118 lines
3.8 KiB
Plaintext
118 lines
3.8 KiB
Plaintext
|
#DESC kudzu - Red Hat utility to recognise new hardware
|
||
|
|
#
|
||
|
|
# Author: Russell Coker <russell@coker.com.au>
|
||
|
|
#
|
||
|
|
|
||
|
|
daemon_base_domain(kudzu, `, etc_writer, privmodule, sysctl_kernel_writer, fs_domain, privmem')
|
||
|
|
|
||
|
|
read_locale(kudzu_t)
|
||
|
|
|
||
|
|
# for /etc/sysconfig/hwconf - probably need a new type
|
||
|
|
allow kudzu_t etc_runtime_t:file rw_file_perms;
|
||
|
|
|
||
|
|
# for kmodule
|
||
|
|
if (allow_execmem) {
|
||
|
|
allow kudzu_t self:process execmem;
|
||
|
|
}
|
||
|
|
allow kudzu_t zero_device_t:chr_file rx_file_perms;
|
||
|
|
allow kudzu_t memory_device_t:chr_file { read write execute };
|
||
|
|
|
||
|
|
allow kudzu_t ramfs_t:dir search;
|
||
|
|
allow kudzu_t ramfs_t:sock_file write;
|
||
|
|
allow kudzu_t self:capability { dac_override sys_admin sys_rawio net_admin sys_tty_config mknod };
|
||
|
|
allow kudzu_t modules_conf_t:file { getattr read unlink rename };
|
||
|
|
allow kudzu_t modules_object_t:dir r_dir_perms;
|
||
|
|
allow kudzu_t { modules_object_t modules_dep_t }:file { getattr read };
|
||
|
|
allow kudzu_t mouse_device_t:chr_file { read write };
|
||
|
|
allow kudzu_t proc_net_t:dir r_dir_perms;
|
||
|
|
allow kudzu_t { proc_net_t proc_t }:file { getattr read };
|
||
|
|
allow kudzu_t { fixed_disk_device_t removable_device_t }:blk_file rw_file_perms;
|
||
|
|
allow kudzu_t scsi_generic_device_t:chr_file r_file_perms;
|
||
|
|
allow kudzu_t { bin_t sbin_t }:dir { getattr search };
|
||
|
|
allow kudzu_t { bin_t sbin_t }:lnk_file read;
|
||
|
|
read_sysctl(kudzu_t)
|
||
|
|
allow kudzu_t sysctl_dev_t:dir { getattr search read };
|
||
|
|
allow kudzu_t sysctl_dev_t:file { getattr read };
|
||
|
|
allow kudzu_t sysctl_kernel_t:file write;
|
||
|
|
allow kudzu_t usbdevfs_t:dir search;
|
||
|
|
allow kudzu_t usbdevfs_t:file { getattr read };
|
||
|
|
allow kudzu_t usbfs_t:dir search;
|
||
|
|
allow kudzu_t usbfs_t:file { getattr read };
|
||
|
|
var_run_domain(kudzu)
|
||
|
|
allow kudzu_t kernel_t:system syslog_console;
|
||
|
|
allow kudzu_t self:udp_socket { create ioctl };
|
||
|
|
allow kudzu_t var_lock_t:dir search;
|
||
|
|
allow kudzu_t devpts_t:dir search;
|
||
|
|
|
||
|
|
# so it can write messages to the console
|
||
|
|
allow kudzu_t { tty_device_t devtty_t admin_tty_type }:chr_file rw_file_perms;
|
||
|
|
|
||
|
|
role sysadm_r types kudzu_t;
|
||
|
|
ifdef(`targeted_policy', `', `
|
||
|
|
domain_auto_trans(sysadm_t, kudzu_exec_t, kudzu_t)
|
||
|
|
')
|
||
|
|
ifdef(`anaconda.te', `
|
||
|
|
domain_auto_trans(anaconda_t, kudzu_exec_t, kudzu_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
allow kudzu_t sysadm_home_dir_t:dir search;
|
||
|
|
rw_dir_create_file(kudzu_t, etc_t)
|
||
|
|
|
||
|
|
rw_dir_create_file(kudzu_t, mnt_t)
|
||
|
|
can_exec(kudzu_t, { bin_t sbin_t init_exec_t })
|
||
|
|
# Read /usr/lib/gconv/gconv-modules.*
|
||
|
|
allow kudzu_t lib_t:file { read getattr };
|
||
|
|
# Read /usr/share/hwdata/.* and /usr/share/terminfo/l/linux
|
||
|
|
allow kudzu_t usr_t:file { read getattr };
|
||
|
|
r_dir_file(kudzu_t, hwdata_t)
|
||
|
|
|
||
|
|
# Communicate with rhgb-client.
|
||
|
|
allow kudzu_t self:unix_stream_socket { connectto create_stream_socket_perms };
|
||
|
|
allow kudzu_t self:unix_dgram_socket create_socket_perms;
|
||
|
|
|
||
|
|
ifdef(`rhgb.te', `
|
||
|
|
allow kudzu_t rhgb_t:unix_stream_socket connectto;
|
||
|
|
')
|
||
|
|
|
||
|
|
allow kudzu_t self:file { getattr read };
|
||
|
|
allow kudzu_t self:fifo_file rw_file_perms;
|
||
|
|
ifdef(`gpm.te', `
|
||
|
|
allow kudzu_t gpmctl_t:sock_file getattr;
|
||
|
|
')
|
||
|
|
|
||
|
|
can_exec(kudzu_t, shell_exec_t)
|
||
|
|
|
||
|
|
# Write to /proc/sys/kernel/hotplug. Why?
|
||
|
|
allow kudzu_t sysctl_hotplug_t:file { read write };
|
||
|
|
|
||
|
|
allow kudzu_t sysfs_t:dir { getattr read search };
|
||
|
|
allow kudzu_t sysfs_t:file { getattr read };
|
||
|
|
allow kudzu_t sysfs_t:lnk_file read;
|
||
|
|
file_type_auto_trans(kudzu_t, etc_t, etc_runtime_t, file)
|
||
|
|
allow kudzu_t tape_device_t:chr_file r_file_perms;
|
||
|
|
tmp_domain(kudzu, `', `{ file dir chr_file }')
|
||
|
|
|
||
|
|
# for file systems that are not yet mounted
|
||
|
|
dontaudit kudzu_t file_t:dir search;
|
||
|
|
ifdef(`lpd.te', `
|
||
|
|
allow kudzu_t printconf_t:file { getattr read };
|
||
|
|
')
|
||
|
|
ifdef(`cups.te', `
|
||
|
|
allow kudzu_t cupsd_rw_etc_t:dir r_dir_perms;
|
||
|
|
')
|
||
|
|
dontaudit kudzu_t src_t:dir search;
|
||
|
|
ifdef(`xserver.te', `
|
||
|
|
allow kudzu_t xserver_exec_t:file getattr;
|
||
|
|
')
|
||
|
|
|
||
|
|
ifdef(`userhelper.te', `
|
||
|
|
role system_r types sysadm_userhelper_t;
|
||
|
|
domain_auto_trans(kudzu_t, userhelper_exec_t, sysadm_userhelper_t)
|
||
|
|
', `
|
||
|
|
unconfined_domain(kudzu_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
allow kudzu_t initrc_t:unix_stream_socket connectto;
|
||
|
|
allow kudzu_t net_conf_t:file { getattr read };
|
||
|
|
|