selinux-policy/refpolicy/policy/modules/services/apache.if

## <summary>Apache web server</summary>

########################################
## <summary>
##	Create a set of derived types for apache
##	web content.
## </summary>
## <param name="prefix">
##	<summary>
##	The prefix to be used for deriving type names.
##	</summary>
## </param>
#
template(`apache_content_template',`
	# allow write access to public file transfer
	# services files.
	gen_tunable(allow_httpd_$1_script_anon_write,false)

	#This type is for webpages
	type httpd_$1_content_t, httpdcontent; # customizable
	files_type(httpd_$1_content_t)

	# This type is used for .htaccess files
	type httpd_$1_htaccess_t; # customizable;
	files_type(httpd_$1_htaccess_t)

	# Type that CGI scripts run as
	type httpd_$1_script_t;
	domain_type(httpd_$1_script_t)
	role system_r types httpd_$1_script_t;

	# This type is used for executable scripts files
	type httpd_$1_script_exec_t; # customizable;
	domain_entry_file(httpd_$1_script_t,httpd_$1_script_exec_t)

	# The following three are the only areas that 
	# scripts can read, read/write, or append to
	type httpd_$1_script_ro_t, httpdcontent; # customizable
	files_type(httpd_$1_script_ro_t)

	type httpd_$1_script_rw_t, httpdcontent; # customizable
	files_type(httpd_$1_script_rw_t)

	type httpd_$1_script_ra_t, httpdcontent; # customizable
	files_type(httpd_$1_script_ra_t)

	allow httpd_t httpd_$1_htaccess_t:file r_file_perms;

	domain_auto_trans(httpd_suexec_t, httpd_$1_script_exec_t, httpd_$1_script_t)
	allow httpd_suexec_t httpd_$1_script_t:fd use;
	allow httpd_$1_script_t httpd_suexec_t:fd use;
	allow httpd_$1_script_t httpd_suexec_t:fifo_file rw_file_perms;
	allow httpd_$1_script_t httpd_suexec_t:process sigchld;

	allow httpd_suexec_t { httpd_$1_content_t httpd_$1_script_ro_t httpd_$1_script_rw_t httpd_$1_script_exec_t }:dir { getattr search };

	allow httpd_$1_script_t self:fifo_file rw_file_perms;
	allow httpd_$1_script_t self:unix_stream_socket connectto;

	allow httpd_$1_script_t httpd_t:fifo_file write;
	# apache should set close-on-exec
	dontaudit httpd_$1_script_t httpd_t:unix_stream_socket { read write };

	# Allow the script process to search the cgi directory, and users directory
	allow httpd_$1_script_t httpd_$1_content_t:dir { getattr search };

	allow httpd_$1_script_t httpd_log_t:file { getattr append };
	allow httpd_$1_script_t httpd_log_t:dir search;
	logging_search_logs(httpd_$1_script_t)

	can_exec(httpd_$1_script_t, httpd_$1_script_exec_t)
	allow httpd_$1_script_t httpd_$1_script_exec_t:dir { search getattr };

	allow httpd_$1_script_t httpd_$1_script_ra_t:dir ra_dir_perms;
	allow httpd_$1_script_t httpd_$1_script_ra_t:file ra_file_perms;
	allow httpd_$1_script_t httpd_$1_script_ra_t:lnk_file { getattr read };

	allow httpd_$1_script_t httpd_$1_script_ro_t:dir { getattr read search };
	allow httpd_$1_script_t httpd_$1_script_ro_t:file { read getattr };
	allow httpd_$1_script_t httpd_$1_script_ro_t:lnk_file { getattr read };

