policy/modules/apps/mozilla.te

   1 policy_module(mozilla, 2.3.0)
   2
   3 ########################################
   4 #
   5 # Declarations
   6 #
   7
   8 ## <desc>
   9 ## <p>
  10 ## allow confined web browsers to read home directory content
  11 ## </p>
  12 ## </desc>
  13 gen_tunable(mozilla_read_content, false)
  14
  15 type mozilla_t;
  16 type mozilla_exec_t;
  17 typealias mozilla_t alias { user_mozilla_t staff_mozilla_t sysadm_mozilla_t };
  18 typealias mozilla_t alias { auditadm_mozilla_t secadm_mozilla_t };
  19 application_domain(mozilla_t, mozilla_exec_t)
  20 ubac_constrained(mozilla_t)
  21
  22 type mozilla_conf_t;
  23 files_config_file(mozilla_conf_t)
  24
  25 type mozilla_home_t;
  26 typealias mozilla_home_t alias { user_mozilla_home_t staff_mozilla_home_t sysadm_mozilla_home_t };
  27 typealias mozilla_home_t alias { auditadm_mozilla_home_t secadm_mozilla_home_t };
  28 files_poly_member(mozilla_home_t)
  29 userdom_user_home_content(mozilla_home_t)
  30
  31 type mozilla_tmpfs_t;
  32 typealias mozilla_tmpfs_t alias { user_mozilla_tmpfs_t staff_mozilla_tmpfs_t sysadm_mozilla_tmpfs_t };
  33 typealias mozilla_tmpfs_t alias { auditadm_mozilla_tmpfs_t secadm_mozilla_tmpfs_t };
  34 files_tmpfs_file(mozilla_tmpfs_t)
  35 ubac_constrained(mozilla_tmpfs_t)
  36
  37 type mozilla_plugin_t;
  38 type mozilla_plugin_exec_t;
  39 application_domain(mozilla_plugin_t, mozilla_plugin_exec_t)
  40 role system_r types mozilla_plugin_t;
  41
  42 type mozilla_plugin_tmp_t;
  43 userdom_user_tmp_content(mozilla_plugin_tmp_t)
  44
  45 type mozilla_plugin_tmpfs_t;
  46 files_tmpfs_file(mozilla_plugin_tmpfs_t)
  47 ubac_constrained(mozilla_plugin_tmpfs_t)
  48
  49 ########################################
  50 #
  51 # Local policy
  52 #
  53
  54 allow mozilla_t self:capability { sys_nice setgid setuid };
  55 allow mozilla_t self:process { sigkill signal setsched getsched setrlimit };
  56 allow mozilla_t self:fifo_file rw_fifo_file_perms;
  57 allow mozilla_t self:shm { unix_read unix_write read write destroy create };
  58 allow mozilla_t self:sem create_sem_perms;
  59 allow mozilla_t self:socket create_socket_perms;
  60 allow mozilla_t self:unix_stream_socket { listen accept };
  61 # Browse the web, connect to printer
  62 allow mozilla_t self:tcp_socket create_socket_perms;
  63 allow mozilla_t self:netlink_route_socket r_netlink_socket_perms;
  64
  65 # for bash - old mozilla binary
  66 can_exec(mozilla_t, mozilla_exec_t)
  67
  68 # X access, Home files
  69 manage_dirs_pattern(mozilla_t, mozilla_home_t, mozilla_home_t)
  70 manage_files_pattern(mozilla_t, mozilla_home_t, mozilla_home_t)
  71 manage_lnk_files_pattern(mozilla_t, mozilla_home_t, mozilla_home_t)
  72 userdom_search_user_home_dirs(mozilla_t)
  73 userdom_user_home_dir_filetrans(mozilla_t, mozilla_home_t, dir)
  74
  75 # Mozpluggerrc
  76 allow mozilla_t mozilla_conf_t:file read_file_perms;
  77
  78 manage_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t)
  79 manage_lnk_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t)
