selinux-refpolicy/policy/modules/system/libraries.if

472 lines
9.0 KiB
Plaintext
Raw Normal View History

2005-05-23 15:45:53 +00:00
## <summary>Policy for system libraries.</summary>
########################################
2005-06-24 13:36:57 +00:00
## <summary>
2005-06-23 21:30:57 +00:00
## Execute ldconfig in the ldconfig domain.
2005-06-24 13:36:57 +00:00
## </summary>
2005-06-23 21:30:57 +00:00
## <param name="domain">
## <summary>
## Domain allowed to transition.
## </summary>
2005-06-23 21:30:57 +00:00
## </param>
2005-05-23 15:45:53 +00:00
#
interface(`libs_domtrans_ldconfig',`
2005-06-17 17:59:26 +00:00
gen_require(`
type ldconfig_t, ldconfig_exec_t;
')
2007-03-23 23:24:59 +00:00
corecmd_search_bin($1)
2009-06-26 14:40:13 +00:00
domtrans_pattern($1, ldconfig_exec_t, ldconfig_t)
2005-05-23 15:45:53 +00:00
')
########################################
2005-06-24 13:36:57 +00:00
## <summary>
2005-06-23 21:30:57 +00:00
## Execute ldconfig in the ldconfig domain.
2005-06-24 13:36:57 +00:00
## </summary>
2005-06-23 21:30:57 +00:00
## <param name="domain">
## <summary>
## Domain allowed to transition.
## </summary>
2005-06-23 21:30:57 +00:00
## </param>
## <param name="role">
## <summary>
2005-06-23 21:30:57 +00:00
## The role to allow the ldconfig domain.
## </summary>
2005-06-23 21:30:57 +00:00
## </param>
2006-09-06 22:07:25 +00:00
## <rolecap/>
2005-05-23 15:45:53 +00:00
#
interface(`libs_run_ldconfig',`
2005-06-17 17:59:26 +00:00
gen_require(`
type ldconfig_t;
')
2005-06-13 17:35:46 +00:00
libs_domtrans_ldconfig($1)
role $2 types ldconfig_t;
2005-05-23 15:45:53 +00:00
')
2005-04-20 19:07:16 +00:00
########################################
## <summary>
## Execute ldconfig in the caller domain.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
## <rolecap/>
#
interface(`libs_exec_ldconfig',`
gen_require(`
type ldconfig_exec_t;
')
corecmd_search_bin($1)
can_exec($1, ldconfig_exec_t)
')
2005-04-14 20:18:17 +00:00
########################################
2005-06-24 13:36:57 +00:00
## <summary>
2005-06-23 21:30:57 +00:00
## Use the dynamic link/loader for automatic loading
## of shared libraries.
2005-06-24 13:36:57 +00:00
## </summary>
2005-06-23 21:30:57 +00:00
## <param name="domain">
## <summary>
2006-05-29 14:16:22 +00:00
## Domain allowed access.
## </summary>
2005-06-23 21:30:57 +00:00
## </param>
2005-04-14 20:18:17 +00:00
#
interface(`libs_use_ld_so',`
2005-06-17 17:59:26 +00:00
gen_require(`
type lib_t, ld_so_t, ld_so_cache_t;
')
files_list_etc($1)
2006-12-12 20:08:08 +00:00
allow $1 lib_t:dir list_dir_perms;
2009-06-26 14:40:13 +00:00
read_lnk_files_pattern($1, lib_t, { lib_t ld_so_t })
mmap_files_pattern($1, lib_t, ld_so_t)
2006-12-12 20:08:08 +00:00
refpolicy: Define and allow map permission Kernel commit 6941857e82ae ("selinux: add a map permission check for mmap") added a map permission check on mmap so that we can distinguish memory mapped access (since it has different implications for revocation). The purpose of a separate map permission check on mmap(2) is to permit policy to prohibit memory mapping of specific files for which we need to ensure that every access is revalidated, particularly useful for scenarios where we expect the file to be relabeled at runtime in order to reflect state changes (e.g. cross-domain solution, assured pipeline without data copying). The kernel commit is anticipated to be included in Linux 4.13. This refpolicy change defines map permission for refpolicy. It mirrors the definition in the kernel classmap by adding it to the common definitions for files and sockets. This will break compatibility for kernels that predate the dynamic class/perm mapping support (< 2.6.33, < RHEL 6); on such kernels, one would instead need to add map permission to the end of each file and socket access vector. This change only allows map permission as needed, e.g. only in the mmap_file_perms and exec_file_perms object permission sets (since map is always required there) and only in specific interfaces or modules where denials were observed in limited testing. It is important to note that effective use of this permission requires complete removal of unconfined, as otherwise unconfined domains will be able to map all file types and therefore bypass the intended protection. If we wanted to exclude map permission to all file types by default from unconfined, we would need to add it to the list of permissions excluded from files_unconfined_type in kernel/files.te. Policies that depend on this permission not being allowed to specific file types should also make use of neverallow rules to ensure that this is not undermined by any allow rule, and ensure that they are performing neverallow checking at policy build time (e.g. make validate) or runtime (e.g. semanage.conf expand-check=1). Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2017-05-24 19:40:18 +00:00
allow $1 ld_so_cache_t:file { map read_file_perms };
2005-04-14 20:18:17 +00:00
')
