selinux-policy/policy/modules/services/bind.te

policy_module(bind, 1.11.0)

########################################
#
# Declarations
#

## <desc>
## <p>
## Allow BIND to write the master zone files.
## Generally this is used for dynamic DNS or zone transfers.
## </p>
## </desc>
gen_tunable(named_write_master_zones, false)

# for DNSSEC key files
type dnssec_t;
files_security_file(dnssec_t)

type named_t;
type named_exec_t;
init_daemon_domain(named_t, named_exec_t)
role system_r types named_t;

type named_checkconf_exec_t;
init_system_domain(named_t, named_checkconf_exec_t)

# A type for configuration files of named.
type named_conf_t;
files_type(named_conf_t)
files_mountpoint(named_conf_t)

# for secondary zone files
type named_cache_t;
files_type(named_cache_t)

type named_initrc_exec_t;
init_script_file(named_initrc_exec_t)

type named_log_t;
logging_log_file(named_log_t)

type named_tmp_t;
files_tmp_file(named_tmp_t)

type named_var_run_t;
files_pid_file(named_var_run_t)

# for primary zone files
type named_zone_t;
files_type(named_zone_t)

type ndc_t;
type ndc_exec_t;
init_system_domain(ndc_t, ndc_exec_t)
role system_r types ndc_t;

########################################
#
# Named local policy
#

allow named_t self:capability { chown dac_override fowner setgid setuid sys_chroot sys_nice sys_resource };
dontaudit named_t self:capability sys_tty_config;
allow named_t self:process { setsched getcap setcap setrlimit signal_perms };
allow named_t self:fifo_file rw_fifo_file_perms;
allow named_t self:unix_stream_socket create_stream_socket_perms;
allow named_t self:unix_dgram_socket create_socket_perms;
allow named_t self:tcp_socket create_stream_socket_perms;
allow named_t self:udp_socket create_socket_perms;

allow named_t dnssec_t:file read_file_perms;

# read configuration
allow named_t named_conf_t:dir list_dir_perms;
read_files_pattern(named_t, named_conf_t, named_conf_t)
read_lnk_files_pattern(named_t, named_conf_t, named_conf_t)

# write cache for secondary zones
manage_files_pattern(named_t, named_cache_t, named_cache_t)
manage_lnk_files_pattern(named_t, named_cache_t, named_cache_t)

can_exec(named_t, named_exec_t)

manage_files_pattern(named_t, named_log_t, named_log_t)
logging_log_filetrans(named_t, named_log_t, { file dir })

manage_dirs_pattern(named_t, named_tmp_t, named_tmp_t)
manage_files_pattern(named_t, named_tmp_t, named_tmp_t)
files_tmp_filetrans(named_t, named_tmp_t, { file dir })

manage_files_pattern(named_t, named_var_run_t, named_var_run_t)
manage_sock_files_pattern(named_t, named_var_run_t, named_var_run_t)
files_pid_filetrans(named_t, named_var_run_t, { file sock_file })

# read zone files
allow named_t named_zone_t:dir list_dir_perms;
read_files_pattern(named_t, named_zone_t, named_zone_t)
read_lnk_files_pattern(named_t, named_zone_t, named_zone_t)

kernel_read_kernel_sysctls(named_t)
kernel_read_system_state(named_t)
kernel_read_network_state(named_t)

corecmd_search_bin(named_t)

corenet_all_recvfrom_unlabeled(named_t)
corenet_all_recvfrom_netlabel(named_t)
corenet_tcp_sendrecv_generic_if(named_t)
corenet_udp_sendrecv_generic_if(named_t)
corenet_tcp_sendrecv_generic_node(named_t)
corenet_udp_sendrecv_generic_node(named_t)
corenet_tcp_sendrecv_all_ports(named_t)
corenet_udp_sendrecv_all_ports(named_t)
corenet_tcp_bind_generic_node(named_t)
corenet_udp_bind_generic_node(named_t)
corenet_tcp_bind_dns_port(named_t)
corenet_udp_bind_dns_port(named_t)
corenet_tcp_bind_rndc_port(named_t)
corenet_tcp_connect_all_ports(named_t)
corenet_sendrecv_dns_server_packets(named_t)
corenet_sendrecv_dns_client_packets(named_t)
corenet_sendrecv_rndc_server_packets(named_t)
corenet_sendrecv_rndc_client_packets(named_t)
corenet_dontaudit_udp_bind_all_reserved_ports(named_t)
corenet_udp_bind_all_unreserved_ports(named_t)

