policy/modules/system/modutils.te

   1 policy_module(modutils, 1.10.1)
   2
   3 ########################################
   4 #
   5 # Declarations
   6 #
   7
   8 type depmod_t;
   9 type depmod_exec_t;
  10 init_system_domain(depmod_t, depmod_exec_t)
  11 role system_r types depmod_t;
  12
  13 type insmod_t;
  14 type insmod_exec_t;
  15 application_domain(insmod_t, insmod_exec_t)
  16 mls_file_write_all_levels(insmod_t)
  17 mls_process_write_down(insmod_t)
  18 role system_r types insmod_t;
  19
  20 # module loading config
  21 type modules_conf_t;
  22 files_config_file(modules_conf_t)
  23
  24 # module dependencies
  25 type modules_dep_t;
  26 files_type(modules_dep_t)
  27
  28 type update_modules_t;
  29 type update_modules_exec_t;
  30 init_system_domain(update_modules_t, update_modules_exec_t)
  31 role system_r types update_modules_t;
  32
  33 type update_modules_tmp_t;
  34 files_tmp_file(update_modules_tmp_t)
  35
  36 type insmod_tmpfs_t;
  37 files_tmpfs_file(insmod_tmpfs_t)
  38
  39 ########################################
  40 #
  41 # depmod local policy
  42 #
  43
  44 can_exec(depmod_t, depmod_exec_t)
  45
  46 # Read conf.modules.
  47 read_files_pattern(depmod_t, modules_conf_t, modules_conf_t)
  48
  49 allow depmod_t modules_dep_t:file manage_file_perms;
  50 files_kernel_modules_filetrans(depmod_t, modules_dep_t, file)
  51
  52 kernel_read_system_state(depmod_t)
  53
  54 corecmd_search_bin(depmod_t)
  55
  56 domain_use_interactive_fds(depmod_t)
  57
  58 files_delete_kernel_modules(depmod_t)
  59 files_read_kernel_symbol_table(depmod_t)
  60 files_read_kernel_modules(depmod_t)
  61 files_read_etc_runtime_files(depmod_t)
  62 files_read_etc_files(depmod_t)
  63 files_read_usr_src_files(depmod_t)
  64 files_list_usr(depmod_t)
  65 files_append_var_files(depmod_t)
  66 files_read_boot_files(depmod_t)
  67
  68 fs_getattr_xattr_fs(depmod_t)
  69
  70 term_use_console(depmod_t)
  71
  72 init_use_fds(depmod_t)
  73 init_use_script_fds(depmod_t)
  74 init_use_script_ptys(depmod_t)
  75
  76 userdom_use_inherited_user_terminals(depmod_t)
  77 # Read System.map from home directories.
  78 files_list_home(depmod_t)
  79 userdom_read_user_home_content_files(depmod_t)
  80 userdom_manage_user_tmp_files(depmod_t)
  81
  82 ifdef(`distro_ubuntu',`
  83         optional_policy(`
  84                 unconfined_domain(depmod_t)
  85         ')
  86 ')
  87
  88 tunable_policy(`use_nfs_home_dirs',`
  89         fs_read_nfs_files(depmod_t)
  90 ')
  91
  92 tunable_policy(`use_samba_home_dirs',`
  93         fs_read_cifs_files(depmod_t)
  94 ')
  95
  96 optional_policy(`
  97         bootloader_rw_tmp_files(insmod_t)
  98 ')
  99
 100 optional_policy(`
 101         rpm_rw_pipes(depmod_t)
 102         rpm_manage_script_tmp_files(depmod_t)
 103 ')
 104
 105 optional_policy(`
 106         unconfined_domain(depmod_t)
 107 ')
 108
 109 ########################################
 110 #
 111 # insmod local policy
 112 #
 113
 114 allow insmod_t self:capability { dac_override mknod net_raw sys_nice sys_tty_config };
 115 allow insmod_t self:process { execmem sigchld sigkill sigstop signull signal };
 116
 117 allow insmod_t self:udp_socket create_socket_perms;
 118 allow insmod_t self:rawip_socket create_socket_perms;
 119 allow insmod_t self:shm create_shm_perms;
 120
 121 # Read module config and dependency information
 122 list_dirs_pattern(insmod_t, modules_conf_t, modules_conf_t)
 123 read_files_pattern(insmod_t, modules_conf_t, modules_conf_t)
