613 lines
18 KiB
Text
613 lines
18 KiB
Text
|
policy_module(kernel, 1.17.1)
|
||
|
|
|
||
|
|
########################################
|
||
|
|
#
|
||
|
|
# Declarations
|
||
|
|
#
|
||
|
|
|
||
|
|
## <desc>
|
||
|
|
## <p>
|
||
|
|
## Disable kernel module loading.
|
||
|
|
## </p>
|
||
|
|
## </desc>
|
||
|
|
gen_bool(secure_mode_insmod, false)
|
||
|
|
|
||
|
|
# assertion related attributes
|
||
|
|
attribute can_load_kernmodule;
|
||
|
|
attribute can_receive_kernel_messages;
|
||
|
|
attribute can_dump_kernel;
|
||
|
|
|
||
|
|
neverallow ~can_load_kernmodule self:capability sys_module;
|
||
|
|
|
||
|
|
# domains with unconfined access to kernel resources
|
||
|
|
attribute kern_unconfined;
|
||
|
|
|
||
|
|
# regular entries in proc
|
||
|
|
attribute proc_type;
|
||
|
|
|
||
|
|
# attribute for domains which read proc_t
|
||
|
|
attribute kernel_system_state_reader;
|
||
|
|
|
||
|
|
# sysctls
|
||
|
|
attribute sysctl_type;
|
||
|
|
|
||
|
|
role system_r;
|
||
|
|
role sysadm_r;
|
||
|
|
role staff_r;
|
||
|
|
role user_r;
|
||
|
|
|
||
|
|
# here until order dependence is fixed:
|
||
|
|
role unconfined_r;
|
||
|
|
|
||
|
|
role guest_r;
|
||
|
|
role xguest_r;
|
||
|
|
|
||
|
|
ifdef(`enable_mls',`
|
||
|
|
role secadm_r;
|
||
|
|
role auditadm_r;
|
||
|
|
')
|
||
|
|
|
||
|
|
#
|
||
|
|
# kernel_t is the domain of kernel threads.
|
||
|
|
# It is also the target type when checking permissions in the system class.
|
||
|
|
#
|
||
|
|
type kernel_t, can_load_kernmodule;
|
||
|
|
domain_base_type(kernel_t)
|
||
|
|
mls_rangetrans_source(kernel_t)
|
||
|
|
mls_trusted_object(kernel_t)
|
||
|
|
role system_r types kernel_t;
|
||
|
|
sid kernel gen_context(system_u:system_r:kernel_t,mls_systemhigh)
|
||
|
|
|
||
|
|
#
|
||
|
|
# BinderFS
|
||
|
|
#
|
||
|
|
type binderfs_t;
|
||
|
|
fs_type(binderfs_t)
|
||
|
|
genfscon binder / gen_context(system_u:object_r:binderfs_t,s0)
|
||
|
|
|
||
|
|
#
|
||
|
|
# DebugFS
|
||
|
|
#
|
||
|
|
|
||
|
|
type debugfs_t;
|
||
|
|
files_mountpoint(debugfs_t)
|
||
|
|
fs_type(debugfs_t)
|
||
|
|
dev_associate_sysfs(debugfs_t)
|
||
|
|
|
||
|
|
allow debugfs_t self:filesystem associate;
|
||
|
|
genfscon debugfs / gen_context(system_u:object_r:debugfs_t,s0)
|
||
|
|
|
||
|
|
#
|
||
|
|
# kvmFS
|
||
|
|
#
|
||
|
|
|
||
|
|
type kvmfs_t;
|
||
|
|
fs_type(kvmfs_t)
|
||
|
|
genfscon kvmfs / gen_context(system_u:object_r:kvmfs_t,s0)
|
||
|
|
|
||
|
|
#
|
||
|
|
# Procfs types
|
||
|
|
#
|
||
|
|
|
||
|
|
type proc_t, proc_type;
|
||
|
|
files_mountpoint(proc_t)
|
||
|
|
fs_type(proc_t)
|
||
|
|
genfscon proc / gen_context(system_u:object_r:proc_t,s0)
|
||
|
|
genfscon proc /sysvipc gen_context(system_u:object_r:proc_t,s0)
|
||
|
|
|
||
|
|
type proc_afs_t, proc_type;
|
||
|
|
fs_associate(proc_afs_t)
|
||
|
|
genfscon proc /fs/openafs gen_context(system_u:object_r:proc_afs_t,s0)
