nnd/selinux-refpolicy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

kernel: Add dontaudits when secure_mode_insmod is enabled.

Browse Source 
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
This commit is contained in:
Chris PeBenito 2021-03-19 15:50:06 -04:00
parent 3d0a6f966f
commit 838c145fb9
2 changed files with 33 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
policy/modules/kernel/files.if
View File

@ -4367,6 +4367,25 @@ interface(`files_load_kernel_modules',`
allow $1 modules_object_t:system module_load; allow $1 modules_object_t:system module_load;
') ')
########################################
## <summary>
## Load kernel module files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`files_dontaudit_load_kernel_modules',`
gen_require(`
type modules_object_t;
')
dontaudit $1 modules_object_t:file read_file_perms;
dontaudit $1 modules_object_t:system module_load;
')
######################################## ########################################
## <summary> ## <summary>
## List world-readable directories. ## List world-readable directories.

15
policy/modules/kernel/kernel.te
View File

@ -497,7 +497,20 @@ optional_policy(`
# Kernel module loading policy # Kernel module loading policy
# #
if( ! secure_mode_insmod ) { if(secure_mode_insmod) {
dontaudit can_load_kernmodule self:capability sys_module;
dontaudit can_load_kernmodule self:system module_load;
files_dontaudit_load_kernel_modules(can_load_kernmodule)
# load_module() calls stop_machine() which
# calls sched_setscheduler()
# gt: there seems to be no trace of the above, at
# least in kernel versions greater than 2.6.37...
dontaudit can_load_kernmodule self:capability sys_nice;
dontaudit can_load_kernmodule kernel_t:process setsched;
dontaudit can_load_kernmodule kernel_t:key search;
} else {
allow can_load_kernmodule self:capability sys_module; allow can_load_kernmodule self:capability sys_module;
allow can_load_kernmodule self:system module_load; allow can_load_kernmodule self:system module_load;