: evolution/thunderbird/gconf/orbit/other stuff - comments?
PATCH 1/1 : evolution/thunderbird/gconf/orbit/other stuff - comments?
Features:
- policy for evolution
- policy for thunderbird
- policy for generic mail client that they derive from
- policy for gconf
- common gnome macros (mozilla, evolution, thunderbird, gift, games, gconf) use those
- macro for secure storage at .gnome(2)_private
- attempt at per role fonts
- per application labeled orbit sockets
- per application labeled ice sockets ( this is rather broken right now )
- begin structuring things to confine bonobo in the future
- introduce untrusted type, but don't do anything with it yet
- restricted home_domain macro set to allow specifying transition class in /home.
Default is now { dir } only, which is more restrictive than before.
- rework gift networking rules
- start writing ethereal policy ( not finished )
- bugfixes
I believe this is against selinux-policy-strict-sources-1.23.17-2
Issues:
(see my other message (nsa-list) - file_type_auto_trans is not sufficient)
- need to patch libfontconfig to create font cache with proper type
- need to patch libgnome to create .gnome2 .gnome2_private, and .gnome2/share/*fonts*
with correct type
- need to patch ORBit to create /tmp/orbit-* with correct type
- need to patch libICE to create /tmp/.ICE_unix with correct type
- need to give getfscreate/setfscreate privileges to all of those (just like it's done for orbit_domain)
- need to patch evolution to create autosave composer files in ~~/.evolution, not in $HOME
- need to fix everything relating to $HOME/.ICEauthority
- need to finish evolution exchange policy
- need to finish ethereal policy
- need to update boolean file
Status:
- can log in with almost no denials. There are the usual strict policy bugs, there's some iceauth related denials, but nothing too bad. Evolution works, but it keeps popping up warning boxes every 15 seconds saying it can't write its autosave files to $HOME - that needs to be patched.
Signature · 2 lines
Ivan Gyurdiev <[email protected]> Cornell University
domains/program/ethereal.te +73 -0
@@ -0,0 +1,73 @@ +# DESC - Ethereal +# +# Author: Ivan Gyurdiev <[email protected]> +# + +# Type for executables +type tethereal_exec_t, file_type, exec_type, sysadmfile; +type ethereal_exec_t, file_type, exec_type, sysadmfile; + +######################################################## +# ethereal_common(app_prefix) - common ethereal rules +# +define(`ethereal_common', ` + +uses_shlib($1_t) +read_locale($1_t) + +# Terminal output +access_terminal($1_t, sysadm) + +# /proc +read_sysctl($1_t) +allow $1_t { self proc_t }:dir { read search getattr }; +allow $1_t { self proc_t }:{ file lnk_file } { read getattr }; + +# Access root +allow $1_t root_t:dir search; + +# Read ethereal files in /usr +allow $1_t usr_t:file { read getattr }; + +# /etc/nsswitch.conf +allow $1_t etc_t:file { read getattr }; + +# Networking privileges +allow $1_t self:netlink_route_socket create_netlink_socket_perms; +allow $1_t self:unix_stream_socket create_stream_socket_perms; +allow $1_t self:udp_socket create_socket_perms; +allow $1_t self:packet_socket create_socket_perms; + +') dnl ethereal_common + +######################################################## +# Tethereal +# + +# Type for program +type tethereal_t, domain, nscd_client_domain; + +# Transition from sysadm type +domain_auto_trans(sysadm_t, tethereal_exec_t, tethereal_t) +role sysadm_r types tethereal_t; + +# Ethereal common +ethereal_common(tethereal) + +######################################################## +# Ethereal (GNOME) +# + +ifdef(`gnome.te', ` + +# Type for program +type ethereal_t, domain, nscd_client_domain; + +# Transition from sysadm type +domain_auto_trans(sysadm_t, ethereal_exec_t, ethereal_t) +role sysadm_r types ethereal_t; + +# Ethereal common +ethereal_common(ethereal) + +') dnl gnome.te
