diff --git a/refpolicy/Changelog b/refpolicy/Changelog index b96d3b2..8dac5cd 100644 --- a/refpolicy/Changelog +++ b/refpolicy/Changelog @@ -3,6 +3,7 @@ apt (Erich Schubert) clamav (Erich Schubert) dpkg (Erich Schubert) + mplayer rhgb thunderbird tor (Erich Schubert) diff --git a/refpolicy/policy/global_tunables b/refpolicy/policy/global_tunables index 974636b..ed18162 100644 --- a/refpolicy/policy/global_tunables +++ b/refpolicy/policy/global_tunables @@ -332,6 +332,13 @@ gen_tunable(allow_gpg_execstack,false) ## ##

+## Allow mplayer executable stack +##

+## +gen_tunable(allow_mplayer_execstack,false) + +## +##

## allow host key based authentication ##

## diff --git a/refpolicy/policy/modules/admin/alsa.if b/refpolicy/policy/modules/admin/alsa.if index f66893c..0381c21 100644 --- a/refpolicy/policy/modules/admin/alsa.if +++ b/refpolicy/policy/modules/admin/alsa.if @@ -59,3 +59,23 @@ interface(`alsa_rw_shared_mem',` allow $1 alsa_t:shm { unix_read unix_write create_shm_perms }; ') + +######################################## +## +## Read alsa writable config files. +## +## +## +## Domain allowed access. +## +## +# +interface(`alsa_read_rw_config',` + gen_require(` + type alsa_etc_rw_t; + ') + + allow $1 alsa_etc_rw_t:dir r_dir_perms; + allow $1 alsa_etc_rw_t:file r_file_perms; + allow $1 alsa_etc_rw_t:lnk_file { getattr read }; +') diff --git a/refpolicy/policy/modules/apps/mplayer.fc b/refpolicy/policy/modules/apps/mplayer.fc new file mode 100644 index 0000000..60db2e9 --- /dev/null +++ b/refpolicy/policy/modules/apps/mplayer.fc @@ -0,0 +1,14 @@ +# +# /etc +# +/etc/mplayer(/.*)? gen_context(system_u:object_r:mplayer_etc_t,s0) + +# +# /usr +# +/usr/bin/mplayer -- gen_context(system_u:object_r:mplayer_exec_t,s0) +/usr/bin/mencoder -- gen_context(system_u:object_r:mencoder_exec_t,s0) + +ifdef(`strict_policy',` +HOME_DIR/\.mplayer(/.*)? gen_context(system_u:object_r:ROLE_mplayer_home_t,s0) +') diff --git a/refpolicy/policy/modules/apps/mplayer.if b/refpolicy/policy/modules/apps/mplayer.if new file mode 100644 index 0000000..6a41c55 --- /dev/null +++ b/refpolicy/policy/modules/apps/mplayer.if @@ -0,0 +1,458 @@ +## Mplayer media player and encoder + +####################################### +## +## The per user domain template for the mplayer module. +## +## +##

+## This template creates a derived domains which are used +## for mplayer media player. +##

+##

+## This template is invoked automatically for each user, and +## generally does not need to be invoked directly +## by policy writers. +##

+## +## +## +## The prefix of the user domain (e.g., user +## is the prefix for user_t). +## +## +## +## +## The type of the user domain. +## +## +## +## +## The role associated with the user domain. +## +## +# +template(`mplayer_per_userdomain_template',` + + ######################################## + # + # Declarations + # + + type $1_mencoder_t; + domain_type($1_mencoder_t) + domain_entry_file($1_mencoder_t,mencoder_exec_t) + role $3 types $1_mencoder_t; + + type $1_mplayer_t; + domain_type($1_mplayer_t) + domain_entry_file($1_mplayer_t,mplayer_exec_t) + role $3 types $1_mplayer_t; + + type $1_mplayer_home_t alias $1_mplayer_rw_t; + files_poly_member($1_mplayer_home_t) + userdom_user_home_content($1,$1_mplayer_home_t) + + type $1_mplayer_tmpfs_t; + files_tmpfs_file($1_mplayer_tmpfs_t) + + ######################################## + # + # mencoder local policy + # + + allow $1_mencoder_t $1_mplayer_home_t:dir create_dir_perms; + allow $1_mencoder_t $1_mplayer_home_t:file create_file_perms; + allow $1_mencoder_t $1_mplayer_home_t:lnk_file create_lnk_perms; + + # Read global config + allow $1_mencoder_t mplayer_etc_t:dir r_dir_perms; + allow $1_mencoder_t mplayer_etc_t:file r_file_perms; + allow $1_mencoder_t mplayer_etc_t:lnk_file { getattr read }; + + # domain transition + domain_auto_trans($2, mencoder_exec_t, $1_mencoder_t) + allow $2 $1_mencoder_t:fd use; + allow $1_mencoder_t $2:fd use; + allow $1_mencoder_t $2:fifo_file rw_file_perms; + allow $1_mencoder_t $2:process sigchld; + + # Allow the user domain to signal/ps. + allow $2 $1_mencoder_t:dir { search getattr read }; + allow $2 $1_mencoder_t:{ file lnk_file } { read getattr }; + allow $2 $1_mencoder_t:process getattr; + # We need to suppress this denial because procps tries to access + # /proc/pid/environ and this now triggers a ptrace check in recent kernels + # (2.4 and 2.6). Might want to change procps to not do this, or only if + # running in a privileged domain. + dontaudit $2 $1_mencoder_t:process ptrace; + allow $2 $1_mencoder_t:process signal_perms; + + # Read /proc files and directories + # Necessary for /proc/meminfo, /proc/cpuinfo, etc.. + kernel_read_system_state($1_mencoder_t) + # Sysctl on kernel version + kernel_read_kernel_sysctls($1_mencoder_t) + + # Required for win32 binary loader + dev_rwx_zero($1_mencoder_t) + # Access to DVD/CD/V4L + dev_read_video_dev($1_mencoder_t) + + # Read data in /usr/share (fonts, icons..) + files_read_usr_files($1_mencoder_t) + files_read_usr_symlinks($1_mencoder_t) + + fs_search_auto_mountpoints($1_mencoder_t) + + # Access to DVD/CD/V4L + storage_raw_read_removable_device($1_mencoder_t) + + libs_use_ld_so($1_mencoder_t) + libs_use_shared_libs($1_mencoder_t) + + miscfiles_read_localization($1_mencoder_t) + + userdom_use_user_terminals($1,$1_mencoder_t) + # Handle removable media, /tmp, and /home + userdom_list_user_tmp($1,$1_mencoder_t) + userdom_read_user_tmp_files($1,$1_mencoder_t) + userdom_read_user_tmp_symlinks($1,$1_mencoder_t) + userdom_read_user_home_content_files($1,$1_mencoder_t) + userdom_read_user_home_content_symlinks($1,$1_mencoder_t) + + # Read content to encode + ifdef(`mls_policy',`',` + fs_search_removable($1_mencoder_t) + fs_read_removable_files($1_mencoder_t) + fs_read_removable_symlinks($1_mencoder_t) + ') + + tunable_policy(`allow_execmem',` + allow $1_mencoder_t self:process execmem; + ') + + tunable_policy(`allow_execmod',` + dev_execmod_zero($1_mencoder_t) + ') + + tunable_policy(`allow_mplayer_execstack',` + allow $1_mencoder_t self:process { execmem execstack }; + ') + + tunable_policy(`use_nfs_home_dirs',` + fs_manage_nfs_dirs($1_mencoder_t) + fs_manage_nfs_files($1_mencoder_t) + fs_manage_nfs_symlinks($1_mencoder_t) + + ') + + tunable_policy(`use_samba_home_dirs',` + fs_manage_cifs_dirs($1_mencoder_t) + fs_manage_cifs_files($1_mencoder_t) + fs_manage_cifs_symlinks($1_mencoder_t) + + ') + + # Read content to encode + tunable_policy(`use_nfs_home_dirs',` + fs_list_auto_mountpoints($1_mencoder_t) + files_list_home($1_mencoder_t) + fs_read_nfs_files($1_mencoder_t) + fs_read_nfs_symlinks($1_mencoder_t) + + ',` + files_dontaudit_list_home($1_mencoder_t) + fs_dontaudit_list_auto_mountpoints($1_mencoder_t) + fs_dontaudit_read_nfs_files($1_mencoder_t) + fs_dontaudit_list_nfs($1_mencoder_t) + ') + + tunable_policy(`use_samba_home_dirs',` + fs_list_auto_mountpoints($1_mencoder_t) + files_list_home($1_mencoder_t) + fs_read_cifs_files($1_mencoder_t) + fs_read_cifs_symlinks($1_mencoder_t) + ',` + files_dontaudit_list_home($1_mencoder_t) + fs_dontaudit_list_auto_mountpoints($1_mencoder_t) + fs_dontaudit_read_cifs_files($1_mencoder_t) + fs_dontaudit_list_cifs($1_mencoder_t) + ') + + tunable_policy(`read_default_t',` + files_list_default($1_mencoder_t) + files_read_default_files($1_mencoder_t) + files_read_default_symlinks($1_mencoder_t) + ',` + files_dontaudit_read_default_files($1_mencoder_t) + files_dontaudit_list_default($1_mencoder_t) + ') + + tunable_policy(`read_untrusted_content',` + files_list_tmp($1_mencoder_t) + files_list_home($1_mencoder_t) + + userdom_list_user_untrusted_content($1,$1_mencoder_t) + userdom_read_user_untrusted_content_files($1,$1_mencoder_t) + userdom_read_user_untrusted_content_symlinks($1,$1_mencoder_t) + userdom_list_user_tmp_untrusted_content($1,$1_mencoder_t) + userdom_read_user_tmp_untrusted_content_files($1,$1_mencoder_t) + userdom_read_user_tmp_untrusted_content_symlinks($1,$1_mencoder_t) + ',` + files_dontaudit_list_tmp($1_mencoder_t) + files_dontaudit_list_home($1_mencoder_t) + userdom_dontaudit_list_user_home_dirs($1,$1_mencoder_t) + userdom_dontaudit_list_user_untrusted_content($1,$1_mencoder_t) + userdom_dontaudit_read_user_untrusted_content_files($1,$1_mencoder_t) + userdom_dontaudit_list_user_tmp_untrusted_content($1,$1_mencoder_t) + userdom_dontaudit_read_user_tmp_untrusted_content_files($1,$1_mencoder_t) + ') + + # Save encoded files + tunable_policy(`write_untrusted_content && use_nfs_home_dirs',` + files_search_home($1_mencoder_t) + + fs_search_auto_mountpoints($1_mencoder_t) + fs_manage_nfs_dirs($1_mencoder_t) + fs_manage_nfs_files($1_mencoder_t) + fs_manage_nfs_symlinks($1_mencoder_t) + ',` + fs_dontaudit_list_auto_mountpoints($1_mencoder_t) + fs_dontaudit_manage_nfs_dirs($1_mencoder_t) + fs_dontaudit_manage_nfs_files($1_mencoder_t) + ') + + tunable_policy(`write_untrusted_content && use_samba_home_dirs',` + files_search_home($1_mencoder_t) + + fs_search_auto_mountpoints($1_mencoder_t) + fs_manage_cifs_dirs($1_mencoder_t) + fs_manage_cifs_files($1_mencoder_t) + fs_manage_cifs_symlinks($1_mencoder_t) + ',` + fs_dontaudit_list_auto_mountpoints($1_mencoder_t) + fs_dontaudit_manage_cifs_dirs($1_mencoder_t) + fs_dontaudit_manage_cifs_files($1_mencoder_t) + ') + + tunable_policy(`write_untrusted_content',` + files_search_home($1_mencoder_t) + files_tmp_filetrans($1_mencoder_t,$1_untrusted_content_tmp_t,file) + files_tmp_filetrans($1_mencoder_t,$1_untrusted_content_tmp_t,dir) + + userdom_manage_user_untrusted_content_files($1,$1_mencoder_t,file) + userdom_manage_user_untrusted_content_files($1,$1_mencoder_t,dir) + + ',` + files_dontaudit_list_home($1_mencoder_t) + files_dontaudit_list_tmp($1_mencoder_t) + + userdom_dontaudit_list_user_home_dirs($1,$1_mencoder_t) + userdom_dontaudit_manage_user_tmp_files($1,$1_mencoder_t) + userdom_dontaudit_manage_user_home_content_dirs($1,$1_mencoder_t) + ') + + ######################################## + # + # mplayer local policy + # + + allow $1_mplayer_t self:process { signal_perms getsched }; + allow $1_mplayer_t self:fifo_file rw_file_perms; + + allow $1_mplayer_t $1_mplayer_home_t:dir manage_dir_perms; + allow $1_mplayer_t $1_mplayer_home_t:file manage_file_perms; + allow $1_mplayer_t $1_mplayer_home_t:lnk_file create_lnk_perms; + userdom_search_user_home_dirs($1,$1_mplayer_t) + + allow $1_mplayer_t $1_mplayer_tmpfs_t:dir rw_dir_perms; + allow $1_mplayer_t $1_mplayer_tmpfs_t:file manage_file_perms; + allow $1_mplayer_t $1_mplayer_tmpfs_t:lnk_file create_lnk_perms; + allow $1_mplayer_t $1_mplayer_tmpfs_t:sock_file manage_file_perms; + allow $1_mplayer_t $1_mplayer_tmpfs_t:fifo_file manage_file_perms; + fs_tmpfs_filetrans($1_mplayer_t,$1_mplayer_tmpfs_t,{ dir file lnk_file sock_file fifo_file }) + + # Read global config + allow $1_mplayer_t mplayer_etc_t:dir r_dir_perms; + allow $1_mplayer_t mplayer_etc_t:file r_file_perms; + allow $1_mplayer_t mplayer_etc_t:lnk_file { getattr read }; + + # Home access + allow $2 $1_mplayer_home_t:dir manage_dir_perms; + allow $2 $1_mplayer_home_t:file manage_file_perms; + allow $2 $1_mplayer_home_t:lnk_file create_lnk_perms; + allow $2 $1_mplayer_home_t:{ dir file lnk_file } { relabelfrom relabelto }; + + # domain transition + domain_auto_trans($2, mplayer_exec_t, $1_mplayer_t) + allow $2 $1_mplayer_t:fd use; + allow $1_mplayer_t $2:fd use; + allow $1_mplayer_t $2:fifo_file rw_file_perms; + allow $1_mplayer_t $2:process sigchld; + + # Allow the user domain to signal/ps. + allow $2 $1_mplayer_t:dir { search getattr read }; + allow $2 $1_mplayer_t:{ file lnk_file } { read getattr }; + allow $2 $1_mplayer_t:process getattr; + # We need to suppress this denial because procps tries to access + # /proc/pid/environ and this now triggers a ptrace check in recent kernels + # (2.4 and 2.6). Might want to change procps to not do this, or only if + # running in a privileged domain. + dontaudit $2 $1_mplayer_t:process ptrace; + allow $2 $1_mplayer_t:process signal_perms; + + kernel_dontaudit_list_unlabeled($1_mplayer_t) + kernel_dontaudit_getattr_unlabeled_files($1_mplayer_t) + kernel_dontaudit_read_unlabeled_files($1_mplayer_t) + # Necessary for /proc/meminfo, /proc/cpuinfo, etc.. + kernel_read_system_state($1_mplayer_t) + # Sysctl on kernel version + kernel_read_kernel_sysctls($1_mplayer_t) + + # Run