- Add Zarafa policy
This commit is contained in:
Daniel J Walsh
parent
244b4526c6
commit
cbf5825080
350
policy-F14.patch
350
policy-F14.patch
@ -6893,7 +6893,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco
|
||||
#
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.te.in serefpolicy-3.8.3/policy/modules/kernel/corenetwork.te.in
|
||||
--- nsaserefpolicy/policy/modules/kernel/corenetwork.te.in 2010-05-25 16:28:22.000000000 -0400
|
||||
+++ serefpolicy-3.8.3/policy/modules/kernel/corenetwork.te.in 2010-06-11 11:15:13.000000000 -0400
|
||||
+++ serefpolicy-3.8.3/policy/modules/kernel/corenetwork.te.in 2010-06-16 15:29:05.000000000 -0400
|
||||
@@ -25,6 +25,7 @@
|
||||
#
|
||||
type tun_tap_device_t;
|
||||
@ -7011,7 +7011,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corene
|
||||
network_port(syslogd, udp,514,s0)
|
||||
network_port(telnetd, tcp,23,s0)
|
||||
network_port(tftp, udp,69,s0)
|
||||
@@ -205,13 +226,13 @@
|
||||
@@ -205,13 +226,14 @@
|
||||
network_port(varnishd, tcp,6081,s0, tcp,6082,s0)
|
||||
network_port(virt, tcp,16509,s0, udp,16509,s0, tcp,16514,s0, udp,16514,s0)
|
||||
network_port(virt_migration, tcp,49152-49216,s0)
|
||||
@ -7024,6 +7024,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corene
|
||||
network_port(xfs, tcp,7100,s0)
|
||||
-network_port(xserver, tcp,6000-6020,s0)
|
||||
+network_port(xserver, tcp,6000-6150,s0)
|
||||
+network_port(zarafa, tcp,236,s0)
|
||||
network_port(zebra, tcp,2600-2604,s0, tcp,2606,s0, udp,2600-2604,s0, udp,2606,s0)
|
||||
network_port(zope, tcp,8021,s0)
|
||||
|
||||
@ -10900,7 +10901,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/abrt
|
||||
+/var/spool/abrt(/.*)? gen_context(system_u:object_r:abrt_var_cache_t,s0)
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/abrt.if serefpolicy-3.8.3/policy/modules/services/abrt.if
|
||||
--- nsaserefpolicy/policy/modules/services/abrt.if 2010-05-25 16:28:22.000000000 -0400
|
||||
+++ serefpolicy-3.8.3/policy/modules/services/abrt.if 2010-06-08 11:32:10.000000000 -0400
|
||||
+++ serefpolicy-3.8.3/policy/modules/services/abrt.if 2010-06-16 15:22:44.000000000 -0400
|
||||
@@ -111,6 +111,10 @@
|
||||
')
|
||||
|
||||
@ -11340,7 +11341,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aicc
|
||||
+
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aisexec.te serefpolicy-3.8.3/policy/modules/services/aisexec.te
|
||||
--- nsaserefpolicy/policy/modules/services/aisexec.te 2010-05-25 16:28:22.000000000 -0400
|
||||
+++ serefpolicy-3.8.3/policy/modules/services/aisexec.te 2010-06-08 11:32:10.000000000 -0400
|
||||
+++ serefpolicy-3.8.3/policy/modules/services/aisexec.te 2010-06-16 15:40:47.000000000 -0400
|
||||
@@ -98,3 +98,6 @@
|
||||
rhcs_rw_groupd_semaphores(aisexec_t)
|
||||
rhcs_rw_groupd_shm(aisexec_t)
|
||||
@ -11796,7 +11797,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
|
||||
')
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-3.8.3/policy/modules/services/apache.te
|
||||
--- nsaserefpolicy/policy/modules/services/apache.te 2010-05-25 16:28:22.000000000 -0400
|
||||
+++ serefpolicy-3.8.3/policy/modules/services/apache.te 2010-06-08 11:32:10.000000000 -0400
|
||||
+++ serefpolicy-3.8.3/policy/modules/services/apache.te 2010-06-16 16:04:24.000000000 -0400
|
||||
@@ -19,6 +19,8 @@
|
||||
# Declarations
|
||||
#
|
||||
