patch from dan Tue, 06 Jun 2006 22:50:46 -0400
This commit is contained in:
Chris PeBenito
parent
e51048a4e8
commit
522b59bb97
@ -56,6 +56,22 @@ gen_tunable(allow_execstack,false)
|
||||
## </desc>
|
||||
gen_tunable(allow_ftpd_anon_write,false)
|
||||
|
||||
## <desc>
|
||||
## <p>
|
||||
## Allow ftp servers to use cifs
|
||||
## used for public file transfer services.
|
||||
## </p>
|
||||
## </desc>
|
||||
gen_tunable(allow_ftpd_use_cifs,false)
|
||||
|
||||
## <desc>
|
||||
## <p>
|
||||
## Allow ftp servers to use nfs
|
||||
## used for public file transfer services.
|
||||
## </p>
|
||||
## </desc>
|
||||
gen_tunable(allow_ftpd_use_nfs,false)
|
||||
|
||||
## <desc>
|
||||
## <p>
|
||||
## Allow gssd to read temp directory.
|
||||
|
||||
@ -84,6 +84,25 @@ interface(`rpm_run',`
|
||||
allow rpm_t $3:chr_file rw_term_perms;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Execute the rpm client in the caller domain.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`rpm_exec',`
|
||||
gen_require(`
|
||||
type rpm_exec_t;
|
||||
')
|
||||
|
||||
corecmd_search_bin($1)
|
||||
can_exec($1,rpm_exec_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Inherit and use file descriptors from RPM.
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
|
||||
policy_module(rpm,1.3.6)
|
||||
policy_module(rpm,1.3.7)
|
||||
|
||||
########################################
|
||||
#
|
||||
@ -333,6 +333,14 @@ ifdef(`distro_redhat',`
|
||||
|
||||
ifdef(`targeted_policy',`
|
||||
unconfined_domain(rpm_script_t)
|
||||
|
||||
optional_policy(`
|
||||
java_domtrans(rpm_script_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
mono_domtrans(rpm_script_t)
|
||||
')
|
||||
',`
|
||||
optional_policy(`
|
||||
bootloader_domtrans(rpm_script_t)
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
|
||||
policy_module(webalizer,1.2.0)
|
||||
policy_module(webalizer,1.2.1)
|
||||
|
||||
########################################
|
||||
#
|
||||
@ -44,6 +44,7 @@ allow webalizer_t self:unix_stream_socket create_stream_socket_perms;
|
||||
allow webalizer_t self:unix_dgram_socket sendto;
|
||||
allow webalizer_t self:unix_stream_socket connectto;
|
||||
allow webalizer_t self:tcp_socket connected_stream_socket_perms;
|
||||
allow webalizer_t self:netlink_route_socket r_netlink_socket_perms;
|
||||
|
||||
allow webalizer_t webalizer_etc_t:file { getattr read };
|
||||
|
||||
|
||||
@ -1 +1,2 @@
|
||||
/usr/bin/wine -- gen_context(system_u:object_r:wine_exec_t,s0)
|
||||
/usr/bin/wine -- gen_context(system_u:object_r:wine_exec_t,s0)
|
||||
/opt/picasa/wine/bin/wine -- gen_context(system_u:object_r:wine_exec_t,s0)
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
|
||||
policy_module(wine,1.1.1)
|
||||
policy_module(wine,1.1.2)
|
||||
|
||||
########################################
|
||||
#
|
||||
@ -21,4 +21,8 @@ ifdef(`targeted_policy',`
|
||||
allow wine_t self:process { execstack execmem };
|
||||
unconfined_domain_noaudit(wine_t)
|
||||
files_execmod_all_files(wine_t)
|
||||
|
||||
optional_policy(`
|
||||
hal_dbus_chat(wine_t)
|
||||
')
|
||||
')
|
||||
|
||||
@ -120,11 +120,6 @@ ifdef(`distro_gentoo',`
|
||||
/usr/lib/ccache/bin(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/lib/pgsql/test/regress/.*\.sh -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/lib/qt.*/bin(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
# these two lines are separate because of a
|
||||
# sorting issue with the java module
|
||||
/usr/lib/jvm/java.*/bin -d gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/lib/jvm/java.*/bin/.* gen_context(system_u:object_r:bin_t,s0)
|
||||
|
||||
/usr/lib(64)?/[^/]*firefox[^/]*/firefox -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/lib(64)?/apt/methods.+ -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/lib(64)?/courier(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
@ -135,6 +130,7 @@ ifdef(`distro_gentoo',`
|
||||
/usr/lib(64)?/emacsen-common/.* gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/lib(64)?/ipsec/.* -- gen_context(system_u:object_r:sbin_t,s0)
|
||||
/usr/lib(64)?/mailman/bin(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/lib(64)?/mailman/mail(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/lib(64)?/misc/sftp-server -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/lib(64)?/nagios/plugins(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/lib(64)?/netsaint/plugins(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
|
||||
policy_module(corecommands,1.3.10)
|
||||
policy_module(corecommands,1.3.11)
|
||||
|
||||
########################################
|
||||
#
|
||||
|
||||
@ -397,6 +397,26 @@ interface(`fs_dontaudit_list_auto_mountpoints',`
|
||||
dontaudit $1 autofs_t:dir r_dir_perms;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Get the attributes of directories on
|
||||
## binfmt_misc filesystems.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`fs_getattr_binfmt_misc_dirs',`
|
||||
