* Hal changes.
@ 2007-03-08 15:06 Daniel J Walsh
2007-03-26 14:22 ` Christopher J. PeBenito
0 siblings, 1 reply; 2+ messages in thread
From: Daniel J Walsh @ 2007-03-08 15:06 UTC (permalink / raw)
To: Christopher J. PeBenito, SE Linux
[-- Attachment #1: Type: text/plain, Size: 160 bytes --]
Beginning to break out hal policy into it's helper apps. So hald_mac is
the only domain that needs to write to /dev/shm and hald_acl needs
dac overrides.
[-- Attachment #2: nsaserefpolicy_policy_modules_services_hal.patch --]
[-- Type: text/x-patch, Size: 4969 bytes --]
--- nsaserefpolicy/policy/modules/services/hal.fc 2007-01-02 12:57:43.000000000 -0500
+++ serefpolicy-2.5.8/policy/modules/services/hal.fc 2007-03-08 08:42:37.000000000 -0500
@@ -8,4 +8,10 @@
/var/lib/hal(/.*)? gen_context(system_u:object_r:hald_var_lib_t,s0)
+/var/cache/hald(/.*)? gen_context(system_u:object_r:hald_cache_t,s0)
+
/var/run/haldaemon.pid -- gen_context(system_u:object_r:hald_var_run_t,s0)
+
+/usr/libexec/hal-acl-tool -- gen_context(system_u:object_r:hald_acl_exec_t,s0)
+
+/usr/libexec/hald-addon-macbookpro-backlight -- gen_context(system_u:object_r:hald_mac_exec_t,s0)
--- nsaserefpolicy/policy/modules/services/hal.te 2007-02-19 11:32:53.000000000 -0500
+++ serefpolicy-2.5.8/policy/modules/services/hal.te 2007-03-08 08:42:37.000000000 -0500
@@ -16,9 +16,24 @@
type hald_var_run_t;
files_pid_file(hald_var_run_t)
+type hald_cache_t;
+files_pid_file(hald_cache_t)
+
type hald_var_lib_t;
files_type(hald_var_lib_t)
+type hald_acl_t;
+type hald_acl_exec_t;
+domain_type(hald_acl_t)
+domain_entry_file(hald_acl_t,hald_acl_exec_t)
+role system_r types hald_acl_t;
+
+type hald_mac_t;
+type hald_mac_exec_t;
+domain_type(hald_mac_t)
+domain_entry_file(hald_mac_t,hald_mac_exec_t)
+role system_r types hald_mac_t;
+
########################################
#
# Local policy
@@ -26,7 +41,7 @@
# execute openvt which needs setuid
allow hald_t self:capability { chown setuid setgid kill net_admin sys_admin sys_nice dac_override dac_read_search mknod sys_rawio sys_tty_config };
-dontaudit hald_t self:capability sys_tty_config;
+dontaudit hald_t self:capability {sys_ptrace sys_tty_config };
allow hald_t self:process signal_perms;
allow hald_t self:fifo_file rw_fifo_file_perms;
allow hald_t self:unix_stream_socket { create_stream_socket_perms connectto };
@@ -51,11 +66,13 @@
manage_files_pattern(hald_t,hald_var_run_t,hald_var_run_t)
files_pid_filetrans(hald_t,hald_var_run_t,file)
+manage_files_pattern(hald_t,hald_cache_t,hald_cache_t)
+
kernel_read_system_state(hald_t)
kernel_read_network_state(hald_t)
kernel_read_kernel_sysctls(hald_t)
kernel_read_fs_sysctls(hald_t)
-kernel_read_irq_sysctls(hald_t)
+kernel_rw_irq_sysctls(hald_t)
kernel_rw_vm_sysctls(hald_t)
kernel_write_proc_files(hald_t)
@@ -85,9 +102,13 @@
dev_rw_power_management(hald_t)
# hal is now execing pm-suspend
dev_rw_sysfs(hald_t)
+dev_read_sound(hald_t)
+dev_write_sound(hald_t)
+dev_read_raw_memory(hald_t)
domain_use_interactive_fds(hald_t)
