policy/modules/apps/games.te

   1 policy_module(games, 2.1.0)
   2
   3 ########################################
   4 #
   5 # Declarations
   6 #
   7
   8 type games_t;
   9 type games_exec_t;
  10 typealias games_t alias { user_games_t staff_games_t sysadm_games_t };
  11 typealias games_t alias { auditadm_games_t secadm_games_t };
  12 application_domain(games_t, games_exec_t)
  13 ubac_constrained(games_t)
  14
  15 type games_data_t;
  16 typealias games_data_t alias { user_games_data_t staff_games_data_t sysadm_games_data_t };
  17 typealias games_data_t alias { auditadm_games_data_t secadm_games_data_t };
  18 files_type(games_data_t)
  19 ubac_constrained(games_data_t)
  20
  21 type games_devpts_t;
  22 typealias games_devpts_t alias { user_games_devpts_t staff_games_devpts_t sysadm_games_devpts_t };
  23 typealias games_devpts_t alias { auditadm_games_devpts_t secadm_games_devpts_t };
  24 term_pty(games_devpts_t)
  25 ubac_constrained(games_devpts_t)
  26
  27 # games_srv_t is for system operation of games, generic games daemons and
  28 # games recovery scripts
  29 type games_srv_t;
  30 init_system_domain(games_srv_t, games_exec_t)
  31
  32 type games_srv_var_run_t;
  33 files_pid_file(games_srv_var_run_t)
  34
  35 type games_tmp_t;
  36 typealias games_tmp_t alias { user_games_tmp_t staff_games_tmp_t sysadm_games_tmp_t };
  37 typealias games_tmp_t alias { auditadm_games_tmp_t secadm_games_tmp_t };
  38 files_tmp_file(games_tmp_t)
  39 ubac_constrained(games_tmp_t)
  40
  41 type games_tmpfs_t;
  42 typealias games_tmpfs_t alias { user_games_tmpfs_t staff_games_tmpfs_t sysadm_games_tmpfs_t };
  43 typealias games_tmpfs_t alias { auditadm_games_tmpfs_t secadm_games_tmpfs_t };
  44 files_tmpfs_file(games_tmpfs_t)
  45 ubac_constrained(games_tmpfs_t)
  46
  47 ########################################
  48 #
  49 # Server local policy
  50 #
  51
  52 dontaudit games_srv_t self:capability sys_tty_config;
  53 allow games_srv_t self:process signal_perms;
  54
  55 manage_files_pattern(games_srv_t, games_data_t, games_data_t)
  56 manage_lnk_files_pattern(games_srv_t, games_data_t, games_data_t)
  57
  58 manage_files_pattern(games_srv_t, games_srv_var_run_t, games_srv_var_run_t)
  59 files_pid_filetrans(games_srv_t, games_srv_var_run_t, file)
  60
  61 can_exec(games_srv_t, games_exec_t)
  62
  63 kernel_read_kernel_sysctls(games_srv_t)
  64 kernel_list_proc(games_srv_t)
  65 kernel_read_proc_symlinks(games_srv_t)
  66
  67 dev_read_sysfs(games_srv_t)
  68
  69 fs_getattr_all_fs(games_srv_t)
  70 fs_search_auto_mountpoints(games_srv_t)
  71
  72 term_dontaudit_use_console(games_srv_t)
  73
  74 domain_use_interactive_fds(games_srv_t)
  75
  76 init_use_fds(games_srv_t)
  77 init_use_script_ptys(games_srv_t)
  78
  79 logging_send_syslog_msg(games_srv_t)
  80
  81 miscfiles_read_localization(games_srv_t)
  82
  83 userdom_dontaudit_use_unpriv_user_fds(games_srv_t)
  84
  85 userdom_dontaudit_search_user_home_dirs(games_srv_t)
  86
  87 optional_policy(`
  88         seutil_sigchld_newrole(games_srv_t)
  89 ')
  90
  91 optional_policy(`
