Dont audit writes to leaked file descriptors or redirected output for nacl

[people/stevee/selinux-policy.git] / policy / modules / apps / gnome.if

diff --git a/policy/modules/apps/gnome.if b/policy/modules/apps/gnome.if
index b2ac79c2e82e2503dad345e6a6f86b36866e9d16..45580b57ef068c47a98830f5dc31c1fe4f1de3c0 100644 (file)
--- a/policy/modules/apps/gnome.if
+++ b/policy/modules/apps/gnome.if
@@ -58,18 +58,20 @@ interface(`gnome_role',`
 interface(`gnome_role_gkeyringd',`
         gen_require(`
                 attribute gkeyringd_domain;
-                attribute gnome_domain;
+                attribute gnomedomain;
                 type gnome_home_t;
                 type gkeyringd_exec_t, gkeyringd_tmp_t, gkeyringd_gnome_home_t;
                class dbus send_msg;
         ')
 
-       type $1_gkeyringd_t, gnome_domain, gkeyringd_domain;
-       typealias $1_gkeyringd_t alias gkeyrind_$1_t;
+       type $1_gkeyringd_t, gnomedomain, gkeyringd_domain;
+       typealias $1_gkeyringd_t alias gkeyringd_$1_t;
        application_domain($1_gkeyringd_t, gkeyringd_exec_t)
        ubac_constrained($1_gkeyringd_t)
        domain_user_exemption_target($1_gkeyringd_t)
 
+       userdom_home_manager($1_gkeyringd_t)
+
        role $2 types $1_gkeyringd_t;
 
        domtrans_pattern($3, gkeyringd_exec_t, $1_gkeyringd_t)
@@ -88,9 +90,10 @@ interface(`gnome_role_gkeyringd',`
 
        ps_process_pattern($1_gkeyringd_t, $3)
 
-       ps_process_pattern($3, $1_gkeyringd_t)
-       allow $3 $1_gkeyringd_t:process { ptrace signal_perms };
+       auth_use_nsswitch($1_gkeyringd_t)
 
+       ps_process_pattern($3, $1_gkeyringd_t)
+       allow $3 $1_gkeyringd_t:process signal_perms;
        dontaudit $3 gkeyringd_exec_t:file entrypoint;
 
        stream_connect_pattern($3, gkeyringd_tmp_t, gkeyringd_tmp_t, $1_gkeyringd_t)
@@ -98,10 +101,11 @@ interface(`gnome_role_gkeyringd',`
        allow $1_gkeyringd_t $3:dbus send_msg;
        allow $3 $1_gkeyringd_t:dbus send_msg;
        optional_policy(`
-               dbus_session_domain($1_gkeyringd_t, gkeyringd_exec_t)
+               dbus_session_domain($1, gkeyringd_exec_t, $1_gkeyringd_t)
                dbus_session_bus_client($1_gkeyringd_t)
                gnome_home_dir_filetrans($1_gkeyringd_t)
                gnome_manage_generic_home_dirs($1_gkeyringd_t)
+               gnome_read_generic_data_home_files($1_gkeyringd_t)
 
                optional_policy(`
                        telepathy_mission_control_read_state($1_gkeyringd_t)
@@ -132,11 +136,6 @@ interface(`gnome_stream_connect_gconf',`
 ## <summary>
 ##     Connect to gkeyringd with a unix stream socket. 
 ## </summary>
-## <param name="role_prefix">
-##     <summary>
-##     Role prefix.
-##     </summary>
-## </param>
 ## <param name="domain">
 ##     <summary>
 ##     Domain allowed access.
@@ -158,11 +157,6 @@ interface(`gnome_stream_connect_gkeyringd',`
 ## <summary>
 ##     Connect to gkeyringd with a unix stream socket. 
 ## </summary>
-## <param name="role_prefix">
-##     <summary>
-##     Role prefix.
-##     </summary>
-## </param>
 ## <param name="domain">
 ##     <summary>
 ##     Domain allowed access.
@@ -204,7 +198,7 @@ interface(`gnome_domtrans_gconfd',`
 ## </summary>
 ## <param name="domain">
 ##     <summary>
-##     Domain allowed access.
+##     Domain to not audit.
 ##     </summary>
 ## </param>
 #
@@ -222,7 +216,7 @@ interface(`gnome_dontaudit_read_config',`
 ## </summary>
 ## <param name="domain">
 ##     <summary>
-##     Domain allowed access.
+##     Domain to not audit.
 ##     </summary>
 ## </param>
 #
@@ -234,6 +228,24 @@ interface(`gnome_dontaudit_search_config',`
        dontaudit $1 gnome_home_type:dir search_dir_perms;
 ')
 
