selinux-policy/policy/modules/services/nis.if

397 lines
8.5 KiB
Plaintext
Raw Normal View History

2005-06-24 19:49:46 +00:00
## <summary>Policy for NIS (YP) servers and clients</summary>
2005-09-29 20:59:00 +00:00
########################################
## <summary>
## Use the ypbind service to access NIS services
## unconditionally.
## </summary>
## <desc>
## <p>
## Use the ypbind service to access NIS services
## unconditionally.
## </p>
## <p>
## This interface was added because of apache and
## spamassassin, to fix a nested conditionals problem.
## When that support is added, this should be removed,
## and the regular interface should be used.
## </p>
## </desc>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
2005-09-29 20:59:00 +00:00
## </param>
#
interface(`nis_use_ypbind_uncond',`
gen_require(`
type var_yp_t;
')
allow $1 self:capability net_bind_service;
2005-09-29 20:59:00 +00:00
allow $1 self:tcp_socket create_stream_socket_perms;
allow $1 self:udp_socket create_socket_perms;
2006-12-12 20:08:08 +00:00
allow $1 var_yp_t:dir list_dir_perms;
2005-09-29 20:59:00 +00:00
allow $1 var_yp_t:lnk_file { getattr read };
2006-12-12 20:08:08 +00:00
allow $1 var_yp_t:file read_file_perms;
2005-09-29 20:59:00 +00:00
corenet_all_recvfrom_unlabeled($1)
corenet_all_recvfrom_netlabel($1)
corenet_tcp_sendrecv_generic_if($1)
corenet_udp_sendrecv_generic_if($1)
corenet_tcp_sendrecv_generic_node($1)
corenet_udp_sendrecv_generic_node($1)
2005-09-29 20:59:00 +00:00
corenet_tcp_sendrecv_all_ports($1)
corenet_udp_sendrecv_all_ports($1)
corenet_tcp_bind_generic_node($1)
corenet_udp_bind_generic_node($1)
2005-09-29 20:59:00 +00:00
corenet_tcp_bind_generic_port($1)
corenet_udp_bind_generic_port($1)
2009-06-25 15:16:29 +00:00
corenet_dontaudit_tcp_bind_all_reserved_ports($1)
corenet_dontaudit_udp_bind_all_reserved_ports($1)
corenet_dontaudit_tcp_bind_all_ports($1)
corenet_dontaudit_udp_bind_all_ports($1)
2005-09-29 20:59:00 +00:00
corenet_tcp_connect_portmap_port($1)
corenet_tcp_connect_reserved_port($1)
corenet_tcp_connect_generic_port($1)
corenet_dontaudit_tcp_connect_all_ports($1)
2006-05-30 19:46:34 +00:00
corenet_sendrecv_portmap_client_packets($1)
corenet_sendrecv_generic_client_packets($1)
corenet_sendrecv_generic_server_packets($1)
2005-09-29 20:59:00 +00:00
sysnet_read_config($1)
')
2005-06-24 19:49:46 +00:00
########################################
## <summary>
## Use the ypbind service to access NIS services.
## </summary>
## <desc>
## <p>
## Allow the specified domain to use the ypbind service
## to access Network Information Service (NIS) services.
## Information that can be retreived from NIS includes
## usernames, passwords, home directories, and groups.
## If the network is configured to have a single sign-on
## using NIS, it is likely that any program that does
## authentication will need this access.
## </p>
## </desc>
2005-06-24 19:49:46 +00:00
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
2005-06-24 19:49:46 +00:00
## </param>
## <infoflow type="both" weight="10"/>
2006-09-06 22:07:25 +00:00
## <rolecap/>
2005-06-24 19:49:46 +00:00
#
interface(`nis_use_ypbind',`
2009-06-25 15:16:29 +00:00
tunable_policy(`allow_ypbind',`
nis_use_ypbind_uncond($1)
2005-06-24 19:49:46 +00:00
')
2009-06-25 15:16:29 +00:00
')
2005-06-24 19:49:46 +00:00
2009-06-25 15:16:29 +00:00
########################################
## <summary>
## Use the nis to authenticate passwords
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
## <rolecap/>
#
interface(`nis_authenticate',`
2005-06-24 19:49:46 +00:00
tunable_policy(`allow_ypbind',`
2006-05-30 19:46:34 +00:00
nis_use_ypbind_uncond($1)
2009-06-25 15:16:29 +00:00
corenet_tcp_bind_all_rpc_ports($1)
corenet_udp_bind_all_rpc_ports($1)
')
2005-06-24 19:49:46 +00:00
')
