policy/modules/kernel/kernel.te

   1
   2 policy_module(kernel, 1.10.5)
   3
   4 ########################################
   5 #
   6 # Declarations
   7 #
   8
   9 # assertion related attributes
  10 attribute can_load_kernmodule;
  11 attribute can_receive_kernel_messages;
  12
  13 neverallow ~{ can_load_kernmodule kern_unconfined } self:capability sys_module;
  14
  15 # domains with unconfined access to kernel resources
  16 attribute kern_unconfined;
  17
  18 # regular entries in proc
  19 attribute proc_type;
  20
  21 # sysctls
  22 attribute sysctl_type;
  23
  24 role system_r;
  25 role sysadm_r;
  26 role staff_r;
  27 role user_r;
  28
  29 # here until order dependence is fixed:
  30 role unconfined_r;
  31
  32 ifdef(`enable_mls',`
  33         role secadm_r;
  34         role auditadm_r;
  35 ')
  36
  37 #
  38 # kernel_t is the domain of kernel threads.
  39 # It is also the target type when checking permissions in the system class.
  40 #
  41 type kernel_t, can_load_kernmodule;
  42 domain_base_type(kernel_t)
  43 mls_rangetrans_source(kernel_t)
  44 role system_r types kernel_t;
  45 sid kernel gen_context(system_u:system_r:kernel_t,mls_systemhigh)
  46
  47 #
  48 # cgroup fs
  49 #
  50
  51 type cgroup_t;
  52 fs_type(cgroup_t)
  53 allow cgroup_t self:filesystem associate;
  54 genfscon cgroup / gen_context(system_u:object_r:cgroup_t,s0)
  55
  56 #
  57 # DebugFS
  58 #
  59
  60 type debugfs_t;
  61 fs_type(debugfs_t)
  62 allow debugfs_t self:filesystem associate;
  63 genfscon debugfs / gen_context(system_u:object_r:debugfs_t,s0)
  64
  65 #
  66 # kvmFS
  67 #
  68
  69 type kvmfs_t;
  70 fs_type(kvmfs_t)
  71 genfscon kvmfs / gen_context(system_u:object_r:kvmfs_t,s0)
  72
  73 #
  74 # Procfs types
  75 #
  76
  77 type proc_t, proc_type;
  78 files_mountpoint(proc_t)
  79 fs_type(proc_t)
  80 genfscon proc / gen_context(system_u:object_r:proc_t,s0)
  81 genfscon proc /sysvipc gen_context(system_u:object_r:proc_t,s0)
  82
  83 type proc_afs_t, proc_type;
  84 genfscon proc /fs/openafs gen_context(system_u:object_r:proc_afs_t,s0)
  85
  86 # kernel message interface
  87 type proc_kmsg_t, proc_type;
  88 genfscon proc /kmsg gen_context(system_u:object_r:proc_kmsg_t,mls_systemhigh)
  89 neverallow ~{ can_receive_kernel_messages kern_unconfined } proc_kmsg_t:file ~getattr;
  90
  91 # /proc kcore: inaccessible
  92 type proc_kcore_t, proc_type;
  93 neverallow ~kern_unconfined proc_kcore_t:file ~getattr;
  94 genfscon proc /kcore gen_context(system_u:object_r:proc_kcore_t,mls_systemhigh)
  95
  96 type proc_mdstat_t, proc_type;
  97 genfscon proc /mdstat gen_context(system_u:object_r:proc_mdstat_t,s0)
  98
  99 type proc_net_t, proc_type;
 100 genfscon proc /net gen_context(system_u:object_r:proc_net_t,s0)
 101
 102 type proc_xen_t, proc_type;
 103 files_mountpoint(proc_xen_t)
 104 genfscon proc /xen gen_context(system_u:object_r:proc_xen_t,s0)
 105
 106 #
 107 # Sysctl types
 108 #
 109
 110 # /proc/sys directory, base directory of sysctls
 111 type sysctl_t, sysctl_type;
 112 files_mountpoint(sysctl_t)
 113 sid sysctl gen_context(system_u:object_r:sysctl_t,s0)
 114 genfscon proc /sys gen_context(system_u:object_r:sysctl_t,s0)
 115
 116 # /proc/irq directory and files
 117 type sysctl_irq_t, sysctl_type;
 118 genfscon proc /irq gen_context(system_u:object_r:sysctl_irq_t,s0)
 119
 120 # /proc/net/rpc directory and files
 121 type sysctl_rpc_t, sysctl_type;
 122 genfscon proc /net/rpc gen_context(system_u:object_r:sysctl_rpc_t,s0)
 123
 124 # /proc/sys/crypto directory and files
