got some problems with the selinux policy

* got some problems with the selinux policy
@ 2015-04-14  3:29 kuangjiou
  2015-04-14 13:00 ` Stephen Smalley
  0 siblings, 1 reply; 5+ messages in thread
From: kuangjiou @ 2015-04-14  3:29 UTC (permalink / raw)
  To: selinux

[-- Attachment #1.1: Type: text/plain, Size: 1363 bytes --]

Hello,everyone!

I am trying to setup selinux in my linux (SLES 11 sp3 with kernel 3.0.76-0.11-default, the /selinux/policyvers is 26), and I got some problem when reboot the OS after i install my own selinux policy. I would be very grateful if anyone can help me to solve this problem
Here are some description of my problem

1.when I compile my policy to a non-mls policy (version 24),and add the boot parameters (security=selinux selinux=1),The system will stuck in the start page.
2 when I set the boot parameters to selinux=0,the system will start successful
3 when I set the boot parameter to (security=selinux selinux=1), and delete the /etc/selinux/config so that the os will not load the selinux policy during the start time. After the OS is started, I rebuild the /etc/selinux/config file and use the load_policy command to load the selinux policy, It can loaded successful.

4 when I compile my policy to a mls policy (version 24).and set the boot parameters (security=selinux selinux=1),The system will start successful

5 when I try the actions all above than compile the policy to version 26, the results are the same.

6 when I try the actions all above in my other linux (SLES 11 sp1 with 2.6.32.12-0.7-default,the /selinux/policyvers is 26 ) the system will start successful

and you can see my policy.conf in the attachment.

[-- Attachment #1.2: Type: text/html, Size: 4376 bytes --]

[-- Attachment #2: policy.conf --]
[-- Type: application/octet-stream, Size: 32561 bytes --]

# FLASK

#
# Define the security object classes 
#

# Classes marked as userspace are classes
# for userspace object managers

class security
class process
class system
class capability

# file-related classes
class filesystem
class file
class dir
class fd
class lnk_file
class chr_file
class blk_file
class sock_file
class fifo_file

# network-related classes
class socket
class tcp_socket
class udp_socket
class rawip_socket
class node
class netif
class netlink_socket
class packet_socket
class key_socket
class unix_stream_socket
class unix_dgram_socket

# sysv-ipc-related classes
class sem
class msg
class msgq
class shm
class ipc

#
# userspace object manager classes
#

# passwd/chfn/chsh
class passwd			# userspace

# SE-X Windows stuff (more classes below)
class x_drawable		# userspace
class x_screen			# userspace
class x_gc			# userspace
class x_font			# userspace
class x_colormap		# userspace
class x_property		# userspace
class x_selection		# userspace
class x_cursor			# userspace
class x_client			# userspace
class x_device			# userspace
class x_server			# userspace
class x_extension		# userspace

# extended netlink sockets
class netlink_route_socket
class netlink_firewall_socket
class netlink_tcpdiag_socket
class netlink_nflog_socket
class netlink_xfrm_socket
class netlink_selinux_socket
class netlink_audit_socket
class netlink_ip6fw_socket
class netlink_dnrt_socket

class dbus			# userspace
class nscd			# userspace

# IPSec association
class association

# Updated Netlink class for KOBJECT_UEVENT family.
class netlink_kobject_uevent_socket

class appletalk_socket

class packet

# Kernel access key retention
class key

class context			# userspace

class dccp_socket

class memprotect

class db_database		# userspace
class db_table			# userspace
class db_procedure		# userspace
class db_column			# userspace
class db_tuple			# userspace
class db_blob			# userspace

# network peer labels
class peer

# Capabilities >= 32
class capability2

# More SE-X Windows stuff
class x_resource		# userspace
class x_event			# userspace
class x_synthetic_event		# userspace
class x_application_data	# userspace

# FLASK
# FLASK

#
# Define initial security identifiers 
#

sid kernel
sid security
sid unlabeled
sid fs
sid file
sid file_labels
sid init
sid any_socket
sid port
sid netif
sid netmsg
sid node
sid igmp_packet
sid icmp_socket
sid tcp_socket
sid sysctl_modprobe
sid sysctl
sid sysctl_fs
sid sysctl_kernel
sid sysctl_net
sid sysctl_net_unix
sid sysctl_vm
sid sysctl_dev
sid kmod
sid policy
sid scmp_packet
sid devnull

