policy_module(kernel, 1.24.0) ######################################## # # Declarations # ## ##

## Disable kernel module loading. ##

## gen_bool(secure_mode_insmod, false) # assertion related attributes attribute can_load_kernmodule; attribute can_receive_kernel_messages; attribute can_dump_kernel; neverallow ~can_load_kernmodule self:capability sys_module; # domains with unconfined access to kernel resources attribute kern_unconfined; # regular entries in proc attribute proc_type; # sysctls attribute sysctl_type; role system_r; role sysadm_r; role staff_r; role user_r; # here until order dependence is fixed: role unconfined_r; ifdef(`enable_mls',` role secadm_r; role auditadm_r; ') # # kernel_t is the domain of kernel threads. # It is also the target type when checking permissions in the system class. # type kernel_t, can_load_kernmodule; domain_base_type(kernel_t) mls_rangetrans_source(kernel_t) role system_r types kernel_t; sid kernel gen_context(system_u:system_r:kernel_t,mls_systemhigh) # # DebugFS # type debugfs_t; files_mountpoint(debugfs_t) fs_type(debugfs_t) allow debugfs_t self:filesystem associate; genfscon debugfs / gen_context(system_u:object_r:debugfs_t,s0) # # kvmFS # type kvmfs_t; fs_type(kvmfs_t) genfscon kvmfs / gen_context(system_u:object_r:kvmfs_t,s0) # # Procfs types # type proc_t, proc_type; files_mountpoint(proc_t) fs_type(proc_t) genfscon proc / gen_context(system_u:object_r:proc_t,s0) genfscon proc /sysvipc gen_context(system_u:object_r:proc_t,s0) type proc_afs_t, proc_type; genfscon proc /fs/openafs gen_context(system_u:object_r:proc_afs_t,s0) # kernel message interface type proc_kmsg_t, proc_type; genfscon proc /kmsg gen_context(system_u:object_r:proc_kmsg_t,mls_systemhigh) neverallow ~{ can_receive_kernel_messages kern_unconfined } proc_kmsg_t:file ~getattr; # /proc kcore: inaccessible type proc_kcore_t, proc_type; neverallow ~{ can_dump_kernel kern_unconfined } proc_kcore_t:file ~getattr; genfscon proc /kcore gen_context(system_u:object_r:proc_kcore_t,mls_systemhigh) type proc_mdstat_t, proc_type; genfscon proc /mdstat gen_context(system_u:object_r:proc_mdstat_t,s0) type proc_net_t, proc_type; genfscon proc /net gen_context(system_u:object_r:proc_net_t,s0) type proc_xen_t, proc_type; files_mountpoint(proc_xen_t) genfscon proc /xen gen_context(system_u:object_r:proc_xen_t,s0) # # Sysctl types # # /proc/sys directory, base directory of sysctls type sysctl_t, sysctl_type; files_mountpoint(sysctl_t) sid sysctl gen_context(system_u:object_r:sysctl_t,s0) genfscon proc /sys gen_context(system_u:object_r:sysctl_t,s0) # /proc/irq directory and files type sysctl_irq_t, sysctl_type; genfscon proc /irq gen_context(system_u:object_r:sysctl_irq_t,s0) # /proc/net/rpc directory and files type sysctl_rpc_t, sysctl_type; genfscon proc /net/rpc gen_context(system_u:object_r:sysctl_rpc_t,s0) # /proc/sys/crypto directory and files type sysctl_crypto_t, sysctl_type; genfscon proc /sys/crypto gen_context(system_u:object_r:sysctl_crypto_t,s0) # /proc/sys/fs directory and files type sysctl_fs_t, sysctl_type; files_mountpoint(sysctl_fs_t) genfscon proc /sys/fs gen_context(system_u:object_r:sysctl_fs_t,s0) # /proc/sys/kernel directory and files type sysctl_kernel_t, sysctl_type; genfscon proc /sys/kernel gen_context(system_u:object_r:sysctl_kernel_t,s0) # /proc/sys/kernel/modprobe file type sysctl_modprobe_t, sysctl_type; genfscon proc /sys/kernel/modprobe gen_context(system_u:object_r:sysctl_modprobe_t,s0) # /proc/sys/kernel/hotplug