|
||
|
|
|
||
|
|
# kernel message interface
|
||
|
|
type proc_kmsg_t, proc_type;
|
||
|
|
fs_associate(proc_kmsg_t)
|
||
|
|
genfscon proc /kmsg gen_context(system_u:object_r:proc_kmsg_t,mls_systemhigh)
|
||
|
|
neverallow ~{ can_receive_kernel_messages kern_unconfined } proc_kmsg_t:file ~getattr;
|
||
|
|
|
||
|
|
# /proc kcore: inaccessible
|
||
|
|
type proc_kcore_t, proc_type;
|
||
|
|
fs_associate(proc_kcore_t)
|
||
|
|
neverallow ~{ can_dump_kernel kern_unconfined } proc_kcore_t:file ~getattr;
|
||
|
|
genfscon proc /kcore gen_context(system_u:object_r:proc_kcore_t,mls_systemhigh)
|
||
|
|
|
||
|
|
type proc_mdstat_t, proc_type;
|
||
|
|
fs_associate(proc_mdstat_t)
|
||
|
|
genfscon proc /mdstat gen_context(system_u:object_r:proc_mdstat_t,s0)
|
||
|
|
|
||
|
|
type proc_numa_t, proc_type;
|
||
|
|
fs_associate(proc_numa_t)
|
||
|
|
genfscon proc /numatools gen_context(system_u:object_r:proc_numa_t,s0)
|
||
|
|
mls_trusted_object(proc_numa_t)
|
||
|
|
|
||
|
|
type proc_net_t, proc_type;
|
||
|
|
fs_associate(proc_net_t)
|
||
|
|
genfscon proc /net gen_context(system_u:object_r:proc_net_t,s0)
|
||
|
|
|
||
|
|
type proc_security_t, proc_type;
|
||
|
|
fs_associate(proc_security_t)
|
||
|
|
genfscon proc /sys/fs/protected_hardlinks gen_context(system_u:object_r:proc_security_t,s0)
|
||
|
|
genfscon proc /sys/fs/protected_symlinks gen_context(system_u:object_r:proc_security_t,s0)
|
||
|
|
genfscon proc /sys/fs/suid_dumpable gen_context(system_u:object_r:proc_security_t,s0)
|
||
|
|
genfscon proc /sys/kernel/dmesg_restrict gen_context(system_u:object_r:proc_security_t,s0)
|
||
|
|
genfscon proc /sys/kernel/kptr_restrict gen_context(system_u:object_r:proc_security_t,s0)
|
||
|
|
genfscon proc /sys/kernel/modules_disabled gen_context(system_u:object_r:proc_security_t,s0)
|
||
|
|
genfscon proc /sys/kernel/randomize_va_space gen_context(system_u:object_r:proc_security_t,s0)
|
||
|
|
|
||
|
|
type usermodehelper_t, proc_type, sysctl_type;
|
||
|
|
typealias usermodehelper_t alias sysctl_hotplug_t;
|
||
|
|
typealias usermodehelper_t alias sysctl_modprobe_t;
|
||
|
|
dev_associate_sysfs(usermodehelper_t)
|
||
|
|
fs_associate(usermodehelper_t)
|
||
|
|
genfscon proc /sys/kernel/core_pattern gen_context(system_u:object_r:usermodehelper_t,s0)
|
||
|
|
genfscon proc /sys/kernel/hotplug gen_context(system_u:object_r:usermodehelper_t,s0)
|
||
|
|
genfscon proc /sys/kernel/modprobe gen_context(system_u:object_r:usermodehelper_t,s0)
|
||
|
|
genfscon proc /sys/kernel/poweroff_cmd gen_context(system_u:object_r:usermodehelper_t,s0)
|
||
|
|
genfscon proc /sys/kernel/usermodehelper gen_context(system_u:object_r:usermodehelper_t,s0)
|
||
|
|
|
||
|
|
type proc_xen_t, proc_type;
|
||
|
|
files_mountpoint(proc_xen_t)
|
||
|
|
genfscon proc /xen gen_context(system_u:object_r:proc_xen_t,s0)
|
||
|
|
|
||
|
|
#
|
||
|
|
# Sysctl types
|
