add ldconfig

refpolicy/policy/modules/system/libraries.fc

@@ -19,6 +19,11 @@
 /opt/.*/lib(64)?(/.*)?				context_template(system_u:object_r:lib_t,s0)
 /opt/.*/lib(64)?/.*\.so(\.[^/]*)*	--	context_template(system_u:object_r:shlib_t,s0)
 
+#
+# /sbin
+#
+/sbin/ldconfig				--	context_template(system_u:object_r:ldconfig_exec_t,s0)
+
 #
 # /usr
 #

refpolicy/policy/modules/system/libraries.if

@@ -1,4 +1,60 @@
 # Copyright (C) 2005 Tresys Technology, LLC
+## <module name="libraries" layer="system">
+## <summary>Policy for system libraries.</summary>
+
+########################################
+## <interface name="libraries_ldconfig_transition">
+##	<description>
+##		Execute ldconfig in the ldconfig domain.
+##	</description>
+##	<parameter name="domain">
+##		The type of the process performing this action.
+##	</parameter>
+##	<infoflow type="write" weight="10"/>
+## </interface>
+#
+define(`libraries_ldconfig_transition',`
+requires_block_template(`$0'_depend)
+allow $1 ldconfig_exec_t:file { getattr read execute };
+allow $1 ldconfig_t:process transition;
+type_transition $1 ldconfig_exec_t:file ldconfig_t;
+dontaudit $1 ldconfig_t:process { noatsecure siginh rlimitinh };
+')
+
+define(`libraries_ldconfig_transition_depend',`
+type ldconfig_t, ldconfig_exec_t;
+class file { getattr read execute };
+class process { transition noatsecure siginh rlimitinh };
+')
+
+########################################
+## <interface name="libraries_ldconfig_transition_add_role_use_terminal">
+##	<description>
+##		Execute ldconfig in the ldconfig domain.
+##	</description>
+##	<parameter name="domain">
+##		The type of the process performing this action.
+##	</parameter>
+##	<parameter name="role">
+##		The role to allow the ldconfig domain.
+##	</parameter>
+##	<parameter name="terminal">
+##		The type of the terminal allow the ldconfig domain to use.
+##	</parameter>
+##	<infoflow type="both" weight="10"/>
+## </interface>
+#
+define(`libraries_ldconfig_transition_add_role_use_terminal',`
+requires_block_template(`$0'_depend)
+libraries_ldconfig_transition($1)
+role $2 types ldconfig_t;
+allow ldconfig_t $3:chr_file { getattr read write ioctl };
+')
+
+define(`libraries_ldconfig_transition_add_role_use_terminal_depend',`
+type ldconfig_t;
+class chr_file { getattr read write ioctl };
+')
 
 ########################################
 #
@@ -6,7 +62,7 @@
 #
 define(`libraries_use_dynamic_loader',`
 requires_block_template(`$0'_depend)
-allow $1 lib_t:dir { getattr read search };
+allow $1 lib_t:dir { getattr search read };
 allow $1 lib_t:lnk_file { getattr read };
 allow $1 ld_so_t:lnk_file { getattr read };
 allow $1 ld_so_t:file { getattr read execute };
@@ -15,7 +71,7 @@ allow $1 ld_so_cache_t:file { getattr read };
 
 define(`libraries_use_dynamic_loader_depend',`
 type lib_t, ld_so_t, ld_so_cache_t;
-class dir { getattr read search };
+class dir { getattr search read };
 class lnk_file { getattr read };
 class file { getattr read execute };
 ')
@@ -43,7 +99,7 @@ class file { execute execmod };
 #
 define(`libraries_execute_dynamic_loader',`
 requires_block_template(`$0'_depend)
-allow $1 lib_t:dir { getattr read search };
+allow $1 lib_t:dir { getattr search read };
 allow $1 lib_t:lnk_file { getattr read };
 allow $1 ld_so_t:lnk_file { getattr read };
 allow $1 ld_so_t:file { getattr read execute execute_no_trans };
@@ -51,7 +107,7 @@ allow $1 ld_so_t:file { getattr read execute execute_no_trans };
 
