github.com/meulengracht/snapd@v0.0.0-20210719210640-8bde69bcc84e/data/selinux/snappy.te (about) 1 # This file is part of snapd-selinux 2 # Skeleton derived from Fedora selinux-policy, Copyright (C) 2016 Red Hat, Inc. 3 # Copyright (C) 2016 Neal Gompa 4 # 5 # This program is free software; you can redistribute it and/or modify 6 # it under the terms of the GNU General Public License as published by 7 # the Free Software Foundation; either version 2 of the License, or 8 # (at your option) any later version. 9 # 10 # This program is distributed in the hope that it will be useful, 11 # but WITHOUT ANY WARRANTY; without even the implied warranty of 12 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 13 # GNU Library General Public License for more details. 14 # 15 # You should have received a copy of the GNU General Public License 16 # along with this program; if not, write to the Free Software 17 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. 18 19 20 policy_module(snappy,0.1.0) 21 22 ######################################## 23 # 24 # Declarations 25 # 26 27 attribute_role snappy_roles; 28 29 # snapd 30 type snappy_t; 31 type snappy_exec_t; 32 # allow init domain to transition to snappy_t by executing snappy_exec_t 33 init_daemon_domain(snappy_t, snappy_exec_t) 34 35 role snappy_roles types snappy_t; 36 37 type snappy_config_t; 38 files_config_file(snappy_config_t) 39 40 type snappy_home_t; 41 typealias snappy_home_t alias { user_snappy_home_t staff_snappy_home_t sysadm_snappy_home_t }; 42 typealias snappy_home_t alias { auditadm_snappy_home_t secadm_snappy_home_t }; 43 userdom_user_home_content(snappy_home_t) 44 45 type snappy_var_t; 46 files_type(snappy_var_t) 47 48 type snappy_var_lib_t; 49 files_type(snappy_var_lib_t) 50 51 type snappy_var_cache_t; 52 files_type(snappy_var_cache_t) 53 54 type snappy_var_run_t; 55 files_pid_file(snappy_var_run_t) 56 57 type snappy_unit_file_t; 58 systemd_unit_file(snappy_unit_file_t) 59 60 type snappy_tmp_t; 61 files_tmp_file(snappy_tmp_t) 62 63 # actual snap 64 type snappy_snap_t; 65 # XXX: snappy_snap_t should be declared a filesystem, but due to how modules are 66 # handled we cannot generate required contexts with genfscon outside of core 67 # policy 68 # fs_type(snappy_snap_t) 69 files_type(snappy_snap_t) 70 files_mountpoint(snappy_snap_t) 71 72 # CLI tools: snap, snapctl 73 type snappy_cli_t; 74 type snappy_cli_exec_t; 75 domain_type(snappy_cli_t) 76 domain_entry_file(snappy_cli_t, snappy_cli_exec_t) 77 78 # helper tools: snap-{update,discard}-ns 79 type snappy_mount_t; 80 type snappy_mount_exec_t; 81 domain_type(snappy_mount_t) 82 domain_entry_file(snappy_mount_t, snappy_mount_exec_t) 83 84 # helper tool: snap-confine 85 type snappy_confine_t; 86 type snappy_confine_exec_t; 87 domain_type(snappy_confine_t) 88 domain_entry_file(snappy_confine_t, snappy_confine_exec_t) 89 90 type snappy_unconfined_snap_t; 91 unconfined_domain(snappy_unconfined_snap_t) 92 93 ######################################## 94 # 95 # snappy snapd local policy 96 # 97 98 # For development purposes, snappy_t domain is to be marked permissive 99 permissive snappy_t; 100 101 # Allow transitions from init_t to snappy for sockets 102 # init_named_socket_activation() is not supported by core policy in RHEL7 103 gen_require(` 104 type init_t; 105 type var_run_t; 106 ') 107 filetrans_pattern(init_t, var_run_t, snappy_var_run_t, sock_file, "snapd.socket") 108 filetrans_pattern(init_t, var_run_t, snappy_var_run_t, sock_file, "snapd-snap.socket") 109 110 # Allow init_t to read snappy data 111 allow init_t snappy_var_lib_t:dir read; 112 113 # Allow snapd to read procfs 114 gen_require(` 115 type proc_t; 116 ') 117 allow snappy_t proc_t:file { getattr open read }; 118 119 # Allow snapd to read sysfs 120 dev_read_sysfs(snappy_t) 121 dev_search_sysfs(snappy_t) 122 123 # This silences a read AVC denial event on the lost+found directory. 