* [refpolicy patch] latest try: merge irssi policy with irc module.
@ 2008-07-25 11:41 Dominick Grift
0 siblings, 0 replies; only message in thread
From: Dominick Grift @ 2008-07-25 11:41 UTC (permalink / raw)
To: selinux
[-- Attachment #1: Type: text/plain, Size: 9320 bytes --]
Merge irssi policy with irc module.
My previous attempt was too coarse. (read_files_pattern instead of
read_file_perms), and the use of (userdom_sigchld_all_users)
From ed2669a27729c95fadf4da0bf9f0f1e0d29abe90 Mon Sep 17 00:00:00 2001
From: Dominick Grift <domg472@gmail.com>
Date: Fri, 25 Jul 2008 13:26:37 +0200
Subject: [PATCH] Merge irssi with irc module.
Add irc signal and ptrace interface calls to userdomain.
Signed-off-by: Dominick Grift <domg472@gmail.com>
---
policy/modules/apps/irc.fc | 11 +++-
policy/modules/apps/irc.if | 122
++++++++++++++++++++++++++++++++---
policy/modules/apps/irc.te | 12 ++++
policy/modules/system/userdomain.if | 5 ++
4 files changed, 138 insertions(+), 12 deletions(-)
diff --git a/policy/modules/apps/irc.fc b/policy/modules/apps/irc.fc
index 618588c..743f5cc 100644
--- a/policy/modules/apps/irc.fc
+++ b/policy/modules/apps/irc.fc
@@ -1,11 +1,18 @@
#
+# /etc
+#
+/etc/irssi\.conf -- gen_context(system_u:object_r:irc_etc_t,s0)
+
+#
# /home
#
HOME_DIR/\.ircmotd -- gen_context(system_u:object_r:ROLE_irc_home_t,s0)
+HOME_DIR/\.irssi(/.*)?
gen_context(system_u:object_r:ROLE_irc_home_t,s0)
#
# /usr
#
-/usr/bin/[st]irc -- gen_context(system_u:object_r:irc_exec_t,s0)
+/usr/bin/[st]irc -- gen_context(system_u:object_r:irc_exec_t,s0)
/usr/bin/ircII -- gen_context(system_u:object_r:irc_exec_t,s0)
-/usr/bin/tinyirc -- gen_context(system_u:object_r:irc_exec_t,s0)
+/usr/bin/irssi -- gen_context(system_u:object_r:irc_exec_t,s0)
+/usr/bin/tinyirc -- gen_context(system_u:object_r:irc_exec_t,s0)
diff --git a/policy/modules/apps/irc.if b/policy/modules/apps/irc.if
index c778244..db7c8ca 100644
--- a/policy/modules/apps/irc.if
+++ b/policy/modules/apps/irc.if
@@ -51,6 +51,7 @@ template(`irc_per_role_template',`
application_domain($1_irc_t, $1_irc_exec_t)
type $1_irc_home_t;
+ files_poly_member($1_irc_home_t)
userdom_user_home_content($1, $1_irc_home_t)
type $1_irc_tmp_t;
@@ -61,14 +62,20 @@ template(`irc_per_role_template',`
# Local policy
#
- allow $1_irc_t self:unix_stream_socket create_stream_socket_perms;
- allow $1_irc_t self:tcp_socket create_socket_perms;
- allow $1_irc_t self:udp_socket create_socket_perms;
+ allow $1_irc_t self:fifo_file rw_fifo_file_perms;
+ allow $1_irc_t self:netlink_route_socket create_netlink_socket_perms;
+ allow $1_irc_t self:process signal;
+ allow $1_irc_t self:tcp_socket { accept listen create_socket_perms };
+ allow $1_irc_t self:udp_socket { create_socket_perms };
+ allow $1_irc_t self:unix_stream_socket { create_stream_socket_perms };
+
+ allow $1_irc_t irc_etc_t:file read_file_perms;
manage_dirs_pattern($1_irc_t, $1_irc_home_t, $1_irc_home_t)
manage_files_pattern($1_irc_t, $1_irc_home_t, $1_irc_home_t)
