## System initialization programs (init and init scripts). ######################################## ## ## Create a file type used for init scripts. ## ## ##

## Create a file type used for init scripts. It can not be ## used in conjunction with init_script_domain(). These ## script files are typically stored in the /etc/init.d directory. ##

##

## Typically this is used to constrain what services an ## admin can start/stop. For example, a policy writer may want ## to constrain a web administrator to only being able to ## restart the web server, not other services. This special type ## will help address that goal. ##

##

## This also makes the type usable for files; thus an ## explicit call to files_type() is redundant. ##

##
## ## ## Type to be used for a script file. ## ## ## # interface(`init_script_file',` gen_require(` type initrc_t; attribute init_script_file_type, init_run_all_scripts_domain; ') typeattribute $1 init_script_file_type; domain_entry_file(initrc_t, $1) domtrans_pattern(init_run_all_scripts_domain, $1, initrc_t) ') ######################################## ## ## Create a domain used for init scripts. ## ## ##

## Create a domain used for init scripts. ## Can not be used in conjunction with ## init_script_file(). ##

##
## ## ## Type to be used as an init script domain. ## ## ## ## ## Type of the script file used as an entry point to this domain. ## ## # interface(`init_script_domain',` gen_require(` attribute init_script_domain_type, init_script_file_type; attribute init_run_all_scripts_domain; ') typeattribute $1 init_script_domain_type; typeattribute $2 init_script_file_type; domain_type($1) domain_entry_file($1, $2) domtrans_pattern(init_run_all_scripts_domain, $2, $1) ') ######################################## ## ## Create a domain which can be started by init. ## ## ## ## Type to be used as a domain. ## ## ## ## ## Type of the program to be used as an entry point to this domain. ## ## # interface(`init_domain',` gen_require(` type init_t; role system_r; ') domain_type($1) domain_entry_file($1,$2) role system_r types $1; tunable_policy(`init_systemd',`', ` domtrans_pattern(init_t,$2,$1) allow init_t $1:unix_stream_socket create_stream_socket_perms; allow $1 init_t:unix_dgram_socket sendto; ') ifdef(`hide_broken_symptoms',` # RHEL4 systems seem to have a stray # fds open from the initrd ifdef(`distro_rhel4',` kernel_dontaudit_use_fds($1) ') ') ') ######################################## ## ## Create a domain which can be started by init, ## with a range transition. ## ## ## ## Type to be used as a domain. ## ## ## ## ## Type of the program to be used as an entry point to this domain. ## ## ## ## ## Range for the domain. ## ## # interface(`init_ranged_domain',` gen_require(` type init_t; ') init_domain($1,$2) ifdef(`enable_mcs',` range_transition init_t $2:process $3; ') ifdef(`enable_mls',` range_transition init_t $2:process $3; mls_rangetrans_target($1) ') ') ######################################## ## ## Create a domain for long running processes ## (daemons/services) which are started by init scripts. ## ## ##

## Create a domain for long running processes (daemons/services) ## which are started by init scripts. Short running processes ## should use the init_system_domain() interface instead. ## Typically all long running processes started by an init ## script (usually in /etc/init.d) will need to use this ## interface. ##

##

## The types will be made usable as a domain and file, making ## calls to domain_type() and files_type() redundant. ##

##

## If the process must also run in a specific MLS/MCS level, ## the init_ranged_daemon_domain() should be used instead. ##

