policy/modules/kernel/kernel.te

   1
   2 policy_module(kernel,1.8.0)
   3
   4 ########################################
   5 #
   6 # Declarations
   7 #
   8
   9 # assertion related attributes
  10 attribute can_load_kernmodule;
  11 attribute can_receive_kernel_messages;
  12
  13 neverallow ~{ can_load_kernmodule kern_unconfined } self:capability sys_module;
  14
  15 # domains with unconfined access to kernel resources
  16 attribute kern_unconfined;
  17
  18 # regular entries in proc
  19 attribute proc_type;
  20
  21 # sysctls
  22 attribute sysctl_type;
  23
  24 role system_r;
  25 role sysadm_r;
  26 role staff_r;
  27 role user_r;
  28
  29 # here until order dependence is fixed:
  30 role unconfined_r;
  31
  32 ifdef(`enable_mls',`
  33         role secadm_r;
  34         role auditadm_r;
  35 ')
  36
  37 #
  38 # kernel_t is the domain of kernel threads.
  39 # It is also the target type when checking permissions in the system class.
  40 #
  41 type kernel_t, can_load_kernmodule;
  42 domain_base_type(kernel_t)
  43 mls_rangetrans_source(kernel_t)
  44 role system_r types kernel_t;
  45 sid kernel gen_context(system_u:system_r:kernel_t,mls_systemhigh)
  46
  47 #
  48 # DebugFS
  49 #
  50
  51 type debugfs_t;
  52 fs_type(debugfs_t)
  53 allow debugfs_t self:filesystem associate;
  54 genfscon debugfs / gen_context(system_u:object_r:debugfs_t,s0)
  55
  56 #
  57 # kvmFS
  58 #
  59
  60 type kvmfs_t;
  61 fs_type(kvmfs_t)
  62 genfscon kvmfs / gen_context(system_u:object_r:kvmfs_t,s0)
  63
  64 #
  65 # Procfs types
  66 #
  67
  68 type proc_t, proc_type;
  69 files_mountpoint(proc_t)
  70 fs_type(proc_t)
  71 genfscon proc / gen_context(system_u:object_r:proc_t,s0)
  72 genfscon proc /sysvipc gen_context(system_u:object_r:proc_t,s0)
  73
  74 # kernel message interface
  75 type proc_kmsg_t, proc_type;
  76 genfscon proc /kmsg gen_context(system_u:object_r:proc_kmsg_t,mls_systemhigh)
  77 neverallow ~{ can_receive_kernel_messages kern_unconfined } proc_kmsg_t:file ~getattr;
  78
  79 # /proc kcore: inaccessible
  80 type proc_kcore_t, proc_type;
  81 neverallow ~kern_unconfined proc_kcore_t:file ~getattr;
  82 genfscon proc /kcore gen_context(system_u:object_r:proc_kcore_t,mls_systemhigh)
  83
  84 type proc_mdstat_t, proc_type;
  85 genfscon proc /mdstat gen_context(system_u:object_r:proc_mdstat_t,s0)
  86
  87 type proc_net_t, proc_type;
  88 genfscon proc /net gen_context(system_u:object_r:proc_net_t,s0)
  89
  90 type proc_xen_t, proc_type;
  91 genfscon proc /xen gen_context(system_u:object_r:proc_xen_t,s0)
  92
  93 #
  94 # Sysctl types
  95 #
  96
  97 # /proc/sys directory, base directory of sysctls
  98 type sysctl_t, sysctl_type;
  99 files_mountpoint(sysctl_t)
 100 sid sysctl gen_context(system_u:object_r:sysctl_t,s0)
 101 genfscon proc /sys gen_context(system_u:object_r:sysctl_t,s0)
 102
 103 # /proc/irq directory and files
 104 type sysctl_irq_t, sysctl_type;
 105 genfscon proc /irq gen_context(system_u:object_r:sysctl_irq_t,s0)
 106
 107 # /proc/net/rpc directory and files
 108 type sysctl_rpc_t, sysctl_type;
 109 genfscon proc /net/rpc gen_context(system_u:object_r:sysctl_rpc_t,s0)
 110
 111 # /proc/sys/fs directory and files
 112 type sysctl_fs_t, sysctl_type;
 113 files_mountpoint(sysctl_fs_t)
 114 genfscon proc /sys/fs gen_context(system_u:object_r:sysctl_fs_t,s0)
