Chris PeBenito e181fe
Chris PeBenito 960373
policy_module(kernel,1.0)
Chris PeBenito 960373
Chris PeBenito 18f25a
# assertion related attributes
Chris PeBenito a266e3
attribute can_load_policy;
Chris PeBenito a266e3
attribute can_setenforce;
Chris PeBenito a266e3
attribute can_setsecparam;
Chris PeBenito a266e3
attribute can_load_kernmodule;
Chris PeBenito a266e3
attribute can_receive_kernel_messages;
Chris PeBenito a266e3
Chris PeBenito 18f25a
# constraint related attributes
Chris PeBenito 18f25a
attribute can_change_process_identity;
Chris PeBenito 18f25a
attribute can_change_process_role;
Chris PeBenito 18f25a
attribute can_change_object_identity;
Chris PeBenito 18f25a
Chris PeBenito a266e3
#
Chris PeBenito b4cd15
# kernel_t is the domain of kernel threads.
Chris PeBenito b4cd15
# It is also the target type when checking permissions in the system class.
Chris PeBenito b4cd15
# 
Chris PeBenito a266e3
type kernel_t, can_load_kernmodule, can_load_policy;
Chris PeBenito b4cd15
role system_r types kernel_t;
Chris PeBenito c9428d
domain_type(kernel_t)
Chris PeBenito cabfa5
sid kernel context_template(system_u:system_r:kernel_t,s0 - s9:c0.c127)
Chris PeBenito b4cd15
Chris PeBenito b4cd15
#
Chris PeBenito b4cd15
# unlabeled_t is the type of unlabeled objects.
Chris PeBenito b4cd15
# Objects that have no known labeling information or that
Chris PeBenito b4cd15
# have labels that are no longer valid are treated as having this type.
Chris PeBenito b4cd15
#
Chris PeBenito b4cd15
type unlabeled_t;
Chris PeBenito cabfa5
sid unlabeled context_template(system_u:object_r:unlabeled_t,s0)
Chris PeBenito cabfa5
Chris PeBenito cabfa5
# These initial sids are no longer used, and can be removed:
Chris PeBenito cabfa5
sid any_socket		context_template(system_u:object_r:unlabeled_t,s0)
Chris PeBenito cabfa5
sid file_labels		context_template(system_u:object_r:unlabeled_t,s0)
Chris PeBenito cabfa5
sid icmp_socket		context_template(system_u:object_r:unlabeled_t,s0)
Chris PeBenito cabfa5
sid igmp_packet		context_template(system_u:object_r:unlabeled_t,s0)
Chris PeBenito cabfa5
sid init		context_template(system_u:object_r:unlabeled_t,s0)
Chris PeBenito cabfa5
sid kmod		context_template(system_u:object_r:unlabeled_t,s0)
Chris PeBenito cabfa5
sid netmsg		context_template(system_u:object_r:unlabeled_t,s0)
Chris PeBenito cabfa5
sid policy		context_template(system_u:object_r:unlabeled_t,s0)
Chris PeBenito cabfa5
sid scmp_packet		context_template(system_u:object_r:unlabeled_t,s0)
Chris PeBenito cabfa5
sid sysctl_modprobe 	context_template(system_u:object_r:unlabeled_t,s0)
Chris PeBenito cabfa5
sid sysctl_fs		context_template(system_u:object_r:unlabeled_t,s0)
Chris PeBenito cabfa5
sid sysctl_kernel	context_template(system_u:object_r:unlabeled_t,s0)
Chris PeBenito cabfa5
sid sysctl_net		context_template(system_u:object_r:unlabeled_t,s0)
Chris PeBenito cabfa5
sid sysctl_net_unix	context_template(system_u:object_r:unlabeled_t,s0)
Chris PeBenito cabfa5
sid sysctl_vm		context_template(system_u:object_r:unlabeled_t,s0)
Chris PeBenito cabfa5
sid sysctl_dev		context_template(system_u:object_r:unlabeled_t,s0)
Chris PeBenito cabfa5
sid tcp_socket		context_template(system_u:object_r:unlabeled_t,s0)