##
## ## ## Type to be used as a daemon domain. ## ## ## ## ## Type of the program to be used as an entry point to this domain. ## ## ## # interface(`init_daemon_domain',` gen_require(` attribute direct_run_init, direct_init, direct_init_entry; type initrc_t; type init_t; role system_r; attribute daemon; attribute initrc_transition_domain; ') typeattribute $1 daemon; domain_type($1) domain_entry_file($1,$2) role system_r types $1; domtrans_pattern(initrc_t,$2,$1) allow initrc_t $1:process siginh; allow $1 initrc_transition_domain:fifo_file rw_inherited_fifo_file_perms; allow $1 initrc_transition_domain:fd use; tunable_policy(`init_upstart || init_systemd',` # Handle upstart direct transition to a executable domtrans_pattern(init_t,$2,$1) allow init_t $1:process siginh; ') tunable_policy(`init_systemd',` allow init_t $1:unix_stream_socket create_stream_socket_perms; allow $1 init_t:unix_dgram_socket sendto; ') # daemons started from init will # inherit fds from init for the console init_dontaudit_use_fds($1) term_dontaudit_use_console($1) # init script ptys are the stdin/out/err # when using run_init init_use_script_ptys($1) ifdef(`direct_sysadm_daemon',` domtrans_pattern(direct_run_init,$2,$1) allow direct_run_init $1:process { noatsecure siginh rlimitinh }; typeattribute $1 direct_init; typeattribute $2 direct_init_entry; userdom_dontaudit_use_user_terminals($1) ') ifdef(`hide_broken_symptoms',` # RHEL4 systems seem to have a stray # fds open from the initrd ifdef(`distro_rhel4',` kernel_dontaudit_use_fds($1) ') ') optional_policy(` nscd_socket_use($1) ') ') ######################################## ## ## Create a domain for long running processes ## (daemons/services) which are started by init scripts, ## running at a specified MLS/MCS range. ## ## ##

## Create a domain for long running processes (daemons/services) ## which are started by init scripts, running at a specified ## MLS/MCS range. Short running processes ## should use the init_ranged_system_domain() interface instead. ## Typically all long running processes started by an init ## script (usually in /etc/init.d) will need to use this ## interface if they need to run in a specific MLS/MCS range. ##

##

## The types will be made usable as a domain and file, making ## calls to domain_type() and files_type() redundant. ##

##

## If the policy build option TYPE is standard (MLS and MCS disabled), ## this interface has the same behavior as init_daemon_domain(). ##

##
## ## ## Type to be used as a daemon domain. ## ## ## ## ## Type of the program to be used as an entry point to this domain. ## ## ## ## ## MLS/MCS range for the domain. ## ## ## # interface(`init_ranged_daemon_domain',` gen_require(` type initrc_t; ') # init_daemon_domain($1,$2) ifdef(`enable_mcs',` range_transition initrc_t $2:process $3; ') ifdef(`enable_mls',` range_transition initrc_t $2:process $3; mls_rangetrans_target($1) ') ') ######################################## ## ## Create a domain for short running processes ## which are started by init scripts. ## ## ##

## Create a domain for long running processes (daemons/services) ## which are started by init scripts. These are generally applications that ## are used to initialize the system during boot. ## Long running processes ## should use the init_daemon_domain() interface instead. ## Typically all short running processes started by an init ## script (usually in /etc/init.d) will need to use this ## interface. ##

##

## The types will be made usable as a domain and file, making ## calls to domain_type() and files_type() redundant. ##

##

## If the process must also run in a specific MLS/MCS level, ## the init_ranged_system_domain() should be used instead. ##

##
## ## ## Type to be used as a system domain. ## ## ## ## ## Type of the program to be used as an entry point to this domain. ## ## ## # interface(`init_system_domain',` gen_require(` type init_t; type initrc_t; role system_r; attribute initrc_transition_domain; ') application_domain($1,$2) role system_r types $1; domtrans_pattern(initrc_t,$2,$1) allow initrc_t $1:process siginh; allow $1 initrc_transition_domain:fifo_file rw_inherited_fifo_file_perms; allow $1 initrc_transition_domain:fd use; tunable_policy(`init_systemd',` # Handle upstart/systemd direct transition to a executable domtrans_pattern(init_t,$2,$1) allow init_t $1:process siginh; allow init_t $1:unix_stream_socket create_stream_socket_perms; allow $1 init_t:unix_dgram_socket sendto; ') ifdef(`hide_broken_symptoms',` # RHEL4 systems seem to have a stray # fds open from the initrd ifdef(`distro_rhel4',` kernel_dontaudit_use_fds($1) ') ') userdom_dontaudit_search_user_home_dirs($1) userdom_dontaudit_rw_stream($1) userdom_dontaudit_write_user_tmp_files($1) tunable_policy(`allow_daemons_use_tty',` term_use_all_ttys($1) term_use_all_ptys($1) ',` term_dontaudit_use_all_ttys($1) term_dontaudit_use_all_ptys($1) ') # these apps are often redirect output to random log files logging_inherit_append_all_logs($1) optional_policy(` cron_rw_pipes($1) ') optional_policy(` xserver_dontaudit_append_xdm_home_files($1) ') optional_policy(` unconfined_dontaudit_rw_pipes($1) unconfined_dontaudit_rw_stream($1) userdom_dontaudit_read_user_tmp_files($1) ') init_rw_script_stream_sockets($1) ') ######################################## ## ## Create a domain for short running processes ## which are started by init scripts. ## ## ##

