policy/modules/apps/mozilla.te

   1
   2 policy_module(mozilla, 2.2.0)
   3
   4 ########################################
   5 #
   6 # Declarations
   7 #
   8
   9 ## <desc>
  10 ## <p>
  11 ## Control mozilla content access
  12 ## </p>
  13 ## </desc>
  14 gen_tunable(mozilla_read_content, false)
  15
  16 type mozilla_t;
  17 type mozilla_exec_t;
  18 typealias mozilla_t alias { user_mozilla_t staff_mozilla_t sysadm_mozilla_t };
  19 typealias mozilla_t alias { auditadm_mozilla_t secadm_mozilla_t };
  20 application_domain(mozilla_t, mozilla_exec_t)
  21 ubac_constrained(mozilla_t)
  22
  23 type mozilla_conf_t;
  24 files_config_file(mozilla_conf_t)
  25
  26 type mozilla_home_t;
  27 typealias mozilla_home_t alias { user_mozilla_home_t staff_mozilla_home_t sysadm_mozilla_home_t };
  28 typealias mozilla_home_t alias { auditadm_mozilla_home_t secadm_mozilla_home_t };
  29 files_poly_member(mozilla_home_t)
  30 userdom_user_home_content(mozilla_home_t)
  31
  32 type mozilla_tmpfs_t;
  33 typealias mozilla_tmpfs_t alias { user_mozilla_tmpfs_t staff_mozilla_tmpfs_t sysadm_mozilla_tmpfs_t };
  34 typealias mozilla_tmpfs_t alias { auditadm_mozilla_tmpfs_t secadm_mozilla_tmpfs_t };
  35 files_tmpfs_file(mozilla_tmpfs_t)
  36 ubac_constrained(mozilla_tmpfs_t)
  37
  38 ########################################
  39 #
  40 # Local policy
  41 #
  42
  43 allow mozilla_t self:capability { sys_nice setgid setuid };
  44 allow mozilla_t self:process { sigkill signal setsched getsched setrlimit };
  45 allow mozilla_t self:fifo_file rw_fifo_file_perms;
  46 allow mozilla_t self:shm { unix_read unix_write read write destroy create };
  47 allow mozilla_t self:sem create_sem_perms;
  48 allow mozilla_t self:socket create_socket_perms;
  49 allow mozilla_t self:unix_stream_socket { listen accept };
  50 # Browse the web, connect to printer
  51 allow mozilla_t self:tcp_socket create_socket_perms;
  52 allow mozilla_t self:netlink_route_socket r_netlink_socket_perms;
  53
  54 # for bash - old mozilla binary
  55 can_exec(mozilla_t, mozilla_exec_t)
  56
  57 # X access, Home files
  58 manage_dirs_pattern(mozilla_t, mozilla_home_t, mozilla_home_t)
  59 manage_files_pattern(mozilla_t, mozilla_home_t, mozilla_home_t)
  60 manage_lnk_files_pattern(mozilla_t, mozilla_home_t, mozilla_home_t)
  61 userdom_search_user_home_dirs(mozilla_t)
  62 userdom_user_home_dir_filetrans(mozilla_t, mozilla_home_t, dir)
  63
  64 # Mozpluggerrc
  65 allow mozilla_t mozilla_conf_t:file read_file_perms;
  66
  67 manage_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t)
  68 manage_lnk_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t)
  69 manage_fifo_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t)
  70 manage_sock_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t)
  71 fs_tmpfs_filetrans(mozilla_t, mozilla_tmpfs_t, { file lnk_file sock_file fifo_file })
  72
  73 kernel_read_kernel_sysctls(mozilla_t)
  74 kernel_read_network_state(mozilla_t)
  75 # Access /proc, sysctl
  76 kernel_read_system_state(mozilla_t)
  77 kernel_read_net_sysctls(mozilla_t)
  78
  79 # Look for plugins
  80 corecmd_list_bin(mozilla_t)
  81 # for bash - old mozilla binary
  82 corecmd_exec_shell(mozilla_t)
