223 lines
5.3 KiB
Plaintext
223 lines
5.3 KiB
Plaintext
|
|
policy_module(modutils,1.0)
|
|
|
|
########################################
|
|
#
|
|
# Declarations
|
|
#
|
|
|
|
# module loading config
|
|
type modules_conf_t;
|
|
files_type(modules_conf_t)
|
|
|
|
# module dependencies
|
|
type modules_dep_t;
|
|
files_type(modules_dep_t)
|
|
|
|
type insmod_t;
|
|
type insmod_exec_t;
|
|
kernel_userland_entry(insmod_t,insmod_exec_t)
|
|
init_system_domain(insmod_t,insmod_exec_t)
|
|
role system_r types insmod_t;
|
|
|
|
type depmod_t;
|
|
type depmod_exec_t;
|
|
init_system_domain(depmod_t,depmod_exec_t)
|
|
role system_r types depmod_t;
|
|
|
|
type update_modules_t;
|
|
type update_modules_exec_t;
|
|
init_system_domain(update_modules_t,update_modules_exec_t)
|
|
role system_r types update_modules_t;
|
|
|
|
type update_modules_tmp_t;
|
|
files_tmp_file(update_modules_tmp_t)
|
|
|
|
########################################
|
|
#
|
|
# insmod local policy
|
|
#
|
|
|
|
allow insmod_t self:capability { dac_override net_raw sys_tty_config };
|
|
allow insmod_t self:process { execmem sigchld sigkill sigstop signull signal };
|
|
|
|
allow insmod_t self:udp_socket create_socket_perms;
|
|
allow insmod_t self:rawip_socket create_socket_perms;
|
|
|
|
# Read module config and dependency information
|
|
allow insmod_t { modules_conf_t modules_dep_t }:file r_file_perms;
|
|
|
|
can_exec(insmod_t, insmod_exec_t)
|
|
|
|
kernel_load_module(insmod_t)
|
|
kernel_read_system_state(insmod_t)
|
|
# Rules for /proc/sys/kernel/tainted
|
|
kernel_read_kernel_sysctl(insmod_t)
|
|
kernel_rw_kernel_sysctl(insmod_t)
|
|
kernel_read_hotplug_sysctl(insmod_t)
|
|
|
|
bootloader_read_kernel_modules(insmod_t)
|
|
# for locking: (cjp: ????)
|
|
bootloader_write_kernel_modules(insmod_t)
|
|
|
|
dev_search_sysfs(insmod_t)
|
|
dev_search_usbfs(insmod_t)
|
|
dev_write_mtrr(insmod_t)
|
|
dev_read_urand(insmod_t)
|
|
dev_rw_agp_dev(insmod_t)
|
|
dev_read_snd_dev(insmod_t)
|
|
dev_write_snd_dev(insmod_t)
|
|
|
|
fs_getattr_xattr_fs(insmod_t)
|
|
|
|
corecmd_exec_bin(insmod_t)
|
|
corecmd_exec_sbin(insmod_t)
|
|
corecmd_exec_shell(insmod_t)
|
|
|
|
domain_signal_all_domains(insmod_t)
|
|
domain_use_wide_inherit_fd(insmod_t)
|
|
|
|
files_read_etc_runtime_files(insmod_t)
|
|
files_read_etc_files(insmod_t)
|
|
files_read_usr_files(insmod_t)
|
|
files_exec_etc_files(insmod_t)
|
|
# for nscd:
|
|
files_dontaudit_search_pids(insmod_t)
|
|
# for when /var is not mounted early in the boot:
|
|
files_dontaudit_search_isid_type_dir(insmod_t)
|
|
|
|
init_use_initctl(insmod_t)
|
|
init_use_fd(insmod_t)
|
|
init_use_script_fd(insmod_t)
|
|
init_use_script_pty(insmod_t)
|
|
|
|
libs_use_ld_so(insmod_t)
|
|
libs_use_shared_libs(insmod_t)
|
|
|
|
logging_send_syslog_msg(insmod_t)
|
|
logging_search_logs(insmod_t)
|
|
|
|
miscfiles_read_localization(insmod_t)
|
|
|
|
optional_policy(`mount.te',`
|
|
mount_domtrans(insmod_t)
|
|
')
|
|
|
|
ifdef(`TODO',`
|
|
|
|
allow insmod_t apm_bios_t:chr_file { read write };
|
|
|
|
ifdef(`xserver.te', `
|
|
allow insmod_t xserver_log_t:file getattr;
|
|
')
|
|
|
|
# why is this needed? insmod cannot mounton any dir
|
|
# and it also transitions to mount
|
|
allow insmod_t usbfs_t:filesystem mount;
|
|
') dnl if TODO
|
|
|
|
########################################
|
|
#
|
|
# depmod local policy
|
|
#
|
|
|
|
can_exec(depmod_t, depmod_exec_t)
