mozilla, gift, games, orbit, gconf, genhomedircon
Subsystems (2)
PATCH 1/1 mozilla, gift, games, orbit, gconf, genhomedircon
Please apply the attached patches, in the order specified. (I really hope this works, because I'm not very good at working w/ patches, and I've created a mess yet again on my home machine - if something won't apply please let me know and I'll get it fixed).
This breaks up some pieces of restrict_home4 for inclusion.
01-file_browse.diff -
split up file_browse_domain into
three individual macros, and use each where appropriate, instead of adding unnecessary dontaudit rules. Also contains fixes for gmplayer.
02-mozilla_gift_misc.diff -
miscellaneous fixes for gift and mozilla, reorganize mozilla a bit
03-genhomedircon-USER.diff -
add handling for USER expansion by genhomedircon
03-Makefile-USER.diff -
change makefile to check for USER expansion
03-orbit.diff -
introduce orbit types, and orbit macros, and prevent applications from accessing ROLE_tmp_t for ORBit sockets.
03-orbit-matchpatchcon.diff -
patch libORBit-2 (CVS) to correctly set
the context of /tmp/orbit-* when it is created.
04-gconfd.diff -
introduce policy for GConf, and a gnome
container domain that will be used to instantiate
a lot of stuff in the future
Signature · 2 lines
Ivan Gyurdiev <[email protected]> Cornell University
macros/base_user_macros.te +8 -1
@@ -68,7 +68,14 @@ allow $1_t dri_device_t:chr_file getattr; dontaudit $1_t dri_device_t:chr_file rw_file_perms; -file_browse_domain($1_t) +# Supress ls denials: +# getattr() - ls -l +# search_dir() - symlink path resolution +# read_dir() - deep ls: ls parent/... + +dontaudit_getattr($1_t) +dontaudit_search_dir($1_t) +dontaudit_read_dir($1_t) # allow ptrace can_ptrace($1_t, $1_t)
macros/global_macros.te +17 -16
@@ -156,7 +156,6 @@ r_dir_file($1, locale_t) ') - ################################### # # access_terminal(domain, typeprefix)
@@ -620,23 +619,25 @@ allow $1_t etc_t:dir r_dir_perms; ') -# Do not flood message log, if the user does a browse -define(`file_browse_domain', ` +# Dontaudit macros to prevent flooding the log -# Regular files/directories that are not security sensitive +define(`dontaudit_getattr', ` dontaudit $1 file_type - secure_file_type:dir_file_class_set getattr; -dontaudit $1 file_type - secure_file_type:dir { read search }; - -# /dev -dontaudit $1 dev_fs:dir_file_class_set getattr; -dontaudit $1 dev_fs:dir { read search }; - -# /proc -dontaudit $1 sysctl_t:dir_file_class_set getattr; -dontaudit $1 proc_fs:dir { read search }; - -')dnl end file_browse_domain - +dontaudit $1 unlabeled_t:dir_file_class_set getattr; +dontaudit $1 { fs_type proc_fs dev_fs sysctl_type }:dir_file_class_set getattr; +')dnl end dontaudit_getattr + +define(`dontaudit_search_dir', ` +dontaudit $1 file_type - secure_file_type:dir search; +dontaudit $1 unlabeled_t:dir search; +dontaudit $1 { fs_type proc_fs dev_fs sysctl_type }:dir search; +')dnl end dontaudit_search_dir + +define(`dontaudit_read_dir', ` +dontaudit $1 file_type - secure_file_type:dir read; +dontaudit $1 unlabeled_t:dir read; +dontaudit $1 { fs_type proc_fs dev_fs sysctl_type }:dir read; +')dnl end dontaudit_read_dir # Define legacy_domain for legacy binaries (java) # "legacy" binary == lacks PT_GNU_STACK header, i.e. built with an old
