168 lines
4.8 KiB
Plaintext
168 lines
4.8 KiB
Plaintext
|
#DESC Rpcd - RPC daemon
|
||
|
|
#
|
||
|
|
# Authors: Stephen Smalley <sds@epoch.ncsc.mil> and Timothy Fraser
|
||
|
|
# Russell Coker <russell@coker.com.au>
|
||
|
|
# Depends: portmap.te
|
||
|
|
# X-Debian-Packages: nfs-common
|
||
|
|
#
|
||
|
|
|
||
|
|
#################################
|
||
|
|
#
|
||
|
|
# Rules for the rpcd_t and nfsd_t domain.
|
||
|
|
#
|
||
|
|
define(`rpc_domain', `
|
||
|
|
ifdef(`targeted_policy', `
|
||
|
|
daemon_base_domain($1, `, transitionbool')
|
||
|
|
', `
|
||
|
|
daemon_base_domain($1)
|
||
|
|
')
|
||
|
|
can_network($1_t)
|
||
|
|
allow $1_t port_type:tcp_socket name_connect;
|
||
|
|
can_ypbind($1_t)
|
||
|
|
allow $1_t { etc_runtime_t etc_t }:file { getattr read };
|
||
|
|
read_locale($1_t)
|
||
|
|
allow $1_t self:capability net_bind_service;
|
||
|
|
dontaudit $1_t self:capability net_admin;
|
||
|
|
|
||
|
|
allow $1_t var_t:dir { getattr search };
|
||
|
|
allow $1_t var_lib_t:dir search;
|
||
|
|
allow $1_t var_lib_nfs_t:dir create_dir_perms;
|
||
|
|
allow $1_t var_lib_nfs_t:file create_file_perms;
|
||
|
|
# do not log when it tries to bind to a port belonging to another domain
|
||
|
|
dontaudit $1_t reserved_port_type:{ tcp_socket udp_socket } name_bind;
|
||
|
|
allow $1_t reserved_port_t:{ udp_socket tcp_socket } name_bind;
|
||
|
|
allow $1_t self:netlink_route_socket r_netlink_socket_perms;
|
||
|
|
allow $1_t self:unix_dgram_socket create_socket_perms;
|
||
|
|
allow $1_t self:unix_stream_socket create_stream_socket_perms;
|
||
|
|
# bind to arbitary unused ports
|
||
|
|
allow $1_t port_t:{ tcp_socket udp_socket } name_bind;
|
||
|
|
allow $1_t sysctl_rpc_t:dir search;
|
||
|
|
allow $1_t sysctl_rpc_t:file rw_file_perms;
|
||
|
|
')
|
||
|
|
|
||
|
|
type exports_t, file_type, sysadmfile;
|
||
|
|
dontaudit userdomain exports_t:file getattr;
|
||
|
|
|
||
|
|
# rpcd_t is the domain of rpc daemons.
|
||
|
|
# rpcd_exec_t is the type of rpc daemon programs.
|
||
|
|
#
|
||
|
|
rpc_domain(rpcd)
|
||
|
|
var_run_domain(rpcd)
|
||
|
|
allow rpcd_t rpcd_var_run_t:dir setattr;
|
||
|
|
|
||
|
|
# for rpc.rquotad
|
||
|
|
allow rpcd_t sysctl_t:dir r_dir_perms;
|
||
|
|
allow rpcd_t self:fifo_file rw_file_perms;
|
||
|
|
|
||
|
|
# rpcd_t needs to talk to the portmap_t domain
|
||
|
|
can_udp_send(rpcd_t, portmap_t)
|
||
|
|
|
||
|
|
allow initrc_t exports_t:file r_file_perms;
|
||
|
|
ifdef(`distro_redhat', `
|
||
|
|
allow rpcd_t self:capability { chown dac_override setgid setuid };
|
||
|
|
# for /etc/rc.d/init.d/nfs to create /etc/exports
|
||
|
|
allow initrc_t exports_t:file write;
|
||
|
|
')
|
||
|
|
|
||
|
|
allow rpcd_t self:file { getattr read };
|
||
|
|
|
||
|
|
# nfs kernel server needs kernel UDP access. It is less risky and painful
|
||
|
|
# to just give it everything.
|
||
|
|
can_network_server(kernel_t)
|
||
|
|
#can_udp_send(kernel_t, rpcd_t)
|
||
|
|
#can_udp_send(rpcd_t, kernel_t)
|
||
|
|
|
||
|
|
rpc_domain(nfsd)
|
||
|
|
domain_auto_trans(sysadm_t, nfsd_exec_t, nfsd_t)
|
||
|
|
role sysadm_r types nfsd_t;
