selinux-refpolicy/policy/modules/system/setrans.te

policy_module(setrans, 1.16.0)

gen_require(`
	class context contains;
')

########################################
#
# Declarations
#

type setrans_t;
type setrans_exec_t;
init_daemon_domain(setrans_t, setrans_exec_t)

type setrans_initrc_exec_t;
init_script_file(setrans_initrc_exec_t)

type setrans_runtime_t alias setrans_var_run_t;
files_pid_file(setrans_runtime_t)
mls_trusted_object(setrans_runtime_t)

type setrans_unit_t;
init_unit_file(setrans_unit_t)

ifdef(`distro_debian',`
	init_daemon_pid_file(setrans_runtime_t, dir, "setrans")
')

ifdef(`enable_mcs',`
	init_ranged_daemon_domain(setrans_t, setrans_exec_t, s0 - mcs_systemhigh)
')

ifdef(`enable_mls',`
	init_ranged_daemon_domain(setrans_t, setrans_exec_t, mls_systemhigh)
')

########################################
#
# setrans local policy
#

allow setrans_t self:capability sys_resource;
allow setrans_t self:process { setrlimit getcap setcap signal_perms };
allow setrans_t self:unix_stream_socket create_stream_socket_perms;
allow setrans_t self:unix_dgram_socket create_socket_perms;
allow setrans_t self:netlink_selinux_socket create_socket_perms;
allow setrans_t self:context contains;

can_exec(setrans_t, setrans_exec_t)
corecmd_search_bin(setrans_t)

# create unix domain socket in /var
manage_dirs_pattern(setrans_t, setrans_runtime_t, setrans_runtime_t)
manage_files_pattern(setrans_t, setrans_runtime_t, setrans_runtime_t)
manage_sock_files_pattern(setrans_t, setrans_runtime_t, setrans_runtime_t)
files_pid_filetrans(setrans_t, setrans_runtime_t, { file dir })

kernel_read_kernel_sysctls(setrans_t)
kernel_read_system_state(setrans_t)

# allow performing getpidcon() on all processes
domain_read_all_domains_state(setrans_t)
domain_dontaudit_search_all_domains_state(setrans_t)
domain_getattr_all_domains(setrans_t)
domain_getsession_all_domains(setrans_t)

files_read_etc_runtime_files(setrans_t)

mls_file_read_all_levels(setrans_t)
mls_file_write_all_levels(setrans_t)
mls_net_receive_all_levels(setrans_t)
mls_socket_write_all_levels(setrans_t)
mls_process_read_all_levels(setrans_t)
mls_socket_read_all_levels(setrans_t)

selinux_compute_access_vector(setrans_t)

term_dontaudit_use_generic_ptys(setrans_t)
term_dontaudit_use_unallocated_ttys(setrans_t)

init_dontaudit_use_script_ptys(setrans_t)

locallogin_dontaudit_use_fds(setrans_t)

logging_send_syslog_msg(setrans_t)

miscfiles_read_localization(setrans_t)

seutil_libselinux_linked(setrans_t)

optional_policy(`
	rpm_use_script_fds(setrans_t)
')
Bump module versions for release. Signed-off-by: Chris PeBenito <pebenito@ieee.org> 2020-02-29 21:54:39 +00:00			`policy_module(setrans, 1.16.0)`
trunk: add context contains to setrans. 2009-02-09 13:58:22 +00:00
			gen_require(`
			`class context contains;`
			`')`
most of patch from dan Mon, 15 May 2006 11:58:01 -0400 2006-05-17 14:50:31 +00:00
			`########################################`
			`#`
			`# Declarations`
			`#`

			`type setrans_t;`
- Move range transitions to modules. - Make number of MLS sensitivities, and number of MLS and MCS categories configurable as build options. 2006-10-04 17:25:34 +00:00			`type setrans_exec_t;`
most of patch from dan Mon, 15 May 2006 11:58:01 -0400 2006-05-17 14:50:31 +00:00			`init_daemon_domain(setrans_t, setrans_exec_t)`

trunk: init script for setrans. 2008-09-18 18:20:31 +00:00			`type setrans_initrc_exec_t;`
			`init_script_file(setrans_initrc_exec_t)`

