more merging from nsa cvs
This commit is contained in:
parent
5a2649cefd
commit
605ba28540
@ -9,9 +9,12 @@ policy_module(consoletype, 1.0)
|
|||||||
type consoletype_t; #, mlsfileread, mlsfilewrite
|
type consoletype_t; #, mlsfileread, mlsfilewrite
|
||||||
type consoletype_exec_t;
|
type consoletype_exec_t;
|
||||||
init_domain(consoletype_t,consoletype_exec_t)
|
init_domain(consoletype_t,consoletype_exec_t)
|
||||||
init_system_domain(consoletype_t,consoletype_exec_t)
|
|
||||||
role system_r types consoletype_t;
|
role system_r types consoletype_t;
|
||||||
|
|
||||||
|
ifdef(`targeted_policy',`',`
|
||||||
|
init_system_domain(consoletype_t,consoletype_exec_t)
|
||||||
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
# Local declarations
|
# Local declarations
|
||||||
@ -54,7 +57,7 @@ userdom_use_sysadm_terms(consoletype_t)
|
|||||||
userdom_use_sysadm_fd(consoletype_t)
|
userdom_use_sysadm_fd(consoletype_t)
|
||||||
userdom_rw_sysadm_pipe(consoletype_t)
|
userdom_rw_sysadm_pipe(consoletype_t)
|
||||||
|
|
||||||
ifdef(`distro_redhat', `
|
ifdef(`distro_redhat',`
|
||||||
fs_use_tmpfs_chr_dev(consoletype_t)
|
fs_use_tmpfs_chr_dev(consoletype_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
@ -99,8 +102,10 @@ allow consoletype_t xdm_tmp_t:file rw_file_perms;
|
|||||||
')
|
')
|
||||||
|
|
||||||
# this goes to xdm module
|
# this goes to xdm module
|
||||||
optional_policy(`consoletype.te',`
|
ifdef(`targeted_policy',`
|
||||||
consoletype_domtrans(xdm_t)
|
optional_policy(`consoletype.te',`
|
||||||
|
consoletype_domtrans(xdm_t)
|
||||||
|
')
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`lpd.te', `
|
optional_policy(`lpd.te', `
|
||||||
|
@ -10,6 +10,7 @@ type firstboot_t;
|
|||||||
type firstboot_exec_t;
|
type firstboot_exec_t;
|
||||||
init_system_domain(firstboot_t,firstboot_exec_t)
|
init_system_domain(firstboot_t,firstboot_exec_t)
|
||||||
domain_obj_id_change_exempt(firstboot_t)
|
domain_obj_id_change_exempt(firstboot_t)
|
||||||
|
domain_subj_id_change_exempt(firstboot_t)
|
||||||
role system_r types firstboot_t;
|
role system_r types firstboot_t;
|
||||||
|
|
||||||
type firstboot_etc_t; #, usercanread;
|
type firstboot_etc_t; #, usercanread;
|
||||||
@ -103,8 +104,10 @@ userdom_manage_user_home_files(firstboot_t)
|
|||||||
userdom_manage_user_home_symlinks(firstboot_t)
|
userdom_manage_user_home_symlinks(firstboot_t)
|
||||||
userdom_manage_user_home_pipes(firstboot_t)
|
userdom_manage_user_home_pipes(firstboot_t)
|
||||||
userdom_manage_user_home_sockets(firstboot_t)
|
userdom_manage_user_home_sockets(firstboot_t)
|
||||||
usermanage_domtrans_useradd(firstboot_t)
|
|
||||||
usermanage_domtrans_groupadd(firstboot_t)
|
ifdef(`targeted_policy',`
|
||||||
|
unconfined_domtrans(firstboot_t)
|
||||||
|
')
|
||||||
|
|
||||||
optional_policy(`kerberos.te',`
|
optional_policy(`kerberos.te',`
|
||||||
kerberos_rw_config(firstboot_t)
|
kerberos_rw_config(firstboot_t)
|
||||||
@ -114,6 +117,11 @@ optional_policy(`nis.te',`
|
|||||||
nis_use_ypbind(firstboot_t)
|
nis_use_ypbind(firstboot_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
|
optional_policy(`usermanage.te',`
|
||||||
|
usermanage_domtrans_useradd(firstboot_t)
|
||||||
|
usermanage_domtrans_groupadd(firstboot_t)
|
||||||
|
')
|
||||||
|
|
||||||
ifdef(`TODO',`
|
ifdef(`TODO',`
|
||||||
allow firstboot_t proc_t:file write;
|
allow firstboot_t proc_t:file write;
|
||||||
|
|
||||||
|
@ -116,4 +116,12 @@ ifdef(`TODO',`
|
|||||||
optional_policy(`rhgb.te',`
|
optional_policy(`rhgb.te',`
|
||||||
rhgb_domain(updfstab_t)
|
rhgb_domain(updfstab_t)
|
||||||
')
|
')
|
||||||
|
ifdef(`dbusd.te',`
|
||||||
|
allow initrc_t updfstab_t:dbus send_msg;
|
||||||
|
allow updfstab_t initrc_t:dbus send_msg;
|
||||||
|
')
|
||||||
|
allow updfstab_t tmpfs_t:dir getattr;
|
||||||
|
ifdef(`hald.te', `
|
||||||
|
can_unix_connect(updfstab_t, hald_t)
|
||||||
|
')
|
||||||
')
|
')
|
||||||
|
@ -520,6 +520,7 @@ logging_send_syslog_msg(useradd_t)
|
|||||||
miscfiles_read_localization(useradd_t)
|
miscfiles_read_localization(useradd_t)
|
||||||
|
|
||||||
seutil_read_config(useradd_t)
|
seutil_read_config(useradd_t)
|
||||||
|
seutil_read_file_contexts(useradd_t)
|
||||||
|
|
||||||
userdom_use_unpriv_users_fd(useradd_t)
|
userdom_use_unpriv_users_fd(useradd_t)
|
||||||
|
|
||||||
|
@ -395,12 +395,12 @@ interface(`dev_del_generic_symlinks',`
|
|||||||
interface(`dev_manage_generic_symlinks',`
|
interface(`dev_manage_generic_symlinks',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
type device_t;
|
type device_t;
|
||||||
class dir { create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir relabelfrom relabelto };
|
class dir rw_dir_perms;
|
||||||
class lnk_file { create read getattr setattr link unlink rename };
|
class lnk_file create_lnk_perms;
|
||||||
')
|
')
|
||||||
|
|
||||||
allow $1 device_t:dir { create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir relabelfrom relabelto };
|
allow $1 device_t:dir rw_dir_perms;
|
||||||
allow $1 device_t:lnk_file { create read getattr setattr link unlink rename };
|
allow $1 device_t:lnk_file create_lnk_perms;
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
|
@ -1492,7 +1492,7 @@ interface(`kernel_use_shared_libs_from',`
|
|||||||
gen_require(`
|
gen_require(`
|
||||||
type kernel_t;
|
type kernel_t;
|
||||||
class lnk_file r_file_perms;
|
class lnk_file r_file_perms;
|
||||||
class file rx_dir_perms;
|
class file rx_file_perms;
|
||||||
')
|
')
|
||||||
|
|
||||||
allow kernel_t $1:dir r_dir_perms;
|
allow kernel_t $1:dir r_dir_perms;
|
||||||
|
@ -25,7 +25,7 @@ attribute sysctl_type;
|
|||||||
# kernel_t is the domain of kernel threads.
|
# kernel_t is the domain of kernel threads.
|
||||||
# It is also the target type when checking permissions in the system class.
|
# It is also the target type when checking permissions in the system class.
|
||||||
#
|
#
|
||||||
type kernel_t, can_load_kernmodule;
|
type kernel_t, can_load_kernmodule; # mlsprocread, mlsprocwrite, privrangetrans
|
||||||
role system_r types kernel_t;
|
role system_r types kernel_t;
|
||||||
domain_base_type(kernel_t)
|
domain_base_type(kernel_t)
|
||||||
sid kernel context_template(system_u:system_r:kernel_t,s0 - s9:c0.c127)
|
sid kernel context_template(system_u:system_r:kernel_t,s0 - s9:c0.c127)
|
||||||
@ -169,6 +169,9 @@ allow kernel_t sysctl_t:dir r_dir_perms;
|
|||||||
allow kernel_t sysctl_kernel_t:dir r_dir_perms;
|
allow kernel_t sysctl_kernel_t:dir r_dir_perms;
|
||||||
allow kernel_t sysctl_kernel_t:file r_file_perms;
|
allow kernel_t sysctl_kernel_t:file r_file_perms;
|
||||||
|
|
||||||
|
# cjp: this seems questionable
|
||||||
|
allow kernel_t unlabeled_t:fifo_file rw_file_perms;
|
||||||
|
|
||||||
# Kernel-generated traffic e.g., ICMP replies:
|
# Kernel-generated traffic e.g., ICMP replies:
|
||||||
corenet_raw_sendrecv_all_if(kernel_t)
|
corenet_raw_sendrecv_all_if(kernel_t)
|
||||||
corenet_raw_sendrecv_all_nodes(kernel_t)
|
corenet_raw_sendrecv_all_nodes(kernel_t)
|
||||||
@ -176,20 +179,24 @@ corenet_raw_sendrecv_all_nodes(kernel_t)
|
|||||||
corenet_tcp_sendrecv_all_if(kernel_t)
|
corenet_tcp_sendrecv_all_if(kernel_t)
|
||||||
corenet_tcp_sendrecv_all_nodes(kernel_t)
|
corenet_tcp_sendrecv_all_nodes(kernel_t)
|
||||||
|
|
||||||
selinux_load_policy(kernel_t)
|
dev_read_sysfs(kernel_t)
|
||||||
|
dev_search_usbfs(kernel_t)
|
||||||
term_use_console(kernel_t)
|
|
||||||
|
|
||||||
# Mount root file system. Used when loading a policy
|
# Mount root file system. Used when loading a policy
|
||||||
# from initrd, then mounting the root filesystem
|
# from initrd, then mounting the root filesystem
|
||||||
fs_mount_all_fs(kernel_t)
|
fs_mount_all_fs(kernel_t)
|
||||||
|
|
||||||
|
selinux_load_policy(kernel_t)
|
||||||
|
|
||||||
|
term_use_console(kernel_t)
|
||||||
|
|
||||||
corecmd_exec_shell(kernel_t)
|
corecmd_exec_shell(kernel_t)
|
||||||
corecmd_list_sbin(kernel_t)
|
corecmd_list_sbin(kernel_t)
