Merge pull request #499 from 0xC0ncord/udica-templates

Add udica templates

.github/workflows/tests.yml

@@ -151,4 +151,5 @@ jobs:
         make install-headers
         make install-src
         make install-docs
+        make install-udica-templates
         make install-appconfig

Makefile

@@ -133,6 +133,9 @@ htmldir := $(LOCAL_ROOT)/doc/html
 doctmpdir := $(LOCAL_ROOT)/doc/tmp
 endif
 
+# udica templates path
+udicatemplates := udica-templates
+
 # config file paths
 globaltun := $(poldir)/global_tunables
 globalbool := $(poldir)/global_booleans
@@ -167,6 +170,7 @@ sharedir := $(prefix)/share/selinux
 modpkgdir := $(sharedir)/$(strip $(NAME))
 headerdir := $(modpkgdir)/include
 docsdir := $(prefix)/share/doc/$(PKGNAME)
+udicatemplatesdir := $(prefix)/share/udica/templates
 
 # enable MLS if requested.
 ifeq "$(TYPE)" "mls"
@@ -590,6 +594,15 @@ install-src:
 	mkdir -p $(srcpath)/policy
 	cp -R . $(srcpath)/policy
 
+########################################
+#
+# Install udica templates
+#
+install-udica-templates:
+	@mkdir -p $(udicatemplatesdir)
+	@echo "Installing udica templates"
+	$(verbose) $(INSTALL) -m 644 $(wildcard $(udicatemplates)/*) $(udicatemplatesdir)
+
 ########################################
 #
 # Generate tags file
@@ -671,4 +684,4 @@ ifneq ($(generated_fc),)
 endif
 endif
 
-.PHONY: install-src install-appconfig install-headers build-interface-db generate xml conf html bare tags
+.PHONY: install-src install-appconfig install-headers install-udica-templates build-interface-db generate xml conf html bare tags

udica-templates/base_container.cil

@@ -0,0 +1,77 @@
+;;
+;; Permission sets definitions
+;;
+
+(classpermission search_dir_perms)
+(classpermissionset search_dir_perms (dir (getattr search)))
+
+(classpermission list_dir_perms)
+(classpermissionset list_dir_perms (dir (getattr search open read lock ioctl)))
+
+(classpermission rw_dir_perms)
+(classpermissionset rw_dir_perms (dir (open read getattr lock search ioctl add_name remove_name write)))
+
+(classpermission manage_dir_perms)
+(classpermissionset manage_dir_perms (dir (create open getattr setattr read write link unlink rename search add_name remove_name reparent rmdir lock ioctl)))
+
+(classpermission rw_chr_file_perms)
+(classpermissionset rw_chr_file_perms (chr_file (getattr open read write append ioctl lock)))
+
+(classpermission read_file_perms)
+(classpermissionset read_file_perms (file (getattr open read lock ioctl)))
+
+(classpermission rw_file_perms)
+(classpermissionset rw_file_perms (file (open getattr read write append ioctl lock)))
+
+(classpermission manage_file_perms)
+(classpermissionset manage_file_perms (file (create open getattr setattr read write append rename link unlink ioctl lock)))
+
+(classpermission exec_file_perms)
+(classpermissionset exec_file_perms (file (getattr open map read execute ioctl execute_no_trans)))
+
+(classpermission read_lnk_file_perms)
+(classpermissionset read_lnk_file_perms (lnk_file (getattr read)))
+
+(classpermission rw_lnk_file_perms)
+(classpermissionset rw_lnk_file_perms (lnk_file (getattr read write lock ioctl)))
+
+(classpermission manage_lnk_file_perms)
+(classpermissionset manage_lnk_file_perms (lnk_file (create read write getattr setattr link unlink rename ioctl lock)))
+
+(classpermission write_sock_file_perms)
+(classpermissionset write_sock_file_perms (sock_file (getattr write open append)))
+
+(classpermission manage_sock_file_perms)
+(classpermissionset manage_sock_file_perms (sock_file (create open getattr setattr read write rename link unlink ioctl lock append)))
+
+(classpermission create_tcp_socket_perms)
+(classpermissionset create_tcp_socket_perms (tcp_socket (ioctl read getattr write setattr append bind connect getopt setopt shutdown listen accept)))
+
+(classpermission create_udp_socket_perms)
+(classpermissionset create_udp_socket_perms (udp_socket (ioctl read getattr write setattr append bind connect getopt setopt shutdown)))
+
+(classpermission create_sctp_socket_perms)
+(classpermissionset create_sctp_socket_perms (sctp_socket (ioctl read getattr write setattr append bind connect getopt setopt shutdown)))
+
+(classpermission rw_shm_perms)
+(classpermissionset rw_shm_perms (shm (lock associate getattr read unix_read unix_write write)))
+
+;;
+;; Base container policy
+;;
+
+(block container
+	(blockabstract container)
+
+	(type process)
+	(type socket)
+
+	(roletype system_r process)
+	(typeattributeset domain (process))
+	(typeattributeset container_domain (process))
+	(typeattributeset mcs_constrained_type (process))
+	(typeattributeset file_type (socket))
+
+	(allow process socket manage_sock_file_perms)
+	(allow container_engine_domain process (key (create search setattr view)))
+)

