpe_t) kernel_read_system_state(nrpe_t) +kernel_read_kernel_sysctls(nrpe_t) corecmd_exec_bin(nrpe_t) corecmd_exec_shell(nrpe_t) corenet_tcp_bind_generic_node(nrpe_t) corenet_tcp_bind_inetd_child_port(nrpe_t) -corenet_sendrecv_unlabeled_packets(nrpe_t) +corenet_all_recvfrom_netlabel(nrpe_t) dev_read_sysfs(nrpe_t) dev_read_urand(nrpe_t) @@ -211,7 +222,7 @@ domain_use_interactive_fds(nrpe_t) domain_read_all_domains_state(nrpe_t) files_read_etc_runtime_files(nrpe_t) -files_read_etc_files(nrpe_t) +files_read_usr_files(nrpe_t) fs_getattr_all_fs(nrpe_t) fs_search_auto_mountpoints(nrpe_t) @@ -220,7 +231,6 @@ auth_use_nsswitch(nrpe_t) logging_send_syslog_msg(nrpe_t) -miscfiles_read_localization(nrpe_t) userdom_dontaudit_use_unpriv_user_fds(nrpe_t) @@ -252,11 +262,9 @@ optional_policy(` corecmd_read_bin_files(nagios_admin_plugin_t) corecmd_read_bin_symlinks(nagios_admin_plugin_t) -dev_read_urand(nagios_admin_plugin_t) dev_getattr_all_chr_files(nagios_admin_plugin_t) dev_getattr_all_blk_files(nagios_admin_plugin_t) -files_read_etc_files(nagios_admin_plugin_t) # for check_file_age plugin files_getattr_all_dirs(nagios_admin_plugin_t) files_getattr_all_files(nagios_admin_plugin_t) @@ -271,20 +279,15 @@ files_getattr_all_file_type_fs(nagios_admin_plugin_t) # allow nagios_mail_plugin_t self:capability { setuid setgid dac_override }; - allow nagios_mail_plugin_t self:netlink_route_socket r_netlink_socket_perms; allow nagios_mail_plugin_t self:tcp_socket create_stream_socket_perms; allow nagios_mail_plugin_t self:udp_socket create_socket_perms; -kernel_read_system_state(nagios_mail_plugin_t) kernel_read_kernel_sysctls(nagios_mail_plugin_t) corecmd_read_bin_files(nagios_mail_plugin_t) corecmd_read_bin_symlinks(nagios_mail_plugin_t) -dev_read_urand(nagios_mail_plugin_t) - -files_read_etc_files(nagios_mail_plugin_t) logging_send_syslog_msg(nagios_mail_plugin_t) @@ -300,7 +303,7 @@ optional_policy(` optional_policy(` postfix_stream_connect_master(nagios_mail_plugin_t) - posftix_exec_postqueue(nagios_mail_plugin_t) + postfix_exec_postqueue(nagios_mail_plugin_t) ') ###################################### @@ -311,7 +314,9 @@ optional_policy(` # needed by ioctl() allow nagios_checkdisk_plugin_t self:capability { sys_admin sys_rawio }; -files_getattr_all_mountpoints(nagios_checkdisk_plugin_t) +kernel_read_software_raid_state(nagios_checkdisk_plugin_t) + +files_getattr_all_dirs(nagios_checkdisk_plugin_t) files_read_etc_runtime_files(nagios_checkdisk_plugin_t) fs_getattr_all_fs(nagios_checkdisk_plugin_t) @@ -323,11 +328,11 @@ storage_raw_read_fixed_disk(nagios_checkdisk_plugin_t) # local policy for service check plugins # -allow nagios_services_plugin_t self:capability { net_bind_service net_raw }; +allow nagios_services_plugin_t self:capability { setuid net_bind_service net_raw }; allow nagios_services_plugin_t self:process { signal sigkill }; - allow nagios_services_plugin_t self:tcp_socket create_stream_socket_perms; allow nagios_services_plugin_t self:udp_socket create_socket_perms; +allow nagios_services_plugin_t self:rawip_socket create_socket_perms; corecmd_exec_bin(nagios_services_plugin_t) @@ -342,6 +347,8 @@ files_read_usr_files(nagios_services_plugin_t) optional_policy(` netutils_domtrans_ping(nagios_services_plugin_t) + netutils_signal_ping(nagios_services_plugin_t) + netutils_kill_ping(nagios_services_plugin_t) ') optional_policy(` @@ -365,6 +372,8 @@ manage_files_pattern(nagios_system_plugin_t, nagios_system_plugin_tmp_t, nagios_ manage_dirs_pattern(nagios_system_plugin_t, nagios_system_plugin_tmp_t, nagios_system_plugin_tmp_t) files_tmp_filetrans(nagios_system_plugin_t, nagios_system_plugin_tmp_t, { dir file }) +read_files_pattern(nagios_system_plugin_t, nagios_log_t, nagios_log_t) + kernel_read_system_state(nagios_system_plugin_t) kernel_read_kernel_sysctls(nagios_system_plugin_t) @@ -372,11 +381,13 @@ corecmd_exec_bin(nagios_system_plugin_t) corecmd_exec_shell(nagios_system_plugin_t) dev_read_sysfs(nagios_system_plugin_t) -dev_read_urand(nagios_system_plugin_t) domain_read_all_domains_state(nagios_system_plugin_t) -files_read_etc_files(nagios_system_plugin_t) + +fs_getattr_all_fs(nagios_system_plugin_t) + +auth_read_passwd(nagios_system_plugin_t) # needed by check_users plugin optional_policy(` @@ -391,3 +402,51 @@ optional_policy(` optional_policy(` unconfined_domain(nagios_unconfined_plugin_t) ') + +####################################### +# +# Event handler plugin plugin policy +# + +manage_files_pattern(nagios_eventhandler_plugin_t, nagios_eventhandler_plugin_tmp_t, nagios_eventhandler_plugin_tmp_t) +manage_dirs_pattern(nagios_eventhandler_plugin_t, nagios_eventhandler_plugin_tmp_t, nagios_eventhandler_plugin_tmp_t) +files_tmp_filetrans(nagios_eventhandler_plugin_t, nagios_eventhandler_plugin_tmp_t, { dir file }) + +corecmd_exec_bin(nagios_eventhandler_plugin_t) +corecmd_exec_shell(nagios_eventhandler_plugin_t) + +init_domtrans_script(nagios_eventhandler_plugin_t) + +systemd_exec_systemctl(nagios_eventhandler_plugin_t) + +allow nagios_t nagios_eventhandler_plugin_exec_t:dir list_dir_perms; + +optional_policy(` + unconfined_domain(nagios_eventhandler_plugin_t) +') + +###################################### +# +# nagios plugin domain policy +# + +allow nagios_plugin_domain self:fifo_file rw_fifo_file_perms; + +allow nrpe_t nagios_plugin_domain:process { signal sigkill }; + +allow nagios_t nagios_plugin_domain:process signal_perms; + +# cjp: leaked file descriptor +dontaudit nagios_plugin_domain nrpe_t:tcp_socket { read write }; +dontaudit nagios_plugin_domain nagios_log_t:file { read write }; + +kernel_read_system_state(nagios_plugin_domain) + +dev_read_urand(nagios_plugin_domain) +dev_read_rand(nagios_plugin_domain) + +files_read_usr_files(nagios_plugin_domain) + + +userdom_use_inherited_user_ptys(nagios_plugin_domain) +userdom_use_inherited_user_ttys(nagios_plugin_domain) diff --git a/namespace.fc b/namespace.fc new file mode 100644 index 0000000..ce51c8d --- /dev/null +++ b/namespace.fc @@ -0,0 +1,3 @@ + +/etc/security/namespace.init -- gen_context(system_u:object_r:namespace_init_exec_t,s0) + diff --git a/namespace.if b/namespace.if new file mode 100644 index 0000000..8d7c751 --- /dev/null +++ b/namespace.if @@ -0,0 +1,48 @@ + +## policy for namespace + +######################################## +## +## Execute a domain transition to run namespace_init. +## +## +## +## Domain allowed access. +## +## +# +interface(`namespace_init_domtrans',` + gen_require(` + type namespace_init_t, namespace_init_exec_t; + ') + + domtrans_pattern($1, namespace_init_exec_t, namespace_init_t) +') + + +######################################## +## +## Execute namespace_init in the namespace_init domain, and +## allow the specified role the namespace_init domain. +## +## +## +## Domain allowed access +## +## +## +## +## The role to be allowed the namespace_init domain. +## +## +# +interface(`namespace_init_run',` + gen_require(` + type namespace_init_t; + ') + + namespace_init_domtrans($1) + role $2 types namespace_init_t; + + seutil_run_setfiles(namespace_init_t, $2) +') diff --git a/namespace.te b/namespace.te new file mode 100644 index 0000000..ef7b846 --- /dev/null +++ b/namespace.te @@ -0,0 +1,43 @@ +policy_module(namespace,1.0.0) + +######################################## +# +# Declarations +# + +type namespace_init_t; +type namespace_init_exec_t; +init_system_domain(namespace_init_t, namespace_init_exec_t) +role system_r types namespace_init_t; + +######################################## +# +# namespace_init local policy +# + +allow namespace_init_t self:capability dac_override; + +allow namespace_init_t self:fifo_file manage_fifo_file_perms; +allow namespace_init_t self:unix_stream_socket create_stream_socket_perms; + +kernel_read_system_state(namespace_init_t) + +corecmd_exec_shell(namespace_init_t) + +domain_use_interactive_fds(namespace_init_t) +domain_obj_id_change_exemption(namespace_init_t) + +files_polyinstantiate_all(namespace_init_t) + +mcs_file_write_all(namespace_init_t) + +auth_use_nsswitch(namespace_init_t) + + +term_use_console(namespace_init_t) + +userdom_manage_user_home_content_dirs(namespace_init_t) +userdom_manage_user_home_content_files(namespace_init_t) +userdom_relabelto_user_home_dirs(namespace_init_t) +userdom_relabelto_user_home_files(namespace_init_t) +userdom_user_home_dir_filetrans_user_home_content(namespace_init_t, { dir file lnk_file fifo_file sock_file }) diff --git a/ncftool.if b/ncftool.if index a648982..59f096b 100644 --- a/ncftool.if +++ b/ncftool.if @@ -36,9 +36,19 @@ interface(`ncftool_domtrans',` # interface(`ncftool_run',` gen_require(` - attribute_role ncftool_roles; - ') + type ncftool_t; + #attribute_role ncftool_roles; + ') + + #ncftool_domtrans($1) + #roleattribute $2 ncftool_roles; ncftool_domtrans($1) - roleattribute $2 ncftool_roles; + role $2 types ncftool_t; + + optional_policy(` + brctl_run(ncftool_t, $2) + ') + ') + diff --git a/ncftool.te b/ncftool.te index f19ca0b..3eadfbb 100644 --- a/ncftool.te +++ b/ncftool.te @@ -5,25 +5,29 @@ policy_module(ncftool, 1.1.0) # Declarations # -attribute_role ncftool_roles; -roleattribute system_r ncftool_roles; +#attribute_role ncftool_roles; +#roleattribute system_r ncftool_roles; type ncftool_t; type ncftool_exec_t; application_domain(ncftool_t, ncftool_exec_t) domain_obj_id_change_exemption(ncftool_t) domain_system_change_exemption(ncftool_t) -role ncftool_roles types ncftool_t; +#role ncftool_roles types ncftool_t; +role system_r types ncftool_t; ######################################## # # ncftool local policy # -allow ncftool_t self:capability { net_admin sys_ptrace }; +allow ncftool_t self:capability net_admin; allow ncftool_t self:process signal; + allow ncftool_t self:fifo_file manage_fifo_file_perms; allow ncftool_t self:unix_stream_socket create_stream_socket_perms; + +allow ncftool_t self:netlink_route_socket create_netlink_socket_perms; allow ncftool_t self:tcp_socket create_stream_socket_perms; allow ncftool_t self:netlink_route_socket create_netlink_socket_perms; @@ -41,24 +45,33 @@ domain_read_all_domains_state(ncftool_t) dev_read_sysfs(ncftool_t) -files_read_etc_files(ncftool_t) +files_manage_system_conf_files(ncftool_t) +files_relabelto_system_conf_files(ncftool_t) files_read_etc_runtime_files(ncftool_t) files_read_usr_files(ncftool_t) -miscfiles_read_localization(ncftool_t) +term_use_all_inherited_terms(ncftool_t) sysnet_delete_dhcpc_pid(ncftool_t) -sysnet_run_dhcpc(ncftool_t, ncftool_roles) -sysnet_run_ifconfig(ncftool_t, ncftool_roles) +sysnet_domtrans_dhcpc(ncftool_t) +sysnet_domtrans_ifconfig(ncftool_t) +#sysnet_run_dhcpc(ncftool_t, ncftool_roles) +#sysnet_run_ifconfig(ncftool_t, ncftool_roles) sysnet_etc_filetrans_config(ncftool_t) sysnet_manage_config(ncftool_t) sysnet_read_dhcpc_state(ncftool_t) +sysnet_relabelfrom_net_conf(ncftool_t) +sysnet_relabelto_net_conf(ncftool_t) sysnet_read_dhcpc_pid(ncftool_t) sysnet_signal_dhcpc(ncftool_t) userdom_use_user_terminals(ncftool_t) userdom_read_user_tmp_files(ncftool_t) +#optional_policy(` +# brctl_run(ncftool_t, ncftool_roles) +#') + optional_policy(` consoletype_exec(ncftool_t) ') @@ -69,13 +82,18 @@ optional_policy(` optional_policy(` iptables_initrc_domtrans(ncftool_t) + iptables_systemctl(ncftool_t) ') optional_policy(` + modutils_list_module_config(ncftool_t) modutils_read_module_config(ncftool_t) - modutils_run_insmod(ncftool_t, ncftool_roles) + modutils_domtrans_insmod(ncftool_t) + #modutils_run_insmod(ncftool_t, ncftool_roles) + ') optional_policy(` - netutils_run(ncftool_t, ncftool_roles) + netutils_domtrans(ncftool_t) + #netutils_run(ncftool_t, ncftool_roles) ') diff --git a/nessus.te b/nessus.te index abf25da..bad6973 100644 --- a/nessus.te +++ b/nessus.te @@ -56,7 +56,6 @@ kernel_read_kernel_sysctls(nessusd_t) # for nmap etc corecmd_exec_bin(nessusd_t) -corenet_all_recvfrom_unlabeled(nessusd_t) corenet_all_recvfrom_netlabel(nessusd_t) corenet_tcp_sendrecv_generic_if(nessusd_t) corenet_udp_sendrecv_generic_if(nessusd_t) @@ -85,7 +84,6 @@ fs_search_auto_mountpoints(nessusd_t) logging_send_syslog_msg(nessusd_t) -miscfiles_read_localization(nessusd_t) sysnet_read_config(nessusd_t) diff --git a/networkmanager.fc b/networkmanager.fc index 386543b..8fe1d63 100644 --- a/networkmanager.fc +++ b/networkmanager.fc @@ -1,6 +1,19 @@ /etc/rc\.d/init\.d/wicd -- gen_context(system_u:object_r:NetworkManager_initrc_exec_t,s0) -/etc/NetworkManager/dispatcher\.d(/.*) gen_context(system_u:object_r:NetworkManager_initrc_exec_t,s0) +/etc/NetworkManager(/.*)? gen_context(system_u:object_r:NetworkManager_etc_t,s0) +/etc/NetworkManager/NetworkManager\.conf gen_context(system_u:object_r:NetworkManager_etc_rw_t,s0) +/etc/NetworkManager/system-connections(/.*)? gen_context(system_u:object_r:NetworkManager_etc_rw_t,s0) +/etc/NetworkManager/dispatcher\.d(/.*)? gen_context(system_u:object_r:NetworkManager_initrc_exec_t,s0) + +/etc/dhcp/manager-settings.conf -- gen_context(system_u:object_r:NetworkManager_var_lib_t, s0) +/etc/dhcp/wireless-settings.conf -- gen_context(system_u:object_r:NetworkManager_var_lib_t, s0) +/etc/dhcp/wired-settings.conf -- gen_context(system_u:object_r:NetworkManager_var_lib_t, s0) + +/etc/wicd/manager-settings.conf -- gen_context(system_u:object_r:NetworkManager_var_lib_t, s0) +/etc/wicd/wireless-settings.conf -- gen_context(system_u:object_r:NetworkManager_var_lib_t, s0) +/etc/wicd/wired-settings.conf -- gen_context(system_u:object_r:NetworkManager_var_lib_t, s0) + +/usr/lib/systemd/system/NetworkManager.* -- gen_context(system_u:object_r:NetworkManager_unit_file_t,s0) /usr/libexec/nm-dispatcher.action -- gen_context(system_u:object_r:NetworkManager_initrc_exec_t,s0) @@ -12,15 +25,19 @@ /usr/sbin/NetworkManagerDispatcher -- gen_context(system_u:object_r:NetworkManager_exec_t,s0) /usr/sbin/nm-system-settings -- gen_context(system_u:object_r:NetworkManager_exec_t,s0) /usr/sbin/wicd -- gen_context(system_u:object_r:NetworkManager_exec_t,s0) +/usr/sbin/wpa_cli -- gen_context(system_u:object_r:wpa_cli_exec_t,s0) +/usr/sbin/wpa_supplicant -- gen_context(system_u:object_r:NetworkManager_exec_t,s0) /var/lib/wicd(/.*)? gen_context(system_u:object_r:NetworkManager_var_lib_t,s0) /var/lib/NetworkManager(/.*)? gen_context(system_u:object_r:NetworkManager_var_lib_t,s0) -/var/log/wicd(/.*)? gen_context(system_u:object_r:NetworkManager_log_t,s0) +/var/log/wicd.* -- gen_context(system_u:object_r:NetworkManager_log_t,s0) + /var/log/wpa_supplicant.* -- gen_context(system_u:object_r:NetworkManager_log_t,s0) /var/run/NetworkManager\.pid -- gen_context(system_u:object_r:NetworkManager_var_run_t,s0) /var/run/NetworkManager(/.*)? gen_context(system_u:object_r:NetworkManager_var_run_t,s0) /var/run/nm-dhclient.* gen_context(system_u:object_r:NetworkManager_var_run_t,s0) +/var/run/nm-dns-dnsmasq\.conf -- gen_context(system_u:object_r:NetworkManager_var_run_t,s0) /var/run/wpa_supplicant(/.*)? gen_context(system_u:object_r:NetworkManager_var_run_t,s0) /var/run/wpa_supplicant-global -s gen_context(system_u:object_r:NetworkManager_var_run_t,s0) diff --git a/networkmanager.if b/networkmanager.if index 2324d9e..da61d01 100644 --- a/networkmanager.if +++ b/networkmanager.if @@ -43,9 +43,9 @@ interface(`networkmanager_rw_packet_sockets',` ## Allow caller to relabel tun_socket ## ## -## -## Domain allowed access. -## +## +## Domain allowed access. +## ## # interface(`networkmanager_attach_tun_iface',` @@ -116,6 +116,29 @@ interface(`networkmanager_initrc_domtrans',` ######################################## ## +## Execute NetworkManager server in the NetworkManager domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`networkmanager_systemctl',` + gen_require(` + type NetworkManager_unit_file_t; + type NetworkManager_t; + ') + + systemd_exec_systemctl($1) + allow $1 NetworkManager_unit_file_t:file read_file_perms; + allow $1 NetworkManager_unit_file_t:service manage_service_perms; + + ps_process_pattern($1, NetworkManager_t) +') + +######################################## +## ## Send and receive messages from ## NetworkManager over dbus. ## @@ -137,6 +160,28 @@ interface(`networkmanager_dbus_chat',` ######################################## ## +## Do not audit attempts to send and +## receive messages from NetworkManager +## over dbus. +## +## +## +## Domain to not audit. +## +## +# +interface(`networkmanager_dontaudit_dbus_chat',` + gen_require(` + type NetworkManager_t; + class dbus send_msg; + ') + + dontaudit $1 NetworkManager_t:dbus send_msg; + dontaudit NetworkManager_t $1:dbus send_msg; +') + +######################################## +## ## Send a generic signal to NetworkManager ## ## @@ -191,3 +236,90 @@ interface(`networkmanager_read_pid_files',` files_search_pids($1) allow $1 NetworkManager_var_run_t:file read_file_perms; ') + +######################################## +## +## Execute NetworkManager in the NetworkManager domain, and +## allow the specified role the NetworkManager domain. +## +## +## +## Domain allowed to transition. +## +## +## +## +## Role allowed access. +## +## +## +# +interface(`networkmanager_run',` + gen_require(` + type NetworkManager_t, NetworkManager_exec_t; + ') + + networkmanager_domtrans($1) + role $2 types NetworkManager_t; +') + +######################################## +## +## Allow the specified domain to append +## to Network Manager log files. +## +## +## +## Domain allowed access. +## +## +# +interface(`networkmanager_append_log',` + gen_require(` + type NetworkManager_log_t; + ') + + logging_search_logs($1) + allow $1 NetworkManager_log_t:dir list_dir_perms; + append_files_pattern($1, NetworkManager_log_t, NetworkManager_log_t) +') + +######################################## +## +## Transition to networkmanager named content +## +## +## +## Domain allowed access. +## +## +# +interface(`networkmanager_filetrans_named_content',` + gen_require(` + type NetworkManager_var_run_t; + type NetworkManager_var_lib_t; + ') + + files_pid_filetrans($1, NetworkManager_var_run_t, file, "nm-dhclient.-eth0.conf") + files_pid_filetrans($1, NetworkManager_var_run_t, file, "nm-dhclient.-eth1.conf") + files_pid_filetrans($1, NetworkManager_var_run_t, file, "nm-dhclient.-eth2.conf") + files_pid_filetrans($1, NetworkManager_var_run_t, file, "nm-dhclient.-eth3.conf") + files_pid_filetrans($1, NetworkManager_var_run_t, file, "nm-dhclient.-eth4.conf") + files_pid_filetrans($1, NetworkManager_var_run_t, file, "nm-dhclient.-eth5.conf") + files_pid_filetrans($1, NetworkManager_var_run_t, file, "nm-dhclient.-eth6.conf") + files_pid_filetrans($1, NetworkManager_var_run_t, file, "nm-dhclient.-eth7.conf") + files_pid_filetrans($1, NetworkManager_var_run_t, file, "nm-dhclient.-eth8.conf") + files_pid_filetrans($1, NetworkManager_var_run_t, file, "nm-dhclient.-eth9.conf") + files_pid_filetrans($1, NetworkManager_var_run_t, file, "nm-dhclient-em0.conf") + files_pid_filetrans($1, NetworkManager_var_run_t, file, "nm-dhclient-em1.conf") + files_pid_filetrans($1, NetworkManager_var_run_t, file, "nm-dhclient-em2.conf") + files_pid_filetrans($1, NetworkManager_var_run_t, file, "nm-dhclient-em3.conf") + files_pid_filetrans($1, NetworkManager_var_run_t, file, "nm-dhclient-em4.conf") + files_pid_filetrans($1, NetworkManager_var_run_t, file, "nm-dhclient-em5.conf") + files_pid_filetrans($1, NetworkManager_var_run_t, file, "nm-dhclient-em6.conf") + files_pid_filetrans($1, NetworkManager_var_run_t, file, "nm-dhclient-em7.conf") + files_pid_filetrans($1, NetworkManager_var_run_t, file, "nm-dhclient-em8.conf") + files_etc_filetrans($1, NetworkManager_var_lib_t, file, "manager-settings.conf") + files_etc_filetrans($1, NetworkManager_var_lib_t, file, "wireless-settings.conf") + files_etc_filetrans($1, NetworkManager_var_lib_t, file, "wireed-settings.conf") +') diff --git a/networkmanager.te b/networkmanager.te index 0619395..f84c1e1 100644 --- a/networkmanager.te +++ b/networkmanager.te @@ -12,6 +12,15 @@ init_daemon_domain(NetworkManager_t, NetworkManager_exec_t) type NetworkManager_initrc_exec_t; init_script_file(NetworkManager_initrc_exec_t) +type NetworkManager_unit_file_t; +systemd_unit_file(NetworkManager_unit_file_t) + +type NetworkManager_etc_t; +files_config_file(NetworkManager_etc_t) + +type NetworkManager_etc_rw_t; +files_config_file(NetworkManager_etc_rw_t) + type NetworkManager_log_t; logging_log_file(NetworkManager_log_t) @@ -35,26 +44,49 @@ init_system_domain(wpa_cli_t, wpa_cli_exec_t) # networkmanager will ptrace itself if gdb is installed # and it receives a unexpected signal (rh bug #204161) -allow NetworkManager_t self:capability { chown fsetid kill setgid setuid sys_nice sys_ptrace dac_override net_admin net_raw net_bind_service ipc_lock }; -dontaudit NetworkManager_t self:capability { sys_tty_config sys_ptrace }; -allow NetworkManager_t self:process { ptrace getcap setcap setpgid getsched setsched signal_perms }; +allow NetworkManager_t self:capability { chown fsetid kill setgid setuid sys_admin sys_nice dac_override net_admin net_raw net_bind_service ipc_lock }; +dontaudit NetworkManager_t self:capability sys_tty_config; +ifdef(`hide_broken_symptoms',` + # caused by some bogus kernel code + dontaudit NetworkManager_t self:capability sys_module; +') +allow NetworkManager_t self:process { getcap setcap setpgid getsched setsched signal_perms }; +tunable_policy(`deny_ptrace',`',` + allow NetworkManager_t self:capability sys_ptrace; + allow NetworkManager_t self:process ptrace; +') + allow NetworkManager_t self:fifo_file rw_fifo_file_perms; allow NetworkManager_t self:unix_dgram_socket { sendto create_socket_perms }; allow NetworkManager_t self:unix_stream_socket create_stream_socket_perms; allow NetworkManager_t self:netlink_route_socket create_netlink_socket_perms; +allow NetworkManager_t self:netlink_socket create_socket_perms; allow NetworkManager_t self:netlink_kobject_uevent_socket create_socket_perms; allow NetworkManager_t self:tcp_socket create_stream_socket_perms; -allow NetworkManager_t self:tun_socket { create_socket_perms relabelfrom }; +allow NetworkManager_t self:tun_socket { create_socket_perms relabelfrom relabelto }; allow NetworkManager_t self:udp_socket create_socket_perms; allow NetworkManager_t self:packet_socket create_socket_perms; allow NetworkManager_t wpa_cli_t:unix_dgram_socket sendto; can_exec(NetworkManager_t, NetworkManager_exec_t) +#wicd +can_exec(NetworkManager_t, wpa_cli_exec_t) + +list_dirs_pattern(NetworkManager_t, NetworkManager_etc_t, NetworkManager_etc_t) +read_files_pattern(NetworkManager_t, NetworkManager_etc_t, NetworkManager_etc_t) +read_lnk_files_pattern(NetworkManager_t, NetworkManager_etc_t, NetworkManager_etc_t) + +manage_dirs_pattern(NetworkManager_t, NetworkManager_etc_rw_t, NetworkManager_etc_rw_t) +manage_files_pattern(NetworkManager_t, NetworkManager_etc_rw_t, NetworkManager_etc_rw_t) +filetrans_pattern(NetworkManager_t, NetworkManager_etc_t, NetworkManager_etc_rw_t, { dir file }) + +logging_log_filetrans(NetworkManager_t, NetworkManager_log_t, file) manage_files_pattern(NetworkManager_t, NetworkManager_log_t, NetworkManager_log_t) logging_log_filetrans(NetworkManager_t, NetworkManager_log_t, file) +can_exec(NetworkManager_t, NetworkManager_tmp_t) manage_files_pattern(NetworkManager_t, NetworkManager_tmp_t, NetworkManager_tmp_t) manage_sock_files_pattern(NetworkManager_t, NetworkManager_tmp_t, NetworkManager_tmp_t) files_tmp_filetrans(NetworkManager_t, NetworkManager_tmp_t, { sock_file file }) @@ -75,7 +107,6 @@ kernel_request_load_module(NetworkManager_t) kernel_read_debugfs(NetworkManager_t) kernel_rw_net_sysctls(NetworkManager_t) -corenet_all_recvfrom_unlabeled(NetworkManager_t) corenet_all_recvfrom_netlabel(NetworkManager_t) corenet_tcp_sendrecv_generic_if(NetworkManager_t) corenet_udp_sendrecv_generic_if(NetworkManager_t) @@ -95,11 +126,12 @@ corenet_sendrecv_all_client_packets(NetworkManager_t) corenet_rw_tun_tap_dev(NetworkManager_t) corenet_getattr_ppp_dev(NetworkManager_t) -dev_read_sysfs(NetworkManager_t) +dev_rw_sysfs(NetworkManager_t) dev_read_rand(NetworkManager_t) dev_read_urand(NetworkManager_t) dev_dontaudit_getattr_generic_blk_files(NetworkManager_t) dev_getattr_all_chr_files(NetworkManager_t) +dev_rw_wireless(NetworkManager_t) fs_getattr_all_fs(NetworkManager_t) fs_search_auto_mountpoints(NetworkManager_t) @@ -113,10 +145,10 @@ corecmd_exec_shell(NetworkManager_t) corecmd_exec_bin(NetworkManager_t) domain_use_interactive_fds(NetworkManager_t) -domain_read_confined_domains_state(NetworkManager_t) +domain_read_all_domains_state(NetworkManager_t) -files_read_etc_files(NetworkManager_t) files_read_etc_runtime_files(NetworkManager_t) +files_read_system_conf_files(NetworkManager_t) files_read_usr_files(NetworkManager_t) files_read_usr_src_files(NetworkManager_t) @@ -128,35 +160,43 @@ init_domtrans_script(NetworkManager_t) auth_use_nsswitch(NetworkManager_t) +libs_exec_ldconfig(NetworkManager_t) + logging_send_syslog_msg(NetworkManager_t) -miscfiles_read_localization(NetworkManager_t) miscfiles_read_generic_certs(NetworkManager_t) -modutils_domtrans_insmod(NetworkManager_t) - seutil_read_config(NetworkManager_t) sysnet_domtrans_ifconfig(NetworkManager_t) sysnet_domtrans_dhcpc(NetworkManager_t) sysnet_signal_dhcpc(NetworkManager_t) +sysnet_signull_dhcpc(NetworkManager_t) sysnet_read_dhcpc_pid(NetworkManager_t) +sysnet_read_dhcp_config(NetworkManager_t) sysnet_delete_dhcpc_pid(NetworkManager_t) +sysnet_kill_dhcpc(NetworkManager_t) +sysnet_read_dhcpc_state(NetworkManager_t) +sysnet_delete_dhcpc_state(NetworkManager_t) sysnet_search_dhcp_state(NetworkManager_t) # in /etc created by NetworkManager will be labelled net_conf_t. sysnet_manage_config(NetworkManager_t) sysnet_etc_filetrans_config(NetworkManager_t) +userdom_stream_connect(NetworkManager_t) userdom_dontaudit_use_unpriv_user_fds(NetworkManager_t) userdom_dontaudit_use_user_ttys(NetworkManager_t) # Read gnome-keyring +userdom_read_home_certs(NetworkManager_t) userdom_read_user_home_content_files(NetworkManager_t) +userdom_dgram_send(NetworkManager_t) optional_policy(` avahi_domtrans(NetworkManager_t) avahi_kill(NetworkManager_t) avahi_signal(NetworkManager_t) avahi_signull(NetworkManager_t) + avahi_dbus_chat(NetworkManager_t) ') optional_policy(` @@ -176,10 +216,17 @@ optional_policy(` ') optional_policy(` + cron_read_system_job_lib_files(NetworkManager_t) +') + +optional_policy(` dbus_system_domain(NetworkManager_t, NetworkManager_exec_t) + init_dbus_chat(NetworkManager_t) + optional_policy(` consolekit_dbus_chat(NetworkManager_t) + consolekit_read_pid_files(NetworkManager_t) ') ') @@ -191,6 +238,7 @@ optional_policy(` dnsmasq_kill(NetworkManager_t) dnsmasq_signal(NetworkManager_t) dnsmasq_signull(NetworkManager_t) + dnsmasq_systemctl(NetworkManager_t) ') optional_policy(` @@ -202,23 +250,45 @@ optional_policy(` ') optional_policy(` + gnome_dontaudit_search_config(NetworkManager_t) +') + +optional_policy(` + ipsec_domtrans_mgmt(NetworkManager_t) + ipsec_kill_mgmt(NetworkManager_t) + ipsec_signal_mgmt(NetworkManager_t) + ipsec_signull_mgmt(NetworkManager_t) +') + +optional_policy(` iptables_domtrans(NetworkManager_t) ') optional_policy(` + netutils_exec_ping(NetworkManager_t) +') + +optional_policy(` nscd_domtrans(NetworkManager_t) nscd_signal(NetworkManager_t) nscd_signull(NetworkManager_t) nscd_kill(NetworkManager_t) nscd_initrc_domtrans(NetworkManager_t) + nscd_systemctl(NetworkManager_t) ') optional_policy(` # Dispatcher starting and stoping ntp ntp_initrc_domtrans(NetworkManager_t) + ntp_systemctl(NetworkManager_t) ') optional_policy(` + modutils_domtrans_insmod(NetworkManager_t) +') + +optional_policy(` + openvpn_read_config(NetworkManager_t) openvpn_domtrans(NetworkManager_t) openvpn_kill(NetworkManager_t) openvpn_signal(NetworkManager_t) @@ -234,6 +304,10 @@ optional_policy(` ') optional_policy(` + polipo_systemctl(NetworkManager_t) +') + +optional_policy(` ppp_initrc_domtrans(NetworkManager_t) ppp_domtrans(NetworkManager_t) ppp_manage_pid_files(NetworkManager_t) @@ -241,6 +315,7 @@ optional_policy(` ppp_signal(NetworkManager_t) ppp_signull(NetworkManager_t) ppp_read_config(NetworkManager_t) + ppp_systemctl(NetworkManager_t) ') optional_policy(` @@ -254,6 +329,10 @@ optional_policy(` ') optional_policy(` + systemd_read_logind_sessions_files(NetworkManager_t) +') + +optional_policy(` udev_exec(NetworkManager_t) udev_read_db(NetworkManager_t) ') @@ -263,6 +342,7 @@ optional_policy(` vpn_kill(NetworkManager_t) vpn_signal(NetworkManager_t) vpn_signull(NetworkManager_t) + vpn_relabelfrom_tun_socket(NetworkManager_t) ') ######################################## @@ -284,6 +364,5 @@ rw_sock_files_pattern(wpa_cli_t, NetworkManager_var_run_t, NetworkManager_var_ru init_dontaudit_use_fds(wpa_cli_t) init_use_script_ptys(wpa_cli_t) -miscfiles_read_localization(wpa_cli_t) term_dontaudit_use_console(wpa_cli_t) diff --git a/nis.fc b/nis.fc index 632a565..cd0e015 100644 --- a/nis.fc +++ b/nis.fc @@ -9,7 +9,9 @@ /usr/lib/yp/ypxfr -- gen_context(system_u:object_r:ypxfr_exec_t,s0) /usr/sbin/rpc\.yppasswdd -- gen_context(system_u:object_r:yppasswdd_exec_t,s0) +/usr/sbin/rpc\.yppasswdd\.env -- gen_context(system_u:object_r:yppasswdd_exec_t,s0) /usr/sbin/rpc\.ypxfrd -- gen_context(system_u:object_r:ypxfr_exec_t,s0) +/usr/sbin/ypbind -- gen_context(system_u:object_r:ypbind_exec_t,s0) /usr/sbin/ypserv -- gen_context(system_u:object_r:ypserv_exec_t,s0) /var/yp(/.*)? gen_context(system_u:object_r:var_yp_t,s0) @@ -18,3 +20,8 @@ /var/run/ypbind.* -- gen_context(system_u:object_r:ypbind_var_run_t,s0) /var/run/ypserv.* -- gen_context(system_u:object_r:ypserv_var_run_t,s0) /var/run/yppass.* -- gen_context(system_u:object_r:yppasswdd_var_run_t,s0) + +/usr/lib/systemd/system/ypbind.* -- gen_context(system_u:object_r:ypbind_unit_file_t,s0) +/usr/lib/systemd/system/ypserv.* -- gen_context(system_u:object_r:nis_unit_file_t,s0) +/usr/lib/systemd/system/yppasswdd.* -- gen_context(system_u:object_r:nis_unit_file_t,s0) +/usr/lib/systemd/system/ypxfrd.* -- gen_context(system_u:object_r:nis_unit_file_t,s0) diff --git a/nis.if b/nis.if index abe3f7f..deeebd1 100644 --- a/nis.if +++ b/nis.if @@ -27,18 +27,13 @@ interface(`nis_use_ypbind_uncond',` gen_require(` type var_yp_t; ') - - allow $1 self:capability net_bind_service; - allow $1 self:tcp_socket create_stream_socket_perms; allow $1 self:udp_socket create_socket_perms; allow $1 var_yp_t:dir list_dir_perms; - allow $1 var_yp_t:lnk_file { getattr read }; + allow $1 var_yp_t:lnk_file read_lnk_file_perms; allow $1 var_yp_t:file read_file_perms; - corenet_all_recvfrom_unlabeled($1) - corenet_all_recvfrom_netlabel($1) corenet_tcp_sendrecv_generic_if($1) corenet_udp_sendrecv_generic_if($1) corenet_tcp_sendrecv_generic_node($1) @@ -49,14 +44,13 @@ interface(`nis_use_ypbind_uncond',` corenet_udp_bind_generic_node($1) corenet_tcp_bind_generic_port($1) corenet_udp_bind_generic_port($1) - corenet_dontaudit_tcp_bind_all_reserved_ports($1) - corenet_dontaudit_udp_bind_all_reserved_ports($1) + corenet_tcp_bind_all_rpc_ports($1) + corenet_udp_bind_all_rpc_ports($1) corenet_dontaudit_tcp_bind_all_ports($1) corenet_dontaudit_udp_bind_all_ports($1) corenet_tcp_connect_portmap_port($1) - corenet_tcp_connect_reserved_port($1) + corenet_tcp_connect_all_reserved_ports($1) corenet_tcp_connect_generic_port($1) - corenet_dontaudit_tcp_connect_all_ports($1) corenet_sendrecv_portmap_client_packets($1) corenet_sendrecv_generic_client_packets($1) corenet_sendrecv_generic_server_packets($1) @@ -88,7 +82,7 @@ interface(`nis_use_ypbind_uncond',` ## # interface(`nis_use_ypbind',` - tunable_policy(`allow_ypbind',` + tunable_policy(`nis_enabled',` nis_use_ypbind_uncond($1) ') ') @@ -105,7 +99,7 @@ interface(`nis_use_ypbind',` ## # interface(`nis_authenticate',` - tunable_policy(`allow_ypbind',` + tunable_policy(`nis_enabled',` nis_use_ypbind_uncond($1) corenet_tcp_bind_all_rpc_ports($1) corenet_udp_bind_all_rpc_ports($1) @@ -337,6 +331,55 @@ interface(`nis_initrc_domtrans_ypbind',` ######################################## ## +## Execute ypbind server in the ypbind domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`nis_systemctl_ypbind',` + gen_require(` + type ypbind_unit_file_t; + type ypbind_t; + ') + + systemd_exec_systemctl($1) + allow $1 ypbind_unit_file_t:file read_file_perms; + allow $1 ypbind_unit_file_t:service manage_service_perms; + + ps_process_pattern($1, ypbind_t) +') + +######################################## +## +## Execute ypbind server in the ypbind domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`nis_systemctl',` + gen_require(` + type nis_unit_file_t, ypbind_unit_file_t; + type ypbind_t, yppasswdd_t, ypserv_t, ypxfr_t; + ') + + systemd_exec_systemctl($1) + allow $1 nis_unit_file_t:file read_file_perms; + allow $1 nis_unit_file_t:service manage_service_perms; + + ps_process_pattern($1, ypbind_t) + ps_process_pattern($1, yppasswdd_t) + ps_process_pattern($1, ypserv_t) + ps_process_pattern($1, ypxfr_t) +') + +######################################## +## ## All of the rules required to administrate ## an nis environment ## @@ -354,22 +397,31 @@ interface(`nis_initrc_domtrans_ypbind',` # interface(`nis_admin',` gen_require(` - type ypbind_t, yppasswdd_t, ypserv_t, ypxfr_t; - type ypbind_tmp_t, ypserv_tmp_t, ypserv_conf_t; + type ypbind_t, yppasswdd_t, ypserv_t; + type ypserv_conf_t; type ypbind_var_run_t, yppasswdd_var_run_t, ypserv_var_run_t; - type ypbind_initrc_exec_t, nis_initrc_exec_t; + type ypserv_tmp_t; + type ypbind_initrc_exec_t, nis_initrc_exec_t, ypxfr_t; + type nis_unit_file_t; + type ypbind_unit_file_t; ') - allow $1 ypbind_t:process { ptrace signal_perms }; + allow $1 ypbind_t:process signal_perms; ps_process_pattern($1, ypbind_t) + tunable_policy(`deny_ptrace',`',` + allow $1 ypbind_t:process ptrace; + allow $1 yppasswdd_t:process ptrace; + allow $1 ypserv_t:process ptrace; + allow $1 ypxfr_t:process ptrace; + ') - allow $1 yppasswdd_t:process { ptrace signal_perms }; + allow $1 yppasswdd_t:process signal_perms; ps_process_pattern($1, yppasswdd_t) - allow $1 ypserv_t:process { ptrace signal_perms }; + allow $1 ypserv_t:process signal_perms; ps_process_pattern($1, ypserv_t) - allow $1 ypxfr_t:process { ptrace signal_perms }; + allow $1 ypxfr_t:process signal_perms; ps_process_pattern($1, ypxfr_t) nis_initrc_domtrans($1) @@ -379,18 +431,22 @@ interface(`nis_admin',` role_transition $2 ypbind_initrc_exec_t system_r; allow $2 system_r; - files_list_tmp($1) - admin_pattern($1, ypbind_tmp_t) - files_list_pids($1) admin_pattern($1, ypbind_var_run_t) + nis_systemctl_ypbind($1) + admin_pattern($1, ypbind_unit_file_t) + allow $1 ypbind_unit_file_t:service all_service_perms; admin_pattern($1, yppasswdd_var_run_t) files_list_etc($1) admin_pattern($1, ypserv_conf_t) + admin_pattern($1, ypserv_var_run_t) + admin_pattern($1, ypserv_tmp_t) - admin_pattern($1, ypserv_var_run_t) + nis_systemctl($1) + admin_pattern($1, nis_unit_file_t) + allow $1 nis_unit_file_t:service all_service_perms; ') diff --git a/nis.te b/nis.te index f27899c..0536e65 100644 --- a/nis.te +++ b/nis.te @@ -18,11 +18,14 @@ init_daemon_domain(ypbind_t, ypbind_exec_t) type ypbind_initrc_exec_t; init_script_file(ypbind_initrc_exec_t) +type ypbind_var_run_t; +files_pid_file(ypbind_var_run_t) + type ypbind_tmp_t; files_tmp_file(ypbind_tmp_t) -type ypbind_var_run_t; -files_pid_file(ypbind_var_run_t) +type ypbind_unit_file_t; +systemd_unit_file(ypbind_unit_file_t) type yppasswdd_t; type yppasswdd_exec_t; @@ -37,7 +40,7 @@ type ypserv_exec_t; init_daemon_domain(ypserv_t, ypserv_exec_t) type ypserv_conf_t; -files_type(ypserv_conf_t) +files_config_file(ypserv_conf_t) type ypserv_tmp_t; files_tmp_file(ypserv_tmp_t) @@ -52,6 +55,9 @@ init_daemon_domain(ypxfr_t, ypxfr_exec_t) type ypxfr_var_run_t; files_pid_file(ypxfr_var_run_t) +type nis_unit_file_t; +systemd_unit_file(nis_unit_file_t) + ######################################## # # ypbind local policy @@ -76,7 +82,6 @@ manage_files_pattern(ypbind_t, var_yp_t, var_yp_t) kernel_read_system_state(ypbind_t) kernel_read_kernel_sysctls(ypbind_t) -corenet_all_recvfrom_unlabeled(ypbind_t) corenet_all_recvfrom_netlabel(ypbind_t) corenet_tcp_sendrecv_generic_if(ypbind_t) corenet_udp_sendrecv_generic_if(ypbind_t) @@ -110,7 +115,6 @@ files_list_var(ypbind_t) logging_send_syslog_msg(ypbind_t) -miscfiles_read_localization(ypbind_t) sysnet_read_config(ypbind_t) @@ -156,12 +160,13 @@ files_pid_filetrans(yppasswdd_t, yppasswdd_var_run_t, file) manage_files_pattern(yppasswdd_t, var_yp_t, var_yp_t) manage_lnk_files_pattern(yppasswdd_t, var_yp_t, var_yp_t) +can_exec(yppasswdd_t,yppasswdd_exec_t) + kernel_list_proc(yppasswdd_t) kernel_read_proc_symlinks(yppasswdd_t) kernel_getattr_proc_files(yppasswdd_t) kernel_read_kernel_sysctls(yppasswdd_t) -corenet_all_recvfrom_unlabeled(yppasswdd_t) corenet_all_recvfrom_netlabel(yppasswdd_t) corenet_tcp_sendrecv_generic_if(yppasswdd_t) corenet_udp_sendrecv_generic_if(yppasswdd_t) @@ -186,6 +191,7 @@ selinux_get_fs_mount(yppasswdd_t) auth_manage_shadow(yppasswdd_t) auth_relabel_shadow(yppasswdd_t) +auth_read_passwd(yppasswdd_t) auth_etc_filetrans_shadow(yppasswdd_t) corecmd_exec_bin(yppasswdd_t) @@ -199,7 +205,6 @@ files_relabel_etc_files(yppasswdd_t) logging_send_syslog_msg(yppasswdd_t) -miscfiles_read_localization(yppasswdd_t) sysnet_read_config(yppasswdd_t) @@ -211,6 +216,10 @@ optional_policy(` ') optional_policy(` + mta_send_mail(yppasswdd_t) +') + +optional_policy(` seutil_sigchld_newrole(yppasswdd_t) ') @@ -247,7 +256,6 @@ kernel_read_kernel_sysctls(ypserv_t) kernel_list_proc(ypserv_t) kernel_read_proc_symlinks(ypserv_t) -corenet_all_recvfrom_unlabeled(ypserv_t) corenet_all_recvfrom_netlabel(ypserv_t) corenet_tcp_sendrecv_generic_if(ypserv_t) corenet_udp_sendrecv_generic_if(ypserv_t) @@ -279,7 +287,6 @@ files_read_etc_files(ypserv_t) logging_send_syslog_msg(ypserv_t) -miscfiles_read_localization(ypserv_t) nis_domtrans_ypxfr(ypserv_t) @@ -317,7 +324,6 @@ allow ypxfr_t ypserv_conf_t:file read_file_perms; manage_files_pattern(ypxfr_t, ypxfr_var_run_t, ypxfr_var_run_t) files_pid_filetrans(ypxfr_t, ypxfr_var_run_t, file) -corenet_all_recvfrom_unlabeled(ypxfr_t) corenet_all_recvfrom_netlabel(ypxfr_t) corenet_tcp_sendrecv_generic_if(ypxfr_t) corenet_udp_sendrecv_generic_if(ypxfr_t) @@ -342,6 +348,5 @@ files_search_usr(ypxfr_t) logging_send_syslog_msg(ypxfr_t) -miscfiles_read_localization(ypxfr_t) sysnet_read_config(ypxfr_t) diff --git a/nova.fc b/nova.fc new file mode 100644 index 0000000..02dc6dc --- /dev/null +++ b/nova.fc @@ -0,0 +1,32 @@ + +/usr/bin/nova-ajax-console-proxy -- gen_context(system_u:object_r:nova_ajax_exec_t,s0) +/usr/bin/nova-console.* -- gen_context(system_u:object_r:nova_console_exec_t,s0) +/usr/bin/nova-direct-api -- gen_context(system_u:object_r:nova_direct_exec_t,s0) +/usr/bin/nova-api -- gen_context(system_u:object_r:nova_api_exec_t,s0) +/usr/bin/nova-cert -- gen_context(system_u:object_r:nova_cert_exec_t,s0) +/usr//bin/nova-api-metadata -- gen_context(system_u:object_r:nova_api_exec_t,s0) +/usr/bin/nova-network -- gen_context(system_u:object_r:nova_network_exec_t,s0) +/usr/bin/nova-objectstore -- gen_context(system_u:object_r:nova_objectstore_exec_t,s0) +/usr/bin/nova-scheduler -- gen_context(system_u:object_r:nova_scheduler_exec_t,s0) +/usr/bin/nova-vncproxy -- gen_context(system_u:object_r:nova_vncproxy_exec_t,s0) +/usr/bin/nova-volume -- gen_context(system_u:object_r:nova_volume_exec_t,s0) +/usr/bin/nova-xvpvncproxy -- gen_context(system_u:object_r:nova_vncproxy_exec_t,s0) + +/usr/lib/systemd/system/openstack-nova-ajax-console-proxy.* -- gen_context(system_u:object_r:nova_ajax_unit_file_t,s0) +/usr/lib/systemd/system/openstack-nova-api.* -- gen_context(system_u:object_r:nova_api_unit_file_t,s0) +/usr/lib/systemd/system/openstack-nova-cert.* -- gen_context(system_u:object_r:nova_cert_unit_file_t,s0) +/usr/lib/systemd/system/openstack-nova-console.* -- gen_context(system_u:object_r:nova_console_unit_file_t,s0) +/usr/lib/systemd/system/openstack-nova-direct-api.* -- gen_context(system_u:object_r:nova_direct_unit_file_t,s0) +/usr/lib/systemd/system/openstack-nova-metadata-api.service.* -- gen_context(system_u:object_r:nova_api_unit_file_t,s0) +/usr/lib/systemd/system/openstack-nova-network.* -- gen_context(system_u:object_r:nova_network_unit_file_t,s0) +/usr/lib/systemd/system/openstack-nova-objectstore.* -- gen_context(system_u:object_r:nova_objectstore_unit_file_t,s0) +/usr/lib/systemd/system/openstack-nova-scheduler.* -- gen_context(system_u:object_r:nova_scheduler_unit_file_t,s0) +/usr/lib/systemd/system/openstack-nova-vncproxy.* -- gen_context(system_u:object_r:nova_vncproxy_unit_file_t,s0) +/usr/lib/systemd/system/openstack-nova-xvpvncproxy.* -- gen_context(system_u:object_r:nova_vncproxy_unit_file_t,s0) +/usr/lib/systemd/system/openstack-nova-volume.* -- gen_context(system_u:object_r:nova_volume_unit_file_t,s0) + +/var/lib/nova(/.*)? gen_context(system_u:object_r:nova_var_lib_t,s0) + +/var/log/nova(/.*)? gen_context(system_u:object_r:nova_log_t,s0) + +/var/run/nova(/.*)? gen_context(system_u:object_r:nova_var_run_t,s0) diff --git a/nova.if b/nova.if new file mode 100644 index 0000000..0d11800 --- /dev/null +++ b/nova.if @@ -0,0 +1,33 @@ +## openstack-nova + +####################################### +## +## Creates types and rules for a basic +## openstack-nova systemd daemon domain. +## +## +## +## Prefix for the domain. +## +## +# +template(`nova_domain_template',` + gen_require(` + attribute nova_domain; + ') + + type nova_$1_t, nova_domain; + type nova_$1_exec_t; + init_daemon_domain(nova_$1_t, nova_$1_exec_t) + + type nova_$1_unit_file_t; + systemd_unit_file(nova_$1_unit_file_t) + + type nova_$1_tmp_t; + files_tmp_file(nova_$1_tmp_t) + + manage_dirs_pattern(nova_$1_t, nova_$1_tmp_t, nova_$1_tmp_t) + manage_files_pattern(nova_$1_t, nova_$1_tmp_t, nova_$1_tmp_t) + files_tmp_filetrans(nova_$1_t, nova_$1_tmp_t, { file dir }) + can_exec(nova_$1_t, nova_$1_tmp_t) +') diff --git a/nova.te b/nova.te new file mode 100644 index 0000000..0c7fb1c --- /dev/null +++ b/nova.te @@ -0,0 +1,326 @@ +policy_module(nova, 1.0.0) + +######################################## +# +# Declarations +# + +# +# nova-stack daemons contain security issue with using sudo in the code +# we make this policy as unconfined until this issue is fixed +# + +attribute nova_domain; + +nova_domain_template(ajax) +nova_domain_template(api) +nova_domain_template(cert) +nova_domain_template(compute) +nova_domain_template(console) +nova_domain_template(direct) +nova_domain_template(network) +nova_domain_template(objectstore) +nova_domain_template(scheduler) +nova_domain_template(vncproxy) +nova_domain_template(volume) + +type nova_log_t; +logging_log_file(nova_log_t) + +type nova_var_lib_t; +files_type(nova_var_lib_t) + +type nova_var_run_t; +files_pid_file(nova_var_run_t) + + +###################################### +# +# nova general domain local policy +# + +allow nova_domain self:fifo_file rw_fifo_file_perms; +allow nova_domain self:tcp_socket create_stream_socket_perms; +allow nova_domain self:unix_stream_socket create_stream_socket_perms; + +manage_dirs_pattern(nova_domain, nova_log_t, nova_log_t) +manage_files_pattern(nova_domain, nova_log_t, nova_log_t) + +manage_dirs_pattern(nova_domain, nova_var_lib_t, nova_var_lib_t) +manage_files_pattern(nova_domain, nova_var_lib_t, nova_var_lib_t) + +manage_dirs_pattern(nova_domain, nova_var_run_t, nova_var_run_t) +manage_files_pattern(nova_domain, nova_var_run_t, nova_var_run_t) + +kernel_read_system_state(nova_domain) + +corenet_tcp_connect_amqp_port(nova_domain) + +corecmd_exec_bin(nova_domain) +corecmd_exec_shell(nova_domain) + +dev_read_urand(nova_domain) + +fs_getattr_xattr_fs(nova_domain) + +files_read_usr_files(nova_domain) + +libs_exec_ldconfig(nova_domain) + +files_read_etc_files(nova_domain) + + +optional_policy(` + sysnet_read_config(nova_domain) +') + +###################################### +# +# nova ajax local policy +# + +optional_policy(` + unconfined_domain(nova_ajax_t) +') + +####################################### +# +# nova api local policy +# + +allow nova_api_t self:process setfscreate; + +allow nova_api_t self:key write; + +allow nova_api_t self:netlink_route_socket r_netlink_socket_perms; + +allow nova_api_t self:udp_socket create_socket_perms; + +kernel_read_kernel_sysctls(nova_api_t) + +corenet_tcp_bind_generic_node(nova_api_t) +corenet_udp_bind_generic_node(nova_api_t) +# should be add to booleans +corenet_tcp_connect_all_ports(nova_api_t) +corenet_tcp_bind_all_unreserved_ports(nova_api_t) + +auth_read_passwd(nova_api_t) + +logging_send_syslog_msg(nova_api_t) + +miscfiles_read_certs(nova_api_t) + +ifdef(`hide_broken_symptoms',` + optional_policy(` + sudo_exec(nova_api_t) + allow nova_api_t self:capability { setuid sys_resource setgid }; + allow nova_api_t self:process { setsched setrlimit }; + logging_send_audit_msgs(nova_api_t) + ') +') + +optional_policy(` + iptables_domtrans(nova_api_t) +') + +optional_policy(` + ssh_exec_keygen(nova_api_t) +') + +optional_policy(` + unconfined_domain(nova_api_t) +') + +###################################### +# +# nova cert local policy +# + +allow nova_cert_t self:process setfscreate; + +allow nova_cert_t self:udp_socket create_socket_perms; + +auth_use_nsswitch(nova_cert_t) + +miscfiles_read_certs(nova_cert_t) + +optional_policy(` + mysql_stream_connect(nova_cert_t) +') + +####################################### +# +# nova compute local policy +# + +# needs to be re-write since now runs as virtd_t + +allow nova_compute_t self:udp_socket create_socket_perms; + +kernel_read_network_state(nova_compute_t) + +dev_read_rand(nova_compute_t) + +dev_read_sysfs(nova_compute_t) + +optional_policy(` + virt_getattr_exec(nova_compute_t) + virt_stream_connect(nova_compute_t) +') + +###################################### +# +# nova console local policy +# + +allow nova_console_t self:udp_socket create_socket_perms; + +auth_use_nsswitch(nova_console_t) + +####################################### +# +# nova direct local policy +# + +optional_policy(` + unconfined_domain(nova_direct_t) +') + +####################################### +# +# nova network local policy +# + +allow nova_network_t self:capability { dac_override net_admin net_bind_service }; +allow nova_network_t self:process { getcap setcap }; + +allow nova_network_t self:netlink_route_socket r_netlink_socket_perms; +allow nova_network_t self:udp_socket create_socket_perms; + +kernel_read_network_state(nova_network_t) +kernel_read_kernel_sysctls(nova_network_t) + +# should be added to boolean or fixed in the code +# dnsmasq domtrans does not work since then dnsmasq_t wants +# to do some stuff with nova_lib, nova_tmp +# nova-dhcpbridge runs in dnsmasq domain +corenet_all_recvfrom_netlabel(nova_network_t) +corenet_tcp_sendrecv_generic_if(nova_network_t) +corenet_udp_sendrecv_generic_if(nova_network_t) +corenet_raw_sendrecv_generic_if(nova_network_t) +corenet_tcp_sendrecv_generic_node(nova_network_t) +corenet_udp_sendrecv_generic_node(nova_network_t) +corenet_raw_sendrecv_generic_node(nova_network_t) +corenet_tcp_sendrecv_all_ports(nova_network_t) +corenet_udp_sendrecv_all_ports(nova_network_t) +corenet_tcp_bind_generic_node(nova_network_t) +corenet_udp_bind_generic_node(nova_network_t) +corenet_tcp_bind_dns_port(nova_network_t) +corenet_udp_bind_all_ports(nova_network_t) +corenet_sendrecv_dns_server_packets(nova_network_t) +corenet_sendrecv_dhcpd_server_packets(nova_network_t) + +libs_exec_ldconfig(nova_network_t) + +logging_send_syslog_msg(nova_network_t) + +ifdef(`hide_broken_symptoms',` + optional_policy(` + sudo_exec(nova_network_t) + allow nova_network_t self:capability { setuid sys_resource setgid }; + allow nova_network_t self:process { setsched setrlimit }; + logging_send_audit_msgs(nova_network_t) + ') +') + +optional_policy(` + brctl_domtrans(nova_network_t) +') + +optional_policy(` + dnsmasq_exec(nova_network_t) +# dnsmasq_domtrans(nova_network_t) +') + +optional_policy(` + iptables_domtrans(nova_network_t) +') + +optional_policy(` + sysnet_domtrans_ifconfig(nova_network_t) +') + +optional_policy(` + unconfined_domain(nova_network_t) +') + +####################################### +# +# nova object store local policy +# + +allow nova_objectstore_t self:udp_socket create_socket_perms; + +corenet_tcp_bind_generic_node(nova_objectstore_t) +corenet_udp_bind_generic_node(nova_objectstore_t) + +optional_policy(` + unconfined_domain(nova_objectstore_t) +') + +####################################### +# +# nova scheduler local policy +# + +allow nova_scheduler_t self:netlink_route_socket r_netlink_socket_perms; +allow nova_scheduler_t self:udp_socket create_socket_perms; + +optional_policy(` + unconfined_domain(nova_scheduler_t) +') + +####################################### +# +# nova vncproxy local policy +# + +optional_policy(` + unconfined_domain(nova_vncproxy_t) +') + +####################################### +# +# nova volume local policy +# + +allow nova_volume_t self:netlink_route_socket r_netlink_socket_perms; + +allow nova_volume_t self:udp_socket create_socket_perms; + +kernel_read_kernel_sysctls(nova_volume_t) + +logging_send_syslog_msg(nova_volume_t) + +optional_policy(` + lvm_domtrans(nova_volume_t) +') + +ifdef(`hide_broken_symptoms',` + require { + type sudo_exec_t; + } + + allow nova_volume_t sudo_exec_t:file { read execute open execute_no_trans }; + + allow nova_volume_t self:capability { setuid sys_resource setgid audit_write }; + allow nova_volume_t self:process { setsched setrlimit }; + + logging_send_audit_msgs(nova_volume_t) + +') + +optional_policy(` + unconfined_domain(nova_volume_t) +') + diff --git a/nscd.if b/nscd.if index 85188dc..2b37836 100644 --- a/nscd.if +++ b/nscd.if @@ -116,7 +116,26 @@ interface(`nscd_socket_use',` dontaudit $1 nscd_t:nscd { getserv shmempwd shmemgrp shmemhost shmemserv }; files_search_pids($1) stream_connect_pattern($1, nscd_var_run_t, nscd_var_run_t, nscd_t) - dontaudit $1 nscd_var_run_t:file { getattr read }; + dontaudit $1 nscd_var_run_t:file read_file_perms; + ps_process_pattern(nscd_t, $1) +') + +######################################## +## +## Use nscd services +## +## +## +## Domain allowed access. +## +## +# +interface(`nscd_use',` + tunable_policy(`nscd_use_shm',` + nscd_shm_use($1) + ',` + nscd_socket_use($1) + ') ') ######################################## @@ -146,11 +165,14 @@ interface(`nscd_shm_use',` # nscd_socket_domain macro. need to investigate # if they are all actually required allow $1 self:unix_stream_socket create_stream_socket_perms; - allow $1 nscd_t:unix_stream_socket connectto; - allow $1 nscd_var_run_t:sock_file rw_file_perms; + + # dg: This may not be required. + allow $1 nscd_var_run_t:sock_file read_sock_file_perms; + + stream_connect_pattern($1, nscd_var_run_t, nscd_var_run_t, nscd_t) files_search_pids($1) allow $1 nscd_t:nscd { getpwd getgrp gethost }; - dontaudit $1 nscd_var_run_t:file { getattr read }; + dontaudit $1 nscd_var_run_t:file read_file_perms; ') ######################################## @@ -168,7 +190,7 @@ interface(`nscd_dontaudit_search_pid',` type nscd_var_run_t; ') - dontaudit $1 nscd_var_run_t:dir search; + dontaudit $1 nscd_var_run_t:dir search_dir_perms; ') ######################################## @@ -224,6 +246,7 @@ interface(`nscd_unconfined',` ## Role allowed access. ## ## +## # interface(`nscd_run',` gen_require(` @@ -254,6 +277,29 @@ interface(`nscd_initrc_domtrans',` ######################################## ## +## Execute nscd server in the nscd domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`nscd_systemctl',` + gen_require(` + type nscd_unit_file_t; + type nscd_t; + ') + + systemd_exec_systemctl($1) + allow $1 nscd_unit_file_t:file read_file_perms; + allow $1 nscd_unit_file_t:service manage_service_perms; + + ps_process_pattern($1, nscd_t) +') + +######################################## +## ## All of the rules required to administrate ## an nscd environment ## @@ -273,10 +319,14 @@ interface(`nscd_admin',` gen_require(` type nscd_t, nscd_log_t, nscd_var_run_t; type nscd_initrc_exec_t; + type nscd_unit_file_t; ') - allow $1 nscd_t:process { ptrace signal_perms }; + allow $1 nscd_t:process signal_perms; ps_process_pattern($1, nscd_t) + tunable_policy(`deny_ptrace',`',` + allow $1 nscd_t:process ptrace; + ') init_labeled_script_domtrans($1, nscd_initrc_exec_t) domain_system_change_exemption($1) @@ -288,4 +338,8 @@ interface(`nscd_admin',` files_list_pids($1) admin_pattern($1, nscd_var_run_t) + + nscd_systemctl($1) + admin_pattern($1, nscd_unit_file_t) + allow $1 nscd_unit_file_t:service all_service_perms; ') diff --git a/nscd.te b/nscd.te index 7936e09..a505c8f 100644 --- a/nscd.te +++ b/nscd.te @@ -4,6 +4,13 @@ gen_require(` class nscd all_nscd_perms; ') +## +##

+## Allow confined applications to use nscd shared memory. +##

+## +gen_tunable(nscd_use_shm, false) + ######################################## # # Declarations @@ -22,6 +29,9 @@ init_daemon_domain(nscd_t, nscd_exec_t) type nscd_initrc_exec_t; init_script_file(nscd_initrc_exec_t) +type nscd_unit_file_t; +systemd_unit_file(nscd_unit_file_t) + type nscd_log_t; logging_log_file(nscd_log_t) @@ -47,13 +57,15 @@ allow nscd_t self:nscd { admin getstat }; allow nscd_t nscd_log_t:file manage_file_perms; logging_log_filetrans(nscd_t, nscd_log_t, file) +manage_dirs_pattern(nscd_t, nscd_var_run_t, nscd_var_run_t) manage_files_pattern(nscd_t, nscd_var_run_t, nscd_var_run_t) manage_sock_files_pattern(nscd_t, nscd_var_run_t, nscd_var_run_t) -files_pid_filetrans(nscd_t, nscd_var_run_t, { file sock_file }) +files_pid_filetrans(nscd_t, nscd_var_run_t, { file sock_file dir }) corecmd_search_bin(nscd_t) can_exec(nscd_t, nscd_exec_t) +kernel_read_network_state(nscd_t) kernel_read_kernel_sysctls(nscd_t) kernel_list_proc(nscd_t) kernel_read_proc_symlinks(nscd_t) @@ -70,7 +82,6 @@ fs_list_inotifyfs(nscd_t) auth_getattr_shadow(nscd_t) auth_use_nsswitch(nscd_t) -corenet_all_recvfrom_unlabeled(nscd_t) corenet_all_recvfrom_netlabel(nscd_t) corenet_tcp_sendrecv_generic_if(nscd_t) corenet_udp_sendrecv_generic_if(nscd_t) @@ -90,8 +101,8 @@ selinux_compute_create_context(nscd_t) selinux_compute_relabel_context(nscd_t) selinux_compute_user_contexts(nscd_t) domain_use_interactive_fds(nscd_t) +domain_search_all_domains_state(nscd_t) -files_read_etc_files(nscd_t) files_read_generic_tmp_symlinks(nscd_t) # Needed to read files created by firstboot "/etc/hesiod.conf" files_read_etc_runtime_files(nscd_t) @@ -99,7 +110,6 @@ files_read_etc_runtime_files(nscd_t) logging_send_audit_msgs(nscd_t) logging_send_syslog_msg(nscd_t) -miscfiles_read_localization(nscd_t) seutil_read_config(nscd_t) seutil_read_default_contexts(nscd_t) @@ -112,6 +122,10 @@ userdom_dontaudit_use_unpriv_user_fds(nscd_t) userdom_dontaudit_search_user_home_dirs(nscd_t) optional_policy(` + accountsd_dontaudit_rw_fifo_file(nscd_t) +') + +optional_policy(` cron_read_system_job_tmp_files(nscd_t) ') @@ -127,3 +141,17 @@ optional_policy(` xen_dontaudit_rw_unix_stream_sockets(nscd_t) xen_append_log(nscd_t) ') + +optional_policy(` + tunable_policy(`samba_domain_controller',` + samba_append_log(nscd_t) + samba_dontaudit_use_fds(nscd_t) + ') + + samba_read_config(nscd_t) + samba_read_var_files(nscd_t) +') + +optional_policy(` + unconfined_dontaudit_rw_packet_sockets(nscd_t) +') diff --git a/nsd.fc b/nsd.fc index 53cc800..5348e92 100644 --- a/nsd.fc +++ b/nsd.fc @@ -1,6 +1,6 @@ /etc/nsd(/.*)? gen_context(system_u:object_r:nsd_conf_t,s0) -/etc/nsd/nsd\.db -- gen_context(system_u:object_r:nsd_db_t,s0) +/etc/nsd/nsd\.db -- gen_context(system_u:object_r:nsd_zone_t,s0) /etc/nsd/primary(/.*)? gen_context(system_u:object_r:nsd_zone_t,s0) /etc/nsd/secondary(/.*)? gen_context(system_u:object_r:nsd_zone_t,s0) @@ -10,5 +10,4 @@ /usr/sbin/zonec -- gen_context(system_u:object_r:nsd_exec_t,s0) /var/lib/nsd(/.*)? gen_context(system_u:object_r:nsd_zone_t,s0) -/var/lib/nsd/nsd\.db -- gen_context(system_u:object_r:nsd_db_t,s0) /var/run/nsd\.pid -- gen_context(system_u:object_r:nsd_var_run_t,s0) diff --git a/nsd.te b/nsd.te index 4b15536..0015de4 100644 --- a/nsd.te +++ b/nsd.te @@ -18,15 +18,11 @@ domain_type(nsd_crond_t) domain_entry_file(nsd_crond_t, nsd_exec_t) role system_r types nsd_crond_t; -# a type for nsd.db -type nsd_db_t; -files_type(nsd_db_t) - type nsd_var_run_t; files_pid_file(nsd_var_run_t) # A type for zone files -type nsd_zone_t; +type nsd_zone_t alias nsd_db_t; files_type(nsd_zone_t) ######################################## @@ -34,25 +30,24 @@ files_type(nsd_zone_t) # NSD Local policy # -allow nsd_t self:capability { dac_override chown setuid setgid }; +allow nsd_t self:capability { chown dac_override kill setgid setuid }; dontaudit nsd_t self:capability sys_tty_config; allow nsd_t self:process signal_perms; allow nsd_t self:tcp_socket create_stream_socket_perms; allow nsd_t self:udp_socket create_socket_perms; +allow nsd_t self:fifo_file rw_fifo_file_perms; allow nsd_t nsd_conf_t:dir list_dir_perms; read_files_pattern(nsd_t, nsd_conf_t, nsd_conf_t) read_lnk_files_pattern(nsd_t, nsd_conf_t, nsd_conf_t) -allow nsd_t nsd_db_t:file manage_file_perms; -filetrans_pattern(nsd_t, nsd_zone_t, nsd_db_t, file) - manage_files_pattern(nsd_t, nsd_var_run_t, nsd_var_run_t) files_pid_filetrans(nsd_t, nsd_var_run_t, file) -allow nsd_t nsd_zone_t:dir list_dir_perms; -read_files_pattern(nsd_t, nsd_zone_t, nsd_zone_t) -read_lnk_files_pattern(nsd_t, nsd_zone_t, nsd_zone_t) +manage_dirs_pattern(nsd_t, nsd_zone_t, nsd_zone_t) +manage_files_pattern(nsd_t, nsd_zone_t, nsd_zone_t) +manage_lnk_files_pattern(nsd_t, nsd_zone_t, nsd_zone_t) +files_var_lib_filetrans(nsd_t, nsd_zone_t, dir) can_exec(nsd_t, nsd_exec_t) @@ -61,7 +56,6 @@ kernel_read_kernel_sysctls(nsd_t) corecmd_exec_bin(nsd_t) -corenet_all_recvfrom_unlabeled(nsd_t) corenet_all_recvfrom_netlabel(nsd_t) corenet_tcp_sendrecv_generic_if(nsd_t) corenet_udp_sendrecv_generic_if(nsd_t) @@ -79,17 +73,18 @@ dev_read_sysfs(nsd_t) domain_use_interactive_fds(nsd_t) -files_read_etc_files(nsd_t) files_read_etc_runtime_files(nsd_t) +files_search_var_lib(nsd_t) fs_getattr_all_fs(nsd_t) fs_search_auto_mountpoints(nsd_t) +auth_use_nsswitch(nsd_t) + logging_send_syslog_msg(nsd_t) -miscfiles_read_localization(nsd_t) -sysnet_read_config(nsd_t) +sysnet_dns_name_resolve(nsd_t) userdom_dontaudit_use_unpriv_user_fds(nsd_t) userdom_dontaudit_search_user_home_dirs(nsd_t) @@ -121,8 +116,6 @@ allow nsd_crond_t self:udp_socket create_socket_perms; allow nsd_crond_t nsd_conf_t:file read_file_perms; -allow nsd_crond_t nsd_db_t:file manage_file_perms; -filetrans_pattern(nsd_crond_t, nsd_zone_t, nsd_db_t, file) files_search_var_lib(nsd_crond_t) allow nsd_crond_t nsd_t:process signal; @@ -139,7 +132,6 @@ kernel_read_system_state(nsd_crond_t) corecmd_exec_bin(nsd_crond_t) corecmd_exec_shell(nsd_crond_t) -corenet_all_recvfrom_unlabeled(nsd_crond_t) corenet_all_recvfrom_netlabel(nsd_crond_t) corenet_tcp_sendrecv_generic_if(nsd_crond_t) corenet_udp_sendrecv_generic_if(nsd_crond_t) @@ -155,13 +147,13 @@ dev_read_urand(nsd_crond_t) domain_dontaudit_read_all_domains_state(nsd_crond_t) -files_read_etc_files(nsd_crond_t) files_read_etc_runtime_files(nsd_crond_t) files_search_var_lib(nsd_t) +auth_use_nsswitch(nsd_crond_t) + logging_send_syslog_msg(nsd_crond_t) -miscfiles_read_localization(nsd_crond_t) sysnet_read_config(nsd_crond_t) diff --git a/nslcd.if b/nslcd.if index 23c769c..0398e70 100644 --- a/nslcd.if +++ b/nslcd.if @@ -93,12 +93,15 @@ interface(`nslcd_stream_connect',` # interface(`nslcd_admin',` gen_require(` - type nslcd_t, nslcd_initrc_exec_t; - type nslcd_conf_t, nslcd_var_run_t; + type nslcd_t, nslcd_initrc_exec_t, nslcd_var_run_t; + type nslcd_conf_t; ') ps_process_pattern($1, nslcd_t) - allow $1 nslcd_t:process { ptrace signal_perms }; + allow $1 nslcd_t:process signal_perms; + tunable_policy(`deny_ptrace',`',` + allow $1 nslcd_t:process ptrace; + ') # Allow nslcd_t to restart the apache service nslcd_initrc_domtrans($1) @@ -106,9 +109,9 @@ interface(`nslcd_admin',` role_transition $2 nslcd_initrc_exec_t system_r; allow $2 system_r; - manage_files_pattern($1, nslcd_conf_t, nslcd_conf_t) + files_list_etc($1) + admin_pattern($1, nslcd_conf_t) - manage_dirs_pattern($1, nslcd_var_run_t, nslcd_var_run_t) - manage_files_pattern($1, nslcd_var_run_t, nslcd_var_run_t) - manage_lnk_files_pattern($1, nslcd_var_run_t, nslcd_var_run_t) + files_list_pids($1) + admin_pattern($1, nslcd_var_run_t, nslcd_var_run_t) ') diff --git a/nslcd.te b/nslcd.te index 01594c8..b09f9da 100644 --- a/nslcd.te +++ b/nslcd.te @@ -16,7 +16,7 @@ type nslcd_var_run_t; files_pid_file(nslcd_var_run_t) type nslcd_conf_t; -files_type(nslcd_conf_t) +files_config_file(nslcd_conf_t) ######################################## # @@ -24,7 +24,7 @@ files_type(nslcd_conf_t) # allow nslcd_t self:capability { setgid setuid dac_override }; -allow nslcd_t self:process signal; +allow nslcd_t self:process { setsched signal }; allow nslcd_t self:unix_stream_socket create_stream_socket_perms; allow nslcd_t nslcd_conf_t:file read_file_perms; @@ -42,13 +42,21 @@ corenet_tcp_connect_ldap_port(nslcd_t) corenet_sendrecv_ldap_client_packets(nslcd_t) files_read_etc_files(nslcd_t) +files_read_usr_symlinks(nslcd_t) +files_list_tmp(nslcd_t) auth_use_nsswitch(nslcd_t) logging_send_syslog_msg(nslcd_t) -miscfiles_read_localization(nslcd_t) + +userdom_read_user_tmp_files(nslcd_t) + +optional_policy(` + dirsrv_stream_connect(nslcd_t) +') optional_policy(` ldap_stream_connect(nslcd_t) ') + diff --git a/nsplugin.fc b/nsplugin.fc new file mode 100644 index 0000000..22e6c96 --- /dev/null +++ b/nsplugin.fc @@ -0,0 +1,11 @@ +HOME_DIR/\.adobe(/.*)? gen_context(system_u:object_r:nsplugin_home_t,s0) +HOME_DIR/\.macromedia(/.*)? gen_context(system_u:object_r:nsplugin_home_t,s0) +HOME_DIR/\.gnash(/.*)? gen_context(system_u:object_r:nsplugin_home_t,s0) +HOME_DIR/\.gcjwebplugin(/.*)? gen_context(system_u:object_r:nsplugin_home_t,s0) +HOME_DIR/\.icedteaplugin(/.*)? gen_context(system_u:object_r:nsplugin_home_t,s0) + +/usr/bin/nspluginscan -- gen_context(system_u:object_r:nsplugin_exec_t,s0) +/usr/bin/nspluginviewer -- gen_context(system_u:object_r:nsplugin_exec_t,s0) +/usr/lib/nspluginwrapper/npviewer.bin -- gen_context(system_u:object_r:nsplugin_exec_t,s0) +/usr/lib/nspluginwrapper/plugin-config -- gen_context(system_u:object_r:nsplugin_config_exec_t,s0) +/usr/lib/mozilla/plugins-wrapped(/.*)? gen_context(system_u:object_r:nsplugin_rw_t,s0) diff --git a/nsplugin.if b/nsplugin.if new file mode 100644 index 0000000..fce899a --- /dev/null +++ b/nsplugin.if @@ -0,0 +1,472 @@ + +## policy for nsplugin + +######################################## +## +## Create, read, write, and delete +## nsplugin rw files. +## +## +## +## Domain allowed access. +## +## +# +interface(`nsplugin_manage_rw_files',` + gen_require(` + type nsplugin_rw_t; + ') + + allow $1 nsplugin_rw_t:file manage_file_perms; + allow $1 nsplugin_rw_t:dir rw_dir_perms; +') + +######################################## +## +## Manage nsplugin rw files. +## +## +## +## Domain allowed access. +## +## +# +interface(`nsplugin_manage_rw',` + gen_require(` + type nsplugin_rw_t; + ') + + manage_dirs_pattern($1, nsplugin_rw_t, nsplugin_rw_t) + manage_files_pattern($1, nsplugin_rw_t, nsplugin_rw_t) + manage_lnk_files_pattern($1, nsplugin_rw_t, nsplugin_rw_t) +') + +####################################### +## +## The per role template for the nsplugin module. +## +## +## +## The role associated with the user domain. +## +## +## +## +## The type of the user domain. +## +## +# +interface(`nsplugin_role_notrans',` + gen_require(` + type nsplugin_rw_t; + type nsplugin_home_t; + type nsplugin_exec_t; + type nsplugin_config_exec_t; + type nsplugin_t; + type nsplugin_config_t; + class x_drawable all_x_drawable_perms; + class x_resource all_x_resource_perms; + class dbus send_msg; + ') + + role $1 types nsplugin_t; + role $1 types nsplugin_config_t; + + allow nsplugin_t $2:process signull; + allow nsplugin_t $2:dbus send_msg; + allow $2 nsplugin_t:dbus send_msg; + + list_dirs_pattern($2, nsplugin_rw_t, nsplugin_rw_t) + read_files_pattern($2, nsplugin_rw_t, nsplugin_rw_t) + read_lnk_files_pattern($2, nsplugin_rw_t, nsplugin_rw_t) + can_exec($2, nsplugin_rw_t) + + #Leaked File Descriptors +ifdef(`hide_broken_symptoms', ` + dontaudit nsplugin_t $2:fifo_file rw_inherited_fifo_file_perms; + dontaudit nsplugin_config_t $2:fifo_file rw_inherited_fifo_file_perms; +') + allow nsplugin_t $2:unix_stream_socket connectto; + dontaudit nsplugin_t $2:process ptrace; + allow nsplugin_t $2:sem rw_sem_perms; + allow nsplugin_t $2:shm rw_shm_perms; + dontaudit nsplugin_t $2:shm destroy; + allow $2 nsplugin_t:sem rw_sem_perms; + + allow $2 nsplugin_t:process { getattr signal_perms }; + allow $2 nsplugin_t:unix_stream_socket connectto; + + # Connect to pulseaudit server + stream_connect_pattern(nsplugin_t, user_home_t, user_home_t, $2) + gnome_stream_connect(nsplugin_t, $2) + + userdom_use_inherited_user_terminals(nsplugin_t) + userdom_use_inherited_user_terminals(nsplugin_config_t) + userdom_dontaudit_setattr_user_home_content_files(nsplugin_t) + userdom_manage_tmpfs_role($1, nsplugin_t) + + optional_policy(` + pulseaudio_role($1, nsplugin_t) + ') +') + +####################################### +## +## Role access for nsplugin +## +## +## +## The role associated with the user domain. +## +## +## +## +## The type of the user domain. +## +## +# +interface(`nsplugin_role',` + gen_require(` + type nsplugin_exec_t; + type nsplugin_config_exec_t; + type nsplugin_t; + type nsplugin_config_t; + ') + + nsplugin_role_notrans($1, $2) + + domtrans_pattern($2, nsplugin_exec_t, nsplugin_t) + domtrans_pattern($2, nsplugin_config_exec_t, nsplugin_config_t) + +') + +####################################### +## +## The per role template for the nsplugin module. +## +## +## +## The type of the user domain. +## +## +# +interface(`nsplugin_domtrans',` + gen_require(` + type nsplugin_exec_t; + type nsplugin_t; + ') + + domtrans_pattern($1, nsplugin_exec_t, nsplugin_t) + allow $1 nsplugin_t:unix_stream_socket connectto; + allow nsplugin_t $1:process signal; +') + +####################################### +## +## The per role template for the nsplugin module. +## +## +## +## The type of the user domain. +## +## +# +interface(`nsplugin_domtrans_config',` + gen_require(` + type nsplugin_config_exec_t; + type nsplugin_config_t; + ') + + domtrans_pattern($1, nsplugin_config_exec_t, nsplugin_config_t) +') + +######################################## +## +## Search nsplugin rw directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`nsplugin_search_rw_dir',` + gen_require(` + type nsplugin_rw_t; + ') + + allow $1 nsplugin_rw_t:dir search_dir_perms; +') + +######################################## +## +## Read nsplugin rw files. +## +## +## +## Domain allowed access. +## +## +# +interface(`nsplugin_read_rw_files',` + gen_require(` + type nsplugin_rw_t; + ') + + list_dirs_pattern($1, nsplugin_rw_t, nsplugin_rw_t) + read_files_pattern($1, nsplugin_rw_t, nsplugin_rw_t) + read_lnk_files_pattern($1, nsplugin_rw_t, nsplugin_rw_t) +') + +######################################## +## +## Read nsplugin home files. +## +## +## +## Domain allowed access. +## +## +# +interface(`nsplugin_read_home',` + gen_require(` + type nsplugin_home_t; + ') + + list_dirs_pattern($1, nsplugin_home_t, nsplugin_home_t) + read_files_pattern($1, nsplugin_home_t, nsplugin_home_t) + read_lnk_files_pattern($1, nsplugin_home_t, nsplugin_home_t) +') + +######################################## +## +## Exec nsplugin rw files. +## +## +## +## Domain allowed access. +## +## +# +interface(`nsplugin_rw_exec',` + gen_require(` + type nsplugin_rw_t; + ') + + can_exec($1, nsplugin_rw_t) +') + +######################################## +## +## Create, read, write, and delete +## nsplugin home files. +## +## +## +## Domain allowed access. +## +## +# +interface(`nsplugin_manage_home_files',` + gen_require(` + type nsplugin_home_t; + ') + + manage_files_pattern($1, nsplugin_home_t, nsplugin_home_t) +') + +######################################## +## +## manage nnsplugin home dirs. +## +## +## +## Domain allowed access. +## +## +# +interface(`nsplugin_manage_home_dirs',` + gen_require(` + type nsplugin_home_t; + ') + + manage_dirs_pattern($1, nsplugin_home_t, nsplugin_home_t) +') + +######################################## +## +## Allow attempts to read and write to +## nsplugin named pipes. +## +## +## +## Domain to not audit. +## +## +# +interface(`nsplugin_rw_pipes',` + gen_require(` + type nsplugin_home_t; + ') + + allow $1 nsplugin_home_t:fifo_file rw_fifo_file_perms; +') + +######################################## +## +## Read and write to nsplugin shared memory. +## +## +## +## Domain allowed access. +## +## +# +interface(`nsplugin_rw_shm',` + gen_require(` + type nsplugin_t; + ') + + allow $1 nsplugin_t:shm rw_shm_perms; +') + +##################################### +## +## Allow read and write access to nsplugin semaphores. +## +## +## +## Domain allowed access. +## +## +# +interface(`nsplugin_rw_semaphores',` + gen_require(` + type nsplugin_t; + ') + + allow $1 nsplugin_t:sem rw_sem_perms; +') + +######################################## +## +## Execute nsplugin_exec_t +## in the specified domain. +## +## +##

+## Execute a nsplugin_exec_t +## in the specified domain. +##

+##

+## No interprocess communication (signals, pipes, +## etc.) is provided by this interface since +## the domains are not owned by this module. +##

+## +## +## +## Domain allowed access. +## +## +## +## +## The type of the new process. +## +## +# +interface(`nsplugin_exec_domtrans',` + gen_require(` + type nsplugin_exec_t; + ') + + allow $2 nsplugin_exec_t:file entrypoint; + domtrans_pattern($1, nsplugin_exec_t, $2) +') + +######################################## +## +## Send generic signals to user nsplugin processes. +## +## +## +## Domain allowed access. +## +## +# +interface(`nsplugin_signal',` + gen_require(` + type nsplugin_t; + ') + + allow $1 nsplugin_t:process signal; +') + +######################################## +## +## Create objects in a user home directory +## with an automatic type transition to +## the nsplugin home file type. +## +## +## +## Domain allowed access. +## +## +## +## +## The class of the object to be created. +## +## +# +interface(`nsplugin_user_home_dir_filetrans',` + gen_require(` + type nsplugin_home_t; + ') + + userdom_user_home_dir_filetrans($1, nsplugin_home_t, $2) +') + +####################################### +## +## Create objects in a user home directory +## with an automatic type transition to +## the nsplugin home file type. +## +## +## +## Domain allowed access. +## +## +## +## +## The class of the object to be created. +## +## +# +interface(`nsplugin_user_home_filetrans',` + gen_require(` + type nsplugin_home_t; + ') + + userdom_user_home_content_filetrans($1, nsplugin_home_t, $2) +') + +######################################## +## +## Send signull signal to nsplugin +## processes. +## +## +## +## Domain allowed access. +## +## +# +interface(`nsplugin_signull',` + gen_require(` + type nsplugin_t; + ') + + allow $1 nsplugin_t:process signull; +') diff --git a/nsplugin.te b/nsplugin.te new file mode 100644 index 0000000..a333e40 --- /dev/null +++ b/nsplugin.te @@ -0,0 +1,323 @@ +policy_module(nsplugin, 1.0.0) + +######################################## +# +# Declarations +# + +## +##

