add aide, ccs, and ricci
This commit is contained in:
Chris PeBenito
parent
d31d3c159e
commit
fa45da0efd
@ -17,7 +17,10 @@
|
||||
- Patches from Dan Walsh:
|
||||
Tue, 24 Oct 2006
|
||||
- Added modules:
|
||||
aide (Matt Anderson)
|
||||
ccs (Dan Walsh)
|
||||
iscsi (Dan Walsh)
|
||||
ricci (Dan Walsh)
|
||||
|
||||
* Wed Oct 18 2006 Chris PeBenito <selinux@tresys.com> - 20061018
|
||||
- Patch from Russell Coker Thu, 5 Oct 2006
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
|
||||
policy_module(corenetwork,1.2.1)
|
||||
policy_module(corenetwork,1.2.2)
|
||||
|
||||
########################################
|
||||
#
|
||||
@ -66,6 +66,7 @@ network_port(bgp, tcp,179,s0, udp,179,s0, tcp,2605,s0, udp,2605,s0)
|
||||
type biff_port_t, port_type, reserved_port_type; dnl network_port(biff) # no defined portcon in current strict
|
||||
network_port(clamd, tcp,3310,s0)
|
||||
network_port(clockspeed, udp,4041,s0)
|
||||
network_port(cluster, tcp,5149,s0, udp,5149,s0, tcp,40040,s0, tcp,50006,s0, udp,50006,s0, tcp,50007,s0, udp,50007,s0, tcp,50008,s0, udp,50008,s0)
|
||||
network_port(comsat, udp,512,s0)
|
||||
network_port(cvs, tcp,2401,s0, udp,2401,s0)
|
||||
network_port(dcc, udp,6276,s0, udp,6277,s0)
|
||||
@ -106,6 +107,7 @@ network_port(mail, tcp,2000,s0)
|
||||
network_port(monopd, tcp,1234,s0)
|
||||
network_port(mysqld, tcp,3306,s0)
|
||||
network_port(nessus, tcp,1241,s0)
|
||||
network_port(netsupport, tcp,5405,s0, udp,5405,s0)
|
||||
network_port(nmbd, udp,137,s0, udp,138,s0, udp,139,s0)
|
||||
network_port(ntp, udp,123,s0)
|
||||
network_port(openvpn, udp,1194,s0)
|
||||
@ -122,6 +124,8 @@ network_port(pyzor, udp,24441,s0)
|
||||
network_port(radacct, udp,1646,s0, udp,1813,s0)
|
||||
network_port(radius, udp,1645,s0, udp,1812,s0)
|
||||
network_port(razor, tcp,2703,s0)
|
||||
network_port(ricci, tcp,11111,s0, udp,11111,s0)
|
||||
network_port(ricci_modcluster, tcp,16851,s0, udp,16851,s0)
|
||||
network_port(rlogind, tcp,513,s0)
|
||||
network_port(rndc, tcp,953,s0)
|
||||
network_port(router, udp,520,s0)
|
||||
|
||||
5
policy/modules/services/aide.fc
Normal file
5
policy/modules/services/aide.fc
Normal file
@ -0,0 +1,5 @@
|
||||
/usr/sbin/aide -- gen_context(system_u:object_r:aide_exec_t,mls_systemhigh)
|
||||
|
||||
/var/lib/aide(/.*) gen_context(system_u:object_r:aide_db_t,mls_systemhigh)
|
||||
|
||||
/var/log/aide.log -- gen_context(system_u:object_r:aide_log_t,mls_systemhigh)
|
||||
55
policy/modules/services/aide.if
Normal file
55
policy/modules/services/aide.if
Normal file
@ -0,0 +1,55 @@
|
||||
## <summary>Aide filesystem integrity checker</summary>
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Execute aide in the aide domain
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`aide_domtrans',`
|
||||
gen_require(`
|
||||
type aide_t, aide_exec_t;
|
||||
')
|
||||
|
||||
corecmd_search_sbin($1)
|
||||
domain_auto_trans($1,aide_exec_t,aide_t)
|
||||
|
||||
allow aide_t $1:fd use;
|
||||
allow aide_t $1:fifo_file rw_file_perms;
|
||||
allow aide_t $1:process sigchld;
|
||||
')
|
||||
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Execute aide programs in the AIDE domain.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
