Attachment 160313 Details for Bug 250249 – Proposed patch to selinux-policy. I've derived it from the mozilla policy files.

[patch] Proposed patch to selinux-policy. I've derived it from the mozilla policy files.

serefpolicy-2.4.6-nsplugin.patch (text/plain), 9.96 KB, created by Martin Stransky on 2007-07-31 12:51:29 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Martin Stransky

Created: 2007-07-31 12:51:29 UTC

Size: 9.96 KB

patch

obsolete

>--- /dev/null	2007-07-30 10:38:24.614755915 +0200
>+++ serefpolicy-2.6.4/policy/modules/admin/nsplugin.if	2007-07-27 11:55:43.000000000 +0200
>@@ -0,0 +1,310 @@
>+## <summary>Policy for nspluginwrapper</summary>
>+
>+#######################################
>+## <summary>
>+##	The per role template for the nsplugin module.
>+## </summary>
>+## <desc>
>+##	
>+##	This template creates a derived domains which are used
>+##	for nsplugin web browser.
>+##	
>+##	
>+##	This template is invoked automatically for each user, and
>+##	generally does not need to be invoked directly
>+##	by policy writers.
>+##	
>+## </desc>
>+## <param name="userdomain_prefix">
>+##	<summary>
>+##	The prefix of the user domain (e.g., user
>+##	is the prefix for user_t).
>+##	</summary>
>+## </param>
>+## <param name="user_domain">
>+##	<summary>
>+##	The type of the user domain.
>+##	</summary>
>+## </param>
>+## <param name="user_role">
>+##	<summary>
>+##	The role associated with the user domain.
>+##	</summary>
>+## </param>
>+#
>+template(`nsplugin_per_role_template',`
>+	gen_require(`
>+		type nsplugin_exec_t;
>+		type $1_mozilla_t;
>+		type $1_mozilla_home_t;
>+	')
>+
>+	########################################
>+	#
>+	# Declarations
>+	#
>+	type $1_nsplugin_t;
>+	domain_type($1_nsplugin_t)
>+	domain_entry_file($1_nsplugin_t,nsplugin_exec_t)
>+	role $3 types $1_nsplugin_t;
>+
>+	########################################
>+	#
>+	# Local policy
>+	#
>+
>+	allow $1_nsplugin_t self:capability { sys_nice setgid setuid };
>+	allow $1_nsplugin_t self:process { sigkill signal setsched getsched setrlimit };
>+	allow $1_nsplugin_t self:fifo_file rw_fifo_file_perms;
>+	allow $1_nsplugin_t self:shm { unix_read unix_write read write destroy create };
>+	allow $1_nsplugin_t self:sem create_sem_perms;
>+	allow $1_nsplugin_t self:socket create_socket_perms;
>+	allow $1_nsplugin_t self:unix_stream_socket { listen accept };
>+
>+	# Mozilla can run nsplugin_exec_t types
>+	can_exec($1_mozilla_t, nsplugin_exec_t)
>+	can_exec($1_nsplugin_t, nsplugin_exec_t)
>+
>+	# X access, Home files
>+	manage_dirs_pattern($1_nsplugin_t,$1_mozilla_home_t,$1_mozilla_home_t)
>+	manage_files_pattern($1_nsplugin_t,$1_mozilla_home_t,$1_mozilla_home_t)
>+	manage_lnk_files_pattern($1_nsplugin_t,$1_mozilla_home_t,$1_mozilla_home_t)
