Changeset 2682

Timestamp:

05/13/08 09:07:42 (7 months ago)

Author:

pebenito

Message:

rbacsep: more collapsing in apps.

Files:

• branches/rbacsep/policy/modules/apps/games.te (modified) (2 diffs)
• branches/rbacsep/policy/modules/apps/vmware.te (modified) (6 diffs)

branches/rbacsep/policy/modules/apps/games.te

@@ -10 +10 @@
-files_type(games_data_t)
-
-# games_t is for system operation of games, generic games daemons and
-# games recovery scripts
-type games_t;
-type games_exec_t;
-init_system_domain(games_t,
+application_domain(games_t, 
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-########################################
@@ -24 +87 @@
-#
-
-
-
+
+
+
-
-games_data_t,
-games_data_t,
+ games_data_t, 
+ games_data_t, 
-
-
-files_pid_filetrans(games_t,games_var_run_t,file
+
+term_create_pty(games_t, games_devpts_t
-
-
+
+
+
-
-
-
-
+
+
+
+
+
-
-dev_read_sysfs(games
+can_exec(games_t, games_exec
-
-
-
+
+
+
-
-term_dontaudit_use_consol
+kernel_read_system_stat
-
-domain_use_interactive_fds
+corecmd_exec_bin
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
-
+dev_read_sound(games_t)
+dev_write_sound(games_t)
+dev_read_input(games_t)
+dev_read_mouse(games_t)
+dev_read_urand(games_t)
+
+files_list_var(games_t)
+files_search_var_lib(games_t)
+files_dontaudit_search_var(games_t)
+files_read_etc_files(games_t)
+files_read_usr_files(games_t)
+files_read_var_files(games_t)
+
+init_dontaudit_rw_utmp(games_t)
+
+logging_dontaudit_search_logs(games_t)
+
+libs_use_shared_libs(games_t)
-libs_use_ld_so(games_t)
-libs_use_shared_libs(games_t)
-
-
-
+
-miscfiles_read_localization(games_t)
-
-userdom_dontaudit_use_unpriv_user_fds
+sysnet_read_config
-
-
+
+
+
+
+
+
-
-optional_policy(
-seutil_sigchld_newrole(games_t)
+tunable_policy(`allow_execmem',
+allow games_t self:process execmem;
-')
-
-optional_policy(`
-udev_read_db
+nscd_socket_use
-')
+
+optional_policy(`
+        xserver_user_x_domain_template($1,games,games_t, games_tmpfs_t)
+        xserver_create_xdm_tmp_sockets(games_t)
+        xserver_read_xdm_lib_files(games_t)
+')

