Chris PeBenito e181fe
Chris PeBenito fb63d0
policy_module(bootloader,1.2.3)
Chris PeBenito 960373
Chris PeBenito a2d824
########################################
Chris PeBenito a2d824
#
Chris PeBenito a2d824
# Declarations
Chris PeBenito a2d824
#
Chris PeBenito a2d824
Chris PeBenito 5f75f5
#
Chris PeBenito 5f75f5
# boot_runtime_t is the type for /boot/kernel.h,
Chris PeBenito 5f75f5
# which is automatically generated at boot time.
Chris PeBenito 5f75f5
# only for Red Hat
Chris PeBenito 5f75f5
#
Chris PeBenito 70dcf7
type boot_runtime_t;
Chris PeBenito 8fd367
files_type(boot_runtime_t)
Chris PeBenito 70dcf7
Chris PeBenito 5f75f5
type bootloader_t;
Chris PeBenito c9428d
domain_type(bootloader_t)
Chris PeBenito 3ce6cb
role system_r types bootloader_t;
Chris PeBenito 5f75f5
Chris PeBenito 5f75f5
type bootloader_exec_t;
Chris PeBenito c9428d
domain_entry_file(bootloader_t,bootloader_exec_t)
Chris PeBenito 5f75f5
Chris PeBenito b4cd15
#
Chris PeBenito b4cd15
# bootloader_etc_t is the configuration file,
Chris PeBenito b4cd15
# grub.conf, lilo.conf, etc.
Chris PeBenito b4cd15
#
Chris PeBenito b4cd15
type bootloader_etc_t alias etc_bootloader_t;
Chris PeBenito 8fd367
files_type(bootloader_etc_t)
Chris PeBenito b4cd15
Chris PeBenito b4cd15
#
Chris PeBenito b4cd15
# The temp file is used for initrd creation;
Chris PeBenito b4cd15
# it consists of files and device nodes
Chris PeBenito b4cd15
#
Chris PeBenito b4cd15
type bootloader_tmp_t;
Chris PeBenito c9428d
files_tmp_file(bootloader_tmp_t)
Karl MacMillan f0c985
dev_node(bootloader_tmp_t)
Chris PeBenito b4cd15
Chris PeBenito 710791
#
Chris PeBenito 710791
# /var/log/ksyms
Chris PeBenito 710791
# cjp: this probably can be removed, I do not
Chris PeBenito 710791
# think it is used on 2.6 kernels
Chris PeBenito 710791
type var_log_ksyms_t;
Chris PeBenito c3cf66
logging_log_file(var_log_ksyms_t)
Chris PeBenito 710791
Chris PeBenito 8a0da1
########################################
Chris PeBenito 8a0da1
#
Chris PeBenito 8a0da1
# bootloader local policy
Chris PeBenito 8a0da1
#
Chris PeBenito 8a0da1
Chris PeBenito b4cd15
allow bootloader_t self:capability { dac_read_search fsetid sys_rawio sys_admin mknod chown };
Chris PeBenito b4cd15
allow bootloader_t self:process { sigkill sigstop signull signal };
Chris PeBenito b0d224
allow bootloader_t self:fifo_file rw_file_perms;
Chris PeBenito b4cd15
Chris PeBenito c2c00b
allow bootloader_t bootloader_etc_t:file r_file_perms;
Chris PeBenito 7bba9d
# uncomment the following lines if you use "lilo -p"
Chris PeBenito 1c1ac6
#allow bootloader_t bootloader_etc_t:file manage_file_perms;
Chris PeBenito 1c1ac6
#files_etc_filetrans(bootloader_t,bootloader_etc_t,file)
Chris PeBenito 7bba9d
Chris PeBenito c2c00b
allow bootloader_t bootloader_tmp_t:dir create_dir_perms;
Chris PeBenito c2c00b
allow bootloader_t bootloader_tmp_t:file create_file_perms;
Chris PeBenito c2c00b
allow bootloader_t bootloader_tmp_t:chr_file create_file_perms;
Chris PeBenito c2c00b
allow bootloader_t bootloader_tmp_t:blk_file create_file_perms;
Chris PeBenito c2c00b
allow bootloader_t bootloader_tmp_t:lnk_file create_lnk_perms;
Chris PeBenito 103fe2
files_tmp_filetrans(bootloader_t,bootloader_tmp_t,{ dir file lnk_file chr_file blk_file })
