nis patch from Dan Walsh

Made a couple style changes.
Removed unnecessary require in nis_use_ypbind interface

policy/modules/services/nis.fc

@@ -1,4 +1,7 @@
-
+/etc/rc\.d/init\.d/ypbind	--	gen_context(system_u:object_r:ypbind_initrc_exec_t,s0)
+/etc/rc\.d/init\.d/yppasswd	--	gen_context(system_u:object_r:nis_initrc_exec_t,s0)
+/etc/rc\.d/init\.d/ypserv	--	gen_context(system_u:object_r:nis_initrc_exec_t,s0)
+/etc/rc\.d/init\.d/ypxfrd	--	gen_context(system_u:object_r:nis_initrc_exec_t,s0)
 /etc/ypserv\.conf	--	gen_context(system_u:object_r:ypserv_conf_t,s0)
 
 /sbin/ypbind		--	gen_context(system_u:object_r:ypbind_exec_t,s0)
@@ -11,3 +14,8 @@
 /usr/sbin/ypserv	--	gen_context(system_u:object_r:ypserv_exec_t,s0)
 
 /var/yp(/.*)?			gen_context(system_u:object_r:var_yp_t,s0)
+
+/var/run/ypxfrd.*	--	gen_context(system_u:object_r:ypxfr_var_run_t,s0)
+/var/run/ypbind.*	--	gen_context(system_u:object_r:ypbind_var_run_t,s0)
+/var/run/ypserv.*	--	gen_context(system_u:object_r:ypserv_var_run_t,s0)
+/var/run/yppass.*	--	gen_context(system_u:object_r:yppasswdd_var_run_t,s0)

policy/modules/services/nis.if

@@ -28,7 +28,7 @@ interface(`nis_use_ypbind_uncond',`
 		type var_yp_t;
 	')
 
-	dontaudit $1 self:capability net_bind_service;
+	allow $1 self:capability net_bind_service;
 
 	allow $1 self:tcp_socket create_stream_socket_perms;
 	allow $1 self:udp_socket create_socket_perms;
@@ -131,13 +131,39 @@ interface(`nis_domtrans_ypbind',`
 	domtrans_pattern($1, ypbind_exec_t, ypbind_t)
 ')
 
+########################################
+## <summary>
+##	Execute ypbind in the ypbind domain, and
+##	allow the specified role the ypbind domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	The role to be allowed the ypbind domain.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`nis_run_ypbind',`
+	gen_require(`
+		type ypbind_t;
+	')
+
+	nis_domtrans_ypbind($1)
+	role $2 types ypbind_t;
+')
+
 ########################################
 ## <summary>
 ##	Send generic signals to ypbind.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
-##	The type of the process performing this action.
+##	Domain allowed access.
 ##	</summary>
 ## </param>
 #
@@ -155,7 +181,7 @@ interface(`nis_signal_ypbind',`
 ## </summary>
 ## <param name="domain">
 ##	<summary>
-##	The type of the process performing this action.
+##	Domain allowed access.
 ##	</summary>
 ## </param>
 #
@@ -174,7 +200,7 @@ interface(`nis_list_var_yp',`
 ## </summary>
 ## <param name="domain">
 ##	<summary>
-##	The type of the process performing this action.
+##	Domain allowed access.
 ##	</summary>
 ## </param>
 #
@@ -272,6 +298,43 @@ interface(`nis_domtrans_ypxfr',`
 	domtrans_pattern($1, ypxfr_exec_t, ypxfr_t)
 ')
 
+########################################
+## <summary>
+##	Execute nis server in the nis domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+#
+interface(`nis_initrc_domtrans',`
+	gen_require(`
+		type nis_initrc_exec_t;
+	')
+
+	init_labeled_script_domtrans($1, nis_initrc_exec_t)
+')
+
+########################################
+## <summary>
+##	Execute nis server in the nis domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`nis_ypbind_initrc_domtrans',`
+	gen_require(`
+		type ypbind_initrc_exec_t;
+	')
+
+	init_labeled_script_domtrans($1, ypbind_initrc_exec_t)
+')
+
 ########################################
 ## <summary>
 ##	All of the rules required to administrate 
@@ -294,6 +357,7 @@ interface(`nis_admin',`
 		type ypbind_t, yppasswdd_t, ypserv_t, ypxfr_t;
 		type ypbind_tmp_t, ypserv_tmp_t, ypserv_conf_t;
 		type ypbind_var_run_t, yppasswdd_var_run_t, ypserv_var_run_t;
+		type ypbind_initrc_exec_t, nis_initrc_exec_t;
 	')
 
 	allow $1 ypbind_t:process { ptrace signal_perms };
@@ -308,6 +372,13 @@ interface(`nis_admin',`
 	allow $1 ypxfr_t:process { ptrace signal_perms };
 	ps_process_pattern($1, ypxfr_t)
 
