Changeset 2680

Timestamp:

05/12/08 10:56:59 (7 months ago)

Author:

pebenito

Message:

rbacsep: basic copy and paste collapsing of most apps modules. does not build.

Files:

• branches/rbacsep/policy/modules/apps/cdrecord.te (modified) (1 diff)
• branches/rbacsep/policy/modules/apps/ethereal.te (modified) (1 diff)
• branches/rbacsep/policy/modules/apps/evolution.te (modified) (1 diff)
• branches/rbacsep/policy/modules/apps/gift.te (modified) (1 diff)
• branches/rbacsep/policy/modules/apps/gnome.te (modified) (1 diff)
• branches/rbacsep/policy/modules/apps/gpg.te (modified) (1 diff)
• branches/rbacsep/policy/modules/apps/irc.te (modified) (1 diff)
• branches/rbacsep/policy/modules/apps/lockdev.te (modified) (1 diff)
• branches/rbacsep/policy/modules/apps/mozilla.te (modified) (1 diff)
• branches/rbacsep/policy/modules/apps/rssh.te (modified) (1 diff)
• branches/rbacsep/policy/modules/apps/screen.te (modified) (1 diff)
• branches/rbacsep/policy/modules/apps/thunderbird.te (modified) (1 diff)
• branches/rbacsep/policy/modules/apps/tvtime.te (modified) (1 diff)
• branches/rbacsep/policy/modules/apps/uml.te (modified) (2 diffs)
• branches/rbacsep/policy/modules/apps/userhelper.te (modified) (1 diff)
• branches/rbacsep/policy/modules/apps/wireshark.te (modified) (1 diff)