dev_read_sysfs(named_t)
dev_read_rand(named_t)
dev_read_urand(named_t)

domain_use_interactive_fds(named_t)

files_read_etc_files(named_t)
files_read_etc_runtime_files(named_t)

fs_getattr_all_fs(named_t)
fs_search_auto_mountpoints(named_t)

auth_use_nsswitch(named_t)

logging_send_syslog_msg(named_t)

miscfiles_read_localization(named_t)
miscfiles_read_generic_certs(named_t)

userdom_dontaudit_use_unpriv_user_fds(named_t)
userdom_dontaudit_search_user_home_dirs(named_t)

tunable_policy(`named_write_master_zones',`
	manage_dirs_pattern(named_t, named_zone_t, named_zone_t)
	manage_files_pattern(named_t, named_zone_t, named_zone_t)
	manage_lnk_files_pattern(named_t, named_zone_t, named_zone_t)
')

optional_policy(`
	init_dbus_chat_script(named_t)

	sysnet_dbus_chat_dhcpc(named_t)

	dbus_system_bus_client(named_t)
	dbus_connect_system_bus(named_t)

	optional_policy(`
		networkmanager_dbus_chat(named_t)
	')
')

optional_policy(`
	kerberos_keytab_template(named, named_t)
')

optional_policy(`
	# this seems like fds that arent being
	# closed. these should probably be
	# dontaudits instead.
	networkmanager_rw_udp_sockets(named_t)
	networkmanager_rw_packet_sockets(named_t)
	networkmanager_rw_routing_sockets(named_t)
')

optional_policy(`
	seutil_sigchld_newrole(named_t)
')

optional_policy(`
	udev_read_db(named_t)
')

########################################
#
# NDC local policy
#

# cjp: why net_admin?!
allow ndc_t self:capability { dac_override net_admin };
allow ndc_t self:process { fork signal_perms };
allow ndc_t self:fifo_file rw_fifo_file_perms;
allow ndc_t self:unix_stream_socket { connect create_stream_socket_perms };
allow ndc_t self:tcp_socket create_socket_perms;
allow ndc_t self:netlink_route_socket r_netlink_socket_perms;

allow ndc_t dnssec_t:file read_file_perms;
allow ndc_t dnssec_t:lnk_file { getattr read };

stream_connect_pattern(ndc_t, named_var_run_t, named_var_run_t, named_t)

allow ndc_t named_conf_t:file read_file_perms;
allow ndc_t named_conf_t:lnk_file { getattr read };

allow ndc_t named_zone_t:dir search_dir_perms;

kernel_read_kernel_sysctls(ndc_t)

corenet_all_recvfrom_unlabeled(ndc_t)
corenet_all_recvfrom_netlabel(ndc_t)
corenet_tcp_sendrecv_generic_if(ndc_t)
corenet_tcp_sendrecv_generic_node(ndc_t)
corenet_tcp_sendrecv_all_ports(ndc_t)
corenet_tcp_bind_generic_node(ndc_t)
corenet_tcp_connect_rndc_port(ndc_t)
corenet_sendrecv_rndc_client_packets(ndc_t)

domain_use_interactive_fds(ndc_t)

files_read_etc_files(ndc_t)
files_search_pids(ndc_t)

fs_getattr_xattr_fs(ndc_t)

init_use_fds(ndc_t)
init_use_script_ptys(ndc_t)

logging_send_syslog_msg(ndc_t)

miscfiles_read_localization(ndc_t)

sysnet_read_config(ndc_t)
sysnet_dns_name_resolve(ndc_t)

userdom_use_user_terminals(ndc_t)

term_dontaudit_use_console(ndc_t)