domains/program/evolution.te +13 -0
@@ -0,0 +1,13 @@ +# DESC - Evolution +# +# Author: Ivan Gyurdiev <[email protected]> +# + +# Type for executables +type evolution_exec_t, file_type, exec_type, sysadmfile; +type evolution_server_exec_t, file_type, exec_type, sysadmfile; +type evolution_webcal_exec_t, file_type, exec_type, sysadmfile; +type evolution_alarm_exec_t, file_type, exec_type, sysadmfile; +type evolution_exchange_exec_t, file_type, exec_type, sysadmfile; + +# Everything else is in macros/evolution_macros.te
domains/program/gconf.te +12 -0
@@ -0,0 +1,12 @@ +# DESC - GConf preference daemon +# +# Author: Ivan Gyurdiev <[email protected]> +# + +# Type for executable +type gconfd_exec_t, file_type, exec_type, sysadmfile; + +# Type for /etc files +type gconf_etc_t, file_type, sysadmfile; + +# Everything else is in macros/gconfd_macros.te
domains/program/gift.te +13 -0
@@ -0,0 +1,13 @@ +# DESC - giFT file sharing tool +# +# Author: Ivan Gyurdiev <[email protected]> +# + +type gift_exec_t, file_type, exec_type, sysadmfile; +type giftd_exec_t, file_type, exec_type, sysadmfile; +type giftd_port_t, port_type; +type giftd_openft_port_t, port_type; +type giftd_fasttrack_port_t, port_type; +type giftd_gnutella_port_t, port_type; + +# Everything else is in macros/gift_macros.te
domains/program/gnome.te +7 -0
@@ -0,0 +1,7 @@ +# +# GNOME related types +# +# Author: Ivan Gyurdiev <[email protected]> +# + +# Look in gnome_macros.te
domains/program/iceauth.te +12 -0
@@ -0,0 +1,12 @@ +#DESC ICEauth - ICE authority file utility +# +# Domains for the iceauth program. +# +# Author: Ivan Gyurdiev <[email protected]> +# +# iceauth_exec_t is the type of the xauth executable. +# +type iceauth_exec_t, file_type, sysadmfile; + +# Everything else is in the iceauth_domain macro in +# macros/program/iceauth_macros.te.
domains/program/orbit.te +7 -0
@@ -0,0 +1,7 @@ +# +# ORBit related types +# +# Author: Ivan Gyurdiev <[email protected]> +# + +# Look in orbit_macros.te
domains/program/thunderbird.te +9 -0
@@ -0,0 +1,9 @@ +# DESC - Thunderbird +# +# Author: Ivan Gyurdiev <[email protected]> +# + +# Type for executables +type thunderbird_exec_t, file_type, exec_type, sysadmfile; + +# Everything else is in macros/thunderbird_macros.te
domains/program/unused/gift.te +4 -0
@@ -5,5 +5,9 @@ type gift_exec_t, file_type, exec_type, sysadmfile; type giftd_exec_t, file_type, exec_type, sysadmfile; +type giftd_port_t, port_type; +type giftd_openft_port_t, port_type; +type giftd_fasttrack_port_t, port_type; +type giftd_gnutella_port_t, port_type; # Everything else is in macros/gift_macros.te
domains/program/xdm.te +5 -0
@@ -279,6 +279,11 @@ # Search /var/run. allow xdm_xserver_t var_run_t:dir search; +# FIXME: After per user fonts are properly working +# xdm_xserver_t may no longer have any reason +# to read ROLE_home_t - examine this in more detail +# (xauth?) + # Search home directories. allow xdm_xserver_t user_home_type:dir search; allow xdm_xserver_t user_home_type:file { getattr read };
domains/program/xserver.te +2 -2
@@ -14,8 +14,8 @@ type xkb_var_lib_t, file_type, sysadmfile, usercanread; typealias xkb_var_lib_t alias var_lib_xkb_t; -# Allow the xserver to check for fonts in ~/.gnome or ~/.kde -bool allow_xserver_home_fonts false; +# type for /tmp/.ICE-unix +type ice_tmp_t, file_type, sysadmfile, tmpfile; # Everything else is in the xserver_domain macro in # macros/program/xserver_macros.te.