|
||||||
# /proc/sys/kernel/modprobe is set to /bin/true if not using modules.
|
# /proc/sys/kernel/modprobe is set to /bin/true if not using modules.
|
||||||
corecmd_exec_bin(kernel_t)
|
corecmd_exec_bin(kernel_t)
|
||||||
|
|
||||||
domain_signal_all_domains(kernel_t)
|
domain_signal_all_domains(kernel_t)
|
||||||
|
domain_search_all_domains_state(kernel_t)
|
||||||
|
|
||||||
files_list_root(kernel_t)
|
files_list_root(kernel_t)
|
||||||
files_list_etc(kernel_t)
|
files_list_etc(kernel_t)
|
||||||
|
@ -10,8 +10,6 @@
|
|||||||
/usr/sbin/cron(d)? -- context_template(system_u:object_r:crond_exec_t,s0)
|
/usr/sbin/cron(d)? -- context_template(system_u:object_r:crond_exec_t,s0)
|
||||||
/usr/sbin/fcron -- context_template(system_u:object_r:crond_exec_t,s0)
|
/usr/sbin/fcron -- context_template(system_u:object_r:crond_exec_t,s0)
|
||||||
|
|
||||||
/var/log/cron.* -- context_template(system_u:object_r:crond_log_t,s0)
|
|
||||||
|
|
||||||
/var/run/atd\.pid -- context_template(system_u:object_r:crond_var_run_t,s0)
|
/var/run/atd\.pid -- context_template(system_u:object_r:crond_var_run_t,s0)
|
||||||
/var/run/crond?\.pid -- context_template(system_u:object_r:crond_var_run_t,s0)
|
/var/run/crond?\.pid -- context_template(system_u:object_r:crond_var_run_t,s0)
|
||||||
/var/run/crond\.reboot -- context_template(system_u:object_r:crond_var_run_t,s0)
|
/var/run/crond\.reboot -- context_template(system_u:object_r:crond_var_run_t,s0)
|
||||||
|
@ -188,8 +188,6 @@ template(`cron_per_userdomain_template',`
|
|||||||
# crontab signals crond by updating the mtime on the spooldir
|
# crontab signals crond by updating the mtime on the spooldir
|
||||||
allow $1_crontab_t cron_spool_t:dir setattr;
|
allow $1_crontab_t cron_spool_t:dir setattr;
|
||||||
|
|
||||||
allow $1_crontab_t crond_log_t:file ra_file_perms;
|
|
||||||
|
|
||||||
# for the checks used by crontab -u
|
# for the checks used by crontab -u
|
||||||
selinux_dontaudit_search_fs($1_crontab_t)
|
selinux_dontaudit_search_fs($1_crontab_t)
|
||||||
|
|
||||||
@ -384,24 +382,6 @@ interface(`cron_rw_pipe',`
|
|||||||
allow $1 crond_t:file { read write };
|
allow $1 crond_t:file { read write };
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
|
||||||
## <summary>
|
|
||||||
## Read and write the cron daemon log files.
|
|
||||||
## </summary>
|
|
||||||
## <param name="domain">
|
|
||||||
## The type of the process to performing this action.
|
|
||||||
## </param>
|
|
||||||
#
|
|
||||||
interface(`cron_rw_log',`
|
|
||||||
gen_require(`
|
|
||||||
type crond_log_t;
|
|
||||||
class file rw_file_perms;
|
|
||||||
')
|
|
||||||
|
|
||||||
logging_search_logs($1)
|
|
||||||
allow $1 crond_log_t:file rw_file_perms;
|
|
||||||
')
|
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
## Search the directory containing user cron tables.
|
## Search the directory containing user cron tables.
|
||||||
|
@ -19,9 +19,6 @@ init_daemon_domain(crond_t,crond_exec_t)
|
|||||||
domain_wide_inherit_fd(crond_t)
|
domain_wide_inherit_fd(crond_t)
|
||||||
domain_cron_exemption_source(crond_t)
|
domain_cron_exemption_source(crond_t)
|
||||||
|
|
||||||
type crond_log_t;
|
|
||||||
logging_log_file(crond_log_t)
|
|
||||||
|
|
||||||
type crond_tmp_t;
|
type crond_tmp_t;
|
||||||
files_tmp_file(crond_tmp_t)
|
files_tmp_file(crond_tmp_t)
|
||||||
|
|
||||||
@ -65,8 +62,6 @@ allow crond_t self:sem create_sem_perms;
|
|||||||
allow crond_t self:msgq create_msgq_perms;
|
allow crond_t self:msgq create_msgq_perms;
|
||||||
allow crond_t self:msg { send receive };
|
allow crond_t self:msg { send receive };
|
||||||
|
|
||||||
allow crond_t crond_log_t:file create_file_perms;
|
|
||||||
|
|
||||||
allow crond_t crond_var_run_t:file create_file_perms;
|
allow crond_t crond_var_run_t:file create_file_perms;
|
||||||
files_create_pid(crond_t,crond_var_run_t)
|
files_create_pid(crond_t,crond_var_run_t)
|
||||||
|
|
||||||
@ -228,10 +223,6 @@ type_transition system_crond_t crond_tmp_t:file system_crond_tmp_t;
|
|||||||
allow system_crond_t cron_spool_t:dir r_dir_perms;
|
allow system_crond_t cron_spool_t:dir r_dir_perms;
|
||||||
allow system_crond_t cron_spool_t:file r_file_perms;
|
allow system_crond_t cron_spool_t:file r_file_perms;
|
||||||
|
|
||||||
# Access crond log files
|
|
||||||
allow system_crond_t crond_log_t:file create_file_perms;
|
|
||||||
logging_create_log(system_crond_t,crond_log_t)
|
|
||||||
|
|
||||||
kernel_read_kernel_sysctl(system_crond_t)
|
kernel_read_kernel_sysctl(system_crond_t)
|
||||||
kernel_read_system_state(system_crond_t)
|
kernel_read_system_state(system_crond_t)
|
||||||
kernel_read_software_raid_state(system_crond_t)
|
kernel_read_software_raid_state(system_crond_t)
|
||||||
@ -372,7 +363,7 @@ allow system_crond_su_t crond_t:fifo_file ioctl;
|
|||||||
# Required for webalizer
|
# Required for webalizer
|
||||||
#
|
#
|
||||||
ifdef(`apache.te', `
|
ifdef(`apache.te', `
|
||||||
allow system_crond_t httpd_log_t:file r_file_perms;
|
allow system_crond_t { httpd_log_t httpd_config_t }:file r_file_perms;
|
||||||
')
|
')
|
||||||
|
|
||||||
ifdef(`mta.te', `
|
ifdef(`mta.te', `
|
||||||
|
@ -342,9 +342,8 @@ optional_policy(`nscd.te',`
|
|||||||
nscd_use_socket(utempter_t)
|
nscd_use_socket(utempter_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`xdm.te', `
|
ifdef(`TODO',`
|
||||||
#allow utempter_t xdm_t:fd use;
|
optional_policy(`xdm.te',`
|
||||||
xdm_use_fd(utempter_t)
|
can_pipe_xdm(utempter_t)
|
||||||
#allow utempter_t xdm_t:fifo_file { write getattr };
|
')
|
||||||
xdm_write_pipe(utempter_t)
|
|
||||||
')
|
')
|
||||||
|
@ -423,13 +423,30 @@ interface(`domain_kill_all_domains',`
|
|||||||
allow $1 domain:process sigkill;
|
allow $1 domain:process sigkill;
|
||||||
allow $1 self:capability kill;
|
allow $1 self:capability kill;
|
||||||
')
|
')
|
||||||
|
########################################
|
||||||
|
## <summary>
|
||||||
|
## Search the process state directory (/proc/pid) of all domains.
|
||||||
|
## </summary>
|
||||||
|
## <param name="domain">
|
||||||
|
## Domain allowed access.
|
||||||
|
## </param>
|
||||||
|
#
|
||||||
|
interface(`domain_search_all_domains_state',`
|
||||||
|
gen_require(`
|
||||||
|
attribute domain;
|
||||||
|
class dir search;
|
||||||
|
')
|
||||||
|
|
||||||
|
kernel_search_proc($1)
|
||||||
|
allow $1 domain:dir search;
|
||||||
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
## Read the process state (/proc/pid) of all domains.
|
## Read the process state (/proc/pid) of all domains.
|
||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
## The type of the process performing this action.
|
## Domain allowed access.
|
||||||
## </param>
|
## </param>
|
||||||
#
|
#
|
||||||
interface(`domain_read_all_domains_state',`
|
interface(`domain_read_all_domains_state',`
|
||||||
@ -441,6 +458,7 @@ interface(`domain_read_all_domains_state',`
|
|||||||
class process { getattr ptrace };
|
class process { getattr ptrace };
|
||||||
')
|
')
|
||||||
|
|
||||||
|
kernel_search_proc($1)
|
||||||
allow $1 domain:dir r_dir_perms;
|
allow $1 domain:dir r_dir_perms;
|
||||||
allow $1 domain:lnk_file r_file_perms;
|
allow $1 domain:lnk_file r_file_perms;
|
||||||
allow $1 domain:file r_file_perms;
|
allow $1 domain:file r_file_perms;
|
||||||
@ -453,6 +471,38 @@ interface(`domain_read_all_domains_state',`
|
|||||||
dontaudit $1 domain:process ptrace;
|
dontaudit $1 domain:process ptrace;
|
||||||
')
|
')
|
||||||
|
|
||||||
|
########################################
|
||||||
|
## <summary>
|
||||||
|
## Read the process state (/proc/pid) of all domains.
|
||||||
|
## </summary>
|
||||||
|
## <param name="domain">
|
||||||
|
## Domain allowed access.
|
||||||
|
## </param>
|
||||||
|
#
|
||||||
|
interface(`domain_read_confined_domains_state',`
|
||||||
|
gen_require(`
|
||||||
|
attribute domain, unconfined_domain;
|
||||||
|
class dir r_dir_perms;
|
||||||
|
class lnk_file r_file_perms;
|
||||||
|
class file r_file_perms;
|
||||||
|
class process { getattr ptrace };
|
||||||
|
')
|
||||||
|
|
||||||
|
kernel_search_proc($1)
|
||||||
|
allow $1 { domain -unconfined_domain }:dir r_dir_perms;
|
||||||
|
allow $1 { domain -unconfined_domain }:lnk_file r_file_perms;
|
||||||
|
allow $1 { domain -unconfined_domain }:file r_file_perms;
|
||||||
|
allow $1 { domain -unconfined_domain }:process getattr;
|
||||||
|
|
||||||
|
dontaudit $1 unconfined_domain:dir search;
