[selinux-policy: 1738/3172] Patch to begin separating out hald helper programs from Dan Walsh.
Daniel J Walsh
dwalsh at fedoraproject.org
Thu Oct 7 21:35:12 UTC 2010
commit 12217cc286aff0a365ff9032a0e39018a087f2e5
Author: Chris PeBenito <cpebenito at tresys.com>
Date: Mon May 7 17:57:48 2007 +0000
Patch to begin separating out hald helper programs from Dan Walsh.
Changelog | 1 +
policy/modules/kernel/devices.if | 18 +++++
policy/modules/kernel/devices.te | 2 +-
policy/modules/services/hal.fc | 5 ++
policy/modules/services/hal.te | 143 ++++++++++++++++++++++++++++++++++++--
5 files changed, 163 insertions(+), 6 deletions(-)
---
diff --git a/Changelog b/Changelog
index 5aadec5..444c5b0 100644
--- a/Changelog
+++ b/Changelog
@@ -1,3 +1,4 @@
+- Patch to begin separating out hald helper programs from Dan Walsh.
- Fixes for squid, dovecot, and snmp from Dan Walsh.
- Miscellaneous consolekit fixes from Dan Walsh.
- Patch to have avahi use the nsswitch interface rather than individual
diff --git a/policy/modules/kernel/devices.if b/policy/modules/kernel/devices.if
index cbbd523..27973bb 100644
--- a/policy/modules/kernel/devices.if
+++ b/policy/modules/kernel/devices.if
@@ -2939,6 +2939,24 @@ interface(`dev_read_video_dev',`
########################################
## <summary>
+## Write the video4linux devices.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`dev_write_video_dev',`
+ gen_require(`
+ type device_t, v4l_device_t;
+ ')
+
+ write_chr_files_pattern($1,device_t,v4l_device_t)
+')
+
+########################################
+## <summary>
## Read and write VMWare devices.
## </summary>
## <param name="domain">
diff --git a/policy/modules/kernel/devices.te b/policy/modules/kernel/devices.te
index 2a83f78..f7c7bc4 100644
--- a/policy/modules/kernel/devices.te
+++ b/policy/modules/kernel/devices.te
@@ -1,5 +1,5 @@
-policy_module(devices,1.4.0)
+policy_module(devices,1.4.1)
########################################
#
diff --git a/policy/modules/services/hal.fc b/policy/modules/services/hal.fc
index 5dceef6..38cc644 100644
--- a/policy/modules/services/hal.fc
+++ b/policy/modules/services/hal.fc
@@ -2,10 +2,15 @@
/etc/hal/device\.d/printer_remove\.hal -- gen_context(system_u:object_r:hald_exec_t,s0)
/etc/hal/capability\.d/printer_update\.hal -- gen_context(system_u:object_r:hald_exec_t,s0)
+/usr/libexec/hal-acl-tool -- gen_context(system_u:object_r:hald_acl_exec_t,s0)
/usr/libexec/hal-hotplug-map -- gen_context(system_u:object_r:hald_exec_t,s0)
+/usr/libexec/hal-system-sonypic -- gen_context(system_u:object_r:hald_sonypic_exec_t,s0)
+/usr/libexec/hald-addon-macbookpro-backlight -- gen_context(system_u:object_r:hald_mac_exec_t,s0)
/usr/sbin/hald -- gen_context(system_u:object_r:hald_exec_t,s0)
+/var/cache/hald(/.*)? gen_context(system_u:object_r:hald_cache_t,s0)
+
/var/lib/hal(/.*)? gen_context(system_u:object_r:hald_var_lib_t,s0)
/var/run/haldaemon.pid -- gen_context(system_u:object_r:hald_var_run_t,s0)
