@@ -180,6 +180,14 @@ ifeq ($(shell [ $(POL_VERS) -ge 34 -a $(MAX_KERNEL_POLICY) -ge 34 ] && echo true
TARGETS += test_ioctl_cond_xperms.te
endif
+ifeq ($(shell grep -q firmware_load $(POLDEV)/include/support/all_perms.spt && \
+ grep -q kexec_image_load $(POLDEV)/include/support/all_perms.spt && \
+ grep -q kexec_initramfs_load $(POLDEV)/include/support/all_perms.spt && \
+ grep -q policy_load $(POLDEV)/include/support/all_perms.spt && \
+ echo true),true)
+TARGETS += test_file_load.te
+endif
+
all: build
expand_check:
new file mode 100644
@@ -0,0 +1,102 @@
+###################### Test file loading ###################
+
+require {
+ type boot_t;
+ type kdump_exec_t;
+ type tmpfs_t;
+ type user_tmp_t;
+}
+
+###################### Allow sys kexec_image_load ######################
+type test_kexec_allow_kexec_image_load_t;
+testsuite_domain_type_minimal(test_kexec_allow_kexec_image_load_t);
+
+files_search_boot(test_kexec_allow_kexec_image_load_t);
+fs_rw_inherited_tmpfs_files(test_kexec_allow_kexec_image_load_t);
+exec_files_pattern(test_kexec_allow_kexec_image_load_t, kdump_exec_t, kdump_exec_t);
+domain_entry_file(test_kexec_allow_kexec_image_load_t, kdump_exec_t);
+allow test_kexec_allow_kexec_image_load_t self:capability sys_boot;
+
+allow test_kexec_allow_kexec_image_load_t boot_t:system kexec_image_load;
+allow test_kexec_allow_kexec_image_load_t tmpfs_t:system kexec_image_load;
+
+###################### Deny sys kexec_image_load ######################
+type test_kexec_deny_kexec_image_load_t;
+testsuite_domain_type_minimal(test_kexec_deny_kexec_image_load_t);
+
+files_search_boot(test_kexec_deny_kexec_image_load_t);
+fs_rw_inherited_tmpfs_files(test_kexec_deny_kexec_image_load_t);
+exec_files_pattern(test_kexec_deny_kexec_image_load_t, kdump_exec_t, kdump_exec_t);
+domain_entry_file(test_kexec_deny_kexec_image_load_t, kdump_exec_t);
+allow test_kexec_deny_kexec_image_load_t self:capability sys_boot;
+
+neverallow test_kexec_deny_kexec_image_load_t boot_t:system kexec_image_load;
+neverallow test_kexec_deny_kexec_image_load_t tmpfs_t:system kexec_image_load;
+
+###################### Allow sys kexec_initramfs_load ######################
+type test_kexec_allow_kexec_initramfs_load_t;
+testsuite_domain_type_minimal(test_kexec_allow_kexec_initramfs_load_t);
+
+files_search_boot(test_kexec_allow_kexec_initramfs_load_t);
+fs_rw_inherited_tmpfs_files(test_kexec_allow_kexec_initramfs_load_t);
+domain_entry_file(test_kexec_allow_kexec_initramfs_load_t, kdump_exec_t);
+allow test_kexec_allow_kexec_initramfs_load_t self:capability sys_boot;
+
+allow test_kexec_allow_kexec_initramfs_load_t boot_t:system { kexec_image_load kexec_initramfs_load } ;
+allow test_kexec_allow_kexec_initramfs_load_t tmpfs_t:system { kexec_image_load kexec_initramfs_load };
+
+###################### Deny sys kexec_initramfs_load ######################
+type test_kexec_deny_kexec_initramfs_load_t;
+testsuite_domain_type_minimal(test_kexec_deny_kexec_initramfs_load_t);
+
+files_search_boot(test_kexec_deny_kexec_initramfs_load_t);
+fs_rw_inherited_tmpfs_files(test_kexec_deny_kexec_initramfs_load_t);
+domain_entry_file(test_kexec_deny_kexec_initramfs_load_t, kdump_exec_t);
+allow test_kexec_deny_kexec_initramfs_load_t boot_t:system kexec_image_load;
+allow test_kexec_deny_kexec_initramfs_load_t tmpfs_t:system kexec_image_load;
+allow test_kexec_deny_kexec_initramfs_load_t self:capability sys_boot;
+
+neverallow test_kexec_deny_kexec_initramfs_load_t boot_t:system kexec_initramfs_load;
+neverallow test_kexec_deny_kexec_initramfs_load_t tmpfs_t:system kexec_initramfs_load;
+
+###################### Allow sys firmware_load ######################
+type test_kmodule_allow_firmware_load_t;
+testsuite_domain_type_minimal(test_kmodule_allow_firmware_load_t)
+typeattribute test_kmodule_allow_firmware_load_t kmoduledomain;
+
+type firmware_allow_file_t;
+files_type(firmware_allow_file_t);
+
+allow test_kmodule_allow_firmware_load_t self:capability sys_module;
+allow test_kmodule_allow_firmware_load_t test_file_t:system module_load;
+allow test_kmodule_allow_firmware_load_t self:system module_load;
+allow kernel_t firmware_allow_file_t:system firmware_load;
+
+###################### Deny sys firmware_load ######################
+type test_kmodule_deny_firmware_load_t;
+testsuite_domain_type_minimal(test_kmodule_deny_firmware_load_t)
+typeattribute test_kmodule_deny_firmware_load_t kmoduledomain;
+
+type firmware_deny_file_t;
+files_type(firmware_deny_file_t);
+