+## Allow nsplugin code to execmem/execstack +##

+## +gen_tunable(nsplugin_execmem, false) + +## +##

+## Allow nsplugin code to connect to unreserved ports +##

+## +gen_tunable(nsplugin_can_network, true) + +type nsplugin_exec_t; +application_executable_file(nsplugin_exec_t) + +type nsplugin_config_exec_t; +application_executable_file(nsplugin_config_exec_t) + +type nsplugin_rw_t; +files_poly_member(nsplugin_rw_t) +files_type(nsplugin_rw_t) + +type nsplugin_tmp_t; +files_tmp_file(nsplugin_tmp_t) + +type nsplugin_home_t; +files_poly_member(nsplugin_home_t) +userdom_user_home_content(nsplugin_home_t) +typealias nsplugin_home_t alias user_nsplugin_home_t; + +type nsplugin_t; +application_domain(nsplugin_t, nsplugin_exec_t) + +type nsplugin_config_t; +domain_type(nsplugin_config_t) +domain_entry_file(nsplugin_config_t, nsplugin_config_exec_t) + +application_executable_file(nsplugin_exec_t) +application_executable_file(nsplugin_config_exec_t) + + +######################################## +# +# nsplugin local policy +# +dontaudit nsplugin_t self:capability { sys_nice sys_tty_config }; +allow nsplugin_t self:fifo_file rw_file_perms; +allow nsplugin_t self:process { setpgid getsched setsched signal_perms }; + +allow nsplugin_t self:sem create_sem_perms; +allow nsplugin_t self:shm create_shm_perms; +allow nsplugin_t self:msgq create_msgq_perms; +allow nsplugin_t self:netlink_kobject_uevent_socket create_socket_perms; +allow nsplugin_t self:unix_stream_socket { connectto create_stream_socket_perms }; +allow nsplugin_t self:unix_dgram_socket { sendto create_socket_perms }; +allow nsplugin_t self:tcp_socket create_stream_socket_perms; +allow nsplugin_t nsplugin_rw_t:dir list_dir_perms; +read_lnk_files_pattern(nsplugin_t, nsplugin_rw_t, nsplugin_rw_t) +read_files_pattern(nsplugin_t, nsplugin_rw_t, nsplugin_rw_t) + +tunable_policy(`nsplugin_execmem',` + allow nsplugin_t self:process { execstack execmem }; + allow nsplugin_config_t self:process { execstack execmem }; +') + +tunable_policy(`nsplugin_can_network',` + corenet_tcp_connect_all_unreserved_ports(nsplugin_t) + corenet_tcp_connect_all_ephemeral_ports(nsplugin_t) +') + +manage_dirs_pattern(nsplugin_t, nsplugin_home_t, nsplugin_home_t) +exec_files_pattern(nsplugin_t, nsplugin_home_t, nsplugin_home_t) +manage_files_pattern(nsplugin_t, nsplugin_home_t, nsplugin_home_t) +manage_fifo_files_pattern(nsplugin_t, nsplugin_home_t, nsplugin_home_t) +manage_sock_files_pattern(nsplugin_t, nsplugin_home_t, nsplugin_home_t) +manage_lnk_files_pattern(nsplugin_t, nsplugin_home_t, nsplugin_home_t) +userdom_user_home_dir_filetrans(nsplugin_t, nsplugin_home_t, {file dir}) +userdom_user_home_content_filetrans(nsplugin_t, nsplugin_home_t, {file dir}) +userdom_dontaudit_getattr_user_home_content(nsplugin_t) +userdom_dontaudit_search_user_bin_dirs(nsplugin_t) +userdom_dontaudit_write_user_home_content_files(nsplugin_t) +userdom_dontaudit_search_admin_dir(nsplugin_t) + +corecmd_exec_bin(nsplugin_t) +corecmd_exec_shell(nsplugin_t) + +corenet_all_recvfrom_netlabel(nsplugin_t) +corenet_tcp_connect_flash_port(nsplugin_t) +corenet_tcp_connect_streaming_port(nsplugin_t) +corenet_tcp_connect_pulseaudio_port(nsplugin_t) +corenet_tcp_connect_http_port(nsplugin_t) +corenet_tcp_connect_http_cache_port(nsplugin_t) +corenet_tcp_connect_squid_port(nsplugin_t) +corenet_tcp_sendrecv_generic_if(nsplugin_t) +corenet_tcp_sendrecv_generic_node(nsplugin_t) +corenet_tcp_connect_ipp_port(nsplugin_t) +corenet_tcp_connect_speech_port(nsplugin_t) + +domain_dontaudit_read_all_domains_state(nsplugin_t) + +dev_read_urand(nsplugin_t) +dev_read_rand(nsplugin_t) +dev_read_sound(nsplugin_t) +dev_write_sound(nsplugin_t) +dev_read_video_dev(nsplugin_t) +dev_write_video_dev(nsplugin_t) +dev_getattr_dri_dev(nsplugin_t) +dev_getattr_mouse_dev(nsplugin_t) +dev_rwx_zero(nsplugin_t) +dev_read_sysfs(nsplugin_t) +dev_dontaudit_getattr_all(nsplugin_t) + +kernel_read_kernel_sysctls(nsplugin_t) +kernel_read_system_state(nsplugin_t) +kernel_read_network_state(nsplugin_t) + +files_dontaudit_getattr_lost_found_dirs(nsplugin_t) +files_dontaudit_list_home(nsplugin_t) +files_read_usr_files(nsplugin_t) +files_read_config_files(nsplugin_t) + +fs_getattr_tmpfs(nsplugin_t) +fs_getattr_xattr_fs(nsplugin_t) +fs_search_auto_mountpoints(nsplugin_t) +fs_rw_anon_inodefs_files(nsplugin_t) +fs_list_inotifyfs(nsplugin_t) +fs_dontaudit_list_fusefs(nsplugin_t) + +storage_dontaudit_getattr_fixed_disk_dev(nsplugin_t) +storage_dontaudit_getattr_removable_dev(nsplugin_t) + +term_dontaudit_getattr_all_ptys(nsplugin_t) +term_dontaudit_getattr_all_ttys(nsplugin_t) + +auth_use_nsswitch(nsplugin_t) + +libs_exec_ld_so(nsplugin_t) + +miscfiles_read_fonts(nsplugin_t) +miscfiles_dontaudit_write_fonts(nsplugin_t) +miscfiles_setattr_fonts_cache_dirs(nsplugin_t) + +userdom_manage_user_tmp_dirs(nsplugin_t) +userdom_manage_user_tmp_files(nsplugin_t) +userdom_manage_user_tmp_sockets(nsplugin_t) +userdom_tmp_filetrans_user_tmp(nsplugin_t, { file dir sock_file }) +userdom_rw_semaphores(nsplugin_t) +userdom_dontaudit_rw_user_tmp_pipes(nsplugin_t) + +userdom_read_user_home_content_symlinks(nsplugin_t) +userdom_read_user_home_content_files(nsplugin_t) +userdom_read_user_tmp_files(nsplugin_t) +userdom_write_user_tmp_sockets(nsplugin_t) +userdom_dontaudit_append_user_home_content_files(nsplugin_t) +userdom_read_home_audio_files(nsplugin_t) + +optional_policy(` + alsa_read_rw_config(nsplugin_t) + alsa_read_home_files(nsplugin_t) +') + +optional_policy(` + chrome_dontaudit_sandbox_leaks(nsplugin_t) +') + +optional_policy(` + cups_stream_connect(nsplugin_t) +') + +optional_policy(` + dbus_session_bus_client(nsplugin_t) + dbus_connect_session_bus(nsplugin_t) + dbus_system_bus_client(nsplugin_t) +') + +optional_policy(` + gnome_exec_gconf(nsplugin_t) + gnome_manage_config(nsplugin_t) + gnome_read_gconf_home_files(nsplugin_t) + gnome_read_usr_config(nsplugin_t) +') + +optional_policy(` + gpm_getattr_gpmctl(nsplugin_t) +') + +optional_policy(` + mozilla_exec_user_home_files(nsplugin_t) + mozilla_read_user_home_files(nsplugin_t) + mozilla_write_user_home_files(nsplugin_t) + mozilla_plugin_delete_tmpfs_files(nsplugin_t) +') + +optional_policy(` + mplayer_exec(nsplugin_t) + mplayer_read_user_home_files(nsplugin_t) +') + +optional_policy(` + sandbox_read_tmpfs_files(nsplugin_t) +') + +optional_policy(` + gen_require(` + type user_tmpfs_t; + ') + xserver_user_x_domain_template(nsplugin, nsplugin_t, user_tmpfs_t) + xserver_rw_shm(nsplugin_t) + xserver_read_xdm_pid(nsplugin_t) + xserver_read_xdm_tmp_files(nsplugin_t) + xserver_read_user_xauth(nsplugin_t) + xserver_read_user_iceauth(nsplugin_t) + xserver_use_user_fonts(nsplugin_t) + xserver_rw_inherited_user_fonts(nsplugin_t) +') + +######################################## +# +# nsplugin_config local policy +# + +allow nsplugin_config_t self:capability { dac_override dac_read_search sys_nice setuid setgid }; +allow nsplugin_config_t self:process { setsched signal_perms getsched execmem }; +#execing pulseaudio +dontaudit nsplugin_t self:process { getcap setcap }; + +allow nsplugin_config_t self:fifo_file rw_file_perms; +allow nsplugin_config_t self:unix_stream_socket create_stream_socket_perms; + +dev_search_sysfs(nsplugin_config_t) +dev_read_urand(nsplugin_config_t) +dev_dontaudit_read_rand(nsplugin_config_t) +dev_dontaudit_rw_dri(nsplugin_config_t) + +fs_search_auto_mountpoints(nsplugin_config_t) +fs_list_inotifyfs(nsplugin_config_t) + +can_exec(nsplugin_config_t, nsplugin_rw_t) +manage_dirs_pattern(nsplugin_config_t, nsplugin_rw_t, nsplugin_rw_t) +manage_files_pattern(nsplugin_config_t, nsplugin_rw_t, nsplugin_rw_t) +manage_lnk_files_pattern(nsplugin_config_t, nsplugin_rw_t, nsplugin_rw_t) + +manage_dirs_pattern(nsplugin_config_t, nsplugin_home_t, nsplugin_home_t) +manage_files_pattern(nsplugin_config_t, nsplugin_home_t, nsplugin_home_t) +manage_lnk_files_pattern(nsplugin_config_t, nsplugin_home_t, nsplugin_home_t) + +corecmd_exec_bin(nsplugin_config_t) +corecmd_exec_shell(nsplugin_config_t) + +kernel_read_system_state(nsplugin_config_t) +kernel_request_load_module(nsplugin_config_t) + +domain_use_interactive_fds(nsplugin_config_t) + +files_read_usr_files(nsplugin_config_t) +files_dontaudit_search_home(nsplugin_config_t) +files_list_tmp(nsplugin_config_t) + +auth_use_nsswitch(nsplugin_config_t) + +miscfiles_read_fonts(nsplugin_config_t) + +userdom_search_user_home_content(nsplugin_config_t) +userdom_read_user_home_content_symlinks(nsplugin_config_t) +userdom_read_user_home_content_files(nsplugin_config_t) +userdom_dontaudit_search_admin_dir(nsplugin_config_t) + +tunable_policy(`use_nfs_home_dirs',` + fs_getattr_nfs(nsplugin_t) + fs_manage_nfs_dirs(nsplugin_t) + fs_manage_nfs_files(nsplugin_t) + fs_manage_nfs_symlinks(nsplugin_t) + fs_manage_nfs_named_pipes(nsplugin_t) + fs_manage_nfs_dirs(nsplugin_config_t) + fs_manage_nfs_files(nsplugin_config_t) + fs_manage_nfs_named_pipes(nsplugin_config_t) + fs_manage_nfs_symlinks(nsplugin_config_t) +') + +tunable_policy(`use_samba_home_dirs',` + fs_getattr_cifs(nsplugin_t) + fs_manage_cifs_dirs(nsplugin_t) + fs_manage_cifs_files(nsplugin_t) + fs_manage_cifs_symlinks(nsplugin_t) + fs_manage_cifs_named_pipes(nsplugin_t) + fs_manage_cifs_dirs(nsplugin_config_t) + fs_manage_cifs_files(nsplugin_config_t) + fs_manage_cifs_named_pipes(nsplugin_config_t) + fs_manage_cifs_symlinks(nsplugin_config_t) +') + +domtrans_pattern(nsplugin_config_t, nsplugin_exec_t, nsplugin_t) + +optional_policy(` + xserver_use_user_fonts(nsplugin_config_t) +') + +optional_policy(` + mozilla_read_user_home_files(nsplugin_config_t) + mozilla_write_user_home_files(nsplugin_config_t) +') + +application_signull(nsplugin_t) + +optional_policy(` + devicekit_dbus_chat_power(nsplugin_t) +') + +optional_policy(` + pulseaudio_exec(nsplugin_t) + pulseaudio_stream_connect(nsplugin_t) + pulseaudio_manage_home_files(nsplugin_t) + pulseaudio_setattr_home_dir(nsplugin_t) +') diff --git a/ntop.te b/ntop.te index ded9fb6..6b11681 100644 --- a/ntop.te +++ b/ntop.te @@ -63,7 +63,6 @@ kernel_read_kernel_sysctls(ntop_t) kernel_list_proc(ntop_t) kernel_read_proc_symlinks(ntop_t) -corenet_all_recvfrom_unlabeled(ntop_t) corenet_all_recvfrom_netlabel(ntop_t) corenet_tcp_sendrecv_generic_if(ntop_t) corenet_udp_sendrecv_generic_if(ntop_t) @@ -85,7 +84,6 @@ dev_rw_generic_usb_dev(ntop_t) domain_use_interactive_fds(ntop_t) -files_read_etc_files(ntop_t) files_read_usr_files(ntop_t) fs_getattr_all_fs(ntop_t) @@ -95,7 +93,6 @@ auth_use_nsswitch(ntop_t) logging_send_syslog_msg(ntop_t) -miscfiles_read_localization(ntop_t) miscfiles_read_fonts(ntop_t) userdom_dontaudit_use_unpriv_user_fds(ntop_t) diff --git a/ntp.fc b/ntp.fc index e79dccc..e8d3e38 100644 --- a/ntp.fc +++ b/ntp.fc @@ -10,6 +10,8 @@ /etc/rc\.d/init\.d/ntpd -- gen_context(system_u:object_r:ntpd_initrc_exec_t,s0) +/usr/lib/systemd/system/ntpd.* -- gen_context(system_u:object_r:ntpd_unit_file_t,s0) + /usr/sbin/ntpd -- gen_context(system_u:object_r:ntpd_exec_t,s0) /usr/sbin/ntpdate -- gen_context(system_u:object_r:ntpdate_exec_t,s0) diff --git a/ntp.if b/ntp.if index e80f8c0..0044e73 100644 --- a/ntp.if +++ b/ntp.if @@ -98,6 +98,48 @@ interface(`ntp_initrc_domtrans',` init_labeled_script_domtrans($1, ntpd_initrc_exec_t) ') +##################################### +## +## Allow domain to read ntpd systemd unit files. +## +## +## +## Domain allowed access. +## +## +# +interface(`ntp_read_unit_file',` + gen_require(` + type ntpd_unit_file_t; + ') + + files_search_var_lib($1) + allow $1 ntpd_unit_file_t:file read_file_perms; +') + +######################################## +## +## Execute ntpd server in the ntpd domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`ntp_systemctl',` + gen_require(` + type ntpd_unit_file_t; + type ntpd_t; + ') + + systemd_exec_systemctl($1) + allow $1 ntpd_unit_file_t:file read_file_perms; + allow $1 ntpd_unit_file_t:service manage_service_perms; + + ps_process_pattern($1, ntpd_t) +') + ######################################## ## ## Read and write ntpd shared memory. @@ -122,6 +164,25 @@ interface(`ntp_rw_shm',` ######################################## ## +## Allow the domain to read ntpd state files in /proc. +## +## +## +## Domain allowed access. +## +## +# +interface(`ntp_read_state',` + gen_require(` + type ntpd_t; + ') + + kernel_search_proc($1) + ps_process_pattern($1, ntpd_t) +') + +######################################## +## ## All of the rules required to administrate ## an ntp environment ## @@ -140,12 +201,15 @@ interface(`ntp_rw_shm',` interface(`ntp_admin',` gen_require(` type ntpd_t, ntpd_tmp_t, ntpd_log_t; - type ntpd_key_t, ntpd_var_run_t; - type ntpd_initrc_exec_t; + type ntpd_key_t, ntpd_var_run_t, ntpd_initrc_exec_t; + type ntpd_unit_file_t; ') - allow $1 ntpd_t:process { ptrace signal_perms getattr }; + allow $1 ntpd_t:process signal_perms; ps_process_pattern($1, ntpd_t) + tunable_policy(`deny_ptrace',`',` + allow $1 ntpd_t:process ptrace; + ') init_labeled_script_domtrans($1, ntpd_initrc_exec_t) domain_system_change_exemption($1) @@ -162,4 +226,8 @@ interface(`ntp_admin',` files_list_pids($1) admin_pattern($1, ntpd_var_run_t) + + ntp_systemctl($1) + admin_pattern($1, ntpd_unit_file_t) + allow $1 ntpd_unit_file_t:service all_service_perms; ') diff --git a/ntp.te b/ntp.te index c61adc8..374883b 100644 --- a/ntp.te +++ b/ntp.te @@ -15,6 +15,9 @@ init_daemon_domain(ntpd_t, ntpd_exec_t) type ntpd_initrc_exec_t; init_script_file(ntpd_initrc_exec_t) +type ntpd_unit_file_t; +systemd_unit_file(ntpd_unit_file_t) + type ntpd_key_t; files_type(ntpd_key_t) @@ -78,7 +81,6 @@ kernel_read_system_state(ntpd_t) kernel_read_network_state(ntpd_t) kernel_request_load_module(ntpd_t) -corenet_all_recvfrom_unlabeled(ntpd_t) corenet_all_recvfrom_netlabel(ntpd_t) corenet_tcp_sendrecv_generic_if(ntpd_t) corenet_udp_sendrecv_generic_if(ntpd_t) @@ -96,11 +98,15 @@ corenet_sendrecv_ntp_client_packets(ntpd_t) dev_read_sysfs(ntpd_t) # for SSP dev_read_urand(ntpd_t) +dev_rw_realtime_clock(ntpd_t) fs_getattr_all_fs(ntpd_t) fs_search_auto_mountpoints(ntpd_t) +# Necessary to communicate with gpsd devices +fs_rw_tmpfs_files(ntpd_t) term_use_ptmx(ntpd_t) +term_use_unallocated_ttys(ntpd_t) auth_use_nsswitch(ntpd_t) @@ -110,7 +116,6 @@ corecmd_exec_shell(ntpd_t) domain_use_interactive_fds(ntpd_t) domain_dontaudit_list_all_domains_state(ntpd_t) -files_read_etc_files(ntpd_t) files_read_etc_runtime_files(ntpd_t) files_read_usr_files(ntpd_t) files_list_var_lib(ntpd_t) @@ -119,7 +124,6 @@ init_exec_script_files(ntpd_t) logging_send_syslog_msg(ntpd_t) -miscfiles_read_localization(ntpd_t) userdom_dontaudit_use_unpriv_user_fds(ntpd_t) userdom_list_user_home_dirs(ntpd_t) diff --git a/numad.fc b/numad.fc new file mode 100644 index 0000000..1f97624 --- /dev/null +++ b/numad.fc @@ -0,0 +1,7 @@ +/usr/bin/numad -- gen_context(system_u:object_r:numad_exec_t,s0) + +/usr/lib/systemd/system/numad.* -- gen_context(system_u:object_r:numad_unit_file_t,s0) + +/var/log/numad\.log.* -- gen_context(system_u:object_r:numad_var_log_t,s0) + +/var/run/numad\.pid -- gen_context(system_u:object_r:numad_var_run_t,s0) diff --git a/numad.if b/numad.if new file mode 100644 index 0000000..709dda1 --- /dev/null +++ b/numad.if @@ -0,0 +1,72 @@ + +## policy for numad + +######################################## +## +## Transition to numad. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`numad_domtrans',` + gen_require(` + type numad_t, numad_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, numad_exec_t, numad_t) +') +######################################## +## +## Execute numad server in the numad domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`numad_systemctl',` + gen_require(` + type numad_t; + type numad_unit_file_t; + ') + + systemd_exec_systemctl($1) + systemd_read_fifo_file_passwd_run($1) + allow $1 numad_unit_file_t:file read_file_perms; + allow $1 numad_unit_file_t:service all_service_perms; + + ps_process_pattern($1, numad_t) +') + + +######################################## +## +## All of the rules required to administrate +## an numad environment +## +## +## +## Domain allowed access. +## +## +# +interface(`numad_admin',` + gen_require(` + type numad_t; + type numad_unit_file_t; + ') + + allow $1 numad_t:process { ptrace signal_perms }; + ps_process_pattern($1, numad_t) + + numad_systemctl($1) + optional_policy(` + systemd_passwd_agent_exec($1) + systemd_read_fifo_file_passwd_run($1) + ') +') diff --git a/numad.te b/numad.te new file mode 100644 index 0000000..40ceda2 --- /dev/null +++ b/numad.te @@ -0,0 +1,45 @@ +policy_module(numad, 1.0.0) + +######################################## +# +# Declarations +# + +type numad_t; +type numad_exec_t; +init_daemon_domain(numad_t, numad_exec_t) + +type numad_unit_file_t; +systemd_unit_file(numad_unit_file_t) + +type numad_var_log_t; +logging_log_file(numad_var_log_t) + +type numad_var_run_t; +files_pid_file(numad_var_run_t) + +######################################## +# +# numad local policy +# + +allow numad_t self:process { fork }; +allow numad_t self:fifo_file rw_fifo_file_perms; +allow numad_t self:msgq create_msgq_perms; +allow numad_t self:msg { send receive }; +allow numad_t self:unix_stream_socket create_stream_socket_perms; + +manage_files_pattern(numad_t, numad_var_log_t, numad_var_log_t) +logging_log_filetrans(numad_t, numad_var_log_t, { file }) + +manage_files_pattern(numad_t, numad_var_run_t, numad_var_run_t) +files_pid_filetrans(numad_t, numad_var_run_t, { file }) + +kernel_read_system_state(numad_t) + +dev_read_sysfs(numad_t) + +domain_use_interactive_fds(numad_t) + +files_read_etc_files(numad_t) + diff --git a/nut.fc b/nut.fc index 0a929ef..371119d 100644 --- a/nut.fc +++ b/nut.fc @@ -3,6 +3,7 @@ /sbin/upsdrvctl -- gen_context(system_u:object_r:nut_upsdrvctl_exec_t,s0) /usr/sbin/upsd -- gen_context(system_u:object_r:nut_upsd_exec_t,s0) +/usr/sbin/upsdrvctl -- gen_context(system_u:object_r:nut_upsdrvctl_exec_t,s0) /usr/sbin/upsmon -- gen_context(system_u:object_r:nut_upsmon_exec_t,s0) /var/run/nut(/.*)? gen_context(system_u:object_r:nut_var_run_t,s0) diff --git a/nut.te b/nut.te index ff962dd..7c6ea74 100644 --- a/nut.te +++ b/nut.te @@ -29,6 +29,7 @@ files_pid_file(nut_var_run_t) # allow nut_upsd_t self:capability { setgid setuid dac_override }; +allow nut_upsd_t self:process signal_perms; allow nut_upsd_t self:unix_dgram_socket { create_socket_perms sendto }; allow nut_upsd_t self:tcp_socket connected_stream_socket_perms; @@ -55,7 +56,6 @@ auth_use_nsswitch(nut_upsd_t) logging_send_syslog_msg(nut_upsd_t) -miscfiles_read_localization(nut_upsd_t) ######################################## # @@ -100,7 +100,6 @@ logging_send_syslog_msg(nut_upsmon_t) auth_use_nsswitch(nut_upsmon_t) -miscfiles_read_localization(nut_upsmon_t) mta_send_mail(nut_upsmon_t) @@ -133,6 +132,7 @@ kernel_read_kernel_sysctls(nut_upsdrvctl_t) # /sbin/upsdrvctl executes other drivers corecmd_exec_bin(nut_upsdrvctl_t) +dev_read_sysfs(nut_upsdrvctl_t) dev_read_urand(nut_upsdrvctl_t) dev_rw_generic_usb_dev(nut_upsdrvctl_t) @@ -144,7 +144,6 @@ init_sigchld(nut_upsdrvctl_t) logging_send_syslog_msg(nut_upsdrvctl_t) -miscfiles_read_localization(nut_upsdrvctl_t) ####################################### # @@ -157,7 +156,6 @@ optional_policy(` read_files_pattern(httpd_nutups_cgi_script_t, nut_conf_t, nut_conf_t) - corenet_all_recvfrom_unlabeled(httpd_nutups_cgi_script_t) corenet_all_recvfrom_netlabel(httpd_nutups_cgi_script_t) corenet_tcp_sendrecv_generic_if(httpd_nutups_cgi_script_t) corenet_tcp_sendrecv_generic_node(httpd_nutups_cgi_script_t) diff --git a/nx.if b/nx.if index 79a225c..d82b231 100644 --- a/nx.if +++ b/nx.if @@ -33,8 +33,10 @@ interface(`nx_read_home_files',` type nx_server_home_ssh_t, nx_server_var_lib_t; ') + files_search_var_lib($1) allow $1 nx_server_var_lib_t:dir search_dir_perms; read_files_pattern($1, nx_server_home_ssh_t, nx_server_home_ssh_t) + read_lnk_files_pattern($1, nx_server_home_ssh_t, nx_server_home_ssh_t) ') ######################################## @@ -52,6 +54,7 @@ interface(`nx_search_var_lib',` type nx_server_var_lib_t; ') + files_search_var_lib($1) allow $1 nx_server_var_lib_t:dir search_dir_perms; ') @@ -81,5 +84,24 @@ interface(`nx_var_lib_filetrans',` type nx_server_var_lib_t; ') + files_search_var_lib($1) filetrans_pattern($1, nx_server_var_lib_t, $2, $3) ') + +######################################## +## +## Transition to nx named content +## +## +## +## Domain allowed access. +## +## +# +interface(`nx_filetrans_named_content',` + gen_require(` + type nx_server_home_ssh_t, nx_server_var_lib_t; + ') + + filetrans_pattern($1, nx_server_var_lib_t, nx_server_home_ssh_t, dir, ".ssh") +') diff --git a/nx.te b/nx.te index 58e2972..2656613 100644 --- a/nx.te +++ b/nx.te @@ -28,6 +28,9 @@ files_type(nx_server_var_lib_t) type nx_server_var_run_t; files_pid_file(nx_server_var_run_t) +type nx_server_home_ssh_t; +files_type(nx_server_home_ssh_t) + ######################################## # # NX server local policy @@ -37,7 +40,7 @@ allow nx_server_t self:fifo_file rw_fifo_file_perms; allow nx_server_t self:tcp_socket create_socket_perms; allow nx_server_t self:udp_socket create_socket_perms; -allow nx_server_t nx_server_devpts_t:chr_file { rw_chr_file_perms setattr }; +allow nx_server_t nx_server_devpts_t:chr_file { rw_chr_file_perms setattr_chr_file_perms }; term_create_pty(nx_server_t, nx_server_devpts_t) manage_dirs_pattern(nx_server_t, nx_server_tmp_t, nx_server_tmp_t) @@ -51,6 +54,9 @@ files_var_lib_filetrans(nx_server_t, nx_server_var_lib_t, { file dir }) manage_files_pattern(nx_server_t, nx_server_var_run_t, nx_server_var_run_t) files_pid_filetrans(nx_server_t, nx_server_var_run_t, file) +manage_dirs_pattern(nx_server_t, nx_server_home_ssh_t, nx_server_home_ssh_t) +manage_files_pattern(nx_server_t, nx_server_home_ssh_t, nx_server_home_ssh_t) + kernel_read_system_state(nx_server_t) kernel_read_kernel_sysctls(nx_server_t) @@ -58,7 +64,6 @@ kernel_read_kernel_sysctls(nx_server_t) corecmd_exec_shell(nx_server_t) corecmd_exec_bin(nx_server_t) -corenet_all_recvfrom_unlabeled(nx_server_t) corenet_all_recvfrom_netlabel(nx_server_t) corenet_tcp_sendrecv_generic_if(nx_server_t) corenet_udp_sendrecv_generic_if(nx_server_t) @@ -77,7 +82,6 @@ files_read_etc_runtime_files(nx_server_t) # but users need to be able to also read the config files_read_usr_files(nx_server_t) -miscfiles_read_localization(nx_server_t) seutil_dontaudit_search_config(nx_server_t) diff --git a/oav.fc b/oav.fc index 0a66474..cf90b6e 100644 --- a/oav.fc +++ b/oav.fc @@ -6,4 +6,4 @@ /var/lib/oav-virussignatures -- gen_context(system_u:object_r:oav_update_var_lib_t,s0) /var/lib/oav-update(/.*)? gen_context(system_u:object_r:oav_update_var_lib_t,s0) -/var/log/scannerdaemon\.log -- gen_context(system_u:object_r:scannerdaemon_log_t,s0) +/var/log/scannerdaemon\.log.* -- gen_context(system_u:object_r:scannerdaemon_log_t,s0) diff --git a/oav.te b/oav.te index b4c5f86..9ecd4a3 100644 --- a/oav.te +++ b/oav.te @@ -48,7 +48,6 @@ read_lnk_files_pattern(oav_update_t, oav_update_var_lib_t, oav_update_var_lib_t) corecmd_exec_all_executables(oav_update_t) -corenet_all_recvfrom_unlabeled(oav_update_t) corenet_all_recvfrom_netlabel(oav_update_t) corenet_tcp_sendrecv_generic_if(oav_update_t) corenet_udp_sendrecv_generic_if(oav_update_t) @@ -66,7 +65,7 @@ logging_send_syslog_msg(oav_update_t) sysnet_read_config(oav_update_t) -userdom_use_user_terminals(oav_update_t) +userdom_use_inherited_user_terminals(oav_update_t) optional_policy(` cron_system_entry(oav_update_t, oav_update_exec_t) @@ -101,7 +100,6 @@ kernel_read_kernel_sysctls(scannerdaemon_t) # Can run kaffe corecmd_exec_all_executables(scannerdaemon_t) -corenet_all_recvfrom_unlabeled(scannerdaemon_t) corenet_all_recvfrom_netlabel(scannerdaemon_t) corenet_tcp_sendrecv_generic_if(scannerdaemon_t) corenet_udp_sendrecv_generic_if(scannerdaemon_t) @@ -130,7 +128,6 @@ libs_exec_lib_files(scannerdaemon_t) logging_send_syslog_msg(scannerdaemon_t) -miscfiles_read_localization(scannerdaemon_t) sysnet_read_config(scannerdaemon_t) diff --git a/obex.fc b/obex.fc new file mode 100644 index 0000000..7b31529 --- /dev/null +++ b/obex.fc @@ -0,0 +1,3 @@ + + +/usr/bin/obex-data-server -- gen_context(system_u:object_r:obex_exec_t,s0) diff --git a/obex.if b/obex.if new file mode 100644 index 0000000..d3b9544 --- /dev/null +++ b/obex.if @@ -0,0 +1,77 @@ +## SELinux policy for obex-data-server + +######################################## +## +## Transition to obex. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`obex_domtrans',` + gen_require(` + type obex_t, obex_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, obex_exec_t, obex_t) +') + +######################################## +## +## Send and receive messages from +## obex over dbus. +## +## +## +## Domain allowed access. +## +## +# +interface(`obex_dbus_chat',` + gen_require(` + type obex_t; + class dbus send_msg; + ') + + allow $1 obex_t:dbus send_msg; + allow obex_t $1:dbus send_msg; +') + +####################################### +## +## Role access for obex domains +## that executes via dbus-session +## +## +## +## The role associated with the user domain. +## +## +## +## +## The type of the user domain. +## +## +## +## +## User domain prefix to be used. +## +## +# +template(`obex_role',` + gen_require(` + type obex_t, obex_exec_t; + ') + + role $1 types obex_t; + + allow $2 obex_t:process signal_perms; + ps_process_pattern($2, obex_t) + + dbus_session_domain($3, obex_exec_t, obex_t) + + obex_dbus_chat($2) +') diff --git a/obex.te b/obex.te new file mode 100644 index 0000000..e9f259e --- /dev/null +++ b/obex.te @@ -0,0 +1,37 @@ +policy_module(obex,1.0.0) + +######################################## +# +# Declarations +# + +type obex_t; +type obex_exec_t; +application_domain(obex_t, obex_exec_t) +ubac_constrained(obex_t) + +######################################## +# +# obex local policy +# + +allow obex_t self:fifo_file rw_fifo_file_perms; +allow obex_t self:socket create_stream_socket_perms; + +dev_read_urand(obex_t) + +files_read_etc_files(obex_t) + +logging_send_syslog_msg(obex_t) + + +userdom_search_user_home_content(obex_t) + +optional_policy(` + bluetooth_stream_connect(obex_t) + bluetooth_dbus_chat(obex_t) +') + +optional_policy(` + dbus_system_bus_client(obex_t) +') diff --git a/oddjob.fc b/oddjob.fc index 9c272c2..0132b08 100644 --- a/oddjob.fc +++ b/oddjob.fc @@ -1,7 +1,6 @@ /usr/lib/oddjob/mkhomedir -- gen_context(system_u:object_r:oddjob_mkhomedir_exec_t,s0) +/usr/libexec/oddjob/mkhomedir -- gen_context(system_u:object_r:oddjob_mkhomedir_exec_t,s0) /usr/sbin/oddjobd -- gen_context(system_u:object_r:oddjob_exec_t,s0) -/sbin/mkhomedir_helper -- gen_context(system_u:object_r:oddjob_mkhomedir_exec_t,s0) - /var/run/oddjobd\.pid gen_context(system_u:object_r:oddjob_var_run_t,s0) diff --git a/oddjob.if b/oddjob.if index bd76ec2..28c4f00 100644 --- a/oddjob.if +++ b/oddjob.if @@ -22,6 +22,25 @@ interface(`oddjob_domtrans',` domtrans_pattern($1, oddjob_exec_t, oddjob_t) ') +##################################### +## +## Do not audit attempts to read and write +## oddjob fifo file. +## +## +## +## Domain to not audit. +## +## +# +interface(`oddjob_dontaudit_rw_fifo_file',` + gen_require(` + type oddjob_t; + ') + + dontaudit $1 oddjob_t:fifo_file rw_inherited_fifo_file_perms; +') + ######################################## ## ## Make the specified program domain accessable @@ -44,6 +63,7 @@ interface(`oddjob_system_entry',` ') domtrans_pattern(oddjob_t, $2, $1) + domain_user_exemption_target($1) ') ######################################## @@ -67,6 +87,24 @@ interface(`oddjob_dbus_chat',` allow oddjob_t $1:dbus send_msg; ') +###################################### +## +## Send a SIGCHLD signal to oddjob. +## +## +## +## Domain allowed access. +## +## +# +interface(`oddjob_sigchld',` + gen_require(` + type oddjob_t; + ') + + allow $1 oddjob_t:process sigchld; +') + ######################################## ## ## Execute a domain transition to run oddjob_mkhomedir. diff --git a/oddjob.te b/oddjob.te index a17ba31..467700e 100644 --- a/oddjob.te +++ b/oddjob.te @@ -51,9 +51,9 @@ mcs_process_set_categories(oddjob_t) selinux_compute_create_context(oddjob_t) -files_read_etc_files(oddjob_t) -miscfiles_read_localization(oddjob_t) +auth_use_nsswitch(oddjob_t) + locallogin_dontaudit_use_fds(oddjob_t) @@ -78,13 +78,10 @@ allow oddjob_mkhomedir_t self:unix_stream_socket create_stream_socket_perms; kernel_read_system_state(oddjob_mkhomedir_t) -files_read_etc_files(oddjob_mkhomedir_t) - auth_use_nsswitch(oddjob_mkhomedir_t) logging_send_syslog_msg(oddjob_mkhomedir_t) -miscfiles_read_localization(oddjob_mkhomedir_t) selinux_get_fs_mount(oddjob_mkhomedir_t) selinux_validate_context(oddjob_mkhomedir_t) @@ -99,8 +96,9 @@ seutil_read_default_contexts(oddjob_mkhomedir_t) # Add/remove user home directories userdom_home_filetrans_user_home_dir(oddjob_mkhomedir_t) -userdom_manage_user_home_content_dirs(oddjob_mkhomedir_t) -userdom_manage_user_home_content_files(oddjob_mkhomedir_t) userdom_manage_user_home_dirs(oddjob_mkhomedir_t) -userdom_user_home_dir_filetrans_user_home_content(oddjob_mkhomedir_t, notdevfile_class_set) +userdom_manage_user_home_content_dirs(oddjob_mkhomedir_t) +userdom_manage_user_home_content(oddjob_mkhomedir_t) +userdom_home_manager(oddjob_mkhomedir_t) +userdom_stream_connect(oddjob_mkhomedir_t) diff --git a/oident.if b/oident.if index bb4fae5..4dfed8a 100644 --- a/oident.if +++ b/oident.if @@ -66,3 +66,40 @@ interface(`oident_relabel_user_content', ` allow $1 oidentd_home_t:file relabel_file_perms; userdom_search_user_home_dirs($1) ') + +######################################## +## +## All of the rules required to administrate +## an oident environment +## +## +## +## Domain allowed access. +## +## +## +## +## Role allowed access. +## +## +## +# +interface(`oident_admin',` + gen_require(` + type oidentd_t, oidentd_initrc_exec_t, oidentd_config_t; + ') + + allow $1 oidentd_t:process signal_perms; + ps_process_pattern($1, oidentd_t) + tunable_policy(`deny_ptrace',`',` + allow $1 oidentd_t:process ptrace; + ') + + init_labeled_script_domtrans($1, oidentd_initrc_exec_t) + domain_system_change_exemption($1) + role_transition $2 oidentd_initrc_exec_t system_r; + allow $2 system_r; + + files_list_etc($1) + admin_pattern($1, oidentd_config_t) +') diff --git a/oident.te b/oident.te index 8845174..f7b073f 100644 --- a/oident.te +++ b/oident.te @@ -26,15 +26,14 @@ files_config_file(oidentd_config_t) # allow oidentd_t self:capability { setuid setgid }; -allow oidentd_t self:netlink_route_socket { write getattr read bind create nlmsg_read }; -allow oidentd_t self:netlink_tcpdiag_socket { write read create nlmsg_read }; -allow oidentd_t self:tcp_socket { setopt read bind create accept write getattr listen }; -allow oidentd_t self:udp_socket { write read create connect getattr ioctl }; +allow oidentd_t self:netlink_route_socket create_netlink_socket_perms; +allow oidentd_t self:netlink_tcpdiag_socket create_netlink_socket_perms; +allow oidentd_t self:tcp_socket create_stream_socket_perms; +allow oidentd_t self:udp_socket create_socket_perms; allow oidentd_t self:unix_dgram_socket { create connect }; allow oidentd_t oidentd_config_t:file read_file_perms; -corenet_all_recvfrom_unlabeled(oidentd_t) corenet_all_recvfrom_netlabel(oidentd_t) corenet_tcp_sendrecv_generic_if(oidentd_t) corenet_tcp_sendrecv_generic_node(oidentd_t) @@ -54,22 +53,7 @@ kernel_request_load_module(oidentd_t) logging_send_syslog_msg(oidentd_t) -miscfiles_read_localization(oidentd_t) - sysnet_read_config(oidentd_t) oident_read_user_content(oidentd_t) - -optional_policy(` - nis_use_ypbind(oidentd_t) -') - -tunable_policy(`use_samba_home_dirs', ` - fs_list_cifs(oidentd_t) - fs_read_cifs_files(oidentd_t) -') - -tunable_policy(`use_nfs_home_dirs', ` - fs_list_nfs(oidentd_t) - fs_read_nfs_files(oidentd_t) -') +userdom_home_reader(oidentd_t) diff --git a/openct.te b/openct.te index 7f8fdc2..bc14bc4 100644 --- a/openct.te +++ b/openct.te @@ -29,6 +29,8 @@ kernel_read_kernel_sysctls(openct_t) kernel_list_proc(openct_t) kernel_read_proc_symlinks(openct_t) +can_exec(openct_t, openct_exec_t) + dev_read_sysfs(openct_t) # openct asks for this dev_rw_usbfs(openct_t) @@ -45,12 +47,12 @@ fs_search_auto_mountpoints(openct_t) logging_send_syslog_msg(openct_t) -miscfiles_read_localization(openct_t) - userdom_dontaudit_use_unpriv_user_fds(openct_t) userdom_dontaudit_search_user_home_dirs(openct_t) -openct_exec(openct_t) +optional_policy(` + pcscd_stream_connect(openct_t) +') optional_policy(` seutil_sigchld_newrole(openct_t) diff --git a/openhpid.fc b/openhpid.fc new file mode 100644 index 0000000..9441fd7 --- /dev/null +++ b/openhpid.fc @@ -0,0 +1,8 @@ + +/etc/rc\.d/init\.d/openhpid -- gen_context(system_u:object_r:openhpid_initrc_exec_t,s0) + +/usr/sbin/openhpid -- gen_context(system_u:object_r:openhpid_exec_t,s0) + +/var/lib/openhpi(/.*)? gen_context(system_u:object_r:openhpid_var_lib_t,s0) + +/var/run/openhpid\.pid -- gen_context(system_u:object_r:openhpid_var_run_t,s0) diff --git a/openhpid.if b/openhpid.if new file mode 100644 index 0000000..598789a --- /dev/null +++ b/openhpid.if @@ -0,0 +1,159 @@ + +## policy for openhpid + + +######################################## +## +## Transition to openhpid. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`openhpid_domtrans',` + gen_require(` + type openhpid_t, openhpid_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, openhpid_exec_t, openhpid_t) +') + + +######################################## +## +## Execute openhpid server in the openhpid domain. +## +## +## +## Domain allowed access. +## +## +# +interface(`openhpid_initrc_domtrans',` + gen_require(` + type openhpid_initrc_exec_t; + ') + + init_labeled_script_domtrans($1, openhpid_initrc_exec_t) +') + + +######################################## +## +## Search openhpid lib directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`openhpid_search_lib',` + gen_require(` + type openhpid_var_lib_t; + ') + + allow $1 openhpid_var_lib_t:dir search_dir_perms; + files_search_var_lib($1) +') + +######################################## +## +## Read openhpid lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`openhpid_read_lib_files',` + gen_require(` + type openhpid_var_lib_t; + ') + + files_search_var_lib($1) + read_files_pattern($1, openhpid_var_lib_t, openhpid_var_lib_t) +') + +######################################## +## +## Manage openhpid lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`openhpid_manage_lib_files',` + gen_require(` + type openhpid_var_lib_t; + ') + + files_search_var_lib($1) + manage_files_pattern($1, openhpid_var_lib_t, openhpid_var_lib_t) +') + +######################################## +## +## Manage openhpid lib directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`openhpid_manage_lib_dirs',` + gen_require(` + type openhpid_var_lib_t; + ') + + files_search_var_lib($1) + manage_dirs_pattern($1, openhpid_var_lib_t, openhpid_var_lib_t) +') + + +######################################## +## +## All of the rules required to administrate +## an openhpid environment +## +## +## +## Domain allowed access. +## +## +## +## +## Role allowed access. +## +## +## +# +interface(`openhpid_admin',` + gen_require(` + type openhpid_t; + type openhpid_initrc_exec_t; + type openhpid_var_lib_t; + ') + + allow $1 openhpid_t:process { ptrace signal_perms }; + ps_process_pattern($1, openhpid_t) + + openhpid_initrc_domtrans($1) + domain_system_change_exemption($1) + role_transition $2 openhpid_initrc_exec_t system_r; + allow $2 system_r; + + files_search_var_lib($1) + admin_pattern($1, openhpid_var_lib_t) + + + +') + diff --git a/openhpid.te b/openhpid.te new file mode 100644 index 0000000..c4ecca7 --- /dev/null +++ b/openhpid.te @@ -0,0 +1,51 @@ +policy_module(openhpid, 1.0.0) + +######################################## +# +# Declarations +# + +type openhpid_t; +type openhpid_exec_t; +init_daemon_domain(openhpid_t, openhpid_exec_t) + +type openhpid_initrc_exec_t; +init_script_file(openhpid_initrc_exec_t) + +type openhpid_var_lib_t; +files_type(openhpid_var_lib_t) + +type openhpid_var_run_t; +files_pid_file(openhpid_var_run_t) + +######################################## +# +# openhpid local policy +# + +allow openhpid_t self:capability { kill }; +allow openhpid_t self:process { fork signal }; + +allow openhpid_t self:fifo_file rw_fifo_file_perms; +allow openhpid_t self:netlink_route_socket r_netlink_socket_perms; +allow openhpid_t self:unix_stream_socket create_stream_socket_perms; +allow openhpid_t self:tcp_socket create_stream_socket_perms; +allow openhpid_t self:udp_socket create_socket_perms; + +manage_dirs_pattern(openhpid_t, openhpid_var_lib_t, openhpid_var_lib_t) +manage_files_pattern(openhpid_t, openhpid_var_lib_t, openhpid_var_lib_t) +files_var_lib_filetrans(openhpid_t, openhpid_var_lib_t, { dir file }) + +manage_files_pattern(openhpid_t, openhpid_var_run_t, openhpid_var_run_t) +files_pid_filetrans(openhpid_t, openhpid_var_run_t, { file }) + +corenet_tcp_bind_generic_node(openhpid_t) +corenet_tcp_bind_openhpid_port(openhpid_t) + +domain_use_interactive_fds(openhpid_t) + +dev_read_urand(openhpid_t) + +files_read_etc_files(openhpid_t) + +logging_send_syslog_msg(openhpid_t) diff --git a/openshift-origin.fc b/openshift-origin.fc new file mode 100644 index 0000000..30ca148 --- /dev/null +++ b/openshift-origin.fc @@ -0,0 +1 @@ +# Left Blank diff --git a/openshift-origin.if b/openshift-origin.if new file mode 100644 index 0000000..3eb6a30 --- /dev/null +++ b/openshift-origin.if @@ -0,0 +1 @@ +## diff --git a/openshift-origin.te b/openshift-origin.te new file mode 100644 index 0000000..966d0b3 --- /dev/null +++ b/openshift-origin.te @@ -0,0 +1,14 @@ +policy_module(openshift-origin,1.0.0) +gen_require(` + attribute openshift_domain; +') + +######################################## +# +# openshift origin standard local policy +# +allow openshift_domain self:socket_class_set create_socket_perms; +corenet_tcp_connect_all_ports(openshift_domain) +corenet_tcp_bind_all_ports(openshift_domain) +dev_read_sysfs(openshift_domain) +files_read_config_files(openshift_domain) diff --git a/openshift.fc b/openshift.fc new file mode 100644 index 0000000..84338ed --- /dev/null +++ b/openshift.fc @@ -0,0 +1,17 @@ +/etc/rc\.d/init\.d/libra gen_context(system_u:object_r:openshift_initrc_exec_t,s0) +/etc/rc\.d/init\.d/mcollective gen_context(system_u:object_r:openshift_initrc_exec_t,s0) + +/var/lib/stickshift(/.*)? gen_context(system_u:object_r:openshift_var_lib_t,s0) +/var/lib/stickshift/.*/data(/.*)? gen_context(system_u:object_r:openshift_rw_file_t,s0) + +/var/lib/stickshift/.*/\.tmp(/.*)? gen_context(system_u:object_r:openshift_tmp_t,s0) +/var/lib/stickshift/.*/\.sandbox(/.*)? gen_context(system_u:object_r:openshift_tmp_t,s0) + +/var/log/mcollective\.log -- gen_context(system_u:object_r:openshift_log_t,s0) + +/usr/bin/rhc-cgroup-read -- gen_context(system_u:object_r:openshift_cgroup_read_exec_t,s0) + +/usr/bin/rhc-restorer -- gen_context(system_u:object_r:openshift_initrc_exec_t,s0) +/usr/bin/rhc-restorer-wrapper.sh -- gen_context(unconfined_u:object_r:httpd_openshift_script_exec_t,s0) + +/var/run/stickshift(/.*)? gen_context(system_u:object_r:openshift_var_run_t,s0) diff --git a/openshift.if b/openshift.if new file mode 100644 index 0000000..c9ddfd6 --- /dev/null +++ b/openshift.if @@ -0,0 +1,551 @@ + +## policy for openshift + +######################################## +## +## Execute openshift server in the openshift domain. +## +## +## +## The type of the process performing this action. +## +## +# +interface(`openshift_initrc_domtrans',` + gen_require(` + type openshift_initrc_t; + type openshift_initrc_exec_t; + ') + + domtrans_pattern($1, openshift_initrc_exec_t, openshift_initrc_t) +') + +######################################## +## +## Search openshift cache directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`openshift_search_cache',` + gen_require(` + type openshift_cache_t; + ') + + allow $1 openshift_cache_t:dir search_dir_perms; + files_search_var($1) +') + +######################################## +## +## Read openshift cache files. +## +## +## +## Domain allowed access. +## +## +# +interface(`openshift_read_cache_files',` + gen_require(` + type openshift_cache_t; + ') + + files_search_var($1) + read_files_pattern($1, openshift_cache_t, openshift_cache_t) +') + +######################################## +## +## Create, read, write, and delete +## openshift cache files. +## +## +## +## Domain allowed access. +## +## +# +interface(`openshift_manage_cache_files',` + gen_require(` + type openshift_cache_t; + ') + + files_search_var($1) + manage_files_pattern($1, openshift_cache_t, openshift_cache_t) +') + +######################################## +## +## Create, read, write, and delete +## openshift cache dirs. +## +## +## +## Domain allowed access. +## +## +# +interface(`openshift_manage_cache_dirs',` + gen_require(` + type openshift_cache_t; + ') + + files_search_var($1) + manage_dirs_pattern($1, openshift_cache_t, openshift_cache_t) +') + + +######################################## +## +## Allow the specified domain to read openshift's log files. +## +## +## +## Domain allowed access. +## +## +## +# +interface(`openshift_read_log',` + gen_require(` + type openshift_log_t; + ') + + logging_search_logs($1) + read_files_pattern($1, openshift_log_t, openshift_log_t) +') + +######################################## +## +## Allow the specified domain to append +## openshift log files. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`openshift_append_log',` + gen_require(` + type openshift_log_t; + ') + + logging_search_logs($1) + append_files_pattern($1, openshift_log_t, openshift_log_t) +') + +######################################## +## +## Allow domain to manage openshift log files +## +## +## +## Domain to not audit. +## +## +# +interface(`openshift_manage_log',` + gen_require(` + type openshift_log_t; + ') + + logging_search_logs($1) + manage_dirs_pattern($1, openshift_log_t, openshift_log_t) + manage_files_pattern($1, openshift_log_t, openshift_log_t) + manage_lnk_files_pattern($1, openshift_log_t, openshift_log_t) +') + +######################################## +## +## Search openshift lib directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`openshift_search_lib',` + gen_require(` + type openshift_var_lib_t; + ') + + allow $1 openshift_var_lib_t:dir search_dir_perms; + files_search_var_lib($1) +') + +######################################## +## +## Read openshift lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`openshift_read_lib_files',` + gen_require(` + type openshift_var_lib_t; + ') + + files_search_var_lib($1) + read_files_pattern($1, openshift_var_lib_t, openshift_var_lib_t) +') + +######################################## +## +## Read openshift lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`openshift_append_lib_files',` + gen_require(` + type openshift_var_lib_t; + ') + + files_search_var_lib($1) + append_files_pattern($1, openshift_var_lib_t, openshift_var_lib_t) +') + +######################################## +## +## Create, read, write, and delete +## openshift lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`openshift_manage_lib_files',` + gen_require(` + type openshift_var_lib_t; + ') + + files_search_var_lib($1) + manage_files_pattern($1, openshift_var_lib_t, openshift_var_lib_t) +') + +######################################## +## +## Manage openshift lib dirs files. +## +## +## +## Domain allowed access. +## +## +# +interface(`openshift_manage_lib_dirs',` + gen_require(` + type openshift_var_lib_t; + ') + + files_search_var_lib($1) + manage_dirs_pattern($1, openshift_var_lib_t, openshift_var_lib_t) +') + + +######################################## +## +## Read openshift PID files. +## +## +## +## Domain allowed access. +## +## +# +interface(`openshift_read_pid_files',` + gen_require(` + type openshift_var_run_t; + ') + + files_search_pids($1) + allow $1 openshift_var_run_t:file read_file_perms; +') + + +######################################## +## +## All of the rules required to administrate +## an openshift environment +## +## +## +## Domain allowed access. +## +## +## +## +## Role allowed access. +## +## +## +# +interface(`openshift_admin',` + gen_require(` + type openshift_t; + type openshift_initrc_exec_t; + type openshift_cache_t; + type openshift_log_t; + type openshift_var_lib_t; + type openshift_var_run_t; + ') + + allow $1 openshift_t:process { ptrace signal_perms }; + ps_process_pattern($1, openshift_t) + + openshift_initrc_domtrans($1) + domain_system_change_exemption($1) + role_transition $2 openshift_initrc_exec_t system_r; + allow $2 system_r; + + files_search_var($1) + admin_pattern($1, openshift_cache_t) + + logging_search_logs($1) + admin_pattern($1, openshift_log_t) + + files_search_var_lib($1) + admin_pattern($1, openshift_var_lib_t) + + files_search_pids($1) + admin_pattern($1, openshift_var_run_t) + +') + +######################################## +## +## Make the specified type usable as a openshift domain. +## +## +## +## The prefix of the domain (e.g., openshift +## is the prefix for openshift_t). +## +## +# +template(`openshift_service_domain_template',` + gen_require(` + attribute openshift_domain; + attribute openshift_user_domain; + ') + + type $1_t; + typeattribute $1_t openshift_domain, openshift_user_domain; + domain_type($1_t) + role system_r types $1_t; + mcs_untrusted_proc($1_t) + domain_user_exemption_target($1_t) + auth_use_nsswitch($1_t) + domain_obj_id_change_exemption($1_t) + domain_dyntrans_type($1_t) + + logging_send_syslog_msg($1_t) + + type $1_app_t; + typeattribute $1_app_t openshift_domain; + domain_type($1_app_t) + role system_r types $1_app_t; + mcs_untrusted_proc($1_app_t) + domain_user_exemption_target($1_app_t) + domain_obj_id_change_exemption($1_app_t) + domain_dyntrans_type($1_app_t) + + logging_send_syslog_msg($1_app_t) +') + +######################################## +## +## Make the specified type usable as a openshift domain. +## +## +## +## Type to be used as a openshift domain type. +## +## +# +template(`openshift_net_type',` + gen_require(` + attribute openshift_net_domain; + ') + + typeattribute $1 openshift_net_domain; +') + +######################################## +## +## Read and write inherited openshift files. +## +## +## +## Domain allowed access. +## +## +# +interface(`openshift_rw_inherited_content',` + gen_require(` + attribute openshift_file_type; + ') + + allow $1 openshift_file_type:file rw_inherited_file_perms; +') + +######################################## +## +## Manage openshift tmp files. +## +## +## +## Domain allowed access. +## +## +# +interface(`openshift_manage_tmp_files',` + gen_require(` + type openshift_tmp_t; + ') + + manage_files_pattern($1, openshift_tmp_t, openshift_tmp_t) +') + +######################################## +## +## Manage openshift tmp sockets. +## +## +## +## Domain allowed access. +## +## +# +interface(`openshift_manage_tmp_sockets',` + gen_require(` + type openshift_tmp_t; + ') + + manage_sock_files_pattern($1, openshift_tmp_t, openshift_tmp_t) +') + +######################################## +## +## Mounton openshift tmp directory. +## +## +## +## Domain allowed access. +## +## +# +interface(`openshift_mounton_tmp',` + gen_require(` + type openshift_tmp_t; + ') + + allow $1 openshift_tmp_t:dir mounton; +') + +######################################## +## +## Dontaudit Read and write inherited script fifo files. +## +## +## +## Domain allowed access. +## +## +# +interface(`openshift_dontaudit_rw_inherited_fifo_files',` + gen_require(` + type openshift_initrc_t; + ') + + dontaudit $1 openshift_initrc_t:fifo_file rw_inherited_fifo_file_perms; +') + +######################################## +## +## Allow calling app to transition to an openshift domain +## +## +## +## Domain allowed access +## +## +## +# +interface(`openshift_transition',` + gen_require(` + attribute openshift_user_domain; + ') + + allow $1 openshift_user_domain:process transition; + dontaudit $1 openshift_user_domain:process { noatsecure siginh rlimitinh }; + allow openshift_user_domain $1:fd use; + allow openshift_user_domain $1:fifo_file rw_inherited_fifo_file_perms; + allow openshift_user_domain $1:process sigchld; + dontaudit $1 openshift_user_domain:socket_class_set { read write }; +') + +######################################## +## +## Allow calling app to transition to an openshift domain +## +## +## +## Domain allowed access +## +## +## +# +interface(`openshift_dyntransition',` + gen_require(` + attribute openshift_domain; + attribute openshift_user_domain; + ') + + allow $1 openshift_user_domain:process dyntransition; + dontaudit openshift_user_domain $1:key view; + allow openshift_user_domain $1:unix_stream_socket { connectto rw_socket_perms }; + allow openshift_user_domain $1:unix_dgram_socket rw_socket_perms; + allow $1 openshift_user_domain:process { rlimitinh signal }; + dontaudit openshift_domain $1:tcp_socket { read write getattr setopt getopt shutdown }; +') + +######################################## +## +## Execute openshift in the openshift domain, and +## allow the specified role the openshift domain. +## +## +## +## Domain allowed to transition. +## +## +## +## +## Role allowed access. +## +## +# +interface(`openshift_run',` + gen_require(` + type openshift_initrc_exec_t; + ') + + openshift_initrc_domtrans($1) + role_transition $2 openshift_initrc_exec_t system_r; + openshift_transition($1) +') diff --git a/openshift.te b/openshift.te new file mode 100644 index 0000000..d939bee --- /dev/null +++ b/openshift.te @@ -0,0 +1,342 @@ +policy_module(openshift,1.0.0) + +gen_require(` + role system_r; +') + +######################################## +# +# Declarations +# + +# openshift applications that can use the network. +attribute openshift_net_domain; +# Attribute representing all openshift user processes (excludes apache processes) +attribute openshift_user_domain; +# Attribute representing all openshift processes +attribute openshift_domain; + +# Attribute for all openshift content +attribute openshift_file_type; + +# Type of openshift init script +type openshift_initrc_t; +type openshift_initrc_exec_t; +init_daemon_domain(openshift_initrc_t, openshift_initrc_exec_t) +init_ranged_daemon_domain(openshift_initrc_t, openshift_initrc_exec_t, s0 - mcs_systemhigh) +oddjob_system_entry(openshift_initrc_t, openshift_initrc_exec_t) + +type openshift_initrc_tmp_t; +files_tmp_file(openshift_initrc_tmp_t) + +type openshift_tmp_t, openshift_file_type; +files_tmp_file(openshift_tmp_t) +files_mountpoint(openshift_tmp_t) +files_poly(openshift_tmp_t) +files_poly_parent(openshift_tmp_t) + +type openshift_var_run_t; +files_pid_file(openshift_var_run_t) + +type openshift_var_lib_t, openshift_file_type; +files_poly(openshift_var_lib_t) +files_poly_parent(openshift_var_lib_t) + +type openshift_rw_file_t, openshift_file_type; +files_poly(openshift_rw_file_t) +files_poly_parent(openshift_rw_file_t) + +type openshift_log_t; +logging_log_file(openshift_log_t) + +type openshift_port_t; +corenet_port(openshift_port_t) +corenet_reserved_port(openshift_port_t) + +type openshift_cgroup_read_t; +type openshift_cgroup_read_exec_t; +application_domain(openshift_cgroup_read_t, openshift_cgroup_read_exec_t) + +######################################## +# +# Template to create openshift_t and openshift_app_t +# +openshift_service_domain_template(openshift) + +######################################## +# +# openshift initrc local policy +# +unconfined_domain_noaudit(openshift_initrc_t) +mcs_process_set_categories(openshift_initrc_t) + +manage_dirs_pattern(openshift_initrc_t, openshift_initrc_tmp_t, openshift_initrc_tmp_t) +manage_files_pattern(openshift_initrc_t, openshift_initrc_tmp_t, openshift_initrc_tmp_t) +manage_lnk_files_pattern(openshift_initrc_t, openshift_initrc_tmp_t, openshift_initrc_tmp_t) +files_tmp_filetrans(openshift_initrc_t, openshift_initrc_tmp_t, { file dir }) + +manage_dirs_pattern(openshift_initrc_t, openshift_var_run_t, openshift_var_run_t) +manage_files_pattern(openshift_initrc_t, openshift_var_run_t, openshift_var_run_t) +manage_lnk_files_pattern(openshift_initrc_t, openshift_var_run_t, openshift_var_run_t) +files_pid_filetrans(openshift_initrc_t, openshift_var_run_t, { file dir }) + +manage_dirs_pattern(openshift_initrc_t, openshift_log_t, openshift_log_t) +manage_files_pattern(openshift_initrc_t, openshift_log_t, openshift_log_t) +logging_log_filetrans(openshift_initrc_t, openshift_log_t, { file dir }) + +allow openshift_initrc_t openshift_domain:process { getattr getsched setsched transition signal signull sigkill }; +allow openshift_domain openshift_initrc_t:fd use; +allow openshift_domain openshift_initrc_t:fifo_file rw_inherited_fifo_file_perms; +allow openshift_domain openshift_initrc_t:process sigchld; +dontaudit openshift_domain openshift_initrc_t:key view; +dontaudit openshift_domain openshift_initrc_t:process signull; +dontaudit openshift_domain openshift_initrc_t:socket_class_set { read write }; + +####################################################### +# +# Policy for all openshift domains +# +allow openshift_domain self:process all_process_perms; +allow openshift_domain self:msg all_msg_perms; +allow openshift_domain self:msgq create_msgq_perms; +allow openshift_domain self:shm create_shm_perms; +allow openshift_domain self:sem create_sem_perms; + +dontaudit openshift_domain self:netlink_tcpdiag_socket create; +allow openshift_domain self:tcp_socket create_stream_socket_perms; +allow openshift_domain self:fifo_file manage_fifo_file_perms; +allow openshift_domain self:unix_stream_socket { create_stream_socket_perms connectto }; +allow openshift_domain self:unix_dgram_socket { create_socket_perms sendto }; +dontaudit openshift_domain self:netlink_audit_socket { create_socket_perms nlmsg_relay }; + +manage_dirs_pattern(openshift_domain, openshift_rw_file_t, openshift_rw_file_t) +manage_files_pattern(openshift_domain, openshift_rw_file_t, openshift_rw_file_t) +manage_fifo_files_pattern(openshift_domain, openshift_rw_file_t, openshift_rw_file_t) +manage_sock_files_pattern(openshift_domain, openshift_rw_file_t, openshift_rw_file_t) +manage_lnk_files_pattern(openshift_domain, openshift_rw_file_t, openshift_rw_file_t) +allow openshift_domain openshift_rw_file_t:dir_file_class_set { relabelfrom relabelto }; + +list_dirs_pattern(openshift_domain, openshift_file_type, openshift_file_type) +read_files_pattern(openshift_domain, openshift_file_type, openshift_file_type) +rw_fifo_files_pattern(openshift_domain, openshift_file_type, openshift_file_type) +rw_sock_files_pattern(openshift_domain, openshift_file_type, openshift_file_type) +read_lnk_files_pattern(openshift_domain, openshift_file_type, openshift_file_type) +allow openshift_domain openshift_file_type:file execmod; +can_exec(openshift_domain, openshift_file_type) +allow openshift_domain openshift_file_type:file entrypoint; +# Allow users to execute files in their home dir +allow openshift_domain openshift_file_type:file { execute execute_no_trans }; + +# Dontaudit openshift domains trying to search other openshift domains directories, +# this happens just when users are probing the system +dontaudit openshift_domain openshift_file_type:dir search_dir_perms +; + +manage_dirs_pattern(openshift_domain, openshift_tmp_t, openshift_tmp_t) +manage_fifo_files_pattern(openshift_domain, openshift_tmp_t, openshift_tmp_t) +manage_files_pattern(openshift_domain, openshift_tmp_t, openshift_tmp_t) +manage_lnk_files_pattern(openshift_domain, openshift_tmp_t, openshift_tmp_t) +manage_sock_files_pattern(openshift_domain, openshift_tmp_t, openshift_tmp_t) +files_tmp_filetrans(openshift_domain, openshift_tmp_t, { lnk_file file dir sock_file fifo_file }) +allow openshift_domain openshift_tmp_t:dir_file_class_set { relabelfrom relabelto }; + +allow openshift_domain openshift_log_t:file { getattr append lock ioctl }; + +dontaudit openshift_domain openshift_initrc_tmp_t:file append; +dontaudit openshift_domain openshift_var_run_t:file append; +dontaudit openshift_domain openshift_file_type:sock_file execute; + +kernel_read_system_state(openshift_domain) +kernel_read_network_state(openshift_domain) +kernel_dontaudit_list_all_proc(openshift_domain) +kernel_dontaudit_list_all_sysctls(openshift_domain) +kernel_dontaudit_request_load_module(openshift_domain) +kernel_get_sysvipc_info(openshift_domain) + +corecmd_shell_entry_type(openshift_domain) +corecmd_bin_entry_type(openshift_domain) +corecmd_exec_all_executables(openshift_domain) + +dev_list_sysfs(openshift_domain) +dev_read_rand(openshift_domain) +dev_dontaudit_append_rand(openshift_domain) +dev_dontaudit_write_urand(openshift_domain) +dev_dontaudit_getattr_all_blk_files(openshift_domain) +dev_dontaudit_getattr_all_chr_files(openshift_domain) + +domain_use_interactive_fds(openshift_domain) +domain_dontaudit_read_all_domains_state(openshift_domain) + +files_read_var_lib_symlinks(openshift_domain) + +fs_rw_hugetlbfs_files(openshift_domain) +fs_rw_anon_inodefs_files(openshift_domain) +fs_search_tmpfs(openshift_domain) +fs_getattr_xattr_fs(openshift_domain) +fs_dontaudit_getattr_all_fs(openshift_domain) +fs_list_inotifyfs(openshift_domain) +fs_dontaudit_list_auto_mountpoints(openshift_domain) +fs_dontaudit_list_tmpfs(openshift_domain) +storage_dontaudit_getattr_fixed_disk_dev(openshift_domain) +storage_getattr_fixed_disk_dev(openshift_domain) +fs_get_xattr_fs_quotas(openshift_domain) +fs_rw_inherited_tmpfs_files(openshift_domain) +fs_dontaudit_rw_anon_inodefs_files(openshift_domain) + +dontaudit openshift_domain file_type:dir read; +files_dontaudit_list_home(openshift_domain) +files_dontaudit_search_all_pids(openshift_domain) +files_dontaudit_getattr_all_dirs(openshift_domain) +files_dontaudit_getattr_all_files(openshift_domain) +files_dontaudit_list_mnt(openshift_domain) +files_dontaudit_list_var(openshift_domain) +files_dontaudit_getattr_lost_found_dirs(openshift_domain) +files_dontaudit_search_all_mountpoints(openshift_domain) +files_dontaudit_search_spool(openshift_domain) +files_dontaudit_search_all_dirs(openshift_domain) +files_dontaudit_list_var(openshift_domain) +files_read_etc_files(openshift_domain) +files_exec_etc_files(openshift_domain) +files_read_usr_files(openshift_domain) +files_dontaudit_getattr_non_security_sockets(openshift_domain) +files_dontaudit_setattr_non_security_dirs(openshift_domain) +files_dontaudit_setattr_non_security_files(openshift_domain) + +libs_exec_lib_files(openshift_domain) +libs_exec_ld_so(openshift_domain) + +term_use_ptmx(openshift_domain) + +selinux_validate_context(openshift_domain) + +logging_inherit_append_all_logs(openshift_domain) + +init_dontaudit_read_utmp(openshift_domain) + +miscfiles_read_fonts(openshift_domain) +miscfiles_read_man_pages(openshift_domain) +miscfiles_dontaudit_setattr_fonts_cache_dirs(openshift_domain) + +mta_dontaudit_read_spool_symlinks(openshift_domain) + +term_dontaudit_search_ptys(openshift_domain) +term_use_ptmx(openshift_domain) + +userdom_use_inherited_user_ptys(openshift_domain) +userdom_dontaudit_search_admin_dir(openshift_domain) + +application_exec(openshift_domain) + +optional_policy(` + apache_exec_modules(openshift_domain) + apache_list_modules(openshift_domain) + apache_read_config(openshift_domain) + apache_search_config(openshift_domain) + apache_read_sys_content(openshift_domain) + apache_exec_sys_script(openshift_domain) + apache_entrypoint(openshift_domain) + + ############################################# + # + # openshift cgi script policy + # + apache_content_template(openshift) + domtrans_pattern(httpd_openshift_script_t, openshift_initrc_exec_t, openshift_initrc_t) + optional_policy(` + dbus_system_bus_client(httpd_openshift_script_t) + optional_policy(` + oddjob_dbus_chat(httpd_openshift_script_t) + oddjob_dontaudit_rw_fifo_file(openshift_domain) + ') + ') +') + +optional_policy(` + cron_role(system_r, openshift_domain) +') + +optional_policy(` + gpg_entry_type(openshift_domain) +') + +optional_policy(` + mysql_search_db(openshift_domain) +') + +optional_policy(` + ssh_use_ptys(openshift_domain) + ssh_getattr_user_home_dir(openshift_domain) + ssh_dontaudit_search_user_home_dir(openshift_domain) +') + +####################################################### +# +# Policy for openshift user domain process +# +manage_dirs_pattern(openshift_user_domain, openshift_file_type, openshift_file_type) +manage_files_pattern(openshift_user_domain, openshift_file_type, openshift_file_type) +manage_fifo_files_pattern(openshift_user_domain, openshift_file_type, openshift_file_type) +manage_sock_files_pattern(openshift_user_domain, openshift_file_type, openshift_file_type) +manage_lnk_files_pattern(openshift_user_domain, openshift_file_type, openshift_file_type) +allow openshift_user_domain openshift_file_type:dir_file_class_set { relabelfrom relabelto }; + +allow openshift_user_domain openshift_domain:process transition; +allow openshift_domain openshift_user_domain:fd use; +allow openshift_domain openshift_user_domain:fifo_file rw_inherited_fifo_file_perms; +allow openshift_domain openshift_user_domain:process sigchld; +dontaudit openshift_domain openshift_user_domain:key view; +dontaudit openshift_domain openshift_user_domain:process signull; +dontaudit openshift_domain openshift_user_domain:socket_class_set { read write }; + +allow openshift_user_domain openshift_domain:process ptrace; + +############################################################################ +# +# Rules specific to openshift and openshift_app_t +# +kernel_read_vm_sysctls(openshift_t) +kernel_read_vm_sysctls(openshift_app_t) +kernel_search_vm_sysctl(openshift_t) +kernel_search_vm_sysctl(openshift_app_t) +netutils_domtrans_ping(openshift_t) +netutils_kill_ping(openshift_t) +netutils_signal_ping(openshift_t) + +openshift_net_type(openshift_app_t) +openshift_net_type(openshift_t) + +######################################## +# +# openshift_cgroup_read local policy +# + +allow openshift_cgroup_read_t self:process { getattr signal_perms }; +allow openshift_cgroup_read_t self:fifo_file rw_fifo_file_perms; +allow openshift_cgroup_read_t self:unix_stream_socket create_stream_socket_perms; +allow openshift_cgroup_read_t openshift_initrc_t:fifo_file rw_inherited_fifo_file_perms; + +ssh_dontaudit_use_ptys(openshift_cgroup_read_t) + +corecmd_exec_bin(openshift_cgroup_read_t) + +dev_read_urand(openshift_cgroup_read_t) + +domain_use_interactive_fds(openshift_cgroup_read_t) + +files_read_etc_files(openshift_cgroup_read_t) + +fs_dontaudit_rw_anon_inodefs_files(openshift_cgroup_read_t) + +userdom_use_inherited_user_ptys(openshift_cgroup_read_t) + +miscfiles_read_generic_certs(openshift_cgroup_read_t) + +domtrans_pattern(openshift_domain, openshift_cgroup_read_exec_t, openshift_cgroup_read_t) +role system_r types openshift_cgroup_read_t; + +allow openshift_domain openshift_cgroup_read_t:process { getattr signal signull sigkill }; + +fs_read_cgroup_files(openshift_cgroup_read_t) + +allow openshift_cgroup_read_t openshift_var_lib_t:dir list_dir_perms; +read_files_pattern(openshift_cgroup_read_t, openshift_var_lib_t, openshift_var_lib_t) diff --git a/openvpn.if b/openvpn.if index d883214..d6afa87 100644 --- a/openvpn.if +++ b/openvpn.if @@ -144,8 +144,11 @@ interface(`openvpn_admin',` type openvpn_var_run_t, openvpn_initrc_exec_t; ') - allow $1 openvpn_t:process { ptrace signal_perms }; + allow $1 openvpn_t:process signal_perms; ps_process_pattern($1, openvpn_t) + tunable_policy(`deny_ptrace',`',` + allow $1 openvpn_t:process ptrace; + ') init_labeled_script_domtrans($1, openvpn_initrc_exec_t) domain_system_change_exemption($1) diff --git a/openvpn.te b/openvpn.te index 66a52ee..2f2e069 100644 --- a/openvpn.te +++ b/openvpn.te @@ -24,6 +24,9 @@ files_config_file(openvpn_etc_t) type openvpn_etc_rw_t; files_config_file(openvpn_etc_rw_t) +type openvpn_tmp_t; +files_tmp_file(openvpn_tmp_t) + type openvpn_initrc_exec_t; init_script_file(openvpn_initrc_exec_t) @@ -40,15 +43,15 @@ files_pid_file(openvpn_var_run_t) # openvpn local policy # -allow openvpn_t self:capability { dac_read_search dac_override ipc_lock net_bind_service net_admin setgid setuid sys_chroot sys_tty_config }; -allow openvpn_t self:process { signal getsched }; +allow openvpn_t self:capability { dac_read_search dac_override ipc_lock net_bind_service net_admin setgid setuid sys_chroot sys_tty_config sys_nice }; +allow openvpn_t self:process { signal getsched setsched }; allow openvpn_t self:fifo_file rw_fifo_file_perms; allow openvpn_t self:unix_dgram_socket { create_socket_perms sendto }; allow openvpn_t self:unix_stream_socket { create_stream_socket_perms connectto }; allow openvpn_t self:udp_socket create_socket_perms; allow openvpn_t self:tcp_socket server_stream_socket_perms; -allow openvpn_t self:tun_socket create; +allow openvpn_t self:tun_socket { create_socket_perms relabelfrom }; allow openvpn_t self:netlink_route_socket rw_netlink_socket_perms; can_exec(openvpn_t, openvpn_etc_t) @@ -58,9 +61,15 @@ read_lnk_files_pattern(openvpn_t, openvpn_etc_t, openvpn_etc_t) manage_files_pattern(openvpn_t, openvpn_etc_t, openvpn_etc_rw_t) filetrans_pattern(openvpn_t, openvpn_etc_t, openvpn_etc_rw_t, file) -allow openvpn_t openvpn_var_log_t:file manage_file_perms; -logging_log_filetrans(openvpn_t, openvpn_var_log_t, file) +manage_files_pattern(openvpn_t, openvpn_tmp_t, openvpn_tmp_t) +files_tmp_filetrans(openvpn_t, openvpn_tmp_t, file) + + +manage_dirs_pattern(openvpn_t, openvpn_var_log_t, openvpn_var_log_t) +manage_files_pattern(openvpn_t, openvpn_var_log_t, openvpn_var_log_t) +logging_log_filetrans(openvpn_t, openvpn_var_log_t, { dir file }) +manage_dirs_pattern(openvpn_t, openvpn_var_run_t, openvpn_var_run_t) manage_files_pattern(openvpn_t, openvpn_var_run_t, openvpn_var_run_t) files_pid_filetrans(openvpn_t, openvpn_var_run_t, { file dir }) @@ -68,11 +77,11 @@ kernel_read_kernel_sysctls(openvpn_t) kernel_read_net_sysctls(openvpn_t) kernel_read_network_state(openvpn_t) kernel_read_system_state(openvpn_t) +kernel_request_load_module(openvpn_t) corecmd_exec_bin(openvpn_t) corecmd_exec_shell(openvpn_t) -corenet_all_recvfrom_unlabeled(openvpn_t) corenet_all_recvfrom_netlabel(openvpn_t) corenet_tcp_sendrecv_generic_if(openvpn_t) corenet_udp_sendrecv_generic_if(openvpn_t) @@ -87,6 +96,7 @@ corenet_udp_bind_openvpn_port(openvpn_t) corenet_tcp_bind_http_port(openvpn_t) corenet_tcp_connect_openvpn_port(openvpn_t) corenet_tcp_connect_http_port(openvpn_t) +corenet_tcp_connect_tor_socks_port(openvpn_t) corenet_tcp_connect_http_cache_port(openvpn_t) corenet_rw_tun_tap_dev(openvpn_t) corenet_sendrecv_openvpn_server_packets(openvpn_t) @@ -100,33 +110,39 @@ dev_read_urand(openvpn_t) files_read_etc_files(openvpn_t) files_read_etc_runtime_files(openvpn_t) +fs_getattr_xattr_fs(openvpn_t) + auth_use_pam(openvpn_t) +init_read_utmp(openvpn_t) + logging_send_syslog_msg(openvpn_t) -miscfiles_read_localization(openvpn_t) miscfiles_read_all_certs(openvpn_t) sysnet_dns_name_resolve(openvpn_t) +sysnet_use_ldap(openvpn_t) sysnet_exec_ifconfig(openvpn_t) sysnet_manage_config(openvpn_t) sysnet_etc_filetrans_config(openvpn_t) -userdom_use_user_terminals(openvpn_t) +userdom_use_inherited_user_terminals(openvpn_t) +userdom_read_home_certs(openvpn_t) +userdom_attach_admin_tun_iface(openvpn_t) +userdom_read_inherited_user_tmp_files(openvpn_t) +userdom_read_inherited_user_home_content_files(openvpn_t) tunable_policy(`openvpn_enable_homedirs',` - userdom_read_user_home_content_files(openvpn_t) + userdom_search_user_home_dirs(openvpn_t) ') tunable_policy(`openvpn_enable_homedirs && use_nfs_home_dirs',` - fs_read_nfs_files(openvpn_t) - fs_read_nfs_symlinks(openvpn_t) -') + fs_read_nfs_files(openvpn_t) +') tunable_policy(`openvpn_enable_homedirs && use_samba_home_dirs',` - fs_read_cifs_files(openvpn_t) - fs_read_cifs_symlinks(openvpn_t) -') + fs_read_cifs_files(openvpn_t) +') optional_policy(` daemontools_service_domain(openvpn_t, openvpn_exec_t) @@ -138,3 +154,7 @@ optional_policy(` networkmanager_dbus_chat(openvpn_t) ') + +optional_policy(` + unconfined_attach_tun_iface(openvpn_t) +') diff --git a/pacemaker.fc b/pacemaker.fc new file mode 100644 index 0000000..4e915ab --- /dev/null +++ b/pacemaker.fc @@ -0,0 +1,11 @@ +/etc/rc\.d/init\.d/pacemaker -- gen_context(system_u:object_r:pacemaker_initrc_exec_t,s0) + +/usr/lib/systemd/system/pacemaker.* -- gen_context(system_u:object_r:pacemaker_unit_file_t,s0) + +/usr/sbin/pacemakerd -- gen_context(system_u:object_r:pacemaker_exec_t,s0) + +/var/lib/heartbeat/crm(/.*)? gen_context(system_u:object_r:pacemaker_var_lib_t,s0) + +/var/lib/pengine(/.*)? gen_context(system_u:object_r:pacemaker_var_lib_t,s0) + +/var/run/crm(/.*)? gen_context(system_u:object_r:pacemaker_var_run_t,s0) diff --git a/pacemaker.if b/pacemaker.if new file mode 100644 index 0000000..e05c78f --- /dev/null +++ b/pacemaker.if @@ -0,0 +1,209 @@ + +## policy for pacemaker + +######################################## +## +## Transition to pacemaker. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`pacemaker_domtrans',` + gen_require(` + type pacemaker_t, pacemaker_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, pacemaker_exec_t, pacemaker_t) +') + +######################################## +## +## Execute pacemaker server in the pacemaker domain. +## +## +## +## Domain allowed access. +## +## +# +interface(`pacemaker_initrc_domtrans',` + gen_require(` + type pacemaker_initrc_exec_t; + ') + + init_labeled_script_domtrans($1, pacemaker_initrc_exec_t) +') + +######################################## +## +## Search pacemaker lib directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`pacemaker_search_lib',` + gen_require(` + type pacemaker_var_lib_t; + ') + + allow $1 pacemaker_var_lib_t:dir search_dir_perms; + files_search_var_lib($1) +') + +######################################## +## +## Read pacemaker lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`pacemaker_read_lib_files',` + gen_require(` + type pacemaker_var_lib_t; + ') + + files_search_var_lib($1) + read_files_pattern($1, pacemaker_var_lib_t, pacemaker_var_lib_t) +') + +######################################## +## +## Manage pacemaker lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`pacemaker_manage_lib_files',` + gen_require(` + type pacemaker_var_lib_t; + ') + + files_search_var_lib($1) + manage_files_pattern($1, pacemaker_var_lib_t, pacemaker_var_lib_t) +') + +######################################## +## +## Manage pacemaker lib directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`pacemaker_manage_lib_dirs',` + gen_require(` + type pacemaker_var_lib_t; + ') + + files_search_var_lib($1) + manage_dirs_pattern($1, pacemaker_var_lib_t, pacemaker_var_lib_t) +') + +######################################## +## +## Read pacemaker PID files. +## +## +## +## Domain allowed access. +## +## +# +interface(`pacemaker_read_pid_files',` + gen_require(` + type pacemaker_var_run_t; + ') + + files_search_pids($1) + allow $1 pacemaker_var_run_t:file read_file_perms; +') + +######################################## +## +## Execute pacemaker server in the pacemaker domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`pacemaker_systemctl',` + gen_require(` + type pacemaker_t; + type pacemaker_unit_file_t; + ') + + systemd_exec_systemctl($1) + systemd_read_fifo_file_passwd_run($1) + allow $1 pacemaker_unit_file_t:file read_file_perms; + allow $1 pacemaker_unit_file_t:service manage_service_perms; + + ps_process_pattern($1, pacemaker_t) +') + + +######################################## +## +## All of the rules required to administrate +## an pacemaker environment +## +## +## +## Domain allowed access. +## +## +## +## +## Role allowed access. +## +## +## +# +interface(`pacemaker_admin',` + gen_require(` + type pacemaker_t; + type pacemaker_initrc_exec_t; + type pacemaker_var_lib_t; + type pacemaker_var_run_t; + type pacemaker_unit_file_t; + ') + + allow $1 pacemaker_t:process { ptrace signal_perms }; + ps_process_pattern($1, pacemaker_t) + + pacemaker_initrc_domtrans($1) + domain_system_change_exemption($1) + role_transition $2 pacemaker_initrc_exec_t system_r; + allow $2 system_r; + + files_search_var_lib($1) + admin_pattern($1, pacemaker_var_lib_t) + + files_search_pids($1) + admin_pattern($1, pacemaker_var_run_t) + + pacemaker_systemctl($1) + admin_pattern($1, pacemaker_unit_file_t) + allow $1 pacemaker_unit_file_t:service all_service_perms; + + optional_policy(` + systemd_passwd_agent_exec($1) + systemd_read_fifo_file_passwd_run($1) + ') +') diff --git a/pacemaker.te b/pacemaker.te new file mode 100644 index 0000000..ec7033b --- /dev/null +++ b/pacemaker.te @@ -0,0 +1,51 @@ +policy_module(pacemaker, 1.0.0) + +######################################## +# +# Declarations +# + +type pacemaker_t; +type pacemaker_exec_t; +init_daemon_domain(pacemaker_t, pacemaker_exec_t) + +type pacemaker_initrc_exec_t; +init_script_file(pacemaker_initrc_exec_t) + +type pacemaker_var_lib_t; +files_type(pacemaker_var_lib_t) + +type pacemaker_var_run_t; +files_pid_file(pacemaker_var_run_t) + +type pacemaker_unit_file_t; +systemd_unit_file(pacemaker_unit_file_t) + +######################################## +# +# pacemaker local policy +# +allow pacemaker_t self:capability { chown dac_override setuid }; +allow pacemaker_t self:process { fork setrlimit signal }; +allow pacemaker_t self:fifo_file rw_fifo_file_perms; +allow pacemaker_t self:unix_stream_socket create_stream_socket_perms; + +manage_dirs_pattern(pacemaker_t, pacemaker_var_lib_t, pacemaker_var_lib_t) +manage_files_pattern(pacemaker_t, pacemaker_var_lib_t, pacemaker_var_lib_t) +files_var_lib_filetrans(pacemaker_t, pacemaker_var_lib_t, { dir file }) + +manage_dirs_pattern(pacemaker_t, pacemaker_var_run_t, pacemaker_var_run_t) +manage_files_pattern(pacemaker_t, pacemaker_var_run_t, pacemaker_var_run_t) +files_pid_filetrans(pacemaker_t, pacemaker_var_run_t, { dir file }) + +domain_use_interactive_fds(pacemaker_t) + + +auth_use_nsswitch(pacemaker_t) + +logging_send_syslog_msg(pacemaker_t) + +optional_policy(` + corosync_stream_connect(pacemaker_t) +') + diff --git a/pads.fc b/pads.fc index 0870c56..6d5fb1d 100644 --- a/pads.fc +++ b/pads.fc @@ -1,10 +1,10 @@ /etc/pads-ether-codes -- gen_context(system_u:object_r:pads_config_t, s0) /etc/pads-signature-list -- gen_context(system_u:object_r:pads_config_t, s0) -/etc/pads.conf -- gen_context(system_u:object_r:pads_config_t, s0) +/etc/pads\.conf -- gen_context(system_u:object_r:pads_config_t, s0) /etc/pads-assets.csv -- gen_context(system_u:object_r:pads_config_t, s0) /etc/rc\.d/init\.d/pads -- gen_context(system_u:object_r:pads_initrc_exec_t, s0) /usr/bin/pads -- gen_context(system_u:object_r:pads_exec_t, s0) -/var/run/pads.pid -- gen_context(system_u:object_r:pads_var_run_t, s0) +/var/run/pads\.pid -- gen_context(system_u:object_r:pads_var_run_t, s0) diff --git a/pads.if b/pads.if index 8ac407e..45673ad 100644 --- a/pads.if +++ b/pads.if @@ -25,20 +25,26 @@ ## ## # -interface(`pads_admin', ` +interface(`pads_admin',` gen_require(` - type pads_t, pads_config_t; - type pads_var_run_t, pads_initrc_exec_t; + type pads_t, pads_config_t, pads_initrc_exec_t; + type pads_var_run_t; ') - allow $1 pads_t:process { ptrace signal_perms }; + allow $1 pads_t:process signal_perms; ps_process_pattern($1, pads_t) + tunable_policy(`deny_ptrace',`',` + allow $1 pads_t:process ptrace; + ') init_labeled_script_domtrans($1, pads_initrc_exec_t) domain_system_change_exemption($1) role_transition $2 pads_initrc_exec_t system_r; allow $2 system_r; + files_list_pids($1) admin_pattern($1, pads_var_run_t) + + files_list_etc($1) admin_pattern($1, pads_config_t) ') diff --git a/pads.te b/pads.te index b246bdd..3cbcc49 100644 --- a/pads.te +++ b/pads.te @@ -25,10 +25,11 @@ files_pid_file(pads_var_run_t) # allow pads_t self:capability { dac_override net_raw }; -allow pads_t self:netlink_route_socket { write getattr read bind create nlmsg_read }; -allow pads_t self:packet_socket { ioctl setopt getopt read bind create }; -allow pads_t self:udp_socket { create ioctl }; -allow pads_t self:unix_dgram_socket { write create connect }; +allow pads_t self:netlink_route_socket create_netlink_socket_perms; +allow pads_t self:packet_socket create_socket_perms; +allow pads_t self:socket create_socket_perms; +allow pads_t self:udp_socket create_socket_perms; +allow pads_t self:unix_dgram_socket create_socket_perms; allow pads_t pads_config_t:file manage_file_perms; files_etc_filetrans(pads_t, pads_config_t, file) @@ -37,10 +38,10 @@ allow pads_t pads_var_run_t:file manage_file_perms; files_pid_filetrans(pads_t, pads_var_run_t, file) kernel_read_sysctl(pads_t) +kernel_read_network_state(pads_t) corecmd_search_bin(pads_t) -corenet_all_recvfrom_unlabeled(pads_t) corenet_all_recvfrom_netlabel(pads_t) corenet_tcp_sendrecv_generic_if(pads_t) corenet_tcp_sendrecv_generic_node(pads_t) @@ -48,12 +49,11 @@ corenet_tcp_connect_prelude_port(pads_t) dev_read_rand(pads_t) dev_read_urand(pads_t) +dev_read_sysfs(pads_t) files_read_etc_files(pads_t) files_search_spool(pads_t) -miscfiles_read_localization(pads_t) - logging_send_syslog_msg(pads_t) sysnet_dns_name_resolve(pads_t) diff --git a/passenger.fc b/passenger.fc index 545518d..1f3251d 100644 --- a/passenger.fc +++ b/passenger.fc @@ -1,7 +1,7 @@ -/usr/lib/ruby/gems/.*/passenger-.*/ext/apache2/ApplicationPoolServerExecutable -- gen_context(system_u:object_r:passenger_exec_t,s0) -/usr/lib/ruby/gems/.*/passenger-.*/agents/PassengerWatchdog -- gen_context(system_u:object_r:passenger_exec_t,s0) -/usr/lib/ruby/gems/.*/passenger-.*/agents/PassengerLoggingAgent -- gen_context(system_u:object_r:passenger_exec_t,s0) -/usr/lib/ruby/gems/.*/passenger-.*/agents/apache2/PassengerHelperAgent -- gen_context(system_u:object_r:passenger_exec_t,s0) +/usr/.*/gems/.*/passenger-.*/ext/apache2/ApplicationPoolServerExecutable -- gen_context(system_u:object_r:passenger_exec_t,s0) +/usr/.*/gems/.*/passenger-.*/agents/PassengerWatchdog -- gen_context(system_u:object_r:passenger_exec_t,s0) +/usr/.*/gems/.*/passenger-.*/agents/PassengerLoggingAgent -- gen_context(system_u:object_r:passenger_exec_t,s0) +/usr/.*/gems/.*/passenger-.*/agents/apache2/PassengerHelperAgent -- gen_context(system_u:object_r:passenger_exec_t,s0) /var/lib/passenger(/.*)? gen_context(system_u:object_r:passenger_var_lib_t,s0) diff --git a/passenger.if b/passenger.if index f68b573..8fb9cd3 100644 --- a/passenger.if +++ b/passenger.if @@ -18,6 +18,24 @@ interface(`passenger_domtrans',` domtrans_pattern($1, passenger_exec_t, passenger_t) ') +###################################### +## +## Execute passenger in the current domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`passenger_exec',` + gen_require(` + type passenger_exec_t; + ') + + can_exec($1, passenger_exec_t) +') + ######################################## ## ## Read passenger lib files @@ -37,3 +55,84 @@ interface(`passenger_read_lib_files',` read_lnk_files_pattern($1, passenger_var_lib_t, passenger_var_lib_t) files_search_var_lib($1) ') + +######################################## +## +## Manage passenger lib files +## +## +## +## Domain allowed access. +## +## +# +interface(`passenger_manage_lib_files',` + gen_require(` + type passenger_var_lib_t; + ') + + manage_dirs_pattern($1, passenger_var_lib_t, passenger_var_lib_t) + manage_files_pattern($1, passenger_var_lib_t, passenger_var_lib_t) + manage_lnk_files_pattern($1, passenger_var_lib_t, passenger_var_lib_t) + files_search_var_lib($1) +') + +##################################### +## +## Manage passenger var_run content. +## +## +## +## Domain allowed access. +## +## +# +interface(`passenger_manage_pid_content',` + gen_require(` + type passenger_var_run_t; + ') + + files_search_pids($1) + manage_dirs_pattern($1, passenger_var_run_t, passenger_var_run_t) + manage_files_pattern($1, passenger_var_run_t, passenger_var_run_t) + manage_fifo_files_pattern($1, passenger_var_run_t, passenger_var_run_t) + manage_sock_files_pattern($1, passenger_var_run_t, passenger_var_run_t) +') + +######################################## +## +## Connect to passenger unix stream socket. +## +## +## +## Domain allowed access. +## +## +# +interface(`passenger_stream_connect',` + gen_require(` + type passenger_t; + ') + + allow $1 passenger_t:unix_stream_socket connectto; +') + +####################################### +## +## Allow to manage passenger tmp files/dirs. +## +## +## +## Domain allowed access. +## +## +# +interface(`passenger_manage_tmp_files',` + gen_require(` + type passenger_tmp_t; + ') + + files_search_tmp($1) + manage_files_pattern($1, passenger_tmp_t, passenger_tmp_t) + manage_dirs_pattern($1, passenger_tmp_t, passenger_tmp_t) +') diff --git a/passenger.te b/passenger.te index 3470036..0db4e5b 100644 --- a/passenger.te +++ b/passenger.te @@ -28,7 +28,7 @@ files_pid_file(passenger_var_run_t) # passanger local policy # -allow passenger_t self:capability { chown dac_override fsetid fowner kill setuid setgid sys_nice }; +allow passenger_t self:capability { chown dac_override fsetid fowner kill setuid setgid sys_nice sys_ptrace sys_resource }; allow passenger_t self:process { setpgid setsched sigkill signal }; allow passenger_t self:fifo_file rw_fifo_file_perms; allow passenger_t self:unix_stream_socket { create_stream_socket_perms connectto }; @@ -49,11 +49,16 @@ manage_fifo_files_pattern(passenger_t, passenger_var_run_t, passenger_var_run_t) manage_sock_files_pattern(passenger_t, passenger_var_run_t, passenger_var_run_t) files_pid_filetrans(passenger_t, passenger_var_run_t, { file dir sock_file }) +#needed by puppet +manage_dirs_pattern(passenger_t, passenger_tmp_t, passenger_tmp_t) +manage_files_pattern(passenger_t, passenger_tmp_t, passenger_tmp_t) +manage_sock_files_pattern(passenger_t, passenger_tmp_t, passenger_tmp_t) +files_tmp_filetrans(passenger_t, passenger_tmp_t, { file dir sock_file }) + kernel_read_system_state(passenger_t) kernel_read_kernel_sysctls(passenger_t) corenet_all_recvfrom_netlabel(passenger_t) -corenet_all_recvfrom_unlabeled(passenger_t) corenet_tcp_sendrecv_generic_if(passenger_t) corenet_tcp_sendrecv_generic_node(passenger_t) corenet_tcp_connect_http_port(passenger_t) @@ -63,11 +68,13 @@ corecmd_exec_shell(passenger_t) dev_read_urand(passenger_t) -files_read_etc_files(passenger_t) +domain_read_all_domains_state(passenger_t) + +files_read_usr_files(passenger_t) auth_use_nsswitch(passenger_t) -miscfiles_read_localization(passenger_t) +logging_send_syslog_msg(passenger_t) userdom_dontaudit_use_user_terminals(passenger_t) @@ -75,3 +82,23 @@ optional_policy(` apache_append_log(passenger_t) apache_read_sys_content(passenger_t) ') + +optional_policy(` + hostname_exec(passenger_t) +') + +optional_policy(` + mta_send_mail(passenger_t) +') + +optional_policy(` + puppet_manage_lib(passenger_t) + puppet_read_config(passenger_t) + puppet_read_log(passenger_t) + puppet_search_pid(passenger_t) +') + +optional_policy(` + rpm_exec(passenger_t) + rpm_read_db(passenger_t) +') diff --git a/pcmcia.fc b/pcmcia.fc index 9cf0e56..2b5260a 100644 --- a/pcmcia.fc +++ b/pcmcia.fc @@ -4,6 +4,9 @@ /sbin/cardctl -- gen_context(system_u:object_r:cardctl_exec_t,s0) /sbin/cardmgr -- gen_context(system_u:object_r:cardmgr_exec_t,s0) +/usr/sbin/cardctl -- gen_context(system_u:object_r:cardctl_exec_t,s0) +/usr/sbin/cardmgr -- gen_context(system_u:object_r:cardmgr_exec_t,s0) + /var/lib/pcmcia(/.*)? gen_context(system_u:object_r:cardmgr_var_run_t,s0) /var/run/cardmgr\.pid -- gen_context(system_u:object_r:cardmgr_var_run_t,s0) diff --git a/pcmcia.te b/pcmcia.te index 4d06ae3..62e6362 100644 --- a/pcmcia.te +++ b/pcmcia.te @@ -62,9 +62,7 @@ dev_read_urand(cardmgr_t) domain_use_interactive_fds(cardmgr_t) # Read /proc/PID directories for all domains (for fuser). -domain_read_confined_domains_state(cardmgr_t) -domain_getattr_confined_domains(cardmgr_t) -domain_dontaudit_ptrace_confined_domains(cardmgr_t) +domain_read_all_domains_state(cardmgr_t) # cjp: these look excessive: domain_dontaudit_getattr_all_pipes(cardmgr_t) domain_dontaudit_getattr_all_sockets(cardmgr_t) @@ -96,8 +94,6 @@ libs_exec_lib_files(cardmgr_t) logging_send_syslog_msg(cardmgr_t) -miscfiles_read_localization(cardmgr_t) - modutils_domtrans_insmod(cardmgr_t) sysnet_domtrans_ifconfig(cardmgr_t) @@ -105,7 +101,7 @@ sysnet_domtrans_ifconfig(cardmgr_t) sysnet_etc_filetrans_config(cardmgr_t) sysnet_manage_config(cardmgr_t) -userdom_use_user_terminals(cardmgr_t) +userdom_use_inherited_user_terminals(cardmgr_t) userdom_dontaudit_use_unpriv_user_fds(cardmgr_t) userdom_dontaudit_search_user_home_dirs(cardmgr_t) diff --git a/pcscd.fc b/pcscd.fc index 87f17e8..63ee18a 100644 --- a/pcscd.fc +++ b/pcscd.fc @@ -1,4 +1,5 @@ /var/run/pcscd\.comm -s gen_context(system_u:object_r:pcscd_var_run_t,s0) +/var/run/pcscd(/.*)? gen_context(system_u:object_r:pcscd_var_run_t,s0) /var/run/pcscd\.pid -- gen_context(system_u:object_r:pcscd_var_run_t,s0) /var/run/pcscd\.pub -- gen_context(system_u:object_r:pcscd_var_run_t,s0) /var/run/pcscd\.events(/.*)? gen_context(system_u:object_r:pcscd_var_run_t,s0) diff --git a/pcscd.if b/pcscd.if index 1c2a091..3ead3cc 100644 --- a/pcscd.if +++ b/pcscd.if @@ -34,7 +34,7 @@ interface(`pcscd_read_pub_files',` ') files_search_pids($1) - allow $1 pcscd_var_run_t:file read_file_perms; + read_files_pattern($1, pcscd_var_run_t, pcscd_var_run_t) ') ######################################## diff --git a/pcscd.te b/pcscd.te index ceafba6..47b690d 100644 --- a/pcscd.te +++ b/pcscd.te @@ -25,6 +25,7 @@ allow pcscd_t self:fifo_file rw_fifo_file_perms; allow pcscd_t self:unix_stream_socket create_stream_socket_perms; allow pcscd_t self:unix_dgram_socket create_socket_perms; allow pcscd_t self:tcp_socket create_stream_socket_perms; +allow pcscd_t self:netlink_kobject_uevent_socket create_socket_perms; manage_dirs_pattern(pcscd_t, pcscd_var_run_t, pcscd_var_run_t) manage_files_pattern(pcscd_t, pcscd_var_run_t, pcscd_var_run_t) @@ -34,7 +35,6 @@ files_pid_filetrans(pcscd_t, pcscd_var_run_t, { file sock_file dir }) kernel_read_system_state(pcscd_t) -corenet_all_recvfrom_unlabeled(pcscd_t) corenet_all_recvfrom_netlabel(pcscd_t) corenet_tcp_sendrecv_generic_if(pcscd_t) corenet_tcp_sendrecv_generic_node(pcscd_t) @@ -56,8 +56,6 @@ locallogin_use_fds(pcscd_t) logging_send_syslog_msg(pcscd_t) -miscfiles_read_localization(pcscd_t) - sysnet_dns_name_resolve(pcscd_t) optional_policy(` @@ -77,3 +75,7 @@ optional_policy(` optional_policy(` rpm_use_script_fds(pcscd_t) ') + +optional_policy(` + udev_read_db(pcscd_t) +') diff --git a/pegasus.te b/pegasus.te index 3185114..a7923bb 100644 --- a/pegasus.te +++ b/pegasus.te @@ -9,6 +9,9 @@ type pegasus_t; type pegasus_exec_t; init_daemon_domain(pegasus_t, pegasus_exec_t) +type pegasus_cache_t; +files_type(pegasus_cache_t) + type pegasus_data_t; files_type(pegasus_data_t) @@ -16,7 +19,7 @@ type pegasus_tmp_t; files_tmp_file(pegasus_tmp_t) type pegasus_conf_t; -files_type(pegasus_conf_t) +files_config_file(pegasus_conf_t) type pegasus_mof_t; files_type(pegasus_mof_t) @@ -29,7 +32,7 @@ files_pid_file(pegasus_var_run_t) # Local policy # -allow pegasus_t self:capability { chown sys_nice setuid setgid dac_override net_bind_service }; +allow pegasus_t self:capability { chown kill ipc_lock sys_nice setuid setgid dac_override net_bind_service }; dontaudit pegasus_t self:capability sys_tty_config; allow pegasus_t self:process signal; allow pegasus_t self:fifo_file rw_fifo_file_perms; @@ -38,9 +41,14 @@ allow pegasus_t self:unix_stream_socket create_stream_socket_perms; allow pegasus_t self:tcp_socket create_stream_socket_perms; allow pegasus_t pegasus_conf_t:dir rw_dir_perms; -allow pegasus_t pegasus_conf_t:file { read_file_perms link unlink }; +allow pegasus_t pegasus_conf_t:file { read_file_perms link delete_file_perms rename_file_perms }; allow pegasus_t pegasus_conf_t:lnk_file read_lnk_file_perms; +manage_dirs_pattern(pegasus_t, pegasus_cache_t, pegasus_cache_t) +manage_files_pattern(pegasus_t, pegasus_cache_t, pegasus_cache_t) +manage_lnk_files_pattern(pegasus_t, pegasus_cache_t, pegasus_cache_t) +files_var_filetrans(pegasus_t, pegasus_cache_t, { dir file lnk_file }) + manage_dirs_pattern(pegasus_t, pegasus_data_t, pegasus_data_t) manage_files_pattern(pegasus_t, pegasus_data_t, pegasus_data_t) manage_lnk_files_pattern(pegasus_t, pegasus_data_t, pegasus_data_t) @@ -56,17 +64,20 @@ manage_dirs_pattern(pegasus_t, pegasus_tmp_t, pegasus_tmp_t) manage_files_pattern(pegasus_t, pegasus_tmp_t, pegasus_tmp_t) files_tmp_filetrans(pegasus_t, pegasus_tmp_t, { file dir }) -allow pegasus_t pegasus_var_run_t:sock_file { create setattr unlink }; +allow pegasus_t pegasus_var_run_t:sock_file { create_sock_file_perms setattr_sock_file_perms delete_sock_file_perms }; +manage_dirs_pattern(pegasus_t, pegasus_var_run_t, pegasus_var_run_t) manage_files_pattern(pegasus_t, pegasus_var_run_t, pegasus_var_run_t) -files_pid_filetrans(pegasus_t, pegasus_var_run_t, file) +files_pid_filetrans(pegasus_t, pegasus_var_run_t, { file dir }) +kernel_read_network_state(pegasus_t) kernel_read_kernel_sysctls(pegasus_t) kernel_read_fs_sysctls(pegasus_t) kernel_read_system_state(pegasus_t) kernel_search_vm_sysctl(pegasus_t) kernel_read_net_sysctls(pegasus_t) +kernel_read_xen_state(pegasus_t) +kernel_write_xen_state(pegasus_t) -corenet_all_recvfrom_unlabeled(pegasus_t) corenet_all_recvfrom_netlabel(pegasus_t) corenet_tcp_sendrecv_generic_if(pegasus_t) corenet_tcp_sendrecv_generic_node(pegasus_t) @@ -95,11 +106,11 @@ files_getattr_all_dirs(pegasus_t) auth_use_nsswitch(pegasus_t) auth_domtrans_chk_passwd(pegasus_t) +auth_read_shadow(pegasus_t) domain_use_interactive_fds(pegasus_t) domain_read_all_domains_state(pegasus_t) -files_read_etc_files(pegasus_t) files_list_var_lib(pegasus_t) files_read_var_lib_files(pegasus_t) files_read_var_lib_symlinks(pegasus_t) @@ -112,8 +123,6 @@ init_stream_connect_script(pegasus_t) logging_send_audit_msgs(pegasus_t) logging_send_syslog_msg(pegasus_t) -miscfiles_read_localization(pegasus_t) - sysnet_read_config(pegasus_t) sysnet_domtrans_ifconfig(pegasus_t) @@ -121,10 +130,30 @@ userdom_dontaudit_use_unpriv_user_fds(pegasus_t) userdom_dontaudit_search_user_home_dirs(pegasus_t) optional_policy(` + hostname_exec(pegasus_t) +') + +optional_policy(` + lldpad_dgram_send(pegasus_t) +') + +optional_policy(` rpm_exec(pegasus_t) ') optional_policy(` + samba_manage_config(pegasus_t) +') + +optional_policy(` + sysnet_domtrans_ifconfig(pegasus_t) +') + +optional_policy(` + ssh_exec(pegasus_t) +') + +optional_policy(` seutil_sigchld_newrole(pegasus_t) seutil_dontaudit_read_config(pegasus_t) ') @@ -136,3 +165,14 @@ optional_policy(` optional_policy(` unconfined_signull(pegasus_t) ') + +optional_policy(` + virt_domtrans(pegasus_t) + virt_stream_connect(pegasus_t) + virt_manage_config(pegasus_t) +') + +optional_policy(` + xen_stream_connect(pegasus_t) + xen_stream_connect_xenstore(pegasus_t) +') diff --git a/perdition.te b/perdition.te index 3636277..05e65ad 100644 --- a/perdition.te +++ b/perdition.te @@ -36,7 +36,6 @@ kernel_read_kernel_sysctls(perdition_t) kernel_list_proc(perdition_t) kernel_read_proc_symlinks(perdition_t) -corenet_all_recvfrom_unlabeled(perdition_t) corenet_all_recvfrom_netlabel(perdition_t) corenet_tcp_sendrecv_generic_if(perdition_t) corenet_udp_sendrecv_generic_if(perdition_t) @@ -59,8 +58,6 @@ files_read_etc_files(perdition_t) logging_send_syslog_msg(perdition_t) -miscfiles_read_localization(perdition_t) - sysnet_read_config(perdition_t) userdom_dontaudit_use_unpriv_user_fds(perdition_t) diff --git a/phpfpm.fc b/phpfpm.fc new file mode 100644 index 0000000..4c64b13 --- /dev/null +++ b/phpfpm.fc @@ -0,0 +1,7 @@ +/usr/lib/systemd/system/php-fpm.service -- gen_context(system_u:object_r:phpfpm_unit_file_t,s0) + +/usr/sbin/php-fpm -- gen_context(system_u:object_r:phpfpm_exec_t,s0) + +/var/log/php-fpm(/.*)? gen_context(system_u:object_r:phpfpm_log_t,s0) + +/var/run/php-fpm(/.*)? gen_context(system_u:object_r:phpfpm_var_run_t,s0) diff --git a/phpfpm.if b/phpfpm.if new file mode 100644 index 0000000..9dcdaa8 --- /dev/null +++ b/phpfpm.if @@ -0,0 +1,168 @@ + +## PHP-FPM (FastCGI Process Manager) is an alternative PHP FastCGI implementation with some additional features useful for sites of any size, especially busier sites. + +######################################## +## +## Execute php-fpm in the phpfpm domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`phpfpm_domtrans',` + gen_require(` + type phpfpm_t, phpfpm_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, phpfpm_exec_t, phpfpm_t) +') + +######################################## +## +## Read phpfpm's log files. +## +## +## +## Domain allowed access. +## +## +## +# +interface(`phpfpm_read_log',` + gen_require(` + type phpfpm_log_t; + ') + + logging_search_logs($1) + read_files_pattern($1, phpfpm_log_t, phpfpm_log_t) +') + +######################################## +## +## Append to phpfpm log files. +## +## +## +## Domain allowed access. +## +## +# +interface(`phpfpm_append_log',` + gen_require(` + type phpfpm_log_t; + ') + + logging_search_logs($1) + append_files_pattern($1, phpfpm_log_t, phpfpm_log_t) +') + +######################################## +## +## Manage phpfpm log files +## +## +## +## Domain allowed access. +## +## +# +interface(`phpfpm_manage_log',` + gen_require(` + type phpfpm_log_t; + ') + + logging_search_logs($1) + manage_dirs_pattern($1, phpfpm_log_t, phpfpm_log_t) + manage_files_pattern($1, phpfpm_log_t, phpfpm_log_t) + manage_lnk_files_pattern($1, phpfpm_log_t, phpfpm_log_t) +') + +######################################## +## +## Read phpfpm PID files. +## +## +## +## Domain allowed access. +## +## +# +interface(`phpfpm_read_pid_files',` + gen_require(` + type phpfpm_var_run_t; + ') + + files_search_pids($1) + allow $1 phpfpm_var_run_t:file read_file_perms; +') + +######################################## +## +## Execute phpfpm server in the phpfpm domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`phpfpm_systemctl',` + gen_require(` + type phpfpm_t; + type phpfpm_unit_file_t; + ') + + systemd_exec_systemctl($1) + allow $1 phpfpm_unit_file_t:file read_file_perms; + allow $1 phpfpm_unit_file_t:service manage_service_perms; + + ps_process_pattern($1, phpfpm_t) +') + + +######################################## +## +## All of the rules required to administrate +## an phpfpm environment +## +## +## +## Domain allowed access. +## +## +## +## +## Role allowed access. +## +## +## +# +interface(`phpfpm_admin',` + gen_require(` + type phpfpm_t; + type phpfpm_log_t; + type phpfpm_var_run_t; + type phpfpm_unit_file_t; + ') + + allow $1 phpfpm_t:process { ptrace signal_perms }; + ps_process_pattern($1, phpfpm_t) + + logging_search_logs($1) + admin_pattern($1, phpfpm_log_t) + + files_search_pids($1) + admin_pattern($1, phpfpm_var_run_t) + + phpfpm_systemctl($1) + admin_pattern($1, phpfpm_unit_file_t) + allow $1 phpfpm_unit_file_t:service all_service_perms; + + optional_policy(` + systemd_passwd_agent_exec($1) + systemd_read_fifo_file_passwd_run($1) + ') +') diff --git a/phpfpm.te b/phpfpm.te new file mode 100644 index 0000000..a27f1e3 --- /dev/null +++ b/phpfpm.te @@ -0,0 +1,52 @@ +policy_module(phpfpm, 1.0.0) + +######################################## +# +# Declarations +# + +type phpfpm_t; +type phpfpm_exec_t; +init_daemon_domain(phpfpm_t, phpfpm_exec_t) + +type phpfpm_log_t; +logging_log_file(phpfpm_log_t) + +type phpfpm_var_run_t; +files_pid_file(phpfpm_var_run_t) + +type phpfpm_unit_file_t; +systemd_unit_file(phpfpm_unit_file_t) + +######################################## +# +# phpfpm local policy +# + +allow phpfpm_t self:capability { chown kill setgid setuid sys_chroot sys_nice }; +allow phpfpm_t self:process { setsched setrlimit signal sigkill }; + +allow phpfpm_t self:fifo_file rw_fifo_file_perms; +allow phpfpm_t self:tcp_socket { accept listen }; +allow phpfpm_t self:unix_stream_socket create_stream_socket_perms; + +manage_dirs_pattern(phpfpm_t, phpfpm_log_t, phpfpm_log_t) +manage_files_pattern(phpfpm_t, phpfpm_log_t, phpfpm_log_t) + +manage_dirs_pattern(phpfpm_t, phpfpm_var_run_t, phpfpm_var_run_t) +manage_files_pattern(phpfpm_t, phpfpm_var_run_t, phpfpm_var_run_t) +files_pid_filetrans(phpfpm_t, phpfpm_var_run_t, dir ) + +kernel_read_kernel_sysctls(phpfpm_t) + +corenet_tcp_bind_generic_port(phpfpm_t) + +domain_use_interactive_fds(phpfpm_t) + +files_read_etc_files(phpfpm_t) + +auth_use_nsswitch(phpfpm_t) + +logging_send_syslog_msg(phpfpm_t) + +sysnet_dns_name_resolve(phpfpm_t) diff --git a/pingd.if b/pingd.if index 8688aae..cf34fc1 100644 --- a/pingd.if +++ b/pingd.if @@ -55,7 +55,6 @@ interface(`pingd_manage_config',` files_search_etc($1) manage_dirs_pattern($1, pingd_etc_t, pingd_etc_t) manage_files_pattern($1, pingd_etc_t, pingd_etc_t) - ') ####################################### @@ -77,12 +76,15 @@ interface(`pingd_manage_config',` # interface(`pingd_admin',` gen_require(` - type pingd_t, pingd_etc_t; - type pingd_initrc_exec_t, pingd_modules_t; + type pingd_t, pingd_etc_t, pingd_modules_t; + type pingd_initrc_exec_t; ') - allow $1 pingd_t:process { ptrace signal_perms }; + allow $1 pingd_t:process signal_perms; ps_process_pattern($1, pingd_t) + tunable_policy(`deny_ptrace',`',` + allow $1 pingd_t:process ptrace; + ') init_labeled_script_domtrans($1, pingd_initrc_exec_t) domain_system_change_exemption($1) diff --git a/pingd.te b/pingd.te index e9cf8a4..c476cf4 100644 --- a/pingd.te +++ b/pingd.te @@ -11,7 +11,7 @@ init_daemon_domain(pingd_t, pingd_exec_t) # type for config type pingd_etc_t; -files_type(pingd_etc_t) +files_config_file(pingd_etc_t) type pingd_initrc_exec_t; init_script_file(pingd_initrc_exec_t) @@ -27,7 +27,7 @@ files_type(pingd_modules_t) allow pingd_t self:capability net_raw; allow pingd_t self:tcp_socket create_stream_socket_perms; -allow pingd_t self:rawip_socket { write read create bind }; +allow pingd_t self:rawip_socket create_socket_perms; read_files_pattern(pingd_t, pingd_etc_t, pingd_etc_t) @@ -43,5 +43,3 @@ auth_use_nsswitch(pingd_t) files_search_usr(pingd_t) logging_send_syslog_msg(pingd_t) - -miscfiles_read_localization(pingd_t) diff --git a/piranha.fc b/piranha.fc new file mode 100644 index 0000000..20ea9f5 --- /dev/null +++ b/piranha.fc @@ -0,0 +1,24 @@ + +/etc/rc\.d/init\.d/pulse -- gen_context(system_u:object_r:piranha_pulse_initrc_exec_t,s0) + +# RHEL6 +#/etc/sysconfig/ha/lvs\.cf -- gen_context(system_u:object_r:piranha_etc_rw_t,s0) + +/etc/piranha/lvs\.cf -- gen_context(system_u:object_r:piranha_etc_rw_t,s0) + +/usr/sbin/fos -- gen_context(system_u:object_r:piranha_fos_exec_t,s0) +/usr/sbin/lvsd -- gen_context(system_u:object_r:piranha_lvs_exec_t,s0) +/usr/sbin/piranha_gui -- gen_context(system_u:object_r:piranha_web_exec_t,s0) +/usr/sbin/pulse -- gen_context(system_u:object_r:piranha_pulse_exec_t,s0) + +/var/lib/luci(/.*)? gen_context(system_u:object_r:piranha_web_data_t,s0) +/var/lib/luci/cert(/.*)? gen_context(system_u:object_r:piranha_web_conf_t,s0) +/var/lib/luci/etc(/.*)? gen_context(system_u:object_r:piranha_web_conf_t,s0) + +/var/log/piranha(/.*)? gen_context(system_u:object_r:piranha_log_t,s0) + +/var/run/fos\.pid -- gen_context(system_u:object_r:piranha_fos_var_run_t,s0) +/var/run/lvs\.pid -- gen_context(system_u:object_r:piranha_lvs_var_run_t,s0) +/var/run/piranha-httpd\.pid -- gen_context(system_u:object_r:piranha_web_var_run_t,s0) +/var/run/pulse\.pid -- gen_context(system_u:object_r:piranha_pulse_var_run_t,s0) + diff --git a/piranha.if b/piranha.if new file mode 100644 index 0000000..21912d4 --- /dev/null +++ b/piranha.if @@ -0,0 +1,177 @@ +## policy for piranha + +####################################### +## +## Creates types and rules for a basic +## cluster init daemon domain. +## +## +## +## Prefix for the domain. +## +## +# +template(`piranha_domain_template',` + gen_require(` + attribute piranha_domain; + ') + + ############################## + # + # piranha_$1_t declarations + # + + type piranha_$1_t, piranha_domain; + type piranha_$1_exec_t; + init_daemon_domain(piranha_$1_t, piranha_$1_exec_t) + + # pid files + type piranha_$1_var_run_t; + files_pid_file(piranha_$1_var_run_t) + + ############################## + # + # piranha_$1_t local policy + # + + manage_files_pattern(piranha_$1_t, piranha_$1_var_run_t, piranha_$1_var_run_t) + manage_dirs_pattern(piranha_$1_t, piranha_$1_var_run_t, piranha_$1_var_run_t) + files_pid_filetrans(piranha_$1_t, piranha_$1_var_run_t, { dir file }) + + auth_use_nsswitch(piranha_$1_t) + + logging_send_syslog_msg(piranha_$1_t) +') + +######################################## +## +## Execute a domain transition to run fos. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`piranha_domtrans_fos',` + gen_require(` + type piranha_fos_t, piranha_fos_exec_t; + ') + + domtrans_pattern($1, piranha_fos_exec_t, piranha_fos_t) +') + +####################################### +## +## Execute a domain transition to run lvsd. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`piranha_domtrans_lvs',` + gen_require(` + type piranha_lvs_t, piranha_lvs_exec_t; + ') + + domtrans_pattern($1, piranha_lvs_exec_t, piranha_lvs_t) +') + +####################################### +## +## Execute a domain transition to run pulse. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`piranha_domtrans_pulse',` + gen_require(` + type piranha_pulse_t, piranha_pulse_exec_t; + ') + + domtrans_pattern($1, piranha_pulse_exec_t, piranha_pulse_t) +') + +####################################### +## +## Execute pulse server in the pulse domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`piranha_pulse_initrc_domtrans',` + gen_require(` + type piranha_pulse_initrc_exec_t; + ') + + init_labeled_script_domtrans($1, piranha_pulse_initrc_exec_t) +') + +######################################## +## +## Allow the specified domain to read piranha's log files. +## +## +## +## Domain allowed access. +## +## +## +# +interface(`piranha_read_log',` + gen_require(` + type piranha_log_t; + ') + + logging_search_logs($1) + read_files_pattern($1, piranha_log_t, piranha_log_t) +') + +######################################## +## +## Allow the specified domain to append +## piranha log files. +## +## +## +## Domain allowed access. +## +## +# +interface(`piranha_append_log',` + gen_require(` + type piranha_log_t; + ') + + logging_search_logs($1) + append_files_pattern($1, piranha_log_t, piranha_log_t) +') + +######################################## +## +## Allow domain to manage piranha log files +## +## +## +## Domain allowed access. +## +## +# +interface(`piranha_manage_log',` + gen_require(` + type piranha_log_t; + ') + + logging_search_logs($1) + manage_dirs_pattern($1, piranha_log_t, piranha_log_t) + manage_files_pattern($1, piranha_log_t, piranha_log_t) + manage_lnk_files_pattern($1, piranha_log_t, piranha_log_t) +') diff --git a/piranha.te b/piranha.te new file mode 100644 index 0000000..1d95b3f --- /dev/null +++ b/piranha.te @@ -0,0 +1,293 @@ +policy_module(piranha, 1.0.0) + +######################################## +# +# Declarations +# + +## +##

+## Allow piranha-lvs domain to connect to the network using TCP. +##

+## +gen_tunable(piranha_lvs_can_network_connect, false) + +attribute piranha_domain; + +piranha_domain_template(fos) + +piranha_domain_template(lvs) + +piranha_domain_template(pulse) + +type piranha_pulse_initrc_exec_t; +init_script_file(piranha_pulse_initrc_exec_t) + +piranha_domain_template(web) + +type piranha_web_tmpfs_t; +files_tmpfs_file(piranha_web_tmpfs_t) + +type piranha_web_conf_t; +files_config_file(piranha_web_conf_t) + +type piranha_web_data_t; +files_type(piranha_web_data_t) + +type piranha_web_tmp_t; +files_tmp_file(piranha_web_tmp_t) + +type piranha_etc_rw_t; +files_config_file(piranha_etc_rw_t) + +type piranha_log_t; +logging_log_file(piranha_log_t) + +####################################### +# +# piranha-fos local policy +# + +kernel_read_kernel_sysctls(piranha_fos_t) + +domain_read_all_domains_state(piranha_fos_t) + +optional_policy(` + consoletype_exec(piranha_fos_t) +') + +# start and stop services +init_domtrans_script(piranha_fos_t) + +######################################## +# +# piranha-gui local policy +# + +allow piranha_web_t self:capability { setuid sys_nice kill setgid }; +allow piranha_web_t self:process { getsched setsched signal signull }; + +allow piranha_web_t self:rawip_socket create_socket_perms; +allow piranha_web_t self:netlink_route_socket r_netlink_socket_perms; +allow piranha_web_t self:sem create_sem_perms; +allow piranha_web_t self:shm create_shm_perms; + +manage_files_pattern(piranha_web_t, piranha_web_data_t, piranha_web_data_t) +manage_dirs_pattern(piranha_web_t, piranha_web_data_t, piranha_web_data_t) +files_var_lib_filetrans(piranha_web_t, piranha_web_data_t, file) + +read_files_pattern(piranha_web_t, piranha_web_conf_t, piranha_web_conf_t) + +rw_files_pattern(piranha_web_t, piranha_etc_rw_t, piranha_etc_rw_t) + +manage_dirs_pattern(piranha_web_t, piranha_log_t, piranha_log_t) +manage_files_pattern(piranha_web_t, piranha_log_t, piranha_log_t) +logging_log_filetrans(piranha_web_t, piranha_log_t, { dir file }) + +can_exec(piranha_web_t, piranha_web_tmp_t) +manage_dirs_pattern(piranha_web_t, piranha_web_tmp_t, piranha_web_tmp_t) +manage_files_pattern(piranha_web_t, piranha_web_tmp_t, piranha_web_tmp_t) +files_tmp_filetrans(piranha_web_t, piranha_web_tmp_t, { file dir }) + +manage_dirs_pattern(piranha_web_t, piranha_web_tmpfs_t, piranha_web_tmpfs_t) +manage_files_pattern(piranha_web_t, piranha_web_tmpfs_t, piranha_web_tmpfs_t) +fs_tmpfs_filetrans(piranha_web_t, piranha_web_tmpfs_t, { dir file }) + +piranha_pulse_initrc_domtrans(piranha_web_t) + +kernel_read_kernel_sysctls(piranha_web_t) + +corenet_tcp_bind_http_cache_port(piranha_web_t) +corenet_tcp_bind_luci_port(piranha_web_t) +corenet_tcp_bind_piranha_port(piranha_web_t) +corenet_tcp_connect_ricci_port(piranha_web_t) + +dev_read_rand(piranha_web_t) +dev_read_urand(piranha_web_t) + +domain_read_all_domains_state(piranha_web_t) + +files_read_usr_files(piranha_web_t) + +optional_policy(` + consoletype_exec(piranha_web_t) +') + +optional_policy(` + apache_read_config(piranha_web_t) + apache_exec_modules(piranha_web_t) + apache_exec(piranha_web_t) +') + +optional_policy(` + gnome_dontaudit_search_config(piranha_web_t) +') + +optional_policy(` + sasl_connect(piranha_web_t) +') + +optional_policy(` + snmp_dontaudit_read_snmp_var_lib_files(piranha_web_t) + snmp_dontaudit_write_snmp_var_lib_files(piranha_web_t) +') + +###################################### +# +# piranha-lvs local policy +# + +# neede by nanny +allow piranha_lvs_t self:capability { net_raw sys_nice }; +allow piranha_lvs_t self:process signal; +allow piranha_lvs_t self:unix_dgram_socket create_socket_perms; +allow piranha_lvs_t self:rawip_socket create_socket_perms; + +kernel_read_kernel_sysctls(piranha_lvs_t) + +# needed by nanny +corenet_tcp_connect_ftp_port(piranha_lvs_t) +corenet_tcp_connect_http_port(piranha_lvs_t) +corenet_tcp_connect_smtp_port(piranha_lvs_t) + +sysnet_dns_name_resolve(piranha_lvs_t) + +# needed by nanny +tunable_policy(`piranha_lvs_can_network_connect',` + corenet_tcp_connect_all_ports(piranha_lvs_t) +') + +# needed by ipvsadm +optional_policy(` + iptables_domtrans(piranha_lvs_t) +') + +####################################### +# +# piranha-pulse local policy +# + +allow piranha_pulse_t self:capability net_admin; + +allow piranha_pulse_t self:packet_socket create_socket_perms; + +# pulse starts fos and lvs daemon +domtrans_pattern(piranha_pulse_t, piranha_fos_exec_t, piranha_fos_t) +allow piranha_pulse_t piranha_fos_t:process signal; + +domtrans_pattern(piranha_pulse_t, piranha_lvs_exec_t, piranha_lvs_t) +allow piranha_pulse_t piranha_lvs_t:process signal; + +kernel_read_kernel_sysctls(piranha_pulse_t) +kernel_read_rpc_sysctls(piranha_pulse_t) +kernel_read_system_state(piranha_pulse_t) +kernel_rw_rpc_sysctls(piranha_pulse_t) +kernel_search_debugfs(piranha_pulse_t) +kernel_search_network_state(piranha_pulse_t) + +corecmd_exec_bin(piranha_pulse_t) +corecmd_exec_shell(piranha_pulse_t) +optional_policy(` + consoletype_exec(piranha_pulse_t) +') + +corenet_udp_bind_apertus_ldp_port(piranha_pulse_t) +corenet_udp_bind_cma_port(piranha_pulse_t) + +domain_read_all_domains_state(piranha_pulse_t) +domain_getattr_all_domains(piranha_pulse_t) + +fs_getattr_all_fs(piranha_pulse_t) + +init_initrc_domain(piranha_pulse_t) + +logging_send_syslog_msg(piranha_pulse_t) + +# various services to failover + +optional_policy(` + apache_domtrans(piranha_pulse_t) + apache_signal(piranha_pulse_t) +') + +optional_policy(` + ftp_domtrans(piranha_pulse_t) + ftp_initrc_domtrans(piranha_pulse_t) + ftp_systemctl(piranha_pulse_t) +') + +optional_policy(` + hostname_exec(piranha_pulse_t) +') + +optional_policy(` + ldap_systemctl(piranha_pulse_t) + ldap_initrc_domtrans(piranha_pulse_t) + ldap_domtrans(piranha_pulse_t) +') + +optional_policy(` + mysql_domtrans_mysql_safe(piranha_pulse_t) + mysql_stream_connect(piranha_pulse_t) +') + +optional_policy(` + netutils_domtrans(piranha_pulse_t) + netutils_domtrans_ping(piranha_pulse_t) +') + +optional_policy(` + postgresql_domtrans(piranha_pulse_t) + postgresql_signal(piranha_pulse_t) +') + +optional_policy(` + samba_initrc_domtrans(piranha_pulse_t) + samba_systemctl(piranha_pulse_t) + samba_domtrans_smbd(piranha_pulse_t) + samba_domtrans_nmbd(piranha_pulse_t) + samba_manage_var_files(piranha_pulse_t) + samba_rw_config(piranha_pulse_t) + samba_signal_smbd(piranha_pulse_t) + samba_signal_nmbd(piranha_pulse_t) +') + +optional_policy(` + sysnet_domtrans_ifconfig(piranha_pulse_t) +') + +optional_policy(` + udev_read_db(piranha_pulse_t) +') + +#################################### +# +# piranha domains common policy +# + +allow piranha_domain self:process signal_perms; +allow piranha_domain self:fifo_file rw_fifo_file_perms; +allow piranha_domain self:tcp_socket create_stream_socket_perms; +allow piranha_domain self:udp_socket create_socket_perms; +allow piranha_domain self:unix_stream_socket create_stream_socket_perms; + +read_files_pattern(piranha_domain, piranha_etc_rw_t, piranha_etc_rw_t) + +kernel_read_system_state(piranha_domain) +kernel_read_network_state(piranha_domain) + +corenet_tcp_sendrecv_generic_if(piranha_domain) +corenet_udp_sendrecv_generic_if(piranha_domain) +corenet_tcp_sendrecv_generic_node(piranha_domain) +corenet_udp_sendrecv_generic_node(piranha_domain) +corenet_tcp_sendrecv_all_ports(piranha_domain) +corenet_udp_sendrecv_all_ports(piranha_domain) +corenet_tcp_bind_generic_node(piranha_domain) +corenet_udp_bind_generic_node(piranha_domain) + +files_read_etc_files(piranha_domain) + +corecmd_exec_bin(piranha_domain) +corecmd_exec_shell(piranha_domain) + +sysnet_read_config(piranha_domain) diff --git a/pkcsslotd.fc b/pkcsslotd.fc new file mode 100644 index 0000000..dd1b8f2 --- /dev/null +++ b/pkcsslotd.fc @@ -0,0 +1,5 @@ +/usr/lib/systemd/system/pkcsslotd.service -- gen_context(system_u:object_r:pkcsslotd_unit_file_t,s0) + +/usr/sbin/pkcsslotd -- gen_context(system_u:object_r:pkcsslotd_exec_t,s0) + +/var/lib/opencryptoki(/.*)? gen_context(system_u:object_r:pkcsslotd_var_lib_t,s0) diff --git a/pkcsslotd.if b/pkcsslotd.if new file mode 100644 index 0000000..db15de4 --- /dev/null +++ b/pkcsslotd.if @@ -0,0 +1,162 @@ + +## policy for pkcsslotd + +######################################## +## +## Transition to pkcsslotd. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`pkcsslotd_domtrans',` + gen_require(` + type pkcsslotd_t, pkcsslotd_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, pkcsslotd_exec_t, pkcsslotd_t) +') + +######################################## +## +## Search pkcsslotd lib directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`pkcsslotd_search_lib',` + gen_require(` + type pkcsslotd_var_lib_t; + ') + + allow $1 pkcsslotd_var_lib_t:dir search_dir_perms; + files_search_var_lib($1) +') + +######################################## +## +## Read pkcsslotd lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`pkcsslotd_read_lib_files',` + gen_require(` + type pkcsslotd_var_lib_t; + ') + + files_search_var_lib($1) + read_files_pattern($1, pkcsslotd_var_lib_t, pkcsslotd_var_lib_t) +') + +######################################## +## +## Manage pkcsslotd lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`pkcsslotd_manage_lib_files',` + gen_require(` + type pkcsslotd_var_lib_t; + ') + + files_search_var_lib($1) + manage_files_pattern($1, pkcsslotd_var_lib_t, pkcsslotd_var_lib_t) +') + +######################################## +## +## Manage pkcsslotd lib directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`pkcsslotd_manage_lib_dirs',` + gen_require(` + type pkcsslotd_var_lib_t; + ') + + files_search_var_lib($1) + manage_dirs_pattern($1, pkcsslotd_var_lib_t, pkcsslotd_var_lib_t) +') + +######################################## +## +## Execute pkcsslotd server in the pkcsslotd domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`pkcsslotd_systemctl',` + gen_require(` + type pkcsslotd_t; + type pkcsslotd_unit_file_t; + ') + + systemd_exec_systemctl($1) + systemd_read_fifo_file_password_run($1) + allow $1 pkcsslotd_unit_file_t:file read_file_perms; + allow $1 pkcsslotd_unit_file_t:service manage_service_perms; + + ps_process_pattern($1, pkcsslotd_t) +') + + +######################################## +## +## All of the rules required to administrate +## an pkcsslotd environment +## +## +## +## Domain allowed access. +## +## +## +## +## Role allowed access. +## +## +## +# +interface(`pkcsslotd_admin',` + gen_require(` + type pkcsslotd_t; + type pkcsslotd_var_lib_t; + type pkcsslotd_unit_file_t; + ') + + allow $1 pkcsslotd_t:process { ptrace signal_perms }; + ps_process_pattern($1, pkcsslotd_t) + + files_search_var_lib($1) + admin_pattern($1, pkcsslotd_var_lib_t) + + pkcsslotd_systemctl($1) + admin_pattern($1, pkcsslotd_unit_file_t) + allow $1 pkcsslotd_unit_file_t:service all_service_perms; + + optional_policy(` + systemd_passwd_agent_exec($1) + systemd_read_fifo_file_passwd_run($1) + ') +') diff --git a/pkcsslotd.te b/pkcsslotd.te new file mode 100644 index 0000000..9ab2c4d --- /dev/null +++ b/pkcsslotd.te @@ -0,0 +1,61 @@ +policy_module(pkcsslotd, 1.0.0) + +######################################## +# +# Declarations +# + +type pkcsslotd_t; +type pkcsslotd_exec_t; +init_daemon_domain(pkcsslotd_t, pkcsslotd_exec_t) + +type pkcsslotd_var_lib_t; +files_type(pkcsslotd_var_lib_t) + +type pkcsslotd_unit_file_t; +systemd_unit_file(pkcsslotd_unit_file_t) + +type pkcsslotd_tmp_t; +files_tmp_file(pkcsslotd_tmp_t) + +type pkcsslotd_tmpfs_t; +files_tmpfs_file(pkcsslotd_tmpfs_t) + +type pkcsslotd_var_run_t; +files_pid_file(pkcsslotd_var_run_t) + +######################################## +# +# pkcsslotd local policy +# + +allow pkcsslotd_t self:capability { kill }; +allow pkcsslotd_t self:process { fork }; + +allow pkcsslotd_t self:fifo_file rw_fifo_file_perms; +allow pkcsslotd_t self:sem create_sem_perms; +allow pkcsslotd_t self:shm create_shm_perms; +allow pkcsslotd_t self:unix_stream_socket create_stream_socket_perms; + +manage_dirs_pattern(pkcsslotd_t, pkcsslotd_tmp_t, pkcsslotd_tmp_t) +manage_files_pattern(pkcsslotd_t, pkcsslotd_tmp_t, pkcsslotd_tmp_t) +files_tmp_filetrans(pkcsslotd_t, pkcsslotd_tmp_t, { file dir }) + +manage_dirs_pattern(pkcsslotd_t, pkcsslotd_tmpfs_t, pkcsslotd_tmpfs_t) +manage_files_pattern(pkcsslotd_t, pkcsslotd_tmpfs_t, pkcsslotd_tmpfs_t) +fs_tmpfs_filetrans(pkcsslotd_t, pkcsslotd_tmpfs_t, { dir file }) + +manage_dirs_pattern(pkcsslotd_t, pkcsslotd_var_lib_t, pkcsslotd_var_lib_t) +manage_files_pattern(pkcsslotd_t, pkcsslotd_var_lib_t, pkcsslotd_var_lib_t) +manage_lnk_files_pattern(pkcsslotd_t, pkcsslotd_var_lib_t, pkcsslotd_var_lib_t) +files_var_lib_filetrans(pkcsslotd_t, pkcsslotd_var_lib_t, { dir file lnk_file }) + +manage_files_pattern(pkcsslotd_t, pkcsslotd_var_run_t, pkcsslotd_var_run_t) +manage_dirs_pattern(pkcsslotd_t, pkcsslotd_var_run_t,pkcsslotd_var_run_t) +files_pid_filetrans(pkcsslotd_t, pkcsslotd_var_run_t, { file dir }) + +domain_use_interactive_fds(pkcsslotd_t) + +files_read_etc_files(pkcsslotd_t) + +logging_send_syslog_msg(pkcsslotd_t) diff --git a/plymouthd.fc b/plymouthd.fc index 5702ca4..498d856 100644 --- a/plymouthd.fc +++ b/plymouthd.fc @@ -2,6 +2,10 @@ /sbin/plymouthd -- gen_context(system_u:object_r:plymouthd_exec_t,s0) +/usr/bin/plymouth -- gen_context(system_u:object_r:plymouth_exec_t,s0) + +/usr/sbin/plymouthd -- gen_context(system_u:object_r:plymouthd_exec_t,s0) + /var/lib/plymouth(/.*)? gen_context(system_u:object_r:plymouthd_var_lib_t,s0) /var/run/plymouth(/.*)? gen_context(system_u:object_r:plymouthd_var_run_t,s0) /var/spool/plymouth(/.*)? gen_context(system_u:object_r:plymouthd_spool_t,s0) diff --git a/plymouthd.if b/plymouthd.if index 9759ed8..17c097d 100644 --- a/plymouthd.if +++ b/plymouthd.if @@ -120,7 +120,7 @@ interface(`plymouthd_search_spool', ` ## ## # -interface(`plymouthd_read_spool_files', ` +interface(`plymouthd_read_spool_files',` gen_require(` type plymouthd_spool_t; ') @@ -228,20 +228,56 @@ interface(`plymouthd_read_pid_files', ` ######################################## ## -## All of the rules required to administrate -## an plymouthd environment +## Allow the specified domain to read +## to plymouthd log files. +## +## +## +## Domain allowed access. +## +## +# +interface(`plymouthd_read_log',` + gen_require(` + type plymouthd_var_log_t; + ') + + logging_search_logs($1) + read_files_pattern($1, plymouthd_var_log_t, plymouthd_var_log_t) +') + +######################################## +## +## Allow the specified domain to manage +## to plymouthd log files. ## ## ## ## Domain allowed access. ## ## -## +# +interface(`plymouthd_manage_log',` + gen_require(` + type plymouthd_var_log_t; + ') + + logging_search_logs($1) + manage_dirs_pattern($1, plymouthd_var_log_t, plymouthd_var_log_t) + manage_files_pattern($1, plymouthd_var_log_t, plymouthd_var_log_t) + read_lnk_files_pattern($1, plymouthd_var_log_t, plymouthd_var_log_t) +') + +######################################## +## +## All of the rules required to administrate +## an plymouthd environment +## +## ## -## Role allowed access. +## Domain allowed access. ## ## -## # interface(`plymouthd_admin', ` gen_require(` @@ -249,12 +285,17 @@ interface(`plymouthd_admin', ` type plymouthd_var_run_t; ') - allow $1 plymouthd_t:process { ptrace signal_perms getattr }; - read_files_pattern($1, plymouthd_t, plymouthd_t) + allow $1 plymouthd_t:process signal_perms; + ps_process_pattern($1, plymouthd_t) + tunable_policy(`deny_ptrace',`',` + allow $1 plymouthd_t:process ptrace; + ') + files_list_var_lib($1) admin_pattern($1, plymouthd_spool_t) admin_pattern($1, plymouthd_var_lib_t) + files_list_pids($1) admin_pattern($1, plymouthd_var_run_t) ') diff --git a/plymouthd.te b/plymouthd.te index 86700ed..9f387a9 100644 --- a/plymouthd.te +++ b/plymouthd.te @@ -1,4 +1,4 @@ -policy_module(plymouthd, 1.1.0) +policy_module(plymouthd, 1.0.1) ######################################## # @@ -8,17 +8,21 @@ policy_module(plymouthd, 1.1.0) type plymouth_t; type plymouth_exec_t; application_domain(plymouth_t, plymouth_exec_t) +role system_r types plymouth_t; type plymouthd_t; type plymouthd_exec_t; init_daemon_domain(plymouthd_t, plymouthd_exec_t) type plymouthd_spool_t; -files_type(plymouthd_spool_t) +files_spool_file(plymouthd_spool_t) type plymouthd_var_lib_t; files_type(plymouthd_var_lib_t) +type plymouthd_var_log_t; +logging_log_file(plymouthd_var_log_t) + type plymouthd_var_run_t; files_pid_file(plymouthd_var_run_t) @@ -42,6 +46,10 @@ manage_dirs_pattern(plymouthd_t, plymouthd_var_lib_t, plymouthd_var_lib_t) manage_files_pattern(plymouthd_t, plymouthd_var_lib_t, plymouthd_var_lib_t) files_var_lib_filetrans(plymouthd_t, plymouthd_var_lib_t, { file dir }) +manage_dirs_pattern(plymouthd_t, plymouthd_var_log_t, plymouthd_var_log_t) +manage_files_pattern(plymouthd_t, plymouthd_var_log_t, plymouthd_var_log_t) +logging_log_filetrans(plymouthd_t, plymouthd_var_log_t, { file dir }) + manage_dirs_pattern(plymouthd_t, plymouthd_var_run_t, plymouthd_var_run_t) manage_files_pattern(plymouthd_t, plymouthd_var_run_t, plymouthd_var_run_t) files_pid_filetrans(plymouthd_t, plymouthd_var_run_t, { file dir }) @@ -57,13 +65,38 @@ dev_write_framebuffer(plymouthd_t) domain_use_interactive_fds(plymouthd_t) +fs_getattr_all_fs(plymouthd_t) + files_read_etc_files(plymouthd_t) files_read_usr_files(plymouthd_t) -miscfiles_read_localization(plymouthd_t) +term_getattr_pty_fs(plymouthd_t) +term_use_all_terms(plymouthd_t) +term_use_ptmx(plymouthd_t) + +init_signal(plymouthd_t) + +logging_link_generic_logs(plymouthd_t) +logging_delete_generic_logs(plymouthd_t) + +auth_read_passwd(plymouthd_t) + miscfiles_read_fonts(plymouthd_t) miscfiles_manage_fonts_cache(plymouthd_t) +userdom_read_admin_home_files(plymouthd_t) + +optional_policy(` + sssd_stream_connect(plymouthd_t) +') + +optional_policy(` + xserver_xdm_manage_spool(plymouthd_t) + xserver_read_state_xdm(plymouthd_t) +') + +term_use_unallocated_ttys(plymouthd_t) + ######################################## # # Plymouth private policy @@ -74,6 +107,7 @@ allow plymouth_t self:fifo_file rw_file_perms; allow plymouth_t self:unix_stream_socket create_stream_socket_perms; kernel_read_system_state(plymouth_t) +kernel_stream_connect(plymouth_t) domain_use_interactive_fds(plymouth_t) @@ -81,7 +115,6 @@ files_read_etc_files(plymouth_t) term_use_ptmx(plymouth_t) -miscfiles_read_localization(plymouth_t) sysnet_read_config(plymouth_t) diff --git a/podsleuth.te b/podsleuth.te index 4cffb07..4170218 100644 --- a/podsleuth.te +++ b/podsleuth.te @@ -25,7 +25,8 @@ userdom_user_tmpfs_file(podsleuth_tmpfs_t) # podsleuth local policy # allow podsleuth_t self:capability { kill dac_override sys_admin sys_rawio }; -allow podsleuth_t self:process { ptrace signal signull getsched execheap execmem execstack }; +allow podsleuth_t self:process { signal signull getsched execheap execmem execstack }; + allow podsleuth_t self:fifo_file rw_file_perms; allow podsleuth_t self:unix_stream_socket create_stream_socket_perms; allow podsleuth_t self:sem create_sem_perms; @@ -66,7 +67,6 @@ fs_getattr_tmpfs(podsleuth_t) fs_list_tmpfs(podsleuth_t) fs_rw_removable_blk_files(podsleuth_t) -miscfiles_read_localization(podsleuth_t) sysnet_dns_name_resolve(podsleuth_t) diff --git a/policykit.fc b/policykit.fc index 63d0061..4718a93 100644 --- a/policykit.fc +++ b/policykit.fc @@ -1,16 +1,20 @@ /usr/lib/policykit/polkit-read-auth-helper -- gen_context(system_u:object_r:policykit_auth_exec_t,s0) -/usr/lib/policykit/polkit-grant-helper.* -- gen_context(system_u:object_r:policykit_grant_exec_t,s0) +/usr/lib/policykit/polkit-grant-helper.* -- gen_context(system_u:object_r:policykit_grant_exec_t,s0) /usr/lib/policykit/polkit-resolve-exe-helper.* -- gen_context(system_u:object_r:policykit_resolve_exec_t,s0) /usr/lib/policykit/polkitd -- gen_context(system_u:object_r:policykit_exec_t,s0) -/usr/lib/policykit-1/polkitd -- gen_context(system_u:object_r:policykit_exec_t,s0) +/usr/lib/polkit-1/polkitd -- gen_context(system_u:object_r:policykit_exec_t,s0) /usr/libexec/polkit-read-auth-helper -- gen_context(system_u:object_r:policykit_auth_exec_t,s0) /usr/libexec/polkit-grant-helper.* -- gen_context(system_u:object_r:policykit_grant_exec_t,s0) /usr/libexec/polkit-resolve-exe-helper.* -- gen_context(system_u:object_r:policykit_resolve_exec_t,s0) -/usr/libexec/polkitd -- gen_context(system_u:object_r:policykit_exec_t,s0) +/usr/libexec/polkitd.* -- gen_context(system_u:object_r:policykit_exec_t,s0) +/usr/libexec/polkit-1/polkit-agent-helper-1 -- gen_context(system_u:object_r:policykit_auth_exec_t,s0) +/usr/lib/polkit-1/polkit-agent-helper-1 -- gen_context(system_u:object_r:policykit_auth_exec_t,s0) +/usr/libexec/polkit-1/polkitd.* -- gen_context(system_u:object_r:policykit_exec_t,s0) /var/lib/misc/PolicyKit.reload gen_context(system_u:object_r:policykit_reload_t,s0) /var/lib/PolicyKit(/.*)? gen_context(system_u:object_r:policykit_var_lib_t,s0) +/var/lib/polkit-1(/.*)? gen_context(system_u:object_r:policykit_var_lib_t,s0) /var/lib/PolicyKit-public(/.*)? gen_context(system_u:object_r:policykit_var_lib_t,s0) /var/run/PolicyKit(/.*)? gen_context(system_u:object_r:policykit_var_run_t,s0) diff --git a/policykit.if b/policykit.if index 48ff1e8..be00a65 100644 --- a/policykit.if +++ b/policykit.if @@ -17,18 +17,43 @@ interface(`policykit_dbus_chat',` class dbus send_msg; ') + ps_process_pattern(policykit_t, $1) + allow $1 policykit_t:dbus send_msg; allow policykit_t $1:dbus send_msg; ') ######################################## ## -## Execute a domain transition to run polkit_auth. +## Send and receive messages from +## policykit over dbus. ## ## +## +## Domain allowed access. +## +## +# +interface(`policykit_dbus_chat_auth',` + gen_require(` + type policykit_auth_t; + class dbus send_msg; + ') + + ps_process_pattern(policykit_auth_t, $1) + + allow $1 policykit_auth_t:dbus send_msg; + allow policykit_auth_t $1:dbus send_msg; +') + +######################################## ## -## Domain allowed to transition. +## Execute a domain transition to run polkit_auth. ## +## +## +## Domain allowed to transition. +## ## # interface(`policykit_domtrans_auth',` @@ -54,6 +79,7 @@ interface(`policykit_domtrans_auth',` ## Role allowed access. ## ## +## # interface(`policykit_run_auth',` gen_require(` @@ -62,6 +88,9 @@ interface(`policykit_run_auth',` policykit_domtrans_auth($1) role $2 types policykit_auth_t; + + allow $1 policykit_auth_t:process signal; + ps_process_pattern(policykit_auth_t, $1) ') ######################################## @@ -69,9 +98,9 @@ interface(`policykit_run_auth',` ## Execute a domain transition to run polkit_grant. ## ## -## +## ## Domain allowed to transition. -## +## ## # interface(`policykit_domtrans_grant',` @@ -155,9 +184,9 @@ interface(`policykit_rw_reload',` ## Execute a domain transition to run polkit_resolve. ## ## -## +## ## Domain allowed to transition. -## +## ## # interface(`policykit_domtrans_resolve',` @@ -206,4 +235,50 @@ interface(`policykit_read_lib',` files_search_var_lib($1) read_files_pattern($1, policykit_var_lib_t, policykit_var_lib_t) + + optional_policy(` + # Broken placement + cron_read_system_job_lib_files($1) + ') +') + +####################################### +## +## The per role template for the policykit module. +## +## +## +## Role allowed access +## +## +## +## +## User domain for the role +## +## +# +template(`policykit_role',` + policykit_run_auth($2, $1) + policykit_run_grant($2, $1) + policykit_read_lib($2) + policykit_read_reload($2) + policykit_dbus_chat($2) +') + +######################################## +## +## Send generic signal to policy_auth +## +## +## +## Domain allowed to transition. +## +## +# +interface(`policykit_signal_auth',` + gen_require(` + type policykit_auth_t; + ') + + allow $1 policykit_auth_t:process signal; ') diff --git a/policykit.te b/policykit.te index 44db896..ced9fab 100644 --- a/policykit.te +++ b/policykit.te @@ -1,51 +1,67 @@ -policy_module(policykit, 1.2.0) +policy_module(policykit, 1.1.0) ######################################## # # Declarations # -type policykit_t alias polkit_t; -type policykit_exec_t alias polkit_exec_t; +attribute policykit_domain; + +type policykit_t, policykit_domain; +type policykit_exec_t; init_daemon_domain(policykit_t, policykit_exec_t) -type policykit_auth_t alias polkit_auth_t; -type policykit_auth_exec_t alias polkit_auth_exec_t; +type policykit_auth_t, policykit_domain; +type policykit_auth_exec_t; init_daemon_domain(policykit_auth_t, policykit_auth_exec_t) -type policykit_grant_t alias polkit_grant_t; -type policykit_grant_exec_t alias polkit_grant_exec_t; +type policykit_grant_t, policykit_domain; +type policykit_grant_exec_t; init_system_domain(policykit_grant_t, policykit_grant_exec_t) -type policykit_resolve_t alias polkit_resolve_t; -type policykit_resolve_exec_t alias polkit_resolve_exec_t; +type policykit_resolve_t, policykit_domain; +type policykit_resolve_exec_t; init_system_domain(policykit_resolve_t, policykit_resolve_exec_t) type policykit_reload_t alias polkit_reload_t; files_type(policykit_reload_t) +type policykit_tmp_t; +files_tmp_file(policykit_tmp_t) + type policykit_var_lib_t alias polkit_var_lib_t; files_type(policykit_var_lib_t) type policykit_var_run_t alias polkit_var_run_t; files_pid_file(policykit_var_run_t) +####################################### +# +# policykit_domain local policy +# + +allow policykit_domain self:process { execmem getattr }; +allow policykit_domain self:fifo_file rw_fifo_file_perms; + +dev_read_sysfs(policykit_domain) + ######################################## # # policykit local policy # -allow policykit_t self:capability { setgid setuid }; -allow policykit_t self:process getattr; -allow policykit_t self:fifo_file rw_file_perms; +allow policykit_t self:capability { dac_override dac_read_search setgid setuid sys_nice sys_ptrace }; +allow policykit_t self:process { getsched setsched signal }; allow policykit_t self:unix_dgram_socket create_socket_perms; -allow policykit_t self:unix_stream_socket create_stream_socket_perms; +allow policykit_t self:unix_stream_socket { create_stream_socket_perms connectto }; policykit_domtrans_auth(policykit_t) can_exec(policykit_t, policykit_exec_t) corecmd_exec_bin(policykit_t) +dev_read_sysfs(policykit_t) + rw_files_pattern(policykit_t, policykit_reload_t, policykit_reload_t) policykit_domtrans_resolve(policykit_t) @@ -56,56 +72,115 @@ manage_dirs_pattern(policykit_t, policykit_var_run_t, policykit_var_run_t) manage_files_pattern(policykit_t, policykit_var_run_t, policykit_var_run_t) files_pid_filetrans(policykit_t, policykit_var_run_t, { file dir }) +kernel_read_system_state(policykit_t) kernel_read_kernel_sysctls(policykit_t) -files_read_etc_files(policykit_t) +domain_read_all_domains_state(policykit_t) + files_read_usr_files(policykit_t) +files_dontaudit_search_all_mountpoints(policykit_t) + +fs_list_inotifyfs(policykit_t) auth_use_nsswitch(policykit_t) logging_send_syslog_msg(policykit_t) -miscfiles_read_localization(policykit_t) - +userdom_getattr_all_users(policykit_t) userdom_read_all_users_state(policykit_t) +userdom_dontaudit_search_admin_dir(policykit_t) + +optional_policy(` + dbus_system_domain(policykit_t, policykit_exec_t) + + init_dbus_chat(policykit_t) + + optional_policy(` + consolekit_dbus_chat(policykit_t) + ') + + optional_policy(` + rpm_dbus_chat(policykit_t) + ') +') + +optional_policy(` + consolekit_list_pid_files(policykit_t) + consolekit_read_pid_files(policykit_t) +') + +optional_policy(` + kerberos_tmp_filetrans_host_rcache(policykit_t, "host_0") + kerberos_manage_host_rcache(policykit_t) +') + +optional_policy(` + gnome_read_config(policykit_t) +') + +optional_policy(` + systemd_read_logind_sessions_files(policykit_t) + systemd_login_list_pid_dirs(policykit_t) + systemd_login_read_pid_files(policykit_t) +') ######################################## # # polkit_auth local policy # -allow policykit_auth_t self:capability setgid; -allow policykit_auth_t self:process getattr; -allow policykit_auth_t self:fifo_file rw_file_perms; +allow policykit_auth_t self:capability { ipc_lock setgid setuid }; +dontaudit policykit_auth_t self:capability sys_tty_config; +allow policykit_auth_t self:process { getsched signal }; + allow policykit_auth_t self:unix_dgram_socket create_socket_perms; allow policykit_auth_t self:unix_stream_socket create_stream_socket_perms; +policykit_dbus_chat(policykit_auth_t) + +kernel_read_system_state(policykit_auth_t) + can_exec(policykit_auth_t, policykit_auth_exec_t) -corecmd_search_bin(policykit_auth_t) +corecmd_exec_bin(policykit_auth_t) rw_files_pattern(policykit_auth_t, policykit_reload_t, policykit_reload_t) +manage_dirs_pattern(policykit_auth_t, policykit_tmp_t, policykit_tmp_t) +manage_files_pattern(policykit_auth_t, policykit_tmp_t, policykit_tmp_t) +files_tmp_filetrans(policykit_auth_t, policykit_tmp_t, { file dir }) + manage_files_pattern(policykit_auth_t, policykit_var_lib_t, policykit_var_lib_t) manage_dirs_pattern(policykit_auth_t, policykit_var_run_t, policykit_var_run_t) manage_files_pattern(policykit_auth_t, policykit_var_run_t, policykit_var_run_t) files_pid_filetrans(policykit_auth_t, policykit_var_run_t, { file dir }) -kernel_read_system_state(policykit_auth_t) +kernel_dontaudit_search_kernel_sysctl(policykit_auth_t) -files_read_etc_files(policykit_auth_t) +dev_read_video_dev(policykit_auth_t) + +files_read_etc_runtime_files(policykit_auth_t) files_read_usr_files(policykit_auth_t) +files_search_home(policykit_auth_t) + +fs_getattr_all_fs(policykit_auth_t) +fs_search_tmpfs(policykit_auth_t) +auth_rw_var_auth(policykit_auth_t) auth_use_nsswitch(policykit_auth_t) +auth_domtrans_chk_passwd(policykit_auth_t) logging_send_syslog_msg(policykit_auth_t) -miscfiles_read_localization(policykit_auth_t) +miscfiles_read_fonts(policykit_auth_t) +miscfiles_setattr_fonts_cache_dirs(policykit_auth_t) userdom_dontaudit_read_user_home_content_files(policykit_auth_t) +userdom_dontaudit_write_user_tmp_files(policykit_auth_t) +userdom_read_admin_home_files(policykit_auth_t) optional_policy(` - dbus_system_bus_client(policykit_auth_t) + dbus_system_domain( policykit_auth_t, policykit_auth_exec_t) dbus_session_bus_client(policykit_auth_t) optional_policy(` @@ -118,14 +193,26 @@ optional_policy(` hal_read_state(policykit_auth_t) ') +optional_policy(` + kerberos_tmp_filetrans_host_rcache(policykit_auth_t, "host_0") + kerberos_manage_host_rcache(policykit_auth_t) +') + +optional_policy(` + xserver_stream_connect(policykit_auth_t) + xserver_xdm_append_log(policykit_auth_t) + xserver_read_xdm_pid(policykit_auth_t) + xserver_search_xdm_lib(policykit_auth_t) + xserver_create_xdm_tmp_sockets(policykit_auth_t) +') + ######################################## # # polkit_grant local policy # allow policykit_grant_t self:capability setuid; -allow policykit_grant_t self:process getattr; -allow policykit_grant_t self:fifo_file rw_file_perms; + allow policykit_grant_t self:unix_dgram_socket create_socket_perms; allow policykit_grant_t self:unix_stream_socket create_stream_socket_perms; @@ -142,22 +229,22 @@ manage_files_pattern(policykit_grant_t, policykit_var_run_t, policykit_var_run_t manage_files_pattern(policykit_grant_t, policykit_var_lib_t, policykit_var_lib_t) -files_read_etc_files(policykit_grant_t) files_read_usr_files(policykit_grant_t) -auth_use_nsswitch(policykit_grant_t) auth_domtrans_chk_passwd(policykit_grant_t) +auth_use_nsswitch(policykit_grant_t) logging_send_syslog_msg(policykit_grant_t) -miscfiles_read_localization(policykit_grant_t) - userdom_read_all_users_state(policykit_grant_t) optional_policy(` - dbus_system_bus_client(policykit_grant_t) + cron_manage_system_job_lib_files(policykit_grant_t) +') optional_policy(` + dbus_system_bus_client(policykit_grant_t) + optional_policy(` consolekit_dbus_chat(policykit_grant_t) ') ') @@ -167,9 +254,8 @@ optional_policy(` # polkit_resolve local policy # -allow policykit_resolve_t self:capability { setuid sys_nice sys_ptrace }; -allow policykit_resolve_t self:process getattr; -allow policykit_resolve_t self:fifo_file rw_file_perms; +allow policykit_resolve_t self:capability { setuid sys_nice }; + allow policykit_resolve_t self:unix_dgram_socket create_socket_perms; allow policykit_resolve_t self:unix_stream_socket create_stream_socket_perms; @@ -182,17 +268,12 @@ read_files_pattern(policykit_resolve_t, policykit_var_lib_t, policykit_var_lib_t can_exec(policykit_resolve_t, policykit_resolve_exec_t) corecmd_search_bin(policykit_resolve_t) -files_read_etc_files(policykit_resolve_t) files_read_usr_files(policykit_resolve_t) -mcs_ptrace_all(policykit_resolve_t) - auth_use_nsswitch(policykit_resolve_t) logging_send_syslog_msg(policykit_resolve_t) -miscfiles_read_localization(policykit_resolve_t) - userdom_read_all_users_state(policykit_resolve_t) optional_policy(` diff --git a/polipo.fc b/polipo.fc new file mode 100644 index 0000000..11f77ee --- /dev/null +++ b/polipo.fc @@ -0,0 +1,16 @@ +HOME_DIR/\.polipo -- gen_context(system_u:object_r:polipo_config_home_t,s0) +HOME_DIR/\.polipo-cache(/.*)? gen_context(system_u:object_r:polipo_cache_home_t,s0) + +/etc/polipo(/.*)? gen_context(system_u:object_r:polipo_etc_t,s0) + +/etc/rc\.d/init\.d/polipo -- gen_context(system_u:object_r:polipo_initrc_exec_t,s0) + +/usr/lib/systemd/system/polipo.* -- gen_context(system_u:object_r:polipo_unit_file_t,s0) + +/usr/bin/polipo -- gen_context(system_u:object_r:polipo_exec_t,s0) + +/var/cache/polipo(/.*)? gen_context(system_u:object_r:polipo_cache_t,s0) + +/var/log/polipo.* -- gen_context(system_u:object_r:polipo_log_t,s0) + +/var/run/polipo(/.*)? gen_context(system_u:object_r:polipo_pid_t,s0) diff --git a/polipo.if b/polipo.if new file mode 100644 index 0000000..d00f6ba --- /dev/null +++ b/polipo.if @@ -0,0 +1,219 @@ +## Caching web proxy. + +######################################## +## +## Role access for polipo session. +## +## +## +## Role allowed access. +## +## +## +## +## Domain allowed access. +## +## +# +template(`polipo_role',` + gen_require(` + type polipo_session_t, polipo_exec_t; + ') + + ######################################## + # + # Declarations + # + + role $1 types polipo_session_t; + + ######################################## + # + # Policy + # + + allow $2 polipo_session_t:process signal_perms; + ps_process_pattern($2, polipo_session_t) + tunable_policy(`deny_ptrace',`',` + allow $2 polipo_session_t:process ptrace; + ') + + tunable_policy(`polipo_session_users',` + domtrans_pattern($2, polipo_exec_t, polipo_session_t) + ',` + can_exec($2, polipo_exec_t) + ') +') + +######################################## +## +## Create configuration files in user +## home directories with a named file +## type transition. +## +## +## +## Domain allowed access. +## +## +# +interface(`polipo_named_filetrans_config_home_files',` + gen_require(` + type polipo_config_home_t; + ') + + userdom_user_home_dir_filetrans($1, polipo_config_home_t, file, ".polipo") +') + +######################################## +## +## Create cache directories in user +## home directories with a named file +## type transition. +## +## +## +## Domain allowed access. +## +## +# +interface(`polipo_named_filetrans_cache_home_dirs',` + gen_require(` + type polipo_cache_home_t; + ') + + userdom_user_home_dir_filetrans($1, polipo_cache_home_t, dir, ".polipo-cache") +') + +######################################## +## +## Create configuration files in admin +## home directories with a named file +## type transition. +## +## +## +## Domain allowed access. +## +## +# +interface(`polipo_named_filetrans_admin_config_home_files',` + gen_require(` + type polipo_config_home_t; + ') + + userdom_admin_home_dir_filetrans($1, polipo_config_home_t, file, ".polipo") +') + +######################################## +## +## Create cache directories in admin +## home directories with a named file +## type transition. +## +## +## +## Domain allowed access. +## +## +# +interface(`polipo_named_filetrans_admin_cache_home_dirs',` + gen_require(` + type polipo_cache_home_t; + ') + + userdom_admin_home_dir_filetrans($1, polipo_cache_home_t, dir, ".polipo-cache") +') + +######################################## +## +## Create log files with a named file +## type transition. +## +## +## +## Domain allowed access. +## +## +# +interface(`polipo_named_filetrans_log_files',` + gen_require(` + type polipo_log_t; + ') + + logging_log_named_filetrans($1, polipo_log_t, file, "polipo") +') + +######################################## +## +## Execute polipo server in the polipo domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`polipo_systemctl',` + gen_require(` + type polipo_t; + type polipo_unit_file_t; + ') + + systemd_exec_systemctl($1) + allow $1 polipo_unit_file_t:file read_file_perms; + allow $1 polipo_unit_file_t:service manage_service_perms; + + ps_process_pattern($1, polipo_t) +') + +######################################## +## +## Administrate an polipo environment. +## +## +## +## Domain allowed access. +## +## +## +## +## Role allowed access. +## +## +## +# +interface(`polipo_admin',` + gen_require(` + type polipo_t, polipo_pid_t, polipo_cache_t; + type polipo_etc_t, polipo_log_t, polipo_initrc_exec_t; + type polipo_unit_file_t; + ') + + allow $1 polipo_t:process signal_perms; + ps_process_pattern($1, polipo_t) + tunable_policy(`deny_ptrace',`',` + allow $1 polipo_t:process ptrace; + ') + + init_labeled_script_domtrans($1, polipo_initrc_exec_t) + domain_system_change_exemption($1) + role_transition $2 polipo_initrc_exec_t system_r; + allow $2 system_r; + + files_list_etc($1) + admin_pattern($1, polipo_etc_t) + + logging_list_logs($1) + admin_pattern($1, polipo_log_t) + + files_list_var($1) + admin_pattern($1, polipo_cache_t) + + files_list_pids($1) + admin_pattern($1, polipo_pid_t) + + polipo_systemctl($1) + admin_pattern($1, polipo_unit_file_t) + allow $1 polipo_unit_file_t:service all_service_perms; +') diff --git a/polipo.te b/polipo.te new file mode 100644 index 0000000..a0b37ad --- /dev/null +++ b/polipo.te @@ -0,0 +1,159 @@ +policy_module(polipo, 1.0.0) + +######################################## +# +# Declarations +# + +## +##

+## Determine whether polipo can +## access cifs file systems. +##

+## +gen_tunable(polipo_use_cifs, false) + +## +##

+## Determine whether Polipo can +## access nfs file systems. +##

+## +gen_tunable(polipo_use_nfs, false) + +## +##

+## Determine whether Polipo session daemon +## can bind tcp sockets to all unreserved ports. +##

+## +gen_tunable(polipo_session_bind_all_unreserved_ports, false) + +## +##

+## Determine whether calling user domains +## can execute Polipo daemon in the +## polipo_session_t domain. +##

+## +gen_tunable(polipo_session_users, false) + +## +##

+## Allow polipo to connect to all ports > 1023 +##

+## +gen_tunable(polipo_connect_all_unreserved, false) + +attribute polipo_daemon; + +type polipo_t, polipo_daemon; +type polipo_exec_t; +init_daemon_domain(polipo_t, polipo_exec_t) + +type polipo_initrc_exec_t; +init_script_file(polipo_initrc_exec_t) + +type polipo_etc_t; +files_config_file(polipo_etc_t) + +type polipo_cache_t; +files_type(polipo_cache_t) + +type polipo_log_t; +logging_log_file(polipo_log_t) + +type polipo_pid_t; +files_pid_file(polipo_pid_t) + +type polipo_session_t, polipo_daemon; +application_domain(polipo_session_t, polipo_exec_t) +ubac_constrained(polipo_session_t) + +type polipo_config_home_t; +userdom_user_home_content(polipo_config_home_t) + +type polipo_cache_home_t; +userdom_user_home_content(polipo_cache_home_t) + +type polipo_unit_file_t; +systemd_unit_file(polipo_unit_file_t) + +######################################## +# +# Global local policy +# + +allow polipo_daemon self:fifo_file rw_fifo_file_perms; +allow polipo_daemon self:tcp_socket { listen accept }; + +corenet_tcp_bind_generic_node(polipo_daemon) +corenet_tcp_sendrecv_generic_if(polipo_daemon) +corenet_tcp_sendrecv_generic_node(polipo_daemon) +corenet_tcp_sendrecv_http_cache_port(polipo_daemon) +corenet_tcp_bind_http_cache_port(polipo_daemon) +corenet_sendrecv_http_cache_server_packets(polipo_daemon) +corenet_tcp_connect_http_port(polipo_daemon) + +files_read_usr_files(polipo_daemon) + +fs_search_auto_mountpoints(polipo_daemon) + + +######################################## +# +# Polipo local policy +# + +read_files_pattern(polipo_t, polipo_etc_t, polipo_etc_t) + +manage_files_pattern(polipo_t, polipo_cache_t, polipo_cache_t) +manage_dirs_pattern(polipo_t, polipo_cache_t, polipo_cache_t) +files_var_filetrans(polipo_t, polipo_cache_t, dir) + +manage_files_pattern(polipo_t, polipo_log_t, polipo_log_t) +logging_log_filetrans(polipo_t, polipo_log_t, file) + +manage_files_pattern(polipo_t, polipo_pid_t, polipo_pid_t) +files_pid_filetrans(polipo_t, polipo_pid_t, file) + +auth_use_nsswitch(polipo_t) + +logging_send_syslog_msg(polipo_t) + +optional_policy(` + cron_system_entry(polipo_t, polipo_exec_t) +') + +tunable_policy(`polipo_connect_all_unreserved',` + corenet_tcp_connect_all_unreserved_ports(polipo_t) +') + +tunable_policy(`polipo_use_cifs',` + fs_manage_cifs_files(polipo_t) +') + +tunable_policy(`polipo_use_nfs',` + fs_manage_nfs_files(polipo_t) +') + +######################################## +# +# Polipo session local policy +# + +read_files_pattern(polipo_session_t, polipo_config_home_t, polipo_config_home_t) +manage_files_pattern(polipo_session_t, polipo_cache_home_t, polipo_cache_home_t) + +auth_use_nsswitch(polipo_session_t) + +userdom_use_user_terminals(polipo_session_t) + +tunable_policy(`polipo_session_bind_all_unreserved_ports',` + corenet_tcp_sendrecv_all_ports(polipo_session_t) + corenet_tcp_bind_all_unreserved_ports(polipo_session_t) +') + +logging_send_syslog_msg(polipo_session_t) + +userdom_home_manager(polipo_session_t) diff --git a/portage.fc b/portage.fc index d9b2a90..5b0e6f8 100644 --- a/portage.fc +++ b/portage.fc @@ -25,7 +25,7 @@ /var/db/pkg(/.*)? gen_context(system_u:object_r:portage_db_t,s0) /var/cache/edb(/.*)? gen_context(system_u:object_r:portage_cache_t,s0) /var/log/emerge\.log.* -- gen_context(system_u:object_r:portage_log_t,s0) -/var/log/emerge-fetch.log -- gen_context(system_u:object_r:portage_log_t,s0) +/var/log/emerge-fetch.log.* -- gen_context(system_u:object_r:portage_log_t,s0) /var/log/portage(/.*)? gen_context(system_u:object_r:portage_log_t,s0) /var/lib/layman(/.*)? gen_context(system_u:object_r:portage_ebuild_t,s0) /var/lib/portage(/.*)? gen_context(system_u:object_r:portage_cache_t,s0) diff --git a/portage.if b/portage.if index 08ac5af..9c4aa3c 100644 --- a/portage.if +++ b/portage.if @@ -43,11 +43,15 @@ interface(`portage_domtrans',` # interface(`portage_run',` gen_require(` - attribute_role portage_roles; + type portage_t, portage_fetch_t, portage_sandbox_t; + #attribute_role portage_roles; ') - portage_domtrans($1) - roleattribute $2 portage_roles; + #portage_domtrans($1) + #roleattribute $2 portage_roles; + portage_domtrans($1) + role $2 types { portage_t portage_fetch_t portage_sandbox_t }; + ') ######################################## @@ -139,7 +143,6 @@ interface(`portage_compile_domain',` # really shouldnt need this but some packages test # network access, such as during configure # also distcc--need to reinvestigate confining distcc client - corenet_all_recvfrom_unlabeled($1) corenet_all_recvfrom_netlabel($1) corenet_tcp_sendrecv_generic_if($1) corenet_udp_sendrecv_generic_if($1) diff --git a/portage.te b/portage.te index 630f16f..64fb1f5 100644 --- a/portage.te +++ b/portage.te @@ -12,7 +12,7 @@ policy_module(portage, 1.13.0) ## gen_tunable(portage_use_nfs, false) -attribute_role portage_roles; +#attribute_role portage_roles; type gcc_config_t; type gcc_config_exec_t; @@ -25,7 +25,8 @@ application_domain(portage_t, portage_exec_t) domain_obj_id_change_exemption(portage_t) rsync_entry_type(portage_t) corecmd_shell_entry_type(portage_t) -role portage_roles types portage_t; +#role portage_roles types portage_t; +role system_r types portage_t; # portage compile sandbox domain type portage_sandbox_t; @@ -33,7 +34,8 @@ application_domain(portage_sandbox_t, portage_exec_t) # the shell is the entrypoint if regular sandbox is disabled # portage_exec_t is the entrypoint if regular sandbox is enabled corecmd_shell_entry_type(portage_sandbox_t) -role portage_roles types portage_sandbox_t; +#role portage_roles types portage_sandbox_t; +role system_r types portage_sandbox_t; # portage package fetching domain type portage_fetch_t; @@ -41,7 +43,8 @@ type portage_fetch_exec_t; application_domain(portage_fetch_t, portage_fetch_exec_t) corecmd_shell_entry_type(portage_fetch_t) rsync_entry_type(portage_fetch_t) -role portage_roles types portage_fetch_t; +#role portage_roles types portage_fetch_t; +role system_r types portage_fetch_t; type portage_devpts_t; term_pty(portage_devpts_t) @@ -56,7 +59,7 @@ type portage_db_t; files_type(portage_db_t) type portage_conf_t; -files_type(portage_conf_t) +files_config_file(portage_conf_t) type portage_cache_t; files_type(portage_cache_t) @@ -115,18 +118,19 @@ files_list_all(gcc_config_t) init_dontaudit_read_script_status_files(gcc_config_t) libs_read_lib_files(gcc_config_t) -libs_run_ldconfig(gcc_config_t, portage_roles) +#libs_run_ldconfig(gcc_config_t, portage_roles) +libs_domtrans_ldconfig(gcc_config_t) libs_manage_shared_libs(gcc_config_t) # gcc-config creates a temp dir for the libs libs_manage_lib_dirs(gcc_config_t) logging_send_syslog_msg(gcc_config_t) -miscfiles_read_localization(gcc_config_t) +userdom_use_inherited_user_terminals(gcc_config_t) -userdom_use_user_terminals(gcc_config_t) - -consoletype_exec(gcc_config_t) +optional_policy(` + consoletype_exec(gcc_config_t) +') ifdef(`distro_gentoo',` init_exec_rc(gcc_config_t) @@ -198,33 +202,41 @@ auth_manage_shadow(portage_t) init_exec(portage_t) # run setfiles -r -seutil_run_setfiles(portage_t, portage_roles) +#seutil_run_setfiles(portage_t, portage_roles) # run semodule -seutil_run_semanage(portage_t, portage_roles) +#seutil_run_semanage(portage_t, portage_roles) -portage_run_gcc_config(portage_t, portage_roles) +#portage_run_gcc_config(portage_t, portage_roles) # if sesandbox is disabled, compiling is performed in this domain portage_compile_domain(portage_t) -optional_policy(` - bootloader_run(portage_t, portage_roles) -') +#optional_policy(` +# bootloader_run(portage_t, portage_roles) +#') optional_policy(` cron_system_entry(portage_t, portage_exec_t) cron_system_entry(portage_fetch_t, portage_fetch_exec_t) ') -optional_policy(` - modutils_run_depmod(portage_t, portage_roles) - modutils_run_update_mods(portage_t, portage_roles) +#optional_policy(` +# modutils_run_depmod(portage_t, portage_roles) +# modutils_run_update_mods(portage_t, portage_roles) #dontaudit update_modules_t portage_tmp_t:dir search_dir_perms; ') -optional_policy(` - usermanage_run_groupadd(portage_t, portage_roles) - usermanage_run_useradd(portage_t, portage_roles) -') +#optional_policy(` +# usermanage_run_groupadd(portage_t, portage_roles) +# usermanage_run_useradd(portage_t, portage_roles) +#') + +seutil_domtrans_setfiles(portage_t) +seutil_domtrans_semanage(portage_t) +bootloader_domtrans(portage_t) +modutils_domtrans_depmod(portage_t) +modutils_domtrans_update_mods(portage_t) +usermanage_domtrans_groupadd(portage_t) +usermanage_domtrans_useradd(portage_t) ifdef(`TODO',` # seems to work ok without these @@ -271,7 +283,6 @@ kernel_read_kernel_sysctls(portage_fetch_t) corecmd_exec_bin(portage_fetch_t) corecmd_exec_shell(portage_fetch_t) -corenet_all_recvfrom_unlabeled(portage_fetch_t) corenet_all_recvfrom_netlabel(portage_fetch_t) corenet_tcp_sendrecv_generic_if(portage_fetch_t) corenet_tcp_sendrecv_generic_node(portage_fetch_t) @@ -303,16 +314,13 @@ logging_dontaudit_search_logs(portage_fetch_t) term_search_ptys(portage_fetch_t) -miscfiles_read_localization(portage_fetch_t) sysnet_read_config(portage_fetch_t) sysnet_dns_name_resolve(portage_fetch_t) -userdom_use_user_terminals(portage_fetch_t) +userdom_use_inherited_user_terminals(portage_fetch_t) userdom_dontaudit_read_user_home_content_files(portage_fetch_t) -rsync_exec(portage_fetch_t) - ifdef(`hide_broken_symptoms',` dontaudit portage_fetch_t portage_cache_t:file read; ') @@ -328,6 +336,10 @@ optional_policy(` gpg_exec(portage_fetch_t) ') +optional_policy(` + rsync_exec(portage_fetch_t) +') + ########################################## # # Portage sandbox domain diff --git a/portmap.fc b/portmap.fc index 3cdcd9f..2061efe 100644 --- a/portmap.fc +++ b/portmap.fc @@ -1,6 +1,8 @@ /sbin/portmap -- gen_context(system_u:object_r:portmap_exec_t,s0) +/usr/sbin/portmap -- gen_context(system_u:object_r:portmap_exec_t,s0) + ifdef(`distro_debian',` /sbin/pmap_dump -- gen_context(system_u:object_r:portmap_helper_exec_t,s0) /sbin/pmap_set -- gen_context(system_u:object_r:portmap_helper_exec_t,s0) diff --git a/portmap.te b/portmap.te index c1db652..66590bd 100644 --- a/portmap.te +++ b/portmap.te @@ -43,7 +43,6 @@ files_pid_filetrans(portmap_t, portmap_var_run_t, file) kernel_read_system_state(portmap_t) kernel_read_kernel_sysctls(portmap_t) -corenet_all_recvfrom_unlabeled(portmap_t) corenet_all_recvfrom_netlabel(portmap_t) corenet_tcp_sendrecv_generic_if(portmap_t) corenet_udp_sendrecv_generic_if(portmap_t) @@ -73,12 +72,10 @@ fs_search_auto_mountpoints(portmap_t) domain_use_interactive_fds(portmap_t) -files_read_etc_files(portmap_t) +auth_use_nsswitch(portmap_t) logging_send_syslog_msg(portmap_t) -miscfiles_read_localization(portmap_t) - sysnet_read_config(portmap_t) userdom_dontaudit_use_unpriv_user_fds(portmap_t) @@ -113,7 +110,6 @@ allow portmap_helper_t self:udp_socket create_socket_perms; allow portmap_helper_t portmap_var_run_t:file manage_file_perms; files_pid_filetrans(portmap_helper_t, portmap_var_run_t, file) -corenet_all_recvfrom_unlabeled(portmap_helper_t) corenet_all_recvfrom_netlabel(portmap_helper_t) corenet_tcp_sendrecv_generic_if(portmap_helper_t) corenet_udp_sendrecv_generic_if(portmap_helper_t) @@ -133,7 +129,6 @@ corenet_tcp_connect_all_ports(portmap_helper_t) domain_dontaudit_use_interactive_fds(portmap_helper_t) -files_read_etc_files(portmap_helper_t) files_rw_generic_pids(portmap_helper_t) init_rw_utmp(portmap_helper_t) @@ -142,7 +137,7 @@ logging_send_syslog_msg(portmap_helper_t) sysnet_read_config(portmap_helper_t) -userdom_use_user_terminals(portmap_helper_t) +userdom_use_inherited_user_terminals(portmap_helper_t) userdom_dontaudit_use_all_users_fds(portmap_helper_t) optional_policy(` diff --git a/portreserve.fc b/portreserve.fc index 4313a6f..cc334a3 100644 --- a/portreserve.fc +++ b/portreserve.fc @@ -1,7 +1,10 @@ -/etc/portreserve(/.*)? gen_context(system_u:object_r:portreserve_etc_t,s0) -/etc/rc\.d/init\.d/portreserve -- gen_context(system_u:object_r:portreserve_initrc_exec_t,s0) +/etc/rc\.d/init\.d/portreserve -- gen_context(system_u:object_r:portreserve_initrc_exec_t,s0) + +/etc/portreserve(/.*)? gen_context(system_u:object_r:portreserve_etc_t,s0) /sbin/portreserve -- gen_context(system_u:object_r:portreserve_exec_t,s0) +/usr/sbin/portreserve -- gen_context(system_u:object_r:portreserve_exec_t,s0) + /var/run/portreserve(/.*)? gen_context(system_u:object_r:portreserve_var_run_t,s0) diff --git a/portreserve.if b/portreserve.if index 7719d16..d283895 100644 --- a/portreserve.if +++ b/portreserve.if @@ -104,8 +104,11 @@ interface(`portreserve_admin',` type portreserve_initrc_exec_t; ') - allow $1 portreserve_t:process { ptrace signal_perms }; + allow $1 portreserve_t:process signal_perms; ps_process_pattern($1, portreserve_t) + tunable_policy(`deny_ptrace',`',` + allow $1 portreserve_t:process ptrace; + ') portreserve_initrc_domtrans($1) domain_system_change_exemption($1) diff --git a/portreserve.te b/portreserve.te index 152af92..d67fea5 100644 --- a/portreserve.te +++ b/portreserve.te @@ -13,7 +13,7 @@ type portreserve_initrc_exec_t; init_script_file(portreserve_initrc_exec_t) type portreserve_etc_t; -files_type(portreserve_etc_t) +files_config_file(portreserve_etc_t) type portreserve_var_run_t; files_pid_file(portreserve_var_run_t) @@ -42,7 +42,6 @@ files_pid_filetrans(portreserve_t, portreserve_var_run_t, { file sock_file dir } corecmd_getattr_bin_files(portreserve_t) -corenet_all_recvfrom_unlabeled(portreserve_t) corenet_all_recvfrom_netlabel(portreserve_t) corenet_tcp_bind_generic_node(portreserve_t) corenet_udp_bind_generic_node(portreserve_t) diff --git a/portslave.te b/portslave.te index 69c331e..528f2d8 100644 --- a/portslave.te +++ b/portslave.te @@ -54,7 +54,6 @@ kernel_read_kernel_sysctls(portslave_t) corecmd_exec_bin(portslave_t) corecmd_exec_shell(portslave_t) -corenet_all_recvfrom_unlabeled(portslave_t) corenet_all_recvfrom_netlabel(portslave_t) corenet_tcp_sendrecv_generic_if(portslave_t) corenet_udp_sendrecv_generic_if(portslave_t) @@ -79,7 +78,7 @@ fs_getattr_xattr_fs(portslave_t) term_use_unallocated_ttys(portslave_t) term_setattr_unallocated_ttys(portslave_t) -term_use_all_ttys(portslave_t) +term_use_all_inherited_ttys(portslave_t) term_search_ptys(portslave_t) auth_rw_login_records(portslave_t) diff --git a/postfix.fc b/postfix.fc index 1ddfa16..c0e0959 100644 --- a/postfix.fc +++ b/postfix.fc @@ -1,5 +1,6 @@ # postfix -/etc/postfix(/.*)? gen_context(system_u:object_r:postfix_etc_t,s0) +/etc/rc\.d/init\.d/postfix -- gen_context(system_u:object_r:postfix_initrc_exec_t,s0) +/etc/postfix.* gen_context(system_u:object_r:postfix_etc_t,s0) ifdef(`distro_redhat', ` /usr/libexec/postfix/.* -- gen_context(system_u:object_r:postfix_exec_t,s0) /usr/libexec/postfix/cleanup -- gen_context(system_u:object_r:postfix_cleanup_exec_t,s0) @@ -22,16 +23,17 @@ ifdef(`distro_redhat', ` /usr/lib/postfix/master -- gen_context(system_u:object_r:postfix_master_exec_t,s0) /usr/lib/postfix/pickup -- gen_context(system_u:object_r:postfix_pickup_exec_t,s0) /usr/lib/postfix/(n)?qmgr -- gen_context(system_u:object_r:postfix_qmgr_exec_t,s0) +/usr/lib/postfix/showq -- gen_context(system_u:object_r:postfix_showq_exec_t,s0) /usr/lib/postfix/smtp -- gen_context(system_u:object_r:postfix_smtp_exec_t,s0) /usr/lib/postfix/lmtp -- gen_context(system_u:object_r:postfix_smtp_exec_t,s0) /usr/lib/postfix/scache -- gen_context(system_u:object_r:postfix_smtp_exec_t,s0) /usr/lib/postfix/smtpd -- gen_context(system_u:object_r:postfix_smtpd_exec_t,s0) /usr/lib/postfix/bounce -- gen_context(system_u:object_r:postfix_bounce_exec_t,s0) /usr/lib/postfix/pipe -- gen_context(system_u:object_r:postfix_pipe_exec_t,s0) -/usr/lib/postfix/virtual -- gen_context(system_u:object_r:postfix_virtual_exec_t,s0) ') /etc/postfix/postfix-script.* -- gen_context(system_u:object_r:postfix_exec_t,s0) /etc/postfix/prng_exch -- gen_context(system_u:object_r:postfix_prng_t,s0) +/usr/sbin/postalias -- gen_context(system_u:object_r:postfix_master_exec_t,s0) /usr/sbin/postcat -- gen_context(system_u:object_r:postfix_master_exec_t,s0) /usr/sbin/postdrop -- gen_context(system_u:object_r:postfix_postdrop_exec_t,s0) /usr/sbin/postfix -- gen_context(system_u:object_r:postfix_master_exec_t,s0) @@ -42,9 +44,11 @@ ifdef(`distro_redhat', ` /usr/sbin/postqueue -- gen_context(system_u:object_r:postfix_postqueue_exec_t,s0) /usr/sbin/postsuper -- gen_context(system_u:object_r:postfix_master_exec_t,s0) -/var/lib/postfix(/.*)? gen_context(system_u:object_r:postfix_data_t,s0) +/var/lib/postfix.* gen_context(system_u:object_r:postfix_data_t,s0) -/var/spool/postfix(/.*)? gen_context(system_u:object_r:postfix_spool_t,s0) +/var/spool/postfix.* gen_context(system_u:object_r:postfix_spool_t,s0) +/var/spool/postfix/deferred(/.*)? gen_context(system_u:object_r:postfix_spool_maildrop_t,s0) +/var/spool/postfix/defer(/.*)? gen_context(system_u:object_r:postfix_spool_maildrop_t,s0) /var/spool/postfix/maildrop(/.*)? gen_context(system_u:object_r:postfix_spool_maildrop_t,s0) /var/spool/postfix/pid/.* gen_context(system_u:object_r:postfix_var_run_t,s0) /var/spool/postfix/private(/.*)? gen_context(system_u:object_r:postfix_private_t,s0) diff --git a/postfix.if b/postfix.if index 46bee12..bb05e96 100644 --- a/postfix.if +++ b/postfix.if @@ -28,75 +28,21 @@ interface(`postfix_stub',` ## # template(`postfix_domain_template',` - type postfix_$1_t; + gen_require(` + attribute postfix_domain; + ') + + type postfix_$1_t, postfix_domain; type postfix_$1_exec_t; domain_type(postfix_$1_t) domain_entry_file(postfix_$1_t, postfix_$1_exec_t) role system_r types postfix_$1_t; - dontaudit postfix_$1_t self:capability sys_tty_config; - allow postfix_$1_t self:process { signal_perms setpgid }; - allow postfix_$1_t self:unix_dgram_socket create_socket_perms; - allow postfix_$1_t self:unix_stream_socket create_stream_socket_perms; - allow postfix_$1_t self:unix_stream_socket connectto; - - allow postfix_master_t postfix_$1_t:process signal; - #https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=244456 - allow postfix_$1_t postfix_master_t:file read; - - allow postfix_$1_t postfix_etc_t:dir list_dir_perms; - read_files_pattern(postfix_$1_t, postfix_etc_t, postfix_etc_t) - read_lnk_files_pattern(postfix_$1_t, postfix_etc_t, postfix_etc_t) - - can_exec(postfix_$1_t, postfix_$1_exec_t) - - allow postfix_$1_t postfix_exec_t:file { mmap_file_perms lock ioctl }; - - allow postfix_$1_t postfix_master_t:process sigchld; - - allow postfix_$1_t postfix_spool_t:dir list_dir_perms; - - allow postfix_$1_t postfix_var_run_t:file manage_file_perms; - files_pid_filetrans(postfix_$1_t, postfix_var_run_t, file) - - kernel_read_system_state(postfix_$1_t) - kernel_read_network_state(postfix_$1_t) - kernel_read_all_sysctls(postfix_$1_t) - - dev_read_sysfs(postfix_$1_t) - dev_read_rand(postfix_$1_t) - dev_read_urand(postfix_$1_t) - - fs_search_auto_mountpoints(postfix_$1_t) - fs_getattr_xattr_fs(postfix_$1_t) - fs_rw_anon_inodefs_files(postfix_$1_t) - - term_dontaudit_use_console(postfix_$1_t) - - corecmd_exec_shell(postfix_$1_t) - - files_read_etc_files(postfix_$1_t) - files_read_etc_runtime_files(postfix_$1_t) - files_read_usr_symlinks(postfix_$1_t) - files_search_spool(postfix_$1_t) - files_getattr_tmp_dirs(postfix_$1_t) - files_search_all_mountpoints(postfix_$1_t) - - init_dontaudit_use_fds(postfix_$1_t) - init_sigchld(postfix_$1_t) - auth_use_nsswitch(postfix_$1_t) logging_send_syslog_msg(postfix_$1_t) - miscfiles_read_localization(postfix_$1_t) - miscfiles_read_generic_certs(postfix_$1_t) - - userdom_dontaudit_use_unpriv_user_fds(postfix_$1_t) - - optional_policy(` - udev_read_db(postfix_$1_t) - ') + can_exec(postfix_$1_t, postfix_$1_exec_t) ') ######################################## @@ -115,7 +61,7 @@ template(`postfix_server_domain_template',` type postfix_$1_tmp_t; files_tmp_file(postfix_$1_tmp_t) - allow postfix_$1_t self:capability { setuid setgid dac_override }; + allow postfix_$1_t self:capability { setuid setgid sys_chroot dac_override }; allow postfix_$1_t postfix_master_t:unix_stream_socket { connectto rw_stream_socket_perms }; allow postfix_$1_t self:tcp_socket create_socket_perms; allow postfix_$1_t self:udp_socket create_socket_perms; @@ -126,7 +72,6 @@ template(`postfix_server_domain_template',` domtrans_pattern(postfix_master_t, postfix_$1_exec_t, postfix_$1_t) - corenet_all_recvfrom_unlabeled(postfix_$1_t) corenet_all_recvfrom_netlabel(postfix_$1_t) corenet_tcp_sendrecv_generic_if(postfix_$1_t) corenet_udp_sendrecv_generic_if(postfix_$1_t) @@ -165,6 +110,8 @@ template(`postfix_user_domain_template',` domtrans_pattern(postfix_user_domtrans, postfix_$1_exec_t, postfix_$1_t) domain_use_interactive_fds(postfix_$1_t) + + application_domain(postfix_$1_t, postfix_$1_exec_t) ') ######################################## @@ -215,7 +162,7 @@ interface(`postfix_config_filetrans',` ') files_search_etc($1) - filetrans_pattern($1, postfix_etc_t, $2, $3) + filetrans_pattern($1, postfix_etc_t, $2, $3, $4) ') ######################################## @@ -272,7 +219,8 @@ interface(`postfix_read_local_state',` type postfix_local_t; ') - read_files_pattern($1, postfix_local_t, postfix_local_t) + kernel_search_proc($1) + ps_process_pattern($1, postfix_local_t) ') ######################################## @@ -290,7 +238,27 @@ interface(`postfix_read_master_state',` type postfix_master_t; ') - read_files_pattern($1, postfix_master_t, postfix_master_t) + kernel_search_proc($1) + ps_process_pattern($1, postfix_master_t) +') + +######################################## +## +## Use postfix master process file +## file descriptors. +## +## +## +## Domain allowed access. +## +## +# +interface(`postfix_use_fds_master',` + gen_require(` + type postfix_master_t; + ') + + allow $1 postfix_master_t:fd use; ') ######################################## @@ -376,6 +344,25 @@ interface(`postfix_domtrans_master',` domtrans_pattern($1, postfix_master_exec_t, postfix_master_t) ') + +######################################## +## +## Execute the master postfix in the postfix master domain. +## +## +## +## Domain allowed access. +## +## +# +interface(`postfix_initrc_domtrans',` + gen_require(` + type postfix_initrc_exec_t; + ') + + init_labeled_script_domtrans($1, postfix_initrc_exec_t) +') + ######################################## ## ## Execute the master postfix program in the @@ -404,7 +391,6 @@ interface(`postfix_exec_master',` ## Domain allowed access. ## ## -## # interface(`postfix_stream_connect_master',` gen_require(` @@ -416,6 +402,24 @@ interface(`postfix_stream_connect_master',` ######################################## ## +## Allow read/write postfix master pipes +## +## +## +## Domain allowed access. +## +## +# +interface(`postfix_rw_master_pipes',` + gen_require(` + type postfix_master_t; + ') + + allow $1 postfix_master_t:fifo_file rw_inherited_fifo_file_perms; +') + +######################################## +## ## Execute the master postdrop in the ## postfix_postdrop domain. ## @@ -462,7 +466,7 @@ interface(`postfix_domtrans_postqueue',` ## ## # -interface(`posftix_exec_postqueue',` +interface(`postfix_exec_postqueue',` gen_require(` type postfix_postqueue_exec_t; ') @@ -529,6 +533,25 @@ interface(`postfix_domtrans_smtp',` ######################################## ## +## Getattr postfix mail spool files. +## +## +## +## Domain allowed access. +## +## +# +interface(`postfix_getattr_spool_files',` + gen_require(` + attribute postfix_spool_type; + ') + + files_search_spool($1) + getattr_files_pattern($1, postfix_spool_type, postfix_spool_type) +') + +######################################## +## ## Search postfix mail spool directories. ## ## @@ -539,10 +562,10 @@ interface(`postfix_domtrans_smtp',` # interface(`postfix_search_spool',` gen_require(` - type postfix_spool_t; + attribute postfix_spool_type; ') - allow $1 postfix_spool_t:dir search_dir_perms; + allow $1 postfix_spool_type:dir search_dir_perms; files_search_spool($1) ') @@ -558,10 +581,10 @@ interface(`postfix_search_spool',` # interface(`postfix_list_spool',` gen_require(` - type postfix_spool_t; + attribute postfix_spool_type; ') - allow $1 postfix_spool_t:dir list_dir_perms; + allow $1 postfix_spool_type:dir list_dir_perms; files_search_spool($1) ') @@ -577,11 +600,11 @@ interface(`postfix_list_spool',` # interface(`postfix_read_spool_files',` gen_require(` - type postfix_spool_t; + attribute postfix_spool_type; ') files_search_spool($1) - read_files_pattern($1, postfix_spool_t, postfix_spool_t) + read_files_pattern($1, postfix_spool_type, postfix_spool_type) ') ######################################## @@ -596,11 +619,11 @@ interface(`postfix_read_spool_files',` # interface(`postfix_manage_spool_files',` gen_require(` - type postfix_spool_t; + attribute postfix_spool_type; ') files_search_spool($1) - manage_files_pattern($1, postfix_spool_t, postfix_spool_t) + manage_files_pattern($1, postfix_spool_type, postfix_spool_type) ') ######################################## @@ -621,3 +644,155 @@ interface(`postfix_domtrans_user_mail_handler',` typeattribute $1 postfix_user_domtrans; ') + +######################################## +## +## All of the rules required to administrate +## an postfix environment. +## +## +## +## Domain allowed access. +## +## +## +## +## Role allowed access. +## +## +## +# +interface(`postfix_admin',` + gen_require(` + attribute postfix_spool_type; + type postfix_bounce_t, postfix_cleanup_t, postfix_local_t; + type postfix_master_t, postfix_pickup_t, postfix_qmgr_t; + type postfix_initrc_exec_t, postfix_data_t, postfix_etc_t; + type postfix_map_tmp_t, postfix_prng_t, postfix_public_t; + type postfix_smtpd_t, postfix_var_run_t; + ') + + allow $1 postfix_bounce_t:process signal_perms; + ps_process_pattern($1, postfix_bounce_t) + tunable_policy(`deny_ptrace',`',` + allow $1 postfix_bounce_t:process ptrace; + ') + + allow $1 postfix_cleanup_t:process signal_perms; + ps_process_pattern($1, postfix_cleanup_t) + tunable_policy(`deny_ptrace',`',` + allow $1 postfix_cleanup_t:process ptrace; + allow $1 postfix_local_t:process ptrace; + allow $1 postfix_master_t:process ptrace; + allow $1 postfix_pickup_t:process ptrace; + allow $1 postfix_qmgr_t:process ptrace; + allow $1 postfix_smtpd_t:process ptrace; + ') + + allow $1 postfix_local_t:process signal_perms; + ps_process_pattern($1, postfix_local_t) + + allow $1 postfix_master_t:process signal_perms; + ps_process_pattern($1, postfix_master_t) + + allow $1 postfix_pickup_t:process signal_perms; + ps_process_pattern($1, postfix_pickup_t) + + allow $1 postfix_qmgr_t:process signal_perms; + ps_process_pattern($1, postfix_qmgr_t) + + allow $1 postfix_smtpd_t:process signal_perms; + ps_process_pattern($1, postfix_smtpd_t) + + postfix_run_map($1, $2) + postfix_run_postdrop($1, $2) + + postfix_initrc_domtrans($1) + domain_system_change_exemption($1) + role_transition $2 postfix_initrc_exec_t system_r; + allow $2 system_r; + + admin_pattern($1, postfix_data_t) + + files_list_etc($1) + admin_pattern($1, postfix_etc_t) + + files_list_spool($1) + admin_pattern($1, postfix_spool_type) + + admin_pattern($1, postfix_var_run_t) + + files_list_tmp($1) + admin_pattern($1, postfix_map_tmp_t) + + admin_pattern($1, postfix_prng_t) + + admin_pattern($1, postfix_public_t) + + postfix_filetrans_named_content($1) +') + +######################################## +## +## Execute the master postdrop in the +## postfix_postdrop domain. +## +## +## +## Domain allowed to transition. +## +## +## +## +## The role to be allowed the iptables domain. +## +## +## +# +interface(`postfix_run_postdrop',` + gen_require(` + type postfix_postdrop_t; + ') + + postfix_domtrans_postdrop($1) + role $2 types postfix_postdrop_t; + allow postfix_postdrop_t $1:unix_stream_socket { read write getattr }; +') + +######################################## +## +## Execute postfix exec in the users domain +## +## +## +## Domain allowed access. +## +## +# +interface(`postfix_exec',` + gen_require(` + type postfix_exec_t; + ') + + can_exec($1, postfix_exec_t) +') + +######################################## +## +## Transition to postfix named content +## +## +## +## Domain allowed access. +## +## +# +interface(`postfix_filetrans_named_content',` + gen_require(` + type postfix_exec_t; + type postfix_prng_t; + ') + + postfix_config_filetrans($1, postfix_exec_t, file, "postfix-script") + postfix_config_filetrans($1, postfix_prng_t, file, "prng_exch") +') diff --git a/postfix.te b/postfix.te index a1e0f60..4549be1 100644 --- a/postfix.te +++ b/postfix.te @@ -5,6 +5,15 @@ policy_module(postfix, 1.14.0) # Declarations # +## +##