manage_lnk_files_pattern($1_irc_t, $1_irc_home_t, $1_irc_home_t)
- userdom_user_home_dir_filetrans($1, $1_irc_t, $1_irc_home_t,{ dir file
lnk_file })
+ userdom_search_user_home_dirs($1, $1_irc_t)
+ userdom_user_home_dir_filetrans($1, $1_irc_t, $1_irc_home_t, { dir
file lnk_file })
# access files under /tmp
manage_dirs_pattern($1_irc_t, $1_irc_tmp_t, $1_irc_tmp_t)
@@ -78,6 +85,14 @@ template(`irc_per_role_template',`
manage_sock_files_pattern($1_irc_t, $1_irc_tmp_t, $1_irc_tmp_t)
files_tmp_filetrans($1_irc_t, $1_irc_tmp_t, { file dir lnk_file
sock_file fifo_file })
+ manage_dirs_pattern($2, $1_irc_home_t, $1_irc_home_t)
+ manage_files_pattern($2, $1_irc_home_t, $1_irc_home_t)
+ manage_lnk_files_pattern($2, $1_irc_home_t, $1_irc_home_t)
+
+ relabel_dirs_pattern($2, $1_irc_home_t, $1_irc_home_t)
+ relabel_files_pattern($2, $1_irc_home_t, $1_irc_home_t)
+ relabel_lnk_files_pattern($2, $1_irc_home_t, $1_irc_home_t)
+
# Transition from the user domain to the derived domain.
domtrans_pattern($2, irc_exec_t, $1_irc_t)
@@ -85,10 +100,12 @@ template(`irc_per_role_template',`
# allow ps to show irc
ps_process_pattern($2, $1_irc_t)
- allow $2 $1_irc_t:process signal;
kernel_read_proc_symlinks($1_irc_t)
+ corecmd_search_bin($1_irc_t)
+ corecmd_read_bin_symlinks($1_irc_t)
+
corenet_all_recvfrom_unlabeled($1_irc_t)
corenet_all_recvfrom_netlabel($1_irc_t)
corenet_tcp_sendrecv_generic_if($1_irc_t)
@@ -97,10 +114,10 @@ template(`irc_per_role_template',`
corenet_udp_sendrecv_all_nodes($1_irc_t)
corenet_tcp_sendrecv_all_ports($1_irc_t)
corenet_udp_sendrecv_all_ports($1_irc_t)
+ corenet_tcp_connect_ircd_port($1_irc_t)
corenet_sendrecv_ircd_client_packets($1_irc_t)
- # cjp: this seems excessive:
- corenet_tcp_connect_all_ports($1_irc_t)
- corenet_sendrecv_all_client_packets($1_irc_t)
+
+ dev_read_urand($1_irc_t)
domain_use_interactive_fds($1_irc_t)
@@ -132,19 +149,104 @@ template(`irc_per_role_template',`
# Write to the user domain tty.
userdom_use_user_terminals($1, $1_irc_t)
- tunable_policy(`use_nfs_home_dirs',`
+ tunable_policy(`irc_unrestricted_tcp_network', `
+ corenet_tcp_bind_all_unreserved_ports($1_irc_t)
+ corenet_tcp_connect_all_ports($1_irc_t)
+ corenet_sendrecv_all_client_packets($1_irc_t)
+ corenet_sendrecv_all_server_packets($1_irc_t)
+ ')
+
+ tunable_policy(`use_nfs_home_dirs', `
fs_manage_nfs_dirs($1_irc_t)
fs_manage_nfs_files($1_irc_t)
fs_manage_nfs_symlinks($1_irc_t)
')
- tunable_policy(`use_samba_home_dirs',`
+ tunable_policy(`use_samba_home_dirs', `
fs_manage_cifs_dirs($1_irc_t)
fs_manage_cifs_files($1_irc_t)
fs_manage_cifs_symlinks($1_irc_t)
')
optional_policy(`
+ automount_dontaudit_getattr_tmp_dirs($1_irc_t)
+ fs_search_auto_mountpoints($1_irc_t)
+ ')
+
+ optional_policy(`
nis_use_ypbind($1_irc_t)
')
+
+ optional_policy(`
+ nscd_read_pid($1_irc_t)
+ ')
+')
+
+########################################
+## <summary>
+## Send all signals and to user IRC Client
+## processes.
