[selinux-policy: 399/3172] work on newrole policy
Daniel J Walsh
dwalsh at fedoraproject.org
Thu Oct 7 19:39:17 UTC 2010
commit 21871a5cf623e701468454701849323eb144ce2d
Author: Chris PeBenito <cpebenito at tresys.com>
Date: Tue Jun 21 17:01:45 2005 +0000
work on newrole policy
refpolicy/policy/global_tunables | 7 ++++
refpolicy/policy/modules/kernel/terminal.if | 21 +++++++++++
refpolicy/policy/modules/system/selinuxutil.te | 46 +++++++++---------------
refpolicy/policy/modules/system/userdomain.if | 25 +++++++++++--
refpolicy/policy/support/misc_macros.spt | 12 ++++++
5 files changed, 79 insertions(+), 32 deletions(-)
---
diff --git a/refpolicy/policy/global_tunables b/refpolicy/policy/global_tunables
index a292811..bfabd20 100644
--- a/refpolicy/policy/global_tunables
+++ b/refpolicy/policy/global_tunables
@@ -40,6 +40,13 @@ gen_tunable(fcron_crond,false)
## </tunable>
gen_tunable(read_default_t,false)
+## <tunable name="secure_mode" dftval="false">
+## Enabling secure mode disallows programs, such as
+## newrole, from transitioning to administrative
+## user domains.
+## </tunable>
+gen_bool(secure_mode,false)
+
## <tunable name="staff_read_sysadm_file" dftval="false">
## Allow staff_r users to search the sysadm home
## dir and read files (such as ~/.bashrc)
diff --git a/refpolicy/policy/modules/kernel/terminal.if b/refpolicy/policy/modules/kernel/terminal.if
index 90ea8a1..c41a065 100644
--- a/refpolicy/policy/modules/kernel/terminal.if
+++ b/refpolicy/policy/modules/kernel/terminal.if
@@ -403,6 +403,27 @@ define(`term_dontaudit_use_all_user_ptys',`
')
########################################
+## <interface name="term_relabel_all_user_ptys">
+## <description>
+## Relabel from and to all user
+## user pty device nodes.
+## </description>
+## <parameter name="domain">
+## The type of the process performing this action.
+## </parameter>
+## </interface>
+#
+define(`term_relabel_all_user_ptys',`
+ gen_require(`
+ attribute ptynode;
+ class chr_file { relabelfrom relabelto };
+ ')
+
+ dev_list_all_dev_nodes($1)
+ allow $1 ptynode:chr_file { relabelfrom relabelto };
+')
+
+########################################
## <interface name="term_getattr_unallocated_ttys">
## <description>
## Get the attributes of all unallocated
diff --git a/refpolicy/policy/modules/system/selinuxutil.te b/refpolicy/policy/modules/system/selinuxutil.te
index a178716..739518b 100644
--- a/refpolicy/policy/modules/system/selinuxutil.te
+++ b/refpolicy/policy/modules/system/selinuxutil.te
@@ -128,11 +128,6 @@ libs_use_shared_libs(checkpolicy_t)
userdom_use_all_user_fd(checkpolicy_t)
-ifdef(`TODO',`
-# Read the devpts root directory.
-ifdef(`sshd.te',`allow checkpolicy_t sshd_devpts_t:dir r_dir_perms;')
-') dnl endif TODO
-
########################################
#
# Load_policy local policy
@@ -210,6 +205,8 @@ selinux_compute_user_contexts(newrole_t)
term_use_all_user_ttys(newrole_t)
term_use_all_user_ptys(newrole_t)
+term_relabel_all_user_ttys(newrole_t)
+term_relabel_all_user_ptys(newrole_t)
auth_domtrans_chk_passwd(newrole_t)
@@ -229,6 +226,14 @@ miscfiles_read_localization(newrole_t)
userdom_use_unpriv_users_fd(newrole_t)
+# if secure mode is enabled, then newrole
+# can only transition to unprivileged users
+if(secure_mode) {
+ userdom_spec_domtrans_unpriv_users(newrole_t)
+} else {
+ userdom_spec_domtrans_all_users(newrole_t)
+}
+
ifdef(`TODO',`
can_ypbind(newrole)
@@ -239,29 +244,10 @@ allow newrole_t autofs_t:dir { search getattr };
# for when the user types "exec newrole" at the command line
allow newrole_t privfd:process sigchld;
-# Execute /sbin/pwdb_chkpwd to check the password.
