policy/modules/kernel/kernel.te

   1
   2 policy_module(kernel,1.9.4)
   3
   4 ########################################
   5 #
   6 # Declarations
   7 #
   8
   9 # assertion related attributes
  10 attribute can_load_kernmodule;
  11 attribute can_receive_kernel_messages;
  12
  13 neverallow ~{ can_load_kernmodule kern_unconfined } self:capability sys_module;
  14
  15 # domains with unconfined access to kernel resources
  16 attribute kern_unconfined;
  17
  18 # regular entries in proc
  19 attribute proc_type;
  20
  21 # sysctls
  22 attribute sysctl_type;
  23
  24 role system_r;
  25 role sysadm_r;
  26 role staff_r;
  27 role user_r;
  28
  29 # here until order dependence is fixed:
  30 role unconfined_r;
  31
  32 ifdef(`enable_mls',`
  33         role secadm_r;
  34         role auditadm_r;
  35 ')
  36
  37 #
  38 # kernel_t is the domain of kernel threads.
  39 # It is also the target type when checking permissions in the system class.
  40 #
  41 type kernel_t, can_load_kernmodule;
  42 domain_base_type(kernel_t)
  43 mls_rangetrans_source(kernel_t)
  44 role system_r types kernel_t;
  45 sid kernel gen_context(system_u:system_r:kernel_t,mls_systemhigh)
  46
  47 #
  48 # DebugFS
  49 #
  50
  51 type debugfs_t;
  52 fs_type(debugfs_t)
  53 allow debugfs_t self:filesystem associate;
  54 genfscon debugfs / gen_context(system_u:object_r:debugfs_t,s0)
  55
  56 #
  57 # kvmFS
  58 #
  59
  60 type kvmfs_t;
  61 fs_type(kvmfs_t)
  62 genfscon kvmfs / gen_context(system_u:object_r:kvmfs_t,s0)
  63
  64 #
  65 # Procfs types
  66 #
  67
  68 type proc_t, proc_type;
  69 files_mountpoint(proc_t)
  70 fs_type(proc_t)
  71 genfscon proc / gen_context(system_u:object_r:proc_t,s0)
  72 genfscon proc /sysvipc gen_context(system_u:object_r:proc_t,s0)
  73
  74 type proc_afs_t, proc_type;
  75 genfscon proc /fs/openafs gen_context(system_u:object_r:proc_afs_t,s0)
  76
  77 # kernel message interface
  78 type proc_kmsg_t, proc_type;
  79 genfscon proc /kmsg gen_context(system_u:object_r:proc_kmsg_t,mls_systemhigh)
  80 neverallow ~{ can_receive_kernel_messages kern_unconfined } proc_kmsg_t:file ~getattr;
  81
  82 # /proc kcore: inaccessible
  83 type proc_kcore_t, proc_type;
  84 neverallow ~kern_unconfined proc_kcore_t:file ~getattr;
  85 genfscon proc /kcore gen_context(system_u:object_r:proc_kcore_t,mls_systemhigh)
  86
  87 type proc_mdstat_t, proc_type;
  88 genfscon proc /mdstat gen_context(system_u:object_r:proc_mdstat_t,s0)
  89
  90 type proc_net_t, proc_type;
  91 genfscon proc /net gen_context(system_u:object_r:proc_net_t,s0)
  92
  93 type proc_xen_t, proc_type;
  94 genfscon proc /xen gen_context(system_u:object_r:proc_xen_t,s0)
  95
  96 #
  97 # Sysctl types
  98 #
  99
 100 # /proc/sys directory, base directory of sysctls
 101 type sysctl_t, sysctl_type;
 102 files_mountpoint(sysctl_t)
 103 sid sysctl gen_context(system_u:object_r:sysctl_t,s0)
 104 genfscon proc /sys gen_context(system_u:object_r:sysctl_t,s0)
 105
 106 # /proc/irq directory and files
 107 type sysctl_irq_t, sysctl_type;
 108 genfscon proc /irq gen_context(system_u:object_r:sysctl_irq_t,s0)
 109
 110 # /proc/net/rpc directory and files
 111 type sysctl_rpc_t, sysctl_type;
 112 genfscon proc /net/rpc gen_context(system_u:object_r:sysctl_rpc_t,s0)
 113
 114 # /proc/sys/fs directory and files
 115 type sysctl_fs_t, sysctl_type;
 116 files_mountpoint(sysctl_fs_t)
 117 genfscon proc /sys/fs gen_context(system_u:object_r:sysctl_fs_t,s0)
 118