|
||||||
|
|
||||||
|
# We need to suppress this denial because procps tries to access
|
||||||
|
# /proc/pid/environ and this now triggers a ptrace check in recent kernels
|
||||||
|
# (2.4 and 2.6). Might want to change procps to not do this, or only if
|
||||||
|
# running in a privileged domain.
|
||||||
|
dontaudit $1 { domain -unconfined_domain }:process ptrace;
|
||||||
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
## Do not audit attempts to read the process
|
## Do not audit attempts to read the process
|
||||||
@ -767,6 +817,8 @@ interface(`domain_unconfined',`
|
|||||||
class lnk_file r_file_perms;
|
class lnk_file r_file_perms;
|
||||||
')
|
')
|
||||||
|
|
||||||
|
typeattribute $1 unconfined_domain;
|
||||||
|
|
||||||
# pass all constraints
|
# pass all constraints
|
||||||
typeattribute $1 can_change_process_identity;
|
typeattribute $1 can_change_process_identity;
|
||||||
typeattribute $1 can_change_process_role;
|
typeattribute $1 can_change_process_role;
|
||||||
|
@ -12,6 +12,9 @@ attribute domain;
|
|||||||
# Transitions only allowed from domains to other domains
|
# Transitions only allowed from domains to other domains
|
||||||
neverallow domain ~domain:process { transition dyntransition };
|
neverallow domain ~domain:process { transition dyntransition };
|
||||||
|
|
||||||
|
# Domains that are unconfined
|
||||||
|
attribute unconfined_domain;
|
||||||
|
|
||||||
# Domains that can set their current context
|
# Domains that can set their current context
|
||||||
# (perform dynamic transitions)
|
# (perform dynamic transitions)
|
||||||
attribute set_curr_context;
|
attribute set_curr_context;
|
||||||
|
@ -123,10 +123,10 @@ ifdef(`distro_redhat', `
|
|||||||
|
|
||||||
ifdef(`targeted_policy', `
|
ifdef(`targeted_policy', `
|
||||||
unconfined_domain_template(hotplug_t)
|
unconfined_domain_template(hotplug_t)
|
||||||
')
|
|
||||||
|
|
||||||
optional_policy(`consoletype.te',`
|
optional_policy(`consoletype.te',`
|
||||||
consoletype_domtrans(hotplug_t)
|
consoletype_domtrans(hotplug_t)
|
||||||
|
')
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`dbus.te',`
|
optional_policy(`dbus.te',`
|
||||||
|
@ -157,6 +157,23 @@ interface(`init_domtrans',`
|
|||||||
allow init_t $1:process sigchld;
|
allow init_t $1:process sigchld;
|
||||||
')
|
')
|
||||||
|
|
||||||
|
########################################
|
||||||
|
## <summary>
|
||||||
|
## Execute the init program in the caller domain.
|
||||||
|
## </summary>
|
||||||
|
## <param name="domain">
|
||||||
|
## Domain allowed access.
|
||||||
|
## </param>
|
||||||
|
#
|
||||||
|
interface(`init_exec',`
|
||||||
|
gen_require(`
|
||||||
|
type init_exec_t;
|
||||||
|
')
|
||||||
|
|
||||||
|
corecmd_search_sbin($1)
|
||||||
|
can_exec($1,init_exec_t)
|
||||||
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
# init_get_process_group(domain)
|
# init_get_process_group(domain)
|
||||||
|
@ -239,6 +239,7 @@ dev_write_snd_mixer_dev(initrc_t)
|
|||||||
dev_setattr_all_chr_files(initrc_t)
|
dev_setattr_all_chr_files(initrc_t)
|
||||||
dev_read_lvm_control(initrc_t)
|
dev_read_lvm_control(initrc_t)
|
||||||
dev_delete_lvm_control(initrc_t)
|
dev_delete_lvm_control(initrc_t)
|
||||||
|
dev_manage_generic_symlinks(initrc_t)
|
||||||
# Wants to remove udev.tbl:
|
# Wants to remove udev.tbl:
|
||||||
dev_del_generic_symlinks(initrc_t)
|
dev_del_generic_symlinks(initrc_t)
|
||||||
|
|
||||||
@ -317,6 +318,7 @@ logging_send_syslog_msg(initrc_t)
|
|||||||
logging_manage_generic_logs(initrc_t)
|
logging_manage_generic_logs(initrc_t)
|
||||||
logging_read_all_logs(initrc_t)
|
logging_read_all_logs(initrc_t)
|
||||||
logging_append_all_logs(initrc_t)
|
logging_append_all_logs(initrc_t)
|
||||||
|
logging_read_auditd_config(initrc_t)
|
||||||
|
|
||||||
miscfiles_read_localization(initrc_t)
|
miscfiles_read_localization(initrc_t)
|
||||||
|
|
||||||
@ -386,6 +388,7 @@ ifdef(`distro_redhat',`
|
|||||||
')
|
')
|
||||||
|
|
||||||
ifdef(`targeted_policy',`
|
ifdef(`targeted_policy',`
|
||||||
|
domain_subj_id_change_exempt(initrc_t)
|
||||||
unconfined_domain_template(initrc_t)
|
unconfined_domain_template(initrc_t)
|
||||||
unconfined_shell_domtrans(initrc_t)
|
unconfined_shell_domtrans(initrc_t)
|
||||||
')
|
')
|
||||||
|
@ -18,7 +18,7 @@ interface(`locallogin_domtrans',`
|
|||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
## Allow processes to inherit local login file descriptors
|
## Allow processes to inherit local login file descriptors.
|
||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
## The type of the process performing this action.
|
## The type of the process performing this action.
|
||||||
@ -33,6 +33,23 @@ interface(`locallogin_use_fd',`
|
|||||||
allow $1 local_login_t:fd use;
|
allow $1 local_login_t:fd use;
|
||||||
')
|
')
|
||||||
|
|
||||||
|
########################################
|
||||||
|
## <summary>
|
||||||
|
## Do not audit attempts to inherit local login file descriptors.
|
||||||
|
## </summary>
|
||||||
|
## <param name="domain">
|
||||||
|
## Domain to not audit.
|
||||||
|
## </param>
|
||||||
|
#
|
||||||
|
interface(`locallogin_dontaudit_use_fd',`
|
||||||
|
gen_require(`
|
||||||
|
type local_login_t;
|
||||||
|
class fd use;
|
||||||
|
')
|
||||||
|
|
||||||
|
dontaudit $1 local_login_t:fd use;
|
||||||
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
## Send a null signal to local login processes.
|
## Send a null signal to local login processes.
|
||||||
|
@ -83,6 +83,24 @@ interface(`logging_send_syslog_msg',`
|
|||||||
term_use_console($1)
|
term_use_console($1)
|
||||||
')
|
')
|
||||||
|
|
||||||
|
########################################
|
||||||
|
## <summary>
|
||||||
|
## Read the auditd configuration files.
|
||||||
|
## </summary>
|
||||||
|
## <param name="domain">
|
||||||
|
## Domain allowed access.
|
||||||
|
## </param>
|
||||||
|
#
|
||||||
|
interface(`logging_read_auditd_config',`
|
||||||
|
gen_require(`
|
||||||
|
type auditd_etc_t;
|
||||||
|
class file r_file_perms;
|
||||||
|
')
|
||||||
|
|
||||||
|
files_search_etc($1)
|
||||||
|
allow $1 auditd_etc_t:file r_file_perms;
|
||||||
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
## Allows the domain to open a file in the
|
## Allows the domain to open a file in the
|
||||||
|
@ -8,7 +8,15 @@ policy_module(logging,1.0)
|
|||||||
|
|
||||||
attribute logfile;
|
attribute logfile;
|
||||||
|
|
||||||
type auditd_log_t;
|
type auditctl_t; #, privlog;
|
||||||
|
type auditctl_exec_t;
|
||||||
|
init_system_domain(auditctl_t,auditctl_exec_t)
|
||||||
|
role system_r types auditctl_t;
|
||||||
|
|
||||||
|
type auditd_etc_t; #, secure_file_type;
|
||||||
|
files_type(auditd_etc_t)
|
||||||
|
|
||||||
|
type auditd_log_t; # secure_file_type;
|
||||||
files_type(auditd_log_t)
|
files_type(auditd_log_t)
|
||||||
|
|
||||||
type auditd_t;
|
type auditd_t;
|
||||||
@ -49,13 +57,55 @@ files_type(var_log_t)
|
|||||||
# Auditd local policy
|
# Auditd local policy
|
||||||
#
|
#
|
||||||
|
|
||||||
|
allow auditctl_t self:capability { audit_write audit_control };
|
||||||
|
allow auditctl_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay nlmsg_readpriv };
|
||||||
|
|
||||||
|
libs_use_ld_so(auditctl_t)
|
||||||
|
libs_use_shared_libs(auditctl_t)
|
||||||
|
|
||||||
|
allow auditctl_t etc_t:file { getattr read };
|
||||||
|
|
||||||
|
allow auditctl_t auditd_etc_t:file r_file_perms;
|
||||||
|
|
||||||
|
kernel_read_kernel_sysctl(auditctl_t)
|
||||||
|
|
||||||
|
domain_use_wide_inherit_fd(auditctl_t)
|
||||||
|
|
||||||
|
init_use_script_pty(auditctl_t)
|
||||||
|
init_dontaudit_use_fd(auditctl_t)
|
||||||
|
|
||||||
|
locallogin_dontaudit_use_fd(auditctl_t)
|
||||||
|
|
||||||
|
ifdef(`TODO',`
|
||||||
|
role secadm_r types auditctl_t;
|
||||||
|
role sysadm_r types auditctl_t;
|
||||||
|
audit_manager_domain(secadm_t)
|
||||||
|
|
||||||
|
ifdef(`targeted_policy', `', `
|
||||||
|
ifdef(`separate_secadm', `', `
|
||||||
|
audit_manager_domain(sysadm_t)
|
||||||
|
allow auditctl_t admin_tty_type:chr_file rw_file_perms;
|
||||||
|
')
|
||||||
|
')
|
||||||
|
') dnl end TODO
|
||||||
|
|
||||||
|
########################################
|
||||||
|
#
|
||||||
|
# Auditd local policy
|
||||||
|
#
|
||||||
|
|
||||||
allow auditd_t self:capability { audit_write audit_control sys_nice sys_resource };
|
allow auditd_t self:capability { audit_write audit_control sys_nice sys_resource };
|
||||||
dontaudit auditd_t self:capability sys_tty_config;
|
dontaudit auditd_t self:capability sys_tty_config;
|
||||||
allow auditd_t self:process { signal_perms setsched };
|
allow auditd_t self:process { signal_perms setsched };
|
||||||
allow auditd_t self:netlink_audit_socket { bind create getattr nlmsg_read nlmsg_write read write };
|
allow auditd_t self:file { getattr read write };
|
||||||
|
allow auditd_t self:unix_dgram_socket create_socket_perms;
|
||||||
|
allow auditd_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay nlmsg_readpriv };
|
||||||
|
|
||||||
allow auditd_t var_log_t:dir rw_dir_perms;
|
allow auditd_t auditd_etc_t:file r_file_perms;
|
||||||
|
|
||||||
|
allow auditd_t auditd_log_t:dir rw_dir_perms;
|
||||||
allow auditd_t auditd_log_t:file create_file_perms;
|
allow auditd_t auditd_log_t:file create_file_perms;
|
||||||
|
allow auditd_t var_log_t:dir search;
|
||||||
|
|
||||||
allow auditd_t auditd_var_run_t:file create_file_perms;
|
allow auditd_t auditd_var_run_t:file create_file_perms;
|
||||||
files_create_pid(auditd_t,auditd_var_run_t)
|
files_create_pid(auditd_t,auditd_var_run_t)
|
||||||
@ -72,6 +122,8 @@ fs_search_auto_mountpoints(auditd_t)
|
|||||||
term_dontaudit_use_console(auditd_t)
|
term_dontaudit_use_console(auditd_t)
|
||||||
|
|
||||||
init_use_fd(auditd_t)
|
init_use_fd(auditd_t)
|
||||||
|
init_exec(auditd_t)
|
||||||
|
init_write_initctl(auditd_t)
|
||||||
init_use_script_pty(auditd_t)
|
init_use_script_pty(auditd_t)
|
||||||
|
|
||||||
domain_use_wide_inherit_fd(auditd_t)
|
domain_use_wide_inherit_fd(auditd_t)
|
||||||
@ -91,10 +143,8 @@ userdom_dontaudit_search_sysadm_home_dir(auditd_t)
|
|||||||
# cjp: this is questionable
|
# cjp: this is questionable
|
||||||
userdom_use_sysadm_tty(auditd_t)
|
userdom_use_sysadm_tty(auditd_t)
|
||||||
|
|
||||||
ifdef(`targeted_policy', `
|
ifdef(`targeted_policy',`
|
||||||
term_dontaudit_use_unallocated_tty(auditd_t)
|
unconfined_domain_template(auditd_t)
|
||||||
term_dontaudit_use_generic_pty(auditd_t)
|
|
||||||
files_dontaudit_read_root_file(auditd_t)
|
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`selinuxutil.te',`
|
optional_policy(`selinuxutil.te',`
|
||||||
@ -155,11 +205,12 @@ miscfiles_read_localization(klogd_t)