  92         udev_read_db(games_srv_t)
  93 ')
  94
  95 ########################################
  96 #
  97 # Local policy
  98 #
  99
 100 allow games_t self:sem create_sem_perms;
 101 allow games_t self:tcp_socket create_stream_socket_perms;
 102 allow games_t self:udp_socket create_socket_perms;
 103
 104 manage_files_pattern(games_t, games_data_t, games_data_t)
 105 manage_lnk_files_pattern(games_t, games_data_t, games_data_t)
 106
 107 allow games_t games_devpts_t:chr_file { rw_chr_file_perms setattr };
 108 term_create_pty(games_t, games_devpts_t)
 109
 110 manage_dirs_pattern(games_t, games_tmp_t, games_tmp_t)
 111 manage_files_pattern(games_t, games_tmp_t, games_tmp_t)
 112 files_tmp_filetrans(games_t, games_tmp_t, { file dir })
 113
 114 manage_files_pattern(games_t, games_tmpfs_t, games_tmpfs_t)
 115 manage_lnk_files_pattern(games_t, games_tmpfs_t, games_tmpfs_t)
 116 manage_fifo_files_pattern(games_t, games_tmpfs_t, games_tmpfs_t)
 117 manage_sock_files_pattern(games_t, games_tmpfs_t, games_tmpfs_t)
 118 fs_tmpfs_filetrans(games_t, games_tmpfs_t, { file lnk_file sock_file fifo_file })
 119
 120 can_exec(games_t, games_exec_t)
 121
 122 kernel_read_system_state(games_t)
 123
 124 corecmd_exec_bin(games_t)
 125
 126 corenet_all_recvfrom_unlabeled(games_t)
 127 corenet_all_recvfrom_netlabel(games_t)
 128 corenet_tcp_sendrecv_generic_if(games_t)
 129 corenet_udp_sendrecv_generic_if(games_t)
 130 corenet_tcp_sendrecv_generic_node(games_t)
 131 corenet_udp_sendrecv_generic_node(games_t)
 132 corenet_tcp_sendrecv_all_ports(games_t)
 133 corenet_udp_sendrecv_all_ports(games_t)
 134 corenet_tcp_bind_generic_node(games_t)
 135 corenet_tcp_bind_generic_port(games_t)
 136 corenet_tcp_connect_generic_port(games_t)
 137 corenet_sendrecv_generic_client_packets(games_t)
 138 corenet_sendrecv_generic_server_packets(games_t)
 139
 140 dev_read_sound(games_t)
 141 dev_write_sound(games_t)
 142 dev_read_input(games_t)
 143 dev_read_mouse(games_t)
 144 dev_read_urand(games_t)
 145
 146 files_list_var(games_t)
 147 files_search_var_lib(games_t)
 148 files_dontaudit_search_var(games_t)
 149 files_read_etc_files(games_t)
 150 files_read_usr_files(games_t)
 151 files_read_var_files(games_t)
 152
 153 init_dontaudit_rw_utmp(games_t)
 154
 155 logging_dontaudit_search_logs(games_t)
 156
 157 miscfiles_read_man_pages(games_t)
 158 miscfiles_read_localization(games_t)
 159
 160 sysnet_read_config(games_t)
 161
 162 userdom_manage_user_tmp_dirs(games_t)
 163 userdom_manage_user_tmp_files(games_t)
 164 userdom_manage_user_tmp_symlinks(games_t)
 165 userdom_manage_user_tmp_sockets(games_t)
 166 # Suppress .icons denial until properly implemented
 167 userdom_dontaudit_read_user_home_content_files(games_t)
 168
 169 tunable_policy(`deny_execmem',`', `
 170         allow games_t self:process execmem;
 171 ')
 172
 173 optional_policy(`
 174         nscd_socket_use(games_t)
 175 ')
 176
 177 optional_policy(`
 178         xserver_user_x_domain_template(games, games_t, games_tmpfs_t)
 179         xserver_create_xdm_tmp_sockets(games_t)
 180         xserver_read_xdm_lib_files(games_t)
 181 ')