# for /etc/rndc.key
ifdef(`distro_redhat',`
	allow ndc_t named_conf_t:dir search;
')

optional_policy(`
	nis_use_ypbind(ndc_t)
')

optional_policy(`
	nscd_socket_use(ndc_t)
')

optional_policy(`
	ppp_dontaudit_use_fds(ndc_t)
')
Bump module versions for release. 2010-05-24 19:32:01 +00:00			`policy_module(bind, 1.11.0)`
add bind 2005-08-23 17:26:19 +00:00
			`########################################`
			`#`
			`# Declarations`
			`#`

- Move booleans and tunables to modules when it is only used in a single module. - Add support for tunables and booleans local to a module. 2007-03-26 18:41:45 +00:00			`## <desc>`
			`## <p>`
			`## Allow BIND to write the master zone files.`
trunk: Improve several tunables descriptions from Dan Walsh. 2007-12-07 15:44:53 +00:00			`## Generally this is used for dynamic DNS or zone transfers.`
- Move booleans and tunables to modules when it is only used in a single module. - Add support for tunables and booleans local to a module. 2007-03-26 18:41:45 +00:00			`## </p>`
			`## </desc>`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`gen_tunable(named_write_master_zones, false)`
- Move booleans and tunables to modules when it is only used in a single module. - Add support for tunables and booleans local to a module. 2007-03-26 18:41:45 +00:00
add bind 2005-08-23 17:26:19 +00:00			`# for DNSSEC key files`
start adding secure_file_type implementation 2005-09-28 19:07:22 +00:00			`type dnssec_t;`
			`files_security_file(dnssec_t)`
add bind 2005-08-23 17:26:19 +00:00
			`type named_t;`
			`type named_exec_t;`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`init_daemon_domain(named_t, named_exec_t)`
add bind 2005-08-23 17:26:19 +00:00			`role system_r types named_t;`

more updates 2005-09-15 21:03:29 +00:00			`type named_checkconf_exec_t;`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`init_system_domain(named_t, named_checkconf_exec_t)`
more updates 2005-09-15 21:03:29 +00:00
add bind 2005-08-23 17:26:19 +00:00			`# A type for configuration files of named.`
			`type named_conf_t;`
			`files_type(named_conf_t)`
more merging from 1.27.1-15 2005-10-14 17:55:40 +00:00			`files_mountpoint(named_conf_t)`
add bind 2005-08-23 17:26:19 +00:00
			`# for secondary zone files`
			`type named_cache_t;`
			`files_type(named_cache_t)`

trunk: bind update from dan. 2008-09-15 17:02:57 +00:00			`type named_initrc_exec_t;`
			`init_script_file(named_initrc_exec_t)`

more updates 2005-09-15 21:03:29 +00:00			`type named_log_t;`
			`logging_log_file(named_log_t)`

add bind 2005-08-23 17:26:19 +00:00			`type named_tmp_t;`
			`files_tmp_file(named_tmp_t)`

			`type named_var_run_t;`
			`files_pid_file(named_var_run_t)`

			`# for primary zone files`
			`type named_zone_t;`
			`files_type(named_zone_t)`

			`type ndc_t;`
			`type ndc_exec_t;`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`init_system_domain(ndc_t, ndc_exec_t)`
add bind 2005-08-23 17:26:19 +00:00			`role system_r types ndc_t;`

			`########################################`
			`#`
			`# Named local policy`
			`#`

