selinux-policy/policy/modules/services/rpc.if

443 lines
9.1 KiB
Plaintext
Raw Normal View History

2005-10-24 01:53:13 +00:00
## <summary>Remote Procedure Call Daemon for managment of network based process communication</summary>
2006-09-13 14:23:04 +00:00
########################################
## <summary>
## RPC stub interface. No access allowed.
## </summary>
2008-06-24 14:43:47 +00:00
## <param name="domain" unused="true">
2006-09-13 14:23:04 +00:00
## <summary>
2008-06-24 14:43:47 +00:00
## Domain allowed access.
2006-09-13 14:23:04 +00:00
## </summary>
## </param>
#
interface(`rpc_stub',`
gen_require(`
type exports_t;
')
')
2005-10-24 01:53:13 +00:00
#######################################
## <summary>
## The template to define a rpc domain.
## </summary>
## <desc>
## <p>
## This template creates a domain to be used for
## a new rpc daemon.
## </p>
## </desc>
## <param name="userdomain_prefix">
## <summary>
2005-10-24 01:53:13 +00:00
## The type of daemon to be used.
## </summary>
2005-10-24 01:53:13 +00:00
## </param>
#
template(`rpc_domain_template',`
2010-09-21 10:03:10 +00:00
gen_require(`
type var_lib_nfs_t;
')
2005-10-24 01:53:13 +00:00
########################################
#
# Declarations
#
type $1_t;
type $1_exec_t;
init_daemon_domain($1_t, $1_exec_t)
2006-02-20 21:33:25 +00:00
domain_use_interactive_fds($1_t)
2005-10-24 01:53:13 +00:00
####################################
#
# Local Policy
#
dontaudit $1_t self:capability { net_admin sys_tty_config };
allow $1_t self:capability net_bind_service;
allow $1_t self:process signal_perms;
allow $1_t self:unix_dgram_socket create_socket_perms;
allow $1_t self:unix_stream_socket create_stream_socket_perms;
allow $1_t self:tcp_socket create_stream_socket_perms;
allow $1_t self:udp_socket create_socket_perms;
manage_dirs_pattern($1_t, var_lib_nfs_t, var_lib_nfs_t)
manage_files_pattern($1_t, var_lib_nfs_t, var_lib_nfs_t)
2005-10-24 01:53:13 +00:00
kernel_list_proc($1_t)
kernel_read_proc_symlinks($1_t)
kernel_read_kernel_sysctls($1_t)
2005-10-24 01:53:13 +00:00
# bind to arbitary unused ports
kernel_rw_rpc_sysctls($1_t)
2005-10-24 01:53:13 +00:00
dev_read_sysfs($1_t)
dev_read_urand($1_t)
dev_read_rand($1_t)
2005-10-24 01:53:13 +00:00
corenet_all_recvfrom_unlabeled($1_t)
corenet_all_recvfrom_netlabel($1_t)
corenet_tcp_sendrecv_generic_if($1_t)
corenet_udp_sendrecv_generic_if($1_t)
corenet_tcp_sendrecv_generic_node($1_t)
corenet_udp_sendrecv_generic_node($1_t)
2005-10-24 01:53:13 +00:00
corenet_tcp_sendrecv_all_ports($1_t)
corenet_udp_sendrecv_all_ports($1_t)
corenet_tcp_bind_generic_node($1_t)
corenet_udp_bind_generic_node($1_t)
2005-10-24 01:53:13 +00:00
corenet_tcp_bind_reserved_port($1_t)
corenet_tcp_connect_all_ports($1_t)
2006-05-25 17:56:07 +00:00
corenet_sendrecv_portmap_client_packets($1_t)
2005-10-24 01:53:13 +00:00
# do not log when it tries to bind to a port belonging to another domain
2009-03-19 17:56:10 +00:00
corenet_dontaudit_tcp_bind_all_ports($1_t)
corenet_dontaudit_udp_bind_all_ports($1_t)
2005-10-24 01:53:13 +00:00
# bind to arbitary unused ports
corenet_tcp_bind_generic_port($1_t)