Rename _var_run_t types to _runtime_t. Signed-off-by: Chris PeBenito <pebenito@ieee.org> 2019-09-08 20:55:02 +00:00			`type setrans_runtime_t alias setrans_var_run_t;`
			`files_pid_file(setrans_runtime_t)`
			`mls_trusted_object(setrans_runtime_t)`
most of patch from dan Mon, 15 May 2006 11:58:01 -0400 2006-05-17 14:50:31 +00:00
Reorder declarations based on *_runtime_t renaming. Signed-off-by: Chris PeBenito <pebenito@ieee.org> 2019-09-11 00:05:46 +00:00			`type setrans_unit_t;`
			`init_unit_file(setrans_unit_t)`

sshd/setrans: make respective init scripts create pid dirs with proper contexts Signed-off-by: Dominick Grift <dominick.grift@gmail.com> 2013-11-09 09:45:13 +00:00			ifdef(`distro_debian',`
Rename _var_run_t types to _runtime_t. Signed-off-by: Chris PeBenito <pebenito@ieee.org> 2019-09-08 20:55:02 +00:00			`init_daemon_pid_file(setrans_runtime_t, dir, "setrans")`
sshd/setrans: make respective init scripts create pid dirs with proper contexts Signed-off-by: Dominick Grift <dominick.grift@gmail.com> 2013-11-09 09:45:13 +00:00			`')`

- Move range transitions to modules. - Make number of MLS sensitivities, and number of MLS and MCS categories configurable as build options. 2006-10-04 17:25:34 +00:00			ifdef(`enable_mcs',`
trunk: whitespace fixes 2009-06-26 14:40:13 +00:00			`init_ranged_daemon_domain(setrans_t, setrans_exec_t, s0 - mcs_systemhigh)`
- Move range transitions to modules. - Make number of MLS sensitivities, and number of MLS and MCS categories configurable as build options. 2006-10-04 17:25:34 +00:00			`')`

			ifdef(`enable_mls',`
trunk: whitespace fixes 2009-06-26 14:40:13 +00:00			`init_ranged_daemon_domain(setrans_t, setrans_exec_t, mls_systemhigh)`
- Move range transitions to modules. - Make number of MLS sensitivities, and number of MLS and MCS categories configurable as build options. 2006-10-04 17:25:34 +00:00			`')`

most of patch from dan Mon, 15 May 2006 11:58:01 -0400 2006-05-17 14:50:31 +00:00			`########################################`
			`#`
			`# setrans local policy`
			`#`

patch from dan Thu, 18 May 2006 11:56:22 -0400 2006-05-19 14:02:24 +00:00			`allow setrans_t self:capability sys_resource;`
trunk: ntp and setrans update from dan. 2008-09-11 14:54:40 +00:00			`allow setrans_t self:process { setrlimit getcap setcap signal_perms };`
most of patch from dan Mon, 15 May 2006 11:58:01 -0400 2006-05-17 14:50:31 +00:00			`allow setrans_t self:unix_stream_socket create_stream_socket_perms;`
			`allow setrans_t self:unix_dgram_socket create_socket_perms;`
			`allow setrans_t self:netlink_selinux_socket create_socket_perms;`
trunk: add context contains to setrans. 2009-02-09 13:58:22 +00:00			`allow setrans_t self:context contains;`
most of patch from dan Mon, 15 May 2006 11:58:01 -0400 2006-05-17 14:50:31 +00:00
			`can_exec(setrans_t, setrans_exec_t)`
Merge sbin_t and ls_exec_t into bin_t. 2007-03-23 23:24:59 +00:00			`corecmd_search_bin(setrans_t)`
most of patch from dan Mon, 15 May 2006 11:58:01 -0400 2006-05-17 14:50:31 +00:00
			`# create unix domain socket in /var`
Rename _var_run_t types to _runtime_t. Signed-off-by: Chris PeBenito <pebenito@ieee.org> 2019-09-08 20:55:02 +00:00			`manage_dirs_pattern(setrans_t, setrans_runtime_t, setrans_runtime_t)`
			`manage_files_pattern(setrans_t, setrans_runtime_t, setrans_runtime_t)`
			`manage_sock_files_pattern(setrans_t, setrans_runtime_t, setrans_runtime_t)`
			`files_pid_filetrans(setrans_t, setrans_runtime_t, { file dir })`
most of patch from dan Mon, 15 May 2006 11:58:01 -0400 2006-05-17 14:50:31 +00:00
			`kernel_read_kernel_sysctls(setrans_t)`
setrans: mcstransd reads filesystems file in /proc Signed-off-by: Dominick Grift <dominick.grift@gmail.com> 2013-11-09 09:44:47 +00:00			`kernel_read_system_state(setrans_t)`
most of patch from dan Mon, 15 May 2006 11:58:01 -0400 2006-05-17 14:50:31 +00:00
			`# allow performing getpidcon() on all processes`
			`domain_read_all_domains_state(setrans_t)`
patch from dan Wed, 20 Sep 2006 12:12:49 -0400 2006-09-22 17:14:35 +00:00			`domain_dontaudit_search_all_domains_state(setrans_t)`
most of patch from dan Mon, 15 May 2006 11:58:01 -0400 2006-05-17 14:50:31 +00:00			`domain_getattr_all_domains(setrans_t)`
			`domain_getsession_all_domains(setrans_t)`

