github.com/hugh712/snapd@v0.0.0-20200910133618-1a99902bd583/data/selinux/snappy.te (about) 1 # This file is part of snapd-selinux 2 # Skeleton derived from Fedora selinux-policy, Copyright (C) 2016 Red Hat, Inc. 3 # Copyright (C) 2016 Neal Gompa 4 # 5 # This program is free software; you can redistribute it and/or modify 6 # it under the terms of the GNU General Public License as published by 7 # the Free Software Foundation; either version 2 of the License, or 8 # (at your option) any later version. 9 # 10 # This program is distributed in the hope that it will be useful, 11 # but WITHOUT ANY WARRANTY; without even the implied warranty of 12 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 13 # GNU Library General Public License for more details. 14 # 15 # You should have received a copy of the GNU General Public License 16 # along with this program; if not, write to the Free Software 17 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. 18 19 20 policy_module(snappy,0.1.0) 21 22 ######################################## 23 # 24 # Declarations 25 # 26 27 attribute_role snappy_roles; 28 29 # snapd 30 type snappy_t; 31 type snappy_exec_t; 32 # allow init domain to transition to snappy_t by executing snappy_exec_t 33 init_daemon_domain(snappy_t, snappy_exec_t) 34 35 role snappy_roles types snappy_t; 36 37 type snappy_config_t; 38 files_config_file(snappy_config_t) 39 40 type snappy_home_t; 41 typealias snappy_home_t alias { user_snappy_home_t staff_snappy_home_t sysadm_snappy_home_t }; 42 typealias snappy_home_t alias { auditadm_snappy_home_t secadm_snappy_home_t }; 43 userdom_user_home_content(snappy_home_t) 44 45 type snappy_var_t; 46 files_type(snappy_var_t) 47 48 type snappy_var_lib_t; 49 files_type(snappy_var_lib_t) 50 51 type snappy_var_cache_t; 52 files_type(snappy_var_cache_t) 53 54 type snappy_var_run_t; 55 files_pid_file(snappy_var_run_t) 56 57 type snappy_unit_file_t; 58 systemd_unit_file(snappy_unit_file_t) 59 60 type snappy_tmp_t; 61 files_tmp_file(snappy_tmp_t) 62 63 # actual snap 64 type snappy_snap_t; 65 # XXX: snappy_snap_t should be declared a filesystem, but due to how modules are 66 # handled we cannot generate required contexts with genfscon outside of core 67 # policy 68 # fs_type(snappy_snap_t) 69 files_type(snappy_snap_t) 70 files_mountpoint(snappy_snap_t) 71 72 # CLI tools: snap, snapctl 73 type snappy_cli_t; 74 type snappy_cli_exec_t; 75 domain_type(snappy_cli_t) 76 domain_entry_file(snappy_cli_t, snappy_cli_exec_t) 77 78 # helper tools: snap-{update,discard}-ns 79 type snappy_mount_t; 80 type snappy_mount_exec_t; 81 domain_type(snappy_mount_t) 82 domain_entry_file(snappy_mount_t, snappy_mount_exec_t) 83 84 # helper tool: snap-confine 85 type snappy_confine_t; 86 type snappy_confine_exec_t; 87 domain_type(snappy_confine_t) 88 domain_entry_file(snappy_confine_t, snappy_confine_exec_t) 89 90 type snappy_unconfined_snap_t; 91 unconfined_domain(snappy_unconfined_snap_t) 92 93 ######################################## 94 # 95 # snappy snapd local policy 96 # 97 98 # For development purposes, snappy_t domain is to be marked permissive 99 permissive snappy_t; 100 101 # Allow transitions from init_t to snappy for sockets 102 # init_named_socket_activation() is not supported by core policy in RHEL7 103 gen_require(` 104 type init_t; 105 type var_run_t; 106 ') 107 filetrans_pattern(init_t, var_run_t, snappy_var_run_t, sock_file, "snapd.socket") 108 filetrans_pattern(init_t, var_run_t, snappy_var_run_t, sock_file, "snapd-snap.socket") 109 110 # Allow init_t to read snappy data 111 allow init_t snappy_var_lib_t:dir read; 112 113 # Allow snapd to read procfs 114 gen_require(` 115 type proc_t; 116 ') 117 allow snappy_t proc_t:file { getattr open read }; 118 119 # Allow snapd to read sysfs 120 dev_read_sysfs(snappy_t) 121 dev_search_sysfs(snappy_t) 122 123 # This silences a read AVC denial event on the lost+found directory. 