109 lines
3.3 KiB
Plaintext
109 lines
3.3 KiB
Plaintext
|
#DESC Useradd - Manage system user accounts
|
||
|
|
#
|
||
|
|
# Authors: Chris Vance <cvance@tislabs.com> David Caplan <dac@tresys.com>
|
||
|
|
# Russell Coker <russell@coker.com.au>
|
||
|
|
# X-Debian-Packages: passwd
|
||
|
|
#
|
||
|
|
|
||
|
|
#################################
|
||
|
|
#
|
||
|
|
# Rules for the useradd_t and groupadd_t domains.
|
||
|
|
#
|
||
|
|
# useradd_t is the domain of the useradd/userdel programs.
|
||
|
|
# groupadd_t is for adding groups (can not create home dirs)
|
||
|
|
#
|
||
|
|
define(`user_group_add_program', `
|
||
|
|
type $1_t, domain, privlog, auth_write, privowner, nscd_client_domain;
|
||
|
|
role sysadm_r types $1_t;
|
||
|
|
role system_r types $1_t;
|
||
|
|
|
||
|
|
general_domain_access($1_t)
|
||
|
|
uses_shlib($1_t)
|
||
|
|
|
||
|
|
type $1_exec_t, file_type, sysadmfile, exec_type;
|
||
|
|
domain_auto_trans(sysadm_t, $1_exec_t, $1_t)
|
||
|
|
domain_auto_trans(initrc_t, $1_exec_t, $1_t)
|
||
|
|
|
||
|
|
# Use capabilities.
|
||
|
|
allow $1_t self:capability { dac_override chown kill };
|
||
|
|
|
||
|
|
# Allow access to context for shadow file
|
||
|
|
can_getsecurity($1_t)
|
||
|
|
|
||
|
|
# Inherit and use descriptors from login.
|
||
|
|
allow $1_t { init_t privfd }:fd use;
|
||
|
|
|
||
|
|
# Execute /usr/bin/{passwd,chfn,chsh} and /usr/sbin/{useradd,vipw}.
|
||
|
|
allow $1_t { bin_t sbin_t }:dir r_dir_perms;
|
||
|
|
can_exec($1_t, { bin_t sbin_t })
|
||
|
|
|
||
|
|
# Update /etc/shadow and /etc/passwd
|
||
|
|
file_type_auto_trans($1_t, etc_t, shadow_t, file)
|
||
|
|
allow $1_t etc_t:file create_file_perms;
|
||
|
|
|
||
|
|
# some apps ask for these accesses, but seems to work regardless
|
||
|
|
dontaudit $1_t var_run_t:dir search;
|
||
|
|
r_dir_file($1_t, selinux_config_t)
|
||
|
|
|
||
|
|
# Set fscreate context.
|
||
|
|
can_setfscreate($1_t)
|
||
|
|
|
||
|
|
allow $1_t { etc_t shadow_t }:file { relabelfrom relabelto };
|
||
|
|
|
||
|
|
read_locale($1_t)
|
||
|
|
|
||
|
|
# useradd/userdel request read/write for /var/log/lastlog, and read of /dev,
|
||
|
|
# but will operate without them.
|
||
|
|
dontaudit $1_t { device_t var_t var_log_t }:dir search;
|
||
|
|
|
||
|
|
# For userdel and groupadd
|
||
|
|
allow $1_t fs_t:filesystem getattr;
|
||
|
|
|
||
|
|
# Access terminals.
|
||
|
|
allow $1_t ttyfile:chr_file rw_file_perms;
|
||
|
|
allow $1_t ptyfile:chr_file rw_file_perms;
|
||
|
|
ifdef(`gnome-pty-helper.te', `allow $1_t gphdomain:fd use;')
|
||
|
|
|
||
|
|
# for when /root is the cwd
|
||
|
|
dontaudit $1_t sysadm_home_dir_t:dir search;
|
||
|
|
nsswitch_domain($1_t)
|
||
|
|
|
||
|
|
allow $1_t self:netlink_audit_socket { create_socket_perms nlmsg_relay };
|
||
|
|
')
|
||
|
|
user_group_add_program(useradd)
|
||
|
|
allow useradd_t lastlog_t:file { getattr read write };
|
||
|
|
|
||
|
|
# for getting the number of groups
|
||
|
|
read_sysctl(useradd_t)
|
||
|
|
|
||
|
|
# Add/remove user home directories
|
||
|
|
file_type_auto_trans(useradd_t, home_root_t, user_home_dir_t, dir)
|
||
|
|
file_type_auto_trans(useradd_t, user_home_dir_t, user_home_t)
|
||
|
|
|
||
|
|
# create/delete mail spool file in /var/mail
|
||
|
|
allow useradd_t var_spool_t:dir search;
|
||
|
|
allow useradd_t mail_spool_t:dir { search write add_name remove_name };
|
||
|
|
allow useradd_t mail_spool_t:file create_file_perms;
|
||
|
|
# /var/mail is a link to /var/spool/mail
|
||
|
|
allow useradd_t mail_spool_t:lnk_file read;
|
||
|
|
|
||
|
|
allow useradd_t self:capability { fowner fsetid setuid sys_resource };
|
||
|
|
can_exec(useradd_t, shell_exec_t)
|
||
|
|
|
||
|
|
# /usr/bin/userdel locks the user being deleted, allow write access to utmp
|
||
|
|
allow useradd_t initrc_var_run_t:file { read write lock };
|
||
|
|
|
||
|
|
user_group_add_program(groupadd)
|
||
|
|
|
||
|
|
dontaudit groupadd_t self:capability fsetid;
|
||
|
|
|
||
|
|
allow groupadd_t self:capability { setuid sys_resource };
|
||
|
|
allow groupadd_t self:process setrlimit;
|
||
|
|
allow groupadd_t initrc_var_run_t:file r_file_perms;
|
||
|
|
dontaudit groupadd_t initrc_var_run_t:file write;
|
||
|
|
|
||
|
|
allow useradd_t default_context_t:dir search;
|
||
|
|
allow useradd_t file_context_t:dir search;
|
||
|
|
allow useradd_t file_context_t:file { getattr read };
|
||
|
|
allow useradd_t var_lib_t:dir search;
|