2005-04-29 17:45:15 +00:00
|
|
|
#DESC PRELINK - Security Enhanced version of the GNU Prelink
|
|
|
|
|
#
|
|
|
|
|
# Author: Dan Walsh <dwalsh@redhat.com>
|
|
|
|
|
#
|
|
|
|
|
|
|
|
|
|
#################################
|
|
|
|
|
#
|
|
|
|
|
# Rules for the prelink_t domain.
|
|
|
|
|
#
|
|
|
|
|
# prelink_exec_t is the type of the prelink executable.
|
|
|
|
|
#
|
2005-09-12 21:40:56 +00:00
|
|
|
daemon_base_domain(prelink, `, admin, privowner')
|
2005-04-29 17:45:15 +00:00
|
|
|
|
2005-09-12 21:40:56 +00:00
|
|
|
allow prelink_t self:process { execheap execmem execstack };
|
2005-04-29 17:45:15 +00:00
|
|
|
allow prelink_t texrel_shlib_t:file execmod;
|
|
|
|
|
allow prelink_t fs_t:filesystem getattr;
|
|
|
|
|
|
|
|
|
|
ifdef(`crond.te', `
|
|
|
|
|
system_crond_entry(prelink_exec_t, prelink_t)
|
|
|
|
|
allow system_crond_t prelink_log_t:dir rw_dir_perms;
|
|
|
|
|
allow system_crond_t prelink_log_t:file create_file_perms;
|
|
|
|
|
allow system_crond_t prelink_cache_t:file { getattr read unlink };
|
|
|
|
|
allow prelink_t crond_log_t:file append;
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
logdir_domain(prelink)
|
|
|
|
|
type etc_prelink_t, file_type, sysadmfile;
|
|
|
|
|
type var_lock_prelink_t, file_type, sysadmfile, lockfile;
|
|
|
|
|
|
|
|
|
|
allow prelink_t etc_prelink_t:file { getattr read };
|
|
|
|
|
allow prelink_t file_type:dir rw_dir_perms;
|
|
|
|
|
allow prelink_t file_type:lnk_file r_file_perms;
|
|
|
|
|
allow prelink_t file_type:file getattr;
|
2005-09-12 21:40:56 +00:00
|
|
|
allow prelink_t { ifdef(`amanda.te', `amanda_usr_lib_t') admin_passwd_exec_t ifdef(`apache.te', `httpd_modules_t') ifdef(`xserver.te', `xkb_var_lib_t') ld_so_t su_exec_t texrel_shlib_t shlib_t sbin_t bin_t lib_t exec_type }:file { create_file_perms execute relabelto relabelfrom };
|
2005-04-29 17:45:15 +00:00
|
|
|
allow prelink_t ld_so_t:file execute_no_trans;
|
|
|
|
|
|
|
|
|
|
allow prelink_t self:capability { chown dac_override fowner fsetid };
|
|
|
|
|
allow prelink_t self:fifo_file rw_file_perms;
|
|
|
|
|
allow prelink_t self:file { getattr read };
|
|
|
|
|
dontaudit prelink_t sysctl_kernel_t:dir search;
|
|
|
|
|
dontaudit prelink_t sysctl_t:dir search;
|
|
|
|
|
allow prelink_t etc_runtime_t:file { getattr read };
|
|
|
|
|
read_locale(prelink_t)
|
|
|
|
|
allow prelink_t urandom_device_t:chr_file read;
|
|
|
|
|
allow prelink_t proc_t:file { getattr read };
|
|
|
|
|
#
|
|
|
|
|
# prelink_cache_t is the type of /etc/prelink.cache.
|
|
|
|
|
#
|
|
|
|
|
type prelink_cache_t, file_type, sysadmfile;
|
|
|
|
|
file_type_auto_trans(prelink_t, etc_t, prelink_cache_t, file)
|
