* [PATCH 1/2] Reference policy: NetLabel policy additions
2006-10-11 21:29 [PATCH 0/2] NetLabel policy additions for the reference policy paul.moore
@ 2006-10-11 21:29 ` paul.moore
2006-10-12 14:49 ` Christopher J. PeBenito
2006-10-11 21:30 ` [PATCH 2/2] Reference policy: Restrict NetLabel to same MLS label connections by default paul.moore
1 sibling, 1 reply; 5+ messages in thread
From: paul.moore @ 2006-10-11 21:29 UTC (permalink / raw)
To: selinux
This patch adds basic NetLabel support to the reference policy.
---
refpolicy/policy/modules/kernel/corenetwork.if.in | 58 ++++++++++++
refpolicy/policy/modules/kernel/kernel.if | 102 ++++++++++++++++++++++
refpolicy/policy/modules/system/netlabel.fc | 7 +
refpolicy/policy/modules/system/netlabel.if | 58 ++++++++++++
refpolicy/policy/modules/system/netlabel.te | 34 +++++++
refpolicy/policy/modules/system/userdomain.if | 2
refpolicy/policy/modules/system/userdomain.te | 2
7 files changed, 263 insertions(+)
Index: refpolicy.lblnet/refpolicy/policy/modules/kernel/corenetwork.if.in
===================================================================
--- refpolicy.lblnet.orig/refpolicy/policy/modules/kernel/corenetwork.if.in
+++ refpolicy.lblnet/refpolicy/policy/modules/kernel/corenetwork.if.in
@@ -1436,6 +1436,64 @@ interface(`corenet_dontaudit_non_ipsec_s
########################################
## <summary>
+## Receive TCP packets from a NetLabel connection.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`corenet_tcp_recv_netlabel',`
+ kernel_tcp_recv_netlabel($1)
+')
+
+########################################
+## <summary>
+## Do not audit attempts to receive TCP packets from a NetLabel
+## connection.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain to not audit.
+## </summary>
+## </param>
+#
+interface(`corenet_dontaudit_tcp_recv_netlabel',`
+ kernel_dontaudit_tcp_recv_netlabel($1)
+')
+
+########################################
+## <summary>
+## Receive UDP packets from a NetLabel connection.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`corenet_udp_recv_netlabel',`
+ kernel_udp_recv_netlabel($1)
+')
+
+########################################
+## <summary>
+## Do not audit attempts to receive UDP packets from a NetLabel
+## connection.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain to not audit.
+## </summary>
+## </param>
+#
+interface(`corenet_dontaudit_udp_recv_netlabel',`
+ kernel_dontaudit_udp_recv_netlabel($1)
+')
+
+########################################
+## <summary>
## Send generic client packets.
## </summary>
## <param name="domain">
Index: refpolicy.lblnet/refpolicy/policy/modules/kernel/kernel.if
===================================================================
--- refpolicy.lblnet.orig/refpolicy/policy/modules/kernel/kernel.if
+++ refpolicy.lblnet/refpolicy/policy/modules/kernel/kernel.if
@@ -2205,6 +2205,108 @@ interface(`kernel_dontaudit_sendrecv_unl
########################################
## <summary>
+## Receive TCP packets from a NetLabel connection.
+## </summary>
+## <desc>
+## <p>
+## Receive TCP packets from a NetLabel connection, NetLabel is an
+## explicit packet labeling framework which implements CIPSO and
+## similar protocols.
+## </p>
+## </desc>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`kernel_dontaudit_tcp_recv_netlabel',`
+ gen_require(`
+ type unlabeled_t;
+ ')
+
+ allow $1 unlabeled_t:tcp_socket recvfrom;
+')
+
+########################################
+## <summary>
+## Do not audit attempts to receive TCP packets from a NetLabel
+## connection.
+## </summary>
+## <desc>
+## <p>
+## Do not audit attempts to receive TCP packets from a NetLabel
+## connection. NetLabel is an explicit packet labeling framework
+## which implements CIPSO and similar protocols.
+## </p>
+## </desc>
+## <param name="domain">
+## <summary>
+## Domain to not audit.
+## </summary>
+## </param>
+#
+interface(`kernel_tcp_recv_netlabel',`
+ gen_require(`
+ type unlabeled_t;
+ ')
+
+ dontaudit $1 unlabeled_t:tcp_socket recvfrom;
+')
+
+########################################
+## <summary>
+## Receive UDP packets from a NetLabel connection.
+## </summary>
+## <desc>
+## <p>
+## Receive UDP packets from a NetLabel connection, NetLabel is an
+## explicit packet labeling framework which implements CIPSO and
+## similar protocols.
