# TODO

- [ ] Add new classes.
- [ ] Update [[../README.md]] with merged `-M` option of `restorecon`
- [ ] Rework device neverallowxs to specify a list of allowed ioctls for a device, and prevent any other ioctl
- [ ] Add global neverallowx rule to prevent accidential broad ioctl access
- [ ] Review linux 5.16 changes
  * New policy changes
  * New policy classes (`mctp_socket`, `io_uring`)

- [ ]  Add a script to build and run a test VM and collect the denials from boot -> login -> shutdown
  * And also make it a part of CI
  * See `debian-installer-selinux`
  * Implement testing against debian experimental using KVM in CI
  * Use it to test podman
  * Use it to test flatpak
  * Use it to test xserver / xfce4

* Find a nice way to ship all optional modules as installed but disabled or put them in a different package

- [ ] Make use of `in after`, `in before` added recently
* Improve consistency in naming things
  * Rename `file.var.lib` to `file.state`
  * Rename `file.var.log` to `file.log`
  * Fix auditd, syslogd, journald, ausearch, etc. domain names.

- [ ] Write a script to verify that filecons generally adhere to the correct MLS range, and that the type is part of `.file.<class>_types`

- [ ] Label `/etc/shadow` high-high ?

- [ ] Figure out a good format for comments, e.g. doxygen. from which documentation about the macros can be generated in, e.g. similar to the HTML for the CIL Reference Manual

- [ ] Implement basic unit tests and more neverallows
  * Ensure that every type is part of either `domain.types`, `file.types`, `port.types`, `node.types`, ...
  * Ensure that unprivileged roles can never change to an admin domain, e.g. `seutil.semodule.type`
  * Implement something like `neverroleallow` to ensure, e.g. that a netif type can only be associated with `system.role`

- [ ] Add additional types for very common sysctls, e.g. `cap_last_cap`, `fips_enabled`. Most (read) users of kernel sysctls only need these 2 but nothing else, this would tighten up access quite a bit.
    * systemd probably only needs to write 3-5 too.
- [ ] Allow opting out of ioctl extended permissions by putting it behind a tunable (perhaps per class i.e. seperate files, chr/blk, sockets)

### constraints

* Completely implement constraints for userspace classes (`dbus`, `service`)
* ensure high integrity for e.g. module loads, e.g. `(system (module_request))` and e.g. setting the clock `(capability (sys_time))`
* Ensure that `/boot/efi` has a MCS range of `high-high`
* Configure number of categories at build time and generate the CIL module.
* unix socket connections get the range of the client, this means that certain constraints could fail, when they shouldn't (see https://lore.kernel.org/selinux/1205937798.6466.223.camel@moss-spartans.epoch.ncsc.mil/)
* Figure out if there is a way to upgrade a policy (adding new categories), relabel and reboot without breaking everything.

### misc

* Review all existing modules to bring them up to standard
* Better handling of inherited sockets form `systemd` or `systemd --user`, also review dbus ioctl permissions (fd passing requires the normal ioctl access to the file, but not any specific ioctlcmd)
* Move the `(unix_stream_socket (shutdown))` permission back into `unix_stream_socket.create`
* Move the `(netlink_.*_socket (bind))` permission back into `netlink_.*_socket.create`
* Review the range that daemons run as
* https://github.com/systemd/systemd/pull/17169 was merged into systemd v247, remove the workaround once all systems are upgraded
* Add stub support for `/run/systemd/io.system.ManagedOOM`
* Add support for systemd-suspend / systemd-sleep
* cleanup sysadm it should have at least read access to almost everywhere
* Lockdown access to memory `/dev/mem`, `/proc/kcore`, `/proc/ioports`, etc...
* Consistent Naming in `policy/kernel/fs.cil`
* Document lightdm / xfce4 setup required workarounds
* Cleanup `.user`
* Make constraints optional
* Implement a semi-unconfined module (e.g. rw all files except /usr, ...)
* Use validatetrans constraints to ensure only trusted (e.g. systemd, `user.type`) domains can elevate the integrity of e.g. files
* Maybe use validatetrans to ensure certain types can only be relabeled to / relabeled to themselfs ? (e.g. dev.storage)
* https://lore.kernel.org/selinux/52E68747.5020006@tycho.nsa.gov/
* Implement support for systemd running `sulogin` in cases of failure
* /etc/xdg/xfce4/xinitrc does mkdir on xdg directories without fixing context
* Look through <https://github.com/systemd/systemd/releases/tag/v252> and IRC logs about new monitor socket

# Development setup

```bash
sudo apt-get install --no-install-recommends -qy build-essential git debhelper devscripts
git clone --branch=dev2 "https://gitlab.com/bauen1/bauen1-policy.git"
cd bauen1-policy
git fetch origin && git reset --keep origin/dev2 && dpkg-buildpackage -b -nc && sudo debi

# testing podman
sudo apt-get install --no-install-recommends -qy podman
sudo podman image pull hello-world
sudo semodule --install local.cil && sudo podman run --rm -it --network=none hello-world
```

Install a `local.cil` module and diff the changes against the previous policy
```bash
sudo cp /etc/selinux/bauen1-policy/policy/policy.33 /tmp/policy.33.old && sudo semodule --install local.cil && sudo sediff /tmp/policy.33.old /etc/selinux/bauen1-policy/policy/policy.33
```