diff --git a/policy/modules/services/hal.te b/policy/modules/services/hal.te
index 5cba0bb..a940ce9 100644
--- a/policy/modules/services/hal.te
+++ b/policy/modules/services/hal.te
@@ -1,5 +1,5 @@
-policy_module(hal,1.6.0)
+policy_module(hal,1.6.1)
########################################
#
@@ -10,6 +10,30 @@ type hald_t;
type hald_exec_t;
init_daemon_domain(hald_t,hald_exec_t)
+type hald_acl_t;
+type hald_acl_exec_t;
+domain_type(hald_acl_t)
+domain_entry_file(hald_acl_t,hald_acl_exec_t)
+role system_r types hald_acl_t;
+
+type hald_cache_t;
+files_pid_file(hald_cache_t)
+
+type hald_log_t;
+files_type(hald_log_t)
+
+type hald_mac_t;
+type hald_mac_exec_t;
+domain_type(hald_mac_t)
+domain_entry_file(hald_mac_t,hald_mac_exec_t)
+role system_r types hald_mac_t;
+
+type hald_sonypic_t;
+type hald_sonypic_exec_t;
+domain_type(hald_sonypic_t)
+domain_entry_file(hald_sonypic_t,hald_sonypic_exec_t)
+role system_r types hald_sonypic_t;
+
type hald_tmp_t;
files_tmp_file(hald_tmp_t)
@@ -26,7 +50,7 @@ files_type(hald_var_lib_t)
# execute openvt which needs setuid
allow hald_t self:capability { chown setuid setgid kill net_admin sys_admin sys_nice dac_override dac_read_search mknod sys_rawio sys_tty_config };
-dontaudit hald_t self:capability sys_tty_config;
+dontaudit hald_t self:capability {sys_ptrace sys_tty_config };
allow hald_t self:process signal_perms;
allow hald_t self:fifo_file rw_fifo_file_perms;
allow hald_t self:unix_stream_socket { create_stream_socket_perms connectto };
@@ -39,6 +63,12 @@ allow hald_t self:netlink_socket create_socket_perms;
send_audit_msgs_pattern(hald_t)
+manage_files_pattern(hald_t,hald_cache_t,hald_cache_t)
+
+# log files for hald
+allow hald_t hald_log_t:file manage_file_perms;
+logging_log_filetrans(hald_t,hald_log_t,file)
+
manage_dirs_pattern(hald_t,hald_tmp_t,hald_tmp_t)
manage_files_pattern(hald_t,hald_tmp_t,hald_tmp_t)
files_tmp_filetrans(hald_t, hald_tmp_t, { file dir })
@@ -53,9 +83,9 @@ files_pid_filetrans(hald_t,hald_var_run_t,file)
kernel_read_system_state(hald_t)
kernel_read_network_state(hald_t)
-kernel_read_kernel_sysctls(hald_t)
+kernel_rw_kernel_sysctl(hald_t)
kernel_read_fs_sysctls(hald_t)
-kernel_read_irq_sysctls(hald_t)
+kernel_rw_irq_sysctls(hald_t)
kernel_rw_vm_sysctls(hald_t)
kernel_write_proc_files(hald_t)
@@ -88,6 +118,7 @@ dev_rw_sysfs(hald_t)
domain_use_interactive_fds(hald_t)
domain_read_all_domains_state(hald_t)
+domain_dontaudit_ptrace_all_domains(hald_t)
files_exec_etc_files(hald_t)
files_read_etc_files(hald_t)
@@ -104,6 +135,7 @@ files_read_kernel_img(hald_t)
fs_getattr_all_fs(hald_t)
fs_search_all(hald_t)
+fs_list_inotifyfs(hald_t)
fs_list_auto_mountpoints(hald_t)
files_getattr_all_mountpoints(hald_t)
@@ -128,10 +160,10 @@ term_dontaudit_use_unallocated_ttys(hald_t)
auth_use_nsswitch(hald_t)
init_domtrans_script(hald_t)
-init_write_initctl(hald_t)
init_read_utmp(hald_t)
#hal runs shutdown, probably need a shutdown domain
init_rw_utmp(hald_t)
+init_telinit(hald_t)
