Chapter 3. Targeted Policy Overview
41
The
can_unix_connect
macro handles the control between the two domains. In addition,
the socket needs write permission to the file associated with the socket. For this reason the
can_unix_connect
macro is paired with other
allow
rules in the policy:
# From $SELINUX_SRC/domains/program/syslogd.te
allow privlog devlog_t:sock_file rw_file_perms;
...
can_unix_connect(privlog, syslogd_t)
create_dir_file
Common permissions for creating directories, regular files, and symlinks are grouped into this
macro from
core_macros.te
:
define(`create_dir_file', `
allow $1 $2:dir create_dir_perms;
allow $1 $2:file create_file_perms;
allow $1 $2:lnk_file create_lnk_perms;
')
create_socket_perms
This is a single line macro from
core_macros.te
that expands into a list of permissions needed
to create and manage sockets. This macro is inserted directly into a rule, and gives a single
location to define this common permissions set. This is the macro followed by an example rule
evoking the macro:
define(`create_socket_perms', `{ create ioctl read getattr \
write setattr append bind connect getopt setopt shutdown }')
allow winbind_t self:unix_dgram_socket create_socket_perms;
domain_auto_trans
and
domain_trans
When you want a particular transition to be the default transition behavior for a domain,
use
domain_auto_trans
, from
core_macros.te
. It calls
domain_trans()
to do the
actual work. If you just want to allow a transition to take place and handle the context with
setexeccon()
, you can use just a
domain_trans()
:
# domain_auto_trans(parent_domain, program_type, child_domain)
define(`domain_auto_trans',`
domain_trans($1,$2,$3)
type_transition $1 $2:process $3;
')
The
domain_trans
macro allows the parent process a typical set of permissions to transition
to the new domain. It sets a few
dontaudit
rules, allows the parent process to execute the
program, allows the child to reap the new domain and exchange and use file descriptions with
the parent process, as well as write back to the old domain via a named pipe (FIFO). Finally, the
new domain is given permission to read and execute the program, making the program the entry
point for the domain.
Because only one transition can be the default for a given pair of types, you can have one
domain_auto_trans
rule followed by multiple
domain_trans
rules that allow other options.
These can be used by a security aware application.
file_type_auto_trans
and
file_type_trans
From
core_macros.te
,
file_type_trans
allows the permissions for the given domain to
create files in the given parent directory that have the given file type. These givens are in 
serted as the variables
$1
and so forth. To make a particular transition the default behavior,
use
file_type_auto_trans()
.
This macro has a built in conditional that it can take three or four parameters in defining the
output
type_transition
rule:






footer




 

 

 

 

 Home | About Us | Network | Services | Support | FAQ | Control Panel | Order Online | Sitemap | Contact

adult web hosting

 

Our partners: PHP: Hypertext Preprocessor Best Web Hosting Java Web Hosting Inexpensive Web Hosting  Jsp Web Hosting

Cheapest Web Hosting Jsp Hosting Cheap Hosting

Visionwebhosting.net Business web hosting division of Web Design Plus. All rights reserved