RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
selinux-refpolicy/policy/modules/apps/chromium.fc

31 lines
2.5 KiB
Plaintext
Raw Normal View History

Add chromium policy upstreamed from Gentoo Signed-off-by: Jason Zaman <jason@perfinion.com>
2019-01-12 08:03:44 +00:00
/opt/google/chrome/chrome -- gen_context(system_u:object_r:chromium_exec_t,s0)
/opt/google/chrome/chrome_sandbox -- gen_context(system_u:object_r:chromium_sandbox_exec_t,s0)
/opt/google/chrome/chrome-sandbox -- gen_context(system_u:object_r:chromium_sandbox_exec_t,s0)
/opt/google/chrome/google-chrome -- gen_context(system_u:object_r:chromium_exec_t,s0)
chromium There are several nacl binaries that need labels. Put an ifdef debian for some chromium paths. Git policy misses chromium_role() lines, were they in another patch that was submitted at the same time? I don't know what this is for but doesn't seem harmful to allow it: type=PROCTITLE msg=audit(28/01/19 19:31:42.361:3218) : proctitle=/bin/bash /usr/bin/google-chrome type=SYSCALL msg=audit(28/01/19 19:31:42.361:3218) : arch=x86_64 syscall=openat success=yes exit=3 a0=0xffffff9c a1=0x563328f7b590 a2=O_WRONLY|O_CREAT|O_TRUNC a3=0x1b6 items=0 ppid=5158 pid=5166 auid=test uid=test gid=test euid=test suid=test fsuid=test egid=test sgid=test fsgid=test tty=pts7 ses=232 comm=google-chrome exe=/bin/bash subj=user_u:user_r:chromium_t:s0 key=(null) type=AVC msg=audit(28/01/19 19:31:42.361:3218) : avc: granted { associate } for pid=5166 comm=google-chrome name=63 scontext=user_u:object_r:chromium_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=filesystem type=AVC msg=audit(28/01/19 19:31:42.361:3218) : avc: granted { create } for pid=5166 comm=google-chrome name=63 scontext=user_u:user_r:chromium_t:s0 tcontext=user_u:object_r:chromium_t:s0 tclass=file type=AVC msg=audit(28/01/19 19:31:42.361:3218) : avc: granted { add_name } for pid=5166 comm=google-chrome name=63 scontext=user_u:user_r:chromium_t:s0 tcontext=user_u:user_r:chromium_t:s0 tclass=dir Allow domain_use_interactive_fds() for running via ssh -X. Allow managing xdg data, cache, and config. Allow reading public data from apt and dpkg, probably from lsb_release or some other shell script. How does the whold naclhelper thing work anyway? I'm nervous about process share access involving chromium_sandbox_t, is that really what we want? Added lots of other stuff like searching cgroup dirs etc.
2019-01-28 08:46:49 +00:00
/opt/google/chrome/nacl_.* -- gen_context(system_u:object_r:chromium_naclhelper_exec_t,s0)
Add chromium policy upstreamed from Gentoo Signed-off-by: Jason Zaman <jason@perfinion.com>
2019-01-12 08:03:44 +00:00
/opt/google/chrome-beta/chrome -- gen_context(system_u:object_r:chromium_exec_t,s0)
/opt/google/chrome-beta/chrome_sandbox -- gen_context(system_u:object_r:chromium_sandbox_exec_t,s0)
/opt/google/chrome-beta/chrome-sandbox -- gen_context(system_u:object_r:chromium_sandbox_exec_t,s0)
/opt/google/chrome-beta/google-chrome -- gen_context(system_u:object_r:chromium_exec_t,s0)
/opt/google/chrome-beta/nacl_helper_bootstrap -- gen_context(system_u:object_r:chromium_naclhelper_exec_t,s0)
/opt/google/chrome-unstable/chrome -- gen_context(system_u:object_r:chromium_exec_t,s0)
/opt/google/chrome-unstable/chrome_sandbox -- gen_context(system_u:object_r:chromium_sandbox_exec_t,s0)