branches/rbacsep/policy/modules/apps/vmware.te

@@ -8 +8 @@
-
-# VMWare user program
+type vmware_t;
-type vmware_exec_t;
-
+
+
+
+
+
+
+
-
-# VMWare host programs
-type vmware_host_t;
-type vmware_host_exec_t;
-
+
+
+
+
+
+
+
-
-# Systemwide configuration files
@@ -20 +33 @@
-files_type(vmware_sys_conf_t)
-
-
-
+
+
+
+
+
-
-########################################
@@ -36 +52 @@
-
-# cjp: the ro and rw files should be split up
-vmware_sys_conf_t,
-
-vmware_var_run_t,
-vmware_var_run_t,
-vmware_var_run_t,
+ vmware_sys_conf_t, 
+
+ vmware_var_run_t, 
+ vmware_var_run_t, 
+ vmware_var_run_t, 
-
-kernel_read_kernel_sysctls(vmware_host_t)
@@ -91 +107 @@
-sysadm_dontaudit_search_home_dirs(vmware_host_t)
-
+netutils_domtrans_ping(vmware_host_t)
+
-optional_policy(`
-        seutil_sigchld_newrole(vmware_host_t)
@@ -99 +117 @@
-        udev_read_db(vmware_host_t)
-')
-netutils_domtrans_ping(vmware_host_t)
-
-ifdef(`TODO',`
@@ -112 +129 @@
-allow kernel_t self:socket create;
-')
+
+##############################
+#
+# VMWare guest local policy
+#
+
+allow vmware_t self:capability { dac_override setgid sys_nice sys_resource setuid sys_admin sys_rawio chown };
+dontaudit vmware_t self:capability sys_tty_config;
+allow vmware_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
+allow vmware_t self:process { execmem execstack };
+allow vmware_t self:fd use;
+allow vmware_t self:fifo_file rw_fifo_file_perms;
+allow vmware_t self:unix_dgram_socket { create_socket_perms sendto };
+allow vmware_t self:unix_stream_socket { create_stream_socket_perms connectto };
+allow vmware_t self:shm create_shm_perms;
+allow vmware_t self:sem create_sem_perms;
+allow vmware_t self:msgq create_msgq_perms;
+allow vmware_t self:msg { send receive };
+
+can_exec(vmware_t, vmware_exec_t)
+
+# User configuration files
+allow vmware_t vmware_conf_t:file manage_file_perms;
+
+# VMWare disks
+manage_files_pattern(vmware_t, vmware_file_t, vmware_file_t)
+manage_lnk_files_pattern(vmware_t, vmware_file_t, vmware_file_t)
+
+allow vmware_t vmware_tmp_t:file execute;
+manage_dirs_pattern(vmware_t, vmware_tmp_t, vmware_tmp_t)
+manage_files_pattern(vmware_t, vmware_tmp_t, vmware_tmp_t)
+manage_sock_files_pattern(vmware_t, vmware_tmp_t, vmware_tmp_t)
+files_tmp_filetrans(vmware_t, vmware_tmp_t, { file dir })
+
+manage_files_pattern(vmware_t, vmware_tmpfs_t, vmware_tmpfs_t)
+manage_lnk_files_pattern(vmware_t, vmware_tmpfs_t, vmware_tmpfs_t)
+manage_fifo_files_pattern(vmware_t, vmware_tmpfs_t, vmware_tmpfs_t)
+manage_sock_files_pattern(vmware_t, vmware_tmpfs_t, vmware_tmpfs_t)
+fs_tmpfs_filetrans(vmware_t, vmware_tmpfs_t, { dir file lnk_file sock_file fifo_file })
+
+# Read clobal configuration files
+allow vmware_t vmware_sys_conf_t:dir list_dir_perms;
+read_files_pattern(vmware_t, vmware_sys_conf_t, vmware_sys_conf_t)
+read_lnk_files_pattern(vmware_t, vmware_sys_conf_t, vmware_sys_conf_t)
+
+manage_dirs_pattern(vmware_t, vmware_pid_t, vmware_pid_t)
+manage_files_pattern(vmware_t, vmware_pid_t, vmware_pid_t)
+manage_lnk_files_pattern(vmware_t, vmware_pid_t, vmware_pid_t)
+manage_sock_files_pattern(vmware_t, vmware_pid_t, vmware_pid_t)
+files_pid_filetrans(vmware_t, vmware_pid_t, { dir file lnk_file })
+
+domtrans_pattern($2, vmware_exec_t, vmware_t)
+
+kernel_read_system_state(vmware_t)
+kernel_read_network_state(vmware_t)
+kernel_read_kernel_sysctls(vmware_t)
+
+# startup scripts
+corecmd_exec_bin(vmware_t)
+corecmd_exec_shell(vmware_t)
+
+dev_read_raw_memory(vmware_t)
+dev_write_raw_memory(vmware_t)
+dev_read_mouse(vmware_t)
+dev_write_sound(vmware_t)
+dev_read_realtime_clock(vmware_t)
+dev_rwx_vmware(vmware_t)
+dev_rw_usbfs(vmware_t)
+dev_search_sysfs(vmware_t)
+
+domain_use_interactive_fds(vmware_t)
+
+files_read_etc_files(vmware_t)
+files_read_etc_runtime_files(vmware_t)
+files_read_usr_files(vmware_t)
+files_list_home(vmware_t)
+
+fs_getattr_xattr_fs(vmware_t)
+fs_search_auto_mountpoints(vmware_t)
+
+storage_raw_read_removable_device(vmware_t)
+storage_raw_write_removable_device(vmware_t)
+
+libs_use_ld_so(vmware_t)
+libs_use_shared_libs(vmware_t)
+# startup scripts run ldd
+libs_exec_ld_so(vmware_t)
+# Access X11 config files
+libs_read_lib_files(vmware_t)
+
+miscfiles_read_localization(vmware_t)
+
+userdom_use_user_terminals($1,vmware_t)
+userdom_use_unpriv_users_fds(vmware_t)
+userdom_list_user_home_dirs($1,vmware_t)
+# cjp: why?
+userdom_read_user_home_content_files($1,vmware_t)
+
+sysnet_dns_name_resolve(vmware_t)
+sysnet_read_config(vmware_t)
+
+xserver_user_x_domain_template($1,vmware,vmware_t, vmware_tmpfs_t)