+## Allow postfix_local domain full write access to mail_spool directories +##

+## +gen_tunable(postfix_local_write_mail_spool, true) + +attribute postfix_domain; +attribute postfix_spool_type; attribute postfix_user_domains; # domains that transition to the # postfix user domains @@ -12,8 +21,8 @@ attribute postfix_user_domtrans; postfix_server_domain_template(bounce) -type postfix_spool_bounce_t; -files_type(postfix_spool_bounce_t) +type postfix_spool_bounce_t, postfix_spool_type; +files_spool_file(postfix_spool_bounce_t) postfix_server_domain_template(cleanup) @@ -41,6 +50,9 @@ typealias postfix_master_t alias postfix_t; # generation macro work mta_mailserver(postfix_t, postfix_master_exec_t) +type postfix_initrc_exec_t; +init_script_file(postfix_initrc_exec_t) + postfix_server_domain_template(pickup) postfix_server_domain_template(pipe) @@ -49,6 +61,7 @@ postfix_user_domain_template(postdrop) mta_mailserver_user_agent(postfix_postdrop_t) postfix_user_domain_template(postqueue) +mta_mailserver_user_agent(postfix_postqueue_t) type postfix_private_t; files_type(postfix_private_t) @@ -65,14 +78,14 @@ mta_mailserver_sender(postfix_smtp_t) postfix_server_domain_template(smtpd) -type postfix_spool_t; -files_type(postfix_spool_t) +type postfix_spool_t, postfix_spool_type; +files_spool_file(postfix_spool_t) -type postfix_spool_maildrop_t; -files_type(postfix_spool_maildrop_t) +type postfix_spool_maildrop_t, postfix_spool_type; +files_spool_file(postfix_spool_maildrop_t) -type postfix_spool_flush_t; -files_type(postfix_spool_flush_t) +type postfix_spool_flush_t, postfix_spool_type; +files_spool_file(postfix_spool_flush_t) type postfix_public_t; files_type(postfix_public_t) @@ -94,23 +107,26 @@ mta_mailserver_delivery(postfix_virtual_t) # chown is to set the correct ownership of queue dirs allow postfix_master_t self:capability { chown dac_override kill setgid setuid net_bind_service sys_tty_config }; -allow postfix_master_t self:fifo_file rw_fifo_file_perms; +allow postfix_master_t self:capability2 block_suspend; + +allow postfix_master_t self:process setrlimit; allow postfix_master_t self:tcp_socket create_stream_socket_perms; allow postfix_master_t self:udp_socket create_socket_perms; -allow postfix_master_t self:process setrlimit; +allow postfix_master_t postfix_etc_t:dir rw_dir_perms; allow postfix_master_t postfix_etc_t:file rw_file_perms; +mta_filetrans_aliases(postfix_master_t, postfix_etc_t) can_exec(postfix_master_t, postfix_exec_t) allow postfix_master_t postfix_data_t:dir manage_dir_perms; allow postfix_master_t postfix_data_t:file manage_file_perms; -allow postfix_master_t postfix_map_exec_t:file { mmap_file_perms ioctl lock }; +allow postfix_master_t postfix_map_exec_t:file { mmap_file_perms lock }; -allow postfix_master_t postfix_postdrop_exec_t:file getattr; +allow postfix_master_t postfix_postdrop_exec_t:file getattr_file_perms; -allow postfix_master_t postfix_postqueue_exec_t:file getattr; +allow postfix_master_t postfix_postqueue_exec_t:file getattr_file_perms; manage_fifo_files_pattern(postfix_master_t, postfix_private_t, postfix_private_t) manage_sock_files_pattern(postfix_master_t, postfix_private_t, postfix_private_t) @@ -130,7 +146,7 @@ manage_files_pattern(postfix_master_t, postfix_spool_t, postfix_spool_t) files_spool_filetrans(postfix_master_t, postfix_spool_t, dir) allow postfix_master_t postfix_spool_bounce_t:dir manage_dir_perms; -allow postfix_master_t postfix_spool_bounce_t:file getattr; +allow postfix_master_t postfix_spool_bounce_t:file getattr_file_perms; manage_dirs_pattern(postfix_master_t, postfix_spool_flush_t, postfix_spool_flush_t) manage_files_pattern(postfix_master_t, postfix_spool_flush_t, postfix_spool_flush_t) @@ -138,11 +154,11 @@ manage_lnk_files_pattern(postfix_master_t, postfix_spool_flush_t, postfix_spool_ delete_files_pattern(postfix_master_t, postfix_spool_maildrop_t, postfix_spool_maildrop_t) rename_files_pattern(postfix_master_t, postfix_spool_maildrop_t, postfix_spool_maildrop_t) +rw_files_pattern(postfix_master_t, postfix_spool_maildrop_t, postfix_spool_maildrop_t) setattr_dirs_pattern(postfix_master_t, postfix_spool_maildrop_t, postfix_spool_maildrop_t) kernel_read_all_sysctls(postfix_master_t) -corenet_all_recvfrom_unlabeled(postfix_master_t) corenet_all_recvfrom_netlabel(postfix_master_t) corenet_tcp_sendrecv_generic_if(postfix_master_t) corenet_udp_sendrecv_generic_if(postfix_master_t) @@ -150,6 +166,9 @@ corenet_tcp_sendrecv_generic_node(postfix_master_t) corenet_udp_sendrecv_generic_node(postfix_master_t) corenet_tcp_sendrecv_all_ports(postfix_master_t) corenet_udp_sendrecv_all_ports(postfix_master_t) +corenet_udp_bind_generic_node(postfix_master_t) +corenet_udp_bind_all_unreserved_ports(postfix_master_t) +corenet_dontaudit_udp_bind_all_ports(postfix_master_t) corenet_tcp_bind_generic_node(postfix_master_t) corenet_tcp_bind_amavisd_send_port(postfix_master_t) corenet_tcp_bind_smtp_port(postfix_master_t) @@ -157,6 +176,8 @@ corenet_tcp_connect_all_ports(postfix_master_t) corenet_sendrecv_amavisd_send_server_packets(postfix_master_t) corenet_sendrecv_smtp_server_packets(postfix_master_t) corenet_sendrecv_all_client_packets(postfix_master_t) +# for spampd +corenet_tcp_bind_spamd_port(postfix_master_t) # for a find command selinux_dontaudit_search_fs(postfix_master_t) @@ -167,6 +188,10 @@ corecmd_exec_bin(postfix_master_t) domain_use_interactive_fds(postfix_master_t) files_read_usr_files(postfix_master_t) +files_search_var_lib(postfix_master_t) +files_search_tmp(postfix_master_t) + +mcs_file_read_all(postfix_master_t) term_dontaudit_search_ptys(postfix_master_t) @@ -220,13 +245,17 @@ allow postfix_bounce_t self:capability dac_read_search; allow postfix_bounce_t self:tcp_socket create_socket_perms; allow postfix_bounce_t postfix_public_t:sock_file write; -allow postfix_bounce_t postfix_public_t:dir search; +allow postfix_bounce_t postfix_public_t:dir search_dir_perms; manage_dirs_pattern(postfix_bounce_t, postfix_spool_t, postfix_spool_t) manage_files_pattern(postfix_bounce_t, postfix_spool_t, postfix_spool_t) manage_lnk_files_pattern(postfix_bounce_t, postfix_spool_t, postfix_spool_t) files_spool_filetrans(postfix_bounce_t, postfix_spool_t, dir) +manage_files_pattern(postfix_bounce_t, postfix_spool_maildrop_t, postfix_spool_maildrop_t) +manage_dirs_pattern(postfix_bounce_t, postfix_spool_maildrop_t, postfix_spool_maildrop_t) +allow postfix_bounce_t postfix_spool_maildrop_t:lnk_file read_lnk_file_perms; + manage_dirs_pattern(postfix_bounce_t, postfix_spool_bounce_t, postfix_spool_bounce_t) manage_files_pattern(postfix_bounce_t, postfix_spool_bounce_t, postfix_spool_bounce_t) manage_lnk_files_pattern(postfix_bounce_t, postfix_spool_bounce_t, postfix_spool_bounce_t) @@ -237,22 +266,31 @@ manage_lnk_files_pattern(postfix_bounce_t, postfix_spool_bounce_t, postfix_spool # allow postfix_cleanup_t self:process setrlimit; +allow postfix_cleanup_t postfix_smtpd_t:tcp_socket rw_stream_socket_perms; # connect to master process stream_connect_pattern(postfix_cleanup_t, postfix_private_t, postfix_private_t, postfix_master_t) rw_fifo_files_pattern(postfix_cleanup_t, postfix_public_t, postfix_public_t) write_sock_files_pattern(postfix_cleanup_t, postfix_public_t, postfix_public_t) +allow postfix_cleanup_t postfix_smtpd_t:unix_stream_socket rw_socket_perms; manage_dirs_pattern(postfix_cleanup_t, postfix_spool_t, postfix_spool_t) manage_files_pattern(postfix_cleanup_t, postfix_spool_t, postfix_spool_t) manage_lnk_files_pattern(postfix_cleanup_t, postfix_spool_t, postfix_spool_t) files_spool_filetrans(postfix_cleanup_t, postfix_spool_t, dir) +allow postfix_cleanup_t postfix_spool_maildrop_t:dir list_dir_perms; +allow postfix_cleanup_t postfix_spool_maildrop_t:file read_file_perms; +allow postfix_cleanup_t postfix_spool_maildrop_t:lnk_file read_lnk_file_perms; + allow postfix_cleanup_t postfix_spool_bounce_t:dir list_dir_perms; corecmd_exec_bin(postfix_cleanup_t) +# allow postfix to connect to sqlgrey +corenet_tcp_connect_rtsclient_port(postfix_cleanup_t) + mta_read_aliases(postfix_cleanup_t) optional_policy(` @@ -264,7 +302,6 @@ optional_policy(` # Postfix local local policy # -allow postfix_local_t self:fifo_file rw_fifo_file_perms; allow postfix_local_t self:process { setsched setrlimit }; # connect to master process @@ -273,12 +310,13 @@ stream_connect_pattern(postfix_local_t, postfix_public_t, postfix_public_t, post # for .forward - maybe we need a new type for it? rw_sock_files_pattern(postfix_local_t, postfix_private_t, postfix_private_t) +domtrans_pattern(postfix_local_t, postfix_postdrop_exec_t, postfix_postdrop_t) + allow postfix_local_t postfix_spool_t:file rw_file_perms; corecmd_exec_shell(postfix_local_t) corecmd_exec_bin(postfix_local_t) -files_read_etc_files(postfix_local_t) logging_dontaudit_search_logs(postfix_local_t) @@ -286,10 +324,15 @@ mta_read_aliases(postfix_local_t) mta_delete_spool(postfix_local_t) # For reading spamassasin mta_read_config(postfix_local_t) +# Handle vacation script +mta_send_mail(postfix_local_t) -domtrans_pattern(postfix_local_t, postfix_postdrop_exec_t, postfix_postdrop_t) -# Might be a leak, but I need a postfix expert to explain -allow postfix_postdrop_t postfix_local_t:unix_stream_socket { read write }; +userdom_read_user_home_content_files(postfix_local_t) +userdom_exec_user_bin_files(postfix_local_t) + +tunable_policy(`postfix_local_write_mail_spool',` + mta_manage_spool(postfix_local_t) +') optional_policy(` clamav_search_lib(postfix_local_t) @@ -297,6 +340,14 @@ optional_policy(` ') optional_policy(` + dovecot_domtrans_deliver(postfix_local_t) +') + +optional_policy(` + dspam_domtrans(postfix_local_t) +') + +optional_policy(` # for postalias mailman_manage_data_files(postfix_local_t) mailman_append_log(postfix_local_t) @@ -304,9 +355,22 @@ optional_policy(` ') optional_policy(` + nagios_search_spool(postfix_local_t) +') + +optional_policy(` procmail_domtrans(postfix_local_t) ') +optional_policy(` + sendmail_rw_pipes(postfix_local_t) +') + +optional_policy(` + zarafa_domtrans_deliver(postfix_local_t) + zarafa_stream_connect_server(postfix_local_t) +') + ######################################## # # Postfix map local policy @@ -329,7 +393,6 @@ kernel_read_kernel_sysctls(postfix_map_t) kernel_dontaudit_list_proc(postfix_map_t) kernel_dontaudit_read_system_state(postfix_map_t) -corenet_all_recvfrom_unlabeled(postfix_map_t) corenet_all_recvfrom_netlabel(postfix_map_t) corenet_tcp_sendrecv_generic_if(postfix_map_t) corenet_udp_sendrecv_generic_if(postfix_map_t) @@ -348,7 +411,6 @@ corecmd_read_bin_sockets(postfix_map_t) files_list_home(postfix_map_t) files_read_usr_files(postfix_map_t) -files_read_etc_files(postfix_map_t) files_read_etc_runtime_files(postfix_map_t) files_dontaudit_search_var(postfix_map_t) @@ -356,8 +418,6 @@ auth_use_nsswitch(postfix_map_t) logging_send_syslog_msg(postfix_map_t) -miscfiles_read_localization(postfix_map_t) - optional_policy(` locallogin_dontaudit_use_fds(postfix_map_t) ') @@ -379,18 +439,24 @@ stream_connect_pattern(postfix_pickup_t, postfix_private_t, postfix_private_t, p rw_fifo_files_pattern(postfix_pickup_t, postfix_public_t, postfix_public_t) rw_sock_files_pattern(postfix_pickup_t, postfix_public_t, postfix_public_t) +allow postfix_pickup_t postfix_spool_t:dir list_dir_perms; +read_files_pattern(postfix_pickup_t, postfix_spool_t, postfix_spool_t) +delete_files_pattern(postfix_pickup_t, postfix_spool_t, postfix_spool_t) + postfix_list_spool(postfix_pickup_t) allow postfix_pickup_t postfix_spool_maildrop_t:dir list_dir_perms; read_files_pattern(postfix_pickup_t, postfix_spool_maildrop_t, postfix_spool_maildrop_t) delete_files_pattern(postfix_pickup_t, postfix_spool_maildrop_t, postfix_spool_maildrop_t) +mcs_file_read_all(postfix_pickup_t) +mcs_file_write_all(postfix_pickup_t) + ######################################## # # Postfix pipe local policy # -allow postfix_pipe_t self:fifo_file rw_fifo_file_perms; allow postfix_pipe_t self:process setrlimit; write_sock_files_pattern(postfix_pipe_t, postfix_private_t, postfix_private_t) @@ -401,6 +467,8 @@ rw_files_pattern(postfix_pipe_t, postfix_spool_t, postfix_spool_t) domtrans_pattern(postfix_pipe_t, postfix_postdrop_exec_t, postfix_postdrop_t) +corecmd_exec_bin(postfix_pipe_t) + optional_policy(` dovecot_domtrans_deliver(postfix_pipe_t) ') @@ -420,6 +488,7 @@ optional_policy(` optional_policy(` spamassassin_domtrans_client(postfix_pipe_t) + spamassassin_kill_client(postfix_pipe_t) ') optional_policy(` @@ -436,11 +505,17 @@ allow postfix_postdrop_t self:capability sys_resource; allow postfix_postdrop_t self:tcp_socket create; allow postfix_postdrop_t self:udp_socket create_socket_perms; +# Might be a leak, but I need a postfix expert to explain +allow postfix_postdrop_t postfix_local_t:unix_stream_socket { read write }; + rw_fifo_files_pattern(postfix_postdrop_t, postfix_public_t, postfix_public_t) postfix_list_spool(postfix_postdrop_t) manage_files_pattern(postfix_postdrop_t, postfix_spool_maildrop_t, postfix_spool_maildrop_t) +mcs_file_read_all(postfix_postdrop_t) +mcs_file_write_all(postfix_postdrop_t) + corenet_udp_sendrecv_generic_if(postfix_postdrop_t) corenet_udp_sendrecv_generic_node(postfix_postdrop_t) @@ -487,8 +562,8 @@ write_fifo_files_pattern(postfix_postqueue_t, postfix_public_t, postfix_public_t domtrans_pattern(postfix_postqueue_t, postfix_showq_exec_t, postfix_showq_t) # to write the mailq output, it really should not need read access! -term_use_all_ptys(postfix_postqueue_t) -term_use_all_ttys(postfix_postqueue_t) +term_use_all_inherited_ptys(postfix_postqueue_t) +term_use_all_inherited_ttys(postfix_postqueue_t) init_sigchld_script(postfix_postqueue_t) init_use_script_fds(postfix_postqueue_t) @@ -519,7 +594,11 @@ files_spool_filetrans(postfix_qmgr_t, postfix_spool_t, dir) allow postfix_qmgr_t postfix_spool_bounce_t:dir list_dir_perms; allow postfix_qmgr_t postfix_spool_bounce_t:file read_file_perms; -allow postfix_qmgr_t postfix_spool_bounce_t:lnk_file { getattr read }; +allow postfix_qmgr_t postfix_spool_bounce_t:lnk_file read_lnk_file_perms; + +manage_files_pattern(postfix_qmgr_t, postfix_spool_maildrop_t, postfix_spool_maildrop_t) +manage_dirs_pattern(postfix_qmgr_t, postfix_spool_maildrop_t, postfix_spool_maildrop_t) +allow postfix_qmgr_t postfix_spool_maildrop_t:lnk_file read_lnk_file_perms; corecmd_exec_bin(postfix_qmgr_t) @@ -539,7 +618,9 @@ postfix_list_spool(postfix_showq_t) allow postfix_showq_t postfix_spool_maildrop_t:dir list_dir_perms; allow postfix_showq_t postfix_spool_maildrop_t:file read_file_perms; -allow postfix_showq_t postfix_spool_maildrop_t:lnk_file { getattr read }; +allow postfix_showq_t postfix_spool_maildrop_t:lnk_file read_lnk_file_perms; + +mcs_file_read_all(postfix_showq_t) # to write the mailq output, it really should not need read access! term_use_all_ptys(postfix_showq_t) @@ -558,6 +639,11 @@ allow postfix_smtp_t postfix_prng_t:file rw_file_perms; allow postfix_smtp_t postfix_spool_t:file rw_file_perms; +rw_files_pattern(postfix_smtp_t, postfix_spool_maildrop_t, postfix_spool_maildrop_t) + +# for spampd +corenet_tcp_connect_spamd_port(postfix_master_t) + files_search_all_mountpoints(postfix_smtp_t) optional_policy(` @@ -565,6 +651,14 @@ optional_policy(` ') optional_policy(` + dovecot_stream_connect(postfix_smtp_t) +') + +optional_policy(` + dspam_stream_connect(postfix_smtp_t) +') + +optional_policy(` milter_stream_connect_all(postfix_smtp_t) ') @@ -581,17 +675,25 @@ stream_connect_pattern(postfix_smtpd_t, { postfix_private_t postfix_public_t }, corenet_tcp_connect_postfix_policyd_port(postfix_smtpd_t) # for prng_exch -allow postfix_smtpd_t postfix_spool_t:file rw_file_perms; +manage_dirs_pattern(postfix_smtpd_t, postfix_spool_t, postfix_spool_t) +manage_files_pattern(postfix_smtpd_t, postfix_spool_t, postfix_spool_t) +manage_lnk_files_pattern(postfix_smtpd_t, postfix_spool_t, postfix_spool_t) allow postfix_smtpd_t postfix_prng_t:file rw_file_perms; corecmd_exec_bin(postfix_smtpd_t) # for OpenSSL certificates files_read_usr_files(postfix_smtpd_t) + +# postfix checks the size of all mounted file systems +fs_getattr_all_dirs(postfix_smtpd_t) +fs_getattr_all_fs(postfix_smtpd_t) + mta_read_aliases(postfix_smtpd_t) optional_policy(` dovecot_stream_connect_auth(postfix_smtpd_t) + dovecot_stream_connect(postfix_smtpd_t) ') optional_policy(` @@ -599,6 +701,11 @@ optional_policy(` ') optional_policy(` + milter_stream_connect_all(postfix_smtpd_t) + spamassassin_read_pid_files(postfix_smtpd_t) +') + +optional_policy(` postgrey_stream_connect(postfix_smtpd_t) ') @@ -611,7 +718,6 @@ optional_policy(` # Postfix virtual local policy # -allow postfix_virtual_t self:fifo_file rw_fifo_file_perms; allow postfix_virtual_t self:process { setsched setrlimit }; allow postfix_virtual_t postfix_spool_t:file rw_file_perms; @@ -622,7 +728,6 @@ stream_connect_pattern(postfix_virtual_t, { postfix_private_t postfix_public_t } corecmd_exec_shell(postfix_virtual_t) corecmd_exec_bin(postfix_virtual_t) -files_read_etc_files(postfix_virtual_t) files_read_usr_files(postfix_virtual_t) mta_read_aliases(postfix_virtual_t) @@ -630,3 +735,76 @@ mta_delete_spool(postfix_virtual_t) # For reading spamassasin mta_read_config(postfix_virtual_t) mta_manage_spool(postfix_virtual_t) + +userdom_manage_user_home_dirs(postfix_virtual_t) +userdom_manage_user_home_content(postfix_virtual_t) +userdom_home_filetrans_user_home_dir(postfix_virtual_t) +userdom_user_home_dir_filetrans_user_home_content(postfix_virtual_t, {file dir }) + +######################################## +# +# postfix_domain common policy +# +allow postfix_domain self:capability { sys_nice sys_chroot }; +dontaudit postfix_domain self:capability sys_tty_config; +allow postfix_domain self:process { signal_perms setpgid setsched }; +allow postfix_domain self:unix_dgram_socket create_socket_perms; +allow postfix_domain self:unix_stream_socket create_stream_socket_perms; +allow postfix_domain self:unix_stream_socket connectto; +allow postfix_domain self:fifo_file rw_fifo_file_perms; + +allow postfix_master_t postfix_domain:fifo_file { read write }; +allow postfix_master_t postfix_domain:process signal; +#https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=244456 +allow postfix_domain postfix_master_t:file read; +allow postfix_domain postfix_etc_t:dir list_dir_perms; +read_files_pattern(postfix_domain, postfix_etc_t, postfix_etc_t) +read_lnk_files_pattern(postfix_domain, postfix_etc_t, postfix_etc_t) + +allow postfix_domain postfix_exec_t:file { mmap_file_perms lock }; + +allow postfix_domain postfix_master_t:process sigchld; + +allow postfix_domain postfix_spool_t:dir list_dir_perms; + +allow postfix_domain postfix_var_run_t:file manage_file_perms; +files_pid_filetrans(postfix_domain, postfix_var_run_t, file) + +kernel_read_system_state(postfix_domain) +kernel_read_network_state(postfix_domain) +kernel_read_all_sysctls(postfix_domain) + +dev_read_sysfs(postfix_domain) +dev_read_rand(postfix_domain) +dev_read_urand(postfix_domain) + +fs_search_auto_mountpoints(postfix_domain) +fs_getattr_xattr_fs(postfix_domain) +fs_rw_anon_inodefs_files(postfix_domain) + +term_dontaudit_use_console(postfix_domain) + +corecmd_exec_shell(postfix_domain) + +files_read_etc_runtime_files(postfix_domain) +files_read_usr_files(postfix_domain) +files_read_usr_symlinks(postfix_domain) +files_search_spool(postfix_domain) +files_getattr_tmp_dirs(postfix_domain) +files_search_all_mountpoints(postfix_domain) + +init_dontaudit_use_fds(postfix_domain) +init_sigchld(postfix_domain) +init_dontaudit_rw_stream_socket(postfix_domain) + +miscfiles_read_generic_certs(postfix_domain) + +userdom_dontaudit_use_unpriv_user_fds(postfix_domain) + +optional_policy(` + spamd_stream_connect(postfix_domain) +') + +optional_policy(` + udev_read_db(postfix_domain) +') diff --git a/postfixpolicyd.if b/postfixpolicyd.if index feae93b..b2af729 100644 --- a/postfixpolicyd.if +++ b/postfixpolicyd.if @@ -20,12 +20,14 @@ interface(`postfixpolicyd_admin',` gen_require(` type postfix_policyd_t, postfix_policyd_conf_t; - type postfix_policyd_var_run_t; - type postfix_policyd_initrc_exec_t; + type postfix_policyd_var_run_t, postfix_policyd_initrc_exec_t; ') - allow $1 postfix_policyd_t:process { ptrace signal_perms }; + allow $1 postfix_policyd_t:process signal_perms; ps_process_pattern($1, postfix_policyd_t) + tunable_policy(`deny_ptrace',`',` + allow $1 postfix_policyd_t:process ptrace; + ') init_labeled_script_domtrans($1, postfix_policyd_initrc_exec_t) domain_system_change_exemption($1) diff --git a/postfixpolicyd.te b/postfixpolicyd.te index 7257526..e69e0d4 100644 --- a/postfixpolicyd.te +++ b/postfixpolicyd.te @@ -23,19 +23,18 @@ files_pid_file(postfix_policyd_var_run_t) # Local Policy # -allow postfix_policyd_t self:tcp_socket create_stream_socket_perms; allow postfix_policyd_t self:capability { sys_resource sys_chroot setgid setuid }; allow postfix_policyd_t self:process setrlimit; -allow postfix_policyd_t self:unix_dgram_socket { connect create write}; +allow postfix_policyd_t self:tcp_socket create_stream_socket_perms; +allow postfix_policyd_t self:unix_dgram_socket create_socket_perms; allow postfix_policyd_t postfix_policyd_conf_t:dir list_dir_perms; allow postfix_policyd_t postfix_policyd_conf_t:file read_file_perms; -allow postfix_policyd_t postfix_policyd_conf_t:lnk_file { getattr read }; +allow postfix_policyd_t postfix_policyd_conf_t:lnk_file read_lnk_file_perms; manage_files_pattern(postfix_policyd_t, postfix_policyd_var_run_t, postfix_policyd_var_run_t) files_pid_filetrans(postfix_policyd_t, postfix_policyd_var_run_t, file) -corenet_all_recvfrom_unlabeled(postfix_policyd_t) corenet_tcp_sendrecv_generic_if(postfix_policyd_t) corenet_tcp_sendrecv_generic_node(postfix_policyd_t) corenet_tcp_sendrecv_all_ports(postfix_policyd_t) @@ -48,6 +47,4 @@ files_read_usr_files(postfix_policyd_t) logging_send_syslog_msg(postfix_policyd_t) -miscfiles_read_localization(postfix_policyd_t) - sysnet_dns_name_resolve(postfix_policyd_t) diff --git a/postgrey.if b/postgrey.if index ad15fde..12202e1 100644 --- a/postgrey.if +++ b/postgrey.if @@ -15,9 +15,9 @@ interface(`postgrey_stream_connect',` type postgrey_var_run_t, postgrey_t, postgrey_spool_t; ') - stream_connect_pattern($1, postgrey_var_run_t, postgrey_var_run_t, postgrey_t) - stream_connect_pattern($1, postgrey_spool_t, postgrey_spool_t, postgrey_t) + stream_connect_pattern($1, { postgrey_spool_t postgrey_var_run_t }, { postgrey_spool_t postgrey_var_run_t }, postgrey_t) files_search_pids($1) + files_search_spool($1) ') ######################################## @@ -35,6 +35,7 @@ interface(`postgrey_search_spool',` type postgrey_spool_t; ') + files_search_spool($1) allow $1 postgrey_spool_t:dir search_dir_perms; ') @@ -57,13 +58,15 @@ interface(`postgrey_search_spool',` # interface(`postgrey_admin',` gen_require(` - type postgrey_t, postgrey_etc_t; + type postgrey_t, postgrey_etc_t, postgrey_initrc_exec_t; type postgrey_var_lib_t, postgrey_var_run_t; - type postgrey_initrc_exec_t; ') - allow $1 postgrey_t:process { ptrace signal_perms }; + allow $1 postgrey_t:process signal_perms; ps_process_pattern($1, postgrey_t) + tunable_policy(`deny_ptrace',`',` + allow $1 postgrey_t:process ptrace; + ') init_labeled_script_domtrans($1, postgrey_initrc_exec_t) domain_system_change_exemption($1) diff --git a/postgrey.te b/postgrey.te index db843e2..570cf36 100644 --- a/postgrey.te +++ b/postgrey.te @@ -16,7 +16,7 @@ type postgrey_initrc_exec_t; init_script_file(postgrey_initrc_exec_t) type postgrey_spool_t; -files_type(postgrey_spool_t) +files_spool_file(postgrey_spool_t) type postgrey_var_lib_t; files_type(postgrey_var_lib_t) @@ -58,7 +58,6 @@ kernel_read_kernel_sysctls(postgrey_t) # for perl corecmd_search_bin(postgrey_t) -corenet_all_recvfrom_unlabeled(postgrey_t) corenet_all_recvfrom_netlabel(postgrey_t) corenet_tcp_sendrecv_generic_if(postgrey_t) corenet_tcp_sendrecv_generic_node(postgrey_t) @@ -80,9 +79,9 @@ files_getattr_tmp_dirs(postgrey_t) fs_getattr_all_fs(postgrey_t) fs_search_auto_mountpoints(postgrey_t) -logging_send_syslog_msg(postgrey_t) +auth_read_passwd(postgrey_t) -miscfiles_read_localization(postgrey_t) +logging_send_syslog_msg(postgrey_t) sysnet_read_config(postgrey_t) diff --git a/ppp.fc b/ppp.fc index 2d82c6d..ff2c96a 100644 --- a/ppp.fc +++ b/ppp.fc @@ -11,19 +11,24 @@ # Fix /etc/ppp {up,down} family scripts (see man pppd) /etc/ppp/(auth|ip(v6|x)?)-(up|down) -- gen_context(system_u:object_r:pppd_initrc_exec_t,s0) +/usr/lib/systemd/system/ppp.* -- gen_context(system_u:object_r:iptables_unit_file_t,s0) + /root/.ppprc -- gen_context(system_u:object_r:pppd_etc_t,s0) # # /sbin # -/sbin/ppp-watch -- gen_context(system_u:object_r:pppd_exec_t,s0) +/sbin/pppoe-server -- gen_context(system_u:object_r:pppd_exec_t,s0) +/sbin/ppp-watch -- gen_context(system_u:object_r:pppd_exec_t,s0) # # /usr # +/usr/sbin/ipppd -- gen_context(system_u:object_r:pppd_exec_t,s0) +/usr/sbin/ppp-watch -- gen_context(system_u:object_r:pppd_exec_t,s0) /usr/sbin/pppd -- gen_context(system_u:object_r:pppd_exec_t,s0) +/usr/sbin/pppoe-server -- gen_context(system_u:object_r:pppd_exec_t,s0) /usr/sbin/pptp -- gen_context(system_u:object_r:pptp_exec_t,s0) -/usr/sbin/ipppd -- gen_context(system_u:object_r:pppd_exec_t,s0) # # /var @@ -34,5 +39,7 @@ # Fix pptp sockets /var/run/pptp(/.*)? gen_context(system_u:object_r:pptp_var_run_t,s0) +/var/lock/ppp(/.*)? gen_context(system_u:object_r:pppd_lock_t,s0) + /var/log/ppp-connect-errors.* -- gen_context(system_u:object_r:pppd_log_t,s0) -/var/log/ppp/.* -- gen_context(system_u:object_r:pppd_log_t,s0) +/var/log/ppp(/.*)? gen_context(system_u:object_r:pppd_log_t,s0) diff --git a/ppp.if b/ppp.if index de4bdb7..a4cad0b 100644 --- a/ppp.if +++ b/ppp.if @@ -66,7 +66,6 @@ interface(`ppp_sigchld',` ## ## # -# interface(`ppp_kill',` gen_require(` type pppd_t; @@ -176,11 +175,18 @@ interface(`ppp_run_cond',` # interface(`ppp_run',` gen_require(` - attribute_role pppd_roles; + #attribute_role pppd_roles; + type pppd_t; ') - ppp_domtrans($1) - roleattribute $2 pppd_roles; + #ppp_domtrans($1) + #roleattribute $2 pppd_roles; + + role $2 types pppd_t; + + tunable_policy(`pppd_for_user',` + ppp_domtrans($1) + ') ') ######################################## @@ -276,7 +282,8 @@ interface(`ppp_read_pid_files',` type pppd_var_run_t; ') - allow $1 pppd_var_run_t:file read_file_perms; + files_search_pids($1) + read_files_pattern($1, pppd_var_run_t, pppd_var_run_t) ') ######################################## @@ -294,6 +301,7 @@ interface(`ppp_manage_pid_files',` type pppd_var_run_t; ') + files_search_pids($1) allow $1 pppd_var_run_t:file manage_file_perms; ') @@ -335,6 +343,29 @@ interface(`ppp_initrc_domtrans',` ######################################## ## +## Execute pppd server in the pppd domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`ppp_systemctl',` + gen_require(` + type pppd_unit_file_t; + type pppd_t; + ') + + systemd_exec_systemctl($1) + allow $1 pppd_unit_file_t:file read_file_perms; + allow $1 pppd_unit_file_t:service manage_service_perms; + + ps_process_pattern($1, pppd_t) +') + +######################################## +## ## All of the rules required to administrate ## an ppp environment ## @@ -343,20 +374,31 @@ interface(`ppp_initrc_domtrans',` ## Domain allowed access. ## ## +## +## +## Role allowed access. +## +## ## # interface(`ppp_admin',` gen_require(` type pppd_t, pppd_tmp_t, pppd_log_t, pppd_lock_t; - type pppd_etc_t, pppd_secret_t; - type pppd_etc_rw_t, pppd_var_run_t; - + type pppd_etc_t, pppd_secret_t, pppd_var_run_t; type pptp_t, pptp_log_t, pptp_var_run_t; - type pppd_initrc_exec_t; + type pppd_initrc_exec_t, pppd_etc_rw_t; + type pppd_unit_file_t; ') - allow $1 pppd_t:process { ptrace signal_perms getattr }; + allow $1 pppd_t:process signal_perms; ps_process_pattern($1, pppd_t) + tunable_policy(`deny_ptrace',`',` + allow $1 pppd_t:process ptrace; + allow $1 pptp_t:process ptrace; + ') + + allow $1 pptp_t:process signal_perms; + ps_process_pattern($1, pptp_t) ppp_initrc_domtrans($1) domain_system_change_exemption($1) @@ -369,6 +411,7 @@ interface(`ppp_admin',` logging_list_logs($1) admin_pattern($1, pppd_log_t) + files_list_locks($1) admin_pattern($1, pppd_lock_t) files_list_etc($1) @@ -381,10 +424,11 @@ interface(`ppp_admin',` files_list_pids($1) admin_pattern($1, pppd_var_run_t) - allow $1 pptp_t:process { ptrace signal_perms getattr }; - ps_process_pattern($1, pptp_t) - admin_pattern($1, pptp_log_t) admin_pattern($1, pptp_var_run_t) + + ppp_systemctl($1) + admin_pattern($1, pppd_unit_file_t) + allow $1 pppd_unit_file_t:service all_service_perms; ') diff --git a/ppp.te b/ppp.te index bcbf9ac..a7f204b 100644 --- a/ppp.te +++ b/ppp.te @@ -19,14 +19,15 @@ gen_tunable(pppd_can_insmod, false) ## gen_tunable(pppd_for_user, false) -attribute_role pppd_roles; +#attribute_role pppd_roles; # pppd_t is the domain for the pppd program. # pppd_exec_t is the type of the pppd executable. type pppd_t; type pppd_exec_t; init_daemon_domain(pppd_t, pppd_exec_t) -role pppd_roles types pppd_t; +#role pppd_roles types pppd_t; +role system_r types pppd_t; type pppd_devpts_t; term_pty(pppd_devpts_t) @@ -42,6 +43,9 @@ files_type(pppd_etc_rw_t) type pppd_initrc_exec_t alias pppd_script_exec_t; init_script_file(pppd_initrc_exec_t) +type pppd_unit_file_t; +systemd_unit_file(pppd_unit_file_t) + # pppd_secret_t is the type of the pap and chap password files type pppd_secret_t; files_type(pppd_secret_t) @@ -61,7 +65,8 @@ files_pid_file(pppd_var_run_t) type pptp_t; type pptp_exec_t; init_daemon_domain(pptp_t, pptp_exec_t) -role pppd_roles types pptp_t; +#role pppd_roles types pptp_t; +role system_r types pptp_t; type pptp_log_t; logging_log_file(pptp_log_t) @@ -74,9 +79,9 @@ files_pid_file(pptp_var_run_t) # PPPD Local policy # -allow pppd_t self:capability { kill net_admin setuid setgid fsetid fowner net_raw dac_override }; +allow pppd_t self:capability { kill net_admin setuid setgid sys_admin fsetid fowner net_raw dac_override }; dontaudit pppd_t self:capability sys_tty_config; -allow pppd_t self:process { getsched signal }; +allow pppd_t self:process { getsched setsched signal }; allow pppd_t self:fifo_file rw_fifo_file_perms; allow pppd_t self:socket create_socket_perms; allow pppd_t self:unix_dgram_socket create_socket_perms; @@ -88,28 +93,29 @@ allow pppd_t self:packet_socket create_socket_perms; domtrans_pattern(pppd_t, pptp_exec_t, pptp_t) -allow pppd_t pppd_devpts_t:chr_file { rw_chr_file_perms setattr }; +allow pppd_t pppd_devpts_t:chr_file { rw_chr_file_perms setattr_chr_file_perms }; allow pppd_t pppd_etc_t:dir rw_dir_perms; allow pppd_t pppd_etc_t:file read_file_perms; -allow pppd_t pppd_etc_t:lnk_file { getattr read }; +allow pppd_t pppd_etc_t:lnk_file read_lnk_file_perms; manage_files_pattern(pppd_t, pppd_etc_rw_t, pppd_etc_rw_t) # Automatically label newly created files under /etc/ppp with this type filetrans_pattern(pppd_t, pppd_etc_t, pppd_etc_rw_t, file) -allow pppd_t pppd_lock_t:file manage_file_perms; -files_lock_filetrans(pppd_t, pppd_lock_t, file) +manage_files_pattern(pppd_t, pppd_lock_t, pppd_lock_t) +files_search_locks(pppd_t) -allow pppd_t pppd_log_t:file manage_file_perms; +manage_files_pattern(pppd_t, pppd_log_t, pppd_log_t) logging_log_filetrans(pppd_t, pppd_log_t, file) manage_dirs_pattern(pppd_t, pppd_tmp_t, pppd_tmp_t) manage_files_pattern(pppd_t, pppd_tmp_t, pppd_tmp_t) files_tmp_filetrans(pppd_t, pppd_tmp_t, { file dir }) +manage_dirs_pattern(pppd_t, pppd_var_run_t, pppd_var_run_t) manage_files_pattern(pppd_t, pppd_var_run_t, pppd_var_run_t) -files_pid_filetrans(pppd_t, pppd_var_run_t, file) +files_pid_filetrans(pppd_t, pppd_var_run_t, { dir file }) allow pppd_t pptp_t:process signal; @@ -130,7 +136,6 @@ dev_search_sysfs(pppd_t) dev_read_sysfs(pppd_t) dev_rw_modem(pppd_t) -corenet_all_recvfrom_unlabeled(pppd_t) corenet_all_recvfrom_netlabel(pppd_t) corenet_tcp_sendrecv_generic_if(pppd_t) corenet_raw_sendrecv_generic_if(pppd_t) @@ -147,10 +152,12 @@ fs_getattr_all_fs(pppd_t) fs_search_auto_mountpoints(pppd_t) term_use_unallocated_ttys(pppd_t) +term_use_usb_ttys(pppd_t) term_setattr_unallocated_ttys(pppd_t) term_ioctl_generic_ptys(pppd_t) # for pppoe term_create_pty(pppd_t, pppd_devpts_t) +term_use_generic_ptys(pppd_t) # allow running ip-up and ip-down scripts and running chat. corecmd_exec_bin(pppd_t) @@ -163,41 +170,51 @@ files_manage_etc_runtime_files(pppd_t) files_dontaudit_write_etc_files(pppd_t) # for scripts -files_read_etc_files(pppd_t) init_read_utmp(pppd_t) init_dontaudit_write_utmp(pppd_t) init_signal_script(pppd_t) auth_use_nsswitch(pppd_t) +auth_domtrans_chk_passwd(pppd_t) +#auth_run_chk_passwd(pppd_t,pppd_roles) +auth_write_login_records(pppd_t) logging_send_syslog_msg(pppd_t) logging_send_audit_msgs(pppd_t) -miscfiles_read_localization(pppd_t) - sysnet_exec_ifconfig(pppd_t) sysnet_manage_config(pppd_t) sysnet_etc_filetrans_config(pppd_t) -userdom_use_user_terminals(pppd_t) +userdom_use_inherited_user_terminals(pppd_t) userdom_dontaudit_use_unpriv_user_fds(pppd_t) userdom_search_user_home_dirs(pppd_t) +userdom_search_admin_dir(pppd_t) ppp_exec(pppd_t) optional_policy(` - ddclient_run(pppd_t, pppd_roles) + #ddclient_run(pppd_t, pppd_roles) + ddclient_domtrans(pppd_t) +') + +optional_policy(` + l2tpd_dgram_send(pppd_t) + l2tpd_rw_socket(pppd_t) + l2tpd_stream_connect(pppd_t) ') optional_policy(` tunable_policy(`pppd_can_insmod',` - modutils_domtrans_insmod(pppd_t) + modutils_domtrans_insmod_uncond(pppd_t) ') ') optional_policy(` mta_send_mail(pppd_t) + mta_system_content(pppd_etc_t) + mta_system_content(pppd_etc_rw_t) ') optional_policy(` @@ -247,21 +264,24 @@ allow pptp_t pppd_log_t:file append_file_perms; allow pptp_t pptp_log_t:file manage_file_perms; logging_log_filetrans(pptp_t, pptp_log_t, file) +manage_dirs_pattern(pptp_t, pptp_var_run_t, pptp_var_run_t) manage_files_pattern(pptp_t, pptp_var_run_t, pptp_var_run_t) manage_sock_files_pattern(pptp_t, pptp_var_run_t, pptp_var_run_t) -files_pid_filetrans(pptp_t, pptp_var_run_t, file) +files_pid_filetrans(pptp_t, pptp_var_run_t, { file dir }) kernel_list_proc(pptp_t) +kernel_signal(pptp_t) kernel_read_kernel_sysctls(pptp_t) +kernel_read_network_state(pptp_t) kernel_read_proc_symlinks(pptp_t) kernel_read_system_state(pptp_t) +kernel_signal(pptp_t) dev_read_sysfs(pptp_t) corecmd_exec_shell(pptp_t) corecmd_read_bin_symlinks(pptp_t) -corenet_all_recvfrom_unlabeled(pptp_t) corenet_all_recvfrom_netlabel(pptp_t) corenet_tcp_sendrecv_generic_if(pptp_t) corenet_raw_sendrecv_generic_if(pptp_t) @@ -273,7 +293,6 @@ corenet_tcp_connect_generic_port(pptp_t) corenet_tcp_connect_all_reserved_ports(pptp_t) corenet_sendrecv_generic_client_packets(pptp_t) -files_read_etc_files(pptp_t) fs_getattr_all_fs(pptp_t) fs_search_auto_mountpoints(pptp_t) @@ -288,8 +307,6 @@ auth_use_nsswitch(pptp_t) logging_send_syslog_msg(pptp_t) -miscfiles_read_localization(pptp_t) - sysnet_exec_ifconfig(pptp_t) userdom_dontaudit_use_unpriv_user_fds(pptp_t) diff --git a/prelink.fc b/prelink.fc index ec0e76a..62af9a4 100644 --- a/prelink.fc +++ b/prelink.fc @@ -4,7 +4,7 @@ /usr/sbin/prelink(\.bin)? -- gen_context(system_u:object_r:prelink_exec_t,s0) -/var/log/prelink\.log -- gen_context(system_u:object_r:prelink_log_t,s0) +/var/log/prelink\.log.* -- gen_context(system_u:object_r:prelink_log_t,s0) /var/log/prelink(/.*)? gen_context(system_u:object_r:prelink_log_t,s0) /var/lib/misc/prelink.* -- gen_context(system_u:object_r:prelink_var_lib_t,s0) diff --git a/prelink.te b/prelink.te index af55369..c77739c 100644 --- a/prelink.te +++ b/prelink.te @@ -36,7 +36,7 @@ files_type(prelink_var_lib_t) # Local policy # -allow prelink_t self:capability { chown dac_override fowner fsetid sys_resource }; +allow prelink_t self:capability { chown dac_override fowner fsetid setfcap sys_resource }; allow prelink_t self:process { execheap execmem execstack signal }; allow prelink_t self:fifo_file rw_fifo_file_perms; @@ -59,10 +59,11 @@ manage_dirs_pattern(prelink_t, prelink_var_lib_t, prelink_var_lib_t) manage_files_pattern(prelink_t, prelink_var_lib_t, prelink_var_lib_t) relabel_files_pattern(prelink_t, prelink_var_lib_t, prelink_var_lib_t) files_var_lib_filetrans(prelink_t, prelink_var_lib_t, { dir file }) +files_search_var_lib(prelink_t) # prelink misc objects that are not system # libraries or entrypoints -allow prelink_t prelink_object:file { manage_file_perms execute relabelto relabelfrom }; +allow prelink_t prelink_object:file { manage_file_perms execute relabel_file_perms }; kernel_read_system_state(prelink_t) kernel_read_kernel_sysctls(prelink_t) @@ -73,6 +74,7 @@ corecmd_mmap_all_executables(prelink_t) corecmd_read_bin_symlinks(prelink_t) dev_read_urand(prelink_t) +dev_getattr_all_chr_files(prelink_t) files_list_all(prelink_t) files_getattr_all_files(prelink_t) @@ -86,6 +88,8 @@ files_relabelfrom_usr_files(prelink_t) fs_getattr_xattr_fs(prelink_t) +storage_getattr_fixed_disk_dev(prelink_t) + selinux_get_enforce_mode(prelink_t) libs_exec_ld_so(prelink_t) @@ -96,9 +100,16 @@ libs_manage_shared_libs(prelink_t) libs_relabel_shared_libs(prelink_t) libs_delete_lib_symlinks(prelink_t) -miscfiles_read_localization(prelink_t) -userdom_use_user_terminals(prelink_t) +userdom_use_inherited_user_terminals(prelink_t) +userdom_manage_user_home_content(prelink_t) +userdom_relabel_user_home_files(prelink_t) +userdom_execmod_user_home_files(prelink_t) +userdom_exec_user_home_content_files(prelink_t) + +systemd_read_unit_files(prelink_t) + +term_use_all_inherited_terms(prelink_t) optional_policy(` amanda_manage_lib(prelink_t) @@ -109,6 +120,15 @@ optional_policy(` ') optional_policy(` + gnome_dontaudit_read_config(prelink_t) + gnome_dontaudit_read_inherited_gconf_config_files(prelink_t) +') + +optional_policy(` + mozilla_plugin_manage_rw_files(prelink_t) +') + +optional_policy(` rpm_manage_tmp_files(prelink_t) ') @@ -129,6 +149,7 @@ optional_policy(` read_files_pattern(prelink_cron_system_t, prelink_cache_t, prelink_cache_t) allow prelink_cron_system_t prelink_cache_t:file unlink; + files_delete_etc_dir_entry(prelink_cron_system_t) domtrans_pattern(prelink_cron_system_t, prelink_exec_t, prelink_t) allow prelink_cron_system_t prelink_t:process noatsecure; @@ -144,21 +165,39 @@ optional_policy(` corecmd_exec_bin(prelink_cron_system_t) corecmd_exec_shell(prelink_cron_system_t) + dev_list_sysfs(prelink_cron_system_t) + dev_read_sysfs(prelink_cron_system_t) + files_dontaudit_search_all_mountpoints(prelink_cron_system_t) files_read_etc_files(prelink_cron_system_t) files_search_var_lib(prelink_cron_system_t) + fs_search_cgroup_dirs(prelink_cron_system_t) + + auth_use_nsswitch(prelink_cron_system_t) + + init_telinit(prelink_cron_system_t) init_exec(prelink_cron_system_t) libs_exec_ld_so(prelink_cron_system_t) logging_search_logs(prelink_cron_system_t) - miscfiles_read_localization(prelink_cron_system_t) + init_stream_connect(prelink_cron_system_t) + cron_system_entry(prelink_cron_system_t, prelink_cron_system_exec_t) + userdom_dontaudit_list_admin_dir(prelink_cron_system_t) + optional_policy(` rpm_read_db(prelink_cron_system_t) ') ') + +ifdef(`hide_broken_symptoms', ` + optional_policy(` + dbus_read_config(prelink_t) + ') + miscfiles_read_man_pages(prelink_t) +') diff --git a/prelude.fc b/prelude.fc index 3bd847a..a52b025 100644 --- a/prelude.fc +++ b/prelude.fc @@ -5,6 +5,7 @@ /sbin/audisp-prelude -- gen_context(system_u:object_r:prelude_audisp_exec_t,s0) +/usr/sbin/audisp-prelude -- gen_context(system_u:object_r:prelude_audisp_exec_t,s0) /usr/bin/prelude-correlator -- gen_context(system_u:object_r:prelude_correlator_exec_t, s0) /usr/bin/prelude-lml -- gen_context(system_u:object_r:prelude_lml_exec_t,s0) /usr/bin/prelude-manager -- gen_context(system_u:object_r:prelude_exec_t,s0) diff --git a/prelude.if b/prelude.if index 2316653..f41a4f7 100644 --- a/prelude.if +++ b/prelude.if @@ -112,22 +112,24 @@ interface(`prelude_manage_spool',` # interface(`prelude_admin',` gen_require(` - type prelude_t, prelude_spool_t; - type prelude_var_run_t, prelude_var_lib_t; - type prelude_audisp_t, prelude_audisp_var_run_t; - type prelude_initrc_exec_t; - - type prelude_lml_t, prelude_lml_tmp_t; - type prelude_lml_var_run_t; + type prelude_t, prelude_spool_t, prelude_initrc_exec_t; + type prelude_var_run_t, prelude_var_lib_t, prelude_lml_var_run_t; + type prelude_audisp_t, prelude_audisp_var_run_t, prelude_lml_tmp_t; + type prelude_lml_t; ') - allow $1 prelude_t:process { ptrace signal_perms }; + allow $1 prelude_t:process signal_perms; ps_process_pattern($1, prelude_t) + tunable_policy(`deny_ptrace',`',` + allow $1 prelude_t:process ptrace; + allow $1 prelude_audisp_t:process ptrace; + allow $1 prelude_lml_t:process ptrace; + ') - allow $1 prelude_audisp_t:process { ptrace signal_perms }; + allow $1 prelude_audisp_t:process signal_perms; ps_process_pattern($1, prelude_audisp_t) - allow $1 prelude_lml_t:process { ptrace signal_perms }; + allow $1 prelude_lml_t:process signal_perms; ps_process_pattern($1, prelude_lml_t) init_labeled_script_domtrans($1, prelude_initrc_exec_t) @@ -135,10 +137,17 @@ interface(`prelude_admin',` role_transition $2 prelude_initrc_exec_t system_r; allow $2 system_r; + files_list_spool($1) admin_pattern($1, prelude_spool_t) + + files_list_var_lib($1) admin_pattern($1, prelude_var_lib_t) + + files_list_pids($1) admin_pattern($1, prelude_var_run_t) admin_pattern($1, prelude_audisp_var_run_t) - admin_pattern($1, prelude_lml_tmp_t) admin_pattern($1, prelude_lml_var_run_t) + + files_list_tmp($1) + admin_pattern($1, prelude_lml_tmp_t) ') diff --git a/prelude.te b/prelude.te index b1bc02c..a06f448 100644 --- a/prelude.te +++ b/prelude.te @@ -13,7 +13,7 @@ type prelude_initrc_exec_t; init_script_file(prelude_initrc_exec_t) type prelude_spool_t; -files_type(prelude_spool_t) +files_spool_file(prelude_spool_t) type prelude_log_t; logging_log_file(prelude_log_t) @@ -82,7 +82,6 @@ kernel_read_sysctl(prelude_t) corecmd_search_bin(prelude_t) -corenet_all_recvfrom_unlabeled(prelude_t) corenet_all_recvfrom_netlabel(prelude_t) corenet_tcp_sendrecv_generic_if(prelude_t) corenet_tcp_sendrecv_generic_node(prelude_t) @@ -95,7 +94,6 @@ corenet_tcp_connect_mysqld_port(prelude_t) dev_read_rand(prelude_t) dev_read_urand(prelude_t) -files_read_etc_files(prelude_t) files_read_etc_runtime_files(prelude_t) files_read_usr_files(prelude_t) files_search_tmp(prelude_t) @@ -107,8 +105,6 @@ auth_use_nsswitch(prelude_t) logging_send_audit_msgs(prelude_t) logging_send_syslog_msg(prelude_t) -miscfiles_read_localization(prelude_t) - optional_policy(` mysql_search_db(prelude_t) mysql_stream_connect(prelude_t) @@ -143,7 +139,6 @@ kernel_read_system_state(prelude_audisp_t) corecmd_search_bin(prelude_audisp_t) -corenet_all_recvfrom_unlabeled(prelude_audisp_t) corenet_all_recvfrom_netlabel(prelude_audisp_t) corenet_tcp_sendrecv_generic_if(prelude_audisp_t) corenet_tcp_sendrecv_generic_node(prelude_audisp_t) @@ -156,14 +151,11 @@ dev_read_urand(prelude_audisp_t) # Init script handling domain_use_interactive_fds(prelude_audisp_t) -files_read_etc_files(prelude_audisp_t) files_read_etc_runtime_files(prelude_audisp_t) files_search_tmp(prelude_audisp_t) logging_send_syslog_msg(prelude_audisp_t) -miscfiles_read_localization(prelude_audisp_t) - sysnet_dns_name_resolve(prelude_audisp_t) ######################################## @@ -183,7 +175,6 @@ kernel_read_sysctl(prelude_correlator_t) corecmd_search_bin(prelude_correlator_t) -corenet_all_recvfrom_unlabeled(prelude_correlator_t) corenet_all_recvfrom_netlabel(prelude_correlator_t) corenet_tcp_sendrecv_generic_if(prelude_correlator_t) corenet_tcp_sendrecv_generic_node(prelude_correlator_t) @@ -192,14 +183,11 @@ corenet_tcp_connect_prelude_port(prelude_correlator_t) dev_read_rand(prelude_correlator_t) dev_read_urand(prelude_correlator_t) -files_read_etc_files(prelude_correlator_t) files_read_usr_files(prelude_correlator_t) files_search_spool(prelude_correlator_t) logging_send_syslog_msg(prelude_correlator_t) -miscfiles_read_localization(prelude_correlator_t) - sysnet_dns_name_resolve(prelude_correlator_t) prelude_manage_spool(prelude_correlator_t) @@ -210,8 +198,8 @@ prelude_manage_spool(prelude_correlator_t) # allow prelude_lml_t self:capability dac_override; -allow prelude_lml_t self:tcp_socket { write getattr setopt read create connect }; -allow prelude_lml_t self:unix_dgram_socket { write create connect }; +allow prelude_lml_t self:tcp_socket { setopt create_socket_perms }; +allow prelude_lml_t self:unix_dgram_socket create_socket_perms; allow prelude_lml_t self:fifo_file rw_fifo_file_perms; allow prelude_lml_t self:unix_stream_socket connectto; @@ -236,10 +224,10 @@ kernel_read_sysctl(prelude_lml_t) corecmd_exec_bin(prelude_lml_t) +corenet_all_recvfrom_netlabel(prelude_lml_t) corenet_tcp_sendrecv_generic_if(prelude_lml_t) corenet_tcp_sendrecv_generic_node(prelude_lml_t) corenet_tcp_recvfrom_netlabel(prelude_lml_t) -corenet_tcp_recvfrom_unlabeled(prelude_lml_t) corenet_sendrecv_unlabeled_packets(prelude_lml_t) corenet_tcp_connect_prelude_port(prelude_lml_t) @@ -247,7 +235,6 @@ dev_read_rand(prelude_lml_t) dev_read_urand(prelude_lml_t) files_list_etc(prelude_lml_t) -files_read_etc_files(prelude_lml_t) files_read_etc_runtime_files(prelude_lml_t) fs_getattr_all_fs(prelude_lml_t) @@ -262,8 +249,6 @@ libs_read_lib_files(prelude_lml_t) logging_send_syslog_msg(prelude_lml_t) logging_read_generic_logs(prelude_lml_t) -miscfiles_read_localization(prelude_lml_t) - sysnet_dns_name_resolve(prelude_lml_t) userdom_read_all_users_state(prelude_lml_t) @@ -283,7 +268,6 @@ optional_policy(` can_exec(httpd_prewikka_script_t, httpd_prewikka_script_exec_t) - files_read_etc_files(httpd_prewikka_script_t) files_search_tmp(httpd_prewikka_script_t) kernel_read_sysctl(httpd_prewikka_script_t) diff --git a/privoxy.if b/privoxy.if index afd1751..5aff531 100644 --- a/privoxy.if +++ b/privoxy.if @@ -23,8 +23,11 @@ interface(`privoxy_admin',` type privoxy_etc_rw_t, privoxy_var_run_t; ') - allow $1 privoxy_t:process { ptrace signal_perms }; + allow $1 privoxy_t:process signal_perms; ps_process_pattern($1, privoxy_t) + tunable_policy(`deny_ptrace',`',` + allow $1 privoxy_t:process ptrace; + ') init_labeled_script_domtrans($1, privoxy_initrc_exec_t) domain_system_change_exemption($1) diff --git a/privoxy.te b/privoxy.te index 2dbf4d4..daa7c93 100644 --- a/privoxy.te +++ b/privoxy.te @@ -46,10 +46,10 @@ logging_log_filetrans(privoxy_t, privoxy_log_t, file) manage_files_pattern(privoxy_t, privoxy_var_run_t, privoxy_var_run_t) files_pid_filetrans(privoxy_t, privoxy_var_run_t, file) -kernel_read_system_state(privoxy_t) kernel_read_kernel_sysctls(privoxy_t) +kernel_read_network_state(privoxy_t) +kernel_read_system_state(privoxy_t) -corenet_all_recvfrom_unlabeled(privoxy_t) corenet_all_recvfrom_netlabel(privoxy_t) corenet_tcp_sendrecv_generic_if(privoxy_t) corenet_tcp_sendrecv_generic_node(privoxy_t) @@ -62,6 +62,7 @@ corenet_tcp_connect_squid_port(privoxy_t) corenet_tcp_connect_ftp_port(privoxy_t) corenet_tcp_connect_pgpkeyserver_port(privoxy_t) corenet_tcp_connect_tor_port(privoxy_t) +corenet_tcp_connect_tor_socks_port(privoxy_t) corenet_sendrecv_http_cache_client_packets(privoxy_t) corenet_sendrecv_squid_client_packets(privoxy_t) corenet_sendrecv_http_cache_server_packets(privoxy_t) @@ -76,18 +77,15 @@ fs_search_auto_mountpoints(privoxy_t) domain_use_interactive_fds(privoxy_t) -files_read_etc_files(privoxy_t) auth_use_nsswitch(privoxy_t) logging_send_syslog_msg(privoxy_t) -miscfiles_read_localization(privoxy_t) - userdom_dontaudit_use_unpriv_user_fds(privoxy_t) userdom_dontaudit_search_user_home_dirs(privoxy_t) # cjp: this should really not be needed -userdom_use_user_terminals(privoxy_t) +userdom_use_inherited_user_terminals(privoxy_t) tunable_policy(`privoxy_connect_any',` corenet_tcp_connect_all_ports(privoxy_t) diff --git a/procmail.fc b/procmail.fc index 1343621..4b36a13 100644 --- a/procmail.fc +++ b/procmail.fc @@ -1,3 +1,5 @@ +HOME_DIR/\.procmailrc -- gen_context(system_u:object_r:procmail_home_t, s0) +/root/\.procmailrc -- gen_context(system_u:object_r:procmail_home_t, s0) /usr/bin/procmail -- gen_context(system_u:object_r:procmail_exec_t,s0) diff --git a/procmail.if b/procmail.if index b64b02f..166e9c3 100644 --- a/procmail.if +++ b/procmail.if @@ -77,3 +77,22 @@ interface(`procmail_rw_tmp_files',` files_search_tmp($1) rw_files_pattern($1, procmail_tmp_t, procmail_tmp_t) ') + +######################################## +## +## Read procmail home directory content +## +## +## +## Domain allowed access. +## +## +# +interface(`procmail_read_home_files',` + gen_require(` + type procmail_home_t; + ') + + userdom_search_user_home_dirs($1) + read_files_pattern($1, procmail_home_t, procmail_home_t) +') diff --git a/procmail.te b/procmail.te index 29b9295..23625fc 100644 --- a/procmail.te +++ b/procmail.te @@ -10,6 +10,9 @@ type procmail_exec_t; application_domain(procmail_t, procmail_exec_t) role system_r types procmail_t; +type procmail_home_t; +userdom_user_home_content(procmail_home_t) + type procmail_log_t; logging_log_file(procmail_log_t) @@ -32,7 +35,7 @@ allow procmail_t self:udp_socket create_socket_perms; can_exec(procmail_t, procmail_exec_t) # Write log to /var/log/procmail.log or /var/log/procmail/.* -allow procmail_t procmail_log_t:dir setattr; +allow procmail_t procmail_log_t:dir setattr_dir_perms; create_files_pattern(procmail_t, procmail_log_t, procmail_log_t) append_files_pattern(procmail_t, procmail_log_t, procmail_log_t) read_lnk_files_pattern(procmail_t, procmail_log_t, procmail_log_t) @@ -44,7 +47,6 @@ files_tmp_filetrans(procmail_t, procmail_tmp_t, file) kernel_read_system_state(procmail_t) kernel_read_kernel_sysctls(procmail_t) -corenet_all_recvfrom_unlabeled(procmail_t) corenet_all_recvfrom_netlabel(procmail_t) corenet_tcp_sendrecv_generic_if(procmail_t) corenet_udp_sendrecv_generic_if(procmail_t) @@ -67,17 +69,23 @@ auth_use_nsswitch(procmail_t) corecmd_exec_bin(procmail_t) corecmd_exec_shell(procmail_t) -corecmd_read_bin_symlinks(procmail_t) -files_read_etc_files(procmail_t) files_read_etc_runtime_files(procmail_t) files_search_pids(procmail_t) # for spamassasin files_read_usr_files(procmail_t) +application_exec_all(procmail_t) + +init_read_utmp(procmail_t) + logging_send_syslog_msg(procmail_t) +logging_append_all_logs(procmail_t) -miscfiles_read_localization(procmail_t) +list_dirs_pattern(procmail_t, procmail_home_t, procmail_home_t) +read_files_pattern(procmail_t, procmail_home_t, procmail_home_t) +userdom_search_user_home_dirs(procmail_t) +userdom_search_admin_dir(procmail_t) # only works until we define a different type for maildir userdom_manage_user_home_content_dirs(procmail_t) @@ -87,8 +95,8 @@ userdom_manage_user_home_content_pipes(procmail_t) userdom_manage_user_home_content_sockets(procmail_t) userdom_user_home_dir_filetrans_user_home_content(procmail_t, { dir file lnk_file fifo_file sock_file }) -# Do not audit attempts to access /root. -userdom_dontaudit_search_user_home_dirs(procmail_t) +# Execute user executables +userdom_exec_user_bin_files(procmail_t) mta_manage_spool(procmail_t) mta_read_queue(procmail_t) @@ -97,21 +105,19 @@ ifdef(`hide_broken_symptoms',` mta_dontaudit_rw_queue(procmail_t) ') -tunable_policy(`use_nfs_home_dirs',` - fs_manage_nfs_dirs(procmail_t) - fs_manage_nfs_files(procmail_t) - fs_manage_nfs_symlinks(procmail_t) +userdom_home_manager(procmail_t) + +optional_policy(` + clamav_domtrans_clamscan(procmail_t) + clamav_search_lib(procmail_t) ') -tunable_policy(`use_samba_home_dirs',` - fs_manage_cifs_dirs(procmail_t) - fs_manage_cifs_files(procmail_t) - fs_manage_cifs_symlinks(procmail_t) +optional_policy(` + cyrus_stream_connect(procmail_t) ') optional_policy(` - clamav_domtrans_clamscan(procmail_t) - clamav_search_lib(procmail_t) + gnome_manage_data(procmail_t) ') optional_policy(` @@ -125,6 +131,11 @@ optional_policy(` postfix_read_spool_files(procmail_t) postfix_read_local_state(procmail_t) postfix_read_master_state(procmail_t) + postfix_rw_master_pipes(procmail_t) +') + +optional_policy(` + nagios_search_spool(procmail_t) ') optional_policy(` @@ -134,6 +145,7 @@ optional_policy(` optional_policy(` mta_read_config(procmail_t) + mta_manage_home_rw(procmail_t) sendmail_domtrans(procmail_t) sendmail_signal(procmail_t) sendmail_dontaudit_rw_tcp_sockets(procmail_t) diff --git a/psad.if b/psad.if index bc329d1..20bb463 100644 --- a/psad.if +++ b/psad.if @@ -91,7 +91,6 @@ interface(`psad_manage_config',` files_search_etc($1) manage_dirs_pattern($1, psad_etc_t, psad_etc_t) manage_files_pattern($1, psad_etc_t, psad_etc_t) - ') ######################################## @@ -115,7 +114,7 @@ interface(`psad_read_pid_files',` ######################################## ## -## Read psad PID files. +## Read and write psad PID files. ## ## ## @@ -176,6 +175,45 @@ interface(`psad_append_log',` ######################################## ## +## Allow the specified domain to write to psad's log files. +## +## +## +## Domain allowed access. +## +## +## +# +interface(`psad_write_log',` + gen_require(` + type psad_var_log_t; + ') + + logging_search_logs($1) + write_files_pattern($1, psad_var_log_t, psad_var_log_t) +') + +####################################### +## +## Allow the specified domain to setattr to psad's log files. +## +## +## +## Domain allowed access. +## +## +# +interface(`psad_setattr_log',` + gen_require(` + type psad_var_log_t; + ') + + logging_search_logs($1) + setattr_files_pattern($1, psad_var_log_t, psad_var_log_t) +') + +######################################## +## ## Read and write psad fifo files. ## ## @@ -186,7 +224,7 @@ interface(`psad_append_log',` # interface(`psad_rw_fifo_file',` gen_require(` - type psad_t; + type psad_t, psad_var_lib_t; ') files_search_var_lib($1) @@ -196,6 +234,26 @@ interface(`psad_rw_fifo_file',` ####################################### ## +## Allow setattr to psad fifo files. +## +## +## +## Domain allowed access. +## +## +# +interface(`psad_setattr_fifo_file',` + gen_require(` + type psad_t, psad_var_lib_t; + ') + + files_search_var_lib($1) + allow $1 psad_var_lib_t:fifo_file setattr; + search_dirs_pattern($1, psad_var_lib_t, psad_var_lib_t) +') + +####################################### +## ## Read and write psad tmp files. ## ## @@ -233,30 +291,33 @@ interface(`psad_rw_tmp_files',` interface(`psad_admin',` gen_require(` type psad_t, psad_var_run_t, psad_var_log_t; - type psad_initrc_exec_t, psad_var_lib_t; + type psad_initrc_exec_t, psad_var_lib_t, psad_etc_t; type psad_tmp_t; ') - allow $1 psad_t:process { ptrace signal_perms }; + allow $1 psad_t:process signal_perms; ps_process_pattern($1, psad_t) + tunable_policy(`deny_ptrace',`',` + allow $1 psad_t:process ptrace; + ') init_labeled_script_domtrans($1, psad_initrc_exec_t) domain_system_change_exemption($1) role_transition $2 psad_initrc_exec_t system_r; allow $2 system_r; - files_search_etc($1) + files_list_etc($1) admin_pattern($1, psad_etc_t) - files_search_pids($1) + files_list_pids($1) admin_pattern($1, psad_var_run_t) - logging_search_logs($1) + logging_list_logs($1) admin_pattern($1, psad_var_log_t) - files_search_var_lib($1) + files_list_var_lib($1) admin_pattern($1, psad_var_lib_t) - files_search_tmp($1) + files_list_tmp($1) admin_pattern($1, psad_tmp_t) ') diff --git a/psad.te b/psad.te index d4000e0..7fbcae1 100644 --- a/psad.te +++ b/psad.te @@ -11,7 +11,7 @@ init_daemon_domain(psad_t, psad_exec_t) # config files type psad_etc_t; -files_type(psad_etc_t) +files_config_file(psad_etc_t) type psad_initrc_exec_t; init_script_file(psad_initrc_exec_t) @@ -39,7 +39,7 @@ files_tmp_file(psad_tmp_t) allow psad_t self:capability { net_admin net_raw setuid setgid dac_override }; dontaudit psad_t self:capability sys_tty_config; -allow psad_t self:process signull; +allow psad_t self:process signal_perms; allow psad_t self:fifo_file rw_fifo_file_perms; allow psad_t self:rawip_socket create_socket_perms; @@ -53,9 +53,10 @@ manage_dirs_pattern(psad_t, psad_var_log_t, psad_var_log_t) logging_log_filetrans(psad_t, psad_var_log_t, { file dir }) # pid file +manage_dirs_pattern(psad_t, psad_var_run_t, psad_var_run_t) manage_files_pattern(psad_t, psad_var_run_t, psad_var_run_t) manage_sock_files_pattern(psad_t, psad_var_run_t, psad_var_run_t) -files_pid_filetrans(psad_t, psad_var_run_t, { file sock_file }) +files_pid_filetrans(psad_t, psad_var_run_t, { dir file sock_file }) # tmp files manage_dirs_pattern(psad_t, psad_tmp_t, psad_tmp_t) @@ -73,7 +74,6 @@ kernel_read_net_sysctls(psad_t) corecmd_exec_shell(psad_t) corecmd_exec_bin(psad_t) -corenet_all_recvfrom_unlabeled(psad_t) corenet_all_recvfrom_netlabel(psad_t) corenet_tcp_sendrecv_generic_if(psad_t) corenet_tcp_sendrecv_generic_node(psad_t) @@ -85,22 +85,23 @@ corenet_sendrecv_whois_client_packets(psad_t) dev_read_urand(psad_t) files_read_etc_runtime_files(psad_t) +files_read_usr_files(psad_t) fs_getattr_all_fs(psad_t) auth_use_nsswitch(psad_t) -iptables_domtrans(psad_t) - logging_read_generic_logs(psad_t) logging_read_syslog_config(psad_t) logging_send_syslog_msg(psad_t) -miscfiles_read_localization(psad_t) - sysnet_exec_ifconfig(psad_t) optional_policy(` + iptables_domtrans(psad_t) +') + +optional_policy(` mta_send_mail(psad_t) mta_read_queue(psad_t) ') diff --git a/ptchown.if b/ptchown.if index 96cc023..5919bbd 100644 --- a/ptchown.if +++ b/ptchown.if @@ -18,6 +18,24 @@ interface(`ptchown_domtrans',` domtrans_pattern($1, ptchown_exec_t, ptchown_t) ') +####################################### +## +## Execute ptchown in the caller domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`ptchown_exec',` + gen_require(` + type ptchown_exec_t; + ') + + can_exec($1, ptchown_exec_t) +') + ######################################## ## ## Execute ptchown in the ptchown domain, and diff --git a/ptchown.te b/ptchown.te index d90245a..f041531 100644 --- a/ptchown.te +++ b/ptchown.te @@ -28,4 +28,3 @@ term_setattr_all_ptys(ptchown_t) term_use_generic_ptys(ptchown_t) term_use_ptmx(ptchown_t) -miscfiles_read_localization(ptchown_t) diff --git a/pulseaudio.fc b/pulseaudio.fc index 84f23dc..5be2738 100644 --- a/pulseaudio.fc +++ b/pulseaudio.fc @@ -1,6 +1,11 @@ -HOME_DIR/\.pulse-cookie gen_context(system_u:object_r:pulseaudio_home_t,s0) +HOME_DIR/\.esd_auth -- gen_context(system_u:object_r:pulseaudio_home_t,s0) +HOME_DIR/\.pulse-cookie -- gen_context(system_u:object_r:pulseaudio_home_t,s0) HOME_DIR/\.pulse(/.*)? gen_context(system_u:object_r:pulseaudio_home_t,s0) +/root/\.esd_auth -- gen_context(system_u:object_r:pulseaudio_home_t,s0) +/root/\.pulse-cookie -- gen_context(system_u:object_r:pulseaudio_home_t,s0) +/root/\.pulse(/.*)? gen_context(system_u:object_r:pulseaudio_home_t,s0) + /usr/bin/pulseaudio -- gen_context(system_u:object_r:pulseaudio_exec_t,s0) /var/lib/pulse(/.*)? gen_context(system_u:object_r:pulseaudio_var_lib_t,s0) diff --git a/pulseaudio.if b/pulseaudio.if index f40c64d..d676e96 100644 --- a/pulseaudio.if +++ b/pulseaudio.if @@ -35,6 +35,9 @@ interface(`pulseaudio_role',` allow pulseaudio_t $2:unix_stream_socket connectto; allow $2 pulseaudio_t:unix_stream_socket connectto; + userdom_manage_tmp_role($1, pulseaudio_t) + userdom_manage_tmpfs_role($1, pulseaudio_t) + allow $2 pulseaudio_t:dbus send_msg; allow pulseaudio_t $2:dbus { acquire_svc send_msg }; ') @@ -151,12 +154,14 @@ interface(`pulseaudio_signull',` interface(`pulseaudio_stream_connect',` gen_require(` type pulseaudio_t, pulseaudio_var_run_t; + type pulseaudio_home_t; ') files_search_pids($1) allow $1 pulseaudio_t:process signull; allow pulseaudio_t $1:process signull; stream_connect_pattern($1, pulseaudio_var_run_t, pulseaudio_var_run_t, pulseaudio_t) + stream_connect_pattern($1, pulseaudio_home_t, pulseaudio_home_t, pulseaudio_t) ') ######################################## @@ -257,4 +262,87 @@ interface(`pulseaudio_manage_home_files',` userdom_search_user_home_dirs($1) manage_files_pattern($1, pulseaudio_home_t, pulseaudio_home_t) read_lnk_files_pattern($1, pulseaudio_home_t, pulseaudio_home_t) + pulseaudio_filetrans_home_content($1) + pulseaudio_filetrans_admin_home_content($1) +') + +######################################## +## +## Create, read, write, and delete pulseaudio +## home directory symlinks. +## +## +## +## Domain allowed access. +## +## +# +interface(`pulseaudio_manage_home_symlinks',` + gen_require(` + type pulseaudio_home_t; + ') + + userdom_search_user_home_dirs($1) + manage_lnk_files_pattern($1, pulseaudio_home_t, pulseaudio_home_t) +') + +######################################## +## +## Create pulseaudio content in the user home directory +## with an correct label. +## +## +## +## Domain allowed access. +## +## +# +interface(`pulseaudio_filetrans_home_content',` + gen_require(` + type pulseaudio_home_t; + ') + + userdom_user_home_dir_filetrans($1, pulseaudio_home_t, dir, ".pulse") + userdom_user_home_dir_filetrans($1, pulseaudio_home_t, file, ".pulse-cookie") + userdom_user_home_dir_filetrans($1, pulseaudio_home_t, file, ".esd_auth") +') + +######################################## +## +## Create pulseaudio content in the admin home directory +## with an correct label. +## +## +## +## Domain allowed access. +## +## +# +interface(`pulseaudio_filetrans_admin_home_content',` + gen_require(` + type pulseaudio_home_t; + ') + + userdom_admin_home_dir_filetrans($1, pulseaudio_home_t, dir, ".pulse") + userdom_admin_home_dir_filetrans($1, pulseaudio_home_t, file, ".pulse-cookie") + userdom_admin_home_dir_filetrans($1, pulseaudio_home_t, file, ".esd_auth") +') + +######################################## +## +## Allow the domain to read pulseaudio state files in /proc. +## +## +## +## Domain allowed access. +## +## +# +interface(`pulseaudio_read_state',` + gen_require(` + type pulseaudio_t; + ') + + kernel_search_proc($1) + ps_process_pattern($1, pulseaudio_t) ') diff --git a/pulseaudio.te b/pulseaudio.te index 901ac9b..639b9e4 100644 --- a/pulseaudio.te +++ b/pulseaudio.te @@ -41,7 +41,13 @@ allow pulseaudio_t self:netlink_kobject_uevent_socket create_socket_perms; manage_dirs_pattern(pulseaudio_t, pulseaudio_home_t, pulseaudio_home_t) manage_files_pattern(pulseaudio_t, pulseaudio_home_t, pulseaudio_home_t) +manage_lnk_files_pattern(pulseaudio_t, pulseaudio_home_t, pulseaudio_home_t) userdom_search_user_home_dirs(pulseaudio_t) +pulseaudio_filetrans_home_content(pulseaudio_t) + +# ~/.esd_auth - maybe we should label this pulseaudit_home_t? +userdom_read_user_home_content_files(pulseaudio_t) +userdom_search_admin_dir(pulseaudio_t) manage_dirs_pattern(pulseaudio_t, pulseaudio_var_lib_t, pulseaudio_var_lib_t) manage_files_pattern(pulseaudio_t, pulseaudio_var_lib_t, pulseaudio_var_lib_t) @@ -51,7 +57,7 @@ files_var_lib_filetrans(pulseaudio_t, pulseaudio_var_lib_t, { dir file }) manage_dirs_pattern(pulseaudio_t, pulseaudio_var_run_t, pulseaudio_var_run_t) manage_files_pattern(pulseaudio_t, pulseaudio_var_run_t, pulseaudio_var_run_t) manage_sock_files_pattern(pulseaudio_t, pulseaudio_var_run_t, pulseaudio_var_run_t) -files_pid_filetrans(pulseaudio_t, pulseaudio_var_run_t, { dir file }) +files_pid_filetrans(pulseaudio_t, pulseaudio_var_run_t, { file dir }) can_exec(pulseaudio_t, pulseaudio_exec_t) @@ -61,7 +67,6 @@ kernel_read_kernel_sysctls(pulseaudio_t) corecmd_exec_bin(pulseaudio_t) -corenet_all_recvfrom_unlabeled(pulseaudio_t) corenet_all_recvfrom_netlabel(pulseaudio_t) corenet_tcp_bind_pulseaudio_port(pulseaudio_t) corenet_tcp_bind_soundd_port(pulseaudio_t) @@ -76,26 +81,42 @@ dev_write_sound(pulseaudio_t) dev_read_sysfs(pulseaudio_t) dev_read_urand(pulseaudio_t) -files_read_etc_files(pulseaudio_t) files_read_usr_files(pulseaudio_t) fs_rw_anon_inodefs_files(pulseaudio_t) fs_getattr_tmpfs(pulseaudio_t) fs_list_inotifyfs(pulseaudio_t) -term_use_all_ttys(pulseaudio_t) -term_use_all_ptys(pulseaudio_t) +term_use_all_inherited_ttys(pulseaudio_t) +term_use_all_inherited_ptys(pulseaudio_t) auth_use_nsswitch(pulseaudio_t) logging_send_syslog_msg(pulseaudio_t) -miscfiles_read_localization(pulseaudio_t) +tunable_policy(`use_nfs_home_dirs',` + fs_mount_nfs(pulseaudio_t) + fs_mounton_nfs(pulseaudio_t) + fs_manage_nfs_dirs(pulseaudio_t) + fs_manage_nfs_files(pulseaudio_t) + fs_manage_nfs_symlinks(pulseaudio_t) + fs_manage_nfs_named_sockets(pulseaudio_t) + fs_manage_nfs_named_pipes(pulseaudio_t) +') + +tunable_policy(`use_samba_home_dirs',` + fs_mount_cifs(pulseaudio_t) + fs_mounton_cifs(pulseaudio_t) + fs_manage_cifs_dirs(pulseaudio_t) + fs_manage_cifs_files(pulseaudio_t) + fs_manage_cifs_symlinks(pulseaudio_t) + fs_manage_cifs_named_sockets(pulseaudio_t) + fs_manage_cifs_named_pipes(pulseaudio_t) +') -# cjp: this seems excessive. need to confirm -userdom_manage_user_home_content_files(pulseaudio_t) -userdom_manage_user_tmp_files(pulseaudio_t) -userdom_manage_user_tmpfs_files(pulseaudio_t) +optional_policy(` + alsa_read_rw_config(pulseaudio_t) +') optional_policy(` bluetooth_stream_connect(pulseaudio_t) @@ -125,16 +146,37 @@ optional_policy(` ') optional_policy(` + gnome_read_gkeyringd_state(pulseaudio_t) + gnome_signull_gkeyringd(pulseaudio_t) + gnome_manage_gstreamer_home_files(pulseaudio_t) + gnome_exec_gstreamer_home_files(pulseaudio_t) +') + +optional_policy(` rtkit_scheduled(pulseaudio_t) ') optional_policy(` + mozilla_plugin_delete_tmpfs_files(pulseaudio_t) + mozilla_plugin_read_tmpfs_files(pulseaudio_t) +') + +optional_policy(` + mpd_read_tmpfs_files(pulseaudio_t) +') + +optional_policy(` policykit_domtrans_auth(pulseaudio_t) policykit_read_lib(pulseaudio_t) policykit_read_reload(pulseaudio_t) ') optional_policy(` + systemd_read_logind_sessions_files(pulseaudio_t) + systemd_login_read_pid_files(pulseaudio_t) +') + +optional_policy(` udev_read_state(pulseaudio_t) udev_read_db(pulseaudio_t) ') @@ -146,3 +188,7 @@ optional_policy(` xserver_read_xdm_pid(pulseaudio_t) xserver_user_x_domain_template(pulseaudio, pulseaudio_t, pulseaudio_tmpfs_t) ') + +optional_policy(` + virt_manage_tmpfs_files(pulseaudio_t) +') diff --git a/puppet.fc b/puppet.fc index 2f1e529..8c0b242 100644 --- a/puppet.fc +++ b/puppet.fc @@ -3,6 +3,7 @@ /etc/rc\.d/init\.d/puppet -- gen_context(system_u:object_r:puppet_initrc_exec_t,s0) /etc/rc\.d/init\.d/puppetmaster -- gen_context(system_u:object_r:puppetmaster_initrc_exec_t,s0) +/usr/sbin/puppetca -- gen_context(system_u:object_r:puppetca_exec_t,s0) /usr/sbin/puppetd -- gen_context(system_u:object_r:puppet_exec_t,s0) /usr/sbin/puppetmasterd -- gen_context(system_u:object_r:puppetmaster_exec_t,s0) diff --git a/puppet.if b/puppet.if index 2855a44..6993089 100644 --- a/puppet.if +++ b/puppet.if @@ -8,6 +8,53 @@ ##

## +######################################## +## +## Execute puppetca in the puppetca +## domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`puppet_domtrans_puppetca',` + gen_require(` + type puppetca_t, puppetca_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, puppetca_exec_t, puppetca_t) +') + +##################################### +## +## Execute puppetca in the puppetca +## domain and allow the specified +## role the puppetca domain. +## +## +## +## Domain allowed to transition. +## +## +## +## +## Role allowed access. +## +## +## +# +interface(`puppet_run_puppetca',` + gen_require(` + type puppetca_t, puppetca_exec_t; + ') + + puppet_domtrans_puppetca($1) + role $2 types puppetca_t; +') + ################################################ ## ## Read / Write to Puppet temp files. Puppet uses @@ -26,6 +73,121 @@ interface(`puppet_rw_tmp', ` type puppet_tmp_t; ') - allow $1 puppet_tmp_t:file rw_file_perms; + allow $1 puppet_tmp_t:file rw_inherited_file_perms; files_search_tmp($1) ') + +################################################ +## +## Read Puppet lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`puppet_read_lib',` + gen_require(` + type puppet_var_lib_t; + ') + + read_files_pattern($1, puppet_var_lib_t, puppet_var_lib_t) + files_search_var_lib($1) +') + +############################################### +## +## Manage Puppet lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`puppet_manage_lib',` + gen_require(` + type puppet_var_lib_t; + ') + + manage_files_pattern($1, puppet_var_lib_t, puppet_var_lib_t) + files_search_var_lib($1) +') + +###################################### +## +## Allow the specified domain to search puppet's log files. +## +## +## +## Domain allowed access. +## +## +# +interface(`puppet_search_log',` + gen_require(` + type puppet_log_t; + ') + + logging_search_logs($1) + allow $1 puppet_log_t:dir search_dir_perms; +') + +##################################### +## +## Allow the specified domain to read puppet's log files. +## +## +## +## Domain allowed access. +## +## +# +interface(`puppet_read_log',` + gen_require(` + type puppet_log_t; + ') + + logging_search_logs($1) + read_files_pattern($1, puppet_log_t, puppet_log_t) +') + +#################################### +## +## Allow the specified domain to read puppet's config files. +## +## +## +## Domain allowed access. +## +## +# +interface(`puppet_read_config',` + gen_require(` + type puppet_etc_t; + ') + + logging_search_logs($1) + list_dirs_pattern($1, puppet_etc_t, puppet_etc_t) + read_files_pattern($1, puppet_etc_t, puppet_etc_t) +') + +##################################### +## +## Allow the specified domain to search puppet's pid files. +## +## +## +## Domain allowed access. +## +## +# +interface(`puppet_search_pid',` + gen_require(` + type puppet_var_run_t; + ') + + files_search_pids($1) + allow $1 puppet_var_run_t:dir search_dir_perms; +') diff --git a/puppet.te b/puppet.te index baa88f6..8a01e7c 100644 --- a/puppet.te +++ b/puppet.te @@ -13,6 +13,13 @@ policy_module(puppet, 1.3.0) ## gen_tunable(puppet_manage_all_files, false) +## +##

+## Allow Puppet master to use connect to MySQL and PostgreSQL database +##

+## +gen_tunable(puppetmaster_use_db, false) + type puppet_t; type puppet_exec_t; init_daemon_domain(puppet_t, puppet_exec_t) @@ -35,6 +42,11 @@ files_type(puppet_var_lib_t) type puppet_var_run_t; files_pid_file(puppet_var_run_t) +type puppetca_t; +type puppetca_exec_t; +application_domain(puppetca_t, puppetca_exec_t) +role system_r types puppetca_t; + type puppetmaster_t; type puppetmaster_exec_t; init_daemon_domain(puppetmaster_t, puppetmaster_exec_t) @@ -50,7 +62,7 @@ files_tmp_file(puppetmaster_tmp_t) # Puppet personal policy # -allow puppet_t self:capability { fowner fsetid setuid setgid dac_override sys_nice sys_ptrace sys_tty_config }; +allow puppet_t self:capability { fowner fsetid setuid setgid dac_override sys_nice sys_tty_config }; allow puppet_t self:process { signal signull getsched setsched }; allow puppet_t self:fifo_file rw_fifo_file_perms; allow puppet_t self:netlink_route_socket create_netlink_socket_perms; @@ -63,7 +75,7 @@ manage_dirs_pattern(puppet_t, puppet_var_lib_t, puppet_var_lib_t) manage_files_pattern(puppet_t, puppet_var_lib_t, puppet_var_lib_t) files_search_var_lib(puppet_t) -setattr_dirs_pattern(puppet_t, puppet_var_run_t, puppet_var_run_t) +manage_dirs_pattern(puppet_t, puppet_var_run_t, puppet_var_run_t) manage_files_pattern(puppet_t, puppet_var_run_t, puppet_var_run_t) files_pid_filetrans(puppet_t, puppet_var_run_t, { file dir }) @@ -80,12 +92,14 @@ kernel_dontaudit_search_sysctl(puppet_t) kernel_dontaudit_search_kernel_sysctl(puppet_t) kernel_read_system_state(puppet_t) kernel_read_crypto_sysctls(puppet_t) +kernel_read_kernel_sysctls(puppet_t) +corecmd_read_all_executables(puppet_t) +corecmd_dontaudit_access_all_executables(puppet_t) corecmd_exec_bin(puppet_t) corecmd_exec_shell(puppet_t) corenet_all_recvfrom_netlabel(puppet_t) -corenet_all_recvfrom_unlabeled(puppet_t) corenet_tcp_sendrecv_generic_if(puppet_t) corenet_tcp_sendrecv_generic_node(puppet_t) corenet_tcp_bind_generic_node(puppet_t) @@ -103,6 +117,7 @@ files_manage_config_files(puppet_t) files_manage_config_dirs(puppet_t) files_manage_etc_dirs(puppet_t) files_manage_etc_files(puppet_t) +files_read_usr_files(puppet_t) files_read_usr_symlinks(puppet_t) files_relabel_config_dirs(puppet_t) files_relabel_config_files(puppet_t) @@ -115,6 +130,8 @@ selinux_validate_context(puppet_t) term_dontaudit_getattr_unallocated_ttys(puppet_t) term_dontaudit_getattr_all_ttys(puppet_t) +auth_use_nsswitch(puppet_t) + init_all_labeled_script_domtrans(puppet_t) init_domtrans_script(puppet_t) init_read_utmp(puppet_t) @@ -123,22 +140,23 @@ init_signull_script(puppet_t) logging_send_syslog_msg(puppet_t) miscfiles_read_hwdata(puppet_t) -miscfiles_read_localization(puppet_t) - -mount_domtrans(puppet_t) seutil_domtrans_setfiles(puppet_t) seutil_domtrans_semanage(puppet_t) +seutil_read_file_contexts(puppet_t) -sysnet_dns_name_resolve(puppet_t) sysnet_run_ifconfig(puppet_t, system_r) tunable_policy(`puppet_manage_all_files',` - files_manage_non_auth_files(puppet_t) + files_manage_non_security_files(puppet_t) +') + +optional_policy(` + cfengine_read_lib_files(puppet_t) ') optional_policy(` - consoletype_domtrans(puppet_t) + consoletype_exec(puppet_t) ') optional_policy(` @@ -146,6 +164,14 @@ optional_policy(` ') optional_policy(` + mount_domtrans(puppet_t) +') + +optional_policy(` + mta_send_mail(puppet_t) +') + +optional_policy(` portage_domtrans(puppet_t) portage_domtrans_fetch(puppet_t) portage_domtrans_gcc_config(puppet_t) @@ -164,8 +190,134 @@ optional_policy(` ') optional_policy(` - usermanage_domtrans_groupadd(puppet_t) - usermanage_domtrans_useradd(puppet_t) + usermanage_access_check_groupadd(puppet_t) + usermanage_access_check_passwd(puppet_t) + usermanage_access_check_useradd(puppet_t) +') + +optional_policy(` + auth_filetrans_named_content(puppet_t) +') + +optional_policy(` + alsa_filetrans_named_content(puppet_t) +') + +optional_policy(` + bootloader_filetrans_config(puppet_t) +') + +optional_policy(` + devicekit_filetrans_named_content(puppet_t) +') + +optional_policy(` + dnsmasq_filetrans_named_content(puppet_t) +') + +optional_policy(` + kerberos_filetrans_named_content(puppet_t) +') + +optional_policy(` + libs_filetrans_named_content(puppet_t) +') + +optional_policy(` + miscfiles_filetrans_named_content(puppet_t) +') + +optional_policy(` + mta_filetrans_named_content(puppet_t) +') + +optional_policy(` + modules_filetrans_named_content(puppet_t) +') + +optional_policy(` + networkmanager_filetrans_named_content(puppet_t) +') + +optional_policy(` + nx_filetrans_named_content(puppet_t) +') + +optional_policy(` + postfix_filetrans_named_content(puppet_t) +') + +optional_policy(` + openshift_initrc_domtrans(puppet_t) +') + +optional_policy(` + quota_filetrans_named_content(puppet_t) +') + +optional_policy(` + sysnet_filetrans_named_content(puppet_t) +') + +optional_policy(` + virt_filetrans_home_content(puppet_t) +') + +optional_policy(` + ssh_filetrans_admin_home_content(puppet_t) +') + +######################################## +# +# PuppetCA personal policy +# + +allow puppetca_t self:capability { dac_override setgid setuid }; +allow puppetca_t self:fifo_file rw_fifo_file_perms; + +read_files_pattern(puppetca_t, puppet_etc_t, puppet_etc_t) + +allow puppetca_t puppet_var_lib_t:dir list_dir_perms; +manage_files_pattern(puppetca_t, puppet_var_lib_t, puppet_var_lib_t) +manage_dirs_pattern(puppetca_t, puppet_var_lib_t, puppet_var_lib_t) + +allow puppetca_t puppet_log_t:dir search_dir_perms; + +allow puppetca_t puppet_var_run_t:dir search_dir_perms; + +kernel_read_system_state(puppetca_t) +# Maybe dontaudit this like we did with other puppet domains? +kernel_read_kernel_sysctls(puppetca_t) + +corecmd_exec_bin(puppetca_t) +corecmd_exec_shell(puppetca_t) + +dev_read_urand(puppetca_t) +dev_search_sysfs(puppetca_t) + +files_read_etc_files(puppetca_t) +files_search_var_lib(puppetca_t) + +selinux_validate_context(puppetca_t) + +logging_search_logs(puppetca_t) + +miscfiles_read_generic_certs(puppetca_t) + +seutil_read_file_contexts(puppetca_t) + +optional_policy(` + hostname_exec(puppetca_t) +') + +optional_policy(` + mta_sendmail_access_check(puppetca_t) +') + +optional_policy(` + usermanage_access_check_groupadd(puppet_t) + usermanage_access_check_passwd(puppet_t) + usermanage_access_check_useradd(puppet_t) ') ######################################## @@ -184,51 +336,83 @@ allow puppetmaster_t self:udp_socket create_socket_perms; list_dirs_pattern(puppetmaster_t, puppet_etc_t, puppet_etc_t) read_files_pattern(puppetmaster_t, puppet_etc_t, puppet_etc_t) -allow puppetmaster_t puppet_log_t:dir { rw_dir_perms setattr }; -allow puppetmaster_t puppet_log_t:file { rw_file_perms create setattr }; +allow puppetmaster_t puppet_log_t:dir { rw_dir_perms setattr_dir_perms }; +allow puppetmaster_t puppet_log_t:file { rw_file_perms create_file_perms setattr_file_perms }; logging_log_filetrans(puppetmaster_t, puppet_log_t, { file dir }) +allow puppetmaster_t puppet_log_t:file relabel_file_perms; manage_dirs_pattern(puppetmaster_t, puppet_var_lib_t, puppet_var_lib_t) manage_files_pattern(puppetmaster_t, puppet_var_lib_t, puppet_var_lib_t) +allow puppetmaster_t puppet_var_lib_t:dir relabel_dir_perms; +allow puppetmaster_t puppet_var_lib_t:file relabel_file_perms; setattr_dirs_pattern(puppetmaster_t, puppet_var_run_t, puppet_var_run_t) +create_dirs_pattern(puppetmaster_t, puppet_var_run_t, puppet_var_run_t) manage_files_pattern(puppetmaster_t, puppet_var_run_t, puppet_var_run_t) files_pid_filetrans(puppetmaster_t, puppet_var_run_t, { file dir }) +allow puppetmaster_t puppet_var_run_t:dir relabel_dir_perms; manage_dirs_pattern(puppetmaster_t, puppetmaster_tmp_t, puppetmaster_tmp_t) manage_files_pattern(puppetmaster_t, puppetmaster_tmp_t, puppetmaster_tmp_t) files_tmp_filetrans(puppetmaster_t, puppetmaster_tmp_t, { file dir }) +allow puppetmaster_t puppet_tmp_t:dir relabel_dir_perms; kernel_dontaudit_search_kernel_sysctl(puppetmaster_t) +kernel_read_network_state(puppetmaster_t) kernel_read_system_state(puppetmaster_t) kernel_read_crypto_sysctls(puppetmaster_t) +kernel_read_kernel_sysctls(puppetmaster_t) corecmd_exec_bin(puppetmaster_t) corecmd_exec_shell(puppetmaster_t) corenet_all_recvfrom_netlabel(puppetmaster_t) -corenet_all_recvfrom_unlabeled(puppetmaster_t) corenet_tcp_sendrecv_generic_if(puppetmaster_t) corenet_tcp_sendrecv_generic_node(puppetmaster_t) corenet_tcp_bind_generic_node(puppetmaster_t) corenet_tcp_bind_puppet_port(puppetmaster_t) corenet_sendrecv_puppet_server_packets(puppetmaster_t) +corenet_tcp_connect_ntop_port(puppetmaster_t) + +# This needs investigation. Puppermasterd is confirmed to bind udp sockets to random high ports. +corenet_udp_bind_generic_node(puppetmaster_t) +corenet_udp_bind_generic_port(puppetmaster_t) dev_read_rand(puppetmaster_t) dev_read_urand(puppetmaster_t) +dev_search_sysfs(puppetmaster_t) domain_read_all_domains_state(puppetmaster_t) +domain_obj_id_change_exemption(puppetmaster_t) -files_read_etc_files(puppetmaster_t) -files_search_var_lib(puppetmaster_t) +files_read_usr_files(puppetmaster_t) + +selinux_validate_context(puppetmaster_t) + +auth_use_nsswitch(puppetmaster_t) logging_send_syslog_msg(puppetmaster_t) -miscfiles_read_localization(puppetmaster_t) +miscfiles_read_generic_certs(puppetmaster_t) + +seutil_read_file_contexts(puppetmaster_t) -sysnet_dns_name_resolve(puppetmaster_t) sysnet_run_ifconfig(puppetmaster_t, system_r) +mta_send_mail(puppetmaster_t) + +optional_policy(` + tunable_policy(`puppetmaster_use_db',` + mysql_stream_connect(puppetmaster_t) + ') +') + +optional_policy(` + tunable_policy(`puppetmaster_use_db',` + postgresql_stream_connect(puppetmaster_t) + ') +') + optional_policy(` hostname_exec(puppetmaster_t) ') @@ -239,3 +423,9 @@ optional_policy(` rpm_exec(puppetmaster_t) rpm_read_db(puppetmaster_t) ') + +optional_policy(` + usermanage_access_check_groupadd(puppetmaster_t) + usermanage_access_check_passwd(puppetmaster_t) + usermanage_access_check_useradd(puppetmaster_t) +') diff --git a/pwauth.fc b/pwauth.fc new file mode 100644 index 0000000..e2f8687 --- /dev/null +++ b/pwauth.fc @@ -0,0 +1,3 @@ +/usr/bin/pwauth -- gen_context(system_u:object_r:pwauth_exec_t,s0) + +/var/run/pwauth.lock -- gen_context(system_u:object_r:pwauth_var_run_t,s0) diff --git a/pwauth.if b/pwauth.if new file mode 100644 index 0000000..86d25ea --- /dev/null +++ b/pwauth.if @@ -0,0 +1,74 @@ + +## policy for pwauth + +######################################## +## +## Transition to pwauth. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`pwauth_domtrans',` + gen_require(` + type pwauth_t, pwauth_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, pwauth_exec_t, pwauth_t) +') + +######################################## +## +## Execute pwauth in the pwauth domain, and +## allow the specified role the pwauth domain. +## +## +## +## Domain allowed to transition +## +## +## +## +## The role to be allowed the pwauth domain. +## +## +# +interface(`pwauth_run',` + gen_require(` + type pwauth_t; + ') + + pwauth_domtrans($1) + role $2 types pwauth_t; +') + +######################################## +## +## Role access for pwauth +## +## +## +## Role allowed access +## +## +## +## +## User domain for the role +## +## +# +interface(`pwauth_role',` + gen_require(` + type pwauth_t; + ') + + role $1 types pwauth_t; + + pwauth_domtrans($2) + + ps_process_pattern($2, pwauth_t) + allow $2 pwauth_t:process signal; +') diff --git a/pwauth.te b/pwauth.te new file mode 100644 index 0000000..8f357cc --- /dev/null +++ b/pwauth.te @@ -0,0 +1,39 @@ +policy_module(pwauth, 1.0.0) + +######################################## +# +# Declarations +# + +type pwauth_t; +type pwauth_exec_t; +application_domain(pwauth_t, pwauth_exec_t) +role system_r types pwauth_t; + +type pwauth_var_run_t; +files_pid_file(pwauth_var_run_t) + +######################################## +# +# pwauth local policy +# +allow pwauth_t self:capability setuid; +allow pwauth_t self:process setrlimit; + +allow pwauth_t self:fifo_file manage_fifo_file_perms; +allow pwauth_t self:unix_stream_socket create_stream_socket_perms; + +manage_files_pattern(pwauth_t, pwauth_var_run_t, pwauth_var_run_t) +files_pid_filetrans(pwauth_t, pwauth_var_run_t, file) + +domain_use_interactive_fds(pwauth_t) + + +auth_domtrans_chkpwd(pwauth_t) +auth_use_nsswitch(pwauth_t) +auth_read_shadow(pwauth_t) + +init_read_utmp(pwauth_t) + +logging_send_syslog_msg(pwauth_t) +logging_send_audit_msgs(pwauth_t) diff --git a/pxe.fc b/pxe.fc index 44b3a0c..5d247cb 100644 --- a/pxe.fc +++ b/pxe.fc @@ -1,6 +1,6 @@ /usr/sbin/pxe -- gen_context(system_u:object_r:pxe_exec_t,s0) -/var/log/pxe\.log -- gen_context(system_u:object_r:pxe_log_t,s0) +/var/log/pxe\.log.* -- gen_context(system_u:object_r:pxe_log_t,s0) /var/run/pxe\.pid -- gen_context(system_u:object_r:pxe_var_run_t,s0) diff --git a/pxe.te b/pxe.te index fec69eb..848c311 100644 --- a/pxe.te +++ b/pxe.te @@ -49,8 +49,6 @@ fs_search_auto_mountpoints(pxe_t) logging_send_syslog_msg(pxe_t) -miscfiles_read_localization(pxe_t) - userdom_dontaudit_use_unpriv_user_fds(pxe_t) userdom_dontaudit_search_user_home_dirs(pxe_t) diff --git a/pyicqt.te b/pyicqt.te index a841221..c653e4a 100644 --- a/pyicqt.te +++ b/pyicqt.te @@ -13,7 +13,7 @@ type pyicqt_conf_t; files_config_file(pyicqt_conf_t) type pyicqt_spool_t; -files_type(pyicqt_spool_t) +files_spool_file(pyicqt_spool_t) type pyicqt_var_run_t; files_pid_file(pyicqt_var_run_t) @@ -40,7 +40,6 @@ kernel_read_system_state(pyicqt_t) corecmd_exec_bin(pyicqt_t) -corenet_all_recvfrom_unlabeled(pyicqt_t) corenet_all_recvfrom_netlabel(pyicqt_t) corenet_tcp_sendrecv_generic_if(pyicqt_t) corenet_tcp_sendrecv_generic_node(pyicqt_t) @@ -54,6 +53,5 @@ files_read_usr_files(pyicqt_t) libs_read_lib_files(pyicqt_t) -miscfiles_read_localization(pyicqt_t) sysnet_read_config(pyicqt_t) diff --git a/pyzor.fc b/pyzor.fc index d4a7750..a927c5a 100644 --- a/pyzor.fc +++ b/pyzor.fc @@ -1,9 +1,13 @@ /etc/pyzor(/.*)? gen_context(system_u:object_r:pyzor_etc_t, s0) +/etc/rc\.d/init\.d/pyzord -- gen_context(system_u:object_r:pyzord_initrc_exec_t,s0) HOME_DIR/\.pyzor(/.*)? gen_context(system_u:object_r:pyzor_home_t,s0) +HOME_DIR/\.spamd(/.*)? gen_context(system_u:object_r:pyzor_home_t,s0) +/root/\.pyzor(/.*)? gen_context(system_u:object_r:pyzor_home_t,s0) +/root/\.spamd(/.*)? gen_context(system_u:object_r:pyzor_home_t,s0) /usr/bin/pyzor -- gen_context(system_u:object_r:pyzor_exec_t,s0) /usr/bin/pyzord -- gen_context(system_u:object_r:pyzord_exec_t,s0) /var/lib/pyzord(/.*)? gen_context(system_u:object_r:pyzor_var_lib_t,s0) -/var/log/pyzord\.log -- gen_context(system_u:object_r:pyzord_log_t,s0) +/var/log/pyzord\.log.* -- gen_context(system_u:object_r:pyzord_log_t,s0) diff --git a/pyzor.if b/pyzor.if index 494f7e2..2c411af 100644 --- a/pyzor.if +++ b/pyzor.if @@ -14,6 +14,7 @@ ## User domain for the role ## ## +## # interface(`pyzor_role',` gen_require(` @@ -28,7 +29,10 @@ interface(`pyzor_role',` # allow ps to show pyzor and allow the user to kill it ps_process_pattern($2, pyzor_t) - allow $2 pyzor_t:process signal; + allow $2 pyzor_t:process signal_perms; + tunable_policy(`deny_ptrace',`',` + allow $2 pyzor_t:process ptrace; + ') ') ######################################## @@ -88,3 +92,50 @@ interface(`pyzor_exec',` corecmd_search_bin($1) can_exec($1, pyzor_exec_t) ') + +######################################## +## +## All of the rules required to administrate +## an pyzor environment +## +## +## +## Domain allowed access. +## +## +## +## +## The role to be allowed to manage the pyzor domain. +## +## +## +# +interface(`pyzor_admin',` + gen_require(` + type pyzord_t, pyzor_tmp_t, pyzord_log_t; + type pyzor_etc_t, pyzor_var_lib_t, pyzord_initrc_exec_t; + ') + + allow $1 pyzord_t:process signal_perms; + ps_process_pattern($1, pyzord_t) + tunable_policy(`deny_ptrace',`',` + allow $1 pyzord_t:process ptrace; + ') + + init_labeled_script_domtrans($1, pyzord_initrc_exec_t) + domain_system_change_exemption($1) + role_transition $2 pyzord_initrc_exec_t system_r; + allow $2 system_r; + + files_list_tmp($1) + admin_pattern($1, pyzor_tmp_t) + + logging_list_logs($1) + admin_pattern($1, pyzord_log_t) + + files_list_etc($1) + admin_pattern($1, pyzor_etc_t) + + files_list_var_lib($1) + admin_pattern($1, pyzor_var_lib_t) +') diff --git a/pyzor.te b/pyzor.te index c8fb70b..f7bf36e 100644 --- a/pyzor.te +++ b/pyzor.te @@ -1,42 +1,66 @@ -policy_module(pyzor, 2.2.0) +policy_module(pyzor, 2.1.0) ######################################## # # Declarations # -type pyzor_t; -type pyzor_exec_t; -typealias pyzor_t alias { user_pyzor_t staff_pyzor_t sysadm_pyzor_t }; -typealias pyzor_t alias { auditadm_pyzor_t secadm_pyzor_t }; -userdom_user_application_domain(pyzor_t, pyzor_exec_t) -role system_r types pyzor_t; - -type pyzor_etc_t; -files_type(pyzor_etc_t) - -type pyzor_home_t; -typealias pyzor_home_t alias { user_pyzor_home_t staff_pyzor_home_t sysadm_pyzor_home_t }; -typealias pyzor_home_t alias { auditadm_pyzor_home_t secadm_pyzor_home_t }; -userdom_user_home_content(pyzor_home_t) - -type pyzor_tmp_t; -typealias pyzor_tmp_t alias { user_pyzor_tmp_t staff_pyzor_tmp_t sysadm_pyzor_tmp_t }; -typealias pyzor_tmp_t alias { auditadm_pyzor_tmp_t secadm_pyzor_tmp_t }; -userdom_user_tmp_file(pyzor_tmp_t) - -type pyzor_var_lib_t; -typealias pyzor_var_lib_t alias { user_pyzor_var_lib_t staff_pyzor_var_lib_t sysadm_pyzor_var_lib_t }; -typealias pyzor_var_lib_t alias { auditadm_pyzor_var_lib_t secadm_pyzor_var_lib_t }; -files_type(pyzor_var_lib_t) -ubac_constrained(pyzor_var_lib_t) - -type pyzord_t; -type pyzord_exec_t; -init_daemon_domain(pyzord_t, pyzord_exec_t) - -type pyzord_log_t; -logging_log_file(pyzord_log_t) +ifdef(`distro_redhat',` + gen_require(` + type spamc_t, spamc_exec_t, spamd_t; + type spamd_initrc_exec_t, spamd_exec_t, spamc_tmp_t; + type spamd_log_t, spamd_var_lib_t, spamd_etc_t; + type spamc_tmp_t, spamc_home_t; + ') + + typealias spamc_t alias pyzor_t; + typealias spamc_exec_t alias pyzor_exec_t; + typealias spamd_t alias pyzord_t; + typealias spamd_initrc_exec_t alias pyzord_initrc_exec_t; + typealias spamd_exec_t alias pyzord_exec_t; + typealias spamc_tmp_t alias pyzor_tmp_t; + typealias spamd_log_t alias pyzor_log_t; + typealias spamd_log_t alias pyzord_log_t; + typealias spamd_var_lib_t alias pyzor_var_lib_t; + typealias spamd_etc_t alias pyzor_etc_t; + typealias spamc_home_t alias pyzor_home_t; + typealias spamc_home_t alias user_pyzor_home_t; +',` + type pyzor_t; + type pyzor_exec_t; + typealias pyzor_t alias { user_pyzor_t staff_pyzor_t sysadm_pyzor_t }; + typealias pyzor_t alias { auditadm_pyzor_t secadm_pyzor_t }; + application_domain(pyzor_t, pyzor_exec_t) + ubac_constrained(pyzor_t) + role system_r types pyzor_t; + + type pyzor_etc_t; + files_config_file(pyzor_etc_t) + + type pyzor_home_t; + typealias pyzor_home_t alias { user_pyzor_home_t staff_pyzor_home_t sysadm_pyzor_home_t }; + typealias pyzor_home_t alias { auditadm_pyzor_home_t secadm_pyzor_home_t }; + userdom_user_home_content(pyzor_home_t) + + type pyzor_tmp_t; + typealias pyzor_tmp_t alias { user_pyzor_tmp_t staff_pyzor_tmp_t sysadm_pyzor_tmp_t }; + typealias pyzor_tmp_t alias { auditadm_pyzor_tmp_t secadm_pyzor_tmp_t }; + files_tmp_file(pyzor_tmp_t) + ubac_constrained(pyzor_tmp_t) + + type pyzor_var_lib_t; + typealias pyzor_var_lib_t alias { user_pyzor_var_lib_t staff_pyzor_var_lib_t sysadm_pyzor_var_lib_t }; + typealias pyzor_var_lib_t alias { auditadm_pyzor_var_lib_t secadm_pyzor_var_lib_t }; + files_type(pyzor_var_lib_t) + ubac_constrained(pyzor_var_lib_t) + + type pyzord_t; + type pyzord_exec_t; + init_daemon_domain(pyzord_t, pyzord_exec_t) + + type pyzord_log_t; + logging_log_file(pyzord_log_t) +') ######################################## # @@ -74,11 +98,13 @@ corenet_tcp_connect_http_port(pyzor_t) dev_read_urand(pyzor_t) -files_read_etc_files(pyzor_t) +fs_getattr_xattr_fs(pyzor_t) + auth_use_nsswitch(pyzor_t) -miscfiles_read_localization(pyzor_t) + +mta_read_queue(pyzor_t) userdom_dontaudit_search_user_home_dirs(pyzor_t) @@ -109,8 +135,8 @@ allow pyzord_t pyzor_etc_t:dir list_dir_perms; can_exec(pyzord_t, pyzor_exec_t) manage_files_pattern(pyzord_t, pyzord_log_t, pyzord_log_t) -allow pyzord_t pyzord_log_t:dir setattr; -logging_log_filetrans(pyzord_t, pyzord_log_t, { file dir } ) +allow pyzord_t pyzord_log_t:dir setattr_dir_perms; +logging_log_filetrans(pyzord_t, pyzord_log_t, { file dir }) kernel_read_kernel_sysctls(pyzord_t) kernel_read_system_state(pyzord_t) @@ -119,7 +145,6 @@ dev_read_urand(pyzord_t) corecmd_exec_bin(pyzord_t) -corenet_all_recvfrom_unlabeled(pyzord_t) corenet_all_recvfrom_netlabel(pyzord_t) corenet_udp_sendrecv_generic_if(pyzord_t) corenet_udp_sendrecv_generic_node(pyzord_t) @@ -128,13 +153,11 @@ corenet_udp_bind_generic_node(pyzord_t) corenet_udp_bind_pyzor_port(pyzord_t) corenet_sendrecv_pyzor_server_packets(pyzord_t) -files_read_etc_files(pyzord_t) auth_use_nsswitch(pyzord_t) locallogin_dontaudit_use_fds(pyzord_t) -miscfiles_read_localization(pyzord_t) # Do not audit attempts to access /root. userdom_dontaudit_search_user_home_dirs(pyzord_t) diff --git a/qemu.if b/qemu.if index 268d691..580f9ee 100644 --- a/qemu.if +++ b/qemu.if @@ -43,7 +43,6 @@ template(`qemu_domain_template',` kernel_read_system_state($1_t) - corenet_all_recvfrom_unlabeled($1_t) corenet_all_recvfrom_netlabel($1_t) corenet_tcp_sendrecv_generic_if($1_t) corenet_tcp_sendrecv_generic_node($1_t) @@ -72,11 +71,10 @@ template(`qemu_domain_template',` term_getattr_pty_fs($1_t) term_use_generic_ptys($1_t) - miscfiles_read_localization($1_t) sysnet_read_config($1_t) - userdom_use_user_terminals($1_t) + userdom_use_inherited_user_terminals($1_t) userdom_attach_admin_tun_iface($1_t) optional_policy(` @@ -98,61 +96,40 @@ template(`qemu_domain_template',` ') ') -####################################### +######################################## ## -## The per role template for the qemu module. +## Execute a domain transition to run qemu. +## +## +## +## Domain allowed to transition. ## -## -##

-## This template creates a derived domains which are used -## for qemu web browser. -##

-##

-## This template is invoked automatically for each user, and -## generally does not need to be invoked directly -## by policy writers. -##

-## -## -## -## The role associated with the user domain. -## -## -## -## -## The type of the user domain. -## ## # -template(`qemu_role',` +interface(`qemu_domtrans',` gen_require(` type qemu_t, qemu_exec_t; - type qemu_config_t, qemu_config_exec_t; ') - role $1 types { qemu_t qemu_config_t }; - - domtrans_pattern($2, qemu_exec_t, qemu_t) - domtrans_pattern($2, qemu_config_exec_t, qemu_config_t) - allow qemu_t $2:process signull; + domtrans_pattern($1, qemu_exec_t, qemu_t) ') ######################################## ## -## Execute a domain transition to run qemu. +## Execute a qemu in the callers domain ## ## ## -## Domain allowed to transition. +## Domain allowed access. ## ## # -interface(`qemu_domtrans',` +interface(`qemu_exec',` gen_require(` - type qemu_t, qemu_exec_t; + type qemu_exec_t; ') - domtrans_pattern($1, qemu_exec_t, qemu_t) + can_exec($1, qemu_exec_t) ') ######################################## @@ -256,20 +233,63 @@ interface(`qemu_kill',` ######################################## ## -## Execute a domain transition to run qemu unconfined. +## Execute qemu_exec_t +## in the specified domain but do not +## do it automatically. This is an explicit +## transition, requiring the caller to use setexeccon(). ## +## +##

+## Execute qemu_exec_t +## in the specified domain. This allows +## the specified domain to qemu programs +## on these filesystems in the specified +## domain. +##

