1 |
commit: aec9eaf2286333e32c87e20244488b162b885df9 |
2 |
Author: Guido Trentalancia <guido <AT> trentalancia <DOT> net> |
3 |
AuthorDate: Fri Aug 19 13:27:32 2016 +0000 |
4 |
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org> |
5 |
CommitDate: Wed Aug 31 15:38:26 2016 +0000 |
6 |
URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=aec9eaf2 |
7 |
|
8 |
Add module_load permission to can_load_kernmodule |
9 |
|
10 |
The "module_load" permission has been recently added to the "system" |
11 |
class (kernel 4.7). |
12 |
|
13 |
The following patch updates the Reference Policy so that the new |
14 |
permission is allowed when a kernel module should be loaded. |
15 |
|
16 |
To preserve the module encapsulation, a new interface is defined |
17 |
in the kernel files module and that interface is then used in the |
18 |
kernel module. |
19 |
|
20 |
A short note is added about unneeded permissions that set the |
21 |
kernel scheduling parameters (might lead to service disruption). |
22 |
|
23 |
Signed-off-by: Guido Trentalancia <guido <AT> trentalancia.net> |
24 |
|
25 |
policy/modules/kernel/files.if | 19 +++++++++++++++++++ |
26 |
policy/modules/kernel/kernel.te | 4 ++++ |
27 |
2 files changed, 23 insertions(+) |
28 |
|
29 |
diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if |
30 |
index dc13e31..0d9fddd 100644 |
31 |
--- a/policy/modules/kernel/files.if |
32 |
+++ b/policy/modules/kernel/files.if |
33 |
@@ -4160,6 +4160,25 @@ interface(`files_kernel_modules_filetrans',` |
34 |
|
35 |
######################################## |
36 |
## <summary> |
37 |
+## Load kernel module files. |
38 |
+## </summary> |
39 |
+## <param name="domain"> |
40 |
+## <summary> |
41 |
+## Domain allowed access. |
42 |
+## </summary> |
43 |
+## </param> |
44 |
+# |
45 |
+interface(`files_load_kernel_modules',` |
46 |
+ gen_require(` |
47 |
+ type modules_object_t; |
48 |
+ ') |
49 |
+ |
50 |
+ files_read_kernel_modules($1) |
51 |
+ allow $1 modules_object_t:system module_load; |
52 |
+') |
53 |
+ |
54 |
+######################################## |
55 |
+## <summary> |
56 |
## List world-readable directories. |
57 |
## </summary> |
58 |
## <param name="domain"> |
59 |
|
60 |
diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te |
61 |
index 6467aed..c18e7eb 100644 |
62 |
--- a/policy/modules/kernel/kernel.te |
63 |
+++ b/policy/modules/kernel/kernel.te |
64 |
@@ -429,8 +429,12 @@ optional_policy(` |
65 |
if( ! secure_mode_insmod ) { |
66 |
allow can_load_kernmodule self:capability sys_module; |
67 |
|
68 |
+ files_load_kernel_modules(can_load_kernmodule) |
69 |
+ |
70 |
# load_module() calls stop_machine() which |
71 |
# calls sched_setscheduler() |
72 |
+ # gt: there seems to be no trace of the above, at |
73 |
+ # least in kernel versions greater than 2.6.37... |
74 |
allow can_load_kernmodule self:capability sys_nice; |
75 |
kernel_setsched(can_load_kernmodule) |
76 |
} |