diff --git a/Changelog b/Changelog index 5aadec5..444c5b0 100644 --- a/Changelog +++ b/Changelog @@ -1,3 +1,4 @@ +- Patch to begin separating out hald helper programs from Dan Walsh. - Fixes for squid, dovecot, and snmp from Dan Walsh. - Miscellaneous consolekit fixes from Dan Walsh. - Patch to have avahi use the nsswitch interface rather than individual diff --git a/policy/modules/kernel/devices.if b/policy/modules/kernel/devices.if index cbbd523..27973bb 100644 --- a/policy/modules/kernel/devices.if +++ b/policy/modules/kernel/devices.if @@ -2939,6 +2939,24 @@ interface(`dev_read_video_dev',` ######################################## ## +## Write the video4linux devices. +## +## +## +## Domain allowed access. +## +## +# +interface(`dev_write_video_dev',` + gen_require(` + type device_t, v4l_device_t; + ') + + write_chr_files_pattern($1,device_t,v4l_device_t) +') + +######################################## +## ## Read and write VMWare devices. ## ## diff --git a/policy/modules/kernel/devices.te b/policy/modules/kernel/devices.te index 2a83f78..f7c7bc4 100644 --- a/policy/modules/kernel/devices.te +++ b/policy/modules/kernel/devices.te @@ -1,5 +1,5 @@ -policy_module(devices,1.4.0) +policy_module(devices,1.4.1) ######################################## # diff --git a/policy/modules/services/hal.fc b/policy/modules/services/hal.fc index 5dceef6..38cc644 100644 --- a/policy/modules/services/hal.fc +++ b/policy/modules/services/hal.fc @@ -2,10 +2,15 @@ /etc/hal/device\.d/printer_remove\.hal -- gen_context(system_u:object_r:hald_exec_t,s0) /etc/hal/capability\.d/printer_update\.hal -- gen_context(system_u:object_r:hald_exec_t,s0) +/usr/libexec/hal-acl-tool -- gen_context(system_u:object_r:hald_acl_exec_t,s0) /usr/libexec/hal-hotplug-map -- gen_context(system_u:object_r:hald_exec_t,s0) +/usr/libexec/hal-system-sonypic -- gen_context(system_u:object_r:hald_sonypic_exec_t,s0) +/usr/libexec/hald-addon-macbookpro-backlight -- gen_context(system_u:object_r:hald_mac_exec_t,s0) /usr/sbin/hald -- gen_context(system_u:object_r:hald_exec_t,s0) +/var/cache/hald(/.*)? gen_context(system_u:object_r:hald_cache_t,s0) + /var/lib/hal(/.*)? gen_context(system_u:object_r:hald_var_lib_t,s0) /var/run/haldaemon.pid -- gen_context(system_u:object_r:hald_var_run_t,s0) diff --git a/policy/modules/services/hal.te b/policy/modules/services/hal.te index 5cba0bb..a940ce9 100644 --- a/policy/modules/services/hal.te +++ b/policy/modules/services/hal.te @@ -1,5 +1,5 @@ -policy_module(hal,1.6.0) +policy_module(hal,1.6.1) ######################################## # @@ -10,6 +10,30 @@ type hald_t; type hald_exec_t; init_daemon_domain(hald_t,hald_exec_t) +type hald_acl_t; +type hald_acl_exec_t; +domain_type(hald_acl_t) +domain_entry_file(hald_acl_t,hald_acl_exec_t) +role system_r types hald_acl_t; + +type hald_cache_t; +files_pid_file(hald_cache_t) + +type hald_log_t; +files_type(hald_log_t) + +type hald_mac_t; +type hald_mac_exec_t; +domain_type(hald_mac_t) +domain_entry_file(hald_mac_t,hald_mac_exec_t) +role system_r types hald_mac_t; + +type hald_sonypic_t; +type hald_sonypic_exec_t; +domain_type(hald_sonypic_t) +domain_entry_file(hald_sonypic_t,hald_sonypic_exec_t) +role system_r types hald_sonypic_t; + type hald_tmp_t; files_tmp_file(hald_tmp_t) @@ -26,7 +50,7 @@ files_type(hald_var_lib_t) # execute openvt which needs setuid allow hald_t self:capability { chown setuid setgid kill net_admin sys_admin sys_nice dac_override dac_read_search mknod sys_rawio sys_tty_config }; -dontaudit hald_t self:capability sys_tty_config; +dontaudit hald_t self:capability {sys_ptrace sys_tty_config }; allow hald_t self:process signal_perms; allow hald_t self:fifo_file rw_fifo_file_perms; allow hald_t self:unix_stream_socket { create_stream_socket_perms connectto }; @@ -39,6 +63,12 @@ allow hald_t self:netlink_socket create_socket_perms; send_audit_msgs_pattern(hald_t) +manage_files_pattern(hald_t,hald_cache_t,hald_cache_t) + +# log files for hald +allow hald_t hald_log_t:file