|
||
|
|
|
||
|
|
# for /proc/fs/nfs/exports - should we have a new type?
|
||
|
|
allow nfsd_t proc_t:file r_file_perms;
|
||
|
|
allow nfsd_t proc_net_t:dir search;
|
||
|
|
allow nfsd_t exports_t:file { getattr read };
|
||
|
|
|
||
|
|
allow nfsd_t nfsd_fs_t:filesystem mount;
|
||
|
|
allow nfsd_t nfsd_fs_t:dir search;
|
||
|
|
allow nfsd_t nfsd_fs_t:file rw_file_perms;
|
||
|
|
allow initrc_t sysctl_rpc_t:dir search;
|
||
|
|
allow initrc_t sysctl_rpc_t:file rw_file_perms;
|
||
|
|
|
||
|
|
type nfsd_rw_t, file_type, sysadmfile, usercanread;
|
||
|
|
type nfsd_ro_t, file_type, sysadmfile, usercanread;
|
||
|
|
|
||
|
|
bool nfs_export_all_rw false;
|
||
|
|
|
||
|
|
if(nfs_export_all_rw) {
|
||
|
|
allow nfsd_t { noexattrfile file_type -shadow_t }:dir r_dir_perms;
|
||
|
|
r_dir_file(kernel_t, noexattrfile)
|
||
|
|
create_dir_file(kernel_t,{ file_type -shadow_t })
|
||
|
|
}
|
||
|
|
|
||
|
|
dontaudit kernel_t shadow_t:file getattr;
|
||
|
|
|
||
|
|
bool nfs_export_all_ro false;
|
||
|
|
|
||
|
|
if(nfs_export_all_ro) {
|
||
|
|
allow nfsd_t { noexattrfile file_type -shadow_t }:dir r_dir_perms;
|
||
|
|
r_dir_file(kernel_t,{ noexattrfile file_type -shadow_t })
|
||
|
|
}
|
||
|
|
|
||
|
|
allow nfsd_t { nfsd_rw_t nfsd_ro_t }:dir r_dir_perms;
|
||
|
|
create_dir_file(kernel_t, nfsd_rw_t);
|
||
|
|
r_dir_file(kernel_t, nfsd_ro_t);
|
||
|
|
|
||
|
|
allow kernel_t nfsd_t:udp_socket rw_socket_perms;
|
||
|
|
can_udp_send(kernel_t, nfsd_t)
|
||
|
|
can_udp_send(nfsd_t, kernel_t)
|
||
|
|
|
||
|
|
# does not really need this, but it is easier to just allow it
|
||
|
|
allow nfsd_t var_run_t:dir search;
|
||
|
|
|
||
|
|
allow nfsd_t self:capability { sys_admin sys_resource };
|
||
|
|
allow nfsd_t fs_type:filesystem getattr;
|
||
|
|
|
||
|
|
can_udp_send(nfsd_t, portmap_t)
|
||
|
|
can_udp_send(portmap_t, nfsd_t)
|
||
|
|
|
||
|
|
can_tcp_connect(nfsd_t, portmap_t)
|
||
|
|
|
||
|
|
# for exportfs and rpc.mountd
|
||
|
|
allow nfsd_t tmp_t:dir getattr;
|
||
|
|
|
||
|
|
r_dir_file(rpcd_t, rpc_pipefs_t)
|
||
|
|
allow rpcd_t rpc_pipefs_t:sock_file { read write };
|
||
|
|
dontaudit rpcd_t selinux_config_t:dir { search };
|
||
|
|
allow rpcd_t proc_net_t:dir search;
|
||
|
|
|
||
|
|
|
||
|
|
rpc_domain(gssd)
|
||
|
|
can_kerberos(gssd_t)
|
||
|
|
ifdef(`kerberos.te', `
|
||
|
|
allow gssd_t krb5_keytab_t:file r_file_perms;
|
||
|
|
')
|
||
|
|
allow gssd_t urandom_device_t:chr_file { getattr read };
|
||
|
|
r_dir_file(gssd_t, tmp_t)
|
||
|
|
tmp_domain(gssd)
|
||
|
|
allow gssd_t self:fifo_file { read write };
|
||
|
|
r_dir_file(gssd_t, proc_net_t)
|
||
|
|
allow gssd_t rpc_pipefs_t:dir r_dir_perms;
|
||
|
|
allow gssd_t rpc_pipefs_t:sock_file { read write };
|
||
|
|
allow gssd_t rpc_pipefs_t:file r_file_perms;
|
||
|
|
allow gssd_t self:capability { dac_override dac_read_search setuid };
|
||
|
|
allow nfsd_t devtty_t:chr_file rw_file_perms;
|
||
|
|
allow rpcd_t devtty_t:chr_file rw_file_perms;
|
||
|
|
|
||
|
|
bool allow_gssd_read_tmp true;
|
||
|
|
if (allow_gssd_read_tmp) {
|
||
|
|
#
|
||
|
|
#needs to be able to udpate the kerberos ticket file
|
||
|
|
#
|
||
|
|
ifdef(`targeted_policy', `
|
||
|
|
r_dir_file(gssd_t, tmp_t)
|
||
|
|
allow gssd_t tmp_t:file write;
|
||
|
|
', `
|
||
|
|
r_dir_file(gssd_t, user_tmpfile)
|
||
|
|
allow gssd_t user_tmpfile:file write;
|
||
|
|
')
|
||
|
|
}
|