policy/modules/system/modutils.te

   1 policy_module(modutils, 1.10.1)
   2
   3 gen_require(`
   4         bool secure_mode_insmod;
   5 ')
   6
   7 ########################################
   8 #
   9 # Declarations
  10 #
  11
  12 type depmod_t;
  13 type depmod_exec_t;
  14 init_system_domain(depmod_t, depmod_exec_t)
  15 role system_r types depmod_t;
  16
  17 type insmod_t;
  18 type insmod_exec_t;
  19 application_domain(insmod_t, insmod_exec_t)
  20 mls_file_write_all_levels(insmod_t)
  21 mls_process_write_down(insmod_t)
  22 role system_r types insmod_t;
  23
  24 # module loading config
  25 type modules_conf_t;
  26 files_config_file(modules_conf_t)
  27
  28 # module dependencies
  29 type modules_dep_t;
  30 files_type(modules_dep_t)
  31
  32 type update_modules_t;
  33 type update_modules_exec_t;
  34 init_system_domain(update_modules_t, update_modules_exec_t)
  35 role system_r types update_modules_t;
  36
  37 type update_modules_tmp_t;
  38 files_tmp_file(update_modules_tmp_t)
  39
  40 type insmod_tmpfs_t;
  41 files_tmpfs_file(insmod_tmpfs_t)
  42
  43 ########################################
  44 #
  45 # depmod local policy
  46 #
  47
  48 can_exec(depmod_t, depmod_exec_t)
  49
  50 # Read conf.modules.
  51 read_files_pattern(depmod_t, modules_conf_t, modules_conf_t)
  52
  53 allow depmod_t modules_dep_t:file manage_file_perms;
  54 files_kernel_modules_filetrans(depmod_t, modules_dep_t, file)
  55
  56 kernel_read_system_state(depmod_t)
  57
  58 corecmd_search_bin(depmod_t)
  59
  60 domain_use_interactive_fds(depmod_t)
  61
  62 files_delete_kernel_modules(depmod_t)
  63 files_read_kernel_symbol_table(depmod_t)
  64 files_read_kernel_modules(depmod_t)
  65 files_read_etc_runtime_files(depmod_t)
  66 files_read_etc_files(depmod_t)
  67 files_read_usr_src_files(depmod_t)
  68 files_list_usr(depmod_t)
  69 files_append_var_files(depmod_t)
  70 files_read_boot_files(depmod_t)
  71
  72 fs_getattr_xattr_fs(depmod_t)
  73
  74 term_use_console(depmod_t)
  75
  76 init_use_fds(depmod_t)
  77 init_use_script_fds(depmod_t)
  78 init_use_script_ptys(depmod_t)
  79
  80 userdom_use_inherited_user_terminals(depmod_t)
  81 # Read System.map from home directories.
  82 files_list_home(depmod_t)
  83 userdom_read_user_home_content_files(depmod_t)
  84 userdom_manage_user_tmp_files(depmod_t)
  85
  86 ifdef(`distro_ubuntu',`
  87         optional_policy(`
  88                 unconfined_domain(depmod_t)
  89         ')
  90 ')
  91
  92 tunable_policy(`use_nfs_home_dirs',`
  93         fs_read_nfs_files(depmod_t)
  94 ')
  95
  96 tunable_policy(`use_samba_home_dirs',`
  97         fs_read_cifs_files(depmod_t)
  98 ')
  99
 100 optional_policy(`
 101         rpm_rw_pipes(depmod_t)
 102         rpm_manage_script_tmp_files(depmod_t)
 103 ')
 104
 105 #optional_policy(`
 106 #       # Read System.map from home directories.