  80 manage_fifo_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t)
  81 manage_sock_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t)
  82 fs_tmpfs_filetrans(mozilla_t, mozilla_tmpfs_t, { file lnk_file sock_file fifo_file })
  83
  84 kernel_read_kernel_sysctls(mozilla_t)
  85 kernel_read_network_state(mozilla_t)
  86 # Access /proc, sysctl
  87 kernel_read_system_state(mozilla_t)
  88 kernel_read_net_sysctls(mozilla_t)
  89
  90 # Look for plugins
  91 corecmd_list_bin(mozilla_t)
  92 # for bash - old mozilla binary
  93 corecmd_exec_shell(mozilla_t)
  94 corecmd_exec_bin(mozilla_t)
  95
  96 # Browse the web, connect to printer
  97 corenet_all_recvfrom_unlabeled(mozilla_t)
  98 corenet_all_recvfrom_netlabel(mozilla_t)
  99 corenet_tcp_sendrecv_generic_if(mozilla_t)
 100 corenet_raw_sendrecv_generic_if(mozilla_t)
 101 corenet_tcp_sendrecv_generic_node(mozilla_t)
 102 corenet_raw_sendrecv_generic_node(mozilla_t)
 103 corenet_tcp_sendrecv_http_port(mozilla_t)
 104 corenet_tcp_sendrecv_http_cache_port(mozilla_t)
 105 corenet_tcp_sendrecv_squid_port(mozilla_t)
 106 corenet_tcp_connect_flash_port(mozilla_t)
 107 corenet_tcp_sendrecv_ftp_port(mozilla_t)
 108 corenet_tcp_sendrecv_ipp_port(mozilla_t)
 109 corenet_tcp_connect_http_port(mozilla_t)
 110 corenet_tcp_connect_http_cache_port(mozilla_t)
 111 corenet_tcp_connect_squid_port(mozilla_t)
 112 corenet_tcp_connect_ftp_port(mozilla_t)
 113 corenet_tcp_connect_ipp_port(mozilla_t)
 114 corenet_tcp_connect_generic_port(mozilla_t)
 115 corenet_tcp_connect_soundd_port(mozilla_t)
 116 corenet_sendrecv_http_client_packets(mozilla_t)
 117 corenet_sendrecv_http_cache_client_packets(mozilla_t)
 118 corenet_sendrecv_squid_client_packets(mozilla_t)
 119 corenet_sendrecv_ftp_client_packets(mozilla_t)
 120 corenet_sendrecv_ipp_client_packets(mozilla_t)
 121 corenet_sendrecv_generic_client_packets(mozilla_t)
 122 # Should not need other ports
 123 corenet_dontaudit_tcp_sendrecv_generic_port(mozilla_t)
 124 corenet_dontaudit_tcp_bind_generic_port(mozilla_t)
 125 corenet_tcp_connect_speech_port(mozilla_t)
 126
 127 dev_read_urand(mozilla_t)
 128 dev_read_rand(mozilla_t)
 129 dev_write_sound(mozilla_t)
 130 dev_read_sound(mozilla_t)
 131 dev_dontaudit_rw_dri(mozilla_t)
 132 dev_getattr_sysfs_dirs(mozilla_t)
 133
 134 domain_dontaudit_read_all_domains_state(mozilla_t)
 135
 136 files_read_etc_runtime_files(mozilla_t)
 137 files_read_usr_files(mozilla_t)
 138 files_read_etc_files(mozilla_t)
 139 # /var/lib
 140 files_read_var_lib_files(mozilla_t)
 141 # interacting with gstreamer
 142 files_read_var_files(mozilla_t)
 143 files_read_var_symlinks(mozilla_t)
 144 files_dontaudit_getattr_boot_dirs(mozilla_t)
 145
 146 fs_search_auto_mountpoints(mozilla_t)
 147 fs_list_inotifyfs(mozilla_t)
 148 fs_rw_tmpfs_files(mozilla_t)
 149
 150 term_dontaudit_getattr_pty_dirs(mozilla_t)
 151
 152 logging_send_syslog_msg(mozilla_t)
 153
 154 miscfiles_read_fonts(mozilla_t)
 155 miscfiles_read_localization(mozilla_t)
 156 miscfiles_dontaudit_setattr_fonts_dirs(mozilla_t)
 157
