Chris PeBenito 9726b3
## <summary>The unconfined domain.</summary>
Chris PeBenito 9726b3
Chris PeBenito 9726b3
########################################
Chris PeBenito 9726b3
## <summary>
Chris PeBenito 9726b3
##	A template to make the specified domain unconfined.
Chris PeBenito 9726b3
## </summary>
Chris PeBenito 9726b3
## <param name="domain">
Chris PeBenito 9726b3
##	Domain to make unconfined.
Chris PeBenito 9726b3
## </param>
Chris PeBenito 9726b3
#
Chris PeBenito c98340
template(`unconfined_domain_template',`
Chris PeBenito 9726b3
Chris PeBenito 9726b3
	# Use any Linux capability.
Chris PeBenito 9726b3
	allow $1 self:capability *;
Chris PeBenito 9726b3
Chris PeBenito 9726b3
	# Transition to myself, to make get_ordered_context_list happy.
Chris PeBenito 9726b3
	allow $1 self:process transition;
Chris PeBenito 9726b3
Chris PeBenito 9726b3
	# Write access is for setting attributes under /proc/self/attr.
Chris PeBenito 9726b3
	allow $1 self:file rw_file_perms;
Chris PeBenito 9726b3
Chris PeBenito 9726b3
	# Userland object managers
Chris PeBenito 9726b3
	allow $1 self:nscd *;
Chris PeBenito 9726b3
	allow $1 self:dbus *;
Chris PeBenito 9726b3
	allow $1 self:passwd *;
Chris PeBenito 9726b3
Chris PeBenito 9726b3
	kernel_unconfined($1)
Chris PeBenito 8c3f43
	corenet_unconfined($1)
Chris PeBenito 9726b3
	dev_unconfined($1)
Chris PeBenito 9726b3
	fs_unconfined($1)
Chris PeBenito 9726b3
	selinux_unconfined($1)
Chris PeBenito 9726b3
Chris PeBenito 9726b3
	domain_unconfined($1)
Chris PeBenito 9726b3
	files_unconfined($1)
Chris PeBenito 9726b3
Chris PeBenito 9726b3
	tunable_policy(`allow_execmem',`
Chris PeBenito 9726b3
		# Allow loading DSOs that require executable stack.
Chris PeBenito 9726b3
		allow $1 self:process execmem;
Chris PeBenito 9726b3
	')
Chris PeBenito 9726b3
Chris PeBenito 9726b3
	optional_policy(`authlogin.te',`
Chris PeBenito 8b0bbd
		auth_unconfined($1)
Chris PeBenito 9726b3
	')
Chris PeBenito 9726b3
Chris PeBenito 9726b3
	optional_policy(`bootloader.te',`
Chris PeBenito 9726b3
		bootloader_manage_kernel_modules($1)
Chris PeBenito 9726b3
	')
Chris PeBenito 9726b3
Chris PeBenito 493d6c
	optional_policy(`nscd.te', `
Chris PeBenito 493d6c
		nscd_unconfined($1)
Chris PeBenito 493d6c
	')
Chris PeBenito 493d6c
Chris PeBenito 9726b3
	optional_policy(`selinuxutil.te',`
Chris PeBenito 9726b3
		seutil_create_binary_pol($1)
Chris PeBenito 9726b3
		seutil_relabelto_binary_pol($1)
Chris PeBenito 9726b3
	')
Chris PeBenito 9726b3
Chris PeBenito 9726b3
	optional_policy(`storage.te',`
Chris PeBenito 9726b3
		storage_unconfined($1)
Chris PeBenito 9726b3
	')
Chris PeBenito 9726b3
Chris PeBenito 9726b3
	ifdef(`TODO',`
Chris PeBenito 9726b3
	if (allow_execmod) {
Chris PeBenito 9726b3
		# Allow text relocations on system shared libraries, e.g. libGL.
Chris PeBenito 9726b3
		allow $1 texrel_shlib_t:file execmod;
