selinux-policy/policy/modules/services/ccs.te


policy_module(ccs, 1.3.0)

########################################
#
# Declarations
#

type ccs_t;
type ccs_exec_t;
init_daemon_domain(ccs_t, ccs_exec_t)

# conf files
type cluster_conf_t;
files_type(cluster_conf_t)

# tmp files
type ccs_tmp_t;
files_tmp_file(ccs_tmp_t)

# log files
type ccs_var_log_t;
logging_log_file(ccs_var_log_t)

# var lib files
type ccs_var_lib_t;
logging_log_file(ccs_var_lib_t)

# pid files
type ccs_var_run_t;
files_pid_file(ccs_var_run_t)

########################################
#
# ccs local policy
#

allow ccs_t self:capability { ipc_lock sys_nice sys_resource sys_admin };
allow ccs_t self:process { signal setrlimit setsched };
dontaudit ccs_t self:process ptrace;
allow ccs_t self:fifo_file rw_fifo_file_perms;
allow ccs_t self:unix_stream_socket { connectto create_stream_socket_perms };
allow ccs_t self:unix_dgram_socket create_socket_perms;
allow ccs_t self:netlink_route_socket r_netlink_socket_perms;
allow ccs_t self:tcp_socket create_stream_socket_perms;
allow ccs_t self:udp_socket { create_socket_perms listen recv_msg send_msg };
# cjp: this needs to be fixed to be specific
allow ccs_t self:socket create_socket_perms;

manage_files_pattern(ccs_t, cluster_conf_t, cluster_conf_t)

# tmp file
allow ccs_t ccs_tmp_t:dir manage_dir_perms;
manage_dirs_pattern(ccs_t, ccs_tmp_t, ccs_tmp_t)
manage_files_pattern(ccs_t, ccs_tmp_t, ccs_tmp_t)
files_tmp_filetrans(ccs_t, ccs_tmp_t, { file dir })

# log files
manage_files_pattern(ccs_t, ccs_var_log_t, ccs_var_log_t)
manage_sock_files_pattern(ccs_t, ccs_var_log_t, ccs_var_log_t)
allow ccs_t ccs_var_log_t:dir setattr;
logging_log_filetrans(ccs_t, ccs_var_log_t, { sock_file file dir })

# var lib files
manage_dirs_pattern(ccs_t, ccs_var_lib_t, ccs_var_lib_t)
manage_files_pattern(ccs_t, ccs_var_lib_t, ccs_var_lib_t)
files_var_lib_filetrans(ccs_t, ccs_var_lib_t, { file dir })

# pid file
manage_dirs_pattern(ccs_t, ccs_var_run_t, ccs_var_run_t)
manage_files_pattern(ccs_t, ccs_var_run_t, ccs_var_run_t)
manage_sock_files_pattern(ccs_t, ccs_var_run_t, ccs_var_run_t)
files_pid_filetrans(ccs_t, ccs_var_run_t, { dir file sock_file })

kernel_read_kernel_sysctls(ccs_t)

corecmd_list_bin(ccs_t)
corecmd_exec_bin(ccs_t)

corenet_all_recvfrom_unlabeled(ccs_t)
corenet_all_recvfrom_netlabel(ccs_t)
corenet_tcp_sendrecv_all_if(ccs_t)
corenet_udp_sendrecv_all_if(ccs_t)
corenet_tcp_sendrecv_all_nodes(ccs_t)
corenet_udp_sendrecv_all_nodes(ccs_t)
corenet_tcp_sendrecv_all_ports(ccs_t)
corenet_udp_sendrecv_all_ports(ccs_t)
corenet_tcp_bind_all_nodes(ccs_t)
corenet_udp_bind_all_nodes(ccs_t)
corenet_tcp_bind_cluster_port(ccs_t)
corenet_udp_bind_cluster_port(ccs_t)
corenet_udp_bind_netsupport_port(ccs_t)

dev_read_urand(ccs_t)

files_read_etc_files(ccs_t)
files_read_etc_runtime_files(ccs_t)

init_rw_script_tmp_files(ccs_t)

logging_send_syslog_msg(ccs_t)

miscfiles_read_localization(ccs_t)

sysnet_dns_name_resolve(ccs_t)

ifdef(`hide_broken_symptoms', `
	corecmd_dontaudit_write_bin_dirs(ccs_t)
	files_manage_isid_type_files(ccs_t)
')

optional_policy(`
	unconfined_use_fds(ccs_t)
')
add aide, ccs, and ricci 2006-11-16 20:56:24 +00:00
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`policy_module(ccs, 1.3.0)`
add aide, ccs, and ricci 2006-11-16 20:56:24 +00:00
			`########################################`
			`#`
			`# Declarations`
			`#`

