Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.1 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id BBAFFC169C4 for ; Tue, 29 Jan 2019 19:23:50 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 613D420882 for ; Tue, 29 Jan 2019 19:23:50 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=millerson.name header.i=@millerson.name header.b="Tv+ig1Fu" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727071AbfA2TXu (ORCPT ); Tue, 29 Jan 2019 14:23:50 -0500 Received: from host89-222-249-147.netorn.net ([89.222.249.147]:57916 "EHLO mail.millerson.name" rhost-flags-OK-FAIL-OK-OK) by vger.kernel.org with ESMTP id S1726852AbfA2TXu (ORCPT ); Tue, 29 Jan 2019 14:23:50 -0500 X-Greylist: delayed 1276 seconds by postgrey-1.27 at vger.kernel.org; Tue, 29 Jan 2019 14:23:48 EST DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=millerson.name; s=mail; h=Message-Id:Date:Subject:To:From; bh=Rj7WDCqmlS558Kmbu197DmmN4aCgx7kbt3plCXUKNVc=; b=Tv+ig1FuPlsn/lPf+YX7F0VYH2 C+ayJUpP/1fNTvBln5IFwcwsXckn0rvB4HmFi7ggQGUItGRwY517ETpryLEDlgUWlU7747V787GL2 hyhiQoUufaCd6vQtJaSGuUIbFR2e6Fwg/JNAtcKT8+bZxQIVzPjOnyJ9QNDzDoAP8DT0=; Received: from localhost ([127.0.0.1] helo=mail.millerson.name) by mail.millerson.name with esmtpsa id 1goYeU-0002Pg-E2 (envelope-from ); Tue, 29 Jan 2019 22:02:30 +0300 Received: from alex-desktop.home ([10.24.17.100]) by mail.millerson.name with ESMTPSA id /63LFkajUFw9JAAAXPwaFA (envelope-from ); Tue, 29 Jan 2019 22:02:30 +0300 From: Alexander Miroshnichenko To: selinux-refpolicy@vger.kernel.org Cc: Alexander Miroshnichenko Subject: [PATCH] Add hostapd service module Date: Tue, 29 Jan 2019 22:01:52 +0300 Message-Id: <20190129190152.10890-1-alex@millerson.name> X-Mailer: git-send-email 2.19.2 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit X-GIT-Signature: 27be0fd002aed58f4b82edbe1294318b Sender: selinux-refpolicy-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux-refpolicy@vger.kernel.org Add a SELinux Reference Policy module for the hostapd IEEE 802.11 wireless LAN Host AP daemon. --- policy/modules/services/hostapd.fc | 7 ++++ policy/modules/services/hostapd.if | 1 + policy/modules/services/hostapd.te | 56 ++++++++++++++++++++++++++++++ 3 files changed, 64 insertions(+) create mode 100644 policy/modules/services/hostapd.fc create mode 100644 policy/modules/services/hostapd.if create mode 100644 policy/modules/services/hostapd.te diff --git a/policy/modules/services/hostapd.fc b/policy/modules/services/hostapd.fc new file mode 100644 index 00000000..83583a77 --- /dev/null +++ b/policy/modules/services/hostapd.fc @@ -0,0 +1,7 @@ +/usr/sbin/hostapd -- gen_context(system_u:object_r:hostapd_exec_t,s0) + +/var/run/hostapd(/.*)? gen_context(system_u:object_r:hostapd_var_run_t,s0) + +/etc/hostapd(/.*)? gen_context(system_u:object_r:hostapd_conf_t,s0) + +/run/hostapd.pid -- gen_context(system_u:object_r:hostapd_var_run_t,s0) diff --git a/policy/modules/services/hostapd.if b/policy/modules/services/hostapd.if new file mode 100644 index 00000000..fce874d2 --- /dev/null +++ b/policy/modules/services/hostapd.if @@ -0,0 +1 @@ +## IEEE 802.11 wireless LAN Host AP daemon. diff --git a/policy/modules/services/hostapd.te b/policy/modules/services/hostapd.te new file mode 100644 index 00000000..2db1e7de --- /dev/null +++ b/policy/modules/services/hostapd.te @@ -0,0 +1,56 @@ +policy_module(hostapd, 1.0.0) + +######################################## +# +# Declarations +# + +type hostapd_t; +type hostapd_exec_t; +init_daemon_domain(hostapd_t, hostapd_exec_t) + +type hostapd_var_run_t; +files_pid_file(hostapd_var_run_t) + +type hostapd_conf_t; +files_type(hostapd_conf_t) + +######################################## +# +# hostapd local policy +# + +allow hostapd_t self:capability { fsetid chown net_admin net_raw dac_read_search dac_override }; +allow hostapd_t self:fifo_file rw_fifo_file_perms; +allow hostapd_t self:unix_stream_socket create_stream_socket_perms; +allow hostapd_t self:netlink_socket create_socket_perms; +allow hostapd_t self:netlink_generic_socket create_socket_perms; +allow hostapd_t self:netlink_route_socket create_netlink_socket_perms; +allow hostapd_t self:packet_socket create_socket_perms; + +manage_dirs_pattern(hostapd_t, hostapd_var_run_t, hostapd_var_run_t) +manage_files_pattern(hostapd_t, hostapd_var_run_t, hostapd_var_run_t) +manage_lnk_files_pattern(hostapd_t, hostapd_var_run_t, hostapd_var_run_t) +manage_sock_files_pattern(hostapd_t, hostapd_var_run_t, hostapd_var_run_t) +files_pid_filetrans(hostapd_t, hostapd_var_run_t, { dir file lnk_file sock_file }) + +read_files_pattern(hostapd_t, hostapd_conf_t, hostapd_conf_t) + +kernel_read_system_state(hostapd_t) +kernel_read_network_state(hostapd_t) +kernel_request_load_module(hostapd_t) +kernel_rw_net_sysctls(hostapd_t) +dev_rw_sysfs(hostapd_t) + +dev_read_rand(hostapd_t) +dev_read_urand(hostapd_t) +dev_read_sysfs(hostapd_t) +dev_rw_wireless(hostapd_t) + +domain_use_interactive_fds(hostapd_t) + +auth_use_nsswitch(hostapd_t) + +logging_send_syslog_msg(hostapd_t) + +miscfiles_read_localization(hostapd_t) -- 2.19.2