From d25063431114cc0df405a3167d0046e21ee460f3 Mon Sep 17 00:00:00 2001
From: Chris PeBenito <cpebenito@tresys.com>
Date: Jul 20 2005 17:06:10 +0000
Subject: reorder kernel policy, add attributes for sysctl and proc entries.  fix unconfined interface



---

diff --git a/refpolicy/policy/modules/kernel/kernel.if b/refpolicy/policy/modules/kernel/kernel.if
index b018245..1b121ff 100644
--- a/refpolicy/policy/modules/kernel/kernel.if
+++ b/refpolicy/policy/modules/kernel/kernel.if
@@ -1030,16 +1030,18 @@ interface(`kernel_rw_rpc_sysctl',`
 ## </param>
 #
 interface(`kernel_read_all_sysctl',`
-	kernel_read_device_sysctl($1)
-	kernel_read_vm_sysctl($1)
-	kernel_read_net_sysctl($1)
-	kernel_read_unix_sysctl($1)
-	kernel_read_hotplug_sysctl($1)
-	kernel_read_modprobe_sysctl($1)
-	kernel_read_kernel_sysctl($1)
-	kernel_read_fs_sysctl($1)
-	kernel_read_irq_sysctl($1)
-	kernel_read_rpc_sysctl($1)
+	gen_require(`
+		attribute sysctl_type;
+		type proc_t, proc_net_t;
+		class dir r_dir_perms;
+		class file r_file_perms;
+	')
+
+	# proc_net_t for /proc/net/rpc sysctls
+	allow $1 { proc_t proc_net_t }:dir search;
+
+	allow $1 sysctl_type:dir r_dir_perms;
+	allow $1 sysctl_type:file r_file_perms;
 ')
 
 ########################################
@@ -1051,16 +1053,18 @@ interface(`kernel_read_all_sysctl',`
 ## </param>
 #
 interface(`kernel_rw_all_sysctl',`
-	kernel_rw_device_sysctl($1)
-	kernel_rw_vm_sysctl($1)
-	kernel_rw_net_sysctl($1)
-	kernel_rw_unix_sysctl($1)
-	kernel_rw_hotplug_sysctl($1)
-	kernel_rw_modprobe_sysctl($1)
-	kernel_rw_kernel_sysctl($1)
-	kernel_rw_fs_sysctl($1)
-	kernel_rw_irq_sysctl($1)
-	kernel_rw_rpc_sysctl($1)
+	gen_require(`
+		attribute sysctl_type;
+		type proc_t, proc_net_t;
+		class dir r_dir_perms;
+		class file { rw_file_perms setattr };
+	')
+
+	# proc_net_t for /proc/net/rpc sysctls
+	allow $1 { proc_t proc_net_t }:dir search;
+
+	allow $1 sysctl_type:dir r_dir_perms;
+	allow $1 sysctl_type:file { rw_file_perms setattr };
 ')
 
 ########################################
@@ -1228,13 +1232,7 @@ interface(`kernel_use_unlabeled_blk_dev',`
 interface(`kernel_relabel_unlabeled',`
 	gen_require(`
 		type unlabeled_t;
-		class dir { getattr relabelfrom };
-		class file { getattr relabelfrom };
-		class lnk_file { getattr relabelfrom };
-		class fifo_file { getattr relabelfrom };
-		class sock_file { getattr relabelfrom };
-		class chr_file { getattr relabelfrom };
-		class blk_file { getattr relabelfrom };
+		gen_require_set({ getattr relabelfrom },dir_file_class_set)
 	')
 
 	allow $1 unlabeled_t:dir_file_class_set { getattr relabelfrom };
@@ -1251,19 +1249,24 @@ interface(`kernel_relabel_unlabeled',`
 interface(`kernel_unconfined',`
 	gen_require(`
 		type kernel_t, unlabeled_t;
+		attribute proc_type, sysctl_type;
+		attribute kern_unconfined;
 		attribute can_load_kernmodule, can_receive_kernel_messages;
+		class dir r_dir_perms;
+		class file { rw_file_perms setattr };
 	')
 
-#	allow $1 proc_fs:{ dir file } *;
+	allow $1 proc_type:{ dir file } *;
 
 	allow $1 sysctl_t:{ dir file } *;
 
 	allow $1 kernel_t:system *;
 
