trunk: add rpcbind from dan
This commit is contained in:
Chris PeBenito
parent
1900668638
commit
7b61fe506d
|
|
@ -32,6 +32,7 @@
|
|||
- Added modules:
|
||||
amtu (Dan Walsh)
|
||||
apcupsd (Dan Walsh)
|
||||
rpcbind (Dan Walsh)
|
||||
rwho (Nalin Dahyabhai)
|
||||
|
||||
* Tue Apr 17 2007 Chris PeBenito <selinux@tresys.com> - 20070417
|
||||
|
|
|
|||
|
|
@ -0,0 +1,7 @@
|
|||
/sbin/rpcbind -- gen_context(system_u:object_r:rpcbind_exec_t,s0)
|
||||
|
||||
/var/lib/rpcbind(/.*)? gen_context(system_u:object_r:rpcbind_var_lib_t,s0)
|
||||
|
||||
/var/run/rpc.statd.pid -- gen_context(system_u:object_r:rpcbind_var_run_t,s0)
|
||||
/var/run/rpcbind.lock -- gen_context(system_u:object_r:rpcbind_var_run_t,s0)
|
||||
/var/run/rpcbind.sock -s gen_context(system_u:object_r:rpcbind_var_run_t,s0)
|
||||
|
|
@ -0,0 +1,97 @@
|
|||
## <summary>Universal Addresses to RPC Program Number Mapper</summary>
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Execute a domain transition to run rpcbind.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed to transition.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`rpcbind_domtrans',`
|
||||
gen_require(`
|
||||
type rpcbind_t, rpcbind_exec_t;
|
||||
')
|
||||
|
||||
domtrans_pattern($1,rpcbind_exec_t,rpcbind_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Read rpcbind PID files.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`rpcbind_read_pid_files',`
|
||||
gen_require(`
|
||||
type rpcbind_var_run_t;
|
||||
')
|
||||
|
||||
files_search_pids($1)
|
||||
allow $1 rpcbind_var_run_t:file read_file_perms;
|
||||
')
|
||||
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Search rpcbind lib directories.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`rpcbind_search_lib',`
|
||||
gen_require(`
|
||||
type rpcbind_var_lib_t;
|
||||
')
|
||||
|
||||
allow $1 rpcbind_var_lib_t:dir search_dir_perms;
|
||||
files_search_var_lib($1)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Read rpcbind lib files.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`rpcbind_read_lib_files',`
|
||||
gen_require(`
|
||||
type rpcbind_var_lib_t;
|
||||
')
|
||||
|
||||
read_files_pattern($1,rpcbind_var_lib_t,rpcbind_var_lib_t)
|
||||
files_search_var_lib($1)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Create, read, write, and delete
|
||||
## rpcbind lib files.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`rpcbind_manage_lib_files',`
|
||||
gen_require(`
|
||||
type rpcbind_var_lib_t;
|
||||
')
|
||||
|
||||
manage_files_pattern($1,rpcbind_var_lib_t,rpcbind_var_lib_t)
|
||||
files_search_var_lib($1)
|
||||
')
|
||||
|
|
@ -0,0 +1,67 @@
|
|||
|
||||
policy_module(rpcbind,1.0.0)
|
||||
|
||||
########################################
|
||||
#
|
||||
# Declarations
|
||||
#
|
||||
|
||||
type rpcbind_t;
|
||||
type rpcbind_exec_t;
|
||||
init_daemon_domain(rpcbind_t, rpcbind_exec_t)
|
||||
|
||||
type rpcbind_var_run_t;
|
||||
files_pid_file(rpcbind_var_run_t)
|
||||
|
||||
type rpcbind_var_lib_t;
|
||||
files_type(rpcbind_var_lib_t)
|
||||
|
||||
########################################
|
||||
#
|
||||
# rpcbind local policy
|
||||
#
|
||||
|
||||
allow rpcbind_t self:capability setuid;
|
||||
allow rpcbind_t self:fifo_file rw_file_perms;
|
||||
allow rpcbind_t self:unix_stream_socket create_stream_socket_perms;
|
||||
allow rpcbind_t self:netlink_route_socket r_netlink_socket_perms;
|
||||
allow rpcbind_t self:udp_socket create_socket_perms;
|
||||
allow rpcbind_t self:tcp_socket create_stream_socket_perms;
|
||||
|
||||
manage_files_pattern(rpcbind_t,rpcbind_var_run_t,rpcbind_var_run_t)
|
||||
manage_sock_files_pattern(rpcbind_t,rpcbind_var_run_t,rpcbind_var_run_t)
|
||||
files_pid_filetrans(rpcbind_t,rpcbind_var_run_t, { file sock_file })
|
||||
|
||||
manage_dirs_pattern(rpcbind_t,rpcbind_var_lib_t,rpcbind_var_lib_t)
|
||||
manage_files_pattern(rpcbind_t,rpcbind_var_lib_t,rpcbind_var_lib_t)
|
||||
manage_sock_files_pattern(rpcbind_t,rpcbind_var_lib_t,rpcbind_var_lib_t)
|
||||
files_var_lib_filetrans(rpcbind_t,rpcbind_var_lib_t, { file dir sock_file })
|
||||
|
||||
kernel_read_network_state(rpcbind_t)
|
||||
|
||||
corenet_all_recvfrom_unlabeled(rpcbind_t)
|
||||
corenet_all_recvfrom_netlabel(rpcbind_t)
|
||||
corenet_tcp_sendrecv_all_if(rpcbind_t)
|
||||
corenet_udp_sendrecv_all_if(rpcbind_t)
|
||||
corenet_tcp_sendrecv_all_nodes(rpcbind_t)
|
||||
corenet_udp_sendrecv_all_nodes(rpcbind_t)
|
||||
corenet_tcp_sendrecv_all_ports(rpcbind_t)
|
||||
corenet_udp_sendrecv_all_ports(rpcbind_t)
|
||||
corenet_tcp_bind_all_nodes(rpcbind_t)
|
||||
corenet_udp_bind_all_nodes(rpcbind_t)
|
||||
corenet_tcp_bind_portmap_port(rpcbind_t)
|
||||
corenet_udp_bind_portmap_port(rpcbind_t)
|
||||
corenet_udp_bind_all_rpc_ports(rpcbind_t)
|
||||
|
||||
domain_use_interactive_fds(rpcbind_t)
|
||||
|
||||
files_read_etc_files(rpcbind_t)
|
||||
|
||||
libs_use_ld_so(rpcbind_t)
|
||||
libs_use_shared_libs(rpcbind_t)
|
||||
|
||||
logging_send_syslog_msg(rpcbind_t)
|
||||
|
||||
miscfiles_read_localization(rpcbind_t)
|
||||
|
||||
sysnet_dns_name_resolve(rpcbind_t)
|
||||
Loading…
Reference in New Issue