policy_module(bootloader, 1.23.0) ######################################## # # Declarations # attribute_role bootloader_roles; roleattribute system_r bootloader_roles; # # boot_runtime_t is the type for /boot/kernel.h, # which is automatically generated at boot time. # only for Red Hat # type boot_runtime_t; files_type(boot_runtime_t) type bootloader_t; type bootloader_exec_t; application_domain(bootloader_t, bootloader_exec_t) role bootloader_roles types bootloader_t; # # bootloader_etc_t is the configuration file, # grub.conf, lilo.conf, etc. # type bootloader_etc_t; files_type(bootloader_etc_t) # # The temp file is used for initrd creation; # it consists of files and device nodes # type bootloader_tmp_t; files_tmp_file(bootloader_tmp_t) dev_node(bootloader_tmp_t) ######################################## # # bootloader local policy # allow bootloader_t self:capability { chown dac_override dac_read_search fsetid mknod setgid sys_admin sys_rawio }; allow bootloader_t self:process { signal_perms execmem }; allow bootloader_t self:fifo_file rw_fifo_file_perms; allow bootloader_t bootloader_etc_t:file read_file_perms; # uncomment the following lines if you use "lilo -p" #allow bootloader_t bootloader_etc_t:file manage_file_perms; #files_etc_filetrans(bootloader_t,bootloader_etc_t,file) manage_dirs_pattern(bootloader_t, bootloader_tmp_t, bootloader_tmp_t) manage_files_pattern(bootloader_t, bootloader_tmp_t, bootloader_tmp_t) manage_lnk_files_pattern(bootloader_t, bootloader_tmp_t, bootloader_tmp_t) manage_blk_files_pattern(bootloader_t, bootloader_tmp_t, bootloader_tmp_t) manage_chr_files_pattern(bootloader_t, bootloader_tmp_t, bootloader_tmp_t) files_tmp_filetrans(bootloader_t, bootloader_tmp_t, { dir file lnk_file chr_file blk_file }) allow bootloader_t bootloader_tmp_t:dir mounton; # for tune2fs (cjp: ?) files_root_filetrans(bootloader_t, bootloader_tmp_t, file) kernel_getattr_core_if(bootloader_t) kernel_read_network_state(bootloader_t) kernel_read_system_state(bootloader_t) kernel_read_software_raid_state(bootloader_t) kernel_read_kernel_sysctls(bootloader_t) kernel_search_debugfs(bootloader_t) kernel_setsched(bootloader_t) kernel_dontaudit_getattr_proc(bootloader_t) # for grub-probe kernel_request_load_module(bootloader_t) storage_raw_read_fixed_disk(bootloader_t) storage_raw_write_fixed_disk(bootloader_t) storage_raw_read_removable_device(bootloader_t) storage_raw_write_removable_device(bootloader_t) storage_rw_fuse(bootloader_t) dev_getattr_all_chr_files(bootloader_t) dev_getattr_all_blk_files(bootloader_t) dev_dontaudit_rw_generic_dev_nodes(bootloader_t) dev_read_rand(bootloader_t) dev_read_urand(bootloader_t) dev_read_sysfs(bootloader_t) # newer versions of grub use efivarfs to modify EFI variables; dontaudit legacy /sys/fs/efi/vars access dev_dontaudit_write_sysfs_files(bootloader_t) # needed on some hardware dev_rw_nvram(bootloader_t) fs_getattr_xattr_fs(bootloader_t) fs_getattr_dos_fs(bootloader_t) fs_getattr_tmpfs(bootloader_t) fs_read_tmpfs_symlinks(bootloader_t) #Needed for EFI fs_getattr_efivarfs(bootloader_t) fs_manage_dos_files(bootloader_t) fs_mmap_read_dos_files(bootloader_t) mls_file_read_all_levels(bootloader_t) mls_file_write_all_levels(bootloader_t) term_getattr_all_ttys(bootloader_t) term_getattr_generic_ptys(bootloader_t) term_dontaudit_manage_pty_dirs(bootloader_t) corecmd_exec_all_executables(bootloader_t) domain_use_interactive_fds(bootloader_t) files_create_boot_dirs(bootloader_t) files_getattr_default_dirs(bootloader_t) files_manage_boot_files(bootloader_t) files_manage_boot_symlinks(bootloader_t) files_read_etc_files(bootloader_t) files_exec_etc_files(bootloader_t) files_read_usr_src_files(bootloader_t) files_read_usr_files(bootloader_t) files_read_var_files(bootloader_t) files_read_kernel_modules(bootloader_t) files_search_mnt(bootloader_t) # for