policy/modules/services/apm.te

   1 policy_module(apm, 1.11.0)
   2
   3 ########################################
   4 #
   5 # Declarations
   6 #
   7 type apmd_t;
   8 type apmd_exec_t;
   9 init_daemon_domain(apmd_t, apmd_exec_t)
  10
  11 type apm_t;
  12 type apm_exec_t;
  13 application_domain(apm_t, apm_exec_t)
  14 role system_r types apm_t;
  15
  16 type apmd_log_t;
  17 logging_log_file(apmd_log_t)
  18
  19 type apmd_tmp_t;
  20 files_tmp_file(apmd_tmp_t)
  21
  22 type apmd_var_run_t;
  23 files_pid_file(apmd_var_run_t)
  24
  25 ifdef(`distro_redhat',`
  26         type apmd_lock_t;
  27         files_lock_file(apmd_lock_t)
  28 ')
  29
  30 ifdef(`distro_suse',`
  31         type apmd_var_lib_t;
  32         files_type(apmd_var_lib_t)
  33 ')
  34
  35 ########################################
  36 #
  37 # apm client Local policy
  38 #
  39
  40 allow apm_t self:capability { dac_override sys_admin };
  41
  42 kernel_read_system_state(apm_t)
  43
  44 dev_rw_apm_bios(apm_t)
  45
  46 fs_getattr_xattr_fs(apm_t)
  47
  48 term_use_all_terms(apm_t)
  49
  50 domain_use_interactive_fds(apm_t)
  51
  52 logging_send_syslog_msg(apm_t)
  53
  54 ########################################
  55 #
  56 # apm daemon Local policy
  57 #
  58
  59 # mknod: controlling an orderly resume of PCMCIA requires creating device
  60 # nodes 254,{0,1,2} for some reason.
  61 allow apmd_t self:capability { sys_admin sys_nice sys_time kill mknod };
  62 dontaudit apmd_t self:capability { setuid dac_override dac_read_search sys_ptrace sys_tty_config };
  63 allow apmd_t self:process { signal_perms getsession };
  64 allow apmd_t self:fifo_file rw_fifo_file_perms;
  65 allow apmd_t self:netlink_socket create_socket_perms;
  66 allow apmd_t self:unix_dgram_socket create_socket_perms;
  67 allow apmd_t self:unix_stream_socket create_stream_socket_perms;
  68
  69 allow apmd_t apmd_log_t:file manage_file_perms;
  70 logging_log_filetrans(apmd_t, apmd_log_t, file)
  71
  72 manage_dirs_pattern(apmd_t, apmd_tmp_t, apmd_tmp_t)
  73 manage_files_pattern(apmd_t, apmd_tmp_t, apmd_tmp_t)
  74 files_tmp_filetrans(apmd_t, apmd_tmp_t, { file dir })
  75
  76 manage_files_pattern(apmd_t, apmd_var_run_t, apmd_var_run_t)
  77 manage_sock_files_pattern(apmd_t, apmd_var_run_t, apmd_var_run_t)
  78 files_pid_filetrans(apmd_t, apmd_var_run_t, { file sock_file })
  79
  80 kernel_read_kernel_sysctls(apmd_t)
  81 kernel_rw_all_sysctls(apmd_t)
  82 kernel_read_system_state(apmd_t)
  83 kernel_write_proc_files(apmd_t)
  84
  85 dev_read_input(apmd_t)
  86 dev_read_realtime_clock(apmd_t)
  87 dev_read_urand(apmd_t)
  88 dev_rw_apm_bios(apmd_t)
  89 dev_rw_sysfs(apmd_t)
  90 dev_dontaudit_getattr_all_chr_files(apmd_t) # Excessive?
  91 dev_dontaudit_getattr_all_blk_files(apmd_t) # Excessive?
  92
  93 fs_dontaudit_list_tmpfs(apmd_t)
  94 fs_getattr_all_fs(apmd_t)
  95 fs_search_auto_mountpoints(apmd_t)
  96 fs_dontaudit_getattr_all_files(apmd_t) # Excessive?
  97 fs_dontaudit_getattr_all_symlinks(apmd_t) # Excessive?
  98 fs_dontaudit_getattr_all_pipes(apmd_t) # Excessive?
  99 fs_dontaudit_getattr_all_sockets(apmd_t) # Excessive?
 100
 101 selinux_search_fs(apmd_t)
 102
 103 corecmd_exec_all_executables(apmd_t)
 104
 105 domain_read_all_domains_state(apmd_t)
 106 domain_dontaudit_ptrace_all_domains(apmd_t)
 107 domain_use_interactive_fds(apmd_t)
 108 domain_dontaudit_getattr_all_sockets(apmd_t)
 109 domain_dontaudit_getattr_all_key_sockets(apmd_t) # Excessive?
