From: russell@coker.com.au (Russell Coker)
To: refpolicy@oss.tresys.com
Subject: [refpolicy] Chrome patch for discussion
Date: Sun, 17 Sep 2017 13:28:11 +1000 [thread overview]
Message-ID: <20170917032811.b2eyftg5j2wois4n@athena.coker.com.au> (raw)
This patch has been hanging around in my collection for years. I am NOT
suggesting including it as-is. I am sending it for discussion.
One thing to discuss is whether we use mozilla_t for all browsers (maybe add
a typealias to browser_t or something) or whether we have a chrome_t. I
think that having a single mozilla_t or browser_t is the better option but I'm
not stuck on it. I can rewrite it for a separate chrome_t if that is the
consensus.
Index: refpolicy-2.20170917/policy/modules/contrib/mozilla.fc
===================================================================
--- refpolicy-2.20170917.orig/policy/modules/contrib/mozilla.fc
+++ refpolicy-2.20170917/policy/modules/contrib/mozilla.fc
@@ -1,5 +1,8 @@
HOME_DIR/\.galeon(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0)
HOME_DIR/\.mozilla(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0)
+HOME_DIR/\.config/chromium(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0)
+HOME_DIR/\.config/google-chrome(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0)
+HOME_DIR/\.cache/chromium(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0)
HOME_DIR/\.mozilla/plugins(/.*)? gen_context(system_u:object_r:mozilla_plugin_home_t,s0)
HOME_DIR/\.netscape(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0)
HOME_DIR/\.phoenix(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0)
@@ -14,6 +17,7 @@ HOME_DIR/\.spicec(/.*)? gen_context(syst
HOME_DIR/\.ICAClient(/.*)? gen_context(system_u:object_r:mozilla_plugin_home_t,s0)
HOME_DIR/zimbrauserdata(/.*)? gen_context(system_u:object_r:mozilla_plugin_home_t,s0)
+/usr/bin/chromium -- gen_context(system_u:object_r:mozilla_exec_t,s0)
/usr/bin/epiphany -- gen_context(system_u:object_r:mozilla_exec_t,s0)
/usr/bin/epiphany-bin -- gen_context(system_u:object_r:mozilla_exec_t,s0)
/usr/bin/mozilla -- gen_context(system_u:object_r:mozilla_exec_t,s0)
@@ -39,3 +43,10 @@ HOME_DIR/zimbrauserdata(/.*)? gen_contex
/usr/lib/nspluginwrapper/npviewer.bin -- gen_context(system_u:object_r:mozilla_plugin_exec_t,s0)
/usr/lib/nspluginwrapper/plugin-config -- gen_context(system_u:object_r:mozilla_plugin_config_exec_t,s0)
/usr/lib/xulrunner[^/]*/plugin-container -- gen_context(system_u:object_r:mozilla_plugin_exec_t,s0)
+/usr/lib/chromium/chrome-sandbox -- gen_context(system_u:object_r:chrome_sandbox_exec_t,s0)
+/usr/lib/chromium/chromium -- gen_context(system_u:object_r:chrome_browser_exec_t,s0)
+/opt/google/chrome/chrome-sandbox -- gen_context(system_u:object_r:chrome_sandbox_exec_t,s0)
+/opt/google/chrome/chrome -- gen_context(system_u:object_r:chrome_browser_exec_t,s0)
+/opt/google/chrome/google-chrome -- gen_context(system_u:object_r:chrome_browser_exec_t,s0)
+/opt/google/chrome/nacl_helper -- gen_context(system_u:object_r:chrome_browser_exec_t,s0)