file_contexts/distros.fc +1 -0
@@ -31,6 +31,7 @@ /usr/share/system-config-network/neat-control\.py -- system_u:object_r:bin_t /usr/share/system-config-nfs/nfs-export\.py -- system_u:object_r:bin_t /usr/share/pydict/pydict\.py -- system_u:object_r:bin_t +/opt/rhqa/inventory/client/inventory\.py -- system_u:object_r:bin_t /usr/share/cvs/contrib/rcs2log -- system_u:object_r:bin_t /usr/share/pwlib/make/ptlib-config -- system_u:object_r:bin_t /usr/share/texmf/web2c/mktexdir -- system_u:object_r:bin_t
file_contexts/program/ethereal.fc +2 -0
@@ -0,0 +1,2 @@ +/usr/sbin/tethereal.* -- system_u:object_r:tethereal_exec_t +/usr/bin/ethereal.* -- system_u:object_r:ethereal_exec_t
file_contexts/program/evolution.fc +7 -0
@@ -0,0 +1,7 @@ +/usr/bin/evolution.* -- system_u:object_r:evolution_exec_t +/usr/libexec/evolution/.*evolution-alarm-notify.* -- system_u:object_r:evolution_alarm_exec_t +/usr/libexec/evolution/.*evolution-exchange-storage.* -- system_u:object_r:evolution_exchange_exec_t +/usr/libexec/evolution-data-server.* -- system_u:object_r:evolution_server_exec_t +/usr/libexec/evolution-webcal.* -- system_u:object_r:evolution_webcal_exec_t +HOME_DIR/\.evolution(/.*)? system_u:object_r:ROLE_evolution_home_t +HOME_DIR/\.camel_certs(/.*)? system_u:object_r:ROLE_evolution_home_t
file_contexts/program/fontconfig.fc +4 -2
@@ -1,2 +1,4 @@ -HOME_DIR/\.fonts(/.*)? system_u:object_r:ROLE_fonts_t -HOME_DIR/\.fonts.cache-1 -- system_u:object_r:ROLE_fonts_cache_t +# FIXME: Those will be created with the wrong type +HOME_DIR/\.fonts.conf -- system_u:object_r:ROLE_fonts_config_t +HOME_DIR/\.fonts(/.*)? system_u:object_r:ROLE_fonts_t +HOME_DIR/\.fonts.cache-.* -- system_u:object_r:ROLE_fonts_cache_t
file_contexts/program/gconf.fc +5 -0
@@ -0,0 +1,5 @@ +/usr/libexec/gconfd-2 -- system_u:object_r:gconfd_exec_t +/etc/gconf(/.*)? system_u:object_r:gconf_etc_t +HOME_DIR/\.gconf(/.*)? system_u:object_r:ROLE_gconfd_home_t +HOME_DIR/\.gconfd(/.*)? system_u:object_r:ROLE_gconfd_home_t +/tmp/gconfd-USER(/.*)? system_u:object_r:ROLE_gconfd_tmp_t
file_contexts/program/gnome.fc +9 -0
@@ -0,0 +1,9 @@ +# FIXME: add a lot more GNOME folders +# FIXME: Those folders will be created with the wrong type +HOME_DIR/\.gnome(2)?(/.*)? system_u:object_r:ROLE_gnome_settings_t +HOME_DIR/\.gnome(2)?_private(/.*)? system_u:object_r:ROLE_gnome_secret_t +ifdef(`evolution.te', ` +HOME_DIR/\.gnome(2)?_private/Evolution -- system_u:object_r:ROLE_evolution_secret_t +') +HOME_DIR/\.gnome(2)?/share/fonts(/.*)? system_u:object_r:ROLE_fonts_t +HOME_DIR/\.gnome(2)?/share/cursor-fonts(/.*)? system_u:object_r:ROLE_fonts_t
file_contexts/program/iceauth.fc +3 -0
@@ -0,0 +1,3 @@ +# iceauth +/usr/X11R6/bin/iceauth -- system_u:object_r:iceauth_exec_t +HOME_DIR/\.ICEauthority.* -- system_u:object_r:ROLE_iceauth_home_t
file_contexts/program/mozilla.fc +0 -3
