[selinux-policy: 390/3172] review of admin interfaces
Daniel J Walsh
dwalsh at fedoraproject.org
Thu Oct 7 19:38:31 UTC 2010
commit 7f2e39b8e61c3b3a77274cac24c2358d6554521c
Author: Chris PeBenito <cpebenito at tresys.com>
Date: Fri Jun 17 18:27:08 2005 +0000
review of admin interfaces
refpolicy/policy/modules/admin/consoletype.if | 31 ++----
refpolicy/policy/modules/admin/dmesg.if | 34 ++----
refpolicy/policy/modules/admin/netutils.if | 32 ++----
refpolicy/policy/modules/admin/rpm.if | 88 ++++++----------
refpolicy/policy/modules/admin/usermanage.if | 141 ++++++++++---------------
5 files changed, 124 insertions(+), 202 deletions(-)
---
diff --git a/refpolicy/policy/modules/admin/consoletype.if b/refpolicy/policy/modules/admin/consoletype.if
index daee8c0..afb9df7 100644
--- a/refpolicy/policy/modules/admin/consoletype.if
+++ b/refpolicy/policy/modules/admin/consoletype.if
@@ -4,8 +4,14 @@
# consoletype_domtrans(domain)
#
define(`consoletype_domtrans',`
- gen_require(`$0'_depend)
-
+ gen_require(`
+ type consoletype_t, consoletype_exec_t;
+ class process sigchld;
+ class fd use;
+ class fifo_file rw_file_perms;
+ ')
+
+ corecmd_search_sbin($1)
domain_auto_trans($1,consoletype_exec_t,consoletype_t)
allow $1 consoletype_t:fd use;
@@ -14,28 +20,15 @@ define(`consoletype_domtrans',`
allow consoletype_t $1:process sigchld;
')
-define(`consoletype_domtrans_depend',`
- type consoletype_t, consoletype_exec_t;
-
- class file rx_file_perms;
- class process { transition noatsecure siginh rlimitinh sigchld };
- class fd use;
- class fifo_file rw_file_perms;
-')
-
#######################################
#
# consoletype_exec(domain)
#
define(`consoletype_exec',`
- gen_require(`$0'_depend)
+ gen_require(`
+ type consoletype_exec_t;
+ ')
+ corecmd_search_sbin($1)
can_exec($1,consoletype_exec_t)
-
-')
-
-define(`consoletype_exec_depend',`
- type consoletype_exec_t;
-
- class file { getattr read execute execute_no_trans };
')
diff --git a/refpolicy/policy/modules/admin/dmesg.if b/refpolicy/policy/modules/admin/dmesg.if
index b43e318..0c6f5b7 100644
--- a/refpolicy/policy/modules/admin/dmesg.if
+++ b/refpolicy/policy/modules/admin/dmesg.if
@@ -12,12 +12,15 @@
## </interface>
#
define(`dmesg_domtrans',`
- gen_require(`$0'_depend)
+ gen_require(`
+ type dmesg_t, dmesg_exec_t;
+ class process sigchld;
+ class fd use;
+ class fifo_file rw_file_perms;
+ ')
- allow $1 dmesg_exec_t:file rx_file_perms;
- allow $1 dmesg_t:process transition;
- type_transition $1 dmesg_exec_t:process dmesg_t;
- dontaudit $1 dmesg_t:process { noatsecure siginh rlimitinh };
+ corecmd_search_sbin($1)
+ domain_auto_trans($1,dmesg_exec_t,dmesg_t)
allow $1 dmesg_t:fd use;
allow dmesg_t $1:fd use;
@@ -25,15 +28,6 @@ define(`dmesg_domtrans',`
allow dmesg_t $1:process sigchld;
')
-define(`dmesg_domtrans_depend',`
- type dmesg_t, dmesg_exec_t;
-
- class file rx_file_perms;
- class process { transition noatsecure siginh rlimitinh sigchld };
- class fd use;
- class fifo_file rw_file_perms;
-')
-
########################################
## <interface name="dmesg_exec">
## <description>
@@ -45,16 +39,12 @@ define(`dmesg_domtrans_depend',`
## </interface>
#
define(`dmesg_exec',`
- gen_require(`$0'_depend)
+ gen_require(`
+ type dmesg_exec_t;
+ ')
+ corecmd_search_sbin($1)
can_exec($1,dmesg_exec_t)
-
-')
-
-define(`dmesg_exec_depend',`
- type dmesg_exec_t;
-
- class file { getattr read execute execute_no_trans };
')
## </module>
diff --git a/refpolicy/policy/modules/admin/netutils.if b/refpolicy/policy/modules/admin/netutils.if
index 8ad4c0a..dd833fa 100644
--- a/refpolicy/policy/modules/admin/netutils.if
+++ b/refpolicy/policy/modules/admin/netutils.if
@@ -4,12 +4,14 @@