 158 # Browse the web, connect to printer
 159 sysnet_dns_name_resolve(mozilla_t)
 160
 161 userdom_use_inherited_user_ptys(mozilla_t)
 162
 163 xserver_user_x_domain_template(mozilla, mozilla_t, mozilla_tmpfs_t)
 164 xserver_dontaudit_read_xdm_tmp_files(mozilla_t)
 165 xserver_dontaudit_getattr_xdm_tmp_sockets(mozilla_t)
 166
 167 tunable_policy(`allow_execmem',`
 168         allow mozilla_t self:process { execmem execstack };
 169 ')
 170
 171 tunable_policy(`use_nfs_home_dirs',`
 172         fs_manage_nfs_dirs(mozilla_t)
 173         fs_manage_nfs_files(mozilla_t)
 174         fs_manage_nfs_symlinks(mozilla_t)
 175 ')
 176
 177 tunable_policy(`use_samba_home_dirs',`
 178         fs_manage_cifs_dirs(mozilla_t)
 179         fs_manage_cifs_files(mozilla_t)
 180         fs_manage_cifs_symlinks(mozilla_t)
 181 ')
 182
 183 # Uploads, local html
 184 tunable_policy(`mozilla_read_content && use_nfs_home_dirs',`
 185         fs_list_auto_mountpoints(mozilla_t)
 186         files_list_home(mozilla_t)
 187         fs_read_nfs_files(mozilla_t)
 188         fs_read_nfs_symlinks(mozilla_t)
 189
 190 ',`
 191         files_dontaudit_list_home(mozilla_t)
 192         fs_dontaudit_list_auto_mountpoints(mozilla_t)
 193         fs_dontaudit_read_nfs_files(mozilla_t)
 194         fs_dontaudit_list_nfs(mozilla_t)
 195 ')
 196
 197 tunable_policy(`mozilla_read_content && use_samba_home_dirs',`
 198         fs_list_auto_mountpoints(mozilla_t)
 199         files_list_home(mozilla_t)
 200         fs_read_cifs_files(mozilla_t)
 201         fs_read_cifs_symlinks(mozilla_t)
 202 ',`
 203         files_dontaudit_list_home(mozilla_t)
 204         fs_dontaudit_list_auto_mountpoints(mozilla_t)
 205         fs_dontaudit_read_cifs_files(mozilla_t)
 206         fs_dontaudit_list_cifs(mozilla_t)
 207 ')
 208
 209 tunable_policy(`mozilla_read_content',`
 210         userdom_list_user_tmp(mozilla_t)
 211         userdom_read_user_tmp_files(mozilla_t)
 212         userdom_read_user_tmp_symlinks(mozilla_t)
 213         userdom_read_user_home_content_files(mozilla_t)
 214         userdom_read_user_home_content_symlinks(mozilla_t)
 215
 216         ifdef(`enable_mls',`',`
 217                 fs_search_removable(mozilla_t)
 218                 fs_read_removable_files(mozilla_t)
 219                 fs_read_removable_symlinks(mozilla_t)
 220         ')
 221 ',`
 222         files_dontaudit_list_tmp(mozilla_t)
 223         files_dontaudit_list_home(mozilla_t)
 224         fs_dontaudit_list_removable(mozilla_t)
 225         fs_dontaudit_read_removable_files(mozilla_t)
 226         userdom_dontaudit_list_user_tmp(mozilla_t)
 227         userdom_dontaudit_read_user_tmp_files(mozilla_t)
 228         userdom_dontaudit_list_user_home_dirs(mozilla_t)
 229         userdom_dontaudit_read_user_home_content_files(mozilla_t)
 230 ')
 231
 232 optional_policy(`
 233         apache_read_user_scripts(mozilla_t)
 234         apache_read_user_content(mozilla_t)
 235 ')
 236
 237 optional_policy(`
 238         automount_dontaudit_getattr_tmp_dirs(mozilla_t)
 239 ')
 240