udica-templates/config_container.cil

@@ -0,0 +1,33 @@
+(block config_container
+	(blockabstract config_container)
+
+	(optional config_container_optional
+		(allow process configfile list_dir_perms)
+		(allow process configfile read_file_perms)
+		(allow process configfile read_lnk_file_perms)
+	)
+)
+
+(block config_rw_container
+	(blockabstract config_rw_container)
+
+	(blockinherit config_container)
+
+	(optional config_rw_container_optional
+		(allow process configfile rw_dir_perms)
+		(allow process configfile rw_file_perms)
+		(allow process configfile rw_lnk_file_perms)
+	)
+)
+
+(block config_manage_container
+	(blockabstract config_manage_container)
+
+	(blockinherit config_rw_container)
+
+	(optional config_manage_container_optional
+		(allow process configfile manage_dir_perms)
+		(allow process configfile manage_file_perms)
+		(allow process configfile manage_lnk_file_perms)
+	)
+)

udica-templates/home_container.cil

@@ -0,0 +1,44 @@
+(block home_container
+	(blockabstract home_container)
+
+	(optional home_container_optional
+		(allow process process (capability (dac_override)))
+
+		(allow process home_root_t list_dir_perms)
+		(allow process user_home_dir_t list_dir_perms)
+		(allow process user_home_t list_dir_perms)
+
+		(allow process user_home_dir_t read_file_perms)
+		(allow process user_home_t read_file_perms)
+	)
+)
+
+(block home_rw_container
+	(blockabstract home_rw_container)
+
+	(blockinherit home_container)
+
+	(optional home_rw_container_optional
+		(allow process home_root_t rw_dir_perms)
+		(allow process user_home_dir_t rw_dir_perms)
+		(allow process user_home_t rw_dir_perms)
+
+		(allow process user_home_dir_t rw_file_perms)
+		(allow process user_home_t rw_file_perms)
+	)
+)
+
+(block home_manage_container
+	(blockabstract home_manage_container)
+
+	(blockinherit home_rw_container)
+
+	(optional home_manage_container_optional
+		(allow process home_root_t manage_dir_perms)
+		(allow process user_home_dir_t manage_dir_perms)
+		(allow process user_home_t manage_dir_perms)
+
+		(allow process user_home_dir_t manage_file_perms)
+		(allow process user_home_t manage_file_perms)
+	)
+)