+
Index: refpolicy-2.20170917/policy/modules/contrib/mozilla.if
===================================================================
--- refpolicy-2.20170917.orig/policy/modules/contrib/mozilla.if
+++ refpolicy-2.20170917/policy/modules/contrib/mozilla.if
@@ -14,12 +14,18 @@
## User domain for the role.
## </summary>
## </param>
+## <param name="type">
+## <summary>
+## Type of the user tty
+## </summary>
+## </param>
#
interface(`mozilla_role',`
gen_require(`
type mozilla_t, mozilla_exec_t, mozilla_home_t;
type mozilla_tmp_t, mozilla_tmpfs_t, mozilla_plugin_tmp_t;
type mozilla_plugin_tmpfs_t, mozilla_plugin_home_t;
+ type chrome_sandbox_t, chrome_browser_exec_t;
attribute_role mozilla_roles;
')
@@ -36,6 +42,7 @@ interface(`mozilla_role',`
#
domtrans_pattern($2, mozilla_exec_t, mozilla_t)
+ domtrans_pattern($2, chrome_browser_exec_t, mozilla_t)
allow $2 mozilla_t:process { noatsecure siginh rlimitinh ptrace signal_perms };
ps_process_pattern($2, mozilla_t)
@@ -45,6 +52,9 @@ interface(`mozilla_role',`
allow $2 mozilla_t:fd use;
allow $2 mozilla_t:shm rw_shm_perms;
+ allow chrome_sandbox_t $2:fd use;
+ allow chrome_sandbox_t $2:fifo_file write;
+ allow chrome_sandbox_t $3:chr_file { read write };
stream_connect_pattern($2, mozilla_tmpfs_t, mozilla_tmpfs_t, mozilla_t)
@@ -288,10 +298,12 @@ interface(`mozilla_read_tmp_files',`
interface(`mozilla_domtrans',`
gen_require(`
type mozilla_t, mozilla_exec_t;
+ type chrome_browser_exec_t;
')
corecmd_search_bin($1)
domtrans_pattern($1, mozilla_exec_t, mozilla_t)
+ domtrans_pattern($1, chrome_browser_exec_t, mozilla_t)
')
########################################
Index: refpolicy-2.20170917/policy/modules/contrib/mozilla.te
===================================================================
--- refpolicy-2.20170917.orig/policy/modules/contrib/mozilla.te
+++ refpolicy-2.20170917/policy/modules/contrib/mozilla.te
@@ -47,6 +47,45 @@ userdom_user_tmp_file(mozilla_plugin_tmp
type mozilla_plugin_tmpfs_t;
userdom_user_tmpfs_file(mozilla_plugin_tmpfs_t)
+type chrome_sandbox_t;
+type chrome_sandbox_exec_t;
+type chrome_browser_exec_t;
+application_domain(mozilla_t, chrome_browser_exec_t)
+userdom_user_application_domain(mozilla_t, chrome_browser_exec_t )
+role mozilla_plugin_roles types chrome_sandbox_t;
+domain_auto_transition_pattern(chrome_sandbox_t, chrome_browser_exec_t, mozilla_t)
+allow mozilla_t chrome_sandbox_t:process sigchld;
+application_domain(chrome_sandbox_t, chrome_sandbox_exec_t)
+ubac_constrained(chrome_sandbox_t)
+fs_getattr_xattr_fs(chrome_sandbox_t)
+
+allow chrome_sandbox_t mozilla_t:dir list_dir_perms;
+allow chrome_sandbox_t mozilla_t:fifo_file rw_file_perms;
+allow chrome_sandbox_t mozilla_t:file read_file_perms;
+allow chrome_sandbox_t mozilla_t:lnk_file read_lnk_file_perms;
+allow chrome_sandbox_t mozilla_t:unix_dgram_socket { read write };
+allow chrome_sandbox_t mozilla_t:unix_stream_socket { read write };
+allow chrome_sandbox_t mozilla_t:fd use;
+allow chrome_sandbox_t mozilla_t:file write;
+allow chrome_sandbox_t proc_t:dir read;
+allow chrome_sandbox_t self:process setrlimit;
+type chrome_sandbox_tmp_t;
+
+# this is needed for Chrome (not Chromium) startup
+allow chrome_sandbox_t mozilla_t:process { siginh rlimitinh noatsecure };
+
+files_tmp_file(chrome_sandbox_tmp_t)
+ubac_constrained(chrome_sandbox_tmp_t)
+files_tmp_filetrans(chrome_sandbox_t, chrome_sandbox_tmp_t, { file dir })
+allow chrome_sandbox_t chrome_sandbox_tmp_t:dir manage_dir_perms;
+allow mozilla_t self:unix_dgram_socket sendto;