## Create a domain for long running processes (daemons/services) ## which are started by init scripts. ## These are generally applications that ## are used to initialize the system during boot. ## Long running processes ## should use the init_ranged_system_domain() interface instead. ## Typically all short running processes started by an init ## script (usually in /etc/init.d) will need to use this ## interface if they need to run in a specific MLS/MCS range. ##

##

## The types will be made usable as a domain and file, making ## calls to domain_type() and files_type() redundant. ##

##

## If the policy build option TYPE is standard (MLS and MCS disabled), ## this interface has the same behavior as init_system_domain(). ##

##
## ## ## Type to be used as a system domain. ## ## ## ## ## Type of the program to be used as an entry point to this domain. ## ## ## ## ## Range for the domain. ## ## ## # interface(`init_ranged_system_domain',` gen_require(` type initrc_t; ') init_system_domain($1,$2) ifdef(`enable_mcs',` range_transition initrc_t $2:process $3; ') ifdef(`enable_mls',` range_transition initrc_t $2:process $3; ') ') ######################################## ## ## Execute init (/sbin/init) with a domain transition. ## ## ## ## Domain allowed to transition. ## ## # interface(`init_domtrans',` gen_require(` type init_t, init_exec_t; ') domtrans_pattern($1, init_exec_t, init_t) ') ######################################## ## ## Execute the init program in the caller domain. ## ## ## ## Domain allowed access. ## ## ## # interface(`init_exec',` gen_require(` type init_exec_t; ') corecmd_search_bin($1) can_exec($1, init_exec_t) ') ######################################## ## ## Get the process group of init. ## ## ## ## Domain allowed access. ## ## # interface(`init_getpgid',` gen_require(` type init_t; ') allow $1 init_t:process getpgid; ') ######################################## ## ## Send init a null signal. ## ## ## ## Domain allowed access. ## ## # interface(`init_signull',` gen_require(` type init_t; ') allow $1 init_t:process signull; ') ######################################## ## ## Send init a SIGCHLD signal. ## ## ## ## Domain allowed access. ## ## # interface(`init_sigchld',` gen_require(` type init_t; ') allow $1 init_t:process sigchld; ') ######################################## ## ## Inherit and use file descriptors from init. ## ## ##

## Allow the specified domain to inherit file ## descriptors from the init program (process ID 1). ## Typically the only file descriptors to be ## inherited from init are for the console. ## This does not allow the domain any access to ## the object to which the file descriptors references. ##

##

## Related interfaces: ##

##
    ##
  • init_dontaudit_use_fds()
  • ##
  • term_dontaudit_use_console()
  • ##
  • term_use_console()
  • ##
##

## Example usage: ##

##

## init_use_fds(mydomain_t) ## term_use_console(mydomain_t) ##

##

## Normally, processes that can inherit these file ## descriptors (usually services) write messages to the ## system log instead of writing to the console. ## Therefore, in many cases, this access should ## dontaudited instead. ##

