selinux-policy/policy/modules/services/nx.te

policy_module(nx, 1.5.0)

########################################
#
# Declarations
#

type nx_server_t;
type nx_server_exec_t;
domain_type(nx_server_t)
domain_entry_file(nx_server_t, nx_server_exec_t)
domain_user_exemption_target(nx_server_t)
# we need an extra role because nxserver is called from sshd
# cjp: do we really need this?
role nx_server_r types nx_server_t;
allow system_r nx_server_r;

type nx_server_devpts_t;
term_user_pty(nx_server_t, nx_server_devpts_t)

type nx_server_tmp_t;
files_tmp_file(nx_server_tmp_t)

type nx_server_var_lib_t;
files_type(nx_server_var_lib_t)

type nx_server_var_run_t;
files_pid_file(nx_server_var_run_t)

type nx_server_home_ssh_t;
files_type(nx_server_home_ssh_t)

########################################
#
# NX server local policy
#

allow nx_server_t self:fifo_file rw_fifo_file_perms;
allow nx_server_t self:tcp_socket create_socket_perms;
allow nx_server_t self:udp_socket create_socket_perms;

allow nx_server_t nx_server_devpts_t:chr_file { rw_chr_file_perms setattr };
term_create_pty(nx_server_t, nx_server_devpts_t)

manage_dirs_pattern(nx_server_t, nx_server_tmp_t, nx_server_tmp_t)
manage_files_pattern(nx_server_t, nx_server_tmp_t, nx_server_tmp_t)
files_tmp_filetrans(nx_server_t, nx_server_tmp_t, { file dir })

manage_files_pattern(nx_server_t, nx_server_var_lib_t, nx_server_var_lib_t)
manage_dirs_pattern(nx_server_t, nx_server_var_lib_t, nx_server_var_lib_t)
files_var_lib_filetrans(nx_server_t, nx_server_var_lib_t, { file dir })

manage_files_pattern(nx_server_t, nx_server_var_run_t, nx_server_var_run_t)
files_pid_filetrans(nx_server_t, nx_server_var_run_t, file)

manage_dirs_pattern(nx_server_t, nx_server_home_ssh_t, nx_server_home_ssh_t)
manage_files_pattern(nx_server_t, nx_server_home_ssh_t, nx_server_home_ssh_t)

kernel_read_system_state(nx_server_t)
kernel_read_kernel_sysctls(nx_server_t)

# nxserver is a shell script --> call other programs
corecmd_exec_shell(nx_server_t)
corecmd_exec_bin(nx_server_t)

corenet_all_recvfrom_unlabeled(nx_server_t)
corenet_all_recvfrom_netlabel(nx_server_t)
corenet_tcp_sendrecv_generic_if(nx_server_t)
corenet_udp_sendrecv_generic_if(nx_server_t)
corenet_tcp_sendrecv_generic_node(nx_server_t)
corenet_udp_sendrecv_generic_node(nx_server_t)
corenet_tcp_sendrecv_all_ports(nx_server_t)
corenet_udp_sendrecv_all_ports(nx_server_t)
corenet_tcp_connect_all_ports(nx_server_t)
corenet_sendrecv_all_client_packets(nx_server_t)

dev_read_urand(nx_server_t)

files_read_etc_files(nx_server_t)
files_read_etc_runtime_files(nx_server_t)
# for reading the config files; maybe a separate type, 
# but users need to be able to also read the config
files_read_usr_files(nx_server_t)

miscfiles_read_localization(nx_server_t)

seutil_dontaudit_search_config(nx_server_t)

sysnet_read_config(nx_server_t)

ifdef(`TODO',`
# clients already have create permissions; the nxclient wants to also have unlink rights
allow userdomain xdm_tmp_t:sock_file unlink;
# for a lockfile created by the client process
allow nx_server_t user_tmpfile:file getattr;
')

########################################
#
# SSH component local policy
#

ssh_basic_client_template(nx_server, nx_server_t, nx_server_r)
Bump module versions for release. 2010-05-24 19:32:01 +00:00			`policy_module(nx, 1.5.0)`
add nx, bug 1535 2006-05-09 15:12:17 +00:00
			`########################################`
			`#`
			`# Declarations`
			`#`

			`type nx_server_t;`
			`type nx_server_exec_t;`
			`domain_type(nx_server_t)`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`domain_entry_file(nx_server_t, nx_server_exec_t)`
add nx, bug 1535 2006-05-09 15:12:17 +00:00			`domain_user_exemption_target(nx_server_t)`
			`# we need an extra role because nxserver is called from sshd`
			`# cjp: do we really need this?`
			`role nx_server_r types nx_server_t;`
			`allow system_r nx_server_r;`

			`type nx_server_devpts_t;`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`term_user_pty(nx_server_t, nx_server_devpts_t)`
add nx, bug 1535 2006-05-09 15:12:17 +00:00
			`type nx_server_tmp_t;`
			`files_tmp_file(nx_server_tmp_t)`

nx patch from Dan Walsh Edits: - Style and whitespace fixes - Removed read_lnk_files_pattern from nx_read_home_files - Delete declaration of nx_server_home_ssh_t and files_type since the template already does this 2010-05-07 13:50:48 +00:00			`type nx_server_var_lib_t;`
			`files_type(nx_server_var_lib_t)`

add nx, bug 1535 2006-05-09 15:12:17 +00:00			`type nx_server_var_run_t;`
			`files_pid_file(nx_server_var_run_t)`