			`allow named_t self:capability { chown dac_override fowner setgid setuid sys_chroot sys_nice sys_resource };`
			`dontaudit named_t self:capability sys_tty_config;`
trunk: bind update from dan. 2008-09-15 17:02:57 +00:00			`allow named_t self:process { setsched getcap setcap setrlimit signal_perms };`
merge policy patterns to trunk 2006-12-12 20:08:08 +00:00			`allow named_t self:fifo_file rw_fifo_file_perms;`
add bind 2005-08-23 17:26:19 +00:00			`allow named_t self:unix_stream_socket create_stream_socket_perms;`
			`allow named_t self:unix_dgram_socket create_socket_perms;`
			`allow named_t self:tcp_socket create_stream_socket_perms;`
			`allow named_t self:udp_socket create_socket_perms;`

trunk: Enable open permission checks policy capability. 2008-10-16 16:09:20 +00:00			`allow named_t dnssec_t:file read_file_perms;`
add bind 2005-08-23 17:26:19 +00:00
			`# read configuration`
merge policy patterns to trunk 2006-12-12 20:08:08 +00:00			`allow named_t named_conf_t:dir list_dir_perms;`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`read_files_pattern(named_t, named_conf_t, named_conf_t)`
			`read_lnk_files_pattern(named_t, named_conf_t, named_conf_t)`
add bind 2005-08-23 17:26:19 +00:00
			`# write cache for secondary zones`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`manage_files_pattern(named_t, named_cache_t, named_cache_t)`
			`manage_lnk_files_pattern(named_t, named_cache_t, named_cache_t)`
add bind 2005-08-23 17:26:19 +00:00
			`can_exec(named_t, named_exec_t)`

trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`manage_files_pattern(named_t, named_log_t, named_log_t)`
			`logging_log_filetrans(named_t, named_log_t, { file dir })`
more updates 2005-09-15 21:03:29 +00:00
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`manage_dirs_pattern(named_t, named_tmp_t, named_tmp_t)`
			`manage_files_pattern(named_t, named_tmp_t, named_tmp_t)`
another round of renaming 2006-02-21 18:40:44 +00:00			`files_tmp_filetrans(named_t, named_tmp_t, { file dir })`
add bind 2005-08-23 17:26:19 +00:00
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`manage_files_pattern(named_t, named_var_run_t, named_var_run_t)`
			`manage_sock_files_pattern(named_t, named_var_run_t, named_var_run_t)`
			`files_pid_filetrans(named_t, named_var_run_t, { file sock_file })`
add bind 2005-08-23 17:26:19 +00:00
			`# read zone files`
merge policy patterns to trunk 2006-12-12 20:08:08 +00:00			`allow named_t named_zone_t:dir list_dir_perms;`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`read_files_pattern(named_t, named_zone_t, named_zone_t)`
			`read_lnk_files_pattern(named_t, named_zone_t, named_zone_t)`
add bind 2005-08-23 17:26:19 +00:00
renaming from 20060131 interface review, round 2 2006-01-31 16:49:43 +00:00			`kernel_read_kernel_sysctls(named_t)`
add bind 2005-08-23 17:26:19 +00:00			`kernel_read_system_state(named_t)`
			`kernel_read_network_state(named_t)`

trunk: reorganize amanda and bind 2007-10-12 17:50:11 +00:00			`corecmd_search_bin(named_t)`

