Skip to content

Commit 7c74672

Browse files
RoyalOughtnesssecureblue-bot
RoyalOughtness
authored and
secureblue-bot
committed
feat: copy existing conf from secureblue repo (#18)
1 parent 1bb6739 commit 7c74672

23 files changed

+956
-25
lines changed

‎README.md‎

Lines changed: 2 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,3 @@
1-
# Fedora SELinux policy
1+
# selinux-policy
22

3-
This is SELinux policy based on [refpolicy](https://github.com/SELinuxProject/refpolicy) used in Fedora, Red Hat Enterprise Linux and CentOS Stream.
4-
5-
## Installation
6-
7-
The installation process is described in [INSTALL](INSTALL).
8-
9-
The default policy is installed to `/etc/selinux/fedora-selinux` and `/var/lib/selinux/fedora-selinux`.
10-
11-
The name and other options can be changed using variables like `NAME`, `TYPE`, ... variables, for more details see [README.build](README.build).
12-
E.g. Fedora `targeted` policy uses the following options:
13-
14-
DISTRO=redhat UBAC=n DIRECT_INITRC=n MONOLITHIC=n MLS_CATS=1024 MCS_CATS=1024 UNK_PERMS=allow NAME=targeted TYPE=mcs
15-
16-
## Contributing
17-
18-
There are several ways how to contribute:
19-
20-
### Report bugs
21-
22-
Either open issue in this project or file a bug in [Fedora Bugzilla](https://bugzilla.redhat.com)
23-
24-
### Pull requests
25-
26-
You can fork this repo and open a PR. Please use good practices and use descriptive commit messages.
3+
This is secureblue's SELinux policy based on [Fedora's policy](https://github.com/fedora-selinux/selinux-policy).

‎cil/grant_fm_userns.cil‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
(typeattribute file_manager_type)
2+
(typeattributeset file_manager_type (nautilus_t thunar_t))
3+
4+
(typeattribute file_manager_exec_type)
5+
(typeattributeset file_manager_exec_type (nautilus_exec_t thunar_exec_t))
6+
7+
(allow file_manager_type self (user_namespace (create)))

‎cil/grant_systemd_flatpak_exec.cil‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
;; SPDX-FileCopyrightText 2025 The Secureblue Authors
2+
;;
3+
;; SPDX-License-Identifier: Apache-2.0 OR MIT
4+
5+
(allow init_t flatpak_exec_t (file (execute execute_no_trans open read map)))

‎cil/grant_userns.cil‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
;; SPDX-FileCopyrightText 2025 The Secureblue Authors
2+
;;
3+
;; SPDX-License-Identifier: Apache-2.0 OR MIT
4+
5+
(allow colord_t self (user_namespace (create)))
6+
(allow devicekit_power_t self (user_namespace (create)))

‎cil/harden_container_userns.cil‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
;; SPDX-FileCopyrightText 2025 The Secureblue Authors
2+
;;
3+
;; SPDX-License-Identifier: Apache-2.0 OR MIT
4+
5+
(deny container_domain self (user_namespace (create)))
6+
(deny container_runtime_domain self (user_namespace (create)))

‎cil/harden_userns.cil‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
;; SPDX-FileCopyrightText 2025 The Secureblue Authors
2+
;;
3+
;; SPDX-License-Identifier: Apache-2.0 OR MIT
4+
5+
(deny userdomain self (user_namespace (create)))
6+
(deny unconfined_service_t self (user_namespace (create)))

‎cil/userns_deny_unconfined_relabels.cil‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
;; SPDX-FileCopyrightText 2025 The Secureblue Authors
2+
;;
3+
;; SPDX-License-Identifier: Apache-2.0 OR MIT
4+
5+
(typeattribute userns_privileged_file_type)
6+
(typeattributeset userns_privileged_file_type (colord_exec_t container_runtime_exec_t devicekit_power_exec_t docker_exec_t file_manager_exec_type flatpak_exec_t kubelet_exec_t systemsettings_exec_t trivalent_exec_t trivalent_script_exec_t))
7+
8+
(typeattribute userns_relabel_allowed)
9+
(typeattributeset userns_relabel_allowed (init_t initrc_t install_t kernel_t))
10+
11+
(typeattribute userns_relabel_restricted)
12+
(typeattributeset userns_relabel_restricted (and (domain) (not (userns_relabel_allowed))))
13+
14+
(deny userns_relabel_restricted userns_privileged_file_type (blk_file (relabelfrom relabelto)))
15+
(deny userns_relabel_restricted userns_privileged_file_type (chr_file (relabelfrom relabelto)))
16+
(deny userns_relabel_restricted userns_privileged_file_type (dir (relabelfrom relabelto)))
17+
(deny userns_relabel_restricted userns_privileged_file_type (fifo_file (relabelfrom relabelto)))
18+
(deny userns_relabel_restricted userns_privileged_file_type (file (relabelfrom relabelto)))
19+
(deny userns_relabel_restricted userns_privileged_file_type (lnk_file (relabelfrom relabelto)))