##

## Example dontaudit usage: ##

##

## init_dontaudit_use_fds(mydomain_t) ## term_dontaudit_use_console(mydomain_t) ##

##
## ## ## Domain allowed access. ## ## ## # interface(`init_use_fds',` gen_require(` type init_t; ') allow $1 init_t:fd use; ') ######################################## ## ## Do not audit attempts to inherit file ## descriptors from init. ## ## ## ## Domain to not audit. ## ## # interface(`init_dontaudit_use_fds',` gen_require(` type init_t; ') dontaudit $1 init_t:fd use; ') ######################################## ## ## Send UDP network traffic to init. (Deprecated) ## ## ## ## Domain allowed access. ## ## # interface(`init_udp_send',` refpolicywarn(`$0($*) has been deprecated.') ') ######################################## ## ## Get the attributes of initctl. ## ## ## ## Domain allowed access. ## ## # interface(`init_getattr_initctl',` gen_require(` type initctl_t; ') allow $1 initctl_t:fifo_file getattr; ') ######################################## ## ## Do not audit attempts to get the ## attributes of initctl. ## ## ## ## Domain to not audit. ## ## # interface(`init_dontaudit_getattr_initctl',` gen_require(` type initctl_t; ') dontaudit $1 initctl_t:fifo_file getattr; ') ######################################## ## ## Write to initctl. ## ## ## ## Domain allowed access. ## ## # interface(`init_write_initctl',` gen_require(` type initctl_t; ') dev_list_all_dev_nodes($1) allow $1 initctl_t:fifo_file write; ') ######################################## ## ## Use telinit (Read and write initctl). ## ## ## ## Domain allowed access. ## ## ## # interface(`init_telinit',` gen_require(` type initctl_t; ') corecmd_exec_bin($1) dev_list_all_dev_nodes($1) allow $1 initctl_t:fifo_file rw_fifo_file_perms; init_exec($1) tunable_policy(`init_upstart || init_systemd',` gen_require(` type init_t; ') # upstart uses a datagram socket instead of initctl pipe allow $1 self:unix_dgram_socket create_socket_perms; allow $1 init_t:unix_dgram_socket sendto; #576913 allow $1 init_t:unix_stream_socket connectto; ') ') ######################################## ## ## Read and write initctl. ## ## ## ## Domain allowed access. ## ## # interface(`init_rw_initctl',` gen_require(` type initctl_t; ') dev_list_all_dev_nodes($1) allow $1 initctl_t:fifo_file rw_fifo_file_perms; ') ######################################## ## ## Do not audit attempts to read and ## write initctl. ## ## ## ## Domain allowed access. ## ## # interface(`init_dontaudit_rw_initctl',` gen_require(` type initctl_t; ') dontaudit $1 initctl_t:fifo_file { read write }; ') ######################################## ## ## Make init scripts an entry point for ## the specified domain. ## ## ## ## Domain allowed access. ## ## # cjp: added for gentoo integrated run_init interface(`init_script_file_entry_type',` gen_require(` type initrc_exec_t; ') domain_entry_file($1, initrc_exec_t) ') ######################################## ## ## Execute init scripts with a specified domain transition. ## ## ## ## Domain allowed to transition. ## ## # interface(`init_spec_domtrans_script',` gen_require(` type initrc_t; attribute init_script_file_type; ') files_list_etc($1) spec_domtrans_pattern($1, init_script_file_type, initrc_t) ifdef(`enable_mcs',` range_transition $1 init_script_file_type:process s0; ') ifdef(`enable_mls',` range_transition $1 init_script_file_type:process s0 - mls_systemhigh; ') ') ######################################## ## ## Execute init scripts with an automatic domain transition. ## ## ## ## Domain allowed to transition. ## ## # interface(`init_domtrans_script',` gen_require(` type initrc_t; attribute init_script_file_type; attribute initrc_transition_domain; ') typeattribute $1 initrc_transition_domain; files_list_etc($1) domtrans_pattern($1, init_script_file_type, initrc_t) ifdef(`enable_mcs',` range_transition $1 init_script_file_type:process s0; ') ifdef(`enable_mls',` range_transition $1 init_script_file_type:process s0 - mls_systemhigh; ') ') ######################################## ## ## Execute a file in a bin directory ## in the initrc_t domain ## ## ## ## Domain allowed access. ## ## # interface(`init_bin_domtrans_spec',` gen_require(` type initrc_t; ') corecmd_bin_domtrans($1, initrc_t) ') ######################################## ## ## Execute a init script in a specified domain. ## ## ##

