[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     81a88d7f2e5391813affdc4b375892681ee8bc09
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Tue Oct 30 10:55:05 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Tue Oct 30 18:33:08 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=81a88d7f

Changes to the uml policy module

Module clean up
Role attribute for uml client

So the user is expected to label and create the tools executable
files himself?

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/uml.fc |    9 -----
 policy/modules/contrib/uml.if |   54 +++++++++------------------
 policy/modules/contrib/uml.te |   81 ++++++++++++++++++++---------------------
 3 files changed, 57 insertions(+), 87 deletions(-)

diff --git a/policy/modules/contrib/uml.fc b/policy/modules/contrib/uml.fc
index 40120e1..c384968 100644
--- a/policy/modules/contrib/uml.fc
+++ b/policy/modules/contrib/uml.fc
@@ -1,14 +1,5 @@
-#
-# HOME_DIR/
-#
 HOME_DIR/\.uml(/.*)?	gen_context(system_u:object_r:uml_rw_t,s0)
 
-#
-# /usr
-#
 /usr/bin/uml_switch	--	gen_context(system_u:object_r:uml_switch_exec_t,s0)
 
-#
-# /var
-#
 /var/run/uml-utilities(/.*)?	gen_context(system_u:object_r:uml_switch_var_run_t,s0)

diff --git a/policy/modules/contrib/uml.if b/policy/modules/contrib/uml.if
index d2ab7cb..ab5c1d0 100644
--- a/policy/modules/contrib/uml.if
+++ b/policy/modules/contrib/uml.if
@@ -1,69 +1,50 @@
-## <summary>Policy for UML</summary>
+## <summary>User mode linux tools and services.</summary>
 
 ########################################
 ## <summary>
-##	Role access for uml
+##	Role access for uml.
 ## </summary>
 ## <param name="role">
 ##	<summary>
-##	Role allowed access
+##	Role allowed access.
 ##	</summary>
 ## </param>
 ## <param name="domain">
 ##	<summary>
-##	User domain for the role
+##	User domain for the role.
 ##	</summary>
 ## </param>
 #
 interface(`uml_role',`
 	gen_require(`
+		attribute_role uml_roles;
 		type uml_t, uml_exec_t;
 		type uml_ro_t, uml_rw_t, uml_tmp_t;
 		type uml_devpts_t, uml_tmpfs_t;
 	')
 
-	role $1 types uml_t;
+	roleattribute $1 uml_roles;
 
-	# Transition from the user domain to this domain.
 	domtrans_pattern($2, uml_exec_t, uml_t)
 
-	# for mconsole
-	allow $2 uml_t:unix_dgram_socket sendto;
+	dgram_send_pattern($2, uml_tmpfs_t, uml_tmpfs_t, uml_t)
+
 	allow uml_t $2:unix_dgram_socket sendto;
 
-	# allow ps, ptrace, signal
 	ps_process_pattern($2, uml_t)
 	allow $2 uml_t:process { ptrace signal_perms };
 
-	allow $2 uml_ro_t:dir list_dir_perms;
-	read_files_pattern($2, uml_ro_t, uml_ro_t)
-	read_lnk_files_pattern($2, uml_ro_t, uml_ro_t)
-
-	manage_dirs_pattern($2, { uml_ro_t uml_rw_t }, { uml_ro_t uml_rw_t })
-	manage_files_pattern($2, { uml_ro_t uml_rw_t }, { uml_ro_t uml_rw_t })
-	manage_lnk_files_pattern($2, { uml_ro_t uml_rw_t }, { uml_ro_t uml_rw_t })
-	manage_fifo_files_pattern($2, { uml_ro_t uml_rw_t }, { uml_ro_t uml_rw_t })
-	manage_sock_files_pattern($2, { uml_ro_t uml_rw_t }, { uml_ro_t uml_rw_t })
-	relabel_dirs_pattern($2, { uml_ro_t uml_rw_t }, { uml_ro_t uml_rw_t })
-	relabel_files_pattern($2, { uml_ro_t uml_rw_t }, { uml_ro_t uml_rw_t })
-	relabel_lnk_files_pattern($2, { uml_ro_t uml_rw_t }, { uml_ro_t uml_rw_t })
-	relabel_fifo_files_pattern($2, { uml_ro_t uml_rw_t }, { uml_ro_t uml_rw_t })
-	relabel_sock_files_pattern($2, { uml_ro_t uml_rw_t }, { uml_ro_t uml_rw_t })
-
-	manage_dirs_pattern($2, { uml_ro_t uml_rw_t uml_exec_t }, { uml_ro_t uml_rw_t uml_exec_t })
-	manage_files_pattern($2, { uml_ro_t uml_rw_t uml_exec_t }, { uml_ro_t uml_rw_t uml_exec_t })
-	relabel_dirs_pattern($2, { uml_ro_t uml_rw_t uml_exec_t }, { uml_ro_t uml_rw_t uml_exec_t })
-	relabel_files_pattern($2, { uml_ro_t uml_rw_t uml_exec_t }, { uml_ro_t uml_rw_t uml_exec_t })
-
-	manage_dirs_pattern($2, uml_tmp_t, uml_tmp_t)
-	manage_files_pattern($2, uml_tmp_t, uml_tmp_t)
-	manage_lnk_files_pattern($2, uml_tmp_t, uml_tmp_t)
-	manage_sock_files_pattern($2, uml_tmp_t, uml_tmp_t)
+	allow $2 { uml_ro_t uml_rw_t uml_tmp_t uml_exec_t }:dir { manage_dir_perms relabel_dir_perms };
+	allow $2 { uml_ro_t uml_rw_t uml_tmp_t uml_tmpfs_t uml_exec_t }:file { manage_file_perms relabel_file_perms };
+	allow $2 { uml_ro_t uml_rw_t uml_tmpfs_t }:lnk_file { manage_lnk_file_perms relabel_lnk_file_perms };
+	allow $2 { uml_ro_t uml_rw_t uml_tmpfs_t }:fifo_file { manage_fifo_file_perms relabel_fifo_file_perms };
+	allow $2 { uml_ro_t uml_rw_t uml_tmpfs_t }:sock_file { manage_sock_file_perms relabel_sock_file_perms };
+	userdom_user_home_dir_filetrans($2, uml_rw_t, dir, ".uml")
 ')
 
