diff --git a/app.te b/app.te index 8e220ff24278e959ae15fc452fe3679e2ff9eced..6e95ffb402825a51c4f7f3f65be0c20b8c5694f4 100644 --- a/app.te +++ b/app.te @@ -137,9 +137,6 @@ neverallow { appdomain -unconfineddomain } self:capability2 *; # Block device access. neverallow { appdomain -unconfineddomain } dev_type:blk_file { read write }; -# Kernel memory access. -neverallow { appdomain -unconfineddomain } kmem_device:chr_file { read write }; - # Access to any character device that is not specifically typed. neverallow { appdomain -unconfineddomain } device:chr_file { read write }; diff --git a/domain.te b/domain.te index 4d411959c7e3cf80dffb283f07726b57a1a06fef..55a7b8162a6af5f4021deab8cb79308a018cd891 100644 --- a/domain.te +++ b/domain.te @@ -139,3 +139,7 @@ neverallow { domain -init -system_server -ueventd -unconfineddomain } hw_random_ # Ensure that all entrypoint executables are in exec_type. neverallow domain { file_type -exec_type }:file entrypoint; + +# Ensure that nothing in userspace can access /dev/mem or /dev/kmem +neverallow { domain -kernel -ueventd -init } kmem_device:chr_file *; +neverallow domain kmem_device:chr_file ~{ create relabelto unlink setattr }; diff --git a/netd.te b/netd.te index d8d65c9a120a252999bb01a5ad5774fbf38169ed..d60e3776b6e6a031e457ac3fc4bc32fad711771e 100644 --- a/netd.te +++ b/netd.te @@ -64,9 +64,6 @@ allow netd device:sock_file write; # Block device access. neverallow netd dev_type:blk_file { read write }; -# Kernel memory access. -neverallow netd kmem_device:chr_file { read write }; - # Setting SELinux enforcing status or booleans. neverallow netd kernel:security { setenforce setbool }; diff --git a/unconfined.te b/unconfined.te index 80f88b7bc6a129941bbef7d9eebc2f1e13b84779..35db54f75b5e58f359db90b3dd473f75d57e8b05 100644 --- a/unconfined.te +++ b/unconfined.te @@ -30,7 +30,7 @@ allow unconfineddomain domain:ipc_class_set *; allow unconfineddomain domain:key *; allow unconfineddomain fs_type:filesystem *; allow unconfineddomain {fs_type dev_type file_type}:{ dir blk_file lnk_file sock_file fifo_file } ~relabelto; -allow unconfineddomain {fs_type dev_type file_type}:{ chr_file file } ~{entrypoint relabelto}; +allow unconfineddomain {fs_type dev_type file_type -kmem_device}:{ chr_file file } ~{entrypoint relabelto}; allow unconfineddomain node_type:node *; allow unconfineddomain node_type:{ tcp_socket udp_socket rawip_socket } node_bind; allow unconfineddomain netif_type:netif *;