macros/program/mozilla_macros.te +7 -3
@@ -16,7 +16,7 @@ # provided separately in domains/program/mozilla.te. # define(`mozilla_domain',` -type $1_mozilla_t, domain, web_client_domain, privlog; +type $1_mozilla_t, domain, web_client_domain, nscd_client_domain, privlog; # Type transition if (! disable_mozilla_trans) {
@@ -28,8 +28,12 @@ home_domain($1, mozilla) x_client_domain($1_mozilla, $1) -# Browse files -file_browse_domain($1_mozilla_t) +# GNOME Open/Save As dialogs +dontaudit_getattr($1_mozilla_t) +dontaudit_search_dir($1_mozilla_t) + +# Look for plugins +allow $1_mozilla_t bin_t:dir { getattr read search }; can_network_client($1_mozilla_t) allow $1_mozilla_t ftp_port_t:tcp_socket name_connect;
macros/program/mplayer_macros.te +32 -13
87 lines not on this page · raw message
macros/program/gift_macros.te +4 -2
@@ -17,9 +17,10 @@ domain_auto_trans($1_t, gift_exec_t, $1_gift_t) role $1_r types $1_gift_t; -# X access, Home files +# X access, Home files, /tmp x_client_domain($1_gift, $1) home_domain($1, gift) +tmp_domain($1_gift) uses_shlib($1_gift_t) read_locale($1_gift_t)
@@ -32,6 +33,7 @@ # Self permissions allow $1_gift_t self:process getsched; +allow $1_gift_t self:fifo_file { read write }; # Fonts, icons r_dir_file($1_gift_t, usr_t)
@@ -104,7 +106,7 @@ home_domain_access($1_giftd_t, $1, gift) # Allow networking -allow $1_giftd_t port_t:tcp_socket name_bind; +allow $1_giftd_t port_t:tcp_socket { name_bind name_connect }; allow $1_giftd_t port_t:udp_socket name_bind; can_network_server($1_giftd_t) can_network_client($1_giftd_t)
macros/program/mozilla_macros.te +26 -18
87 lines not on this page · raw message
genhomedircon renamed from genhomedircon.old +8 -1
@@ -357,16 +357,22 @@ return udict def getHomeDirContext(self, user, home, role): - ret="\n\n#\n# Context for user %s\n#\n\n" % user + ret="\n\n#\n# Home Context for user %s\n#\n\n" % user rc=commands.getstatusoutput("grep '^HOME_DIR' %s | sed -e 's|HOME_DIR|%s|' -e 's/ROLE/%s/' -e 's/system_u/%s/'" % (self.getHomeDirTemplate(), home, role, user)) return ret + rc[1] + "\n" + def getUserContext(self, user, sel_user, role): + ret="\n\n#\n# Other Context for user %s\n#\n\n" % user + rc=commands.getstatusoutput("grep 'USER' %s | sed -e 's/USER/%s/' -e 's/ROLE/%s/' -e 's/system_u/%s/'" % (self.getHomeDirTemplate(), user, role, sel_user)) + return ret + rc[1] + "\n" + def genHomeDirContext(self): users = self.getUsers() ret="" # Fill in HOME and ROLE for users that are defined for u in users.keys(): ret += self.getHomeDirContext (u, users[u]["home"], users[u]["role"]) + ret += self.getUserContext (u, u, users[u]["role"]) return ret+"\n" def checkExists(self, home):