|
|||||||
# syslogd local policy
|
# syslogd local policy
|
||||||
#
|
#
|
||||||
|
|
||||||
|
# sys_admin chown fsetid for syslog-ng
|
||||||
# cjp: why net_admin!
|
# cjp: why net_admin!
|
||||||
allow syslogd_t self:capability { dac_override sys_resource sys_tty_config net_admin };
|
allow syslogd_t self:capability { dac_override sys_resource sys_tty_config net_admin sys_admin chown fsetid };
|
||||||
dontaudit syslogd_t self:capability sys_tty_config;
|
dontaudit syslogd_t self:capability sys_tty_config;
|
||||||
allow syslogd_t self:process signal_perms;
|
allow syslogd_t self:process signal_perms;
|
||||||
|
allow syslogd_t self:netlink_route_socket r_netlink_socket_perms;
|
||||||
# receive messages to be logged
|
# receive messages to be logged
|
||||||
allow syslogd_t self:unix_dgram_socket create_socket_perms;
|
allow syslogd_t self:unix_dgram_socket create_socket_perms;
|
||||||
allow syslogd_t self:unix_stream_socket create_stream_socket_perms;
|
allow syslogd_t self:unix_stream_socket create_stream_socket_perms;
|
||||||
@ -167,9 +218,18 @@ allow syslogd_t self:unix_dgram_socket sendto;
|
|||||||
allow syslogd_t self:fifo_file rw_file_perms;
|
allow syslogd_t self:fifo_file rw_file_perms;
|
||||||
allow syslogd_t self:udp_socket { connected_socket_perms connect };
|
allow syslogd_t self:udp_socket { connected_socket_perms connect };
|
||||||
|
|
||||||
|
# Create and bind to /dev/log or /var/run/log.
|
||||||
|
allow syslogd_t devlog_t:sock_file create_file_perms;
|
||||||
|
files_create_pid(syslogd_t,devlog_t,sock_file)
|
||||||
|
# cjp: I belive these are not needed:
|
||||||
|
allow syslogd_t devlog_t:unix_stream_socket name_bind;
|
||||||
|
allow syslogd_t devlog_t:unix_dgram_socket name_bind;
|
||||||
|
|
||||||
# create/append log files.
|
# create/append log files.
|
||||||
allow syslogd_t var_log_t:dir rw_dir_perms;
|
allow syslogd_t var_log_t:dir rw_dir_perms;
|
||||||
allow syslogd_t var_log_t:file create_file_perms;
|
allow syslogd_t var_log_t:file create_file_perms;
|
||||||
|
# Allow access for syslog-ng
|
||||||
|
allow syslogd_t var_log_t:dir { create setattr };
|
||||||
|
|
||||||
# manage temporary files
|
# manage temporary files
|
||||||
allow syslogd_t syslogd_tmp_t:file create_file_perms;
|
allow syslogd_t syslogd_tmp_t:file create_file_perms;
|
||||||
@ -178,13 +238,6 @@ files_create_tmp_files(syslogd_t,syslogd_tmp_t)
|
|||||||
allow syslogd_t syslogd_var_run_t:file create_file_perms;
|
allow syslogd_t syslogd_var_run_t:file create_file_perms;
|
||||||
files_create_pid(syslogd_t,syslogd_var_run_t,file)
|
files_create_pid(syslogd_t,syslogd_var_run_t,file)
|
||||||
|
|
||||||
# Create and bind to /dev/log or /var/run/log.
|
|
||||||
allow syslogd_t devlog_t:sock_file create_file_perms;
|
|
||||||
files_create_pid(syslogd_t,devlog_t,sock_file)
|
|
||||||
# I belive these are not needed:
|
|
||||||
allow syslogd_t devlog_t:unix_stream_socket name_bind;
|
|
||||||
allow syslogd_t devlog_t:unix_dgram_socket name_bind;
|
|
||||||
|
|
||||||
# manage pid file
|
# manage pid file
|
||||||
allow syslogd_t syslogd_var_run_t:file create_file_perms;
|
allow syslogd_t syslogd_var_run_t:file create_file_perms;
|
||||||
files_create_pid(syslogd_t,syslogd_var_run_t)
|
files_create_pid(syslogd_t,syslogd_var_run_t)
|
||||||
@ -192,6 +245,10 @@ files_create_pid(syslogd_t,syslogd_var_run_t)
|
|||||||
kernel_read_kernel_sysctl(syslogd_t)
|
kernel_read_kernel_sysctl(syslogd_t)
|
||||||
kernel_read_proc_symlinks(syslogd_t)
|
kernel_read_proc_symlinks(syslogd_t)
|
||||||
kernel_send_syslog_msg_from(devlog_t,syslogd_t)
|
kernel_send_syslog_msg_from(devlog_t,syslogd_t)
|
||||||
|
# Allow access to /proc/kmsg for syslog-ng
|
||||||
|
kernel_read_messages(klogd_t)
|
||||||
|
kernel_clear_ring_buffer(klogd_t)
|
||||||
|
kernel_change_ring_buffer_level(klogd_t)
|
||||||
|
|
||||||
dev_create_dev_node(syslogd_t,devlog_t,sock_file)
|
dev_create_dev_node(syslogd_t,devlog_t,sock_file)
|
||||||
dev_read_sysfs(syslogd_t)
|
dev_read_sysfs(syslogd_t)
|
||||||
@ -213,7 +270,9 @@ corenet_raw_sendrecv_all_nodes(syslogd_t)
|
|||||||
corenet_udp_sendrecv_all_nodes(syslogd_t)
|
corenet_udp_sendrecv_all_nodes(syslogd_t)
|
||||||
corenet_udp_sendrecv_all_ports(syslogd_t)
|
corenet_udp_sendrecv_all_ports(syslogd_t)
|
||||||
corenet_udp_bind_all_nodes(syslogd_t)
|
corenet_udp_bind_all_nodes(syslogd_t)
|
||||||
corenet_udp_bind_syslogd_port(syslogd_t)
|
corenet_tcp_bind_syslogd_port(syslogd_t)
|
||||||
|
#cjp: why?
|
||||||
|
corenet_tcp_connect_rsh_port(syslogd_t)
|
||||||
|
|
||||||
fs_getattr_all_fs(syslogd_t)
|
fs_getattr_all_fs(syslogd_t)
|
||||||
|
|
||||||
@ -223,6 +282,8 @@ init_use_script_pty(syslogd_t)
|
|||||||
domain_use_wide_inherit_fd(syslogd_t)
|
domain_use_wide_inherit_fd(syslogd_t)
|
||||||
|
|
||||||
files_read_etc_files(syslogd_t)
|
files_read_etc_files(syslogd_t)
|
||||||
|
# /initrd is not umounted before minilog starts
|
||||||
|
files_dontaudit_search_isid_type_dir(syslogd_t)
|
||||||
|
|
||||||
libs_use_ld_so(syslogd_t)
|
libs_use_ld_so(syslogd_t)
|
||||||
libs_use_shared_libs(syslogd_t)
|
libs_use_shared_libs(syslogd_t)
|
||||||
@ -234,38 +295,18 @@ miscfiles_read_localization(syslogd_t)
|
|||||||
userdom_dontaudit_use_unpriv_user_fd(syslogd_t)
|
userdom_dontaudit_use_unpriv_user_fd(syslogd_t)
|
||||||
userdom_dontaudit_search_sysadm_home_dir(syslogd_t)
|
userdom_dontaudit_search_sysadm_home_dir(syslogd_t)
|
||||||
|
|
||||||
#
|
ifdef(`distro_suse',`
|
||||||
# /initrd is not umounted before minilog starts
|
|
||||||
#
|
|
||||||
files_dontaudit_search_isid_type_dir(syslogd_t)
|
|
||||||
#allow syslogd_t tmpfs_t:dir search;
|
|
||||||
#dontaudit syslogd_t unlabeled_t:file read;
|
|
||||||
#dontaudit syslogd_t { userpty_type devpts_t }:chr_file getattr;
|
|
||||||
allow syslogd_t self:capability net_admin;
|
|
||||||
allow syslogd_t self:netlink_route_socket r_netlink_socket_perms;
|
|
||||||
|
|
||||||
ifdef(`distro_suse', `
|
|
||||||
# suse creates a /dev/log under /var/lib/stunnel for chrooted stunnel
|
# suse creates a /dev/log under /var/lib/stunnel for chrooted stunnel
|
||||||
files_create_var_lib(syslogd_t,devlog_t,sock_file)
|
files_create_var_lib(syslogd_t,devlog_t,sock_file)
|
||||||
')
|
')
|
||||||
|
|
||||||
ifdef(`klogd.te', `', `
|
ifdef(`targeted_policy',`
|
||||||
# Allow access to /proc/kmsg for syslog-ng
|
allow syslogd_t var_run_t:fifo_file { ioctl read write };
|
||||||
kernel_read_messages(syslogd_t)
|
|
||||||
kernel_clear_ring_buffer(syslogd_t)
|
|
||||||
kernel_change_ring_buffer_level(syslogd_t)
|
|
||||||
')
|
|
||||||
|
|
||||||
ifdef(`targeted_policy', `
|
|
||||||
term_dontaudit_use_unallocated_tty(syslogd_t)
|
term_dontaudit_use_unallocated_tty(syslogd_t)
|
||||||
term_dontaudit_use_generic_pty(syslogd_t)
|
term_dontaudit_use_generic_pty(syslogd_t)
|
||||||
files_dontaudit_read_root_file(syslogd_t)
|
files_dontaudit_read_root_file(syslogd_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`cron.te',`
|
|
||||||
cron_rw_log(syslogd_t)
|
|
||||||
')
|
|
||||||
|
|
||||||
optional_policy(`inn.te',`
|
optional_policy(`inn.te',`
|
||||||
inn_manage_log(syslogd_t)
|
inn_manage_log(syslogd_t)
|
||||||
')
|
')
|
||||||
@ -283,16 +324,19 @@ optional_policy(`udev.te', `
|
|||||||
')
|
')
|
||||||
|
|
||||||
ifdef(`TODO',`
|
ifdef(`TODO',`
|
||||||
|
|
||||||
optional_policy(`rhgb.te', `
|
optional_policy(`rhgb.te', `
|
||||||
rhgb_domain(syslogd_t)
|
rhgb_domain(syslogd_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
|
allow syslogd_t tmpfs_t:dir search;
|
||||||
|
dontaudit syslogd_t unlabeled_t:file { getattr read };
|
||||||
|
dontaudit syslogd_t { userpty_type devpts_t }:chr_file getattr;
|
||||||
|
|
||||||
# log to the xconsole
|
# log to the xconsole
|
||||||
allow syslogd_t xconsole_device_t:fifo_file { ioctl read write };
|
allow syslogd_t xconsole_device_t:fifo_file { ioctl read write };
|
||||||
|
|
||||||
#
|
#
|
||||||
# Special case to handle crashes
|
# Special case to handle crashes
|
||||||
#
|
#
|
||||||
allow syslogd_t { device_t file_t }:sock_file unlink;
|
allow syslogd_t { device_t file_t }:sock_file { getattr unlink };
|
||||||
') dnl end TODO
|
') dnl end TODO
|
||||||
|
@ -72,7 +72,7 @@ corecmd_exec_sbin(cardmgr_t)
|
|||||||
domain_use_wide_inherit_fd(cardmgr_t)
|
domain_use_wide_inherit_fd(cardmgr_t)
|
||||||
domain_exec_all_entry_files(cardmgr_t)
|
domain_exec_all_entry_files(cardmgr_t)
