##
## Allow BIND to write the master zone files.
## Generally this is used for dynamic DNS or zone transfers.
@@ -16,6 +23,7 @@ gen_tunable(named_write_master_zones, false)
# for DNSSEC key files
type dnssec_t;
files_security_file(dnssec_t)
+files_mountpoint(dnssec_t)
type named_t;
type named_exec_t;
@@ -27,7 +35,7 @@ init_system_domain(named_t, named_checkconf_exec_t)
# A type for configuration files of named.
type named_conf_t;
-files_type(named_conf_t)
+files_config_file(named_conf_t)
files_mountpoint(named_conf_t)
# for secondary zone files
@@ -37,6 +45,9 @@ files_type(named_cache_t)
type named_initrc_exec_t;
init_script_file(named_initrc_exec_t)
+type named_unit_file_t;
+systemd_unit_file(named_unit_file_t)
+
type named_log_t;
logging_log_file(named_log_t)
@@ -89,9 +100,10 @@ manage_dirs_pattern(named_t, named_tmp_t, named_tmp_t)
manage_files_pattern(named_t, named_tmp_t, named_tmp_t)
files_tmp_filetrans(named_t, named_tmp_t, { file dir })
+manage_dirs_pattern(named_t, named_var_run_t, named_var_run_t)
manage_files_pattern(named_t, named_var_run_t, named_var_run_t)
manage_sock_files_pattern(named_t, named_var_run_t, named_var_run_t)
-files_pid_filetrans(named_t, named_var_run_t, { file sock_file })
+files_pid_filetrans(named_t, named_var_run_t, { file sock_file dir })
# read zone files
allow named_t named_zone_t:dir list_dir_perms;
@@ -131,7 +143,6 @@ dev_read_urand(named_t)
domain_use_interactive_fds(named_t)
-files_read_etc_files(named_t)
files_read_etc_runtime_files(named_t)
fs_getattr_all_fs(named_t)
@@ -147,6 +158,10 @@ miscfiles_read_generic_certs(named_t)
userdom_dontaudit_use_unpriv_user_fds(named_t)
userdom_dontaudit_search_user_home_dirs(named_t)
+tunable_policy(`named_bind_http_port',`
+ corenet_tcp_bind_http_port(named_t)
+')
+
tunable_policy(`named_write_master_zones',`
manage_dirs_pattern(named_t, named_zone_t, named_zone_t)
manage_files_pattern(named_t, named_zone_t, named_zone_t)
@@ -154,6 +169,12 @@ tunable_policy(`named_write_master_zones',`
')
optional_policy(`
+ # needed by FreeIPA with DNS support
+ dirsrv_stream_connect(named_t)
+ ldap_stream_connect(named_t)
+')
+
+optional_policy(`
init_dbus_chat_script(named_t)
sysnet_dbus_chat_dhcpc(named_t)
@@ -206,10 +227,11 @@ allow ndc_t dnssec_t:lnk_file { getattr read };
stream_connect_pattern(ndc_t, named_var_run_t, named_var_run_t, named_t)
allow ndc_t named_conf_t:file read_file_perms;
-allow ndc_t named_conf_t:lnk_file { getattr read };
+allow ndc_t named_conf_t:lnk_file read_lnk_file_perms;
allow ndc_t named_zone_t:dir search_dir_perms;
+kernel_read_system_state(ndc_t)
kernel_read_kernel_sysctls(ndc_t)
corenet_all_recvfrom_unlabeled(ndc_t)
@@ -223,11 +245,12 @@ corenet_sendrecv_rndc_client_packets(ndc_t)
domain_use_interactive_fds(ndc_t)
-files_read_etc_files(ndc_t)
files_search_pids(ndc_t)
fs_getattr_xattr_fs(ndc_t)
+auth_use_nsswitch(ndc_t)
+
init_use_fds(ndc_t)
init_use_script_ptys(ndc_t)
@@ -235,16 +258,16 @@ logging_send_syslog_msg(ndc_t)
miscfiles_read_localization(ndc_t)
+userdom_use_inherited_user_terminals(ndc_t)
+
sysnet_read_config(ndc_t)
sysnet_dns_name_resolve(ndc_t)
-userdom_use_user_terminals(ndc_t)
-
term_dontaudit_use_console(ndc_t)
# for /etc/rndc.key
ifdef(`distro_redhat',`
- allow ndc_t named_conf_t:dir search;
+ allow ndc_t named_conf_t:dir search_dir_perms;
')
optional_policy(`
diff --git a/bitlbee.fc b/bitlbee.fc
index 0197980..909ce04 100644
--- a/bitlbee.fc
+++ b/bitlbee.fc
@@ -1,6 +1,13 @@
/etc/rc\.d/init\.d/bitlbee -- gen_context(system_u:object_r:bitlbee_initrc_exec_t,s0)
/etc/bitlbee(/.*)? gen_context(system_u:object_r:bitlbee_conf_t,s0)
+/usr/bin/bip -- gen_context(system_u:object_r:bitlbee_exec_t,s0)
/usr/sbin/bitlbee -- gen_context(system_u:object_r:bitlbee_exec_t,s0)
/var/lib/bitlbee(/.*)? gen_context(system_u:object_r:bitlbee_var_t,s0)
+
+/var/log/bip(/.*)? gen_context(system_u:object_r:bitlbee_log_t,s0)
+
+/var/run/bitlbee\.pid -- gen_context(system_u:object_r:bitlbee_var_run_t,s0)
+/var/run/bitlbee\.sock -s gen_context(system_u:object_r:bitlbee_var_run_t,s0)
+/var/run/bip(/.*)? gen_context(system_u:object_r:bitlbee_var_run_t,s0)
diff --git a/bitlbee.if b/bitlbee.if