-	allow $1 unlabeled_t:{ dir lnk_file sock_file fifo_file blk_file } *;
+	allow $1 unlabeled_t:dir_file_class_set *;
 	allow $1 unlabeled_t:filesystem *;
 
 	typeattribute $1 can_load_kernmodule, can_receive_kernel_messages;
+	typeattribute $1 kern_unconfined;
 
 	kernel_rw_all_sysctl($1)
 ')
diff --git a/refpolicy/policy/modules/kernel/kernel.te b/refpolicy/policy/modules/kernel/kernel.te
index 759046a..3afc061 100644
--- a/refpolicy/policy/modules/kernel/kernel.te
+++ b/refpolicy/policy/modules/kernel/kernel.te
@@ -10,6 +10,15 @@ policy_module(kernel,1.0)
 attribute can_load_kernmodule;
 attribute can_receive_kernel_messages;
 
+# domains with unconfined access to kernel resources
+attribute kern_unconfined;
+
+# regular entries in proc
+attribute proc_type;
+
+# sysctls
+attribute sysctl_type;
+
 #
 # kernel_t is the domain of kernel threads.
 # It is also the target type when checking permissions in the system class.
@@ -20,109 +29,109 @@ domain_type(kernel_t)
 sid kernel context_template(system_u:system_r:kernel_t,s0 - s9:c0.c127)
 
 #
-# unlabeled_t is the type of unlabeled objects.
-# Objects that have no known labeling information or that
-# have labels that are no longer valid are treated as having this type.
-#
-type unlabeled_t;
-sid unlabeled context_template(system_u:object_r:unlabeled_t,s0)
-
-# These initial sids are no longer used, and can be removed:
-sid any_socket		context_template(system_u:object_r:unlabeled_t,s0)
-sid file_labels		context_template(system_u:object_r:unlabeled_t,s0)
-sid icmp_socket		context_template(system_u:object_r:unlabeled_t,s0)
-sid igmp_packet		context_template(system_u:object_r:unlabeled_t,s0)
-sid init		context_template(system_u:object_r:unlabeled_t,s0)
-sid kmod		context_template(system_u:object_r:unlabeled_t,s0)
-sid netmsg		context_template(system_u:object_r:unlabeled_t,s0)
-sid policy		context_template(system_u:object_r:unlabeled_t,s0)
-sid scmp_packet		context_template(system_u:object_r:unlabeled_t,s0)
-sid sysctl_modprobe 	context_template(system_u:object_r:unlabeled_t,s0)
-sid sysctl_fs		context_template(system_u:object_r:unlabeled_t,s0)
-sid sysctl_kernel	context_template(system_u:object_r:unlabeled_t,s0)
-sid sysctl_net		context_template(system_u:object_r:unlabeled_t,s0)
-sid sysctl_net_unix	context_template(system_u:object_r:unlabeled_t,s0)
-sid sysctl_vm		context_template(system_u:object_r:unlabeled_t,s0)
-sid sysctl_dev		context_template(system_u:object_r:unlabeled_t,s0)
-sid tcp_socket		context_template(system_u:object_r:unlabeled_t,s0)
-
-#
 # Procfs types
 #
 
-type proc_t;
+type proc_t, proc_type;
 files_mountpoint(proc_t)
 fs_type(proc_t)
 genfscon proc / context_template(system_u:object_r:proc_t,s0)
 genfscon proc /sysvipc context_template(system_u:object_r:proc_t,s0)
 
 # kernel message interface
-type proc_kmsg_t;
+type proc_kmsg_t, proc_type;
 genfscon proc /kmsg context_template(system_u:object_r:proc_kmsg_t,s0)
 neverallow ~can_receive_kernel_messages proc_kmsg_t:file ~getattr;
 
 # /proc kcore: inaccessible
-type proc_kcore_t;
-neverallow * proc_kcore_t:file ~getattr;
+type proc_kcore_t, proc_type;
+neverallow { domain -kern_unconfined } proc_kcore_t:file ~getattr;
 genfscon proc /kcore context_template(system_u:object_r:proc_kcore_t,s0)
 
-type proc_mdstat_t;
+type proc_mdstat_t, proc_type;
 genfscon proc /mdstat context_template(system_u:object_r:proc_mdstat_t,s0)
 
-type proc_net_t;
+type proc_net_t, proc_type;
 genfscon proc /net context_template(system_u:object_r:proc_net_t,s0)
 
 #
 # Sysctl types
 #
 
+# /proc/sys directory, base directory of sysctls
+type sysctl_t, sysctl_type;
+files_mountpoint(sysctl_t)
+sid sysctl context_template(system_u:object_r:sysctl_t,s0)
+genfscon proc /sys context_template(system_u:object_r:sysctl_t,s0)
+
 # /proc/irq directory and files
-type sysctl_irq_t;
+type sysctl_irq_t, sysctl_type;
 genfscon proc /irq context_template(system_u:object_r:sysctl_irq_t,s0)
 
