Chris PeBenito 17de1b
Chris PeBenito f7925f
policy_module(modutils,1.6.0)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
gen_require(`
Chris PeBenito 17de1b
	bool secure_mode_insmod;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
# Declarations
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
Chris PeBenito 17de1b
# module loading config
Chris PeBenito 17de1b
type modules_conf_t;
Chris PeBenito 17de1b
files_type(modules_conf_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
# module dependencies
Chris PeBenito 17de1b
type modules_dep_t;
Chris PeBenito 17de1b
files_type(modules_dep_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
type insmod_t;
Chris PeBenito 17de1b
type insmod_exec_t;
Chris PeBenito d46cfe
application_domain(insmod_t,insmod_exec_t)
Chris PeBenito f8233a
mls_file_write_all_levels(insmod_t)
Chris PeBenito 17de1b
role system_r types insmod_t;
Chris PeBenito 17de1b
Chris PeBenito 17de1b
type depmod_t;
Chris PeBenito 17de1b
type depmod_exec_t;
Chris PeBenito 17de1b
init_system_domain(depmod_t,depmod_exec_t)
Chris PeBenito 17de1b
role system_r types depmod_t;
Chris PeBenito 17de1b
Chris PeBenito 17de1b
type update_modules_t;
Chris PeBenito 17de1b
type update_modules_exec_t;
Chris PeBenito 17de1b
init_system_domain(update_modules_t,update_modules_exec_t)
Chris PeBenito 17de1b
role system_r types update_modules_t;
Chris PeBenito 17de1b
Chris PeBenito 17de1b
type update_modules_tmp_t;
Chris PeBenito 17de1b
files_tmp_file(update_modules_tmp_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
# insmod local policy
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
Chris PeBenito 17de1b
allow insmod_t self:capability { dac_override net_raw sys_tty_config };
Chris PeBenito 17de1b
allow insmod_t self:process { execmem sigchld sigkill sigstop signull signal };
Chris PeBenito 17de1b
Chris PeBenito 17de1b
allow insmod_t self:udp_socket create_socket_perms; 
Chris PeBenito 17de1b
allow insmod_t self:rawip_socket create_socket_perms; 
Chris PeBenito 17de1b
Chris PeBenito 17de1b
# Read module config and dependency information
Chris PeBenito ef659a
allow insmod_t { modules_conf_t modules_dep_t }:file read_file_perms;
Chris PeBenito 17de1b
Chris PeBenito 17de1b
can_exec(insmod_t, insmod_exec_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
kernel_load_module(insmod_t)
Chris PeBenito 17de1b
kernel_read_system_state(insmod_t)
Chris PeBenito 17de1b
kernel_write_proc_files(insmod_t)
Chris PeBenito 17de1b
kernel_mount_debugfs(insmod_t)
Chris PeBenito 882186
kernel_mount_kvmfs(insmod_t)
Chris PeBenito 17de1b
kernel_read_debugfs(insmod_t)
Chris PeBenito 17de1b
# Rules for /proc/sys/kernel/tainted
Chris PeBenito 17de1b
kernel_read_kernel_sysctls(insmod_t)
Chris PeBenito 17de1b
kernel_rw_kernel_sysctl(insmod_t)
Chris PeBenito 17de1b
kernel_read_hotplug_sysctls(insmod_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
files_read_kernel_modules(insmod_t)