|
|
|
|
# Read conf.modules.
|
|
allow depmod_t modules_conf_t:file r_file_perms;
|
|
|
|
allow depmod_t modules_dep_t:file create_file_perms;
|
|
bootloader_create_modules(depmod_t,modules_dep_t)
|
|
|
|
kernel_read_system_state(depmod_t)
|
|
|
|
bootloader_read_kernel_symbol_table(depmod_t)
|
|
bootloader_read_kernel_modules(depmod_t)
|
|
|
|
fs_getattr_xattr_fs(depmod_t)
|
|
|
|
term_use_console(depmod_t)
|
|
|
|
corecmd_search_bin(depmod_t)
|
|
corecmd_search_sbin(depmod_t)
|
|
|
|
domain_use_wide_inherit_fd(depmod_t)
|
|
|
|
init_use_fd(depmod_t)
|
|
init_use_script_fd(depmod_t)
|
|
init_use_script_pty(depmod_t)
|
|
|
|
files_read_etc_runtime_files(depmod_t)
|
|
files_read_etc_files(depmod_t)
|
|
files_read_usr_src_files(depmod_t)
|
|
|
|
libs_use_ld_so(depmod_t)
|
|
libs_use_shared_libs(depmod_t)
|
|
|
|
ifdef(`TODO',`
|
|
|
|
ifdef(`gnome-pty-helper.te', `allow depmod_t sysadm_gph_t:fd use;')
|
|
|
|
# Read System.map from home directories.
|
|
allow depmod_t { home_root_t staff_home_dir_t sysadm_home_dir_t }:dir r_dir_perms;
|
|
r_dir_file(depmod_t, { staff_home_t sysadm_home_t })
|
|
') dnl end ifdef TODO
|
|
|
|
#################################
|
|
#
|
|
# update-modules local policy
|
|
#
|
|
|
|
allow update_modules_t self:fifo_file rw_file_perms;
|
|
|
|
allow update_modules_t modules_dep_t:file rw_file_perms;
|
|
|
|
can_exec(update_modules_t, insmod_exec_t)
|
|
can_exec(update_modules_t, update_modules_exec_t)
|
|
|
|
# manage module loading configuration
|
|
allow update_modules_t modules_conf_t:file create_file_perms;
|
|
bootloader_create_modules(update_modules_t,modules_conf_t)
|
|
files_create_etc_config(update_modules_t,modules_conf_t)
|
|
|
|
# transition to depmod
|
|
domain_auto_trans(update_modules_t, depmod_exec_t, depmod_t)
|
|
|
|
allow update_modules_t update_modules_tmp_t:dir create_dir_perms;
|
|
allow update_modules_t update_modules_tmp_t:file create_file_perms;
|
|
files_create_tmp_files(update_modules_t, update_modules_tmp_t, { file dir })
|
|
|
|
kernel_read_kernel_sysctl(update_modules_t)
|
|
kernel_read_system_state(update_modules_t)
|
|
|
|
dev_read_urand(update_modules_t)
|
|
|
|
fs_getattr_xattr_fs(update_modules_t)
|
|
|
|
term_use_console(update_modules_t)
|
|
|
|
init_use_fd(depmod_t)
|
|
init_use_script_fd(depmod_t)
|
|
init_use_script_pty(depmod_t)
|
|
|
|
domain_use_wide_inherit_fd(depmod_t)
|
|
|
|
files_read_etc_runtime_files(update_modules_t)
|
|
files_read_etc_files(update_modules_t)
|
|
files_exec_etc_files(update_modules_t)
|
|
|
|
corecmd_exec_bin(update_modules_t)
|
|
corecmd_exec_sbin(update_modules_t)
|
|
corecmd_exec_shell(update_modules_t)
|
|
|
|
libs_use_ld_so(update_modules_t)
|
|
libs_use_shared_libs(update_modules_t)
|
|
|
|
logging_send_syslog_msg(update_modules_t)
|
|
|
|
miscfiles_read_localization(update_modules_t)
|
|
|
|
ifdef(`TODO',`
|
|
dontaudit update_modules_t sysadm_home_dir_t:dir search;
|
|
') dnl endif TODO
|