1. Create a folder for our policy and change directory to that location
-create a folder
-change directory to that location
mkdir ~/myapp; cd ~/myapp;
2. Declare your policy module
-specify name
-specify version
echo "policy_module(myapp,1.0.0)" > myapp.te;
3. Declare a type for the object that gets executed.(what gets executed)
echo "type myapp_exec_t;" >> myapp.te;
4. Specify the location of this object
echo "/usr/bin/myapp -- gen_context(system_u:object_r:myapp_exec_t,s0)" > myapp.fc;
5. Declare a domain(Who executes it?)
- application domain/init daemon domain (application domain/gets executed by user_t)
- declare a type for our domain (user_myapp_t)
- declare a role for our domain (user_r)
echo "type user_myapp_t;" >> myapp.te;
echo "application_domain(user_myapp_t,myapp_exec_t)" >> myapp.te;
echo "role user_r types user_myapp_t;" >> myapp.te;
6. Does this domain write or execute any other objects that it own?
- Objects in the user home dir? tmp, tmpfs, logfiles, pids, ports? interfaces, nodes, configuration files ???
- if true, declare a type for the object that gets executes or gets written(what gets executed or written?)
echo "type user_myapp_home_t;" >> myapp.te;
- specify the location of this object
echo "HOME_DIR/\.myapp(/.*)? gen_context(system_u:object_r:user_myapp_home_t,s0)" >> myapp.fc;
- Declare a domain object(who executes or writes it?) (user e.g. user_t)
echo "userdom_user_home_content(user,user_myapp_home_t)" >> myapp.te;
7. Write private policy
- users (user_t) transtions to user_myapp_t upon executing myapp_exec_t object
echo "domain_auto_trans(user_t,myapp_exec_t,user_myapp_t)" >> myapp.te;
- What can this domain do internally? (e.g. to self)
echo "allow user_myapp_t self:fifo_file rw_fifo_file_perms;" >> myapp.te;
echo "allow user_myapp_t self:process signal;" >> myapp.te;
- What can this applicaiton do to the user that it running it? ( e.g. to user_t)
echo "allow user_myapp_t user_t:process sigchld;" >> myapp.te;
- What can the user do to the application? (e.g. user_t to user_myapp_t)
echo "allow user_t user_myapp_t:process { ptrace signal_perms };" >> myapp.te;
8. Write policy for applications objects in user home dir
-What can the application do to what type of objects in user home dir (manage files)
echo "manage_files_pattern(user_myapp_t,user_myapp_home_t,user_myapp_home_t)" >> myapp.te;
echo "userdom_user_home_dir_filetrans(user,user_myapp_t,user_myapp_home_t,{ file })" >> myapp.te;
- What else does our application need to be able to manage its objects there? (it must be able to search user home dirs)
echo "userdom_search_user_home_dirs(user,user_myapp_t)" >> myapp.te;
9 How does our application interact with other domains?
- user can stat applicaton process
echo "ps_process_pattern(user_t,user_myapp_t)" >> myapp.te;
- application can read generic etc files
echo "files_read_etc_files(user_myapp_t)" >> myapp.te;
- application can read localization
echo "miscfiles_read_localization(user_myapp_t)" >> myapp.te;
- users can run application fro ma terminal
echo "userdom_use_user_terminals(user,user_myapp_t)" >> myapp.te;
10. Compile and install
- Compile policy (need selinux-policy-devel)
- install policy (need policycoreutils)
make -f /usr/share/selinux/devel/Makefile
/usr/sbin/semodule -i myapp.pp