## <param name="role">
|
||||
## <summary>
|
||||
## The role to allow the AIDE domain.
|
||||
## </summary>
|
||||
## </param>
|
||||
## <param name="terminal">
|
||||
## <summary>
|
||||
## The type of the terminal allow the AIDE domain to use.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`aide_run',`
|
||||
gen_require(`
|
||||
type aide_t;
|
||||
')
|
||||
|
||||
aide_domtrans($1)
|
||||
role $2 types aide_t;
|
||||
allow aide_t $3:chr_file rw_file_perms;
|
||||
')
|
||||
45
policy/modules/services/aide.te
Normal file
45
policy/modules/services/aide.te
Normal file
@ -0,0 +1,45 @@
|
||||
|
||||
policy_module(aide,1.0.0)
|
||||
|
||||
########################################
|
||||
#
|
||||
# Declarations
|
||||
#
|
||||
|
||||
type aide_t;
|
||||
type aide_exec_t;
|
||||
domain_type(aide_t)
|
||||
domain_entry_file(aide_t,aide_exec_t)
|
||||
|
||||
# log files
|
||||
type aide_log_t;
|
||||
logging_log_file(aide_log_t)
|
||||
|
||||
# aide database
|
||||
type aide_db_t;
|
||||
files_type(aide_db_t)
|
||||
|
||||
########################################
|
||||
#
|
||||
# aide local policy
|
||||
#
|
||||
|
||||
allow aide_t self:capability { dac_override fowner };
|
||||
# audit
|
||||
allow aide_t self:capability audit_write;
|
||||
allow aide_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay };
|
||||
|
||||
# database actions
|
||||
allow aide_t aide_db_t:dir rw_dir_perms;
|
||||
allow aide_t aide_db_t:file manage_file_perms;
|
||||
|
||||
# logs
|
||||
logging_log_filetrans(aide_t,aide_log_t,file)
|
||||
allow aide_t aide_log_t:file manage_file_perms;
|
||||
|
||||
files_read_all_files(aide_t)
|
||||
|
||||
libs_use_ld_so(aide_t)
|
||||
libs_use_shared_libs(aide_t)
|
||||
|
||||
seutil_use_newrole_fds(aide_t)
|
||||
8
policy/modules/services/ccs.fc
Normal file
8
policy/modules/services/ccs.fc
Normal file
@ -0,0 +1,8 @@
|
||||
/etc/cluster(/.*)? gen_context(system_u:object_r:cluster_conf_t,s0)
|
||||
|
||||
/sbin/ccsd -- gen_context(system_u:object_r:ccs_exec_t,s0)
|
||||
|
||||
/usr/sbin/aisexec -- gen_context(system_u:object_r:ccs_exec_t,s0)
|
||||
|
||||
/var/run/cluster(/.*)? gen_context(system_u:object_r:ccs_var_run_t,s0)
|
||||
/var/run/cman_.* -s gen_context(system_u:object_r:ccs_var_run_t,s0)
|
||||
81
policy/modules/services/ccs.if
Normal file
81
policy/modules/services/ccs.if
Normal file
@ -0,0 +1,81 @@
|
||||
## <summary>Cluster Configuration System</summary>
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Execute a domain transition to run ccs.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed to transition.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`ccs_domtrans',`
|
||||
gen_require(`
|
||||
type ccs_t, ccs_exec_t;
|
||||
')
|
||||
|
||||
domain_auto_trans($1,ccs_exec_t,ccs_t)
|
||||
allow ccs_t $1:fd use;
|
||||
allow ccs_t $1:fifo_file rw_file_perms;
|
||||
allow ccs_t $1:process sigchld;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Connect to ccs over an unix stream socket.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`ccs_stream_connect',`
|
||||
gen_require(`
|
||||
type ccs_t, ccs_var_run_t;
|
||||
')
|
||||
|
||||
files_search_pids($1)
|
||||
allow $1 ccs_var_run_t:dir list_dir_perms;
|
||||
allow $1 ccs_var_run_t:sock_file write;
|
||||
allow $1 ccs_t:unix_stream_socket connectto;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Read cluster configuration files.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`ccs_read_config',`
|
||||
gen_require(`
|
||||
type cluster_conf_t;
|
||||
')
|
||||
|
||||
allow $1 cluster_conf_t:dir search_dir_perms;
|
||||
allow $1 cluster_conf_t:file { getattr read };
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Manage cluster configuration files.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`ccs_manage_config',`
|
||||
gen_require(`
|
||||
type cluster_conf_t;
|
||||
')
|
||||
|
||||
allow $1 cluster_conf_t:dir manage_dir_perms;
|
||||
allow $1 cluster_conf_t:file manage_file_perms;
|
||||
')
|
||||
98
policy/modules/services/ccs.te
Normal file
98
policy/modules/services/ccs.te
Normal file
@ -0,0 +1,98 @@
|
||||
|
||||
policy_module(ccs,1.0.0)
|
||||
|
||||
########################################
|
||||
#
|
||||
# Declarations
|
||||
#
|
||||
|
||||
type ccs_t;
|
||||
type ccs_exec_t;
|
||||
init_daemon_domain(ccs_t, ccs_exec_t)
|
||||
