From mboxrd@z Thu Jan  1 00:00:00 1970
From: russell@coker.com.au (Russell Coker)
Date: Sun, 17 Sep 2017 13:28:11 +1000
Subject: [refpolicy] Chrome patch for discussion
Message-ID: <20170917032811.b2eyftg5j2wois4n@athena.coker.com.au>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com

This patch has been hanging around in my collection for years.  I am NOT
suggesting including it as-is.  I am sending it for discussion.

One thing to discuss is whether we use mozilla_t for all browsers (maybe add
a typealias to browser_t or something) or whether we have a chrome_t.  I
think that having a single mozilla_t or browser_t is the better option but I'm
not stuck on it.  I can rewrite it for a separate chrome_t if that is the
consensus.

Index: refpolicy-2.20170917/policy/modules/contrib/mozilla.fc
===================================================================
--- refpolicy-2.20170917.orig/policy/modules/contrib/mozilla.fc
+++ refpolicy-2.20170917/policy/modules/contrib/mozilla.fc
@@ -1,5 +1,8 @@
 HOME_DIR/\.galeon(/.*)?	gen_context(system_u:object_r:mozilla_home_t,s0)
 HOME_DIR/\.mozilla(/.*)?	gen_context(system_u:object_r:mozilla_home_t,s0)
+HOME_DIR/\.config/chromium(/.*)?	gen_context(system_u:object_r:mozilla_home_t,s0)
+HOME_DIR/\.config/google-chrome(/.*)?	gen_context(system_u:object_r:mozilla_home_t,s0)
+HOME_DIR/\.cache/chromium(/.*)?	gen_context(system_u:object_r:mozilla_home_t,s0)
 HOME_DIR/\.mozilla/plugins(/.*)?	gen_context(system_u:object_r:mozilla_plugin_home_t,s0)
 HOME_DIR/\.netscape(/.*)?	gen_context(system_u:object_r:mozilla_home_t,s0)
 HOME_DIR/\.phoenix(/.*)?	gen_context(system_u:object_r:mozilla_home_t,s0)
@@ -14,6 +17,7 @@ HOME_DIR/\.spicec(/.*)?	gen_context(syst
 HOME_DIR/\.ICAClient(/.*)?	gen_context(system_u:object_r:mozilla_plugin_home_t,s0)
 HOME_DIR/zimbrauserdata(/.*)?	gen_context(system_u:object_r:mozilla_plugin_home_t,s0)
 
+/usr/bin/chromium	--	gen_context(system_u:object_r:mozilla_exec_t,s0)
 /usr/bin/epiphany	--	gen_context(system_u:object_r:mozilla_exec_t,s0)
 /usr/bin/epiphany-bin	--	gen_context(system_u:object_r:mozilla_exec_t,s0)
 /usr/bin/mozilla	--	gen_context(system_u:object_r:mozilla_exec_t,s0)
@@ -39,3 +43,10 @@ HOME_DIR/zimbrauserdata(/.*)?	gen_contex
 /usr/lib/nspluginwrapper/npviewer.bin	--	gen_context(system_u:object_r:mozilla_plugin_exec_t,s0)
 /usr/lib/nspluginwrapper/plugin-config	--	gen_context(system_u:object_r:mozilla_plugin_config_exec_t,s0)
 /usr/lib/xulrunner[^/]*/plugin-container	--	gen_context(system_u:object_r:mozilla_plugin_exec_t,s0)
+/usr/lib/chromium/chrome-sandbox --	gen_context(system_u:object_r:chrome_sandbox_exec_t,s0)
+/usr/lib/chromium/chromium	--	gen_context(system_u:object_r:chrome_browser_exec_t,s0)
+/opt/google/chrome/chrome-sandbox --	gen_context(system_u:object_r:chrome_sandbox_exec_t,s0)
+/opt/google/chrome/chrome	--	gen_context(system_u:object_r:chrome_browser_exec_t,s0)
+/opt/google/chrome/google-chrome --	gen_context(system_u:object_r:chrome_browser_exec_t,s0)
+/opt/google/chrome/nacl_helper	--	gen_context(system_u:object_r:chrome_browser_exec_t,s0)
+
Index: refpolicy-2.20170917/policy/modules/contrib/mozilla.if
===================================================================
--- refpolicy-2.20170917.orig/policy/modules/contrib/mozilla.if
+++ refpolicy-2.20170917/policy/modules/contrib/mozilla.if
@@ -14,12 +14,18 @@
 ##	User domain for the role.
 ##	</summary>
 ## </param>
+## <param name="type">
+##	<summary>
+##	Type of the user tty
+##	</summary>
+## </param>
 #
 interface(`mozilla_role',`
 	gen_require(`
 		type mozilla_t, mozilla_exec_t, mozilla_home_t;
 		type mozilla_tmp_t, mozilla_tmpfs_t, mozilla_plugin_tmp_t;
 		type mozilla_plugin_tmpfs_t, mozilla_plugin_home_t;
+		type chrome_sandbox_t, chrome_browser_exec_t;
 		attribute_role mozilla_roles;
 	')
 
