Chapter 3. Targeted Policy Overview

41

The

can_unix_connect

macro handles the control between the two domains. In addition,

the socket needs write permission to the file associated with the socket. For this reason the

can_unix_connect

macro is paired with other

allow

rules in the policy:

# From $SELINUX_SRC/domains/program/syslogd.te

allow privlog devlog_t:sock_file rw_file_perms;

...

can_unix_connect(privlog, syslogd_t)

create_dir_file

Common permissions for creating directories, regular files, and symlinks are grouped into this

macro from

core_macros.te

:

define(`create_dir_file', `

allow $1 $2:dir create_dir_perms;

allow $1 $2:file create_file_perms;

allow $1 $2:lnk_file create_lnk_perms;

')

create_socket_perms

This is a single line macro from

core_macros.te

that expands into a list of permissions needed

to create and manage sockets. This macro is inserted directly into a rule, and gives a single

location to define this common permissions set. This is the macro followed by an example rule

evoking the macro:

define(`create_socket_perms', `{ create ioctl read getattr \

write setattr append bind connect getopt setopt shutdown }')

allow winbind_t self:unix_dgram_socket create_socket_perms;

domain_auto_trans

and

domain_trans

When you want a particular transition to be the default transition behavior for a domain,

use

domain_auto_trans

, from

core_macros.te

. It calls

domain_trans()

to do the

actual work. If you just want to allow a transition to take place and handle the context with

setexeccon()

, you can use just a

domain_trans()

:

# domain_auto_trans(parent_domain, program_type, child_domain)

define(`domain_auto_trans',`

domain_trans($1,$2,$3)

type_transition $1 $2:process $3;

')

The

domain_trans

macro allows the parent process a typical set of permissions to transition

to the new domain. It sets a few

dontaudit

rules, allows the parent process to execute the

program, allows the child to reap the new domain and exchange and use file descriptions with

the parent process, as well as write back to the old domain via a named pipe (FIFO). Finally, the

new domain is given permission to read and execute the program, making the program the entry

point for the domain.

Because only one transition can be the default for a given pair of types, you can have one

domain_auto_trans

rule followed by multiple

domain_trans

rules that allow other options.

These can be used by a security aware application.

file_type_auto_trans

and

file_type_trans

From

core_macros.te

,

file_type_trans

allows the permissions for the given domain to

create files in the given parent directory that have the given file type. These givens are in 

serted as the variables

$1

and so forth. To make a particular transition the default behavior,

use

file_type_auto_trans()

.

This macro has a built in conditional that it can take three or four parameters in defining the

output

type_transition

rule: