Chris PeBenito ab58ad
#DESC Userhelper - SELinux utility to run a shell with a new role
Chris PeBenito ab58ad
#
Chris PeBenito ab58ad
# Authors:  Dan Walsh (Red Hat)
Chris PeBenito ab58ad
# Maintained by Dan Walsh <dwalsh@redhat.com>
Chris PeBenito ab58ad
#
Chris PeBenito ab58ad
Chris PeBenito ab58ad
#
Chris PeBenito ab58ad
# userhelper_domain(domain_prefix)
Chris PeBenito ab58ad
#
Chris PeBenito ab58ad
# Define a derived domain for the userhelper/userhelper program when executed by
Chris PeBenito ab58ad
# a user domain.  
Chris PeBenito ab58ad
#
Chris PeBenito ab58ad
# The type declaration for the executable type for this program is
Chris PeBenito ab58ad
# provided separately in domains/program/userhelper.te. 
Chris PeBenito ab58ad
#
Chris PeBenito ab58ad
define(`userhelper_domain',`
Chris PeBenito ab58ad
type $1_userhelper_t, domain, userhelperdomain, privlog, privrole, privowner, auth_chkpwd, privfd, privuser, nscd_client_domain;
Chris PeBenito ab58ad
Chris PeBenito ab58ad
in_user_role($1_userhelper_t)
Chris PeBenito ab58ad
role sysadm_r types $1_userhelper_t;
Chris PeBenito ab58ad
Chris PeBenito ab58ad
ifelse($1, sysadm, `
Chris PeBenito ab58ad
typealias sysadm_userhelper_t alias userhelper_t;
Chris PeBenito ab58ad
domain_auto_trans(initrc_t, userhelper_exec_t, sysadm_userhelper_t)
Chris PeBenito ab58ad
')
Chris PeBenito ab58ad
Chris PeBenito ab58ad
general_domain_access($1_userhelper_t);
Chris PeBenito ab58ad
Chris PeBenito ab58ad
uses_shlib($1_userhelper_t)
Chris PeBenito ab58ad
read_locale($1_userhelper_t)
Chris PeBenito ab58ad
read_sysctl($1_userhelper_t)
Chris PeBenito ab58ad
Chris PeBenito ab58ad
# for when the user types "exec userhelper" at the command line
Chris PeBenito ab58ad
allow $1_userhelper_t privfd:process sigchld;
Chris PeBenito ab58ad
Chris PeBenito ab58ad
domain_auto_trans($1_t, userhelper_exec_t, $1_userhelper_t)
Chris PeBenito ab58ad
Chris PeBenito ab58ad
# Inherit descriptors from the current session.
Chris PeBenito ab58ad
allow $1_userhelper_t { init_t privfd }:fd use;
Chris PeBenito ab58ad
Chris PeBenito ab58ad
can_exec($1_userhelper_t, { bin_t sbin_t userhelper_exec_t })
Chris PeBenito ab58ad
Chris PeBenito ab58ad
# Execute shells
Chris PeBenito ab58ad
allow $1_userhelper_t { sbin_t bin_t }:dir r_dir_perms;
Chris PeBenito ab58ad
allow $1_userhelper_t { sbin_t bin_t }:lnk_file read;
Chris PeBenito ab58ad
allow $1_userhelper_t shell_exec_t:file r_file_perms;
Chris PeBenito ab58ad
Chris PeBenito ab58ad
# By default, revert to the calling domain when a program is executed.
Chris PeBenito ab58ad
domain_auto_trans($1_userhelper_t, { bin_t sbin_t }, $1_t)
Chris PeBenito ab58ad
Chris PeBenito ab58ad
# Allow $1_userhelper_t to transition to user domains.
Chris PeBenito ab58ad
domain_trans($1_userhelper_t, { bin_t sbin_t exec_type }, unpriv_userdomain)
Chris PeBenito ab58ad
if (!secure_mode) {
Chris PeBenito ab58ad
	# if we are not in secure mode then we can transition to sysadm_t
Chris PeBenito ab58ad
	domain_trans($1_userhelper_t, { bin_t sbin_t exec_type }, sysadm_t)
Chris PeBenito ab58ad
}
Chris PeBenito ab58ad
can_setexec($1_userhelper_t)
Chris PeBenito ab58ad
Chris PeBenito ab58ad
ifdef(`distro_redhat', `
Chris PeBenito ab58ad
ifdef(`rpm.te', `
Chris PeBenito ab58ad
# Allow transitioning to rpm_t, for up2date
Chris PeBenito ab58ad
allow $1_userhelper_t rpm_t:process { transition siginh rlimitinh noatsecure };
Chris PeBenito ab58ad
')
Chris PeBenito ab58ad
')
Chris PeBenito ab58ad
Chris PeBenito ab58ad
# Use capabilities.
Chris PeBenito ab58ad
allow $1_userhelper_t self:capability { setuid setgid net_bind_service dac_override chown sys_tty_config };