Chris PeBenito 7bba9d
# for tune2fs (cjp: ?)
Chris PeBenito 1c1ac6
files_root_filetrans(bootloader_t,bootloader_tmp_t,file)
Chris PeBenito 7bba9d
Chris PeBenito 445522
kernel_getattr_core_if(bootloader_t)
Chris PeBenito b4cd15
kernel_read_system_state(bootloader_t)
Chris PeBenito b4cd15
kernel_read_software_raid_state(bootloader_t)
Chris PeBenito 445522
kernel_read_kernel_sysctls(bootloader_t)
Chris PeBenito b4cd15
Chris PeBenito b4cd15
storage_raw_read_fixed_disk(bootloader_t)
Chris PeBenito b4cd15
storage_raw_write_fixed_disk(bootloader_t)
Chris PeBenito b4cd15
storage_raw_read_removable_device(bootloader_t)
Chris PeBenito b4cd15
storage_raw_write_removable_device(bootloader_t)
Chris PeBenito b4cd15
Karl MacMillan f0c985
dev_getattr_all_chr_files(bootloader_t)
Chris PeBenito 9d3bdc
dev_getattr_all_blk_files(bootloader_t)
Karl MacMillan f0c985
dev_dontaudit_rw_generic_dev_nodes(bootloader_t)
Karl MacMillan f0c985
dev_read_rand(bootloader_t)
Karl MacMillan f0c985
dev_read_urand(bootloader_t)
Chris PeBenito b0d224
dev_read_sysfs(bootloader_t)
Chris PeBenito 3ce6cb
# for reading BIOS data
Karl MacMillan f0c985
dev_read_raw_memory(bootloader_t)
Chris PeBenito b4cd15
Chris PeBenito 0fd9dc
fs_getattr_xattr_fs(bootloader_t)
Chris PeBenito a52492
fs_read_tmpfs_symlinks(bootloader_t)
Chris PeBenito 7bba9d
Chris PeBenito cdc86e
mls_file_read_up(bootloader_t)
Chris PeBenito cdc86e
Chris PeBenito 0fd9dc
term_getattr_all_user_ttys(bootloader_t)
Chris PeBenito 1815ba
term_dontaudit_manage_pty_dirs(bootloader_t)
Chris PeBenito 7bba9d
Chris PeBenito fb63d0
corecmd_exec_all_executables(bootloader_t)
Chris PeBenito a2d824
Chris PeBenito 15722e
domain_use_interactive_fds(bootloader_t)
Chris PeBenito a2d824
Chris PeBenito 1c1ac6
files_create_boot_dirs(bootloader_t)
Chris PeBenito 1c1ac6
files_manage_boot_files(bootloader_t)
Chris PeBenito 1c1ac6
files_manage_boot_symlinks(bootloader_t)
Chris PeBenito 8fd367
files_read_etc_files(bootloader_t)
Chris PeBenito 681c9a
files_exec_etc_files(bootloader_t)
Chris PeBenito 8fd367
files_read_usr_src_files(bootloader_t)
Chris PeBenito c9428d
files_read_usr_files(bootloader_t)
Chris PeBenito 8fd367
files_read_var_files(bootloader_t)
Chris PeBenito 1c1ac6
files_read_kernel_modules(bootloader_t)
Chris PeBenito 7bba9d
# for nscd
Chris PeBenito c9428d
files_dontaudit_search_pids(bootloader_t)
Chris PeBenito a3cf80
# for blkid.tab
Chris PeBenito a3cf80
files_manage_etc_runtime_files(bootloader_t)
Chris PeBenito a2d824
Chris PeBenito 1aa526
init_getattr_initctl(bootloader_t)
Chris PeBenito 1815ba
init_use_script_ptys(bootloader_t)
Chris PeBenito 15722e
init_use_script_fds(bootloader_t)
Chris PeBenito 1815ba
init_rw_script_pipes(bootloader_t)
Chris PeBenito 1aa526
Chris PeBenito 1aa526
libs_use_ld_so(bootloader_t)
Chris PeBenito 1aa526
libs_use_shared_libs(bootloader_t)
Chris PeBenito 1815ba
libs_read_lib_files(bootloader_t)
Chris PeBenito 681c9a
libs_exec_lib_files(bootloader_t)
Chris PeBenito b4cd15
Chris PeBenito c9428d
logging_send_syslog_msg(bootloader_t)
Chris PeBenito c9428d
logging_rw_generic_logs(bootloader_t)
Chris PeBenito b4cd15
Chris PeBenito 7bba9d
miscfiles_read_localization(bootloader_t)
Chris PeBenito b4cd15
Chris PeBenito 1815ba
seutil_read_bin_policy(bootloader_t)
Chris PeBenito 1815ba
seutil_read_loadpolicy(bootloader_t)
Chris PeBenito a5f339
seutil_dontaudit_search_config(bootloader_t)
Chris PeBenito 8a0da1
Chris PeBenito 58c3da
ifdef(`distro_debian',`
Chris PeBenito 58c3da
	allow bootloader_t bootloader_tmp_t:{ dir file } { relabelfrom relabelto };
