Skip to content

Commit ed9e2c9

Browse files
pebenitopebenito
authored
Merge pull request #499 from 0xC0ncord/udica-templates
Add udica templates
2 parents 8f4ca1f + 082fbdf commit ed9e2c9

File tree

11 files changed

+307
-1
lines changed

11 files changed

+307
-1
lines changed

‎.github/workflows/tests.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -151,4 +151,5 @@ jobs:
151151
make install-headers
152152
make install-src
153153
make install-docs
154+
make install-udica-templates
154155
make install-appconfig

‎Makefile‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -133,6 +133,9 @@ htmldir := $(LOCAL_ROOT)/doc/html
133133
doctmpdir := $(LOCAL_ROOT)/doc/tmp
134134
endif
135135

136+
# udica templates path
137+
udicatemplates := udica-templates
138+
136139
# config file paths
137140
globaltun := $(poldir)/global_tunables
138141
globalbool := $(poldir)/global_booleans
@@ -167,6 +170,7 @@ sharedir := $(prefix)/share/selinux
167170
modpkgdir := $(sharedir)/$(strip $(NAME))
168171
headerdir := $(modpkgdir)/include
169172
docsdir := $(prefix)/share/doc/$(PKGNAME)
173+
udicatemplatesdir := $(prefix)/share/udica/templates
170174

171175
# enable MLS if requested.
172176
ifeq "$(TYPE)" "mls"
@@ -590,6 +594,15 @@ install-src:
590594
mkdir -p $(srcpath)/policy
591595
cp -R . $(srcpath)/policy
592596

597+
########################################
598+
#
599+
# Install udica templates
600+
#
601+
install-udica-templates:
602+
@mkdir -p $(udicatemplatesdir)
603+
@echo "Installing udica templates"
604+
$(verbose) $(INSTALL) -m 644 $(wildcard $(udicatemplates)/*) $(udicatemplatesdir)
605+
593606
########################################
594607
#
595608
# Generate tags file
@@ -671,4 +684,4 @@ ifneq ($(generated_fc),)
671684
endif
672685
endif
673686

674-
.PHONY: install-src install-appconfig install-headers build-interface-db generate xml conf html bare tags
687+
.PHONY: install-src install-appconfig install-headers install-udica-templates build-interface-db generate xml conf html bare tags

