#

# This is the guide for converting old macros to local policy

# and new interfaces.

#

# $1, $2, etc. are replaced with and the first and second, etc.

# parameters to the old macro.

#

########################################

#

# Object class sets

#

#

# devfile_class_set

#

{ chr_file blk_file }

#

# dgram_socket_class_set

#

{ udp_socket unix_dgram_socket }

#

# dir_file_class_set

#

{ dir file lnk_file sock_file fifo_file chr_file blk_file }

#

# file_class_set

#

{ file lnk_file sock_file fifo_file chr_file blk_file }

#

# notdevfile_class_set

#

{ file lnk_file sock_file fifo_file }

#

# socket_class_set

#

{ tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_ip6fw_socket netlink_dnrt_socket }

#

# stream_socket_class_set

#

{ tcp_socket unix_stream_socket }

#

# unpriv_socket_class_set

#

{ tcp_socket udp_socket unix_stream_socket unix_dgram_socket }

########################################

#

# Permission Sets

#

#

# connected_socket_perms

#

{ create ioctl read getattr write setattr append bind getopt setopt shutdown }

#

# connected_stream_socket_perms

#

{ create ioctl read getattr write setattr append bind getopt setopt shutdown listen accept }

#

# create_dir_perms

#

{ create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir }

#

# create_file_perms

#

{ create ioctl read getattr lock write setattr append link unlink rename }

#

# create_lnk_perms

#

{ create read getattr setattr link unlink rename }

#

# create_msgq_perms

#

{ associate getattr setattr create destroy read write enqueue unix_read unix_write }

#

# create_netlink_socket_perms

#

{ create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write }

#

# create_sem_perms

#

{ associate getattr setattr create destroy read write unix_read unix_write }

#

# create_shm_perms

#

{ associate getattr setattr create destroy read write lock unix_read unix_write }

#

# create_socket_perms

#

{ create ioctl read getattr write setattr append bind connect getopt setopt shutdown }

#

# create_stream_socket_perms

#

{ create ioctl read getattr write setattr append bind connect getopt setopt shutdown listen accept }

#

# link_file_perms

#

{ getattr link unlink rename }

#

# mount_fs_perms

#

{ mount remount unmount getattr }

#

# packet_perms

#

{ tcp_recv tcp_send udp_recv udp_send rawip_recv rawip_send }

#

# r_dir_perms

#

{ read getattr lock search ioctl }

#

# r_file_perms

#

{ read getattr lock ioctl }

#

# r_msgq_perms

#

{ associate getattr read unix_read }

#

# r_netlink_socket_perms

#

{ create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read }

#

# r_sem_perms

#

{ associate getattr read unix_read }

#

# r_shm_perms

#

{ associate getattr read unix_read }

#

# ra_dir_perms

#

{ read getattr lock search ioctl add_name write }

#

# ra_file_perms

#

{ ioctl read getattr lock append }

#

# rw_dir_perms

#

{ read getattr lock search ioctl add_name remove_name write }

#

# rw_file_perms

#

{ ioctl read getattr lock write append }

#

# rw_msgq_perms

#

{ associate getattr read write enqueue unix_read unix_write }

#

# rw_netlink_socket_perms

#

{ create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write }

#

# rw_sem_perms

#

{ associate getattr read write unix_read unix_write }

#

# rw_shm_perms

#

{ associate getattr read write lock unix_read unix_write }

#

# rw_socket_perms

#

{ ioctl read getattr write setattr append bind connect getopt setopt shutdown }

#

# rw_stream_socket_perms

#

{ ioctl read getattr write setattr append bind connect getopt setopt shutdown listen accept }

#

# rx_file_perms

#

{ read getattr lock execute ioctl }

#

# signal_perms

#

{ sigchld sigkill sigstop signull signal }

#

# stat_file_perms

#

{ getattr }

#

# x_file_perms

#

{ getattr execute }

########################################

#

# Attributes

#

#

# admin_tty_type: complete

#

{ sysadm_tty_device_t sysadm_devpts_t }

#

# file_type: complete

#

files_make_file($1)