trunk: Unified labeled networking policy from Paul Moore. The latest revision of the labeled policy patches which enable both labeled and unlabeled policy support for NetLabel. This revision takes into account Chris' feedback from the first version and reduces the number of interface calls in each domain down to two at present: one for unlabeled access, one for NetLabel access. The older, transport layer specific interfaces, are still present for use by third-party modules but are not used in the default policy modules. trunk: Use netmsg initial SID for MLS-only Netlabel packets, from Paul Moore. This patch changes the policy to use the netmsg initial SID as the "base" SID/context for NetLabel packets which only have MLS security attributes. Currently we use the unlabeled initial SID which makes it very difficult to distinquish between actual unlabeled packets and those packets which have MLS security attributes. 2007-06-27 15:23:21 +00:00			`corenet_all_recvfrom_unlabeled(named_t)`
			`corenet_all_recvfrom_netlabel(named_t)`
trunk: change network interface access from all to generic network interfaces. 2009-01-06 20:24:10 +00:00			`corenet_tcp_sendrecv_generic_if(named_t)`
			`corenet_udp_sendrecv_generic_if(named_t)`
trunk: Remove node definitions and change node usage to generic nodes. 2009-01-09 19:48:02 +00:00			`corenet_tcp_sendrecv_generic_node(named_t)`
			`corenet_udp_sendrecv_generic_node(named_t)`
add bind 2005-08-23 17:26:19 +00:00			`corenet_tcp_sendrecv_all_ports(named_t)`
			`corenet_udp_sendrecv_all_ports(named_t)`
trunk: Remove node definitions and change node usage to generic nodes. 2009-01-09 19:48:02 +00:00			`corenet_tcp_bind_generic_node(named_t)`
			`corenet_udp_bind_generic_node(named_t)`
add bind 2005-08-23 17:26:19 +00:00			`corenet_tcp_bind_dns_port(named_t)`
			`corenet_udp_bind_dns_port(named_t)`
more updates 2005-09-15 21:03:29 +00:00			`corenet_tcp_bind_rndc_port(named_t)`
			`corenet_tcp_connect_all_ports(named_t)`
packet updates for kernel, nscd, bind, ntp, spamassassin, and dhcpc 2006-05-26 18:04:46 +00:00			`corenet_sendrecv_dns_server_packets(named_t)`
			`corenet_sendrecv_dns_client_packets(named_t)`
			`corenet_sendrecv_rndc_server_packets(named_t)`
			`corenet_sendrecv_rndc_client_packets(named_t)`
5 patches from dan 2009-07-14 14:30:22 +00:00			`corenet_dontaudit_udp_bind_all_reserved_ports(named_t)`
trunk: 2 patches from dan. 2007-10-12 17:35:56 +00:00			`corenet_udp_bind_all_unreserved_ports(named_t)`
add bind 2005-08-23 17:26:19 +00:00
			`dev_read_sysfs(named_t)`
			`dev_read_rand(named_t)`
patch from dan Thu, 18 May 2006 11:56:22 -0400 2006-05-19 14:02:24 +00:00			`dev_read_urand(named_t)`

another round of renaming 2006-02-20 21:33:25 +00:00			`domain_use_interactive_fds(named_t)`
add bind 2005-08-23 17:26:19 +00:00
			`files_read_etc_files(named_t)`
			`files_read_etc_runtime_files(named_t)`

trunk: reorganize amanda and bind 2007-10-12 17:50:11 +00:00			`fs_getattr_all_fs(named_t)`
			`fs_search_auto_mountpoints(named_t)`

trunk: 2 patches from dan. 2007-10-12 17:35:56 +00:00			`auth_use_nsswitch(named_t)`

add bind 2005-08-23 17:26:19 +00:00			`logging_send_syslog_msg(named_t)`

			`miscfiles_read_localization(named_t)`
Implement miscfiles_cert_type(). This is based on Fedoras' miscfiles_cert_type implementation. The idea was that openvpn needs to be able read home certificates (home_cert_t) which is not implemented in refpolicy yet, as well as generic cert_t certificates. Note that openvpn is allowed to read all cert_types, as i know that it needs access to both generic cert_t as well as (future) home_cert_t. Dwalsh noted that other domains may need this as well but because i do not know exactly which domains i will not changes any other domains call to generic cert type interfaces. Signed-off-by: Dominick Grift <domg472@gmail.com> 2010-09-09 16:14:48 +00:00			`miscfiles_read_generic_certs(named_t)`
add bind 2005-08-23 17:26:19 +00:00
another round of renaming 2006-02-20 21:33:25 +00:00			`userdom_dontaudit_use_unpriv_user_fds(named_t)`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00			`userdom_dontaudit_search_user_home_dirs(named_t)`
add bind 2005-08-23 17:26:19 +00:00
many loadable module build fixes 2005-12-02 22:06:05 +00:00			tunable_policy(`named_write_master_zones',`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`manage_dirs_pattern(named_t, named_zone_t, named_zone_t)`
trunk: whitespace fixes 2009-06-26 14:40:13 +00:00			`manage_files_pattern(named_t, named_zone_t, named_zone_t)`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`manage_lnk_files_pattern(named_t, named_zone_t, named_zone_t)`
many loadable module build fixes 2005-12-02 22:06:05 +00:00			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
many loadable module build fixes 2005-12-02 22:06:05 +00:00			`init_dbus_chat_script(named_t)`

