trunk: add rpcbind from dan
This commit is contained in:
parent
1900668638
commit
7b61fe506d
@ -32,6 +32,7 @@
|
|||||||
- Added modules:
|
- Added modules:
|
||||||
amtu (Dan Walsh)
|
amtu (Dan Walsh)
|
||||||
apcupsd (Dan Walsh)
|
apcupsd (Dan Walsh)
|
||||||
|
rpcbind (Dan Walsh)
|
||||||
rwho (Nalin Dahyabhai)
|
rwho (Nalin Dahyabhai)
|
||||||
|
|
||||||
* Tue Apr 17 2007 Chris PeBenito <selinux@tresys.com> - 20070417
|
* Tue Apr 17 2007 Chris PeBenito <selinux@tresys.com> - 20070417
|
||||||
|
7
policy/modules/services/rpcbind.fc
Normal file
7
policy/modules/services/rpcbind.fc
Normal file
@ -0,0 +1,7 @@
|
|||||||
|
/sbin/rpcbind -- gen_context(system_u:object_r:rpcbind_exec_t,s0)
|
||||||
|
|
||||||
|
/var/lib/rpcbind(/.*)? gen_context(system_u:object_r:rpcbind_var_lib_t,s0)
|
||||||
|
|
||||||
|
/var/run/rpc.statd.pid -- gen_context(system_u:object_r:rpcbind_var_run_t,s0)
|
||||||
|
/var/run/rpcbind.lock -- gen_context(system_u:object_r:rpcbind_var_run_t,s0)
|
||||||
|
/var/run/rpcbind.sock -s gen_context(system_u:object_r:rpcbind_var_run_t,s0)
|
97
policy/modules/services/rpcbind.if
Normal file
97
policy/modules/services/rpcbind.if
Normal file
@ -0,0 +1,97 @@
|
|||||||
|
## <summary>Universal Addresses to RPC Program Number Mapper</summary>
|
||||||
|
|
||||||
|
########################################
|
||||||
|
## <summary>
|
||||||
|
## Execute a domain transition to run rpcbind.
|
||||||
|
## </summary>
|
||||||
|
## <param name="domain">
|
||||||
|
## <summary>
|
||||||
|
## Domain allowed to transition.
|
||||||
|
## </summary>
|
||||||
|
## </param>
|
||||||
|
#
|
||||||
|
interface(`rpcbind_domtrans',`
|
||||||
|
gen_require(`
|
||||||
|
type rpcbind_t, rpcbind_exec_t;
|
||||||
|
')
|
||||||
|
|
||||||
|
domtrans_pattern($1,rpcbind_exec_t,rpcbind_t)
|
||||||
|
')
|
||||||
|
|
||||||
|
########################################
|
||||||
|
## <summary>
|
||||||
|
## Read rpcbind PID files.
|
||||||
|
## </summary>
|
||||||
|
## <param name="domain">
|
||||||
|
## <summary>
|
||||||
|
## Domain allowed access.
|
||||||
|
## </summary>
|
||||||
|
## </param>
|
||||||
|
#
|
||||||
|
interface(`rpcbind_read_pid_files',`
|
||||||
|
gen_require(`
|
||||||
|
type rpcbind_var_run_t;
|
||||||
|
')
|
||||||
|
|
||||||
|
files_search_pids($1)
|
||||||
|
allow $1 rpcbind_var_run_t:file read_file_perms;
|
||||||
|
')
|
||||||
|
|
||||||
|
|
||||||
|
########################################
|
||||||
|
## <summary>
|
||||||
|
## Search rpcbind lib directories.
|
||||||
|
## </summary>
|
||||||
|
## <param name="domain">
|
||||||
|
## <summary>
|
||||||
|
## Domain allowed access.
|
||||||
|
## </summary>
|
||||||
|
## </param>
|
||||||
|
#
|
||||||
|
interface(`rpcbind_search_lib',`
|
||||||
|
gen_require(`
|
||||||
|
type rpcbind_var_lib_t;
|
||||||
|
')
|
||||||
|
|
||||||
|
allow $1 rpcbind_var_lib_t:dir search_dir_perms;
|
||||||
|
files_search_var_lib($1)
|
||||||
|
')
|
||||||
|
|
||||||
|
########################################
|
||||||
|
## <summary>
|
||||||
|
## Read rpcbind lib files.
|
||||||
|
## </summary>
|
||||||
|
## <param name="domain">
|
||||||
|
## <summary>
|
||||||
|
## Domain allowed access.
|
||||||
|
## </summary>
|
||||||
|
## </param>
|
||||||
|
#
|
||||||
|
interface(`rpcbind_read_lib_files',`
|
||||||
|
gen_require(`
|
||||||
|
type rpcbind_var_lib_t;
|
||||||
|
')
|
||||||
|
|
||||||
|
read_files_pattern($1,rpcbind_var_lib_t,rpcbind_var_lib_t)
|
||||||
|
files_search_var_lib($1)
|
||||||
|
')
