RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
selinux-refpolicy/policy/modules/apps/chromium.te

363 lines
11 KiB
Plaintext
Raw Normal View History

various: Module version bump. Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2019-12-26 17:21:07 +00:00
policy_module(chromium, 1.1.3)
Add chromium policy upstreamed from Gentoo Signed-off-by: Jason Zaman <jason@perfinion.com>
2019-01-12 08:03:44 +00:00
########################################
#
# Declarations
#
## <desc>
## <p>
## Allow chromium to read system information
## </p>
## <p>
## Although not needed for regular browsing, this will allow chromium to update
## its own memory consumption based on system state, support additional
## debugging, detect specific devices, etc.
## </p>
## </desc>
gen_tunable(chromium_read_system_info, false)
## <desc>
## <p>
## Allow chromium to bind to tcp ports
## </p>
## <p>
## Although not needed for regular browsing, some chrome extensions need to
## bind to tcp ports and accept connections.
## </p>
## </desc>
gen_tunable(chromium_bind_tcp_unreserved_ports, false)
## <desc>
## <p>
## Allow chromium to read/write USB devices
## </p>
## <p>
## Although not needed for regular browsing, used for debugging over usb
## or using FIDO U2F tokens.
## </p>
## </desc>
gen_tunable(chromium_rw_usb_dev, false)
type chromium_t;
domain_dyntrans_type(chromium_t)
type chromium_exec_t;
application_domain(chromium_t, chromium_exec_t)
type chromium_naclhelper_t;
type chromium_naclhelper_exec_t;
application_domain(chromium_naclhelper_t, chromium_naclhelper_exec_t)
type chromium_sandbox_t;
type chromium_sandbox_exec_t;
application_domain(chromium_sandbox_t, chromium_sandbox_exec_t)
type chromium_renderer_t;
domain_base_type(chromium_renderer_t)
type chromium_tmp_t;
userdom_user_tmp_file(chromium_tmp_t)
type chromium_tmpfs_t;
userdom_user_tmpfs_file(chromium_tmpfs_t)
optional_policy(`
pulseaudio_tmpfs_content(chromium_tmpfs_t)
')
type chromium_xdg_config_t;
xdg_config_content(chromium_xdg_config_t)
type chromium_xdg_cache_t;
xdg_cache_content(chromium_xdg_cache_t)
########################################
#
# chromium local policy
#
# execmem for load in plugins
allow chromium_t self:process { execmem getsched getcap setcap setrlimit setsched sigkill signal };
allow chromium_t self:fifo_file rw_fifo_file_perms;
allow chromium_t self:sem create_sem_perms;
allow chromium_t self:netlink_kobject_uevent_socket client_stream_socket_perms;
# cap_userns sys_admin for the sandbox
allow chromium_t self:cap_userns { sys_admin sys_chroot sys_ptrace };
allow chromium_t chromium_exec_t:file execute_no_trans;
allow chromium_t chromium_renderer_t:dir list_dir_perms;
allow chromium_t chromium_renderer_t:file rw_file_perms;
allow chromium_t chromium_renderer_t:fd use;
allow chromium_t chromium_renderer_t:process signal_perms;
allow chromium_t chromium_renderer_t:shm rw_shm_perms;
allow chromium_t chromium_renderer_t:unix_dgram_socket { read write };
allow chromium_t chromium_renderer_t:unix_stream_socket { read write };
chromium There are several nacl binaries that need labels. Put an ifdef debian for some chromium paths. Git policy misses chromium_role() lines, were they in another patch that was submitted at the same time? I don't know what this is for but doesn't seem harmful to allow it: type=PROCTITLE msg=audit(28/01/19 19:31:42.361:3218) : proctitle=/bin/bash /usr/bin/google-chrome type=SYSCALL msg=audit(28/01/19 19:31:42.361:3218) : arch=x86_64 syscall=openat success=yes exit=3 a0=0xffffff9c a1=0x563328f7b590 a2=O_WRONLY|O_CREAT|O_TRUNC a3=0x1b6 items=0 ppid=5158 pid=5166 auid=test uid=test gid=test euid=test suid=test fsuid=test egid=test sgid=test fsgid=test tty=pts7 ses=232 comm=google-chrome exe=/bin/bash subj=user_u:user_r:chromium_t:s0 key=(null) type=AVC msg=audit(28/01/19 19:31:42.361:3218) : avc: granted { associate } for pid=5166 comm=google-chrome name=63 scontext=user_u:object_r:chromium_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=filesystem type=AVC msg=audit(28/01/19 19:31:42.361:3218) : avc: granted { create } for pid=5166 comm=google-chrome name=63 scontext=user_u:user_r:chromium_t:s0 tcontext=user_u:object_r:chromium_t:s0 tclass=file type=AVC msg=audit(28/01/19 19:31:42.361:3218) : avc: granted { add_name } for pid=5166 comm=google-chrome name=63 scontext=user_u:user_r:chromium_t:s0 tcontext=user_u:user_r:chromium_t:s0 tclass=dir Allow domain_use_interactive_fds() for running via ssh -X. Allow managing xdg data, cache, and config. Allow reading public data from apt and dpkg, probably from lsb_release or some other shell script. How does the whold naclhelper thing work anyway? I'm nervous about process share access involving chromium_sandbox_t, is that really what we want? Added lots of other stuff like searching cgroup dirs etc.
