From 584dfaca458f9fbbd1f2a6d9f54b4789a84aea58 Mon Sep 17 00:00:00 2001 From: Jeremy Solt Date: Fri, 19 Mar 2010 15:46:59 -0400 Subject: [PATCH] icecast policy from Dan Walsh Fixed some style and spacing issues Replace manage_var_run interface with manage_pid_files with fewer permissions Replaced rkit_daemon_system_domain with rtkit_schedule --- policy/modules/services/icecast.fc | 8 ++ policy/modules/services/icecast.if | 192 +++++++++++++++++++++++++++++ policy/modules/services/icecast.te | 57 +++++++++ 3 files changed, 257 insertions(+) create mode 100644 policy/modules/services/icecast.fc create mode 100644 policy/modules/services/icecast.if create mode 100644 policy/modules/services/icecast.te diff --git a/policy/modules/services/icecast.fc b/policy/modules/services/icecast.fc new file mode 100644 index 00000000..3f1a6c2c --- /dev/null +++ b/policy/modules/services/icecast.fc @@ -0,0 +1,8 @@ + +/etc/rc\.d/init\.d/icecast -- gen_context(system_u:object_r:icecast_initrc_exec_t,s0) + +/usr/bin/icecast -- gen_context(system_u:object_r:icecast_exec_t,s0) + +/var/log/icecast(/.*)? gen_context(system_u:object_r:icecast_log_t,s0) + +/var/run/icecast(/.*)? gen_context(system_u:object_r:icecast_var_run_t,s0) diff --git a/policy/modules/services/icecast.if b/policy/modules/services/icecast.if new file mode 100644 index 00000000..8e6759df --- /dev/null +++ b/policy/modules/services/icecast.if @@ -0,0 +1,192 @@ + +## ShoutCast compatible streaming media server + +######################################## +## +## Execute a domain transition to run icecast. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`icecast_domtrans',` + gen_require(` + type icecast_t, icecast_exec_t; + ') + + domtrans_pattern($1, icecast_exec_t, icecast_t) +') + +######################################## +## +## Execute icecast server in the icecast domain. +## +## +## +## Domain allowed access. +## +## +# +interface(`icecast_initrc_domtrans',` + gen_require(` + type icecast_initrc_exec_t; + ') + + init_labeled_script_domtrans($1, icecast_initrc_exec_t) +') + +######################################## +## +## Read icecast PID files. +## +## +## +## Domain allowed access. +## +## +# +interface(`icecast_read_pid_files',` + gen_require(` + type icecast_var_run_t; + ') + + files_search_pids($1) + allow $1 icecast_var_run_t:file read_file_perms; +') + +######################################## +## +## Manage icecast pid files. +## +## +## +## Domain allowed access. +## +## +# +interface(`icecast_manage_pid_files',` + gen_require(` + type icecast_var_run_t; + ') + + files_search_pids($1) + manage_files_pattern($1, icecast_var_run_t, icecast_var_run_t) +') + +######################################## +## +## Allow the specified domain to read icecast's log files. +## +## +## +## Domain allowed access. +## +## +## +# +interface(`icecast_read_log',` + gen_require(` + type icecast_log_t; + ') + + logging_search_logs($1) + read_files_pattern($1, icecast_log_t, icecast_log_t) +') + +######################################## +## +## Allow the specified domain to append +## icecast log files. +## +## +## +## Domain allowed access. +## +## +# +interface(`icecast_append_log',` + gen_require(` + type icecast_log_t; + ') + + logging_search_logs($1) + append_files_pattern($1, icecast_log_t, icecast_log_t) +') + +######################################## +## +## Allow domain to manage icecast log files +## +## +## +## Domain allow access. +## +## +# +interface(`icecast_manage_log',` + gen_require(` + type icecast_log_t; + ') + + logging_search_logs($1) + manage_dirs_pattern($1, icecast_log_t, icecast_log_t) + manage_files_pattern($1, icecast_log_t, icecast_log_t) + manage_lnk_files_pattern($1, icecast_log_t, icecast_log_t) +') + +######################################## +## +## Allow domain signal icecast +## +## +## +## Domain allowed access. +## +## +# +interface(`icecast_signal',` + gen_require(` + type icecast_t; + ') + + allow $1 icecast_t:process signal; +') + +######################################## +## +## All of the rules required to administrate +## an icecast environment +## +## +## +## Domain allowed access. +## +## +## +## +## Role allowed access. +## +## +## +# +interface(`icecast_admin',` + gen_require(` + type icecast_t, icecast_initrc_exec_t; + ') + + allow $1 icecast_t:process { ptrace signal_perms getattr }; + read_files_pattern($1, icecast_t, icecast_t) + + # Allow icecast_t to restart the apache service + icecast_initrc_domtrans($1) + domain_system_change_exemption($1) + role_transition $2 icecast_initrc_exec_t system_r; + allow $2 system_r; + + icecast_manage_pid_files($1) + + icecast_manage_log($1) + +') diff --git a/policy/modules/services/icecast.te b/policy/modules/services/icecast.te new file mode 100644 index 00000000..87159be8 --- /dev/null +++ b/policy/modules/services/icecast.te @@ -0,0 +1,57 @@ +policy_module(icecast,1.0.0) + +######################################## +# +# Declarations +# + +type icecast_t; +type icecast_exec_t; +init_daemon_domain(icecast_t, icecast_exec_t) + +type icecast_initrc_exec_t; +init_script_file(icecast_initrc_exec_t) + +type icecast_var_run_t; +files_pid_file(icecast_var_run_t) + +type icecast_log_t; +logging_log_file(icecast_log_t) + +######################################## +# +# icecast local policy +# + +allow icecast_t self:capability { dac_override setgid setuid sys_nice }; +allow icecast_t self:process { getsched fork setsched signal }; + +# internal communication is often done using fifo and unix sockets. +allow icecast_t self:fifo_file rw_fifo_file_perms; +allow icecast_t self:unix_stream_socket create_stream_socket_perms; +allow icecast_t self:tcp_socket create_stream_socket_perms; + +manage_dirs_pattern(icecast_t, icecast_log_t, icecast_log_t) +manage_files_pattern(icecast_t, icecast_log_t, icecast_log_t) +logging_log_filetrans(icecast_t, icecast_log_t, { file dir } ) + +manage_dirs_pattern(icecast_t, icecast_var_run_t, icecast_var_run_t) +manage_files_pattern(icecast_t, icecast_var_run_t, icecast_var_run_t) +files_pid_filetrans(icecast_t, icecast_var_run_t, { file dir }) + +corenet_tcp_bind_soundd_port(icecast_t) + +# Init script handling +domain_use_interactive_fds(icecast_t) + +files_read_etc_files(icecast_t) + +auth_use_nsswitch(icecast_t) + +miscfiles_read_localization(icecast_t) + +sysnet_dns_name_resolve(icecast_t) + +optional_policy(` + rtkit_schedule(icecast_t) +')