144 lines
4 KiB
Text
144 lines
4 KiB
Text
|
policy_module(sudo, 1.10.0)
|
||
|
|
|
||
|
|
gen_require(`
|
||
|
|
class passwd { passwd rootok };
|
||
|
|
')
|
||
|
|
|
||
|
|
########################################
|
||
|
|
#
|
||
|
|
# Declarations
|
||
|
|
attribute sudodomain;
|
||
|
|
|
||
|
|
type sudo_exec_t;
|
||
|
|
application_executable_file(sudo_exec_t)
|
||
|
|
|
||
|
|
type sudo_db_t;
|
||
|
|
files_type(sudo_db_t)
|
||
|
|
mls_trusted_object(sudo_db_t)
|
||
|
|
|
||
|
|
type sudo_log_t;
|
||
|
|
logging_log_file(sudo_log_t)
|
||
|
|
|
||
|
|
manage_dirs_pattern(sudodomain, sudo_db_t, sudo_db_t)
|
||
|
|
manage_files_pattern(sudodomain, sudo_db_t, sudo_db_t)
|
||
|
|
|
||
|
|
manage_dirs_pattern(sudodomain, sudo_log_t, sudo_log_t)
|
||
|
|
manage_files_pattern(sudodomain, sudo_log_t, sudo_log_t)
|
||
|
|
logging_log_filetrans(sudodomain, sudo_log_t, dir, "sudo-io")
|
||
|
|
logging_log_filetrans(sudodomain, sudo_log_t, file, "sudo.log")
|
||
|
|
|
||
|
|
##############################
|
||
|
|
#
|
||
|
|
# Local Policy
|
||
|
|
#
|
||
|
|
|
||
|
|
# Use capabilities.
|
||
|
|
allow sudodomain self:capability { chown fowner setuid setgid dac_read_search dac_override sys_nice sys_resource };
|
||
|
|
dontaudit sudodomain self:capability net_admin;
|
||
|
|
allow sudodomain self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
|
||
|
|
allow sudodomain self:process { setexec setrlimit };
|
||
|
|
allow sudodomain self:fd use;
|
||
|
|
allow sudodomain self:fifo_file rw_fifo_file_perms;
|
||
|
|
allow sudodomain self:shm create_shm_perms;
|
||
|
|
allow sudodomain self:sem create_sem_perms;
|
||
|
|
allow sudodomain self:msgq create_msgq_perms;
|
||
|
|
allow sudodomain self:msg { send receive };
|
||
|
|
allow sudodomain self:unix_dgram_socket create_socket_perms;
|
||
|
|
allow sudodomain self:unix_stream_socket create_stream_socket_perms;
|
||
|
|
allow sudodomain self:unix_dgram_socket sendto;
|
||
|
|
allow sudodomain self:unix_stream_socket connectto;
|
||
|
|
allow sudodomain self:key manage_key_perms;
|
||
|
|
allow sudodomain self:netlink_kobject_uevent_socket create_socket_perms;
|
||
|
|
allow sudodomain self:netlink_selinux_socket create_socket_perms;
|
||
|
|
allow sudodomain self:passwd { passwd rootok };
|
||
|
|
|
||
|
|
kernel_getattr_core_if(sudodomain)
|
||
|
|
kernel_link_key(sudodomain)
|
||
|
|
kernel_read_kernel_sysctls(sudodomain)
|
||
|
|
|
||
|
|
corecmd_read_bin_symlinks(sudodomain)
|
||
|
|
corecmd_exec_all_executables(sudodomain)
|
||
|
|
|
||
|
|
dev_getattr_fs(sudodomain)
|
||
|
|
dev_read_urand(sudodomain)
|
||
|
|
dev_rw_generic_usb_dev(sudodomain)
|
||
|
|
dev_read_sysfs(sudodomain)
|
||
|
|
dev_dontaudit_getattr_all(sudodomain)
|
||
|
|
|
||
|
|
domain_use_interactive_fds(sudodomain)
|
||
|
|
domain_sigchld_interactive_fds(sudodomain)
|
||
|
|
domain_getattr_all_entry_files(sudodomain)
|
||
|
|
|
||
|
|
files_read_etc_files(sudodomain)
|
||
|
|
files_read_var_files(sudodomain)
|
||
|
|
files_read_usr_files(sudodomain)
|
||
|
|
# for some PAM modules and for cwd
|
||
|
|
files_dontaudit_search_home(sudodomain)
|
||
|
|
files_list_tmp(sudodomain)
|
||
|
|
|
||
|
|
fs_search_auto_mountpoints(sudodomain)
|
||
|
|
fs_getattr_all_fs(sudodomain)
|
||
|
|
|
||
|
|
selinux_validate_context(sudodomain)
|
||
|
|
selinux_compute_relabel_context(sudodomain)
|
||
|
|
selinux_compute_access_vector(sudodomain)
|
||
|
|
|
||
|
|
term_getattr_pty_fs(sudodomain)
|
||
|
|
term_relabel_all_ttys(sudodomain)
|
||
|
|
term_relabel_all_ptys(sudodomain)
|
||
|
|
term_use_ptmx(sudodomain)
|
||
|
|
|
||
|
|
#auth_run_chk_passwd(sudodomain)
|
||
|
|
# sudo stores a token in the pam_pid directory
|
||
|
|
auth_manage_pam_pid(sudodomain)
|
||
|
|
auth_manage_faillog(sudodomain)
|
||
|
|
auth_read_var_auth(sudodomain)
|
||
|
|
auth_rw_lastlog(sudodomain)
|
||
|
|
|
||
|
|
application_signal(sudodomain)
|
||
|
|
|
||
|
|
init_rw_utmp(sudodomain)
|
||
|
|
|
||
|
|
logging_send_audit_msgs(sudodomain)
|
||
|
|
logging_set_audit_parameters(sudodomain)
|
||
|
|
|
||
|
|
seutil_read_default_contexts(sudodomain)
|
||
|
|
|
||
|
|
userdom_spec_domtrans_all_users(sudodomain)
|
||
|
|
userdom_manage_user_home_content_files(sudodomain)
|
||
|
|
userdom_manage_user_home_content_symlinks(sudodomain)
|
||
|
|
userdom_manage_user_tmp_files(sudodomain)
|
||
|
|
userdom_manage_user_tmp_symlinks(sudodomain)
|
||
|
|
userdom_use_user_terminals(sudodomain)
|
||
|
|
userdom_signal_all_users(sudodomain)
|
||
|
|
userdom_exec_user_home_content_files(sudodomain)
|
||
|
|
# for some PAM modules and for cwd
|
||
|
|
userdom_search_user_home_content(sudodomain)
|
||
|
|
userdom_search_admin_dir(sudodomain)
|
||
|
|
userdom_manage_all_users_keys(sudodomain)
|
||
|
|
|
||
|
|
tunable_policy(`authlogin_yubikey',`
|
||
|
|
auth_manage_home_content(sudodomain)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
dbus_system_bus_client(sudodomain)
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
systemd_dbus_chat_logind(sudodomain)
|
||
|
|
init_getpgid(sudodomain)
|
||
|
|
')
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
ssh_signull(sudodomain)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
systemd_write_inherited_logind_sessions_pipes(sudodomain)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
fprintd_dbus_chat(sudodomain)
|
||
|
|
')
|