2019-01-28 08:46:49 +00:00
allow chromium_t chromium_sandbox_t:unix_dgram_socket { getattr read write };
allow chromium_t chromium_sandbox_t:unix_stream_socket { getattr read write };
Add chromium policy upstreamed from Gentoo Signed-off-by: Jason Zaman <jason@perfinion.com>
2019-01-12 08:03:44 +00:00
allow chromium_t chromium_naclhelper_t:process { share };
# tmp has a wide class access (used for plugins)
manage_files_pattern(chromium_t, chromium_tmp_t, chromium_tmp_t)
allow chromium_t chromium_tmp_t:file map;
manage_dirs_pattern(chromium_t, chromium_tmp_t, chromium_tmp_t)
manage_lnk_files_pattern(chromium_t, chromium_tmp_t, chromium_tmp_t)
manage_sock_files_pattern(chromium_t, chromium_tmp_t, chromium_tmp_t)
manage_fifo_files_pattern(chromium_t, chromium_tmp_t, chromium_tmp_t)
files_tmp_filetrans(chromium_t, chromium_tmp_t, { file dir sock_file })
manage_files_pattern(chromium_t, chromium_tmpfs_t, chromium_tmpfs_t)
allow chromium_t chromium_tmpfs_t:file map;
fs_tmpfs_filetrans(chromium_t, chromium_tmpfs_t, file)
fs_tmpfs_filetrans(chromium_renderer_t, chromium_tmpfs_t, file)
manage_files_pattern(chromium_t, chromium_xdg_config_t, chromium_xdg_config_t)
allow chromium_t chromium_xdg_config_t:file map;
manage_lnk_files_pattern(chromium_t, chromium_xdg_config_t, chromium_xdg_config_t)
manage_dirs_pattern(chromium_t, chromium_xdg_config_t, chromium_xdg_config_t)
xdg_config_filetrans(chromium_t, chromium_xdg_config_t, dir, "chromium")
manage_files_pattern(chromium_t, chromium_xdg_cache_t, chromium_xdg_cache_t)
allow chromium_t chromium_xdg_cache_t:file map;
manage_dirs_pattern(chromium_t, chromium_xdg_cache_t, chromium_xdg_cache_t)
xdg_cache_filetrans(chromium_t, chromium_xdg_cache_t, dir, "chromium")
dyntrans_pattern(chromium_t, chromium_renderer_t)
domtrans_pattern(chromium_t, chromium_sandbox_exec_t, chromium_sandbox_t)
domtrans_pattern(chromium_t, chromium_naclhelper_exec_t, chromium_naclhelper_t)
kernel_list_proc(chromium_t)
kernel_read_net_sysctls(chromium_t)
corecmd_exec_bin(chromium_t)
# Look for /etc/gentoo-release through a shell invocation running find
corecmd_exec_shell(chromium_t)
corenet_tcp_connect_all_unreserved_ports(chromium_t)
corenet_tcp_connect_ftp_port(chromium_t)
corenet_tcp_connect_http_port(chromium_t)
corenet_udp_bind_generic_node(chromium_t)
corenet_udp_bind_all_unreserved_ports(chromium_t)
dev_read_sound(chromium_t)
dev_write_sound(chromium_t)
dev_read_urand(chromium_t)
dev_read_rand(chromium_t)
dev_rw_xserver_misc(chromium_t)
dev_map_xserver_misc(chromium_t)
domain_dontaudit_search_all_domains_state(chromium_t)
chromium There are several nacl binaries that need labels. Put an ifdef debian for some chromium paths. Git policy misses chromium_role() lines, were they in another patch that was submitted at the same time? I don't know what this is for but doesn't seem harmful to allow it: type=PROCTITLE msg=audit(28/01/19 19:31:42.361:3218) : proctitle=/bin/bash /usr/bin/google-chrome type=SYSCALL msg=audit(28/01/19 19:31:42.361:3218) : arch=x86_64 syscall=openat success=yes exit=3 a0=0xffffff9c a1=0x563328f7b590 a2=O_WRONLY|O_CREAT|O_TRUNC a3=0x1b6 items=0 ppid=5158 pid=5166 auid=test uid=test gid=test euid=test suid=test fsuid=test egid=test sgid=test fsgid=test tty=pts7 ses=232 comm=google-chrome exe=/bin/bash subj=user_u:user_r:chromium_t:s0 key=(null) type=AVC msg=audit(28/01/19 19:31:42.361:3218) : avc: granted { associate } for pid=5166 comm=google-chrome name=63 scontext=user_u:object_r:chromium_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=filesystem type=AVC msg=audit(28/01/19 19:31:42.361:3218) : avc: granted { create } for pid=5166 comm=google-chrome name=63 scontext=user_u:user_r:chromium_t:s0 tcontext=user_u:object_r:chromium_t:s0 tclass=file type=AVC msg=audit(28/01/19 19:31:42.361:3218) : avc: granted { add_name } for pid=5166 comm=google-chrome name=63 scontext=user_u:user_r:chromium_t:s0 tcontext=user_u:user_r:chromium_t:s0 tclass=dir Allow domain_use_interactive_fds() for running via ssh -X. Allow managing xdg data, cache, and config. Allow reading public data from apt and dpkg, probably from lsb_release or some other shell script. How does the whold naclhelper thing work anyway? I'm nervous about process share access involving chromium_sandbox_t, is that really what we want? Added lots of other stuff like searching cgroup dirs etc.