124 gen_require(` 125 type lost_found_t; 126 ') 127 dontaudit snappy_t lost_found_t:dir read; 128 129 # Allow snapd to read SSL cert store 130 miscfiles_read_all_certs(snappy_t) 131 132 # Allow snapd to read config files 133 read_files_pattern(snappy_t, snappy_config_t, snappy_config_t) 134 135 # Allow snapd to manage snaps' homedir data 136 admin_pattern(snappy_t, snappy_home_t) 137 userdom_search_user_home_dirs(snappy_t) 138 userdom_list_user_home_dirs(snappy_t) 139 140 # Allow snapd to read DNS config 141 sysnet_dns_name_resolve(snappy_t) 142 143 # When managed by NetworkManager, DNS config is in its rundata 144 gen_require(` 145 type NetworkManager_var_run_t; 146 ') 147 allow snappy_t NetworkManager_var_run_t:dir search; 148 149 # Allow snapd to read sysctl files 150 kernel_read_net_sysctls(snappy_t) 151 kernel_search_network_sysctl(snappy_t) 152 153 # Allow snapd to query SELinux status 154 selinux_get_enforce_mode(snappy_t) 155 156 # Allow snapd to manage D-Bus config files for snaps 157 optional_policy(` 158 dbus_read_config(snappy_t) 159 allow snappy_t dbusd_etc_t:file { write create rename unlink }; 160 allow snappy_t dbusd_etc_t:lnk_file { read }; 161 ') 162 163 # Allow snapd to manage kmod-backend (/etc/modules-load.d/) files 164 allow snappy_t etc_t:dir { write remove_name }; 165 allow snappy_t etc_t:file unlink; 166 167 # Allow snapd to manage udev rules for snaps and trigger events 168 optional_policy(` 169 udev_manage_rules_files(snappy_t) 170 udev_manage_pid_files(snappy_t) 171 udev_exec(snappy_t) 172 udev_domtrans(snappy_t) 173 udev_create_kobject_uevent_socket(snappy_t) 174 ') 175 allow snappy_t self:netlink_kobject_uevent_socket { create_socket_perms read }; 176 177 # Allow snapd to read/write systemd units and use systemctl for managing snaps 178 systemd_config_all_services(snappy_t) 179 systemd_manage_all_unit_files(snappy_t) 180 systemd_manage_all_unit_lnk_files(snappy_t) 181 systemd_exec_systemctl(snappy_t) 182 systemd_reload_all_services(snappy_t) 183 init_reload_services(snappy_t) 184 init_enable_services(snappy_t) 185 init_disable_services(snappy_t) 186 187 # Allow snapd to execute unsquashfs 188 corecmd_exec_bin(snappy_t) 189 190 # Allow snappy to exec helpers 191 can_exec(snappy_t, snappy_exec_t) 192 can_exec(snappy_t, snappy_mount_exec_t) 193 can_exec(snappy_t, snappy_cli_exec_t) 194 corecmd_search_bin(snappy_t) 195 # allow transition to snap cli domain 196 snappy_cli_domtrans(snappy_t) 197 # allow transition to mount helpers domain 198 snappy_mount_domtrans(snappy_t) 199 # allow transition to snap-confine domain 200 snappy_confine_domtrans(snappy_t) 201 202 # Allow snapd to get FUSE device attributes 203 storage_getattr_fuse_dev(snappy_t) 204 205 # Read l10n files? 206 miscfiles_read_localization(snappy_t) 207 208 # Allow snapd to read its run files, those files are managed elsewhere 209 manage_files_pattern(snappy_t, snappy_var_run_t, snappy_var_run_t) 210 manage_sock_files_pattern(snappy_t, snappy_var_run_t, snappy_var_run_t) 211 212 gen_require(` 213 type user_tmp_t; 214 ') 215 allow snappy_t user_tmp_t:dir { read }; 216 217 # Allow snapd to clean up /run/user sockets 218 userdom_manage_tmp_dirs(snappy_t) 219 userdom_manage_tmp_sockets(snappy_t) 220 221 gen_require(` 222 type systemd_unit_file_t; 223 ') 224 allow snappy_t systemd_unit_file_t:dir { rmdir }; 225 226 gen_require(` 227 type home_root_t; 228 ') 229 allow snappy_t home_root_t:dir { read }; 230 231 # Allow snapd to manage its persistent data 232 admin_pattern(snappy_t, snappy_var_cache_t) 233 # for r/w to commands.db 234 mmap_rw_files_pattern(snappy_t, snappy_var_cache_t, snappy_var_cache_t) 235 admin_pattern(snappy_t, snappy_var_lib_t) 236 # for r/w to errtracker.db 237 mmap_rw_files_pattern(snappy_t, snappy_var_lib_t, snappy_var_lib_t) 238 # snap data files 239 admin_pattern(snappy_t, snappy_var_t) 240 # auto transition /var/snap when created at runtime 241 files_var_filetrans(snappy_t, snappy_var_t, dir, "snap") 