@@ -36,6 +42,7 @@ interface(`mozilla_role',`
 	#
 
 	domtrans_pattern($2, mozilla_exec_t, mozilla_t)
+	domtrans_pattern($2, chrome_browser_exec_t, mozilla_t)
 
 	allow $2 mozilla_t:process { noatsecure siginh rlimitinh ptrace signal_perms };
 	ps_process_pattern($2, mozilla_t)
@@ -45,6 +52,9 @@ interface(`mozilla_role',`
 
 	allow $2 mozilla_t:fd use;
 	allow $2 mozilla_t:shm rw_shm_perms;
+	allow chrome_sandbox_t $2:fd use;
+	allow chrome_sandbox_t $2:fifo_file write;
+	allow chrome_sandbox_t $3:chr_file { read write };
 
 	stream_connect_pattern($2, mozilla_tmpfs_t, mozilla_tmpfs_t, mozilla_t)
 
@@ -288,10 +298,12 @@ interface(`mozilla_read_tmp_files',`
 interface(`mozilla_domtrans',`
 	gen_require(`
 		type mozilla_t, mozilla_exec_t;
+		type chrome_browser_exec_t;
 	')
 
 	corecmd_search_bin($1)
 	domtrans_pattern($1, mozilla_exec_t, mozilla_t)
+	domtrans_pattern($1, chrome_browser_exec_t, mozilla_t)
 ')
 
 ########################################
Index: refpolicy-2.20170917/policy/modules/contrib/mozilla.te
===================================================================
--- refpolicy-2.20170917.orig/policy/modules/contrib/mozilla.te
+++ refpolicy-2.20170917/policy/modules/contrib/mozilla.te
@@ -47,6 +47,45 @@ userdom_user_tmp_file(mozilla_plugin_tmp
 type mozilla_plugin_tmpfs_t;
 userdom_user_tmpfs_file(mozilla_plugin_tmpfs_t)
 
+type chrome_sandbox_t;
+type chrome_sandbox_exec_t;
+type chrome_browser_exec_t;
+application_domain(mozilla_t, chrome_browser_exec_t)
+userdom_user_application_domain(mozilla_t, chrome_browser_exec_t )
+role mozilla_plugin_roles types chrome_sandbox_t;
+domain_auto_transition_pattern(chrome_sandbox_t, chrome_browser_exec_t, mozilla_t)
+allow mozilla_t chrome_sandbox_t:process sigchld;
+application_domain(chrome_sandbox_t, chrome_sandbox_exec_t)
+ubac_constrained(chrome_sandbox_t)
+fs_getattr_xattr_fs(chrome_sandbox_t)
+
+allow chrome_sandbox_t mozilla_t:dir list_dir_perms;
+allow chrome_sandbox_t mozilla_t:fifo_file rw_file_perms;
+allow chrome_sandbox_t mozilla_t:file read_file_perms;
+allow chrome_sandbox_t mozilla_t:lnk_file read_lnk_file_perms;
+allow chrome_sandbox_t mozilla_t:unix_dgram_socket { read write };
+allow chrome_sandbox_t mozilla_t:unix_stream_socket { read write };
+allow chrome_sandbox_t mozilla_t:fd use;
+allow chrome_sandbox_t mozilla_t:file write;
+allow chrome_sandbox_t proc_t:dir read;
+allow chrome_sandbox_t self:process setrlimit;
+type chrome_sandbox_tmp_t;
+
+# this is needed for Chrome (not Chromium) startup
+allow chrome_sandbox_t mozilla_t:process { siginh rlimitinh noatsecure };
+
+files_tmp_file(chrome_sandbox_tmp_t)
+ubac_constrained(chrome_sandbox_tmp_t)
+files_tmp_filetrans(chrome_sandbox_t, chrome_sandbox_tmp_t, { file dir })
+allow chrome_sandbox_t chrome_sandbox_tmp_t:dir manage_dir_perms;
+allow mozilla_t self:unix_dgram_socket sendto;
+allow mozilla_t chrome_browser_exec_t:file execute_no_trans;
+# for V8
+allow mozilla_t self:process execmem;
+
+allow mozilla_t chrome_sandbox_t:shm { write unix_read getattr unix_write associate read };
+allow mozilla_t chrome_sandbox_t:unix_dgram_socket { read write };
+
 optional_policy(`
 	pulseaudio_tmpfs_content(mozilla_plugin_tmpfs_t)
 ')
@@ -76,8 +115,22 @@ optional_policy(`
 # Local policy
 #
 