 125 type sysctl_crypto_t, sysctl_type;
 126 genfscon proc /sys/crypto gen_context(system_u:object_r:sysctl_crypto_t,s0)
 127
 128 # /proc/sys/fs directory and files
 129 type sysctl_fs_t, sysctl_type;
 130 files_mountpoint(sysctl_fs_t)
 131 genfscon proc /sys/fs gen_context(system_u:object_r:sysctl_fs_t,s0)
 132
 133 # /proc/sys/kernel directory and files
 134 type sysctl_kernel_t, sysctl_type;
 135 genfscon proc /sys/kernel gen_context(system_u:object_r:sysctl_kernel_t,s0)
 136
 137 # /proc/sys/kernel/modprobe file
 138 type sysctl_modprobe_t, sysctl_type;
 139 genfscon proc /sys/kernel/modprobe gen_context(system_u:object_r:sysctl_modprobe_t,s0)
 140
 141 # /proc/sys/kernel/hotplug file
 142 type sysctl_hotplug_t, sysctl_type;
 143 genfscon proc /sys/kernel/hotplug gen_context(system_u:object_r:sysctl_hotplug_t,s0)
 144
 145 # /proc/sys/net directory and files
 146 type sysctl_net_t, sysctl_type;
 147 genfscon proc /sys/net gen_context(system_u:object_r:sysctl_net_t,s0)
 148
 149 # /proc/sys/net/unix directory and files
 150 type sysctl_net_unix_t, sysctl_type;
 151 genfscon proc /sys/net/unix gen_context(system_u:object_r:sysctl_net_unix_t,s0)
 152
 153 # /proc/sys/vm directory and files
 154 type sysctl_vm_t, sysctl_type;
 155 genfscon proc /sys/vm gen_context(system_u:object_r:sysctl_vm_t,s0)
 156
 157 # /proc/sys/dev directory and files
 158 type sysctl_dev_t, sysctl_type;
 159 genfscon proc /sys/dev gen_context(system_u:object_r:sysctl_dev_t,s0)
 160
 161 #
 162 # unlabeled_t is the type of unlabeled objects.
 163 # Objects that have no known labeling information or that
 164 # have labels that are no longer valid are treated as having this type.
 165 #
 166 type unlabeled_t;
 167 sid unlabeled gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
 168
 169 # These initial sids are no longer used, and can be removed:
 170 sid any_socket          gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
 171 sid file_labels         gen_context(system_u:object_r:unlabeled_t,s0)
 172 sid icmp_socket         gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
 173 sid igmp_packet         gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
 174 sid init                gen_context(system_u:object_r:unlabeled_t,s0)
 175 sid kmod                gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
 176 sid policy              gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
 177 sid scmp_packet         gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
 178 sid sysctl_modprobe     gen_context(system_u:object_r:unlabeled_t,s0)
 179 sid sysctl_fs           gen_context(system_u:object_r:unlabeled_t,s0)
 180 sid sysctl_kernel       gen_context(system_u:object_r:unlabeled_t,s0)
 181 sid sysctl_net          gen_context(system_u:object_r:unlabeled_t,s0)
 182 sid sysctl_net_unix     gen_context(system_u:object_r:unlabeled_t,s0)
 183 sid sysctl_vm           gen_context(system_u:object_r:unlabeled_t,s0)
 184 sid sysctl_dev          gen_context(system_u:object_r:unlabeled_t,s0)
 185 sid tcp_socket          gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
 186
 187 ########################################
 188 #
 189 # kernel local policy
 190 #
 191
 192 allow kernel_t self:capability *;
 193 allow kernel_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
 194 allow kernel_t self:shm create_shm_perms;
 195 allow kernel_t self:sem create_sem_perms;
 196 allow kernel_t self:msg { send receive };
 197 allow kernel_t self:msgq create_msgq_perms;
 198 allow kernel_t self:unix_dgram_socket create_socket_perms;
