add content

sec-policy/selinux-wireguard/Manifest

@@ -0,0 +1,6 @@
+AUX wireguard.fc 250 BLAKE2B 10976a1e72bc8a7962920e4831e25bd8bd36c11d4890d0955e3d85453ebf821d2a1403b68bd178cddc3a8f09c4ce328a9628e0257d72635eb32d6184e18fa2d6 SHA512 248873b7767631ff46f014c8ccc7fcf73077962a037359a1b551a028812e6d2a351ed1f36e5e3717a39612323befa39c5d3c4e6dfc96bcdec08498bcd5f451c5
+AUX wireguard.if 2642 BLAKE2B 292ac6cfda215ffa8b97a2471a42f7e778e84357b268549497ce589e2c9d27ba4e03ee2090618690e6ce34f6436d962eb9fce98a41e37823c63f27d91d9cbc1e SHA512 96a31ab31e57f71bfa7c76a95386e845a50eeb748d9632197e89d3e3d7f7ed3d29d3b30bed668f569bdebebd2803736d1638784fa9195f877b97e55f96701f71
+AUX wireguard.te 2452 BLAKE2B 3408dd5f133978499884236e5fab7480c6be664a82f6862fef7d20d52c9a301fed456520cf61bb9671920d8b2019191a35a1c74702f79ea7c28ca01fa9121d4d SHA512 0af8271f9cfaabbc6f653fa307658cc039f09748972778a6302cc21fd4e9f2023ecd1ff30f2a5ab51f9816c06d6bb2ab3528c94705e582bc3d51b97955296d8b
+DIST patchbundle-selinux-base-policy-2.20180701-r1.tar.bz2 315378 BLAKE2B eeeb0b04c023c40289b6d964aefd1773d2b5d6912f1dffebf9509e6dcdbb39b17e722ee4483fb2b11193d4b987a85f90c7dc7e61cef3cf982fc2ba368d4900ef SHA512 a8b049120f1c420f9bfb55aba9ed0157ff7896ace402cd1b77b01d1ea52b67e49d915f1c00de83ff4d59b1cf8b8aa1f39b50ba312d842ed4850e75fcc7f5be42
+DIST refpolicy-2.20180701.tar.bz2 753050 BLAKE2B 7069a1b9b9bef25950e62bb50ac09f4a9d5ef6fd0acc667d321da396c3935939348534458df129f7bc81687dca240b4c4fc120d1f46d452665d335c9f023da8c SHA512 9dd5a1e10da5d25fea96cc25efb682f8ac866e835a1d940b161c1ce944cac9a90a5836b03c14311acad6bf9acd9a78003f36e050d35d8edb43606575523857b5
+EBUILD selinux-wireguard-2.20180701-r1.ebuild 402 BLAKE2B 0b9fa44a7cd7fdd8408288b2ed754f23591051e75288e9e50e05a36a0e03eaae39f882a4df3ee3a1c367927922a9e8e57900b72297ef445582a68e2ab06bfa4a SHA512 177f53e4fde327213b713ae19e191f11417ab02ce953abb7742ad16ac685cbdf4a1e12ae4c9f4c24e46da82c16624f4fbe52bf27380d399596c5631f7ade6441

sec-policy/selinux-wireguard/files/wireguard.fc

@@ -0,0 +1,11 @@
+#
+# /etc
+#
+/etc/wireguard(/.*)?			gen_context(system_u:object_r:wireguard_etc_t,s0)
+
+#
+# /usr
+#
+/usr/bin/wg			--	gen_context(system_u:object_r:wireguard_exec_t,s0)
+/usr/bin/wg-quick		--      gen_context(system_u:object_r:wireguard_script_exec_t,s0)
+