			`files_read_etc_runtime_files(setrans_t)`

trunk: Deprecate mls_file_write_down() and mls_file_read_up(), replaced with mls_write_all_levels() and mls_read_all_levels(), for consistency. 2007-08-20 18:26:08 +00:00			`mls_file_read_all_levels(setrans_t)`
			`mls_file_write_all_levels(setrans_t)`
most of patch from dan Mon, 15 May 2006 11:58:01 -0400 2006-05-17 14:50:31 +00:00			`mls_net_receive_all_levels(setrans_t)`
enhanced setransd support from darrel goeddel 2006-10-20 14:44:23 +00:00			`mls_socket_write_all_levels(setrans_t)`
No longer use deprecated MLS interfaces Since commit 2d0c9cec mls_file_read_up and mls_file_write_down interfaces are deprecated even though they are still present. Replace mls_file_read_up with mls_file_read_all_levels and mls_file_write_down with mls_file_write_all_levels. 2014-05-23 18:18:10 +00:00			`mls_process_read_all_levels(setrans_t)`
patch from dan Tue, 24 Oct 2006 11:00:28 -0400 2006-10-31 21:01:48 +00:00			`mls_socket_read_all_levels(setrans_t)`
most of patch from dan Mon, 15 May 2006 11:58:01 -0400 2006-05-17 14:50:31 +00:00
			`selinux_compute_access_vector(setrans_t)`

			`term_dontaudit_use_generic_ptys(setrans_t)`
patch from dan Thu, 31 Aug 2006 15:16:30 -0400 2006-09-01 15:52:05 +00:00			`term_dontaudit_use_unallocated_ttys(setrans_t)`
most of patch from dan Mon, 15 May 2006 11:58:01 -0400 2006-05-17 14:50:31 +00:00
patch from dan Thu, 18 May 2006 11:56:22 -0400 2006-05-19 14:02:24 +00:00			`init_dontaudit_use_script_ptys(setrans_t)`
most of patch from dan Mon, 15 May 2006 11:58:01 -0400 2006-05-17 14:50:31 +00:00
patch from dan Thu, 31 Aug 2006 15:16:30 -0400 2006-09-01 15:52:05 +00:00			`locallogin_dontaudit_use_fds(setrans_t)`

most of patch from dan Mon, 15 May 2006 11:58:01 -0400 2006-05-17 14:50:31 +00:00			`logging_send_syslog_msg(setrans_t)`

			`miscfiles_read_localization(setrans_t)`

setrans: needs to be able to get attributes of selinuxfs, else fails to start in Debian Access noted by Dominick Grift. 2013-12-03 14:52:21 +00:00			`seutil_libselinux_linked(setrans_t)`
patch from dan Wed, 26 Jul 2006 14:42:46 -0400 2006-07-28 15:13:58 +00:00
			optional_policy(`
			`rpm_use_script_fds(setrans_t)`
			`')`