|
||||||
# Read /proc/PID directories for all domains (for fuser).
|
# Read /proc/PID directories for all domains (for fuser).
|
||||||
domain_read_all_domains_state(cardmgr_t)
|
domain_read_confined_domains_state(cardmgr_t)
|
||||||
# cjp: these look excessive:
|
# cjp: these look excessive:
|
||||||
domain_dontaudit_getattr_all_unnamed_pipes(cardmgr_t)
|
domain_dontaudit_getattr_all_unnamed_pipes(cardmgr_t)
|
||||||
domain_dontaudit_getattr_all_sockets(cardmgr_t)
|
domain_dontaudit_getattr_all_sockets(cardmgr_t)
|
||||||
|
@ -11,7 +11,7 @@
|
|||||||
# kernel_t is the domain of kernel threads.
|
# kernel_t is the domain of kernel threads.
|
||||||
# It is also the target type when checking permissions in the system class.
|
# It is also the target type when checking permissions in the system class.
|
||||||
#
|
#
|
||||||
type kernel_t, domain, privmodule, privlog, sysctl_kernel_writer, mlsprocread, mlsprocwrite ifdef(`nfs_export_all_rw',`,etc_writer') ;
|
type kernel_t, domain, privmodule, privlog, sysctl_kernel_writer, mlsprocread, mlsprocwrite, privsysmod ifdef(`nfs_export_all_rw',`,etc_writer'), privrangetrans ;
|
||||||
role system_r types kernel_t;
|
role system_r types kernel_t;
|
||||||
general_domain_access(kernel_t)
|
general_domain_access(kernel_t)
|
||||||
general_proc_read_access(kernel_t)
|
general_proc_read_access(kernel_t)
|
||||||
@ -22,8 +22,8 @@ can_exec(kernel_t, shell_exec_t)
|
|||||||
# Use capabilities.
|
# Use capabilities.
|
||||||
allow kernel_t self:capability *;
|
allow kernel_t self:capability *;
|
||||||
|
|
||||||
allow kernel_t sysfs_t:dir search;
|
r_dir_file(kernel_t, sysfs_t)
|
||||||
allow kernel_t { usbfs_t usbdevfs_t sysfs_t }:dir search;
|
allow kernel_t { usbfs_t usbdevfs_t }:dir search;
|
||||||
|
|
||||||
# Run init in the init_t domain.
|
# Run init in the init_t domain.
|
||||||
domain_auto_trans(kernel_t, init_exec_t, init_t)
|
domain_auto_trans(kernel_t, init_exec_t, init_t)
|
||||||
@ -36,6 +36,7 @@ allow kernel_t fs_type:filesystem mount_fs_perms;
|
|||||||
|
|
||||||
# Send signal to any process.
|
# Send signal to any process.
|
||||||
allow kernel_t domain:process signal;
|
allow kernel_t domain:process signal;
|
||||||
|
allow kernel_t domain:dir search;
|
||||||
|
|
||||||
# Access the console.
|
# Access the console.
|
||||||
allow kernel_t device_t:dir search;
|
allow kernel_t device_t:dir search;
|
||||||
@ -50,6 +51,7 @@ can_exec(kernel_t, chroot_exec_t)
|
|||||||
allow kernel_t self:capability sys_chroot;
|
allow kernel_t self:capability sys_chroot;
|
||||||
|
|
||||||
allow kernel_t { unlabeled_t root_t file_t }:dir mounton;
|
allow kernel_t { unlabeled_t root_t file_t }:dir mounton;
|
||||||
|
allow kernel_t unlabeled_t:fifo_file rw_file_perms;
|
||||||
allow kernel_t file_t:dir rw_dir_perms;
|
allow kernel_t file_t:dir rw_dir_perms;
|
||||||
allow kernel_t file_t:blk_file create_file_perms;
|
allow kernel_t file_t:blk_file create_file_perms;
|
||||||
allow kernel_t { sysctl_t sysctl_kernel_t }:file { setattr rw_file_perms };
|
allow kernel_t { sysctl_t sysctl_kernel_t }:file { setattr rw_file_perms };
|
||||||
|
@ -2,11 +2,66 @@
|
|||||||
#
|
#
|
||||||
# Authors: Colin Walters <walters@verbum.org>
|
# Authors: Colin Walters <walters@verbum.org>
|
||||||
#
|
#
|
||||||
|
# Some fixes by Paul Moore <paul.moore@hp.com>
|
||||||
|
#
|
||||||
|
define(`audit_manager_domain', `
|
||||||
|
allow $1 auditd_etc_t:file rw_file_perms;
|
||||||
|
create_dir_file($1, auditd_log_t)
|
||||||
|
domain_auto_trans($1, auditctl_exec_t, auditctl_t)
|
||||||
|
')
|
||||||
|
|
||||||
daemon_domain(auditd)
|
daemon_domain(auditd)
|
||||||
allow auditd_t self:netlink_audit_socket { bind create getattr nlmsg_read nlmsg_write read write };
|
|
||||||
allow auditd_t self:capability { audit_write audit_control };
|
allow auditd_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay nlmsg_readpriv };
|
||||||
allow auditd_t sysadm_tty_device_t:chr_file rw_file_perms;
|
|
||||||
allow auditd_t self:unix_dgram_socket create_socket_perms;
|
allow auditd_t self:unix_dgram_socket create_socket_perms;
|
||||||
|
allow auditd_t self:capability { audit_write audit_control sys_nice sys_resource };
|
||||||
|
allow auditd_t self:process setsched;
|
||||||
|
allow auditd_t self:file { getattr read write };
|
||||||
allow auditd_t etc_t:file { getattr read };
|
allow auditd_t etc_t:file { getattr read };
|
||||||
log_domain(auditd)
|
|
||||||
|
# Do not use logdir_domain since this is a security file
|
||||||
|
type auditd_log_t, file_type, secure_file_type;
|
||||||
|
allow auditd_t var_log_t:dir search;
|
||||||
|
rw_dir_create_file(auditd_t, auditd_log_t)
|
||||||
|
|
||||||
|
can_exec(auditd_t, init_exec_t)
|
||||||
|
allow auditd_t initctl_t:fifo_file write;
|
||||||
|
|
||||||
|
ifdef(`targeted_policy', `
|
||||||
|
dontaudit auditd_t unconfined_t:fifo_file read;
|
||||||
|
')
|
||||||
|
|
||||||
|
type auditctl_t, domain, privlog;
|
||||||
|
type auditctl_exec_t, file_type, exec_type, sysadmfile;
|
||||||
|
uses_shlib(auditctl_t)
|
||||||
|
allow auditctl_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay nlmsg_readpriv };
|
||||||
|
allow auditctl_t self:capability { audit_write audit_control };
|
||||||
|
allow auditctl_t etc_t:file { getattr read };
|
||||||
|
allow auditctl_t admin_tty_type:chr_file rw_file_perms;
|
||||||
|
|
||||||
|
type auditd_etc_t, file_type, secure_file_type;
|
||||||
|
allow { auditd_t auditctl_t } auditd_etc_t:file r_file_perms;
|
||||||
|
allow initrc_t auditd_etc_t:file r_file_perms;
|
||||||
|
|
||||||
|
role secadm_r types auditctl_t;
|
||||||
|
role sysadm_r types auditctl_t;
|
||||||
|
audit_manager_domain(secadm_t)
|
||||||
|
|
||||||
|
ifdef(`targeted_policy', `', `
|
||||||
|
ifdef(`separate_secadm', `', `
|
||||||
|
audit_manager_domain(sysadm_t)
|
||||||
|
')
|
||||||
|
')
|
||||||
|
|
||||||
|
role system_r types auditctl_t;
|
||||||
|
domain_auto_trans(initrc_t, auditctl_exec_t, auditctl_t)
|
||||||
|
|
||||||
|
dontaudit auditctl_t local_login_t:fd use;
|
||||||
|
allow auditctl_t proc_t:dir search;
|
||||||
|
allow auditctl_t sysctl_kernel_t:dir search;
|
||||||
|
allow auditctl_t sysctl_kernel_t:file { getattr read };
|
||||||
|
dontaudit auditctl_t init_t:fd use;
|
||||||
|
allow auditctl_t initrc_devpts_t:chr_file { read write };
|
||||||
|
allow auditctl_t privfd:fd use;
|
||||||
|
|
||||||
|
|
||||||
|
@ -61,7 +61,9 @@ allow ifconfig_t cardmgr_t:fd use;
|
|||||||
allow cardmgr_t proc_t:file { getattr read ioctl };
|
allow cardmgr_t proc_t:file { getattr read ioctl };