+########################################
+## <summary>
+##     Dontaudit write gnome homedir content (.config)
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain to not audit.
+##     </summary>
+## </param>
+#
+interface(`gnome_dontaudit_write_config_files',`
+       gen_require(`
+               attribute gnome_home_type;
+       ')
+
+       dontaudit $1 gnome_home_type:file write;
+')
+
 ########################################
 ## <summary>
 ##     manage gnome homedir content (.config)
@@ -267,10 +279,10 @@ interface(`gnome_manage_config',`
 #
 interface(`gnome_signal_all',`
        gen_require(`
-               attribute gnome_domain;
+               attribute gnomedomain;
        ')
 
-       allow $1 gnome_domain:process signal;
+       allow $1 gnomedomain:process signal;
 ')
 
 ########################################
@@ -300,7 +312,38 @@ interface(`gnome_cache_filetrans',`
                type cache_home_t;
        ')
 
-       filetrans_pattern($1, cache_home_t, $2, $3)
+       filetrans_pattern($1, cache_home_t, $2, $3, $4)
+       userdom_search_user_home_dirs($1)
+')
+
+########################################
+## <summary>
+##     Create objects in a Gnome cache home directory
+##     with an automatic type transition to
+##     a specified private type.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+## <param name="private_type">
+##     <summary>
+##     The type of the object to create.
+##     </summary>
+## </param>
+## <param name="object_class">
+##     <summary>
+##     The class of the object to be created.
+##     </summary>
+## </param>
+#
+interface(`gnome_config_filetrans',`
+       gen_require(`
+               type config_home_t;
+       ')
+
+       filetrans_pattern($1, config_home_t, $2, $3, $4)
        userdom_search_user_home_dirs($1)
 ')
 
@@ -380,6 +423,24 @@ interface(`gnome_write_generic_cache_files',`
        userdom_search_user_home_dirs($1)
 ')
 
+########################################
+## <summary>
+##     Dontaudit read/write to generic cache home files (.cache)
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain to not audit.
+##     </summary>
+## </param>
+#
+interface(`gnome_dontaudit_rw_generic_cache_files',`
+       gen_require(`
+               type cache_home_t;
+       ')
+
+       dontaudit $1 cache_home_t:file rw_inherited_file_perms;
+')
+
 ########################################
 ## <summary>
 ##     read gnome homedir content (.config)
@@ -427,32 +488,90 @@ interface(`gnome_data_filetrans',`
                type data_home_t;
        ')
 
-       filetrans_pattern($1, data_home_t, $2, $3)
+       filetrans_pattern($1, data_home_t, $2, $3, $4)
        gnome_search_gconf($1)
 ')
 
 #######################################
 ## <summary>
-##      Manage gconf data home files
+##     Read generic data home files.
 ## </summary>
 ## <param name="domain">
-##      <summary>
-##      Domain allowed access.
-##      </summary>
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`gnome_read_generic_data_home_files',`
+       gen_require(`
+               type data_home_t, gconf_home_t;
+       ')
+
+       read_files_pattern($1, { gconf_home_t data_home_t }, data_home_t)
+')
+
+#######################################
+## <summary>
+##     Manage gconf data home files
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
 ## </param>
 #
 interface(`gnome_manage_data',`
-        gen_require(`
-                type data_home_t;
-                               type gconf_home_t;
-        ')
+       gen_require(`
+               type data_home_t;
+               type gconf_home_t;
+       ')
 
                allow $1 gconf_home_t:dir search_dir_perms;
                manage_dirs_pattern($1, data_home_t, data_home_t)
-        manage_files_pattern($1, data_home_t, data_home_t)
+               manage_files_pattern($1, data_home_t, data_home_t)
                manage_lnk_files_pattern($1, data_home_t, data_home_t)
 ')
 
+########################################
+## <summary>
+##     Read icc data home content.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`gnome_read_home_icc_data_content',`
+       gen_require(`
+               type icc_data_home_t, gconf_home_t, data_home_t;
+       ')
+
+       userdom_search_user_home_dirs($1)
+       allow $1 { gconf_home_t data_home_t }:dir search_dir_perms;
+       list_dirs_pattern($1, icc_data_home_t, icc_data_home_t)
+       read_files_pattern($1, icc_data_home_t, icc_data_home_t)
+       read_lnk_files_pattern($1, icc_data_home_t, icc_data_home_t)
+')
+
+########################################
+## <summary>
+##     Read inherited icc data home files.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`gnome_read_inherited_home_icc_data_files',`
+       gen_require(`
+               type icc_data_home_t;
+       ')
+
+       allow $1 icc_data_home_t:file read_inherited_file_perms;
+')
+
 ########################################
 ## <summary>
 ##     Create gconf_home_t objects in the /root directory
@@ -476,6 +595,25 @@ interface(`gnome_admin_home_gconf_filetrans',`
        userdom_admin_home_dir_filetrans($1, gconf_home_t, $2)
 ')
 
