[selinux-policy: 168/3172] start adding user domains. fix ttynode and ptynode handling, as they're more then user terminals (a
Daniel J Walsh
dwalsh at fedoraproject.org
Thu Oct 7 19:19:32 UTC 2010
commit b16c6b8c32a631a2e66265f6f60b664222760972
Author: Chris PeBenito <cpebenito at tresys.com>
Date: Mon May 16 21:10:33 2005 +0000
start adding user domains. fix ttynode and ptynode handling, as they're
more then user terminals (at least ptynode is). start adding XML comments
refpolicy/policy/modules/admin/netutils.te | 8 +-
refpolicy/policy/modules/admin/usermanage.te | 20 +-
refpolicy/policy/modules/kernel/bootloader.te | 2 +-
refpolicy/policy/modules/kernel/corenetwork.if | 14 +
refpolicy/policy/modules/kernel/devices.if | 32 ++-
refpolicy/policy/modules/kernel/devices.te | 4 +
refpolicy/policy/modules/kernel/filesystem.if | 202 +++++++++
refpolicy/policy/modules/kernel/kernel.if | 14 +
refpolicy/policy/modules/kernel/storage.if | 267 +++++++++---
refpolicy/policy/modules/kernel/terminal.if | 118 ++++--
refpolicy/policy/modules/kernel/terminal.te | 1 +
refpolicy/policy/modules/services/mta.if | 16 +
refpolicy/policy/modules/system/authlogin.if | 59 ++-
refpolicy/policy/modules/system/authlogin.te | 12 +-
refpolicy/policy/modules/system/clock.te | 4 +-
refpolicy/policy/modules/system/getty.te | 6 -
refpolicy/policy/modules/system/hostname.te | 4 +-
refpolicy/policy/modules/system/init.if | 30 +-
refpolicy/policy/modules/system/init.te | 2 +-
refpolicy/policy/modules/system/locallogin.te | 2 +-
refpolicy/policy/modules/system/logging.if | 14 +
refpolicy/policy/modules/system/lvm.te | 2 +-
refpolicy/policy/modules/system/selinux.te | 8 +-
refpolicy/policy/modules/system/selinuxutil.te | 8 +-
refpolicy/policy/modules/system/sysnetwork.te | 8 +-
refpolicy/policy/modules/system/userdomain.if | 562 ++++++++++++++++++++++++
refpolicy/policy/modules/system/userdomain.te | 79 ++++
27 files changed, 1332 insertions(+), 166 deletions(-)
---
diff --git a/refpolicy/policy/modules/admin/netutils.te b/refpolicy/policy/modules/admin/netutils.te
index 060c777..835f332 100644
--- a/refpolicy/policy/modules/admin/netutils.te
+++ b/refpolicy/policy/modules/admin/netutils.te
@@ -131,8 +131,8 @@ sysnetwork_read_network_config(ping_t)
logging_send_system_log_message(ping_t)
if (user_ping) {
- terminal_use_all_users_physical_terminals(ping_t)
- terminal_use_all_users_pseudoterminals(ping_t)
+ terminal_use_all_private_physical_terminals(ping_t)
+ terminal_use_all_private_pseudoterminals(ping_t)
}
ifdef(`TODO',`
@@ -194,8 +194,8 @@ devices_get_pseudorandom_data(traceroute_t)
files_read_general_application_resources(traceroute_t)
if (user_ping) {
- terminal_use_all_users_physical_terminals(traceroute_t)
- terminal_use_all_users_pseudoterminals(traceroute_t)
+ terminal_use_all_private_physical_terminals(traceroute_t)
+ terminal_use_all_private_pseudoterminals(traceroute_t)
}
ifdef(`TODO',`
diff --git a/refpolicy/policy/modules/admin/usermanage.te b/refpolicy/policy/modules/admin/usermanage.te
index c3457c4..d36f8a0 100644
--- a/refpolicy/policy/modules/admin/usermanage.te
+++ b/refpolicy/policy/modules/admin/usermanage.te
@@ -85,8 +85,8 @@ kernel_compute_create(chfn_t)
kernel_compute_relabel(chfn_t)
kernel_compute_reachable_user_contexts(chfn_t)
-terminal_use_all_users_physical_terminals(chfn_t)
-terminal_use_all_users_pseudoterminals(chfn_t)
+terminal_use_all_private_physical_terminals(chfn_t)
+terminal_use_all_private_pseudoterminals(chfn_t)
filesystem_get_persistent_filesystem_attributes(chfn_t)
@@ -220,8 +220,8 @@ kernel_compute_reachable_user_contexts(groupadd_t)
filesystem_get_persistent_filesystem_attributes(groupadd_t)
-terminal_use_all_users_physical_terminals(groupadd_t)
-terminal_use_all_users_pseudoterminals(groupadd_t)
+terminal_use_all_private_physical_terminals(groupadd_t)
+terminal_use_all_private_pseudoterminals(groupadd_t)
init_use_file_descriptors(groupadd_t)
init_script_read_runtime_data(groupadd_t)
@@ -298,8 +298,8 @@ devices_get_pseudorandom_data(passwd_t)
filesystem_get_persistent_filesystem_attributes(passwd_t)
-terminal_use_all_users_physical_terminals(passwd_t)
-terminal_use_all_users_pseudoterminals(passwd_t)
+terminal_use_all_private_physical_terminals(passwd_t)
+terminal_use_all_private_pseudoterminals(passwd_t)
# /usr/bin/passwd asks for w access to utmp, but it will operate
# correctly without it. Do not audit write denials to utmp.
@@ -398,8 +398,8 @@ devices_get_pseudorandom_data(sysadm_passwd_t)
filesystem_get_persistent_filesystem_attributes(sysadm_passwd_t)
-terminal_use_all_users_physical_terminals(sysadm_passwd_t)
-terminal_use_all_users_pseudoterminals(sysadm_passwd_t)
+terminal_use_all_private_physical_terminals(sysadm_passwd_t)
+terminal_use_all_private_pseudoterminals(sysadm_passwd_t)
# /usr/bin/passwd asks for w access to utmp, but it will operate
# correctly without it. Do not audit write denials to utmp.
@@ -487,8 +487,8 @@ kernel_read_kernel_sysctl(useradd_t)
filesystem_get_persistent_filesystem_attributes(useradd_t)
-terminal_use_all_users_physical_terminals(useradd_t)
-terminal_use_all_users_pseudoterminals(useradd_t)
+terminal_use_all_private_physical_terminals(useradd_t)
+terminal_use_all_private_pseudoterminals(useradd_t)
init_use_file_descriptors(useradd_t)
init_script_modify_runtime_data(useradd_t)
diff --git a/refpolicy/policy/modules/kernel/bootloader.te b/refpolicy/policy/modules/kernel/bootloader.te
index 5decaa8..1ab29ce 100644
--- a/refpolicy/policy/modules/kernel/bootloader.te
+++ b/refpolicy/policy/modules/kernel/bootloader.te
@@ -109,7 +109,7 @@ devices_raw_read_memory(bootloader_t)
filesystem_get_persistent_filesystem_attributes(bootloader_t)
-terminal_get_all_users_physical_terminal_attributes(bootloader_t)
+terminal_get_all_private_physical_terminal_attributes(bootloader_t)
init_get_control_channel_attributes(bootloader_t)
init_script_use_pseudoterminal(bootloader_t)
diff --git a/refpolicy/policy/modules/kernel/corenetwork.if b/refpolicy/policy/modules/kernel/corenetwork.if
index 3e122c9..e839ba2 100644
--- a/refpolicy/policy/modules/kernel/corenetwork.if
+++ b/refpolicy/policy/modules/kernel/corenetwork.if
@@ -726,6 +726,20 @@ class capability net_bind_service;
#######################################
#
+# corenetwork_ignore_bind_tcp_on_all_reserved_ports(domain)
+#
+define(`corenetwork_ignore_bind_tcp_on_all_reserved_ports',`
+requires_block_template(`$0'_depend)
+dontaudit $1 reserved_port_type:tcp_socket name_bind;
+')
+
+define(`corenetwork_ignore_bind_tcp_on_all_reserved_ports_depend',`
+attribute reserved_port_type;
+class tcp_socket name_bind;
+')
+
+#######################################
+#
# corenetwork_bind_udp_on_all_reserved_ports(domain)
#
define(`corenetwork_bind_udp_on_all_reserved_ports',`
diff --git a/refpolicy/policy/modules/kernel/devices.if b/refpolicy/policy/modules/kernel/devices.if
index 4947150..ce95b8b 100644
--- a/refpolicy/policy/modules/kernel/devices.if
+++ b/refpolicy/policy/modules/kernel/devices.if
@@ -578,12 +578,28 @@ class chr_file { getattr read write ioctl };
########################################
#
+# devices_get_direct_rendering_interface_attributes(domain)
+#
+define(`devices_get_direct_rendering_interface_attributes',`
+requires_block_template(`$0'_depend)
+allow $1 device_t:dir { getattr read search };
+allow $1 dri_device_t:chr_file getattr;
+')
+
+define(`devices_get_direct_rendering_interface_attributes_depend',`
+type device_t, dri_device_t;
+class dir { getattr read search };
+class chr_file getattr;
+')
+
+########################################
+#
# devices_use_direct_rendering_interface(domain)
#
define(`devices_use_direct_rendering_interface',`
requires_block_template(`$0'_depend)
allow $1 device_t:dir { getattr read search };
-allow $1 dri_device_t:chr_file { getattr read ioctl };
+allow $1 dri_device_t:chr_file { getattr read write ioctl };
')
define(`devices_use_direct_rendering_interface_depend',`
@@ -594,6 +610,20 @@ class chr_file { getattr read write ioctl };
########################################
#
+# devices_ignore_use_direct_rendering_interface(domain)
+#
+define(`devices_ignore_use_direct_rendering_interface',`
+requires_block_template(`$0'_depend)
+dontaudit $1 dri_device_t:chr_file { getattr read write ioctl };
+')
+
+define(`devices_ignore_use_direct_rendering_interface_depend',`
+type dri_device_t;
+class chr_file { getattr read write ioctl };
+')
+
+########################################
+#
# devices_read_mtrr(domain)
#
define(`devices_read_mtrr',`
diff --git a/refpolicy/policy/modules/kernel/devices.te b/refpolicy/policy/modules/kernel/devices.te
index 4230c93..3fcac88 100644
--- a/refpolicy/policy/modules/kernel/devices.te
+++ b/refpolicy/policy/modules/kernel/devices.te
@@ -88,6 +88,10 @@ filesystem_tmpfs_associate(memory_device_t)
neverallow ~memory_raw_read memory_device_t:{ chr_file blk_file } read;
neverallow ~memory_raw_write memory_device_t:{ chr_file blk_file } { append write };
+type misc_device_t, device_node;
+filesystem_associate(misc_device_t)
+filesystem_tmpfs_associate(misc_device_t)
