Skip to content

Commit f95131d

Browse files
0xC0ncord0xC0ncord
committed
udica-templates: initial commit of udica templates
Signed-off-by: Kenton Groombridge <[email protected]>
1 parent 8f4ca1f commit f95131d

File tree

9 files changed

+292
-0
lines changed

9 files changed

+292
-0
lines changed

‎udica-templates/base_container.cil‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
;;
2+
;; Permission sets definitions
3+
;;
4+
5+
(classpermission search_dir_perms)
6+
(classpermissionset search_dir_perms (dir (getattr search)))
7+
8+
(classpermission list_dir_perms)
9+
(classpermissionset list_dir_perms (dir (getattr search open read lock ioctl)))
10+
11+
(classpermission rw_dir_perms)
12+
(classpermissionset rw_dir_perms (dir (open read getattr lock search ioctl add_name remove_name write)))
13+
14+
(classpermission manage_dir_perms)
15+
(classpermissionset manage_dir_perms (dir (create open getattr setattr read write link unlink rename search add_name remove_name reparent rmdir lock ioctl)))
16+
17+
(classpermission rw_chr_file_perms)
18+
(classpermissionset rw_chr_file_perms (chr_file (getattr open read write append ioctl lock)))
19+
20+
(classpermission read_file_perms)
21+
(classpermissionset read_file_perms (file (getattr open read lock ioctl)))
22+
23+
(classpermission rw_file_perms)
24+
(classpermissionset rw_file_perms (file (open getattr read write append ioctl lock)))
25+
26+
(classpermission manage_file_perms)
27+
(classpermissionset manage_file_perms (file (create open getattr setattr read write append rename link unlink ioctl lock)))
28+
29+
(classpermission exec_file_perms)
30+
(classpermissionset exec_file_perms (file (getattr open map read execute ioctl execute_no_trans)))
31+
32+
(classpermission read_lnk_file_perms)
33+
(classpermissionset read_lnk_file_perms (lnk_file (getattr read)))
34+
35+
(classpermission rw_lnk_file_perms)
36+
(classpermissionset rw_lnk_file_perms (lnk_file (getattr read write lock ioctl)))
37+
38+
(classpermission manage_lnk_file_perms)
39+
(classpermissionset manage_lnk_file_perms (lnk_file (create read write getattr setattr link unlink rename ioctl lock)))
40+
41+
(classpermission write_sock_file_perms)
42+
(classpermissionset write_sock_file_perms (sock_file (getattr write open append)))
43+
44+
(classpermission manage_sock_file_perms)
45+
(classpermissionset manage_sock_file_perms (sock_file (create open getattr setattr read write rename link unlink ioctl lock append)))
46+
47+
(classpermission create_tcp_socket_perms)
48+
(classpermissionset create_tcp_socket_perms (tcp_socket (ioctl read getattr write setattr append bind connect getopt setopt shutdown listen accept)))
49+
50+
(classpermission create_udp_socket_perms)
51+
(classpermissionset create_udp_socket_perms (udp_socket (ioctl read getattr write setattr append bind connect getopt setopt shutdown)))
52+
53+
(classpermission create_sctp_socket_perms)
54+
(classpermissionset create_sctp_socket_perms (sctp_socket (ioctl read getattr write setattr append bind connect getopt setopt shutdown)))
55+
56+
(classpermission rw_shm_perms)
57+
(classpermissionset rw_shm_perms (shm (lock associate getattr read unix_read unix_write write)))
58+
59+
;;
60+
;; Base container policy
61+
;;
62+
63+
(block container
64+
(blockabstract container)
65+
66+
(type process)
67+
(type socket)
68+
69+
(roletype system_r process)
70+
(typeattributeset domain (process))
71+
(typeattributeset container_domain (process))
72+
(typeattributeset mcs_constrained_type (process))
73+
(typeattributeset file_type (socket))
74+
75+
(allow process socket manage_sock_file_perms)
76+
(allow container_engine_domain process (key (create search setattr view)))
77+
)

‎udica-templates/config_container.cil‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
(block config_container
2+
(blockabstract config_container)
3+
4+
(optional config_container_optional
5+
(allow process configfile list_dir_perms)
6+
(allow process configfile read_file_perms)
7+
(allow process configfile read_lnk_file_perms)
8+
)
9+
)
10+
11+
(block config_rw_container
12+
(blockabstract config_rw_container)
13+
14+
(blockinherit config_container)
15+
16+
(optional config_rw_container_optional
17+
(allow process configfile rw_dir_perms)
18+
(allow process configfile rw_file_perms)
19+
(allow process configfile rw_lnk_file_perms)
20+
)
21+
)
22+
23+
(block config_manage_container
24+
(blockabstract config_manage_container)
25+
26+
(blockinherit config_rw_container)
27+
28+
(optional config_manage_container_optional
29+
(allow process configfile manage_dir_perms)
30+
(allow process configfile manage_file_perms)
31+
(allow process configfile manage_lnk_file_perms)
32+
)
33+
)