@@ -3,9 +3,6 @@ HOME_DIR/\.netscape(/.*)? system_u:object_r:ROLE_mozilla_home_t HOME_DIR/\.mozilla(/.*)? system_u:object_r:ROLE_mozilla_home_t HOME_DIR/\.phoenix(/.*)? system_u:object_r:ROLE_mozilla_home_t -HOME_DIR/\.gconfd(/.*)? system_u:object_r:ROLE_mozilla_home_t -HOME_DIR/\.gconf(/.*)? system_u:object_r:ROLE_mozilla_home_t -HOME_DIR/\.gnome2/epiphany(/.*)? system_u:object_r:ROLE_mozilla_home_t HOME_DIR/My.Downloads(/.*)? system_u:object_r:ROLE_mozilla_home_t HOME_DIR/\.java(/.*)? system_u:object_r:ROLE_mozilla_home_t /usr/bin/netscape -- system_u:object_r:mozilla_exec_t
file_contexts/program/orbit.fc +3 -0
@@ -0,0 +1,3 @@ +/tmp/orbit-USER(-.*)? -d system_u:object_r:ROLE_orbit_tmp_t +/tmp/orbit-USER(-.*)?/linc.* -s <<none>> +/tmp/orbit-USER(-.*)?/bonobo.* system_u:object_r:ROLE_orbit_tmp_t
file_contexts/program/thunderbird.fc +2 -0
@@ -0,0 +1,2 @@ +/usr/bin/thunderbird.* -- system_u:object_r:thunderbird_exec_t +HOME_DIR/\.thunderbird(/.*)? system_u:object_r:ROLE_thunderbird_home_t
file_contexts/program/xserver.fc +1 -1
@@ -13,5 +13,5 @@ /etc/init\.d/xfree86-common -- system_u:object_r:xserver_exec_t /tmp/\.X11-unix -d system_u:object_r:xdm_tmp_t /tmp/\.X11-unix/.* -s <<none>> -/tmp/\.ICE-unix -d system_u:object_r:xdm_xserver_tmp_t +/tmp/\.ICE-unix -d system_u:object_r:ice_tmp_t /tmp/\.ICE-unix/.* -s <<none>>
file_contexts/types.fc +1 -0
@@ -499,6 +499,7 @@ # /usr/lib(64)?/[^/]*thunderbird[^/]*/thunderbird -- system_u:object_r:bin_t /usr/lib(64)?/[^/]*thunderbird[^/]*/thunderbird-bin -- system_u:object_r:bin_t +/usr/lib(64)?/[^/]*thunderbird[^/]*/open-browser\.sh -- system_u:object_r:bin_t /usr/lib(64)?/[^/]*thunderbird[^/]*/run-mozilla\.sh -- system_u:object_r:bin_t /usr/lib(64)?/[^/]*thunderbird[^/]*/mozilla-xremote-client -- system_u:object_r:bin_t
macros/base_user_macros.te +24 -4
@@ -22,6 +22,14 @@ undefine(`base_user_domain') define(`base_user_domain', ` +# Type for network-obtained content +type $1_untrusted_content_t, file_type, $1_file_type, sysadmfile, customizable; +bool $1_access_untrusted_content false; +if ($1_access_untrusted_content) { +rw_dir_file($1_t, $1_untrusted_content_t) +} +#allow $1_t $1_untrusted_content_t:{ dir file } { relabelto relabelfrom }; + allow $1_t self:capability { setgid chown fowner }; dontaudit $1_t self:capability { sys_nice fsetid };
@@ -182,10 +190,11 @@ ifdef(`screen.te', `screen_domain($1)') ifdef(`tvtime.te', `tvtime_domain($1)') ifdef(`mozilla.te', `mozilla_domain($1)') +ifdef(`thunderbird.te', `thunderbird_domain($1)') ifdef(`samba.te', `samba_domain($1)') -ifdef(`games.te', `games_domain($1)') ifdef(`gpg.te', `gpg_domain($1)') ifdef(`xauth.te', `xauth_domain($1)') +ifdef(`iceauth.te', `iceauth_domain($1)') ifdef(`startx.te', `xserver_domain($1)') ifdef(`lpr.te', `lpr_domain($1)') ifdef(`ssh.te', `ssh_domain($1)')
@@ -196,10 +205,23 @@ ifdef(`uml.te', `uml_domain($1)') ifdef(`cdrecord.te', `cdrecord_domain($1)') ifdef(`mplayer.te', `mplayer_domains($1)') -ifdef(`gift.te', `gift_domains($1)') fontconfig_domain($1) +# GNOME +ifdef(`gnome.te', ` +gnome_domain($1) +ifdef(`games.te', `games_domain($1)') +ifdef(`gift.te', `gift_domains($1)') +ifdef(`evolution.te', `evolution_domains($1)') +') + +# ICE communication channel +ice_domain($1, $1) + +# ORBit communication channel (independent of GNOME) +orbit_domain($1, $1) + # Instantiate a derived domain for user cron jobs. ifdef(`crond.te', `crond_domain($1)')
