1 |
commit: f5a0a7c4574aaa7179d9f693db9d8e07b1afd7c1 |
2 |
Author: Jason Zaman <jason <AT> perfinion <DOT> com> |
3 |
AuthorDate: Sat Jan 12 08:03:44 2019 +0000 |
4 |
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org> |
5 |
CommitDate: Sun Feb 10 04:11:25 2019 +0000 |
6 |
URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=f5a0a7c4 |
7 |
|
8 |
Add chromium policy upstreamed from Gentoo |
9 |
|
10 |
Signed-off-by: Jason Zaman <jason <AT> perfinion.com> |
11 |
|
12 |
policy/modules/apps/chromium.fc | 31 ++++ |
13 |
policy/modules/apps/chromium.if | 139 ++++++++++++++++ |
14 |
policy/modules/apps/chromium.te | 342 ++++++++++++++++++++++++++++++++++++++++ |
15 |
3 files changed, 512 insertions(+) |
16 |
|
17 |
diff --git a/policy/modules/apps/chromium.fc b/policy/modules/apps/chromium.fc |
18 |
new file mode 100644 |
19 |
index 00000000..534235dc |
20 |
--- /dev/null |
21 |
+++ b/policy/modules/apps/chromium.fc |
22 |
@@ -0,0 +1,31 @@ |
23 |
+/opt/google/chrome/chrome -- gen_context(system_u:object_r:chromium_exec_t,s0) |
24 |
+/opt/google/chrome/chrome_sandbox -- gen_context(system_u:object_r:chromium_sandbox_exec_t,s0) |
25 |
+/opt/google/chrome/chrome-sandbox -- gen_context(system_u:object_r:chromium_sandbox_exec_t,s0) |
26 |
+/opt/google/chrome/google-chrome -- gen_context(system_u:object_r:chromium_exec_t,s0) |
27 |
+/opt/google/chrome/nacl_helper_bootstrap -- gen_context(system_u:object_r:chromium_naclhelper_exec_t,s0) |
28 |
+/opt/google/chrome/libudev.so.0 gen_context(system_u:object_r:lib_t,s0) |
29 |
+ |
30 |
+/opt/google/chrome-beta/chrome -- gen_context(system_u:object_r:chromium_exec_t,s0) |
31 |
+/opt/google/chrome-beta/chrome_sandbox -- gen_context(system_u:object_r:chromium_sandbox_exec_t,s0) |
32 |
+/opt/google/chrome-beta/chrome-sandbox -- gen_context(system_u:object_r:chromium_sandbox_exec_t,s0) |
33 |
+/opt/google/chrome-beta/google-chrome -- gen_context(system_u:object_r:chromium_exec_t,s0) |
34 |
+/opt/google/chrome-beta/nacl_helper_bootstrap -- gen_context(system_u:object_r:chromium_naclhelper_exec_t,s0) |
35 |
+/opt/google/chrome-beta/libudev.so.0 gen_context(system_u:object_r:lib_t,s0) |
36 |
+ |
37 |
+/opt/google/chrome-unstable/chrome -- gen_context(system_u:object_r:chromium_exec_t,s0) |
38 |
+/opt/google/chrome-unstable/chrome_sandbox -- gen_context(system_u:object_r:chromium_sandbox_exec_t,s0) |
39 |
+/opt/google/chrome-unstable/chrome-sandbox -- gen_context(system_u:object_r:chromium_sandbox_exec_t,s0) |
40 |
+/opt/google/chrome-unstable/google-chrome -- gen_context(system_u:object_r:chromium_exec_t,s0) |
41 |
+/opt/google/chrome-unstable/nacl_helper_bootstrap -- gen_context(system_u:object_r:chromium_naclhelper_exec_t,s0) |
42 |
+/opt/google/chrome-unstable/libudev.so.0 gen_context(system_u:object_r:lib_t,s0) |
43 |
+ |
44 |
+/usr/lib/chromium-browser/chrome -- gen_context(system_u:object_r:chromium_exec_t,s0) |
45 |
+/usr/lib/chromium-browser/chrome_sandbox -- gen_context(system_u:object_r:chromium_sandbox_exec_t,s0) |
46 |
+/usr/lib/chromium-browser/chrome-sandbox -- gen_context(system_u:object_r:chromium_sandbox_exec_t,s0) |
47 |