124 gen_require(` 125 type lost_found_t; 126 ') 127 dontaudit snappy_t lost_found_t:dir read; 128 129 # Allow snapd to read SSL cert store 130 miscfiles_read_all_certs(snappy_t) 131 132 # Allow snapd to read config files 133 read_files_pattern(snappy_t, snappy_config_t, snappy_config_t) 134 135 # Allow snapd to manage snaps' homedir data 136 admin_pattern(snappy_t, snappy_home_t) 137 userdom_search_user_home_dirs(snappy_t) 138 userdom_list_user_home_dirs(snappy_t) 139 140 # Allow snapd to read DNS config 141 sysnet_dns_name_resolve(snappy_t) 142 143 # When managed by NetworkManager, DNS config is in its rundata 144 gen_require(` 145 type NetworkManager_var_run_t; 146 ') 147 allow snappy_t NetworkManager_var_run_t:dir search; 148 149 # Allow snapd to read sysctl files 150 kernel_read_net_sysctls(snappy_t) 151 kernel_search_network_sysctl(snappy_t) 152 153 # Allow snapd to query SELinux status 154 selinux_get_enforce_mode(snappy_t) 155 156 # Allow snapd to manage D-Bus config files for snaps 157 optional_policy(` 158 dbus_read_config(snappy_t) 159 allow snappy_t dbusd_etc_t:file { write create rename unlink }; 160 allow snappy_t dbusd_etc_t:lnk_file { read }; 161 ') 162 163 # Allow snapd to manage kmod-backend (/etc/modules-load.d/) files 164 allow snappy_t etc_t:dir { write remove_name }; 165 allow snappy_t etc_t:file unlink; 166 167 # Allow snapd to manage udev rules for snaps and trigger events 168 optional_policy(` 169 udev_manage_rules_files(snappy_t) 170 udev_manage_pid_files(snappy_t) 171 udev_exec(snappy_t) 172 udev_domtrans(snappy_t) 173 udev_create_kobject_uevent_socket(snappy_t) 174 ') 175 allow snappy_t self:netlink_kobject_uevent_socket { create_socket_perms read }; 176 177 # Allow snapd to read/write systemd units and use systemctl for managing snaps 178 systemd_config_all_services(snappy_t) 179 systemd_manage_all_unit_files(snappy_t) 180 systemd_manage_all_unit_lnk_files(snappy_t) 181 systemd_exec_systemctl(snappy_t) 182 systemd_reload_all_services(snappy_t) 183 init_reload_services(snappy_t) 184 init_enable_services(snappy_t) 185 init_disable_services(snappy_t) 186 187 # Allow snapd to execute unsquashfs 188 corecmd_exec_bin(snappy_t) 189 190 # Allow snappy to exec helpers 191 can_exec(snappy_t, snappy_exec_t) 192 can_exec(snappy_t, snappy_mount_exec_t) 193 can_exec(snappy_t, snappy_cli_exec_t) 194 corecmd_search_bin(snappy_t) 195 # allow transition to snap cli domain 196 snappy_cli_domtrans(snappy_t) 197 # allow transition to mount helpers domain 198 snappy_mount_domtrans(snappy_t) 199 # allow transition to snap-confine domain 200 snappy_confine_domtrans(snappy_t) 201 202 # Allow snapd to get FUSE device attributes 203 storage_getattr_fuse_dev(snappy_t) 204 205 # Read l10n files? 206 miscfiles_read_localization(snappy_t) 207 208 # Allow snapd to read its run files, those files are managed elsewhere 209 manage_files_pattern(snappy_t, snappy_var_run_t, snappy_var_run_t) 210 manage_sock_files_pattern(snappy_t, snappy_var_run_t, snappy_var_run_t) 211 212 gen_require(` 213 type user_tmp_t; 214 ') 215 allow snappy_t user_tmp_t:dir { read }; 216 217 # Allow snapd to clean up /run/user sockets 218 userdom_manage_tmp_dirs(snappy_t) 219 userdom_manage_tmp_sockets(snappy_t) 220 221 gen_require(` 222 type systemd_unit_file_t; 223 ') 224 allow snappy_t systemd_unit_file_t:dir { rmdir }; 225 226 gen_require(` 227 type home_root_t; 228 ') 229 allow snappy_t home_root_t:dir { read }; 230 231 # Allow snapd to manage its persistent data 232 admin_pattern(snappy_t, snappy_var_cache_t) 233 # for r/w to commands.db 234 mmap_rw_files_pattern(snappy_t, snappy_var_cache_t, snappy_var_cache_t) 235 admin_pattern(snappy_t, snappy_var_lib_t) 236 # for r/w to errtracker.db 237 mmap_rw_files_pattern(snappy_t, snappy_var_lib_t, snappy_var_lib_t) 238 # snap data files 239 admin_pattern(snappy_t, snappy_var_t) 240 # auto transition /var/snap when created at runtime 241 files_var_filetrans(snappy_t, snappy_var_t, dir, "snap") 242 # some snaps may create character files, eg. lxd creates /dev/full in the 243 # container's rootfs 244 manage_chr_files_pattern(snappy_t, snappy_var_t, snappy_var_t) 245 # And search/read mounted snaps 246 allow snappy_t snappy_snap_t:dir { list_dir_perms }; 247 allow snappy_t snappy_snap_t:file { read_file_perms }; 248 allow snappy_t snappy_snap_t:lnk_file { read_lnk_file_perms }; 249 250 # Grant snapd access to /tmp 251 admin_pattern(snappy_t, snappy_tmp_t) 252 files_tmp_filetrans(snappy_t, snappy_tmp_t, { file dir }) 253 254 # snap command completions, symlinks going back to snap mount directory 255 gen_require(` 256 type usr_t; 257 ') 258 allow snappy_t usr_t:dir { write remove_name add_name }; 259 allow snappy_t usr_t:lnk_file { create unlink }; 260 261 # Allow snapd to use ssh-keygen 262 ssh_exec_keygen(snappy_t) 263 264 # Allow snapd to access passwd file for trivial user lookup 265 auth_read_passwd(snappy_t) 266 # also via nsswitch if called via libc 267 auth_use_nsswitch(snappy_t) 268 269 # because /run/snapd/ns/*.mnt gets a label of the process context 270 gen_require(` type unconfined_t; ') 271 allow snappy_t unconfined_t:file getattr; 272 allow snappy_t snappy_confine_t:file getattr; 273 274 logging_send_syslog_msg(snappy_t) 275 276 allow snappy_t self:capability { dac_read_search dac_override fowner }; 277 allow snappy_t self:process { setpgid }; 278 279 # Various socket permissions 280 allow snappy_t self:fifo_file rw_fifo_file_perms; 281 allow snappy_t self:netlink_route_socket create_netlink_socket_perms; 282 allow snappy_t self:unix_stream_socket create_stream_socket_perms; 283 allow snappy_t self:tcp_socket create_stream_socket_perms; 284 allow snappy_t self:udp_socket create_stream_socket_perms; 285 allow snappy_t self:unix_dgram_socket { create_socket_perms sendto }; 286 allow snappy_t self:capability2 block_suspend; 287 288 # snapd needs to check for ipv6 support 289 gen_require(` 290 type node_t; 291 ') 292 allow snappy_t node_t:tcp_socket node_bind; 293 294 corenet_all_recvfrom_unlabeled(snappy_t) 295 corenet_all_recvfrom_netlabel(snappy_t) 296 corenet_tcp_sendrecv_generic_if(snappy_t) 297 corenet_tcp_sendrecv_generic_node(snappy_t) 298 299 corenet_tcp_sendrecv_http_port(snappy_t) 300 corenet_tcp_connect_http_port(snappy_t) 301 corenet_tcp_sendrecv_http_cache_port(snappy_t) 302 corenet_tcp_connect_http_cache_port(snappy_t) 303 304 # snapd has its own internal DNS resolver 305 corenet_tcp_sendrecv_dns_port(snappy_t) 306 corenet_udp_sendrecv_dns_port(snappy_t) 307 corenet_tcp_connect_dns_port(snappy_t) 308 corenet_sendrecv_dns_client_packets(snappy_t) 309 310 # allow communication with polkit over dbus 311 optional_policy(` 312 policykit_dbus_chat(snappy_t) 313 ') 314 315 # allow communication with system bus 316 optional_policy(` 317 dbus_system_bus_client(snappy_t) 318 ') 319 320 # allow reading sssd files 321 optional_policy(` 322 sssd_read_public_files(snappy_t) 323 sssd_stream_connect(snappy_t) 324 ') 325 326 # for sanity checks 327 optional_policy(` 328 mount_run(snappy_t, snappy_roles) 329 ') 330 331 # snapd runs journalctl to fetch logs 332 optional_policy(` 333 journalctl_run(snappy_t, snappy_roles) 334 # and kills journalctl once the logs have been fetched 335 allow snappy_t journalctl_t:process sigkill; 336 ') 337 338 # only pops up in cloud images where cloud-init.target is incorrectly labeled 339 allow snappy_t init_var_run_t:lnk_file read; 340 341 # snapd may need to run helpers from the snaps, eg. fontconfig helper 342 can_exec(snappy_t, snappy_snap_t) 343 # fontconfig cache setup 344 miscfiles_manage_fonts_cache(snappy_t) 345 files_var_filetrans(snappy_t, fonts_cache_t, dir, "fontconfig") 346 # fontconfig cache is in /usr/lib/fontconfig/cache, which should be labeled as 347 # fonts_cache_t, but it may be incorrectly labeled as lib_t, see 348 # https://bugzilla.redhat.com/show_bug.cgi?id=1659905 and a corresponding bug 349 # for RHEL7 https://bugzilla.redhat.com/show_bug.cgi?id=1792349 (marked as 350 # WONTFIX, so carry the workaround for as long as we support EPEL7) 351 libs_manage_lib_dirs(snappy_t) 352 libs_manage_lib_files(snappy_t) 353 fs_getattr_xattr_fs(snappy_t) 354 # probing cgroup version, /sys/fs/cgroup is a tmpfs for v1 or cgroup for v2 355 fs_getattr_tmpfs(snappy_t) 356 fs_list_tmpfs(snappy_t) 357 fs_getattr_cgroup(snappy_t) 358 # snapd checks whether <snap>.mnt exists before running the mount namespace 359 # helper tool 360 # fs_getattr_nsfs_files() is not available in selinux devel on CentOS 7.x 361 getattr_files_pattern(snappy_t, nsfs_t, nsfs_t) 362 363 # lxd snap has nsfs under common directory, this works around denials triggered 364 # by snapshot size estimation. 