+## ## +## +## Domain allowed access. +## +## +## +## +## The type of the new process. +## +## +# +interface(`qemu_spec_domtrans',` + gen_require(` + type qemu_exec_t; + ') + + read_lnk_files_pattern($1, qemu_exec_t, qemu_exec_t) + domain_transition_pattern($1, qemu_exec_t, $2) + domain_entry_file($2,qemu_exec_t) + can_exec($1,qemu_exec_t) + + allow $2 $1:fd use; + allow $2 $1:fifo_file rw_fifo_file_perms; + allow $2 $1:process sigchld; +') + +######################################## ## -## Domain allowed to transition. +## Execute qemu unconfined programs in the role. ## +## +## +## The role to allow the qemu unconfined domain. +## ## # -interface(`qemu_domtrans_unconfined',` +interface(`qemu_unconfined_role',` gen_require(` - type unconfined_qemu_t, qemu_exec_t; + type unconfined_qemu_t; + type qemu_t; ') - - domtrans_pattern($1, qemu_exec_t, unconfined_qemu_t) + role $1 types unconfined_qemu_t; + role $1 types qemu_t; ') ######################################## @@ -307,3 +327,22 @@ interface(`qemu_manage_tmp_files',` manage_files_pattern($1, qemu_tmp_t, qemu_tmp_t) ') + +######################################## +## +## Make qemu_exec_t an entrypoint for +## the specified domain. +## +## +## +## The domain for which qemu_exec_t is an entrypoint. +## +## +# +interface(`qemu_entry_type',` + gen_require(` + type qemu_exec_t; + ') + + domain_entry_file($1, qemu_exec_t) +') diff --git a/qemu.te b/qemu.te index 9681d82..695c857 100644 --- a/qemu.te +++ b/qemu.te @@ -40,9 +40,7 @@ gen_tunable(qemu_use_nfs, true) ## gen_tunable(qemu_use_usb, true) -type qemu_exec_t; virt_domain_template(qemu) -application_domain(qemu_t, qemu_exec_t) role system_r types qemu_t; ######################################## @@ -50,13 +48,12 @@ role system_r types qemu_t; # qemu local policy # -can_exec(qemu_t, qemu_exec_t) - storage_raw_write_removable_device(qemu_t) storage_raw_read_removable_device(qemu_t) userdom_search_user_home_content(qemu_t) userdom_read_user_tmpfs_files(qemu_t) +userdom_stream_connect(qemu_t) tunable_policy(`qemu_full_network',` allow qemu_t self:udp_socket create_socket_perms; @@ -101,6 +98,17 @@ optional_policy(` ') optional_policy(` + tunable_policy(`qemu_use_cifs',` + samba_domtrans_smbd(qemu_t) + ') +') + +optional_policy(` + virt_domtrans_bridgehelper(qemu_t) +') + +optional_policy(` + virt_manage_home_files(qemu_t) virt_manage_images(qemu_t) virt_append_log(qemu_t) ') @@ -113,18 +121,3 @@ optional_policy(` xserver_read_xdm_pid(qemu_t) xserver_stream_connect(qemu_t) ') - -######################################## -# -# Unconfined qemu local policy -# - -optional_policy(` - type unconfined_qemu_t; - typealias unconfined_qemu_t alias qemu_unconfined_t; - application_type(unconfined_qemu_t) - unconfined_domain(unconfined_qemu_t) - - allow unconfined_qemu_t self:process { execstack execmem }; - allow unconfined_qemu_t qemu_exec_t:file execmod; -') diff --git a/qmail.fc b/qmail.fc index 0055e54..edee505 100644 --- a/qmail.fc +++ b/qmail.fc @@ -17,6 +17,7 @@ /var/qmail/bin/tcp-env -- gen_context(system_u:object_r:qmail_tcp_env_exec_t,s0) /var/qmail/control(/.*)? gen_context(system_u:object_r:qmail_etc_t,s0) +/var/qmail/owners(/.*)? gen_context(system_u:object_r:qmail_etc_t,s0) /var/qmail/queue(/.*)? gen_context(system_u:object_r:qmail_spool_t,s0) @@ -25,7 +26,7 @@ ifdef(`distro_debian', ` /usr/bin/tcp-env -- gen_context(system_u:object_r:qmail_tcp_env_exec_t,s0) -#/usr/local/bin/serialmail/.* -- gen_context(system_u:object_r:qmail_serialmail_exec_t,s0) +#/usr/bin/serialmail/.* -- gen_context(system_u:object_r:qmail_serialmail_exec_t,s0) /usr/sbin/qmail-clean -- gen_context(system_u:object_r:qmail_clean_exec_t,s0) /usr/sbin/qmail-getpw -- gen_context(system_u:object_r:qmail_exec_t,s0) diff --git a/qmail.if b/qmail.if index a55bf44..05e219e 100644 --- a/qmail.if +++ b/qmail.if @@ -44,7 +44,6 @@ template(`qmail_child_domain_template',` fs_getattr_xattr_fs($1_t) - miscfiles_read_localization($1_t) ') ######################################## @@ -62,14 +61,13 @@ interface(`qmail_domtrans_inject',` type qmail_inject_t, qmail_inject_exec_t; ') + corecmd_search_bin($1) domtrans_pattern($1, qmail_inject_exec_t, qmail_inject_t) ifdef(`distro_debian',` files_search_usr($1) - corecmd_search_bin($1) ',` files_search_var($1) - corecmd_search_bin($1) ') ') @@ -88,14 +86,13 @@ interface(`qmail_domtrans_queue',` type qmail_queue_t, qmail_queue_exec_t; ') + corecmd_search_bin($1) domtrans_pattern($1, qmail_queue_exec_t, qmail_queue_t) ifdef(`distro_debian',` files_search_usr($1) - corecmd_search_bin($1) ',` files_search_var($1) - corecmd_search_bin($1) ') ') @@ -149,3 +146,59 @@ interface(`qmail_smtpd_service_domain',` domtrans_pattern(qmail_smtpd_t, $2, $1) ') + +######################################## +## +## Create, read, write, and delete qmail +## spool directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`qmail_manage_spool_dirs',` + gen_require(` + type qmail_spool_t; + ') + + manage_dirs_pattern($1, qmail_spool_t, qmail_spool_t) +') + +######################################## +## +## Create, read, write, and delete qmail +## spool files. +## +## +## +## Domain allowed access. +## +## +# +interface(`qmail_manage_spool_files',` + gen_require(` + type qmail_spool_t; + ') + + manage_files_pattern($1, qmail_spool_t, qmail_spool_t) +') + +######################################## +## +## Read and write to qmail spool pipes. +## +## +## +## Domain to not audit. +## +## +# +interface(`qmail_rw_spool_pipes',` + gen_require(` + type qmail_spool_t; + ') + + allow $1 qmail_spool_t:fifo_file rw_fifo_file_perms; +') diff --git a/qmail.te b/qmail.te index 355b2a2..af2850e 100644 --- a/qmail.te +++ b/qmail.te @@ -47,7 +47,7 @@ qmail_child_domain_template(qmail_smtpd, qmail_tcp_env_t) qmail_child_domain_template(qmail_splogger, qmail_start_t) type qmail_spool_t; -files_type(qmail_spool_t) +files_spool_file(qmail_spool_t) type qmail_start_t; type qmail_start_exec_t; @@ -60,7 +60,7 @@ application_domain(qmail_tcp_env_t, qmail_tcp_env_exec_t) ######################################## # # qmail-clean local policy -# this component cleans up the queue directory +# this component cleans up the queue directory # read_files_pattern(qmail_clean_t, qmail_spool_t, qmail_spool_t) @@ -69,11 +69,11 @@ delete_files_pattern(qmail_clean_t, qmail_spool_t, qmail_spool_t) ######################################## # # qmail-inject local policy -# this component preprocesses mail from stdin and invokes qmail-queue +# this component preprocesses mail from stdin and invokes qmail-queue # -allow qmail_inject_t self:fifo_file write_fifo_file_perms; allow qmail_inject_t self:process signal_perms; +allow qmail_inject_t self:fifo_file write_fifo_file_perms; allow qmail_inject_t qmail_queue_exec_t:file read_file_perms; @@ -81,18 +81,17 @@ corecmd_search_bin(qmail_inject_t) files_search_var(qmail_inject_t) -miscfiles_read_localization(qmail_inject_t) qmail_read_config(qmail_inject_t) ######################################## # # qmail-local local policy -# this component delivers a mail message +# this component delivers a mail message # -allow qmail_local_t self:fifo_file write_file_perms; allow qmail_local_t self:process signal_perms; +allow qmail_local_t self:fifo_file write_file_perms; allow qmail_local_t self:unix_stream_socket create_stream_socket_perms; manage_dirs_pattern(qmail_local_t, qmail_alias_home_t, qmail_alias_home_t) @@ -109,7 +108,6 @@ kernel_read_system_state(qmail_local_t) corecmd_exec_bin(qmail_local_t) corecmd_exec_shell(qmail_local_t) -files_read_etc_files(qmail_local_t) files_read_etc_runtime_files(qmail_local_t) auth_use_nsswitch(qmail_local_t) @@ -121,13 +119,17 @@ mta_append_spool(qmail_local_t) qmail_domtrans_queue(qmail_local_t) optional_policy(` + uucp_domtrans(qmail_local_t) +') + +optional_policy(` spamassassin_domtrans_client(qmail_local_t) ') ######################################## # # qmail-lspawn local policy -# this component schedules local deliveries +# this component schedules local deliveries # allow qmail_lspawn_t self:capability { setuid setgid }; @@ -143,22 +145,21 @@ read_files_pattern(qmail_lspawn_t, qmail_spool_t, qmail_spool_t) corecmd_search_bin(qmail_lspawn_t) -files_read_etc_files(qmail_lspawn_t) files_search_pids(qmail_lspawn_t) files_search_tmp(qmail_lspawn_t) ######################################## # # qmail-queue local policy -# this component places a mail in a delivery queue, later to be processed by qmail-send +# this component places a mail in a delivery queue, later to be processed by qmail-send # allow qmail_queue_t qmail_lspawn_t:fd use; allow qmail_queue_t qmail_lspawn_t:fifo_file write_fifo_file_perms; +allow qmail_queue_t qmail_smtpd_t:process sigchld; allow qmail_queue_t qmail_smtpd_t:fd use; allow qmail_queue_t qmail_smtpd_t:fifo_file read_fifo_file_perms; -allow qmail_queue_t qmail_smtpd_t:process sigchld; manage_dirs_pattern(qmail_queue_t, qmail_spool_t, qmail_spool_t) manage_files_pattern(qmail_queue_t, qmail_spool_t, qmail_spool_t) @@ -175,7 +176,7 @@ optional_policy(` ######################################## # # qmail-remote local policy -# this component sends mail via SMTP +# this component sends mail via SMTP # allow qmail_remote_t self:tcp_socket create_socket_perms; @@ -183,7 +184,6 @@ allow qmail_remote_t self:udp_socket create_socket_perms; rw_files_pattern(qmail_remote_t, qmail_spool_t, qmail_spool_t) -corenet_all_recvfrom_unlabeled(qmail_remote_t) corenet_all_recvfrom_netlabel(qmail_remote_t) corenet_tcp_sendrecv_generic_if(qmail_remote_t) corenet_udp_sendrecv_generic_if(qmail_remote_t) @@ -202,7 +202,7 @@ sysnet_read_config(qmail_remote_t) ######################################## # # qmail-rspawn local policy -# this component scedules remote deliveries +# this component scedules remote deliveries # allow qmail_rspawn_t self:process signal_perms; @@ -217,7 +217,7 @@ corecmd_search_bin(qmail_rspawn_t) ######################################## # # qmail-send local policy -# this component delivers mail messages from the queue +# this component delivers mail messages from the queue # allow qmail_send_t self:process signal_perms; @@ -236,7 +236,7 @@ optional_policy(` ######################################## # # qmail-smtpd local policy -# this component receives mails via SMTP +# this component receives mails via SMTP # allow qmail_smtpd_t self:process signal_perms; @@ -265,27 +265,25 @@ optional_policy(` ######################################## # # splogger local policy -# this component creates entries in syslog +# this component creates entries in syslog # allow qmail_splogger_t self:unix_dgram_socket create_socket_perms; -files_read_etc_files(qmail_splogger_t) init_dontaudit_use_script_fds(qmail_splogger_t) -miscfiles_read_localization(qmail_splogger_t) ######################################## # # qmail-start local policy -# this component starts up the mail delivery component +# this component starts up the mail delivery component # allow qmail_start_t self:capability { setgid setuid }; dontaudit qmail_start_t self:capability sys_tty_config; -allow qmail_start_t self:fifo_file rw_fifo_file_perms; allow qmail_start_t self:process signal_perms; +allow qmail_start_t self:fifo_file rw_fifo_file_perms; can_exec(qmail_start_t, qmail_start_exec_t) @@ -303,7 +301,7 @@ optional_policy(` ######################################## # # tcp-env local policy -# this component sets up TCP-related environment variables +# this component sets up TCP-related environment variables # allow qmail_tcp_env_t qmail_smtpd_exec_t:file read_file_perms; diff --git a/qpid.fc b/qpid.fc index 4f94229..f3b89e4 100644 --- a/qpid.fc +++ b/qpid.fc @@ -1,6 +1,7 @@ -/etc/rc\.d/init\.d/qpidd -- gen_context(system_u:object_r:qpidd_initrc_exec_t,s0) -/usr/sbin/qpidd -- gen_context(system_u:object_r:qpidd_exec_t,s0) +/usr/sbin/qpidd -- gen_context(system_u:object_r:qpidd_exec_t,s0) + +/etc/rc\.d/init\.d/qpidd -- gen_context(system_u:object_r:qpidd_initrc_exec_t,s0) /var/lib/qpidd(/.*)? gen_context(system_u:object_r:qpidd_var_lib_t,s0) diff --git a/qpid.if b/qpid.if index 5a9630c..bedca3a 100644 --- a/qpid.if +++ b/qpid.if @@ -1,4 +1,4 @@ -## Apache QPID AMQP messaging server. +## policy for qpidd ######################################## ## @@ -18,9 +18,9 @@ interface(`qpidd_domtrans',` domtrans_pattern($1, qpidd_exec_t, qpidd_t) ') -##################################### +######################################## ## -## Allow read and write access to qpidd semaphores. +## Execute qpidd server in the qpidd domain. ## ## ## @@ -28,17 +28,17 @@ interface(`qpidd_domtrans',` ## ## # -interface(`qpidd_rw_semaphores',` +interface(`qpidd_initrc_domtrans',` gen_require(` - type qpidd_t; + type qpidd_initrc_exec_t; ') - allow $1 qpidd_t:sem rw_sem_perms; + init_labeled_script_domtrans($1, qpidd_initrc_exec_t) ') ######################################## ## -## Read and write to qpidd shared memory. +## Read qpidd PID files. ## ## ## @@ -46,17 +46,18 @@ interface(`qpidd_rw_semaphores',` ## ## # -interface(`qpidd_rw_shm',` +interface(`qpidd_read_pid_files',` gen_require(` - type qpidd_t; + type qpidd_var_run_t; ') - allow $1 qpidd_t:shm rw_shm_perms; + files_search_pids($1) + allow $1 qpidd_var_run_t:file read_file_perms; ') ######################################## ## -## Execute qpidd server in the qpidd domain. +## Manage qpidd var_run files. ## ## ## @@ -64,17 +65,20 @@ interface(`qpidd_rw_shm',` ## ## # -interface(`qpidd_initrc_domtrans',` +interface(`qpidd_manage_var_run',` gen_require(` - type qpidd_initrc_exec_t; + type qpidd_var_run_t; ') - init_labeled_script_domtrans($1, qpidd_initrc_exec_t) + files_search_pids($1) + manage_dirs_pattern($1, qpidd_var_run_t, qpidd_var_run_t) + manage_files_pattern($1, qpidd_var_run_t, qpidd_var_run_t) + manage_lnk_files_pattern($1, qpidd_var_run_t, qpidd_var_run_t) ') ######################################## ## -## Read qpidd PID files. +## Search qpidd lib directories. ## ## ## @@ -82,18 +86,18 @@ interface(`qpidd_initrc_domtrans',` ## ## # -interface(`qpidd_read_pid_files',` +interface(`qpidd_search_lib',` gen_require(` - type qpidd_var_run_t; + type qpidd_var_lib_t; ') - files_search_pids($1) - allow $1 qpidd_var_run_t:file read_file_perms; + allow $1 qpidd_var_lib_t:dir search_dir_perms; + files_search_var_lib($1) ') ######################################## ## -## Search qpidd lib directories. +## Read qpidd lib files. ## ## ## @@ -101,18 +105,19 @@ interface(`qpidd_read_pid_files',` ## ## # -interface(`qpidd_search_lib',` +interface(`qpidd_read_lib_files',` gen_require(` type qpidd_var_lib_t; ') - allow $1 qpidd_var_lib_t:dir search_dir_perms; files_search_var_lib($1) + read_files_pattern($1, qpidd_var_lib_t, qpidd_var_lib_t) ') ######################################## ## -## Read qpidd lib files. +## Create, read, write, and delete +## qpidd lib files. ## ## ## @@ -120,19 +125,18 @@ interface(`qpidd_search_lib',` ## ## # -interface(`qpidd_read_lib_files',` +interface(`qpidd_manage_lib_files',` gen_require(` type qpidd_var_lib_t; ') files_search_var_lib($1) - read_files_pattern($1, qpidd_var_lib_t, qpidd_var_lib_t) + manage_files_pattern($1, qpidd_var_lib_t, qpidd_var_lib_t) ') ######################################## ## -## Create, read, write, and delete -## qpidd lib files. +## Manage qpidd var_lib files. ## ## ## @@ -140,13 +144,15 @@ interface(`qpidd_read_lib_files',` ## ## # -interface(`qpidd_manage_lib_files',` +interface(`qpidd_manage_var_lib',` gen_require(` type qpidd_var_lib_t; ') files_search_var_lib($1) + manage_dirs_pattern($1, qpidd_var_lib_t, qpidd_var_lib_t) manage_files_pattern($1, qpidd_var_lib_t, qpidd_var_lib_t) + manage_lnk_files_pattern($1, qpidd_var_lib_t, qpidd_var_lib_t) ') ######################################## @@ -171,8 +177,11 @@ interface(`qpidd_admin',` type qpidd_t, qpidd_initrc_exec_t; ') - allow $1 qpidd_t:process { ptrace signal_perms }; + allow $1 qpidd_t:process signal_perms; ps_process_pattern($1, qpidd_t) + tunable_policy(`deny_ptrace',`',` + allow $1 qpidd_t:process ptrace; + ') # Allow qpidd_t to restart the apache service qpidd_initrc_domtrans($1) @@ -180,7 +189,46 @@ interface(`qpidd_admin',` role_transition $2 qpidd_initrc_exec_t system_r; allow $2 system_r; - admin_pattern($1, qpidd_var_lib_t) + qpidd_manage_var_run($1) - admin_pattern($1, qpidd_var_run_t) + qpidd_manage_var_lib($1) +') + +##################################### +## +## Allow read and write access to qpidd semaphores. +## +## +## +## Domain allowed access. +## +## +# +interface(`qpidd_rw_semaphores',` + gen_require(` + type qpidd_t; + ') + + allow $1 qpidd_t:sem rw_sem_perms; +') + +####################################### +## +## Read and write to qpidd shared memory. +## +## +## +## Domain allowed access. +## +## +# +interface(`qpidd_rw_shm',` + gen_require(` + type qpidd_t; + type qpidd_tmpfs_t; + ') + + allow $1 qpidd_t:shm rw_shm_perms; + fs_search_tmpfs($1) + manage_files_pattern($1, qpidd_tmpfs_t, qpidd_tmpfs_t) ') diff --git a/qpid.te b/qpid.te index cb7ecb5..68f26ad 100644 --- a/qpid.te +++ b/qpid.te @@ -12,12 +12,15 @@ init_daemon_domain(qpidd_t, qpidd_exec_t) type qpidd_initrc_exec_t; init_script_file(qpidd_initrc_exec_t) -type qpidd_var_lib_t; -files_type(qpidd_var_lib_t) +type qpidd_tmpfs_t; +files_tmpfs_file(qpidd_tmpfs_t) type qpidd_var_run_t; files_pid_file(qpidd_var_run_t) +type qpidd_var_lib_t; +files_type(qpidd_var_lib_t) + ######################################## # # qpidd local policy @@ -30,34 +33,41 @@ allow qpidd_t self:shm create_shm_perms; allow qpidd_t self:tcp_socket create_stream_socket_perms; allow qpidd_t self:unix_stream_socket create_stream_socket_perms; -manage_dirs_pattern(qpidd_t, qpidd_var_lib_t, qpidd_var_lib_t) -manage_files_pattern(qpidd_t, qpidd_var_lib_t, qpidd_var_lib_t) +manage_dirs_pattern(qpidd_t, qpidd_tmpfs_t, qpidd_tmpfs_t) +manage_files_pattern(qpidd_t, qpidd_tmpfs_t, qpidd_tmpfs_t) +fs_tmpfs_filetrans(qpidd_t, qpidd_tmpfs_t, { dir file }) + +manage_dirs_pattern(qpidd_t, qpidd_var_lib_t, qpidd_var_lib_t) +manage_files_pattern(qpidd_t, qpidd_var_lib_t, qpidd_var_lib_t) files_var_lib_filetrans(qpidd_t, qpidd_var_lib_t, { file dir }) -manage_dirs_pattern(qpidd_t, qpidd_var_run_t, qpidd_var_run_t) -manage_files_pattern(qpidd_t, qpidd_var_run_t, qpidd_var_run_t) +manage_dirs_pattern(qpidd_t, qpidd_var_run_t, qpidd_var_run_t) +manage_files_pattern(qpidd_t, qpidd_var_run_t, qpidd_var_run_t) files_pid_filetrans(qpidd_t, qpidd_var_run_t, { file dir }) kernel_read_system_state(qpidd_t) -corenet_all_recvfrom_unlabeled(qpidd_t) corenet_all_recvfrom_netlabel(qpidd_t) +corenet_tcp_bind_generic_node(qpidd_t) corenet_tcp_sendrecv_generic_if(qpidd_t) corenet_tcp_sendrecv_generic_node(qpidd_t) corenet_tcp_sendrecv_all_ports(qpidd_t) -corenet_tcp_bind_generic_node(qpidd_t) corenet_tcp_bind_amqp_port(qpidd_t) +corenet_tcp_bind_matahari_port(qpidd_t) +corenet_tcp_connect_amqp_port(qpidd_t) +corenet_tcp_connect_matahari_port(qpidd_t) +dev_read_sysfs(qpidd_t) dev_read_urand(qpidd_t) files_read_etc_files(qpidd_t) +files_read_usr_files(qpidd_t) logging_send_syslog_msg(qpidd_t) -miscfiles_read_localization(qpidd_t) - sysnet_dns_name_resolve(qpidd_t) optional_policy(` corosync_stream_connect(qpidd_t) ') + diff --git a/quantum.fc b/quantum.fc new file mode 100644 index 0000000..9108437 --- /dev/null +++ b/quantum.fc @@ -0,0 +1,10 @@ +/usr/bin/quantum-server -- gen_context(system_u:object_r:quantum_exec_t,s0) +/usr/bin/quantum-openvswitch-agent -- gen_context(system_u:object_r:quantum_exec_t,s0) +/usr/bin/quantum-linuxbridge-agent -- gen_context(system_u:object_r:quantum_exec_t,s0) +/usr/bin/quantum-ryu-agent -- gen_context(system_u:object_r:quantum_exec_t,s0) + +/usr/lib/systemd/system/quantum.* -- gen_context(system_u:object_r:quantum_unit_file_t,s0) + +/var/lib/quantum(/.*)? gen_context(system_u:object_r:quantum_var_lib_t,s0) + +/var/log/quantum(/.*)? gen_context(system_u:object_r:quantum_log_t,s0) diff --git a/quantum.if b/quantum.if new file mode 100644 index 0000000..010b2be --- /dev/null +++ b/quantum.if @@ -0,0 +1,218 @@ +## Quantum is a virtual network service for Openstack + +######################################## +## +## Transition to quantum. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`quantum_domtrans',` + gen_require(` + type quantum_t, quantum_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, quantum_exec_t, quantum_t) +') + +######################################## +## +## Read quantum's log files. +## +## +## +## Domain allowed access. +## +## +## +# +interface(`quantum_read_log',` + gen_require(` + type quantum_log_t; + ') + + logging_search_logs($1) + read_files_pattern($1, quantum_log_t, quantum_log_t) +') + +######################################## +## +## Append to quantum log files. +## +## +## +## Domain allowed access. +## +## +# +interface(`quantum_append_log',` + gen_require(` + type quantum_log_t; + ') + + logging_search_logs($1) + append_files_pattern($1, quantum_log_t, quantum_log_t) +') + +######################################## +## +## Manage quantum log files +## +## +## +## Domain allowed access. +## +## +# +interface(`quantum_manage_log',` + gen_require(` + type quantum_log_t; + ') + + logging_search_logs($1) + manage_dirs_pattern($1, quantum_log_t, quantum_log_t) + manage_files_pattern($1, quantum_log_t, quantum_log_t) + manage_lnk_files_pattern($1, quantum_log_t, quantum_log_t) +') + +######################################## +## +## Search quantum lib directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`quantum_search_lib',` + gen_require(` + type quantum_var_lib_t; + ') + + allow $1 quantum_var_lib_t:dir search_dir_perms; + files_search_var_lib($1) +') + +######################################## +## +## Read quantum lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`quantum_read_lib_files',` + gen_require(` + type quantum_var_lib_t; + ') + + files_search_var_lib($1) + read_files_pattern($1, quantum_var_lib_t, quantum_var_lib_t) +') + +######################################## +## +## Manage quantum lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`quantum_manage_lib_files',` + gen_require(` + type quantum_var_lib_t; + ') + + files_search_var_lib($1) + manage_files_pattern($1, quantum_var_lib_t, quantum_var_lib_t) +') + +######################################## +## +## Manage quantum lib directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`quantum_manage_lib_dirs',` + gen_require(` + type quantum_var_lib_t; + ') + + files_search_var_lib($1) + manage_dirs_pattern($1, quantum_var_lib_t, quantum_var_lib_t) +') + +######################################## +## +## Execute quantum server in the quantum domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`quantum_systemctl',` + gen_require(` + type quantum_t; + type quantum_unit_file_t; + ') + + systemd_exec_systemctl($1) + systemd_read_fifo_file_passwd_run($1) + allow $1 quantum_unit_file_t:file read_file_perms; + allow $1 quantum_unit_file_t:service manage_service_perms; + + ps_process_pattern($1, quantum_t) +') + + +######################################## +## +## All of the rules required to administrate +## an quantum environment +## +## +## +## Domain allowed access. +## +## +# +interface(`quantum_admin',` + gen_require(` + type quantum_t; + type quantum_log_t; + type quantum_var_lib_t; + type quantum_unit_file_t; + ') + + allow $1 quantum_t:process { ptrace signal_perms }; + ps_process_pattern($1, quantum_t) + + logging_search_logs($1) + admin_pattern($1, quantum_log_t) + + files_search_var_lib($1) + admin_pattern($1, quantum_var_lib_t) + + quantum_systemctl($1) + admin_pattern($1, quantum_unit_file_t) + allow $1 quantum_unit_file_t:service all_service_perms; + optional_policy(` + systemd_passwd_agent_exec($1) + systemd_read_fifo_file_passwd_run($1) + ') +') diff --git a/quantum.te b/quantum.te new file mode 100644 index 0000000..6e15504 --- /dev/null +++ b/quantum.te @@ -0,0 +1,80 @@ +policy_module(quantum, 1.0.0) + +######################################## +# +# Declarations +# + +type quantum_t; +type quantum_exec_t; +init_daemon_domain(quantum_t, quantum_exec_t) + +type quantum_log_t; +logging_log_file(quantum_log_t) + +type quantum_tmp_t; +files_tmp_file(quantum_tmp_t) + +type quantum_var_lib_t; +files_type(quantum_var_lib_t) + +type quantum_unit_file_t; +systemd_unit_file(quantum_unit_file_t) + +######################################## +# +# quantum local policy +# +allow quantum_t self:capability { setuid sys_resource setgid audit_write }; +allow quantum_t self:process { setsched setrlimit }; +allow quantum_t self:key manage_key_perms; + +allow quantum_t self:fifo_file rw_fifo_file_perms; +allow quantum_t self:unix_stream_socket create_stream_socket_perms; +allow quantum_t self:tcp_socket create_stream_socket_perms; + +manage_dirs_pattern(quantum_t, quantum_log_t, quantum_log_t) +manage_files_pattern(quantum_t, quantum_log_t, quantum_log_t) +logging_log_filetrans(quantum_t, quantum_log_t, { dir file }) + +manage_files_pattern(quantum_t, quantum_tmp_t, quantum_tmp_t) +files_tmp_filetrans(quantum_t, quantum_tmp_t, file) +can_exec(quantum_t, quantum_tmp_t) + +manage_dirs_pattern(quantum_t, quantum_var_lib_t, quantum_var_lib_t) +manage_files_pattern(quantum_t, quantum_var_lib_t, quantum_var_lib_t) +files_var_lib_filetrans(quantum_t, quantum_var_lib_t, { dir file }) + +kernel_read_kernel_sysctls(quantum_t) +kernel_read_system_state(quantum_t) + +corecmd_exec_shell(quantum_t) +corecmd_exec_bin(quantum_t) + +corenet_tcp_bind_generic_node(quantum_t) +corenet_tcp_bind_quantum_port(quantum_t) +corenet_tcp_connect_mysqld_port(quantum_t) + +dev_read_urand(quantum_t) +dev_list_sysfs(quantum_t) + +domain_use_interactive_fds(quantum_t) + +files_read_usr_files(quantum_t) + +auth_use_nsswitch(quantum_t) + +libs_exec_ldconfig(quantum_t) + +logging_send_audit_msgs(quantum_t) +logging_send_syslog_msg(quantum_t) + +sysnet_domtrans_ifconfig(quantum_t) + +optional_policy(` + brctl_domtrans(quantum_t) +') + +optional_policy(` + sudo_exec(quantum_t) +') diff --git a/quota.fc b/quota.fc index f387230..746532d 100644 --- a/quota.fc +++ b/quota.fc @@ -1,4 +1,5 @@ HOME_ROOT/a?quota\.(user|group) -- gen_context(system_u:object_r:quota_db_t,s0) +HOME_DIR/a?quota\.(user|group) -- gen_context(system_u:object_r:quota_db_t,s0) /a?quota\.(user|group) -- gen_context(system_u:object_r:quota_db_t,s0) @@ -8,12 +9,20 @@ HOME_ROOT/a?quota\.(user|group) -- gen_context(system_u:object_r:quota_db_t,s0) /sbin/quota(check|on) -- gen_context(system_u:object_r:quota_exec_t,s0) +/usr/sbin/quota(check|on) -- gen_context(system_u:object_r:quota_exec_t,s0) + /var/a?quota\.(user|group) -- gen_context(system_u:object_r:quota_db_t,s0) /var/lib/quota(/.*)? gen_context(system_u:object_r:quota_flag_t,s0) -/var/spool/a?quota\.(user|group) -- gen_context(system_u:object_r:quota_db_t,s0) +/var/spool/(.*/)?a?quota\.(user|group) -- gen_context(system_u:object_r:quota_db_t,s0) ifdef(`distro_redhat',` /usr/sbin/convertquota -- gen_context(system_u:object_r:quota_exec_t,s0) ',` /sbin/convertquota -- gen_context(system_u:object_r:quota_exec_t,s0) ') + +/usr/sbin/quota_nld -- gen_context(system_u:object_r:quota_nld_exec_t,s0) + +/var/lib/stickshift/a?quota\.(user|group) -- gen_context(system_u:object_r:quota_db_t,s0) + +/var/run/quota_nld\.pid -- gen_context(system_u:object_r:quota_nld_var_run_t,s0) diff --git a/quota.if b/quota.if index bf75d99..3fb8575 100644 --- a/quota.if +++ b/quota.if @@ -45,6 +45,24 @@ interface(`quota_run',` role $2 types quota_t; ') +####################################### +## +## Alow to read of filesystem quota data files. +## +## +## +## Domain to not audit. +## +## +# +interface(`quota_read_db',` + gen_require(` + type quota_db_t; + ') + + allow $1 quota_db_t:file read_file_perms; +') + ######################################## ## ## Do not audit attempts to get the attributes @@ -67,6 +85,25 @@ interface(`quota_dontaudit_getattr_db',` ######################################## ## ## Create, read, write, and delete quota +## db files. +## +## +## +## Domain to not audit. +## +## +# +interface(`quota_manage_db',` + gen_require(` + type quota_db_t; + ') + + allow $1 quota_db_t:file manage_file_perms; +') + +######################################## +## +## Create, read, write, and delete quota ## flag files. ## ## @@ -83,3 +120,59 @@ interface(`quota_manage_flags',` files_search_var_lib($1) manage_files_pattern($1, quota_flag_t, quota_flag_t) ') + +######################################## +## +## Transition to quota named content +## +## +## +## Domain allowed access. +## +## +# +interface(`quota_filetrans_named_content',` + gen_require(` + type quota_db_t; + ') + + files_root_filetrans($1, quota_db_t, file, "aquota.user") + files_root_filetrans($1, quota_db_t, file, "aquota.group") + files_boot_filetrans($1, quota_db_t, file, "aquota.user") + files_boot_filetrans($1, quota_db_t, file, "aquota.group") + files_etc_filetrans($1, quota_db_t, file, "aquota.user") + files_etc_filetrans($1, quota_db_t, file, "aquota.group") + files_tmp_filetrans($1, quota_db_t, file, "aquota.user") + files_tmp_filetrans($1, quota_db_t, file, "aquota.group") + files_home_filetrans($1, quota_db_t, file, "aquota.user") + files_home_filetrans($1, quota_db_t, file, "aquota.group") + files_usr_filetrans($1, quota_db_t, file, "aquota.user") + files_usr_filetrans($1, quota_db_t, file, "aquota.group") + files_var_filetrans($1, quota_db_t, file, "aquota.user") + files_var_filetrans($1, quota_db_t, file, "aquota.group") + files_spool_filetrans($1, quota_db_t, file, "aquota.user") + files_spool_filetrans($1, quota_db_t, file, "aquota.group") + mta_spool_filetrans($1, quota_db_t, file, "aquota.user") + mta_spool_filetrans($1, quota_db_t, file, "aquota.group") + mta_spool_filetrans_queue($1, quota_db_t, file, "aquota.user") + mta_spool_filetrans_queue($1, quota_db_t, file, "aquota.group") +') + +####################################### +## +## Transition to quota_nld. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`quota_domtrans_nld',` + gen_require(` + type quota_nld_t, quota_nld_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, quota_nld_exec_t, quota_nld_t) +') diff --git a/quota.te b/quota.te index 5dd42f5..8f0100a 100644 --- a/quota.te +++ b/quota.te @@ -7,7 +7,8 @@ policy_module(quota, 1.5.0) type quota_t; type quota_exec_t; -init_system_domain(quota_t, quota_exec_t) +application_domain(quota_t, quota_exec_t) +#init_system_domain(quota_t, quota_exec_t) type quota_db_t; files_type(quota_db_t) @@ -15,6 +16,13 @@ files_type(quota_db_t) type quota_flag_t; files_type(quota_flag_t) +type quota_nld_t; +type quota_nld_exec_t; +init_daemon_domain(quota_nld_t, quota_nld_exec_t) + +type quota_nld_var_run_t; +files_pid_file(quota_nld_var_run_t) + ######################################## # # Local policy @@ -34,6 +42,13 @@ files_home_filetrans(quota_t, quota_db_t, file) files_usr_filetrans(quota_t, quota_db_t, file) files_var_filetrans(quota_t, quota_db_t, file) files_spool_filetrans(quota_t, quota_db_t, file) +userdom_user_home_dir_filetrans(quota_t, quota_db_t, file) + +optional_policy(` + mta_spool_filetrans(quota_t, quota_db_t, file) + mta_spool_filetrans(quota_t, quota_db_t, file) + mta_spool_filetrans_queue(quota_t, quota_db_t, file) +') kernel_list_proc(quota_t) kernel_read_proc_symlinks(quota_t) @@ -72,7 +87,7 @@ init_use_script_ptys(quota_t) logging_send_syslog_msg(quota_t) -userdom_use_user_terminals(quota_t) +userdom_use_inherited_user_terminals(quota_t) userdom_dontaudit_use_unpriv_user_fds(quota_t) optional_policy(` @@ -82,3 +97,31 @@ optional_policy(` optional_policy(` udev_read_db(quota_t) ') + +####################################### +# +# Local policy +# + +allow quota_nld_t self:fifo_file rw_fifo_file_perms; +allow quota_nld_t self:netlink_socket create_socket_perms; +allow quota_nld_t self:unix_stream_socket create_stream_socket_perms; + +manage_files_pattern(quota_nld_t, quota_nld_var_run_t, quota_nld_var_run_t) +files_pid_filetrans(quota_nld_t, quota_nld_var_run_t, { file }) + +kernel_read_network_state(quota_nld_t) + + +auth_use_nsswitch(quota_nld_t) + +init_read_utmp(quota_nld_t) + +logging_send_syslog_msg(quota_nld_t) + +userdom_use_user_terminals(quota_nld_t) + +optional_policy(` + dbus_system_bus_client(quota_nld_t) + dbus_connect_system_bus(quota_nld_t) +') diff --git a/rabbitmq.fc b/rabbitmq.fc new file mode 100644 index 0000000..594c110 --- /dev/null +++ b/rabbitmq.fc @@ -0,0 +1,7 @@ + +/usr/lib64/erlang/erts-5.8.5/bin/beam.* -- gen_context(system_u:object_r:rabbitmq_beam_exec_t,s0) +/usr/lib64/erlang/erts-5.8.5/bin/epmd -- gen_context(system_u:object_r:rabbitmq_epmd_exec_t,s0) + +/var/lib/rabbitmq(/.*)? gen_context(system_u:object_r:rabbitmq_var_lib_t,s0) + +/var/log/rabbitmq(/.*)? gen_context(system_u:object_r:rabbitmq_var_log_t,s0) diff --git a/rabbitmq.if b/rabbitmq.if new file mode 100644 index 0000000..491bd1f --- /dev/null +++ b/rabbitmq.if @@ -0,0 +1,21 @@ + +## policy for rabbitmq + +######################################## +## +## Transition to rabbitmq. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`rabbitmq_domtrans',` + gen_require(` + type rabbitmq_t, rabbitmq_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, rabbitmq_exec_t, rabbitmq_t) +') diff --git a/rabbitmq.te b/rabbitmq.te new file mode 100644 index 0000000..4cb2ad8 --- /dev/null +++ b/rabbitmq.te @@ -0,0 +1,82 @@ +policy_module(rabbitmq, 1.0.0) + +######################################## +# +# Declarations +# + +type rabbitmq_epmd_t; +type rabbitmq_epmd_exec_t; +init_daemon_domain(rabbitmq_epmd_t, rabbitmq_epmd_exec_t) + +type rabbitmq_beam_t; +type rabbitmq_beam_exec_t; +init_daemon_domain(rabbitmq_beam_t, rabbitmq_beam_exec_t) + +type rabbitmq_var_lib_t; +files_type(rabbitmq_var_lib_t) + +type rabbitmq_var_log_t; +logging_log_file(rabbitmq_var_log_t) + +###################################### +# +# beam local policy +# + +allow rabbitmq_beam_t self:process { setsched signal signull }; + +allow rabbitmq_beam_t self:fifo_file rw_fifo_file_perms; +allow rabbitmq_beam_t self:tcp_socket create_stream_socket_perms; + +manage_dirs_pattern(rabbitmq_beam_t, rabbitmq_var_lib_t, rabbitmq_var_lib_t) +manage_files_pattern(rabbitmq_beam_t, rabbitmq_var_lib_t, rabbitmq_var_lib_t) + +manage_dirs_pattern(rabbitmq_beam_t, rabbitmq_var_log_t, rabbitmq_var_log_t) +manage_files_pattern(rabbitmq_beam_t, rabbitmq_var_log_t, rabbitmq_var_log_t) + +can_exec(rabbitmq_beam_t, rabbitmq_beam_exec_t) + +kernel_read_system_state(rabbitmq_beam_t) + +corecmd_exec_bin(rabbitmq_beam_t) +corecmd_exec_shell(rabbitmq_beam_t) + +corenet_tcp_bind_generic_node(rabbitmq_beam_t) +corenet_udp_bind_generic_node(rabbitmq_beam_t) +corenet_tcp_connect_all_ephemeral_ports(rabbitmq_beam_t) +corenet_tcp_bind_amqp_port(rabbitmq_beam_t) +corenet_tcp_connect_epmd_port(rabbitmq_beam_t) + +dev_read_sysfs(rabbitmq_beam_t) + +files_read_etc_files(rabbitmq_beam_t) + + +optional_policy(` + sysnet_dns_name_resolve(rabbitmq_beam_t) +') + +######################################## +# +# epmd local policy +# + +domtrans_pattern(rabbitmq_beam_t, rabbitmq_epmd_exec_t, rabbitmq_epmd_t) + +allow rabbitmq_epmd_t self:process signal; + +allow rabbitmq_epmd_t self:fifo_file rw_fifo_file_perms; +allow rabbitmq_epmd_t self:tcp_socket create_stream_socket_perms; +allow rabbitmq_epmd_t self:unix_stream_socket create_stream_socket_perms; + +# should be append +allow rabbitmq_epmd_t rabbitmq_var_log_t:file write_file_perms; + +corenet_tcp_bind_generic_node(rabbitmq_epmd_t) +corenet_udp_bind_generic_node(rabbitmq_epmd_t) +corenet_tcp_bind_epmd_port(rabbitmq_epmd_t) + +files_read_etc_files(rabbitmq_epmd_t) + +logging_send_syslog_msg(rabbitmq_epmd_t) diff --git a/radius.if b/radius.if index 75e5dc4..87d75fe 100644 --- a/radius.if +++ b/radius.if @@ -38,8 +38,11 @@ interface(`radius_admin',` type radiusd_initrc_exec_t; ') - allow $1 radiusd_t:process { ptrace signal_perms }; + allow $1 radiusd_t:process signal_perms; ps_process_pattern($1, radiusd_t) + tunable_policy(`deny_ptrace',`',` + allow $1 radiusd_t:process ptrace; + ') init_labeled_script_domtrans($1, radiusd_initrc_exec_t) domain_system_change_exemption($1) diff --git a/radius.te b/radius.te index b1ed1bf..3edb33c 100644 --- a/radius.te +++ b/radius.te @@ -62,11 +62,11 @@ manage_sock_files_pattern(radiusd_t, radiusd_var_run_t, radiusd_var_run_t) manage_dirs_pattern(radiusd_t, radiusd_var_run_t, radiusd_var_run_t) manage_files_pattern(radiusd_t, radiusd_var_run_t, radiusd_var_run_t) files_pid_filetrans(radiusd_t, radiusd_var_run_t, { file sock_file dir }) +files_dontaudit_list_tmp(radiusd_t) kernel_read_kernel_sysctls(radiusd_t) kernel_read_system_state(radiusd_t) -corenet_all_recvfrom_unlabeled(radiusd_t) corenet_all_recvfrom_netlabel(radiusd_t) corenet_tcp_sendrecv_generic_if(radiusd_t) corenet_udp_sendrecv_generic_if(radiusd_t) @@ -77,6 +77,7 @@ corenet_udp_sendrecv_all_ports(radiusd_t) corenet_udp_bind_generic_node(radiusd_t) corenet_udp_bind_radacct_port(radiusd_t) corenet_udp_bind_radius_port(radiusd_t) +corenet_tcp_connect_postgresql_port(radiusd_t) corenet_tcp_connect_mysqld_port(radiusd_t) corenet_tcp_connect_snmp_port(radiusd_t) corenet_sendrecv_radius_server_packets(radiusd_t) @@ -99,7 +100,6 @@ corecmd_exec_shell(radiusd_t) domain_use_interactive_fds(radiusd_t) files_read_usr_files(radiusd_t) -files_read_etc_files(radiusd_t) files_read_etc_runtime_files(radiusd_t) auth_use_nsswitch(radiusd_t) @@ -110,9 +110,10 @@ libs_exec_lib_files(radiusd_t) logging_send_syslog_msg(radiusd_t) -miscfiles_read_localization(radiusd_t) miscfiles_read_generic_certs(radiusd_t) +sysnet_use_ldap(radiusd_t) + userdom_dontaudit_use_unpriv_user_fds(radiusd_t) userdom_dontaudit_search_user_home_dirs(radiusd_t) diff --git a/radvd.if b/radvd.if index be05bff..7b00e1e 100644 --- a/radvd.if +++ b/radvd.if @@ -19,12 +19,15 @@ # interface(`radvd_admin',` gen_require(` - type radvd_t, radvd_etc_t; - type radvd_var_run_t, radvd_initrc_exec_t; + type radvd_t, radvd_etc_t, radvd_initrc_exec_t; + type radvd_var_run_t; ') - allow $1 radvd_t:process { ptrace signal_perms }; + allow $1 radvd_t:process signal_perms; ps_process_pattern($1, radvd_t) + tunable_policy(`deny_ptrace',`',` + allow $1 radvd_t:process ptrace; + ') init_labeled_script_domtrans($1, radvd_initrc_exec_t) domain_system_change_exemption($1) diff --git a/radvd.te b/radvd.te index f9a2162..903be76 100644 --- a/radvd.te +++ b/radvd.te @@ -43,7 +43,6 @@ kernel_read_network_state(radvd_t) kernel_read_system_state(radvd_t) kernel_request_load_module(radvd_t) -corenet_all_recvfrom_unlabeled(radvd_t) corenet_all_recvfrom_netlabel(radvd_t) corenet_tcp_sendrecv_generic_if(radvd_t) corenet_udp_sendrecv_generic_if(radvd_t) @@ -61,15 +60,12 @@ fs_search_auto_mountpoints(radvd_t) domain_use_interactive_fds(radvd_t) -files_read_etc_files(radvd_t) files_list_usr(radvd_t) auth_use_nsswitch(radvd_t) logging_send_syslog_msg(radvd_t) -miscfiles_read_localization(radvd_t) - userdom_dontaudit_use_unpriv_user_fds(radvd_t) userdom_dontaudit_search_user_home_dirs(radvd_t) diff --git a/raid.fc b/raid.fc index ed9c70d..c298507 100644 --- a/raid.fc +++ b/raid.fc @@ -1,6 +1,14 @@ -/dev/.mdadm.map -- gen_context(system_u:object_r:mdadm_map_t,s0) +/dev/.mdadm\.map -- gen_context(system_u:object_r:mdadm_var_run_t,s0) +/dev/md/.* -- gen_context(system_u:object_r:mdadm_var_run_t,s0) /sbin/mdadm -- gen_context(system_u:object_r:mdadm_exec_t,s0) /sbin/mdmpd -- gen_context(system_u:object_r:mdadm_exec_t,s0) +/usr/sbin/iprdump -- gen_context(system_u:object_r:mdadm_exec_t,s0) +/usr/sbin/iprinit -- gen_context(system_u:object_r:mdadm_exec_t,s0) +/usr/sbin/iprupdate -- gen_context(system_u:object_r:mdadm_exec_t,s0) +/usr/sbin/mdadm -- gen_context(system_u:object_r:mdadm_exec_t,s0) +/usr/sbin/mdmpd -- gen_context(system_u:object_r:mdadm_exec_t,s0) +/usr/sbin/raid-check -- gen_context(system_u:object_r:mdadm_exec_t,s0) + /var/run/mdadm(/.*)? gen_context(system_u:object_r:mdadm_var_run_t,s0) diff --git a/raid.if b/raid.if index b1a85b5..db0d815 100644 --- a/raid.if +++ b/raid.if @@ -47,6 +47,24 @@ interface(`raid_run_mdadm',` ######################################## ## +## read the mdadm pid files. +## +## +## +## Domain allowed access. +## +## +# +interface(`raid_read_mdadm_pid',` + gen_require(` + type mdadm_var_run_t; + ') + + read_files_pattern($1, mdadm_var_run_t, mdadm_var_run_t) +') + +######################################## +## ## Create, read, write, and delete the mdadm pid files. ## ## diff --git a/raid.te b/raid.te index a8a12b7..b633301 100644 --- a/raid.te +++ b/raid.te @@ -10,11 +10,9 @@ type mdadm_exec_t; init_daemon_domain(mdadm_t, mdadm_exec_t) role system_r types mdadm_t; -type mdadm_map_t; -files_type(mdadm_map_t) - -type mdadm_var_run_t; +type mdadm_var_run_t alias mdadm_map_t; files_pid_file(mdadm_var_run_t) +dev_associate(mdadm_var_run_t) ######################################## # @@ -23,18 +21,20 @@ files_pid_file(mdadm_var_run_t) allow mdadm_t self:capability { dac_override sys_admin ipc_lock }; dontaudit mdadm_t self:capability sys_tty_config; -allow mdadm_t self:process { sigchld sigkill sigstop signull signal }; +allow mdadm_t self:process { getsched setsched sigchld sigkill sigstop signull signal }; allow mdadm_t self:fifo_file rw_fifo_file_perms; +allow mdadm_t self:netlink_kobject_uevent_socket create_socket_perms; -# create .mdadm files in /dev -allow mdadm_t mdadm_map_t:file manage_file_perms; -dev_filetrans(mdadm_t, mdadm_map_t, file) - +manage_dirs_pattern(mdadm_t, mdadm_var_run_t, mdadm_var_run_t) manage_files_pattern(mdadm_t, mdadm_var_run_t, mdadm_var_run_t) -files_pid_filetrans(mdadm_t, mdadm_var_run_t, file) +manage_lnk_files_pattern(mdadm_t, mdadm_var_run_t, mdadm_var_run_t) +manage_sock_files_pattern(mdadm_t, mdadm_var_run_t, mdadm_var_run_t) +files_pid_filetrans(mdadm_t, mdadm_var_run_t, { file dir }) +dev_filetrans(mdadm_t, mdadm_var_run_t, { file dir sock_file }) kernel_read_system_state(mdadm_t) kernel_read_kernel_sysctls(mdadm_t) +kernel_request_load_module(mdadm_t) kernel_rw_software_raid_state(mdadm_t) kernel_getattr_core_if(mdadm_t) @@ -52,14 +52,16 @@ dev_dontaudit_getattr_generic_blk_files(mdadm_t) dev_read_realtime_clock(mdadm_t) # unfortunately needed for DMI decoding: dev_read_raw_memory(mdadm_t) +dev_read_generic_files(mdadm_t) +domain_read_all_domains_state(mdadm_t) domain_use_interactive_fds(mdadm_t) -files_read_etc_files(mdadm_t) files_read_etc_runtime_files(mdadm_t) -files_dontaudit_getattr_all_files(mdadm_t) +files_dontaudit_getattr_tmpfs_files(mdadm_t) -fs_search_auto_mountpoints(mdadm_t) +fs_list_hugetlbfs(mdadm_t) +fs_list_auto_mountpoints(mdadm_t) fs_dontaudit_list_tmpfs(mdadm_t) mls_file_read_all_levels(mdadm_t) @@ -69,16 +71,17 @@ mls_file_write_all_levels(mdadm_t) storage_manage_fixed_disk(mdadm_t) storage_dev_filetrans_fixed_disk(mdadm_t) storage_read_scsi_generic(mdadm_t) +storage_write_scsi_generic(mdadm_t) term_dontaudit_list_ptys(mdadm_t) term_dontaudit_use_unallocated_ttys(mdadm_t) +auth_use_nsswitch(mdadm_t) + init_dontaudit_getattr_initctl(mdadm_t) logging_send_syslog_msg(mdadm_t) -miscfiles_read_localization(mdadm_t) - userdom_dontaudit_use_unpriv_user_fds(mdadm_t) userdom_dontaudit_search_user_home_content(mdadm_t) userdom_dontaudit_use_user_terminals(mdadm_t) @@ -86,6 +89,10 @@ userdom_dontaudit_use_user_terminals(mdadm_t) mta_send_mail(mdadm_t) optional_policy(` + cron_system_entry(mdadm_t, mdadm_exec_t) +') + +optional_policy(` gpm_dontaudit_getattr_gpmctl(mdadm_t) ') diff --git a/razor.fc b/razor.fc index 1efba0c..6e26673 100644 --- a/razor.fc +++ b/razor.fc @@ -1,8 +1,9 @@ -HOME_DIR/\.razor(/.*)? gen_context(system_u:object_r:razor_home_t,s0) +#/root/\.razor(/.*)? gen_context(system_u:object_r:razor_home_t,s0) +#HOME_DIR/\.razor(/.*)? gen_context(system_u:object_r:razor_home_t,s0) -/etc/razor(/.*)? gen_context(system_u:object_r:razor_etc_t,s0) +#/etc/razor(/.*)? gen_context(system_u:object_r:razor_etc_t,s0) -/usr/bin/razor.* -- gen_context(system_u:object_r:razor_exec_t,s0) +#/usr/bin/razor.* -- gen_context(system_u:object_r:razor_exec_t,s0) -/var/lib/razor(/.*)? gen_context(system_u:object_r:razor_var_lib_t,s0) -/var/log/razor-agent\.log -- gen_context(system_u:object_r:razor_log_t,s0) +#/var/lib/razor(/.*)? gen_context(system_u:object_r:razor_var_lib_t,s0) +#/var/log/razor-agent\.log.* -- gen_context(system_u:object_r:razor_log_t,s0) diff --git a/razor.if b/razor.if index f04a595..fee3b7c 100644 --- a/razor.if +++ b/razor.if @@ -26,6 +26,7 @@ template(`razor_common_domain_template',` gen_require(` type razor_exec_t, razor_etc_t, razor_log_t, razor_var_lib_t; ') + type $1_t; domain_type($1_t) domain_entry_file($1_t, razor_exec_t) @@ -46,7 +47,7 @@ template(`razor_common_domain_template',` # Read system config file allow $1_t razor_etc_t:dir list_dir_perms; allow $1_t razor_etc_t:file read_file_perms; - allow $1_t razor_etc_t:lnk_file { getattr read }; + allow $1_t razor_etc_t:lnk_file read_lnk_file_perms; manage_dirs_pattern($1_t, razor_log_t, razor_log_t) manage_files_pattern($1_t, razor_log_t, razor_log_t) @@ -93,7 +94,6 @@ template(`razor_common_domain_template',` libs_read_lib_files($1_t) - miscfiles_read_localization($1_t) sysnet_read_config($1_t) sysnet_dns_name_resolve($1_t) @@ -117,6 +117,7 @@ template(`razor_common_domain_template',` ## User domain for the role ## ## +## # interface(`razor_role',` gen_require(` @@ -130,7 +131,10 @@ interface(`razor_role',` # allow ps to show razor and allow the user to kill it ps_process_pattern($2, razor_t) - allow $2 razor_t:process signal; + allow $2 razor_t:process signal_perms; + tunable_policy(`deny_ptrace',`',` + allow $2 razor_t:process ptrace; + ') manage_dirs_pattern($2, razor_home_t, razor_home_t) manage_files_pattern($2, razor_home_t, razor_home_t) @@ -157,3 +161,43 @@ interface(`razor_domtrans',` domtrans_pattern($1, razor_exec_t, razor_t) ') + +######################################## +## +## Create, read, write, and delete razor files +## in a user home subdirectory. +## +## +## +## Domain allowed access. +## +## +# +interface(`razor_manage_user_home_files',` + gen_require(` + type razor_home_t; + ') + + userdom_search_user_home_dirs($1) + manage_files_pattern($1, razor_home_t, razor_home_t) + read_lnk_files_pattern($1, razor_home_t, razor_home_t) +') + +######################################## +## +## read razor lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`razor_read_lib_files',` + gen_require(` + type razor_var_lib_t; + ') + + files_search_var_lib($1) + read_files_pattern($1, razor_var_lib_t, razor_var_lib_t) +') diff --git a/razor.te b/razor.te index 9353d5e..4e15f29 100644 --- a/razor.te +++ b/razor.te @@ -5,117 +5,124 @@ policy_module(razor, 2.3.0) # Declarations # -type razor_exec_t; -corecmd_executable_file(razor_exec_t) +ifdef(`distro_redhat',` + gen_require(` + type spamc_t, spamc_exec_t, spamd_log_t; + type spamd_spool_t, spamd_var_lib_t, spamd_etc_t; + type spamc_home_t, spamc_tmp_t; + ') + + typealias spamc_t alias razor_t; + typealias spamc_exec_t alias razor_exec_t; + typealias spamd_log_t alias razor_log_t; + typealias spamd_var_lib_t alias razor_var_lib_t; + typealias spamd_etc_t alias razor_etc_t; + typealias spamc_home_t alias razor_home_t; + typealias spamc_home_t alias { user_razor_home_t staff_razor_home_t sysadm_razor_home_t }; + typealias spamc_home_t alias { auditadm_razor_home_t secadm_razor_home_t }; + typealias spamc_tmp_t alias { user_razor_tmp_t staff_razor_tmp_t sysadm_razor_tmp_t }; + typealias spamc_tmp_t alias { auditadm_razor_tmp_t secadm_razor_tmp_t }; +',` + type razor_exec_t; + corecmd_executable_file(razor_exec_t) + + type razor_etc_t; + files_config_file(razor_etc_t) + + type razor_home_t; + typealias razor_home_t alias { user_razor_home_t staff_razor_home_t sysadm_razor_home_t }; + typealias razor_home_t alias { auditadm_razor_home_t secadm_razor_home_t }; + userdom_user_home_content(razor_home_t) + + type razor_log_t; + logging_log_file(razor_log_t) + + type razor_tmp_t; + typealias razor_tmp_t alias { user_razor_tmp_t staff_razor_tmp_t sysadm_razor_tmp_t }; + typealias razor_tmp_t alias { auditadm_razor_tmp_t secadm_razor_tmp_t }; + files_tmp_file(razor_tmp_t) + ubac_constrained(razor_tmp_t) + + type razor_var_lib_t; + files_type(razor_var_lib_t) + + # these are here due to ordering issues: + razor_common_domain_template(razor) + typealias razor_t alias { user_razor_t staff_razor_t sysadm_razor_t }; + typealias razor_t alias { auditadm_razor_t secadm_razor_t }; + ubac_constrained(razor_t) + + razor_common_domain_template(system_razor) + role system_r types system_razor_t; + + ######################################## + # + # System razor local policy + # + + # this version of razor is invoked typically + # via the system spam filter + + allow system_razor_t self:tcp_socket create_socket_perms; + + manage_dirs_pattern(system_razor_t, razor_etc_t, razor_etc_t) + manage_files_pattern(system_razor_t, razor_etc_t, razor_etc_t) + manage_lnk_files_pattern(system_razor_t, razor_etc_t, razor_etc_t) + files_search_etc(system_razor_t) + + allow system_razor_t razor_log_t:file manage_file_perms; + logging_log_filetrans(system_razor_t, razor_log_t, file) + + manage_files_pattern(system_razor_t, razor_var_lib_t, razor_var_lib_t) + files_var_lib_filetrans(system_razor_t, razor_var_lib_t, file) + + corenet_all_recvfrom_netlabel(system_razor_t) + corenet_tcp_sendrecv_generic_if(system_razor_t) + corenet_raw_sendrecv_generic_if(system_razor_t) + corenet_tcp_sendrecv_generic_node(system_razor_t) + corenet_raw_sendrecv_generic_node(system_razor_t) + corenet_tcp_sendrecv_razor_port(system_razor_t) + corenet_tcp_connect_razor_port(system_razor_t) + corenet_sendrecv_razor_client_packets(system_razor_t) + + auth_use_nsswitch(system_razor_t) + + # cjp: this shouldn't be needed + userdom_use_unpriv_users_fds(system_razor_t) + + optional_policy(` + logging_send_syslog_msg(system_razor_t) + ') + + ######################################## + # + # User razor local policy + # + + # Allow razor to be run by hand. Needed by any action other than + # invocation from a spam filter. + + allow razor_t self:unix_stream_socket create_stream_socket_perms; + + manage_dirs_pattern(razor_t, razor_home_t, razor_home_t) + manage_files_pattern(razor_t, razor_home_t, razor_home_t) + manage_lnk_files_pattern(razor_t, razor_home_t, razor_home_t) + userdom_user_home_dir_filetrans(razor_t, razor_home_t, dir) + + manage_dirs_pattern(razor_t, razor_tmp_t, razor_tmp_t) + manage_files_pattern(razor_t, razor_tmp_t, razor_tmp_t) + files_tmp_filetrans(razor_t, razor_tmp_t, { file dir }) + + auth_use_nsswitch(razor_t) -type razor_etc_t; -files_config_file(razor_etc_t) + logging_send_syslog_msg(razor_t) -type razor_home_t; -typealias razor_home_t alias { user_razor_home_t staff_razor_home_t sysadm_razor_home_t }; -typealias razor_home_t alias { auditadm_razor_home_t secadm_razor_home_t }; -userdom_user_home_content(razor_home_t) + userdom_search_user_home_dirs(razor_t) + userdom_use_inherited_user_terminals(razor_t) -type razor_log_t; -logging_log_file(razor_log_t) + userdom_home_manager(razor_t) -type razor_tmp_t; -typealias razor_tmp_t alias { user_razor_tmp_t staff_razor_tmp_t sysadm_razor_tmp_t }; -typealias razor_tmp_t alias { auditadm_razor_tmp_t secadm_razor_tmp_t }; -userdom_user_tmp_file(razor_tmp_t) - -type razor_var_lib_t; -files_type(razor_var_lib_t) - -# these are here due to ordering issues: -razor_common_domain_template(razor) -typealias razor_t alias { user_razor_t staff_razor_t sysadm_razor_t }; -typealias razor_t alias { auditadm_razor_t secadm_razor_t }; -userdom_user_application_type(razor_t) - -razor_common_domain_template(system_razor) -role system_r types system_razor_t; - -######################################## -# -# System razor local policy -# - -# this version of razor is invoked typically -# via the system spam filter - -allow system_razor_t self:tcp_socket create_socket_perms; - -manage_dirs_pattern(system_razor_t, razor_etc_t, razor_etc_t) -manage_files_pattern(system_razor_t, razor_etc_t, razor_etc_t) -manage_lnk_files_pattern(system_razor_t, razor_etc_t, razor_etc_t) -files_search_etc(system_razor_t) - -allow system_razor_t razor_log_t:file manage_file_perms; -logging_log_filetrans(system_razor_t, razor_log_t, file) - -manage_files_pattern(system_razor_t, razor_var_lib_t, razor_var_lib_t) -files_var_lib_filetrans(system_razor_t, razor_var_lib_t, file) - -corenet_all_recvfrom_unlabeled(system_razor_t) -corenet_all_recvfrom_netlabel(system_razor_t) -corenet_tcp_sendrecv_generic_if(system_razor_t) -corenet_raw_sendrecv_generic_if(system_razor_t) -corenet_tcp_sendrecv_generic_node(system_razor_t) -corenet_raw_sendrecv_generic_node(system_razor_t) -corenet_tcp_sendrecv_razor_port(system_razor_t) -corenet_tcp_connect_razor_port(system_razor_t) -corenet_sendrecv_razor_client_packets(system_razor_t) - -sysnet_read_config(system_razor_t) - -# cjp: this shouldn't be needed -userdom_use_unpriv_users_fds(system_razor_t) - -optional_policy(` - logging_send_syslog_msg(system_razor_t) -') - -optional_policy(` - nscd_socket_use(system_razor_t) -') - -######################################## -# -# User razor local policy -# - -# Allow razor to be run by hand. Needed by any action other than -# invocation from a spam filter. - -allow razor_t self:unix_stream_socket create_stream_socket_perms; - -manage_dirs_pattern(razor_t, razor_home_t, razor_home_t) -manage_files_pattern(razor_t, razor_home_t, razor_home_t) -manage_lnk_files_pattern(razor_t, razor_home_t, razor_home_t) -userdom_user_home_dir_filetrans(razor_t, razor_home_t, dir) - -manage_dirs_pattern(razor_t, razor_tmp_t, razor_tmp_t) -manage_files_pattern(razor_t, razor_tmp_t, razor_tmp_t) -files_tmp_filetrans(razor_t, razor_tmp_t, { file dir }) - -logging_send_syslog_msg(razor_t) - -userdom_search_user_home_dirs(razor_t) -userdom_use_user_terminals(razor_t) - -tunable_policy(`use_nfs_home_dirs',` - fs_manage_nfs_dirs(razor_t) - fs_manage_nfs_files(razor_t) - fs_manage_nfs_symlinks(razor_t) -') - -tunable_policy(`use_samba_home_dirs',` - fs_manage_cifs_dirs(razor_t) - fs_manage_cifs_files(razor_t) - fs_manage_cifs_symlinks(razor_t) -') - -optional_policy(` - nscd_socket_use(razor_t) + optional_policy(` + milter_manage_spamass_state(razor_t) + ') ') diff --git a/rdisc.fc b/rdisc.fc index dee4adc..a7e4bc7 100644 --- a/rdisc.fc +++ b/rdisc.fc @@ -1,2 +1,4 @@ /sbin/rdisc -- gen_context(system_u:object_r:rdisc_exec_t,s0) + +/usr/sbin/rdisc -- gen_context(system_u:object_r:rdisc_exec_t,s0) diff --git a/rdisc.te b/rdisc.te index 0f07685..1b75760 100644 --- a/rdisc.te +++ b/rdisc.te @@ -25,7 +25,6 @@ kernel_list_proc(rdisc_t) kernel_read_proc_symlinks(rdisc_t) kernel_read_kernel_sysctls(rdisc_t) -corenet_all_recvfrom_unlabeled(rdisc_t) corenet_all_recvfrom_netlabel(rdisc_t) corenet_udp_sendrecv_generic_if(rdisc_t) corenet_raw_sendrecv_generic_if(rdisc_t) @@ -43,8 +42,6 @@ files_read_etc_files(rdisc_t) logging_send_syslog_msg(rdisc_t) -miscfiles_read_localization(rdisc_t) - sysnet_read_config(rdisc_t) userdom_dontaudit_use_unpriv_user_fds(rdisc_t) diff --git a/readahead.fc b/readahead.fc index 7077413..0428aee 100644 --- a/readahead.fc +++ b/readahead.fc @@ -1,3 +1,10 @@ -/usr/sbin/readahead.* -- gen_context(system_u:object_r:readahead_exec_t,s0) +/dev/\.systemd/readahead(/.*)? gen_context(system_u:object_r:readahead_var_run_t,s0) + /sbin/readahead.* -- gen_context(system_u:object_r:readahead_exec_t,s0) +/usr/sbin/readahead.* -- gen_context(system_u:object_r:readahead_exec_t,s0) + +/usr/lib/systemd/systemd-readahead.* -- gen_context(system_u:object_r:readahead_exec_t,s0) + /var/lib/readahead(/.*)? gen_context(system_u:object_r:readahead_var_lib_t,s0) + +/var/run/systemd/readahead(/.*)? gen_context(system_u:object_r:readahead_var_run_t,s0) diff --git a/readahead.if b/readahead.if index 47c4723..64c8889 100644 --- a/readahead.if +++ b/readahead.if @@ -1 +1,44 @@ ## Readahead, read files into page cache for improved performance + +######################################## +## +## Transition to the readahead domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`readahead_domtrans',` + gen_require(` + type readahead_t, readahead_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, readahead_exec_t, readahead_t) +') + +######################################## +## +## Manage readahead var_run files. +## +## +## +## Domain allowed access. +## +## +# +interface(`readahead_manage_pid_files',` + gen_require(` + type readahead_var_run_t; + ') + + manage_dirs_pattern($1, readahead_var_run_t, readahead_var_run_t) + manage_files_pattern($1, readahead_var_run_t, readahead_var_run_t) + dev_filetrans($1, readahead_var_run_t, { dir file }) + init_pid_filetrans($1, readahead_var_run_t, { dir file }) + files_search_pids($1) + init_search_pid_dirs($1) +') + diff --git a/readahead.te b/readahead.te index b4ac57e..dffaad9 100644 --- a/readahead.te +++ b/readahead.te @@ -16,13 +16,14 @@ typealias readahead_var_lib_t alias readahead_etc_rw_t; type readahead_var_run_t; files_pid_file(readahead_var_run_t) +dev_associate(readahead_var_run_t) ######################################## # # Local policy # -allow readahead_t self:capability { fowner dac_override dac_read_search }; +allow readahead_t self:capability { sys_admin fowner dac_override dac_read_search }; dontaudit readahead_t self:capability { net_admin sys_tty_config }; allow readahead_t self:process { setsched signal_perms }; @@ -31,13 +32,18 @@ manage_files_pattern(readahead_t, readahead_var_lib_t, readahead_var_lib_t) files_search_var_lib(readahead_t) manage_files_pattern(readahead_t, readahead_var_run_t, readahead_var_run_t) -files_pid_filetrans(readahead_t, readahead_var_run_t, file) +manage_dirs_pattern(readahead_t, readahead_var_run_t, readahead_var_run_t) +files_pid_filetrans(readahead_t, readahead_var_run_t, { dir file }) +dev_filetrans(readahead_t, readahead_var_run_t, { dir file }) +init_pid_filetrans(readahead_t, readahead_var_run_t, { dir file }) kernel_read_all_sysctls(readahead_t) kernel_read_system_state(readahead_t) kernel_dontaudit_getattr_core_if(readahead_t) -dev_read_sysfs(readahead_t) +dev_rw_sysfs(readahead_t) +dev_read_kmsg(readahead_t) +dev_write_kmsg(readahead_t) dev_getattr_generic_chr_files(readahead_t) dev_getattr_generic_blk_files(readahead_t) dev_getattr_all_chr_files(readahead_t) @@ -53,10 +59,18 @@ domain_read_all_domains_state(readahead_t) files_list_non_security(readahead_t) files_read_non_security_files(readahead_t) +files_dontaudit_read_security_files(readahead_t) files_create_boot_flag(readahead_t) files_getattr_all_pipes(readahead_t) files_dontaudit_getattr_all_sockets(readahead_t) files_dontaudit_getattr_non_security_blk_files(readahead_t) +files_dontaudit_all_access_check(readahead_t) + +ifdef(`hide_broken_symptoms', ` + files_dontaudit_write_all_files(readahead_t) + dev_dontaudit_write_all_chr_files(readahead_t) + dev_dontaudit_write_all_blk_files(readahead_t) +') fs_getattr_all_fs(readahead_t) fs_search_auto_mountpoints(readahead_t) @@ -66,12 +80,14 @@ fs_read_cgroup_files(readahead_t) fs_read_tmpfs_files(readahead_t) fs_read_tmpfs_symlinks(readahead_t) fs_list_inotifyfs(readahead_t) +fs_dontaudit_read_tmpfs_blk_dev(readahead_t) fs_dontaudit_search_ramfs(readahead_t) fs_dontaudit_read_ramfs_pipes(readahead_t) fs_dontaudit_read_ramfs_files(readahead_t) fs_dontaudit_use_tmpfs_chr_dev(readahead_t) mls_file_read_all_levels(readahead_t) +mcs_file_read_all(readahead_t) storage_raw_read_fixed_disk(readahead_t) @@ -82,13 +98,13 @@ auth_dontaudit_read_shadow(readahead_t) init_use_fds(readahead_t) init_use_script_ptys(readahead_t) init_getattr_initctl(readahead_t) +# needs to write to /run/systemd/notify +init_write_pid_socket(readahead_t) logging_send_syslog_msg(readahead_t) logging_set_audit_parameters(readahead_t) logging_dontaudit_search_audit_config(readahead_t) -miscfiles_read_localization(readahead_t) - userdom_dontaudit_use_unpriv_user_fds(readahead_t) userdom_dontaudit_search_user_home_dirs(readahead_t) diff --git a/realmd.fc b/realmd.fc new file mode 100644 index 0000000..3c24ce4 --- /dev/null +++ b/realmd.fc @@ -0,0 +1 @@ +/usr/lib/realmd/realmd -- gen_context(system_u:object_r:realmd_exec_t,s0) diff --git a/realmd.if b/realmd.if new file mode 100644 index 0000000..e38693b --- /dev/null +++ b/realmd.if @@ -0,0 +1,42 @@ + +## dbus system service which manages discovery and enrollment in realms and domains like Active Directory or IPA + +######################################## +## +## Execute realmd in the realmd_t domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`realmd_domtrans',` + gen_require(` + type realmd_t, realmd_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, realmd_exec_t, realmd_t) +') + +######################################## +## +## Send and receive messages from +## realmd over dbus. +## +## +## +## Domain allowed access. +## +## +# +interface(`realmd_dbus_chat',` + gen_require(` + type realmd_t; + class dbus send_msg; + ') + + allow $1 realmd_t:dbus send_msg; + allow realmd_t $1:dbus send_msg; +') diff --git a/realmd.te b/realmd.te new file mode 100644 index 0000000..ef3e11e --- /dev/null +++ b/realmd.te @@ -0,0 +1,46 @@ +policy_module(realmd, 1.0.0) + +######################################## +# +# Declarations +# + +type realmd_t; +type realmd_exec_t; +application_domain(realmd_t, realmd_exec_t) +role system_r types realmd_t; + +######################################## +# +# realmd local policy +# + +allow realmd_t self:capability { kill }; + +domain_use_interactive_fds(realmd_t) + +files_read_etc_files(realmd_t) +files_read_usr_files(realmd_t) + +logging_send_syslog_msg(realmd_t) + +sysnet_read_config(realmd_t) + +optional_policy(` + dbus_system_domain(realmd_t, realmd_exec_t) +') + +optional_policy(` + kerberos_use(realmd_t) +') + +optional_policy(` + samba_domtrans_net(realmd_t) + samba_read_config(realmd_t) +') + +optional_policy(` + sssd_read_config(realmd_t) + sssd_write_config(realmd_t) + sssd_create_config(realmd_t) +') diff --git a/remotelogin.te b/remotelogin.te index 0a76027..18f59a7 100644 --- a/remotelogin.te +++ b/remotelogin.te @@ -10,9 +10,6 @@ domain_interactive_fd(remote_login_t) auth_login_pgm_domain(remote_login_t) auth_login_entry_type(remote_login_t) -type remote_login_tmp_t; -files_tmp_file(remote_login_tmp_t) - ######################################## # # Remote login remote policy @@ -34,10 +31,6 @@ allow remote_login_t self:msgq create_msgq_perms; allow remote_login_t self:msg { send receive }; allow remote_login_t self:key write; -manage_dirs_pattern(remote_login_t, remote_login_tmp_t, remote_login_tmp_t) -manage_files_pattern(remote_login_t, remote_login_tmp_t, remote_login_tmp_t) -files_tmp_filetrans(remote_login_t, remote_login_tmp_t, { file dir }) - kernel_read_system_state(remote_login_t) kernel_read_kernel_sysctls(remote_login_t) @@ -49,6 +42,8 @@ fs_getattr_xattr_fs(remote_login_t) fs_search_auto_mountpoints(remote_login_t) term_relabel_all_ptys(remote_login_t) +term_use_all_ptys(remote_login_t) +term_setattr_all_ptys(remote_login_t) auth_rw_login_records(remote_login_t) auth_rw_faillog(remote_login_t) @@ -64,7 +59,6 @@ corecmd_read_bin_sockets(remote_login_t) domain_read_all_entry_files(remote_login_t) -files_read_etc_files(remote_login_t) files_read_etc_runtime_files(remote_login_t) files_list_home(remote_login_t) files_read_usr_files(remote_login_t) @@ -77,9 +71,8 @@ files_list_mnt(remote_login_t) # for when /var/mail is a sym-link files_read_var_symlinks(remote_login_t) -sysnet_dns_name_resolve(remote_login_t) +auth_use_nsswitch(remote_login_t) -miscfiles_read_localization(remote_login_t) userdom_use_unpriv_users_fds(remote_login_t) userdom_search_user_home_content(remote_login_t) @@ -87,34 +80,28 @@ userdom_search_user_home_content(remote_login_t) # since very weak authentication is used. userdom_signal_unpriv_users(remote_login_t) userdom_spec_domtrans_unpriv_users(remote_login_t) +userdom_use_user_ptys(remote_login_t) -# Search for mail spool file. -mta_getattr_spool(remote_login_t) +userdom_manage_user_tmp_dirs(remote_login_t) +userdom_manage_user_tmp_files(remote_login_t) +userdom_tmp_filetrans_user_tmp(remote_login_t, { file dir }) -tunable_policy(`use_nfs_home_dirs',` - fs_read_nfs_files(remote_login_t) - fs_read_nfs_symlinks(remote_login_t) -') - -tunable_policy(`use_samba_home_dirs',` - fs_read_cifs_files(remote_login_t) - fs_read_cifs_symlinks(remote_login_t) -') +userdom_home_reader(remote_login_t) optional_policy(` alsa_domtrans(remote_login_t) ') optional_policy(` - nis_use_ypbind(remote_login_t) + # Search for mail spool file. + mta_getattr_spool(remote_login_t) ') optional_policy(` - nscd_socket_use(remote_login_t) + telnet_use_ptys(remote_login_t) ') optional_policy(` - unconfined_domain(remote_login_t) unconfined_shell_domtrans(remote_login_t) ') diff --git a/resmgr.fc b/resmgr.fc index af810b9..a888eb9 100644 --- a/resmgr.fc +++ b/resmgr.fc @@ -2,6 +2,7 @@ /etc/resmgr\.conf -- gen_context(system_u:object_r:resmgrd_etc_t,s0) /sbin/resmgrd -- gen_context(system_u:object_r:resmgrd_exec_t,s0) +/usr/sbin/resmgrd -- gen_context(system_u:object_r:resmgrd_exec_t,s0) /var/run/\.resmgr_socket -s gen_context(system_u:object_r:resmgrd_var_run_t,s0) /var/run/resmgr\.pid -- gen_context(system_u:object_r:resmgrd_var_run_t,s0) diff --git a/resmgr.if b/resmgr.if index d457736..eabdd78 100644 --- a/resmgr.if +++ b/resmgr.if @@ -16,7 +16,6 @@ interface(`resmgr_stream_connect',` type resmgrd_var_run_t, resmgrd_t; ') - allow $1 resmgrd_t:unix_stream_socket connectto; - allow $1 resmgrd_var_run_t:sock_file { getattr write }; files_search_pids($1) + stream_connect_pattern($1, resmgrd_var_run_t, resmgrd_var_run_t, resmgrd_t) ') diff --git a/resmgr.te b/resmgr.te index bf5efbf..b38b22d 100644 --- a/resmgr.te +++ b/resmgr.te @@ -53,8 +53,6 @@ storage_raw_write_removable_device(resmgrd_t) logging_send_syslog_msg(resmgrd_t) -miscfiles_read_localization(resmgrd_t) - userdom_dontaudit_use_unpriv_user_fds(resmgrd_t) optional_policy(` diff --git a/rgmanager.fc b/rgmanager.fc index 3c97ef0..48c4029 100644 --- a/rgmanager.fc +++ b/rgmanager.fc @@ -1,7 +1,19 @@ +/etc/rc\.d/init\.d/cpglockd -- gen_context(system_u:object_r:rgmanager_initrc_exec_t,s0) +/etc/rc\.d/init\.d/rgmanager -- gen_context(system_u:object_r:rgmanager_initrc_exec_t,s0) +/etc/rc\.d/init\.d/heartbeat -- gen_context(system_u:object_r:rgmanager_initrc_exec_t,s0) + +/usr/sbin/cpglockd -- gen_context(system_u:object_r:rgmanager_exec_t,s0) /usr/sbin/rgmanager -- gen_context(system_u:object_r:rgmanager_exec_t,s0) -/var/log/cluster/rgmanager\.log -- gen_context(system_u:object_r:rgmanager_var_log_t,s0) +/usr/lib(64)?/heartbeat(/.*)? gen_context(system_u:object_r:rgmanager_var_lib_t,s0) +/usr/lib(64)?/heartbeat/heartbeat -- gen_context(system_u:object_r:rgmanager_exec_t,s0) +/var/lib/heartbeat(/.*)? gen_context(system_u:object_r:rgmanager_var_lib_t,s0) + +/var/log/cluster/cpglockd\.log.* -- gen_context(system_u:object_r:rgmanager_var_log_t,s0) +/var/log/cluster/rgmanager\.log.* -- gen_context(system_u:object_r:rgmanager_var_log_t,s0) /var/run/cluster/rgmanager\.sk -s gen_context(system_u:object_r:rgmanager_var_run_t,s0) +/var/run/cpglockd\.pid -- gen_context(system_u:object_r:rgmanager_var_run_t,s0) +/var/run/heartbeat(/.*)? gen_context(system_u:object_r:rgmanager_var_run_t,s0) /var/run/rgmanager\.pid -- gen_context(system_u:object_r:rgmanager_var_run_t,s0) diff --git a/rgmanager.if b/rgmanager.if index 7dc38d1..5bd6fdb 100644 --- a/rgmanager.if +++ b/rgmanager.if @@ -5,9 +5,9 @@ ## Execute a domain transition to run rgmanager. ## ## -## +## ## Domain allowed to transition. -## +## ## # interface(`rgmanager_domtrans',` @@ -21,7 +21,7 @@ interface(`rgmanager_domtrans',` ######################################## ## -## Connect to rgmanager over an unix stream socket. +## Connect to rgmanager over a unix stream socket. ## ## ## @@ -75,3 +75,91 @@ interface(`rgmanager_manage_tmpfs_files',` fs_search_tmpfs($1) manage_files_pattern($1, rgmanager_tmpfs_t, rgmanager_tmpfs_t) ') + +####################################### +## +## Allow read and write access to rgmanager semaphores. +## +## +## +## Domain allowed access. +## +## +# +interface(`rgmanager_rw_semaphores',` + gen_require(` + type rgmanager_t; + ') + + allow $1 rgmanager_t:sem rw_sem_perms; +') + +###################################### +## +## All of the rules required to administrate +## an rgmanager environment +## +## +## +## Domain allowed access. +## +## +## +## +## The role to be allowed to manage the rgmanager domain. +## +## +## +# +interface(`rgmanager_admin',` + gen_require(` + type rgmanager_t, rgmanager_initrc_exec_t, rgmanager_tmp_t; + type rgmanager_tmpfs_t, rgmanager_var_log_t, rgmanager_var_run_t; + ') + + allow $1 rgmanager_t:process signal_perms; + ps_process_pattern($1, rgmanager_t) + tunable_policy(`deny_ptrace',`',` + allow $1 rgmanager_t:process ptrace; + ') + + init_labeled_script_domtrans($1, rgmanager_initrc_exec_t) + domain_system_change_exemption($1) + role_transition $2 rgmanager_initrc_exec_t system_r; + allow $2 system_r; + + files_list_tmp($1) + admin_pattern($1, rgmanager_tmp_t) + + admin_pattern($1, rgmanager_tmpfs_t) + + logging_list_logs($1) + admin_pattern($1, rgmanager_var_log_t) + + files_list_pids($1) + admin_pattern($1, rgmanager_var_run_t) +') + + +###################################### +## +## Allow the specified domain to manage rgmanager's lib/run files. +## +## +## +## Domain allowed access. +## +## +# +interface(`rgmanager_manage_files',` + gen_require(` + type rgmanager_var_lib_t; + type rgmanager_var_run_t; + ') + + files_list_var_lib($1) + admin_pattern($1, rgmanager_var_lib_t) + + files_list_pids($1) + admin_pattern($1, rgmanager_var_run_t) +') diff --git a/rgmanager.te b/rgmanager.te index 3786c45..1ad9c12 100644 --- a/rgmanager.te +++ b/rgmanager.te @@ -14,15 +14,20 @@ gen_tunable(rgmanager_can_network_connect, false) type rgmanager_t; type rgmanager_exec_t; -domain_type(rgmanager_t) init_daemon_domain(rgmanager_t, rgmanager_exec_t) +type rgmanager_initrc_exec_t; +init_script_file(rgmanager_initrc_exec_t) + type rgmanager_tmp_t; files_tmp_file(rgmanager_tmp_t) type rgmanager_tmpfs_t; files_tmpfs_file(rgmanager_tmpfs_t) +type rgmanager_var_lib_t; +files_type(rgmanager_var_lib_t) + type rgmanager_var_log_t; logging_log_file(rgmanager_var_log_t) @@ -35,9 +40,7 @@ files_pid_file(rgmanager_var_run_t) # allow rgmanager_t self:capability { dac_override net_raw sys_resource sys_admin sys_nice ipc_lock }; -dontaudit rgmanager_t self:capability { sys_ptrace }; allow rgmanager_t self:process { setsched signal }; -dontaudit rgmanager_t self:process { ptrace }; allow rgmanager_t self:fifo_file rw_fifo_file_perms; allow rgmanager_t self:unix_stream_socket { create_stream_socket_perms }; @@ -52,14 +55,27 @@ manage_dirs_pattern(rgmanager_t, rgmanager_tmpfs_t, rgmanager_tmpfs_t) manage_files_pattern(rgmanager_t, rgmanager_tmpfs_t, rgmanager_tmpfs_t) fs_tmpfs_filetrans(rgmanager_t, rgmanager_tmpfs_t, { dir file }) +# var/lib files +# # needed by hearbeat +can_exec(rgmanager_t, rgmanager_var_lib_t) +manage_files_pattern(rgmanager_t, rgmanager_var_lib_t,rgmanager_var_lib_t) +manage_dirs_pattern(rgmanager_t, rgmanager_var_lib_t,rgmanager_var_lib_t) +manage_sock_files_pattern(rgmanager_t, rgmanager_var_lib_t,rgmanager_var_lib_t) +manage_fifo_files_pattern(rgmanager_t, rgmanager_var_lib_t,rgmanager_var_lib_t) +files_var_lib_filetrans(rgmanager_t,rgmanager_var_lib_t, { file dir fifo_file sock_file }) + + manage_files_pattern(rgmanager_t, rgmanager_var_log_t, rgmanager_var_log_t) logging_log_filetrans(rgmanager_t, rgmanager_var_log_t, { file }) +manage_dirs_pattern(rgmanager_t, rgmanager_var_run_t, rgmanager_var_run_t) manage_files_pattern(rgmanager_t, rgmanager_var_run_t, rgmanager_var_run_t) manage_sock_files_pattern(rgmanager_t, rgmanager_var_run_t, rgmanager_var_run_t) -files_pid_filetrans(rgmanager_t, rgmanager_var_run_t, { file sock_file }) +files_pid_filetrans(rgmanager_t, rgmanager_var_run_t, { file sock_file dir }) +kernel_kill(rgmanager_t) kernel_read_kernel_sysctls(rgmanager_t) +kernel_read_rpc_sysctls(rgmanager_t) kernel_read_system_state(rgmanager_t) kernel_rw_rpc_sysctls(rgmanager_t) kernel_search_debugfs(rgmanager_t) @@ -67,7 +83,6 @@ kernel_search_network_state(rgmanager_t) corecmd_exec_bin(rgmanager_t) corecmd_exec_shell(rgmanager_t) -consoletype_exec(rgmanager_t) # need to write to /dev/misc/dlm-control dev_rw_dlm_control(rgmanager_t) @@ -76,31 +91,35 @@ dev_search_sysfs(rgmanager_t) domain_read_all_domains_state(rgmanager_t) domain_getattr_all_domains(rgmanager_t) -domain_dontaudit_ptrace_all_domains(rgmanager_t) -files_list_all(rgmanager_t) +files_create_var_run_dirs(rgmanager_t) files_getattr_all_symlinks(rgmanager_t) +files_list_all(rgmanager_t) files_manage_mnt_dirs(rgmanager_t) +files_manage_mnt_files(rgmanager_t) +files_manage_mnt_symlinks(rgmanager_t) +files_manage_isid_type_files(rgmanager_t) files_manage_isid_type_dirs(rgmanager_t) fs_getattr_xattr_fs(rgmanager_t) fs_getattr_all_fs(rgmanager_t) +storage_raw_read_fixed_disk(rgmanager_t) storage_getattr_fixed_disk_dev(rgmanager_t) term_getattr_pty_fs(rgmanager_t) -#term_use_ptmx(rgmanager_t) # needed by resources scripts -files_read_non_auth_files(rgmanager_t) +files_read_non_security_files(rgmanager_t) auth_dontaudit_getattr_shadow(rgmanager_t) auth_use_nsswitch(rgmanager_t) -logging_send_syslog_msg(rgmanager_t) +init_domtrans_script(rgmanager_t) +init_initrc_domain(rgmanager_t) -miscfiles_read_localization(rgmanager_t) +logging_send_syslog_msg(rgmanager_t) -mount_domtrans(rgmanager_t) +userdom_kill_all_users(rgmanager_t) tunable_policy(`rgmanager_can_network_connect',` corenet_tcp_connect_all_ports(rgmanager_t) @@ -118,6 +137,14 @@ optional_policy(` ') optional_policy(` + consoletype_exec(rgmanager_t) +') + +optional_policy(` + dbus_system_bus_client(rgmanager_t) +') + +optional_policy(` fstools_domtrans(rgmanager_t) ') @@ -140,6 +167,16 @@ optional_policy(` ') optional_policy(` + ldap_initrc_domtrans(rgmanager_t) + ldap_systemctl(rgmanager_t) + ldap_domtrans(rgmanager_t) +') + +optional_policy(` + mount_domtrans(rgmanager_t) +') + +optional_policy(` mysql_domtrans_mysql_safe(rgmanager_t) mysql_stream_connect(rgmanager_t) ') @@ -165,6 +202,8 @@ optional_policy(` optional_policy(` rpc_initrc_domtrans_nfsd(rgmanager_t) rpc_initrc_domtrans_rpcd(rgmanager_t) + rpc_systemctl_nfsd(rgmanager_t) + rpc_systemctl_rpcd(rgmanager_t) rpc_domtrans_nfsd(rgmanager_t) rpc_domtrans_rpcd(rgmanager_t) diff --git a/rhcs.fc b/rhcs.fc index c2ba53b..1f935bf 100644 --- a/rhcs.fc +++ b/rhcs.fc @@ -1,20 +1,25 @@ /usr/sbin/dlm_controld -- gen_context(system_u:object_r:dlm_controld_exec_t,s0) /usr/sbin/fenced -- gen_context(system_u:object_r:fenced_exec_t,s0) /usr/sbin/fence_node -- gen_context(system_u:object_r:fenced_exec_t,s0) +/usr/sbin/fence_tool -- gen_context(system_u:object_r:fenced_exec_t,s0) /usr/sbin/gfs_controld -- gen_context(system_u:object_r:gfs_controld_exec_t,s0) +/usr/sbin/foghorn -- gen_context(system_u:object_r:foghorn_exec_t,s0) /usr/sbin/groupd -- gen_context(system_u:object_r:groupd_exec_t,s0) /usr/sbin/qdiskd -- gen_context(system_u:object_r:qdiskd_exec_t,s0) /var/lock/fence_manual\.lock -- gen_context(system_u:object_r:fenced_lock_t,s0) +/var/lib/cluster(/.*)? gen_context(system_u:object_r:cluster_var_lib_t,s0) /var/lib/qdiskd(/.*)? gen_context(system_u:object_r:qdiskd_var_lib_t,s0) +/var/log/cluster/.*\.*log <> /var/log/cluster/dlm_controld\.log.* -- gen_context(system_u:object_r:dlm_controld_var_log_t,s0) /var/log/cluster/fenced\.log.* -- gen_context(system_u:object_r:fenced_var_log_t,s0) /var/log/cluster/gfs_controld\.log.* -- gen_context(system_u:object_r:gfs_controld_var_log_t,s0) /var/log/cluster/qdiskd\.log.* -- gen_context(system_u:object_r:qdiskd_var_log_t,s0) /var/run/cluster/fenced_override -- gen_context(system_u:object_r:fenced_var_run_t,s0) +/var/run/cluster/fence_scsi.* -- gen_context(system_u:object_r:fenced_var_run_t,s0) /var/run/dlm_controld\.pid -- gen_context(system_u:object_r:dlm_controld_var_run_t,s0) /var/run/fenced\.pid -- gen_context(system_u:object_r:fenced_var_run_t,s0) /var/run/gfs_controld\.pid -- gen_context(system_u:object_r:gfs_controld_var_run_t,s0) diff --git a/rhcs.if b/rhcs.if index de37806..8ed6546 100644 --- a/rhcs.if +++ b/rhcs.if @@ -1,3 +1,43 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ## RHCS - Red Hat Cluster Suite ####################################### @@ -13,7 +53,7 @@ # template(`rhcs_domain_template',` gen_require(` - attribute cluster_domain; + attribute cluster_domain, cluster_tmpfs, cluster_pid; ') ############################## @@ -25,13 +65,13 @@ template(`rhcs_domain_template',` type $1_exec_t; init_daemon_domain($1_t, $1_exec_t) - type $1_tmpfs_t; + type $1_tmpfs_t, cluster_tmpfs; files_tmpfs_file($1_tmpfs_t) type $1_var_log_t; logging_log_file($1_var_log_t) - type $1_var_run_t; + type $1_var_run_t, cluster_pid; files_pid_file($1_var_run_t) ############################## @@ -50,8 +90,11 @@ template(`rhcs_domain_template',` manage_files_pattern($1_t, $1_var_run_t, $1_var_run_t) manage_fifo_files_pattern($1_t, $1_var_run_t, $1_var_run_t) manage_sock_files_pattern($1_t, $1_var_run_t, $1_var_run_t) - files_pid_filetrans($1_t, $1_var_run_t, { file fifo_file }) + files_pid_filetrans($1_t, $1_var_run_t, { dir file fifo_file }) + auth_use_nsswitch($1_t) + + logging_send_syslog_msg($1_t) ') ###################################### @@ -59,9 +102,9 @@ template(`rhcs_domain_template',` ## Execute a domain transition to run dlm_controld. ## ## -## +## ## Domain allowed to transition. -## +## ## # interface(`rhcs_domtrans_dlm_controld',` @@ -133,6 +176,24 @@ interface(`rhcs_domtrans_fenced',` domtrans_pattern($1, fenced_exec_t, fenced_t) ') +##################################### +## +## Allow a domain to getattr on fenced executable. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`rhcs_getattr_fenced',` + gen_require(` + type fenced_t, fenced_exec_t; + ') + + allow $1 fenced_exec_t:file getattr; +') + ###################################### ## ## Allow read and write access to fenced semaphores. @@ -156,7 +217,7 @@ interface(`rhcs_rw_fenced_semaphores',` ###################################### ## -## Connect to fenced over an unix domain stream socket. +## Connect to fenced over a unix domain stream socket. ## ## ## @@ -169,9 +230,8 @@ interface(`rhcs_stream_connect_fenced',` type fenced_var_run_t, fenced_t; ') - allow $1 fenced_t:unix_stream_socket connectto; - allow $1 fenced_var_run_t:sock_file { getattr write }; files_search_pids($1) + stream_connect_pattern($1, fenced_var_run_t, fenced_var_run_t, fenced_t) ') ##################################### @@ -237,7 +297,7 @@ interface(`rhcs_rw_gfs_controld_shm',` ##################################### ## -## Connect to gfs_controld_t over an unix domain stream socket. +## Connect to gfs_controld_t over a unix domain stream socket. ## ## ## @@ -335,6 +395,65 @@ interface(`rhcs_rw_groupd_shm',` manage_files_pattern($1, groupd_tmpfs_t, groupd_tmpfs_t) ') +######################################## +## +## Read and write to group shared memory. +## +## +## +## Domain allowed access. +## +## +# +interface(`rhcs_rw_cluster_shm',` + gen_require(` + attribute cluster_domain, cluster_tmpfs; + ') + + allow $1 cluster_domain:shm { rw_shm_perms destroy }; + + fs_search_tmpfs($1) + manage_files_pattern($1, cluster_tmpfs, cluster_tmpfs) +') + +#################################### +## +## Read and write access to cluster domains semaphores. +## +## +## +## Domain allowed access. +## +## +# +interface(`rhcs_rw_cluster_semaphores',` + gen_require(` + attribute cluster_domain; + ') + + allow $1 cluster_domain:sem { rw_sem_perms destroy }; +') + +#################################### +## +## Connect to cluster domains over a unix domain +## stream socket. +## +## +## +## Domain allowed access. +## +## +# +interface(`rhcs_stream_connect_cluster',` + gen_require(` + attribute cluster_domain, cluster_pid; + ') + + files_search_pids($1) + stream_connect_pattern($1, cluster_pid, cluster_pid, cluster_domain) +') + ###################################### ## ## Execute a domain transition to run qdiskd. @@ -353,3 +472,80 @@ interface(`rhcs_domtrans_qdiskd',` corecmd_search_bin($1) domtrans_pattern($1, qdiskd_exec_t, qdiskd_t) ') + +######################################## +## +## Allow domain to read qdiskd tmpfs files +## +## +## +## Domain allowed access. +## +## +# +interface(`rhcs_read_qdiskd_tmpfs_files',` + gen_require(` + type qdiskd_tmpfs_t; + ') + + fs_search_tmpfs($1) + allow $1 qdiskd_tmpfs_t:file read_file_perms; +') + +###################################### +## +## Allow domain to read cluster lib files +## +## +## +## Domain allowed access. +## +## +# +interface(`rhcs_read_cluster_lib_files',` + gen_require(` + type cluster_var_lib_t; + ') + + files_search_var_lib($1) + read_files_pattern($1, cluster_var_lib_t, cluster_var_lib_t) +') + +##################################### +## +## Allow domain to manage cluster lib files +## +## +## +## Domain allowed access. +## +## +# +interface(`rhcs_manage_cluster_lib_files',` + gen_require(` + type cluster_var_lib_t; + ') + + files_search_var_lib($1) + manage_files_pattern($1, cluster_var_lib_t, cluster_var_lib_t) +') + +#################################### +## +## Allow domain to relabel cluster lib files +## +## +## +## Domain allowed access. +## +## +# +interface(`rhcs_relabel_cluster_lib_files',` + gen_require(` + type cluster_var_lib_t; + ') + + files_search_var_lib($1) + relabelto_files_pattern($1, cluster_var_lib_t, cluster_var_lib_t) + relabelfrom_files_pattern($1, cluster_var_lib_t, cluster_var_lib_t) +') diff --git a/rhcs.te b/rhcs.te index 93c896a..4f499ab 100644 --- a/rhcs.te +++ b/rhcs.te @@ -12,7 +12,16 @@ policy_module(rhcs, 1.1.0) ## gen_tunable(fenced_can_network_connect, false) +## +##

+## Allow fenced domain to execute ssh. +##

+## +gen_tunable(fenced_can_ssh, false) + attribute cluster_domain; +attribute cluster_tmpfs; +attribute cluster_pid; rhcs_domain_template(dlm_controld) @@ -24,6 +33,8 @@ files_lock_file(fenced_lock_t) type fenced_tmp_t; files_tmp_file(fenced_tmp_t) +rhcs_domain_template(foghorn) + rhcs_domain_template(gfs_controld) rhcs_domain_template(groupd) @@ -33,6 +44,10 @@ rhcs_domain_template(qdiskd) type qdiskd_var_lib_t; files_type(qdiskd_var_lib_t) +# type for cluster lib files +type cluster_var_lib_t; +files_type(cluster_var_lib_t) + ##################################### # # dlm_controld local policy @@ -46,6 +61,9 @@ stream_connect_pattern(dlm_controld_t, fenced_var_run_t, fenced_var_run_t, fence stream_connect_pattern(dlm_controld_t, groupd_var_run_t, groupd_var_run_t, groupd_t) kernel_read_system_state(dlm_controld_t) +kernel_rw_net_sysctls(dlm_controld_t) + +corecmd_exec_bin(dlm_controld_t) dev_rw_dlm_control(dlm_controld_t) dev_rw_sysfs(dlm_controld_t) @@ -56,7 +74,7 @@ fs_manage_configfs_dirs(dlm_controld_t) init_rw_script_tmp_files(dlm_controld_t) optional_policy(` - ccs_stream_connect(dlm_controld_t) + corosync_rw_tmpfs(dlm_controld_t) ') ####################################### @@ -65,10 +83,11 @@ optional_policy(` # allow fenced_t self:capability { sys_rawio sys_resource }; -allow fenced_t self:process getsched; +allow fenced_t self:process { getsched signal_perms }; allow fenced_t self:tcp_socket create_stream_socket_perms; allow fenced_t self:udp_socket create_socket_perms; +allow fenced_t self:unix_stream_socket connectto; can_exec(fenced_t, fenced_exec_t) @@ -82,13 +101,19 @@ files_tmp_filetrans(fenced_t, fenced_tmp_t, { file fifo_file dir }) stream_connect_pattern(fenced_t, groupd_var_run_t, groupd_var_run_t, groupd_t) +kernel_read_system_state(fenced_t) + corecmd_exec_bin(fenced_t) +corecmd_exec_shell(fenced_t) +corenet_udp_bind_ionixnetmon_port(fenced_t) +corenet_tcp_bind_zented_port(fenced_t) corenet_tcp_connect_http_port(fenced_t) dev_read_sysfs(fenced_t) dev_read_urand(fenced_t) +files_read_usr_files(fenced_t) files_read_usr_symlinks(fenced_t) storage_raw_read_fixed_disk(fenced_t) @@ -97,16 +122,35 @@ storage_raw_read_removable_device(fenced_t) term_getattr_pty_fs(fenced_t) term_use_ptmx(fenced_t) - -auth_use_nsswitch(fenced_t) +term_use_generic_ptys(fenced_t) tunable_policy(`fenced_can_network_connect',` corenet_tcp_connect_all_ports(fenced_t) ') optional_policy(` + tunable_policy(`fenced_can_ssh',` + + allow fenced_t self:capability { setuid setgid }; + + corenet_tcp_connect_ssh_port(fenced_t) + + ssh_exec(fenced_t) + ssh_read_user_home_files(fenced_t) + ') +') + +# needed by fence_scsi +optional_policy(` + corosync_exec(fenced_t) +') + +optional_policy(` ccs_read_config(fenced_t) - ccs_stream_connect(fenced_t) +') + +optional_policy(` + gnome_read_generic_data_home_files(fenced_t) ') optional_policy(` @@ -114,13 +158,42 @@ optional_policy(` lvm_read_config(fenced_t) ') +optional_policy(` + snmp_manage_var_lib_files(fenced_t) + snmp_manage_var_lib_dirs(fenced_t) +') + + +####################################### +# +# foghorn local policy +# + +allow foghorn_t self:process { signal }; +allow foghorn_t self:tcp_socket create_stream_socket_perms; +allow foghorn_t self:udp_socket create_socket_perms; + +corenet_tcp_connect_agentx_port(foghorn_t) + +dev_read_urand(foghorn_t) + +files_read_usr_files(foghorn_t) + +optional_policy(` + dbus_connect_system_bus(foghorn_t) +') + +optional_policy(` + snmp_read_snmp_var_lib_files(foghorn_t) + snmp_stream_connect(foghorn_t) +') + ###################################### # # gfs_controld local policy # allow gfs_controld_t self:capability { net_admin sys_resource }; - allow gfs_controld_t self:shm create_shm_perms; allow gfs_controld_t self:netlink_kobject_uevent_socket create_socket_perms; @@ -139,10 +212,6 @@ storage_getattr_removable_dev(gfs_controld_t) init_rw_script_tmp_files(gfs_controld_t) optional_policy(` - ccs_stream_connect(gfs_controld_t) -') - -optional_policy(` lvm_exec(gfs_controld_t) dev_rw_lvm_control(gfs_controld_t) ') @@ -154,12 +223,12 @@ optional_policy(` allow groupd_t self:capability { sys_nice sys_resource }; allow groupd_t self:process setsched; - allow groupd_t self:shm create_shm_perms; +domtrans_pattern(groupd_t, fenced_exec_t, fenced_t) + dev_list_sysfs(groupd_t) -files_read_etc_files(groupd_t) init_rw_script_tmp_files(groupd_t) @@ -168,8 +237,7 @@ init_rw_script_tmp_files(groupd_t) # qdiskd local policy # -allow qdiskd_t self:capability ipc_lock; - +allow qdiskd_t self:capability { ipc_lock sys_boot }; allow qdiskd_t self:tcp_socket create_stream_socket_perms; allow qdiskd_t self:udp_socket create_socket_perms; @@ -182,7 +250,7 @@ kernel_read_system_state(qdiskd_t) kernel_read_software_raid_state(qdiskd_t) kernel_getattr_core_if(qdiskd_t) -corecmd_getattr_bin_files(qdiskd_t) +corecmd_exec_bin(qdiskd_t) corecmd_exec_shell(qdiskd_t) dev_read_sysfs(qdiskd_t) @@ -197,19 +265,14 @@ domain_dontaudit_getattr_all_sockets(qdiskd_t) files_dontaudit_getattr_all_sockets(qdiskd_t) files_dontaudit_getattr_all_pipes(qdiskd_t) -files_read_etc_files(qdiskd_t) + +fs_list_hugetlbfs(qdiskd_t) storage_raw_read_removable_device(qdiskd_t) storage_raw_write_removable_device(qdiskd_t) storage_raw_read_fixed_disk(qdiskd_t) storage_raw_write_fixed_disk(qdiskd_t) -auth_use_nsswitch(qdiskd_t) - -optional_policy(` - ccs_stream_connect(qdiskd_t) -') - optional_policy(` netutils_domtrans_ping(qdiskd_t) ') @@ -223,18 +286,24 @@ optional_policy(` # rhcs domains common policy # -allow cluster_domain self:capability { sys_nice }; +allow cluster_domain self:capability sys_nice; allow cluster_domain self:process setsched; - allow cluster_domain self:sem create_sem_perms; allow cluster_domain self:fifo_file rw_fifo_file_perms; allow cluster_domain self:unix_stream_socket create_stream_socket_perms; allow cluster_domain self:unix_dgram_socket create_socket_perms; -logging_send_syslog_msg(cluster_domain) +manage_files_pattern(cluster_domain, cluster_var_lib_t, cluster_var_lib_t) +manage_dirs_pattern(cluster_domain, cluster_var_lib_t, cluster_var_lib_t) -miscfiles_read_localization(cluster_domain) +optional_policy(` + ccs_stream_connect(cluster_domain) +') optional_policy(` corosync_stream_connect(cluster_domain) ') + +optional_policy(` + dbus_system_bus_client(cluster_domain) +') diff --git a/rhev.fc b/rhev.fc new file mode 100644 index 0000000..48beae9 --- /dev/null +++ b/rhev.fc @@ -0,0 +1,8 @@ +/usr/share/rhev-agent/rhev-agentd\.py -- gen_context(system_u:object_r:rhev_agentd_exec_t,s0) +/usr/share/ovirt-guest-agent -- gen_context(system_u:object_r:rhev_agentd_exec_t,s0) + +/usr/lib/systemd/system/ovirt-guest-agent.* -- gen_context(system_u:object_r:rhev_agentd_unit_file_t,s0) + +/var/run/rhev-agentd\.pid -- gen_context(system_u:object_r:rhev_agentd_var_run_t,s0) + +/var/log/rhev-agent(/.*)? gen_context(system_u:object_r:rhev_agentd_log_t,s0) diff --git a/rhev.if b/rhev.if new file mode 100644 index 0000000..bf11e25 --- /dev/null +++ b/rhev.if @@ -0,0 +1,76 @@ +## rhev polic module contains policies for rhev apps + +##################################### +## +## Execute rhev-agentd in the rhev_agentd domain. +## +## +## +## Domain allowed access. +## +## +# +interface(`rhev_domtrans_agentd',` + gen_require(` + type rhev_agentd_t, rhev_agentd_exec_t; + ') + + domtrans_pattern($1, rhev_agentd_exec_t, rhev_agentd_t) +') + +#################################### +## +## Read rhev-agentd PID files. +## +## +## +## Domain allowed access. +## +## +# +interface(`rhev_read_pid_files_agentd',` + gen_require(` + type rhev_agentd_var_run_t; + ') + + files_search_pids($1) + read_files_pattern($1, rhev_agentd_var_run_t, rhev_agentd_var_run_t) +') + +##################################### +## +## Connect to rhev_agentd over a unix domain +## stream socket. +## +## +## +## Domain allowed access. +## +## +# +interface(`rhev_stream_connect_agentd',` + gen_require(` + type rhev_agentd_var_run_t, rhev_agentd_t; + ') + + files_search_pids($1) + stream_connect_pattern($1, rhev_agentd_var_run_t, rhev_agentd_var_run_t, rhev_agentd_t) +') + +###################################### +## +## Send sigchld to rhev-agentd +## +## +## +## Domain allowed access +## +## +# +interface(`rhev_sigchld_agentd',` + gen_require(` + type rhev_agentd_t; + ') + + allow $1 rhev_agentd_t:process sigchld; +') diff --git a/rhev.te b/rhev.te new file mode 100644 index 0000000..e6c2344 --- /dev/null +++ b/rhev.te @@ -0,0 +1,110 @@ +policy_module(rhev,1.0) + +######################################## +# +# Declarations +# + +type rhev_agentd_t; +type rhev_agentd_exec_t; +init_daemon_domain(rhev_agentd_t, rhev_agentd_exec_t) + +type rhev_agentd_unit_file_t; +systemd_unit_file(rhev_agentd_unit_file_t) + +type rhev_agentd_var_run_t; +files_pid_file(rhev_agentd_var_run_t) + +type rhev_agentd_tmp_t; +files_tmp_file(rhev_agentd_tmp_t) + +type rhev_agentd_log_t; +logging_log_file(rhev_agentd_log_t) + +######################################## +# +# rhev_agentd_t local policy +# + +allow rhev_agentd_t self:capability sys_nice; +allow rhev_agentd_t self:process setsched; + +allow rhev_agentd_t self:fifo_file rw_fifo_file_perms; +allow rhev_agentd_t self:unix_stream_socket create_stream_socket_perms; + +manage_dirs_pattern(rhev_agentd_t, rhev_agentd_var_run_t, rhev_agentd_var_run_t) +manage_files_pattern(rhev_agentd_t, rhev_agentd_var_run_t, rhev_agentd_var_run_t) +manage_sock_files_pattern(rhev_agentd_t, rhev_agentd_var_run_t, rhev_agentd_var_run_t) +files_pid_filetrans(rhev_agentd_t, rhev_agentd_var_run_t, { dir file sock_file }) + +manage_files_pattern(rhev_agentd_t, rhev_agentd_log_t, rhev_agentd_log_t) + +manage_dirs_pattern(rhev_agentd_t, rhev_agentd_tmp_t, rhev_agentd_tmp_t) +manage_files_pattern(rhev_agentd_t, rhev_agentd_tmp_t, rhev_agentd_tmp_t) +files_tmp_filetrans(rhev_agentd_t, rhev_agentd_tmp_t, { file dir }) +can_exec(rhev_agentd_t, rhev_agentd_tmp_t) + +kernel_read_system_state(rhev_agentd_t) +kernel_read_kernel_sysctls(rhev_agentd_t) + +corecmd_exec_bin(rhev_agentd_t) +corecmd_exec_shell(rhev_agentd_t) + +dev_read_urand(rhev_agentd_t) + +term_use_virtio_console(rhev_agentd_t) + +fs_getattr_all_fs(rhev_agentd_t) + +files_getattr_all_mountpoints(rhev_agentd_t) +files_search_all_mountpoints(rhev_agentd_t) +files_read_usr_files(rhev_agentd_t) + +auth_use_nsswitch(rhev_agentd_t) + +init_read_utmp(rhev_agentd_t) + +libs_exec_ldconfig(rhev_agentd_t) +logging_send_syslog_msg(rhev_agentd_t) + +optional_policy(` + rpm_read_db(rhev_agentd_t) + rpm_dontaudit_manage_db(rhev_agentd_t) +') + +optional_policy(` + ssh_signull(rhev_agentd_t) +') + +optional_policy(` + dbus_system_bus_client(rhev_agentd_t) + dbus_connect_system_bus(rhev_agentd_t) +') + +optional_policy(` + xserver_dbus_chat_xdm(rhev_agentd_t) +') + +###################################### +# +# rhev_agentd_t consolehelper local policy +# + +optional_policy(` + userhelper_console_role_template(rhev_agentd, system_r, rhev_agentd_t) + + allow rhev_agentd_consolehelper_t rhev_agentd_log_t:file append; + + can_exec(rhev_agentd_consolehelper_t, rhev_agentd_exec_t) + kernel_read_system_state(rhev_agentd_consolehelper_t) + + term_use_virtio_console(rhev_agentd_consolehelper_t) + + optional_policy(` + dbus_session_bus_client(rhev_agentd_consolehelper_t) + ') + + optional_policy(` + unconfined_dbus_chat(rhev_agentd_consolehelper_t) + ') +') diff --git a/rhgb.if b/rhgb.if index 96efae7..793a29f 100644 --- a/rhgb.if +++ b/rhgb.if @@ -194,5 +194,6 @@ interface(`rhgb_rw_tmpfs_files',` type rhgb_tmpfs_t; ') + fs_search_tmpfs($1) allow $1 rhgb_tmpfs_t:file rw_file_perms; ') diff --git a/rhgb.te b/rhgb.te index 0f262a7..08c49bc 100644 --- a/rhgb.te +++ b/rhgb.te @@ -30,7 +30,7 @@ allow rhgb_t self:tcp_socket create_socket_perms; allow rhgb_t self:udp_socket create_socket_perms; allow rhgb_t self:netlink_route_socket r_netlink_socket_perms; -allow rhgb_t rhgb_devpts_t:chr_file { rw_chr_file_perms setattr }; +allow rhgb_t rhgb_devpts_t:chr_file { rw_chr_file_perms setattr_chr_file_perms }; term_create_pty(rhgb_t, rhgb_devpts_t) manage_dirs_pattern(rhgb_t, rhgb_tmpfs_t, rhgb_tmpfs_t) @@ -46,7 +46,6 @@ kernel_read_system_state(rhgb_t) corecmd_exec_bin(rhgb_t) corecmd_exec_shell(rhgb_t) -corenet_all_recvfrom_unlabeled(rhgb_t) corenet_all_recvfrom_netlabel(rhgb_t) corenet_tcp_sendrecv_generic_if(rhgb_t) corenet_udp_sendrecv_generic_if(rhgb_t) @@ -97,7 +96,6 @@ libs_read_lib_files(rhgb_t) logging_send_syslog_msg(rhgb_t) -miscfiles_read_localization(rhgb_t) miscfiles_read_fonts(rhgb_t) miscfiles_dontaudit_write_fonts(rhgb_t) diff --git a/rhsmcertd.if b/rhsmcertd.if index 137605a..7624759 100644 --- a/rhsmcertd.if +++ b/rhsmcertd.if @@ -194,13 +194,13 @@ interface(`rhsmcertd_read_pid_files',` #################################### ## -## Connect to rhsmcertd over a unix domain -## stream socket. +## Connect to rhsmcertd over a unix domain +## stream socket. ## ## -## -## Domain allowed access. -## +## +## Domain allowed access. +## ## # interface(`rhsmcertd_stream_connect',` @@ -235,23 +235,23 @@ interface(`rhsmcertd_dbus_chat',` ###################################### ## -## Dontaudit Send and receive messages from -## rhsmcertd over dbus. +## Dontaudit Send and receive messages from +## rhsmcertd over dbus. ## ## -## -## Domain allowed access. -## +## +## Domain allowed access. +## ## # interface(`rhsmcertd_dontaudit_dbus_chat',` - gen_require(` - type rhsmcertd_t; - class dbus send_msg; - ') + gen_require(` + type rhsmcertd_t; + class dbus send_msg; + ') - dontaudit $1 rhsmcertd_t:dbus send_msg; - dontaudit rhsmcertd_t $1:dbus send_msg; + dontaudit $1 rhsmcertd_t:dbus send_msg; + dontaudit rhsmcertd_t $1:dbus send_msg; ') ######################################## @@ -279,18 +279,7 @@ interface(`rhsmcertd_admin',` allow $1 rhsmcertd_t:process signal_perms; ps_process_pattern($1, rhsmcertd_t) - - rhsmcertd_initrc_domtrans($1) - domain_system_change_exemption($1) - role_transition $2 rhsmcertd_initrc_exec_t system_r; - allow $2 system_r; - - logging_search_logs($1) - admin_pattern($1, rhsmcertd_log_t) - - files_search_var_lib($1) - admin_pattern($1, rhsmcertd_var_lib_t) - - files_search_pids($1) - admin_pattern($1, rhsmcertd_var_run_t) + tunable_policy(`deny_ptrace',`',` + allow $1 rhsmcertd_t:process ptrace; + ') ') diff --git a/rhsmcertd.te b/rhsmcertd.te index 783f678..29ff761 100644 --- a/rhsmcertd.te +++ b/rhsmcertd.te @@ -29,6 +29,9 @@ files_pid_file(rhsmcertd_var_run_t) # rhsmcertd local policy # +allow rhsmcertd_t self:capability sys_nice; +allow rhsmcertd_t self:process { signal setsched }; + allow rhsmcertd_t self:fifo_file rw_fifo_file_perms; allow rhsmcertd_t self:unix_stream_socket create_stream_socket_perms; @@ -43,17 +46,32 @@ manage_files_pattern(rhsmcertd_t, rhsmcertd_var_lib_t, rhsmcertd_var_lib_t) manage_dirs_pattern(rhsmcertd_t, rhsmcertd_var_run_t, rhsmcertd_var_run_t) manage_files_pattern(rhsmcertd_t, rhsmcertd_var_run_t, rhsmcertd_var_run_t) +files_pid_filetrans(rhsmcertd_t, rhsmcertd_var_run_t, { file dir }) +kernel_read_network_state(rhsmcertd_t) kernel_read_system_state(rhsmcertd_t) +files_list_tmp(rhsmcertd_t) + corecmd_exec_bin(rhsmcertd_t) +dev_read_rand(rhsmcertd_t) dev_read_urand(rhsmcertd_t) files_read_etc_files(rhsmcertd_t) files_read_usr_files(rhsmcertd_t) +files_manage_generic_locks(rhsmcertd_t) + +auth_read_passwd(rhsmcertd_t) -miscfiles_read_localization(rhsmcertd_t) -miscfiles_read_generic_certs(rhsmcertd_t) +logging_send_syslog_msg(rhsmcertd_t) + +miscfiles_read_certs(rhsmcertd_t) sysnet_dns_name_resolve(rhsmcertd_t) + +rpm_read_db(rhsmcertd_t) + +optional_policy(` + gnome_dontaudit_search_config(rhsmcertd_t) +') diff --git a/ricci.fc b/ricci.fc index 5b08327..4d5819e 100644 --- a/ricci.fc +++ b/ricci.fc @@ -1,3 +1,6 @@ + +/etc/rc\.d/init\.d/ricci -- gen_context(system_u:object_r:ricci_initrc_exec_t,s0) + /usr/libexec/modcluster -- gen_context(system_u:object_r:ricci_modcluster_exec_t,s0) /usr/libexec/ricci-modlog -- gen_context(system_u:object_r:ricci_modlog_exec_t,s0) /usr/libexec/ricci-modrpm -- gen_context(system_u:object_r:ricci_modrpm_exec_t,s0) @@ -9,7 +12,7 @@ /var/lib/ricci(/.*)? gen_context(system_u:object_r:ricci_var_lib_t,s0) -/var/log/clumond\.log -- gen_context(system_u:object_r:ricci_modcluster_var_log_t,s0) +/var/log/clumond\.log.* -- gen_context(system_u:object_r:ricci_modcluster_var_log_t,s0) /var/run/clumond\.sock -s gen_context(system_u:object_r:ricci_modcluster_var_run_t,s0) /var/run/modclusterd\.pid -- gen_context(system_u:object_r:ricci_modcluster_var_run_t,s0) diff --git a/ricci.if b/ricci.if index f7826f9..23d579c 100644 --- a/ricci.if +++ b/ricci.if @@ -5,9 +5,9 @@ ## Execute a domain transition to run ricci. ## ## -## +## ## Domain allowed to transition. -## +## ## # interface(`ricci_domtrans',` @@ -18,14 +18,32 @@ interface(`ricci_domtrans',` domtrans_pattern($1, ricci_exec_t, ricci_t) ') +####################################### +## +## Execute ricci server in the ricci domain. +## +## +## +## Domain allowed access. +## +## +# +interface(`ricci_initrc_domtrans',` + gen_require(` + type ricci_initrc_exec_t; + ') + + init_labeled_script_domtrans($1, ricci_initrc_exec_t) +') + ######################################## ## ## Execute a domain transition to run ricci_modcluster. ## ## -## +## ## Domain allowed to transition. -## +## ## # interface(`ricci_domtrans_modcluster',` @@ -71,12 +89,12 @@ interface(`ricci_dontaudit_rw_modcluster_pipes',` type ricci_modcluster_t; ') - dontaudit $1 ricci_modcluster_t:fifo_file { read write }; + dontaudit $1 ricci_modcluster_t:fifo_file rw_inherited_fifo_file_perms; ') ######################################## ## -## Connect to ricci_modclusterd over an unix stream socket. +## Connect to ricci_modclusterd over a unix stream socket. ## ## ## @@ -90,18 +108,36 @@ interface(`ricci_stream_connect_modclusterd',` ') files_search_pids($1) - allow $1 ricci_modcluster_var_run_t:sock_file write; - allow $1 ricci_modclusterd_t:unix_stream_socket connectto; + stream_connect_pattern($1, ricci_modcluster_var_run_t, ricci_modcluster_var_run_t, ricci_modclusterd_t) ') ######################################## ## -## Execute a domain transition to run ricci_modlog. +## Read and write to ricci_modcluserd temporary file system. ## ## +## +## Domain allowed access. +## +## +# +interface(`ricci_rw_modclusterd_tmpfs_files',` + gen_require(` + type ricci_modclusterd_tmpfs_t; + ') + + fs_search_tmpfs($1) + allow $1 ricci_modclusterd_tmpfs_t:file rw_file_perms; +') + +######################################## ## -## Domain allowed to transition. +## Execute a domain transition to run ricci_modlog. ## +## +## +## Domain allowed to transition. +## ## # interface(`ricci_domtrans_modlog',` @@ -117,9 +153,9 @@ interface(`ricci_domtrans_modlog',` ## Execute a domain transition to run ricci_modrpm. ## ## -## +## ## Domain allowed to transition. -## +## ## # interface(`ricci_domtrans_modrpm',` @@ -135,9 +171,9 @@ interface(`ricci_domtrans_modrpm',` ## Execute a domain transition to run ricci_modservice. ## ## -## +## ## Domain allowed to transition. -## +## ## # interface(`ricci_domtrans_modservice',` @@ -153,9 +189,9 @@ interface(`ricci_domtrans_modservice',` ## Execute a domain transition to run ricci_modstorage. ## ## -## +## ## Domain allowed to transition. -## +## ## # interface(`ricci_domtrans_modstorage',` @@ -165,3 +201,70 @@ interface(`ricci_domtrans_modstorage',` domtrans_pattern($1, ricci_modstorage_exec_t, ricci_modstorage_t) ') + +#################################### +## +## Allow the specified domain to manage ricci's lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`ricci_manage_lib_files',` + gen_require(` + type ricci_var_lib_t; + ') + + files_search_var_lib($1) + manage_dirs_pattern($1, ricci_var_lib_t, ricci_var_lib_t) + manage_files_pattern($1, ricci_var_lib_t, ricci_var_lib_t) +') + +######################################## +## +## All of the rules required to administrate +## an ricci environment +## +## +## +## Domain allowed access. +## +## +## +## +## Role allowed access. +## +## +## +# +interface(`ricci_admin',` + gen_require(` + type ricci_t, ricci_initrc_exec_t, ricci_tmp_t; + type ricci_var_lib_t, ricci_var_log_t, ricci_var_run_t; + ') + + allow $1 ricci_t:process signal_perms; + ps_process_pattern($1, ricci_t) + tunable_policy(`deny_ptrace',`',` + allow $1 ricci_t:process ptrace; + ') + + ricci_initrc_domtrans($1) + domain_system_change_exemption($1) + role_transition $2 ricci_initrc_exec_t system_r; + allow $2 system_r; + + files_list_tmp($1) + admin_pattern($1, ricci_tmp_t) + + files_list_var_lib($1) + admin_pattern($1, ricci_var_lib_t) + + logging_list_logs($1) + admin_pattern($1, ricci_var_log_t) + + files_list_pids($1) + admin_pattern($1, ricci_var_run_t) +') diff --git a/ricci.te b/ricci.te index 33e72e8..6b0ec3e 100644 --- a/ricci.te +++ b/ricci.te @@ -7,9 +7,11 @@ policy_module(ricci, 1.7.0) type ricci_t; type ricci_exec_t; -domain_type(ricci_t) init_daemon_domain(ricci_t, ricci_exec_t) +type ricci_initrc_exec_t; +init_script_file(ricci_initrc_exec_t) + type ricci_tmp_t; files_tmp_file(ricci_tmp_t) @@ -39,9 +41,11 @@ files_pid_file(ricci_modcluster_var_run_t) type ricci_modclusterd_t; type ricci_modclusterd_exec_t; -domain_type(ricci_modclusterd_t) init_daemon_domain(ricci_modclusterd_t, ricci_modclusterd_exec_t) +type ricci_modclusterd_tmpfs_t; +files_tmpfs_file(ricci_modclusterd_tmpfs_t) + type ricci_modlog_t; type ricci_modlog_exec_t; domain_type(ricci_modlog_t) @@ -95,7 +99,7 @@ manage_files_pattern(ricci_t, ricci_var_lib_t, ricci_var_lib_t) manage_sock_files_pattern(ricci_t, ricci_var_lib_t, ricci_var_lib_t) files_var_lib_filetrans(ricci_t, ricci_var_lib_t, { file dir sock_file }) -allow ricci_t ricci_var_log_t:dir setattr; +allow ricci_t ricci_var_log_t:dir setattr_dir_perms; manage_files_pattern(ricci_t, ricci_var_log_t, ricci_var_log_t) manage_sock_files_pattern(ricci_t, ricci_var_log_t, ricci_var_log_t) logging_log_filetrans(ricci_t, ricci_var_log_t, { sock_file file dir }) @@ -105,10 +109,10 @@ manage_sock_files_pattern(ricci_t, ricci_var_run_t, ricci_var_run_t) files_pid_filetrans(ricci_t, ricci_var_run_t, { file sock_file }) kernel_read_kernel_sysctls(ricci_t) +kernel_read_system_state(ricci_t) corecmd_exec_bin(ricci_t) -corenet_all_recvfrom_unlabeled(ricci_t) corenet_all_recvfrom_netlabel(ricci_t) corenet_tcp_sendrecv_generic_if(ricci_t) corenet_tcp_sendrecv_generic_node(ricci_t) @@ -123,7 +127,6 @@ dev_read_urand(ricci_t) domain_read_all_domains_state(ricci_t) -files_read_etc_files(ricci_t) files_read_etc_runtime_files(ricci_t) files_create_boot_flag(ricci_t) @@ -136,8 +139,6 @@ locallogin_dontaudit_use_fds(ricci_t) logging_send_syslog_msg(ricci_t) -miscfiles_read_localization(ricci_t) - sysnet_dns_name_resolve(ricci_t) optional_policy(` @@ -170,6 +171,10 @@ optional_policy(` ') optional_policy(` + shutdown_domtrans(ricci_t) +') + +optional_policy(` unconfined_use_fds(ricci_t) ') @@ -193,29 +198,25 @@ corecmd_exec_shell(ricci_modcluster_t) corecmd_exec_bin(ricci_modcluster_t) corenet_tcp_bind_cluster_port(ricci_modclusterd_t) -corenet_tcp_bind_reserved_port(ricci_modclusterd_t) +corenet_tcp_bind_all_rpc_ports(ricci_modclusterd_t) +corenet_tcp_connect_cluster_port(ricci_modclusterd_t) domain_read_all_domains_state(ricci_modcluster_t) files_search_locks(ricci_modcluster_t) files_read_etc_runtime_files(ricci_modcluster_t) -files_read_etc_files(ricci_modcluster_t) files_search_usr(ricci_modcluster_t) +auth_use_nsswitch(ricci_modcluster_t) + init_exec(ricci_modcluster_t) init_domtrans_script(ricci_modcluster_t) logging_send_syslog_msg(ricci_modcluster_t) -miscfiles_read_localization(ricci_modcluster_t) - -modutils_domtrans_insmod(ricci_modcluster_t) - -mount_domtrans(ricci_modcluster_t) - -consoletype_exec(ricci_modcluster_t) - -ricci_stream_connect_modclusterd(ricci_modcluster_t) +optional_policy(` + ricci_stream_connect_modclusterd(ricci_modcluster_t) +') optional_policy(` aisexec_stream_connect(ricci_modcluster_t) @@ -233,7 +234,15 @@ optional_policy(` ') optional_policy(` - nscd_socket_use(ricci_modcluster_t) + modutils_domtrans_insmod(ricci_modcluster_t) +') + +optional_policy(` + mount_domtrans(ricci_modcluster_t) +') + +optional_policy(` + consoletype_exec(ricci_modcluster_t) ') optional_policy(` @@ -241,8 +250,7 @@ optional_policy(` ') optional_policy(` - # XXX This has got to go. - unconfined_domain(ricci_modcluster_t) + rgmanager_stream_connect(ricci_modclusterd_t) ') ######################################## @@ -261,6 +269,10 @@ allow ricci_modclusterd_t self:socket create_socket_perms; allow ricci_modclusterd_t ricci_modcluster_t:unix_stream_socket connectto; allow ricci_modclusterd_t ricci_modcluster_t:fifo_file rw_file_perms; +manage_dirs_pattern(ricci_modclusterd_t, ricci_modclusterd_tmpfs_t, ricci_modclusterd_tmpfs_t) +manage_files_pattern(ricci_modclusterd_t, ricci_modclusterd_tmpfs_t, ricci_modclusterd_tmpfs_t) +fs_tmpfs_filetrans(ricci_modclusterd_t, ricci_modclusterd_tmpfs_t, { dir file }) + allow ricci_modclusterd_t ricci_modcluster_var_log_t:dir setattr; manage_files_pattern(ricci_modclusterd_t, ricci_modcluster_var_log_t, ricci_modcluster_var_log_t) manage_sock_files_pattern(ricci_modclusterd_t, ricci_modcluster_var_log_t, ricci_modcluster_var_log_t) @@ -272,6 +284,7 @@ files_pid_filetrans(ricci_modclusterd_t, ricci_modcluster_var_run_t, { file sock kernel_read_kernel_sysctls(ricci_modclusterd_t) kernel_read_system_state(ricci_modclusterd_t) +kernel_request_load_module(ricci_modclusterd_t) corecmd_exec_bin(ricci_modclusterd_t) @@ -283,7 +296,6 @@ corenet_tcp_connect_ricci_modcluster_port(ricci_modclusterd_t) domain_read_all_domains_state(ricci_modclusterd_t) -files_read_etc_files(ricci_modclusterd_t) files_read_etc_runtime_files(ricci_modclusterd_t) fs_getattr_xattr_fs(ricci_modclusterd_t) @@ -296,8 +308,6 @@ locallogin_dontaudit_use_fds(ricci_modclusterd_t) logging_send_syslog_msg(ricci_modclusterd_t) -miscfiles_read_localization(ricci_modclusterd_t) - sysnet_domtrans_ifconfig(ricci_modclusterd_t) optional_policy(` @@ -334,12 +344,10 @@ corecmd_exec_bin(ricci_modlog_t) domain_read_all_domains_state(ricci_modlog_t) -files_read_etc_files(ricci_modlog_t) files_search_usr(ricci_modlog_t) logging_read_generic_logs(ricci_modlog_t) -miscfiles_read_localization(ricci_modlog_t) optional_policy(` nscd_dontaudit_search_pid(ricci_modlog_t) @@ -361,9 +369,8 @@ kernel_read_kernel_sysctls(ricci_modrpm_t) corecmd_exec_bin(ricci_modrpm_t) files_search_usr(ricci_modrpm_t) -files_read_etc_files(ricci_modrpm_t) -miscfiles_read_localization(ricci_modrpm_t) +logging_send_syslog_msg(ricci_modrpm_t) optional_policy(` oddjob_system_entry(ricci_modrpm_t, ricci_modrpm_exec_t) @@ -388,23 +395,24 @@ kernel_read_system_state(ricci_modservice_t) corecmd_exec_bin(ricci_modservice_t) corecmd_exec_shell(ricci_modservice_t) -files_read_etc_files(ricci_modservice_t) files_read_etc_runtime_files(ricci_modservice_t) files_search_usr(ricci_modservice_t) # Needed for running chkconfig files_manage_etc_symlinks(ricci_modservice_t) -consoletype_exec(ricci_modservice_t) - init_domtrans_script(ricci_modservice_t) -miscfiles_read_localization(ricci_modservice_t) +logging_send_syslog_msg(ricci_modservice_t) optional_policy(` ccs_read_config(ricci_modservice_t) ') optional_policy(` + consoletype_exec(ricci_modservice_t) +') + +optional_policy(` nscd_dontaudit_search_pid(ricci_modservice_t) ') @@ -418,7 +426,6 @@ optional_policy(` # allow ricci_modstorage_t self:process { setsched signal }; -dontaudit ricci_modstorage_t self:process ptrace; allow ricci_modstorage_t self:capability { mknod sys_nice }; allow ricci_modstorage_t self:fifo_file rw_fifo_file_perms; allow ricci_modstorage_t self:unix_dgram_socket create_socket_perms; @@ -444,22 +451,20 @@ files_read_etc_runtime_files(ricci_modstorage_t) files_read_usr_files(ricci_modstorage_t) files_read_kernel_modules(ricci_modstorage_t) +files_create_default_dir(ricci_modstorage_t) +files_root_filetrans_default(ricci_modstorage_t, dir) +files_mounton_default(ricci_modstorage_t) +files_manage_default_dirs(ricci_modstorage_t) +files_manage_default_files(ricci_modstorage_t) + storage_raw_read_fixed_disk(ricci_modstorage_t) term_dontaudit_use_console(ricci_modstorage_t) -fstools_domtrans(ricci_modstorage_t) +auth_use_nsswitch(ricci_modstorage_t) logging_send_syslog_msg(ricci_modstorage_t) -miscfiles_read_localization(ricci_modstorage_t) - -modutils_read_module_deps(ricci_modstorage_t) - -consoletype_exec(ricci_modstorage_t) - -mount_domtrans(ricci_modstorage_t) - optional_policy(` aisexec_stream_connect(ricci_modstorage_t) corosync_stream_connect(ricci_modstorage_t) @@ -471,12 +476,24 @@ optional_policy(` ') optional_policy(` + consoletype_exec(ricci_modstorage_t) +') + +optional_policy(` + fstools_domtrans(ricci_modstorage_t) +') + +optional_policy(` lvm_domtrans(ricci_modstorage_t) lvm_manage_config(ricci_modstorage_t) ') optional_policy(` - nscd_socket_use(ricci_modstorage_t) + modutils_read_module_deps(ricci_modstorage_t) +') + +optional_policy(` + mount_domtrans(ricci_modstorage_t) ') optional_policy(` diff --git a/rlogin.fc b/rlogin.fc index 2fae3f0..d7f6b82 100644 --- a/rlogin.fc +++ b/rlogin.fc @@ -1,7 +1,10 @@ HOME_DIR/\.rlogin -- gen_context(system_u:object_r:rlogind_home_t,s0) +HOME_DIR/\.rhosts -- gen_context(system_u:object_r:rlogind_home_t,s0) +/root/\.rlogin -- gen_context(system_u:object_r:rlogind_home_t,s0) +/root/\.rhosts -- gen_context(system_u:object_r:rlogind_home_t,s0) /usr/kerberos/sbin/klogind -- gen_context(system_u:object_r:rlogind_exec_t,s0) -/usr/lib/telnetlogin -- gen_context(system_u:object_r:rlogind_exec_t,s0) +/usr/lib/telnetlogin -- gen_context(system_u:object_r:rlogind_exec_t,s0) /usr/sbin/in\.rlogind -- gen_context(system_u:object_r:rlogind_exec_t,s0) diff --git a/rlogin.if b/rlogin.if index 63e78c6..fdd8228 100644 --- a/rlogin.if +++ b/rlogin.if @@ -21,21 +21,15 @@ interface(`rlogin_domtrans',` ######################################## ## -## read rlogin homedir content (.config) +## read rlogin homedir content (.rlogin) ## -## -## -## The prefix of the user domain (e.g., user -## is the prefix for user_t). -## -## -## +## ## -## The type of the user domain. +## Domain allowed access. ## ## # -template(`rlogin_read_home_content',` +interface(`rlogin_read_home_content',` gen_require(` type rlogind_home_t; ') diff --git a/rlogin.te b/rlogin.te index 16304ec..3293b25 100644 --- a/rlogin.te +++ b/rlogin.te @@ -27,15 +27,14 @@ files_pid_file(rlogind_var_run_t) # Local policy # -allow rlogind_t self:capability { fsetid chown fowner sys_tty_config dac_override }; +allow rlogind_t self:capability { fsetid chown fowner setuid setgid sys_tty_config dac_override }; allow rlogind_t self:process signal_perms; allow rlogind_t self:fifo_file rw_fifo_file_perms; allow rlogind_t self:tcp_socket connected_stream_socket_perms; # for identd; cjp: this should probably only be inetd_child rules? allow rlogind_t self:netlink_tcpdiag_socket r_netlink_socket_perms; -allow rlogind_t self:capability { setuid setgid }; -allow rlogind_t rlogind_devpts_t:chr_file { rw_chr_file_perms setattr }; +allow rlogind_t rlogind_devpts_t:chr_file { rw_chr_file_perms setattr_chr_file_perms }; term_create_pty(rlogind_t, rlogind_devpts_t) # for /usr/lib/telnetlogin @@ -43,7 +42,6 @@ can_exec(rlogind_t, rlogind_exec_t) manage_dirs_pattern(rlogind_t, rlogind_tmp_t, rlogind_tmp_t) manage_files_pattern(rlogind_t, rlogind_tmp_t, rlogind_tmp_t) -files_tmp_filetrans(rlogind_t, rlogind_tmp_t, { file dir }) manage_files_pattern(rlogind_t, rlogind_var_run_t, rlogind_var_run_t) files_pid_filetrans(rlogind_t, rlogind_var_run_t, file) @@ -52,7 +50,6 @@ kernel_read_kernel_sysctls(rlogind_t) kernel_read_system_state(rlogind_t) kernel_read_network_state(rlogind_t) -corenet_all_recvfrom_unlabeled(rlogind_t) corenet_all_recvfrom_netlabel(rlogind_t) corenet_tcp_sendrecv_generic_if(rlogind_t) corenet_udp_sendrecv_generic_if(rlogind_t) @@ -69,10 +66,11 @@ fs_getattr_xattr_fs(rlogind_t) fs_search_auto_mountpoints(rlogind_t) auth_domtrans_chk_passwd(rlogind_t) +auth_signal_chk_passwd(rlogind_t) auth_rw_login_records(rlogind_t) auth_use_nsswitch(rlogind_t) +auth_login_pgm_domain(rlogind_t) -files_read_etc_files(rlogind_t) files_read_etc_runtime_files(rlogind_t) files_search_home(rlogind_t) files_search_default(rlogind_t) @@ -81,34 +79,29 @@ init_rw_utmp(rlogind_t) logging_send_syslog_msg(rlogind_t) -miscfiles_read_localization(rlogind_t) - seutil_read_config(rlogind_t) userdom_setattr_user_ptys(rlogind_t) # cjp: this is egregious userdom_read_user_home_content_files(rlogind_t) - -remotelogin_domtrans(rlogind_t) -remotelogin_signal(rlogind_t) +userdom_search_admin_dir(rlogind_t) +userdom_manage_user_tmp_files(rlogind_t) +userdom_tmp_filetrans_user_tmp(rlogind_t, file) +userdom_use_user_terminals(rlogind_t) +userdom_home_reader(rlogind_t) rlogin_read_home_content(rlogind_t) -tunable_policy(`use_nfs_home_dirs',` - fs_list_nfs(rlogind_t) - fs_read_nfs_files(rlogind_t) - fs_read_nfs_symlinks(rlogind_t) -') - -tunable_policy(`use_samba_home_dirs',` - fs_list_cifs(rlogind_t) - fs_read_cifs_files(rlogind_t) - fs_read_cifs_symlinks(rlogind_t) +optional_policy(` + kerberos_keytab_template(rlogind, rlogind_t) + kerberos_tmp_filetrans_host_rcache(rlogind_t, "host_0") + #part of auth_use_pam + #kerberos_manage_host_rcache(rlogind_t) ') optional_policy(` - kerberos_keytab_template(rlogind, rlogind_t) - kerberos_manage_host_rcache(rlogind_t) + remotelogin_domtrans(rlogind_t) + remotelogin_signal(rlogind_t) ') optional_policy(` diff --git a/roundup.if b/roundup.if index 30c4b75..e07c2ff 100644 --- a/roundup.if +++ b/roundup.if @@ -23,8 +23,11 @@ interface(`roundup_admin',` type roundup_initrc_exec_t; ') - allow $1 roundup_t:process { ptrace signal_perms }; + allow $1 roundup_t:process signal_perms; ps_process_pattern($1, roundup_t) + tunable_policy(`deny_ptrace',`',` + allow $1 roundup_t:process ptrace; + ') init_labeled_script_domtrans($1, roundup_initrc_exec_t) domain_system_change_exemption($1) diff --git a/roundup.te b/roundup.te index 57f839f..090dd29 100644 --- a/roundup.te +++ b/roundup.te @@ -45,7 +45,6 @@ dev_read_sysfs(roundup_t) # execute python corecmd_exec_bin(roundup_t) -corenet_all_recvfrom_unlabeled(roundup_t) corenet_all_recvfrom_netlabel(roundup_t) corenet_tcp_sendrecv_generic_if(roundup_t) corenet_udp_sendrecv_generic_if(roundup_t) @@ -75,8 +74,6 @@ fs_search_auto_mountpoints(roundup_t) logging_send_syslog_msg(roundup_t) -miscfiles_read_localization(roundup_t) - sysnet_read_config(roundup_t) userdom_dontaudit_use_unpriv_user_fds(roundup_t) diff --git a/rpc.fc b/rpc.fc index 5c70c0c..b0c22f7 100644 --- a/rpc.fc +++ b/rpc.fc @@ -6,6 +6,9 @@ /etc/rc\.d/init\.d/nfslock -- gen_context(system_u:object_r:rpcd_initrc_exec_t,s0) /etc/rc\.d/init\.d/rpcidmapd -- gen_context(system_u:object_r:rpcd_initrc_exec_t,s0) +/usr/lib/systemd/system/nfs.* -- gen_context(system_u:object_r:nfsd_unit_file_t,s0) +/usr/lib/systemd/system/rpc.* -- gen_context(system_u:object_r:rpcd_unit_file_t,s0) + # # /sbin # @@ -15,12 +18,14 @@ # # /usr # +/usr/sbin/rpc\..* -- gen_context(system_u:object_r:rpcd_exec_t,s0) /usr/sbin/rpc\.idmapd -- gen_context(system_u:object_r:rpcd_exec_t,s0) /usr/sbin/rpc\.gssd -- gen_context(system_u:object_r:gssd_exec_t,s0) /usr/sbin/rpc\.mountd -- gen_context(system_u:object_r:nfsd_exec_t,s0) /usr/sbin/rpc\.nfsd -- gen_context(system_u:object_r:nfsd_exec_t,s0) /usr/sbin/rpc\.rquotad -- gen_context(system_u:object_r:rpcd_exec_t,s0) /usr/sbin/rpc\.svcgssd -- gen_context(system_u:object_r:gssd_exec_t,s0) +/usr/sbin/sm-notify -- gen_context(system_u:object_r:rpcd_exec_t,s0) # # /var @@ -29,3 +34,4 @@ /var/run/rpc\.statd(/.*)? gen_context(system_u:object_r:rpcd_var_run_t,s0) /var/run/rpc\.statd\.pid -- gen_context(system_u:object_r:rpcd_var_run_t,s0) + diff --git a/rpc.if b/rpc.if index dddabcf..a61764b 100644 --- a/rpc.if +++ b/rpc.if @@ -32,7 +32,11 @@ interface(`rpc_stub',` ## ## # -template(`rpc_domain_template', ` +template(`rpc_domain_template',` + gen_require(` + type var_lib_nfs_t; + ') + ######################################## # # Declarations @@ -69,7 +73,6 @@ template(`rpc_domain_template', ` dev_read_urand($1_t) dev_read_rand($1_t) - corenet_all_recvfrom_unlabeled($1_t) corenet_all_recvfrom_netlabel($1_t) corenet_tcp_sendrecv_generic_if($1_t) corenet_udp_sendrecv_generic_if($1_t) @@ -105,7 +108,6 @@ template(`rpc_domain_template', ` logging_send_syslog_msg($1_t) - miscfiles_read_localization($1_t) userdom_dontaudit_use_unpriv_user_fds($1_t) @@ -152,7 +154,7 @@ interface(`rpc_dontaudit_getattr_exports',` type exports_t; ') - dontaudit $1 exports_t:file getattr; + dontaudit $1 exports_t:file getattr_file_perms; ') ######################################## @@ -188,7 +190,7 @@ interface(`rpc_write_exports',` type exports_t; ') - allow $1 exports_t:file write; + allow $1 exports_t:file write_file_perms; ') ######################################## @@ -229,6 +231,29 @@ interface(`rpc_initrc_domtrans_nfsd',` ######################################## ## +## Execute nfsd server in the nfsd domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`rpc_systemctl_nfsd',` + gen_require(` + type nfsd_unit_file_t; + type nfsd_t; + ') + + systemd_exec_systemctl($1) + allow $1 nfsd_unit_file_t:file read_file_perms; + allow $1 nfsd_unit_file_t:service manage_service_perms; + + ps_process_pattern($1, nfsd_t) +') + +######################################## +## ## Execute domain in rpcd domain. ## ## @@ -246,6 +271,32 @@ interface(`rpc_domtrans_rpcd',` allow rpcd_t $1:process signal; ') +######################################## +## +## Execute rpcd in the rcpd domain, and +## allow the specified role the rpcd domain. +## +## +## +## Domain allowed to transition. +## +## +## +## +## Role allowed access. +## +## +## +# +interface(`rpc_run_rpcd',` + gen_require(` + type rpcd_t; + ') + + rpc_domtrans_rpcd($1) + role $2 types rpcd_t; +') + ####################################### ## ## Execute domain in rpcd domain. @@ -266,6 +317,29 @@ interface(`rpc_initrc_domtrans_rpcd',` ######################################## ## +## Execute rpcd server in the rpcd domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`rpc_systemctl_rpcd',` + gen_require(` + type rpcd_unit_file_t; + type rpcd_t; + ') + + systemd_exec_systemctl($1) + allow $1 rpcd_unit_file_t:file read_file_perms; + allow $1 rpcd_unit_file_t:service manage_service_perms; + + ps_process_pattern($1, rpcd_t) +') + +######################################## +## ## Read NFS exported content. ## ## @@ -282,7 +356,7 @@ interface(`rpc_read_nfs_content',` allow $1 { nfsd_ro_t nfsd_rw_t }:dir list_dir_perms; allow $1 { nfsd_ro_t nfsd_rw_t }:file read_file_perms; - allow $1 { nfsd_ro_t nfsd_rw_t }:lnk_file { getattr read }; + allow $1 { nfsd_ro_t nfsd_rw_t }:lnk_file read_lnk_file_perms; ') ######################################## @@ -329,7 +403,7 @@ interface(`rpc_manage_nfs_ro_content',` ######################################## ## -## Allow domain to read and write to an NFS TCP socket. +## Allow domain to read and write to an NFS UDP socket. ## ## ## @@ -337,17 +411,17 @@ interface(`rpc_manage_nfs_ro_content',` ## ## # -interface(`rpc_tcp_rw_nfs_sockets',` +interface(`rpc_udp_rw_nfs_sockets',` gen_require(` type nfsd_t; ') - allow $1 nfsd_t:tcp_socket rw_socket_perms; + allow $1 nfsd_t:udp_socket rw_socket_perms; ') ######################################## ## -## Allow domain to read and write to an NFS UDP socket. +## Send UDP traffic to NFSd. (Deprecated) ## ## ## @@ -355,17 +429,13 @@ interface(`rpc_tcp_rw_nfs_sockets',` ## ## # -interface(`rpc_udp_rw_nfs_sockets',` - gen_require(` - type nfsd_t; - ') - - allow $1 nfsd_t:udp_socket rw_socket_perms; +interface(`rpc_udp_send_nfs',` + refpolicywarn(`$0($*) has been deprecated.') ') ######################################## ## -## Send UDP traffic to NFSd. (Deprecated) +## Search NFS state data in /var/lib/nfs. ## ## ## @@ -373,13 +443,18 @@ interface(`rpc_udp_rw_nfs_sockets',` ## ## # -interface(`rpc_udp_send_nfs',` - refpolicywarn(`$0($*) has been deprecated.') +interface(`rpc_search_nfs_state_data',` + gen_require(` + type var_lib_nfs_t; + ') + + files_search_var_lib($1) + allow $1 var_lib_nfs_t:dir search_dir_perms; ') ######################################## ## -## Search NFS state data in /var/lib/nfs. +## List NFS state data in /var/lib/nfs. ## ## ## @@ -387,13 +462,13 @@ interface(`rpc_udp_send_nfs',` ## ## # -interface(`rpc_search_nfs_state_data',` +interface(`rpc_list_nfs_state_data',` gen_require(` type var_lib_nfs_t; ') files_search_var_lib($1) - allow $1 var_lib_nfs_t:dir search; + allow $1 var_lib_nfs_t:dir list_dir_perms; ') ######################################## @@ -432,4 +507,5 @@ interface(`rpc_manage_nfs_state_data',` files_search_var_lib($1) manage_files_pattern($1, var_lib_nfs_t, var_lib_nfs_t) + allow $1 var_lib_nfs_t:file relabel_file_perms; ') diff --git a/rpc.te b/rpc.te index 330d01f..d7875f4 100644 --- a/rpc.te +++ b/rpc.te @@ -10,7 +10,7 @@ policy_module(rpc, 1.14.0) ## Allow gssd to read temp directory. For access to kerberos tgt. ##