gen_require(`
|
||||
type binfmt_misc_t;
|
||||
')
|
||||
|
||||
allow $1 binfmt_misc_t:dir getattr;
|
||||
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Register an interpreter for new binary
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
|
||||
policy_module(filesystem,1.3.7)
|
||||
policy_module(filesystem,1.3.8)
|
||||
|
||||
########################################
|
||||
#
|
||||
@ -77,6 +77,10 @@ type nfsd_fs_t;
|
||||
fs_type(nfsd_fs_t)
|
||||
genfscon nfsd / gen_context(system_u:object_r:nfsd_fs_t,s0)
|
||||
|
||||
type oprofilefs_t;
|
||||
fs_type(oprofilefs_t)
|
||||
genfscon oprofilefs / gen_context(system_u:object_r:oprofilefs_t,s0)
|
||||
|
||||
type ramfs_t;
|
||||
fs_type(ramfs_t)
|
||||
genfscon ramfs / gen_context(system_u:object_r:ramfs_t,s0)
|
||||
|
||||
@ -7,6 +7,6 @@
|
||||
/var/amavis(/.*)? gen_context(system_u:object_r:amavis_var_lib_t,s0)
|
||||
/var/lib/amavis(/.*)? gen_context(system_u:object_r:amavis_var_lib_t,s0)
|
||||
/var/log/amavisd\.log -- gen_context(system_u:object_r:amavis_var_log_t,s0)
|
||||
/var/run/amavis(/.*)? gen_context(system_u:object_r:amavis_var_run_t,s0)
|
||||
/var/run/amavis(d)?(/.*)? gen_context(system_u:object_r:amavis_var_run_t,s0)
|
||||
/var/spool/amavisd(/.*)? gen_context(system_u:object_r:amavis_spool_t,s0)
|
||||
/var/virusmails(/.*)? gen_context(system_u:object_r:amavis_quarantine_t,s0)
|
||||
|
||||
@ -26,6 +26,76 @@ interface(`amavis_domtrans',`
|
||||
allow amavis_t $1:process sigchld;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Read amavis spool files.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`amavis_read_spool_files',`
|
||||
gen_require(`
|
||||
type amavis_spool_t;
|
||||
')
|
||||
|
||||
files_search_spool($1)
|
||||
allow $1 amavis_spool_t:file { getattr read };
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Manage amavis spool files.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`amavis_manage_spool_files',`
|
||||
gen_require(`
|
||||
type amavis_spool_t;
|
||||
')
|
||||
|
||||
files_search_spool($1)
|
||||
allow $1 amavis_spool_t:dir manage_dir_perms;
|
||||
allow $1 amavis_spool_t:file manage_file_perms;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Create objects in the amavis spool directories
|
||||
## with a private type.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
## <param name="private_type">
|
||||
## <summary>
|
||||
## Private file type.
|
||||
## </summary>
|
||||
## </param>
|
||||
## <param name="object_class">
|
||||
## <summary>
|
||||
## Class of the object being created.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`amavis_spool_filetrans',`
|
||||
gen_require(`
|
||||
type amavis_spool_t;
|
||||
')
|
||||
|
||||
files_search_spool($1)
|
||||
allow $1 amavis_spool_t:dir rw_dir_perms;
|
||||
type_transition $1 amavis_spool_t:$3 $2;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Search amavis lib directories.
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
|
||||
policy_module(amavis,1.0.4)
|
||||
policy_module(amavis,1.0.5)
|
||||
|
||||
########################################
|
||||
#
|
||||
@ -64,6 +64,7 @@ allow amavis_t amavis_quarantine_t:dir create_dir_perms;
|
||||
# Spool Files
|
||||
allow amavis_t amavis_spool_t:dir manage_dir_perms;
|
||||
allow amavis_t amavis_spool_t:file manage_file_perms;
|
||||
allow amavis_t amavis_spool_t:sock_file manage_file_perms;
|
||||
files_spool_filetrans(amavis_t,amavis_spool_t,{ dir file })
|
||||
|
||||
# tmp files
|
||||
@ -93,6 +94,7 @@ files_pid_filetrans(amavis_t,amavis_var_run_t, { file sock_file })
|
||||
kernel_read_kernel_sysctls(amavis_t)
|
||||
# amavis tries to access /proc/self/stat, /etc/shadow and /root - perl...
|
||||
kernel_dontaudit_list_proc(amavis_t)
|
||||
kernel_dontaudit_read_proc_symlinks(amavis_t)
|
||||
kernel_dontaudit_read_system_state(amavis_t)
|
||||
|
||||
# find perl
|
||||
@ -102,6 +104,8 @@ corecmd_search_sbin(amavis_t)
|
||||
corenet_non_ipsec_sendrecv(amavis_t)
|
||||
corenet_tcp_sendrecv_all_if(amavis_t)
|
||||
corenet_tcp_sendrecv_all_nodes(amavis_t)
|
||||
corenet_tcp_bind_all_nodes(amavis_t)
|
||||
corenet_udp_bind_all_nodes(amavis_t)
|
||||
# amavis uses well-defined ports
|
||||
corenet_tcp_sendrecv_amavisd_recv_port(amavis_t)
|
||||
corenet_tcp_sendrecv_amavisd_send_port(amavis_t)
|
||||
@ -111,6 +115,7 @@ corenet_tcp_sendrecv_all_ports(amavis_t)
|
||||
corenet_tcp_connect_amavisd_send_port(amavis_t)
|
||||
# bind to incoming port
|
||||
corenet_tcp_bind_amavisd_recv_port(amavis_t)
|
||||
corenet_udp_bind_generic_port(amavis_t)
|
||||
|
||||
dev_read_rand(amavis_t)
|
||||
dev_read_urand(amavis_t)
|
||||
|
||||
@ -115,6 +115,7 @@ template(`apache_content_template',`
|
||||
seutil_dontaudit_search_config(httpd_$1_script_t)
|
||||
|
||||
tunable_policy(`httpd_enable_cgi && httpd_unified',`
|
||||
allow httpd_$1_script_t httpdcontent:file entrypoint;
|
||||
allow httpd_$1_script_t httpdcontent:dir create_dir_perms;
|
||||
