policy/modules/system/udev.te

   1
   2 policy_module(udev, 1.12.0)
   3
   4 ########################################
   5 #
   6 # Declarations
   7 #
   8
   9 type udev_t;
  10 type udev_exec_t;
  11 type udev_helper_exec_t;
  12 kernel_domtrans_to(udev_t, udev_exec_t)
  13 domain_obj_id_change_exemption(udev_t)
  14 domain_entry_file(udev_t, udev_helper_exec_t)
  15 domain_interactive_fd(udev_t)
  16 init_daemon_domain(udev_t, udev_exec_t)
  17
  18 type udev_etc_t alias etc_udev_t;
  19 files_config_file(udev_etc_t)
  20
  21 type udev_tbl_t alias udev_tdb_t;
  22 files_type(udev_tbl_t)
  23
  24 type udev_rules_t;
  25 files_type(udev_rules_t)
  26
  27 type udev_var_run_t;
  28 files_pid_file(udev_var_run_t)
  29
  30 ifdef(`enable_mcs',`
  31         kernel_ranged_domtrans_to(udev_t, udev_exec_t, s0 - mcs_systemhigh)
  32         init_ranged_daemon_domain(udev_t, udev_exec_t, s0 - mcs_systemhigh)
  33 ')
  34
  35 ########################################
  36 #
  37 # Local policy
  38 #
  39
  40 allow udev_t self:capability { chown dac_override dac_read_search fowner fsetid sys_admin mknod net_raw net_admin sys_nice sys_rawio sys_resource setuid setgid sys_nice sys_ptrace };
  41 dontaudit udev_t self:capability sys_tty_config;
  42 allow udev_t self:process ~{ setcurrent setexec setfscreate setrlimit execmem execstack execheap };
  43 allow udev_t self:process { execmem setfscreate };
  44 allow udev_t self:fd use;
  45 allow udev_t self:fifo_file rw_fifo_file_perms;
  46 allow udev_t self:sock_file read_sock_file_perms;
  47 allow udev_t self:shm create_shm_perms;
  48 allow udev_t self:sem create_sem_perms;
  49 allow udev_t self:msgq create_msgq_perms;
  50 allow udev_t self:msg { send receive };
  51 allow udev_t self:unix_stream_socket { listen accept };
  52 allow udev_t self:unix_dgram_socket sendto;
  53 allow udev_t self:unix_stream_socket connectto;
  54 allow udev_t self:netlink_kobject_uevent_socket create_socket_perms;
  55 allow udev_t self:rawip_socket create_socket_perms;
  56
  57 allow udev_t udev_exec_t:file write;
  58 can_exec(udev_t, udev_exec_t)
  59
  60 allow udev_t udev_helper_exec_t:dir list_dir_perms;
  61 can_exec(udev_t, udev_helper_exec_t)
  62
  63 # read udev config
  64 allow udev_t udev_etc_t:file read_file_perms;
  65
  66 # create udev database in /dev/.udevdb
  67 allow udev_t udev_tbl_t:file manage_file_perms;
  68 dev_filetrans(udev_t, udev_tbl_t, file)
  69
  70 list_dirs_pattern(udev_t, udev_rules_t, udev_rules_t)
  71 read_files_pattern(udev_t, udev_rules_t, udev_rules_t)
  72
  73 manage_dirs_pattern(udev_t, udev_var_run_t, udev_var_run_t)
  74 manage_files_pattern(udev_t, udev_var_run_t, udev_var_run_t)
  75 manage_lnk_files_pattern(udev_t, udev_var_run_t, udev_var_run_t)
  76 files_pid_filetrans(udev_t, udev_var_run_t, { dir file })
  77
  78 kernel_read_system_state(udev_t)
  79 kernel_request_load_module(udev_t)
  80 kernel_getattr_core_if(udev_t)
