Chris PeBenito 948914
## <summary>Run shells with substitute user and group</summary>
Chris PeBenito 948914
Chris PeBenito bb6763
template(`su_restricted_domain_template', `
Chris PeBenito bb6763
	gen_require(`
Chris PeBenito bb6763
		type su_exec_t;
Chris PeBenito bb6763
	')
Chris PeBenito bb6763
Chris PeBenito bb6763
	type $1_su_t;
Chris PeBenito bb6763
	domain_entry_file($1_su_t,su_exec_t)
Chris PeBenito bb6763
	domain_type($1_su_t)
Chris PeBenito bb6763
	domain_wide_inherit_fd($1_su_t)
Chris PeBenito bb6763
	role $3 types $1_su_t;
Chris PeBenito bb6763
Chris PeBenito bb6763
	allow $2 $1_su_t:process signal;
Chris PeBenito bb6763
Chris PeBenito bb6763
	allow $1_su_t self:capability { audit_control audit_write setuid setgid net_bind_service chown dac_override fowner sys_nice sys_resource };
Chris PeBenito bb6763
	dontaudit $1_su_t self:capability sys_tty_config;
Chris PeBenito bb6763
	allow $1_su_t self:process { setexec setsched setrlimit };
Chris PeBenito bb6763
	allow $1_su_t self:fifo_file rw_file_perms;
Chris PeBenito bb6763
	allow $1_su_t self:netlink_audit_socket { nlmsg_relay create_netlink_socket_perms };
Chris PeBenito 2e0a88
	allow $1_su_t self:unix_stream_socket create_stream_socket_perms;
Chris PeBenito bb6763
Chris PeBenito bb6763
	# Transition from the user domain to this domain.
Chris PeBenito bb6763
	domain_auto_trans($2, su_exec_t, $1_su_t)
Chris PeBenito bb6763
	allow $1_su_t $2:fd use;
Chris PeBenito bb6763
	allow $1_su_t $2:fifo_file rw_file_perms;
Chris PeBenito bb6763
	allow $1_su_t $2:process sigchld;
Chris PeBenito bb6763
Chris PeBenito bb6763
	# By default, revert to the calling domain when a shell is executed.
Chris PeBenito bb6763
	corecmd_shell_domtrans($1_su_t,$2)
Chris PeBenito bb6763
	allow $2 $1_su_t:fd use;
Chris PeBenito b0d224
	allow $2 $1_su_t:fifo_file rw_file_perms;
Chris PeBenito b0d224
	allow $2 $1_su_t:process sigchld;
Chris PeBenito bb6763
Chris PeBenito bb6763
	kernel_read_system_state($1_su_t)
Chris PeBenito 445522
	kernel_read_kernel_sysctls($1_su_t)
Chris PeBenito bb6763
Chris PeBenito bb6763
	# for SSP
Chris PeBenito bb6763
	dev_read_urand($1_su_t)
Chris PeBenito bb6763
Chris PeBenito 049e11
	files_read_etc_files($1_su_t)
Chris PeBenito 049e11
	files_read_etc_runtime_files($1_su_t)
Chris PeBenito 049e11
	files_search_var_lib($1_su_t)
Chris PeBenito 9e04f5
	files_dontaudit_getattr_tmp_dirs($1_su_t)
Chris PeBenito 049e11
Chris PeBenito bb6763
	auth_domtrans_chk_passwd($1_su_t)
Chris PeBenito bb6763
	auth_dontaudit_read_shadow($1_su_t)
Chris PeBenito bb6763
	auth_use_nsswitch($1_su_t)
Chris PeBenito bb6763
Chris PeBenito 30705b
	domain_use_wide_inherit_fd($1_su_t)
Chris PeBenito bb6763
Chris PeBenito 725926
	init_dontaudit_use_fd($1_su_t)
Chris PeBenito 1815ba
	init_dontaudit_use_script_ptys($1_su_t)