Chris PeBenito 17de1b
# for locking: (cjp: ????)
Chris PeBenito 17de1b
files_write_kernel_modules(insmod_t)
Chris PeBenito 17de1b
Chris PeBenito 697489
dev_rw_sysfs(insmod_t)
Chris PeBenito 17de1b
dev_search_usbfs(insmod_t)
Chris PeBenito 85476e
dev_rw_mtrr(insmod_t)
Chris PeBenito 17de1b
dev_read_urand(insmod_t)
Chris PeBenito 17de1b
dev_rw_agp(insmod_t)
Chris PeBenito 17de1b
dev_read_sound(insmod_t)
Chris PeBenito 17de1b
dev_write_sound(insmod_t)
Chris PeBenito 17de1b
dev_rw_apm_bios(insmod_t)
Chris PeBenito 17de1b
# cjp: why is this needed?  insmod cannot mounton any dir
Chris PeBenito 17de1b
# and it also transitions to mount
Chris PeBenito 17de1b
dev_mount_usbfs(insmod_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
fs_getattr_xattr_fs(insmod_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
corecmd_exec_bin(insmod_t)
Chris PeBenito 17de1b
corecmd_exec_shell(insmod_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
domain_signal_all_domains(insmod_t)
Chris PeBenito 17de1b
domain_use_interactive_fds(insmod_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
files_read_etc_runtime_files(insmod_t)
Chris PeBenito 17de1b
files_read_etc_files(insmod_t)
Chris PeBenito 17de1b
files_read_usr_files(insmod_t)
Chris PeBenito 17de1b
files_exec_etc_files(insmod_t)
Chris PeBenito 17de1b
# for nscd:
Chris PeBenito 17de1b
files_dontaudit_search_pids(insmod_t)
Chris PeBenito 17de1b
# for when /var is not mounted early in the boot:
Chris PeBenito 17de1b
files_dontaudit_search_isid_type_dirs(insmod_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
init_rw_initctl(insmod_t)
Chris PeBenito 17de1b
init_use_fds(insmod_t)
Chris PeBenito 17de1b
init_use_script_fds(insmod_t)
Chris PeBenito 17de1b
init_use_script_ptys(insmod_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
libs_use_ld_so(insmod_t)
Chris PeBenito 17de1b
libs_use_shared_libs(insmod_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
logging_send_syslog_msg(insmod_t)
Chris PeBenito 17de1b
logging_search_logs(insmod_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
miscfiles_read_localization(insmod_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
seutil_read_file_contexts(insmod_t)
Chris PeBenito 17de1b
Chris PeBenito 12cf80
ifdef(`distro_ubuntu',`
Chris PeBenito 12cf80
	optional_policy(`
Chris PeBenito 12cf80
		unconfined_domain(insmod_t)
Chris PeBenito 12cf80
	')
Chris PeBenito 12cf80
')
Chris PeBenito 12cf80
Chris PeBenito 17de1b
if( ! secure_mode_insmod ) {
Chris PeBenito 17de1b
	kernel_domtrans_to(insmod_t,insmod_exec_t)
Chris PeBenito 17de1b
}
Chris PeBenito 17de1b
Chris PeBenito 17de1b
optional_policy(`
Chris PeBenito 17de1b
	hotplug_search_config(insmod_t)
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
optional_policy(`
Chris PeBenito 17de1b
	mount_domtrans(insmod_t)
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
optional_policy(`
Chris PeBenito 17de1b
	nis_use_ypbind(insmod_t)
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
optional_policy(`
Chris PeBenito 17de1b
	nscd_socket_use(insmod_t)
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
optional_policy(`
Chris PeBenito 17de1b
	fs_manage_ramfs_files(insmod_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	rhgb_use_fds(insmod_t)
Chris PeBenito 6b19be
	rhgb_dontaudit_use_ptys(insmod_t)
Chris PeBenito 6b19be
Chris PeBenito 6b19be
	xserver_dontaudit_write_log(insmod_t)
Chris PeBenito 6b19be
	xserver_stream_connect_xdm_xserver(insmod_t)
Chris PeBenito 6b19be
	xserver_dontaudit_rw_xdm_stream_sockets(insmod_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	ifdef(`hide_broken_symptoms',`
Chris PeBenito 17de1b
		xserver_dontaudit_rw_xdm_xserver_tcp_sockets(insmod_t)
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
optional_policy(`
Chris PeBenito 17de1b
	rpm_rw_pipes(insmod_t)
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
optional_policy(`
Chris PeBenito 882186
	unconfined_dontaudit_rw_pipes(insmod_t)
Chris PeBenito 882186
')
Chris PeBenito 882186
Chris PeBenito 882186
optional_policy(`
Chris PeBenito 17de1b
	# cjp: why is this needed:
Chris PeBenito 17de1b
	dev_rw_xserver_misc(insmod_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	xserver_getattr_log(insmod_t)
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
# depmod local policy
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
Chris PeBenito 17de1b
can_exec(depmod_t, depmod_exec_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
# Read conf.modules.
Chris PeBenito c0868a
allow depmod_t modules_conf_t:file read_file_perms;
Chris PeBenito 17de1b
Chris PeBenito c0868a
allow depmod_t modules_dep_t:file manage_file_perms;
Chris PeBenito 17de1b
files_kernel_modules_filetrans(depmod_t,modules_dep_t,file)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
kernel_read_system_state(depmod_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
files_read_kernel_symbol_table(depmod_t)
Chris PeBenito 17de1b
files_read_kernel_modules(depmod_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
fs_getattr_xattr_fs(depmod_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
term_use_console(depmod_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
corecmd_search_bin(depmod_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
domain_use_interactive_fds(depmod_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
init_use_fds(depmod_t)
Chris PeBenito 17de1b
init_use_script_fds(depmod_t)
Chris PeBenito 17de1b
init_use_script_ptys(depmod_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
files_read_etc_runtime_files(depmod_t)
Chris PeBenito 17de1b
files_read_etc_files(depmod_t)
Chris PeBenito 17de1b
files_read_usr_src_files(depmod_t)
Chris PeBenito 17de1b
files_list_usr(depmod_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
libs_use_ld_so(depmod_t)
Chris PeBenito 17de1b
libs_use_shared_libs(depmod_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
