Hi,
In fedora 11 SELinux world there are some developments that can affect
akmods, xorg-nvidia and other packages.
Development #1, In Fedora 11 one can de-install the unconfined SELinux
module (semodule -r unconfined). This causes system services that do not
have SELinux policy defined, thus running in the initrc_t domain, to no
longer be allowed unconfined access.
Note: by default it will still work, only once you decide to de-install
the unconfined module it will be denied access.
Development #2, In Fedora 11 one can now use selinux-policy-mls in a
GUI. selinux-policy-mls is a strict SELinux model thus xorg-nvidia,
akmods will not be allowed to operate by default.
Since i am running SELinux with the unconfined module removed and i am
using akmods plus xorg-nvidia, i decided to write SELinux policy for
these two packages.
The policy only works for xorg-nvidia and akmods (used for xorg-nvidia).
It needs further testing to perfect it and to make akmods also work for
building other rpm-fusion modules.
If anyone wants to help improve this that would probably help the
community. Be aware that testing this can break your system. Do not test
it in a production environment or any important system.
Below you will find instruction about how to test the akmods and nvidia
SELinux policy modules:
1. Update to the latest available selinux-policy-targeted
(yum update selinux-policy-targeted)
2. Remove the unconfined SELinux module
(semodule -r unconfined)
3. Put the attached source policy modules in a directory and build them
cp nvidia.te nvidia.fc nvidia.if akmods.te akmods.if akmods.fc ~/stuff;
cd ~/stuff;
make -f /usr/share/selinux/devel/Makefile
4. install the binary modules it created
semodule -i nvidia.pp akmods.pp
5. restore the contexts of all defined paths in both nvidia.fc and
akmods.fc
restorecon -R -v /etc/rc.d/init.d/nvidia
restorecon -R -v /usr/sbin/nvidia-config-display
restorecon -R -v /etc/rc.d/init.d/akmods
restorecon -R -v /usr/sbin/akmods
restorecon -R -v /var/cache/akmods
restorecon -R -v /usr/src/akmods
6. put the system in permissive mode
setenforce 0
7. install akmods, nvidia etc.
Notes: The installed SELinux domains run in a permissive mode. However
You may want to test this with the whole system in permissive mode since
rpm, depmod and other stuff are also involved.
setenforce 0
8. test
Important note: try this at you own risk. If you decide to uninstall the
unconfined SELinux module then don't expect there to be an easy way to
undo that!
9. Send feedback accompanied by AVC denials so that the modules can be
improved.
Thanks
/etc/rc\.d/init\.d/akmods --
gen_context(system_u:object_r:akmods_initrc_exec_t, s0)
/usr/sbin/akmods -- gen_context(system_u:object_r:akmods_exec_t, s0)
/var/cache/akmods(/.*)? gen_context(system_u:object_r:akmods_cache_t, s0)
/usr/src/akmods(.*)? gen_context(system_u:object_r:akmods_src_t, s0)
## <summary>SELinux policy for Akmods</summary>
## <desc>
## <p>
## Automatic kmods build and install tool.
## http://rpmfusion.org/Packaging/KernelModules/Akmods
## </p>
## </desc>
########################################
## <summary>
## Append akmods cache file.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`akmods_append_cache_file', `
gen_require(`
type akmods_cache_t;
')
allow $1 akmods_cache_t:file append;
')