file type sysctl_hotplug_t, sysctl_type; genfscon proc /sys/kernel/hotplug gen_context(system_u:object_r:sysctl_hotplug_t,s0) # /proc/sys/net directory and files type sysctl_net_t, sysctl_type; genfscon proc /sys/net gen_context(system_u:object_r:sysctl_net_t,s0) # /proc/sys/net/unix directory and files type sysctl_net_unix_t, sysctl_type; genfscon proc /sys/net/unix gen_context(system_u:object_r:sysctl_net_unix_t,s0) # /proc/sys/vm directory and files type sysctl_vm_t, sysctl_type; genfscon proc /sys/vm gen_context(system_u:object_r:sysctl_vm_t,s0) type sysctl_vm_overcommit_t, sysctl_type; genfscon proc /sys/vm/overcommit_memory gen_context(system_u:object_r:sysctl_vm_overcommit_t,s0) # /proc/sys/dev directory and files type sysctl_dev_t, sysctl_type; genfscon proc /sys/dev gen_context(system_u:object_r:sysctl_dev_t,s0) # # unlabeled_t is the type of unlabeled objects. # Objects that have no known labeling information or that # have labels that are no longer valid are treated as having this type. # # Mountpoint permissions are for the case when a file has been assigned # an extended attribute for the first time (old file_t). Directories # where filesystems are mounted may never get relabeled. # type unlabeled_t alias file_t; kernel_rootfs_mountpoint(unlabeled_t) files_mountpoint(unlabeled_t) fs_associate(unlabeled_t) sid file gen_context(system_u:object_r:unlabeled_t,s0) sid unlabeled gen_context(system_u:object_r:unlabeled_t,mls_systemhigh) neverallow * unlabeled_t:file entrypoint; # These initial sids are no longer used, and can be removed: sid any_socket gen_context(system_u:object_r:unlabeled_t,mls_systemhigh) sid file_labels gen_context(system_u:object_r:unlabeled_t,s0) sid icmp_socket gen_context(system_u:object_r:unlabeled_t,mls_systemhigh) sid igmp_packet gen_context(system_u:object_r:unlabeled_t,mls_systemhigh) sid init gen_context(system_u:object_r:unlabeled_t,s0) sid kmod gen_context(system_u:object_r:unlabeled_t,mls_systemhigh) sid policy gen_context(system_u:object_r:unlabeled_t,mls_systemhigh) sid scmp_packet gen_context(system_u:object_r:unlabeled_t,mls_systemhigh) sid sysctl_modprobe gen_context(system_u:object_r:unlabeled_t,s0) sid sysctl_fs gen_context(system_u:object_r:unlabeled_t,s0) sid sysctl_kernel gen_context(system_u:object_r:unlabeled_t,s0) sid sysctl_net gen_context(system_u:object_r:unlabeled_t,s0) sid sysctl_net_unix gen_context(system_u:object_r:unlabeled_t,s0) sid sysctl_vm gen_context(system_u:object_r:unlabeled_t,s0) sid sysctl_dev gen_context(system_u:object_r:unlabeled_t,s0) sid tcp_socket gen_context(system_u:object_r:unlabeled_t,mls_systemhigh) ######################################## # # kernel local policy # allow kernel_t self:capability { chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap }; allow kernel_t self:process { transition signal_perms getsched setsched getsession getpgid setpgid getcap setcap share getattr noatsecure siginh rlimitinh dyntransition setkeycreate setsockcreate getrlimit }; allow kernel_t self:shm create_shm_perms; allow kernel_t self:sem create_sem_perms; allow kernel_t self:msg { send receive }; allow kernel_t self:msgq create_msgq_perms; allow kernel_t self:unix_dgram_socket create_socket_perms; allow kernel_t self:unix_stream_socket create_stream_socket_perms; allow kernel_t self:unix_dgram_socket sendto; allow kernel_t self:unix_stream_socket connectto; allow kernel_t self:fifo_file rw_fifo_file_perms; allow