policy/modules/apps/mplayer.te

   1
   2 policy_module(mplayer, 2.0.0)
   3
   4 ########################################
   5 #
   6 # Declarations
   7 #
   8
   9 ## <desc>
  10 ## <p>
  11 ## Allow mplayer executable stack
  12 ## </p>
  13 ## </desc>
  14 gen_tunable(allow_mplayer_execstack, false)
  15
  16 type mencoder_t;
  17 type mencoder_exec_t;
  18 typealias mencoder_t alias { user_mencoder_t staff_mencoder_t sysadm_mencoder_t };
  19 typealias mencoder_t alias { auditadm_mencoder_t secadm_mencoder_t };
  20 application_domain(mencoder_t, mencoder_exec_t)
  21 ubac_constrained(mencoder_t)
  22
  23 type mplayer_t;
  24 type mplayer_exec_t;
  25 typealias mplayer_t alias { user_mplayer_t staff_mplayer_t sysadm_mplayer_t };
  26 typealias mplayer_t alias { auditadm_mplayer_t secadm_mplayer_t };
  27 application_domain(mplayer_t, mplayer_exec_t)
  28 ubac_constrained(mplayer_t)
  29
  30 type mplayer_etc_t;
  31 files_config_file(mplayer_etc_t)
  32
  33 type mplayer_home_t;
  34 typealias mplayer_home_t alias { user_mplayer_home_t staff_mplayer_home_t sysadm_mplayer_home_t };
  35 typealias mplayer_home_t alias { auditadm_mplayer_home_t secadm_mplayer_home_t };
  36 files_poly_member(mplayer_home_t)
  37 userdom_user_home_content(mplayer_home_t)
  38
  39 type mplayer_tmpfs_t;
  40 typealias mplayer_tmpfs_t alias { user_mplayer_tmpfs_t staff_mplayer_tmpfs_t sysadm_mplayer_tmpfs_t };
  41 typealias mplayer_tmpfs_t alias { auditadm_mplayer_tmpfs_t secadm_mplayer_tmpfs_t };
  42 files_tmpfs_file(mplayer_tmpfs_t)
  43 ubac_constrained(mplayer_tmpfs_t)
  44
  45 ########################################
  46 #
  47 # mencoder local policy
  48 #
  49
  50 manage_dirs_pattern(mencoder_t, mplayer_home_t, mplayer_home_t)
  51 manage_files_pattern(mencoder_t, mplayer_home_t, mplayer_home_t)
  52 manage_lnk_files_pattern(mencoder_t, mplayer_home_t, mplayer_home_t)
  53
  54 # Read global config
  55 allow mencoder_t mplayer_etc_t:dir list_dir_perms;
  56 read_files_pattern(mencoder_t, mplayer_etc_t, mplayer_etc_t)
  57 read_lnk_files_pattern(mencoder_t, mplayer_etc_t, mplayer_etc_t)
  58
  59 # Read /proc files and directories
  60 # Necessary for /proc/meminfo, /proc/cpuinfo, etc..
  61 kernel_read_system_state(mencoder_t)
  62 # Sysctl on kernel version
  63 kernel_read_kernel_sysctls(mencoder_t)
  64
  65 # Required for win32 binary loader
  66 dev_rwx_zero(mencoder_t)
  67 # Access to DVD/CD/V4L
  68 dev_read_video_dev(mencoder_t)
  69
  70 # Read data in /usr/share (fonts, icons..)