‎udica-templates/base_container.cil‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
;;
2+
;; Permission sets definitions
3+
;;
4+
5+
(classpermission search_dir_perms)
6+
(classpermissionset search_dir_perms (dir (getattr search)))
7+
8+
(classpermission list_dir_perms)
9+
(classpermissionset list_dir_perms (dir (getattr search open read lock ioctl)))
10+
11+
(classpermission rw_dir_perms)
12+
(classpermissionset rw_dir_perms (dir (open read getattr lock search ioctl add_name remove_name write)))
13+
14+
(classpermission manage_dir_perms)
15+
(classpermissionset manage_dir_perms (dir (create open getattr setattr read write link unlink rename search add_name remove_name reparent rmdir lock ioctl)))
16+
17+
(classpermission rw_chr_file_perms)
18+
(classpermissionset rw_chr_file_perms (chr_file (getattr open read write append ioctl lock)))
19+
20+
(classpermission read_file_perms)
21+
(classpermissionset read_file_perms (file (getattr open read lock ioctl)))
22+
23+
(classpermission rw_file_perms)
24+
(classpermissionset rw_file_perms (file (open getattr read write append ioctl lock)))
25+
26+
(classpermission manage_file_perms)
27+
(classpermissionset manage_file_perms (file (create open getattr setattr read write append rename link unlink ioctl lock)))
28+
29+
(classpermission exec_file_perms)
30+
(classpermissionset exec_file_perms (file (getattr open map read execute ioctl execute_no_trans)))
31+
32+
(classpermission read_lnk_file_perms)
33+
(classpermissionset read_lnk_file_perms (lnk_file (getattr read)))
34+
35+
(classpermission rw_lnk_file_perms)
36+
(classpermissionset rw_lnk_file_perms (lnk_file (getattr read write lock ioctl)))
37+
38+
(classpermission manage_lnk_file_perms)
39+
(classpermissionset manage_lnk_file_perms (lnk_file (create read write getattr setattr link unlink rename ioctl lock)))
40+
41+
(classpermission write_sock_file_perms)
42+
(classpermissionset write_sock_file_perms (sock_file (getattr write open append)))
43+
44+
(classpermission manage_sock_file_perms)
45+
(classpermissionset manage_sock_file_perms (sock_file (create open getattr setattr read write rename link unlink ioctl lock append)))
46+
47+
(classpermission create_tcp_socket_perms)
48+
(classpermissionset create_tcp_socket_perms (tcp_socket (ioctl read getattr write setattr append bind connect getopt setopt shutdown listen accept)))
49+
50+
(classpermission create_udp_socket_perms)
51+
(classpermissionset create_udp_socket_perms (udp_socket (ioctl read getattr write setattr append bind connect getopt setopt shutdown)))
52+
53+
(classpermission create_sctp_socket_perms)
54+
(classpermissionset create_sctp_socket_perms (sctp_socket (ioctl read getattr write setattr append bind connect getopt setopt shutdown)))
55+
56+
(classpermission rw_shm_perms)
57+
(classpermissionset rw_shm_perms (shm (lock associate getattr read unix_read unix_write write)))
58+
59+
;;
60+
;; Base container policy
61+
;;
62+
63+
(block container
64+
(blockabstract container)
65+
66+
(type process)
67+
(type socket)
68+
69+
(roletype system_r process)
70+
(typeattributeset domain (process))
71+
(typeattributeset container_domain (process))
72+
(typeattributeset mcs_constrained_type (process))
73+
(typeattributeset file_type (socket))
74+
75+
(allow process socket manage_sock_file_perms)
76+
(allow container_engine_domain process (key (create search setattr view)))
77+
)

‎udica-templates/config_container.cil‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
(block config_container
2+
(blockabstract config_container)
3+
4+
(optional config_container_optional
5+
(allow process configfile list_dir_perms)
6+
(allow process configfile read_file_perms)
7+
(allow process configfile read_lnk_file_perms)
8+
)
9+
)
10+
11+
(block config_rw_container
12+
(blockabstract config_rw_container)
13+
14+
(blockinherit config_container)
15+
16+
(optional config_rw_container_optional
17+
(allow process configfile rw_dir_perms)
18+
(allow process configfile rw_file_perms)
19+
(allow process configfile rw_lnk_file_perms)
20+
)
21+
)
22+
23+
(block config_manage_container
24+
(blockabstract config_manage_container)
25+
26+
(blockinherit config_rw_container)
27+
28+
(optional config_manage_container_optional
29+
(allow process configfile manage_dir_perms)
30+
(allow process configfile manage_file_perms)
31+
(allow process configfile manage_lnk_file_perms)
32+
)
33+
)

‎udica-templates/home_container.cil‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
(block home_container
2+
(blockabstract home_container)
3+
4+
(optional home_container_optional
5+
(allow process process (capability (dac_override)))
6+
7+
(allow process home_root_t list_dir_perms)
8+
(allow process user_home_dir_t list_dir_perms)
9+
(allow process user_home_t list_dir_perms)
10+
11+
(allow process user_home_dir_t read_file_perms)
12+
(allow process user_home_t read_file_perms)
13+
)
14+
)
15+
16+
(block home_rw_container
17+
(blockabstract home_rw_container)
18+
19+
(blockinherit home_container)
20+
21+
(optional home_rw_container_optional
22+
(allow process home_root_t rw_dir_perms)
23+
(allow process user_home_dir_t rw_dir_perms)
24+
(allow process user_home_t rw_dir_perms)
25+
26+
(allow process user_home_dir_t rw_file_perms)
27+
(allow process user_home_t rw_file_perms)
28+
)
29+
)
30+
31+
(block home_manage_container
32+
(blockabstract home_manage_container)
33+
34+
(blockinherit home_rw_container)
35+
36+
(optional home_manage_container_optional
37+
(allow process home_root_t manage_dir_perms)
38+
(allow process user_home_dir_t manage_dir_perms)
39+
(allow process user_home_t manage_dir_perms)
40+
41+
(allow process user_home_dir_t manage_file_perms)
42+
(allow process user_home_t manage_file_perms)
43+
)
44+
)