index de0bd67..1df2048 100644
--- a/bitlbee.if
+++ b/bitlbee.if
@@ -43,9 +43,13 @@ interface(`bitlbee_admin',`
type bitlbee_initrc_exec_t;
')
- allow $1 bitlbee_t:process { ptrace signal_perms };
+ allow $1 bitlbee_t:process signal_perms;
ps_process_pattern($1, bitlbee_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 bitlbee_t:process ptrace;
+ ')
+
init_labeled_script_domtrans($1, bitlbee_initrc_exec_t)
domain_system_change_exemption($1)
role_transition $2 bitlbee_initrc_exec_t system_r;
diff --git a/bitlbee.te b/bitlbee.te
index f4e7ad3..df0296d 100644
--- a/bitlbee.te
+++ b/bitlbee.te
@@ -22,29 +22,47 @@ files_tmp_file(bitlbee_tmp_t)
type bitlbee_var_t;
files_type(bitlbee_var_t)
+type bitlbee_log_t;
+logging_log_file(bitlbee_log_t)
+
+type bitlbee_var_run_t;
+files_pid_file(bitlbee_var_run_t)
+
########################################
#
# Local policy
#
-allow bitlbee_t self:capability { setgid setuid };
-allow bitlbee_t self:process signal;
+allow bitlbee_t self:capability { dac_override kill setgid setuid sys_nice };
+allow bitlbee_t self:process { setsched signal };
+
+allow bitlbee_t self:fifo_file rw_fifo_file_perms;
allow bitlbee_t self:udp_socket create_socket_perms;
allow bitlbee_t self:tcp_socket { create_stream_socket_perms connected_stream_socket_perms };
allow bitlbee_t self:unix_stream_socket create_stream_socket_perms;
-allow bitlbee_t self:fifo_file rw_fifo_file_perms;
+allow bitlbee_t self:netlink_route_socket r_netlink_socket_perms;
bitlbee_read_config(bitlbee_t)
# tmp files
manage_files_pattern(bitlbee_t, bitlbee_tmp_t, bitlbee_tmp_t)
-files_tmp_filetrans(bitlbee_t, bitlbee_tmp_t, file)
+manage_dirs_pattern(bitlbee_t, bitlbee_tmp_t, bitlbee_tmp_t)
+files_tmp_filetrans(bitlbee_t, bitlbee_tmp_t, { dir file })
# user account information is read and edited at runtime; give the usual
# r/w access to bitlbee_var_t
manage_files_pattern(bitlbee_t, bitlbee_var_t, bitlbee_var_t)
files_var_lib_filetrans(bitlbee_t, bitlbee_var_t, file)
+# log files
+manage_dirs_pattern(bitlbee_t, bitlbee_log_t, bitlbee_log_t)
+manage_files_pattern(bitlbee_t, bitlbee_log_t, bitlbee_log_t)
+
+manage_dirs_pattern(bitlbee_t, bitlbee_var_run_t, bitlbee_var_run_t)
+manage_files_pattern(bitlbee_t, bitlbee_var_run_t, bitlbee_var_run_t)
+manage_sock_files_pattern(bitlbee_t, bitlbee_var_run_t, bitlbee_var_run_t)
+files_pid_filetrans(bitlbee_t, bitlbee_var_run_t, { dir file sock_file })
+
kernel_read_system_state(bitlbee_t)
corenet_all_recvfrom_unlabeled(bitlbee_t)
@@ -52,6 +70,9 @@ corenet_udp_sendrecv_generic_if(bitlbee_t)
corenet_udp_sendrecv_generic_node(bitlbee_t)
corenet_tcp_sendrecv_generic_if(bitlbee_t)
corenet_tcp_sendrecv_generic_node(bitlbee_t)
+corenet_tcp_bind_generic_node(bitlbee_t)
+corenet_tcp_connect_gatekeeper_port(bitlbee_t)
+corenet_tcp_connect_ircd_port(bitlbee_t)
# Allow bitlbee to connect to jabber servers
corenet_tcp_connect_jabber_client_port(bitlbee_t)
corenet_tcp_sendrecv_jabber_client_port(bitlbee_t)
@@ -69,11 +90,15 @@ corenet_tcp_connect_http_port(bitlbee_t)
corenet_tcp_sendrecv_http_port(bitlbee_t)
corenet_tcp_connect_http_cache_port(bitlbee_t)
corenet_tcp_sendrecv_http_cache_port(bitlbee_t)
+corenet_tcp_bind_ircd_port(bitlbee_t)
+corenet_tcp_sendrecv_ircd_port(bitlbee_t)
+corenet_sendrecv_ircd_server_packets(bitlbee_t)
+corenet_tcp_bind_interwise_port(bitlbee_t)
+corenet_tcp_sendrecv_interwise_port(bitlbee_t)
dev_read_rand(bitlbee_t)
dev_read_urand(bitlbee_t)
-files_read_etc_files(bitlbee_t)
files_search_pids(bitlbee_t)
# grant read-only access to the user help files
files_read_usr_files(bitlbee_t)
diff --git a/blueman.fc b/blueman.fc
new file mode 100644
index 0000000..98ba16a
--- /dev/null
+++ b/blueman.fc
@@ -0,0 +1,4 @@
+
+/usr/libexec/blueman-mechanism -- gen_context(system_u:object_r:blueman_exec_t,s0)
+
+/var/lib/blueman(/.*)? gen_context(system_u:object_r:blueman_var_lib_t,s0)
diff --git a/blueman.if b/blueman.if
new file mode 100644
index 0000000..a66b2ff
--- /dev/null
+++ b/blueman.if
@@ -0,0 +1,99 @@
+## policy for blueman
+
+########################################
+##
+## Transition to blueman.
+##
+##
+##
+## Domain allowed to transition.