 241 optional_policy(`
 242         cups_read_rw_config(mozilla_t)
 243         cups_dbus_chat(mozilla_t)
 244 ')
 245
 246 optional_policy(`
 247         dbus_system_bus_client(mozilla_t)
 248         dbus_session_bus_client(mozilla_t)
 249
 250         optional_policy(`
 251                 networkmanager_dbus_chat(mozilla_t)
 252         ')
 253 ')
 254
 255 optional_policy(`
 256         gnome_stream_connect_gconf(mozilla_t)
 257         gnome_manage_config(mozilla_t)
 258         gnome_manage_gconf_home_files(mozilla_t)
 259 ')
 260
 261 optional_policy(`
 262         java_domtrans(mozilla_t)
 263 ')
 264
 265 optional_policy(`
 266         lpd_domtrans_lpr(mozilla_t)
 267 ')
 268
 269 optional_policy(`
 270         mplayer_domtrans(mozilla_t)
 271         mplayer_read_user_home_files(mozilla_t)
 272 ')
 273
 274 optional_policy(`
 275         nscd_socket_use(mozilla_t)
 276 ')
 277
 278 optional_policy(`
 279         nsplugin_manage_rw(mozilla_t)
 280         nsplugin_manage_home_files(mozilla_t)
 281 ')
 282
 283 optional_policy(`
 284         pulseaudio_exec(mozilla_t)
 285         pulseaudio_stream_connect(mozilla_t)
 286         pulseaudio_manage_home_files(mozilla_t)
 287 ')
 288
 289 optional_policy(`
 290         thunderbird_domtrans(mozilla_t)
 291 ')
 292
 293 ########################################
 294 #
 295 # mozilla_plugin local policy
 296 #
 297
 298 dontaudit mozilla_plugin_t self:capability { sys_ptrace };
 299
 300 allow mozilla_plugin_t self:process { setsched signal_perms execmem };
 301 allow mozilla_plugin_t self:netlink_route_socket r_netlink_socket_perms;
 302 allow mozilla_plugin_t self:tcp_socket create_stream_socket_perms;
 303 allow mozilla_plugin_t self:udp_socket create_socket_perms;
 304 allow mozilla_plugin_t self:netlink_kobject_uevent_socket create_socket_perms;
 305
 306 allow mozilla_plugin_t self:sem create_sem_perms;
 307 allow mozilla_plugin_t self:shm create_shm_perms;
 308 allow mozilla_plugin_t self:fifo_file manage_fifo_file_perms;
 309 allow mozilla_plugin_t self:unix_stream_socket { connectto create_stream_socket_perms };
 310
 311 can_exec(mozilla_plugin_t, mozilla_home_t)
 312 read_files_pattern(mozilla_plugin_t, mozilla_home_t, mozilla_home_t)
 313
 314 manage_dirs_pattern(mozilla_plugin_t, mozilla_plugin_tmp_t, mozilla_plugin_tmp_t)
 315 manage_files_pattern(mozilla_plugin_t, mozilla_plugin_tmp_t, mozilla_plugin_tmp_t)
 316 manage_fifo_files_pattern(mozilla_plugin_t, mozilla_plugin_tmp_t, mozilla_plugin_tmp_t)
 317 files_tmp_filetrans(mozilla_plugin_t, mozilla_plugin_tmp_t, { dir file fifo_file })
 318 userdom_user_tmp_filetrans(mozilla_plugin_t, mozilla_plugin_tmp_t, { dir file fifo_file })
 319 can_exec(mozilla_plugin_t, mozilla_plugin_tmp_t)
 320
 321 manage_files_pattern(mozilla_plugin_t, mozilla_plugin_tmpfs_t, mozilla_plugin_tmpfs_t)
 322 manage_lnk_files_pattern(mozilla_plugin_t, mozilla_plugin_tmpfs_t, mozilla_plugin_tmpfs_t)
 323 manage_fifo_files_pattern(mozilla_plugin_t, mozilla_plugin_tmpfs_t, mozilla_plugin_tmpfs_t)