>+	userdom_search_user_home_dirs($1,$1_nsplugin_t)
>+
>+	# Mozpluggerrc
>+	
>+	allow $1_nsplugin_t $2:fd use;
>+	allow $1_nsplugin_t $2:process sigchld;
>+	allow $1_nsplugin_t $2:unix_stream_socket connectto;
>+	allow $2 $1_nsplugin_t:fd use;
>+	allow $2 $1_nsplugin_t:shm { associate getattr };
>+	allow $2 $1_nsplugin_t:shm { unix_read unix_write };
>+	allow $2 $1_nsplugin_t:unix_stream_socket connectto;
>+
>+	# X access, Home files
>+	manage_dirs_pattern($2,$1_mozilla_home_t,$1_mozilla_home_t)
>+	manage_files_pattern($2,$1_mozilla_home_t,$1_mozilla_home_t)
>+	manage_lnk_files_pattern($2,$1_mozilla_home_t,$1_mozilla_home_t)
>+	relabel_dirs_pattern($2,$1_mozilla_home_t,$1_mozilla_home_t)
>+	relabel_files_pattern($2,$1_mozilla_home_t,$1_mozilla_home_t)
>+	relabel_lnk_files_pattern($2,$1_mozilla_home_t,$1_mozilla_home_t)
>+
>+	allow $1_nsplugin_t $2:process signull;
>+
>+	domain_auto_trans($2, nsplugin_exec_t, $1_nsplugin_t)
>+	# Unrestricted inheritance from the caller.
>+	allow $2 $1_nsplugin_t:process { noatsecure siginh rlimitinh };
>+
>+	# Allow the user domain to signal/ps.
>+	ps_process_pattern($2,$1_nsplugin_t)
>+	allow $2 $1_nsplugin_t:process signal_perms;
>+	
>+	kernel_read_kernel_sysctls($1_nsplugin_t)
>+	kernel_read_network_state($1_nsplugin_t)
>+	# Access /proc, sysctl
>+	kernel_read_system_state($1_nsplugin_t)
>+	kernel_read_net_sysctls($1_nsplugin_t)
>+
>+	# Look for plugins 
>+	corecmd_list_bin($1_nsplugin_t)
>+	# for bash - old mozilla binary
>+	corecmd_exec_shell($1_nsplugin_t)
>+	corecmd_exec_bin($1_nsplugin_t)
>+ 
>+
>+	# Browse the web, connect to printer
>+	corenet_non_ipsec_sendrecv($1_nsplugin_t)
>+	corenet_tcp_sendrecv_generic_if($1_nsplugin_t)
>+	corenet_raw_sendrecv_generic_if($1_nsplugin_t)
>+	corenet_tcp_sendrecv_all_nodes($1_nsplugin_t)
>+	corenet_raw_sendrecv_all_nodes($1_nsplugin_t)
>+	corenet_tcp_sendrecv_http_port($1_nsplugin_t)
>+	corenet_tcp_sendrecv_http_cache_port($1_nsplugin_t)
>+	corenet_tcp_sendrecv_ftp_port($1_nsplugin_t)
>+	corenet_tcp_sendrecv_ipp_port($1_nsplugin_t)
>+	corenet_tcp_connect_http_port($1_nsplugin_t)
>+	corenet_tcp_connect_http_cache_port($1_nsplugin_t)
>+	corenet_tcp_connect_ftp_port($1_nsplugin_t)
>+	corenet_tcp_connect_ipp_port($1_nsplugin_t)
>+	corenet_tcp_connect_generic_port($1_nsplugin_t)
>+	corenet_sendrecv_http_client_packets($1_nsplugin_t)
>+	corenet_sendrecv_http_cache_client_packets($1_nsplugin_t)
>+	corenet_sendrecv_ftp_client_packets($1_nsplugin_t)
>+	corenet_sendrecv_ipp_client_packets($1_nsplugin_t)
>+	corenet_sendrecv_generic_client_packets($1_nsplugin_t)
>+	# Should not need other ports
>+	corenet_dontaudit_tcp_sendrecv_generic_port($1_nsplugin_t)
>+	corenet_dontaudit_tcp_bind_generic_port($1_nsplugin_t)
>+