allow httpd_$1_script_t httpdcontent:file create_file_perms;
|
||||
allow httpd_$1_script_t httpdcontent:lnk_file create_lnk_perms;
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
|
||||
policy_module(apache,1.3.12)
|
||||
policy_module(apache,1.3.13)
|
||||
|
||||
#
|
||||
# NOTES:
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
|
||||
policy_module(bluetooth,1.2.7)
|
||||
policy_module(bluetooth,1.2.8)
|
||||
|
||||
########################################
|
||||
#
|
||||
@ -125,6 +125,8 @@ init_use_script_ptys(bluetooth_t)
|
||||
libs_use_ld_so(bluetooth_t)
|
||||
libs_use_shared_libs(bluetooth_t)
|
||||
|
||||
locallogin_dontaudit_use_fds(bluetooth_helper_t)
|
||||
|
||||
logging_send_syslog_msg(bluetooth_t)
|
||||
|
||||
miscfiles_read_localization(bluetooth_t)
|
||||
@ -223,6 +225,8 @@ ifdef(`targeted_policy',`
|
||||
xserver_stream_connect_xdm(bluetooth_helper_t)
|
||||
xserver_use_xdm_fds(bluetooth_helper_t)
|
||||
xserver_rw_xdm_pipes(bluetooth_helper_t)
|
||||
# when started via startx
|
||||
xserver_stream_connect_xdm_xserver(bluetooth_helper_t)
|
||||
')
|
||||
')
|
||||
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
|
||||
policy_module(clamav,1.0.2)
|
||||
policy_module(clamav,1.0.3)
|
||||
|
||||
########################################
|
||||
#
|
||||
@ -39,6 +39,10 @@ type clamscan_t;
|
||||
type clamscan_exec_t;
|
||||
init_daemon_domain(clamscan_t, clamscan_exec_t)
|
||||
|
||||
# tmp files
|
||||
type clamscan_tmp_t;
|
||||
files_tmp_file(clamscan_tmp_t)
|
||||
|
||||
type freshclam_t;
|
||||
type freshclam_exec_t;
|
||||
init_daemon_domain(freshclam_t, freshclam_exec_t)
|
||||
@ -111,6 +115,7 @@ domain_use_interactive_fds(clamd_t)
|
||||
|
||||
files_read_etc_files(clamd_t)
|
||||
files_read_etc_runtime_files(clamd_t)
|
||||
files_search_spool(clamd_t)
|
||||
|
||||
init_use_fds(clamd_t)
|
||||
init_use_script_ptys(clamd_t)
|
||||
@ -118,6 +123,8 @@ init_use_script_ptys(clamd_t)
|
||||
libs_use_ld_so(clamd_t)
|
||||
libs_use_shared_libs(clamd_t)
|
||||
|
||||
logging_send_syslog_msg(clamd_t)
|
||||
|
||||
miscfiles_read_localization(clamd_t)
|
||||
|
||||
sysnet_dns_name_resolve(clamd_t)
|
||||
@ -126,8 +133,14 @@ cron_use_fds(clamd_t)
|
||||
cron_use_system_job_fds(clamd_t)
|
||||
cron_rw_pipes(clamd_t)
|
||||
|
||||
ifdef(`targeted_policy',`
|
||||
term_dontaudit_use_generic_ptys(clamd_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
amavis_read_lib_files(clamd_t)
|
||||
amavis_read_spool_files(clamd_t)
|
||||
amavis_spool_filetrans(clamd_t,clamd_var_run_t,sock_file)
|
||||
')
|
||||
|
||||
########################################
|
||||
@ -214,6 +227,11 @@ allow clamscan_t clamd_etc_t:dir r_dir_perms;
|
||||
allow clamscan_t clamd_etc_t:file r_file_perms;
|
||||
allow clamscan_t clamd_etc_t:lnk_file { getattr read };
|
||||
|
||||
# tmp files
|
||||
allow clamscan_t clamscan_tmp_t:file manage_file_perms;
|
||||
allow clamscan_t clamscan_tmp_t:dir manage_dir_perms;
|
||||
files_tmp_filetrans(clamscan_t,clamscan_tmp_t,{ file dir })
|
||||
|
||||
# var/lib files together with clamd
|
||||
allow clamscan_t clamd_var_lib_t:file r_file_perms;
|
||||
allow clamscan_t clamd_var_lib_t:sock_file rw_file_perms;
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
|
||||
policy_module(cups,1.3.5)
|
||||
policy_module(cups,1.3.6)
|
||||
|
||||
########################################
|
||||
#
|
||||
@ -74,14 +74,14 @@ files_pid_file(ptal_var_run_t)
|
||||
#
|
||||
|
||||
# /usr/lib/cups/backend/serial needs sys_admin(?!)
|
||||
allow cupsd_t self:capability { sys_admin dac_read_search kill setgid setuid fsetid net_bind_service fowner chown dac_override sys_tty_config audit_write };
|
||||
allow cupsd_t self:capability { sys_admin dac_override dac_read_search kill setgid setuid fsetid net_bind_service fowner chown dac_override sys_tty_config audit_write };
|
||||
dontaudit cupsd_t self:capability { sys_tty_config net_admin };
|
||||
allow cupsd_t self:process { setsched signal_perms };
|
||||
allow cupsd_t self:fifo_file rw_file_perms;
|
||||
allow cupsd_t self:unix_stream_socket { create_stream_socket_perms connectto };
|
||||
allow cupsd_t self:unix_dgram_socket create_socket_perms;
|
||||
allow cupsd_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay };
|
||||
allow cupsd_t self:netlink_route_socket { r_netlink_socket_perms };
|
||||
allow cupsd_t self:netlink_route_socket r_netlink_socket_perms;
|
||||
allow cupsd_t self:tcp_socket { create_stream_socket_perms connectto acceptfrom recvfrom };
|
||||
allow cupsd_t self:udp_socket create_socket_perms;
|
||||
allow cupsd_t self:appletalk_socket create_socket_perms;
|
||||
@ -565,6 +565,7 @@ allow hplip_t self:unix_dgram_socket create_socket_perms;
|
||||
allow hplip_t self:unix_stream_socket create_socket_perms;
|
||||
allow hplip_t self:tcp_socket create_stream_socket_perms;
|
||||
allow hplip_t self:udp_socket create_socket_perms;
|
||||
allow hplip_t self:netlink_route_socket r_netlink_socket_perms;