+
#
# A more general type for mouse devices.
#
diff --git a/refpolicy/policy/modules/kernel/filesystem.if b/refpolicy/policy/modules/kernel/filesystem.if
index 7194d62..64c29cc 100644
--- a/refpolicy/policy/modules/kernel/filesystem.if
+++ b/refpolicy/policy/modules/kernel/filesystem.if
@@ -247,6 +247,100 @@ class filesystem getattr;
########################################
#
+# filesystem_execute_windows_network_files(domain)
+#
+define(`filesystem_execute_windows_network_files',`
+requires_block_template(`$0'_depend)
+allow $1 cifs_t:dir { getattr search read };
+allow $1 cifs_t:file { getattr read execute execute_no_trans };
+')
+
+define(`filesystem_execute_windows_network_files_depend',`
+type cifs_t;
+class dir { getattr search read };
+class file { getattr read execute execute_no_trans };
+')
+
+########################################
+#
+# filesystem_manage_windows_network_directories(domain)
+#
+define(`filesystem_manage_windows_network_directories',`
+requires_block_template(`$0'_depend)
+allow $1 cifs_t:dir { create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir };
+')
+
+define(`filesystem_manage_windows_network_directories_depend',`
+type cifs_t;
+class dir { create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir };
+')
+
+########################################
+#
+# filesystem_manage_windows_network_files(domain)
+#
+define(`filesystem_manage_windows_network_files',`
+requires_block_template(`$0'_depend)
+allow $1 cifs_t:dir { getattr search read write add_name remove_name };
+allow $1 cifs_t:file { create ioctl read getattr lock write setattr append link unlink rename };
+')
+
+define(`filesystem_manage_windows_network_files_depend',`
+type cifs_t;
+class dir { getattr search read write add_name remove_name };
+class file { create ioctl read getattr lock write setattr append link unlink rename };
+')
+
+########################################
+#
+# filesystem_manage_windows_network_symbolic_links(domain)
+#
+define(`filesystem_manage_windows_network_symbolic_links',`
+requires_block_template(`$0'_depend)
+allow $1 cifs_t:dir { getattr search read write add_name remove_name };
+allow $1 cifs_t:lnk_file { create ioctl read getattr lock write setattr append link unlink rename };
+')
+
+define(`filesystem_manage_windows_network_symbolic_links_depend',`
+type cifs_t;
+class dir { getattr search read write add_name remove_name };
+class lnk_file { create ioctl read getattr lock write setattr append link unlink rename };
+')
+
+########################################
+#
+# filesystem_manage_windows_network_named_pipes(domain)
+#
+define(`filesystem_manage_windows_network_named_pipes',`
+requires_block_template(`$0'_depend)
+allow $1 cifs_t:dir { getattr search read write add_name remove_name };
+allow $1 cifs_t:fifo_file { create ioctl read getattr lock write setattr append link unlink rename };
+')
+
+define(`filesystem_manage_windows_network_named_pipes_depend',`
+type cifs_t;
+class dir { getattr search read write add_name remove_name };
+class fifo_file { create ioctl read getattr lock write setattr append link unlink rename };
+')
+
+########################################
+#
+# filesystem_manage_windows_network_named_sockets(domain)
+#
+define(`filesystem_manage_windows_network_named_sockets',`
+requires_block_template(`$0'_depend)
+allow $1 cifs_t:dir { getattr search read write add_name remove_name };
+allow $1 cifs_t:sock_file { create ioctl read getattr lock write setattr append link unlink rename };
+')
+
+define(`filesystem_manage_windows_network_named_sockets_depend',`
+type cifs_t;
+class dir { getattr search read write add_name remove_name };
+class sock_file { create ioctl read getattr lock write setattr append link unlink rename };
+')
+
+########################################
+#
# filesystem_mount_dos_filesystem(domain)
#
define(`filesystem_mount_dos_filesystem',`
@@ -415,6 +509,100 @@ class filesystem getattr;
########################################
#
+# filesystem_execute_nfs_files(domain)
+#
+define(`filesystem_execute_nfs_files',`
+requires_block_template(`$0'_depend)
+allow $1 nfs_t:dir { getattr search read };
+allow $1 nfs_t:file { getattr read execute execute_no_trans };
+')
+
+define(`filesystem_execute_nfs_files_depend',`
+type nfs_t;
+class dir { getattr search read };
+class file { getattr read execute execute_no_trans };
+')
+
+########################################
+#
+# filesystem_manage_nfs_directories(domain)
+#
+define(`filesystem_manage_nfs_directories',`
+requires_block_template(`$0'_depend)
+allow $1 nfs_t:dir { create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir };
+')
+
+define(`filesystem_manage_nfs_directories_depend',`
+type nfs_t;
+class dir { create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir };
+')
+
+########################################
+#
+# filesystem_manage_nfs_files(domain)
+#
+define(`filesystem_manage_nfs_files',`
+requires_block_template(`$0'_depend)
+allow $1 nfs_t:dir { getattr search read write add_name remove_name };
+allow $1 nfs_t:file { create ioctl read getattr lock write setattr append link unlink rename };
+')
+
+define(`filesystem_manage_nfs_files_depend',`
+type nfs_t;
+class dir { getattr search read write add_name remove_name };
+class file { create ioctl read getattr lock write setattr append link unlink rename };
+')
+
+########################################
+#
+# filesystem_manage_nfs_symbolic_links(domain)
+#
+define(`filesystem_manage_nfs_symbolic_links',`
+requires_block_template(`$0'_depend)
+allow $1 nfs_t:dir { getattr search read write add_name remove_name };
+allow $1 nfs_t:lnk_file { create ioctl read getattr lock write setattr append link unlink rename };
+')
+
+define(`filesystem_manage_nfs_symbolic_links_depend',`
+type nfs_t;
+class dir { getattr search read write add_name remove_name };
+class lnk_file { create ioctl read getattr lock write setattr append link unlink rename };
+')
+
+########################################
+#
+# filesystem_manage_nfs_named_pipes(domain)
+#
+define(`filesystem_manage_nfs_named_pipes',`
+requires_block_template(`$0'_depend)
+allow $1 nfs_t:dir { getattr search read write add_name remove_name };
+allow $1 nfs_t:fifo_file { create ioctl read getattr lock write setattr append link unlink rename };
+')
+
+define(`filesystem_manage_nfs_named_pipes_depend',`
+type nfs_t;
+class dir { getattr search read write add_name remove_name };
+class fifo_file { create ioctl read getattr lock write setattr append link unlink rename };
+')
+
+########################################
+#
+# filesystem_manage_nfs_named_sockets(domain)
+#
+define(`filesystem_manage_nfs_named_sockets',`
+requires_block_template(`$0'_depend)
+allow $1 nfs_t:dir { getattr search read write add_name remove_name };
+allow $1 nfs_t:sock_file { create ioctl read getattr lock write setattr append link unlink rename };
+')
+
+define(`filesystem_manage_nfs_named_sockets_depend',`
+type nfs_t;
+class dir { getattr search read write add_name remove_name };
+class sock_file { create ioctl read getattr lock write setattr append link unlink rename };
+')
+
+########################################
+#
# filesystem_mount_nfsd_filesystem(domain)
#
define(`filesystem_mount_nfsd_filesystem',`
@@ -784,6 +972,20 @@ class filesystem getattr;
########################################
#
+# filesystem_get_all_filesystems_quotas(type)
+#
+define(`filesystem_get_all_filesystems_quotas',`
+requires_block_template(`$0'_depend)
+allow $1 fs_type:filesystem quotaget;
+')
+
+define(`filesystem_get_all_filesystems_quotas_depend',`
+attribute fs_type;
+class filesystem quotaget;
+')
+
+########################################
+#
# filesystem_get_all_file_attributes(type)
#
define(`filesystem_get_all_file_attributes',`
diff --git a/refpolicy/policy/modules/kernel/kernel.if b/refpolicy/policy/modules/kernel/kernel.if
index 9d6420c..79ba5db 100644
--- a/refpolicy/policy/modules/kernel/kernel.if
+++ b/refpolicy/policy/modules/kernel/kernel.if
@@ -372,6 +372,20 @@ class system syslog_read;
########################################
#
+# kernel_ignore_read_ring_buffer(domain)
+#
+define(`kernel_ignore_read_ring_buffer',`
+requires_block_template(`$0'_depend)
+dontaudit $1 kernel_t:system syslog_read;
+')
+
+define(`kernel_ignore_read_ring_buffer_depend',`
+type kernel_t;
+class system syslog_read;
+')
+
+########################################
+#
# kernel_change_ring_buffer_level(domain)
#
define(`kernel_change_ring_buffer_level',`
diff --git a/refpolicy/policy/modules/kernel/storage.if b/refpolicy/policy/modules/kernel/storage.if
index 1f69d35..8602a8a 100644
--- a/refpolicy/policy/modules/kernel/storage.if
+++ b/refpolicy/policy/modules/kernel/storage.if
@@ -1,13 +1,93 @@
# Copyright (C) 2005 Tresys Technology, LLC
+## <interfaces module="storage">
+## <summary>Policy controlling access to storage devices</summary>
+
+#
+## <interface name="storage_get_fixed_disk_attributes">
+## <description>
+## Allow the caller to get the attributes of fixed disk
+## device nodes.