	allow httpd_$1_script_t httpd_$1_script_rw_t:dir create_dir_perms;
	allow httpd_$1_script_t httpd_$1_script_rw_t:file create_file_perms;
	allow httpd_$1_script_t httpd_$1_script_rw_t:lnk_file create_lnk_perms;
	allow httpd_$1_script_t httpd_$1_script_rw_t:sock_file create_file_perms;
	allow httpd_$1_script_t httpd_$1_script_rw_t:fifo_file create_file_perms;
	files_filetrans_tmp(httpd_$1_script_t,httpd_$1_script_rw_t,{ dir file lnk_file sock_file fifo_file })

	kernel_dontaudit_search_sysctl(httpd_$1_script_t)
	kernel_dontaudit_search_kernel_sysctl(httpd_$1_script_t)

	dev_read_rand(httpd_$1_script_t)
	dev_read_urand(httpd_$1_script_t)

	corecmd_exec_bin(httpd_$1_script_t)
	corecmd_exec_sbin(httpd_$1_script_t)

	domain_exec_all_entry_files(httpd_$1_script_t)

	files_exec_etc_files(httpd_$1_script_t)
	files_read_etc_files(httpd_$1_script_t)
	files_search_home(httpd_$1_script_t)

	libs_use_ld_so(httpd_$1_script_t)
	libs_use_shared_libs(httpd_$1_script_t)
	libs_exec_ld_so(httpd_$1_script_t)
	libs_exec_lib_files(httpd_$1_script_t)

	miscfiles_read_fonts(httpd_$1_script_t)
	miscfiles_read_public_files(httpd_$1_script_t)

	seutil_dontaudit_search_config(httpd_$1_script_t)

	tunable_policy(`httpd_enable_cgi && httpd_unified',`
		allow httpd_$1_script_t httpdcontent:dir create_dir_perms;
		allow httpd_$1_script_t httpdcontent:file create_file_perms;
		allow httpd_$1_script_t httpdcontent:lnk_file create_lnk_perms;
		can_exec(httpd_$1_script_t, httpdcontent)
	')

	tunable_policy(`allow_httpd_$1_script_anon_write',`
		miscfiles_manage_public_files(httpd_$1_script_t)
	') 

	# Allow the web server to run scripts and serve pages
	tunable_policy(`httpd_builtin_scripting',`
		allow httpd_t httpd_$1_script_rw_t:dir create_dir_perms;
		allow httpd_t httpd_$1_script_rw_t:file create_file_perms;
		allow httpd_t httpd_$1_script_rw_t:lnk_file create_lnk_perms;
		allow httpd_t httpd_$1_script_rw_t:sock_file rw_file_perms;

		allow httpd_t httpd_$1_script_ra_t:dir ra_dir_perms;
		allow httpd_t httpd_$1_script_ra_t:file ra_file_perms;
		allow httpd_t httpd_$1_script_ra_t:lnk_file { getattr read };

		allow httpd_t httpd_$1_script_ro_t:dir r_dir_perms;
		allow httpd_t httpd_$1_script_ro_t:file r_file_perms;
		allow httpd_t httpd_$1_script_ro_t:lnk_file { getattr read };

		allow httpd_t httpd_$1_content_t:dir r_dir_perms;
		allow httpd_t httpd_$1_content_t:file r_file_perms;
		allow httpd_t httpd_$1_content_t:lnk_file { getattr read };
	')

	tunable_policy(`httpd_enable_cgi',`
		allow httpd_$1_script_t httpd_$1_script_exec_t:file entrypoint;

		# privileged users run the script:
		domain_auto_trans(httpd_exec_scripts, httpd_$1_script_exec_t, httpd_$1_script_t)
		allow httpd_exec_scripts httpd_$1_script_t:fd use;
		allow httpd_$1_script_t httpd_exec_scripts:fd use;
		allow httpd_$1_script_t httpd_exec_scripts:fifo_file rw_file_perms;
		allow httpd_$1_script_t httpd_exec_scripts:process sigchld;