  81 kernel_use_fds(udev_t)
  82 kernel_read_device_sysctls(udev_t)
  83 kernel_read_hotplug_sysctls(udev_t)
  84 kernel_read_modprobe_sysctls(udev_t)
  85 kernel_read_kernel_sysctls(udev_t)
  86 kernel_rw_hotplug_sysctls(udev_t)
  87 kernel_rw_unix_dgram_sockets(udev_t)
  88 kernel_dgram_send(udev_t)
  89 kernel_signal(udev_t)
  90 kernel_search_debugfs(udev_t)
  91
  92 #https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=235182
  93 kernel_rw_net_sysctls(udev_t)
  94 kernel_read_network_state(udev_t)
  95 kernel_read_software_raid_state(udev_t)
  96
  97 corecmd_exec_all_executables(udev_t)
  98
  99 dev_rw_sysfs(udev_t)
 100 dev_manage_all_dev_nodes(udev_t)
 101 dev_rw_generic_files(udev_t)
 102 dev_delete_generic_files(udev_t)
 103 dev_search_usbfs(udev_t)
 104 dev_relabel_all_dev_nodes(udev_t)
 105 # udev_node.c/node_symlink() symlink labels are explicitly
 106 # preserved, instead of short circuiting the relabel
 107 dev_relabel_generic_symlinks(udev_t)
 108 dev_manage_generic_symlinks(udev_t)
 109
 110 domain_read_all_domains_state(udev_t)
 111 domain_dontaudit_ptrace_all_domains(udev_t) #pidof triggers these
 112
 113 files_read_usr_files(udev_t)
 114 files_read_etc_runtime_files(udev_t)
 115 files_read_etc_files(udev_t)
 116 files_exec_etc_files(udev_t)
 117 files_dontaudit_search_isid_type_dirs(udev_t)
 118 files_getattr_generic_locks(udev_t)
 119 files_search_mnt(udev_t)
 120
 121 fs_getattr_all_fs(udev_t)
 122 fs_list_inotifyfs(udev_t)
 123 fs_rw_anon_inodefs_files(udev_t)
 124
 125 mcs_ptrace_all(udev_t)
 126
 127 mls_file_read_all_levels(udev_t)
 128 mls_file_write_all_levels(udev_t)
 129 mls_file_upgrade(udev_t)
 130 mls_file_downgrade(udev_t)
 131 mls_process_write_down(udev_t)
 132
 133 selinux_get_fs_mount(udev_t)
 134 selinux_validate_context(udev_t)
 135 selinux_compute_access_vector(udev_t)
 136 selinux_compute_create_context(udev_t)
 137 selinux_compute_relabel_context(udev_t)
 138 selinux_compute_user_contexts(udev_t)
 139
 140 auth_read_pam_console_data(udev_t)
 141 auth_domtrans_pam_console(udev_t)
 142 auth_use_nsswitch(udev_t)
 143
 144 init_read_utmp(udev_t)
 145 init_dontaudit_write_utmp(udev_t)
 146 init_getattr_initctl(udev_t)
 147
 148 logging_search_logs(udev_t)
 149 logging_send_syslog_msg(udev_t)
 150 logging_send_audit_msgs(udev_t)
 151
 152 miscfiles_read_localization(udev_t)
 153 miscfiles_read_hwdata(udev_t)
 154
 155 modutils_domtrans_insmod(udev_t)
 156 # read modules.inputmap:
 157 modutils_read_module_deps(udev_t)
 158
 159 seutil_read_config(udev_t)
 160 seutil_read_default_contexts(udev_t)
 161 seutil_read_file_contexts(udev_t)
 162 seutil_domtrans_setfiles(udev_t)
 163
 164 sysnet_domtrans_ifconfig(udev_t)
 165 sysnet_domtrans_dhcpc(udev_t)
 166 sysnet_rw_dhcp_config(udev_t)
 167 sysnet_read_dhcpc_pid(udev_t)
 168 sysnet_delete_dhcpc_pid(udev_t)
 169 sysnet_signal_dhcpc(udev_t)
 170 sysnet_manage_config(udev_t)
 171 sysnet_etc_filetrans_config(udev_t)
 172
