|
 |
b63e47 |
diff --color -ru a/fapolicyd-selinux-0.4/fapolicyd.if b/fapolicyd-selinux-0.4/fapolicyd.if
|
|
|
b63e47 |
--- a/fapolicyd-selinux-0.4/fapolicyd.if 2021-03-23 10:21:31.000000000 +0100
|
|
|
b63e47 |
+++ b/fapolicyd-selinux-0.4/fapolicyd.if 2021-12-14 13:35:17.842430123 +0100
|
|
|
afdf34 |
@@ -2,6 +2,122 @@
|
|
|
afdf34 |
|
|
|
afdf34 |
########################################
|
|
|
afdf34 |
## <summary>
|
|
|
afdf34 |
+## Watch_mount directories in /boot.
|
|
|
afdf34 |
+## </summary>
|
|
|
afdf34 |
+## <param name="domain">
|
|
|
afdf34 |
+## <summary>
|
|
|
afdf34 |
+## Domain allowed access.
|
|
|
afdf34 |
+## </summary>
|
|
|
afdf34 |
+## </param>
|
|
|
afdf34 |
+#
|
|
|
afdf34 |
+
|
|
|
afdf34 |
+ifndef(`files_watch_mount_boot_dirs',`
|
|
|
afdf34 |
+ interface(`files_watch_mount_boot_dirs',`
|
|
|
afdf34 |
+ gen_require(`
|
|
|
afdf34 |
+ type boot_t;
|
|
|
afdf34 |
+ ')
|
|
|
afdf34 |
+
|
|
|
afdf34 |
+ allow $1 boot_t:dir watch_mount_dir_perms;
|
|
|
afdf34 |
+ ')
|
|
|
afdf34 |
+')
|
|
|
afdf34 |
+
|
|
|
afdf34 |
+
|
|
|
afdf34 |
+########################################
|
|
|
afdf34 |
+## <summary>
|
|
|
afdf34 |
+## Watch_mount home directories.
|
|
|
afdf34 |
+## </summary>
|
|
|
afdf34 |
+## <param name="domain">
|
|
|
afdf34 |
+## <summary>
|
|
|
afdf34 |
+## Domain allowed access.
|
|
|
afdf34 |
+## </summary>
|
|
|
afdf34 |
+## </param>
|
|
|
afdf34 |
+#
|
|
|
afdf34 |
+
|
|
|
afdf34 |
+ifndef(`files_watch_mount_home',`
|
|
|
afdf34 |
+ interface(`files_watch_mount_home',`
|
|
|
afdf34 |
+ gen_require(`
|
|
|
afdf34 |
+ type home_root_t;
|
|
|
afdf34 |
+ ')
|
|
|
afdf34 |
+
|
|
|
afdf34 |
+ allow $1 home_root_t:dir watch_mount_dir_perms;
|
|
|
afdf34 |
+ ')
|
|
|
afdf34 |
+')
|
|
|
afdf34 |
+
|
|
|
afdf34 |
+
|
|
|
afdf34 |
+########################################
|
|
|
afdf34 |
+## <summary>
|
|
|
afdf34 |
+## Watch_with_perm home directories.
|
|
|
afdf34 |
+## </summary>
|
|
|
afdf34 |
+## <param name="domain">
|
|
|
afdf34 |
+## <summary>
|
|
|
afdf34 |
+## Domain allowed access.
|
|
|
afdf34 |
+## </summary>
|
|
|
afdf34 |
+## </param>
|
|
|
afdf34 |
+#
|
|
|
afdf34 |
+
|
|
|
afdf34 |
+ifndef(`files_watch_with_perm_home',`
|
|
|
afdf34 |
+interface(`files_watch_with_perm_home',`
|
|
|
afdf34 |
+ gen_require(`
|
|
|
afdf34 |
+ type home_root_t;
|
|
|
afdf34 |
+ ')
|
|
|
afdf34 |
+
|
|
|
afdf34 |
+ allow $1 home_root_t:dir watch_with_perm_dir_perms;
|
|
|
afdf34 |
+')
|
|
|
afdf34 |
+')
|
|
|
afdf34 |
+
|
|
|
afdf34 |
+
|
|
|
afdf34 |
+########################################
|
|
|
afdf34 |
+## <summary>
|
|
|
afdf34 |
+## Watch_mount dirs on a DOS filesystem.
|
|
|
afdf34 |
+## </summary>
|
|
|
afdf34 |
+## <param name="domain">
|
|
|
afdf34 |
+## <summary>
|
|
|
afdf34 |
+## Domain allowed access.
|
|
|
afdf34 |
+## </summary>
|
|
|
afdf34 |
+## </param>
|
|
|
afdf34 |
+#
|
|
|
afdf34 |
+
|
|
|
afdf34 |
+ifndef(`fs_watch_mount_dos_dirs',`
|
|
|
afdf34 |
+interface(`fs_watch_mount_dos_dirs',`
|
|
|
afdf34 |
+ gen_require(`
|
|
|
afdf34 |
+ type dosfs_t;
|
|
|
afdf34 |
+ ')
|
|
|
afdf34 |
+
|
|
|
afdf34 |
+ watch_mount_dirs_pattern($1, dosfs_t, dosfs_t)
|
|
|
afdf34 |
+')
|
|
|
afdf34 |
+')
|
|
|
afdf34 |
+
|
|
|
afdf34 |
+
|
|
|
afdf34 |
+
|
|
|
afdf34 |
+########################################
|
|
|
afdf34 |
+## <summary>
|
|
|
afdf34 |
+## Watch_with_perm dirs on a DOS filesystem.