+	nis_initrc_domtrans($1)
+	nis_ypbind_initrc_domtrans($1)
+	domain_system_change_exemption($1)
+	role_transition $2 nis_initrc_exec_t system_r;
+	role_transition $2 ypbind_initrc_exec_t system_r;
+	allow $2 system_r;
+
 	files_list_tmp($1)
 	admin_pattern($1, ypbind_tmp_t)
 

policy/modules/services/nis.te

@@ -13,6 +13,9 @@ type ypbind_t;
 type ypbind_exec_t;
 init_daemon_domain(ypbind_t, ypbind_exec_t)
 
+type ypbind_initrc_exec_t;
+init_script_file(ypbind_initrc_exec_t)
+
 type ypbind_tmp_t;
 files_tmp_file(ypbind_tmp_t)
 
@@ -44,6 +47,12 @@ type ypxfr_t;
 type ypxfr_exec_t;
 init_daemon_domain(ypxfr_t, ypxfr_exec_t)
 
+type ypxfr_var_run_t;
+files_pid_file(ypxfr_var_run_t)
+
+type nis_initrc_exec_t;
+init_script_file(nis_initrc_exec_t)
+
 ########################################
 #
 # ypbind local policy
@@ -65,9 +74,8 @@ files_pid_filetrans(ypbind_t, ypbind_var_run_t, file)
 
 manage_files_pattern(ypbind_t, var_yp_t, var_yp_t)
 
+kernel_read_system_state(ypbind_t)
 kernel_read_kernel_sysctls(ypbind_t)
-kernel_list_proc(ypbind_t)
-kernel_read_proc_symlinks(ypbind_t)
 
 corenet_all_recvfrom_unlabeled(ypbind_t)
 corenet_all_recvfrom_netlabel(ypbind_t)
@@ -136,7 +144,7 @@ optional_policy(`
 allow yppasswdd_t self:capability dac_override;
 dontaudit yppasswdd_t self:capability sys_tty_config;
 allow yppasswdd_t self:fifo_file rw_fifo_file_perms;
-allow yppasswdd_t self:process { setfscreate signal_perms };
+allow yppasswdd_t self:process { getsched setfscreate signal_perms };
 allow yppasswdd_t self:unix_dgram_socket create_socket_perms;
 allow yppasswdd_t self:unix_stream_socket create_stream_socket_perms;
 allow yppasswdd_t self:netlink_route_socket r_netlink_socket_perms;
@@ -250,6 +258,8 @@ corenet_tcp_sendrecv_all_ports(ypserv_t)
 corenet_udp_sendrecv_all_ports(ypserv_t)
 corenet_tcp_bind_generic_node(ypserv_t)
 corenet_udp_bind_generic_node(ypserv_t)
+corenet_tcp_bind_reserved_port(ypserv_t)
+corenet_udp_bind_reserved_port(ypserv_t)
 corenet_tcp_bind_all_rpc_ports(ypserv_t)
 corenet_udp_bind_all_rpc_ports(ypserv_t)
 corenet_dontaudit_tcp_bind_all_reserved_ports(ypserv_t)
@@ -305,6 +315,9 @@ allow ypxfr_t ypserv_t:udp_socket { read write };
 
 allow ypxfr_t ypserv_conf_t:file read_file_perms;
 
+manage_files_pattern(ypxfr_t, ypxfr_var_run_t, ypxfr_var_run_t)
+files_pid_filetrans(ypxfr_t, ypxfr_var_run_t, file)
+
 corenet_all_recvfrom_unlabeled(ypxfr_t)
 corenet_all_recvfrom_netlabel(ypxfr_t)
 corenet_tcp_sendrecv_generic_if(ypxfr_t)
@@ -315,6 +328,8 @@ corenet_tcp_sendrecv_all_ports(ypxfr_t)
 corenet_udp_sendrecv_all_ports(ypxfr_t)
 corenet_tcp_bind_generic_node(ypxfr_t)
 corenet_udp_bind_generic_node(ypxfr_t)
+corenet_tcp_bind_reserved_port(ypxfr_t)
+corenet_udp_bind_reserved_port(ypxfr_t)
 corenet_tcp_bind_all_rpc_ports(ypxfr_t)
 corenet_udp_bind_all_rpc_ports(ypxfr_t)
 corenet_dontaudit_tcp_bind_all_reserved_ports(ypxfr_t)