## Execute a init script in a specified domain. ##

##

## No interprocess communication (signals, pipes, ## etc.) is provided by this interface since ## the domains are not owned by this module. ##

##
## ## ## Domain allowed to transition. ## ## ## ## ## Domain to transition to. ## ## # cjp: added for gentoo integrated run_init interface(`init_script_file_domtrans',` gen_require(` type initrc_exec_t; ') files_list_etc($1) domain_auto_trans($1, initrc_exec_t,$2) ') ######################################## ## ## Transition to the init script domain ## on a specified labeled init script. ## ## ## ## Domain allowed to transition. ## ## ## ## ## Labeled init script file. ## ## # interface(`init_labeled_script_domtrans',` gen_require(` type initrc_t; attribute initrc_transition_domain; ') typeattribute $1 initrc_transition_domain; domtrans_pattern($1, $2, initrc_t) files_search_etc($1) ') ######################################### ## ## Transition to the init script domain ## for all labeled init script types ## ## ## ## Domain allowed to transition. ## ## # interface(`init_all_labeled_script_domtrans',` gen_require(` attribute init_script_file_type; ') init_labeled_script_domtrans($1, init_script_file_type) ') ######################################## ## ## Start and stop daemon programs directly. ## ## ##

## Start and stop daemon programs directly ## in the traditional "/etc/init.d/daemon start" ## style, and do not require run_init. ##