# FLASK
#
# Define common prefixes for access vectors
#
# common common_name { permission_name ... }

#
# Define a common prefix for file access vectors.
#

common file
{
	ioctl
	read
	write
	create
	getattr
	setattr
	lock
	relabelfrom
	relabelto
	append
	unlink
	link
	rename
	execute
	swapon
	quotaon
	mounton
}

#
# Define a common prefix for socket access vectors.
#

common socket
{
# inherited from file
	ioctl
	read
	write
	create
	getattr
	setattr
	lock
	relabelfrom
	relabelto
	append
# socket-specific
	bind
	connect
	listen
	accept
	getopt
	setopt
	shutdown
	recvfrom
	sendto
	recv_msg
	send_msg
	name_bind
}	

#
# Define a common prefix for ipc access vectors.
#

common ipc
{
	create
	destroy
	getattr
	setattr
	read
	write
	associate
	unix_read
	unix_write
}

#
#  Define a common prefix for userspace database object access vectors.
#

common database
{
	create
	drop
	getattr
	setattr
	relabelfrom
	relabelto
}

#
# Define the access vectors.
#
# class class_name [ inherits common_name ] { permission_name ... }

#
# Define the access vector interpretation for file-related objects.
#

class filesystem
{
	mount
	remount
	unmount
	getattr
	relabelfrom
	relabelto
	transition
	associate
	quotamod
	quotaget
}

class dir
inherits file
{
	add_name
	remove_name
	reparent
	search
	rmdir
	open
}

class file
inherits file
{
	execute_no_trans
	entrypoint
	execmod
	open
}

class lnk_file
inherits file

class chr_file
inherits file
{
	execute_no_trans
	entrypoint
	execmod
	open
}

class blk_file
inherits file
{
	open
}

class sock_file
inherits file

class fifo_file
inherits file
{
	open
}

class fd
{
	use
}

#
# Define the access vector interpretation for network-related objects.
#

class socket
inherits socket

class tcp_socket
inherits socket
{
	connectto
	newconn
	acceptfrom
	node_bind
	name_connect
}

class udp_socket
inherits socket
{
	node_bind
}

class rawip_socket
inherits socket
{
	node_bind
}

class node 
{
	tcp_recv
	tcp_send
	udp_recv
	udp_send
	rawip_recv
	rawip_send
	enforce_dest
	dccp_recv
	dccp_send
	recvfrom
	sendto
}

class netif
{
	tcp_recv
	tcp_send
	udp_recv
	udp_send
	rawip_recv
	rawip_send
	dccp_recv
	dccp_send
	ingress
	egress
}

class netlink_socket
inherits socket

class packet_socket
inherits socket

class key_socket
inherits socket

class unix_stream_socket
inherits socket
{
	connectto
	newconn
	acceptfrom
}

class unix_dgram_socket
inherits socket

#
# Define the access vector interpretation for process-related objects
#

class process
{
	fork
	transition
	sigchld # commonly granted from child to parent
	sigkill # cannot be caught or ignored
	sigstop # cannot be caught or ignored
	signull # for kill(pid, 0)
	signal  # all other signals
	ptrace
	getsched
	setsched
	getsession
	getpgid
	setpgid
	getcap
	setcap
	share
	getattr
	setexec
	setfscreate
	noatsecure
	siginh
	setrlimit
	rlimitinh
	dyntransition
	setcurrent
	execmem
	execstack
	execheap
	setkeycreate
	setsockcreate
}

#
# Define the access vector interpretation for ipc-related objects
#

class ipc
inherits ipc

class sem
inherits ipc

class msgq
inherits ipc
{
	enqueue
}

class msg
{
	send
	receive
}

class shm
inherits ipc
{
	lock
}

#
# Define the access vector interpretation for the security server. 
#

class security
{
	compute_av
	compute_create
	compute_member
	check_context
	load_policy
	compute_relabel
	compute_user
	setenforce     # was avc_toggle in system class
	setbool
	setsecparam
	setcheckreqprot
}

#
# Define the access vector interpretation for system operations.
#

class system
{
	ipc_info
	syslog_read  
	syslog_mod
	syslog_console
}

#
# Define the access vector interpretation for controling capabilies
#

class capability
{
	# The capabilities are defined in include/linux/capability.h
	# Capabilities >= 32 are defined in the capability2 class.
	# Care should be taken to ensure that these are consistent with
	# those definitions. (Order matters)

	chown           
	dac_override    
	dac_read_search 
	fowner          
	fsetid          
	kill            
	setgid           
	setuid           
	setpcap          
	linux_immutable  
	net_bind_service 
	net_broadcast    
	net_admin        
	net_raw          
	ipc_lock         
	ipc_owner        
	sys_module       
	sys_rawio        
	sys_chroot       
	sys_ptrace       
	sys_pacct        
	sys_admin        
	sys_boot         
	sys_nice         
	sys_resource     
	sys_time         
	sys_tty_config  
	mknod
	lease
	audit_write
	audit_control
	setfcap
}

class capability2 
{
	mac_override	# unused by SELinux
	mac_admin	# unused by SELinux
}