## -gen_tunable(allow_gssd_read_tmp, true) +gen_tunable(gssd_read_tmp, true) ## ##

@@ -19,7 +19,7 @@ gen_tunable(allow_gssd_read_tmp, true) ## labeled public_content_rw_t. ##

## -gen_tunable(allow_nfsd_anon_write, false) +gen_tunable(nfsd_anon_write, false) type exports_t; files_config_file(exports_t) @@ -39,11 +39,17 @@ rpc_domain_template(rpcd) type rpcd_initrc_exec_t; init_script_file(rpcd_initrc_exec_t) +type rpcd_unit_file_t; +systemd_unit_file(rpcd_unit_file_t) + rpc_domain_template(nfsd) type nfsd_initrc_exec_t; init_script_file(nfsd_initrc_exec_t) +type nfsd_unit_file_t; +systemd_unit_file(nfsd_unit_file_t) + type nfsd_rw_t; files_type(nfsd_rw_t) @@ -58,13 +64,16 @@ files_mountpoint(var_lib_nfs_t) # RPC local policy # -allow rpcd_t self:capability { sys_admin chown dac_override setgid setuid }; +allow rpcd_t self:capability { setpcap sys_admin chown dac_override setgid setuid }; +allow rpcd_t self:capability2 block_suspend; + allow rpcd_t self:process { getcap setcap }; allow rpcd_t self:fifo_file rw_fifo_file_perms; -allow rpcd_t rpcd_var_run_t:dir setattr; +allow rpcd_t rpcd_var_run_t:dir setattr_dir_perms; +manage_dirs_pattern(rpcd_t, rpcd_var_run_t, rpcd_var_run_t) manage_files_pattern(rpcd_t, rpcd_var_run_t, rpcd_var_run_t) -files_pid_filetrans(rpcd_t, rpcd_var_run_t, file) +files_pid_filetrans(rpcd_t, rpcd_var_run_t, { file dir }) # rpc.statd executes sm-notify can_exec(rpcd_t, rpcd_exec_t) @@ -81,12 +90,14 @@ corecmd_exec_bin(rpcd_t) files_manage_mounttab(rpcd_t) files_getattr_all_dirs(rpcd_t) +files_read_usr_files(rpcd_t) fs_list_rpc(rpcd_t) fs_read_rpc_files(rpcd_t) fs_read_rpc_symlinks(rpcd_t) fs_rw_rpc_sockets(rpcd_t) fs_get_all_fs_quotas(rpcd_t) +fs_set_xattr_fs_quotas(rpcd_t) fs_getattr_all_fs(rpcd_t) storage_getattr_fixed_disk_dev(rpcd_t) @@ -97,21 +108,41 @@ miscfiles_read_generic_certs(rpcd_t) seutil_dontaudit_search_config(rpcd_t) +userdom_signal_unpriv_users(rpcd_t) +userdom_read_user_home_content_files(rpcd_t) + optional_policy(` automount_signal(rpcd_t) automount_dontaudit_write_pipes(rpcd_t) ') optional_policy(` + domain_unconfined_signal(rpcd_t) +') + +optional_policy(` + quota_manage_db(rpcd_t) +') + +optional_policy(` nis_read_ypserv_config(rpcd_t) ') +optional_policy(` + quota_read_db(rpcd_t) +') + +optional_policy(` + rgmanager_manage_tmp_files(rpcd_t) +') + ######################################## # # NFSD local policy # allow nfsd_t self:capability { dac_override dac_read_search sys_admin sys_resource }; +dontaudit nfsd_t self:capability sys_rawio; allow nfsd_t exports_t:file read_file_perms; allow nfsd_t { nfsd_rw_t nfsd_ro_t }:dir list_dir_perms; @@ -120,9 +151,16 @@ allow nfsd_t { nfsd_rw_t nfsd_ro_t }:dir list_dir_perms; kernel_read_system_state(nfsd_t) kernel_read_network_state(nfsd_t) kernel_dontaudit_getattr_core_if(nfsd_t) +kernel_setsched(nfsd_t) +kernel_request_load_module(nfsd_t) +kernel_mounton_proc(nfsd_t) + +corecmd_exec_shell(nfsd_t) corenet_tcp_bind_all_rpc_ports(nfsd_t) corenet_udp_bind_all_rpc_ports(nfsd_t) +corenet_tcp_bind_nfs_port(nfsd_t) +corenet_udp_bind_nfs_port(nfsd_t) dev_dontaudit_getattr_all_blk_files(nfsd_t) dev_dontaudit_getattr_all_chr_files(nfsd_t) @@ -135,12 +173,12 @@ files_getattr_tmp_dirs(nfsd_t) # cjp: this should really have its own type files_manage_mounttab(nfsd_t) files_read_etc_runtime_files(nfsd_t) +files_read_usr_files(nfsd_t) fs_mount_nfsd_fs(nfsd_t) -fs_search_nfsd_fs(nfsd_t) fs_getattr_all_fs(nfsd_t) fs_getattr_all_dirs(nfsd_t) -fs_rw_nfsd_fs(nfsd_t) +fs_manage_nfsd_fs(nfsd_t) storage_dontaudit_read_fixed_disk(nfsd_t) storage_raw_read_removable_device(nfsd_t) @@ -148,8 +186,11 @@ storage_raw_read_removable_device(nfsd_t) # Read access to public_content_t and public_content_rw_t miscfiles_read_public_files(nfsd_t) +userdom_user_home_dir_filetrans_user_home_content(nfsd_t, { file dir }) +userdom_list_user_tmp(nfsd_t) + # Write access to public_content_t and public_content_rw_t -tunable_policy(`allow_nfsd_anon_write',` +tunable_policy(`nfsd_anon_write',` miscfiles_manage_public_files(nfsd_t) ') @@ -158,7 +199,6 @@ tunable_policy(`nfs_export_all_rw',` dev_getattr_all_chr_files(nfsd_t) fs_read_noxattr_fs_files(nfsd_t) - files_manage_non_auth_files(nfsd_t) ') tunable_policy(`nfs_export_all_ro',` @@ -170,8 +210,11 @@ tunable_policy(`nfs_export_all_ro',` fs_read_noxattr_fs_files(nfsd_t) - files_list_non_auth_dirs(nfsd_t) - files_read_non_auth_files(nfsd_t) + files_read_non_security_files(nfsd_t) +') + +optional_policy(` + mount_exec(nfsd_t) ') ######################################## @@ -181,7 +224,7 @@ tunable_policy(`nfs_export_all_ro',` allow gssd_t self:capability { dac_override dac_read_search setuid sys_nice }; allow gssd_t self:process { getsched setsched }; -allow gssd_t self:fifo_file rw_file_perms; +allow gssd_t self:fifo_file rw_fifo_file_perms; manage_dirs_pattern(gssd_t, gssd_tmp_t, gssd_tmp_t) manage_files_pattern(gssd_t, gssd_tmp_t, gssd_tmp_t) @@ -199,6 +242,7 @@ corecmd_exec_bin(gssd_t) fs_list_rpc(gssd_t) fs_rw_rpc_sockets(gssd_t) fs_read_rpc_files(gssd_t) +fs_read_nfsd_files(gssd_t) fs_list_inotifyfs(gssd_t) files_list_tmp(gssd_t) @@ -210,14 +254,14 @@ auth_manage_cache(gssd_t) miscfiles_read_generic_certs(gssd_t) -mount_signal(gssd_t) - userdom_signal_all_users(gssd_t) -tunable_policy(`allow_gssd_read_tmp',` +tunable_policy(`gssd_read_tmp',` userdom_list_user_tmp(gssd_t) userdom_read_user_tmp_files(gssd_t) userdom_read_user_tmp_symlinks(gssd_t) + userdom_write_user_tmp_files(gssd_t) + files_read_generic_tmp_files(gssd_t) ') optional_policy(` @@ -226,6 +270,11 @@ optional_policy(` optional_policy(` kerberos_keytab_template(gssd, gssd_t) + kerberos_tmp_filetrans_host_rcache(gssd_t, "nfs_0") +') + +optional_policy(` + mount_signal(gssd_t) ') optional_policy(` diff --git a/rpcbind.fc b/rpcbind.fc index f5c47d6..482b584 100644 --- a/rpcbind.fc +++ b/rpcbind.fc @@ -2,6 +2,9 @@ /sbin/rpcbind -- gen_context(system_u:object_r:rpcbind_exec_t,s0) +/usr/sbin/rpcbind -- gen_context(system_u:object_r:rpcbind_exec_t,s0) + +/var/cache/rpcbind(/.*)? gen_context(system_u:object_r:rpcbind_var_lib_t,s0) /var/lib/rpcbind(/.*)? gen_context(system_u:object_r:rpcbind_var_lib_t,s0) /var/run/rpc.statd\.pid -- gen_context(system_u:object_r:rpcbind_var_run_t,s0) diff --git a/rpcbind.if b/rpcbind.if index a96249c..5f38427 100644 --- a/rpcbind.if +++ b/rpcbind.if @@ -34,8 +34,7 @@ interface(`rpcbind_stream_connect',` ') files_search_pids($1) - allow $1 rpcbind_var_run_t:sock_file write; - allow $1 rpcbind_t:unix_stream_socket connectto; + stream_connect_pattern($1, rpcbind_var_run_t, rpcbind_var_run_t, rpcbind_t) ') ######################################## @@ -117,6 +116,24 @@ interface(`rpcbind_manage_lib_files',` ######################################## ## +## Send a null signal to rpcbind. +## +## +## +## Domain allowed access. +## +## +# +interface(`rpcbind_signull',` + gen_require(` + type rpcbind_t; + ') + + allow $1 rpcbind_t:process signull; +') + +######################################## +## ## All of the rules required to administrate ## an rpcbind environment ## @@ -138,11 +155,20 @@ interface(`rpcbind_admin',` type rpcbind_initrc_exec_t; ') - allow $1 rpcbind_t:process { ptrace signal_perms }; + allow $1 rpcbind_t:process signal_perms; ps_process_pattern($1, rpcbind_t) + tunable_policy(`deny_ptrace',`',` + allow $1 rpcbind_t:process ptrace; + ') - init_labeled_script_domtrans($1, rbcbind_initrc_exec_t) + init_labeled_script_domtrans($1, rpcbind_initrc_exec_t) domain_system_change_exemption($1) role_transition $2 rpcbind_initrc_exec_t system_r; allow $2 system_r; + + files_list_var_lib($1) + admin_pattern($1, rpcbind_var_lib_t) + + files_list_pids($1) + admin_pattern($1, rpcbind_var_run_t) ') diff --git a/rpcbind.te b/rpcbind.te index a63e9ee..8910c44 100644 --- a/rpcbind.te +++ b/rpcbind.te @@ -43,7 +43,8 @@ kernel_read_system_state(rpcbind_t) kernel_read_network_state(rpcbind_t) kernel_request_load_module(rpcbind_t) -corenet_all_recvfrom_unlabeled(rpcbind_t) +corecmd_exec_shell(rpcbind_t) + corenet_all_recvfrom_netlabel(rpcbind_t) corenet_tcp_sendrecv_generic_if(rpcbind_t) corenet_udp_sendrecv_generic_if(rpcbind_t) @@ -64,6 +65,12 @@ files_read_etc_runtime_files(rpcbind_t) logging_send_syslog_msg(rpcbind_t) -miscfiles_read_localization(rpcbind_t) - sysnet_dns_name_resolve(rpcbind_t) + +ifdef(`hide_broken_symptoms',` + dontaudit rpcbind_t self:udp_socket listen; +') + +optional_policy(` + nis_use_ypbind(rpcbind_t) +') diff --git a/rpm.fc b/rpm.fc index b2a0b6a..6167fe8 100644 --- a/rpm.fc +++ b/rpm.fc @@ -6,6 +6,7 @@ /usr/bin/smart -- gen_context(system_u:object_r:rpm_exec_t,s0) /usr/bin/yum -- gen_context(system_u:object_r:rpm_exec_t,s0) +/usr/bin/zif -- gen_context(system_u:object_r:rpm_exec_t,s0) /usr/libexec/packagekitd -- gen_context(system_u:object_r:rpm_exec_t,s0) /usr/libexec/yumDBUSBackend.py -- gen_context(system_u:object_r:rpm_exec_t,s0) @@ -20,12 +21,18 @@ /usr/share/yumex/yum_childtask\.py -- gen_context(system_u:object_r:rpm_exec_t,s0) ifdef(`distro_redhat', ` +/usr/sbin/bcfg2 -- gen_context(system_u:object_r:rpm_exec_t,s0) +/usr/bin/package-cleanup -- gen_context(system_u:object_r:rpm_exec_t,s0) /usr/bin/fedora-rmdevelrpms -- gen_context(system_u:object_r:rpm_exec_t,s0) /usr/bin/rpmdev-rmdevelrpms -- gen_context(system_u:object_r:rpm_exec_t,s0) /usr/sbin/pirut -- gen_context(system_u:object_r:rpm_exec_t,s0) /usr/sbin/pup -- gen_context(system_u:object_r:rpm_exec_t,s0) /usr/sbin/rhn_check -- gen_context(system_u:object_r:rpm_exec_t,s0) +/usr/sbin/rhnreg_ks -- gen_context(system_u:object_r:rpm_exec_t,s0) /usr/sbin/up2date -- gen_context(system_u:object_r:rpm_exec_t,s0) +/usr/sbin/synaptic -- gen_context(system_u:object_r:rpm_exec_t,s0) +/usr/bin/apt-get -- gen_context(system_u:object_r:rpm_exec_t,s0) +/usr/bin/apt-shell -- gen_context(system_u:object_r:rpm_exec_t,s0) ') /var/cache/PackageKit(/.*)? gen_context(system_u:object_r:rpm_var_cache_t,s0) @@ -36,9 +43,10 @@ ifdef(`distro_redhat', ` /var/lib/rpm(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0) /var/lib/yum(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0) -/var/log/rpmpkgs.* -- gen_context(system_u:object_r:rpm_log_t,s0) /var/log/yum\.log.* -- gen_context(system_u:object_r:rpm_log_t,s0) +/var/spool/up2date(/.*)? gen_context(system_u:object_r:rpm_var_cache_t,s0) + /var/run/yum.* -- gen_context(system_u:object_r:rpm_var_run_t,s0) /var/run/PackageKit(/.*)? gen_context(system_u:object_r:rpm_var_run_t,s0) diff --git a/rpm.if b/rpm.if index 951d8f6..8ba0f86 100644 --- a/rpm.if +++ b/rpm.if @@ -13,10 +13,13 @@ interface(`rpm_domtrans',` gen_require(` type rpm_t, rpm_exec_t; + attribute rpm_transition_domain; ') corecmd_search_bin($1) domtrans_pattern($1, rpm_exec_t, rpm_t) + typeattribute $1 rpm_transition_domain; + rpm_debuginfo_domtrans($1) ') ######################################## @@ -78,11 +81,19 @@ interface(`rpm_domtrans_script',` # interface(`rpm_run',` gen_require(` - attribute_role rpm_roles; + type rpm_t, rpm_script_t; ') rpm_domtrans($1) - roleattribute $2 rpm_roles; + role $2 types { rpm_t rpm_script_t }; + + domain_system_change_exemption($1) + role_transition $2 rpm_exec_t system_r; + allow $2 system_r; + + seutil_run_loadpolicy(rpm_script_t, $2) + seutil_run_semanage(rpm_script_t, $2) + seutil_run_setfiles(rpm_script_t, $2) ') ######################################## @@ -178,6 +189,41 @@ interface(`rpm_rw_pipes',` ######################################## ## +## dontaudit read and write an leaked file descriptors +## +## +## +## Domain to not audit. +## +## +# +interface(`rpm_dontaudit_leaks',` + gen_require(` + type rpm_t, rpm_var_cache_t; + type rpm_script_t, rpm_var_run_t, rpm_tmp_t; + type rpm_tmpfs_t, rpm_script_tmp_t, rpm_var_lib_t; + ') + + dontaudit $1 rpm_t:fifo_file rw_inherited_fifo_file_perms; + dontaudit $1 rpm_t:tcp_socket { read write }; + dontaudit $1 rpm_t:unix_dgram_socket { read write }; + dontaudit $1 rpm_t:shm rw_shm_perms; + + dontaudit $1 rpm_script_t:fd use; + dontaudit $1 rpm_script_t:fifo_file rw_inherited_fifo_file_perms; + + dontaudit $1 rpm_var_run_t:file rw_inherited_file_perms; + + dontaudit $1 rpm_tmp_t:file rw_inherited_file_perms; + dontaudit $1 rpm_tmpfs_t:dir rw_dir_perms; + dontaudit $1 rpm_tmpfs_t:file rw_inherited_file_perms; + dontaudit $1 rpm_script_tmp_t:file rw_inherited_file_perms; + dontaudit $1 rpm_var_lib_t:file rw_inherited_file_perms; + dontaudit $1 rpm_var_cache_t:file rw_inherited_file_perms; +') + +######################################## +## ## Send and receive messages from ## rpm over dbus. ## @@ -274,8 +320,7 @@ interface(`rpm_append_log',` type rpm_log_t; ') - logging_search_logs($1) - append_files_pattern($1, rpm_log_t, rpm_log_t) + allow $1 rpm_log_t:file append_inherited_file_perms; ') ######################################## @@ -332,7 +377,9 @@ interface(`rpm_manage_script_tmp_files',` ') files_search_tmp($1) + manage_dirs_pattern($1, rpm_script_tmp_t, rpm_script_tmp_t) manage_files_pattern($1, rpm_script_tmp_t, rpm_script_tmp_t) + manage_lnk_files_pattern($1, rpm_script_tmp_t, rpm_script_tmp_t) ') ##################################### @@ -351,8 +398,7 @@ interface(`rpm_append_tmp_files',` type rpm_tmp_t; ') - files_search_tmp($1) - append_files_pattern($1, rpm_tmp_t, rpm_tmp_t) + allow $1 rpm_tmp_t:file append_inherited_file_perms; ') ######################################## @@ -372,7 +418,9 @@ interface(`rpm_manage_tmp_files',` ') files_search_tmp($1) + manage_dirs_pattern($1, rpm_tmp_t, rpm_tmp_t) manage_files_pattern($1, rpm_tmp_t, rpm_tmp_t) + manage_lnk_files_pattern($1, rpm_tmp_t, rpm_tmp_t) ') ######################################## @@ -456,6 +504,7 @@ interface(`rpm_read_db',` allow $1 rpm_var_lib_t:dir list_dir_perms; read_files_pattern($1, rpm_var_lib_t, rpm_var_lib_t) read_lnk_files_pattern($1, rpm_var_lib_t, rpm_var_lib_t) + rpm_read_cache($1) ') ######################################## @@ -513,7 +562,7 @@ interface(`rpm_dontaudit_manage_db',` type rpm_var_lib_t; ') - dontaudit $1 rpm_var_lib_t:dir rw_dir_perms; + dontaudit $1 rpm_var_lib_t:dir manage_dir_perms; dontaudit $1 rpm_var_lib_t:file manage_file_perms; dontaudit $1 rpm_var_lib_t:lnk_file manage_lnk_file_perms; ') @@ -573,3 +622,66 @@ interface(`rpm_pid_filetrans',` files_pid_filetrans($1, rpm_var_run_t, file) ') + +######################################## +## +## Send a null signal to rpm. +## +## +## +## Domain allowed access. +## +## +# +interface(`rpm_inherited_fifo',` + gen_require(` + attribute rpm_transition_domain; + ') + + allow $1 rpm_transition_domain:fifo_file rw_inherited_fifo_file_perms; +') + + +######################################## +## +## Make rpm_exec_t an entry point for +## the specified domain. +## +## +## +## Domain allowed access. +## +## +# +interface(`rpm_entry_type',` + gen_require(` + type rpm_exec_t; + ') + + domain_entry_file($1, rpm_exec_t) +') + +######################################## +## +## Allow application to transition to rpm_script domain. +## +## +## +## Domain allowed access. +## +## +# +interface(`rpm_transition_script',` + gen_require(` + type rpm_script_t; + attribute rpm_transition_domain; + ') + + typeattribute $1 rpm_transition_domain; + allow $1 rpm_script_t:process transition; + + allow $1 rpm_script_t:fd use; + allow rpm_script_t $1:fd use; + allow rpm_script_t $1:fifo_file rw_fifo_file_perms; + allow rpm_script_t $1:process sigchld; +') diff --git a/rpm.te b/rpm.te index 60149a5..c2bc3aa 100644 --- a/rpm.te +++ b/rpm.te @@ -1,12 +1,11 @@ policy_module(rpm, 1.15.0) +attribute rpm_transition_domain; + ######################################## # # Declarations # - -attribute_role rpm_roles; - type debuginfo_exec_t; domain_entry_file(rpm_t, debuginfo_exec_t) @@ -17,7 +16,6 @@ domain_obj_id_change_exemption(rpm_t) domain_role_change_exemption(rpm_t) domain_system_change_exemption(rpm_t) domain_interactive_fd(rpm_t) -role rpm_roles types rpm_t; type rpm_file_t; files_type(rpm_file_t) @@ -50,7 +48,6 @@ corecmd_bin_entry_type(rpm_script_t) domain_type(rpm_script_t) domain_entry_file(rpm_t, rpm_script_exec_t) domain_interactive_fd(rpm_script_t) -role rpm_roles types rpm_script_t; role system_r types rpm_script_t; type rpm_script_tmp_t; @@ -80,6 +77,9 @@ allow rpm_t self:shm create_shm_perms; allow rpm_t self:sem create_sem_perms; allow rpm_t self:msgq create_msgq_perms; allow rpm_t self:msg { send receive }; +allow rpm_t self:dir search; +allow rpm_t self:file rw_file_perms;; +allow rpm_t self:netlink_kobject_uevent_socket create_socket_perms; allow rpm_t rpm_log_t:file manage_file_perms; logging_log_filetrans(rpm_t, rpm_log_t, file) @@ -105,17 +105,19 @@ files_var_filetrans(rpm_t, rpm_var_cache_t, dir) manage_files_pattern(rpm_t, rpm_var_lib_t, rpm_var_lib_t) files_var_lib_filetrans(rpm_t, rpm_var_lib_t, dir) +manage_dirs_pattern(rpm_t, rpm_var_run_t, rpm_var_run_t) manage_files_pattern(rpm_t, rpm_var_run_t, rpm_var_run_t) -files_pid_filetrans(rpm_t, rpm_var_run_t, file) +files_pid_filetrans(rpm_t, rpm_var_run_t, { file dir }) kernel_read_crypto_sysctls(rpm_t) kernel_read_network_state(rpm_t) kernel_read_system_state(rpm_t) kernel_read_kernel_sysctls(rpm_t) +kernel_read_network_state_symlinks(rpm_t) +kernel_rw_irq_sysctls(rpm_t) corecmd_exec_all_executables(rpm_t) -corenet_all_recvfrom_unlabeled(rpm_t) corenet_all_recvfrom_netlabel(rpm_t) corenet_tcp_sendrecv_generic_if(rpm_t) corenet_raw_sendrecv_generic_if(rpm_t) @@ -131,6 +133,19 @@ corenet_sendrecv_all_client_packets(rpm_t) dev_list_sysfs(rpm_t) dev_list_usbfs(rpm_t) dev_read_urand(rpm_t) +dev_read_raw_memory(rpm_t) +dev_manage_all_dev_nodes(rpm_t) + +#devices_manage_all_device_types(rpm_t) +dev_create_generic_blk_files(rpm_t) +dev_create_generic_chr_files(rpm_t) +dev_delete_all_blk_files(rpm_t) +dev_delete_all_chr_files(rpm_t) +dev_relabel_all_dev_nodes(rpm_t) +dev_rename_generic_blk_files(rpm_t) +dev_rename_generic_chr_files(rpm_t) +dev_setattr_all_blk_files(rpm_t) +dev_setattr_all_chr_files(rpm_t) fs_getattr_all_dirs(rpm_t) fs_list_inotifyfs(rpm_t) @@ -158,8 +173,8 @@ storage_raw_read_fixed_disk(rpm_t) term_list_ptys(rpm_t) -files_relabel_non_auth_files(rpm_t) -files_manage_non_auth_files(rpm_t) +files_relabel_all_files(rpm_t) +files_manage_all_files(rpm_t) auth_dontaudit_read_shadow(rpm_t) auth_use_nsswitch(rpm_t) @@ -168,7 +183,6 @@ rpm_domtrans_script(rpm_t) domain_read_all_domains_state(rpm_t) domain_getattr_all_domains(rpm_t) -domain_dontaudit_ptrace_all_domains(rpm_t) domain_use_interactive_fds(rpm_t) domain_dontaudit_getattr_all_pipes(rpm_t) domain_dontaudit_getattr_all_tcp_sockets(rpm_t) @@ -177,23 +191,26 @@ domain_dontaudit_getattr_all_packet_sockets(rpm_t) domain_dontaudit_getattr_all_raw_sockets(rpm_t) domain_dontaudit_getattr_all_stream_sockets(rpm_t) domain_dontaudit_getattr_all_dgram_sockets(rpm_t) +domain_signull_all_domains(rpm_t) files_exec_etc_files(rpm_t) init_domtrans_script(rpm_t) init_use_script_ptys(rpm_t) +init_signull_script(rpm_t) libs_exec_ld_so(rpm_t) libs_exec_lib_files(rpm_t) -libs_run_ldconfig(rpm_t, rpm_roles) logging_send_syslog_msg(rpm_t) +miscfiles_filetrans_named_content(rpm_t) + # allow compiling and loading new policy seutil_manage_src_policy(rpm_t) seutil_manage_bin_policy(rpm_t) -userdom_use_user_terminals(rpm_t) +userdom_use_inherited_user_terminals(rpm_t) userdom_use_unpriv_users_fds(rpm_t) optional_policy(` @@ -211,14 +228,15 @@ optional_policy(` optional_policy(` networkmanager_dbus_chat(rpm_t) ') + ') optional_policy(` - prelink_run(rpm_t, rpm_roles) + prelink_domtrans(rpm_t) ') optional_policy(` - unconfined_domain(rpm_t) + unconfined_domain_noaudit(rpm_t) # yum-updatesd requires this unconfined_dbus_chat(rpm_t) unconfined_dbus_chat(rpm_script_t) @@ -229,7 +247,8 @@ optional_policy(` # rpm-script Local policy # -allow rpm_script_t self:capability { chown dac_override dac_read_search fowner fsetid setgid setuid ipc_lock sys_admin sys_chroot sys_ptrace sys_rawio sys_nice mknod kill net_admin }; +allow rpm_script_t self:capability { chown dac_override dac_read_search fowner fsetid setgid setuid ipc_lock sys_admin sys_chroot sys_rawio sys_nice mknod kill net_admin }; + allow rpm_script_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execheap }; allow rpm_script_t self:fd use; allow rpm_script_t self:fifo_file rw_fifo_file_perms; @@ -261,12 +280,18 @@ manage_sock_files_pattern(rpm_script_t, rpm_script_tmpfs_t, rpm_script_tmpfs_t) fs_tmpfs_filetrans(rpm_script_t, rpm_script_tmpfs_t, { dir file lnk_file sock_file fifo_file }) can_exec(rpm_script_t, rpm_script_tmpfs_t) +allow rpm_script_t rpm_t:netlink_route_socket { read write }; + kernel_read_crypto_sysctls(rpm_script_t) kernel_read_kernel_sysctls(rpm_script_t) kernel_read_system_state(rpm_script_t) kernel_read_network_state(rpm_script_t) +kernel_list_all_proc(rpm_script_t) kernel_read_software_raid_state(rpm_script_t) +# needed by rhn_check +corenet_tcp_connect_http_port(rpm_script_t) + dev_list_sysfs(rpm_script_t) # ideally we would not need this @@ -286,7 +311,6 @@ fs_unmount_xattr_fs(rpm_script_t) fs_search_auto_mountpoints(rpm_script_t) mcs_killall(rpm_script_t) -mcs_ptrace_all(rpm_script_t) mls_file_read_all_levels(rpm_script_t) mls_file_write_all_levels(rpm_script_t) @@ -303,19 +327,20 @@ storage_raw_write_fixed_disk(rpm_script_t) term_getattr_unallocated_ttys(rpm_script_t) term_list_ptys(rpm_script_t) -term_use_all_terms(rpm_script_t) +term_use_all_inherited_terms(rpm_script_t) auth_dontaudit_getattr_shadow(rpm_script_t) auth_use_nsswitch(rpm_script_t) # ideally we would not need this -files_manage_non_auth_files(rpm_script_t) -auth_relabel_shadow(rpm_script_t) +files_manage_all_files(rpm_script_t) +files_relabel_all_files(rpm_script_t) corecmd_exec_all_executables(rpm_script_t) +can_exec(rpm_script_t, rpm_script_tmp_t) +can_exec(rpm_script_t, rpm_script_tmpfs_t) domain_read_all_domains_state(rpm_script_t) domain_getattr_all_domains(rpm_script_t) -domain_dontaudit_ptrace_all_domains(rpm_script_t) domain_use_interactive_fds(rpm_script_t) domain_signal_all_domains(rpm_script_t) domain_signull_all_domains(rpm_script_t) @@ -330,33 +355,36 @@ init_telinit(rpm_script_t) libs_exec_ld_so(rpm_script_t) libs_exec_lib_files(rpm_script_t) -libs_run_ldconfig(rpm_script_t, rpm_roles) logging_send_syslog_msg(rpm_script_t) -miscfiles_read_localization(rpm_script_t) +miscfiles_filetrans_named_content(rpm_script_t) -modutils_run_depmod(rpm_script_t, rpm_roles) -modutils_run_insmod(rpm_script_t, rpm_roles) - -seutil_run_loadpolicy(rpm_script_t, rpm_roles) -seutil_run_setfiles(rpm_script_t, rpm_roles) -seutil_run_semanage(rpm_script_t, rpm_roles) +seutil_domtrans_loadpolicy(rpm_script_t) +seutil_domtrans_setfiles(rpm_script_t) +seutil_domtrans_semanage(rpm_script_t) +seutil_domtrans_setsebool(rpm_script_t) userdom_use_all_users_fds(rpm_script_t) +userdom_exec_admin_home_files(rpm_script_t) ifdef(`distro_redhat',` optional_policy(` mta_send_mail(rpm_script_t) + mta_system_content(rpm_var_run_t) ') ') -tunable_policy(`allow_execmem',` +tunable_policy(`deny_execmem',`',` allow rpm_script_t self:process execmem; ') optional_policy(` - bootloader_run(rpm_script_t, rpm_roles) + bootloader_domtrans(rpm_script_t) +') + +optional_policy(` + cups_filetrans_named_content(rpm_script_t) ') optional_policy(` @@ -364,7 +392,7 @@ optional_policy(` ') optional_policy(` - lvm_run(rpm_script_t, rpm_roles) + lvm_domtrans(rpm_script_t) ') optional_policy(` @@ -372,8 +400,17 @@ optional_policy(` ') optional_policy(` - tzdata_run(rpm_t, rpm_roles) - tzdata_run(rpm_script_t, rpm_roles) + modutils_domtrans_depmod(rpm_script_t) + modutils_domtrans_insmod(rpm_script_t) +') + +optional_policy(` + openshift_initrc_domtrans(rpm_script_t) +') + +optional_policy(` + tzdata_domtrans(rpm_t) + tzdata_domtrans(rpm_script_t) ') optional_policy(` @@ -381,7 +418,7 @@ optional_policy(` ') optional_policy(` - unconfined_domain(rpm_script_t) + unconfined_domain_noaudit(rpm_script_t) unconfined_domtrans(rpm_script_t) optional_policy(` @@ -394,6 +431,6 @@ optional_policy(` ') optional_policy(` - usermanage_run_groupadd(rpm_script_t, rpm_roles) - usermanage_run_useradd(rpm_script_t, rpm_roles) + usermanage_domtrans_groupadd(rpm_script_t) + usermanage_domtrans_useradd(rpm_script_t) ') diff --git a/rshd.te b/rshd.te index 0b405d1..23c58c2 100644 --- a/rshd.te +++ b/rshd.te @@ -22,7 +22,6 @@ allow rshd_t self:tcp_socket create_stream_socket_perms; kernel_read_kernel_sysctls(rshd_t) -corenet_all_recvfrom_unlabeled(rshd_t) corenet_all_recvfrom_netlabel(rshd_t) corenet_tcp_sendrecv_generic_if(rshd_t) corenet_udp_sendrecv_generic_if(rshd_t) @@ -39,6 +38,8 @@ corenet_sendrecv_rsh_server_packets(rshd_t) dev_read_urand(rshd_t) +domain_interactive_fd(rshd_t) + selinux_get_fs_mount(rshd_t) selinux_validate_context(rshd_t) selinux_compute_access_vector(rshd_t) @@ -60,26 +61,16 @@ init_rw_utmp(rshd_t) logging_send_syslog_msg(rshd_t) logging_search_logs(rshd_t) -miscfiles_read_localization(rshd_t) - seutil_read_config(rshd_t) seutil_read_default_contexts(rshd_t) userdom_search_user_home_content(rshd_t) +userdom_manage_tmp_role(system_r, rshd_t) -tunable_policy(`use_nfs_home_dirs',` - fs_read_nfs_files(rshd_t) - fs_read_nfs_symlinks(rshd_t) -') - -tunable_policy(`use_samba_home_dirs',` - fs_read_cifs_files(rshd_t) - fs_read_cifs_symlinks(rshd_t) -') +userdom_home_reader(rshd_t) optional_policy(` kerberos_keytab_template(rshd, rshd_t) - kerberos_manage_host_rcache(rshd_t) ') optional_policy(` diff --git a/rssh.fc b/rssh.fc index 4c091ca..a58f123 100644 --- a/rssh.fc +++ b/rssh.fc @@ -1 +1,3 @@ /usr/bin/rssh -- gen_context(system_u:object_r:rssh_exec_t,s0) + +/usr/libexec/rssh_chroot_helper -- gen_context(system_u:object_r:rssh_chroot_helper_exec_t,s0) diff --git a/rssh.te b/rssh.te index ffb9605..4bb7119 100644 --- a/rssh.te +++ b/rssh.te @@ -63,7 +63,6 @@ manage_files_pattern(rssh_t, rssh_rw_t, rssh_rw_t) kernel_read_system_state(rssh_t) kernel_read_kernel_sysctls(rssh_t) -files_read_etc_files(rssh_t) files_read_etc_runtime_files(rssh_t) files_list_home(rssh_t) files_read_usr_files(rssh_t) @@ -73,8 +72,6 @@ fs_search_auto_mountpoints(rssh_t) logging_send_syslog_msg(rssh_t) -miscfiles_read_localization(rssh_t) - rssh_domtrans_chroot_helper(rssh_t) ssh_rw_tcp_sockets(rssh_t) @@ -95,10 +92,6 @@ allow rssh_chroot_helper_t self:unix_stream_socket create_stream_socket_perms; domain_use_interactive_fds(rssh_chroot_helper_t) -files_read_etc_files(rssh_chroot_helper_t) - auth_use_nsswitch(rssh_chroot_helper_t) logging_send_syslog_msg(rssh_chroot_helper_t) - -miscfiles_read_localization(rssh_chroot_helper_t) diff --git a/rsync.fc b/rsync.fc index 479615b..2d77839 100644 --- a/rsync.fc +++ b/rsync.fc @@ -2,6 +2,6 @@ /usr/bin/rsync -- gen_context(system_u:object_r:rsync_exec_t,s0) -/var/log/rsync\.log -- gen_context(system_u:object_r:rsync_log_t,s0) +/var/log/rsync\.log.* -- gen_context(system_u:object_r:rsync_log_t,s0) /var/run/rsyncd\.lock -- gen_context(system_u:object_r:rsync_var_run_t,s0) diff --git a/rsync.if b/rsync.if index 3386f29..8d8f6c5 100644 --- a/rsync.if +++ b/rsync.if @@ -119,7 +119,7 @@ interface(`rsync_read_config',` type rsync_etc_t; ') - allow $1 rsync_etc_t:file read_file_perms; + read_files_pattern($1, rsync_etc_t, rsync_etc_t) files_search_etc($1) ') @@ -128,9 +128,9 @@ interface(`rsync_read_config',` ## Write to rsync config files. ## ## -## +## ## Domain allowed access. -## +## ## # interface(`rsync_write_config',` @@ -138,6 +138,49 @@ interface(`rsync_write_config',` type rsync_etc_t; ') - allow $1 rsync_etc_t:file read_file_perms; + write_files_pattern($1, rsync_etc_t, rsync_etc_t) + files_search_etc($1) +') + +######################################## +## +## Manage rsync config files. +## +## +## +## Domain allowed access. +## +## +# +interface(`rsync_manage_config',` + gen_require(` + type rsync_etc_t; + ') + + manage_files_pattern($1, rsync_etc_t, rsync_etc_t) files_search_etc($1) ') + +######################################## +## +## Create objects in etc directories +## with rsync etc type. +## +## +## +## Domain allowed to transition. +## +## +## +## +## Class of the object being created. +## +## +# +interface(`rsync_filetrans_config',` + gen_require(` + type rsync_etc_t; + ') + + files_etc_filetrans($1, rsync_etc_t, $2) +') diff --git a/rsync.te b/rsync.te index 2834d86..6dc67fa 100644 --- a/rsync.te +++ b/rsync.te @@ -7,6 +7,27 @@ policy_module(rsync, 1.12.0) ## ##

+## Allow rsync servers to share cifs files systems +##

+## +gen_tunable(rsync_use_cifs, false) + +## +##

+## Allow rsync servers to share nfs files systems +##

+## +gen_tunable(rsync_use_nfs, false) + +## +##

+## Allow rsync to run as a client +##

+## +gen_tunable(rsync_client, false) + +## +##

## Allow rsync to export any files/directories read only. ##

## @@ -19,7 +40,7 @@ gen_tunable(rsync_export_all_ro, false) ## labeled public_content_rw_t. ##

## -gen_tunable(allow_rsync_anon_write, false) +gen_tunable(rsync_anon_write, false) type rsync_t; type rsync_exec_t; @@ -59,7 +80,7 @@ allow rsync_t self:udp_socket connected_socket_perms; allow rsync_t self:netlink_tcpdiag_socket r_netlink_socket_perms; #end for identd -allow rsync_t rsync_etc_t:file read_file_perms; +read_files_pattern(rsync_t, rsync_etc_t, rsync_etc_t) allow rsync_t rsync_data_t:dir list_dir_perms; read_files_pattern(rsync_t, rsync_data_t, rsync_data_t) @@ -79,7 +100,6 @@ kernel_read_kernel_sysctls(rsync_t) kernel_read_system_state(rsync_t) kernel_read_network_state(rsync_t) -corenet_all_recvfrom_unlabeled(rsync_t) corenet_all_recvfrom_netlabel(rsync_t) corenet_tcp_sendrecv_generic_if(rsync_t) corenet_udp_sendrecv_generic_if(rsync_t) @@ -95,17 +115,15 @@ dev_read_urand(rsync_t) fs_getattr_xattr_fs(rsync_t) -files_read_etc_files(rsync_t) files_search_home(rsync_t) auth_use_nsswitch(rsync_t) logging_send_syslog_msg(rsync_t) -miscfiles_read_localization(rsync_t) miscfiles_read_public_files(rsync_t) -tunable_policy(`allow_rsync_anon_write',` +tunable_policy(`rsync_anon_write',` miscfiles_manage_public_files(rsync_t) ') @@ -121,13 +139,39 @@ optional_policy(` inetd_service_domain(rsync_t, rsync_exec_t) ') +tunable_policy(`rsync_use_cifs',` + fs_list_cifs(rsync_t) + fs_read_cifs_files(rsync_t) + fs_read_cifs_symlinks(rsync_t) +') + +tunable_policy(`rsync_use_nfs',` + fs_list_nfs(rsync_t) + fs_read_nfs_files(rsync_t) + fs_read_nfs_symlinks(rsync_t) +') + tunable_policy(`rsync_export_all_ro',` - fs_read_noxattr_fs_files(rsync_t) + files_getattr_all_pipes(rsync_t) + fs_read_noxattr_fs_files(rsync_t) fs_read_nfs_files(rsync_t) fs_read_cifs_files(rsync_t) - files_list_non_auth_dirs(rsync_t) - files_read_non_auth_files(rsync_t) - files_read_non_auth_symlinks(rsync_t) + files_read_non_security_files(rsync_t) auth_tunable_read_shadow(rsync_t) ') + +tunable_policy(`rsync_client',` + corenet_tcp_connect_rsync_port(rsync_t) + corenet_tcp_connect_ssh_port(rsync_t) + manage_dirs_pattern(rsync_t, rsync_data_t, rsync_data_t) + manage_files_pattern(rsync_t, rsync_data_t, rsync_data_t) + manage_lnk_files_pattern(rsync_t, rsync_data_t, rsync_data_t) +') + +optional_policy(` + tunable_policy(`rsync_client',` + ssh_exec(rsync_t) + ') +') + auth_can_read_shadow_passwords(rsync_t) diff --git a/rtkit.if b/rtkit.if index 46dad1f..051addd 100644 --- a/rtkit.if +++ b/rtkit.if @@ -41,6 +41,28 @@ interface(`rtkit_daemon_dbus_chat',` ######################################## ## +## Do not audit send and receive messages from +## rtkit_daemon over dbus. +## +## +## +## Domain to not audit. +## +## +# +interface(`rtkit_daemon_dontaudit_dbus_chat',` + gen_require(` + type rtkit_daemon_t; + class dbus send_msg; + ') + + dontaudit $1 rtkit_daemon_t:dbus send_msg; + dontaudit rtkit_daemon_t $1:dbus send_msg; + dontaudit rtkit_daemon_t $1:process { getsched setsched }; +') + +######################################## +## ## Allow rtkit to control scheduling for your process ## ## @@ -54,6 +76,7 @@ interface(`rtkit_scheduled',` type rtkit_daemon_t; ') + kernel_search_proc($1) ps_process_pattern(rtkit_daemon_t, $1) allow rtkit_daemon_t $1:process { getsched setsched }; rtkit_daemon_dbus_chat($1) diff --git a/rtkit.te b/rtkit.te index 6f8e268..eaad2c5 100644 --- a/rtkit.te +++ b/rtkit.te @@ -7,7 +7,7 @@ policy_module(rtkit, 1.1.0) type rtkit_daemon_t; type rtkit_daemon_exec_t; -dbus_system_domain(rtkit_daemon_t, rtkit_daemon_exec_t) +init_system_domain(rtkit_daemon_t, rtkit_daemon_exec_t) ######################################## # @@ -28,8 +28,9 @@ auth_use_nsswitch(rtkit_daemon_t) logging_send_syslog_msg(rtkit_daemon_t) -miscfiles_read_localization(rtkit_daemon_t) - +optional_policy(` + dbus_system_domain(rtkit_daemon_t, rtkit_daemon_exec_t) +') optional_policy(` policykit_dbus_chat(rtkit_daemon_t) ') diff --git a/rwho.if b/rwho.if index 71ea0ea..886a45e 100644 --- a/rwho.if +++ b/rwho.if @@ -138,8 +138,11 @@ interface(`rwho_admin',` type rwho_initrc_exec_t; ') - allow $1 rwho_t:process { ptrace signal_perms }; + allow $1 rwho_t:process signal_perms; ps_process_pattern($1, rwho_t) + tunable_policy(`deny_ptrace',`',` + allow $1 rwho_t:process ptrace; + ') init_labeled_script_domtrans($1, rwho_initrc_exec_t) domain_system_change_exemption($1) diff --git a/rwho.te b/rwho.te index a07b2f4..22e0db0 100644 --- a/rwho.te +++ b/rwho.te @@ -16,7 +16,7 @@ type rwho_log_t; files_type(rwho_log_t) type rwho_spool_t; -files_type(rwho_spool_t) +files_spool_file(rwho_spool_t) ######################################## # @@ -24,6 +24,7 @@ files_type(rwho_spool_t) # allow rwho_t self:capability sys_chroot; +allow rwho_t self:process signal; allow rwho_t self:unix_dgram_socket create; allow rwho_t self:fifo_file rw_file_perms; allow rwho_t self:unix_stream_socket create_stream_socket_perms; @@ -39,7 +40,6 @@ files_spool_filetrans(rwho_t, rwho_spool_t, { file dir }) kernel_read_system_state(rwho_t) -corenet_all_recvfrom_unlabeled(rwho_t) corenet_all_recvfrom_netlabel(rwho_t) corenet_udp_sendrecv_generic_if(rwho_t) corenet_udp_sendrecv_generic_node(rwho_t) @@ -55,6 +55,8 @@ files_read_etc_files(rwho_t) init_read_utmp(rwho_t) init_dontaudit_write_utmp(rwho_t) -miscfiles_read_localization(rwho_t) +logging_send_syslog_msg(rwho_t) sysnet_dns_name_resolve(rwho_t) + +userdom_getattr_user_terminals(rwho_t) diff --git a/samba.fc b/samba.fc index 69a6074..c9dbc93 100644 --- a/samba.fc +++ b/samba.fc @@ -14,6 +14,9 @@ # # /usr # +/usr/lib/systemd/system/smb.* -- gen_context(system_u:object_r:samba_unit_file_t,s0) +/usr/lib/systemd/system/nmb.* -- gen_context(system_u:object_r:samba_unit_file_t,s0) + /usr/bin/net -- gen_context(system_u:object_r:samba_net_exec_t,s0) /usr/bin/ntlm_auth -- gen_context(system_u:object_r:winbind_helper_exec_t,s0) /usr/bin/smbcontrol -- gen_context(system_u:object_r:smbcontrol_exec_t,s0) @@ -36,6 +39,10 @@ /var/log/samba(/.*)? gen_context(system_u:object_r:samba_log_t,s0) +/var/run/nmbd(/.*)? gen_context(system_u:object_r:nmbd_var_run_t,s0) +/var/run/samba/nmbd(/.*)? gen_context(system_u:object_r:nmbd_var_run_t,s0) + +/var/run/samba(/.*)? gen_context(system_u:object_r:smbd_var_run_t,s0) /var/run/samba/brlock\.tdb -- gen_context(system_u:object_r:smbd_var_run_t,s0) /var/run/samba/connections\.tdb -- gen_context(system_u:object_r:smbd_var_run_t,s0) /var/run/samba/gencache\.tdb -- gen_context(system_u:object_r:smbd_var_run_t,s0) @@ -48,6 +55,11 @@ /var/run/samba/smbd\.pid -- gen_context(system_u:object_r:smbd_var_run_t,s0) /var/run/samba/unexpected\.tdb -- gen_context(system_u:object_r:nmbd_var_run_t,s0) +/var/run/samba/winbindd(/.*)? gen_context(system_u:object_r:winbind_var_run_t,s0) /var/run/winbindd(/.*)? gen_context(system_u:object_r:winbind_var_run_t,s0) /var/spool/samba(/.*)? gen_context(system_u:object_r:samba_var_t,s0) + +ifndef(`enable_mls',` +/var/lib/samba/scripts(/.*)? gen_context(system_u:object_r:samba_unconfined_script_exec_t,s0) +') diff --git a/samba.if b/samba.if index 82cb169..9bb5db2 100644 --- a/samba.if +++ b/samba.if @@ -42,6 +42,44 @@ interface(`samba_signal_nmbd',` ######################################## ## +## Search the samba pid directory. +## +## +## +## Domain to not audit. +## +## +# +interface(`samba_search_pid',` + gen_require(` + type smbd_var_run_t; + ') + + files_search_pids($1) + allow $1 smbd_var_run_t:dir search_dir_perms; +') + +######################################## +## +## Connect to nmbd. +## +## +## +## Domain allowed access. +## +## +# +interface(`samba_stream_connect_nmbd',` + gen_require(` + type nmbd_t, nmbd_var_run_t; + ') + + samba_search_pid($1) + stream_connect_pattern($1, nmbd_var_run_t, nmbd_var_run_t, nmbd_t) +') + +######################################## +## ## Execute samba server in the samba domain. ## ## @@ -60,6 +98,29 @@ interface(`samba_initrc_domtrans',` ######################################## ## +## Execute samba server in the samba domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`samba_systemctl',` + gen_require(` + type samba_unit_file_t; + type smbd_t; + ') + + systemd_exec_systemctl($1) + allow $1 samba_unit_file_t:file read_file_perms; + allow $1 samba_unit_file_t:service manage_service_perms; + + ps_process_pattern($1, smbd_t) +') + +######################################## +## ## Execute samba net in the samba_net domain. ## ## @@ -79,6 +140,25 @@ interface(`samba_domtrans_net',` ######################################## ## +## Execute samba net in the samba_unconfined_net domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`samba_domtrans_unconfined_net',` + gen_require(` + type samba_unconfined_net_t, samba_net_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, samba_net_exec_t, samba_unconfined_net_t) +') + +######################################## +## ## Execute samba net in the samba_net domain, and ## allow the specified role the samba_net domain. ## @@ -103,6 +183,51 @@ interface(`samba_run_net',` role $2 types samba_net_t; ') +####################################### +## +## The role for the samba module. +## +## +## +## The role to be allowed the samba_net domain. +## +## +## +# +interface(`samba_role_notrans',` + gen_require(` + type smbd_t; + ') + + role $1 types smbd_t; +') + +######################################## +## +## Execute samba net in the samba_unconfined_net domain, and +## allow the specified role the samba_unconfined_net domain. +## +## +## +## Domain allowed to transition. +## +## +## +## +## The role to be allowed the samba_unconfined_net domain. +## +## +## +# +interface(`samba_run_unconfined_net',` + gen_require(` + type samba_unconfined_net_t; + ') + + samba_domtrans_unconfined_net($1) + role $2 types samba_unconfined_net_t; +') + ######################################## ## ## Execute smbmount in the smbmount domain. @@ -166,6 +291,7 @@ interface(`samba_read_config',` ') files_search_etc($1) + list_dirs_pattern($1, samba_etc_t, samba_etc_t) read_files_pattern($1, samba_etc_t, samba_etc_t) ') @@ -409,9 +535,10 @@ interface(`samba_manage_var_files',` type samba_var_t; ') - files_search_var($1) + files_search_var_lib($1) files_search_var_lib($1) manage_files_pattern($1, samba_var_t, samba_var_t) + manage_lnk_files_pattern($1, samba_var_t, samba_var_t) ') ######################################## @@ -564,6 +691,7 @@ interface(`samba_domtrans_winbind_helper',` ') domtrans_pattern($1, winbind_helper_exec_t, winbind_helper_t) + allow $1 winbind_helper_t:process signal; ') ######################################## @@ -607,7 +735,7 @@ interface(`samba_read_winbind_pid',` type winbind_var_run_t; ') - files_search_pids($1) + samba_search_pid($1) allow $1 winbind_var_run_t:file read_file_perms; ') @@ -626,9 +754,10 @@ interface(`samba_stream_connect_winbind',` type samba_var_t, winbind_t, winbind_var_run_t; ') - files_search_pids($1) + samba_search_pid($1) allow $1 samba_var_t:dir search_dir_perms; stream_connect_pattern($1, winbind_var_run_t, winbind_var_run_t, winbind_t) + samba_read_config($1) ifndef(`distro_redhat',` gen_require(` @@ -644,6 +773,37 @@ interface(`samba_stream_connect_winbind',` ######################################## ## +## Create a set of derived types for apache +## web content. +## +## +## +## The prefix to be used for deriving type names. +## +## +# +template(`samba_helper_template',` + gen_require(` + type smbd_t; + role system_r; + ') + + #This type is for samba helper scripts + type samba_$1_script_t; + domain_type(samba_$1_script_t) + role system_r types samba_$1_script_t; + + # This type is used for executable scripts files + type samba_$1_script_exec_t; + corecmd_shell_entry_type(samba_$1_script_t) + domain_entry_file(samba_$1_script_t, samba_$1_script_exec_t) + + domtrans_pattern(smbd_t, samba_$1_script_exec_t, samba_$1_script_t) + allow smbd_t samba_$1_script_exec_t:file ioctl; +') + +######################################## +## ## All of the rules required to administrate ## an samba environment ## @@ -661,33 +821,33 @@ interface(`samba_stream_connect_winbind',` # interface(`samba_admin',` gen_require(` - type nmbd_t, nmbd_var_run_t; - type smbd_t, smbd_tmp_t; - type smbd_var_run_t; - type smbd_spool_t; - - type samba_log_t, samba_var_t; - type samba_etc_t, samba_share_t; - type samba_secrets_t; - - type swat_var_run_t, swat_tmp_t; - - type winbind_var_run_t, winbind_tmp_t; - type winbind_log_t; - - type samba_initrc_exec_t; + type nmbd_t, nmbd_var_run_t, smbd_var_run_t; + type smbd_t, smbd_tmp_t, samba_secrets_t; + type samba_initrc_exec_t, samba_log_t, samba_var_t; + type samba_etc_t, samba_share_t, winbind_log_t; + type swat_var_run_t, swat_tmp_t, samba_unconfined_script_exec_t; + type winbind_var_run_t, winbind_tmp_t, samba_unconfined_script_t; + type samba_unit_file_t; ') - allow $1 smbd_t:process { ptrace signal_perms }; + allow $1 smbd_t:process signal_perms; ps_process_pattern($1, smbd_t) + tunable_policy(`deny_ptrace',`',` + allow $1 smbd_t:process ptrace; + allow $1 nmbd_t:process ptrace; + allow $1 samba_unconfined_script_t:process ptrace; + ') - allow $1 nmbd_t:process { ptrace signal_perms }; + allow $1 nmbd_t:process signal_perms; ps_process_pattern($1, nmbd_t) - samba_run_smbcontrol($1, $2, $3) - samba_run_winbind_helper($1, $2, $3) - samba_run_smbmount($1, $2, $3) - samba_run_net($1, $2, $3) + allow $1 samba_unconfined_script_t:process signal_perms; + ps_process_pattern($1, samba_unconfined_script_t) + + samba_run_smbcontrol($1, $2) + samba_run_winbind_helper($1, $2) + samba_run_smbmount($1, $2) + samba_run_net($1, $2) init_labeled_script_domtrans($1, samba_initrc_exec_t) domain_system_change_exemption($1) @@ -709,9 +869,6 @@ interface(`samba_admin',` admin_pattern($1, samba_var_t) files_list_var($1) - admin_pattern($1, smbd_spool_t) - files_list_spool($1) - admin_pattern($1, smbd_var_run_t) files_list_pids($1) @@ -727,4 +884,9 @@ interface(`samba_admin',` admin_pattern($1, winbind_tmp_t) admin_pattern($1, winbind_var_run_t) + admin_pattern($1, samba_unconfined_script_exec_t) + + samba_systemctl($1) + admin_pattern($1, samba_unit_file_t) + allow $1 samba_unit_file_t:service all_service_perms; ') diff --git a/samba.te b/samba.te index 905883f..e042b3c 100644 --- a/samba.te +++ b/samba.te @@ -12,7 +12,7 @@ policy_module(samba, 1.15.0) ## public_content_rw_t. ##

## -gen_tunable(allow_smbd_anon_write, false) +gen_tunable(smbd_anon_write, false) ## ##

@@ -32,6 +32,14 @@ gen_tunable(samba_domain_controller, false) ## ##

+## Allow samba to act as a portmapper +## +##

+## +gen_tunable(samba_portmapper, false) + +## +##

## Allow samba to share users home directories. ##

## @@ -85,6 +93,9 @@ files_config_file(samba_etc_t) type samba_initrc_exec_t; init_script_file(samba_initrc_exec_t) +type samba_unit_file_t; +systemd_unit_file(samba_unit_file_t) + type samba_log_t; logging_log_file(samba_log_t) @@ -152,9 +163,6 @@ domain_entry_file(winbind_helper_t, winbind_helper_exec_t) type winbind_log_t; logging_log_file(winbind_log_t) -type winbind_tmp_t; -files_tmp_file(winbind_tmp_t) - type winbind_var_run_t; files_pid_file(winbind_var_run_t) @@ -184,8 +192,8 @@ manage_lnk_files_pattern(samba_net_t, samba_var_t, samba_var_t) kernel_read_proc_symlinks(samba_net_t) kernel_read_system_state(samba_net_t) +kernel_read_network_state(samba_net_t) -corenet_all_recvfrom_unlabeled(samba_net_t) corenet_all_recvfrom_netlabel(samba_net_t) corenet_tcp_sendrecv_generic_if(samba_net_t) corenet_udp_sendrecv_generic_if(samba_net_t) @@ -203,7 +211,6 @@ dev_read_urand(samba_net_t) domain_use_interactive_fds(samba_net_t) -files_read_etc_files(samba_net_t) files_read_usr_symlinks(samba_net_t) auth_use_nsswitch(samba_net_t) @@ -211,15 +218,16 @@ auth_manage_cache(samba_net_t) logging_send_syslog_msg(samba_net_t) -miscfiles_read_localization(samba_net_t) - samba_read_var_files(samba_net_t) -userdom_use_user_terminals(samba_net_t) +sysnet_use_ldap(samba_net_t) + +userdom_use_inherited_user_terminals(samba_net_t) userdom_list_user_home_dirs(samba_net_t) optional_policy(` - ldap_stream_connect(samba_net_t) + ldap_stream_connect(samba_net_t) + dirsrv_stream_connect(samba_net_t) ') optional_policy(` @@ -228,13 +236,15 @@ optional_policy(` optional_policy(` kerberos_use(samba_net_t) + kerberos_etc_filetrans_keytab(samba_net_t) ') ######################################## # # smbd Local policy # -allow smbd_t self:capability { chown fowner setgid setuid sys_nice sys_resource lease dac_override dac_read_search }; + +allow smbd_t self:capability { chown fowner kill fsetid setgid setuid sys_chroot sys_nice sys_admin sys_resource lease dac_override dac_read_search }; dontaudit smbd_t self:capability sys_tty_config; allow smbd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; allow smbd_t self:process setrlimit; @@ -253,6 +263,7 @@ allow smbd_t self:unix_stream_socket { create_stream_socket_perms connectto }; allow smbd_t nmbd_t:process { signal signull }; allow smbd_t nmbd_var_run_t:file rw_file_perms; +stream_connect_pattern(smbd_t, nmbd_var_run_t, nmbd_var_run_t, nmbd_t) allow smbd_t samba_etc_t:file { rw_file_perms setattr }; @@ -267,12 +278,13 @@ filetrans_pattern(smbd_t, samba_etc_t, samba_secrets_t, file) manage_dirs_pattern(smbd_t, samba_share_t, samba_share_t) manage_files_pattern(smbd_t, samba_share_t, samba_share_t) manage_lnk_files_pattern(smbd_t, samba_share_t, samba_share_t) -allow smbd_t samba_share_t:filesystem getattr; +allow smbd_t samba_share_t:filesystem { getattr quotaget }; manage_dirs_pattern(smbd_t, samba_var_t, samba_var_t) manage_files_pattern(smbd_t, samba_var_t, samba_var_t) manage_lnk_files_pattern(smbd_t, samba_var_t, samba_var_t) manage_sock_files_pattern(smbd_t, samba_var_t, samba_var_t) +files_var_filetrans(smbd_t, samba_var_t, dir) allow smbd_t smbcontrol_t:process { signal signull }; @@ -283,7 +295,7 @@ files_tmp_filetrans(smbd_t, smbd_tmp_t, { file dir }) manage_dirs_pattern(smbd_t, smbd_var_run_t, smbd_var_run_t) manage_files_pattern(smbd_t, smbd_var_run_t, smbd_var_run_t) manage_sock_files_pattern(smbd_t, smbd_var_run_t, smbd_var_run_t) -files_pid_filetrans(smbd_t, smbd_var_run_t, file) +files_pid_filetrans(smbd_t, smbd_var_run_t, { dir file }) allow smbd_t swat_t:process signal; @@ -302,7 +314,6 @@ kernel_read_system_state(smbd_t) corecmd_exec_shell(smbd_t) corecmd_exec_bin(smbd_t) -corenet_all_recvfrom_unlabeled(smbd_t) corenet_all_recvfrom_netlabel(smbd_t) corenet_tcp_sendrecv_generic_if(smbd_t) corenet_udp_sendrecv_generic_if(smbd_t) @@ -320,6 +331,7 @@ corenet_tcp_connect_smbd_port(smbd_t) dev_read_sysfs(smbd_t) dev_read_urand(smbd_t) +dev_dontaudit_write_urand(smbd_t) dev_getattr_mtrr_dev(smbd_t) dev_dontaudit_getattr_usbfs_dirs(smbd_t) # For redhat bug 566984 @@ -327,26 +339,29 @@ dev_getattr_all_blk_files(smbd_t) dev_getattr_all_chr_files(smbd_t) fs_getattr_all_fs(smbd_t) +fs_getattr_all_dirs(smbd_t) fs_get_xattr_fs_quotas(smbd_t) fs_search_auto_mountpoints(smbd_t) fs_getattr_rpc_dirs(smbd_t) fs_list_inotifyfs(smbd_t) +fs_get_all_fs_quotas(smbd_t) auth_use_nsswitch(smbd_t) auth_domtrans_chk_passwd(smbd_t) auth_domtrans_upd_passwd(smbd_t) auth_manage_cache(smbd_t) +auth_write_login_records(smbd_t) domain_use_interactive_fds(smbd_t) domain_dontaudit_list_all_domains_state(smbd_t) files_list_var_lib(smbd_t) -files_read_etc_files(smbd_t) files_read_etc_runtime_files(smbd_t) files_read_usr_files(smbd_t) files_search_spool(smbd_t) # smbd seems to getattr all mountpoints files_dontaudit_getattr_all_dirs(smbd_t) +files_dontaudit_list_all_mountpoints(smbd_t) # Allow samba to list mnt_t for potential mounted dirs files_list_mnt(smbd_t) @@ -355,9 +370,10 @@ init_rw_utmp(smbd_t) logging_search_logs(smbd_t) logging_send_syslog_msg(smbd_t) -miscfiles_read_localization(smbd_t) miscfiles_read_public_files(smbd_t) +sysnet_use_ldap(smbd_t) + userdom_use_unpriv_users_fds(smbd_t) userdom_search_user_home_content(smbd_t) userdom_signal_all_users(smbd_t) @@ -372,8 +388,13 @@ ifdef(`hide_broken_symptoms', ` fs_dontaudit_getattr_tmpfs_dirs(smbd_t) ') -tunable_policy(`allow_smbd_anon_write',` +tunable_policy(`smbd_anon_write',` miscfiles_manage_public_files(smbd_t) +') + +tunable_policy(`samba_portmapper',` + corenet_tcp_bind_epmap_port(smbd_t) + corenet_tcp_bind_all_unreserved_ports(smbd_t) ') tunable_policy(`samba_domain_controller',` @@ -389,12 +410,7 @@ tunable_policy(`samba_domain_controller',` ') tunable_policy(`samba_enable_home_dirs',` - userdom_manage_user_home_content_dirs(smbd_t) - userdom_manage_user_home_content_files(smbd_t) - userdom_manage_user_home_content_symlinks(smbd_t) - userdom_manage_user_home_content_sockets(smbd_t) - userdom_manage_user_home_content_pipes(smbd_t) - userdom_user_home_dir_filetrans_user_home_content(smbd_t, { dir file lnk_file sock_file fifo_file }) + userdom_manage_user_home_content(smbd_t) ') # Support Samba sharing of NFS mount points @@ -415,6 +431,15 @@ tunable_policy(`samba_share_fusefs',` ') optional_policy(` + ccs_read_config(smbd_t) +') + +optional_policy(` + ctdbd_stream_connect(smbd_t) + ctdbd_manage_lib_files(smbd_t) +') + +optional_policy(` cups_read_rw_config(smbd_t) cups_stream_connect(smbd_t) ') @@ -426,6 +451,7 @@ optional_policy(` optional_policy(` ldap_stream_connect(smbd_t) + dirsrv_stream_connect(smbd_t) ') optional_policy(` @@ -452,26 +478,26 @@ optional_policy(` tunable_policy(`samba_create_home_dirs',` allow smbd_t self:capability chown; userdom_create_user_home_dirs(smbd_t) - userdom_home_filetrans_user_home_dir(smbd_t) ') +userdom_home_filetrans_user_home_dir(smbd_t) + tunable_policy(`samba_export_all_ro',` - fs_read_noxattr_fs_files(smbd_t) - files_list_non_auth_dirs(smbd_t) - files_read_non_auth_files(smbd_t) - fs_read_noxattr_fs_files(nmbd_t) - files_list_non_auth_dirs(nmbd_t) - files_read_non_auth_files(nmbd_t) + fs_read_noxattr_fs_files(smbd_t) + files_read_non_security_files(smbd_t) + fs_read_noxattr_fs_files(nmbd_t) + files_read_non_security_files(nmbd_t) ') tunable_policy(`samba_export_all_rw',` - fs_read_noxattr_fs_files(smbd_t) - files_manage_non_auth_files(smbd_t) - fs_read_noxattr_fs_files(nmbd_t) - files_manage_non_auth_files(nmbd_t) - userdom_user_home_dir_filetrans_user_home_content(nmbd_t, { file dir }) + fs_read_noxattr_fs_files(smbd_t) + files_manage_non_security_files(smbd_t) + fs_read_noxattr_fs_files(nmbd_t) + files_manage_non_security_files(nmbd_t) ') +userdom_user_home_dir_filetrans_user_home_content(nmbd_t, { file dir }) + ######################################## # # nmbd Local policy @@ -491,8 +517,11 @@ allow nmbd_t self:udp_socket create_socket_perms; allow nmbd_t self:unix_dgram_socket { create_socket_perms sendto }; allow nmbd_t self:unix_stream_socket { create_stream_socket_perms connectto }; +manage_dirs_pattern(nmbd_t, { smbd_var_run_t nmbd_var_run_t }, nmbd_var_run_t) manage_files_pattern(nmbd_t, nmbd_var_run_t, nmbd_var_run_t) -files_pid_filetrans(nmbd_t, nmbd_var_run_t, file) +manage_sock_files_pattern(nmbd_t, nmbd_var_run_t, nmbd_var_run_t) +files_pid_filetrans(nmbd_t, nmbd_var_run_t, { dir file sock_file }) +filetrans_pattern(nmbd_t, smbd_var_run_t, nmbd_var_run_t, dir) read_files_pattern(nmbd_t, samba_etc_t, samba_etc_t) read_lnk_files_pattern(nmbd_t, samba_etc_t, samba_etc_t) @@ -501,11 +530,13 @@ manage_dirs_pattern(nmbd_t, samba_log_t, samba_log_t) manage_files_pattern(nmbd_t, samba_log_t, samba_log_t) manage_files_pattern(nmbd_t, samba_var_t, samba_var_t) +manage_files_pattern(nmbd_t, samba_var_t, samba_var_t) +manage_lnk_files_pattern(nmbd_t, samba_var_t, samba_var_t) +manage_sock_files_pattern(nmbd_t, samba_var_t, samba_var_t) +files_var_filetrans(nmbd_t, samba_var_t, dir) allow nmbd_t smbcontrol_t:process signal; -allow nmbd_t smbd_var_run_t:dir rw_dir_perms; - kernel_getattr_core_if(nmbd_t) kernel_getattr_message_if(nmbd_t) kernel_read_kernel_sysctls(nmbd_t) @@ -513,7 +544,6 @@ kernel_read_network_state(nmbd_t) kernel_read_software_raid_state(nmbd_t) kernel_read_system_state(nmbd_t) -corenet_all_recvfrom_unlabeled(nmbd_t) corenet_all_recvfrom_netlabel(nmbd_t) corenet_tcp_sendrecv_generic_if(nmbd_t) corenet_udp_sendrecv_generic_if(nmbd_t) @@ -536,7 +566,6 @@ fs_search_auto_mountpoints(nmbd_t) domain_use_interactive_fds(nmbd_t) files_read_usr_files(nmbd_t) -files_read_etc_files(nmbd_t) files_list_var_lib(nmbd_t) auth_use_nsswitch(nmbd_t) @@ -544,8 +573,6 @@ auth_use_nsswitch(nmbd_t) logging_search_logs(nmbd_t) logging_send_syslog_msg(nmbd_t) -miscfiles_read_localization(nmbd_t) - userdom_use_unpriv_users_fds(nmbd_t) userdom_dontaudit_search_user_home_dirs(nmbd_t) @@ -562,18 +589,21 @@ optional_policy(` # smbcontrol local policy # + +allow smbcontrol_t self:process signal; # internal communication is often done using fifo and unix sockets. allow smbcontrol_t self:fifo_file rw_file_perms; allow smbcontrol_t self:unix_stream_socket create_stream_socket_perms; +allow smbcontrol_t self:process { signal signull }; allow smbcontrol_t nmbd_t:process { signal signull }; +read_files_pattern(smbcontrol_t, nmbd_var_run_t, nmbd_var_run_t) -allow smbcontrol_t nmbd_var_run_t:file { read lock }; - -allow smbcontrol_t smbd_t:process signal; - +allow smbcontrol_t smbd_t:process { signal signull }; +read_files_pattern(smbcontrol_t, smbd_var_run_t, smbd_var_run_t) allow smbcontrol_t winbind_t:process { signal signull }; +files_search_var_lib(smbcontrol_t) samba_read_config(smbcontrol_t) samba_rw_var_files(smbcontrol_t) samba_search_var(smbcontrol_t) @@ -581,11 +611,19 @@ samba_read_winbind_pid(smbcontrol_t) domain_use_interactive_fds(smbcontrol_t) -files_read_etc_files(smbcontrol_t) +dev_read_urand(smbcontrol_t) + +term_use_console(smbcontrol_t) + -miscfiles_read_localization(smbcontrol_t) -userdom_use_user_terminals(smbcontrol_t) +sysnet_use_ldap(smbcontrol_t) + +userdom_use_inherited_user_terminals(smbcontrol_t) + +optional_policy(` + ctdbd_stream_connect(smbcontrol_t) +') ######################################## # @@ -604,7 +642,7 @@ allow smbmount_t samba_etc_t:file read_file_perms; can_exec(smbmount_t, smbmount_exec_t) -allow smbmount_t samba_log_t:dir list_dir_perms; +allow smbmount_t samba_log_t:dir list_dir_perms; allow smbmount_t samba_log_t:file manage_file_perms; allow smbmount_t samba_secrets_t:file manage_file_perms; @@ -615,7 +653,6 @@ files_list_var_lib(smbmount_t) kernel_read_system_state(smbmount_t) -corenet_all_recvfrom_unlabeled(smbmount_t) corenet_all_recvfrom_netlabel(smbmount_t) corenet_tcp_sendrecv_generic_if(smbmount_t) corenet_raw_sendrecv_generic_if(smbmount_t) @@ -645,25 +682,25 @@ files_list_mnt(smbmount_t) files_mounton_mnt(smbmount_t) files_manage_etc_runtime_files(smbmount_t) files_etc_filetrans_etc_runtime(smbmount_t, file) -files_read_etc_files(smbmount_t) auth_use_nsswitch(smbmount_t) -miscfiles_read_localization(smbmount_t) - -mount_use_fds(smbmount_t) locallogin_use_fds(smbmount_t) logging_search_logs(smbmount_t) -userdom_use_user_terminals(smbmount_t) +userdom_use_inherited_user_terminals(smbmount_t) userdom_use_all_users_fds(smbmount_t) optional_policy(` cups_read_rw_config(smbmount_t) ') +optional_policy(` + mount_use_fds(smbmount_t) +') + ######################################## # # SWAT Local policy @@ -684,7 +721,8 @@ samba_domtrans_nmbd(swat_t) allow swat_t nmbd_t:process { signal signull }; allow nmbd_t swat_t:process signal; -allow swat_t smbd_var_run_t:file { lock unlink }; +read_files_pattern(swat_t, nmbd_var_run_t, nmbd_var_run_t) +stream_connect_pattern(swat_t, nmbd_var_run_t, nmbd_var_run_t, nmbd_t) allow swat_t smbd_port_t:tcp_socket name_bind; @@ -699,12 +737,14 @@ manage_files_pattern(swat_t, samba_log_t, samba_log_t) manage_files_pattern(swat_t, samba_etc_t, samba_secrets_t) manage_files_pattern(swat_t, samba_var_t, samba_var_t) +files_list_var_lib(swat_t) allow swat_t smbd_exec_t:file mmap_file_perms ; allow swat_t smbd_t:process signull; allow swat_t smbd_var_run_t:file read_file_perms; +allow swat_t smbd_var_run_t:file { lock unlink }; manage_dirs_pattern(swat_t, swat_tmp_t, swat_tmp_t) manage_files_pattern(swat_t, swat_tmp_t, swat_tmp_t) @@ -717,6 +757,7 @@ allow swat_t winbind_exec_t:file mmap_file_perms; domtrans_pattern(swat_t, winbind_exec_t, winbind_t) allow swat_t winbind_t:process { signal signull }; +read_files_pattern(swat_t, winbind_var_run_t, winbind_var_run_t) allow swat_t winbind_var_run_t:dir { write add_name remove_name }; allow swat_t winbind_var_run_t:sock_file { create unlink }; @@ -726,7 +767,6 @@ kernel_read_network_state(swat_t) corecmd_search_bin(swat_t) -corenet_all_recvfrom_unlabeled(swat_t) corenet_all_recvfrom_netlabel(swat_t) corenet_tcp_sendrecv_generic_if(swat_t) corenet_udp_sendrecv_generic_if(swat_t) @@ -744,7 +784,6 @@ corenet_sendrecv_ipp_client_packets(swat_t) dev_read_urand(swat_t) files_list_var_lib(swat_t) -files_read_etc_files(swat_t) files_search_home(swat_t) files_read_usr_files(swat_t) fs_getattr_xattr_fs(swat_t) @@ -759,7 +798,10 @@ logging_send_syslog_msg(swat_t) logging_send_audit_msgs(swat_t) logging_search_logs(swat_t) -miscfiles_read_localization(swat_t) +sysnet_use_ldap(swat_t) + + +userdom_dontaudit_search_admin_dir(swat_t) optional_policy(` cups_read_rw_config(swat_t) @@ -790,7 +832,8 @@ allow winbind_t self:udp_socket create_socket_perms; allow winbind_t nmbd_t:process { signal signull }; -allow winbind_t nmbd_var_run_t:file read_file_perms; +read_files_pattern(winbind_t, nmbd_var_run_t, nmbd_var_run_t) +samba_stream_connect_nmbd(winbind_t) allow winbind_t samba_etc_t:dir list_dir_perms; read_files_pattern(winbind_t, samba_etc_t, samba_etc_t) @@ -813,21 +856,24 @@ rw_files_pattern(winbind_t, smbd_tmp_t, smbd_tmp_t) allow winbind_t winbind_log_t:file manage_file_perms; logging_log_filetrans(winbind_t, winbind_log_t, file) -manage_dirs_pattern(winbind_t, winbind_tmp_t, winbind_tmp_t) -manage_files_pattern(winbind_t, winbind_tmp_t, winbind_tmp_t) -manage_sock_files_pattern(winbind_t, winbind_tmp_t, winbind_tmp_t) -files_tmp_filetrans(winbind_t, winbind_tmp_t, { file dir }) +userdom_manage_user_tmp_dirs(winbind_t) +userdom_manage_user_tmp_files(winbind_t) +userdom_tmp_filetrans_user_tmp(winbind_t, { file dir }) +manage_dirs_pattern(winbind_t, { smbd_var_run_t winbind_var_run_t }, winbind_var_run_t) manage_files_pattern(winbind_t, winbind_var_run_t, winbind_var_run_t) manage_sock_files_pattern(winbind_t, winbind_var_run_t, winbind_var_run_t) -files_pid_filetrans(winbind_t, winbind_var_run_t, file) +files_pid_filetrans(winbind_t, winbind_var_run_t, { sock_file file dir }) +filetrans_pattern(winbind_t, smbd_var_run_t, winbind_var_run_t, dir) +# /run/samba/krb5cc_samba +manage_files_pattern(winbind_t, smbd_var_run_t, smbd_var_run_t) +kernel_read_network_state(winbind_t) kernel_read_kernel_sysctls(winbind_t) kernel_read_system_state(winbind_t) corecmd_exec_bin(winbind_t) -corenet_all_recvfrom_unlabeled(winbind_t) corenet_all_recvfrom_netlabel(winbind_t) corenet_tcp_sendrecv_generic_if(winbind_t) corenet_udp_sendrecv_generic_if(winbind_t) @@ -840,6 +886,7 @@ corenet_udp_sendrecv_all_ports(winbind_t) corenet_tcp_bind_generic_node(winbind_t) corenet_udp_bind_generic_node(winbind_t) corenet_tcp_connect_smbd_port(winbind_t) +corenet_tcp_connect_smbd_port(winbind_t) corenet_tcp_connect_epmap_port(winbind_t) corenet_tcp_connect_all_unreserved_ports(winbind_t) @@ -855,12 +902,14 @@ auth_manage_cache(winbind_t) domain_use_interactive_fds(winbind_t) -files_read_etc_files(winbind_t) files_read_usr_symlinks(winbind_t) +files_list_var_lib(winbind_t) logging_send_syslog_msg(winbind_t) -miscfiles_read_localization(winbind_t) +miscfiles_read_generic_certs(winbind_t) + +sysnet_use_ldap(winbind_t) userdom_dontaudit_use_unpriv_user_fds(winbind_t) userdom_manage_user_home_content_dirs(winbind_t) @@ -871,6 +920,11 @@ userdom_manage_user_home_content_sockets(winbind_t) userdom_user_home_dir_filetrans_user_home_content(winbind_t, { dir file lnk_file fifo_file sock_file }) optional_policy(` + ctdbd_stream_connect(winbind_t) + ctdbd_manage_lib_files(winbind_t) +') + +optional_policy(` kerberos_use(winbind_t) ') @@ -909,9 +963,7 @@ auth_use_nsswitch(winbind_helper_t) logging_send_syslog_msg(winbind_helper_t) -miscfiles_read_localization(winbind_helper_t) - -userdom_use_user_terminals(winbind_helper_t) +userdom_use_inherited_user_terminals(winbind_helper_t) optional_policy(` apache_append_log(winbind_helper_t) @@ -929,19 +981,34 @@ optional_policy(` # optional_policy(` - type samba_unconfined_script_t; - type samba_unconfined_script_exec_t; - domain_type(samba_unconfined_script_t) - domain_entry_file(samba_unconfined_script_t, samba_unconfined_script_exec_t) - corecmd_shell_entry_type(samba_unconfined_script_t) - role system_r types samba_unconfined_script_t; + type samba_unconfined_net_t; + domain_type(samba_unconfined_net_t) + domain_entry_file(samba_unconfined_net_t, samba_net_exec_t) + role system_r types samba_unconfined_net_t; + + unconfined_domain(samba_unconfined_net_t) - allow smbd_t samba_unconfined_script_exec_t:dir search_dir_perms; - allow smbd_t samba_unconfined_script_exec_t:file ioctl; + manage_files_pattern(samba_unconfined_net_t, samba_etc_t, samba_secrets_t) + filetrans_pattern(samba_unconfined_net_t, samba_etc_t, samba_secrets_t, file) + userdom_use_inherited_user_terminals(samba_unconfined_net_t) +') + +type samba_unconfined_script_t; +type samba_unconfined_script_exec_t; +domain_type(samba_unconfined_script_t) +domain_entry_file(samba_unconfined_script_t, samba_unconfined_script_exec_t) +corecmd_shell_entry_type(samba_unconfined_script_t) +role system_r types samba_unconfined_script_t; +allow smbd_t samba_unconfined_script_exec_t:dir search_dir_perms; +allow smbd_t samba_unconfined_script_exec_t:file ioctl; + +optional_policy(` unconfined_domain(samba_unconfined_script_t) +') - tunable_policy(`samba_run_unconfined',` +tunable_policy(`samba_run_unconfined',` domtrans_pattern(smbd_t, samba_unconfined_script_exec_t, samba_unconfined_script_t) - ') +',` + can_exec(smbd_t, samba_unconfined_script_exec_t) ') diff --git a/sambagui.te b/sambagui.te index 1898dbd..1d5e802 100644 --- a/sambagui.te +++ b/sambagui.te @@ -7,7 +7,8 @@ policy_module(sambagui, 1.1.0) type sambagui_t; type sambagui_exec_t; -dbus_system_domain(sambagui_t, sambagui_exec_t) +application_domain(sambagui_t, sambagui_exec_t) +role system_r types sambagui_t; ######################################## # @@ -27,21 +28,28 @@ corecmd_exec_bin(sambagui_t) dev_dontaudit_read_urand(sambagui_t) -files_read_etc_files(sambagui_t) +files_read_usr_files(sambagui_t) files_search_var_lib(sambagui_t) files_read_usr_files(sambagui_t) auth_use_nsswitch(sambagui_t) +auth_dontaudit_read_shadow(sambagui_t) + +init_access_check(sambagui_t) logging_send_syslog_msg(sambagui_t) -miscfiles_read_localization(sambagui_t) +sysnet_use_ldap(sambagui_t) optional_policy(` consoletype_exec(sambagui_t) ') optional_policy(` + dbus_system_domain(sambagui_t, sambagui_exec_t) +') + +optional_policy(` nscd_dontaudit_search_pid(sambagui_t) ') @@ -56,6 +64,7 @@ optional_policy(` samba_manage_var_files(sambagui_t) samba_read_secrets(sambagui_t) samba_initrc_domtrans(sambagui_t) + samba_systemctl(sambagui_t) samba_domtrans_smbd(sambagui_t) samba_domtrans_nmbd(sambagui_t) ') diff --git a/samhain.if b/samhain.if index c040ebf..2b601a5 100644 --- a/samhain.if +++ b/samhain.if @@ -271,10 +271,14 @@ interface(`samhain_admin',` type samhain_initrc_exec_t, samhain_log_t, samhain_var_run_t; ') - allow $1 samhain_t:process { ptrace signal_perms }; + allow $1 samhain_t:process signal_perms; ps_process_pattern($1, samhain_t) + tunable_policy(`deny_ptrace',`',` + allow $1 samhain_t:process ptrace; + allow $1 samhaind_t:process ptrace; + ') - allow $1 samhaind_t:process { ptrace signal_perms }; + allow $1 samhaind_t:process signal_perms; ps_process_pattern($1, samhaind_t) files_list_var_lib($1) diff --git a/samhain.te b/samhain.te index acd1700..778d18b 100644 --- a/samhain.te +++ b/samhain.te @@ -55,7 +55,7 @@ domain_use_interactive_fds(samhain_t) seutil_sigchld_newrole(samhain_t) -userdom_use_user_terminals(samhain_t) +userdom_use_inherited_user_terminals(samhain_t) ######################################## # diff --git a/sandbox.fc b/sandbox.fc new file mode 100644 index 0000000..b7db254 --- /dev/null +++ b/sandbox.fc @@ -0,0 +1 @@ +# Empty diff --git a/sandbox.if b/sandbox.if new file mode 100644 index 0000000..7addd77 --- /dev/null +++ b/sandbox.if @@ -0,0 +1,55 @@ + +## policy for sandbox + +######################################## +## +## Execute sandbox in the sandbox domain, and +## allow the specified role the sandbox domain. +## +## +## +## Domain allowed access +## +## +## +## +## The role to be allowed the sandbox domain. +## +## +# +interface(`sandbox_transition',` + gen_require(` + attribute sandbox_domain; + ') + + allow $1 sandbox_domain:process transition; + dontaudit $1 sandbox_domain:process { noatsecure siginh rlimitinh }; + role $2 types sandbox_domain; + allow sandbox_domain $1:process { sigchld signull }; + allow sandbox_domain $1:fifo_file rw_inherited_fifo_file_perms; + dontaudit sandbox_domain $1:process signal; +') + +######################################## +## +## Creates types and rules for a basic +## sandbox process domain. +## +## +## +## Prefix for the domain. +## +## +# +template(`sandbox_domain_template',` + + gen_require(` + attribute sandbox_domain; + ') + type $1_t, sandbox_domain; + + application_type($1_t) + + mls_rangetrans_target($1_t) + mcs_untrusted_proc($1_t) +') diff --git a/sandbox.te b/sandbox.te new file mode 100644 index 0000000..db440d4 --- /dev/null +++ b/sandbox.te @@ -0,0 +1,66 @@ +policy_module(sandbox,1.0.0) + +attribute sandbox_domain; + +######################################## +# +# Declarations +# +sandbox_domain_template(sandbox) + +######################################## +# +# sandbox local policy +# +allow sandbox_domain self:process { getattr signal_perms getsched setsched setpgid execstack }; +tunable_policy(`deny_execmem',`',` + allow sandbox_domain self:process execmem; +') + +allow sandbox_domain self:fifo_file manage_file_perms; +allow sandbox_domain self:sem create_sem_perms; +allow sandbox_domain self:shm create_shm_perms; +allow sandbox_domain self:msgq create_msgq_perms; +allow sandbox_domain self:unix_stream_socket create_stream_socket_perms; +allow sandbox_domain self:unix_dgram_socket { sendto create_socket_perms }; +dontaudit sandbox_domain self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay }; + +dev_rw_all_inherited_chr_files(sandbox_domain) +dev_rw_all_inherited_blk_files(sandbox_domain) + +# sandbox_file_t was moved to sandboxX.te +optional_policy(` + sandbox_exec_file(sandbox_domain) + sandbox_manage_content(sandbox_domain) + sandbox_dontaudit_mounton(sandbox_domain) + sandbox_manage_tmpfs_files(sandbox_domain) +') + +gen_require(` + type usr_t, lib_t, locale_t, device_t; + type var_t, var_run_t, rpm_log_t, locale_t; + attribute exec_type, configfile; +') + +kernel_dontaudit_read_system_state(sandbox_domain) + +corecmd_exec_all_executables(sandbox_domain) + +dev_dontaudit_getattr_all(sandbox_domain) + +files_rw_all_inherited_files(sandbox_domain, -exec_type -configfile -usr_t -lib_t -locale_t -var_t -var_run_t -device_t -rpm_log_t ) +files_entrypoint_all_files(sandbox_domain) + +files_read_config_files(sandbox_domain) +files_read_usr_files(sandbox_domain) +files_read_var_files(sandbox_domain) +files_dontaudit_search_all_dirs(sandbox_domain) + +fs_dontaudit_getattr_all_fs(sandbox_domain) + + +userdom_dontaudit_use_user_terminals(sandbox_domain) + +mta_dontaudit_read_spool_symlinks(sandbox_domain) + + diff --git a/sandboxX.fc b/sandboxX.fc new file mode 100644 index 0000000..6caef63 --- /dev/null +++ b/sandboxX.fc @@ -0,0 +1,2 @@ + +/usr/share/sandbox/start -- gen_context(system_u:object_r:sandbox_exec_t,s0) diff --git a/sandboxX.if b/sandboxX.if new file mode 100644 index 0000000..f6c1781 --- /dev/null +++ b/sandboxX.if @@ -0,0 +1,386 @@ + +## policy for sandboxX + +######################################## +## +## Execute sandbox in the sandbox domain, and +## allow the specified role the sandbox domain. +## +## +## +## Domain allowed access +## +## +## +## +## The role to be allowed the sandbox domain. +## +## +# +interface(`sandbox_x_transition',` + gen_require(` + type sandbox_xserver_t; + type sandbox_file_t; + attribute sandbox_x_domain; + attribute sandbox_tmpfs_type; + ') + + allow $1 sandbox_x_domain:process { signal_perms transition }; + dontaudit $1 sandbox_x_domain:process { noatsecure siginh rlimitinh }; + allow sandbox_x_domain $1:process { sigchld signull }; + allow { sandbox_x_domain sandbox_xserver_t } $1:fd use; + role $2 types sandbox_x_domain; + role $2 types sandbox_xserver_t; + allow $1 sandbox_xserver_t:process signal_perms; + dontaudit sandbox_xserver_t $1:fifo_file rw_inherited_fifo_file_perms; + dontaudit sandbox_xserver_t $1:tcp_socket rw_socket_perms; + dontaudit sandbox_xserver_t $1:udp_socket rw_socket_perms; + allow sandbox_xserver_t $1:unix_stream_socket { connectto rw_socket_perms }; + allow sandbox_x_domain sandbox_x_domain:process signal; + # Dontaudit leaked file descriptors + dontaudit sandbox_x_domain $1:fifo_file { read write }; + dontaudit sandbox_x_domain $1:tcp_socket rw_socket_perms; + dontaudit sandbox_x_domain $1:udp_socket rw_socket_perms; + dontaudit sandbox_x_domain $1:unix_stream_socket { read write }; + dontaudit sandbox_x_domain $1:process { signal sigkill }; + + allow $1 sandbox_tmpfs_type:file manage_file_perms; + dontaudit $1 sandbox_tmpfs_type:file manage_file_perms; + + can_exec($1, sandbox_file_t) + allow $1 sandbox_file_t:filesystem getattr; + manage_files_pattern($1, sandbox_file_t, sandbox_file_t); + manage_dirs_pattern($1, sandbox_file_t, sandbox_file_t); + manage_sock_files_pattern($1, sandbox_file_t, sandbox_file_t); + manage_fifo_files_pattern($1, sandbox_file_t, sandbox_file_t); + manage_lnk_files_pattern($1, sandbox_file_t, sandbox_file_t); + relabel_dirs_pattern($1, sandbox_file_t, sandbox_file_t) + relabel_files_pattern($1, sandbox_file_t, sandbox_file_t) + relabel_lnk_files_pattern($1, sandbox_file_t, sandbox_file_t) + relabel_fifo_files_pattern($1, sandbox_file_t, sandbox_file_t) + relabel_sock_files_pattern($1, sandbox_file_t, sandbox_file_t) +') + +######################################## +## +## Creates types and rules for a basic +## sandbox process domain. +## +## +## +## Prefix for the domain. +## +## +# +template(`sandbox_x_domain_template',` + gen_require(` + type xserver_exec_t, sandbox_devpts_t; + type sandbox_xserver_t; + type sandbox_exec_t; + attribute sandbox_x_domain; + attribute sandbox_tmpfs_type; + attribute sandbox_type; + ') + + type $1_t, sandbox_x_domain, sandbox_type; + application_type($1_t) + mcs_untrusted_proc($1_t) + + auth_use_nsswitch($1_t) + + logging_send_syslog_msg($1_t) + + # window manager + miscfiles_setattr_fonts_cache_dirs($1_t) + allow $1_t self:capability setuid; + + type $1_client_t, sandbox_x_domain; + application_type($1_client_t) + mcs_untrusted_proc($1_t) + + type $1_client_tmpfs_t, sandbox_tmpfs_type; + files_tmpfs_file($1_client_tmpfs_t) + + manage_files_pattern($1_client_t, $1_client_tmpfs_t, $1_client_tmpfs_t) + manage_files_pattern($1_t, $1_client_tmpfs_t, $1_client_tmpfs_t) + fs_tmpfs_filetrans($1_client_t, $1_client_tmpfs_t, file ) + fs_tmpfs_filetrans($1_t, $1_client_tmpfs_t, file ) + # Pulseaudio tmpfs files with different MCS labels + dontaudit $1_client_t $1_client_tmpfs_t:file { read write }; + dontaudit $1_t $1_client_tmpfs_t:file { read write }; + allow sandbox_xserver_t $1_client_tmpfs_t:file { read write }; + + domtrans_pattern($1_t, xserver_exec_t, sandbox_xserver_t) + allow $1_t sandbox_xserver_t:process signal_perms; + + domtrans_pattern($1_t, sandbox_exec_t, $1_client_t) + domain_entry_file($1_client_t, sandbox_exec_t) + + ps_process_pattern(sandbox_xserver_t, $1_client_t) + ps_process_pattern(sandbox_xserver_t, $1_t) + allow sandbox_xserver_t $1_client_t:shm rw_shm_perms; + allow sandbox_xserver_t $1_t:shm rw_shm_perms; + allow $1_client_t $1_t:unix_stream_socket connectto; + allow $1_t $1_client_t:unix_stream_socket connectto; +') + +######################################## +## +## allow domain to read, +## write sandbox_xserver tmp files +## +## +## +## Domain allowed access +## +## +# +interface(`sandbox_rw_xserver_tmpfs_files',` + gen_require(` + type sandbox_xserver_tmpfs_t; + ') + + allow $1 sandbox_xserver_tmpfs_t:file rw_file_perms; +') + +######################################## +## +## allow domain to read +## sandbox tmpfs files +## +## +## +## Domain allowed access +## +## +# +interface(`sandbox_read_tmpfs_files',` + gen_require(` + attribute sandbox_tmpfs_type; + ') + + allow $1 sandbox_tmpfs_type:file read_file_perms; +') + +######################################## +## +## allow domain to manage +## sandbox tmpfs files +## +## +## +## Domain allowed access +## +## +# +interface(`sandbox_manage_tmpfs_files',` + gen_require(` + attribute sandbox_tmpfs_type; + ') + + allow $1 sandbox_tmpfs_type:file manage_file_perms; +') + +######################################## +## +## Delete sandbox files +## +## +## +## Domain allowed access +## +## +# +interface(`sandbox_delete_files',` + gen_require(` + type sandbox_file_t; + ') + + delete_files_pattern($1, sandbox_file_t, sandbox_file_t) +') + +######################################## +## +## Manage sandbox content +## +## +## +## Domain allowed access +## +## +# +interface(`sandbox_manage_content',` + gen_require(` + type sandbox_file_t; + ') + + allow $1 sandbox_file_t:filesystem getattr; + manage_files_pattern($1, sandbox_file_t, sandbox_file_t); + manage_dirs_pattern($1, sandbox_file_t, sandbox_file_t); + manage_sock_files_pattern($1, sandbox_file_t, sandbox_file_t); + manage_fifo_files_pattern($1, sandbox_file_t, sandbox_file_t); + manage_lnk_files_pattern($1, sandbox_file_t, sandbox_file_t); +') + +######################################## +## +## Delete sandbox symbolic links +## +## +## +## Domain allowed access +## +## +# +interface(`sandbox_delete_lnk_files',` + gen_require(` + type sandbox_file_t; + ') + + delete_lnk_files_pattern($1, sandbox_file_t, sandbox_file_t) +') + +######################################## +## +## Delete sandbox fifo files +## +## +## +## Domain allowed access +## +## +# +interface(`sandbox_delete_pipes',` + gen_require(` + type sandbox_file_t; + ') + + delete_fifo_files_pattern($1, sandbox_file_t, sandbox_file_t) +') + +######################################## +## +## Delete sandbox sock files +## +## +## +## Domain allowed access +## +## +# +interface(`sandbox_delete_sock_files',` + gen_require(` + type sandbox_file_t; + ') + + delete_sock_files_pattern($1, sandbox_file_t, sandbox_file_t) +') + +######################################## +## +## Allow domain to set the attributes +## of the sandbox directory. +## +## +## +## Domain allowed access +## +## +# +interface(`sandbox_setattr_dirs',` + gen_require(` + type sandbox_file_t; + ') + + allow $1 sandbox_file_t:dir setattr; +') + +######################################## +## +## Delete sandbox directories +## +## +## +## Domain allowed access +## +## +# +interface(`sandbox_delete_dirs',` + gen_require(` + type sandbox_file_t; + ') + + delete_dirs_pattern($1, sandbox_file_t, sandbox_file_t) +') + +######################################## +## +## allow domain to list sandbox dirs +## +## +## +## Domain allowed access +## +## +# +interface(`sandbox_list',` + gen_require(` + type sandbox_file_t; + ') + + allow $1 sandbox_file_t:dir list_dir_perms; +') + +######################################## +## +## Read and write a sandbox domain pty. +## +## +## +## Domain allowed access. +## +## +# +interface(`sandbox_use_ptys',` + gen_require(` + type sandbox_devpts_t; + ') + + allow $1 sandbox_devpts_t:chr_file rw_inherited_term_perms; +') + +####################################### +## +## Allow domain to execute sandbox_file_t in the caller domain. +## +## +## +## Domain allowed access. +## +## +# +interface(`sandbox_exec_file',` + gen_require(` + type sandbox_file_t; + ') + + can_exec($1, sandbox_file_t) +') + +###################################### +## +## Allow domain to execute sandbox_file_t in the caller domain. +## +## +## +## Domain allowed access. +## +## +# +interface(`sandbox_dontaudit_mounton',` + gen_require(` + type sandbox_file_t; + ') + + dontaudit $1 sandbox_file_t:dir mounton; +') diff --git a/sandboxX.te b/sandboxX.te new file mode 100644 index 0000000..3532e98 --- /dev/null +++ b/sandboxX.te @@ -0,0 +1,454 @@ +policy_module(sandboxX,1.0.0) + +dbus_stub() +attribute sandbox_x_domain; +attribute sandbox_web_type; +attribute sandbox_file_type; +attribute sandbox_tmpfs_type; +attribute sandbox_type; + +type sandbox_exec_t; +files_type(sandbox_exec_t) + +type sandbox_file_t, sandbox_file_type; +files_type(sandbox_file_t) +typealias sandbox_file_t alias { sandbox_x_file_t sandbox_web_file_t sandbox_net_file_t sandbox_min_file_t }; + +######################################## +# +# Declarations +# +sandbox_x_domain_template(sandbox_min) +sandbox_x_domain_template(sandbox_x) +sandbox_x_domain_template(sandbox_web) +sandbox_x_domain_template(sandbox_net) + +type sandbox_xserver_t; +domain_type(sandbox_xserver_t) +xserver_user_x_domain_template(sandbox_xserver, sandbox_xserver_t, sandbox_xserver_tmpfs_t) + +type sandbox_xserver_tmpfs_t; +files_tmpfs_file(sandbox_xserver_tmpfs_t) + +type sandbox_devpts_t; +term_pty(sandbox_devpts_t) +files_type(sandbox_devpts_t) + +######################################## +# +# sandbox xserver policy +# +allow sandbox_xserver_t self:process { signal_perms execstack }; + +tunable_policy(`deny_execmem',`',` + allow sandbox_xserver_t self:process execmem; +') + +allow sandbox_xserver_t self:fifo_file manage_fifo_file_perms; +allow sandbox_xserver_t self:shm create_shm_perms; +allow sandbox_xserver_t self:tcp_socket create_stream_socket_perms; + +manage_dirs_pattern(sandbox_xserver_t, sandbox_file_t, sandbox_file_t) +manage_files_pattern(sandbox_xserver_t, sandbox_file_t, sandbox_file_t) +manage_sock_files_pattern(sandbox_xserver_t, sandbox_file_t, sandbox_file_t) +allow sandbox_xserver_t sandbox_file_t:sock_file create_sock_file_perms; + +manage_dirs_pattern(sandbox_xserver_t, sandbox_xserver_tmpfs_t, sandbox_xserver_tmpfs_t) +manage_files_pattern(sandbox_xserver_t, sandbox_xserver_tmpfs_t, sandbox_xserver_tmpfs_t) +manage_lnk_files_pattern(sandbox_xserver_t, sandbox_xserver_tmpfs_t, sandbox_xserver_tmpfs_t) +manage_fifo_files_pattern(sandbox_xserver_t, sandbox_xserver_tmpfs_t, sandbox_xserver_tmpfs_t) +manage_sock_files_pattern(sandbox_xserver_t, sandbox_xserver_tmpfs_t, sandbox_xserver_tmpfs_t) +fs_tmpfs_filetrans(sandbox_xserver_t, sandbox_xserver_tmpfs_t, { dir file lnk_file sock_file fifo_file }) + +kernel_dontaudit_request_load_module(sandbox_xserver_t) +kernel_read_system_state(sandbox_xserver_t) + +corecmd_exec_bin(sandbox_xserver_t) +corecmd_exec_shell(sandbox_xserver_t) + +corenet_all_recvfrom_netlabel(sandbox_xserver_t) +corenet_tcp_sendrecv_generic_if(sandbox_xserver_t) +corenet_udp_sendrecv_generic_if(sandbox_xserver_t) +corenet_tcp_sendrecv_generic_node(sandbox_xserver_t) +corenet_udp_sendrecv_generic_node(sandbox_xserver_t) +corenet_tcp_sendrecv_all_ports(sandbox_xserver_t) +corenet_udp_sendrecv_all_ports(sandbox_xserver_t) +corenet_tcp_bind_generic_node(sandbox_xserver_t) +corenet_tcp_bind_xserver_port(sandbox_xserver_t) +corenet_sendrecv_xserver_server_packets(sandbox_xserver_t) +corenet_sendrecv_all_client_packets(sandbox_xserver_t) + +dev_read_sysfs(sandbox_xserver_t) +dev_rwx_zero(sandbox_xserver_t) +dev_read_urand(sandbox_xserver_t) + +domain_use_interactive_fds(sandbox_xserver_t) + +files_read_config_files(sandbox_xserver_t) +files_read_usr_files(sandbox_xserver_t) +files_search_home(sandbox_xserver_t) +fs_dontaudit_rw_tmpfs_files(sandbox_xserver_t) +fs_list_inotifyfs(sandbox_xserver_t) +fs_search_auto_mountpoints(sandbox_xserver_t) + +miscfiles_read_fonts(sandbox_xserver_t) + +selinux_validate_context(sandbox_xserver_t) +selinux_compute_access_vector(sandbox_xserver_t) +selinux_compute_create_context(sandbox_xserver_t) + +auth_use_nsswitch(sandbox_xserver_t) + +logging_send_syslog_msg(sandbox_xserver_t) +logging_send_audit_msgs(sandbox_xserver_t) + +userdom_use_inherited_user_terminals(sandbox_xserver_t) +userdom_dontaudit_search_user_home_content(sandbox_xserver_t) +userdom_dontaudit_rw_user_tmp_pipes(sandbox_xserver_t) + +xserver_entry_type(sandbox_xserver_t) + +optional_policy(` + dbus_system_bus_client(sandbox_xserver_t) + + optional_policy(` + hal_dbus_chat(sandbox_xserver_t) + ') +') + +######################################## +# +# sandbox_x_domain local policy +# +allow sandbox_x_domain self:process { getattr signal_perms getsched setsched setpgid execstack }; +tunable_policy(`deny_execmem',`',` + allow sandbox_x_domain self:process execmem; +') + +allow sandbox_x_domain self:fifo_file manage_file_perms; +allow sandbox_x_domain self:sem create_sem_perms; +allow sandbox_x_domain self:shm create_shm_perms; +allow sandbox_x_domain self:msgq create_msgq_perms; +allow sandbox_x_domain self:netlink_selinux_socket create_socket_perms; +allow sandbox_x_domain self:unix_dgram_socket { sendto create_socket_perms }; +allow sandbox_x_domain self:unix_stream_socket { connectto create_stream_socket_perms }; + +dontaudit sandbox_x_domain sandbox_x_domain:process signal; +dontaudit sandbox_x_domain sandbox_xserver_t:process signal; +dontaudit sandbox_x_domain self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay }; + +allow sandbox_x_domain sandbox_xserver_t:unix_stream_socket connectto; + +allow sandbox_x_domain sandbox_devpts_t:chr_file { rw_term_perms setattr }; +term_create_pty(sandbox_x_domain,sandbox_devpts_t) + +can_exec(sandbox_x_domain, sandbox_file_t) +allow sandbox_x_domain sandbox_file_t:filesystem getattr; +manage_files_pattern(sandbox_x_domain, sandbox_file_t, sandbox_file_t); +manage_dirs_pattern(sandbox_x_domain, sandbox_file_t, sandbox_file_t); +manage_sock_files_pattern(sandbox_x_domain, sandbox_file_t, sandbox_file_t); +manage_fifo_files_pattern(sandbox_x_domain, sandbox_file_t, sandbox_file_t); +manage_lnk_files_pattern(sandbox_x_domain, sandbox_file_t, sandbox_file_t); +dontaudit sandbox_x_domain sandbox_file_t:dir mounton; + +kernel_getattr_proc(sandbox_x_domain) +kernel_read_network_state(sandbox_x_domain) +kernel_read_system_state(sandbox_x_domain) +kernel_dontaudit_search_kernel_sysctl(sandbox_x_domain) + +domain_dontaudit_read_all_domains_state(sandbox_x_domain) + +corecmd_exec_all_executables(sandbox_x_domain) + +dev_read_urand(sandbox_x_domain) +dev_dontaudit_read_rand(sandbox_x_domain) +dev_read_sysfs(sandbox_x_domain) +dev_dontaudit_rw_dri(sandbox_x_domain) + +files_search_home(sandbox_x_domain) +files_dontaudit_list_all_mountpoints(sandbox_x_domain) +files_entrypoint_all_files(sandbox_x_domain) +files_read_config_files(sandbox_x_domain) +files_read_usr_files(sandbox_x_domain) +files_read_usr_symlinks(sandbox_x_domain) + +fs_getattr_tmpfs(sandbox_x_domain) +fs_getattr_xattr_fs(sandbox_x_domain) +fs_list_inotifyfs(sandbox_x_domain) +fs_dontaudit_getattr_xattr_fs(sandbox_x_domain) +# Random tmpfs_t that gets created when you run X. +fs_rw_tmpfs_files(sandbox_x_domain) +fs_get_xattr_fs_quotas(sandbox_x_domain) + +auth_dontaudit_read_login_records(sandbox_x_domain) +auth_dontaudit_write_login_records(sandbox_x_domain) +auth_search_pam_console_data(sandbox_x_domain) + +init_read_utmp(sandbox_x_domain) +init_dontaudit_write_utmp(sandbox_x_domain) + +libs_dontaudit_setattr_lib_files(sandbox_x_domain) + +miscfiles_dontaudit_setattr_fonts_cache_dirs(sandbox_x_domain) + +mta_dontaudit_read_spool_symlinks(sandbox_x_domain) + +selinux_get_fs_mount(sandbox_x_domain) +selinux_validate_context(sandbox_x_domain) +selinux_compute_access_vector(sandbox_x_domain) +selinux_compute_create_context(sandbox_x_domain) +selinux_compute_relabel_context(sandbox_x_domain) +selinux_compute_user_contexts(sandbox_x_domain) +seutil_read_default_contexts(sandbox_x_domain) + +term_getattr_pty_fs(sandbox_x_domain) +term_use_ptmx(sandbox_x_domain) +term_search_ptys(sandbox_x_domain) + +application_dontaudit_signal(sandbox_x_domain) +application_dontaudit_sigkill(sandbox_x_domain) + +logging_dontaudit_search_logs(sandbox_x_domain) + +miscfiles_read_fonts(sandbox_x_domain) + +storage_dontaudit_rw_fuse(sandbox_x_domain) + +optional_policy(` + consolekit_dbus_chat(sandbox_x_domain) +') + +optional_policy(` + cups_stream_connect(sandbox_x_domain) + cups_read_rw_config(sandbox_x_domain) +') + +optional_policy(` + dbus_system_bus_client(sandbox_x_domain) +') + +optional_policy(` + devicekit_dontaudit_dbus_chat_disk(sandbox_x_domain) +') + +optional_policy(` + gnome_read_gconf_config(sandbox_x_domain) +') + +optional_policy(` + nscd_dontaudit_search_pid(sandbox_x_domain) +') + +optional_policy(` + sssd_dontaudit_search_lib(sandbox_x_domain) +') + +optional_policy(` + udev_read_db(sandbox_x_domain) +') + +userdom_dontaudit_use_user_terminals(sandbox_x_domain) +userdom_read_user_home_content_symlinks(sandbox_x_domain) +userdom_search_user_home_content(sandbox_x_domain) +userdom_dontaudit_rw_user_tmp_pipes(sandbox_x_domain) + +fs_search_auto_mountpoints(sandbox_x_domain) + +tunable_policy(`use_nfs_home_dirs',` + fs_search_auto_mountpoints(sandbox_x_domain) + fs_search_nfs(sandbox_xserver_t) + fs_read_nfs_files(sandbox_xserver_t) + fs_manage_nfs_dirs(sandbox_x_domain) + fs_manage_nfs_files(sandbox_x_domain) + fs_exec_nfs_files(sandbox_x_domain) +') + +tunable_policy(`use_samba_home_dirs',` + fs_search_cifs(sandbox_xserver_t) + fs_read_cifs_files(sandbox_xserver_t) + fs_manage_cifs_dirs(sandbox_x_domain) + fs_manage_cifs_files(sandbox_x_domain) + fs_exec_cifs_files(sandbox_x_domain) +') + +tunable_policy(`use_fusefs_home_dirs',` + fs_search_fusefs(sandbox_xserver_t) + fs_read_fusefs_files(sandbox_xserver_t) + fs_manage_fusefs_dirs(sandbox_x_domain) + fs_manage_fusefs_files(sandbox_x_domain) + fs_exec_fusefs_files(sandbox_x_domain) +') + +files_search_home(sandbox_x_t) +userdom_use_user_ptys(sandbox_x_t) + +######################################## +# +# sandbox_x_client_t local policy +# +allow sandbox_x_client_t self:tcp_socket create_stream_socket_perms; +allow sandbox_x_client_t self:udp_socket create_socket_perms; +allow sandbox_x_client_t self:dbus { acquire_svc send_msg }; + +dev_read_rand(sandbox_x_client_t) + +corenet_tcp_connect_ipp_port(sandbox_x_client_t) +corenet_dontaudit_tcp_connect_xserver_port(sandbox_x_client_t) + +auth_use_nsswitch(sandbox_x_client_t) + +logging_send_syslog_msg(sandbox_x_client_t) + +optional_policy(` + colord_dbus_chat(sandbox_x_client_t) +') + +optional_policy(` + hal_dbus_chat(sandbox_x_client_t) +') + +optional_policy(` + nsplugin_read_rw_files(sandbox_x_client_t) +') + +######################################## +# +# sandbox_web_client_t local policy +# +typeattribute sandbox_web_client_t sandbox_web_type; + +auth_use_nsswitch(sandbox_web_client_t) + +logging_send_syslog_msg(sandbox_web_client_t) + +allow sandbox_web_type self:capability { setuid setgid }; +allow sandbox_web_type self:netlink_audit_socket nlmsg_relay; +dontaudit sandbox_web_type self:process setrlimit; + +allow sandbox_web_type self:tcp_socket create_stream_socket_perms; +allow sandbox_web_type self:udp_socket create_socket_perms; +allow sandbox_web_type self:dbus { acquire_svc send_msg }; + +kernel_dontaudit_search_kernel_sysctl(sandbox_web_type) +kernel_request_load_module(sandbox_web_type) + +dev_read_rand(sandbox_web_type) +dev_write_sound(sandbox_web_type) +dev_read_sound(sandbox_web_type) + +corenet_tcp_sendrecv_generic_if(sandbox_web_type) +corenet_raw_sendrecv_generic_if(sandbox_web_type) +corenet_tcp_sendrecv_generic_node(sandbox_web_type) +corenet_raw_sendrecv_generic_node(sandbox_web_type) +corenet_tcp_sendrecv_http_port(sandbox_web_type) +corenet_tcp_sendrecv_http_cache_port(sandbox_web_type) +corenet_tcp_sendrecv_squid_port(sandbox_web_type) +corenet_tcp_sendrecv_ftp_port(sandbox_web_type) +corenet_tcp_sendrecv_ipp_port(sandbox_web_type) +corenet_tcp_connect_http_port(sandbox_web_type) +corenet_tcp_connect_http_cache_port(sandbox_web_type) +corenet_tcp_connect_squid_port(sandbox_web_type) +corenet_tcp_connect_flash_port(sandbox_web_type) +corenet_tcp_connect_ftp_port(sandbox_web_type) +corenet_tcp_connect_all_ephemeral_ports(sandbox_web_type) +corenet_tcp_connect_ipp_port(sandbox_web_type) +corenet_tcp_connect_streaming_port(sandbox_web_type) +corenet_tcp_connect_pulseaudio_port(sandbox_web_type) +corenet_tcp_connect_speech_port(sandbox_web_type) +corenet_tcp_connect_generic_port(sandbox_web_type) +corenet_tcp_connect_soundd_port(sandbox_web_type) +corenet_tcp_connect_speech_port(sandbox_web_type) +corenet_sendrecv_http_client_packets(sandbox_web_type) +corenet_sendrecv_http_cache_client_packets(sandbox_web_type) +corenet_sendrecv_squid_client_packets(sandbox_web_type) +corenet_sendrecv_ftp_client_packets(sandbox_web_type) +corenet_sendrecv_ipp_client_packets(sandbox_web_type) +corenet_sendrecv_generic_client_packets(sandbox_web_type) + +corenet_dontaudit_tcp_sendrecv_generic_port(sandbox_web_type) +corenet_dontaudit_tcp_bind_generic_port(sandbox_web_type) + +files_dontaudit_getattr_all_dirs(sandbox_web_type) + +fs_dontaudit_rw_anon_inodefs_files(sandbox_web_type) +fs_dontaudit_getattr_all_fs(sandbox_web_type) + +storage_dontaudit_getattr_fixed_disk_dev(sandbox_web_type) + +dbus_system_bus_client(sandbox_web_type) +dbus_read_config(sandbox_web_type) +selinux_get_fs_mount(sandbox_web_type) +selinux_validate_context(sandbox_web_type) +selinux_compute_access_vector(sandbox_web_type) +selinux_compute_create_context(sandbox_web_type) +selinux_compute_relabel_context(sandbox_web_type) +selinux_compute_user_contexts(sandbox_web_type) +seutil_read_default_contexts(sandbox_web_type) + +userdom_rw_user_tmpfs_files(sandbox_web_type) +userdom_delete_user_tmpfs_files(sandbox_web_type) + +optional_policy(` + alsa_read_rw_config(sandbox_web_type) +') + +optional_policy(` + bluetooth_dontaudit_dbus_chat(sandbox_web_type) +') + +optional_policy(` + hal_dbus_chat(sandbox_web_type) +') + +optional_policy(` + chrome_domtrans_sandbox(sandbox_web_type) +') + +optional_policy(` + nsplugin_manage_rw(sandbox_web_type) + nsplugin_read_rw_files(sandbox_web_type) + nsplugin_rw_exec(sandbox_web_type) +') + +optional_policy(` + pulseaudio_stream_connect(sandbox_web_type) + allow sandbox_web_type self:netlink_kobject_uevent_socket create_socket_perms; +') + +optional_policy(` + rtkit_daemon_dontaudit_dbus_chat(sandbox_web_type) +') + +optional_policy(` + networkmanager_dontaudit_dbus_chat(sandbox_web_type) +') + +optional_policy(` + udev_read_state(sandbox_web_type) +') + +######################################## +# +# sandbox_net_client_t local policy +# +typeattribute sandbox_net_client_t sandbox_web_type; + +corenet_tcp_sendrecv_generic_if(sandbox_net_client_t) +corenet_udp_sendrecv_generic_if(sandbox_net_client_t) +corenet_tcp_sendrecv_generic_node(sandbox_net_client_t) +corenet_udp_sendrecv_generic_node(sandbox_net_client_t) +corenet_tcp_sendrecv_all_ports(sandbox_net_client_t) +corenet_udp_sendrecv_all_ports(sandbox_net_client_t) +corenet_tcp_connect_all_ports(sandbox_net_client_t) +corenet_sendrecv_all_client_packets(sandbox_net_client_t) + +auth_use_nsswitch(sandbox_net_client_t) + +logging_send_syslog_msg(sandbox_net_client_t) + +optional_policy(` + mozilla_dontaudit_rw_user_home_files(sandbox_x_t) + mozilla_dontaudit_rw_user_home_files(sandbox_xserver_t) + mozilla_dontaudit_rw_user_home_files(sandbox_x_domain) + mozilla_plugin_dontaudit_leaks(sandbox_x_domain) +') diff --git a/sanlock.fc b/sanlock.fc index 5d1826c..9656f79 100644 --- a/sanlock.fc +++ b/sanlock.fc @@ -1,7 +1,8 @@ + /etc/rc\.d/init\.d/sanlock -- gen_context(system_u:object_r:sanlock_initrc_exec_t,s0) /var/run/sanlock(/.*)? gen_context(system_u:object_r:sanlock_var_run_t,s0) -/var/log/sanlock\.log gen_context(system_u:object_r:sanlock_log_t,s0) +/var/log/sanlock\.log.* gen_context(system_u:object_r:sanlock_log_t,s0) /usr/sbin/sanlock -- gen_context(system_u:object_r:sanlock_exec_t,s0) diff --git a/sanlock.if b/sanlock.if index cfe3172..3eb745d 100644 --- a/sanlock.if +++ b/sanlock.if @@ -1,3 +1,4 @@ + ## policy for sanlock ######################################## @@ -18,6 +19,7 @@ interface(`sanlock_domtrans',` domtrans_pattern($1, sanlock_exec_t, sanlock_t) ') + ######################################## ## ## Execute sanlock server in the sanlock domain. @@ -57,21 +59,21 @@ interface(`sanlock_manage_pid_files',` ######################################## ## -## Connect to sanlock over an unix stream socket. +## Connect to sanlock over a unix stream socket. ## ## -## -## Domain allowed access. -## +## +## Domain allowed access. +## ## # interface(`sanlock_stream_connect',` - gen_require(` - type sanlock_t, sanlock_var_run_t; - ') + gen_require(` + type sanlock_t, sanlock_var_run_t; + ') - files_search_pids($1) - stream_connect_pattern($1, sanlock_var_run_t, sanlock_var_run_t, sanlock_t) + files_search_pids($1) + stream_connect_pattern($1, sanlock_var_run_t, sanlock_var_run_t, sanlock_t) ') ######################################## @@ -99,9 +101,13 @@ interface(`sanlock_admin',` allow $1 sanlock_t:process signal_perms; ps_process_pattern($1, sanlock_t) + tunable_policy(`deny_ptrace',`',` + allow $1 sanlock_t:process ptrace; + ') sanlock_initrc_domtrans($1) domain_system_change_exemption($1) role_transition $2 sanlock_initrc_exec_t system_r; allow $2 system_r; + ') diff --git a/sanlock.te b/sanlock.te index e02eb6c..5388405 100644 --- a/sanlock.te +++ b/sanlock.te @@ -1,4 +1,4 @@ -policy_module(sanlock, 1.0.0) +policy_module(sanlock,1.0.0) ######################################## # @@ -6,18 +6,25 @@ policy_module(sanlock, 1.0.0) # ## -##

-## Allow confined virtual guests to manage nfs files -##

+##

+## Allow sanlock to manage nfs files +##

## gen_tunable(sanlock_use_nfs, false) ## +##

+## Allow sanlock to manage cifs files +##

+## +gen_tunable(sanlock_use_samba, false) + +## ##

-## Allow confined virtual guests to manage cifs files +## Allow sanlock to read/write fuse files ##

## -gen_tunable(sanlock_use_samba, false) +gen_tunable(sanlock_use_fusefs, false) type sanlock_t; type sanlock_exec_t; @@ -44,8 +51,9 @@ ifdef(`enable_mls',` # # sanlock local policy # -allow sanlock_t self:capability { sys_nice ipc_lock }; -allow sanlock_t self:process { setsched signull }; +allow sanlock_t self:capability { chown dac_override ipc_lock kill setgid setuid sys_nice sys_resource }; +allow sanlock_t self:process { setrlimit setsched signull signal sigkill }; + allow sanlock_t self:fifo_file rw_fifo_file_perms; allow sanlock_t self:unix_stream_socket create_stream_socket_perms; @@ -58,36 +66,49 @@ manage_sock_files_pattern(sanlock_t, sanlock_var_run_t, sanlock_var_run_t) files_pid_filetrans(sanlock_t, sanlock_var_run_t, { file dir sock_file }) kernel_read_system_state(sanlock_t) +kernel_read_kernel_sysctls(sanlock_t) domain_use_interactive_fds(sanlock_t) -files_read_etc_files(sanlock_t) storage_raw_rw_fixed_disk(sanlock_t) dev_read_urand(sanlock_t) +auth_use_nsswitch(sanlock_t) + init_read_utmp(sanlock_t) init_dontaudit_write_utmp(sanlock_t) logging_send_syslog_msg(sanlock_t) -miscfiles_read_localization(sanlock_t) +tunable_policy(`sanlock_use_fusefs',` + fs_manage_fusefs_dirs(sanlock_t) + fs_manage_fusefs_files(sanlock_t) + fs_read_fusefs_symlinks(sanlock_t) + fs_getattr_fusefs(sanlock_t) +') tunable_policy(`sanlock_use_nfs',` - fs_manage_nfs_dirs(sanlock_t) - fs_manage_nfs_files(sanlock_t) - fs_manage_nfs_named_sockets(sanlock_t) - fs_read_nfs_symlinks(sanlock_t) + fs_manage_nfs_dirs(sanlock_t) + fs_manage_nfs_files(sanlock_t) + fs_manage_nfs_named_sockets(sanlock_t) + fs_read_nfs_symlinks(sanlock_t) ') tunable_policy(`sanlock_use_samba',` - fs_manage_cifs_dirs(sanlock_t) - fs_manage_cifs_files(sanlock_t) - fs_manage_cifs_named_sockets(sanlock_t) - fs_read_cifs_symlinks(sanlock_t) + fs_manage_cifs_dirs(sanlock_t) + fs_manage_cifs_files(sanlock_t) + fs_manage_cifs_named_sockets(sanlock_t) + fs_read_cifs_symlinks(sanlock_t) +') + +optional_policy(` + wdmd_stream_connect(sanlock_t) ') optional_policy(` + virt_kill_svirt(sanlock_t) virt_manage_lib_files(sanlock_t) + virt_signal_svirt(sanlock_t) ') diff --git a/sasl.if b/sasl.if index f1aea88..3e6a93f 100644 --- a/sasl.if +++ b/sasl.if @@ -38,21 +38,21 @@ interface(`sasl_connect',` # interface(`sasl_admin',` gen_require(` - type saslauthd_t, saslauthd_tmp_t, saslauthd_var_run_t; + type saslauthd_t, saslauthd_var_run_t; type saslauthd_initrc_exec_t; ') - allow $1 saslauthd_t:process { ptrace signal_perms getattr }; + allow $1 saslauthd_t:process signal_perms; ps_process_pattern($1, saslauthd_t) + tunable_policy(`deny_ptrace',`',` + allow $1 saslauthd_t:process ptrace; + ') init_labeled_script_domtrans($1, saslauthd_initrc_exec_t) domain_system_change_exemption($1) role_transition $2 saslauthd_initrc_exec_t system_r; allow $2 system_r; - files_list_tmp($1) - admin_pattern($1, saslauthd_tmp_t) - files_list_pids($1) admin_pattern($1, saslauthd_var_run_t) ') diff --git a/sasl.te b/sasl.te index 9d9f8ce..1a3a14e 100644 --- a/sasl.te +++ b/sasl.te @@ -10,7 +10,7 @@ policy_module(sasl, 1.14.0) ## Allow sasl to read shadow ##