2006-05-26 20:29:51 +00:00
corenet_udp_bind_generic_port($1_t)
2009-03-19 17:56:10 +00:00
corenet_tcp_bind_all_rpc_ports($1_t)
corenet_udp_bind_all_rpc_ports($1_t)
corenet_sendrecv_generic_server_packets($1_t)
2005-10-24 01:53:13 +00:00
2010-04-05 18:26:21 +00:00
fs_rw_rpc_named_pipes($1_t)
2005-10-24 01:53:13 +00:00
fs_search_auto_mountpoints($1_t)
files_read_etc_files($1_t)
files_read_etc_runtime_files($1_t)
files_search_var($1_t)
files_search_var_lib($1_t)
2010-04-05 18:26:21 +00:00
files_list_home($1_t)
2005-10-24 01:53:13 +00:00
auth_use_nsswitch($1_t)
2005-10-24 01:53:13 +00:00
logging_send_syslog_msg($1_t)
miscfiles_read_localization($1_t)
2006-02-20 21:33:25 +00:00
userdom_dontaudit_use_unpriv_user_fds($1_t)
2005-10-24 01:53:13 +00:00
2010-04-05 18:26:21 +00:00
optional_policy(`
rpcbind_stream_connect($1_t)
')
optional_policy(`
2005-10-24 01:53:13 +00:00
seutil_sigchld_newrole($1_t)
')
optional_policy(`
2005-10-24 01:53:13 +00:00
udev_read_db($1_t)
')
')
########################################
## <summary>
2008-12-03 19:16:20 +00:00
## Send UDP network traffic to rpc and recieve UDP traffic from rpc. (Deprecated)
2005-10-24 01:53:13 +00:00
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
2005-10-24 01:53:13 +00:00
## </param>
#
2006-02-02 21:08:12 +00:00
interface(`rpc_udp_send',`
2006-08-15 20:00:58 +00:00
refpolicywarn(`$0($*) has been deprecated.')
2005-10-24 01:53:13 +00:00
')
2005-11-25 17:39:35 +00:00
########################################
## <summary>
2008-12-03 19:16:20 +00:00
## Do not audit attempts to get the attributes
2005-11-25 17:39:35 +00:00
## of the NFS export file.
## </summary>
## <param name="domain">
## <summary>
## Domain to not audit.
## </summary>
2005-11-25 17:39:35 +00:00
## </param>
#
interface(`rpc_dontaudit_getattr_exports',`
gen_require(`
type exports_t;
')
dontaudit $1 exports_t:file getattr_file_perms;
2005-11-25 17:39:35 +00:00
')
2005-10-24 01:53:13 +00:00
########################################
## <summary>
2008-12-03 19:16:20 +00:00
## Allow read access to exports.
2005-10-24 01:53:13 +00:00
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
2005-10-24 01:53:13 +00:00
## </param>
#
interface(`rpc_read_exports',`
gen_require(`
type exports_t;
')
2006-12-12 20:08:08 +00:00
allow $1 exports_t:file read_file_perms;
2005-10-24 01:53:13 +00:00
')
########################################
## <summary>
2008-12-03 19:16:20 +00:00
## Allow write access to exports.
2005-10-24 01:53:13 +00:00
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
2005-10-24 01:53:13 +00:00
## </param>
#
interface(`rpc_write_exports',`
gen_require(`
type exports_t;
')
allow $1 exports_t:file write_file_perms;
2005-10-24 01:53:13 +00:00
')
########################################
## <summary>
2008-12-03 19:16:20 +00:00
## Execute domain in nfsd domain.
2005-10-24 01:53:13 +00:00
## </summary>
## <param name="domain">
## <summary>
## Domain allowed to transition.
## </summary>
2005-10-24 01:53:13 +00:00
## </param>
#
interface(`rpc_domtrans_nfsd',`
gen_require(`
type nfsd_t, nfsd_exec_t;
')
domtrans_pattern($1, nfsd_exec_t, nfsd_t)
2005-10-24 01:53:13 +00:00
')