  71 files_read_usr_files(mencoder_t)
  72 files_read_usr_symlinks(mencoder_t)
  73
  74 fs_search_auto_mountpoints(mencoder_t)
  75
  76 # Access to DVD/CD/V4L
  77 storage_raw_read_removable_device(mencoder_t)
  78
  79 miscfiles_read_localization(mencoder_t)
  80
  81 userdom_use_user_terminals(mencoder_t)
  82 # Handle removable media, /tmp, and /home
  83 userdom_list_user_tmp(mencoder_t)
  84 userdom_read_user_tmp_files(mencoder_t)
  85 userdom_read_user_tmp_symlinks(mencoder_t)
  86 userdom_read_user_home_content_files(mencoder_t)
  87 userdom_read_user_home_content_symlinks(mencoder_t)
  88
  89 # Read content to encode
  90 ifndef(`enable_mls',`
  91         fs_search_removable(mencoder_t)
  92         fs_read_removable_files(mencoder_t)
  93         fs_read_removable_symlinks(mencoder_t)
  94 ')
  95
  96 tunable_policy(`allow_execmem',`
  97         allow mencoder_t self:process execmem;
  98 ')
  99
 100 tunable_policy(`allow_execmod',`
 101         dev_execmod_zero(mencoder_t)
 102 ')
 103
 104 tunable_policy(`allow_mplayer_execstack',`
 105         allow mencoder_t self:process { execmem execstack };
 106 ')
 107
 108 tunable_policy(`use_nfs_home_dirs',`
 109         fs_manage_nfs_dirs(mencoder_t)
 110         fs_manage_nfs_files(mencoder_t)
 111         fs_manage_nfs_symlinks(mencoder_t)
 112
 113 ')
 114
 115 tunable_policy(`use_samba_home_dirs',`
 116         fs_manage_cifs_dirs(mencoder_t)
 117         fs_manage_cifs_files(mencoder_t)
 118         fs_manage_cifs_symlinks(mencoder_t)
 119
 120 ')
 121
 122 # Read content to encode
 123 tunable_policy(`use_nfs_home_dirs',`
 124         fs_list_auto_mountpoints(mencoder_t)
 125         files_list_home(mencoder_t)
 126         fs_read_nfs_files(mencoder_t)
 127         fs_read_nfs_symlinks(mencoder_t)
 128
 129 ',`
 130         files_dontaudit_list_home(mencoder_t)
 131         fs_dontaudit_list_auto_mountpoints(mencoder_t)
 132         fs_dontaudit_read_nfs_files(mencoder_t)
 133         fs_dontaudit_list_nfs(mencoder_t)
 134 ')
 135
 136 tunable_policy(`use_samba_home_dirs',`
 137         fs_list_auto_mountpoints(mencoder_t)
 138         files_list_home(mencoder_t)
 139         fs_read_cifs_files(mencoder_t)
 140         fs_read_cifs_symlinks(mencoder_t)
 141 ',`
 142         files_dontaudit_list_home(mencoder_t)
 143         fs_dontaudit_list_auto_mountpoints(mencoder_t)
 144         fs_dontaudit_read_cifs_files(mencoder_t)
 145         fs_dontaudit_list_cifs(mencoder_t)
 146 ')
 147
 148 tunable_policy(`read_default_t',`
 149         files_list_default(mencoder_t)
 150         files_read_default_files(mencoder_t)
 151         files_read_default_symlinks(mencoder_t)
 152 ',`
 153         files_dontaudit_read_default_files(mencoder_t)
 154         files_dontaudit_list_default(mencoder_t)
 155 ')
 156
 157 ########################################
 158 #
 159 # mplayer local policy
 160 #
 161
 162 allow mplayer_t self:process { signal_perms getsched };
 163 allow mplayer_t self:fifo_file rw_fifo_file_perms;
 164 allow mplayer_t self:sem create_sem_perms;
 165
 166 manage_dirs_pattern(mplayer_t, mplayer_home_t, mplayer_home_t)
 167 manage_files_pattern(mplayer_t, mplayer_home_t, mplayer_home_t)
 168 manage_lnk_files_pattern(mplayer_t, mplayer_home_t, mplayer_home_t)
 169 userdom_search_user_home_dirs(mplayer_t)
 170
 171 manage_files_pattern(mplayer_t, mplayer_tmpfs_t, mplayer_tmpfs_t)
 172 manage_lnk_files_pattern(mplayer_t, mplayer_tmpfs_t, mplayer_tmpfs_t)
 173 manage_fifo_files_pattern(mplayer_t, mplayer_tmpfs_t, mplayer_tmpfs_t)
 174 manage_sock_files_pattern(mplayer_t, mplayer_tmpfs_t, mplayer_tmpfs_t)
 175 fs_tmpfs_filetrans(mplayer_t, mplayer_tmpfs_t,{ dir file lnk_file sock_file fifo_file })
 176
 177 # Read global config
 178 allow mplayer_t mplayer_etc_t:dir list_dir_perms;
 179 read_files_pattern(mplayer_t, mplayer_etc_t, mplayer_etc_t)
 180 read_lnk_files_pattern(mplayer_t, mplayer_etc_t, mplayer_etc_t)
 181
 182 kernel_dontaudit_list_unlabeled(mplayer_t)
 183 kernel_dontaudit_getattr_unlabeled_files(mplayer_t)
 184 kernel_dontaudit_read_unlabeled_files(mplayer_t)
 185 # Necessary for /proc/meminfo, /proc/cpuinfo, etc..
 186 kernel_read_system_state(mplayer_t)
 187 # Sysctl on kernel version
 188 kernel_read_kernel_sysctls(mplayer_t)
 189
 190 # Run bash/sed (??)