|
||||
# cjp: raw?
|
||||
allow hplip_t self:rawip_socket create_socket_perms;
|
||||
|
||||
@ -635,6 +636,7 @@ sysnet_read_config(hplip_t)
|
||||
|
||||
userdom_dontaudit_use_unpriv_user_fds(hplip_t)
|
||||
userdom_dontaudit_search_sysadm_home_dirs(hplip_t)
|
||||
userdom_dontaudit_search_all_users_home_content(hplip_t)
|
||||
|
||||
lpd_read_config(cupsd_t)
|
||||
|
||||
@ -645,11 +647,11 @@ ifdef(`targeted_policy', `
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
mount_send_nfs_client_request(hplip_t)
|
||||
seutil_sigchld_newrole(hplip_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
seutil_sigchld_newrole(hplip_t)
|
||||
snmp_read_snmp_var_lib_files(hplip_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
|
||||
policy_module(dbus,1.2.3)
|
||||
policy_module(dbus,1.2.4)
|
||||
|
||||
gen_require(`
|
||||
class dbus { send_msg acquire_svc };
|
||||
@ -38,6 +38,7 @@ allow system_dbusd_t self:dbus { send_msg acquire_svc };
|
||||
allow system_dbusd_t self:unix_stream_socket { connectto create_stream_socket_perms connectto };
|
||||
allow system_dbusd_t self:unix_dgram_socket create_socket_perms;
|
||||
allow system_dbusd_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay };
|
||||
allow system_dbusd_t self:netlink_route_socket r_netlink_socket_perms;
|
||||
# Receive notifications of policy reloads and enforcing status changes.
|
||||
allow system_dbusd_t self:netlink_selinux_socket { create bind read };
|
||||
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
|
||||
policy_module(dovecot,1.2.3)
|
||||
policy_module(dovecot,1.2.4)
|
||||
|
||||
########################################
|
||||
#
|
||||
@ -42,6 +42,7 @@ allow dovecot_t self:fifo_file rw_file_perms;
|
||||
allow dovecot_t self:tcp_socket create_stream_socket_perms;
|
||||
allow dovecot_t self:unix_dgram_socket create_socket_perms;
|
||||
allow dovecot_t self:unix_stream_socket { create_stream_socket_perms connectto };
|
||||
allow dovecot_t self:netlink_route_socket r_netlink_socket_perms;
|
||||
|
||||
domain_auto_trans(dovecot_t, dovecot_auth_exec_t, dovecot_auth_t)
|
||||
allow dovecot_t dovecot_auth_t:fd use;
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
|
||||
policy_module(ftp,1.2.4)
|
||||
policy_module(ftp,1.2.5)
|
||||
|
||||
########################################
|
||||
#
|
||||
@ -139,7 +139,25 @@ ifdef(`targeted_policy',`
|
||||
|
||||
tunable_policy(`allow_ftpd_anon_write',`
|
||||
miscfiles_manage_public_files(ftpd_t)
|
||||
')
|
||||
')
|
||||
|
||||
tunable_policy(`allow_ftpd_use_cifs',`
|
||||
fs_read_cifs_files(ftpd_t)
|
||||
fs_read_cifs_symlinks(ftpd_t)
|
||||
')
|
||||
|
||||
tunable_policy(`allow_ftpd_use_cifs && allow_ftpd_anon_write',`
|
||||
fs_manage_cifs_files(ftpd_t)
|
||||
')
|
||||
|
||||
tunable_policy(`allow_ftpd_use_nfs',`
|
||||
fs_read_nfs_files(ftpd_t)
|
||||
fs_read_nfs_symlinks(ftpd_t)
|
||||
')
|
||||
|
||||
tunable_policy(`allow_ftpd_use_nfs && allow_ftpd_anon_write',`
|
||||
fs_manage_nfs_files(ftpd_t)
|
||||
')
|
||||
|
||||
tunable_policy(`ftp_home_dir',`
|
||||
allow ftpd_t self:capability { dac_override dac_read_search };
|
||||
@ -156,6 +174,16 @@ tunable_policy(`ftp_home_dir',`
|
||||
')
|
||||
')
|
||||
|
||||
tunable_policy(`ftp_home_dir && use_nfs_home_dirs',`
|
||||
fs_manage_nfs_files(ftpd_t)
|
||||
fs_read_nfs_symlinks(ftpd_t)
|
||||
')
|
||||
|
||||
tunable_policy(`ftp_home_dir && use_samba_home_dirs',`
|
||||
fs_manage_cifs_files(ftpd_t)
|
||||
fs_read_cifs_symlinks(ftpd_t)
|
||||
')
|
||||
|
||||
tunable_policy(`ftpd_is_daemon',`
|
||||
allow ftpd_t ftpd_lock_t:file create_file_perms;
|
||||
files_lock_filetrans(ftpd_t,ftpd_lock_t,file)
|
||||
@ -163,16 +191,6 @@ tunable_policy(`ftpd_is_daemon',`
|
||||
corenet_tcp_bind_ftp_port(ftpd_t)
|
||||
')
|
||||
|
||||
tunable_policy(`use_nfs_home_dirs && ftp_home_dir',`
|
||||
fs_read_nfs_files(ftpd_t)
|
||||
fs_read_nfs_symlinks(ftpd_t)
|
||||
')
|
||||
|
||||
tunable_policy(`use_samba_home_dirs && ftp_home_dir',`
|
||||
fs_read_cifs_files(ftpd_t)
|
||||
fs_read_cifs_symlinks(ftpd_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
corecmd_exec_shell(ftpd_t)
|
||||
|
||||
|
||||
@ -6,5 +6,6 @@
|
||||
/var/lib/ldap(/.*)? gen_context(system_u:object_r:slapd_db_t,s0)
|
||||
/var/lib/ldap/replog(/.*)? gen_context(system_u:object_r:slapd_replog_t,s0)
|
||||
|
||||
/var/run/openldap(/.*)? gen_context(system_u:object_r:slapd_var_run_t,s0)
|
||||
/var/run/slapd\.args -- gen_context(system_u:object_r:slapd_var_run_t,s0)
|
||||
/var/run/slapd\.pid -- gen_context(system_u:object_r:slapd_var_run_t,s0)
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
|
||||
policy_module(ldap,1.2.2)
|
||||
policy_module(ldap,1.2.3)
|
||||
|
||||
########################################
|
||||
#
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
|
||||
policy_module(mysql,1.2.2)
|
||||
policy_module(mysql,1.2.3)
|
||||
|
||||
########################################
|
||||
#
|
||||
@ -32,7 +32,7 @@ files_tmp_file(mysqld_tmp_t)
