RepoMirrors/selinux-refpolicy
1
0
Fork 0
mirror of https://github.com/SELinuxProject/refpolicy synced 2025-04-01 00:06:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

Implement mcs_constrained_type

Browse Source 
This process is not allowed to interact with subjects or operate on
objects that it would otherwise be able to interact with or operate on
respectively.

This is, i think, to make sure that specified processes cannot interact
with subject or operate on objects regardless of its mcs range.

It is used by svirt and probably also by sandbox

Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
This commit is contained in:
Dominick Grift 2012-11-27 17:59:19 +01:00 committed by Chris PeBenito
parent b30c5df388
commit c2f056b2f6
3 changed files with 55 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
policy/mcs
View File

@ -69,16 +69,32 @@ gen_levels(1,mcs_num_cats)
# - /proc/pid operations are not constrained.
mlsconstrain file { read ioctl lock execute execute_no_trans }
(( h1 dom h2 ) or ( t1 == mcsreadall ) or ( t2 == domain ));
(( h1 dom h2 ) or ( t1 == mcsreadall ) or
(( t1 != mcs_constrained_type ) and (t2 == domain)));
mlsconstrain file { write setattr append unlink link rename }
(( h1 dom h2 ) or ( t1 == mcswriteall ) or ( t2 == domain ));
(( h1 dom h2 ) or ( t1 == mcswriteall ) or
(( t1 != mcs_constrained_type ) and (t2 == domain)));
mlsconstrain dir { search read ioctl lock }
(( h1 dom h2 ) or ( t1 == mcsreadall ) or ( t2 == domain ));
(( h1 dom h2 ) or ( t1 == mcsreadall ) or
(( t1 != mcs_constrained_type ) and (t2 == domain)));
mlsconstrain dir { write setattr append unlink link rename add_name remove_name }
(( h1 dom h2 ) or ( t1 == mcswriteall ) or ( t2 == domain ));
(( h1 dom h2 ) or ( t1 == mcswriteall ) or
(( t1 != mcs_constrained_type ) and (t2 == domain)));
mlsconstrain fifo_file { open }
(( h1 dom h2 ) or ( t1 == mcsreadall ) or
(( t1 != mcs_constrained_type ) and ( t2 == domain )));
mlsconstrain { lnk_file chr_file blk_file sock_file } { getattr read ioctl }
(( h1 dom h2 ) or ( t1 == mcsreadall ) or
(( t1 != mcs_constrained_type ) and (t2 == domain)));
mlsconstrain { lnk_file chr_file blk_file sock_file } { write setattr }
(( h1 dom h2 ) or ( t1 == mcswriteall ) or
(( t1 != mcs_constrained_type ) and (t2 == domain)));
# New filesystem object labels must be dominated by the relabeling subject
# clearance, also the objects are single-level.
@ -101,6 +117,12 @@ mlsconstrain process { ptrace }
mlsconstrain process { sigkill sigstop }
(( h1 dom h2 ) or ( t1 == mcskillall ));
mlsconstrain process { signal }
(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
mlsconstrain { tcp_socket udp_socket rawip_socket } node_bind
(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
#
# MCS policy for SELinux-enabled databases
#

28
policy/modules/kernel/mcs.if
View File

@ -102,3 +102,31 @@ interface(`mcs_process_set_categories',`
typeattribute $1 mcssetcats;
')
########################################
## <summary>
## Constrain by category access control (MCS).
## </summary>
## <desc>
## <p>
## Constrain the specified type by category based
## access control (MCS) This prevents this domain from
## interacting with subjects and operating on objects
## that it otherwise would be able to interact
## with or operate on respectively.
## </p>
## </desc>
## <param name="domain">
## <summary>
## Type to be constrained by MCS.
## </summary>
## </param>
## <infoflow type="none"/>
#
interface(`mcs_constrained',`
gen_require(`
attribute mcs_constrained_type;
')
typeattribute $1 mcs_constrained_type;
')

1
policy/modules/kernel/mcs.te
View File

@ -10,3 +10,4 @@ attribute mcsptraceall;
attribute mcssetcats;
attribute mcswriteall;
attribute mcsreadall;
attribute mcs_constrained_type;