[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/kernel/

[Jason Zaman]

commit:     aec9eaf2286333e32c87e20244488b162b885df9
Author:     Guido Trentalancia <guido <AT> trentalancia <DOT> net>
AuthorDate: Fri Aug 19 13:27:32 2016 +0000
Commit:     Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Wed Aug 31 15:38:26 2016 +0000
URL:        
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=aec9eaf2

Add module_load permission to can_load_kernmodule

The "module_load" permission has been recently added to the "system"
class (kernel 4.7).

The following patch updates the Reference Policy so that the new
permission is allowed when a kernel module should be loaded.

To preserve the module encapsulation, a new interface is defined
in the kernel files module and that interface is then used in the
kernel module.

A short note is added about unneeded permissions that set the
kernel scheduling parameters (might lead to service disruption).

Signed-off-by: Guido Trentalancia <guido <AT> trentalancia.net>

 policy/modules/kernel/files.if  | 19 +++++++++++++++++++
 policy/modules/kernel/kernel.te |  4 ++++
 2 files changed, 23 insertions(+)

diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if
index dc13e31..0d9fddd 100644
--- a/policy/modules/kernel/files.if
+++ b/policy/modules/kernel/files.if
@@ -4160,6 +4160,25 @@ interface(`files_kernel_modules_filetrans',`
 
 ########################################
 ## <summary>
+##     Load kernel module files.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`files_load_kernel_modules',`
+       gen_require(`
+               type modules_object_t;
+       ')
+
+       files_read_kernel_modules($1)
+       allow $1 modules_object_t:system module_load;
+')
+
+########################################
+## <summary>
 ##     List world-readable directories.
 ## </summary>
 ## <param name="domain">

diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te
index 6467aed..c18e7eb 100644
--- a/policy/modules/kernel/kernel.te
+++ b/policy/modules/kernel/kernel.te
@@ -429,8 +429,12 @@ optional_policy(`
 if( ! secure_mode_insmod ) {
        allow can_load_kernmodule self:capability sys_module;
 
+       files_load_kernel_modules(can_load_kernmodule)
+
        # load_module() calls stop_machine() which
        # calls sched_setscheduler()
+       # gt: there seems to be no trace of the above, at
+       # least in kernel versions greater than 2.6.37...
        allow can_load_kernmodule self:capability sys_nice;
        kernel_setsched(can_load_kernmodule)
 }