+## </description>
+## <parameter position="1" name="domain">
+## The type of the process performing this action.
+## </parameter>
+## <infoflow type="read" weight="7"/>
+## </interface>
+#
+define(`storage_get_fixed_disk_attributes',`
+requires_block_template(`$0'_depend)
+devices_list_device_nodes($1)
+allow $1 fixed_disk_device_t:blk_file getattr;
+')
+
+define(`storage_get_fixed_disk_attributes_depend',`
+type fixed_disk_device_t;
+class blk_file getattr;
+')
+
+#
+## <interface name="storage_ignore_get_fixed_disk_attributes">
+## <description>
+## Do not audit attempts made by the caller to get
+## the attributes of fixed disk device nodes.
+## </description>
+## <parameter position="1" name="domain">
+## The type of the process to not audit.
+## </parameter>
+## <infoflow type="none"/>
+## </interface>
+#
+define(`storage_ignore_get_fixed_disk_attributes',`
+requires_block_template(`$0'_depend)
+dontaudit $1 fixed_disk_device_t:blk_file getattr;
+')
+
+define(`storage_ignore_get_fixed_disk_attributes_depend',`
+type fixed_disk_device_t;
+class blk_file getattr;
+')
+
+#
+## <interface name="storage_set_fixed_disk_attributes">
+## <description>
+## Allow the caller to set the attributes of fixed disk
+## device nodes.
+## </description>
+## <parameter position="1" name="domain">
+## The type of the process performing this action.
+## </parameter>
+## <infoflow type="write" weight="7"/>
+## </interface>
+#
+define(`storage_set_fixed_disk_attributes',`
+requires_block_template(`$0'_depend)
+devices_list_device_nodes($1)
+allow $1 fixed_disk_device_t:blk_file setattr;
+')
+
+define(`storage_set_fixed_disk_attributes_depend',`
+type fixed_disk_device_t;
+class blk_file setattr;
+')
-########################################
#
-# storage_raw_read_fixed_disk(domain)
+## <interface name="storage_raw_read_fixed_disk">
+## <description>
+## Allow the caller to directly read from a fixed disk.
+## This is extremly dangerous as it can bypass the
+## SELinux protections for filesystem objects, and
+## should only be used by trusted domains.
+## </description>
+## <parameter position="1" name="domain">
+## The type of the process performing this action.
+## </parameter>
+## <infoflow type="read" weight="10"/>
+## </interface>
#
define(`storage_raw_read_fixed_disk',`
requires_block_template(`$0'_depend)
typeattribute $1 fixed_disk_raw_read;
-devices_list_device_nodes($1,optional)
+devices_list_device_nodes($1)
allow $1 fixed_disk_device_t:blk_file { getattr read ioctl };
')
@@ -15,17 +95,26 @@ define(`storage_raw_read_fixed_disk_depend',`
type fixed_disk_device_t;
attribute fixed_disk_raw_read;
class blk_file { getattr read ioctl };
-devices_list_device_nodes_depend
')
-########################################
#
-# storage_raw_write_fixed_disk(domain)
+## <interface name="storage_write_read_fixed_disk">
+## <description>
+## Allow the caller to directly write to a fixed disk.
+## This is extremly dangerous as it can bypass the
+## SELinux protections for filesystem objects, and
+## should only be used by trusted domains.
+## </description>
+## <parameter position="1" name="domain">
+## The type of the process performing this action.
+## </parameter>
+## <infoflow type="write" weight="10"/>
+## </interface>
#
define(`storage_raw_write_fixed_disk',`
requires_block_template(`$0'_depend)
typeattribute $1 fixed_disk_raw_write;
-devices_list_device_nodes($1,optional)
+devices_list_device_nodes($1)
allow $1 fixed_disk_device_t:blk_file { getattr write ioctl };
')
@@ -33,12 +122,22 @@ define(`storage_raw_write_fixed_disk_depend',`
type fixed_disk_device_t;
attribute fixed_disk_raw_write;
class blk_file { getattr write ioctl };
-devices_list_device_nodes_depend
')
-########################################
#
-# storage_raw_read_lvm_volume(domain)
+##
+## <interface name="storage_raw_read_lvm_volume">
+## <description>
+## Allow the caller to directly read from a logical volume.
+## This is extremly dangerous as it can bypass the
+## SELinux protections for filesystem objects, and
+## should only be used by trusted domains.
+## </description>
+## <parameter position="1" name="domain">
+## The type of the process performing this action.
+## </parameter>
+## <infoflow type="read" weight="10"/>
+## </interface>
#
define(`storage_raw_read_lvm_volume',`
requires_block_template(`$0'_depend)
@@ -53,9 +152,19 @@ attribute fixed_disk_raw_read;
class blk_file { getattr read ioctl };
')
-########################################
#
-# storage_raw_write_lvm_volume(domain)
+## <interface name="storage_raw_write_lvm_volume">
+## <description>
+## Allow the caller to directly read from a logical volume.
+## This is extremly dangerous as it can bypass the
+## SELinux protections for filesystem objects, and
+## should only be used by trusted domains.
+## </description>
+## <parameter position="1" name="domain">
+## The type of the process performing this action.
+## </parameter>
+## <infoflow type="write" weight="10"/>
+## </interface>
#
define(`storage_raw_write_lvm_volume',`
requires_block_template(`$0'_depend)
@@ -70,39 +179,20 @@ attribute fixed_disk_raw_write;
class blk_file { getattr write ioctl };
')
-########################################
-#
-# storage_get_fixed_disk_attributes(domain)
-#
-define(`storage_get_fixed_disk_attributes',`
-requires_block_template(`$0'_depend)
-devices_list_device_nodes($1)
-allow $1 fixed_disk_device_t:blk_file getattr;
-')
-
-define(`storage_get_fixed_disk_attributes_depend',`
-type fixed_disk_device_t;
-class blk_file getattr;
-')
-
-########################################
-#
-# storage_set_fixed_disk_attributes(domain)
-#
-define(`storage_set_fixed_disk_attributes',`
-requires_block_template(`$0'_depend)
-devices_list_device_nodes($1)
-allow $1 fixed_disk_device_t:blk_file setattr;
-')
-
-define(`storage_set_fixed_disk_attributes_depend',`
-type fixed_disk_device_t;
-class blk_file setattr;
-')
-
-########################################
#
-# storage_read_scsi_generic(domain)
+## <interface name="storage_read_scsi_generic">
+## <description>
+## Allow the caller to directly read, in a
+## generic fashion, from any SCSI device.
+## This is extremly dangerous as it can bypass the
+## SELinux protections for filesystem objects, and
+## should only be used by trusted domains.
+## </description>
+## <parameter position="1" name="domain">
+## The type of the process performing this action.
+## </parameter>
+## <infoflow type="read" weight="10"/>
+## </interface>
#
define(`storage_read_scsi_generic',`
requires_block_template(`$0'_depend)
@@ -117,9 +207,20 @@ attribute scsi_generic_read;
class blk_file { getattr read ioctl };
')
-########################################
#
-# storage_write_scsi_generic(domain)
+## <interface name="storage_write_scsi_generic">
+## <description>
+## Allow the caller to directly write, in a
+## generic fashion, from any SCSI device.
+## This is extremly dangerous as it can bypass the
+## SELinux protections for filesystem objects, and
+## should only be used by trusted domains.
+## </description>
+## <parameter position="1" name="domain">
+## The type of the process performing this action.
+## </parameter>
+## <infoflow type="write" weight="10"/>
+## </interface>
#
define(`storage_write_scsi_generic',`
requires_block_template(`$0'_depend)
@@ -164,64 +265,94 @@ type scsi_generic_device_t;
class blk_file setattr;
')
-########################################
#
-# storage_raw_read_removable_device(domain)
+## <interface name="storage_get_removable_device_attributes">
+## <description>
+## Allow the caller to get the attributes of removable
+## devices device nodes.
+## </description>
+## <parameter position="1" name="domain">
+## The type of the process performing this action.
+## </parameter>
+## <infoflow type="read" weight="7"/>
+## </interface>
#
-define(`storage_raw_read_removable_device',`
+define(`storage_get_removable_device_attributes',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
-allow $1 removable_device_t:blk_file { getattr read ioctl };
+allow $1 removable_device_t:blk_file getattr;
')
-define(`storage_raw_read_removable_device_depend',`
+define(`storage_get_removable_device_attributes_depend',`
type removable_device_t;
-class blk_file { getattr read ioctl };
+class blk_file getattr;
+')
+
+#
+## <interface name="storage_ignore_get_removable_device_attributes">
+## <description>
+## Do not audit attempts made by the caller to get
+## the attributes of removable devices device nodes.
+## </description>
+## <parameter position="1" name="domain">
+## The type of the process to not audit.