domain_read_all_domains_state(hald_t)
+domain_dontaudit_ptrace_all_domains(hald_t)
files_exec_etc_files(hald_t)
files_read_etc_files(hald_t)
@@ -101,6 +122,7 @@
files_create_boot_flag(hald_t)
files_getattr_all_dirs(hald_t)
files_read_kernel_img(hald_t)
+files_rw_lock_dirs(hald_t)
fs_getattr_all_fs(hald_t)
fs_search_all(hald_t)
@@ -130,10 +152,10 @@
init_use_fds(hald_t)
init_use_script_ptys(hald_t)
init_domtrans_script(hald_t)
-init_write_initctl(hald_t)
init_read_utmp(hald_t)
#hal runs shutdown, probably need a shutdown domain
init_rw_utmp(hald_t)
+init_telinit(hald_t)
libs_use_ld_so(hald_t)
libs_use_shared_libs(hald_t)
@@ -248,3 +270,68 @@
optional_policy(`
vbetool_domtrans(hald_t)
')
+
+########################################
+#
+# Local hald acl policy
+#
+
+allow hald_acl_t self:capability { dac_override fowner };
+allow hald_acl_t self : fifo_file read_fifo_file_perms;
+
+domtrans_pattern(hald_t, hald_acl_exec_t, hald_acl_t)
+allow hald_t hald_acl_t : process signal;
+allow hald_acl_t hald_t : unix_stream_socket connectto;
+manage_dirs_pattern(hald_acl_t,hald_var_lib_t,hald_var_lib_t)
+manage_files_pattern(hald_acl_t,hald_var_lib_t,hald_var_lib_t)
+
+corecmd_exec_bin(hald_acl_t)
+corecmd_search_sbin(hald_acl_t)
+
+dev_setattr_video_dev(hald_acl_t)
+dev_getattr_sound_dev(hald_acl_t)
+dev_setattr_sound_dev(hald_acl_t)
+
+libs_use_ld_so(hald_acl_t)
+libs_use_shared_libs(hald_acl_t)
+
+files_search_var_lib(hald_acl_t)
+files_read_usr_files(hald_acl_t)
+files_read_etc_files(hald_acl_t)
+
+storage_getattr_removable_dev(hald_acl_t)
+storage_setattr_removable_dev(hald_acl_t)
+
+miscfiles_read_localization(hald_acl_t)
+
+ifdef(`targeted_policy',`
+ term_dontaudit_use_console(hald_acl_t)
+ term_dontaudit_use_generic_ptys(hald_acl_t)
+')
+
+########################################
+#
+# Local hald mac policy
+#
+
+domtrans_pattern(hald_t, hald_mac_exec_t, hald_mac_t)
+allow hald_t hald_mac_t : process signal;
+allow hald_mac_t hald_t : unix_stream_socket connectto;
+
+files_search_var_lib(hald_mac_t)
+manage_dirs_pattern(hald_mac_t,hald_var_lib_t,hald_var_lib_t)
+manage_files_pattern(hald_mac_t,hald_var_lib_t,hald_var_lib_t)
+
+libs_use_ld_so(hald_mac_t)
+libs_use_shared_libs(hald_mac_t)
+
+files_read_usr_files(hald_mac_t)
+
+dev_write_raw_memory(hald_mac_t)
+
+miscfiles_read_localization(hald_mac_t)
+
+ifdef(`targeted_policy',`
+ term_dontaudit_use_console(hald_mac_t)
+ term_dontaudit_use_generic_ptys(hald_mac_t)
+')
^ permalink raw reply [flat|nested] 2+ messages in thread* Re: Hal changes.
2007-03-08 15:06 Hal changes Daniel J Walsh
@ 2007-03-26 14:22 ` Christopher J. PeBenito
0 siblings, 0 replies; 2+ messages in thread
From: Christopher J. PeBenito @ 2007-03-26 14:22 UTC (permalink / raw)
To: Daniel J Walsh; +Cc: SE Linux
On Thu, 2007-03-08 at 10:06 -0500, Daniel J Walsh wrote:
> Beginning to break out hal policy into it's helper apps. So hald_mac is
> the only domain that needs to write to /dev/shm and hald_acl needs
> dac overrides.