@@ -428,6 +434,7 @@ ret= self.heading() for h in self.getHomeDirs(): ret += self.getHomeDirContext ("user_u" , h+'/[^/]*', "user") + ret += self.getUserContext(".*", "user_u", "user") + "\n" ret += self.getHomeRootContext(h) ret += self.genHomeDirContext() return ret
Makefile.new renamed from Makefile +1 -1
@@ -221,7 +221,7 @@ @echo "Building file contexts files..." @m4 $(M4PARAM) $(ALL_TUNABLES) tmp/program_used_flags.te $(FCFILES) > [email protected] @grep -v -e HOME -e ROLE [email protected] > $@ - @grep -e HOME -e ROLE [email protected] > $(HOMEDIR_TEMPLATE) + @grep -e HOME -e ROLE -e USER [email protected] > $(HOMEDIR_TEMPLATE) @-rm [email protected] # Create a tags-file for the policy:
domains/program/orbit.te +7 -0
@@ -0,0 +1,7 @@ +# +# ORBit related types +# +# Author: Ivan Gyurdiev <[email protected]> +# + +# Look in orbit_macros.te
file_contexts/program/orbit.fc +3 -0
@@ -0,0 +1,3 @@ +/tmp/orbit-USER(-.*)? -d system_u:object_r:ROLE_orbit_tmp_t +/tmp/orbit-USER(-.*)?/.* -- <<none>> +/tmp/orbit-USER/bonobo.* -- system_u:object_r:ROLE_orbit_tmp_t
macros/base_user_macros.te +3 -0
@@ -198,6 +198,9 @@ ifdef(`mplayer.te', `mplayer_domains($1)') ifdef(`gift.te', `gift_domains($1)') +# ORBit +orbit_domain($1, $1) + # Instantiate a derived domain for user cron jobs. ifdef(`crond.te', `crond_domain($1)')
macros/program/gift_macros.te +4 -9
@@ -55,15 +55,10 @@ allow $1_gift_t etc_t:file { getattr read }; allow $1_gift_t etc_runtime_t:file { getattr read }; -# Tmp/ORBit -tmp_domain($1_gift) -file_type_auto_trans($1_gift_t, $1_tmp_t, $1_gift_tmp_t) -can_unix_connect($1_t, $1_gift_t) -can_unix_connect($1_gift_t, $1_t) -allow $1_t $1_gift_tmp_t:sock_file write; -allow $1_gift_t $1_tmp_t:file { getattr read write lock }; -allow $1_gift_t $1_tmp_t:sock_file { read write }; -dontaudit $1_gift_t $1_tmp_t:dir setattr; +# ORBit connection to ROLE_t +# FIXME: restrict further +orbit_domain($1_gift, $1) +orbit_connect($1_gift, $1) # Access random device allow $1_gift_t urandom_device_t:chr_file { read getattr ioctl };
macros/program/mozilla_macros.te +5 -7
@@ -58,6 +58,7 @@ # Fork, set resource limits and scheduling info. allow $1_mozilla_t self:process { fork signal_perms setrlimit setsched getsched }; +# Fonts, icons allow $1_mozilla_t usr_t:{ lnk_file file } { getattr read }; # Access /proc
@@ -96,13 +97,10 @@ # Execute downloaded programs. can_exec($1_mozilla_t, $1_mozilla_tmp_t) -# ORBit sockets -file_type_auto_trans($1_mozilla_t, $1_tmp_t, $1_mozilla_tmp_t) -can_unix_connect($1_t, $1_mozilla_t) -allow $1_t $1_mozilla_tmp_t:sock_file write; -allow $1_mozilla_t $1_tmp_t:file { read write lock }; -allow $1_mozilla_t $1_tmp_t:sock_file { read write }; -dontaudit $1_mozilla_t $1_tmp_t:dir setattr; +# ORBit connection to ROLE_t +# FIXME: restrict further +orbit_domain($1_mozilla, $1) +orbit_connect($1_mozilla, $1) # Allow mozilla to read user home content if (mozilla_readhome || mozilla_writehome) {
macros/program/orbit_macros.te +43 -0
43 lines not on this page · raw message
configure.in +21 -0