+/usr/lib/chromium-browser/chromium-launcher\.sh -- gen_context(system_u:object_r:chromium_exec_t,s0) |
48 |
+/usr/lib/chromium-browser/nacl_helper_bootstrap -- gen_context(system_u:object_r:chromium_naclhelper_exec_t,s0) |
49 |
+ |
50 |
+HOME_DIR/\.cache/chromium(/.*)? gen_context(system_u:object_r:chromium_xdg_cache_t,s0) |
51 |
+HOME_DIR/\.cache/google-chrome(/.*)? gen_context(system_u:object_r:chromium_xdg_cache_t,s0) |
52 |
+HOME_DIR/\.config/chromium(/.*)? gen_context(system_u:object_r:chromium_xdg_config_t,s0) |
53 |
+HOME_DIR/\.config/google-chrome(/.*)? gen_context(system_u:object_r:chromium_xdg_config_t,s0) |
54 |
|
55 |
diff --git a/policy/modules/apps/chromium.if b/policy/modules/apps/chromium.if |
56 |
new file mode 100644 |
57 |
index 00000000..26eb0259 |
58 |
--- /dev/null |
59 |
+++ b/policy/modules/apps/chromium.if |
60 |
@@ -0,0 +1,139 @@ |
61 |
+## <summary> |
62 |
+## Chromium browser |
63 |
+## </summary> |
64 |
+ |
65 |
+####################################### |
66 |
+## <summary> |
67 |
+## Role access for chromium |
68 |
+## </summary> |
69 |
+## <param name="role"> |
70 |
+## <summary> |
71 |
+## Role allowed access |
72 |
+## </summary> |
73 |
+## </param> |
74 |
+## <param name="domain"> |
75 |
+## <summary> |
76 |
+## User domain for the role |
77 |
+## </summary> |
78 |
+## </param> |
79 |
+# |
80 |
+interface(`chromium_role',` |
81 |
+ gen_require(` |
82 |
+ type chromium_t; |
83 |
+ type chromium_renderer_t; |
84 |
+ type chromium_sandbox_t; |
85 |
+ type chromium_naclhelper_t; |
86 |
+ type chromium_exec_t; |
87 |
+ ') |
88 |
+ |
89 |
+ role $1 types chromium_t; |
90 |
+ role $1 types chromium_renderer_t; |
91 |
+ role $1 types chromium_sandbox_t; |
92 |
+ role $1 types chromium_naclhelper_t; |
93 |
+ |
94 |
+ # Transition from the user domain to the derived domain |
95 |
+ chromium_domtrans($2) |
96 |
+ |
97 |
+ # Allow ps to show chromium processes and allow the user to signal it |
98 |
+ ps_process_pattern($2, chromium_t) |
99 |
+ ps_process_pattern($2, chromium_renderer_t) |
100 |
+ |
101 |
+ allow $2 chromium_t:process signal_perms; |
102 |
+ allow $2 chromium_renderer_t:process signal_perms; |
103 |
+ allow $2 chromium_naclhelper_t:process signal_perms; |
104 |
+ |
105 |
+ allow chromium_sandbox_t $2:fd use; |
106 |
+ allow chromium_naclhelper_t $2:fd use; |
107 |
+') |
108 |
+ |
109 |
+####################################### |
110 |
+## <summary> |
111 |
+## Read-write access to Chromiums' temporary fifo files |
112 |
+## </summary> |
113 |
+## <param name="domain"> |
114 |
+## <summary> |
115 |
+## Domain allowed access |
116 |
+## </summary> |
117 |
+## </param> |
118 |
+# |
119 |
+interface(`chromium_rw_tmp_pipes',` |
120 |
+ gen_require(` |
121 |
+ type chromium_tmp_t; |
122 |
+ ') |
123 |
+ |
124 |
+ rw_fifo_files_pattern($1, chromium_tmp_t, chromium_tmp_t) |
125 |
+') |
126 |
+ |
127 |
+############################################## |
128 |
+## <summary> |
129 |
+## Automatically use the specified type for resources created in chromium's |
130 |
+## temporary locations |
131 |
+## </summary> |
132 |
+## <param name="domain"> |
133 |
+## <summary> |
134 |
+## Domain that creates the resource(s) |
135 |
+## </summary> |
136 |
