etc/guix-daemon.cil.in

   1 ; -*- lisp -*-
   2 ;;; GNU Guix --- Functional package management for GNU
   3 ;;; Copyright © 2018 Ricardo Wurmus <rekado@elephly.net>
   4 ;;; Copyright © 2020 Daniel Brooks <db48x@db48x.net>
   5 ;;; Copyright © 2020 Marius Bakke <marius@gnu.org>
   6 ;;;
   7 ;;; This file is part of GNU Guix.
   8 ;;;
   9 ;;; GNU Guix is free software; you can redistribute it and/or modify it
  10 ;;; under the terms of the GNU General Public License as published by
  11 ;;; the Free Software Foundation; either version 3 of the License, or (at
  12 ;;; your option) any later version.
  13 ;;;
  14 ;;; GNU Guix is distributed in the hope that it will be useful, but
  15 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
  16 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17 ;;; GNU General Public License for more details.
  18 ;;;
  19 ;;; You should have received a copy of the GNU General Public License
  20 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
  21
  22 ;; This is a specification for SELinux 2.7 written in the SELinux Common
  23 ;; Intermediate Language (CIL).  It refers to types that must be defined in
  24 ;; the system's base policy.
  25
  26 ;; If you, like me, need advice about fixing an SELinux policy, I recommend
  27 ;; reading https://danwalsh.livejournal.com/55324.html
  28
  29 ;; In particular, you can run semanage permissive -a guix_daemon.guix_daemon_t
  30 ;; to allow guix-daemon to do whatever it wants. SELinux will still check its
  31 ;; permissions, and when it doesn't have permission it will still send an
  32 ;; audit message to your system logs. This lets you know what permissions it
  33 ;; ought to have. Use ausearch --raw to find the permissions violations, then
  34 ;; pipe that to audit2allow to generate an updated policy. You'll still need
  35 ;; to translate that policy into CIL in order to update this file, but that's
  36 ;; fairly straight-forward. Annoying, but easy.
  37
  38 (block guix_daemon
  39   ;; Require existing types
  40   (typeattributeset cil_gen_require init_t)
  41   (typeattributeset cil_gen_require tmp_t)
  42   (typeattributeset cil_gen_require nscd_var_run_t)
  43   (typeattributeset cil_gen_require var_log_t)
  44   (typeattributeset cil_gen_require domain)
  45
  46   ;; Declare own types
  47   (type guix_daemon_t)
  48   (roletype object_r guix_daemon_t)
  49   (type guix_daemon_conf_t)
  50   (roletype object_r guix_daemon_conf_t)
  51   (typeattributeset file_type guix_daemon_conf_t)
  52   (type guix_daemon_exec_t)
  53   (roletype object_r guix_daemon_exec_t)
  54   (typeattributeset file_type guix_daemon_exec_t)
  55   (type guix_daemon_socket_t)
  56   (roletype object_r guix_daemon_socket_t)
  57   (typeattributeset file_type guix_daemon_socket_t)
  58   (type guix_store_content_t)
  59   (roletype object_r guix_store_content_t)
  60   (typeattributeset file_type guix_store_content_t)
  61   (type guix_profiles_t)
  62   (roletype object_r guix_profiles_t)
  63   (typeattributeset file_type guix_profiles_t)
  64
  65   ;; These types are domains, thereby allowing process rules
  66   (typeattributeset domain (guix_daemon_t guix_daemon_exec_t))
  67
  68   (level low (s0))
  69
  70   ;; When a process in init_t or guix_store_content_t spawns a
  71   ;; guix_daemon_exec_t process, let it run in the guix_daemon_t context
  72   (typetransition init_t guix_daemon_exec_t
  73                   process guix_daemon_t)
  74   (typetransition guix_store_content_t guix_daemon_exec_t
  75                   process guix_daemon_t)
  76
  77   (roletype system_r guix_daemon_t)
  78
  79   ;; allow init_t to read and execute guix files
  80   (allow init_t
  81          guix_profiles_t
  82          (lnk_file (read)))
  83   (allow init_t
  84          guix_daemon_exec_t
  85          (file (execute)))
  86   (allow init_t
  87          guix_daemon_t
  88          (process (transition)))
  89   (allow init_t
  90          guix_store_content_t
  91          (lnk_file (read)))
  92   (allow init_t
  93          guix_store_content_t