@ -12152,7 +12153,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
|
||||
snmp_dontaudit_read_snmp_var_lib_files(httpd_t)
|
||||
snmp_dontaudit_write_snmp_var_lib_files(httpd_t)
|
||||
')
|
||||
@@ -619,6 +745,10 @@
|
||||
@@ -604,6 +730,10 @@
|
||||
yam_read_content(httpd_t)
|
||||
')
|
||||
|
||||
+optional_policy(`
|
||||
+ zarafa_stream_connect_server(httpd_t)
|
||||
+')
|
||||
+
|
||||
########################################
|
||||
#
|
||||
# Apache helper local policy
|
||||
@@ -619,6 +749,10 @@
|
||||
|
||||
userdom_use_user_terminals(httpd_helper_t)
|
||||
|
||||
@ -12163,7 +12175,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
|
||||
########################################
|
||||
#
|
||||
# Apache PHP script local policy
|
||||
@@ -700,17 +830,18 @@
|
||||
@@ -700,17 +834,18 @@
|
||||
manage_files_pattern(httpd_suexec_t, httpd_suexec_tmp_t, httpd_suexec_tmp_t)
|
||||
files_tmp_filetrans(httpd_suexec_t, httpd_suexec_tmp_t, { file dir })
|
||||
|
||||
@ -12185,7 +12197,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
|
||||
|
||||
files_read_etc_files(httpd_suexec_t)
|
||||
files_read_usr_files(httpd_suexec_t)
|
||||
@@ -741,10 +872,21 @@
|
||||
@@ -741,10 +876,21 @@
|
||||
corenet_sendrecv_all_client_packets(httpd_suexec_t)
|
||||
')
|
||||
|
||||
@ -12208,7 +12220,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
|
||||
')
|
||||
|
||||
tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',`
|
||||
@@ -770,6 +912,12 @@
|
||||
@@ -770,6 +916,12 @@
|
||||
dontaudit httpd_suexec_t httpd_t:unix_stream_socket { read write };
|
||||
')
|
||||
|
||||
@ -12221,7 +12233,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
|
||||
########################################
|
||||
#
|
||||
# Apache system script local policy
|
||||
@@ -793,9 +941,13 @@
|
||||
@@ -793,9 +945,13 @@
|
||||
files_search_var_lib(httpd_sys_script_t)
|
||||
files_search_spool(httpd_sys_script_t)
|
||||
|
||||
@ -12235,7 +12247,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
|
||||
ifdef(`distro_redhat',`
|
||||
allow httpd_sys_script_t httpd_log_t:file append_file_perms;
|
||||
')
|
||||
@@ -804,6 +956,22 @@
|
||||
@@ -804,6 +960,22 @@
|
||||
mta_send_mail(httpd_sys_script_t)
|
||||
')
|
||||
|
||||
@ -12258,7 +12270,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
|
||||
tunable_policy(`httpd_enable_cgi && httpd_can_network_connect',`
|
||||
allow httpd_sys_script_t self:tcp_socket create_stream_socket_perms;
|
||||
allow httpd_sys_script_t self:udp_socket create_socket_perms;
|
||||
@@ -831,6 +999,16 @@
|
||||
@@ -831,6 +1003,16 @@
|
||||
fs_read_nfs_symlinks(httpd_sys_script_t)
|
||||
')
|
||||
|
||||
@ -12275,7 +12287,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
|
||||
tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',`
|
||||
fs_read_cifs_files(httpd_sys_script_t)
|
||||
fs_read_cifs_symlinks(httpd_sys_script_t)
|
||||
@@ -843,6 +1021,7 @@
|
||||
@@ -843,6 +1025,7 @@
|
||||
optional_policy(`
|
||||
mysql_stream_connect(httpd_sys_script_t)
|
||||
mysql_rw_db_sockets(httpd_sys_script_t)
|
||||
@ -12283,7 +12295,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@@ -892,11 +1071,33 @@
|
||||
@@ -892,11 +1075,33 @@
|
||||
|
||||
tunable_policy(`httpd_enable_cgi && httpd_unified',`
|
||||
allow httpd_user_script_t httpdcontent:file entrypoint;
|
||||
@ -18758,7 +18770,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
