diff --git a/Changelog b/Changelog index 8c4b73f..b400464 100644 --- a/Changelog +++ b/Changelog @@ -1,3 +1,4 @@ +- Add authlogin interface to abstract common access for login programs. - Remove setbool auditallow, except for RHEL4. - Change eventpollfs to task SID labeling. - Add key support from Michael LeMay. diff --git a/policy/modules/services/remotelogin.te b/policy/modules/services/remotelogin.te index 5d1ebea..51409bb 100644 --- a/policy/modules/services/remotelogin.te +++ b/policy/modules/services/remotelogin.te @@ -1,5 +1,5 @@ -policy_module(remotelogin,1.2.1) +policy_module(remotelogin,1.2.2) ######################################## # @@ -7,13 +7,9 @@ policy_module(remotelogin,1.2.1) # type remote_login_t; -domain_obj_id_change_exemption(remote_login_t) -domain_subj_id_change_exemption(remote_login_t) -domain_role_change_exemption(remote_login_t) -domain_type(remote_login_t) domain_interactive_fd(remote_login_t) +auth_login_pgm_domain(remote_login_t) auth_login_entry_type(remote_login_t) -role system_r types remote_login_t; type remote_login_tmp_t; files_tmp_file(remote_login_tmp_t) @@ -49,27 +45,14 @@ kernel_read_kernel_sysctls(remote_login_t) dev_getattr_mouse_dev(remote_login_t) dev_setattr_mouse_dev(remote_login_t) dev_dontaudit_search_sysfs(remote_login_t) -# for SSP/ProPolice -dev_read_urand(remote_login_t) fs_getattr_xattr_fs(remote_login_t) fs_search_auto_mountpoints(remote_login_t) -selinux_get_fs_mount(remote_login_t) -selinux_validate_context(remote_login_t) -selinux_compute_access_vector(remote_login_t) -selinux_compute_create_context(remote_login_t) -selinux_compute_relabel_context(remote_login_t) -selinux_compute_user_contexts(remote_login_t) - term_relabel_all_user_ptys(remote_login_t) -auth_domtrans_chk_passwd(remote_login_t) -auth_dontaudit_read_shadow(remote_login_t) auth_rw_login_records(remote_login_t) -auth_rw_lastlog(remote_login_t) auth_rw_faillog(remote_login_t) -auth_exec_pam(remote_login_t) auth_manage_pam_console_data(remote_login_t) auth_domtrans_pam_console(remote_login_t) @@ -97,26 +80,12 @@ files_read_world_readable_symlinks(remote_login_t) files_read_world_readable_pipes(remote_login_t) files_read_world_readable_sockets(remote_login_t) files_list_mnt(remote_login_t) -files_polyinstantiate_all(remote_login_t) # for when /var/mail is a sym-link files_read_var_symlinks(remote_login_t) -init_rw_utmp(remote_login_t) - libs_use_ld_so(remote_login_t) libs_use_shared_libs(remote_login_t) -logging_send_syslog_msg(remote_login_t) - -mls_file_read_up(remote_login_t) -mls_file_write_down(remote_login_t) -mls_file_upgrade(remote_login_t) -mls_file_downgrade(remote_login_t) -mls_process_set_level(remote_login_t) - -seutil_read_config(remote_login_t) -seutil_read_default_contexts(remote_login_t) - sysnet_dns_name_resolve(remote_login_t) miscfiles_read_localization(remote_login_t) diff --git a/policy/modules/services/ssh.if b/policy/modules/services/ssh.if index 0089934..172fcf6 100644 --- a/policy/modules/services/ssh.if +++ b/policy/modules/services/ssh.if @@ -459,9 +459,7 @@ template(`ssh_per_userdomain_template',` # template(`ssh_server_template', ` type $1_t, ssh_server; - - domain_type($1_t) - role system_r