/opt/google/chrome-unstable/chrome-sandbox -- gen_context(system_u:object_r:chromium_sandbox_exec_t,s0)
/opt/google/chrome-unstable/google-chrome -- gen_context(system_u:object_r:chromium_exec_t,s0)
/opt/google/chrome-unstable/nacl_helper_bootstrap -- gen_context(system_u:object_r:chromium_naclhelper_exec_t,s0)
chromium There are several nacl binaries that need labels. Put an ifdef debian for some chromium paths. Git policy misses chromium_role() lines, were they in another patch that was submitted at the same time? I don't know what this is for but doesn't seem harmful to allow it: type=PROCTITLE msg=audit(28/01/19 19:31:42.361:3218) : proctitle=/bin/bash /usr/bin/google-chrome type=SYSCALL msg=audit(28/01/19 19:31:42.361:3218) : arch=x86_64 syscall=openat success=yes exit=3 a0=0xffffff9c a1=0x563328f7b590 a2=O_WRONLY|O_CREAT|O_TRUNC a3=0x1b6 items=0 ppid=5158 pid=5166 auid=test uid=test gid=test euid=test suid=test fsuid=test egid=test sgid=test fsgid=test tty=pts7 ses=232 comm=google-chrome exe=/bin/bash subj=user_u:user_r:chromium_t:s0 key=(null) type=AVC msg=audit(28/01/19 19:31:42.361:3218) : avc: granted { associate } for pid=5166 comm=google-chrome name=63 scontext=user_u:object_r:chromium_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=filesystem type=AVC msg=audit(28/01/19 19:31:42.361:3218) : avc: granted { create } for pid=5166 comm=google-chrome name=63 scontext=user_u:user_r:chromium_t:s0 tcontext=user_u:object_r:chromium_t:s0 tclass=file type=AVC msg=audit(28/01/19 19:31:42.361:3218) : avc: granted { add_name } for pid=5166 comm=google-chrome name=63 scontext=user_u:user_r:chromium_t:s0 tcontext=user_u:user_r:chromium_t:s0 tclass=dir Allow domain_use_interactive_fds() for running via ssh -X. Allow managing xdg data, cache, and config. Allow reading public data from apt and dpkg, probably from lsb_release or some other shell script. How does the whold naclhelper thing work anyway? I'm nervous about process share access involving chromium_sandbox_t, is that really what we want? Added lots of other stuff like searching cgroup dirs etc.
2019-01-28 08:46:49 +00:00
/usr/lib/chromium/chromium -- gen_context(system_u:object_r:chromium_exec_t,s0)
/usr/lib/chromium/chrome-sandbox -- gen_context(system_u:object_r:chromium_sandbox_exec_t,s0)
Add chromium policy upstreamed from Gentoo Signed-off-by: Jason Zaman <jason@perfinion.com>
2019-01-12 08:03:44 +00:00
/usr/lib/chromium-browser/chrome -- gen_context(system_u:object_r:chromium_exec_t,s0)
/usr/lib/chromium-browser/chrome_sandbox -- gen_context(system_u:object_r:chromium_sandbox_exec_t,s0)
/usr/lib/chromium-browser/chrome-sandbox -- gen_context(system_u:object_r:chromium_sandbox_exec_t,s0)
/usr/lib/chromium-browser/chromium-launcher\.sh -- gen_context(system_u:object_r:chromium_exec_t,s0)
/usr/lib/chromium-browser/nacl_helper_bootstrap -- gen_context(system_u:object_r:chromium_naclhelper_exec_t,s0)
HOME_DIR/\.cache/chromium(/.*)? gen_context(system_u:object_r:chromium_xdg_cache_t,s0)
HOME_DIR/\.cache/google-chrome(/.*)? gen_context(system_u:object_r:chromium_xdg_cache_t,s0)
HOME_DIR/\.config/chromium(/.*)? gen_context(system_u:object_r:chromium_xdg_config_t,s0)
HOME_DIR/\.config/google-chrome(/.*)? gen_context(system_u:object_r:chromium_xdg_config_t,s0)