|
||||
+
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.te serefpolicy-3.8.3/policy/modules/services/postfix.te
|
||||
--- nsaserefpolicy/policy/modules/services/postfix.te 2010-05-25 16:28:22.000000000 -0400
|
||||
+++ serefpolicy-3.8.3/policy/modules/services/postfix.te 2010-06-14 19:02:47.000000000 -0400
|
||||
+++ serefpolicy-3.8.3/policy/modules/services/postfix.te 2010-06-16 16:05:01.000000000 -0400
|
||||
@@ -6,6 +6,15 @@
|
||||
# Declarations
|
||||
#
|
||||
@ -18854,7 +18866,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
|
||||
|
||||
term_dontaudit_search_ptys(postfix_master_t)
|
||||
|
||||
@@ -305,6 +332,10 @@
|
||||
@@ -305,9 +332,17 @@
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@ -18865,7 +18877,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
|
||||
procmail_domtrans(postfix_local_t)
|
||||
')
|
||||
|
||||
@@ -421,6 +452,7 @@
|
||||
+optional_policy(`
|
||||
+ zarafa_deliver_domtrans(postfix_local_t)
|
||||
+')
|
||||
+
|
||||
########################################
|
||||
#
|
||||
# Postfix map local policy
|
||||
@@ -421,6 +456,7 @@
|
||||
|
||||
optional_policy(`
|
||||
spamassassin_domtrans_client(postfix_pipe_t)
|
||||
@ -18873,7 +18892,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@@ -589,6 +621,11 @@
|
||||
@@ -589,6 +625,11 @@
|
||||
|
||||
# for OpenSSL certificates
|
||||
files_read_usr_files(postfix_smtpd_t)
|
||||
@ -18885,7 +18904,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
|
||||
mta_read_aliases(postfix_smtpd_t)
|
||||
|
||||
optional_policy(`
|
||||
@@ -631,3 +668,8 @@
|
||||
@@ -631,3 +672,8 @@
|
||||
# For reading spamassasin
|
||||
mta_read_config(postfix_virtual_t)
|
||||
mta_manage_spool(postfix_virtual_t)
|
||||
@ -23914,6 +23933,299 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
||||
+tunable_policy(`use_samba_home_dirs',`
|
||||
+ fs_append_cifs_files(xdmhomewriter)
|
||||
+')
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/zabbix.te serefpolicy-3.8.3/policy/modules/services/zabbix.te
|
||||
--- nsaserefpolicy/policy/modules/services/zabbix.te 2009-07-14 14:19:57.000000000 -0400
|
||||
+++ serefpolicy-3.8.3/policy/modules/services/zabbix.te 2010-06-16 15:16:12.000000000 -0400
|
||||
@@ -13,11 +13,9 @@
|
||||
type zabbix_initrc_exec_t;
|
||||
init_script_file(zabbix_initrc_exec_t)
|
||||
|
||||
-# log files
|
||||
type zabbix_log_t;
|
||||
logging_log_file(zabbix_log_t)
|
||||
|
||||
-# pid files
|
||||
type zabbix_var_run_t;
|
||||
files_pid_file(zabbix_var_run_t)
|
||||
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/zarafa.fc serefpolicy-3.8.3/policy/modules/services/zarafa.fc
|
||||
--- nsaserefpolicy/policy/modules/services/zarafa.fc 1969-12-31 19:00:00.000000000 -0500
|
||||
+++ serefpolicy-3.8.3/policy/modules/services/zarafa.fc 2010-06-16 16:03:02.000000000 -0400
|
||||
@@ -0,0 +1,27 @@
|
||||
+
|
||||
+/etc/zarafa(/.*)? gen_context(system_u:object_r:zarafa_etc_t,s0)
|
||||
+
|
||||
+/usr/bin/zarafa-dagent -- gen_context(system_u:object_r:zarafa_deliver_exec_t,s0)
|
||||
+
|
||||
+/usr/bin/zarafa-server -- gen_context(system_u:object_r:zarafa_server_exec_t,s0)
|
||||
+
|
||||
+/usr/bin/zarafa-gateway -- gen_context(system_u:object_r:zarafa_gateway_exec_t,s0)
|
||||
+
|
||||
+/usr/bin/zarafa-spooler -- gen_context(system_u:object_r:zarafa_spooler_exec_t,s0)