  94          (file (open read execute)))
  95
  96   ;; guix-daemon needs to know the names of users
  97   (allow guix_daemon_t
  98          passwd_file_t
  99          (file (getattr open read)))
 100
 101   ;; Permit communication with NSCD
 102   (allow guix_daemon_t
 103          nscd_var_run_t
 104          (file (map read)))
 105   (allow guix_daemon_t
 106          nscd_var_run_t
 107          (dir (search)))
 108   (allow guix_daemon_t
 109          nscd_var_run_t
 110          (sock_file (write)))
 111   (allow guix_daemon_t
 112          nscd_t
 113          (fd (use)))
 114   (allow guix_daemon_t
 115          nscd_t
 116          (unix_stream_socket (connectto)))
 117   (allow guix_daemon_t nscd_t
 118          (nscd (getgrp gethost getpwd getserv shmemgrp shmemhost shmempwd shmemserv)))
 119
 120   ;; permit downloading packages via HTTP(s)
 121   (allow guix_daemon_t http_port_t
 122          (tcp_socket (name_connect)))
 123   (allow guix_daemon_t ftp_port_t
 124          (tcp_socket (name_connect)))
 125   (allow guix_daemon_t ephemeral_port_t
 126          (tcp_socket (name_connect)))
 127
 128   ;; Permit logging and temp file access
 129   (allow guix_daemon_t
 130          tmp_t
 131          (lnk_file (create rename setattr unlink)))
 132   (allow guix_daemon_t
 133          tmp_t
 134          (file (link
 135                 rename create execute execute_no_trans write
 136                 unlink setattr map relabelto relabelfrom)))
 137   (allow guix_daemon_t
 138          tmp_t
 139          (fifo_file (open read write create getattr ioctl setattr unlink)))
 140   (allow guix_daemon_t
 141          tmp_t
 142          (dir (create rename
 143                rmdir relabelto relabelfrom reparent
 144                add_name remove_name
 145                open read write
 146                getattr setattr
 147                search)))
 148   (allow guix_daemon_t
 149          tmp_t
 150          (sock_file (create getattr setattr unlink write)))
 151   (allow guix_daemon_t
 152          var_log_t
 153          (file (create getattr open write)))
 154   (allow guix_daemon_t
 155          var_log_t
 156          (dir (getattr create write add_name)))
 157   (allow guix_daemon_t
 158          var_run_t
 159          (lnk_file (read)))
 160   (allow guix_daemon_t
 161          var_run_t
 162          (dir (search)))
 163
 164   ;; Spawning processes, execute helpers
 165   (allow guix_daemon_t
 166          self
 167          (process (fork execmem setrlimit setpgid setsched)))
 168   (allow guix_daemon_t
 169          guix_daemon_exec_t
 170          (file (execute execute_no_trans read open entrypoint map)))
 171
 172   ;; TODO: unknown
 173   (allow guix_daemon_t
 174          root_t
 175          (dir (mounton)))
 176   (allow guix_daemon_t
 177          fs_t
 178          (filesystem (getattr)))
 179   (allow guix_daemon_conf_t
 180          fs_t
 181          (filesystem (associate)))
 182
 183   ;; Build isolation
 184   (allow guix_daemon_t
 185          guix_store_content_t
 186          (file (ioctl mounton)))
 187   (allow guix_store_content_t
 188          fs_t
 189          (filesystem (associate)))
 190   (allow guix_daemon_t
 191          guix_store_content_t
 192          (dir (read mounton)))
 193   (allow guix_daemon_t
 194          guix_daemon_t
 195          (capability (net_admin
 196                       fsetid fowner
 197                       chown setuid setgid
 198                       dac_override dac_read_search
 199                       sys_chroot
 200                       sys_admin)))
 201   (allow guix_daemon_t
 202          fs_t
 203          (filesystem (unmount)))
 204   (allow guix_daemon_t
 205          devpts_t
 206          (dir (search)))
 207   (allow guix_daemon_t
 208          devpts_t
 209          (filesystem (mount)))
 210   (allow guix_daemon_t
 211          devpts_t
 212          (chr_file (ioctl open read write setattr getattr)))
 213   (allow guix_daemon_t
 214          tmpfs_t
 215          (filesystem (getattr mount)))
 216   (allow guix_daemon_t
 217          tmpfs_t
