diff --git a/policy/modules/kernel/devices.fc b/policy/modules/kernel/devices.fc index 8ac94e423..6cf8784c1 100644 --- a/policy/modules/kernel/devices.fc +++ b/policy/modules/kernel/devices.fc @@ -18,6 +18,7 @@ /dev/beep -c gen_context(system_u:object_r:sound_device_t,s0) /dev/btrfs-control -c gen_context(system_u:object_r:lvm_control_t,s0) /dev/controlD64 -c gen_context(system_u:object_r:xserver_misc_device_t,s0) +/dev/crash -c gen_context(system_u:object_r:crash_device_t,mls_systemhigh) /dev/dahdi/.* -c gen_context(system_u:object_r:sound_device_t,s0) /dev/dmfm -c gen_context(system_u:object_r:sound_device_t,s0) /dev/dmmidi.* -c gen_context(system_u:object_r:sound_device_t,s0) @@ -157,6 +158,8 @@ ifdef(`distro_suse', ` /dev/mfpports/.* -c gen_context(system_u:object_r:printer_device_t,s0) +/dev/mqueue(/.*)? <> + /dev/mvideo/.* -c gen_context(system_u:object_r:xserver_misc_device_t,s0) /dev/pts(/.*)? <> @@ -178,13 +181,13 @@ ifdef(`distro_suse', ` /etc/udev/devices -d gen_context(system_u:object_r:device_t,s0) -/lib/udev/devices -d gen_context(system_u:object_r:device_t,s0) - -ifdef(`distro_gentoo',` # used by init scripts to initally populate udev /dev +/lib/udev/devices(/.*)? gen_context(system_u:object_r:device_t,s0) +/lib/udev/devices/lp.* -c gen_context(system_u:object_r:printer_device_t,s0) /lib/udev/devices/null -c gen_context(system_u:object_r:null_device_t,s0) /lib/udev/devices/zero -c gen_context(system_u:object_r:zero_device_t,s0) -') + +/sys(/.*)? gen_context(system_u:object_r:sysfs_t,s0) ifdef(`distro_redhat',` # originally from named.fc diff --git a/policy/modules/kernel/devices.if b/policy/modules/kernel/devices.if index efaf80886..e9313fb44 100644 --- a/policy/modules/kernel/devices.if +++ b/policy/modules/kernel/devices.if @@ -334,6 +334,24 @@ interface(`dev_dontaudit_getattr_generic_files',` dontaudit $1 device_t:file getattr; ') +######################################## +## +## Read generic files in /dev. +## +## +## +## Domain to not audit. +## +## +# +interface(`dev_read_generic_files',` + gen_require(` + type device_t; + ') + + read_files_pattern($1, device_t, device_t) +') + ######################################## ## ## Read and write generic files in /dev. @@ -550,6 +568,24 @@ interface(`dev_dontaudit_setattr_generic_chr_files',` dontaudit $1 device_t:chr_file setattr; ') +######################################## +## +## Read generic character device files. +## +## +## +## Domain allowed access. +## +## +# +interface(`dev_read_generic_chr_files',` + gen_require(` + type device_t; + ') + + allow $1 device_t:chr_file read_chr_file_perms; +') + ######################################## ## ## Read and write generic character device files. @@ -568,6 +604,24 @@ interface(`dev_rw_generic_chr_files',` allow $1 device_t:chr_file rw_chr_file_perms; ') +######################################## +## +## Read and write generic block device files. +## +## +## +## Domain allowed access. +## +## +# +interface(`dev_rw_generic_blk_files',` + gen_require(` + type device_t; + ') + + allow $1 device_t:blk_file rw_chr_file_perms; +') + ######################################## ## ## Dontaudit attempts to read/write generic character device files. @@ -622,6 +676,24 @@ interface(`dev_delete_generic_chr_files',` delete_chr_files_pattern($1, device_t, device_t) ') +######################################## +## +## Relabel from generic character device files. +## +## +## +## Domain allowed access. +## +## +# +interface(`dev_relabelfrom_generic_chr_files',` + gen_require(` + type device_t; + ') + + allow $1 device_t:chr_file relabelfrom; +') + ######################################## ## ## Do not audit attempts to set the attributes @@ -641,6 +713,24 @@ interface(`dev_dontaudit_setattr_generic_symlinks',` dontaudit $1 device_t:lnk_file setattr; ') +######################################## +## +## Read symbolic links in device directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`dev_read_generic_symlinks',` + gen_require(` + type