RepoMirrors/selinux-refpolicy
1
0
Fork 0
mirror of https://github.com/SELinuxProject/refpolicy synced 2025-03-31 15:56:35 +00:00
Code Issues Packages Projects Releases Wiki Activity
5cfe0def8b
selinux-refpolicy/policy/modules/kernel
History
Nicolas Iooss 5cfe0def8b Add module_load permission to self when loading modules is allowed 
When a program uses init_module() to load a module, the kernel checks
for system:load_module permission in the process type [1].
For example when systemd loads ip_tables modules (since
1d3087978a),
the following AVC denial gets reported:

    avc:  denied  { module_load } for  pid=1 comm="systemd"
    scontext=system_u:system_r:init_t tcontext=system_u:system_r:init_t
    tclass=system permissive=1

[1] The relevant kernel code is selinux_kernel_module_from_file() in
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/security/selinux/hooks.c?h=v4.11#n3836

    /* init_module */
    if (file == NULL)
        return avc_has_perm(sid, sid, SECCLASS_SYSTEM,
                    SYSTEM__MODULE_LOAD, NULL);

In this code, both source and target SIDs are current_sid().
2017-08-08 19:58:47 -04:00
..
corecommands.fc chkrootkit: add interfaces and sysadm permit 2017-06-12 18:41:56 -04:00
corecommands.if Remove deprecated interfaces older than one year old. 2017-08-06 17:03:17 -04:00
corecommands.te Bump module versions for release. 2017-08-05 12:59:42 -04:00
corenetwork.fc Create / to /usr equivalence for bin, sbin, and lib, from Russell Coker. 2017-02-04 15:19:35 -05:00
corenetwork.if.in Remove deprecated interfaces older than one year old. 2017-08-06 17:03:17 -04:00
corenetwork.if.m4 refpolicy: Infiniband pkeys and endports 2017-05-24 19:23:18 -04:00
corenetwork.te.in Bump module versions for release. 2017-08-05 12:59:42 -04:00
corenetwork.te.m4 refpolicy: Infiniband pkeys and endports 2017-05-24 19:23:18 -04:00
devices.fc Update for Xen 4.7 2017-08-06 11:19:29 -04:00
devices.if Remove deprecated interfaces older than one year old. 2017-08-06 17:03:17 -04:00
devices.te Module version bump for patches from Guido Trentalancia and Anthony PERARD. 2017-08-06 11:26:52 -04:00
domain.fc remove extra level of directory 2006-07-12 20:32:27 +00:00
domain.if remove trailing whitespaces 2016-12-06 13:45:13 +01:00
domain.te Bump module versions for release. 2016-10-23 16:58:59 -04:00
files.fc Misc fc changes from Russell Coker. 2017-04-06 17:00:28 -04:00
files.if Remove deprecated interfaces older than one year old. 2017-08-06 17:03:17 -04:00
files.te Bump module versions for release. 2017-08-05 12:59:42 -04:00
filesystem.fc Create / to /usr equivalence for bin, sbin, and lib, from Russell Coker. 2017-02-04 15:19:35 -05:00
filesystem.if Remove deprecated interfaces older than one year old. 2017-08-06 17:03:17 -04:00
filesystem.te Bump module versions for release. 2017-08-05 12:59:42 -04:00
kernel.fc Add fc for /sys/kernel/debug as debugfs_t 2015-05-06 09:49:40 -04:00
kernel.if Remove deprecated interfaces older than one year old. 2017-08-06 17:03:17 -04:00
kernel.te Add module_load permission to self when loading modules is allowed 2017-08-08 19:58:47 -04:00
mcs.fc remove extra level of directory 2006-07-12 20:32:27 +00:00
mcs.if remove trailing whitespaces 2016-12-06 13:45:13 +01:00
mcs.te Bump module versions for release. 2013-04-24 16:14:52 -04:00
metadata.xml remove extra level of directory 2006-07-12 20:32:27 +00:00
mls.fc remove extra level of directory 2006-07-12 20:32:27 +00:00
mls.if Remove deprecated interfaces older than one year old. 2017-08-06 17:03:17 -04:00
mls.te remove trailing whitespaces 2016-12-06 13:45:13 +01:00
selinux.fc remove extra level of directory 2006-07-12 20:32:27 +00:00
selinux.if Remove deprecated interfaces older than one year old. 2017-08-06 17:03:17 -04:00
selinux.te remove trailing whitespaces 2016-12-06 13:45:13 +01:00
storage.fc Create / to /usr equivalence for bin, sbin, and lib, from Russell Coker. 2017-02-04 15:19:35 -05:00
storage.if Fix interface descriptions when duplicate ones are found 2016-01-19 00:17:34 +01:00
storage.te Bump module versions for release. 2017-08-05 12:59:42 -04:00
terminal.fc Misc fc changes from Russell Coker. 2017-04-06 17:00:28 -04:00
terminal.if Remove deprecated interfaces older than one year old. 2017-08-06 17:03:17 -04:00
terminal.te Bump module versions for release. 2017-08-05 12:59:42 -04:00
ubac.fc trunk: add missing ubac module. 2008-11-05 16:11:27 +00:00
ubac.if Improve the documentation of ubac_constrained(). 2010-03-02 11:28:44 -05:00
ubac.te Whitespace change: drop unnecessary blank line at the start of .te files. 2010-06-10 08:16:35 -04:00