2005-06-30 21:11:54 +00:00
|
|
|
## <summary>MIT Kerberos admin and KDC</summary>
|
|
|
|
## <desc>
|
|
|
|
## <p>
|
|
|
|
## This policy supports:
|
|
|
|
## </p>
|
|
|
|
## <p>
|
|
|
|
## Servers:
|
|
|
|
## <ul>
|
|
|
|
## <li>kadmind</li>
|
|
|
|
## <li>krb5kdc</li>
|
|
|
|
## </ul>
|
2005-07-01 13:10:57 +00:00
|
|
|
## </p>
|
2005-06-30 21:11:54 +00:00
|
|
|
## <p>
|
|
|
|
## Clients:
|
|
|
|
## <ul>
|
|
|
|
## <li>kinit</li>
|
|
|
|
## <li>kdestroy</li>
|
|
|
|
## <li>klist</li>
|
|
|
|
## <li>ksu (incomplete)</li>
|
|
|
|
## </ul>
|
2005-07-01 13:10:57 +00:00
|
|
|
## </p>
|
2005-06-30 21:11:54 +00:00
|
|
|
## </desc>
|
|
|
|
|
|
|
|
########################################
|
|
|
|
## <summary>
|
|
|
|
## Use kerberos services
|
|
|
|
## </summary>
|
|
|
|
## <param name="domain">
|
2006-02-10 18:41:53 +00:00
|
|
|
## <summary>
|
2005-06-30 21:11:54 +00:00
|
|
|
## Domain allowed access.
|
2006-02-10 18:41:53 +00:00
|
|
|
## </summary>
|
2005-06-30 21:11:54 +00:00
|
|
|
## </param>
|
|
|
|
#
|
|
|
|
interface(`kerberos_use',`
|
|
|
|
gen_require(`
|
|
|
|
type krb5_conf_t;
|
2006-09-22 17:14:35 +00:00
|
|
|
type krb5kdc_conf_t;
|
2005-06-30 21:11:54 +00:00
|
|
|
')
|
|
|
|
|
2005-08-31 15:25:12 +00:00
|
|
|
files_search_etc($1)
|
|
|
|
allow $1 krb5_conf_t:file { getattr read };
|
|
|
|
dontaudit $1 krb5_conf_t:file write;
|
2007-02-16 23:01:42 +00:00
|
|
|
dontaudit $1 krb5kdc_conf_t:dir list_dir_perms;
|
2007-02-26 17:04:56 +00:00
|
|
|
dontaudit $1 krb5kdc_conf_t:file rw_file_perms;
|
2005-08-31 15:25:12 +00:00
|
|
|
|
2005-06-30 21:11:54 +00:00
|
|
|
tunable_policy(`allow_kerberos',`
|
2005-08-31 15:25:12 +00:00
|
|
|
allow $1 self:tcp_socket create_socket_perms;
|
|
|
|
allow $1 self:udp_socket create_socket_perms;
|
2006-05-30 19:46:34 +00:00
|
|
|
|
2007-06-27 15:23:21 +00:00
|
|
|
corenet_all_recvfrom_unlabeled($1)
|
|
|
|
corenet_all_recvfrom_netlabel($1)
|
2005-06-30 21:11:54 +00:00
|
|
|
corenet_tcp_sendrecv_all_if($1)
|
|
|
|
corenet_udp_sendrecv_all_if($1)
|
|
|
|
corenet_tcp_sendrecv_all_nodes($1)
|
|
|
|
corenet_udp_sendrecv_all_nodes($1)
|
|
|
|
corenet_tcp_sendrecv_kerberos_port($1)
|
|
|
|
corenet_udp_sendrecv_kerberos_port($1)
|
|
|
|
corenet_tcp_bind_all_nodes($1)
|
|
|
|
corenet_udp_bind_all_nodes($1)
|
2005-09-16 19:36:10 +00:00
|
|
|
corenet_tcp_connect_kerberos_port($1)
|
2006-12-04 20:10:56 +00:00
|
|
|
corenet_tcp_connect_ocsp_port($1)
|
2006-05-30 19:46:34 +00:00
|
|
|
corenet_sendrecv_kerberos_client_packets($1)
|
2006-12-04 20:10:56 +00:00
|
|
|
corenet_sendrecv_ocsp_client_packets($1)
|
2006-05-30 19:46:34 +00:00
|
|
|
|
2005-06-30 21:11:54 +00:00
|
|
|
sysnet_read_config($1)
|
2005-09-15 21:03:29 +00:00
|
|
|
sysnet_dns_name_resolve($1)
|
2005-06-30 21:11:54 +00:00
|
|
|
')
|
2007-02-16 23:01:42 +00:00
|
|
|
|
|
|
|
optional_policy(`
|
|
|
|
tunable_policy(`allow_kerberos',`
|
|
|
|
pcscd_stream_connect($1)
|
|
|
|
')
|
|
|
|
')
|
2005-06-30 21:11:54 +00:00
|
|
|
')