Chris PeBenito b4cd15
Chris PeBenito b4cd15
# 
Chris PeBenito b4cd15
# security_t is the target type when checking
Chris PeBenito b4cd15
# the permissions in the security class.  It is also
Chris PeBenito b4cd15
# applied to selinuxfs inodes.
Chris PeBenito b4cd15
#
Chris PeBenito b4cd15
type security_t;
Chris PeBenito 763c44
fs_make_fs(security_t)
Chris PeBenito cabfa5
sid security context_template(system_u:object_r:security_t,s0)
Chris PeBenito e32c0d
genfscon selinuxfs / context_template(system_u:object_r:security_t,s0)
Chris PeBenito b4cd15
Chris PeBenito b4cd15
#
Chris PeBenito b4cd15
# sysfs_t is the type for /sys
Chris PeBenito b4cd15
#
Chris PeBenito b4cd15
type sysfs_t;
Chris PeBenito c9428d
files_mountpoint(sysfs_t)
Chris PeBenito 763c44
fs_make_fs(sysfs_t)
Chris PeBenito e32c0d
genfscon sysfs / context_template(system_u:object_r:sysfs_t,s0)
Chris PeBenito b4cd15
Chris PeBenito b4cd15
#
Chris PeBenito b4cd15
# Procfs types
Chris PeBenito b4cd15
#
Chris PeBenito b4cd15
Chris PeBenito b4cd15
type proc_t;
Chris PeBenito c9428d
files_mountpoint(proc_t)
Chris PeBenito 763c44
fs_make_fs(proc_t)
Chris PeBenito e32c0d
genfscon proc / context_template(system_u:object_r:proc_t,s0)
Chris PeBenito e32c0d
genfscon proc /sysvipc context_template(system_u:object_r:proc_t,s0)
Chris PeBenito b4cd15
Chris PeBenito b4cd15
# kernel message interface
Chris PeBenito b4cd15
type proc_kmsg_t;
Chris PeBenito e32c0d
genfscon proc /kmsg context_template(system_u:object_r:proc_kmsg_t,s0)
Chris PeBenito b4cd15
neverallow ~can_receive_kernel_messages proc_kmsg_t:file ~getattr;
Chris PeBenito b4cd15
Chris PeBenito b4cd15
# /proc kcore: inaccessible
Chris PeBenito b4cd15
type proc_kcore_t;
Chris PeBenito b4cd15
neverallow * proc_kcore_t:file ~getattr;
Chris PeBenito e32c0d
genfscon proc /kcore context_template(system_u:object_r:proc_kcore_t,s0)
Chris PeBenito b4cd15
Chris PeBenito b4cd15
type proc_mdstat_t;
Chris PeBenito e32c0d
genfscon proc /mdstat context_template(system_u:object_r:proc_mdstat_t,s0)
Chris PeBenito b4cd15
Chris PeBenito b4cd15
type proc_net_t;
Chris PeBenito e32c0d
genfscon proc /net context_template(system_u:object_r:proc_net_t,s0)
Chris PeBenito b4cd15
Chris PeBenito b4cd15
#
Chris PeBenito b4cd15
# Sysctl types
Chris PeBenito b4cd15
#
Chris PeBenito b4cd15
Chris PeBenito b4cd15
# /proc/irq directory and files
Chris PeBenito b4cd15
type sysctl_irq_t;
Chris PeBenito e32c0d
genfscon proc /irq context_template(system_u:object_r:sysctl_irq_t,s0)
Chris PeBenito b4cd15
Chris PeBenito b4cd15
# /proc/net/rpc directory and files
Chris PeBenito b4cd15
type sysctl_rpc_t;
Chris PeBenito e32c0d
genfscon proc /net/rpc context_template(system_u:object_r:sysctl_rpc_t,s0)
Chris PeBenito b4cd15
Chris PeBenito b4cd15
# /proc/sys directory, base directory of sysctls
Chris PeBenito b4cd15
type sysctl_t;
Chris PeBenito c9428d
files_mountpoint(sysctl_t)
Chris PeBenito cabfa5
sid sysctl context_template(system_u:object_r:sysctl_t,s0)
Chris PeBenito e32c0d
genfscon proc /sys context_template(system_u:object_r:sysctl_t,s0)
Chris PeBenito b4cd15
Chris PeBenito b4cd15
# /proc/sys/fs directory and files
Chris PeBenito b4cd15
type sysctl_fs_t;
Chris PeBenito c9428d
files_mountpoint(sysctl_fs_t)
Chris PeBenito e32c0d
genfscon proc /sys/fs context_template(system_u:object_r:sysctl_fs_t,s0)
Chris PeBenito b4cd15
Chris PeBenito b4cd15
# /proc/sys/kernel directory and files
Chris PeBenito b4cd15