365 allow snappy_t unconfined_service_t:file getattr; 366 367 # snapd attempts to read /run/cloud-init/instance-data.json 368 sysnet_read_config(snappy_t) 369 # however older policy may be missing the transition rules, and 370 # /run/cloud-init/instance-data.json ends up as var_run_t 371 files_read_generic_pids(snappy_t) 372 373 # snapd attempts to check /proc/sys/fs/may_detach_mounts during sanity testing 374 kernel_read_fs_sysctls(snappy_t) 375 376 # socket activated services may have their socket files created under 377 # $SNAP_COMMON, but lacking auto transition, they end up labeled as var_t 378 allow snappy_t var_t:sock_file unlink; 379 380 # snapd picks the process start time from /proc/<pid>/stat for polkit 381 allow snappy_t unconfined_t:dir search; 382 allow snappy_t unconfined_t:file { open read }; 383 384 # snapd executes cp when copying snap data between revisions 385 allow snappy_t self:process { setfscreate }; 386 allow snappy_t self:capability { fsetid chown }; 387 # snappy_t running as system_u attempts to change the user identity of copied 388 # files, which typically have unconfined_u 389 domain_obj_id_change_exemption(snappy_t) 390 # snapd executes runuser to take snapshots of user's snap data 391 allow snappy_t self:capability { setuid setgid }; 392 allow snappy_t self:process setsched; 393 # runuser uses kernel keyring 394 allow snappy_t self:key { search write }; 395 # runuser logs to audit 396 logging_send_audit_msgs(snappy_t) 397 398 # allow snapd to remove snap specific user's data under 399 # /run/user/<uid>/snap.<snap> on snap remove; 400 # also desktop-helpers do cp -a on user-dirs.locale, what creates a config_home_t 401 # file inside ~/snap, which would normally be snappy_home_t 402 gnome_manage_home_config(snappy_t) 403 gnome_manage_home_config_dirs(snappy_t) 404 userdom_manage_user_tmp_symlinks(snappy_t) 405 406 # appstream-metadata interface checks whether /var/cache/app-info (labeled 407 # fwupd_cache_t) exists 408 # RHEL7: fwupd.if is not defined in the policy 409 ifndef(`distro_rhel7',` 410 optional_policy(` 411 fwupd_search_cache(snappy_t) 412 ') 413 ') 414 415 # Snapd tries to kill hooks that run for over 10 minutes. Allow killing 416 # processes both in "snap run" and in "post-snap-confine" phases. 417 allow snappy_t snappy_cli_t:process { getpgid sigkill }; 418 allow snappy_t unconfined_service_t:process { getpgid sigkill }; 419 420 ######################################## 421 # 422 # snap-update-ns, snap-dicsard-ns local policy 423 # 424 permissive snappy_mount_t; 425 426 role system_r types snappy_mount_t; 427 428 admin_pattern(snappy_mount_t, snappy_var_run_t) 429 files_pid_filetrans(snappy_mount_t, snappy_var_run_t, {file dir}) 430 431 # layouts are built using tmpfs 432 fs_manage_tmpfs_files(snappy_mount_t) 433 fs_manage_tmpfs_dirs(snappy_mount_t) 434 fs_manage_tmpfs_symlinks(snappy_mount_t) 435 fs_mount_tmpfs(snappy_mount_t) 436 fs_unmount_tmpfs(snappy_mount_t) 437 fs_remount_tmpfs(snappy_mount_t) 438 fs_getattr_tmpfs(snappy_mount_t) 439 # this only gives mounton on directories 440 fs_mounton_tmpfs(snappy_mount_t) 441 # layouts may need to mount on files 442 allow snappy_mount_t tmpfs_t:file mounton; 443 # or (re)create symlinks 444 fs_manage_tmpfs_symlinks(snappy_mount_t) 445 446 # any tmp_t files or directories get snappy_tmp_t 447 files_tmp_filetrans(snappy_mount_t, snappy_tmp_t, { file dir }) 448 userdom_user_tmp_filetrans(snappy_mount_t, snappy_tmp_t, { file dir}) 449 allow snappy_mount_t snappy_tmp_t:dir { mounton }; 450 allow snappy_mount_t snappy_tmp_t:file { mounton }; 451 admin_pattern(snappy_mount_t, snappy_tmp_t) 452 # FIXME: investigate further why transition from user_tmp_t to snappy_tmp_t may 453 # not happen when snap-confine is executed by