+## </parameter>
+## <infoflow type="none"/>
+## </interface>
+#
+define(`storage_ignore_get_removable_device_attributes',`
+requires_block_template(`$0'_depend)
+dontaudit $1 removable_device_t:blk_file getattr;
+')
+
+define(`storage_ignore_get_removable_device_attributes_depend',`
+type removable_device_t;
+class blk_file getattr;
')
########################################
#
-# storage_raw_write_removable_device(domain)
+# storage_set_removable_device_attributes(domain)
#
-define(`storage_raw_write_removable_device',`
+define(`storage_set_removable_device_attributes',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
-allow $1 removable_device_t:blk_file { getattr write ioctl };
+allow $1 removable_device_t:blk_file setattr;
')
-define(`storage_raw_write_removable_device_depend',`
+define(`storage_set_removable_device_attributes_depend',`
type removable_device_t;
-class blk_file { getattr write ioctl };
+class blk_file setattr;
')
########################################
#
-# storage_get_removable_device_attributes(domain)
+# storage_raw_read_removable_device(domain)
#
-define(`storage_get_removable_device_attributes',`
+define(`storage_raw_read_removable_device',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
-allow $1 removable_device_t:blk_file getattr;
+allow $1 removable_device_t:blk_file { getattr read ioctl };
')
-define(`storage_get_removable_device_attributes_depend',`
+define(`storage_raw_read_removable_device_depend',`
type removable_device_t;
-class blk_file getattr;
+class blk_file { getattr read ioctl };
')
########################################
#
-# storage_set_removable_device_attributes(domain)
+# storage_raw_write_removable_device(domain)
#
-define(`storage_set_removable_device_attributes',`
+define(`storage_raw_write_removable_device',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
-allow $1 removable_device_t:blk_file setattr;
+allow $1 removable_device_t:blk_file { getattr write ioctl };
')
-define(`storage_set_removable_device_attributes_depend',`
+define(`storage_raw_write_removable_device_depend',`
type removable_device_t;
-class blk_file setattr;
+class blk_file { getattr write ioctl };
')
########################################
@@ -283,3 +414,5 @@ define(`storage_set_tape_device_attributes_depend',`
type tape_device_t;
class blk_file setattr;
')
+
+## </interfaces>
diff --git a/refpolicy/policy/modules/kernel/terminal.if b/refpolicy/policy/modules/kernel/terminal.if
index 0db677b..c48f3bc 100644
--- a/refpolicy/policy/modules/kernel/terminal.if
+++ b/refpolicy/policy/modules/kernel/terminal.if
@@ -2,27 +2,87 @@
########################################
#
-# terminal_make_pseudoterminal(domain,ptytype)
+# terminal_make_pseudoterminal(type)
#
define(`terminal_make_pseudoterminal',`
requires_block_template(`$0'_depend)
-devices_list_device_nodes($1,optional)
+allow $1 devpts_t:filesystem associate;
+typeattribute $1 ptynode;
+')
+
+define(`terminal_make_pseudoterminal_depend',`
+attribute ptynode;
+type devpts_t;
+class filesystem associate;
+')
+
+########################################
+#
+# terminal_make_user_pseudoterminal(domain,type)
+#
+define(`terminal_make_user_pseudoterminal',`
+requires_block_template(`$0'_depend)
+terminal_make_pseudoterminal($1)
+type_change $1 server_ptynode:chr_file $2;
+')
+
+define(`terminal_make_user_pseudoterminal_depend',`
+attribute server_ptynode;
+')
+
+########################################
+#
+# terminal_make_service_pseudoterminal(type)
+#
+define(`terminal_make_service_pseudoterminal',`
+requires_block_template(`$0'_depend)
+terminal_make_pseudoterminal($1)
+typeattribute $1 server_ptynode;
+')
+
+define(`terminal_make_service_pseudoterminal_depend',`
+attribute server_ptynode;
+')
+
+########################################
+#
+# terminal_make_physical_terminal(domain,type)
+#
+define(`terminal_make_physical_terminal',`
+requires_block_template(`$0'_depend)
+typeattribute $2 ttynode;
+type_change $1 tty_device_t:chr_file $2;
+# Debian login is from shadow utils and does not allow resetting the perms.
+# have to fix this!
+tunable_policy(`distro_debian',`
+type_change $1 ttyfile:chr_file $2;
+')
+')
+
+define(`terminal_make_physical_terminal_depend',`
+attribute ttynode;
+type tty_device_t;
+')
+
+########################################
+#
+# terminal_create_private_pseudoterminal(domain,ptytype)
+#
+define(`terminal_create_private_pseudoterminal',`
+requires_block_template(`$0'_depend)
+devices_list_device_nodes($1)
allow $1 ptmx_t:chr_file { getattr read write };
allow $1 devpts_t:dir { getattr search read };
allow $1 devpts_t:filesystem getattr;
-allow $2 devpts_t:filesystem associate;
dontaudit $1 bsdpty_device_t:chr_file { getattr read write };
type_transition $1 devpts_t:chr_file $2;
-typeattribute $2 ptynode;
')
-define(`terminal_make_pseudoterminal_depend',`
-attribute ptynode;
+define(`terminal_create_pseudoterminal_depend',`
type ptmx_t, devpts_t;
-class filesystem { getattr associate };
+class filesystem getattr;
class dir { getattr search read };
class chr_file { getattr read write };
-devices_list_device_nodes_depend
')
########################################
@@ -179,16 +239,16 @@ class chr_file { getattr read write };
########################################
#
-# terminal_get_all_users_pseudoterminal_attributes(domain)
+# terminal_get_all_private_pseudoterminal_attributes(domain)
#
-define(`terminal_get_all_users_pseudoterminal_attributes',`
+define(`terminal_get_all_private_pseudoterminal_attributes',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
allow $1 devpts_t:dir { getattr search read };
allow $1 ptynode:chr_file getattr;
')
-define(`terminal_get_all_users_pseudoterminal_attributes_depend',`
+define(`terminal_get_all_private_pseudoterminal_attributes_depend',`
attribute ptynode;
class dir { getattr search read };
class chr_file getattr;
@@ -196,16 +256,16 @@ class chr_file getattr;
########################################
#
-# terminal_use_all_users_pseudoterminals(domain)
+# terminal_use_all_private_pseudoterminals(domain)
#
-define(`terminal_use_all_users_pseudoterminals',`
+define(`terminal_use_all_private_pseudoterminals',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
allow $1 devpts_t:dir { getattr read search };
allow $1 ptynode:chr_file { read write };
')
-define(`terminal_use_all_users_pseudoterminals_depend',`
+define(`terminal_use_all_private_pseudoterminals_depend',`
attribute ptynode;
class dir { getattr search read };
class chr_file { read write };
@@ -213,14 +273,14 @@ class chr_file { read write };
########################################
#
-# terminal_ignore_use_all_users_pseudoterminals(domain)
+# terminal_ignore_use_all_private_pseudoterminals(domain)
#
-define(`terminal_ignore_use_all_users_pseudoterminals',`
+define(`terminal_ignore_use_all_private_pseudoterminals',`
requires_block_template(`$0'_depend)
dontaudit $1 ptynode:chr_file { read write };
')
-define(`terminal_ignore_use_all_users_pseudoterminals_depend',`
+define(`terminal_ignore_use_all_private_pseudoterminals_depend',`
attribute ptynode;
class chr_file { read write };
')
@@ -304,58 +364,58 @@ class chr_file { read write };
########################################
#
-# terminal_get_all_users_physical_terminal_attributes(domain)
+# terminal_get_all_private_physical_terminal_attributes(domain)
#
-define(`terminal_get_all_users_physical_terminal_attributes',`
+define(`terminal_get_all_private_physical_terminal_attributes',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
allow $1 ttynode:chr_file getattr;
')
-define(`terminal_get_all_users_physical_terminal_attributes_depend',`
+define(`terminal_get_all_private_physical_terminal_attributes_depend',`
attribute ttynode;
class chr_file getattr;
')
########################################
#
-# terminal_ignore_get_all_users_physical_terminal_attributes(domain)
+# terminal_ignore_get_all_private_physical_terminal_attributes(domain)
#
-define(`terminal_ignore_get_all_users_physical_terminal_attributes',`
+define(`terminal_ignore_get_all_private_physical_terminal_attributes',`
requires_block_template(`$0'_depend)
dontaudit $1 ttynode:chr_file getattr;
')
-define(`terminal_ignore_get_all_users_physical_terminal_attributes_depend',`
+define(`terminal_ignore_get_all_private_physical_terminal_attributes_depend',`
attribute ttynode;
class chr_file getattr;
')
########################################
#
-# terminal_use_all_users_physical_terminals(domain)
+# terminal_use_all_private_physical_terminals(domain)
#
-define(`terminal_use_all_users_physical_terminals',`
+define(`terminal_use_all_private_physical_terminals',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
allow $1 ttynode:chr_file { read write };
')
-define(`terminal_use_all_users_physical_terminals_depend',`
+define(`terminal_use_all_private_physical_terminals_depend',`
attribute ttynode;
class chr_file { read write };
')
########################################
#
-# terminal_ignore_use_all_users_physical_terminals(domain)
+# terminal_ignore_use_all_private_physical_terminals(domain)
#
-define(`terminal_ignore_use_all_users_physical_terminals',`
+define(`terminal_ignore_use_all_private_physical_terminals',`
requires_block_template(`$0'_depend)
dontaudit $1 ttynode:chr_file { read write };
')
-define(`terminal_ignore_use_all_users_physical_terminals_depend',`
+define(`terminal_ignore_use_all_private_physical_terminals_depend',`
attribute ttynode;
class chr_file { read write };
')
diff --git a/refpolicy/policy/modules/kernel/terminal.te b/refpolicy/policy/modules/kernel/terminal.te
index 36d172b..e43ce5e 100644
--- a/refpolicy/policy/modules/kernel/terminal.te
+++ b/refpolicy/policy/modules/kernel/terminal.te
@@ -4,6 +4,7 @@ policy_module(terminal,1.0)
attribute ttynode;
attribute ptynode;
+attribute server_ptynode;
#
# bsdpty_device_t is the type of /dev/[tp]ty[abcdepqrstuvwxyz][0-9a-f]
diff --git a/refpolicy/policy/modules/services/mta.if b/refpolicy/policy/modules/services/mta.if
index 6f47072..5a53119 100644
--- a/refpolicy/policy/modules/services/mta.if
+++ b/refpolicy/policy/modules/services/mta.if
@@ -220,6 +220,22 @@ class file { getattr read write append setattr };
#######################################
#
+# mta_modify_mail_spool(domain)
+#
+define(`mta_modify_mail_spool',`
+requires_block_template(`$0'_depend)
+allow $1 mail_spool_t:dir { read getattr lock search ioctl add_name remove_name write };
+allow $1 mail_spool_t:file { getattr read write append setattr };