>+	dev_read_urand($1_nsplugin_t)
>+	dev_read_rand($1_nsplugin_t)
>+	dev_write_sound($1_nsplugin_t)
>+	dev_read_sound($1_nsplugin_t)
>+	dev_dontaudit_rw_dri($1_nsplugin_t)
>+	dev_getattr_sysfs_dirs($1_nsplugin_t)
>+
>+	files_read_etc_runtime_files($1_nsplugin_t)
>+	files_read_usr_files($1_nsplugin_t)
>+	files_read_etc_files($1_nsplugin_t)
>+	
>+	# /var/lib
>+	files_read_var_lib_files($1_nsplugin_t)
>+	
>+	# interacting with gstreamer
>+	files_read_var_files($1_nsplugin_t)
>+	files_read_var_symlinks($1_nsplugin_t)
>+ 	files_dontaudit_getattr_boot_dirs($1_nsplugin_t)
>+
>+	fs_search_auto_mountpoints($1_nsplugin_t)
>+	fs_list_inotifyfs($1_nsplugin_t)
>+	fs_rw_tmpfs_files($1_nsplugin_t)
>+
>+	term_dontaudit_getattr_pty_dirs($1_nsplugin_t)
>+	
>+	libs_use_ld_so($1_nsplugin_t)
>+	libs_use_lib_files($1_nsplugin_t)
>+	libs_use_shared_libs($1_nsplugin_t)
>+
>+	logging_send_syslog_msg($1_nsplugin_t)
>+
>+	miscfiles_read_fonts($1_nsplugin_t)
>+	miscfiles_read_localization($1_nsplugin_t)
>+
>+	# Browse the web, connect to printer
>+	sysnet_dns_name_resolve($1_nsplugin_t)
>+	sysnet_read_config($1_nsplugin_t)
>+	
>+	userdom_manage_user_home_content_dirs($1,$1_nsplugin_t)
>+	userdom_manage_user_home_content_files($1,$1_nsplugin_t)
>+	userdom_manage_user_home_content_symlinks($1,$1_nsplugin_t)
>+	userdom_manage_user_tmp_dirs($1,$1_nsplugin_t)
>+	userdom_manage_user_tmp_files($1,$1_nsplugin_t)
>+	userdom_manage_user_tmp_sockets($1,$1_nsplugin_t)
>+	
>+	xserver_dontaudit_read_xdm_tmp_files($1_nsplugin_t)
>+	xserver_dontaudit_getattr_xdm_tmp_sockets($1_nsplugin_t)
>+
>+	# Enable writing to /usr/lib
>+	allow $1_nsplugin_t lib_t:file { unlink create write execmod };
>+	allow $1_nsplugin_t lib_t:lnk_file { unlink create };
>+	allow $1_nsplugin_t lib_t:dir { write remove_name add_name };
>+
>+	# Enable lauching external "usecure" plug-ins
>+	allow $1_nsplugin_t self:process { execstack execmem };
>+	
>+
>+	tunable_policy(`allow_execmem',`
>+		allow $1_nsplugin_t self:process { execmem execstack };
>+	')
>+
>+	tunable_policy(`use_nfs_home_dirs',`
>+		fs_manage_nfs_dirs($1_nsplugin_t)
>+		fs_manage_nfs_files($1_nsplugin_t)
>+		fs_manage_nfs_symlinks($1_nsplugin_t)
>+	')
>+
>+	tunable_policy(`use_samba_home_dirs',`
>+		fs_manage_cifs_dirs($1_nsplugin_t)
>+		fs_manage_cifs_files($1_nsplugin_t)
>+		fs_manage_cifs_symlinks($1_nsplugin_t)
>+	')
>+
>+	optional_policy(`
>+		automount_dontaudit_getattr_tmp_dirs($1_nsplugin_t)
>+	')
>+
>+	optional_policy(`
>+		dbus_system_bus_client_template($1_nsplugin,$1_nsplugin_t)
>+		dbus_send_system_bus($1_nsplugin_t)
>+		dbus_user_bus_client_template($1,$1_nsplugin,$1_nsplugin_t)
>+		dbus_send_user_bus($1,$1_nsplugin_t)
>+	')
>+
>+	optional_policy(`
>+		gnome_stream_connect_gconf_template($1,$1_nsplugin_t)