			`sysnet_dbus_chat_dhcpc(named_t)`
more merging from 1.27.1-15 2005-10-14 17:55:40 +00:00
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00			`dbus_system_bus_client(named_t)`
more merging from 1.27.1-15 2005-10-14 17:55:40 +00:00			`dbus_connect_system_bus(named_t)`
many loadable module build fixes 2005-12-02 22:06:05 +00:00
deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
many loadable module build fixes 2005-12-02 22:06:05 +00:00			`networkmanager_dbus_chat(named_t)`
			`')`
			`')`

trunk: 2 patches from dan. 2007-10-12 17:35:56 +00:00			optional_policy(`
5 patches from dan 2009-07-14 14:30:22 +00:00			`kerberos_keytab_template(named, named_t)`
trunk: 2 patches from dan. 2007-10-12 17:35:56 +00:00			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
many loadable module build fixes 2005-12-02 22:06:05 +00:00			`# this seems like fds that arent being`
trunk: whitespace fixes in xml blocks. 2008-12-03 19:16:20 +00:00			`# closed. these should probably be`
many loadable module build fixes 2005-12-02 22:06:05 +00:00			`# dontaudits instead.`
another slew of renaming 2006-02-02 21:08:12 +00:00			`networkmanager_rw_udp_sockets(named_t)`
			`networkmanager_rw_packet_sockets(named_t)`
			`networkmanager_rw_routing_sockets(named_t)`
more merging from 1.27.1-15 2005-10-14 17:55:40 +00:00			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
add bind 2005-08-23 17:26:19 +00:00			`seutil_sigchld_newrole(named_t)`
			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
add bind 2005-08-23 17:26:19 +00:00			`udev_read_db(named_t)`
			`')`

			`########################################`
			`#`
			`# NDC local policy`
			`#`

			`# cjp: why net_admin?!`
			`allow ndc_t self:capability { dac_override net_admin };`
			`allow ndc_t self:process { fork signal_perms };`
trunk: Enable open permission checks policy capability. 2008-10-16 16:09:20 +00:00			`allow ndc_t self:fifo_file rw_fifo_file_perms;`
add bind 2005-08-23 17:26:19 +00:00			`allow ndc_t self:unix_stream_socket { connect create_stream_socket_perms };`
			`allow ndc_t self:tcp_socket create_socket_perms;`
			`allow ndc_t self:netlink_route_socket r_netlink_socket_perms;`

