|
Chris PeBenito |
e181fe |
|
|
Chris PeBenito |
960373 |
policy_module(bootloader,1.0)
|
|
Chris PeBenito |
960373 |
|
|
Chris PeBenito |
a2d824 |
########################################
|
|
Chris PeBenito |
a2d824 |
#
|
|
Chris PeBenito |
a2d824 |
# Declarations
|
|
Chris PeBenito |
a2d824 |
#
|
|
Chris PeBenito |
a2d824 |
|
|
Chris PeBenito |
c9428d |
attribute rw_kern_modules;
|
|
Chris PeBenito |
b4cd15 |
|
|
Chris PeBenito |
b4cd15 |
#
|
|
Chris PeBenito |
b4cd15 |
# boot_t is the type for files in /boot
|
|
Chris PeBenito |
b4cd15 |
#
|
|
Chris PeBenito |
b4cd15 |
type boot_t;
|
|
Chris PeBenito |
8fd367 |
files_type(boot_t)
|
|
Chris PeBenito |
c9428d |
files_mountpoint(boot_t)
|
|
Chris PeBenito |
b4cd15 |
|
|
Chris PeBenito |
5f75f5 |
#
|
|
Chris PeBenito |
5f75f5 |
# boot_runtime_t is the type for /boot/kernel.h,
|
|
Chris PeBenito |
5f75f5 |
# which is automatically generated at boot time.
|
|
Chris PeBenito |
5f75f5 |
# only for Red Hat
|
|
Chris PeBenito |
5f75f5 |
#
|
|
Chris PeBenito |
70dcf7 |
type boot_runtime_t;
|
|
Chris PeBenito |
8fd367 |
files_type(boot_runtime_t)
|
|
Chris PeBenito |
70dcf7 |
|
|
Chris PeBenito |
5f75f5 |
type bootloader_t;
|
|
Chris PeBenito |
c9428d |
domain_type(bootloader_t)
|
|
Chris PeBenito |
3ce6cb |
role system_r types bootloader_t;
|
|
Chris PeBenito |
5f75f5 |
|
|
Chris PeBenito |
5f75f5 |
type bootloader_exec_t;
|
|
Chris PeBenito |
c9428d |
domain_entry_file(bootloader_t,bootloader_exec_t)
|
|
Chris PeBenito |
5f75f5 |
|
|
Chris PeBenito |
b4cd15 |
#
|
|
Chris PeBenito |
b4cd15 |
# bootloader_etc_t is the configuration file,
|
|
Chris PeBenito |
b4cd15 |
# grub.conf, lilo.conf, etc.
|
|
Chris PeBenito |
b4cd15 |
#
|
|
Chris PeBenito |
b4cd15 |
type bootloader_etc_t alias etc_bootloader_t;
|
|
Chris PeBenito |
8fd367 |
files_type(bootloader_etc_t)
|
|
Chris PeBenito |
b4cd15 |
|
|
Chris PeBenito |
b4cd15 |
#
|
|
Chris PeBenito |
b4cd15 |
# The temp file is used for initrd creation;
|
|
Chris PeBenito |
b4cd15 |
# it consists of files and device nodes
|
|
Chris PeBenito |
b4cd15 |
#
|
|
Chris PeBenito |
b4cd15 |
type bootloader_tmp_t;
|
|
Chris PeBenito |
c9428d |
files_tmp_file(bootloader_tmp_t)
|
|
Karl MacMillan |
f0c985 |
dev_node(bootloader_tmp_t)
|
|
Chris PeBenito |
b4cd15 |
|
|
Chris PeBenito |
5f75f5 |
# kernel modules
|
|
Chris PeBenito |
5f75f5 |
type modules_object_t;
