274 lines
6.9 KiB
Plaintext
274 lines
6.9 KiB
Plaintext
## <summary>
|
|
## Policy for kernel security interface, in particular, selinuxfs.
|
|
## </summary>
|
|
## <required val="true">
|
|
## Contains the policy for the kernel SELinux security interface.
|
|
## </required>
|
|
|
|
########################################
|
|
## <desc>
|
|
## Gets the caller the mountpoint of the selinuxfs filesystem.
|
|
## </desc>
|
|
## <param name="domain">
|
|
## The process type requesting the selinuxfs mountpoint.
|
|
## </param>
|
|
#
|
|
interface(`selinux_get_fs_mount',`
|
|
# read /proc/filesystems to see if selinuxfs is supported
|
|
# then read /proc/self/mount to see where selinuxfs is mounted
|
|
kernel_read_system_state($1)
|
|
')
|
|
|
|
########################################
|
|
## <desc>
|
|
## Allows the caller to get the mode of policy enforcement
|
|
## (enforcing or permissive mode).
|
|
## </desc>
|
|
## <param name="domain">
|
|
## The process type to allow to get the enforcing mode.
|
|
## </param>
|
|
#
|
|
interface(`selinux_get_enforce_mode',`
|
|
gen_require(`
|
|
type security_t;
|
|
class dir { read search getattr };
|
|
class file { getattr read };
|
|
')
|
|
|
|
allow $1 security_t:dir { read search getattr };
|
|
allow $1 security_t:file { getattr read };
|
|
')
|
|
|
|
########################################
|
|
## <desc>
|
|
## Allow caller to set the mode of policy enforcement
|
|
## (enforcing or permissive mode).
|
|
## </desc>
|
|
## <param name="domain">
|
|
## The process type to allow to set the enforcement mode.
|
|
## </param>
|
|
#
|
|
interface(`selinux_set_enforce_mode',`
|
|
gen_require(`
|
|
type security_t;
|
|
attribute can_setenforce;
|
|
class dir { read search getattr };
|
|
class file { getattr read write };
|
|
class security setenforce;
|
|
')
|
|
|
|
allow $1 security_t:dir { read search getattr };
|
|
allow $1 security_t:file { getattr read write };
|
|
allow $1 security_t:security setenforce;
|
|
auditallow $1 security_t:security setenforce;
|
|
typeattribute $1 can_setenforce;
|
|
')
|
|
|
|
########################################
|
|
## <desc>
|
|
## Allow caller to load the policy into the kernel.
|
|
## </desc>
|
|
## <param name="domain">
|
|
## The process type that will load the policy.
|
|
## </param>
|
|
#
|
|
interface(`selinux_load_policy',`
|
|
gen_require(`
|
|
type security_t;
|
|
attribute can_load_policy;
|
|
class dir { read search getattr };
|
|
class file { getattr read write };
|
|
class security load_policy;
|
|
')
|
|
|
|
allow $1 security_t:dir { read search getattr };
|
|
allow $1 security_t:file { getattr read write };
|
|
allow $1 security_t:security load_policy;
|
|
auditallow $1 security_t:security load_policy;
|
|
typeattribute $1 can_load_policy;
|
|
')
|
|
|
|
########################################
|
|
## <desc>
|
|
## Allow caller to set the state of Booleans to
|
|
## enable or disable conditional portions of the policy.
|
|
## </desc>
|
|
## <param name="domain">
|
|
## The process type allowed to set the Boolean.
|
|
## </param>
|
|
## <param name="booltype" optional="true">
|
|
## The type of Booleans the caller is allowed to set.
|
|
## </param>
|
|
#
|
|
interface(`selinux_set_boolean',`
|
|
gen_require(`
|
|
type security_t;
|
|
class dir { read search getattr };
|
|
class file { getattr read write };
|
|
class security setbool;
|
|
')
|
|
|
|
ifelse(`$2',`',`
|
|
allow $1 security_t:dir { getattr search read };
|
|
allow $1 security_t:file { getattr read write };
|
|
',`
|
|
allow $1 $2:dir { getattr search read };
|
|
allow $1 $2:file { getattr read write };
|
|
')
|
|
|
|
allow $1 security_t:dir search;
|
|
allow $1 security_t:security setbool;
|
|
auditallow $1 security_t:security setbool;
|
|
')