unconfined_t, should we still end 454 # up with user_tmp_t allow acting on it 455 allow snappy_mount_t user_tmp_t:dir { mounton rmdir }; 456 userdom_delete_user_tmp_files(snappy_mount_t) 457 # when managing some interfaces, a mount from the host /tmp may need to be set 458 # up and files or directories may need to be created or removed (eg. x11 459 # interface), in most distros the /tmp is on tmpfs and thus fs_manage_tmpfs_* 460 # will provide the right policy, but we still need to allow those operations 461 # when the host's /tmp is not a tmpfs 462 files_manage_generic_tmp_dirs(snappy_mount_t) 463 files_manage_generic_tmp_files(snappy_mount_t) 464 465 # Allow snap-{update,discard}-ns to manage mounts 466 gen_require(` 467 type fs_t; 468 type mount_var_run_t; 469 ') 470 allow snappy_mount_t fs_t:filesystem { mount unmount }; 471 allow snappy_mount_t mount_var_run_t:dir { add_name remove_name write search }; 472 allow snappy_mount_t mount_var_run_t:file { create getattr setattr open read write rename unlink lock }; 473 # for discard-ns, because a preserved mount ns is a bind-mounted /proc/<pid>/ns/mnt 474 gen_require(` 475 type proc_t; 476 ') 477 allow snappy_mount_t proc_t:filesystem { getattr unmount }; 478 479 allow snappy_mount_t self:capability { sys_chroot sys_admin setgid }; 480 481 manage_files_pattern(snappy_mount_t, snappy_snap_t, snappy_snap_t) 482 manage_dirs_pattern(snappy_mount_t, snappy_snap_t, snappy_snap_t) 483 manage_lnk_files_pattern(snappy_mount_t, snappy_snap_t, snappy_snap_t) 484 485 read_files_pattern(snappy_mount_t, snappy_var_lib_t, snappy_var_lib_t) 486 getattr_files_pattern(snappy_mount_t, snappy_var_lib_t, snappy_var_lib_t) 487 read_lnk_files_pattern(snappy_mount_t, snappy_var_lib_t, snappy_var_lib_t) 488 list_dirs_pattern(snappy_mount_t, snappy_var_lib_t, snappy_var_lib_t) 489 490 fs_getattr_all_fs(snappy_mount_t) 491 fs_getattr_xattr_fs(snappy_mount_t) 492 # snap-discard-ns pokes, reads and unmounts the mount ns captured at <snap>.mnt 493 fs_read_nsfs_files(snappy_mount_t) 494 fs_unmount_nsfs(snappy_mount_t) 495 496 # due to mounting /usr/libexec/snapd 497 allow snappy_mount_t bin_t:dir mounton; 498 # setting up fonts for the desktop interface 499 gen_require(` 500 type fonts_t, fonts_cache_t; 501 ') 502 503 allow snappy_mount_t fonts_cache_t:dir mounton; 504 allow snappy_mount_t fonts_t:dir mounton; 505 # fontconfig cache is in /usr/lib/fontconfig/cache, which should be labeled as 506 # fonts_cache_t, but it may be incorrectly labeled as lib_t, see 507 # https://bugzilla.redhat.com/show_bug.cgi?id=1659905 and a corresponding bug 508 # for RHEL7 https://bugzilla.redhat.com/show_bug.cgi?id=1792349 (marked as 509 # WONTFIX, so carry the workaround for as long as we support EPEL7) 510 allow snappy_mount_t lib_t:dir mounton; 511 512 # mount and unmount on top of snaps 513 allow snappy_mount_t snappy_snap_t:dir mounton; 514 allow snappy_mount_t snappy_snap_t:file mounton; 515 allow snappy_mount_t snappy_snap_t:filesystem { unmount remount }; 516 517 # freezer 518 fs_manage_cgroup_dirs(snappy_mount_t) 519 fs_manage_cgroup_files(snappy_mount_t) 520 521 # because /run/snapd/ns/*.mnt gets a label of the process context 522 gen_require(` 523 type unconfined_t; 524 ') 525 allow snappy_mount_t unconfined_t:file { open read getattr }; 526 allow snappy_mount_t snappy_confine_t:file { open read getattr }; 527 528 # Go runtime artifacts 529 kernel_read_system_state(snappy_mount_t) 530 kernel_read_net_sysctls(snappy_mount_t) 531 kernel_search_network_sysctl(snappy_mount_t) 532 dev_read_sysfs(snappy_mount_t) 533 534 # snap-update-ns is started using a file descriptor, meaning ld.so runs in the 535 # mount ns and may try to read/mmap cache files inside 536 fs_read_tmpfs_files(snappy_mount_t) 537 mmap_read_files_pattern(snappy_mount_t, tmpfs_t, tmpfs_t) 538 539 # with robust mount namespace update snap-update-ns can remount filesystems that 540 # were mounted from the host when updating the ns 541 fs_remount_xattr_fs(snappy_mount_t) 542 543 # when applying update due to appstream-metadata interface, snap-update-ns