 173 userdom_dontaudit_search_user_home_content(udev_t)
 174
 175 ifdef(`distro_gentoo',`
 176         # during boot, init scripts use /dev/.rcsysinit
 177         # existance to determine if we are in early booting
 178         init_getattr_script_status_files(udev_t)
 179 ')
 180
 181 ifdef(`distro_redhat',`
 182         fs_manage_tmpfs_dirs(udev_t)
 183         fs_manage_tmpfs_files(udev_t)
 184         fs_manage_tmpfs_symlinks(udev_t)
 185         fs_manage_tmpfs_sockets(udev_t)
 186         fs_manage_tmpfs_blk_files(udev_t)
 187         fs_manage_tmpfs_chr_files(udev_t)
 188         fs_relabel_tmpfs_blk_file(udev_t)
 189         fs_relabel_tmpfs_chr_file(udev_t)
 190
 191         term_search_ptys(udev_t)
 192
 193         # for arping used for static IP addresses on PCMCIA ethernet
 194         netutils_domtrans(udev_t)
 195
 196         optional_policy(`
 197                 unconfined_domain(udev_t)
 198         ')
 199 ')
 200
 201 optional_policy(`
 202         alsa_domtrans(udev_t)
 203         alsa_read_lib(udev_t)
 204         alsa_read_rw_config(udev_t)
 205 ')
 206
 207 optional_policy(`
 208         bluetooth_domtrans(udev_t)
 209 ')
 210
 211 optional_policy(`
 212         brctl_domtrans(udev_t)
 213 ')
 214
 215 optional_policy(`
 216         clock_domtrans(udev_t)
 217 ')
 218
 219 optional_policy(`
 220         consoletype_exec(udev_t)
 221 ')
 222
 223 optional_policy(`
 224         cups_domtrans_config(udev_t)
 225 ')
 226
 227 optional_policy(`
 228         dbus_system_bus_client(udev_t)
 229 ')
 230
 231 optional_policy(`
 232         devicekit_read_pid_files(udev_t)
 233         devicekit_dgram_send(udev_t)
 234 ')
 235
 236 optional_policy(`
 237         lvm_domtrans(udev_t)
 238 ')
 239
 240 optional_policy(`
 241         fstools_domtrans(udev_t)
 242 ')
 243
 244 optional_policy(`
 245         hal_dgram_send(udev_t)
 246
 247         ifdef(`hide_broken_symptoms',`
 248                 hal_dontaudit_rw_dgram_sockets(udev_t)
 249         ')
 250 ')
 251
 252 optional_policy(`
 253         hotplug_read_config(udev_t)
 254         # usb.agent searches /var/run/usb
 255         hotplug_search_pids(udev_t)
 256 ')
 257
 258 optional_policy(`
 259         mount_domtrans(udev_t)
 260 ')
 261
 262 optional_policy(`
 263         openct_read_pid_files(udev_t)
 264         openct_domtrans(udev_t)
 265 ')
 266
 267 optional_policy(`
 268         pcscd_read_pub_files(udev_t)
 269         pcscd_domtrans(udev_t)
 270 ')
 271
 272 optional_policy(`
 273         raid_domtrans_mdadm(udev_t)
 274 ')
 275
 276 optional_policy(`
 277         unconfined_signal(udev_t)
 278 ')
 279
 280 optional_policy(`
 281         vbetool_domtrans(udev_t)
 282 ')
 283
 284 optional_policy(`
 285         kernel_write_xen_state(udev_t)
 286         kernel_read_xen_state(udev_t)
 287         xen_manage_log(udev_t)
 288         xen_read_image_files(udev_t)
 289 ')
 290
 291 optional_policy(`
 292         xserver_read_xdm_pid(udev_t)
 293 ')