Chris PeBenito bb6763
	# Write to utmp.
Chris PeBenito 68228b
	init_rw_utmp($1_su_t)
Chris PeBenito bb6763
Chris PeBenito bb6763
	libs_use_ld_so($1_su_t)
Chris PeBenito bb6763
	libs_use_shared_libs($1_su_t)
Chris PeBenito bb6763
Chris PeBenito bb6763
	logging_send_syslog_msg($1_su_t)
Chris PeBenito bb6763
Chris PeBenito bb6763
	miscfiles_read_localization($1_su_t)
Chris PeBenito bb6763
Chris PeBenito 132880
	optional_policy(`cron',`
Chris PeBenito 1815ba
		cron_read_pipes($1_su_t)
Chris PeBenito bb6763
	')
Chris PeBenito bb6763
Chris PeBenito 132880
	optional_policy(`kerberos',`
Chris PeBenito bb6763
		kerberos_use($1_su_t)
Chris PeBenito bb6763
	')
Chris PeBenito bb6763
Chris PeBenito 132880
	optional_policy(`nscd',`
Chris PeBenito 1815ba
		nscd_socket_use($1_su_t)
Chris PeBenito bb6763
	')
Chris PeBenito bb6763
Chris PeBenito bb6763
	ifdef(`TODO',`
Chris PeBenito bb6763
	# Caused by su - init scripts
Chris PeBenito bb6763
	dontaudit $1_su_t initrc_devpts_t:chr_file { getattr ioctl };
Chris PeBenito bb6763
	') dnl end TODO
Chris PeBenito bb6763
')
Chris PeBenito bb6763
Chris PeBenito b9d7d7
#######################################
Chris PeBenito b9d7d7
## <summary>
Chris PeBenito b9d7d7
##	The per user domain template for the su module.
Chris PeBenito b9d7d7
## </summary>
Chris PeBenito b9d7d7
## <desc>
Chris PeBenito b9d7d7
##	

Chris PeBenito b9d7d7
##	This template creates a derived domain which is allowed
Chris PeBenito b9d7d7
##	to change the linux user id, to run shells as a different
Chris PeBenito b9d7d7
##	user.
Chris PeBenito b9d7d7
##	

Chris PeBenito b9d7d7
##	

Chris PeBenito b9d7d7
##	This template is invoked automatically for each user, and
Chris PeBenito b9d7d7
##	generally does not need to be invoked directly
Chris PeBenito b9d7d7
##	by policy writers.
Chris PeBenito b9d7d7
##	

Chris PeBenito b9d7d7
## </desc>
Chris PeBenito b9d7d7
## <param name="userdomain_prefix">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito b9d7d7
##	The prefix of the user domain (e.g., user
Chris PeBenito b9d7d7
##	is the prefix for user_t).
Chris PeBenito 885b83
##	</summary>
Chris PeBenito b9d7d7
## </param>
Chris PeBenito 451c1e
## <param name="user_domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 451c1e
##	The type of the user domain.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 451c1e
## </param>
Chris PeBenito 451c1e
## <param name="user_role">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 451c1e
##	The role associated with the user domain.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 451c1e
## </param>
Chris PeBenito b9d7d7
#
Chris PeBenito 948914
template(`su_per_userdomain_template',`
Chris PeBenito 77f6e2
	gen_require(`
Chris PeBenito 77f6e2
		type su_exec_t;
Chris PeBenito 0efe52
		bool secure_mode;
Chris PeBenito 77f6e2
	')
Chris PeBenito 77f6e2
Chris PeBenito 77f6e2
	type $1_su_t;
Chris PeBenito 77f6e2
	domain_entry_file($1_su_t,su_exec_t)
Chris PeBenito 77f6e2
	domain_type($1_su_t)
Chris PeBenito 77f6e2
	domain_wide_inherit_fd($1_su_t)
Chris PeBenito 77f6e2
	role $3 types $1_su_t;
Chris PeBenito 77f6e2
Chris PeBenito 77f6e2
	allow $2 $1_su_t:process signal;
Chris PeBenito 77f6e2
Chris PeBenito 77f6e2
	allow $1_su_t self:capability { audit_control audit_write setuid setgid net_bind_service chown dac_override fowner sys_nice sys_resource };
Chris PeBenito 77f6e2
	dontaudit $1_su_t self:capability sys_tty_config;
Chris PeBenito 77f6e2
	allow $1_su_t self:process { setexec setsched setrlimit };
Chris PeBenito 77f6e2
	allow $1_su_t self:fifo_file rw_file_perms;
Chris PeBenito 77f6e2
	allow $1_su_t self:netlink_audit_socket { nlmsg_relay create_netlink_socket_perms };
Chris PeBenito 77f6e2
Chris PeBenito 77f6e2
	# Transition from the user domain to this domain.
Chris PeBenito 77f6e2
	domain_auto_trans($2, su_exec_t, $1_su_t)
Chris PeBenito 77f6e2
	allow $2 $1_su_t:fd use;
Chris PeBenito 77f6e2
	allow $1_su_t $2:fd use;
Chris PeBenito 77f6e2
	allow $1_su_t $2:fifo_file rw_file_perms;
Chris PeBenito 77f6e2
	allow $1_su_t $2:process sigchld;