|
||||||
|
|
||||||
# Read /proc/PID directories for all domains (for fuser).
|
# Read /proc/PID directories for all domains (for fuser).
|
||||||
can_ps(cardmgr_t, domain)
|
can_ps(cardmgr_t, domain -unrestricted)
|
||||||
|
dontaudit cardmgr_t unrestricted:dir search;
|
||||||
|
|
||||||
allow cardmgr_t device_type:{ chr_file blk_file } getattr;
|
allow cardmgr_t device_type:{ chr_file blk_file } getattr;
|
||||||
allow cardmgr_t ttyfile:chr_file getattr;
|
allow cardmgr_t ttyfile:chr_file getattr;
|
||||||
dontaudit cardmgr_t ptyfile:chr_file getattr;
|
dontaudit cardmgr_t ptyfile:chr_file getattr;
|
||||||
|
@ -12,6 +12,7 @@
|
|||||||
type checkpolicy_t, domain;
|
type checkpolicy_t, domain;
|
||||||
role sysadm_r types checkpolicy_t;
|
role sysadm_r types checkpolicy_t;
|
||||||
role system_r types checkpolicy_t;
|
role system_r types checkpolicy_t;
|
||||||
|
role secadm_r types checkpolicy_t;
|
||||||
|
|
||||||
type checkpolicy_exec_t, file_type, exec_type, sysadmfile;
|
type checkpolicy_exec_t, file_type, exec_type, sysadmfile;
|
||||||
|
|
||||||
@ -19,7 +20,7 @@ type checkpolicy_exec_t, file_type, exec_type, sysadmfile;
|
|||||||
#
|
#
|
||||||
# Rules
|
# Rules
|
||||||
|
|
||||||
domain_auto_trans(sysadm_t, checkpolicy_exec_t, checkpolicy_t)
|
domain_auto_trans(secadmin, checkpolicy_exec_t, checkpolicy_t)
|
||||||
|
|
||||||
# able to create and modify binary policy files
|
# able to create and modify binary policy files
|
||||||
allow checkpolicy_t policy_config_t:dir rw_dir_perms;
|
allow checkpolicy_t policy_config_t:dir rw_dir_perms;
|
||||||
|
@ -19,28 +19,28 @@ role system_r types consoletype_t;
|
|||||||
uses_shlib(consoletype_t)
|
uses_shlib(consoletype_t)
|
||||||
general_domain_access(consoletype_t)
|
general_domain_access(consoletype_t)
|
||||||
|
|
||||||
|
ifdef(`targeted_policy', `', `
|
||||||
domain_auto_trans(initrc_t, consoletype_exec_t, consoletype_t)
|
domain_auto_trans(initrc_t, consoletype_exec_t, consoletype_t)
|
||||||
|
|
||||||
allow consoletype_t tty_device_t:chr_file { getattr ioctl write };
|
|
||||||
allow consoletype_t initrc_devpts_t:chr_file { read write getattr ioctl };
|
|
||||||
|
|
||||||
ifdef(`xdm.te', `
|
ifdef(`xdm.te', `
|
||||||
domain_auto_trans(xdm_t, consoletype_exec_t, consoletype_t)
|
domain_auto_trans(xdm_t, consoletype_exec_t, consoletype_t)
|
||||||
allow consoletype_t xdm_tmp_t:file { read write };
|
allow consoletype_t xdm_tmp_t:file { read write };
|
||||||
')
|
')
|
||||||
|
|
||||||
allow consoletype_t { kernel_t init_t initrc_t privfd sysadm_t }:fd use;
|
|
||||||
allow consoletype_t admin_tty_type:chr_file rw_file_perms;
|
|
||||||
ifdef(`hotplug.te', `
|
ifdef(`hotplug.te', `
|
||||||
domain_auto_trans(hotplug_t, consoletype_exec_t, consoletype_t)
|
domain_auto_trans(hotplug_t, consoletype_exec_t, consoletype_t)
|
||||||
')
|
')
|
||||||
|
')
|
||||||
|
|
||||||
|
allow consoletype_t {admin_tty_type tty_device_t devtty_t initrc_devpts_t }:chr_file rw_file_perms;
|
||||||
|
|
||||||
|
allow consoletype_t { kernel_t init_t initrc_t privfd sysadm_t }:fd use;
|
||||||
|
|
||||||
# Use capabilities.
|
# Use capabilities.
|
||||||
allow consoletype_t self:capability sys_admin;
|
allow consoletype_t self:capability sys_admin;
|
||||||
|
|
||||||
allow consoletype_t console_device_t:chr_file { getattr ioctl read write };
|
allow consoletype_t console_device_t:chr_file { getattr ioctl read write };
|
||||||
allow consoletype_t initrc_t:fifo_file write;
|
allow consoletype_t initrc_t:fifo_file write;
|
||||||
allow consoletype_t tty_device_t:chr_file read;
|
|
||||||
allow consoletype_t nfs_t:file write;
|
allow consoletype_t nfs_t:file write;
|
||||||
allow consoletype_t sysadm_t:fifo_file rw_file_perms;
|
allow consoletype_t sysadm_t:fifo_file rw_file_perms;
|
||||||
|
|
||||||
|
@ -43,8 +43,6 @@ allow system_crond_t { sysfs_t rpc_pipefs_t }:dir getattr;
|
|||||||
|
|
||||||
read_locale(crond_t)
|
read_locale(crond_t)
|
||||||
|
|
||||||
log_domain(crond)
|
|
||||||
|
|
||||||
# Use capabilities.
|
# Use capabilities.
|
||||||
allow crond_t self:capability { dac_override setgid setuid net_bind_service sys_nice };
|
allow crond_t self:capability { dac_override setgid setuid net_bind_service sys_nice };
|
||||||
dontaudit crond_t self:capability sys_resource;
|
dontaudit crond_t self:capability sys_resource;
|
||||||
@ -101,9 +99,6 @@ can_setexec(crond_t)
|
|||||||
# Still need to study anacron.
|
# Still need to study anacron.
|
||||||
domain_auto_trans(initrc_t, anacron_exec_t, system_crond_t)
|
domain_auto_trans(initrc_t, anacron_exec_t, system_crond_t)
|
||||||
|
|
||||||
# Access log files
|
|
||||||
file_type_auto_trans(system_crond_t, var_log_t, crond_log_t, file)
|
|
||||||
|
|
||||||
# Inherit and use descriptors from init for anacron.
|
# Inherit and use descriptors from init for anacron.
|
||||||
allow system_crond_t init_t:fd use;
|
allow system_crond_t init_t:fd use;
|
||||||
|
|
||||||
@ -205,11 +200,11 @@ domain_auto_trans(system_crond_t, setfiles_exec_t, setfiles_t)
|
|||||||
r_dir_file(system_crond_t, file_context_t)
|
r_dir_file(system_crond_t, file_context_t)
|
||||||
can_getsecurity(system_crond_t)
|
can_getsecurity(system_crond_t)
|
||||||
}
|
}
|
||||||
allow system_crond_t removable_t:filesystem { getattr };
|
dontaudit system_crond_t removable_t:filesystem getattr;
|
||||||
#
|
#
|
||||||
# Required for webalizer
|
# Required for webalizer
|
||||||
#
|
#
|
||||||
ifdef(`apache.te', `
|
ifdef(`apache.te', `
|
||||||
allow system_crond_t httpd_log_t:file { getattr read };
|
allow system_crond_t { httpd_log_t httpd_config_t }:file { getattr read };
|
||||||
')
|
')
|
||||||
dontaudit crond_t self:capability { sys_tty_config };
|
dontaudit crond_t self:capability sys_tty_config;
|
||||||
|
@ -10,7 +10,7 @@
|
|||||||
#
|
#
|
||||||
# firstboot_exec_t is the type of the firstboot executable.
|
# firstboot_exec_t is the type of the firstboot executable.
|
||||||
#
|
#
|
||||||
application_domain(firstboot,`, admin, etc_writer, fs_domain, privmem, auth_write, privlog, privowner, privmodule, sysctl_kernel_writer')
|
application_domain(firstboot,`, admin, etc_writer, fs_domain, privmem, auth_write, privowner, privmodule, privuser, sysctl_kernel_writer')
|
||||||
type firstboot_rw_t, file_type, sysadmfile;
|
type firstboot_rw_t, file_type, sysadmfile;
|
||||||
role system_r types firstboot_t;
|
role system_r types firstboot_t;
|
||||||
|
|
||||||
@ -29,8 +29,10 @@ domain_auto_trans(initrc_t, firstboot_exec_t, firstboot_t)
|
|||||||
file_type_auto_trans(firstboot_t, etc_t, firstboot_rw_t, file)
|
file_type_auto_trans(firstboot_t, etc_t, firstboot_rw_t, file)
|
||||||
|
|
||||||
can_exec_any(firstboot_t)
|
can_exec_any(firstboot_t)
|
||||||
|
ifdef(`useradd.te',`
|
||||||
domain_auto_trans(firstboot_t, useradd_exec_t, useradd_t)
|
domain_auto_trans(firstboot_t, useradd_exec_t, useradd_t)
|
||||||
domain_auto_trans(firstboot_t, groupadd_exec_t, groupadd_t)
|
domain_auto_trans(firstboot_t, groupadd_exec_t, groupadd_t)
|
||||||
|
')
|
||||||
allow firstboot_t etc_runtime_t:file { getattr read };
|
allow firstboot_t etc_runtime_t:file { getattr read };
|
||||||
|
|
||||||
r_dir_file(firstboot_t, etc_t)
|
r_dir_file(firstboot_t, etc_t)
|
||||||
@ -107,8 +109,10 @@ read_sysctl(firstboot_t)
|
|||||||
|
|
||||||
allow firstboot_t var_run_t:dir getattr;
|
allow firstboot_t var_run_t:dir getattr;
|
||||||
allow firstboot_t var_t:dir getattr;
|
allow firstboot_t var_t:dir getattr;
|
||||||
|
ifdef(`hostname.te', `
|
||||||
allow hostname_t devtty_t:chr_file { read write };
|
allow hostname_t devtty_t:chr_file { read write };
|
||||||
allow hostname_t firstboot_t:fd use;
|
allow hostname_t firstboot_t:fd use;
|
||||||
|
')
|
||||||
ifdef(`iptables.te', `
|
ifdef(`iptables.te', `
|
||||||
allow iptables_t devtty_t:chr_file { read write };
|
allow iptables_t devtty_t:chr_file { read write };
|
||||||
allow iptables_t firstboot_t:fd use;
|
allow iptables_t firstboot_t:fd use;
|
||||||
@ -128,4 +132,7 @@ file_type_auto_trans(firstboot_t, user_home_dir_t, user_home_t)
|
|||||||
# The big hammer
|
# The big hammer
|
||||||
#
|
#
|
||||||
unconfined_domain(firstboot_t)
|
unconfined_domain(firstboot_t)
|
||||||
|
ifdef(`targeted_policy', `
|
||||||
|
allow firstboot_t unconfined_t:process transition;
|
||||||
|
')
|
||||||
|
|
||||||
|
@ -42,6 +42,7 @@ allow getty_t wtmp_t:file rw_file_perms;
|
|||||||
# Chown, chmod, read and write ttys.
|
# Chown, chmod, read and write ttys.
|
||||||
allow getty_t tty_device_t:chr_file { setattr rw_file_perms };
|
allow getty_t tty_device_t:chr_file { setattr rw_file_perms };
|
||||||
allow getty_t ttyfile:chr_file { setattr rw_file_perms };
|
allow getty_t ttyfile:chr_file { setattr rw_file_perms };
|
||||||
|
dontaudit getty_t initrc_devpts_t:chr_file rw_file_perms;
|
||||||
|
|
||||||
# for error condition handling
|
# for error condition handling
|
||||||
allow getty_t fs_t:filesystem getattr;
|
allow getty_t fs_t:filesystem getattr;
|
||||||
|
@ -120,7 +120,10 @@ allow initrc_t domain:process { getattr getsession };
