selinux-refpolicy/refpolicy/policy/modules/admin/bootloader.te

209 lines
5.6 KiB
Plaintext
Raw Normal View History

2005-04-20 19:07:16 +00:00
policy_module(bootloader,1.2.3)
2005-04-28 21:41:09 +00:00
########################################
#
# Declarations
#
#
# boot_runtime_t is the type for /boot/kernel.h,
# which is automatically generated at boot time.
# only for Red Hat
#
2005-04-16 17:18:34 +00:00
type boot_runtime_t;
files_type(boot_runtime_t)
2005-04-16 17:18:34 +00:00
type bootloader_t;
2005-06-13 17:35:46 +00:00
domain_type(bootloader_t)
role system_r types bootloader_t;
type bootloader_exec_t;
2005-06-13 17:35:46 +00:00
domain_entry_file(bootloader_t,bootloader_exec_t)
2005-04-14 20:18:17 +00:00
#
# bootloader_etc_t is the configuration file,
# grub.conf, lilo.conf, etc.
#
type bootloader_etc_t alias etc_bootloader_t;
files_type(bootloader_etc_t)
2005-04-14 20:18:17 +00:00
#
# The temp file is used for initrd creation;
# it consists of files and device nodes
#
type bootloader_tmp_t;
2005-06-13 17:35:46 +00:00
files_tmp_file(bootloader_tmp_t)
2005-06-13 16:22:32 +00:00
dev_node(bootloader_tmp_t)
2005-04-14 20:18:17 +00:00
2005-10-24 03:52:35 +00:00
#
# /var/log/ksyms
# cjp: this probably can be removed, I do not
# think it is used on 2.6 kernels
type var_log_ksyms_t;
2005-10-25 20:06:27 +00:00
logging_log_file(var_log_ksyms_t)
2005-10-24 03:52:35 +00:00
########################################
#
# bootloader local policy
#
2005-04-14 20:18:17 +00:00
allow bootloader_t self:capability { dac_read_search fsetid sys_rawio sys_admin mknod chown };
allow bootloader_t self:process { sigkill sigstop signull signal };
allow bootloader_t self:fifo_file rw_file_perms;
2005-04-14 20:18:17 +00:00
2005-06-08 20:28:45 +00:00
allow bootloader_t bootloader_etc_t:file r_file_perms;
2005-05-13 14:37:13 +00:00
# uncomment the following lines if you use "lilo -p"
#allow bootloader_t bootloader_etc_t:file manage_file_perms;
#files_etc_filetrans(bootloader_t,bootloader_etc_t,file)
2005-05-13 14:37:13 +00:00
2005-06-08 20:28:45 +00:00
allow bootloader_t bootloader_tmp_t:dir create_dir_perms;
allow bootloader_t bootloader_tmp_t:file create_file_perms;
allow bootloader_t bootloader_tmp_t:chr_file create_file_perms;
allow bootloader_t bootloader_tmp_t:blk_file create_file_perms;
allow bootloader_t bootloader_tmp_t:lnk_file create_lnk_perms;
2006-02-21 18:40:44 +00:00
files_tmp_filetrans(bootloader_t,bootloader_tmp_t,{ dir file lnk_file chr_file blk_file })
2005-05-13 14:37:13 +00:00
# for tune2fs (cjp: ?)
files_root_filetrans(bootloader_t,bootloader_tmp_t,file)
2005-05-13 14:37:13 +00:00
kernel_getattr_core_if(bootloader_t)
2005-04-14 20:18:17 +00:00
kernel_read_system_state(bootloader_t)
kernel_read_software_raid_state(bootloader_t)
kernel_read_kernel_sysctls(bootloader_t)
2005-04-14 20:18:17 +00:00
storage_raw_read_fixed_disk(bootloader_t)
storage_raw_write_fixed_disk(bootloader_t)
storage_raw_read_removable_device(bootloader_t)
storage_raw_write_removable_device(bootloader_t)
2005-06-13 16:22:32 +00:00
dev_getattr_all_chr_files(bootloader_t)
2005-09-01 20:13:42 +00:00
dev_getattr_all_blk_files(bootloader_t)
2005-06-13 16:22:32 +00:00
dev_dontaudit_rw_generic_dev_nodes(bootloader_t)
dev_read_rand(bootloader_t)
dev_read_urand(bootloader_t)
dev_read_sysfs(bootloader_t)
# for reading BIOS data
2005-06-13 16:22:32 +00:00
dev_read_raw_memory(bootloader_t)
2005-04-14 20:18:17 +00:00
2005-06-10 01:01:13 +00:00
fs_getattr_xattr_fs(bootloader_t)
2006-01-25 15:53:35 +00:00
fs_read_tmpfs_symlinks(bootloader_t)
2005-05-13 14:37:13 +00:00
mls_file_read_up(bootloader_t)
2005-06-10 01:01:13 +00:00
term_getattr_all_user_ttys(bootloader_t)
2006-02-02 21:08:12 +00:00
term_dontaudit_manage_pty_dirs(bootloader_t)
2005-05-13 14:37:13 +00:00
corecmd_exec_all_executables(bootloader_t)
2005-04-28 21:41:09 +00:00
2006-02-20 21:33:25 +00:00
domain_use_interactive_fds(bootloader_t)
2005-04-28 21:41:09 +00:00
files_create_boot_dirs(bootloader_t)
files_manage_boot_files(bootloader_t)
files_manage_boot_symlinks(bootloader_t)
