selinux-policy/strict/macros/program/crond_macros.te

#
# Macros for crond domains.
#

#
# Authors:  Jonathan Crowley (MITRE) <jonathan@mitre.org>,
#	    Stephen Smalley <sds@epoch.ncsc.mil> and Timothy Fraser
#           Russell Coker <rcoker@redhat.com>
#

#
# crond_domain(domain_prefix)
#
# Define a derived domain for cron jobs executed by crond on behalf 
# of a user domain.  These domains are separate from the top-level domain
# defined for the crond daemon and the domain defined for system cron jobs,
# which are specified in domains/program/crond.te.
#
undefine(`crond_domain')
define(`crond_domain',`
# Derived domain for user cron jobs, user user_crond_domain if not system
ifelse(`system', `$1', `
type $1_crond_t, domain, privlog, privmail, nscd_client_domain;
', `
type $1_crond_t, domain, user_crond_domain;

# Access user files and dirs.
allow $1_crond_t home_root_t:dir search;
file_type_auto_trans($1_crond_t, $1_home_dir_t, $1_home_t)

# Run scripts in user home directory and access shared libs.
can_exec($1_crond_t, $1_home_t)

file_type_auto_trans($1_crond_t, tmp_t, $1_tmp_t)
')
r_dir_file($1_crond_t, selinux_config_t)

# Type of user crontabs once moved to cron spool.
type $1_cron_spool_t, file_type, sysadmfile;

ifdef(`fcron.te', `
allow crond_t $1_cron_spool_t:file create_file_perms;
')

allow $1_crond_t urandom_device_t:chr_file { getattr read };

allow $1_crond_t usr_t:file { getattr ioctl read };
allow $1_crond_t usr_t:lnk_file read;

# Permit a transition from the crond_t domain to this domain.
# The transition is requested explicitly by the modified crond 
# via execve_secure.  There is no way to set up an automatic
# transition, since crontabs are configuration files, not executables.
domain_trans(crond_t, shell_exec_t, $1_crond_t)

ifdef(`mta.te', `
domain_auto_trans($1_crond_t, sendmail_exec_t, $1_mail_t)
allow $1_crond_t sendmail_exec_t:lnk_file { getattr read };

# $1_mail_t should only be reading from the cron fifo not needing to write
dontaudit $1_mail_t crond_t:fifo_file write;
allow mta_user_agent $1_crond_t:fd use;
')

# The user role is authorized for this domain.
role $1_r types $1_crond_t;

# This domain is granted permissions common to most domains.
can_network($1_crond_t)
allow $1_crond_t port_type:tcp_socket name_connect;
can_ypbind($1_crond_t)
r_dir_file($1_crond_t, self)
allow $1_crond_t self:fifo_file rw_file_perms;
allow $1_crond_t self:unix_stream_socket create_stream_socket_perms;
allow $1_crond_t self:unix_dgram_socket create_socket_perms;
allow $1_crond_t etc_runtime_t:file { getattr read };
allow $1_crond_t self:process { fork signal_perms setsched };
allow $1_crond_t proc_t:dir r_dir_perms;
allow $1_crond_t proc_t:file { getattr read ioctl };
read_locale($1_crond_t)
read_sysctl($1_crond_t)
allow $1_crond_t var_spool_t:dir search;
allow $1_crond_t fs_type:filesystem getattr;

allow $1_crond_t devtty_t:chr_file { read write };
allow $1_crond_t var_t:dir r_dir_perms;
allow $1_crond_t var_t:file { getattr read ioctl };
allow $1_crond_t var_log_t:dir search;

# Use capabilities.
allow $1_crond_t self:capability dac_override;

# Inherit and use descriptors from initrc - I think this is wrong
#allow $1_crond_t initrc_t:fd use;

# 
# Since crontab files are not directly executed,
# crond must ensure that the crontab file has
# a type that is appropriate for the domain of
# the user cron job.  It performs an entrypoint
# permission check for this purpose.
#
allow $1_crond_t $1_cron_spool_t:file entrypoint;

# Run helper programs.
can_exec_any($1_crond_t)

# ps does not need to access /boot when run from cron
dontaudit $1_crond_t boot_t:dir search;
# quiet other ps operations
dontaudit $1_crond_t domain:dir { getattr search };
# for nscd
dontaudit $1_crond_t var_run_t:dir search;
')

# When system_crond_t domain executes a type $1 executable then transition to
# domain $2, allow $2 to interact with crond_t as well.
define(`system_crond_entry', `
ifdef(`crond.te', `
domain_auto_trans(system_crond_t, $1, $2)
allow $2 crond_t:fifo_file { getattr read write ioctl };
# a rule for privfd may make this obsolete
allow $2 crond_t:fd use;
allow $2 crond_t:process sigchld;
')dnl end ifdef
')dnl end system_crond_entry