rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity
b04a855a22
selinux-policy/policy/modules/services/certmonger.te

84 lines
2.1 KiB
Plaintext
Raw Normal View History

Module version bump for c17ad38 5271920 2a2b6a7 01c4413 c4fbfae a831710 67effb0 483be01 c6c63f6 b0d8d59 5b082e4 b8097d6 689d954 5afc3d3 f3c5e77 a59e50c cf87233 17759c7 dc1db54 e9bf16d 4f95198 bf40792 622c63b c20842c dc7cc4d 792d448
2010-09-15 14:42:34 +00:00
policy_module(certmonger, 1.0.1)
certmonger policy from Dan Walsh Removed manage_var_run and manage_var_lib interfaces Added missing requires to admin interface Removed permissive line Fixed some spacing / style issues
2010-04-09 17:05:52 +00:00
########################################
#
# Declarations
#
type certmonger_t;
type certmonger_exec_t;
init_daemon_domain(certmonger_t, certmonger_exec_t)
type certmonger_initrc_exec_t;
init_script_file(certmonger_initrc_exec_t)
type certmonger_var_run_t;
files_pid_file(certmonger_var_run_t)
type certmonger_var_lib_t;
files_type(certmonger_var_lib_t)
########################################
#
# certmonger local policy
#
allow certmonger_t self:capability { kill sys_nice };
allow certmonger_t self:process { getsched setsched sigkill };
allow certmonger_t self:fifo_file rw_file_perms;
allow certmonger_t self:unix_stream_socket create_stream_socket_perms;
allow certmonger_t self:tcp_socket create_stream_socket_perms;
allow certmonger_t self:netlink_route_socket r_netlink_socket_perms;
Additional whitespace fixes in certmonger.
2010-04-19 14:17:24 +00:00
manage_dirs_pattern(certmonger_t, certmonger_var_lib_t, certmonger_var_lib_t)
manage_files_pattern(certmonger_t, certmonger_var_lib_t, certmonger_var_lib_t)
Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes.
2010-09-22 10:07:37 +00:00
files_var_lib_filetrans(certmonger_t, certmonger_var_lib_t, { file dir })
certmonger policy from Dan Walsh Removed manage_var_run and manage_var_lib interfaces Added missing requires to admin interface Removed permissive line Fixed some spacing / style issues
2010-04-09 17:05:52 +00:00
Additional whitespace fixes in certmonger.
2010-04-19 14:17:24 +00:00
manage_dirs_pattern(certmonger_t, certmonger_var_run_t, certmonger_var_run_t)
manage_files_pattern(certmonger_t, certmonger_var_run_t, certmonger_var_run_t)
Fix some whitespace and style issues.
2010-04-12 19:54:18 +00:00
files_pid_filetrans(certmonger_t, certmonger_var_run_t, { file dir })
certmonger policy from Dan Walsh Removed manage_var_run and manage_var_lib interfaces Added missing requires to admin interface Removed permissive line Fixed some spacing / style issues
2010-04-09 17:05:52 +00:00
corenet_tcp_sendrecv_generic_if(certmonger_t)
corenet_tcp_sendrecv_generic_node(certmonger_t)
corenet_tcp_sendrecv_all_ports(certmonger_t)
corenet_tcp_connect_certmaster_port(certmonger_t)
dev_read_urand(certmonger_t)
Fix some whitespace and style issues.
2010-04-12 19:54:18 +00:00
domain_use_interactive_fds(certmonger_t)
certmonger policy from Dan Walsh Removed manage_var_run and manage_var_lib interfaces Added missing requires to admin interface Removed permissive line Fixed some spacing / style issues
2010-04-09 17:05:52 +00:00
files_read_etc_files(certmonger_t)
files_read_usr_files(certmonger_t)
files_list_tmp(certmonger_t)
logging_send_syslog_msg(certmonger_t)
miscfiles_read_localization(certmonger_t)
Implement miscfiles_cert_type(). This is based on Fedoras' miscfiles_cert_type implementation. The idea was that openvpn needs to be able read home certificates (home_cert_t) which is not implemented in refpolicy yet, as well as generic cert_t certificates. Note that openvpn is allowed to read all cert_types, as i know that it needs access to both generic cert_t as well as (future) home_cert_t. Dwalsh noted that other domains may need this as well but because i do not know exactly which domains i will not changes any other domains call to generic cert type interfaces. Signed-off-by: Dominick Grift <domg472@gmail.com>
2010-09-09 16:14:48 +00:00
miscfiles_manage_generic_cert_files(certmonger_t)
certmonger policy from Dan Walsh Removed manage_var_run and manage_var_lib interfaces Added missing requires to admin interface Removed permissive line Fixed some spacing / style issues
2010-04-09 17:05:52 +00:00
sysnet_dns_name_resolve(certmonger_t)
dontaudit sandbox sending signals to itself. This can happen when they are running at different mcs. Disable transition from dbus_session_domain to telepathy for F14 Allow boinc_project to use shm Allow certmonger to search through directories that contain certs Allow fail2ban the DAC Override so it can read log files owned by non root users
2010-10-07 13:06:56 +00:00
userdom_search_user_home_content(certmonger_t)
optional_policy(`
apache_search_config(certmonger_t)
')
optional_policy(`
bind_search_cache(certmonger_t)
')
certmonger policy from Dan Walsh Removed manage_var_run and manage_var_lib interfaces Added missing requires to admin interface Removed permissive line Fixed some spacing / style issues
2010-04-09 17:05:52 +00:00
optional_policy(`
dbus_system_bus_client(certmonger_t)
dbus_connect_system_bus(certmonger_t)
')
optional_policy(`
kerberos_use(certmonger_t)
')
optional_policy(`
certmonger patch from Dan Walsh
2010-08-30 14:38:54 +00:00
pcscd_stream_connect(certmonger_t)
certmonger policy from Dan Walsh Removed manage_var_run and manage_var_lib interfaces Added missing requires to admin interface Removed permissive line Fixed some spacing / style issues
2010-04-09 17:05:52 +00:00
')
dontaudit sandbox sending signals to itself. This can happen when they are running at different mcs. Disable transition from dbus_session_domain to telepathy for F14 Allow boinc_project to use shm Allow certmonger to search through directories that contain certs Allow fail2ban the DAC Override so it can read log files owned by non root users
2010-10-07 13:06:56 +00:00
Reference in New Issue Copy Permalink