+## </summary>
+## <desc>
+## <p>
+## Allows users to send all signals to user IRC
+## client processes.
+## </p>
+## <p>
+## This is a templated interface, and should only
+## be called from a per-userdomain template.
+## </p>
+## </desc>
+## <param name="userdomain_prefix">
+## <summary>
+## The prefix of the user domain (e.g., user
+## is the prefix for user_t).
+## </summary>
+## </param>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+template(`irc_send_all_signal_user_irc', `
+ gen_require(`
+ type $1_irc_t;
+ ')
+
+ allow $2 $1_irc_t:process signal_perms;
+')
+
+########################################
+## <summary>
+## Trace user IRC Client processes.
+## </summary>
+## <desc>
+## <p>
+## Allows users to trace user IRC
+## Client processes.
+## </p>
+## <p>
+## This is a templated interface, and should only
+## be called from a per-userdomain template.
+## </p>
+## </desc>
+## <param name="userdomain_prefix">
+## <summary>
+## The prefix of the user domain (e.g., user
+## is the prefix for user_t).
+## </summary>
+## </param>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+template(`irc_ptrace_user_irc', `
+ gen_require(`
+ type $1_irc_t;
+ ')
+
+ allow $2 $1_irc_t:process ptrace;
')
diff --git a/policy/modules/apps/irc.te b/policy/modules/apps/irc.te
index 31208b6..186d98a 100644
--- a/policy/modules/apps/irc.te
+++ b/policy/modules/apps/irc.te
@@ -6,5 +6,17 @@ policy_module(irc, 1.4.0)
# Declarations
#
+## <desc>
+## <p>
+## Allow IRC clients to bind TCP sockets to all
+## unreserved ports, and to connect
+## to all TCP ports.
+## </p>
+## </desc>
+gen_tunable(irc_unrestricted_tcp_network, false)
+
type irc_exec_t;
application_executable_file(irc_exec_t)
+
+type irc_etc_t;
+files_config_file(irc_etc_t)
diff --git a/policy/modules/system/userdomain.if
b/policy/modules/system/userdomain.if
index d52771f..4accb16 100644
--- a/policy/modules/system/userdomain.if
+++ b/policy/modules/system/userdomain.if
@@ -818,6 +818,11 @@ template(`userdom_common_user_template',`
')
optional_policy(`
+ irc_send_all_signal_user_irc($1, $1_t)
+ irc_ptrace_user_irc($1, $1_t)
+ ')
+
+ optional_policy(`
locate_read_lib_files($1_t)
')
--
1.5.5.2
From 9238a13b7bbc431798f6a41d30c5c684bf5b9780 Mon Sep 17 00:00:00 2001
From: Dominick Grift <domg472@gmail.com>
Date: Fri, 25 Jul 2008 13:35:06 +0200
Subject: [PATCH] Irc can send sigchld to user domain.
Signed-off-by: Dominick Grift <domg472@gmail.com>
---
policy/modules/apps/irc.if | 2 ++
1 files changed, 2 insertions(+), 0 deletions(-)
diff --git a/policy/modules/apps/irc.if b/policy/modules/apps/irc.if
index db7c8ca..c913a9d 100644
--- a/policy/modules/apps/irc.if
+++ b/policy/modules/apps/irc.if
@@ -69,6 +69,8 @@ template(`irc_per_role_template',`
allow $1_irc_t self:udp_socket { create_socket_perms };
allow $1_irc_t self:unix_stream_socket { create_stream_socket_perms };
+ allow $1_irc_t $2:process sigchld;
+
allow $1_irc_t irc_etc_t:file read_file_perms;
manage_dirs_pattern($1_irc_t, $1_irc_home_t, $1_irc_home_t)
--
1.5.5.2
--
Dominick Grift <domg472@gmail.com>
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 197 bytes --]
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2008-07-25 11:41 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2008-07-25 11:41 [refpolicy patch] latest try: merge irssi policy with irc module Dominick Grift
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.