||
|
|
#
|
||
|
|
|
||
|
|
# /proc/sys directory, base directory of sysctls
|
||
|
|
type sysctl_t, sysctl_type;
|
||
|
|
files_mountpoint(sysctl_t)
|
||
|
|
sid sysctl gen_context(system_u:object_r:sysctl_t,s0)
|
||
|
|
genfscon proc /sys gen_context(system_u:object_r:sysctl_t,s0)
|
||
|
|
|
||
|
|
# /proc/irq directory and files
|
||
|
|
type sysctl_irq_t, sysctl_type;
|
||
|
|
fs_associate(sysctl_irq_t)
|
||
|
|
fs_associate_proc(sysctl_irq_t)
|
||
|
|
genfscon proc /irq gen_context(system_u:object_r:sysctl_irq_t,s0)
|
||
|
|
|
||
|
|
# /proc/net/rpc directory and files
|
||
|
|
type sysctl_rpc_t, sysctl_type;
|
||
|
|
fs_associate(sysctl_rpc_t)
|
||
|
|
fs_associate_proc(sysctl_rpc_t)
|
||
|
|
genfscon proc /net/rpc gen_context(system_u:object_r:sysctl_rpc_t,s0)
|
||
|
|
|
||
|
|
# /proc/sys/crypto directory and files
|
||
|
|
type sysctl_crypto_t, sysctl_type;
|
||
|
|
fs_associate_proc(sysctl_crypto_t)
|
||
|
|
fs_associate(sysctl_crypto_t)
|
||
|
|
genfscon proc /sys/crypto gen_context(system_u:object_r:sysctl_crypto_t,s0)
|
||
|
|
|
||
|
|
# /proc/sys/fs directory and files
|
||
|
|
type sysctl_fs_t, sysctl_type;
|
||
|
|
files_mountpoint(sysctl_fs_t)
|
||
|
|
genfscon proc /sys/fs gen_context(system_u:object_r:sysctl_fs_t,s0)
|
||
|
|
|
||
|
|
# /proc/sys/kernel directory and files
|
||
|
|
type sysctl_kernel_t, sysctl_type;
|
||
|
|
fs_associate(sysctl_kernel_t)
|
||
|
|
genfscon proc /sys/kernel gen_context(system_u:object_r:sysctl_kernel_t,s0)
|
||
|
|
|
||
|
|
# /sys/kernel/ns_last_pid file
|
||
|
|
type sysctl_kernel_ns_last_pid_t, sysctl_type;
|
||
|
|
fs_associate(sysctl_kernel_ns_last_pid_t)
|
||
|
|
genfscon proc /sys/kernel/ns_last_pid gen_context(system_u:object_r:sysctl_kernel_ns_last_pid_t,s0)
|
||
|
|
|
||
|
|
# /proc/sys/net directory and files
|
||
|
|
type sysctl_net_t, sysctl_type;
|
||
|
|
fs_associate(sysctl_net_t)
|
||
|
|
genfscon proc /sys/net gen_context(system_u:object_r:sysctl_net_t,s0)
|
||
|
|
|
||
|
|
# /proc/sys/net/unix directory and files
|
||
|
|
type sysctl_net_unix_t, sysctl_type;
|
||
|
|
fs_associate(sysctl_net_unix_t)
|
||
|
|
genfscon proc /sys/net/unix gen_context(system_u:object_r:sysctl_net_unix_t,s0)
|
||
|
|
|
||
|
|
# /proc/sys/vm directory and files
|
||
|
|
type sysctl_vm_t, sysctl_type;
|
||
|
|
fs_associate(sysctl_vm_t)
|
||
|
|
genfscon proc /sys/vm gen_context(system_u:object_r:sysctl_vm_t,s0)
|
||
|
|
|
||
|
|
# /proc/sys/vm/overcommit_memory
|
||
|
|
type sysctl_vm_overcommit_t, sysctl_type;
|
||
|
|
fs_associate(sysctl_vm_overcommit_t)
|
||
|
|
genfscon proc /sys/vm/overcommit_memory gen_context(system_u:object_r:sysctl_vm_overcommit_t,s0)
|
||
|
|
|
||
|
|
# /proc/sys/dev directory and files
|
||
|
|
type sysctl_dev_t, sysctl_type;
|
||
|
|
fs_associate(sysctl_dev_t)
|
||
|
|
genfscon proc /sys/dev gen_context(system_u:object_r:sysctl_dev_t,s0)