-allow newrole_t sbin_t:dir r_dir_perms;
-
-# Execute shells
-allow newrole_t bin_t:dir r_dir_perms;
-allow newrole_t bin_t:lnk_file read;
-
-# Allow newrole_t to transition to user domains.
-bool secure_mode false;
-domain_trans(newrole_t, shell_exec_t, unpriv_userdomain)
-if(!secure_mode)
-{
- # if we are not in secure mode then we can transition to sysadm_t
- domain_trans(newrole_t, shell_exec_t, sysadm_t)
-}
-
# Read /var.
allow newrole_t var_t:dir r_dir_perms;
allow newrole_t var_t:notdevfile_class_set r_file_perms;
-# Relabel terminals.
-allow newrole_t { ttyfile ptyfile }:chr_file { relabelfrom relabelto };
-
ifdef(`gnome-pty-helper.te', `allow newrole_t gphdomain:fd use;')
# for some PAM modules and for cwd
@@ -308,10 +294,6 @@ logging_send_syslog_msg(restorecon_t)
userdom_use_all_user_fd(restorecon_t)
-optional_policy(`hotplug.te',`
- hotplug_use_fd(restorecon_t)
-')
-
# relabeling rules
kernel_relabel_unlabeled(restorecon_t)
dev_relabel_all_dev_nodes(restorecon_t)
@@ -328,6 +310,10 @@ ifdef(`distro_redhat', `
fs_relabel_tmpfs_character_devices(restorecon_t)
')
+optional_policy(`hotplug.te',`
+ hotplug_use_fd(restorecon_t)
+')
+
ifdef(`TODO',`
# for upgrading glibc and other shared objects - without this the upgrade
@@ -395,13 +381,15 @@ ifdef(`targeted_policy',`',`
logging_send_syslog_msg(run_init_t)
') dnl end ifdef targeted policy
+
ifdef(`TODO',`
ifdef(`distro_gentoo', `
# Gentoo integrated run_init+open_init_pty-runscript:
- domain_auto_trans(sysadm_t,initrc_exec_t,run_init_t)
domain_entry_file(run_init_t,initrc_exec_t)
+ domain_auto_trans(sysadm_t,initrc_exec_t,run_init_t)
')
+
') dnl end TODO
########################################
diff --git a/refpolicy/policy/modules/system/userdomain.if b/refpolicy/policy/modules/system/userdomain.if
index 229bd81..2f804f7 100644
--- a/refpolicy/policy/modules/system/userdomain.if
+++ b/refpolicy/policy/modules/system/userdomain.if
@@ -821,12 +821,31 @@ define(`admin_domain_template',`
## </interface>
#
define(`userdom_spec_domtrans_all_users',`
- gen_require(`$0'_depend)
+ gen_require(`
+ attribute userdomain;
+ ')
+
corecmd_shell_spec_domtrans($1,userdomain)
')
-define(`userdom_spec_domtrans_all_users_depend',`
- type sysadm_t;
+########################################
+## <interface name="userdom_spec_domtrans_unpriv_users">
+## <description>
+## Execute a shell in all unprivileged user domains. This
+## is an explicit transition, requiring the
+## caller to use setexeccon().
+## </description>
+## <parameter name="domain">
+## The type of the process performing this action.
+## </parameter>
+## </interface>
+#
+define(`userdom_spec_domtrans_unpriv_users',`
+ gen_require(`
+ attribute unpriv_userdomain;
+ ')
+
+ corecmd_shell_spec_domtrans($1,unpriv_userdomain)
')
########################################
diff --git a/refpolicy/policy/support/misc_macros.spt b/refpolicy/policy/support/misc_macros.spt
index b4f4a2a..8b3b94c 100644
--- a/refpolicy/policy/support/misc_macros.spt
+++ b/refpolicy/policy/support/misc_macros.spt
@@ -19,6 +19,10 @@ define(`shiftn',`ifelse($1,0,`shift($*)',`shiftn(decr($1),shift(shift($*)))')')
#
define(`context_template',`ifdef(`enable_mls',`$1:$2',`$1')') dnl
+########################################
+#
+# can_exec(domain,executable)
+#
define(`can_exec',`
gen_require(`
class file { rx_file_perms execute_no_trans };
@@ -26,3 +30,11 @@ define(`can_exec',`
allow $1 $2:file { rx_file_perms execute_no_trans };
')
+
+########################################
+#
+# gen_bool(name,default_value)
+#
+define(`gen_bool',`
+ bool $1 dflt_or_overr(`$1'_conf,$2);
+')
More information about the scm-commits
mailing list