policy/modules/apps/mozilla.te

   1 policy_module(mozilla, 2.3.0)
   2
   3 ########################################
   4 #
   5 # Declarations
   6 #
   7
   8 ## <desc>
   9 ## <p>
  10 ## allow confined web browsers to read home directory content
  11 ## </p>
  12 ## </desc>
  13 gen_tunable(mozilla_read_content, false)
  14
  15 type mozilla_t;
  16 type mozilla_exec_t;
  17 typealias mozilla_t alias { user_mozilla_t staff_mozilla_t sysadm_mozilla_t };
  18 typealias mozilla_t alias { auditadm_mozilla_t secadm_mozilla_t };
  19 application_domain(mozilla_t, mozilla_exec_t)
  20 ubac_constrained(mozilla_t)
  21
  22 type mozilla_conf_t;
  23 files_config_file(mozilla_conf_t)
  24
  25 type mozilla_home_t;
  26 typealias mozilla_home_t alias { user_mozilla_home_t staff_mozilla_home_t sysadm_mozilla_home_t };
  27 typealias mozilla_home_t alias { auditadm_mozilla_home_t secadm_mozilla_home_t };
  28 files_poly_member(mozilla_home_t)
  29 userdom_user_home_content(mozilla_home_t)
  30
  31 type mozilla_tmpfs_t;
  32 typealias mozilla_tmpfs_t alias { user_mozilla_tmpfs_t staff_mozilla_tmpfs_t sysadm_mozilla_tmpfs_t };
  33 typealias mozilla_tmpfs_t alias { auditadm_mozilla_tmpfs_t secadm_mozilla_tmpfs_t };
  34 files_tmpfs_file(mozilla_tmpfs_t)
  35 ubac_constrained(mozilla_tmpfs_t)
  36
  37 type mozilla_plugin_t;
  38 type mozilla_plugin_exec_t;
  39 application_domain(mozilla_plugin_t, mozilla_plugin_exec_t)
  40 role system_r types mozilla_plugin_t;
  41
  42 type mozilla_plugin_tmp_t;
  43 files_tmp_file(mozilla_plugin_tmp_t)
  44
  45 type mozilla_plugin_tmpfs_t;
  46 files_tmpfs_file(mozilla_plugin_tmpfs_t)
  47 ubac_constrained(mozilla_plugin_tmpfs_t)
  48
  49 permissive mozilla_plugin_t;
  50
  51 ########################################
  52 #
  53 # Local policy
  54 #
  55
  56 allow mozilla_t self:capability { sys_nice setgid setuid };
  57 allow mozilla_t self:process { sigkill signal setsched getsched setrlimit };
  58 allow mozilla_t self:fifo_file rw_fifo_file_perms;
  59 allow mozilla_t self:shm { unix_read unix_write read write destroy create };
  60 allow mozilla_t self:sem create_sem_perms;
  61 allow mozilla_t self:socket create_socket_perms;
  62 allow mozilla_t self:unix_stream_socket { listen accept };
  63 # Browse the web, connect to printer
  64 allow mozilla_t self:tcp_socket create_socket_perms;
  65 allow mozilla_t self:netlink_route_socket r_netlink_socket_perms;
  66
  67 # for bash - old mozilla binary
  68 can_exec(mozilla_t, mozilla_exec_t)
  69
  70 # X access, Home files
  71 manage_dirs_pattern(mozilla_t, mozilla_home_t, mozilla_home_t)
  72 manage_files_pattern(mozilla_t, mozilla_home_t, mozilla_home_t)
  73 manage_lnk_files_pattern(mozilla_t, mozilla_home_t, mozilla_home_t)
  74 userdom_search_user_home_dirs(mozilla_t)
  75 userdom_user_home_dir_filetrans(mozilla_t, mozilla_home_t, dir)
  76
  77 # Mozpluggerrc