nscd files_dontaudit_search_runtime(bootloader_t) # for blkid.tab files_manage_etc_runtime_files(bootloader_t) files_etc_filetrans_etc_runtime(bootloader_t, file) files_dontaudit_search_home(bootloader_t) fs_list_efivars(bootloader_t) fs_manage_efivarfs_files(bootloader_t) fs_list_hugetlbfs(bootloader_t) fs_mount_fusefs(bootloader_t) fs_mount_xattr_fs(bootloader_t) fs_mounton_fusefs(bootloader_t) fs_read_fusefs_symlinks(bootloader_t) fs_read_fusefs_files(bootloader_t) fs_getattr_fusefs(bootloader_t) fs_unmount_fusefs(bootloader_t) fs_unmount_xattr_fs(bootloader_t) fstools_manage_runtime_files(bootloader_t) init_getattr_initctl(bootloader_t) init_use_script_ptys(bootloader_t) init_use_script_fds(bootloader_t) init_rw_script_pipes(bootloader_t) libs_read_lib_files(bootloader_t) libs_exec_lib_files(bootloader_t) logging_send_syslog_msg(bootloader_t) logging_rw_generic_logs(bootloader_t) miscfiles_read_localization(bootloader_t) mount_rw_runtime_files(bootloader_t) selinux_getattr_fs(bootloader_t) selinux_use_status_page(bootloader_t) seutil_read_bin_policy(bootloader_t) seutil_read_file_contexts(bootloader_t) seutil_read_loadpolicy(bootloader_t) seutil_dontaudit_search_config(bootloader_t) udev_read_runtime_files(bootloader_t) userdom_use_user_terminals(bootloader_t) userdom_dontaudit_search_user_home_dirs(bootloader_t) ifdef(`distro_debian',` allow bootloader_t bootloader_tmp_t:{ dir file } { relabelfrom relabelto }; fs_list_tmpfs(bootloader_t) files_relabel_kernel_modules(bootloader_t) files_relabelfrom_boot_files(bootloader_t) files_delete_kernel_modules(bootloader_t) files_relabelto_usr_files(bootloader_t) files_search_var_lib(bootloader_t) # for /usr/share/initrd-tools/scripts files_exec_usr_files(bootloader_t) fstools_manage_entry_files(bootloader_t) fstools_relabelto_entry_files(bootloader_t) libs_relabelto_lib_files(bootloader_t) apt_use_fds(bootloader_t) apt_use_ptys(bootloader_t) # for apt-cache apt_read_db(bootloader_t) apt_manage_cache(bootloader_t) dpkg_read_db(bootloader_t) dpkg_rw_pipes(bootloader_t) ') ifdef(`distro_redhat',` # for memlock allow bootloader_t self:capability ipc_lock; allow bootloader_t boot_runtime_t:file { read_file_perms delete_file_perms }; # new file system defaults to unlabeled, granting unlabeled access is still bad. kernel_manage_unlabeled_dirs(bootloader_t) kernel_manage_unlabeled_files(bootloader_t) kernel_manage_unlabeled_symlinks(bootloader_t) kernel_manage_unlabeled_blk_files(bootloader_t) kernel_manage_unlabeled_chr_files(bootloader_t) # for mke2fs mount_run(bootloader_t, bootloader_roles) optional_policy(` unconfined_domain(bootloader_t) ') ') optional_policy(` fstools_exec(bootloader_t) ') optional_policy(` gpm_getattr_gpmctl(bootloader_t) ') optional_policy(` dev_rw_lvm_control(bootloader_t) lvm_domtrans(bootloader_t) lvm_read_config(bootloader_t) ') optional_policy(` modutils_domtrans(bootloader_t) modutils_read_module_config(bootloader_t) modutils_read_module_deps(bootloader_t) ') optional_policy(` nscd_use(bootloader_t) ') optional_policy(` raid_read_mdadm_runtime_files(bootloader_t) ') optional_policy(` rpm_rw_pipes(bootloader_t) ')