 ########################################
 ## <summary>
-##	Set attributes on uml utility socket files.
+##	Set attributes of uml pid sock files.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -76,12 +57,13 @@ interface(`uml_setattr_util_sockets',`
 		type uml_switch_var_run_t;
 	')
 
-	allow $1 uml_switch_var_run_t:sock_file setattr;
+	allow $1 uml_switch_var_run_t:sock_file setattr_sock_file_perms;
 ')
 
 ########################################
 ## <summary>
-##	Manage uml utility files.
+##	Create, read, write, and delete
+##	uml pid files.
 ## </summary>
 ## <param name="domain">
 ##	<summary>

diff --git a/policy/modules/contrib/uml.te b/policy/modules/contrib/uml.te
index ff094e5..dc03cc5 100644
--- a/policy/modules/contrib/uml.te
+++ b/policy/modules/contrib/uml.te
@@ -1,17 +1,20 @@
-policy_module(uml, 2.2.0)
+policy_module(uml, 2.2.1)
 
 ########################################
 #
 # Declarations
 #
 
+attribute_role uml_roles;
+
 type uml_t;
-type uml_exec_t;
+type uml_exec_t; # customizable
 typealias uml_t alias { user_uml_t staff_uml_t sysadm_uml_t };
 typealias uml_t alias { auditadm_uml_t secadm_uml_t };
 userdom_user_application_domain(uml_t, uml_exec_t)
+role uml_roles types uml_t;
 
-type uml_ro_t;
+type uml_ro_t; # customizable
 typealias uml_ro_t alias { user_uml_ro_t staff_uml_ro_t sysadm_uml_ro_t };
 typealias uml_ro_t alias { auditadm_uml_ro_t secadm_uml_ro_t };
 userdom_user_home_content(uml_ro_t)
@@ -49,93 +52,88 @@ files_pid_file(uml_switch_var_run_t)
 # Local policy
 #
 
+allow uml_t self:process signal_perms;
 allow uml_t self:fifo_file rw_fifo_file_perms;
-allow uml_t self:process { signal_perms ptrace };
 allow uml_t self:unix_stream_socket create_stream_socket_perms;
-allow uml_t self:unix_dgram_socket create_socket_perms;
-# Use the network.
-allow uml_t self:tcp_socket create_stream_socket_perms;
-allow uml_t self:udp_socket create_socket_perms;
+allow uml_t self:tcp_socket { accept listen };
 allow uml_t self:tun_socket create;
-# for mconsole
-allow uml_t self:unix_dgram_socket sendto;
+allow uml_t self:unix_dgram_socket { create_socket_perms sendto };
 
-# allow the UML thing to happen
-allow uml_t uml_devpts_t:chr_file { rw_file_perms setattr };
+allow uml_t uml_devpts_t:chr_file { rw_file_perms setattr_chr_file_perms };
 term_create_pty(uml_t, uml_devpts_t)
 
 manage_dirs_pattern(uml_t, uml_tmp_t, uml_tmp_t)
 manage_files_pattern(uml_t, uml_tmp_t, uml_tmp_t)
 files_tmp_filetrans(uml_t, uml_tmp_t, { file dir })
-can_exec(uml_t, uml_tmp_t)
 
 manage_files_pattern(uml_t, uml_tmpfs_t, uml_tmpfs_t)
 manage_lnk_files_pattern(uml_t, uml_tmpfs_t, uml_tmpfs_t)
 manage_fifo_files_pattern(uml_t, uml_tmpfs_t, uml_tmpfs_t)
 manage_sock_files_pattern(uml_t, uml_tmpfs_t, uml_tmpfs_t)
 fs_tmpfs_filetrans(uml_t, uml_tmpfs_t, { file lnk_file sock_file fifo_file })
-can_exec(uml_t, uml_tmpfs_t)
 