+## </param> |
137 |
+## <param name="class"> |
138 |
+## <summary> |
139 |
+## Type of the resource created |
140 |
+## </summary> |
141 |
+## </param> |
142 |
+## <param name="filename" optional="true"> |
143 |
+## <summary> |
144 |
+## The name of the resource being created |
145 |
+## </summary> |
146 |
+## </param> |
147 |
+# |
148 |
+interface(`chromium_tmp_filetrans',` |
149 |
+ gen_require(` |
150 |
+ type chromium_tmp_t; |
151 |
+ ') |
152 |
+ |
153 |
+ search_dirs_pattern($1, chromium_tmp_t, chromium_tmp_t) |
154 |
+ filetrans_pattern($1, chromium_tmp_t, $2, $3, $4) |
155 |
+') |
156 |
+ |
157 |
+####################################### |
158 |
+## <summary> |
159 |
+## Execute a domain transition to the chromium domain (chromium_t) |
160 |
+## </summary> |
161 |
+## <param name="domain"> |
162 |
+## <summary> |
163 |
+## Domain allowed access |
164 |
+## </summary> |
165 |
+## </param> |
166 |
+# |
167 |
+interface(`chromium_domtrans',` |
168 |
+ gen_require(` |
169 |
+ type chromium_t; |
170 |
+ type chromium_exec_t; |
171 |
+ ') |
172 |
+ |
173 |
+ corecmd_search_bin($1) |
174 |
+ domtrans_pattern($1, chromium_exec_t, chromium_t) |
175 |
+') |
176 |
+ |
177 |
+####################################### |
178 |
+## <summary> |
179 |
+## Execute chromium in the chromium domain and allow the specified role to access the chromium domain |
180 |
+## </summary> |
181 |
+## <param name="domain"> |
182 |
+## <summary> |
183 |
+## Domain allowed access |
184 |
+## </summary> |
185 |
+## </param> |
186 |
+## <param name="role"> |
187 |
+## <summary> |
188 |
+## Role allowed access |
189 |
+## </summary> |
190 |
+## </param> |
191 |
+# |
192 |
+interface(`chromium_run',` |
193 |
+ gen_require(` |
194 |
+ type chromium_t; |
195 |
+ ') |
196 |
+ |
197 |
+ chromium_domtrans($1) |
198 |
+ role $2 types chromium_t; |
199 |
+') |
200 |
|
201 |
diff --git a/policy/modules/apps/chromium.te b/policy/modules/apps/chromium.te |
202 |
new file mode 100644 |
203 |
index 00000000..5219cb87 |
204 |
--- /dev/null |
205 |
+++ b/policy/modules/apps/chromium.te |
206 |
@@ -0,0 +1,342 @@ |
207 |
+policy_module(chromium, 1.0.0) |
208 |
+ |
209 |
+######################################## |
210 |
+# |
211 |
+# Declarations |
212 |
+# |
213 |
+ |
214 |
+## <desc> |
215 |
+## <p> |
216 |
+## Allow chromium to read system information |
217 |
+## </p> |
218 |
+## <p> |
219 |
+## Although not needed for regular browsing, this will allow chromium to update |
220 |
+## its own memory consumption based on system state, support additional |
221 |
+## debugging, detect specific devices, etc. |
222 |
+## </p> |
223 |
+## </desc> |
224 |
+gen_tunable(chromium_read_system_info, false) |
225 |
+ |
226 |
+## <desc> |
227 |
+## <p> |
228 |
+## Allow chromium to bind to tcp ports |
229 |
+## </p> |
230 |
+## <p> |
231 |
+## Although not needed for regular browsing, some chrome extensions need to |
232 |
+## bind to tcp ports and accept connections. |
233 |
+## </p> |
234 |
+## </desc> |
235 |
+gen_tunable(chromium_bind_tcp_unreserved_ports, false) |
236 |
+ |
237 |
+## <desc> |
238 |
+## <p> |
239 |
+## Allow chromium to read/write USB devices |
240 |
+## </p> |
