rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

- Change etc files to config files to allow users to read them

Browse Source
This commit is contained in:
Daniel J Walsh 2008-04-23 14:15:54 +00:00
parent a6a82aec79
commit 4b1d56da14
11 changed files with 1827 additions and 2995 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

228
booleans-strict.conf
View File

@ -1,228 +0,0 @@
# Allow making anonymous memory executable, e.g.for runtime-code generation or executable stack.
#
allow_execmem = false
# Allow making a modified private filemapping executable (text relocation).
#
allow_execmod = false
# Allow making the stack executable via mprotect.Also requires allow_execmem.
#
allow_execstack = false
# Allow ftp servers to modify public filesused for public file transfer services.
#
allow_ftpd_anon_write = false
# Allow gssd to read temp directory.
#
allow_gssd_read_tmp = false
# Allow Apache to modify public filesused for public file transfer services.
#
allow_httpd_anon_write = false
# Allow system to run with kerberos
#
allow_kerberos = true
# Allow rsync to modify public filesused for public file transfer services.
#
allow_rsync_anon_write = false
# Allow sasl to read shadow
#
allow_saslauthd_read_shadow = false
# Allow samba to modify public filesused for public file transfer services.
#
allow_smbd_anon_write = false
# Allow sysadm to ptrace all processes
#
allow_ptrace = false
# Allow system to run with NIS
#
allow_ypbind = false
# Enable extra rules in the cron domainto support fcron.
#
fcron_crond = false
# Allow ftp to read and write files in the user home directories
#
ftp_home_dir = false
# Allow ftpd to run directly without inetd
#
ftpd_is_daemon = true
# Allow httpd to use built in scripting (usually php)
#
httpd_builtin_scripting = false
# Allow http daemon to tcp connect
#
httpd_can_network_connect = false
# Allow httpd cgi support
#
httpd_enable_cgi = false
# Allow httpd to act as a FTP server bylistening on the ftp port.
#
httpd_enable_ftp_server = false
# Allow httpd to read home directories
#
httpd_enable_homedirs = false
# Run SSI execs in system CGI script domain.
#
httpd_ssi_exec = false
# Allow http daemon to communicate with the TTY
#
httpd_tty_comm = false
# Run CGI in the main httpd domain
#
httpd_unified = false
# Allow BIND to write the master zone files.Generally this is used for dynamic DNS.
#
named_write_master_zones = false
# Allow nfs to be exported read/write.
#
nfs_export_all_rw = false
# Allow nfs to be exported read only
#
nfs_export_all_ro = false
# Allow pppd to load kernel modules for certain modems
#
pppd_can_insmod = false
# Allow reading of default_t files.
#
read_default_t = false
# Allow ssh to run from inetd instead of as a daemon.
#
run_ssh_inetd = false
# Allow samba to export user home directories.
#
samba_enable_home_dirs = false
# Allow squid to connect to all ports, not justHTTP, FTP, and Gopher ports.
#
squid_connect_any = false
# Allow ssh logins as sysadm_r:sysadm_t
#
ssh_sysadm_login = false
# Configure stunnel to be a standalone daemon orinetd service.
#
stunnel_is_daemon = false
# Support NFS home directories
#
use_nfs_home_dirs = false
# Support SAMBA home directories
#
use_samba_home_dirs = false
# Control users use of ping and traceroute
#
user_ping = false
# Allow gpg executable stack
#
allow_gpg_execstack = false
# allow host key based authentication
#
allow_ssh_keysign = false
# Allow users to connect to mysql
#
allow_user_mysql_connect = false
# Allow system cron jobs to relabel filesystemfor restoring file contexts.
#
cron_can_relabel = false
# Allow pppd to be run for a regular user
#
pppd_for_user = false
# Allow applications to read untrusted contentIf this is disallowed, Internet content hasto be manually relabeled for read access to be granted
#
read_untrusted_content = true
# Allow user spamassassin clients to use the network.
#
spamassassin_can_network = false
# Allow staff_r users to search the sysadm homedir and read files (such as ~/.bashrc)
#
staff_read_sysadm_file = false
# Allow regular users direct mouse access
#
user_direct_mouse = false
# Allow users to read system messages.
#
user_dmesg = false
# Allow users to control network interfaces(also needs USERCTL=true)
#
user_net_control = false
# Allow user to r/w files on filesystemsthat do not have extended attributes (FAT, CDROM, FLOPPY)
#
user_rw_noexattrfile = false
# Allow users to rw usb devices
#
user_rw_usb = false
# Allow users to run TCP servers (bind to ports and accept connection fromthe same domain and outside users) disabling this forces FTP passive modeand may change other protocols.
#
user_tcp_server = false
# Allow w to display everyone
#
user_ttyfile_stat = false
# Allow applications to write untrusted contentIf this is disallowed, no Internet contentwill be stored.
#
write_untrusted_content = true
spamd_enable_home_dirs = false
# Allow login domains to polyinstatiate directories
#
allow_polyinstantiation = false
# Allow sysadm to ptrace all processes
#
allow_ptrace = false
## Control users use of ping and traceroute
user_ping = true
# Allow unlabeled packets to flow
#
allow_unlabeled_packets = true
# Allow samba to act as the domain controller
#
samba_domain_controller = false