  78 allow mozilla_t mozilla_conf_t:file read_file_perms;
  79
  80 manage_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t)
  81 manage_lnk_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t)
  82 manage_fifo_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t)
  83 manage_sock_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t)
  84 fs_tmpfs_filetrans(mozilla_t, mozilla_tmpfs_t, { file lnk_file sock_file fifo_file })
  85
  86 kernel_read_kernel_sysctls(mozilla_t)
  87 kernel_read_network_state(mozilla_t)
  88 # Access /proc, sysctl
  89 kernel_read_system_state(mozilla_t)
  90 kernel_read_net_sysctls(mozilla_t)
  91
  92 # Look for plugins
  93 corecmd_list_bin(mozilla_t)
  94 # for bash - old mozilla binary
  95 corecmd_exec_shell(mozilla_t)
  96 corecmd_exec_bin(mozilla_t)
  97
  98 # Browse the web, connect to printer
  99 corenet_all_recvfrom_unlabeled(mozilla_t)
 100 corenet_all_recvfrom_netlabel(mozilla_t)
 101 corenet_tcp_sendrecv_generic_if(mozilla_t)
 102 corenet_raw_sendrecv_generic_if(mozilla_t)
 103 corenet_tcp_sendrecv_generic_node(mozilla_t)
 104 corenet_raw_sendrecv_generic_node(mozilla_t)
 105 corenet_tcp_sendrecv_http_port(mozilla_t)
 106 corenet_tcp_sendrecv_http_cache_port(mozilla_t)
 107 corenet_tcp_sendrecv_squid_port(mozilla_t)
 108 corenet_tcp_connect_flash_port(mozilla_t)
 109 corenet_tcp_sendrecv_ftp_port(mozilla_t)
 110 corenet_tcp_sendrecv_ipp_port(mozilla_t)
 111 corenet_tcp_connect_http_port(mozilla_t)
 112 corenet_tcp_connect_http_cache_port(mozilla_t)
 113 corenet_tcp_connect_squid_port(mozilla_t)
 114 corenet_tcp_connect_ftp_port(mozilla_t)
 115 corenet_tcp_connect_ipp_port(mozilla_t)
 116 corenet_tcp_connect_generic_port(mozilla_t)
 117 corenet_tcp_connect_soundd_port(mozilla_t)
 118 corenet_sendrecv_http_client_packets(mozilla_t)
 119 corenet_sendrecv_http_cache_client_packets(mozilla_t)
 120 corenet_sendrecv_squid_client_packets(mozilla_t)
 121 corenet_sendrecv_ftp_client_packets(mozilla_t)
 122 corenet_sendrecv_ipp_client_packets(mozilla_t)
 123 corenet_sendrecv_generic_client_packets(mozilla_t)
 124 # Should not need other ports
 125 corenet_dontaudit_tcp_sendrecv_generic_port(mozilla_t)
 126 corenet_dontaudit_tcp_bind_generic_port(mozilla_t)
 127 corenet_tcp_connect_speech_port(mozilla_t)
 128
 129 dev_read_urand(mozilla_t)
 130 dev_read_rand(mozilla_t)
 131 dev_write_sound(mozilla_t)
 132 dev_read_sound(mozilla_t)
 133 dev_dontaudit_rw_dri(mozilla_t)
 134 dev_getattr_sysfs_dirs(mozilla_t)
 135
 136 domain_dontaudit_read_all_domains_state(mozilla_t)
 137
 138 files_read_etc_runtime_files(mozilla_t)
 139 files_read_usr_files(mozilla_t)
 140 files_read_etc_files(mozilla_t)
 141 # /var/lib
 142 files_read_var_lib_files(mozilla_t)
 143 # interacting with gstreamer
 144 files_read_var_files(mozilla_t)
 145 files_read_var_symlinks(mozilla_t)
 146 files_dontaudit_getattr_boot_dirs(mozilla_t)
 147
 148 fs_search_auto_mountpoints(mozilla_t)