|
||||
|
||||
allow mysqld_t self:capability { dac_override setgid setuid sys_resource net_bind_service };
|
||||
dontaudit mysqld_t self:capability sys_tty_config;
|
||||
allow mysqld_t self:process { setsched getsched setrlimit signal_perms };
|
||||
allow mysqld_t self:process { setsched getsched setrlimit signal_perms rlimitinh };
|
||||
allow mysqld_t self:fifo_file { read write };
|
||||
allow mysqld_t self:netlink_route_socket r_netlink_socket_perms;
|
||||
allow mysqld_t self:unix_stream_socket create_stream_socket_perms;
|
||||
|
||||
@ -1,4 +1,5 @@
|
||||
|
||||
/usr/(s)?bin/NetworkManager -- gen_context(system_u:object_r:NetworkManager_exec_t,s0)
|
||||
/var/run/NetworkManager.pid -- gen_context(system_u:object_r:NetworkManager_var_run_t,s0)
|
||||
/var/run/NetworkManager(/.*)? gen_context(system_u:object_r:NetworkManager_var_run_t,s0)
|
||||
/var/run/wpa_supplicant(/.*)? gen_context(system_u:object_r:NetworkManager_var_run_t,s0)
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
|
||||
policy_module(networkmanager,1.3.2)
|
||||
policy_module(networkmanager,1.3.3)
|
||||
|
||||
########################################
|
||||
#
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
|
||||
policy_module(nscd,1.2.4)
|
||||
policy_module(nscd,1.2.5)
|
||||
|
||||
gen_require(`
|
||||
class nscd all_nscd_perms;
|
||||
@ -131,3 +131,8 @@ optional_policy(`
|
||||
optional_policy(`
|
||||
udev_read_db(nscd_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
xen_dontaudit_rw_unix_stream_sockets(nscd_t)
|
||||
xen_append_log(nscd_t)
|
||||
')
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
|
||||
policy_module(pegasus,1.1.3)
|
||||
policy_module(pegasus,1.1.4)
|
||||
|
||||
########################################
|
||||
#
|
||||
@ -30,7 +30,7 @@ files_pid_file(pegasus_var_run_t)
|
||||
# Local policy
|
||||
#
|
||||
|
||||
allow pegasus_t self:capability { dac_override net_bind_service audit_write };
|
||||
allow pegasus_t self:capability { chown sys_nice setuid setgid dac_override net_bind_service audit_write };
|
||||
dontaudit pegasus_t self:capability sys_tty_config;
|
||||
allow pegasus_t self:process signal;
|
||||
allow pegasus_t self:fifo_file rw_file_perms;
|
||||
@ -48,6 +48,8 @@ allow pegasus_t pegasus_data_t:file create_file_perms;
|
||||
allow pegasus_t pegasus_data_t:lnk_file create_lnk_perms;
|
||||
type_transition pegasus_t pegasus_conf_t:{ file dir } pegasus_data_t;
|
||||
|
||||
can_exec(pegasus_t,pegasus_exec_t)
|
||||
|
||||
allow pegasus_t pegasus_mof_t:dir r_dir_perms;
|
||||
allow pegasus_t pegasus_mof_t:file r_file_perms;
|
||||
allow pegasus_t pegasus_mof_t:lnk_file { getattr read };
|
||||
@ -65,6 +67,7 @@ kernel_read_kernel_sysctls(pegasus_t)
|
||||
kernel_read_fs_sysctls(pegasus_t)
|
||||
kernel_read_system_state(pegasus_t)
|
||||
kernel_search_vm_sysctl(pegasus_t)
|
||||
kernel_read_net_sysctls(pegasus_t)
|
||||
|
||||
corenet_non_ipsec_sendrecv(pegasus_t)
|
||||
corenet_tcp_sendrecv_all_if(pegasus_t)
|
||||
@ -111,6 +114,7 @@ hostname_exec(pegasus_t)
|
||||
init_use_fds(pegasus_t)
|
||||
init_use_script_ptys(pegasus_t)
|
||||
init_rw_utmp(pegasus_t)
|
||||
init_stream_connect_script(pegasus_t)
|
||||
|
||||
libs_use_ld_so(pegasus_t)
|
||||
libs_use_shared_libs(pegasus_t)
|
||||
@ -137,6 +141,10 @@ optional_policy(`
|
||||
nscd_socket_use(pegasus_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
rpm_exec(pegasus_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
seutil_sigchld_newrole(pegasus_t)
|
||||
seutil_dontaudit_read_config(pegasus_t)
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
|
||||
policy_module(postfix,1.2.6)
|
||||
policy_module(postfix,1.2.7)
|
||||
|
||||
########################################
|
||||
#
|
||||
@ -290,7 +290,7 @@ mta_read_config(postfix_local_t)
|
||||
|
||||
optional_policy(`
|
||||
# for postalias
|
||||
mailman_read_data_files(postfix_local_t)
|
||||
mailman_manage_data_files(postfix_local_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
|
||||
policy_module(pyzor,1.0.2)
|
||||
policy_module(pyzor,1.0.3)
|
||||
|
||||
########################################
|
||||
#
|
||||
@ -31,10 +31,24 @@ files_type(pyzor_var_lib_t)
|
||||
# Pyzor local policy
|
||||
#
|
||||
|
||||
allow pyzor_t self:udp_socket create_socket_perms;
|
||||
|
||||
allow pyzor_t pyzor_var_lib_t:dir r_dir_perms;
|
||||
allow pyzor_t pyzor_var_lib_t:file r_file_perms;
|
||||
files_search_var_lib(pyzor_t)
|
||||
|
||||
kernel_read_kernel_sysctls(pyzor_t)
|
||||
kernel_read_system_state(pyzor_t)
|
||||
|
||||
corecmd_list_bin(pyzor_t)
|
||||
corecmd_getattr_bin_files(pyzor_t)
|
||||
|
||||
corenet_udp_sendrecv_all_if(pyzor_t)
|
||||
corenet_udp_sendrecv_all_nodes(pyzor_t)
|
||||
corenet_udp_sendrecv_all_ports(pyzor_t)
|
||||
|
||||
dev_read_urand(pyzor_t)
|
||||
|
||||
files_read_etc_files(pyzor_t)
|
||||
|
||||
auth_use_nsswitch(pyzor_t)
|
||||
@ -46,6 +60,7 @@ miscfiles_read_localization(pyzor_t)