# netutils_domtrans(domain)
#
define(`netutils_domtrans',`
- gen_require(`$0'_depend)
+ gen_require(`
+ type netutils_t, netutils_exec_t;
+ class process sigchld;
+ class fd use;
+ class fifo_file rw_file_perms;
+ ')
- allow $1 netutils_exec_t:file rx_file_perms;
- allow $1 netutils_t:process transition;
- type_transition $1 netutils_exec_t:process netutils_t;
- dontaudit $1 netutils_t:process { noatsecure siginh rlimitinh };
+ domain_auto_trans($1,netutils_exec_t,netutils_t)
allow $1 netutils_t:fd use;
allow netutils_t $1:fd use;
@@ -17,28 +19,14 @@ define(`netutils_domtrans',`
allow netutils_t $1:process sigchld;
')
-define(`netutils_domtrans_depend',`
- type netutils_t, netutils_exec_t;
-
- class file rx_file_perms;
- class process { transition noatsecure siginh rlimitinh sigchld };
- class fd use;
- class fifo_file rw_file_perms;
-')
-
#######################################
#
# netutils_exec(domain)
#
define(`netutils_exec',`
- gen_require(`$0'_depend)
+ gen_require(`
+ type netutils_exec_t;
+ ')
can_exec($1,netutils_exec_t)
-
-')
-
-define(`netutils_exec_depend',`
- type netutils_exec_t;
-
- class file { getattr read execute execute_no_trans };
')
diff --git a/refpolicy/policy/modules/admin/rpm.if b/refpolicy/policy/modules/admin/rpm.if
index 9469e07..c4c3bde 100644
--- a/refpolicy/policy/modules/admin/rpm.if
+++ b/refpolicy/policy/modules/admin/rpm.if
@@ -12,12 +12,16 @@
## </interface>
#
define(`rpm_domtrans',`
- gen_require(`$0'_depend)
+ gen_require(`
+ type rpm_t, rpm_exec_t;
+ class process sigchld;
+ class fd use;
+ class fifo_file rw_file_perms;
+ ')
- allow $1 rpm_exec_t:file rx_file_perms;
- allow $1 rpm_t:process transition;
- type_transition $1 rpm_exec_t:process rpm_t;
- dontaudit $1 rpm_t:process { noatsecure siginh rlimitinh };
+ files_search_usr($1)
+ corecmd_search_bin($1)
+ domain_auto_trans($1,rpm_exec_t,rpm_t)
allow $1 rpm_t:fd use;
allow rpm_t $1:fd use;
@@ -25,15 +29,6 @@ define(`rpm_domtrans',`
allow rpm_t $1:process sigchld;
')
-define(`rpm_domtrans_depend',`
- type rpm_t, rpm_exec_t;
-
- class file rx_file_perms;
- class process { transition noatsecure siginh rlimitinh sigchld };
- class fd use;
- class fifo_file rw_file_perms;
-')
-
########################################
## <interface name="rpm_run">
## <description>
@@ -51,18 +46,15 @@ define(`rpm_domtrans_depend',`
## </interface>
#
define(`rpm_run',`
- gen_require(`$0'_depend)
+ gen_require(`
+ type rpm_t, rpm_script_t;
+ class chr_file rw_term_perms;
+ ')
rpm_domtrans($1)
role $2 types rpm_t;
role $2 types rpm_script_t;
- allow rpm_t $3:chr_file { getattr read write ioctl };
-')
-
-define(`rpm_run_depend',`
- type rpm_t, rpm_script_t;
-
- class chr_file { getattr read write ioctl };
+ allow rpm_t $3:chr_file rw_term_perms;
')
########################################
@@ -76,17 +68,14 @@ define(`rpm_run_depend',`
## </interface>
#
define(`rpm_use_fd',`
- gen_require(`$0'_depend)
+ gen_require(`
+ type rpm_t;
+ class fd use;
+ ')
allow $1 rpm_t:fd use;
')
-define(`rpm_use_fd_depend',`
- type rpm_t;
-
- class fd use;
-')
-
########################################
## <interface name="rpm_read_pipe">
## <description>
@@ -98,17 +87,14 @@ define(`rpm_use_fd_depend',`
## </interface>
#
define(`rpm_read_pipe',`
- gen_require(`$0'_depend)
+ gen_require(`
+ type rpm_t;
+ class fifo_file r_file_perms;
+ ')
allow $1 rpm_t:fifo_file r_file_perms;
')
-define(`rpm_read_pipe_depend',`
- type rpm_t;
-
- class fifo_file r_file_perms;
-')
-
########################################
## <interface name="rpm_read_db">
## <description>
@@ -120,39 +106,33 @@ define(`rpm_read_pipe_depend',`
## </interface>
#
define(`rpm_read_db',`
- gen_require(`$0'_depend)
+ gen_require(`
+ type rpm_var_lib_t_t;