|
||||
+
|
||||
+/usr/bin/zarafa-ical -- gen_context(system_u:object_r:zarafa_ical_exec_t,s0)
|
||||
+
|
||||
+/usr/bin/zarafa-monitor -- gen_context(system_u:object_r:zarafa_monitor_exec_t,s0)
|
||||
+
|
||||
+/var/log/zarafa/server\.log -- gen_context(system_u:object_r:zarafa_server_log_t,s0)
|
||||
+/var/log/zarafa/spooler\.log -- gen_context(system_u:object_r:zarafa_spooler_log_t,s0)
|
||||
+/var/log/zarafa/gateway\.log -- gen_context(system_u:object_r:zarafa_gateway_log_t,s0)
|
||||
+/var/log/zarafa/ical\.log -- gen_context(system_u:object_r:zarafa_ical_log_t,s0)
|
||||
+/var/log/zarafa/monitor\.log -- gen_context(system_u:object_r:zarafa_monitor_log_t,s0)
|
||||
+
|
||||
+/var/run/zarafa -s gen_context(system_u:object_r:zarafa_server_var_run_t,s0)
|
||||
+/var/run/zarafa-gateway\.pid -- gen_context(system_u:object_r:zarafa_gateway_var_run_t,s0)
|
||||
+/var/run/zarafa-server\.pid -- gen_context(system_u:object_r:zarafa_server_var_run_t,s0)
|
||||
+/var/run/zarafa-spooler\.pid -- gen_context(system_u:object_r:zarafa_spooler_var_run_t,s0)
|
||||
+/var/run/zarafa-ical\.pid -- gen_context(system_u:object_r:zarafa_ical_var_run_t,s0)
|
||||
+/var/run/zarafa-monitor\.pid -- gen_context(system_u:object_r:zarafa_monitor_var_run_t,s0)
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/zarafa.if serefpolicy-3.8.3/policy/modules/services/zarafa.if
|
||||
--- nsaserefpolicy/policy/modules/services/zarafa.if 1969-12-31 19:00:00.000000000 -0500
|
||||
+++ serefpolicy-3.8.3/policy/modules/services/zarafa.if 2010-06-16 16:09:56.000000000 -0400
|
||||
@@ -0,0 +1,105 @@
|
||||
+
|
||||
+## <summary>policy for zarafa services</summary>
|
||||
+
|
||||
+######################################
|
||||
+## <summary>
|
||||
+## Creates types and rules for a basic
|
||||
+## zararfa init daemon domain.
|
||||
+## </summary>
|
||||
+## <param name="prefix">
|
||||
+## <summary>
|
||||
+## Prefix for the domain.
|
||||
+## </summary>
|
||||
+## </param>
|
||||
+#
|
||||
+template(`zarafa_domain_template',`
|
||||
+
|
||||
+ gen_require(`
|
||||
+ attribute zarafa_domain;
|
||||
+ ')
|
||||
+
|
||||
+ ##############################
|
||||
+ #
|
||||
+ # $1_t declarations
|
||||
+ #
|
||||
+
|
||||
+ type zarafa_$1_t, zarafa_domain;
|
||||
+ type zarafa_$1_exec_t;
|
||||
+ init_daemon_domain(zarafa_$1_t, zarafa_$1_exec_t)
|
||||
+
|
||||
+ type zarafa_$1_log_t;
|
||||
+ logging_log_file(zarafa_$1_log_t)
|
||||
+
|
||||
+ type zarafa_$1_var_run_t;
|
||||
+ files_pid_file(zarafa_$1_var_run_t)
|
||||
+
|
||||
+ ##############################
|
||||
+ #
|
||||
+ # $1_t local policy
|
||||
+ #
|
||||
+
|
||||
+ manage_files_pattern(zarafa_$1_t, zarafa_$1_var_run_t, zarafa_$1_var_run_t)
|
||||
+ manage_sock_files_pattern(zarafa_$1_t, zarafa_$1_var_run_t, zarafa_$1_var_run_t)
|
||||
+ files_pid_filetrans(zarafa_$1_t, zarafa_$1_var_run_t, { file sock_file })
|
||||
+ #stream_connect_pattern(zarafa_$1_t, $1_var_run_t, $1_var_run_t, virtd_t)
|
||||
+
|
||||
+ manage_files_pattern(zarafa_$1_t, zarafa_$1_log_t,zarafa_$1_log_t)
|
||||
+ #manage_sock_files_pattern(zarafa_$1_t, zarafa_$1_log_t,zarafa_$1_log_t)
|
||||
+ logging_log_filetrans(zarafa_$1_t,zarafa_$1_log_t,{ file })
|
||||
+')
|
||||
+
|
||||
+########################################
|
||||
+## <summary>
|
||||
+## Execute a domain transition to run zarafa_server.