+')
+
+define(`mta_modify_mail_spool_depend',`
+type mail_spool_t;
+class dir { read getattr lock search ioctl add_name remove_name write };
+class file { create ioctl read getattr lock write setattr append link unlink rename };
+')
+
+#######################################
+#
# mta_manage_mail_spool(domain)
#
define(`mta_manage_mail_spool',`
diff --git a/refpolicy/policy/modules/system/authlogin.if b/refpolicy/policy/modules/system/authlogin.if
index 6faef79..142c0d0 100644
--- a/refpolicy/policy/modules/system/authlogin.if
+++ b/refpolicy/policy/modules/system/authlogin.if
@@ -136,21 +136,6 @@ class udp_socket { create ioctl read getattr write setattr append bind getopt se
#######################################
#
-# authlogin_modify_login_records(domain)
-#
-define(`authlogin_modify_login_records',`
-requires_block_template(`$0'_depend)
-logging_search_system_log_directory($1)
-allow $1 wtmp_t:file { getattr read write setattr };
-')
-
-define(`authlogin_modify_login_records_depend',`
-type wtmp_t;
-class file { getattr read write setattr };
-')
-
-#######################################
-#
# authlogin_read_shadow_passwords(domain)
#
define(`authlogin_read_shadow_passwords',`
@@ -373,3 +358,47 @@ class dir { read getattr lock search ioctl add_name remove_name write };
class file { create ioctl read getattr lock write setattr append link unlink rename };
class lnk_file { create read getattr setattr link unlink rename };
')
+
+#######################################
+#
+# authlogin_read_login_records(domain)
+#
+define(`authlogin_read_login_records',`
+requires_block_template(`$0'_depend)
+logging_search_system_log_directory($1)
+allow $1 wtmp_t:file { getattr read };
+')
+
+define(`authlogin_read_login_records_depend',`
+type wtmp_t;
+class file { getattr read };
+')
+
+#######################################
+#
+# authlogin_ignore_write_login_records(domain)
+#
+define(`authlogin_ignore_write_login_records',`
+requires_block_template(`$0'_depend)
+dontaudit $1 wtmp_t:file write;
+')
+
+define(`authlogin_read_login_records_depend',`
+type wtmp_t;
+class file write;
+')
+
+#######################################
+#
+# authlogin_modify_login_records(domain)
+#
+define(`authlogin_modify_login_records',`
+requires_block_template(`$0'_depend)
+logging_search_system_log_directory($1)
+allow $1 wtmp_t:file { getattr read write setattr };
+')
+
+define(`authlogin_modify_login_records_depend',`
+type wtmp_t;
+class file { getattr read write setattr };
+')
diff --git a/refpolicy/policy/modules/system/authlogin.te b/refpolicy/policy/modules/system/authlogin.te
index c1f35ed..e4f7b7e 100644
--- a/refpolicy/policy/modules/system/authlogin.te
+++ b/refpolicy/policy/modules/system/authlogin.te
@@ -94,8 +94,8 @@ files_create_private_tmp_data(pam_t, pam_tmp_t, { file dir })
kernel_read_system_state(pam_t)
-terminal_use_all_users_physical_terminals(pam_t)
-terminal_use_all_users_pseudoterminals(pam_t)
+terminal_use_all_private_physical_terminals(pam_t)
+terminal_use_all_private_pseudoterminals(pam_t)
init_script_ignore_modify_runtime_data(pam_t)
@@ -288,10 +288,10 @@ allow utempter_t self:unix_stream_socket { create ioctl read getattr write setat
allow utempter_t wtmp_t:file { ioctl read getattr lock write append };
-terminal_get_all_users_physical_terminal_attributes(utempter_t)
-terminal_get_all_users_pseudoterminal_attributes(utempter_t)
-terminal_ignore_use_all_users_physical_terminals(utempter_t)
-terminal_ignore_use_all_users_pseudoterminals(utempter_t)
+terminal_get_all_private_physical_terminal_attributes(utempter_t)
+terminal_get_all_private_pseudoterminal_attributes(utempter_t)
+terminal_ignore_use_all_private_physical_terminals(utempter_t)
+terminal_ignore_use_all_private_pseudoterminals(utempter_t)
terminal_ignore_use_pseudoterminal_multiplexer(utempter_t)
init_script_modify_runtime_data(utempter_t)
diff --git a/refpolicy/policy/modules/system/clock.te b/refpolicy/policy/modules/system/clock.te
index 3bd5bf7..2d7cb75 100644
--- a/refpolicy/policy/modules/system/clock.te
+++ b/refpolicy/policy/modules/system/clock.te
@@ -39,8 +39,8 @@ filesystem_get_persistent_filesystem_attributes(hwclock_t)
terminal_ignore_use_console(hwclock_t)
terminal_use_general_physical_terminal(hwclock_t)
-terminal_use_all_users_physical_terminals(hwclock_t)
-terminal_use_all_users_pseudoterminals(hwclock_t)
+terminal_use_all_private_physical_terminals(hwclock_t)
+terminal_use_all_private_pseudoterminals(hwclock_t)
init_use_file_descriptors(hwclock_t)
init_script_use_pseudoterminal(hwclock_t)
diff --git a/refpolicy/policy/modules/system/getty.te b/refpolicy/policy/modules/system/getty.te
index 09a7a0b..c4d0c56 100644
--- a/refpolicy/policy/modules/system/getty.te
+++ b/refpolicy/policy/modules/system/getty.te
@@ -60,9 +60,3 @@ locallogin_transition(getty_t)
logging_send_system_log_message(getty_t)
miscfiles_read_localization(getty_t)
-
-# TODO: to allow w to display everyone...
-#bool user_ttyfile_stat false;
-#if (user_ttyfile_stat) {
-#allow userdomain ttyfile:chr_file getattr;
-#}
diff --git a/refpolicy/policy/modules/system/hostname.te b/refpolicy/policy/modules/system/hostname.te
index f5c9f26..7f40975 100644
--- a/refpolicy/policy/modules/system/hostname.te
+++ b/refpolicy/policy/modules/system/hostname.te
@@ -35,8 +35,8 @@ files_ignore_search_system_state_data_directory(hostname_t)
filesystem_get_persistent_filesystem_attributes(hostname_t)
terminal_ignore_use_console(hostname_t)
-terminal_use_all_users_physical_terminals(hostname_t)
-terminal_use_all_users_pseudoterminals(hostname_t)
+terminal_use_all_private_physical_terminals(hostname_t)
+terminal_use_all_private_pseudoterminals(hostname_t)
init_use_file_descriptors(hostname_t)
init_script_use_pseudoterminal(hostname_t)
diff --git a/refpolicy/policy/modules/system/init.if b/refpolicy/policy/modules/system/init.if
index a701982..52b51e5 100644
--- a/refpolicy/policy/modules/system/init.if
+++ b/refpolicy/policy/modules/system/init.if
@@ -257,30 +257,44 @@ class fd use;
########################################
#
+# init_script_get_process_group(domain)
+#
+define(`init_script_get_process_group',`
+requires_block_template(`$0'_depend)
+allow $1 initrc_t:process getpgid;
+')
+
+define(`init_script_get_process_group_depend',`
+type initrc_t;
+class process getpgid;
+')
+
+########################################
+#
# init_script_use_pseudoterminal(domain)
#
define(`init_script_use_pseudoterminal',`
requires_block_template(`$0'_depend)
-allow $1 initrc_devpts_t:chr_file { read write };
+allow $1 initrc_devpts_t:chr_file { getattr read write ioctl };
')
define(`init_script_use_pseudoterminal_depend',`
type initrc_devpts_t;
-class chr_file { read write };
+class chr_file { getattr read write ioctl };
')
########################################
#
-# init_script_get_process_group(domain)
+# init_script_ignore_use_pseudoterminal(domain)
#
-define(`init_script_get_process_group',`
+define(`init_script_ignore_use_pseudoterminal',`
requires_block_template(`$0'_depend)
-allow $1 initrc_t:process getpgid;
+allow $1 initrc_devpts_t:chr_file { read write ioctl };
')
-define(`init_script_get_process_group_depend',`
-type initrc_t;
-class process getpgid;
+define(`init_script_ignore_use_pseudoterminal_depend',`
+type initrc_devpts_t;
+class chr_file { read write ioctl };
')
########################################
diff --git a/refpolicy/policy/modules/system/init.te b/refpolicy/policy/modules/system/init.te
index bccab0a..c697722 100644
--- a/refpolicy/policy/modules/system/init.te
+++ b/refpolicy/policy/modules/system/init.te
@@ -47,7 +47,7 @@ domain_make_entrypoint_file(initrc_t,initrc_exec_t)
type initrc_devpts_t;
filesystem_associate(initrc_devpts_t)
filesystem_noxattr_associate(initrc_devpts_t)
-terminal_make_pseudoterminal(initrc_t,initrc_devpts_t)
+terminal_make_pseudoterminal(initrc_devpts_t)
type initrc_var_run_t;
files_make_daemon_runtime_file(initrc_var_run_t)
diff --git a/refpolicy/policy/modules/system/locallogin.te b/refpolicy/policy/modules/system/locallogin.te
index 699519b..7446423 100644
--- a/refpolicy/policy/modules/system/locallogin.te
+++ b/refpolicy/policy/modules/system/locallogin.te
@@ -65,7 +65,7 @@ kernel_compute_reachable_user_contexts(local_login_t)
# for SSP/ProPolice
devices_get_pseudorandom_data(local_login_t)
-terminal_use_all_users_physical_terminals(local_login_t)
+terminal_use_all_private_physical_terminals(local_login_t)
terminal_use_general_physical_terminal(local_login_t)
init_script_modify_runtime_data(local_login_t)
diff --git a/refpolicy/policy/modules/system/logging.if b/refpolicy/policy/modules/system/logging.if
index 39968a9..ef0a698 100644
--- a/refpolicy/policy/modules/system/logging.if
+++ b/refpolicy/policy/modules/system/logging.if
@@ -74,6 +74,20 @@ class dir search;
#######################################
#
+# logging_ignore_get_all_logs_attributes(domain)
+#
+define(`logging_ignore_get_all_logs_attributes',`
+requires_block_template(`$0'_depend)
+dontaudit $1 logfile:file getattr;
+')
+
+define(`logging_ignore_get_all_logs_attributes_depend',`
+attribute logfile;
+class file getattr;
+')
+
+#######################################
+#
# logging_append_all_logs(domain)
#
define(`logging_append_all_logs',`
diff --git a/refpolicy/policy/modules/system/lvm.te b/refpolicy/policy/modules/system/lvm.te
index 2b6a3ff..c19cf9c 100644
--- a/refpolicy/policy/modules/system/lvm.te
+++ b/refpolicy/policy/modules/system/lvm.te
@@ -95,7 +95,7 @@ devices_ignore_get_all_character_device_attributes(lvm_t)
devices_ignore_get_all_block_device_attributes(lvm_t)
devices_ignore_get_generic_character_device_attributes(lvm_t)
devices_ignore_get_generic_block_device_attributes(lvm_t)
-terminal_ignore_get_all_users_physical_terminal_attributes(lvm_t)
+terminal_ignore_get_all_private_physical_terminal_attributes(lvm_t)
filesystem_get_persistent_filesystem_attributes(lvm_t)
diff --git a/refpolicy/policy/modules/system/selinux.te b/refpolicy/policy/modules/system/selinux.te
index f04ed99..b4faa64 100644
--- a/refpolicy/policy/modules/system/selinux.te
+++ b/refpolicy/policy/modules/system/selinux.te
@@ -219,8 +219,8 @@ devices_get_pseudorandom_data(newrole_t)
filesystem_get_persistent_filesystem_attributes(newrole_t)
-terminal_use_all_users_physical_terminals(newrole_t)
-terminal_use_all_users_pseudoterminals(newrole_t)
+terminal_use_all_private_physical_terminals(newrole_t)
+terminal_use_all_private_pseudoterminals(newrole_t)
