|
Chris PeBenito |
e181fe0 |
|
|
Chris PeBenito |
296273a |
policy_module(bootloader, 1.9.1)
|
|
Chris PeBenito |
960373d |
|
|
Chris PeBenito |
a2d8246 |
########################################
|
|
Chris PeBenito |
a2d8246 |
#
|
|
Chris PeBenito |
a2d8246 |
# Declarations
|
|
Chris PeBenito |
a2d8246 |
#
|
|
Chris PeBenito |
a2d8246 |
|
|
Chris PeBenito |
5f75f56 |
#
|
|
Chris PeBenito |
5f75f56 |
# boot_runtime_t is the type for /boot/kernel.h,
|
|
Chris PeBenito |
5f75f56 |
# which is automatically generated at boot time.
|
|
Chris PeBenito |
5f75f56 |
# only for Red Hat
|
|
Chris PeBenito |
5f75f56 |
#
|
|
Chris PeBenito |
70dcf79 |
type boot_runtime_t;
|
|
Chris PeBenito |
8fd3673 |
files_type(boot_runtime_t)
|
|
Chris PeBenito |
70dcf79 |
|
|
Chris PeBenito |
5f75f56 |
type bootloader_t;
|
|
Chris PeBenito |
5f75f56 |
type bootloader_exec_t;
|
|
Chris PeBenito |
0bfccda |
application_domain(bootloader_t, bootloader_exec_t)
|
|
Chris PeBenito |
d46cfe4 |
role system_r types bootloader_t;
|
|
Chris PeBenito |
5f75f56 |
|
|
Chris PeBenito |
b4cd153 |
#
|
|
Chris PeBenito |
b4cd153 |
# bootloader_etc_t is the configuration file,
|
|
Chris PeBenito |
b4cd153 |
# grub.conf, lilo.conf, etc.
|
|
Chris PeBenito |
b4cd153 |
#
|
|
Chris PeBenito |
b4cd153 |
type bootloader_etc_t alias etc_bootloader_t;
|
|
Chris PeBenito |
8fd3673 |
files_type(bootloader_etc_t)
|
|
Chris PeBenito |
b4cd153 |
|
|
Chris PeBenito |
b4cd153 |
#
|
|
Chris PeBenito |
b4cd153 |
# The temp file is used for initrd creation;
|
|
Chris PeBenito |
b4cd153 |
# it consists of files and device nodes
|
|
Chris PeBenito |
b4cd153 |
#
|
|
Chris PeBenito |
b4cd153 |
type bootloader_tmp_t;
|
|
Chris PeBenito |
c9428d3 |
files_tmp_file(bootloader_tmp_t)
|
|
Karl MacMillan |
f0c985c |
dev_node(bootloader_tmp_t)
|
|
Chris PeBenito |
b4cd153 |
|
|
Chris PeBenito |
710791f |
#
|
|
Chris PeBenito |
710791f |
# /var/log/ksyms
|
|
Chris PeBenito |
710791f |
# cjp: this probably can be removed, I do not
|
|
Chris PeBenito |
710791f |
# think it is used on 2.6 kernels
|
|
Chris PeBenito |
710791f |
type var_log_ksyms_t;
|
|
Chris PeBenito |
c3cf669 |
logging_log_file(var_log_ksyms_t)
|
|
Chris PeBenito |
710791f |
|
|
Chris PeBenito |
8a0da10 |
########################################
|
|
Chris PeBenito |
8a0da10 |
#
|
|
Chris PeBenito |
8a0da10 |
# bootloader local policy
|
|
Chris PeBenito |
8a0da10 |
#
|
|
Chris PeBenito |
8a0da10 |
|
|
Chris PeBenito |
4655103 |
allow bootloader_t self:capability { dac_override dac_read_search fsetid sys_rawio sys_admin mknod chown };
|
|
Chris PeBenito |
123a990 |
allow bootloader_t self:process { sigkill sigstop signull signal execmem };
|
|
Chris PeBenito |
c0868a7 |
allow bootloader_t self:fifo_file rw_fifo_file_perms;
|
|
Chris PeBenito |
b4cd153 |
|
|
Chris PeBenito |
c0868a7 |
allow bootloader_t bootloader_etc_t:file read_file_perms;
|
|
Chris PeBenito |
7bba9d3 |
# uncomment the following lines if you use "lilo -p"
|
|
Chris PeBenito |
1c1ac67 |
#allow bootloader_t bootloader_etc_t:file manage_file_perms;
|
|
Chris PeBenito |
1c1ac67 |
#files_etc_filetrans(bootloader_t,bootloader_etc_t,file)
|
|
Chris PeBenito |
7bba9d3 |
|
|
Chris PeBenito |
0bfccda |
manage_dirs_pattern(bootloader_t, bootloader_tmp_t, bootloader_tmp_t)
|
|
Chris PeBenito |
0bfccda |
manage_files_pattern(bootloader_t, bootloader_tmp_t, bootloader_tmp_t)
|
|
Chris PeBenito |
0bfccda |
manage_lnk_files_pattern(bootloader_t, bootloader_tmp_t, bootloader_tmp_t)
|
|
Chris PeBenito |
0bfccda |
manage_blk_files_pattern(bootloader_t, bootloader_tmp_t, bootloader_tmp_t)
|
|
Chris PeBenito |
0bfccda |
manage_chr_files_pattern(bootloader_t, bootloader_tmp_t, bootloader_tmp_t)
|
|
Chris PeBenito |
0bfccda |
files_tmp_filetrans(bootloader_t, bootloader_tmp_t, { dir file lnk_file chr_file blk_file })
