##############################

#

# Global macros for the type enforcement (TE) configuration.

#

#

# Authors:  Stephen Smalley <sds@epoch.ncsc.mil> and Timothy Fraser  

#           Howard Holm (NSA) <hdholm@epoch.ncsc.mil>

#           Russell Coker <russell@coker.com.au>

#

#

#

##################################

#

# can_setexec(domain)

#

# Authorize a domain to set its exec context

# (via /proc/pid/attr/exec).

#

define(`can_setexec',`

allow $1 self:process setexec;

allow $1 proc_t:dir search;

allow $1 proc_t:{ file lnk_file } read;

allow $1 self:dir search;

allow $1 self:file { getattr read write };

')

##################################

#

# can_getcon(domain)

#

# Authorize a domain to get its context

# (via /proc/pid/attr/current).

#

define(`can_getcon',`

allow $1 proc_t:dir search;

allow $1 proc_t:{ file lnk_file } read;

allow $1 self:dir search;

allow $1 self:file { getattr read };

allow $1 self:process getattr;

')

##################################

#

# can_setcon(domain)

#

# Authorize a domain to set its current context

# (via /proc/pid/attr/current).

#

define(`can_setcon',`

allow $1 self:process setcurrent;

allow $1 proc_t:dir search;

allow $1 proc_t:{ file lnk_file } read;

allow $1 self:dir search;

allow $1 self:file { getattr read write };

')

##################################

# read_sysctl(domain)

#

# Permissions for reading sysctl variables.

# If the second parameter is full, allow

# reading of any sysctl variables, else only

# sysctl_kernel_t.

#

define(`read_sysctl', `

# Read system variables in /sys.

ifelse($2,`full', `

allow $1 sysctl_type:dir r_dir_perms;

allow $1 sysctl_type:file r_file_perms;

', `

allow $1 sysctl_t:dir search;

allow $1 sysctl_kernel_t:dir search;

allow $1 sysctl_kernel_t:file { getattr read };

')

')dnl read_sysctl

##################################

#

# can_setfscreate(domain)

#

# Authorize a domain to set its fscreate context

# (via /proc/pid/attr/fscreate).

#

define(`can_setfscreate',`

allow $1 self:process setfscreate;

allow $1 proc_t:dir search;

allow $1 proc_t:{ file lnk_file } read;

allow $1 self:dir search;

allow $1 self:file { getattr read write };

')

#################################

#

# uses_shlib(domain)

#

# Permissions for using shared libraries.

#

define(`uses_shlib',`

allow $1 { root_t usr_t lib_t etc_t }:dir r_dir_perms;

allow $1 lib_t:lnk_file r_file_perms;

allow $1 ld_so_t:file rx_file_perms;

#allow $1 ld_so_t:file execute_no_trans;

allow $1 ld_so_t:lnk_file r_file_perms;

allow $1 { texrel_shlib_t shlib_t }:file rx_file_perms;

allow $1 { texrel_shlib_t shlib_t }:lnk_file r_file_perms;

allow $1 texrel_shlib_t:file execmod;

allow $1 ld_so_cache_t:file r_file_perms;

allow $1 device_t:dir search;

allow $1 null_device_t:chr_file rw_file_perms;

')

#################################

#

# can_exec_any(domain)

#

# Permissions for executing a variety

# of executable types.

#

define(`can_exec_any',`

allow $1 { bin_t sbin_t lib_t etc_t }:dir r_dir_perms;

allow $1 { bin_t sbin_t etc_t }:lnk_file { getattr read };

uses_shlib($1)

can_exec($1, etc_t)

can_exec($1, lib_t)

can_exec($1, bin_t)

can_exec($1, sbin_t)

can_exec($1, exec_type)

can_exec($1, ld_so_t)

')

#################################

#

# can_sysctl(domain)

#

# Permissions for modifying sysctl parameters.

#

define(`can_sysctl',`

allow $1 sysctl_type:dir r_dir_perms;

allow $1 sysctl_type:file { setattr rw_file_perms };

')

