Chris PeBenito ab58ad
#
Chris PeBenito ab58ad
# Macros for uml domains.
Chris PeBenito ab58ad
#
Chris PeBenito ab58ad
Chris PeBenito ab58ad
#
Chris PeBenito ab58ad
# Author:  Russell Coker <russell@coker.com.au>
Chris PeBenito ab58ad
#
Chris PeBenito ab58ad
Chris PeBenito ab58ad
#
Chris PeBenito ab58ad
# uml_domain(domain_prefix)
Chris PeBenito ab58ad
#
Chris PeBenito ab58ad
# Define a derived domain for the uml program when executed
Chris PeBenito ab58ad
# by a user domain.
Chris PeBenito ab58ad
#
Chris PeBenito ab58ad
# The type declaration for the executable type for this program is
Chris PeBenito ab58ad
# provided separately in domains/program/uml.te. 
Chris PeBenito ab58ad
#
Chris PeBenito ab58ad
undefine(`uml_domain')
Chris PeBenito ab58ad
ifdef(`uml.te', `
Chris PeBenito ab58ad
define(`uml_domain',`
Chris PeBenito ab58ad
Chris PeBenito ab58ad
# Derived domain based on the calling user domain and the program.
Chris PeBenito ab58ad
type $1_uml_t, domain;
Chris PeBenito ab58ad
type $1_uml_exec_t, file_type, sysadmfile, $1_file_type;
Chris PeBenito ab58ad
type $1_uml_ro_t, file_type, sysadmfile, $1_file_type;
Chris PeBenito ab58ad
type $1_uml_rw_t, file_type, sysadmfile, $1_file_type;
Chris PeBenito ab58ad
Chris PeBenito ab58ad
# for X
Chris PeBenito ab58ad
ifdef(`startx.te', `
Chris PeBenito ab58ad
ifelse($1, sysadm, `', `
Chris PeBenito ab58ad
ifdef(`xdm.te', `
Chris PeBenito ab58ad
allow $1_uml_t xdm_xserver_tmp_t:dir search;
Chris PeBenito ab58ad
')dnl end if xdm.te
Chris PeBenito ab58ad
allow $1_uml_t $1_xserver_tmp_t:sock_file write;
Chris PeBenito ab58ad
can_unix_connect($1_uml_t, $1_xserver_t)
Chris PeBenito ab58ad
')dnl end ifelse sysadm
Chris PeBenito ab58ad
')dnl end ifdef startx
Chris PeBenito ab58ad
Chris PeBenito ab58ad
allow $1_t { $1_uml_ro_t $1_uml_rw_t }:{ file sock_file fifo_file } { relabelfrom relabelto create_file_perms };
Chris PeBenito ab58ad
allow $1_t $1_uml_exec_t:file { relabelfrom relabelto create_file_perms };
Chris PeBenito ab58ad
allow $1_t { $1_uml_ro_t $1_uml_rw_t }:lnk_file { relabelfrom relabelto create_lnk_perms };
Chris PeBenito ab58ad
allow $1_t { $1_uml_ro_t $1_uml_rw_t $1_uml_exec_t }:dir { relabelfrom relabelto create_dir_perms };
Chris PeBenito ab58ad
r_dir_file($1_t, uml_ro_t)
Chris PeBenito ab58ad
Chris PeBenito ab58ad
# Transition from the user domain to this domain.
Chris PeBenito ab58ad
domain_auto_trans($1_t, { uml_exec_t $1_uml_exec_t }, $1_uml_t)
Chris PeBenito ab58ad
can_exec($1_uml_t, { uml_exec_t $1_uml_exec_t })
Chris PeBenito ab58ad
Chris PeBenito ab58ad
# The user role is authorized for this domain.
Chris PeBenito ab58ad
role $1_r types $1_uml_t;
Chris PeBenito ab58ad
Chris PeBenito ab58ad
# Inherit and use descriptors from gnome-pty-helper.
Chris PeBenito ab58ad
ifdef(`gnome-pty-helper.te', `allow $1_uml_t $1_gph_t:fd use;')