@@ -293,6 +293,27 @@ AC_DEFINE(HAVE_INET_PTON, 1, [Define if inet_pton() is available]) fi +# Checks for SELinux +AC_MSG_CHECKING(for SELinux support) +AC_ARG_ENABLE(selinux, AC_HELP_STRING([--enable-selinux], [enable SELinux support]), +[ + AC_MSG_RESULT(yes) + AC_CHECK_LIB(selinux, is_selinux_enabled, + [ + AC_DEFINE(WITH_SELINUX, 1, [Define if you want ORBit to be compiled with selinux support]) + SELINUX_CFLAGS="-I/usr/include/selinux" + SELINUX_LDFLAGS="-lselinux" + ], + [ + AC_MSG_WARN([libselinux not found, compiling without SELinux support]) + ]) +], +[ + AC_MSG_RESULT(no) +]) +AC_SUBST(SELINUX_LDFLAGS) +AC_SUBST(SELINUX_CFLAGS) + # AC_CHECK_TYPE doesn't work here. AC_MSG_CHECKING([for socklen_t]) AC_TRY_COMPILE(
src/orb/GIOP/giop.c +43 -2
84 lines not on this page · raw message
src/orb/GIOP/Makefile.am +2 -1
@@ -6,7 +6,8 @@ $(ORBIT_DEBUG_CFLAGS) \ $(DISABLE_DEPRECATED_CFLAGS) \ $(LOCAL_LINC_CFLAGS) \ - $(ORBIT_CFLAGS) + $(ORBIT_CFLAGS) \ + $(SELINUX_CFLAGS) noinst_LTLIBRARIES=libGIOP.la
src/orb/Makefile.am +1 -0
@@ -20,6 +20,7 @@ -version-info $(LT_VERSION) \ -no-undefined \ $(ORBIT_LIBS) \ + $(SELINUX_LDFLAGS) \ -lpopt libORBit_2_la_LIBADD= \
domains/program/gconf.te +12 -0
@@ -0,0 +1,12 @@ +# DESC - GConf preference daemon +# +# Author: Ivan Gyurdiev <[email protected]> +# + +# Type for executable +type gconfd_exec_t, file_type, exec_type, sysadmfile; + +# Type for /etc files +type gconf_etc_t, file_type, sysadmfile; + +# Everything else is in macros/gconfd_macros.te
domains/program/gnome.te +7 -0
@@ -0,0 +1,7 @@ +# +# GNOME related types +# +# Author: Ivan Gyurdiev <[email protected]> +# + +# Look in gnome_macros.te
file_contexts/program/gconf.fc +5 -0
@@ -0,0 +1,5 @@ +/usr/libexec/gconfd-2 -- system_u:object_r:gconfd_exec_t +/etc/gconf(/.*)? system_u:object_r:gconf_etc_t +HOME_DIR/\.gconf(/.*)? system_u:object_r:ROLE_gconfd_home_t +HOME_DIR/\.gconfd(/.*)? system_u:object_r:ROLE_gconfd_home_t +/tmp/gconfd-USER(/.*)? system_u:object_r:ROLE_gconfd_tmp_t
file_contexts/program/mozilla.fc +0 -2
@@ -3,8 +3,6 @@ HOME_DIR/\.netscape(/.*)? system_u:object_r:ROLE_mozilla_home_t HOME_DIR/\.mozilla(/.*)? system_u:object_r:ROLE_mozilla_home_t HOME_DIR/\.phoenix(/.*)? system_u:object_r:ROLE_mozilla_home_t -HOME_DIR/\.gconfd(/.*)? system_u:object_r:ROLE_mozilla_home_t -HOME_DIR/\.gconf(/.*)? system_u:object_r:ROLE_mozilla_home_t HOME_DIR/\.gnome2/epiphany(/.*)? system_u:object_r:ROLE_mozilla_home_t HOME_DIR/My.Downloads(/.*)? system_u:object_r:ROLE_mozilla_home_t HOME_DIR/\.java(/.*)? system_u:object_r:ROLE_mozilla_home_t
macros/base_user_macros.te +6 -4
@@ -183,7 +183,6 @@ ifdef(`tvtime.te', `tvtime_domain($1)') ifdef(`mozilla.te', `mozilla_domain($1)') ifdef(`samba.te', `samba_domain($1)') -ifdef(`games.te', `games_domain($1)') ifdef(`gpg.te', `gpg_domain($1)') ifdef(`xauth.te', `xauth_domain($1)') ifdef(`startx.te', `xserver_domain($1)')