-# access config files
-allow uml_t { uml_ro_t uml_ro_t }:dir list_dir_perms;
-read_files_pattern(uml_t, { uml_ro_t uml_ro_t }, { uml_ro_t uml_ro_t })
-read_lnk_files_pattern(uml_t, { uml_ro_t uml_ro_t }, { uml_ro_t uml_ro_t })
+allow uml_t uml_ro_t:dir list_dir_perms;
+allow uml_t uml_ro_t:file read_file_perms;
+allow uml_t uml_ro_t:lnk_file read_lnk_file_perms;
 
 manage_dirs_pattern(uml_t, uml_rw_t, uml_rw_t)
 manage_files_pattern(uml_t, uml_rw_t, uml_rw_t)
 manage_lnk_files_pattern(uml_t, uml_rw_t, uml_rw_t)
 manage_fifo_files_pattern(uml_t, uml_rw_t, uml_rw_t)
 manage_sock_files_pattern(uml_t, uml_rw_t, uml_rw_t)
-userdom_user_home_dir_filetrans(uml_t, uml_rw_t, { file lnk_file sock_file fifo_file })
+userdom_user_home_dir_filetrans(uml_t, uml_rw_t, dir, ".uml")
 
-can_exec(uml_t, { uml_exec_t uml_exec_t })
+can_exec(uml_t, { uml_exec_t uml_tmp_t uml_tmpfs_t })
 
 kernel_read_system_state(uml_t)
-# for SKAS - need something better
 kernel_write_proc_files(uml_t)
 
-# for xterm
 corecmd_exec_bin(uml_t)
 
 corenet_all_recvfrom_unlabeled(uml_t)
 corenet_all_recvfrom_netlabel(uml_t)
 corenet_tcp_sendrecv_generic_if(uml_t)
-corenet_udp_sendrecv_generic_if(uml_t)
 corenet_tcp_sendrecv_generic_node(uml_t)
-corenet_udp_sendrecv_generic_node(uml_t)
 corenet_tcp_sendrecv_all_ports(uml_t)
-corenet_udp_sendrecv_all_ports(uml_t)
-corenet_tcp_connect_all_ports(uml_t)
+
 corenet_sendrecv_all_client_packets(uml_t)
+corenet_tcp_connect_all_ports(uml_t)
+
 corenet_rw_tun_tap_dev(uml_t)
 
 domain_use_interactive_fds(uml_t)
 
-# for xterm
-files_read_etc_files(uml_t)
 files_dontaudit_read_etc_runtime_files(uml_t)
-# putting uml data under /var is usual...
-files_search_var(uml_t)
 
-fs_getattr_xattr_fs(uml_t)
+fs_getattr_all_fs(uml_t)
+fs_search_auto_mountpoints(uml_t)
+
+auth_use_nsswitch(uml_t)
 
 init_read_utmp(uml_t)
 init_dontaudit_write_utmp(uml_t)
 
-# for xterm
 libs_exec_lib_files(uml_t)
 
-# Inherit and use descriptors from newrole.
-seutil_use_newrole_fds(uml_t)
-
-# Use the network.
-sysnet_read_config(uml_t)
-
 userdom_use_user_terminals(uml_t)
 userdom_attach_admin_tun_iface(uml_t)
 
+tunable_policy(`use_nfs_home_dirs',`
+	fs_manage_nfs_dirs(uml_t)
+	fs_manage_nfs_files(uml_t)
+	fs_manage_nfs_named_pipes(uml_t)
+	fs_manage_nfs_symlinks(uml_t)
+')
+
+tunable_policy(`use_samba_home_dirs',`
+	fs_manage_cifs_dirs(uml_t)
+	fs_manage_cifs_files(uml_t)
+	fs_manage_cifs_named_pipes(uml_t)
+	fs_manage_cifs_symlinks(uml_t)
+')
+
 optional_policy(`
-	nis_use_ypbind(uml_t)
+	seutil_use_newrole_fds(uml_t)
 ')
 
 optional_policy(`
@@ -144,13 +142,12 @@ optional_policy(`
 
 ########################################
 #
-# Local policy
+# Switch local policy
 #
 
 dontaudit uml_switch_t self:capability sys_tty_config;
 allow uml_switch_t self:process signal_perms;
-allow uml_switch_t self:unix_dgram_socket create_socket_perms;
-allow uml_switch_t self:unix_stream_socket create_stream_socket_perms;
+allow uml_switch_t self:unix_stream_socket { accept listen };
 
 manage_files_pattern(uml_switch_t, uml_switch_var_run_t, uml_switch_var_run_t)
 manage_sock_files_pattern(uml_switch_t, uml_switch_var_run_t, uml_switch_var_run_t)