make DONTAUDIT_UNLABELED=y policy load

do not build dontaudit rules on unlabeled_t target type

Author: bachradsusi

Makefile

@@ -215,6 +215,10 @@ ifeq "$(UBAC)" "y"
 	M4PARAM += -D enable_ubac
 endif
 
+ifeq "$(DONTAUDIT_UNLABELED)" "y"
+	M4PARAM += -D dontaudit_unlabeled
+endif
+
 # default MLS/MCS sensitivity and category settings.
 MLS_SENS ?= 16
 MLS_CATS ?= 1024

policy/modules/contrib/amanda.te

@@ -109,7 +109,9 @@ kernel_read_kernel_sysctls(amanda_t)
 kernel_read_net_sysctls(amanda_t)
 kernel_read_system_state(amanda_t)
 kernel_read_network_state(amanda_t)
-kernel_dontaudit_getattr_unlabeled_files(amanda_t)
+ifdef(`dontaudit_unlabeled',`
+	kernel_dontaudit_getattr_unlabeled_files(amanda_t)
+')
 kernel_dontaudit_read_proc_symlinks(amanda_t)
 
 corecmd_exec_shell(amanda_t)

policy/modules/contrib/devicekit.te

@@ -90,7 +90,9 @@ manage_files_pattern(devicekit_disk_t, devicekit_var_run_t, devicekit_var_run_t)
 files_pid_filetrans(devicekit_disk_t, devicekit_var_run_t, { dir file })
 files_filetrans_named_content(devicekit_disk_t)
 
-kernel_dontaudit_getattr_unlabeled_files(devicekit_disk_t)
+ifdef(`dontaudit_unlabeled',`
+	kernel_dontaudit_getattr_unlabeled_files(devicekit_disk_t)
+')
 kernel_getattr_message_if(devicekit_disk_t)
 kernel_list_unlabeled(devicekit_disk_t)
 kernel_read_fs_sysctls(devicekit_disk_t)

policy/modules/contrib/mplayer.te

@@ -146,9 +146,11 @@ manage_fifo_files_pattern(mplayer_t, mplayer_tmpfs_t, mplayer_tmpfs_t)
 manage_sock_files_pattern(mplayer_t, mplayer_tmpfs_t, mplayer_tmpfs_t)
 fs_tmpfs_filetrans(mplayer_t, mplayer_tmpfs_t,{ dir file lnk_file sock_file fifo_file })
 
-kernel_dontaudit_list_unlabeled(mplayer_t)
-kernel_dontaudit_getattr_unlabeled_files(mplayer_t)
-kernel_dontaudit_read_unlabeled_files(mplayer_t)
+ifdef(`dontaudit_unlabeled',`
+	kernel_dontaudit_list_unlabeled(mplayer_t)
+	kernel_dontaudit_getattr_unlabeled_files(mplayer_t)
+	kernel_dontaudit_read_unlabeled_files(mplayer_t)
+')
 kernel_read_system_state(mplayer_t)
 kernel_read_kernel_sysctls(mplayer_t)
 

policy/modules/system/init.te

@@ -1672,8 +1672,9 @@ optional_policy(`
 
 optional_policy(`
 	# bash tries to access a block device in the initrd
-	kernel_dontaudit_getattr_unlabeled_blk_files(initrc_t)
-
+	ifdef(`dontaudit_unlabeled',`
+		kernel_dontaudit_getattr_unlabeled_blk_files(initrc_t)
+	')
 	# for a bug in rm
 	files_dontaudit_write_all_pids(initrc_t)
 

policy/modules/system/userdomain.if

@@ -77,13 +77,15 @@ template(`userdom_base_user_template',`
 
 	kernel_read_kernel_sysctls($1_usertype)
 	kernel_read_all_sysctls($1_usertype)
-	kernel_dontaudit_list_unlabeled($1_usertype)
-	kernel_dontaudit_getattr_unlabeled_files($1_usertype)
-	kernel_dontaudit_getattr_unlabeled_symlinks($1_usertype)
-	kernel_dontaudit_getattr_unlabeled_pipes($1_usertype)
-	kernel_dontaudit_getattr_unlabeled_sockets($1_usertype)
-	kernel_dontaudit_getattr_unlabeled_blk_files($1_usertype)
-	kernel_dontaudit_getattr_unlabeled_chr_files($1_usertype)
+	ifdef(`dontaudit_unlabeled',`
+		kernel_dontaudit_list_unlabeled($1_usertype)
+		kernel_dontaudit_getattr_unlabeled_files($1_usertype)
+		kernel_dontaudit_getattr_unlabeled_symlinks($1_usertype)
+		kernel_dontaudit_getattr_unlabeled_pipes($1_usertype)
+		kernel_dontaudit_getattr_unlabeled_sockets($1_usertype)
+		kernel_dontaudit_getattr_unlabeled_blk_files($1_usertype)
+		kernel_dontaudit_getattr_unlabeled_chr_files($1_usertype)
+	')
 	kernel_dontaudit_list_proc($1_usertype)
 
 	dev_dontaudit_getattr_all_blk_files($1_usertype)

policy/modules/system/userdomain.te

@@ -572,13 +572,15 @@ application_exec_all(confined_admindomain)
 
 kernel_read_kernel_sysctls(confined_admindomain)
 kernel_read_all_sysctls(confined_admindomain)
-kernel_dontaudit_list_unlabeled(confined_admindomain)
-kernel_dontaudit_getattr_unlabeled_files(confined_admindomain)
-kernel_dontaudit_getattr_unlabeled_symlinks(confined_admindomain)
-kernel_dontaudit_getattr_unlabeled_pipes(confined_admindomain)
-kernel_dontaudit_getattr_unlabeled_sockets(confined_admindomain)
-kernel_dontaudit_getattr_unlabeled_blk_files(confined_admindomain)
-kernel_dontaudit_getattr_unlabeled_chr_files(confined_admindomain)
+ifdef(`dontaudit_unlabeled',`
+	kernel_dontaudit_list_unlabeled(confined_admindomain)
+	kernel_dontaudit_getattr_unlabeled_files(confined_admindomain)
+	kernel_dontaudit_getattr_unlabeled_symlinks(confined_admindomain)
+	kernel_dontaudit_getattr_unlabeled_pipes(confined_admindomain)
+	kernel_dontaudit_getattr_unlabeled_sockets(confined_admindomain)
+	kernel_dontaudit_getattr_unlabeled_blk_files(confined_admindomain)
+	kernel_dontaudit_getattr_unlabeled_chr_files(confined_admindomain)
+')
 kernel_dontaudit_list_proc(confined_admindomain)
 
 dev_dontaudit_getattr_all_blk_files(confined_admindomain)