241 |
+## <p> |
242 |
+## Although not needed for regular browsing, used for debugging over usb |
243 |
+## or using FIDO U2F tokens. |
244 |
+## </p> |
245 |
+## </desc> |
246 |
+gen_tunable(chromium_rw_usb_dev, false) |
247 |
+ |
248 |
+type chromium_t; |
249 |
+domain_dyntrans_type(chromium_t) |
250 |
+ |
251 |
+type chromium_exec_t; |
252 |
+application_domain(chromium_t, chromium_exec_t) |
253 |
+ |
254 |
+type chromium_naclhelper_t; |
255 |
+type chromium_naclhelper_exec_t; |
256 |
+application_domain(chromium_naclhelper_t, chromium_naclhelper_exec_t) |
257 |
+ |
258 |
+type chromium_sandbox_t; |
259 |
+type chromium_sandbox_exec_t; |
260 |
+application_domain(chromium_sandbox_t, chromium_sandbox_exec_t) |
261 |
+ |
262 |
+type chromium_renderer_t; |
263 |
+domain_base_type(chromium_renderer_t) |
264 |
+ |
265 |
+type chromium_tmp_t; |
266 |
+userdom_user_tmp_file(chromium_tmp_t) |
267 |
+ |
268 |
+type chromium_tmpfs_t; |
269 |
+userdom_user_tmpfs_file(chromium_tmpfs_t) |
270 |
+optional_policy(` |
271 |
+ pulseaudio_tmpfs_content(chromium_tmpfs_t) |
272 |
+') |
273 |
+ |
274 |
+type chromium_xdg_config_t; |
275 |
+xdg_config_content(chromium_xdg_config_t) |
276 |
+ |
277 |
+type chromium_xdg_cache_t; |
278 |
+xdg_cache_content(chromium_xdg_cache_t) |
279 |
+ |
280 |
+ |
281 |
+ |
282 |
+######################################## |
283 |
+# |
284 |
+# chromium local policy |
285 |
+# |
286 |
+ |
287 |
+# execmem for load in plugins |
288 |
+allow chromium_t self:process { execmem getsched getcap setcap setrlimit setsched sigkill signal }; |
289 |
+allow chromium_t self:fifo_file rw_fifo_file_perms; |
290 |
+allow chromium_t self:sem create_sem_perms; |
291 |
+allow chromium_t self:netlink_kobject_uevent_socket client_stream_socket_perms; |
292 |
+# cap_userns sys_admin for the sandbox |
293 |
+allow chromium_t self:cap_userns { sys_admin sys_chroot sys_ptrace }; |
294 |
+ |
295 |
+allow chromium_t chromium_exec_t:file execute_no_trans; |
296 |
+ |
297 |
+allow chromium_t chromium_renderer_t:dir list_dir_perms; |
298 |
+allow chromium_t chromium_renderer_t:file rw_file_perms; |
299 |
+allow chromium_t chromium_renderer_t:fd use; |
300 |
+allow chromium_t chromium_renderer_t:process signal_perms; |
301 |
+allow chromium_t chromium_renderer_t:shm rw_shm_perms; |
302 |
+allow chromium_t chromium_renderer_t:unix_dgram_socket { read write }; |
303 |
+allow chromium_t chromium_renderer_t:unix_stream_socket { read write }; |
304 |
+ |
305 |
+allow chromium_t chromium_sandbox_t:unix_dgram_socket { read write }; |
306 |
+allow chromium_t chromium_sandbox_t:unix_stream_socket { read write }; |
307 |
+ |
308 |
+allow chromium_t chromium_naclhelper_t:process { share }; |
309 |
+ |
310 |
+# tmp has a wide class access (used for plugins) |
311 |
+manage_files_pattern(chromium_t, chromium_tmp_t, chromium_tmp_t) |
312 |
+allow chromium_t chromium_tmp_t:file map; |
313 |
+manage_dirs_pattern(chromium_t, chromium_tmp_t, chromium_tmp_t) |
314 |
+manage_lnk_files_pattern(chromium_t, chromium_tmp_t, chromium_tmp_t) |
315 |
+manage_sock_files_pattern(chromium_t, chromium_tmp_t, chromium_tmp_t) |
316 |