Chris PeBenito 9726b3
	}
Chris PeBenito 9726b3
Chris PeBenito 9726b3
	ifdef(`dbusd.te', `
Chris PeBenito 9726b3
		# Communicate via dbusd.
Chris PeBenito 9726b3
		allow $1 system_dbusd_t:dbus *;
Chris PeBenito 9726b3
	')
Chris PeBenito 9726b3
Chris PeBenito 9726b3
	') dnl end TODO
Chris PeBenito 9726b3
')
Chris PeBenito c98340
Chris PeBenito c98340
########################################
Chris PeBenito c98340
## <summary>
Chris PeBenito b24f35
##	Transition to the unconfined domain.
Chris PeBenito b24f35
## </summary>
Chris PeBenito b24f35
## <param name="domain">
Chris PeBenito b24f35
##	Domain allowed access.
Chris PeBenito b24f35
## </param>
Chris PeBenito b24f35
#
Chris PeBenito b24f35
interface(`unconfined_domtrans',`
Chris PeBenito b24f35
	gen_require(`
Chris PeBenito b24f35
		type unconfined_t, unconfined_exec_t;
Chris PeBenito b24f35
		class process sigchld;
Chris PeBenito b24f35
		class fd use;
Chris PeBenito b24f35
		class fifo_file rw_file_perms;
Chris PeBenito b24f35
	')
Chris PeBenito b24f35
Chris PeBenito b24f35
	domain_auto_trans($1,unconfined_exec_t,unconfined_t)
Chris PeBenito b24f35
Chris PeBenito b24f35
	allow $1 unconfined_t:fd use;
Chris PeBenito b24f35
	allow unconfined_t $1:fd use;
Chris PeBenito b24f35
	allow unconfined_t $1:fifo_file rw_file_perms;
Chris PeBenito b24f35
	allow unconfined_t $1:process sigchld;
Chris PeBenito b24f35
')
Chris PeBenito b24f35
Chris PeBenito b24f35
########################################
Chris PeBenito a5f339
## <desc>
Chris PeBenito a5f339
##	Execute specified programs in the unconfined domain.
Chris PeBenito a5f339
## </desc>
Chris PeBenito a5f339
## <param name="domain">
Chris PeBenito a5f339
##	The type of the process performing this action.
Chris PeBenito a5f339
## </param>
Chris PeBenito a5f339
## <param name="role">
Chris PeBenito a5f339
##	The role to allow the unconfined domain.
Chris PeBenito a5f339
## </param>
Chris PeBenito a5f339
## <param name="terminal">
Chris PeBenito a5f339
##	The type of the terminal allow the unconfined domain to use.
Chris PeBenito a5f339
## </param>
Chris PeBenito a5f339
#
Chris PeBenito a5f339
interface(`unconfined_run',`
Chris PeBenito a5f339
	gen_require(`
Chris PeBenito a5f339
		type unconfined_t;
Chris PeBenito a5f339
		class chr_file rw_term_perms;
Chris PeBenito a5f339
	')
Chris PeBenito a5f339
Chris PeBenito a5f339
	unconfined_domtrans($1)
Chris PeBenito a5f339
	role $2 types unconfined_t;
Chris PeBenito a5f339
	allow unconfined_t $3:chr_file rw_term_perms;
Chris PeBenito a5f339
')
Chris PeBenito a5f339
Chris PeBenito a5f339
########################################
Chris PeBenito b24f35
## <summary>
Chris PeBenito c98340
##	Transition to the unconfined domain by executing a shell.
Chris PeBenito c98340
## </summary>
Chris PeBenito c98340
## <param name="domain">
Chris PeBenito c98340
##	Domain allowed access.
Chris PeBenito c98340
## </param>
Chris PeBenito c98340
#
Chris PeBenito a42ca7
interface(`unconfined_shell_domtrans',`
Chris PeBenito c98340
	gen_require(`
Chris PeBenito b24f35
		type unconfined_t;
Chris PeBenito c98340
	')
Chris PeBenito c98340
Chris PeBenito 8b0bbd
	corecmd_shell_domtrans($1,unconfined_t)
Chris PeBenito c98340
')