|
|
|
afdf34 |
+## </summary>
|
|
|
afdf34 |
+## <param name="domain">
|
|
|
afdf34 |
+## <summary>
|
|
|
afdf34 |
+## Domain allowed access.
|
|
|
afdf34 |
+## </summary>
|
|
|
afdf34 |
+## </param>
|
|
|
afdf34 |
+#
|
|
|
afdf34 |
+
|
|
|
afdf34 |
+ifndef(`fs_watch_with_perm_dos_dirs',`
|
|
|
afdf34 |
+interface(`fs_watch_with_perm_dos_dirs',`
|
|
|
afdf34 |
+ gen_require(`
|
|
|
afdf34 |
+ type dosfs_t;
|
|
|
afdf34 |
+ ')
|
|
|
afdf34 |
+
|
|
|
afdf34 |
+ watch_with_perm_dirs_pattern($1, dosfs_t, dosfs_t)
|
|
|
afdf34 |
+')
|
|
|
afdf34 |
+')
|
|
|
afdf34 |
+
|
|
|
afdf34 |
+
|
|
|
afdf34 |
+###################################################################################################
|
|
|
afdf34 |
+
|
|
|
afdf34 |
+
|
|
|
afdf34 |
+
|
|
|
afdf34 |
+
|
|
|
afdf34 |
+########################################
|
|
|
afdf34 |
+## <summary>
|
|
|
afdf34 |
## Execute fapolicyd_exec_t in the fapolicyd domain.
|
|
|
afdf34 |
## </summary>
|
|
|
afdf34 |
## <param name="domain">
|
|
|
b63e47 |
diff --color -ru a/fapolicyd-selinux-0.4/fapolicyd.te b/fapolicyd-selinux-0.4/fapolicyd.te
|
|
|
b63e47 |
--- a/fapolicyd-selinux-0.4/fapolicyd.te 2021-03-23 10:21:31.000000000 +0100
|
|
|
b63e47 |
+++ b/fapolicyd-selinux-0.4/fapolicyd.te 2021-12-14 13:35:17.842430123 +0100
|
|
|
afdf34 |
@@ -1,5 +1,6 @@
|
|
|
afdf34 |
policy_module(fapolicyd, 1.0.0)
|
|
|
afdf34 |
|
|
|
afdf34 |
+
|
|
|
afdf34 |
########################################
|
|
|
afdf34 |
#
|
|
|
afdf34 |
# Declarations
|
|
|
b63e47 |
@@ -36,6 +37,12 @@
|
|
|
b63e47 |
allow fapolicyd_t self:unix_stream_socket create_stream_socket_perms;
|
|
|
b63e47 |
allow fapolicyd_t self:unix_dgram_socket create_socket_perms;
|
|
|
b63e47 |
|
|
|
b63e47 |
+gen_require(`
|
|
|
b63e47 |
+ attribute file_type;
|
|
|
b63e47 |
+')
|
|
|
b63e47 |
+allow fapolicyd_t file_type:dir { watch_mount watch_with_perm };
|
|
|
b63e47 |
+allow fapolicyd_t file_type:file { watch_mount watch_with_perm };
|
|
|
b63e47 |
+
|
|
|
b63e47 |
manage_files_pattern(fapolicyd_t, fapolicyd_log_t, fapolicyd_log_t)
|
|
|
b63e47 |
logging_log_filetrans(fapolicyd_t, fapolicyd_log_t, file)
|
|
|
b63e47 |
|
|
|
b63e47 |
@@ -63,14 +70,20 @@
|
|
|
b63e47 |
|
|
|
b63e47 |
files_mmap_usr_files(fapolicyd_t)
|
|
|
b63e47 |
files_read_all_files(fapolicyd_t)
|
|
|
b63e47 |
+files_watch_mount_boot_dirs(fapolicyd_t)
|
|
|
b63e47 |
+files_watch_with_perm_boot_dirs(fapolicyd_t)
|
|
|
b63e47 |
files_watch_mount_generic_tmp_dirs(fapolicyd_t)
|
|
|
b63e47 |
files_watch_with_perm_generic_tmp_dirs(fapolicyd_t)
|
|
|
b63e47 |
+files_watch_mount_home(fapolicyd_t)
|
|
|
b63e47 |
+files_watch_with_perm_home(fapolicyd_t)
|
|
|
b63e47 |
files_watch_mount_root_dirs(fapolicyd_t)
|
|
|
b63e47 |
files_watch_with_perm_root_dirs(fapolicyd_t)
|
|
|
b63e47 |
|
|
|
b63e47 |
fs_getattr_xattr_fs(fapolicyd_t)
|
|
|
b63e47 |
fs_watch_mount_tmpfs_dirs(fapolicyd_t)
|
|
|
b63e47 |
fs_watch_with_perm_tmpfs_dirs(fapolicyd_t)
|
|
|
b63e47 |
+fs_watch_mount_dos_dirs(fapolicyd_t)
|
|
|
b63e47 |
+fs_watch_with_perm_dos_dirs(fapolicyd_t)
|
|
|
b63e47 |
|
|
|
b63e47 |
logging_send_syslog_msg(fapolicyd_t)
|
|
|
b63e47 |
dbus_system_bus_client(fapolicyd_t)
|