UPdate for f14 policy 2010-08-26 13:41:21 +00:00			`type nx_server_home_ssh_t;`
			`files_type(nx_server_home_ssh_t)`

add nx, bug 1535 2006-05-09 15:12:17 +00:00			`########################################`
			`#`
			`# NX server local policy`
			`#`

trunk: Enable open permission checks policy capability. 2008-10-16 16:09:20 +00:00			`allow nx_server_t self:fifo_file rw_fifo_file_perms;`
add nx, bug 1535 2006-05-09 15:12:17 +00:00			`allow nx_server_t self:tcp_socket create_socket_perms;`
			`allow nx_server_t self:udp_socket create_socket_perms;`

merge policy patterns to trunk 2006-12-12 20:08:08 +00:00			`allow nx_server_t nx_server_devpts_t:chr_file { rw_chr_file_perms setattr };`
trunk: whitespace fixes 2009-06-26 14:40:13 +00:00			`term_create_pty(nx_server_t, nx_server_devpts_t)`
add nx, bug 1535 2006-05-09 15:12:17 +00:00
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`manage_dirs_pattern(nx_server_t, nx_server_tmp_t, nx_server_tmp_t)`
			`manage_files_pattern(nx_server_t, nx_server_tmp_t, nx_server_tmp_t)`
add nx, bug 1535 2006-05-09 15:12:17 +00:00			`files_tmp_filetrans(nx_server_t, nx_server_tmp_t, { file dir })`

nx patch from Dan Walsh Edits: - Style and whitespace fixes - Removed read_lnk_files_pattern from nx_read_home_files - Delete declaration of nx_server_home_ssh_t and files_type since the template already does this 2010-05-07 13:50:48 +00:00			`manage_files_pattern(nx_server_t, nx_server_var_lib_t, nx_server_var_lib_t)`
			`manage_dirs_pattern(nx_server_t, nx_server_var_lib_t, nx_server_var_lib_t)`
			`files_var_lib_filetrans(nx_server_t, nx_server_var_lib_t, { file dir })`

trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`manage_files_pattern(nx_server_t, nx_server_var_run_t, nx_server_var_run_t)`
			`files_pid_filetrans(nx_server_t, nx_server_var_run_t, file)`
add nx, bug 1535 2006-05-09 15:12:17 +00:00
UPdate for f14 policy 2010-08-26 13:41:21 +00:00			`manage_dirs_pattern(nx_server_t, nx_server_home_ssh_t, nx_server_home_ssh_t)`
			`manage_files_pattern(nx_server_t, nx_server_home_ssh_t, nx_server_home_ssh_t)`

add nx, bug 1535 2006-05-09 15:12:17 +00:00			`kernel_read_system_state(nx_server_t)`
			`kernel_read_kernel_sysctls(nx_server_t)`

			`# nxserver is a shell script --> call other programs`
			`corecmd_exec_shell(nx_server_t)`
			`corecmd_exec_bin(nx_server_t)`

trunk: Unified labeled networking policy from Paul Moore. The latest revision of the labeled policy patches which enable both labeled and unlabeled policy support for NetLabel. This revision takes into account Chris' feedback from the first version and reduces the number of interface calls in each domain down to two at present: one for unlabeled access, one for NetLabel access. The older, transport layer specific interfaces, are still present for use by third-party modules but are not used in the default policy modules. trunk: Use netmsg initial SID for MLS-only Netlabel packets, from Paul Moore. This patch changes the policy to use the netmsg initial SID as the "base" SID/context for NetLabel packets which only have MLS security attributes. Currently we use the unlabeled initial SID which makes it very difficult to distinquish between actual unlabeled packets and those packets which have MLS security attributes. 2007-06-27 15:23:21 +00:00			`corenet_all_recvfrom_unlabeled(nx_server_t)`
			`corenet_all_recvfrom_netlabel(nx_server_t)`
add nx, bug 1535 2006-05-09 15:12:17 +00:00			`corenet_tcp_sendrecv_generic_if(nx_server_t)`
			`corenet_udp_sendrecv_generic_if(nx_server_t)`
trunk: Remove node definitions and change node usage to generic nodes. 2009-01-09 19:48:02 +00:00			`corenet_tcp_sendrecv_generic_node(nx_server_t)`
			`corenet_udp_sendrecv_generic_node(nx_server_t)`
add nx, bug 1535 2006-05-09 15:12:17 +00:00			`corenet_tcp_sendrecv_all_ports(nx_server_t)`
			`corenet_udp_sendrecv_all_ports(nx_server_t)`
			`corenet_tcp_connect_all_ports(nx_server_t)`
packets for services 2006-05-30 19:46:34 +00:00			`corenet_sendrecv_all_client_packets(nx_server_t)`
add nx, bug 1535 2006-05-09 15:12:17 +00:00
			`dev_read_urand(nx_server_t)`

			`files_read_etc_files(nx_server_t)`
			`files_read_etc_runtime_files(nx_server_t)`
			`# for reading the config files; maybe a separate type,`
			`# but users need to be able to also read the config`
			`files_read_usr_files(nx_server_t)`

			`miscfiles_read_localization(nx_server_t)`

			`seutil_dontaudit_search_config(nx_server_t)`

			`sysnet_read_config(nx_server_t)`

			ifdef(`TODO',`
			`# clients already have create permissions; the nxclient wants to also have unlink rights`
			`allow userdomain xdm_tmp_t:sock_file unlink;`
			`# for a lockfile created by the client process`
			`allow nx_server_t user_tmpfile:file getattr;`
			`')`

			`########################################`
			`#`
			`# SSH component local policy`
			`#`

trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`ssh_basic_client_template(nx_server, nx_server_t, nx_server_r)`