[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     fc0e045f7ea52cdf449ca1fd8218adad5b78d49b
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Wed Oct 31 08:57:16 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Wed Oct 31 18:04:23 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=fc0e045f

Changes to the vmware policy module

Module clean up

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/vmware.fc |   13 --------
 policy/modules/contrib/vmware.if |   36 +++++++++++++--------
 policy/modules/contrib/vmware.te |   64 ++++++++++++++++++-------------------
 3 files changed, 54 insertions(+), 59 deletions(-)

diff --git a/policy/modules/contrib/vmware.fc b/policy/modules/contrib/vmware.fc
index dc41e2d..7273b9c 100644
--- a/policy/modules/contrib/vmware.fc
+++ b/policy/modules/contrib/vmware.fc
@@ -1,18 +1,9 @@
-#
-# HOME_DIR/
-#
 HOME_DIR/\.vmware(/.*)?	gen_context(system_u:object_r:vmware_file_t,s0)
 HOME_DIR/\.vmware[^/]*/.*\.cfg	--	gen_context(system_u:object_r:vmware_conf_t,s0)
 HOME_DIR/vmware(/.*)?	gen_context(system_u:object_r:vmware_file_t,s0)
 
-#
-# /etc
-#
 /etc/vmware.*(/.*)?	gen_context(system_u:object_r:vmware_sys_conf_t,s0)
 
-#
-# /usr
-#
 /usr/bin/vmnet-bridge	--	gen_context(system_u:object_r:vmware_host_exec_t,s0)
 /usr/bin/vmnet-dhcpd	--	gen_context(system_u:object_r:vmware_host_exec_t,s0)
 /usr/bin/vmnet-natd	--	gen_context(system_u:object_r:vmware_host_exec_t,s0)
@@ -34,15 +25,12 @@ HOME_DIR/vmware(/.*)?	gen_context(system_u:object_r:vmware_file_t,s0)
 /usr/lib/vmware/bin/vmware-ui	--	gen_context(system_u:object_r:vmware_exec_t,s0)
 /usr/lib/vmware/bin/vmware-vmx	--	gen_context(system_u:object_r:vmware_host_exec_t,s0)
 
-ifdef(`distro_redhat',`
 /usr/lib/vmware-tools/sbin32/vmware.*	--	gen_context(system_u:object_r:vmware_host_exec_t,s0)
 /usr/lib/vmware-tools/sbin64/vmware.*	--	gen_context(system_u:object_r:vmware_host_exec_t,s0)
-')
 
 /usr/sbin/vmware-guest.*	--	gen_context(system_u:object_r:vmware_host_exec_t,s0)
 /usr/sbin/vmware-serverd	--	gen_context(system_u:object_r:vmware_exec_t,s0)
 
-ifdef(`distro_gentoo',`
 /opt/vmware/(workstation|player)/bin/vmnet-bridge	--	gen_context(system_u:object_r:vmware_host_exec_t,s0)
 /opt/vmware/(workstation|player)/bin/vmnet-dhcpd	--	gen_context(system_u:object_r:vmware_host_exec_t,s0)
 /opt/vmware/(workstation|player)/bin/vmnet-natd	--	gen_context(system_u:object_r:vmware_host_exec_t,s0)
@@ -55,7 +43,6 @@ ifdef(`distro_gentoo',`
 /opt/vmware/(workstation|player)/bin/vmware-smbpasswd\.bin	--	gen_context(system_u:object_r:vmware_host_exec_t,s0)
 /opt/vmware/(workstation|player)/bin/vmware-wizard	--	gen_context(system_u:object_r:vmware_exec_t,s0)
 /opt/vmware/(workstation|player)/bin/vmware	--	gen_context(system_u:object_r:vmware_exec_t,s0)
-')
 
 /var/log/vmware.*	--	gen_context(system_u:object_r:vmware_log_t,s0)
 /var/log/vnetlib.*	--	gen_context(system_u:object_r:vmware_log_t,s0)

diff --git a/policy/modules/contrib/vmware.if b/policy/modules/contrib/vmware.if
index 853f575..20a1fb2 100644
--- a/policy/modules/contrib/vmware.if
+++ b/policy/modules/contrib/vmware.if
@@ -1,33 +1,40 @@
-## <summary>VMWare Workstation virtual machines</summary>
+## <summary>VMWare Workstation virtual machines.</summary>
 