##
## ## ## Domain allowed access. ## ## ## ## ## The role to be performing this action. ## ## # interface(`init_run_daemon',` gen_require(` attribute direct_run_init, direct_init, direct_init_entry; role system_r; ') typeattribute $1 direct_run_init; role_transition $2 direct_init_entry system_r; ') ######################################## ## ## Read the process state (/proc/pid) of init. ## ## ## ## Domain allowed access. ## ## # interface(`init_read_state',` gen_require(` attribute init_t; ') allow $1 init_t:dir search_dir_perms; allow $1 init_t:file read_file_perms; allow $1 init_t:lnk_file read_lnk_file_perms; ') ######################################## ## ## Ptrace init ## ## ## ## Domain allowed access. ## ## ## # interface(`init_ptrace',` gen_require(` attribute init_t; ') allow $1 init_t:process ptrace; ') ######################################## ## ## Write an init script unnamed pipe. ## ## ## ## Domain allowed access. ## ## # interface(`init_write_script_pipes',` gen_require(` type initrc_t; ') allow $1 initrc_t:fifo_file write; ') ######################################## ## ## Get the attribute of init script entrypoint files. ## ## ## ## Domain allowed access. ## ## # interface(`init_getattr_script_files',` gen_require(` type initrc_exec_t; ') files_list_etc($1) allow $1 initrc_exec_t:file getattr; ') ######################################## ## ## Read init scripts. ## ## ## ## Domain allowed access. ## ## # interface(`init_read_script_files',` gen_require(` type initrc_exec_t; ') files_search_etc($1) allow $1 initrc_exec_t:file read_file_perms; ') ######################################## ## ## Execute init scripts in the caller domain. ## ## ## ## Domain allowed access. ## ## # interface(`init_exec_script_files',` gen_require(` type initrc_exec_t; ') files_list_etc($1) can_exec($1, initrc_exec_t) ') ######################################## ## ## Get the attribute of all init script entrypoint files. ## ## ## ## Domain allowed access. ## ## # interface(`init_getattr_all_script_files',` gen_require(` attribute init_script_file_type; ') files_list_etc($1) allow $1 init_script_file_type:file getattr; ') ######################################## ## ## Read all init script files. ## ## ## ## Domain allowed access. ## ## # interface(`init_read_all_script_files',` gen_require(` attribute init_script_file_type; ') files_search_etc($1) allow $1 init_script_file_type:file read_file_perms; ') ####################################### ## ## Dontaudit read all init script files. ## ## ## ## Domain to not audit. ## ## # interface(`init_dontaudit_read_all_script_files',` gen_require(` attribute init_script_file_type; ') dontaudit $1 init_script_file_type:file read_file_perms; ') ######################################## ## ## Execute all init scripts in the caller domain. ## ## ## ## Domain allowed access. ## ## # interface(`init_exec_all_script_files',` gen_require(` attribute init_script_file_type; ') files_list_etc($1) can_exec($1, init_script_file_type) ') ######################################## ## ## Read the process state (/proc/pid) of the init scripts. ## ## ## ## Domain allowed access. ## ## # interface(`init_read_script_state',` gen_require(` type initrc_t; ') kernel_search_proc($1) read_files_pattern($1, initrc_t, initrc_t) read_lnk_files_pattern($1, initrc_t, initrc_t) list_dirs_pattern($1, initrc_t, initrc_t) # should move this to separate interface allow $1 initrc_t:process getattr; ') ######################################## ## ## Inherit and use init script file descriptors. ## ## ## ## Domain allowed access. ## ## # interface(`init_use_script_fds',` gen_require(` type initrc_t; ') allow $1 initrc_t:fd use; ') ######################################## ## ## Do not audit attempts to inherit ## init script file descriptors. ## ## ## ## Domain to not audit. ## ## # interface(`init_dontaudit_use_script_fds',` gen_require(` type initrc_t; ') dontaudit $1 initrc_t:fd use; ') ######################################## ## ## Get the process group ID of init scripts. ## ## ## ## Domain allowed access. ## ## # interface(`init_getpgid_script',` gen_require(` type initrc_t; ') allow $1 initrc_t:process getpgid; ') ######################################## ## ## Send SIGCHLD signals to init scripts. ## ## ## ## Domain allowed access. ## ## # interface(`init_sigchld_script',` gen_require(` type initrc_t; ') allow $1 initrc_t:process sigchld; ') ######################################## ## ## Send generic signals to init scripts. ## ## ## ## Domain allowed access. ## ## # interface(`init_signal_script',` gen_require(` type initrc_t; ') allow $1 initrc_t:process signal; ') ######################################## ## ## Send null signals to init scripts. ## ## ## ## Domain allowed access. ## ## # interface(`init_signull_script',` gen_require(` type initrc_t; ') allow $1 initrc_t:process signull; ') ######################################## ## ## Read and write init script unnamed pipes. ## ## ## ## Domain allowed access. ## ## # interface(`init_rw_script_pipes',` gen_require(` type initrc_t; ') allow $1 initrc_t:fifo_file { read write }; ') ######################################## ## ## Send UDP network traffic to init scripts. (Deprecated) ## ## ## ## Domain allowed access. ## ## # interface(`init_udp_send_script',` refpolicywarn(`$0($*) has been deprecated.') ') ######################################## ## ## Allow the specified domain to connect to ## init scripts with a unix socket. ## ## ## ## Domain allowed access. ## ## # interface(`init_stream_connect_script',` gen_require(` type initrc_t; ') allow $1 initrc_t:unix_stream_socket connectto; ') ######################################## ## ## Allow the specified domain to read/write to ## init scripts with a unix domain stream sockets. ## ## ## ## Domain allowed access. ## ## # interface(`init_rw_script_stream_sockets',` gen_require(` type initrc_t; ') allow $1 initrc_t:unix_stream_socket rw_socket_perms; ') ######################################## ## ## Dont audit the specified domain connecting to ## init scripts with a unix domain stream socket. ## ## ## ## Domain to not audit. ## ## # interface(`init_dontaudit_stream_connect_script',` gen_require(` type initrc_t; ') dontaudit $1 initrc_t:unix_stream_socket connectto; ') ######################################## ## ## Send messages to init scripts over dbus. ## ## ## ## Domain allowed access. ## ## # interface(`init_dbus_send_script',` gen_require(` type initrc_t; class dbus send_msg; ') allow $1 initrc_t:dbus send_msg; ') ######################################## ## ## Send and receive messages from ## init over dbus. ## ## ## ## Domain allowed access. ## ## # interface(`init_dbus_chat',` gen_require(` type init_t; class dbus send_msg; ') allow $1 init_t:dbus send_msg; allow init_t $1:dbus send_msg; ') ######################################## ## ## Send and receive messages from ## init scripts over dbus. ## ## ## ## Domain allowed access. ## ## # interface(`init_dbus_chat_script',` gen_require(` type initrc_t; class dbus send_msg; ') allow $1 initrc_t:dbus send_msg; allow initrc_t $1:dbus send_msg; ') ######################################## ## ## Read and write the init script pty. ## ## ##

