selinux-refpolicy/refpolicy/policy/modules/kernel/kernel.te

222 lines
7.2 KiB
Plaintext
Raw Normal View History

2005-04-20 19:07:16 +00:00
policy_module(kernel,1.0)
2005-06-14 20:40:09 +00:00
########################################
#
# Declarations
#
# assertion related attributes
attribute can_load_kernmodule;
attribute can_receive_kernel_messages;
# domains with unconfined access to kernel resources
attribute kern_unconfined;
# regular entries in proc
attribute proc_type;
# sysctls
attribute sysctl_type;
#
2005-04-14 20:18:17 +00:00
# kernel_t is the domain of kernel threads.
# It is also the target type when checking permissions in the system class.
#
2005-07-05 20:59:51 +00:00
type kernel_t, can_load_kernmodule;
2005-04-14 20:18:17 +00:00
role system_r types kernel_t;
domain_base_type(kernel_t)
sid kernel context_template(system_u:system_r:kernel_t,s0 - s9:c0.c127)
2005-04-14 20:18:17 +00:00
#
# Procfs types
#
type proc_t, proc_type;
2005-06-13 17:35:46 +00:00
files_mountpoint(proc_t)
fs_type(proc_t)
genfscon proc / context_template(system_u:object_r:proc_t,s0)
genfscon proc /sysvipc context_template(system_u:object_r:proc_t,s0)
2005-04-14 20:18:17 +00:00
# kernel message interface
type proc_kmsg_t, proc_type;
genfscon proc /kmsg context_template(system_u:object_r:proc_kmsg_t,s0)
2005-04-14 20:18:17 +00:00
neverallow ~can_receive_kernel_messages proc_kmsg_t:file ~getattr;
# /proc kcore: inaccessible
type proc_kcore_t, proc_type;
neverallow { domain -kern_unconfined } proc_kcore_t:file ~getattr;
genfscon proc /kcore context_template(system_u:object_r:proc_kcore_t,s0)
2005-04-14 20:18:17 +00:00
type proc_mdstat_t, proc_type;
genfscon proc /mdstat context_template(system_u:object_r:proc_mdstat_t,s0)
2005-04-14 20:18:17 +00:00
type proc_net_t, proc_type;
genfscon proc /net context_template(system_u:object_r:proc_net_t,s0)
2005-04-14 20:18:17 +00:00
#
# Sysctl types
#
# /proc/sys directory, base directory of sysctls
type sysctl_t, sysctl_type;
files_mountpoint(sysctl_t)
sid sysctl context_template(system_u:object_r:sysctl_t,s0)
genfscon proc /sys context_template(system_u:object_r:sysctl_t,s0)
2005-04-14 20:18:17 +00:00
# /proc/irq directory and files
type sysctl_irq_t, sysctl_type;
genfscon proc /irq context_template(system_u:object_r:sysctl_irq_t,s0)
2005-04-14 20:18:17 +00:00
# /proc/net/rpc directory and files
type sysctl_rpc_t, sysctl_type;
genfscon proc /net/rpc context_template(system_u:object_r:sysctl_rpc_t,s0)
2005-04-14 20:18:17 +00:00
# /proc/sys/fs directory and files
type sysctl_fs_t, sysctl_type;
2005-06-13 17:35:46 +00:00
files_mountpoint(sysctl_fs_t)
genfscon proc /sys/fs context_template(system_u:object_r:sysctl_fs_t,s0)
2005-04-14 20:18:17 +00:00
# /proc/sys/kernel directory and files
type sysctl_kernel_t, sysctl_type;
genfscon proc /sys/kernel context_template(system_u:object_r:sysctl_kernel_t,s0)
2005-04-14 20:18:17 +00:00
# /proc/sys/kernel/modprobe file
type sysctl_modprobe_t, sysctl_type;
genfscon proc /sys/kernel/modprobe context_template(system_u:object_r:sysctl_modprobe_t,s0)
2005-04-14 20:18:17 +00:00
# /proc/sys/kernel/hotplug file
type sysctl_hotplug_t, sysctl_type;
genfscon proc /sys/kernel/hotplug context_template(system_u:object_r:sysctl_hotplug_t,s0)
2005-04-14 20:18:17 +00:00
# /proc/sys/net directory and files
type sysctl_net_t, sysctl_type;
genfscon proc /sys/net context_template(system_u:object_r:sysctl_net_t,s0)
2005-04-14 20:18:17 +00:00
# /proc/sys/net/unix directory and files
type sysctl_net_unix_t, sysctl_type;
genfscon proc /sys/net/unix context_template(system_u:object_r:sysctl_net_unix_t,s0)
2005-04-14 20:18:17 +00:00
# /proc/sys/vm directory and files
type sysctl_vm_t, sysctl_type;
genfscon proc /sys/vm context_template(system_u:object_r:sysctl_vm_t,s0)
2005-04-14 20:18:17 +00:00
# /proc/sys/dev directory and files
type sysctl_dev_t, sysctl_type;
genfscon proc /sys/dev context_template(system_u:object_r:sysctl_dev_t,s0)