@@ -294,8 +316,6 @@ x_client_domain($1, $1) ifdef(`xserver.te', ` -# for /tmp/.ICE-unix -file_type_auto_trans($1_t, xdm_xserver_tmp_t, $1_tmp_t, sock_file) allow $1_t xserver_misc_device_t:{ chr_file blk_file } rw_file_perms; ')
macros/global_macros.te +19 -18
@@ -60,7 +60,7 @@ # read_sysctl(domain) # # Permissions for reading sysctl variables. -# If the second parameter is 'full', allow +# If the second parameter is full, allow # reading of any sysctl variables, else only # sysctl_kernel_t. #
@@ -292,7 +292,7 @@ # Define a daemon domain with a base set of type declarations # and permissions that are common to most daemons. # attribs is the list of attributes which must start with "," if it is not empty -# `nosysadm' may be given as an optional third parameter, to specify that the +# nosysadm may be given as an optional third parameter, to specify that the # sysadmin should not transition to the domain when directly calling the executable # # Author: Russell Coker <[email protected]>
@@ -520,11 +520,13 @@ ') dnl home_domain_ro_access #################################################################### -# home_domain_access(source, user, app) +# home_domain_access(source, user, app, trans_classes) # # Gives source full access to the home # domain of app for the given user type # +# You can also specify the transition classes +# By default the only trans. class in /home is dir define(`home_domain_access', `
@@ -538,16 +540,24 @@ } allow $1 autofs_t:dir { search getattr }; -file_type_auto_trans($1, $2_home_dir_t, $2_$3_home_t) +create_dir_file($1, $2_$3_home_t) + +ifelse($4, `', ` +file_type_auto_trans($1, $2_home_dir_t, $2_$3_home_t, dir) +', ` +file_type_auto_trans($1, $2_home_dir_t, $2_$3_home_t, $4) +') ') dnl home_domain_access #################################################################### -# home_domain (prefix, app) +# home_domain (prefix, app, trans_classes) # # Creates a domain in the prefix home where an application can -# store its settings. It's accessible by the prefix domain. +# store its settings. It is accessible by the prefix domain. # +# You can also specify the transition classes +# By default the only trans. class in /home is dir define(`home_domain', `
@@ -565,15 +575,15 @@ allow $1_t $1_$2_home_t:{ dir file lnk_file } { relabelfrom relabelto }; # App side access -home_domain_access($1_$2_t, $1, $2) +home_domain_access($1_$2_t, $1, $2, $3) ') #################################################################### # home_domain_ro (user, app) # # Creates a read-only domain in the user home where an application can -# store its settings. It's fully accessible by the user, but -# it's read-only for the application. +# store its settings. It is fully accessible by the user, but +# it is read-only for the application. # define(`home_domain_ro', `
@@ -797,12 +807,3 @@ ') ')dnl end unconfined_domain -# Author: Ivan Gyurdiev <[email protected]> -# -# read_fonts(domain, role_prefix) - -# allow domain to read fonts, optionally per/user -# -define(`read_fonts', ` -r_dir_file($1, fonts_t) -') -
macros/program/bonobo_macros.te +60 -0
