nnd
/
selinux-refpolicy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
selinux-refpolicy/policy/modules/services/wireguard.te

80 lines
2.2 KiB
Plaintext
Raw Normal View History

Drop module versioning. Semodule stopped using this many years ago. The policy_module() macro will continue to support an optional second parameter as version. If it is not specified, a default value of 1 is set. Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2022-01-06 13:55:54 +00:00
policy_module(wireguard)
Add a policy module for WireGuard VPN WireGuard is a fast, modern, secure VPN tunnel, according to https://www.wireguard.com/. In order to install it, the mostly documented way consists in building and installing an out-of-tree kernel module and using userland tools to configure this module (wg and wg-quick). * WireGuard is like "ip": the userland tool communicates with the kernel module through a netlink socket. * WireGuard is like "iptables": there is no daemon, but some distributions ship systemd units that restores a WireGuard configuration when started. * WireGuard is like other services: its configuration files are in /etc, and it can use /run and /tmp. Create a new policy module which handles all of this. Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2019-09-06 20:20:40 +00:00
########################################
#
# Declarations
#
attribute_role wireguard_roles;
roleattribute system_r wireguard_roles;
type wireguard_t;
type wireguard_exec_t;
init_system_domain(wireguard_t, wireguard_exec_t)
role wireguard_roles types wireguard_t;
type wireguard_etc_t;
files_config_file(wireguard_etc_t)
type wireguard_initrc_exec_t;
init_unit_file(wireguard_initrc_exec_t)
type wireguard_runtime_t;
Update callers for "pid" to "runtime" interface rename. Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2020-06-27 21:11:48 +00:00
files_runtime_file(wireguard_runtime_t)
Add a policy module for WireGuard VPN WireGuard is a fast, modern, secure VPN tunnel, according to https://www.wireguard.com/. In order to install it, the mostly documented way consists in building and installing an out-of-tree kernel module and using userland tools to configure this module (wg and wg-quick). * WireGuard is like "ip": the userland tool communicates with the kernel module through a netlink socket. * WireGuard is like "iptables": there is no daemon, but some distributions ship systemd units that restores a WireGuard configuration when started. * WireGuard is like other services: its configuration files are in /etc, and it can use /run and /tmp. Create a new policy module which handles all of this. Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2019-09-06 20:20:40 +00:00
type wireguard_unit_t;
init_unit_file(wireguard_unit_t)
type wireguard_tmp_t;
files_tmp_file(wireguard_tmp_t)
########################################
#
# Local policy
#
allow wireguard_t self:capability net_admin;
allow wireguard_t self:process getsched;
allow wireguard_t self:fifo_file rw_fifo_file_perms;
allow wireguard_t self:netlink_generic_socket create_socket_perms;
allow wireguard_t self:netlink_route_socket r_netlink_socket_perms;
allow wireguard_t self:udp_socket create_socket_perms;
allow wireguard_t self:unix_stream_socket create_socket_perms;
Remove unneeded semicolons after interface and macro calls Signed-off-by: Daniel Burgener <dburgener@tresys.com>
2020-01-31 19:41:28 +00:00
manage_files_pattern(wireguard_t, wireguard_etc_t, wireguard_etc_t)
Add a policy module for WireGuard VPN WireGuard is a fast, modern, secure VPN tunnel, according to https://www.wireguard.com/. In order to install it, the mostly documented way consists in building and installing an out-of-tree kernel module and using userland tools to configure this module (wg and wg-quick). * WireGuard is like "ip": the userland tool communicates with the kernel module through a netlink socket. * WireGuard is like "iptables": there is no daemon, but some distributions ship systemd units that restores a WireGuard configuration when started. * WireGuard is like other services: its configuration files are in /etc, and it can use /run and /tmp. Create a new policy module which handles all of this. Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2019-09-06 20:20:40 +00:00