files_read_etc_files(bootloader_t)
2005-09-22 21:59:50 +00:00
files_exec_etc_files(bootloader_t)
files_read_usr_src_files(bootloader_t)
2005-06-13 17:35:46 +00:00
files_read_usr_files(bootloader_t)
files_read_var_files(bootloader_t)
files_read_kernel_modules(bootloader_t)
2005-05-13 14:37:13 +00:00
# for nscd
2005-06-13 17:35:46 +00:00
files_dontaudit_search_pids(bootloader_t)
# for blkid.tab
files_manage_etc_runtime_files(bootloader_t)
2005-04-28 21:41:09 +00:00
2005-07-07 15:20:24 +00:00
init_getattr_initctl(bootloader_t)
2006-02-02 21:08:12 +00:00
init_use_script_ptys(bootloader_t)
2006-02-20 21:33:25 +00:00
init_use_script_fds(bootloader_t)
2006-02-02 21:08:12 +00:00
init_rw_script_pipes(bootloader_t)
2005-07-07 15:20:24 +00:00
libs_use_ld_so(bootloader_t)
libs_use_shared_libs(bootloader_t)
2006-02-02 21:08:12 +00:00
libs_read_lib_files(bootloader_t)
2005-09-22 21:59:50 +00:00
libs_exec_lib_files(bootloader_t)
2005-04-14 20:18:17 +00:00
2005-06-13 17:35:46 +00:00
logging_send_syslog_msg(bootloader_t)
logging_rw_generic_logs(bootloader_t)
2005-04-14 20:18:17 +00:00
2005-05-13 14:37:13 +00:00
miscfiles_read_localization(bootloader_t)
2005-04-14 20:18:17 +00:00
2006-02-02 21:08:12 +00:00
seutil_read_bin_policy(bootloader_t)
seutil_read_loadpolicy(bootloader_t)
2005-07-18 18:31:49 +00:00
seutil_dontaudit_search_config(bootloader_t)
2005-06-27 20:59:28 +00:00
ifdef(`distro_debian',`
allow bootloader_t bootloader_tmp_t:{ dir file } { relabelfrom relabelto };
fs_list_tmpfs(bootloader_t)
files_relabel_kernel_modules(bootloader_t)
files_relabelfrom_boot_files(bootloader_t)
files_delete_kernel_modules(bootloader_t)
files_relabelto_usr_files(bootloader_t)
files_search_var_lib(bootloader_t)
2005-06-27 20:59:28 +00:00
# for /usr/share/initrd-tools/scripts
files_exec_usr_files(bootloader_t)
fstools_manage_entry_files(bootloader_t)
fstools_relabelto_entry_files(bootloader_t)
libs_relabelto_lib_files(bootloader_t)
2005-05-13 14:37:13 +00:00
')
2005-04-28 21:41:09 +00:00
2005-06-27 20:59:28 +00:00
ifdef(`distro_redhat',`
# for memlock
allow bootloader_t self:capability ipc_lock;
# new file system defaults to file_t, granting file_t access is still bad.
2005-06-08 20:28:45 +00:00
allow bootloader_t boot_runtime_t:file { r_file_perms unlink };
# mkinitrd mount initrd on bootloader temp dir
2005-06-13 17:35:46 +00:00
files_mountpoint(bootloader_tmp_t)
2005-06-27 20:59:28 +00:00
# new file system defaults to file_t, granting file_t access is still bad.
files_manage_isid_type_dirs(bootloader_t)
files_manage_isid_type_files(bootloader_t)
files_manage_isid_type_symlinks(bootloader_t)
files_manage_isid_type_blk_files(bootloader_t)
files_manage_isid_type_chr_files(bootloader_t)
2005-06-27 20:59:28 +00:00
# for mke2fs
2005-06-13 17:35:46 +00:00
mount_domtrans(bootloader_t)
2005-05-13 14:37:13 +00:00
')
2005-04-28 21:41:09 +00:00
ifdef(`targeted_policy',`
2006-02-02 21:08:12 +00:00
term_use_unallocated_ttys(bootloader_t)
term_use_generic_ptys(bootloader_t)
')
optional_policy(`
2005-09-14 00:30:10 +00:00
fstools_exec(bootloader_t)
2005-05-13 14:37:13 +00:00
')
2005-04-28 21:41:09 +00:00
optional_policy(`
2005-06-13 16:22:32 +00:00
dev_rw_lvm_control(bootloader_t)
2005-06-13 17:35:46 +00:00
lvm_domtrans(bootloader_t)
lvm_read_config(bootloader_t)
2005-05-13 14:37:13 +00:00
')
2005-04-28 21:41:09 +00:00
optional_policy(`
2005-10-18 18:25:33 +00:00
modutils_exec_insmod(bootloader_t)
2006-02-02 21:08:12 +00:00
modutils_read_module_deps(bootloader_t)
modutils_read_module_config(bootloader_t)
2005-06-13 17:35:46 +00:00
modutils_exec_insmod(bootloader_t)
modutils_exec_depmod(bootloader_t)
modutils_exec_update_mods(bootloader_t)
2005-05-13 14:37:13 +00:00
')
2005-04-14 20:18:17 +00:00
optional_policy(`
2006-02-02 21:08:12 +00:00
nscd_socket_use(bootloader_t)
')
optional_policy(`
2006-02-02 21:08:12 +00:00
rpm_rw_pipes(bootloader_t)
2005-07-12 20:34:24 +00:00
')
optional_policy(`
2006-02-21 18:40:44 +00:00
userdom_dontaudit_search_staff_home_dirs(bootloader_t)
userdom_dontaudit_search_sysadm_home_dirs(bootloader_t)
2005-07-18 18:31:49 +00:00
')