2019-01-28 08:46:49 +00:00
domain_use_interactive_fds(chromium_t)
Add chromium policy upstreamed from Gentoo Signed-off-by: Jason Zaman <jason@perfinion.com>
2019-01-12 08:03:44 +00:00
files_list_home(chromium_t)
files_search_home(chromium_t)
files_read_usr_files(chromium_t)
files_map_usr_files(chromium_t)
files_read_etc_files(chromium_t)
# During find for /etc/whatever-release we get lots of output otherwise
files_dontaudit_getattr_all_dirs(chromium_t)
fs_dontaudit_getattr_xattr_fs(chromium_t)
chromium There are several nacl binaries that need labels. Put an ifdef debian for some chromium paths. Git policy misses chromium_role() lines, were they in another patch that was submitted at the same time? I don't know what this is for but doesn't seem harmful to allow it: type=PROCTITLE msg=audit(28/01/19 19:31:42.361:3218) : proctitle=/bin/bash /usr/bin/google-chrome type=SYSCALL msg=audit(28/01/19 19:31:42.361:3218) : arch=x86_64 syscall=openat success=yes exit=3 a0=0xffffff9c a1=0x563328f7b590 a2=O_WRONLY|O_CREAT|O_TRUNC a3=0x1b6 items=0 ppid=5158 pid=5166 auid=test uid=test gid=test euid=test suid=test fsuid=test egid=test sgid=test fsgid=test tty=pts7 ses=232 comm=google-chrome exe=/bin/bash subj=user_u:user_r:chromium_t:s0 key=(null) type=AVC msg=audit(28/01/19 19:31:42.361:3218) : avc: granted { associate } for pid=5166 comm=google-chrome name=63 scontext=user_u:object_r:chromium_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=filesystem type=AVC msg=audit(28/01/19 19:31:42.361:3218) : avc: granted { create } for pid=5166 comm=google-chrome name=63 scontext=user_u:user_r:chromium_t:s0 tcontext=user_u:object_r:chromium_t:s0 tclass=file type=AVC msg=audit(28/01/19 19:31:42.361:3218) : avc: granted { add_name } for pid=5166 comm=google-chrome name=63 scontext=user_u:user_r:chromium_t:s0 tcontext=user_u:user_r:chromium_t:s0 tclass=dir Allow domain_use_interactive_fds() for running via ssh -X. Allow managing xdg data, cache, and config. Allow reading public data from apt and dpkg, probably from lsb_release or some other shell script. How does the whold naclhelper thing work anyway? I'm nervous about process share access involving chromium_sandbox_t, is that really what we want? Added lots of other stuff like searching cgroup dirs etc.
2019-01-28 08:46:49 +00:00
fs_getattr_tmpfs(chromium_t)
fs_search_cgroup_dirs(chromium_t)
Add chromium policy upstreamed from Gentoo Signed-off-by: Jason Zaman <jason@perfinion.com>
2019-01-12 08:03:44 +00:00
miscfiles_read_all_certs(chromium_t)
miscfiles_read_localization(chromium_t)
sysnet_dns_name_resolve(chromium_t)
chromium There are several nacl binaries that need labels. Put an ifdef debian for some chromium paths. Git policy misses chromium_role() lines, were they in another patch that was submitted at the same time? I don't know what this is for but doesn't seem harmful to allow it: type=PROCTITLE msg=audit(28/01/19 19:31:42.361:3218) : proctitle=/bin/bash /usr/bin/google-chrome type=SYSCALL msg=audit(28/01/19 19:31:42.361:3218) : arch=x86_64 syscall=openat success=yes exit=3 a0=0xffffff9c a1=0x563328f7b590 a2=O_WRONLY|O_CREAT|O_TRUNC a3=0x1b6 items=0 ppid=5158 pid=5166 auid=test uid=test gid=test euid=test suid=test fsuid=test egid=test sgid=test fsgid=test tty=pts7 ses=232 comm=google-chrome exe=/bin/bash subj=user_u:user_r:chromium_t:s0 key=(null) type=AVC msg=audit(28/01/19 19:31:42.361:3218) : avc: granted { associate } for pid=5166 comm=google-chrome name=63 scontext=user_u:object_r:chromium_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=filesystem type=AVC msg=audit(28/01/19 19:31:42.361:3218) : avc: granted { create } for pid=5166 comm=google-chrome name=63 scontext=user_u:user_r:chromium_t:s0 tcontext=user_u:object_r:chromium_t:s0 tclass=file type=AVC msg=audit(28/01/19 19:31:42.361:3218) : avc: granted { add_name } for pid=5166 comm=google-chrome name=63 scontext=user_u:user_r:chromium_t:s0 tcontext=user_u:user_r:chromium_t:s0 tclass=dir Allow domain_use_interactive_fds() for running via ssh -X. Allow managing xdg data, cache, and config. Allow reading public data from apt and dpkg, probably from lsb_release or some other shell script. How does the whold naclhelper thing work anyway? I'm nervous about process share access involving chromium_sandbox_t, is that really what we want? Added lots of other stuff like searching cgroup dirs etc.