|
|
Chris PeBenito |
8fd367 |
files_type(modules_object_t)
|
|
Chris PeBenito |
5f75f5 |
|
|
Chris PeBenito |
c9428d |
neverallow ~rw_kern_modules modules_object_t:file { create append write };
|
|
Chris PeBenito |
5f75f5 |
|
|
Chris PeBenito |
5f75f5 |
#
|
|
Chris PeBenito |
5f75f5 |
# system_map_t is for the system.map files in /boot
|
|
Chris PeBenito |
5f75f5 |
#
|
|
Chris PeBenito |
5f75f5 |
type system_map_t;
|
|
Chris PeBenito |
8fd367 |
files_type(system_map_t)
|
|
Chris PeBenito |
5f75f5 |
|
|
Chris PeBenito |
8a0da1 |
########################################
|
|
Chris PeBenito |
8a0da1 |
#
|
|
Chris PeBenito |
8a0da1 |
# bootloader local policy
|
|
Chris PeBenito |
8a0da1 |
#
|
|
Chris PeBenito |
8a0da1 |
|
|
Chris PeBenito |
b4cd15 |
allow bootloader_t self:capability { dac_read_search fsetid sys_rawio sys_admin mknod chown };
|
|
Chris PeBenito |
b4cd15 |
allow bootloader_t self:process { sigkill sigstop signull signal };
|
|
Chris PeBenito |
b4cd15 |
allow bootloader_t self:fifo_file { getattr read write };
|
|
Chris PeBenito |
b4cd15 |
|
|
Chris PeBenito |
c2c00b |
allow bootloader_t boot_t:dir ra_dir_perms;
|
|
Chris PeBenito |
c2c00b |
allow bootloader_t boot_t:file { rw_file_perms create };
|
|
Chris PeBenito |
c2c00b |
allow bootloader_t boot_t:lnk_file { r_file_perms create unlink };
|
|
Chris PeBenito |
7bba9d |
|
|
Chris PeBenito |
c2c00b |
allow bootloader_t bootloader_etc_t:file r_file_perms;
|
|
Chris PeBenito |
7bba9d |
# uncomment the following lines if you use "lilo -p"
|
|
Chris PeBenito |
7bba9d |
#allow bootloader_t bootloader_etc_t:file { create ioctl read getattr lock write setattr append link unlink rename };
|
|
Chris PeBenito |
c9428d |
#files_create_etc_config(bootloader_t,bootloader_etc_t)
|
|
Chris PeBenito |
7bba9d |
|
|
Chris PeBenito |
c2c00b |
allow bootloader_t bootloader_tmp_t:dir create_dir_perms;
|
|
Chris PeBenito |
c2c00b |
allow bootloader_t bootloader_tmp_t:file create_file_perms;
|
|
Chris PeBenito |
c2c00b |
allow bootloader_t bootloader_tmp_t:chr_file create_file_perms;
|
|
Chris PeBenito |
c2c00b |
allow bootloader_t bootloader_tmp_t:blk_file create_file_perms;
|
|
Chris PeBenito |
c2c00b |
allow bootloader_t bootloader_tmp_t:lnk_file create_lnk_perms;
|
|
Chris PeBenito |
c9428d |
files_create_tmp_files(bootloader_t,bootloader_tmp_t,{ dir file lnk_file chr_file blk_file })