2010-04-05 18:26:21 +00:00
#######################################
2009-03-19 17:56:10 +00:00
## <summary>
2009-06-26 14:40:13 +00:00
## Execute domain in nfsd domain.
2009-03-19 17:56:10 +00:00
## </summary>
## <param name="domain">
## <summary>
## Domain allowed to transition.
2010-04-05 18:26:21 +00:00
## </summary>
## </param>
#
interface(`rpc_initrc_domtrans_nfsd',`
gen_require(`
type nfsd_initrc_exec_t;
')
init_labeled_script_domtrans($1, nfsd_initrc_exec_t)
')
########################################
## <summary>
## Execute domain in rpcd domain.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed to transition.
2009-03-19 17:56:10 +00:00
## </summary>
## </param>
#
interface(`rpc_domtrans_rpcd',`
gen_require(`
type rpcd_t, rpcd_exec_t;
')
domtrans_pattern($1, rpcd_exec_t, rpcd_t)
allow rpcd_t $1:process signal;
')
2010-08-26 13:41:21 +00:00
########################################
## <summary>
## Execute rpcd in the rcpd domain, and
## allow the specified role the rpcd domain.
## </summary>
## <param name="domain">
## <summary>
## The role to be allowed the rpcd domain.
## </summary>
## </param>
#
interface(`rpc_run_rpcd',`
gen_require(`
type rpcd_t;
')
rpc_domtrans_rpcd($1)
role $2 types rpcd_t;
')
2010-04-05 18:26:21 +00:00
#######################################
## <summary>
## Execute domain in rpcd domain.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed to transition.
2010-04-05 18:26:21 +00:00
## </summary>
## </param>
#
interface(`rpc_initrc_domtrans_rpcd',`
gen_require(`
type rpcd_initrc_exec_t;
')
init_labeled_script_domtrans($1, rpcd_initrc_exec_t)
')
2006-06-14 20:52:45 +00:00
########################################
## <summary>
2008-12-03 19:16:20 +00:00
## Read NFS exported content.
2006-06-14 20:52:45 +00:00
## </summary>
## <param name="domain">
## <summary>
2008-12-03 19:16:20 +00:00
## Domain allowed access.
2006-06-14 20:52:45 +00:00
## </summary>
## </param>
2006-09-06 22:07:25 +00:00
## <rolecap/>
2006-06-14 20:52:45 +00:00
#
interface(`rpc_read_nfs_content',`
gen_require(`
2010-04-05 18:26:21 +00:00
type nfsd_ro_t, nfsd_rw_t;
2006-06-14 20:52:45 +00:00
')
allow $1 { nfsd_ro_t nfsd_rw_t }:dir list_dir_perms;
allow $1 { nfsd_ro_t nfsd_rw_t }:file read_file_perms;
allow $1 { nfsd_ro_t nfsd_rw_t }:lnk_file read_lnk_file_perms;
2006-06-14 20:52:45 +00:00
')
2005-10-24 01:53:13 +00:00
########################################
## <summary>
2008-12-03 19:16:20 +00:00
## Allow domain to create read and write NFS directories.
2005-10-24 01:53:13 +00:00
## </summary>
## <param name="domain">
## <summary>
2008-12-03 19:16:20 +00:00
## Domain allowed access.
## </summary>
2005-10-24 01:53:13 +00:00
## </param>
2006-09-06 22:07:25 +00:00
## <rolecap/>
2005-10-24 01:53:13 +00:00
#
interface(`rpc_manage_nfs_rw_content',`
gen_require(`
2010-04-05 18:26:21 +00:00
type nfsd_rw_t;
2005-10-24 01:53:13 +00:00
')
manage_dirs_pattern($1, nfsd_rw_t, nfsd_rw_t)
manage_files_pattern($1, nfsd_rw_t, nfsd_rw_t)
manage_lnk_files_pattern($1, nfsd_rw_t, nfsd_rw_t)
2005-10-24 01:53:13 +00:00
')