2019-01-28 08:46:49 +00:00
# for /run/udev/data/*
udev_read_pid_files(chromium_t)
Add chromium policy upstreamed from Gentoo Signed-off-by: Jason Zaman <jason@perfinion.com>
2019-01-12 08:03:44 +00:00
userdom_user_content_access_template(chromium, chromium_t)
userdom_dontaudit_list_user_home_dirs(chromium_t)
# Debugging. Also on user_tty_device_t if X is started through "startx" for instance
userdom_use_user_terminals(chromium_t)
userdom_manage_user_certs(chromium_t)
userdom_user_home_dir_filetrans_user_cert(chromium_t, dir, ".pki")
xdg_create_cache_dirs(chromium_t)
xdg_create_config_dirs(chromium_t)
xdg_create_data_dirs(chromium_t)
xdg_manage_downloads(chromium_t)
xdg_read_config_files(chromium_t)
xdg_read_data_files(chromium_t)
xserver_user_x_domain_template(chromium, chromium_t, chromium_tmpfs_t)
tunable_policy(`chromium_bind_tcp_unreserved_ports',`
corenet_tcp_bind_generic_node(chromium_t)
corenet_tcp_bind_all_unreserved_ports(chromium_t)
allow chromium_t self:tcp_socket { listen accept };
')
tunable_policy(`chromium_rw_usb_dev',`
dev_rw_generic_usb_dev(chromium_t)
udev_read_db(chromium_t)
')
tunable_policy(`chromium_read_system_info',`
kernel_read_kernel_sysctls(chromium_t)
# Memory optimizations & optimizations based on OS/version
chromium There are several nacl binaries that need labels. Put an ifdef debian for some chromium paths. Git policy misses chromium_role() lines, were they in another patch that was submitted at the same time? I don't know what this is for but doesn't seem harmful to allow it: type=PROCTITLE msg=audit(28/01/19 19:31:42.361:3218) : proctitle=/bin/bash /usr/bin/google-chrome type=SYSCALL msg=audit(28/01/19 19:31:42.361:3218) : arch=x86_64 syscall=openat success=yes exit=3 a0=0xffffff9c a1=0x563328f7b590 a2=O_WRONLY|O_CREAT|O_TRUNC a3=0x1b6 items=0 ppid=5158 pid=5166 auid=test uid=test gid=test euid=test suid=test fsuid=test egid=test sgid=test fsgid=test tty=pts7 ses=232 comm=google-chrome exe=/bin/bash subj=user_u:user_r:chromium_t:s0 key=(null) type=AVC msg=audit(28/01/19 19:31:42.361:3218) : avc: granted { associate } for pid=5166 comm=google-chrome name=63 scontext=user_u:object_r:chromium_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=filesystem type=AVC msg=audit(28/01/19 19:31:42.361:3218) : avc: granted { create } for pid=5166 comm=google-chrome name=63 scontext=user_u:user_r:chromium_t:s0 tcontext=user_u:object_r:chromium_t:s0 tclass=file type=AVC msg=audit(28/01/19 19:31:42.361:3218) : avc: granted { add_name } for pid=5166 comm=google-chrome name=63 scontext=user_u:user_r:chromium_t:s0 tcontext=user_u:user_r:chromium_t:s0 tclass=dir Allow domain_use_interactive_fds() for running via ssh -X. Allow managing xdg data, cache, and config. Allow reading public data from apt and dpkg, probably from lsb_release or some other shell script. How does the whold naclhelper thing work anyway? I'm nervous about process share access involving chromium_sandbox_t, is that really what we want? Added lots of other stuff like searching cgroup dirs etc.
