policy/modules/apps/mozilla.te

   1
   2 policy_module(mozilla, 2.0.1)
   3
   4 ########################################
   5 #
   6 # Declarations
   7 #
   8
   9 ## <desc>
  10 ## <p>
  11 ## Control mozilla content access
  12 ## </p>
  13 ## </desc>
  14 gen_tunable(mozilla_read_content, false)
  15
  16 type mozilla_t;
  17 type mozilla_exec_t;
  18 typealias mozilla_t alias { user_mozilla_t staff_mozilla_t sysadm_mozilla_t };
  19 typealias mozilla_t alias { auditadm_mozilla_t secadm_mozilla_t };
  20 application_domain(mozilla_t, mozilla_exec_t)
  21 ubac_constrained(mozilla_t)
  22
  23 type mozilla_conf_t;
  24 files_config_file(mozilla_conf_t)
  25
  26 type mozilla_home_t;
  27 typealias mozilla_home_t alias { user_mozilla_home_t staff_mozilla_home_t sysadm_mozilla_home_t };
  28 typealias mozilla_home_t alias { auditadm_mozilla_home_t secadm_mozilla_home_t };
  29 files_poly_member(mozilla_home_t)
  30 userdom_user_home_content(mozilla_home_t)
  31
  32 type mozilla_tmpfs_t;
  33 typealias mozilla_tmpfs_t alias { user_mozilla_tmpfs_t staff_mozilla_tmpfs_t sysadm_mozilla_tmpfs_t };
  34 typealias mozilla_tmpfs_t alias { auditadm_mozilla_tmpfs_t secadm_mozilla_tmpfs_t };
  35 files_tmpfs_file(mozilla_tmpfs_t)
  36 ubac_constrained(mozilla_tmpfs_t)
  37
  38 ########################################
  39 #
  40 # Local policy
  41 #
  42
  43 allow mozilla_t self:capability { sys_nice setgid setuid };
  44 allow mozilla_t self:process { sigkill signal setsched getsched setrlimit };
  45 allow mozilla_t self:fifo_file rw_fifo_file_perms;
  46 allow mozilla_t self:shm { unix_read unix_write read write destroy create };
  47 allow mozilla_t self:sem create_sem_perms;
  48 allow mozilla_t self:socket create_socket_perms;
  49 allow mozilla_t self:unix_stream_socket { listen accept };
  50 # Browse the web, connect to printer
  51 allow mozilla_t self:tcp_socket create_socket_perms;
  52 allow mozilla_t self:netlink_route_socket r_netlink_socket_perms;
  53
  54 # for bash - old mozilla binary
  55 can_exec(mozilla_t, mozilla_exec_t)
  56
  57 # X access, Home files
  58 manage_dirs_pattern(mozilla_t, mozilla_home_t, mozilla_home_t)
  59 manage_files_pattern(mozilla_t, mozilla_home_t, mozilla_home_t)
  60 manage_lnk_files_pattern(mozilla_t, mozilla_home_t, mozilla_home_t)
  61 userdom_search_user_home_dirs(mozilla_t)
  62
  63 # Mozpluggerrc
  64 allow mozilla_t mozilla_conf_t:file read_file_perms;
  65
  66 manage_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t)
  67 manage_lnk_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t)
  68 manage_fifo_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t)
  69 manage_sock_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t)
  70 fs_tmpfs_filetrans(mozilla_t, mozilla_tmpfs_t, { file lnk_file sock_file fifo_file })
  71
  72 kernel_read_kernel_sysctls(mozilla_t)
  73 kernel_read_network_state(mozilla_t)
  74 # Access /proc, sysctl
  75 kernel_read_system_state(mozilla_t)
  76 kernel_read_net_sysctls(mozilla_t)
  77
  78 # Look for plugins
  79 corecmd_list_bin(mozilla_t)
  80 # for bash - old mozilla binary
  81 corecmd_exec_shell(mozilla_t)
  82 corecmd_exec_bin(mozilla_t)
  83
  84 # Browse the web, connect to printer