|
||
|
|
|
||
|
|
#
|
||
|
|
# unlabeled_t is the type of unlabeled objects.
|
||
|
|
# Objects that have no known labeling information or that
|
||
|
|
# have labels that are no longer valid are treated as having this type.
|
||
|
|
#
|
||
|
|
type unlabeled_t;
|
||
|
|
fs_associate(unlabeled_t)
|
||
|
|
sid unlabeled gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
|
||
|
|
allow unlabeled_t self:filesystem associate;
|
||
|
|
|
||
|
|
# Need the following because we are type alias of file_t.
|
||
|
|
files_type(unlabeled_t)
|
||
|
|
kernel_rootfs_mountpoint(unlabeled_t)
|
||
|
|
sid file gen_context(system_u:object_r:unlabeled_t,s0)
|
||
|
|
typealias unlabeled_t alias file_t;
|
||
|
|
neverallow * unlabeled_t:file entrypoint;
|
||
|
|
|
||
|
|
# anon_inode types
|
||
|
|
type userfaultfd_t;
|
||
|
|
type io_uring_t;
|
||
|
|
|
||
|
|
# These initial sids are no longer used, and can be removed:
|
||
|
|
sid any_socket gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
|
||
|
|
sid file_labels gen_context(system_u:object_r:unlabeled_t,s0)
|
||
|
|
sid icmp_socket gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
|
||
|
|
sid igmp_packet gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
|
||
|
|
sid init gen_context(system_u:object_r:unlabeled_t,s0)
|
||
|
|
sid kmod gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
|
||
|
|
sid policy gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
|
||
|
|
sid scmp_packet gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
|
||
|
|
sid sysctl_modprobe gen_context(system_u:object_r:unlabeled_t,s0)
|
||
|
|
sid sysctl_fs gen_context(system_u:object_r:unlabeled_t,s0)
|
||
|
|
sid sysctl_kernel gen_context(system_u:object_r:unlabeled_t,s0)
|
||
|
|
sid sysctl_net gen_context(system_u:object_r:unlabeled_t,s0)
|
||
|
|
sid sysctl_net_unix gen_context(system_u:object_r:unlabeled_t,s0)
|
||
|
|
sid sysctl_vm gen_context(system_u:object_r:unlabeled_t,s0)
|
||
|
|
sid sysctl_dev gen_context(system_u:object_r:unlabeled_t,s0)
|
||
|
|
sid tcp_socket gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
|
||
|
|
|
||
|
|
########################################
|
||
|
|
#
|
||
|
|
# kernel local policy
|
||
|
|
#
|
||
|
|
|
||
|
|
allow kernel_t self:capability2 ~mac_override;
|
||
|
|
allow kernel_t self:capability ~sys_module;
|
||
|
|
allow kernel_t self:key manage_key_perms;
|
||
|
|
allow kernel_t self:system { ipc_info module_request syslog_console syslog_mod syslog_read };
|
||
|
|
allow kernel_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
|
||
|
|
allow kernel_t self:shm create_shm_perms;
|
||
|
|