242 # some snaps may create character files, eg. lxd creates /dev/full in the 243 # container's rootfs 244 manage_chr_files_pattern(snappy_t, snappy_var_t, snappy_var_t) 245 # And search/read mounted snaps 246 allow snappy_t snappy_snap_t:dir { list_dir_perms }; 247 allow snappy_t snappy_snap_t:file { read_file_perms }; 248 allow snappy_t snappy_snap_t:lnk_file { read_lnk_file_perms }; 249 250 # Grant snapd access to /tmp 251 admin_pattern(snappy_t, snappy_tmp_t) 252 files_tmp_filetrans(snappy_t, snappy_tmp_t, { file dir }) 253 254 # snap command completions, symlinks going back to snap mount directory 255 gen_require(` 256 type usr_t; 257 ') 258 allow snappy_t usr_t:dir { write remove_name add_name }; 259 allow snappy_t usr_t:lnk_file { create unlink }; 260 261 # Allow snapd to use ssh-keygen 262 ssh_exec_keygen(snappy_t) 263 264 # Allow snapd to access passwd file for trivial user lookup 265 auth_read_passwd(snappy_t) 266 # also via nsswitch if called via libc 267 auth_use_nsswitch(snappy_t) 268 269 # because /run/snapd/ns/*.mnt gets a label of the process context 270 gen_require(` type unconfined_t; ') 271 allow snappy_t unconfined_t:file getattr; 272 allow snappy_t snappy_confine_t:file getattr; 273 274 logging_send_syslog_msg(snappy_t) 275 276 allow snappy_t self:capability { dac_read_search dac_override fowner }; 277 allow snappy_t self:process { setpgid }; 278 279 # Various socket permissions 280 allow snappy_t self:fifo_file rw_fifo_file_perms; 281 allow snappy_t self:netlink_route_socket create_netlink_socket_perms; 282 allow snappy_t self:unix_stream_socket create_stream_socket_perms; 283 allow snappy_t self:tcp_socket create_stream_socket_perms; 284 allow snappy_t self:udp_socket create_stream_socket_perms; 285 allow snappy_t self:unix_dgram_socket { create_socket_perms sendto }; 286 allow snappy_t self:capability2 block_suspend; 287 288 # snapd needs to check for ipv6 support 289 gen_require(` 290 type node_t; 291 ') 292 allow snappy_t node_t:tcp_socket node_bind; 293 294 corenet_all_recvfrom_unlabeled(snappy_t) 295 corenet_all_recvfrom_netlabel(snappy_t) 296 corenet_tcp_sendrecv_generic_if(snappy_t) 297 corenet_tcp_sendrecv_generic_node(snappy_t) 298 299 corenet_tcp_sendrecv_http_port(snappy_t) 300 corenet_tcp_connect_http_port(snappy_t) 301 corenet_tcp_sendrecv_http_cache_port(snappy_t) 302 corenet_tcp_connect_http_cache_port(snappy_t) 303 304 # snapd has its own internal DNS resolver 305 corenet_tcp_sendrecv_dns_port(snappy_t) 306 corenet_udp_sendrecv_dns_port(snappy_t) 307 corenet_tcp_connect_dns_port(snappy_t) 308 corenet_sendrecv_dns_client_packets(snappy_t) 309 310 # allow communication with polkit over dbus 311 optional_policy(` 312 policykit_dbus_chat(snappy_t) 313 ') 314 315 # allow communication with system bus 316 optional_policy(` 317 dbus_system_bus_client(snappy_t) 318 ') 319 320 # allow reading sssd files 321 optional_policy(` 322 sssd_read_public_files(snappy_t) 323 sssd_stream_connect(snappy_t) 324 ') 325 326 # for sanity checks 327 optional_policy(` 328 mount_run(snappy_t, snappy_roles) 329 ') 330 331 # snapd runs journalctl to fetch logs 332 optional_policy(` 333 journalctl_run(snappy_t, snappy_roles) 334 # and kills journalctl once the logs have been fetched 335 allow snappy_t journalctl_t:process sigkill; 336 ') 337 338 # only pops up in cloud images where cloud-init.target is incorrectly labeled 339 allow snappy_t init_var_run_t:lnk_file read; 340 341 # snapd may need to run helpers from the snaps, eg. fontconfig helper 342 can_exec(snappy_t, snappy_snap_t) 343 # fontconfig cache setup 344 miscfiles_manage_fonts_cache(snappy_t) 345 files_var_filetrans(snappy_t, fonts_cache_t, dir, "fontconfig") 346 # fontconfig cache is in /usr/lib/fontconfig/cache, which should be labeled as 347 # fonts_cache_t, but it may be incorrectly labeled as lib_t, see 348 # https://bugzilla.redhat.com/show_bug.cgi?id=1659905 and a corresponding bug 349 # for RHEL7 https://bugzilla.redhat.com/show_bug.cgi?id=1792349 (marked as 350 # WONTFIX, so carry the workaround for as long as we support EPEL7) 351 libs_manage_lib_dirs(snappy_t) 352 libs_manage_lib_files(snappy_t) 353 fs_getattr_xattr_fs(snappy_t) 354 # probing cgroup version, /sys/fs/cgroup is a tmpfs for v1 or cgroup for v2 355 fs_getattr_tmpfs(snappy_t) 356 fs_list_tmpfs(snappy_t) 357 fs_getattr_cgroup(snappy_t) 358 # snapd checks whether <snap>.mnt exists before running the mount namespace 359 # helper tool 360 # fs_getattr_nsfs_files() is not available in selinux devel on CentOS 7.x 361 getattr_files_pattern(snappy_t, nsfs_t, nsfs_t) 362 363 # lxd snap has nsfs under common directory, this works around denials triggered 364 # by snapshot size estimation. 365 allow snappy_t unconfined_service_t:file getattr; 366 367 # snapd attempts to read /run/cloud-init/instance-data.json 368 sysnet_read_config(snappy_t) 369 # however older policy may be missing the transition rules, and 370 # /run/cloud-init/instance-data.json ends up as var_run_t 371 files_read_generic_pids(snappy_t) 372 373 # snapd attempts to check /proc/sys/fs/may_detach_mounts during sanity testing 374 kernel_read_fs_sysctls(snappy_t) 375 376 # socket activated services may have their socket files created under 377 # $SNAP_COMMON, but lacking auto transition, they end up labeled as var_t 378 allow snappy_t var_t:sock_file unlink; 379 380 # snapd picks the process start time from /proc/<pid>/stat for polkit 381 allow snappy_t unconfined_t:dir search; 382 allow snappy_t unconfined_t:file { open read }; 383 384 # snapd executes cp when copying snap data between revisions 385 allow snappy_t self:process { setfscreate }; 386 allow snappy_t self:capability { fsetid chown }; 387 # snappy_t running as system_u attempts to change the user identity of copied 388 # files, which typically have unconfined_u 389 domain_obj_id_change_exemption(snappy_t) 390 # snapd executes runuser to take snapshots of user's snap data 391 allow snappy_t self:capability { setuid setgid }; 392 allow snappy_t self:process setsched; 393 # runuser uses kernel keyring 394 allow snappy_t self:key { search write }; 395 # runuser logs to audit 396 logging_send_audit_msgs(snappy_t) 397 398 # allow snapd to remove snap specific user's data under 399 # /run/user/<uid>/snap.<snap> on snap remove; 400 # also desktop-helpers do cp -a on user-dirs.locale, what creates a config_home_t 401 # file inside ~/snap, which would normally be snappy_home_t 402 gnome_manage_home_config(snappy_t) 403 gnome_manage_home_config_dirs(snappy_t) 404 userdom_manage_user_tmp_symlinks(snappy_t) 405 406 # appstream-metadata interface checks whether /var/cache/app-info (labeled 407 # fwupd_cache_t) exists 408 # RHEL7: fwupd.if is not defined in the policy 409 ifndef(`distro_rhel7',` 410 optional_policy(` 411 fwupd_search_cache(snappy_t) 412 ') 413 ') 414 415 ######################################## 416 # 417 # snap-update-ns, snap-dicsard-ns local policy 418 # 419 permissive snappy_mount_t; 420 421 role system_r types snappy_mount_t; 422 423 admin_pattern(snappy_mount_t, snappy_var_run_t) 424 files_pid_filetrans(snappy_mount_t, snappy_var_run_t, {file dir}) 425 426 # layouts are built using tmpfs 427 fs_manage_tmpfs_files(snappy_mount_t) 428 fs_manage_tmpfs_dirs(snappy_mount_t) 429 fs_manage_tmpfs_symlinks(snappy_mount_t) 430 fs_mount_tmpfs(snappy_mount_t) 431 fs_unmount_tmpfs(snappy_mount_t) 432 fs_remount_tmpfs(snappy_mount_t) 433 fs_getattr_tmpfs(snappy_mount_t) 434 # this only gives mounton on directories 435 fs_mounton_tmpfs(snappy_mount_t) 436 # layouts may need to mount on files 437 allow snappy_mount_t tmpfs_t:file mounton; 438 # or (re)create symlinks 439 fs_manage_tmpfs_symlinks(snappy_mount_t) 440 441 # any tmp_t files or directories get snappy_tmp_t 442 files_tmp_filetrans(snappy_mount_t, snappy_tmp_t, { file dir }) 443 userdom_user_tmp_filetrans(snappy_mount_t, snappy_tmp_t, { file