 149 fs_list_inotifyfs(mozilla_t)
 150 fs_rw_tmpfs_files(mozilla_t)
 151
 152 term_dontaudit_getattr_pty_dirs(mozilla_t)
 153
 154 logging_send_syslog_msg(mozilla_t)
 155
 156 miscfiles_read_fonts(mozilla_t)
 157 miscfiles_read_localization(mozilla_t)
 158 miscfiles_dontaudit_setattr_fonts_dirs(mozilla_t)
 159
 160 # Browse the web, connect to printer
 161 sysnet_dns_name_resolve(mozilla_t)
 162
 163 userdom_use_user_ptys(mozilla_t)
 164
 165 xserver_user_x_domain_template(mozilla, mozilla_t, mozilla_tmpfs_t)
 166 xserver_dontaudit_read_xdm_tmp_files(mozilla_t)
 167 xserver_dontaudit_getattr_xdm_tmp_sockets(mozilla_t)
 168
 169 tunable_policy(`allow_execmem',`
 170         allow mozilla_t self:process { execmem execstack };
 171 ')
 172
 173 tunable_policy(`use_nfs_home_dirs',`
 174         fs_manage_nfs_dirs(mozilla_t)
 175         fs_manage_nfs_files(mozilla_t)
 176         fs_manage_nfs_symlinks(mozilla_t)
 177 ')
 178
 179 tunable_policy(`use_samba_home_dirs',`
 180         fs_manage_cifs_dirs(mozilla_t)
 181         fs_manage_cifs_files(mozilla_t)
 182         fs_manage_cifs_symlinks(mozilla_t)
 183 ')
 184
 185 # Uploads, local html
 186 tunable_policy(`mozilla_read_content && use_nfs_home_dirs',`
 187         fs_list_auto_mountpoints(mozilla_t)
 188         files_list_home(mozilla_t)
 189         fs_read_nfs_files(mozilla_t)
 190         fs_read_nfs_symlinks(mozilla_t)
 191
 192 ',`
 193         files_dontaudit_list_home(mozilla_t)
 194         fs_dontaudit_list_auto_mountpoints(mozilla_t)
 195         fs_dontaudit_read_nfs_files(mozilla_t)
 196         fs_dontaudit_list_nfs(mozilla_t)
 197 ')
 198
 199 tunable_policy(`mozilla_read_content && use_samba_home_dirs',`
 200         fs_list_auto_mountpoints(mozilla_t)
 201         files_list_home(mozilla_t)
 202         fs_read_cifs_files(mozilla_t)
 203         fs_read_cifs_symlinks(mozilla_t)
 204 ',`
 205         files_dontaudit_list_home(mozilla_t)
 206         fs_dontaudit_list_auto_mountpoints(mozilla_t)
 207         fs_dontaudit_read_cifs_files(mozilla_t)
 208         fs_dontaudit_list_cifs(mozilla_t)
 209 ')
 210
 211 tunable_policy(`mozilla_read_content',`
 212         userdom_list_user_tmp(mozilla_t)
 213         userdom_read_user_tmp_files(mozilla_t)
 214         userdom_read_user_tmp_symlinks(mozilla_t)
 215         userdom_read_user_home_content_files(mozilla_t)
 216         userdom_read_user_home_content_symlinks(mozilla_t)
 217
 218         ifdef(`enable_mls',`',`
 219                 fs_search_removable(mozilla_t)
 220                 fs_read_removable_files(mozilla_t)
 221                 fs_read_removable_symlinks(mozilla_t)
 222         ')
 223 ',`
 224         files_dontaudit_list_tmp(mozilla_t)
 225         files_dontaudit_list_home(mozilla_t)
 226         fs_dontaudit_list_removable(mozilla_t)
 227         fs_dontaudit_read_removable_files(mozilla_t)
 228         userdom_dontaudit_list_user_tmp(mozilla_t)