 124 list_dirs_pattern(insmod_t, modules_dep_t, modules_dep_t)
 125 read_files_pattern(insmod_t, modules_dep_t, modules_dep_t)
 126
 127 can_exec(insmod_t, insmod_exec_t)
 128
 129 manage_files_pattern(insmod_t,insmod_tmpfs_t,insmod_tmpfs_t)
 130 fs_tmpfs_filetrans(insmod_t,insmod_tmpfs_t,file)
 131
 132 kernel_load_module(insmod_t)
 133 kernel_request_load_module(insmod_t)
 134 kernel_read_system_state(insmod_t)
 135 kernel_read_network_state(insmod_t)
 136 kernel_write_proc_files(insmod_t)
 137 kernel_mount_debugfs(insmod_t)
 138 kernel_mount_kvmfs(insmod_t)
 139 kernel_read_debugfs(insmod_t)
 140 kernel_request_load_module(insmod_t)
 141 # Rules for /proc/sys/kernel/tainted
 142 kernel_read_kernel_sysctls(insmod_t)
 143 kernel_rw_kernel_sysctl(insmod_t)
 144 kernel_read_hotplug_sysctls(insmod_t)
 145 kernel_setsched(insmod_t)
 146
 147 corecmd_exec_bin(insmod_t)
 148 corecmd_exec_shell(insmod_t)
 149
 150 dev_rw_sysfs(insmod_t)
 151 dev_search_usbfs(insmod_t)
 152 dev_rw_mtrr(insmod_t)
 153 dev_read_urand(insmod_t)
 154 dev_rw_agp(insmod_t)
 155 dev_read_sound(insmod_t)
 156 dev_write_sound(insmod_t)
 157 dev_rw_apm_bios(insmod_t)
 158 dev_create_generic_chr_files(insmod_t)
 159
 160 domain_signal_all_domains(insmod_t)
 161 domain_use_interactive_fds(insmod_t)
 162
 163 files_read_kernel_modules(insmod_t)
 164 files_read_etc_runtime_files(insmod_t)
 165 files_read_etc_files(insmod_t)
 166 files_read_usr_files(insmod_t)
 167 files_exec_etc_files(insmod_t)
 168 # for nscd:
 169 files_dontaudit_search_pids(insmod_t)
 170 # for when /var is not mounted early in the boot:
 171 files_dontaudit_search_isid_type_dirs(insmod_t)
 172 # for locking: (cjp: ????)
 173 files_write_kernel_modules(insmod_t)
 174
 175 fs_getattr_xattr_fs(insmod_t)
 176 fs_dontaudit_use_tmpfs_chr_dev(insmod_t)
 177 fs_mount_rpc_pipefs(insmod_t)
 178 fs_search_rpc(insmod_t)
 179
 180 auth_use_nsswitch(insmod_t)
 181
 182 init_rw_initctl(insmod_t)
 183 init_use_fds(insmod_t)
 184 init_use_script_fds(insmod_t)
 185 init_use_script_ptys(insmod_t)
 186 init_spec_domtrans_script(insmod_t)
 187 init_rw_script_tmp_files(insmod_t)
 188 init_dontaudit_getattr_stream_socket(insmod_t)
 189
 190 logging_send_syslog_msg(insmod_t)
 191 logging_search_logs(insmod_t)
 192
 193 miscfiles_read_localization(insmod_t)
 194
 195 seutil_read_file_contexts(insmod_t)
 196
 197 term_use_all_inherited_terms(insmod_t)
 198 userdom_dontaudit_search_user_home_dirs(insmod_t)
 199
 200 kernel_domtrans_to(insmod_t, insmod_exec_t)
 201
 202 optional_policy(`
 203         alsa_domtrans(insmod_t)
 204 ')
 205
 206 optional_policy(`
 207         devicekit_use_fds_disk(insmod_t)
 208         devicekit_dontaudit_read_pid_files(insmod_t)
 209 ')
 210
 211 optional_policy(`
 212         firstboot_dontaudit_leaks(insmod_t)
 213 ')
 214
 215 optional_policy(`
 216         firewallgui_dontaudit_rw_pipes(insmod_t)
 217 ')
 218
 219 optional_policy(`
 220         hal_write_log(insmod_t)
 221 ')
 222
 223 optional_policy(`
 224         hotplug_search_config(insmod_t)
 225 ')
 226
 227 optional_policy(`
 228         mount_domtrans(insmod_t)
 229 ')
 230
 231 optional_policy(`
 232         fs_manage_ramfs_files(insmod_t)
 233
 234         rhgb_use_fds(insmod_t)
 235         rhgb_dontaudit_use_ptys(insmod_t)
 236
 237         xserver_dontaudit_write_log(insmod_t)
 238         xserver_stream_connect(insmod_t)
 239         xserver_dontaudit_rw_stream_sockets(insmod_t)
 240