+##
+##
+#
+interface(`blueman_domtrans',`
+ gen_require(`
+ type blueman_t, blueman_exec_t;
+ ')
+
+ corecmd_search_bin($1)
+ domtrans_pattern($1, blueman_exec_t, blueman_t)
+')
+
+########################################
+##
+## Send and receive messages from
+## blueman over dbus.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`blueman_dbus_chat',`
+ gen_require(`
+ type blueman_t;
+ class dbus send_msg;
+ ')
+
+ allow $1 blueman_t:dbus send_msg;
+ allow blueman_t $1:dbus send_msg;
+')
+
+########################################
+##
+## Search blueman lib directories.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`blueman_search_lib',`
+ gen_require(`
+ type blueman_var_lib_t;
+ ')
+
+ allow $1 blueman_var_lib_t:dir search_dir_perms;
+ files_search_var_lib($1)
+')
+
+########################################
+##
+## Read blueman lib files.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`blueman_read_lib_files',`
+ gen_require(`
+ type blueman_var_lib_t;
+ ')
+
+ files_search_var_lib($1)
+ read_files_pattern($1, blueman_var_lib_t, blueman_var_lib_t)
+')
+
+########################################
+##
+## Create, read, write, and delete
+## blueman lib files.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`blueman_manage_lib_files',`
+ gen_require(`
+ type blueman_var_lib_t;
+ ')
+
+ files_search_var_lib($1)
+ manage_files_pattern($1, blueman_var_lib_t, blueman_var_lib_t)
+')
diff --git a/blueman.te b/blueman.te
new file mode 100644
index 0000000..5000a2a
--- /dev/null
+++ b/blueman.te
@@ -0,0 +1,55 @@
+policy_module(blueman, 1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type blueman_t;
+type blueman_exec_t;
+dbus_system_domain(blueman_t, blueman_exec_t)
+init_daemon_domain(blueman_t, blueman_exec_t)
+
+type blueman_var_lib_t;
+files_type(blueman_var_lib_t)
+
+########################################
+#
+# blueman local policy
+#
+allow blueman_t self:fifo_file rw_fifo_file_perms;
+
+manage_dirs_pattern(blueman_t, blueman_var_lib_t, blueman_var_lib_t)
+manage_files_pattern(blueman_t, blueman_var_lib_t, blueman_var_lib_t)
+files_var_lib_filetrans(blueman_t, blueman_var_lib_t, { file dir })
+
+kernel_read_system_state(blueman_t)
+
+corecmd_exec_bin(blueman_t)
+
+dev_read_rand(blueman_t)
+dev_read_urand(blueman_t)
+dev_rw_wireless(blueman_t)
+
+domain_use_interactive_fds(blueman_t)
+
+files_read_usr_files(blueman_t)
+
+auth_use_nsswitch(blueman_t)
+auth_read_passwd(blueman_t)
+
+logging_send_syslog_msg(blueman_t)
+
+miscfiles_read_localization(blueman_t)
+
+optional_policy(`
+ avahi_domtrans(blueman_t)
+')
+
+optional_policy(`
+ gnome_search_gconf(blueman_t)
+')
+
+optional_policy(`
+ xserver_read_state_xdm(blueman_t)
+')
diff --git a/bluetooth.fc b/bluetooth.fc
index dc687e6..e0255eb 100644
--- a/bluetooth.fc
+++ b/bluetooth.fc
@@ -7,6 +7,8 @@
/etc/rc\.d/init\.d/dund -- gen_context(system_u:object_r:bluetooth_initrc_exec_t,s0)
/etc/rc\.d/init\.d/pand -- gen_context(system_u:object_r:bluetooth_initrc_exec_t,s0)
+/usr/lib/systemd/system/bluetooth.* -- gen_context(system_u:object_r:bluetooth_unit_file_t,s0)
+
#
# /usr
#
diff --git a/bluetooth.if b/bluetooth.if
index 3e45431..540f783 100644
--- a/bluetooth.if
+++ b/bluetooth.if
@@ -27,7 +27,11 @@ interface(`bluetooth_role',`
# allow ps to show cdrecord and allow the user to kill it
ps_process_pattern($2, bluetooth_helper_t)
- allow $2 bluetooth_helper_t:process signal;
+ allow $2 bluetooth_helper_t:process signal_perms;
+
+ tunable_policy(`deny_ptrace',`',`
+ allow $2 bluetooth_helper_t:process ptrace;
+ ')
manage_dirs_pattern($2, bluetooth_helper_tmp_t, bluetooth_helper_tmp_t)
manage_files_pattern($2, bluetooth_helper_tmp_t, bluetooth_helper_tmp_t)
@@ -35,6 +39,8 @@ interface(`bluetooth_role',`
manage_dirs_pattern($2, bluetooth_helper_tmpfs_t, bluetooth_helper_tmpfs_t)
manage_files_pattern($2, bluetooth_helper_tmpfs_t, bluetooth_helper_tmpfs_t)
+
+ bluetooth_stream_connect($2)
')
#####################################
@@ -91,7 +97,7 @@ interface(`bluetooth_read_config',`
type bluetooth_conf_t;
')
- allow $1 bluetooth_conf_t:file { getattr read ioctl };
+ allow $1 bluetooth_conf_t:file read_file_perms;
')
########################################
@@ -117,6 +123,27 @@ interface(`bluetooth_dbus_chat',`
########################################
##
+## dontaudit Send and receive messages from
+## bluetooth over dbus.
+##
+##
+##
+## Domain to not audit.