60 lines not on this page · raw message
macros/program/evolution_macros.te +247 -0
247 lines not on this page · raw message
macros/program/fontconfig_macros.te +27 -5
@@ -8,17 +8,39 @@ # read_fonts(domain, role_prefix) - # allow domain to read fonts, optionally per/user # -# dontaudit_home_fonts(domain, role_prefix) - -# block the denials of home fonts - hack for X define(`fontconfig_domain', ` -type $1_fonts_t, file_type, $1_file_type, sysadmfile, customizable; +type $1_fonts_t, file_type, $1_file_type, sysadmfile; +type $1_fonts_config_t, file_type, $1_file_type, sysadmfile; type $1_fonts_cache_t, file_type, $1_file_type, sysadmfile; -allow $1_t $1_fonts_cache_t:file create_file_perms; create_dir_file($1_t, $1_fonts_t) +allow $1_t $1_fonts_t:{ dir file } { relabelto relabelfrom }; -') dnl gnome_domain +create_dir_file($1_t, $1_fonts_config_t) +allow $1_t $1_fonts_config_t:file { relabelto relabelfrom }; +') dnl fontconfig_domain +#################### + +define(`read_fonts', ` + +# Read global fonts and font config +r_dir_file($1, fonts_t) +r_dir_file($1, etc_t) + +ifelse(`$2', `', `', ` + +# Automatically manipulated by libfontconfig +allow $1 $2_fonts_cache_t:file create_file_perms; + +# Read per user fonts and font config +r_dir_file($1, $2_fonts_t) +r_dir_file($1, $2_fonts_config_t) + +# There are some fonts in .gnome2 +allow $1 $2_gnome_settings_t:dir { getattr search }; +') +') dnl read_fonts
macros/program/games_domain.te +18 -20
@@ -22,17 +22,21 @@ can_create_pty($1_games) -# X access, /tmp files +# X access, GNOME, /tmp files x_client_domain($1_games, $1) tmp_domain($1_games, `', { dir notdevfile_class_set }) +gnome_application($1_games, $1) +gnome_file_dialog($1_games_t) + +# Ice connection to gnome-session +ice_connect($1_games, $1) -uses_shlib($1_games_t) -read_locale($1_games_t) read_sysctl($1_games_t) -access_terminal($1_games_t, $1) +dontaudit $1_games_t sysctl_t:dir search; # Fork allow $1_games_t self:process { fork signal_perms getsched }; +allow $1_games_t self:fifo_file rw_file_perms; # Games seem to need this if (allow_execmem) {
@@ -46,30 +50,26 @@ allow $1_games_t var_t:dir { search getattr }; rw_dir_create_file($1_games_t, games_data_t) allow $1_games_t sound_device_t:chr_file rw_file_perms; -r_dir_file($1_games_t, usr_t) can_udp_send($1_games_t, $1_games_t) can_tcp_connect($1_games_t, $1_games_t) # Access /home/user/.gnome2 -create_dir_file($1_games_t, $1_home_t) -allow $1_games_t $1_home_dir_t:dir { read getattr search }; -allow $1_games_t $1_home_t:dir { read getattr }; +# FIXME: Change to use per app types +create_dir_file($1_games_t, $1_gnome_settings_t) +# FIXME: why is this necessary - ORBit? +# ORBit works differently now create_dir_file($1_games_t, $1_tmp_t) allow $1_games_t $1_tmp_t:sock_file create_file_perms; +can_unix_connect($1_t, $1_games_t) +can_unix_connect($1_games_t, $1_t) -dontaudit $1_games_t sysctl_t:dir search; - -allow $1_games_t urandom_device_t:chr_file { getattr ioctl read }; ifdef(`xdm.te', ` allow $1_games_t xdm_tmp_t:dir rw_dir_perms; allow $1_games_t xdm_tmp_t:sock_file create_file_perms; allow $1_games_t xdm_var_lib_t:file { getattr read }; ')dnl end if xdm.te -can_unix_connect($1_t, $1_games_t) -can_unix_connect($1_games_t, $1_t) - allow $1_games_t var_lib_t:dir search; r_dir_file($1_games_t, man_t) allow $1_games_t { proc_t self }:dir search;
