Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.8 required=3.0 tests=DKIM_INVALID,DKIM_SIGNED, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 29DBCC282C7 for ; Sat, 26 Jan 2019 19:06:24 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id B0C9921872 for ; Sat, 26 Jan 2019 19:06:23 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (1024-bit key) header.d=millerson.name header.i=@millerson.name header.b="K/0YxDGC" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726174AbfAZTGX (ORCPT ); Sat, 26 Jan 2019 14:06:23 -0500 Received: from host89-222-249-147.netorn.net ([89.222.249.147]:50664 "EHLO mail.millerson.name" rhost-flags-OK-FAIL-OK-OK) by vger.kernel.org with ESMTP id S1726166AbfAZTGX (ORCPT ); Sat, 26 Jan 2019 14:06:23 -0500 X-Greylist: delayed 1730 seconds by postgrey-1.27 at vger.kernel.org; Sat, 26 Jan 2019 14:06:22 EST DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=millerson.name; s=mail; h=Content-Transfer-Encoding:MIME-Version:Message-Id :Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=Rj7WDCqmlS558Kmbu197DmmN4aCgx7kbt3plCXUKNVc=; b=K/0YxDGCj92jOPyy6FJCIU2eDF u8LcaXLDJvQxz9vC/Um6e2xmX+lBuSCz7qK5usIJY5nSiW8jLvfWLzyD6gQJVvFtMktxak2gYxUBM 9v3UKvBNRM58LppULTqTElQV/FoCOcDv5+3jklsI9aqEDbiaMuIqFpWe3semlV9XbNxE=; Received: from localhost ([127.0.0.1] helo=mail.millerson.name) by mail.millerson.name with esmtpsa id 1gnSpe-0002Iv-Gj (envelope-from ); Sat, 26 Jan 2019 21:37:30 +0300 Received: from alex-desktop.home ([10.24.17.100]) by mail.millerson.name with ESMTPSA id mUrsG+qoTFyaIgAAXPwaFA (envelope-from ); Sat, 26 Jan 2019 21:37:30 +0300 From: Alexander Miroshnichenko To: selinux-refpolicy@vger.kernel.org Cc: Alexander Miroshnichenko Subject: [PATCH] Add hostapd service module Date: Sat, 26 Jan 2019 21:37:27 +0300 Message-Id: <20190126183727.12313-1-alex@millerson.name> X-Mailer: git-send-email 2.19.2 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-GIT-Signature: 27be0fd002aed58f4b82edbe1294318b Sender: selinux-refpolicy-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux-refpolicy@vger.kernel.org Add a SELinux Reference Policy module for the hostapd IEEE 802.11 wireless LAN Host AP daemon. --- policy/modules/services/hostapd.fc | 7 ++++ policy/modules/services/hostapd.if | 1 + policy/modules/services/hostapd.te | 56 ++++++++++++++++++++++++++++++ 3 files changed, 64 insertions(+) create mode 100644 policy/modules/services/hostapd.fc create mode 100644 policy/modules/services/hostapd.if create mode 100644 policy/modules/services/hostapd.te diff --git a/policy/modules/services/hostapd.fc b/policy/modules/services/hostapd.fc new file mode 100644 index 00000000..83583a77 --- /dev/null +++ b/policy/modules/services/hostapd.fc @@ -0,0 +1,7 @@ +/usr/sbin/hostapd -- gen_context(system_u:object_r:hostapd_exec_t,s0) + +/var/run/hostapd(/.*)? gen_context(system_u:object_r:hostapd_var_run_t,s0) + +/etc/hostapd(/.*)? gen_context(system_u:object_r:hostapd_conf_t,s0) + +/run/hostapd.pid -- gen_context(system_u:object_r:hostapd_var_run_t,s0) diff --git a/policy/modules/services/hostapd.if b/policy/modules/services/hostapd.if new file mode 100644 index 00000000..fce874d2 --- /dev/null +++ b/policy/modules/services/hostapd.if @@ -0,0 +1 @@ +## IEEE 802.11 wireless LAN Host AP daemon. diff --git a/policy/modules/services/hostapd.te b/policy/modules/services/hostapd.te new file mode 100644 index 00000000..2db1e7de --- /dev/null +++ b/policy/modules/services/hostapd.te @@ -0,0 +1,56 @@ +policy_module(hostapd, 1.0.0) + +######################################## +# +# Declarations +# + +type hostapd_t; +type hostapd_exec_t; +init_daemon_domain(hostapd_t, hostapd_exec_t) + +type hostapd_var_run_t; +files_pid_file(hostapd_var_run_t) + +type hostapd_conf_t; +files_type(hostapd_conf_t) + +######################################## +# +# hostapd local policy +# + +allow hostapd_t self:capability { fsetid chown net_admin net_raw dac_read_search dac_override }; +allow hostapd_t self:fifo_file rw_fifo_file_perms; +allow hostapd_t self:unix_stream_socket create_stream_socket_perms; +allow hostapd_t self:netlink_socket create_socket_perms; +allow hostapd_t self:netlink_generic_socket create_socket_perms; +allow hostapd_t self:netlink_route_socket create_netlink_socket_perms; +allow hostapd_t self:packet_socket create_socket_perms; + +manage_dirs_pattern(hostapd_t, hostapd_var_run_t, hostapd_var_run_t) +manage_files_pattern(hostapd_t, hostapd_var_run_t, hostapd_var_run_t) +manage_lnk_files_pattern(hostapd_t, hostapd_var_run_t, hostapd_var_run_t) +manage_sock_files_pattern(hostapd_t, hostapd_var_run_t, hostapd_var_run_t) +files_pid_filetrans(hostapd_t, hostapd_var_run_t, { dir file lnk_file sock_file }) + +read_files_pattern(hostapd_t, hostapd_conf_t, hostapd_conf_t) + +kernel_read_system_state(hostapd_t) +kernel_read_network_state(hostapd_t) +kernel_request_load_module(hostapd_t) +kernel_rw_net_sysctls(hostapd_t) +dev_rw_sysfs(hostapd_t) + +dev_read_rand(hostapd_t) +dev_read_urand(hostapd_t) +dev_read_sysfs(hostapd_t) +dev_rw_wireless(hostapd_t) + +domain_use_interactive_fds(hostapd_t) + +auth_use_nsswitch(hostapd_t) + +logging_send_syslog_msg(hostapd_t) + +miscfiles_read_localization(hostapd_t) -- 2.19.2