## -gen_tunable(allow_saslauthd_read_shadow, false) +gen_tunable(saslauthd_read_shadow, false) type saslauthd_t; type saslauthd_exec_t; @@ -19,9 +19,6 @@ init_daemon_domain(saslauthd_t, saslauthd_exec_t) type saslauthd_initrc_exec_t; init_script_file(saslauthd_initrc_exec_t) -type saslauthd_tmp_t; -files_tmp_file(saslauthd_tmp_t) - type saslauthd_var_run_t; files_pid_file(saslauthd_var_run_t) @@ -30,31 +27,32 @@ files_pid_file(saslauthd_var_run_t) # Local policy # -allow saslauthd_t self:capability { setgid setuid }; +allow saslauthd_t self:capability { setgid setuid sys_nice }; dontaudit saslauthd_t self:capability sys_tty_config; -allow saslauthd_t self:process signal_perms; +allow saslauthd_t self:process { setsched signal_perms }; allow saslauthd_t self:fifo_file rw_fifo_file_perms; allow saslauthd_t self:unix_dgram_socket create_socket_perms; allow saslauthd_t self:unix_stream_socket create_stream_socket_perms; allow saslauthd_t self:tcp_socket create_socket_perms; -allow saslauthd_t saslauthd_tmp_t:dir setattr; -manage_files_pattern(saslauthd_t, saslauthd_tmp_t, saslauthd_tmp_t) -files_tmp_filetrans(saslauthd_t, saslauthd_tmp_t, file) - +manage_dirs_pattern(saslauthd_t, saslauthd_var_run_t, saslauthd_var_run_t) manage_files_pattern(saslauthd_t, saslauthd_var_run_t, saslauthd_var_run_t) manage_sock_files_pattern(saslauthd_t, saslauthd_var_run_t, saslauthd_var_run_t) -files_pid_filetrans(saslauthd_t, saslauthd_var_run_t, file) +files_pid_filetrans(saslauthd_t, saslauthd_var_run_t, { file dir }) kernel_read_kernel_sysctls(saslauthd_t) kernel_read_system_state(saslauthd_t) +kernel_rw_afs_state(saslauthd_t) + +#577519 +corecmd_exec_bin(saslauthd_t) -corenet_all_recvfrom_unlabeled(saslauthd_t) corenet_all_recvfrom_netlabel(saslauthd_t) corenet_tcp_sendrecv_generic_if(saslauthd_t) corenet_tcp_sendrecv_generic_node(saslauthd_t) corenet_tcp_sendrecv_all_ports(saslauthd_t) corenet_tcp_connect_pop_port(saslauthd_t) +corenet_tcp_connect_zarafa_port(saslauthd_t) corenet_sendrecv_pop_client_packets(saslauthd_t) dev_read_urand(saslauthd_t) @@ -78,7 +76,6 @@ init_dontaudit_stream_connect_script(saslauthd_t) logging_send_syslog_msg(saslauthd_t) -miscfiles_read_localization(saslauthd_t) miscfiles_read_generic_certs(saslauthd_t) seutil_dontaudit_read_config(saslauthd_t) @@ -88,11 +85,13 @@ userdom_dontaudit_search_user_home_dirs(saslauthd_t) # cjp: typeattribute doesnt work in conditionals auth_can_read_shadow_passwords(saslauthd_t) -tunable_policy(`allow_saslauthd_read_shadow',` +tunable_policy(`saslauthd_read_shadow',` + allow saslauthd_t self:capability dac_override; auth_tunable_read_shadow(saslauthd_t) ') optional_policy(` + kerberos_tmp_filetrans_host_rcache(saslauthd_t, "host_0") kerberos_keytab_template(saslauthd, saslauthd_t) ') diff --git a/sblim.if b/sblim.if index fa24879..fdb665a 100644 --- a/sblim.if +++ b/sblim.if @@ -48,11 +48,6 @@ interface(`sblim_read_pid_files',` ## Domain allowed access. ## ## -## -## -## Role allowed access. -## -## ## # interface(`sblim_admin',` @@ -65,6 +60,11 @@ interface(`sblim_admin',` allow $1 sblim_gatherd_t:process signal_perms; ps_process_pattern($1, sblim_gatherd_t) + tunable_policy(`deny_ptrace',`',` + allow $1 sblim_gatherd_t:process ptrace; + allow $1 sblim_reposd_t:process ptrace; + ') + allow $1 sblim_reposd_t:process signal_perms; ps_process_pattern($1, sblim_reposd_t) diff --git a/sblim.te b/sblim.te index 869f976..16bda71 100644 --- a/sblim.te +++ b/sblim.te @@ -42,6 +42,8 @@ domain_read_all_domains_state(sblim_gatherd_t) fs_getattr_all_fs(sblim_gatherd_t) +logging_send_syslog_msg(sblim_gatherd_t) + sysnet_dns_name_resolve(sblim_gatherd_t) term_getattr_pty_fs(sblim_gatherd_t) @@ -64,6 +66,7 @@ optional_policy(` optional_policy(` virt_stream_connect(sblim_gatherd_t) + virt_getattr_exec(sblim_gatherd_t) ') optional_policy(` @@ -81,6 +84,8 @@ domtrans_pattern(sblim_gatherd_t, sblim_reposd_exec_t, sblim_reposd_t) corenet_tcp_bind_all_nodes(sblim_reposd_t) corenet_tcp_bind_repository_port(sblim_reposd_t) +logging_send_syslog_msg(sblim_reposd_t) + ###################################### # # sblim_domain local policy @@ -97,8 +102,5 @@ kernel_read_system_state(sblim_domain) dev_read_sysfs(sblim_domain) -logging_send_syslog_msg(sblim_domain) - files_read_etc_files(sblim_domain) -miscfiles_read_localization(sblim_domain) diff --git a/screen.fc b/screen.fc index c8254dd..b73334e 100644 --- a/screen.fc +++ b/screen.fc @@ -1,15 +1,19 @@ # # /home # -HOME_DIR/\.screen(/.*)? gen_context(system_u:object_r:screen_home_t,s0) HOME_DIR/\.screenrc -- gen_context(system_u:object_r:screen_home_t,s0) +HOME_DIR/\.screen(/.*)? gen_context(system_u:object_r:screen_home_t,s0) + +/root/\.screen(/.*)? gen_context(system_u:object_r:screen_home_t,s0) # # /usr # /usr/bin/screen -- gen_context(system_u:object_r:screen_exec_t,s0) +/usr/bin/tmux -- gen_context(system_u:object_r:screen_exec_t,s0) # # /var # /var/run/screen(/.*)? gen_context(system_u:object_r:screen_var_run_t,s0) +/var/run/tmux(/.*)? gen_context(system_u:object_r:screen_var_run_t,s0) diff --git a/screen.if b/screen.if index c50a444..d73be9f 100644 --- a/screen.if +++ b/screen.if @@ -25,6 +25,7 @@ template(`screen_role_template',` gen_require(` type screen_exec_t, screen_tmp_t; type screen_home_t, screen_var_run_t; + attribute screen_domain; ') ######################################## @@ -32,50 +33,20 @@ template(`screen_role_template',` # Declarations # - type $1_screen_t; - userdom_user_application_domain($1_screen_t, screen_exec_t) + type $1_screen_t, screen_domain; + application_domain($1_screen_t, screen_exec_t) domain_interactive_fd($1_screen_t) + ubac_constrained($1_screen_t) role $2 types $1_screen_t; - ######################################## - # - # Local policy - # - - allow $1_screen_t self:capability { setuid setgid fsetid }; - allow $1_screen_t self:process signal_perms; - allow $1_screen_t self:fifo_file rw_fifo_file_perms; - allow $1_screen_t self:tcp_socket create_stream_socket_perms; - allow $1_screen_t self:udp_socket create_socket_perms; - # Internal screen networking - allow $1_screen_t self:fd use; - allow $1_screen_t self:unix_stream_socket { create_socket_perms connectto }; - allow $1_screen_t self:unix_dgram_socket create_socket_perms; - - manage_dirs_pattern($1_screen_t, screen_tmp_t, screen_tmp_t) - manage_files_pattern($1_screen_t, screen_tmp_t, screen_tmp_t) - manage_fifo_files_pattern($1_screen_t, screen_tmp_t, screen_tmp_t) - files_tmp_filetrans($1_screen_t, screen_tmp_t, { file dir }) - - # Create fifo - manage_fifo_files_pattern($1_screen_t, screen_var_run_t, screen_var_run_t) - manage_dirs_pattern($1_screen_t, screen_var_run_t, screen_var_run_t) - manage_sock_files_pattern($1_screen_t, screen_var_run_t, screen_var_run_t) - files_pid_filetrans($1_screen_t, screen_var_run_t, dir) - - allow $1_screen_t screen_home_t:dir list_dir_perms; - manage_dirs_pattern($1_screen_t, screen_home_t, screen_home_t) - manage_fifo_files_pattern($1_screen_t, screen_home_t, screen_home_t) - userdom_user_home_dir_filetrans($1_screen_t, screen_home_t, dir) - read_files_pattern($1_screen_t, screen_home_t, screen_home_t) - read_lnk_files_pattern($1_screen_t, screen_home_t, screen_home_t) - - allow $1_screen_t $3:process signal; + userdom_home_reader($1_screen_t) domtrans_pattern($3, screen_exec_t, $1_screen_t) allow $3 $1_screen_t:process { signal sigchld }; dontaudit $3 $1_screen_t:unix_stream_socket { read write }; + allow $1_screen_t $3:unix_stream_socket { connectto }; allow $1_screen_t $3:process signal; + ps_process_pattern($1_screen_t, $3) manage_fifo_files_pattern($3, screen_home_t, screen_home_t) manage_dirs_pattern($3, screen_home_t, screen_home_t) @@ -86,77 +57,44 @@ template(`screen_role_template',` relabel_lnk_files_pattern($3, screen_home_t, screen_home_t) manage_dirs_pattern($3, screen_var_run_t, screen_var_run_t) - manage_files_pattern($3, screen_var_run_t, screen_var_run_t) - manage_lnk_files_pattern($3, screen_var_run_t, screen_var_run_t) manage_fifo_files_pattern($3, screen_var_run_t, screen_var_run_t) - kernel_read_system_state($1_screen_t) - kernel_read_kernel_sysctls($1_screen_t) - - corecmd_list_bin($1_screen_t) - corecmd_read_bin_files($1_screen_t) - corecmd_read_bin_symlinks($1_screen_t) - corecmd_read_bin_pipes($1_screen_t) - corecmd_read_bin_sockets($1_screen_t) # Revert to the user domain when a shell is executed. corecmd_shell_domtrans($1_screen_t, $3) corecmd_bin_domtrans($1_screen_t, $3) - corenet_all_recvfrom_unlabeled($1_screen_t) - corenet_all_recvfrom_netlabel($1_screen_t) - corenet_tcp_sendrecv_generic_if($1_screen_t) - corenet_udp_sendrecv_generic_if($1_screen_t) - corenet_tcp_sendrecv_generic_node($1_screen_t) - corenet_udp_sendrecv_generic_node($1_screen_t) - corenet_tcp_sendrecv_all_ports($1_screen_t) - corenet_udp_sendrecv_all_ports($1_screen_t) - corenet_tcp_connect_all_ports($1_screen_t) - - dev_dontaudit_getattr_all_chr_files($1_screen_t) - dev_dontaudit_getattr_all_blk_files($1_screen_t) - # for SSP - dev_read_urand($1_screen_t) - - domain_use_interactive_fds($1_screen_t) - - files_search_tmp($1_screen_t) - files_search_home($1_screen_t) - files_list_home($1_screen_t) - files_read_usr_files($1_screen_t) - files_read_etc_files($1_screen_t) - - fs_search_auto_mountpoints($1_screen_t) - fs_getattr_xattr_fs($1_screen_t) - auth_domtrans_chk_passwd($1_screen_t) auth_use_nsswitch($1_screen_t) - auth_dontaudit_read_shadow($1_screen_t) - auth_dontaudit_exec_utempter($1_screen_t) - - # Write to utmp. - init_rw_utmp($1_screen_t) logging_send_syslog_msg($1_screen_t) - miscfiles_read_localization($1_screen_t) - - seutil_read_config($1_screen_t) - - userdom_use_user_terminals($1_screen_t) - userdom_create_user_pty($1_screen_t) userdom_user_home_domtrans($1_screen_t, $3) - userdom_setattr_user_ptys($1_screen_t) - userdom_setattr_user_ttys($1_screen_t) + userdom_manage_tmp_role($2, $1_screen_t) tunable_policy(`use_samba_home_dirs',` fs_cifs_domtrans($1_screen_t, $3) - fs_read_cifs_symlinks($1_screen_t) - fs_list_cifs($1_screen_t) ') tunable_policy(`use_nfs_home_dirs',` fs_nfs_domtrans($1_screen_t, $3) - fs_list_nfs($1_screen_t) - fs_read_nfs_symlinks($1_screen_t) ') ') + +####################################### +## +## Execute the rssh program +## in the caller domain. +## +## +## +## Domain allowed access. +## +## +# +interface(`screen_exec',` + gen_require(` + type screen_exec_t; + ') + + can_exec($1, screen_exec_t) +') diff --git a/screen.te b/screen.te index 2583626..d1280bf 100644 --- a/screen.te +++ b/screen.te @@ -5,6 +5,8 @@ policy_module(screen, 2.5.0) # Declarations # +attribute screen_domain; + type screen_exec_t; application_executable_file(screen_exec_t) @@ -13,13 +15,85 @@ typealias screen_home_t alias { user_screen_home_t staff_screen_home_t sysadm_sc typealias screen_home_t alias { auditadm_screen_home_t secadm_screen_home_t }; userdom_user_home_content(screen_home_t) -type screen_tmp_t; -typealias screen_tmp_t alias { user_screen_tmp_t staff_screen_tmp_t sysadm_screen_tmp_t }; -typealias screen_tmp_t alias { auditadm_screen_tmp_t secadm_screen_tmp_t }; -userdom_user_tmp_file(screen_tmp_t) - type screen_var_run_t; typealias screen_var_run_t alias { user_screen_var_run_t staff_screen_var_run_t sysadm_screen_var_run_t }; typealias screen_var_run_t alias { auditadm_screen_var_run_t secadm_screen_var_run_t screen_dir_t }; files_pid_file(screen_var_run_t) ubac_constrained(screen_var_run_t) + +######################################## +# +# Local policy +# + +allow screen_domain self:capability { setuid setgid fsetid }; +allow screen_domain self:process signal_perms; +allow screen_domain self:fifo_file rw_fifo_file_perms; +allow screen_domain self:tcp_socket create_stream_socket_perms; +allow screen_domain self:udp_socket create_socket_perms; +# Internal screen networking +allow screen_domain self:fd use; +allow screen_domain self:unix_stream_socket { create_socket_perms connectto }; +allow screen_domain self:unix_dgram_socket create_socket_perms; + +# Create fifo +manage_fifo_files_pattern(screen_domain, screen_var_run_t, screen_var_run_t) +manage_dirs_pattern(screen_domain, screen_var_run_t, screen_var_run_t) +manage_sock_files_pattern(screen_domain, screen_var_run_t, screen_var_run_t) +files_pid_filetrans(screen_domain, screen_var_run_t, dir) + +allow screen_domain screen_home_t:dir list_dir_perms; +manage_dirs_pattern(screen_domain, screen_home_t, screen_home_t) +manage_fifo_files_pattern(screen_domain, screen_home_t, screen_home_t) +userdom_user_home_dir_filetrans(screen_domain, screen_home_t, dir) +userdom_admin_home_dir_filetrans(screen_domain, screen_home_t, dir) +read_files_pattern(screen_domain, screen_home_t, screen_home_t) +read_lnk_files_pattern(screen_domain, screen_home_t, screen_home_t) + +kernel_read_system_state(screen_domain) +kernel_read_kernel_sysctls(screen_domain) + +corecmd_list_bin(screen_domain) +corecmd_read_bin_files(screen_domain) +corecmd_read_bin_symlinks(screen_domain) +corecmd_read_bin_pipes(screen_domain) +corecmd_read_bin_sockets(screen_domain) + +corenet_tcp_sendrecv_generic_if(screen_domain) +corenet_udp_sendrecv_generic_if(screen_domain) +corenet_tcp_sendrecv_generic_node(screen_domain) +corenet_udp_sendrecv_generic_node(screen_domain) +corenet_tcp_sendrecv_all_ports(screen_domain) +corenet_udp_sendrecv_all_ports(screen_domain) +corenet_tcp_connect_all_ports(screen_domain) + +dev_dontaudit_getattr_all_chr_files(screen_domain) +dev_dontaudit_getattr_all_blk_files(screen_domain) +# for SSP +dev_read_urand(screen_domain) + +domain_sigchld_interactive_fds(screen_domain) +domain_use_interactive_fds(screen_domain) +domain_read_all_domains_state(screen_domain) + +files_search_tmp(screen_domain) +files_search_home(screen_domain) +files_list_home(screen_domain) +files_read_usr_files(screen_domain) +files_read_etc_files(screen_domain) + +fs_search_auto_mountpoints(screen_domain) +fs_getattr_xattr_fs(screen_domain) + +auth_dontaudit_read_shadow(screen_domain) +auth_dontaudit_exec_utempter(screen_domain) + +# Write to utmp. +init_rw_utmp(screen_domain) + +seutil_read_config(screen_domain) + +userdom_use_user_terminals(screen_domain) +userdom_create_user_pty(screen_domain) +userdom_setattr_user_ptys(screen_domain) +userdom_setattr_user_ttys(screen_domain) diff --git a/sectoolm.fc b/sectoolm.fc index 1ed6870..3f1dac5 100644 --- a/sectoolm.fc +++ b/sectoolm.fc @@ -1,4 +1,4 @@ /usr/libexec/sectool-mechanism\.py -- gen_context(system_u:object_r:sectoolm_exec_t,s0) /var/lib/sectool(/.*)? gen_context(system_u:object_r:sectool_var_lib_t,s0) -/var/log/sectool\.log -- gen_context(system_u:object_r:sectool_var_log_t,s0) +/var/log/sectool\.log.* -- gen_context(system_u:object_r:sectool_var_log_t,s0) diff --git a/sectoolm.te b/sectoolm.te index c8ef84b..ffa81dd 100644 --- a/sectoolm.te +++ b/sectoolm.te @@ -7,7 +7,7 @@ policy_module(sectoolm, 1.0.0) type sectoolm_t; type sectoolm_exec_t; -dbus_system_domain(sectoolm_t, sectoolm_exec_t) +init_daemon_domain(sectoolm_t, sectoolm_exec_t) type sectool_var_lib_t; files_type(sectool_var_lib_t) @@ -23,7 +23,7 @@ files_tmp_file(sectool_tmp_t) # sectool local policy # -allow sectoolm_t self:capability { dac_override net_admin sys_nice sys_ptrace }; +allow sectoolm_t self:capability { dac_override net_admin sys_nice }; allow sectoolm_t self:process { getcap getsched signull setsched }; dontaudit sectoolm_t self:process { execstack execmem }; allow sectoolm_t self:fifo_file rw_fifo_file_perms; @@ -70,12 +70,6 @@ application_exec_all(sectoolm_t) auth_use_nsswitch(sectoolm_t) -# tests related to network -hostname_exec(sectoolm_t) - -# tests related to network -iptables_domtrans(sectoolm_t) - libs_exec_ld_so(sectoolm_t) logging_send_syslog_msg(sectoolm_t) @@ -84,6 +78,21 @@ logging_send_syslog_msg(sectoolm_t) sysnet_domtrans_ifconfig(sectoolm_t) userdom_manage_user_tmp_sockets(sectoolm_t) +userdom_dgram_send(sectoolm_t) + +optional_policy(` + dbus_system_domain(sectoolm_t, sectoolm_exec_t) +') + +optional_policy(` + # tests related to network + hostname_exec(sectoolm_t) +') + +optional_policy(` + # tests related to network + iptables_domtrans(sectoolm_t) +') optional_policy(` mount_exec(sectoolm_t) diff --git a/sendmail.fc b/sendmail.fc index a86ec50..ef4199b 100644 --- a/sendmail.fc +++ b/sendmail.fc @@ -1,4 +1,6 @@ +/etc/rc\.d/init\.d/sendmail -- gen_context(system_u:object_r:sendmail_initrc_exec_t,s0) + /var/log/sendmail\.st -- gen_context(system_u:object_r:sendmail_log_t,s0) /var/log/mail(/.*)? gen_context(system_u:object_r:sendmail_log_t,s0) diff --git a/sendmail.if b/sendmail.if index 7e94c7c..ca74cd9 100644 --- a/sendmail.if +++ b/sendmail.if @@ -51,10 +51,24 @@ interface(`sendmail_domtrans',` ') mta_sendmail_domtrans($1, sendmail_t) +') + +####################################### +## +## Execute sendmail in the sendmail domain. +## +## +## +## Domain allowed access. +## +## +# +interface(`sendmail_initrc_domtrans',` + gen_require(` + type sendmail_initrc_exec_t; + ') - allow sendmail_t $1:fd use; - allow sendmail_t $1:fifo_file rw_file_perms; - allow sendmail_t $1:process sigchld; + init_labeled_script_domtrans($1, sendmail_initrc_exec_t) ') ######################################## @@ -152,7 +166,7 @@ interface(`sendmail_rw_unix_stream_sockets',` type sendmail_t; ') - allow $1 sendmail_t:unix_stream_socket { getattr read write ioctl }; + allow $1 sendmail_t:unix_stream_socket rw_socket_perms; ') ######################################## @@ -171,7 +185,7 @@ interface(`sendmail_dontaudit_rw_unix_stream_sockets',` type sendmail_t; ') - dontaudit $1 sendmail_t:unix_stream_socket { getattr read write ioctl }; + dontaudit $1 sendmail_t:unix_stream_socket rw_socket_perms; ') ######################################## @@ -295,3 +309,73 @@ interface(`sendmail_run_unconfined',` sendmail_domtrans_unconfined($1) role $2 types unconfined_sendmail_t; ') + +######################################## +## +## Set the attributes of sendmail pid files. +## +## +## +## Domain allowed access. +## +## +# +interface(`sendmail_setattr_pid_files',` + gen_require(` + type sendmail_var_run_t; + ') + + allow $1 sendmail_var_run_t:file setattr_file_perms; + files_search_pids($1) +') + +######################################## +## +## All of the rules required to administrate +## an sendmail environment +## +## +## +## Domain allowed access. +## +## +## +## +## Role allowed access. +## +## +## +# +interface(`sendmail_admin',` + gen_require(` + type sendmail_t, sendmail_initrc_exec_t, sendmail_log_t; + type sendmail_tmp_t, sendmail_var_run_t, unconfined_sendmail_t; + type mail_spool_t; + ') + + allow $1 sendmail_t:process signal_perms; + ps_process_pattern($1, sendmail_t) + tunable_policy(`deny_ptrace',`',` + allow $1 sendmail_t:process ptrace; + allow $1 unconfined_sendmail_t:process ptrace; + ') + + allow $1 unconfined_sendmail_t:process signal_perms; + ps_process_pattern($1, unconfined_sendmail_t) + + sendmail_initrc_domtrans($1) + domain_system_change_exemption($1) + role_transition $2 sendmail_initrc_exec_t system_r; + + logging_list_logs($1) + admin_pattern($1, sendmail_log_t) + + files_list_tmp($1) + admin_pattern($1, sendmail_tmp_t) + + files_list_pids($1) + admin_pattern($1, sendmail_var_run_t) + + files_list_spool($1) + admin_pattern($1, mail_spool_t) +') diff --git a/sendmail.te b/sendmail.te index 22dac1f..8bc4eff 100644 --- a/sendmail.te +++ b/sendmail.te @@ -19,9 +19,8 @@ mta_sendmail_mailserver(sendmail_t) mta_mailserver_delivery(sendmail_t) mta_mailserver_sender(sendmail_t) -type unconfined_sendmail_t; -application_domain(unconfined_sendmail_t, sendmail_exec_t) -role system_r types unconfined_sendmail_t; +type sendmail_initrc_exec_t; +init_script_file(sendmail_initrc_exec_t) ######################################## # @@ -52,7 +51,6 @@ kernel_read_kernel_sysctls(sendmail_t) # for piping mail to a command kernel_read_system_state(sendmail_t) -corenet_all_recvfrom_unlabeled(sendmail_t) corenet_all_recvfrom_netlabel(sendmail_t) corenet_tcp_sendrecv_generic_if(sendmail_t) corenet_tcp_sendrecv_generic_node(sendmail_t) @@ -79,17 +77,18 @@ corecmd_exec_bin(sendmail_t) domain_use_interactive_fds(sendmail_t) -files_read_etc_files(sendmail_t) files_read_usr_files(sendmail_t) files_search_spool(sendmail_t) # for piping mail to a command files_read_etc_runtime_files(sendmail_t) +files_read_all_tmp_files(sendmail_t) init_use_fds(sendmail_t) init_use_script_ptys(sendmail_t) # sendmail wants to read /var/run/utmp if the controlling tty is /dev/console init_read_utmp(sendmail_t) init_dontaudit_write_utmp(sendmail_t) +init_rw_script_tmp_files(sendmail_t) auth_use_nsswitch(sendmail_t) @@ -100,10 +99,9 @@ logging_send_syslog_msg(sendmail_t) logging_dontaudit_write_generic_logs(sendmail_t) miscfiles_read_generic_certs(sendmail_t) -miscfiles_read_localization(sendmail_t) userdom_dontaudit_use_unpriv_user_fds(sendmail_t) -userdom_dontaudit_search_user_home_dirs(sendmail_t) +userdom_read_user_home_content_files(sendmail_t) mta_read_config(sendmail_t) mta_etc_filetrans_aliases(sendmail_t) @@ -115,6 +113,10 @@ mta_manage_spool(sendmail_t) mta_sendmail_exec(sendmail_t) optional_policy(` + cfengine_dontaudit_write_log(sendmail_t) +') + +optional_policy(` cron_read_pipes(sendmail_t) ') @@ -128,7 +130,14 @@ optional_policy(` ') optional_policy(` + dovecot_write_inherited_tmp_files(sendmail_t) +') + +optional_policy(` exim_domtrans(sendmail_t) + exim_manage_spool_files(sendmail_t) + exim_manage_spool_dirs(sendmail_t) + exim_read_log(sendmail_t) ') optional_policy(` @@ -149,7 +158,14 @@ optional_policy(` ') optional_policy(` + openshift_dontaudit_rw_inherited_fifo_files(sendmail_t) + openshift_rw_inherited_content(sendmail_t) +') + +optional_policy(` + postfix_domtrans_postdrop(sendmail_t) postfix_domtrans_master(sendmail_t) + postfix_domtrans_postqueue(sendmail_t) postfix_read_config(sendmail_t) postfix_search_spool(sendmail_t) ') @@ -168,20 +184,13 @@ optional_policy(` ') optional_policy(` - udev_read_db(sendmail_t) + spamd_stream_connect(sendmail_t) ') optional_policy(` - uucp_domtrans_uux(sendmail_t) + udev_read_db(sendmail_t) ') -######################################## -# -# Unconfined sendmail local policy -# Allow unconfined domain to run newalias and have transitions work -# - optional_policy(` - mta_etc_filetrans_aliases(unconfined_sendmail_t) - unconfined_domain(unconfined_sendmail_t) + uucp_domtrans_uux(sendmail_t) ') diff --git a/sensord.fc b/sensord.fc new file mode 100644 index 0000000..e1ef619 --- /dev/null +++ b/sensord.fc @@ -0,0 +1,5 @@ +/lib/systemd/system/sensord.service -- gen_context(system_u:object_r:sensord_unit_file_t,s0) + +/usr/sbin/sensord -- gen_context(system_u:object_r:sensord_exec_t,s0) + +/var/run/sensord\.pid -- gen_context(system_u:object_r:sensord_var_run_t,s0) diff --git a/sensord.if b/sensord.if new file mode 100644 index 0000000..e3d6190 --- /dev/null +++ b/sensord.if @@ -0,0 +1,80 @@ + +## Sensor information logging daemon + +######################################## +## +## Execute sensord in the sensord domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`sensord_domtrans',` + gen_require(` + type sensord_t, sensord_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, sensord_exec_t, sensord_t) +') +######################################## +## +## Execute sensord server in the sensord domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`sensord_systemctl',` + gen_require(` + type sensord_t; + type sensord_unit_file_t; + ') + + systemd_exec_systemctl($1) + systemd_read_fifo_file_password_run($1) + allow $1 sensord_unit_file_t:file read_file_perms; + allow $1 sensord_unit_file_t:service manage_service_perms; + + ps_process_pattern($1, sensord_t) +') + + +######################################## +## +## All of the rules required to administrate +## an sensord environment +## +## +## +## Domain allowed access. +## +## +## +## +## Role allowed access. +## +## +## +# +interface(`sensord_admin',` + gen_require(` + type sensord_t; + type sensord_unit_file_t; + ') + + allow $1 sensord_t:process { ptrace signal_perms }; + ps_process_pattern($1, sensord_t) + + sensord_systemctl($1) + admin_pattern($1, sensord_unit_file_t) + allow $1 sensord_unit_file_t:service all_service_perms; + optional_policy(` + systemd_passwd_agent_exec($1) + systemd_read_fifo_file_passwd_run($1) + ') +') diff --git a/sensord.te b/sensord.te new file mode 100644 index 0000000..5e92ac9 --- /dev/null +++ b/sensord.te @@ -0,0 +1,35 @@ +policy_module(sensord, 1.0.0) + +######################################## +# +# Declarations +# + +type sensord_t; +type sensord_exec_t; +init_daemon_domain(sensord_t, sensord_exec_t) + +type sensord_unit_file_t; +systemd_unit_file(sensord_unit_file_t) + +type sensord_var_run_t; +files_pid_file(sensord_var_run_t) + +######################################## +# +# sensord local policy +# + +allow sensord_t self:fifo_file rw_fifo_file_perms; +allow sensord_t self:unix_stream_socket create_stream_socket_perms; + +manage_files_pattern(sensord_t, sensord_var_run_t, sensord_var_run_t) +files_pid_filetrans(sensord_t, sensord_var_run_t, { file }) + +domain_use_interactive_fds(sensord_t) + +dev_read_sysfs(sensord_t) + +files_read_etc_files(sensord_t) + +logging_send_syslog_msg(sensord_t) diff --git a/setroubleshoot.if b/setroubleshoot.if index bcdd16c..039b0c8 100644 --- a/setroubleshoot.if +++ b/setroubleshoot.if @@ -2,7 +2,7 @@ ######################################## ## -## Connect to setroubleshootd over an unix stream socket. +## Connect to setroubleshootd over a unix stream socket. ## ## ## @@ -23,7 +23,7 @@ interface(`setroubleshoot_stream_connect',` ######################################## ## ## Dontaudit attempts to connect to setroubleshootd -## over an unix stream socket. +## over a unix stream socket. ## ## ## @@ -105,6 +105,25 @@ interface(`setroubleshoot_dbus_chat_fixit',` ######################################## ## +## Dontaudit read/write to a setroubleshoot leaked sockets. +## +## +## +## Domain to not audit. +## +## +# +interface(`setroubleshoot_fixit_dontaudit_leaks',` + gen_require(` + type setroubleshoot_fixit_t; + ') + + dontaudit $1 setroubleshoot_fixit_t:unix_dgram_socket { read write }; + dontaudit $1 setroubleshoot_fixit_t:unix_stream_socket { read write }; +') + +######################################## +## ## All of the rules required to administrate ## an setroubleshoot environment ## @@ -117,15 +136,18 @@ interface(`setroubleshoot_dbus_chat_fixit',` # interface(`setroubleshoot_admin',` gen_require(` - type setroubleshootd_t, setroubleshoot_log_t; - type setroubleshoot_var_lib_t, setroubleshoot_var_run_t; + type setroubleshootd_t, setroubleshoot_var_log_t, setroubleshoot_var_run_t; + type setroubleshoot_var_lib_t; ') - allow $1 setroubleshootd_t:process { ptrace signal_perms }; + allow $1 setroubleshootd_t:process signal_perms; ps_process_pattern($1, setroubleshootd_t) + tunable_policy(`deny_ptrace',`',` + allow $1 setroubleshootd_t:process ptrace; + ') logging_list_logs($1) - admin_pattern($1, setroubleshoot_log_t) + admin_pattern($1, setroubleshoot_var_log_t) files_list_var_lib($1) admin_pattern($1, setroubleshoot_var_lib_t) diff --git a/setroubleshoot.te b/setroubleshoot.te index 086cd5f..4a59722 100644 --- a/setroubleshoot.te +++ b/setroubleshoot.te @@ -12,7 +12,7 @@ init_daemon_domain(setroubleshootd_t, setroubleshootd_exec_t) type setroubleshoot_fixit_t; type setroubleshoot_fixit_exec_t; -dbus_system_domain(setroubleshoot_fixit_t, setroubleshoot_fixit_exec_t) +init_daemon_domain(setroubleshoot_fixit_t, setroubleshoot_fixit_exec_t) type setroubleshoot_var_lib_t; files_type(setroubleshoot_var_lib_t) @@ -30,8 +30,10 @@ files_pid_file(setroubleshoot_var_run_t) # setroubleshootd local policy # -allow setroubleshootd_t self:capability { dac_override sys_nice sys_tty_config }; +allow setroubleshootd_t self:capability { dac_override sys_nice sys_ptrace sys_tty_config }; allow setroubleshootd_t self:process { getattr getsched setsched sigkill signull signal }; +# if bad library causes setroubleshoot to require these, we want to give it so setroubleshoot can continue to run +allow setroubleshootd_t self:process { execmem execstack }; allow setroubleshootd_t self:fifo_file rw_fifo_file_perms; allow setroubleshootd_t self:tcp_socket create_stream_socket_perms; allow setroubleshootd_t self:unix_stream_socket { create_stream_socket_perms connectto }; @@ -49,19 +51,23 @@ manage_sock_files_pattern(setroubleshootd_t, setroubleshoot_var_log_t, setrouble logging_log_filetrans(setroubleshootd_t, setroubleshoot_var_log_t, { file dir }) # pid file +manage_dirs_pattern(setroubleshootd_t, setroubleshoot_var_run_t, setroubleshoot_var_run_t) manage_files_pattern(setroubleshootd_t, setroubleshoot_var_run_t, setroubleshoot_var_run_t) manage_sock_files_pattern(setroubleshootd_t, setroubleshoot_var_run_t, setroubleshoot_var_run_t) -files_pid_filetrans(setroubleshootd_t, setroubleshoot_var_run_t, { file sock_file }) +files_pid_filetrans(setroubleshootd_t, setroubleshoot_var_run_t, { file sock_file dir }) kernel_read_kernel_sysctls(setroubleshootd_t) kernel_read_system_state(setroubleshootd_t) kernel_read_net_sysctls(setroubleshootd_t) kernel_read_network_state(setroubleshootd_t) +kernel_dontaudit_list_all_proc(setroubleshootd_t) +kernel_read_irq_sysctls(setroubleshootd_t) +kernel_read_unlabeled_state(setroubleshootd_t) corecmd_exec_bin(setroubleshootd_t) corecmd_exec_shell(setroubleshootd_t) +corecmd_read_all_executables(setroubleshootd_t) -corenet_all_recvfrom_unlabeled(setroubleshootd_t) corenet_all_recvfrom_netlabel(setroubleshootd_t) corenet_tcp_sendrecv_generic_if(setroubleshootd_t) corenet_tcp_sendrecv_generic_node(setroubleshootd_t) @@ -74,17 +80,18 @@ dev_read_urand(setroubleshootd_t) dev_read_sysfs(setroubleshootd_t) dev_getattr_all_blk_files(setroubleshootd_t) dev_getattr_all_chr_files(setroubleshootd_t) +dev_getattr_mtrr_dev(setroubleshootd_t) domain_dontaudit_search_all_domains_state(setroubleshootd_t) domain_signull_all_domains(setroubleshootd_t) files_read_usr_files(setroubleshootd_t) -files_read_etc_files(setroubleshootd_t) files_list_all(setroubleshootd_t) files_getattr_all_files(setroubleshootd_t) files_getattr_all_pipes(setroubleshootd_t) files_getattr_all_sockets(setroubleshootd_t) files_read_all_symlinks(setroubleshootd_t) +files_read_mnt_files(setroubleshootd_t) fs_getattr_all_dirs(setroubleshootd_t) fs_getattr_all_files(setroubleshootd_t) @@ -95,6 +102,7 @@ fs_dontaudit_read_cifs_files(setroubleshootd_t) selinux_get_enforce_mode(setroubleshootd_t) selinux_validate_context(setroubleshootd_t) +selinux_read_policy(setroubleshootd_t) term_dontaudit_use_all_ptys(setroubleshootd_t) term_dontaudit_use_all_ttys(setroubleshootd_t) @@ -104,7 +112,8 @@ auth_use_nsswitch(setroubleshootd_t) init_read_utmp(setroubleshootd_t) init_dontaudit_write_utmp(setroubleshootd_t) -miscfiles_read_localization(setroubleshootd_t) +libs_exec_ld_so(setroubleshootd_t) + locallogin_dontaudit_use_fds(setroubleshootd_t) @@ -112,8 +121,6 @@ logging_send_audit_msgs(setroubleshootd_t) logging_send_syslog_msg(setroubleshootd_t) logging_stream_connect_dispatcher(setroubleshootd_t) -modutils_read_module_config(setroubleshootd_t) - seutil_read_config(setroubleshootd_t) seutil_read_file_contexts(setroubleshootd_t) seutil_read_bin_policy(setroubleshootd_t) @@ -121,10 +128,23 @@ seutil_read_bin_policy(setroubleshootd_t) userdom_dontaudit_read_user_home_content_files(setroubleshootd_t) optional_policy(` + locate_read_lib_files(setroubleshootd_t) +') + +optional_policy(` + mock_getattr_lib(setroubleshootd_t) +') + +optional_policy(` + modutils_read_module_config(setroubleshootd_t) +') + +optional_policy(` dbus_system_domain(setroubleshootd_t, setroubleshootd_exec_t) ') optional_policy(` + rpm_exec(setroubleshootd_t) rpm_signull(setroubleshootd_t) rpm_read_db(setroubleshootd_t) rpm_dontaudit_manage_db(setroubleshootd_t) @@ -151,10 +171,14 @@ kernel_read_system_state(setroubleshoot_fixit_t) corecmd_exec_bin(setroubleshoot_fixit_t) corecmd_exec_shell(setroubleshoot_fixit_t) +dev_read_sysfs(setroubleshoot_fixit_t) +dev_read_urand(setroubleshoot_fixit_t) + seutil_domtrans_setfiles(setroubleshoot_fixit_t) +seutil_domtrans_setsebool(setroubleshoot_fixit_t) +seutil_read_module_store(setroubleshoot_fixit_t) files_read_usr_files(setroubleshoot_fixit_t) -files_read_etc_files(setroubleshoot_fixit_t) files_list_tmp(setroubleshoot_fixit_t) auth_use_nsswitch(setroubleshoot_fixit_t) @@ -162,7 +186,16 @@ auth_use_nsswitch(setroubleshoot_fixit_t) logging_send_audit_msgs(setroubleshoot_fixit_t) logging_send_syslog_msg(setroubleshoot_fixit_t) -miscfiles_read_localization(setroubleshoot_fixit_t) +userdom_dontaudit_search_admin_dir(setroubleshoot_fixit_t) +userdom_signull_unpriv_users(setroubleshoot_fixit_t) + +optional_policy(` + dbus_system_domain(setroubleshoot_fixit_t, setroubleshoot_fixit_exec_t) +') + +optional_policy(` + gnome_dontaudit_search_config(setroubleshoot_fixit_t) +') optional_policy(` rpm_signull(setroubleshoot_fixit_t) diff --git a/sge.fc b/sge.fc new file mode 100644 index 0000000..160ddc2 --- /dev/null +++ b/sge.fc @@ -0,0 +1,6 @@ + +/usr/bin/sge_execd -- gen_context(system_u:object_r:sge_execd_exec_t,s0) +/usr/bin/sge_shepherd -- gen_context(system_u:object_r:sge_shepherd_exec_t,s0) + +/var/spool/gridengine(/.*)? gen_context(system_u:object_r:sge_spool_t,s0) + diff --git a/sge.if b/sge.if new file mode 100644 index 0000000..839f1b3 --- /dev/null +++ b/sge.if @@ -0,0 +1,2 @@ +## Policy for gridengine MPI jobs + diff --git a/sge.te b/sge.te new file mode 100644 index 0000000..faf7c69 --- /dev/null +++ b/sge.te @@ -0,0 +1,197 @@ +policy_module(sge, 1.0.0) + +######################################## +# +# Declarations +# + +## +##

+## Allow sge to access nfs file systems. +##

+## +gen_tunable(sge_use_nfs, false) + +## +##

+## Allow sge to connect to the network using any TCP port +##

+## +gen_tunable(sge_domain_can_network_connect, false) + +attribute sge_domain; + +type sge_execd_t, sge_domain; +type sge_execd_exec_t; +init_daemon_domain(sge_execd_t, sge_execd_exec_t) + +type sge_spool_t; +files_type(sge_spool_t) + +type sge_tmp_t; +files_tmp_file(sge_tmp_t) + +type sge_shepherd_t, sge_domain; +type sge_shepherd_exec_t; +application_domain(sge_shepherd_t, sge_shepherd_exec_t) +role system_r types sge_shepherd_t; + +type sge_job_t, sge_domain; +type sge_job_exec_t; +application_domain(sge_job_t, sge_job_exec_t) +corecmd_shell_entry_type(sge_job_t) +role system_r types sge_job_t; + +####################################### +# +# sge_execd local policy +# + +allow sge_execd_t self:capability { dac_override setuid chown setgid }; +allow sge_execd_t self:process { setsched signal setpgid }; + +allow sge_execd_t sge_shepherd_t:process signal; + +kernel_read_kernel_sysctls(sge_execd_t) + +dev_read_sysfs(sge_execd_t) + +files_exec_usr_files(sge_execd_t) +files_search_spool(sge_execd_t) + +fs_getattr_xattr_fs(sge_execd_t) + +auth_use_nsswitch(sge_execd_t) + +logging_send_syslog_msg(sge_execd_t) + +init_read_utmp(sge_execd_t) + +optional_policy(` + sendmail_domtrans(sge_execd_t) +') + +###################################### +# +# sge_shepherd local policy +# + +allow sge_shepherd_t self:capability { setuid sys_nice chown kill setgid dac_override }; +allow sge_shepherd_t self:process { setsched setrlimit setpgid }; +allow sge_shepherd_t self:process signal_perms; + +domtrans_pattern(sge_execd_t, sge_shepherd_exec_t, sge_shepherd_t) + +kernel_read_sysctl(sge_shepherd_t) +kernel_read_kernel_sysctls(sge_shepherd_t) + +dev_read_sysfs(sge_shepherd_t) + +fs_getattr_all_fs(sge_shepherd_t) + +logging_send_syslog_msg(sge_shepherd_t) + +optional_policy(` + mta_send_mail(sge_shepherd_t) +') + +optional_policy(` + ssh_domtrans(sge_shepherd_t) +') + +optional_policy(` + unconfined_domain(sge_shepherd_t) +') + +##################################### +# +# sge_job local policy +# + +allow sge_shepherd_t sge_job_t:process signal_perms; + +corecmd_shell_domtrans(sge_shepherd_t, sge_job_t) + +kernel_read_kernel_sysctls(sge_job_t) + +term_use_all_terms(sge_job_t) + +logging_send_syslog_msg(sge_job_t) + +optional_policy(` + ssh_basic_client_template(sge_job, sge_job_t, system_r) + ssh_domtrans(sge_job_t) + + allow sge_job_t sge_job_ssh_t:process sigkill; + allow sge_shepherd_t sge_job_ssh_t:process sigkill; + + xserver_exec_xauth(sge_job_ssh_t) + + tunable_policy(`sge_use_nfs',` + fs_list_auto_mountpoints(sge_job_ssh_t) + fs_manage_nfs_dirs(sge_job_ssh_t) + fs_manage_nfs_files(sge_job_ssh_t) + fs_read_nfs_symlinks(sge_job_ssh_t) + ') + ') + +optional_policy(` + xserver_domtrans_xauth(sge_job_t) +') + +optional_policy(` + unconfined_domain(sge_job_t) +') + +##################################### +# +# sge_domain local policy +# + +allow sge_domain self:fifo_file rw_fifo_file_perms; +allow sge_domain self:tcp_socket create_stream_socket_perms; + +manage_dirs_pattern(sge_domain, sge_spool_t, sge_spool_t) +manage_files_pattern(sge_domain, sge_spool_t, sge_spool_t) +manage_lnk_files_pattern(sge_domain, sge_spool_t, sge_spool_t) + +manage_files_pattern(sge_domain, sge_tmp_t, sge_tmp_t) +manage_dirs_pattern(sge_domain, sge_tmp_t, sge_tmp_t) +files_tmp_filetrans(sge_domain, sge_tmp_t, { file dir }) + +kernel_read_network_state(sge_domain) +kernel_read_system_state(sge_domain) + +corecmd_exec_bin(sge_domain) +corecmd_exec_shell(sge_domain) + +domain_read_all_domains_state(sge_domain) + +files_read_etc_files(sge_domain) +files_read_usr_files(sge_domain) + +dev_read_urand(sge_domain) + +tunable_policy(`sge_domain_can_network_connect',` + corenet_tcp_connect_all_ports(sge_domain) +') + +tunable_policy(`sge_use_nfs',` + fs_list_auto_mountpoints(sge_domain) + fs_manage_nfs_dirs(sge_domain) + fs_manage_nfs_files(sge_domain) + fs_read_nfs_symlinks(sge_domain) + fs_exec_nfs_files(sge_domain) +') + +optional_policy(` + sysnet_dns_name_resolve(sge_domain) +') + +optional_policy(` + hostname_exec(sge_domain) +') + +optional_policy(` + nslcd_stream_connect(sge_domain) +') diff --git a/shorewall.fc b/shorewall.fc index 48d1363..4a5b930 100644 --- a/shorewall.fc +++ b/shorewall.fc @@ -7,6 +7,9 @@ /sbin/shorewall6? -- gen_context(system_u:object_r:shorewall_exec_t,s0) /sbin/shorewall-lite -- gen_context(system_u:object_r:shorewall_exec_t,s0) +/usr/sbin/shorewall6? -- gen_context(system_u:object_r:shorewall_exec_t,s0) +/usr/sbin/shorewall-lite -- gen_context(system_u:object_r:shorewall_exec_t,s0) + /var/lib/shorewall(/.*)? gen_context(system_u:object_r:shorewall_var_lib_t,s0) /var/lib/shorewall6(/.*)? gen_context(system_u:object_r:shorewall_var_lib_t,s0) /var/lib/shorewall-lite(/.*)? gen_context(system_u:object_r:shorewall_var_lib_t,s0) diff --git a/shorewall.if b/shorewall.if index 781ad7e..d5ce40a 100644 --- a/shorewall.if +++ b/shorewall.if @@ -55,28 +55,9 @@ interface(`shorewall_read_config',` read_files_pattern($1, shorewall_etc_t, shorewall_etc_t) ') -####################################### -## -## Read shorewall PID files. -## -## -## -## Domain allowed access. -## -## -# -interface(`shorewall_read_pid_files',` - gen_require(` - type shorewall_var_run_t; - ') - - files_search_pids($1) - read_files_pattern($1, shorewall_var_run_t, shorewall_var_run_t) -') - -####################################### +###################################### ## -## Read and write shorewall PID files. +## Read shorewall /var/lib files. ## ## ## @@ -84,28 +65,9 @@ interface(`shorewall_read_pid_files',` ## ## # -interface(`shorewall_rw_pid_files',` - gen_require(` - type shorewall_var_run_t; - ') - - files_search_pids($1) - rw_files_pattern($1, shorewall_var_run_t, shorewall_var_run_t) -') - -###################################### -## -## Read shorewall /var/lib files. -## -## -## -## Domain allowed access. -## -## -# interface(`shorewall_read_lib_files',` gen_require(` - type shorewall_t; + type shorewall_var_lib_t; ') files_search_var_lib($1) @@ -177,8 +139,11 @@ interface(`shorewall_admin',` type shorewall_tmp_t, shorewall_etc_t; ') - allow $1 shorewall_t:process { ptrace signal_perms }; + allow $1 shorewall_t:process signal_perms; ps_process_pattern($1, shorewall_t) + tunable_policy(`deny_ptrace',`',` + allow $1 shorewall_t:process ptrace; + ') init_labeled_script_domtrans($1, shorewall_initrc_exec_t) domain_system_change_exemption($1) diff --git a/shorewall.te b/shorewall.te index 4723c6b..91229bd 100644 --- a/shorewall.te +++ b/shorewall.te @@ -37,7 +37,7 @@ logging_log_file(shorewall_log_t) # shorewall local policy # -allow shorewall_t self:capability { dac_override net_admin net_raw setuid setgid sys_nice sys_ptrace }; +allow shorewall_t self:capability { dac_override net_admin net_raw setuid setgid sys_nice }; dontaudit shorewall_t self:capability sys_tty_config; allow shorewall_t self:fifo_file rw_fifo_file_perms; @@ -59,6 +59,9 @@ exec_files_pattern(shorewall_t, shorewall_var_lib_t, shorewall_var_lib_t) manage_dirs_pattern(shorewall_t, shorewall_var_lib_t, shorewall_var_lib_t) manage_files_pattern(shorewall_t, shorewall_var_lib_t, shorewall_var_lib_t) files_var_lib_filetrans(shorewall_t, shorewall_var_lib_t, { dir file }) +allow shorewall_t shorewall_var_lib_t:file entrypoint; + +allow shorewall_t shorewall_initrc_exec_t:file read_file_perms; allow shorewall_t shorewall_initrc_exec_t:file read_file_perms; @@ -75,7 +78,6 @@ dev_read_urand(shorewall_t) domain_read_all_domains_state(shorewall_t) files_getattr_kernel_modules(shorewall_t) -files_read_etc_files(shorewall_t) files_read_usr_files(shorewall_t) files_search_kernel_modules(shorewall_t) @@ -83,13 +85,20 @@ fs_getattr_all_fs(shorewall_t) init_rw_utmp(shorewall_t) +logging_read_generic_logs(shorewall_t) logging_send_syslog_msg(shorewall_t) -miscfiles_read_localization(shorewall_t) +auth_use_nsswitch(shorewall_t) sysnet_domtrans_ifconfig(shorewall_t) -userdom_dontaudit_list_user_home_dirs(shorewall_t) +userdom_dontaudit_list_admin_dir(shorewall_t) +userdom_use_inherited_user_ttys(shorewall_t) +userdom_use_inherited_user_ptys(shorewall_t) + +optional_policy(` + brctl_domtrans(shorewall_t) +') optional_policy(` hostname_exec(shorewall_t) diff --git a/shutdown.fc b/shutdown.fc index 97671a3..e317fbe 100644 --- a/shutdown.fc +++ b/shutdown.fc @@ -2,6 +2,10 @@ /lib/upstart/shutdown -- gen_context(system_u:object_r:shutdown_exec_t,s0) -/sbin/shutdown -- gen_context(system_u:object_r:shutdown_exec_t,s0) +/sbin/shutdown -- gen_context(system_u:object_r:shutdown_exec_t,s0) -/var/run/shutdown\.pid -- gen_context(system_u:object_r:shutdown_var_run_t,s0) +/usr/lib/upstart/shutdown -- gen_context(system_u:object_r:shutdown_exec_t,s0) + +/usr/sbin/shutdown -- gen_context(system_u:object_r:shutdown_exec_t,s0) + +/var/run/shutdown\.pid -- gen_context(system_u:object_r:shutdown_var_run_t,s0) diff --git a/shutdown.if b/shutdown.if index d0604cf..b66057c 100644 --- a/shutdown.if +++ b/shutdown.if @@ -18,9 +18,18 @@ interface(`shutdown_domtrans',` corecmd_search_bin($1) domtrans_pattern($1, shutdown_exec_t, shutdown_t) + init_reboot($1) + init_halt($1) + + optional_policy(` + systemd_exec_systemctl($1) + init_stream_connect($1) + systemd_login_reboot($1) + systemd_login_halt($1) + ') + ifdef(`hide_broken_symptoms', ` - dontaudit shutdown_t $1:socket_class_set { read write }; - dontaudit shutdown_t $1:fifo_file { read write }; + dontaudit shutdown_t $1:fifo_file rw_inherited_fifo_file_perms; ') ') @@ -51,6 +60,73 @@ interface(`shutdown_run',` ######################################## ## +## Role access for shutdown +## +## +## +## Role allowed access +## +## +## +## +## User domain for the role +## +## +# +interface(`shutdown_role',` + gen_require(` + type shutdown_t; + ') + + role $1 types shutdown_t; + + shutdown_domtrans($2) + + ps_process_pattern($2, shutdown_t) + allow $2 shutdown_t:process signal; +') + +######################################## +## +## Recieve sigchld from shutdown +## +## +## +## Domain allowed access +## +## +# +interface(`shutdown_send_sigchld',` + gen_require(` + type shutdown_t; + ') + + allow shutdown_t $1:process signal; +') + +######################################## +## +## Send and receive messages from +## shutdown over dbus. +## +## +## +## Domain allowed access. +## +## +# +interface(`shutdown_dbus_chat',` + gen_require(` + type shutdown_t; + class dbus send_msg; + ') + + allow $1 shutdown_t:dbus send_msg; + allow shutdown_t $1:dbus send_msg; +') + +######################################## +## ## Get attributes of shutdown executable. ## ## diff --git a/shutdown.te b/shutdown.te index 8966ec9..2a52a13 100644 --- a/shutdown.te +++ b/shutdown.te @@ -7,6 +7,7 @@ policy_module(shutdown, 1.1.0) type shutdown_t; type shutdown_exec_t; +init_system_domain(shutdown_t, shutdown_exec_t) application_domain(shutdown_t, shutdown_exec_t) role system_r types shutdown_t; @@ -21,8 +22,8 @@ files_pid_file(shutdown_var_run_t) # shutdown local policy # -allow shutdown_t self:capability { dac_override kill setuid sys_tty_config }; -allow shutdown_t self:process { fork signal signull }; +allow shutdown_t self:capability { dac_override kill setuid sys_nice sys_tty_config }; +allow shutdown_t self:process { fork setsched signal signull }; allow shutdown_t self:fifo_file manage_fifo_file_perms; allow shutdown_t self:unix_stream_socket create_stream_socket_perms; @@ -33,25 +34,31 @@ files_etc_filetrans(shutdown_t, shutdown_etc_t, file) manage_files_pattern(shutdown_t, shutdown_var_run_t, shutdown_var_run_t) files_pid_filetrans(shutdown_t, shutdown_var_run_t, file) +kernel_read_system_state(shutdown_t) + domain_use_interactive_fds(shutdown_t) -files_read_etc_files(shutdown_t) files_read_generic_pids(shutdown_t) +files_delete_boot_flag(shutdown_t) + +mls_file_write_to_clearance(shutdown_t) -term_use_all_terms(shutdown_t) +term_use_all_inherited_terms(shutdown_t) auth_use_nsswitch(shutdown_t) auth_write_login_records(shutdown_t) -init_dontaudit_write_utmp(shutdown_t) -init_read_utmp(shutdown_t) +init_rw_utmp(shutdown_t) init_stream_connect(shutdown_t) init_telinit(shutdown_t) logging_search_logs(shutdown_t) logging_send_audit_msgs(shutdown_t) -miscfiles_read_localization(shutdown_t) + +optional_policy(` + cron_system_entry(shutdown_t, shutdown_exec_t) +') optional_policy(` dbus_system_bus_client(shutdown_t) @@ -59,5 +66,15 @@ optional_policy(` ') optional_policy(` + oddjob_dontaudit_rw_fifo_file(shutdown_t) + oddjob_sigchld(shutdown_t) +') + +optional_policy(` + rhev_sigchld_agentd(shutdown_t) +') + +optional_policy(` xserver_dontaudit_write_log(shutdown_t) + xserver_xdm_append_log(shutdown_t) ') diff --git a/slocate.te b/slocate.te index a225c02..b76ed92 100644 --- a/slocate.te +++ b/slocate.te @@ -43,7 +43,6 @@ files_getattr_all_files(locate_t) files_getattr_all_pipes(locate_t) files_getattr_all_sockets(locate_t) files_read_etc_runtime_files(locate_t) -files_read_etc_files(locate_t) fs_getattr_all_fs(locate_t) fs_getattr_all_files(locate_t) @@ -58,7 +57,6 @@ fs_read_noxattr_fs_symlinks(locate_t) # getpwnam auth_use_nsswitch(locate_t) -miscfiles_read_localization(locate_t) ifdef(`enable_mls',` # On MLS machines will not be allowed to getattr Anything but SystemLow diff --git a/slpd.fc b/slpd.fc new file mode 100644 index 0000000..5064a4a --- /dev/null +++ b/slpd.fc @@ -0,0 +1,7 @@ +/etc/rc\.d/init\.d/slpd -- gen_context(system_u:object_r:slpd_initrc_exec_t,s0) + +/usr/sbin/slpd -- gen_context(system_u:object_r:slpd_exec_t,s0) + +/var/log/slpd\.log -- gen_context(system_u:object_r:slpd_var_log_t,s0) + +/var/run/slpd\.pid -- gen_context(system_u:object_r:slpd_var_run_t,s0) diff --git a/slpd.if b/slpd.if new file mode 100644 index 0000000..75931f8 --- /dev/null +++ b/slpd.if @@ -0,0 +1,75 @@ + +## OpenSLP server daemon to dynamically register services. + +######################################## +## +## Transition to slpd. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`slpd_domtrans',` + gen_require(` + type slpd_t, slpd_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, slpd_exec_t, slpd_t) +') + +######################################## +## +## Execute slpd server in the slpd domain. +## +## +## +## Domain allowed access. +## +## +# +interface(`slpd_initrc_domtrans',` + gen_require(` + type slpd_initrc_exec_t; + ') + + init_labeled_script_domtrans($1, slpd_initrc_exec_t) +') + +######################################## +## +## All of the rules required to administrate +## an slpd environment +## +## +## +## Domain allowed access. +## +## +## +## +## Role allowed access. +## +## +## +# +interface(`slpd_admin',` + gen_require(` + type slpd_t; + type slpd_initrc_exec_t; + ') + + allow $1 slpd_t:process { ptrace signal_perms }; + ps_process_pattern($1, slpd_t) + + slpd_initrc_domtrans($1) + domain_system_change_exemption($1) + role_transition $2 slpd_initrc_exec_t system_r; + allow $2 system_r; + optional_policy(` + systemd_passwd_agent_exec($1) + systemd_read_fifo_file_passwd_run($1) + ') +') diff --git a/slpd.te b/slpd.te new file mode 100644 index 0000000..d76b43b --- /dev/null +++ b/slpd.te @@ -0,0 +1,51 @@ +policy_module(slpd, 1.0.0) + +######################################## +# +# Declarations +# + +type slpd_t; +type slpd_exec_t; +init_daemon_domain(slpd_t, slpd_exec_t) + +type slpd_initrc_exec_t; +init_script_file(slpd_initrc_exec_t) + +type slpd_var_log_t; +logging_log_file(slpd_var_log_t) + +type slpd_var_run_t; +files_pid_file(slpd_var_run_t) + +######################################## +# +# slpd local policy +# + +allow slpd_t self:capability { kill setgid setuid }; +allow slpd_t self:process { fork signal }; +allow slpd_t self:fifo_file rw_fifo_file_perms; +allow slpd_t self:tcp_socket { create_socket_perms listen }; +allow slpd_t self:unix_stream_socket create_stream_socket_perms; + +manage_files_pattern(slpd_t, slpd_var_log_t, slpd_var_log_t) +logging_log_filetrans(slpd_t, slpd_var_log_t, { file }) + +manage_files_pattern(slpd_t, slpd_var_run_t, slpd_var_run_t) +files_pid_filetrans(slpd_t, slpd_var_run_t, { file }) + +corenet_all_recvfrom_netlabel(slpd_t) +corenet_tcp_bind_generic_node(slpd_t) +corenet_udp_bind_generic_node(slpd_t) +corenet_tcp_bind_all_ports(slpd_t) +corenet_udp_bind_all_ports(slpd_t) + +domain_use_interactive_fds(slpd_t) + +files_read_etc_files(slpd_t) + +auth_use_nsswitch(slpd_t) + + +sysnet_dns_name_resolve(slpd_t) diff --git a/slrnpull.te b/slrnpull.te index e5e72fd..84936ca 100644 --- a/slrnpull.te +++ b/slrnpull.te @@ -13,7 +13,7 @@ type slrnpull_var_run_t; files_pid_file(slrnpull_var_run_t) type slrnpull_spool_t; -files_type(slrnpull_spool_t) +files_spool_file(slrnpull_spool_t) type slrnpull_log_t; logging_log_file(slrnpull_log_t) @@ -52,8 +52,6 @@ fs_search_auto_mountpoints(slrnpull_t) logging_send_syslog_msg(slrnpull_t) -miscfiles_read_localization(slrnpull_t) - userdom_dontaudit_use_unpriv_user_fds(slrnpull_t) userdom_dontaudit_search_user_home_dirs(slrnpull_t) diff --git a/smartmon.if b/smartmon.if index adea9f9..145adbd 100644 --- a/smartmon.if +++ b/smartmon.if @@ -15,6 +15,7 @@ interface(`smartmon_read_tmp_files',` type fsdaemon_tmp_t; ') + files_search_tmp($1) allow $1 fsdaemon_tmp_t:file read_file_perms; ') @@ -41,8 +42,11 @@ interface(`smartmon_admin',` type fsdaemon_initrc_exec_t; ') - allow $1 fsdaemon_t:process { ptrace signal_perms getattr }; + allow $1 fsdaemon_t:process signal_perms; ps_process_pattern($1, fsdaemon_t) + tunable_policy(`deny_ptrace',`',` + allow $1 smartmon_t:process ptrace; + ') init_labeled_script_domtrans($1, fsdaemon_initrc_exec_t) domain_system_change_exemption($1) diff --git a/smartmon.te b/smartmon.te index 6b3322b..c955ccc 100644 --- a/smartmon.te +++ b/smartmon.te @@ -1,4 +1,4 @@ -policy_module(smartmon, 1.11.0) +policy_module(smartmon, 1.14.0) ######################################## # @@ -35,7 +35,7 @@ ifdef(`enable_mls',` # Local policy # -allow fsdaemon_t self:capability { setpcap setgid sys_rawio sys_admin }; +allow fsdaemon_t self:capability { dac_override kill setpcap setgid sys_rawio sys_admin }; dontaudit fsdaemon_t self:capability sys_tty_config; allow fsdaemon_t self:process { getcap setcap signal_perms }; allow fsdaemon_t self:fifo_file rw_fifo_file_perms; @@ -52,12 +52,12 @@ manage_files_pattern(fsdaemon_t, fsdaemon_var_run_t, fsdaemon_var_run_t) files_pid_filetrans(fsdaemon_t, fsdaemon_var_run_t, file) kernel_read_kernel_sysctls(fsdaemon_t) +kernel_read_network_state(fsdaemon_t) kernel_read_software_raid_state(fsdaemon_t) kernel_read_system_state(fsdaemon_t) corecmd_exec_all_executables(fsdaemon_t) -corenet_all_recvfrom_unlabeled(fsdaemon_t) corenet_all_recvfrom_netlabel(fsdaemon_t) corenet_udp_sendrecv_generic_if(fsdaemon_t) corenet_udp_sendrecv_generic_node(fsdaemon_t) @@ -73,26 +73,36 @@ files_read_etc_runtime_files(fsdaemon_t) files_read_usr_files(fsdaemon_t) # for config files_read_etc_files(fsdaemon_t) +files_read_usr_files(fsdaemon_t) fs_getattr_all_fs(fsdaemon_t) fs_search_auto_mountpoints(fsdaemon_t) +fs_read_removable_files(fsdaemon_t) mls_file_read_all_levels(fsdaemon_t) #mls_rangetrans_target(fsdaemon_t) +storage_create_fixed_disk_dev(fsdaemon_t) +storage_dev_filetrans_named_fixed_disk(fsdaemon_t) storage_raw_read_fixed_disk(fsdaemon_t) storage_raw_write_fixed_disk(fsdaemon_t) storage_raw_read_removable_device(fsdaemon_t) +storage_read_scsi_generic(fsdaemon_t) +storage_write_scsi_generic(fsdaemon_t) term_dontaudit_search_ptys(fsdaemon_t) +application_signull(fsdaemon_t) + +auth_read_passwd(fsdaemon_t) + +init_read_utmp(fsdaemon_t) + libs_exec_ld_so(fsdaemon_t) libs_exec_lib_files(fsdaemon_t) logging_send_syslog_msg(fsdaemon_t) -miscfiles_read_localization(fsdaemon_t) - seutil_sigchld_newrole(fsdaemon_t) sysnet_dns_name_resolve(fsdaemon_t) diff --git a/smokeping.if b/smokeping.if index 8265278..017b923 100644 --- a/smokeping.if +++ b/smokeping.if @@ -153,8 +153,11 @@ interface(`smokeping_admin',` type smokeping_t, smokeping_initrc_exec_t; ') - allow $1 smokeping_t:process { ptrace signal_perms }; + allow $1 smokeping_t:process signal_perms; ps_process_pattern($1, smokeping_t) + tunable_policy(`deny_ptrace',`',` + allow $1 smokeping_t:process ptrace; + ') smokeping_initrc_domtrans($1) domain_system_change_exemption($1) diff --git a/smokeping.te b/smokeping.te index 740994a..9f1f74a 100644 --- a/smokeping.te +++ b/smokeping.te @@ -40,7 +40,6 @@ corecmd_read_bin_symlinks(smokeping_t) dev_read_urand(smokeping_t) -files_read_etc_files(smokeping_t) files_read_usr_files(smokeping_t) files_search_tmp(smokeping_t) @@ -49,8 +48,6 @@ auth_dontaudit_read_shadow(smokeping_t) logging_send_syslog_msg(smokeping_t) -miscfiles_read_localization(smokeping_t) - mta_send_mail(smokeping_t) netutils_domtrans_ping(smokeping_t) @@ -73,5 +70,7 @@ optional_policy(` files_search_tmp(httpd_smokeping_cgi_script_t) files_search_var_lib(httpd_smokeping_cgi_script_t) + auth_read_passwd(httpd_smokeping_cgi_script_t) + sysnet_dns_name_resolve(httpd_smokeping_cgi_script_t) ') diff --git a/smoltclient.te b/smoltclient.te index bc00875..7dd4e53 100644 --- a/smoltclient.te +++ b/smoltclient.te @@ -8,7 +8,6 @@ policy_module(smoltclient, 1.1.0) type smoltclient_t; type smoltclient_exec_t; application_domain(smoltclient_t, smoltclient_exec_t) -cron_system_entry(smoltclient_t, smoltclient_exec_t) type smoltclient_tmp_t; files_tmp_file(smoltclient_tmp_t) @@ -39,20 +38,29 @@ corecmd_exec_shell(smoltclient_t) corenet_tcp_connect_http_port(smoltclient_t) dev_read_sysfs(smoltclient_t) +dev_read_urand(smoltclient_t) fs_getattr_all_fs(smoltclient_t) fs_getattr_all_dirs(smoltclient_t) fs_list_auto_mountpoints(smoltclient_t) files_getattr_generic_locks(smoltclient_t) -files_read_etc_files(smoltclient_t) +files_read_etc_runtime_files(smoltclient_t) files_read_usr_files(smoltclient_t) auth_use_nsswitch(smoltclient_t) logging_send_syslog_msg(smoltclient_t) -miscfiles_read_localization(smoltclient_t) +miscfiles_read_hwdata(smoltclient_t) + +optional_policy(` + abrt_stream_connect(smoltclient_t) +') + +optional_policy(` + cron_system_entry(smoltclient_t, smoltclient_exec_t) +') optional_policy(` dbus_system_bus_client(smoltclient_t) diff --git a/snmp.fc b/snmp.fc index 623c8fa..1ef62d0 100644 --- a/snmp.fc +++ b/snmp.fc @@ -16,9 +16,10 @@ /var/lib/net-snmp(/.*)? gen_context(system_u:object_r:snmpd_var_lib_t,s0) /var/lib/snmp(/.*)? gen_context(system_u:object_r:snmpd_var_lib_t,s0) -/var/log/snmpd\.log -- gen_context(system_u:object_r:snmpd_log_t,s0) +/var/log/snmpd\.log.* -- gen_context(system_u:object_r:snmpd_log_t,s0) -/var/net-snmp(/.*) gen_context(system_u:object_r:snmpd_var_lib_t,s0) +/var/net-snmp(/.*)? gen_context(system_u:object_r:snmpd_var_lib_t,s0) +/var/run/net-snmpd(/.*)? gen_context(system_u:object_r:snmpd_var_run_t,s0) /var/run/snmpd(/.*)? gen_context(system_u:object_r:snmpd_var_run_t,s0) /var/run/snmpd\.pid -- gen_context(system_u:object_r:snmpd_var_run_t,s0) diff --git a/snmp.if b/snmp.if index 275f9fb..f1343b7 100644 --- a/snmp.if +++ b/snmp.if @@ -11,12 +11,12 @@ ## # interface(`snmp_stream_connect',` - gen_require(` + gen_require(` type snmpd_t, snmpd_var_lib_t; - ') + ') - files_search_var_lib($1) - stream_connect_pattern($1, snmpd_var_lib_t, snmpd_var_lib_t, snmpd_t) + files_search_var_lib($1) + stream_connect_pattern($1, snmpd_var_lib_t, snmpd_var_lib_t, snmpd_t) ') ######################################## @@ -62,11 +62,70 @@ interface(`snmp_read_snmp_var_lib_files',` type snmpd_var_lib_t; ') + files_search_var_lib($1) allow $1 snmpd_var_lib_t:dir list_dir_perms; read_files_pattern($1, snmpd_var_lib_t, snmpd_var_lib_t) read_lnk_files_pattern($1, snmpd_var_lib_t, snmpd_var_lib_t) ') +####################################### +## +## Read snmpd libraries directories +## +## +## +## Domain allowed access. +## +## +# +interface(`snmp_read_snmp_var_lib_dirs',` + gen_require(` + type snmpd_var_lib_t; + ') + + files_search_var_lib($1) + allow $1 snmpd_var_lib_t:dir list_dir_perms; +') + +######################################## +## +## Manage snmpd libraries directories +## +## +## +## Domain allowed access. +## +## +# +interface(`snmp_manage_var_lib_dirs',` + gen_require(` + type snmpd_var_lib_t; + ') + + allow $1 snmpd_var_lib_t:dir manage_dir_perms; + files_var_lib_filetrans($1, snmpd_var_lib_t, dir) +') + +######################################## +## +## Manage snmpd libraries. +## +## +## +## Domain allowed access. +## +## +# +interface(`snmp_manage_var_lib_files',` + gen_require(` + type snmpd_var_lib_t; + ') + + files_search_var_lib($1) + allow $1 snmpd_var_lib_t:dir list_dir_perms; + manage_files_pattern($1, snmpd_var_lib_t, snmpd_var_lib_t) +') + ######################################## ## ## dontaudit Read snmpd libraries. @@ -81,9 +140,10 @@ interface(`snmp_dontaudit_read_snmp_var_lib_files',` gen_require(` type snmpd_var_lib_t; ') + dontaudit $1 snmpd_var_lib_t:dir list_dir_perms; dontaudit $1 snmpd_var_lib_t:file read_file_perms; - dontaudit $1 snmpd_var_lib_t:lnk_file { getattr read }; + dontaudit $1 snmpd_var_lib_t:lnk_file read_lnk_file_perms; ') ######################################## @@ -123,13 +183,15 @@ interface(`snmp_dontaudit_write_snmp_var_lib_files',` # interface(`snmp_admin',` gen_require(` - type snmpd_t, snmpd_log_t; + type snmpd_t, snmpd_log_t, snmpd_initrc_exec_t; type snmpd_var_lib_t, snmpd_var_run_t; - type snmpd_initrc_exec_t; ') - allow $1 snmpd_t:process { ptrace signal_perms getattr }; + allow $1 snmpd_t:process signal_perms; ps_process_pattern($1, snmpd_t) + tunable_policy(`deny_ptrace',`',` + allow $1 snmpd_t:process ptrace; + ') init_labeled_script_domtrans($1, snmpd_initrc_exec_t) domain_system_change_exemption($1) diff --git a/snmp.te b/snmp.te index 56f074c..d6c5aec 100644 --- a/snmp.te +++ b/snmp.te @@ -4,6 +4,7 @@ policy_module(snmp, 1.13.0) # # Declarations # + type snmpd_t; type snmpd_exec_t; init_daemon_domain(snmpd_t, snmpd_exec_t) @@ -24,12 +25,14 @@ files_type(snmpd_var_lib_t) # # Local policy # -allow snmpd_t self:capability { chown dac_override kill ipc_lock sys_ptrace net_admin sys_nice sys_tty_config }; + +allow snmpd_t self:capability { chown dac_override kill ipc_lock setgid setuid net_admin sys_nice sys_tty_config sys_ptrace }; + dontaudit snmpd_t self:capability { sys_module sys_tty_config }; allow snmpd_t self:process { signal_perms getsched setsched }; allow snmpd_t self:fifo_file rw_fifo_file_perms; allow snmpd_t self:unix_dgram_socket create_socket_perms; -allow snmpd_t self:unix_stream_socket create_stream_socket_perms; +allow snmpd_t self:unix_stream_socket { create_stream_socket_perms connectto }; allow snmpd_t self:tcp_socket create_stream_socket_perms; allow snmpd_t self:udp_socket connected_stream_socket_perms; @@ -41,23 +44,23 @@ manage_files_pattern(snmpd_t, snmpd_var_lib_t, snmpd_var_lib_t) manage_sock_files_pattern(snmpd_t, snmpd_var_lib_t, snmpd_var_lib_t) files_usr_filetrans(snmpd_t, snmpd_var_lib_t, file) files_var_filetrans(snmpd_t, snmpd_var_lib_t, { file dir sock_file }) -files_var_lib_filetrans(snmpd_t, snmpd_var_lib_t, file) +files_var_lib_filetrans(snmpd_t, snmpd_var_lib_t, { dir file }) +manage_dirs_pattern(snmpd_t, snmpd_var_run_t, snmpd_var_run_t) manage_files_pattern(snmpd_t, snmpd_var_run_t, snmpd_var_run_t) -files_pid_filetrans(snmpd_t, snmpd_var_run_t, file) +files_pid_filetrans(snmpd_t, snmpd_var_run_t, { file dir }) kernel_read_device_sysctls(snmpd_t) kernel_read_kernel_sysctls(snmpd_t) kernel_read_fs_sysctls(snmpd_t) kernel_read_net_sysctls(snmpd_t) -kernel_read_proc_symlinks(snmpd_t) -kernel_read_system_state(snmpd_t) kernel_read_network_state(snmpd_t) +kernel_read_proc_symlinks(snmpd_t) +kernel_read_all_proc(snmpd_t) corecmd_exec_bin(snmpd_t) corecmd_exec_shell(snmpd_t) -corenet_all_recvfrom_unlabeled(snmpd_t) corenet_all_recvfrom_netlabel(snmpd_t) corenet_tcp_sendrecv_generic_if(snmpd_t) corenet_udp_sendrecv_generic_if(snmpd_t) @@ -83,10 +86,8 @@ dev_getattr_usbfs_dirs(snmpd_t) domain_use_interactive_fds(snmpd_t) domain_signull_all_domains(snmpd_t) domain_read_all_domains_state(snmpd_t) -domain_dontaudit_ptrace_all_domains(snmpd_t) domain_exec_all_entry_files(snmpd_t) -files_read_etc_files(snmpd_t) files_read_usr_files(snmpd_t) files_read_etc_runtime_files(snmpd_t) files_search_home(snmpd_t) @@ -94,20 +95,22 @@ files_search_home(snmpd_t) fs_getattr_all_dirs(snmpd_t) fs_getattr_all_fs(snmpd_t) fs_search_auto_mountpoints(snmpd_t) +files_search_all_mountpoints(snmpd_t) storage_dontaudit_read_fixed_disk(snmpd_t) storage_dontaudit_read_removable_device(snmpd_t) +storage_dontaudit_write_removable_device(snmpd_t) auth_use_nsswitch(snmpd_t) -files_list_non_auth_dirs(snmpd_t) +files_list_all(snmpd_t) init_read_utmp(snmpd_t) init_dontaudit_write_utmp(snmpd_t) +# need write to /var/run/systemd/notify +init_write_pid_socket(snmpd_t) logging_send_syslog_msg(snmpd_t) -miscfiles_read_localization(snmpd_t) - seutil_dontaudit_search_config(snmpd_t) sysnet_read_config(snmpd_t) @@ -115,7 +118,7 @@ sysnet_read_config(snmpd_t) userdom_dontaudit_use_unpriv_user_fds(snmpd_t) userdom_dontaudit_search_user_home_dirs(snmpd_t) -ifdef(`distro_redhat', ` +ifdef(`distro_redhat',` optional_policy(` rpm_read_db(snmpd_t) rpm_dontaudit_manage_db(snmpd_t) @@ -131,6 +134,10 @@ optional_policy(` ') optional_policy(` + corosync_stream_connect(snmpd_t) +') + +optional_policy(` cups_read_rw_config(snmpd_t) ') @@ -140,6 +147,10 @@ optional_policy(` ') optional_policy(` + ricci_stream_connect_modclusterd(snmpd_t) +') + +optional_policy(` rpc_search_nfs_state_data(snmpd_t) ') diff --git a/snort.if b/snort.if index c117e8b..0eb909b 100644 --- a/snort.if +++ b/snort.if @@ -41,8 +41,11 @@ interface(`snort_admin',` type snort_etc_t, snort_initrc_exec_t; ') - allow $1 snort_t:process { ptrace signal_perms }; + allow $1 snort_t:process signal_perms; ps_process_pattern($1, snort_t) + tunable_policy(`deny_ptrace',`',` + allow $1 snort_t:process ptrace; + ') init_labeled_script_domtrans($1, snort_initrc_exec_t) domain_system_change_exemption($1) @@ -50,11 +53,11 @@ interface(`snort_admin',` allow $2 system_r; admin_pattern($1, snort_etc_t) - files_search_etc($1) + files_list_etc($1) admin_pattern($1, snort_log_t) - logging_search_logs($1) + logging_list_logs($1) admin_pattern($1, snort_var_run_t) - files_search_pids($1) + files_list_pids($1) ') diff --git a/snort.te b/snort.te index 179bc1b..3dbbcc0 100644 --- a/snort.te +++ b/snort.te @@ -32,17 +32,18 @@ files_pid_file(snort_var_run_t) allow snort_t self:capability { setgid setuid net_admin net_raw dac_override }; dontaudit snort_t self:capability sys_tty_config; allow snort_t self:process signal_perms; -allow snort_t self:netlink_route_socket { bind create getattr nlmsg_read read write }; +allow snort_t self:netlink_route_socket create_netlink_socket_perms; +allow snort_t self:netlink_socket create_socket_perms; allow snort_t self:tcp_socket create_stream_socket_perms; allow snort_t self:udp_socket create_socket_perms; allow snort_t self:packet_socket create_socket_perms; allow snort_t self:socket create_socket_perms; # Snort IPS node. unverified. -allow snort_t self:netlink_firewall_socket { bind create getattr }; +allow snort_t self:netlink_firewall_socket create_socket_perms; allow snort_t snort_etc_t:dir list_dir_perms; allow snort_t snort_etc_t:file read_file_perms; -allow snort_t snort_etc_t:lnk_file { getattr read }; +allow snort_t snort_etc_t:lnk_file read_lnk_file_perms; manage_files_pattern(snort_t, snort_log_t, snort_log_t) create_dirs_pattern(snort_t, snort_log_t, snort_log_t) @@ -63,7 +64,6 @@ kernel_request_load_module(snort_t) kernel_dontaudit_read_system_state(snort_t) kernel_read_network_state(snort_t) -corenet_all_recvfrom_unlabeled(snort_t) corenet_all_recvfrom_netlabel(snort_t) corenet_tcp_sendrecv_generic_if(snort_t) corenet_udp_sendrecv_generic_if(snort_t) @@ -95,8 +95,6 @@ init_read_utmp(snort_t) logging_send_syslog_msg(snort_t) -miscfiles_read_localization(snort_t) - sysnet_read_config(snort_t) # snorts must be able to resolve dns in case it wants to relay to a remote prelude-manager sysnet_dns_name_resolve(snort_t) diff --git a/sosreport.fc b/sosreport.fc index a40478e..050f521 100644 --- a/sosreport.fc +++ b/sosreport.fc @@ -1 +1,3 @@ /usr/sbin/sosreport -- gen_context(system_u:object_r:sosreport_exec_t,s0) + +/.ismount-test-file -- gen_context(system_u:object_r:sosreport_tmp_t,s0) diff --git a/sosreport.if b/sosreport.if index 94c01b5..f64bd93 100644 --- a/sosreport.if +++ b/sosreport.if @@ -106,7 +106,7 @@ interface(`sosreport_append_tmp_files',` type sosreport_tmp_t; ') - append_files_pattern($1, sosreport_tmp_t, sosreport_tmp_t) + allow $1 sosreport_tmp_t:file append_inherited_file_perms; ') ######################################## diff --git a/sosreport.te b/sosreport.te index c6079a5..cb59eff 100644 --- a/sosreport.te +++ b/sosreport.te @@ -21,7 +21,7 @@ files_tmpfs_file(sosreport_tmpfs_t) # sosreport local policy # -allow sosreport_t self:capability { kill net_admin net_raw setuid sys_admin sys_nice sys_ptrace dac_override }; +allow sosreport_t self:capability { kill net_admin net_raw setuid sys_admin sys_nice dac_override }; allow sosreport_t self:process { setsched signull }; allow sosreport_t self:fifo_file rw_fifo_file_perms; allow sosreport_t self:tcp_socket create_stream_socket_perms; @@ -64,7 +64,6 @@ files_getattr_all_sockets(sosreport_t) files_exec_etc_files(sosreport_t) files_list_all(sosreport_t) files_read_config_files(sosreport_t) -files_read_etc_files(sosreport_t) files_read_generic_tmp_files(sosreport_t) files_read_usr_files(sosreport_t) files_read_var_lib_files(sosreport_t) @@ -74,13 +73,17 @@ files_read_all_symlinks(sosreport_t) # for blkid.tab files_manage_etc_runtime_files(sosreport_t) files_etc_filetrans_etc_runtime(sosreport_t, file) +files_root_filetrans(sosreport_t, sosreport_tmp_t, file, ".ismount-test-file") fs_getattr_all_fs(sosreport_t) fs_list_inotifyfs(sosreport_t) +storage_dontaudit_read_fixed_disk(sosreport_t) +storage_dontaudit_read_removable_device(sosreport_t) + # some config files do not have configfile attribute # sosreport needs to read various files on system -files_read_non_auth_files(sosreport_t) +files_read_non_security_files(sosreport_t) auth_use_nsswitch(sosreport_t) init_domtrans_script(sosreport_t) @@ -90,15 +93,11 @@ libs_domtrans_ldconfig(sosreport_t) logging_read_all_logs(sosreport_t) logging_send_syslog_msg(sosreport_t) -miscfiles_read_localization(sosreport_t) - -# needed by modinfo -modutils_read_module_deps(sosreport_t) - sysnet_read_config(sosreport_t) optional_policy(` abrt_manage_pid_files(sosreport_t) + abrt_manage_cache(sosreport_t) ') optional_policy(` @@ -110,6 +109,11 @@ optional_policy(` ') optional_policy(` + # needed by modinfo + modutils_read_module_deps(sosreport_t) +') + +optional_policy(` fstools_domtrans(sosreport_t) ') diff --git a/soundserver.if b/soundserver.if index 93fe7bf..1b07ed4 100644 --- a/soundserver.if +++ b/soundserver.if @@ -33,13 +33,15 @@ interface(`soundserver_tcp_connect',` # interface(`soundserver_admin',` gen_require(` - type soundd_t, soundd_etc_t; + type soundd_t, soundd_etc_t, soundd_initrc_exec_t; type soundd_tmp_t, soundd_var_run_t; - type soundd_initrc_exec_t; ') - allow $1 soundd_t:process { ptrace signal_perms }; + allow $1 soundd_t:process signal_perms; ps_process_pattern($1, soundd_t) + tunable_policy(`deny_ptrace',`',` + allow $1 soundd_t:process ptrace; + ') init_labeled_script_domtrans($1, soundd_initrc_exec_t) domain_system_change_exemption($1) diff --git a/soundserver.te b/soundserver.te index 3217605..e9a4381 100644 --- a/soundserver.te +++ b/soundserver.te @@ -68,7 +68,6 @@ kernel_read_kernel_sysctls(soundd_t) kernel_list_proc(soundd_t) kernel_read_proc_symlinks(soundd_t) -corenet_all_recvfrom_unlabeled(soundd_t) corenet_all_recvfrom_netlabel(soundd_t) corenet_tcp_sendrecv_generic_if(soundd_t) corenet_udp_sendrecv_generic_if(soundd_t) @@ -94,8 +93,6 @@ fs_search_auto_mountpoints(soundd_t) logging_send_syslog_msg(soundd_t) -miscfiles_read_localization(soundd_t) - sysnet_read_config(soundd_t) userdom_dontaudit_use_unpriv_user_fds(soundd_t) diff --git a/spamassassin.fc b/spamassassin.fc index 6b3abf9..3dfa27b 100644 --- a/spamassassin.fc +++ b/spamassassin.fc @@ -1,15 +1,53 @@ -HOME_DIR/\.spamassassin(/.*)? gen_context(system_u:object_r:spamassassin_home_t,s0) +HOME_DIR/\.pyzor(/.*)? gen_context(system_u:object_r:spamc_home_t,s0) +HOME_DIR/\.spamassassin(/.*)? gen_context(system_u:object_r:spamc_home_t,s0) +HOME_DIR/\.spamd(/.*)? gen_context(system_u:object_r:spamc_home_t,s0) +/root/\.pyzor(/.*)? gen_context(system_u:object_r:spamc_home_t,s0) +/root/\.spamassassin(/.*)? gen_context(system_u:object_r:spamc_home_t,s0) +/root/\.spamd(/.*)? gen_context(system_u:object_r:spamc_home_t,s0) + +/etc/rc\.d/init\.d/spamd -- gen_context(system_u:object_r:spamd_initrc_exec_t,s0) +/etc/rc\.d/init\.d/spampd -- gen_context(system_u:object_r:spamd_initrc_exec_t,s0) +/etc/rc\.d/init\.d/mimedefang.* -- gen_context(system_u:object_r:spamd_initrc_exec_t,s0) /usr/bin/sa-learn -- gen_context(system_u:object_r:spamc_exec_t,s0) -/usr/bin/spamassassin -- gen_context(system_u:object_r:spamassassin_exec_t,s0) +/usr/bin/spamassassin -- gen_context(system_u:object_r:spamc_exec_t,s0) /usr/bin/spamc -- gen_context(system_u:object_r:spamc_exec_t,s0) /usr/bin/spamd -- gen_context(system_u:object_r:spamd_exec_t,s0) +/usr/bin/sa-update -- gen_context(system_u:object_r:spamd_update_exec_t,s0) /usr/sbin/spamd -- gen_context(system_u:object_r:spamd_exec_t,s0) +/usr/sbin/spampd -- gen_context(system_u:object_r:spamd_exec_t,s0) +/usr/bin/mimedefang -- gen_context(system_u:object_r:spamd_exec_t,s0) +/usr/bin/mimedefang-multiplexor -- gen_context(system_u:object_r:spamd_exec_t,s0) /var/lib/spamassassin(/.*)? gen_context(system_u:object_r:spamd_var_lib_t,s0) +/var/lib/spamassassin/compiled(/.*)? gen_context(system_u:object_r:spamd_compiled_t,s0) + +/var/log/spamd\.log.* -- gen_context(system_u:object_r:spamd_log_t,s0) +/var/log/mimedefang -- gen_context(system_u:object_r:spamd_log_t,s0) /var/run/spamassassin(/.*)? gen_context(system_u:object_r:spamd_var_run_t,s0) /var/spool/spamassassin(/.*)? gen_context(system_u:object_r:spamd_spool_t,s0) /var/spool/spamd(/.*)? gen_context(system_u:object_r:spamd_spool_t,s0) +/var/spool/spampd(/.*)? gen_context(system_u:object_r:spamd_spool_t,s0) +/var/spool/MD-Quarantine(/.*)? gen_context(system_u:object_r:spamd_var_run_t,s0) +/var/spool/MIMEDefang(/.*)? gen_context(system_u:object_r:spamd_var_run_t,s0) + +/root/\.razor(/.*)? gen_context(system_u:object_r:spamc_home_t,s0) +HOME_DIR/\.razor(/.*)? gen_context(system_u:object_r:spamc_home_t,s0) + +/etc/pyzor(/.*)? gen_context(system_u:object_r:spamd_etc_t, s0) +/etc/razor(/.*)? gen_context(system_u:object_r:spamd_etc_t,s0) +/etc/rc\.d/init\.d/pyzord -- gen_context(system_u:object_r:spamd_initrc_exec_t,s0) + +/usr/bin/razor.* -- gen_context(system_u:object_r:spamc_exec_t,s0) + +/var/lib/pyzord(/.*)? gen_context(system_u:object_r:spamd_var_lib_t,s0) +/var/lib/razor(/.*)? gen_context(system_u:object_r:spamd_var_lib_t,s0) + +/var/log/pyzord\.log.* -- gen_context(system_u:object_r:spamd_log_t,s0) +/var/log/razor-agent\.log.* -- gen_context(system_u:object_r:spamd_log_t,s0) + +/usr/bin/pyzor -- gen_context(system_u:object_r:spamc_exec_t,s0) +/usr/bin/pyzord -- gen_context(system_u:object_r:spamd_exec_t,s0) diff --git a/spamassassin.if b/spamassassin.if index c954f31..82fc7f6 100644 --- a/spamassassin.if +++ b/spamassassin.if @@ -14,6 +14,7 @@ ## User domain for the role ## ## +## # interface(`spamassassin_role',` gen_require(` @@ -25,9 +26,13 @@ interface(`spamassassin_role',` role $1 types { spamc_t spamassassin_t }; domtrans_pattern($2, spamassassin_exec_t, spamassassin_t) + + allow $2 spamassassin_t:process signal_perms; ps_process_pattern($2, spamassassin_t) domtrans_pattern($2, spamc_exec_t, spamc_t) + + allow $2 spamc_t:process signal_perms; ps_process_pattern($2, spamc_t) manage_dirs_pattern($2, spamassassin_home_t, spamassassin_home_t) @@ -55,7 +60,6 @@ interface(`spamassassin_exec',` ') can_exec($1, spamassassin_exec_t) - ') ######################################## @@ -111,6 +115,67 @@ interface(`spamassassin_domtrans_client',` ') domtrans_pattern($1, spamc_exec_t, spamc_t) + allow $1 spamc_exec_t:file ioctl; +') + +######################################## +## +## Send kill signal to spamassassin client +## +## +## +## Domain allowed access. +## +## +# +interface(`spamassassin_kill_client',` + gen_require(` + type spamc_t; + ') + + allow $1 spamc_t:process sigkill; +') + +######################################## +## +## Manage spamc home files. +## +## +## +## Domain allowed access. +## +## +# +interface(`spamassassin_manage_home_client',` + gen_require(` + type spamc_home_t; + ') + + userdom_search_user_home_dirs($1) + manage_dirs_pattern($1, spamc_home_t, spamc_home_t) + manage_files_pattern($1, spamc_home_t, spamc_home_t) + manage_lnk_files_pattern($1, spamc_home_t, spamc_home_t) +') + +######################################## +## +## Read spamc home files. +## +## +## +## Domain allowed access. +## +## +# +interface(`spamassassin_read_home_client',` + gen_require(` + type spamc_home_t; + ') + + userdom_search_user_home_dirs($1) + list_dirs_pattern($1, spamc_home_t, spamc_home_t) + read_files_pattern($1, spamc_home_t, spamc_home_t) + read_lnk_files_pattern($1, spamc_home_t, spamc_home_t) ') ######################################## @@ -166,7 +231,9 @@ interface(`spamassassin_read_lib_files',` ') files_search_var_lib($1) + list_dirs_pattern($1, spamd_var_lib_t, spamd_var_lib_t) read_files_pattern($1, spamd_var_lib_t, spamd_var_lib_t) + read_lnk_files_pattern($1, spamd_var_lib_t, spamd_var_lib_t) ') ######################################## @@ -204,6 +271,7 @@ interface(`spamassassin_read_spamd_tmp_files',` type spamd_tmp_t; ') + files_search_tmp($1) allow $1 spamd_tmp_t:file read_file_perms; ') @@ -223,5 +291,94 @@ interface(`spamassassin_dontaudit_getattr_spamd_tmp_sockets',` type spamd_tmp_t; ') - dontaudit $1 spamd_tmp_t:sock_file getattr; + dontaudit $1 spamd_tmp_t:sock_file getattr_sock_file_perms; +') + +######################################## +## +## Connect to run spamd. +## +## +## +## Domain allowed to connect. +## +## +# +interface(`spamd_stream_connect',` + gen_require(` + type spamd_t, spamd_var_run_t; + ') + + files_search_pids($1) + stream_connect_pattern($1, spamd_var_run_t, spamd_var_run_t, spamd_t) +') + +######################################## +## +## Read spamd pid files. +## +## +## +## Domain allowed access. +## +## +# +interface(`spamassassin_read_pid_files',` + gen_require(` + type spamd_var_run_t; + ') + + files_search_pids($1) + read_files_pattern($1, spamd_var_run_t, spamd_var_run_t) +') + +######################################## +## +## All of the rules required to administrate +## an spamassassin environment +## +## +## +## Domain allowed access. +## +## +## +## +## The role to be allowed to manage the spamassassin domain. +## +## +## +# +interface(`spamassassin_spamd_admin',` + gen_require(` + type spamd_t, spamd_tmp_t, spamd_log_t; + type spamd_spool_t, spamd_var_lib_t, spamd_var_run_t; + type spamd_initrc_exec_t; + ') + + allow $1 spamd_t:process signal_perms; + ps_process_pattern($1, spamd_t) + tunable_policy(`deny_ptrace',`',` + allow $1 spamd_t:process ptrace; + ') + + init_labeled_script_domtrans($1, spamd_initrc_exec_t) + domain_system_change_exemption($1) + role_transition $2 spamd_initrc_exec_t system_r; + allow $2 system_r; + + files_list_tmp($1) + admin_pattern($1, spamd_tmp_t) + + logging_list_logs($1) + admin_pattern($1, spamd_log_t) + + files_list_spool($1) + admin_pattern($1, spamd_spool_t) + + files_list_var_lib($1) + admin_pattern($1, spamd_var_lib_t) + + files_list_pids($1) + admin_pattern($1, spamd_var_run_t) ') diff --git a/spamassassin.te b/spamassassin.te index 1bbf73b..903a1e6 100644 --- a/spamassassin.te +++ b/spamassassin.te @@ -6,52 +6,41 @@ policy_module(spamassassin, 2.5.0) # ## -##

-## Allow user spamassassin clients to use the network. -##

+##

+## Allow user spamassassin clients to use the network. +##

## gen_tunable(spamassassin_can_network, false) ## -##

-## Allow spamd to read/write user home directories. -##

+##

+## Allow spamd to read/write user home directories. +##

## gen_tunable(spamd_enable_home_dirs, true) -type spamassassin_t; -type spamassassin_exec_t; -typealias spamassassin_t alias { user_spamassassin_t staff_spamassassin_t sysadm_spamassassin_t }; -typealias spamassassin_t alias { auditadm_spamassassin_t secadm_spamassassin_t }; -userdom_user_application_domain(spamassassin_t, spamassassin_exec_t) - -type spamassassin_home_t; -typealias spamassassin_home_t alias { user_spamassassin_home_t staff_spamassassin_home_t sysadm_spamassassin_home_t }; -typealias spamassassin_home_t alias { auditadm_spamassassin_home_t secadm_spamassassin_home_t }; -userdom_user_home_content(spamassassin_home_t) - -type spamassassin_tmp_t; -typealias spamassassin_tmp_t alias { user_spamassassin_tmp_t staff_spamassassin_tmp_t sysadm_spamassassin_tmp_t }; -typealias spamassassin_tmp_t alias { auditadm_spamassassin_tmp_t secadm_spamassassin_tmp_t }; -userdom_user_tmp_file(spamassassin_tmp_t) - -type spamc_t; -type spamc_exec_t; -typealias spamc_t alias { user_spamc_t staff_spamc_t sysadm_spamc_t }; -typealias spamc_t alias { auditadm_spamc_t secadm_spamc_t }; -userdom_user_application_domain(spamc_t, spamc_exec_t) - -type spamc_tmp_t; -typealias spamc_tmp_t alias { user_spamc_tmp_t staff_spamc_tmp_t sysadm_spamc_tmp_t }; -typealias spamc_tmp_t alias { auditadm_spamc_tmp_t secadm_spamc_tmp_t }; -userdom_user_tmp_file(spamc_tmp_t) + +type spamd_update_t; +type spamd_update_exec_t; +application_domain(spamd_update_t, spamd_update_exec_t) +cron_system_entry(spamd_update_t, spamd_update_exec_t) +role system_r types spamd_update_t; type spamd_t; type spamd_exec_t; init_daemon_domain(spamd_t, spamd_exec_t) +type spamd_compiled_t; +files_type(spamd_compiled_t) + +type spamd_initrc_exec_t; +init_script_file(spamd_initrc_exec_t) + +type spamd_log_t; +logging_log_file(spamd_log_t) + type spamd_spool_t; -files_type(spamd_spool_t) +files_spool_file(spamd_spool_t) type spamd_tmp_t; files_tmp_file(spamd_tmp_t) @@ -63,6 +52,89 @@ files_type(spamd_var_lib_t) type spamd_var_run_t; files_pid_file(spamd_var_run_t) +ifdef(`distro_redhat',` + # spamassassin client executable + type spamc_t; + type spamc_exec_t; + application_domain(spamc_t, spamc_exec_t) + role system_r types spamc_t; + + type spamd_etc_t; + files_config_file(spamd_etc_t) + + typealias spamc_exec_t alias spamassassin_exec_t; + typealias spamc_t alias spamassassin_t; + + type spamc_home_t; + userdom_user_home_content(spamc_home_t) + typealias spamc_home_t alias { spamassassin_home_t user_spamassassin_home_t staff_spamassassin_home_t sysadm_spamassassin_home_t }; + typealias spamc_home_t alias { auditadm_spamassassin_home_t secadm_spamassassin_home_t }; + typealias spamc_home_t alias { user_spamc_home_t staff_spamc_home_t sysadm_spamc_home_t }; + typealias spamc_home_t alias { auditadm_spamc_home_t secadm_spamc_home_t }; + + type spamc_tmp_t; + files_tmp_file(spamc_tmp_t) + typealias spamc_tmp_t alias spamassassin_tmp_t; + typealias spamc_tmp_t alias { user_spamassassin_tmp_t staff_spamassassin_tmp_t sysadm_spamassassin_tmp_t }; + typealias spamc_tmp_t alias { auditadm_spamassassin_tmp_t secadm_spamassassin_tmp_t }; + + typealias spamc_tmp_t alias { user_spamc_tmp_t staff_spamc_tmp_t sysadm_spamc_tmp_t }; + typealias spamc_tmp_t alias { auditadm_spamc_tmp_t secadm_spamc_tmp_t }; + typealias spamc_t alias pyzor_t; + typealias spamc_exec_t alias pyzor_exec_t; + typealias spamd_t alias pyzord_t; + typealias spamd_initrc_exec_t alias pyzord_initrc_exec_t; + typealias spamd_exec_t alias pyzord_exec_t; + typealias spamc_tmp_t alias pyzor_tmp_t; + typealias spamd_log_t alias pyzor_log_t; + typealias spamd_log_t alias pyzord_log_t; + typealias spamd_var_lib_t alias pyzor_var_lib_t; + typealias spamd_etc_t alias pyzor_etc_t; + typealias spamc_home_t alias pyzor_home_t; + typealias spamc_home_t alias user_pyzor_home_t; + typealias spamc_t alias razor_t; + typealias spamc_exec_t alias razor_exec_t; + typealias spamd_log_t alias razor_log_t; + typealias spamd_var_lib_t alias razor_var_lib_t; + typealias spamd_etc_t alias razor_etc_t; + typealias spamc_home_t alias razor_home_t; + typealias spamc_home_t alias { user_razor_home_t staff_razor_home_t sysadm_razor_home_t }; + typealias spamc_home_t alias { auditadm_razor_home_t secadm_razor_home_t }; + typealias spamc_tmp_t alias { user_razor_tmp_t staff_razor_tmp_t sysadm_razor_tmp_t }; + typealias spamc_tmp_t alias { auditadm_razor_tmp_t secadm_razor_tmp_t }; +',` + type spamassassin_t; + type spamassassin_exec_t; + typealias spamassassin_t alias { user_spamassassin_t staff_spamassassin_t sysadm_spamassassin_t }; + typealias spamassassin_t alias { auditadm_spamassassin_t secadm_spamassassin_t }; + application_domain(spamassassin_t, spamassassin_exec_t) + ubac_constrained(spamassassin_t) + + type spamassassin_home_t; + typealias spamassassin_home_t alias { user_spamassassin_home_t staff_spamassassin_home_t sysadm_spamassassin_home_t }; + typealias spamassassin_home_t alias { auditadm_spamassassin_home_t secadm_spamassassin_home_t }; + userdom_user_home_content(spamassassin_home_t) + + type spamassassin_tmp_t; + typealias spamassassin_tmp_t alias { user_spamassassin_tmp_t staff_spamassassin_tmp_t sysadm_spamassassin_tmp_t }; + typealias spamassassin_tmp_t alias { auditadm_spamassassin_tmp_t secadm_spamassassin_tmp_t }; + files_tmp_file(spamassassin_tmp_t) + ubac_constrained(spamassassin_tmp_t) + + type spamc_t; + type spamc_exec_t; + typealias spamc_t alias { user_spamc_t staff_spamc_t sysadm_spamc_t }; + typealias spamc_t alias { auditadm_spamc_t secadm_spamc_t }; + application_domain(spamc_t, spamc_exec_t) + ubac_constrained(spamc_t) + + type spamc_tmp_t; + typealias spamc_tmp_t alias { user_spamc_tmp_t staff_spamc_tmp_t sysadm_spamc_tmp_t }; + typealias spamc_tmp_t alias { auditadm_spamc_tmp_t secadm_spamc_tmp_t }; + files_tmp_file(spamc_tmp_t) + ubac_constrained(spamc_tmp_t) +') + ############################## # # Standalone program local policy @@ -98,12 +170,14 @@ manage_lnk_files_pattern(spamd_t, spamassassin_home_t, spamassassin_home_t) manage_fifo_files_pattern(spamd_t, spamassassin_home_t, spamassassin_home_t) manage_sock_files_pattern(spamd_t, spamassassin_home_t, spamassassin_home_t) userdom_user_home_dir_filetrans(spamd_t, spamassassin_home_t, { dir file lnk_file sock_file fifo_file }) +userdom_home_manager(spamassassin_t) kernel_read_kernel_sysctls(spamassassin_t) dev_read_urand(spamassassin_t) fs_search_auto_mountpoints(spamassassin_t) +fs_getattr_all_fs(spamassassin_t) # this should probably be removed corecmd_list_bin(spamassassin_t) @@ -114,7 +188,6 @@ corecmd_read_bin_sockets(spamassassin_t) domain_use_interactive_fds(spamassassin_t) -files_read_etc_files(spamassassin_t) files_read_etc_runtime_files(spamassassin_t) files_list_home(spamassassin_t) files_read_usr_files(spamassassin_t) @@ -122,8 +195,6 @@ files_dontaudit_search_var(spamassassin_t) logging_send_syslog_msg(spamassassin_t) -miscfiles_read_localization(spamassassin_t) - # cjp: this could probably be removed seutil_read_config(spamassassin_t) @@ -134,8 +205,6 @@ tunable_policy(`spamassassin_can_network',` allow spamassassin_t self:tcp_socket create_stream_socket_perms; allow spamassassin_t self:udp_socket create_socket_perms; - corenet_all_recvfrom_unlabeled(spamassassin_t) - corenet_all_recvfrom_netlabel(spamassassin_t) corenet_tcp_sendrecv_generic_if(spamassassin_t) corenet_udp_sendrecv_generic_if(spamassassin_t) corenet_tcp_sendrecv_generic_node(spamassassin_t) @@ -144,6 +213,9 @@ tunable_policy(`spamassassin_can_network',` corenet_udp_sendrecv_all_ports(spamassassin_t) corenet_tcp_connect_all_ports(spamassassin_t) corenet_sendrecv_all_client_packets(spamassassin_t) + corenet_udp_bind_generic_node(spamassassin_t) + corenet_udp_bind_generic_port(spamassassin_t) + corenet_dontaudit_udp_bind_all_ports(spamassassin_t) sysnet_read_config(spamassassin_t) ') @@ -154,25 +226,13 @@ tunable_policy(`spamd_enable_home_dirs',` userdom_manage_user_home_content_symlinks(spamd_t) ') -tunable_policy(`use_nfs_home_dirs',` - fs_manage_nfs_dirs(spamassassin_t) - fs_manage_nfs_files(spamassassin_t) - fs_manage_nfs_symlinks(spamassassin_t) -') - -tunable_policy(`use_samba_home_dirs',` - fs_manage_cifs_dirs(spamassassin_t) - fs_manage_cifs_files(spamassassin_t) - fs_manage_cifs_symlinks(spamassassin_t) -') - optional_policy(` # Write pid file and socket in ~/.evolution/cache/tmp evolution_home_filetrans(spamd_t, spamd_tmp_t, { file sock_file }) ') optional_policy(` - tunable_policy(`spamassassin_can_network && allow_ypbind',` + tunable_policy(`spamassassin_can_network && nis_enabled',` nis_use_ypbind_uncond(spamassassin_t) ') ') @@ -180,6 +240,8 @@ optional_policy(` optional_policy(` mta_read_config(spamassassin_t) sendmail_stub(spamassassin_t) + sendmail_dontaudit_rw_unix_stream_sockets(spamassassin_t) + sendmail_dontaudit_rw_tcp_sockets(spamassassin_t) ') ######################################## @@ -202,17 +264,37 @@ allow spamc_t self:unix_stream_socket connectto; allow spamc_t self:tcp_socket create_stream_socket_perms; allow spamc_t self:udp_socket create_socket_perms; +can_exec(spamc_t, spamc_exec_t) + manage_dirs_pattern(spamc_t, spamc_tmp_t, spamc_tmp_t) manage_files_pattern(spamc_t, spamc_tmp_t, spamc_tmp_t) files_tmp_filetrans(spamc_t, spamc_tmp_t, { file dir }) +manage_dirs_pattern(spamc_t, spamc_home_t, spamc_home_t) +manage_files_pattern(spamc_t, spamc_home_t, spamc_home_t) +manage_lnk_files_pattern(spamc_t, spamc_home_t, spamc_home_t) +manage_fifo_files_pattern(spamc_t, spamc_home_t, spamc_home_t) +manage_sock_files_pattern(spamc_t, spamc_home_t, spamc_home_t) +userdom_user_home_dir_filetrans(spamc_t, spamc_home_t, { dir file lnk_file sock_file fifo_file }) +userdom_append_user_home_content_files(spamc_t) +# for /root/.pyzor +allow spamc_t self:capability dac_override; +userdom_admin_home_dir_filetrans(spamc_t, spamc_home_t , dir, ".pyzor") + +list_dirs_pattern(spamc_t, spamd_var_lib_t, spamd_var_lib_t) +read_files_pattern(spamc_t, spamd_var_lib_t, spamd_var_lib_t) + # Allow connecting to a local spamd allow spamc_t spamd_t:unix_stream_socket connectto; allow spamc_t spamd_tmp_t:sock_file rw_sock_file_perms; +spamd_stream_connect(spamc_t) +allow spamc_t spamd_tmp_t:file read_inherited_file_perms; kernel_read_kernel_sysctls(spamc_t) +kernel_read_system_state(spamc_t) + +corecmd_exec_bin(spamc_t) -corenet_all_recvfrom_unlabeled(spamc_t) corenet_all_recvfrom_netlabel(spamc_t) corenet_tcp_sendrecv_generic_if(spamc_t) corenet_udp_sendrecv_generic_if(spamc_t) @@ -222,6 +304,7 @@ corenet_tcp_sendrecv_all_ports(spamc_t) corenet_udp_sendrecv_all_ports(spamc_t) corenet_tcp_connect_all_ports(spamc_t) corenet_sendrecv_all_client_packets(spamc_t) +corenet_tcp_connect_spamd_port(spamc_t) fs_search_auto_mountpoints(spamc_t) @@ -234,21 +317,24 @@ corecmd_read_bin_sockets(spamc_t) domain_use_interactive_fds(spamc_t) -files_read_etc_files(spamc_t) files_read_etc_runtime_files(spamc_t) files_read_usr_files(spamc_t) files_dontaudit_search_var(spamc_t) # cjp: this may be removable: files_list_home(spamc_t) +files_list_var_lib(spamc_t) + +fs_search_auto_mountpoints(spamc_t) logging_send_syslog_msg(spamc_t) -miscfiles_read_localization(spamc_t) +auth_use_nsswitch(spamc_t) -# cjp: this should probably be removed: -seutil_read_config(spamc_t) +userdom_home_manager(spamc_t) -sysnet_read_config(spamc_t) +optional_policy(` + abrt_stream_connect(spamc_t) +') optional_policy(` # Allow connection to spamd socket above @@ -256,21 +342,23 @@ optional_policy(` ') optional_policy(` - # Needed for pyzor/razor called from spamd milter_manage_spamass_state(spamc_t) ') optional_policy(` - nis_use_ypbind(spamc_t) -') - -optional_policy(` - nscd_socket_use(spamc_t) + postfix_domtrans_postdrop(spamc_t) + postfix_search_spool(spamc_t) + postfix_rw_local_pipes(spamc_t) + postfix_rw_master_pipes(spamc_t) ') optional_policy(` + mta_send_mail(spamc_t) mta_read_config(spamc_t) + mta_read_queue(spamc_t) sendmail_stub(spamc_t) + sendmail_rw_pipes(spamc_t) + sendmail_dontaudit_rw_tcp_sockets(spamc_t) ') ######################################## @@ -282,7 +370,7 @@ optional_policy(` # setuids to the user running spamc. Comment this if you are not # using this ability. -allow spamd_t self:capability { setuid setgid dac_override sys_tty_config }; +allow spamd_t self:capability { kill setuid setgid dac_override sys_tty_config }; dontaudit spamd_t self:capability sys_tty_config; allow spamd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; allow spamd_t self:fd use; @@ -298,10 +386,17 @@ allow spamd_t self:unix_dgram_socket sendto; allow spamd_t self:unix_stream_socket connectto; allow spamd_t self:tcp_socket create_stream_socket_perms; allow spamd_t self:udp_socket create_socket_perms; -allow spamd_t self:netlink_route_socket r_netlink_socket_perms; + +can_exec(spamd_t, spamd_compiled_t) +manage_dirs_pattern(spamd_t, spamd_compiled_t, spamd_compiled_t) +manage_files_pattern(spamd_t, spamd_compiled_t, spamd_compiled_t) + +manage_files_pattern(spamd_t, spamd_log_t, spamd_log_t) +logging_log_filetrans(spamd_t, spamd_log_t, file) manage_dirs_pattern(spamd_t, spamd_spool_t, spamd_spool_t) manage_files_pattern(spamd_t, spamd_spool_t, spamd_spool_t) +manage_sock_files_pattern(spamd_t, spamd_spool_t, spamd_spool_t) files_spool_filetrans(spamd_t, spamd_spool_t, { file dir }) manage_dirs_pattern(spamd_t, spamd_tmp_t, spamd_tmp_t) @@ -310,16 +405,21 @@ files_tmp_filetrans(spamd_t, spamd_tmp_t, { file dir }) # var/lib files for spamd allow spamd_t spamd_var_lib_t:dir list_dir_perms; -read_files_pattern(spamd_t, spamd_var_lib_t, spamd_var_lib_t) +manage_files_pattern(spamd_t, spamd_var_lib_t, spamd_var_lib_t) +manage_lnk_files_pattern(spamd_t, spamd_var_lib_t, spamd_var_lib_t) manage_dirs_pattern(spamd_t, spamd_var_run_t, spamd_var_run_t) manage_files_pattern(spamd_t, spamd_var_run_t, spamd_var_run_t) -files_pid_filetrans(spamd_t, spamd_var_run_t, { dir file }) +manage_sock_files_pattern(spamd_t, spamd_var_run_t, spamd_var_run_t) +files_pid_filetrans(spamd_t, spamd_var_run_t, { file dir }) + +read_files_pattern(spamd_t, spamc_home_t, spamc_home_t) + +can_exec(spamd_t, spamd_exec_t) kernel_read_all_sysctls(spamd_t) kernel_read_system_state(spamd_t) -corenet_all_recvfrom_unlabeled(spamd_t) corenet_all_recvfrom_netlabel(spamd_t) corenet_tcp_sendrecv_generic_if(spamd_t) corenet_udp_sendrecv_generic_if(spamd_t) @@ -356,30 +456,30 @@ corecmd_exec_bin(spamd_t) domain_use_interactive_fds(spamd_t) files_read_usr_files(spamd_t) -files_read_etc_files(spamd_t) files_read_etc_runtime_files(spamd_t) # /var/lib/spamassin files_read_var_lib_files(spamd_t) init_dontaudit_rw_utmp(spamd_t) -logging_send_syslog_msg(spamd_t) +auth_use_nsswitch(spamd_t) -miscfiles_read_localization(spamd_t) +libs_use_ld_so(spamd_t) +libs_use_shared_libs(spamd_t) -sysnet_read_config(spamd_t) -sysnet_use_ldap(spamd_t) -sysnet_dns_name_resolve(spamd_t) +logging_send_syslog_msg(spamd_t) userdom_use_unpriv_users_fds(spamd_t) userdom_search_user_home_dirs(spamd_t) +userdom_home_manager(spamd_t) -tunable_policy(`use_nfs_home_dirs',` - fs_manage_nfs_files(spamd_t) +optional_policy(` + clamav_stream_connect(spamd_t) ') -tunable_policy(`use_samba_home_dirs',` - fs_manage_cifs_files(spamd_t) +optional_policy(` + exim_manage_spool_dirs(spamd_t) + exim_manage_spool_files(spamd_t) ') optional_policy(` @@ -395,7 +495,9 @@ optional_policy(` ') optional_policy(` + dcc_domtrans_cdcc(spamd_t) dcc_domtrans_client(spamd_t) + dcc_signal_client(spamd_t) dcc_stream_connect_dccifd(spamd_t) ') @@ -404,25 +506,17 @@ optional_policy(` ') optional_policy(` - corenet_tcp_connect_mysqld_port(spamd_t) - corenet_sendrecv_mysqld_client_packets(spamd_t) - + mysql_tcp_connect(spamd_t) mysql_search_db(spamd_t) mysql_stream_connect(spamd_t) ') optional_policy(` - nis_use_ypbind(spamd_t) -') - -optional_policy(` postfix_read_config(spamd_t) ') optional_policy(` - corenet_tcp_connect_postgresql_port(spamd_t) - corenet_sendrecv_postgresql_client_packets(spamd_t) - + postgresql_tcp_connect(spamd_t) postgresql_stream_connect(spamd_t) ') @@ -433,6 +527,10 @@ optional_policy(` optional_policy(` razor_domtrans(spamd_t) + razor_read_lib_files(spamd_t) + tunable_policy(`spamd_enable_home_dirs',` + razor_manage_user_home_files(spamd_t) + ') ') optional_policy(` @@ -440,6 +538,7 @@ optional_policy(` ') optional_policy(` + mta_send_mail(spamd_t) sendmail_stub(spamd_t) mta_read_config(spamd_t) ') @@ -447,3 +546,49 @@ optional_policy(` optional_policy(` udev_read_db(spamd_t) ') + +######################################## +# +# spamd_update local policy +# + +allow spamd_update_t self:fifo_file manage_fifo_file_perms; +allow spamd_update_t self:unix_stream_socket create_stream_socket_perms; +dontaudit spamd_update_t self:capability dac_override; + +manage_dirs_pattern(spamd_update_t, spamd_tmp_t, spamd_tmp_t) +manage_files_pattern(spamd_update_t, spamd_tmp_t, spamd_tmp_t) +files_tmp_filetrans(spamd_update_t, spamd_tmp_t, { file dir }) + +allow spamd_update_t spamd_var_lib_t:dir list_dir_perms; +manage_files_pattern(spamd_update_t, spamd_var_lib_t, spamd_var_lib_t) +manage_lnk_files_pattern(spamd_update_t, spamd_var_lib_t, spamd_var_lib_t) + +allow spamd_update_t spamd_tmp_t:file read_file_perms; + +kernel_read_system_state(spamd_update_t) + +# for updating rules +corenet_tcp_connect_http_port(spamd_update_t) + +corecmd_exec_bin(spamd_update_t) +corecmd_exec_shell(spamd_update_t) + +dev_read_urand(spamd_update_t) + +domain_use_interactive_fds(spamd_update_t) + +files_read_usr_files(spamd_update_t) + +auth_use_nsswitch(spamd_update_t) +auth_dontaudit_read_shadow(spamd_update_t) + + +mta_read_config(spamd_update_t) + +userdom_use_inherited_user_ptys(spamd_update_t) + +optional_policy(` + gpg_domtrans(spamd_update_t) +') + diff --git a/speedtouch.te b/speedtouch.te index ade10f5..bed16af 100644 --- a/speedtouch.te +++ b/speedtouch.te @@ -47,8 +47,6 @@ fs_search_auto_mountpoints(speedmgmt_t) logging_send_syslog_msg(speedmgmt_t) -miscfiles_read_localization(speedmgmt_t) - userdom_dontaudit_use_unpriv_user_fds(speedmgmt_t) userdom_dontaudit_search_user_home_dirs(speedmgmt_t) diff --git a/squid.fc b/squid.fc index 2015152..6664de3 100644 --- a/squid.fc +++ b/squid.fc @@ -1,8 +1,11 @@ /etc/rc\.d/init\.d/squid -- gen_context(system_u:object_r:squid_initrc_exec_t,s0) /etc/squid(/.*)? gen_context(system_u:object_r:squid_conf_t,s0) +/etc/lightsquid(/.*)? gen_context(system_u:object_r:squid_conf_t,s0) +/usr/share/lightsquid/cgi(/.*)? gen_context(system_u:object_r:httpd_squid_script_exec_t,s0) /usr/lib/squid/cachemgr\.cgi -- gen_context(system_u:object_r:httpd_squid_script_exec_t,s0) /usr/sbin/squid -- gen_context(system_u:object_r:squid_exec_t,s0) +/usr/sbin/lightparser.pl -- gen_context(system_u:object_r:squid_cron_exec_t,s0) /usr/share/squid(/.*)? gen_context(system_u:object_r:squid_conf_t,s0) /var/cache/squid(/.*)? gen_context(system_u:object_r:squid_cache_t,s0) @@ -11,3 +14,4 @@ /var/run/squid\.pid -- gen_context(system_u:object_r:squid_var_run_t,s0) /var/spool/squid(/.*)? gen_context(system_u:object_r:squid_cache_t,s0) /var/squidGuard(/.*)? gen_context(system_u:object_r:squid_cache_t,s0) +/var/lightsquid(/.*)? gen_context(system_u:object_r:squid_cache_t,s0) diff --git a/squid.if b/squid.if index d2496bd..c7614d7 100644 --- a/squid.if +++ b/squid.if @@ -71,7 +71,7 @@ interface(`squid_rw_stream_sockets',` type squid_t; ') - allow $1 squid_t:unix_stream_socket { getattr read write }; + allow $1 squid_t:unix_stream_socket rw_socket_perms; ') ######################################## @@ -83,7 +83,6 @@ interface(`squid_rw_stream_sockets',` ## Domain to not audit. ## ## -## # interface(`squid_dontaudit_search_cache',` gen_require(` @@ -207,12 +206,14 @@ interface(`squid_use',` interface(`squid_admin',` gen_require(` type squid_t, squid_cache_t, squid_conf_t; - type squid_log_t, squid_var_run_t; - type squid_initrc_exec_t; + type squid_log_t, squid_var_run_t, squid_initrc_exec_t; ') - allow $1 squid_t:process { ptrace signal_perms }; + allow $1 squid_t:process signal_perms; ps_process_pattern($1, squid_t) + tunable_policy(`deny_ptrace',`',` + allow $1 squid_t:process ptrace; + ') init_labeled_script_domtrans($1, squid_initrc_exec_t) domain_system_change_exemption($1) diff --git a/squid.te b/squid.te index c38de7a..a654467 100644 --- a/squid.te +++ b/squid.te @@ -29,7 +29,7 @@ type squid_cache_t; files_type(squid_cache_t) type squid_conf_t; -files_type(squid_conf_t) +files_config_file(squid_conf_t) type squid_initrc_exec_t; init_script_file(squid_initrc_exec_t) @@ -40,9 +40,18 @@ logging_log_file(squid_log_t) type squid_tmpfs_t; files_tmpfs_file(squid_tmpfs_t) +type squid_tmp_t; +files_tmp_file(squid_tmp_t) + type squid_var_run_t; files_pid_file(squid_var_run_t) +type squid_cron_t; +type squid_cron_exec_t; +init_daemon_domain(squid_cron_t, squid_cron_exec_t) +application_domain(squid_cron_t, squid_cron_exec_t) +role system_r types squid_cron_t; + ######################################## # # Local policy @@ -69,6 +78,7 @@ allow squid_t self:udp_socket create_socket_perms; manage_dirs_pattern(squid_t, squid_cache_t, squid_cache_t) manage_files_pattern(squid_t, squid_cache_t, squid_cache_t) manage_lnk_files_pattern(squid_t, squid_cache_t, squid_cache_t) +files_var_filetrans(squid_t, squid_cache_t, dir, "squid") allow squid_t squid_conf_t:dir list_dir_perms; read_files_pattern(squid_t, squid_conf_t, squid_conf_t) @@ -85,15 +95,19 @@ logging_log_filetrans(squid_t, squid_log_t, { file dir }) manage_files_pattern(squid_t, squid_tmpfs_t, squid_tmpfs_t) fs_tmpfs_filetrans(squid_t, squid_tmpfs_t, file) +manage_dirs_pattern(squid_t, squid_tmp_t, squid_tmp_t) +manage_files_pattern(squid_t, squid_tmp_t, squid_tmp_t) +files_tmp_filetrans(squid_t, squid_tmp_t, { file dir }) + manage_files_pattern(squid_t, squid_var_run_t, squid_var_run_t) files_pid_filetrans(squid_t, squid_var_run_t, file) kernel_read_kernel_sysctls(squid_t) kernel_read_system_state(squid_t) +kernel_read_network_state(squid_t) files_dontaudit_getattr_boot_dirs(squid_t) -corenet_all_recvfrom_unlabeled(squid_t) corenet_all_recvfrom_netlabel(squid_t) corenet_tcp_sendrecv_generic_if(squid_t) corenet_udp_sendrecv_generic_if(squid_t) @@ -145,7 +159,6 @@ corecmd_exec_shell(squid_t) domain_use_interactive_fds(squid_t) -files_read_etc_files(squid_t) files_read_etc_runtime_files(squid_t) files_read_usr_files(squid_t) files_search_spool(squid_t) @@ -161,7 +174,6 @@ libs_exec_lib_files(squid_t) logging_send_syslog_msg(squid_t) miscfiles_read_generic_certs(squid_t) -miscfiles_read_localization(squid_t) userdom_use_unpriv_users_fds(squid_t) userdom_dontaudit_search_user_home_dirs(squid_t) @@ -169,7 +181,8 @@ userdom_dontaudit_search_user_home_dirs(squid_t) tunable_policy(`squid_connect_any',` corenet_tcp_connect_all_ports(squid_t) corenet_tcp_bind_all_ports(squid_t) - corenet_sendrecv_all_packets(squid_t) + corenet_sendrecv_all_client_packets(squid_t) + corenet_sendrecv_all_server_packets(squid_t) ') tunable_policy(`squid_use_tproxy',` @@ -182,9 +195,9 @@ optional_policy(` allow httpd_squid_script_t self:tcp_socket create_socket_perms; - corenet_all_recvfrom_unlabeled(httpd_squid_script_t) corenet_all_recvfrom_netlabel(httpd_squid_script_t) corenet_tcp_connect_http_cache_port(httpd_squid_script_t) + corenet_tcp_connect_squid_port(httpd_squid_script_t) sysnet_dns_name_resolve(httpd_squid_script_t) @@ -192,10 +205,6 @@ optional_policy(` ') optional_policy(` - cron_system_entry(squid_t, squid_exec_t) -') - -optional_policy(` samba_domtrans_winbind_helper(squid_t) ') @@ -206,3 +215,32 @@ optional_policy(` optional_policy(` udev_read_db(squid_t) ') + +optional_policy(` + kerberos_tmp_filetrans_host_rcache(squid_t, "host_0") +') + +######################################## +# +# squid cron Local policy +# +manage_dirs_pattern(squid_cron_t, squid_cache_t, squid_cache_t) +manage_files_pattern(squid_cron_t, squid_cache_t, squid_cache_t) +manage_lnk_files_pattern(squid_cron_t, squid_cache_t, squid_cache_t) +files_var_filetrans(squid_cron_t, squid_cache_t, dir, "squid") + +read_files_pattern(squid_cron_t, squid_conf_t, squid_conf_t) + +read_files_pattern(squid_cron_t, squid_log_t, squid_log_t) + +corecmd_exec_bin(squid_cron_t) + +dev_read_urand(squid_cron_t) + +files_read_etc_files(squid_cron_t) +files_read_usr_files(squid_cron_t) + + +optional_policy(` + cron_system_entry(squid_cron_t, squid_cron_exec_t) +') diff --git a/sssd.fc b/sssd.fc index 4271815..fb5520f 100644 --- a/sssd.fc +++ b/sssd.fc @@ -1,9 +1,13 @@ /etc/rc\.d/init\.d/sssd -- gen_context(system_u:object_r:sssd_initrc_exec_t,s0) +/etc/sssd(/.*)? gen_context(system_u:object_r:sssd_conf_t,s0) + /usr/sbin/sssd -- gen_context(system_u:object_r:sssd_exec_t,s0) /var/lib/sss(/.*)? gen_context(system_u:object_r:sssd_var_lib_t,s0) +/var/lib/sss/mc(/.*)? gen_context(system_u:object_r:sssd_public_t,s0) + /var/lib/sss/pubconf(/.*)? gen_context(system_u:object_r:sssd_public_t,s0) /var/log/sssd(/.*)? gen_context(system_u:object_r:sssd_var_log_t,s0) diff --git a/sssd.if b/sssd.if index 941380a..a61f9fd 100644 --- a/sssd.if +++ b/sssd.if @@ -5,9 +5,9 @@ ## Execute a domain transition to run sssd. ## ## -## +## ## Domain allowed to transition. -## +## ## # interface(`sssd_domtrans',` @@ -36,6 +36,64 @@ interface(`sssd_initrc_domtrans',` init_labeled_script_domtrans($1, sssd_initrc_exec_t) ') +####################################### +## +## Read sssd configuration. +## +## +## +## Domain allowed access. +## +## +# +interface(`sssd_read_config',` + gen_require(` + type sssd_conf_t; + ') + + files_search_etc($1) + list_dirs_pattern($1, sssd_conf_t, sssd_conf_t) + read_files_pattern($1, sssd_conf_t, sssd_conf_t) +') + +###################################### +## +## Write sssd configuration. +## +## +## +## Domain allowed access. +## +## +# +interface(`sssd_write_config',` + gen_require(` + type sssd_conf_t; + ') + + files_search_etc($1) + write_files_pattern($1, sssd_conf_t, sssd_conf_t) +') + +##################################### +## +## Write sssd configuration. +## +## +## +## Domain allowed access. +## +## +# +interface(`sssd_create_config',` + gen_require(` + type sssd_conf_t; + ') + + files_search_etc($1) + create_files_pattern($1, sssd_conf_t, sssd_conf_t) +') + ######################################## ## ## Read sssd public files. @@ -89,6 +147,7 @@ interface(`sssd_manage_pids',` type sssd_var_run_t; ') + files_search_pids($1) manage_dirs_pattern($1, sssd_var_run_t, sssd_var_run_t) manage_files_pattern($1, sssd_var_run_t, sssd_var_run_t) ') @@ -128,7 +187,6 @@ interface(`sssd_dontaudit_search_lib',` ') dontaudit $1 sssd_var_lib_t:dir search_dir_perms; - files_search_var_lib($1) ') ######################################## @@ -148,6 +206,7 @@ interface(`sssd_read_lib_files',` files_search_var_lib($1) read_files_pattern($1, sssd_var_lib_t, sssd_var_lib_t) + read_lnk_files_pattern($1, sssd_var_lib_t, sssd_var_lib_t) ') ######################################## @@ -168,6 +227,7 @@ interface(`sssd_manage_lib_files',` files_search_var_lib($1) manage_files_pattern($1, sssd_var_lib_t, sssd_var_lib_t) + manage_lnk_files_pattern($1, sssd_var_lib_t, sssd_var_lib_t) ') ######################################## @@ -193,7 +253,7 @@ interface(`sssd_dbus_chat',` ######################################## ## -## Connect to sssd over an unix stream socket. +## Connect to sssd over a unix stream socket. ## ## ## @@ -225,21 +285,18 @@ interface(`sssd_stream_connect',` ## The role to be allowed to manage the sssd domain. ## ## -## -## -## The type of the user terminal. -## -## ## # interface(`sssd_admin',` gen_require(` - type sssd_t, sssd_public_t; - type sssd_initrc_exec_t; + type sssd_t, sssd_public_t, sssd_initrc_exec_t; ') - allow $1 sssd_t:process { ptrace signal_perms getattr }; - read_files_pattern($1, sssd_t, sssd_t) + allow $1 sssd_t:process signal_perms; + ps_process_pattern($1, sssd_t) + tunable_policy(`deny_ptrace',`',` + allow $1 sssd_t:process ptrace; + ') # Allow sssd_t to restart the apache service sssd_initrc_domtrans($1) diff --git a/sssd.te b/sssd.te index a1b61bc..c36be88 100644 --- a/sssd.te +++ b/sssd.te @@ -12,11 +12,15 @@ init_daemon_domain(sssd_t, sssd_exec_t) type sssd_initrc_exec_t; init_script_file(sssd_initrc_exec_t) +type sssd_conf_t; +files_config_file(sssd_conf_t) + type sssd_public_t; files_pid_file(sssd_public_t) type sssd_var_lib_t; files_type(sssd_var_lib_t) +mls_trusted_object(sssd_var_lib_t) type sssd_var_log_t; logging_log_file(sssd_var_log_t) @@ -28,18 +32,24 @@ files_pid_file(sssd_var_run_t) # # sssd local policy # -allow sssd_t self:capability { dac_read_search dac_override kill sys_nice setgid setuid }; -allow sssd_t self:process { setfscreate setsched sigkill signal getsched }; -allow sssd_t self:fifo_file rw_file_perms; + +allow sssd_t self:capability { chown dac_read_search dac_override kill net_admin sys_nice setgid setuid sys_admin sys_resource }; +allow sssd_t self:capability2 block_suspend; +allow sssd_t self:process { setfscreate setsched sigkill signal getsched setrlimit }; +allow sssd_t self:fifo_file rw_fifo_file_perms; +allow sssd_t self:key manage_key_perms; allow sssd_t self:unix_stream_socket { create_stream_socket_perms connectto }; +read_files_pattern(sssd_t, sssd_conf_t, sssd_conf_t) + manage_dirs_pattern(sssd_t, sssd_public_t, sssd_public_t) manage_files_pattern(sssd_t, sssd_public_t, sssd_public_t) manage_dirs_pattern(sssd_t, sssd_var_lib_t, sssd_var_lib_t) manage_files_pattern(sssd_t, sssd_var_lib_t, sssd_var_lib_t) +manage_lnk_files_pattern(sssd_t, sssd_var_lib_t, sssd_var_lib_t) manage_sock_files_pattern(sssd_t, sssd_var_lib_t, sssd_var_lib_t) -files_var_lib_filetrans(sssd_t, sssd_var_lib_t, { file dir } ) +files_var_lib_filetrans(sssd_t, sssd_var_lib_t, { file dir }) manage_files_pattern(sssd_t, sssd_var_log_t, sssd_var_log_t) logging_log_filetrans(sssd_t, sssd_var_log_t, file) @@ -48,37 +58,56 @@ manage_dirs_pattern(sssd_t, sssd_var_run_t, sssd_var_run_t) manage_files_pattern(sssd_t, sssd_var_run_t, sssd_var_run_t) files_pid_filetrans(sssd_t, sssd_var_run_t, { file dir }) +kernel_read_network_state(sssd_t) kernel_read_system_state(sssd_t) +corenet_udp_bind_generic_port(sssd_t) +corenet_dontaudit_udp_bind_all_ports(sssd_t) + corecmd_exec_bin(sssd_t) dev_read_urand(sssd_t) +dev_read_sysfs(sssd_t) domain_read_all_domains_state(sssd_t) domain_obj_id_change_exemption(sssd_t) files_list_tmp(sssd_t) files_read_etc_files(sssd_t) +files_read_etc_runtime_files(sssd_t) files_read_usr_files(sssd_t) +files_list_var_lib(sssd_t) fs_list_inotifyfs(sssd_t) selinux_validate_context(sssd_t) seutil_read_file_contexts(sssd_t) +# sssd wants to write /etc/selinux//logins/ for SELinux PAM module +seutil_rw_login_config_dirs(sssd_t) +seutil_manage_login_config_files(sssd_t) mls_file_read_to_clearance(sssd_t) +mls_socket_read_to_clearance(sssd_t) +mls_socket_write_to_clearance(sssd_t) +mls_trusted_object(sssd_t) -auth_use_nsswitch(sssd_t) +# auth_use_nsswitch(sssd_t) auth_domtrans_chk_passwd(sssd_t) auth_domtrans_upd_passwd(sssd_t) +auth_manage_cache(sssd_t) init_read_utmp(sssd_t) logging_send_syslog_msg(sssd_t) logging_send_audit_msgs(sssd_t) -miscfiles_read_localization(sssd_t) +miscfiles_read_generic_certs(sssd_t) + +sysnet_dns_name_resolve(sssd_t) +sysnet_use_ldap(sssd_t) + +userdom_manage_tmp_role(system_r, sssd_t) optional_policy(` dbus_system_bus_client(sssd_t) @@ -87,8 +116,17 @@ optional_policy(` optional_policy(` kerberos_manage_host_rcache(sssd_t) + kerberos_tmp_filetrans_host_rcache(sssd_t, "host_0") + kerberos_read_home_content(sssd_t) +') + +optional_policy(` + dirsrv_stream_connect(sssd_t) ') optional_policy(` ldap_stream_connect(sssd_t) ') + +userdom_home_reader(sssd_t) + diff --git a/stapserver.fc b/stapserver.fc new file mode 100644 index 0000000..0ccce59 --- /dev/null +++ b/stapserver.fc @@ -0,0 +1,7 @@ +/usr/bin/stap-server -- gen_context(system_u:object_r:stapserver_exec_t,s0) + +/var/lib/stap-server(/.*)? gen_context(system_u:object_r:stapserver_var_lib_t,s0) + +/var/log/stap-server(/.*)? gen_context(system_u:object_r:stapserver_log_t,s0) + +/var/run/stap-server(/.*)? gen_context(system_u:object_r:stapserver_var_run_t,s0) diff --git a/stapserver.if b/stapserver.if new file mode 100644 index 0000000..89b20d3 --- /dev/null +++ b/stapserver.if @@ -0,0 +1,156 @@ + +## Instrumentation System Server + +######################################## +## +## Execute stapserver in the stapserver domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`stapserver_domtrans',` + gen_require(` + type stapserver_t, stapserver_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, stapserver_exec_t, stapserver_t) +') +######################################## +## +## Read stapserver's log files. +## +## +## +## Domain allowed access. +## +## +## +# +interface(`stapserver_read_log',` + gen_require(` + type stapserver_log_t; + ') + + logging_search_logs($1) + read_files_pattern($1, stapserver_log_t, stapserver_log_t) +') + +######################################## +## +## Append to stapserver log files. +## +## +## +## Domain allowed access. +## +## +# +interface(`stapserver_append_log',` + gen_require(` + type stapserver_log_t; + ') + + logging_search_logs($1) + append_files_pattern($1, stapserver_log_t, stapserver_log_t) +') + +######################################## +## +## Manage stapserver log files +## +## +## +## Domain allowed access. +## +## +# +interface(`stapserver_manage_log',` + gen_require(` + type stapserver_log_t; + ') + + logging_search_logs($1) + manage_dirs_pattern($1, stapserver_log_t, stapserver_log_t) + manage_files_pattern($1, stapserver_log_t, stapserver_log_t) + manage_lnk_files_pattern($1, stapserver_log_t, stapserver_log_t) +') +######################################## +## +## Read stapserver PID files. +## +## +## +## Domain allowed access. +## +## +# +interface(`stapserver_read_pid_files',` + gen_require(` + type stapserver_var_run_t; + ') + + files_search_pids($1) + allow $1 stapserver_var_run_t:file read_file_perms; +') + +####################################### +## +## Manage stapserver lib files +## +## +## +## Domain allowed access. +## +## +# +interface(`stapserver_manage_lib',` + gen_require(` + type stapserver_var_lib_t; + ') + + manage_dirs_pattern($1, stapserver_var_lib_t, stapserver_var_lib_t) + manage_files_pattern($1, stapserver_var_lib_t, stapserver_var_lib_t) +') + +######################################## +## +## All of the rules required to administrate +## an stapserver environment +## +## +## +## Domain allowed access. +## +## +## +## +## Role allowed access. +## +## +## +# +interface(`stapserver_admin',` + gen_require(` + type stapserver_t; + type stapserver_log_t; + type stapserver_var_run_t; + ') + + allow $1 stapserver_t:process { ptrace signal_perms }; + ps_process_pattern($1, stapserver_t) + + logging_search_logs($1) + admin_pattern($1, stapserver_log_t) + + files_search_pids($1) + admin_pattern($1, stapserver_var_run_t) + + optional_policy(` + systemd_passwd_agent_exec($1) + systemd_read_fifo_file_passwd_run($1) + ') +') diff --git a/stapserver.te b/stapserver.te new file mode 100644 index 0000000..b87c79c --- /dev/null +++ b/stapserver.te @@ -0,0 +1,100 @@ +policy_module(stapserver, 1.0.0) + +######################################## +# +# Declarations +# + +type stapserver_t; +type stapserver_exec_t; +init_daemon_domain(stapserver_t, stapserver_exec_t) + +type stapserver_var_lib_t; +files_type(stapserver_var_lib_t) + +type stapserver_log_t; +logging_log_file(stapserver_log_t) + +type stapserver_var_run_t; +files_pid_file(stapserver_var_run_t) + +######################################## +# +# stapserver local policy +# + +#runuser +allow stapserver_t self:capability { setuid setgid }; +allow stapserver_t self:process setsched; + +allow stapserver_t self:capability { dac_override kill }; +allow stapserver_t self:process { setrlimit signal }; + +allow stapserver_t self:fifo_file rw_fifo_file_perms; +allow stapserver_t self:key write; +allow stapserver_t self:unix_stream_socket create_stream_socket_perms; +allow stapserver_t self:tcp_socket { accept listen }; + +manage_dirs_pattern(stapserver_t, stapserver_var_lib_t, stapserver_var_lib_t) +manage_files_pattern(stapserver_t, stapserver_var_lib_t, stapserver_var_lib_t) +files_var_lib_filetrans(stapserver_t, stapserver_var_lib_t, dir) + +manage_dirs_pattern(stapserver_t, stapserver_log_t, stapserver_log_t) +manage_files_pattern(stapserver_t, stapserver_log_t, stapserver_log_t) +logging_log_filetrans(stapserver_t, stapserver_log_t, dir ) + +manage_dirs_pattern(stapserver_t, stapserver_var_run_t, stapserver_var_run_t) +manage_files_pattern(stapserver_t, stapserver_var_run_t, stapserver_var_run_t) +files_pid_filetrans(stapserver_t, stapserver_var_run_t, dir ) + +kernel_read_system_state(stapserver_t) +kernel_read_kernel_sysctls(stapserver_t) + +corecmd_exec_bin(stapserver_t) +corecmd_exec_shell(stapserver_t) + +domain_read_all_domains_state(stapserver_t) +domain_use_interactive_fds(stapserver_t) + +dev_read_sysfs(stapserver_t) +dev_read_rand(stapserver_t) +dev_read_urand(stapserver_t) + +files_list_tmp(stapserver_t) +files_read_usr_files(stapserver_t) +files_search_kernel_modules(stapserver_t) + +fs_search_cgroup_dirs(stapserver_t) + +auth_use_nsswitch(stapserver_t) + +init_read_utmp(stapserver_t) + +logging_send_audit_msgs(stapserver_t) +logging_send_syslog_msg(stapserver_t) + +#lspci +miscfiles_read_hwdata(stapserver_t) + +userdom_use_user_terminals(stapserver_t) + +optional_policy(` + consoletype_exec(stapserver_t) +') + +optional_policy(` + dbus_system_bus_client(stapserver_t) +') + +optional_policy(` + hostname_exec(stapserver_t) +') + +optional_policy(` + plymouthd_exec_plymouth(stapserver_t) +') + +optional_policy(` + rpm_exec(stapserver_t) +') + diff --git a/stunnel.te b/stunnel.te index f646c66..a399168 100644 --- a/stunnel.te +++ b/stunnel.te @@ -40,7 +40,7 @@ allow stunnel_t self:udp_socket create_socket_perms; allow stunnel_t stunnel_etc_t:dir list_dir_perms; allow stunnel_t stunnel_etc_t:file read_file_perms; -allow stunnel_t stunnel_etc_t:lnk_file { getattr read }; +allow stunnel_t stunnel_etc_t:lnk_file read_lnk_file_perms; manage_dirs_pattern(stunnel_t, stunnel_tmp_t, stunnel_tmp_t) manage_files_pattern(stunnel_t, stunnel_tmp_t, stunnel_tmp_t) @@ -56,7 +56,6 @@ kernel_read_network_state(stunnel_t) corecmd_exec_bin(stunnel_t) -corenet_all_recvfrom_unlabeled(stunnel_t) corenet_all_recvfrom_netlabel(stunnel_t) corenet_tcp_sendrecv_generic_if(stunnel_t) corenet_udp_sendrecv_generic_if(stunnel_t) @@ -73,8 +72,6 @@ auth_use_nsswitch(stunnel_t) logging_send_syslog_msg(stunnel_t) -miscfiles_read_localization(stunnel_t) - sysnet_read_config(stunnel_t) ifdef(`distro_gentoo', ` @@ -106,7 +103,6 @@ ifdef(`distro_gentoo', ` dev_read_urand(stunnel_t) - files_read_etc_files(stunnel_t) files_read_etc_runtime_files(stunnel_t) files_search_home(stunnel_t) @@ -120,4 +116,5 @@ ifdef(`distro_gentoo', ` gen_require(` type stunnel_port_t; ') + allow stunnel_t stunnel_port_t:tcp_socket name_bind; diff --git a/svnserve.fc b/svnserve.fc new file mode 100644 index 0000000..5ab0840 --- /dev/null +++ b/svnserve.fc @@ -0,0 +1,12 @@ +/etc/rc.d/init.d/svnserve -- gen_context(system_u:object_r:svnserve_initrc_exec_t,s0) + +/usr/bin/svnserve -- gen_context(system_u:object_r:svnserve_exec_t,s0) + +/lib/systemd/system/svnserve\.service -- gen_context(system_u:object_r:svnserve_unit_file_t,s0) +/usr/lib/systemd/system/svnserve\.service -- gen_context(system_u:object_r:svnserve_unit_file_t,s0) + +/var/run/svnserve(/.*)? gen_context(system_u:object_r:svnserve_var_run_t,s0) +/var/run/svnserve.pid -- gen_context(system_u:object_r:svnserve_var_run_t,s0) + +/var/subversion/repo(/.*)? gen_context(system_u:object_r:svnserve_content_t,s0) +/var/lib/subversion/repo(/.*)? gen_context(system_u:object_r:svnserve_content_t,s0) diff --git a/svnserve.if b/svnserve.if new file mode 100644 index 0000000..dd2ac36 --- /dev/null +++ b/svnserve.if @@ -0,0 +1,118 @@ + +## policy for svnserve + + +######################################## +## +## Transition to svnserve. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`svnserve_domtrans',` + gen_require(` + type svnserve_t, svnserve_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, svnserve_exec_t, svnserve_t) +') + + +######################################## +## +## Execute svnserve server in the svnserve domain. +## +## +## +## Domain allowed access. +## +## +# +interface(`svnserve_initrc_domtrans',` + gen_require(` + type svnserve_initrc_exec_t; + ') + + init_labeled_script_domtrans($1, svnserve_initrc_exec_t) +') + +####################################### +## +## Execute svnserve server in the svnserve domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`svnserve_systemctl',` + gen_require(` + type svnserve_t; + type svnserve_unit_file_t; + ') + + systemd_exec_systemctl($1) + allow $1 svnserve_unit_file_t:file read_file_perms; + allow $1 svnserve_unit_file_t:service manage_service_perms; + + ps_process_pattern($1, svnserve_t) +') + +######################################## +## +## Read svnserve PID files. +## +## +## +## Domain allowed access. +## +## +# +interface(`svnserve_read_pid_files',` + gen_require(` + type svnserve_var_run_t; + ') + + files_search_pids($1) + allow $1 svnserve_var_run_t:file read_file_perms; +') + + +######################################## +## +## All of the rules required to administrate +## an svnserve environment +## +## +## +## Domain allowed access. +## +## +# +interface(`svnserve_admin',` + gen_require(` + type svnserve_t; + type svnserve_var_run_t; + type svnserve_unit_file_t; + ') + + allow $1 svnserve_t:process { ptrace signal_perms }; + ps_process_pattern($1, svnserve_t) + + files_search_pids($1) + admin_pattern($1, svnserve_var_run_t) + + svnserve_systemctl($1) + admin_pattern($1, svnserve_unit_file_t) + allow $1 svnserve_unit_file_t:service all_service_perms; + optional_policy(` + systemd_passwd_agent_exec($1) + systemd_read_fifo_file_passwd_run($1) + ') +') + diff --git a/svnserve.te b/svnserve.te new file mode 100644 index 0000000..f66149f --- /dev/null +++ b/svnserve.te @@ -0,0 +1,52 @@ +policy_module(svnserve, 1.0.0) + +######################################## +# +# Declarations +# + +type svnserve_t; +type svnserve_exec_t; +init_daemon_domain(svnserve_t, svnserve_exec_t) + +type svnserve_initrc_exec_t; +init_script_file(svnserve_initrc_exec_t) + +type svnserve_var_run_t; +files_pid_file(svnserve_var_run_t) + +type svnserve_content_t; +files_type(svnserve_content_t) + +type svnserve_unit_file_t; +systemd_unit_file(svnserve_unit_file_t) + +######################################## +# +# svnserve local policy +# + +allow svnserve_t self:fifo_file rw_fifo_file_perms; +allow svnserve_t self:unix_stream_socket create_stream_socket_perms; + +manage_dirs_pattern(svnserve_t, svnserve_content_t, svnserve_content_t) +manage_files_pattern(svnserve_t, svnserve_content_t, svnserve_content_t) + +manage_dirs_pattern(svnserve_t, svnserve_var_run_t, svnserve_var_run_t) +manage_files_pattern(svnserve_t, svnserve_var_run_t, svnserve_var_run_t) +files_pid_filetrans(svnserve_t, svnserve_var_run_t, { dir file }) + +corenet_udp_bind_generic_node(svnserve_t) +#corenet_tcp_connect_svn_port(svnserve_t) +#corenet_tcp_bind_svn_port(svnserve_t) +#corenet_udp_bind_svn_port(svnserve_t) + +domain_use_interactive_fds(svnserve_t) + +files_read_etc_files(svnserve_t) +files_read_usr_files(svnserve_t) + +logging_send_syslog_msg(svnserve_t) + +sysnet_dns_name_resolve(svnserve_t) + diff --git a/sxid.te b/sxid.te index 8296303..50eddef 100644 --- a/sxid.te +++ b/sxid.te @@ -40,7 +40,6 @@ kernel_read_kernel_sysctls(sxid_t) corecmd_exec_bin(sxid_t) corecmd_exec_shell(sxid_t) -corenet_all_recvfrom_unlabeled(sxid_t) corenet_all_recvfrom_netlabel(sxid_t) corenet_tcp_sendrecv_generic_if(sxid_t) corenet_udp_sendrecv_generic_if(sxid_t) @@ -66,7 +65,7 @@ fs_list_all(sxid_t) term_dontaudit_use_console(sxid_t) -files_read_non_auth_files(sxid_t) +files_read_non_security_files(sxid_t) auth_dontaudit_getattr_shadow(sxid_t) init_use_fds(sxid_t) @@ -74,15 +73,17 @@ init_use_script_ptys(sxid_t) logging_send_syslog_msg(sxid_t) -miscfiles_read_localization(sxid_t) - -mount_exec(sxid_t) - sysnet_read_config(sxid_t) userdom_dontaudit_use_unpriv_user_fds(sxid_t) -cron_system_entry(sxid_t, sxid_exec_t) +optional_policy(` + cron_system_entry(sxid_t, sxid_exec_t) +') + +optional_policy(` + mount_exec(sxid_t) +') optional_policy(` mta_send_mail(sxid_t) diff --git a/sysstat.fc b/sysstat.fc index 5d0e77b..5a92938 100644 --- a/sysstat.fc +++ b/sysstat.fc @@ -6,3 +6,4 @@ /var/log/atsar(/.*)? gen_context(system_u:object_r:sysstat_log_t,s0) /var/log/sa(/.*)? gen_context(system_u:object_r:sysstat_log_t,s0) /var/log/sysstat(/.*)? gen_context(system_u:object_r:sysstat_log_t,s0) +/opt/sartest(/.*)? gen_context(system_u:object_r:sysstat_log_t,s0) diff --git a/sysstat.te b/sysstat.te index 0ecd8a7..b532568 100644 --- a/sysstat.te +++ b/sysstat.te @@ -18,8 +18,7 @@ logging_log_file(sysstat_log_t) # Local policy # -allow sysstat_t self:capability { dac_override sys_resource sys_tty_config }; -dontaudit sysstat_t self:capability sys_admin; +allow sysstat_t self:capability { dac_override sys_admin sys_resource sys_tty_config }; allow sysstat_t self:fifo_file rw_fifo_file_perms; can_exec(sysstat_t, sysstat_exec_t) @@ -36,6 +35,7 @@ kernel_read_kernel_sysctls(sysstat_t) kernel_read_fs_sysctls(sysstat_t) kernel_read_rpc_sysctls(sysstat_t) +corecmd_exec_shell(sysstat_t) corecmd_exec_bin(sysstat_t) dev_read_urand(sysstat_t) @@ -45,19 +45,20 @@ files_search_var(sysstat_t) # for mtab files_read_etc_runtime_files(sysstat_t) #for fstab -files_read_etc_files(sysstat_t) fs_getattr_xattr_fs(sysstat_t) fs_list_inotifyfs(sysstat_t) term_use_console(sysstat_t) -term_use_all_terms(sysstat_t) +term_use_all_inherited_terms(sysstat_t) init_use_fds(sysstat_t) locallogin_use_fds(sysstat_t) -miscfiles_read_localization(sysstat_t) +auth_use_nsswitch(sysstat_t) + +logging_send_syslog_msg(sysstat_t) userdom_dontaudit_list_user_home_dirs(sysstat_t) @@ -65,6 +66,3 @@ optional_policy(` cron_system_entry(sysstat_t, sysstat_exec_t) ') -optional_policy(` - logging_send_syslog_msg(sysstat_t) -') diff --git a/tcpd.te b/tcpd.te index 7038b55..8961067 100644 --- a/tcpd.te +++ b/tcpd.te @@ -22,7 +22,6 @@ manage_dirs_pattern(tcpd_t, tcpd_tmp_t, tcpd_tmp_t) manage_files_pattern(tcpd_t, tcpd_tmp_t, tcpd_tmp_t) files_tmp_filetrans(tcpd_t, tcpd_tmp_t, { file dir }) -corenet_all_recvfrom_unlabeled(tcpd_t) corenet_all_recvfrom_netlabel(tcpd_t) corenet_tcp_sendrecv_generic_if(tcpd_t) corenet_tcp_sendrecv_generic_node(tcpd_t) @@ -39,8 +38,6 @@ files_dontaudit_search_var(tcpd_t) logging_send_syslog_msg(tcpd_t) -miscfiles_read_localization(tcpd_t) - sysnet_read_config(tcpd_t) inetd_domtrans_child(tcpd_t) diff --git a/tcsd.if b/tcsd.if index 595f5a7..4e518cf 100644 --- a/tcsd.if +++ b/tcsd.if @@ -137,8 +137,11 @@ interface(`tcsd_admin',` type tcsd_var_lib_t; ') - allow $1 tcsd_t:process { ptrace signal_perms }; + allow $1 tcsd_t:process signal_perms; ps_process_pattern($1, tcsd_t) + tunable_policy(`deny_ptrace',`',` + allow $1 tcsd_t:process ptrace; + ') tcsd_initrc_domtrans($1) domain_system_change_exemption($1) diff --git a/tcsd.te b/tcsd.te index ee9f3c6..ac97168 100644 --- a/tcsd.te +++ b/tcsd.te @@ -30,7 +30,6 @@ manage_files_pattern(tcsd_t, tcsd_var_lib_t, tcsd_var_lib_t) files_var_lib_filetrans(tcsd_t, tcsd_var_lib_t, { file dir }) # Accept connections on the TCS port over loopback. -corenet_all_recvfrom_unlabeled(tcsd_t) corenet_tcp_bind_generic_node(tcsd_t) corenet_tcp_bind_tcs_port(tcsd_t) @@ -38,13 +37,8 @@ dev_read_urand(tcsd_t) # Access /dev/tpm0. dev_rw_tpm(tcsd_t) -files_read_etc_files(tcsd_t) files_read_usr_files(tcsd_t) auth_use_nsswitch(tcsd_t) logging_send_syslog_msg(tcsd_t) - -miscfiles_read_localization(tcsd_t) - -sysnet_dns_name_resolve(tcsd_t) diff --git a/telepathy.fc b/telepathy.fc index b07ee19..a275bd6 100644 --- a/telepathy.fc +++ b/telepathy.fc @@ -1,8 +1,11 @@ HOME_DIR/\.cache/\.mc_connections -- gen_context(system_u:object_r:telepathy_mission_control_cache_home_t, s0) -HOME_DIR/\.cache/telepathy/logger/sqlite-data-journal -- gen_context(system_u:object_r:telepathy_logger_cache_home_t,s0) +HOME_DIR/\.cache/telepathy(/.*)? gen_context(system_u:object_r:telepathy_cache_home_t, s0) +HOME_DIR/\.cache/telepathy/logger(/.*)? gen_context(system_u:object_r:telepathy_logger_cache_home_t,s0) HOME_DIR/\.cache/telepathy/gabble(/.*)? gen_context(system_u:object_r:telepathy_gabble_cache_home_t, s0) HOME_DIR/\.cache/wocky(/.*)? gen_context(system_u:object_r:telepathy_gabble_cache_home_t, s0) HOME_DIR/\.mission-control(/.*)? gen_context(system_u:object_r:telepathy_mission_control_home_t, s0) +HOME_DIR/\.local/share/telepathy(/.*)? gen_context(system_u:object_r:telepathy_data_home_t,s0) +HOME_DIR/\.local/share/telepathy/mission-control(/.*)? gen_context(system_u:object_r:telepathy_mission_control_data_home_t, s0) HOME_DIR/\.telepathy-sunshine(/.*)? gen_context(system_u:object_r:telepathy_sunshine_home_t, s0) HOME_DIR/\.local/share/TpLogger(/.*)? gen_context(system_u:object_r:telepathy_logger_data_home_t,s0) diff --git a/telepathy.if b/telepathy.if index f09171e..18952a8 100644 --- a/telepathy.if +++ b/telepathy.if @@ -11,7 +11,6 @@ ## ## # -# template(`telepathy_domain_template',` gen_require(` attribute telepathy_domain; @@ -20,19 +19,19 @@ template(`telepathy_domain_template',` type telepathy_$1_t, telepathy_domain; type telepathy_$1_exec_t, telepathy_executable; - userdom_user_application_domain(telepathy_$1_t, telepathy_$1_exec_t) + application_domain(telepathy_$1_t, telepathy_$1_exec_t) + ubac_constrained(telepathy_$1_t) type telepathy_$1_tmp_t; userdom_user_tmp_file(telepathy_$1_tmp_t) auth_use_nsswitch(telepathy_$1_t) - ') ####################################### ## -## Role access for telepathy domains -### that executes via dbus-session +## Role access for telepathy domains +## that executes via dbus-session ## ## ## @@ -44,8 +43,13 @@ template(`telepathy_domain_template',` ## The type of the user domain. ## ## +## +## +## User domain prefix to be used. +## +## # -template(`telepathy_role', ` +template(`telepathy_role',` gen_require(` attribute telepathy_domain; type telepathy_gabble_t, telepathy_sofiasip_t, telepathy_idle_t; @@ -76,6 +80,8 @@ template(`telepathy_role', ` dbus_session_domain($3, telepathy_sunshine_exec_t, telepathy_sunshine_t) dbus_session_domain($3, telepathy_stream_engine_exec_t, telepathy_stream_engine_t) dbus_session_domain($3, telepathy_msn_exec_t, telepathy_msn_t) + + telepathy_dbus_chat($2) ') ######################################## @@ -122,11 +128,6 @@ interface(`telepathy_gabble_dbus_chat', ` ## ## Read telepathy mission control state. ## -## -## -## Prefix to be used. -## -## ## ## ## Domain allowed access. @@ -166,7 +167,7 @@ interface(`telepathy_msn_stream_connect', ` ## Stream connect to Telepathy Salut ## ## -## +## ## Domain allowed access. ## ## @@ -179,3 +180,111 @@ interface(`telepathy_salut_stream_connect', ` stream_connect_pattern($1, telepathy_salut_tmp_t, telepathy_salut_tmp_t, telepathy_salut_t) files_search_tmp($1) ') + +####################################### +## +## Send DBus messages to and from +## all Telepathy domain. +## +## +## +## Domain allowed access. +## +## +# +interface(`telepathy_dbus_chat',` + gen_require(` + attribute telepathy_domain; + class dbus send_msg; + ') + + allow $1 telepathy_domain:dbus send_msg; + allow telepathy_domain $1:dbus send_msg; +') + +###################################### +## +## Execute telepathy executable +## in the specified domain. +## +## +##