@@ -79,9 +79,8 @@ ') allow $1_games_t event_device_t:chr_file getattr; allow $1_games_t mouse_device_t:chr_file getattr; -allow $1_games_t self:file { getattr read }; -allow $1_games_t self:fifo_file rw_file_perms; +allow $1_games_t self:file { getattr read }; allow $1_games_t self:sem create_sem_perms; allow $1_games_t { bin_t sbin_t }:dir { getattr search };
@@ -92,13 +91,12 @@ dontaudit $1_games_t initrc_var_run_t:file { read write }; dontaudit $1_games_t var_log_t:dir search; -# Allow games to read /etc/mtab and /etc/nsswitch.conf -allow $1_games_t etc_t:file { getattr read }; -allow $1_games_t etc_runtime_t:file { getattr read }; - can_network($1_games_t) allow $1_games_t port_t:tcp_socket name_bind; allow $1_games_t port_t:tcp_socket name_connect; +# Suppress .icons denial until properly implemented +dontaudit $1_games_t $1_home_t:dir read; + ')dnl end macro definition
macros/program/gconf_macros.te +58 -0
58 lines not on this page · raw message
macros/program/gift_macros.te +19 -42
94 lines not on this page · raw message
macros/program/gnome_macros.te +90 -0
90 lines not on this page · raw message
macros/program/iceauth_macros.te +22 -0
@@ -0,0 +1,22 @@ +# +# Macros for iceauth domains. +# +# Author: Ivan Gyurdiev <[email protected]> +# +# iceauth_domain(domain_prefix) + +define(`iceauth_domain',` + +# Program type +type $1_iceauth_t, domain; + +# Transition from the user domain to this domain. +domain_auto_trans($1_t, iceauth_exec_t, $1_iceauth_t) +role $1_r types $1_iceauth_t; + +# Store .ICEauthority files +home_domain($1, iceauth, file) + +# FIXME: policy is incomplete + +')dnl end xauth_domain macro
macros/program/ice_macros.te +52 -0
52 lines not on this page · raw message
macros/program/mail_client_macros.te +60 -0
60 lines not on this page · raw message
macros/program/mozilla_macros.te +23 -29
132 lines not on this page · raw message
macros/program/orbit_macros.te +51 -0
51 lines not on this page · raw message
macros/program/spamassassin_macros.te +5 -2
@@ -29,7 +29,7 @@ # Note: most of this should really be in a generic macro like # base_user_program($1, foo) define(`spamassassin_program_domain',` -type $1_$2_t, domain, privlog; +type $1_$2_t, domain, privlog $3; domain_auto_trans($1_t, $2_exec_t, $1_$2_t) role $1_r types $1_$2_t;
@@ -76,6 +76,7 @@ allow $1_spamassassin_t lib_t:file rx_file_perms; # Ignore perl digging in /proc and /var. dontaudit $1_spamassassin_t proc_t:dir search; +dontaudit $1_spamassassin_t proc_t:lnk_file read; dontaudit $1_spamassassin_t { sysctl_t sysctl_kernel_t }:dir search; # For ~/.spamassassin
@@ -95,7 +96,7 @@ # Define the domain for /usr/bin/spamc # ifdef(`spamc.te',` -spamassassin_program_domain($1, spamc) +spamassassin_program_domain($1, spamc, `, nscd_client_domain') can_network($1_spamc_t) allow $1_spamc_t port_type:tcp_socket name_connect; can_ypbind($1_spamc_t)
