From 4b9516c125d25fb2571b1afa05177cf9165548fd Mon Sep 17 00:00:00 2001 From: Chris PeBenito Date: Wed, 9 Nov 2005 17:12:34 +0000 Subject: [PATCH] add avahi --- refpolicy/Changelog | 1 + refpolicy/policy/modules/services/avahi.fc | 5 + refpolicy/policy/modules/services/avahi.if | 1 + refpolicy/policy/modules/services/avahi.te | 115 +++++++++++++++++++++ refpolicy/policy/modules/system/init.if | 32 ++++++ 5 files changed, 154 insertions(+) create mode 100644 refpolicy/policy/modules/services/avahi.fc create mode 100644 refpolicy/policy/modules/services/avahi.if create mode 100644 refpolicy/policy/modules/services/avahi.te diff --git a/refpolicy/Changelog b/refpolicy/Changelog index c92a2d1b..88501b31 100644 --- a/refpolicy/Changelog +++ b/refpolicy/Changelog @@ -3,6 +3,7 @@ - DISTRO=redhat now implies DIRECT_INITRC=y. - Added policies: amanda + avahi canna cyrus dbskk diff --git a/refpolicy/policy/modules/services/avahi.fc b/refpolicy/policy/modules/services/avahi.fc new file mode 100644 index 00000000..49dcc5f3 --- /dev/null +++ b/refpolicy/policy/modules/services/avahi.fc @@ -0,0 +1,5 @@ + +/usr/sbin/avahi-daemon -- gen_context(system_u:object_r:avahi_exec_t,s0) +/usr/sbin/avahi-dnsconfd -- gen_context(system_u:object_r:avahi_exec_t,s0) + +/var/run/avahi-daemon(/.*)? gen_context(system_u:object_r:avahi_var_run_t,s0) diff --git a/refpolicy/policy/modules/services/avahi.if b/refpolicy/policy/modules/services/avahi.if new file mode 100644 index 00000000..8bc232b9 --- /dev/null +++ b/refpolicy/policy/modules/services/avahi.if @@ -0,0 +1 @@ +## mDNS/DNS-SD daemon implementing Apple ZeroConf architecture diff --git a/refpolicy/policy/modules/services/avahi.te b/refpolicy/policy/modules/services/avahi.te new file mode 100644 index 00000000..07c28241 --- /dev/null +++ b/refpolicy/policy/modules/services/avahi.te @@ -0,0 +1,115 @@ + +policy_module(avahi,1.0) + +######################################## +# +# Declarations +# + +type avahi_t; +type avahi_exec_t; +init_daemon_domain(avahi_t,avahi_exec_t) + +type avahi_var_run_t; +files_pid_file(avahi_var_run_t) + +######################################## +# +# Local policy +# + +allow avahi_t self:capability { dac_override setgid chown kill setuid }; +dontaudit avahi_t self:capability sys_tty_config; +allow avahi_t self:process { setrlimit signal_perms }; +allow avahi_t self:fifo_file { read write }; +allow avahi_t self:unix_stream_socket { connectto create_stream_socket_perms }; +allow avahi_t self:unix_dgram_socket create_socket_perms; +allow avahi_t self:netlink_route_socket r_netlink_socket_perms; +allow avahi_t self:tcp_socket create_stream_socket_perms; +allow avahi_t self:udp_socket create_socket_perms; + +allow avahi_t avahi_var_run_t:sock_file create_file_perms; +allow avahi_t avahi_var_run_t:file create_file_perms; +allow avahi_t avahi_var_run_t:dir { rw_dir_perms setattr }; +files_create_pid(avahi_t,avahi_var_run_t) + +kernel_read_kernel_sysctl(avahi_t) +kernel_list_proc(avahi_t) +kernel_read_proc_symlinks(avahi_t) +kernel_read_network_state(avahi_t) + +corenet_tcp_sendrecv_all_if(avahi_t) +corenet_raw_sendrecv_all_if(avahi_t) +corenet_udp_sendrecv_all_if(avahi_t) +corenet_tcp_sendrecv_all_nodes(avahi_t) +corenet_raw_sendrecv_all_nodes(avahi_t) +corenet_udp_sendrecv_all_nodes(avahi_t) +corenet_tcp_sendrecv_all_ports(avahi_t) +corenet_udp_sendrecv_all_ports(avahi_t) +corenet_tcp_bind_all_nodes(avahi_t) +corenet_udp_bind_all_nodes(avahi_t) +corenet_tcp_bind_howl_port(avahi_t) +corenet_udp_bind_howl_port(avahi_t) + +dev_read_sysfs(avahi_t) +dev_read_urand(avahi_t) + +fs_getattr_all_fs(avahi_t) +fs_search_auto_mountpoints(avahi_t) + +term_dontaudit_use_console(avahi_t) + +domain_use_wide_inherit_fd(avahi_t) + +files_read_etc_files(avahi_t) + +init_use_fd(avahi_t) +init_use_script_pty(avahi_t) +init_signal_script(avahi_t) +init_signull_script(avahi_t) + +libs_use_ld_so(avahi_t) +libs_use_shared_libs(avahi_t) + +logging_send_syslog_msg(avahi_t) + +miscfiles_read_localization(avahi_t) + +sysnet_read_config(avahi_t) + +userdom_dontaudit_use_unpriv_user_fd(avahi_t) +userdom_dontaudit_search_sysadm_home_dir(avahi_t) + +ifdef(`targeted_policy',` + term_dontaudit_use_unallocated_tty(avahi_t) + term_dontaudit_use_generic_pty(avahi_t) + files_dontaudit_read_root_file(avahi_t) +') + +optional_policy(`dbus.te',` + dbus_system_bus_client_template(avahi,avahi_t) + dbus_connect_system_bus(avahi_t) + dbus_send_system_bus_msg(avahi_t) + + # FIXME: + allow avahi_t unconfined_t:dbus send_msg; + allow unconfined_t avahi_t:dbus send_msg; +') + +optional_policy(`nis.te',` + nis_use_ypbind(avahi_t) +') + +optional_policy(`selinuxutil.te',` + seutil_sigchld_newrole(avahi_t) +') + +optional_policy(`udev.te',` + udev_read_db(avahi_t) +') + +ifdef(`TODO',` +optional_policy(`rhgb.te',` + rhgb_domain(avahi_t) +') +') dnl end TODO diff --git a/refpolicy/policy/modules/system/init.if b/refpolicy/policy/modules/system/init.if index 3a9e940e..5ee661e7 100644 --- a/refpolicy/policy/modules/system/init.if +++ b/refpolicy/policy/modules/system/init.if @@ -579,6 +579,38 @@ interface(`init_sigchld_script',` allow $1 initrc_t:process sigchld; ') +######################################## +## +## Send generic signals to init scripts. +## +## +## Domain allowed access. +## +# +interface(`init_signal_script',` + gen_require(` + type initrc_t; + ') + + allow $1 initrc_t:process signal; +') + +######################################## +## +## Send null signals to init scripts. +## +## +## Domain allowed access. +## +# +interface(`init_signull_script',` + gen_require(` + type initrc_t; + ') + + allow $1 initrc_t:process signull; +') + ######################################## ## ## Read and write init script unnamed pipes.