+##
+##
+#
+interface(`bluetooth_dontaudit_dbus_chat',`
+ gen_require(`
+ type bluetooth_t;
+ class dbus send_msg;
+ ')
+
+ dontaudit $1 bluetooth_t:dbus send_msg;
+ dontaudit bluetooth_t $1:dbus send_msg;
+')
+
+########################################
+##
## Execute bluetooth_helper in the bluetooth_helper domain. (Deprecated)
##
##
@@ -157,7 +184,7 @@ interface(`bluetooth_run_helper',`
########################################
##
-## Read bluetooth helper state files.
+## Do not audit attempts to read bluetooth helper state files.
##
##
##
@@ -170,8 +197,31 @@ interface(`bluetooth_dontaudit_read_helper_state',`
type bluetooth_helper_t;
')
- dontaudit $1 bluetooth_helper_t:dir search;
- dontaudit $1 bluetooth_helper_t:file { read getattr };
+ dontaudit $1 bluetooth_helper_t:dir search_dir_perms;
+ dontaudit $1 bluetooth_helper_t:file read_file_perms;
+')
+
+########################################
+##
+## Execute bluetooth server in the bluetooth domain.
+##
+##
+##
+## Domain allowed to transition.
+##
+##
+#
+interface(`bluetooth_systemctl',`
+ gen_require(`
+ type bluetooth_t;
+ type bluetooth_unit_file_t;
+ ')
+
+ systemd_exec_systemctl($1)
+ allow $1 bluetooth_unit_file_t:file read_file_perms;
+ allow $1 bluetooth_unit_file_t:service manage_service_perms;
+
+ ps_process_pattern($1, bluetooth_t)
')
########################################
@@ -193,15 +243,19 @@ interface(`bluetooth_dontaudit_read_helper_state',`
#
interface(`bluetooth_admin',`
gen_require(`
- type bluetooth_t, bluetooth_tmp_t, bluetooth_lock_t;
- type bluetooth_spool_t, bluetooth_var_lib_t, bluetooth_var_run_t;
+ type bluetooth_t, bluetooth_lock_t;
+ type bluetooth_var_lib_t, bluetooth_var_run_t, bluetooth_initrc_exec_t;
type bluetooth_conf_t, bluetooth_conf_rw_t;
- type bluetooth_initrc_exec_t;
+ type bluetooth_unit_file_t;
')
- allow $1 bluetooth_t:process { ptrace signal_perms };
+ allow $1 bluetooth_t:process signal_perms;
ps_process_pattern($1, bluetooth_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 bluetooth_t:process ptrace;
+ ')
+
init_labeled_script_domtrans($1, bluetooth_initrc_exec_t)
domain_system_change_exemption($1)
role_transition $2 bluetooth_initrc_exec_t system_r;
@@ -225,4 +279,8 @@ interface(`bluetooth_admin',`
files_list_pids($1)
admin_pattern($1, bluetooth_var_run_t)
+
+ bluetooth_systemctl($1)
+ admin_pattern($1, bluetooth_unit_file_t)
+ allow $1 bluetooth_unit_file_t:service all_service_perms;
')
diff --git a/bluetooth.te b/bluetooth.te
index d3019b3..59440d1 100644
--- a/bluetooth.te
+++ b/bluetooth.te
@@ -4,12 +4,13 @@ policy_module(bluetooth, 3.4.0)
#
# Declarations
#
+
type bluetooth_t;
type bluetooth_exec_t;
init_daemon_domain(bluetooth_t, bluetooth_exec_t)
type bluetooth_conf_t;
-files_type(bluetooth_conf_t)
+files_config_file(bluetooth_conf_t)
type bluetooth_conf_rw_t;
files_type(bluetooth_conf_rw_t)
@@ -45,6 +46,9 @@ files_type(bluetooth_var_lib_t)
type bluetooth_var_run_t;
files_pid_file(bluetooth_var_run_t)
+type bluetooth_unit_file_t;
+systemd_unit_file(bluetooth_unit_file_t)
+
########################################
#
# Bluetooth services local policy
@@ -127,7 +131,6 @@ corecmd_exec_shell(bluetooth_t)
domain_use_interactive_fds(bluetooth_t)
domain_dontaudit_search_all_domains_state(bluetooth_t)
-files_read_etc_files(bluetooth_t)
files_read_etc_runtime_files(bluetooth_t)
files_read_usr_files(bluetooth_t)
@@ -144,6 +147,10 @@ userdom_dontaudit_use_user_terminals(bluetooth_t)
userdom_dontaudit_search_user_home_dirs(bluetooth_t)
optional_policy(`
+ devicekit_dbus_chat_power(bluetooth_t)
+')
+
+optional_policy(`
dbus_system_bus_client(bluetooth_t)
dbus_connect_system_bus(bluetooth_t)
@@ -212,11 +219,12 @@ corecmd_exec_shell(bluetooth_helper_t)
domain_read_all_domains_state(bluetooth_helper_t)
-files_read_etc_files(bluetooth_helper_t)
files_read_etc_runtime_files(bluetooth_helper_t)
files_read_usr_files(bluetooth_helper_t)
files_dontaudit_list_default(bluetooth_helper_t)
+auth_use_nsswitch(bluetooth_helper_t)
+
locallogin_dontaudit_use_fds(bluetooth_helper_t)
logging_send_syslog_msg(bluetooth_helper_t)
diff --git a/boinc.fc b/boinc.fc
new file mode 100644
index 0000000..e59e51b
--- /dev/null
+++ b/boinc.fc
@@ -0,0 +1,12 @@
+
+/etc/rc\.d/init\.d/boinc-client -- gen_context(system_u:object_r:boinc_initrc_exec_t,s0)
+
+/usr/bin/boinc_client -- gen_context(system_u:object_r:boinc_exec_t,s0)
+
+/usr/lib/systemd/system/boinc-client\.service -- gen_context(system_u:object_r:boinc_unit_file_t,s0)
+
+/var/lib/boinc(/.*)? gen_context(system_u:object_r:boinc_var_lib_t,s0)
+/var/lib/boinc/projects(/.*)? gen_context(system_u:object_r:boinc_project_var_lib_t,s0)
+/var/lib/boinc/slots(/.*)? gen_context(system_u:object_r:boinc_project_var_lib_t,s0)
+
+/var/log/boinc\.log -- gen_context(system_u:object_r:boinc_log_t,s0)
diff --git a/boinc.if b/boinc.if
new file mode 100644
index 0000000..6d7e034
--- /dev/null
+++ b/boinc.if
@@ -0,0 +1,189 @@
+## policy for boinc
+
+########################################
+##
+## Execute a domain transition to run boinc.
