RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

more Chrome stuff 

Patches for some more Chrome stuff

Signed-off-by: Russell Coker <russell@coker.com.au>
This commit is contained in:
Russell Coker 2021-01-20 20:32:19 +11:00 committed by Chris PeBenito
parent eef53e3ddc
commit da9b6306ea
2 changed files with 30 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
policy/modules/apps/chromium.te
View File

@ -90,7 +90,9 @@ xdg_cache_content(chromium_xdg_cache_t)
# #
# execmem for load in plugins # execmem for load in plugins
allow chromium_t self:process { execmem getsched getcap setcap setrlimit setsched sigkill signal }; allow chromium_t self:process { execmem getsched getcap setcap setrlimit setsched sigkill signal signull };
allow chromium_t self:dir { write add_name };
allow chromium_t self:file create;
allow chromium_t self:fifo_file rw_fifo_file_perms; allow chromium_t self:fifo_file rw_fifo_file_perms;
allow chromium_t self:sem create_sem_perms; allow chromium_t self:sem create_sem_perms;
allow chromium_t self:netlink_kobject_uevent_socket client_stream_socket_perms; allow chromium_t self:netlink_kobject_uevent_socket client_stream_socket_perms;
@ -144,7 +146,12 @@ dyntrans_pattern(chromium_t, chromium_renderer_t)
domtrans_pattern(chromium_t, chromium_sandbox_exec_t, chromium_sandbox_t) domtrans_pattern(chromium_t, chromium_sandbox_exec_t, chromium_sandbox_t)
domtrans_pattern(chromium_t, chromium_naclhelper_exec_t, chromium_naclhelper_t) domtrans_pattern(chromium_t, chromium_naclhelper_exec_t, chromium_naclhelper_t)
# for self:file create
kernel_associate_proc(chromium_t)
kernel_get_sysvipc_info(chromium_t)
kernel_list_proc(chromium_t) kernel_list_proc(chromium_t)
kernel_read_crypto_sysctls(chromium_t)
kernel_read_fs_sysctls(chromium_t) kernel_read_fs_sysctls(chromium_t)
kernel_read_kernel_sysctls(chromium_t) kernel_read_kernel_sysctls(chromium_t)
kernel_read_net_sysctls(chromium_t) kernel_read_net_sysctls(chromium_t)
@ -156,6 +163,7 @@ corecmd_exec_shell(chromium_t)
corenet_tcp_connect_all_unreserved_ports(chromium_t) corenet_tcp_connect_all_unreserved_ports(chromium_t)
corenet_tcp_connect_ftp_port(chromium_t) corenet_tcp_connect_ftp_port(chromium_t)
corenet_tcp_connect_http_port(chromium_t) corenet_tcp_connect_http_port(chromium_t)
corenet_tcp_connect_ipp_port(chromium_t)
corenet_udp_bind_generic_node(chromium_t) corenet_udp_bind_generic_node(chromium_t)
corenet_udp_bind_all_unreserved_ports(chromium_t) corenet_udp_bind_all_unreserved_ports(chromium_t)
@ -325,6 +333,9 @@ userdom_use_user_terminals(chromium_renderer_t)
xdg_read_config_files(chromium_renderer_t) xdg_read_config_files(chromium_renderer_t)
# should we have a tunable for this?
xdg_read_pictures(chromium_t)
xserver_user_x_domain_template(chromium_renderer, chromium_renderer_t, chromium_tmpfs_t) xserver_user_x_domain_template(chromium_renderer, chromium_renderer_t, chromium_tmpfs_t)
tunable_policy(`chromium_read_system_info',` tunable_policy(`chromium_read_system_info',`

18
policy/modules/kernel/kernel.if
View File

@ -2440,6 +2440,24 @@ interface(`kernel_rw_all_sysctls',`
allow $1 sysctl_type:file setattr; allow $1 sysctl_type:file setattr;
') ')
########################################
## <summary>
## Associate a file to proc_t (/proc)
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
## <rolecap/>
#
interface(`kernel_associate_proc',`
gen_require(`
type proc_t;
')
allow $1 proc_t:filesystem associate;
')
######################################## ########################################
## <summary> ## <summary>
## Send a kill signal to unlabeled processes. ## Send a kill signal to unlabeled processes.