2005-10-24 18:40:24 +00:00
########################################
## <summary>
## Execute ypbind in the ypbind domain.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed to transition.
## </summary>
2005-10-24 18:40:24 +00:00
## </param>
#
interface(`nis_domtrans_ypbind',`
gen_require(`
type ypbind_t, ypbind_exec_t;
')
corecmd_search_bin($1)
domtrans_pattern($1, ypbind_exec_t, ypbind_t)
2005-10-24 18:40:24 +00:00
')
########################################
## <summary>
## Execute ypbind in the ypbind domain, and
## allow the specified role the ypbind domain.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed to transition.
## </summary>
## </param>
## <param name="role">
## <summary>
## Role allowed access.
## </summary>
## </param>
## <rolecap/>
#
interface(`nis_run_ypbind',`
gen_require(`
type ypbind_t;
')
nis_domtrans_ypbind($1)
role $2 types ypbind_t;
')
2005-10-14 17:55:40 +00:00
########################################
## <summary>
## Send generic signals to ypbind.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
2005-10-14 17:55:40 +00:00
## </param>
#
interface(`nis_signal_ypbind',`
gen_require(`
type ypbind_t;
')
allow $1 ypbind_t:process signal;
')
2005-06-24 19:49:46 +00:00
########################################
## <summary>
2005-10-22 21:09:03 +00:00
## List the contents of the NIS data directory.
2005-06-24 19:49:46 +00:00
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
2005-06-24 19:49:46 +00:00
## </param>
#
interface(`nis_list_var_yp',`
gen_require(`
2005-10-14 17:55:40 +00:00
type var_yp_t;
2005-06-24 19:49:46 +00:00
')
files_search_var($1)
2006-12-12 20:08:08 +00:00
allow $1 var_yp_t:dir list_dir_perms;
2005-06-24 19:49:46 +00:00
')
########################################
## <summary>
2006-08-15 20:00:58 +00:00
## Send UDP network traffic to NIS clients. (Deprecated)
2005-06-24 19:49:46 +00:00
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
2005-06-24 19:49:46 +00:00
## </param>
#
2006-02-02 21:08:12 +00:00
interface(`nis_udp_send_ypbind',`
2006-08-15 20:00:58 +00:00
refpolicywarn(`$0($*) has been deprecated.')
2005-06-24 19:49:46 +00:00
')
2005-10-22 21:09:03 +00:00
########################################
## <summary>
2006-08-15 20:00:58 +00:00
## Connect to ypbind over TCP. (Deprecated)
2005-10-22 21:09:03 +00:00
## </summary>
## <param name="domain">
## <summary>
2005-10-22 21:09:03 +00:00
## Domain allowed access.
## </summary>
2005-10-22 21:09:03 +00:00
## </param>
#
interface(`nis_tcp_connect_ypbind',`
2006-08-15 20:00:58 +00:00
refpolicywarn(`$0($*) has been deprecated.')
2005-10-22 21:09:03 +00:00
')
2005-11-08 22:00:30 +00:00
########################################
## <summary>
## Read ypbind pid files.
## </summary>
## <param name="domain">
## <summary>
2005-11-08 22:00:30 +00:00
## Domain allowed access.
## </summary>
2005-11-08 22:00:30 +00:00
## </param>
#
interface(`nis_read_ypbind_pid',`
gen_require(`
2005-12-14 15:27:14 +00:00
type ypbind_var_run_t;
2005-11-08 22:00:30 +00:00
')
files_search_pids($1)
2006-12-12 20:08:08 +00:00
allow $1 ypbind_var_run_t:file read_file_perms;
2005-11-08 22:00:30 +00:00
')