 324 manage_sock_files_pattern(mozilla_plugin_t, mozilla_plugin_tmpfs_t, mozilla_plugin_tmpfs_t)
 325 fs_tmpfs_filetrans(mozilla_plugin_t, mozilla_plugin_tmpfs_t, { file lnk_file sock_file fifo_file })
 326
 327 can_exec(mozilla_plugin_t, mozilla_exec_t)
 328
 329 kernel_read_kernel_sysctls(mozilla_plugin_t)
 330 kernel_read_system_state(mozilla_plugin_t)
 331 kernel_read_network_state(mozilla_plugin_t)
 332 kernel_request_load_module(mozilla_plugin_t)
 333
 334 corecmd_exec_bin(mozilla_plugin_t)
 335 corecmd_exec_shell(mozilla_plugin_t)
 336
 337 corenet_tcp_connect_generic_port(mozilla_plugin_t)
 338 corenet_tcp_connect_flash_port(mozilla_plugin_t)
 339 corenet_tcp_connect_streaming_port(mozilla_plugin_t)
 340 corenet_tcp_connect_pulseaudio_port(mozilla_plugin_t)
 341 corenet_tcp_connect_http_port(mozilla_plugin_t)
 342 corenet_tcp_connect_http_cache_port(mozilla_plugin_t)
 343 corenet_tcp_connect_squid_port(mozilla_plugin_t)
 344 corenet_tcp_connect_ipp_port(mozilla_plugin_t)
 345 corenet_tcp_connect_mmcc_port(mozilla_plugin_t)
 346 corenet_tcp_connect_speech_port(mozilla_plugin_t)
 347 corenet_tcp_connect_streaming_port(mozilla_plugin_t)
 348 corenet_tcp_bind_generic_node(mozilla_plugin_t)
 349 corenet_udp_bind_generic_node(mozilla_plugin_t)
 350
 351 dev_read_rand(mozilla_plugin_t)
 352 dev_read_urand(mozilla_plugin_t)
 353 dev_read_video_dev(mozilla_plugin_t)
 354 dev_write_video_dev(mozilla_plugin_t)
 355 dev_read_sysfs(mozilla_plugin_t)
 356 dev_read_sound(mozilla_plugin_t)
 357 dev_write_sound(mozilla_plugin_t)
 358 # for nvidia driver
 359 dev_rw_xserver_misc(mozilla_plugin_t)
 360 dev_dontaudit_rw_dri(mozilla_plugin_t)
 361
 362 domain_use_interactive_fds(mozilla_plugin_t)
 363 domain_dontaudit_read_all_domains_state(mozilla_plugin_t)
 364
 365 files_read_config_files(mozilla_plugin_t)
 366 files_read_usr_files(mozilla_plugin_t)
 367 files_list_mnt(mozilla_plugin_t)
 368
 369 fs_getattr_all_fs(mozilla_plugin_t)
 370 fs_list_dos_dirs(mozilla_plugin_t)
 371 fs_read_dos_files(mozilla_plugin_t)
 372
 373 application_dontaudit_signull(mozilla_plugin_t)
 374
 375 auth_use_nsswitch(mozilla_plugin_t)
 376
 377 logging_send_syslog_msg(mozilla_plugin_t)
 378
 379 miscfiles_read_localization(mozilla_plugin_t)
 380 miscfiles_read_fonts(mozilla_plugin_t)
 381 miscfiles_read_generic_certs(mozilla_plugin_t)
 382 miscfiles_dontaudit_setattr_fonts_dirs(mozilla_plugin_t)
 383 miscfiles_dontaudit_setattr_fonts_cache_dirs(mozilla_plugin_t)
 384
 385 sysnet_dns_name_resolve(mozilla_plugin_t)
 386
 387 term_getattr_all_ttys(mozilla_plugin_t)
 388 term_getattr_all_ptys(mozilla_plugin_t)
 389
 390 userdom_rw_user_tmpfs_files(mozilla_plugin_t)
 391 userdom_delete_user_tmpfs_files(mozilla_plugin_t)
 392 userdom_stream_connect(mozilla_plugin_t)
 393 userdom_dontaudit_use_user_ptys(mozilla_plugin_t)
 394 userdom_dontaudit_use_user_terminals(mozilla_plugin_t)
 395 userdom_manage_user_tmp_sockets(mozilla_plugin_t)
 396 userdom_dontaudit_rw_user_tmp_pipes(mozilla_plugin_t)
 397
 398 userdom_list_user_tmp(mozilla_plugin_t)
 399 userdom_manage_user_tmp_dirs(mozilla_plugin_t)