|
||||
# pid files
|
||||
type cluster_conf_t;
|
||||
files_type(cluster_conf_t)
|
||||
|
||||
# log files
|
||||
type ccs_var_log_t;
|
||||
logging_log_file(ccs_var_log_t)
|
||||
|
||||
# pid files
|
||||
type ccs_var_run_t;
|
||||
files_pid_file(ccs_var_run_t)
|
||||
|
||||
########################################
|
||||
#
|
||||
# ccs local policy
|
||||
#
|
||||
|
||||
allow ccs_t self:capability { ipc_lock sys_nice sys_resource };
|
||||
allow ccs_t self:process { signal setrlimit setsched };
|
||||
allow ccs_t self:fifo_file { read write };
|
||||
allow ccs_t self:unix_stream_socket { connectto create_stream_socket_perms };
|
||||
allow ccs_t self:unix_dgram_socket create_socket_perms;
|
||||
allow ccs_t self:netlink_route_socket r_netlink_socket_perms;
|
||||
allow ccs_t self:tcp_socket create_stream_socket_perms;
|
||||
allow ccs_t self:udp_socket { create_socket_perms listen recv_msg send_msg };
|
||||
# cjp: this needs to be fixed to be specific
|
||||
allow ccs_t self:socket create_socket_perms;
|
||||
|
||||
allow ccs_t cluster_conf_t:dir rw_dir_perms;
|
||||
allow ccs_t cluster_conf_t:file manage_file_perms;
|
||||
|
||||
# log files
|
||||
allow ccs_t ccs_var_log_t:file create_file_perms;
|
||||
allow ccs_t ccs_var_log_t:sock_file create_file_perms;
|
||||
allow ccs_t ccs_var_log_t:dir { rw_dir_perms setattr };
|
||||
logging_log_filetrans(ccs_t,ccs_var_log_t,{ sock_file file dir })
|
||||
|
||||
# pid file
|
||||
allow ccs_t ccs_var_run_t:file manage_file_perms;
|
||||
allow ccs_t ccs_var_run_t:sock_file manage_file_perms;
|
||||
allow ccs_t ccs_var_run_t:dir manage_dir_perms;
|
||||
files_pid_filetrans(ccs_t,ccs_var_run_t, { dir file sock_file })
|
||||
|
||||
kernel_read_kernel_sysctls(ccs_t)
|
||||
|
||||
corecmd_list_sbin(ccs_t)
|
||||
corecmd_exec_bin(ccs_t)
|
||||
|
||||
corenet_non_ipsec_sendrecv(ccs_t)
|
||||
corenet_tcp_sendrecv_all_if(ccs_t)
|
||||
corenet_udp_sendrecv_all_if(ccs_t)
|
||||
corenet_tcp_sendrecv_all_nodes(ccs_t)
|
||||
corenet_udp_sendrecv_all_nodes(ccs_t)
|
||||
corenet_tcp_sendrecv_all_ports(ccs_t)
|
||||
corenet_udp_sendrecv_all_ports(ccs_t)
|
||||
corenet_tcp_bind_all_nodes(ccs_t)
|
||||
corenet_udp_bind_all_nodes(ccs_t)
|
||||
corenet_tcp_bind_cluster_port(ccs_t)
|
||||
corenet_udp_bind_cluster_port(ccs_t)
|
||||
corenet_udp_bind_netsupport_port(ccs_t)
|
||||
|
||||
dev_read_urand(ccs_t)
|
||||
|
||||
files_read_etc_files(ccs_t)
|
||||
files_read_etc_runtime_files(ccs_t)
|
||||
|
||||
init_dontaudit_use_fds(ccs_t)
|
||||
init_rw_script_tmp_files(ccs_t)
|
||||
|
||||
libs_use_ld_so(ccs_t)
|
||||
libs_use_shared_libs(ccs_t)
|
||||
|
||||
logging_send_syslog_msg(ccs_t)
|
||||
|
||||
miscfiles_read_localization(ccs_t)
|
||||
|
||||
sysnet_dns_name_resolve(ccs_t)
|
||||
|
||||
ifdef(`targeted_policy',`
|
||||
term_dontaudit_use_generic_ptys(ccs_t)
|
||||
term_dontaudit_use_unallocated_ttys(ccs_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
unconfined_use_fds(ccs_t)
|
||||
')
|
||||
16
policy/modules/services/ricci.fc
Normal file
16
policy/modules/services/ricci.fc
Normal file
@ -0,0 +1,16 @@
|
||||
/usr/libexec/modcluster -- gen_context(system_u:object_r:ricci_modcluster_exec_t,s0)
|
||||
/usr/libexec/ricci-modlog -- gen_context(system_u:object_r:ricci_modlog_exec_t,s0)
|
||||
/usr/libexec/ricci-modrpm -- gen_context(system_u:object_r:ricci_modrpm_exec_t,s0)
|
||||
/usr/libexec/ricci-modservice -- gen_context(system_u:object_r:ricci_modservice_exec_t,s0)
|
||||
/usr/libexec/ricci-modstorage -- gen_context(system_u:object_r:ricci_modstorage_exec_t,s0)
|
||||
|
||||
/usr/sbin/modclusterd -- gen_context(system_u:object_r:ricci_modclusterd_exec_t,s0)
|
||||
/usr/sbin/ricci -- gen_context(system_u:object_r:ricci_exec_t,s0)
|
||||
|
||||
/var/lib/ricci(/.*)? gen_context(system_u:object_r:ricci_var_lib_t,s0)
|
||||
|
||||
/var/log/clumond.log -- gen_context(system_u:object_r:ricci_modcluster_var_log_t,s0)
|
||||
|
||||
/var/run/clumond.sock -s gen_context(system_u:object_r:ricci_modcluster_var_run_t,s0)
|
||||
/var/run/modclusterd.pid -- gen_context(system_u:object_r:ricci_modcluster_var_run_t,s0)
|
||||
/var/run/ricci.pid -- gen_context(system_u:object_r:ricci_var_run_t,s0)
|
||||
185
policy/modules/services/ricci.if
Normal file
185
policy/modules/services/ricci.if
Normal file
@ -0,0 +1,185 @@
|
||||
