Subject: [PATCH] refpolicy: services_hal changes --text follows this line-- --- nsaserefpolicy/policy/modules/services/hal.fc 2007-11-14 08:17:58.000000000 -0500 +++ serefpolicy-3.4.1/policy/modules/services/hal.fc 2008-05-27 07:34:21.000000000 -0400 @@ -8,6 +8,7 @@ /usr/libexec/hal-hotplug-map -- gen_context(system_u:object_r:hald_exec_t,s0) /usr/libexec/hal-system-sonypic -- gen_context(system_u:object_r:hald_sonypic_exec_t,s0) /usr/libexec/hald-addon-macbookpro-backlight -- gen_context(system_u:object_r:hald_mac_exec_t,s0) +/usr/libexec/hald-addon-macbook-backlight -- gen_context(system_u:object_r:hald_mac_exec_t,s0) /usr/sbin/hald -- gen_context(system_u:object_r:hald_exec_t,s0) @@ -16,10 +17,13 @@ /var/lib/hal(/.*)? gen_context(system_u:object_r:hald_var_lib_t,s0) /var/log/pm-suspend\.log gen_context(system_u:object_r:hald_log_t,s0) +/var/log/pm(/.*)? gen_context(system_u:object_r:hald_log_t,s0) +/var/run/pm(/.*)? gen_context(system_u:object_r:hald_var_run_t,s0) +/var/run/pm-utils(/.*)? gen_context(system_u:object_r:hald_var_run_t,s0) +/var/run/hald(/.*)? gen_context(system_u:object_r:hald_var_run_t,s0) /var/run/haldaemon\.pid -- gen_context(system_u:object_r:hald_var_run_t,s0) -/var/run/vbestate -- gen_context(system_u:object_r:hald_var_run_t,s0) - +/var/run/vbe.* -- gen_context(system_u:object_r:hald_var_run_t,s0) ifdef(`distro_gentoo',` /var/lib/cache/hald(/.*)? gen_context(system_u:object_r:hald_cache_t,s0) ') --- nsaserefpolicy/policy/modules/services/hal.if 2008-05-09 11:59:10.000000000 -0400 +++ serefpolicy-3.4.1/policy/modules/services/hal.if 2008-05-27 07:34:21.000000000 -0400 @@ -195,7 +195,7 @@ ## ## ## -## Domain allowed access. +## Domain to not audit ## ## # @@ -302,3 +302,42 @@ files_search_pids($1) allow $1 hald_var_run_t:file rw_file_perms; ') + +######################################## +## +## Send a SIGCHLD signal to hal. +## +## +## +## Domain allowed access. +## +## +# +interface(`hal_getattr',` + gen_require(` + type hald_t; + ') + + allow $1 hald_t:process getattr; +') + +######################################## +## +##f Read hal system state +## +## +## +## Domain to not audit. +## +## +# +interface(`hal_read_state',` + gen_require(` + type hald_t; + ') + kernel_search_proc($1) + allow $1 hald_t:dir list_dir_perms; + read_files_pattern($1,hald_t,hald_t) + read_lnk_files_pattern($1,hald_t,hald_t) + dontaudit $1 hald_t:process ptrace; +') --- nsaserefpolicy/policy/modules/services/hal.te 2008-05-09 11:59:10.000000000 -0400 +++ serefpolicy-3.4.1/policy/modules/services/hal.te 2008-05-27 07:45:46.000000000 -0400 @@ -49,6 +49,9 @@ type hald_var_lib_t; files_type(hald_var_lib_t) +typealias hald_log_t alias pmtools_log_t; +typealias hald_var_run_t alias pmtools_var_run_t; + ######################################## # # Local policy @@ -57,7 +60,7 @@ # execute openvt which needs setuid allow hald_t self:capability { chown setuid setgid kill net_admin sys_admin sys_nice dac_override dac_read_search mknod sys_rawio sys_tty_config }; dontaudit hald_t self:capability {sys_ptrace sys_tty_config }; -allow hald_t self:process signal_perms; +allow hald_t self:process { getattr signal_perms }; allow hald_t self:fifo_file rw_fifo_file_perms; allow hald_t self:unix_stream_socket { create_stream_socket_perms connectto }; allow hald_t self:unix_dgram_socket create_socket_perms; @@ -70,7 +73,7 @@ manage_files_pattern(hald_t,hald_cache_t,hald_cache_t) # log files for