diff options
author | Russell Coker <russell@coker.com.au> | 2019-01-28 19:46:49 +1100 |
---|---|---|
committer | Jason Zaman <jason@perfinion.com> | 2019-02-10 12:11:25 +0800 |
commit | 60e0d1b33e0be37edd4e8971e3b2cd67966574ab (patch) | |
tree | d1d8b906ae52a671cf95ad75ae897478e08438d6 | |
parent | yet another little patch (diff) | |
download | hardened-refpolicy-60e0d1b3.tar.gz hardened-refpolicy-60e0d1b3.tar.bz2 hardened-refpolicy-60e0d1b3.zip |
chromium
There are several nacl binaries that need labels.
Put an ifdef debian for some chromium paths.
Git policy misses chromium_role() lines, were they in another patch that was
submitted at the same time?
I don't know what this is for but doesn't seem harmful to allow it:
type=PROCTITLE msg=audit(28/01/19 19:31:42.361:3218) : proctitle=/bin/bash /usr/bin/google-chrome
type=SYSCALL msg=audit(28/01/19 19:31:42.361:3218) : arch=x86_64 syscall=openat success=yes exit=3 a0=0xffffff9c a1=0x563328f7b590 a2=O_WRONLY|O_CREAT|O_TRUNC a3=0x1b6 items=0 ppid=5158 pid=5166 auid=test uid=test gid=test euid=test suid=test fsuid=test egid=test sgid=test fsgid=test tty=pts7 ses=232 comm=google-chrome exe=/bin/bash subj=user_u:user_r:chromium_t:s0 key=(null)
type=AVC msg=audit(28/01/19 19:31:42.361:3218) : avc: granted { associate } for pid=5166 comm=google-chrome name=63 scontext=user_u:object_r:chromium_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=filesystem
type=AVC msg=audit(28/01/19 19:31:42.361:3218) : avc: granted { create } for pid=5166 comm=google-chrome name=63 scontext=user_u:user_r:chromium_t:s0 tcontext=user_u:object_r:chromium_t:s0 tclass=file
type=AVC msg=audit(28/01/19 19:31:42.361:3218) : avc: granted { add_name } for pid=5166 comm=google-chrome name=63 scontext=user_u:user_r:chromium_t:s0 tcontext=user_u:user_r:chromium_t:s0 tclass=dir
Allow domain_use_interactive_fds() for running via ssh -X.
Allow managing xdg data, cache, and config.
Allow reading public data from apt and dpkg, probably from lsb_release or some
other shell script.
How does the whold naclhelper thing work anyway? I'm nervous about process
share access involving chromium_sandbox_t, is that really what we want?
Added lots of other stuff like searching cgroup dirs etc.
Signed-off-by: Jason Zaman <jason@perfinion.com>
-rw-r--r-- | policy/modules/apps/chromium.fc | 7 | ||||
-rw-r--r-- | policy/modules/apps/chromium.te | 32 | ||||
-rw-r--r-- | policy/modules/roles/staff.te | 4 | ||||
-rw-r--r-- | policy/modules/roles/sysadm.te | 4 | ||||
-rw-r--r-- | policy/modules/roles/unprivuser.te | 4 |
5 files changed, 45 insertions, 6 deletions
diff --git a/policy/modules/apps/chromium.fc b/policy/modules/apps/chromium.fc index 534235dc..58a6cb45 100644 --- a/policy/modules/apps/chromium.fc +++ b/policy/modules/apps/chromium.fc @@ -2,7 +2,7 @@ /opt/google/chrome/chrome_sandbox -- gen_context(system_u:object_r:chromium_sandbox_exec_t,s0) /opt/google/chrome/chrome-sandbox -- gen_context(system_u:object_r:chromium_sandbox_exec_t,s0) /opt/google/chrome/google-chrome -- gen_context(system_u:object_r:chromium_exec_t,s0) -/opt/google/chrome/nacl_helper_bootstrap -- gen_context(system_u:object_r:chromium_naclhelper_exec_t,s0) +/opt/google/chrome/nacl_.* -- gen_context(system_u:object_r:chromium_naclhelper_exec_t,s0) /opt/google/chrome/libudev.so.0 gen_context(system_u:object_r:lib_t,s0) /opt/google/chrome-beta/chrome -- gen_context(system_u:object_r:chromium_exec_t,s0) @@ -19,9 +19,14 @@ /opt/google/chrome-unstable/nacl_helper_bootstrap -- gen_context(system_u:object_r:chromium_naclhelper_exec_t,s0) /opt/google/chrome-unstable/libudev.so.0 gen_context(system_u:object_r:lib_t,s0) +ifdef(`distro_debian',` +/usr/lib/chromium/chromium -- gen_context(system_u:object_r:chromium_exec_t,s0) +/usr/lib/chromium/chrome-sandbox -- gen_context(system_u:object_r:chromium_sandbox_exec_t,s0) +', ` /usr/lib/chromium-browser/chrome -- gen_context(system_u:object_r:chromium_exec_t,s0) /usr/lib/chromium-browser/chrome_sandbox -- gen_context(system_u:object_r:chromium_sandbox_exec_t,s0) /usr/lib/chromium-browser/chrome-sandbox -- gen_context(system_u:object_r:chromium_sandbox_exec_t,s0) +') /usr/lib/chromium-browser/chromium-launcher\.sh -- gen_context(system_u:object_r:chromium_exec_t,s0) /usr/lib/chromium-browser/nacl_helper_bootstrap -- gen_context(system_u:object_r:chromium_naclhelper_exec_t,s0) diff --git a/policy/modules/apps/chromium.te b/policy/modules/apps/chromium.te index 59c75491..7a18d814 100644 --- a/policy/modules/apps/chromium.te +++ b/policy/modules/apps/chromium.te @@ -94,8 +94,8 @@ allow chromium_t chromium_renderer_t:shm rw_shm_perms; allow chromium_t chromium_renderer_t:unix_dgram_socket { read write }; allow chromium_t chromium_renderer_t:unix_stream_socket { read write }; -allow chromium_t chromium_sandbox_t:unix_dgram_socket { read write }; -allow chromium_t chromium_sandbox_t:unix_stream_socket { read write }; +allow chromium_t chromium_sandbox_t:unix_dgram_socket { getattr read write }; +allow chromium_t chromium_sandbox_t:unix_stream_socket { getattr read write }; allow chromium_t chromium_naclhelper_t:process { share }; @@ -149,6 +149,7 @@ dev_rw_xserver_misc(chromium_t) dev_map_xserver_misc(chromium_t) domain_dontaudit_search_all_domains_state(chromium_t) +domain_use_interactive_fds(chromium_t) files_list_home(chromium_t) files_search_home(chromium_t) @@ -159,12 +160,17 @@ files_read_etc_files(chromium_t) files_dontaudit_getattr_all_dirs(chromium_t) fs_dontaudit_getattr_xattr_fs(chromium_t) +fs_getattr_tmpfs(chromium_t) +fs_search_cgroup_dirs(chromium_t) miscfiles_read_all_certs(chromium_t) miscfiles_read_localization(chromium_t) sysnet_dns_name_resolve(chromium_t) +# for /run/udev/data/* +udev_read_pid_files(chromium_t) + userdom_user_content_access_template(chromium, chromium_t) userdom_dontaudit_list_user_home_dirs(chromium_t) # Debugging. Also on user_tty_device_t if X is started through "startx" for instance @@ -195,6 +201,8 @@ tunable_policy(`chromium_rw_usb_dev',` tunable_policy(`chromium_read_system_info',` kernel_read_kernel_sysctls(chromium_t) # Memory optimizations & optimizations based on OS/version + kernel_read_crypto_sysctls(chromium_t) + kernel_read_kernel_sysctls(chromium_t) kernel_read_system_state(chromium_t) # Debugging (sys/kernel/debug) and device information (sys/bus and sys/devices). @@ -237,6 +245,13 @@ optional_policy(` ') ') +optional_policy(` + apt_read_cache(chromium_t) + apt_read_db(chromium_t) + dpkg_exec(chromium_t) + dpkg_read_db(chromium_t) +') + ifdef(`use_alsa',` optional_policy(` alsa_domain(chromium_t, chromium_tmpfs_t) @@ -309,23 +324,27 @@ allow chromium_sandbox_t chromium_t:dir list_dir_perms; allow chromium_sandbox_t chromium_t:lnk_file read_lnk_file_perms; allow chromium_sandbox_t chromium_t:file rw_file_perms; -allow chromium_sandbox_t chromium_t:unix_stream_socket { read write }; -allow chromium_sandbox_t chromium_t:unix_dgram_socket { read write }; +allow chromium_sandbox_t chromium_t:unix_stream_socket { getattr read write }; +allow chromium_sandbox_t chromium_t:unix_dgram_socket { getattr read write }; kernel_list_proc(chromium_sandbox_t) domain_dontaudit_read_all_domains_state(chromium_sandbox_t) +domain_use_interactive_fds(chromium_sandbox_t) userdom_use_user_ptys(chromium_sandbox_t) chromium_domtrans(chromium_sandbox_t) +domtrans_pattern(chromium_sandbox_t, chromium_naclhelper_exec_t, chromium_naclhelper_t) +allow chromium_sandbox_t chromium_naclhelper_t:process share; ########################################## # # Chromium nacl helper local policy # -allow chromium_naclhelper_t chromium_t:unix_stream_socket { read write }; +allow chromium_naclhelper_t chromium_t:unix_stream_socket { getattr read write }; +allow chromium_naclhelper_t chromium_sandbox_t:unix_stream_socket { getattr read write }; domain_mmap_low_uncond(chromium_naclhelper_t) @@ -338,3 +357,6 @@ tunable_policy(`chromium_read_system_info',` kernel_dontaudit_read_kernel_sysctl(chromium_naclhelper_t) kernel_dontaudit_read_system_state(chromium_naclhelper_t) ') + +dev_read_sysfs(chromium_naclhelper_t) +dev_read_urand(chromium_naclhelper_t) diff --git a/policy/modules/roles/staff.te b/policy/modules/roles/staff.te index 7b4a780a..2321ecf0 100644 --- a/policy/modules/roles/staff.te +++ b/policy/modules/roles/staff.te @@ -82,6 +82,10 @@ ifndef(`distro_redhat',` ') optional_policy(` + chromium_role(staff_r, staff_t) + ') + + optional_policy(` cron_role(staff_r, staff_t) ') diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te index 6960fc31..060c4396 100644 --- a/policy/modules/roles/sysadm.te +++ b/policy/modules/roles/sysadm.te @@ -1272,6 +1272,10 @@ ifndef(`distro_redhat',` ') optional_policy(` + chromium_role(sysadm_r, sysadm_t) + ') + + optional_policy(` cron_admin_role(sysadm_r, sysadm_t) ') diff --git a/policy/modules/roles/unprivuser.te b/policy/modules/roles/unprivuser.te index 209c904b..02e3de3b 100644 --- a/policy/modules/roles/unprivuser.te +++ b/policy/modules/roles/unprivuser.te @@ -50,6 +50,10 @@ ifndef(`distro_redhat',` ') optional_policy(` + chromium_role(user_r, user_t) + ') + + optional_policy(` cron_role(user_r, user_t) ') |