## <summary>Ricci cluster management agent</summary>
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Execute a domain transition to run ricci.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed to transition.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`ricci_domtrans',`
|
||||
gen_require(`
|
||||
type ricci_t, ricci_exec_t;
|
||||
')
|
||||
|
||||
domain_auto_trans($1,ricci_exec_t,ricci_t)
|
||||
allow ricci_t $1:fd use;
|
||||
allow ricci_t $1:fifo_file rw_file_perms;
|
||||
allow ricci_t $1:process sigchld;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Execute a domain transition to run ricci_modcluster.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed to transition.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`ricci_domtrans_modcluster',`
|
||||
gen_require(`
|
||||
type ricci_modcluster_t, ricci_modcluster_exec_t;
|
||||
')
|
||||
|
||||
domain_auto_trans($1,ricci_modcluster_exec_t,ricci_modcluster_t)
|
||||
allow ricci_modcluster_t $1:fd use;
|
||||
allow ricci_modcluster_t $1:fifo_file rw_file_perms;
|
||||
allow ricci_modcluster_t $1:process sigchld;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Do not audit attempts to use
|
||||
## ricci_modcluster file descriptors.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## The type of process not to audit.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`ricci_dontaudit_use_modcluster_fds',`
|
||||
gen_require(`
|
||||
type ricci_modcluster_t;
|
||||
')
|
||||
|
||||
dontaudit $1 ricci_modcluster_t:fd use;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Do not audit attempts to read write
|
||||
## ricci_modcluster unamed pipes.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## The type of process not to audit.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`ricci_dontaudit_rw_modcluster_pipes',`
|
||||
gen_require(`
|
||||
type ricci_modcluster_t;
|
||||
')
|
||||
|
||||
dontaudit $1 ricci_modcluster_t:fifo_file { read write };
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Connect to ricci_modclusterd over an unix stream socket.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`ricci_stream_connect_modclusterd',`
|
||||
gen_require(`
|
||||
type ricci_modclusterd_t, ricci_modcluster_var_run_t;
|
||||
')
|
||||
|
||||
files_search_pids($1)
|
||||
allow $1 ricci_modcluster_var_run_t:sock_file write;
|
||||
allow $1 ricci_modclusterd_t:unix_stream_socket connectto;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Execute a domain transition to run ricci_modlog.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed to transition.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`ricci_domtrans_modlog',`
|
||||
gen_require(`
|
||||
type ricci_modlog_t, ricci_modlog_exec_t;
|
||||
')
|
||||
|
||||
domain_auto_trans($1,ricci_modlog_exec_t,ricci_modlog_t)
|
||||
allow ricci_modlog_t $1:fd use;
|
||||
allow ricci_modlog_t $1:fifo_file rw_file_perms;
|
||||
allow ricci_modlog_t $1:process sigchld;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Execute a domain transition to run ricci_modrpm.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed to transition.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`ricci_domtrans_modrpm',`
|
||||
gen_require(`
|
||||
type ricci_modrpm_t, ricci_modrpm_exec_t;
|
||||
')
|
||||
|
||||
domain_auto_trans($1,ricci_modrpm_exec_t,ricci_modrpm_t)
|
||||
allow ricci_modrpm_t $1:fd use;
|
||||
allow ricci_modrpm_t $1:fifo_file rw_file_perms;
|
||||
allow ricci_modrpm_t $1:process sigchld;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Execute a domain transition to run ricci_modservice.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed to transition.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`ricci_domtrans_modservice',`
|
||||
gen_require(`
|
||||
type ricci_modservice_t, ricci_modservice_exec_t;
|
||||
')
|
||||
|
||||
domain_auto_trans($1,ricci_modservice_exec_t,ricci_modservice_t)
|
||||
allow ricci_modservice_t $1:fd use;
|
||||
allow ricci_modservice_t $1:fifo_file rw_file_perms;
|
||||
allow ricci_modservice_t $1:process sigchld;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Execute a domain transition to run ricci_modstorage.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed to transition.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`ricci_domtrans_modstorage',`
|
||||