|
|||||||
|
|
||||||
# Mount and unmount file systems.
|
# Mount and unmount file systems.
|
||||||
allow initrc_t fs_type:filesystem mount_fs_perms;
|
allow initrc_t fs_type:filesystem mount_fs_perms;
|
||||||
allow initrc_t { file_t default_t }:dir { read search getattr mounton };
|
allow initrc_t file_t:dir { read search getattr mounton };
|
||||||
|
|
||||||
|
# during boot up initrc needs to do the following
|
||||||
|
allow initrc_t default_t:dir { read search getattr mounton };
|
||||||
|
|
||||||
# Create runtime files in /etc, e.g. /etc/mtab, /etc/HOSTNAME.
|
# Create runtime files in /etc, e.g. /etc/mtab, /etc/HOSTNAME.
|
||||||
file_type_auto_trans(initrc_t, etc_t, etc_runtime_t, file)
|
file_type_auto_trans(initrc_t, etc_t, etc_runtime_t, file)
|
||||||
@ -153,9 +156,6 @@ allow initrc_t clock_device_t:devfile_class_set rw_file_perms;
|
|||||||
# Kill all processes.
|
# Kill all processes.
|
||||||
allow initrc_t domain:process signal_perms;
|
allow initrc_t domain:process signal_perms;
|
||||||
|
|
||||||
# Read and unlink /var/run/*.pid files.
|
|
||||||
allow initrc_t pidfile:file { getattr read unlink };
|
|
||||||
|
|
||||||
# Write to /dev/urandom.
|
# Write to /dev/urandom.
|
||||||
allow initrc_t { random_device_t urandom_device_t }:chr_file rw_file_perms;
|
allow initrc_t { random_device_t urandom_device_t }:chr_file rw_file_perms;
|
||||||
|
|
||||||
@ -229,9 +229,13 @@ allow initrc_t sound_device_t:chr_file { setattr ioctl read write };
|
|||||||
allow initrc_t { home_root_t home_type }:dir r_dir_perms;
|
allow initrc_t { home_root_t home_type }:dir r_dir_perms;
|
||||||
allow initrc_t home_type:file r_file_perms;
|
allow initrc_t home_type:file r_file_perms;
|
||||||
|
|
||||||
|
# Read and unlink /var/run/*.pid files.
|
||||||
|
allow initrc_t pidfile:file { getattr read unlink };
|
||||||
|
|
||||||
# for system start scripts
|
# for system start scripts
|
||||||
allow initrc_t pidfile:dir rw_dir_perms;
|
allow initrc_t pidfile:dir rw_dir_perms;
|
||||||
allow initrc_t pidfile:sock_file unlink;
|
allow initrc_t pidfile:sock_file unlink;
|
||||||
|
|
||||||
rw_dir_create_file(initrc_t, var_lib_t)
|
rw_dir_create_file(initrc_t, var_lib_t)
|
||||||
|
|
||||||
# allow start scripts to clean /tmp
|
# allow start scripts to clean /tmp
|
||||||
@ -252,7 +256,9 @@ type run_init_t, domain;
|
|||||||
domain_auto_trans(unconfined_t, initrc_exec_t, initrc_t)
|
domain_auto_trans(unconfined_t, initrc_exec_t, initrc_t)
|
||||||
allow unconfined_t initrc_t:dbus { acquire_svc send_msg };
|
allow unconfined_t initrc_t:dbus { acquire_svc send_msg };
|
||||||
allow initrc_t unconfined_t:dbus { acquire_svc send_msg };
|
allow initrc_t unconfined_t:dbus { acquire_svc send_msg };
|
||||||
|
typeattribute initrc_t privuser;
|
||||||
domain_trans(initrc_t, shell_exec_t, unconfined_t)
|
domain_trans(initrc_t, shell_exec_t, unconfined_t)
|
||||||
|
allow initrc_t unconfined_t:system syslog_mod;
|
||||||
', `
|
', `
|
||||||
run_program(sysadm_t, sysadm_r, init, initrc_exec_t, initrc_t)
|
run_program(sysadm_t, sysadm_r, init, initrc_exec_t, initrc_t)
|
||||||
')
|
')
|
||||||
@ -309,3 +315,4 @@ ifdef(`distro_gentoo', `
|
|||||||
domain_auto_trans(sysadm_t,initrc_exec_t,run_init_t)
|
domain_auto_trans(sysadm_t,initrc_exec_t,run_init_t)
|
||||||
')
|
')
|
||||||
allow initrc_t self:netlink_route_socket r_netlink_socket_perms;
|
allow initrc_t self:netlink_route_socket r_netlink_socket_perms;
|
||||||
|
allow initrc_t device_t:lnk_file create_file_perms;
|
||||||
|
@ -9,14 +9,13 @@
|
|||||||
# Declarations for Samba
|
# Declarations for Samba
|
||||||
#
|
#
|
||||||
|
|
||||||
daemon_domain(smbd, `, auth_chkpwd')
|
daemon_domain(smbd, `, auth_chkpwd, nscd_client_domain')
|
||||||
daemon_domain(nmbd)
|
daemon_domain(nmbd)
|
||||||
type samba_etc_t, file_type, sysadmfile, usercanread;
|
type samba_etc_t, file_type, sysadmfile, usercanread;
|
||||||
type samba_log_t, file_type, sysadmfile, logfile;
|
type samba_log_t, file_type, sysadmfile, logfile;
|
||||||
type samba_var_t, file_type, sysadmfile;
|
type samba_var_t, file_type, sysadmfile;
|
||||||
type samba_share_t, file_type, sysadmfile, customizable;
|
type samba_share_t, file_type, sysadmfile, customizable;
|
||||||
type samba_secrets_t, file_type, sysadmfile;
|
type samba_secrets_t, file_type, sysadmfile;
|
||||||
typealias samba_var_t alias samba_spool_t;
|
|
||||||
|
|
||||||
# for /var/run/samba/messages.tdb
|
# for /var/run/samba/messages.tdb
|
||||||
allow smbd_t nmbd_var_run_t:file rw_file_perms;
|
allow smbd_t nmbd_var_run_t:file rw_file_perms;
|
||||||
@ -41,14 +40,17 @@ allow system_crond_t samba_log_t:file { read getattr lock };
|
|||||||
general_domain_access(smbd_t)
|
general_domain_access(smbd_t)
|
||||||
general_proc_read_access(smbd_t)
|
general_proc_read_access(smbd_t)
|
||||||
|
|
||||||
type smbd_port_t, port_type, reserved_port_type;
|
|
||||||
allow smbd_t smbd_port_t:tcp_socket name_bind;
|
allow smbd_t smbd_port_t:tcp_socket name_bind;
|
||||||
|
|
||||||
# Use capabilities.
|
# Use capabilities.
|
||||||
allow smbd_t self:capability { setgid setuid sys_resource net_bind_service lease dac_override dac_read_search };
|
allow smbd_t self:capability { setgid setuid sys_resource net_bind_service lease dac_override dac_read_search };
|
||||||
|
|
||||||
# Use the network.
|
# Use the network.
|
||||||
can_network_server(smbd_t)
|
can_network(smbd_t)
|
||||||
|
can_ldap(smbd_t)
|
||||||
|
can_kerberos(smbd_t)
|
||||||
|
can_winbind(smbd_t)
|
||||||
|
allow smbd_t ipp_port_t:tcp_socket name_connect;
|
||||||
|
|
||||||
allow smbd_t urandom_device_t:chr_file { getattr read };
|
allow smbd_t urandom_device_t:chr_file { getattr read };
|
||||||
|
|
||||||
@ -62,13 +64,16 @@ allow smbd_t { etc_t samba_etc_t etc_runtime_t }:file r_file_perms;
|
|||||||
|
|
||||||
# Permissions for Samba cache files in /var/cache/samba and /var/lib/samba
|
# Permissions for Samba cache files in /var/cache/samba and /var/lib/samba
|
||||||
allow smbd_t var_lib_t:dir search;
|
allow smbd_t var_lib_t:dir search;
|
||||||
allow smbd_t samba_var_t:dir create_dir_perms;
|
create_dir_file(smbd_t, samba_var_t)
|
||||||
allow smbd_t samba_var_t:file create_file_perms;
|
|
||||||
|
# Needed for shared printers
|
||||||
|
allow smbd_t var_spool_t:dir search;
|
||||||
|
|
||||||
# Permissions to write log files.
|
# Permissions to write log files.
|
||||||
allow smbd_t samba_log_t:file { create ra_file_perms };
|
allow smbd_t samba_log_t:file { create ra_file_perms };
|
||||||
allow smbd_t var_log_t:dir search;
|
allow smbd_t var_log_t:dir search;
|
||||||
allow smbd_t samba_log_t:dir ra_dir_perms;
|
allow smbd_t samba_log_t:dir ra_dir_perms;
|
||||||
|
dontaudit smbd_t samba_log_t:dir remove_name;
|
||||||
|
|
||||||
allow smbd_t usr_t:file { getattr read };
|
allow smbd_t usr_t:file { getattr read };
|
||||||
|
|
||||||
@ -88,7 +93,6 @@ can_exec(logrotate_t, samba_log_t)
|
|||||||
general_domain_access(nmbd_t)
|
general_domain_access(nmbd_t)
|
||||||
general_proc_read_access(nmbd_t)
|
general_proc_read_access(nmbd_t)
|
||||||
|
|
||||||
type nmbd_port_t, port_type, reserved_port_type;
|
|
||||||
allow nmbd_t nmbd_port_t:udp_socket name_bind;
|
allow nmbd_t nmbd_port_t:udp_socket name_bind;
|
||||||
|
|
||||||
# Use capabilities.
|
# Use capabilities.
|
||||||
@ -111,6 +115,7 @@ allow nmbd_t usr_t:file { getattr read };
|
|||||||
allow nmbd_t samba_log_t:file { create ra_file_perms };
|
allow nmbd_t samba_log_t:file { create ra_file_perms };
|
||||||
allow nmbd_t var_log_t:dir search;
|
allow nmbd_t var_log_t:dir search;
|
||||||
allow nmbd_t samba_log_t:dir ra_dir_perms;
|
allow nmbd_t samba_log_t:dir ra_dir_perms;
|
||||||
|
allow nmbd_t etc_t:file { getattr read };
|
||||||
ifdef(`cups.te', `
|
ifdef(`cups.te', `
|
||||||
allow smbd_t cupsd_rw_etc_t:file { getattr read };
|
allow smbd_t cupsd_rw_etc_t:file { getattr read };
|
||||||
')
|
')
|
||||||
@ -136,6 +141,7 @@ allow smbmount_t self:capability { net_bind_service sys_rawio sys_admin dac_over
|
|||||||
# Access samba config
|
# Access samba config
|
||||||
allow smbmount_t samba_etc_t:file r_file_perms;
|
allow smbmount_t samba_etc_t:file r_file_perms;
|
||||||
allow smbmount_t samba_etc_t:dir r_dir_perms;
|
allow smbmount_t samba_etc_t:dir r_dir_perms;
|
||||||
|
allow initrc_t samba_etc_t:file rw_file_perms;
|
||||||
|
|
||||||
# Write samba log
|
# Write samba log
|
||||||
allow smbmount_t samba_log_t:file create_file_perms;
|
allow smbmount_t samba_log_t:file create_file_perms;
|
||||||
@ -153,6 +159,7 @@ allow smbmount_t etc_t:file r_file_perms;
|
|||||||
|
|
||||||
# Networking
|
# Networking
|
||||||
can_network(smbmount_t)
|
can_network(smbmount_t)
|
||||||
|
allow smbmount_t port_type:tcp_socket name_connect;
|
||||||
can_ypbind(smbmount_t)
|
can_ypbind(smbmount_t)
|
||||||
allow smbmount_t self:unix_dgram_socket create_socket_perms;
|
allow smbmount_t self:unix_dgram_socket create_socket_perms;
|
||||||
allow smbmount_t self:unix_stream_socket create_socket_perms;
|
allow smbmount_t self:unix_stream_socket create_socket_perms;
|
||||||
@ -180,3 +187,28 @@ access_terminal(smbmount_t, sysadm)
|
|||||||
allow smbmount_t userdomain:fd use;
|
allow smbmount_t userdomain:fd use;
|
||||||
allow smbmount_t local_login_t:fd use;
|
allow smbmount_t local_login_t:fd use;
|
||||||
')
|
')