|
|
|
|
|
|
|
|
########################################
|
|
|
|
## <summary>
|
|
|
|
## Read the kerberos configuration file (/etc/krb5.conf).
|
|
|
|
## </summary>
|
|
|
|
## <param name="domain">
|
2006-02-10 18:41:53 +00:00
|
|
|
## <summary>
|
2005-06-30 21:11:54 +00:00
|
|
|
## Domain allowed access.
|
2006-02-10 18:41:53 +00:00
|
|
|
## </summary>
|
2005-06-30 21:11:54 +00:00
|
|
|
## </param>
|
2006-09-06 22:07:25 +00:00
|
|
|
## <rolecap/>
|
2005-06-30 21:11:54 +00:00
|
|
|
#
|
2005-08-17 14:14:07 +00:00
|
|
|
interface(`kerberos_read_config',`
|
2005-06-30 21:11:54 +00:00
|
|
|
gen_require(`
|
|
|
|
type krb5_conf_t;
|
|
|
|
')
|
|
|
|
|
|
|
|
files_search_etc($1)
|
2006-12-12 20:08:08 +00:00
|
|
|
allow $1 krb5_conf_t:file read_file_perms;
|
2005-06-30 21:11:54 +00:00
|
|
|
')
|
2005-08-17 14:14:07 +00:00
|
|
|
|
2005-09-20 18:49:13 +00:00
|
|
|
########################################
|
|
|
|
## <summary>
|
|
|
|
## Do not audit attempts to write the kerberos
|
|
|
|
## configuration file (/etc/krb5.conf).
|
|
|
|
## </summary>
|
|
|
|
## <param name="domain">
|
2006-02-10 18:41:53 +00:00
|
|
|
## <summary>
|
2005-09-20 18:49:13 +00:00
|
|
|
## Domain to not audit.
|
2006-02-10 18:41:53 +00:00
|
|
|
## </summary>
|
2005-09-20 18:49:13 +00:00
|
|
|
## </param>
|
|
|
|
#
|
|
|
|
interface(`kerberos_dontaudit_write_config',`
|
|
|
|
gen_require(`
|
|
|
|
type krb5_conf_t;
|
|
|
|
')
|
|
|
|
|
|
|
|
dontaudit $1 krb5_conf_t:file write;
|
|
|
|
')
|
|
|
|
|
2005-08-17 14:14:07 +00:00
|
|
|
########################################
|
|
|
|
## <summary>
|
|
|
|
## Read and write the kerberos configuration file (/etc/krb5.conf).
|
|
|
|
## </summary>
|
|
|
|
## <param name="domain">
|
2006-02-10 18:41:53 +00:00
|
|
|
## <summary>
|
2005-08-17 14:14:07 +00:00
|
|
|
## Domain allowed access.
|
2006-02-10 18:41:53 +00:00
|
|
|
## </summary>
|
2005-08-17 14:14:07 +00:00
|
|
|
## </param>
|
2006-09-06 22:07:25 +00:00
|
|
|
## <rolecap/>
|
2005-08-17 14:14:07 +00:00
|
|
|
#
|
|
|
|
interface(`kerberos_rw_config',`
|
|
|
|
gen_require(`
|
|
|
|
type krb5_conf_t;
|
|
|
|
')
|
|
|
|
|
|
|
|
files_search_etc($1)
|
|
|
|
allow $1 krb5_conf_t:file rw_file_perms;
|
|
|
|
')
|
2005-09-20 17:11:53 +00:00
|
|
|
|
|
|
|
########################################
|
|
|
|
## <summary>
|
|
|
|
## Read the kerberos key table.
|
|
|
|
## </summary>
|
|
|
|
## <param name="domain">
|
2006-02-10 18:41:53 +00:00
|
|
|
## <summary>
|
2005-09-20 17:11:53 +00:00
|
|
|
## Domain allowed access.
|
2006-02-10 18:41:53 +00:00
|
|
|
## </summary>
|
2005-09-20 17:11:53 +00:00
|
|
|
## </param>
|
2006-09-06 22:07:25 +00:00
|
|
|
## <rolecap/>
|
2005-09-20 17:11:53 +00:00
|
|
|
#
|
|
|
|
interface(`kerberos_read_keytab',`
|
|
|
|
gen_require(`
|
|
|
|
type krb5_keytab_t;
|
|
|
|
')
|
|
|
|
|
|
|
|
files_search_etc($1)
|
2006-12-12 20:08:08 +00:00
|
|
|
allow $1 krb5_keytab_t:file read_file_perms;
|
2005-09-20 17:11:53 +00:00
|
|
|
')
|
2007-04-10 17:20:07 +00:00
|
|
|
|
|
|
|
########################################
|
|
|
|
## <summary>
|
|
|
|
## Read the kerberos kdc configuration file (/etc/krb5kdc.conf).
|
|
|
|
## </summary>
|
|
|
|
## <param name="domain">
|
|
|
|
## <summary>
|
|
|
|
## Domain allowed access.
|
|
|
|
## </summary>
|
|
|
|
## </param>
|
|
|
|
## <rolecap/>
|
|
|
|
#
|
|
|
|
interface(`kerberos_read_kdc_config',`
|
|
|
|
gen_require(`
|
|
|
|
type krb5kdc_conf_t;
|
|
|
|
')
|
|
|
|
|
|
|
|
files_search_etc($1)
|
|
|
|
allow $1 krb5kdc_conf_t:file read_file_perms;
|
|
|
|
|
|
|
|
')
|