Chris PeBenito ab58ad
Chris PeBenito ab58ad
# Inherit and use descriptors from newrole.
Chris PeBenito ab58ad
ifdef(`newrole.te', `allow $1_uml_t newrole_t:fd use;')
Chris PeBenito ab58ad
Chris PeBenito ab58ad
# allow ps, ptrace, signal
Chris PeBenito ab58ad
can_ps($1_t, $1_uml_t)
Chris PeBenito ab58ad
can_ptrace($1_t, $1_uml_t)
Chris PeBenito ab58ad
allow $1_t $1_uml_t:process signal_perms;
Chris PeBenito ab58ad
Chris PeBenito ab58ad
# allow the UML thing to happen
Chris PeBenito ab58ad
allow $1_uml_t self:process { fork signal_perms ptrace };
Chris PeBenito ab58ad
can_create_pty($1_uml)
Chris PeBenito ab58ad
allow $1_uml_t root_t:dir search;
Chris PeBenito ab58ad
tmp_domain($1_uml)
Chris PeBenito ab58ad
can_exec($1_uml_t, $1_uml_tmp_t)
Chris PeBenito ab58ad
tmpfs_domain($1_uml)
Chris PeBenito ab58ad
can_exec($1_uml_t, $1_uml_tmpfs_t)
Chris PeBenito ab58ad
create_dir_file($1_t, $1_uml_tmp_t)
Chris PeBenito ab58ad
allow $1_t $1_uml_tmp_t:sock_file create_file_perms;
Chris PeBenito ab58ad
allow $1_uml_t self:fifo_file rw_file_perms;
Chris PeBenito ab58ad
allow $1_uml_t fs_t:filesystem getattr;
Chris PeBenito ab58ad
Chris PeBenito ab58ad
allow $1_uml_t tun_tap_device_t:chr_file { read write ioctl };
Chris PeBenito ab58ad
Chris PeBenito ab58ad
ifdef(`uml_net.te', `
Chris PeBenito ab58ad
# for uml_net
Chris PeBenito ab58ad
domain_auto_trans($1_uml_t, uml_net_exec_t, uml_net_t)
Chris PeBenito ab58ad
allow uml_net_t $1_uml_t:unix_stream_socket { read write };
Chris PeBenito ab58ad
allow uml_net_t $1_uml_t:unix_dgram_socket { read write };
Chris PeBenito ab58ad
dontaudit uml_net_t privfd:fd use;
Chris PeBenito ab58ad
can_access_pty(uml_net_t, $1_uml)
Chris PeBenito ab58ad
dontaudit uml_net_t $1_uml_rw_t:dir { getattr search };
Chris PeBenito ab58ad
')dnl end ifdef uml_net.te
Chris PeBenito ab58ad
Chris PeBenito ab58ad
# for mconsole
Chris PeBenito ab58ad
allow { $1_t $1_uml_t } $1_uml_t:unix_dgram_socket sendto;
Chris PeBenito ab58ad
allow $1_uml_t $1_t:unix_dgram_socket sendto;
Chris PeBenito ab58ad
Chris PeBenito ab58ad
# Use the network.
Chris PeBenito ab58ad
can_network($1_uml_t)
Chris PeBenito ab58ad
allow $1_uml_t port_type:tcp_socket name_connect;
Chris PeBenito ab58ad
can_ypbind($1_uml_t)
Chris PeBenito ab58ad
Chris PeBenito ab58ad
# for xterm
Chris PeBenito ab58ad
uses_shlib($1_uml_t)
Chris PeBenito ab58ad
can_exec($1_uml_t, { bin_t sbin_t lib_t })
Chris PeBenito ab58ad
allow $1_uml_t { bin_t sbin_t }:dir search;
Chris PeBenito ab58ad
allow $1_uml_t etc_t:file { getattr read };
Chris PeBenito ab58ad
dontaudit $1_uml_t etc_runtime_t:file read;
Chris PeBenito ab58ad
can_tcp_connect($1_uml_t, sshd_t)
Chris PeBenito ab58ad
ifdef(`xauth.te', `
Chris PeBenito ab58ad
allow $1_uml_t $1_xauth_home_t:file { getattr read };
Chris PeBenito ab58ad
')
Chris PeBenito ab58ad
allow $1_uml_t var_run_t:dir search;
Chris PeBenito ab58ad
allow $1_uml_t initrc_var_run_t:file { getattr read };
Chris PeBenito ab58ad
dontaudit $1_uml_t initrc_var_run_t:file { write lock };
Chris PeBenito ab58ad
Chris PeBenito ab58ad
allow $1_uml_t device_t:dir search;
Chris PeBenito ab58ad
allow $1_uml_t self:unix_stream_socket create_stream_socket_perms;
Chris PeBenito ab58ad
allow $1_uml_t self:unix_dgram_socket create_socket_perms;
Chris PeBenito ab58ad
allow $1_uml_t privfd:fd use;
Chris PeBenito ab58ad
allow $1_uml_t proc_t:dir search;
Chris PeBenito ab58ad
allow $1_uml_t proc_t:file { getattr read };
Chris PeBenito ab58ad
Chris PeBenito ab58ad
# for SKAS - need something better
Chris PeBenito ab58ad
allow $1_uml_t proc_t:file write;
Chris PeBenito ab58ad
Chris PeBenito ab58ad
# Write to the user domain tty.
Chris PeBenito ab58ad
access_terminal($1_uml_t, $1)
Chris PeBenito ab58ad
Chris PeBenito ab58ad
# access config files
Chris PeBenito ab58ad
allow $1_uml_t home_root_t:dir search;
Chris PeBenito ab58ad
file_type_auto_trans($1_uml_t, $1_home_dir_t, $1_uml_rw_t)
Chris PeBenito ab58ad
r_dir_file($1_uml_t, { $1_uml_ro_t uml_ro_t })
Chris PeBenito ab58ad
Chris PeBenito ab58ad
# putting uml data under /var is usual...
Chris PeBenito ab58ad
allow $1_uml_t var_t:dir search;
Chris PeBenito ab58ad
')dnl end macro definition
Chris PeBenito ab58ad
Chris PeBenito ab58ad
', `
Chris PeBenito ab58ad
Chris PeBenito ab58ad
define(`uml_domain',`')
Chris PeBenito ab58ad
Chris PeBenito ab58ad
')