* [gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/roles/, policy/modules/apps/
@ 2019-02-10 4:14 Jason Zaman
0 siblings, 0 replies; 2+ messages in thread
From: Jason Zaman @ 2019-02-10 4:14 UTC (permalink / raw
To: gentoo-commits
commit: 60e0d1b33e0be37edd4e8971e3b2cd67966574ab
Author: Russell Coker <russell <AT> coker <DOT> com <DOT> au>
AuthorDate: Mon Jan 28 08:46:49 2019 +0000
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Sun Feb 10 04:11:25 2019 +0000
URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=60e0d1b3
chromium
There are several nacl binaries that need labels.
Put an ifdef debian for some chromium paths.
Git policy misses chromium_role() lines, were they in another patch that was
submitted at the same time?
I don't know what this is for but doesn't seem harmful to allow it:
type=PROCTITLE msg=audit(28/01/19 19:31:42.361:3218) : proctitle=/bin/bash /usr/bin/google-chrome
type=SYSCALL msg=audit(28/01/19 19:31:42.361:3218) : arch=x86_64 syscall=openat success=yes exit=3 a0=0xffffff9c a1=0x563328f7b590 a2=O_WRONLY|O_CREAT|O_TRUNC a3=0x1b6 items=0 ppid=5158 pid=5166 auid=test uid=test gid=test euid=test suid=test fsuid=test egid=test sgid=test fsgid=test tty=pts7 ses=232 comm=google-chrome exe=/bin/bash subj=user_u:user_r:chromium_t:s0 key=(null)
type=AVC msg=audit(28/01/19 19:31:42.361:3218) : avc: granted { associate } for pid=5166 comm=google-chrome name=63 scontext=user_u:object_r:chromium_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=filesystem
type=AVC msg=audit(28/01/19 19:31:42.361:3218) : avc: granted { create } for pid=5166 comm=google-chrome name=63 scontext=user_u:user_r:chromium_t:s0 tcontext=user_u:object_r:chromium_t:s0 tclass=file
type=AVC msg=audit(28/01/19 19:31:42.361:3218) : avc: granted { add_name } for pid=5166 comm=google-chrome name=63 scontext=user_u:user_r:chromium_t:s0 tcontext=user_u:user_r:chromium_t:s0 tclass=dir
Allow domain_use_interactive_fds() for running via ssh -X.
Allow managing xdg data, cache, and config.
Allow reading public data from apt and dpkg, probably from lsb_release or some
other shell script.
How does the whold naclhelper thing work anyway? I'm nervous about process
share access involving chromium_sandbox_t, is that really what we want?
Added lots of other stuff like searching cgroup dirs etc.
Signed-off-by: Jason Zaman <jason <AT> perfinion.com>
policy/modules/apps/chromium.fc | 7 ++++++-
policy/modules/apps/chromium.te | 32 +++++++++++++++++++++++++++-----
policy/modules/roles/staff.te | 4 ++++
policy/modules/roles/sysadm.te | 4 ++++
policy/modules/roles/unprivuser.te | 4 ++++
5 files changed, 45 insertions(+), 6 deletions(-)
diff --git a/policy/modules/apps/chromium.fc b/policy/modules/apps/chromium.fc
index 534235dc..58a6cb45 100644
--- a/policy/modules/apps/chromium.fc
+++ b/policy/modules/apps/chromium.fc
@@ -2,7 +2,7 @@
/opt/google/chrome/chrome_sandbox -- gen_context(system_u:object_r:chromium_sandbox_exec_t,s0)
/opt/google/chrome/chrome-sandbox -- gen_context(system_u:object_r:chromium_sandbox_exec_t,s0)
/opt/google/chrome/google-chrome -- gen_context(system_u:object_r:chromium_exec_t,s0)
