Building a SELinux Policy Module

-Building a SELinux Policy Module +Full SELinux Policy Modules -Creating an Isolated Module +Checking Out an Isolated Module =20 +

+With the above in mind, we can now go one step further and investigate a= full +policy module, with both the type enforcement rules (.te fi= le), +file contexts (.fc) and interfaces (.if). +

+ +

+You should know that writing a module requires you to get intimate with = the +application. It isn't a matter of just hoping for the best: as a securit= y +administrator, you will be responsible for defining what accesses are al= lowed +and which not. If you forget one, the application might break under the = users' +hands. But if you add too much, you might grant privileges that can be a= bused +later on. And it will be a lot more difficult to track and remove privil= eges +later as you will be hesitating if the privilege is needed or not. +

+ +

+In this section, we will not divulge in how to write one. We have an exc= ellent +Gentoo Hardened = SELinux +Development resource that guides you in that. However, we will loo= k into +such a full module to explain the other aspects of policy development. +

+ + + + +Type Enforcement File + + +

+The .te file we wrote earlier is a type enforcement file= . +Its purpose is to define the access rules related to the module that you= are +building, but also - and more importantly - define new types (or even ro= les). +

+ +

+The example below is a snippet from a module for the skype application. +

+ +

+policy_module(skype, 1.0.0)
+
+type skype_t;
+type skype_exec_t;
+application_domain(skype_t, skype_exec_t)
+
+type skype_home_t;
+userdom_user_home_content(skype_home_t)
+
+manage_dirs_pattern(skype_t, skype_home_t, skype_home_t)
+manage_files_pattern(skype_t, skype_home_t, skype_home_t)
+

+ +

+In the above example, three new types are declared: skype_t (whic= h will +be used for the application), skype_exec_t (which is the label gi= ven to +the application binary) and skype_home_t (which will be used for = the +users' ~/.Skype location). Also, the skype_t domain = is given +some privileges with respect to the skype_home_t label (manage +directories and files). +

+ + + + +File Context File + + +

+In the .fc file (which stands for file context file)= the +module's resources (files, directories, sockets, ...) are defined. Once = the +module is loaded, these rules are added so that file system relabeling w= ill put +the correct context on the files. +

+ +

+The example below is a snippet from the skype modules' file context file= . +

+ +

+HOME_DIR/\.Skype(/.*)?    gen_context(system_u:object_r:skype_home_t,s0)
+/opt/skype/skype       -- gen_context(system_u:object_r:skype_exec_t,s0)
+/usr/bin/skype         -- gen_context(system_u:object_r:skype_exec_t,s0)
+

+ +

+The format of the file context file has the following syntax: +

+ +

+ The regular expression that matches the file(s) and directorie(s) af= fected + by that line +
+ An optional identifier to differentiate the type of files (file, dir= ectory, + socket, symbolic link, ...) +
+ A gen_context line that contains the context to assign to the= file(s) + and directorie(s) +

+ + + + +Interface File + + +

+In the .if file (for interface file) interfaces are = declared +which can be used by other modules. It is through interfaces that a nice= ly +defined policy can be built on top of other, existing policy modules. +

+ +

+One interface could be to allow users to call and execute an application= . For +instance, the following interface can be found in the skype module. +

+ +

+interface(`skype_role',`
+        gen_require(`
+                type skype_t, skype_exec_t, skype_tmpfs_t, skype_home_t;
+        ')
+
+        role $1 types skype_t;
+
+        domtrans_pattern($2, skype_exec_t, skype_t)
+
+        allow $2 skype_t:process { ptrace signal_perms };
+
+        manage_dirs_pattern($2, skype_home_t, skype_home_t)
+        manage_files_pattern($2, skype_home_t, skype_home_t)
+        manage_lnk_files_pattern($2, skype_home_t, skype_home_t)
+
+        relabel_dirs_pattern($2, skype_home_t, skype_home_t)
+        relabel_files_pattern($2, skype_home_t, skype_home_t)
+        relabel_lnk_files_pattern($2, skype_home_t, skype_home_t)
+
+        ps_process_pattern($2, skype_t)
+')
+

+ +

+Through this skype_role, we can then allow users to call skype, a= s can be +found in the unprivuser.te file (which defines the user_t d= omain): +

+ +

+optional_policy(`
+	skype_role(user_r, user_t)
+')
+

=20