selinux-refpolicy/strict/domains/program/init.te

#DESC Init - Process initialization
#
# Authors:  Stephen Smalley <sds@epoch.ncsc.mil> and Timothy Fraser  
# X-Debian-Packages: sysvinit
#

#################################
#
# Rules for the init_t domain.
#
# init_t is the domain of the init process.
# init_exec_t is the type of the init program.
# initctl_t is the type of the named pipe created 
# by init during initialization.  This pipe is used
# to communicate with init.
#
type init_t, domain, privlog, sysctl_kernel_writer, nscd_client_domain, mlsrangetrans, mlsfileread, mlsfilewrite;
role system_r types init_t;
uses_shlib(init_t);
type init_exec_t, file_type, sysadmfile, exec_type;
type initctl_t, file_type, sysadmfile, dev_fs, mlstrustedobject;

# for init to determine whether SE Linux is active so it can know whether to
# activate it
allow init_t security_t:dir search;
allow init_t security_t:file { getattr read };

# for mount points
allow init_t file_t:dir search;

# Use capabilities.
allow init_t self:capability ~sys_module;

# Run /etc/rc.sysinit, /etc/rc, /etc/rc.local in the initrc_t domain.
domain_auto_trans(init_t, initrc_exec_t, initrc_t)

# Run the shell in the sysadm_t domain for single-user mode.
domain_auto_trans(init_t, shell_exec_t, sysadm_t)

# Run /sbin/update in the init_t domain.
can_exec(init_t, sbin_t)

# Run init.
can_exec(init_t, init_exec_t)

# Run chroot from initrd scripts.
ifdef(`chroot.te', `
can_exec(init_t, chroot_exec_t)
')

# Create /dev/initctl.
file_type_auto_trans(init_t, device_t, initctl_t, fifo_file)
ifdef(`distro_redhat', `
file_type_auto_trans(init_t, tmpfs_t, initctl_t, fifo_file)
')

# Create ioctl.save.
file_type_auto_trans(init_t, etc_t, etc_runtime_t, file)

# Update /etc/ld.so.cache
allow init_t ld_so_cache_t:file rw_file_perms;

# Allow access to log files
allow init_t var_t:dir search;
allow init_t var_log_t:dir search;
allow init_t var_log_t:file rw_file_perms;

read_locale(init_t)

# Create unix sockets
allow init_t self:unix_dgram_socket create_socket_perms;
allow init_t self:unix_stream_socket create_socket_perms;
allow init_t self:fifo_file rw_file_perms;

# Permissions required for system startup
allow init_t { bin_t sbin_t }:dir r_dir_perms;
allow init_t { bin_t sbin_t }:{ file lnk_file } { read getattr lock ioctl };

# allow init to fork
allow init_t self:process { fork sigchld };

# Modify utmp.
allow init_t var_run_t:file rw_file_perms;
allow init_t initrc_var_run_t:file { setattr rw_file_perms };
can_unix_connect(init_t, initrc_t)

# For /var/run/shutdown.pid.
var_run_domain(init)

# Shutdown permissions
r_dir_file(init_t, proc_t)
r_dir_file(init_t, self)
allow init_t devpts_t:dir r_dir_perms;

# Modify wtmp.
allow init_t wtmp_t:file rw_file_perms;

# Kill all processes.
allow init_t domain:process signal_perms;

# Allow all processes to send SIGCHLD to init.
allow domain init_t:process { sigchld signull };

# If you load a new policy that removes active domains, processes can
# get stuck if you do not allow unlabeled processes to signal init
# If you load an incompatible policy, you should probably reboot,
# since you may have compromised system security.
allow unlabeled_t init_t:process sigchld;

# for loading policy
allow init_t policy_config_t:file r_file_perms;

# Set booleans.
can_setbool(init_t)

# Read and write the console and ttys.
allow init_t { tty_device_t console_device_t } :chr_file rw_file_perms;
ifdef(`distro_redhat', `
allow init_t tmpfs_t:chr_file rw_file_perms;
')
allow init_t ttyfile:chr_file rw_file_perms;
allow init_t ptyfile:chr_file rw_file_perms;

# Run system executables.
can_exec(init_t,bin_t)
ifdef(`consoletype.te', `
can_exec(init_t, consoletype_exec_t)
')

# Run /etc/X11/prefdm.
can_exec(init_t,etc_t)

allow init_t lib_t:file { getattr read };

allow init_t devtty_t:chr_file { read write };
allow init_t ramfs_t:dir search;
allow init_t ramfs_t:sock_file write;
r_dir_file(init_t, sysfs_t)

r_dir_file(init_t, selinux_config_t)

# file descriptors inherited from the rootfs.
dontaudit init_t root_t:{ file chr_file } { read write }; 
ifdef(`targeted_policy', `
unconfined_domain(init_t)
')