########################################
## <summary>
2008-12-03 19:16:20 +00:00
## Allow domain to create read and write NFS directories.
2005-10-24 01:53:13 +00:00
## </summary>
## <param name="domain">
## <summary>
2008-12-03 19:16:20 +00:00
## Domain allowed access.
## </summary>
2005-10-24 01:53:13 +00:00
## </param>
2006-09-06 22:07:25 +00:00
## <rolecap/>
2005-10-24 01:53:13 +00:00
#
interface(`rpc_manage_nfs_ro_content',`
gen_require(`
2010-04-05 18:26:21 +00:00
type nfsd_ro_t;
2005-10-24 01:53:13 +00:00
')
manage_dirs_pattern($1, nfsd_ro_t, nfsd_ro_t)
manage_files_pattern($1, nfsd_ro_t, nfsd_ro_t)
manage_lnk_files_pattern($1, nfsd_ro_t, nfsd_ro_t)
2005-10-24 01:53:13 +00:00
')
########################################
## <summary>
2008-12-03 19:16:20 +00:00
## Allow domain to read and write to an NFS UDP socket.
2005-10-24 01:53:13 +00:00
## </summary>
## <param name="domain">
## <summary>
2008-12-03 19:16:20 +00:00
## Domain allowed access.
## </summary>
2005-10-24 01:53:13 +00:00
## </param>
#
interface(`rpc_udp_rw_nfs_sockets',`
gen_require(`
2010-04-05 18:26:21 +00:00
type nfsd_t;
2005-10-24 01:53:13 +00:00
')
allow $1 nfsd_t:udp_socket rw_socket_perms;
')
########################################
## <summary>
2006-08-15 20:00:58 +00:00
## Send UDP traffic to NFSd. (Deprecated)
2005-10-24 01:53:13 +00:00
## </summary>
## <param name="domain">
## <summary>
2008-12-03 19:16:20 +00:00
## Domain allowed access.
## </summary>
2005-10-24 01:53:13 +00:00
## </param>
#
2006-02-02 21:08:12 +00:00
interface(`rpc_udp_send_nfs',`
2006-08-15 20:00:58 +00:00
refpolicywarn(`$0($*) has been deprecated.')
2005-10-24 01:53:13 +00:00
')
2005-12-02 22:06:05 +00:00
########################################
## <summary>
## Search NFS state data in /var/lib/nfs.
## </summary>
## <param name="domain">
## <summary>
2008-12-03 19:16:20 +00:00
## Domain allowed access.
## </summary>
2005-12-02 22:06:05 +00:00
## </param>
#
interface(`rpc_search_nfs_state_data',`
gen_require(`
type var_lib_nfs_t;
')
files_search_var_lib($1)
allow $1 var_lib_nfs_t:dir search_dir_perms;
2005-12-02 22:06:05 +00:00
')
2006-06-14 20:52:45 +00:00
########################################
## <summary>
## Read NFS state data in /var/lib/nfs.
## </summary>
## <param name="domain">
## <summary>
2008-12-03 19:16:20 +00:00
## Domain allowed access.
2006-06-14 20:52:45 +00:00
## </summary>
## </param>
#
interface(`rpc_read_nfs_state_data',`
gen_require(`
type var_lib_nfs_t;
')
files_search_var_lib($1)
read_files_pattern($1, var_lib_nfs_t, var_lib_nfs_t)
2006-06-14 20:52:45 +00:00
')
2009-03-19 17:56:10 +00:00
########################################
## <summary>
## Manage NFS state data in /var/lib/nfs.
## </summary>
## <param name="domain">
## <summary>
2009-06-26 14:40:13 +00:00
## Domain allowed access.
2009-03-19 17:56:10 +00:00
## </summary>
## </param>
#
interface(`rpc_manage_nfs_state_data',`
gen_require(`
type var_lib_nfs_t;
')
files_search_var_lib($1)
manage_files_pattern($1, var_lib_nfs_t, var_lib_nfs_t)
allow $1 var_lib_nfs_t:file relabel_file_perms;
2009-03-19 17:56:10 +00:00
')