ns 544 # whether /var/cache/app-info (labeled fwupd_cache_t) exists 545 # RHEL7: fwupd.if is not defined in the policy 546 ifndef(`distro_rhel7',` 547 optional_policy(` 548 fwupd_search_cache(snappy_mount_t) 549 ') 550 ') 551 552 ######################################## 553 # 554 # snap-confine local policy 555 # 556 permissive snappy_confine_t; 557 558 role system_r types snappy_confine_t; 559 snappy_mount_domtrans(snappy_confine_t) 560 allow snappy_confine_t snappy_mount_t:process2 nosuid_transition; 561 562 admin_pattern(snappy_confine_t, snappy_var_run_t) 563 564 allow snappy_confine_t snappy_var_lib_t:dir { list_dir_perms }; 565 allow snappy_confine_t snappy_var_lib_t:file { read_file_perms }; 566 allow snappy_confine_t snappy_var_lib_t:lnk_file { read_lnk_file_perms }; 567 568 files_pid_filetrans(snappy_confine_t, snappy_var_run_t, {file dir}) 569 570 allow snappy_confine_t snappy_home_t:dir { create_dir_perms list_dir_perms add_entry_dir_perms }; 571 allow snappy_confine_t snappy_home_t:file { read_file_perms }; 572 allow snappy_confine_t snappy_home_t:lnk_file { manage_lnk_file_perms }; 573 userdom_user_home_dir_filetrans(snappy_confine_t, snappy_home_t, dir, "snap") 574 userdom_admin_home_dir_filetrans(snappy_confine_t, snappy_home_t, dir, "snap") 575 576 allow snappy_confine_t snappy_snap_t:process transition; 577 578 allow snappy_confine_t self:process { setexec }; 579 allow snappy_confine_t self:capability { setgid setuid sys_admin sys_chroot dac_read_search dac_override }; 580 581 init_read_state(snappy_confine_t) 582 583 # libudev 584 udev_manage_pid_dirs(snappy_confine_t) 585 586 # basic access to system info in /proc 587 kernel_read_system_state(snappy_confine_t) 588 589 fs_getattr_all_fs(snappy_confine_t) 590 dev_getattr_fs(snappy_confine_t) 591 dev_getattr_sysfs_fs(snappy_confine_t) 592 fs_getattr_cgroup(snappy_confine_t) 593 fs_getattr_hugetlbfs(snappy_confine_t) 594 fs_getattr_tmpfs(snappy_confine_t) 595 # some locations that snap-confine unmounts, eg. /dev, are actually tmpfs 596 fs_unmount_tmpfs(snappy_confine_t) 597 fs_getattr_xattr_fs(snappy_confine_t) 598 fs_manage_cgroup_dirs(snappy_confine_t) 599 fs_write_cgroup_files(snappy_confine_t) 600 kernel_getattr_debugfs(snappy_confine_t) 601 kernel_getattr_proc(snappy_confine_t) 602 fs_read_nsfs_files(snappy_confine_t) 603 term_getattr_pty_fs(snappy_confine_t) 604 # term_getattr_generic_ptys() is not supported by core policy in RHEL7 605 allow snappy_confine_t devpts_t:chr_file getattr; 606 term_search_ptys(snappy_confine_t) 607 608 # because /run/snapd/ns/*.mnt gets a label of the process context 609 allow snappy_confine_t unconfined_t:file getattr; 610 611 # mount ns setup 612 gen_require(` 613 type ptmx_t; 614 type modules_object_t; 615 type ifconfig_var_run_t; 616 type var_log_t; 617 type lib_t; 618 ') 619 620 admin_pattern(snappy_confine_t, snappy_tmp_t) 621 # any tmp files or directories get snappy_tmp_t 622 files_tmp_filetrans(snappy_confine_t, snappy_tmp_t, { file dir }) 623 userdom_user_tmp_filetrans(snappy_confine_t, snappy_tmp_t, { file dir}) 624 625 allow snappy_confine_t snappy_tmp_t:dir mounton; 626 627 allow snappy_confine_t admin_home_t:dir mounton; 628 allow snappy_confine_t bin_t:dir mounton; 629 allow snappy_confine_t cert_t:dir { getattr mounton }; 630 allow snappy_confine_t device_t:filesystem unmount; 631 allow snappy_confine_t devpts_t:dir mounton; 632 allow snappy_confine_t etc_t:file mounton; 633 allow snappy_confine_t home_root_t:dir mounton; 634 allow snappy_confine_t ifconfig_var_run_t:dir mounton; 635 allow snappy_confine_t modules_object_t:dir mounton; 636 allow snappy_confine_t lib_t:dir mounton; 637 allow snappy_confine_t ptmx_t:chr_file { getattr mounton }; 638 allow snappy_confine_t snappy_snap_t:dir { mounton read }; 639 allow snappy_confine_t snappy_snap_t:file mounton; 640 allow snappy_confine_t snappy_snap_t:lnk_file read; 641 allow snappy_confine_t snappy_var_lib_t:dir mounton; 642 allow snappy_confine_t snappy_var_run_t:dir mounton; 643 allow snappy_confine_t snappy_var_run_t:file mounton; 644 allow snappy_confine_t