2019-01-28 08:46:49 +00:00
kernel_read_crypto_sysctls(chromium_t)
kernel_read_kernel_sysctls(chromium_t)
Add chromium policy upstreamed from Gentoo Signed-off-by: Jason Zaman <jason@perfinion.com>
2019-01-12 08:03:44 +00:00
kernel_read_system_state(chromium_t)
# Debugging (sys/kernel/debug) and device information (sys/bus and sys/devices).
dev_read_sysfs(chromium_t)
storage_getattr_fixed_disk_dev(chromium_t)
files_read_etc_runtime_files(chromium_t)
dev_dontaudit_getattr_all_chr_files(chromium_t)
init_dontaudit_getattr_initctl(chromium_t)
',`
kernel_dontaudit_read_kernel_sysctl(chromium_t)
kernel_dontaudit_read_system_state(chromium_t)
dev_dontaudit_read_sysfs(chromium_t)
files_dontaudit_read_etc_runtime_files(chromium_t)
')
optional_policy(`
cups_read_config(chromium_t)
cups_stream_connect(chromium_t)
')
optional_policy(`
dbus_all_session_bus_client(chromium_t)
dbus_system_bus_client(chromium_t)
optional_policy(`
unconfined_dbus_chat(chromium_t)
')
chromium: Whitespace fixes.
2019-01-23 23:43:16 +00:00
Add chromium policy upstreamed from Gentoo Signed-off-by: Jason Zaman <jason@perfinion.com>
2019-01-12 08:03:44 +00:00
optional_policy(`
gnome_dbus_chat_all_gkeyringd(chromium_t)
')
chromium: Whitespace fixes.
2019-01-23 23:43:16 +00:00
Add chromium policy upstreamed from Gentoo Signed-off-by: Jason Zaman <jason@perfinion.com>
2019-01-12 08:03:44 +00:00
optional_policy(`
devicekit_dbus_chat_power(chromium_t)
')
')
chromium There are several nacl binaries that need labels. Put an ifdef debian for some chromium paths. Git policy misses chromium_role() lines, were they in another patch that was submitted at the same time? I don't know what this is for but doesn't seem harmful to allow it: type=PROCTITLE msg=audit(28/01/19 19:31:42.361:3218) : proctitle=/bin/bash /usr/bin/google-chrome type=SYSCALL msg=audit(28/01/19 19:31:42.361:3218) : arch=x86_64 syscall=openat success=yes exit=3 a0=0xffffff9c a1=0x563328f7b590 a2=O_WRONLY|O_CREAT|O_TRUNC a3=0x1b6 items=0 ppid=5158 pid=5166 auid=test uid=test gid=test euid=test suid=test fsuid=test egid=test sgid=test fsgid=test tty=pts7 ses=232 comm=google-chrome exe=/bin/bash subj=user_u:user_r:chromium_t:s0 key=(null) type=AVC msg=audit(28/01/19 19:31:42.361:3218) : avc: granted { associate } for pid=5166 comm=google-chrome name=63 scontext=user_u:object_r:chromium_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=filesystem type=AVC msg=audit(28/01/19 19:31:42.361:3218) : avc: granted { create } for pid=5166 comm=google-chrome name=63 scontext=user_u:user_r:chromium_t:s0 tcontext=user_u:object_r:chromium_t:s0 tclass=file type=AVC msg=audit(28/01/19 19:31:42.361:3218) : avc: granted { add_name } for pid=5166 comm=google-chrome name=63 scontext=user_u:user_r:chromium_t:s0 tcontext=user_u:user_r:chromium_t:s0 tclass=dir Allow domain_use_interactive_fds() for running via ssh -X. Allow managing xdg data, cache, and config. Allow reading public data from apt and dpkg, probably from lsb_release or some other shell script. How does the whold naclhelper thing work anyway? I'm nervous about process share access involving chromium_sandbox_t, is that really what we want? Added lots of other stuff like searching cgroup dirs etc.
2019-01-28 08:46:49 +00:00
optional_policy(`
apt_read_cache(chromium_t)
apt_read_db(chromium_t)
dpkg_exec(chromium_t)
dpkg_read_db(chromium_t)
')
Add chromium policy upstreamed from Gentoo Signed-off-by: Jason Zaman <jason@perfinion.com>
2019-01-12 08:03:44 +00:00
ifdef(`use_alsa',`
optional_policy(`
alsa_domain(chromium_t, chromium_tmpfs_t)
')
optional_policy(`
pulseaudio_domtrans(chromium_t)
')
')
########################################
#
# chromium_renderer local policy
#
allow chromium_renderer_t self:process execmem;
chromium: Move line.