########################################
## <summary>
## Delete ypbind pid files.
## </summary>
## <param name="domain">
## <summary>
2005-11-08 22:00:30 +00:00
## Domain allowed access.
## </summary>
2005-11-08 22:00:30 +00:00
## </param>
#
interface(`nis_delete_ypbind_pid',`
gen_require(`
type ypbind_t;
')
# TODO: add delete pid from dir call to files
allow $1 ypbind_t:file unlink;
')
########################################
## <summary>
## Read ypserv configuration files.
## </summary>
## <param name="domain">
## <summary>
2005-11-08 22:00:30 +00:00
## Domain allowed access.
## </summary>
2005-11-08 22:00:30 +00:00
## </param>
#
interface(`nis_read_ypserv_config',`
gen_require(`
2005-11-28 16:44:51 +00:00
type ypserv_conf_t;
2005-11-08 22:00:30 +00:00
')
files_search_etc($1)
2008-10-20 16:10:42 +00:00
allow $1 ypserv_conf_t:file read_file_perms;
2005-11-08 22:00:30 +00:00
')
########################################
## <summary>
## Execute ypxfr in the ypxfr domain.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed to transition.
## </summary>
## </param>
#
interface(`nis_domtrans_ypxfr',`
gen_require(`
type ypxfr_t, ypxfr_exec_t;
')
corecmd_search_bin($1)
domtrans_pattern($1, ypxfr_exec_t, ypxfr_t)
')
2009-06-25 15:16:29 +00:00
########################################
## <summary>
## Execute nis server in the nis domain.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed to transition.
## </summary>
## </param>
#
#
interface(`nis_initrc_domtrans',`
gen_require(`
type nis_initrc_exec_t;
')
init_labeled_script_domtrans($1, nis_initrc_exec_t)
')
########################################
## <summary>
## Execute nis server in the nis domain.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed to transition.
## </summary>
## </param>
#
2010-04-12 20:02:45 +00:00
interface(`nis_initrc_domtrans_ypbind',`
gen_require(`
type ypbind_initrc_exec_t;
')
init_labeled_script_domtrans($1, ypbind_initrc_exec_t)
')
2009-06-25 15:16:29 +00:00
########################################
## <summary>
2010-04-19 14:20:19 +00:00
## All of the rules required to administrate
2009-06-25 15:16:29 +00:00
## an nis environment
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
## <param name="role">
## <summary>
## Role allowed access.
## </summary>
## </param>
## <rolecap/>
#
interface(`nis_admin',`
gen_require(`
type ypbind_t, yppasswdd_t, ypserv_t, ypxfr_t;
type ypbind_tmp_t, ypserv_tmp_t, ypserv_conf_t;
type ypbind_var_run_t, yppasswdd_var_run_t, ypserv_var_run_t;
type ypbind_initrc_exec_t, nis_initrc_exec_t;
2009-06-25 15:16:29 +00:00
')
allow $1 ypbind_t:process { ptrace signal_perms };
ps_process_pattern($1, ypbind_t)
allow $1 yppasswdd_t:process { ptrace signal_perms };
ps_process_pattern($1, yppasswdd_t)
allow $1 ypserv_t:process { ptrace signal_perms };
ps_process_pattern($1, ypserv_t)
allow $1 ypxfr_t:process { ptrace signal_perms };
ps_process_pattern($1, ypxfr_t)
nis_initrc_domtrans($1)
2010-04-12 20:02:45 +00:00
nis_initrc_domtrans_ypbind($1)
domain_system_change_exemption($1)
role_transition $2 nis_initrc_exec_t system_r;
role_transition $2 ypbind_initrc_exec_t system_r;
allow $2 system_r;
2009-06-25 15:16:29 +00:00
files_list_tmp($1)
admin_pattern($1, ypbind_tmp_t)
files_list_pids($1)
admin_pattern($1, ypbind_var_run_t)
admin_pattern($1, yppasswdd_var_run_t)
files_list_etc($1)
admin_pattern($1, ypserv_conf_t)
admin_pattern($1, ypserv_tmp_t)
admin_pattern($1, ypserv_var_run_t)
')