+## Execute a telepathy executable +## in the specified domain. This allows +## the specified domain to execute any file +## on these filesystems in the specified +## domain. +##

+##

+## No interprocess communication (signals, pipes, +## etc.) is provided by this interface since +## the domains are not owned by this module. +##

+## +## +## +## Domain allowed to transition. +## +## +## +## +## The type of the new process. +## +## +# +interface(`telepathy_command_domtrans', ` + gen_require(` + attribute telepathy_executable; + ') + + allow $2 telepathy_executable:file entrypoint; + domain_transition_pattern($1, telepathy_executable, $2) + type_transition $1 telepathy_executable:process $2; + + # needs to dbus chat with unconfined_t and unconfined_dbusd_t + optional_policy(` + telepathy_dbus_chat($1) + telepathy_dbus_chat($2) + ') +') + +######################################## +## +## Create telepathy content in the user home directory +## with an correct label. +## +## +## +## Domain allowed access. +## +## +# +interface(`telepathy_filetrans_home_content',` + gen_require(` + type telepathy_mission_control_cache_home_t; + type telepathy_mission_control_home_t; + type telepathy_logger_cache_home_t; + type telepathy_gabble_cache_home_t; + type telepathy_sunshine_home_t; + type telepathy_logger_data_home_t; + type telepathy_cache_home_t, telepathy_data_home_t; + type telepathy_mission_control_data_home_t; + ') + + filetrans_pattern($1, telepathy_cache_home_t, telepathy_logger_cache_home_t, dir, "logger") + filetrans_pattern($1, telepathy_cache_home_t, telepathy_logger_cache_home_t, file, "sqlite-data-journal") + filetrans_pattern($1, telepathy_cache_home_t, telepathy_gabble_cache_home_t, dir, "gabble") + + filetrans_pattern($1, telepathy_data_home_t, telepathy_mission_control_data_home_t, dir, "mission-control") + + userdom_user_home_dir_filetrans($1, telepathy_mission_control_home_t, dir, ".mission-control") + userdom_user_home_dir_filetrans($1, telepathy_sunshine_home_t, dir, ".telepathy-sunshine") + + gnome_cache_filetrans($1, telepathy_mission_control_cache_home_t, file, ".mc_connections") + gnome_cache_filetrans($1, telepathy_gabble_cache_home_t, dir, "gabble") + gnome_cache_filetrans($1, telepathy_gabble_cache_home_t, dir, "wocky") + gnome_cache_filetrans($1, telepathy_cache_home_t, dir, "telepathy") + + gnome_data_filetrans($1, telepathy_logger_data_home_t, dir, "TpLogger") + gnome_data_filetrans($1, telepathy_data_home_t, dir, "telepathy") +') diff --git a/telepathy.te b/telepathy.te index 964978b..e3abb65 100644 --- a/telepathy.te +++ b/telepathy.te @@ -7,16 +7,16 @@ policy_module(telepathy, 1.3.0) ## ##

-## Allow the Telepathy connection managers -## to connect to any generic TCP port. +## Allow the Telepathy connection managers +## to connect to any generic TCP port. ##

## gen_tunable(telepathy_tcp_connect_generic_network_ports, false) ## ##

-## Allow the Telepathy connection managers -## to connect to any network port. +## Allow the Telepathy connection managers +## to connect to any network port. ##

## gen_tunable(telepathy_connect_all_ports, false) @@ -26,12 +26,18 @@ attribute telepathy_executable; telepathy_domain_template(gabble) +type telepathy_cache_home_t; +userdom_user_home_content(telepathy_cache_home_t) + type telepathy_gabble_cache_home_t; userdom_user_home_content(telepathy_gabble_cache_home_t) telepathy_domain_template(idle) telepathy_domain_template(logger) +type telepathy_data_home_t; +userdom_user_home_content(telepathy_data_home_t) + type telepathy_logger_cache_home_t; userdom_user_home_content(telepathy_logger_cache_home_t) @@ -43,6 +49,9 @@ telepathy_domain_template(mission_control) type telepathy_mission_control_home_t; userdom_user_home_content(telepathy_mission_control_home_t) +type telepathy_mission_control_data_home_t; +userdom_user_home_content(telepathy_mission_control_data_home_t) + type telepathy_mission_control_cache_home_t; userdom_user_home_content(telepathy_mission_control_cache_home_t) @@ -67,8 +76,16 @@ manage_dirs_pattern(telepathy_gabble_t, telepathy_gabble_tmp_t, telepathy_gabble manage_sock_files_pattern(telepathy_gabble_t, telepathy_gabble_tmp_t, telepathy_gabble_tmp_t) files_tmp_filetrans(telepathy_gabble_t, telepathy_gabble_tmp_t, { dir sock_file }) +# ~/.cache/telepathy/gabble/caps-cache.db-journal +optional_policy(` + manage_dirs_pattern(telepathy_gabble_t, telepathy_gabble_cache_home_t, telepathy_gabble_cache_home_t) + manage_files_pattern(telepathy_gabble_t, telepathy_gabble_cache_home_t, telepathy_gabble_cache_home_t) + filetrans_pattern(telepathy_gabble_t, telepathy_cache_home_t, telepathy_gabble_cache_home_t, dir) + # ~/.cache/wocky + gnome_cache_filetrans(telepathy_gabble_t, telepathy_gabble_cache_home_t, dir) +') + corenet_all_recvfrom_netlabel(telepathy_gabble_t) -corenet_all_recvfrom_unlabeled(telepathy_gabble_t) corenet_tcp_sendrecv_generic_if(telepathy_gabble_t) corenet_tcp_sendrecv_generic_node(telepathy_gabble_t) corenet_tcp_connect_http_port(telepathy_gabble_t) @@ -98,18 +115,14 @@ tunable_policy(`telepathy_tcp_connect_generic_network_ports',` corenet_sendrecv_generic_client_packets(telepathy_gabble_t) ') -tunable_policy(`use_nfs_home_dirs',` - fs_manage_nfs_dirs(telepathy_gabble_t) - fs_manage_nfs_files(telepathy_gabble_t) -') +userdom_home_manager(telepathy_gabble_t) -tunable_policy(`use_samba_home_dirs',` - fs_manage_cifs_dirs(telepathy_gabble_t) - fs_manage_cifs_files(telepathy_gabble_t) +optional_policy(` + dbus_system_bus_client(telepathy_gabble_t) ') optional_policy(` - dbus_system_bus_client(telepathy_gabble_t) + gnome_manage_home_config(telepathy_gabble_t) ') ####################################### @@ -118,7 +131,6 @@ optional_policy(` # corenet_all_recvfrom_netlabel(telepathy_idle_t) -corenet_all_recvfrom_unlabeled(telepathy_idle_t) corenet_tcp_sendrecv_generic_if(telepathy_idle_t) corenet_tcp_sendrecv_generic_node(telepathy_idle_t) corenet_tcp_connect_gatekeeper_port(telepathy_idle_t) @@ -128,6 +140,7 @@ corenet_sendrecv_ircd_client_packets(telepathy_idle_t) dev_read_rand(telepathy_idle_t) files_read_etc_files(telepathy_idle_t) +files_read_usr_files(telepathy_idle_t) tunable_policy(`telepathy_connect_all_ports',` corenet_tcp_connect_all_ports(telepathy_idle_t) @@ -147,10 +160,13 @@ tunable_policy(`telepathy_tcp_connect_generic_network_ports',` allow telepathy_logger_t self:unix_stream_socket create_socket_perms; +manage_dirs_pattern(telepathy_logger_t, telepathy_logger_cache_home_t, telepathy_logger_cache_home_t) manage_files_pattern(telepathy_logger_t, telepathy_logger_cache_home_t, telepathy_logger_cache_home_t) +filetrans_pattern(telepathy_logger_t, telepathy_cache_home_t, telepathy_logger_cache_home_t, dir) manage_dirs_pattern(telepathy_logger_t, telepathy_logger_data_home_t, telepathy_logger_data_home_t) manage_files_pattern(telepathy_logger_t, telepathy_logger_data_home_t, telepathy_logger_data_home_t) +gnome_data_filetrans(telepathy_logger_t, telepathy_logger_data_home_t, dir) files_read_etc_files(telepathy_logger_t) files_read_usr_files(telepathy_logger_t) @@ -158,40 +174,58 @@ files_search_pids(telepathy_logger_t) fs_getattr_all_fs(telepathy_logger_t) -tunable_policy(`use_nfs_home_dirs',` - fs_manage_nfs_dirs(telepathy_logger_t) - fs_manage_nfs_files(telepathy_logger_t) -') +userdom_home_manager(telepathy_logger_t) -tunable_policy(`use_samba_home_dirs',` - fs_manage_cifs_dirs(telepathy_logger_t) - fs_manage_cifs_files(telepathy_logger_t) +optional_policy(` + # ~/.config/dconf/user + gnome_manage_home_config(telepathy_logger_t) ') ####################################### # # Telepathy Mission-Control local policy. # +allow telepathy_mission_control_t self:process setsched; manage_dirs_pattern(telepathy_mission_control_t, telepathy_mission_control_home_t, telepathy_mission_control_home_t) manage_files_pattern(telepathy_mission_control_t, telepathy_mission_control_home_t, telepathy_mission_control_home_t) userdom_user_home_dir_filetrans(telepathy_mission_control_t, telepathy_mission_control_home_t, { dir file }) +userdom_search_user_home_dirs(telepathy_mission_control_t) + +manage_dirs_pattern(telepathy_mission_control_t, { telepathy_data_home_t telepathy_mission_control_data_home_t }, { telepathy_data_home_t telepathy_mission_control_data_home_t }) +manage_files_pattern(telepathy_mission_control_t, telepathy_mission_control_data_home_t, telepathy_mission_control_data_home_t) +filetrans_pattern(telepathy_mission_control_t, telepathy_data_home_t, telepathy_mission_control_data_home_t, { dir file }) +gnome_data_filetrans(telepathy_mission_control_t, telepathy_data_home_t, dir) +gnome_manage_home_config(telepathy_mission_control_t) dev_read_rand(telepathy_mission_control_t) fs_getattr_all_fs(telepathy_mission_control_t) +files_list_tmp(telepathy_mission_control_t) files_read_etc_files(telepathy_mission_control_t) files_read_usr_files(telepathy_mission_control_t) -tunable_policy(`use_nfs_home_dirs',` - fs_manage_nfs_dirs(telepathy_mission_control_t) - fs_manage_nfs_files(telepathy_mission_control_t) +userdom_home_manager(telepathy_mission_control_t) + +optional_policy(` + dbus_system_bus_client(telepathy_mission_control_t) + + optional_policy(` + devicekit_dbus_chat_power(telepathy_mission_control_t) + ') + optional_policy(` + gnome_dbus_chat_gkeyringd(telepathy_mission_control_t) + ') + optional_policy(` + networkmanager_dbus_chat(telepathy_mission_control_t) + ') ') -tunable_policy(`use_samba_home_dirs',` - fs_manage_cifs_dirs(telepathy_mission_control_t) - fs_manage_cifs_files(telepathy_mission_control_t) +# ~/.cache/.mc_connections. +optional_policy(` + manage_files_pattern(telepathy_mission_control_t, telepathy_mission_control_cache_home_t, telepathy_mission_control_cache_home_t) + gnome_cache_filetrans(telepathy_mission_control_t, telepathy_mission_control_cache_home_t, file) ') ####################################### @@ -205,11 +239,13 @@ allow telepathy_msn_t self:unix_dgram_socket { write create connect }; manage_dirs_pattern(telepathy_msn_t, telepathy_msn_tmp_t, telepathy_msn_tmp_t) manage_files_pattern(telepathy_msn_t, telepathy_msn_tmp_t, telepathy_msn_tmp_t) manage_sock_files_pattern(telepathy_msn_t, telepathy_msn_tmp_t, telepathy_msn_tmp_t) +exec_files_pattern(telepathy_msn_t, telepathy_msn_tmp_t, telepathy_msn_tmp_t) files_tmp_filetrans(telepathy_msn_t, telepathy_msn_tmp_t, { dir file sock_file }) userdom_user_tmp_filetrans(telepathy_msn_t, telepathy_msn_tmp_t, { dir file sock_file }) +userdom_dontaudit_setattr_user_tmp(telepathy_msn_t) +can_exec(telepathy_msn_t, telepathy_msn_tmp_t) corenet_all_recvfrom_netlabel(telepathy_msn_t) -corenet_all_recvfrom_unlabeled(telepathy_msn_t) corenet_tcp_sendrecv_generic_if(telepathy_msn_t) corenet_tcp_sendrecv_generic_node(telepathy_msn_t) corenet_tcp_bind_generic_node(telepathy_msn_t) @@ -228,6 +264,8 @@ corecmd_read_bin_symlinks(telepathy_msn_t) files_read_etc_files(telepathy_msn_t) files_read_usr_files(telepathy_msn_t) +init_read_state(telepathy_msn_t) + libs_exec_ldconfig(telepathy_msn_t) logging_send_syslog_msg(telepathy_msn_t) @@ -246,6 +284,10 @@ tunable_policy(`telepathy_tcp_connect_generic_network_ports',` ') optional_policy(` + gnome_read_gconf_home_files(telepathy_msn_t) +') + +optional_policy(` dbus_system_bus_client(telepathy_msn_t) optional_policy(` @@ -264,7 +306,6 @@ manage_sock_files_pattern(telepathy_salut_t, telepathy_salut_tmp_t, telepathy_sa files_tmp_filetrans(telepathy_salut_t, telepathy_salut_tmp_t, sock_file) corenet_all_recvfrom_netlabel(telepathy_salut_t) -corenet_all_recvfrom_unlabeled(telepathy_salut_t) corenet_tcp_sendrecv_generic_if(telepathy_salut_t) corenet_tcp_sendrecv_generic_node(telepathy_salut_t) corenet_tcp_bind_generic_node(telepathy_salut_t) @@ -302,7 +343,6 @@ allow telepathy_sofiasip_t self:rawip_socket { create_socket_perms listen }; allow telepathy_sofiasip_t self:tcp_socket create_stream_socket_perms; corenet_all_recvfrom_netlabel(telepathy_sofiasip_t) -corenet_all_recvfrom_unlabeled(telepathy_sofiasip_t) corenet_tcp_sendrecv_generic_if(telepathy_sofiasip_t) corenet_raw_sendrecv_generic_if(telepathy_sofiasip_t) corenet_raw_sendrecv_generic_node(telepathy_sofiasip_t) @@ -361,18 +401,40 @@ allow telepathy_domain self:fifo_file rw_fifo_file_perms; allow telepathy_domain self:tcp_socket create_socket_perms; allow telepathy_domain self:udp_socket create_socket_perms; +manage_dirs_pattern(telepathy_domain, telepathy_cache_home_t, telepathy_cache_home_t) +gnome_cache_filetrans(telepathy_domain, telepathy_cache_home_t, dir, "telepathy") + dev_read_urand(telepathy_domain) kernel_read_system_state(telepathy_domain) +fs_getattr_all_fs(telepathy_domain) fs_search_auto_mountpoints(telepathy_domain) +fs_rw_inherited_tmpfs_files(telepathy_domain) -miscfiles_read_localization(telepathy_domain) optional_policy(` automount_dontaudit_getattr_tmp_dirs(telepathy_domain) ') optional_policy(` + gnome_read_generic_cache_files(telepathy_domain) + gnome_write_generic_cache_files(telepathy_domain) +') + +optional_policy(` + telepathy_dbus_chat(telepathy_domain) +') + +optional_policy(` xserver_rw_xdm_pipes(telepathy_domain) ') + +# Just for F15 +optional_policy(` + gen_require(` + role unconfined_r; + ') + + role unconfined_r types telepathy_domain; +') diff --git a/telnet.if b/telnet.if index 58e7ec0..e4119f7 100644 --- a/telnet.if +++ b/telnet.if @@ -1 +1,19 @@ ## Telnet daemon + +######################################## +## +## Read and write a telnetd domain pty. +## +## +## +## Domain allowed access. +## +## +# +interface(`telnet_use_ptys',` + gen_require(` + type telnetd_devpts_t; + ') + + allow $1 telnetd_devpts_t:chr_file rw_inherited_term_perms; +') diff --git a/telnet.te b/telnet.te index 3858d35..62dca46 100644 --- a/telnet.te +++ b/telnet.te @@ -24,21 +24,20 @@ files_pid_file(telnetd_var_run_t) # Local policy # -allow telnetd_t self:capability { fsetid chown fowner sys_tty_config dac_override }; +allow telnetd_t self:capability { fsetid chown fowner setuid setgid sys_tty_config dac_override }; allow telnetd_t self:process signal_perms; allow telnetd_t self:fifo_file rw_fifo_file_perms; allow telnetd_t self:tcp_socket connected_stream_socket_perms; allow telnetd_t self:udp_socket create_socket_perms; # for identd; cjp: this should probably only be inetd_child rules? allow telnetd_t self:netlink_tcpdiag_socket r_netlink_socket_perms; -allow telnetd_t self:capability { setuid setgid }; -allow telnetd_t telnetd_devpts_t:chr_file { rw_chr_file_perms setattr }; +allow telnetd_t telnetd_devpts_t:chr_file { rw_chr_file_perms setattr_chr_file_perms }; + term_create_pty(telnetd_t, telnetd_devpts_t) manage_dirs_pattern(telnetd_t, telnetd_tmp_t, telnetd_tmp_t) manage_files_pattern(telnetd_t, telnetd_tmp_t, telnetd_tmp_t) -files_tmp_filetrans(telnetd_t, telnetd_tmp_t, { file dir }) manage_files_pattern(telnetd_t, telnetd_var_run_t, telnetd_var_run_t) files_pid_filetrans(telnetd_t, telnetd_var_run_t, file) @@ -47,7 +46,6 @@ kernel_read_kernel_sysctls(telnetd_t) kernel_read_system_state(telnetd_t) kernel_read_network_state(telnetd_t) -corenet_all_recvfrom_unlabeled(telnetd_t) corenet_all_recvfrom_netlabel(telnetd_t) corenet_tcp_sendrecv_generic_if(telnetd_t) corenet_udp_sendrecv_generic_if(telnetd_t) @@ -68,7 +66,6 @@ auth_use_nsswitch(telnetd_t) corecmd_search_bin(telnetd_t) files_read_usr_files(telnetd_t) -files_read_etc_files(telnetd_t) files_read_etc_runtime_files(telnetd_t) # for identd; cjp: this should probably only be inetd_child rules? files_search_home(telnetd_t) @@ -77,14 +74,12 @@ init_rw_utmp(telnetd_t) logging_send_syslog_msg(telnetd_t) -miscfiles_read_localization(telnetd_t) - seutil_read_config(telnetd_t) -remotelogin_domtrans(telnetd_t) - userdom_search_user_home_dirs(telnetd_t) userdom_setattr_user_ptys(telnetd_t) +userdom_manage_user_tmp_files(telnetd_t) +userdom_tmp_filetrans_user_tmp(telnetd_t, file) tunable_policy(`use_nfs_home_dirs',` fs_search_nfs(telnetd_t) @@ -96,5 +91,10 @@ tunable_policy(`use_samba_home_dirs',` optional_policy(` kerberos_keytab_template(telnetd, telnetd_t) + kerberos_tmp_filetrans_host_rcache(telnetd_t, "host_0") kerberos_manage_host_rcache(telnetd_t) ') + +optional_policy(` + remotelogin_domtrans(telnetd_t) +') diff --git a/tftp.fc b/tftp.fc index 25eee43..621f343 100644 --- a/tftp.fc +++ b/tftp.fc @@ -1,3 +1,4 @@ +/etc/xinetd\.d/tftp -- gen_context(system_u:object_r:tftpd_etc_t,s0) /usr/sbin/atftpd -- gen_context(system_u:object_r:tftpd_exec_t,s0) /usr/sbin/in\.tftpd -- gen_context(system_u:object_r:tftpd_exec_t,s0) diff --git a/tftp.if b/tftp.if index 38bb312..0a40bc5 100644 --- a/tftp.if +++ b/tftp.if @@ -13,9 +13,33 @@ interface(`tftp_read_content',` gen_require(` type tftpdir_t; + type tftpdir_rw_t; ') read_files_pattern($1, tftpdir_t, tftpdir_t) + read_lnk_files_pattern($1, tftpdir_t, tftpdir_t) + + read_files_pattern($1, tftpdir_rw_t, tftpdir_rw_t) + read_lnk_files_pattern($1, tftpdir_rw_t, tftpdir_rw_t) +') + +######################################## +## +## Search tftp /var/lib directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`tftp_search_rw_content',` + gen_require(` + type tftpdir_rw_t; + ') + + search_dirs_pattern($1, tftpdir_rw_t, tftpdir_rw_t) + files_search_var_lib($1) ') ######################################## @@ -40,6 +64,91 @@ interface(`tftp_manage_rw_content',` ######################################## ## +## Read tftp config files. +## +## +## +## Domain allowed access. +## +## +# +interface(`tftp_read_config',` + gen_require(` + type tftpd_etc_t; + ') + + read_files_pattern($1, tftpd_etc_t, tftpd_etc_t) +') + +######################################## +## +## Manage tftp config files. +## +## +## +## Domain allowed access. +## +## +# +interface(`tftp_manage_config',` + gen_require(` + type tftpd_etc_t; + ') + + manage_files_pattern($1, tftpd_etc_t, tftpd_etc_t) + files_etc_filetrans($1, tftpd_etc_t, file, "tftp") +') + +######################################## +## +## Create objects in tftpdir directories +## with specified types. +## +## +## +## Domain allowed access. +## +## +## +## +## Private file type. +## +## +## +## +## Class of the object being created. +## +## +# +interface(`tftp_filetrans_tftpdir',` + gen_require(` + type tftpdir_rw_t; + ') + + filetrans_pattern($1, tftpdir_rw_t, $2, $3) + files_search_var_lib($1) +') + +######################################## +## +## Transition to tftp named content +## +## +## +## Domain allowed access. +## +## +# +interface(`tftp_filetrans_named_content',` + gen_require(` + type tftpd_etc_t; + ') + + files_etc_filetrans($1, tftpd_etc_t, file, "tftp") +') + +######################################## +## ## All of the rules required to administrate ## an tftp environment ## @@ -55,8 +164,13 @@ interface(`tftp_admin',` type tftpd_t, tftpdir_t, tftpdir_rw_t, tftpd_var_run_t; ') - allow $1 tftpd_t:process { ptrace signal_perms getattr }; + allow $1 tftpd_t:process signal_perms; ps_process_pattern($1, tftpd_t) + tunable_policy(`deny_ptrace',`',` + allow $1 tftpd_t:process ptrace; + ') + + files_list_var_lib($1) admin_pattern($1, tftpdir_rw_t) @@ -64,4 +178,6 @@ interface(`tftp_admin',` files_list_pids($1) admin_pattern($1, tftpd_var_run_t) + + tftp_manage_config($1) ') diff --git a/tftp.te b/tftp.te index d50c10d..44d277d 100644 --- a/tftp.te +++ b/tftp.te @@ -26,21 +26,26 @@ files_type(tftpdir_t) type tftpdir_rw_t; files_type(tftpdir_rw_t) +type tftpd_etc_t; +files_config_file(tftpd_etc_t) + ######################################## # # Local policy # allow tftpd_t self:capability { setgid setuid sys_chroot }; +dontaudit tftpd_t self:capability sys_tty_config; allow tftpd_t self:tcp_socket create_stream_socket_perms; allow tftpd_t self:udp_socket create_socket_perms; allow tftpd_t self:unix_dgram_socket create_socket_perms; allow tftpd_t self:unix_stream_socket create_stream_socket_perms; -dontaudit tftpd_t self:capability sys_tty_config; allow tftpd_t tftpdir_t:dir list_dir_perms; allow tftpd_t tftpdir_t:file read_file_perms; -allow tftpd_t tftpdir_t:lnk_file { getattr read }; +allow tftpd_t tftpdir_t:lnk_file read_lnk_file_perms; + +read_files_pattern(tftpd_t, tftpd_etc_t, tftpd_etc_t) manage_dirs_pattern(tftpd_t, tftpdir_rw_t, tftpdir_rw_t) manage_files_pattern(tftpd_t, tftpdir_rw_t, tftpdir_rw_t) @@ -52,7 +57,6 @@ files_pid_filetrans(tftpd_t, tftpd_var_run_t, file) kernel_read_system_state(tftpd_t) kernel_read_kernel_sysctls(tftpd_t) -corenet_all_recvfrom_unlabeled(tftpd_t) corenet_all_recvfrom_netlabel(tftpd_t) corenet_tcp_sendrecv_generic_if(tftpd_t) corenet_udp_sendrecv_generic_if(tftpd_t) @@ -72,7 +76,6 @@ fs_search_auto_mountpoints(tftpd_t) domain_use_interactive_fds(tftpd_t) -files_read_etc_files(tftpd_t) files_read_etc_runtime_files(tftpd_t) files_read_var_files(tftpd_t) files_read_var_symlinks(tftpd_t) @@ -82,7 +85,6 @@ auth_use_nsswitch(tftpd_t) logging_send_syslog_msg(tftpd_t) -miscfiles_read_localization(tftpd_t) miscfiles_read_public_files(tftpd_t) userdom_dontaudit_use_unpriv_user_fds(tftpd_t) @@ -94,6 +96,10 @@ tunable_policy(`tftp_anon_write',` ') optional_policy(` + cobbler_read_lib_files(tftpd_t) +') + +optional_policy(` inetd_udp_service_domain(tftpd_t, tftpd_exec_t) ') diff --git a/tgtd.fc b/tgtd.fc index 8294f6f..4847b43 100644 --- a/tgtd.fc +++ b/tgtd.fc @@ -1,3 +1,4 @@ /etc/rc\.d/init\.d/tgtd -- gen_context(system_u:object_r:tgtd_initrc_exec_t,s0) /usr/sbin/tgtd -- gen_context(system_u:object_r:tgtd_exec_t,s0) /var/lib/tgtd(/.*)? gen_context(system_u:object_r:tgtd_var_lib_t,s0) +/var/run/tgtd.* -s gen_context(system_u:object_r:tgtd_var_run_t,s0) diff --git a/tgtd.if b/tgtd.if index c2ed23a..d9e875d 100644 --- a/tgtd.if +++ b/tgtd.if @@ -44,3 +44,22 @@ interface(`tgtd_manage_semaphores',` allow $1 tgtd_t:sem create_sem_perms; ') + +###################################### +## +## Connect to tgtd using a unix domain stream socket. +## +## +## +## Domain allowed access. +## +## +# +interface(`tgtd_stream_connect',` + gen_require(` + type tgtd_t, tgtd_var_run_t; + ') + + files_search_var_lib($1) + stream_connect_pattern($1, tgtd_var_run_t, tgtd_var_run_t, tgtd_t) +') diff --git a/tgtd.te b/tgtd.te index 80fe75c..1c6e2df 100644 --- a/tgtd.te +++ b/tgtd.te @@ -21,6 +21,9 @@ files_tmpfs_file(tgtd_tmpfs_t) type tgtd_var_lib_t; files_type(tgtd_var_lib_t) +type tgtd_var_run_t; +files_pid_file(tgtd_var_run_t) + ######################################## # # TGTD personal policy. @@ -29,7 +32,7 @@ files_type(tgtd_var_lib_t) allow tgtd_t self:capability sys_resource; allow tgtd_t self:process { setrlimit signal }; allow tgtd_t self:fifo_file rw_fifo_file_perms; -allow tgtd_t self:netlink_route_socket { create_socket_perms nlmsg_read }; +allow tgtd_t self:netlink_route_socket create_netlink_socket_perms; allow tgtd_t self:shm create_shm_perms; allow tgtd_t self:sem create_sem_perms; allow tgtd_t self:tcp_socket create_stream_socket_perms; @@ -46,10 +49,15 @@ manage_dirs_pattern(tgtd_t, tgtd_var_lib_t, tgtd_var_lib_t) manage_files_pattern(tgtd_t, tgtd_var_lib_t, tgtd_var_lib_t) files_var_lib_filetrans(tgtd_t, tgtd_var_lib_t, { dir file }) +manage_dirs_pattern(tgtd_t, tgtd_var_run_t,tgtd_var_run_t) +manage_files_pattern(tgtd_t, tgtd_var_run_t,tgtd_var_run_t) +manage_sock_files_pattern(tgtd_t, tgtd_var_run_t,tgtd_var_run_t) +files_pid_filetrans(tgtd_t,tgtd_var_run_t, { file sock_file }) + +kernel_read_system_state(tgtd_t) kernel_read_fs_sysctls(tgtd_t) corenet_all_recvfrom_netlabel(tgtd_t) -corenet_all_recvfrom_unlabeled(tgtd_t) corenet_tcp_sendrecv_generic_if(tgtd_t) corenet_tcp_sendrecv_generic_node(tgtd_t) corenet_tcp_sendrecv_iscsi_port(tgtd_t) @@ -57,10 +65,16 @@ corenet_tcp_bind_generic_node(tgtd_t) corenet_tcp_bind_iscsi_port(tgtd_t) corenet_sendrecv_iscsi_server_packets(tgtd_t) +dev_read_sysfs(tgtd_t) + files_read_etc_files(tgtd_t) +fs_read_anon_inodefs_files(tgtd_t) + storage_manage_fixed_disk(tgtd_t) logging_send_syslog_msg(tgtd_t) -miscfiles_read_localization(tgtd_t) +optional_policy(` + iscsi_manage_semaphores(tgtd_t) +') diff --git a/thin.fc b/thin.fc new file mode 100644 index 0000000..7f4bce8 --- /dev/null +++ b/thin.fc @@ -0,0 +1,11 @@ +/usr/bin/thin -- gen_context(system_u:object_r:thin_exec_t,s0) + +/usr/bin/aeolus-configserver-thinwrapper -- gen_context(system_u:object_r:thin_aeolus_configserver_exec_t,s0) + +/var/lib/aeolus-configserver(/.*)? gen_context(system_u:object_r:thin_aeolus_configserver_lib_t,s0) + +/var/log/aeolus-configserver(/.*)? gen_context(system_u:object_r:thin_aeolus_configserver_log_t,s0) +/var/log/thin\.log.* -- gen_context(system_u:object_r:thin_log_t,s0) + +/var/run/aeolus-configserver(/.*)? gen_context(system_u:object_r:thin_aeolus_configserver_var_run_t,s0) +/var/run/aeolus/thin\.pid -- gen_context(system_u:object_r:thin_var_run_t,s0) diff --git a/thin.if b/thin.if new file mode 100644 index 0000000..6de86e5 --- /dev/null +++ b/thin.if @@ -0,0 +1,42 @@ +## thin policy + +####################################### +## +## Creates types and rules for a basic +## thin daemon domain. +## +## +## +## Prefix for the domain. +## +## +# +template(`thin_domain_template',` + gen_require(` + attribute thin_domain; + ') + + type $1_t, thin_domain; + type $1_exec_t; + init_daemon_domain($1_t, $1_exec_t) + + can_exec($1_t, $1_exec_t) +') + +###################################### +## +## Execute mongod in the caller domain. +## +## +## +## Domain allowed access. +## +## +# +interface(`thin_exec',` + gen_require(` + type thin_exec_t; + ') + + can_exec($1, thin_exec_t) +') diff --git a/thin.te b/thin.te new file mode 100644 index 0000000..1d3d77b --- /dev/null +++ b/thin.te @@ -0,0 +1,107 @@ +policy_module(thin, 1.0) + +######################################## +# +# Declarations +# + +attribute thin_domain; + +thin_domain_template(thin) + +type thin_log_t; +logging_log_file(thin_log_t) + +type thin_var_run_t; +files_pid_file(thin_var_run_t) + +thin_domain_template(thin_aeolus_configserver) + +type thin_aeolus_configserver_lib_t; +files_type(thin_aeolus_configserver_lib_t) + +type thin_aeolus_configserver_log_t; +logging_log_file(thin_aeolus_configserver_log_t) + +type thin_aeolus_configserver_var_run_t; +files_pid_file(thin_aeolus_configserver_var_run_t) + +######################################## +# +# thin_domain local policy +# + +allow thin_domain self:process signal; + +allow thin_domain self:fifo_file rw_fifo_file_perms; +allow thin_domain self:tcp_socket create_stream_socket_perms; + +# we want to stay in a new thin domain if we call thin binary from a script +# # initrc_t@thin_test_exec_t->thin_test_t@thin_exec_t->thin_test_t +can_exec(thin_domain, thin_exec_t) + +kernel_read_system_state(thin_domain) + +corecmd_exec_bin(thin_domain) +corecmd_exec_shell(thin_domain) + +dev_read_rand(thin_domain) +dev_read_urand(thin_domain) + +files_read_etc_files(thin_domain) + +auth_read_passwd(thin_domain) + +miscfiles_read_certs(thin_domain) + +files_read_usr_files(thin_domain) + +fs_search_auto_mountpoints(thin_domain) + +init_read_utmp(thin_domain) + +kernel_read_kernel_sysctls(thin_domain) + +optional_policy(` + sysnet_read_config(thin_domain) +') + +######################################## +# +# thin local policy +# + +allow thin_t self:capability { setuid kill setgid dac_override }; + +allow thin_t self:netlink_route_socket r_netlink_socket_perms; +allow thin_t self:udp_socket create_socket_perms; +allow thin_t self:unix_stream_socket create_stream_socket_perms; + +manage_files_pattern(thin_t, thin_log_t, thin_log_t) +manage_dirs_pattern(thin_t, thin_log_t, thin_log_t) +logging_log_filetrans(thin_t, thin_log_t, { file dir }) + +manage_files_pattern(thin_t, thin_var_run_t, thin_var_run_t) +files_pid_filetrans(thin_t, thin_var_run_t, { file }) + +corenet_tcp_bind_generic_node(thin_t) +corenet_tcp_bind_ntop_port(thin_t) +corenet_tcp_connect_postgresql_port(thin_t) + + +####################################### +# +# thin aeolus configserver local policy +# + +manage_files_pattern(thin_aeolus_configserver_t, thin_aeolus_configserver_lib_t, thin_aeolus_configserver_lib_t) +manage_dirs_pattern(thin_aeolus_configserver_t, thin_aeolus_configserver_lib_t, thin_aeolus_configserver_lib_t) +files_var_lib_filetrans(thin_aeolus_configserver_t, thin_aeolus_configserver_lib_t, { file dir }) + +manage_files_pattern(thin_aeolus_configserver_t, thin_aeolus_configserver_log_t, thin_aeolus_configserver_log_t) +manage_dirs_pattern(thin_aeolus_configserver_t, thin_aeolus_configserver_log_t, thin_aeolus_configserver_log_t) +logging_log_filetrans(thin_aeolus_configserver_t, thin_aeolus_configserver_log_t, { file dir }) + +manage_files_pattern(thin_aeolus_configserver_t, thin_aeolus_configserver_var_run_t, thin_aeolus_configserver_var_run_t) +manage_dirs_pattern(thin_aeolus_configserver_t, thin_aeolus_configserver_var_run_t, thin_aeolus_configserver_var_run_t) +files_pid_filetrans(thin_aeolus_configserver_t, thin_aeolus_configserver_var_run_t, { dir file }) diff --git a/thumb.fc b/thumb.fc new file mode 100644 index 0000000..17544ee --- /dev/null +++ b/thumb.fc @@ -0,0 +1,16 @@ +HOME_DIR/\.thumbnails(/.*)? gen_context(system_u:object_r:thumb_home_t,s0) +HOME_DIR/.cache/thumbnails(/.*)? gen_context(system_u:object_r:thumb_home_t,s0) +HOME_DIR/missfont\.log.* gen_context(system_u:object_r:thumb_home_t,s0) + +/usr/bin/evince-thumbnailer -- gen_context(system_u:object_r:thumb_exec_t,s0) +/usr/bin/gsf-office-thumbnailer -- gen_context(system_u:object_r:thumb_exec_t,s0) +/usr/bin/gnome-thumbnail-font -- gen_context(system_u:object_r:thumb_exec_t,s0) +/usr/bin/gnome-[^/]*-thumbnailer(.sh)? -- gen_context(system_u:object_r:thumb_exec_t,s0) +/usr/bin/raw-thumbnailer -- gen_context(system_u:object_r:thumb_exec_t,s0) +/usr/bin/shotwell-video-thumbnailer -- gen_context(system_u:object_r:thumb_exec_t,s0) +/usr/bin/totem-video-thumbnailer -- gen_context(system_u:object_r:thumb_exec_t,s0) +/usr/bin/whaaw-thumbnailer -- gen_context(system_u:object_r:thumb_exec_t,s0) +/usr/bin/[^/]*thumbnailer -- gen_context(system_u:object_r:thumb_exec_t,s0) +/usr/bin/ffmpegthumbnailer -- gen_context(system_u:object_r:thumb_exec_t,s0) + +/usr/lib/tumbler[^/]*/tumblerd -- gen_context(system_u:object_r:thumb_exec_t,s0) diff --git a/thumb.if b/thumb.if new file mode 100644 index 0000000..9127cec --- /dev/null +++ b/thumb.if @@ -0,0 +1,125 @@ + +## policy for thumb + +######################################## +## +## Transition to thumb. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`thumb_domtrans',` + gen_require(` + type thumb_t, thumb_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, thumb_exec_t, thumb_t) +') + + +######################################## +## +## Execute thumb in the thumb domain, and +## allow the specified role the thumb domain. +## +## +## +## Domain allowed to transition +## +## +## +## +## The role to be allowed the thumb domain. +## +## +# +interface(`thumb_run',` + gen_require(` + type thumb_t; + ') + + thumb_domtrans($1) + role $2 types thumb_t; + + allow $1 thumb_t:process signal; +') + +######################################## +## +## Role access for thumb +## +## +## +## Role allowed access +## +## +## +## +## User domain for the role +## +## +# +interface(`thumb_role',` + gen_require(` + type thumb_t; + class dbus send_msg; + ') + + role $1 types thumb_t; + + thumb_domtrans($2) + + ps_process_pattern($2, thumb_t) + allow $2 thumb_t:process signal; + allow thumb_t $2:unix_stream_socket connectto; + + allow $2 thumb_t:dbus send_msg; + allow thumb_t $2:dbus send_msg; + thumb_filetrans_home_content($2) +') + +######################################## +## +## Send and receive messages from +## thumb over dbus. +## +## +## +## Domain allowed access. +## +## +# +interface(`thumb_dbus_chat',` + gen_require(` + type thumb_t; + class dbus send_msg; + ') + + allow $1 thumb_t:dbus send_msg; + allow thumb_t $1:dbus send_msg; +') + +######################################## +## +## Create thumb content in the user home directory +## with an correct label. +## +## +## +## Domain allowed access. +## +## +# +interface(`thumb_filetrans_home_content',` + + gen_require(` + type thumb_home_t; + ') + + userdom_user_home_dir_filetrans($1, thumb_home_t, dir, ".thumbnails") + userdom_user_home_dir_filetrans($1, thumb_home_t, file, "missfont.log") +') diff --git a/thumb.te b/thumb.te new file mode 100644 index 0000000..792c967 --- /dev/null +++ b/thumb.te @@ -0,0 +1,120 @@ +policy_module(thumb, 1.0.0) + +######################################## +# +# Declarations +# + +type thumb_t; +type thumb_exec_t; +application_domain(thumb_t, thumb_exec_t) +ubac_constrained(thumb_t) +userdom_home_manager(thumb_t) + +type thumb_tmp_t; +files_tmp_file(thumb_tmp_t) +ubac_constrained(thumb_tmp_t) + +type thumb_home_t; +userdom_user_home_content(thumb_home_t) + +type thumb_tmpfs_t; +files_tmpfs_file(thumb_tmpfs_t) + +######################################## +# +# thumb local policy +# + +allow thumb_t self:process { setsched signal setrlimit }; + +tunable_policy(`deny_execmem',`',` + allow thumb_t self:process execmem; +') + +allow thumb_t self:fifo_file manage_fifo_file_perms; +allow thumb_t self:unix_stream_socket create_stream_socket_perms; +allow thumb_t self:netlink_route_socket r_netlink_socket_perms; +allow thumb_t self:udp_socket create_socket_perms; +allow thumb_t self:tcp_socket create_socket_perms; +allow thumb_t self:shm create_shm_perms; +allow thumb_t self:sem create_sem_perms; + +manage_dirs_pattern(thumb_t, thumb_home_t, thumb_home_t) +manage_files_pattern(thumb_t, thumb_home_t, thumb_home_t) +userdom_user_home_dir_filetrans(thumb_t, thumb_home_t, dir, ".thumbnails") +userdom_user_home_dir_filetrans(thumb_t, thumb_home_t, file, "missfont.log") + +manage_files_pattern(thumb_t, thumb_tmp_t, thumb_tmp_t) +manage_dirs_pattern(thumb_t, thumb_tmp_t, thumb_tmp_t) +manage_sock_files_pattern(thumb_t, thumb_tmp_t, thumb_tmp_t) +exec_files_pattern(thumb_t, thumb_tmp_t, thumb_tmp_t) +files_tmp_filetrans(thumb_t, thumb_tmp_t, { file dir sock_file }) +userdom_user_tmp_filetrans(thumb_t, thumb_tmp_t, { file dir sock_file }) +xserver_xdm_tmp_filetrans(thumb_t, thumb_tmp_t, sock_file) + +manage_dirs_pattern(thumb_t, thumb_tmpfs_t, thumb_tmpfs_t) +manage_files_pattern(thumb_t, thumb_tmpfs_t, thumb_tmpfs_t) +fs_tmpfs_filetrans(thumb_t, thumb_tmpfs_t, { dir file }) + +can_exec(thumb_t, thumb_exec_t) + +kernel_read_system_state(thumb_t) + +domain_use_interactive_fds(thumb_t) + +corecmd_exec_bin(thumb_t) +corecmd_exec_shell(thumb_t) + +dev_read_sysfs(thumb_t) +dev_read_urand(thumb_t) +dev_dontaudit_rw_dri(thumb_t) +dev_rw_xserver_misc(thumb_t) + +domain_use_interactive_fds(thumb_t) + +files_read_usr_files(thumb_t) +files_read_non_security_files(thumb_t) + +fs_getattr_all_fs(thumb_t) +fs_read_dos_files(thumb_t) +fs_rw_inherited_tmpfs_files(thumb_t) + +auth_use_nsswitch(thumb_t) + +tunable_policy(`selinuxuser_execmod',` + libs_legacy_use_shared_libs(thumb_t) +') + +miscfiles_read_fonts(thumb_t) + +sysnet_read_config(thumb_t) + +userdom_read_user_tmp_files(thumb_t) +userdom_read_user_home_content_files(thumb_t) +userdom_write_user_tmp_files(thumb_t) +userdom_read_home_audio_files(thumb_t) +userdom_home_reader(thumb_t) + +userdom_use_user_terminals(thumb_t) + +xserver_read_xdm_home_files(thumb_t) +xserver_append_xdm_home_files(thumb_t) +xserver_dontaudit_read_xdm_pid(thumb_t) +xserver_dontaudit_xdm_tmp_dirs(thumb_t) +xserver_stream_connect(thumb_t) + +optional_policy(` + dbus_dontaudit_stream_connect_session_bus(thumb_t) + dbus_dontaudit_chat_session_bus(thumb_t) +') + +optional_policy(` + # .config + gnome_dontaudit_search_config(thumb_t) + gnome_read_generic_data_home_files(thumb_t) + gnome_manage_gstreamer_home_files(thumb_t) + gnome_manage_gstreamer_home_dirs(thumb_t) + gnome_exec_gstreamer_home_files(thumb_t) + gnome_cache_filetrans(thumb_t, thumb_home_t, dir, "thumbnails") +') diff --git a/thunderbird.te b/thunderbird.te index bf37d98..0d863fc 100644 --- a/thunderbird.te +++ b/thunderbird.te @@ -54,7 +54,6 @@ kernel_read_system_state(thunderbird_t) # Startup shellscript corecmd_exec_shell(thunderbird_t) -corenet_all_recvfrom_unlabeled(thunderbird_t) corenet_all_recvfrom_netlabel(thunderbird_t) corenet_tcp_sendrecv_generic_if(thunderbird_t) corenet_tcp_sendrecv_generic_node(thunderbird_t) @@ -82,7 +81,6 @@ dev_dontaudit_search_sysfs(thunderbird_t) files_list_tmp(thunderbird_t) files_read_usr_files(thunderbird_t) -files_read_etc_files(thunderbird_t) files_read_etc_runtime_files(thunderbird_t) files_read_var_files(thunderbird_t) files_read_var_symlinks(thunderbird_t) @@ -99,7 +97,6 @@ fs_search_auto_mountpoints(thunderbird_t) auth_use_nsswitch(thunderbird_t) miscfiles_read_fonts(thunderbird_t) -miscfiles_read_localization(thunderbird_t) userdom_manage_user_tmp_dirs(thunderbird_t) userdom_read_user_tmp_files(thunderbird_t) @@ -112,17 +109,7 @@ xserver_read_xdm_tmp_files(thunderbird_t) xserver_dontaudit_getattr_xdm_tmp_sockets(thunderbird_t) # Access ~/.thunderbird -tunable_policy(`use_nfs_home_dirs',` - fs_manage_nfs_dirs(thunderbird_t) - fs_manage_nfs_files(thunderbird_t) - fs_manage_nfs_symlinks(thunderbird_t) -') - -tunable_policy(`use_samba_home_dirs',` - fs_manage_cifs_dirs(thunderbird_t) - fs_manage_cifs_files(thunderbird_t) - fs_manage_cifs_symlinks(thunderbird_t) -') +userdom_home_manager(thunderbird_t) tunable_policy(`mail_read_content && use_nfs_home_dirs',` files_list_home(thunderbird_t) diff --git a/timidity.te b/timidity.te index 67b5592..ccddff5 100644 --- a/timidity.te +++ b/timidity.te @@ -39,7 +39,6 @@ kernel_read_kernel_sysctls(timidity_t) # read /proc/cpuinfo kernel_read_system_state(timidity_t) -corenet_all_recvfrom_unlabeled(timidity_t) corenet_all_recvfrom_netlabel(timidity_t) corenet_tcp_sendrecv_generic_if(timidity_t) corenet_udp_sendrecv_generic_if(timidity_t) diff --git a/tmpreaper.te b/tmpreaper.te index 0521d5a..45d8032 100644 --- a/tmpreaper.te +++ b/tmpreaper.te @@ -7,6 +7,7 @@ policy_module(tmpreaper, 1.6.0) type tmpreaper_t; type tmpreaper_exec_t; +init_system_domain(tmpreaper_t, tmpreaper_exec_t) application_domain(tmpreaper_t, tmpreaper_exec_t) role system_r types tmpreaper_t; @@ -18,33 +19,47 @@ role system_r types tmpreaper_t; allow tmpreaper_t self:process { fork sigchld }; allow tmpreaper_t self:capability { dac_override dac_read_search fowner }; +kernel_read_system_state(tmpreaper_t) + dev_read_urand(tmpreaper_t) fs_getattr_xattr_fs(tmpreaper_t) +fs_list_all(tmpreaper_t) -files_read_etc_files(tmpreaper_t) files_read_var_lib_files(tmpreaper_t) files_purge_tmp(tmpreaper_t) +files_delete_all_non_security_files(tmpreaper_t) # why does it need setattr? files_setattr_all_tmp_dirs(tmpreaper_t) +files_setattr_usr_dirs(tmpreaper_t) files_getattr_all_dirs(tmpreaper_t) files_getattr_all_files(tmpreaper_t) +kernel_list_unlabeled(tmpreaper_t) +kernel_delete_unlabeled(tmpreaper_t) +mcs_file_read_all(tmpreaper_t) +mcs_file_write_all(tmpreaper_t) mls_file_read_all_levels(tmpreaper_t) mls_file_write_all_levels(tmpreaper_t) +auth_use_nsswitch(tmpreaper_t) + logging_send_syslog_msg(tmpreaper_t) -miscfiles_read_localization(tmpreaper_t) miscfiles_delete_man_pages(tmpreaper_t) -cron_system_entry(tmpreaper_t, tmpreaper_exec_t) +optional_policy(` + cron_system_entry(tmpreaper_t, tmpreaper_exec_t) +') ifdef(`distro_redhat',` userdom_list_user_home_content(tmpreaper_t) - userdom_delete_user_home_content_dirs(tmpreaper_t) - userdom_delete_user_home_content_files(tmpreaper_t) - userdom_delete_user_home_content_symlinks(tmpreaper_t) + userdom_list_admin_dir(tmpreaper_t) + userdom_delete_all_user_home_content_dirs(tmpreaper_t) + userdom_delete_all_user_home_content_files(tmpreaper_t) + userdom_delete_all_user_home_content_sock_files(tmpreaper_t) + userdom_delete_all_user_home_content_symlinks(tmpreaper_t) + userdom_setattr_all_user_home_content_dirs(tmpreaper_t) ') optional_policy(` @@ -52,7 +67,9 @@ optional_policy(` ') optional_policy(` + apache_delete_sys_content_rw(tmpreaper_t) apache_list_cache(tmpreaper_t) + apache_delete_cache_dirs(tmpreaper_t) apache_delete_cache_files(tmpreaper_t) apache_setattr_cache_dirs(tmpreaper_t) ') @@ -66,9 +83,13 @@ optional_policy(` ') optional_policy(` - rpm_manage_cache(tmpreaper_t) + sandbox_list(tmpreaper_t) + sandbox_delete_dirs(tmpreaper_t) + sandbox_delete_files(tmpreaper_t) + sandbox_delete_sock_files(tmpreaper_t) + sandbox_setattr_dirs(tmpreaper_t) ') optional_policy(` - unconfined_domain(tmpreaper_t) + rpm_manage_cache(tmpreaper_t) ') diff --git a/tomcat.fc b/tomcat.fc new file mode 100644 index 0000000..a8385bc --- /dev/null +++ b/tomcat.fc @@ -0,0 +1,11 @@ +/usr/lib/systemd/system/tomcat.service -- gen_context(system_u:object_r:tomcat_unit_file_t,s0) + +/usr/sbin/tomcat(6)? -- gen_context(system_u:object_r:tomcat_exec_t,s0) + +/var/cache/tomcat6?(/.*)? gen_context(system_u:object_r:tomcat_cache_t,s0) + +/var/lib/tomcat6?(/.*)? gen_context(system_u:object_r:tomcat_var_lib_t,s0) + +/var/log/tomcat6?(/.*)? gen_context(system_u:object_r:tomcat_log_t,s0) + +/var/run/tomcat6?\.pid -- gen_context(system_u:object_r:tomcat_var_run_t,s0) diff --git a/tomcat.if b/tomcat.if new file mode 100644 index 0000000..56f9936 --- /dev/null +++ b/tomcat.if @@ -0,0 +1,352 @@ + +## policy for tomcat + +###################################### +## +## Creates types and rules for a basic +## tomcat daemon domain. +## +## +## +## Prefix for the domain. +## +## +# +template(`tomcat_domain_template',` + gen_require(` + attribute tomcat_domain; + ') + + type $1_t, tomcat_domain; + type $1_exec_t; + init_daemon_domain($1_t, $1_exec_t) + + can_exec($1_t, $1_exec_t) + +') + +######################################## +## +## Transition to tomcat. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`tomcat_domtrans',` + gen_require(` + type tomcat_t, tomcat_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, tomcat_exec_t, tomcat_t) +') + +######################################## +## +## Search tomcat cache directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`tomcat_search_cache',` + gen_require(` + type tomcat_cache_t; + ') + + allow $1 tomcat_cache_t:dir search_dir_perms; + files_search_var($1) +') + +######################################## +## +## Read tomcat cache files. +## +## +## +## Domain allowed access. +## +## +# +interface(`tomcat_read_cache_files',` + gen_require(` + type tomcat_cache_t; + ') + + files_search_var($1) + read_files_pattern($1, tomcat_cache_t, tomcat_cache_t) +') + +######################################## +## +## Create, read, write, and delete +## tomcat cache files. +## +## +## +## Domain allowed access. +## +## +# +interface(`tomcat_manage_cache_files',` + gen_require(` + type tomcat_cache_t; + ') + + files_search_var($1) + manage_files_pattern($1, tomcat_cache_t, tomcat_cache_t) +') + +######################################## +## +## Manage tomcat cache dirs. +## +## +## +## Domain allowed access. +## +## +# +interface(`tomcat_manage_cache_dirs',` + gen_require(` + type tomcat_cache_t; + ') + + files_search_var($1) + manage_dirs_pattern($1, tomcat_cache_t, tomcat_cache_t) +') + +######################################## +## +## Read tomcat's log files. +## +## +## +## Domain allowed access. +## +## +## +# +interface(`tomcat_read_log',` + gen_require(` + type tomcat_log_t; + ') + + logging_search_logs($1) + read_files_pattern($1, tomcat_log_t, tomcat_log_t) +') + +######################################## +## +## Append to tomcat log files. +## +## +## +## Domain allowed access. +## +## +# +interface(`tomcat_append_log',` + gen_require(` + type tomcat_log_t; + ') + + logging_search_logs($1) + append_files_pattern($1, tomcat_log_t, tomcat_log_t) +') + +######################################## +## +## Manage tomcat log files +## +## +## +## Domain allowed access. +## +## +# +interface(`tomcat_manage_log',` + gen_require(` + type tomcat_log_t; + ') + + logging_search_logs($1) + manage_dirs_pattern($1, tomcat_log_t, tomcat_log_t) + manage_files_pattern($1, tomcat_log_t, tomcat_log_t) + manage_lnk_files_pattern($1, tomcat_log_t, tomcat_log_t) +') + +######################################## +## +## Search tomcat lib directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`tomcat_search_lib',` + gen_require(` + type tomcat_var_lib_t; + ') + + allow $1 tomcat_var_lib_t:dir search_dir_perms; + files_search_var_lib($1) +') + +######################################## +## +## Read tomcat lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`tomcat_read_lib_files',` + gen_require(` + type tomcat_var_lib_t; + ') + + files_search_var_lib($1) + read_files_pattern($1, tomcat_var_lib_t, tomcat_var_lib_t) +') + +######################################## +## +## Manage tomcat lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`tomcat_manage_lib_files',` + gen_require(` + type tomcat_var_lib_t; + ') + + files_search_var_lib($1) + manage_files_pattern($1, tomcat_var_lib_t, tomcat_var_lib_t) +') + +######################################## +## +## Manage tomcat lib directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`tomcat_manage_lib_dirs',` + gen_require(` + type tomcat_var_lib_t; + ') + + files_search_var_lib($1) + manage_dirs_pattern($1, tomcat_var_lib_t, tomcat_var_lib_t) +') + +######################################## +## +## Read tomcat PID files. +## +## +## +## Domain allowed access. +## +## +# +interface(`tomcat_read_pid_files',` + gen_require(` + type tomcat_var_run_t; + ') + + files_search_pids($1) + allow $1 tomcat_var_run_t:file read_file_perms; +') + +######################################## +## +## Execute tomcat server in the tomcat domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`tomcat_systemctl',` + gen_require(` + type tomcat_t; + type tomcat_unit_file_t; + ') + + systemd_exec_systemctl($1) + allow $1 tomcat_unit_file_t:file read_file_perms; + allow $1 tomcat_unit_file_t:service manage_service_perms; + + ps_process_pattern($1, tomcat_t) +') + + +######################################## +## +## All of the rules required to administrate +## an tomcat environment +## +## +## +## Domain allowed access. +## +## +## +## +## Role allowed access. +## +## +## +# +interface(`tomcat_admin',` + gen_require(` + type tomcat_t; + type tomcat_cache_t; + type tomcat_log_t; + type tomcat_var_lib_t; + type tomcat_var_run_t; + type tomcat_unit_file_t; + ') + + allow $1 tomcat_t:process { ptrace signal_perms }; + ps_process_pattern($1, tomcat_t) + + files_search_var($1) + admin_pattern($1, tomcat_cache_t) + + logging_search_logs($1) + admin_pattern($1, tomcat_log_t) + + files_search_var_lib($1) + admin_pattern($1, tomcat_var_lib_t) + + files_search_pids($1) + admin_pattern($1, tomcat_var_run_t) + + tomcat_systemctl($1) + admin_pattern($1, tomcat_unit_file_t) + allow $1 tomcat_unit_file_t:service all_service_perms; + optional_policy(` + systemd_passwd_agent_exec($1) + systemd_read_fifo_file_passwd_run($1) + ') +') diff --git a/tomcat.te b/tomcat.te new file mode 100644 index 0000000..33d6bab --- /dev/null +++ b/tomcat.te @@ -0,0 +1,107 @@ +policy_module(tomcat, 1.0.0) + +######################################## +# +# Declarations +# + +attribute tomcat_domain; + +tomcat_domain_template(tomcat) + +type tomcat_cache_t; +files_type(tomcat_cache_t) + +type tomcat_log_t; +logging_log_file(tomcat_log_t) + +type tomcat_var_lib_t; +files_type(tomcat_var_lib_t) + +type tomcat_var_run_t; +files_pid_file(tomcat_var_run_t) + +type tomcat_tmp_t; +files_tmp_file(tomcat_tmp_t) + +type tomcat_unit_file_t; +systemd_unit_file(tomcat_unit_file_t) + +####################################### +# +# tomcat local policy +# + +optional_policy(` + unconfined_domain(tomcat_t) +') + +######################################## +# +# tomcat domain local policy +# + +allow tomcat_t self:process execmem; +allow tomcat_t self:process { signal signull }; + +allow tomcat_t self:tcp_socket { accept listen }; +allow tomcat_domain self:fifo_file rw_fifo_file_perms; +allow tomcat_domain self:unix_stream_socket create_stream_socket_perms; + +manage_dirs_pattern(tomcat_domain, tomcat_cache_t, tomcat_cache_t) +manage_files_pattern(tomcat_domain, tomcat_cache_t, tomcat_cache_t) +manage_lnk_files_pattern(tomcat_domain, tomcat_cache_t, tomcat_cache_t) +files_var_filetrans(tomcat_domain, tomcat_cache_t, { dir file }) + +manage_dirs_pattern(tomcat_domain, tomcat_log_t, tomcat_log_t) +manage_files_pattern(tomcat_domain, tomcat_log_t, tomcat_log_t) +logging_log_filetrans(tomcat_domain, tomcat_log_t, { dir file }) + +manage_dirs_pattern(tomcat_domain, tomcat_var_lib_t, tomcat_var_lib_t) +manage_files_pattern(tomcat_domain, tomcat_var_lib_t, tomcat_var_lib_t) +files_var_lib_filetrans(tomcat_domain, tomcat_var_lib_t, { dir file }) + +manage_dirs_pattern(tomcat_domain, tomcat_var_run_t, tomcat_var_run_t) +manage_files_pattern(tomcat_domain, tomcat_var_run_t, tomcat_var_run_t) +files_pid_filetrans(tomcat_domain, tomcat_var_run_t, { dir file }) + +manage_dirs_pattern(tomcat_t, tomcat_tmp_t, tomcat_tmp_t) +manage_files_pattern(tomcat_t, tomcat_tmp_t, tomcat_tmp_t) +manage_fifo_files_pattern(tomcat_t, tomcat_tmp_t, tomcat_tmp_t) +files_tmp_filetrans(tomcat_t, tomcat_tmp_t, { file fifo_file dir }) + +# we want to stay in a new tomcat domain if we call tomcat binary from a script +# initrc_t@tomcat_test_exec_t->tomcat_test_t@tomcat_exec_t->tomcat_test_t +can_exec(tomcat_domain, tomcat_exec_t) + +kernel_read_system_state(tomcat_domain) +kernel_read_network_state(tomcat_domain) + +corecmd_exec_bin(tomcat_domain) +corecmd_exec_shell(tomcat_domain) + +corenet_tcp_bind_generic_node(tomcat_domain) +corenet_udp_bind_generic_node(tomcat_domain) +corenet_tcp_bind_http_port(tomcat_domain) +corenet_tcp_bind_http_cache_port(tomcat_domain) +corenet_tcp_bind_mxi_port(tomcat_domain) +corenet_tcp_connect_http_port(tomcat_domain) +corenet_tcp_connect_mxi_port(tomcat_domain) + +dev_read_rand(tomcat_domain) +dev_read_urand(tomcat_domain) +dev_read_sysfs(tomcat_domain) + +domain_use_interactive_fds(tomcat_domain) + +fs_getattr_all_fs(tomcat_domain) +fs_read_hugetlbfs_files(tomcat_domain) + +files_read_etc_files(tomcat_domain) +files_read_usr_files(tomcat_domain) + +auth_read_passwd(tomcat_domain) + + +sysnet_dns_name_resolve(tomcat_domain) + diff --git a/tor.fc b/tor.fc index e2e06b2..6752bc3 100644 --- a/tor.fc +++ b/tor.fc @@ -4,6 +4,8 @@ /usr/bin/tor -- gen_context(system_u:object_r:tor_exec_t,s0) /usr/sbin/tor -- gen_context(system_u:object_r:tor_exec_t,s0) +/usr/lib/systemd/system/tor.* -- gen_context(system_u:object_r:tor_unit_file_t,s0) + /var/lib/tor(/.*)? gen_context(system_u:object_r:tor_var_lib_t,s0) /var/lib/tor-data(/.*)? gen_context(system_u:object_r:tor_var_lib_t,s0) diff --git a/tor.if b/tor.if index 904f13e..5801347 100644 --- a/tor.if +++ b/tor.if @@ -18,6 +18,29 @@ interface(`tor_domtrans',` domtrans_pattern($1, tor_exec_t, tor_t) ') +####################################### +## +## Execute tor server in the tor domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`tor_systemctl',` + gen_require(` + type tor_t; + type tor_unit_file_t; + ') + + systemd_exec_systemctl($1) + allow $1 tor_unit_file_t:file read_file_perms; + allow $1 tor_unit_file_t:service manage_service_perms; + + ps_process_pattern($1, tor_t) +') + ######################################## ## ## All of the rules required to administrate @@ -40,10 +63,14 @@ interface(`tor_admin',` type tor_t, tor_var_log_t, tor_etc_t; type tor_var_lib_t, tor_var_run_t; type tor_initrc_exec_t; + type tor_unit_file_t; ') - allow $1 tor_t:process { ptrace signal_perms getattr }; + allow $1 tor_t:process signal_perms; ps_process_pattern($1, tor_t) + tunable_policy(`deny_ptrace',`',` + allow $1 tor_t:process ptrace; + ') init_labeled_script_domtrans($1, tor_initrc_exec_t) domain_system_change_exemption($1) @@ -61,4 +88,13 @@ interface(`tor_admin',` files_list_pids($1) admin_pattern($1, tor_var_run_t) + + tor_systemctl($1) + admin_pattern($1, tor_unit_file_t) + allow $1 tor_unit_file_t:service all_service_perms; + + optional_policy(` + systemd_passwd_agent_exec($1) + systemd_read_fifo_file_passwd_run($1) + ') ') diff --git a/tor.te b/tor.te index c842cad..a0c42c1 100644 --- a/tor.te +++ b/tor.te @@ -36,12 +36,16 @@ logging_log_file(tor_var_log_t) type tor_var_run_t; files_pid_file(tor_var_run_t) +type tor_unit_file_t; +systemd_unit_file(tor_unit_file_t) + ######################################## # # tor local policy # allow tor_t self:capability { setgid setuid sys_tty_config }; +allow tor_t self:process signal; allow tor_t self:fifo_file rw_fifo_file_perms; allow tor_t self:unix_stream_socket create_stream_socket_perms; allow tor_t self:netlink_route_socket r_netlink_socket_perms; @@ -73,9 +77,9 @@ manage_sock_files_pattern(tor_t, tor_var_run_t, tor_var_run_t) files_pid_filetrans(tor_t, tor_var_run_t, { dir file sock_file }) kernel_read_system_state(tor_t) +kernel_read_net_sysctls(tor_t) # networking basics -corenet_all_recvfrom_unlabeled(tor_t) corenet_all_recvfrom_netlabel(tor_t) corenet_tcp_sendrecv_generic_if(tor_t) corenet_udp_sendrecv_generic_if(tor_t) @@ -87,6 +91,7 @@ corenet_tcp_sendrecv_all_reserved_ports(tor_t) corenet_tcp_bind_generic_node(tor_t) corenet_udp_bind_generic_node(tor_t) corenet_tcp_bind_tor_port(tor_t) +corenet_tcp_bind_tor_socks_port(tor_t) corenet_udp_bind_dns_port(tor_t) corenet_sendrecv_tor_server_packets(tor_t) corenet_sendrecv_dns_server_packets(tor_t) @@ -95,13 +100,14 @@ corenet_tcp_connect_all_ports(tor_t) corenet_sendrecv_all_client_packets(tor_t) # ... especially including port 80 and other privileged ports corenet_tcp_connect_all_reserved_ports(tor_t) +corenet_udp_bind_dns_port(tor_t) # tor uses crypto and needs random dev_read_urand(tor_t) +dev_read_sysfs(tor_t) domain_use_interactive_fds(tor_t) -files_read_etc_files(tor_t) files_read_etc_runtime_files(tor_t) files_read_usr_files(tor_t) @@ -109,8 +115,6 @@ auth_use_nsswitch(tor_t) logging_send_syslog_msg(tor_t) -miscfiles_read_localization(tor_t) - tunable_policy(`tor_bind_all_unreserved_ports', ` corenet_tcp_bind_all_unreserved_ports(tor_t) ') diff --git a/transproxy.te b/transproxy.te index 95cf0c0..f191f8a 100644 --- a/transproxy.te +++ b/transproxy.te @@ -29,7 +29,6 @@ kernel_read_kernel_sysctls(transproxy_t) kernel_list_proc(transproxy_t) kernel_read_proc_symlinks(transproxy_t) -corenet_all_recvfrom_unlabeled(transproxy_t) corenet_all_recvfrom_netlabel(transproxy_t) corenet_tcp_sendrecv_generic_if(transproxy_t) corenet_tcp_sendrecv_generic_node(transproxy_t) @@ -49,8 +48,6 @@ fs_search_auto_mountpoints(transproxy_t) logging_send_syslog_msg(transproxy_t) -miscfiles_read_localization(transproxy_t) - sysnet_read_config(transproxy_t) userdom_dontaudit_use_unpriv_user_fds(transproxy_t) diff --git a/tripwire.te b/tripwire.te index 2ae8b62..bfe64af 100644 --- a/tripwire.te +++ b/tripwire.te @@ -80,7 +80,7 @@ files_getattr_all_sockets(tripwire_t) logging_send_syslog_msg(tripwire_t) -userdom_use_user_terminals(tripwire_t) +userdom_use_inherited_user_terminals(tripwire_t) optional_policy(` cron_system_entry(tripwire_t, tripwire_exec_t) @@ -99,9 +99,7 @@ domain_use_interactive_fds(twadmin_t) logging_send_syslog_msg(twadmin_t) -miscfiles_read_localization(twadmin_t) - -userdom_use_user_terminals(twadmin_t) +userdom_use_inherited_user_terminals(twadmin_t) ######################################## # @@ -125,9 +123,7 @@ domain_use_interactive_fds(twprint_t) logging_send_syslog_msg(twprint_t) -miscfiles_read_localization(twprint_t) - -userdom_use_user_terminals(twprint_t) +userdom_use_inherited_user_terminals(twprint_t) ######################################## # @@ -141,6 +137,4 @@ files_read_all_files(siggen_t) logging_send_syslog_msg(siggen_t) -miscfiles_read_localization(siggen_t) - -userdom_use_user_terminals(siggen_t) +userdom_use_inherited_user_terminals(siggen_t) diff --git a/tuned.fc b/tuned.fc index 639c962..e789b2e 100644 --- a/tuned.fc +++ b/tuned.fc @@ -1,8 +1,12 @@ /etc/rc\.d/init\.d/tuned -- gen_context(system_u:object_r:tuned_initrc_exec_t,s0) +/etc/tuned(/.)? gen_context(system_u:object_r:tuned_etc_t,s0) +/etc/tuned/active_profile -- gen_context(system_u:object_r:tuned_rw_etc_t,s0) + /usr/sbin/tuned -- gen_context(system_u:object_r:tuned_exec_t,s0) /var/log/tuned(/.*)? gen_context(system_u:object_r:tuned_log_t,s0) -/var/log/tuned\.log -- gen_context(system_u:object_r:tuned_log_t,s0) +/var/log/tuned\.log.* -- gen_context(system_u:object_r:tuned_log_t,s0) +/var/run/tuned(/.*)? gen_context(system_u:object_r:tuned_var_run_t,s0) /var/run/tuned\.pid -- gen_context(system_u:object_r:tuned_var_run_t,s0) diff --git a/tuned.if b/tuned.if index 54b8605..a04f013 100644 --- a/tuned.if +++ b/tuned.if @@ -5,9 +5,9 @@ ## Execute a domain transition to run tuned. ## ## -## +## ## Domain allowed to transition. -## +## ## # interface(`tuned_domtrans',` @@ -112,18 +112,20 @@ interface(`tuned_initrc_domtrans',` # interface(`tuned_admin',` gen_require(` - type tuned_t, tuned_var_run_t; - type tuned_initrc_exec_t; + type tuned_t, tuned_var_run_t, tuned_initrc_exec_t; ') - allow $1 tuned_t:process { ptrace signal_perms }; + allow $1 tuned_t:process signal_perms; ps_process_pattern($1, tuned_t) + tunable_policy(`deny_ptrace',`',` + allow $1 tuned_t:process ptrace; + ') tuned_initrc_domtrans($1) domain_system_change_exemption($1) role_transition $2 tuned_initrc_exec_t system_r; allow $2 system_r; - files_search_pids($1) + files_list_pids($1) admin_pattern($1, tuned_var_run_t) ') diff --git a/tuned.te b/tuned.te index db9d2a5..3a15a1c 100644 --- a/tuned.te +++ b/tuned.te @@ -12,6 +12,12 @@ init_daemon_domain(tuned_t, tuned_exec_t) type tuned_initrc_exec_t; init_script_file(tuned_initrc_exec_t) +type tuned_etc_t; +files_config_file(tuned_etc_t) + +type tuned_rw_etc_t; +files_config_file(tuned_rw_etc_t) + type tuned_log_t; logging_log_file(tuned_log_t) @@ -22,34 +28,51 @@ files_pid_file(tuned_var_run_t) # # tuned local policy # - +allow tuned_t self:capability { sys_admin sys_nice }; dontaudit tuned_t self:capability { dac_override sys_tty_config }; +allow tuned_t self:process signal; +allow tuned_t self:fifo_file rw_fifo_file_perms; +allow tuned_t self:udp_socket create_socket_perms; + +read_files_pattern(tuned_t, tuned_etc_t, tuned_etc_t) + +manage_files_pattern(tuned_t, tuned_etc_t, tuned_rw_etc_t) manage_dirs_pattern(tuned_t, tuned_log_t, tuned_log_t) manage_files_pattern(tuned_t, tuned_log_t, tuned_log_t) -logging_log_filetrans(tuned_t, tuned_log_t, file) +logging_log_filetrans(tuned_t, tuned_log_t, file, "tuned.log") manage_files_pattern(tuned_t, tuned_var_run_t, tuned_var_run_t) -files_pid_filetrans(tuned_t, tuned_var_run_t, file) +manage_dirs_pattern(tuned_t, tuned_var_run_t, tuned_var_run_t) +files_pid_filetrans(tuned_t, tuned_var_run_t, { dir file }) corecmd_exec_shell(tuned_t) corecmd_exec_bin(tuned_t) kernel_read_system_state(tuned_t) kernel_read_network_state(tuned_t) - +kernel_read_kernel_sysctls(tuned_t) +kernel_rw_kernel_sysctl(tuned_t) +kernel_rw_hotplug_sysctls(tuned_t) +kernel_rw_vm_sysctls(tuned_t) +kernel_setsched(tuned_t) + +dev_getattr_all_blk_files(tuned_t) +dev_getattr_all_chr_files(tuned_t) +dev_dontaudit_getattr_all(tuned_t) dev_read_urand(tuned_t) -dev_read_sysfs(tuned_t) +dev_rw_sysfs(tuned_t) # to allow cpu tuning dev_rw_netcontrol(tuned_t) -files_read_etc_files(tuned_t) files_read_usr_files(tuned_t) files_dontaudit_search_home(tuned_t) -logging_send_syslog_msg(tuned_t) +fs_getattr_xattr_fs(tuned_t) -miscfiles_read_localization(tuned_t) +auth_use_nsswitch(tuned_t) + +logging_send_syslog_msg(tuned_t) userdom_dontaudit_search_user_home_dirs(tuned_t) @@ -58,6 +81,14 @@ optional_policy(` fstools_domtrans(tuned_t) ') +optional_policy(` + gnome_dontaudit_search_config(tuned_t) +') + +optional_policy(` + mount_domtrans(tuned_t) +') + # to allow network interface tuning optional_policy(` sysnet_domtrans_ifconfig(tuned_t) diff --git a/tvtime.te b/tvtime.te index 531b1f1..7455f78 100644 --- a/tvtime.te +++ b/tvtime.te @@ -67,23 +67,13 @@ files_read_etc_files(tvtime_t) # X access, Home files fs_search_auto_mountpoints(tvtime_t) -miscfiles_read_localization(tvtime_t) miscfiles_read_fonts(tvtime_t) -userdom_use_user_terminals(tvtime_t) +userdom_use_inherited_user_terminals(tvtime_t) userdom_read_user_home_content_files(tvtime_t) # X access, Home files -tunable_policy(`use_nfs_home_dirs',` - fs_manage_nfs_dirs(tvtime_t) - fs_manage_nfs_files(tvtime_t) - fs_manage_nfs_symlinks(tvtime_t) -') -tunable_policy(`use_samba_home_dirs',` - fs_manage_cifs_dirs(tvtime_t) - fs_manage_cifs_files(tvtime_t) - fs_manage_cifs_symlinks(tvtime_t) -') +userdom_home_manager(tvtime_t) optional_policy(` xserver_user_x_domain_template(tvtime, tvtime_t, tvtime_tmpfs_t) diff --git a/tzdata.te b/tzdata.te index d0f2a64..9896b57 100644 --- a/tzdata.te +++ b/tzdata.te @@ -15,7 +15,7 @@ application_domain(tzdata_t, tzdata_exec_t) # tzdata local policy # -files_read_etc_files(tzdata_t) +files_read_config_files(tzdata_t) files_search_spool(tzdata_t) fs_getattr_xattr_fs(tzdata_t) @@ -24,11 +24,10 @@ term_dontaudit_list_ptys(tzdata_t) locallogin_dontaudit_use_fds(tzdata_t) -miscfiles_read_localization(tzdata_t) miscfiles_manage_localization(tzdata_t) miscfiles_etc_filetrans_localization(tzdata_t) -userdom_use_user_terminals(tzdata_t) +userdom_use_inherited_user_terminals(tzdata_t) # tzdata looks for /var/spool/postfix/etc/localtime. optional_policy(` diff --git a/ucspitcp.if b/ucspitcp.if index c1feba4..bf82170 100644 --- a/ucspitcp.if +++ b/ucspitcp.if @@ -31,8 +31,5 @@ interface(`ucspitcp_service_domain', ` role system_r types $1; - domain_auto_trans(ucspitcp_t, $2, $1) - allow $1 ucspitcp_t:fd use; - allow $1 ucspitcp_t:process sigchld; - allow $1 ucspitcp_t:tcp_socket rw_stream_socket_perms; + domtrans_pattern(ucspitcp_t, $2, $1) ') diff --git a/ucspitcp.te b/ucspitcp.te index a0794bf..a05c54c 100644 --- a/ucspitcp.te +++ b/ucspitcp.te @@ -24,7 +24,6 @@ ucspitcp_service_domain(rblsmtpd_t, rblsmtpd_exec_t) corecmd_search_bin(rblsmtpd_t) -corenet_all_recvfrom_unlabeled(rblsmtpd_t) corenet_all_recvfrom_netlabel(rblsmtpd_t) corenet_tcp_sendrecv_generic_if(rblsmtpd_t) corenet_udp_sendrecv_generic_if(rblsmtpd_t) @@ -55,7 +54,6 @@ allow ucspitcp_t self:udp_socket create_socket_perms; corecmd_search_bin(ucspitcp_t) # base networking: -corenet_all_recvfrom_unlabeled(ucspitcp_t) corenet_all_recvfrom_netlabel(ucspitcp_t) corenet_tcp_sendrecv_generic_if(ucspitcp_t) corenet_udp_sendrecv_generic_if(ucspitcp_t) @@ -89,5 +87,7 @@ sysnet_read_config(ucspitcp_t) optional_policy(` daemontools_service_domain(ucspitcp_t, ucspitcp_exec_t) + daemontools_sigchld_run(ucspitcp_t) daemontools_read_svc(ucspitcp_t) ') + diff --git a/ulogd.if b/ulogd.if index d23be5c..a05cd68 100644 --- a/ulogd.if +++ b/ulogd.if @@ -123,8 +123,11 @@ interface(`ulogd_admin',` type ulogd_var_log_t, ulogd_initrc_exec_t; ') - allow $1 ulogd_t:process { ptrace signal_perms }; + allow $1 ulogd_t:process signal_perms; ps_process_pattern($1, ulogd_t) + tunable_policy(`deny_ptrace',`',` + allow $1 ulogd_t:process ptrace; + ') init_labeled_script_domtrans($1, ulogd_initrc_exec_t) domain_system_change_exemption($1) diff --git a/ulogd.te b/ulogd.te index 3b953f5..d35a323 100644 --- a/ulogd.te +++ b/ulogd.te @@ -11,7 +11,7 @@ init_daemon_domain(ulogd_t, ulogd_exec_t) # config files type ulogd_etc_t; -files_type(ulogd_etc_t) +files_config_file(ulogd_etc_t) type ulogd_initrc_exec_t; init_script_file(ulogd_initrc_exec_t) @@ -29,8 +29,13 @@ logging_log_file(ulogd_var_log_t) # ulogd local policy # -allow ulogd_t self:capability net_admin; +allow ulogd_t self:capability { net_admin sys_nice }; +allow ulogd_t self:process { setsched }; allow ulogd_t self:netlink_nflog_socket create_socket_perms; +allow ulogd_t self:netlink_route_socket r_netlink_socket_perms; +allow ulogd_t self:netlink_socket create_socket_perms; +allow ulogd_t self:tcp_socket { create_stream_socket_perms connect }; +allow ulogd_t self:udp_socket create_socket_perms; # config files read_files_pattern(ulogd_t, ulogd_etc_t, ulogd_etc_t) @@ -46,7 +51,6 @@ logging_log_filetrans(ulogd_t, ulogd_var_log_t, file) files_read_etc_files(ulogd_t) files_read_usr_files(ulogd_t) -miscfiles_read_localization(ulogd_t) optional_policy(` allow ulogd_t self:tcp_socket create_stream_socket_perms; diff --git a/uml.if b/uml.if index d2ab7cb..ddb34f1 100644 --- a/uml.if +++ b/uml.if @@ -31,9 +31,9 @@ interface(`uml_role',` allow $2 uml_t:unix_dgram_socket sendto; allow uml_t $2:unix_dgram_socket sendto; - # allow ps, ptrace, signal + # allow ps, signal ps_process_pattern($2, uml_t) - allow $2 uml_t:process { ptrace signal_perms }; + allow $2 uml_t:process signal_perms; allow $2 uml_ro_t:dir list_dir_perms; read_files_pattern($2, uml_ro_t, uml_ro_t) diff --git a/uml.te b/uml.te index ff094e5..4ddeb30 100644 --- a/uml.te +++ b/uml.te @@ -50,7 +50,7 @@ files_pid_file(uml_switch_var_run_t) # allow uml_t self:fifo_file rw_fifo_file_perms; -allow uml_t self:process { signal_perms ptrace }; +allow uml_t self:process signal_perms; allow uml_t self:unix_stream_socket create_stream_socket_perms; allow uml_t self:unix_dgram_socket create_socket_perms; # Use the network. @@ -97,7 +97,6 @@ kernel_write_proc_files(uml_t) # for xterm corecmd_exec_bin(uml_t) -corenet_all_recvfrom_unlabeled(uml_t) corenet_all_recvfrom_netlabel(uml_t) corenet_tcp_sendrecv_generic_if(uml_t) corenet_udp_sendrecv_generic_if(uml_t) @@ -131,7 +130,7 @@ seutil_use_newrole_fds(uml_t) # Use the network. sysnet_read_config(uml_t) -userdom_use_user_terminals(uml_t) +userdom_use_inherited_user_terminals(uml_t) userdom_attach_admin_tun_iface(uml_t) optional_policy(` @@ -174,8 +173,6 @@ init_use_script_ptys(uml_switch_t) logging_send_syslog_msg(uml_switch_t) -miscfiles_read_localization(uml_switch_t) - userdom_dontaudit_use_unpriv_user_fds(uml_switch_t) userdom_dontaudit_search_user_home_dirs(uml_switch_t) diff --git a/updfstab.te b/updfstab.te index ef12ed5..4bd4cea 100644 --- a/updfstab.te +++ b/updfstab.te @@ -69,8 +69,6 @@ init_use_script_ptys(updfstab_t) logging_send_syslog_msg(updfstab_t) logging_search_logs(updfstab_t) -miscfiles_read_localization(updfstab_t) - seutil_read_config(updfstab_t) seutil_read_default_contexts(updfstab_t) seutil_read_file_contexts(updfstab_t) @@ -78,9 +76,8 @@ seutil_read_file_contexts(updfstab_t) userdom_dontaudit_search_user_home_content(updfstab_t) userdom_dontaudit_use_unpriv_user_fds(updfstab_t) -optional_policy(` - auth_domtrans_pam_console(updfstab_t) -') +auth_use_nsswitch(updfstab_t) +auth_domtrans_pam_console(updfstab_t) optional_policy(` init_dbus_chat_script(updfstab_t) diff --git a/uptime.te b/uptime.te index c2cf97e..d9105b0 100644 --- a/uptime.te +++ b/uptime.te @@ -13,7 +13,7 @@ type uptimed_etc_t alias etc_uptimed_t; files_config_file(uptimed_etc_t) type uptimed_spool_t; -files_type(uptimed_spool_t) +files_spool_file(uptimed_spool_t) type uptimed_var_run_t; files_pid_file(uptimed_var_run_t) @@ -25,7 +25,7 @@ files_pid_file(uptimed_var_run_t) dontaudit uptimed_t self:capability sys_tty_config; allow uptimed_t self:process signal_perms; -allow uptimed_t self:fifo_file write_file_perms; +allow uptimed_t self:fifo_file write_fifo_file_perms; allow uptimed_t uptimed_etc_t:file read_file_perms; files_search_etc(uptimed_t) @@ -55,8 +55,6 @@ fs_search_auto_mountpoints(uptimed_t) logging_send_syslog_msg(uptimed_t) -miscfiles_read_localization(uptimed_t) - userdom_dontaudit_use_unpriv_user_fds(uptimed_t) userdom_dontaudit_search_user_home_dirs(uptimed_t) diff --git a/usbmodules.te b/usbmodules.te index 74354da..f04565f 100644 --- a/usbmodules.te +++ b/usbmodules.te @@ -34,9 +34,7 @@ init_use_fds(usbmodules_t) miscfiles_read_hwdata(usbmodules_t) -modutils_read_module_deps(usbmodules_t) - -userdom_use_user_terminals(usbmodules_t) +userdom_use_inherited_user_terminals(usbmodules_t) optional_policy(` hotplug_read_config(usbmodules_t) @@ -45,3 +43,7 @@ optional_policy(` optional_policy(` logging_send_syslog_msg(usbmodules_t) ') + +optional_policy(` + modutils_read_module_deps(usbmodules_t) +') diff --git a/usbmuxd.te b/usbmuxd.te index 4440aa6..7f74e52 100644 --- a/usbmuxd.te +++ b/usbmuxd.te @@ -33,10 +33,10 @@ kernel_read_system_state(usbmuxd_t) dev_read_sysfs(usbmuxd_t) dev_rw_generic_usb_dev(usbmuxd_t) -files_read_etc_files(usbmuxd_t) - -miscfiles_read_localization(usbmuxd_t) - auth_use_nsswitch(usbmuxd_t) logging_send_syslog_msg(usbmuxd_t) + +optional_policy(` + virt_dontaudit_read_chr_dev(usbmuxd_t) +') diff --git a/userhelper.fc b/userhelper.fc index e70b0e8..cd83b89 100644 --- a/userhelper.fc +++ b/userhelper.fc @@ -7,3 +7,4 @@ # /usr # /usr/sbin/userhelper -- gen_context(system_u:object_r:userhelper_exec_t,s0) +/usr/bin/consolehelper -- gen_context(system_u:object_r:consolehelper_exec_t,s0) diff --git a/userhelper.if b/userhelper.if index 65baaac..afc7be9 100644 --- a/userhelper.if +++ b/userhelper.if @@ -25,6 +25,7 @@ template(`userhelper_role_template',` gen_require(` attribute userhelper_type; type userhelper_exec_t, userhelper_conf_t; + class dbus send_msg; ') ######################################## @@ -121,6 +122,9 @@ template(`userhelper_role_template',` auth_manage_pam_pid($1_userhelper_t) auth_manage_var_auth($1_userhelper_t) auth_search_pam_console_data($1_userhelper_t) + auth_use_nsswitch($1_userhelper_t) + + logging_send_syslog_msg($1_userhelper_t) # Inherit descriptors from the current session. init_use_fds($1_userhelper_t) @@ -128,7 +132,6 @@ template(`userhelper_role_template',` init_manage_utmp($1_userhelper_t) init_pid_filetrans_utmp($1_userhelper_t) - miscfiles_read_localization($1_userhelper_t) seutil_read_config($1_userhelper_t) seutil_read_default_contexts($1_userhelper_t) @@ -145,18 +148,6 @@ template(`userhelper_role_template',` ') optional_policy(` - logging_send_syslog_msg($1_userhelper_t) - ') - - optional_policy(` - nis_use_ypbind($1_userhelper_t) - ') - - optional_policy(` - nscd_socket_use($1_userhelper_t) - ') - - optional_policy(` tunable_policy(`! secure_mode',` #if we are not in secure mode then we can transition to sysadm_t sysadm_bin_spec_domtrans($1_userhelper_t) @@ -255,3 +246,88 @@ interface(`userhelper_exec',` can_exec($1, userhelper_exec_t) ') + +####################################### +## +## The role template for the consolehelper module. +## +## +##

+## This template creates a derived domains which are used +## for consolehelper applications. +##

+## +## +## +## The prefix of the user domain (e.g., user +## is the prefix for user_t). +## +## +## +## +## The role associated with the user domain. +## +## +## +## +## The type of the user domain. +## +## +# +template(`userhelper_console_role_template',` + gen_require(` + type consolehelper_exec_t; + attribute consolehelper_domain; + class dbus send_msg; + ') + type $1_consolehelper_t, consolehelper_domain; + domain_type($1_consolehelper_t) + domain_entry_file($1_consolehelper_t, consolehelper_exec_t) + role $2 types $1_consolehelper_t; + + domtrans_pattern($3, consolehelper_exec_t, $1_consolehelper_t) + + allow $3 $1_consolehelper_t:process signal; + allow $3 $1_consolehelper_t:dbus send_msg; + allow $1_consolehelper_t $3:dbus send_msg; + + auth_use_pam($1_consolehelper_t) + + userdom_manage_tmpfs_role($2, $1_consolehelper_t) + + optional_policy(` + dbus_connect_session_bus($1_consolehelper_t) + ') + + optional_policy(` + shutdown_run($1_consolehelper_t, $2) + shutdown_send_sigchld($3) + ') + + optional_policy(` + mock_run($1_consolehelper_t, $2) + ') + + optional_policy(` + xserver_run_xauth($1_consolehelper_t, $2) + xserver_read_xdm_pid($1_consolehelper_t) + ') +') + +######################################## +## +## Execute the consolehelper program in the caller domain. +## +## +## +## Domain allowed access. +## +## +# +interface(`userhelper_exec_console',` + gen_require(` + type consolehelper_exec_t; + ') + + can_exec($1, consolehelper_exec_t) +') diff --git a/userhelper.te b/userhelper.te index f25ed61..c0f8b5d 100644 --- a/userhelper.te +++ b/userhelper.te @@ -6,9 +6,81 @@ policy_module(userhelper, 1.7.0) # attribute userhelper_type; +attribute consolehelper_domain; type userhelper_conf_t; files_type(userhelper_conf_t) type userhelper_exec_t; application_executable_file(userhelper_exec_t) + +type consolehelper_exec_t; +application_executable_file(consolehelper_exec_t) + +######################################## +# +# consolehelper local policy +# + +allow consolehelper_domain self:shm create_shm_perms; +allow consolehelper_domain self:capability { setgid setuid dac_override }; +allow consolehelper_domain self:process signal; + +allow consolehelper_domain userhelper_conf_t:file audit_access; +dontaudit consolehelper_domain userhelper_conf_t:file write; +read_files_pattern(consolehelper_domain, userhelper_conf_t, userhelper_conf_t) + +# Init script handling +domain_use_interactive_fds(consolehelper_domain) + +# internal communication is often done using fifo and unix sockets. +allow consolehelper_domain self:fifo_file rw_fifo_file_perms; +allow consolehelper_domain self:unix_stream_socket create_stream_socket_perms; + +kernel_read_system_state(consolehelper_domain) +kernel_read_kernel_sysctls(consolehelper_domain) + +corecmd_exec_bin(consolehelper_domain) + +dev_getattr_all_chr_files(consolehelper_domain) +dev_dontaudit_list_all_dev_nodes(consolehelper_domain) +dev_dontaudit_getattr_all(consolehelper_domain) +fs_getattr_all_dirs(consolehelper_domain) + +files_read_config_files(consolehelper_domain) +files_read_usr_files(consolehelper_domain) + +term_list_ptys(consolehelper_domain) + +auth_search_pam_console_data(consolehelper_domain) +auth_read_pam_pid(consolehelper_domain) + +init_read_utmp(consolehelper_domain) +init_telinit(consolehelper_domain) + +miscfiles_read_fonts(consolehelper_domain) + +userhelper_exec(consolehelper_domain) + +userdom_use_user_ptys(consolehelper_domain) +userdom_use_user_ttys(consolehelper_domain) +userdom_read_user_home_content_files(consolehelper_domain) + +optional_policy(` + gnome_read_gconf_home_files(consolehelper_domain) +') + +optional_policy(` + xserver_read_home_fonts(consolehelper_domain) + xserver_stream_connect(consolehelper_domain) +') + +tunable_policy(`use_nfs_home_dirs',` + files_search_mnt(consolehelper_domain) + fs_search_nfs(consolehelper_domain) +') + +tunable_policy(`use_samba_home_dirs',` + files_search_mnt(consolehelper_domain) + fs_search_cifs(consolehelper_domain) +') diff --git a/usernetctl.if b/usernetctl.if index d45c715..2d4f1ba 100644 --- a/usernetctl.if +++ b/usernetctl.if @@ -37,9 +37,26 @@ interface(`usernetctl_domtrans',` # interface(`usernetctl_run',` gen_require(` - attribute_role usernetctl_roles; + type usernetctl_t; + #attribute_role usernetctl_roles; ') - usernetctl_domtrans($1) - roleattribute $2 usernetctl_roles; + #usernetctl_domtrans($1) + #roleattribute $2 usernetctl_roles; + + sysnet_run_ifconfig(usernetctl_t, $2) + sysnet_run_dhcpc(usernetctl_t, $2) + + optional_policy(` + iptables_run(usernetctl_t, $2) + ') + + optional_policy(` + modutils_run_insmod(usernetctl_t, $2) + ') + + optional_policy(` + ppp_run(usernetctl_t, $2) + ') + ') diff --git a/usernetctl.te b/usernetctl.te index 19c70bb..8a00ab0 100644 --- a/usernetctl.te +++ b/usernetctl.te @@ -5,13 +5,14 @@ policy_module(usernetctl, 1.6.0) # Declarations # -attribute_role usernetctl_roles; +#attribute_role usernetctl_roles; type usernetctl_t; type usernetctl_exec_t; application_domain(usernetctl_t, usernetctl_exec_t) domain_interactive_fd(usernetctl_t) -role usernetctl_roles types usernetctl_t; +#role usernetctl_roles types usernetctl_t; +role system_r types usernetctl_t; ######################################## # @@ -42,7 +43,6 @@ corecmd_exec_shell(usernetctl_t) domain_dontaudit_read_all_domains_state(usernetctl_t) -files_read_etc_files(usernetctl_t) files_exec_etc_files(usernetctl_t) files_read_etc_runtime_files(usernetctl_t) files_list_pids(usernetctl_t) @@ -55,36 +55,36 @@ auth_use_nsswitch(usernetctl_t) logging_send_syslog_msg(usernetctl_t) -miscfiles_read_localization(usernetctl_t) - seutil_read_config(usernetctl_t) sysnet_read_config(usernetctl_t) -sysnet_run_ifconfig(usernetctl_t, usernetctl_roles) -sysnet_run_dhcpc(usernetctl_t, usernetctl_roles) -userdom_use_user_terminals(usernetctl_t) +userdom_use_inherited_user_terminals(usernetctl_t) + +#sysnet_run_ifconfig(usernetctl_t, usernetctl_roles) +#sysnet_run_dhcpc(usernetctl_t, usernetctl_roles) optional_policy(` - consoletype_run(usernetctl_t, usernetctl_roles) + #consoletype_run(usernetctl_t, usernetctl_roles) + consoletype_exec(usernetctl_t) ') optional_policy(` hostname_exec(usernetctl_t) ') -optional_policy(` - iptables_run(usernetctl_t, usernetctl_roles) -') +#optional_policy(` +# iptables_run(usernetctl_t, usernetctl_roles) +#') -optional_policy(` - modutils_run_insmod(usernetctl_t, usernetctl_roles) -') +#optional_policy(` +# modutils_run_insmod(usernetctl_t, usernetctl_roles) +#') optional_policy(` nis_use_ypbind(usernetctl_t) ') -optional_policy(` - ppp_run(usernetctl_t, usernetctl_roles) -') +#optional_policy(` +# ppp_run(usernetctl_t, usernetctl_roles) +#') diff --git a/uucp.if b/uucp.if index ebc5414..8f8ac45 100644 --- a/uucp.if +++ b/uucp.if @@ -99,8 +99,11 @@ interface(`uucp_admin',` type uucpd_var_run_t; ') - allow $1 uucpd_t:process { ptrace signal_perms }; + allow $1 uucpd_t:process signal_perms; ps_process_pattern($1, uucpd_t) + tunable_policy(`deny_ptrace',`',` + allow $1 uucpd_t:process ptrace; + ') logging_list_logs($1) admin_pattern($1, uucpd_log_t) diff --git a/uucp.te b/uucp.te index d4349e9..e338438 100644 --- a/uucp.te +++ b/uucp.te @@ -24,7 +24,7 @@ type uucpd_ro_t; files_type(uucpd_ro_t) type uucpd_spool_t; -files_type(uucpd_spool_t) +files_spool_file(uucpd_spool_t) type uucpd_log_t; logging_log_file(uucpd_log_t) @@ -74,7 +74,6 @@ kernel_read_kernel_sysctls(uucpd_t) kernel_read_system_state(uucpd_t) kernel_read_network_state(uucpd_t) -corenet_all_recvfrom_unlabeled(uucpd_t) corenet_all_recvfrom_netlabel(uucpd_t) corenet_tcp_sendrecv_generic_if(uucpd_t) corenet_udp_sendrecv_generic_if(uucpd_t) @@ -83,6 +82,7 @@ corenet_udp_sendrecv_generic_node(uucpd_t) corenet_tcp_sendrecv_all_ports(uucpd_t) corenet_udp_sendrecv_all_ports(uucpd_t) corenet_tcp_connect_ssh_port(uucpd_t) +corenet_tcp_connect_uucpd_port(uucpd_t) dev_read_urand(uucpd_t) @@ -91,7 +91,6 @@ fs_getattr_xattr_fs(uucpd_t) corecmd_exec_bin(uucpd_t) corecmd_exec_shell(uucpd_t) -files_read_etc_files(uucpd_t) files_search_home(uucpd_t) files_search_spool(uucpd_t) @@ -101,8 +100,6 @@ auth_use_nsswitch(uucpd_t) logging_send_syslog_msg(uucpd_t) -miscfiles_read_localization(uucpd_t) - mta_send_mail(uucpd_t) optional_policy(` @@ -125,18 +122,19 @@ optional_policy(` allow uux_t self:capability { setuid setgid }; allow uux_t self:fifo_file write_fifo_file_perms; +domtrans_pattern(uux_t, uucpd_exec_t, uucpd_t) + uucp_append_log(uux_t) uucp_manage_spool(uux_t) corecmd_exec_bin(uux_t) -files_read_etc_files(uux_t) fs_rw_anon_inodefs_files(uux_t) -logging_send_syslog_msg(uux_t) +auth_use_nsswitch(uux_t) -miscfiles_read_localization(uux_t) +logging_send_syslog_msg(uux_t) optional_policy(` mta_send_mail(uux_t) @@ -145,5 +143,5 @@ optional_policy(` ') optional_policy(` - nscd_socket_use(uux_t) + postfix_rw_master_pipes(uux_t) ') diff --git a/uuidd.fc b/uuidd.fc index a7c9381..d810232 100644 --- a/uuidd.fc +++ b/uuidd.fc @@ -1,4 +1,5 @@ -/etc/rc\.d/init\.d/uuidd -- gen_context(system_u:object_r:uuidd_initrc_exec_t,s0) + +/etc/rc\.d/init\.d/uuidd -- gen_context(system_u:object_r:uuidd_initrc_exec_t,s0) /usr/sbin/uuidd -- gen_context(system_u:object_r:uuidd_exec_t,s0) diff --git a/uuidd.if b/uuidd.if index 5d43bd5..879a5cb 100644 --- a/uuidd.if +++ b/uuidd.if @@ -176,6 +176,9 @@ interface(`uuidd_admin',` allow $1 uuidd_t:process signal_perms; ps_process_pattern($1, uuidd_t) + tunable_policy(`deny_ptrace',`',` + allow $1 uuidd_t:process ptrace; + ') uuidd_initrc_domtrans($1) domain_system_change_exemption($1) diff --git a/uuidd.te b/uuidd.te index 04589dc..33b02b5 100644 --- a/uuidd.te +++ b/uuidd.te @@ -41,4 +41,3 @@ domain_use_interactive_fds(uuidd_t) files_read_etc_files(uuidd_t) -miscfiles_read_localization(uuidd_t) diff --git a/uwimap.te b/uwimap.te index 46d9811..f109ba3 100644 --- a/uwimap.te +++ b/uwimap.te @@ -37,7 +37,6 @@ kernel_read_kernel_sysctls(imapd_t) kernel_list_proc(imapd_t) kernel_read_proc_symlinks(imapd_t) -corenet_all_recvfrom_unlabeled(imapd_t) corenet_all_recvfrom_netlabel(imapd_t) corenet_tcp_sendrecv_generic_if(imapd_t) corenet_tcp_sendrecv_generic_node(imapd_t) @@ -65,8 +64,6 @@ auth_domtrans_chk_passwd(imapd_t) logging_send_syslog_msg(imapd_t) -miscfiles_read_localization(imapd_t) - sysnet_read_config(imapd_t) userdom_dontaudit_use_unpriv_user_fds(imapd_t) diff --git a/varnishd.if b/varnishd.if index 93975d6..bd248ce 100644 --- a/varnishd.if +++ b/varnishd.if @@ -151,12 +151,16 @@ interface(`varnishd_manage_log',` # interface(`varnishd_admin_varnishlog',` gen_require(` + type varnishd_t; type varnishlog_t, varnishlog_initrc_exec_t, varnishlog_log_t; type varnishlog_var_run_t; ') - allow $1 varnishlog_t:process { ptrace signal_perms }; + allow $1 varnishlog_t:process signal_perms; ps_process_pattern($1, varnishlog_t) + tunable_policy(`deny_ptrace',`',` + allow $1 varnishd_t:process ptrace; + ') init_labeled_script_domtrans($1, varnishlog_initrc_exec_t) domain_system_change_exemption($1) @@ -194,8 +198,11 @@ interface(`varnishd_admin',` type varnishd_initrc_exec_t; ') - allow $1 varnishd_t:process { ptrace signal_perms }; + allow $1 varnishd_t:process signal_perms; ps_process_pattern($1, varnishd_t) + tunable_policy(`deny_ptrace',`',` + allow $1 varnishd_t:process ptrace; + ') init_labeled_script_domtrans($1, varnishd_initrc_exec_t) domain_system_change_exemption($1) diff --git a/varnishd.te b/varnishd.te index f9310f3..c321cd2 100644 --- a/varnishd.te +++ b/varnishd.te @@ -21,7 +21,7 @@ type varnishd_initrc_exec_t; init_script_file(varnishd_initrc_exec_t) type varnishd_etc_t; -files_type(varnishd_etc_t) +files_config_file(varnishd_etc_t) type varnishd_tmp_t; files_tmp_file(varnishd_tmp_t) @@ -43,7 +43,7 @@ type varnishlog_var_run_t; files_pid_file(varnishlog_var_run_t) type varnishlog_log_t; -files_type(varnishlog_log_t) +logging_log_file(varnishlog_log_t) ######################################## # @@ -87,14 +87,14 @@ corenet_tcp_connect_http_port(varnishd_t) dev_read_urand(varnishd_t) +files_read_usr_files(varnishd_t) + fs_getattr_all_fs(varnishd_t) auth_use_nsswitch(varnishd_t) logging_send_syslog_msg(varnishd_t) -miscfiles_read_localization(varnishd_t) - sysnet_read_config(varnishd_t) tunable_policy(`varnishd_connect_any',` diff --git a/vbetool.te b/vbetool.te index 001c93c..664502c 100644 --- a/vbetool.te +++ b/vbetool.te @@ -22,6 +22,7 @@ init_system_domain(vbetool_t, vbetool_exec_t) # allow vbetool_t self:capability { dac_override sys_tty_config sys_admin }; +allow vbetool_t self:capability2 { secure_firmware }; allow vbetool_t self:process execmem; dev_wx_raw_memory(vbetool_t) @@ -38,7 +39,6 @@ mls_file_write_all_levels(vbetool_t) term_use_unallocated_ttys(vbetool_t) -miscfiles_read_localization(vbetool_t) tunable_policy(`vbetool_mmap_zero_ignore',` dontaudit vbetool_t self:memprotect mmap_zero; diff --git a/vdagent.fc b/vdagent.fc index 21c5f41..3ae71ae 100644 --- a/vdagent.fc +++ b/vdagent.fc @@ -1,7 +1,7 @@ /usr/sbin/spice-vdagentd -- gen_context(system_u:object_r:vdagent_exec_t,s0) /var/log/spice-vdagentd(/.*)? gen_context(system_u:object_r:vdagent_log_t,s0) -/var/log/spice-vdagentd\.log -- gen_context(system_u:object_r:vdagent_log_t,s0) +/var/log/spice-vdagentd\.log.* -- gen_context(system_u:object_r:vdagent_log_t,s0) /var/run/spice-vdagentd(/.*)? gen_context(system_u:object_r:vdagent_var_run_t,s0) -/var/run/spice-vdagentd.\pid -- gen_context(system_u:object_r:vdagent_var_run_t,s0) +/var/run/spice-vdagentd\.pid -- gen_context(system_u:object_r:vdagent_var_run_t,s0) diff --git a/vdagent.if b/vdagent.if index e59a074..b708678 100644 --- a/vdagent.if +++ b/vdagent.if @@ -20,39 +20,39 @@ interface(`vdagent_domtrans',` ##################################### ## -## Getattr on vdagent executable. +## Getattr on vdagent executable. ## ## -## +## ## Domain allowed access. -## +## ## # interface(`vdagent_getattr_exec_files',` - gen_require(` - type vdagent_exec_t; - ') + gen_require(` + type vdagent_exec_t; + ') - allow $1 vdagent_exec_t:file getattr; + allow $1 vdagent_exec_t:file getattr; ') ####################################### ## -## Get the attributes of vdagent logs. +## Get the attributes of vdagent logs. ## ## -## -## Domain allowed access. -## +## +## Domain allowed access. +## ## # interface(`vdagent_getattr_log',` - gen_require(` - type vdagent_log_t; - ') + gen_require(` + type vdagent_log_t; + ') - logging_search_logs($1) - allow $1 vdagent_log_t:file getattr_file_perms; + logging_search_logs($1) + allow $1 vdagent_log_t:file getattr_file_perms; ') ######################################## @@ -76,22 +76,22 @@ interface(`vdagent_read_pid_files',` ##################################### ## -## Connect to vdagent over a unix domain -## stream socket. +## Connect to vdagent over a unix domain +## stream socket. ## ## -## -## Domain allowed access. -## +## +## Domain allowed access. +## ## # interface(`vdagent_stream_connect',` - gen_require(` - type vdagent_var_run_t, vdagent_t; - ') + gen_require(` + type vdagent_var_run_t, vdagent_t; + ') - files_search_pids($1) - stream_connect_pattern($1, vdagent_var_run_t, vdagent_var_run_t, vdagent_t) + files_search_pids($1) + stream_connect_pattern($1, vdagent_var_run_t, vdagent_var_run_t, vdagent_t) ') ######################################## @@ -104,12 +104,6 @@ interface(`vdagent_stream_connect',` ## Domain allowed access. ## ## -## -## -## Role allowed access. -## -## -## # interface(`vdagent_admin',` gen_require(` @@ -118,6 +112,9 @@ interface(`vdagent_admin',` allow $1 vdagent_t:process signal_perms; ps_process_pattern($1, vdagent_t) + tunable_policy(`deny_ptrace',`',` + allow $1 vdagent_t:process ptrace; + ') files_search_pids($1) admin_pattern($1, vdagent_var_run_t) diff --git a/vdagent.te b/vdagent.te index 29e24e2..b1ca03a 100644 --- a/vdagent.te +++ b/vdagent.te @@ -21,6 +21,7 @@ logging_log_file(vdagent_log_t) # dontaudit vdagent_t self:capability sys_admin; +allow vdagent_t self:process signal; allow vdagent_t self:fifo_file rw_fifo_file_perms; allow vdagent_t self:unix_stream_socket create_stream_socket_perms; @@ -32,7 +33,7 @@ files_pid_filetrans(vdagent_t, vdagent_var_run_t, { dir file sock_file }) manage_dirs_pattern(vdagent_t, vdagent_log_t, vdagent_log_t) manage_files_pattern(vdagent_t, vdagent_log_t, vdagent_log_t) -logging_log_filetrans(vdagent_t, vdagent_log_t, file) +logging_log_filetrans(vdagent_t, vdagent_log_t, { file }) dev_rw_input_dev(vdagent_t) dev_read_sysfs(vdagent_t) @@ -40,7 +41,16 @@ dev_dontaudit_write_mtrr(vdagent_t) files_read_etc_files(vdagent_t) -miscfiles_read_localization(vdagent_t) +init_read_state(vdagent_t) + +systemd_read_logind_sessions_files(vdagent_t) +systemd_login_read_pid_files(vdagent_t) + +term_use_virtio_console(vdagent_t) + +userdom_read_all_users_state(vdagent_t) + +logging_send_syslog_msg(vdagent_t) optional_policy(` consolekit_dbus_chat(vdagent_t) diff --git a/vhostmd.if b/vhostmd.if index 1f872b5..8af4bce 100644 --- a/vhostmd.if +++ b/vhostmd.if @@ -52,7 +52,7 @@ interface(`vhostmd_read_tmpfs_files',` ') allow $1 vhostmd_tmpfs_t:file read_file_perms; - files_search_tmp($1) + fs_search_tmpfs($1) ') ######################################## @@ -90,7 +90,7 @@ interface(`vhostmd_rw_tmpfs_files',` ') rw_files_pattern($1, vhostmd_tmpfs_t, vhostmd_tmpfs_t) - files_search_tmp($1) + fs_search_tmpfs($1) ') ######################################## @@ -109,7 +109,7 @@ interface(`vhostmd_manage_tmpfs_files',` ') manage_files_pattern($1, vhostmd_tmpfs_t, vhostmd_tmpfs_t) - files_search_tmp($1) + fs_search_tmpfs($1) ') ######################################## @@ -146,7 +146,8 @@ interface(`vhostmd_manage_pid_files',` type vhostmd_var_run_t; ') - manage_files_pattern($1, vhostmd_var_run_t, vhostmd_var_run_t) + files_search_pids($1) + manage_files_pattern($1, vhostmd_var_run_t, vhostmd_var_run_t) ') ######################################## @@ -209,8 +210,11 @@ interface(`vhostmd_admin',` type vhostmd_t, vhostmd_initrc_exec_t; ') - allow $1 vhostmd_t:process { ptrace signal_perms getattr }; + allow $1 vhostmd_t:process signal_perms; ps_process_pattern($1, vhostmd_t) + tunable_policy(`deny_ptrace',`',` + allow $1 vhostmd_t:process ptrace; + ') vhostmd_initrc_domtrans($1) domain_system_change_exemption($1) @@ -220,5 +224,4 @@ interface(`vhostmd_admin',` vhostmd_manage_tmpfs_files($1) vhostmd_manage_pid_files($1) - ') diff --git a/vhostmd.te b/vhostmd.te index 32a3c13..0cbca75 100644 --- a/vhostmd.te +++ b/vhostmd.te @@ -24,8 +24,8 @@ files_pid_file(vhostmd_var_run_t) # allow vhostmd_t self:capability { dac_override ipc_lock setuid setgid }; -allow vhostmd_t self:process { setsched getsched }; -allow vhostmd_t self:fifo_file rw_file_perms; +allow vhostmd_t self:process { setsched getsched signal }; +allow vhostmd_t self:fifo_file rw_fifo_file_perms; manage_dirs_pattern(vhostmd_t, vhostmd_tmpfs_t, vhostmd_tmpfs_t) manage_files_pattern(vhostmd_t, vhostmd_tmpfs_t, vhostmd_tmpfs_t) @@ -35,6 +35,7 @@ manage_dirs_pattern(vhostmd_t, vhostmd_var_run_t, vhostmd_var_run_t) manage_files_pattern(vhostmd_t, vhostmd_var_run_t, vhostmd_var_run_t) files_pid_filetrans(vhostmd_t, vhostmd_var_run_t, { file dir }) +kernel_read_kernel_sysctls(vhostmd_t) kernel_read_system_state(vhostmd_t) kernel_read_network_state(vhostmd_t) kernel_write_xen_state(vhostmd_t) @@ -44,17 +45,21 @@ corecmd_exec_shell(vhostmd_t) corenet_tcp_connect_soundd_port(vhostmd_t) -files_read_etc_files(vhostmd_t) +dev_read_rand(vhostmd_t) +dev_read_urand(vhostmd_t) +dev_read_sysfs(vhostmd_t) + +# 579803 +files_list_tmp(vhostmd_t) files_read_usr_files(vhostmd_t) +dev_read_rand(vhostmd_t) dev_read_sysfs(vhostmd_t) auth_use_nsswitch(vhostmd_t) logging_send_syslog_msg(vhostmd_t) -miscfiles_read_localization(vhostmd_t) - optional_policy(` hostname_exec(vhostmd_t) ') @@ -66,6 +71,7 @@ optional_policy(` optional_policy(` virt_stream_connect(vhostmd_t) + virt_write_content(vhostmd_t) ') optional_policy(` diff --git a/virt.fc b/virt.fc index 2124b6a..1b23633 100644 --- a/virt.fc +++ b/virt.fc @@ -1,6 +1,14 @@ -HOME_DIR/.virtinst(/.*)? gen_context(system_u:object_r:virt_content_t,s0) -HOME_DIR/VirtualMachines(/.*)? gen_context(system_u:object_r:virt_image_t,s0) +HOME_DIR/\.libvirt(/.*)? gen_context(system_u:object_r:virt_home_t,s0) +HOME_DIR/\.libvirt/qemu(/.*)? gen_context(system_u:object_r:svirt_home_t,s0) +HOME_DIR/\.virtinst(/.*)? gen_context(system_u:object_r:virt_home_t,s0) +HOME_DIR/\.cache/libvirt(/.*)? gen_context(system_u:object_r:virt_home_t,s0) +HOME_DIR/\.cache/gnome-boxes(/.*)? gen_context(system_u:object_r:virt_home_t,s0) +HOME_DIR/\.cache/libvirt/qemu(/.*)? gen_context(system_u:object_r:svirt_home_t,s0) +HOME_DIR/\.config/libvirt(/.*)? gen_context(system_u:object_r:virt_home_t,s0) +HOME_DIR/\.config/libvirt/qemu(/.*)? gen_context(system_u:object_r:svirt_home_t,s0) +HOME_DIR/VirtualMachines(/.*)? gen_context(system_u:object_r:virt_home_t,s0) HOME_DIR/VirtualMachines/isos(/.*)? gen_context(system_u:object_r:virt_content_t,s0) +HOME_DIR/\.local/share/gnome-boxes/images(/.*)? gen_context(system_u:object_r:svirt_home_t,s0) /etc/libvirt -d gen_context(system_u:object_r:virt_etc_t,s0) /etc/libvirt/[^/]* -- gen_context(system_u:object_r:virt_etc_t,s0) @@ -12,18 +20,53 @@ HOME_DIR/VirtualMachines/isos(/.*)? gen_context(system_u:object_r:virt_content_t /etc/xen/[^/]* -d gen_context(system_u:object_r:virt_etc_rw_t,s0) /etc/xen/.*/.* gen_context(system_u:object_r:virt_etc_rw_t,s0) +/usr/libexec/libvirt_lxc -- gen_context(system_u:object_r:virtd_lxc_exec_t,s0) +/usr/libexec/qemu-bridge-helper gen_context(system_u:object_r:virt_bridgehelper_exec_t,s0) + +/usr/sbin/libvirt-qmf -- gen_context(system_u:object_r:virt_qmf_exec_t,s0) /usr/sbin/libvirtd -- gen_context(system_u:object_r:virtd_exec_t,s0) +/usr/bin/virsh -- gen_context(system_u:object_r:virsh_exec_t,s0) +/usr/bin/virt-sandbox-service.* -- gen_context(system_u:object_r:virsh_exec_t,s0) +/usr/sbin/condor_vm-gahp -- gen_context(system_u:object_r:virtd_exec_t,s0) +/usr/sbin/fence_virtd -- gen_context(system_u:object_r:virsh_exec_t,s0) -/var/cache/libvirt(/.*)? gen_context(system_u:object_r:svirt_cache_t,s0) +/var/cache/libvirt(/.*)? gen_context(system_u:object_r:virt_cache_t,s0-mls_systemhigh) /var/lib/libvirt(/.*)? gen_context(system_u:object_r:virt_var_lib_t,s0) /var/lib/libvirt/boot(/.*)? gen_context(system_u:object_r:virt_content_t,s0) /var/lib/libvirt/images(/.*)? gen_context(system_u:object_r:virt_image_t,s0) /var/lib/libvirt/isos(/.*)? gen_context(system_u:object_r:virt_content_t,s0) -/var/lib/libvirt/qemu(/.*)? gen_context(system_u:object_r:svirt_var_run_t,s0) +/var/lib/libvirt/qemu(/.*)? gen_context(system_u:object_r:qemu_var_run_t,s0-mls_systemhigh) +/var/log/log(/.*)? gen_context(system_u:object_r:virt_log_t,s0) /var/log/libvirt(/.*)? gen_context(system_u:object_r:virt_log_t,s0) +/var/log/vdsm(/.*)? gen_context(system_u:object_r:virt_log_t,s0) +/var/run/libguestfs(/.*)? gen_context(system_u:object_r:virt_var_run_t,s0) /var/run/libvirt(/.*)? gen_context(system_u:object_r:virt_var_run_t,s0) -/var/run/libvirt/qemu(/.*)? gen_context(system_u:object_r:svirt_var_run_t,s0) +/var/run/libvirt/qemu(/.*)? gen_context(system_u:object_r:qemu_var_run_t,s0-mls_systemhigh) +/var/run/libvirt/lxc(/.*)? gen_context(system_u:object_r:virt_lxc_var_run_t,s0) +/var/run/libvirt-sandbox(/.*)? gen_context(system_u:object_r:virt_lxc_var_run_t,s0) +/var/run/user/[^/]*/libguestfs(/.*)? gen_context(system_u:object_r:virt_home_t,s0) +/var/run/vdsm(/.*)? gen_context(system_u:object_r:virt_var_run_t,s0) /var/vdsm(/.*)? gen_context(system_u:object_r:virt_var_run_t,s0) + +# support for AEOLUS project +/usr/bin/imagefactory -- gen_context(system_u:object_r:virtd_exec_t,s0) +/usr/bin/imgfac\.py -- gen_context(system_u:object_r:virtd_exec_t,s0) +/var/cache/oz(/.*)? gen_context(system_u:object_r:virt_cache_t,s0) +/var/lib/imagefactory/images(/.*)? gen_context(system_u:object_r:virt_image_t,s0) +/var/lib/oz(/.*)? gen_context(system_u:object_r:virt_var_lib_t,s0) +/var/lib/oz/isos(/.*)? gen_context(system_u:object_r:virt_content_t,s0) +/var/lib/vdsm(/.*)? gen_context(system_u:object_r:virt_content_t,s0) + +# add support vios-proxy-* +/usr/bin/vios-proxy-host -- gen_context(system_u:object_r:virtd_exec_t,s0) +/usr/bin/vios-proxy-guest -- gen_context(system_u:object_r:virtd_exec_t,s0) + +# support for nova-stack +/usr/bin/nova-compute -- gen_context(system_u:object_r:virtd_exec_t,s0) +/usr/bin/qemu -- gen_context(system_u:object_r:qemu_exec_t,s0) +/usr/bin/qemu-system-.* -- gen_context(system_u:object_r:qemu_exec_t,s0) +/usr/bin/qemu-kvm -- gen_context(system_u:object_r:qemu_exec_t,s0) +/usr/libexec/qemu.* -- gen_context(system_u:object_r:qemu_exec_t,s0) diff --git a/virt.if b/virt.if index 6f0736b..15c2645 100644 --- a/virt.if +++ b/virt.if @@ -13,39 +13,47 @@ # template(`virt_domain_template',` gen_require(` - type virtd_t; - attribute virt_image_type; - attribute virt_domain; + attribute virt_image_type, virt_domain; + attribute virt_tmpfs_type; + attribute virt_ptynode; + type qemu_exec_t; ') type $1_t, virt_domain; - domain_type($1_t) + application_domain($1_t, qemu_exec_t) domain_user_exemption_target($1_t) + mls_rangetrans_target($1_t) + mcs_untrusted_proc($1_t) role system_r types $1_t; - type $1_devpts_t; + type $1_devpts_t, virt_ptynode; term_pty($1_devpts_t) type $1_tmp_t; files_tmp_file($1_tmp_t) - type $1_tmpfs_t; + type $1_tmpfs_t, virt_tmpfs_type; files_tmpfs_file($1_tmpfs_t) type $1_image_t, virt_image_type; files_type($1_image_t) dev_node($1_image_t) + dev_associate_sysfs($1_image_t) + + auth_use_nsswitch($1_t) - type $1_var_run_t; - files_pid_file($1_var_run_t) + logging_send_syslog_msg($1_t) - allow $1_t $1_devpts_t:chr_file { rw_chr_file_perms setattr }; + allow $1_t $1_devpts_t:chr_file { rw_chr_file_perms setattr_chr_file_perms }; term_create_pty($1_t, $1_devpts_t) manage_dirs_pattern($1_t, $1_image_t, $1_image_t) manage_files_pattern($1_t, $1_image_t, $1_image_t) + manage_fifo_files_pattern($1_t, $1_image_t, $1_image_t) read_lnk_files_pattern($1_t, $1_image_t, $1_image_t) + rw_chr_files_pattern($1_t, $1_image_t, $1_image_t) rw_blk_files_pattern($1_t, $1_image_t, $1_image_t) + fs_hugetlbfs_filetrans($1_t, $1_image_t, file) manage_dirs_pattern($1_t, $1_tmp_t, $1_tmp_t) manage_files_pattern($1_t, $1_tmp_t, $1_tmp_t) @@ -57,20 +65,6 @@ template(`virt_domain_template',` manage_lnk_files_pattern($1_t, $1_tmpfs_t, $1_tmpfs_t) fs_tmpfs_filetrans($1_t, $1_tmpfs_t, { dir file lnk_file }) - stream_connect_pattern(virtd_t, $1_var_run_t, $1_var_run_t, virt_domain) - manage_dirs_pattern(virtd_t, $1_var_run_t, $1_var_run_t) - manage_files_pattern(virtd_t, $1_var_run_t, $1_var_run_t) - manage_sock_files_pattern(virtd_t, $1_var_run_t, $1_var_run_t) - - manage_dirs_pattern($1_t, $1_var_run_t, $1_var_run_t) - manage_files_pattern($1_t, $1_var_run_t, $1_var_run_t) - manage_sock_files_pattern($1_t, $1_var_run_t, $1_var_run_t) - manage_lnk_files_pattern($1_t, $1_var_run_t, $1_var_run_t) - files_pid_filetrans($1_t, $1_var_run_t, { dir file }) - stream_connect_pattern($1_t, $1_var_run_t, $1_var_run_t, virtd_t) - - auth_use_nsswitch($1_t) - optional_policy(` xserver_rw_shm($1_t) ') @@ -98,14 +92,32 @@ interface(`virt_image',` dev_node($1) ') +####################################### +## +## Getattr on virt executable. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`virt_getattr_exec',` + gen_require(` + type virtd_exec_t; + ') + + allow $1 virtd_exec_t:file getattr; +') + ######################################## ## ## Execute a domain transition to run virt. ## ## -## +## ## Domain allowed to transition. -## +## ## # interface(`virt_domtrans',` @@ -116,9 +128,45 @@ interface(`virt_domtrans',` domtrans_pattern($1, virtd_exec_t, virtd_t) ') +######################################## +## +## Transition to virt_qmf. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`virt_domtrans_qmf',` + gen_require(` + type virt_qmf_t, virt_qmf_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, virt_qmf_exec_t, virt_qmf_t) +') + +######################################## +## +## Transition to virt_bridgehelper. +## +## +## +## Domain allowed to transition. +## +## +interface(`virt_domtrans_bridgehelper',` + gen_require(` + type virt_bridgehelper_t, virt_bridgehelper_exec_t; + ') + + domtrans_pattern($1, virt_bridgehelper_exec_t, virt_bridgehelper_t) +') + ####################################### ## -## Connect to virt over an unix domain stream socket. +## Connect to virt over a unix domain stream socket. ## ## ## @@ -166,13 +214,13 @@ interface(`virt_attach_tun_iface',` # interface(`virt_read_config',` gen_require(` - type virt_etc_t; - type virt_etc_rw_t; + type virt_etc_t, virt_etc_rw_t; ') files_search_etc($1) read_files_pattern($1, virt_etc_t, virt_etc_t) read_files_pattern($1, virt_etc_rw_t, virt_etc_rw_t) + read_lnk_files_pattern($1, virt_etc_rw_t, virt_etc_rw_t) ') ######################################## @@ -187,13 +235,13 @@ interface(`virt_read_config',` # interface(`virt_manage_config',` gen_require(` - type virt_etc_t; - type virt_etc_rw_t; + type virt_etc_t, virt_etc_rw_t; ') files_search_etc($1) manage_files_pattern($1, virt_etc_t, virt_etc_t) manage_files_pattern($1, virt_etc_rw_t, virt_etc_rw_t) + manage_lnk_files_pattern($1, virt_etc_rw_t, virt_etc_rw_t) ') ######################################## @@ -233,6 +281,24 @@ interface(`virt_read_content',` ######################################## ## +## Allow domain to write virt image files +## +## +## +## Domain allowed access. +## +## +# +interface(`virt_write_content',` + gen_require(` + type virt_content_t; + ') + + allow $1 virt_content_t:file write_file_perms; +') + +######################################## +## ## Read virt PID files. ## ## @@ -252,6 +318,28 @@ interface(`virt_read_pid_files',` ######################################## ## +## Manage virt pid directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`virt_manage_pid_dirs',` + gen_require(` + type virt_var_run_t; + type virt_lxc_var_run_t; + ') + + files_search_pids($1) + manage_dirs_pattern($1, virt_var_run_t, virt_var_run_t) + manage_dirs_pattern($1, virt_lxc_var_run_t, virt_lxc_var_run_t) + virt_filetrans_named_content($1) +') + +######################################## +## ## Manage virt pid files. ## ## @@ -263,10 +351,42 @@ interface(`virt_read_pid_files',` interface(`virt_manage_pid_files',` gen_require(` type virt_var_run_t; + type virt_lxc_var_run_t; ') files_search_pids($1) manage_files_pattern($1, virt_var_run_t, virt_var_run_t) + manage_files_pattern($1, virt_lxc_var_run_t, virt_lxc_var_run_t) +') + +######################################## +## +## Create objects in the pid directory +## with a private type with a type transition. +## +## +## +## Domain allowed access. +## +## +## +## +## Type to which the created node will be transitioned. +## +## +## +## +## Object class(es) (single or set including {}) for which this +## the transition will occur. +## +## +# +interface(`virt_pid_filetrans',` + gen_require(` + type virt_var_run_t; + ') + + filetrans_pattern($1, virt_var_run_t, $2, $3, $4) ') ######################################## @@ -310,6 +430,24 @@ interface(`virt_read_lib_files',` ######################################## ## +## Dontaudit inherited read virt lib files. +## +## +## +## Domain to not audit. +## +## +# +interface(`virt_dontaudit_read_lib_files',` + gen_require(` + type virt_var_lib_t; + ') + + dontaudit $1 virt_var_lib_t:file read_inherited_file_perms; +') + +######################################## +## ## Create, read, write, and delete ## virt lib files. ## @@ -354,9 +492,9 @@ interface(`virt_read_log',` ## virt log files. ## ## -## +## ## Domain allowed access. -## +## ## # interface(`virt_append_log',` @@ -390,6 +528,25 @@ interface(`virt_manage_log',` ######################################## ## +## Allow domain to search virt image direcories +## +## +## +## Domain allowed access. +## +## +# +interface(`virt_search_images',` + gen_require(` + attribute virt_image_type; + ') + + virt_search_lib($1) + allow $1 virt_image_type:dir search_dir_perms; +') + +######################################## +## ## Allow domain to read virt image files ## ## @@ -410,6 +567,7 @@ interface(`virt_read_images',` read_files_pattern($1, virt_image_type, virt_image_type) read_lnk_files_pattern($1, virt_image_type, virt_image_type) read_blk_files_pattern($1, virt_image_type, virt_image_type) + read_chr_files_pattern($1, virt_image_type, virt_image_type) tunable_policy(`virt_use_nfs',` fs_list_nfs($1) @@ -426,6 +584,24 @@ interface(`virt_read_images',` ######################################## ## +## Allow domain to read virt blk image files +## +## +## +## Domain allowed access. +## +## +# +interface(`virt_read_blk_images',` + gen_require(` + attribute virt_image_type; + ') + + read_blk_files_pattern($1, virt_image_type, virt_image_type) +') + +######################################## +## ## Create, read, write, and delete ## svirt cache files. ## @@ -435,15 +611,15 @@ interface(`virt_read_images',` ## ## # -interface(`virt_manage_svirt_cache',` +interface(`virt_manage_cache',` gen_require(` - type svirt_cache_t; + type virt_cache_t; ') files_search_var($1) - manage_dirs_pattern($1, svirt_cache_t, svirt_cache_t) - manage_files_pattern($1, svirt_cache_t, svirt_cache_t) - manage_lnk_files_pattern($1, svirt_cache_t, svirt_cache_t) + manage_dirs_pattern($1, virt_cache_t, virt_cache_t) + manage_files_pattern($1, virt_cache_t, virt_cache_t) + manage_lnk_files_pattern($1, virt_cache_t, virt_cache_t) ') ######################################## @@ -468,18 +644,7 @@ interface(`virt_manage_images',` manage_files_pattern($1, virt_image_type, virt_image_type) read_lnk_files_pattern($1, virt_image_type, virt_image_type) rw_blk_files_pattern($1, virt_image_type, virt_image_type) - - tunable_policy(`virt_use_nfs',` - fs_manage_nfs_dirs($1) - fs_manage_nfs_files($1) - fs_read_nfs_symlinks($1) - ') - - tunable_policy(`virt_use_samba',` - fs_manage_cifs_files($1) - fs_manage_cifs_files($1) - fs_read_cifs_symlinks($1) - ') + rw_chr_files_pattern($1, virt_image_type, virt_image_type) ') ######################################## @@ -502,10 +667,19 @@ interface(`virt_manage_images',` interface(`virt_admin',` gen_require(` type virtd_t, virtd_initrc_exec_t; + attribute virt_domain; + type virt_lxc_t; ') - allow $1 virtd_t:process { ptrace signal_perms }; + allow $1 virtd_t:process signal_perms; ps_process_pattern($1, virtd_t) + tunable_policy(`deny_ptrace',`',` + allow $1 virtd_t:process ptrace_perms; + allow $1 virt_lxc_t:process ptrace_perms; + ') + + allow $1 virt_lxc_t:process signal_perms; + ps_process_pattern($1, virt_lxc_t) init_labeled_script_domtrans($1, virtd_initrc_exec_t) domain_system_change_exemption($1) @@ -517,4 +691,293 @@ interface(`virt_admin',` virt_manage_lib_files($1) virt_manage_log($1) + + virt_manage_images($1) + + allow $1 virt_domain:process signal_perms; +') + +######################################## +## +## Execute qemu in the svirt domain, and +## allow the specified role the svirt domain. +## +## +## +## Domain allowed access +## +## +## +## +## The role to be allowed the sandbox domain. +## +## +## +# +interface(`virt_transition_svirt',` + gen_require(` + type svirt_t; + type virt_bridgehelper_t; + type svirt_image_t; + ') + + allow $1 svirt_t:process transition; + role $2 types svirt_t; + role $2 types virt_bridgehelper_t; + + allow $1 svirt_image_t:file { relabelfrom relabelto }; + allow $1 svirt_image_t:fifo_file { read_fifo_file_perms relabelto }; + + virt_signal_svirt($1) + + optional_policy(` + ptchown_run(svirt_t, $2) + ') +') + +######################################## +## +## Do not audit attempts to write virt daemon unnamed pipes. +## +## +## +## Domain to not audit. +## +## +# +interface(`virt_dontaudit_write_pipes',` + gen_require(` + type virtd_t; + ') + + dontaudit $1 virtd_t:fd use; + dontaudit $1 virtd_t:fifo_file write_fifo_file_perms; +') + +######################################## +## +## Send a sigkill to virtual machines +## +## +## +## Domain allowed access. +## +## +# +interface(`virt_kill_svirt',` + gen_require(` + attribute virt_domain; + ') + + allow $1 virt_domain:process sigkill; +') + +######################################## +## +## Send a signal to virtual machines +## +## +## +## Domain allowed access. +## +## +# +interface(`virt_signal_svirt',` + gen_require(` + attribute virt_domain; + ') + + allow $1 virt_domain:process signal; +') + +######################################## +## +## Manage virt home files. +## +## +## +## Domain allowed access. +## +## +# +interface(`virt_manage_home_files',` + gen_require(` + type virt_home_t; + ') + + userdom_search_user_home_dirs($1) + manage_files_pattern($1, virt_home_t, virt_home_t) +') + +######################################## +## +## allow domain to read +## virt tmpfs files +## +## +## +## Domain allowed access +## +## +# +interface(`virt_read_tmpfs_files',` + gen_require(` + attribute virt_tmpfs_type; + ') + + allow $1 virt_tmpfs_type:file read_file_perms; +') + +######################################## +## +## allow domain to manage +## virt tmpfs files +## +## +## +## Domain allowed access +## +## +# +interface(`virt_manage_tmpfs_files',` + gen_require(` + attribute virt_tmpfs_type; + ') + + allow $1 virt_tmpfs_type:file manage_file_perms; +') + +######################################## +## +## Create .virt directory in the user home directory +## with an correct label. +## +## +## +## Domain allowed access. +## +## +# +interface(`virt_filetrans_home_content',` + gen_require(` + type virt_home_t; + type svirt_home_t; + ') + + userdom_user_home_dir_filetrans($1, virt_home_t, dir, ".libvirt") + userdom_user_home_dir_filetrans($1, virt_home_t, dir, ".virtinst") + filetrans_pattern($1, virt_home_t, svirt_home_t, dir, "qemu") + gnome_config_filetrans($1, virt_home_t, dir, "libvirt") + gnome_cache_filetrans($1, virt_home_t, dir, "libvirt") + gnome_cache_filetrans($1, virt_home_t, dir, "gnome-boxes") + gnome_data_filetrans($1, svirt_home_t, dir, "images") +') + +######################################## +## +## Dontaudit attempts to Read virt_image_type devices. +## +## +## +## Domain allowed access. +## +## +# +interface(`virt_dontaudit_read_chr_dev',` + gen_require(` + attribute virt_image_type; + ') + + dontaudit $1 virt_image_type:chr_file read_chr_file_perms; +') + +######################################## +## +## Creates types and rules for a basic +## virt_lxc process domain. +## +## +## +## Prefix for the domain. +## +## +# +template(`virt_lxc_domain_template',` + gen_require(` + attribute svirt_lxc_domain; + ') + + type $1_t, svirt_lxc_domain; + domain_type($1_t) + domain_user_exemption_target($1_t) + mls_rangetrans_target($1_t) + mcs_untrusted_proc($1_t) + role system_r types $1_t; +') + +######################################## +## +## Execute a qemu_exec_t in the callers domain +## +## +## +## Domain allowed access. +## +## +# +interface(`virt_exec_qemu',` + gen_require(` + type qemu_exec_t; + ') + + can_exec($1, qemu_exec_t) +') + +######################################## +## +## Transition to virt named content +## +## +## +## Domain allowed access. +## +## +# +interface(`virt_filetrans_named_content',` + gen_require(` + type virt_lxc_var_run_t; + type virt_var_run_t; + ') + + files_pid_filetrans($1, virt_lxc_var_run_t, dir, "libvirt-sandbox") + files_pid_filetrans($1, virt_var_run_t, dir, "libvirt") + files_pid_filetrans($1, virt_var_run_t, dir, "libguestfs") +') + +######################################## +## +## Execute qemu in the svirt domain, and +## allow the specified role the svirt domain. +## +## +## +## Domain allowed access +## +## +## +## +## The role to be allowed the sandbox domain. +## +## +## +# +interface(`virt_transition_svirt_lxc',` + gen_require(` + attribute svirt_lxc_domain; + ') + + allow $1 svirt_lxc_domain:process transition; + role $2 types svirt_lxc_domain; + + allow svirt_lxc_domain $1:process sigchld; ') diff --git a/virt.te b/virt.te index 947bbc6..f1bf16e 100644 --- a/virt.te +++ b/virt.te @@ -5,56 +5,87 @@ policy_module(virt, 1.5.0) # Declarations # +attribute virsh_transition_domain; +attribute virt_ptynode; + ## ##

