commit: 04ebf78c2f42dbdbb4cc5c79c10af95878a1438a Author: Luis Ressel <aranea <AT> aixah <DOT> de> AuthorDate: Mon Mar 7 15:33:02 2016 +0000 Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org> CommitDate: Fri Mar 11 17:16:17 2016 +0000 URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=04ebf78c
New policy for tboot utilities tboot is an OSS project for using the features of Intel TXT. Some of its included utilities (might) need special permissions. For now, there's only a policy for txt-stat (it needs access to /dev/mem). policy/modules/contrib/tboot.fc | 1 + policy/modules/contrib/tboot.if | 46 +++++++++++++++++++++++++++++++++++++++++ policy/modules/contrib/tboot.te | 24 +++++++++++++++++++++ 3 files changed, 71 insertions(+) diff --git a/policy/modules/contrib/tboot.fc b/policy/modules/contrib/tboot.fc new file mode 100644 index 0000000..437e1d5 --- /dev/null +++ b/policy/modules/contrib/tboot.fc @@ -0,0 +1 @@ +/usr/sbin/txt-stat -- gen_context(system_u:object_r:txtstat_exec_t,s0) diff --git a/policy/modules/contrib/tboot.if b/policy/modules/contrib/tboot.if new file mode 100644 index 0000000..0ffe6d8 --- /dev/null +++ b/policy/modules/contrib/tboot.if @@ -0,0 +1,46 @@ +## <summary>Utilities for the tboot TXT module.</summary> + +######################################## +## <summary> +## Execute txt-stat in the txtstat domain. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed to transition. +## </summary> +## </param> +# +interface(`tboot_domtrans_txtstat',` + gen_require(` + type txtstat_t, txtstat_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, txtstat_exec_t, txtstat_t) +') + +######################################## +## <summary> +## Execute txt-stat in the txtstat domain, and +## allow the specified role the txtstat domain. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed to transition. +## </summary> +## </param> +## <param name="role"> +## <summary> +## The role to be allowed the txtstat domain. +## </summary> +## </param> +# +interface(`tboot_run_txtstat',` + gen_require(` + type txtstat_t; + attribute_role txtstat_roles; + ') + + tboot_domtrans_txtstat($1) + roleattribute $2 txtstat_roles; +') diff --git a/policy/modules/contrib/tboot.te b/policy/modules/contrib/tboot.te new file mode 100644 index 0000000..4961a36 --- /dev/null +++ b/policy/modules/contrib/tboot.te @@ -0,0 +1,24 @@ +policy_module(tboot, 1.0.0) + +######################################## +# +# Declarations +# + +attribute_role txtstat_roles; +roleattribute system_r txtstat_roles; + +type txtstat_t; +type txtstat_exec_t; +application_domain(txtstat_t, txtstat_exec_t) +role txtstat_roles types txtstat_t; + +######################################## +# +# Local policy +# + +dev_read_raw_memory(txtstat_t) + +domain_use_interactive_fds(txtstat_t) +userdom_use_user_terminals(txtstat_t)