2005-04-26 19:10:29 +00:00
########################################
2005-06-24 13:36:57 +00:00
## <summary>
2005-06-23 21:30:57 +00:00
## Use the dynamic link/loader for automatic loading
## of shared libraries with legacy support.
2005-06-24 13:36:57 +00:00
## </summary>
2005-06-23 21:30:57 +00:00
## <param name="domain">
## <summary>
2006-05-29 14:16:22 +00:00
## Domain allowed access.
## </summary>
2005-06-23 21:30:57 +00:00
## </param>
2005-04-26 19:10:29 +00:00
#
interface(`libs_legacy_use_ld_so',`
2005-06-17 17:59:26 +00:00
gen_require(`
type ld_so_t, ld_so_cache_t;
')
2005-06-13 17:35:46 +00:00
libs_use_ld_so($1)
allow $1 ld_so_t:file execmod;
allow $1 ld_so_cache_t:file execute;
2005-04-26 19:10:29 +00:00
')
2005-05-12 20:50:09 +00:00
########################################
2005-06-24 13:36:57 +00:00
## <summary>
## Execute the dynamic link/loader in the caller's domain.
## </summary>
2005-06-23 21:30:57 +00:00
## <param name="domain">
## <summary>
2006-05-29 14:16:22 +00:00
## Domain allowed access.
## </summary>
2005-06-23 21:30:57 +00:00
## </param>
2005-05-12 20:50:09 +00:00
#
interface(`libs_exec_ld_so',`
2005-06-17 17:59:26 +00:00
gen_require(`
type lib_t, ld_so_t;
')
2006-12-12 20:08:08 +00:00
allow $1 lib_t:dir list_dir_perms;
2009-06-26 14:40:13 +00:00
read_lnk_files_pattern($1, lib_t, { lib_t ld_so_t })
exec_files_pattern($1, lib_t, ld_so_t)
2005-05-12 20:50:09 +00:00
')
2006-01-11 23:20:28 +00:00
########################################
## <summary>
## Create, read, write, and delete the
## dynamic link/loader.
## </summary>
## <param name="domain">
## <summary>
2006-01-11 23:20:28 +00:00
## Domain allowed access.
## </summary>
2006-01-11 23:20:28 +00:00
## </param>
#
# cjp: added for prelink
interface(`libs_manage_ld_so',`
gen_require(`
type lib_t, ld_so_t;
')
2009-06-26 14:40:13 +00:00
manage_files_pattern($1, lib_t, ld_so_t)
2006-01-11 23:20:28 +00:00
')
########################################
## <summary>
## Relabel to and from the type used for
## the dynamic link/loader.
## </summary>
## <param name="domain">
## <summary>
2006-01-11 23:20:28 +00:00
## Domain allowed access.
## </summary>
2006-01-11 23:20:28 +00:00
## </param>
#
# cjp: added for prelink
interface(`libs_relabel_ld_so',`
gen_require(`
type lib_t, ld_so_t;
')
2009-06-26 14:40:13 +00:00
relabel_files_pattern($1, lib_t, ld_so_t)
2006-01-11 23:20:28 +00:00
')
2005-04-14 20:18:17 +00:00
########################################
2005-06-24 13:36:57 +00:00
## <summary>
2005-06-23 21:30:57 +00:00
## Modify the dynamic link/loader's cached listing
## of shared libraries.
2005-06-24 13:36:57 +00:00
## </summary>
2005-06-23 21:30:57 +00:00
## <param name="domain">
## <summary>
2006-05-29 14:16:22 +00:00
## Domain allowed access.
## </summary>
2005-06-23 21:30:57 +00:00
## </param>
2005-04-14 20:18:17 +00:00
#
interface(`libs_rw_ld_so_cache',`
2005-06-17 17:59:26 +00:00
gen_require(`
type ld_so_cache_t;
')
2005-06-17 17:59:26 +00:00
files_list_etc($1)
2005-06-09 14:50:48 +00:00
allow $1 ld_so_cache_t:file rw_file_perms;
2005-04-14 20:18:17 +00:00
')