#
# unlabeled_t is the type of unlabeled objects.
# Objects that have no known labeling information or that
# have labels that are no longer valid are treated as having this type.
#
type unlabeled_t;
sid unlabeled context_template(system_u:object_r:unlabeled_t,s0)
# These initial sids are no longer used, and can be removed:
sid any_socket context_template(system_u:object_r:unlabeled_t,s0)
sid file_labels context_template(system_u:object_r:unlabeled_t,s0)
sid icmp_socket context_template(system_u:object_r:unlabeled_t,s0)
sid igmp_packet context_template(system_u:object_r:unlabeled_t,s0)
sid init context_template(system_u:object_r:unlabeled_t,s0)
sid kmod context_template(system_u:object_r:unlabeled_t,s0)
sid netmsg context_template(system_u:object_r:unlabeled_t,s0)
sid policy context_template(system_u:object_r:unlabeled_t,s0)
sid scmp_packet context_template(system_u:object_r:unlabeled_t,s0)
sid sysctl_modprobe context_template(system_u:object_r:unlabeled_t,s0)
sid sysctl_fs context_template(system_u:object_r:unlabeled_t,s0)
sid sysctl_kernel context_template(system_u:object_r:unlabeled_t,s0)
sid sysctl_net context_template(system_u:object_r:unlabeled_t,s0)
sid sysctl_net_unix context_template(system_u:object_r:unlabeled_t,s0)
sid sysctl_vm context_template(system_u:object_r:unlabeled_t,s0)
sid sysctl_dev context_template(system_u:object_r:unlabeled_t,s0)
sid tcp_socket context_template(system_u:object_r:unlabeled_t,s0)
########################################
#
# kernel local policy
#
# Use capabilities. need to investigate which capabilities are actually used
allow kernel_t self:capability *;
# Other possible mount points for the root fs are in files
allow kernel_t unlabeled_t:dir mounton;
# old general_domain_access()
2005-06-08 20:28:45 +00:00
allow kernel_t self:shm create_shm_perms;
allow kernel_t self:sem create_sem_perms;
allow kernel_t self:msg { send receive };
2005-06-08 20:28:45 +00:00
allow kernel_t self:msgq create_msgq_perms;
allow kernel_t self:unix_dgram_socket create_socket_perms;
allow kernel_t self:unix_stream_socket create_stream_socket_perms;
allow kernel_t self:unix_dgram_socket sendto;
allow kernel_t self:unix_stream_socket connectto;
2005-06-08 20:28:45 +00:00
allow kernel_t self:fifo_file rw_file_perms;
allow kernel_t self:fd use;
# old general_proc_read_access():
2005-06-08 20:28:45 +00:00
allow kernel_t proc_t:dir r_dir_perms;
allow kernel_t proc_t:{ lnk_file file } r_file_perms;
allow kernel_t proc_net_t:dir r_dir_perms;
allow kernel_t proc_net_t:file r_file_perms;
allow kernel_t proc_mdstat_t:file r_file_perms;
allow kernel_t proc_kcore_t:file getattr;
allow kernel_t proc_kmsg_t:file getattr;
2005-06-08 20:28:45 +00:00
allow kernel_t sysctl_t:dir r_dir_perms;
allow kernel_t sysctl_kernel_t:dir r_dir_perms;
allow kernel_t sysctl_kernel_t:file r_file_perms;
2005-06-09 21:07:58 +00:00
# Kernel-generated traffic e.g., ICMP replies:
corenet_raw_sendrecv_all_if(kernel_t)
corenet_raw_sendrecv_all_nodes(kernel_t)
# Kernel-generated traffic e.g., TCP resets:
2005-06-10 01:01:13 +00:00
corenet_tcp_sendrecv_all_if(kernel_t)
corenet_tcp_sendrecv_all_nodes(kernel_t)
2005-06-09 21:07:58 +00:00
2005-07-05 20:59:51 +00:00
selinux_load_policy(kernel_t)
2005-06-10 01:01:13 +00:00
term_use_console(kernel_t)
2005-06-09 21:07:58 +00:00
# Mount root file system. Used when loading a policy
# from initrd, then mounting the root filesystem
fs_mount_all_fs(kernel_t)
2005-06-13 17:35:46 +00:00
corecmd_exec_shell(kernel_t)
corecmd_list_sbin(kernel_t)
2005-06-09 21:07:58 +00:00
# /proc/sys/kernel/modprobe is set to /bin/true if not using modules.
2005-06-13 17:35:46 +00:00
corecmd_exec_bin(kernel_t)
2005-06-09 21:07:58 +00:00
domain_signal_all_domains(kernel_t)
2005-06-09 20:50:17 +00:00
2005-06-13 17:35:46 +00:00
files_list_root(kernel_t)
files_list_home(kernel_t)
files_read_usr_files(kernel_t)
2005-06-09 20:50:17 +00:00
init_sigchld(kernel_t)
2005-06-13 17:35:46 +00:00
libs_use_ld_so(kernel_t)
libs_use_shared_libs(kernel_t)
2005-06-13 17:35:46 +00:00
logging_send_syslog_msg(kernel_t)
2005-06-14 20:40:09 +00:00
seutil_read_config(kernel_t)
seutil_read_binary_pol(kernel_t)
2005-06-09 21:07:58 +00:00
neverallow ~can_load_kernmodule self:capability sys_module;
2005-06-09 20:50:17 +00:00
########################################
#
# Unlabeled process local policy
#
# If you load a new policy that removes active domains, processes can
# get stuck if you do not allow unlabeled processes to signal init.
# If you load an incompatible policy, you should probably reboot,
# since you may have compromised system security.
init_sigchld(unlabeled_t)
2005-07-06 20:28:29 +00:00
ifdef(`targeted_policy',`
allow unlabeled_t self:filesystem associate;
')