##################################

#

# read_locale(domain)

#

# Permissions for reading the locale data,

# /etc/localtime and the files that it links to

#

define(`read_locale', `

allow $1 etc_t:lnk_file read;

allow $1 lib_t:file r_file_perms;

r_dir_file($1, locale_t)

')

define(`can_access_pty', `

allow $1 devpts_t:dir r_dir_perms;

allow $1 $2_devpts_t:chr_file rw_file_perms;

')

###################################

#

# access_terminal(domain, typeprefix)

#

# Permissions for accessing the terminal

#

define(`access_terminal', `

allow $1 $2_tty_device_t:chr_file { read write getattr ioctl };

allow $1 devtty_t:chr_file { read write getattr ioctl };

can_access_pty($1, $2)

') 

#

# general_proc_read_access(domain)

#

# Grant read/search permissions to most of /proc, excluding

# the /proc/PID directories and the /proc/kmsg and /proc/kcore files.

# The general_domain_access macro grants access to the domain /proc/PID

# directories, but not to other domains.  Only permissions to stat

# are granted for /proc/kmsg and /proc/kcore, since these files are more

# sensitive.

# 

define(`general_proc_read_access',`

# Read system information files in /proc.

r_dir_file($1, proc_t)

r_dir_file($1, proc_net_t)

allow $1 proc_mdstat_t:file r_file_perms;

# Stat /proc/kmsg and /proc/kcore.

allow $1 proc_fs:file stat_file_perms;

# Read system variables in /proc/sys.

read_sysctl($1)

')

#

# base_file_read_access(domain)

#

# Grant read/search permissions to a few system file types.

#

define(`base_file_read_access',`

# Read /.

allow $1 root_t:dir r_dir_perms;

allow $1 root_t:notdevfile_class_set r_file_perms;

# Read /home.

allow $1 home_root_t:dir r_dir_perms;

# Read /usr.

allow $1 usr_t:dir r_dir_perms;

allow $1 usr_t:notdevfile_class_set r_file_perms;

# Read bin and sbin directories.

allow $1 bin_t:dir r_dir_perms;

allow $1 bin_t:notdevfile_class_set r_file_perms;

allow $1 sbin_t:dir r_dir_perms;

allow $1 sbin_t:notdevfile_class_set r_file_perms;

read_sysctl($1)

r_dir_file($1, selinux_config_t)

if (read_default_t) {

#

# Read default_t

#.

allow $1 default_t:dir r_dir_perms;

allow $1 default_t:notdevfile_class_set r_file_perms;

}

')

#######################

# daemon_core_rules(domain_prefix, attribs)

#

# Define the core rules for a daemon, used by both daemon_base_domain() and

# init_service_domain().

# Attribs is the list of attributes which must start with "," if it is not empty

#

# Author:  Russell Coker <russell@coker.com.au>

#

define(`daemon_core_rules', `

type $1_t, domain, privlog, daemon $2;

type $1_exec_t, file_type, sysadmfile, exec_type;

dontaudit $1_t self:capability sys_tty_config;

role system_r types $1_t;

# Inherit and use descriptors from init.

allow $1_t init_t:fd use;

allow $1_t init_t:process sigchld;

allow $1_t self:process { signal_perms fork };

uses_shlib($1_t)

allow $1_t { self proc_t }:dir r_dir_perms;

allow $1_t { self proc_t }:lnk_file { getattr read };

allow $1_t device_t:dir r_dir_perms;

ifdef(`udev.te', `

allow $1_t udev_tdb_t:file r_file_perms;

')dnl end if udev.te

allow $1_t null_device_t:chr_file rw_file_perms;

dontaudit $1_t console_device_t:chr_file rw_file_perms;

dontaudit $1_t unpriv_userdomain:fd use;

r_dir_file($1_t, sysfs_t) 

allow $1_t autofs_t:dir { search getattr };

ifdef(`targeted_policy', `

dontaudit $1_t { tty_device_t devpts_t }:chr_file { read write };

dontaudit $1_t root_t:file { getattr read };