		# apache runs the script:
		domain_auto_trans(httpd_t, httpd_$1_script_exec_t, httpd_$1_script_t)
		allow httpd_t httpd_$1_script_t:fd use;
		allow httpd_$1_script_t httpd_t:fd use;
		allow httpd_$1_script_t httpd_t:fifo_file rw_file_perms;
		allow httpd_$1_script_t httpd_t:process sigchld;

		allow httpd_t httpd_$1_script_t:process { signal sigkill sigstop };
		allow httpd_t httpd_$1_script_exec_t:dir r_dir_perms;
		allow httpd_t httpd_$1_script_exec_t:file r_file_perms;

		allow httpd_$1_script_t self:process signal_perms;
		allow httpd_$1_script_t self:unix_stream_socket create_stream_socket_perms;

		allow httpd_$1_script_t httpd_t:fd use;
		allow httpd_$1_script_t httpd_t:process sigchld;

		kernel_read_system_state(httpd_$1_script_t)

		dev_read_urand(httpd_$1_script_t)

		fs_getattr_xattr_fs(httpd_$1_script_t)

		files_read_etc_runtime_files(httpd_$1_script_t)
		files_read_usr_files(httpd_$1_script_t)

		libs_read_lib_files(httpd_$1_script_t)

		miscfiles_read_localization(httpd_$1_script_t)

		# added back to make sediff nicer
		dev_rw_null(httpd_$1_script_t)
		term_use_controlling_term(httpd_$1_script_t)
		allow httpd_$1_script_t self:dir r_dir_perms;
		allow httpd_$1_script_t self:file r_file_perms;
		allow httpd_$1_script_t self:lnk_file read;
	')

	tunable_policy(`httpd_enable_cgi && httpd_can_network_connect',`
		allow httpd_$1_script_t self:tcp_socket create_stream_socket_perms;
		allow httpd_$1_script_t self:udp_socket create_socket_perms;

		corenet_tcp_sendrecv_all_if(httpd_$1_script_t)
		corenet_udp_sendrecv_all_if(httpd_$1_script_t)
		corenet_raw_sendrecv_all_if(httpd_$1_script_t)
		corenet_tcp_sendrecv_all_nodes(httpd_$1_script_t)
		corenet_udp_sendrecv_all_nodes(httpd_$1_script_t)
		corenet_raw_sendrecv_all_nodes(httpd_$1_script_t)
		corenet_tcp_sendrecv_all_ports(httpd_$1_script_t)
		corenet_udp_sendrecv_all_ports(httpd_$1_script_t)
		corenet_non_ipsec_sendrecv(httpd_$1_script_t)
		corenet_tcp_bind_all_nodes(httpd_$1_script_t)
		corenet_udp_bind_all_nodes(httpd_$1_script_t)
		corenet_tcp_connect_all_ports(httpd_$1_script_t)

		sysnet_read_config(httpd_$1_script_t)
	')

	optional_policy(`mount',`
		tunable_policy(`httpd_enable_cgi && httpd_can_network_connect',`
			mount_send_nfs_client_request(httpd_$1_script_t)
		')
	')


	optional_policy(`mta',`
		mta_send_mail(httpd_$1_script_t)
	')

	optional_policy(`nis',`
		tunable_policy(`httpd_enable_cgi && allow_ypbind',`
			nis_use_ypbind_uncond(httpd_$1_script_t)
		')
	')

	optional_policy(`nscd',`
		nscd_socket_use(httpd_$1_script_t)
	')
')