#
# Define the access vector interpretation for controlling
# changes to passwd information.
#
class passwd
{
	passwd	# change another user passwd
	chfn	# change another user finger info
	chsh	# change another user shell
	rootok  # pam_rootok check (skip auth)
	crontab # crontab on another user
}

#
# SE-X Windows stuff
#
class x_drawable
{
	create
	destroy
	read
	write
	blend
	getattr
	setattr
	list_child
	add_child
	remove_child
	list_property
	get_property
	set_property
	manage
	override
	show
	hide
	send
	receive
}

class x_screen
{
	getattr
	setattr
	hide_cursor
	show_cursor
	saver_getattr
	saver_setattr
	saver_hide
	saver_show
}

class x_gc
{
	create
	destroy
	getattr
	setattr
	use
}

class x_font
{
	create
	destroy
	getattr
	add_glyph
	remove_glyph
	use
}

class x_colormap
{
	create
	destroy
	read
	write
	getattr
	add_color
	remove_color
	install
	uninstall
	use
}

class x_property
{
	create
	destroy
	read
	write
	append
	getattr
	setattr
}

class x_selection
{
	read
	write
	getattr
	setattr
}

class x_cursor
{
	create
	destroy
	read
	write
	getattr
	setattr
	use
}

class x_client
{
	destroy
	getattr
	setattr
	manage
}

class x_device
{
	getattr
	setattr
	use
	read
	write
	getfocus
	setfocus
	bell
	force_cursor
	freeze
	grab
	manage
}

class x_server
{
	getattr
	setattr
	record
	debug
	grab
	manage
}

class x_extension
{
	query
	use
}

class x_resource
{
	read
	write
}

class x_event
{
	send
	receive
}

class x_synthetic_event
{
	send
	receive
}

#
# Extended Netlink classes
#
class netlink_route_socket
inherits socket
{
	nlmsg_read
	nlmsg_write
}

class netlink_firewall_socket
inherits socket
{
	nlmsg_read
	nlmsg_write
}

class netlink_tcpdiag_socket
inherits socket
{
	nlmsg_read
	nlmsg_write
}

class netlink_nflog_socket
inherits socket

class netlink_xfrm_socket
inherits socket
{
	nlmsg_read
	nlmsg_write
}

class netlink_selinux_socket
inherits socket

class netlink_audit_socket
inherits socket
{
	nlmsg_read
	nlmsg_write
	nlmsg_relay
	nlmsg_readpriv
}

class netlink_ip6fw_socket
inherits socket
{
	nlmsg_read
	nlmsg_write
}

class netlink_dnrt_socket
inherits socket

# Define the access vector interpretation for controlling
# access and communication through the D-BUS messaging
# system.
#
class dbus
{
	acquire_svc
	send_msg
}

# Define the access vector interpretation for controlling
# access through the name service cache daemon (nscd).
#
class nscd
{
	getpwd
	getgrp
	gethost
	getstat
	admin
	shmempwd
	shmemgrp
	shmemhost
	getserv
	shmemserv
}

# Define the access vector interpretation for controlling
# access to IPSec network data by association
#
class association
{
	sendto
	recvfrom
	setcontext
	polmatch
}

# Updated Netlink class for KOBJECT_UEVENT family.
class netlink_kobject_uevent_socket
inherits socket

class appletalk_socket
inherits socket

class packet
{
	send
	recv
	relabelto
	flow_in		# not currently in use
	flow_out	# not currently in use
	forward_in
	forward_out
}

class key
{
	view
	read
	write
	search
	link
	setattr
	create
}

class context
{
	translate
	contains
}

class dccp_socket
inherits socket
{
	node_bind
	name_connect
}

class memprotect
{
	mmap_zero
}

class db_database
inherits database
{
	access
	install_module
	load_module
	get_param
	set_param
}

class db_table
inherits database
{
	use
	select
	update
	insert
	delete
	lock
}

class db_procedure
inherits database
{
	execute
	entrypoint
}

class db_column
inherits database
{
	use
	select
	update
	insert
}

class db_tuple
{
	relabelfrom
	relabelto
	use
	select
	update
	insert
	delete
}

class db_blob
inherits database
{
	read
	write
	import
	export
}

# network peer labels
class peer
{
	recv
}

class x_application_data
{
	paste
	paste_after_confirm
	copy
}
#
# Directory patterns (dir)
#
# Parameters:
# 1. domain type
# 2. container (directory) type
# 3. directory type
#