+allow mozilla_t chrome_browser_exec_t:file execute_no_trans;
+# for V8
+allow mozilla_t self:process execmem;
+
+allow mozilla_t chrome_sandbox_t:shm { write unix_read getattr unix_write associate read };
+allow mozilla_t chrome_sandbox_t:unix_dgram_socket { read write };
+
optional_policy(`
pulseaudio_tmpfs_content(mozilla_plugin_tmpfs_t)
')
@@ -76,8 +115,22 @@ optional_policy(`
# Local policy
#
+dontaudit chrome_sandbox_t domain:dir getattr;
+application_domain(chrome_sandbox_t, chrome_sandbox_exec_t)
+domain_auto_transition_pattern(mozilla_t, chrome_sandbox_exec_t, chrome_sandbox_t)
+allow mozilla_t mozilla_home_t:sock_file manage_sock_file_perms;
+allow chrome_sandbox_t self:fifo_file rw_file_perms;
+allow chrome_sandbox_t mozilla_t:unix_dgram_socket { read write };
+allow chrome_sandbox_t mozilla_t:unix_stream_socket { read write };
+allow chrome_sandbox_t self:capability { chown dac_override fsetid net_raw setgid setuid sys_admin sys_chroot sys_ptrace };
+allow chrome_sandbox_t mozilla_t:process { share sigchld };
+allow mozilla_t chrome_sandbox_t:fd use;
+allow mozilla_t chrome_sandbox_t:unix_stream_socket { read write };
+dev_read_sysfs(mozilla_t)
+domain_dontaudit_search_all_domains_state(chrome_sandbox_t)
+
allow mozilla_t self:capability { setgid setuid sys_nice };
-allow mozilla_t self:process { sigkill signal setsched getsched setrlimit };
+allow mozilla_t self:process { sigkill signal setsched getsched setrlimit setcap };
allow mozilla_t self:fifo_file rw_fifo_file_perms;
allow mozilla_t self:shm create_shm_perms;
allow mozilla_t self:sem create_sem_perms;
@@ -90,6 +143,10 @@ allow mozilla_t mozilla_plugin_t:fd use;
allow mozilla_t { mozilla_home_t mozilla_plugin_home_t }:dir manage_dir_perms;
allow mozilla_t { mozilla_home_t mozilla_plugin_home_t }:file { manage_file_perms map };
allow mozilla_t mozilla_home_t:lnk_file manage_lnk_file_perms;
+
+# for plugins
+can_exec(mozilla_t, mozilla_home_t)
+
userdom_user_home_dir_filetrans(mozilla_t, mozilla_home_t, dir, ".galeon")
userdom_user_home_dir_filetrans(mozilla_t, mozilla_home_t, dir, ".mozilla")
userdom_user_home_dir_filetrans(mozilla_t, mozilla_home_t, dir, ".netscape")
@@ -100,6 +157,7 @@ filetrans_pattern(mozilla_t, mozilla_hom
manage_files_pattern(mozilla_t, mozilla_tmp_t, mozilla_tmp_t)
manage_lnk_files_pattern(mozilla_t, mozilla_tmp_t, mozilla_tmp_t)
manage_dirs_pattern(mozilla_t, mozilla_tmp_t, mozilla_tmp_t)
+manage_sock_files_pattern(mozilla_t, mozilla_tmp_t, mozilla_tmp_t)
allow mozilla_t mozilla_tmp_t:file map;
files_tmp_filetrans(mozilla_t, mozilla_tmp_t, { file dir })
@@ -107,7 +165,10 @@ manage_files_pattern(mozilla_t, mozilla_
manage_lnk_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t)
manage_fifo_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t)
manage_sock_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t)
-fs_tmpfs_filetrans(mozilla_t, mozilla_tmpfs_t, { file lnk_file sock_file fifo_file })
+fs_tmpfs_filetrans(mozilla_t, mozilla_tmpfs_t, { dir file lnk_file sock_file fifo_file })
+
+# so mozilla can create /var/run/user/PID/pulse
+auth_read_var_auth(mozilla_t)
allow mozilla_t mozilla_plugin_rw_t:dir list_dir_perms;
allow mozilla_t mozilla_plugin_rw_t:file read_file_perms;
@@ -117,11 +178,16 @@ stream_connect_pattern(mozilla_t, mozill
can_exec(mozilla_t, { mozilla_exec_t mozilla_plugin_rw_t mozilla_plugin_home_t })
+allow mozilla_t self:netlink_kobject_uevent_socket create_socket_perms;
+
kernel_read_kernel_sysctls(mozilla_t)
kernel_read_network_state(mozilla_t)
kernel_read_system_state(mozilla_t)
