diff mbox series

[02/12] package/busybox/selinux: Add buildroot busybox policy

Message ID 20231012103210.2915871-3-adam.duskett@amarulasolutions.com
State New
Headers show
Series SELinux: Basic config enforcing mode support. | expand

Commit Message

Adam Duskett Oct. 12, 2023, 10:31 a.m. UTC 
This is a minimal selinux policy required to run busybox in enforcing mode
without denials. It is based off of the applets that Buildroot selects by
default.

Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
---
 DEVELOPERS                                   |  1 +
 package/busybox/selinux/buildroot-busybox.fc |  1 +
 package/busybox/selinux/buildroot-busybox.if |  1 +
 package/busybox/selinux/buildroot-busybox.te | 16 ++++++++++++++++
 4 files changed, 19 insertions(+)
 create mode 100644 package/busybox/selinux/buildroot-busybox.fc
 create mode 100644 package/busybox/selinux/buildroot-busybox.if
 create mode 100644 package/busybox/selinux/buildroot-busybox.te
diff mbox series

Patch

diff --git a/DEVELOPERS b/DEVELOPERS
index e863d06535..c206f5262f 100644
--- a/DEVELOPERS
+++ b/DEVELOPERS
@@ -32,6 +32,7 @@  F:	package/vulkan-loader/
 F:	package/vulkan-tools/
 
 N:	Adam Duskett <adam.duskett@amarulasolutions.com>
+F:	package/busybox/selinux/
 F:	package/depot-tools/
 F:	package/flutter-engine/
 F:	package/flutter-gallery/
diff --git a/package/busybox/selinux/buildroot-busybox.fc b/package/busybox/selinux/buildroot-busybox.fc
new file mode 100644
index 0000000000..6785e466f3
--- /dev/null
+++ b/package/busybox/selinux/buildroot-busybox.fc
@@ -0,0 +1 @@ 
+/lib/libbusybox*	--	gen_context(system_u:object_r:lib_t,s0)
diff --git a/package/busybox/selinux/buildroot-busybox.if b/package/busybox/selinux/buildroot-busybox.if
new file mode 100644
index 0000000000..60ea4b190d
--- /dev/null
+++ b/package/busybox/selinux/buildroot-busybox.if
@@ -0,0 +1 @@ 
+## <summary>Buildroot busybox rules</summary>
diff --git a/package/busybox/selinux/buildroot-busybox.te b/package/busybox/selinux/buildroot-busybox.te
new file mode 100644
index 0000000000..e7d0f510b9
--- /dev/null
+++ b/package/busybox/selinux/buildroot-busybox.te
@@ -0,0 +1,16 @@ 
+policy_module(buildroot-busybox, 1.0.0)
+
+#============= init_tmpfs_t ==============
+allow init_tmpfs_t self:file { lock open read write };
+
+#============= getty_t ==============
+allow getty_t local_login_t:file { lock open read write };
+allow getty_t local_login_t:process { noatsecure rlimitinh siginh };
+allow getty_t security_t:filesystem getattr;
+allow getty_t selinux_config_t:dir search;
+
+#============= local_login_t ==============
+allow local_login_t device_t:chr_file { getattr setattr };
+allow local_login_t shadow_t:file { getattr open read };
+allow local_login_t sysadm_t:process { noatsecure siginh rlimitinh };
+