1408
modules-strict.conf
View File

File diff suppressed because it is too large Load Diff

2986
policy-20071130.patch
View File

File diff suppressed because it is too large Load Diff

11
policy-init.patch
View File

@ -1,11 +0,0 @@
diff -up serefpolicy-3.3.1/policy/modules/services/rhgb.te.foo serefpolicy-3.3.1/policy/modules/services/rhgb.te
--- serefpolicy-3.3.1/policy/modules/services/rhgb.te.foo 2008-03-11 17:50:18.000000000 -0400
+++ serefpolicy-3.3.1/policy/modules/services/rhgb.te 2008-03-11 17:50:18.000000000 -0400
@@ -92,6 +92,7 @@ term_use_ptmx(rhgb_t)
term_getattr_pty_fs(rhgb_t)
init_write_initctl(rhgb_t)
+init_chat(rhgb_t)
libs_use_ld_so(rhgb_t)
libs_use_shared_libs(rhgb_t)

10
policy-udev_tbl.patch
View File

@ -1,10 +0,0 @@
--- serefpolicy-2.5.9/policy/modules/system/udev.fc.udev_tbl 2007-03-20 09:36:50.000000000 -0400
+++ serefpolicy-2.5.9/policy/modules/system/udev.fc 2007-03-22 06:36:55.000000000 -0400
@@ -1,6 +1,6 @@
# udev
-/dev/\.udev(/.*)? gen_context(system_u:object_r:udev_tbl_t,s0)
+/dev/\.udev(/.*)? -- gen_context(system_u:object_r:udev_tbl_t,s0)
/dev/\.udevdb -- gen_context(system_u:object_r:udev_tbl_t,s0)
/dev/udev\.tbl -- gen_context(system_u:object_r:udev_tbl_t,s0)

3
securetty_types-strict
View File

@ -1,3 +0,0 @@
sysadm_tty_device_t
user_tty_device_t
staff_tty_device_t

14
selinux-policy.spec
View File

@ -17,7 +17,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.3.1
Release: 36%{?dist}
Release: 39%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@ -303,6 +303,8 @@ exit 0
%triggerpostun targeted -- selinux-policy-targeted < 3.2.5-9.fc9
. /etc/selinux/config
[ "${SELINUXTYPE}" != "targeted" ] && exit 0
setsebool -P use_nfs_home_dirs=1
semanage user -l | grep -s unconfined_u
if [ $? -eq 0 ]; then
@ -311,9 +313,9 @@ else
semanage user -a -P user -R "unconfined_r system_r" -r s0-s0:c0.c1023 unconfined_u 2> /dev/null
fi
seuser=`semanage login -l | grep __default__ | awk '{ print $2 }'`
[ $seuser == "system_u" ] && semanage login -m -s "unconfined_u" -r s0-s0:c0.c1023 __default__
[ "$seuser" != "unconfined_u" ] && semanage login -m -s "unconfined_u" -r s0-s0:c0.c1023 __default__
seuser=`semanage login -l | grep root | awk '{ print $2 }'`
[ $seuser == "system_u" ] && semanage login -m -s "unconfined_u" -r s0-s0:c0.c1023 root
[ "$seuser" == "system_u" ] && semanage login -m -s "unconfined_u" -r s0-s0:c0.c1023 root
restorecon -R /root /etc/selinux/targeted 2> /dev/null
semodule -r qmail 2> /dev/null
exit 0
@ -383,6 +385,12 @@ exit 0
%endif
%changelog
* Wed Apr 23 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-39
- Change etc files to config files to allow users to read them
* Fri Apr 14 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-37
- Lots of fixes for confined domains on NFS_t homedir
* Mon Apr 14 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-36
- dontaudit mrtg reading /proc
- Allow iscsi to signal itself

19
setrans-strict.conf
View File

@ -1,19 +0,0 @@
#
# Multi-Category Security translation table for SELinux
#
# Uncomment the following to disable translation libary
# disable=1
#
# Objects can be categorized with 0-1023 categories defined by the admin.
# Objects can be in more than one category at a time.
# Categories are stored in the system as c0-c1023. Users can use this
# table to translate the categories into a more meaningful output.
# Examples:
# s0:c0=CompanyConfidential
# s0:c1=PatientRecord
# s0:c2=Unclassified
# s0:c3=TopSecret
# s0:c1,c3=CompanyConfidentialRedHat
s0=
s0-s0:c0.c1023=SystemLow-SystemHigh
s0:c0.c1023=SystemHigh