dir}) 444 allow snappy_mount_t snappy_tmp_t:dir { mounton }; 445 allow snappy_mount_t snappy_tmp_t:file { mounton }; 446 admin_pattern(snappy_mount_t, snappy_tmp_t) 447 # FIXME: investigate further why transition from user_tmp_t to snappy_tmp_t may 448 # not happen when snap-confine is executed by unconfined_t, should we still end 449 # up with user_tmp_t allow acting on it 450 allow snappy_mount_t user_tmp_t:dir { mounton rmdir }; 451 userdom_delete_user_tmp_files(snappy_mount_t) 452 453 # Allow snap-{update,discard}-ns to manage mounts 454 gen_require(` 455 type fs_t; 456 type mount_var_run_t; 457 ') 458 allow snappy_mount_t fs_t:filesystem { mount unmount }; 459 allow snappy_mount_t mount_var_run_t:dir { add_name remove_name write search }; 460 allow snappy_mount_t mount_var_run_t:file { create getattr setattr open read write rename unlink lock }; 461 # for discard-ns, because a preserved mount ns is a bind-mounted /proc/<pid>/ns/mnt 462 gen_require(` 463 type proc_t; 464 ') 465 allow snappy_mount_t proc_t:filesystem { getattr unmount }; 466 467 allow snappy_mount_t self:capability { sys_chroot sys_admin setgid }; 468 469 manage_files_pattern(snappy_mount_t, snappy_snap_t, snappy_snap_t) 470 manage_dirs_pattern(snappy_mount_t, snappy_snap_t, snappy_snap_t) 471 manage_lnk_files_pattern(snappy_mount_t, snappy_snap_t, snappy_snap_t) 472 473 read_files_pattern(snappy_mount_t, snappy_var_lib_t, snappy_var_lib_t) 474 getattr_files_pattern(snappy_mount_t, snappy_var_lib_t, snappy_var_lib_t) 475 read_lnk_files_pattern(snappy_mount_t, snappy_var_lib_t, snappy_var_lib_t) 476 list_dirs_pattern(snappy_mount_t, snappy_var_lib_t, snappy_var_lib_t) 477 478 fs_getattr_all_fs(snappy_mount_t) 479 fs_getattr_xattr_fs(snappy_mount_t) 480 # snap-discard-ns pokes, reads and unmounts the mount ns captured at <snap>.mnt 481 fs_read_nsfs_files(snappy_mount_t) 482 fs_unmount_nsfs(snappy_mount_t) 483 484 # due to mounting /usr/libexec/snapd 485 allow snappy_mount_t bin_t:dir mounton; 486 # setting up fonts for the desktop interface 487 gen_require(` 488 type fonts_t, fonts_cache_t; 489 ') 490 491 allow snappy_mount_t fonts_cache_t:dir mounton; 492 allow snappy_mount_t fonts_t:dir mounton; 493 # fontconfig cache is in /usr/lib/fontconfig/cache, which should be labeled as 494 # fonts_cache_t, but it may be incorrectly labeled as lib_t, see 495 # https://bugzilla.redhat.com/show_bug.cgi?id=1659905 and a corresponding bug 496 # for RHEL7 https://bugzilla.redhat.com/show_bug.cgi?id=1792349 (marked as 497 # WONTFIX, so carry the workaround for as long as we support EPEL7) 498 allow snappy_mount_t lib_t:dir mounton; 499 500 # mount and unmount on top of snaps 501 allow snappy_mount_t snappy_snap_t:dir mounton; 502 allow snappy_mount_t snappy_snap_t:file mounton; 503 allow snappy_mount_t snappy_snap_t:filesystem { unmount remount }; 504 505 # freezer 506 fs_manage_cgroup_dirs(snappy_mount_t) 507 fs_manage_cgroup_files(snappy_mount_t) 508 509 # because /run/snapd/ns/*.mnt gets a label of the process context 510 gen_require(` 511 type unconfined_t; 512 ') 513 allow snappy_mount_t unconfined_t:file { open read getattr }; 514 allow snappy_mount_t snappy_confine_t:file { open read getattr }; 515 516 # Go runtime artifacts 517 kernel_read_system_state(snappy_mount_t) 518 kernel_read_net_sysctls(snappy_mount_t) 519 kernel_search_network_sysctl(snappy_mount_t) 520 dev_read_sysfs(snappy_mount_t) 521 522 # snap-update-ns is started using a file descriptor, meaning ld.so runs in the 523 # mount ns and may try to read/mmap cache files inside 524 fs_read_tmpfs_files(snappy_mount_t) 525 mmap_read_files_pattern(snappy_mount_t, tmpfs_t, tmpfs_t) 526 527 # with robust mount namespace update snap-update-ns can remount filesystems that 528 # were mounted from the host when updating the ns 529 fs_remount_xattr_fs(snappy_mount_t) 530 531 # when applying update due to appstream-metadata interface, snap-update-ns