afs client patch from dan.
This commit is contained in:
Chris PeBenito
parent
b93a7dacca
commit
13306f56b6
@ -1,3 +1,6 @@
|
||||
/etc/rc\.d/init\.d/openafs-client -- gen_context(system_u:object_r:afs_initrc_exec_t,s0)
|
||||
/etc/rc\.d/init\.d/afs -- gen_context(system_u:object_r:afs_initrc_exec_t,s0)
|
||||
|
||||
/usr/afs/bin/bosserver -- gen_context(system_u:object_r:afs_bosserver_exec_t,s0)
|
||||
/usr/afs/bin/fileserver -- gen_context(system_u:object_r:afs_fsserver_exec_t,s0)
|
||||
/usr/afs/bin/kaserver -- gen_context(system_u:object_r:afs_kaserver_exec_t,s0)
|
||||
@ -17,6 +20,12 @@
|
||||
|
||||
/usr/afs/logs(/.*)? gen_context(system_u:object_r:afs_logfile_t,s0)
|
||||
|
||||
/usr/sbin/afsd -- gen_context(system_u:object_r:afs_exec_t,s0)
|
||||
|
||||
/usr/vice/etc/afsd -- gen_context(system_u:object_r:afs_exec_t,s0)
|
||||
|
||||
/var/cache/afs(/.*)? gen_context(system_u:object_r:afs_cache_t,s0)
|
||||
|
||||
/vicepa gen_context(system_u:object_r:afs_files_t,s0)
|
||||
/vicepb gen_context(system_u:object_r:afs_files_t,s0)
|
||||
/vicepc gen_context(system_u:object_r:afs_files_t,s0)
|
||||
|
||||
@ -1 +1,107 @@
|
||||
## <summary>Andrew Filesystem server</summary>
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Execute a domain transition to run the
|
||||
## afs client.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed to transition.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`afs_domtrans',`
|
||||
gen_require(`
|
||||
type afs_t, afs_exec_t;
|
||||
')
|
||||
|
||||
domtrans_pattern($1, afs_exec_t, afs_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Read and write afs client UDP sockets.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`afs_rw_udp_sockets',`
|
||||
gen_require(`
|
||||
type afs_t;
|
||||
')
|
||||
|
||||
allow $1 afs_t:udp_socket { read write };
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## read/write afs cache files
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed to transition.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`afs_rw_cache',`
|
||||
gen_require(`
|
||||
type afs_cache_t;
|
||||
')
|
||||
|
||||
allow $1 afs_cache_t:file { read write };
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Execute afs server in the afs domain.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## The type of the process performing this action.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`afs_initrc_domtrans',`
|
||||
gen_require(`
|
||||
type afs_initrc_exec_t;
|
||||
')
|
||||
|
||||
init_script_domtrans_spec($1, afs_initrc_exec_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## All of the rules required to administrate
|
||||
## an afs environment
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
## <param name="role">
|
||||
## <summary>
|
||||
## The role to be allowed to manage the afs domain.
|
||||
## </summary>
|
||||
## </param>
|
||||
## <rolecap/>
|
||||
#
|
||||
interface(`afs_admin',`
|
||||
gen_require(`
|
||||
type afs_t, afs_initrc_exec_t;
|
||||
')
|
||||
|
||||
allow $1 afs_t:process { ptrace signal_perms getattr };
|
||||
read_files_pattern($1, afs_t, afs_t)
|
||||
|
||||
# Allow afs_t to restart the apache service
|
||||
afs_initrc_domtrans($1)
|
||||
domain_system_change_exemption($1)
|
||||
role_transition $2 afs_initrc_exec_t system_r;
|
||||
allow $2 system_r;
|
||||
|
||||
')
|
||||
|
||||
@ -1,15 +1,22 @@
|
||||
|
||||
policy_module(afs, 1.4.1)
|
||||
policy_module(afs, 1.4.2)
|
||||
|
||||
########################################
|
||||
#
|
||||
# Declarations
|
||||
#
|
||||
|
||||
type afs_t;
|
||||
type afs_exec_t;
|
||||
init_daemon_domain(afs_t, afs_exec_t)
|
||||
|
||||
type afs_bosserver_t;
|
||||
type afs_bosserver_exec_t;
|
||||
init_daemon_domain(afs_bosserver_t, afs_bosserver_exec_t)
|
||||
|
||||
type afs_cache_t;
|
||||
files_type(afs_cache_t)
|
||||
|
||||
type afs_config_t;
|
||||
files_type(afs_config_t)
|
||||
|
||||
@ -26,6 +33,9 @@ domain_type(afs_fsserver_t)
|
||||
domain_entry_file(afs_fsserver_t, afs_fsserver_exec_t)
|
||||
role system_r types afs_fsserver_t;
|
||||
|
||||
type afs_initrc_exec_t;
|
||||
init_script_file(afs_initrc_exec_t)
|
||||
|
||||
type afs_ka_db_t;
|
||||
files_type(afs_ka_db_t)
|
||||
|
||||
@ -56,6 +66,44 @@ domain_type(afs_vlserver_t)
|
||||
domain_entry_file(afs_vlserver_t, afs_vlserver_exec_t)
|
||||
role system_r types afs_vlserver_t;
|
||||
|
||||
########################################
|
||||
#
|
||||
# afs client local policy
|
||||
#
|
||||
|
||||
allow afs_t self:capability { sys_nice sys_tty_config };
|
||||
allow afs_t self:process setsched;
|
||||
allow afs_t self:udp_socket create_socket_perms;
|
||||
allow afs_t self:fifo_file rw_file_perms;
|
||||
allow afs_t self:unix_stream_socket create_stream_socket_perms;
|
||||
|
||||
manage_files_pattern(afs_t, afs_cache_t, afs_cache_t)
|
||||
manage_dirs_pattern(afs_t, afs_cache_t, afs_cache_t)
|
||||
files_var_filetrans(afs_t, afs_cache_t, { file dir })
|
||||
|
||||
files_mounton_mnt(afs_t)
|
||||
files_read_etc_files(afs_t)
|
||||
files_rw_etc_runtime_files(afs_t)
|
||||
|
||||
fs_getattr_xattr_fs(afs_t)
|
||||
fs_mount_nfs(afs_t)
|
||||
|
||||
kernel_rw_afs_state(afs_t)
|
||||
|
||||
corenet_all_recvfrom_unlabeled(afs_t)
|
||||
corenet_all_recvfrom_netlabel(afs_t)
|
||||
corenet_tcp_sendrecv_generic_if(afs_t)
|
||||
corenet_udp_sendrecv_generic_if(afs_t)
|
||||
corenet_tcp_sendrecv_generic_node(afs_t)
|
||||
corenet_udp_sendrecv_generic_node(afs_t)
|
||||
corenet_tcp_sendrecv_all_ports(afs_t)
|
||||
corenet_udp_sendrecv_all_ports(afs_t)
|
||||
corenet_udp_bind_generic_node(afs_t)
|
||||
|
||||
logging_send_syslog_msg(afs_t)
|
||||
|
||||
miscfiles_read_localization(afs_t)
|
||||
|
||||
########################################
|
||||
#
|
||||
# AFS bossserver local policy
|
||||
|
||||
Loading…
Reference in New Issue
Block a user