+ class dir r_dir_perms;
+ class lnk_file r_file_perms;
+ class file r_file_perms;
+ ')
allow $1 rpm_var_lib_t:dir r_dir_perms;
allow $1 rpm_var_lib_t:file r_file_perms;
allow $1 rpm_var_lib_t:lnk_file r_file_perms;
')
-define(`rpm_read_db_depend',`
- type rpm_var_lib_t_t;
-
- class dir r_dir_perms;
- class lnk_file r_file_perms;
- class file r_file_perms;
-')
-
########################################
#
# rpm_manage_db(domain)
#
define(`rpm_manage_db',`
- gen_require(`$0'_depend)
+ gen_require(`
+ type rpm_var_lib_t_t;
+ class dir rw_dir_perms;
+ class lnk_file { getattr read write unlink };
+ class file { getattr create read write append unlink };
+ ')
allow $1 rpm_var_lib_t:dir rw_dir_perms;
allow $1 rpm_var_lib_t:file { getattr create read write append unlink };
allow $1 rpm_var_lib_t:lnk_file { getattr read write unlink };
')
-define(`rpm_manage_db_depend',`
- type rpm_var_lib_t_t;
-
- class dir rw_dir_perms;
- class lnk_file { getattr read write unlink };
- class file { getattr create read write append unlink };
-')
-
## </module>
diff --git a/refpolicy/policy/modules/admin/usermanage.if b/refpolicy/policy/modules/admin/usermanage.if
index eb3a539..194411f 100644
--- a/refpolicy/policy/modules/admin/usermanage.if
+++ b/refpolicy/policy/modules/admin/usermanage.if
@@ -12,12 +12,16 @@
## </interface>
#
define(`usermanage_domtrans_chfn',`
- gen_require(`$0'_depend)
+ gen_require(`
+ type chfn_t, chfn_exec_t;
+ class process sigchld;
+ class fd use;
+ class fifo_file rw_file_perms;
+ ')
- allow $1 chfn_exec_t:file rx_file_perms;
- allow $1 chfn_t:process transition;
- type_transition $1 chfn_exec_t:process chfn_t;
- dontaudit $1 chfn_t:process { noatsecure siginh rlimitinh };
+ files_search_usr($1)
+ corecmd_search_bin($1)
+ domain_auto_trans($1,chfn_exec_t,chfn_t)
allow $1 chfn_t:fd use;
allow chfn_t $1:fd use;
@@ -25,15 +29,6 @@ define(`usermanage_domtrans_chfn',`
allow chfn_t $1:process sigchld;
')
-define(`usermanage_domtrans_chfn_depend',`
- type chfn_t, chfn_exec_t;
-
- class file rx_file_perms;
- class process { transition noatsecure siginh rlimitinh sigchld };
- class fd use;
- class fifo_file rw_file_perms;
-')
-
########################################
## <interface name="usermanage_run_chfn">
## <description>
@@ -52,17 +47,14 @@ define(`usermanage_domtrans_chfn_depend',`
## </interface>
#
define(`usermanage_run_chfn',`
- gen_require(`$0'_depend)
+ gen_require(`
+ type chfn_t;
+ class chr_file rw_term_perms;
+ ')
usermanage_domtrans_chfn($1)
role $2 types chfn_t;
- allow chfn_t $3:chr_file { getattr read write ioctl };
-')
-
-define(`usermanage_run_chfn_depend',`
- type chfn_t;
-
- class chr_file { getattr read write ioctl };
+ allow chfn_t $3:chr_file rw_term_perms;
')
########################################
@@ -76,8 +68,15 @@ define(`usermanage_run_chfn_depend',`
## </interface>
#
define(`usermanage_domtrans_groupadd',`
- gen_require(`$0'_depend)
-
+ gen_require(`
+ type groupadd_t, groupadd_exec_t;
+ class process sigchld;
+ class fd use;
+ class fifo_file rw_file_perms;
+ ')
+
+ files_search_usr($1)
+ corecmd_search_sbin($1)
domain_auto_trans($1,groupadd_exec_t,groupadd_t)
allow $1 groupadd_t:fd use;
@@ -86,15 +85,6 @@ define(`usermanage_domtrans_groupadd',`
allow groupadd_t $1:process sigchld;
')
-define(`usermanage_domtrans_groupadd_depend',`
- type groupadd_t, groupadd_exec_t;
-
- class file rx_file_perms;
- class process { transition noatsecure siginh rlimitinh sigchld };
- class fd use;
- class fifo_file rw_file_perms;
-')
-
########################################
## <interface name="usermanage_run_groupadd">
## <description>
@@ -113,17 +103,14 @@ define(`usermanage_domtrans_groupadd_depend',`