 199 allow kernel_t self:unix_stream_socket create_stream_socket_perms;
 200 allow kernel_t self:unix_dgram_socket sendto;
 201 allow kernel_t self:unix_stream_socket connectto;
 202 allow kernel_t self:fifo_file rw_fifo_file_perms;
 203 allow kernel_t self:sock_file read_sock_file_perms;
 204 allow kernel_t self:fd use;
 205
 206 allow kernel_t debugfs_t:dir search_dir_perms;
 207
 208 allow kernel_t proc_t:dir list_dir_perms;
 209 allow kernel_t proc_t:file read_file_perms;
 210 allow kernel_t proc_t:lnk_file read_lnk_file_perms;
 211
 212 allow kernel_t proc_net_t:dir list_dir_perms;
 213 allow kernel_t proc_net_t:file read_file_perms;
 214
 215 allow kernel_t proc_mdstat_t:file read_file_perms;
 216
 217 allow kernel_t proc_kcore_t:file getattr;
 218
 219 allow kernel_t proc_kmsg_t:file getattr;
 220
 221 allow kernel_t sysctl_kernel_t:dir list_dir_perms;
 222 allow kernel_t sysctl_kernel_t:file read_file_perms;
 223 allow kernel_t sysctl_t:dir list_dir_perms;
 224
 225 # Other possible mount points for the root fs are in files
 226 allow kernel_t unlabeled_t:dir mounton;
 227 # Kernel-generated traffic e.g., TCP resets on
 228 # connections with invalidated labels:
 229 allow kernel_t unlabeled_t:packet send;
 230
 231 # Allow unlabeled network traffic
 232 allow unlabeled_t unlabeled_t:packet { forward_in forward_out };
 233 corenet_in_generic_if(unlabeled_t)
 234 corenet_in_generic_node(unlabeled_t)
 235
 236 corenet_all_recvfrom_unlabeled(kernel_t)
 237 corenet_all_recvfrom_netlabel(kernel_t)
 238 # Kernel-generated traffic e.g., ICMP replies:
 239 corenet_raw_sendrecv_all_if(kernel_t)
 240 corenet_raw_sendrecv_all_nodes(kernel_t)
 241 corenet_raw_send_generic_if(kernel_t)
 242 # Kernel-generated traffic e.g., TCP resets:
 243 corenet_tcp_sendrecv_all_if(kernel_t)
 244 corenet_tcp_sendrecv_all_nodes(kernel_t)
 245 corenet_raw_send_generic_node(kernel_t)
 246 corenet_send_all_packets(kernel_t)
 247
 248 dev_read_sysfs(kernel_t)
 249 dev_search_usbfs(kernel_t)
 250
 251 # Mount root file system.  Used when loading a policy
 252 # from initrd, then mounting the root filesystem
 253 fs_mount_all_fs(kernel_t)
 254 fs_unmount_all_fs(kernel_t)
 255
 256 selinux_load_policy(kernel_t)
 257
 258 term_use_console(kernel_t)
 259
 260 corecmd_exec_shell(kernel_t)
 261 corecmd_list_bin(kernel_t)
 262 # /proc/sys/kernel/modprobe is set to /bin/true if not using modules.
 263 corecmd_exec_bin(kernel_t)
 264
 265 domain_signal_all_domains(kernel_t)
 266 domain_search_all_domains_state(kernel_t)
 267
 268 files_list_root(kernel_t)
 269 files_list_etc(kernel_t)
 270 files_list_home(kernel_t)
 271 files_read_usr_files(kernel_t)
 272
 273 mcs_process_set_categories(kernel_t)
 274
 275 mls_process_read_up(kernel_t)
 276 mls_process_write_down(kernel_t)
 277 mls_file_write_all_levels(kernel_t)
 278 mls_file_read_all_levels(kernel_t)
 279
 280 ifdef(`distro_redhat',`
 281         # Bugzilla 222337
 282         fs_rw_tmpfs_chr_files(kernel_t)
 283 ')
 284
 285 optional_policy(`
 286         hotplug_search_config(kernel_t)
 287 ')
 288
 289 optional_policy(`
 290         init_sigchld(kernel_t)
 291 ')
 292
 293 optional_policy(`
 294         libs_use_ld_so(kernel_t)
 295         libs_use_shared_libs(kernel_t)
 296 ')
 297
 298 optional_policy(`
 299         logging_send_syslog_msg(kernel_t)
 300 ')
 301
 302 optional_policy(`
 303         nis_use_ypbind(kernel_t)
 304 ')
 305
 306 optional_policy(`
 307         # nfs kernel server needs kernel UDP access. It is less risky and painful
 308         # to just give it everything.