+##
+##
+##
+## Domain allowed to transition.
+##
+##
+#
+interface(`boinc_domtrans',`
+ gen_require(`
+ type boinc_t, boinc_exec_t;
+ ')
+
+ domtrans_pattern($1, boinc_exec_t, boinc_t)
+')
+
+#######################################
+##
+## Execute boinc server in the boinc domain.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`boinc_initrc_domtrans',`
+ gen_require(`
+ type boinc_initrc_exec_t;
+ ')
+
+ init_labeled_script_domtrans($1, boinc_initrc_exec_t)
+')
+
+########################################
+##
+## Search boinc lib directories.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`boinc_search_lib',`
+ gen_require(`
+ type boinc_var_lib_t;
+ ')
+
+ allow $1 boinc_var_lib_t:dir search_dir_perms;
+ files_search_var_lib($1)
+')
+
+########################################
+##
+## Read boinc lib files.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`boinc_read_lib_files',`
+ gen_require(`
+ type boinc_var_lib_t;
+ ')
+
+ files_search_var_lib($1)
+ read_files_pattern($1, boinc_var_lib_t, boinc_var_lib_t)
+')
+
+########################################
+##
+## Create, read, write, and delete
+## boinc lib files.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`boinc_manage_lib_files',`
+ gen_require(`
+ type boinc_var_lib_t;
+ ')
+
+ files_search_var_lib($1)
+ manage_files_pattern($1, boinc_var_lib_t, boinc_var_lib_t)
+')
+
+########################################
+##
+## Manage boinc var_lib files.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`boinc_manage_var_lib',`
+ gen_require(`
+ type boinc_var_lib_t;
+ ')
+
+ files_search_var_lib($1)
+ manage_dirs_pattern($1, boinc_var_lib_t, boinc_var_lib_t)
+ manage_files_pattern($1, boinc_var_lib_t, boinc_var_lib_t)
+ manage_lnk_files_pattern($1, boinc_var_lib_t, boinc_var_lib_t)
+')
+
+#######################################
+##
+## Execute boinc server in the boinc domain.
+##
+##
+##
+## Domain allowed to transition.
+##
+##
+#
+interface(`boinc_systemctl',`
+ gen_require(`
+ type boinc_t;
+ type boinc_unit_file_t;
+ ')
+
+ systemd_exec_systemctl($1)
+ systemd_read_fifo_file_password_run($1)
+ allow $1 boinc_unit_file_t:file read_file_perms;
+ allow $1 boinc_unit_file_t:service manage_service_perms;
+
+ ps_process_pattern($1, boinc_t)
+')
+
+########################################
+##
+## All of the rules required to administrate
+## an boinc environment.
+##
+##
+##
+## Domain allowed access.
+##
+##
+##
+##
+## Role allowed access.
+##
+##
+##
+#
+interface(`boinc_admin',`
+ gen_require(`
+ type boinc_t, boinc_initrc_exec_t, boinc_var_lib_t;
+ type boinc_unit_file_t;
+ ')
+
+ allow $1 boinc_t:process signal_perms;
+ ps_process_pattern($1, boinc_t)
+
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 boic_t:process ptrace;
+ ')
+
+ boinc_initrc_domtrans($1)
+ domain_system_change_exemption($1)
+ role_transition $2 boinc_initrc_exec_t system_r;
+ allow $2 system_r;
+
+ files_list_var_lib($1)
+ admin_pattern($1, boinc_var_lib_t)
+
+ boinc_systemctl($1)
+ admin_pattern($1, boinc_unit_file_t)
+
+ allow $1 boinc_unit_file_t:service all_service_perms;
+
+ optional_policy(`
+ systemd_passwd_agent_exec($1)
+ systemd_read_fifo_file_passwd_run($1)
+ ')
+')
diff --git a/boinc.te b/boinc.te
new file mode 100644
index 0000000..20156f6
--- /dev/null
+++ b/boinc.te
@@ -0,0 +1,200 @@
+policy_module(boinc, 1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+attribute boinc_domain;
+
+type boinc_t, boinc_domain;
+type boinc_exec_t;
+init_daemon_domain(boinc_t, boinc_exec_t)
+
+type boinc_initrc_exec_t;
+init_script_file(boinc_initrc_exec_t)
+
+type boinc_tmp_t;
+files_tmp_file(boinc_tmp_t)
+
+type boinc_tmpfs_t;
+files_tmpfs_file(boinc_tmpfs_t)
+
+type boinc_var_lib_t;
+files_type(boinc_var_lib_t)
+
+type boinc_log_t;
+logging_log_file(boinc_log_t)
+
+type boinc_unit_file_t;
+systemd_unit_file(boinc_unit_file_t)
+
+type boinc_project_t;
+domain_type(boinc_project_t)
+role system_r types boinc_project_t;
+
+type boinc_project_tmp_t;
+files_tmp_file(boinc_project_tmp_t)
+
+type boinc_project_var_lib_t;
+files_type(boinc_project_var_lib_t)
+
+#######################################
+#
+# boinc domain local policy
+#
+
+allow boinc_domain self:fifo_file rw_fifo_file_perms;
+allow boinc_domain self:sem create_sem_perms;
+
+manage_dirs_pattern(boinc_domain, boinc_var_lib_t, boinc_var_lib_t)
+manage_files_pattern(boinc_domain, boinc_var_lib_t, boinc_var_lib_t)
+manage_lnk_files_pattern(boinc_domain, boinc_var_lib_t, boinc_var_lib_t)
+
+# needs read /proc/interrupts
+kernel_read_system_state(boinc_domain)
+
+corecmd_exec_bin(boinc_domain)
+corecmd_exec_shell(boinc_domain)
+
+dev_read_rand(boinc_domain)