gen_require(`
|
||||
type ricci_modstorage_t, ricci_modstorage_exec_t;
|
||||
')
|
||||
|
||||
domain_auto_trans($1,ricci_modstorage_exec_t,ricci_modstorage_t)
|
||||
allow ricci_modstorage_t $1:fd use;
|
||||
allow ricci_modstorage_t $1:fifo_file rw_file_perms;
|
||||
allow ricci_modstorage_t $1:process sigchld;
|
||||
')
|
||||
498
policy/modules/services/ricci.te
Normal file
498
policy/modules/services/ricci.te
Normal file
@ -0,0 +1,498 @@
|
||||
|
||||
policy_module(ricci,1.0.0)
|
||||
|
||||
########################################
|
||||
#
|
||||
# Declarations
|
||||
#
|
||||
|
||||
type ricci_t;
|
||||
type ricci_exec_t;
|
||||
domain_type(ricci_t)
|
||||
init_daemon_domain(ricci_t, ricci_exec_t)
|
||||
|
||||
# tmp files
|
||||
type ricci_tmp_t;
|
||||
files_tmp_file(ricci_tmp_t)
|
||||
|
||||
# var/lib files
|
||||
type ricci_var_lib_t;
|
||||
files_type(ricci_var_lib_t)
|
||||
|
||||
# log files
|
||||
type ricci_var_log_t;
|
||||
logging_log_file(ricci_var_log_t)
|
||||
|
||||
# pid files
|
||||
type ricci_var_run_t;
|
||||
files_pid_file(ricci_var_run_t)
|
||||
|
||||
type ricci_modcluster_t;
|
||||
type ricci_modcluster_exec_t;
|
||||
domain_type(ricci_modcluster_t)
|
||||
domain_entry_file(ricci_modcluster_t, ricci_modcluster_exec_t)
|
||||
role system_r types ricci_modcluster_t;
|
||||
|
||||
# var/lib files
|
||||
type ricci_modcluster_var_lib_t;
|
||||
files_type(ricci_modcluster_var_lib_t)
|
||||
|
||||
# log files
|
||||
type ricci_modcluster_var_log_t;
|
||||
logging_log_file(ricci_modcluster_var_log_t)
|
||||
|
||||
# pid files
|
||||
type ricci_modcluster_var_run_t;
|
||||
files_pid_file(ricci_modcluster_var_run_t)
|
||||
|
||||
type ricci_modclusterd_t;
|
||||
type ricci_modclusterd_exec_t;
|
||||
domain_type(ricci_modclusterd_t)
|
||||
init_daemon_domain(ricci_modclusterd_t, ricci_modclusterd_exec_t)
|
||||
|
||||
type ricci_modlog_t;
|
||||
type ricci_modlog_exec_t;
|
||||
domain_type(ricci_modlog_t)
|
||||
domain_entry_file(ricci_modlog_t, ricci_modlog_exec_t)
|
||||
role system_r types ricci_modlog_t;
|
||||
|
||||
type ricci_modrpm_t;
|
||||
type ricci_modrpm_exec_t;
|
||||
domain_type(ricci_modrpm_t)
|
||||
domain_entry_file(ricci_modrpm_t, ricci_modrpm_exec_t)
|
||||
role system_r types ricci_modrpm_t;
|
||||
|
||||
type ricci_modservice_t;
|
||||
type ricci_modservice_exec_t;
|
||||
domain_type(ricci_modservice_t)
|
||||
domain_entry_file(ricci_modservice_t, ricci_modservice_exec_t)
|
||||
role system_r types ricci_modservice_t;
|
||||
|
||||
type ricci_modstorage_t;
|
||||
type ricci_modstorage_exec_t;
|
||||
domain_type(ricci_modstorage_t)
|
||||
domain_entry_file(ricci_modstorage_t, ricci_modstorage_exec_t)
|
||||
role system_r types ricci_modstorage_t;
|
||||
|
||||
########################################
|
||||
#
|
||||
# ricci local policy
|
||||
#
|
||||
|
||||
allow ricci_t self:capability { setuid sys_nice sys_boot };
|
||||
allow ricci_t self:process setsched;
|
||||
allow ricci_t self:fifo_file { read write };
|
||||
allow ricci_t self:unix_stream_socket { create_stream_socket_perms connectto };
|
||||
allow ricci_t self:tcp_socket create_stream_socket_perms;
|
||||
|
||||
domain_auto_trans(ricci_t,ricci_modcluster_exec_t,ricci_modcluster_t)
|
||||
domain_auto_trans(ricci_t,ricci_modlog_exec_t,ricci_modlog_t)
|
||||
domain_auto_trans(ricci_t,ricci_modrpm_exec_t,ricci_modrpm_t)
|
||||
domain_auto_trans(ricci_t,ricci_modservice_exec_t,ricci_modservice_t)
|
||||
domain_auto_trans(ricci_t,ricci_modstorage_exec_t,ricci_modstorage_t)
|
||||
|
||||
# tmp file
|
||||
allow ricci_t ricci_tmp_t:dir create_dir_perms;
|
||||
allow ricci_t ricci_tmp_t:file create_file_perms;
|
||||
files_tmp_filetrans(ricci_t, ricci_tmp_t, { file dir })
|
||||
|
||||
# var/lib files for ricci
|
||||
allow ricci_t ricci_var_lib_t:file create_file_perms;
|
||||
allow ricci_t ricci_var_lib_t:sock_file create_file_perms;
|
||||
allow ricci_t ricci_var_lib_t:dir create_dir_perms;
|
||||
files_var_lib_filetrans(ricci_t,ricci_var_lib_t, { file dir sock_file })
|
||||
|
||||
# log files
|
||||
allow ricci_t ricci_var_log_t:file create_file_perms;
|
||||
allow ricci_t ricci_var_log_t:sock_file create_file_perms;
|
||||
allow ricci_t ricci_var_log_t:dir { rw_dir_perms setattr };
|
||||
logging_log_filetrans(ricci_t,ricci_var_log_t,{ sock_file file dir })
|
||||