## Read and write the init script pty. This ## pty is generally opened by the open_init_pty ## portion of the run_init program so that the ## daemon does not require direct access to ## the administrator terminal. ##

##
## ## ## Domain allowed access. ## ## # interface(`init_use_script_ptys',` gen_require(` type initrc_devpts_t; ') term_list_ptys($1) allow $1 initrc_devpts_t:chr_file { rw_term_perms lock append }; ') ######################################## ## ## Do not audit attempts to read and ## write the init script pty. ## ## ## ## Domain to not audit. ## ## # interface(`init_dontaudit_use_script_ptys',` gen_require(` type initrc_devpts_t; ') dontaudit $1 initrc_devpts_t:chr_file { rw_term_perms lock append }; ') ######################################## ## ## Get the attributes of init script ## status files. ## ## ## ## Domain allowed access. ## ## # interface(`init_getattr_script_status_files',` gen_require(` type initrc_state_t; ') getattr_files_pattern($1, initrc_state_t, initrc_state_t) ') ######################################## ## ## Do not audit attempts to read init script ## status files. ## ## ## ## Domain to not audit. ## ## # interface(`init_dontaudit_read_script_status_files',` gen_require(` type initrc_state_t; ') dontaudit $1 initrc_state_t:dir search_dir_perms; dontaudit $1 initrc_state_t:file read_file_perms; ') ######################################## ## ## Read init script temporary data. ## ## ## ## Domain allowed access. ## ## # interface(`init_read_script_tmp_files',` gen_require(` type initrc_tmp_t; ') files_search_tmp($1) read_files_pattern($1, initrc_tmp_t, initrc_tmp_t) ') ######################################## ## ## Read and write init script temporary data. ## ## ## ## Domain allowed access. ## ## # interface(`init_rw_script_tmp_files',` gen_require(` type initrc_tmp_t; ') files_search_tmp($1) rw_files_pattern($1, initrc_tmp_t, initrc_tmp_t) ') ######################################## ## ## Create files in a init script ## temporary data directory. ## ## ## ## Domain allowed access. ## ## ## ## ## The type of the object to be created ## ## ## ## ## The object class. ## ## # interface(`init_script_tmp_filetrans',` gen_require(` type initrc_tmp_t; ') files_search_tmp($1) filetrans_pattern($1, initrc_tmp_t, $2, $3) ') ######################################## ## ## Get the attributes of init script process id files. ## ## ## ## Domain allowed access. ## ## # interface(`init_getattr_utmp',` gen_require(` type initrc_var_run_t; ') allow $1 initrc_var_run_t:file getattr; ') ######################################## ## ## Read utmp. ## ## ## ## Domain allowed access. ## ## # interface(`init_read_utmp',` gen_require(` type initrc_var_run_t; ') files_list_pids($1) allow $1 initrc_var_run_t:file read_file_perms; ') ######################################## ## ## Do not audit attempts to write utmp. ## ## ## ## Domain to not audit. ## ## # interface(`init_dontaudit_write_utmp',` gen_require(` type initrc_var_run_t; ') dontaudit $1 initrc_var_run_t:file { write lock }; ') ######################################## ## ## Write to utmp. ## ## ## ## Domain allowed access. ## ## # interface(`init_write_utmp',` gen_require(` type initrc_var_run_t; ') files_list_pids($1) allow $1 initrc_var_run_t:file { getattr open write }; ') ######################################## ## ## Do not audit attempts to lock ## init script pid files. ## ## ## ## Domain to not audit. ## ## # interface(`init_dontaudit_lock_utmp',` gen_require(` type initrc_var_run_t; ') dontaudit $1 initrc_var_run_t:file lock; ') ######################################## ## ## Read and write utmp. ## ## ## ## Domain allowed access. ## ## # interface(`init_rw_utmp',` gen_require(` type initrc_var_run_t; ') files_list_pids($1) allow $1 initrc_var_run_t:file rw_file_perms; ') ######################################## ## ## Do not audit attempts to read and write utmp. ## ## ## ## Domain to not audit. ## ## # interface(`init_dontaudit_rw_utmp',` gen_require(` type initrc_var_run_t; ') dontaudit $1 initrc_var_run_t:file rw_file_perms; ') ######################################## ## ## Create, read, write, and delete utmp. ## ## ## ## Domain allowed access. ## ## # interface(`init_manage_utmp',` gen_require(` type initrc_var_run_t; ') files_search_pids($1) allow $1 initrc_var_run_t:file manage_file_perms; ') ######################################## ## ## Create files in /var/run with the ## utmp file type. ## ## ## ## Domain allowed access. ## ## # interface(`init_pid_filetrans_utmp',` gen_require(` type initrc_var_run_t; ') files_pid_filetrans($1, initrc_var_run_t, file) ') ######################################## ## ## Allow the specified domain to connect to daemon with a tcp socket ## ## ## ## Domain allowed access. ## ## # interface(`init_tcp_recvfrom_all_daemons',` gen_require(` attribute daemon; ') corenet_tcp_recvfrom_labeled($1, daemon) ') ######################################## ## ## Allow the specified domain to connect to daemon with a udp socket ## ## ## ## Domain allowed access. ## ## # interface(`init_udp_recvfrom_all_daemons',` gen_require(` attribute daemon; ') corenet_udp_recvfrom_labeled($1, daemon) ') ######################################## ## ## Transition to system_r when execute an init script ## ## ##