 119 # /proc/sys/kernel directory and files
 120 type sysctl_kernel_t, sysctl_type;
 121 genfscon proc /sys/kernel gen_context(system_u:object_r:sysctl_kernel_t,s0)
 122
 123 # /proc/sys/kernel/modprobe file
 124 type sysctl_modprobe_t, sysctl_type;
 125 genfscon proc /sys/kernel/modprobe gen_context(system_u:object_r:sysctl_modprobe_t,s0)
 126
 127 # /proc/sys/kernel/hotplug file
 128 type sysctl_hotplug_t, sysctl_type;
 129 genfscon proc /sys/kernel/hotplug gen_context(system_u:object_r:sysctl_hotplug_t,s0)
 130
 131 # /proc/sys/net directory and files
 132 type sysctl_net_t, sysctl_type;
 133 genfscon proc /sys/net gen_context(system_u:object_r:sysctl_net_t,s0)
 134
 135 # /proc/sys/net/unix directory and files
 136 type sysctl_net_unix_t, sysctl_type;
 137 genfscon proc /sys/net/unix gen_context(system_u:object_r:sysctl_net_unix_t,s0)
 138
 139 # /proc/sys/vm directory and files
 140 type sysctl_vm_t, sysctl_type;
 141 genfscon proc /sys/vm gen_context(system_u:object_r:sysctl_vm_t,s0)
 142
 143 # /proc/sys/dev directory and files
 144 type sysctl_dev_t, sysctl_type;
 145 genfscon proc /sys/dev gen_context(system_u:object_r:sysctl_dev_t,s0)
 146
 147 #
 148 # unlabeled_t is the type of unlabeled objects.
 149 # Objects that have no known labeling information or that
 150 # have labels that are no longer valid are treated as having this type.
 151 #
 152 type unlabeled_t;
 153 sid unlabeled gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
 154
 155 # These initial sids are no longer used, and can be removed:
 156 sid any_socket          gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
 157 sid file_labels         gen_context(system_u:object_r:unlabeled_t,s0)
 158 sid icmp_socket         gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
 159 sid igmp_packet         gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
 160 sid init                gen_context(system_u:object_r:unlabeled_t,s0)
 161 sid kmod                gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
 162 sid policy              gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
 163 sid scmp_packet         gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
 164 sid sysctl_modprobe     gen_context(system_u:object_r:unlabeled_t,s0)
 165 sid sysctl_fs           gen_context(system_u:object_r:unlabeled_t,s0)
 166 sid sysctl_kernel       gen_context(system_u:object_r:unlabeled_t,s0)
 167 sid sysctl_net          gen_context(system_u:object_r:unlabeled_t,s0)
 168 sid sysctl_net_unix     gen_context(system_u:object_r:unlabeled_t,s0)
 169 sid sysctl_vm           gen_context(system_u:object_r:unlabeled_t,s0)
 170 sid sysctl_dev          gen_context(system_u:object_r:unlabeled_t,s0)
 171 sid tcp_socket          gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
 172
 173 ########################################
 174 #
 175 # kernel local policy
 176 #
 177
 178 allow kernel_t self:capability *;
 179 allow kernel_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
 180 allow kernel_t self:shm create_shm_perms;
 181 allow kernel_t self:sem create_sem_perms;
 182 allow kernel_t self:msg { send receive };
 183 allow kernel_t self:msgq create_msgq_perms;
 184 allow kernel_t self:unix_dgram_socket create_socket_perms;
 185 allow kernel_t self:unix_stream_socket create_stream_socket_perms;
 186 allow kernel_t self:unix_dgram_socket sendto;
 187 allow kernel_t self:unix_stream_socket connectto;
 188 allow kernel_t self:fifo_file rw_fifo_file_perms;