|
||||
# pid file
|
||||
allow ricci_t ricci_var_run_t:file manage_file_perms;
|
||||
allow ricci_t ricci_var_run_t:sock_file manage_file_perms;
|
||||
allow ricci_t ricci_var_run_t:dir rw_dir_perms;
|
||||
files_pid_filetrans(ricci_t,ricci_var_run_t, { file sock_file })
|
||||
|
||||
kernel_read_kernel_sysctls(ricci_t)
|
||||
|
||||
corecmd_exec_bin(ricci_t)
|
||||
corecmd_exec_sbin(ricci_t)
|
||||
|
||||
corenet_non_ipsec_sendrecv(ricci_t)
|
||||
corenet_tcp_sendrecv_all_if(ricci_t)
|
||||
corenet_tcp_sendrecv_all_nodes(ricci_t)
|
||||
corenet_tcp_sendrecv_all_ports(ricci_t)
|
||||
corenet_tcp_bind_all_nodes(ricci_t)
|
||||
corenet_udp_bind_all_nodes(ricci_t)
|
||||
corenet_tcp_bind_ricci_port(ricci_t)
|
||||
corenet_udp_bind_ricci_port(ricci_t)
|
||||
corenet_tcp_connect_http_port(ricci_t)
|
||||
|
||||
dev_read_urand(ricci_t)
|
||||
|
||||
files_read_etc_files(ricci_t)
|
||||
files_read_etc_runtime_files(ricci_t)
|
||||
files_create_boot_flag(ricci_t)
|
||||
|
||||
auth_domtrans_chk_passwd(ricci_t)
|
||||
auth_append_login_records(ricci_t)
|
||||
|
||||
init_dontaudit_use_fds(ricci_t)
|
||||
init_dontaudit_stream_connect_script(ricci_t)
|
||||
|
||||
libs_use_ld_so(ricci_t)
|
||||
libs_use_shared_libs(ricci_t)
|
||||
|
||||
locallogin_dontaudit_use_fds(ricci_t)
|
||||
|
||||
logging_send_syslog_msg(ricci_t)
|
||||
|
||||
miscfiles_read_localization(ricci_t)
|
||||
|
||||
sysnet_dns_name_resolve(ricci_t)
|
||||
|
||||
ifdef(`targeted_policy', `
|
||||
term_dontaudit_use_console(ricci_t)
|
||||
term_dontaudit_use_generic_ptys(ricci_t)
|
||||
term_dontaudit_use_unallocated_ttys(ricci_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
ccs_read_config(ricci_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
dbus_system_bus_client_template(ricci,ricci_t)
|
||||
dbus_send_system_bus(ricci_t)
|
||||
oddjob_dbus_chat(ricci_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
# Needed so oddjob can run halt/reboot on behalf of ricci
|
||||
corecmd_sbin_entry_type(ricci_t)
|
||||
term_dontaudit_search_ptys(ricci_t)
|
||||
init_exec(ricci_t)
|
||||
init_telinit(ricci_t)
|
||||
init_rw_utmp(ricci_t)
|
||||
|
||||
oddjob_system_entry(ricci_t, ricci_exec_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
rpm_use_script_fds(ricci_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
sasl_connect(ricci_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
unconfined_use_fds(ricci_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
xen_domtrans_xm(ricci_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
#
|
||||
# ricci_modcluster local policy
|
||||
#
|
||||
|
||||
allow ricci_modcluster_t self:capability sys_nice;
|
||||
allow ricci_modcluster_t self:process setsched;
|
||||
allow ricci_modcluster_t self:fifo_file rw_file_perms;
|
||||
|
||||
kernel_read_kernel_sysctls(ricci_modcluster_t)
|
||||
kernel_read_system_state(ricci_modcluster_t)
|
||||
|
||||
corecmd_exec_shell(ricci_modcluster_t)
|
||||
corecmd_exec_sbin(ricci_modcluster_t)
|
||||
corecmd_exec_bin(ricci_modcluster_t)
|
||||
|
||||
domain_dontaudit_read_all_domains_state(ricci_modcluster_t)
|
||||
|
||||
files_search_locks(ricci_modcluster_t)
|
||||
files_read_etc_runtime_files(ricci_modcluster_t)
|
||||
files_read_etc_files(ricci_modcluster_t)
|
||||
files_search_usr(ricci_modcluster_t)
|
||||
|
||||
init_exec(ricci_modcluster_t)
|
||||
init_domtrans_script(ricci_modcluster_t)
|
||||
|
||||
libs_use_ld_so(ricci_modcluster_t)
|
||||
libs_use_shared_libs(ricci_modcluster_t)
|
||||
|
||||
logging_send_syslog_msg(ricci_modcluster_t)
|
||||
|
||||
miscfiles_read_localization(ricci_modcluster_t)
|
||||
|
||||
modutils_domtrans_insmod(ricci_modcluster_t)
|
||||
|
||||
mount_domtrans(ricci_modcluster_t)
|
||||
|
||||
ricci_stream_connect_modclusterd(ricci_modcluster_t)
|
||||
|
||||
optional_policy(`
|
||||
ccs_stream_connect(ricci_modcluster_t)
|
||||
ccs_domtrans(ricci_modcluster_t)
|
||||
ccs_manage_config(ricci_modcluster_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
consoletype_exec(ricci_modcluster_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
lvm_domtrans(ricci_modcluster_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
nscd_socket_use(ricci_modcluster_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
oddjob_system_entry(ricci_modcluster_t, ricci_modcluster_exec_t)
|
||||
')