2005-06-17 17:59:26 +00:00
########################################
2005-06-24 13:36:57 +00:00
## <summary>
2006-05-29 14:16:22 +00:00
## Search library directories.
2005-06-24 13:36:57 +00:00
## </summary>
2005-06-23 21:30:57 +00:00
## <param name="domain">
## <summary>
2006-05-29 14:16:22 +00:00
## Domain allowed access.
## </summary>
2005-06-23 21:30:57 +00:00
## </param>
2005-06-17 17:59:26 +00:00
#
interface(`libs_search_lib',`
2005-06-17 17:59:26 +00:00
gen_require(`
type lib_t;
')
2006-12-12 20:08:08 +00:00
allow $1 lib_t:dir search_dir_perms;
2005-04-14 20:18:17 +00:00
')
########################################
## <summary>
## Do not audit attempts to write to library directories.
## </summary>
## <desc>
## <p>
## Do not audit attempts to write to library directories.
## Typically this is used to quiet attempts to recompile
## python byte code.
## </p>
## </desc>
## <param name="domain">
## <summary>
## Domain to not audit.
## </summary>
## </param>
#
interface(`libs_dontaudit_write_lib_dirs',`
gen_require(`
type lib_t;
')
dontaudit $1 lib_t:dir write;
')
2006-05-29 14:16:22 +00:00
########################################
## <summary>
## Create, read, write, and delete library directories.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`libs_manage_lib_dirs',`
gen_require(`
type lib_t;
')
allow $1 lib_t:dir manage_dir_perms;
')
########################################
## <summary>
## dontaudit attempts to setattr on library files
## </summary>
## <param name="domain">
## <summary>
## Domain to not audit.
## </summary>
## </param>
#
interface(`libs_dontaudit_setattr_lib_files',`
gen_require(`
type lib_t;
')
dontaudit $1 lib_t:file setattr;
')
2005-04-14 20:18:17 +00:00
########################################
2005-06-24 13:36:57 +00:00
## <summary>
2005-06-23 21:30:57 +00:00
## Read files in the library directories, such
## as static libraries.
2005-06-24 13:36:57 +00:00
## </summary>
2005-06-23 21:30:57 +00:00
## <param name="domain">
## <summary>
2006-05-29 14:16:22 +00:00
## Domain allowed access.
## </summary>
2005-06-23 21:30:57 +00:00
## </param>
2005-04-14 20:18:17 +00:00
#
2006-02-02 21:08:12 +00:00
interface(`libs_read_lib_files',`
2005-06-17 17:59:26 +00:00
gen_require(`
type lib_t;
')
2010-03-19 18:21:23 +00:00
files_list_usr($1)
2009-06-26 14:40:13 +00:00
list_dirs_pattern($1, lib_t, lib_t)
read_files_pattern($1, lib_t, lib_t)
read_lnk_files_pattern($1, lib_t, lib_t)
2005-05-30 21:17:20 +00:00
')
########################################
2005-06-24 13:36:57 +00:00
## <summary>
2005-06-23 21:30:57 +00:00
## Execute library scripts in the caller domain.
2005-06-24 13:36:57 +00:00
## </summary>
2005-06-23 21:30:57 +00:00
## <param name="domain">
## <summary>
2006-05-29 14:16:22 +00:00
## Domain allowed access.
## </summary>
2005-06-23 21:30:57 +00:00
## </param>
2005-05-30 21:17:20 +00:00
#
interface(`libs_exec_lib_files',`
2005-06-17 17:59:26 +00:00
gen_require(`
type lib_t;
')
2005-06-17 17:59:26 +00:00
files_search_usr($1)
2006-12-12 20:08:08 +00:00
allow $1 lib_t:dir list_dir_perms;
2009-06-26 14:40:13 +00:00
read_lnk_files_pattern($1, lib_t, lib_t)
exec_files_pattern($1, lib_t, lib_t)
2005-05-30 21:17:20 +00:00
')
2006-01-11 23:20:28 +00:00
########################################
## <summary>
## Create, read, write, and delete generic
## files in library directories.
## </summary>
## <param name="domain">
## <summary>
2006-01-11 23:20:28 +00:00
## Domain allowed access.
## </summary>
2006-01-11 23:20:28 +00:00
## </param>
#
# cjp: added for prelink
interface(`libs_manage_lib_files',`
gen_require(`
type lib_t;
')
2009-06-26 14:40:13 +00:00
manage_files_pattern($1, lib_t, lib_t)
2006-01-11 23:20:28 +00:00
')