allow kernel_t self:sem create_sem_perms;
|
||
|
|
allow kernel_t self:msg { send receive };
|
||
|
|
allow kernel_t self:msgq create_msgq_perms;
|
||
|
|
allow kernel_t self:perf_event manage_perf_event_perms;
|
||
|
|
allow kernel_t self:unix_dgram_socket create_socket_perms;
|
||
|
|
allow kernel_t self:unix_stream_socket create_stream_socket_perms;
|
||
|
|
allow kernel_t self:unix_dgram_socket sendto;
|
||
|
|
allow kernel_t self:unix_stream_socket connectto;
|
||
|
|
allow kernel_t self:fifo_file rw_fifo_file_perms;
|
||
|
|
allow kernel_t self:sock_file read_sock_file_perms;
|
||
|
|
allow kernel_t self:fd use;
|
||
|
|
allow kernel_t self:bpf { map_create map_read map_write prog_load prog_run };
|
||
|
|
|
||
|
|
allow kernel_t debugfs_t:dir search_dir_perms;
|
||
|
|
|
||
|
|
allow kernel_t proc_t:dir list_dir_perms;
|
||
|
|
allow kernel_t proc_t:file read_file_perms;
|
||
|
|
allow kernel_t proc_t:lnk_file read_lnk_file_perms;
|
||
|
|
|
||
|
|
allow kernel_t proc_net_t:dir list_dir_perms;
|
||
|
|
allow kernel_t proc_net_t:file read_file_perms;
|
||
|
|
|
||
|
|
allow kernel_t proc_mdstat_t:file read_file_perms;
|
||
|
|
|
||
|
|
allow kernel_t proc_kcore_t:file getattr;
|
||
|
|
|
||
|
|
allow kernel_t proc_kmsg_t:file getattr;
|
||
|
|
|
||
|
|
allow kernel_t sysctl_kernel_t:dir list_dir_perms;
|
||
|
|
allow kernel_t sysctl_kernel_t:file read_file_perms;
|
||
|
|
|
||
|
|
allow kernel_t sysctl_kernel_ns_last_pid_t:file read_file_perms;
|
||
|
|
|
||
|
|
allow kernel_t sysctl_t:dir list_dir_perms;
|
||
|
|
|
||
|
|
# Other possible mount points for the root fs are in files
|
||
|
|
allow kernel_t unlabeled_t:dir mounton;
|
||
|
|
# Kernel-generated traffic e.g., TCP resets on
|
||
|
|
# connections with invalidated labels:
|
||
|
|
allow kernel_t unlabeled_t:packet send;
|
||
|
|
|
||
|
|
# Allow unlabeled network traffic
|
||
|
|
allow unlabeled_t unlabeled_t:packet { forward_in forward_out };
|
||
|
|
corenet_in_generic_if(unlabeled_t)
|
||
|
|
corenet_in_generic_node(unlabeled_t)
|
||
|
|
|
||
|
|
corenet_all_recvfrom_netlabel(kernel_t)
|
||
|
|
# Kernel-generated traffic e.g., ICMP replies:
|
||
|
|
corenet_raw_sendrecv_all_if(kernel_t)
|
||
|
|
corenet_raw_sendrecv_all_nodes(kernel_t)
|
||
|
|
corenet_raw_send_generic_if(kernel_t)
|
||
|
|
# Kernel-generated traffic e.g., TCP resets:
|
||
|
|
corenet_tcp_sendrecv_all_if(kernel_t)
|
||
|
|
corenet_tcp_sendrecv_all_nodes(kernel_t)
|
||
|
|
corenet_raw_send_generic_node(kernel_t)
|
||
|
|
corenet_send_all_packets(kernel_t)
|
||
|
|
corenet_filetrans_all_named_dev(kernel_t)
|
||
|
|
|
||
|
|
corenet_ib_access_all_pkeys(kernel_t)
|
||
|
|