-## Allow virt to use serial/parallell communication ports +## Allow confined virtual guests to use serial/parallel communication ports ##

## gen_tunable(virt_use_comm, false) ## ##

-## Allow virt to read fuse files +## Allow confined virtual guests to use executable memory and executable stack +##

+## +gen_tunable(virt_use_execmem, false) + +## +##

+## Allow confined virtual guests to read fuse files ##

## gen_tunable(virt_use_fusefs, false) ## ##

-## Allow virt to manage nfs files +## Allow confined virtual guests to manage nfs files ##

## gen_tunable(virt_use_nfs, false) ## ##

-## Allow virt to manage cifs files +## Allow confined virtual guests to manage cifs files ##

## gen_tunable(virt_use_samba, false) ## ##

-## Allow virt to manage device configuration, (pci) +## Allow confined virtual guests to manage device configuration, (pci) ##

## gen_tunable(virt_use_sysfs, false) ## +##

+## Allow confined virtual guests to interact with the sanlock +##

+## +gen_tunable(virt_use_sanlock, false) + +## +##

+## Allow confined virtual guests to interact with the xserver +##

+## +gen_tunable(virt_use_xserver, false) + +## ##

-## Allow virt to use usb devices +## Allow confined virtual guests to use usb devices ##

## gen_tunable(virt_use_usb, true) virt_domain_template(svirt) role system_r types svirt_t; +typealias svirt_t alias qemu_t; -type svirt_cache_t; -files_type(svirt_cache_t) +virt_domain_template(svirt_prot_exec) +role system_r types svirt_prot_exec_t; attribute virt_domain; attribute virt_image_type; +attribute virt_tmpfs_type; + +type qemu_exec_t; + +type virt_cache_t alias svirt_cache_t; +files_type(virt_cache_t) type virt_etc_t; files_config_file(virt_etc_t) @@ -62,26 +93,37 @@ files_config_file(virt_etc_t) type virt_etc_rw_t; files_type(virt_etc_rw_t) +type virt_home_t; +userdom_user_home_content(virt_home_t) + +type svirt_home_t; +userdom_user_home_content(svirt_home_t) + # virt Image files type virt_image_t; # customizable virt_image(virt_image_t) +files_mountpoint(virt_image_t) # virt Image files type virt_content_t; # customizable virt_image(virt_content_t) userdom_user_home_content(virt_content_t) +type virt_tmp_t; +files_tmp_file(virt_tmp_t) + type virt_log_t; logging_log_file(virt_log_t) +mls_trusted_object(virt_log_t) -type virt_tmp_t; -files_tmp_file(virt_tmp_t) +type virt_lock_t; +files_lock_file(virt_lock_t) type virt_var_run_t; files_pid_file(virt_var_run_t) type virt_var_lib_t; -files_type(virt_var_lib_t) +files_mountpoint(virt_var_lib_t) type virtd_t; type virtd_exec_t; @@ -92,6 +134,11 @@ domain_subj_id_change_exemption(virtd_t) type virtd_initrc_exec_t; init_script_file(virtd_initrc_exec_t) +type qemu_var_run_t; +typealias qemu_var_run_t alias svirt_var_run_t; +files_pid_file(qemu_var_run_t) +mls_trusted_object(qemu_var_run_t) + ifdef(`enable_mcs',` init_ranged_daemon_domain(virtd_t, virtd_exec_t, s0 - mcs_systemhigh) ') @@ -100,6 +147,35 @@ ifdef(`enable_mls',` init_ranged_daemon_domain(virtd_t, virtd_exec_t, s0 - mls_systemhigh) ') +type virt_qmf_t; +type virt_qmf_exec_t; +init_daemon_domain(virt_qmf_t, virt_qmf_exec_t) + +type virt_bridgehelper_t; +domain_type(virt_bridgehelper_t) + +type virt_bridgehelper_exec_t; +domain_entry_file(virt_bridgehelper_t, virt_bridgehelper_exec_t) +role system_r types virt_bridgehelper_t; + +######################################## +# +# Declarations +# +attribute svirt_lxc_domain; + +type virtd_lxc_t; +type virtd_lxc_exec_t; +init_system_domain(virtd_lxc_t, virtd_lxc_exec_t) + +type virt_lxc_var_run_t; +files_pid_file(virt_lxc_var_run_t) +typealias virt_lxc_var_run_t alias virtd_lxc_var_run_t; + +# virt lxc container files +type svirt_lxc_file_t; +files_mountpoint(svirt_lxc_file_t) + ######################################## # # svirt local policy @@ -107,15 +183,12 @@ ifdef(`enable_mls',` allow svirt_t self:udp_socket create_socket_perms; -manage_dirs_pattern(svirt_t, svirt_cache_t, svirt_cache_t) -manage_files_pattern(svirt_t, svirt_cache_t, svirt_cache_t) -files_var_filetrans(svirt_t, svirt_cache_t, { file dir }) - read_lnk_files_pattern(svirt_t, virt_image_t, virt_image_t) allow svirt_t svirt_image_t:dir search_dir_perms; manage_dirs_pattern(svirt_t, svirt_image_t, svirt_image_t) manage_files_pattern(svirt_t, svirt_image_t, svirt_image_t) +manage_fifo_files_pattern(svirt_t, svirt_image_t, svirt_image_t) fs_hugetlbfs_filetrans(svirt_t, svirt_image_t, file) list_dirs_pattern(svirt_t, virt_content_t, virt_content_t) @@ -133,9 +206,17 @@ corenet_tcp_connect_all_ports(svirt_t) dev_list_sysfs(svirt_t) +fs_getattr_xattr_fs(svirt_t) + userdom_search_user_home_content(svirt_t) userdom_read_user_home_content_symlinks(svirt_t) userdom_read_all_users_state(svirt_t) +append_files_pattern(svirt_t, virt_home_t, virt_home_t) +manage_dirs_pattern(svirt_t, svirt_home_t, svirt_home_t) +manage_files_pattern(svirt_t, svirt_home_t, svirt_home_t) +manage_sock_files_pattern(svirt_t, svirt_home_t, svirt_home_t) +filetrans_pattern(svirt_t, virt_home_t, svirt_home_t, { dir sock_file file }) +stream_connect_pattern(svirt_t, svirt_home_t, svirt_home_t, virtd_t) tunable_policy(`virt_use_comm',` term_use_unallocated_ttys(svirt_t) @@ -143,18 +224,26 @@ tunable_policy(`virt_use_comm',` ') tunable_policy(`virt_use_fusefs',` - fs_read_fusefs_files(svirt_t) + fs_manage_fusefs_dirs(svirt_t) + fs_manage_fusefs_files(svirt_t) fs_read_fusefs_symlinks(svirt_t) + fs_getattr_fusefs(svirt_t) ') tunable_policy(`virt_use_nfs',` fs_manage_nfs_dirs(svirt_t) fs_manage_nfs_files(svirt_t) + fs_manage_nfs_named_sockets(svirt_t) + fs_read_nfs_symlinks(svirt_t) + fs_getattr_nfs(svirt_t) ') tunable_policy(`virt_use_samba',` fs_manage_cifs_dirs(svirt_t) fs_manage_cifs_files(svirt_t) + fs_manage_cifs_named_sockets(svirt_t) + fs_read_cifs_symlinks(virtd_t) + fs_getattr_cifs(svirt_t) ') tunable_policy(`virt_use_sysfs',` @@ -163,11 +252,28 @@ tunable_policy(`virt_use_sysfs',` tunable_policy(`virt_use_usb',` dev_rw_usbfs(svirt_t) + dev_read_sysfs(svirt_t) fs_manage_dos_dirs(svirt_t) fs_manage_dos_files(svirt_t) ') optional_policy(` + tunable_policy(`virt_use_sanlock',` + sanlock_stream_connect(svirt_t) + ') +') + +optional_policy(` + tunable_policy(`virt_use_xserver',` + xserver_stream_connect(svirt_t) + ') +') + +optional_policy(` + virt_domtrans_bridgehelper(svirt_t) +') + +optional_policy(` xen_rw_image_files(svirt_t) ') @@ -176,22 +282,41 @@ optional_policy(` # virtd local policy # -allow virtd_t self:capability { chown dac_override fowner ipc_lock kill mknod net_admin net_raw setpcap setuid setgid sys_admin sys_nice sys_ptrace }; -allow virtd_t self:process { getcap getsched setcap sigkill signal signull execmem setexec setfscreate setsched }; +allow virtd_t self:capability { chown dac_override fowner ipc_lock kill mknod net_admin net_raw setpcap setuid setgid sys_admin sys_nice }; +allow virtd_t self:process { getcap getsched setcap sigkill signal signull execmem setexec setfscreate setsockcreate setsched }; +ifdef(`hide_broken_symptoms',` + # caused by some bogus kernel code + dontaudit virtd_t self:capability { sys_module sys_ptrace }; +') -allow virtd_t self:fifo_file rw_fifo_file_perms; -allow virtd_t self:unix_stream_socket create_stream_socket_perms; +allow virtd_t self:fifo_file { manage_fifo_file_perms relabelfrom relabelto }; +allow virtd_t self:unix_stream_socket { connectto create_stream_socket_perms }; allow virtd_t self:tcp_socket create_stream_socket_perms; -allow virtd_t self:tun_socket create_socket_perms; +allow virtd_t self:tun_socket { create_socket_perms relabelfrom relabelto }; +allow virtd_t self:rawip_socket create_socket_perms; +allow virtd_t self:packet_socket create_socket_perms; allow virtd_t self:netlink_kobject_uevent_socket create_socket_perms; +allow virtd_t self:netlink_route_socket create_netlink_socket_perms; -manage_dirs_pattern(virtd_t, svirt_cache_t, svirt_cache_t) -manage_files_pattern(virtd_t, svirt_cache_t, svirt_cache_t) +manage_dirs_pattern(virtd_t, virt_cache_t, virt_cache_t) +manage_files_pattern(virtd_t, virt_cache_t, virt_cache_t) manage_dirs_pattern(virtd_t, virt_content_t, virt_content_t) manage_files_pattern(virtd_t, virt_content_t, virt_content_t) allow virtd_t virt_domain:process { getattr getsched setsched transition signal signull sigkill }; +allow virt_domain virtd_t:fd use; +dontaudit virt_domain virtd_t:unix_stream_socket { read write }; + +can_exec(virtd_t, qemu_exec_t) +can_exec(virt_domain, qemu_exec_t) + +allow virtd_t qemu_var_run_t:file relabel_file_perms; +manage_dirs_pattern(virtd_t, qemu_var_run_t, qemu_var_run_t) +manage_files_pattern(virtd_t, qemu_var_run_t, qemu_var_run_t) +manage_sock_files_pattern(virtd_t, qemu_var_run_t, qemu_var_run_t) +stream_connect_pattern(virtd_t, qemu_var_run_t, qemu_var_run_t, virt_domain) +filetrans_pattern(virtd_t, virt_var_run_t, qemu_var_run_t, dir, "qemu") read_files_pattern(virtd_t, virt_etc_t, virt_etc_t) read_lnk_files_pattern(virtd_t, virt_etc_t, virt_etc_t) @@ -202,19 +327,28 @@ manage_lnk_files_pattern(virtd_t, virt_etc_rw_t, virt_etc_rw_t) filetrans_pattern(virtd_t, virt_etc_t, virt_etc_rw_t, dir) manage_files_pattern(virtd_t, virt_image_type, virt_image_type) +manage_chr_files_pattern(virtd_t, virt_image_type, virt_image_type) manage_blk_files_pattern(virtd_t, virt_image_type, virt_image_type) -allow virtd_t virt_image_type:file { relabelfrom relabelto }; -allow virtd_t virt_image_type:blk_file { relabelfrom relabelto }; - -manage_dirs_pattern(virtd_t, virt_log_t, virt_log_t) -manage_files_pattern(virtd_t, virt_log_t, virt_log_t) -logging_log_filetrans(virtd_t, virt_log_t, { file dir }) +manage_lnk_files_pattern(virtd_t, virt_image_type, virt_image_type) +allow virtd_t virt_image_type:file relabel_file_perms; +allow virtd_t virt_image_type:blk_file relabel_blk_file_perms; +allow virtd_t virt_image_type:chr_file relabel_chr_file_perms; +allow virtd_t virt_ptynode:chr_file rw_term_perms; manage_dirs_pattern(virtd_t, virt_tmp_t, virt_tmp_t) manage_files_pattern(virtd_t, virt_tmp_t, virt_tmp_t) files_tmp_filetrans(virtd_t, virt_tmp_t, { file dir }) can_exec(virtd_t, virt_tmp_t) +manage_dirs_pattern(virtd_t, virt_lock_t, virt_lock_t) +manage_files_pattern(virtd_t, virt_lock_t, virt_lock_t) +manage_lnk_files_pattern(virtd_t, virt_lock_t, virt_lock_t) +files_lock_filetrans(virtd_t, virt_lock_t, { dir file lnk_file }) + +manage_dirs_pattern(virtd_t, virt_log_t, virt_log_t) +manage_files_pattern(virtd_t, virt_log_t, virt_log_t) +logging_log_filetrans(virtd_t, virt_log_t, { file dir }) + manage_dirs_pattern(virtd_t, virt_var_lib_t, virt_var_lib_t) manage_files_pattern(virtd_t, virt_var_lib_t, virt_var_lib_t) manage_sock_files_pattern(virtd_t, virt_var_lib_t, virt_var_lib_t) @@ -225,16 +359,21 @@ manage_files_pattern(virtd_t, virt_var_run_t, virt_var_run_t) manage_sock_files_pattern(virtd_t, virt_var_run_t, virt_var_run_t) files_pid_filetrans(virtd_t, virt_var_run_t, { file dir }) +manage_dirs_pattern(virtd_t, virt_lxc_var_run_t, virt_lxc_var_run_t) +manage_files_pattern(virtd_t, virt_lxc_var_run_t, virt_lxc_var_run_t) +filetrans_pattern(virtd_t, virt_var_run_t, virt_lxc_var_run_t, dir, "lxc") +stream_connect_pattern(virtd_t, virt_lxc_var_run_t, virt_lxc_var_run_t, virtd_lxc_t) + kernel_read_system_state(virtd_t) kernel_read_network_state(virtd_t) kernel_rw_net_sysctls(virtd_t) +kernel_read_kernel_sysctls(virtd_t) kernel_request_load_module(virtd_t) kernel_search_debugfs(virtd_t) corecmd_exec_bin(virtd_t) corecmd_exec_shell(virtd_t) -corenet_all_recvfrom_unlabeled(virtd_t) corenet_all_recvfrom_netlabel(virtd_t) corenet_tcp_sendrecv_generic_if(virtd_t) corenet_tcp_sendrecv_generic_node(virtd_t) @@ -247,22 +386,31 @@ corenet_tcp_connect_soundd_port(virtd_t) corenet_rw_tun_tap_dev(virtd_t) dev_rw_sysfs(virtd_t) +dev_read_urand(virtd_t) dev_read_rand(virtd_t) dev_rw_kvm(virtd_t) dev_getattr_all_chr_files(virtd_t) dev_rw_mtrr(virtd_t) +dev_rw_vhost(virtd_t) +dev_setattr_generic_usb_dev(virtd_t) +dev_relabel_generic_usb_dev(virtd_t) # Init script handling domain_use_interactive_fds(virtd_t) domain_read_all_domains_state(virtd_t) +domain_read_all_domains_state(virtd_t) files_read_usr_files(virtd_t) -files_read_etc_files(virtd_t) +files_read_usr_files(virtd_t) files_read_etc_runtime_files(virtd_t) files_search_all(virtd_t) files_read_kernel_modules(virtd_t) files_read_usr_src_files(virtd_t) -files_manage_etc_files(virtd_t) +files_relabelto_system_conf_files(virtd_t) +files_relabelfrom_system_conf_files(virtd_t) + +# Manages /etc/sysconfig/system-config-firewall +files_manage_system_conf_files(virtd_t) fs_list_auto_mountpoints(virtd_t) fs_getattr_xattr_fs(virtd_t) @@ -270,6 +418,18 @@ fs_rw_anon_inodefs_files(virtd_t) fs_list_inotifyfs(virtd_t) fs_manage_cgroup_dirs(virtd_t) fs_rw_cgroup_files(virtd_t) +fs_manage_hugetlbfs_dirs(virtd_t) +fs_rw_hugetlbfs_files(virtd_t) + +mls_fd_share_all_levels(virtd_t) +mls_file_read_to_clearance(virtd_t) +mls_file_write_to_clearance(virtd_t) +mls_process_read_to_clearance(virtd_t) +mls_process_write_to_clearance(virtd_t) +mls_net_write_within_range(virtd_t) +mls_socket_write_to_clearance(virtd_t) +mls_socket_read_to_clearance(virtd_t) +mls_rangetrans_source(virtd_t) mcs_process_set_categories(virtd_t) @@ -284,7 +444,8 @@ term_use_ptmx(virtd_t) auth_use_nsswitch(virtd_t) -miscfiles_read_localization(virtd_t) +init_dbus_chat(virtd_t) + miscfiles_read_generic_certs(virtd_t) miscfiles_read_hwdata(virtd_t) @@ -293,17 +454,32 @@ modutils_read_module_config(virtd_t) modutils_manage_module_config(virtd_t) logging_send_syslog_msg(virtd_t) +logging_send_audit_msgs(virtd_t) + +selinux_validate_context(virtd_t) seutil_read_config(virtd_t) seutil_read_default_contexts(virtd_t) +seutil_read_file_contexts(virtd_t) +sysnet_signull_ifconfig(virtd_t) +sysnet_signal_ifconfig(virtd_t) sysnet_domtrans_ifconfig(virtd_t) sysnet_read_config(virtd_t) +userdom_list_admin_dir(virtd_t) userdom_getattr_all_users(virtd_t) userdom_list_user_home_content(virtd_t) userdom_read_all_users_state(virtd_t) userdom_read_user_home_content_files(virtd_t) +userdom_relabel_user_home_files(virtd_t) +userdom_setattr_user_home_content_files(virtd_t) +manage_dirs_pattern(virtd_t, virt_home_t, virt_home_t) +manage_files_pattern(virtd_t, virt_home_t, virt_home_t) +manage_sock_files_pattern(virtd_t, virt_home_t, virt_home_t) +manage_lnk_files_pattern(virtd_t, virt_home_t, virt_home_t) +#userdom_user_home_dir_filetrans(virtd_t, virt_home_t, { dir file }) +virt_filetrans_home_content(virtd_t) tunable_policy(`virt_use_nfs',` fs_manage_nfs_dirs(virtd_t) @@ -322,6 +498,10 @@ optional_policy(` ') optional_policy(` + consoletype_exec(virtd_t) +') + +optional_policy(` dbus_system_bus_client(virtd_t) optional_policy(` @@ -335,19 +515,34 @@ optional_policy(` optional_policy(` hal_dbus_chat(virtd_t) ') + + optional_policy(` + networkmanager_dbus_chat(virtd_t) + ') +') + +optional_policy(` + dmidecode_domtrans(virtd_t) ') optional_policy(` dnsmasq_domtrans(virtd_t) dnsmasq_signal(virtd_t) dnsmasq_kill(virtd_t) - dnsmasq_read_pid_files(virtd_t) dnsmasq_signull(virtd_t) + dnsmasq_create_pid_dirs(virtd_t) + dnsmasq_filetrans_named_content_fromdir(virtd_t, virt_var_run_t); + dnsmasq_manage_pid_files(virtd_t) +') + +optional_policy(` + firewalld_dbus_chat(virtd_t) ') optional_policy(` iptables_domtrans(virtd_t) iptables_initrc_domtrans(virtd_t) + iptables_systemctl(virtd_t) # Manages /etc/sysconfig/system-config-firewall iptables_manage_config(virtd_t) @@ -362,6 +557,12 @@ optional_policy(` ') optional_policy(` + # Run mount in the mount_t domain. + mount_domtrans(virtd_t) + mount_signal(virtd_t) +') + +optional_policy(` policykit_dbus_chat(virtd_t) policykit_domtrans_auth(virtd_t) policykit_domtrans_resolve(virtd_t) @@ -369,11 +570,11 @@ optional_policy(` ') optional_policy(` - qemu_domtrans(virtd_t) - qemu_read_state(virtd_t) - qemu_signal(virtd_t) - qemu_kill(virtd_t) - qemu_setsched(virtd_t) + qemu_exec(virtd_t) +') + +optional_policy(` + sanlock_stream_connect(virtd_t) ') optional_policy(` @@ -384,6 +585,7 @@ optional_policy(` kernel_read_xen_state(virtd_t) kernel_write_xen_state(virtd_t) + xen_exec(virtd_t) xen_stream_connect(virtd_t) xen_stream_connect_xenstore(virtd_t) xen_read_image_files(virtd_t) @@ -403,34 +605,50 @@ optional_policy(` # virtual domains common policy # -allow virt_domain self:capability { dac_read_search dac_override kill }; -allow virt_domain self:process { execmem execstack signal getsched signull }; -allow virt_domain self:fifo_file rw_file_perms; +allow virt_domain self:process { signal getsched signull }; +allow virt_domain self:fifo_file rw_fifo_file_perms; allow virt_domain self:shm create_shm_perms; allow virt_domain self:unix_stream_socket create_stream_socket_perms; allow virt_domain self:unix_dgram_socket { create_socket_perms sendto }; allow virt_domain self:tcp_socket create_stream_socket_perms; +manage_dirs_pattern(virt_domain, virt_cache_t, virt_cache_t) +manage_files_pattern(virt_domain, virt_cache_t, virt_cache_t) +files_var_filetrans(virt_domain, virt_cache_t, { file dir }) + +manage_dirs_pattern(virt_domain, qemu_var_run_t, qemu_var_run_t) +manage_files_pattern(virt_domain, qemu_var_run_t, qemu_var_run_t) +manage_sock_files_pattern(virt_domain, qemu_var_run_t, qemu_var_run_t) +manage_lnk_files_pattern(virt_domain, qemu_var_run_t, qemu_var_run_t) +files_pid_filetrans(virt_domain, qemu_var_run_t, { dir file }) +stream_connect_pattern(virt_domain, qemu_var_run_t, qemu_var_run_t, virtd_t) + +dontaudit virtd_t virt_domain:process { siginh noatsecure rlimitinh }; + +dontaudit virt_domain virt_tmpfs_type:file { read write }; + append_files_pattern(virt_domain, virt_log_t, virt_log_t) append_files_pattern(virt_domain, virt_var_lib_t, virt_var_lib_t) kernel_read_system_state(virt_domain) +fs_getattr_xattr_fs(virt_domain) + corecmd_exec_bin(virt_domain) corecmd_exec_shell(virt_domain) -corenet_all_recvfrom_unlabeled(virt_domain) -corenet_all_recvfrom_netlabel(virt_domain) corenet_tcp_sendrecv_generic_if(virt_domain) corenet_tcp_sendrecv_generic_node(virt_domain) corenet_tcp_sendrecv_all_ports(virt_domain) corenet_tcp_bind_generic_node(virt_domain) corenet_tcp_bind_vnc_port(virt_domain) -corenet_rw_tun_tap_dev(virt_domain) corenet_tcp_bind_virt_migration_port(virt_domain) corenet_tcp_connect_virt_migration_port(virt_domain) +corenet_rw_inherited_tun_tap_dev(virt_domain) +dev_getattr_fs(virt_domain) +dev_read_generic_symlinks(virt_domain) dev_read_rand(virt_domain) dev_read_sound(virt_domain) dev_read_urand(virt_domain) @@ -438,10 +656,11 @@ dev_write_sound(virt_domain) dev_rw_ksm(virt_domain) dev_rw_kvm(virt_domain) dev_rw_qemu(virt_domain) +dev_rw_inherited_vhost(virt_domain) domain_use_interactive_fds(virt_domain) -files_read_etc_files(virt_domain) +files_read_mnt_symlinks(virt_domain) files_read_usr_files(virt_domain) files_read_var_files(virt_domain) files_search_all(virt_domain) @@ -449,23 +668,481 @@ files_search_all(virt_domain) fs_getattr_tmpfs(virt_domain) fs_rw_anon_inodefs_files(virt_domain) fs_rw_tmpfs_files(virt_domain) +fs_getattr_hugetlbfs(virt_domain) +fs_rw_inherited_nfs_files(virt_domain) +fs_rw_inherited_cifs_files(virt_domain) +fs_rw_inherited_noxattr_fs_files(virt_domain) -term_use_all_terms(virt_domain) +# I think we need these for now. +miscfiles_read_public_files(virt_domain) +storage_raw_read_removable_device(virt_domain) + +term_use_all_inherited_terms(virt_domain) term_getattr_pty_fs(virt_domain) term_use_generic_ptys(virt_domain) term_use_ptmx(virt_domain) -logging_send_syslog_msg(virt_domain) +tunable_policy(`virt_use_execmem',` + allow virt_domain self:process { execmem execstack }; +') -miscfiles_read_localization(virt_domain) +optional_policy(` + alsa_read_rw_config(virt_domain) +') optional_policy(` ptchown_domtrans(virt_domain) ') optional_policy(` + pulseaudio_dontaudit_exec(virt_domain) +') + +optional_policy(` virt_read_config(virt_domain) virt_read_lib_files(virt_domain) virt_read_content(virt_domain) virt_stream_connect(virt_domain) ') + +######################################## +# +# xm local policy +# +type virsh_t; +type virsh_exec_t; +init_system_domain(virsh_t, virsh_exec_t) +typealias virsh_t alias xm_t; +typealias virsh_exec_t alias xm_exec_t; + +allow virsh_t self:capability { setpcap dac_override ipc_lock sys_nice sys_tty_config }; +allow virsh_t self:process { getcap getsched setsched setcap signal }; +allow virsh_t self:fifo_file rw_fifo_file_perms; +allow virsh_t self:unix_stream_socket { create_stream_socket_perms connectto }; +allow virsh_t self:tcp_socket create_stream_socket_perms; + +can_exec(virsh_t, virsh_exec_t) +virt_domtrans(virsh_t) +virt_manage_images(virsh_t) +virt_manage_config(virsh_t) +virt_stream_connect(virsh_t) + +manage_files_pattern(virsh_t, virt_image_type, virt_image_type) +manage_blk_files_pattern(virsh_t, virt_image_type, virt_image_type) +manage_lnk_files_pattern(virsh_t, virt_image_type, virt_image_type) + +manage_dirs_pattern(virsh_t, svirt_lxc_file_t, svirt_lxc_file_t) +manage_files_pattern(virsh_t, svirt_lxc_file_t, svirt_lxc_file_t) +manage_chr_files_pattern(virsh_t, svirt_lxc_file_t, svirt_lxc_file_t) +manage_lnk_files_pattern(virsh_t, svirt_lxc_file_t, svirt_lxc_file_t) +manage_sock_files_pattern(virsh_t, svirt_lxc_file_t, svirt_lxc_file_t) +manage_fifo_files_pattern(virsh_t, svirt_lxc_file_t, svirt_lxc_file_t) +virt_transition_svirt_lxc(virsh_t, system_r) + +manage_dirs_pattern(virsh_t, virt_lxc_var_run_t, virt_lxc_var_run_t) +manage_files_pattern(virsh_t, virt_lxc_var_run_t, virt_lxc_var_run_t) +virt_filetrans_named_content(virsh_t) + +dontaudit virsh_t virt_var_lib_t:file read_inherited_file_perms; + +kernel_read_system_state(virsh_t) +kernel_read_network_state(virsh_t) +kernel_read_kernel_sysctls(virsh_t) +kernel_read_sysctl(virsh_t) +kernel_read_xen_state(virsh_t) +kernel_write_xen_state(virsh_t) + +corecmd_exec_bin(virsh_t) +corecmd_exec_shell(virsh_t) + +corenet_tcp_sendrecv_generic_if(virsh_t) +corenet_tcp_sendrecv_generic_node(virsh_t) +corenet_tcp_connect_soundd_port(virsh_t) + +dev_read_rand(virsh_t) +dev_read_urand(virsh_t) +dev_read_sysfs(virsh_t) + +files_read_etc_runtime_files(virsh_t) +files_read_etc_files(virsh_t) +files_read_usr_files(virsh_t) +files_list_mnt(virsh_t) +files_list_tmp(virsh_t) +# Some common macros (you might be able to remove some) + +fs_getattr_all_fs(virsh_t) +fs_manage_xenfs_dirs(virsh_t) +fs_manage_xenfs_files(virsh_t) +fs_search_auto_mountpoints(virsh_t) + +storage_raw_read_fixed_disk(virsh_t) + +term_use_all_inherited_terms(virsh_t) + +init_stream_connect_script(virsh_t) +init_rw_script_stream_sockets(virsh_t) +init_use_fds(virsh_t) + +auth_read_passwd(virsh_t) + +logging_send_syslog_msg(virsh_t) + +sysnet_dns_name_resolve(virsh_t) + +tunable_policy(`virt_use_nfs',` + fs_manage_nfs_dirs(virsh_t) + fs_manage_nfs_files(virsh_t) + fs_read_nfs_symlinks(virsh_t) +') + +tunable_policy(`virt_use_samba',` + fs_manage_cifs_files(virsh_t) + fs_manage_cifs_files(virsh_t) + fs_read_cifs_symlinks(virsh_t) +') + +optional_policy(` + cron_system_entry(virsh_t, virsh_exec_t) +') + +optional_policy(` + rpm_exec(virsh_t) +') + +optional_policy(` + xen_manage_image_dirs(virsh_t) + xen_append_log(virsh_t) + xen_domtrans(virsh_t) + xen_read_pid_files_xenstored(virsh_t) + xen_stream_connect(virsh_t) + xen_stream_connect_xenstore(virsh_t) +') + +optional_policy(` + dbus_system_bus_client(virsh_t) + + optional_policy(` + hal_dbus_chat(virsh_t) + ') +') + +optional_policy(` + vhostmd_rw_tmpfs_files(virsh_t) + vhostmd_stream_connect(virsh_t) + vhostmd_dontaudit_rw_stream_connect(virsh_t) +') + +optional_policy(` + ssh_basic_client_template(virsh, virsh_t, system_r) + + kernel_read_xen_state(virsh_ssh_t) + kernel_write_xen_state(virsh_ssh_t) + + dontaudit virsh_ssh_t virsh_transition_domain:fifo_file rw_inherited_fifo_file_perms; + files_search_tmp(virsh_ssh_t) + + fs_manage_xenfs_dirs(virsh_ssh_t) + fs_manage_xenfs_files(virsh_ssh_t) + + userdom_search_admin_dir(virsh_ssh_t) +') + +######################################## +# +# virt_lxc local policy +# +allow virtd_lxc_t self:capability { dac_override net_admin net_raw setpcap chown sys_admin sys_boot sys_resource }; +allow virtd_lxc_t self:process { setexec setrlimit setsched getcap setcap signal_perms }; +allow virtd_lxc_t self:fifo_file rw_fifo_file_perms; +allow virtd_lxc_t self:netlink_route_socket rw_netlink_socket_perms; +allow virtd_lxc_t self:unix_stream_socket create_stream_socket_perms; +allow virtd_lxc_t self:packet_socket create_socket_perms; + +allow virtd_lxc_t virt_image_type:dir mounton; +manage_files_pattern(virtd_lxc_t, virt_image_t, virt_image_t) + +domtrans_pattern(virtd_t, virtd_lxc_exec_t, virtd_lxc_t) +allow virtd_t virtd_lxc_t:process { signal signull sigkill }; + +allow virtd_lxc_t virt_var_run_t:dir search_dir_perms; +manage_dirs_pattern(virtd_lxc_t, virt_lxc_var_run_t, virt_lxc_var_run_t) +manage_files_pattern(virtd_lxc_t, virt_lxc_var_run_t, virt_lxc_var_run_t) +manage_sock_files_pattern(virtd_lxc_t, virt_lxc_var_run_t, virt_lxc_var_run_t) +files_pid_filetrans(virtd_lxc_t, virt_lxc_var_run_t, { file dir }) + +manage_dirs_pattern(virtd_lxc_t, svirt_lxc_file_t, svirt_lxc_file_t) +manage_files_pattern(virtd_lxc_t, svirt_lxc_file_t, svirt_lxc_file_t) +manage_chr_files_pattern(virtd_lxc_t, svirt_lxc_file_t, svirt_lxc_file_t) +manage_lnk_files_pattern(virtd_lxc_t, svirt_lxc_file_t, svirt_lxc_file_t) +manage_sock_files_pattern(virtd_lxc_t, svirt_lxc_file_t, svirt_lxc_file_t) +manage_fifo_files_pattern(virtd_lxc_t, svirt_lxc_file_t, svirt_lxc_file_t) +allow virtd_lxc_t svirt_lxc_file_t:dir_file_class_set { relabelto relabelfrom }; +allow virtd_lxc_t svirt_lxc_file_t:filesystem { relabelto relabelfrom }; +files_associate_rootfs(svirt_lxc_file_t) + +storage_manage_fixed_disk(virtd_lxc_t) + +kernel_read_all_sysctls(virtd_lxc_t) +kernel_read_network_state(virtd_lxc_t) +kernel_read_system_state(virtd_lxc_t) + +corecmd_exec_bin(virtd_lxc_t) +corecmd_exec_shell(virtd_lxc_t) + +dev_relabel_all_dev_nodes(virtd_lxc_t) +dev_rw_sysfs(virtd_lxc_t) +dev_read_sysfs(virtd_lxc_t) +dev_read_urand(virtd_lxc_t) + +domain_use_interactive_fds(virtd_lxc_t) + +files_search_all(virtd_lxc_t) +files_getattr_all_files(virtd_lxc_t) +files_read_usr_files(virtd_lxc_t) +files_relabel_rootfs(virtd_lxc_t) +files_mounton_non_security(virtd_lxc_t) +files_mount_all_file_type_fs(virtd_lxc_t) +files_unmount_all_file_type_fs(virtd_lxc_t) +files_list_isid_type_dirs(virtd_lxc_t) +files_root_filetrans(virtd_lxc_t, svirt_lxc_file_t, dir_file_class_set) + +fs_getattr_all_fs(virtd_lxc_t) +fs_manage_tmpfs_dirs(virtd_lxc_t) +fs_manage_tmpfs_chr_files(virtd_lxc_t) +fs_manage_tmpfs_symlinks(virtd_lxc_t) +fs_manage_cgroup_dirs(virtd_lxc_t) +fs_mounton_tmpfs(virtd_lxc_t) +fs_remount_all_fs(virtd_lxc_t) +fs_rw_cgroup_files(virtd_lxc_t) +fs_unmount_all_fs(virtd_lxc_t) +fs_relabelfrom_tmpfs(virtd_lxc_t) + +selinux_mount_fs(virtd_lxc_t) +selinux_unmount_fs(virtd_lxc_t) +seutil_read_config(virtd_lxc_t) + +term_use_generic_ptys(virtd_lxc_t) +term_use_ptmx(virtd_lxc_t) +term_relabel_pty_fs(virtd_lxc_t) + +auth_use_nsswitch(virtd_lxc_t) + +logging_send_syslog_msg(virtd_lxc_t) + +seutil_domtrans_setfiles(virtd_lxc_t) +seutil_read_default_contexts(virtd_lxc_t) + +selinux_get_enforce_mode(virtd_lxc_t) +selinux_get_fs_mount(virtd_lxc_t) +selinux_validate_context(virtd_lxc_t) +selinux_compute_access_vector(virtd_lxc_t) +selinux_compute_create_context(virtd_lxc_t) +selinux_compute_relabel_context(virtd_lxc_t) +selinux_compute_user_contexts(virtd_lxc_t) +seutil_read_default_contexts(virtd_lxc_t) + +sysnet_domtrans_ifconfig(virtd_lxc_t) + +#optional_policy(` +# unconfined_shell_domtrans(virtd_lxc_t) +# unconfined_signal(virtd_t) +#') + +######################################## +# +# virt_lxc_domain local policy +# +allow svirt_lxc_domain self:capability { kill setuid setgid dac_override sys_boot }; + +allow virtd_t svirt_lxc_domain:unix_stream_socket { create_stream_socket_perms connectto }; +allow virtd_t svirt_lxc_domain:process { signal_perms }; +allow virtd_lxc_t svirt_lxc_domain:process { getattr getsched setsched transition signal signull sigkill }; +allow svirt_lxc_domain virtd_lxc_t:process sigchld; +allow svirt_lxc_domain virtd_lxc_t:fd use; +allow svirt_lxc_domain virt_lxc_var_run_t:dir list_dir_perms; +allow svirt_lxc_domain virt_lxc_var_run_t:file read_file_perms; +allow svirt_lxc_domain virtd_lxc_t:unix_stream_socket { connectto rw_socket_perms }; + +allow svirt_lxc_domain self:process { execstack execmem getattr signal_perms getsched setsched setcap setpgid }; +allow svirt_lxc_domain self:fifo_file manage_file_perms; +allow svirt_lxc_domain self:sem create_sem_perms; +allow svirt_lxc_domain self:shm create_shm_perms; +allow svirt_lxc_domain self:msgq create_msgq_perms; +allow svirt_lxc_domain self:unix_stream_socket { create_stream_socket_perms connectto }; +allow svirt_lxc_domain self:unix_dgram_socket { sendto create_socket_perms }; + +manage_dirs_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t) +manage_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t) +manage_lnk_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t) +manage_sock_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t) +manage_fifo_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t) +rw_chr_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t) +rw_blk_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t) +can_exec(svirt_lxc_domain, svirt_lxc_file_t) +allow svirt_lxc_net_t svirt_lxc_file_t:dir mounton; +allow svirt_lxc_net_t svirt_lxc_file_t:filesystem getattr; + +kernel_getattr_proc(svirt_lxc_domain) +kernel_list_all_proc(svirt_lxc_domain) +kernel_read_kernel_sysctls(svirt_lxc_domain) +kernel_rw_net_sysctls(svirt_lxc_domain) +kernel_read_system_state(svirt_lxc_domain) +kernel_dontaudit_search_kernel_sysctl(svirt_lxc_domain) + +corecmd_exec_all_executables(svirt_lxc_domain) + +files_read_kernel_modules(svirt_lxc_net_t) +files_dontaudit_getattr_all_dirs(svirt_lxc_domain) +files_dontaudit_getattr_all_files(svirt_lxc_domain) +files_dontaudit_getattr_all_symlinks(svirt_lxc_domain) +files_dontaudit_getattr_all_pipes(svirt_lxc_domain) +files_dontaudit_getattr_all_sockets(svirt_lxc_domain) +files_dontaudit_list_all_mountpoints(svirt_lxc_domain) +files_dontaudit_write_etc_runtime_files(svirt_lxc_domain) +files_entrypoint_all_files(svirt_lxc_domain) +files_list_var(svirt_lxc_domain) +files_list_var_lib(svirt_lxc_domain) +files_search_all(svirt_lxc_domain) +files_read_config_files(svirt_lxc_domain) +files_read_usr_files(svirt_lxc_domain) +files_read_usr_symlinks(svirt_lxc_domain) +files_search_locks(svirt_lxc_domain) + +fs_getattr_all_fs(svirt_lxc_domain) +fs_list_inotifyfs(svirt_lxc_domain) +fs_rw_inherited_tmpfs_files(svirt_lxc_domain) + +auth_dontaudit_read_passwd(svirt_lxc_domain) +auth_dontaudit_read_login_records(svirt_lxc_domain) +auth_dontaudit_write_login_records(svirt_lxc_domain) +auth_search_pam_console_data(svirt_lxc_domain) + +clock_read_adjtime(svirt_lxc_domain) + +init_read_utmp(svirt_lxc_domain) +init_dontaudit_write_utmp(svirt_lxc_domain) + +libs_dontaudit_setattr_lib_files(svirt_lxc_domain) + +miscfiles_dontaudit_setattr_fonts_cache_dirs(svirt_lxc_domain) +miscfiles_read_fonts(svirt_lxc_domain) + +mta_dontaudit_read_spool_symlinks(svirt_lxc_domain) + +systemd_read_unit_files(svirt_lxc_domain) + +optional_policy(` + udev_read_pid_files(svirt_lxc_domain) +') + +optional_policy(` + apache_exec_modules(svirt_lxc_domain) + apache_read_sys_content(svirt_lxc_domain) +') + +virt_lxc_domain_template(svirt_lxc_net) + +allow svirt_lxc_net_t self:capability { chown dac_read_search dac_override fowner fsetid net_raw net_admin net_bind_service sys_admin sys_nice sys_ptrace sys_resource setpcap }; +dontaudit svirt_lxc_net_t self:capability2 { block_suspend }; + +allow svirt_lxc_net_t self:process setrlimit; + +allow svirt_lxc_net_t self:udp_socket create_socket_perms; +allow svirt_lxc_net_t self:tcp_socket create_stream_socket_perms; +allow svirt_lxc_net_t self:netlink_route_socket create_netlink_socket_perms; +allow svirt_lxc_net_t self:packet_socket create_socket_perms; +allow svirt_lxc_net_t self:socket create_socket_perms; +allow svirt_lxc_net_t self:rawip_socket create_socket_perms; +allow svirt_lxc_net_t self:netlink_tcpdiag_socket create_socket_perms; +allow svirt_lxc_net_t self:netlink_kobject_uevent_socket create_socket_perms; + +kernel_read_network_state(svirt_lxc_net_t) +kernel_read_irq_sysctls(svirt_lxc_net_t) + +dev_read_sysfs(svirt_lxc_net_t) +dev_getattr_mtrr_dev(svirt_lxc_net_t) + +corenet_tcp_bind_generic_node(svirt_lxc_net_t) +corenet_udp_bind_generic_node(svirt_lxc_net_t) +corenet_tcp_sendrecv_all_ports(svirt_lxc_net_t) +corenet_udp_sendrecv_all_ports(svirt_lxc_net_t) +corenet_udp_bind_all_ports(svirt_lxc_net_t) +corenet_tcp_bind_all_ports(svirt_lxc_net_t) +corenet_tcp_connect_all_ports(svirt_lxc_net_t) + +fs_noxattr_type(svirt_lxc_file_t) +term_pty(svirt_lxc_file_t) + +auth_use_nsswitch(svirt_lxc_net_t) + +rpm_read_db(svirt_lxc_net_t) + +logging_send_audit_msgs(svirt_lxc_net_t) + +userdom_use_inherited_user_ptys(svirt_lxc_net_t) + +fs_mount_cgroup(svirt_lxc_net_t) +fs_manage_cgroup_dirs(svirt_lxc_net_t) +fs_manage_cgroup_files(svirt_lxc_net_t) + + +####################################### +# +# svirt_prot_exec local policy +# + +allow svirt_prot_exec_t self:process { execmem execstack }; + +######################################## +# +# virt_qmf local policy +# +allow virt_qmf_t self:capability { sys_nice sys_tty_config }; +allow virt_qmf_t self:process { setsched signal }; +allow virt_qmf_t self:fifo_file rw_fifo_file_perms; +allow virt_qmf_t self:unix_stream_socket create_stream_socket_perms; +allow virt_qmf_t self:tcp_socket create_stream_socket_perms; +allow virt_qmf_t self:netlink_route_socket create_netlink_socket_perms; + +can_exec(virt_qmf_t, virtd_exec_t) + +kernel_read_system_state(virt_qmf_t) +kernel_read_network_state(virt_qmf_t) + +dev_read_sysfs(virt_qmf_t) +dev_read_rand(virt_qmf_t) +dev_read_urand(virt_qmf_t) + +corenet_tcp_connect_matahari_port(virt_qmf_t) + +domain_use_interactive_fds(virt_qmf_t) + +logging_send_syslog_msg(virt_qmf_t) + +sysnet_read_config(virt_qmf_t) + +optional_policy(` + dbus_read_lib_files(virt_qmf_t) +') + +optional_policy(` + virt_stream_connect(virt_qmf_t) +') + +######################################## +# +# virt_bridgehelper local policy +# +allow virt_bridgehelper_t self:process { setcap getcap }; +allow virt_bridgehelper_t self:capability { setpcap setgid setuid net_admin }; +allow virt_bridgehelper_t self:tcp_socket create_stream_socket_perms; +allow virt_bridgehelper_t self:tun_socket create_socket_perms; +allow virt_bridgehelper_t self:unix_dgram_socket create_socket_perms; + +manage_files_pattern(virt_bridgehelper_t, svirt_home_t, svirt_home_t) + +kernel_read_network_state(virt_bridgehelper_t) + +corenet_rw_tun_tap_dev(virt_bridgehelper_t) + +userdom_use_inherited_user_ptys(virt_bridgehelper_t) diff --git a/vlock.te b/vlock.te index 2511093..669dc13 100644 --- a/vlock.te +++ b/vlock.te @@ -47,7 +47,5 @@ init_dontaudit_rw_utmp(vlock_t) logging_send_syslog_msg(vlock_t) -miscfiles_read_localization(vlock_t) - userdom_dontaudit_search_user_home_dirs(vlock_t) -userdom_use_user_terminals(vlock_t) +userdom_use_inherited_user_terminals(vlock_t) diff --git a/vmware.te b/vmware.te index 7d334c4..fb0da00 100644 --- a/vmware.te +++ b/vmware.te @@ -68,7 +68,7 @@ ifdef(`enable_mcs',` # VMWare host local policy # -allow vmware_host_t self:capability { setgid setuid net_raw sys_nice sys_time sys_ptrace kill dac_override }; +allow vmware_host_t self:capability { setgid setuid net_raw sys_nice sys_time kill dac_override }; dontaudit vmware_host_t self:capability sys_tty_config; allow vmware_host_t self:process { execstack execmem signal_perms }; allow vmware_host_t self:fifo_file rw_fifo_file_perms; @@ -98,7 +98,6 @@ kernel_read_kernel_sysctls(vmware_host_t) kernel_read_system_state(vmware_host_t) kernel_read_network_state(vmware_host_t) -corenet_all_recvfrom_unlabeled(vmware_host_t) corenet_all_recvfrom_netlabel(vmware_host_t) corenet_tcp_sendrecv_generic_if(vmware_host_t) corenet_udp_sendrecv_generic_if(vmware_host_t) @@ -122,6 +121,7 @@ dev_getattr_all_blk_files(vmware_host_t) dev_read_sysfs(vmware_host_t) dev_read_urand(vmware_host_t) dev_rw_vmware(vmware_host_t) +dev_rw_generic_chr_files(vmware_host_t) domain_use_interactive_fds(vmware_host_t) domain_dontaudit_read_all_domains_state(vmware_host_t) @@ -129,7 +129,7 @@ domain_dontaudit_read_all_domains_state(vmware_host_t) files_list_tmp(vmware_host_t) files_read_etc_files(vmware_host_t) files_read_etc_runtime_files(vmware_host_t) -files_read_usr_files(vmware_host_t) +files_read_usr_files(vmware_host_t) fs_getattr_all_fs(vmware_host_t) fs_search_auto_mountpoints(vmware_host_t) @@ -145,8 +145,6 @@ libs_exec_ld_so(vmware_host_t) logging_send_syslog_msg(vmware_host_t) -miscfiles_read_localization(vmware_host_t) - sysnet_dns_name_resolve(vmware_host_t) sysnet_domtrans_ifconfig(vmware_host_t) @@ -157,10 +155,22 @@ netutils_domtrans_ping(vmware_host_t) optional_policy(` hostname_exec(vmware_host_t) -') +') optional_policy(` modutils_domtrans_insmod(vmware_host_t) +') + +optional_policy(` + samba_read_config(vmware_host_t) +') + +optional_policy(` + seutil_sigchld_newrole(vmware_host_t) +') + +optional_policy(` + shutdown_domtrans(vmware_host_t) ') optional_policy(` @@ -269,9 +279,8 @@ libs_exec_ld_so(vmware_t) # Access X11 config files libs_read_lib_files(vmware_t) -miscfiles_read_localization(vmware_t) -userdom_use_user_terminals(vmware_t) +userdom_use_inherited_user_terminals(vmware_t) userdom_list_user_home_dirs(vmware_t) # cjp: why? userdom_read_user_home_content_files(vmware_t) diff --git a/vnstatd.if b/vnstatd.if index 727fe95..47ec114 100644 --- a/vnstatd.if +++ b/vnstatd.if @@ -123,20 +123,17 @@ interface(`vnstatd_manage_lib_files',` ## Domain allowed access. ## ## -## -## -## Role allowed access. -## -## -## # interface(`vnstatd_admin',` gen_require(` type vnstatd_t, vnstatd_var_lib_t; ') - allow $1 vnstatd_t:process { ptrace signal_perms }; + allow $1 vnstatd_t:process signal_perms; ps_process_pattern($1, vnstatd_t) + tunable_policy(`deny_ptrace',`',` + allow $1 vnstatd_t:process ptrace; + ') files_list_var_lib($1) admin_pattern($1, vnstatd_var_lib_t) diff --git a/vnstatd.te b/vnstatd.te index 8121937..f90b43b 100644 --- a/vnstatd.te +++ b/vnstatd.te @@ -28,9 +28,13 @@ allow vnstatd_t self:process signal; allow vnstatd_t self:fifo_file rw_fifo_file_perms; allow vnstatd_t self:unix_stream_socket create_stream_socket_perms; +manage_files_pattern(vnstatd_t, vnstatd_var_run_t, vnstatd_var_run_t) +manage_dirs_pattern(vnstatd_t, vnstatd_var_run_t, vnstatd_var_run_t) +files_pid_filetrans(vnstatd_t, vnstatd_var_run_t, { dir file }) + manage_dirs_pattern(vnstatd_t, vnstatd_var_lib_t, vnstatd_var_lib_t) manage_files_pattern(vnstatd_t, vnstatd_var_lib_t, vnstatd_var_lib_t) -files_var_lib_filetrans(vnstatd_t, vnstatd_var_lib_t, { dir file }) +files_var_lib_filetrans(vnstatd_t, vnstatd_var_lib_t, dir) manage_files_pattern(vnstatd_t, vnstatd_var_run_t, vnstatd_var_run_t) manage_dirs_pattern(vnstatd_t, vnstatd_var_run_t, vnstatd_var_run_t) @@ -47,8 +51,6 @@ fs_getattr_xattr_fs(vnstatd_t) logging_send_syslog_msg(vnstatd_t) -miscfiles_read_localization(vnstatd_t) - optional_policy(` cron_system_entry(vnstat_t, vnstat_exec_t) ') @@ -62,9 +64,9 @@ allow vnstat_t self:process signal; allow vnstat_t self:fifo_file rw_fifo_file_perms; allow vnstat_t self:unix_stream_socket create_stream_socket_perms; +files_search_var_lib(vnstat_t) manage_dirs_pattern(vnstat_t, vnstatd_var_lib_t, vnstatd_var_lib_t) manage_files_pattern(vnstat_t, vnstatd_var_lib_t, vnstatd_var_lib_t) -files_var_lib_filetrans(vnstat_t, vnstatd_var_lib_t, { dir file }) kernel_read_network_state(vnstat_t) kernel_read_system_state(vnstat_t) @@ -76,5 +78,3 @@ files_read_etc_files(vnstat_t) fs_getattr_xattr_fs(vnstat_t) logging_send_syslog_msg(vnstat_t) - -miscfiles_read_localization(vnstat_t) diff --git a/vpn.if b/vpn.if index 7b93e07..a4e2f60 100644 --- a/vpn.if +++ b/vpn.if @@ -37,11 +37,16 @@ interface(`vpn_domtrans',` # interface(`vpn_run',` gen_require(` - attribute_role vpnc_roles; + #attribute_role vpnc_roles; + type vpnc_t; ') + #vpn_domtrans($1) + #roleattribute $2 vpnc_roles; + vpn_domtrans($1) - roleattribute $2 vpnc_roles; + role $2 types vpnc_t; + sysnet_run_ifconfig(vpnc_t, $2) ') ######################################## diff --git a/vpn.te b/vpn.te index 83a80ba..9f367c4 100644 --- a/vpn.te +++ b/vpn.te @@ -5,13 +5,15 @@ policy_module(vpn, 1.15.0) # Declarations # -attribute_role vpnc_roles; -roleattribute system_r vpnc_roles; +#attribute_role vpnc_roles; +#roleattribute system_r vpnc_roles; type vpnc_t; type vpnc_exec_t; +init_system_domain(vpnc_t, vpnc_exec_t) application_domain(vpnc_t, vpnc_exec_t) -role vpnc_roles types vpnc_t; +#role vpnc_roles types vpnc_t; +role system_r types vpnc_t; type vpnc_tmp_t; files_tmp_file(vpnc_tmp_t) @@ -24,7 +26,7 @@ files_pid_file(vpnc_var_run_t) # Local policy # -allow vpnc_t self:capability { dac_read_search dac_override net_admin ipc_lock net_raw }; +allow vpnc_t self:capability { dac_read_search dac_override net_admin ipc_lock net_raw setuid }; allow vpnc_t self:process { getsched signal }; allow vpnc_t self:fifo_file rw_fifo_file_perms; allow vpnc_t self:netlink_route_socket rw_netlink_socket_perms; @@ -51,7 +53,6 @@ kernel_read_all_sysctls(vpnc_t) kernel_request_load_module(vpnc_t) kernel_rw_net_sysctls(vpnc_t) -corenet_all_recvfrom_unlabeled(vpnc_t) corenet_all_recvfrom_netlabel(vpnc_t) corenet_tcp_sendrecv_generic_if(vpnc_t) corenet_udp_sendrecv_generic_if(vpnc_t) @@ -80,18 +81,19 @@ domain_use_interactive_fds(vpnc_t) fs_getattr_xattr_fs(vpnc_t) fs_getattr_tmpfs(vpnc_t) -term_use_all_ptys(vpnc_t) -term_use_all_ttys(vpnc_t) +term_use_all_inherited_ptys(vpnc_t) +term_use_all_inherited_ttys(vpnc_t) corecmd_exec_all_executables(vpnc_t) files_exec_etc_files(vpnc_t) files_read_etc_runtime_files(vpnc_t) -files_read_etc_files(vpnc_t) files_dontaudit_search_home(vpnc_t) auth_use_nsswitch(vpnc_t) +init_dontaudit_use_fds(vpnc_t) + libs_exec_ld_so(vpnc_t) libs_exec_lib_files(vpnc_t) @@ -100,17 +102,16 @@ locallogin_use_fds(vpnc_t) logging_send_syslog_msg(vpnc_t) logging_dontaudit_search_logs(vpnc_t) -miscfiles_read_localization(vpnc_t) - seutil_dontaudit_search_config(vpnc_t) seutil_use_newrole_fds(vpnc_t) -sysnet_run_ifconfig(vpnc_t, vpnc_roles) +#sysnet_run_ifconfig(vpnc_t, vpnc_roles) sysnet_etc_filetrans_config(vpnc_t) sysnet_manage_config(vpnc_t) userdom_use_all_users_fds(vpnc_t) -userdom_dontaudit_search_user_home_content(vpnc_t) +userdom_read_home_certs(vpnc_t) +userdom_search_admin_dir(vpnc_t) optional_policy(` dbus_system_bus_client(vpnc_t) diff --git a/w3c.te b/w3c.te index 1174ad8..f4c4c1b 100644 --- a/w3c.te +++ b/w3c.te @@ -7,11 +7,18 @@ policy_module(w3c, 1.0.0) apache_content_template(w3c_validator) +type httpd_w3c_validator_tmp_t; +files_tmp_file(httpd_w3c_validator_tmp_t) + ######################################## # # Local policy # +manage_dirs_pattern(httpd_w3c_validator_script_t, httpd_w3c_validator_tmp_t, httpd_w3c_validator_tmp_t) +manage_files_pattern(httpd_w3c_validator_script_t, httpd_w3c_validator_tmp_t, httpd_w3c_validator_tmp_t) +files_tmp_filetrans(httpd_w3c_validator_script_t, httpd_w3c_validator_tmp_t, { file dir }) + corenet_tcp_connect_ftp_port(httpd_w3c_validator_script_t) corenet_tcp_sendrecv_ftp_port(httpd_w3c_validator_script_t) corenet_tcp_connect_http_port(httpd_w3c_validator_script_t) @@ -22,3 +29,5 @@ corenet_tcp_sendrecv_http_cache_port(httpd_w3c_validator_script_t) miscfiles_read_generic_certs(httpd_w3c_validator_script_t) sysnet_dns_name_resolve(httpd_w3c_validator_script_t) + +apache_dontaudit_rw_tmp_files(httpd_w3c_validator_script_t) diff --git a/watchdog.te b/watchdog.te index b10bb05..f0d56b5 100644 --- a/watchdog.te +++ b/watchdog.te @@ -42,7 +42,6 @@ kernel_unmount_proc(watchdog_t) corecmd_exec_shell(watchdog_t) # cjp: why networking? -corenet_all_recvfrom_unlabeled(watchdog_t) corenet_all_recvfrom_netlabel(watchdog_t) corenet_tcp_sendrecv_generic_if(watchdog_t) corenet_udp_sendrecv_generic_if(watchdog_t) @@ -81,8 +80,6 @@ auth_append_login_records(watchdog_t) logging_send_syslog_msg(watchdog_t) -miscfiles_read_localization(watchdog_t) - sysnet_read_config(watchdog_t) userdom_dontaudit_use_unpriv_user_fds(watchdog_t) diff --git a/wdmd.fc b/wdmd.fc new file mode 100644 index 0000000..ad47e05 --- /dev/null +++ b/wdmd.fc @@ -0,0 +1,6 @@ + +/etc/rc\.d/init\.d/wdmd -- gen_context(system_u:object_r:wdmd_initrc_exec_t,s0) + +/var/run/wdmd(/.*)? gen_context(system_u:object_r:wdmd_var_run_t,s0) + +/usr/sbin/wdmd -- gen_context(system_u:object_r:wdmd_exec_t,s0) diff --git a/wdmd.if b/wdmd.if new file mode 100644 index 0000000..8e3570d --- /dev/null +++ b/wdmd.if @@ -0,0 +1,113 @@ + +## watchdog multiplexing daemon + +######################################## +## +## Execute a domain transition to run wdmd. +## +## +## +## Domain allowed access. +## +## +# +interface(`wdmd_domtrans',` + gen_require(` + type wdmd_t, wdmd_exec_t; + ') + + domtrans_pattern($1, wdmd_exec_t, wdmd_t) +') + + +######################################## +## +## Execute wdmd server in the wdmd domain. +## +## +## +## The type of the process performing this action. +## +## +# +interface(`wdmd_initrc_domtrans',` + gen_require(` + type wdmd_initrc_exec_t; + ') + + init_labeled_script_domtrans($1, wdmd_initrc_exec_t) +') + +######################################## +## +## All of the rules required to administrate +## an wdmd environment +## +## +## +## Domain allowed access. +## +## +## +## +## Role allowed access. +## +## +## +# +interface(`wdmd_admin',` + gen_require(` + type wdmd_t; + type wdmd_initrc_exec_t; + ') + + allow $1 wdmd_t:process signal_perms; + ps_process_pattern($1, wdmd_t) + tunable_policy(`deny_ptrace',`',` + allow $1 wdmd_t:process ptrace; + ') + + wdmd_initrc_domtrans($1) + domain_system_change_exemption($1) + role_transition $2 wdmd_initrc_exec_t system_r; + allow $2 system_r; + +') + +###################################### +## +## Create, read, write, and delete wdmd PID files. +## +## +## +## Domain allowed access. +## +## +# +interface(`wdmd_manage_pid_files',` + gen_require(` + type wdmd_var_run_t; + ') + + files_search_pids($1) + manage_files_pattern($1, wdmd_var_run_t, wdmd_var_run_t) +') + +######################################## +## +## Connect to wdmd over a unix stream socket. +## +## +## +## Domain allowed access. +## +## +# +interface(`wdmd_stream_connect',` + gen_require(` + type wdmd_t, wdmd_var_run_t; + ') + + files_search_pids($1) + stream_connect_pattern($1, wdmd_var_run_t, wdmd_var_run_t, wdmd_t) +') diff --git a/wdmd.te b/wdmd.te new file mode 100644 index 0000000..29b9d6a --- /dev/null +++ b/wdmd.te @@ -0,0 +1,50 @@ +policy_module(wdmd,1.0.0) + +######################################## +# +# Declarations +# + +type wdmd_t; +type wdmd_exec_t; +init_daemon_domain(wdmd_t, wdmd_exec_t) + +type wdmd_var_run_t; +files_pid_file(wdmd_var_run_t) + +type wdmd_initrc_exec_t; +init_script_file(wdmd_initrc_exec_t) + +type wdmd_tmpfs_t; +files_tmpfs_file(wdmd_tmpfs_t) + +######################################## +# +# wdmd local policy +# +allow wdmd_t self:capability { chown sys_nice ipc_lock }; +allow wdmd_t self:process { setsched signal }; + +allow wdmd_t self:fifo_file rw_fifo_file_perms; +allow wdmd_t self:unix_stream_socket create_stream_socket_perms; + +manage_dirs_pattern(wdmd_t, wdmd_var_run_t, wdmd_var_run_t) +manage_files_pattern(wdmd_t, wdmd_var_run_t, wdmd_var_run_t) +manage_sock_files_pattern(wdmd_t, wdmd_var_run_t, wdmd_var_run_t) +files_pid_filetrans(wdmd_t, wdmd_var_run_t, { file dir sock_file }) + +manage_dirs_pattern(wdmd_t, wdmd_tmpfs_t, wdmd_tmpfs_t) +manage_files_pattern(wdmd_t, wdmd_tmpfs_t, wdmd_tmpfs_t) +fs_tmpfs_filetrans(wdmd_t, wdmd_tmpfs_t, { dir file }) + +dev_read_watchdog(wdmd_t) +dev_write_watchdog(wdmd_t) + +domain_use_interactive_fds(wdmd_t) + + +fs_read_anon_inodefs_files(wdmd_t) + +auth_use_nsswitch(wdmd_t) + +logging_send_syslog_msg(wdmd_t) diff --git a/webadm.te b/webadm.te index 0ecc786..3e7e984 100644 --- a/webadm.te +++ b/webadm.te @@ -28,7 +28,7 @@ userdom_base_user_template(webadm) # webadmin local policy # -allow webadm_t self:capability { dac_override dac_read_search kill sys_ptrace sys_nice }; +allow webadm_t self:capability { dac_override dac_read_search kill sys_nice }; files_dontaudit_search_all_dirs(webadm_t) files_manage_generic_locks(webadm_t) @@ -38,6 +38,7 @@ selinux_get_enforce_mode(webadm_t) seutil_domtrans_setfiles(webadm_t) logging_send_syslog_msg(webadm_t) +logging_send_audit_msgs(webadm_t) userdom_dontaudit_search_user_home_dirs(webadm_t) diff --git a/webalizer.te b/webalizer.te index 32b4f76..b00362b 100644 --- a/webalizer.te +++ b/webalizer.te @@ -59,7 +59,6 @@ files_var_lib_filetrans(webalizer_t, webalizer_var_lib_t, file) kernel_read_kernel_sysctls(webalizer_t) kernel_read_system_state(webalizer_t) -corenet_all_recvfrom_unlabeled(webalizer_t) corenet_all_recvfrom_netlabel(webalizer_t) corenet_tcp_sendrecv_generic_if(webalizer_t) corenet_tcp_sendrecv_generic_node(webalizer_t) @@ -69,24 +68,26 @@ fs_search_auto_mountpoints(webalizer_t) fs_getattr_xattr_fs(webalizer_t) fs_rw_anon_inodefs_files(webalizer_t) -files_read_etc_files(webalizer_t) files_read_etc_runtime_files(webalizer_t) logging_list_logs(webalizer_t) logging_send_syslog_msg(webalizer_t) -miscfiles_read_localization(webalizer_t) +auth_use_nsswitch(webalizer_t) + miscfiles_read_public_files(webalizer_t) sysnet_dns_name_resolve(webalizer_t) sysnet_read_config(webalizer_t) -userdom_use_user_terminals(webalizer_t) +userdom_use_inherited_user_terminals(webalizer_t) userdom_use_unpriv_users_fds(webalizer_t) userdom_dontaudit_search_user_home_content(webalizer_t) -apache_read_log(webalizer_t) -apache_manage_sys_content(webalizer_t) +optional_policy(` + apache_read_log(webalizer_t) + apache_manage_sys_content(webalizer_t) +') optional_policy(` cron_system_entry(webalizer_t, webalizer_exec_t) diff --git a/wine.fc b/wine.fc index 9d24449..2666317 100644 --- a/wine.fc +++ b/wine.fc @@ -2,6 +2,7 @@ HOME_DIR/cxoffice/bin/wine.+ -- gen_context(system_u:object_r:wine_exec_t,s0) /opt/cxoffice/bin/wine.* -- gen_context(system_u:object_r:wine_exec_t,s0) +/opt/google/picasa(/.*)?/Picasa3/.*exe -- gen_context(system_u:object_r:wine_exec_t,s0) /opt/google/picasa(/.*)?/bin/msiexec -- gen_context(system_u:object_r:wine_exec_t,s0) /opt/google/picasa(/.*)?/bin/notepad -- gen_context(system_u:object_r:wine_exec_t,s0) /opt/google/picasa(/.*)?/bin/progman -- gen_context(system_u:object_r:wine_exec_t,s0) @@ -10,6 +11,7 @@ HOME_DIR/cxoffice/bin/wine.+ -- gen_context(system_u:object_r:wine_exec_t,s0) /opt/google/picasa(/.*)?/bin/uninstaller -- gen_context(system_u:object_r:wine_exec_t,s0) /opt/google/picasa(/.*)?/bin/wdi -- gen_context(system_u:object_r:wine_exec_t,s0) /opt/google/picasa(/.*)?/bin/wine.* -- gen_context(system_u:object_r:wine_exec_t,s0) +/opt/teamviewer(/.*)?/bin/wine.* -- gen_context(system_u:object_r:wine_exec_t,s0) /opt/picasa/wine/bin/wine.* -- gen_context(system_u:object_r:wine_exec_t,s0) diff --git a/wine.if b/wine.if index f9a73d0..4b83bb0 100644 --- a/wine.if +++ b/wine.if @@ -10,10 +10,9 @@ ## for wine applications. ##

## -## +## ## -## The prefix of the user domain (e.g., user -## is the prefix for user_t). +## The role associated with the user domain. ## ## ## @@ -21,20 +20,19 @@ ## The type of the user domain. ## ## -## -## -## The role associated with the user domain. -## -## # template(`wine_role',` gen_require(` + type wine_t; + type wine_home_t; type wine_exec_t; ') role $1 types wine_t; domain_auto_trans($2, wine_exec_t, wine_t) + # Unrestricted inheritance from the caller. + allow $2 wine_t:process { noatsecure siginh rlimitinh }; allow wine_t $2:fd use; allow wine_t $2:process { sigchld signull }; allow wine_t $2:unix_stream_socket connectto; @@ -44,8 +42,7 @@ template(`wine_role',` allow $2 wine_t:process signal_perms; allow $2 wine_t:fd use; - allow $2 wine_t:shm { associate getattr }; - allow $2 wine_t:shm { unix_read unix_write }; + allow $2 wine_t:shm { associate getattr unix_read unix_write }; allow $2 wine_t:unix_stream_socket connectto; # X access, Home files @@ -86,6 +83,7 @@ template(`wine_role',` # template(`wine_role_template',` gen_require(` + type wine_t; type wine_exec_t; ') @@ -96,12 +94,12 @@ template(`wine_role_template',` role $2 types $1_wine_t; allow $1_wine_t self:process { execmem execstack }; - allow $3 $1_wine_t:process { getattr ptrace noatsecure signal_perms }; + allow $3 $1_wine_t:process { getattr noatsecure signal_perms }; domtrans_pattern($3, wine_exec_t, $1_wine_t) corecmd_bin_domtrans($1_wine_t, $1_t) userdom_unpriv_usertype($1, $1_wine_t) - userdom_manage_user_tmpfs_files($1_wine_t) + userdom_manage_tmpfs_role($2, $1_wine_t) domain_mmap_low($1_wine_t) @@ -109,6 +107,10 @@ template(`wine_role_template',` dontaudit $1_wine_t self:memprotect mmap_zero; ') + tunable_policy(`wine_mmap_zero_ignore',` + dontaudit $1_wine_t self:memprotect mmap_zero; + ') + optional_policy(` xserver_role($1_r, $1_wine_t) ') diff --git a/wine.te b/wine.te index 7a17516..56fbcc2 100644 --- a/wine.te +++ b/wine.te @@ -38,7 +38,7 @@ domain_mmap_low(wine_t) files_execmod_all_files(wine_t) -userdom_use_user_terminals(wine_t) +userdom_use_inherited_user_terminals(wine_t) tunable_policy(`wine_mmap_zero_ignore',` dontaudit wine_t self:memprotect mmap_zero; @@ -53,6 +53,10 @@ optional_policy(` ') optional_policy(` + rtkit_scheduled(wine_t) +') + +optional_policy(` unconfined_domain(wine_t) ') diff --git a/wireshark.te b/wireshark.te index fc0adf8..cf479f3 100644 --- a/wireshark.te +++ b/wireshark.te @@ -31,18 +31,19 @@ userdom_user_tmpfs_file(wireshark_tmpfs_t) # Local Policy # -allow wireshark_t self:capability { net_admin net_raw setgid }; +allow wireshark_t self:capability { net_admin net_raw }; allow wireshark_t self:process { signal getsched }; allow wireshark_t self:fifo_file { getattr read write }; allow wireshark_t self:shm destroy; allow wireshark_t self:shm create_shm_perms; allow wireshark_t self:netlink_route_socket { nlmsg_read create_socket_perms }; -allow wireshark_t self:packet_socket { setopt bind ioctl getopt create read write }; +allow wireshark_t self:packet_socket { setopt bind ioctl getopt create read }; allow wireshark_t self:tcp_socket create_socket_perms; allow wireshark_t self:udp_socket create_socket_perms; # Re-execute itself (why?) can_exec(wireshark_t, wireshark_exec_t) +corecmd_search_bin(wireshark_t) # /home/.wireshark manage_dirs_pattern(wireshark_t, wireshark_home_t, wireshark_home_t) @@ -67,7 +68,6 @@ kernel_read_system_state(wireshark_t) kernel_read_sysctl(wireshark_t) corecmd_exec_bin(wireshark_t) -corecmd_search_bin(wireshark_t) corenet_tcp_connect_generic_port(wireshark_t) corenet_tcp_sendrecv_generic_if(wireshark_t) @@ -76,7 +76,6 @@ dev_read_rand(wireshark_t) dev_read_sysfs(wireshark_t) dev_read_urand(wireshark_t) -files_read_etc_files(wireshark_t) files_read_usr_files(wireshark_t) fs_list_inotifyfs(wireshark_t) @@ -84,31 +83,17 @@ fs_search_auto_mountpoints(wireshark_t) libs_read_lib_files(wireshark_t) +auth_use_nsswitch(wireshark_t) + miscfiles_read_fonts(wireshark_t) -miscfiles_read_localization(wireshark_t) seutil_use_newrole_fds(wireshark_t) sysnet_read_config(wireshark_t) userdom_manage_user_home_content_files(wireshark_t) -userdom_use_user_ptys(wireshark_t) - -tunable_policy(`use_nfs_home_dirs',` - fs_manage_nfs_dirs(wireshark_t) - fs_manage_nfs_files(wireshark_t) - fs_manage_nfs_symlinks(wireshark_t) -') -tunable_policy(`use_samba_home_dirs',` - fs_manage_cifs_dirs(wireshark_t) - fs_manage_cifs_files(wireshark_t) - fs_manage_cifs_symlinks(wireshark_t) -') - -optional_policy(` - nscd_socket_use(wireshark_t) -') +userdom_home_manager(wireshark_t) # Manual transition from userhelper optional_policy(` diff --git a/wm.if b/wm.if index b3efef7..efa6002 100644 --- a/wm.if +++ b/wm.if @@ -75,7 +75,11 @@ template(`wm_role_template',` application_signull($1_wm_t) miscfiles_read_fonts($1_wm_t) - miscfiles_read_localization($1_wm_t) + + userdom_manage_home_role($2, $1_wm_t) + userdom_manage_tmpfs_role($2, $1_wm_t) + userdom_manage_tmp_role($2, $1_wm_t) + userdom_exec_user_tmp_files($1_wm_t) optional_policy(` dbus_system_bus_client($1_wm_t) diff --git a/xen.fc b/xen.fc index 1a1b374..574794d 100644 --- a/xen.fc +++ b/xen.fc @@ -1,12 +1,10 @@ /dev/xen/tapctrl.* -p gen_context(system_u:object_r:xenctl_t,s0) -/usr/bin/virsh -- gen_context(system_u:object_r:xm_exec_t,s0) - /usr/sbin/blktapctrl -- gen_context(system_u:object_r:blktap_exec_t,s0) /usr/sbin/evtchnd -- gen_context(system_u:object_r:evtchnd_exec_t,s0) /usr/sbin/tapdisk -- gen_context(system_u:object_r:blktap_exec_t,s0) -/usr/lib/xen/bin/qemu-dm -- gen_context(system_u:object_r:qemu_dm_exec_t,s0) +#/usr/lib/xen/bin/qemu-dm -- gen_context(system_u:object_r:qemu_dm_exec_t,s0) ifdef(`distro_debian',` /usr/lib/xen-[^/]*/bin/xenconsoled -- gen_context(system_u:object_r:xenconsoled_exec_t,s0) @@ -17,6 +15,7 @@ ifdef(`distro_debian',` /usr/sbin/xenconsoled -- gen_context(system_u:object_r:xenconsoled_exec_t,s0) /usr/sbin/xend -- gen_context(system_u:object_r:xend_exec_t,s0) /usr/sbin/xenstored -- gen_context(system_u:object_r:xenstored_exec_t,s0) +/usr/sbin/xl -- gen_context(system_u:object_r:xm_exec_t,s0) /usr/sbin/xm -- gen_context(system_u:object_r:xm_exec_t,s0) ') @@ -25,11 +24,11 @@ ifdef(`distro_debian',` /var/lib/xend(/.*)? gen_context(system_u:object_r:xend_var_lib_t,s0) /var/lib/xenstored(/.*)? gen_context(system_u:object_r:xenstored_var_lib_t,s0) -/var/log/evtchnd\.log -- gen_context(system_u:object_r:evtchnd_var_log_t,s0) +/var/log/evtchnd\.log.* -- gen_context(system_u:object_r:evtchnd_var_log_t,s0) /var/log/xen(/.*)? gen_context(system_u:object_r:xend_var_log_t,s0) -/var/log/xen-hotplug\.log -- gen_context(system_u:object_r:xend_var_log_t,s0) -/var/log/xend\.log -- gen_context(system_u:object_r:xend_var_log_t,s0) -/var/log/xend-debug\.log -- gen_context(system_u:object_r:xend_var_log_t,s0) +/var/log/xen-hotplug\.log.* -- gen_context(system_u:object_r:xend_var_log_t,s0) +/var/log/xend\.log.* -- gen_context(system_u:object_r:xend_var_log_t,s0) +/var/log/xend-debug\.log.* -- gen_context(system_u:object_r:xend_var_log_t,s0) /var/run/evtchnd -s gen_context(system_u:object_r:evtchnd_var_run_t,s0) /var/run/evtchnd\.pid -- gen_context(system_u:object_r:evtchnd_var_run_t,s0) diff --git a/xen.if b/xen.if index 77d41b6..cc73c96 100644 --- a/xen.if +++ b/xen.if @@ -20,6 +20,25 @@ interface(`xen_domtrans',` ######################################## ## +## Allow the specified domain to execute xend +## in the caller domain. +## +## +## +## Domain allowed access. +## +## +# +interface(`xen_exec',` + gen_require(` + type xend_exec_t; + ') + + can_exec($1, xend_exec_t) +') + +######################################## +## ## Inherit and use xen file descriptors. ## ## @@ -55,6 +74,26 @@ interface(`xen_dontaudit_use_fds',` dontaudit $1 xend_t:fd use; ') +####################################### +## +## Read xend pid files. +## +## +## +## Domain allowed access. +## +## +# +interface(`xen_read_pid_files_xenstored',` + gen_require(` + type xenstored_var_run_t; + ') + + files_search_pids($1) + + read_files_pattern($1, xenstored_var_run_t, xenstored_var_run_t) +') + ######################################## ## ## Read xend image files. @@ -87,6 +126,26 @@ interface(`xen_read_image_files',` ## ## # +interface(`xen_manage_image_dirs',` + gen_require(` + type xend_var_lib_t; + ') + + files_list_var_lib($1) + manage_dirs_pattern($1, xend_var_lib_t, xend_var_lib_t) +') + +######################################## +## +## Allow the specified domain to read/write +## xend image files. +## +## +## +## Domain allowed to transition. +## +## +# interface(`xen_rw_image_files',` gen_require(` type xen_image_t, xend_var_lib_t; @@ -161,7 +220,7 @@ interface(`xen_dontaudit_rw_unix_stream_sockets',` ######################################## ## -## Connect to xenstored over an unix stream socket. +## Connect to xenstored over a unix stream socket. ## ## ## @@ -180,7 +239,7 @@ interface(`xen_stream_connect_xenstore',` ######################################## ## -## Connect to xend over an unix domain stream socket. +## Connect to xend over a unix domain stream socket. ## ## ## @@ -213,14 +272,15 @@ interface(`xen_stream_connect',` interface(`xen_domtrans_xm',` gen_require(` type xm_t, xm_exec_t; + attribute virsh_transition_domain; ') - + typeattribute $1 virsh_transition_domain; domtrans_pattern($1, xm_exec_t, xm_t) ') ######################################## ## -## Connect to xm over an unix stream socket. +## Connect to xm over a unix stream socket. ## ## ## @@ -230,7 +290,7 @@ interface(`xen_domtrans_xm',` # interface(`xen_stream_connect_xm',` gen_require(` - type xm_t; + type xm_t, xenstored_var_run_t; ') files_search_pids($1) diff --git a/xen.te b/xen.te index 07033bb..203e2f8 100644 --- a/xen.te +++ b/xen.te @@ -4,6 +4,7 @@ policy_module(xen, 1.12.0) # # Declarations # +attribute xm_transition_domain; ## ##

@@ -65,6 +66,7 @@ type xen_image_t; # customizable files_type(xen_image_t) # xen_image_t can be assigned to blk devices dev_node(xen_image_t) +virt_image(xen_image_t) type xenctl_t; files_type(xenctl_t) @@ -121,11 +123,6 @@ init_daemon_domain(xenconsoled_t, xenconsoled_exec_t) type xenconsoled_var_run_t; files_pid_file(xenconsoled_var_run_t) -type xm_t; -type xm_exec_t; -domain_type(xm_t) -init_system_domain(xm_t, xm_exec_t) - ######################################## # # blktap local policy @@ -135,22 +132,21 @@ tunable_policy(`xend_run_blktap',` # If yes, transition to its own domain. domtrans_pattern(xend_t, blktap_exec_t, blktap_t) - allow blktap_t self:fifo_file { read write }; +',` + # If no, then silently refuse to run it. + dontaudit xend_t blktap_exec_t:file { execute execute_no_trans }; +') - dev_read_sysfs(blktap_t) - dev_rw_xen(blktap_t) +allow blktap_t self:fifo_file { read write }; - files_read_etc_files(blktap_t) +dev_read_sysfs(blktap_t) +dev_rw_xen(blktap_t) - logging_send_syslog_msg(blktap_t) +files_read_etc_files(blktap_t) - miscfiles_read_localization(blktap_t) +logging_send_syslog_msg(blktap_t) - xen_stream_connect_xenstore(blktap_t) -',` - # If no, then silently refuse to run it. - dontaudit xend_t blktap_exec_t:file { execute execute_no_trans }; -') +xen_stream_connect_xenstore(blktap_t) ####################################### # @@ -170,6 +166,10 @@ files_pid_filetrans(evtchnd_t, evtchnd_var_run_t, { file sock_file dir }) # # qemu-dm local policy # + +# TODO: This part of policy should be removed +# qemu-dm should run in xend_t domain + # Do we need to allow execution of qemu-dm? tunable_policy(`xend_run_qemu',` allow qemu_dm_t self:capability sys_resource; @@ -195,7 +195,6 @@ tunable_policy(`xend_run_qemu',` fs_manage_xenfs_dirs(qemu_dm_t) fs_manage_xenfs_files(qemu_dm_t) - miscfiles_read_localization(qemu_dm_t) xen_stream_connect_xenstore(qemu_dm_t) ',` @@ -208,10 +207,13 @@ tunable_policy(`xend_run_qemu',` # xend local policy # -allow xend_t self:capability { dac_override ipc_lock net_admin setuid sys_nice sys_tty_config net_raw }; -dontaudit xend_t self:capability { sys_ptrace }; +allow xend_t self:capability { dac_override ipc_lock net_admin setuid sys_admin sys_nice sys_tty_config net_raw }; allow xend_t self:process { signal sigkill }; -dontaudit xend_t self:process ptrace; + +# needed by qemu_dm +allow xend_t self:capability sys_resource; +allow xend_t self:process setrlimit; + # internal communication is often done using fifo and unix sockets. allow xend_t self:fifo_file rw_fifo_file_perms; allow xend_t self:unix_stream_socket create_stream_socket_perms; @@ -219,6 +221,7 @@ allow xend_t self:unix_dgram_socket create_socket_perms; allow xend_t self:netlink_route_socket r_netlink_socket_perms; allow xend_t self:tcp_socket create_stream_socket_perms; allow xend_t self:packet_socket create_socket_perms; +allow xend_t self:tun_socket create_socket_perms; allow xend_t xen_image_t:dir list_dir_perms; manage_dirs_pattern(xend_t, xen_image_t, xen_image_t) @@ -275,7 +278,6 @@ kernel_read_network_state(xend_t) corecmd_exec_bin(xend_t) corecmd_exec_shell(xend_t) -corenet_all_recvfrom_unlabeled(xend_t) corenet_all_recvfrom_netlabel(xend_t) corenet_tcp_sendrecv_generic_if(xend_t) corenet_tcp_sendrecv_generic_node(xend_t) @@ -294,12 +296,13 @@ corenet_sendrecv_soundd_server_packets(xend_t) corenet_rw_tun_tap_dev(xend_t) dev_read_urand(xend_t) +# run lsscsi +dev_getattr_all_chr_files(xend_t) dev_filetrans_xen(xend_t) dev_rw_sysfs(xend_t) dev_rw_xen(xend_t) domain_dontaudit_read_all_domains_state(xend_t) -domain_dontaudit_ptrace_all_domains(xend_t) files_read_etc_files(xend_t) files_read_kernel_symbol_table(xend_t) @@ -309,7 +312,9 @@ files_etc_filetrans_etc_runtime(xend_t, file) files_read_usr_files(xend_t) files_read_default_symlinks(xend_t) +term_setattr_generic_ptys(xend_t) term_getattr_all_ptys(xend_t) +term_setattr_all_ptys(xend_t) term_use_generic_ptys(xend_t) term_use_ptmx(xend_t) term_getattr_pty_fs(xend_t) @@ -320,13 +325,10 @@ locallogin_dontaudit_use_fds(xend_t) logging_send_syslog_msg(xend_t) -lvm_domtrans(xend_t) +auth_read_passwd(xend_t) -miscfiles_read_localization(xend_t) miscfiles_read_hwdata(xend_t) -mount_domtrans(xend_t) - sysnet_domtrans_dhcpc(xend_t) sysnet_signal_dhcpc(xend_t) sysnet_domtrans_ifconfig(xend_t) @@ -339,8 +341,6 @@ userdom_dontaudit_search_user_home_dirs(xend_t) xen_stream_connect_xenstore(xend_t) -netutils_domtrans(xend_t) - optional_policy(` brctl_domtrans(xend_t) ') @@ -349,6 +349,27 @@ optional_policy(` consoletype_exec(xend_t) ') +optional_policy(` + lvm_domtrans(xend_t) +') + +optional_policy(` + mount_domtrans(xend_t) +') + +optional_policy(` + netutils_domtrans(xend_t) +') + +optional_policy(` + ptchown_exec(xend_t) +') + +optional_policy(` + virt_search_images(xend_t) + virt_read_config(xend_t) +') + ######################################## # # Xen console local policy @@ -374,8 +395,6 @@ dev_rw_xen(xenconsoled_t) dev_filetrans_xen(xenconsoled_t) dev_rw_sysfs(xenconsoled_t) -domain_dontaudit_ptrace_all_domains(xenconsoled_t) - files_read_etc_files(xenconsoled_t) files_read_usr_files(xenconsoled_t) @@ -390,7 +409,6 @@ term_use_console(xenconsoled_t) init_use_fds(xenconsoled_t) init_use_script_ptys(xenconsoled_t) -miscfiles_read_localization(xenconsoled_t) xen_manage_log(xenconsoled_t) xen_stream_connect_xenstore(xenconsoled_t) @@ -413,9 +431,10 @@ manage_dirs_pattern(xenstored_t, xenstored_tmp_t, xenstored_tmp_t) files_tmp_filetrans(xenstored_t, xenstored_tmp_t, { file dir }) # pid file +manage_dirs_pattern(xenstored_t, xenstored_var_run_t, xenstored_var_run_t) manage_files_pattern(xenstored_t, xenstored_var_run_t, xenstored_var_run_t) manage_sock_files_pattern(xenstored_t, xenstored_var_run_t, xenstored_var_run_t) -files_pid_filetrans(xenstored_t, xenstored_var_run_t, { file sock_file }) +files_pid_filetrans(xenstored_t, xenstored_var_run_t, { file sock_file dir }) # log files manage_dirs_pattern(xenstored_t, xenstored_var_log_t, xenstored_var_log_t) @@ -442,111 +461,24 @@ files_read_etc_files(xenstored_t) files_read_usr_files(xenstored_t) +fs_search_xenfs(xenstored_t) fs_manage_xenfs_files(xenstored_t) term_use_generic_ptys(xenstored_t) +term_use_console(xenconsoled_t) init_use_fds(xenstored_t) init_use_script_ptys(xenstored_t) logging_send_syslog_msg(xenstored_t) -miscfiles_read_localization(xenstored_t) - xen_append_log(xenstored_t) ######################################## # -# xm local policy -# - -allow xm_t self:capability { dac_override ipc_lock sys_tty_config }; -allow xm_t self:process { getsched signal }; - -# internal communication is often done using fifo and unix sockets. -allow xm_t self:fifo_file rw_fifo_file_perms; -allow xm_t self:unix_stream_socket { create_stream_socket_perms connectto }; -allow xm_t self:tcp_socket create_stream_socket_perms; - -manage_files_pattern(xm_t, xend_var_lib_t, xend_var_lib_t) -manage_fifo_files_pattern(xm_t, xend_var_lib_t, xend_var_lib_t) -manage_sock_files_pattern(xm_t, xend_var_lib_t, xend_var_lib_t) -files_search_var_lib(xm_t) - -allow xm_t xen_image_t:dir rw_dir_perms; -allow xm_t xen_image_t:file read_file_perms; -allow xm_t xen_image_t:blk_file read_blk_file_perms; - -kernel_read_system_state(xm_t) -kernel_read_kernel_sysctls(xm_t) -kernel_read_sysctl(xm_t) -kernel_read_xen_state(xm_t) -kernel_write_xen_state(xm_t) - -corecmd_exec_bin(xm_t) -corecmd_exec_shell(xm_t) - -corenet_tcp_sendrecv_generic_if(xm_t) -corenet_tcp_sendrecv_generic_node(xm_t) -corenet_tcp_connect_soundd_port(xm_t) - -dev_read_urand(xm_t) -dev_read_sysfs(xm_t) - -files_read_etc_runtime_files(xm_t) -files_read_usr_files(xm_t) -files_list_mnt(xm_t) -# Some common macros (you might be able to remove some) -files_read_etc_files(xm_t) - -fs_getattr_all_fs(xm_t) -fs_manage_xenfs_dirs(xm_t) -fs_manage_xenfs_files(xm_t) - -term_use_all_terms(xm_t) - -init_stream_connect_script(xm_t) -init_rw_script_stream_sockets(xm_t) -init_use_fds(xm_t) - -miscfiles_read_localization(xm_t) - -sysnet_dns_name_resolve(xm_t) - -xen_append_log(xm_t) -xen_stream_connect(xm_t) -xen_stream_connect_xenstore(xm_t) - -optional_policy(` - dbus_system_bus_client(xm_t) - - optional_policy(` - hal_dbus_chat(xm_t) - ') -') - -optional_policy(` - virt_domtrans(xm_t) - virt_manage_images(xm_t) - virt_manage_config(xm_t) - virt_stream_connect(xm_t) -') - -######################################## -# # SSH component local policy # optional_policy(` - ssh_basic_client_template(xm, xm_t, system_r) - - kernel_read_xen_state(xm_ssh_t) - kernel_write_xen_state(xm_ssh_t) - - files_search_tmp(xm_ssh_t) - - fs_manage_xenfs_dirs(xm_ssh_t) - fs_manage_xenfs_files(xm_ssh_t) - #Should have a boolean wrapping these fs_list_auto_mountpoints(xend_t) files_search_mnt(xend_t) @@ -559,8 +491,4 @@ optional_policy(` fs_manage_nfs_files(xend_t) fs_read_nfs_symlinks(xend_t) ') - - optional_policy(` - unconfined_domain(xend_t) - ') ') diff --git a/xfs.te b/xfs.te index 11c1b12..fc5d128 100644 --- a/xfs.te +++ b/xfs.te @@ -37,7 +37,6 @@ files_pid_filetrans(xfs_t, xfs_var_run_t, file) kernel_read_kernel_sysctls(xfs_t) kernel_read_system_state(xfs_t) -corenet_all_recvfrom_unlabeled(xfs_t) corenet_all_recvfrom_netlabel(xfs_t) corenet_tcp_sendrecv_generic_if(xfs_t) corenet_tcp_sendrecv_generic_node(xfs_t) @@ -57,7 +56,6 @@ fs_search_auto_mountpoints(xfs_t) domain_use_interactive_fds(xfs_t) -files_read_etc_files(xfs_t) files_read_etc_runtime_files(xfs_t) files_read_usr_files(xfs_t) @@ -65,7 +63,6 @@ auth_use_nsswitch(xfs_t) logging_send_syslog_msg(xfs_t) -miscfiles_read_localization(xfs_t) miscfiles_read_fonts(xfs_t) userdom_dontaudit_use_unpriv_user_fds(xfs_t) diff --git a/xguest.te b/xguest.te index e88b95f..f978acc 100644 --- a/xguest.te +++ b/xguest.te @@ -14,7 +14,7 @@ gen_tunable(xguest_mount_media, true) ## ##

-## Allow xguest to configure Network Manager +## Allow xguest users to configure Network Manager and connect to apache ports ##

## gen_tunable(xguest_connect_network, true) @@ -29,6 +29,7 @@ gen_tunable(xguest_use_bluetooth, true) role xguest_r; userdom_restricted_xwindows_user_template(xguest) +sysnet_dns_name_resolve(xguest_t) ######################################## # @@ -49,11 +50,22 @@ ifndef(`enable_mls',` ') ') +optional_policy(` + # Dontaudit fusermount + mount_dontaudit_exec_fusermount(xguest_t) +') + +kernel_dontaudit_request_load_module(xguest_t) + +tunable_policy(`selinuxuser_execstack',` + allow xguest_t self:process execstack; +') + # Allow mounting of file systems optional_policy(` tunable_policy(`xguest_mount_media',` kernel_read_fs_sysctls(xguest_t) - + kernel_request_load_module(xguest_t) files_dontaudit_getattr_boot_dirs(xguest_t) files_search_mnt(xguest_t) @@ -62,10 +74,9 @@ optional_policy(` fs_manage_noxattr_fs_dirs(xguest_t) fs_getattr_noxattr_fs(xguest_t) fs_read_noxattr_fs_symlinks(xguest_t) + fs_mount_fusefs(xguest_t) auth_list_pam_console_data(xguest_t) - - init_read_utmp(xguest_t) ') ') @@ -76,23 +87,95 @@ optional_policy(` ') optional_policy(` + tunable_policy(`xguest_use_bluetooth',` + blueman_dbus_chat(xguest_t) + ') +') + + +optional_policy(` + chrome_role(xguest_r, xguest_t) +') + +optional_policy(` hal_dbus_chat(xguest_t) ') optional_policy(` - java_role(xguest_r, xguest_t) + apache_role(xguest_r, xguest_t) +') + +optional_policy(` + gnome_role(xguest_r, xguest_t) +') + +optional_policy(` + gnomeclock_dontaudit_dbus_chat(xguest_t) +') + +optional_policy(` + mozilla_run_plugin(xguest_t, xguest_r) +') + +optional_policy(` + pcscd_read_pub_files(xguest_t) + pcscd_stream_connect(xguest_t) ') optional_policy(` - mozilla_role(xguest_r, xguest_t) + rhsmcertd_dontaudit_dbus_chat(xguest_t) ') optional_policy(` tunable_policy(`xguest_connect_network',` + kernel_read_network_state(xguest_t) + networkmanager_dbus_chat(xguest_t) + networkmanager_read_lib_files(xguest_t) corenet_tcp_connect_pulseaudio_port(xguest_t) + corenet_tcp_sendrecv_generic_if(xguest_t) + corenet_raw_sendrecv_generic_if(xguest_t) + corenet_tcp_sendrecv_generic_node(xguest_t) + corenet_raw_sendrecv_generic_node(xguest_t) + corenet_tcp_sendrecv_http_port(xguest_t) + corenet_tcp_sendrecv_http_cache_port(xguest_t) + corenet_tcp_sendrecv_squid_port(xguest_t) + corenet_tcp_sendrecv_ftp_port(xguest_t) + corenet_tcp_sendrecv_ipp_port(xguest_t) + corenet_tcp_connect_http_port(xguest_t) + corenet_tcp_connect_http_cache_port(xguest_t) + corenet_tcp_connect_squid_port(xguest_t) + corenet_tcp_connect_flash_port(xguest_t) + corenet_tcp_connect_ftp_port(xguest_t) corenet_tcp_connect_ipp_port(xguest_t) + corenet_tcp_connect_generic_port(xguest_t) + corenet_tcp_connect_soundd_port(xguest_t) + corenet_sendrecv_http_client_packets(xguest_t) + corenet_sendrecv_http_cache_client_packets(xguest_t) + corenet_sendrecv_squid_client_packets(xguest_t) + corenet_sendrecv_ftp_client_packets(xguest_t) + corenet_sendrecv_ipp_client_packets(xguest_t) + corenet_sendrecv_generic_client_packets(xguest_t) + # Should not need other ports + corenet_dontaudit_tcp_sendrecv_generic_port(xguest_t) + corenet_dontaudit_tcp_bind_generic_port(xguest_t) + corenet_tcp_connect_speech_port(xguest_t) + corenet_tcp_sendrecv_transproxy_port(xguest_t) + corenet_tcp_connect_transproxy_port(xguest_t) ') + + #optional_policy(` + # telepathy_dbus_session_role(xguest_r, xguest_t) + #') +') + +optional_policy(` + gen_require(` + type mozilla_t; + ') + + allow xguest_t mozilla_t:process transition; + role xguest_r types mozilla_t; ') -#gen_user(xguest_u,, xguest_r, s0, s0) +gen_user(xguest_u, user, xguest_r, s0, s0) diff --git a/xprint.te b/xprint.te index 68d13e5..4fe8668 100644 --- a/xprint.te +++ b/xprint.te @@ -32,7 +32,6 @@ kernel_read_kernel_sysctls(xprint_t) corecmd_exec_bin(xprint_t) corecmd_exec_shell(xprint_t) -corenet_all_recvfrom_unlabeled(xprint_t) corenet_all_recvfrom_netlabel(xprint_t) corenet_tcp_sendrecv_generic_if(xprint_t) corenet_udp_sendrecv_generic_if(xprint_t) @@ -58,7 +57,6 @@ fs_search_auto_mountpoints(xprint_t) logging_send_syslog_msg(xprint_t) miscfiles_read_fonts(xprint_t) -miscfiles_read_localization(xprint_t) sysnet_read_config(xprint_t) diff --git a/xscreensaver.te b/xscreensaver.te index 1487a4e..c099b55 100644 --- a/xscreensaver.te +++ b/xscreensaver.te @@ -33,9 +33,7 @@ init_read_utmp(xscreensaver_t) logging_send_audit_msgs(xscreensaver_t) logging_send_syslog_msg(xscreensaver_t) -miscfiles_read_localization(xscreensaver_t) - -userdom_use_user_ptys(xscreensaver_t) +userdom_use_inherited_user_ptys(xscreensaver_t) #access to .icons and ~/.xscreensaver userdom_read_user_home_content_files(xscreensaver_t) diff --git a/yam.te b/yam.te index 223ad43..a3267e5 100644 --- a/yam.te +++ b/yam.te @@ -58,7 +58,6 @@ corecmd_exec_bin(yam_t) # Rsync and lftp need to network. They also set files attributes to # match whats on the remote server. -corenet_all_recvfrom_unlabeled(yam_t) corenet_all_recvfrom_netlabel(yam_t) corenet_tcp_sendrecv_generic_if(yam_t) corenet_tcp_sendrecv_generic_node(yam_t) @@ -71,7 +70,6 @@ corenet_sendrecv_rsync_client_packets(yam_t) # mktemp dev_read_urand(yam_t) -files_read_etc_files(yam_t) files_read_etc_runtime_files(yam_t) # /usr/share/createrepo/genpkgmetadata.py: files_exec_usr_files(yam_t) @@ -83,16 +81,15 @@ fs_search_auto_mountpoints(yam_t) # Content can also be on ISO image files. fs_read_iso9660_files(yam_t) -logging_send_syslog_msg(yam_t) +auth_use_nsswitch(yam_t) -miscfiles_read_localization(yam_t) +logging_send_syslog_msg(yam_t) seutil_read_config(yam_t) -sysnet_dns_name_resolve(yam_t) sysnet_read_config(yam_t) -userdom_use_user_terminals(yam_t) +userdom_use_inherited_user_terminals(yam_t) userdom_use_unpriv_users_fds(yam_t) # Reading dotfiles... # cjp: ? diff --git a/zabbix.fc b/zabbix.fc index aa5a521..980c0df 100644 --- a/zabbix.fc +++ b/zabbix.fc @@ -1,8 +1,12 @@ /etc/rc\.d/init\.d/zabbix -- gen_context(system_u:object_r:zabbix_initrc_exec_t,s0) -/etc/rc\.d/init\.d/zabbix-agentd -- gen_context(system_u:object_r:zabbix_agent_initrc_exec_t,s0) +/etc/rc\.d/init\.d/zabbix-server -- gen_context(system_u:object_r:zabbix_initrc_exec_t,s0) +/etc/rc\.d/init\.d/zabbix-agentd -- gen_context(system_u:object_r:zabbix_agent_initrc_exec_t,s0) /usr/(s)?bin/zabbix_server -- gen_context(system_u:object_r:zabbix_exec_t,s0) /usr/(s)?bin/zabbix_agentd -- gen_context(system_u:object_r:zabbix_agent_exec_t,s0) +/usr/sbin/zabbix_server_mysql -- gen_context(system_u:object_r:zabbix_exec_t,s0) +/usr/sbin/zabbix_server_pgsql -- gen_context(system_u:object_r:zabbix_exec_t,s0) +/usr/sbin/zabbix_server_sqlite3 -- gen_context(system_u:object_r:zabbix_exec_t,s0) /var/log/zabbix(/.*)? gen_context(system_u:object_r:zabbix_log_t,s0) diff --git a/zabbix.if b/zabbix.if index c9981d1..38ce620 100644 --- a/zabbix.if +++ b/zabbix.if @@ -61,6 +61,26 @@ interface(`zabbix_read_log',` ######################################## ## +## Allow the specified domain to read zabbix's tmp files. +## +## +## +## Domain allowed access. +## +## +## +# +interface(`zabbix_read_tmp',` + gen_require(` + type zabbix_tmp_t; + ') + + files_search_tmp($1) + read_files_pattern($1, zabbix_tmp_t, zabbix_tmp_t) +') + +######################################## +## ## Allow the specified domain to append ## zabbix log files. ## @@ -110,7 +130,7 @@ interface(`zabbix_read_pid_files',` # interface(`zabbix_agent_tcp_connect',` gen_require(` - type zabbix_agent_t; + type zabbix_t, zabbix_agent_t; ') corenet_sendrecv_zabbix_agent_client_packets($1) @@ -142,8 +162,11 @@ interface(`zabbix_admin',` type zabbix_initrc_exec_t; ') - allow $1 zabbix_t:process { ptrace signal_perms }; + allow $1 zabbix_t:process signal_perms; ps_process_pattern($1, zabbix_t) + tunable_policy(`deny_ptrace',`',` + allow $1 zabbix_t:process ptrace; + ') init_labeled_script_domtrans($1, zabbix_initrc_exec_t) domain_system_change_exemption($1) diff --git a/zabbix.te b/zabbix.te index 8c0bd70..40b1c56 100644 --- a/zabbix.te +++ b/zabbix.te @@ -5,6 +5,13 @@ policy_module(zabbix, 1.5.0) # Declarations # +## +##

+## Allow zabbix to connect to unreserved ports +##

+## +gen_tunable(zabbix_can_network, false) + type zabbix_t; type zabbix_exec_t; init_daemon_domain(zabbix_t, zabbix_exec_t) @@ -23,6 +30,10 @@ init_script_file(zabbix_agent_initrc_exec_t) type zabbix_log_t; logging_log_file(zabbix_log_t) +# tmp files +type zabbix_tmp_t; +files_tmp_file(zabbix_tmp_t) + # shared memory type zabbix_tmpfs_t; files_tmpfs_file(zabbix_tmpfs_t) @@ -36,19 +47,25 @@ files_pid_file(zabbix_var_run_t) # zabbix local policy # -allow zabbix_t self:capability { setuid setgid }; -allow zabbix_t self:fifo_file rw_file_perms; -allow zabbix_t self:process { setsched getsched signal }; +allow zabbix_t self:capability { dac_read_search dac_override setuid setgid }; +allow zabbix_t self:process setsched; +allow zabbix_t self:sem create_sem_perms; +allow zabbix_t self:fifo_file rw_fifo_file_perms; allow zabbix_t self:unix_stream_socket create_stream_socket_perms; allow zabbix_t self:sem create_sem_perms; allow zabbix_t self:shm create_shm_perms; allow zabbix_t self:tcp_socket create_stream_socket_perms; # log files -allow zabbix_t zabbix_log_t:dir setattr; +allow zabbix_t zabbix_log_t:dir setattr_dir_perms; manage_files_pattern(zabbix_t, zabbix_log_t, zabbix_log_t) logging_log_filetrans(zabbix_t, zabbix_log_t, file) +# tmp files +manage_dirs_pattern(zabbix_t, zabbix_tmp_t, zabbix_tmp_t) +manage_files_pattern(zabbix_t, zabbix_tmp_t, zabbix_tmp_t) +files_tmp_filetrans(zabbix_t, zabbix_tmp_t, { dir file }) + # shared memory rw_files_pattern(zabbix_t, zabbix_tmpfs_t, zabbix_tmpfs_t) fs_tmpfs_filetrans(zabbix_t, zabbix_tmpfs_t, file) @@ -58,26 +75,48 @@ manage_dirs_pattern(zabbix_t, zabbix_var_run_t, zabbix_var_run_t) manage_files_pattern(zabbix_t, zabbix_var_run_t, zabbix_var_run_t) files_pid_filetrans(zabbix_t, zabbix_var_run_t, { dir file }) +kernel_read_system_state(zabbix_t) +kernel_read_kernel_sysctls(zabbix_t) + +corecmd_exec_bin(zabbix_t) +corecmd_exec_shell(zabbix_t) + corenet_tcp_bind_generic_node(zabbix_t) corenet_tcp_bind_zabbix_port(zabbix_t) +# needed by zabbix-server-mysql +corenet_tcp_connect_http_port(zabbix_t) +# to monitor ftp urls +corenet_tcp_connect_ftp_port(zabbix_t) -files_read_etc_files(zabbix_t) +dev_read_urand(zabbix_t) -miscfiles_read_localization(zabbix_t) +files_read_usr_files(zabbix_t) + +auth_use_nsswitch(zabbix_t) -sysnet_dns_name_resolve(zabbix_t) zabbix_agent_tcp_connect(zabbix_t) +tunable_policy(`zabbix_can_network',` + corenet_tcp_connect_all_ports(zabbix_t) +') + optional_policy(` mysql_stream_connect(zabbix_t) - mysql_tcp_connect(zabbix_t) +') + +optional_policy(` + netutils_domtrans_ping(zabbix_t) ') optional_policy(` postgresql_stream_connect(zabbix_t) ') +optional_policy(` + snmp_read_snmp_var_lib_dirs(zabbix_t) +') + ######################################## # # zabbix agent local policy @@ -121,7 +160,6 @@ domain_search_all_domains_state(zabbix_agent_t) files_getattr_all_dirs(zabbix_agent_t) files_getattr_all_files(zabbix_agent_t) files_read_all_symlinks(zabbix_agent_t) -files_read_etc_files(zabbix_agent_t) fs_getattr_all_fs(zabbix_agent_t) @@ -129,7 +167,6 @@ init_read_utmp(zabbix_agent_t) logging_search_logs(zabbix_agent_t) -miscfiles_read_localization(zabbix_agent_t) sysnet_dns_name_resolve(zabbix_agent_t) diff --git a/zarafa.fc b/zarafa.fc index 3defaa1..560e6e3 100644 --- a/zarafa.fc +++ b/zarafa.fc @@ -8,19 +8,23 @@ /usr/bin/zarafa-server -- gen_context(system_u:object_r:zarafa_server_exec_t,s0) /usr/bin/zarafa-spooler -- gen_context(system_u:object_r:zarafa_spooler_exec_t,s0) -/var/lib/zarafa-.* gen_context(system_u:object_r:zarafa_var_lib_t,s0) +/var/lib/zarafa(/.*)? gen_context(system_u:object_r:zarafa_var_lib_t,s0) +/var/lib/zarafa-webaccess(/.*)? gen_context(system_u:object_r:zarafa_var_lib_t,s0) -/var/log/zarafa/gateway\.log -- gen_context(system_u:object_r:zarafa_gateway_log_t,s0) -/var/log/zarafa/ical\.log -- gen_context(system_u:object_r:zarafa_ical_log_t,s0) -/var/log/zarafa/indexer\.log -- gen_context(system_u:object_r:zarafa_indexer_log_t,s0) -/var/log/zarafa/monitor\.log -- gen_context(system_u:object_r:zarafa_monitor_log_t,s0) -/var/log/zarafa/server\.log -- gen_context(system_u:object_r:zarafa_server_log_t,s0) -/var/log/zarafa/spooler\.log -- gen_context(system_u:object_r:zarafa_spooler_log_t,s0) +/var/log/zarafa/dagent\.log.* -- gen_context(system_u:object_r:zarafa_deliver_log_t,s0) +/var/log/zarafa/gateway\.log.* -- gen_context(system_u:object_r:zarafa_gateway_log_t,s0) +/var/log/zarafa/ical\.log.* -- gen_context(system_u:object_r:zarafa_ical_log_t,s0) +/var/log/zarafa/indexer\.log.* -- gen_context(system_u:object_r:zarafa_indexer_log_t,s0) +/var/log/zarafa/monitor\.log.* -- gen_context(system_u:object_r:zarafa_monitor_log_t,s0) +/var/log/zarafa/server\.log.* -- gen_context(system_u:object_r:zarafa_server_log_t,s0) +/var/log/zarafa/spooler\.log.* -- gen_context(system_u:object_r:zarafa_spooler_log_t,s0) /var/run/zarafa -s gen_context(system_u:object_r:zarafa_server_var_run_t,s0) +/var/run/zarafa-dagent\.pid -- gen_context(system_u:object_r:zarafa_deliver_var_run_t,s0) /var/run/zarafa-gateway\.pid -- gen_context(system_u:object_r:zarafa_gateway_var_run_t,s0) /var/run/zarafa-ical\.pid -- gen_context(system_u:object_r:zarafa_ical_var_run_t,s0) -/var/run/zarafa-indexer -- gen_context(system_u:object_r:zarafa_indexer_var_run_t,s0) +/var/run/zarafa-indexer -s gen_context(system_u:object_r:zarafa_indexer_var_run_t,s0) +/var/run/zarafa-indexer\.pid -- gen_context(system_u:object_r:zarafa_indexer_var_run_t,s0) /var/run/zarafa-monitor\.pid -- gen_context(system_u:object_r:zarafa_monitor_var_run_t,s0) /var/run/zarafa-server\.pid -- gen_context(system_u:object_r:zarafa_server_var_run_t,s0) /var/run/zarafa-spooler\.pid -- gen_context(system_u:object_r:zarafa_spooler_var_run_t,s0) diff --git a/zarafa.if b/zarafa.if index 21ae664..eb61fc5 100644 --- a/zarafa.if +++ b/zarafa.if @@ -42,6 +42,10 @@ template(`zarafa_domain_template',` manage_files_pattern(zarafa_$1_t, zarafa_$1_log_t, zarafa_$1_log_t) logging_log_filetrans(zarafa_$1_t, zarafa_$1_log_t, { file }) + + auth_use_nsswitch(zarafa_$1_t) + + logging_send_syslog_msg(zarafa_$1_t) ') ###################################### @@ -118,3 +122,25 @@ interface(`zarafa_stream_connect_server',` files_search_var_lib($1) stream_connect_pattern($1, zarafa_server_var_run_t, zarafa_server_var_run_t, zarafa_server_t) ') + +#################################### +## +## Allow the specified domain to manage +## zarafa /var/lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`zarafa_manage_lib_files',` + gen_require(` + type zarafa_var_lib_t; + ') + + files_search_var_lib($1) + manage_files_pattern($1, zarafa_var_lib_t, zarafa_var_lib_t) + manage_lnk_files_pattern($1, zarafa_var_lib_t, zarafa_var_lib_t) + manage_dirs_pattern($1, zarafa_var_lib_t, zarafa_var_lib_t) +') diff --git a/zarafa.te b/zarafa.te index 91267bc..00fee9d 100644 --- a/zarafa.te +++ b/zarafa.te @@ -18,6 +18,10 @@ files_config_file(zarafa_etc_t) zarafa_domain_template(gateway) zarafa_domain_template(ical) zarafa_domain_template(indexer) + +type zarafa_indexer_tmp_t; +files_tmp_file(zarafa_indexer_tmp_t) + zarafa_domain_template(monitor) zarafa_domain_template(server) @@ -48,10 +52,9 @@ auth_use_nsswitch(zarafa_deliver_t) # zarafa_gateway local policy # -allow zarafa_gateway_t self:capability { chown kill }; +allow zarafa_gateway_t self:capability { kill }; allow zarafa_gateway_t self:process setrlimit; -corenet_all_recvfrom_unlabeled(zarafa_gateway_t) corenet_all_recvfrom_netlabel(zarafa_gateway_t) corenet_tcp_sendrecv_generic_if(zarafa_gateway_t) corenet_tcp_sendrecv_generic_node(zarafa_gateway_t) @@ -59,16 +62,28 @@ corenet_tcp_sendrecv_all_ports(zarafa_gateway_t) corenet_tcp_bind_generic_node(zarafa_gateway_t) corenet_tcp_bind_pop_port(zarafa_gateway_t) -auth_use_nsswitch(zarafa_gateway_t) +###################################### +# +# zarafa-indexer local policy +# + + +manage_dirs_pattern(zarafa_indexer_t, zarafa_indexer_tmp_t, zarafa_indexer_tmp_t) +manage_files_pattern(zarafa_indexer_t, zarafa_indexer_tmp_t, zarafa_indexer_tmp_t) +files_tmp_filetrans(zarafa_indexer_t, zarafa_indexer_tmp_t, { file dir }) + +manage_dirs_pattern(zarafa_indexer_t, zarafa_var_lib_t, zarafa_var_lib_t) +manage_files_pattern(zarafa_indexer_t, zarafa_var_lib_t, zarafa_var_lib_t) +manage_lnk_files_pattern(zarafa_indexer_t, zarafa_var_lib_t, zarafa_var_lib_t) + +auth_use_nsswitch(zarafa_indexer_t) ####################################### # # zarafa-ical local policy # -allow zarafa_ical_t self:capability chown; -corenet_all_recvfrom_unlabeled(zarafa_ical_t) corenet_all_recvfrom_netlabel(zarafa_ical_t) corenet_tcp_sendrecv_generic_if(zarafa_ical_t) corenet_tcp_sendrecv_generic_node(zarafa_ical_t) @@ -83,7 +98,6 @@ auth_use_nsswitch(zarafa_ical_t) # zarafa-monitor local policy # -allow zarafa_monitor_t self:capability chown; auth_use_nsswitch(zarafa_monitor_t) @@ -92,7 +106,7 @@ auth_use_nsswitch(zarafa_monitor_t) # zarafa_server local policy # -allow zarafa_server_t self:capability { chown kill net_bind_service }; +allow zarafa_server_t self:capability { kill net_bind_service }; allow zarafa_server_t self:process setrlimit; manage_dirs_pattern(zarafa_server_t, zarafa_server_tmp_t, zarafa_server_tmp_t) @@ -101,11 +115,11 @@ files_tmp_filetrans(zarafa_server_t, zarafa_server_tmp_t, { file dir }) manage_dirs_pattern(zarafa_server_t, zarafa_var_lib_t, zarafa_var_lib_t) manage_files_pattern(zarafa_server_t, zarafa_var_lib_t, zarafa_var_lib_t) -files_var_lib_filetrans(zarafa_server_t, zarafa_var_lib_t, { file dir }) +manage_lnk_files_pattern(zarafa_server_t, zarafa_var_lib_t, zarafa_var_lib_t) +files_var_lib_filetrans(zarafa_server_t, zarafa_var_lib_t, { file dir lnk_file }) stream_connect_pattern(zarafa_server_t, zarafa_indexer_var_run_t, zarafa_indexer_var_run_t, zarafa_indexer_t) -corenet_all_recvfrom_unlabeled(zarafa_server_t) corenet_all_recvfrom_netlabel(zarafa_server_t) corenet_tcp_sendrecv_generic_if(zarafa_server_t) corenet_tcp_sendrecv_generic_node(zarafa_server_t) @@ -135,11 +149,10 @@ optional_policy(` # zarafa_spooler local policy # -allow zarafa_spooler_t self:capability { chown kill }; +allow zarafa_spooler_t self:capability { kill }; can_exec(zarafa_spooler_t, zarafa_spooler_exec_t) -corenet_all_recvfrom_unlabeled(zarafa_spooler_t) corenet_all_recvfrom_netlabel(zarafa_spooler_t) corenet_tcp_sendrecv_generic_if(zarafa_spooler_t) corenet_tcp_sendrecv_generic_node(zarafa_spooler_t) @@ -150,11 +163,35 @@ auth_use_nsswitch(zarafa_spooler_t) ######################################## # +# zarafa_gateway local policy +# + +allow zarafa_gateway_t self:capability { kill }; +allow zarafa_gateway_t self:process setrlimit; + +corenet_tcp_bind_pop_port(zarafa_gateway_t) + +####################################### +# +# zarafa-ical local policy +# + + +corenet_tcp_bind_http_cache_port(zarafa_ical_t) + +###################################### +# +# zarafa-monitor local policy +# + + +######################################## +# # zarafa domains local policy # # bad permission on /etc/zarafa -allow zarafa_domain self:capability { dac_override setgid setuid }; +allow zarafa_domain self:capability { dac_override chown setgid setuid }; allow zarafa_domain self:process signal; allow zarafa_domain self:fifo_file rw_fifo_file_perms; allow zarafa_domain self:tcp_socket create_stream_socket_perms; @@ -164,8 +201,10 @@ stream_connect_pattern(zarafa_domain, zarafa_server_var_run_t, zarafa_server_var read_files_pattern(zarafa_domain, zarafa_etc_t, zarafa_etc_t) +dev_read_rand(zarafa_domain) +dev_read_urand(zarafa_domain) + kernel_read_system_state(zarafa_domain) files_read_etc_files(zarafa_domain) -miscfiles_read_localization(zarafa_domain) diff --git a/zebra.if b/zebra.if index 6b87605..ef64e73 100644 --- a/zebra.if +++ b/zebra.if @@ -38,8 +38,7 @@ interface(`zebra_stream_connect',` ') files_search_pids($1) - allow $1 zebra_var_run_t:sock_file write; - allow $1 zebra_t:unix_stream_socket connectto; + stream_connect_pattern($1, zebra_var_run_t, zebra_var_run_t, zebra_t) ') ######################################## @@ -62,12 +61,14 @@ interface(`zebra_stream_connect',` interface(`zebra_admin',` gen_require(` type zebra_t, zebra_tmp_t, zebra_log_t; - type zebra_conf_t, zebra_var_run_t; - type zebra_initrc_exec_t; + type zebra_conf_t, zebra_var_run_t, zebra_initrc_exec_t; ') - allow $1 zebra_t:process { ptrace signal_perms }; + allow $1 zebra_t:process signal_perms; ps_process_pattern($1, zebra_t) + tunable_policy(`deny_ptrace',`',` + allow $1 zebra_t:process ptrace; + ') init_labeled_script_domtrans($1, zebra_initrc_exec_t) domain_system_change_exemption($1) diff --git a/zebra.te b/zebra.te index ade6c2c..ac46eb2 100644 --- a/zebra.te +++ b/zebra.te @@ -11,14 +11,14 @@ policy_module(zebra, 1.12.0) ##

## # -gen_tunable(allow_zebra_write_config, false) +gen_tunable(zebra_write_config, false) type zebra_t; type zebra_exec_t; init_daemon_domain(zebra_t, zebra_exec_t) type zebra_conf_t; -files_type(zebra_conf_t) +files_config_file(zebra_conf_t) type zebra_initrc_exec_t; init_script_file(zebra_initrc_exec_t) @@ -52,7 +52,7 @@ allow zebra_t zebra_conf_t:dir list_dir_perms; read_files_pattern(zebra_t, zebra_conf_t, zebra_conf_t) read_lnk_files_pattern(zebra_t, zebra_conf_t, zebra_conf_t) -allow zebra_t zebra_log_t:dir setattr; +allow zebra_t zebra_log_t:dir setattr_dir_perms; manage_files_pattern(zebra_t, zebra_log_t, zebra_log_t) manage_sock_files_pattern(zebra_t, zebra_log_t, zebra_log_t) logging_log_filetrans(zebra_t, zebra_log_t, { sock_file file dir }) @@ -71,7 +71,6 @@ kernel_read_network_state(zebra_t) kernel_read_kernel_sysctls(zebra_t) kernel_rw_net_sysctls(zebra_t) -corenet_all_recvfrom_unlabeled(zebra_t) corenet_all_recvfrom_netlabel(zebra_t) corenet_tcp_sendrecv_generic_if(zebra_t) corenet_udp_sendrecv_generic_if(zebra_t) @@ -106,16 +105,16 @@ files_search_etc(zebra_t) files_read_etc_files(zebra_t) files_read_etc_runtime_files(zebra_t) -logging_send_syslog_msg(zebra_t) +auth_read_passwd(zebra_t) -miscfiles_read_localization(zebra_t) +logging_send_syslog_msg(zebra_t) sysnet_read_config(zebra_t) userdom_dontaudit_use_unpriv_user_fds(zebra_t) userdom_dontaudit_search_user_home_dirs(zebra_t) -tunable_policy(`allow_zebra_write_config',` +tunable_policy(`zebra_write_config',` manage_files_pattern(zebra_t, zebra_conf_t, zebra_conf_t) ') diff --git a/zoneminder.fc b/zoneminder.fc new file mode 100644 index 0000000..e1602ec --- /dev/null +++ b/zoneminder.fc @@ -0,0 +1,24 @@ +/etc/rc\.d/init\.d/motion -- gen_context(system_u:object_r:zoneminder_initrc_exec_t,s0) + +/etc/rc\.d/init\.d/zoneminder -- gen_context(system_u:object_r:zoneminder_initrc_exec_t,s0) + +/usr/bin/motion -- gen_context(system_u:object_r:zoneminder_exec_t,s0) + +/usr/bin/zmpkg.pl -- gen_context(system_u:object_r:zoneminder_exec_t,s0) + +/usr/libexec/zoneminder/cgi-bin(/.*)? gen_context(system_u:object_r:httpd_zoneminder_script_exec_t,s0) + +/var/lib/zoneminder(/.*)? gen_context(system_u:object_r:zoneminder_var_lib_t,s0) + +/var/motion(/.*)? gen_context(system_u:object_r:zoneminder_var_lib_t,s0) + +/var/log/zoneminder(/.*)? gen_context(system_u:object_r:zoneminder_log_t,s0) + +/var/log/motion\.log.* -- gen_context(system_u:object_r:zoneminder_log_t,s0) + +/var/run/motion\.pid -- gen_context(system_u:object_r:zoneminder_var_run_t,s0) + +/var/spool/zoneminder-upload(/.*)? gen_context(system_u:object_r:zoneminder_spool_t,s0) + + + diff --git a/zoneminder.if b/zoneminder.if new file mode 100644 index 0000000..b34b8b4 --- /dev/null +++ b/zoneminder.if @@ -0,0 +1,339 @@ + +## policy for zoneminder + + +######################################## +## +## Transition to zoneminder. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`zoneminder_domtrans',` + gen_require(` + type zoneminder_t, zoneminder_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, zoneminder_exec_t, zoneminder_t) +') + + +######################################## +## +## Execute zoneminder server in the zoneminder domain. +## +## +## +## Domain allowed access. +## +## +# +interface(`zoneminder_initrc_domtrans',` + gen_require(` + type zoneminder_initrc_exec_t; + ') + + init_labeled_script_domtrans($1, zoneminder_initrc_exec_t) +') + + +######################################## +## +## Read zoneminder's log files. +## +## +## +## Domain allowed access. +## +## +## +# +interface(`zoneminder_read_log',` + gen_require(` + type zoneminder_log_t; + ') + + logging_search_logs($1) + read_files_pattern($1, zoneminder_log_t, zoneminder_log_t) +') + +######################################## +## +## Append to zoneminder log files. +## +## +## +## Domain allowed access. +## +## +# +interface(`zoneminder_append_log',` + gen_require(` + type zoneminder_log_t; + ') + + logging_search_logs($1) + append_files_pattern($1, zoneminder_log_t, zoneminder_log_t) +') + +######################################## +## +## Manage zoneminder log files +## +## +## +## Domain allowed access. +## +## +# +interface(`zoneminder_manage_log',` + gen_require(` + type zoneminder_log_t; + ') + + logging_search_logs($1) + manage_dirs_pattern($1, zoneminder_log_t, zoneminder_log_t) + manage_files_pattern($1, zoneminder_log_t, zoneminder_log_t) + manage_lnk_files_pattern($1, zoneminder_log_t, zoneminder_log_t) +') + +######################################## +## +## Search zoneminder lib directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`zoneminder_search_lib',` + gen_require(` + type zoneminder_var_lib_t; + ') + + allow $1 zoneminder_var_lib_t:dir search_dir_perms; + files_search_var_lib($1) +') + +######################################## +## +## Read zoneminder lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`zoneminder_read_lib_files',` + gen_require(` + type zoneminder_var_lib_t; + ') + + files_search_var_lib($1) + read_files_pattern($1, zoneminder_var_lib_t, zoneminder_var_lib_t) +') + +######################################## +## +## Manage zoneminder lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`zoneminder_manage_lib_files',` + gen_require(` + type zoneminder_var_lib_t; + ') + + files_search_var_lib($1) + manage_files_pattern($1, zoneminder_var_lib_t, zoneminder_var_lib_t) +') + +######################################## +## +## Manage zoneminder lib directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`zoneminder_manage_lib_dirs',` + gen_require(` + type zoneminder_var_lib_t; + ') + + files_search_var_lib($1) + manage_dirs_pattern($1, zoneminder_var_lib_t, zoneminder_var_lib_t) +') + + +######################################## +## +## Search zoneminder spool directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`zoneminder_search_spool',` + gen_require(` + type zoneminder_spool_t; + ') + + allow $1 zoneminder_spool_t:dir search_dir_perms; + files_search_spool($1) +') + +######################################## +## +## Read zoneminder spool files. +## +## +## +## Domain allowed access. +## +## +# +interface(`zoneminder_read_spool_files',` + gen_require(` + type zoneminder_spool_t; + ') + + files_search_spool($1) + read_files_pattern($1, zoneminder_spool_t, zoneminder_spool_t) +') + +######################################## +## +## Manage zoneminder spool files. +## +## +## +## Domain allowed access. +## +## +# +interface(`zoneminder_manage_spool_files',` + gen_require(` + type zoneminder_spool_t; + ') + + files_search_spool($1) + manage_files_pattern($1, zoneminder_spool_t, zoneminder_spool_t) +') + +######################################## +## +## Manage zoneminder spool dirs. +## +## +## +## Domain allowed access. +## +## +# +interface(`zoneminder_manage_spool_dirs',` + gen_require(` + type zoneminder_spool_t; + ') + + files_search_spool($1) + manage_dirs_pattern($1, zoneminder_spool_t, zoneminder_spool_t) +') + +######################################## +## +## Connect to zoneminder over a unix stream socket. +## +## +## +## Domain allowed access. +## +## +# +interface(`zoneminder_stream_connect',` + gen_require(` + type zoneminder_t, zoneminder_var_lib_t; + ') + + files_search_pids($1) + stream_connect_pattern($1, zoneminder_var_lib_t, zoneminder_var_lib_t, zoneminder_t) +') + +###################################### +## +## Read/write zonerimender tmpfs files. +## +## +## +## Domain allowed access. +## +## +# +interface(`zoneminder_rw_tmpfs_files',` + gen_require(` + type zoneminder_tmpfs_t; + ') + + fs_search_tmpfs($1) + rw_files_pattern($1, zoneminder_tmpfs_t, zoneminder_tmpfs_t) +') + +######################################## +## +## All of the rules required to administrate +## an zoneminder environment +## +## +## +## Domain allowed access. +## +## +## +## +## Role allowed access. +## +## +## +# +interface(`zoneminder_admin',` + gen_require(` + type zoneminder_t; + type zoneminder_initrc_exec_t; + type zoneminder_log_t; + type zoneminder_var_lib_t; + type zoneminder_spool_t; + ') + + allow $1 zoneminder_t:process { ptrace signal_perms }; + ps_process_pattern($1, zoneminder_t) + + zoneminder_initrc_domtrans($1) + domain_system_change_exemption($1) + role_transition $2 zoneminder_initrc_exec_t system_r; + allow $2 system_r; + + logging_search_logs($1) + admin_pattern($1, zoneminder_log_t) + + files_search_var_lib($1) + admin_pattern($1, zoneminder_var_lib_t) + + files_search_spool($1) + admin_pattern($1, zoneminder_spool_t) + +') + diff --git a/zoneminder.te b/zoneminder.te new file mode 100644 index 0000000..3708d3c --- /dev/null +++ b/zoneminder.te @@ -0,0 +1,121 @@ +policy_module(zoneminder, 1.0.0) + +######################################## +# +# Declarations +# + +## +##

+## Allow ZoneMinder to modify public files +## used for public file transfer services. +##

+## +gen_tunable(zoneminder_anon_write, false) + +type zoneminder_t; +type zoneminder_exec_t; +init_daemon_domain(zoneminder_t, zoneminder_exec_t) + +type zoneminder_initrc_exec_t; +init_script_file(zoneminder_initrc_exec_t) + +type zoneminder_log_t; +logging_log_file(zoneminder_log_t) + +type zoneminder_tmpfs_t; +files_tmpfs_file(zoneminder_tmpfs_t) + +type zoneminder_spool_t; +files_type(zoneminder_spool_t) + +type zoneminder_var_lib_t; +files_type(zoneminder_var_lib_t) + +type zoneminder_var_run_t; +files_pid_file(zoneminder_var_run_t) + +######################################## +# +# zoneminder local policy +# +allow zoneminder_t self:capability { chown dac_override }; +allow zoneminder_t self:process { signal_perms setpgid }; +allow zoneminder_t self:shm create_shm_perms; +allow zoneminder_t self:fifo_file rw_fifo_file_perms; +allow zoneminder_t self:unix_stream_socket { create_stream_socket_perms connectto }; + +manage_dirs_pattern(zoneminder_t, zoneminder_log_t, zoneminder_log_t) +manage_files_pattern(zoneminder_t, zoneminder_log_t, zoneminder_log_t) +logging_log_filetrans(zoneminder_t, zoneminder_log_t, { dir file }) + +manage_dirs_pattern(zoneminder_t, zoneminder_tmpfs_t, zoneminder_tmpfs_t) +manage_files_pattern(zoneminder_t, zoneminder_tmpfs_t, zoneminder_tmpfs_t) +manage_lnk_files_pattern(zoneminder_t, zoneminder_tmpfs_t, zoneminder_tmpfs_t) +fs_tmpfs_filetrans(zoneminder_t, zoneminder_tmpfs_t, { dir file lnk_file }) + +manage_dirs_pattern(zoneminder_t, zoneminder_var_lib_t, zoneminder_var_lib_t) +manage_files_pattern(zoneminder_t, zoneminder_var_lib_t, zoneminder_var_lib_t) +manage_sock_files_pattern(zoneminder_t, zoneminder_var_lib_t, zoneminder_var_lib_t) +files_var_lib_filetrans(zoneminder_t, zoneminder_var_lib_t, { dir file sock_file }) + +manage_dirs_pattern(zoneminder_t, zoneminder_var_run_t, zoneminder_var_run_t) +manage_files_pattern(zoneminder_t, zoneminder_var_run_t, zoneminder_var_run_t) +files_pid_filetrans(zoneminder_t, zoneminder_var_run_t, { dir file }) + +manage_dirs_pattern(zoneminder_t, zoneminder_spool_t, zoneminder_spool_t) +manage_files_pattern(zoneminder_t, zoneminder_spool_t, zoneminder_spool_t) +manage_lnk_files_pattern(zoneminder_t, zoneminder_spool_t, zoneminder_spool_t) +files_spool_filetrans(zoneminder_t, zoneminder_spool_t, { dir file }) + +kernel_read_system_state(zoneminder_t) + +corecmd_exec_bin(zoneminder_t) +corecmd_exec_shell(zoneminder_t) + +corenet_tcp_bind_http_cache_port(zoneminder_t) +corenet_tcp_bind_transproxy_port(zoneminder_t) + +dev_read_sysfs(zoneminder_t) +dev_read_rand(zoneminder_t) +dev_read_urand(zoneminder_t) +dev_read_video_dev(zoneminder_t) +dev_write_video_dev(zoneminder_t) + +files_read_usr_files(zoneminder_t) + +auth_use_nsswitch(zoneminder_t) + +logging_send_syslog_msg(zoneminder_t) + +tunable_policy(`zoneminder_anon_write',` + miscfiles_manage_public_files(zoneminder_t) +') + +optional_policy(` + mysql_stream_connect(zoneminder_t) +') + +######################################## +# +# zoneminder cgi local policy +# + +optional_policy(` + apache_content_template(zoneminder) + + # need more testing + #allow httpd_zoneminder_script_t self:shm create_shm_perms; + + manage_sock_files_pattern(httpd_zoneminder_script_t, zoneminder_var_lib_t, zoneminder_var_lib_t) + zoneminder_stream_connect(httpd_zoneminder_script_t) + + files_search_var_lib(httpd_zoneminder_script_t) + + logging_send_syslog_msg(httpd_zoneminder_script_t) + + optional_policy(` + mysql_stream_connect(httpd_zoneminder_script_t) + ') + +') diff --git a/zosremote.fc b/zosremote.fc index d719d0b..7a7fc61 100644 --- a/zosremote.fc +++ b/zosremote.fc @@ -1 +1,3 @@ /sbin/audispd-zos-remote -- gen_context(system_u:object_r:zos_remote_exec_t,s0) + +/usr/sbin/audispd-zos-remote -- gen_context(system_u:object_r:zos_remote_exec_t,s0) diff --git a/zosremote.if b/zosremote.if index 702e768..2a4f2cc 100644 --- a/zosremote.if +++ b/zosremote.if @@ -34,6 +34,7 @@ interface(`zosremote_domtrans',` ## Role allowed access. ## ## +## # interface(`zosremote_run',` gen_require(` diff --git a/zosremote.te b/zosremote.te index f9a06d2..fade72a 100644 --- a/zosremote.te +++ b/zosremote.te @@ -16,13 +16,9 @@ logging_dispatcher_domain(zos_remote_t, zos_remote_exec_t) # allow zos_remote_t self:process signal; -allow zos_remote_t self:fifo_file rw_file_perms; +allow zos_remote_t self:fifo_file rw_fifo_file_perms; allow zos_remote_t self:unix_stream_socket create_stream_socket_perms; -files_read_etc_files(zos_remote_t) - auth_use_nsswitch(zos_remote_t) -miscfiles_read_localization(zos_remote_t) - logging_send_syslog_msg(zos_remote_t)