|
|
Chris PeBenito |
7bba9d |
# for tune2fs (cjp: ?)
|
|
Chris PeBenito |
c9428d |
files_create_root(bootloader_t,bootloader_tmp_t)
|
|
Chris PeBenito |
7bba9d |
|
|
Chris PeBenito |
c2c00b |
allow bootloader_t modules_object_t:dir r_dir_perms;
|
|
Chris PeBenito |
c2c00b |
allow bootloader_t modules_object_t:file r_file_perms;
|
|
Chris PeBenito |
c2c00b |
allow bootloader_t modules_object_t:lnk_file r_file_perms;
|
|
Chris PeBenito |
7bba9d |
|
|
Chris PeBenito |
0fd9dc |
kernel_getattr_core(bootloader_t)
|
|
Chris PeBenito |
b4cd15 |
kernel_read_system_state(bootloader_t)
|
|
Chris PeBenito |
b4cd15 |
kernel_read_software_raid_state(bootloader_t)
|
|
Chris PeBenito |
b4cd15 |
kernel_read_kernel_sysctl(bootloader_t)
|
|
Chris PeBenito |
b4cd15 |
|
|
Chris PeBenito |
b4cd15 |
storage_raw_read_fixed_disk(bootloader_t)
|
|
Chris PeBenito |
b4cd15 |
storage_raw_write_fixed_disk(bootloader_t)
|
|
Chris PeBenito |
b4cd15 |
storage_raw_read_removable_device(bootloader_t)
|
|
Chris PeBenito |
b4cd15 |
storage_raw_write_removable_device(bootloader_t)
|
|
Chris PeBenito |
b4cd15 |
|
|
Karl MacMillan |
f0c985 |
dev_getattr_all_chr_files(bootloader_t)
|
|
Karl MacMillan |
f0c985 |
dev_setattr_all_blk_files(bootloader_t)
|
|
Karl MacMillan |
f0c985 |
dev_dontaudit_rw_generic_dev_nodes(bootloader_t)
|
|
Karl MacMillan |
f0c985 |
dev_read_rand(bootloader_t)
|
|
Karl MacMillan |
f0c985 |
dev_read_urand(bootloader_t)
|
|
Chris PeBenito |
7a2f20 |
dev_getattr_sysfs_dir(bootloader_t)
|
|
Chris PeBenito |
3ce6cb |
# for reading BIOS data
|
|
Karl MacMillan |
f0c985 |
dev_read_raw_memory(bootloader_t)
|
|
Chris PeBenito |
b4cd15 |
|
|
Chris PeBenito |
0fd9dc |
fs_getattr_xattr_fs(bootloader_t)
|
|
Chris PeBenito |
7bba9d |
|
|
Chris PeBenito |
0fd9dc |
term_getattr_all_user_ttys(bootloader_t)
|
|
Chris PeBenito |
5f38a6 |
term_dontaudit_manage_pty_dir(bootloader_t)
|
|
Chris PeBenito |
7bba9d |
|
|
Chris PeBenito |
1aa526 |
corecmd_exec_bin(bootloader_t)
|
|
Chris PeBenito |
1aa526 |
corecmd_exec_sbin(bootloader_t)
|
|
Chris PeBenito |
1aa526 |
corecmd_exec_shell(bootloader_t)
|
|
Chris PeBenito |
a2d824 |
|
|
Chris PeBenito |
1aa526 |
domain_exec_all_entry_files(bootloader_t)
|
|
Chris PeBenito |
c9428d |
domain_use_wide_inherit_fd(bootloader_t)
|
|
Chris PeBenito |
a2d824 |
|
|
Chris PeBenito |
8fd367 |
files_read_etc_files(bootloader_t)
|
|
Chris PeBenito |
c9428d |
files_read_etc_runtime_files(bootloader_t)
|
|
Chris PeBenito |
8fd367 |
files_read_usr_src_files(bootloader_t)
|
|
Chris PeBenito |
c9428d |
files_read_usr_files(bootloader_t)
|
|
Chris PeBenito |
8fd367 |
files_read_var_files(bootloader_t)
|
|
Chris PeBenito |
7bba9d |
# for nscd
|
|
Chris PeBenito |
c9428d |
files_dontaudit_search_pids(bootloader_t)
|
|