#

# privlog: complete

logging_send_system_log_message($1)

#

# privmodule: complete

#

modutils_insmod_transition($1)

########################################

#

# Access macros

#

#

# access_terminal():

#

allow $1 $2_tty_device_t:chr_file { read write getattr ioctl };

allow $1 devtty_t:chr_file { read write getattr ioctl };

allow $1 devpts_t:dir { read search getattr };

allow $1 $2_devpts_t:chr_file { read write getattr ioctl };

#

# admin_domain():

#

#

# append_log_domain():

#

type $1_log_t;

logging_make_log_file($1_log_t)

allow $1_t var_log_t:dir ra_dir_perms;

allow $1_t $1_log_t:file  { create ra_file_perms };

type_transition $1_t var_log_t:file $1_log_t;

#

# append_logdir_domain():

#

type $1_log_t;

logging_make_log_file($1_log_t)

allow $1_t var_log_t:dir ra_dir_perms;

allow $1_t $1_log_t:dir { setattr ra_dir_perms };

allow $1_t $1_log_t:file  { create ra_file_perms };

type_transition $1_t var_log_t:file $1_log_t;

#

# application_domain():

#

type $1_t;

type $1_exec_t;

domain_make_domain($1_t)

domain_make_entrypoint_file($1_t,$1_exec_t)

role sysadm_r types $1_t;

domain_auto_trans(sysadm_t, $1_exec_t, $1_t)

libraries_use_dynamic_loader($1_t)

libraries_read_shared_libraries($1_t)

#

# base_can_network($1,$2):

#

allow $1 self:$2_socket { create ioctl read getattr write setattr append bind getopt setopt shutdown };

corenetwork_network_$2_on_all_interfaces($1)

corenetwork_network_raw_on_all_interfaces($1)

corenetwork_network_$2_on_all_nodes($1)

corenetwork_network_raw_on_all_nodes($1)

corenetwork_bind_$2_on_all_nodes($1)

corenetwork_network_$2_on_all_ports($1)

sysnetwork_read_network_config($1)

#

# base_can_network($1,$2,$3):

#

allow $1 self:$2_socket { create ioctl read getattr write setattr append bind getopt setopt shutdown };

corenetwork_network_$2_on_all_interfaces($1)

corenetwork_network_raw_on_all_interfaces($1)

corenetwork_network_$2_on_all_nodes($1)

corenetwork_network_raw_on_all_nodes($1)

corenetwork_bind_$2_on_all_nodes($1)

corenetwork_network_$2_on_$3_port($1)

sysnetwork_read_network_config($1)

#

# base_file_read_access():

#

files_list_home_directories($1)

files_read_general_shared_resources($1)

allow $1 bin_t:dir r_dir_perms;

allow $1 bin_t:notdevfile_class_set r_file_perms;

allow $1 sbin_t:dir r_dir_perms;

allow $1 sbin_t:notdevfile_class_set r_file_perms;

kernel_read_kernel_sysctl($1)

selinux_read_config($1)

if (read_default_t) {

allow $1 default_t:dir r_dir_perms;

allow $1 default_t:notdevfile_class_set r_file_perms;

}

#

# base_pty_perms():

#

allow $1_t ptmx_t:chr_file rw_file_perms;

allow $1_t devpts_t:filesystem getattr;

allow $1_t devpts_t:dir { getattr read search };

dontaudit $1_t bsdpty_device_t:chr_file { getattr read write };

#

# base_user_domain():

#

#

# can_create():

#

# for each i in $3

can_create_internal($1,$2,$i)

#

# can_create_internal($1,$2,dir):

#

allow $1 $2:$3 { create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir };

#

# can_create_internal($1,$2,lnk_file):

#

allow $1 $2:$3 { create read getattr setattr link unlink rename };