## </interface>
#
define(`usermanage_run_groupadd',`
- gen_require(`$0'_depend)
+ gen_require(`
+ type groupadd_t;
+ class chr_file rw_term_perms;
+ ')
usermanage_domtrans_groupadd($1)
role $2 types groupadd_t;
- allow groupadd_t $3:chr_file { getattr read write ioctl };
-')
-
-define(`usermanage_run_groupadd_depend',`
- type groupadd_t;
-
- class chr_file { getattr read write ioctl };
+ allow groupadd_t $3:chr_file rw_term_perms;
')
########################################
@@ -137,12 +124,16 @@ define(`usermanage_run_groupadd_depend',`
## </interface>
#
define(`usermanage_domtrans_passwd',`
- gen_require(`$0'_depend)
+ gen_require(`
+ type passwd_t, passwd_exec_t;
+ class process sigchld;
+ class fd use;
+ class fifo_file rw_file_perms;
+ ')
- allow $1 passwd_exec_t:file rx_file_perms;
- allow $1 passwd_t:process transition;
- type_transition $1 passwd_exec_t:process passwd_t;
- dontaudit $1 passwd_t:process { noatsecure siginh rlimitinh };
+ files_search_usr($1)
+ corecmd_search_bin($1)
+ domain_auto_trans($1,passwd_exec_t,passwd_t)
allow $1 passwd_t:fd use;
allow passwd_t $1:fd use;
@@ -150,15 +141,6 @@ define(`usermanage_domtrans_passwd',`
allow passwd_t $1:process sigchld;
')
-define(`usermanage_domtrans_passwd_depend',`
- type passwd_t, passwd_exec_t;
-
- class file rx_file_perms;
- class process { transition noatsecure siginh rlimitinh sigchld };
- class fd use;
- class fifo_file rw_file_perms;
-')
-
########################################
## <interface name="usermanage_run_passwd">
## <description>
@@ -177,17 +159,14 @@ define(`usermanage_domtrans_passwd_depend',`
## </interface>
#
define(`usermanage_run_passwd',`
- gen_require(`$0'_depend)
+ gen_require(`
+ type passwd_t;
+ class chr_file rw_term_perms;
+ ')
usermanage_domtrans_passwd($1)
role $2 types passwd_t;
- allow passwd_t $3:chr_file { getattr read write ioctl };
-')
-
-define(`usermanage_run_passwd_depend',`
- type passwd_t;
-
- class chr_file { getattr read write ioctl };
+ allow passwd_t $3:chr_file rw_term_perms;
')
########################################
@@ -201,12 +180,16 @@ define(`usermanage_run_passwd_depend',`
## </interface>
#
define(`usermanage_domtrans_useradd',`
- gen_require(`$0'_depend)
+ gen_require(`
+ type useradd_t, useradd_exec_t;
+ class process sigchld;
+ class fd use;
+ class fifo_file rw_file_perms;
+ ')
- allow $1 useradd_exec_t:file rx_file_perms;
- allow $1 useradd_t:process transition;
- type_transition $1 useradd_exec_t:process useradd_t;
- dontaudit $1 useradd_t:process { noatsecure siginh rlimitinh };
+ files_search_usr($1)
+ corecmd_search_sbin($1)
+ domain_auto_trans($1,useradd_exec_t,useradd_t)
allow $1 useradd_t:fd use;
allow useradd_t $1:fd use;
@@ -214,15 +197,6 @@ define(`usermanage_domtrans_useradd',`
allow useradd_t $1:process sigchld;
')
-define(`usermanage_domtrans_useradd_depend',`
- type useradd_t, useradd_exec_t;
-
- class file rx_file_perms;
- class process { transition noatsecure siginh rlimitinh sigchld };
- class fd use;
- class fifo_file rw_file_perms;
-')
-
########################################
## <interface name="usermanage_run_useradd">
## <description>
@@ -241,17 +215,14 @@ define(`usermanage_domtrans_useradd_depend',`
## </interface>
#
define(`usermanage_run_useradd',`
- gen_require(`$0'_depend)
+ gen_require(`
+ type useradd_t;
+ class chr_file rw_term_perms;
+ ')
usermanage_domtrans_useradd($1)
role $2 types useradd_t;
- allow useradd_t $3:chr_file { getattr read write ioctl };
-')
-
-define(`usermanage_run_useradd_depend',`
- type useradd_t;
-
- class chr_file { getattr read write ioctl };
+ allow useradd_t $3:chr_file rw_term_perms;
')
## </module>
More information about the scm-commits
mailing list