|
||||||
|
# Derive from app. domain. Transition from mount.
|
||||||
|
application_domain(samba_net, `, nscd_client_domain')
|
||||||
|
file_type_auto_trans(samba_net_t, samba_etc_t, samba_secrets_t, file)
|
||||||
|
read_locale(samba_net_t)
|
||||||
|
allow samba_net_t samba_etc_t:file r_file_perms;
|
||||||
|
r_dir_file(samba_net_t, samba_var_t)
|
||||||
|
can_network_udp(samba_net_t)
|
||||||
|
access_terminal(samba_net_t, sysadm)
|
||||||
|
allow samba_net_t self:unix_dgram_socket create_socket_perms;
|
||||||
|
allow samba_net_t self:unix_stream_socket create_stream_socket_perms;
|
||||||
|
rw_dir_create_file(samba_net_t, samba_var_t)
|
||||||
|
allow samba_net_t etc_t:file { getattr read };
|
||||||
|
can_network_client(samba_net_t)
|
||||||
|
allow samba_net_t smbd_port_t:tcp_socket name_connect;
|
||||||
|
can_ldap(samba_net_t)
|
||||||
|
can_kerberos(samba_net_t)
|
||||||
|
allow samba_net_t urandom_device_t:chr_file r_file_perms;
|
||||||
|
allow samba_net_t proc_t:dir search;
|
||||||
|
allow samba_net_t proc_t:lnk_file read;
|
||||||
|
allow samba_net_t self:dir search;
|
||||||
|
allow samba_net_t self:file read;
|
||||||
|
allow samba_net_t self:process signal;
|
||||||
|
tmp_domain(samba_net)
|
||||||
|
dontaudit samba_net_t sysadm_home_dir_t:dir search;
|
||||||
|
allow samba_net_t privfd:fd use;
|
||||||
|
@ -64,8 +64,6 @@ can_unix_connect(privlog,syslogd_t)
|
|||||||
allow privlog devlog_t:lnk_file read;
|
allow privlog devlog_t:lnk_file read;
|
||||||
|
|
||||||
ifdef(`crond.te', `
|
ifdef(`crond.te', `
|
||||||
# Write to the cron log.
|
|
||||||
allow syslogd_t crond_log_t:file rw_file_perms;
|
|
||||||
# for daemon re-start
|
# for daemon re-start
|
||||||
allow system_crond_t syslogd_t:lnk_file read;
|
allow system_crond_t syslogd_t:lnk_file read;
|
||||||
')
|
')
|
||||||
@ -79,16 +77,10 @@ allow syslogd_t initrc_var_run_t:file { read lock };
|
|||||||
dontaudit syslogd_t initrc_var_run_t:file write;
|
dontaudit syslogd_t initrc_var_run_t:file write;
|
||||||
allow syslogd_t ttyfile:chr_file { getattr write };
|
allow syslogd_t ttyfile:chr_file { getattr write };
|
||||||
|
|
||||||
ifdef(`klogd.te', `', `
|
|
||||||
# Allow access to /proc/kmsg for syslog-ng
|
|
||||||
allow syslogd_t proc_t:dir search;
|
|
||||||
allow syslogd_t proc_kmsg_t:file { getattr read };
|
|
||||||
allow syslogd_t kernel_t:system { syslog_mod syslog_console };
|
|
||||||
')
|
|
||||||
#
|
#
|
||||||
# Special case to handle crashes
|
# Special case to handle crashes
|
||||||
#
|
#
|
||||||
allow syslogd_t { device_t file_t }:sock_file unlink;
|
allow syslogd_t { device_t file_t }:sock_file { getattr unlink };
|
||||||
|
|
||||||
# Allow syslog to a terminal
|
# Allow syslog to a terminal
|
||||||
allow syslogd_t tty_device_t:chr_file { getattr write ioctl append };
|
allow syslogd_t tty_device_t:chr_file { getattr write ioctl append };
|
||||||
@ -100,6 +92,18 @@ allow syslogd_t syslogd_port_t:udp_socket name_bind;
|
|||||||
#
|
#
|
||||||
dontaudit syslogd_t file_t:dir search;
|
dontaudit syslogd_t file_t:dir search;
|
||||||
allow syslogd_t { tmpfs_t devpts_t }:dir search;
|
allow syslogd_t { tmpfs_t devpts_t }:dir search;
|
||||||
dontaudit syslogd_t unlabeled_t:file read;
|
dontaudit syslogd_t unlabeled_t:file { getattr read };
|
||||||
dontaudit syslogd_t { userpty_type devpts_t }:chr_file getattr;
|
dontaudit syslogd_t { userpty_type devpts_t }:chr_file getattr;
|
||||||
allow syslogd_t self:netlink_route_socket r_netlink_socket_perms;
|
allow syslogd_t self:netlink_route_socket r_netlink_socket_perms;
|
||||||
|
ifdef(`targeted_policy', `
|
||||||
|
allow syslogd_t var_run_t:fifo_file { ioctl read write };
|
||||||
|
')
|
||||||
|
|
||||||
|
# Allow access to /proc/kmsg for syslog-ng
|
||||||
|
allow syslogd_t proc_t:dir search;
|
||||||
|
allow syslogd_t proc_kmsg_t:file { getattr read };
|
||||||
|
allow syslogd_t kernel_t:system { syslog_mod syslog_console };
|
||||||
|
allow syslogd_t self:capability { sys_admin chown fsetid };
|
||||||
|
allow syslogd_t var_log_t:dir { create setattr };
|
||||||
|
allow syslogd_t syslogd_port_t:tcp_socket name_bind;
|
||||||
|
allow syslogd_t rsh_port_t:tcp_socket name_connect;
|
||||||
|
@ -31,6 +31,8 @@ read_locale(updfstab_t)
|
|||||||
ifdef(`dbusd.te', `
|
ifdef(`dbusd.te', `
|
||||||
dbusd_client(system, updfstab)
|
dbusd_client(system, updfstab)
|
||||||
allow updfstab_t system_dbusd_t:dbus { send_msg };
|
allow updfstab_t system_dbusd_t:dbus { send_msg };
|
||||||
|
allow initrc_t updfstab_t:dbus send_msg;
|
||||||
|
allow updfstab_t initrc_t:dbus send_msg;
|
||||||
')
|
')
|
||||||
|
|
||||||
# not sure what the sysctl_kernel_t file is, or why it wants to write it, so
|
# not sure what the sysctl_kernel_t file is, or why it wants to write it, so
|
||||||
@ -72,3 +74,8 @@ can_exec(updfstab_t, { sbin_t bin_t ls_exec_t } )
|
|||||||
dontaudit updfstab_t home_root_t:dir { getattr search };
|
dontaudit updfstab_t home_root_t:dir { getattr search };
|
||||||
dontaudit updfstab_t { home_dir_type home_type }:dir search;
|
dontaudit updfstab_t { home_dir_type home_type }:dir search;
|
||||||
allow updfstab_t fs_t:filesystem { getattr };
|
allow updfstab_t fs_t:filesystem { getattr };
|
||||||
|
allow updfstab_t tmpfs_t:dir getattr;
|
||||||
|
ifdef(`hald.te', `
|
||||||
|
can_unix_connect(updfstab_t, hald_t)
|
||||||
|
')
|
||||||
|
|
||||||
|
@ -98,3 +98,7 @@ allow groupadd_t self:capability { setuid sys_resource };
|
|||||||
allow groupadd_t self:process setrlimit;
|
allow groupadd_t self:process setrlimit;
|
||||||
allow groupadd_t initrc_var_run_t:file r_file_perms;
|
allow groupadd_t initrc_var_run_t:file r_file_perms;
|
||||||
dontaudit groupadd_t initrc_var_run_t:file write;
|
dontaudit groupadd_t initrc_var_run_t:file write;
|
||||||
|
|
||||||
|
allow useradd_t default_context_t:dir search;
|
||||||
|
allow useradd_t file_context_t:dir search;
|
||||||
|
allow useradd_t file_context_t:file { getattr read };
|
||||||
|
@ -38,10 +38,7 @@ allow utempter_t user_tmpfile:file { getattr write append };
|
|||||||
|
|
||||||
# Inherit and use descriptors from login.
|
# Inherit and use descriptors from login.
|
||||||
allow utempter_t privfd:fd use;
|
allow utempter_t privfd:fd use;
|
||||||
ifdef(`xdm.te', `
|
ifdef(`xdm.te', `can_pipe_xdm(utempter_t)')
|
||||||
allow utempter_t xdm_t:fd use;
|
|
||||||
allow utempter_t xdm_t:fifo_file { write getattr };
|
|
||||||
')
|
|
||||||
|
|
||||||
allow utempter_t self:unix_stream_socket create_stream_socket_perms;
|
allow utempter_t self:unix_stream_socket create_stream_socket_perms;
|
||||||
|
|
||||||
|
@ -1,6 +1,7 @@
|
|||||||
# samba scripts
|
# samba scripts
|
||||||
/usr/sbin/smbd -- system_u:object_r:smbd_exec_t
|
/usr/sbin/smbd -- system_u:object_r:smbd_exec_t
|
||||||
/usr/sbin/nmbd -- system_u:object_r:nmbd_exec_t
|
/usr/sbin/nmbd -- system_u:object_r:nmbd_exec_t
|
||||||
|
/usr/bin/net -- system_u:object_r:samba_net_exec_t
|
||||||
/etc/samba(/.*)? system_u:object_r:samba_etc_t
|
/etc/samba(/.*)? system_u:object_r:samba_etc_t
|
||||||
/var/log/samba(/.*)? system_u:object_r:samba_log_t
|
/var/log/samba(/.*)? system_u:object_r:samba_log_t
|
||||||
/var/cache/samba(/.*)? system_u:object_r:samba_var_t
|
/var/cache/samba(/.*)? system_u:object_r:samba_var_t
|
||||||
|
Loading…
Reference in New Issue
Block a user