+manage_fifo_files_pattern(chromium_t, chromium_tmp_t, chromium_tmp_t) |
317 |
+files_tmp_filetrans(chromium_t, chromium_tmp_t, { file dir sock_file }) |
318 |
+ |
319 |
+manage_files_pattern(chromium_t, chromium_tmpfs_t, chromium_tmpfs_t) |
320 |
+allow chromium_t chromium_tmpfs_t:file map; |
321 |
+fs_tmpfs_filetrans(chromium_t, chromium_tmpfs_t, file) |
322 |
+fs_tmpfs_filetrans(chromium_renderer_t, chromium_tmpfs_t, file) |
323 |
+ |
324 |
+manage_files_pattern(chromium_t, chromium_xdg_config_t, chromium_xdg_config_t) |
325 |
+allow chromium_t chromium_xdg_config_t:file map; |
326 |
+manage_lnk_files_pattern(chromium_t, chromium_xdg_config_t, chromium_xdg_config_t) |
327 |
+manage_dirs_pattern(chromium_t, chromium_xdg_config_t, chromium_xdg_config_t) |
328 |
+xdg_config_filetrans(chromium_t, chromium_xdg_config_t, dir, "chromium") |
329 |
+ |
330 |
+manage_files_pattern(chromium_t, chromium_xdg_cache_t, chromium_xdg_cache_t) |
331 |
+allow chromium_t chromium_xdg_cache_t:file map; |
332 |
+manage_dirs_pattern(chromium_t, chromium_xdg_cache_t, chromium_xdg_cache_t) |
333 |
+xdg_cache_filetrans(chromium_t, chromium_xdg_cache_t, dir, "chromium") |
334 |
+ |
335 |
+dyntrans_pattern(chromium_t, chromium_renderer_t) |
336 |
+domtrans_pattern(chromium_t, chromium_sandbox_exec_t, chromium_sandbox_t) |
337 |
+domtrans_pattern(chromium_t, chromium_naclhelper_exec_t, chromium_naclhelper_t) |
338 |
+ |
339 |
+kernel_list_proc(chromium_t) |
340 |
+kernel_read_net_sysctls(chromium_t) |
341 |
+ |
342 |
+corecmd_exec_bin(chromium_t) |
343 |
+# Look for /etc/gentoo-release through a shell invocation running find |
344 |
+corecmd_exec_shell(chromium_t) |
345 |
+ |
346 |
+corenet_tcp_connect_all_unreserved_ports(chromium_t) |
347 |
+corenet_tcp_connect_ftp_port(chromium_t) |
348 |
+corenet_tcp_connect_http_port(chromium_t) |
349 |
+corenet_udp_bind_generic_node(chromium_t) |
350 |
+corenet_udp_bind_all_unreserved_ports(chromium_t) |
351 |
+ |
352 |
+dev_read_sound(chromium_t) |
353 |
+dev_write_sound(chromium_t) |
354 |
+dev_read_urand(chromium_t) |
355 |
+dev_read_rand(chromium_t) |
356 |
+dev_rw_xserver_misc(chromium_t) |
357 |
+dev_map_xserver_misc(chromium_t) |
358 |
+ |
359 |
+domain_dontaudit_search_all_domains_state(chromium_t) |
360 |
+ |
361 |
+files_list_home(chromium_t) |
362 |
+files_search_home(chromium_t) |
363 |
+files_read_usr_files(chromium_t) |
364 |
+files_map_usr_files(chromium_t) |
365 |
+files_read_etc_files(chromium_t) |
366 |
+# During find for /etc/whatever-release we get lots of output otherwise |
367 |
+files_dontaudit_getattr_all_dirs(chromium_t) |
368 |
+ |
369 |
+fs_dontaudit_getattr_xattr_fs(chromium_t) |
370 |
+ |
371 |
+miscfiles_read_all_certs(chromium_t) |
372 |
+miscfiles_read_localization(chromium_t) |
373 |
+ |
374 |
+sysnet_dns_name_resolve(chromium_t) |
375 |
+ |
376 |
+userdom_user_content_access_template(chromium, chromium_t) |
377 |
+userdom_dontaudit_list_user_home_dirs(chromium_t) |
378 |
+# Debugging. Also on user_tty_device_t if X is started through "startx" for instance |
379 |
+userdom_use_user_terminals(chromium_t) |
380 |
+userdom_manage_user_certs(chromium_t) |
381 |
+userdom_user_home_dir_filetrans_user_cert(chromium_t, dir, ".pki") |