 400 userdom_read_user_tmp_files(mozilla_plugin_t)
 401 userdom_read_user_tmp_symlinks(mozilla_plugin_t)
 402 userdom_read_user_home_content_files(mozilla_plugin_t)
 403 userdom_read_user_home_content_files(mozilla_plugin_t)
 404 userdom_read_user_home_content_symlinks(mozilla_plugin_t)
 405 userdom_read_home_certs(mozilla_plugin_t)
 406 userdom_dontaudit_write_home_certs(mozilla_plugin_t)
 407
 408 tunable_policy(`allow_execmem',`
 409         allow mozilla_plugin_t self:process { execmem execstack };
 410 ')
 411
 412 tunable_policy(`allow_execstack',`
 413         allow mozilla_plugin_t self:process { execstack };
 414 ')
 415
 416 optional_policy(`
 417         alsa_read_rw_config(mozilla_plugin_t)
 418         alsa_read_home_files(mozilla_plugin_t)
 419 ')
 420
 421 optional_policy(`
 422         dbus_system_bus_client(mozilla_plugin_t)
 423         dbus_session_bus_client(mozilla_plugin_t)
 424         dbus_read_lib_files(mozilla_plugin_t)
 425 ')
 426
 427 optional_policy(`
 428         git_dontaudit_read_session_content_files(mozilla_plugin_t)
 429 ')
 430
 431 optional_policy(`
 432         gnome_manage_config(mozilla_plugin_t)
 433         gnome_setattr_home_config(mozilla_plugin_t)
 434 ')
 435
 436 optional_policy(`
 437         java_exec(mozilla_plugin_t)
 438 ')
 439
 440 optional_policy(`
 441         mplayer_exec(mozilla_plugin_t)
 442         mplayer_read_user_home_files(mozilla_plugin_t)
 443 ')
 444
 445 optional_policy(`
 446         nsplugin_domtrans(mozilla_plugin_t)
 447         nsplugin_rw_exec(mozilla_plugin_t)
 448         nsplugin_manage_home_dirs(mozilla_plugin_t)
 449         nsplugin_manage_home_files(mozilla_plugin_t)
 450         nsplugin_user_home_dir_filetrans(mozilla_plugin_t, dir)
 451         nsplugin_user_home_filetrans(mozilla_plugin_t, file)
 452         nsplugin_read_rw_files(mozilla_plugin_t);
 453         nsplugin_signal(mozilla_plugin_t)
 454 ')
 455
 456 optional_policy(`
 457         pulseaudio_exec(mozilla_plugin_t)
 458         pulseaudio_stream_connect(mozilla_plugin_t)
 459         pulseaudio_setattr_home_dir(mozilla_plugin_t)
 460         pulseaudio_manage_home_files(mozilla_plugin_t)
 461 ')
 462
 463 optional_policy(`
 464         pcscd_stream_connect(mozilla_plugin_t)
 465 ')
 466
 467 optional_policy(`
 468         xserver_read_xdm_pid(mozilla_plugin_t)
 469         xserver_stream_connect(mozilla_plugin_t)
 470         xserver_use_user_fonts(mozilla_plugin_t)
 471         xserver_read_user_iceauth(mozilla_plugin_t)
 472         xserver_read_user_xauth(mozilla_plugin_t)
 473         xserver_append_xdm_home_files(mozilla_plugin_t);
 474 ')
 475
 476 tunable_policy(`use_nfs_home_dirs',`
 477         fs_manage_nfs_dirs(mozilla_plugin_t)
 478         fs_manage_nfs_files(mozilla_plugin_t)
 479         fs_manage_nfs_symlinks(mozilla_plugin_t)
 480 ')
 481
 482 tunable_policy(`use_samba_home_dirs',`
 483         fs_manage_cifs_dirs(mozilla_plugin_t)
 484         fs_manage_cifs_files(mozilla_plugin_t)
 485         fs_manage_cifs_symlinks(mozilla_plugin_t)
 486 ')