			`type ccs_t;`
			`type ccs_exec_t;`
			`init_daemon_domain(ccs_t, ccs_exec_t)`

six patches from dan 2007-04-10 13:10:58 +00:00			`# conf files`
add aide, ccs, and ricci 2006-11-16 20:56:24 +00:00			`type cluster_conf_t;`
			`files_type(cluster_conf_t)`

six patches from dan 2007-04-10 13:10:58 +00:00			`# tmp files`
			`type ccs_tmp_t;`
			`files_tmp_file(ccs_tmp_t)`

add aide, ccs, and ricci 2006-11-16 20:56:24 +00:00			`# log files`
			`type ccs_var_log_t;`
			`logging_log_file(ccs_var_log_t)`

patch from dan, Thu, 2007-01-25 at 08:12 -0500 2007-02-16 23:01:42 +00:00			`# var lib files`
			`type ccs_var_lib_t;`
			`logging_log_file(ccs_var_lib_t)`

add aide, ccs, and ricci 2006-11-16 20:56:24 +00:00			`# pid files`
			`type ccs_var_run_t;`
			`files_pid_file(ccs_var_run_t)`

			`########################################`
			`#`
			`# ccs local policy`
			`#`

patch from dan, Thu, 2007-01-25 at 08:12 -0500 2007-02-16 23:01:42 +00:00			`allow ccs_t self:capability { ipc_lock sys_nice sys_resource sys_admin };`
add aide, ccs, and ricci 2006-11-16 20:56:24 +00:00			`allow ccs_t self:process { signal setrlimit setsched };`
trivial change from dan 2007-03-06 17:44:26 +00:00			`dontaudit ccs_t self:process ptrace;`
trunk: Enable open permission checks policy capability. 2008-10-16 16:09:20 +00:00			`allow ccs_t self:fifo_file rw_fifo_file_perms;`
add aide, ccs, and ricci 2006-11-16 20:56:24 +00:00			`allow ccs_t self:unix_stream_socket { connectto create_stream_socket_perms };`
			`allow ccs_t self:unix_dgram_socket create_socket_perms;`
			`allow ccs_t self:netlink_route_socket r_netlink_socket_perms;`
			`allow ccs_t self:tcp_socket create_stream_socket_perms;`
			`allow ccs_t self:udp_socket { create_socket_perms listen recv_msg send_msg };`
			`# cjp: this needs to be fixed to be specific`
			`allow ccs_t self:socket create_socket_perms;`

trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`manage_files_pattern(ccs_t, cluster_conf_t, cluster_conf_t)`
add aide, ccs, and ricci 2006-11-16 20:56:24 +00:00
six patches from dan 2007-04-10 13:10:58 +00:00			`# tmp file`
			`allow ccs_t ccs_tmp_t:dir manage_dir_perms;`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`manage_dirs_pattern(ccs_t, ccs_tmp_t, ccs_tmp_t)`
			`manage_files_pattern(ccs_t, ccs_tmp_t, ccs_tmp_t)`
six patches from dan 2007-04-10 13:10:58 +00:00			`files_tmp_filetrans(ccs_t, ccs_tmp_t, { file dir })`