')dnl end if targeted_policy

')dnl end macro daemon_core_rules

#######################

# init_service_domain(domain_prefix, attribs)

#

# Define a domain for a program that is run from init

# Attribs is the list of attributes which must start with "," if it is not empty

#

# Author:  Russell Coker <russell@coker.com.au>

#

define(`init_service_domain', `

daemon_core_rules($1, `$2')

domain_auto_trans(init_t, $1_exec_t, $1_t)

')dnl

#######################

# daemon_base_domain(domain_prefix, attribs)

#

# Define a daemon domain with a base set of type declarations

# and permissions that are common to most daemons.

# attribs is the list of attributes which must start with "," if it is not empty

# nosysadm may be given as an optional third parameter, to specify that the

# sysadmin should not transition to the domain when directly calling the executable

#

# Author:  Russell Coker <russell@coker.com.au>

#

define(`daemon_base_domain', `

daemon_core_rules($1, `$2')

rhgb_domain($1_t)

read_sysctl($1_t)

ifdef(`direct_sysadm_daemon', `

dontaudit $1_t admin_tty_type:chr_file rw_file_perms;

')

#

# Allows user to define a tunable to disable domain transition

#

ifelse(index(`$2',`transitionbool'), -1, `', `

bool $1_disable_trans false;

if ($1_disable_trans) {

can_exec(initrc_t, $1_exec_t)

can_exec(sysadm_t, $1_exec_t)

} else {

') dnl transitionbool

domain_auto_trans(initrc_t, $1_exec_t, $1_t)

allow initrc_t $1_t:process { noatsecure siginh rlimitinh };

ifdef(`direct_sysadm_daemon', `

ifelse(`$3', `nosysadm', `', `

domain_auto_trans(sysadm_t, $1_exec_t, $1_t)

allow sysadm_t $1_t:process { noatsecure siginh rlimitinh };

')dnl end nosysadm

')dnl end direct_sysadm_daemon

ifelse(index(`$2', `transitionbool'), -1, `', `

}

') dnl end transitionbool

ifdef(`direct_sysadm_daemon', `

ifelse(`$3', `nosysadm', `', `

role_transition sysadm_r $1_exec_t system_r;

')dnl end nosysadm

')dnl end direct_sysadm_daemon

allow $1_t privfd:fd use;

ifdef(`newrole.te', `allow $1_t newrole_t:process sigchld;')

allow $1_t initrc_devpts_t:chr_file rw_file_perms;

')dnl

# allow a domain to create its own files under /var/run and to create files

# in directories that are created for it.  $2 is an optional list of

# classes to use; default is file.

define(`var_run_domain', `

type $1_var_run_t, file_type, sysadmfile, pidfile;

ifelse(`$2', `', `

file_type_auto_trans($1_t, var_run_t, $1_var_run_t, file)

', `

file_type_auto_trans($1_t, var_run_t, $1_var_run_t, $2)

')

allow $1_t var_t:dir search;

allow $1_t $1_var_run_t:dir rw_dir_perms;

')

#######################

# daemon_domain(domain_prefix, attribs)

#

# see daemon_base_domain for calling details

# daemon_domain defines some additional privileges needed by many domains,

# like pid files and locale support

define(`daemon_domain', `

ifdef(`targeted_policy', `

daemon_base_domain($1, `$2, transitionbool', $3)

', `

daemon_base_domain($1, `$2', $3)

')

# Create pid file.

allow $1_t var_t:dir { getattr search };

var_run_domain($1)

allow $1_t devtty_t:chr_file rw_file_perms;

# for daemons that look at /root on startup

dontaudit $1_t sysadm_home_dir_t:dir search;

# for df

allow $1_t fs_type:filesystem getattr;

allow $1_t removable_t:filesystem getattr;

read_locale($1_t)

# for localization

allow $1_t lib_t:file { getattr read };

')dnl end daemon_domain macro

define(`uses_authbind',

`domain_auto_trans($1, authbind_exec_t, authbind_t)

allow authbind_t $1:process sigchld;

allow authbind_t $1:fd use;

allow authbind_t $1:{ tcp_socket udp_socket } rw_socket_perms;