branches/rbacsep/policy/modules/apps/cdrecord.te

@@ -16 +16 @@
-gen_tunable(cdrecord_read_content,false)
-
+type cdrecord_t;
+application_domain(cdrecord_t, cdrecord_exec_t)
+
-type cdrecord_exec_t;
-application_executable_file(cdrecord_exec_t)
+
+########################################
+#
+# Local policy
+#
+
+allow cdrecord_t self:capability { ipc_lock sys_nice setuid dac_override sys_rawio };
+allow cdrecord_t self:process { getsched setsched sigkill };
+allow cdrecord_t self:unix_dgram_socket create_socket_perms;
+allow cdrecord_t self:unix_stream_socket create_stream_socket_perms;
+
+allow cdrecord_t $2:unix_stream_socket { getattr read write ioctl };
+
+# allow ps to show cdrecord and allow the user to kill it 
+ps_process_pattern($2, cdrecord_t)
+allow $2 cdrecord_t:process signal;
+
+# Transition from the user domain to the derived domain.
+domtrans_pattern($2, cdrecord_exec_t, cdrecord_t)
+
+# allow searching for cdrom-drive
+dev_list_all_dev_nodes(cdrecord_t) 
+
+domain_interactive_fd(cdrecord_t)
+domain_use_interactive_fds(cdrecord_t)
+
+files_read_etc_files(cdrecord_t)
+
+term_use_controlling_term(cdrecord_t)
+term_list_ptys(cdrecord_t)
+
+# allow cdrecord to write the CD
+storage_raw_write_removable_device(cdrecord_t)
+storage_write_scsi_generic(cdrecord_t)
+
+libs_use_ld_so(cdrecord_t)
+libs_use_shared_libs(cdrecord_t)
+
+logging_send_syslog_msg(cdrecord_t)
+
+miscfiles_read_localization(cdrecord_t)
+
+# write to the user domain tty.
+userdom_use_user_terminals($1, cdrecord_t)
+userdom_use_user_terminals($1, $2)
+
+userdom_read_user_home_content_files($1, cdrecord_t)
+
+# Handle nfs home dirs
+tunable_policy(`cdrecord_read_content && use_nfs_home_dirs',`
+        fs_list_auto_mountpoints(cdrecord_t)
+        files_list_home(cdrecord_t)
+        fs_read_nfs_files(cdrecord_t)
+        fs_read_nfs_symlinks(cdrecord_t)
+
+',`
+        files_dontaudit_list_home(cdrecord_t)
+        fs_dontaudit_list_auto_mountpoints(cdrecord_t)
+        fs_dontaudit_read_nfs_files(cdrecord_t)
+        fs_dontaudit_list_nfs(cdrecord_t)
+')
+# Handle samba home dirs
+tunable_policy(`cdrecord_read_content && use_samba_home_dirs',`
+        fs_list_auto_mountpoints(cdrecord_t)
+        files_list_home(cdrecord_t)
+        fs_read_cifs_files(cdrecord_t)
+        fs_read_cifs_symlinks(cdrecord_t)
+',`
+        files_dontaudit_list_home(cdrecord_t)
+        fs_dontaudit_list_auto_mountpoints(cdrecord_t)
+        fs_dontaudit_read_cifs_files(cdrecord_t)
+        fs_dontaudit_list_cifs(cdrecord_t)
+')
+
+# Handle removable media, /tmp, and /home
+tunable_policy(`cdrecord_read_content',`
+        userdom_list_user_tmp($1, cdrecord_t)
+        userdom_read_user_tmp_files($1, drecord_t)
+        userdom_read_user_tmp_symlinks($1, cdrecord_t)
+        userdom_search_user_home_dirs($1, cdrecord_t)
+        userdom_read_user_home_content_files($1, cdrecord_t)
+        userdom_read_user_home_content_symlinks($1, cdrecord_t)
+        
+        ifdef(`enable_mls',`
+        ',`
+                fs_search_removable(cdrecord_t)
+                fs_read_removable_files(cdrecord_t)
+                fs_read_removable_symlinks(cdrecord_t)
+        ')
+',`
+        files_dontaudit_list_tmp(cdrecord_t)
+        files_dontaudit_list_home(cdrecord_t)
+        fs_dontaudit_list_removable(cdrecord_t)
+        fs_dontaudit_read_removable_files(cdrecord_t)
+        userdom_dontaudit_list_user_tmp($1, cdrecord_t)
+        userdom_dontaudit_read_user_tmp_files($1, cdrecord_t)
+        userdom_dontaudit_list_user_home_dirs($1, cdrecord_t)
+        userdom_dontaudit_read_user_home_content_files($1, cdrecord_t)
+')
+
+# Handle default_t content
+tunable_policy(`cdrecord_read_content && read_default_t',`
+        files_list_default(cdrecord_t)
+        files_read_default_files(cdrecord_t)
+        files_read_default_symlinks(cdrecord_t)
+',`
+        files_dontaudit_read_default_files(cdrecord_t)
+        files_dontaudit_list_default(cdrecord_t)
+')
+
+# Handle untrusted content
+tunable_policy(`cdrecord_read_content && read_untrusted_content',`
+        files_list_tmp(cdrecord_t)
+        files_list_home(cdrecord_t)
+        userdom_search_user_home_dirs($1, cdrecord_t)
+
+        userdom_list_user_untrusted_content($1, cdrecord_t)
+        userdom_read_user_untrusted_content_files($1, cdrecord_t)
+        userdom_read_user_untrusted_content_symlinks($1, cdrecord_t)
+        userdom_list_user_tmp_untrusted_content($1, cdrecord_t)
+        userdom_read_user_tmp_untrusted_content_files($1, cdrecord_t)
+        userdom_read_user_tmp_untrusted_content_symlinks($1, cdrecord_t)
+',`
+        files_dontaudit_list_tmp(cdrecord_t)
+        files_dontaudit_list_home(cdrecord_t)
+        userdom_dontaudit_list_user_home_dirs($1, cdrecord_t)
+        userdom_dontaudit_list_user_untrusted_content($1, cdrecord_t)
+        userdom_dontaudit_read_user_untrusted_content_files($1, cdrecord_t)
+        userdom_dontaudit_list_user_tmp_untrusted_content($1, cdrecord_t)
+        userdom_dontaudit_read_user_tmp_untrusted_content_files($1, cdrecord_t)
+')
+
+tunable_policy(`use_nfs_home_dirs',`
+        files_search_mnt(cdrecord_t)
+        fs_read_nfs_files(cdrecord_t)
+        fs_read_nfs_symlinks(cdrecord_t)
+')
+
+optional_policy(`
+        resmgr_stream_connect(cdrecord_t)
+')