 107 #       unconfined_domain(depmod_t)
 108 #')
 109
 110 ########################################
 111 #
 112 # insmod local policy
 113 #
 114
 115 allow insmod_t self:capability { dac_override mknod net_raw sys_nice sys_tty_config };
 116 allow insmod_t self:process { execmem sigchld sigkill sigstop signull signal };
 117
 118 allow insmod_t self:udp_socket create_socket_perms;
 119 allow insmod_t self:rawip_socket create_socket_perms;
 120 allow insmod_t self:shm create_shm_perms;
 121
 122 # Read module config and dependency information
 123 list_dirs_pattern(insmod_t, modules_conf_t, modules_conf_t)
 124 read_files_pattern(insmod_t, modules_conf_t, modules_conf_t)
 125 list_dirs_pattern(insmod_t, modules_dep_t, modules_dep_t)
 126 read_files_pattern(insmod_t, modules_dep_t, modules_dep_t)
 127
 128 can_exec(insmod_t, insmod_exec_t)
 129
 130 manage_files_pattern(insmod_t,insmod_tmpfs_t,insmod_tmpfs_t)
 131 fs_tmpfs_filetrans(insmod_t,insmod_tmpfs_t,file)
 132
 133 kernel_load_module(insmod_t)
 134 kernel_request_load_module(insmod_t)
 135 kernel_read_system_state(insmod_t)
 136 kernel_read_network_state(insmod_t)
 137 kernel_write_proc_files(insmod_t)
 138 kernel_mount_debugfs(insmod_t)
 139 kernel_mount_kvmfs(insmod_t)
 140 kernel_read_debugfs(insmod_t)
 141 kernel_request_load_module(insmod_t)
 142 # Rules for /proc/sys/kernel/tainted
 143 kernel_read_kernel_sysctls(insmod_t)
 144 kernel_rw_kernel_sysctl(insmod_t)
 145 kernel_read_hotplug_sysctls(insmod_t)
 146 kernel_setsched(insmod_t)
 147
 148 corecmd_exec_bin(insmod_t)
 149 corecmd_exec_shell(insmod_t)
 150
 151 dev_rw_sysfs(insmod_t)
 152 dev_search_usbfs(insmod_t)
 153 dev_rw_mtrr(insmod_t)
 154 dev_read_urand(insmod_t)
 155 dev_rw_agp(insmod_t)
 156 dev_read_sound(insmod_t)
 157 dev_write_sound(insmod_t)
 158 dev_rw_apm_bios(insmod_t)
 159 dev_create_generic_chr_files(insmod_t)
 160
 161 domain_signal_all_domains(insmod_t)
 162 domain_use_interactive_fds(insmod_t)
 163
 164 files_read_kernel_modules(insmod_t)
 165 files_read_etc_runtime_files(insmod_t)
 166 files_read_etc_files(insmod_t)
 167 files_read_usr_files(insmod_t)
 168 files_exec_etc_files(insmod_t)
 169 # for nscd:
 170 files_dontaudit_search_pids(insmod_t)
 171 # for when /var is not mounted early in the boot:
 172 files_dontaudit_search_isid_type_dirs(insmod_t)
 173 # for locking: (cjp: ????)
 174 files_write_kernel_modules(insmod_t)
 175
 176 fs_getattr_xattr_fs(insmod_t)
 177 fs_dontaudit_use_tmpfs_chr_dev(insmod_t)
 178 fs_mount_rpc_pipefs(insmod_t)
 179 fs_search_rpc(insmod_t)
 180
 181 init_rw_initctl(insmod_t)
 182 init_use_fds(insmod_t)
 183 init_use_script_fds(insmod_t)
 184 init_use_script_ptys(insmod_t)
 185 init_spec_domtrans_script(insmod_t)
 186 init_rw_script_tmp_files(insmod_t)
 187
 188 logging_send_syslog_msg(insmod_t)
 189 logging_search_logs(insmod_t)
 190
 191 miscfiles_read_localization(insmod_t)
 192
 193 seutil_read_file_contexts(insmod_t)
 194
 195 term_use_all_inherited_terms(insmod_t)
 196 userdom_dontaudit_search_user_home_dirs(insmod_t)
 197
 198 if( ! secure_mode_insmod ) {
 199         kernel_domtrans_to(insmod_t, insmod_exec_t)
 200 }
 201
 202 optional_policy(`
 203         alsa_domtrans(insmod_t)
 204 ')
 205
 206 optional_policy(`
 207         firstboot_dontaudit_leaks(insmod_t)
 208 ')
 209
 210 optional_policy(`
 211         firewallgui_dontaudit_rw_pipes(insmod_t)
 212 ')
 213
 214 optional_policy(`
 215         hal_write_log(insmod_t)
 216 ')
 217
 218 optional_policy(`
 219         hotplug_search_config(insmod_t)
 220 ')
 221
 222 optional_policy(`
 223         mount_domtrans(insmod_t)
 224 ')
 225
 226 optional_policy(`
 227         nis_use_ypbind(insmod_t)
 228 ')
 229
 230 optional_policy(`
 231         nscd_socket_use(insmod_t)
 232 ')
 233
 234 optional_policy(`
