You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
 
 
 
 

286 lines
8.6 KiB

  1. ; -*- lisp -*-
  2. ;;; GNU Guix --- Functional package management for GNU
  3. ;;; Copyright © 2018 Ricardo Wurmus <rekado@elephly.net>
  4. ;;;
  5. ;;; This file is part of GNU Guix.
  6. ;;;
  7. ;;; GNU Guix is free software; you can redistribute it and/or modify it
  8. ;;; under the terms of the GNU General Public License as published by
  9. ;;; the Free Software Foundation; either version 3 of the License, or (at
  10. ;;; your option) any later version.
  11. ;;;
  12. ;;; GNU Guix is distributed in the hope that it will be useful, but
  13. ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
  14. ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  15. ;;; GNU General Public License for more details.
  16. ;;;
  17. ;;; You should have received a copy of the GNU General Public License
  18. ;;; along with GNU Guix. If not, see <http://www.gnu.org/licenses/>.
  19. ;; This is a specification for SELinux 2.7 written in the SELinux Common
  20. ;; Intermediate Language (CIL). It refers to types that must be defined in
  21. ;; the system's base policy.
  22. (block guix_daemon
  23. ;; Require existing types
  24. (typeattributeset cil_gen_require init_t)
  25. (typeattributeset cil_gen_require tmp_t)
  26. (typeattributeset cil_gen_require nscd_var_run_t)
  27. (typeattributeset cil_gen_require var_log_t)
  28. (typeattributeset cil_gen_require domain)
  29. ;; Declare own types
  30. (type guix_daemon_t)
  31. (roletype object_r guix_daemon_t)
  32. (type guix_daemon_conf_t)
  33. (roletype object_r guix_daemon_conf_t)
  34. (type guix_daemon_exec_t)
  35. (roletype object_r guix_daemon_exec_t)
  36. (type guix_daemon_socket_t)
  37. (roletype object_r guix_daemon_socket_t)
  38. (type guix_store_content_t)
  39. (roletype object_r guix_store_content_t)
  40. (type guix_profiles_t)
  41. (roletype object_r guix_profiles_t)
  42. ;; These types are domains, thereby allowing process rules
  43. (typeattributeset domain (guix_daemon_t guix_daemon_exec_t))
  44. (level low (s0))
  45. ;; When a process in init_t or guix_store_content_t spawns a
  46. ;; guix_daemon_exec_t process, let it run in the guix_daemon_t context
  47. (typetransition init_t guix_daemon_exec_t
  48. process guix_daemon_t)
  49. (typetransition guix_store_content_t guix_daemon_exec_t
  50. process guix_daemon_t)
  51. ;; Permit communication with NSCD
  52. (allow guix_daemon_t
  53. nscd_var_run_t
  54. (file (map read)))
  55. (allow guix_daemon_t
  56. nscd_var_run_t
  57. (dir (search)))
  58. (allow guix_daemon_t
  59. nscd_var_run_t
  60. (sock_file (write)))
  61. (allow guix_daemon_t
  62. nscd_t
  63. (fd (use)))
  64. (allow guix_daemon_t
  65. nscd_t
  66. (unix_stream_socket (connectto)))
  67. ;; Permit logging and temp file access
  68. (allow guix_daemon_t
  69. tmp_t
  70. (lnk_file (setattr unlink)))
  71. (allow guix_daemon_t
  72. tmp_t
  73. (dir (create
  74. rmdir
  75. add_name remove_name
  76. open read write
  77. getattr setattr
  78. search)))
  79. (allow guix_daemon_t
  80. var_log_t
  81. (file (create getattr open write)))
  82. (allow guix_daemon_t
  83. var_log_t
  84. (dir (getattr write add_name)))
  85. (allow guix_daemon_t
  86. var_run_t
  87. (lnk_file (read)))
  88. (allow guix_daemon_t
  89. var_run_t
  90. (dir (search)))
  91. ;; Spawning processes, execute helpers
  92. (allow guix_daemon_t
  93. self
  94. (process (fork)))
  95. (allow guix_daemon_t
  96. guix_daemon_exec_t
  97. (file (execute execute_no_trans read open)))
  98. ;; TODO: unknown
  99. (allow guix_daemon_t
  100. root_t
  101. (dir (mounton)))
  102. (allow guix_daemon_t
  103. fs_t
  104. (filesystem (getattr)))
  105. (allow guix_daemon_conf_t
  106. fs_t
  107. (filesystem (associate)))
  108. ;; Build isolation
  109. (allow guix_daemon_t
  110. guix_store_content_t
  111. (file (mounton)))
  112. (allow guix_store_content_t
  113. fs_t
  114. (filesystem (associate)))
  115. (allow guix_daemon_t
  116. guix_store_content_t
  117. (dir (mounton)))
  118. (allow guix_daemon_t
  119. guix_daemon_t
  120. (capability (net_admin
  121. fsetid fowner
  122. chown setuid setgid
  123. dac_override dac_read_search
  124. sys_chroot)))
  125. (allow guix_daemon_t
  126. fs_t
  127. (filesystem (unmount)))