trunk: Enable open permission checks policy capability. 2008-10-16 16:09:20 +00:00			`allow ndc_t dnssec_t:file read_file_perms;`
patch from dan Wed, 23 Aug 2006 14:03:49 -0400 2006-08-29 02:41:00 +00:00			`allow ndc_t dnssec_t:lnk_file { getattr read };`
add bind 2005-08-23 17:26:19 +00:00
trunk: Enable open permission checks policy capability. 2008-10-16 16:09:20 +00:00			`stream_connect_pattern(ndc_t, named_var_run_t, named_var_run_t, named_t)`
add bind 2005-08-23 17:26:19 +00:00
trunk: Enable open permission checks policy capability. 2008-10-16 16:09:20 +00:00			`allow ndc_t named_conf_t:file read_file_perms;`
patch from dan Fri, 22 Sep 2006 16:30:34 -0400 2006-09-25 18:53:06 +00:00			`allow ndc_t named_conf_t:lnk_file { getattr read };`
add bind 2005-08-23 17:26:19 +00:00
trunk: Enable open permission checks policy capability. 2008-10-16 16:09:20 +00:00			`allow ndc_t named_zone_t:dir search_dir_perms;`
add bind 2005-08-23 17:26:19 +00:00
renaming from 20060131 interface review, round 2 2006-01-31 16:49:43 +00:00			`kernel_read_kernel_sysctls(ndc_t)`
add bind 2005-08-23 17:26:19 +00:00
trunk: Unified labeled networking policy from Paul Moore. The latest revision of the labeled policy patches which enable both labeled and unlabeled policy support for NetLabel. This revision takes into account Chris' feedback from the first version and reduces the number of interface calls in each domain down to two at present: one for unlabeled access, one for NetLabel access. The older, transport layer specific interfaces, are still present for use by third-party modules but are not used in the default policy modules. trunk: Use netmsg initial SID for MLS-only Netlabel packets, from Paul Moore. This patch changes the policy to use the netmsg initial SID as the "base" SID/context for NetLabel packets which only have MLS security attributes. Currently we use the unlabeled initial SID which makes it very difficult to distinquish between actual unlabeled packets and those packets which have MLS security attributes. 2007-06-27 15:23:21 +00:00			`corenet_all_recvfrom_unlabeled(ndc_t)`
			`corenet_all_recvfrom_netlabel(ndc_t)`
trunk: change network interface access from all to generic network interfaces. 2009-01-06 20:24:10 +00:00			`corenet_tcp_sendrecv_generic_if(ndc_t)`
trunk: Remove node definitions and change node usage to generic nodes. 2009-01-09 19:48:02 +00:00			`corenet_tcp_sendrecv_generic_node(ndc_t)`
add bind 2005-08-23 17:26:19 +00:00			`corenet_tcp_sendrecv_all_ports(ndc_t)`
trunk: Remove node definitions and change node usage to generic nodes. 2009-01-09 19:48:02 +00:00			`corenet_tcp_bind_generic_node(ndc_t)`
more updates 2005-09-15 21:03:29 +00:00			`corenet_tcp_connect_rndc_port(ndc_t)`
packet updates for kernel, nscd, bind, ntp, spamassassin, and dhcpc 2006-05-26 18:04:46 +00:00			`corenet_sendrecv_rndc_client_packets(ndc_t)`
add bind 2005-08-23 17:26:19 +00:00
another round of renaming 2006-02-20 21:33:25 +00:00			`domain_use_interactive_fds(ndc_t)`
add bind 2005-08-23 17:26:19 +00:00
			`files_read_etc_files(ndc_t)`
			`files_search_pids(ndc_t)`

trunk: reorganize amanda and bind 2007-10-12 17:50:11 +00:00			`fs_getattr_xattr_fs(ndc_t)`

make (almost) all interface parameters required. move boot_t, system_map_t, and modules_object_t to files module. fd use interface renames, udp sendto interface renames. 2006-03-02 23:41:11 +00:00			`init_use_fds(ndc_t)`
another slew of renaming 2006-02-02 21:08:12 +00:00			`init_use_script_ptys(ndc_t)`
add bind 2005-08-23 17:26:19 +00:00
			`logging_send_syslog_msg(ndc_t)`

			`miscfiles_read_localization(ndc_t)`

			`sysnet_read_config(ndc_t)`
more updates 2005-09-15 21:03:29 +00:00			`sysnet_dns_name_resolve(ndc_t)`
add bind 2005-08-23 17:26:19 +00:00
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00			`userdom_use_user_terminals(ndc_t)`

trunk: 10 patches from dan. 2008-11-11 16:38:34 +00:00			`term_dontaudit_use_console(ndc_t)`

add bind 2005-08-23 17:26:19 +00:00			`# for /etc/rndc.key`
			ifdef(`distro_redhat',`
			`allow ndc_t named_conf_t:dir search;`
			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
add bind 2005-08-23 17:26:19 +00:00			`nis_use_ypbind(ndc_t)`
			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
another slew of renaming 2006-02-02 21:08:12 +00:00			`nscd_socket_use(ndc_t)`
add bind 2005-08-23 17:26:19 +00:00			`')`
add networkmanager 2005-10-22 17:44:04 +00:00
deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
make (almost) all interface parameters required. move boot_t, system_map_t, and modules_object_t to files module. fd use interface renames, udp sendto interface renames. 2006-03-02 23:41:11 +00:00			`ppp_dontaudit_use_fds(ndc_t)`
pile of sediff fixes 2005-11-08 22:00:30 +00:00			`')`