# Write to utmp.
init_script_modify_runtime_data(newrole_t)
@@ -374,8 +374,8 @@ kernel_compute_reachable_user_contexts(setfiles_t)
filesystem_get_persistent_filesystem_attributes(setfiles_t)
-terminal_use_all_users_physical_terminals(setfiles_t)
-terminal_use_all_users_pseudoterminals(setfiles_t)
+terminal_use_all_private_physical_terminals(setfiles_t)
+terminal_use_all_private_pseudoterminals(setfiles_t)
terminal_use_general_physical_terminal(setfiles_t)
init_use_file_descriptors(setfiles_t)
diff --git a/refpolicy/policy/modules/system/selinuxutil.te b/refpolicy/policy/modules/system/selinuxutil.te
index f04ed99..b4faa64 100644
--- a/refpolicy/policy/modules/system/selinuxutil.te
+++ b/refpolicy/policy/modules/system/selinuxutil.te
@@ -219,8 +219,8 @@ devices_get_pseudorandom_data(newrole_t)
filesystem_get_persistent_filesystem_attributes(newrole_t)
-terminal_use_all_users_physical_terminals(newrole_t)
-terminal_use_all_users_pseudoterminals(newrole_t)
+terminal_use_all_private_physical_terminals(newrole_t)
+terminal_use_all_private_pseudoterminals(newrole_t)
# Write to utmp.
init_script_modify_runtime_data(newrole_t)
@@ -374,8 +374,8 @@ kernel_compute_reachable_user_contexts(setfiles_t)
filesystem_get_persistent_filesystem_attributes(setfiles_t)
-terminal_use_all_users_physical_terminals(setfiles_t)
-terminal_use_all_users_pseudoterminals(setfiles_t)
+terminal_use_all_private_physical_terminals(setfiles_t)
+terminal_use_all_private_pseudoterminals(setfiles_t)
terminal_use_general_physical_terminal(setfiles_t)
init_use_file_descriptors(setfiles_t)
diff --git a/refpolicy/policy/modules/system/sysnetwork.te b/refpolicy/policy/modules/system/sysnetwork.te
index b9a48af..7ec78f1 100644
--- a/refpolicy/policy/modules/system/sysnetwork.te
+++ b/refpolicy/policy/modules/system/sysnetwork.te
@@ -90,8 +90,8 @@ devices_get_pseudorandom_data(dhcpc_t)
filesystem_get_all_filesystems_attributes(dhcpc_t)
terminal_ignore_use_console(dhcpc_t)
-terminal_ignore_use_all_users_physical_terminals(dhcpc_t)
-terminal_ignore_use_all_users_pseudoterminals(dhcpc_t)
+terminal_ignore_use_all_private_physical_terminals(dhcpc_t)
+terminal_ignore_use_all_private_pseudoterminals(dhcpc_t)
terminal_ignore_use_general_physical_terminal(dhcpc_t)
init_use_file_descriptors(dhcpc_t)
@@ -254,8 +254,8 @@ kernel_read_network_state(ifconfig_t)
filesystem_get_persistent_filesystem_attributes(ifconfig_t)
-terminal_ignore_use_all_users_physical_terminals(ifconfig_t)
-terminal_ignore_use_all_users_pseudoterminals(ifconfig_t)
+terminal_ignore_use_all_private_physical_terminals(ifconfig_t)
+terminal_ignore_use_all_private_pseudoterminals(ifconfig_t)
init_use_file_descriptors(ifconfig_t)
init_script_use_pseudoterminal(ifconfig_t)
diff --git a/refpolicy/policy/modules/system/userdomain.if b/refpolicy/policy/modules/system/userdomain.if
new file mode 100644
index 0000000..a2802d1
--- /dev/null
+++ b/refpolicy/policy/modules/system/userdomain.if
@@ -0,0 +1,562 @@
+# Copyright (C) 2005 Tresys Technology, LLC
+
+########################################
+#
+# Base user domain template
+#
+# This is common to user and admin domain
+
+define(`base_user_domain',`
+
+role $1_r types $1_t;
+allow system_r $1_r;
+
+allow $1_t self:capability { setgid chown fowner };
+dontaudit $1_t self:capability { sys_nice fsetid };
+allow $1_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem dyntransition };
+allow $1_t self:process { ptrace setfscreate };
+allow $1_t self:fd use;
+allow $1_t self:fifo_file { read getattr lock ioctl write append };
+allow $1_t self:unix_dgram_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
+allow $1_t self:unix_stream_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown listen accept };
+allow $1_t self:unix_dgram_socket sendto;
+allow $1_t self:unix_stream_socket connectto;
+allow $1_t self:shm { associate getattr setattr create destroy read write lock unix_read unix_write };
+allow $1_t self:sem { associate getattr setattr create destroy read write unix_read unix_write };
+allow $1_t self:msgq { associate getattr setattr create destroy read write enqueue unix_read unix_write };
+allow $1_t self:msg { send receive };
+dontaudit $1_t self:socket create;
+# Irrelevant until we have labeled networking.
+#allow $1_t self:udp_socket { sendto recvfrom };
+
+# evolution and gnome-session try to create a netlink socket
+dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
+dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
+
+# execute files in the home directory
+allow $1_t $1_home_t:file { getattr read execute execute_no_trans };
+
+# full control of the home directory
+allow $1_t $1_home_t:file { create ioctl read getattr lock write setattr append link unlink rename relabelfrom relabelto };
+allow $1_t $1_home_t:lnk_file { create read getattr setattr link unlink rename relabelfrom relabelto };
+allow $1_t $1_home_t:dir { create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir relabelfrom relabelto };
+allow $1_t $1_home_t:sock_file { create ioctl read getattr lock write setattr append link unlink rename relabelfrom relabelto };
+allow $1_t $1_home_t:fifo_file { create ioctl read getattr lock write setattr append link unlink rename relabelfrom relabelto };
+allow $1_t $1_home_dir_t:dir { create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir };
+type_transition $1_t $1_home_dir_t:{ file lnk_file dir sock_file fifo_file } $1_home_t;
+
+allow $1_t $1_tmp_t:file { getattr read execute execute_no_trans };
+
+# Bind to a Unix domain socket in /tmp.
+# cjp: this is combination is not checked and should be removed
+allow $1_t $1_tmp_t:unix_stream_socket name_bind;
+
+allow $1_t $1_tty_device_t:chr_file { setattr getattr read write append ioctl lock };
+
+allow $1_t unpriv_userdomain:fd use;
+
+# Instantiate derived domains for a number of programs.
+# These derived domains encode both information about the calling
+# user domain and the program, and allow us to maintain separation
+# between different instances of the program being run by different
+# user domains.
+per_userdomain_templates($1)
+
+kernel_read_kernel_sysctl($1_t)
+kernel_get_selinuxfs_mount_point($1_t)
+# Very permissive allowing every domain to see every type.
