policy/modules/system/application.if

   1 ## <summary>Policy for user executable applications.</summary>
   2
   3 ########################################
   4 ## <summary>
   5 ##      Make the specified type usable as an application domain.
   6 ## </summary>
   7 ## <param name="type">
   8 ##      <summary>
   9 ##      Type to be used as a domain type.
  10 ##      </summary>
  11 ## </param>
  12 #
  13 interface(`application_type',`
  14         gen_require(`
  15                 attribute application_domain_type;
  16         ')
  17
  18         typeattribute $1 application_domain_type;
  19
  20         # start with basic domain
  21         domain_type($1)
  22 ')
  23
  24 ########################################
  25 ## <summary>
  26 ##      Make the specified type usable for files
  27 ##      that are exectuables, such as binary programs.
  28 ##      This does not include shared libraries.
  29 ## </summary>
  30 ## <param name="type">
  31 ##      <summary>
  32 ##      Type to be used for files.
  33 ##      </summary>
  34 ## </param>
  35 #
  36 interface(`application_executable_file',`
  37         gen_require(`
  38                 attribute application_exec_type;
  39         ')
  40
  41         typeattribute $1 application_exec_type;
  42
  43         corecmd_executable_file($1)
  44 ')
  45
  46 ########################################
  47 ## <summary>
  48 ## Execute application executables in the caller domain.
  49 ## </summary>
  50 ## <param name="type">
  51 ##      <summary>
  52 ##      Domain allowed access.
  53 ##      </summary>
  54 ## </param>
  55 #
  56 interface(`application_exec',`
  57         gen_require(`
  58                 attribute application_exec_type;
  59         ')
  60
  61         can_exec($1, application_exec_type)
  62 ')
  63
  64 ########################################
  65 ## <summary>
  66 ##      Execute all executable files.
  67 ## </summary>
  68 ## <param name="domain">
  69 ##      <summary>
  70 ##      Domain allowed access.
  71 ##      </summary>
  72 ## </param>
  73 ## <rolecap/>
  74 #
  75 interface(`application_exec_all',`
  76         corecmd_dontaudit_exec_all_executables($1)
  77         corecmd_exec_bin($1)
  78         corecmd_exec_shell($1)
  79         corecmd_exec_chroot($1)
  80
  81         application_exec($1)
  82 ')
  83
  84 ########################################
  85 ## <summary>
  86 ##      Create a domain for applications.
  87 ## </summary>
  88 ## <desc>
  89 ##      <p>
  90 ##      Create a domain for applications.  Typically these are
  91 ##      programs that are run interactively.
  92 ##      </p>
  93 ##      <p>
  94 ##      The types will be made usable as a domain and file, making
  95 ##      calls to domain_type() and files_type() redundant.
  96 ##      </p>
  97 ## </desc>
  98 ## <param name="domain">
  99 ##      <summary>
 100 ##      Type to be used as an application domain.
 101 ##      </summary>
 102 ## </param>
 103 ## <param name="entry_point">
 104 ##      <summary>
 105 ##      Type of the program to be used as an entry point to this domain.
 106 ##      </summary>
 107 ## </param>
 108 ## <infoflow type="none"/>
 109 #
 110 interface(`application_domain',`
 111         application_type($1)
 112         application_executable_file($2)
 113         domain_entry_file($1, $2)
 114 ')
 115
 116 ########################################
 117 ## <summary>
 118 ##      Send null signals to all application domains.
 119 ## </summary>
 120 ## <param name="domain">
 121 ##      <summary>
 122 ##      Domain allowed access.
 123 ##      </summary>
 124 ## </param>
 125 #
 126 interface(`application_signull',`
 127         gen_require(`
 128                 attribute application_domain_type;
 129         ')
 130
 131         allow $1 application_domain_type:process signull;
 132 ')
 133
 134 ########################################
 135 ## <summary>
 136 ##      Do not audit attempts to send null signals
 137 ##      to all application domains.
 138 ## </summary>
 139 ## <param name="domain">
 140 ##      <summary>
 141 ##      Domain to not audit.
 142 ##      </summary>
 143 ## </param>
 144 #
 145 interface(`application_dontaudit_signull',`
 146         gen_require(`
 147                 attribute application_domain_type;
 148         ')
 149
 150         dontaudit $1 application_domain_type:process signull;
 151 ')
 152
 153 ########################################
 154 ## <summary>
 155 ##      Send general signals to all application domains.
 156 ## </summary>
 157 ## <param name="domain">
 158 ##      <summary>
 159 ##      Domain allowed access.
 160 ##      </summary>
 161 ## </param>
 162 #
 163 interface(`application_signal',`
 164         gen_require(`
 165                 attribute application_domain_type;
 166         ')
 167
 168         allow $1 application_domain_type:process signal;
 169 ')
 170
 171 ########################################
 172 ## <summary>
 173 ##      Do not audit attempts to send general signals
 174 ##      to all application domains.
 175 ## </summary>
 176 ## <param name="domain">
 177 ##      <summary>
 178 ##      Domain to not audit.
 179 ##      </summary>
 180 ## </param>
 181 #
 182 interface(`application_dontaudit_signal',`
 183         gen_require(`
 184                 attribute application_domain_type;
 185         ')
 186
 187         dontaudit $1 application_domain_type:process signal;
 188 ')
 189
 190 ########################################
 191 ## <summary>
 192 ##      Do not audit attempts to send kill signals
 193 ##      to all application domains.
 194 ## </summary>
 195 ## <param name="domain">
 196 ##      <summary>
 197 ##      Domain to not audit.
 198 ##      </summary>
 199 ## </param>
 200 #
 201 interface(`application_dontaudit_sigkill',`
 202         gen_require(`
 203                 attribute application_domain_type;
 204         ')
 205
 206         dontaudit $1 application_domain_type:process sigkill;
 207 ')
 208
 209 #######################################
 210 ## <summary>
 211 ##  Getattr all application sockets.
 212 ## </summary>
 213 ## <param name="domain">
 214 ##  <summary>
 215 ##  Domain allowed access.
 216 ##  </summary>
 217 ## </param>
 218 #
 219 interface(`application_getattr_socket',`
 220     gen_require(`
 221         attribute application_domain_type;
 222     ')
 223
 224     allow $1 application_domain_type:socket_class_set getattr;
 225 ')