 115
 116 # /proc/sys/kernel directory and files
 117 type sysctl_kernel_t, sysctl_type;
 118 genfscon proc /sys/kernel gen_context(system_u:object_r:sysctl_kernel_t,s0)
 119
 120 # /proc/sys/kernel/modprobe file
 121 type sysctl_modprobe_t, sysctl_type;
 122 genfscon proc /sys/kernel/modprobe gen_context(system_u:object_r:sysctl_modprobe_t,s0)
 123
 124 # /proc/sys/kernel/hotplug file
 125 type sysctl_hotplug_t, sysctl_type;
 126 genfscon proc /sys/kernel/hotplug gen_context(system_u:object_r:sysctl_hotplug_t,s0)
 127
 128 # /proc/sys/net directory and files
 129 type sysctl_net_t, sysctl_type;
 130 genfscon proc /sys/net gen_context(system_u:object_r:sysctl_net_t,s0)
 131
 132 # /proc/sys/net/unix directory and files
 133 type sysctl_net_unix_t, sysctl_type;
 134 genfscon proc /sys/net/unix gen_context(system_u:object_r:sysctl_net_unix_t,s0)
 135
 136 # /proc/sys/vm directory and files
 137 type sysctl_vm_t, sysctl_type;
 138 genfscon proc /sys/vm gen_context(system_u:object_r:sysctl_vm_t,s0)
 139
 140 # /proc/sys/dev directory and files
 141 type sysctl_dev_t, sysctl_type;
 142 genfscon proc /sys/dev gen_context(system_u:object_r:sysctl_dev_t,s0)
 143
 144 #
 145 # unlabeled_t is the type of unlabeled objects.
 146 # Objects that have no known labeling information or that
 147 # have labels that are no longer valid are treated as having this type.
 148 #
 149 type unlabeled_t;
 150 sid unlabeled gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
 151
 152 # These initial sids are no longer used, and can be removed:
 153 sid any_socket          gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
 154 sid file_labels         gen_context(system_u:object_r:unlabeled_t,s0)
 155 sid icmp_socket         gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
 156 sid igmp_packet         gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
 157 sid init                gen_context(system_u:object_r:unlabeled_t,s0)
 158 sid kmod                gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
 159 sid policy              gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
 160 sid scmp_packet         gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
 161 sid sysctl_modprobe     gen_context(system_u:object_r:unlabeled_t,s0)
 162 sid sysctl_fs           gen_context(system_u:object_r:unlabeled_t,s0)
 163 sid sysctl_kernel       gen_context(system_u:object_r:unlabeled_t,s0)
 164 sid sysctl_net          gen_context(system_u:object_r:unlabeled_t,s0)
 165 sid sysctl_net_unix     gen_context(system_u:object_r:unlabeled_t,s0)
 166 sid sysctl_vm           gen_context(system_u:object_r:unlabeled_t,s0)
 167 sid sysctl_dev          gen_context(system_u:object_r:unlabeled_t,s0)
 168 sid tcp_socket          gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
 169
 170 ########################################
 171 #
 172 # kernel local policy
 173 #
 174
 175 allow kernel_t self:capability *;
 176 allow kernel_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
 177 allow kernel_t self:shm create_shm_perms;
 178 allow kernel_t self:sem create_sem_perms;
 179 allow kernel_t self:msg { send receive };
 180 allow kernel_t self:msgq create_msgq_perms;
 181 allow kernel_t self:unix_dgram_socket create_socket_perms;
 182 allow kernel_t self:unix_stream_socket create_stream_socket_perms;