types $1_t; + auth_login_pgm_domain($1_t) type $1_devpts_t; term_login_pty($1_devpts_t) @@ -503,22 +501,9 @@ template(`ssh_server_template', ` corenet_tcp_connect_all_ports($1_t) corenet_sendrecv_ssh_server_packets($1_t) - dev_read_urand($1_t) - fs_dontaudit_getattr_all_fs($1_t) - selinux_get_fs_mount($1_t) - selinux_validate_context($1_t) - selinux_compute_access_vector($1_t) - selinux_compute_create_context($1_t) - selinux_compute_relabel_context($1_t) - selinux_compute_user_contexts($1_t) - - auth_dontaudit_read_shadow($1_t) - auth_domtrans_chk_passwd($1_t) auth_rw_login_records($1_t) - auth_rw_lastlog($1_t) - auth_append_faillog($1_t) corecmd_read_bin_symlinks($1_t) corecmd_getattr_bin_files($1_t) @@ -526,31 +511,17 @@ template(`ssh_server_template', ` corecmd_getattr_bin_files($1_t) domain_interactive_fd($1_t) - domain_subj_id_change_exemption($1_t) - domain_role_change_exemption($1_t) - domain_obj_id_change_exemption($1_t) files_read_etc_files($1_t) files_read_etc_runtime_files($1_t) - init_rw_utmp($1_t) - libs_use_ld_so($1_t) libs_use_shared_libs($1_t) logging_search_logs($1_t) - logging_send_syslog_msg($1_t) miscfiles_read_localization($1_t) - mls_file_read_up($1_t) - mls_file_write_down($1_t) - mls_file_upgrade($1_t) - mls_file_downgrade($1_t) - mls_process_set_level($1_t) - - seutil_read_default_contexts($1_t) - sysnet_read_config($1_t) userdom_dontaudit_relabelfrom_unpriv_users_ptys($1_t) diff --git a/policy/modules/services/ssh.te b/policy/modules/services/ssh.te index 15ec28f..91a9116 100644 --- a/policy/modules/services/ssh.te +++ b/policy/modules/services/ssh.te @@ -1,5 +1,5 @@ -policy_module(ssh,1.3.7) +policy_module(ssh,1.3.8) ######################################## # @@ -84,16 +84,6 @@ ifdef(`strict_policy',` corenet_tcp_bind_xserver_port(sshd_t) corenet_sendrecv_xserver_server_packets(sshd_t) - mls_file_read_up(sshd_t) - mls_file_write_down(sshd_t) - mls_file_upgrade(sshd_t) - mls_file_downgrade(sshd_t) - mls_process_set_level(sshd_t) - - auth_exec_pam(sshd_t) - - seutil_read_config(sshd_t) - tunable_policy(`ssh_sysadm_login',` # Relabel and access ptys created by sshd # ioctl is necessary for logout() processing for utmp entry and for w to diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te index 86b30cc..c43154a 100644 --- a/policy/modules/services/xserver.te +++ b/policy/modules/services/xserver.te @@ -1,5 +1,5 @@ -policy_module(xserver,1.1.11) +policy_module(xserver,1.1.12) ######################################## # @@ -31,6 +31,7 @@ type xdm_t; gen_require(` type xdm_exec_t; ') +auth_login_pgm_domain(xdm_t) init_domain(xdm_t,xdm_exec_t) init_daemon_domain(xdm_t,xdm_exec_t) @@ -125,7 +126,6 @@ corenet_sendrecv_all_client_packets(xdm_t) corenet_dontaudit_tcp_bind_all_ports(xdm_t) dev_read_rand(xdm_t) -dev_read_urand(xdm_t) dev_read_sysfs(xdm_t) dev_getattr_framebuffer_dev(xdm_t) dev_setattr_framebuffer_dev(xdm_t) @@ -165,13 +165,6 @@ files_create_boot_flag(xdm_t) fs_getattr_all_fs(xdm_t) fs_search_auto_mountpoints(xdm_t) -selinux_get_fs_mount(xdm_t) -selinux_validate_context(xdm_t) -selinux_compute_access_vector(xdm_t) -selinux_compute_create_context(xdm_t) -selinux_compute_relabel_context(xdm_t) -selinux_compute_user_contexts(xdm_t) - storage_dontaudit_read_fixed_disk(xdm_t) storage_dontaudit_write_fixed_disk(xdm_t) storage_dontaudit_setattr_fixed_disk_dev(xdm_t) @@ -185,14 +178,9 @@ term_dontaudit_use_console(xdm_t) term_use_unallocated_ttys(xdm_t) term_setattr_unallocated_ttys(xdm_t) -auth_rw_lastlog(xdm_t) -auth_read_login_records(xdm_t) -auth_append_login_records(xdm_t) auth_manage_pam_pid(xdm_t) -auth_exec_pam(xdm_t) auth_manage_pam_console_data(xdm_t) -init_rw_utmp(xdm_t) init_use_script_ptys(xdm_t) # Run telinit->init to shutdown. init_exec(xdm_t) @@ -202,15 +190,11 @@ libs_use_ld_so(xdm_t) libs_use_shared_libs(xdm_t) libs_exec_lib_files(xdm_t) -logging_send_syslog_msg(xdm_t) logging_read_generic_logs(xdm_t) miscfiles_read_localization(xdm_t) miscfiles_read_fonts(xdm_t) -seutil_read_config(xdm_t) -seutil_read_default_contexts(xdm_t) - sysnet_read_config(xdm_t) userdom_dontaudit_use_unpriv_user_fds(xdm_t) @@ -222,11 +206,6 @@ userdom_read_unpriv_users_home_content_files(xdm_t) userdom_read_all_users_state(xdm_t) userdom_signal_all_users(xdm_t) -ifdef(`enable_polyinstantiation',` - # xdm_t can polyinstantiate - files_polyinstantiate_all(xdm_t) -') - ifdef(`strict_policy',` allow xdm_t xdm_lock_t:file create_file_perms; files_lock_filetrans(xdm_t,xdm_lock_t,file) @@ -283,11 +262,6 @@ ifdef(`strict_policy',` allow xdm_t xserver_log_t:fifo_file manage_file_perms; logging_log_filetrans(xdm_t,xserver_log_t,file) - domain_subj_id_change_exemption(xdm_t) - domain_role_change_exemption(xdm_t) - domain_obj_id_change_exemption(xdm_t) - - auth_domtrans_chk_passwd(xdm_t) auth_domtrans_pam_console(xdm_t) xserver_rw_session_template(xdm,xdm_t,xdm_tmpfs_t) diff --git a/policy/modules/system/authlogin.if b/policy/modules/system/authlogin.if index 4df9bc8..e0b90a7 100644 --- a/policy/modules/system/authlogin.if +++ b/policy/modules/system/authlogin.if @@ -195,6 +195,62 @@ template(`auth_domtrans_user_chk_passwd',` ######################################## ## +## Make the specified domain used for a login program. +## +## +## +## Domain type used for a login program domain. +## +## +# +interface(`auth_login_pgm_domain',` + + domain_type($1) + domain_subj_id_change_exemption($1) + domain_role_change_exemption($1) + domain_obj_id_change_exemption($1) + role system_r types $1; + + # for SSP/ProPolice + dev_read_urand($1) + + files_read_etc_files($1) + + selinux_get_fs_mount($1) + selinux_validate_context($1) + selinux_compute_access_vector($1) + selinux_compute_create_context($1) + selinux_compute_relabel_context($1) + selinux_compute_user_contexts($1) + + mls_file_read_up($1) + mls_file_write_down($1) + mls_file_upgrade($1) + mls_file_downgrade($1) + mls_process_set_level($1) + + auth_domtrans_chk_passwd($1) + auth_dontaudit_read_shadow($1) + auth_read_login_records($1) + auth_append_login_records($1) + auth_rw_lastlog($1) + auth_append_faillog($1) + auth_exec_pam($1) + + init_rw_utmp($1) + + logging_send_syslog_msg($1) + + seutil_read_config($1) + seutil_read_default_contexts($1) + + ifdef(`enable_polyinstantiation',` + files_polyinstantiate_all($1) + ') +') + +######################################## +## ## Use the login program as an entry point