Chris PeBenito |
a2d824 |
|
|
Chris PeBenito |
1aa526 |
init_getattr_initctl(bootloader_t)
|
|
Chris PeBenito |
1aa526 |
init_use_script_pty(bootloader_t)
|
|
Chris PeBenito |
1aa526 |
init_use_script_fd(bootloader_t)
|
|
Chris PeBenito |
1aa526 |
init_rw_script_pipe(bootloader_t)
|
|
Chris PeBenito |
1aa526 |
|
|
Chris PeBenito |
1aa526 |
libs_use_ld_so(bootloader_t)
|
|
Chris PeBenito |
1aa526 |
libs_use_shared_libs(bootloader_t)
|
|
Chris PeBenito |
1aa526 |
libs_read_lib(bootloader_t)
|
|
Chris PeBenito |
b4cd15 |
|
|
Chris PeBenito |
c9428d |
logging_send_syslog_msg(bootloader_t)
|
|
Chris PeBenito |
c9428d |
logging_rw_generic_logs(bootloader_t)
|
|
Chris PeBenito |
b4cd15 |
|
|
Chris PeBenito |
7bba9d |
miscfiles_read_localization(bootloader_t)
|
|
Chris PeBenito |
b4cd15 |
|
|
Chris PeBenito |
5e0da6 |
seutil_read_binary_pol(bootloader_t)
|
|
Chris PeBenito |
5e0da6 |
seutil_read_loadpol(bootloader_t)
|
|
Chris PeBenito |
a5f339 |
seutil_dontaudit_search_config(bootloader_t)
|
|
Chris PeBenito |
8a0da1 |
|
|
Chris PeBenito |
58c3da |
ifdef(`distro_debian',`
|
|
Chris PeBenito |
58c3da |
allow bootloader_t bootloader_tmp_t:{ dir file } { relabelfrom relabelto };
|
|
Chris PeBenito |
58c3da |
allow bootloader_t modules_object_t:file { relabelfrom relabelto unlink };
|
|
Chris PeBenito |
58c3da |
allow bootloader_t boot_t:file relabelfrom;
|
|
Chris PeBenito |
58c3da |
|
|
Chris PeBenito |
5f38a6 |
fs_list_tmpfs(bootloader_t)
|
|
Chris PeBenito |
5f38a6 |
|
|
Chris PeBenito |
5f38a6 |
files_relabelto_usr_files(bootloader_t)
|
|
Chris PeBenito |
5f38a6 |
files_search_var_lib(bootloader_t)
|
|
Chris PeBenito |
58c3da |
# for /usr/share/initrd-tools/scripts
|
|
Chris PeBenito |
58c3da |
files_exec_usr_files(bootloader_t)
|
|
Chris PeBenito |
5f38a6 |
|
|
Chris PeBenito |
5f38a6 |
fstools_manage_entry_files(bootloader_t)
|
|
Chris PeBenito |
5f38a6 |
fstools_relabelto_entry_files(bootloader_t)
|
|
Chris PeBenito |
5f38a6 |
|
|
Chris PeBenito |
2d803e |
init_list_script_pids(bootloader_t)
|
|
Chris PeBenito |
2d803e |
|
|
Chris PeBenito |
5f38a6 |
libs_relabelto_lib_files(bootloader_t)
|
|
Chris PeBenito |
7bba9d |
')
|
|
Chris PeBenito |
a2d824 |
|
|
Chris PeBenito |
58c3da |
ifdef(`distro_redhat',`
|
|
Chris PeBenito |
0c73cd |
# for memlock
|
|
Chris PeBenito |
0c73cd |
allow bootloader_t self:capability ipc_lock;
|
|
Chris PeBenito |
0c73cd |
|
|
Chris PeBenito |
0c73cd |
# new file system defaults to file_t, granting file_t access is still bad.
|
|
Chris PeBenito |
c2c00b |
allow bootloader_t boot_runtime_t:file { r_file_perms unlink };
|
|
Chris PeBenito |
0c73cd |
|
|
Chris PeBenito |
0c73cd |
# mkinitrd mount initrd on bootloader temp dir
|
|
Chris PeBenito |
c9428d |
files_mountpoint(bootloader_tmp_t)