#

# can_create_internal($1,$2,[file,chr_file,blk_file,sock_file,fifo_file]):

#

allow $1 $2:$3 { create ioctl read getattr lock write setattr append link unlink rename };

#

# can_create_other_pty(): complete

#

terminal_make_pseudoterminal($1_t,$2_devpts_t)

allow $1_t $2_devpts_t:chr_file { setattr ioctl read getattr lock write append };

#

# can_create_pty(): complete

#

# $2 may require more conversion

type $1_devpts_t $2;

terminal_make_pseudoterminal($1_t,$1_devpts_t)

allow $1_t $1_devpts_t:chr_file { setattr ioctl read getattr lock write append };

#

# can_exec(): complete

#

allow $1 $2:file { getattr read execute execute_no_trans };

#

# can_exec_any():

#

libraries_use_dynamic_loader($1)

libraries_read_shared_libraries($1)

files_execute_system_config_script($1)

libraries_execute_library_scripts($1)

corecommands_execute_general_programs($1)

corecommands_execute_system_programs($1)

domain_execute_all_entrypoint_programs($1)

can_exec($1, ld_so_t)

#

# can_getcon():

#

allow $1 proc_t:dir search;

allow $1 proc_t:{ file lnk_file } read;

allow $1 self:process getattr;

#

# can_getsecurity(): complete

#

kernel_get_selinuxfs_mount_point($1)

kernel_validate_selinux_context($1)

kernel_compute_selinux_av($1)

kernel_compute_create($1)

kernel_compute_relabel($1)

kernel_compute_reachable_user_contexts($1)

#

# can_kerberos():

#

ifdef(`kerberos.te',`

if (allow_kerberos) {

can_network_client($1, `kerberos_port_t')

can_resolve($1)

}

') dnl kerberos.te

dontaudit $1 krb5_conf_t:file write;

allow $1 krb5_conf_t:file { getattr read };

#

# can_ldap():

#

ifdef(`slapd.te',`

can_network_client_tcp($1, `ldap_port_t')

')

#

# can_loadpol(): complete

#

kernel_get_selinuxfs_mount_point($1)

kernel_load_selinux_policy($1)

#

# can_network():

#

can_network_tcp($1, `$2')

can_network_udp($1, `$2')

ifdef(`mount.te', `

allow $1 mount_t:udp_socket rw_socket_perms;

')

#

# can_network_client():

#

can_network_client_tcp($1, `$2')

can_network_udp($1, `$2')

#

# can_network_client_tcp():

#

base_can_network($1, tcp, `$2')

allow $1 self:tcp_socket { connect };

#

# can_network_server():

#

allow $1 self:tcp_socket { listen accept };

base_can_network($1, tcp, `$2')

#

# can_network_server_tcp():

#

allow $1 self:tcp_socket { listen accept };

base_can_network($1, tcp, `$2')

#

# can_network_tcp(): complete

#

can_network_server_tcp($1, `$2')

can_network_client_tcp($1, `$2')

#

# can_network_udp(): complete

#

base_can_network($1, udp, `$2')

allow $1 self:udp_socket { connect };

#

# can_ps():

#

allow $1 $2:dir { search getattr read };

allow $1 $2:{ file lnk_file } { read getattr };

allow $1 $2:process getattr;

# We need to suppress this denial because procps tries to access

# /proc/pid/environ and this now triggers a ptrace check in recent kernels

# (2.4 and 2.6).  Might want to change procps to not do this, or only if

# running in a privileged domain.

dontaudit $1 $2:process ptrace;

#

# can_ptrace():

#

allow $1 $2:process ptrace;

allow $2 $1:process sigchld;

#

# can_resolve():

#

ifdef(`use_dns',`

can_network_udp($1, `dns_port_t')

')

#

# can_setbool(): complete

#

kernel_get_selinuxfs_mount_point($1)

kernel_set_selinux_boolean($1)

#

# can_setcon(): complete

#

# get mount point is due to libselinux init

#

allow $1 self:process setcurrent;

kernel_get_selinuxfs_mount_point($1)

