Policy for Mozilla and related web browsers

######################################## ##

## Role access for mozilla ##

## ##

## Role allowed access ##

## ## ##

## User domain for the role ##

## # interface(`mozilla_role',` gen_require(` type mozilla_t, mozilla_exec_t, mozilla_home_t; ') role $1 types mozilla_t; domain_auto_trans($2, mozilla_exec_t, mozilla_t) # Unrestricted inheritance from the caller. allow $2 mozilla_t:process { noatsecure siginh rlimitinh }; allow mozilla_t $2:fd use; allow mozilla_t $2:process { sigchld signull }; allow mozilla_t $2:unix_stream_socket connectto; # Allow the user domain to signal/ps. ps_process_pattern($2, mozilla_t) allow $2 mozilla_t:process signal_perms; allow $2 mozilla_t:fd use; allow $2 mozilla_t:shm { associate getattr }; allow $2 mozilla_t:shm { unix_read unix_write }; allow $2 mozilla_t:unix_stream_socket connectto; # X access, Home files manage_dirs_pattern($2, mozilla_home_t, mozilla_home_t) manage_files_pattern($2, mozilla_home_t, mozilla_home_t) manage_lnk_files_pattern($2, mozilla_home_t, mozilla_home_t) relabel_dirs_pattern($2, mozilla_home_t, mozilla_home_t) relabel_files_pattern($2, mozilla_home_t, mozilla_home_t) relabel_lnk_files_pattern($2, mozilla_home_t, mozilla_home_t) mozilla_run_plugin(mozilla_t, $1) mozilla_dbus_chat($2) userdom_manage_tmp_role($1, mozilla_t) optional_policy(` nsplugin_role($1, mozilla_t) ') optional_policy(` pulseaudio_role($1, mozilla_t) ') ') ######################################## ##

## Read mozilla home directory content ##

## ##

## Domain allowed access. ##

## # interface(`mozilla_read_user_home_files',` gen_require(` type mozilla_home_t; ') allow $1 mozilla_home_t:dir list_dir_perms; allow $1 mozilla_home_t:file read_file_perms; allow $1 mozilla_home_t:lnk_file read_lnk_file_perms; userdom_search_user_home_dirs($1) ') ######################################## ##

## Write mozilla home directory content ##

## ##

## Domain allowed access. ##

## # interface(`mozilla_write_user_home_files',` gen_require(` type mozilla_home_t; ') write_files_pattern($1, mozilla_home_t, mozilla_home_t) userdom_search_user_home_dirs($1) ') ######################################## ##

## Dontaudit attempts to read/write mozilla home directory content ##

## ##

## Domain allowed access. ##

## # interface(`mozilla_dontaudit_rw_user_home_files',` gen_require(` type mozilla_home_t; ') dontaudit $1 mozilla_home_t:file rw_inherited_file_perms; ') ######################################## ##

## Dontaudit attempts to write mozilla home directory content ##

## ##

## Domain allowed access. ##

## # interface(`mozilla_dontaudit_manage_user_home_files',` gen_require(` type mozilla_home_t; ') dontaudit $1 mozilla_home_t:dir manage_dir_perms; dontaudit $1 mozilla_home_t:file manage_file_perms; ') ######################################## ##

## Run mozilla in the mozilla domain. ##

## ##

## Domain allowed access. ##

## # interface(`mozilla_domtrans',` gen_require(` type mozilla_t, mozilla_exec_t; ') domtrans_pattern($1, mozilla_exec_t, mozilla_t) ') ######################################## ##

## Send and receive messages from ## mozilla over dbus. ##

## ##

## Domain allowed access. ##

## # interface(`mozilla_dbus_chat',` gen_require(` type mozilla_t; class dbus send_msg; ') allow $1 mozilla_t:dbus send_msg; allow mozilla_t $1:dbus send_msg; ') ######################################## ##