bash/sed (??) + corecmd_exec_bin($1_mplayer_t) + corecmd_exec_shell($1_mplayer_t) + + # Required for win32 binary loader + dev_rwx_zero($1_mplayer_t) + # Access to DVD/CD/V4L + dev_read_video_dev($1_mplayer_t) + # Audio, alsa.conf + dev_read_sound_mixer($1_mplayer_t) + dev_write_sound_mixer($1_mplayer_t) + # RTC clock + dev_read_realtime_clock($1_mplayer_t) + + # Access to DVD/CD/V4L + storage_raw_read_removable_device($1_mplayer_t) + + files_read_etc_files($1_mplayer_t) + files_dontaudit_list_non_security($1_mplayer_t) + files_dontaudit_getattr_non_security_files($1_mplayer_t) + files_read_non_security_files($1_mplayer_t) + # Unfortunately the ancient file dialog starts in / + files_list_home($1_mplayer_t) + # Read /etc/mtab + files_read_etc_runtime_files($1_mplayer_t) + # Read data in /usr/share (fonts, icons..) + files_read_usr_files($1_mplayer_t) + files_read_usr_symlinks($1_mplayer_t) + + fs_dontaudit_getattr_all_fs($1_mplayer_t) + fs_search_auto_mountpoints($1_mplayer_t) + + libs_use_ld_so($1_mplayer_t) + libs_use_shared_libs($1_mplayer_t) + + miscfiles_read_localization($1_mplayer_t) + miscfiles_read_fonts($1_mplayer_t) + + userdom_use_user_terminals($1,$1_mplayer_t) + # Read media files + userdom_list_user_tmp($1,$1_mplayer_t) + userdom_read_user_tmp_files($1,$1_mplayer_t) + userdom_read_user_tmp_symlinks($1,$1_mplayer_t) + userdom_read_user_home_content_files($1,$1_mplayer_t) + userdom_read_user_home_content_symlinks($1,$1_mplayer_t) + + xserver_user_client_template($1,$1_mplayer_t,$1_mplayer_tmpfs_t) + + # Read songs + ifdef(`mls_policy',`',` + fs_search_removable($1_mplayer_t) + fs_read_removable_files($1_mplayer_t) + fs_read_removable_symlinks($1_mplayer_t) + ') + + tunable_policy(`allow_execmem',` + allow $1_mplayer_t self:process execmem; + ') + + tunable_policy(`allow_execmod',` + dev_execmod_zero($1_mplayer_t) + ') + + tunable_policy(`allow_mplayer_execstack',` + allow $1_mplayer_t self:process { execmem execstack }; + ') + + tunable_policy(`use_nfs_home_dirs',` + fs_manage_nfs_dirs($1_mplayer_t) + fs_manage_nfs_files($1_mplayer_t) + fs_manage_nfs_symlinks($1_mplayer_t) + ') + tunable_policy(`use_samba_home_dirs',` + fs_manage_cifs_dirs($1_mplayer_t) + fs_manage_cifs_files($1_mplayer_t) + fs_manage_cifs_symlinks($1_mplayer_t) + ') + + # Legacy domain issues + tunable_policy(`allow_mplayer_execstack',` + allow $1_mplayer_t $1_mplayer_tmpfs_t:file execute; + ') + + # Read songs + tunable_policy(`use_nfs_home_dirs',` + fs_list_auto_mountpoints($1_mplayer_t) + files_list_home($1_mplayer_t) + fs_read_nfs_files($1_mplayer_t) + fs_read_nfs_symlinks($1_mplayer_t) + + ',` + files_dontaudit_list_home($1_mplayer_t) + fs_dontaudit_list_auto_mountpoints($1_mplayer_t) + fs_dontaudit_read_nfs_files($1_mplayer_t) + fs_dontaudit_list_nfs($1_mplayer_t) + ') + + tunable_policy(`use_samba_home_dirs',` + fs_list_auto_mountpoints($1_mplayer_t) + files_list_home($1_mplayer_t) + fs_read_cifs_files($1_mplayer_t) + fs_read_cifs_symlinks($1_mplayer_t) + ',` + files_dontaudit_list_home($1_mplayer_t) + fs_dontaudit_list_auto_mountpoints($1_mplayer_t) + fs_dontaudit_read_cifs_files($1_mplayer_t) + fs_dontaudit_list_cifs($1_mplayer_t) + ') + + tunable_policy(`read_default_t',` + files_list_default($1_mplayer_t) + files_read_default_files($1_mplayer_t) + files_read_default_symlinks($1_mplayer_t) + ',` + files_dontaudit_read_default_files($1_mplayer_t) + files_dontaudit_list_default($1_mplayer_t) + ') + + tunable_policy(`read_untrusted_content',` + files_list_tmp($1_mplayer_t) + files_list_home($1_mplayer_t) + + userdom_list_user_untrusted_content($1,$1_mplayer_t) + userdom_read_user_untrusted_content_files($1,$1_mplayer_t) + userdom_read_user_untrusted_content_symlinks($1,$1_mplayer_t) + userdom_list_user_tmp_untrusted_content($1,$1_mplayer_t) + userdom_read_user_tmp_untrusted_content_files($1,$1_mplayer_t) + userdom_read_user_tmp_untrusted_content_symlinks($1,$1_mplayer_t) + ',` + files_dontaudit_list_tmp($1_mplayer_t) + files_dontaudit_list_home($1_mplayer_t) + userdom_dontaudit_list_user_home_dirs($1,$1_mplayer_t) + userdom_dontaudit_list_user_untrusted_content($1,$1_mplayer_t) + userdom_dontaudit_read_user_untrusted_content_files($1,$1_mplayer_t) + userdom_dontaudit_list_user_tmp_untrusted_content($1,$1_mplayer_t) + userdom_dontaudit_read_user_tmp_untrusted_content_files($1,$1_mplayer_t) + ') + + optional_policy(`alsa',` + alsa_read_rw_config($1_mplayer_t) + ') + + optional_policy(`nscd',` + nscd_socket_use($1_mplayer_t) + ') +') diff --git a/refpolicy/policy/modules/apps/mplayer.te b/refpolicy/policy/modules/apps/mplayer.te new file mode 100644 index 0000000..0d0556a --- /dev/null +++ b/refpolicy/policy/modules/apps/mplayer.te @@ -0,0 +1,16 @@ + +policy_module(mplayer,1.0.0) + +######################################## +# +# Declarations +# + +type mplayer_exec_t; +files_type(mplayer_exec_t) + +type mencoder_exec_t; +files_type(mencoder_exec_t) + +type mplayer_etc_t; +files_config_file(mplayer_etc_t) diff --git a/refpolicy/policy/modules/kernel/devices.if b/refpolicy/policy/modules/kernel/devices.if index 6f131b4..f0f8328 100644 --- a/refpolicy/policy/modules/kernel/devices.if +++ b/refpolicy/policy/modules/kernel/devices.if @@ -2616,6 +2616,26 @@ interface(`dev_dontaudit_setattr_video_dev',` ######################################## ## +## Read the video4linux devices. +## +## +## +## Domain allowed access. +## +## +# +interface(`dev_read_video_dev',` + gen_require(` + type device_t, v4l_device_t; + ') + + allow $1 device_t:dir r_dir_perms; + allow $1 device_t:lnk_file { getattr read }; + allow $1 v4l_device_t:chr_file r_file_perms; +') + +######################################## +## ## Get the attributes of X server miscellaneous devices. ## ## @@ -2711,6 +2731,25 @@ interface(`dev_rwx_zero',` ######################################## ## +## Execmod the zero device (/dev/zero). +## +## +## +## Domain allowed access. +## +## +# +interface(`dev_execmod_zero',` + gen_require(` + type zero_device_t; + ') + + dev_rw_zero($1) + allow $1 zero_device_t:chr_file execmod; +') + +######################################## +## ## Unconfined access to devices. ## ##