+########################################
+## <summary>
+##     Do not audit attempts to read
+##     inherited gconf config files.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain to not audit.
+##     </summary>
+## </param>
+#
+interface(`gnome_dontaudit_read_inherited_gconf_config_files',`
+       gen_require(`
+               type gconf_etc_t;
+       ')
+
+       dontaudit $1 gconf_etc_t:file read_inherited_file_perms;
+')
+
 ########################################
 ## <summary>
 ##     read gconf config files
@@ -762,7 +900,7 @@ interface(`gnome_list_home_config',`
 ##     </summary>
 ## </param>
 #
-template(`gnome_setattr_home_config',`
+interface(`gnome_setattr_home_config',`
        gen_require(`
                type config_home_t;
        ')
@@ -791,6 +929,42 @@ interface(`gnome_read_home_config',`
        read_lnk_files_pattern($1, config_home_t, config_home_t)
 ')
 
+#######################################
+## <summary>
+##  delete gnome homedir content (.config)
+## </summary>
+## <param name="domain">
+##  <summary>
+##  Domain allowed access.
+##  </summary>
+## </param>
+#
+interface(`gnome_delete_home_config',`
+    gen_require(`
+        type config_home_t;
+    ')
+
+    delete_files_pattern($1, config_home_t, config_home_t)
+')
+
+#######################################
+## <summary>
+##  setattr gnome homedir content (.config)
+## </summary>
+## <param name="domain">
+##  <summary>
+##  Domain allowed access.
+##  </summary>
+## </param>
+#
+interface(`gnome_setattr_home_config_dirs',`
+    gen_require(`
+        type config_home_t;
+    ')
+
+    setattr_dirs_pattern($1, config_home_t, config_home_t)
+')
+
 ########################################
 ## <summary>
 ##     manage gnome homedir content (.config)
@@ -801,7 +975,7 @@ interface(`gnome_read_home_config',`
 ##     </summary>
 ## </param>
 #
-template(`gnome_manage_home_config',`
+interface(`gnome_manage_home_config',`
        gen_require(`
                type config_home_t;
        ')
@@ -809,6 +983,60 @@ template(`gnome_manage_home_config',`
        manage_files_pattern($1, config_home_t, config_home_t)
 ')
 
+#######################################
+## <summary>
+##  delete gnome homedir content (.config)
+## </summary>
+## <param name="domain">
+##  <summary>
+##  Domain allowed access.
+##  </summary>
+## </param>
+#
+interface(`gnome_delete_home_config_dirs',`
+    gen_require(`
+        type config_home_t;
+    ')
+
+    delete_dirs_pattern($1, config_home_t, config_home_t)
+')
+
+########################################
+## <summary>
+##     manage gnome homedir content (.config)
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`gnome_manage_home_config_dirs',`
+       gen_require(`
+               type config_home_t;
+       ')
+
+       manage_dirs_pattern($1, config_home_t, config_home_t)
+')
+
+########################################
+## <summary>
+##     manage gstreamer home content files.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`gnome_manage_gstreamer_home_files',`
+       gen_require(`
+               type gstreamer_home_t;
+       ')
+
+       manage_files_pattern($1, gstreamer_home_t, gstreamer_home_t)
+')
+
 ########################################
 ## <summary>
 ##     Read/Write all inherited gnome home config 
@@ -853,11 +1081,6 @@ interface(`gnome_dbus_chat_gconfdefault',`
 ##     Send and receive messages from
 ##     gkeyringd over dbus.
 ## </summary>
-## <param name="role_prefix">
-##     <summary>
-##     Role prefix.
-##     </summary>
-## </param>
 ## <param name="domain">
 ##     <summary>
 ##     Domain allowed access.
@@ -874,6 +1097,42 @@ interface(`gnome_dbus_chat_gkeyringd',`
        allow gkeyringd_domain $1:dbus send_msg;
 ')
 
+########################################
+## <summary>
+##     Send signull signal to gkeyringd processes.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`gnome_signull_gkeyringd',`
+       gen_require(`
+               attribute gkeyringd_domain;
+       ')
+
+       allow $1 gkeyringd_domain:process signull;
+')
+
+########################################
+## <summary>
+##     Allow the domain to read gkeyringd state files in /proc.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`gnome_read_gkeyringd_state',`
+       gen_require(`
+               attribute gkeyringd_domain;
+       ')
+
+       ps_process_pattern($1, gkeyringd_domain)
+')
+
 ########################################
 ## <summary>
 ##     Create directories in user home directories
@@ -962,3 +1221,124 @@ interface(`gnome_transition_gkeyringd',`
        allow gkeyringd_domain $1:fifo_file rw_inherited_fifo_file_perms;
 ')
 