kernel_t self:sock_file read_sock_file_perms; allow kernel_t self:fd use; allow kernel_t debugfs_t:dir search_dir_perms; allow kernel_t proc_t:dir list_dir_perms; allow kernel_t proc_t:file read_file_perms; allow kernel_t proc_t:lnk_file read_lnk_file_perms; allow kernel_t proc_net_t:dir list_dir_perms; allow kernel_t proc_net_t:file read_file_perms; allow kernel_t proc_mdstat_t:file read_file_perms; allow kernel_t proc_kcore_t:file getattr; allow kernel_t proc_kmsg_t:file getattr; allow kernel_t sysctl_kernel_t:dir list_dir_perms; allow kernel_t sysctl_kernel_t:file read_file_perms; allow kernel_t sysctl_t:dir list_dir_perms; # Other possible mount points for the root fs are in files allow kernel_t unlabeled_t:dir mounton; # Kernel-generated traffic e.g., TCP resets on # connections with invalidated labels: allow kernel_t unlabeled_t:packet send; kernel_mounton_proc_dirs(kernel_t) kernel_request_load_module(kernel_t) # Allow unlabeled network traffic allow unlabeled_t unlabeled_t:packet { forward_in forward_out }; corenet_in_generic_if(unlabeled_t) corenet_in_generic_node(unlabeled_t) corenet_all_recvfrom_unlabeled(kernel_t) corenet_all_recvfrom_netlabel(kernel_t) # Kernel-generated traffic e.g., ICMP replies: corenet_raw_sendrecv_all_if(kernel_t) corenet_raw_sendrecv_all_nodes(kernel_t) corenet_raw_send_generic_if(kernel_t) # Kernel-generated traffic e.g., TCP resets: corenet_tcp_sendrecv_all_if(kernel_t) corenet_tcp_sendrecv_all_nodes(kernel_t) corenet_raw_send_generic_node(kernel_t) corenet_send_all_packets(kernel_t) corenet_ib_access_all_pkeys(kernel_t) corenet_ib_access_unlabeled_pkeys(kernel_t) corenet_ib_manage_subnet_all_endports(kernel_t) corenet_ib_manage_subnet_unlabeled_endports(kernel_t) dev_mounton_sysfs(kernel_t) dev_read_sysfs(kernel_t) dev_search_usbfs(kernel_t) # devtmpfs handling: dev_create_generic_dirs(kernel_t) dev_delete_generic_dirs(kernel_t) dev_create_generic_blk_files(kernel_t) dev_delete_generic_blk_files(kernel_t) dev_create_generic_chr_files(kernel_t) dev_delete_generic_chr_files(kernel_t) dev_mounton(kernel_t) dev_delete_generic_symlinks(kernel_t) dev_rw_generic_chr_files(kernel_t) dev_setattr_generic_blk_files(kernel_t) dev_setattr_generic_chr_files(kernel_t) dev_getattr_fs(kernel_t) dev_getattr_sysfs(kernel_t) dev_write_kmsg(kernel_t) # Mount root file system. Used when loading a policy # from initrd, then mounting the root filesystem fs_mount_all_fs(kernel_t) fs_unmount_all_fs(kernel_t) fs_getattr_tmpfs(kernel_t) fs_getattr_tmpfs_dirs(kernel_t) fs_manage_tmpfs_dirs(kernel_t) fs_manage_tmpfs_files(kernel_t) fs_manage_tmpfs_sockets(kernel_t) fs_delete_tmpfs_symlinks(kernel_t) selinux_getattr_fs(kernel_t) selinux_load_policy(kernel_t) term_getattr_pty_fs(kernel_t) term_use_console(kernel_t) term_use_generic_ptys(kernel_t) # for kdevtmpfs term_setattr_unlink_unallocated_ttys(kernel_t) corecmd_exec_shell(kernel_t) corecmd_list_bin(kernel_t) # /proc/sys/kernel/modprobe is set to /bin/true if not using modules. corecmd_exec_bin(kernel_t) domain_signal_all_domains(kernel_t) domain_search_all_domains_state(kernel_t) files_getattr_rootfs(kernel_t) files_manage_root_dir(kernel_t) files_delete_root_files(kernel_t) files_exec_root_files(kernel_t) files_delete_root_symlinks(kernel_t) files_delete_root_chr_files(kernel_t) files_list_root(kernel_t) files_list_etc(kernel_t) files_getattr_etc_runtime_dirs(kernel_t) files_mounton_etc_runtime_dirs(kernel_t) files_list_home(kernel_t) files_read_usr_files(kernel_t) mcs_process_set_categories(kernel_t) mls_process_read_all_levels(kernel_t) mls_process_write_all_levels(kernel_t) mls_file_write_all_levels(kernel_t) mls_file_read_all_levels(kernel_t) ifdef(`distro_redhat',` # Bugzilla 