policy/modules/system/libraries.te

   1
   2 policy_module(libraries, 2.7.0)
   3
   4 ########################################
   5 #
   6 # Declarations
   7 #
   8
   9 #
  10 # ld_so_cache_t is the type of /etc/ld.so.cache.
  11 #
  12 type ld_so_cache_t;
  13 files_type(ld_so_cache_t)
  14
  15 #
  16 # ld_so_t is the type of the system dynamic loaders.
  17 #
  18 type ld_so_t;
  19 files_type(ld_so_t)
  20
  21 type ldconfig_t;
  22 type ldconfig_exec_t;
  23 init_system_domain(ldconfig_t, ldconfig_exec_t)
  24 role system_r types ldconfig_t;
  25
  26 type ldconfig_cache_t;
  27 files_type(ldconfig_cache_t)
  28
  29 type ldconfig_tmp_t;
  30 files_tmp_file(ldconfig_tmp_t)
  31
  32 #
  33 # lib_t is the type of files in the system lib directories.
  34 #
  35 type lib_t alias shlib_t;
  36 files_type(lib_t)
  37
  38 #
  39 # textrel_shlib_t is the type of shared objects in the system lib
  40 # directories, which require text relocation.
  41 #
  42 type textrel_shlib_t alias texrel_shlib_t;
  43 files_type(textrel_shlib_t)
  44
  45 ifdef(`distro_gentoo',`
  46         # openrc unfortunately mounts a tmpfs
  47         # at /lib/rc/
  48         files_mountpoint(lib_t)
  49 ')
  50
  51 optional_policy(`
  52         postgresql_loadable_module(lib_t)
  53         postgresql_loadable_module(textrel_shlib_t)
  54 ')
  55
  56 ########################################
  57 #
  58 # ldconfig local policy
  59 #
  60
  61 allow ldconfig_t self:capability { dac_override sys_chroot };
  62
  63 manage_files_pattern(ldconfig_t, ldconfig_cache_t, ldconfig_cache_t)
  64
  65 allow ldconfig_t ld_so_cache_t:file manage_file_perms;
  66 files_etc_filetrans(ldconfig_t, ld_so_cache_t, file)
  67
  68 manage_dirs_pattern(ldconfig_t, ldconfig_tmp_t, ldconfig_tmp_t)
  69 manage_files_pattern(ldconfig_t, ldconfig_tmp_t, ldconfig_tmp_t)
  70 manage_lnk_files_pattern(ldconfig_t, ldconfig_tmp_t, ldconfig_tmp_t)
  71 files_tmp_filetrans(ldconfig_t, ldconfig_tmp_t, { file dir lnk_file })
  72
  73 manage_lnk_files_pattern(ldconfig_t, lib_t, lib_t)
  74
  75 kernel_read_system_state(ldconfig_t)
  76
  77 fs_getattr_xattr_fs(ldconfig_t)
  78
  79 corecmd_search_bin(ldconfig_t)
  80
  81 domain_use_interactive_fds(ldconfig_t)
  82
  83 files_search_var_lib(ldconfig_t)
  84 files_read_etc_files(ldconfig_t)
  85 files_read_usr_files(ldconfig_t)
  86 files_search_tmp(ldconfig_t)
  87 files_search_usr(ldconfig_t)
  88 # for when /etc/ld.so.cache is mislabeled:
  89 files_delete_etc_files(ldconfig_t)
  90
  91 init_use_script_ptys(ldconfig_t)
  92 init_read_script_tmp_files(ldconfig_t)
  93
  94 miscfiles_read_localization(ldconfig_t)
  95
  96 logging_send_syslog_msg(ldconfig_t)
  97
  98 userdom_use_user_terminals(ldconfig_t)
  99 userdom_use_all_users_fds(ldconfig_t)
 100
 101 ifdef(`distro_ubuntu',`
 102         optional_policy(`
 103                 unconfined_domain(ldconfig_t)
 104         ')
 105 ')
 106
 107 ifdef(`hide_broken_symptoms',`
 108         ifdef(`distro_gentoo',`
 109                 # leaked fds from portage
 110                 files_dontaudit_rw_var_files(ldconfig_t)
 111
 112                 optional_policy(`
 113                         portage_dontaudit_search_tmp(ldconfig_t)
 114                         portage_dontaudit_rw_tmp_files(ldconfig_t)
 115                 ')
 116         ')
 117
 118         optional_policy(`
 119                 unconfined_dontaudit_rw_tcp_sockets(ldconfig_t)
 120         ')
 121 ')
 122
 123 optional_policy(`
 124         # dontaudit access to /usr/lib/apache, normal programs cannot read these libs anyway
 125         apache_dontaudit_search_modules(ldconfig_t)
 126 ')
 127
 128 optional_policy(`
 129         apt_rw_pipes(ldconfig_t)
 130         apt_use_fds(ldconfig_t)
 131         apt_use_ptys(ldconfig_t)
 132 ')
 133
 134 optional_policy(`
 135         puppet_rw_tmp(ldconfig_t)
 136 ')
 137
 138 optional_policy(`
 139         # When you install a kernel the postinstall builds a initrd image in tmp
 140         # and executes ldconfig on it. If you dont allow this kernel installs
 141         # blow up.
 142         rpm_manage_script_tmp_files(ldconfig_t)
 143 ')
 144
 145 optional_policy(`
 146         unconfined_domain(ldconfig_t)
 147 ')