|
||||
|
||||
optional_policy(`
|
||||
amavis_manage_lib_files(pyzor_t)
|
||||
amavis_manage_spool_files(pyzor_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
|
||||
policy_module(samba,1.2.5)
|
||||
policy_module(samba,1.2.6)
|
||||
|
||||
#################################
|
||||
#
|
||||
@ -225,6 +225,7 @@ allow smbd_t winbind_var_run_t:sock_file { read write getattr };
|
||||
kernel_getattr_core_if(smbd_t)
|
||||
kernel_getattr_message_if(smbd_t)
|
||||
kernel_read_network_state(smbd_t)
|
||||
kernel_read_fs_sysctls(smbd_t)
|
||||
kernel_read_kernel_sysctls(smbd_t)
|
||||
kernel_read_software_raid_state(smbd_t)
|
||||
kernel_read_system_state(smbd_t)
|
||||
@ -252,6 +253,7 @@ dev_dontaudit_getattr_usbfs_dirs(smbd_t)
|
||||
fs_getattr_all_fs(smbd_t)
|
||||
fs_get_xattr_fs_quotas(smbd_t)
|
||||
fs_search_auto_mountpoints(smbd_t)
|
||||
fs_getattr_rpc_dirs(smbd_t)
|
||||
|
||||
term_dontaudit_use_console(smbd_t)
|
||||
|
||||
@ -327,6 +329,10 @@ optional_policy(`
|
||||
nscd_socket_use(smbd_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
rpc_search_nfs_state_data(smbd_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
seutil_sigchld_newrole(smbd_t)
|
||||
')
|
||||
|
||||
@ -1,10 +1,12 @@
|
||||
|
||||
/usr/bin/sa-learn -- gen_context(system_u:object_r:spamc_exec_t,s0)
|
||||
/usr/bin/spamassassin -- gen_context(system_u:object_r:spamassassin_exec_t,s0)
|
||||
/usr/bin/spamc -- gen_context(system_u:object_r:spamc_exec_t,s0)
|
||||
/usr/bin/spamd -- gen_context(system_u:object_r:spamd_exec_t,s0)
|
||||
|
||||
/usr/sbin/spamd -- gen_context(system_u:object_r:spamd_exec_t,s0)
|
||||
/usr/bin/spamassassin -- gen_context(system_u:object_r:spamassassin_exec_t,s0)
|
||||
|
||||
/var/spool/spamassassin(/.*)? gen_context(system_u:object_r:spamd_spool_t,s0)
|
||||
|
||||
ifdef(`strict_policy',`
|
||||
HOME_DIR/\.spamassassin(/.*)? gen_context(system_u:object_r:ROLE_spamassassin_home_t,s0)
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
|
||||
policy_module(spamassassin,1.3.8)
|
||||
policy_module(spamassassin,1.3.9)
|
||||
|
||||
########################################
|
||||
#
|
||||
@ -14,6 +14,9 @@ type spamd_t;
|
||||
type spamd_exec_t;
|
||||
init_daemon_domain(spamd_t,spamd_exec_t)
|
||||
|
||||
type spamd_spool_t;
|
||||
files_type(spamd_spool_t)
|
||||
|
||||
type spamd_tmp_t;
|
||||
files_tmp_file(spamd_tmp_t)
|
||||
|
||||
@ -49,6 +52,10 @@ allow spamd_t self:unix_stream_socket connectto;
|
||||
allow spamd_t self:tcp_socket create_stream_socket_perms;
|
||||
allow spamd_t self:udp_socket create_socket_perms;
|
||||
|
||||
allow spamd_t spamd_spool_t:file create_file_perms;
|
||||
allow spamd_t spamd_spool_t:dir create_dir_perms;
|
||||
files_spool_filetrans(spamd_t,spamd_spool_t, { file dir })
|
||||
|
||||
allow spamd_t spamd_tmp_t:dir create_dir_perms;
|
||||
allow spamd_t spamd_tmp_t:file create_file_perms;
|
||||
files_tmp_filetrans(spamd_t, spamd_tmp_t, { file dir })
|
||||
@ -100,6 +107,7 @@ domain_use_interactive_fds(spamd_t)
|
||||
files_read_usr_files(spamd_t)
|
||||
files_read_etc_files(spamd_t)
|
||||
files_read_etc_runtime_files(spamd_t)
|
||||
files_search_var_lib(spamd_t)
|
||||
|
||||
init_use_fds(spamd_t)
|
||||
init_use_script_ptys(spamd_t)
|
||||
|
||||
@ -1108,3 +1108,24 @@ interface(`xserver_dontaudit_rw_xdm_xserver_tcp_sockets',`
|
||||
|
||||
dontaudit $1 xdm_xserver_t:tcp_socket { read write };
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Connect to xdm_xserver over a unix domain
|
||||
## stream socket.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`xserver_stream_connect_xdm_xserver',`
|
||||
gen_require(`
|
||||
type xdm_xserver_t, xdm_xserver_tmp_t;
|
||||
')
|
||||
|
||||
files_search_tmp($1)
|
||||
allow $1 xdm_xserver_tmp_t:sock_file write;
|
||||
allow $1 xdm_xserver_t:unix_stream_socket connectto;
|
||||
')
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
|
||||
policy_module(xserver,1.1.7)
|
||||
policy_module(xserver,1.1.8)
|
||||
|
||||
########################################
|
||||
#
|
||||
|
||||
@ -34,8 +34,13 @@ ifdef(`distro_redhat',`
|
||||
#
|
||||
/lib(/.*)? gen_context(system_u:object_r:lib_t,s0)
|
||||
/lib64(/.*)? gen_context(system_u:object_r:lib_t,s0)
|
||||
/lib(64)?/.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:shlib_t,s0)
|
||||
/lib(64)?(/.*)?/ld-[^/]*\.so(\.[^/]*)* -- gen_context(system_u:object_r:ld_so_t,s0)
|
||||
/lib/.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:shlib_t,s0)
|
||||
/lib64/.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:shlib_t,s0)
|
||||
/lib/ld-[^/]*\.so(\.[^/]*)* -- gen_context(system_u:object_r:ld_so_t,s0)
|
||||
/lib64/ld-[^/]*\.so(\.[^/]*)* -- gen_context(system_u:object_r:ld_so_t,s0)
|
||||
|
||||
/lib/security/pam_poldi.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
/lib64/security/pam_poldi.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
|
||||
ifdef(`distro_gentoo',`
|
||||
/lib32(/.*)? gen_context(system_u:object_r:lib_t,s0)