+dontaudit chrome_sandbox_t domain:dir getattr;
+application_domain(chrome_sandbox_t, chrome_sandbox_exec_t)
+domain_auto_transition_pattern(mozilla_t, chrome_sandbox_exec_t, chrome_sandbox_t)
+allow mozilla_t mozilla_home_t:sock_file manage_sock_file_perms;
+allow chrome_sandbox_t self:fifo_file rw_file_perms;
+allow chrome_sandbox_t mozilla_t:unix_dgram_socket { read write };
+allow chrome_sandbox_t mozilla_t:unix_stream_socket { read write };
+allow chrome_sandbox_t self:capability { chown dac_override fsetid net_raw setgid setuid sys_admin sys_chroot sys_ptrace };
+allow chrome_sandbox_t mozilla_t:process { share sigchld };
+allow mozilla_t chrome_sandbox_t:fd use;
+allow mozilla_t chrome_sandbox_t:unix_stream_socket { read write };
+dev_read_sysfs(mozilla_t)
+domain_dontaudit_search_all_domains_state(chrome_sandbox_t)
+
 allow mozilla_t self:capability { setgid setuid sys_nice };
-allow mozilla_t self:process { sigkill signal setsched getsched setrlimit };
+allow mozilla_t self:process { sigkill signal setsched getsched setrlimit setcap };
 allow mozilla_t self:fifo_file rw_fifo_file_perms;
 allow mozilla_t self:shm create_shm_perms;
 allow mozilla_t self:sem create_sem_perms;
@@ -90,6 +143,10 @@ allow mozilla_t mozilla_plugin_t:fd use;
 allow mozilla_t { mozilla_home_t mozilla_plugin_home_t }:dir manage_dir_perms;
 allow mozilla_t { mozilla_home_t mozilla_plugin_home_t }:file { manage_file_perms map };
 allow mozilla_t mozilla_home_t:lnk_file manage_lnk_file_perms;
+
+# for plugins
+can_exec(mozilla_t, mozilla_home_t)
+
 userdom_user_home_dir_filetrans(mozilla_t, mozilla_home_t, dir, ".galeon")
 userdom_user_home_dir_filetrans(mozilla_t, mozilla_home_t, dir, ".mozilla")
 userdom_user_home_dir_filetrans(mozilla_t, mozilla_home_t, dir, ".netscape")
@@ -100,6 +157,7 @@ filetrans_pattern(mozilla_t, mozilla_hom
 manage_files_pattern(mozilla_t, mozilla_tmp_t, mozilla_tmp_t)
 manage_lnk_files_pattern(mozilla_t, mozilla_tmp_t, mozilla_tmp_t)
 manage_dirs_pattern(mozilla_t, mozilla_tmp_t, mozilla_tmp_t)
+manage_sock_files_pattern(mozilla_t, mozilla_tmp_t, mozilla_tmp_t)
 allow mozilla_t mozilla_tmp_t:file map;
 files_tmp_filetrans(mozilla_t, mozilla_tmp_t, { file dir })
 
@@ -107,7 +165,10 @@ manage_files_pattern(mozilla_t, mozilla_
 manage_lnk_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t)
 manage_fifo_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t)
 manage_sock_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t)
-fs_tmpfs_filetrans(mozilla_t, mozilla_tmpfs_t, { file lnk_file sock_file fifo_file })
+fs_tmpfs_filetrans(mozilla_t, mozilla_tmpfs_t, { dir file lnk_file sock_file fifo_file })
+
+# so mozilla can create /var/run/user/PID/pulse
+auth_read_var_auth(mozilla_t)
 
 allow mozilla_t mozilla_plugin_rw_t:dir list_dir_perms;
 allow mozilla_t mozilla_plugin_rw_t:file read_file_perms;
@@ -117,11 +178,16 @@ stream_connect_pattern(mozilla_t, mozill
 
 can_exec(mozilla_t, { mozilla_exec_t mozilla_plugin_rw_t mozilla_plugin_home_t })
 