')

# define a sub-domain, $1_t is the parent domain, $2 is the name

# of the sub-domain.

#

define(`daemon_sub_domain', `

# $1 is the parent domain (or domains), $2_t is the child domain,

# and $3 is any attributes to apply to the child

type $2_t, domain, privlog, daemon $3;

type $2_exec_t, file_type, sysadmfile, exec_type;

role system_r types $2_t;

ifelse(index(`$3',`transitionbool'), -1, `

domain_auto_trans($1, $2_exec_t, $2_t)

', `

bool $2_disable_trans false;

if (! $2_disable_trans) {

domain_auto_trans($1, $2_exec_t, $2_t)

}

');

# Inherit and use descriptors from parent.

allow $2_t $1:fd use;

allow $2_t $1:process sigchld;

allow $2_t self:process signal_perms;

uses_shlib($2_t)

allow $2_t { self proc_t }:dir r_dir_perms;

allow $2_t { self proc_t }:lnk_file read;

allow $2_t device_t:dir getattr;

')

# grant access to /tmp

# by default, only plain files and dirs may be stored there.

# This can be overridden with a third parameter

define(`tmp_domain', `

type $1_tmp_t, file_type, sysadmfile, polymember, tmpfile $2;

ifelse($3, `',

`file_type_auto_trans($1_t, tmp_t, $1_tmp_t, `{ file dir }')',

`file_type_auto_trans($1_t, tmp_t, $1_tmp_t, `$3')')

')

# grant access to /tmp. Do not perform an automatic transition.

define(`tmp_domain_notrans', `

type $1_tmp_t, file_type, sysadmfile, polymember, tmpfile $2;

')

define(`tmpfs_domain', `

ifdef(`$1_tmpfs_t_defined',`', `

define(`$1_tmpfs_t_defined')

type $1_tmpfs_t, file_type, sysadmfile, tmpfsfile;

# Use this type when creating tmpfs/shm objects.

file_type_auto_trans($1_t, tmpfs_t, $1_tmpfs_t)

allow $1_tmpfs_t tmpfs_t:filesystem associate;

')

')

define(`var_lib_domain', `

type $1_var_lib_t, file_type, sysadmfile;

file_type_auto_trans($1_t, var_lib_t, $1_var_lib_t, file)

allow $1_t $1_var_lib_t:dir rw_dir_perms;

')

define(`log_domain', `

type $1_log_t, file_type, sysadmfile, logfile;

file_type_auto_trans($1_t, var_log_t, $1_log_t, file)

')

define(`logdir_domain', `

log_domain($1)

allow $1_t $1_log_t:dir { setattr rw_dir_perms };

')

define(`etc_domain', `

type $1_etc_t, file_type, sysadmfile, usercanread;

allow $1_t $1_etc_t:file r_file_perms;

')

define(`etcdir_domain', `

etc_domain($1)

allow $1_t $1_etc_t:dir r_dir_perms;

allow $1_t $1_etc_t:lnk_file { getattr read };

')

define(`append_log_domain', `

type $1_log_t, file_type, sysadmfile, logfile;

allow $1_t var_log_t:dir ra_dir_perms;

allow $1_t $1_log_t:file  { create ra_file_perms };

type_transition $1_t var_log_t:file $1_log_t;

')

define(`append_logdir_domain', `

append_log_domain($1)

allow $1_t $1_log_t:dir { setattr ra_dir_perms };

')

define(`lock_domain', `

type $1_lock_t, file_type, sysadmfile, lockfile;

file_type_auto_trans($1_t, var_lock_t, $1_lock_t, file)

')

#######################

# application_domain(domain_prefix)

#

# Define a domain with a base set of type declarations

# and permissions that are common to simple applications.

#

# Author:  Russell Coker <russell@coker.com.au>

#

define(`application_domain', `

type $1_t, domain, privlog $2;

type $1_exec_t, file_type, sysadmfile, exec_type;

role sysadm_r types $1_t;

ifdef(`targeted_policy', `

role system_r types $1_t;