|
||||
|
||||
# XXX This has got to go.
|
||||
unconfined_domain(ricci_modcluster_t)
|
||||
|
||||
########################################
|
||||
#
|
||||
# ricci_modclusterd local policy
|
||||
#
|
||||
|
||||
allow ricci_modclusterd_t self:capability sys_nice;
|
||||
allow ricci_modclusterd_t self:process { signal sigkill setsched };
|
||||
allow ricci_modclusterd_t self:fifo_file rw_file_perms;
|
||||
allow ricci_modclusterd_t self:unix_stream_socket create_stream_socket_perms;
|
||||
allow ricci_modclusterd_t self:tcp_socket create_stream_socket_perms;
|
||||
allow ricci_modclusterd_t self:netlink_route_socket r_netlink_socket_perms;
|
||||
# cjp: this needs to be fixed for a specific socket type:
|
||||
allow ricci_modclusterd_t self:socket create_socket_perms;
|
||||
|
||||
allow ricci_modclusterd_t ricci_modcluster_t:unix_stream_socket connectto;
|
||||
|
||||
# log files
|
||||
allow ricci_modclusterd_t ricci_modcluster_var_log_t:file create_file_perms;
|
||||
allow ricci_modclusterd_t ricci_modcluster_var_log_t:sock_file create_file_perms;
|
||||
allow ricci_modclusterd_t ricci_modcluster_var_log_t:dir { rw_dir_perms setattr };
|
||||
logging_log_filetrans(ricci_modclusterd_t,ricci_modcluster_var_log_t,{ sock_file file dir })
|
||||
|
||||
# pid file
|
||||
allow ricci_modclusterd_t ricci_modcluster_var_run_t:file manage_file_perms;
|
||||
allow ricci_modclusterd_t ricci_modcluster_var_run_t:sock_file manage_file_perms;
|
||||
allow ricci_modclusterd_t ricci_modcluster_var_run_t:dir rw_dir_perms;
|
||||
files_pid_filetrans(ricci_modclusterd_t,ricci_modcluster_var_run_t, { file sock_file })
|
||||
|
||||
kernel_read_kernel_sysctls(ricci_modclusterd_t)
|
||||
kernel_read_system_state(ricci_modclusterd_t)
|
||||
|
||||
corecmd_exec_bin(ricci_modclusterd_t)
|
||||
corecmd_exec_sbin(ricci_modclusterd_t)
|
||||
|
||||
corenet_tcp_sendrecv_all_if(ricci_modclusterd_t)
|
||||
corenet_tcp_sendrecv_all_ports(ricci_modclusterd_t)
|
||||
corenet_tcp_bind_all_nodes(ricci_modclusterd_t)
|
||||
corenet_tcp_bind_ricci_modcluster_port(ricci_modclusterd_t)
|
||||
corenet_tcp_connect_ricci_modcluster_port(ricci_modclusterd_t)
|
||||
|
||||
domain_dontaudit_read_all_domains_state(ricci_modclusterd_t)
|
||||
|
||||
files_read_etc_files(ricci_modclusterd_t)
|
||||
files_read_etc_runtime_files(ricci_modclusterd_t)
|
||||
|
||||
fs_getattr_xattr_fs(ricci_modclusterd_t)
|
||||
|
||||
init_dontaudit_use_fds(ricci_modclusterd_t)
|
||||
init_dontaudit_stream_connect_script(ricci_modclusterd_t)
|
||||
|
||||
libs_use_ld_so(ricci_modclusterd_t)
|
||||
libs_use_shared_libs(ricci_modclusterd_t)
|
||||
|
||||
locallogin_dontaudit_use_fds(ricci_modclusterd_t)
|
||||
|
||||
logging_send_syslog_msg(ricci_modclusterd_t)
|
||||
|
||||
miscfiles_read_localization(ricci_modclusterd_t)
|
||||
|
||||
sysnet_domtrans_ifconfig(ricci_modclusterd_t)
|
||||
sysnet_dns_name_resolve(ricci_modclusterd_t)
|
||||
|
||||
ifdef(`targeted_policy', `
|
||||
term_dontaudit_use_console(ricci_modclusterd_t)
|
||||
term_dontaudit_use_generic_ptys(ricci_modclusterd_t)
|
||||
term_dontaudit_use_unallocated_ttys(ricci_modclusterd_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
ccs_domtrans(ricci_modclusterd_t)
|
||||
ccs_stream_connect(ricci_modclusterd_t)
|
||||
ccs_read_config(ricci_modclusterd_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
unconfined_use_fds(ricci_modclusterd_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
#
|
||||
# ricci_modlog local policy
|
||||
#
|
||||
|
||||
allow ricci_modlog_t self:capability sys_nice;
|
||||
allow ricci_modlog_t self:process setsched;
|
||||
|
||||
kernel_read_kernel_sysctls(ricci_modlog_t)
|
||||
kernel_read_system_state(ricci_modlog_t)
|
||||
|
||||
corecmd_exec_bin(ricci_modlog_t)
|
||||
corecmd_exec_sbin(ricci_modlog_t)
|
||||
|
||||
domain_dontaudit_read_all_domains_state(ricci_modlog_t)
|
||||
|
||||
files_read_etc_files(ricci_modlog_t)
|
||||
files_search_usr(ricci_modlog_t)
|
||||
|
||||
libs_use_ld_so(ricci_modlog_t)
|
||||
libs_use_shared_libs(ricci_modlog_t)
|
||||
|
||||