|
||||
+## </summary>
|
||||
+## <param name="domain">
|
||||
+## <summary>
|
||||
+## Domain allowed to transition.
|
||||
+## </summary>
|
||||
+## </param>
|
||||
+#
|
||||
+interface(`zarafa_server_domtrans',`
|
||||
+ gen_require(`
|
||||
+ type zarafa_server_t, zarafa_server_exec_t;
|
||||
+ ')
|
||||
+
|
||||
+ domtrans_pattern($1, zarafa_server_exec_t, zarafa_server_t)
|
||||
+')
|
||||
+
|
||||
+
|
||||
+########################################
|
||||
+## <summary>
|
||||
+## Execute a domain transition to run zarafa_deliver.
|
||||
+## </summary>
|
||||
+## <param name="domain">
|
||||
+## <summary>
|
||||
+## Domain allowed to transition.
|
||||
+## </summary>
|
||||
+## </param>
|
||||
+#
|
||||
+interface(`zarafa_deliver_domtrans',`
|
||||
+ gen_require(`
|
||||
+ type zarafa_deliver_t, zarafa_deliver_exec_t;
|
||||
+ ')
|
||||
+
|
||||
+ domtrans_pattern($1, zarafa_deliver_exec_t, zarafa_deliver_t)
|
||||
+')
|
||||
+
|
||||
+#######################################
|
||||
+## <summary>
|
||||
+## Connect to zarafa-server unix domain stream socket.
|
||||
+## </summary>
|
||||
+## <param name="domain">
|
||||
+## <summary>
|
||||
+## Domain allowed access.
|
||||
+## </summary>
|
||||
+## </param>
|
||||
+## <rolecap/>
|
||||
+#
|
||||
+interface(`zarafa_stream_connect_server',`
|
||||
+ gen_require(`
|
||||
+ type zarafa_server_t, zarafa_server_var_run_t;
|
||||
+ ')
|
||||
+
|
||||
+ stream_connect_pattern($1, zarafa_server_t, zarafa_server_var_run_t, zarafa_server_t)
|
||||
+')
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/zarafa.te serefpolicy-3.8.3/policy/modules/services/zarafa.te
|
||||
--- nsaserefpolicy/policy/modules/services/zarafa.te 1969-12-31 19:00:00.000000000 -0500
|
||||
+++ serefpolicy-3.8.3/policy/modules/services/zarafa.te 2010-06-16 16:08:32.000000000 -0400
|
||||
@@ -0,0 +1,134 @@
|
||||
+
|
||||
+policy_module(zarafa, 1.0.0)
|
||||
+
|
||||
+########################################
|
||||
+#
|
||||
+# Declarations
|
||||
+#
|
||||
+
|
||||
+attribute zarafa_domain;
|
||||
+
|
||||
+zarafa_domain_template(monitor)
|
||||
+zarafa_domain_template(ical)
|
||||
+zarafa_domain_template(server)
|
||||
+zarafa_domain_template(spooler)
|
||||
+zarafa_domain_template(gateway)
|
||||
+zarafa_domain_template(deliver)
|
||||
+
|
||||
+type zarafa_deliver_tmp_t;
|
||||
+files_tmp_file(zarafa_deliver_tmp_t)
|
||||
+
|
||||
+type zarafa_etc_t;
|
||||
+files_config_file(zarafa_etc_t)
|
||||
+
|
||||
+type zarafa_share_t;
|
||||
+files_type(zarafa_share_t)
|
||||
+
|
||||
+permissive zarafa_server_t;
|
||||
+permissive zarafa_spooler_t;
|
||||
+permissive zarafa_gateway_t;
|
||||
+permissive zarafa_deliver_t;
|
||||
+permissive zarafa_ical_t;
|
||||
+permissive zarafa_monitor_t;
|
||||
+
|
||||
+########################################
|
||||
+#
|
||||
+# zarafa-deliver local policy
|
||||
+#
|
||||
+
|
||||
+manage_dirs_pattern(zarafa_deliver_t, zarafa_deliver_tmp_t, zarafa_deliver_tmp_t)
|
||||
+manage_files_pattern(zarafa_deliver_t, zarafa_deliver_tmp_t, zarafa_deliver_tmp_t)
|
||||
+files_tmp_filetrans(zarafa_deliver_t, zarafa_deliver_tmp_t, { file dir })
|
||||
+
|
||||
+#temporary
|
||||