|
|
Chris PeBenito |
7bba9d3 |
# for tune2fs (cjp: ?)
|
|
Chris PeBenito |
0bfccda |
files_root_filetrans(bootloader_t, bootloader_tmp_t, file)
|
|
Chris PeBenito |
7bba9d3 |
|
|
Chris PeBenito |
445522d |
kernel_getattr_core_if(bootloader_t)
|
|
Chris PeBenito |
4655103 |
kernel_read_network_state(bootloader_t)
|
|
Chris PeBenito |
b4cd153 |
kernel_read_system_state(bootloader_t)
|
|
Chris PeBenito |
b4cd153 |
kernel_read_software_raid_state(bootloader_t)
|
|
Chris PeBenito |
445522d |
kernel_read_kernel_sysctls(bootloader_t)
|
|
Chris PeBenito |
b4cd153 |
|
|
Chris PeBenito |
b4cd153 |
storage_raw_read_fixed_disk(bootloader_t)
|
|
Chris PeBenito |
b4cd153 |
storage_raw_write_fixed_disk(bootloader_t)
|
|
Chris PeBenito |
b4cd153 |
storage_raw_read_removable_device(bootloader_t)
|
|
Chris PeBenito |
b4cd153 |
storage_raw_write_removable_device(bootloader_t)
|
|
Chris PeBenito |
b4cd153 |
|
|
Karl MacMillan |
f0c985c |
dev_getattr_all_chr_files(bootloader_t)
|
|
Chris PeBenito |
9d3bdc2 |
dev_getattr_all_blk_files(bootloader_t)
|
|
Karl MacMillan |
f0c985c |
dev_dontaudit_rw_generic_dev_nodes(bootloader_t)
|
|
Karl MacMillan |
f0c985c |
dev_read_rand(bootloader_t)
|
|
Karl MacMillan |
f0c985c |
dev_read_urand(bootloader_t)
|
|
Chris PeBenito |
b0d2243 |
dev_read_sysfs(bootloader_t)
|
|
Chris PeBenito |
a5e2133 |
# needed on some hardware
|
|
Chris PeBenito |
a5e2133 |
dev_rw_nvram(bootloader_t)
|
|
Chris PeBenito |
b4cd153 |
|
|
Chris PeBenito |
0fd9dc5 |
fs_getattr_xattr_fs(bootloader_t)
|
|
Chris PeBenito |
4655103 |
fs_getattr_tmpfs(bootloader_t)
|
|
Chris PeBenito |
a524921 |
fs_read_tmpfs_symlinks(bootloader_t)
|
|
Chris PeBenito |
4655103 |
#Needed for ia64
|
|
Chris PeBenito |
4655103 |
fs_manage_dos_files(bootloader_t)
|
|
Chris PeBenito |
7bba9d3 |
|
|
Chris PeBenito |
f8233ab |
mls_file_read_all_levels(bootloader_t)
|
|
Chris PeBenito |
f8233ab |
mls_file_write_all_levels(bootloader_t)
|
|
Chris PeBenito |
6b19be3 |
|
|
Chris PeBenito |
0fd9dc5 |
term_getattr_all_user_ttys(bootloader_t)
|
|
Chris PeBenito |
1815bad |
term_dontaudit_manage_pty_dirs(bootloader_t)
|
|
Chris PeBenito |
7bba9d3 |
|
|
Chris PeBenito |
fb63d0b |
corecmd_exec_all_executables(bootloader_t)
|
|
Chris PeBenito |
a2d8246 |
|
|
Chris PeBenito |
15722ec |
domain_use_interactive_fds(bootloader_t)
|
|
Chris PeBenito |
a2d8246 |
|
|
Chris PeBenito |
1c1ac67 |
files_create_boot_dirs(bootloader_t)
|
|
Chris PeBenito |
1c1ac67 |
files_manage_boot_files(bootloader_t)
|
|
Chris PeBenito |
1c1ac67 |
files_manage_boot_symlinks(bootloader_t)
|
|
Chris PeBenito |
8fd3673 |
files_read_etc_files(bootloader_t)
|
|
Chris PeBenito |
681c9a0 |
files_exec_etc_files(bootloader_t)
|
|
Chris PeBenito |
8fd3673 |
files_read_usr_src_files(bootloader_t)
|
|
Chris PeBenito |
c9428d3 |
files_read_usr_files(bootloader_t)
|
|
Chris PeBenito |
8fd3673 |
files_read_var_files(bootloader_t)
|
|
Chris PeBenito |
1c1ac67 |
files_read_kernel_modules(bootloader_t)
