Attachment 646112 Details for Bug 877232 – Type enforcement policy for firefox that allows transition to mozilla_t

Type enforcement policy for firefox that allows transition to mozilla_t

file_877232.txt (text/plain), 1.96 KB, created by Todd Garrison on 2012-11-16 01:18:20 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Todd Garrison

Created: 2012-11-16 01:18:20 UTC

Size: 1.96 KB

patch

obsolete

>module firefox 1.10;
>
>require {
>        class dir read;
>        class file { { getattr open read execute execute_no_trans unlink ioctl entrypoint } ioctl lock };
>        class filesystem getattr;
>        class filesystem quotaget;
>        class process { transition signull };
>        class sem { unix_read read write unix_write associate };
>        class sock_file write;
>        class unix_stream_socket connectto;
>        role unconfined_r;
>        type alsa_etc_rw_t;
>        type fs_t;
>        type mozilla_exec_t;
>        type mozilla_plugin_exec_t;
>        type mozilla_plugin_t;
>        type mozilla_t;
>        type sysfs_t;
>        type tmpfs_t;
>        type unconfined_t;
>        type user_tmpfs_t;
>        type user_tmp_t;
>}
>
># Access missing from the mozilla policy:
>allow mozilla_t alsa_etc_rw_t:file { read getattr open };
>allow mozilla_t fs_t:filesystem { quotaget getattr };
>allow mozilla_t mozilla_plugin_exec_t:file { read execute open getattr execute_no_trans };
>allow mozilla_t mozilla_plugin_t:sem { unix_read read write unix_write associate };
>allow mozilla_t sysfs_t:dir read;
>allow mozilla_t sysfs_t:file { read getattr open };
>allow mozilla_t tmpfs_t:filesystem getattr;
>allow mozilla_t unconfined_t:process signull;
>allow mozilla_t unconfined_t:unix_stream_socket connectto;
>allow mozilla_t user_tmpfs_t:file unlink;
>allow mozilla_t user_tmp_t:sock_file write;
>
># Needed to transition from unconfined to mozilla domains:
>allow unconfined_r object_r;
>allow unconfined_t mozilla_t:process transition;
>role unconfined_r types mozilla_t;
>
># Needed to transition from mozilla to mozilla_plugin domains:
>allow mozilla_t mozilla_plugin_t:process transition;
>role object_r types mozilla_plugin_t;
>
>bool firefox_protect true;
>if (firefox_protect) {
>        # Setup the transitions
>        type_transition unconfined_t mozilla_exec_t:process mozilla_t;
>        type_transition mozilla_t mozilla_plugin_exec_t:process mozilla_plugin_t;
>}

Actions: View

Attachments on bug 877232: 646112