snappy_var_t:dir { getattr mounton search }; 645 allow snappy_confine_t tmp_t:dir { add_name create mounton remove_name rmdir setattr write read }; 646 allow snappy_confine_t usr_t:dir mounton; 647 allow snappy_confine_t var_log_t:dir mounton; 648 allow snappy_confine_t var_run_t:dir mounton; 649 dev_mounton(snappy_confine_t) 650 dev_mounton_sysfs(snappy_confine_t) 651 dev_unmount_sysfs_fs(snappy_confine_t) 652 files_mounton_etc(snappy_confine_t) 653 files_mounton_mnt(snappy_confine_t) 654 files_mounton_rootfs(snappy_confine_t) 655 fs_unmount_xattr_fs(snappy_confine_t) 656 kernel_mounton_proc(snappy_confine_t) 657 kernel_unmount_proc(snappy_confine_t) 658 seutil_read_file_contexts(snappy_confine_t) 659 term_mount_pty_fs(snappy_confine_t) 660 661 # device group 662 fs_manage_cgroup_dirs(snappy_confine_t) 663 fs_manage_cgroup_files(snappy_confine_t) 664 # snap-update-ns and snap-confine use tmpfs when setting up the namespace, 665 # things may end up keeping tmpfs_t label 666 fs_read_tmpfs_symlinks(snappy_confine_t) 667 668 # restoring file contexts 669 seutil_read_file_contexts(snappy_confine_t) 670 seutil_read_default_contexts(snappy_confine_t) 671 seutil_read_config(snappy_confine_t) 672 673 can_exec(snappy_confine_t, snappy_snap_t) 674 read_files_pattern(snappy_confine_t, snappy_snap_t, snappy_snap_t) 675 # and allow transition by snap-confine 676 allow snappy_confine_t snappy_unconfined_snap_t:process { noatsecure rlimitinh siginh transition dyntransition }; 677 gen_require(` 678 type unconfined_service_t; 679 ') 680 allow snappy_confine_t unconfined_service_t:process { noatsecure rlimitinh siginh transition dyntransition }; 681 682 # for classic snaps, snap-confine executes snap-exec from the host (labeled as 683 # snappy_exec_t) 684 can_exec(snappy_confine_t, snappy_exec_t) 685 # allow snappy_exec_t to be an entrypoint to unconfined_service_t, only 686 # snap-confine is allowed to transition this way 687 domain_entry_file(unconfined_service_t, snappy_exec_t) 688 689 ######################################## 690 # 691 # snap, snapctl local policy 692 # 693 permissive snappy_cli_t; 694 695 role system_r types snappy_cli_t; 696 snappy_confine_domtrans(snappy_cli_t) 697 # services are started through 'snap run ...' wrapper 698 snappy_cli_domtrans(init_t) 699 700 relabel_dirs_pattern(snappy_cli_t, user_home_t, snappy_home_t) 701 relabel_files_pattern(snappy_cli_t, user_home_t, snappy_home_t) 702 relabel_dirs_pattern(snappy_cli_t, admin_home_t, snappy_home_t) 703 relabel_files_pattern(snappy_cli_t, admin_home_t, snappy_home_t) 704 705 manage_files_pattern(snappy_cli_t, snappy_home_t, snappy_home_t) 706 manage_lnk_files_pattern(snappy_cli_t, snappy_home_t, snappy_home_t) 707 manage_dirs_pattern(snappy_cli_t, snappy_home_t, snappy_home_t) 708 userdom_user_home_dir_filetrans(snappy_cli_t, snappy_home_t, dir, "snap") 709 userdom_admin_home_dir_filetrans(snappy_cli_t, snappy_home_t, dir, "snap") 710 711 allow snappy_cli_t snappy_snap_t:dir {list_dir_perms }; 712 allow snappy_cli_t snappy_snap_t:file { read_file_perms }; 713 allow snappy_cli_t snappy_snap_t:lnk_file { read_lnk_file_perms }; 714 715 allow snappy_cli_t snappy_var_lib_t:dir { list_dir_perms }; 716 allow snappy_cli_t snappy_var_lib_t:file { read_file_perms }; 717 allow snappy_cli_t snappy_var_lib_t:lnk_file { read_lnk_file_perms }; 718 719 # allow talking to system and session bus for app tracking 720 dbus_system_bus_client(snappy_cli_t); 721 dbus_chat_system_bus(snappy_cli_t); 722 723 # allow reading passwd 724 auth_read_passwd(snappy_cli_t) 725 # allow reading sssd files 726 optional_policy(` 727 sssd_read_public_files(snappy_cli_t) 728 sssd_stream_connect(snappy_cli_t) 729 ') 730 731 # restorecon, matchpathcon 732 seutil_domtrans_setfiles(snappy_cli_t) 733 seutil_read_file_contexts(snappy_cli_t) 734 seutil_read_default_contexts(snappy_cli_t) 735 seutil_read_config(snappy_cli_t) 736 selinux_load_policy(snappy_cli_t) 737 selinux_validate_context(snappy_cli_t) 738 corecmd_exec_bin(snappy_cli_t) 739 740 allow snappy_cli_t proc_t:file { getattr open read }; 741 