3
seusers-strict
View File

@ -1,3 +0,0 @@
system_u:system_u:s0-s0:c0.c1023
root:root:s0-s0:c0.c1023
__default__:user_u:s0

4
users_extra-strict
View File

@ -1,4 +0,0 @@
user root prefix staff;
user staff_u prefix staff;
user user_u prefix user;
user sysadm_u prefix sysadm;

136
xm.patch
View File

@ -1,136 +0,0 @@
diff -ru serefpolicy-2.2.35-orig/policy/modules/system/xen.fc serefpolicy-2.2.35/policy/modules/system/xen.fc
--- serefpolicy-2.2.35-orig/policy/modules/system/xen.fc 2006-04-24 20:14:54.000000000 -0400
+++ serefpolicy-2.2.35/policy/modules/system/xen.fc 2006-04-25 11:01:03.000000000 -0400
@@ -14,3 +14,4 @@
/var/run/xend\.pid -- gen_context(system_u:object_r:xend_var_run_t,s0)
/var/run/xenstore\.pid -- gen_context(system_u:object_r:xenstored_var_run_t,s0)
/var/run/xenstored(/.*)? gen_context(system_u:object_r:xenstored_var_run_t,s0)
+/usr/sbin/xm -- gen_context(system_u:object_r:xm_exec_t,s0)
--- serefpolicy-2.2.35-orig/policy/modules/system/xen.if 2006-04-25 10:27:36.000000000 -0400
+++ serefpolicy-2.2.35/policy/modules/system/xen.if 2006-04-25 11:03:07.000000000 -0400
@@ -83,3 +83,66 @@
allow $1 xenstored_var_run_t:sock_file { getattr write };
allow $1 xenstored_t:unix_stream_socket connectto;
')
+
+########################################
+## <summary>
+## Connect to xend over an unix stream socket.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`xen_connect',`
+ gen_require(`
+ type xend_t, xend_var_run_t;
+ ')
+
+ files_search_pids($1)
+ allow $1 xend_var_run_t:dir search;
+ allow $1 xend_var_run_t:sock_file getattr;
+ allow $1 xend_t:unix_stream_socket connectto;
+')
+
+########################################
+## <summary>
+## Write to xend over an unix stream socket.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`xen_writeto',`
+ gen_require(`
+ type xend_var_run_t;
+ ')
+
+ allow $1 xend_var_run_t:sock_file write;
+')
+
+
+########################################
+## <summary>
+## Execute a domain transition to run xm.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`xm_domtrans',`
+ gen_requires(`
+ type xm_t, xm_exec_t;
+ ')
+
+ domain_auto_trans($1,xm_exec_t,xm_t)
+
+ allow $1 xm_t:fd use;
+ allow xm_t $1:fd use;
+ allow xm_t:$1:fifo_file rw_file_perms;
+ allow xm_t $1:process sigchld;
+')
Only in serefpolicy-2.2.35/policy/modules/system: xen.if~
--- serefpolicy-2.2.35-orig/policy/modules/system/xen.te 2006-04-25 10:27:36.000000000 -0400
+++ serefpolicy-2.2.35/policy/modules/system/xen.te 2006-04-25 11:01:03.000000000 -0400
@@ -224,3 +224,55 @@
miscfiles_read_localization(xenstored_t)
xen_append_log(xenstored_t)
+
+########################################
+#
+# Declarations
+#
+
+type xm_t;
+type xm_exec_t;
+domain_type(xm_t)
+init_daemon_domain(xm_t, xm_exec_t)
+
+########################################
+#
+# xm local policy
+#
+# Check in /etc/selinux/refpolicy/include for macros to use instead of allow rules.
+
+# Some common macros (you might be able to remove some)
+files_read_etc_files(xm_t)
+libs_use_ld_so(xm_t)
+libs_use_shared_libs(xm_t)
+miscfiles_read_localization(xm_t)
+# internal communication is often done using fifo and unix sockets.
+allow xm_t self:fifo_file { read write };
+allow xm_t self:unix_stream_socket create_stream_socket_perms;
+
+
+# james -- aujdit2allow
+
+corecmd_exec_bin(xm_t)
+corecmd_exec_sbin(xm_t)
+
+kernel_read_system_state(xm_t)
+kernel_read_kernel_sysctls(xm_t)
+kernel_read_xen_state(xm_t)
+kernel_write_xen_state(xm_t)
+term_use_all_terms(xm_t)
+
+dev_read_urand(xm_t)
+
+xen_append_log(xm_t)
+xen_connect(xm_t)
+xen_writeto(xm_t)
+
+xen_stream_connect_xenstore(xm_t)
+allow xm_t self:capability dac_override;
+
+
+# allow xm_t root_t:dir search;
+# Need to relabel files for xen
+auth_read_all_files_except_shadow(xm_t)
+