#######################################
## <summary>
##	The per user domain template for the apache module.
## </summary>
## <desc>
##	<p>
##	This template creates types used for web pages
##	and web cgi to be used from the user home directory.
##	</p>
##	<p>
##	This template is invoked automatically for each user, and
##	generally does not need to be invoked directly
##	by policy writers.
##	</p>
## </desc>
## <param name="userdomain_prefix">
##	<summary>
##	The prefix of the user domain (e.g., user
##	is the prefix for user_t).
##	</summary>
## </param>
## <param name="user_domain">
##	<summary>
##	The type of the user domain.
##	</summary>
## </param>
## <param name="user_role">
##	<summary>
##	The role associated with the user domain.
##	</summary>
## </param>
#
template(`apache_per_userdomain_template', `
	gen_require(`
		attribute httpdcontent, httpd_script_domains;
		attribute httpd_exec_scripts;
		type httpd_t, httpd_suexec_t, httpd_log_t;
	')

	apache_content_template($1)

	typeattribute httpd_$1_content_t httpd_script_domains;
	userdom_home_file($1,httpd_$1_content_t)

	role $3 types httpd_$1_script_t;

	allow $2 httpd_$1_content_t:{ dir file lnk_file } { relabelto relabelfrom };

	allow $2 httpd_$1_htaccess_t:file { create_file_perms relabelto relabelfrom };

	allow $2 httpd_$1_script_ra_t:lnk_file { create_lnk_perms relabelto relabelfrom };
	allow $2 httpd_$1_script_ra_t:dir { create_dir_perms relabelto relabelfrom };
	allow $2 httpd_$1_script_ra_t:file { create_file_perms relabelto relabelfrom };

	allow $2 httpd_$1_script_ro_t:lnk_file { create_lnk_perms relabelto relabelfrom };
	allow $2 httpd_$1_script_ro_t:dir { create_dir_perms relabelto relabelfrom };
	allow $2 httpd_$1_script_ro_t:file { create_file_perms relabelto relabelfrom };

	allow $2 httpd_$1_script_rw_t:lnk_file { create_lnk_perms relabelto relabelfrom };
	allow $2 httpd_$1_script_rw_t:dir { create_dir_perms relabelto relabelfrom };
	allow $2 httpd_$1_script_rw_t:file { create_file_perms relabelto relabelfrom };

	allow $2 httpd_$1_script_exec_t:dir create_dir_perms;
	allow $2 httpd_$1_script_exec_t:file create_file_perms;
	allow $2 httpd_$1_script_exec_t:lnk_file create_lnk_perms;

	allow $2 httpd_$1_script_exec_t:dir { create_dir_perms relabelto relabelfrom };
	allow $2 httpd_$1_script_exec_t:file { create_file_perms relabelto relabelfrom };
	allow $2 httpd_$1_script_exec_t:lnk_file { create_lnk_perms relabelto relabelfrom };

	tunable_policy(`httpd_enable_cgi',`
		# If a user starts a script by hand it gets the proper context
		domain_auto_trans($2, httpd_$1_script_exec_t, httpd_$1_script_t)
		allow $2 httpd_$1_script_t:fd use;
		allow httpd_$1_script_t $2:fd use;
		allow httpd_$1_script_t $2:fifo_file rw_file_perms;
		allow httpd_$1_script_t $2:process sigchld;
	')

	tunable_policy(`httpd_enable_cgi && httpd_unified',`
		allow httpd_$1_script_t httpdcontent:file entrypoint;

		domain_auto_trans($2, httpdcontent, httpd_$1_script_t)
		allow $2 httpd_$1_script_t:fd use;
		allow httpd_$1_script_t $2:fd use;
		allow httpd_$1_script_t $2:fifo_file rw_file_perms;
		allow httpd_$1_script_t $2:process sigchld;
	')

	# allow accessing files/dirs below the users home dir
	tunable_policy(`httpd_enable_homedirs',`
		userdom_search_user_home($1,httpd_t)
		userdom_search_user_home($1,httpd_suexec_t)
		userdom_search_user_home($1,httpd_$1_script_t)
	')
')

########################################
## <summary>
##	Transition to apache.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`apache_domtrans',`
	gen_require(`
		type httpd_t, httpd_exec_t;
	')

	corecmd_search_sbin($1)
	domain_auto_trans($1,httpd_exec_t,httpd_t)

	allow $1 httpd_t:fd use;
	allow httpd_t $1:fd use;
	allow httpd_t $1:fifo_file rw_file_perms;
	allow httpd_t $1:process sigchld;
')