|
|
Chris PeBenito |
7bba9d3 |
# for nscd
|
|
Chris PeBenito |
c9428d3 |
files_dontaudit_search_pids(bootloader_t)
|
|
Chris PeBenito |
a3cf80d |
# for blkid.tab
|
|
Chris PeBenito |
a3cf80d |
files_manage_etc_runtime_files(bootloader_t)
|
|
Chris PeBenito |
0bfccda |
files_etc_filetrans_etc_runtime(bootloader_t, file)
|
|
Chris PeBenito |
123a990 |
files_dontaudit_search_home(bootloader_t)
|
|
Chris PeBenito |
a2d8246 |
|
|
Chris PeBenito |
1aa5262 |
init_getattr_initctl(bootloader_t)
|
|
Chris PeBenito |
1815bad |
init_use_script_ptys(bootloader_t)
|
|
Chris PeBenito |
15722ec |
init_use_script_fds(bootloader_t)
|
|
Chris PeBenito |
1815bad |
init_rw_script_pipes(bootloader_t)
|
|
Chris PeBenito |
1aa5262 |
|
|
Chris PeBenito |
1815bad |
libs_read_lib_files(bootloader_t)
|
|
Chris PeBenito |
681c9a0 |
libs_exec_lib_files(bootloader_t)
|
|
Chris PeBenito |
b4cd153 |
|
|
Chris PeBenito |
c9428d3 |
logging_send_syslog_msg(bootloader_t)
|
|
Chris PeBenito |
c9428d3 |
logging_rw_generic_logs(bootloader_t)
|
|
Chris PeBenito |
b4cd153 |
|
|
Chris PeBenito |
7bba9d3 |
miscfiles_read_localization(bootloader_t)
|
|
Chris PeBenito |
b4cd153 |
|
|
Chris PeBenito |
123a990 |
modutils_domtrans_insmod_uncond(bootloader_t)
|
|
Chris PeBenito |
123a990 |
|
|
Chris PeBenito |
1815bad |
seutil_read_bin_policy(bootloader_t)
|
|
Chris PeBenito |
1815bad |
seutil_read_loadpolicy(bootloader_t)
|
|
Chris PeBenito |
a5f339f |
seutil_dontaudit_search_config(bootloader_t)
|
|
Chris PeBenito |
8a0da10 |
|
|
Chris PeBenito |
296273a |
userdom_use_user_terminals(bootloader_t)
|
|
Chris PeBenito |
296273a |
userdom_dontaudit_search_user_home_dirs(bootloader_t)
|
|
Chris PeBenito |
296273a |
|
|
Chris PeBenito |
58c3da5 |
ifdef(`distro_debian',`
|
|
Chris PeBenito |
58c3da5 |
allow bootloader_t bootloader_tmp_t:{ dir file } { relabelfrom relabelto };
|
|
Chris PeBenito |
5f38a65 |
fs_list_tmpfs(bootloader_t)
|
|
Chris PeBenito |
5f38a65 |
|
|
Chris PeBenito |
1c1ac67 |
files_relabel_kernel_modules(bootloader_t)
|
|
Chris PeBenito |
1c1ac67 |
files_relabelfrom_boot_files(bootloader_t)
|
|
Chris PeBenito |
1c1ac67 |
files_delete_kernel_modules(bootloader_t)
|
|
Chris PeBenito |
5f38a65 |
files_relabelto_usr_files(bootloader_t)
|
|
Chris PeBenito |
5f38a65 |
files_search_var_lib(bootloader_t)
|
|
Chris PeBenito |
58c3da5 |
# for /usr/share/initrd-tools/scripts
|
|
Chris PeBenito |
58c3da5 |
files_exec_usr_files(bootloader_t)
|
|
Chris PeBenito |
5f38a65 |
|
|
Chris PeBenito |
5f38a65 |
fstools_manage_entry_files(bootloader_t)
|
|
Chris PeBenito |
5f38a65 |
fstools_relabelto_entry_files(bootloader_t)
|
|
Chris PeBenito |
5f38a65 |
|
|
Chris PeBenito |
5f38a65 |
libs_relabelto_lib_files(bootloader_t)
|
|
Chris PeBenito |
7bba9d3 |
')
|
|
Chris PeBenito |
a2d8246 |
|
|
Chris PeBenito |
58c3da5 |
ifdef(`distro_redhat',`
|
|
Chris PeBenito |
0c73cd2 |
# for memlock
|
|
Chris PeBenito |
0c73cd2 |
allow bootloader_t self:capability ipc_lock;