@@ -103,6 +104,8 @@ # Allow connecting to a local spamd ifdef(`spamd.te',` can_tcp_connect($1_spamc_t, spamd_t) +can_unix_connect($1_spamc_t, spamd_t) +allow $1_spamc_t spamd_tmp_t:sock_file rw_file_perms; ') dnl endif spamd.te ') dnl endif spamc.te
macros/program/thunderbird_macros.te +63 -0
63 lines not on this page · raw message
macros/program/xauth_macros.te +1 -1
@@ -23,7 +23,7 @@ allow $1_xauth_t self:process signal; -home_domain($1, xauth) +home_domain($1, xauth, file) # Transition from the user domain to this domain. domain_auto_trans($1_t, xauth_exec_t, $1_xauth_t)
macros/program/x_client_macros.te +0 -4
@@ -16,10 +16,6 @@ # Connect to xserver can_unix_connect($1_t, $2_xserver_t) -# /tmp/.ICE_unix -allow $1_t $2_xserver_tmp_t:dir search; -allow $1_t $2_xserver_tmp_t:sock_file rw_file_perms; - # Stat /tmp/.X0-lock allow $1_t $2_xserver_tmp_t:file getattr;
macros/program/xserver_macros.te +10 -7
@@ -79,6 +79,12 @@ allow xdm_xserver_t init_t:fd use; dontaudit xdm_xserver_t home_dir_type:dir { read search }; + +# Read all global and per user fonts +read_fonts($1_xserver_t, sysadm) +read_fonts($1_xserver_t, staff) +read_fonts($1_xserver_t, user) + ', ` # The user role is authorized for this domain. role $1_r types $1_xserver_t;
@@ -92,12 +98,13 @@ can_unix_connect($1_t, $1_xserver_t) +# Read fonts +read_fonts($1_xserver_t, $1) + # Access the home directory. allow $1_xserver_t home_root_t:dir search; allow $1_xserver_t $1_home_dir_t:dir { getattr search }; -if (allow_xserver_home_fonts) { -r_dir_file($1_xserver_t, $1_home_t) -} + ifdef(`xauth.te', ` domain_auto_trans($1_xserver_t, xauth_exec_t, $1_xauth_t) allow $1_xserver_t $1_xauth_home_t:file { getattr read };
@@ -174,8 +181,6 @@ ifdef(`xdm.te', ` allow $1_t xdm_tmp_t:sock_file unlink; allow $1_xserver_t xdm_var_run_t:dir search; -# for /tmp/.ICE-unix -file_type_auto_trans($1_t, xdm_xserver_tmp_t, $1_tmp_t, sock_file) ') # Signal the user domain.
@@ -263,8 +268,6 @@ allow $1_xserver_t var_lib_t:dir search; rw_dir_create_file($1_xserver_t, xkb_var_lib_t) -# for fonts -r_dir_file($1_xserver_t, fonts_t) ')dnl end macro definition ', `
net_contexts +8 -0
@@ -136,6 +136,14 @@ portcon tcp 995 system_u:object_r:pop_port_t portcon tcp 1109 system_u:object_r:pop_port_t ') +ifdef(`gift.te', ` +portcon tcp 1213 system_u:object_r:giftd_port_t +portcon tcp 1214 system_u:object_r:giftd_fasttrack_port_t +portcon udp 1214 system_u:object_r:giftd_fasttrack_port_t +portcon tcp 2141 system_u:object_r:giftd_openft_port_t +portcon tcp 2513 system_u:object_r:giftd_openft_port_t +portcon tcp 3606 system_u:object_r:giftd_gnutella_port_t +') ifdef(`nessusd.te', `portcon tcp 1241 system_u:object_r:nessus_port_t') ifdef(`monopd.te', `portcon tcp 1234 system_u:object_r:monopd_port_t') ifdef(`radius.te', `
types/network.te +2 -0
@@ -39,6 +39,8 @@ ifdef(`dovecot.te', `define(`use_pop')') ifdef(`uwimapd.te', `define(`use_pop')') ifdef(`fetchmail.te', `define(`use_pop')') +ifdef(`thunderbird.te', `define(`use_pop')') +ifdef(`evolution.te', `define(`use_pop')') ifdef(`use_pop', ` type pop_port_t, port_type, reserved_port_type; ')