add calamaris, bug 1518

refpolicy/Changelog

@@ -12,6 +12,7 @@
 	amavis (Erich Schubert)
 	apt (Erich Schubert)
 	audioentropy
+	calamaris
 	clamav (Erich Schubert)
 	dpkg (Erich Schubert)
 	ethereal

refpolicy/policy/modules/apps/calamaris.fc

@@ -0,0 +1,10 @@
+#
+# /etc
+#
+/etc/cron\.daily/calamaris --	gen_context(system_u:object_r:calamaris_exec_t,s0)
+
+#
+# /var
+#
+/var/log/calamaris(/.*)?	gen_context(system_u:object_r:calamaris_log_t,s0)
+/var/www/calamaris(/.*)?	gen_context(system_u:object_r:calamaris_www_t,s0)

refpolicy/policy/modules/apps/calamaris.if

@@ -0,0 +1,21 @@
+## <summary>Squid log analysis</summary>
+
+#######################################
+## <summary>
+##	Allow domain to read calamaris www files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`calamaris_read_www_files',`
+	gen_require(`
+		type calamaris_www_t;
+	')
+
+	allow $1 calamaris_www_t:dir r_dir_perms;
+	allow $1 calamaris_www_t:file r_file_perms;
+	allow $1 calamaris_www_t:lnk_file { getattr read };
+')

refpolicy/policy/modules/apps/calamaris.te

@@ -0,0 +1,97 @@
+
+policy_module(calamaris,1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type calamaris_t;
+type calamaris_exec_t;
+init_system_domain(calamaris_t,calamaris_exec_t)
+
+type calamaris_www_t;
+files_type(calamaris_www_t)
+
+type calamaris_log_t;
+logging_log_file(calamaris_log_t)
+
+########################################
+#
+# Local policy
+#
+
+# for when squid has a different UID
+allow calamaris_t self:capability dac_override;
+allow calamaris_t self:process { fork signal_perms setsched };
+allow calamaris_t self:fifo_file { getattr read write ioctl };
+allow calamaris_t self:unix_stream_socket create_stream_socket_perms;
+allow calamaris_t self:tcp_socket create_stream_socket_perms;
+allow calamaris_t self:udp_socket create_socket_perms;
+
+allow calamaris_t calamaris_www_t:dir rw_dir_perms;
+allow calamaris_t calamaris_www_t:file manage_file_perms;
+allow calamaris_t calamaris_www_t:lnk_file create_lnk_perms;
+
+allow calamaris_t calamaris_log_t:file create_file_perms;
+allow calamaris_t calamaris_log_t:dir rw_dir_perms;
+logging_log_filetrans(calamaris_t,calamaris_log_t,{ file dir })
+
+kernel_read_all_sysctls(calamaris_t)
+kernel_read_system_state(calamaris_t)
+
+corecmd_exec_bin(calamaris_t)
+
+corenet_tcp_sendrecv_generic_if(calamaris_t)
+corenet_udp_sendrecv_generic_if(calamaris_t)
+corenet_raw_sendrecv_generic_if(calamaris_t)
+corenet_tcp_sendrecv_all_nodes(calamaris_t)
+corenet_udp_sendrecv_all_nodes(calamaris_t)
+corenet_raw_sendrecv_all_nodes(calamaris_t)
+corenet_tcp_sendrecv_all_ports(calamaris_t)
+corenet_udp_sendrecv_all_ports(calamaris_t)
+corenet_non_ipsec_sendrecv(calamaris_t)
+corenet_tcp_bind_all_nodes(calamaris_t)
+corenet_udp_bind_all_nodes(calamaris_t)
+
+dev_read_urand(calamaris_t)
+
+files_search_pids(calamaris_t)
+files_read_etc_files(calamaris_t)
+files_read_usr_files(calamaris_t)
+files_read_var_files(calamaris_t)
+files_read_etc_runtime_files(calamaris_t)
+
+libs_read_lib_files(calamaris_t)
+libs_use_ld_so(calamaris_t)
+libs_use_shared_libs(calamaris_t)
+
+logging_send_syslog_msg(calamaris_t)
+
+miscfiles_read_localization(calamaris_t)
+
+sysnet_read_config(calamaris_t)
+
+userdom_dontaudit_list_sysadm_home_dirs(calamaris_t)
+
+squid_read_log(calamaris_t)
+
+optional_policy(`apache', `
+	apache_search_sys_content(calamaris_t)
+')
+
+optional_policy(`bind', `
+	bind_udp_chat_named(calamaris_t)
+')
+
+optional_policy(`cron', `
+	cron_system_entry(calamaris_t,calamaris_exec_t)
+')
+
+optional_policy(`mta',`
+	mta_send_mail(calamaris_t)
+')
+
+optional_policy(`nis',`
+	nis_use_ypbind(calamaris_t)
+')

refpolicy/policy/modules/services/apache.if

@@ -785,7 +785,25 @@ interface(`apache_append_squirrelmail_data',`
 
 ########################################
 ## <summary>
-##	Read apache system content
+##	Search apache system content.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`apache_search_sys_content',`
+	gen_require(`
+		type httpd_sys_content_t;
+	')
+
+	allow $1 httpd_sys_content_t:dir search_dir_perms;
+')
+
+########################################
+## <summary>
+##	Read apache system content.
 ## </summary>
 ## <param name="domain">
 ##	<summary>

refpolicy/policy/modules/services/apache.te

@@ -1,5 +1,5 @@
 
-policy_module(apache,1.3.2)
+policy_module(apache,1.3.3)
 
 #
 # NOTES: 
@@ -396,6 +396,10 @@ tunable_policy(`httpd_tty_comm',`
 	userdom_dontaudit_use_sysadm_terms(httpd_t)
 ')
 
+optional_policy(`calamaris',`
+	calamaris_read_www_files(httpd_t)
+')
+
 optional_policy(`daemontools',`
 	daemontools_service_domain(httpd_t, httpd_exec_t)
 ')

refpolicy/policy/modules/services/bind.if

@@ -254,3 +254,21 @@ interface(`bind_read_zone',`
 	allow $1 named_zone_t:file r_file_perms;
 ')
 
+########################################
+## <summary>
+##	Send and receive datagrams to and from named.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`bind_udp_chat_named',`
+	gen_require(`
+		type named_t;
+	')
+	allow $1 named_t:udp_socket sendto;
+	allow named_t $1:udp_socket recvfrom;
+')
+

refpolicy/policy/modules/services/bind.te

@@ -1,5 +1,5 @@
 
-policy_module(bind,1.1.0)
+policy_module(bind,1.1.1)
 
 ########################################
 #