[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/system/

[Jason Zaman]

commit:     ff059cfa2c7ef4bd5ff446240617a14e515a0ace
Author:     Kenton Groombridge <me <AT> concord <DOT> sh>
AuthorDate: Tue Jan 11 19:56:49 2022 +0000
Commit:     Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Sun Jan 30 01:15:06 2022 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=ff059cfa

userdomain: add type for user bin files

Add a type and allow execute access to executable files that may be
freely managed by users in their home directories. Although users may
normally execute anything labeled user_home_t, this type is intended to
be executed by user services such as the user's systemd --user instance.

Signed-off-by: Kenton Groombridge <me <AT> concord.sh>
Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org>

 policy/modules/system/userdomain.fc |  2 ++
 policy/modules/system/userdomain.if | 52 ++++++++++++++++++++++++++++++++++++-
 policy/modules/system/userdomain.te |  3 +++
 3 files changed, 56 insertions(+), 1 deletion(-)

diff --git a/policy/modules/system/userdomain.fc b/policy/modules/system/userdomain.fc
index 70b83058..173e314a 100644
--- a/policy/modules/system/userdomain.fc
+++ b/policy/modules/system/userdomain.fc
@@ -1,5 +1,7 @@
 HOME_DIR	-d	gen_context(system_u:object_r:user_home_dir_t,s0-mls_systemhigh)
 HOME_DIR/.+		gen_context(system_u:object_r:user_home_t,s0)
+HOME_DIR/bin(/.*)?		gen_context(system_u:object_r:user_bin_t,s0)
+HOME_DIR/\.local/bin(/.*)?		gen_context(system_u:object_r:user_bin_t,s0)
 HOME_DIR/\.pki(/.*)?	gen_context(system_u:object_r:user_cert_t,s0)
 
 /tmp/gconfd-%{USERNAME} -d	gen_context(system_u:object_r:user_tmp_t,s0)

diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
index ef4419a5..6380e869 100644
--- a/policy/modules/system/userdomain.if
+++ b/policy/modules/system/userdomain.if
@@ -376,7 +376,8 @@ interface(`userdom_ro_home_role',`
 #
 interface(`userdom_manage_home_role',`
 	gen_require(`
-		type user_home_t, user_home_dir_t, user_cert_t;
+		type user_home_t, user_home_dir_t;
+		type user_bin_t, user_cert_t;
 	')
 
 	##############################
@@ -410,6 +411,10 @@ interface(`userdom_manage_home_role',`
 	allow $2 user_home_t:sock_file { watch watch_mount watch_sb watch_with_perm watch_reads };
 	allow $2 user_home_t:fifo_file { watch watch_mount watch_sb watch_with_perm watch_reads };
 
+	userdom_manage_user_bin($2)
+	userdom_exec_user_bin_files($2)
+	userdom_user_home_dir_filetrans($2, user_bin_t, dir, "bin")
+
 	userdom_manage_user_certs($2)
 	userdom_user_home_dir_filetrans($2, user_cert_t, dir, ".pki")
 
@@ -442,6 +447,10 @@ interface(`userdom_manage_home_role',`
 			flash_relabel_home($2)
 		')
 	')
+
+	optional_policy(`
+		xdg_data_filetrans($2, user_bin_t, dir, "bin")
+	')
 ')
 
 #######################################
@@ -2774,6 +2783,47 @@ interface(`userdom_user_home_dir_filetrans_user_home_content',`
 	files_search_home($1)
 ')
 
+########################################
+## <summary>
+##	Execute user executable files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_exec_user_bin_files',`
+	gen_require(`
+		type user_bin_t;
+	')
+
+	exec_files_pattern($1, user_bin_t, user_bin_t)
+	read_lnk_files_pattern($1, user_bin_t, user_bin_t)
+	files_search_home($1)
+')
+
+########################################
+## <summary>
+##	Manage user executable files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_manage_user_bin',`
+	gen_require(`
+		type user_bin_t;
+	')
+
+	allow $1 user_bin_t:dir { manage_dir_perms relabel_dir_perms };
+	allow $1 user_bin_t:file { manage_file_perms relabel_file_perms };
+	allow $1 user_bin_t:lnk_file { manage_lnk_file_perms relabel_lnk_file_perms };
+	files_search_home($1)
+')
+
 ########################################
 ## <summary>
 ##	Read user SSL certificates.

diff --git a/policy/modules/system/userdomain.te b/policy/modules/system/userdomain.te
index e9a5ccfc..9339cb9d 100644
--- a/policy/modules/system/userdomain.te
+++ b/policy/modules/system/userdomain.te
@@ -95,6 +95,9 @@ files_associate_tmp(user_home_t)
 files_poly_parent(user_home_t)
 files_mountpoint(user_home_t)
 
+type user_bin_t;
+userdom_user_home_content(user_bin_t)
+
 type user_cert_t;
 userdom_user_home_content(user_cert_t)