allow snappy_cli_t snappy_exec_t:file { read_file_perms }; 742 allow snappy_cli_t self:capability { dac_override }; 743 744 # go runtime poking at things 745 init_ioctl_stream_sockets(snappy_cli_t) 746 kernel_read_net_sysctls(snappy_cli_t) 747 kernel_search_network_sysctl(snappy_cli_t) 748 dev_read_sysfs(snappy_cli_t) 749 750 # talk to snapd 751 snappy_stream_connect(snappy_cli_t) 752 753 # check stuff in /run/user 754 userdom_search_user_tmp_dirs(snappy_cli_t) 755 756 # execute snapd internal tools 757 # needed to grab a version information from snap-seccomp 758 can_exec(snappy_cli_t, snappy_exec_t) 759 760 # probing cgroup version, /sys/fs/cgroup is a tmpfs for v1 or cgroup for v2 761 fs_getattr_tmpfs(snappy_cli_t) 762 fs_getattr_cgroup(snappy_cli_t) 763 764 765 ######################################## 766 # 767 # snappy (unconfined snap) local policy 768 # 769 permissive snappy_unconfined_snap_t; 770 771 # allow unconfined snap service to run as a system service 772 role system_r types snappy_unconfined_snap_t; 773 can_exec(snappy_unconfined_snap_t, snappy_snap_t) 774 domain_entry_file(snappy_unconfined_snap_t, snappy_snap_t) 775 domain_entry_file(unconfined_service_t, snappy_snap_t) 776 777 # for journald 778 gen_require(` 779 type syslogd_t; 780 ') 781 allow syslogd_t snappy_unconfined_snap_t:dir search_dir_perms; 782 783 allow snappy_unconfined_snap_t self:process { fork getsched }; 784 785 # allow snappy_unconfined_snap_t snappy_snap_t:dir { list_dir_perms }; 786 # allow snappy_unconfined_snap_t snappy_snap_t:file { read_file_perms }; 787 # allow snappy_unconfined_snap_t snappy_snap_t:lnk_file { read_lnk_file_perms }; 788 789 # snap can carry services, which are then started by systemd, need to allow 790 # systemd to manage them 791 allow init_t snappy_unconfined_snap_t:dir search_dir_perms; 792 allow init_t snappy_unconfined_snap_t:file { read_file_perms }; 793 allow init_t snappy_unconfined_snap_t:lnk_file { read_lnk_file_perms }; 794 allow init_t snappy_unconfined_snap_t:process { sigkill signull signal }; 795 796 ######################################## 797 # 798 # file/dir transitions for unconfined_t 799 # 800 801 # snap tools can be invoked by the regular user, make sure that things get 802 # proper labels 803 gen_require(` 804 type unconfined_t; 805 ') 806 userdom_user_home_dir_filetrans(unconfined_t, snappy_home_t, dir, "snap") 807 userdom_admin_home_dir_filetrans(unconfined_t, snappy_home_t, dir, "snap") 808 files_pid_filetrans(unconfined_t, snappy_var_run_t, dir, "snapd") 809 810 ######################################## 811 # 812 # extra policy for init_t 813 # 814 815 # support socket activation of snap services, for such snaps the socket file can 816 # only be located under $SNAP_DATA or $SNAP_COMMON, both labeled as snappy_var_t; 817 allow init_t snappy_var_t:dir manage_dir_perms; 818 allow init_t snappy_var_t:sock_file manage_sock_file_perms; 819 # the snap is started via `snap run ..` 820 allow init_t snappy_cli_t:unix_stream_socket create_stream_socket_perms; 821 # init_t will try to remount snap mount directory when starting services that 822 # use Private* directives, while init_t is allowed to remount all fs, we cannot 823 # declare fs_type(snappy_snap_t) outside of core policy, add explicit permission 824 # instead 825 allow init_t snappy_snap_t:filesystem remount; 826 827 ######################################## 828 # 829 # extra policy for mandb_t 830 # 831 gen_require(` 832 type mandb_t; 833 ') 834 # mandb cache update scans whe whole directory tree looking for 'man' 835 allow mandb_t snappy_var_lib_t:dir search_dir_perms; 836 837 ######################################## 838 # 839 # extra policy for system dbus 840 # 841 gen_require(` 842 type system_dbusd_t; 843 ') 844 # system dbus may look info /var/lib/snapd/dbus-1 845 snappy_search_lib(system_dbusd_t) 846 snappy_read_lib(system_dbusd_t) 847 optional_policy(` 848 gen_require(` 849 # watch permission is defined only in recent versions of refpolicy 850 class dir { watch }; 851 ') 852 allow system_dbusd_t snappy_var_lib_t:dir watch; 853 ')