80 lines
2.2 KiB
Plaintext
80 lines
2.2 KiB
Plaintext
|
#DESC Automount - Automount daemon
|
||
|
|
#
|
||
|
|
# Authors: Stephen Smalley <sds@epoch.ncsc.mil>
|
||
|
|
# Modified by Russell Coker <russell@coker.com.au>
|
||
|
|
# X-Debian-Packages: amd am-utils autofs
|
||
|
|
#
|
||
|
|
|
||
|
|
#################################
|
||
|
|
#
|
||
|
|
# Rules for the automount_t domain.
|
||
|
|
#
|
||
|
|
daemon_domain(automount)
|
||
|
|
|
||
|
|
etc_domain(automount)
|
||
|
|
|
||
|
|
# for SSP
|
||
|
|
allow automount_t urandom_device_t:chr_file read;
|
||
|
|
|
||
|
|
# for if the mount point is not labelled
|
||
|
|
allow automount_t file_t:dir getattr;
|
||
|
|
allow automount_t default_t:dir getattr;
|
||
|
|
|
||
|
|
allow automount_t autofs_t:dir { create_dir_perms ioctl };
|
||
|
|
allow automount_t fs_type:dir getattr;
|
||
|
|
|
||
|
|
allow automount_t { etc_t etc_runtime_t }:file { getattr read };
|
||
|
|
allow automount_t proc_t:file { getattr read };
|
||
|
|
allow automount_t self:process { getpgid setpgid setsched };
|
||
|
|
allow automount_t self:capability { sys_nice dac_override };
|
||
|
|
allow automount_t self:unix_stream_socket create_socket_perms;
|
||
|
|
allow automount_t self:unix_dgram_socket create_socket_perms;
|
||
|
|
|
||
|
|
# because config files can be shell scripts
|
||
|
|
can_exec(automount_t, { etc_t automount_etc_t })
|
||
|
|
|
||
|
|
can_network_server(automount_t)
|
||
|
|
can_resolve(automount_t)
|
||
|
|
can_ypbind(automount_t)
|
||
|
|
can_ldap(automount_t)
|
||
|
|
|
||
|
|
ifdef(`fsadm.te', `
|
||
|
|
domain_auto_trans(automount_t, fsadm_exec_t, fsadm_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
lock_domain(automount)
|
||
|
|
|
||
|
|
tmp_domain(automount)
|
||
|
|
allow automount_t self:fifo_file rw_file_perms;
|
||
|
|
|
||
|
|
# Run mount in the mount_t domain.
|
||
|
|
domain_auto_trans(automount_t, mount_exec_t, mount_t)
|
||
|
|
allow mount_t autofs_t:dir { search mounton read };
|
||
|
|
allow mount_t automount_tmp_t:dir mounton;
|
||
|
|
|
||
|
|
ifdef(`apmd.te',
|
||
|
|
`domain_auto_trans(apmd_t, automount_exec_t, automount_t)
|
||
|
|
can_exec(automount_t, bin_t)')
|
||
|
|
|
||
|
|
allow automount_t { bin_t sbin_t }:dir search;
|
||
|
|
can_exec(automount_t, mount_exec_t)
|
||
|
|
can_exec(automount_t, shell_exec_t)
|
||
|
|
|
||
|
|
allow mount_t autofs_t:dir getattr;
|
||
|
|
dontaudit automount_t var_t:dir write;
|
||
|
|
|
||
|
|
allow userdomain autofs_t:dir r_dir_perms;
|
||
|
|
allow kernel_t autofs_t:dir { getattr ioctl read search };
|
||
|
|
|
||
|
|
allow automount_t { boot_t home_root_t }:dir getattr;
|
||
|
|
allow automount_t mnt_t:dir { getattr search };
|
||
|
|
|
||
|
|
can_exec(initrc_t, automount_etc_t)
|
||
|
|
|
||
|
|
# Allow automount to create and delete directories in / and /home
|
||
|
|
file_type_auto_trans(automount_t, { root_t home_root_t }, automount_tmp_t, dir)
|
||
|
|
|
||
|
|
allow automount_t var_lib_t:dir search;
|
||
|
|
allow automount_t var_lib_nfs_t:dir search;
|
||
|
|
|