222337 fs_rw_tmpfs_chr_files(kernel_t) ') ifdef(`init_systemd',` optional_policy(` dev_manage_input_dev(kernel_t) dev_filetrans_input_dev(kernel_t) ') optional_policy(` selinux_compute_create_context(kernel_t) ') optional_policy(` storage_dev_filetrans_fixed_disk(kernel_t) storage_setattr_fixed_disk_dev(kernel_t) storage_create_fixed_disk_dev(kernel_t) storage_delete_fixed_disk_dev(kernel_t) ') ') optional_policy(` # loop devices fstools_use_fds(kernel_t) ') optional_policy(` hotplug_search_config(kernel_t) ') optional_policy(` init_sigchld(kernel_t) ') optional_policy(` libs_use_ld_so(kernel_t) libs_use_shared_libs(kernel_t) ') optional_policy(` logging_manage_generic_logs(kernel_t) logging_send_syslog_msg(kernel_t) ') optional_policy(` mount_use_fds(kernel_t) mount_read_loopback_files(kernel_t) ') optional_policy(` nis_use_ypbind(kernel_t) ') optional_policy(` plymouthd_read_lib_files(kernel_t) plymouthd_read_pid_files(kernel_t) plymouthd_read_spool_files(kernel_t) term_use_ptmx(kernel_t) term_use_unallocated_ttys(kernel_t) ') optional_policy(` # nfs kernel server needs kernel UDP access. It is less risky and painful # to just give it everything. allow kernel_t self:tcp_socket create_stream_socket_perms; allow kernel_t self:udp_socket create_socket_perms; # nfs kernel server needs kernel UDP access. It is less risky and painful # to just give it everything. corenet_udp_sendrecv_generic_if(kernel_t) corenet_udp_sendrecv_generic_node(kernel_t) corenet_udp_sendrecv_all_ports(kernel_t) corenet_udp_bind_generic_node(kernel_t) corenet_sendrecv_portmap_client_packets(kernel_t) corenet_sendrecv_generic_server_packets(kernel_t) fs_getattr_xattr_fs(kernel_t) auth_dontaudit_getattr_shadow(kernel_t) sysnet_read_config(kernel_t) rpc_manage_nfs_ro_content(kernel_t) rpc_manage_nfs_rw_content(kernel_t) rpc_tcp_rw_nfs_sockets(kernel_t) rpc_udp_rw_nfs_sockets(kernel_t) optional_policy(` gssproxy_stream_connect(kernel_t) ') tunable_policy(`nfs_export_all_ro',` fs_getattr_noxattr_fs(kernel_t) fs_list_noxattr_fs(kernel_t) fs_read_noxattr_fs_files(kernel_t) fs_read_noxattr_fs_symlinks(kernel_t) files_list_non_auth_dirs(kernel_t) files_read_non_auth_files(kernel_t) files_read_non_auth_symlinks(kernel_t) ') tunable_policy(`nfs_export_all_rw',` fs_getattr_noxattr_fs(kernel_t) fs_list_noxattr_fs(kernel_t) fs_read_noxattr_fs_files(kernel_t) fs_read_noxattr_fs_symlinks(kernel_t) files_manage_non_auth_files(kernel_t) ') ') optional_policy(` seutil_read_config(kernel_t) seutil_read_bin_policy(kernel_t) seutil_domtrans_setfiles(kernel_t) ') optional_policy(` unconfined_domain_noaudit(kernel_t) ') ######################################## # # Unlabeled process local policy # optional_policy(` # If you load a new policy that removes active domains, processes can # get stuck if you do not allow unlabeled processes to signal init. # If you load an incompatible policy, you should probably reboot, # since you may have compromised system security. init_sigchld(unlabeled_t) ') ######################################## # # Kernel module loading policy # if( ! secure_mode_insmod ) { allow can_load_kernmodule self:capability sys_module; allow can_load_kernmodule self:system