 110 domain_dontaudit_list_all_domains_state(apmd_t) # Excessive?
 111
 112 files_exec_etc_files(apmd_t)
 113 files_read_etc_runtime_files(apmd_t)
 114 files_dontaudit_getattr_all_files(apmd_t) # Excessive?
 115 files_dontaudit_getattr_all_symlinks(apmd_t) # Excessive?
 116 files_dontaudit_getattr_all_pipes(apmd_t) # Excessive?
 117 files_dontaudit_getattr_all_sockets(apmd_t) # Excessive?
 118
 119 init_domtrans_script(apmd_t)
 120 init_rw_utmp(apmd_t)
 121 init_telinit(apmd_t)
 122
 123 libs_exec_ld_so(apmd_t)
 124 libs_exec_lib_files(apmd_t)
 125
 126 logging_send_syslog_msg(apmd_t)
 127 logging_send_audit_msgs(apmd_t)
 128
 129 miscfiles_read_localization(apmd_t)
 130 miscfiles_read_hwdata(apmd_t)
 131
 132 modutils_domtrans_insmod(apmd_t)
 133 modutils_read_module_config(apmd_t)
 134
 135 seutil_dontaudit_read_config(apmd_t)
 136
 137 userdom_dontaudit_use_unpriv_user_fds(apmd_t)
 138 userdom_dontaudit_search_user_home_dirs(apmd_t)
 139 userdom_dontaudit_search_user_home_content(apmd_t) # Excessive?
 140
 141 ifdef(`distro_redhat',`
 142         allow apmd_t apmd_lock_t:file manage_file_perms;
 143         files_lock_filetrans(apmd_t, apmd_lock_t, file)
 144
 145         can_exec(apmd_t, apmd_var_run_t)
 146
 147         optional_policy(`
 148                 fstools_domtrans(apmd_t)
 149         ')
 150
 151         optional_policy(`
 152                 iptables_domtrans(apmd_t)
 153         ')
 154
 155         optional_policy(`
 156                 netutils_domtrans(apmd_t)
 157         ')
 158
 159         # ifconfig_exec_t needs to be run in its own domain for Red Hat
 160         optional_policy(`
 161                 sssd_search_lib(apmd_t)
 162         ')
 163
 164         optional_policy(`
 165                 sysnet_domtrans_ifconfig(apmd_t)
 166         ')
 167
 168 ',`
 169         # for ifconfig which is run all the time
 170         kernel_dontaudit_search_sysctl(apmd_t)
 171 ')
 172
 173 ifdef(`distro_suse',`
 174         manage_dirs_pattern(apmd_t, apmd_var_lib_t, apmd_var_lib_t)
 175         manage_files_pattern(apmd_t, apmd_var_lib_t, apmd_var_lib_t)
 176         files_var_lib_filetrans(apmd_t, apmd_var_lib_t, file)
 177 ')
 178
 179 optional_policy(`
 180         automount_domtrans(apmd_t)
 181 ')
 182
 183 optional_policy(`
 184         clock_domtrans(apmd_t)
 185         clock_rw_adjtime(apmd_t)
 186 ')
 187
 188 optional_policy(`
 189         cron_system_entry(apmd_t, apmd_exec_t)
 190         cron_anacron_domtrans_system_job(apmd_t)
 191 ')
 192
 193 optional_policy(`
 194         dbus_system_bus_client(apmd_t)
 195
 196         optional_policy(`
 197                 consolekit_dbus_chat(apmd_t)
 198         ')
 199
 200         optional_policy(`
 201                 networkmanager_dbus_chat(apmd_t)
 202         ')
 203 ')
 204
 205 optional_policy(`
 206         logrotate_use_fds(apmd_t)
 207 ')
 208
 209 optional_policy(`
 210         mta_send_mail(apmd_t)
 211 ')
 212
 213 optional_policy(`
 214         nscd_socket_use(apmd_t)
 215 ')
 216
 217 optional_policy(`
 218         pcmcia_domtrans_cardmgr(apmd_t)
 219         pcmcia_domtrans_cardctl(apmd_t)
 220 ')
 221
 222 optional_policy(`
 223         seutil_sigchld_newrole(apmd_t)
 224 ')
 225
 226 optional_policy(`
 227         udev_read_db(apmd_t)
 228         udev_read_state(apmd_t) #necessary?
 229 ')
 230
 231 optional_policy(`
 232         unconfined_domain(apmd_t)
 233 ')
 234
 235 optional_policy(`
 236         vbetool_domtrans(apmd_t)
 237 ')
 238
 239 # cjp: related to sleep/resume (?)
 240 optional_policy(`
 241         xserver_domtrans(apmd_t)
 242 ')