selinux-refpolicy/strict/macros/program/chroot_macros.te

# macro for chroot environments
# Author Russell Coker

# chroot(initial_domain, basename, role, tty_device_type)
define(`chroot', `

ifelse(`$1', `initrc', `
define(`chroot_role', `system_r')
define(`chroot_tty_device', `{ console_device_t admin_tty_type }')
define(`chroot_mount_domain', `mount_t')
define(`chroot_fd_use', `{ privfd init_t }')
', `
define(`chroot_role', `$1_r')
define(`chroot_tty_device', `{ $1_devpts_t $1_tty_device_t }')
define(`chroot_fd_use', `privfd')

# allow mounting /proc and /dev
ifdef(`$1_mount_def', `', `
mount_domain($1, $1_mount)
role chroot_role types $1_mount_t;
')
define(`chroot_mount_domain', `$1_mount_t')
ifdef(`ssh.te', `
can_tcp_connect($1_ssh_t, $2_t)
')dnl end ssh
')dnl end ifelse initrc

# types for read-only and read-write files in the chroot
type $2_ro_t, file_type, sysadmfile, home_type, user_home_type;
type $2_rw_t, file_type, sysadmfile, home_type, user_home_type;
# type like $2_ro_t but that triggers a transition from $2_super_t to $2_t
# when you execute it
type $2_dropdown_t, file_type, sysadmfile, home_type, user_home_type;

allow chroot_mount_domain { $2_rw_t $2_ro_t }:dir { getattr search mounton };
allow chroot_mount_domain { $2_rw_t $2_ro_t }:file { getattr mounton };

# entry point for $2_super_t
type $2_super_entry_t, file_type, sysadmfile, home_type, user_home_type;
# $2_t is the base domain, has full access to $2_rw_t files
type $2_t, domain;
# $2_super_t is the super-chroot domain, can also write to $2_ro_t
# but still can not access outside the chroot
type $2_super_t, domain;
allow $2_super_t chroot_tty_device:chr_file rw_file_perms;

ifdef(`$1_chroot_def', `', `
dnl can not have this defined twice
define(`$1_chroot_def')

allow chroot_mount_domain { proc_t device_t fs_t }:filesystem { mount unmount };

# $1_chroot_t is the domain for /usr/sbin/chroot
type $1_chroot_t, domain;

# allow $1_chroot_t to write to the tty device
allow $1_chroot_t chroot_tty_device:chr_file rw_file_perms;
allow $1_chroot_t chroot_fd_use:fd use;
allow { $1_chroot_t $2_t $2_super_t } $1_t:fd use;

role chroot_role types $1_chroot_t;
uses_shlib($1_chroot_t)
allow $1_chroot_t self:capability sys_chroot;
allow $1_t $1_chroot_t:dir { search getattr read };
allow $1_t $1_chroot_t:{ file lnk_file } { read getattr };
domain_auto_trans($1_t, chroot_exec_t, $1_chroot_t)
allow $1_chroot_t fs_t:filesystem getattr;
')dnl End conditional

role chroot_role types { $2_t $2_super_t };

# allow ps to show processes and allow killing them
allow $1_t { $2_super_t $2_t }:dir { search getattr read };
allow $1_t { $2_super_t $2_t }:{ file lnk_file } { read getattr };
allow $1_t { $2_super_t $2_t }:process signal_perms;
allow $2_super_t $2_t:dir { search getattr read };
allow $2_super_t $2_t:{ file lnk_file } { read getattr };
allow { $1_t $2_super_t } $2_t:process { signal_perms ptrace };
allow $1_t $2_super_t:process { signal_perms ptrace };
allow sysadm_t { $2_super_t $2_t }:process { signal_perms ptrace };

allow { $2_super_t $2_t } { fs_t device_t }:filesystem getattr;
allow { $2_super_t $2_t } device_t:dir { search getattr };
allow { $2_super_t $2_t } devtty_t:chr_file rw_file_perms;
allow { $2_super_t $2_t } random_device_t:chr_file r_file_perms;
allow { $2_super_t $2_t } self:capability { fowner chown fsetid setgid setuid net_bind_service sys_tty_config };
allow $2_super_t self:capability sys_ptrace;

can_tcp_connect($2_super_t, $2_t)
allow { $2_super_t $2_t } $2_rw_t:sock_file create_file_perms;

# quiet ps and killall
dontaudit { $2_super_t $2_t } domain:dir { search getattr };

# allow $2_t to write to the owner tty device (should remove this)
allow $2_t chroot_tty_device:chr_file { read write };

r_dir_file($1_chroot_t, { $2_ro_t $2_rw_t $2_super_entry_t $2_dropdown_t })
can_exec($2_t, { $2_ro_t $2_rw_t $2_super_entry_t $2_dropdown_t })
can_exec($2_super_t, { $2_ro_t $2_super_entry_t })
create_dir_notdevfile($2_super_t, { $2_ro_t $2_rw_t $2_super_entry_t $2_dropdown_t })
# $2_super_t transitions to $2_t when it executes
# any file that $2_t can write
domain_auto_trans($2_super_t, { $2_rw_t $2_dropdown_t }, $2_t)
allow $1_chroot_t { $2_ro_t $2_rw_t }:lnk_file read;
r_dir_file($2_t, { $2_ro_t $2_super_entry_t $2_dropdown_t })
create_dir_notdevfile($2_t, $2_rw_t)
allow $2_t $2_rw_t:fifo_file create_file_perms;
allow $2_t $2_ro_t:fifo_file rw_file_perms;
allow { $1_t $2_super_t } { $2_rw_t $2_ro_t }:fifo_file create_file_perms;
create_dir_notdevfile($1_t, { $2_ro_t $2_rw_t $2_super_entry_t $2_dropdown_t })
can_exec($1_t, { $2_ro_t $2_dropdown_t })
domain_auto_trans($1_chroot_t, { $2_ro_t $2_rw_t $2_dropdown_t }, $2_t)
domain_auto_trans($1_chroot_t, $2_super_entry_t, $2_super_t)
allow { $1_t $2_super_t } { $2_ro_t $2_rw_t $2_super_entry_t $2_dropdown_t }:{ dir notdevfile_class_set } { relabelfrom relabelto };
general_proc_read_access({ $2_t $2_super_t })
general_domain_access({ $2_t $2_super_t })
can_create_pty($2)
can_create_pty($2_super)
can_network({ $2_t $2_super_t })
allow { $2_t $2_super_t } port_type:tcp_socket name_connect;
allow { $2_t $2_super_t } null_device_t:chr_file rw_file_perms;
allow $2_super_t { $2_rw_t $2_ro_t }:{ dir file } mounton;
allow { $2_t $2_super_t } self:capability { dac_override kill };

undefine(`chroot_role')
undefine(`chroot_tty_device')
undefine(`chroot_mount_domain')
undefine(`chroot_fd_use')
')