module_load; files_load_kernel_modules(can_load_kernmodule) # load_module() calls stop_machine() which # calls sched_setscheduler() # gt: there seems to be no trace of the above, at # least in kernel versions greater than 2.6.37... allow can_load_kernmodule self:capability sys_nice; kernel_setsched(can_load_kernmodule) } ######################################## # # Rules for unconfined acccess to this module # allow kern_unconfined proc_type:dir { manage_dir_perms relabelfrom relabelto append map execute swapon quotaon mounton audit_access execmod }; allow kern_unconfined proc_type:lnk_file { manage_lnk_file_perms relabelfrom relabelto append map execute swapon quotaon mounton open audit_access execmod }; allow kern_unconfined proc_type:file { manage_file_perms relabelfrom relabelto map execute swapon quotaon mounton execute_no_trans audit_access }; allow kern_unconfined sysctl_type:dir { manage_dir_perms relabelfrom relabelto append map execute swapon quotaon mounton audit_access execmod }; allow kern_unconfined sysctl_type:file { manage_file_perms relabelfrom relabelto map execute swapon quotaon mounton execute_no_trans audit_access }; allow kern_unconfined kernel_t:system { ipc_info syslog_read syslog_mod syslog_console module_request module_load halt reboot status start stop enable disable reload }; allow kern_unconfined unlabeled_t:file { manage_file_perms relabelfrom relabelto map execute swapon quotaon mounton execute_no_trans audit_access }; allow kern_unconfined unlabeled_t:lnk_file { manage_lnk_file_perms relabelfrom relabelto append map execute swapon quotaon mounton open audit_access execmod }; allow kern_unconfined unlabeled_t:sock_file { manage_sock_file_perms relabelfrom relabelto map execute swapon quotaon mounton audit_access execmod }; allow kern_unconfined unlabeled_t:fifo_file { manage_fifo_file_perms relabelfrom relabelto map execute swapon quotaon mounton audit_access execmod }; allow kern_unconfined unlabeled_t:blk_file { manage_blk_file_perms relabelfrom relabelto map execute swapon quotaon mounton audit_access execmod }; allow kern_unconfined unlabeled_t:chr_file { manage_chr_file_perms relabelfrom relabelto map execute swapon quotaon mounton execute_no_trans audit_access }; allow kern_unconfined unlabeled_t:dir { manage_dir_perms relabelfrom relabelto append map execute swapon quotaon mounton add_name remove_name reparent search rmdir audit_access execmod }; allow kern_unconfined unlabeled_t:filesystem { mount remount unmount getattr relabelfrom relabelto transition associate quotamod quotaget }; allow kern_unconfined unlabeled_t:association { sendto recvfrom setcontext polmatch }; allow kern_unconfined unlabeled_t:packet { send recv relabelto flow_in flow_out forward_in forward_out }; allow kern_unconfined unlabeled_t:process { fork signal_perms ptrace getsched setsched getsession getpgid setpgid getcap setcap share getattr setexec setfscreate noatsecure siginh setrlimit rlimitinh setcurrent setkeycreate setsockcreate getrlimit }; ifdef(`distro_gentoo',` ##################################### # # Local kernel_t policy # allow kernel_t unlabeled_t:dir search_dir_perms; # To support kdevtmpfs properly (its purpose is to manage the /dev tmpfs so grant it these rights) # See also bug 535992 #dev_manage_all_dev_nodes(kernel_t) dev_setattr_generic_chr_files(kernel_t) # ZFS send/recv writes to an fd optional_policy(` sysadm_use_fds(kernel_t) ') # zfs list writes to a pipe optional_policy(` mount_rw_pipes(kernel_t) ') ')