>+	')
>+
>+	optional_policy(`
>+		java_domtrans_user_javaplugin($1, $1_nsplugin_t)
>+	')
>+
>+	optional_policy(`
>+		mplayer_domtrans_user_mplayer($1, $1_nsplugin_t)
>+		mplayer_read_user_home_files($1, $1_nsplugin_t)
>+	')
>+
>+	optional_policy(`
>+		nscd_socket_use($1_nsplugin_t)
>+	')
>+
>+	optional_policy(`
>+		thunderbird_domtrans_user_thunderbird($1, $1_nsplugin_t)
>+	')
>+
>+')
>+
>+########################################
>+## <summary>
>+##	Run nsplugin in user nsplugin domain.
>+## </summary>
>+## <desc>
>+##	
>+##	Run nsplugin in nsplugin domain.
>+##	
>+##	
>+##	This is a templated interface, and should only
>+##	be called from a per-userdomain template.
>+##	
>+## </desc>
>+## <param name="userdomain_prefix">
>+##	<summary>
>+##	The prefix of the user domain (e.g., user
>+##	is the prefix for user_t).
>+##	</summary>
>+## </param>
>+## <param name="domain">
>+##	<summary>
>+##	Domain allowed access.
>+##	</summary>
>+## </param>
>+#
>+template(`nsplugin_domtrans_user_nsplugin',`
>+	gen_require(`
>+		type $1_nsplugin_t, nsplugin_exec_t;
>+	')
>+
>+	domtrans_pattern($2, nsplugin_exec_t,$1_nsplugin_t)
>+')
>+
>+########################################
>+## <summary>
>+##	read/write nsplugin per user tcp_socket
>+## </summary>
>+## <desc>
>+##	
>+##	read/write nsplugin per user tcp_socket
>+##	
>+##	
>+##	This is a templated interface, and should only
>+##	be called from a per-userdomain template.
>+##	
>+## </desc>
>+## <param name="userdomain_prefix">
>+##	<summary>
>+##	The prefix of the user domain (e.g., user
>+##	is the prefix for user_t).
>+##	</summary>
>+## </param>
>+## <param name="domain">
>+##	<summary>
>+##	Domain allowed access.
>+##	</summary>
>+## </param>
>+#
>+template(`nsplugin_rw_user_tcp_sockets',`
>+	gen_require(`
>+		type $1_nsplugin_t;
>+	')
>+
>+	allow $2 $1_nsplugin_t:tcp_socket rw_socket_perms;
>+')
>--- /dev/null	2007-07-30 10:38:24.614755915 +0200
>+++ serefpolicy-2.6.4/policy/modules/admin/nsplugin.fc	2007-07-30 13:20:25.000000000 +0200
>@@ -0,0 +1,9 @@
>+#
>+# /lib
>+#
>+
>+/usr/lib(64)?/nspluginwrapper/np.* -- 	gen_context(system_u:object_r:nsplugin_exec_t,s0)
>+
>+/usr/lib(64)?/firefox[^/]*/plugin-configuration -- gen_context(system_u:object_r:nsplugin_exec_t,s0)
>+/usr/lib(64)?/seamonkey[^/]*/plugin-configuration -- gen_context(system_u:object_r:nsplugin_exec_t,s0)
>+
>--- /dev/null	2007-07-30 10:38:24.614755915 +0200
>+++ serefpolicy-2.6.4/policy/modules/admin/nsplugin.te	2007-07-27 11:55:43.000000000 +0200
>@@ -0,0 +1,10 @@
>+
>+policy_module(nsplugin,1.0.0)
>+
>+########################################
>+#
>+# Declarations
>+#
>+
>+type nsplugin_exec_t;
>+corecmd_executable_file(nsplugin_exec_t)

Actions: View | Diff

Attachments on bug 250249: 160313