kernel_read_net_sysctls(mozilla_t)
+# for overcommit_memory
+kernel_read_vm_overcommit_sysctl(mozilla_t)
+
corecmd_list_bin(mozilla_t)
corecmd_exec_shell(mozilla_t)
corecmd_exec_bin(mozilla_t)
@@ -166,6 +232,8 @@ dev_read_rand(mozilla_t)
dev_read_urand(mozilla_t)
dev_rw_dri(mozilla_t)
dev_write_sound(mozilla_t)
+dev_dontaudit_getattr_all_chr_files(mozilla_t)
+dev_dontaudit_getattr_all_blk_files(mozilla_t)
domain_dontaudit_read_all_domains_state(mozilla_t)
@@ -207,6 +275,7 @@ mozilla_run_plugin(mozilla_t, mozilla_ro
mozilla_run_plugin_config(mozilla_t, mozilla_roles)
xserver_user_x_domain_template(mozilla, mozilla_t, mozilla_tmpfs_t)
+corenet_tcp_connect_xserver_port(mozilla_t)
xserver_dontaudit_read_xdm_tmp_files(mozilla_t)
xserver_dontaudit_getattr_xdm_tmp_sockets(mozilla_t)
Index: refpolicy-2.20170917/policy/modules/kernel/corecommands.fc
===================================================================
--- refpolicy-2.20170917.orig/policy/modules/kernel/corecommands.fc
+++ refpolicy-2.20170917/policy/modules/kernel/corecommands.fc
@@ -120,6 +120,7 @@ ifdef(`distro_debian',`
/opt/(.*/)?sbin(/.*)? gen_context(system_u:object_r:bin_t,s0)
/opt/google/talkplugin(/.*)? gen_context(system_u:object_r:bin_t,s0)
+/opt/google/chrome/cron/google-chrome -- gen_context(system_u:object_r:bin_t,s0)
/opt/gutenprint/cups/lib/filter(/.*)? gen_context(system_u:object_r:bin_t,s0)
Index: refpolicy-2.20170917/policy/modules/contrib/xguest.te
===================================================================
--- refpolicy-2.20170917.orig/policy/modules/contrib/xguest.te
+++ refpolicy-2.20170917/policy/modules/contrib/xguest.te
@@ -103,7 +103,7 @@ optional_policy(`
')
optional_policy(`
- mozilla_role(xguest_r, xguest_t)
+ mozilla_role(xguest_r, xguest_t, user_devpts_t)
')
optional_policy(`
Index: refpolicy-2.20170917/policy/modules/roles/staff.te
===================================================================
--- refpolicy-2.20170917.orig/policy/modules/roles/staff.te
+++ refpolicy-2.20170917/policy/modules/roles/staff.te
@@ -142,7 +142,7 @@ ifndef(`distro_redhat',`
')
optional_policy(`
- mozilla_role(staff_r, staff_t)
+ mozilla_role(staff_r, staff_t, user_devpts_t)
')
optional_policy(`
Index: refpolicy-2.20170917/policy/modules/roles/sysadm.te
===================================================================
--- refpolicy-2.20170917.orig/policy/modules/roles/sysadm.te
+++ refpolicy-2.20170917/policy/modules/roles/sysadm.te
@@ -648,7 +648,7 @@ optional_policy(`
')
optional_policy(`
- mozilla_role(sysadm_r, sysadm_t)
+ mozilla_role(sysadm_r, sysadm_t, user_devpts_t)
')
optional_policy(`
Index: refpolicy-2.20170917/policy/modules/roles/unprivuser.te
===================================================================
--- refpolicy-2.20170917.orig/policy/modules/roles/unprivuser.te
+++ refpolicy-2.20170917/policy/modules/roles/unprivuser.te
@@ -114,7 +114,7 @@ ifndef(`distro_redhat',`
')
optional_policy(`
- mozilla_role(user_r, user_t)
+ mozilla_role(user_r, user_t, user_devpts_t)
')
optional_policy(`
next reply other threads:[~2017-09-17 3:28 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-09-17 3:28 Russell Coker [this message]
2017-09-17 4:18 ` [refpolicy] Chrome patch for discussion Jason Zaman
2017-09-17 5:16 ` Russell Coker
2017-09-19 2:55 ` Jason Zaman
2017-09-17 14:14 ` Chris PeBenito
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170917032811.b2eyftg5j2wois4n@athena.coker.com.au \
--to=russell@coker.com.au \
--cc=refpolicy@oss.tresys.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.