sec-policy/selinux-wireguard/files/wireguard.if

@@ -0,0 +1,128 @@
+## <summary>Policy for logical volume management programs.</summary>
+
+########################################
+## <summary>
+##	Execute wireguard programs in the wireguard domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+#
+interface(`wireguard_domtrans',`
+	gen_require(`
+		type wireguard_t, wireguard_exec_t;
+		type wireguard_script_t, wireguard_script_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	domtrans_pattern($1, wireguard_exec_t, wireguard_t)
+	domtrans_pattern($1, wireguard_script_exec_t, wireguard_script_t)
+')
+
+########################################
+## <summary>
+##	Execute wireguard programs in the caller domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`wireguard_exec',`
+	gen_require(`
+		type wireguard_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	can_exec($1, wireguard_exec_t)
+')
+
+########################################
+## <summary>
+##	Execute wireguard programs in the wireguard domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	The role to allow the Wireguard domain.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`wireguard_run',`
+	gen_require(`
+		type wireguard_t, wireguard_script_t;
+	')
+
+	wireguard_domtrans($1)
+	role $2 types wireguard_t;
+	role $2 types wireguard_script_t;
+')
+
+########################################
+## <summary>
+##      Send wireguard a null signal.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`wireguard_signull',`
+	gen_require(`
+		type wireguard_t;
+	')
+
+	allow $1 wireguard_t:process signull;
+')
+
+########################################
+## <summary>
+##	Read Wireguard configuration files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`wireguard_read_config',`
+	gen_require(`
+		type wireguard_etc_t;
+	')
+
+	files_search_etc($1)
+	allow $1 wireguard_etc_t:dir list_dir_perms;
+	read_files_pattern($1, wireguard_etc_t, wireguard_etc_t)
+')
+
+########################################
+## <summary>
+##	Manage Wireguard configuration files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`wireguard_manage_config',`
+	gen_require(`
+		type wireguard_etc_t;
+	')
+
+	files_search_etc($1)
+	manage_dirs_pattern($1, wireguard_etc_t, wireguard_etc_t)
+	manage_files_pattern($1, wireguard_etc_t, wireguard_etc_t)
+')
+

sec-policy/selinux-wireguard/files/wireguard.te

@@ -0,0 +1,84 @@
+policy_module(wireguard, 1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type wireguard_t;
+type wireguard_exec_t;
+init_system_domain(wireguard_t, wireguard_exec_t)
+# needs privowner because it assigns the identity system_u to device nodes
+# but runs as the identity of the sysadmin
+domain_obj_id_change_exemption(wireguard_t)
+role system_r types wireguard_t;
+
+type wireguard_script_t;
+type wireguard_script_exec_t;
+init_system_domain(wireguard_script_t, wireguard_script_exec_t)
+domtrans_pattern(wireguard_script_t, wireguard_exec_t, wireguard_t)
+
+type wireguard_etc_t;
+files_type(wireguard_etc_t)
+
+########################################
+#
+# wireguard Local policy
+#
+
+kernel_request_load_module(wireguard_t)
+
+allow wireguard_t self:capability net_admin;
+allow wireguard_t self:netlink_generic_socket create_socket_perms;
+allow wireguard_t self:netlink_route_socket r_netlink_socket_perms;
+allow wireguard_t self:udp_socket create_socket_perms;
+
+allow wireguard_t wireguard_script_t:fifo_file read_fifo_file_perms;
+
+manage_dirs_pattern(wireguard_t, wireguard_etc_t, wireguard_etc_t)
+manage_files_pattern(wireguard_t, wireguard_etc_t, wireguard_etc_t)
+manage_lnk_files_pattern(wireguard_t, wireguard_etc_t, wireguard_etc_t)
+files_etc_filetrans(wireguard_t, wireguard_etc_t, dir)
+filetrans_pattern(wireguard_t, wireguard_etc_t, wireguard_etc_t, file)
+
+userdom_use_user_ptys(wireguard_t)
+domain_use_interactive_fds(wireguard_t)
+
+########################################
+#
+# wireguard-quick Local policy
+#
+
+files_read_etc_files(wireguard_script_t)
+corecmd_exec_bin(wireguard_script_t)
+corecmd_exec_shell(wireguard_script_t)
+sysnet_domtrans_ifconfig(wireguard_script_t)
+
+manage_dirs_pattern(wireguard_script_t, wireguard_etc_t, wireguard_etc_t)
+manage_files_pattern(wireguard_script_t, wireguard_etc_t, wireguard_etc_t)
+manage_lnk_files_pattern(wireguard_script_t, wireguard_etc_t, wireguard_etc_t)
+filetrans_pattern(wireguard_script_t, wireguard_etc_t, wireguard_etc_t, file)
+
+allow wireguard_script_t self:fifo_file rw_fifo_file_perms;
+
+kernel_read_network_state(wireguard_script_t)
+
+miscfiles_read_localization(wireguard_script_t)
+
+userdom_use_user_ptys(wireguard_script_t)
+domain_use_interactive_fds(wireguard_script_t)
+
+########################################
+#
+# optional policy
+#
+
+optional_policy(`
+        gen_require(`
+                type sysadm_t;
+		role sysadm_r;
+        ')
+
+        wireguard_run(sysadm_t, sysadm_r)
+')
+

sec-policy/selinux-wireguard/selinux-wireguard-2.20180701-r1.ebuild

@@ -0,0 +1,20 @@
+# Copyright 1999-2015 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Id$
+EAPI="5"
+
+IUSE=""
+MODS="wireguard"
+POLICY_FILES="wireguard.te wireguard.fc wireguard.if"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for wireguard"
+
+RDEPEND="sec-policy/selinux-base-policy"
+
+if [[ $PV == 9999* ]] ; then
+        KEYWORDS=""
+else
+        KEYWORDS="amd64 x86"
+fi