corenet_ib_access_unlabeled_pkeys(kernel_t)
|
||
|
|
corenet_ib_manage_subnet_all_endports(kernel_t)
|
||
|
|
corenet_ib_manage_subnet_unlabeled_endports(kernel_t)
|
||
|
|
|
||
|
|
dev_read_sysfs(kernel_t)
|
||
|
|
dev_search_usbfs(kernel_t)
|
||
|
|
# devtmpfs handling:
|
||
|
|
dev_create_generic_dirs(kernel_t)
|
||
|
|
dev_delete_generic_dirs(kernel_t)
|
||
|
|
dev_manage_all_blk_files(kernel_t)
|
||
|
|
dev_manage_all_chr_files(kernel_t)
|
||
|
|
dev_mounton(kernel_t)
|
||
|
|
dev_filetrans_all_named_dev(kernel_t)
|
||
|
|
term_filetrans_all_named_dev(kernel_t)
|
||
|
|
# mapping video devices is needed for plymouthd
|
||
|
|
dev_map_dri(kernel_t)
|
||
|
|
dev_map_framebuffer(kernel_t)
|
||
|
|
|
||
|
|
fs_getattr_all_fs(kernel_t)
|
||
|
|
# Mount root file system. Used when loading a policy
|
||
|
|
# from initrd, then mounting the root filesystem
|
||
|
|
fs_mount_all_fs(kernel_t)
|
||
|
|
fs_unmount_all_fs(kernel_t)
|
||
|
|
|
||
|
|
selinux_load_policy(kernel_t)
|
||
|
|
selinux_compute_create_context(kernel_t)
|
||
|
|
|
||
|
|
term_use_all_terms(kernel_t)
|
||
|
|
term_use_ptmx(kernel_t)
|
||
|
|
|
||
|
|
corecmd_list_bin(kernel_t)
|
||
|
|
|
||
|
|
# /proc/sys/kernel/modprobe is set to /bin/true if not using modules,
|
||
|
|
# thus allow a transition into a minimal helper domain through generic bin
|
||
|
|
# types.
|
||
|
|
type kernel_generic_helper_t;
|
||
|
|
domain_type(kernel_generic_helper_t)
|
||
|
|
role system_r types kernel_generic_helper_t;
|
||
|
|
corecmd_bin_entry_type(kernel_generic_helper_t)
|
||
|
|
corecmd_bin_domtrans(kernel_t, kernel_generic_helper_t)
|
||
|
|
|
||
|
|
allow kernel_generic_helper_t kernel_t:fifo_file read_inherited_fifo_file_perms;
|
||
|
|
|
||
|
|
# Enable running `/usr/bin/env [u]mount ...` to support ZFS automounting.
|
||
|
|
# See the module/os/linux/zfs/zfs_ctldir.c file in
|
||
|
|
# https://github.com/openzfs/zfs/ for the usermode helper calls.
|
||
|
|
optional_policy(`
|
||
|
|
mount_domtrans(kernel_generic_helper_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
domain_use_all_fds(kernel_t)
|
||
|
|
domain_signal_all_domains(kernel_t)
|
||
|
|
domain_search_all_domains_state(kernel_t)
|
||
|
|
domain_connect_all_stream_sockets(kernel_t)
|
||
|
|
domain_rw_all_sockets(kernel_t)
|
||
|
|
# Needed for overlayfs mounter checks
|
||
|
|
# (see: https://bugzilla.redhat.com/show_bug.cgi?id=2215454)
|
||
|
|
domain_obj_id_change_exemption(kernel_t)
|
||
|
|
|
||
|
|
files_manage_all_files(kernel_t)
|
||
|
|
files_manage_all_blk_files(kernel_t)
|
||
|
|
files_manage_all_chr_files(kernel_t)
|
||
|
|
files_relabel_all_files(kernel_t)
