policy/modules/services/apm.te

   1
   2 policy_module(apm, 1.9.2)
   3
   4 ########################################
   5 #
   6 # Declarations
   7 #
   8 type apmd_t;
   9 type apmd_exec_t;
  10 init_daemon_domain(apmd_t, apmd_exec_t)
  11
  12 type apm_t;
  13 type apm_exec_t;
  14 application_domain(apm_t, apm_exec_t)
  15 role system_r types apm_t;
  16
  17 type apmd_log_t;
  18 logging_log_file(apmd_log_t)
  19
  20 type apmd_tmp_t;
  21 files_tmp_file(apmd_tmp_t)
  22
  23 type apmd_var_run_t;
  24 files_pid_file(apmd_var_run_t)
  25
  26 ifdef(`distro_redhat',`
  27         type apmd_lock_t;
  28         files_lock_file(apmd_lock_t)
  29 ')
  30
  31 ifdef(`distro_suse',`
  32         type apmd_var_lib_t;
  33         files_type(apmd_var_lib_t)
  34 ')
  35
  36 ########################################
  37 #
  38 # apm client Local policy
  39 #
  40
  41 allow apm_t self:capability { dac_override sys_admin };
  42
  43 kernel_read_system_state(apm_t)
  44
  45 dev_rw_apm_bios(apm_t)
  46
  47 fs_getattr_xattr_fs(apm_t)
  48
  49 term_use_all_terms(apm_t)
  50
  51 domain_use_interactive_fds(apm_t)
  52
  53 logging_send_syslog_msg(apm_t)
  54
  55 ########################################
  56 #
  57 # apm daemon Local policy
  58 #
  59
  60 # mknod: controlling an orderly resume of PCMCIA requires creating device
  61 # nodes 254,{0,1,2} for some reason.
  62 allow apmd_t self:capability { sys_admin sys_nice sys_time kill mknod };
  63 dontaudit apmd_t self:capability { setuid dac_override dac_read_search sys_tty_config };
  64 allow apmd_t self:process { signal_perms getsession };
  65 allow apmd_t self:fifo_file rw_fifo_file_perms;
  66 allow apmd_t self:unix_dgram_socket create_socket_perms;
  67 allow apmd_t self:unix_stream_socket create_stream_socket_perms;
  68
  69 allow apmd_t apmd_log_t:file manage_file_perms;
  70 logging_log_filetrans(apmd_t, apmd_log_t, file)
  71
  72 manage_dirs_pattern(apmd_t, apmd_tmp_t, apmd_tmp_t)
  73 manage_files_pattern(apmd_t, apmd_tmp_t, apmd_tmp_t)
  74 files_tmp_filetrans(apmd_t, apmd_tmp_t, { file dir })
  75
  76 manage_files_pattern(apmd_t, apmd_var_run_t, apmd_var_run_t)
  77 manage_sock_files_pattern(apmd_t, apmd_var_run_t, apmd_var_run_t)
  78 files_pid_filetrans(apmd_t, apmd_var_run_t, { file sock_file })
  79
  80 kernel_read_kernel_sysctls(apmd_t)
  81 kernel_rw_all_sysctls(apmd_t)
  82 kernel_read_system_state(apmd_t)
  83 kernel_write_proc_files(apmd_t)
  84
  85 dev_read_realtime_clock(apmd_t)
  86 dev_read_urand(apmd_t)
  87 dev_rw_apm_bios(apmd_t)
  88 dev_rw_sysfs(apmd_t)
  89 dev_dontaudit_getattr_all_chr_files(apmd_t) # Excessive?
  90 dev_dontaudit_getattr_all_blk_files(apmd_t) # Excessive?
  91
  92 fs_dontaudit_list_tmpfs(apmd_t)
  93 fs_getattr_all_fs(apmd_t)
  94 fs_search_auto_mountpoints(apmd_t)
  95 fs_dontaudit_getattr_all_files(apmd_t) # Excessive?
  96 fs_dontaudit_getattr_all_symlinks(apmd_t) # Excessive?
  97 fs_dontaudit_getattr_all_pipes(apmd_t) # Excessive?
  98 fs_dontaudit_getattr_all_sockets(apmd_t) # Excessive?
  99
 100 selinux_search_fs(apmd_t)
 101
 102 corecmd_exec_all_executables(apmd_t)
 103
 104 domain_read_all_domains_state(apmd_t)
 105 domain_dontaudit_ptrace_all_domains(apmd_t)
 106 domain_use_interactive_fds(apmd_t)
 107 domain_dontaudit_getattr_all_sockets(apmd_t)
 108 domain_dontaudit_getattr_all_key_sockets(apmd_t) # Excessive?