 189 allow kernel_t self:sock_file read_sock_file_perms;
 190 allow kernel_t self:fd use;
 191
 192 allow kernel_t proc_t:dir list_dir_perms;
 193 allow kernel_t proc_t:file read_file_perms;
 194 allow kernel_t proc_t:lnk_file read_lnk_file_perms;
 195
 196 allow kernel_t proc_net_t:dir list_dir_perms;
 197 allow kernel_t proc_net_t:file read_file_perms;
 198
 199 allow kernel_t proc_mdstat_t:file read_file_perms;
 200
 201 allow kernel_t proc_kcore_t:file getattr;
 202
 203 allow kernel_t proc_kmsg_t:file getattr;
 204
 205 allow kernel_t sysctl_kernel_t:dir list_dir_perms;
 206 allow kernel_t sysctl_kernel_t:file read_file_perms;
 207 allow kernel_t sysctl_t:dir list_dir_perms;
 208
 209 # Other possible mount points for the root fs are in files
 210 allow kernel_t unlabeled_t:dir mounton;
 211 # Kernel-generated traffic e.g., TCP resets on
 212 # connections with invalidated labels:
 213 allow kernel_t unlabeled_t:packet send;
 214
 215 # Forwarded network traffic
 216 allow unlabeled_t unlabeled_t:packet { forward_in forward_out };
 217
 218 corenet_all_recvfrom_unlabeled(kernel_t)
 219 corenet_all_recvfrom_netlabel(kernel_t)
 220 # Kernel-generated traffic e.g., ICMP replies:
 221 corenet_raw_sendrecv_all_if(kernel_t)
 222 corenet_raw_sendrecv_all_nodes(kernel_t)
 223 corenet_raw_send_generic_if(kernel_t)
 224 # Kernel-generated traffic e.g., TCP resets:
 225 corenet_tcp_sendrecv_all_if(kernel_t)
 226 corenet_tcp_sendrecv_all_nodes(kernel_t)
 227 corenet_raw_send_generic_node(kernel_t)
 228 corenet_raw_send_multicast_node(kernel_t)
 229 corenet_send_all_packets(kernel_t)
 230
 231 dev_read_sysfs(kernel_t)
 232 dev_search_usbfs(kernel_t)
 233
 234 # Mount root file system.  Used when loading a policy
 235 # from initrd, then mounting the root filesystem
 236 fs_mount_all_fs(kernel_t)
 237 fs_unmount_all_fs(kernel_t)
 238
 239 selinux_load_policy(kernel_t)
 240
 241 term_use_console(kernel_t)
 242
 243 corecmd_exec_shell(kernel_t)
 244 corecmd_list_bin(kernel_t)
 245 # /proc/sys/kernel/modprobe is set to /bin/true if not using modules.
 246 corecmd_exec_bin(kernel_t)
 247
 248 domain_signal_all_domains(kernel_t)
 249 domain_search_all_domains_state(kernel_t)
 250
 251 files_list_root(kernel_t)
 252 files_list_etc(kernel_t)
 253 files_list_home(kernel_t)
 254 files_read_usr_files(kernel_t)
 255
 256 mcs_process_set_categories(kernel_t)
 257
 258 mls_process_read_up(kernel_t)
 259 mls_process_write_down(kernel_t)
 260 mls_file_write_all_levels(kernel_t)
 261 mls_file_read_all_levels(kernel_t)
 262
 263 ifdef(`distro_redhat',`
 264         # Bugzilla 222337
 265         fs_rw_tmpfs_chr_files(kernel_t)
 266 ')
 267
 268 tunable_policy(`read_default_t',`
 269         files_list_default(kernel_t)
 270         files_read_default_files(kernel_t)
 271         files_read_default_symlinks(kernel_t)
 272         files_read_default_sockets(kernel_t)
 273         files_read_default_pipes(kernel_t)
 274 ')
 275
 276 optional_policy(`
 277         hotplug_search_config(kernel_t)
 278 ')
 279
 280 optional_policy(`
 281         init_sigchld(kernel_t)
 282 ')
 283
 284 optional_policy(`
 285         libs_use_ld_so(kernel_t)
 286         libs_use_shared_libs(kernel_t)
 287 ')
 288
 289 optional_policy(`
 290         logging_send_syslog_msg(kernel_t)
 291 ')
 292
 293 optional_policy(`
 294         nis_use_ypbind(kernel_t)
 295 ')
 296
 297 optional_policy(`
 298         # nfs kernel server needs kernel UDP access.  It is less risky and painful
 299         # to just give it everything.