 218          (file (create open read unlink write)))
 219   (allow guix_daemon_t
 220          tmpfs_t
 221          (dir (getattr add_name remove_name write)))
 222   (allow guix_daemon_t
 223          proc_t
 224          (file (getattr open read)))
 225   (allow guix_daemon_t
 226          proc_t
 227          (dir (read)))
 228   (allow guix_daemon_t
 229          proc_t
 230          (filesystem (associate mount)))
 231   (allow guix_daemon_t
 232          null_device_t
 233          (chr_file (getattr open read write)))
 234   (allow guix_daemon_t
 235          kvm_device_t
 236          (chr_file (getattr)))
 237   (allow guix_daemon_t
 238          zero_device_t
 239          (chr_file (getattr)))
 240   (allow guix_daemon_t
 241          urandom_device_t
 242          (chr_file (getattr)))
 243   (allow guix_daemon_t
 244          random_device_t
 245          (chr_file (getattr)))
 246   (allow guix_daemon_t
 247          devtty_t
 248          (chr_file (getattr)))
 249
 250   ;; Access to store items
 251   (allow guix_daemon_t
 252          guix_store_content_t
 253          (dir (reparent
 254                create
 255                getattr setattr
 256                search rename
 257                add_name remove_name
 258                open write
 259                rmdir relabelfrom)))
 260   (allow guix_daemon_t
 261          guix_store_content_t
 262          (file (create
 263                 lock
 264                 setattr getattr
 265                 execute execute_no_trans
 266                 link unlink
 267                 map
 268                 rename
 269                 append
 270                 open read write relabelfrom)))
 271   (allow guix_daemon_t
 272          guix_store_content_t
 273          (lnk_file (create
 274                     getattr setattr
 275                     link unlink
 276                     read
 277                     rename)))
 278   (allow guix_daemon_t
 279          guix_store_content_t
 280          (fifo_file (create getattr open read unlink write)))
 281   (allow guix_daemon_t
 282          guix_store_content_t
 283          (sock_file (create getattr setattr unlink write)))
 284
 285   ;; Access to configuration files and directories
 286   (allow guix_daemon_t
 287          guix_daemon_conf_t
 288          (dir (search create
 289                setattr getattr
 290                add_name remove_name
 291                open read write)))
 292   (allow guix_daemon_t
 293          guix_daemon_conf_t
 294          (file (create rename
 295                 lock
 296                 map
 297                 getattr setattr
 298                 unlink
 299                 open read write)))
 300   (allow guix_daemon_t
 301          guix_daemon_conf_t
 302          (lnk_file (create getattr rename unlink)))
 303   (allow guix_daemon_t net_conf_t
 304          (file (getattr open read)))
 305   (allow guix_daemon_t net_conf_t
 306          (lnk_file (read)))
 307   (allow guix_daemon_t NetworkManager_var_run_t
 308          (dir (search)))
 309
 310   ;; Access to profiles
 311   (allow guix_daemon_t
 312          guix_profiles_t
 313          (dir (search getattr setattr read write open create add_name)))
 314   (allow guix_daemon_t
 315          guix_profiles_t
 316          (lnk_file (read getattr)))
 317
 318   ;; Access to profile links in the home directory
 319   ;; TODO: allow access to profile links *anywhere* on the filesystem
 320   (allow guix_daemon_t
 321          user_home_t
 322          (lnk_file (read getattr)))
 323   (allow guix_daemon_t
 324          user_home_t
 325          (dir (search)))
 326   (allow guix_daemon_t
 327          cache_home_t
 328          (dir (search)))
 329
 330   ;; self upgrades
 331   (allow guix_daemon_t
 332          self
 333          (dir (add_name write)))
 334   (allow guix_daemon_t
 335          self
 336          (netlink_route_socket (bind create getattr nlmsg_read read write getopt)))
 337
 338   ;; Socket operations
 339   (allow guix_daemon_t
 340          guix_daemon_socket_t
 341          (sock_file (unlink)))