+allow test_kmodule_deny_firmware_load_t self:capability { sys_module };
+allow test_kmodule_deny_firmware_load_t test_file_t:system { module_load };
+allow test_kmodule_deny_firmware_load_t self:system { module_load };
+neverallow kernel_t firmware_deny_file_t:system firmware_load;
+
+###################### Allow sys policy_load ######################
+type test_policy_allow_policy_load_t;
+testsuite_domain_type_minimal(test_policy_allow_policy_load_t);
+
+userdom_read_inherited_user_tmp_files(test_policy_allow_policy_load_t);
+userdom_write_user_tmp_files(test_policy_allow_policy_load_t);
+allow test_policy_allow_policy_load_t user_tmp_t:system policy_load;
+
+###################### Deny sys policy_load ######################
+type test_policy_deny_policy_load_t;
+testsuite_domain_type_minimal(test_policy_deny_policy_load_t);
+
+userdom_read_inherited_user_tmp_files(test_policy_deny_policy_load_t);
+userdom_write_user_tmp_files(test_policy_deny_policy_load_t);
+neverallow test_policy_deny_policy_load_t user_tmp_t:system policy_load;
@@ -1,4 +1,4 @@
-obj-m = setest_module_load.o setest_module_request.o
+obj-m = setest_module_load.o setest_module_request.o setest_firmware_load.o
TARGETS = finit_load init_load
LDLIBS += -lselinux
new file mode 100644
@@ -0,0 +1,29 @@
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/firmware.h>
+
+static int __init setest_firmware_request_init(void)
+{
+ const struct firmware *fw;
+ int result;
+
+ pr_info("INIT - setest_firmware_request\n");
+ result = request_firmware(&fw, "dummy-firmware", NULL);
+ if (result) {
+ pr_err("request_firmware failed: %d\n", result);
+ return result;
+ }
+ pr_info("request_firmware succeeded\n");
+ release_firmware(fw);
+ return 0;
+}
+
+static void __exit setest_firmware_request_exit(void)
+{
+ pr_info("EXIT - setest_firmware_request\n");
+}
+
+module_init(setest_firmware_request_init);
+module_exit(setest_firmware_request_exit);
+MODULE_LICENSE("GPL");
\ No newline at end of file
@@ -16,7 +16,13 @@ BEGIN {
$v = " ";
}
- plan tests => 8;
+ $kexec_perm_file = "/sys/fs/selinux/class/system/perms/kexec_image_load";
+ $kexec_load_exists = 0;
+ if ( -f $kexec_perm_file ) {
+ $kexec_load_exists = 1;
+ }
+
+ plan tests => 17;
}
print "Test finit_module(2)\n";
@@ -59,4 +65,66 @@ $result = system
"runcon -t test_kmodule_deny_module_request_t $basedir/init_load $v $basedir setest_module_request 2>&1";
ok( $result >> 8 eq 13 );
+SKIP: {
+ skip(
+"Not all system permissions available; skipping kexec, initramfs, firmware and policy tests",
+ 9
+ ) unless $kexec_load_exists;
+
+ $kver = `uname -r`;
+ chomp($kver);
+ $kernel = "/boot/vmlinuz-$kver";
+ $initrd = "/boot/initramfs-$kver.img";
+
+ $result =
+ system "runcon -t test_kexec_allow_kexec_image_load_t kexec -l $kernel";
+ ok( $result eq 0 );
+
+ $result = system "runcon -t test_kexec_allow_kexec_image_load_t kexec -u";
+ ok( $result eq 0 );
+
+ # Deny system { kexec_image_load }
+ $result = system
+ "runcon -t test_kexec_deny_kexec_image_load_t kexec -l $kernel 2>&1";
+ ok( $result >> 8 eq 255 );
+
+ $result = system
+"runcon -t test_kexec_allow_kexec_initramfs_load_t kexec -l --initrd=$initrd $kernel";
+ ok( $result eq 0 );
+
+ # Deny system { kexec_initramfs_load }
+ $result = system
+"runcon -t test_kexec_deny_kexec_initramfs_load_t kexec -l --initrd=$initrd $kernel 2>&1";
+ ok( $result >> 8 eq 255 );
+
+ system("mkdir -p /usr/lib/firmware");
+ system("echo 'Test firmware' > /usr/lib/firmware/dummy-firmware");
+ system("chcon -t firmware_allow_file_t /usr/lib/firmware/dummy-firmware");
+
+ $result = system
+"runcon -t test_kmodule_allow_firmware_load_t $basedir/init_load $v $basedir setest_firmware_load";
+ ok( $result eq 0 );
+
+ system("chcon -t firmware_deny_file_t /usr/lib/firmware/dummy-firmware");
+
+ # Deny system { firmware_load } - EACCES
+ $result = system
+"runcon -t test_kmodule_deny_firmware_load_t $basedir/init_load $v $basedir setest_firmware_load 2>&1";
+ ok( $result >> 8 eq 13 );
+
+ system("rm -f /usr/lib/firmware/dummy-firmware");
+ system("echo 'measure func=BPRM_CHECK' > /tmp/test_ima_policy");
+
+ $result = system
+qq(runcon -t test_policy_allow_policy_load_t bash -c "echo '/tmp/test_ima_policy' > /sys/kernel/security/ima/policy");
+ ok( $result eq 0 );
+
+ # Deny system { policy_load } - EACCES
+ $result = system
+qq(runcon -t test_policy_deny_policy_load_t bash -c "echo '/tmp/test_ima_policy' > /sys/kernel/security/ima/policy 2>&1");
+ ok( $result >> 8 eq 1 );
+
+ system("rm -f /tmp/test_ima_policy");
+}
+
exit;