From: russell@coker.com.au (Russell Coker) Date: Sun, 17 Sep 2017 13:28:11 +1000 Subject: [refpolicy] Chrome patch for discussion Message-ID: <20170917032811.b2eyftg5j2wois4n@athena.coker.com.au> To: refpolicy@oss.tresys.com List-Id: refpolicy.oss.tresys.com This patch has been hanging around in my collection for years. I am NOT suggesting including it as-is. I am sending it for discussion. One thing to discuss is whether we use mozilla_t for all browsers (maybe add a typealias to browser_t or something) or whether we have a chrome_t. I think that having a single mozilla_t or browser_t is the better option but I'm not stuck on it. I can rewrite it for a separate chrome_t if that is the consensus. Index: refpolicy-2.20170917/policy/modules/contrib/mozilla.fc =================================================================== --- refpolicy-2.20170917.orig/policy/modules/contrib/mozilla.fc +++ refpolicy-2.20170917/policy/modules/contrib/mozilla.fc @@ -1,5 +1,8 @@ HOME_DIR/\.galeon(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) HOME_DIR/\.mozilla(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) +HOME_DIR/\.config/chromium(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) +HOME_DIR/\.config/google-chrome(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) +HOME_DIR/\.cache/chromium(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) HOME_DIR/\.mozilla/plugins(/.*)? gen_context(system_u:object_r:mozilla_plugin_home_t,s0) HOME_DIR/\.netscape(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) HOME_DIR/\.phoenix(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) @@ -14,6 +17,7 @@ HOME_DIR/\.spicec(/.*)? gen_context(syst HOME_DIR/\.ICAClient(/.*)? gen_context(system_u:object_r:mozilla_plugin_home_t,s0) HOME_DIR/zimbrauserdata(/.*)? gen_context(system_u:object_r:mozilla_plugin_home_t,s0) +/usr/bin/chromium -- gen_context(system_u:object_r:mozilla_exec_t,s0) /usr/bin/epiphany -- gen_context(system_u:object_r:mozilla_exec_t,s0) /usr/bin/epiphany-bin -- gen_context(system_u:object_r:mozilla_exec_t,s0) /usr/bin/mozilla -- gen_context(system_u:object_r:mozilla_exec_t,s0) @@ -39,3 +43,10 @@ HOME_DIR/zimbrauserdata(/.*)? gen_contex /usr/lib/nspluginwrapper/npviewer.bin -- gen_context(system_u:object_r:mozilla_plugin_exec_t,s0) /usr/lib/nspluginwrapper/plugin-config -- gen_context(system_u:object_r:mozilla_plugin_config_exec_t,s0) /usr/lib/xulrunner[^/]*/plugin-container -- gen_context(system_u:object_r:mozilla_plugin_exec_t,s0) +/usr/lib/chromium/chrome-sandbox -- gen_context(system_u:object_r:chrome_sandbox_exec_t,s0) +/usr/lib/chromium/chromium -- gen_context(system_u:object_r:chrome_browser_exec_t,s0) +/opt/google/chrome/chrome-sandbox -- gen_context(system_u:object_r:chrome_sandbox_exec_t,s0) +/opt/google/chrome/chrome -- gen_context(system_u:object_r:chrome_browser_exec_t,s0) +/opt/google/chrome/google-chrome -- gen_context(system_u:object_r:chrome_browser_exec_t,s0) +/opt/google/chrome/nacl_helper -- gen_context(system_u:object_r:chrome_browser_exec_t,s0) + Index: refpolicy-2.20170917/policy/modules/contrib/mozilla.if =================================================================== --- refpolicy-2.20170917.orig/policy/modules/contrib/mozilla.if +++ refpolicy-2.20170917/policy/modules/contrib/mozilla.if @@ -14,12 +14,18 @@ ## User domain for the role. ## ## +## +## +## Type of the user tty +## +## # interface(`mozilla_role',` gen_require(` type mozilla_t, mozilla_exec_t, mozilla_home_t; type mozilla_tmp_t, mozilla_tmpfs_t, mozilla_plugin_tmp_t; type mozilla_plugin_tmpfs_t, mozilla_plugin_home_t; + type chrome_sandbox_t, chrome_browser_exec_t; attribute_role mozilla_roles; ') @@ -36,6 +42,7 @@ interface(`mozilla_role',` # domtrans_pattern($2, mozilla_exec_t, mozilla_t) + domtrans_pattern($2, chrome_browser_exec_t, mozilla_t) allow $2 mozilla_t:process { noatsecure siginh rlimitinh ptrace signal_perms }; ps_process_pattern($2, mozilla_t) @@ -45,6 +52,9 @@ interface(`mozilla_role',` allow $2 mozilla_t:fd use; allow $2 mozilla_t:shm rw_shm_perms; + allow chrome_sandbox_t $2:fd use; + allow chrome_sandbox_t $2:fifo_file write; + allow chrome_sandbox_t $3:chr_file { read write }; stream_connect_pattern($2, mozilla_tmpfs_t, mozilla_tmpfs_t, mozilla_t) @@ -288,10 +298,12 @@ interface(`mozilla_read_tmp_files',` interface(`mozilla_domtrans',` gen_require(` type mozilla_t, mozilla_exec_t; + type chrome_browser_exec_t; ') corecmd_search_bin($1) domtrans_pattern($1, mozilla_exec_t, mozilla_t) + domtrans_pattern($1, chrome_browser_exec_t, mozilla_t) ') ######################################## Index: refpolicy-2.20170917/policy/modules/contrib/mozilla.te =================================================================== --- refpolicy-2.20170917.orig/policy/modules/contrib/mozilla.te +++ refpolicy-2.20170917/policy/modules/contrib/mozilla.te @@ -47,6 +47,45 @@ userdom_user_tmp_file(mozilla_plugin_tmp type mozilla_plugin_tmpfs_t; userdom_user_tmpfs_file(mozilla_plugin_tmpfs_t) +type chrome_sandbox_t; +type chrome_sandbox_exec_t; +type chrome_browser_exec_t; +application_domain(mozilla_t, chrome_browser_exec_t) +userdom_user_application_domain(mozilla_t, chrome_browser_exec_t ) +role mozilla_plugin_roles types chrome_sandbox_t; +domain_auto_transition_pattern(chrome_sandbox_t, chrome_browser_exec_t, mozilla_t) +allow mozilla_t chrome_sandbox_t:process sigchld; +application_domain(chrome_sandbox_t, chrome_sandbox_exec_t) +ubac_constrained(chrome_sandbox_t) +fs_getattr_xattr_fs(chrome_sandbox_t) + +allow chrome_sandbox_t mozilla_t:dir list_dir_perms; +allow chrome_sandbox_t mozilla_t:fifo_file rw_file_perms; +allow chrome_sandbox_t mozilla_t:file read_file_perms; +allow chrome_sandbox_t mozilla_t:lnk_file read_lnk_file_perms; +allow chrome_sandbox_t mozilla_t:unix_dgram_socket { read write }; +allow chrome_sandbox_t mozilla_t:unix_stream_socket { read write }; +allow chrome_sandbox_t mozilla_t:fd use; +allow chrome_sandbox_t mozilla_t:file write; +allow chrome_sandbox_t proc_t:dir read; +allow chrome_sandbox_t self:process setrlimit; +type chrome_sandbox_tmp_t; + +# this is needed for Chrome (not Chromium) startup +allow chrome_sandbox_t mozilla_t:process { siginh rlimitinh noatsecure }; + +files_tmp_file(chrome_sandbox_tmp_t) +ubac_constrained(chrome_sandbox_tmp_t) +files_tmp_filetrans(chrome_sandbox_t, chrome_sandbox_tmp_t, { file dir }) +allow chrome_sandbox_t chrome_sandbox_tmp_t:dir manage_dir_perms; +allow mozilla_t self:unix_dgram_socket sendto; +allow mozilla_t chrome_browser_exec_t:file execute_no_trans; +# for