|
||||
@ -55,6 +60,7 @@ ifdef(`distro_gentoo',`
|
||||
/opt/(.*/)?jre.*/libdeploy.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
/opt/(.*/)?jre.*/libjvm.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
/opt/(.*/)?jre.*/libawt.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
/opt/cisco-vpnclient/lib/libvpnapi.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
/opt/netbeans(.*/)?jdk.*/linux/.*.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
|
||||
ifdef(`distro_gentoo',`
|
||||
@ -115,6 +121,7 @@ ifdef(`distro_gentoo',`
|
||||
|
||||
/usr/x11R6/lib/modules/extensions/libglx\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
/usr/lib(64)?/xorg/modules/extensions/libglx\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
/usr/lib(64)?/xorg/modules/drivers/fglx_drv\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
/usr/lib(64)?/xorg/modules/extensions/nvidia(-[^/]*)?/libglx\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
|
||||
ifdef(`distro_redhat',`
|
||||
@ -226,7 +233,14 @@ HOME_DIR/.*/plugins/libflashplayer\.so.* -- gen_context(system_u:object_r:textre
|
||||
/usr/(local/)?Adobe/(.*/)?lib/[^/]*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
/usr/(local/)?acroread/(.*/)?lib/[^/]*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
/usr/(local/)?Adobe/.*\.api -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
/usr/local/matlab.*/bin/glnx86/libmwlapack.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
/usr/(.*/)?intellinux/SPPlugins/ADMPlugin\.apl -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
|
||||
/usr/lib/acroread/(.*/)?sidecars/* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
/usr/lib/acroread/(.*/)?nppdf\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
/usr/lib/acroread/(.*/)?lib/[^/]*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
/usr/lib/acroread/.*\.api -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
/usr/lib/acroread/(.*/)?ADMPlugin\.apl -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
') dnl end distro_redhat
|
||||
|
||||
#
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
|
||||
policy_module(libraries,1.3.7)
|
||||
policy_module(libraries,1.3.8)
|
||||
|
||||
########################################
|
||||
#
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
|
||||
policy_module(logging,1.3.5)
|
||||
policy_module(logging,1.3.6)
|
||||
|
||||
########################################
|
||||
#
|
||||
@ -123,8 +123,9 @@ allow auditd_t auditd_var_run_t:dir rw_dir_perms;
|
||||
files_pid_filetrans(auditd_t,auditd_var_run_t,file)
|
||||
|
||||
kernel_read_kernel_sysctls(auditd_t)
|
||||
kernel_list_proc(auditd_t)
|
||||
kernel_read_proc_symlinks(auditd_t)
|
||||
# Needs to be able to run dispatcher. see /etc/audit/auditd.conf
|
||||
# Probably want a transition, and a new auditd_helper app
|
||||
kernel_read_system_state(auditd_t)
|
||||
|
||||
dev_read_sysfs(auditd_t)
|
||||
|
||||
@ -133,8 +134,11 @@ fs_search_auto_mountpoints(auditd_t)
|
||||
|
||||
term_dontaudit_use_console(auditd_t)
|
||||
|
||||
# cjp: why?
|
||||
# Needs to be able to run dispatcher. see /etc/audit/auditd.conf
|
||||
# Probably want a transition, and a new auditd_helper app
|
||||
corecmd_exec_sbin(auditd_t)
|
||||
corecmd_exec_bin(auditd_t)
|
||||
|
||||
|
||||
domain_use_interactive_fds(auditd_t)
|
||||
|
||||
|
||||
@ -3,3 +3,8 @@
|
||||
# /usr/local/bin/appsrv -- gen_context(system_u:object_r:unconfined_exec_t,s0)
|
||||
# For the time being until someone writes a sane policy, we need initrc to transition to unconfined_t
|
||||
/usr/bin/vncserver -- gen_context(system_u:object_r:unconfined_exec_t,s0)
|
||||
|
||||
ifdef(`targeted_policy',`
|
||||
/usr/lib/openoffice.org.*/program/.*\.bin -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0)
|
||||
/usr/bin/valgrind -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0)
|
||||
')
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
|
||||
policy_module(unconfined,1.3.8)
|
||||
policy_module(unconfined,1.3.9)
|
||||
|
||||
########################################
|
||||
#
|
||||
@ -13,7 +13,12 @@ gen_require(`
|
||||
')
|
||||
type unconfined_exec_t;
|
||||
init_system_domain(unconfined_t,unconfined_exec_t)
|
||||
role system_r types unconfined_t;
|
||||
|
||||
ifdef(`targeted_policy',`
|
||||
type unconfined_execmem_t;
|
||||
type unconfined_execmem_exec_t;
|
||||
init_system_domain(unconfined_execmem_t,unconfined_execmem_exec_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
#
|
||||
@ -28,6 +33,8 @@ ifdef(`targeted_policy',`
|
||||
allow unconfined_t self:system syslog_read;
|
||||
dontaudit unconfined_t self:capability sys_module;
|
||||
|
||||
domain_auto_trans(unconfined_t,unconfined_execmem_exec_t,unconfined_execmem_t)
|
||||
|
||||
files_create_boot_flag(unconfined_t)
|
||||
|
||||
init_domtrans_script(unconfined_t)
|
||||
@ -174,3 +181,13 @@ ifdef(`targeted_policy',`
|
||||
xserver_domtrans_xdm_xserver(unconfined_t)
|
||||
')