  85 corenet_all_recvfrom_unlabeled(mozilla_t)
  86 corenet_all_recvfrom_netlabel(mozilla_t)
  87 corenet_tcp_sendrecv_generic_if(mozilla_t)
  88 corenet_raw_sendrecv_generic_if(mozilla_t)
  89 corenet_tcp_sendrecv_generic_node(mozilla_t)
  90 corenet_raw_sendrecv_generic_node(mozilla_t)
  91 corenet_tcp_sendrecv_http_port(mozilla_t)
  92 corenet_tcp_sendrecv_http_cache_port(mozilla_t)
  93 corenet_tcp_sendrecv_ftp_port(mozilla_t)
  94 corenet_tcp_sendrecv_ipp_port(mozilla_t)
  95 corenet_tcp_connect_http_port(mozilla_t)
  96 corenet_tcp_connect_http_cache_port(mozilla_t)
  97 corenet_tcp_connect_ftp_port(mozilla_t)
  98 corenet_tcp_connect_ipp_port(mozilla_t)
  99 corenet_tcp_connect_generic_port(mozilla_t)
 100 corenet_sendrecv_http_client_packets(mozilla_t)
 101 corenet_sendrecv_http_cache_client_packets(mozilla_t)
 102 corenet_sendrecv_ftp_client_packets(mozilla_t)
 103 corenet_sendrecv_ipp_client_packets(mozilla_t)
 104 corenet_sendrecv_generic_client_packets(mozilla_t)
 105 # Should not need other ports
 106 corenet_dontaudit_tcp_sendrecv_generic_port(mozilla_t)
 107 corenet_dontaudit_tcp_bind_generic_port(mozilla_t)
 108
 109 dev_read_urand(mozilla_t)
 110 dev_read_rand(mozilla_t)
 111 dev_write_sound(mozilla_t)
 112 dev_read_sound(mozilla_t)
 113 dev_dontaudit_rw_dri(mozilla_t)
 114 dev_getattr_sysfs_dirs(mozilla_t)
 115
 116 files_read_etc_runtime_files(mozilla_t)
 117 files_read_usr_files(mozilla_t)
 118 files_read_etc_files(mozilla_t)
 119 # /var/lib
 120 files_read_var_lib_files(mozilla_t)
 121 # interacting with gstreamer
 122 files_read_var_files(mozilla_t)
 123 files_read_var_symlinks(mozilla_t)
 124 files_dontaudit_getattr_boot_dirs(mozilla_t)
 125
 126 fs_search_auto_mountpoints(mozilla_t)
 127 fs_list_inotifyfs(mozilla_t)
 128 fs_rw_tmpfs_files(mozilla_t)
 129
 130 term_dontaudit_getattr_pty_dirs(mozilla_t)
 131
 132 logging_send_syslog_msg(mozilla_t)
 133
 134 miscfiles_read_fonts(mozilla_t)
 135 miscfiles_read_localization(mozilla_t)
 136
 137 # Browse the web, connect to printer
 138 sysnet_dns_name_resolve(mozilla_t)
 139
 140 userdom_manage_user_home_content_dirs(mozilla_t)
 141 userdom_manage_user_home_content_files(mozilla_t)
 142 userdom_manage_user_home_content_symlinks(mozilla_t)
 143 userdom_manage_user_tmp_dirs(mozilla_t)
 144 userdom_manage_user_tmp_files(mozilla_t)
 145 userdom_manage_user_tmp_sockets(mozilla_t)
 146
 147 xserver_user_x_domain_template(mozilla, mozilla_t, mozilla_tmpfs_t)
 148 xserver_dontaudit_read_xdm_tmp_files(mozilla_t)
 149 xserver_dontaudit_getattr_xdm_tmp_sockets(mozilla_t)
 150
 151 tunable_policy(`allow_execmem',`
 152         allow mozilla_t self:process { execmem execstack };
 153 ')
 154
 155 tunable_policy(`use_nfs_home_dirs',`
 156         fs_manage_nfs_dirs(mozilla_t)
 157         fs_manage_nfs_files(mozilla_t)
 158         fs_manage_nfs_symlinks(mozilla_t)
 159 ')
 160
 161 tunable_policy(`use_samba_home_dirs',`
 162         fs_manage_cifs_dirs(mozilla_t)
 163         fs_manage_cifs_files(mozilla_t)
 164         fs_manage_cifs_symlinks(mozilla_t)
 165 ')
 166
 167 # Uploads, local html
 168 tunable_policy(`mozilla_read_content && use_nfs_home_dirs',`
 169         fs_list_auto_mountpoints(mozilla_t)