-/opt/google/chrome/nacl_helper_bootstrap -- gen_context(system_u:object_r:chromium_naclhelper_exec_t,s0)
+/opt/google/chrome/nacl_.* -- gen_context(system_u:object_r:chromium_naclhelper_exec_t,s0)
/opt/google/chrome/libudev.so.0 gen_context(system_u:object_r:lib_t,s0)
/opt/google/chrome-beta/chrome -- gen_context(system_u:object_r:chromium_exec_t,s0)
@@ -19,9 +19,14 @@
/opt/google/chrome-unstable/nacl_helper_bootstrap -- gen_context(system_u:object_r:chromium_naclhelper_exec_t,s0)
/opt/google/chrome-unstable/libudev.so.0 gen_context(system_u:object_r:lib_t,s0)
+ifdef(`distro_debian',`
+/usr/lib/chromium/chromium -- gen_context(system_u:object_r:chromium_exec_t,s0)
+/usr/lib/chromium/chrome-sandbox -- gen_context(system_u:object_r:chromium_sandbox_exec_t,s0)
+', `
/usr/lib/chromium-browser/chrome -- gen_context(system_u:object_r:chromium_exec_t,s0)
/usr/lib/chromium-browser/chrome_sandbox -- gen_context(system_u:object_r:chromium_sandbox_exec_t,s0)
/usr/lib/chromium-browser/chrome-sandbox -- gen_context(system_u:object_r:chromium_sandbox_exec_t,s0)
+')
/usr/lib/chromium-browser/chromium-launcher\.sh -- gen_context(system_u:object_r:chromium_exec_t,s0)
/usr/lib/chromium-browser/nacl_helper_bootstrap -- gen_context(system_u:object_r:chromium_naclhelper_exec_t,s0)
diff --git a/policy/modules/apps/chromium.te b/policy/modules/apps/chromium.te
index 59c75491..7a18d814 100644
--- a/policy/modules/apps/chromium.te
+++ b/policy/modules/apps/chromium.te
@@ -94,8 +94,8 @@ allow chromium_t chromium_renderer_t:shm rw_shm_perms;
allow chromium_t chromium_renderer_t:unix_dgram_socket { read write };
allow chromium_t chromium_renderer_t:unix_stream_socket { read write };
-allow chromium_t chromium_sandbox_t:unix_dgram_socket { read write };
-allow chromium_t chromium_sandbox_t:unix_stream_socket { read write };
+allow chromium_t chromium_sandbox_t:unix_dgram_socket { getattr read write };
+allow chromium_t chromium_sandbox_t:unix_stream_socket { getattr read write };
allow chromium_t chromium_naclhelper_t:process { share };
@@ -149,6 +149,7 @@ dev_rw_xserver_misc(chromium_t)
dev_map_xserver_misc(chromium_t)
domain_dontaudit_search_all_domains_state(chromium_t)
+domain_use_interactive_fds(chromium_t)
files_list_home(chromium_t)
files_search_home(chromium_t)
@@ -159,12 +160,17 @@ files_read_etc_files(chromium_t)
files_dontaudit_getattr_all_dirs(chromium_t)
fs_dontaudit_getattr_xattr_fs(chromium_t)
+fs_getattr_tmpfs(chromium_t)
+fs_search_cgroup_dirs(chromium_t)
miscfiles_read_all_certs(chromium_t)
miscfiles_read_localization(chromium_t)
sysnet_dns_name_resolve(chromium_t)
+# for /run/udev/data/*
+udev_read_pid_files(chromium_t)
+
userdom_user_content_access_template(chromium, chromium_t)
userdom_dontaudit_list_user_home_dirs(chromium_t)
# Debugging. Also on user_tty_device_t if X is started through "startx" for instance
@@ -195,6 +201,8 @@ tunable_policy(`chromium_rw_usb_dev',`
tunable_policy(`chromium_read_system_info',`
kernel_read_kernel_sysctls(chromium_t)
# Memory optimizations & optimizations based on OS/version
+ kernel_read_crypto_sysctls(chromium_t)
+ kernel_read_kernel_sysctls(chromium_t)
kernel_read_system_state(chromium_t)