+kernel_get_sysvipc_info($1_t)
+# Find CDROM devices
+kernel_read_device_sysctl($1_t)
+
+corenetwork_network_tcp_on_all_interfaces($1_t)
+corenetwork_network_raw_on_all_interfaces($1_t)
+corenetwork_network_udp_on_all_interfaces($1_t)
+corenetwork_network_tcp_on_all_nodes($1_t)
+corenetwork_network_raw_on_all_nodes($1_t)
+corenetwork_network_udp_on_all_nodes($1_t)
+corenetwork_network_tcp_on_all_ports($1_t)
+corenetwork_network_udp_on_all_ports($1_t)
+corenetwork_bind_tcp_on_all_nodes($1_t)
+corenetwork_bind_udp_on_all_nodes($1_t)
+# allow port_t name binding for UDP because it is not very usable otherwise
+corenetwork_bind_udp_on_general_port($1_t)
+
+devices_get_input_event($1_t)
+devices_read_misc($1_t)
+devices_write_misc($1_t)
+devices_play_sound($1_t)
+devices_record_sound_input($1_t)
+devices_read_sound_mixer_levels($1_t)
+devices_write_sound_mixer_levels($1_t)
+devices_get_random_data($1_t)
+devices_get_pseudorandom_data($1_t)
+# open office is looking for the following
+devices_get_direct_rendering_interface_attributes($1_t)
+devices_ignore_use_direct_rendering_interface($1_t)
+
+filesystem_get_all_filesystems_quotas($1_t)
+filesystem_get_all_filesystems_attributes($1_t)
+
+# for eject
+storage_get_fixed_disk_attributes($1_t)
+
+authlogin_read_login_records($1_t)
+authlogin_ignore_write_login_records($1_t)
+
+corecommands_execute_general_programs($1_t)
+corecommands_execute_system_programs($1_t)
+
+domain_execute_all_entrypoint_programs($1_t)
+domain_use_widely_inheritable_file_descriptors($1_t)
+
+files_execute_system_config_script($1_t)
+files_read_system_source_code($1_t)
+
+# Caused by su - init scripts
+init_script_ignore_use_pseudoterminal($1_t)
+
+libraries_use_dynamic_loader($1_t)
+libraries_read_shared_libraries($1_t)
+libraries_execute_dynamic_loader($1_t)
+libraries_execute_library_scripts($1_t)
+
+logging_ignore_get_all_logs_attributes($1_t)
+
+miscfiles_read_localization($1_t)
+miscfiles_manage_man_page_cache($1_t)
+
+mta_modify_mail_spool($1_t)
+
+if (allow_execmem) {
+# Allow loading DSOs that require executable stack.
+allow $1_t self:process execmem;
+}
+
+if (use_nfs_home_dirs) {
+filesystem_manage_nfs_directories($1_t)
+filesystem_manage_nfs_files($1_t)
+filesystem_manage_nfs_symbolic_links($1_t)
+filesystem_manage_nfs_named_sockets($1_t)
+filesystem_manage_nfs_named_pipes($1_t)
+filesystem_execute_nfs_files($1_t)
+}
+
+if (use_samba_home_dirs) {
+filesystem_manage_windows_network_directories($1_t)
+filesystem_manage_windows_network_files($1_t)
+filesystem_manage_windows_network_symbolic_links($1_t)
+filesystem_manage_windows_network_named_sockets($1_t)
+filesystem_manage_windows_network_named_pipes($1_t)
+filesystem_execute_windows_network_files($1_t)
+}
+
+if (user_direct_mouse) {
+devices_get_mouse_input($1_t)
+}
+
+if (user_ttyfile_stat) {
+terminal_get_all_private_physical_terminal_attributes($1_t)
+}
+
+ifdef(`TODO',`
+
+# When the user domain runs ps, there will be a number of access
+# denials when ps tries to search /proc. Do not audit these denials.
+dontaudit $1_t domain:dir r_dir_perms;
+dontaudit $1_t domain:notdevfile_class_set r_file_perms;
+dontaudit $1_t domain:process { getattr getsession };
+#
+# Cups daemon running as user tries to write /etc/printcap
+#
+dontaudit $1_t usr_t:file setattr;
+
+# Access the power device.
+allow $1_t power_device_t:chr_file { getattr read write ioctl };
+
+# Check to see if cdrom is mounted
+allow $1_t mnt_t:dir { getattr search };
+
+#
+# Added to allow reading of cdrom
+#
+allow $1_t rpc_pipefs_t:dir getattr;
+allow $1_t nfsd_fs_t:dir getattr;
+allow $1_t binfmt_misc_fs_t:dir getattr;
+
+# /initrd is left mounted, various programs try to look at it
+dontaudit $1_t ramfs_t:dir getattr;
+
+if (read_default_t) {
+allow $1_t default_t:dir r_dir_perms;
+allow $1_t default_t:notdevfile_class_set r_file_perms;
+}
+
+#
+# Running ifconfig as a user generates the following
+#
+dontaudit $1_t sysctl_net_t:dir search;
+
+dontaudit $1_t default_context_t:dir search;
+
+r_dir_file($1_t, usercanread)
+
+can_ypbind($1_t)
+
+if (allow_execmod) {
+# Allow text relocations on system shared libraries, e.g. libGL.
+allow $1_t texrel_shlib_t:file execmod;
+}
+
+allow $1_t fs_type:dir getattr;
+
+# old "file_browse_domain":
+# Regular files/directories that are not security sensitive
+dontaudit $1_t file_type - secure_file_type:dir_file_class_set getattr;
+dontaudit $1_t file_type - secure_file_type:dir { read search };
+# /dev
+dontaudit $1_t dev_fs:dir_file_class_set getattr;
+dontaudit $1_t dev_fs:dir { read search };
+# /proc
+dontaudit $1_t sysctl_t:dir_file_class_set getattr;
+dontaudit $1_t proc_fs:dir { read search };
+
+allow $1_t autofs_t:dir { search getattr };
+
+can_exec($1_t, { removable_t noexattrfile } )
+if (user_rw_noexattrfile) {
+create_dir_file($1_t, noexattrfile)
+create_dir_file($1_t, removable_t)
+# Write floppies
+allow $1_t removable_device_t:blk_file rw_file_perms;
+allow $1_t usbtty_device_t:chr_file write;
+} else {
+r_dir_file($1_t, noexattrfile)
+r_dir_file($1_t, removable_t)
+allow $1_t removable_device_t:blk_file r_file_perms;
+}
+allow $1_t usbtty_device_t:chr_file read;
+
+# GNOME checks for usb and other devices
+rw_dir_file($1_t,usbfs_t)
+
+can_exec($1_t, noexattrfile)
+
+# for running TeX programs
+r_dir_file($1_t, tetex_data_t)
+can_exec($1_t, tetex_data_t)
+
+type $1_tmpfs_t, file_type, sysadmfile, tmpfsfile;
+file_type_auto_trans($1_t, tmpfs_t, $1_tmpfs_t)
+allow $1_tmpfs_t tmpfs_t:filesystem associate;
+
+# Run programs developed by other users in the same domain.
+
+can_resmgrd_connect($1_t)
+
+can_ypbind($1_t)
+
+allow $1_t var_lock_t:dir search;
+
+# Grant permissions to access the system DBus
+ifdef(`dbusd.te', `
+dbusd_client(system, $1)
+can_network_server_tcp($1_dbusd_t)
+allow $1_dbusd_t reserved_port_t:tcp_socket name_bind;
+
+allow $1_t system_dbusd_t:dbus { send_msg acquire_svc };
+dbusd_client($1, $1)
+allow $1_t $1_dbusd_t:dbus { send_msg acquire_svc };
+dbusd_domain($1)
+ifdef(`hald.te', `
+allow $1_t hald_t:dbus send_msg;
+allow hald_t $1_t:dbus send_msg;
+') dnl end ifdef hald.te
+') dnl end ifdef dbus.te
+
+# Gnome pannel binds to the following
+ifdef(`cups.te', `
+allow $1_t { cupsd_etc_t cupsd_rw_etc_t }:file { read getattr };
+')
+
+# Connect to inetd.
+ifdef(`inetd.te', `
+can_tcp_connect($1_t, inetd_t)
+can_udp_send($1_t, inetd_t)
+can_udp_send(inetd_t, $1_t)
+')
+
+# Connect to portmap.
+ifdef(`portmap.te', `can_tcp_connect($1_t, portmap_t)')
+
+# Inherit and use sockets from inetd
+ifdef(`inetd.te', `
+allow $1_t inetd_t:fd use;
+allow $1_t inetd_t:tcp_socket rw_stream_socket_perms;
+')
+
+ifdef(`xserver.te', `
+# for /tmp/.ICE-unix
+file_type_auto_trans($1_t, xdm_xserver_tmp_t, $1_tmp_t, sock_file)
+allow $1_t xserver_misc_device_t:{ chr_file blk_file } rw_file_perms;
+')
+
+ifdef(`xdm.te', `
+# Connect to the X server run by the X Display Manager.
+can_unix_connect($1_t, xdm_t)
+allow $1_t xdm_tmp_t:sock_file rw_file_perms;
+allow $1_t xdm_tmp_t:dir r_dir_perms;
+allow $1_t xdm_tmp_t:file { getattr read };
+allow $1_t xdm_xserver_tmp_t:sock_file { read write };
+allow $1_t xdm_xserver_tmp_t:dir search;
+allow $1_t xdm_xserver_t:unix_stream_socket connectto;
+# certain apps want to read xdm.pid file
+r_dir_file($1_t, xdm_var_run_t)
+allow $1_t xdm_var_lib_t:file { getattr read };
+allow xdm_t $1_home_dir_t:dir getattr;
+ifdef(`xauth.te', `
+file_type_auto_trans(xdm_t, $1_home_dir_t, $1_xauth_home_t, file)
+')
+
+# for shared memory
+allow xdm_xserver_t $1_tmpfs_t:file { read write };
+
+')dnl end ifdef xdm.te
+
+ifdef(`rpcd.te', `
+create_dir_file($1_t, nfsd_rw_t)
+')
+
+ifdef(`cardmgr.te', `
+# to allow monitoring of pcmcia status
+allow $1_t cardmgr_var_run_t:file { getattr read };
+')
+
+#
+# Allow graphical boot to check battery lifespan
+#
+ifdef(`apmd.te', `
+allow $1_t apmd_t:unix_stream_socket connectto;
+allow $1_t apmd_var_run_t:sock_file write;
+')
+
+ifdef(`automount.te', `
+allow $1_t autofs_t:dir { search getattr };
+')
+
+ifdef(`pamconsole.te', `
+allow $1_t pam_var_console_t:dir search;
+')
+
+') dnl endif TODO
+
+')dnl end base_user_domain macro
+
+########################################
+#
+# User domain template
+#
+
+define(`user_domain_template', `
+
+##############################
+#
+# Declarations
+#
+
+attribute $1_file_type;
+
+type $1_t, userdomain, unpriv_userdomain; #, web_client_domain, nscd_client_domain;
+domain_make_domain($1_t)
+domain_make_file_descriptors_widely_inheritable($1_t)
+
+type $1_devpts_t; # userpty_type, user_tty_type;
+terminal_make_user_pseudoterminal($1_t,$1_devpts_t)
+
+# Type for home directory.