########################################
## <summary>
## Execute a domain transition to run akmods.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed to transition.
## </summary>
## </param>
#
interface(`akmods_domtrans', `
gen_require(`
type akmods_t, akmods_exec_t;
')
domtrans_pattern($1, akmods_exec_t, akmods_t)
')
policy_module(akmods, 0.0.1)
########################################
#
# Akmods private declarations
#
type akmods_initrc_exec_t;
init_script_file(akmods_initrc_exec_t)
type akmods_t;
type akmods_exec_t;
init_daemon_domain(akmods_t, akmods_exec_t)
type akmods_cache_t;
files_type(akmods_cache_t)
type akmods_src_t;
files_type(akmods_src_t)
type akmods_tmp_t;
files_tmp_file(akmods_tmp_t)
permissive akmods_t;
########################################
#
# Akmods private policy
#
allow akmods_t self:capability { setuid sys_tty_config chown setgid audit_write
dac_override };
allow akmods_t self:fifo_file rw_fifo_file_perms;
allow akmods_t self:netlink_audit_socket { nlmsg_relay write create read };
allow akmods_t self:process { setsched setfscreate getsched setrlimit };
allow akmods_t self:udp_socket { write read create ioctl connect };
allow akmods_t self:unix_dgram_socket { write create connect };
manage_dirs_pattern(akmods_t, akmods_cache_t, akmods_cache_t)
manage_files_pattern(akmods_t, akmods_cache_t, akmods_cache_t)
manage_dirs_pattern(akmods_t, akmods_src_t, akmods_src_t)
manage_files_pattern(akmods_t, akmods_src_t, akmods_src_t)
manage_lnk_files_pattern(akmods_t, akmods_src_t, akmods_src_t)
manage_dirs_pattern(akmods_t, akmods_tmp_t, akmods_tmp_t)
manage_files_pattern(akmods_t, akmods_tmp_t, akmods_tmp_t)
manage_lnk_files_pattern(akmods_t, akmods_tmp_t, akmods_tmp_t)
files_tmp_filetrans(akmods_t, akmods_tmp_t, { dir file lnk_file })
relabel_dirs_pattern(akmods_t, akmods_tmp_t, akmods_tmp_t)
relabel_files_pattern(akmods_t, akmods_tmp_t, akmods_tmp_t)
relabel_lnk_files_pattern(akmods_t, akmods_tmp_t, akmods_tmp_t)
exec_files_pattern(akmods_t, akmods_tmp_t, akmods_tmp_t)
consoletype_exec(akmods_t)
corecmd_exec_bin(akmods_t)
corecmd_exec_shell(akmods_t)
corecmd_read_bin_symlinks(akmods_t)
dev_read_urand(akmods_t)
files_exec_usr_src_files(akmods_t)
# files_exec_usr_src_files doesnt include ioctl perm
files_read_usr_src_files(akmods_t)
files_read_etc_files(akmods_t)
files_read_kernel_img(akmods_t)
files_read_usr_files(akmods_t)
files_read_usr_symlinks(akmods_t)
files_search_kernel_modules(akmods_t)
files_search_var_lib(akmods_t)
fs_getattr_xattr_fs(akmods_t)
kernel_read_kernel_sysctls(akmods_t)
kernel_read_system_state(akmods_t)
init_read_utmp(akmods_t)
libs_exec_lib_files(akmods_t)
logging_send_syslog_msg(akmods_t)
miscfiles_read_localization(akmods_t)
rpm_domtrans(akmods_t)
rpm_read_db(akmods_t)
seutil_read_file_contexts(akmods_t)
seutil_search_default_contexts(akmods_t)
sysnet_read_config(akmods_t)
# Customization
# /var/cache/akmods/nvidia/.last.log
require { type depmod_t, rpm_script_t, modules_object_t; }
akmods_append_cache_file(depmod_t)
akmods_domtrans(rpm_script_t)
# BUG needs to be added to files_search_kernel_modules
read_lnk_files_pattern(akmods_t, modules_object_t, modules_object_t)
/etc/rc\.d/init\.d/nvidia --
gen_context(system_u:object_r:nvidia_initrc_exec_t, s0)
/usr/sbin/nvidia-config-display --
gen_context(system_u:object_r:nvidia_exec_t, s0)
# /usr/sbin/nvidia-xconfig
## <summary>SELinux policy for Xorg NVidia driver suite</summary>
policy_module(nvidia, 0.0.1)
########################################
#
# Nvidia Xorg driver private declarations
#
type nvidia_initrc_exec_t;
init_script_file(nvidia_initrc_exec_t)
type nvidia_exec_t;
type nvidia_t;
init_daemon_domain(nvidia_t, nvidia_exec_t)
permissive nvidia_t;
########################################
#
# Nvidia Xorg driver private policy
#
allow nvidia_t self:capability sys_tty_config;
allow nvidia_t self:fifo_file read_fifo_file_perms;
corecmd_read_bin_symlinks(nvidia_t)
corecmd_search_bin(nvidia_t)
corecmd_exec_shell(nvidia_t)
files_getattr_kernel_modules(nvidia_t)
# /etc/gdm/custom.conf /etc/X11/xorg.conf
files_manage_etc_files(nvidia_t)
files_search_kernel_modules(nvidia_t)
kernel_read_system_state(nvidia_t)
miscfiles_read_localization(nvidia_t)
rpm_domtrans(nvidia_t)
