diff --git a/policy/modules/services/ppp.fc b/policy/modules/services/ppp.fc index ed6561f7..6ea513d7 100644 --- a/policy/modules/services/ppp.fc +++ b/policy/modules/services/ppp.fc @@ -25,7 +25,7 @@ # # /var # -/var/run/(i)?ppp.*pid -- gen_context(system_u:object_r:pppd_var_run_t,s0) +/var/run/(i)?ppp.*pid[^/]* -- gen_context(system_u:object_r:pppd_var_run_t,s0) /var/run/pppd[0-9]*\.tdb -- gen_context(system_u:object_r:pppd_var_run_t,s0) /var/run/ppp(/.*)? gen_context(system_u:object_r:pppd_var_run_t,s0) # Fix pptp sockets diff --git a/policy/modules/services/ppp.if b/policy/modules/services/ppp.if index 1eca6bd0..5db34a3b 100644 --- a/policy/modules/services/ppp.if +++ b/policy/modules/services/ppp.if @@ -269,3 +269,66 @@ interface(`ppp_pid_filetrans',` files_pid_filetrans($1,pppd_var_run_t,file) ') + +######################################## +## +## All of the rules required to administrate +## an ppp environment +## +## +## +## Domain allowed access. +## +## +## +## +## The role to be allowed to manage the ppp domain. +## +## +## +## +## The type of the user terminal. +## +## +## +# +interface(`ppp_admin',` + gen_require(` + type pppd_t, pppd_tmp_t, pppd_log_t, pppd_lock_t; + type pppd_etc_t, pppd_script_t, pppd_secret_t; + type pppd_etc_rw_t, pppd_var_lib_t, pppd_var_run_t; + + type pptp_t, pptp_log_t, pptp_var_run_t; + ') + + allow $1 pppd_t:process { ptrace signal_perms getattr }; + ps_process_pattern($1, pppd_t) + + files_list_tmp($1) + manage_files_pattern($1, pppd_tmp_t, pppd_tmp_t) + + logging_list_logs($1) + manage_files_pattern($1, pppd_log_t, pppd_log_t) + + manage_files_pattern($1, pppd_lock_t, pppd_lock_t) + + files_list_etc($1) + manage_files_pattern($1, pppd_etc_t, pppd_etc_t) + + manage_files_pattern($1, pppd_etc_rw_t, pppd_etc_rw_t) + + manage_files_pattern($1, pppd_secret_t, pppd_secret_t) + + files_list_var_lib($1) + manage_files_pattern($1, pppd_var_lib_t, pppd_var_lib_t) + + files_list_pids($1) + manage_files_pattern($1, pppd_var_run_t), pppd_var_run_t + + allow $1 pptp_t:process { ptrace signal_perms getattr }; + ps_process_pattern($1, pptp_t) + + manage_files_pattern($1, pptp_log_t, pptp_log_t) + + manage_files_pattern($1, pptp_var_run_t, pptp_var_run_t) +') diff --git a/policy/modules/services/ppp.te b/policy/modules/services/ppp.te index ba7a6c1c..15699e6a 100644 --- a/policy/modules/services/ppp.te +++ b/policy/modules/services/ppp.te @@ -1,5 +1,5 @@ -policy_module(ppp,1.6.0) +policy_module(ppp,1.6.1) ######################################## # @@ -162,6 +162,8 @@ files_read_etc_files(pppd_t) init_read_utmp(pppd_t) init_dontaudit_write_utmp(pppd_t) +auth_use_nsswitch(pppd_t) + libs_use_ld_so(pppd_t) libs_use_shared_libs(pppd_t) @@ -196,14 +198,6 @@ optional_policy(` mta_send_mail(pppd_t) ') -optional_policy(` - nis_use_ypbind(pppd_t) -') - -optional_policy(` - nscd_socket_use(pppd_t) -') - optional_policy(` postfix_domtrans_master(pppd_t) ') @@ -221,8 +215,9 @@ optional_policy(` # PPTP Local policy # -dontaudit pptp_t self:capability sys_tty_config; allow pptp_t self:capability net_raw; +dontaudit pptp_t self:capability sys_tty_config; +allow pptp_t self:process signal; allow pptp_t self:fifo_file { read write }; allow pptp_t self:unix_dgram_socket create_socket_perms; allow pptp_t self:unix_stream_socket { connectto create_stream_socket_perms }; diff --git a/policy/modules/services/privoxy.if b/policy/modules/services/privoxy.if index 26d15d7a..f1be3941 100644 --- a/policy/modules/services/privoxy.if +++ b/policy/modules/services/privoxy.if @@ -1 +1,42 @@ ## Privacy enhancing web proxy. + +######################################## +## +## All of the rules required to administrate +## an privoxy environment +## +## +## +## Domain allowed access. +## +## +## +## +## The