‎dist/targeted/modules.conf‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3060,3 +3060,44 @@ ktls = module
30603060
#
30613061
#
30623062
switcheroo = module
3063+
3064+
# Layer: contrib
3065+
# Module: trivalent
3066+
#
3067+
# Policy for trivalent: A security-focused Chromium-based browser
3068+
#
3069+
#
3070+
trivalent = module
3071+
3072+
# Layer: contrib
3073+
# Module: thunar
3074+
#
3075+
# Policy for thunar: A file manager for XFCE
3076+
#
3077+
#
3078+
thunar = module
3079+
3080+
# Layer: contrib
3081+
# Module: nautilus
3082+
#
3083+
# Policy for nautilus: A file manager for GNOME
3084+
#
3085+
#
3086+
nautilus = module
3087+
3088+
# Layer: contrib
3089+
# Module: systemsettings
3090+
#
3091+
# Policy for systemsettings: KDE system settings application
3092+
#
3093+
#
3094+
systemsettings = module
3095+
3096+
3097+
# Layer: contrib
3098+
# Module: flatpakfull
3099+
#
3100+
# Policy for flatpakfull: Application sandboxing and distribution
3101+
#
3102+
#
3103+
flatpakfull = module

‎policy/modules/contrib/flatpakfull.fc‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
# SPDX-FileCopyrightText 2025 The Secureblue Authors
2+
#
3+
# SPDX-License-Identifier: Apache-2.0 OR MIT
4+
5+
/usr/bin/flatpak -- gen_context(system_u:object_r:flatpak_exec_t,s0)
6+
/usr/bin/flatpak-bisect -- gen_context(system_u:object_r:flatpak_exec_t,s0)
7+
/usr/bin/flatpak-coredumpctl -- gen_context(system_u:object_r:flatpak_exec_t,s0)
8+
/usr/libexec/flatpak-oci-authenticator -- gen_context(system_u:object_r:flatpak_exec_t,s0)
9+
/usr/libexec/flatpak-portal -- gen_context(system_u:object_r:flatpak_exec_t,s0)
10+
/usr/libexec/flatpak-session-helper -- gen_context(system_u:object_r:flatpak_exec_t,s0)
11+
/usr/libexec/flatpak-validate-icon -- gen_context(system_u:object_r:flatpak_exec_t,s0)
12+
/usr/libexec/revokefs-fuse -- gen_context(system_u:object_r:flatpak_exec_t,s0)

‎policy/modules/contrib/flatpakfull.if‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
## <summary>flatpak packaging system</summary>
2+
3+
# SPDX-FileCopyrightText 2025 The Secureblue Authors
4+
#
5+
# SPDX-License-Identifier: Apache-2.0 OR MIT
6+
7+
########################################
8+
## <summary>
9+
## Execute flatpak in the flatpak domain.
10+
## </summary>
11+
## <param name="domain">
12+
## <summary>
13+
## Domain allowed to transition.
14+
## </summary>
15+
## </param>
16+
#
17+
interface(`flatpak_domtrans',`
18+
gen_require(`
19+
type flatpak_t, flatpak_exec_t;
20+
')
21+
22+
domtrans_pattern($1, flatpak_exec_t, flatpak_t)
23+
')
24+
25+
26+
########################################
27+
## <summary>
28+
## Execute flatpak in the flatpak domain.
29+
## </summary>
30+
## <param name="domain">
31+
## <summary>
32+
## Domain allowed to transition.
33+
## </summary>
34+
## </param>
35+
## <param name="role">
36+
## <summary>
37+
## Role allowed access.
38+
## </summary>
39+
## </param>
40+
#
41+
interface(`flatpak_run',`
42+
gen_require(`
43+
type flatpak_t;
44+
attribute_role flatpak_roles;
45+
')
46+
47+
flatpak_domtrans($1)
48+
roleattribute $2 flatpak_roles;
49+
')

0 commit comments

Comments
 (0)