########################################
## <summary>
##	Send a null signal to apache.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`apache_signull',`
	gen_require(`
		type httpd_t;
	')

	allow $1 httpd_t:process signull;
')

########################################
## <summary>
##	Send a SIGCHLD signal to apache.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`apache_sigchld',`
	gen_require(`
		type httpd_t;
	')

	allow $1 httpd_t:process sigchld;
')

########################################
## <summary>
##	Inherit and use file descriptors from Apache.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`apache_use_fd',`
	gen_require(`
		type httpd_t;
	')

	allow $1 httpd_t:fd use;
')

########################################
## <summary>
##	Do not audit attempts to read and write Apache
##	unix domain stream sockets.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`apache_dontaudit_rw_stream_sockets',`
	gen_require(`
		type httpd_t;
	')

	dontaudit $1 httpd_t:unix_stream_socket { read write };
')

########################################
## <summary>
##	Do not audit attempts to read and write Apache
##	TCP sockets.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`apache_dontaudit_rw_tcp_sockets',`
	gen_require(`
		type httpd_t;
	')

	dontaudit $1 httpd_t:tcp_socket { read write };
')

########################################
## <summary>
##	Allow the specified domain to read
##	apache configuration files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`apache_read_config',`
	gen_require(`
		type httpd_config_t;
	')

	files_search_etc($1)
	allow $1 httpd_config_t:dir r_dir_perms;
	allow $1 httpd_config_t:file r_file_perms;
	allow $1 httpd_config_t:lnk_file { getattr read };
')

########################################
## <summary>
##	Execute the Apache helper program with
##	a domain transition.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`apache_domtrans_helper',`
	gen_require(`
		type httpd_helper_t, httpd_helper_exec_t;
	')

	corecmd_search_sbin($1)
	domain_auto_trans($1,httpd_helper_exec_t,httpd_helper_t)

	allow $1 httpd_helper_t:fd use;
	allow httpd_helper_t $1:fd use;
	allow httpd_helper_t $1:fifo_file rw_file_perms;
	allow httpd_helper_t $1:process sigchld;
')

########################################
## <summary>
##	Execute the Apache helper program with
##	a domain transition, and allow the
##	specified role the dmidecode domain.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
## <param name="role">
##	<summary>
##	The role to be allowed the dmidecode domain.
##	</summary>
## </param>
## <param name="terminal">
##	<summary>
##	The type of the terminal allow the dmidecode domain to use.
##	</summary>
## </param>
#
interface(`apache_run_helper',`
	gen_require(`
		type httpd_helper_t;
	')

	apache_domtrans_helper($1)
	role $2 types httpd_helper_t;
	allow httpd_helper_t $3:chr_file rw_term_perms;
')

########################################
## <summary>
##	Allow the specified domain to read
##	apache log files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`apache_read_log',`
	gen_require(`
		type httpd_log_t;
	')

	files_search_var($1)
	allow $1 httpd_log_t:dir r_dir_perms;
	allow $1 httpd_log_t:file r_file_perms;
	allow $1 httpd_log_t:lnk_file { getattr read };
')

########################################
## <summary>
##	Do not audit attempts to append to the
##	Apache logs.
## </summary>
## <param name="domain">
##	<summary>
##	Domain to not audit.
##	</summary>
## </param>
#
interface(`apache_dontaudit_append_log',`
	gen_require(`
		type httpd_log_t;
	')

	dontaudit $1 httpd_log_t:file { getattr append };
')

########################################
## <summary>
##	Do not audit attempts to search Apache
##	module directories.
## </summary>
## <param name="domain">
##	<summary>
##	Domain to not audit.
##	</summary>
## </param>
#
interface(`apache_dontaudit_search_modules',`
	gen_require(`
		type httpd_modules_t;
	')

	allow $1 httpd_modules_t:dir r_dir_perms;
')