 191 corecmd_exec_bin(mplayer_t)
 192 corecmd_exec_shell(mplayer_t)
 193
 194 # Required for win32 binary loader
 195 dev_rwx_zero(mplayer_t)
 196 # Access to DVD/CD/V4L
 197 dev_read_video_dev(mplayer_t)
 198 # Audio, alsa.conf
 199 dev_read_sound_mixer(mplayer_t)
 200 dev_write_sound_mixer(mplayer_t)
 201 # RTC clock
 202 dev_read_realtime_clock(mplayer_t)
 203
 204 # Access to DVD/CD/V4L
 205 storage_raw_read_removable_device(mplayer_t)
 206
 207 files_read_etc_files(mplayer_t)
 208 files_dontaudit_list_non_security(mplayer_t)
 209 files_dontaudit_getattr_non_security_files(mplayer_t)
 210 files_read_non_security_files(mplayer_t)
 211 # Unfortunately the ancient file dialog starts in /
 212 files_list_home(mplayer_t)
 213 # Read /etc/mtab
 214 files_read_etc_runtime_files(mplayer_t)
 215 # Read data in /usr/share (fonts, icons..)
 216 files_read_usr_files(mplayer_t)
 217 files_read_usr_symlinks(mplayer_t)
 218
 219 fs_dontaudit_getattr_all_fs(mplayer_t)
 220 fs_search_auto_mountpoints(mplayer_t)
 221 fs_list_inotifyfs(mplayer_t)
 222
 223 miscfiles_read_localization(mplayer_t)
 224 miscfiles_read_fonts(mplayer_t)
 225
 226 userdom_use_user_terminals(mplayer_t)
 227 # Read media files
 228 userdom_list_user_tmp(mplayer_t)
 229 userdom_read_user_tmp_files(mplayer_t)
 230 userdom_read_user_tmp_symlinks(mplayer_t)
 231 userdom_read_user_home_content_files(mplayer_t)
 232 userdom_read_user_home_content_symlinks(mplayer_t)
 233
 234 xserver_user_x_domain_template(mplayer, mplayer_t, mplayer_tmpfs_t)
 235
 236 # Read songs
 237 ifdef(`enable_mls',`',`
 238         fs_search_removable(mplayer_t)
 239         fs_read_removable_files(mplayer_t)
 240         fs_read_removable_symlinks(mplayer_t)
 241 ')
 242
 243 tunable_policy(`allow_execmem',`
 244         allow mplayer_t self:process execmem;
 245 ')
 246
 247 tunable_policy(`allow_execmod',`
 248         dev_execmod_zero(mplayer_t)
 249 ')
 250
 251 tunable_policy(`allow_mplayer_execstack',`
 252         allow mplayer_t self:process { execmem execstack };
 253 ')
 254
 255 tunable_policy(`use_nfs_home_dirs',`
 256         fs_manage_nfs_dirs(mplayer_t)
 257         fs_manage_nfs_files(mplayer_t)
 258         fs_manage_nfs_symlinks(mplayer_t)
 259 ')
 260 tunable_policy(`use_samba_home_dirs',`
 261         fs_manage_cifs_dirs(mplayer_t)
 262         fs_manage_cifs_files(mplayer_t)
 263         fs_manage_cifs_symlinks(mplayer_t)
 264 ')
 265
 266 # Legacy domain issues
 267 tunable_policy(`allow_mplayer_execstack',`
 268         allow mplayer_t mplayer_tmpfs_t:file execute;
 269 ')
 270
 271 # Read songs
 272 tunable_policy(`use_nfs_home_dirs',`
 273         fs_list_auto_mountpoints(mplayer_t)
 274         files_list_home(mplayer_t)
 275         fs_read_nfs_files(mplayer_t)
 276         fs_read_nfs_symlinks(mplayer_t)
 277
 278 ',`
 279         files_dontaudit_list_home(mplayer_t)
 280         fs_dontaudit_list_auto_mountpoints(mplayer_t)
 281         fs_dontaudit_read_nfs_files(mplayer_t)
 282         fs_dontaudit_list_nfs(mplayer_t)
 283 ')
 284
 285 tunable_policy(`use_samba_home_dirs',`
 286         fs_list_auto_mountpoints(mplayer_t)
 287         files_list_home(mplayer_t)
 288         fs_read_cifs_files(mplayer_t)
 289         fs_read_cifs_symlinks(mplayer_t)
 290 ',`
 291         files_dontaudit_list_home(mplayer_t)
 292         fs_dontaudit_list_auto_mountpoints(mplayer_t)
 293         fs_dontaudit_read_cifs_files(mplayer_t)
 294         fs_dontaudit_list_cifs(mplayer_t)
 295 ')
 296
 297 tunable_policy(`read_default_t',`
 298         files_list_default(mplayer_t)
 299         files_read_default_files(mplayer_t)
 300         files_read_default_symlinks(mplayer_t)
 301 ',`
 302         files_dontaudit_read_default_files(mplayer_t)
 303         files_dontaudit_list_default(mplayer_t)
 304 ')
 305
 306 optional_policy(`
 307         alsa_read_rw_config(mplayer_t)
 308 ')
 309
 310 optional_policy(`
 311         nscd_socket_use(mplayer_t)
 312 ')