manage_file_perms; +logging_log_filetrans(hald_t,hald_log_t,file) + manage_dirs_pattern(hald_t,hald_tmp_t,hald_tmp_t) manage_files_pattern(hald_t,hald_tmp_t,hald_tmp_t) files_tmp_filetrans(hald_t, hald_tmp_t, { file dir }) @@ -53,9 +83,9 @@ files_pid_filetrans(hald_t,hald_var_run_t,file) kernel_read_system_state(hald_t) kernel_read_network_state(hald_t) -kernel_read_kernel_sysctls(hald_t) +kernel_rw_kernel_sysctl(hald_t) kernel_read_fs_sysctls(hald_t) -kernel_read_irq_sysctls(hald_t) +kernel_rw_irq_sysctls(hald_t) kernel_rw_vm_sysctls(hald_t) kernel_write_proc_files(hald_t) @@ -88,6 +118,7 @@ dev_rw_sysfs(hald_t) domain_use_interactive_fds(hald_t) domain_read_all_domains_state(hald_t) +domain_dontaudit_ptrace_all_domains(hald_t) files_exec_etc_files(hald_t) files_read_etc_files(hald_t) @@ -104,6 +135,7 @@ files_read_kernel_img(hald_t) fs_getattr_all_fs(hald_t) fs_search_all(hald_t) +fs_list_inotifyfs(hald_t) fs_list_auto_mountpoints(hald_t) files_getattr_all_mountpoints(hald_t) @@ -128,10 +160,10 @@ term_dontaudit_use_unallocated_ttys(hald_t) auth_use_nsswitch(hald_t) init_domtrans_script(hald_t) -init_write_initctl(hald_t) init_read_utmp(hald_t) #hal runs shutdown, probably need a shutdown domain init_rw_utmp(hald_t) +init_telinit(hald_t) libs_use_ld_so(hald_t) libs_use_shared_libs(hald_t) @@ -160,6 +192,10 @@ ifdef(`targeted_policy',` ') optional_policy(` + alsa_read_rw_config(hald_t) +') + +optional_policy(` bootloader_domtrans(hald_t) ') @@ -245,3 +281,100 @@ optional_policy(` optional_policy(` vbetool_domtrans(hald_t) ') + +######################################## +# +# Hal acl local policy +# + +allow hald_acl_t self:capability { dac_override fowner }; +allow hald_acl_t self:fifo_file read_fifo_file_perms; + +domtrans_pattern(hald_t, hald_acl_exec_t, hald_acl_t) +allow hald_t hald_acl_t:process signal; +allow hald_acl_t hald_t:unix_stream_socket connectto; + +manage_dirs_pattern(hald_acl_t,hald_var_lib_t,hald_var_lib_t) +manage_files_pattern(hald_acl_t,hald_var_lib_t,hald_var_lib_t) +files_search_var_lib(hald_acl_t) + +corecmd_exec_bin(hald_acl_t) + +dev_getattr_all_chr_files(hald_acl_t) +dev_setattr_video_dev(hald_acl_t) +dev_setattr_sound_dev(hald_acl_t) +dev_setattr_generic_usb_dev(hald_acl_t) +dev_setattr_usbfs_files(hald_acl_t) + +files_read_usr_files(hald_acl_t) +files_read_etc_files(hald_acl_t) + +storage_getattr_removable_dev(hald_acl_t) +storage_setattr_removable_dev(hald_acl_t) + +auth_use_nsswitch(hald_acl_t) + +libs_use_ld_so(hald_acl_t) +libs_use_shared_libs(hald_acl_t) + +miscfiles_read_localization(hald_acl_t) + +ifdef(`targeted_policy',` + term_dontaudit_use_console(hald_acl_t) + term_dontaudit_use_generic_ptys(hald_acl_t) +') + +######################################## +# +# Local hald mac policy +# + +domtrans_pattern(hald_t, hald_mac_exec_t, hald_mac_t) +allow hald_t hald_mac_t:process signal; +allow hald_mac_t hald_t:unix_stream_socket connectto; + +manage_dirs_pattern(hald_mac_t,hald_var_lib_t,hald_var_lib_t) +manage_files_pattern(hald_mac_t,hald_var_lib_t,hald_var_lib_t) +files_search_var_lib(hald_mac_t) + +dev_write_raw_memory(hald_mac_t) + +files_read_usr_files(hald_mac_t) + +libs_use_ld_so(hald_mac_t) +libs_use_shared_libs(hald_mac_t) + +miscfiles_read_localization(hald_mac_t) + +ifdef(`targeted_policy',` + term_dontaudit_use_console(hald_mac_t) + term_dontaudit_use_generic_ptys(hald_mac_t) +') + +######################################## +# +# Local hald sonypic policy +# + +domtrans_pattern(hald_t, hald_sonypic_exec_t, hald_sonypic_t) +allow hald_t hald_sonypic_t:process signal; +allow hald_sonypic_t hald_t:unix_stream_socket connectto; + +dev_read_video_dev(hald_sonypic_t) +dev_write_video_dev(hald_sonypic_t) + +manage_dirs_pattern(hald_sonypic_t,hald_var_lib_t,hald_var_lib_t) +manage_files_pattern(hald_sonypic_t,hald_var_lib_t,hald_var_lib_t) +files_search_var_lib(hald_sonypic_t) + +files_read_usr_files(hald_sonypic_t) + +libs_use_ld_so(hald_sonypic_t) +libs_use_shared_libs(hald_sonypic_t) + +miscfiles_read_localization(hald_sonypic_t) + +ifdef(`targeted_policy',` + term_dontaudit_use_console(hald_sonypic_t) + term_dontaudit_use_generic_ptys(hald_sonypic_t) +')