#

# can_setenforce(): complete

#

# get mount point is due to libselinux init

#

kernel_get_selinuxfs_mount_point($1)

kernel_set_selinux_enforcement_mode($1)

#

# can_setexec(): complete

#

# get mount point is due to libselinux init

#

allow $1 self:process setexec;

kernel_get_selinuxfs_mount_point($1)

#

# can_setfscreate(): complete

#

# get mount point is due to libselinux init

#

allow $1 self:process setfscreate;

kernel_get_selinuxfs_mount_point($1)

#

# can_setsecparam(): complete

#

# get mount point is due to libselinux init

#

kernel_get_selinuxfs_mount_point($1)

kernel_setsecparam($1)

#

# can_sysctl(): complete

#

kernel_modify_all_sysctl($1)

#

# can_tcp_connect

# (policy is commented out)

# Irrelevant until we have labeled networking.

#

#allow $1 $2:tcp_socket { connectto recvfrom };

#allow $2 $1:tcp_socket { acceptfrom recvfrom };

#allow $2 kernel_t:tcp_socket recvfrom;

#allow $1 kernel_t:tcp_socket recvfrom;

#

# can_udp_send():

# (policy is commented out)

# Irrelevant until we have labeled networking.

#

#allow $1 $2:udp_socket sendto;

#allow $2 $1:udp_socket recvfrom;

#

# can_unix_connect():

#

allow $1 $2:unix_stream_socket connectto;

#

# can_unix_send():

#

allow $1 $2:unix_dgram_socket sendto;

#

# can_ypbind():

#

optional_policy(`ypbind.te', `

if (allow_ypbind) {

can_network($1)

r_dir_file($1,var_yp_t)

corenetwork_bind_tcp_on_general_port($1)

corenetwork_bind_udp_on_general_port($1)

corenetwork_bind_tcp_on_reserved_port($1)

corenetwork_bind_udp_on_reserved_port($1)

corenetwork_ignore_bind_tcp_on_all_reserved_ports($1)

corenetwork_ignore_bind_udp_on_all_reserved_ports($1)

dontaudit $1 self:capability net_bind_service;

} else {

dontaudit $1 var_yp_t:dir search;

}

') dnl end ypbind optional_policy

#

# create_append_log_file():

#

allow $1 $2:dir { read getattr search add_name write };

allow $1 $2:file { create ioctl getattr setattr append link };

#

# create_dir_file():

#

allow $1 $2:dir { create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir };

allow $1 $2:file { create ioctl read getattr lock write setattr append link unlink rename };

allow $1 $2:lnk_file { create read getattr setattr link unlink rename };

#

# create_dir_notdevfile():

#

allow $1 $2:dir { create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir };

allow $1 $2:{ file sock_file fifo_file } { create ioctl read getattr lock write setattr append link unlink rename };

allow $1 $2:lnk_file { create read getattr setattr link unlink rename };

#

# daemon_base_domain():

#

type $1_t;

type $1_exec_t;

domain_make_daemon_domain($1_t,$1_exec_t)

role system_r types $1_t;

dontaudit $1_t self:capability sys_tty_config;

allow $1_t self:process { sigchld sigkill sigstop signull signal };

kernel_read_kernel_sysctl($1_t)

kernel_read_hardware_state($1_t)

devices_discard_data_stream($1_t)

terminal_ignore_use_console($1_t)

init_use_file_descriptors($1_t)

init_script_use_pseudoterminal($1_t)

domain_use_widely_inheritable_file_descriptors($1_t)

libraries_use_dynamic_loader($1_t)

libraries_read_shared_libraries($1_t)

logging_send_system_log_message($1_t)

tunable_policy(`targeted_policy', `

terminal_ignore_use_general_physical_terminal($1_t)

terminal_ignore_use_general_pseudoterminal($1_t)

files_ignore_read_rootfs_file($1_t)

')dnl end targeted_policy tunable

allow $1_t proc_t:dir r_dir_perms;

allow $1_t proc_t:lnk_file read;

optional_policy(`rhgb.te', `

allow $1_t rhgb_t:process sigchld;

allow $1_t rhgb_t:fd use;

allow $1_t rhgb_t:fifo_file { read write };

')

optional_policy(`udev.te', `

udev_read_database($1_t)

')

allow $1_t null_device_t:chr_file r_file_perms;

dontaudit $1_t unpriv_userdomain:fd use;

allow $1_t autofs_t:dir { search getattr };

tunable_policy(`direct_sysadm_daemon', `

dontaudit $1_t admin_tty_type:chr_file rw_file_perms;

')

optional_policy(`selinux.te',`

selinux_newrole_sigchld($1_t)

')

#

# daemon_domain():

#

type $1_t;

type $1_exec_t;

domain_make_daemon_domain($1_t,$1_exec_t)

type $1_var_run_t;

files_make_file($1_var_run_t)

allow $1_t $1_var_run_t:file { getattr create read write append setattr unlink };

files_create_daemon_runtime_data($1_t,$1_var_run_t)

dontaudit $1_t self:capability sys_tty_config;

kernel_read_kernel_sysctl($1_t)

kernel_read_hardware_state($1_t)

devices_discard_data_stream($1_t)

filesystem_get_all_filesystems_attributes($1_t)

terminal_use_controlling_terminal($1_t)

terminal_ignore_use_console($1_t)

init_use_file_descriptors($1_t)

init_script_use_pseudoterminal($1_t)

domain_use_widely_inheritable_file_descriptors($1_t)

logging_send_system_log_message($1_t)

libraries_use_dynamic_loader($1_t)

libraries_read_shared_libraries($1_t)

miscfiles_read_localization($1_t)

optional_policy(`udev.te', `

udev_read_database($1_t)

')

tunable_policy(`targeted_policy', `

terminal_ignore_use_general_physical_terminal($1_t)

terminal_ignore_use_general_pseudoterminal($1_t)

files_ignore_read_rootfs_file($1_t)

')dnl end targeted_policy tunable

allow $1_t proc_t:dir r_dir_perms;

allow $1_t proc_t:lnk_file read;

allow $1_t null_device_t:chr_file r_file_perms;

dontaudit $1_t unpriv_userdomain:fd use;

allow $1_t autofs_t:dir { search getattr };

dontaudit $1_t sysadm_home_dir_t:dir search;

optional_policy(`rhgb.te', `

allow $1_t rhgb_t:process sigchld;

allow $1_t rhgb_t:fd use;

allow $1_t rhgb_t:fifo_file { read write };

')

optional_policy(`selinux.te',`

selinux_newrole_sigchld($1_t)

')

#

# daemon_sub_domain():

#

# $1 is the parent domain (or domains), $2_t is the child domain,

# and $3 is any attributes to apply to the child

type $2_t, domain, privlog, daemon $3;

type $2_exec_t, file_type, sysadmfile, exec_type;

role system_r types $2_t;

domain_auto_trans($1, $2_exec_t, $2_t)

allow $2_t $1:fd use;

allow $2_t $1:process sigchld;

allow $2_t self:process signal_perms;

libraries_use_dynamic_loader($2_t)

libraries_read_shared_libraries($2_t)

allow $2_t proc_t:dir r_dir_perms;

allow $2_t proc_t:lnk_file read;

allow $2_t device_t:dir getattr;

#

# etc_domain():

#

type $1_etc_t; #, usercanread;

files_make_file($1_etc_t)

allow $1_t $1_etc_t:file r_file_perms;

#

# etcdir_domain():

#

type $1_etc_t; #, usercanread;

files_make_file($1_etc_t)

allow $1_t $1_etc_t:file r_file_perms;

allow $1_t $1_etc_t:dir r_dir_perms;

allow $1_t $1_etc_t:lnk_file { getattr read };