V8 +allow mozilla_t self:process execmem; + +allow mozilla_t chrome_sandbox_t:shm { write unix_read getattr unix_write associate read }; +allow mozilla_t chrome_sandbox_t:unix_dgram_socket { read write }; + optional_policy(` pulseaudio_tmpfs_content(mozilla_plugin_tmpfs_t) ') @@ -76,8 +115,22 @@ optional_policy(` # Local policy # +dontaudit chrome_sandbox_t domain:dir getattr; +application_domain(chrome_sandbox_t, chrome_sandbox_exec_t) +domain_auto_transition_pattern(mozilla_t, chrome_sandbox_exec_t, chrome_sandbox_t) +allow mozilla_t mozilla_home_t:sock_file manage_sock_file_perms; +allow chrome_sandbox_t self:fifo_file rw_file_perms; +allow chrome_sandbox_t mozilla_t:unix_dgram_socket { read write }; +allow chrome_sandbox_t mozilla_t:unix_stream_socket { read write }; +allow chrome_sandbox_t self:capability { chown dac_override fsetid net_raw setgid setuid sys_admin sys_chroot sys_ptrace }; +allow chrome_sandbox_t mozilla_t:process { share sigchld }; +allow mozilla_t chrome_sandbox_t:fd use; +allow mozilla_t chrome_sandbox_t:unix_stream_socket { read write }; +dev_read_sysfs(mozilla_t) +domain_dontaudit_search_all_domains_state(chrome_sandbox_t) + allow mozilla_t self:capability { setgid setuid sys_nice }; -allow mozilla_t self:process { sigkill signal setsched getsched setrlimit }; +allow mozilla_t self:process { sigkill signal setsched getsched setrlimit setcap }; allow mozilla_t self:fifo_file rw_fifo_file_perms; allow mozilla_t self:shm create_shm_perms; allow mozilla_t self:sem create_sem_perms; @@ -90,6 +143,10 @@ allow mozilla_t mozilla_plugin_t:fd use; allow mozilla_t { mozilla_home_t mozilla_plugin_home_t }:dir manage_dir_perms; allow mozilla_t { mozilla_home_t mozilla_plugin_home_t }:file { manage_file_perms map }; allow mozilla_t mozilla_home_t:lnk_file manage_lnk_file_perms; + +# for plugins +can_exec(mozilla_t, mozilla_home_t) + userdom_user_home_dir_filetrans(mozilla_t, mozilla_home_t, dir, ".galeon") userdom_user_home_dir_filetrans(mozilla_t, mozilla_home_t, dir, ".mozilla") userdom_user_home_dir_filetrans(mozilla_t, mozilla_home_t, dir, ".netscape") @@ -100,6 +157,7 @@ filetrans_pattern(mozilla_t, mozilla_hom manage_files_pattern(mozilla_t, mozilla_tmp_t, mozilla_tmp_t) manage_lnk_files_pattern(mozilla_t, mozilla_tmp_t, mozilla_tmp_t) manage_dirs_pattern(mozilla_t, mozilla_tmp_t, mozilla_tmp_t) +manage_sock_files_pattern(mozilla_t, mozilla_tmp_t, mozilla_tmp_t) allow mozilla_t mozilla_tmp_t:file map; files_tmp_filetrans(mozilla_t, mozilla_tmp_t, { file dir }) @@ -107,7 +165,10 @@ manage_files_pattern(mozilla_t, mozilla_ manage_lnk_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t) manage_fifo_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t) manage_sock_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t) -fs_tmpfs_filetrans(mozilla_t, mozilla_tmpfs_t, { file lnk_file sock_file fifo_file }) +fs_tmpfs_filetrans(mozilla_t, mozilla_tmpfs_t, { dir file lnk_file sock_file fifo_file }) + +# so mozilla can create /var/run/user/PID/pulse +auth_read_var_auth(mozilla_t) allow mozilla_t mozilla_plugin_rw_t:dir list_dir_perms; allow mozilla_t mozilla_plugin_rw_t:file read_file_perms; @@ -117,11 +178,16 @@ stream_connect_pattern(mozilla_t, mozill can_exec(mozilla_t, { mozilla_exec_t