  128. (allow guix_daemon_t
  129. devpts_t
  130. (filesystem (mount)))
  131. (allow guix_daemon_t
  132. devpts_t
  133. (chr_file (setattr getattr)))
  134. (allow guix_daemon_t
  135. tmpfs_t
  136. (filesystem (mount)))
  137. (allow guix_daemon_t
  138. tmpfs_t
  139. (dir (getattr)))
  140. (allow guix_daemon_t
  141. proc_t
  142. (filesystem (mount)))
  143. (allow guix_daemon_t
  144. null_device_t
  145. (chr_file (getattr open read write)))
  146. (allow guix_daemon_t
  147. kvm_device_t
  148. (chr_file (getattr)))
  149. (allow guix_daemon_t
  150. zero_device_t
  151. (chr_file (getattr)))
  152. (allow guix_daemon_t
  153. urandom_device_t
  154. (chr_file (getattr)))
  155. (allow guix_daemon_t
  156. random_device_t
  157. (chr_file (getattr)))
  158. (allow guix_daemon_t
  159. devtty_t
  160. (chr_file (getattr)))
  161. ;; Access to store items
  162. (allow guix_daemon_t
  163. guix_store_content_t
  164. (dir (reparent
  165. create
  166. getattr setattr
  167. search rename
  168. add_name remove_name
  169. open write
  170. rmdir)))
  171. (allow guix_daemon_t
  172. guix_store_content_t
  173. (file (create
  174. lock
  175. setattr getattr
  176. execute execute_no_trans
  177. link unlink
  178. map
  179. rename
  180. open read write)))
  181. (allow guix_daemon_t
  182. guix_store_content_t
  183. (lnk_file (create
  184. getattr setattr
  185. link unlink
  186. read
  187. rename)))
  188. ;; Access to configuration files and directories
  189. (allow guix_daemon_t
  190. guix_daemon_conf_t
  191. (dir (search
  192. setattr getattr
  193. add_name remove_name
  194. open read write)))
  195. (allow guix_daemon_t
  196. guix_daemon_conf_t
  197. (file (create
  198. lock
  199. map
  200. getattr setattr
  201. unlink
  202. open read write)))
  203. (allow guix_daemon_t
  204. guix_daemon_conf_t
  205. (lnk_file (create getattr rename unlink)))
  206. ;; Access to profiles
  207. (allow guix_daemon_t
  208. guix_profiles_t
  209. (dir (getattr setattr read open)))
  210. (allow guix_daemon_t
  211. guix_profiles_t
  212. (lnk_file (read getattr)))
  213. ;; Access to profile links in the home directory
  214. ;; TODO: allow access to profile links *anywhere* on the filesystem
  215. (allow guix_daemon_t
  216. user_home_t
  217. (lnk_file (read getattr)))
  218. (allow guix_daemon_t
  219. user_home_t
  220. (dir (search)))
  221. ;; Socket operations
  222. (allow guix_daemon_t
  223. init_t
  224. (fd (use)))
  225. (allow guix_daemon_t
  226. init_t
  227. (unix_stream_socket (write)))
  228. (allow guix_daemon_t
  229. guix_daemon_conf_t
  230. (unix_stream_socket (listen)))
  231. (allow guix_daemon_t
  232. guix_daemon_conf_t
  233. (sock_file (create unlink)))
  234. (allow guix_daemon_t
  235. self
  236. (unix_stream_socket (create
  237. read write
  238. connect bind accept
  239. getopt setopt)))
  240. (allow guix_daemon_t
  241. self
  242. (fifo_file (write read)))
  243. (allow guix_daemon_t
  244. self
  245. (udp_socket (ioctl create)))
  246. ;; Label file system
  247. (filecon "@guix_sysconfdir@/guix(/.*)?"
  248. any (system_u object_r guix_daemon_conf_t (low low)))
  249. (filecon "@guix_localstatedir@/guix(/.*)?"
  250. any (system_u object_r guix_daemon_conf_t (low low)))
  251. (filecon "@guix_localstatedir@/guix/profiles(/.*)?"
  252. any (system_u object_r guix_profiles_t (low low)))
  253. (filecon "/gnu"
  254. dir (unconfined_u object_r guix_store_content_t (low low)))
  255. (filecon "@storedir@(/.+)?"
  256. any (unconfined_u object_r guix_store_content_t (low low)))
  257. (filecon "@storedir@/[^/]+/.+"
  258. any (unconfined_u object_r guix_store_content_t (low low)))
  259. (filecon "@prefix@/bin/guix-daemon"
  260. file (system_u object_r guix_daemon_exec_t (low low)))
  261. (filecon "@storedir@/.+-(guix-.+|profile)/bin/guix-daemon"
  262. file (system_u object_r guix_daemon_exec_t (low low)))
  263. (filecon "@storedir@/.+-(guix-.+|profile)/libexec/guix-authenticate"
  264. file (system_u object_r guix_daemon_exec_t (low low)))
  265. (filecon "@storedir@/.+-(guix-.+|profile)/libexec/guix/(.*)?"
  266. any (system_u object_r guix_daemon_exec_t (low low)))
  267. (filecon "@guix_localstatedir@/guix/daemon-socket/socket"
  268. any (system_u object_r guix_daemon_socket_t (low low))))