files_read_etc_files(wireguard_t)
manage_files_pattern(wireguard_t, wireguard_runtime_t, wireguard_runtime_t)
Update callers for "pid" to "runtime" interface rename. Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2020-06-27 21:11:48 +00:00
files_runtime_filetrans(wireguard_t, wireguard_runtime_t, dir)
Add a policy module for WireGuard VPN WireGuard is a fast, modern, secure VPN tunnel, according to https://www.wireguard.com/. In order to install it, the mostly documented way consists in building and installing an out-of-tree kernel module and using userland tools to configure this module (wg and wg-quick). * WireGuard is like "ip": the userland tool communicates with the kernel module through a netlink socket. * WireGuard is like "iptables": there is no daemon, but some distributions ship systemd units that restores a WireGuard configuration when started. * WireGuard is like other services: its configuration files are in /etc, and it can use /run and /tmp. Create a new policy module which handles all of this. Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2019-09-06 20:20:40 +00:00
manage_dirs_pattern(wireguard_t, wireguard_tmp_t, wireguard_tmp_t)
manage_files_pattern(wireguard_t, wireguard_tmp_t, wireguard_tmp_t)
files_tmp_filetrans(wireguard_t, wireguard_tmp_t, file)
# wg-quick can execute wg
can_exec(wireguard_t, wireguard_exec_t)
# wg-quick is a shell script
corecmd_exec_bin(wireguard_t)
corecmd_exec_shell(wireguard_t)
domain_use_interactive_fds(wireguard_t)
# wg-quick tries to read /proc/filesystem when running "stat" and "mv" commands
kernel_dontaudit_read_system_state(wireguard_t)
wireguard: allow running iptables Wireguard can be configured to run iptables and other such networking tools when bringing up/down interfaces. Also add a dontaudit for searching kernel sysctls. Signed-off-by: Kenton Groombridge <me@concord.sh>
2021-03-13 02:15:45 +00:00
kernel_dontaudit_search_kernel_sysctl(wireguard_t)
Add a policy module for WireGuard VPN WireGuard is a fast, modern, secure VPN tunnel, according to https://www.wireguard.com/. In order to install it, the mostly documented way consists in building and installing an out-of-tree kernel module and using userland tools to configure this module (wg and wg-quick). * WireGuard is like "ip": the userland tool communicates with the kernel module through a netlink socket. * WireGuard is like "iptables": there is no daemon, but some distributions ship systemd units that restores a WireGuard configuration when started. * WireGuard is like other services: its configuration files are in /etc, and it can use /run and /tmp. Create a new policy module which handles all of this. Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2019-09-06 20:20:40 +00:00
miscfiles_read_localization(wireguard_t)
# wg-quick runs /usr/bin/ip to configure the network
sysnet_run_ifconfig(wireguard_t, wireguard_roles)
userdom_use_user_terminals(wireguard_t)
policy/modules/services/wireguard.te: make iptables optional Make iptables optional to avoid the following build failure raised since version 2.20210908 and https://github.com/SELinuxProject/refpolicy/commit/7f1a7b1cacd5d211077ce62fbb4e91890e65c820: Compiling targeted policy.33 env LD_LIBRARY_PATH="/tmp/instance-0/output-1/host/lib:/tmp/instance-0/output-1/host/usr/lib" /tmp/instance-0/output-1/host/usr/bin/checkpolicy -c 33 -U deny -S -O -E policy.conf -o policy.33 policy/modules/services/wireguard.te:66:ERROR 'type iptables_exec_t is not within scope' at token ';' on line 591892: #line 66 allow wireguard_t iptables_exec_t:file { getattr open map read execute ioctl }; checkpolicy: error(s) encountered while parsing configuration make[1]: *** [Rules.monolithic:79: policy.33] Error 1 Fixes: - http://autobuild.buildroot.org/results/a4223accc6adb70b06fd4e74ca4f28484446b6fa Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
2021-09-22 21:55:59 +00:00
# wg-quick can be configured to run iptables and other networking
# config tools when bringing up/down the wg interfaces
optional_policy(`
iptables_domtrans(wireguard_t)
')