ns 532 # whether /var/cache/app-info (labeled fwupd_cache_t) exists 533 # RHEL7: fwupd.if is not defined in the policy 534 ifndef(`distro_rhel7',` 535 optional_policy(` 536 fwupd_search_cache(snappy_mount_t) 537 ') 538 ') 539 540 ######################################## 541 # 542 # snap-confine local policy 543 # 544 permissive snappy_confine_t; 545 546 role system_r types snappy_confine_t; 547 snappy_mount_domtrans(snappy_confine_t) 548 allow snappy_confine_t snappy_mount_t:process2 nosuid_transition; 549 550 admin_pattern(snappy_confine_t, snappy_var_run_t) 551 552 allow snappy_confine_t snappy_var_lib_t:dir { list_dir_perms }; 553 allow snappy_confine_t snappy_var_lib_t:file { read_file_perms }; 554 allow snappy_confine_t snappy_var_lib_t:lnk_file { read_lnk_file_perms }; 555 556 files_pid_filetrans(snappy_confine_t, snappy_var_run_t, {file dir}) 557 558 allow snappy_confine_t snappy_home_t:dir { create_dir_perms list_dir_perms add_entry_dir_perms }; 559 allow snappy_confine_t snappy_home_t:file { read_file_perms }; 560 allow snappy_confine_t snappy_home_t:lnk_file { manage_lnk_file_perms }; 561 userdom_user_home_dir_filetrans(snappy_confine_t, snappy_home_t, dir, "snap") 562 userdom_admin_home_dir_filetrans(snappy_confine_t, snappy_home_t, dir, "snap") 563 564 allow snappy_confine_t snappy_snap_t:process transition; 565 566 allow snappy_confine_t self:process { setexec }; 567 allow snappy_confine_t self:capability { setgid setuid sys_admin sys_chroot dac_read_search dac_override }; 568 569 init_read_state(snappy_confine_t) 570 571 # libudev 572 udev_manage_pid_dirs(snappy_confine_t) 573 574 # basic access to system info in /proc 575 kernel_read_system_state(snappy_confine_t) 576 577 fs_getattr_all_fs(snappy_confine_t) 578 dev_getattr_fs(snappy_confine_t) 579 dev_getattr_sysfs_fs(snappy_confine_t) 580 fs_getattr_cgroup(snappy_confine_t) 581 fs_getattr_hugetlbfs(snappy_confine_t) 582 fs_getattr_tmpfs(snappy_confine_t) 583 fs_getattr_xattr_fs(snappy_confine_t) 584 fs_manage_cgroup_dirs(snappy_confine_t) 585 fs_write_cgroup_files(snappy_confine_t) 586 kernel_getattr_debugfs(snappy_confine_t) 587 kernel_getattr_proc(snappy_confine_t) 588 fs_read_nsfs_files(snappy_confine_t) 589 term_getattr_pty_fs(snappy_confine_t) 590 # term_getattr_generic_ptys() is not supported by core policy in RHEL7 591 allow snappy_confine_t devpts_t:chr_file getattr; 592 term_search_ptys(snappy_confine_t) 593 594 # because /run/snapd/ns/*.mnt gets a label of the process context 595 allow snappy_confine_t unconfined_t:file getattr; 596 597 # mount ns setup 598 gen_require(` 599 type ptmx_t; 600 type modules_object_t; 601 type ifconfig_var_run_t; 602 type var_log_t; 603 type lib_t; 604 ') 605 606 admin_pattern(snappy_confine_t, snappy_tmp_t) 607 # any tmp files or directories get snappy_tmp_t 608 files_tmp_filetrans(snappy_confine_t, snappy_tmp_t, { file dir }) 609 userdom_user_tmp_filetrans(snappy_confine_t, snappy_tmp_t, { file dir}) 610 611 allow snappy_confine_t snappy_tmp_t:dir mounton; 612 613 allow snappy_confine_t admin_home_t:dir mounton; 614 allow snappy_confine_t bin_t:dir mounton; 615 allow snappy_confine_t cert_t:dir { getattr mounton }; 616 allow snappy_confine_t device_t:filesystem unmount; 617 allow snappy_confine_t devpts_t:dir mounton; 618 allow snappy_confine_t etc_t:file mounton; 619 allow snappy_confine_t home_root_t:dir mounton; 620 allow snappy_confine_t ifconfig_var_run_t:dir mounton; 621 allow snappy_confine_t modules_object_t:dir mounton; 622 allow snappy_confine_t lib_t:dir mounton; 623 allow snappy_confine_t ptmx_t:chr_file { getattr mounton }; 624 allow snappy_confine_t snappy_snap_t:dir { mounton read }; 625 allow snappy_confine_t snappy_snap_t:file mounton; 626 allow snappy_confine_t snappy_snap_t:lnk_file read; 627 allow snappy_confine_t snappy_var_lib_t:dir mounton; 628 allow snappy_confine_t snappy_var_run_t:dir mounton; 629 allow snappy_confine_t