Skip to content

userdomain: Remove permissions from unprivileged user #1068

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dsugar100 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

userdomain: Remove permissions from unprivileged user #1068

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 2 additions & 3 deletions policy/modules/system/userdomain.if
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -991,10 +991,9 @@ template(`userdom_login_user_template', `
# User domain Local policy
#

allow $1_t self:capability { chown fowner setgid };
dontaudit $1_t self:capability { fsetid sys_nice };

allow $1_t self:process { dyntransition getattr getcap getpgid getrlimit getsched getsession noatsecure ptrace rlimitinh setcap setfscreate setkeycreate setpgid setsched setsockcreate share siginh signal_perms transition };
allow $1_t self:process { dyntransition getattr getcap getpgid getrlimit getsched getsession noatsecure rlimitinh setcap setfscreate setkeycreate setpgid setsched setsockcreate share siginh signal_perms transition };
dontaudit $1_t self:process setrlimit;
dontaudit $1_t self:netlink_route_socket { append bind connect create getattr getopt ioctl nlmsg_read nlmsg_write read setattr setopt shutdown write };

Expand Down Expand Up @@ -1370,7 +1369,7 @@ template(`userdom_admin_user_template',`

allow $1_t self:capability { chown dac_override dac_read_search fowner fsetid ipc_lock ipc_owner kill lease linux_immutable mknod net_admin net_bind_service net_broadcast net_raw setfcap setgid setpcap setuid sys_admin sys_boot sys_chroot sys_nice sys_pacct sys_ptrace sys_rawio sys_resource sys_time sys_tty_config };
allow $1_t self:cap_userns sys_ptrace;
allow $1_t self:process { setexec setfscreate };
allow $1_t self:process { ptrace setexec setfscreate };
allow $1_t self:netlink_audit_socket nlmsg_readpriv;
allow $1_t self:netlink_tcpdiag_socket create_netlink_socket_perms;
allow $1_t self:tun_socket create;
Expand Down
Loading