 # /proc/net/rpc directory and files
-type sysctl_rpc_t;
+type sysctl_rpc_t, sysctl_type;
 genfscon proc /net/rpc context_template(system_u:object_r:sysctl_rpc_t,s0)
 
-# /proc/sys directory, base directory of sysctls
-type sysctl_t;
-files_mountpoint(sysctl_t)
-sid sysctl context_template(system_u:object_r:sysctl_t,s0)
-genfscon proc /sys context_template(system_u:object_r:sysctl_t,s0)
-
 # /proc/sys/fs directory and files
-type sysctl_fs_t;
+type sysctl_fs_t, sysctl_type;
 files_mountpoint(sysctl_fs_t)
 genfscon proc /sys/fs context_template(system_u:object_r:sysctl_fs_t,s0)
 
 # /proc/sys/kernel directory and files
-type sysctl_kernel_t;
+type sysctl_kernel_t, sysctl_type;
 genfscon proc /sys/kernel context_template(system_u:object_r:sysctl_kernel_t,s0)
 
 # /proc/sys/kernel/modprobe file
-type sysctl_modprobe_t;
+type sysctl_modprobe_t, sysctl_type;
 genfscon proc /sys/kernel/modprobe context_template(system_u:object_r:sysctl_modprobe_t,s0)
 
 # /proc/sys/kernel/hotplug file
-type sysctl_hotplug_t;
+type sysctl_hotplug_t, sysctl_type;
 genfscon proc /sys/kernel/hotplug context_template(system_u:object_r:sysctl_hotplug_t,s0)
 
 # /proc/sys/net directory and files
-type sysctl_net_t;
+type sysctl_net_t, sysctl_type;
 genfscon proc /sys/net context_template(system_u:object_r:sysctl_net_t,s0)
 
 # /proc/sys/net/unix directory and files
-type sysctl_net_unix_t;
+type sysctl_net_unix_t, sysctl_type;
 genfscon proc /sys/net/unix context_template(system_u:object_r:sysctl_net_unix_t,s0)
 
 # /proc/sys/vm directory and files
-type sysctl_vm_t;
+type sysctl_vm_t, sysctl_type;
 genfscon proc /sys/vm context_template(system_u:object_r:sysctl_vm_t,s0)
 
 # /proc/sys/dev directory and files
-type sysctl_dev_t;
+type sysctl_dev_t, sysctl_type;
 genfscon proc /sys/dev context_template(system_u:object_r:sysctl_dev_t,s0)
 
+#
+# unlabeled_t is the type of unlabeled objects.
+# Objects that have no known labeling information or that
+# have labels that are no longer valid are treated as having this type.
+#
+type unlabeled_t;
+sid unlabeled context_template(system_u:object_r:unlabeled_t,s0)
+
+# These initial sids are no longer used, and can be removed:
+sid any_socket		context_template(system_u:object_r:unlabeled_t,s0)
+sid file_labels		context_template(system_u:object_r:unlabeled_t,s0)
+sid icmp_socket		context_template(system_u:object_r:unlabeled_t,s0)
+sid igmp_packet		context_template(system_u:object_r:unlabeled_t,s0)
+sid init		context_template(system_u:object_r:unlabeled_t,s0)
+sid kmod		context_template(system_u:object_r:unlabeled_t,s0)
+sid netmsg		context_template(system_u:object_r:unlabeled_t,s0)
+sid policy		context_template(system_u:object_r:unlabeled_t,s0)
+sid scmp_packet		context_template(system_u:object_r:unlabeled_t,s0)
+sid sysctl_modprobe 	context_template(system_u:object_r:unlabeled_t,s0)
+sid sysctl_fs		context_template(system_u:object_r:unlabeled_t,s0)
+sid sysctl_kernel	context_template(system_u:object_r:unlabeled_t,s0)
+sid sysctl_net		context_template(system_u:object_r:unlabeled_t,s0)
+sid sysctl_net_unix	context_template(system_u:object_r:unlabeled_t,s0)
+sid sysctl_vm		context_template(system_u:object_r:unlabeled_t,s0)
+sid sysctl_dev		context_template(system_u:object_r:unlabeled_t,s0)
+sid tcp_socket		context_template(system_u:object_r:unlabeled_t,s0)
+
 ########################################
 #
 # kernel local policy