From: Russell Coker <russell@coker.com.au>
To: selinux-refpolicy@vger.kernel.org
Subject: [PATCH] more Chrome stuff
Date: Wed, 20 Jan 2021 20:32:19 +1100 [thread overview]
Message-ID: <YAf4o+bWqueNpBrT@xev> (raw)
Patches for some more Chrome stuff
Signed-off-by: Russell Coker <russell@coker.com.au>
Index: refpolicy-2.20210120/policy/modules/apps/chromium.te
===================================================================
--- refpolicy-2.20210120.orig/policy/modules/apps/chromium.te
+++ refpolicy-2.20210120/policy/modules/apps/chromium.te
@@ -90,7 +90,9 @@ xdg_cache_content(chromium_xdg_cache_t)
#
# execmem for load in plugins
-allow chromium_t self:process { execmem getsched getcap setcap setrlimit setsched sigkill signal };
+allow chromium_t self:process { execmem getsched getcap setcap setrlimit setsched sigkill signal signull };
+allow chromium_t self:dir { write add_name };
+allow chromium_t self:file create;
allow chromium_t self:fifo_file rw_fifo_file_perms;
allow chromium_t self:sem create_sem_perms;
allow chromium_t self:netlink_kobject_uevent_socket client_stream_socket_perms;
@@ -144,7 +146,12 @@ dyntrans_pattern(chromium_t, chromium_re
domtrans_pattern(chromium_t, chromium_sandbox_exec_t, chromium_sandbox_t)
domtrans_pattern(chromium_t, chromium_naclhelper_exec_t, chromium_naclhelper_t)
+# for self:file create
+kernel_associate_proc(chromium_t)
+
+kernel_get_sysvipc_info(chromium_t)
kernel_list_proc(chromium_t)
+kernel_read_crypto_sysctls(chromium_t)
kernel_read_fs_sysctls(chromium_t)
kernel_read_kernel_sysctls(chromium_t)
kernel_read_net_sysctls(chromium_t)
@@ -156,6 +163,7 @@ corecmd_exec_shell(chromium_t)
corenet_tcp_connect_all_unreserved_ports(chromium_t)
corenet_tcp_connect_ftp_port(chromium_t)
corenet_tcp_connect_http_port(chromium_t)
+corenet_tcp_connect_ipp_port(chromium_t)
corenet_udp_bind_generic_node(chromium_t)
corenet_udp_bind_all_unreserved_ports(chromium_t)
@@ -325,6 +333,9 @@ userdom_use_user_terminals(chromium_rend
xdg_read_config_files(chromium_renderer_t)
+# should we have a tunable for this?
+xdg_read_pictures(chromium_t)
+
xserver_user_x_domain_template(chromium_renderer, chromium_renderer_t, chromium_tmpfs_t)
tunable_policy(`chromium_read_system_info',`
Index: refpolicy-2.20210120/policy/modules/kernel/kernel.if
===================================================================
--- refpolicy-2.20210120.orig/policy/modules/kernel/kernel.if
+++ refpolicy-2.20210120/policy/modules/kernel/kernel.if
@@ -2442,6 +2442,24 @@ interface(`kernel_rw_all_sysctls',`
########################################
## <summary>
+## Associate a file to proc_t (/proc)
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+## <rolecap/>
+#
+interface(`kernel_associate_proc',`
+ gen_require(`
+ type proc_t;
+ ')
+ allow $1 proc_t:filesystem associate;
+')
+
+########################################
+## <summary>
## Send a kill signal to unlabeled processes.
## </summary>
## <param name="domain">
next reply other threads:[~2021-01-20 11:08 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-01-20 9:32 Russell Coker [this message]
2021-01-25 14:38 ` [PATCH] more Chrome stuff Chris PeBenito
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YAf4o+bWqueNpBrT@xev \
--to=russell@coker.com.au \
--cc=selinux-refpolicy@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.