Chris PeBenito e78430
## <summary>Execute a command with a substitute user</summary>
Chris PeBenito e78430
Chris PeBenito e78430
#######################################
Chris PeBenito e78430
## <summary>
Chris PeBenito 296273
##	The role template for the sudo module.
Chris PeBenito e78430
## </summary>
Chris PeBenito e78430
## <desc>
Chris PeBenito e78430
##	

Chris PeBenito e78430
##	This template creates a derived domain which is allowed
Chris PeBenito e78430
##	to change the linux user id, to run commands as a different
Chris PeBenito e78430
##	user.
Chris PeBenito e78430
##	

Chris PeBenito e78430
## </desc>
Chris PeBenito 296273
## <param name="role_prefix">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 296273
##	The prefix of the user role (e.g., user
Chris PeBenito 296273
##	is the prefix for user_r).
Chris PeBenito 885b83
##	</summary>
Chris PeBenito e78430
## </param>
Chris PeBenito 296273
## <param name="user_role">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 296273
##	The user role.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 451c1e
## </param>
Chris PeBenito 296273
## <param name="user_domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 296273
##	The user domain associated with the role.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 451c1e
## </param>
Chris PeBenito e78430
#
Chris PeBenito 296273
template(`sudo_role_template',`
Chris PeBenito e78430
Chris PeBenito 71fe0f
	gen_require(`
Chris PeBenito 71fe0f
		type sudo_exec_t;
Chris PeBenito 41ea88
		attribute sudodomain;
Chris PeBenito 71fe0f
	')
Chris PeBenito 71fe0f
Chris PeBenito e78430
	##############################
Chris PeBenito e78430
	#
Chris PeBenito e78430
	# Declarations
Chris PeBenito e78430
	#
Chris PeBenito e78430
Chris PeBenito 41ea88
	type $1_sudo_t, sudodomain; 
Chris PeBenito 0bfccd
	application_domain($1_sudo_t, sudo_exec_t)
Chris PeBenito 15722e
	domain_interactive_fd($1_sudo_t)
Chris PeBenito 41ea88
	domain_role_change_exemption($1_sudo_t)
Chris PeBenito 296273
	ubac_constrained($1_sudo_t)
Chris PeBenito 296273
	role $2 types $1_sudo_t;
Chris PeBenito e78430
Chris PeBenito e78430
	##############################
Chris PeBenito e78430
	#
Chris PeBenito e78430
	# Local Policy
Chris PeBenito e78430
	#
Chris PeBenito e78430
Chris PeBenito e78430
	# Use capabilities.
Chris PeBenito 41ea88
	allow $1_sudo_t self:capability { fowner setuid setgid dac_override sys_nice sys_resource };
Chris PeBenito 9d3bdc
	allow $1_sudo_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
Chris PeBenito e78430
	allow $1_sudo_t self:process { setexec setrlimit };
Chris PeBenito e78430
	allow $1_sudo_t self:fd use;
Chris PeBenito c0868a
	allow $1_sudo_t self:fifo_file rw_fifo_file_perms;
Chris PeBenito e78430
	allow $1_sudo_t self:shm create_shm_perms;
Chris PeBenito e78430
	allow $1_sudo_t self:sem create_sem_perms;
Chris PeBenito e78430
	allow $1_sudo_t self:msgq create_msgq_perms;
Chris PeBenito e78430
	allow $1_sudo_t self:msg { send receive };
Chris PeBenito d8636f
	allow $1_sudo_t self:unix_dgram_socket create_socket_perms;
Chris PeBenito d8636f
	allow $1_sudo_t self:unix_stream_socket create_stream_socket_perms;
Chris PeBenito d8636f
	allow $1_sudo_t self:unix_dgram_socket sendto;
Chris PeBenito d8636f
	allow $1_sudo_t self:unix_stream_socket connectto;
Chris PeBenito ed03a5
	allow $1_sudo_t self:key manage_key_perms;
Chris PeBenito 41ea88
Chris PeBenito 41ea88
	allow $1_sudo_t $3:key search;
Chris PeBenito e78430
Chris PeBenito e78430
	# Enter this derived domain from the user domain
Chris PeBenito 296273
	domtrans_pattern($3, sudo_exec_t, $1_sudo_t)