libs_use_ld_so(hald_t)
libs_use_shared_libs(hald_t)
@@ -160,6 +192,10 @@ ifdef(`targeted_policy',`
')
optional_policy(`
+ alsa_read_rw_config(hald_t)
+')
+
+optional_policy(`
bootloader_domtrans(hald_t)
')
@@ -245,3 +281,100 @@ optional_policy(`
optional_policy(`
vbetool_domtrans(hald_t)
')
+
+########################################
+#
+# Hal acl local policy
+#
+
+allow hald_acl_t self:capability { dac_override fowner };
+allow hald_acl_t self:fifo_file read_fifo_file_perms;
+
+domtrans_pattern(hald_t, hald_acl_exec_t, hald_acl_t)
+allow hald_t hald_acl_t:process signal;
+allow hald_acl_t hald_t:unix_stream_socket connectto;
+
+manage_dirs_pattern(hald_acl_t,hald_var_lib_t,hald_var_lib_t)
+manage_files_pattern(hald_acl_t,hald_var_lib_t,hald_var_lib_t)
+files_search_var_lib(hald_acl_t)
+
+corecmd_exec_bin(hald_acl_t)
+
+dev_getattr_all_chr_files(hald_acl_t)
+dev_setattr_video_dev(hald_acl_t)
+dev_setattr_sound_dev(hald_acl_t)
+dev_setattr_generic_usb_dev(hald_acl_t)
+dev_setattr_usbfs_files(hald_acl_t)
+
+files_read_usr_files(hald_acl_t)
+files_read_etc_files(hald_acl_t)
+
+storage_getattr_removable_dev(hald_acl_t)
+storage_setattr_removable_dev(hald_acl_t)
+
+auth_use_nsswitch(hald_acl_t)
+
+libs_use_ld_so(hald_acl_t)
+libs_use_shared_libs(hald_acl_t)
+
+miscfiles_read_localization(hald_acl_t)
+
+ifdef(`targeted_policy',`
+ term_dontaudit_use_console(hald_acl_t)
+ term_dontaudit_use_generic_ptys(hald_acl_t)
+')
+
+########################################
+#
+# Local hald mac policy
+#
+
+domtrans_pattern(hald_t, hald_mac_exec_t, hald_mac_t)
+allow hald_t hald_mac_t:process signal;
+allow hald_mac_t hald_t:unix_stream_socket connectto;
+
+manage_dirs_pattern(hald_mac_t,hald_var_lib_t,hald_var_lib_t)
+manage_files_pattern(hald_mac_t,hald_var_lib_t,hald_var_lib_t)
+files_search_var_lib(hald_mac_t)
+
+dev_write_raw_memory(hald_mac_t)
+
+files_read_usr_files(hald_mac_t)
+
+libs_use_ld_so(hald_mac_t)
+libs_use_shared_libs(hald_mac_t)
+
+miscfiles_read_localization(hald_mac_t)
+
+ifdef(`targeted_policy',`
+ term_dontaudit_use_console(hald_mac_t)
+ term_dontaudit_use_generic_ptys(hald_mac_t)
+')
+
+########################################
+#
+# Local hald sonypic policy
+#
+
+domtrans_pattern(hald_t, hald_sonypic_exec_t, hald_sonypic_t)
+allow hald_t hald_sonypic_t:process signal;
+allow hald_sonypic_t hald_t:unix_stream_socket connectto;
+
+dev_read_video_dev(hald_sonypic_t)
+dev_write_video_dev(hald_sonypic_t)
+
+manage_dirs_pattern(hald_sonypic_t,hald_var_lib_t,hald_var_lib_t)
+manage_files_pattern(hald_sonypic_t,hald_var_lib_t,hald_var_lib_t)
+files_search_var_lib(hald_sonypic_t)
+
+files_read_usr_files(hald_sonypic_t)
+
+libs_use_ld_so(hald_sonypic_t)
+libs_use_shared_libs(hald_sonypic_t)
+
+miscfiles_read_localization(hald_sonypic_t)
+
+ifdef(`targeted_policy',`
+ term_dontaudit_use_console(hald_sonypic_t)
+ term_dontaudit_use_generic_ptys(hald_sonypic_t)
+')
More information about the scm-commits
mailing list