 300         allow kernel_t self:tcp_socket create_stream_socket_perms;
 301         allow kernel_t self:udp_socket create_socket_perms;
 302
 303         # nfs kernel server needs kernel UDP access.  It is less risky and painful
 304         # to just give it everything.
 305         corenet_udp_sendrecv_all_if(kernel_t)
 306         corenet_udp_sendrecv_all_nodes(kernel_t)
 307         corenet_udp_sendrecv_all_ports(kernel_t)
 308         corenet_udp_bind_all_nodes(kernel_t)
 309         corenet_sendrecv_portmap_client_packets(kernel_t)
 310         corenet_sendrecv_generic_server_packets(kernel_t)
 311
 312         fs_getattr_xattr_fs(kernel_t)
 313
 314         auth_dontaudit_getattr_shadow(kernel_t)
 315
 316         sysnet_read_config(kernel_t)
 317
 318         rpc_manage_nfs_ro_content(kernel_t)
 319         rpc_manage_nfs_rw_content(kernel_t)
 320         rpc_udp_rw_nfs_sockets(kernel_t)
 321
 322         tunable_policy(`nfs_export_all_ro',`
 323                 fs_getattr_noxattr_fs(kernel_t)
 324                 fs_list_noxattr_fs(kernel_t)
 325                 fs_read_noxattr_fs_files(kernel_t)
 326                 fs_read_noxattr_fs_symlinks(kernel_t)
 327
 328                 auth_read_all_dirs_except_shadow(kernel_t)
 329                 auth_read_all_files_except_shadow(kernel_t)
 330                 auth_read_all_symlinks_except_shadow(kernel_t)
 331         ')
 332
 333         tunable_policy(`nfs_export_all_rw',`
 334                 fs_getattr_noxattr_fs(kernel_t)
 335                 fs_list_noxattr_fs(kernel_t)
 336                 fs_read_noxattr_fs_files(kernel_t)
 337                 fs_read_noxattr_fs_symlinks(kernel_t)
 338
 339                 auth_manage_all_files_except_shadow(kernel_t)
 340         ')
 341 ')
 342
 343 optional_policy(`
 344         seutil_read_config(kernel_t)
 345         seutil_read_bin_policy(kernel_t)
 346 ')
 347
 348 optional_policy(`
 349         unconfined_domain(kernel_t)
 350 ')
 351
 352 ########################################
 353 #
 354 # Unlabeled process local policy
 355 #
 356
 357 optional_policy(`
 358         # If you load a new policy that removes active domains, processes can
 359         # get stuck if you do not allow unlabeled processes to signal init.
 360         # If you load an incompatible policy, you should probably reboot,
 361         # since you may have compromised system security.
 362         init_sigchld(unlabeled_t)
 363 ')
 364
 365 ########################################
 366 #
 367 # Rules for unconfined acccess to this module
 368 #
 369
 370 allow kern_unconfined proc_type:{ dir file lnk_file } *;
 371
 372 allow kern_unconfined sysctl_type:{ dir file } *;
 373
 374 allow kern_unconfined kernel_t:system *;
 375
 376 allow kern_unconfined unlabeled_t:dir_file_class_set *;
 377 allow kern_unconfined unlabeled_t:filesystem *;
 378 allow kern_unconfined unlabeled_t:association *;
 379 allow kern_unconfined unlabeled_t:packet *;
 380 allow kern_unconfined unlabeled_t:process ~{ transition dyntransition execmem execstack execheap };