 235         fs_manage_ramfs_files(insmod_t)
 236
 237         rhgb_use_fds(insmod_t)
 238         rhgb_dontaudit_use_ptys(insmod_t)
 239
 240         xserver_dontaudit_write_log(insmod_t)
 241         xserver_stream_connect(insmod_t)
 242         xserver_dontaudit_rw_stream_sockets(insmod_t)
 243
 244         ifdef(`hide_broken_symptoms',`
 245                 xserver_dontaudit_rw_tcp_sockets(insmod_t)
 246         ')
 247 ')
 248
 249 optional_policy(`
 250         rpm_rw_pipes(insmod_t)
 251 ')
 252
 253 optional_policy(`
 254         #unconfined_domain(insmod_t)
 255         unconfined_dontaudit_rw_pipes(insmod_t)
 256 ')
 257
 258 optional_policy(`
 259         virt_dontaudit_write_pipes(insmod_t)
 260 ')
 261
 262 optional_policy(`
 263         # cjp: why is this needed:
 264         dev_rw_xserver_misc(insmod_t)
 265
 266         xserver_getattr_log(insmod_t)
 267 ')
 268
 269 #################################
 270 #
 271 # update-modules local policy
 272 #
 273
 274 allow update_modules_t self:fifo_file rw_fifo_file_perms;
 275
 276 allow update_modules_t modules_dep_t:file rw_file_perms;
 277
 278 can_exec(update_modules_t, insmod_exec_t)
 279 can_exec(update_modules_t, update_modules_exec_t)
 280
 281 # manage module loading configuration
 282 manage_files_pattern(update_modules_t, modules_conf_t, modules_conf_t)
 283 files_kernel_modules_filetrans(update_modules_t, modules_conf_t, file)
 284 files_etc_filetrans(update_modules_t, modules_conf_t, file)
 285
 286 # transition to depmod
 287 domain_auto_trans(update_modules_t, depmod_exec_t, depmod_t)
 288 allow update_modules_t depmod_t:fd use;
 289 allow depmod_t update_modules_t:fd use;
 290 allow depmod_t update_modules_t:fifo_file rw_file_perms;
 291 allow depmod_t update_modules_t:process sigchld;
 292
 293 manage_dirs_pattern(update_modules_t, update_modules_tmp_t, update_modules_tmp_t)
 294 manage_files_pattern(update_modules_t, update_modules_tmp_t, update_modules_tmp_t)
 295 files_tmp_filetrans(update_modules_t, update_modules_tmp_t, { file dir })
 296
 297 kernel_read_kernel_sysctls(update_modules_t)
 298 kernel_read_system_state(update_modules_t)
 299
 300 corecmd_exec_bin(update_modules_t)
 301 corecmd_exec_shell(update_modules_t)
 302
 303 dev_read_urand(update_modules_t)
 304
 305 domain_use_interactive_fds(update_modules_t)
 306
 307 files_read_etc_runtime_files(update_modules_t)
 308 files_read_etc_files(update_modules_t)
 309 files_exec_etc_files(update_modules_t)
 310
 311 fs_getattr_xattr_fs(update_modules_t)
 312
 313 term_use_console(update_modules_t)
 314
 315 init_use_fds(update_modules_t)
 316 init_use_script_fds(update_modules_t)
 317 init_use_script_ptys(update_modules_t)
 318
 319 logging_send_syslog_msg(update_modules_t)
 320
 321 miscfiles_read_localization(update_modules_t)
 322
 323 userdom_use_inherited_user_terminals(update_modules_t)
 324 userdom_dontaudit_search_user_home_dirs(update_modules_t)
 325
 326 ifdef(`distro_gentoo',`
 327         files_search_pids(update_modules_t)
 328         files_getattr_usr_src_files(update_modules_t)
 329         files_list_isid_type_dirs(update_modules_t) # /var
 330
 331         # update-modules on Gentoo throws errors when run because it
 332         # sources /etc/init.d/functions.sh, which always scans
 333         # /var/lib/init.d to set SOFTLEVEL environment var.
 334         # This is never used by update-modules.
 335         files_dontaudit_search_var_lib(update_modules_t)
 336         init_dontaudit_read_script_status_files(update_modules_t)
 337
 338         optional_policy(`
 339                 consoletype_exec(update_modules_t)
 340         ')
 341 ')
 342
 343 ifdef(`distro_ubuntu',`
 344         optional_policy(`
 345                 unconfined_domain(update_modules_t)
 346         ')
 347 ')