type sysctl_kernel_t;
Chris PeBenito e32c0d
genfscon proc /sys/kernel context_template(system_u:object_r:sysctl_kernel_t,s0)
Chris PeBenito b4cd15
Chris PeBenito b4cd15
# /proc/sys/kernel/modprobe file
Chris PeBenito b4cd15
type sysctl_modprobe_t;
Chris PeBenito e32c0d
genfscon proc /sys/kernel/modprobe context_template(system_u:object_r:sysctl_modprobe_t,s0)
Chris PeBenito b4cd15
Chris PeBenito b4cd15
# /proc/sys/kernel/hotplug file
Chris PeBenito b4cd15
type sysctl_hotplug_t;
Chris PeBenito e32c0d
genfscon proc /sys/kernel/hotplug context_template(system_u:object_r:sysctl_hotplug_t,s0)
Chris PeBenito b4cd15
Chris PeBenito b4cd15
# /proc/sys/net directory and files
Chris PeBenito b4cd15
type sysctl_net_t;
Chris PeBenito e32c0d
genfscon proc /sys/net context_template(system_u:object_r:sysctl_net_t,s0)
Chris PeBenito b4cd15
Chris PeBenito b4cd15
# /proc/sys/net/unix directory and files
Chris PeBenito b4cd15
type sysctl_net_unix_t;
Chris PeBenito e32c0d
genfscon proc /sys/net/unix context_template(system_u:object_r:sysctl_net_unix_t,s0)
Chris PeBenito b4cd15
Chris PeBenito b4cd15
# /proc/sys/vm directory and files
Chris PeBenito b4cd15
type sysctl_vm_t;
Chris PeBenito e32c0d
genfscon proc /sys/vm context_template(system_u:object_r:sysctl_vm_t,s0)
Chris PeBenito b4cd15
Chris PeBenito b4cd15
# /proc/sys/dev directory and files
Chris PeBenito b4cd15
type sysctl_dev_t;
Chris PeBenito e32c0d
genfscon proc /sys/dev context_template(system_u:object_r:sysctl_dev_t,s0)
Chris PeBenito a266e3
Chris PeBenito 0fd9dc
#
Chris PeBenito 0fd9dc
# usbfs_t is the type for /proc/bus/usb
Chris PeBenito 0fd9dc
#
Chris PeBenito 0fd9dc
type usbfs_t alias usbdevfs_t;
Chris PeBenito c9428d
files_mountpoint(usbfs_t)
Chris PeBenito 0fd9dc
fs_make_noxattr_fs(usbfs_t)
Chris PeBenito 0fd9dc
genfscon usbfs / context_template(system_u:object_r:usbfs_t,s0)
Chris PeBenito 0fd9dc
genfscon usbdevfs / context_template(system_u:object_r:usbfs_t,s0)
Chris PeBenito 0fd9dc
Chris PeBenito a266e3
########################################
Chris PeBenito a266e3
#
Chris PeBenito a266e3
# kernel local policy
Chris PeBenito a266e3
#
Chris PeBenito a266e3
Chris PeBenito a266e3
# Use capabilities. need to investigate which capabilities are actually used
Chris PeBenito a266e3
allow kernel_t self:capability *;
Chris PeBenito a266e3
Chris PeBenito a266e3
# Other possible mount points for the root fs are in files
Chris PeBenito a266e3
allow kernel_t unlabeled_t:dir mounton;
Chris PeBenito a266e3
Chris PeBenito a266e3
# old general_domain_access()
Chris PeBenito c2c00b
allow kernel_t self:shm create_shm_perms;
Chris PeBenito c2c00b
allow kernel_t self:sem create_sem_perms;
Chris PeBenito a266e3
allow kernel_t self:msg { send receive };
Chris PeBenito c2c00b
allow kernel_t self:msgq create_msgq_perms;
Chris PeBenito c2c00b
allow kernel_t self:unix_dgram_socket create_socket_perms;
Chris PeBenito c2c00b
allow kernel_t self:unix_stream_socket create_stream_socket_perms;
Chris PeBenito a266e3
allow kernel_t self:unix_dgram_socket sendto;
Chris PeBenito a266e3
allow kernel_t self:unix_stream_socket connectto;
Chris PeBenito c2c00b
allow kernel_t self:fifo_file rw_file_perms;
Chris PeBenito a266e3
allow kernel_t self:fd use;
Chris PeBenito a266e3
Chris PeBenito a266e3
# old general_proc_read_access():
Chris PeBenito c2c00b
allow kernel_t proc_t:dir r_dir_perms;
Chris PeBenito c2c00b