snappy_var_run_t:file mounton; 630 allow snappy_confine_t snappy_var_t:dir { getattr mounton search }; 631 allow snappy_confine_t tmp_t:dir { add_name create mounton remove_name rmdir setattr write read }; 632 allow snappy_confine_t usr_t:dir mounton; 633 allow snappy_confine_t var_log_t:dir mounton; 634 allow snappy_confine_t var_run_t:dir mounton; 635 dev_mounton(snappy_confine_t) 636 dev_mounton_sysfs(snappy_confine_t) 637 dev_unmount_sysfs_fs(snappy_confine_t) 638 files_mounton_etc(snappy_confine_t) 639 files_mounton_mnt(snappy_confine_t) 640 files_mounton_rootfs(snappy_confine_t) 641 fs_unmount_xattr_fs(snappy_confine_t) 642 kernel_mounton_proc(snappy_confine_t) 643 kernel_unmount_proc(snappy_confine_t) 644 seutil_read_file_contexts(snappy_confine_t) 645 term_mount_pty_fs(snappy_confine_t) 646 647 # device group 648 fs_manage_cgroup_dirs(snappy_confine_t) 649 fs_manage_cgroup_files(snappy_confine_t) 650 # snap-update-ns and snap-confine use tmpfs when setting up the namespace, 651 # things may end up keeping tmpfs_t label 652 fs_read_tmpfs_symlinks(snappy_confine_t) 653 654 # restoring file contexts 655 seutil_read_file_contexts(snappy_confine_t) 656 seutil_read_default_contexts(snappy_confine_t) 657 seutil_read_config(snappy_confine_t) 658 659 can_exec(snappy_confine_t, snappy_snap_t) 660 read_files_pattern(snappy_confine_t, snappy_snap_t, snappy_snap_t) 661 # and allow transition by snap-confine 662 allow snappy_confine_t snappy_unconfined_snap_t:process { noatsecure rlimitinh siginh transition dyntransition }; 663 gen_require(` 664 type unconfined_service_t; 665 ') 666 allow snappy_confine_t unconfined_service_t:process { noatsecure rlimitinh siginh transition dyntransition }; 667 668 # for classic snaps, snap-confine executes snap-exec from the host (labeled as 669 # snappy_exec_t) 670 can_exec(snappy_confine_t, snappy_exec_t) 671 # allow snappy_exec_t to be an entrypoint to unconfined_service_t, only 672 # snap-confine is allowed to transition this way 673 domain_entry_file(unconfined_service_t, snappy_exec_t) 674 675 ######################################## 676 # 677 # snap, snapctl local policy 678 # 679 permissive snappy_cli_t; 680 681 role system_r types snappy_cli_t; 682 snappy_confine_domtrans(snappy_cli_t) 683 # services are started through 'snap run ...' wrapper 684 snappy_cli_domtrans(init_t) 685 686 relabel_dirs_pattern(snappy_cli_t, user_home_t, snappy_home_t) 687 relabel_files_pattern(snappy_cli_t, user_home_t, snappy_home_t) 688 relabel_dirs_pattern(snappy_cli_t, admin_home_t, snappy_home_t) 689 relabel_files_pattern(snappy_cli_t, admin_home_t, snappy_home_t) 690 691 manage_files_pattern(snappy_cli_t, snappy_home_t, snappy_home_t) 692 manage_lnk_files_pattern(snappy_cli_t, snappy_home_t, snappy_home_t) 693 manage_dirs_pattern(snappy_cli_t, snappy_home_t, snappy_home_t) 694 userdom_user_home_dir_filetrans(snappy_cli_t, snappy_home_t, dir, "snap") 695 userdom_admin_home_dir_filetrans(snappy_cli_t, snappy_home_t, dir, "snap") 696 697 allow snappy_cli_t snappy_snap_t:dir {list_dir_perms }; 698 allow snappy_cli_t snappy_snap_t:file { read_file_perms }; 699 allow snappy_cli_t snappy_snap_t:lnk_file { read_lnk_file_perms }; 700 701 allow snappy_cli_t snappy_var_lib_t:dir { list_dir_perms }; 702 allow snappy_cli_t snappy_var_lib_t:file { read_file_perms }; 703 allow snappy_cli_t snappy_var_lib_t:lnk_file { read_lnk_file_perms }; 704 705 # allow reading passwd 706 auth_read_passwd(snappy_cli_t) 707 # allow reading sssd files 708 optional_policy(` 709 sssd_read_public_files(snappy_cli_t) 710 sssd_stream_connect(snappy_cli_t) 711 ') 712 713 # restorecon, matchpathcon 714 seutil_domtrans_setfiles(snappy_cli_t) 715 seutil_read_file_contexts(snappy_cli_t) 716 seutil_read_default_contexts(snappy_cli_t) 717 seutil_read_config(snappy_cli_t) 718 selinux_load_policy(snappy_cli_t) 719 selinux_validate_context(snappy_cli_t) 720 corecmd_exec_bin(snappy_cli_t) 721 722 allow