#
# Regular file patterns (file)
#
# Parameters:
# 1. domain type
# 2. container (directory) type
# 3. file type
#

#
# Symbolic link patterns (lnk_file)
#
# Parameters:
# 1. domain type
# 2. container (directory) type
# 3. file type
#

#
# (Un)named Pipes/FIFO patterns (fifo_file)
#
# Parameters:
# 1. domain type
# 2. container (directory) type
# 3. file type
#

#
# (Un)named sockets patterns (sock_file)
#
# Parameters:
# 1. domain type
# 2. container (directory) type
# 3. file type
#

#
# Block device node patterns (blk_file)
#
# Parameters:
# 1. domain type
# 2. container (directory) type
# 3. file type
#

#
# Character device node patterns (chr_file)
#
# Parameters:
# 1. domain type
# 2. container (directory) type
# 3. file type
#

#
# File type_transition patterns
#
# pattern(domain,dirtype,newtype,class(es))
#

#
# unix domain socket patterns
#

########################################
#
# Macros for switching between source policy
# and loadable policy module support
#

##############################
#
# For adding the module statement
#

##############################
#
# For use in interfaces, to optionally insert a require block
#

# helper function, since m4 wont expand macros
# if a line is a comment (#):

##############################
#
# In the future interfaces should be in loadable modules
#
# template(name,rules)
#

##############################
#
# In the future interfaces should be in loadable modules
#
# interface(name,rules)
#

##############################
#
# Optional policy handling
#

##############################
#
# Determine if we should use the default
# tunable value as specified by the policy
# or if the override value should be used
#

##############################
#
# Extract booleans out of an expression.
# This needs to be reworked so expressions
# with parentheses can work.

##############################
#
# Tunable declaration
#

##############################
#
# Tunable policy handling
#

########################################
#
# Helper macros
#

#
# shiftn(num,list...)
#
# shift the list num times
#

#
# ifndef(expr,true_block,false_block)
#
# m4 does not have this.
#

#
# __endline__
#
# dummy macro to insert a newline.  used for 
# errprint, so the close parentheses can be
# indented correctly.
#

########################################
#
# refpolwarn(message)
#
# print a warning message
#

########################################
#
# refpolerr(message)
#
# print an error message.  does not
# make anything fail.
#

########################################
#
# gen_user(username, prefix, role_set, mls_defaultlevel, mls_range, [mcs_categories])
#

########################################
#
# gen_context(context,mls_sensitivity,[mcs_categories])
#

########################################
#
# can_exec(domain,executable)
#

########################################
#
# gen_bool(name,default_value)
#

#
# Specified domain transition patterns
#

# compatibility:

#
# Automatic domain transition patterns
#

# compatibility:

#
# Other process permissions
#

########################################
#
# gen_cats(N)
#
# declares categores c0 to c(N-1)
#

########################################
#
# gen_sens(N)
#
# declares sensitivites s0 to s(N-1) with dominance
# in increasing numeric order with s0 lowest, s(N-1) highest
#

########################################
#
# gen_levels(N,M)
#
# levels from s0 to (N-1) with categories c0 to (M-1)
#

########################################
#
# Basic level names for system low and high
#

########################################
# 
# Support macros for sets of object classes and permissions
#
# This file should only have object class and permission set macros - they
# can only reference object classes and/or permissions.