branches/rbacsep/policy/modules/apps/ethereal.te

@@ -7 +7 @@
-#
-
+type ethereal_t;
-type ethereal_exec_t;
-
+
+
+
+
+
+
+
+
+
+
+
-
-type tethereal_t;
-type tethereal_exec_t;
-
+ 
-
-type tethereal_tmp_t;
-files_tmp_file(tethereal_tmp_t)
+
+##############################
+#
+# Local Policy
+#
+
+allow ethereal_t self:capability { net_admin net_raw setgid };
+allow ethereal_t self:process { signal getsched };
+allow ethereal_t self:fifo_file { getattr read write };
+allow ethereal_t self:shm destroy;
+allow ethereal_t self:shm create_shm_perms;
+allow ethereal_t self:netlink_route_socket { nlmsg_read create_socket_perms };
+allow ethereal_t self:packet_socket { setopt bind ioctl getopt create read };
+allow ethereal_t self:tcp_socket create_socket_perms;
+allow ethereal_t self:udp_socket create_socket_perms;
+
+# Re-execute itself (why?)
+can_exec(ethereal_t, ethereal_exec_t)
+corecmd_search_bin(ethereal_t)
+
+# /home/.ethereal
+manage_dirs_pattern(ethereal_t, ethereal_home_t, ethereal_home_t)
+manage_files_pattern(ethereal_t, ethereal_home_t, ethereal_home_t)
+manage_lnk_files_pattern(ethereal_t, ethereal_home_t, ethereal_home_t)
+userdom_user_home_dir_filetrans($1, ethereal_t, ethereal_home_t, dir)
+
+# Store temporary files
+manage_dirs_pattern(ethereal_t, ethereal_tmp_t, ethereal_tmp_t)
+manage_files_pattern(ethereal_t, ethereal_tmp_t, ethereal_tmp_t)
+files_tmp_filetrans(ethereal_t, ethereal_tmp_t, { dir file })
+
+manage_dirs_pattern(ethereal_t, ethereal_tmpfs_t, ethereal_tmpfs_t)
+manage_files_pattern(ethereal_t, ethereal_tmpfs_t, ethereal_tmpfs_t)
+manage_lnk_files_pattern(ethereal_t, ethereal_tmpfs_t, ethereal_tmpfs_t)
+manage_sock_files_pattern(ethereal_t, ethereal_tmpfs_t, ethereal_tmpfs_t)
+manage_fifo_files_pattern(ethereal_t, ethereal_tmpfs_t, ethereal_tmpfs_t)
+fs_tmpfs_filetrans(ethereal_t, ethereal_tmpfs_t, { dir file lnk_file sock_file fifo_file })
+
+domain_auto_trans($2, ethereal_exec_t, ethereal_t)
+allow ethereal_t $2:fd use;
+allow ethereal_t $2:process sigchld;
+
+manage_dirs_pattern($2, ethereal_home_t, ethereal_home_t)
+manage_files_pattern($2, ethereal_home_t, ethereal_home_t)
+manage_lnk_files_pattern($2, ethereal_home_t, ethereal_home_t)
+relabel_dirs_pattern($2, ethereal_home_t, ethereal_home_t)
+relabel_files_pattern($2, ethereal_home_t, ethereal_home_t)
+relabel_lnk_files_pattern($2, ethereal_home_t, ethereal_home_t)
+
+kernel_read_kernel_sysctls(ethereal_t)
+kernel_read_system_state(ethereal_t)
+kernel_read_sysctl(ethereal_t)
+
+corecmd_search_bin(ethereal_t)
+
+corenet_tcp_connect_generic_port(ethereal_t)
+corenet_tcp_sendrecv_generic_if(ethereal_t)
+
+dev_read_urand(ethereal_t)
+
+files_read_etc_files(ethereal_t)
+files_read_usr_files(ethereal_t)
+
+fs_list_inotifyfs(ethereal_t)
+fs_search_auto_mountpoints(ethereal_t)
+
+libs_read_lib_files(ethereal_t)
+libs_use_ld_so(ethereal_t)
+libs_use_shared_libs(ethereal_t)
+
+miscfiles_read_fonts(ethereal_t)
+miscfiles_read_localization(ethereal_t)
+
+seutil_use_newrole_fds(ethereal_t)
+
+sysnet_read_config(ethereal_t)
+
+userdom_manage_user_home_content_files($1, ethereal_t)
+
+tunable_policy(`use_nfs_home_dirs',`
+        fs_manage_nfs_dirs(ethereal_t)
+        fs_manage_nfs_files(ethereal_t)
+        fs_manage_nfs_symlinks(ethereal_t)
+')
+
+tunable_policy(`use_samba_home_dirs',`
+        fs_manage_cifs_dirs(ethereal_t)
+        fs_manage_cifs_files(ethereal_t)
+        fs_manage_cifs_symlinks(ethereal_t)
+')
+
+optional_policy(`
+        nscd_socket_use(ethereal_t)
+')
+
+# Manual transition from userhelper 
+optional_policy(`
+        userhelper_use_user_fd($1, ethereal_t)
+        userhelper_sigchld_user($1, ethereal_t)
+')
+
+optional_policy(`
+        xserver_user_x_domain_template($1, ethereal, ethereal_t, ethereal_tmpfs_t)
+        xserver_create_xdm_tmp_sockets(ethereal_t)
+')
-
-########################################

branches/rbacsep/policy/modules/apps/evolution.te

@@ -7 +7 @@
-#
-
+type evolution_t;
-type evolution_exec_t;
-
-
+
+
+
-type evolution_alarm_exec_t;
-
-
+
+
+
+
+
+
+
+
+
-type evolution_exchange_exec_t;
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-type evolution_server_exec_t;
-
-
+
+
+
+
+
+
+
+
+
-type evolution_webcal_exec_t;
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+

branches/rbacsep/policy/modules/apps/gift.te

@@ -7 +7 @@
-#
-
+type gift_t;
-type gift_exec_t;
-executable_file(
+domain(gift_t, 
-
+type gift_home_t;
+files_poly_member(gift_home_t)
+userdom_user_home_content($1, gift_home_t)
+
+type gift_tmpfs_t;
+files_tmpfs_file(gift_tmpfs_t)
+
+type giftd_t;
-type giftd_exec_t;
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+