‎udica-templates/home_container.cil‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
(block home_container
2+
(blockabstract home_container)
3+
4+
(optional home_container_optional
5+
(allow process process (capability (dac_override)))
6+
7+
(allow process home_root_t list_dir_perms)
8+
(allow process user_home_dir_t list_dir_perms)
9+
(allow process user_home_t list_dir_perms)
10+
11+
(allow process user_home_dir_t read_file_perms)
12+
(allow process user_home_t read_file_perms)
13+
)
14+
)
15+
16+
(block home_rw_container
17+
(blockabstract home_rw_container)
18+
19+
(blockinherit home_container)
20+
21+
(optional home_rw_container_optional
22+
(allow process home_root_t rw_dir_perms)
23+
(allow process user_home_dir_t rw_dir_perms)
24+
(allow process user_home_t rw_dir_perms)
25+
26+
(allow process user_home_dir_t rw_file_perms)
27+
(allow process user_home_t rw_file_perms)
28+
)
29+
)
30+
31+
(block home_manage_container
32+
(blockabstract home_manage_container)
33+
34+
(blockinherit home_rw_container)
35+
36+
(optional home_manage_container_optional
37+
(allow process home_root_t manage_dir_perms)
38+
(allow process user_home_dir_t manage_dir_perms)
39+
(allow process user_home_t manage_dir_perms)
40+
41+
(allow process user_home_dir_t manage_file_perms)
42+
(allow process user_home_t manage_file_perms)
43+
)
44+
)

‎udica-templates/log_container.cil‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
(block log_container
2+
(blockabstract log_container)
3+
4+
(optional log_container_optional
5+
(allow process var_t search_dir_perms)
6+
(allow process logfile list_dir_perms)
7+
(allow process logfile read_file_perms)
8+
(allow process logfile read_lnk_file_perms)
9+
(allow process auditd_log_t list_dir_perms)
10+
(allow process auditd_log_t read_file_perms)
11+
)
12+
)
13+
14+
(block log_rw_container
15+
(blockabstract log_rw_container)
16+
17+
(blockinherit log_container)
18+
19+
(optional log_rw_container_optional
20+
(allow process logfile rw_dir_perms)
21+
(allow process logfile rw_file_perms)
22+
(allow process logfile rw_lnk_file_perms)
23+
(allow process auditd_log_t rw_dir_perms)
24+
(allow process auditd_log_t rw_file_perms)
25+
)
26+
)
27+
28+
(block log_manage_container
29+
(blockabstract log_manage_container)
30+
31+
(blockinherit log_rw_container)
32+
33+
(optional log_manage_container_optional
34+
(allow process logfile manage_dir_perms)
35+
(allow process logfile manage_file_perms)
36+
(allow process logfile manage_lnk_file_perms)
37+
(allow process auditd_log_t manage_dir_perms)
38+
(allow process auditd_log_t manage_file_perms)
39+
)
40+
)

‎udica-templates/net_container.cil‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
(block net_container
2+
(blockabstract net_container)
3+
4+
(optional net_container_optional
5+
(typeattributeset container_net_domain (process))
6+
)
7+
)
8+
9+
(block restricted_net_container
10+
(blockabstract restricted_net_container)
11+
12+
(optional restricted_net_container_optional
13+
(allow process self create_tcp_socket_perms)
14+
(allow process self create_udp_socket_perms)
15+
(allow process self create_sctp_socket_perms)
16+
17+
(call .read_lnk_files (process proc_t))
18+
19+
(allow process node_t (node (recvfrom sendto)))
20+
21+
(allow process node_t (udp_socket (node_bind)))
22+
(allow process node_t (tcp_socket (node_bind)))
23+
24+
(allow process http_port_t (tcp_socket (name_connect)))
25+
)
26+
)

‎udica-templates/tmp_container.cil‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
(block tmp_container
2+
(blockabstract tmp_container)
3+
4+
(optional tmp_container_optional
5+
(allow process tmpfile search_dir_perms)
6+
(allow process tmpfile read_file_perms)
7+
)
8+
)
9+
10+
(block tmp_rw_container
11+
(blockabstract tmp_rw_container)
12+
13+
(blockinherit tmp_container)
14+
15+
(optional tmp_rw_container_optional
16+
(allow process tmpfile rw_dir_perms)
17+
(allow process tmpfile rw_file_perms)
18+
)
19+
)

‎udica-templates/tty_container.cil‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
(block tty_container
2+
(blockabstract tty_container)
3+
4+
(optional tty_container_optional
5+
(allow process device_t list_dir_perms)
6+
(allow process device_t read_lnk_file_perms)
7+
8+
(allow process devtty_t rw_chr_file_perms)
9+
)
10+
)

‎udica-templates/virt_container.cil‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
(block virt_container
2+
(blockabstract virt_container)
3+
4+
(optional virt_container_optional
5+
(allow process var_t search_dir_perms)
6+
(allow process var_t read_lnk_file_perms)
7+
8+
(allow process var_run_t search_dir_perms)
9+
(allow process var_run_t read_lnk_file_perms)
10+
11+
(allow process virt_runtime_t search_dir_perms)
12+
(allow process virt_runtime_t write_sock_file_perms)
13+
14+
(allow process virtd_t (unix_stream_socket (connectto)))
15+
)
16+
)

‎udica-templates/x_container.cil‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
(block x_container
2+
(blockabstract x_container)
3+
4+
(optional x_container_optional
5+
(allow xserver_t process rw_shm_perms)
6+
7+
(allow process xserver_t (unix_stream_socket (connectto)))
8+
9+
(allow process device_t search_dir_perms)
10+
11+
(allow process dri_device_t rw_chr_file_perms)
12+
13+
(allow process xserver_misc_device_t rw_chr_file_perms)
14+
15+
(allow process urandom_device_t read_chr_file_perms)
16+
17+
(allow process tmpfs_t search_dir_perms)
18+
19+
(allow process tmp_t search_dir_perms)
20+
(allow process tmp_t read_lnk_file_perms)
21+
22+
(allow process xserver_tmp_t search_dir_perms)
23+
(allow process xserver_tmp_t write_sock_file_perms)
24+
25+
(allow process xserver_exec_t exec_file_perms)
26+
)
27+
)

0 commit comments

Comments
 (0)