+dev_read_urand(boinc_domain)
+dev_read_sysfs(boinc_domain)
+dev_rw_xserver_misc(boinc_domain)
+
+domain_read_all_domains_state(boinc_domain)
+
+files_read_etc_files(boinc_domain)
+files_read_etc_runtime_files(boinc_domain)
+files_read_usr_files(boinc_domain)
+
+fs_getattr_all_fs(boinc_domain)
+
+miscfiles_read_fonts(boinc_domain)
+miscfiles_read_localization(boinc_domain)
+
+optional_policy(`
+ sysnet_dns_name_resolve(boinc_domain)
+')
+
+########################################
+#
+# boinc local policy
+#
+
+allow boinc_t self:process { setsched setpgid signull sigkill };
+
+allow boinc_t self:unix_stream_socket create_stream_socket_perms;
+allow boinc_t self:tcp_socket create_stream_socket_perms;
+allow boinc_t self:shm create_shm_perms;
+
+manage_dirs_pattern(boinc_t, boinc_tmp_t, boinc_tmp_t)
+manage_files_pattern(boinc_t, boinc_tmp_t, boinc_tmp_t)
+files_tmp_filetrans(boinc_t, boinc_tmp_t, { dir file })
+
+manage_files_pattern(boinc_t, boinc_tmpfs_t, boinc_tmpfs_t)
+fs_tmpfs_filetrans(boinc_t, boinc_tmpfs_t, file)
+
+exec_files_pattern(boinc_t, boinc_var_lib_t, boinc_var_lib_t)
+# this should be created by default by boinc
+# we need this label for transition to boinc_project_t
+# other boinc lib files will end up with boinc_var_lib_t
+filetrans_pattern(boinc_t, boinc_var_lib_t, boinc_project_var_lib_t, dir, "slots")
+filetrans_pattern(boinc_t, boinc_var_lib_t, boinc_project_var_lib_t, dir, "projects")
+
+manage_dirs_pattern(boinc_t, boinc_project_var_lib_t, boinc_project_var_lib_t)
+manage_files_pattern(boinc_t, boinc_project_var_lib_t, boinc_project_var_lib_t)
+
+manage_files_pattern(boinc_t, boinc_log_t, boinc_log_t)
+logging_log_filetrans(boinc_t, boinc_log_t, { file })
+
+kernel_search_vm_sysctl(boinc_t)
+
+files_getattr_all_dirs(boinc_t)
+files_getattr_all_files(boinc_t)
+
+corenet_all_recvfrom_unlabeled(boinc_t)
+corenet_all_recvfrom_netlabel(boinc_t)
+corenet_tcp_sendrecv_generic_if(boinc_t)
+corenet_udp_sendrecv_generic_if(boinc_t)
+corenet_tcp_sendrecv_generic_node(boinc_t)
+corenet_udp_sendrecv_generic_node(boinc_t)
+corenet_tcp_sendrecv_all_ports(boinc_t)
+corenet_udp_sendrecv_all_ports(boinc_t)
+corenet_tcp_bind_generic_node(boinc_t)
+corenet_udp_bind_generic_node(boinc_t)
+corenet_tcp_bind_boinc_port(boinc_t)
+corenet_tcp_bind_boinc_client_ctrl_port(boinc_t)
+corenet_tcp_connect_boinc_port(boinc_t)
+corenet_tcp_connect_http_port(boinc_t)
+corenet_tcp_connect_http_cache_port(boinc_t)
+
+files_dontaudit_getattr_boot_dirs(boinc_t)
+
+auth_read_passwd(boinc_t)
+
+term_getattr_all_ptys(boinc_t)
+term_getattr_unallocated_ttys(boinc_t)
+
+init_read_utmp(boinc_t)
+
+logging_send_syslog_msg(boinc_t)
+
+optional_policy(`
+ mta_send_mail(boinc_t)
+')
+
+########################################
+#
+# boinc-projects local policy
+#
+
+allow boinc_project_t self:capability { setuid setgid };
+
+domtrans_pattern(boinc_t, boinc_project_var_lib_t, boinc_project_t)
+allow boinc_t boinc_project_t:process sigkill;
+allow boinc_t boinc_project_t:process noatsecure;
+
+allow boinc_project_t self:process { ptrace setcap getcap setpgid setsched signal signull sigkill sigstop };
+allow boinc_project_t self:process { execmem execstack };
+
+manage_dirs_pattern(boinc_project_t, boinc_project_tmp_t, boinc_project_tmp_t)
+manage_files_pattern(boinc_project_t, boinc_project_tmp_t, boinc_project_tmp_t)
+manage_sock_files_pattern(boinc_project_t, boinc_project_tmp_t, boinc_project_tmp_t)
+files_tmp_filetrans(boinc_project_t, boinc_project_tmp_t, { dir file sock_file})
+
+allow boinc_project_t boinc_project_var_lib_t:file entrypoint;
+exec_files_pattern(boinc_project_t, boinc_project_var_lib_t, boinc_project_var_lib_t)
+manage_dirs_pattern(boinc_project_t, boinc_project_var_lib_t, boinc_project_var_lib_t)
+manage_files_pattern(boinc_project_t, boinc_project_var_lib_t, boinc_project_var_lib_t)
+files_var_lib_filetrans(boinc_project_t, boinc_project_var_lib_t, dir, "projects")
+files_var_lib_filetrans(boinc_project_t, boinc_project_var_lib_t, dir, "slots" )
+
+allow boinc_project_t boinc_project_var_lib_t:file execmod;
+
+allow boinc_project_t boinc_t:shm rw_shm_perms;
+allow boinc_project_t boinc_tmpfs_t:file rw_inherited_file_perms;
+
+kernel_read_kernel_sysctls(boinc_project_t)
+kernel_search_vm_sysctl(boinc_project_t)
+kernel_read_network_state(boinc_project_t)
+
+corenet_tcp_connect_boinc_port(boinc_project_t)
+
+files_dontaudit_search_home(boinc_project_t)
+
+# needed by java
+fs_read_hugetlbfs_files(boinc_project_t)
+
+optional_policy(`
+ gnome_read_gconf_config(boinc_project_t)
+')
+
+optional_policy(`
+ java_exec(boinc_project_t)
+')
+
+# until solution for VirtualBox, java ..