 183 allow kernel_t self:unix_dgram_socket sendto;
 184 allow kernel_t self:unix_stream_socket connectto;
 185 allow kernel_t self:fifo_file rw_file_perms;
 186 allow kernel_t self:sock_file r_file_perms;
 187 allow kernel_t self:fd use;
 188
 189 allow kernel_t proc_t:dir r_dir_perms;
 190 allow kernel_t proc_t:{ lnk_file file } r_file_perms;
 191
 192 allow kernel_t proc_net_t:dir r_dir_perms;
 193 allow kernel_t proc_net_t:file r_file_perms;
 194
 195 allow kernel_t proc_mdstat_t:file r_file_perms;
 196
 197 allow kernel_t proc_kcore_t:file getattr;
 198
 199 allow kernel_t proc_kmsg_t:file getattr;
 200
 201 allow kernel_t sysctl_kernel_t:dir r_dir_perms;
 202 allow kernel_t sysctl_kernel_t:file r_file_perms;
 203 allow kernel_t sysctl_t:dir r_dir_perms;
 204
 205 # Other possible mount points for the root fs are in files
 206 allow kernel_t unlabeled_t:dir mounton;
 207 # Kernel-generated traffic e.g., TCP resets on
 208 # connections with invalidated labels:
 209 allow kernel_t unlabeled_t:packet send;
 210
 211 corenet_all_recvfrom_unlabeled(kernel_t)
 212 corenet_all_recvfrom_netlabel(kernel_t)
 213 # Kernel-generated traffic e.g., ICMP replies:
 214 corenet_raw_sendrecv_all_if(kernel_t)
 215 corenet_raw_sendrecv_all_nodes(kernel_t)
 216 corenet_raw_send_generic_if(kernel_t)
 217 # Kernel-generated traffic e.g., TCP resets:
 218 corenet_tcp_sendrecv_all_if(kernel_t)
 219 corenet_tcp_sendrecv_all_nodes(kernel_t)
 220 corenet_raw_send_generic_node(kernel_t)
 221 corenet_raw_send_multicast_node(kernel_t)
 222 corenet_send_all_packets(kernel_t)
 223
 224 dev_read_sysfs(kernel_t)
 225 dev_search_usbfs(kernel_t)
 226
 227 # Mount root file system.  Used when loading a policy
 228 # from initrd, then mounting the root filesystem
 229 fs_mount_all_fs(kernel_t)
 230
 231 selinux_load_policy(kernel_t)
 232
 233 term_use_console(kernel_t)
 234
 235 corecmd_exec_shell(kernel_t)
 236 corecmd_list_bin(kernel_t)
 237 # /proc/sys/kernel/modprobe is set to /bin/true if not using modules.
 238 corecmd_exec_bin(kernel_t)
 239
 240 domain_signal_all_domains(kernel_t)
 241 domain_search_all_domains_state(kernel_t)
 242
 243 files_list_root(kernel_t)
 244 files_list_etc(kernel_t)
 245 files_list_home(kernel_t)
 246 files_read_usr_files(kernel_t)
 247
 248 mcs_process_set_categories(kernel_t)
 249
 250 mls_process_read_up(kernel_t)
 251 mls_process_write_down(kernel_t)
 252
 253 ifdef(`distro_redhat',`
 254         # Bugzilla 222337
 255         fs_rw_tmpfs_chr_files(kernel_t)
 256 ')
 257
 258 tunable_policy(`read_default_t',`
 259         files_list_default(kernel_t)
 260         files_read_default_files(kernel_t)
 261         files_read_default_symlinks(kernel_t)
 262         files_read_default_sockets(kernel_t)
 263         files_read_default_pipes(kernel_t)
 264 ')
 265
 266 optional_policy(`
 267         hotplug_search_config(kernel_t)
 268 ')
 269
 270 optional_policy(`
 271         init_sigchld(kernel_t)
 272 ')
 273
 274 optional_policy(`
 275         libs_use_ld_so(kernel_t)
 276         libs_use_shared_libs(kernel_t)
 277 ')
 278
 279 optional_policy(`
 280         logging_send_syslog_msg(kernel_t)
 281 ')
 282
 283 optional_policy(`
 284         nis_use_ypbind(kernel_t)
 285 ')
 286
 287 optional_policy(`
 288         # nfs kernel server needs kernel UDP access.  It is less risky and painful
 289         # to just give it everything.
