Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# Macros for screen domains.
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# Author: Russell Coker <russell@coker.com.au>
Chris PeBenito 0fbfa5
# Based on the work of Stephen Smalley <sds@epoch.ncsc.mil>
Chris PeBenito 0fbfa5
# and Timothy Fraser
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# screen_domain(domain_prefix)
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# Define a derived domain for the screen program when executed
Chris PeBenito 0fbfa5
# by a user domain.
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# The type declaration for the executable type for this program is
Chris PeBenito 0fbfa5
# provided separately in domains/program/screen.te. 
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
undefine(`screen_domain')
Chris PeBenito 0fbfa5
ifdef(`screen.te', `
Chris PeBenito 0fbfa5
define(`screen_domain',`
Chris PeBenito 0fbfa5
# Derived domain based on the calling user domain and the program.
Chris PeBenito 2705f9
type $1_screen_t, domain, privlog, privfd, nscd_client_domain;
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# Transition from the user domain to this domain.
Chris PeBenito 0fbfa5
domain_auto_trans($1_t, screen_exec_t, $1_screen_t)
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
tmp_domain($1_screen, `', `{ dir file fifo_file }')
Chris PeBenito 0fbfa5
base_file_read_access($1_screen_t)
Chris PeBenito 0fbfa5
# The user role is authorized for this domain.
Chris PeBenito 0fbfa5
role $1_r types $1_screen_t;
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
uses_shlib($1_screen_t)
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# for SSP
Chris PeBenito 0fbfa5
allow $1_screen_t urandom_device_t:chr_file read;
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# Revert to the user domain when a shell is executed.
Chris PeBenito 0fbfa5
domain_auto_trans($1_screen_t, { shell_exec_t bin_t }, $1_t)
Chris PeBenito 0fbfa5
domain_auto_trans($1_screen_t, $1_home_t, $1_t)
Chris PeBenito 0fbfa5
if (use_nfs_home_dirs) {
Chris PeBenito 0fbfa5
domain_auto_trans($1_screen_t, nfs_t, $1_t)
Chris PeBenito 0fbfa5
}
Chris PeBenito 0fbfa5
if (use_samba_home_dirs) {
Chris PeBenito 0fbfa5
domain_auto_trans($1_screen_t, cifs_t, $1_t)
Chris PeBenito 0fbfa5
}
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# Inherit and use descriptors from gnome-pty-helper.
Chris PeBenito 0fbfa5
ifdef(`gnome-pty-helper.te', `allow $1_screen_t $1_gph_t:fd use;')
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
home_domain_ro($1, screen)
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
allow $1_screen_t privfd:fd use;
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# Write to utmp.
Chris PeBenito 0fbfa5
allow $1_screen_t initrc_var_run_t:file rw_file_perms;
Chris PeBenito 0fbfa5
ifdef(`utempter.te', `
Chris PeBenito 0fbfa5
dontaudit $1_screen_t utempter_exec_t:file execute;
Chris PeBenito 0fbfa5
')
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# create pty devices
Chris PeBenito 0fbfa5
can_create_other_pty($1_screen, $1)
Chris PeBenito 0fbfa5
allow $1_screen_t $1_tty_device_t:chr_file rw_file_perms;
Chris PeBenito 0fbfa5
allow $1_screen_t device_t:dir { getattr read };
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
allow $1_screen_t fs_t:filesystem getattr;
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# Create fifo
Chris PeBenito 0fbfa5
allow $1_screen_t var_t:dir search;
Chris PeBenito 0fbfa5
file_type_auto_trans($1_screen_t, var_run_t, screen_dir_t, dir)
Chris PeBenito 0fbfa5
type $1_screen_var_run_t, file_type, sysadmfile, pidfile;
Chris PeBenito 0fbfa5
file_type_auto_trans($1_screen_t, screen_dir_t, $1_screen_var_run_t, fifo_file)
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
allow $1_screen_t self:process { fork signal_perms };
Chris PeBenito 0fbfa5
allow $1_t $1_screen_t:process signal;
Chris PeBenito 0fbfa5
allow $1_screen_t $1_t:process signal;
Chris PeBenito 0fbfa5
allow $1_screen_t self:capability { setuid setgid fsetid };
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
dontaudit $1_screen_t shadow_t:file read;
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
allow $1_screen_t tmp_t:dir search;
Chris PeBenito 0fbfa5
can_network($1_screen_t)
Chris PeBenito 2705f9
allow $1_screen_t port_type:tcp_socket name_connect;
Chris PeBenito 0fbfa5
can_ypbind($1_screen_t)
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# get stats
Chris PeBenito 0fbfa5
allow $1_screen_t proc_t:dir search;
Chris PeBenito 0fbfa5
allow $1_screen_t proc_t:file { getattr read };
Chris PeBenito 0fbfa5
allow $1_screen_t proc_t:lnk_file read;
Chris PeBenito 0fbfa5
allow $1_screen_t etc_t:{ file lnk_file } { read getattr };
Chris PeBenito 0fbfa5
allow $1_screen_t self:dir { search read };
Chris PeBenito 0fbfa5
allow $1_screen_t self:lnk_file read;
Chris PeBenito 0fbfa5
allow $1_screen_t device_t:dir search;
Chris PeBenito 0fbfa5
allow $1_screen_t { home_root_t $1_home_dir_t }:dir search;
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# Internal screen networking
Chris PeBenito 0fbfa5
allow $1_screen_t self:fd use;
Chris PeBenito 0fbfa5
allow $1_screen_t self:unix_stream_socket create_socket_perms;
Chris PeBenito 0fbfa5
allow $1_screen_t self:unix_dgram_socket create_socket_perms;
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
allow $1_screen_t bin_t:dir search;
Chris PeBenito 0fbfa5
allow $1_screen_t bin_t:lnk_file read;
Chris PeBenito 0fbfa5
read_locale($1_screen_t)
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
dontaudit $1_screen_t file_type:{ chr_file blk_file } getattr;
Chris PeBenito 0fbfa5
')dnl end screen_domain
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
', `
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
define(`screen_domain',`')
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
')