add aide, ccs, and ricci 2006-11-16 20:56:24 +00:00			`# log files`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`manage_files_pattern(ccs_t, ccs_var_log_t, ccs_var_log_t)`
			`manage_sock_files_pattern(ccs_t, ccs_var_log_t, ccs_var_log_t)`
merge policy patterns to trunk 2006-12-12 20:08:08 +00:00			`allow ccs_t ccs_var_log_t:dir setattr;`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`logging_log_filetrans(ccs_t, ccs_var_log_t, { sock_file file dir })`
add aide, ccs, and ricci 2006-11-16 20:56:24 +00:00
patch from dan, Thu, 2007-01-25 at 08:12 -0500 2007-02-16 23:01:42 +00:00			`# var lib files`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`manage_dirs_pattern(ccs_t, ccs_var_lib_t, ccs_var_lib_t)`
			`manage_files_pattern(ccs_t, ccs_var_lib_t, ccs_var_lib_t)`
			`files_var_lib_filetrans(ccs_t, ccs_var_lib_t, { file dir })`
patch from dan, Thu, 2007-01-25 at 08:12 -0500 2007-02-16 23:01:42 +00:00
add aide, ccs, and ricci 2006-11-16 20:56:24 +00:00			`# pid file`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`manage_dirs_pattern(ccs_t, ccs_var_run_t, ccs_var_run_t)`
			`manage_files_pattern(ccs_t, ccs_var_run_t, ccs_var_run_t)`
			`manage_sock_files_pattern(ccs_t, ccs_var_run_t, ccs_var_run_t)`
			`files_pid_filetrans(ccs_t, ccs_var_run_t, { dir file sock_file })`
add aide, ccs, and ricci 2006-11-16 20:56:24 +00:00
			`kernel_read_kernel_sysctls(ccs_t)`

Merge sbin_t and ls_exec_t into bin_t. 2007-03-23 23:24:59 +00:00			`corecmd_list_bin(ccs_t)`
add aide, ccs, and ricci 2006-11-16 20:56:24 +00:00			`corecmd_exec_bin(ccs_t)`

trunk: Unified labeled networking policy from Paul Moore. The latest revision of the labeled policy patches which enable both labeled and unlabeled policy support for NetLabel. This revision takes into account Chris' feedback from the first version and reduces the number of interface calls in each domain down to two at present: one for unlabeled access, one for NetLabel access. The older, transport layer specific interfaces, are still present for use by third-party modules but are not used in the default policy modules. trunk: Use netmsg initial SID for MLS-only Netlabel packets, from Paul Moore. This patch changes the policy to use the netmsg initial SID as the "base" SID/context for NetLabel packets which only have MLS security attributes. Currently we use the unlabeled initial SID which makes it very difficult to distinquish between actual unlabeled packets and those packets which have MLS security attributes. 2007-06-27 15:23:21 +00:00			`corenet_all_recvfrom_unlabeled(ccs_t)`
			`corenet_all_recvfrom_netlabel(ccs_t)`
add aide, ccs, and ricci 2006-11-16 20:56:24 +00:00			`corenet_tcp_sendrecv_all_if(ccs_t)`
			`corenet_udp_sendrecv_all_if(ccs_t)`
			`corenet_tcp_sendrecv_all_nodes(ccs_t)`
			`corenet_udp_sendrecv_all_nodes(ccs_t)`
			`corenet_tcp_sendrecv_all_ports(ccs_t)`
			`corenet_udp_sendrecv_all_ports(ccs_t)`
			`corenet_tcp_bind_all_nodes(ccs_t)`
			`corenet_udp_bind_all_nodes(ccs_t)`
			`corenet_tcp_bind_cluster_port(ccs_t)`
			`corenet_udp_bind_cluster_port(ccs_t)`
			`corenet_udp_bind_netsupport_port(ccs_t)`

			`dev_read_urand(ccs_t)`

			`files_read_etc_files(ccs_t)`
			`files_read_etc_runtime_files(ccs_t)`

			`init_rw_script_tmp_files(ccs_t)`

			`logging_send_syslog_msg(ccs_t)`

			`miscfiles_read_localization(ccs_t)`

			`sysnet_dns_name_resolve(ccs_t)`

patch from dan, Thu, 2007-01-25 at 08:12 -0500 2007-02-16 23:01:42 +00:00			ifdef(`hide_broken_symptoms', `
Merge sbin_t and ls_exec_t into bin_t. 2007-03-23 23:24:59 +00:00			`corecmd_dontaudit_write_bin_dirs(ccs_t)`
patch from dan, Thu, 2007-01-25 at 08:12 -0500 2007-02-16 23:01:42 +00:00			`files_manage_isid_type_files(ccs_t)`
			`')`

add aide, ccs, and ricci 2006-11-16 20:56:24 +00:00			optional_policy(`
			`unconfined_use_fds(ccs_t)`
			`')`