role to be allowed to manage the privoxy domain. +## +## +## +## +## The type of the user terminal. +## +## +## +# +interface(`privoxy_admin',` + gen_require(` + type privoxy_t, privoxy_log_t; + type privoxy_etc_rw_t, privoxy_var_run_t; + ') + + allow $1 privoxy_t:process { ptrace signal_perms getattr }; + ps_process_pattern($1, privoxy_t) + + logging_list_logs($1) + manage_files_pattern($1, privoxy_log_t, privoxy_log_t) + + files_list_etc($1) + manage_files_pattern($1, privoxy_etc_rw_t, privoxy_etc_rw_t) + + files_list_pids($1) + manage_files_pattern($1, privoxy_var_run_t, privoxy_var_run_t) +') diff --git a/policy/modules/services/privoxy.te b/policy/modules/services/privoxy.te index b559c41b..a5b089e1 100644 --- a/policy/modules/services/privoxy.te +++ b/policy/modules/services/privoxy.te @@ -1,5 +1,5 @@ -policy_module(privoxy,1.5.0) +policy_module(privoxy,1.5.1) ######################################## # diff --git a/policy/modules/services/radius.if b/policy/modules/services/radius.if index 3d684f3c..0e8fab20 100644 --- a/policy/modules/services/radius.if +++ b/policy/modules/services/radius.if @@ -13,3 +13,49 @@ interface(`radius_use',` refpolicywarn(`$0($*) has been deprecated.') ') + +######################################## +## +## All of the rules required to administrate +## an radius environment +## +## +## +## Domain allowed access. +## +## +## +## +## The role to be allowed to manage the radius domain. +## +## +## +## +## The type of the user terminal. +## +## +## +# +interface(`radius_admin',` + gen_require(` + type radius_t, radius_etc_t, radius_log_t; + type radius_etc_rw_t, radius_var_lib_t, radius_var_run_t; + ') + + allow $1 radius_t:process { ptrace signal_perms getattr }; + ps_process_pattern($1, radius_t) + + files_list_etc($1) + manage_files_pattern($1, radius_etc_t, radius_etc_t) + + logging_list_logs($1) + manage_files_pattern($1, radius_log_t, radius_log_t) + + manage_files_pattern($1, radius_etc_rw_t, radius_etc_rw_t) + + files_list_var_lib($1) + manage_files_pattern($1, radius_var_lib_t, radius_var_lib_t) + + files_list_pids($1) + manage_files_pattern($1, radius_var_run_t, radius_var_run_t) +') diff --git a/policy/modules/services/radius.te b/policy/modules/services/radius.te index 4b136ff7..aefd4fc7 100644 --- a/policy/modules/services/radius.te +++ b/policy/modules/services/radius.te @@ -1,5 +1,5 @@ -policy_module(radius,1.6.0) +policy_module(radius,1.6.1) ######################################## # diff --git a/policy/modules/services/radvd.if b/policy/modules/services/radvd.if index 6fe38b7f..a24aefcf 100644 --- a/policy/modules/services/radvd.if +++ b/policy/modules/services/radvd.if @@ -1 +1,39 @@ ## IPv6 router advertisement daemon + +######################################## +## +## All of the rules required to administrate +## an radvd environment +## +## +## +## Domain allowed access. +## +## +## +## +## The role to be allowed to manage the radvd domain. +## +## +## +## +## The type of the user terminal. +## +## +## +# +interface(`radvd_admin',` + gen_require(` + type radvd_t, radvd_etc_t; + type radvd_var_run_t; + ') + + allow $1 radvd_t:process { ptrace signal_perms getattr }; + ps_process_pattern($1, radvd_t) + + files_list_etc($1) + manage_files_pattern($1, radvd_etc_t, radvd_etc_t) + + files_list_pids($1) + manage_files_pattern($1, radvd_var_run_t, radvd_var_run_t) +') diff --git a/policy/modules/services/radvd.te b/policy/modules/services/radvd.te index 09b7a5ca..06731699 100644 --- a/policy/modules/services/radvd.te +++ b/policy/modules/services/radvd.te @@ -1,5 +1,5 @@ -policy_module(radvd,1.6.0) +policy_module(radvd,1.6.1) ######################################## # diff --git a/policy/modules/services/remotelogin.if b/policy/modules/services/remotelogin.if