+type $1_home_dir_t; #, home_dir_type, home_type, user_home_dir_type;
+files_make_file($1_home_dir_t)
+
+# Type for files and directories in the home directory
+type $1_home_t, $1_file_type; #, home_type, user_home_type;
+files_make_file($1_home_t)
+
+type $1_tmp_t, $1_file_type; #, user_tmpfile
+files_make_temporary_file($1_tmp_t)
+
+type $1_tty_device_t; #, sysadmfile, ttyfile, user_tty_type, dev_fs;
+terminal_make_physical_terminal($1_t,$1_tty_device_t)
+
+##############################
+#
+# Local policy
+#
+
+base_user_domain($1)
+
+allow $1_t $1_devpts_t:chr_file { setattr ioctl read getattr lock write append };
+terminal_create_private_pseudoterminal($1_t,$1_devpts_t)
+
+# Rules used to associate a homedir as a mountpoint
+allow $1_home_t self:filesystem associate;
+allow $1_file_type $1_home_t:filesystem associate;
+
+# user temporary files
+allow $1_t $1_tmp_t:file { create ioctl read getattr lock write setattr append link unlink rename };
+allow $1_t $1_tmp_t:lnk_file { create read getattr setattr link unlink rename };
+allow $1_t $1_tmp_t:dir { create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir };
+allow $1_t $1_tmp_t:sock_file { create ioctl read getattr lock write setattr append link unlink rename };
+allow $1_t $1_tmp_t:fifo_file { create ioctl read getattr lock write setattr append link unlink rename };
+files_create_private_tmp_data($1_t, $1_tmp_t, { file lnk_file dir sock_file fifo_file })
+
+# privileged home directory writers
+allow privhome $1_home_t:file { create ioctl read getattr lock write setattr append link unlink rename };
+allow privhome $1_home_t:lnk_file { create read getattr setattr link unlink rename };
+allow privhome $1_home_t:dir { create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir };
+allow privhome $1_home_t:sock_file { create ioctl read getattr lock write setattr append link unlink rename };
+allow privhome $1_home_t:fifo_file { create ioctl read getattr lock write setattr append link unlink rename };
+type_transition privhome $1_home_dir_t:{ file lnk_file dir sock_file fifo_file } $1_home_t;
+
+kernel_read_system_state($1_t)
+kernel_read_network_state($1_t)
+kernel_read_hardware_state($1_t)
+
+# cjp: why?
+bootloader_read_kernel_symbol_table($1_t)
+
+# port access is audited even if dac would not have allowed it, so dontaudit it here
+corenetwork_ignore_bind_tcp_on_all_reserved_ports($1_t)
+
+files_read_general_system_config($1_t)
+files_list_home_directories($1_t)
+files_read_general_application_resources($1_t)
+
+init_script_read_runtime_data($1_t)
+# The library functions always try to open read-write first,
+# then fall back to read-only if it fails.
+init_script_ignore_write_runtime_data($1_t)
+
+selinux_read_config($1_t)
+
+if (user_dmesg) {
+kernel_read_ring_buffer($1_t)
+} else {
+kernel_ignore_read_ring_buffer($1_t)
+}
+
+# Allow users to run TCP servers (bind to ports and accept connection from
+# the same domain and outside users) disabling this forces FTP passive mode
+# and may change other protocols
+if (user_tcp_server) {
+corenetwork_bind_tcp_on_general_port($1_t)
+}
+
+# Need the following rule to allow users to run vpnc
+optional_policy(`xserver.te', `
+corenetwork_bind_tcp_on_xserver_port($1_t)
+')
+
+ifdef(`TODO',`
+
+dontaudit $1_t boot_t:lnk_file read;
+dontaudit $1_t boot_t:file read;
+
+can_kerberos($1_t)
+
+# do not audit read on disk devices
+dontaudit $1_t { removable_device_t fixed_disk_device_t }:blk_file read;
+
+ifdef(`xdm.te', `
+allow xdm_t $1_home_t:lnk_file read;
+allow xdm_t $1_home_t:dir search;
+#
+# Changing this to dontaudit should cause the .xsession-errors file to be written to /tmp
+#
+dontaudit xdm_t $1_home_t:file rw_file_perms;
+')dnl end ifdef xdm.te
+
+ifdef(`ftpd.te', `
+if (ftp_home_dir) {
+file_type_auto_trans(ftpd_t, $1_home_dir_t, $1_home_t)
+}
+')dnl end ifdef ftpd
+
+if (read_default_t) {
+allow $1 default_t:dir r_dir_perms;
+allow $1 default_t:notdevfile_class_set r_file_perms;
+}
+
+can_exec($1_t, usr_t)
+
+# Read directories and files with the readable_t type.
+# This type is a general type for "world"-readable files.
+allow $1_t readable_t:dir r_dir_perms;
+allow $1_t readable_t:notdevfile_class_set r_file_perms;
+
+# Stat lost+found.
+allow $1_t lost_found_t:dir getattr;
+
+# Read /var, /var/spool, /var/run.
+allow $1_t var_t:dir r_dir_perms;
+allow $1_t var_t:notdevfile_class_set r_file_perms;
+allow $1_t var_spool_t:dir r_dir_perms;
+allow $1_t var_spool_t:notdevfile_class_set r_file_perms;
+allow $1_t var_run_t:dir r_dir_perms;
+allow $1_t var_run_t:{ file lnk_file } r_file_perms;
+allow $1_t var_lib_t:dir r_dir_perms;
+allow $1_t var_lib_t:file { getattr read };
+
+# for running depmod as part of the kernel packaging process
+allow $1_t modules_conf_t:file { getattr read };
+
+# Read man directories and files.
+allow $1_t man_t:dir r_dir_perms;
+allow $1_t man_t:notdevfile_class_set r_file_perms;
+
+# Allow users to rw usb devices
+if (user_rw_usb) {
+rw_dir_create_file($1_t,usbdevfs_t)
+} else {
+r_dir_file($1_t,usbdevfs_t)
+}
+
+# Read /dev directories and any symbolic links.
+allow $1_t device_t:dir r_dir_perms;
+allow $1_t device_t:lnk_file r_file_perms;
+
+# Do not audit write denials to /etc/ld.so.cache.
+dontaudit $1_t ld_so_cache_t:file write;
+
+dontaudit $1_t sysadm_home_t:file { read append };
+
+ifdef(`syslogd.te', `
+# Some programs that are left in $1_t will try to connect
+# to syslogd, but we do not want to let them generate log messages.
+# Do not audit.
+dontaudit $1_t devlog_t:sock_file { read write };
+dontaudit $1_t syslogd_t:unix_dgram_socket sendto;
+')
+
+# Stop warnings about access to /dev/console
+dontaudit $1_t init_t:fd use;
+dontaudit $1_t initrc_t:fd use;
+allow $1_t initrc_t:fifo_file write;
+ifdef(`user_can_mount', `
+#
+# Allow users to mount file systems like floppies and cdrom
+#
+mount_domain($1, $1_mount, `, fs_domain')
+r_dir_file($1_t, mnt_t)
+allow $1_mount_t device_t:lnk_file read;
+allow $1_mount_t removable_device_t:blk_file read;
+allow $1_mount_t iso9660_t:filesystem relabelfrom;
+allow $1_mount_t removable_t:filesystem { mount relabelto };
+allow $1_mount_t removable_t:dir mounton;
+ifdef(`xdm.te', `
+allow $1_mount_t xdm_t:fd use;
+allow $1_mount_t xdm_t:fifo_file { read write };
+')
+')
+
+') dnl end TODO
+')
diff --git a/refpolicy/policy/modules/system/userdomain.te b/refpolicy/policy/modules/system/userdomain.te
new file mode 100644
index 0000000..01e92ac
--- /dev/null
+++ b/refpolicy/policy/modules/system/userdomain.te
@@ -0,0 +1,79 @@
+# Copyright (C) 2005 Tresys Technology, LLC
+
+policy_module(userdomain,1.0)
+
+########################################
+#
+# Declarations
+#
+
+# The privhome attribute identifies every domain that can create files under
+# regular user home directories in the regular context (IE act on behalf of
+# a user in writing regular files)
+attribute privhome;
+
+# all user domains
+attribute userdomain;
+
+# unprivileged user domains
+attribute unpriv_userdomain;
+
+# Allow execution of anonymous mappings, e.g. executable stack.
+bool allow_execmem false;
+
+# Support Share libraries with Text Relocation
+bool allow_execmod false;
+
+# Allow system to run with kerberos
+bool allow_kerberos false;
+
+# Allow system to run with NIS
+bool allow_ypbind false;
+
+# Allow reading of default_t files.
+bool read_default_t false;
+
+# Allow staff_r users to search the sysadm home dir and read
+# files (such as ~/.bashrc)
+bool staff_read_sysadm_file false;
+
+# Support NFS home directories
+bool use_nfs_home_dirs false;
+
+# Support SAMBA home directories
+bool use_samba_home_dirs false;
+
+# Allow regular users direct mouse access
+bool user_direct_mouse false;
+
+# Allow users to read system messages.
+bool user_dmesg false;
+
+# Allow users to control network interfaces (also needs USERCTL=true)
+bool user_net_control false;
+
+# Allow user to r/w noextattrfile (FAT, CDROM, FLOPPY)
+bool user_rw_noexattrfile false;
+
+# Allow users to rw usb devices
+bool user_rw_usb false;
+
+# Allow users to run TCP servers (bind to ports and accept connection from
+# the same domain and outside users) disabling this forces FTP passive mode
+# and may change other protocols
+bool user_tcp_server false;
+
+# Allow w to display everyone
+bool user_ttyfile_stat false;
+
+user_domain_template(staff)
+user_domain_template(user)
+
+type sysadm_t;
+domain_make_domain(sysadm_t)
+per_userdomain_templates(sysadm)
+
+########################################
+#
+# Local policy
+#
More information about the scm-commits
mailing list