platform_system_sepolicy/racoon.te

# IKE key management daemon
type racoon, domain, domain_deprecated;
type racoon_exec, exec_type, file_type;

init_daemon_domain(racoon)
typeattribute racoon mlstrustedsubject;

net_domain(racoon)

binder_use(racoon)

allow racoon tun_device:chr_file r_file_perms;
allow racoon cgroup:dir { add_name create };
allow racoon kernel:system module_request;

allow racoon self:key_socket create_socket_perms_no_ioctl;
allow racoon self:tun_socket create_socket_perms_no_ioctl;
allow racoon self:capability { net_admin net_bind_service net_raw setuid };

# XXX: should we give ip-up-vpn its own label (currently racoon domain)
allow racoon system_file:file rx_file_perms;
allow racoon vpn_data_file:file create_file_perms;
allow racoon vpn_data_file:dir w_dir_perms;

use_keystore(racoon)

# Racoon (VPN) has a restricted set of permissions from the default.
allow racoon keystore:keystore_key {
	get
	sign
	verify
};
racoon policy. Initial policy for racoon (IKE key management). Signed-off-by: Robert Craig <rpcraig@tycho.ncsc.mil> Change-Id: If1e344f39ea914e42afbaa021b272ba1b7113479 2013-01-07 15:21:18 +01:00			`# IKE key management daemon`
Create attribute for moving perms out of domain Motivation: Domain is overly permissive. Start removing permissions from domain and assign them to the domain_deprecated attribute. Domain_deprecated and domain can initially be assigned to all domains. The goal is to not assign domain_deprecated to new domains and to start removing domain_deprecated where it is not required or reassigning the appropriate permissions to the inheriting domain when necessary. Bug: 25433265 Change-Id: I8b11cb137df7bdd382629c98d916a73fe276413c 2015-11-03 18:54:39 +01:00			`type racoon, domain, domain_deprecated;`
racoon policy. Initial policy for racoon (IKE key management). Signed-off-by: Robert Craig <rpcraig@tycho.ncsc.mil> Change-Id: If1e344f39ea914e42afbaa021b272ba1b7113479 2013-01-07 15:21:18 +01:00			`type racoon_exec, exec_type, file_type;`

Make racoon permissive or unconfined. Also add allow rules from our policy. Change-Id: Id480eb7c8cd4e5544a1ec46cb39a55abc653ddb9 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> 2013-10-29 19:42:38 +01:00			`init_daemon_domain(racoon)`
			`typeattribute racoon mlstrustedsubject;`

Clean up socket rules. Replace * or any permission set containing create with create_socket_perms or create_stream_socket_perms. Add net_domain() to all domains using network sockets and delete rules already covered by domain.te or net.te. For netlink_route_socket, only nlmsg_write needs to be separately granted to specific domains that are permitted to modify the routing table. Clarification: read/write permissions are just ability to perform read/recv() or write/send() on the socket, whereas nlmsg_read/ nlmsg_write permissions control ability to observe or modify the underlying kernel state accessed via the socket. See security/selinux/nlmsgtab.c in the kernel for the mapping of netlink message types to nlmsg_read or nlmsg_write. Delete legacy rule for b/12061011. This change does not touch any rules where only read/write were allowed to a socket created by another domain (inherited across exec or received across socket or binder IPC). We may wish to rewrite some or all of those rules with the rw_socket_perms macro but that is a separate change. Change-Id: Ib0637ab86f6d388043eff928e5d96beb02e5450e Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> 2014-02-24 21:06:11 +01:00			`net_domain(racoon)`

Deduplicate binder_call rules. A number of binder_call rules are duplicated by other rules written in terms of attributes/sets (e.g. appdomain, binderservicedomain). Get rid of the duplicates. Also use binder_use() in racoon.te rather than manually writing the base rule for communicating with the servicemanager. Change-Id: I5a459cc2154b1466bcde6eccef253dfcdcb44e0a Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> 2014-02-26 22:46:33 +01:00			`binder_use(racoon)`
Make racoon permissive or unconfined. Also add allow rules from our policy. Change-Id: Id480eb7c8cd4e5544a1ec46cb39a55abc653ddb9 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> 2013-10-29 19:42:38 +01:00
			`allow racoon tun_device:chr_file r_file_perms;`
			`allow racoon cgroup:dir { add_name create };`
			`allow racoon kernel:system module_request;`

Enforce ioctl command whitelisting on all sockets Remove the ioctl permission for most socket types. For others, such as tcp/udp/rawip/unix_dgram/unix_stream set a default unprivileged whitelist that individual domains may extend (except where neverallowed like untrusted_app). Enforce via a neverallowxperm rule. Change-Id: I15548d830f8eff1fd4d64005c5769ca2be8d4ffe 2016-05-17 06:12:17 +02:00			`allow racoon self:key_socket create_socket_perms_no_ioctl;`
			`allow racoon self:tun_socket create_socket_perms_no_ioctl;`
Make racoon permissive or unconfined. Also add allow rules from our policy. Change-Id: Id480eb7c8cd4e5544a1ec46cb39a55abc653ddb9 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> 2013-10-29 19:42:38 +01:00			`allow racoon self:capability { net_admin net_bind_service net_raw setuid };`

			`# XXX: should we give ip-up-vpn its own label (currently racoon domain)`
			`allow racoon system_file:file rx_file_perms;`
			`allow racoon vpn_data_file:file create_file_perms;`
			`allow racoon vpn_data_file:dir w_dir_perms;`
Adding policies for KeyStore MAC. Add keystore_key class and an action for each action supported by keystore. Add policies that replicate the access control that already exists in keystore. Add auditallow rules for actions not known to be used frequently. Add macro for those domains wishing to access keystore. Change-Id: Iddd8672b9e9b72b45ee208e6eda608cc9dc61edc 2014-06-17 23:58:52 +02:00
			`use_keystore(racoon)`

			`# Racoon (VPN) has a restricted set of permissions from the default.`
			`allow racoon keystore:keystore_key {`
			`get`
			`sign`
			`verify`
			`};`