‎udica-templates/log_container.cil‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
(block log_container
2+
(blockabstract log_container)
3+
4+
(optional log_container_optional
5+
(allow process var_t search_dir_perms)
6+
(allow process logfile list_dir_perms)
7+
(allow process logfile read_file_perms)
8+
(allow process logfile read_lnk_file_perms)
9+
(allow process auditd_log_t list_dir_perms)
10+
(allow process auditd_log_t read_file_perms)
11+
)
12+
)
13+
14+
(block log_rw_container
15+
(blockabstract log_rw_container)
16+
17+
(blockinherit log_container)
18+
19+
(optional log_rw_container_optional
20+
(allow process logfile rw_dir_perms)
21+
(allow process logfile rw_file_perms)
22+
(allow process logfile rw_lnk_file_perms)
23+
(allow process auditd_log_t rw_dir_perms)
24+
(allow process auditd_log_t rw_file_perms)
25+
)
26+
)
27+
28+
(block log_manage_container
29+
(blockabstract log_manage_container)
30+
31+
(blockinherit log_rw_container)
32+
33+
(optional log_manage_container_optional
34+
(allow process logfile manage_dir_perms)
35+
(allow process logfile manage_file_perms)
36+
(allow process logfile manage_lnk_file_perms)
37+
(allow process auditd_log_t manage_dir_perms)
38+
(allow process auditd_log_t manage_file_perms)
39+
)
40+
)

‎udica-templates/net_container.cil‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
(block net_container
2+
(blockabstract net_container)
3+
4+
(optional net_container_optional
5+
(typeattributeset container_net_domain (process))
6+
)
7+
)
8+
9+
(block restricted_net_container
10+
(blockabstract restricted_net_container)
11+
12+
(optional restricted_net_container_optional
13+
(allow process self create_tcp_socket_perms)
14+
(allow process self create_udp_socket_perms)
15+
(allow process self create_sctp_socket_perms)
16+
17+
(call .read_lnk_files (process proc_t))
18+
19+
(allow process node_t (node (recvfrom sendto)))
20+
21+
(allow process node_t (udp_socket (node_bind)))
22+
(allow process node_t (tcp_socket (node_bind)))
23+
24+
(allow process http_port_t (tcp_socket (name_connect)))
25+
)
26+
)

‎udica-templates/tmp_container.cil‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
(block tmp_container
2+
(blockabstract tmp_container)
3+
4+
(optional tmp_container_optional
5+
(allow process tmpfile search_dir_perms)
6+
(allow process tmpfile read_file_perms)
7+
)
8+
)
9+
10+
(block tmp_rw_container
11+
(blockabstract tmp_rw_container)
12+
13+
(blockinherit tmp_container)
14+
15+
(optional tmp_rw_container_optional
16+
(allow process tmpfile rw_dir_perms)
17+
(allow process tmpfile rw_file_perms)
18+
)
19+
)

‎udica-templates/tty_container.cil‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
(block tty_container
2+
(blockabstract tty_container)
3+
4+
(optional tty_container_optional
5+
(allow process device_t list_dir_perms)
6+
(allow process device_t read_lnk_file_perms)
7+
8+
(allow process devtty_t rw_chr_file_perms)
9+
)
10+
)

‎udica-templates/virt_container.cil‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
(block virt_container
2+
(blockabstract virt_container)
3+
4+
(optional virt_container_optional
5+
(allow process var_t search_dir_perms)
6+
(allow process var_t read_lnk_file_perms)
7+
8+
(allow process var_run_t search_dir_perms)
9+
(allow process var_run_t read_lnk_file_perms)
10+
11+
(allow process virt_runtime_t search_dir_perms)
12+
(allow process virt_runtime_t write_sock_file_perms)
13+
14+
(allow process virtd_t (unix_stream_socket (connectto)))
15+
)
16+
)

0 commit comments

Comments
 (0)