Chris PeBenito e78430
Chris PeBenito e78430
	# By default, revert to the calling domain when a shell is executed.
Chris PeBenito 296273
	corecmd_shell_domtrans($1_sudo_t, $3)
Chris PeBenito 41ea88
	corecmd_bin_domtrans($1_sudo_t, $3)
Dan Walsh 3eaa99
	userdom_domtrans_user_home($1_sudo_t, $3)
Dan Walsh 3eaa99
	userdom_domtrans_user_tmp($1_sudo_t, $3)
Chris PeBenito 296273
	allow $3 $1_sudo_t:fd use;
Chris PeBenito 296273
	allow $3 $1_sudo_t:fifo_file rw_file_perms;
Chris PeBenito 3835c3
	allow $3 $1_sudo_t:process signal_perms;
Chris PeBenito e78430
Chris PeBenito 445522
	kernel_read_kernel_sysctls($1_sudo_t)
Chris PeBenito e78430
	kernel_read_system_state($1_sudo_t)
Chris PeBenito 41ea88
	kernel_link_key($1_sudo_t)
Chris PeBenito e78430
Chris PeBenito 9c4722
	corecmd_read_bin_symlinks($1_sudo_t)
Chris PeBenito ed03a5
	corecmd_exec_all_executables($1_sudo_t)
Chris PeBenito 9c4722
Chris PeBenito e78430
	dev_read_urand($1_sudo_t)
Chris PeBenito 41ea88
	dev_rw_generic_usb_dev($1_sudo_t)
Chris PeBenito 41ea88
	dev_read_sysfs($1_sudo_t)
Chris PeBenito e78430
Chris PeBenito 9c4722
	domain_use_interactive_fds($1_sudo_t)
Chris PeBenito 9c4722
	domain_sigchld_interactive_fds($1_sudo_t)
Chris PeBenito 9c4722
	domain_getattr_all_entry_files($1_sudo_t)
Chris PeBenito 9c4722
Chris PeBenito 9c4722
	files_read_etc_files($1_sudo_t)
Chris PeBenito 9c4722
	files_read_var_files($1_sudo_t)
Chris PeBenito 9c4722
	files_read_usr_symlinks($1_sudo_t)
Chris PeBenito 9c4722
	files_getattr_usr_files($1_sudo_t)
Chris PeBenito 9c4722
	# for some PAM modules and for cwd
Chris PeBenito 9c4722
	files_dontaudit_search_home($1_sudo_t)
Chris PeBenito 9c4722
	files_list_tmp($1_sudo_t)
Chris PeBenito 9c4722
Chris PeBenito e78430
	fs_search_auto_mountpoints($1_sudo_t)
Chris PeBenito e78430
	fs_getattr_xattr_fs($1_sudo_t)
Chris PeBenito e78430
Chris PeBenito 41ea88
	selinux_validate_context($1_sudo_t)
Chris PeBenito 41ea88
	selinux_compute_relabel_context($1_sudo_t)
Chris PeBenito 41ea88
Chris PeBenito c3c753
	term_relabel_all_ttys($1_sudo_t)
Chris PeBenito c3c753
	term_relabel_all_ptys($1_sudo_t)
Chris PeBenito 41ea88
Chris PeBenito 41ea88
	auth_run_chk_passwd($1_sudo_t, $2)
Chris PeBenito 6b19be
	# sudo stores a token in the pam_pid directory
Chris PeBenito 6b19be
	auth_manage_pam_pid($1_sudo_t)
Chris PeBenito c0cf6e
	auth_use_nsswitch($1_sudo_t)
Chris PeBenito e78430
Chris PeBenito 68228b
	init_rw_utmp($1_sudo_t)
Chris PeBenito e78430
Chris PeBenito 41ea88
	logging_send_audit_msgs($1_sudo_t)
Chris PeBenito e78430