|
||||
')
|
||||
|
||||
########################################
|
||||
#
|
||||
# Unconfined Execmem Local policy
|
||||
#
|
||||
|
||||
ifdef(`targeted_policy',`
|
||||
allow unconfined_execmem_t self:process { execstack execmem };
|
||||
unconfined_domain_noaudit(unconfined_execmem_t)
|
||||
')
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
|
||||
policy_module(userdomain,1.3.26)
|
||||
policy_module(userdomain,1.3.27)
|
||||
|
||||
gen_require(`
|
||||
role sysadm_r, staff_r, user_r;
|
||||
@ -227,6 +227,10 @@ ifdef(`targeted_policy',`
|
||||
bluetooth_run_helper(sysadm_t,sysadm_r,admin_terminal)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
consoletype_run(sysadm_t,sysadm_r,admin_terminal)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
clock_run(sysadm_t,sysadm_r,admin_terminal)
|
||||
')
|
||||
|
||||
@ -16,3 +16,5 @@
|
||||
/var/run/xend\.pid -- gen_context(system_u:object_r:xend_var_run_t,s0)
|
||||
/var/run/xenstore\.pid -- gen_context(system_u:object_r:xenstored_var_run_t,s0)
|
||||
/var/run/xenstored(/.*)? gen_context(system_u:object_r:xenstored_var_run_t,s0)
|
||||
|
||||
/xen(/.*)? gen_context(system_u:object_r:xen_image_t,s0)
|
||||
|
||||
@ -124,6 +124,6 @@ interface(`xen_domtrans_xm',`
|
||||
|
||||
domain_auto_trans($1,xm_exec_t,xm_t)
|
||||
allow xm_t $1:fd use;
|
||||
allow xm_t:$1:fifo_file rw_file_perms;
|
||||
allow xm_t $1:fifo_file rw_file_perms;
|
||||
allow xm_t $1:process sigchld;
|
||||
')
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
|
||||
policy_module(xen,1.0.5)
|
||||
policy_module(xen,1.0.6)
|
||||
|
||||
########################################
|
||||
#
|
||||
@ -11,6 +11,10 @@ type xen_devpts_t;
|
||||
term_pty(xen_devpts_t);
|
||||
files_type(xen_devpts_t);
|
||||
|
||||
# Xen Image files
|
||||
type xen_image_t; # customizable
|
||||
files_type(xen_image_t)
|
||||
|
||||
type xend_t;
|
||||
type xend_exec_t;
|
||||
domain_type(xend_t)
|
||||
@ -74,6 +78,9 @@ allow xend_t self:netlink_route_socket r_netlink_socket_perms;
|
||||
allow xend_t self:tcp_socket create_stream_socket_perms;
|
||||
allow xend_t self:packet_socket create_socket_perms;
|
||||
|
||||
allow xend_t xen_image_t:dir r_dir_perms;
|
||||
allow xend_t xen_image_t:file r_file_perms;
|
||||
|
||||
# pid file
|
||||
allow xend_t xend_var_run_t:file manage_file_perms;
|
||||
allow xend_t xend_var_run_t:sock_file manage_file_perms;
|
||||
@ -89,8 +96,9 @@ logging_log_filetrans(xend_t,xend_var_log_t,{ sock_file file dir })
|
||||
# var/lib files for xend
|
||||
allow xend_t xend_var_lib_t:file create_file_perms;
|
||||
allow xend_t xend_var_lib_t:sock_file create_file_perms;
|
||||
allow xend_t xend_var_lib_t:fifo_file create_file_perms;
|
||||
allow xend_t xend_var_lib_t:dir create_dir_perms;
|
||||
files_var_lib_filetrans(xend_t,xend_var_lib_t,{ file dir sock_file })
|
||||
files_var_lib_filetrans(xend_t,xend_var_lib_t,{ file dir })
|
||||
|
||||
# transition to store
|
||||
domain_auto_trans(xend_t, xenstored_exec_t, xenstored_t)
|
||||
@ -117,6 +125,7 @@ corenet_non_ipsec_sendrecv(xend_t)
|
||||
corenet_tcp_sendrecv_all_if(xend_t)
|
||||
corenet_tcp_sendrecv_all_nodes(xend_t)
|
||||
corenet_tcp_sendrecv_all_ports(xend_t)
|
||||
corenet_tcp_bind_all_nodes(xend_t)
|
||||
corenet_tcp_bind_xen_port(xend_t)
|
||||
corenet_tcp_bind_soundd_port(xend_t)
|
||||
corenet_sendrecv_xen_server_packets(xend_t)
|
||||
@ -133,6 +142,8 @@ domain_dontaudit_read_all_domains_state(xend_t)
|
||||
files_read_etc_files(xend_t)
|
||||
files_read_kernel_symbol_table(xend_t)
|
||||
files_read_kernel_img(xend_t)
|
||||
files_manage_etc_runtime_files(xend_t)
|
||||
files_etc_filetrans_etc_runtime(xend_t,file)
|
||||
|
||||
storage_raw_read_fixed_disk(xend_t)
|
||||
|
||||
@ -244,11 +255,16 @@ xen_append_log(xenstored_t)
|
||||
# xm local policy
|
||||
#
|
||||
|
||||
allow xm_t self:capability dac_override;
|
||||
allow xm_t self:capability { dac_override ipc_lock };
|
||||
# internal communication is often done using fifo and unix sockets.
|
||||
allow xm_t self:fifo_file { read write };
|
||||
allow xm_t self:unix_stream_socket create_stream_socket_perms;
|
||||
|
||||
allow xm_t xend_var_lib_t:dir rw_dir_perms;
|
||||
allow xm_t xend_var_lib_t:fifo_file create_file_perms;
|
||||
allow xm_t xend_var_lib_t:file create_file_perms;
|
||||
files_search_var_lib(xm_t)
|
||||
|
||||
kernel_read_system_state(xm_t)
|
||||
kernel_read_kernel_sysctls(xm_t)
|
||||
kernel_read_xen_state(xm_t)
|
||||
@ -259,11 +275,16 @@ corecmd_exec_sbin(xm_t)
|
||||
|
||||
dev_read_urand(xm_t)
|
||||
|
||||
files_read_etc_runtime_files(xm_t)
|
||||
files_read_usr_files(xm_t)
|
||||
files_list_mnt(xm_t)
|
||||
# Some common macros (you might be able to remove some)
|
||||
files_read_etc_files(xm_t)
|
||||
|
||||
term_use_all_terms(xm_t)
|
||||
|
||||
init_rw_script_stream_sockets(xm_t)
|
||||
|
||||
libs_use_ld_so(xm_t)
|
||||
libs_use_shared_libs(xm_t)
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user