Well this is a welcome sight. How much testing has this received? I'm
hoping that the read of /dev/mem thats still in hald_t can be split out
too.
>
>
>
>
>
> differences
> between files
> attachment
> (nsaserefpolicy_policy_modules_services_hal.patch)
>
> --- nsaserefpolicy/policy/modules/services/hal.fc 2007-01-02 12:57:43.000000000 -0500
> +++ serefpolicy-2.5.8/policy/modules/services/hal.fc 2007-03-08 08:42:37.000000000 -0500
> @@ -8,4 +8,10 @@
>
> /var/lib/hal(/.*)? gen_context(system_u:object_r:hald_var_lib_t,s0)
>
> +/var/cache/hald(/.*)? gen_context(system_u:object_r:hald_cache_t,s0)
> +
> /var/run/haldaemon.pid -- gen_context(system_u:object_r:hald_var_run_t,s0)
> +
> +/usr/libexec/hal-acl-tool -- gen_context(system_u:object_r:hald_acl_exec_t,s0)
> +
> +/usr/libexec/hald-addon-macbookpro-backlight -- gen_context(system_u:object_r:hald_mac_exec_t,s0)
> --- nsaserefpolicy/policy/modules/services/hal.te 2007-02-19 11:32:53.000000000 -0500
> +++ serefpolicy-2.5.8/policy/modules/services/hal.te 2007-03-08 08:42:37.000000000 -0500
> @@ -16,9 +16,24 @@
> type hald_var_run_t;
> files_pid_file(hald_var_run_t)
>
> +type hald_cache_t;
> +files_pid_file(hald_cache_t)
> +
> type hald_var_lib_t;
> files_type(hald_var_lib_t)
>
> +type hald_acl_t;
> +type hald_acl_exec_t;
> +domain_type(hald_acl_t)
> +domain_entry_file(hald_acl_t,hald_acl_exec_t)
> +role system_r types hald_acl_t;
> +
> +type hald_mac_t;
> +type hald_mac_exec_t;
> +domain_type(hald_mac_t)
> +domain_entry_file(hald_mac_t,hald_mac_exec_t)
> +role system_r types hald_mac_t;
> +
> ########################################
> #
> # Local policy
> @@ -26,7 +41,7 @@
>
> # execute openvt which needs setuid
> allow hald_t self:capability { chown setuid setgid kill net_admin sys_admin sys_nice dac_override dac_read_search mknod sys_rawio sys_tty_config };
> -dontaudit hald_t self:capability sys_tty_config;
> +dontaudit hald_t self:capability {sys_ptrace sys_tty_config };
> allow hald_t self:process signal_perms;
> allow hald_t self:fifo_file rw_fifo_file_perms;
> allow hald_t self:unix_stream_socket { create_stream_socket_perms connectto };
> @@ -51,11 +66,13 @@
> manage_files_pattern(hald_t,hald_var_run_t,hald_var_run_t)
> files_pid_filetrans(hald_t,hald_var_run_t,file)
>
> +manage_files_pattern(hald_t,hald_cache_t,hald_cache_t)
> +
> kernel_read_system_state(hald_t)
> kernel_read_network_state(hald_t)
> kernel_read_kernel_sysctls(hald_t)
> kernel_read_fs_sysctls(hald_t)
> -kernel_read_irq_sysctls(hald_t)
> +kernel_rw_irq_sysctls(hald_t)
> kernel_rw_vm_sysctls(hald_t)
> kernel_write_proc_files(hald_t)
>
> @@ -85,9 +102,13 @@
> dev_rw_power_management(hald_t)
> # hal is now execing pm-suspend
> dev_rw_sysfs(hald_t)
> +dev_read_sound(hald_t)
> +dev_write_sound(hald_t)
> +dev_read_raw_memory(hald_t)
>
> domain_use_interactive_fds(hald_t)
> domain_read_all_domains_state(hald_t)
