diff --git a/refpolicy/policy/modules/system/domain.if b/refpolicy/policy/modules/system/domain.if index 481c201..aa14bbb 100644 --- a/refpolicy/policy/modules/system/domain.if +++ b/refpolicy/policy/modules/system/domain.if @@ -6,27 +6,26 @@ # domain_base_domain_type(domain) # define(`domain_base_domain_type',` - gen_require(`$0'_depend) + gen_require(` + attribute domain; + class dir r_dir_perms; + class lnk_file r_file_perms; + class file rw_file_perms; + class process { fork sigchld }; + ') # mark as a domain typeattribute $1 domain; # allow the domain to read its /proc/pid entries allow $1 self:dir r_dir_perms; - allow $1 self:{ file lnk_file } rw_file_perms; + allow $1 self:lnk_file r_file_perms; + allow $1 self:file rw_file_perms; # allow $1 to create child processes in this domain allow $1 self:process { fork sigchld }; ') -define(`domain_base_domain_type_depend',` - attribute domain; - - class dir r_dir_perms; - class file rw_file_perms; - class lnk_file r_file_perms; -') - ######################################## # # domain_type(domain) @@ -58,33 +57,28 @@ define(`domain_type',` # domain_entry_file(domain,entrypointfile) # define(`domain_entry_file',` - gen_require(`$0'_depend) + gen_require(` + attribute entry_type; + class file entrypoint; + ') files_file_type($2) allow $1 $2:file entrypoint; typeattribute $2 entry_type; ') -define(`domain_entry_file_depend',` - attribute entry_type; - - class file entrypoint; -') - ######################################## # # domain_wide_inherit_fd(domain) # define(`domain_wide_inherit_fd',` - gen_require(`$0'_depend) + gen_require(` + attribute privfd; + ') typeattribute $1 privfd; ') -define(`domain_wide_inherit_fd_depend',` - attribute privfd; -') - ######################################## ## ## @@ -97,15 +91,13 @@ define(`domain_wide_inherit_fd_depend',` ## # define(`domain_subj_id_change_exempt',` - gen_require(`$0'_depend) + gen_require(` + attribute can_change_process_identity; + ') typeattribute $1 can_change_process_identity; ') -define(`domain_subj_id_change_exempt_depend',` - attribute can_change_process_identity; -') - ######################################## ## ## @@ -118,15 +110,13 @@ define(`domain_subj_id_change_exempt_depend',` ## # define(`domain_role_change_exempt',` - gen_require(`$0'_depend) + gen_require(` + attribute can_change_process_role; + ') typeattribute $1 can_change_process_role; ') -define(`domain_role_change_exempt_depend',` - attribute can_change_process_role; -') - ######################################## ## ## @@ -139,63 +129,52 @@ define(`domain_role_change_exempt_depend',` ## # define(`domain_obj_id_change_exempt',` - gen_require(`$0'_depend) + gen_require(` + attribute can_change_object_identity; + ') typeattribute $1 can_change_object_identity; ') -define(`domain_obj_id_change_exempt_depend',` - attribute can_change_object_identity; -') - ######################################## # # domain_use_wide_inherit_fd(domain) # define(`domain_use_wide_inherit_fd',` - gen_require(`$0'_depend) + gen_require(` + attribute privfd; + class fd use; + ') allow $1 privfd:fd use; ') -define(`domain_use_wide_inherit_fd_depend',` - attribute privfd; - - class fd use; -') - ######################################## # # domain_dontaudit_use_wide_inherit_fd(domain) # define(`domain_dontaudit_use_wide_inherit_fd',` - gen_require(`$0'_depend) + gen_require(` + attribute privfd; + class fd use; + ') dontaudit $1 privfd:fd use; ') -define(`domain_dontaudit_use_wide_inherit_fd_depend',` - attribute privfd; - - class fd use; -') - ######################################## # # domain_setpriority_all_domains(domain) # define(`domain_setpriority_all_domains',` - gen_require(`$0'_depend) + gen_require(` + attribute