## Write mozilla home directory content ##

## ##

## Domain allowed access. ##

## # interface(`mozilla_execmod_user_home_files',` gen_require(` type mozilla_home_t; ') allow $1 mozilla_home_t:file execmod; ') ######################################## ##

## Execute mozilla_exec_t ## in the specified domain. ##

## ##

## Execute a mozilla_exec_t ## in the specified domain. ##

## No interprocess communication (signals, pipes, ## etc.) is provided by this interface since ## the domains are not owned by this module. ##

## ## ##

## Domain allowed access. ##

## ## ##

## The type of the new process. ##

## # interface(`mozilla_exec_domtrans',` gen_require(` type mozilla_exec_t; ') allow $2 mozilla_exec_t:file entrypoint; domtrans_pattern($1, mozilla_exec_t, $2) ') ####################################### ##

## Execute a domain transition to run mozilla_plugin. ##

## ##

## Domain allowed access. ##

## # interface(`mozilla_domtrans_plugin',` gen_require(` type mozilla_plugin_t, mozilla_plugin_exec_t; class dbus send_msg; ') domtrans_pattern($1, mozilla_plugin_exec_t, mozilla_plugin_t) allow mozilla_plugin_t $1:process signull; allow $1 mozilla_plugin_t:unix_stream_socket { connectto rw_socket_perms }; allow $1 mozilla_plugin_t:fd use; allow mozilla_plugin_t $1:unix_stream_socket rw_socket_perms; allow mozilla_plugin_t $1:shm { rw_shm_perms destroy }; allow mozilla_plugin_t $1:sem create_sem_perms; ps_process_pattern($1, mozilla_plugin_t) allow $1 mozilla_plugin_t:process { ptrace signal_perms }; ') ####################################### ##

## Execute mozilla_plugin in the mozilla_plugin domain, and ## allow the specified role the mozilla_plugin domain. ##

## ##

## Domain allowed access ##

## ## ##

## The role to be allowed the mozilla_plugin domain. ##

## # interface(`mozilla_run_plugin',` gen_require(` type mozilla_plugin_t; ') mozilla_domtrans_plugin($1) role $2 types mozilla_plugin_t; ') ###################################### ##

## Execute qemu unconfined programs in the role. ##

## ##

## The role to allow the mozilla_plugin domain. ##

## ## # interface(`mozilla_role_plugin',` gen_require(` type mozilla_plugin_t; ') role $1 types mozilla_plugin_t; ') ####################################### ##

## read/write mozilla per user tcp_socket ##

## ##

## Domain allowed access. ##

## # interface(`mozilla_rw_tcp_sockets',` gen_require(` type mozilla_t; ') allow $1 mozilla_t:tcp_socket rw_socket_perms; ') ###################################### ##

## Read mozilla_plugin tmpfs files ##

## ##

## Domain allowed access ##

## # interface(`mozilla_plugin_read_tmpfs_files',` gen_require(` type mozilla_plugin_tmpfs_t; ') allow $1 mozilla_plugin_tmpfs_t:file read_file_perms; ') ####################################### ##

## Delete mozilla_plugin tmpfs files ##

## ##

## Domain allowed access ##

## # interface(`mozilla_plugin_delete_tmpfs_files',` gen_require(` type mozilla_plugin_tmpfs_t; ') allow $1 mozilla_plugin_tmpfs_t:file delete_file_perms; ') ####################################### ##

## Dontaudit read/write to a mozilla_plugin leaks ##

## ##

## Domain to not audit. ##

## # interface(`mozilla_plugin_dontaudit_leaks',` gen_require(` type mozilla_plugin_t; ') dontaudit $1 mozilla_plugin_t:unix_stream_socket { read write }; ') ####################################### ##

## Execute mozilla home directory content. ##

## ##

## Domain allowed access. ##

## # interface(`mozilla_exec_user_home_files',` gen_require(` type mozilla_home_t; ') can_exec($1, mozilla_home_t) ')