|
||
|
|
# The 'execute' permission on lower inodes is checked against the mounter
|
||
|
|
# cred by overlayfs, so we need to grant it to allow overlay mounts created
|
||
|
|
# during early boot to work.
|
||
|
|
# In itself, this doesn't allow the kernel to execute all files - an
|
||
|
|
# execute_no_trans permission or a type transition is also needed to grant
|
||
|
|
# that ability (and we are much more strict about those).
|
||
|
|
files_mmap_exec_all_files(kernel_t)
|
||
|
|
|
||
|
|
mcs_process_set_categories(kernel_t)
|
||
|
|
mcs_file_read_all(kernel_t)
|
||
|
|
mcs_file_write_all(kernel_t)
|
||
|
|
mcs_socket_write_all_levels(kernel_t)
|
||
|
|
|
||
|
|
mls_process_read_up(kernel_t)
|
||
|
|
mls_process_write_down(kernel_t)
|
||
|
|
mls_file_downgrade(kernel_t)
|
||
|
|
mls_file_write_all_levels(kernel_t)
|
||
|
|
mls_file_read_all_levels(kernel_t)
|
||
|
|
mls_socket_write_all_levels(kernel_t)
|
||
|
|
mls_fd_share_all_levels(kernel_t)
|
||
|
|
mls_fd_use_all_levels(kernel_t)
|
||
|
|
mls_process_set_level(kernel_t)
|
||
|
|
|
||
|
|
ifdef(`distro_redhat',`
|
||
|
|
# Bugzilla 222337
|
||
|
|
fs_rw_tmpfs_chr_files(kernel_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
abrt_filetrans_named_content(kernel_t)
|
||
|
|
abrt_dump_oops_domtrans(kernel_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
apache_filetrans_home_content(kernel_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
gnome_filetrans_home_content(kernel_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
kerberos_filetrans_home_content(kernel_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
keyutils_request_domtrans(kernel_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
init_dbus_chat(kernel_t)
|
||
|
|
init_sigchld(kernel_t)
|
||
|
|
init_dyntrans(kernel_t)
|
||
|
|
# required actually for plymouthd
|
||
|
|
init_read_state(kernel_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
libs_use_ld_so(kernel_t)
|
||
|
|
libs_use_shared_libs(kernel_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
logging_send_syslog_msg(kernel_t)
|
||
|
|
logging_manage_generic_logs(kernel_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
mta_filetrans_home_content(kernel_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
ssh_filetrans_home_content(kernel_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
storage_filetrans_all_named_dev(kernel_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
userdom_user_home_dir_filetrans_user_home_content(kernel_t, { file dir })
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
nis_use_ypbind(kernel_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
plymouthd_create_log(kernel_t)
|
||
|
|
plymouthd_filetrans_named_content(kernel_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
# nfs kernel server needs kernel UDP access. It is less risky and painful
|
||
|
|
# to just give it everything.
|
||
|
|
allow kernel_t self:tcp_socket create_stream_socket_perms;
|
||
|
|
allow kernel_t self:udp_socket create_socket_perms;
|
||
|
|
|
||
|
|
# nfs kernel server needs kernel UDP access. It is less risky and painful
|
||
|
|
# to just give it everything.
|
||
|
|
corenet_udp_sendrecv_generic_if(kernel_t)
|
||
|
|
corenet_udp_sendrecv_generic_node(kernel_t)
|
||
|
|
corenet_udp_sendrecv_all_ports(kernel_t)
|
||
|
|
corenet_udp_bind_generic_node(kernel_t)
|
||
|
|
corenet_sendrecv_portmap_client_packets(kernel_t)
|
||
|
|
corenet_sendrecv_generic_server_packets(kernel_t)
|
||
|
|
|
||
|
|
auth_dontaudit_getattr_shadow(kernel_t)
|
||
|
|
|
||
|
|
sysnet_read_config(kernel_t)
|
||
|
|
|
||
|
|
rpc_udp_rw_nfs_sockets(kernel_t)
|
||
|
|
|
||
|
|
tunable_policy(`nfs_export_all_ro',`
|
||
|
|
fs_getattr_noxattr_fs(kernel_t)
|
||
|
|
fs_list_noxattr_fs(kernel_t)
|
||
|
|
fs_read_noxattr_fs_files(kernel_t)
|
||
|
|
fs_read_noxattr_fs_symlinks(kernel_t)
|
||
|
|
|
||
|
|
files_read_non_security_files(kernel_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
tunable_policy(`nfs_export_all_rw',`
|
||
|
|
fs_getattr_noxattr_fs(kernel_t)
|
||
|
|
fs_list_noxattr_fs(kernel_t)
|
||
|
|
fs_read_noxattr_fs_files(kernel_t)
|
||
|
|
fs_read_noxattr_fs_symlinks(kernel_t)
|
||
|
|
|
||
|
|
files_manage_non_security_files(kernel_t)
|
||
|
|
')
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
seutil_read_config(kernel_t)
|
||
|
|
seutil_read_bin_policy(kernel_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
systemd_coredump_domtrans(kernel_t)