allow kernel_t proc_t:{ lnk_file file } r_file_perms;
Chris PeBenito c2c00b
allow kernel_t proc_net_t:dir r_dir_perms;
Chris PeBenito c2c00b
allow kernel_t proc_net_t:file r_file_perms;
Chris PeBenito c2c00b
allow kernel_t proc_mdstat_t:file r_file_perms;
Chris PeBenito a266e3
allow kernel_t proc_kcore_t:file getattr;
Chris PeBenito a266e3
allow kernel_t proc_kmsg_t:file getattr;
Chris PeBenito c2c00b
allow kernel_t sysctl_t:dir r_dir_perms;
Chris PeBenito c2c00b
allow kernel_t sysctl_kernel_t:dir r_dir_perms;
Chris PeBenito c2c00b
allow kernel_t sysctl_kernel_t:file r_file_perms;
Chris PeBenito a266e3
Chris PeBenito c2c00b
allow kernel_t security_t:dir r_dir_perms;
Chris PeBenito c2c00b
allow kernel_t security_t:file rw_file_perms;
Chris PeBenito a266e3
allow kernel_t security_t:security load_policy;
Chris PeBenito a266e3
auditallow kernel_t security_t:security load_policy;
Chris PeBenito a266e3
Chris PeBenito a154cd
# Kernel-generated traffic e.g., ICMP replies:
Chris PeBenito a154cd
corenet_raw_sendrecv_all_if(kernel_t)
Chris PeBenito a154cd
corenet_raw_sendrecv_all_nodes(kernel_t)
Chris PeBenito a154cd
# Kernel-generated traffic e.g., TCP resets:
Chris PeBenito 0fd9dc
corenet_tcp_sendrecv_all_if(kernel_t)
Chris PeBenito 0fd9dc
corenet_tcp_sendrecv_all_nodes(kernel_t)
Chris PeBenito a154cd
Chris PeBenito 0fd9dc
term_use_console(kernel_t)
Chris PeBenito a154cd
Chris PeBenito a154cd
# Mount root file system.  Used when loading a policy
Chris PeBenito a154cd
# from initrd, then mounting the root filesystem
Chris PeBenito a154cd
fs_mount_all_fs(kernel_t)
Chris PeBenito a154cd
Chris PeBenito c9428d
corecmd_exec_shell(kernel_t)
Chris PeBenito c9428d
corecmd_list_sbin(kernel_t)
Chris PeBenito a154cd
# /proc/sys/kernel/modprobe is set to /bin/true if not using modules.
Chris PeBenito c9428d
corecmd_exec_bin(kernel_t)
Chris PeBenito a154cd
Chris PeBenito a154cd
domain_signal_all_domains(kernel_t)
Chris PeBenito 588ffa
Chris PeBenito c9428d
files_list_root(kernel_t)
Chris PeBenito c9428d
files_list_home(kernel_t)
Chris PeBenito c9428d
files_read_usr_files(kernel_t)
Chris PeBenito 588ffa
Chris PeBenito 588ffa
init_sigchld(kernel_t)
Chris PeBenito 588ffa
Chris PeBenito c9428d
libs_use_ld_so(kernel_t)
Chris PeBenito c9428d
libs_use_shared_libs(kernel_t)
Chris PeBenito a266e3
Chris PeBenito c9428d
logging_send_syslog_msg(kernel_t)
Chris PeBenito a266e3
Chris PeBenito a154cd
selinux_read_config(kernel_t)
Chris PeBenito c9428d
selinux_read_binary_pol(kernel_t)
Chris PeBenito a266e3
Chris PeBenito a266e3
neverallow ~can_load_policy security_t:security load_policy;
Chris PeBenito a266e3
neverallow ~can_setenforce security_t:security setenforce;
Chris PeBenito a266e3
neverallow ~can_setsecparam security_t:security setsecparam;
Chris PeBenito a154cd
neverallow ~can_load_kernmodule self:capability sys_module;
Chris PeBenito 588ffa
Chris PeBenito 588ffa
########################################
Chris PeBenito 588ffa
#
Chris PeBenito 588ffa
# Unlabeled process local policy
Chris PeBenito 588ffa
#
Chris PeBenito 588ffa
Chris PeBenito 588ffa
# If you load a new policy that removes active domains, processes can
Chris PeBenito 588ffa
# get stuck if you do not allow unlabeled processes to signal init.
Chris PeBenito 588ffa
# If you load an incompatible policy, you should probably reboot,
Chris PeBenito 588ffa
# since you may have compromised system security.
Chris PeBenito 588ffa
init_sigchld(unlabeled_t)