PERFORCE change 113422 for review

[Todd Miller]

http://perforce.freebsd.org/chv.cgi?CH=113422

Change 113422 by millert at millert_macbook on 2007/01/22 20:15:11

	More rules for unconfined_t.

Affected files ...

.. //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/refpolicy/policy/modules/system/darwin.te#8 edit

Differences ...

==== //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/refpolicy/policy/modules/system/darwin.te#8 (text+ko) ====

@@ -25,6 +25,7 @@
 fs_associate(darwin_keychain_t)
 fs_associate(darwin_global_pref_t)
 fs_associate(darwin_private_t)
+fs_associate(darwin_host_pref_t)
 
 define(`enable_unconfined', `true')
 ifdef(`enable_unconfined',`
@@ -34,15 +35,51 @@
 	mach_allow_message(unconfined_t, init_t)
 	mach_allow_message(unconfined_t, securityd_t)
 
-	allow unconfined_t init_t:mi_bootstrap { bootstrap_look_up bootstrap_subset };
-	allow unconfined_t init_t:mi_notify_ipc { notify_server_register_check notify_server_get_state notify_server_register_plain };
-	allow unconfined_t { darwin_system_t framework_t darwin_private_t darwin_CoreServices_t darwin_global_pref_t darwin_system_t darwin_host_pref_t var_vm_t }:dir { search getattr };
-	allow unconfined_t { darwin_CoreServices_t darwin_global_pref_t darwin_host_pref_t }:file read;
-	allow unconfined_t framework_t:{file dir lnk_file} read;
-	allow unconfined_t framework_t:file getattr;
+	allow unconfined_t init_t:mi_bootstrap { bootstrap_look_up bootstrap_subset bootstrap_register bootstrap_parent bootstrap_create_service bootstrap_create_server };
+	allow unconfined_t init_t:mi_notify_ipc { notify_server_register_check notify_server_get_state notify_server_register_plain notify_server_monitor_file notify_server_register_mach_port notify_server_post notify_server_monitor_file notify_server_cancel };
+	allow unconfined_t { darwin_host_pref_t var_vm_t }:dir { search getattr };
+	allow unconfined_t { darwin_host_pref_t }:file read;
+	allow unconfined_t framework_t:{file lnk_file} { read getattr };
+	allow unconfined_t framework_t:dir { read getattr search };
+	allow unconfined_t framework_t:file { getattr execute_no_trans execute };
+	allow unconfined_t darwin_keychain_t:file { getattr read };
+	allow unconfined_t darwin_keychain_t:dir search;
+
+	allow unconfined_t darwin_private_t:dir { search getattr read };
+
+	allow unconfined_t darwin_system_t:file { execute getattr read execute_no_trans };
+	allow unconfined_t darwin_system_t:lnk_file { read getattr };
+	allow unconfined_t darwin_system_t:dir { read search getattr };
+
+	allow unconfined_t darwin_cache_t:file { read write lock getattr create };
+	allow unconfined_t darwin_cache_t:dir { search getattr add_name };
+
+	allow unconfined_t darwin_global_pref_t:file { create write setattr rename unlink read };
+	allow unconfined_t darwin_global_pref_t:dir { add_name remove_name search getattr };
+
+	allow unconfined_t darwin_CoreServices_t:file { read getattr execute_no_trans };
+	allow unconfined_t darwin_CoreServices_t:dir { read search getattr };
+
+	allow unconfined_t darwin_security_t:dir { search getattr read };
+
+	allow unconfined_t configd_resource_t:file read;
+	allow unconfined_t configd_resource_t:dir { read search };
+
+	allow unconfined_t automount_t:dir search;
+
+	allow unconfined_t WindowServer_resource_t:file read;
+	allow unconfined_t WindowServer_resource_t:dir { read search };
+
+	allow unconfined_t init_t:mi_bootstrap { bootstrap_register bootstrap_parent bootstrap_create_service bootstrap_create_server };
+
+	allow unconfined_t darwin_resource_t:dir {search getattr };
+	allow unconfined_t darwin_resource_t:file { read getattr };
+
+	allow unconfined_t bsdpty_device_t:file ioctl;
 
 	# Allow communication with unconfined
 	mach_allow_ipc(configd_t, unconfined_t)
+	mach_allow_ipc(coreaudiod_t, unconfined_t)
 	mach_allow_ipc(coreservicesd_t, unconfined_t)
 	mach_allow_ipc(diskarbitrationd_t, unconfined_t)
 	mach_allow_ipc(init_t, unconfined_t)
@@ -51,4 +88,8 @@
 	mach_allow_ipc(memberd_t, unconfined_t)
 	mach_allow_ipc(notifyd_t, unconfined_t)
 	mach_allow_ipc(securityd_t, unconfined_t)
+	mach_allow_ipc(mDNSResponder_t, unconfined_t)
+
+	allow coreservicesd_t unconfined_t:process taskforpid;
+	allow loginwindow_t unconfined_t:process getsched;
 ')