domain; + class process setsched; + ') allow $1 domain:process setsched; ') -define(`domain_setpriority_all_domains_depend',` - attribute domain; - - class process setsched; -') - ######################################## ## ## @@ -207,17 +186,14 @@ define(`domain_setpriority_all_domains_depend',` ## # define(`domain_signal_all_domains',` - gen_require(`$0'_depend) + gen_require(` + attribute domain; + class process signal; + ') allow $1 domain:process signal; ') -define(`domain_signal_all_domains_depend',` - attribute domain; - - class process signal; -') - ######################################## ## ## @@ -229,17 +205,14 @@ define(`domain_signal_all_domains_depend',` ## # define(`domain_signull_all_domains',` - gen_require(`$0'_depend) + gen_require(` + attribute domain; + class process signull; + ') allow $1 domain:process signull; ') -define(`domain_signull_all_domains_depend',` - attribute domain; - - class process signull; -') - ######################################## ## ## @@ -251,17 +224,14 @@ define(`domain_signull_all_domains_depend',` ## # define(`domain_sigstop_all_domains',` - gen_require(`$0'_depend) + gen_require(` + attribute domain; + class process sigstop; + ') allow $1 domain:process sigstop; ') -define(`domain_sigstop_all_domains_depend',` - attribute domain; - - class process sigstop; -') - ######################################## ## ## @@ -273,17 +243,14 @@ define(`domain_sigstop_all_domains_depend',` ## # define(`domain_sigchld_all_domains',` - gen_require(`$0'_depend) + gen_require(` + attribute domain; + class process sigchld; + ') allow $1 domain:process sigchld; ') -define(`domain_sigchld_all_domains_depend',` - attribute domain; - - class process sigchld; -') - ######################################## ## ## @@ -295,19 +262,16 @@ define(`domain_sigchld_all_domains_depend',` ## # define(`domain_kill_all_domains',` - gen_require(`$0'_depend) + gen_require(` + attribute domain; + class process sigkill; + class capability kill; + ') allow $1 domain:process sigkill; allow $1 self:capability kill; ') -define(`domain_kill_all_domains_depend',` - attribute domain; - - class process sigkill; - class capability kill; -') - ######################################## ## ## @@ -319,7 +283,13 @@ define(`domain_kill_all_domains_depend',` ## # define(`domain_read_all_domains_state',` - gen_require(`$0'_depend) + gen_require(` + attribute domain; + class dir r_dir_perms; + class lnk_file r_file_perms; + class file r_file_perms; + class process { getattr ptrace }; + ') allow $1 domain:dir r_dir_perms; allow $1 domain:lnk_file r_file_perms; @@ -333,15 +303,6 @@ define(`domain_read_all_domains_state',` dontaudit $1 domain:process ptrace; ') -define(`domain_read_all_domains_state_depend',` - attribute domain; - - class dir r_dir_perms; - class lnk_file r_file_perms; - class file r_file_perms; - class process { getattr ptrace }; -') - ######################################## ## ## @@ -354,18 +315,14 @@ define(`domain_read_all_domains_state_depend',` ## # define(`domain_dontaudit_list_all_domains_proc',` - gen_require(`$0'_depend) + gen_require(` + attribute domain; + class dir r_dir_perms; + ') dontaudit $1 domain:dir r_dir_perms; ') -define(`domain_dontaudit_list_all_domains_proc_depend',` - attribute domain; - - class dir r_dir_perms; -') - - ######################################## ## ## @@ -377,17 +334,14 @@ define(`domain_dontaudit_list_all_domains_proc_depend',` ## # define(`domain_getsession_all_domains',` - gen_require(`$0'_depend) + gen_require(` + attribute domain; + class process getsession; + ') allow $1 domain:process getsession; ') -define(`domain_getsession_all_domains_depend',` - attribute