 229         userdom_dontaudit_read_user_tmp_files(mozilla_t)
 230         userdom_dontaudit_list_user_home_dirs(mozilla_t)
 231         userdom_dontaudit_read_user_home_content_files(mozilla_t)
 232 ')
 233
 234 optional_policy(`
 235         apache_read_user_scripts(mozilla_t)
 236         apache_read_user_content(mozilla_t)
 237 ')
 238
 239 optional_policy(`
 240         automount_dontaudit_getattr_tmp_dirs(mozilla_t)
 241 ')
 242
 243 optional_policy(`
 244         cups_read_rw_config(mozilla_t)
 245         cups_dbus_chat(mozilla_t)
 246 ')
 247
 248 optional_policy(`
 249         dbus_system_bus_client(mozilla_t)
 250         dbus_session_bus_client(mozilla_t)
 251
 252         optional_policy(`
 253                 networkmanager_dbus_chat(mozilla_t)
 254         ')
 255 ')
 256
 257 optional_policy(`
 258         gnome_stream_connect_gconf(mozilla_t)
 259         gnome_manage_config(mozilla_t)
 260         gnome_manage_gconf_home_files(mozilla_t)
 261 ')
 262
 263 optional_policy(`
 264         java_domtrans(mozilla_t)
 265 ')
 266
 267 optional_policy(`
 268         lpd_domtrans_lpr(mozilla_t)
 269 ')
 270
 271 optional_policy(`
 272         mplayer_domtrans(mozilla_t)
 273         mplayer_read_user_home_files(mozilla_t)
 274 ')
 275
 276 optional_policy(`
 277         nscd_socket_use(mozilla_t)
 278 ')
 279
 280 optional_policy(`
 281         nsplugin_manage_rw(mozilla_t)
 282         nsplugin_manage_home_files(mozilla_t)
 283 ')
 284
 285 optional_policy(`
 286         pulseaudio_exec(mozilla_t)
 287         pulseaudio_stream_connect(mozilla_t)
 288         pulseaudio_manage_home_files(mozilla_t)
 289 ')
 290
 291 optional_policy(`
 292         thunderbird_domtrans(mozilla_t)
 293 ')
 294
 295 ########################################
 296 #
 297 # mozilla_plugin local policy
 298 #
 299
 300 dontaudit mozilla_plugin_t self:capability { sys_ptrace };
 301
 302 allow mozilla_plugin_t self:process { setsched signal_perms execmem };
 303 allow mozilla_plugin_t self:netlink_route_socket r_netlink_socket_perms;
 304 allow mozilla_plugin_t self:tcp_socket create_stream_socket_perms;
 305 allow mozilla_plugin_t self:udp_socket create_socket_perms;
 306 allow mozilla_plugin_t self:netlink_kobject_uevent_socket create_socket_perms;
 307
 308 allow mozilla_plugin_t self:sem create_sem_perms;
 309 allow mozilla_plugin_t self:shm create_shm_perms;
 310 allow mozilla_plugin_t self:fifo_file manage_fifo_file_perms;
 311 allow mozilla_plugin_t self:unix_stream_socket { connectto create_stream_socket_perms };
 312
 313 can_exec(mozilla_plugin_t, mozilla_home_t)
 314 read_files_pattern(mozilla_plugin_t, mozilla_home_t, mozilla_home_t)
 315
 316 manage_dirs_pattern(mozilla_plugin_t, mozilla_plugin_tmp_t, mozilla_plugin_tmp_t)
 317 manage_files_pattern(mozilla_plugin_t, mozilla_plugin_tmp_t, mozilla_plugin_tmp_t)
 318 manage_fifo_files_pattern(mozilla_plugin_t, mozilla_plugin_tmp_t, mozilla_plugin_tmp_t)