mozilla_plugin_rw_t mozilla_plugin_home_t }) +allow mozilla_t self:netlink_kobject_uevent_socket create_socket_perms; + kernel_read_kernel_sysctls(mozilla_t) kernel_read_network_state(mozilla_t) kernel_read_system_state(mozilla_t) kernel_read_net_sysctls(mozilla_t) +# for overcommit_memory +kernel_read_vm_overcommit_sysctl(mozilla_t) + corecmd_list_bin(mozilla_t) corecmd_exec_shell(mozilla_t) corecmd_exec_bin(mozilla_t) @@ -166,6 +232,8 @@ dev_read_rand(mozilla_t) dev_read_urand(mozilla_t) dev_rw_dri(mozilla_t) dev_write_sound(mozilla_t) +dev_dontaudit_getattr_all_chr_files(mozilla_t) +dev_dontaudit_getattr_all_blk_files(mozilla_t) domain_dontaudit_read_all_domains_state(mozilla_t) @@ -207,6 +275,7 @@ mozilla_run_plugin(mozilla_t, mozilla_ro mozilla_run_plugin_config(mozilla_t, mozilla_roles) xserver_user_x_domain_template(mozilla, mozilla_t, mozilla_tmpfs_t) +corenet_tcp_connect_xserver_port(mozilla_t) xserver_dontaudit_read_xdm_tmp_files(mozilla_t) xserver_dontaudit_getattr_xdm_tmp_sockets(mozilla_t) Index: refpolicy-2.20170917/policy/modules/kernel/corecommands.fc =================================================================== --- refpolicy-2.20170917.orig/policy/modules/kernel/corecommands.fc +++ refpolicy-2.20170917/policy/modules/kernel/corecommands.fc @@ -120,6 +120,7 @@ ifdef(`distro_debian',` /opt/(.*/)?sbin(/.*)? gen_context(system_u:object_r:bin_t,s0) /opt/google/talkplugin(/.*)? gen_context(system_u:object_r:bin_t,s0) +/opt/google/chrome/cron/google-chrome -- gen_context(system_u:object_r:bin_t,s0) /opt/gutenprint/cups/lib/filter(/.*)? gen_context(system_u:object_r:bin_t,s0) Index: refpolicy-2.20170917/policy/modules/contrib/xguest.te =================================================================== --- refpolicy-2.20170917.orig/policy/modules/contrib/xguest.te +++ refpolicy-2.20170917/policy/modules/contrib/xguest.te @@ -103,7 +103,7 @@ optional_policy(` ') optional_policy(` - mozilla_role(xguest_r, xguest_t) + mozilla_role(xguest_r, xguest_t, user_devpts_t) ') optional_policy(` Index: refpolicy-2.20170917/policy/modules/roles/staff.te =================================================================== --- refpolicy-2.20170917.orig/policy/modules/roles/staff.te +++ refpolicy-2.20170917/policy/modules/roles/staff.te @@ -142,7 +142,7 @@ ifndef(`distro_redhat',` ') optional_policy(` - mozilla_role(staff_r, staff_t) + mozilla_role(staff_r, staff_t, user_devpts_t) ') optional_policy(` Index: refpolicy-2.20170917/policy/modules/roles/sysadm.te =================================================================== --- refpolicy-2.20170917.orig/policy/modules/roles/sysadm.te +++ refpolicy-2.20170917/policy/modules/roles/sysadm.te @@ -648,7 +648,7 @@ optional_policy(` ') optional_policy(` - mozilla_role(sysadm_r, sysadm_t) + mozilla_role(sysadm_r, sysadm_t, user_devpts_t) ') optional_policy(` Index: refpolicy-2.20170917/policy/modules/roles/unprivuser.te =================================================================== --- refpolicy-2.20170917.orig/policy/modules/roles/unprivuser.te +++ refpolicy-2.20170917/policy/modules/roles/unprivuser.te @@ -114,7 +114,7 @@ ifndef(`distro_redhat',` ') optional_policy(` - mozilla_role(user_r, user_t) + mozilla_role(user_r, user_t, user_devpts_t) ') optional_policy(`