#

# file_type_auto_trans():

#

allow $1 $2:dir { read getattr lock search ioctl add_name remove_name write };

allow $1 $2:file { create ioctl read getattr lock write setattr append link unlink rename };

allow $1 $2:lnk_file { create read getattr setattr link unlink rename };

allow $1 $2:sock_file { create ioctl read getattr lock write setattr append link unlink rename };

allow $1 $2:fifo_file { create ioctl read getattr lock write setattr append link unlink rename };

type_transition $1 $2:dir $3;

type_transition $1 $2:{ file lnk_file sock_file fifo_file } $3;

#

# file_type_auto_trans($1,$2,$3,$4):

#

# for each i in $4

allow $1 $2:dir { read getattr lock search ioctl add_name remove_name write };

can_create_internal($1,$2,$4)

type_transition $1 $2:$4 $3;

#

# file_type_trans($1,$2,$3):

#

allow $1 $3:dir { read getattr lock search ioctl add_name remove_name write };

allow $1 $3:file { create ioctl read getattr lock write setattr append link unlink rename };

allow $1 $3:lnk_file { create read getattr setattr link unlink rename };

allow $1 $3:sock_file { create ioctl read getattr lock write setattr append link unlink rename };

allow $1 $3:fifo_file { create ioctl read getattr lock write setattr append link unlink rename };

type_transition $1 $2:{ dir file lnk_file sock_file fifo_file } $3;

#

# file_type_trans($1,$2,$3,$4):

#

# for each i in $4

allow $1 $2:dir { read getattr lock search ioctl add_name remove_name write };

can_create_internal($1,$2,$3,$4)

type_transition $1 $2:$i $3;

#

# full_user_role():

#

#

# general_domain_access():

#

allow $1 self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem dyntransition };

allow $1 self:fd use;

allow $1 self:fifo_file { read getattr lock ioctl write append };

allow $1 self:unix_dgram_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };

allow $1 self:unix_stream_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown listen accept };

allow $1 self:unix_dgram_socket sendto;

allow $1 self:unix_stream_socket connectto;

allow $1 self:shm { associate getattr setattr create destroy read write lock unix_read unix_write };

allow $1 self:sem { associate getattr setattr create destroy read write unix_read unix_write };

allow $1 self:msgq { associate getattr setattr create destroy read write enqueue unix_read unix_write };

allow $1 self:msg { send receive };

allow $1 unpriv_userdomain:fd use;

can_ypbind($1)

ifdef(`automount.te', `

allow $1 autofs_t:dir { search getattr };

')

#

# general_proc_read_access(): complete

#

kernel_read_system_state($1)

kernel_read_network_state($1)

kernel_read_software_raid_state($1)

kernel_get_core_interface_attributes($1)

kernel_get_message_interface_attributes($1)

kernel_read_kernel_sysctl($1)

#

# home_domain():

#

#

# home_domain_access():

#

#

# home_domain_ro():

#

#

# home_domain_ro_access():

#

#

# in_user_role():

#

role user_r types $1;

role staff_r types $1;

#

# init_service_domain():

#

type $1_t;

type $1_exec_t;

domain_make_daemon_domain($1_t,$1_exec_t)

dontaudit $1_t self:capability sys_tty_config;

kernel_read_hardware_state($1_t)

terminal_ignore_use_console($1_t)

init_use_file_descriptors($1_t)

libraries_use_dynamic_loader($1_t)

libraries_read_shared_libraries($1_t)

logging_send_system_log_message($1_t)

devices_discard_data_stream($1_t)

tunable_policy(`targeted_policy', `

terminal_ignore_use_general_physical_terminal($1_t)

terminal_ignore_use_general_pseudoterminal($1_t)

files_ignore_read_rootfs_file($1_t)

')dnl end targeted_policy tunable

allow $1_t proc_t:dir r_dir_perms;

allow $1_t proc_t:lnk_file read;

optional_policy(`udev.te', `

udev_read_database($1_t)

')