 319 files_tmp_filetrans(mozilla_plugin_t, mozilla_plugin_tmp_t, { dir file fifo_file })
 320 can_exec(mozilla_plugin_t, mozilla_plugin_tmp_t)
 321
 322 manage_files_pattern(mozilla_plugin_t, mozilla_plugin_tmpfs_t, mozilla_plugin_tmpfs_t)
 323 manage_lnk_files_pattern(mozilla_plugin_t, mozilla_plugin_tmpfs_t, mozilla_plugin_tmpfs_t)
 324 manage_fifo_files_pattern(mozilla_plugin_t, mozilla_plugin_tmpfs_t, mozilla_plugin_tmpfs_t)
 325 manage_sock_files_pattern(mozilla_plugin_t, mozilla_plugin_tmpfs_t, mozilla_plugin_tmpfs_t)
 326 fs_tmpfs_filetrans(mozilla_plugin_t, mozilla_plugin_tmpfs_t, { file lnk_file sock_file fifo_file })
 327
 328 can_exec(mozilla_plugin_t, mozilla_exec_t)
 329
 330 kernel_read_kernel_sysctls(mozilla_plugin_t)
 331 kernel_read_system_state(mozilla_plugin_t)
 332 kernel_request_load_module(mozilla_plugin_t)
 333
 334 corecmd_exec_bin(mozilla_plugin_t)
 335 corecmd_exec_shell(mozilla_plugin_t)
 336
 337 corenet_tcp_connect_generic_port(mozilla_plugin_t)
 338 corenet_tcp_connect_flash_port(mozilla_plugin_t)
 339 corenet_tcp_connect_streaming_port(mozilla_plugin_t)
 340 corenet_tcp_connect_pulseaudio_port(mozilla_plugin_t)
 341 corenet_tcp_connect_http_port(mozilla_plugin_t)
 342 corenet_tcp_connect_http_cache_port(mozilla_plugin_t)
 343 corenet_tcp_connect_squid_port(mozilla_plugin_t)
 344 corenet_tcp_connect_ipp_port(mozilla_plugin_t)
 345 corenet_tcp_connect_speech_port(mozilla_plugin_t)
 346 corenet_tcp_connect_streaming_port(mozilla_plugin_t)
 347 corenet_tcp_bind_generic_node(mozilla_plugin_t)
 348 corenet_udp_bind_generic_node(mozilla_plugin_t)
 349
 350 dev_read_rand(mozilla_plugin_t)
 351 dev_read_urand(mozilla_plugin_t)
 352 dev_read_video_dev(mozilla_plugin_t)
 353 dev_write_video_dev(mozilla_plugin_t)
 354 dev_read_sysfs(mozilla_plugin_t)
 355 dev_read_sound(mozilla_plugin_t)
 356 dev_write_sound(mozilla_plugin_t)
 357 dev_dontaudit_rw_dri(mozilla_plugin_t)
 358
 359 domain_use_interactive_fds(mozilla_plugin_t)
 360 domain_dontaudit_read_all_domains_state(mozilla_plugin_t)
 361
 362 files_read_config_files(mozilla_plugin_t)
 363 files_read_usr_files(mozilla_plugin_t)
 364 files_list_mnt(mozilla_plugin_t)
 365
 366 fs_getattr_all_fs(mozilla_plugin_t)
 367 fs_list_dos_dirs(mozilla_plugin_t)
 368 fs_read_dos_files(mozilla_plugin_t)
 369
 370 application_dontaudit_signull(mozilla_plugin_t)
 371
 372 logging_send_syslog_msg(mozilla_plugin_t)
 373
 374 miscfiles_read_localization(mozilla_plugin_t)
 375 miscfiles_read_fonts(mozilla_plugin_t)
 376 miscfiles_read_certs(mozilla_plugin_t)
 377 miscfiles_dontaudit_setattr_fonts_dirs(mozilla_plugin_t)
 378
 379 sysnet_dns_name_resolve(mozilla_plugin_t)
 380
 381 term_getattr_all_ttys(mozilla_plugin_t)
 382 term_getattr_all_ptys(mozilla_plugin_t)
 383
 384 userdom_rw_user_tmpfs_files(mozilla_plugin_t)
 385 userdom_delete_user_tmpfs_files(mozilla_plugin_t)