#
# All directory and file classes
#

#
# All non-directory file classes.
#

#
# Non-device file classes.
#

#
# Device file classes.
#

#
# All socket classes.
#

#
# Datagram socket classes.
# 

#
# Stream socket classes.
#

#
# Unprivileged socket classes (exclude rawip, netlink, packet).
#

########################################
# 
# Macros for sets of permissions
#

# 
# Permissions for getting file attributes.
#

# 
# Permissions for executing files.
#

# 
# Permissions for reading files and their attributes.
#

# 
# Permissions for reading and executing files.
#

# 
# Permissions for reading and appending to files.
#

#
# Permissions for linking, unlinking and renaming files.
# 

#
# Permissions for creating lnk_files.
#

# 
# Permissions for reading directories and their attributes.
#

# 
# Permissions for reading and writing directories and their attributes.
#

# 
# Permissions for reading and adding names to directories.
#

#
# Permissions to mount and unmount file systems.
#

#
# Permissions for using sockets.
# 

#
# Permissions for creating and using sockets.
# 

#
# Permissions for using stream sockets.
# 

#
# Permissions for creating and using stream sockets.
# 

#
# Permissions for creating and using sockets.
# 

#
# Permissions for creating and using sockets.
# 

#
# Permissions for creating and using netlink sockets.
# 

#
# Permissions for using netlink sockets for operations that modify state.
# 

#
# Permissions for using netlink sockets for operations that observe state.
# 

#
# Permissions for sending all signals.
#

#
# Permissions for sending and receiving network packets.
#

#
# Permissions for using System V IPC
#

########################################
#
# New permission sets
#

#
# Directory (dir)
#

#
# Regular file (file)
#

#
# Symbolic link (lnk_file)
#

#
# (Un)named Pipes/FIFOs (fifo_file)
#

#
# (Un)named Sockets (sock_file)
#

#
# Block device nodes (blk_file)
#

#
# Character device nodes (chr_file)
#

########################################
#
# Special permission sets
#

#
# Use (read and write) terminals
#

#
# Sockets
#

  #
# This file contains the policy capabilites
# that are enabled in this policy, not a
# declaration of DAC capabilites such as
# CAP_DAC_OVERRIDE.
#
# The affected object classes and their
# permissions should also be listed in
# the comments for each capability.
#

# Enable additional networking access control for
# labeled networking peers.
#
# Checks enabled:
# node: sendto recvfrom
# netif: ingress egress
# peer: recv
#
#policycap network_peer_controls;

# Enable additional access controls for opening
# a file (and similar objects).
#
# Checks enabled:
# dir: open
# file: open
# lnk_file: open
# fifo_file: open
# chr_file: open
# blk_file: open
#
# The only type defined for this policy:
attribute common_domain;
attribute file_type;

type unconfined_t, common_domain, file_type;
type security_t, file_type;
type selinux_config_t, file_type; 

# The roles defined for this policy:
role unconfined_r;
role unconfined_r types { unconfined_t };
#
# These allow rules enable all of the objects to access all of their
# permissions. This effectively gives access to everything.
#
allow common_domain unconfined_t:security *;
allow common_domain unconfined_t:process *;
allow common_domain unconfined_t:system *;
allow common_domain unconfined_t:capability *;
allow common_domain unconfined_t:filesystem *;
allow common_domain unconfined_t:file *;
allow common_domain unconfined_t:dir *;
allow common_domain unconfined_t:fd *;
allow common_domain unconfined_t:lnk_file *;
allow common_domain unconfined_t:chr_file *;
allow common_domain unconfined_t:blk_file *;
allow common_domain unconfined_t:sock_file *;
allow common_domain unconfined_t:fifo_file *;
allow common_domain unconfined_t:socket *;
allow common_domain unconfined_t:tcp_socket *;
allow common_domain unconfined_t:udp_socket *;
allow common_domain unconfined_t:rawip_socket *;
allow common_domain unconfined_t:node *;
allow common_domain unconfined_t:netif *;
allow common_domain unconfined_t:netlink_socket *;
allow common_domain unconfined_t:packet_socket *;
allow common_domain unconfined_t:key_socket *;
allow common_domain unconfined_t:unix_stream_socket *;
allow common_domain unconfined_t:unix_dgram_socket *;
allow common_domain unconfined_t:sem *;
allow common_domain unconfined_t:msg *;
allow common_domain unconfined_t:msgq *;
allow common_domain unconfined_t:shm *;
allow common_domain unconfined_t:ipc *;
allow common_domain unconfined_t:passwd *;
#allow common_domain unconfined_t:x_drawable *;
#allow common_domain unconfined_t:x_screen *;
#allow common_domain unconfined_t:x_gc *;
#allow common_domain unconfined_t:x_font *;
#allow common_domain unconfined_t:x_colormap *;
#allow common_domain unconfined_t:x_property *;
#allow common_domain unconfined_t:x_selection *;
#allow common_domain unconfined_t:x_cursor *;
#allow common_domain unconfined_t:x_client *;
#allow common_domain unconfined_t:x_device *;
#allow common_domain unconfined_t:x_server *;
allow common_domain unconfined_t:x_extension *;
allow common_domain unconfined_t:netlink_route_socket *;
allow common_domain unconfined_t:netlink_firewall_socket *;
allow common_domain unconfined_t:netlink_tcpdiag_socket *;
allow common_domain unconfined_t:netlink_nflog_socket *;
allow common_domain unconfined_t:netlink_xfrm_socket *;
allow common_domain unconfined_t:netlink_selinux_socket *;
allow common_domain unconfined_t:netlink_audit_socket *;
allow common_domain unconfined_t:netlink_ip6fw_socket *;
allow common_domain unconfined_t:netlink_dnrt_socket *;
#allow common_domain unconfined_t:dbus *;
#allow common_domain unconfined_t:nscd *;
allow common_domain unconfined_t:association *;
allow common_domain unconfined_t:netlink_kobject_uevent_socket *;
allow common_domain unconfined_t:appletalk_socket *;
allow common_domain unconfined_t:packet *;
allow common_domain unconfined_t:key *;
#allow common_domain unconfined_t:context *;
allow common_domain unconfined_t:dccp_socket *;
allow common_domain unconfined_t:memprotect *;
#allow common_domain unconfined_t:db_database *;
#allow common_domain unconfined_t:db_table *;
#allow common_domain unconfined_t:db_procedure *;
#allow common_domain unconfined_t:db_column *;
#allow common_domain unconfined_t:db_tuple *;
#allow common_domain unconfined_t:db_blob *;
allow common_domain unconfined_t:peer *;
allow common_domain unconfined_t:capability2 *;
#allow common_domain unconfined_t:x_resource *;
#allow common_domain unconfined_t:x_event *;
#allow common_domain unconfined_t:x_synthetic_event *;
#allow common_domain unconfined_t:x_application_data *;
#allow common_domain unconfined_t:kernel_service *;
#allow common_domain unconfined_t:tun_socket *;
#allow common_domain unconfined_t:x_pointer *;
#allow common_domain unconfined_t:x_keyboard *;