 ########################################
 ## <summary>
-##	Role access for vmware
+##	Role access for vmware.
 ## </summary>
 ## <param name="role">
 ##	<summary>
-##	Role allowed access
+##	Role allowed access.
 ##	</summary>
 ## </param>
 ## <param name="domain">
 ##	<summary>
-##	User domain for the role
+##	User domain for the role.
 ##	</summary>
 ## </param>
 #
 interface(`vmware_role',`
 	gen_require(`
-		type vmware_t, vmware_exec_t;
+		type vmware_t, vmware_exec_t, vmware_file_t;
+		type vmware_conf_t, vmware_tmp_t, vmware_tmpfs_t;
 	')
 
 	role $1 types vmware_t;
 
-	# Transition from the user domain to the derived domain.
 	domtrans_pattern($2, vmware_exec_t, vmware_t)
 
-	# allow ps to show vmware and allow the user to kill it 
 	ps_process_pattern($2, vmware_t)
-	allow $2 vmware_t:process signal;
+	allow $2 vmware_t:process { ptrace signal_perms };
+
+	allow $2 { vmware_tmp_t vmware_file_t }:dir { manage_dir_perms relabel_dir_perms };
+	allow $2 { vmware_conf_t vmware_file_t vmware_tmp_t vmware_tmpfs_t }:file { manage_file_perms relabel_file_perms };
+	allow $2 { vmware_tmp_t vmware_tmpfs_t }:sock_file { manage_sock_file_perms relabel_sock_file_perms };
+	allow $2 vmware_tmpfs_t:lnk_file { manage_lnk_file_perms relabel_lnk_file_perms };
+	allow $2 vmware_tmpfs_t:fifo_file { manage_fifo_file_perms relabel_fifo_file_perms };
+	userdom_user_home_dir_filetrans($2, vmware_file_t, dir, ".vmware")
+	userdom_user_home_dir_filetrans($2, vmware_file_t, dir, "vmware")
 ')
 
 ########################################
@@ -45,12 +52,13 @@ interface(`vmware_exec_host',`
 		type vmware_host_exec_t;
 	')
 
+	corecmd_search_bin($1)
 	can_exec($1, vmware_host_exec_t)
 ')
 
 ########################################
 ## <summary>
-##	Read VMWare system configuration files.
+##	Read vmware system configuration files.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -63,12 +71,13 @@ interface(`vmware_read_system_config',`
 		type vmware_sys_conf_t;
 	')
 
-	allow $1 vmware_sys_conf_t:file { getattr read };
+	files_search_etc($1)
+	allow $1 vmware_sys_conf_t:file read_file_perms;
 ')
 
 ########################################
 ## <summary>
-##	Append to VMWare system configuration files.
+##	Append vmware system configuration files.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -81,12 +90,13 @@ interface(`vmware_append_system_config',`
 		type vmware_sys_conf_t;
 	')
 
-	allow $1 vmware_sys_conf_t:file append;
+	files_search_etc($1)
+	allow $1 vmware_sys_conf_t:file append_file_perms;
 ')
 
 ########################################
 ## <summary>
-##	Append to VMWare log files.
+##	Append vmware log files.
 ## </summary>
 ## <param name="domain">
 ##	<summary>

diff --git a/policy/modules/contrib/vmware.te b/policy/modules/contrib/vmware.te
index 7d334c4..3a56513 100644
--- a/policy/modules/contrib/vmware.te
+++ b/policy/modules/contrib/vmware.te
@@ -1,11 +1,10 @@
-policy_module(vmware, 2.6.0)
+policy_module(vmware, 2.6.1)
 
 ########################################
 #
 # Declarations
 #
 
-# VMWare user program
 type vmware_t;
 type vmware_exec_t;
 typealias vmware_t alias { user_vmware_t staff_vmware_t sysadm_vmware_t };
@@ -22,7 +21,6 @@ typealias vmware_file_t alias { user_vmware_file_t staff_vmware_file_t sysadm_vm
 typealias vmware_file_t alias { auditadm_vmware_file_t secadm_vmware_file_t };
 userdom_user_home_content(vmware_file_t)
 