')

domain_auto_trans(sysadm_t, $1_exec_t, $1_t)

uses_shlib($1_t)

')

define(`system_domain', `

type $1_t, domain, privlog $2;

type $1_exec_t, file_type, sysadmfile, exec_type;

role system_r types $1_t;

uses_shlib($1_t)

allow $1_t etc_t:dir r_dir_perms;

')

# Dontaudit macros to prevent flooding the log

define(`dontaudit_getattr', `

dontaudit $1 file_type - secure_file_type:dir_file_class_set getattr; 

dontaudit $1 unlabeled_t:dir_file_class_set getattr;

dontaudit $1 { fs_type proc_fs dev_fs sysctl_type }:dir_file_class_set getattr;

')dnl end dontaudit_getattr 

define(`dontaudit_search_dir', `

dontaudit $1 file_type - secure_file_type:dir search;

dontaudit $1 unlabeled_t:dir search;

dontaudit $1 { fs_type proc_fs dev_fs sysctl_type }:dir search;

')dnl end dontaudit_search_dir

define(`dontaudit_read_dir', `

dontaudit $1 file_type - secure_file_type:dir read;

dontaudit $1 unlabeled_t:dir read;

dontaudit $1 { fs_type proc_fs dev_fs sysctl_type }:dir read;

')dnl end dontaudit_read_dir

# Define legacy_domain  for legacy binaries (java)

# "legacy" binary == lacks PT_GNU_STACK header, i.e. built with an old

# toolchain.  They cause the kernel to automatically start translating all

# read protection requests to read|execute for backward compatibility on

# x86.  They will all need execmem and execmod, including execmod to

# shlib_t and ld_so_t unlike non-legacy binaries.

define(`legacy_domain', `

allow $1_t self:process { execmem execstack };

allow $1_t { texrel_shlib_t shlib_t }:file execmod;

allow $1_t ld_so_t:file execmod;

allow $1_t ld_so_cache_t:file execute;

')

# Allow domain to perform polyinstantiation functions

# polyinstantiater(domain)

define(`polyinstantiater', `

ifdef(`support_polyinstantiation', `

# Need to give access to /selinux/member

allow $1 security_t:security compute_member;

# Need to give access to the directories to be polyinstantiated

allow $1 polydir:dir { getattr mounton add_name create setattr write search };

# Need to give access to the polyinstantiated subdirectories

allow $1 polymember:dir {getattr search };

# Need to give access to parent directories where original

# is remounted for polyinstantiation aware programs (like gdm)

allow $1 polyparent:dir { getattr mounton };

# Need to give permission to create directories where applicable

allow $1 polymember: dir { create setattr };

allow $1 polydir: dir { write add_name };

allow $1 self:process setfscreate;

allow $1 polyparent:dir { write add_name };

# Default type for mountpoints

allow $1 poly_t:dir { create mounton };

# Need sys_admin capability for mounting

allow $1 self:capability sys_admin;

')dnl end else support_polyinstantiation

')dnl end polyinstantiater

# 

# Domain that is allow to read anonymous data off the network

# without providing authentication.

# Also define boolean to allow anonymous writing

#

define(`anonymous_domain', `

r_dir_file($1_t, { public_content_t public_content_rw_t } )

bool allow_$1_anon_write false;

if (allow_$1_anon_write) {

create_dir_file($1_t,public_content_rw_t)

}

')

# 

# Define a domain that can do anything, so that it is

# effectively unconfined by the SELinux policy.  This

# means that it is only restricted by the normal Linux 

# protections.  Note that you may need to add further rules

# to allow other domains to interact with this domain as expected,

# since this macro only allows the specified domain to act upon

# all other domains and types, not vice versa.

#

define(`unconfined_domain', `

typeattribute $1 unrestricted;

typeattribute $1 privuser;

# Mount/unmount any filesystem. 

allow $1 fs_type:filesystem *;

# Mount/unmount any filesystem with the context= option. 

allow $1 file_type:filesystem *;