allow common_domain self:security *;
allow common_domain self:process *;
allow common_domain self:system *;
allow common_domain self:capability *;
allow common_domain self:filesystem *;
allow common_domain self:file *;
allow common_domain self:dir *;
allow common_domain self:fd *;
allow common_domain self:lnk_file *;
allow common_domain self:chr_file *;
allow common_domain self:blk_file *;
allow common_domain self:sock_file *;
allow common_domain self:fifo_file *;
allow common_domain self:socket *;
allow common_domain self:tcp_socket *;
allow common_domain self:udp_socket *;
allow common_domain self:rawip_socket *;
allow common_domain self:node *;
allow common_domain self:netif *;
allow common_domain self:netlink_socket *;
allow common_domain self:packet_socket *;
allow common_domain self:key_socket *;
allow common_domain self:unix_stream_socket *;
allow common_domain self:unix_dgram_socket *;
allow common_domain self:sem *;
allow common_domain self:msg *;
allow common_domain self:msgq *;
allow common_domain self:shm *;
allow common_domain self:ipc *;
allow common_domain self:passwd *;
#allow common_domain self:x_drawable *;
#allow common_domain self:x_screen *;
#allow common_domain self:x_gc *;
#allow common_domain self:x_font *;
#allow common_domain self:x_colormap *;
#allow common_domain self:x_property *;
#allow common_domain self:x_selection *;
#allow common_domain self:x_cursor *;
#allow common_domain self:x_client *;
#allow common_domain self:x_device *;
#allow common_domain self:x_server *;
#allow common_domain self:x_extension *;
allow common_domain self:netlink_route_socket *;
allow common_domain self:netlink_firewall_socket *;
allow common_domain self:netlink_tcpdiag_socket *;
allow common_domain self:netlink_nflog_socket *;
allow common_domain self:netlink_xfrm_socket *;
allow common_domain self:netlink_selinux_socket *;
allow common_domain self:netlink_audit_socket *;
allow common_domain self:netlink_ip6fw_socket *;
allow common_domain self:netlink_dnrt_socket *;
#allow common_domain self:dbus *;
#allow common_domain self:nscd *;
allow common_domain self:association *;
allow common_domain self:netlink_kobject_uevent_socket *;
allow common_domain self:appletalk_socket *;
allow common_domain self:packet *;
allow common_domain self:key *;
#allow common_domain self:context *;
allow common_domain self:dccp_socket *;
allow common_domain self:memprotect *;
#allow common_domain self:db_database *;
#allow common_domain self:db_table *;
#allow common_domain self:db_procedure *;
#allow common_domain self:db_column *;
#allow common_domain self:db_tuple *;
#allow common_domain self:db_blob *;
allow common_domain self:peer *;
allow common_domain self:capability2 *;
#allow common_domain self:x_resource *;
#allow common_domain self:x_event *;
#allow common_domain self:x_synthetic_event *;
#allow common_domain self:x_application_data *;
#allow common_domain self:kernel_service *;
#allow common_domain self:tun_socket *;
#allow common_domain self:x_pointer *;
#allow common_domain self:x_keyboard *;

allow common_domain security_t:dir { search getattr };
allow common_domain security_t:file read;
allow common_domain security_t:filesystem getattr;
allow common_domain selinux_config_t:dir search;
allow common_domain selinux_config_t:file { read getattr };

allow file_type unconfined_t:filesystem associate;