snappy_cli_t proc_t:file { getattr open read }; 723 allow snappy_cli_t snappy_exec_t:file { read_file_perms }; 724 allow snappy_cli_t self:capability { dac_override }; 725 726 # go runtime poking at things 727 init_ioctl_stream_sockets(snappy_cli_t) 728 kernel_read_net_sysctls(snappy_cli_t) 729 kernel_search_network_sysctl(snappy_cli_t) 730 dev_read_sysfs(snappy_cli_t) 731 732 # talk to snapd 733 snappy_stream_connect(snappy_cli_t) 734 735 # check stuff in /run/user 736 userdom_search_user_tmp_dirs(snappy_cli_t) 737 738 # execute snapd internal tools 739 # needed to grab a version information from snap-seccomp 740 can_exec(snappy_cli_t, snappy_exec_t) 741 742 # probing cgroup version, /sys/fs/cgroup is a tmpfs for v1 or cgroup for v2 743 fs_getattr_tmpfs(snappy_cli_t) 744 fs_getattr_cgroup(snappy_cli_t) 745 746 747 ######################################## 748 # 749 # snappy (unconfined snap) local policy 750 # 751 permissive snappy_unconfined_snap_t; 752 753 # allow unconfined snap service to run as a system service 754 role system_r types snappy_unconfined_snap_t; 755 can_exec(snappy_unconfined_snap_t, snappy_snap_t) 756 domain_entry_file(snappy_unconfined_snap_t, snappy_snap_t) 757 domain_entry_file(unconfined_service_t, snappy_snap_t) 758 759 # for journald 760 gen_require(` 761 type syslogd_t; 762 ') 763 allow syslogd_t snappy_unconfined_snap_t:dir search_dir_perms; 764 765 allow snappy_unconfined_snap_t self:process { fork getsched }; 766 767 # allow snappy_unconfined_snap_t snappy_snap_t:dir { list_dir_perms }; 768 # allow snappy_unconfined_snap_t snappy_snap_t:file { read_file_perms }; 769 # allow snappy_unconfined_snap_t snappy_snap_t:lnk_file { read_lnk_file_perms }; 770 771 # snap can carry services, which are then started by systemd, need to allow 772 # systemd to manage them 773 allow init_t snappy_unconfined_snap_t:dir search_dir_perms; 774 allow init_t snappy_unconfined_snap_t:file { read_file_perms }; 775 allow init_t snappy_unconfined_snap_t:lnk_file { read_lnk_file_perms }; 776 allow init_t snappy_unconfined_snap_t:process { sigkill signull signal }; 777 778 ######################################## 779 # 780 # file/dir transitions for unconfined_t 781 # 782 783 # snap tools can be invoked by the regular user, make sure that things get 784 # proper labels 785 gen_require(` 786 type unconfined_t; 787 ') 788 userdom_user_home_dir_filetrans(unconfined_t, snappy_home_t, dir, "snap") 789 userdom_admin_home_dir_filetrans(unconfined_t, snappy_home_t, dir, "snap") 790 files_pid_filetrans(unconfined_t, snappy_var_run_t, dir, "snapd") 791 792 ######################################## 793 # 794 # extra policy for init_t 795 # 796 797 # support socket activation of snap services, for such snaps the socket file can 798 # only be located under $SNAP_DATA or $SNAP_COMMON, both labeled as snappy_var_t; 799 allow init_t snappy_var_t:dir manage_dir_perms; 800 allow init_t snappy_var_t:sock_file manage_sock_file_perms; 801 # the snap is started via `snap run ..` 802 allow init_t snappy_cli_t:unix_stream_socket create_stream_socket_perms; 803 # init_t will try to remount snap mount directory when starting services that 804 # use Private* directives, while init_t is allowed to remount all fs, we cannot 805 # declare fs_type(snappy_snap_t) outside of core policy, add explicit permission 806 # instead 807 allow init_t snappy_snap_t:filesystem remount; 808 809 ######################################## 810 # 811 # extra policy for mandb_t 812 # 813 gen_require(` 814 type mandb_t; 815 ') 816 # mandb cache update scans whe whole directory tree looking for 'man' 817 allow mandb_t snappy_var_lib_t:dir search_dir_perms; 818 819 ######################################## 820 # 821 # extra policy for system dbus 822 # 823 gen_require(` 824 type system_dbusd_t; 825 ') 826 # system dbus may look info /var/lib/snapd/dbus-1 827 snappy_search_lib(system_dbusd_t) 828 snappy_read_lib(system_dbusd_t)