index 3b86750e..3bfd4ec0 100644 --- a/policy/modules/services/remotelogin.if +++ b/policy/modules/services/remotelogin.if @@ -18,3 +18,20 @@ interface(`remotelogin_domtrans',` auth_domtrans_login_program($1,remote_login_t) ') +######################################## +## +## allow Domain to signal remote login domain. +## +## +## +## The type of the process performing this action. +## +## +# +interface(`remotelogin_signal',` + gen_require(` + type remote_login_t; + ') + + allow $1 remote_login_t:process signal; +') diff --git a/policy/modules/services/remotelogin.te b/policy/modules/services/remotelogin.te index 4bb6b1ca..72cdcd8d 100644 --- a/policy/modules/services/remotelogin.te +++ b/policy/modules/services/remotelogin.te @@ -1,5 +1,5 @@ -policy_module(remotelogin,1.4.0) +policy_module(remotelogin,1.4.1) ######################################## # diff --git a/policy/modules/services/rwho.if b/policy/modules/services/rwho.if index fa303f72..0f8dad65 100644 --- a/policy/modules/services/rwho.if +++ b/policy/modules/services/rwho.if @@ -115,3 +115,40 @@ interface(`rwho_manage_spool_files',` manage_files_pattern($1,rwho_spool_t,rwho_spool_t) files_search_spool($1) ') + +######################################## +## +## All of the rules required to administrate +## an rwho environment +## +## +## +## Domain allowed access. +## +## +## +## +## The role to be allowed to manage the rwho domain. +## +## +## +## +## The type of the user terminal. +## +## +## +# +interface(`rwho_admin',` + gen_require(` + type rwho_t, rwho_log_t, rwho_spool_t; + ') + + allow $1 rwho_t:process { ptrace signal_perms getattr }; + ps_process_pattern($1, rwho_t) + + logging_list_logs($1) + manage_files_pattern($1, rwho_log_t, rwho_log_t) + + files_list_spool($1) + manage_files_pattern($1, rwho_spool_t, rwho_spool_t) +') diff --git a/policy/modules/services/rwho.te b/policy/modules/services/rwho.te index 16418449..31e2d162 100644 --- a/policy/modules/services/rwho.te +++ b/policy/modules/services/rwho.te @@ -1,5 +1,5 @@ -policy_module(rwho,1.3.0) +policy_module(rwho,1.3.1) ######################################## # diff --git a/policy/modules/services/sasl.if b/policy/modules/services/sasl.if index 756f40a7..f5041aec 100644 --- a/policy/modules/services/sasl.if +++ b/policy/modules/services/sasl.if @@ -18,3 +18,42 @@ interface(`sasl_connect',` files_search_pids($1) stream_connect_pattern($1,saslauthd_var_run_t,saslauthd_var_run_t,saslauthd_t) ') + +######################################## +## +## All of the rules required to administrate +## an sasl environment +## +## +## +## Domain allowed access. +## +## +## +## +## The role to be allowed to manage the sasl domain. +## +## +## +## +## The type of the user terminal. +## +## +## +# +interface(`sasl_admin',` + gen_require(` + type sasl_t; + type sasl_tmp_t; + type sasl_var_run_t; + ') + + allow $1 sasl_t:process { ptrace signal_perms getattr }; + ps_process_pattern($1, sasl_t) + + files_list_tmp($1) + manage_files_pattern($1, sasl_tmp_t, sasl_tmp_t) + + files_list_pids($1) + manage_files_pattern($1, sasl_var_run_t, sasl_var_run_t) +') diff --git a/policy/modules/services/sasl.te b/policy/modules/services/sasl.te index c088ceda..6765102d 100644 --- a/policy/modules/services/sasl.te +++ b/policy/modules/services/sasl.te @@ -1,5 +1,5 @@ -policy_module(sasl,1.7.0) +policy_module(sasl,1.7.1) ######################################## # diff --git a/policy/modules/services/smartmon.if b/policy/modules/services/smartmon.if index c9766639..f52f7e7d 100644 --- a/policy/modules/services/smartmon.if +++ b/policy/modules/services/smartmon.if @@ -17,3 +17,40 @@ interface(`smartmon_read_tmp_files',` allow $1 fsdaemon_tmp_t:file { getattr ioctl read }; ') + +######################################## +## +## All of the rules required to administrate +## an smartmon environment +## +## +## +## Domain allowed access. +## +## +## +## +## The role to be allowed to manage the smartmon domain. +## +## +## +## +## The type of the user terminal. +## +## +## +# +interface(`smartmon_admin',` + gen_require(` + type smartmon_t, smartmon_tmp_t, smartmon_var_run_t; + ') + + allow $1 smartmon_t:process { ptrace signal_perms getattr }; + ps_process_pattern($1, smartmon_t) + + files_list_tmp($1) + manage_files_pattern($1, smartmon_tmp_t, smartmon_tmp_t) + + files_list_pids($1) + manage_files_pattern($1, smartmon_var_run_t, smartmon_var_run_t) +') diff --git a/policy/modules/services/smartmon.te b/policy/modules/services/smartmon.te index 6e7dcb0c..45410024 100644 --- a/policy/modules/services/smartmon.te +++ b/policy/modules/services/smartmon.te @@ -1,5 +1,5 @@ -policy_module(smartmon,1.4.0) +policy_module(smartmon,1.4.1) ######################################## # @@ -49,6 +49,7 @@ corenet_udp_sendrecv_all_nodes(fsdaemon_t) corenet_udp_sendrecv_all_ports(fsdaemon_t) dev_read_sysfs(fsdaemon_t) +dev_read_urand(fsdaemon_t) domain_use_interactive_fds(fsdaemon_t) diff --git a/policy/modules/services/snmp.if b/policy/modules/services/snmp.if index e311ba21..579ab1b5 100644 --- a/policy/modules/services/snmp.if +++ b/policy/modules/services/snmp.if @@ -84,3 +84,44 @@ interface(`snmp_dontaudit_write_snmp_var_lib_files',` dontaudit $1 snmpd_var_lib_t:file write; ') + +######################################## +## +## All of the rules required to administrate +## an snmp environment +## +## +## +## Domain allowed access. +## +## +## +## +## The role to be allowed to manage the snmp domain. +## +## +## +## +## The type of the user terminal. +## +## +## +# +interface(`snmp_admin',` + gen_require(` + type snmp_t, snmp_log_t; + type snmp_var_lib_t, snmp_var_run_t; + ') + + allow $1 snmp_t:process { ptrace signal_perms getattr }; + ps_process_pattern($1, snmp_t) + + logging_list_logs($1) + manage_files_pattern($1, snmp_log_t, snmp_log_t) + + files_list_var_lib($1) + manage_files_pattern($1, snmp_var_lib_t, snmp_var_lib_t) + + files_list_pids($1) + manage_files_pattern($1, snmp_var_run_t, snmp_var_run_t) +') diff --git a/policy/modules/services/snmp.te b/policy/modules/services/snmp.te index 27fcdd4f..14f3b616 100644 --- a/policy/modules/services/snmp.te +++ b/policy/modules/services/snmp.te @@ -1,5 +1,5 @@ -policy_module(snmp,1.6.0) +policy_module(snmp,1.6.1) ######################################## # diff --git a/policy/modules/services/tftp.fc b/policy/modules/services/tftp.fc index bb4a3be1..72274cd4 100644 --- a/policy/modules/services/tftp.fc +++ b/policy/modules/services/tftp.fc @@ -4,3 +4,5 @@ /tftpboot -d gen_context(system_u:object_r:tftpdir_t,s0) /tftpboot/.* gen_context(system_u:object_r:tftpdir_t,s0) + +/var/lib/tftpboot(/.*)? gen_context(system_u:object_r:tftpdir_t,s0) diff --git a/policy/modules/services/tftp.if b/policy/modules/services/tftp.if index ad413637..2adcb522 100644 --- a/policy/modules/services/tftp.if +++ b/policy/modules/services/tftp.if @@ -1 +1,40 @@ ## Trivial file transfer protocol daemon + +######################################## +## +## All of the rules required to administrate +## an tftp environment +## +## +## +## Domain allowed access. +## +## +## +## +## The role to be allowed to manage the tftp domain. +## +## +## +## +## The type of the user terminal. +## +## +## +# +interface(`tftp_admin',` + gen_require(` + type tftp_t, tftpdir_t; + type tftp_rw_t, tftp_var_run_t; + ') + + allow $1 tftp_t:process { ptrace signal_perms getattr }; + ps_process_pattern($1, tftp_t) + + manage_files_pattern($1, tftp_rw_t, tftp_rw_t) + + manage_files_pattern($1, tftpdir_t, tftpdir_t) + + files_list_pids($1) + manage_files_pattern($1, tftp_var_run_t, tftp_var_run_t) +') diff --git a/policy/modules/services/tftp.te b/policy/modules/services/tftp.te index 60fffa37..9c009ef8 100644 --- a/policy/modules/services/tftp.te +++ b/policy/modules/services/tftp.te @@ -1,5 +1,5 @@ -policy_module(tftp,1.6.0) +policy_module(tftp,1.6.1) ######################################## # diff --git a/policy/modules/services/tor.fc b/policy/modules/services/tor.fc index 3ae4b72c..8190cc61 100644 --- a/policy/modules/services/tor.fc +++ b/policy/modules/services/tor.fc @@ -1,5 +1,6 @@ /etc/tor(/.*)? gen_context(system_u:object_r:tor_etc_t,s0) +/usr/bin/tor -- gen_context(system_u:object_r:tor_exec_t,s0) /usr/sbin/tor -- gen_context(system_u:object_r:tor_exec_t,s0) /var/lib/tor(/.*)? gen_context(system_u:object_r:tor_var_lib_t,s0) diff --git a/policy/modules/services/tor.if b/policy/modules/services/tor.if index 5c9fd025..513fb4d5 100644 --- a/policy/modules/services/tor.if +++ b/policy/modules/services/tor.if @@ -17,3 +17,47 @@ interface(`tor_domtrans',` domtrans_pattern($1,tor_exec_t,tor_t) ') + +######################################## +## +## All of the rules required to administrate +## an tor environment +## +## +## +## Domain allowed access. +## +## +## +## +## The role to be allowed to manage the tor domain. +## +## +## +## +## The type of the user terminal. +## +## +## +# +interface(`tor_admin',` + gen_require(` + type tor_t, tor_log_t, tor_etc_t; + type tor_var_lib_t, tor_var_run_t; + ') + + allow $1 tor_t:process { ptrace signal_perms getattr }; + ps_process_pattern($1, tor_t) + + logging_list_logs($1) + manage_files_pattern($1, tor_log_t, tor_log_t) + + files_list_etc($1) + manage_files_pattern($1, tor_etc_t, tor_etc_t) + + files_list_var_lib($1) + manage_files_pattern($1, tor_var_lib_t, tor_var_lib_t) + + files_list_pids($1) + manage_files_pattern($1, tor_var_run_t, tor_var_run_t) +') diff --git a/policy/modules/services/tor.te b/policy/modules/services/tor.te index 009027b6..748b7643 100644 --- a/policy/modules/services/tor.te +++ b/policy/modules/services/tor.te @@ -1,5 +1,5 @@ -policy_module(tor,1.3.0) +policy_module(tor,1.3.1) ######################################## # diff --git a/policy/modules/services/uucp.if b/policy/modules/services/uucp.if index 57d483d2..699fc791 100644 --- a/policy/modules/services/uucp.if +++ b/policy/modules/services/uucp.if @@ -60,3 +60,52 @@ interface(`uucp_domtrans_uux',` domtrans_pattern($1,uux_exec_t,uux_t) ') + +######################################## +## +## All of the rules required to administrate +## an uucp environment +## +## +## +## Domain allowed access. +## +## +## +## +## The role to be allowed to manage the uucp domain. +## +## +## +## +## The type of the user terminal. +## +## +## +# +interface(`uucp_admin',` + gen_require(` + type uucp_t, uucp_tmp_t, uucp_log_t; + type uucp_spool_t, uucp_ro_t, uucp_rw_t; + type uucp_var_run_t; + ') + + allow $1 uucp_t:process { ptrace signal_perms getattr }; + ps_process_pattern($1, uucp_t) + + files_list_tmp($1) + manage_files_pattern($1, uucp_tmp_t, uucp_tmp_t) + + logging_list_logs($1) + manage_files_pattern($1, uucp_log_t, uucp_log_t) + + files_list_spool($1) + manage_files_pattern($1, uucp_spool_t, uucp_spool_t) + + manage_files_pattern($1, uucp_rw_t, uucp_rw_t) + + manage_files_pattern($1, uucp_ro_t, uucp_ro_t) + + files_list_pids($1) + manage_files_pattern($1, uucp_var_run_t, uucp_var_run_t) +') diff --git a/policy/modules/services/uucp.te b/policy/modules/services/uucp.te index 874f0cb6..8782562f 100644 --- a/policy/modules/services/uucp.te +++ b/policy/modules/services/uucp.te @@ -1,5 +1,5 @@ -policy_module(uucp,1.6.0) +policy_module(uucp,1.6.1) ######################################## #