SELinux: add basic policy.

This patch removes the chromium_zygote_t type and adds a
chromium_renderer_t type. Also, a basic policy for chromium_renderer_t
is included.

I decided not to try to have a different policy for the zygote since
it just makes things more complex for little reason.

BUG=none
TEST=none

http://codereview.chromium.org/1104002

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@44908 0039d316-1c4b-4281-b951-d872f2087c98

3 files changed, 53 insertions, 0 deletions

diff --git a/sandbox/linux/selinux/README b/sandbox/linux/selinux/README
new file mode 100644
index 0000000..f5428a3
--- /dev/null
+++ b/sandbox/linux/selinux/README
@@ -0,0 +1,12 @@
+This contains a basic and seemingly functional policy for Chromium. This policy
+was written on FC12 and might not function on other distributions depending on
+the version of the refpolicy installed.
+
+When building Chromium with the GYP define selinux=1, the seccomp sandbox is
+disabled and the zygote will perform a dynamic transition to chromium_renderer_t
+after forking a renderer. The policy in this directory defines access vectors
+for chromium_renderer_t.
+
+To install:
+  % make -f /usr/share/selinux/devel/Makefile
+  % sudo /usr/sbin/semodule -i chromium-browser.pp
diff --git a/sandbox/linux/selinux/chromium-browser.if b/sandbox/linux/selinux/chromium-browser.if
new file mode 100644
index 0000000..3eb6a30
--- /dev/null
+++ b/sandbox/linux/selinux/chromium-browser.if
@@ -0,0 +1 @@
+## <summary></summary>
diff --git a/sandbox/linux/selinux/chromium-browser.te b/sandbox/linux/selinux/chromium-browser.te
new file mode 100644
index 0000000..ae2f8b7
--- /dev/null
+++ b/sandbox/linux/selinux/chromium-browser.te
@@ -0,0 +1,40 @@
+policy_module(chromium-browser,1.0.0)
+
+gen_require(`
+  type gnome_home_t;
+  type proc_t;
+  type tmpfs_t;
+  type unconfined_t;
+  type urandom_device_t;
+  type user_devpts_t;
+  type user_tmpfs_t;
+')
+
+type chromium_renderer_t;
+domain_base_type(chromium_renderer_t)
+role unconfined_r types chromium_renderer_t;
+
+allow unconfined_t chromium_renderer_t:process { dyntransition };
+
+allow chromium_renderer_t unconfined_t:unix_stream_socket { read write send_msg recv_msg };
+allow unconfined_t chromium_renderer_t:unix_stream_socket { read write send_msg recv_msg };
+
+allow chromium_renderer_t urandom_device_t:chr_file { read };
+allow chromium_renderer_t user_devpts_t:chr_file { write };
+allow chromium_renderer_t self:process { execmem };
+allow chromium_renderer_t self:fifo_file { read write };
+allow chromium_renderer_t self:unix_dgram_socket { read write create send_msg recv_msg sendto };
+allow chromium_renderer_t unconfined_t:unix_dgram_socket { read write send_msg recv_msg };
+allow unconfined_t chromium_renderer_t:unix_dgram_socket { read write send_msg recv_msg };
+allow chromium_renderer_t user_tmpfs_t:file { read write append open getattr };
+allow chromium_renderer_t tmpfs_t:file { read write };
+allow chromium_renderer_t self:shm { create destroy getattr setattr read write associate unix_read unix_write };
+
+# For reading dictionaries out of the user-data-dir
+allow chromium_renderer_t gnome_home_t:file { read getattr };
+
+miscfiles_read_localization(chromium_renderer_t);
+miscfiles_read_fonts(chromium_renderer_t);
+
+# The renderer will attempt to read meminfo
+dontaudit chromium_renderer_t proc_t:file { read };