+## </p>
+## </desc>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`kernel_udp_recv_netlabel',`
+ gen_require(`
+ type unlabeled_t;
+ ')
+
+ allow $1 unlabeled_t:udp_socket recvfrom;
+')
+
+########################################
+## <summary>
+## Do not audit attempts to receive UDP packets from a NetLabel
+## connection.
+## </summary>
+## <desc>
+## <p>
+## Do not audit attempts to receive UDP packets from a NetLabel
+## connection. NetLabel is an explicit packet labeling framework
+## which implements CIPSO and similar protocols.
+## </p>
+## </desc>
+## <param name="domain">
+## <summary>
+## Domain to not audit.
+## </summary>
+## </param>
+#
+interface(`kernel_dontaudit_udp_recv_netlabel',`
+ gen_require(`
+ type unlabeled_t;
+ ')
+
+ dontaudit $1 unlabeled_t:udp_socket recvfrom;
+')
+
+########################################
+## <summary>
## Send and receive unlabeled packets.
## </summary>
## <desc>
Index: refpolicy.lblnet/refpolicy/policy/modules/system/netlabel.fc
===================================================================
--- /dev/null
+++ refpolicy.lblnet/refpolicy/policy/modules/system/netlabel.fc
@@ -0,0 +1,7 @@
+
+########################################
+#
+# netlabel file contexts
+#
+
+/sbin/netlabelctl -- gen_context(system_u:object_r:netlabel_mgmt_exec_t,s0)
Index: refpolicy.lblnet/refpolicy/policy/modules/system/netlabel.if
===================================================================
--- /dev/null
+++ refpolicy.lblnet/refpolicy/policy/modules/system/netlabel.if
@@ -0,0 +1,58 @@
+## <summary>NetLabel packet labeling</summary>
+
+########################################
+## <summary>
+## Execute netlabel_mgmt in the netlabel_mgmt domain.
+## </summary>
+## <param name="domain">
+## <summary>
+## The type of the process performing this action.
+## </summary>
+## </param>
+#
+interface(`netlabel_domtrans_mgmt',`
+ gen_require(`
+ type netlabel_mgmt_t, netlabel_mgmt_exec_t;
+ ')
+
+ corecmd_search_sbin($1)
+ domain_auto_trans($1,netlabel_mgmt_exec_t,netlabel_mgmt_t)
+
+ allow $1 netlabel_mgmt_t:fd use;
+ allow netlabel_mgmt_t $1:fd use;
+ allow netlabel_mgmt_t $1:fifo_file rw_file_perms;
+ allow netlabel_mgmt_t $1:process sigchld;
+')
+
+########################################
+## <summary>
+## Execute netlabel_mgmt in the netlabel_mgmt domain, and
+## allow the specified role the netlabel_mgmt domain.
+## </summary>
+## <param name="domain">
+## <summary>
+## The type of the process performing this action.
+## </summary>
+## </param>
+## <param name="role">
+## <summary>
+## The role to be allowed the netlabel_mgmt domain.
+## </summary>
+## </param>
+## <param name="terminal">
+## <summary>
+## The type of the terminal allow the netlabel_mgmt domain to use.
+## </summary>
+## </param>
+## <rolecap/>
+#
+interface(`netlabel_run_mgmt',`
+ gen_require(`
+ type netlabel_mgmt_t;
+ ')
+
+ corecmd_search_sbin($1)
+ netlabel_domtrans_mgmt($1)
+ role $2 types netlabel_mgmt_t;
+ allow netlabel_mgmt_t $3:chr_file rw_term_perms;
+')
Index: refpolicy.lblnet/refpolicy/policy/modules/system/netlabel.te
===================================================================
--- /dev/null
+++ refpolicy.lblnet/refpolicy/policy/modules/system/netlabel.te
@@ -0,0 +1,34 @@
+
+policy_module(netlabel,1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type netlabel_mgmt_t;
+type netlabel_mgmt_exec_t;
+
+domain_type(netlabel_mgmt_t)
+domain_entry_file(netlabel_mgmt_t,netlabel_mgmt_exec_t)
+
+########################################
+#
+# NetLabel Management Tools Local policy
+#
+
+# allow access to newrole fds
+seutil_use_newrole_fds(netlabel_mgmt_t)
+
+# allow access to shared libraries
+libs_use_ld_so(netlabel_mgmt_t)
+libs_use_shared_libs(netlabel_mgmt_t)
+
+# allow read access to network state
+kernel_read_network_state(netlabel_mgmt_t)
+
+# allow communication with kernel subsystem