|
|
Chris PeBenito |
0c73cd |
|
|
Chris PeBenito |
58c3da |
# new file system defaults to file_t, granting file_t access is still bad.
|
|
Chris PeBenito |
58c3da |
files_manage_isid_type_dir(bootloader_t)
|
|
Chris PeBenito |
58c3da |
files_manage_isid_type_file(bootloader_t)
|
|
Chris PeBenito |
58c3da |
files_manage_isid_type_symlink(bootloader_t)
|
|
Chris PeBenito |
58c3da |
files_manage_isid_type_blk_node(bootloader_t)
|
|
Chris PeBenito |
58c3da |
files_manage_isid_type_chr_node(bootloader_t)
|
|
Chris PeBenito |
58c3da |
|
|
Chris PeBenito |
0c73cd |
# for mke2fs
|
|
Chris PeBenito |
c9428d |
mount_domtrans(bootloader_t)
|
|
Chris PeBenito |
7bba9d |
')
|
|
Chris PeBenito |
a2d824 |
|
|
Chris PeBenito |
58c3da |
optional_policy(`filesystemtools.te',`
|
|
Chris PeBenito |
0c73cd |
filesystemtools_execute(bootloader_t)
|
|
Chris PeBenito |
7bba9d |
')
|
|
Chris PeBenito |
a2d824 |
|
|
Chris PeBenito |
58c3da |
optional_policy(`lvm.te',`
|
|
Karl MacMillan |
f0c985 |
dev_rw_lvm_control(bootloader_t)
|
|
Chris PeBenito |
0c73cd |
|
|
Chris PeBenito |
c9428d |
lvm_domtrans(bootloader_t)
|
|
Chris PeBenito |
0c73cd |
lvm_read_config(bootloader_t)
|
|
Chris PeBenito |
7bba9d |
')
|
|
Chris PeBenito |
a2d824 |
|
|
Chris PeBenito |
7bba9d |
optional_policy(`modutils.te',`
|
|
Chris PeBenito |
c9428d |
modutils_exec_insmod(insmod_t)
|
|
Chris PeBenito |
8fd367 |
modutils_read_mods_deps(bootloader_t)
|
|
Chris PeBenito |
c9428d |
modutils_read_module_conf(bootloader_t)
|
|
Chris PeBenito |
c9428d |
modutils_exec_insmod(bootloader_t)
|
|
Chris PeBenito |
c9428d |
modutils_exec_depmod(bootloader_t)
|
|
Chris PeBenito |
c9428d |
modutils_exec_update_mods(bootloader_t)
|
|
Chris PeBenito |
7bba9d |
')
|
|
Chris PeBenito |
b4cd15 |
|
|
Chris PeBenito |
b24f35 |
optional_policy(`rpm.te',`
|
|
Chris PeBenito |
b24f35 |
rpm_rw_pipe(bootloader_t)
|
|
Chris PeBenito |
b24f35 |
')
|
|
Chris PeBenito |
b24f35 |
|
|
Chris PeBenito |
a5f339 |
optional_policy(`userdomain.te',`
|
|
Chris PeBenito |
a5f339 |
userdom_dontaudit_search_staff_home_dir(bootloader_t)
|
|
Chris PeBenito |
a5f339 |
userdom_dontaudit_search_sysadm_home_dir(bootloader_t)
|
|
Chris PeBenito |
a5f339 |
')
|
|
Chris PeBenito |
b4cd15 |
|
|
Chris PeBenito |
a5f339 |
ifdef(`TODO',`
|
|
Chris PeBenito |
254bbc |
ifdef(`distro_debian', `
|
|
Chris PeBenito |
5f38a6 |
# cjp: there is no setfscreate or type_transition, and
|
|
Chris PeBenito |
5f38a6 |
# bootloader_t cannot rw a usr_t or lib_t directory, so
|
|
Chris PeBenito |
5f38a6 |
# how can this work? This is probably rw_file_perms,
|
|
Chris PeBenito |
5f38a6 |
# possibly with unlink. Files are probably "created"
|
|
Chris PeBenito |
5f38a6 |
# by the above relabeling permissions.
|
|
Chris PeBenito |
5f38a6 |
allow bootloader_t { usr_t lib_t }:file create_file_perms;
|
|
Chris PeBenito |
5f38a6 |
|
|
Chris PeBenito |
0c73cd |
allow bootloader_t dpkg_var_lib_t:dir r_dir_perms;
|
|
Chris PeBenito |
0c73cd |
allow bootloader_t dpkg_var_lib_t:file { getattr read };
|
|
Chris PeBenito |
b4cd15 |
')
|
|
Chris PeBenito |
b4cd15 |
') dnl end TODO
|