# Read System.map from home directories.
Chris PeBenito 17de1b
files_list_home(depmod_t)
Chris PeBenito 17de1b
userdom_read_staff_home_content_files(depmod_t)
Chris PeBenito 17de1b
userdom_read_sysadm_home_content_files(depmod_t)
Chris PeBenito 17de1b
Chris PeBenito 12cf80
ifdef(`distro_ubuntu',`
Chris PeBenito 12cf80
	optional_policy(`
Chris PeBenito 12cf80
		unconfined_domain(depmod_t)
Chris PeBenito 12cf80
	')
Chris PeBenito 12cf80
')
Chris PeBenito 12cf80
Chris PeBenito 350b6a
optional_policy(`
Chris PeBenito 350b6a
	# Read System.map from home directories.
Chris PeBenito 350b6a
	unconfined_read_home_content_files(depmod_t)
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
optional_policy(`
Chris PeBenito 17de1b
	rpm_rw_pipes(depmod_t)
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
#################################
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
# update-modules local policy
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
Chris PeBenito c0868a
allow update_modules_t self:fifo_file rw_fifo_file_perms;
Chris PeBenito 17de1b
Chris PeBenito 17de1b
allow update_modules_t modules_dep_t:file rw_file_perms;
Chris PeBenito 17de1b
Chris PeBenito 17de1b
can_exec(update_modules_t, insmod_exec_t)
Chris PeBenito 17de1b
can_exec(update_modules_t, update_modules_exec_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
# manage module loading configuration
Chris PeBenito c0868a
allow update_modules_t modules_conf_t:file manage_file_perms;
Chris PeBenito 17de1b
files_kernel_modules_filetrans(update_modules_t,modules_conf_t,file)
Chris PeBenito 17de1b
files_etc_filetrans(update_modules_t,modules_conf_t,file)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
# transition to depmod
Chris PeBenito 17de1b
domain_auto_trans(update_modules_t, depmod_exec_t, depmod_t)
Chris PeBenito 17de1b
allow update_modules_t depmod_t:fd use;
Chris PeBenito 17de1b
allow depmod_t update_modules_t:fd use;
Chris PeBenito 17de1b
allow depmod_t update_modules_t:fifo_file rw_file_perms;
Chris PeBenito 17de1b
allow depmod_t update_modules_t:process sigchld;
Chris PeBenito 17de1b
Chris PeBenito c0868a
manage_dirs_pattern(update_modules_t,update_modules_tmp_t,update_modules_tmp_t)
Chris PeBenito c0868a
manage_files_pattern(update_modules_t,update_modules_tmp_t,update_modules_tmp_t)
Chris PeBenito 17de1b
files_tmp_filetrans(update_modules_t, update_modules_tmp_t, { file dir })
Chris PeBenito 17de1b
Chris PeBenito 17de1b
kernel_read_kernel_sysctls(update_modules_t)
Chris PeBenito 17de1b
kernel_read_system_state(update_modules_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
dev_read_urand(update_modules_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
fs_getattr_xattr_fs(update_modules_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
term_use_console(update_modules_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
init_use_fds(update_modules_t)
Chris PeBenito 17de1b
init_use_script_fds(update_modules_t)
Chris PeBenito 17de1b
init_use_script_ptys(update_modules_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
domain_use_interactive_fds(update_modules_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
files_read_etc_runtime_files(update_modules_t)
Chris PeBenito 17de1b
files_read_etc_files(update_modules_t)
Chris PeBenito 17de1b
files_exec_etc_files(update_modules_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
corecmd_exec_bin(update_modules_t)
Chris PeBenito 17de1b
corecmd_exec_shell(update_modules_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
libs_use_ld_so(update_modules_t)
Chris PeBenito 17de1b
libs_use_shared_libs(update_modules_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
logging_send_syslog_msg(update_modules_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
miscfiles_read_localization(update_modules_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
userdom_dontaudit_search_sysadm_home_dirs(update_modules_t)
Chris PeBenito 17de1b
Chris PeBenito d15dd5
ifdef(`distro_gentoo',`
Chris PeBenito d15dd5
	files_search_pids(update_modules_t)
Chris PeBenito bf469d
	files_getattr_usr_src_files(update_modules_t)
Chris PeBenito 14b168
	files_list_isid_type_dirs(update_modules_t) # /var
Chris PeBenito d15dd5
Chris PeBenito d15dd5
	optional_policy(`
Chris PeBenito d15dd5
		consoletype_exec(update_modules_t)
Chris PeBenito d15dd5
	')
Chris PeBenito d15dd5
')
Chris PeBenito 12cf80
Chris PeBenito 12cf80
ifdef(`distro_ubuntu',`
Chris PeBenito 12cf80
	optional_policy(`
Chris PeBenito 12cf80
		unconfined_domain(update_modules_t)
Chris PeBenito 12cf80
	')
Chris PeBenito 12cf80
')