382 |
+ |
383 |
+xdg_create_cache_dirs(chromium_t) |
384 |
+xdg_create_config_dirs(chromium_t) |
385 |
+xdg_create_data_dirs(chromium_t) |
386 |
+xdg_manage_downloads(chromium_t) |
387 |
+xdg_read_config_files(chromium_t) |
388 |
+xdg_read_data_files(chromium_t) |
389 |
+ |
390 |
+xserver_user_x_domain_template(chromium, chromium_t, chromium_tmpfs_t) |
391 |
+ |
392 |
+tunable_policy(`chromium_bind_tcp_unreserved_ports',` |
393 |
+ corenet_tcp_bind_generic_node(chromium_t) |
394 |
+ corenet_tcp_bind_all_unreserved_ports(chromium_t) |
395 |
+ allow chromium_t self:tcp_socket { listen accept }; |
396 |
+') |
397 |
+ |
398 |
+tunable_policy(`chromium_rw_usb_dev',` |
399 |
+ dev_rw_generic_usb_dev(chromium_t) |
400 |
+ udev_read_db(chromium_t) |
401 |
+') |
402 |
+ |
403 |
+tunable_policy(`chromium_read_system_info',` |
404 |
+ kernel_read_kernel_sysctls(chromium_t) |
405 |
+ # Memory optimizations & optimizations based on OS/version |
406 |
+ kernel_read_system_state(chromium_t) |
407 |
+ |
408 |
+ # Debugging (sys/kernel/debug) and device information (sys/bus and sys/devices). |
409 |
+ dev_read_sysfs(chromium_t) |
410 |
+ |
411 |
+ storage_getattr_fixed_disk_dev(chromium_t) |
412 |
+ |
413 |
+ files_read_etc_runtime_files(chromium_t) |
414 |
+ |
415 |
+ dev_dontaudit_getattr_all_chr_files(chromium_t) |
416 |
+ init_dontaudit_getattr_initctl(chromium_t) |
417 |
+',` |
418 |
+ kernel_dontaudit_read_kernel_sysctl(chromium_t) |
419 |
+ kernel_dontaudit_read_system_state(chromium_t) |
420 |
+ |
421 |
+ dev_dontaudit_read_sysfs(chromium_t) |
422 |
+ |
423 |
+ files_dontaudit_read_etc_runtime_files(chromium_t) |
424 |
+') |
425 |
+ |
426 |
+optional_policy(` |
427 |
+ cups_read_config(chromium_t) |
428 |
+ cups_stream_connect(chromium_t) |
429 |
+') |
430 |
+ |
431 |
+optional_policy(` |
432 |
+ dbus_all_session_bus_client(chromium_t) |
433 |
+ dbus_system_bus_client(chromium_t) |
434 |
+ |
435 |
+ optional_policy(` |
436 |
+ unconfined_dbus_chat(chromium_t) |
437 |
+ ') |
438 |
+ optional_policy(` |
439 |
+ gnome_dbus_chat_all_gkeyringd(chromium_t) |
440 |
+ ') |
441 |
+ optional_policy(` |
442 |
+ devicekit_dbus_chat_power(chromium_t) |
443 |
+ ') |
444 |
+') |
445 |
+ |
446 |
+ifdef(`use_alsa',` |
447 |
+ optional_policy(` |
448 |
+ alsa_domain(chromium_t, chromium_tmpfs_t) |
449 |
+ ') |
450 |
+ |
451 |
+ optional_policy(` |
452 |
+ pulseaudio_domtrans(chromium_t) |
453 |
+ ') |
454 |
+') |
455 |
+ |
456 |
+######################################## |
457 |
+# |
458 |
+# chromium_renderer local policy |
459 |
+# |
460 |
+ |
461 |
+allow chromium_renderer_t self:process execmem; |
462 |
+ |
463 |
+allow chromium_renderer_t self:fifo_file rw_fifo_file_perms; |
464 |
+allow chromium_renderer_t self:shm create_shm_perms; |
465 |
+allow chromium_renderer_t self:unix_dgram_socket { create read sendto }; |
466 |
+allow chromium_renderer_t self:unix_stream_socket { create getattr read write }; |
467 |
+ |
468 |
+allow chromium_renderer_t chromium_t:fd use; |
469 |
+allow chromium_renderer_t chromium_t:unix_stream_socket rw_stream_socket_perms; |
470 |
+allow chromium_renderer_t chromium_tmpfs_t:file rw_file_perms; |