 109 domain_dontaudit_list_all_domains_state(apmd_t) # Excessive?
 110
 111 files_exec_etc_files(apmd_t)
 112 files_read_etc_runtime_files(apmd_t)
 113 files_dontaudit_getattr_all_files(apmd_t) # Excessive?
 114 files_dontaudit_getattr_all_symlinks(apmd_t) # Excessive?
 115 files_dontaudit_getattr_all_pipes(apmd_t) # Excessive?
 116 files_dontaudit_getattr_all_sockets(apmd_t) # Excessive?
 117
 118 init_domtrans_script(apmd_t)
 119 init_rw_utmp(apmd_t)
 120 init_telinit(apmd_t)
 121
 122 libs_exec_ld_so(apmd_t)
 123 libs_exec_lib_files(apmd_t)
 124
 125 logging_send_syslog_msg(apmd_t)
 126 logging_send_audit_msgs(apmd_t)
 127
 128 miscfiles_read_localization(apmd_t)
 129 miscfiles_read_hwdata(apmd_t)
 130
 131 modutils_domtrans_insmod(apmd_t)
 132 modutils_read_module_config(apmd_t)
 133
 134 seutil_dontaudit_read_config(apmd_t)
 135
 136 userdom_dontaudit_use_unpriv_user_fds(apmd_t)
 137 userdom_dontaudit_search_user_home_dirs(apmd_t)
 138 userdom_dontaudit_search_user_home_content(apmd_t) # Excessive?
 139
 140 ifdef(`distro_redhat',`
 141         allow apmd_t apmd_lock_t:file manage_file_perms;
 142         files_lock_filetrans(apmd_t, apmd_lock_t, file)
 143
 144         can_exec(apmd_t, apmd_var_run_t)
 145
 146         # ifconfig_exec_t needs to be run in its own domain for Red Hat
 147         optional_policy(`
 148                 sysnet_domtrans_ifconfig(apmd_t)
 149         ')
 150
 151         optional_policy(`
 152                 iptables_domtrans(apmd_t)
 153         ')
 154
 155         optional_policy(`
 156                 netutils_domtrans(apmd_t)
 157         ')
 158
 159 ',`
 160         # for ifconfig which is run all the time
 161         kernel_dontaudit_search_sysctl(apmd_t)
 162 ')
 163
 164 ifdef(`distro_suse',`
 165         manage_dirs_pattern(apmd_t, apmd_var_lib_t, apmd_var_lib_t)
 166         manage_files_pattern(apmd_t, apmd_var_lib_t, apmd_var_lib_t)
 167         files_var_lib_filetrans(apmd_t, apmd_var_lib_t, file)
 168 ')
 169
 170 optional_policy(`
 171         automount_domtrans(apmd_t)
 172 ')
 173
 174 optional_policy(`
 175         clock_domtrans(apmd_t)
 176         clock_rw_adjtime(apmd_t)
 177 ')
 178
 179 optional_policy(`
 180         cron_system_entry(apmd_t, apmd_exec_t)
 181         cron_anacron_domtrans_system_job(apmd_t)
 182 ')
 183
 184 optional_policy(`
 185         dbus_system_bus_client(apmd_t)
 186
 187         optional_policy(`
 188                 consolekit_dbus_chat(apmd_t)
 189         ')
 190
 191         optional_policy(`
 192                 networkmanager_dbus_chat(apmd_t)
 193         ')
 194 ')
 195
 196 optional_policy(`
 197         logrotate_use_fds(apmd_t)
 198 ')
 199
 200 optional_policy(`
 201         mta_send_mail(apmd_t)
 202 ')
 203
 204 optional_policy(`
 205         nscd_socket_use(apmd_t)
 206 ')
 207
 208 optional_policy(`
 209         pcmcia_domtrans_cardmgr(apmd_t)
 210         pcmcia_domtrans_cardctl(apmd_t)
 211 ')
 212
 213 optional_policy(`
 214         seutil_sigchld_newrole(apmd_t)
 215 ')
 216
 217 optional_policy(`
 218         udev_read_db(apmd_t)
 219         udev_read_state(apmd_t) #necessary?
 220 ')
 221
 222 optional_policy(`
 223         unconfined_domain(apmd_t)
 224 ')
 225
 226 # cjp: related to sleep/resume (?)
 227 optional_policy(`
 228         xserver_domtrans(apmd_t)
 229 ')