@@ -196,10 +195,13 @@ ifdef(`uml.te', `uml_domain($1)') ifdef(`cdrecord.te', `cdrecord_domain($1)') ifdef(`mplayer.te', `mplayer_domains($1)') -ifdef(`gift.te', `gift_domains($1)') -# ORBit -orbit_domain($1, $1) +# GNOME +ifdef(`gnome.te', ` +gnome_domain($1) +ifdef(`games.te', `games_domain($1)') +ifdef(`gift.te', `gift_domains($1)') +') # Instantiate a derived domain for user cron jobs. ifdef(`crond.te', `crond_domain($1)')
macros/program/games_domain.te +3 -0
@@ -55,6 +55,9 @@ allow $1_games_t $1_home_dir_t:dir { read getattr search }; allow $1_games_t $1_home_t:dir { read getattr }; +# Connect to gconf +gconf_client($1_games, $1) + create_dir_file($1_games_t, $1_tmp_t) allow $1_games_t $1_tmp_t:sock_file create_file_perms;
macros/program/gconf_macros.te +64 -0
64 lines not on this page · raw message
macros/program/gift_macros.te +6 -5
@@ -38,6 +38,9 @@ # Fonts, icons r_dir_file($1_gift_t, usr_t) +# Connect to gconf +gconf_client($1_gift, $1) + # Launch gift daemon allow $1_gift_t bin_t:dir search; allow $1_gift_t self:process { fork signal_perms getsched };
@@ -55,11 +58,6 @@ allow $1_gift_t etc_t:file { getattr read }; allow $1_gift_t etc_runtime_t:file { getattr read }; -# ORBit connection to ROLE_t -# FIXME: restrict further -orbit_domain($1_gift, $1) -orbit_connect($1_gift, $1) - # Access random device allow $1_gift_t urandom_device_t:chr_file { read getattr ioctl };
@@ -99,6 +97,9 @@ # Access home domain home_domain_access($1_giftd_t, $1, gift) + +# Allow gift to create untrusted content +create_dir_file($1_giftd_t, $1_untrusted_content_t) # Allow networking allow $1_giftd_t port_t:tcp_socket { name_bind name_connect };
macros/program/gnome_macros.te +17 -0
@@ -0,0 +1,17 @@ +# +# GNOME related types +# +# Author: Ivan Gyurdiev <[email protected]> +# +# gnome_domain(role_prefix) - create GNOME domain + +define(`gnome_domain', ` + +# FIXME: more to be added.. + +gconfd_domain($1) +gconf_client($1, $1) + +orbit_domain($1) + +') dnl gnome_domain
macros/program/mozilla_macros.te +11 -5
@@ -61,6 +61,17 @@ # Fonts, icons allow $1_mozilla_t usr_t:{ lnk_file file } { getattr read }; +# GNOME integration +ifdef(`gnome.te', ` + +# ORBit connection to ROLE_t +# FIXME: restrict further +orbit_domain($1_mozilla, $1) +orbit_connect($1_mozilla, $1) + +gconf_client($1_mozilla, $1) +') + # Access /proc allow $1_mozilla_t proc_t:dir search; allow $1_mozilla_t proc_t:file { getattr read };
@@ -97,11 +108,6 @@ # Execute downloaded programs. can_exec($1_mozilla_t, $1_mozilla_tmp_t) -# ORBit connection to ROLE_t -# FIXME: restrict further -orbit_domain($1_mozilla, $1) -orbit_connect($1_mozilla, $1) - # Allow mozilla to read user home content if (mozilla_readhome || mozilla_writehome) { r_dir_file($1_mozilla_t, $1_home_t)
Quoted 5 lines
04-gconfd.diff -
introduce policy for GConf, and a gnome
container domain that will be used to instantiate
a lot of stuff in the future
There's two lines in here about untrusted_content_t in gift that shouldn't be there - you can erase those...
Signature · 8 lines
Ivan Gyurdiev <[email protected]> Cornell University -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.