471 |
+ |
472 |
+dontaudit chromium_renderer_t chromium_t:dir search; # /proc/... access |
473 |
+dontaudit chromium_renderer_t self:process getsched; |
474 |
+ |
475 |
+read_files_pattern(chromium_renderer_t, chromium_xdg_config_t, chromium_xdg_config_t) |
476 |
+ |
477 |
+rw_fifo_files_pattern(chromium_renderer_t, chromium_tmp_t, chromium_tmp_t) |
478 |
+ |
479 |
+dev_read_urand(chromium_renderer_t) |
480 |
+ |
481 |
+files_dontaudit_list_tmp(chromium_renderer_t) |
482 |
+files_dontaudit_read_etc_files(chromium_renderer_t) |
483 |
+files_search_var(chromium_renderer_t) |
484 |
+ |
485 |
+init_sigchld(chromium_renderer_t) |
486 |
+ |
487 |
+miscfiles_read_localization(chromium_renderer_t) |
488 |
+ |
489 |
+userdom_dontaudit_use_all_users_fds(chromium_renderer_t) |
490 |
+userdom_use_user_terminals(chromium_renderer_t) |
491 |
+ |
492 |
+xdg_read_config_files(chromium_renderer_t) |
493 |
+ |
494 |
+xserver_user_x_domain_template(chromium_renderer, chromium_renderer_t, chromium_tmpfs_t) |
495 |
+ |
496 |
+tunable_policy(`chromium_read_system_info',` |
497 |
+ kernel_read_kernel_sysctls(chromium_renderer_t) |
498 |
+ kernel_read_system_state(chromium_renderer_t) |
499 |
+',` |
500 |
+ kernel_dontaudit_read_kernel_sysctl(chromium_renderer_t) |
501 |
+ kernel_dontaudit_read_system_state(chromium_renderer_t) |
502 |
+') |
503 |
+ |
504 |
+######################################### |
505 |
+# |
506 |
+# Chromium sandbox local policy |
507 |
+# |
508 |
+ |
509 |
+allow chromium_sandbox_t self:capability { dac_read_search setgid setuid sys_admin sys_chroot sys_ptrace }; |
510 |
+allow chromium_sandbox_t self:process { setrlimit }; |
511 |
+allow chromium_sandbox_t self:unix_stream_socket create_stream_socket_perms; |
512 |
+ |
513 |
+allow chromium_sandbox_t chromium_t:process { share }; |
514 |
+# /proc access |
515 |
+allow chromium_sandbox_t chromium_t:dir list_dir_perms; |
516 |
+allow chromium_sandbox_t chromium_t:lnk_file read_lnk_file_perms; |
517 |
+allow chromium_sandbox_t chromium_t:file rw_file_perms; |
518 |
+ |
519 |
+allow chromium_sandbox_t chromium_t:unix_stream_socket { read write }; |
520 |
+allow chromium_sandbox_t chromium_t:unix_dgram_socket { read write }; |
521 |
+ |
522 |
+kernel_list_proc(chromium_sandbox_t) |
523 |
+ |
524 |
+domain_dontaudit_read_all_domains_state(chromium_sandbox_t) |
525 |
+ |
526 |
+userdom_use_user_ptys(chromium_sandbox_t) |
527 |
+ |
528 |
+chromium_domtrans(chromium_sandbox_t) |
529 |
+ |
530 |
+########################################## |
531 |
+# |
532 |
+# Chromium nacl helper local policy |
533 |
+# |
534 |
+ |
535 |
+allow chromium_naclhelper_t chromium_t:unix_stream_socket { read write }; |
536 |
+ |
537 |
+domain_mmap_low_uncond(chromium_naclhelper_t) |
538 |
+ |
539 |
+userdom_use_user_ptys(chromium_naclhelper_t) |
540 |
+ |
541 |
+tunable_policy(`chromium_read_system_info',` |
542 |
+ kernel_read_kernel_sysctls(chromium_naclhelper_t) |
543 |
+ kernel_read_system_state(chromium_naclhelper_t) |
544 |
+',` |
545 |
+ kernel_dontaudit_read_kernel_sysctl(chromium_naclhelper_t) |
546 |
+ kernel_dontaudit_read_system_state(chromium_naclhelper_t) |
547 |
+') |
548 |
+ |