Chris PeBenito 5f38a6
	fs_list_tmpfs(bootloader_t)
Chris PeBenito 5f38a6
Chris PeBenito 1c1ac6
	files_relabel_kernel_modules(bootloader_t)
Chris PeBenito 1c1ac6
	files_relabelfrom_boot_files(bootloader_t)
Chris PeBenito 1c1ac6
	files_delete_kernel_modules(bootloader_t)
Chris PeBenito 5f38a6
	files_relabelto_usr_files(bootloader_t)
Chris PeBenito 5f38a6
	files_search_var_lib(bootloader_t)
Chris PeBenito 58c3da
	# for /usr/share/initrd-tools/scripts
Chris PeBenito 58c3da
	files_exec_usr_files(bootloader_t)
Chris PeBenito 5f38a6
Chris PeBenito 5f38a6
	fstools_manage_entry_files(bootloader_t)
Chris PeBenito 5f38a6
	fstools_relabelto_entry_files(bootloader_t)
Chris PeBenito 5f38a6
Chris PeBenito 5f38a6
	libs_relabelto_lib_files(bootloader_t)
Chris PeBenito 7bba9d
')
Chris PeBenito a2d824
Chris PeBenito 58c3da
ifdef(`distro_redhat',`
Chris PeBenito 0c73cd
	# for memlock
Chris PeBenito 0c73cd
	allow bootloader_t self:capability ipc_lock;
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	# new file system defaults to file_t, granting file_t access is still bad.
Chris PeBenito c2c00b
	allow bootloader_t boot_runtime_t:file { r_file_perms unlink };
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	# mkinitrd mount initrd on bootloader temp dir
Chris PeBenito c9428d
	files_mountpoint(bootloader_tmp_t)
Chris PeBenito 0c73cd
Chris PeBenito 58c3da
	# new file system defaults to file_t, granting file_t access is still bad.
Chris PeBenito 9e04f5
	files_manage_isid_type_dirs(bootloader_t)
Chris PeBenito 9e04f5
	files_manage_isid_type_files(bootloader_t)
Chris PeBenito 9e04f5
	files_manage_isid_type_symlinks(bootloader_t)
Chris PeBenito 9e04f5
	files_manage_isid_type_blk_files(bootloader_t)
Chris PeBenito 9e04f5
	files_manage_isid_type_chr_files(bootloader_t)
Chris PeBenito 58c3da
Chris PeBenito 0c73cd
	# for mke2fs
Chris PeBenito c9428d
	mount_domtrans(bootloader_t)
Chris PeBenito 7bba9d
')
Chris PeBenito a2d824
Chris PeBenito 704327
ifdef(`targeted_policy',`
Chris PeBenito 1815ba
	term_use_unallocated_ttys(bootloader_t)
Chris PeBenito 1815ba
	term_use_generic_ptys(bootloader_t)
Chris PeBenito 704327
')
Chris PeBenito 704327
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito 71fe0f
	fstools_exec(bootloader_t)
Chris PeBenito 7bba9d
')
Chris PeBenito a2d824
Chris PeBenito bb7170
optional_policy(`
Karl MacMillan f0c985
	dev_rw_lvm_control(bootloader_t)
Chris PeBenito 0c73cd
Chris PeBenito c9428d
	lvm_domtrans(bootloader_t)
Chris PeBenito 0c73cd
	lvm_read_config(bootloader_t)
Chris PeBenito 7bba9d
')
Chris PeBenito a2d824
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito 12ae75
	modutils_exec_insmod(bootloader_t)
Chris PeBenito 1815ba
	modutils_read_module_deps(bootloader_t)
Chris PeBenito 1815ba
	modutils_read_module_config(bootloader_t)
Chris PeBenito c9428d
	modutils_exec_insmod(bootloader_t)
Chris PeBenito c9428d
	modutils_exec_depmod(bootloader_t)
Chris PeBenito c9428d
	modutils_exec_update_mods(bootloader_t)
Chris PeBenito 7bba9d
')
Chris PeBenito b4cd15
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito 1815ba
	nscd_socket_use(bootloader_t)
Chris PeBenito 704327
')
Chris PeBenito 704327
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito 1815ba
	rpm_rw_pipes(bootloader_t)
Chris PeBenito b24f35
')
Chris PeBenito b24f35
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito 103fe2
	userdom_dontaudit_search_staff_home_dirs(bootloader_t)
Chris PeBenito 103fe2
	userdom_dontaudit_search_sysadm_home_dirs(bootloader_t)
Chris PeBenito a5f339
')