 290         allow kernel_t self:tcp_socket create_stream_socket_perms;
 291         allow kernel_t self:udp_socket create_socket_perms;
 292
 293         # nfs kernel server needs kernel UDP access.  It is less risky and painful
 294         # to just give it everything.
 295         corenet_udp_sendrecv_all_if(kernel_t)
 296         corenet_udp_sendrecv_all_nodes(kernel_t)
 297         corenet_udp_sendrecv_all_ports(kernel_t)
 298         corenet_udp_bind_all_nodes(kernel_t)
 299         corenet_sendrecv_portmap_client_packets(kernel_t)
 300         corenet_sendrecv_generic_server_packets(kernel_t)
 301
 302         fs_getattr_xattr_fs(kernel_t)
 303
 304         auth_dontaudit_getattr_shadow(kernel_t)
 305
 306         sysnet_read_config(kernel_t)
 307
 308         rpc_manage_nfs_ro_content(kernel_t)
 309         rpc_manage_nfs_rw_content(kernel_t)
 310         rpc_udp_rw_nfs_sockets(kernel_t)
 311
 312         tunable_policy(`nfs_export_all_ro',`
 313                 fs_getattr_noxattr_fs(kernel_t)
 314                 fs_list_noxattr_fs(kernel_t)
 315                 fs_read_noxattr_fs_files(kernel_t)
 316                 fs_read_noxattr_fs_symlinks(kernel_t)
 317
 318                 auth_read_all_dirs_except_shadow(kernel_t)
 319                 auth_read_all_files_except_shadow(kernel_t)
 320                 auth_read_all_symlinks_except_shadow(kernel_t)
 321         ')
 322
 323         tunable_policy(`nfs_export_all_rw',`
 324                 fs_getattr_noxattr_fs(kernel_t)
 325                 fs_list_noxattr_fs(kernel_t)
 326                 fs_read_noxattr_fs_files(kernel_t)
 327                 fs_read_noxattr_fs_symlinks(kernel_t)
 328
 329                 auth_manage_all_files_except_shadow(kernel_t)
 330         ')
 331 ')
 332
 333 optional_policy(`
 334         seutil_read_config(kernel_t)
 335         seutil_read_bin_policy(kernel_t)
 336 ')
 337
 338 optional_policy(`
 339         unconfined_domain(kernel_t)
 340 ')
 341
 342 ########################################
 343 #
 344 # Unlabeled process local policy
 345 #
 346
 347 optional_policy(`
 348         # If you load a new policy that removes active domains, processes can
 349         # get stuck if you do not allow unlabeled processes to signal init.
 350         # If you load an incompatible policy, you should probably reboot,
 351         # since you may have compromised system security.
 352         init_sigchld(unlabeled_t)
 353 ')
 354
 355 ########################################
 356 #
 357 # Rules for unconfined acccess to this module
 358 #
 359
 360 allow kern_unconfined proc_type:{ dir file lnk_file } *;
 361
 362 allow kern_unconfined sysctl_t:{ dir file } *;
 363
 364 allow kern_unconfined kernel_t:system *;
 365
 366 allow kern_unconfined unlabeled_t:dir_file_class_set *;
 367 allow kern_unconfined unlabeled_t:filesystem *;
 368 allow kern_unconfined unlabeled_t:association *;
 369 allow kern_unconfined unlabeled_t:packet *;
 370 allow kern_unconfined unlabeled_t:process ~{ transition dyntransition execmem execstack execheap };
 371
 372 kernel_rw_all_sysctls(kern_unconfined)