tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/dhcp.te

29 lines
1.1 KiB
Text
Raw Normal View History

dhcp policy.
2012-08-15 12:25:14 +02:00
type dhcp, domain;
type dhcp_exec, exec_type, file_type;
type dhcp_data_file, file_type, data_file_type;
init_daemon_domain(dhcp)
Revert "Revert "Various minor policy fixes based on CTS."" This reverts commit ba84bf1dec64d745b6efc516799b2c722a672cd9 Hidden dependency resolved. Change-Id: I9f0844f643abfda8405db2c722a36c847882c392
2013-03-26 19:00:13 +01:00
net_domain(dhcp)
Confine dhcp, but leave it permissive for now. Change-Id: I11b185ff539915174bd2da53bfaa2cad87173008 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-29 19:42:35 +01:00
allow dhcp cgroup:dir { create write add_name };
allow dhcp self:capability { setgid setuid net_admin net_raw net_bind_service };
allow dhcp self:packet_socket create_socket_perms;
Clean up socket rules. Replace * or any permission set containing create with create_socket_perms or create_stream_socket_perms. Add net_domain() to all domains using network sockets and delete rules already covered by domain.te or net.te. For netlink_route_socket, only nlmsg_write needs to be separately granted to specific domains that are permitted to modify the routing table. Clarification: read/write permissions are just ability to perform read/recv() or write/send() on the socket, whereas nlmsg_read/ nlmsg_write permissions control ability to observe or modify the underlying kernel state accessed via the socket. See security/selinux/nlmsgtab.c in the kernel for the mapping of netlink message types to nlmsg_read or nlmsg_write. Delete legacy rule for b/12061011. This change does not touch any rules where only read/write were allowed to a socket created by another domain (inherited across exec or received across socket or binder IPC). We may wish to rewrite some or all of those rules with the rw_socket_perms macro but that is a separate change. Change-Id: Ib0637ab86f6d388043eff928e5d96beb02e5450e Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-02-24 21:06:11 +01:00
allow dhcp self:netlink_route_socket nlmsg_write;
Confine dhcp, but leave it permissive for now. Change-Id: I11b185ff539915174bd2da53bfaa2cad87173008 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-29 19:42:35 +01:00
allow dhcp shell_exec:file rx_file_perms;
allow dhcp system_file:file rx_file_perms;
Create proc_net type for /proc/sys/net entries. /proc/sys/net could use its own type to help distinguish among some of the proc access rules. Fix dhcp and netd because of this. Change-Id: I6e16cba660f07bc25f437bf43e1eba851a88d538 Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2014-01-07 19:46:56 +01:00
# For /proc/sys/net/ipv4/conf/*/promote_secondaries
allow dhcp proc_net:file write;
Confine dhcp, but leave it permissive for now. Change-Id: I11b185ff539915174bd2da53bfaa2cad87173008 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-29 19:42:35 +01:00
allow dhcp system_prop:property_service set ;
unix_socket_connect(dhcp, property, init)
allow dhcp owntty_device:chr_file rw_file_perms;
dhcp policy.
2012-08-15 12:25:14 +02:00
type_transition dhcp system_data_file:{ dir file } dhcp_data_file;
Confine dhcp, but leave it permissive for now. Change-Id: I11b185ff539915174bd2da53bfaa2cad87173008 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-29 19:42:35 +01:00
allow dhcp dhcp_data_file:dir create_dir_perms;
allow dhcp dhcp_data_file:file create_file_perms;
# PAN connections
allow dhcp netd:fd use;
allow dhcp netd:fifo_file rw_file_perms;
allow dhcp netd:{ dgram_socket_class_set unix_stream_socket } { read write };
allow dhcp netd:{ netlink_kobject_uevent_socket netlink_route_socket netlink_nflog_socket } { read write };
Reference in a new issue Copy permalink