-# VMWare host programs
 type vmware_host_t;
 type vmware_host_exec_t;
 init_daemon_domain(vmware_host_t, vmware_host_exec_t)
@@ -45,9 +43,8 @@ typealias vmware_pid_t alias { auditadm_vmware_pid_t secadm_vmware_pid_t };
 files_pid_file(vmware_pid_t)
 ubac_constrained(vmware_pid_t)
 
-# Systemwide configuration files
 type vmware_sys_conf_t;
-files_type(vmware_sys_conf_t)
+files_config_file(vmware_sys_conf_t)
 
 type vmware_tmp_t;
 typealias vmware_tmp_t alias { user_vmware_tmp_t staff_vmware_tmp_t sysadm_vmware_tmp_t };
@@ -65,20 +62,16 @@ ifdef(`enable_mcs',`
 
 ########################################
 #
-# VMWare host local policy
+# Host local policy
 #
 
 allow vmware_host_t self:capability { setgid setuid net_raw sys_nice sys_time sys_ptrace kill dac_override };
 dontaudit vmware_host_t self:capability sys_tty_config;
 allow vmware_host_t self:process { execstack execmem signal_perms };
 allow vmware_host_t self:fifo_file rw_fifo_file_perms;
-allow vmware_host_t self:unix_stream_socket create_stream_socket_perms;
+allow vmware_host_t self:unix_stream_socket { accept listen };
 allow vmware_host_t self:rawip_socket create_socket_perms;
-allow vmware_host_t self:tcp_socket create_socket_perms;
 
-can_exec(vmware_host_t, vmware_host_exec_t)
-
-# cjp: the ro and rw files should be split up
 manage_files_pattern(vmware_host_t, vmware_sys_conf_t, vmware_sys_conf_t)
 manage_lnk_files_pattern(vmware_host_t, vmware_sys_conf_t, vmware_sys_conf_t)
 
@@ -91,8 +84,12 @@ manage_files_pattern(vmware_host_t, vmware_var_run_t, vmware_var_run_t)
 manage_sock_files_pattern(vmware_host_t, vmware_var_run_t, vmware_var_run_t)
 files_pid_filetrans(vmware_host_t, vmware_var_run_t, { file sock_file })
 
-manage_files_pattern(vmware_host_t, vmware_log_t, vmware_log_t)
-logging_log_filetrans(vmware_host_t, vmware_log_t, { file dir })
+append_files_pattern(vmware_host_t, vmware_log_t, vmware_log_t)
+create_files_pattern(vmware_host_t, vmware_log_t, vmware_log_t)
+setattr_files_pattern(vmware_host_t, vmware_log_t, vmware_log_t)
+logging_log_filetrans(vmware_host_t, vmware_log_t, file)
+
+can_exec(vmware_host_t, vmware_host_exec_t)
 
 kernel_read_kernel_sysctls(vmware_host_t)
 kernel_read_system_state(vmware_host_t)
@@ -107,13 +104,9 @@ corenet_tcp_sendrecv_generic_node(vmware_host_t)
 corenet_udp_sendrecv_generic_node(vmware_host_t)
 corenet_raw_sendrecv_generic_node(vmware_host_t)
 corenet_tcp_sendrecv_all_ports(vmware_host_t)
-corenet_udp_sendrecv_all_ports(vmware_host_t)
-corenet_raw_bind_generic_node(vmware_host_t)
-corenet_tcp_bind_generic_node(vmware_host_t)
-corenet_udp_bind_generic_node(vmware_host_t)
-corenet_tcp_connect_all_ports(vmware_host_t)
+
 corenet_sendrecv_all_client_packets(vmware_host_t)
-corenet_sendrecv_all_server_packets(vmware_host_t)
+corenet_tcp_connect_all_ports(vmware_host_t)
 
 corecmd_exec_bin(vmware_host_t)
 corecmd_exec_shell(vmware_host_t)
@@ -184,9 +177,9 @@ optional_policy(`
 	xserver_read_xdm_pid(vmware_host_t)
 ')
 