+allow netlabel_mgmt_t self:netlink_socket create_socket_perms;
+
+# allow CAP_NET_ADMIN to modify the kernel subsystem configuration
+allow netlabel_mgmt_t self:capability net_admin;
Index: refpolicy.lblnet/refpolicy/policy/modules/system/userdomain.if
===================================================================
--- refpolicy.lblnet.orig/refpolicy/policy/modules/system/userdomain.if
+++ refpolicy.lblnet/refpolicy/policy/modules/system/userdomain.if
@@ -512,6 +512,8 @@ template(`userdom_basic_networking_templ
corenet_udp_sendrecv_all_nodes($1_t)
corenet_tcp_sendrecv_all_ports($1_t)
corenet_udp_sendrecv_all_ports($1_t)
+ corenet_tcp_recv_netlabel($1_t)
+ corenet_udp_recv_netlabel($1_t)
corenet_tcp_connect_all_ports($1_t)
corenet_sendrecv_all_client_packets($1_t)
')
Index: refpolicy.lblnet/refpolicy/policy/modules/system/userdomain.te
===================================================================
--- refpolicy.lblnet.orig/refpolicy/policy/modules/system/userdomain.te
+++ refpolicy.lblnet/refpolicy/policy/modules/system/userdomain.te
@@ -155,10 +155,12 @@ ifdef(`strict_policy',`
logging_read_generic_logs(secadm_t)
userdom_dontaudit_append_staff_home_content_files(secadm_t)
userdom_dontaudit_read_sysadm_home_content_files(secadm_t)
+ netlabel_run_mgmt(secadm_t,secadm_r, { secadm_tty_device_t secadm_devpts_t })
',`
logging_manage_audit_log(sysadm_t)
logging_manage_audit_config(sysadm_t)
logging_run_auditctl(sysadm_t,sysadm_r,admin_terminal)
+ netlabel_run_mgmt(sysadm_t,sysadm_r,admin_terminal)
')
tunable_policy(`allow_ptrace',`
--
paul moore
linux security @ hp
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 5+ messages in thread* [PATCH 2/2] Reference policy: Restrict NetLabel to same MLS label connections by default
2006-10-11 21:29 [PATCH 0/2] NetLabel policy additions for the reference policy paul.moore
2006-10-11 21:29 ` [PATCH 1/2] Reference policy: NetLabel policy additions paul.moore
@ 2006-10-11 21:30 ` paul.moore
1 sibling, 0 replies; 5+ messages in thread
From: paul.moore @ 2006-10-11 21:30 UTC (permalink / raw)
To: selinux
This patch adjusts the {tcp,udp}_socket recvfrom permissions to only allow
same MLS label connections.
---
refpolicy/policy/mls | 8 +++++++-
1 files changed, 7 insertions(+), 1 deletion(-)
Index: refpolicy.lblnet/refpolicy/policy/mls
===================================================================
--- refpolicy.lblnet.orig/refpolicy/policy/mls
+++ refpolicy.lblnet/refpolicy/policy/mls
@@ -165,7 +165,7 @@ mlsconstrain { socket tcp_socket udp_soc
( h1 dom h2 );
# the socket "read" ops (note the check is dominance of the low level)
-mlsconstrain { socket tcp_socket udp_socket rawip_socket netlink_socket packet_socket key_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_ip6fw_socket netlink_dnrt_socket } { read getattr listen accept getopt recvfrom recv_msg }
+mlsconstrain { socket tcp_socket udp_socket rawip_socket netlink_socket packet_socket key_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_ip6fw_socket netlink_dnrt_socket } { read getattr listen accept getopt recv_msg }
(( l1 dom l2 ) or
(( t1 == mlsnetreadtoclr ) and ( h1 dom l2 )) or
( t1 == mlsnetread ));
@@ -181,6 +181,12 @@ mlsconstrain { socket tcp_socket udp_soc
(( t1 == mlsnetwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
( t1 == mlsnetwrite ));
+# used by netlabel to restrict normal domains to same level connections
+mlsconstrain { tcp_socket udp_socket } recvfrom
+ (( l1 eq l2 ) or
+ (( t1 == mlsnetreadtoclr ) and ( h1 dom l2 )) or
+ ( t1 == mlsnetread ));
+
# these access vectors have no MLS restrictions
# { socket tcp_socket udp_socket rawip_socket netlink_socket packet_socket key_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_ip6fw_socket netlink_dnrt_socket } { ioctl create lock append bind sendto send_msg name_bind }
#
--
paul moore
linux security @ hp
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 5+ messages in thread