Chris PeBenito 77f6e2
Chris PeBenito 77f6e2
	# By default, revert to the calling domain when a shell is executed.
Chris PeBenito 77f6e2
	corecmd_shell_domtrans($1_su_t,$2)
Chris PeBenito 77f6e2
	allow $2 $1_su_t:fd use;
Chris PeBenito 77f6e2
	allow $1_su_t $2:fd use;
Chris PeBenito 77f6e2
	allow $1_su_t $2:fifo_file rw_file_perms;
Chris PeBenito 77f6e2
	allow $1_su_t $2:process sigchld;
Chris PeBenito 77f6e2
Chris PeBenito 77f6e2
	kernel_read_system_state($1_su_t)
Chris PeBenito 445522
	kernel_read_kernel_sysctls($1_su_t)
Chris PeBenito 77f6e2
Chris PeBenito 77f6e2
	# for SSP
Chris PeBenito 77f6e2
	dev_read_urand($1_su_t)
Chris PeBenito 77f6e2
Chris PeBenito 77f6e2
	fs_search_auto_mountpoints($1_su_t)
Chris PeBenito 77f6e2
Chris PeBenito 30705b
	auth_domtrans_user_chk_passwd($1,$1_su_t)
Chris PeBenito 77f6e2
	auth_dontaudit_read_shadow($1_su_t)
Chris PeBenito d8636f
	auth_use_nsswitch($1_su_t)
Chris PeBenito 77f6e2
Chris PeBenito 83e451
	corecmd_search_bin($1_su_t)
Chris PeBenito 83e451
	corecmd_search_sbin($1_su_t)
Chris PeBenito 83e451
Chris PeBenito 30705b
	domain_use_wide_inherit_fd($1_su_t)
Chris PeBenito 77f6e2
Chris PeBenito 77f6e2
	files_read_etc_files($1_su_t)
Chris PeBenito a77e65
	files_read_etc_runtime_files($1_su_t)
Chris PeBenito 77f6e2
	files_search_var_lib($1_su_t)
Chris PeBenito 9e04f5
	files_dontaudit_getattr_tmp_dirs($1_su_t)
Chris PeBenito 77f6e2
Chris PeBenito 77f6e2
	init_dontaudit_use_fd($1_su_t)
Chris PeBenito 77f6e2
	# Write to utmp.
Chris PeBenito 68228b
	init_rw_utmp($1_su_t)
Chris PeBenito 77f6e2
Chris PeBenito 77f6e2
	libs_use_ld_so($1_su_t)
Chris PeBenito 77f6e2
	libs_use_shared_libs($1_su_t)
Chris PeBenito 77f6e2
Chris PeBenito 77f6e2
	logging_send_syslog_msg($1_su_t)
Chris PeBenito 77f6e2
Chris PeBenito 77f6e2
	miscfiles_read_localization($1_su_t)
Chris PeBenito 77f6e2
Chris PeBenito 77f6e2
	userdom_use_user_terminals($1,$1_su_t)
Chris PeBenito 9aca49
	userdom_search_user_home($1,$1_su_t)
Chris PeBenito 77f6e2
Chris PeBenito b07eae
	ifdef(`enable_polyinstantiation',`
Chris PeBenito 5e4cbc
		fs_mount_xattr_fs($1_su_t)
Chris PeBenito b07eae
		fs_unmount_xattr_fs($1_su_t)
Chris PeBenito b07eae
	')