  83 corecmd_exec_bin(mozilla_t)
  84
  85 # Browse the web, connect to printer
  86 corenet_all_recvfrom_unlabeled(mozilla_t)
  87 corenet_all_recvfrom_netlabel(mozilla_t)
  88 corenet_tcp_sendrecv_generic_if(mozilla_t)
  89 corenet_raw_sendrecv_generic_if(mozilla_t)
  90 corenet_tcp_sendrecv_generic_node(mozilla_t)
  91 corenet_raw_sendrecv_generic_node(mozilla_t)
  92 corenet_tcp_sendrecv_http_port(mozilla_t)
  93 corenet_tcp_sendrecv_http_cache_port(mozilla_t)
  94 corenet_tcp_sendrecv_ftp_port(mozilla_t)
  95 corenet_tcp_sendrecv_ipp_port(mozilla_t)
  96 corenet_tcp_connect_http_port(mozilla_t)
  97 corenet_tcp_connect_http_cache_port(mozilla_t)
  98 corenet_tcp_connect_ftp_port(mozilla_t)
  99 corenet_tcp_connect_ipp_port(mozilla_t)
 100 corenet_tcp_connect_generic_port(mozilla_t)
 101 corenet_tcp_connect_soundd_port(mozilla_t)
 102 corenet_sendrecv_http_client_packets(mozilla_t)
 103 corenet_sendrecv_http_cache_client_packets(mozilla_t)
 104 corenet_sendrecv_ftp_client_packets(mozilla_t)
 105 corenet_sendrecv_ipp_client_packets(mozilla_t)
 106 corenet_sendrecv_generic_client_packets(mozilla_t)
 107 # Should not need other ports
 108 corenet_dontaudit_tcp_sendrecv_generic_port(mozilla_t)
 109 corenet_dontaudit_tcp_bind_generic_port(mozilla_t)
 110 corenet_tcp_connect_speech_port(mozilla_t)
 111
 112 dev_read_urand(mozilla_t)
 113 dev_read_rand(mozilla_t)
 114 dev_write_sound(mozilla_t)
 115 dev_read_sound(mozilla_t)
 116 dev_dontaudit_rw_dri(mozilla_t)
 117 dev_getattr_sysfs_dirs(mozilla_t)
 118
 119 domain_dontaudit_read_all_domains_state(mozilla_t)
 120
 121 files_read_etc_runtime_files(mozilla_t)
 122 files_read_usr_files(mozilla_t)
 123 files_read_etc_files(mozilla_t)
 124 # /var/lib
 125 files_read_var_lib_files(mozilla_t)
 126 # interacting with gstreamer
 127 files_read_var_files(mozilla_t)
 128 files_read_var_symlinks(mozilla_t)
 129 files_dontaudit_getattr_boot_dirs(mozilla_t)
 130
 131 fs_search_auto_mountpoints(mozilla_t)
 132 fs_list_inotifyfs(mozilla_t)
 133 fs_rw_tmpfs_files(mozilla_t)
 134
 135 term_dontaudit_getattr_pty_dirs(mozilla_t)
 136
 137 logging_send_syslog_msg(mozilla_t)
 138
 139 miscfiles_read_fonts(mozilla_t)
 140 miscfiles_read_localization(mozilla_t)
 141
 142 # Browse the web, connect to printer
 143 sysnet_dns_name_resolve(mozilla_t)
 144
 145 userdom_manage_user_home_content_dirs(mozilla_t)
 146 userdom_manage_user_home_content_files(mozilla_t)
 147 userdom_manage_user_home_content_symlinks(mozilla_t)
 148 userdom_manage_user_tmp_dirs(mozilla_t)
 149 userdom_manage_user_tmp_files(mozilla_t)
 150 userdom_manage_user_tmp_sockets(mozilla_t)
 151
 152 xserver_user_x_domain_template(mozilla, mozilla_t, mozilla_tmpfs_t)
 153 xserver_dontaudit_read_xdm_tmp_files(mozilla_t)
 154 xserver_dontaudit_getattr_xdm_tmp_sockets(mozilla_t)
 155
 156 tunable_policy(`allow_execmem',`
 157         allow mozilla_t self:process { execmem execstack };
 158 ')
 159
 160 tunable_policy(`use_nfs_home_dirs',`
 161         fs_manage_nfs_dirs(mozilla_t)
 162         fs_manage_nfs_files(mozilla_t)
 163         fs_manage_nfs_symlinks(mozilla_t)
 164 ')
 165
 166 tunable_policy(`use_samba_home_dirs',`
 167         fs_manage_cifs_dirs(mozilla_t)
 168         fs_manage_cifs_files(mozilla_t)