Chris PeBenito ab58ad
Chris PeBenito ab58ad
# Write to utmp.
Chris PeBenito ab58ad
file_type_auto_trans($1_userhelper_t, var_run_t, initrc_var_run_t, file)
Chris PeBenito ab58ad
Chris PeBenito ab58ad
# Read the devpts root directory.
Chris PeBenito ab58ad
allow $1_userhelper_t devpts_t:dir r_dir_perms;
Chris PeBenito ab58ad
Chris PeBenito ab58ad
# Read the /etc/security/default_type file
Chris PeBenito ab58ad
allow $1_userhelper_t etc_t:file r_file_perms;
Chris PeBenito ab58ad
Chris PeBenito ab58ad
# Read /var.
Chris PeBenito ab58ad
r_dir_file($1_userhelper_t, var_t)
Chris PeBenito ab58ad
Chris PeBenito ab58ad
# Read /dev directories and any symbolic links.
Chris PeBenito ab58ad
allow $1_userhelper_t device_t:dir r_dir_perms;
Chris PeBenito ab58ad
Chris PeBenito ab58ad
# Relabel terminals.
Chris PeBenito ab58ad
allow $1_userhelper_t { ttyfile ptyfile }:chr_file { relabelfrom relabelto };
Chris PeBenito ab58ad
Chris PeBenito ab58ad
# Access terminals.
Chris PeBenito ab58ad
allow $1_userhelper_t { ttyfile ptyfile devtty_t }:chr_file rw_file_perms;
Chris PeBenito ab58ad
ifdef(`gnome-pty-helper.te', `allow $1_userhelper_t gphdomain:fd use;')
Chris PeBenito ab58ad
Chris PeBenito ab58ad
#
Chris PeBenito ab58ad
# Allow $1_userhelper to obtain contexts to relabel TTYs
Chris PeBenito ab58ad
#
Chris PeBenito ab58ad
can_getsecurity($1_userhelper_t)
Chris PeBenito ab58ad
Chris PeBenito ab58ad
allow $1_userhelper_t fs_t:filesystem getattr;
Chris PeBenito ab58ad
Chris PeBenito ab58ad
# for some PAM modules and for cwd
Chris PeBenito ab58ad
allow $1_userhelper_t { home_root_t $1_home_dir_t }:dir search;
Chris PeBenito ab58ad
Chris PeBenito ab58ad
allow $1_userhelper_t proc_t:dir search;
Chris PeBenito ab58ad
allow $1_userhelper_t proc_t:file { getattr read };
Chris PeBenito ab58ad
Chris PeBenito ab58ad
# for when the network connection is killed
Chris PeBenito ab58ad
dontaudit unpriv_userdomain $1_userhelper_t:process signal;
Chris PeBenito ab58ad
Chris PeBenito ab58ad
allow $1_userhelper_t userhelper_conf_t:file rw_file_perms;
Chris PeBenito ab58ad
allow $1_userhelper_t userhelper_conf_t:dir rw_dir_perms;
Chris PeBenito ab58ad
Chris PeBenito ab58ad
ifdef(`pam.te', `
Chris PeBenito ab58ad
allow $1_userhelper_t pam_var_run_t:dir create_dir_perms;
Chris PeBenito ab58ad
allow $1_userhelper_t pam_var_run_t:file create_file_perms;
Chris PeBenito ab58ad
')
Chris PeBenito ab58ad
Chris PeBenito ab58ad
allow $1_userhelper_t urandom_device_t:chr_file { getattr read };
Chris PeBenito ab58ad
Chris PeBenito ab58ad
allow $1_userhelper_t autofs_t:dir search;
Chris PeBenito ab58ad
role system_r types $1_userhelper_t;
Chris PeBenito ab58ad
r_dir_file($1_userhelper_t, nfs_t)
Chris PeBenito ab58ad
Chris PeBenito ab58ad
ifdef(`xdm.te', `
Chris PeBenito ab58ad
can_pipe_xdm($1_userhelper_t)
Chris PeBenito ab58ad
allow $1_userhelper_t xdm_var_run_t:dir search;
Chris PeBenito ab58ad
')
Chris PeBenito ab58ad
Chris PeBenito ab58ad
r_dir_file($1_userhelper_t, selinux_config_t)
Chris PeBenito ab58ad
r_dir_file($1_userhelper_t, default_context_t)
Chris PeBenito ab58ad
Chris PeBenito ab58ad
ifdef(`xauth.te', `
Chris PeBenito ab58ad
domain_auto_trans($1_userhelper_t, xauth_exec_t, $1_xauth_t)
Chris PeBenito ab58ad
allow $1_userhelper_t $1_xauth_home_t:file { getattr read };
Chris PeBenito ab58ad
')
Chris PeBenito ab58ad
Chris PeBenito ab58ad
ifdef(`pamconsole.te', `
Chris PeBenito ab58ad
allow $1_userhelper_t pam_var_console_t:dir { search };
Chris PeBenito ab58ad
')
Chris PeBenito ab58ad
Chris PeBenito ab58ad
ifdef(`mozilla.te', `
Chris PeBenito ab58ad
domain_auto_trans($1_mozilla_t, userhelper_exec_t, $1_userhelper_t)
Chris PeBenito ab58ad
')
Chris PeBenito ab58ad
Chris PeBenito ab58ad
')dnl end userhelper macro