 241         ifdef(`hide_broken_symptoms',`
 242                 xserver_dontaudit_rw_tcp_sockets(insmod_t)
 243         ')
 244 ')
 245
 246 optional_policy(`
 247         rpm_rw_pipes(insmod_t)
 248 ')
 249
 250 optional_policy(`
 251         unconfined_domain(insmod_t)
 252         unconfined_dontaudit_rw_pipes(insmod_t)
 253 ')
 254
 255 optional_policy(`
 256         virt_dontaudit_write_pipes(insmod_t)
 257 ')
 258
 259 optional_policy(`
 260         # cjp: why is this needed:
 261         dev_rw_xserver_misc(insmod_t)
 262
 263         xserver_getattr_log(insmod_t)
 264 ')
 265
 266 #################################
 267 #
 268 # update-modules local policy
 269 #
 270
 271 allow update_modules_t self:fifo_file rw_fifo_file_perms;
 272
 273 allow update_modules_t modules_dep_t:file rw_file_perms;
 274
 275 can_exec(update_modules_t, insmod_exec_t)
 276 can_exec(update_modules_t, update_modules_exec_t)
 277
 278 # manage module loading configuration
 279 manage_files_pattern(update_modules_t, modules_conf_t, modules_conf_t)
 280 files_kernel_modules_filetrans(update_modules_t, modules_conf_t, file)
 281 files_etc_filetrans(update_modules_t, modules_conf_t, file)
 282
 283 # transition to depmod
 284 domain_auto_trans(update_modules_t, depmod_exec_t, depmod_t)
 285 allow update_modules_t depmod_t:fd use;
 286 allow depmod_t update_modules_t:fd use;
 287 allow depmod_t update_modules_t:fifo_file rw_file_perms;
 288 allow depmod_t update_modules_t:process sigchld;
 289
 290 manage_dirs_pattern(update_modules_t, update_modules_tmp_t, update_modules_tmp_t)
 291 manage_files_pattern(update_modules_t, update_modules_tmp_t, update_modules_tmp_t)
 292 files_tmp_filetrans(update_modules_t, update_modules_tmp_t, { file dir })
 293
 294 kernel_read_kernel_sysctls(update_modules_t)
 295 kernel_read_system_state(update_modules_t)
 296
 297 corecmd_exec_bin(update_modules_t)
 298 corecmd_exec_shell(update_modules_t)
 299
 300 dev_read_urand(update_modules_t)
 301
 302 domain_use_interactive_fds(update_modules_t)
 303
 304 files_read_etc_runtime_files(update_modules_t)
 305 files_read_etc_files(update_modules_t)
 306 files_exec_etc_files(update_modules_t)
 307
 308 fs_getattr_xattr_fs(update_modules_t)
 309
 310 term_use_console(update_modules_t)
 311
 312 init_use_fds(update_modules_t)
 313 init_use_script_fds(update_modules_t)
 314 init_use_script_ptys(update_modules_t)
 315
 316 logging_send_syslog_msg(update_modules_t)
 317
 318 miscfiles_read_localization(update_modules_t)
 319
 320 userdom_use_inherited_user_terminals(update_modules_t)
 321 userdom_dontaudit_search_user_home_dirs(update_modules_t)
 322
 323 ifdef(`distro_gentoo',`
 324         files_search_pids(update_modules_t)
 325         files_getattr_usr_src_files(update_modules_t)
 326         files_list_isid_type_dirs(update_modules_t) # /var
 327
 328         # update-modules on Gentoo throws errors when run because it
 329         # sources /etc/init.d/functions.sh, which always scans
 330         # /var/lib/init.d to set SOFTLEVEL environment var.
 331         # This is never used by update-modules.
 332         files_dontaudit_search_var_lib(update_modules_t)
 333         init_dontaudit_read_script_status_files(update_modules_t)
 334
 335         optional_policy(`
 336                 consoletype_exec(update_modules_t)
 337         ')
 338 ')
 339
 340 ifdef(`distro_ubuntu',`
 341         optional_policy(`
 342                 unconfined_domain(update_modules_t)
 343         ')
 344 ')