 342   (allow guix_daemon_t
 343          init_t
 344          (fd (use)))
 345   (allow guix_daemon_t
 346          init_t
 347          (unix_stream_socket (write)))
 348   (allow guix_daemon_t
 349          guix_daemon_conf_t
 350          (unix_stream_socket (listen)))
 351   (allow guix_daemon_t
 352          guix_daemon_conf_t
 353          (sock_file (create unlink)))
 354   (allow guix_daemon_t
 355          self
 356          (unix_stream_socket (create
 357                               read write
 358                               connect bind accept
 359                               getopt setopt)))
 360   (allow guix_daemon_t
 361          self
 362          (tcp_socket (accept listen bind connect create setopt getopt getattr ioctl read write shutdown)))
 363   (allow guix_daemon_t
 364          unreserved_port_t
 365          (tcp_socket (name_bind name_connect accept listen)))
 366   (allow guix_daemon_t
 367          self
 368          (udp_socket (connect getattr bind getopt setopt read write)))
 369   (allow guix_daemon_t
 370          self
 371          (fifo_file (write read)))
 372   (allow guix_daemon_t
 373          self
 374          (udp_socket (ioctl create)))
 375   (allow guix_daemon_t
 376          self
 377          (unix_stream_socket (connectto)))
 378   (allow guix_daemon_t
 379          self
 380          (unix_dgram_socket (create bind connect sendto read write)))
 381
 382   ;; For some esoteric build jobs (i.e. running PostgreSQL, etc).
 383   (allow guix_daemon_t
 384          self
 385          (capability (kill)))
 386   (allow guix_daemon_t
 387          node_t
 388          (tcp_socket (node_bind)))
 389   (allow guix_daemon_t
 390          node_t
 391          (udp_socket (node_bind)))
 392   (allow guix_daemon_t
 393          port_t
 394          (tcp_socket (name_connect)))
 395   (allow guix_daemon_t
 396          tmpfs_t
 397          (file (map read write link getattr)))
 398   (allow guix_daemon_t
 399          usermodehelper_t
 400          (file (read)))
 401   (allow guix_daemon_t
 402          hugetlbfs_t
 403          (file (map read write)))
 404   (allow guix_daemon_t
 405          proc_net_t
 406          (file (read)))
 407   (allow guix_daemon_t
 408          postgresql_port_t
 409          (tcp_socket (name_connect name_bind)))
 410   (allow guix_daemon_t
 411          rtp_media_port_t
 412          (udp_socket (name_bind)))
 413   (allow guix_daemon_t
 414          vnc_port_t
 415          (tcp_socket (name_bind)))
 416
 417   ;; I guess sometimes it needs random numbers
 418   (allow guix_daemon_t
 419          random_device_t
 420          (chr_file (read)))
 421
 422   ;; guix system vm
 423   (allow guix_daemon_t
 424          kvm_device_t
 425          (chr_file (ioctl open read write)))
 426   (allow guix_daemon_t
 427          kernel_t
 428          (system (ipc_info)))
 429
 430   ;; Label file system
 431   (filecon "@guix_sysconfdir@/guix(/.*)?"
 432            any (system_u object_r guix_daemon_conf_t (low low)))
 433   (filecon "@guix_localstatedir@/guix(/.*)?"
 434            any (system_u object_r guix_daemon_conf_t (low low)))
 435   (filecon "@guix_localstatedir@/guix/profiles(/.*)?"
 436            any (system_u object_r guix_profiles_t (low low)))
 437   (filecon "/gnu"
 438            dir (unconfined_u object_r guix_store_content_t (low low)))
 439   (filecon "@storedir@(/.+)?"
 440            any (unconfined_u object_r guix_store_content_t (low low)))
 441   (filecon "@storedir@/[^/]+/.+"
 442            any (unconfined_u object_r guix_store_content_t (low low)))
 443   (filecon "@prefix@/bin/guix-daemon"
 444            file (system_u object_r guix_daemon_exec_t (low low)))
 445   (filecon "@storedir@/.+-(guix-.+|profile)/bin/guix-daemon"
 446            file (system_u object_r guix_daemon_exec_t (low low)))
 447   (filecon "@storedir@/[a-z0-9]+-guix-daemon"
 448            file (system_u object_r guix_daemon_exec_t (low low)))
 449   (filecon "@guix_localstatedir@/guix/daemon-socket/socket"
 450            any (system_u object_r guix_daemon_socket_t (low low))))