 169         fs_manage_cifs_symlinks(mozilla_t)
 170 ')
 171
 172 # Uploads, local html
 173 tunable_policy(`mozilla_read_content && use_nfs_home_dirs',`
 174         fs_list_auto_mountpoints(mozilla_t)
 175         files_list_home(mozilla_t)
 176         fs_read_nfs_files(mozilla_t)
 177         fs_read_nfs_symlinks(mozilla_t)
 178
 179 ',`
 180         files_dontaudit_list_home(mozilla_t)
 181         fs_dontaudit_list_auto_mountpoints(mozilla_t)
 182         fs_dontaudit_read_nfs_files(mozilla_t)
 183         fs_dontaudit_list_nfs(mozilla_t)
 184 ')
 185
 186 tunable_policy(`mozilla_read_content && use_samba_home_dirs',`
 187         fs_list_auto_mountpoints(mozilla_t)
 188         files_list_home(mozilla_t)
 189         fs_read_cifs_files(mozilla_t)
 190         fs_read_cifs_symlinks(mozilla_t)
 191 ',`
 192         files_dontaudit_list_home(mozilla_t)
 193         fs_dontaudit_list_auto_mountpoints(mozilla_t)
 194         fs_dontaudit_read_cifs_files(mozilla_t)
 195         fs_dontaudit_list_cifs(mozilla_t)
 196 ')
 197
 198 tunable_policy(`mozilla_read_content',`
 199         userdom_list_user_tmp(mozilla_t)
 200         userdom_read_user_tmp_files(mozilla_t)
 201         userdom_read_user_tmp_symlinks(mozilla_t)
 202         userdom_read_user_home_content_files(mozilla_t)
 203         userdom_read_user_home_content_symlinks(mozilla_t)
 204
 205         ifdef(`enable_mls',`',`
 206                 fs_search_removable(mozilla_t)
 207                 fs_read_removable_files(mozilla_t)
 208                 fs_read_removable_symlinks(mozilla_t)
 209         ')
 210 ',`
 211         files_dontaudit_list_tmp(mozilla_t)
 212         files_dontaudit_list_home(mozilla_t)
 213         fs_dontaudit_list_removable(mozilla_t)
 214         fs_dontaudit_read_removable_files(mozilla_t)
 215         userdom_dontaudit_list_user_tmp(mozilla_t)
 216         userdom_dontaudit_read_user_tmp_files(mozilla_t)
 217         userdom_dontaudit_list_user_home_dirs(mozilla_t)
 218         userdom_dontaudit_read_user_home_content_files(mozilla_t)
 219 ')
 220
 221 optional_policy(`
 222         apache_read_user_scripts(mozilla_t)
 223         apache_read_user_content(mozilla_t)
 224 ')
 225
 226 optional_policy(`
 227         automount_dontaudit_getattr_tmp_dirs(mozilla_t)
 228 ')
 229
 230 optional_policy(`
 231         cups_read_rw_config(mozilla_t)
 232         cups_dbus_chat(mozilla_t)
 233 ')
 234
 235 optional_policy(`
 236         dbus_system_bus_client(mozilla_t)
 237         dbus_session_bus_client(mozilla_t)
 238
 239         optional_policy(`
 240                 networkmanager_dbus_chat(mozilla_t)
 241         ')
 242 ')
 243
 244 optional_policy(`
 245         gnome_stream_connect_gconf(mozilla_t)
 246         gnome_manage_config(mozilla_t)
 247 ')
 248
 249 optional_policy(`
 250         java_domtrans(mozilla_t)
 251 ')
 252
 253 optional_policy(`
 254         lpd_domtrans_lpr(mozilla_t)
 255 ')
 256
 257 optional_policy(`
 258         mplayer_domtrans(mozilla_t)
 259         mplayer_read_user_home_files(mozilla_t)
 260 ')
 261
 262 optional_policy(`
 263         nscd_socket_use(mozilla_t)
 264 ')
 265
 266 optional_policy(`
 267         thunderbird_domtrans(mozilla_t)
 268 ')