+optional_policy(`
+ unconfined_domain(boinc_project_t)
+')
diff --git a/brctl.if b/brctl.if
index 2c2cdb6..73b3814 100644
--- a/brctl.if
+++ b/brctl.if
@@ -18,3 +18,28 @@ interface(`brctl_domtrans',`
corecmd_search_bin($1)
domtrans_pattern($1, brctl_exec_t, brctl_t)
')
+
+#####################################
+##
+## Execute brctl in the brctl domain.
+##
+##
+##
+## Domain allowed to transition.
+##
+##
+##
+##
+## Role allowed access.
+##
+##
+##
+#
+interface(`brctl_run',`
+ gen_require(`
+ type brctl_t, brctl_exec_t;
+ ')
+
+ brctl_domtrans($1)
+ role $2 types brctl_t;
+')
diff --git a/bugzilla.if b/bugzilla.if
index de89d0f..86e4ee7 100644
--- a/bugzilla.if
+++ b/bugzilla.if
@@ -48,23 +48,24 @@ interface(`bugzilla_dontaudit_rw_stream_sockets',`
## Domain allowed access.
##
##
-##
-##
-## The role to be allowed to manage the bugzilla domain.
-##
-##
-##
#
interface(`bugzilla_admin',`
gen_require(`
type httpd_bugzilla_script_t, httpd_bugzilla_content_t, httpd_bugzilla_ra_content_t;
type httpd_bugzilla_rw_content_t, httpd_bugzilla_script_exec_t;
- type httpd_bugzilla_htaccess_t;
+ type httpd_bugzilla_htaccess_t, httpd_bugzilla_tmp_t;
')
- allow $1 httpd_bugzilla_script_t:process { ptrace signal_perms };
+ allow $1 httpd_bugzilla_script_t:process signal_perms;
ps_process_pattern($1, httpd_bugzilla_script_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 httpd_bugzilla_script_t:process ptrace;
+ ')
+
+ files_list_tmp($1)
+ admin_pattern($1, httpd_bugzilla_tmp_t)
+
files_list_var_lib(httpd_bugzilla_script_t)
apache_list_sys_content($1)
diff --git a/bugzilla.te b/bugzilla.te
index 048abbf..7368f57 100644
--- a/bugzilla.te
+++ b/bugzilla.te
@@ -7,6 +7,9 @@ policy_module(bugzilla, 1.0.0)
apache_content_template(bugzilla)
+type httpd_bugzilla_tmp_t;
+files_tmp_file(httpd_bugzilla_tmp_t)
+
########################################
#
# bugzilla local policy
@@ -31,6 +34,10 @@ corenet_tcp_connect_smtp_port(httpd_bugzilla_script_t)
corenet_sendrecv_postgresql_client_packets(httpd_bugzilla_script_t)
corenet_sendrecv_mysqld_client_packets(httpd_bugzilla_script_t)
+manage_dirs_pattern(httpd_bugzilla_script_t, httpd_bugzilla_tmp_t, httpd_bugzilla_tmp_t)
+manage_files_pattern(httpd_bugzilla_script_t, httpd_bugzilla_tmp_t, httpd_bugzilla_tmp_t)
+files_tmp_filetrans(httpd_bugzilla_script_t, httpd_bugzilla_tmp_t, { file dir })
+
files_search_var_lib(httpd_bugzilla_script_t)
sysnet_read_config(httpd_bugzilla_script_t)
diff --git a/cachefilesd.fc b/cachefilesd.fc
new file mode 100644
index 0000000..a561ce0
--- /dev/null
+++ b/cachefilesd.fc
@@ -0,0 +1,34 @@
+###############################################################################
+#
+# Copyright (C) 2006 Red Hat, Inc. All Rights Reserved.
+# Written by David Howells (dhowells@redhat.com)
+# Karl MacMillan (kmacmill@redhat.com)
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version
+# 2 of the License, or (at your option) any later version.
+#
+###############################################################################
+
+#
+# Define the contexts to be assigned to various files and directories of
+# importance to the CacheFiles kernel module and userspace management daemon.