 170         files_list_home(mozilla_t)
 171         fs_read_nfs_files(mozilla_t)
 172         fs_read_nfs_symlinks(mozilla_t)
 173
 174 ',`
 175         files_dontaudit_list_home(mozilla_t)
 176         fs_dontaudit_list_auto_mountpoints(mozilla_t)
 177         fs_dontaudit_read_nfs_files(mozilla_t)
 178         fs_dontaudit_list_nfs(mozilla_t)
 179 ')
 180
 181 tunable_policy(`mozilla_read_content && use_samba_home_dirs',`
 182         fs_list_auto_mountpoints(mozilla_t)
 183         files_list_home(mozilla_t)
 184         fs_read_cifs_files(mozilla_t)
 185         fs_read_cifs_symlinks(mozilla_t)
 186 ',`
 187         files_dontaudit_list_home(mozilla_t)
 188         fs_dontaudit_list_auto_mountpoints(mozilla_t)
 189         fs_dontaudit_read_cifs_files(mozilla_t)
 190         fs_dontaudit_list_cifs(mozilla_t)
 191 ')
 192
 193 tunable_policy(`mozilla_read_content',`
 194         userdom_list_user_tmp(mozilla_t)
 195         userdom_read_user_tmp_files(mozilla_t)
 196         userdom_read_user_tmp_symlinks(mozilla_t)
 197         userdom_read_user_home_content_files(mozilla_t)
 198         userdom_read_user_home_content_symlinks(mozilla_t)
 199
 200         ifdef(`enable_mls',`',`
 201                 fs_search_removable(mozilla_t)
 202                 fs_read_removable_files(mozilla_t)
 203                 fs_read_removable_symlinks(mozilla_t)
 204         ')
 205 ',`
 206         files_dontaudit_list_tmp(mozilla_t)
 207         files_dontaudit_list_home(mozilla_t)
 208         fs_dontaudit_list_removable(mozilla_t)
 209         fs_dontaudit_read_removable_files(mozilla_t)
 210         userdom_dontaudit_list_user_tmp(mozilla_t)
 211         userdom_dontaudit_read_user_tmp_files(mozilla_t)
 212         userdom_dontaudit_list_user_home_dirs(mozilla_t)
 213         userdom_dontaudit_read_user_home_content_files(mozilla_t)
 214 ')
 215
 216 tunable_policy(`mozilla_read_content && read_default_t',`
 217         files_list_default(mozilla_t)
 218         files_read_default_files(mozilla_t)
 219         files_read_default_symlinks(mozilla_t)
 220 ',`
 221         files_dontaudit_read_default_files(mozilla_t)
 222         files_dontaudit_list_default(mozilla_t)
 223 ')
 224
 225 optional_policy(`
 226         apache_read_user_scripts(mozilla_t)
 227         apache_read_user_content(mozilla_t)
 228 ')
 229
 230 optional_policy(`
 231         automount_dontaudit_getattr_tmp_dirs(mozilla_t)
 232 ')
 233
 234 optional_policy(`
 235         cups_read_rw_config(mozilla_t)
 236         cups_dbus_chat(mozilla_t)
 237 ')
 238
 239 optional_policy(`
 240         dbus_system_bus_client(mozilla_t)
 241         dbus_session_bus_client(mozilla_t)
 242 ')
 243
 244 optional_policy(`
 245         gnome_stream_connect_gconf(mozilla_t)
 246 ')
 247
 248 optional_policy(`
 249         java_domtrans(mozilla_t)
 250 ')
 251
 252 optional_policy(`
 253         lpd_domtrans_lpr(mozilla_t)
 254 ')
 255
 256 optional_policy(`
 257         mplayer_domtrans(mozilla_t)
 258         mplayer_read_user_home_files(mozilla_t)
 259 ')
 260
 261 optional_policy(`
 262         nscd_socket_use(mozilla_t)
 263 ')
 264
 265 optional_policy(`
 266         thunderbird_domtrans(mozilla_t)
 267 ')