+allow mozilla_t self:netlink_kobject_uevent_socket create_socket_perms;
+
 kernel_read_kernel_sysctls(mozilla_t)
 kernel_read_network_state(mozilla_t)
 kernel_read_system_state(mozilla_t)
 kernel_read_net_sysctls(mozilla_t)
 
+# for overcommit_memory
+kernel_read_vm_overcommit_sysctl(mozilla_t)
+
 corecmd_list_bin(mozilla_t)
 corecmd_exec_shell(mozilla_t)
 corecmd_exec_bin(mozilla_t)
@@ -166,6 +232,8 @@ dev_read_rand(mozilla_t)
 dev_read_urand(mozilla_t)
 dev_rw_dri(mozilla_t)
 dev_write_sound(mozilla_t)
+dev_dontaudit_getattr_all_chr_files(mozilla_t)
+dev_dontaudit_getattr_all_blk_files(mozilla_t)
 
 domain_dontaudit_read_all_domains_state(mozilla_t)
 
@@ -207,6 +275,7 @@ mozilla_run_plugin(mozilla_t, mozilla_ro
 mozilla_run_plugin_config(mozilla_t, mozilla_roles)
 
 xserver_user_x_domain_template(mozilla, mozilla_t, mozilla_tmpfs_t)
+corenet_tcp_connect_xserver_port(mozilla_t)
 xserver_dontaudit_read_xdm_tmp_files(mozilla_t)
 xserver_dontaudit_getattr_xdm_tmp_sockets(mozilla_t)
 
Index: refpolicy-2.20170917/policy/modules/kernel/corecommands.fc
===================================================================
--- refpolicy-2.20170917.orig/policy/modules/kernel/corecommands.fc
+++ refpolicy-2.20170917/policy/modules/kernel/corecommands.fc
@@ -120,6 +120,7 @@ ifdef(`distro_debian',`
 /opt/(.*/)?sbin(/.*)?			gen_context(system_u:object_r:bin_t,s0)
 
 /opt/google/talkplugin(/.*)?		gen_context(system_u:object_r:bin_t,s0)
+/opt/google/chrome/cron/google-chrome -- gen_context(system_u:object_r:bin_t,s0)
 
 /opt/gutenprint/cups/lib/filter(/.*)?	gen_context(system_u:object_r:bin_t,s0)
 
Index: refpolicy-2.20170917/policy/modules/contrib/xguest.te
===================================================================
--- refpolicy-2.20170917.orig/policy/modules/contrib/xguest.te
+++ refpolicy-2.20170917/policy/modules/contrib/xguest.te
@@ -103,7 +103,7 @@ optional_policy(`
 ')
 
 optional_policy(`
-	mozilla_role(xguest_r, xguest_t)
+	mozilla_role(xguest_r, xguest_t, user_devpts_t)
 ')
 
 optional_policy(`
Index: refpolicy-2.20170917/policy/modules/roles/staff.te
===================================================================
--- refpolicy-2.20170917.orig/policy/modules/roles/staff.te
+++ refpolicy-2.20170917/policy/modules/roles/staff.te
@@ -142,7 +142,7 @@ ifndef(`distro_redhat',`
 	')
 
 	optional_policy(`
-		mozilla_role(staff_r, staff_t)
+		mozilla_role(staff_r, staff_t, user_devpts_t)
 	')
 
 	optional_policy(`
Index: refpolicy-2.20170917/policy/modules/roles/sysadm.te
===================================================================
--- refpolicy-2.20170917.orig/policy/modules/roles/sysadm.te
+++ refpolicy-2.20170917/policy/modules/roles/sysadm.te
@@ -648,7 +648,7 @@ optional_policy(`
 ')
 
 optional_policy(`
-	mozilla_role(sysadm_r, sysadm_t)
+	mozilla_role(sysadm_r, sysadm_t, user_devpts_t)
 ')
 
 optional_policy(`
Index: refpolicy-2.20170917/policy/modules/roles/unprivuser.te
===================================================================
--- refpolicy-2.20170917.orig/policy/modules/roles/unprivuser.te
+++ refpolicy-2.20170917/policy/modules/roles/unprivuser.te
@@ -114,7 +114,7 @@ ifndef(`distro_redhat',`
 	')
 
 	optional_policy(`
-		mozilla_role(user_r, user_t)
+		mozilla_role(user_r, user_t, user_devpts_t)
 	')
 
 	optional_policy(`