## Execute a init script in a specified role ##

##

## No interprocess communication (signals, pipes, ## etc.) is provided by this interface since ## the domains are not owned by this module. ##

##
## ## ## Role to transition from. ## ## # interface(`init_script_role_transition',` gen_require(` attribute init_script_file_type; ') role_transition $1 init_script_file_type system_r; ') ######################################## ## ## dontaudit read and write an leaked init scrip file descriptors ## ## ## ## Domain allowed access. ## ## # interface(`init_dontaudit_script_leaks',` gen_require(` type initrc_t; ') dontaudit $1 initrc_t:tcp_socket { read write }; dontaudit $1 initrc_t:udp_socket { read write }; dontaudit $1 initrc_t:unix_dgram_socket { read write }; dontaudit $1 initrc_t:unix_stream_socket { read write }; dontaudit $1 initrc_t:shm rw_shm_perms; init_dontaudit_use_script_ptys($1) init_dontaudit_use_script_fds($1) ') ######################################## ## ## Allow the specified domain to connect to ## the init process with a unix socket. ## ## ## ## Domain allowed access. ## ## # interface(`init_stream_connect',` gen_require(` type init_t; ') allow $1 init_t:unix_stream_socket connectto; ') ######################################## ## ## Allow the specified domain to read/write to ## init with a unix domain stream sockets. ## ## ## ## Domain allowed access. ## ## # interface(`init_rw_stream_sockets',` gen_require(` type init_t; ') allow $1 init_t:unix_stream_socket rw_stream_socket_perms; ')