-##############################
+########################################
 #
-# VMWare guest local policy
+# Guest local policy
 #
 
 allow vmware_t self:capability { dac_override setgid sys_nice sys_resource setuid sys_admin sys_rawio chown };
@@ -202,16 +195,14 @@ allow vmware_t self:sem create_sem_perms;
 allow vmware_t self:msgq create_msgq_perms;
 allow vmware_t self:msg { send receive };
 
-can_exec(vmware_t, vmware_exec_t)
-
-# User configuration files
 allow vmware_t vmware_conf_t:file manage_file_perms;
 
-# VMWare disks
+manage_dirs_pattern(vmware_t, vmware_file_t, vmware_file_t)
 manage_files_pattern(vmware_t, vmware_file_t, vmware_file_t)
 manage_lnk_files_pattern(vmware_t, vmware_file_t, vmware_file_t)
+userdom_user_home_dir_filetrans(vmware_t, vmware_file_t, dir, ".vmware")
+userdom_user_home_dir_filetrans(vmware_t, vmware_file_t, dir, "vmware")
 
-allow vmware_t vmware_tmp_t:file execute;
 manage_dirs_pattern(vmware_t, vmware_tmp_t, vmware_tmp_t)
 manage_files_pattern(vmware_t, vmware_tmp_t, vmware_tmp_t)
 manage_sock_files_pattern(vmware_t, vmware_tmp_t, vmware_tmp_t)
@@ -223,7 +214,6 @@ manage_fifo_files_pattern(vmware_t, vmware_tmpfs_t, vmware_tmpfs_t)
 manage_sock_files_pattern(vmware_t, vmware_tmpfs_t, vmware_tmpfs_t)
 fs_tmpfs_filetrans(vmware_t, vmware_tmpfs_t, { dir file lnk_file sock_file fifo_file })
 
-# Read clobal configuration files
 allow vmware_t vmware_sys_conf_t:dir list_dir_perms;
 read_files_pattern(vmware_t, vmware_sys_conf_t, vmware_sys_conf_t)
 read_lnk_files_pattern(vmware_t, vmware_sys_conf_t, vmware_sys_conf_t)
@@ -234,11 +224,12 @@ manage_lnk_files_pattern(vmware_t, vmware_pid_t, vmware_pid_t)
 manage_sock_files_pattern(vmware_t, vmware_pid_t, vmware_pid_t)
 files_pid_filetrans(vmware_t, vmware_pid_t, { dir file lnk_file })
 
+can_exec(vmware_t, { vmware_tmp_t vmware_exec_t })
+
 kernel_read_system_state(vmware_t)
 kernel_read_network_state(vmware_t)
 kernel_read_kernel_sysctls(vmware_t)
 
-# startup scripts
 corecmd_exec_bin(vmware_t)
 corecmd_exec_shell(vmware_t)
 
@@ -264,19 +255,26 @@ fs_search_auto_mountpoints(vmware_t)
 storage_raw_read_removable_device(vmware_t)
 storage_raw_write_removable_device(vmware_t)
 
-# startup scripts run ldd
 libs_exec_ld_so(vmware_t)
-# Access X11 config files
 libs_read_lib_files(vmware_t)
 
 miscfiles_read_localization(vmware_t)
 
 userdom_use_user_terminals(vmware_t)
 userdom_list_user_home_dirs(vmware_t)
-# cjp: why?
-userdom_read_user_home_content_files(vmware_t)
 
 sysnet_dns_name_resolve(vmware_t)
-sysnet_read_config(vmware_t)
 
 xserver_user_x_domain_template(vmware, vmware_t, vmware_tmpfs_t)
+
+tunable_policy(`use_nfs_home_dirs',`
+	fs_manage_nfs_dirs(vmware_t)
+	fs_manage_nfs_files(vmware_t)
+	fs_manage_nfs_symlinks(vmware_t)
+')
+
+tunable_policy(`use_samba_home_dirs',`
+	fs_manage_cifs_dirs(vmware_t)
+	fs_manage_cifs_files(vmware_t)
+	fs_manage_cifs_symlinks(vmware_t)
+')