trunk: nis patch from dan.

This commit is contained in:
Chris PeBenito 2009-06-25 15:16:29 +00:00
parent c017ee17ab
commit c989807d4a
3 changed files with 92 additions and 13 deletions

View File

@ -4,6 +4,7 @@
/sbin/ypbind -- gen_context(system_u:object_r:ypbind_exec_t,s0)
/usr/lib/yp/ypxfr -- gen_context(system_u:object_r:ypxfr_exec_t,s0)
/usr/lib64/yp/ypxfr -- gen_context(system_u:object_r:ypxfr_exec_t,s0)
/usr/sbin/rpc\.yppasswdd -- gen_context(system_u:object_r:yppasswdd_exec_t,s0)
/usr/sbin/rpc\.ypxfrd -- gen_context(system_u:object_r:ypxfr_exec_t,s0)

View File

@ -49,8 +49,8 @@ interface(`nis_use_ypbind_uncond',`
corenet_udp_bind_generic_node($1)
corenet_tcp_bind_generic_port($1)
corenet_udp_bind_generic_port($1)
corenet_tcp_bind_reserved_port($1)
corenet_udp_bind_reserved_port($1)
corenet_dontaudit_tcp_bind_all_reserved_ports($1)
corenet_dontaudit_udp_bind_all_reserved_ports($1)
corenet_dontaudit_tcp_bind_all_ports($1)
corenet_dontaudit_udp_bind_all_ports($1)
corenet_tcp_connect_portmap_port($1)
@ -76,15 +76,30 @@ interface(`nis_use_ypbind_uncond',`
## <rolecap/>
#
interface(`nis_use_ypbind',`
gen_require(`
type var_yp_t;
')
tunable_policy(`allow_ypbind',`
nis_use_ypbind_uncond($1)
')
')
########################################
## <summary>
## Use the nis to authenticate passwords
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
## <rolecap/>
#
interface(`nis_authenticate',`
tunable_policy(`allow_ypbind',`
nis_use_ypbind_uncond($1)
corenet_tcp_bind_all_rpc_ports($1)
corenet_udp_bind_all_rpc_ports($1)
')
')
########################################
## <summary>
## Execute ypbind in the ypbind domain.
@ -244,3 +259,55 @@ interface(`nis_domtrans_ypxfr',`
corecmd_search_bin($1)
domtrans_pattern($1, ypxfr_exec_t, ypxfr_t)
')
########################################
## <summary>
## All of the rules required to administrate
## an nis environment
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
## <param name="role">
## <summary>
## Role allowed access.
## </summary>
## </param>
## <rolecap/>
#
interface(`nis_admin',`
gen_require(`
type ypbind_t, yppasswdd_t, ypserv_t, ypxfr_t;
type ypbind_tmp_t, ypserv_tmp_t, ypserv_conf_t;
type ypbind_var_run_t, yppasswdd_var_run_t, ypserv_var_run_t;
')
allow $1 ypbind_t:process { ptrace signal_perms };
ps_process_pattern($1, ypbind_t)
allow $1 yppasswdd_t:process { ptrace signal_perms };
ps_process_pattern($1, yppasswdd_t)
allow $1 ypserv_t:process { ptrace signal_perms };
ps_process_pattern($1, ypserv_t)
allow $1 ypxfr_t:process { ptrace signal_perms };
ps_process_pattern($1, ypxfr_t)
files_list_tmp($1)
admin_pattern($1, ypbind_tmp_t)
files_list_pids($1)
admin_pattern($1, ypbind_var_run_t)
admin_pattern($1, yppasswdd_var_run_t)
files_list_etc($1)
admin_pattern($1, ypserv_conf_t)
admin_pattern($1, ypserv_tmp_t)
admin_pattern($1, ypserv_var_run_t)
')

View File

@ -1,5 +1,5 @@
policy_module(nis, 1.8.2)
policy_module(nis, 1.8.3)
########################################
#
@ -110,6 +110,16 @@ sysnet_read_config(ypbind_t)
userdom_dontaudit_use_unpriv_user_fds(ypbind_t)
userdom_dontaudit_search_user_home_dirs(ypbind_t)
optional_policy(`
dbus_system_bus_client(ypbind_t)
dbus_connect_system_bus(ypbind_t)
init_dbus_chat_script(ypbind_t)
optional_policy(`
networkmanager_dbus_chat(ypbind_t)
')
')
optional_policy(`
seutil_sigchld_newrole(ypbind_t)
')
@ -123,6 +133,7 @@ optional_policy(`
# yppasswdd local policy
#
allow yppasswdd_t self:capability dac_override;
dontaudit yppasswdd_t self:capability sys_tty_config;
allow yppasswdd_t self:fifo_file rw_fifo_file_perms;
allow yppasswdd_t self:process { setfscreate signal_perms };
@ -153,8 +164,8 @@ corenet_tcp_sendrecv_all_ports(yppasswdd_t)
corenet_udp_sendrecv_all_ports(yppasswdd_t)
corenet_tcp_bind_generic_node(yppasswdd_t)
corenet_udp_bind_generic_node(yppasswdd_t)
corenet_tcp_bind_reserved_port(yppasswdd_t)
corenet_udp_bind_reserved_port(yppasswdd_t)
corenet_tcp_bind_all_rpc_ports(yppasswdd_t)
corenet_udp_bind_all_rpc_ports(yppasswdd_t)
corenet_dontaudit_tcp_bind_all_reserved_ports(yppasswdd_t)
corenet_dontaudit_udp_bind_all_reserved_ports(yppasswdd_t)
corenet_sendrecv_generic_server_packets(yppasswdd_t)
@ -239,8 +250,8 @@ corenet_tcp_sendrecv_all_ports(ypserv_t)
corenet_udp_sendrecv_all_ports(ypserv_t)
corenet_tcp_bind_generic_node(ypserv_t)
corenet_udp_bind_generic_node(ypserv_t)
corenet_tcp_bind_reserved_port(ypserv_t)
corenet_udp_bind_reserved_port(ypserv_t)
corenet_tcp_bind_all_rpc_ports(ypserv_t)
corenet_udp_bind_all_rpc_ports(ypserv_t)
corenet_dontaudit_tcp_bind_all_reserved_ports(ypserv_t)
corenet_dontaudit_udp_bind_all_reserved_ports(ypserv_t)
corenet_sendrecv_generic_server_packets(ypserv_t)
@ -304,8 +315,8 @@ corenet_tcp_sendrecv_all_ports(ypxfr_t)
corenet_udp_sendrecv_all_ports(ypxfr_t)
corenet_tcp_bind_generic_node(ypxfr_t)
corenet_udp_bind_generic_node(ypxfr_t)
corenet_tcp_bind_reserved_port(ypxfr_t)
corenet_udp_bind_reserved_port(ypxfr_t)
corenet_tcp_bind_all_rpc_ports(ypxfr_t)
corenet_udp_bind_all_rpc_ports(ypxfr_t)
corenet_dontaudit_tcp_bind_all_reserved_ports(ypxfr_t)
corenet_dontaudit_udp_bind_all_reserved_ports(ypxfr_t)
corenet_tcp_connect_all_ports(ypxfr_t)