# Create/access any file in a labeled filesystem;

allow $1 file_type:{ file chr_file } ~execmod;

allow $1 file_type:{ dir lnk_file sock_file fifo_file blk_file } *;

allow $1 sysctl_t:{ dir file } *;

allow $1 device_type:devfile_class_set *;

allow $1 mtrr_device_t:file *;

# Create/access other files.  fs_type is to pick up various

# pseudo filesystem types that are applied to both the filesystem

# and its files.

allow $1 { unlabeled_t fs_type }:dir_file_class_set *;

allow $1 proc_fs:{ dir file } *;

# For /proc/pid

r_dir_file($1,domain)

# Write access is for setting attributes under /proc/self/attr.

allow $1 self:file rw_file_perms;

# Read and write sysctls.

can_sysctl($1)

# Access the network.

allow $1 node_type:node *;

allow $1 netif_type:netif *;

allow $1 port_type:{ tcp_socket udp_socket } { send_msg recv_msg };

allow $1 port_type:tcp_socket name_connect;

# Bind to any network address.

allow $1 port_type:{ rawip_socket tcp_socket udp_socket } name_bind;

allow $1 node_type:{ tcp_socket udp_socket rawip_socket } node_bind;

allow $1 file_type:{ unix_stream_socket unix_dgram_socket } name_bind;

# Use/sendto/connectto sockets created by any domain.

allow $1 domain:{ socket_class_set socket key_socket } *;

# Use descriptors and pipes created by any domain.

allow $1 domain:fd use;

allow $1 domain:fifo_file rw_file_perms;

# Act upon any other process.

allow $1 domain:process ~{ transition dyntransition execmem };

# Transition to myself, to make get_ordered_context_list happy.

allow $1 self:process transition;

if (allow_execmem) {

# Allow making anonymous memory executable, e.g. 

# for runtime-code generation or executable stack.

allow $1 self:process execmem;

}

if (allow_execmem && allow_execstack) {

# Allow making the stack executable via mprotect.

allow $1 self:process execstack;

}

if (allow_execmod) {

# Allow text relocations on system shared libraries, e.g. libGL.

ifdef(`targeted_policy', `

allow $1 file_type:file execmod;

', `

allow $1 texrel_shlib_t:file execmod;

allow $1 home_type:file execmod;

')

}

# Create/access any System V IPC objects.

allow $1 domain:{ sem msgq shm } *;

allow $1 domain:msg  { send receive };

# Access the security API.

if (!secure_mode_policyload) {

allow $1 security_t:security *;

auditallow $1 security_t:security { load_policy setenforce setbool };

}dnl end if !secure_mode_policyload

# Perform certain system operations that lacked individual capabilities.

allow $1 kernel_t:system *;

# Use any Linux capability.

allow $1 self:capability *;

# Set user information and skip authentication.

allow $1 self:passwd *;

# Communicate via dbusd.

allow $1 self:dbus *;

ifdef(`dbusd.te', `

allow $1 system_dbusd_t:dbus *;

')

# Get info via nscd.

allow $1 self:nscd *;

ifdef(`nscd.te', `

allow $1 nscd_t:nscd *;

')

')dnl end unconfined_domain

define(`access_removable_media', `

can_exec($1, { removable_t noexattrfile } )

if (user_rw_noexattrfile) {

create_dir_file($1, noexattrfile)

create_dir_file($1, removable_t)

# Write floppies 

allow $1 removable_device_t:blk_file rw_file_perms;

allow $1 usbtty_device_t:chr_file write;

} else {

r_dir_file($1, noexattrfile)

r_dir_file($1, removable_t)

allow $1 removable_device_t:blk_file r_file_perms;

}

allow $1 removable_t:filesystem getattr;

')

define(`authentication_domain', `

can_ypbind($1)

can_kerberos($1)

can_ldap($1)

can_resolve($1)

can_winbind($1)

r_dir_file($1, cert_t)

allow $1 { random_device_t urandom_device_t }:chr_file { getattr read };

allow $1 self:capability { audit_write audit_control };

dontaudit $1 shadow_t:file { getattr read };

allow $1 sbin_t:dir search;

allow $1 self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay };

')