+########################################
+## <summary>
+##     Create gnome content in the user home directory
+##     with an correct label.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`gnome_filetrans_home_content',`
+
+gen_require(`
+       type config_home_t;
+       type cache_home_t;
+       type gstreamer_home_t;
+       type gconf_home_t;
+       type gnome_home_t;
+       type data_home_t, icc_data_home_t;
+       type gkeyringd_gnome_home_t;
+')
+
+       userdom_user_home_dir_filetrans($1, config_home_t, dir, ".config")
+       userdom_user_home_dir_filetrans($1, config_home_t, file, ".Xdefaults")
+       userdom_user_home_dir_filetrans($1, config_home_t, dir, ".xine")
+       userdom_user_home_dir_filetrans($1, cache_home_t, dir, ".cache")
+       userdom_user_home_dir_filetrans($1, config_home_t, dir, ".kde")
+       userdom_user_home_dir_filetrans($1, gconf_home_t, dir, ".gconf")
+       userdom_user_home_dir_filetrans($1, gconf_home_t, dir, ".gconfd")
+       userdom_user_home_dir_filetrans($1, gconf_home_t, dir, ".local")
+       userdom_user_home_dir_filetrans($1, gnome_home_t, dir, ".gnome2")
+       userdom_user_home_dir_filetrans($1, gstreamer_home_t, dir, ".gstreamer-10")
+       userdom_user_home_dir_filetrans($1, gstreamer_home_t, dir, ".gstreamer-12")
+       # ~/.color/icc: legacy
+       userdom_user_home_content_filetrans($1, icc_data_home_t, dir, "icc")
+       filetrans_pattern($1, gnome_home_t, gkeyringd_gnome_home_t, dir, "keyrings")
+       filetrans_pattern($1, gconf_home_t, data_home_t, dir, "share")
+       filetrans_pattern($1, data_home_t, icc_data_home_t, dir, "icc")
+       userdom_user_tmp_filetrans($1, config_home_t, dir, "dconf")
+')
+
+########################################
+## <summary>
+##     Create gnome directory in the /root directory
+##     with an correct label.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`gnome_filetrans_admin_home_content',`
+
+gen_require(`
+       type config_home_t;
+       type cache_home_t;
+       type gstreamer_home_t;
+       type gconf_home_t;
+       type gnome_home_t;
+       type icc_data_home_t;
+')
+
+       userdom_admin_home_dir_filetrans($1, config_home_t, file, ".Xdefaults")
+       userdom_admin_home_dir_filetrans($1, config_home_t, dir, ".xine")
+       userdom_admin_home_dir_filetrans($1, cache_home_t, dir, ".cache")
+       userdom_admin_home_dir_filetrans($1, config_home_t, dir, ".kde")
+       userdom_admin_home_dir_filetrans($1, gconf_home_t, dir, ".gconf")
+       userdom_admin_home_dir_filetrans($1, gconf_home_t, dir, ".gconfd")
+       userdom_admin_home_dir_filetrans($1, gconf_home_t, dir, ".local")
+       userdom_admin_home_dir_filetrans($1, gnome_home_t, dir, ".gnome2")
+       userdom_admin_home_dir_filetrans($1, gstreamer_home_t, dir, ".gstreamer-10")
+       userdom_admin_home_dir_filetrans($1, gstreamer_home_t, dir, ".gstreamer-12")
+       # /root/.color/icc: legacy
+       userdom_admin_home_dir_filetrans($1, icc_data_home_t, dir, "icc")
+')
+
+######################################
+## <summary>
+##  Execute gnome-keyring executable
+##  in the specified domain.
+## </summary>
+## <desc>
+##  <p>
+##  Execute a telepathy executable
+##  in the specified domain.  This allows
+##  the specified domain to execute any file
+##  on these filesystems in the specified
+##  domain. 
+##  </p>
+##  <p>
+##  No interprocess communication (signals, pipes,
+##  etc.) is provided by this interface since
+##  the domains are not owned by this module.
+##  </p>
+##  <p>
+##  This interface was added to handle
+##  the ssh-agent policy.
+##  </p>
+## </desc>
+## <param name="domain">
+##  <summary>
+##  Domain allowed to transition.
+##  </summary>
+## </param>
+## <param name="target_domain">
+##  <summary>
+##  The type of the new process.
+##  </summary>
+## </param>
+#
+interface(`gnome_command_domtrans_gkeyringd', `
+    gen_require(`
+        type gkeyringd_exec_t;
+    ')
+
+    allow $2 gkeyringd_exec_t:file entrypoint;
+    domain_transition_pattern($1, gkeyringd_exec_t, $2)
+    type_transition $1 gkeyringd_exec_t:process $2;
+')