|
||||||
|
|
||||||
|
########################################
|
||||||
|
## <summary>
|
||||||
|
## Create, read, write, and delete
|
||||||
|
## rpcbind lib files.
|
||||||
|
## </summary>
|
||||||
|
## <param name="domain">
|
||||||
|
## <summary>
|
||||||
|
## Domain allowed access.
|
||||||
|
## </summary>
|
||||||
|
## </param>
|
||||||
|
#
|
||||||
|
interface(`rpcbind_manage_lib_files',`
|
||||||
|
gen_require(`
|
||||||
|
type rpcbind_var_lib_t;
|
||||||
|
')
|
||||||
|
|
||||||
|
manage_files_pattern($1,rpcbind_var_lib_t,rpcbind_var_lib_t)
|
||||||
|
files_search_var_lib($1)
|
||||||
|
')
|
67
policy/modules/services/rpcbind.te
Normal file
67
policy/modules/services/rpcbind.te
Normal file
@ -0,0 +1,67 @@
|
|||||||
|
|
||||||
|
policy_module(rpcbind,1.0.0)
|
||||||
|
|
||||||
|
########################################
|
||||||
|
#
|
||||||
|
# Declarations
|
||||||
|
#
|
||||||
|
|
||||||
|
type rpcbind_t;
|
||||||
|
type rpcbind_exec_t;
|
||||||
|
init_daemon_domain(rpcbind_t, rpcbind_exec_t)
|
||||||
|
|
||||||
|
type rpcbind_var_run_t;
|
||||||
|
files_pid_file(rpcbind_var_run_t)
|
||||||
|
|
||||||
|
type rpcbind_var_lib_t;
|
||||||
|
files_type(rpcbind_var_lib_t)
|
||||||
|
|
||||||
|
########################################
|
||||||
|
#
|
||||||
|
# rpcbind local policy
|
||||||
|
#
|
||||||
|
|
||||||
|
allow rpcbind_t self:capability setuid;
|
||||||
|
allow rpcbind_t self:fifo_file rw_file_perms;
|
||||||
|
allow rpcbind_t self:unix_stream_socket create_stream_socket_perms;
|
||||||
|
allow rpcbind_t self:netlink_route_socket r_netlink_socket_perms;
|
||||||
|
allow rpcbind_t self:udp_socket create_socket_perms;
|
||||||
|
allow rpcbind_t self:tcp_socket create_stream_socket_perms;
|
||||||
|
|
||||||
|
manage_files_pattern(rpcbind_t,rpcbind_var_run_t,rpcbind_var_run_t)
|
||||||
|
manage_sock_files_pattern(rpcbind_t,rpcbind_var_run_t,rpcbind_var_run_t)
|
||||||
|
files_pid_filetrans(rpcbind_t,rpcbind_var_run_t, { file sock_file })
|
||||||
|
|
||||||
|
manage_dirs_pattern(rpcbind_t,rpcbind_var_lib_t,rpcbind_var_lib_t)
|
||||||
|
manage_files_pattern(rpcbind_t,rpcbind_var_lib_t,rpcbind_var_lib_t)
|
||||||
|
manage_sock_files_pattern(rpcbind_t,rpcbind_var_lib_t,rpcbind_var_lib_t)
|
||||||
|
files_var_lib_filetrans(rpcbind_t,rpcbind_var_lib_t, { file dir sock_file })
|
||||||
|
|
||||||
|
kernel_read_network_state(rpcbind_t)
|
||||||
|
|
||||||
|
corenet_all_recvfrom_unlabeled(rpcbind_t)
|
||||||
|
corenet_all_recvfrom_netlabel(rpcbind_t)
|
||||||
|
corenet_tcp_sendrecv_all_if(rpcbind_t)
|
||||||
|
corenet_udp_sendrecv_all_if(rpcbind_t)
|
||||||
|
corenet_tcp_sendrecv_all_nodes(rpcbind_t)
|
||||||
|
corenet_udp_sendrecv_all_nodes(rpcbind_t)
|
||||||
|
corenet_tcp_sendrecv_all_ports(rpcbind_t)
|
||||||
|
corenet_udp_sendrecv_all_ports(rpcbind_t)
|
||||||
|
corenet_tcp_bind_all_nodes(rpcbind_t)
|
||||||
|
corenet_udp_bind_all_nodes(rpcbind_t)
|
||||||
|
corenet_tcp_bind_portmap_port(rpcbind_t)
|
||||||
|
corenet_udp_bind_portmap_port(rpcbind_t)
|
||||||
|
corenet_udp_bind_all_rpc_ports(rpcbind_t)
|
||||||
|
|
||||||
|
domain_use_interactive_fds(rpcbind_t)
|
||||||
|
|
||||||
|
files_read_etc_files(rpcbind_t)
|
||||||
|
|
||||||
|
libs_use_ld_so(rpcbind_t)
|
||||||
|
libs_use_shared_libs(rpcbind_t)
|
||||||
|
|
||||||
|
logging_send_syslog_msg(rpcbind_t)
|
||||||
|
|
||||||
|
miscfiles_read_localization(rpcbind_t)
|
||||||
|
|
||||||
|
sysnet_dns_name_resolve(rpcbind_t)
|
Loading…
Reference in New Issue
Block a user