Chris PeBenito c98340
Chris PeBenito c98340
########################################
Chris PeBenito c98340
## <summary>
Chris PeBenito c98340
##	Inherit file descriptors from the unconfined domain.
Chris PeBenito c98340
## </summary>
Chris PeBenito c98340
## <param name="domain">
Chris PeBenito c98340
##	Domain allowed access.
Chris PeBenito c98340
## </param>
Chris PeBenito c98340
#
Chris PeBenito c98340
interface(`unconfined_use_fd',`
Chris PeBenito c98340
	gen_require(`
Chris PeBenito c98340
		type unconfined_t;
Chris PeBenito c98340
		class fd use;
Chris PeBenito c98340
	')
Chris PeBenito c98340
Chris PeBenito c98340
	allow $1 unconfined_t:fd use;
Chris PeBenito c98340
')
Chris PeBenito c98340
Chris PeBenito c98340
########################################
Chris PeBenito c98340
## <summary>
Chris PeBenito c98340
##	Send a SIGCHLD signal to the unconfined domain.
Chris PeBenito c98340
## </summary>
Chris PeBenito c98340
## <param name="domain">
Chris PeBenito c98340
##	Domain allowed access.
Chris PeBenito c98340
## </param>
Chris PeBenito c98340
#
Chris PeBenito c98340
interface(`unconfined_sigchld',`
Chris PeBenito c98340
	gen_require(`
Chris PeBenito c98340
		type unconfined_t;
Chris PeBenito c98340
		class process sigchld;
Chris PeBenito c98340
	')
Chris PeBenito c98340
Chris PeBenito c98340
	allow $1 unconfined_t:process sigchld;
Chris PeBenito c98340
')
Chris PeBenito c98340
Chris PeBenito c98340
########################################
Chris PeBenito c98340
## <summary>
Chris PeBenito c98340
##	Read and write unconfined domain unnamed pipes.
Chris PeBenito c98340
## </summary>
Chris PeBenito c98340
## <param name="domain">
Chris PeBenito c98340
##	Domain allowed access.
Chris PeBenito c98340
## </param>
Chris PeBenito c98340
#
Chris PeBenito c98340
interface(`unconfined_rw_pipe',`
Chris PeBenito c98340
	gen_require(`
Chris PeBenito c98340
		type unconfined_t;
Chris PeBenito c98340
		class fifo_file rw_file_perms;
Chris PeBenito c98340
	')
Chris PeBenito c98340
Chris PeBenito c98340
	allow $1 unconfined_t:fifo_file rw_file_perms;
Chris PeBenito c98340
')
Chris PeBenito c98340
Chris PeBenito c98340
########################################
Chris PeBenito c98340
## <summary>
Chris PeBenito a42ca7
##	Do not audit attempts to read or write
Chris PeBenito a42ca7
##	unconfined domain tcp sockets.
Chris PeBenito a42ca7
## </summary>
Chris PeBenito a42ca7
## <desc>
Chris PeBenito a42ca7
##	

Chris PeBenito a42ca7
##	Do not audit attempts to read or write
Chris PeBenito a42ca7
##	unconfined domain tcp sockets.
Chris PeBenito a42ca7
##	

Chris PeBenito a42ca7
##	

Chris PeBenito a42ca7
##	This interface was added due to a broken
Chris PeBenito a42ca7
##	symptom in ldconfig.
Chris PeBenito a42ca7
##	

Chris PeBenito a42ca7
## </desc>
Chris PeBenito a42ca7
## <param name="domain">
Chris PeBenito a42ca7
##	Domain to not audit.
Chris PeBenito a42ca7
## </param>
Chris PeBenito a42ca7
#
Chris PeBenito a42ca7
interface(`unconfined_dontaudit_rw_tcp_socket',`
Chris PeBenito a42ca7
	gen_require(`
Chris PeBenito a42ca7
		type unconfined_t;
Chris PeBenito a42ca7
		class tcp_socket { read write };
Chris PeBenito a42ca7
	')
Chris PeBenito a42ca7
Chris PeBenito a42ca7
	dontaudit $1 unconfined_t:tcp_socket { read write };
Chris PeBenito a42ca7
')
Chris PeBenito a42ca7
Chris PeBenito a42ca7
########################################
Chris PeBenito a42ca7
## <summary>
Chris PeBenito c98340
##	Add the unconfined domain to the specified role.
Chris PeBenito c98340
## </summary>
Chris PeBenito c98340
## <param name="domain">
Chris PeBenito c98340
##	Domain allowed access.
Chris PeBenito c98340
## </param>
Chris PeBenito c98340
#
Chris PeBenito c98340
interface(`unconfined_role',`
Chris PeBenito c98340
	gen_require(`
Chris PeBenito c98340
		type unconfined_t;
Chris PeBenito c98340
	')
Chris PeBenito c98340
Chris PeBenito c98340
	role $1 types unconfined_t;
Chris PeBenito c98340
')