hald -allow hald_t hald_log_t:file manage_file_perms; +manage_files_pattern(hald_t, hald_log_t, hald_log_t) logging_log_filetrans(hald_t,hald_log_t,file) manage_dirs_pattern(hald_t,hald_tmp_t,hald_tmp_t) @@ -82,8 +85,9 @@ manage_files_pattern(hald_t,hald_var_lib_t,hald_var_lib_t) manage_sock_files_pattern(hald_t,hald_var_lib_t,hald_var_lib_t) +manage_dirs_pattern(hald_t,hald_var_run_t,hald_var_run_t) manage_files_pattern(hald_t,hald_var_run_t,hald_var_run_t) -files_pid_filetrans(hald_t,hald_var_run_t,file) +files_pid_filetrans(hald_t,hald_var_run_t,{ dir file }) kernel_read_system_state(hald_t) kernel_read_network_state(hald_t) @@ -93,6 +97,7 @@ kernel_rw_irq_sysctls(hald_t) kernel_rw_vm_sysctls(hald_t) kernel_write_proc_files(hald_t) +kernel_setsched(hald_t) auth_read_pam_console_data(hald_t) @@ -121,6 +126,7 @@ dev_rw_power_management(hald_t) # hal is now execing pm-suspend dev_rw_sysfs(hald_t) +dev_read_video_dev(hald_t) domain_use_interactive_fds(hald_t) domain_read_all_domains_state(hald_t) @@ -155,6 +161,8 @@ selinux_compute_relabel_context(hald_t) selinux_compute_user_contexts(hald_t) +dev_read_raw_memory(hald_t) + storage_raw_read_removable_device(hald_t) storage_raw_write_removable_device(hald_t) storage_raw_read_fixed_disk(hald_t) @@ -172,6 +180,8 @@ init_rw_utmp(hald_t) init_telinit(hald_t) +fstools_getattr_swap_files(hald_t) + libs_use_ld_so(hald_t) libs_use_shared_libs(hald_t) libs_exec_ld_so(hald_t) @@ -245,6 +255,10 @@ ') optional_policy(` + gpm_dontaudit_getattr_gpmctl(hald_t) +') + +optional_policy(` hotplug_read_config(hald_t) ') @@ -266,6 +280,15 @@ ') optional_policy(` + podsleuth_domtrans(hald_t) +') + +optional_policy(` + polkit_domtrans_auth(hald_t) + polkit_read_lib(hald_t) +') + +optional_policy(` rpc_search_nfs_state_data(hald_t) ') @@ -292,7 +315,8 @@ # allow hald_acl_t self:capability { dac_override fowner }; -allow hald_acl_t self:fifo_file read_fifo_file_perms; +allow hald_acl_t self:process { getattr signal }; +allow hald_acl_t self:fifo_file rw_fifo_file_perms; domtrans_pattern(hald_t, hald_acl_exec_t, hald_acl_t) allow hald_t hald_acl_t:process signal; @@ -302,9 +326,14 @@ manage_files_pattern(hald_acl_t,hald_var_lib_t,hald_var_lib_t) files_search_var_lib(hald_acl_t) +manage_dirs_pattern(hald_acl_t,hald_var_run_t,hald_var_run_t) +manage_files_pattern(hald_acl_t,hald_var_run_t,hald_var_run_t) +files_pid_filetrans(hald_acl_t,hald_var_run_t,{ dir file }) + corecmd_exec_bin(hald_acl_t) dev_getattr_all_chr_files(hald_acl_t) +dev_setattr_all_chr_files(hald_acl_t) dev_getattr_generic_usb_dev(hald_acl_t) dev_getattr_video_dev(hald_acl_t) dev_setattr_video_dev(hald_acl_t) @@ -326,6 +355,11 @@ miscfiles_read_localization(hald_acl_t) +optional_policy(` + polkit_domtrans_auth(hald_acl_t) + polkit_read_lib(hald_acl_t) +') + ######################################## # # Local hald mac policy @@ -339,10 +373,14 @@ manage_files_pattern(hald_mac_t,hald_var_lib_t,hald_var_lib_t) files_search_var_lib(hald_mac_t) +dev_read_raw_memory(hald_mac_t) dev_write_raw_memory(hald_mac_t) +dev_read_sysfs(hald_mac_t) files_read_usr_files(hald_mac_t) +kernel_read_system_state(hald_mac_t) + libs_use_ld_so(hald_mac_t) libs_use_shared_libs(hald_mac_t) @@ -392,3 +430,7 @@ libs_use_shared_libs(hald_keymap_t) miscfiles_read_localization(hald_keymap_t) + +# This is caused by a bug in hald and PolicyKit. +# Should be removed when this is fixed +cron_read_system_job_lib_files(hald_t)