commit: ff059cfa2c7ef4bd5ff446240617a14e515a0ace
Author: Kenton Groombridge <me <AT> concord <DOT> sh>
AuthorDate: Tue Jan 11 19:56:49 2022 +0000
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Sun Jan 30 01:15:06 2022 +0000
URL:
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=ff059cfa
userdomain: add type for user bin files
Add a type and allow execute access to executable files that may be
freely managed by users in their home directories. Although users may
normally execute anything labeled user_home_t, this type is intended to
be executed by user services such as the user's systemd --user instance.
Signed-off-by: Kenton Groombridge <me <AT> concord.sh>
Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org>
policy/modules/system/userdomain.fc | 2 ++
policy/modules/system/userdomain.if | 52 ++++++++++++++++++++++++++++++++++++-
policy/modules/system/userdomain.te | 3 +++
3 files changed, 56 insertions(+), 1 deletion(-)
diff --git a/policy/modules/system/userdomain.fc
b/policy/modules/system/userdomain.fc
index 70b83058..173e314a 100644
--- a/policy/modules/system/userdomain.fc
+++ b/policy/modules/system/userdomain.fc
@@ -1,5 +1,7 @@
HOME_DIR -d
gen_context(system_u:object_r:user_home_dir_t,s0-mls_systemhigh)
HOME_DIR/.+ gen_context(system_u:object_r:user_home_t,s0)
+HOME_DIR/bin(/.*)? gen_context(system_u:object_r:user_bin_t,s0)
+HOME_DIR/\.local/bin(/.*)?
gen_context(system_u:object_r:user_bin_t,s0)
HOME_DIR/\.pki(/.*)? gen_context(system_u:object_r:user_cert_t,s0)
/tmp/gconfd-%{USERNAME} -d gen_context(system_u:object_r:user_tmp_t,s0)
diff --git a/policy/modules/system/userdomain.if
b/policy/modules/system/userdomain.if
index ef4419a5..6380e869 100644
--- a/policy/modules/system/userdomain.if
+++ b/policy/modules/system/userdomain.if
@@ -376,7 +376,8 @@ interface(`userdom_ro_home_role',`
#
interface(`userdom_manage_home_role',`
gen_require(`
- type user_home_t, user_home_dir_t, user_cert_t;
+ type user_home_t, user_home_dir_t;
+ type user_bin_t, user_cert_t;
')
##############################
@@ -410,6 +411,10 @@ interface(`userdom_manage_home_role',`
allow $2 user_home_t:sock_file { watch watch_mount watch_sb
watch_with_perm watch_reads };
allow $2 user_home_t:fifo_file { watch watch_mount watch_sb
watch_with_perm watch_reads };
+ userdom_manage_user_bin($2)
+ userdom_exec_user_bin_files($2)
+ userdom_user_home_dir_filetrans($2, user_bin_t, dir, "bin")
+
userdom_manage_user_certs($2)
userdom_user_home_dir_filetrans($2, user_cert_t, dir, ".pki")
@@ -442,6 +447,10 @@ interface(`userdom_manage_home_role',`
flash_relabel_home($2)
')
')
+
+ optional_policy(`
+ xdg_data_filetrans($2, user_bin_t, dir, "bin")
+ ')
')
#######################################
@@ -2774,6 +2783,47 @@
interface(`userdom_user_home_dir_filetrans_user_home_content',`
files_search_home($1)
')
+########################################
+## <summary>
+## Execute user executable files.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`userdom_exec_user_bin_files',`
+ gen_require(`
+ type user_bin_t;
+ ')
+
+ exec_files_pattern($1, user_bin_t, user_bin_t)
+ read_lnk_files_pattern($1, user_bin_t, user_bin_t)
+ files_search_home($1)
+')
+
+########################################
+## <summary>
+## Manage user executable files.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`userdom_manage_user_bin',`
+ gen_require(`
+ type user_bin_t;
+ ')
+
+ allow $1 user_bin_t:dir { manage_dir_perms relabel_dir_perms };
+ allow $1 user_bin_t:file { manage_file_perms relabel_file_perms };
+ allow $1 user_bin_t:lnk_file { manage_lnk_file_perms
relabel_lnk_file_perms };
+ files_search_home($1)
+')
+
########################################
## <summary>
## Read user SSL certificates.
diff --git a/policy/modules/system/userdomain.te
b/policy/modules/system/userdomain.te
index e9a5ccfc..9339cb9d 100644
--- a/policy/modules/system/userdomain.te
+++ b/policy/modules/system/userdomain.te
@@ -95,6 +95,9 @@ files_associate_tmp(user_home_t)
files_poly_parent(user_home_t)
files_mountpoint(user_home_t)
+type user_bin_t;
+userdom_user_home_content(user_bin_t)
+
type user_cert_t;
userdom_user_home_content(user_cert_t)