 309         allow kernel_t self:tcp_socket create_stream_socket_perms;
 310         allow kernel_t self:udp_socket create_socket_perms;
 311
 312         # nfs kernel server needs kernel UDP access.  It is less risky and painful
 313         # to just give it everything.
 314         corenet_udp_sendrecv_generic_if(kernel_t)
 315         corenet_udp_sendrecv_generic_node(kernel_t)
 316         corenet_udp_sendrecv_all_ports(kernel_t)
 317         corenet_udp_bind_generic_node(kernel_t)
 318         corenet_sendrecv_portmap_client_packets(kernel_t)
 319         corenet_sendrecv_generic_server_packets(kernel_t)
 320
 321         fs_getattr_xattr_fs(kernel_t)
 322
 323         auth_dontaudit_getattr_shadow(kernel_t)
 324
 325         sysnet_read_config(kernel_t)
 326
 327         rpc_manage_nfs_ro_content(kernel_t)
 328         rpc_manage_nfs_rw_content(kernel_t)
 329         rpc_udp_rw_nfs_sockets(kernel_t)
 330
 331         tunable_policy(`nfs_export_all_ro',`
 332                 fs_getattr_noxattr_fs(kernel_t)
 333                 fs_list_noxattr_fs(kernel_t)
 334                 fs_read_noxattr_fs_files(kernel_t)
 335                 fs_read_noxattr_fs_symlinks(kernel_t)
 336
 337                 auth_read_all_dirs_except_shadow(kernel_t)
 338                 auth_read_all_files_except_shadow(kernel_t)
 339                 auth_read_all_symlinks_except_shadow(kernel_t)
 340         ')
 341
 342         tunable_policy(`nfs_export_all_rw',`
 343                 fs_getattr_noxattr_fs(kernel_t)
 344                 fs_list_noxattr_fs(kernel_t)
 345                 fs_read_noxattr_fs_files(kernel_t)
 346                 fs_read_noxattr_fs_symlinks(kernel_t)
 347
 348                 auth_manage_all_files_except_shadow(kernel_t)
 349         ')
 350 ')
 351
 352 optional_policy(`
 353         seutil_read_config(kernel_t)
 354         seutil_read_bin_policy(kernel_t)
 355 ')
 356
 357 optional_policy(`
 358         unconfined_domain(kernel_t)
 359 ')
 360
 361 ########################################
 362 #
 363 # Unlabeled process local policy
 364 #
 365
 366 optional_policy(`
 367         # If you load a new policy that removes active domains, processes can
 368         # get stuck if you do not allow unlabeled processes to signal init.
 369         # If you load an incompatible policy, you should probably reboot,
 370         # since you may have compromised system security.
 371         init_sigchld(unlabeled_t)
 372 ')
 373
 374 ########################################
 375 #
 376 # Rules for unconfined acccess to this module
 377 #
 378
 379 allow kern_unconfined proc_type:{ dir file lnk_file } *;
 380
 381 allow kern_unconfined sysctl_type:{ dir file } *;
 382
 383 allow kern_unconfined kernel_t:system *;
 384
 385 allow kern_unconfined unlabeled_t:dir_file_class_set *;
 386 allow kern_unconfined unlabeled_t:filesystem *;
 387 allow kern_unconfined unlabeled_t:association *;
 388 allow kern_unconfined unlabeled_t:packet *;
 389 allow kern_unconfined unlabeled_t:process ~{ transition dyntransition execmem execstack execheap };