# Debugging (sys/kernel/debug) and device information (sys/bus and sys/devices).
@@ -237,6 +245,13 @@ optional_policy(`
')
')
+optional_policy(`
+ apt_read_cache(chromium_t)
+ apt_read_db(chromium_t)
+ dpkg_exec(chromium_t)
+ dpkg_read_db(chromium_t)
+')
+
ifdef(`use_alsa',`
optional_policy(`
alsa_domain(chromium_t, chromium_tmpfs_t)
@@ -309,23 +324,27 @@ allow chromium_sandbox_t chromium_t:dir list_dir_perms;
allow chromium_sandbox_t chromium_t:lnk_file read_lnk_file_perms;
allow chromium_sandbox_t chromium_t:file rw_file_perms;
-allow chromium_sandbox_t chromium_t:unix_stream_socket { read write };
-allow chromium_sandbox_t chromium_t:unix_dgram_socket { read write };
+allow chromium_sandbox_t chromium_t:unix_stream_socket { getattr read write };
+allow chromium_sandbox_t chromium_t:unix_dgram_socket { getattr read write };
kernel_list_proc(chromium_sandbox_t)
domain_dontaudit_read_all_domains_state(chromium_sandbox_t)
+domain_use_interactive_fds(chromium_sandbox_t)
userdom_use_user_ptys(chromium_sandbox_t)
chromium_domtrans(chromium_sandbox_t)
+domtrans_pattern(chromium_sandbox_t, chromium_naclhelper_exec_t, chromium_naclhelper_t)
+allow chromium_sandbox_t chromium_naclhelper_t:process share;
##########################################
#
# Chromium nacl helper local policy
#
-allow chromium_naclhelper_t chromium_t:unix_stream_socket { read write };
+allow chromium_naclhelper_t chromium_t:unix_stream_socket { getattr read write };
+allow chromium_naclhelper_t chromium_sandbox_t:unix_stream_socket { getattr read write };
domain_mmap_low_uncond(chromium_naclhelper_t)
@@ -338,3 +357,6 @@ tunable_policy(`chromium_read_system_info',`
kernel_dontaudit_read_kernel_sysctl(chromium_naclhelper_t)
kernel_dontaudit_read_system_state(chromium_naclhelper_t)
')
+
+dev_read_sysfs(chromium_naclhelper_t)
+dev_read_urand(chromium_naclhelper_t)
diff --git a/policy/modules/roles/staff.te b/policy/modules/roles/staff.te
index 7b4a780a..2321ecf0 100644
--- a/policy/modules/roles/staff.te
+++ b/policy/modules/roles/staff.te
@@ -81,6 +81,10 @@ ifndef(`distro_redhat',`
cdrecord_role(staff_r, staff_t)
')
+ optional_policy(`
+ chromium_role(staff_r, staff_t)
+ ')
+
optional_policy(`
cron_role(staff_r, staff_t)
')
diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
index 6960fc31..060c4396 100644
--- a/policy/modules/roles/sysadm.te
+++ b/policy/modules/roles/sysadm.te
@@ -1271,6 +1271,10 @@ ifndef(`distro_redhat',`
cdrecord_role(sysadm_r, sysadm_t)
')
+ optional_policy(`
+ chromium_role(sysadm_r, sysadm_t)
+ ')
+
optional_policy(`
cron_admin_role(sysadm_r, sysadm_t)
')
diff --git a/policy/modules/roles/unprivuser.te b/policy/modules/roles/unprivuser.te
index 209c904b..02e3de3b 100644
--- a/policy/modules/roles/unprivuser.te
+++ b/policy/modules/roles/unprivuser.te
@@ -49,6 +49,10 @@ ifndef(`distro_redhat',`
cdrecord_role(user_r, user_t)
')
+ optional_policy(`
+ chromium_role(user_r, user_t)
+ ')
+
optional_policy(`
cron_role(user_r, user_t)
')
^ permalink raw reply related [flat|nested] 2+ messages in thread
* [gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/roles/, policy/modules/apps/
@ 2021-11-21 3:00 Jason Zaman
0 siblings, 0 replies; 2+ messages in thread
From: Jason Zaman @ 2021-11-21 3:00 UTC (permalink / raw
To: gentoo-commits
commit: 90ed6629790f8ed980e3419b017c49dc6b6bdce9
Author: Jason Zaman <perfinion <AT> gentoo <DOT> org>
AuthorDate: Sat Nov 20 23:32:17 2021 +0000
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Sun Nov 21 01:09:03 2021 +0000
URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=90ed6629
pulseaudio: Remove gentoo-specific interfaces
pulseaudio_client_domain and pulseaudio_role were changed upstream to
have more args. pulseaudio_client_domain was previously deprecated and
unused in gentoo.
Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org>
policy/modules/apps/pulseaudio.if | 26 --------------------------
policy/modules/roles/staff.te | 4 ----
policy/modules/roles/unprivuser.te | 4 ----
3 files changed, 34 deletions(-)
diff --git a/policy/modules/apps/pulseaudio.if b/policy/modules/apps/pulseaudio.if
index 1796b771..b2d2f1d4 100644
--- a/policy/modules/apps/pulseaudio.if
+++ b/policy/modules/apps/pulseaudio.if
@@ -427,29 +427,3 @@ interface(`pulseaudio_rw_tmpfs_files',`
fs_search_tmpfs($1)
rw_files_pattern($1, pulseaudio_tmpfs_t, pulseaudio_tmpfs_t)
')
-
-# Below are Gentoo specifics but ifdef distro_gentoo cannot be used in interfaces
-
-########################################
-## <summary>
-## Mark the specified domain as a PulseAudio client domain
-## and the related tmpfs file type as a (shared) PulseAudio tmpfs
-## file type used for the shared memory access
-## </summary>
-## <param name="domain">
-## <summary>
-## Domain to become a PulseAudio client domain
-## </summary>
-## </param>
-## <param name="tmpfstype">
-## <summary>
-## Tmpfs type used for shared memory of the given domain
-## </summary>
-## </param>
-#
-interface(`pulseaudio_client_domain',`
- refpolicywarn(`$0($*) has been deprecated')
-
- pulseaudio_domtrans($1)
- pulseaudio_tmpfs_content($2)
-')
diff --git a/policy/modules/roles/staff.te b/policy/modules/roles/staff.te
index 3ac0650c..29f68027 100644
--- a/policy/modules/roles/staff.te
+++ b/policy/modules/roles/staff.te
@@ -260,10 +260,6 @@ ifdef(`distro_gentoo',`
pan_role(staff_r, staff_t)
')
- optional_policy(`
- pulseaudio_role(staff_r, staff_t)
- ')
-
optional_policy(`
rtorrent_role(staff_r, staff_t)
')
diff --git a/policy/modules/roles/unprivuser.te b/policy/modules/roles/unprivuser.te
index 249215b4..32c928d7 100644
--- a/policy/modules/roles/unprivuser.te
+++ b/policy/modules/roles/unprivuser.te
@@ -239,10 +239,6 @@ ifdef(`distro_gentoo',`
pan_role(user_r, user_t)
')
- optional_policy(`
- pulseaudio_role(user_r, user_t)
- ')
-
optional_policy(`
rtorrent_role(user_r, user_t)
')
^ permalink raw reply related [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-11-21 3:00 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2021-11-21 3:00 [gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/roles/, policy/modules/apps/ Jason Zaman
-- strict thread matches above, loose matches on Subject: below --
2019-02-10 4:14 Jason Zaman
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox