258 lines
8.2 KiB
Plaintext
258 lines
8.2 KiB
Plaintext
|
#DESC Cups - Common Unix Printing System
|
||
|
|
#
|
||
|
|
# Created cups policy from lpd policy: Russell Coker <russell@coker.com.au>
|
||
|
|
# X-Debian-Packages: cupsys cupsys-client cupsys-bsd
|
||
|
|
# Depends: lpd.te lpr.te
|
||
|
|
|
||
|
|
#################################
|
||
|
|
#
|
||
|
|
# Rules for the cupsd_t domain.
|
||
|
|
#
|
||
|
|
# cupsd_t is the domain of cupsd.
|
||
|
|
# cupsd_exec_t is the type of the cupsd executable.
|
||
|
|
#
|
||
|
|
type ipp_port_t, port_type, reserved_port_type;
|
||
|
|
daemon_domain(cupsd, `, auth_chkpwd, nscd_client_domain')
|
||
|
|
etcdir_domain(cupsd)
|
||
|
|
typealias cupsd_etc_t alias etc_cupsd_t;
|
||
|
|
type cupsd_rw_etc_t, file_type, sysadmfile, usercanread;
|
||
|
|
typealias cupsd_rw_etc_t alias etc_cupsd_rw_t;
|
||
|
|
|
||
|
|
can_network(cupsd_t)
|
||
|
|
logdir_domain(cupsd)
|
||
|
|
|
||
|
|
tmp_domain(cupsd)
|
||
|
|
|
||
|
|
allow cupsd_t devpts_t:dir search;
|
||
|
|
|
||
|
|
allow cupsd_t device_t:lnk_file read;
|
||
|
|
allow cupsd_t printer_device_t:chr_file rw_file_perms;
|
||
|
|
allow cupsd_t urandom_device_t:chr_file { getattr read };
|
||
|
|
dontaudit cupsd_t random_device_t:chr_file ioctl;
|
||
|
|
|
||
|
|
# temporary solution, we need something better
|
||
|
|
allow cupsd_t serial_device:chr_file rw_file_perms;
|
||
|
|
|
||
|
|
r_dir_file(cupsd_t, usbdevfs_t)
|
||
|
|
r_dir_file(cupsd_t, usbfs_t)
|
||
|
|
|
||
|
|
ifdef(`logrotate.te', `
|
||
|
|
domain_auto_trans(logrotate_t, cupsd_exec_t, cupsd_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
ifdef(`inetd.te', `
|
||
|
|
allow inetd_t printer_port_t:tcp_socket name_bind;
|
||
|
|
domain_auto_trans(inetd_t, cupsd_exec_t, cupsd_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
# write to spool
|
||
|
|
allow cupsd_t var_spool_t:dir search;
|
||
|
|
|
||
|
|
# this is not ideal, and allowing setattr access to cupsd_etc_t is wrong
|
||
|
|
file_type_auto_trans(cupsd_t, cupsd_etc_t, cupsd_rw_etc_t, file)
|
||
|
|
file_type_auto_trans(cupsd_t, var_t, cupsd_rw_etc_t, file)
|
||
|
|
allow cupsd_t cupsd_rw_etc_t:dir { setattr rw_dir_perms };
|
||
|
|
allow cupsd_t cupsd_etc_t:file setattr;
|
||
|
|
allow cupsd_t cupsd_etc_t:dir setattr;
|
||
|
|
|
||
|
|
allow cupsd_t { etc_t etc_runtime_t }:file { getattr read ioctl };
|
||
|
|
can_exec(cupsd_t, initrc_exec_t)
|
||
|
|
allow cupsd_t proc_t:file r_file_perms;
|
||
|
|
allow cupsd_t proc_t:dir r_dir_perms;
|
||
|
|
allow cupsd_t self:file { getattr read };
|
||
|
|
read_sysctl(cupsd_t)
|
||
|
|
allow cupsd_t sysctl_dev_t:dir search;
|
||
|
|
allow cupsd_t sysctl_dev_t:file { getattr read };
|
||
|
|
|
||
|
|
# for /etc/printcap
|
||
|
|
dontaudit cupsd_t etc_t:file write;
|
||
|
|
|
||
|
|
# allow cups to execute its backend scripts
|
||
|
|
can_exec(cupsd_t, cupsd_exec_t)
|
||
|
|
allow cupsd_t cupsd_exec_t:dir search;
|
||
|
|
allow cupsd_t cupsd_exec_t:lnk_file read;
|
||
|
|
|
||
|
|
allow cupsd_t self:unix_stream_socket create_socket_perms;
|
||
|
|
allow cupsd_t self:unix_dgram_socket create_socket_perms;
|
||
|
|
allow cupsd_t self:fifo_file rw_file_perms;
|
||
|
|
|
||
|
|
# Use capabilities.
|
||
|
|
allow cupsd_t self:capability { dac_read_search kill setgid setuid fsetid net_bind_service fowner chown dac_override sys_tty_config };
|
||
|
|
dontaudit cupsd_t self:capability net_admin;
|
||
|
|
|
||
|
|
allow cupsd_t self:process setsched;
|
||
|
|
|
||
|
|
# for /var/lib/defoma
|
||
|
|
allow cupsd_t var_lib_t:dir search;
|
||
|
|
r_dir_file(cupsd_t, readable_t)
|
||
|
|
|
||
|
|
# Bind to the cups/ipp port (631).
|
||
|
|
allow cupsd_t ipp_port_t:{ udp_socket tcp_socket } name_bind;
|
||
|
|
|
||
|
|
can_tcp_connect(web_client_domain, cupsd_t)
|
||
|
|
can_tcp_connect(cupsd_t, cupsd_t)
|
||
|
|
|
||
|
|
# Send to portmap.
|
||
|
|
ifdef(`portmap.te', `
|
||
|
|
can_udp_send(cupsd_t, portmap_t)
|
||
|
|
can_udp_send(portmap_t, cupsd_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
# Write to /var/spool/cups.
|
||
|
|
allow cupsd_t print_spool_t:dir { setattr rw_dir_perms };
|
||
|
|
allow cupsd_t print_spool_t:file create_file_perms;
|
||
|
|
allow cupsd_t print_spool_t:file rw_file_perms;
|
||
|
|
|
||
|
|
# Filter scripts may be shell scripts, and may invoke progs like /bin/mktemp
|
||
|
|
allow cupsd_t { bin_t sbin_t }:dir { search getattr };
|
||
|
|
allow cupsd_t bin_t:lnk_file read;
|
||
|
|
can_exec(cupsd_t, { shell_exec_t bin_t sbin_t })
|
||
|
|
|
||
|
|
# They will also invoke ghostscript, which needs to read fonts
|
||
|
|
r_dir_file(cupsd_t, fonts_t)
|
||
|
|
|
||
|
|
# Read /usr/lib/gconv/gconv-modules.* and /usr/lib/python2.2/.*
|
||
|
|
allow cupsd_t lib_t:file { read getattr };
|
||
|
|
|
||
|
|
# read python modules
|
||
|
|
allow cupsd_t usr_t:{ file lnk_file } { read getattr ioctl };
|
||
|
|
|
||
|
|
#
|
||
|
|
# lots of errors generated requiring the following
|
||
|
|
#
|
||
|
|
allow cupsd_t self:netlink_route_socket { bind create getattr nlmsg_read read write };
|
||
|
|
#
|
||
|
|
# Satisfy readahead
|
||
|
|
#
|
||
|
|
allow initrc_t cupsd_log_t:file { getattr read };
|
||
|
|
r_dir_file(cupsd_t, var_t)
|
||
|
|
|
||
|
|
r_dir_file(cupsd_t, usercanread)
|
||
|
|
ifdef(`samba.te', `
|
||
|
|
rw_dir_file(cupsd_t, samba_var_t)
|
||
|
|
allow smbd_t cupsd_etc_t:dir search;
|
||
|
|
')
|
||
|
|
|
||
|
|
ifdef(`pam.te', `
|
||
|
|
dontaudit cupsd_t pam_var_run_t:file { getattr read };
|
||
|
|
')
|
||
|
|
dontaudit cupsd_t { sysadm_home_dir_t staff_home_dir_t }:dir { getattr search };
|
||
|
|
# PTAL
|
||
|
|
daemon_domain(ptal)
|
||
|
|
etcdir_domain(ptal)
|
||
|
|
allow ptal_t ptal_var_run_t:fifo_file create_file_perms;
|
||
|
|
allow ptal_t ptal_var_run_t:sock_file create_file_perms;
|
||
|
|
allow ptal_t self:capability chown;
|
||
|
|
allow ptal_t self:{ unix_dgram_socket unix_stream_socket } create_socket_perms;
|
||
|
|
allow ptal_t self:unix_stream_socket { listen accept };
|
||
|
|
allow ptal_t self:fifo_file rw_file_perms;
|
||
|
|
allow ptal_t device_t:dir read;
|
||
|
|
allow ptal_t printer_device_t:chr_file { ioctl read write };
|
||
|
|
allow initrc_t printer_device_t:chr_file getattr;
|
||
|
|
allow ptal_t { etc_t etc_runtime_t }:file { getattr read };
|
||
|
|
r_dir_file(ptal_t, usbdevfs_t)
|
||
|
|
r_dir_file(ptal_t, usbfs_t)
|
||
|
|
allow cupsd_t ptal_var_run_t:sock_file { write setattr };
|
||
|
|
allow cupsd_t ptal_t:unix_stream_socket connectto;
|
||
|
|
allow cupsd_t ptal_var_run_t:dir search;
|
||
|
|
dontaudit ptal_t { sysadm_home_dir_t staff_home_dir_t }:dir { getattr search };
|
||
|
|
|
||
|
|
allow initrc_t ptal_var_run_t:dir rmdir;
|
||
|
|
allow initrc_t ptal_var_run_t:fifo_file unlink;
|
||
|
|
|
||
|
|
dontaudit cupsd_t selinux_config_t:dir search;
|
||
|
|
dontaudit cupsd_t selinux_config_t:file { getattr read };
|
||
|
|
|
||
|
|
allow cupsd_t printconf_t:file { getattr read };
|
||
|
|
|
||
|
|
dbusd_client(system, cupsd)
|
||
|
|
|
||
|
|
ifdef(`hald.te', `
|
||
|
|
|
||
|
|
# CUPS configuration daemon
|
||
|
|
daemon_domain(cupsd_config)
|
||
|
|
|
||
|
|
allow cupsd_config_t devpts_t:dir search;
|
||
|
|
|
||
|
|
ifdef(`distro_redhat', `
|
||
|
|
ifdef(`rpm.te', `
|
||
|
|
allow cupsd_config_t rpm_var_lib_t:dir { getattr search };
|
||
|
|
allow cupsd_config_t rpm_var_lib_t:file { getattr read };
|
||
|
|
')
|
||
|
|
allow cupsd_config_t initrc_exec_t:file getattr;
|
||
|
|
')dnl end distro_redhat
|
||
|
|
|
||
|
|
allow cupsd_config_t { etc_t etc_runtime_t net_conf_t }:file { getattr read };
|
||
|
|
allow cupsd_config_t self:file { getattr read };
|
||
|
|
|
||
|
|
allow cupsd_config_t proc_t:file { getattr read };
|
||
|
|
allow cupsd_config_t cupsd_var_run_t:file { getattr read };
|
||
|
|
allow cupsd_config_t cupsd_t:process { signal };
|
||
|
|
allow cupsd_config_t cupsd_t:{ file lnk_file } { getattr read };
|
||
|
|
can_ps(cupsd_config_t, cupsd_t)
|
||
|
|
|
||
|
|
allow cupsd_config_t self:capability chown;
|
||
|
|
|
||
|
|
rw_dir_create_file(cupsd_config_t, cupsd_etc_t)
|
||
|
|
rw_dir_create_file(cupsd_config_t, cupsd_rw_etc_t)
|
||
|
|
file_type_auto_trans(cupsd_config_t, cupsd_etc_t, cupsd_rw_etc_t, file)
|
||
|
|
|
||
|
|
can_network_tcp(cupsd_config_t)
|
||
|
|
can_tcp_connect(cupsd_config_t, cupsd_t)
|
||
|
|
allow cupsd_config_t self:fifo_file rw_file_perms;
|
||
|
|
|
||
|
|
allow cupsd_config_t self:unix_stream_socket create_socket_perms;
|
||
|
|
ifdef(`dbusd.te', `
|
||
|
|
dbusd_client(system, cupsd_config)
|
||
|
|
allow cupsd_config_t userdomain:dbus send_msg;
|
||
|
|
allow cupsd_config_t system_dbusd_t:dbus { send_msg acquire_svc };
|
||
|
|
allow cupsd_t system_dbusd_t:dbus send_msg;
|
||
|
|
allow userdomain cupsd_config_t:dbus send_msg;
|
||
|
|
allow cupsd_config_t hald_t:dbus send_msg;
|
||
|
|
allow hald_t cupsd_config_t:dbus send_msg;
|
||
|
|
allow cupsd_t userdomain:dbus send_msg;
|
||
|
|
allow cupsd_t hald_t:dbus send_msg;
|
||
|
|
allow hald_t cupsd_t:dbus send_msg;
|
||
|
|
')dnl end if dbusd.te
|
||
|
|
|
||
|
|
can_exec(cupsd_config_t, { bin_t sbin_t shell_exec_t })
|
||
|
|
ifdef(`hostname.te', `
|
||
|
|
can_exec(cupsd_t, hostname_exec_t)
|
||
|
|
can_exec(cupsd_config_t, hostname_exec_t)
|
||
|
|
')
|
||
|
|
allow cupsd_config_t { bin_t sbin_t }:dir { search getattr };
|
||
|
|
allow cupsd_config_t { bin_t sbin_t }:lnk_file read;
|
||
|
|
# killall causes the following
|
||
|
|
dontaudit cupsd_config_t domain:dir { getattr search };
|
||
|
|
dontaudit cupsd_config_t selinux_config_t:dir search;
|
||
|
|
|
||
|
|
can_exec(cupsd_config_t, cupsd_config_exec_t)
|
||
|
|
|
||
|
|
allow cupsd_config_t usr_t:file { getattr read };
|
||
|
|
allow cupsd_config_t var_lib_t:dir { getattr search };
|
||
|
|
allow cupsd_config_t rpm_var_lib_t:file { getattr read };
|
||
|
|
allow cupsd_config_t printconf_t:file { getattr read };
|
||
|
|
|
||
|
|
allow cupsd_config_t urandom_device_t:chr_file { getattr read };
|
||
|
|
|
||
|
|
domain_auto_trans(hald_t, cupsd_config_exec_t, cupsd_config_t)
|
||
|
|
ifdef(`logrotate.te', `
|
||
|
|
allow cupsd_config_t logrotate_t:fd use;
|
||
|
|
')dnl end if logrotate.te
|
||
|
|
allow cupsd_config_t system_crond_t:fd use;
|
||
|
|
allow cupsd_config_t crond_t:fifo_file read;
|
||
|
|
allow cupsd_t crond_t:fifo_file read;
|
||
|
|
|
||
|
|
# Alternatives asks for this
|
||
|
|
allow cupsd_config_t initrc_exec_t:file getattr;
|
||
|
|
') dnl end if hald.te
|
||
|
|
ifdef(`targeted_policy', `
|
||
|
|
can_unix_connect(cupsd_t, initrc_t)
|
||
|
|
allow cupsd_t initrc_t:dbus send_msg;
|
||
|
|
allow initrc_t cupsd_t:dbus send_msg;
|
||
|
|
')
|
||
|
|
|
||
|
|
ifdef(`targeted_policy', `
|
||
|
|
allow cupsd_t unconfined_t:dbus send_msg;
|
||
|
|
')
|