#============= unconfined_t ==============
allow unconfined_t security_t:filesystem getattr;
allow unconfined_t security_t:security { compute_user compute_av compute_relabel };
allow unconfined_t security_t:dir { getattr search read lock ioctl };
allow unconfined_t security_t:file { getattr read lock ioctl };
allow unconfined_t selinux_config_t:dir { getattr search read lock ioctl };
allow unconfined_t selinux_config_t:file { getattr read lock ioctl };
#============= selinux_config_t ==============
allow selinux_config_t unconfined_t:filesystem { associate };

# The only real SELinux user defined for this policy:
user user_u roles { unconfined_r };

#
# The system_u user is defined so that objects can be labeled with
# system_u:object_r as in standard policies, also so that semanage can add
# ports etc. as it requires a system_u user for adding these type of objects.
user system_u roles { unconfined_r };

#
# This role constraint statement will be used to show limiting
# a role transition in the external gateway. For now comment out:
# constrain process transition ( r1 == r2 );

#
# These are the default labeling operations for these objects.
# Note that the kernel entry is unconfined_r not object_r
#

sid netmsg system_u:object_r:unconfined_t
sid port system_u:object_r:unconfined_t
sid node system_u:object_r:unconfined_t
sid netif system_u:object_r:unconfined_t
sid devnull system_u:object_r:unconfined_t
sid file system_u:object_r:unconfined_t
sid fs system_u:object_r:unconfined_t
sid kernel system_u:unconfined_r:unconfined_t
sid sysctl system_u:object_r:unconfined_t
sid unlabeled system_u:object_r:unconfined_t
sid any_socket          system_u:object_r:unconfined_t
sid file_labels         system_u:object_r:unconfined_t
sid icmp_socket         system_u:object_r:unconfined_t
sid igmp_packet         system_u:object_r:unconfined_t
sid init                system_u:object_r:unconfined_t
sid kmod                system_u:object_r:unconfined_t
sid policy              system_u:object_r:unconfined_t
sid scmp_packet         system_u:object_r:unconfined_t
sid sysctl_modprobe     system_u:object_r:unconfined_t
sid sysctl_fs           system_u:object_r:unconfined_t
sid sysctl_kernel       system_u:object_r:unconfined_t
sid sysctl_net          system_u:object_r:unconfined_t
sid sysctl_net_unix     system_u:object_r:unconfined_t
sid sysctl_vm           system_u:object_r:unconfined_t
sid sysctl_dev          system_u:object_r:unconfined_t
sid tcp_socket          system_u:object_r:unconfined_t
sid security system_u:object_r:security_t
fs_use_xattr ecryptfs system_u:object_r:unconfined_t;
fs_use_xattr encfs system_u:object_r:unconfined_t;
fs_use_xattr ext2 system_u:object_r:unconfined_t;
fs_use_xattr ext3 system_u:object_r:unconfined_t;
fs_use_xattr ext4 system_u:object_r:unconfined_t;
fs_use_xattr ext4dev system_u:object_r:unconfined_t;
fs_use_xattr gfs system_u:object_r:unconfined_t;
fs_use_xattr gfs2 system_u:object_r:unconfined_t;
fs_use_xattr jffs2 system_u:object_r:unconfined_t;
fs_use_xattr jfs system_u:object_r:unconfined_t;
fs_use_xattr lustre system_u:object_r:unconfined_t;
fs_use_xattr xfs system_u:object_r:unconfined_t;
fs_use_task eventpollfs system_u:object_r:unconfined_t;
fs_use_task pipefs system_u:object_r:unconfined_t;
fs_use_task sockfs system_u:object_r:unconfined_t;
fs_use_trans mqueue system_u:object_r:unconfined_t;
fs_use_trans shm system_u:object_r:unconfined_t;
fs_use_trans tmpfs system_u:object_r:unconfined_t;
fs_use_trans devpts system_u:object_r:unconfined_t;
genfscon proc /mtrr system_u:object_r:unconfined_t
genfscon sysfs / system_u:object_r:unconfined_t
genfscon usbfs / system_u:object_r:unconfined_t