2019-01-23 23:44:45 +00:00
dontaudit chromium_renderer_t self:process getsched;
Add chromium policy upstreamed from Gentoo Signed-off-by: Jason Zaman <jason@perfinion.com>
2019-01-12 08:03:44 +00:00
allow chromium_renderer_t self:fifo_file rw_fifo_file_perms;
allow chromium_renderer_t self:shm create_shm_perms;
allow chromium_renderer_t self:unix_dgram_socket { create read sendto };
allow chromium_renderer_t self:unix_stream_socket { create getattr read write };
allow chromium_renderer_t chromium_t:fd use;
allow chromium_renderer_t chromium_t:unix_stream_socket rw_stream_socket_perms;
allow chromium_renderer_t chromium_tmpfs_t:file rw_file_perms;
dontaudit chromium_renderer_t chromium_t:dir search; # /proc/... access
read_files_pattern(chromium_renderer_t, chromium_xdg_config_t, chromium_xdg_config_t)
rw_fifo_files_pattern(chromium_renderer_t, chromium_tmp_t, chromium_tmp_t)
dev_read_urand(chromium_renderer_t)
files_dontaudit_list_tmp(chromium_renderer_t)
files_dontaudit_read_etc_files(chromium_renderer_t)
files_search_var(chromium_renderer_t)
init_sigchld(chromium_renderer_t)
miscfiles_read_localization(chromium_renderer_t)
userdom_dontaudit_use_all_users_fds(chromium_renderer_t)
userdom_use_user_terminals(chromium_renderer_t)
xdg_read_config_files(chromium_renderer_t)
xserver_user_x_domain_template(chromium_renderer, chromium_renderer_t, chromium_tmpfs_t)
tunable_policy(`chromium_read_system_info',`
kernel_read_kernel_sysctls(chromium_renderer_t)
kernel_read_system_state(chromium_renderer_t)
',`
kernel_dontaudit_read_kernel_sysctl(chromium_renderer_t)
kernel_dontaudit_read_system_state(chromium_renderer_t)
')
#########################################
#
# Chromium sandbox local policy
#
allow chromium_sandbox_t self:capability { dac_read_search setgid setuid sys_admin sys_chroot sys_ptrace };
allow chromium_sandbox_t self:process { setrlimit };
allow chromium_sandbox_t self:unix_stream_socket create_stream_socket_perms;
allow chromium_sandbox_t chromium_t:process { share };
# /proc access
allow chromium_sandbox_t chromium_t:dir list_dir_perms;
allow chromium_sandbox_t chromium_t:lnk_file read_lnk_file_perms;
allow chromium_sandbox_t chromium_t:file rw_file_perms;
chromium There are several nacl binaries that need labels. Put an ifdef debian for some chromium paths. Git policy misses chromium_role() lines, were they in another patch that was submitted at the same time? I don't know what this is for but doesn't seem harmful to allow it: type=PROCTITLE msg=audit(28/01/19 19:31:42.361:3218) : proctitle=/bin/bash /usr/bin/google-chrome type=SYSCALL msg=audit(28/01/19 19:31:42.361:3218) : arch=x86_64 syscall=openat success=yes exit=3 a0=0xffffff9c a1=0x563328f7b590 a2=O_WRONLY|O_CREAT|O_TRUNC a3=0x1b6 items=0 ppid=5158 pid=5166 auid=test uid=test gid=test euid=test suid=test fsuid=test egid=test sgid=test fsgid=test tty=pts7 ses=232 comm=google-chrome exe=/bin/bash subj=user_u:user_r:chromium_t:s0 key=(null) type=AVC msg=audit(28/01/19 19:31:42.361:3218) : avc: granted { associate } for pid=5166 comm=google-chrome name=63 scontext=user_u:object_r:chromium_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=filesystem type=AVC msg=audit(28/01/19 19:31:42.361:3218) : avc: granted { create } for pid=5166 comm=google-chrome name=63 scontext=user_u:user_r:chromium_t:s0 tcontext=user_u:object_r:chromium_t:s0 tclass=file type=AVC msg=audit(28/01/19 19:31:42.361:3218) : avc: granted { add_name } for pid=5166 comm=google-chrome name=63 scontext=user_u:user_r:chromium_t:s0 tcontext=user_u:user_r:chromium_t:s0 tclass=dir Allow domain_use_interactive_fds() for running via ssh -X. Allow managing xdg data, cache, and config. Allow reading public data from apt and dpkg, probably from lsb_release or some other shell script. How does the whold naclhelper thing work anyway? I'm nervous about process share access involving chromium_sandbox_t, is that really what we want? Added lots of other stuff like searching cgroup dirs etc.