logging_read_generic_logs(ricci_modlog_t)
|
||||
|
||||
miscfiles_read_localization(ricci_modlog_t)
|
||||
|
||||
|
||||
optional_policy(`
|
||||
nscd_dontaudit_search_pid(ricci_modlog_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
oddjob_system_entry(ricci_modlog_t, ricci_modlog_exec_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
#
|
||||
# ricci_modrpm local policy
|
||||
#
|
||||
|
||||
allow ricci_modrpm_t self:fifo_file { getattr read };
|
||||
|
||||
corecmd_exec_bin(ricci_modrpm_t)
|
||||
|
||||
libs_use_ld_so(ricci_modrpm_t)
|
||||
libs_use_shared_libs(ricci_modrpm_t)
|
||||
|
||||
files_search_usr(ricci_modrpm_t)
|
||||
files_read_etc_files(ricci_modrpm_t)
|
||||
|
||||
miscfiles_read_localization(ricci_modrpm_t)
|
||||
|
||||
optional_policy(`
|
||||
oddjob_system_entry(ricci_modrpm_t, ricci_modrpm_exec_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
rpm_domtrans(ricci_modrpm_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
#
|
||||
# ricci_modservice local policy
|
||||
#
|
||||
|
||||
allow ricci_modservice_t self:capability { dac_override sys_nice };
|
||||
allow ricci_modservice_t self:fifo_file { getattr read write };
|
||||
allow ricci_modservice_t self:process setsched;
|
||||
|
||||
kernel_read_kernel_sysctls(ricci_modservice_t)
|
||||
kernel_read_system_state(ricci_modservice_t)
|
||||
|
||||
corecmd_exec_sbin(ricci_modservice_t)
|
||||
corecmd_exec_bin(ricci_modservice_t)
|
||||
corecmd_exec_shell(ricci_modservice_t)
|
||||
|
||||
files_read_etc_files(ricci_modservice_t)
|
||||
files_read_etc_runtime_files(ricci_modservice_t)
|
||||
files_search_usr(ricci_modservice_t)
|
||||
|
||||
consoletype_exec(ricci_modservice_t)
|
||||
|
||||
init_domtrans_script(ricci_modservice_t)
|
||||
|
||||
libs_use_ld_so(ricci_modservice_t)
|
||||
libs_use_shared_libs(ricci_modservice_t)
|
||||
|
||||
miscfiles_read_localization(ricci_modservice_t)
|
||||
|
||||
optional_policy(`
|
||||
ccs_read_config(ricci_modservice_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
nscd_dontaudit_search_pid(ricci_modservice_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
oddjob_system_entry(ricci_modservice_t, ricci_modservice_exec_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
#
|
||||
# ricci_modstorage local policy
|
||||
#
|
||||
|
||||
allow ricci_modstorage_t self:process { setsched signal };
|
||||
allow ricci_modstorage_t self:capability { mknod sys_nice };
|
||||
allow ricci_modstorage_t self:fifo_file rw_file_perms;
|
||||
allow ricci_modstorage_t self:unix_dgram_socket create_socket_perms;
|
||||
|
||||
kernel_read_kernel_sysctls(ricci_modstorage_t)
|
||||
kernel_read_system_state(ricci_modstorage_t)
|
||||
|
||||
corecmd_exec_bin(ricci_modstorage_t)
|
||||
corecmd_exec_sbin(ricci_modstorage_t)
|
||||
|
||||
dev_read_sysfs(ricci_modstorage_t)
|
||||
dev_read_urand(ricci_modstorage_t)
|
||||
dev_manage_generic_blk_files(ricci_modstorage_t)
|
||||
|
||||
#Needed for editing /etc/fstab
|
||||
files_manage_etc_files(ricci_modstorage_t)
|
||||
files_read_etc_runtime_files(ricci_modstorage_t)
|
||||
files_read_usr_files(ricci_modstorage_t)
|
||||
|
||||
storage_raw_read_fixed_disk(ricci_modstorage_t)
|
||||
|
||||
term_dontaudit_use_console(ricci_modstorage_t)
|
||||
|
||||
fstools_domtrans(ricci_modstorage_t)
|
||||
|
||||
libs_use_ld_so(ricci_modstorage_t)
|
||||
libs_use_shared_libs(ricci_modstorage_t)
|
||||
|
||||
logging_send_syslog_msg(ricci_modstorage_t)
|
||||
|
||||
lvm_domtrans(ricci_modstorage_t)
|
||||
lvm_read_config(ricci_modstorage_t)
|
||||
|
||||
miscfiles_read_localization(ricci_modstorage_t)
|
||||
|
||||
modutils_read_module_deps(ricci_modstorage_t)
|
||||
|
||||
optional_policy(`
|
||||
ccs_read_config(ricci_modstorage_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
lvm_domtrans(ricci_modstorage_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
oddjob_system_entry(ricci_modstorage_t, ricci_modstorage_exec_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
raid_domtrans_mdadm(ricci_modstorage_t)
|
||||
')
|
||||
Loading…
Reference in New Issue
Block a user