program. ## ## diff --git a/policy/modules/system/authlogin.te b/policy/modules/system/authlogin.te index 18d1fe8..978c2b3 100644 --- a/policy/modules/system/authlogin.te +++ b/policy/modules/system/authlogin.te @@ -1,5 +1,5 @@ -policy_module(authlogin,1.3.9) +policy_module(authlogin,1.3.10) ######################################## # diff --git a/policy/modules/system/locallogin.te b/policy/modules/system/locallogin.te index 296b6d9..0b999f4 100644 --- a/policy/modules/system/locallogin.te +++ b/policy/modules/system/locallogin.te @@ -1,5 +1,5 @@ -policy_module(locallogin,1.2.4) +policy_module(locallogin,1.2.5) ######################################## # @@ -7,13 +7,9 @@ policy_module(locallogin,1.2.4) # type local_login_t; -auth_login_entry_type(local_login_t) -domain_type(local_login_t) -domain_obj_id_change_exemption(local_login_t) -domain_subj_id_change_exemption(local_login_t) -domain_role_change_exemption(local_login_t) domain_interactive_fd(local_login_t) -role system_r types local_login_t; +auth_login_pgm_domain(local_login_t) +auth_login_entry_type(local_login_t) type local_login_lock_t; files_lock_file(local_login_lock_t) @@ -85,18 +81,9 @@ dev_dontaudit_setattr_scanner_dev(local_login_t) dev_dontaudit_search_sysfs(local_login_t) dev_dontaudit_getattr_video_dev(local_login_t) dev_dontaudit_setattr_video_dev(local_login_t) -# for SSP/ProPolice -dev_read_urand(local_login_t) fs_search_auto_mountpoints(local_login_t) -selinux_get_fs_mount(local_login_t) -selinux_validate_context(local_login_t) -selinux_compute_access_vector(local_login_t) -selinux_compute_create_context(local_login_t) -selinux_compute_relabel_context(local_login_t) -selinux_compute_user_contexts(local_login_t) - storage_dontaudit_getattr_fixed_disk_dev(local_login_t) storage_dontaudit_setattr_fixed_disk_dev(local_login_t) storage_dontaudit_getattr_removable_dev(local_login_t) @@ -109,12 +96,8 @@ term_relabel_all_user_ttys(local_login_t) term_setattr_all_user_ttys(local_login_t) term_setattr_unallocated_ttys(local_login_t) -auth_domtrans_chk_passwd(local_login_t) -auth_dontaudit_read_shadow(local_login_t) auth_rw_login_records(local_login_t) -auth_rw_lastlog(local_login_t) auth_rw_faillog(local_login_t) -auth_exec_pam(local_login_t) auth_manage_pam_console_data(local_login_t) auth_domtrans_pam_console(local_login_t) @@ -143,28 +126,14 @@ files_read_world_readable_pipes(local_login_t) files_read_world_readable_sockets(local_login_t) # for when /var/mail is a symlink files_read_var_symlinks(local_login_t) -# Login can polyinstantiate -files_polyinstantiate_all(local_login_t) -init_rw_utmp(local_login_t) init_dontaudit_use_fds(local_login_t) libs_use_ld_so(local_login_t) libs_use_shared_libs(local_login_t) -logging_send_syslog_msg(local_login_t) - miscfiles_read_localization(local_login_t) -mls_file_read_up(local_login_t) -mls_file_write_down(local_login_t) -mls_file_upgrade(local_login_t) -mls_file_downgrade(local_login_t) -mls_process_set_level(local_login_t) - -seutil_read_config(local_login_t) -seutil_read_default_contexts(local_login_t) - userdom_spec_domtrans_all_users(local_login_t) userdom_signal_all_users(local_login_t) userdom_search_all_users_home_content(local_login_t)