2019-01-28 08:46:49 +00:00
allow chromium_sandbox_t chromium_t:unix_stream_socket { getattr read write };
allow chromium_sandbox_t chromium_t:unix_dgram_socket { getattr read write };
Add chromium policy upstreamed from Gentoo Signed-off-by: Jason Zaman <jason@perfinion.com>
2019-01-12 08:03:44 +00:00
kernel_list_proc(chromium_sandbox_t)
domain_dontaudit_read_all_domains_state(chromium_sandbox_t)
chromium There are several nacl binaries that need labels. Put an ifdef debian for some chromium paths. Git policy misses chromium_role() lines, were they in another patch that was submitted at the same time? I don't know what this is for but doesn't seem harmful to allow it: type=PROCTITLE msg=audit(28/01/19 19:31:42.361:3218) : proctitle=/bin/bash /usr/bin/google-chrome type=SYSCALL msg=audit(28/01/19 19:31:42.361:3218) : arch=x86_64 syscall=openat success=yes exit=3 a0=0xffffff9c a1=0x563328f7b590 a2=O_WRONLY|O_CREAT|O_TRUNC a3=0x1b6 items=0 ppid=5158 pid=5166 auid=test uid=test gid=test euid=test suid=test fsuid=test egid=test sgid=test fsgid=test tty=pts7 ses=232 comm=google-chrome exe=/bin/bash subj=user_u:user_r:chromium_t:s0 key=(null) type=AVC msg=audit(28/01/19 19:31:42.361:3218) : avc: granted { associate } for pid=5166 comm=google-chrome name=63 scontext=user_u:object_r:chromium_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=filesystem type=AVC msg=audit(28/01/19 19:31:42.361:3218) : avc: granted { create } for pid=5166 comm=google-chrome name=63 scontext=user_u:user_r:chromium_t:s0 tcontext=user_u:object_r:chromium_t:s0 tclass=file type=AVC msg=audit(28/01/19 19:31:42.361:3218) : avc: granted { add_name } for pid=5166 comm=google-chrome name=63 scontext=user_u:user_r:chromium_t:s0 tcontext=user_u:user_r:chromium_t:s0 tclass=dir Allow domain_use_interactive_fds() for running via ssh -X. Allow managing xdg data, cache, and config. Allow reading public data from apt and dpkg, probably from lsb_release or some other shell script. How does the whold naclhelper thing work anyway? I'm nervous about process share access involving chromium_sandbox_t, is that really what we want? Added lots of other stuff like searching cgroup dirs etc.
2019-01-28 08:46:49 +00:00
domain_use_interactive_fds(chromium_sandbox_t)
Add chromium policy upstreamed from Gentoo Signed-off-by: Jason Zaman <jason@perfinion.com>
2019-01-12 08:03:44 +00:00
userdom_use_user_ptys(chromium_sandbox_t)
chromium_domtrans(chromium_sandbox_t)
chromium There are several nacl binaries that need labels. Put an ifdef debian for some chromium paths. Git policy misses chromium_role() lines, were they in another patch that was submitted at the same time? I don't know what this is for but doesn't seem harmful to allow it: type=PROCTITLE msg=audit(28/01/19 19:31:42.361:3218) : proctitle=/bin/bash /usr/bin/google-chrome type=SYSCALL msg=audit(28/01/19 19:31:42.361:3218) : arch=x86_64 syscall=openat success=yes exit=3 a0=0xffffff9c a1=0x563328f7b590 a2=O_WRONLY|O_CREAT|O_TRUNC a3=0x1b6 items=0 ppid=5158 pid=5166 auid=test uid=test gid=test euid=test suid=test fsuid=test egid=test sgid=test fsgid=test tty=pts7 ses=232 comm=google-chrome exe=/bin/bash subj=user_u:user_r:chromium_t:s0 key=(null) type=AVC msg=audit(28/01/19 19:31:42.361:3218) : avc: granted { associate } for pid=5166 comm=google-chrome name=63 scontext=user_u:object_r:chromium_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=filesystem type=AVC msg=audit(28/01/19 19:31:42.361:3218) : avc: granted { create } for pid=5166 comm=google-chrome name=63 scontext=user_u:user_r:chromium_t:s0 tcontext=user_u:object_r:chromium_t:s0 tclass=file type=AVC msg=audit(28/01/19 19:31:42.361:3218) : avc: granted { add_name } for pid=5166 comm=google-chrome name=63 scontext=user_u:user_r:chromium_t:s0 tcontext=user_u:user_r:chromium_t:s0 tclass=dir Allow domain_use_interactive_fds() for running via ssh -X. Allow managing xdg data, cache, and config. Allow reading public data from apt and dpkg, probably from lsb_release or some other shell script. How does the whold naclhelper thing work anyway? I'm nervous about process share access involving chromium_sandbox_t, is that really what we want? Added lots of other stuff like searching cgroup dirs etc.