Chris PeBenito b07eae
Chris PeBenito b4e1eb
	ifdef(`targeted_policy',`
Chris PeBenito 1d697c
		# allow user to suspend terminal.
Chris PeBenito 1d697c
		# does not work in strict since the
Chris PeBenito 1d697c
		# parent may not be able to use
Chris PeBenito 1d697c
		# the terminal if we newrole,
Chris PeBenito 1d697c
		# which relabels the terminal.
Chris PeBenito 1d697c
		allow $1_su_t self:process sigstop;
Chris PeBenito 1d697c
Chris PeBenito b4e1eb
		corecmd_exec_bin($1_su_t)
Chris PeBenito 2c216c
		userdom_manage_all_user_files($1_su_t)
Chris PeBenito 2c216c
		userdom_manage_all_user_symlinks($1_su_t)
Chris PeBenito b4e1eb
	')
Chris PeBenito b4e1eb
Chris PeBenito 77f6e2
	tunable_policy(`use_nfs_home_dirs',`
Chris PeBenito 77f6e2
		fs_search_nfs($1_su_t)
Chris PeBenito 77f6e2
	')
Chris PeBenito 77f6e2
Chris PeBenito 77f6e2
	tunable_policy(`use_samba_home_dirs',`
Chris PeBenito 77f6e2
		fs_search_cifs($1_su_t)
Chris PeBenito 77f6e2
	')
Chris PeBenito 77f6e2
Chris PeBenito 132880
	optional_policy(`cron',`
Chris PeBenito 1815ba
		cron_read_pipes($1_su_t)
Chris PeBenito 77f6e2
	')
Chris PeBenito 77f6e2
Chris PeBenito 132880
	optional_policy(`kerberos',`
Chris PeBenito 77f6e2
		kerberos_use($1_su_t)
Chris PeBenito 77f6e2
	')
Chris PeBenito 77f6e2
Chris PeBenito 132880
	optional_policy(`nscd',`
Chris PeBenito 1815ba
		nscd_socket_use($1_su_t)
Chris PeBenito 77f6e2
	')
Chris PeBenito 77f6e2
Chris PeBenito 77f6e2
	ifdef(`TODO',`
Chris PeBenito 77f6e2
	# Caused by su - init scripts
Chris PeBenito 77f6e2
	dontaudit $1_su_t initrc_devpts_t:chr_file { getattr ioctl };
Chris PeBenito 77f6e2
Chris PeBenito 77f6e2
	# Inherit and use descriptors from gnome-pty-helper.
Chris PeBenito 77f6e2
	ifdef(`gnome-pty-helper.te', `allow $1_su_t $1_gph_t:fd use;')
Chris PeBenito 77f6e2
Chris PeBenito 77f6e2
	allow $1_su_t $1_home_t:file create_file_perms;
Chris PeBenito 77f6e2
Chris PeBenito 77f6e2
	ifdef(`user_canbe_sysadm', `
Chris PeBenito 77f6e2
	allow $1_su_t home_dir_type:dir { search write };
Chris PeBenito 77f6e2
	', `
Chris PeBenito 77f6e2
	dontaudit $1_su_t home_dir_type:dir { search write };
Chris PeBenito 77f6e2
	')
Chris PeBenito 77f6e2
Chris PeBenito 77f6e2
	# Modify .Xauthority file (via xauth program).
Chris PeBenito 77f6e2
	ifdef(`xauth.te', `
Chris PeBenito 77f6e2
	file_type_auto_trans($1_su_t, staff_home_dir_t, staff_xauth_home_t, file)
Chris PeBenito 77f6e2
	file_type_auto_trans($1_su_t, user_home_dir_t, user_xauth_home_t, file)
Chris PeBenito 77f6e2
	file_type_auto_trans($1_su_t, sysadm_home_dir_t, sysadm_xauth_home_t, file)
Chris PeBenito 77f6e2
	domain_auto_trans($1_su_t, xauth_exec_t, $1_xauth_t)
Chris PeBenito 77f6e2
	')
Chris PeBenito 77f6e2
Chris PeBenito 77f6e2
	ifdef(`cyrus.te', `
Chris PeBenito 77f6e2
	allow $1_su_t cyrus_var_lib_t:dir search;
Chris PeBenito 77f6e2
	')
Chris PeBenito 77f6e2
	ifdef(`ssh.te', `
Chris PeBenito 77f6e2
	# Access sshd cookie files.
Chris PeBenito 77f6e2
	allow $1_su_t sshd_tmp_t:file rw_file_perms;
Chris PeBenito 77f6e2
	file_type_auto_trans($1_su_t, sshd_tmp_t, $1_tmp_t)
Chris PeBenito 948914
	')
Chris PeBenito 77f6e2
	') dnl end TODO
Chris PeBenito 948914
')
Chris PeBenito 799a0b
Chris PeBenito 799a0b
#######################################
Chris PeBenito 799a0b
## <summary>
Chris PeBenito 799a0b
##	Execute su in the caller domain.
Chris PeBenito 799a0b
## </summary>
Chris PeBenito 799a0b
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 799a0b
##	Domain allowed access.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 799a0b
## </param>
Chris PeBenito 799a0b
#
Chris PeBenito 799a0b
interface(`su_exec',`
Chris PeBenito 799a0b
	gen_require(`
Chris PeBenito 799a0b
		type su_exec_t;
Chris PeBenito 799a0b
	')
Chris PeBenito 799a0b
Chris PeBenito 799a0b
	can_exec($1,su_exec_t)
Chris PeBenito 799a0b
')