 386 userdom_stream_connect(mozilla_plugin_t)
 387 userdom_dontaudit_use_user_ptys(mozilla_plugin_t)
 388 userdom_dontaudit_use_user_terminals(mozilla_plugin_t)
 389 userdom_manage_user_tmp_sockets(mozilla_plugin_t)
 390
 391 userdom_list_user_tmp(mozilla_plugin_t)
 392 userdom_manage_user_tmp_dirs(mozilla_plugin_t)
 393 userdom_read_user_tmp_files(mozilla_plugin_t)
 394 userdom_read_user_tmp_symlinks(mozilla_plugin_t)
 395 userdom_read_user_home_content_files(mozilla_plugin_t)
 396 userdom_read_user_home_content_files(mozilla_plugin_t)
 397 userdom_read_user_home_content_symlinks(mozilla_plugin_t)
 398 userdom_read_home_certs(mozilla_plugin_t)
 399 userdom_dontaudit_write_home_certs(mozilla_plugin_t)
 400
 401 optional_policy(`
 402         alsa_read_rw_config(mozilla_plugin_t)
 403         alsa_read_home_files(mozilla_plugin_t)
 404 ')
 405
 406 optional_policy(`
 407         dbus_system_bus_client(mozilla_plugin_t)
 408         dbus_session_bus_client(mozilla_plugin_t)
 409         dbus_read_lib_files(mozilla_plugin_t)
 410 ')
 411
 412 optional_policy(`
 413         git_dontaudit_read_session_content_files(mozilla_plugin_t)
 414 ')
 415
 416 optional_policy(`
 417         gnome_manage_config(mozilla_plugin_t)
 418         gnome_setattr_home_config(mozilla_plugin_t)
 419 ')
 420
 421 optional_policy(`
 422         java_exec(mozilla_plugin_t)
 423 ')
 424
 425 optional_policy(`
 426         mplayer_exec(mozilla_plugin_t)
 427         mplayer_read_user_home_files(mozilla_plugin_t)
 428 ')
 429
 430 optional_policy(`
 431         nsplugin_domtrans(mozilla_plugin_t)
 432         nsplugin_rw_exec(mozilla_plugin_t)
 433         nsplugin_manage_home_dirs(mozilla_plugin_t)
 434         nsplugin_manage_home_files(mozilla_plugin_t)
 435         nsplugin_user_home_dir_filetrans(mozilla_plugin_t, dir)
 436         nsplugin_user_home_filetrans(mozilla_plugin_t, file)
 437         nsplugin_signal(mozilla_plugin_t)
 438 ')
 439
 440 optional_policy(`
 441         pulseaudio_exec(mozilla_plugin_t)
 442         pulseaudio_stream_connect(mozilla_plugin_t)
 443         pulseaudio_setattr_home_dir(mozilla_plugin_t)
 444         pulseaudio_manage_home_files(mozilla_plugin_t)
 445 ')
 446
 447 optional_policy(`
 448         xserver_read_xdm_pid(mozilla_plugin_t)
 449         xserver_stream_connect(mozilla_plugin_t)
 450         xserver_use_user_fonts(mozilla_plugin_t)
 451         xserver_read_user_iceauth(mozilla_plugin_t)
 452         xserver_read_user_xauth(mozilla_plugin_t)
 453 ')
 454
 455 tunable_policy(`use_nfs_home_dirs',`
 456         fs_manage_nfs_dirs(mozilla_plugin_t)
 457         fs_manage_nfs_files(mozilla_plugin_t)
 458         fs_manage_nfs_symlinks(mozilla_plugin_t)
 459 ')
 460
 461 tunable_policy(`use_samba_home_dirs',`
 462         fs_manage_cifs_dirs(mozilla_plugin_t)
 463         fs_manage_cifs_files(mozilla_plugin_t)
 464         fs_manage_cifs_symlinks(mozilla_plugin_t)
 465 ')