2019-01-28 08:46:49 +00:00
domtrans_pattern(chromium_sandbox_t, chromium_naclhelper_exec_t, chromium_naclhelper_t)
allow chromium_sandbox_t chromium_naclhelper_t:process share;
Add chromium policy upstreamed from Gentoo Signed-off-by: Jason Zaman <jason@perfinion.com>
2019-01-12 08:03:44 +00:00
##########################################
#
# Chromium nacl helper local policy
#
chromium There are several nacl binaries that need labels. Put an ifdef debian for some chromium paths. Git policy misses chromium_role() lines, were they in another patch that was submitted at the same time? I don't know what this is for but doesn't seem harmful to allow it: type=PROCTITLE msg=audit(28/01/19 19:31:42.361:3218) : proctitle=/bin/bash /usr/bin/google-chrome type=SYSCALL msg=audit(28/01/19 19:31:42.361:3218) : arch=x86_64 syscall=openat success=yes exit=3 a0=0xffffff9c a1=0x563328f7b590 a2=O_WRONLY|O_CREAT|O_TRUNC a3=0x1b6 items=0 ppid=5158 pid=5166 auid=test uid=test gid=test euid=test suid=test fsuid=test egid=test sgid=test fsgid=test tty=pts7 ses=232 comm=google-chrome exe=/bin/bash subj=user_u:user_r:chromium_t:s0 key=(null) type=AVC msg=audit(28/01/19 19:31:42.361:3218) : avc: granted { associate } for pid=5166 comm=google-chrome name=63 scontext=user_u:object_r:chromium_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=filesystem type=AVC msg=audit(28/01/19 19:31:42.361:3218) : avc: granted { create } for pid=5166 comm=google-chrome name=63 scontext=user_u:user_r:chromium_t:s0 tcontext=user_u:object_r:chromium_t:s0 tclass=file type=AVC msg=audit(28/01/19 19:31:42.361:3218) : avc: granted { add_name } for pid=5166 comm=google-chrome name=63 scontext=user_u:user_r:chromium_t:s0 tcontext=user_u:user_r:chromium_t:s0 tclass=dir Allow domain_use_interactive_fds() for running via ssh -X. Allow managing xdg data, cache, and config. Allow reading public data from apt and dpkg, probably from lsb_release or some other shell script. How does the whold naclhelper thing work anyway? I'm nervous about process share access involving chromium_sandbox_t, is that really what we want? Added lots of other stuff like searching cgroup dirs etc.
2019-01-28 08:46:49 +00:00
allow chromium_naclhelper_t chromium_t:unix_stream_socket { getattr read write };
allow chromium_naclhelper_t chromium_sandbox_t:unix_stream_socket { getattr read write };
Add chromium policy upstreamed from Gentoo Signed-off-by: Jason Zaman <jason@perfinion.com>
2019-01-12 08:03:44 +00:00
domain_mmap_low_uncond(chromium_naclhelper_t)
userdom_use_user_ptys(chromium_naclhelper_t)
tunable_policy(`chromium_read_system_info',`
kernel_read_kernel_sysctls(chromium_naclhelper_t)
kernel_read_system_state(chromium_naclhelper_t)
',`
kernel_dontaudit_read_kernel_sysctl(chromium_naclhelper_t)
kernel_dontaudit_read_system_state(chromium_naclhelper_t)
')
chromium There are several nacl binaries that need labels. Put an ifdef debian for some chromium paths. Git policy misses chromium_role() lines, were they in another patch that was submitted at the same time? I don't know what this is for but doesn't seem harmful to allow it: type=PROCTITLE msg=audit(28/01/19 19:31:42.361:3218) : proctitle=/bin/bash /usr/bin/google-chrome type=SYSCALL msg=audit(28/01/19 19:31:42.361:3218) : arch=x86_64 syscall=openat success=yes exit=3 a0=0xffffff9c a1=0x563328f7b590 a2=O_WRONLY|O_CREAT|O_TRUNC a3=0x1b6 items=0 ppid=5158 pid=5166 auid=test uid=test gid=test euid=test suid=test fsuid=test egid=test sgid=test fsgid=test tty=pts7 ses=232 comm=google-chrome exe=/bin/bash subj=user_u:user_r:chromium_t:s0 key=(null) type=AVC msg=audit(28/01/19 19:31:42.361:3218) : avc: granted { associate } for pid=5166 comm=google-chrome name=63 scontext=user_u:object_r:chromium_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=filesystem type=AVC msg=audit(28/01/19 19:31:42.361:3218) : avc: granted { create } for pid=5166 comm=google-chrome name=63 scontext=user_u:user_r:chromium_t:s0 tcontext=user_u:object_r:chromium_t:s0 tclass=file type=AVC msg=audit(28/01/19 19:31:42.361:3218) : avc: granted { add_name } for pid=5166 comm=google-chrome name=63 scontext=user_u:user_r:chromium_t:s0 tcontext=user_u:user_r:chromium_t:s0 tclass=dir Allow domain_use_interactive_fds() for running via ssh -X. Allow managing xdg data, cache, and config. Allow reading public data from apt and dpkg, probably from lsb_release or some other shell script. How does the whold naclhelper thing work anyway? I'm nervous about process share access involving chromium_sandbox_t, is that really what we want? Added lots of other stuff like searching cgroup dirs etc.
2019-01-28 08:46:49 +00:00
dev_read_sysfs(chromium_naclhelper_t)
dev_read_urand(chromium_naclhelper_t)