genfscon usbdevfs / system_u:object_r:unconfined_t
genfscon rootfs / system_u:object_r:unconfined_t
genfscon proc /kallsyms system_u:object_r:unconfined_t
genfscon anon_inodefs / system_u:object_r:unconfined_t
genfscon bdev / system_u:object_r:unconfined_t
genfscon binfmt_misc / system_u:object_r:unconfined_t
genfscon capifs / system_u:object_r:unconfined_t
genfscon configfs / system_u:object_r:unconfined_t
genfscon cpuset / system_u:object_r:unconfined_t
genfscon futexfs / system_u:object_r:unconfined_t
genfscon hugetlbfs / system_u:object_r:unconfined_t
genfscon ibmasmfs / system_u:object_r:unconfined_t
genfscon inotifyfs / system_u:object_r:unconfined_t
genfscon mvfs / system_u:object_r:unconfined_t
genfscon nfsd / system_u:object_r:unconfined_t
genfscon oprofilefs / system_u:object_r:unconfined_t
genfscon ramfs / system_u:object_r:unconfined_t
genfscon romfs / system_u:object_r:unconfined_t
genfscon cramfs / system_u:object_r:unconfined_t
genfscon rpc_pipefs / system_u:object_r:unconfined_t
genfscon spufs / system_u:object_r:unconfined_t
genfscon squash / system_u:object_r:unconfined_t
genfscon vmblock / system_u:object_r:unconfined_t
genfscon vxfs / system_u:object_r:unconfined_t
genfscon autofs / system_u:object_r:unconfined_t
genfscon automount / system_u:object_r:unconfined_t
genfscon cifs / system_u:object_r:unconfined_t
genfscon smbfs / system_u:object_r:unconfined_t
genfscon fat / system_u:object_r:unconfined_t
genfscon msdos / system_u:object_r:unconfined_t
genfscon ntfs-3g / system_u:object_r:unconfined_t
genfscon ntfs / system_u:object_r:unconfined_t
genfscon vfat / system_u:object_r:unconfined_t
genfscon fuse / system_u:object_r:unconfined_t
genfscon fuseblk / system_u:object_r:unconfined_t
genfscon fusectl / system_u:object_r:unconfined_t
genfscon iso9660 / system_u:object_r:unconfined_t
genfscon udf / system_u:object_r:unconfined_t
genfscon nfs / system_u:object_r:unconfined_t
genfscon nfs4 / system_u:object_r:unconfined_t
genfscon afs / system_u:object_r:unconfined_t
genfscon coda / system_u:object_r:unconfined_t
genfscon hfs / system_u:object_r:unconfined_t
genfscon hfsplus / system_u:object_r:unconfined_t
genfscon lustre / system_u:object_r:unconfined_t
genfscon reiserfs / system_u:object_r:unconfined_t
genfscon panfs / system_u:object_r:unconfined_t
genfscon cgroup / system_u:object_r:unconfined_t
genfscon debugfs / system_u:object_r:unconfined_t
genfscon kvmfs / system_u:object_r:unconfined_t
genfscon proc / system_u:object_r:unconfined_t
genfscon proc /sysvipc system_u:object_r:unconfined_t
genfscon proc /fs/openafs system_u:object_r:unconfined_t
genfscon proc /kmsg system_u:object_r:unconfined_t
genfscon proc /kcore system_u:object_r:unconfined_t
genfscon proc /mdstat system_u:object_r:unconfined_t
genfscon proc /net system_u:object_r:unconfined_t
genfscon proc /xen system_u:object_r:unconfined_t
genfscon proc /sys system_u:object_r:unconfined_t
genfscon proc /irq system_u:object_r:unconfined_t
genfscon proc /net/rpc system_u:object_r:unconfined_t
genfscon proc /sys/fs system_u:object_r:unconfined_t
genfscon proc /sys/kernel system_u:object_r:unconfined_t
genfscon proc /sys/kernel/modprobe system_u:object_r:unconfined_t
genfscon proc /sys/kernel/hotplug system_u:object_r:unconfined_t
genfscon proc /sys/net system_u:object_r:unconfined_t
genfscon proc /sys/net/unix system_u:object_r:unconfined_t
genfscon proc /sys/vm system_u:object_r:unconfined_t
genfscon proc /sys/dev system_u:object_r:unconfined_t
genfscon selinuxfs / system_u:object_r:security_t
genfscon securityfs / system_u:object_r:security_t

^ permalink raw reply	[flat|nested] 5+ messages in thread