########################################
## <summary>
##	Allow the specified domain to list
##	the contents of the apache modules
##	directory.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`apache_list_modules',`
	gen_require(`
		type httpd_modules_t;
	')

	allow $1 httpd_modules_t:dir r_dir_perms;
')

########################################
## <summary>
##	Allow the specified domain to execute
##	apache modules.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`apache_exec_modules',`
	gen_require(`
		type httpd_modules_t;
	')

	allow $1 httpd_modules_t:dir r_dir_perms;
	allow $1 httpd_modules_t:lnk_file r_file_perms;
	can_exec($1,httpd_modules_t)
')

########################################
## <summary>
##	Allow the specified domain to manage
##	apache system content files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
# Note that httpd_sys_content_t is found in /var, /etc, /srv and /usr
interface(`apache_manage_sys_content',`
	gen_require(`
		type httpd_sys_content_t;
	')

	files_search_var($1)
	allow $1 httpd_sys_content_t:dir create_dir_perms;
	allow $1 httpd_sys_content_t:file create_file_perms;
	allow $1 httpd_sys_content_t:lnk_file create_lnk_perms;
')

########################################
## <summary>
##	Execute all web scripts in the system
##	script domain.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
# cjp: this interface specifically added to allow
# sysadm_t to run scripts
interface(`apache_domtrans_sys_script',`
	gen_require(`
		attribute httpdcontent;
		type httpd_sys_script_t;
	')

	tunable_policy(`httpd_enable_cgi && httpd_unified',`
		domain_auto_trans($1, httpdcontent, httpd_sys_script_t)

		allow $1 httpd_sys_script_t:fd use;
		allow httpd_sys_script_t $1:fd use;
		allow httpd_sys_script_t $1:fifo_file rw_file_perms;
		allow httpd_sys_script_t $1:process sigchld;
	')
')

########################################
## <summary>
##	Do not audit attempts to read and write Apache
##	system script unix domain stream sockets.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`apache_dontaudit_rw_sys_script_stream_sockets',`
	gen_require(`
		type httpd_sys_script_t;
	')

	dontaudit $1 httpd_sys_script_t:unix_stream_socket { read write };
')

########################################
## <summary>
##	Execute all user scripts in the user
##	script domain.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`apache_domtrans_all_scripts',`
	gen_require(`
		attribute httpd_exec_scripts;
	')

	typeattribute $1 httpd_exec_scripts;
')

########################################
## <summary>
##	Execute all user scripts in the user
##	script domain.  Add user script domains
##	to the specified role.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
## <param name="role">
##	<summary>
##	The role to be allowed the script domains.
##	</summary>
## </param>
#
# cjp: this is missing the terminal since scripts
# do not output to the terminal
interface(`apache_run_all_scripts',`
	gen_require(`
		attribute httpd_exec_scripts, httpd_script_domains;
	')

	role $2 types httpd_script_domains;
	apache_domtrans_all_scripts($1)
')

########################################
## <summary>
##	Allow the specified domain to read
##	apache squirrelmail data.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`apache_read_squirrelmail_data',`
	gen_require(`
		type httpd_squirrelmail_t;
	')

	allow $1 httpd_squirrelmail_t:file { getattr read };
')

########################################
## <summary>
##	Allow the specified domain to append
##	apache squirrelmail data.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`apache_append_squirrelmail_data',`
	gen_require(`
		type httpd_squirrelmail_t;
	')

	allow $1 httpd_squirrelmail_t:file { getattr append };
')

########################################
## <summary>
##	Search system script state directory.
## </summary>
## <param name="domain">
##	<summary>
##	Domain to not audit.
##	</summary>
## </param>
#
interface(`apache_search_sys_script_state',`
	gen_require(`
		type httpd_sys_script_t;
	')

	allow $1 httpd_sys_script_t:dir search;
')