device_t; + ') + + allow $1 device_t:lnk_file read_lnk_file_perms; +') + ######################################## ## ## Create symbolic links in device directories. @@ -1422,6 +1512,24 @@ interface(`dev_rw_autofs',` rw_chr_files_pattern($1, device_t, autofs_device_t) ') +######################################## +## +## Relabel the autofs device node. +## +## +## +## Domain allowed access. +## +## +# +interface(`dev_relabel_autofs_dev',` + gen_require(` + type autofs_device_t; + ') + + allow $1 autofs_device_t:chr_file relabel_chr_file_perms; +') + ######################################## ## ## Read and write the PCMCIA card manager device. @@ -1595,6 +1703,24 @@ interface(`dev_rw_cpu_microcode',` rw_chr_files_pattern($1, device_t, cpu_device_t) ') +######################################## +## +## Read the kernel crash device +## +## +## +## Domain allowed access. +## +## +# +interface(`dev_read_crash',` + gen_require(` + type device_t, crash_device_t; + ') + + read_chr_files_pattern($1, device_t, crash_device_t) +') + ######################################## ## ## Read and write the the hardware SSL accelerator. @@ -1977,6 +2103,24 @@ interface(`dev_read_kmsg',` read_chr_files_pattern($1, device_t, kmsg_device_t) ') +######################################## +## +## Do not audit attempts to read the kernel messages +## +## +## +## Domain to not audit. +## +## +# +interface(`dev_dontaudit_read_kmsg',` + gen_require(` + type kmsg_device_t; + ') + + dontaudit $1 kmsg_device_t:chr_file read; +') + ######################################## ## ## Write to the kernel messages device @@ -3611,6 +3755,24 @@ interface(`dev_manage_smartcard',` manage_chr_files_pattern($1, device_t, smartcard_device_t) ') +######################################## +## +## Associate a file to a sysfs filesystem. +## +## +## +## The type of the file to be associated to sysfs. +## +## +# +interface(`dev_associate_sysfs',` + gen_require(` + type sysfs_t; + ') + + allow $1 sysfs_t:filesystem associate; +') + ######################################## ## ## Get the attributes of sysfs directories. @@ -3720,6 +3882,25 @@ interface(`dev_dontaudit_write_sysfs_dirs',` dontaudit $1 sysfs_t:dir write; ') +######################################## +## +## Create, read, write, and delete sysfs +## directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`dev_manage_sysfs_dirs',` + gen_require(` + type sysfs_t; + ') + + manage_dirs_pattern($1, sysfs_t, sysfs_t) +') + ######################################## ## ## Read hardware state information. @@ -3958,6 +4139,24 @@ interface(`dev_read_usbmon_dev',` read_chr_files_pattern($1, device_t, usbmon_device_t) ') +######################################## +## +## Write USB monitor devices. +## +## +## +## Domain allowed access. +## +## +# +interface(`dev_write_usbmon_dev',` + gen_require(` + type device_t, usbmon_device_t; + ') + + write_chr_files_pattern($1, device_t, usbmon_device_t) +') + ######################################## ## ## Mount a usbfs filesystem. @@ -4270,11 +4469,10 @@ interface(`dev_write_video_dev',` # interface(`dev_rw_vhost',` gen_require(` - type vhost_device_t; + type device_t, vhost_device_t; ') - list_dirs_pattern($1, vhost_device_t, vhost_device_t) - rw_files_pattern($1, vhost_device_t, vhost_device_t) + rw_chr_files_pattern($1, device_t, vhost_device_t) ') ######################################## diff --git a/policy/modules/kernel/devices.te b/policy/modules/kernel/devices.te index c03e21b9d..3ff4f60af 100644 --- a/policy/modules/kernel/devices.te +++ b/policy/modules/kernel/devices.te @@ -1,4 +1,4 @@ -policy_module(devices, 1.11.1) +policy_module(devices, 1.11.2) ######################################## # @@ -56,6 +56,12 @@ dev_node(clock_device_t) type cpu_device_t; dev_node(cpu_device_t) +# +# Type for /dev/crash +# +type crash_device_t; +dev_node(crash_device_t) + # for the IBM zSeries z90crypt hardware ssl accelorator type crypt_device_t; dev_node(crypt_device_t)