	logging_send_syslog_msg($1_sudo_t)
Chris PeBenito e78430
Chris PeBenito e78430
	miscfiles_read_localization($1_sudo_t)
Chris PeBenito e78430
Chris PeBenito 41ea88
	seutil_search_default_contexts($1_sudo_t)
Chris PeBenito 41ea88
	seutil_libselinux_linked($1_sudo_t)
Chris PeBenito 41ea88
Chris PeBenito 41ea88
	userdom_spec_domtrans_all_users($1_sudo_t)
Chris PeBenito 296273
	userdom_manage_user_home_content_files($1_sudo_t)
Chris PeBenito 296273
	userdom_manage_user_home_content_symlinks($1_sudo_t)
Chris PeBenito 296273
	userdom_manage_user_tmp_files($1_sudo_t)
Chris PeBenito 296273
	userdom_manage_user_tmp_symlinks($1_sudo_t)
Chris PeBenito 296273
	userdom_use_user_terminals($1_sudo_t)
Chris PeBenito e78430
	# for some PAM modules and for cwd
Dan Walsh 3eaa99
	userdom_search_user_home_content($1_sudo_t)
Dan Walsh 3eaa99
	userdom_search_admin_dir($1_sudo_t)
Dan Walsh 3eaa99
	userdom_manage_all_users_keys($1_sudo_t)
Chris PeBenito 41ea88
Chris PeBenito 3835c3
	ifdef(`hide_broken_symptoms', `
Chris PeBenito 3835c3
		dontaudit $1_sudo_t $3:socket_class_set { read write };
Chris PeBenito 3835c3
	')
Chris PeBenito 3835c3
Dan Walsh 3eaa99
	mta_role($2, $1_sudo_t)
Dan Walsh 3eaa99
Chris PeBenito 41ea88
	tunable_policy(`use_nfs_home_dirs',`
Chris PeBenito 41ea88
		fs_manage_nfs_files($1_sudo_t)
Chris PeBenito 41ea88
	')
Chris PeBenito 41ea88
Chris PeBenito 41ea88
	tunable_policy(`use_samba_home_dirs',`
Chris PeBenito 41ea88
		fs_manage_cifs_files($1_sudo_t)
Chris PeBenito 41ea88
	')
Chris PeBenito 41ea88
Chris PeBenito 41ea88
	optional_policy(`
Chris PeBenito 41ea88
		dbus_system_bus_client($1_sudo_t)
Chris PeBenito 41ea88
	')
Chris PeBenito ed03a5
Chris PeBenito ed03a5
	optional_policy(`
Chris PeBenito ed03a5
		fprintd_dbus_chat($1_sudo_t)
Chris PeBenito ed03a5
	')
Chris PeBenito ed03a5
Chris PeBenito 41ea88
')
Chris PeBenito 41ea88
Chris PeBenito 41ea88
########################################
Chris PeBenito 41ea88
## <summary>
Chris PeBenito 41ea88
##	Send a SIGCHLD signal to the sudo domain.
Chris PeBenito 41ea88
## </summary>
Chris PeBenito 41ea88
## <param name="domain">
Chris PeBenito 41ea88
##	<summary>
Chris PeBenito 41ea88
##	Domain allowed access.
Chris PeBenito 41ea88
##	</summary>
Chris PeBenito 41ea88
## </param>
Chris PeBenito 41ea88
#
Chris PeBenito 41ea88
interface(`sudo_sigchld',`
Chris PeBenito 41ea88
	gen_require(`
Chris PeBenito 41ea88
		attribute sudodomain;
Chris PeBenito 41ea88
	')
Chris PeBenito 41ea88
Chris PeBenito 41ea88
	allow $1 sudodomain:process sigchld;
Chris PeBenito e78430
')