 define(`libraries_execute_dynamic_loader_depend',`
 type lib_t, ld_so_t;
-class dir { getattr read search };
+class dir { getattr search read };
 class lnk_file { getattr read };
 class file { getattr read execute execute_no_trans };
 ')
@@ -76,7 +132,7 @@ class file { getattr read write };
 #
 define(`libraries_use_shared_libraries',`
 requires_block_template(`$0'_depend)
-allow $1 lib_t:dir { getattr read search };
+allow $1 lib_t:dir { getattr search read };
 allow $1 lib_t:lnk_file { getattr read };
 allow $1 { shlib_t texrel_shlib_t }:lnk_file { getattr read };
 allow $1 { shlib_t texrel_shlib_t }:file { getattr read execute };
@@ -84,7 +140,7 @@ allow $1 { shlib_t texrel_shlib_t }:file { getattr read execute };
 
 define(`libraries_use_shared_libraries_depend',`
 type lib_t, shlib_t, texrel_shlib_t;
-class dir { getattr read search };
+class dir { getattr searc read };
 class lnk_file { getattr read };
 class file { getattr read execute };
 ')
@@ -138,3 +194,5 @@ class dir { getattr read search };
 class lnk_file { getattr read };
 class file { getattr read execute execute_no_trans };
 ')
+
+## </module>

refpolicy/policy/modules/system/libraries.te

@@ -2,12 +2,18 @@
 
 policy_module(libraries,1.0)
 
+########################################
+#
+# Declarations
+#
+
 #
 # ld_so_cache_t is the type of /etc/ld.so.cache.
 #
 type ld_so_cache_t;
 files_make_file(ld_so_cache_t)
 
+#
 # ld_so_t is the type of the system dynamic loaders.
 #
 type ld_so_t;
@@ -32,3 +38,64 @@ files_make_file(shlib_t)
 #
 type texrel_shlib_t;
 files_make_file(texrel_shlib_t)
+
+########################################
+#
+# ldconfig local policy
+#
+type ldconfig_t;
+type ldconfig_exec_t;
+init_make_system_domain(ldconfig_t,ldconfig_exec_t)
+role system_r types ldconfig_t;
+
+allow ldconfig_t ld_so_cache_t:file { create ioctl read getattr lock write setattr append link unlink rename };
+files_create_private_config(ldconfig_t,ld_so_cache_t,file)
+
+allow ldconfig_t lib_t:dir { getattr search read write add_name remove_name };
+allow ldconfig_t lib_t:lnk_file { getattr create read unlink };
+allow ldconfig_t ld_so_t:lnk_file { getattr read };
+allow ldconfig_t ld_so_t:file { getattr read execute };
+allow ldconfig_t ld_so_cache_t:file { getattr read };
+allow ldconfig_t { shlib_t texrel_shlib_t }:lnk_file { getattr read };
+allow ldconfig_t { shlib_t texrel_shlib_t }:file { getattr read execute };
+
+kernel_read_system_state(ldconfig_t)
+
+filesystem_get_persistent_filesystem_attributes(ldconfig_t)
+
+domain_use_widely_inheritable_file_descriptors(ldconfig_t)
+
+files_read_general_system_config(ldconfig_t)
+# for when /etc/ld.so.cache is mislabeled:
+files_remove_general_system_config(ldconfig_t)
+
+init_script_use_pseudoterminal(ldconfig_t)
+
+logging_send_system_log_message(ldconfig_t)
+
+userdomain_use_all_users_file_descriptors(ldconfig_t)
+
+
+ifdef(`TODO',`
+
+allow ldconfig_t tmp_t:dir search;
+
+ifdef(`apache.te', `
+# dontaudit access to /usr/lib/apache, normal programs cannot read these libs anyway
+dontaudit ldconfig_t httpd_modules_t:dir search;
+')
+
+allow ldconfig_t { var_t var_lib_t }:dir search;
+
+ifdef(`hide_broken_symptoms', `
+ifdef(`unconfined.te',`
+dontaudit ldconfig_t unconfined_t:tcp_socket { read write };
+')
+')
+
+ifdef(`targeted_policy', `
+allow ldconfig_t lib_t:file r_file_perms;
+unconfined_domain(ldconfig_t) 
+')
+
+') dnl end TODO