diff --git a/domain.te b/domain.te index 4297badcbf16e5416dc4ece9e5b2e1ce290c62d5..2b7c0a676f3d626578ecd973a455b8e601f502cf 100644 --- a/domain.te +++ b/domain.te @@ -130,8 +130,17 @@ neverallow { domain -relabeltodomain } *:dir_file_class_set relabelto; ### neverallow rules ### -# Only init should be able to load SELinux policies and set enforcing mode. -neverallow { domain -init } kernel:security { load_policy setenforce }; +# Only init should be able to load SELinux policies. +# The first load technically occurs while still in the kernel domain, +# but this does not trigger a denial since there is no policy yet. +# Policy reload requires allowing this to the init domain. +neverallow { domain -init } kernel:security load_policy; + +# Only init prior to switching context should be able to set enforcing mode. +# init starts in kernel domain and switches to init domain via setcon in +# the init.rc, so the setenforce occurs while still in kernel. After +# switching domains, there is never any need to setenforce again by init. +neverallow { domain -kernel } kernel:security setenforce; # Only init, ueventd and system_server should be able to access HW RNG neverallow { domain -init -system_server -ueventd -unconfineddomain } hw_random_device:chr_file *; diff --git a/init.te b/init.te index b2d99fbcef58d0b6c0cba8fd19e71dadb239f88f..abe5e78a61451e94ac7b8262dd23edecaca06037 100644 --- a/init.te +++ b/init.te @@ -8,6 +8,6 @@ relabelto_domain(init) allow init unlabeled:filesystem mount; allow init {fs_type dev_type file_type}:dir_file_class_set relabelto; -allow init kernel:security { load_policy setenforce }; +allow init kernel:security load_policy; allow init usermodehelper:file rw_file_perms; allow init proc_security:file rw_file_perms; diff --git a/kernel.te b/kernel.te index d1c1b7f823ba3ef645fbeaea412dfe516a7eb52b..089786bff834cdd689e5f997c5fdbf451ef164bb 100644 --- a/kernel.te +++ b/kernel.te @@ -6,3 +6,6 @@ relabelto_domain(kernel) allow kernel {fs_type dev_type file_type}:dir_file_class_set relabelto; allow kernel unlabeled:filesystem mount; + +# Initial setenforce by init prior to switching to init domain. +allow kernel self:security setenforce;