2005-05-30 21:17:20 +00:00
########################################
## <summary>
## Relabel files to the type used in library directories.
## </summary>
## <param name="domain">
## <summary>
2006-05-29 14:16:22 +00:00
## Domain allowed access.
## </summary>
## </param>
#
interface(`libs_relabelto_lib_files',`
gen_require(`
type lib_t;
')
2009-06-26 14:40:13 +00:00
relabelto_files_pattern($1, lib_t, lib_t)
')
2006-01-11 23:20:28 +00:00
########################################
## <summary>
## Relabel to and from the type used
## for generic lib files.
## </summary>
## <param name="domain">
## <summary>
2006-01-11 23:20:28 +00:00
## Domain allowed access.
## </summary>
2006-01-11 23:20:28 +00:00
## </param>
#
# cjp: added for prelink
interface(`libs_relabel_lib_files',`
gen_require(`
type lib_t;
')
2009-06-26 14:40:13 +00:00
relabel_files_pattern($1, lib_t, lib_t)
2006-01-11 23:20:28 +00:00
')
########################################
## <summary>
## Delete generic symlinks in library directories.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
# cjp: added for prelink
interface(`libs_delete_lib_symlinks',`
gen_require(`
type lib_t;
')
2009-06-26 14:40:13 +00:00
delete_lnk_files_pattern($1, lib_t, lib_t)
')
2006-01-11 23:20:28 +00:00
########################################
## <summary>
## Create, read, write, and delete shared libraries.
## </summary>
## <param name="domain">
## <summary>
2006-01-11 23:20:28 +00:00
## Domain allowed access.
## </summary>
2006-01-11 23:20:28 +00:00
## </param>
#
# cjp: added for prelink
interface(`libs_manage_shared_libs',`
gen_require(`
type lib_t, textrel_shlib_t;
2006-01-11 23:20:28 +00:00
')
2009-06-26 14:40:13 +00:00
manage_files_pattern($1, lib_t, { lib_t textrel_shlib_t })
2006-01-11 23:20:28 +00:00
')
########################################
2005-06-24 13:36:57 +00:00
## <summary>
2005-06-23 21:30:57 +00:00
## Load and execute functions from shared libraries.
2005-06-24 13:36:57 +00:00
## </summary>
2005-06-23 21:30:57 +00:00
## <param name="domain">
## <summary>
2006-05-29 14:16:22 +00:00
## Domain allowed access.
## </summary>
2005-06-23 21:30:57 +00:00
## </param>
2005-04-14 20:18:17 +00:00
#
interface(`libs_use_shared_libs',`
2005-06-17 17:59:26 +00:00
gen_require(`
type lib_t, textrel_shlib_t;
2005-06-17 17:59:26 +00:00
')
2010-03-19 18:21:23 +00:00
files_search_usr($1)
2006-12-12 20:08:08 +00:00
allow $1 lib_t:dir list_dir_perms;
2009-06-26 14:40:13 +00:00
read_lnk_files_pattern($1, lib_t, { lib_t textrel_shlib_t })
mmap_files_pattern($1, lib_t, { lib_t textrel_shlib_t })
allow $1 textrel_shlib_t:file execmod;
2005-04-14 20:18:17 +00:00
')
########################################
2005-06-24 13:36:57 +00:00
## <summary>
2005-06-23 21:30:57 +00:00
## Load and execute functions from shared libraries,
## with legacy support.
2005-06-24 13:36:57 +00:00
## </summary>
2005-06-23 21:30:57 +00:00
## <param name="domain">
## <summary>
2006-05-29 14:16:22 +00:00
## Domain allowed access.
## </summary>
2005-06-23 21:30:57 +00:00
## </param>
2005-04-26 19:10:29 +00:00
#
interface(`libs_legacy_use_shared_libs',`
2005-06-17 17:59:26 +00:00
gen_require(`
type lib_t;
2005-06-17 17:59:26 +00:00
')
2005-06-13 17:35:46 +00:00
libs_use_shared_libs($1)
allow $1 lib_t:file execmod;
2005-04-26 19:10:29 +00:00
')
2006-01-11 23:20:28 +00:00
########################################
## <summary>
## Relabel to and from the type used for
## shared libraries.
## </summary>
## <param name="domain">
## <summary>
2006-01-11 23:20:28 +00:00
## Domain allowed access.
## </summary>
2006-01-11 23:20:28 +00:00
## </param>
#
# cjp: added for prelink
interface(`libs_relabel_shared_libs',`
gen_require(`
type lib_t, textrel_shlib_t;
2006-01-11 23:20:28 +00:00
')
2009-06-26 14:40:13 +00:00
relabel_files_pattern($1, lib_t, { lib_t textrel_shlib_t })
2006-01-11 23:20:28 +00:00
')