domain; - - class process getsession; -') - ######################################## ## ## @@ -400,17 +354,14 @@ define(`domain_getsession_all_domains_depend',` ## # define(`domain_dontaudit_getattr_all_udp_sockets',` - gen_require(`$0'_depend) + gen_require(` + attribute domain; + class udp_socket getattr; + ') dontaudit $1 domain:udp_socket getattr; ') -define(`domain_dontaudit_getattr_all_udp_sockets_depend',` - attribute domain; - - class udp_socket getattr; -') - ######################################## ## ## @@ -423,17 +374,14 @@ define(`domain_dontaudit_getattr_all_udp_sockets_depend',` ## # define(`domain_dontaudit_getattr_all_tcp_sockets',` - gen_require(`$0'_depend) + gen_require(` + attribute domain; + class tcp_socket getattr; + ') dontaudit $1 domain:tcp_socket getattr; ') -define(`domain_dontaudit_getattr_all_tcp_sockets_depend',` - attribute domain; - - class tcp_socket getattr; -') - ######################################## ## ## @@ -446,17 +394,14 @@ define(`domain_dontaudit_getattr_all_tcp_sockets_depend',` ## # define(`domain_dontaudit_getattr_all_unix_dgram_sockets',` - gen_require(`$0'_depend) + gen_require(` + attribute domain; + class unix_dgram_socket getattr; + ') dontaudit $1 domain:unix_dgram_socket getattr; ') -define(`domain_dontaudit_getattr_all_unix_dgram_sockets_depend',` - attribute domain; - - class unix_dgram_socket getattr; -') - ######################################## ## ## @@ -469,32 +414,24 @@ define(`domain_dontaudit_getattr_all_unix_dgram_sockets_depend',` ## # define(`domain_dontaudit_getattr_all_unnamed_pipes',` - gen_require(`$0'_depend) + gen_require(` + attribute domain; + class fifo_file getattr; + ') dontaudit $1 domain:fifo_file getattr; ') -define(`domain_dontaudit_getattr_all_unnamed_pipes_depend',` - attribute domain; - - class fifo_file getattr; -') - ######################################## # # domain_exec_all_entry_files(domain) # define(`domain_exec_all_entry_files',` - gen_require(`$0'_depend) - - can_exec($1,entry_type) - -') - -define(`domain_exec_all_entry_files_depend',` - attribute entry_type; + gen_require(` + attribute entry_type; + ') - class file { getattr read ioctl lock execute execute_no_trans }; + can_exec($1,entry_type) ') ######################################## @@ -502,25 +439,22 @@ define(`domain_exec_all_entry_files_depend',` # domain_read_all_entry_files(domain) # define(`domain_read_all_entry_files',` - gen_require(`$0'_depend) + gen_require(` + attribute entry_type; + class file r_file_perms; + class lnk_file r_file_perms; + ') allow $1 entry_type:lnk_file r_file_perms; allow $1 entry_type:file r_file_perms; ') -define(`domain_read_all_entry_files_depend',` - attribute entry_type; - - class file r_file_perms; - class lnk_file r_file_perms; -') - ## # # These next macros are not interfaces, but actually are # support macros. Due to the domain_ prefix, they -# are placed in this module. +# are placed in this module, to try to prevent confusion. # ######################################## @@ -528,18 +462,16 @@ define(`domain_read_all_entry_files_depend',` # domain_trans(source_domain,entrypoint_file,target_domain) # define(`domain_trans',` - gen_require(`$0'_depend) + gen_require(` + class file rx_file_perms; + process { transition noatsecure siginh rlimitinh }; + ') allow $1 $2:file rx_file_perms; allow $1 $3:process transition; dontaudit $1 $3:process { noatsecure siginh rlimitinh }; ') -define(`domain_trans_depend',` - class file rx_file_perms; - process { transition noatsecure siginh rlimitinh }; -') - ######################################## # # domain_auto_trans(source_domain,entrypoint_file,target_domain)