> +domain_dontaudit_ptrace_all_domains(hald_t)
>
> files_exec_etc_files(hald_t)
> files_read_etc_files(hald_t)
> @@ -101,6 +122,7 @@
> files_create_boot_flag(hald_t)
> files_getattr_all_dirs(hald_t)
> files_read_kernel_img(hald_t)
> +files_rw_lock_dirs(hald_t)
>
> fs_getattr_all_fs(hald_t)
> fs_search_all(hald_t)
> @@ -130,10 +152,10 @@
> init_use_fds(hald_t)
> init_use_script_ptys(hald_t)
> init_domtrans_script(hald_t)
> -init_write_initctl(hald_t)
> init_read_utmp(hald_t)
> #hal runs shutdown, probably need a shutdown domain
> init_rw_utmp(hald_t)
> +init_telinit(hald_t)
>
> libs_use_ld_so(hald_t)
> libs_use_shared_libs(hald_t)
> @@ -248,3 +270,68 @@
> optional_policy(`
> vbetool_domtrans(hald_t)
> ')
> +
> +########################################
> +#
> +# Local hald acl policy
> +#
> +
> +allow hald_acl_t self:capability { dac_override fowner };
> +allow hald_acl_t self : fifo_file read_fifo_file_perms;
> +
> +domtrans_pattern(hald_t, hald_acl_exec_t, hald_acl_t)
> +allow hald_t hald_acl_t : process signal;
> +allow hald_acl_t hald_t : unix_stream_socket connectto;
> +manage_dirs_pattern(hald_acl_t,hald_var_lib_t,hald_var_lib_t)
> +manage_files_pattern(hald_acl_t,hald_var_lib_t,hald_var_lib_t)
> +
> +corecmd_exec_bin(hald_acl_t)
> +corecmd_search_sbin(hald_acl_t)
> +
> +dev_setattr_video_dev(hald_acl_t)
> +dev_getattr_sound_dev(hald_acl_t)
> +dev_setattr_sound_dev(hald_acl_t)
> +
> +libs_use_ld_so(hald_acl_t)
> +libs_use_shared_libs(hald_acl_t)
> +
> +files_search_var_lib(hald_acl_t)
> +files_read_usr_files(hald_acl_t)
> +files_read_etc_files(hald_acl_t)
> +
> +storage_getattr_removable_dev(hald_acl_t)
> +storage_setattr_removable_dev(hald_acl_t)
> +
> +miscfiles_read_localization(hald_acl_t)
> +
> +ifdef(`targeted_policy',`
> + term_dontaudit_use_console(hald_acl_t)
> + term_dontaudit_use_generic_ptys(hald_acl_t)
> +')
> +
> +########################################
> +#
> +# Local hald mac policy
> +#
> +
> +domtrans_pattern(hald_t, hald_mac_exec_t, hald_mac_t)
> +allow hald_t hald_mac_t : process signal;
> +allow hald_mac_t hald_t : unix_stream_socket connectto;
> +
> +files_search_var_lib(hald_mac_t)
> +manage_dirs_pattern(hald_mac_t,hald_var_lib_t,hald_var_lib_t)
> +manage_files_pattern(hald_mac_t,hald_var_lib_t,hald_var_lib_t)
> +
> +libs_use_ld_so(hald_mac_t)
> +libs_use_shared_libs(hald_mac_t)
> +
> +files_read_usr_files(hald_mac_t)
> +
> +dev_write_raw_memory(hald_mac_t)
> +
> +miscfiles_read_localization(hald_mac_t)
> +
> +ifdef(`targeted_policy',`
> + term_dontaudit_use_console(hald_mac_t)
> + term_dontaudit_use_generic_ptys(hald_mac_t)
> +')
--
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2007-03-26 14:21 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2007-03-08 15:06 Hal changes Daniel J Walsh
2007-03-26 14:22 ` Christopher J. PeBenito
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.