+#allow zarafa_deliver_t port_t:tcp_socket name_bind;
|
||||
+
|
||||
+########################################
|
||||
+#
|
||||
+# zarafa_server local policy
|
||||
+#
|
||||
+
|
||||
+allow zarafa_server_t self:capability { chown kill net_bind_service};
|
||||
+allow zarafa_server_t self:process { setrlimit signal };
|
||||
+
|
||||
+corenet_tcp_bind_zarafa_port(zarafa_ical_t)
|
||||
+
|
||||
+files_read_usr_files(zarafa_server_t)
|
||||
+
|
||||
+logging_send_syslog_msg(zarafa_server_t)
|
||||
+logging_send_audit_msgs(zarafa_server_t)
|
||||
+
|
||||
+sysnet_dns_name_resolve(zarafa_server_t)
|
||||
+
|
||||
+optional_policy(`
|
||||
+ mysql_stream_connect(zarafa_server_t)
|
||||
+')
|
||||
+
|
||||
+optional_policy(`
|
||||
+ kerberos_use(zarafa_server_t)
|
||||
+')
|
||||
+
|
||||
+########################################
|
||||
+#
|
||||
+# zarafa_spooler local policy
|
||||
+#
|
||||
+
|
||||
+allow zarafa_spooler_t self:capability { chown kill };
|
||||
+allow zarafa_spooler_t self:process { signal };
|
||||
+
|
||||
+corenet_tcp_connect_smtp_port(zarafa_spooler_t)
|
||||
+
|
||||
+########################################
|
||||
+#
|
||||
+# zarafa_gateway local policy
|
||||
+#
|
||||
+
|
||||
+allow zarafa_gateway_t self:capability { chown kill };
|
||||
+allow zarafa_gateway_t self:process { setrlimit signal };
|
||||
+
|
||||
+corenet_tcp_bind_pop_port(zarafa_gateway_t)
|
||||
+
|
||||
+#######################################
|
||||
+#
|
||||
+# zarafa-ical local policy
|
||||
+#
|
||||
+
|
||||
+allow zarafa_ical_t self:capability chown;
|
||||
+
|
||||
+corenet_tcp_bind_http_cache_port(zarafa_ical_t)
|
||||
+
|
||||
+######################################
|
||||
+#
|
||||
+# zarafa-monitor local policy
|
||||
+#
|
||||
+
|
||||
+allow zarafa_monitor_t self:capability chown;
|
||||
+
|
||||
+########################################
|
||||
+#
|
||||
+# zarafa domains local policy
|
||||
+#
|
||||
+
|
||||
+# bad permission on /etc/zarafa
|
||||
+allow zarafa_domain self:capability { dac_override setgid setuid };
|
||||
+
|
||||
+allow zarafa_domain self:fifo_file rw_fifo_file_perms;
|
||||
+allow zarafa_domain self:tcp_socket create_stream_socket_perms;
|
||||
+allow zarafa_domain self:unix_stream_socket create_stream_socket_perms;
|
||||
+
|
||||
+stream_connect_pattern(zarafa_domain, zarafa_server_var_run_t, zarafa_server_var_run_t, zarafa_server_t)
|
||||
+
|
||||
+read_files_pattern(zarafa_domain, zarafa_etc_t, zarafa_etc_t)
|
||||
+
|
||||
+kernel_read_system_state(zarafa_domain)
|
||||
+
|
||||
+files_read_etc_files(zarafa_domain)
|
||||
+
|
||||
+auth_use_nsswitch(zarafa_domain)
|
||||
+
|
||||
+miscfiles_read_localization(zarafa_domain)
|
||||
+
|
||||
+# temporary rules
|
||||
+optional_policy(`
|
||||
+ apache_content_template(zarafa)
|
||||
+')
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.te serefpolicy-3.8.3/policy/modules/system/application.te
|
||||
--- nsaserefpolicy/policy/modules/system/application.te 2010-05-25 16:28:22.000000000 -0400
|
||||
+++ serefpolicy-3.8.3/policy/modules/system/application.te 2010-06-08 11:32:10.000000000 -0400
|
||||
|
||||
Loading…
Reference in New Issue
Block a user