udica-templates/log_container.cil

@@ -0,0 +1,40 @@
+(block log_container
+	(blockabstract log_container)
+
+	(optional log_container_optional
+		(allow process var_t search_dir_perms)
+		(allow process logfile list_dir_perms)
+		(allow process logfile read_file_perms)
+		(allow process logfile read_lnk_file_perms)
+		(allow process auditd_log_t list_dir_perms)
+		(allow process auditd_log_t read_file_perms)
+	)
+)
+
+(block log_rw_container
+	(blockabstract log_rw_container)
+
+	(blockinherit log_container)
+
+	(optional log_rw_container_optional
+		(allow process logfile rw_dir_perms)
+		(allow process logfile rw_file_perms)
+		(allow process logfile rw_lnk_file_perms)
+		(allow process auditd_log_t rw_dir_perms)
+		(allow process auditd_log_t rw_file_perms)
+	)
+)
+
+(block log_manage_container
+	(blockabstract log_manage_container)
+
+	(blockinherit log_rw_container)
+
+	(optional log_manage_container_optional
+		(allow process logfile manage_dir_perms)
+		(allow process logfile manage_file_perms)
+		(allow process logfile manage_lnk_file_perms)
+		(allow process auditd_log_t manage_dir_perms)
+		(allow process auditd_log_t manage_file_perms)
+	)
+)

udica-templates/net_container.cil

@@ -0,0 +1,26 @@
+(block net_container
+	(blockabstract net_container)
+
+	(optional net_container_optional
+		(typeattributeset container_net_domain (process))
+	)
+)
+
+(block restricted_net_container
+	(blockabstract restricted_net_container)
+
+	(optional restricted_net_container_optional
+		(allow process self create_tcp_socket_perms)
+		(allow process self create_udp_socket_perms)
+		(allow process self create_sctp_socket_perms)
+
+		(call .read_lnk_files (process proc_t))
+
+		(allow process node_t (node (recvfrom sendto)))
+
+		(allow process node_t (udp_socket (node_bind)))
+		(allow process node_t (tcp_socket (node_bind)))
+
+		(allow process http_port_t (tcp_socket (name_connect)))
+	)
+)

udica-templates/tmp_container.cil

@@ -0,0 +1,19 @@
+(block tmp_container
+	(blockabstract tmp_container)
+
+	(optional tmp_container_optional
+		(allow process tmpfile search_dir_perms)
+		(allow process tmpfile read_file_perms)
+	)
+)
+
+(block tmp_rw_container
+	(blockabstract tmp_rw_container)
+
+	(blockinherit tmp_container)
+
+	(optional tmp_rw_container_optional
+		(allow process tmpfile rw_dir_perms)
+		(allow process tmpfile rw_file_perms)
+	)
+)

udica-templates/tty_container.cil

@@ -0,0 +1,10 @@
+(block tty_container
+	(blockabstract tty_container)
+
+	(optional tty_container_optional
+		(allow process device_t list_dir_perms)
+		(allow process device_t read_lnk_file_perms)
+
+		(allow process devtty_t rw_chr_file_perms)
+	)
+)

udica-templates/virt_container.cil

@@ -0,0 +1,16 @@
+(block virt_container
+	(blockabstract virt_container)
+
+	(optional virt_container_optional
+		(allow process var_t search_dir_perms)
+		(allow process var_t read_lnk_file_perms)
+
+		(allow process var_run_t search_dir_perms)
+		(allow process var_run_t read_lnk_file_perms)
+
+		(allow process virt_runtime_t search_dir_perms)
+		(allow process virt_runtime_t write_sock_file_perms)
+
+		(allow process virtd_t (unix_stream_socket (connectto)))
+	)
+)

udica-templates/x_container.cil

@@ -0,0 +1,27 @@
+(block x_container
+	(blockabstract x_container)
+
+	(optional x_container_optional
+		(allow xserver_t process rw_shm_perms)
+
+		(allow process xserver_t (unix_stream_socket (connectto)))
+
+		(allow process device_t search_dir_perms)
+
+		(allow process dri_device_t rw_chr_file_perms)
+
+		(allow process xserver_misc_device_t rw_chr_file_perms)
+
+		(allow process urandom_device_t read_chr_file_perms)
+
+		(allow process tmpfs_t search_dir_perms)
+
+		(allow process tmp_t search_dir_perms)
+		(allow process tmp_t read_lnk_file_perms)
+
+		(allow process xserver_tmp_t search_dir_perms)
+		(allow process xserver_tmp_t write_sock_file_perms)
+
+		(allow process xserver_exec_t exec_file_perms)
+	)
+)