From 8b51674b2d2588c97ee6ddb976d6458ad33e2880 Mon Sep 17 00:00:00 2001
From: Stephen Smalley <sds@tycho.nsa.gov>
Date: Wed, 8 Jan 2014 09:29:30 -0500
Subject: [PATCH] Restrict ability to set checkreqprot.
Now that we set /sys/fs/selinux/checkreqprot via init.rc,
restrict the ability to set it to only the kernel domain.
Change-Id: I975061fd0e69c158db9bdb23e6ba77948e3fead1
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
---
domain.te | 2 +-
kernel.te | 3 +++
unconfined.te | 2 +-
3 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/domain.te b/domain.te
index a49898048..653a50776 100644
--- a/domain.te
+++ b/domain.te
@@ -148,7 +148,7 @@ neverallow { domain -init } kernel:security load_policy;
# init starts in kernel domain and switches to init domain via setcon in
# the init.rc, so the setenforce occurs while still in kernel. After
# switching domains, there is never any need to setenforce again by init.
-neverallow { domain -kernel } kernel:security setenforce;
+neverallow { domain -kernel } kernel:security { setenforce setcheckreqprot };
# Only init, ueventd and system_server should be able to access HW RNG
neverallow { domain -init -system_server -ueventd -unconfineddomain } hw_random_device:chr_file *;
diff --git a/kernel.te b/kernel.te
index 089786bff..4ccce20f1 100644
--- a/kernel.te
+++ b/kernel.te
@@ -9,3 +9,6 @@ allow kernel unlabeled:filesystem mount;
# Initial setenforce by init prior to switching to init domain.
allow kernel self:security setenforce;
+
+# Set checkreqprot by init.rc prior to switching to init domain.
+allow kernel self:security setcheckreqprot;
diff --git a/unconfined.te b/unconfined.te
index bdebf3a2c..ef134026d 100644
--- a/unconfined.te
+++ b/unconfined.te
@@ -17,7 +17,7 @@
######################################################
allow unconfineddomain self:capability_class_set *;
-allow unconfineddomain kernel:security ~{ load_policy setenforce };
+allow unconfineddomain kernel:security ~{ load_policy setenforce setcheckreqprot };
allow unconfineddomain kernel:system *;
allow unconfineddomain domain:process ~ptrace;
allow unconfineddomain domain:fd *;
--
GitLab