|
|
|
|
########################################
|
|
## <desc>
|
|
## Allow caller to set selinux security parameters.
|
|
## </desc>
|
|
## <param name="domain">
|
|
## The process type to allow to set security parameters.
|
|
## </param>
|
|
#
|
|
interface(`selinux_set_parameters',`
|
|
gen_require(`
|
|
type security_t;
|
|
attribute can_setsecparam;
|
|
class dir { read search getattr };
|
|
class file { getattr read write };
|
|
class security setsecparam;
|
|
')
|
|
|
|
allow $1 security_t:dir { read search getattr };
|
|
allow $1 security_t:file { getattr read write };
|
|
allow $1 security_t:security setsecparam;
|
|
auditallow $1 security_t:security setsecparam;
|
|
typeattribute $1 can_setsecparam;
|
|
')
|
|
|
|
########################################
|
|
## <desc>
|
|
## Allows caller to validate security contexts.
|
|
## </desc>
|
|
## <param name="domain">
|
|
## The process type permitted to validate contexts.
|
|
## </param>
|
|
#
|
|
interface(`selinux_validate_context',`
|
|
gen_require(`
|
|
type security_t;
|
|
class dir { read search getattr };
|
|
class file { getattr read write };
|
|
class security check_context;
|
|
')
|
|
|
|
allow $1 security_t:dir { read search getattr };
|
|
allow $1 security_t:file { getattr read write };
|
|
allow $1 security_t:security check_context;
|
|
')
|
|
|
|
########################################
|
|
## <desc>
|
|
## Allows caller to compute an access vector.
|
|
## </desc>
|
|
## <param name="domain">
|
|
## The process type allowed to compute an access vector.
|
|
## </param>
|
|
#
|
|
interface(`selinux_compute_access_vector',`
|
|
gen_require(`
|
|
type security_t;
|
|
class dir { read search getattr };
|
|
class file { getattr read write };
|
|
class security compute_av;
|
|
')
|
|
|
|
allow $1 security_t:dir { read search getattr };
|
|
allow $1 security_t:file { getattr read write };
|
|
allow $1 security_t:security compute_av;
|
|
')
|
|
|
|
########################################
|
|
## <desc>
|
|
##
|
|
## </desc>
|
|
## <param name="domain">
|
|
##
|
|
## </param>
|
|
#
|
|
interface(`selinux_compute_create_context',`
|
|
gen_require(`
|
|
type security_t;
|
|
class dir { read search getattr };
|
|
class file { getattr read write };
|
|
class security compute_create;
|
|
')
|
|
|
|
allow $1 security_t:dir { read search getattr };
|
|
allow $1 security_t:file { getattr read write };
|
|
allow $1 security_t:security compute_create;
|
|
')
|
|
|
|
########################################
|
|
## <desc>
|
|
##
|
|
## </desc>
|
|
## <param name="domain">
|
|
## The process type to
|
|
## </param>
|
|
#
|
|
interface(`selinux_compute_relabel_context',`
|
|
gen_require(`
|
|
type security_t;
|
|
class dir { read search getattr };
|
|
class file { getattr read write };
|
|
class security compute_relabel;
|
|
')
|
|
|
|
allow $1 security_t:dir { read search getattr };
|
|
allow $1 security_t:file { getattr read write };
|
|
allow $1 security_t:security compute_relabel;
|
|
')
|
|
|
|
########################################
|
|
## <desc>
|
|
## Allows caller to compute possible contexts for a user.
|
|
## </desc>
|
|
## <param name="domain">
|
|
## The process type allowed to compute user contexts.
|
|
## </param>
|
|
#
|
|
interface(`selinux_compute_user_contexts',`
|
|
gen_require(`
|
|
type security_t;
|
|
class dir { read search getattr };
|
|
class file { getattr read write };
|
|
class security compute_user;
|
|
')
|
|
|
|
allow $1 security_t:dir { read search getattr };
|
|
allow $1 security_t:file { getattr read write };
|
|
allow $1 security_t:security compute_user;
|
|
')
|
|
|
|
########################################
|
|
## <desc>
|
|
## Unconfined access to the SELinux security server.
|
|
## </desc>
|
|
## <param name="domain">
|
|
## Domain allowed access.
|
|
## </param>
|
|
#
|
|
interface(`selinux_unconfined',`
|
|
gen_require(`
|
|
attribute can_load_policy, can_setenforce, can_setsecparam;
|
|
type security_t;
|
|
class security { load_policy setenforce setbool };
|
|
')
|
|
|
|
# Access the security API.
|
|
allow $1 security_t:security *;
|
|
auditallow $1 security_t:security { load_policy setenforce setbool };
|
|
|
|
typeattribute $1 can_load_policy, can_setenforce, can_setsecparam;
|
|
')
|