|
|
Chris PeBenito |
0c73cd2 |
|
|
Chris PeBenito |
0c73cd2 |
# new file system defaults to file_t, granting file_t access is still bad.
|
|
Chris PeBenito |
c0868a7 |
allow bootloader_t boot_runtime_t:file { read_file_perms unlink };
|
|
Chris PeBenito |
0c73cd2 |
|
|
Chris PeBenito |
58c3da5 |
# new file system defaults to file_t, granting file_t access is still bad.
|
|
Chris PeBenito |
9e04f5c |
files_manage_isid_type_dirs(bootloader_t)
|
|
Chris PeBenito |
9e04f5c |
files_manage_isid_type_files(bootloader_t)
|
|
Chris PeBenito |
9e04f5c |
files_manage_isid_type_symlinks(bootloader_t)
|
|
Chris PeBenito |
9e04f5c |
files_manage_isid_type_blk_files(bootloader_t)
|
|
Chris PeBenito |
9e04f5c |
files_manage_isid_type_chr_files(bootloader_t)
|
|
Chris PeBenito |
58c3da5 |
|
|
Chris PeBenito |
0c73cd2 |
# for mke2fs
|
|
Chris PeBenito |
c9428d3 |
mount_domtrans(bootloader_t)
|
|
Chris PeBenito |
3e59876 |
|
|
Chris PeBenito |
3e59876 |
optional_policy(`
|
|
Chris PeBenito |
3e59876 |
unconfined_domain(bootloader_t)
|
|
Chris PeBenito |
3e59876 |
')
|
|
Chris PeBenito |
7bba9d3 |
')
|
|
Chris PeBenito |
a2d8246 |
|
|
Chris PeBenito |
bb7170f |
optional_policy(`
|
|
Chris PeBenito |
71fe0fa |
fstools_exec(bootloader_t)
|
|
Chris PeBenito |
7bba9d3 |
')
|
|
Chris PeBenito |
a2d8246 |
|
|
Chris PeBenito |
bb7170f |
optional_policy(`
|
|
Chris PeBenito |
d6d16b9 |
hal_dontaudit_append_lib_files(bootloader_t)
|
|
Chris PeBenito |
016e5c5 |
hal_write_log(bootloader_t)
|
|
Chris PeBenito |
d6d16b9 |
')
|
|
Chris PeBenito |
d6d16b9 |
|
|
Chris PeBenito |
d6d16b9 |
optional_policy(`
|
|
Chris PeBenito |
123a990 |
kudzu_domtrans(bootloader_t)
|
|
Chris PeBenito |
123a990 |
')
|
|
Chris PeBenito |
123a990 |
|
|
Chris PeBenito |
123a990 |
optional_policy(`
|
|
Karl MacMillan |
f0c985c |
dev_rw_lvm_control(bootloader_t)
|
|
Chris PeBenito |
0c73cd2 |
|
|
Chris PeBenito |
c9428d3 |
lvm_domtrans(bootloader_t)
|
|
Chris PeBenito |
0c73cd2 |
lvm_read_config(bootloader_t)
|
|
Chris PeBenito |
7bba9d3 |
')
|
|
Chris PeBenito |
a2d8246 |
|
|
Chris PeBenito |
bb7170f |
optional_policy(`
|
|
Chris PeBenito |
12ae755 |
modutils_exec_insmod(bootloader_t)
|
|
Chris PeBenito |
1815bad |
modutils_read_module_deps(bootloader_t)
|
|
Chris PeBenito |
1815bad |
modutils_read_module_config(bootloader_t)
|
|
Chris PeBenito |
c9428d3 |
modutils_exec_insmod(bootloader_t)
|
|
Chris PeBenito |
c9428d3 |
modutils_exec_depmod(bootloader_t)
|
|
Chris PeBenito |
c9428d3 |
modutils_exec_update_mods(bootloader_t)
|
|
Chris PeBenito |
7bba9d3 |
')
|
|
Chris PeBenito |
b4cd153 |
|
|
Chris PeBenito |
bb7170f |
optional_policy(`
|
|
Chris PeBenito |
1815bad |
nscd_socket_use(bootloader_t)
|
|
Chris PeBenito |
704327e |
')
|
|
Chris PeBenito |
704327e |
|
|
Chris PeBenito |
bb7170f |
optional_policy(`
|
|
Chris PeBenito |
1815bad |
rpm_rw_pipes(bootloader_t)
|
|
Chris PeBenito |
b24f35d |
')
|