|
||
|
|
|
||
|
|
# Systemd symlinks /usr/sbin/{poweroff,reboot} (which are invoked by
|
||
|
|
# the kernel to perform an orderly poweroff/reboot) to
|
||
|
|
# /usr/bin/systemctl, so we need to allow the kernel to execute it
|
||
|
|
# and trigger the respective service unit.
|
||
|
|
systemd_systemctl_domain(kernel)
|
||
|
|
systemd_config_power_services(kernel_systemctl_t)
|
||
|
|
systemd_dbus_chat_logind(kernel_systemctl_t)
|
||
|
|
|
||
|
|
dbus_system_bus_client(kernel_systemctl_t)
|
||
|
|
init_read_utmp(kernel_systemctl_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
virt_filetrans_home_content(kernel_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
xserver_xdm_manage_spool(kernel_t)
|
||
|
|
xserver_filetrans_home_content(kernel_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
########################################
|
||
|
|
#
|
||
|
|
# Unlabeled process local policy
|
||
|
|
#
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
# If you load a new policy that removes active domains, processes can
|
||
|
|
# get stuck if you do not allow unlabeled processes to signal init.
|
||
|
|
# If you load an incompatible policy, you should probably reboot,
|
||
|
|
# since you may have compromised system security.
|
||
|
|
init_sigchld(unlabeled_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
########################################
|
||
|
|
#
|
||
|
|
# Kernel module loading policy
|
||
|
|
#
|
||
|
|
|
||
|
|
if( ! secure_mode_insmod ) {
|
||
|
|
allow can_load_kernmodule self:capability sys_module;
|
||
|
|
|
||
|
|
files_load_kernel_modules(can_load_kernmodule)
|
||
|
|
|
||
|
|
# load_module() calls stop_machine() which
|
||
|
|
# calls sched_setscheduler()
|
||
|
|
allow can_load_kernmodule self:capability sys_nice;
|
||
|
|
kernel_setsched(can_load_kernmodule)
|
||
|
|
}
|
||
|
|
|
||
|
|
########################################
|
||
|
|
#
|
||
|
|
# Rules for unconfined acccess to this module
|
||
|
|
#
|
||
|
|
|
||
|
|
allow kern_unconfined proc_type:{ file } ~entrypoint;
|
||
|
|
allow kern_unconfined proc_type:dir ~map;
|
||
|
|
allow kern_unconfined proc_type:lnk_file *;
|
||
|
|
|
||
|
|
allow kern_unconfined sysctl_type:{ file } ~entrypoint;
|
||
|
|
allow kern_unconfined sysctl_type:dir ~map;
|
||
|
|
allow kern_unconfined sysctl_type:lnk_file *;
|
||
|
|
|
||
|
|
allow kern_unconfined kernel_t:system *;
|
||
|
|
|
||
|
|
allow kern_unconfined unlabeled_t:dir ~map;
|
||
|
|
allow kern_unconfined unlabeled_t:{ lnk_file sock_file fifo_file chr_file blk_file } *;
|
||
|
|
allow kern_unconfined unlabeled_t:file ~entrypoint;
|
||
|
|
allow kern_unconfined unlabeled_t:filesystem *;
|
||
|
|
allow kern_unconfined unlabeled_t:association *;
|
||
|
|
allow kern_unconfined unlabeled_t:packet *;
|
||
|
|
allow kern_unconfined unlabeled_t:process ~{ ptrace transition dyntransition execmem execstack execheap };
|
||
|
|
|
||
|
|
#######################################
|
||
|
|
#
|
||
|
|
# Kernel system state reader policy
|
||
|
|
#
|
||
|
|
|
||
|
|
read_files_pattern(kernel_system_state_reader, proc_t, proc_t)
|
||
|
|
read_lnk_files_pattern(kernel_system_state_reader, proc_t, proc_t)
|
||
|
|
list_dirs_pattern(kernel_system_state_reader, proc_t, proc_t)
|