+#
+
+# cachefilesd executable will have:
+# label: system_u:object_r:cachefilesd_exec_t
+# MLS sensitivity: s0
+# MCS categories:
+
+/dev/cachefiles -c gen_context(system_u:object_r:cachefiles_dev_t,s0)
+
+/sbin/cachefilesd -- gen_context(system_u:object_r:cachefilesd_exec_t,s0)
+
+/usr/sbin/cachefilesd -- gen_context(system_u:object_r:cachefilesd_exec_t,s0)
+
+/var/cache/fscache(/.*)? gen_context(system_u:object_r:cachefiles_var_t,s0)
+
+/var/fscache(/.*)? gen_context(system_u:object_r:cachefiles_var_t,s0)
+
+/var/run/cachefilesd\.pid -- gen_context(system_u:object_r:cachefiles_var_t,s0)
diff --git a/cachefilesd.if b/cachefilesd.if
new file mode 100644
index 0000000..3b41945
--- /dev/null
+++ b/cachefilesd.if
@@ -0,0 +1,35 @@
+###############################################################################
+#
+# Copyright (C) 2006 Red Hat, Inc. All Rights Reserved.
+# Written by David Howells (dhowells@redhat.com)
+# Karl MacMillan (kmacmill@redhat.com)
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version
+# 2 of the License, or (at your option) any later version.
+#
+###############################################################################
+
+#
+# Define the policy interface for the CacheFiles userspace management daemon.
+#
+## policy for cachefilesd
+
+########################################
+##
+## Execute a domain transition to run cachefilesd.
+##
+##
+##
+## Domain allowed to transition.
+##
+##
+#
+interface(`cachefilesd_domtrans',`
+ gen_require(`
+ type cachefilesd_t, cachefilesd_exec_t;
+ ')
+
+ domtrans_pattern($1, cachefilesd_exec_t, cachefilesd_t)
+')
diff --git a/cachefilesd.te b/cachefilesd.te
new file mode 100644
index 0000000..e7d2a5b
--- /dev/null
+++ b/cachefilesd.te
@@ -0,0 +1,145 @@
+###############################################################################
+#
+# Copyright (C) 2006, 2010 Red Hat, Inc. All Rights Reserved.
+# Written by David Howells (dhowells@redhat.com)
+# Karl MacMillan (kmacmill@redhat.com)
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version
+# 2 of the License, or (at your option) any later version.
+#
+###############################################################################
+
+#
+# This security policy governs access by the CacheFiles kernel module and
+# userspace management daemon to the files and directories in the on-disk
+# cache, on behalf of the processes accessing the cache through a network
+# filesystem such as NFS
+#
+policy_module(cachefilesd, 1.0.17)
+
+###############################################################################
+#
+# Declarations
+#
+
+#
+# Files in the cache are created by the cachefiles module with security ID
+# cachefiles_var_t
+#
+type cachefiles_var_t;
+files_type(cachefiles_var_t)
+
+#
+# The /dev/cachefiles character device has security ID cachefiles_dev_t
+#
+type cachefiles_dev_t;
+dev_node(cachefiles_dev_t)
+
+#
+# The cachefilesd daemon normally runs with security ID cachefilesd_t
+#
+type cachefilesd_t;
+type cachefilesd_exec_t;
+init_daemon_domain(cachefilesd_t, cachefilesd_exec_t)
+
+#
+# The cachefilesd daemon pid file context
+#
+type cachefilesd_var_run_t;
+files_pid_file(cachefilesd_var_run_t)
+
+#
+# The CacheFiles kernel module causes processes accessing the cache files to do
+# so acting as security ID cachefiles_kernel_t
+#
+type cachefiles_kernel_t;
+domain_type(cachefiles_kernel_t)
+domain_obj_id_change_exemption(cachefiles_kernel_t)
+role system_r types cachefiles_kernel_t;
+
+###############################################################################
+#
+# Permit RPM to deal with files in the cache
+#
+optional_policy(`
+ rpm_use_script_fds(cachefilesd_t)
+')
+
+###############################################################################
+#
+# cachefilesd local policy
+#
+# These define what cachefilesd is permitted to do. This doesn't include very
+# much: startup stuff, logging, pid file, scanning the cache superstructure and
+# deleting files from the cache. It is not permitted to read/write files in
+# the cache.
+#
+# Check in /usr/share/selinux/devel/include/ for macros to use instead of allow
+# rules.
+#
+allow cachefilesd_t self:capability { setuid setgid sys_admin dac_override };
+
+# Allow manipulation of pid file
+allow cachefilesd_t cachefilesd_var_run_t:file create_file_perms;
+manage_files_pattern(cachefilesd_t, cachefilesd_var_run_t, cachefilesd_var_run_t)
+manage_dirs_pattern(cachefilesd_t, cachefilesd_var_run_t, cachefilesd_var_run_t)
+files_pid_filetrans(cachefilesd_t, cachefilesd_var_run_t, file)
+files_create_as_is_all_files(cachefilesd_t)
+
+# Allow access to cachefiles device file
+allow cachefilesd_t cachefiles_dev_t:chr_file rw_file_perms;
+
+# Allow access to cache superstructure
+allow cachefilesd_t cachefiles_var_t:dir { rw_dir_perms delete_dir_perms };
+allow cachefilesd_t cachefiles_var_t:file { rename delete_file_perms };
+
+# Permit statfs on the backing filesystem
+fs_getattr_xattr_fs(cachefilesd_t)
+
+# Basic access
+files_read_etc_files(cachefilesd_t)
+miscfiles_read_localization(cachefilesd_t)
+logging_send_syslog_msg(cachefilesd_t)
+init_dontaudit_use_script_ptys(cachefilesd_t)
+term_dontaudit_use_generic_ptys(cachefilesd_t)
+term_dontaudit_getattr_unallocated_ttys(cachefilesd_t)
+
+###############################################################################
+#
+# When cachefilesd invokes the kernel module to begin caching, it has to tell
+# the kernel module the security context in which it should act, and this
+# policy has to approve that.
+#
+# There are two parts to this:
+#
+# (1) the security context used by the module to access files in the cache,
+# as set by the 'secctx' command in /etc/cachefilesd.conf, and
+#
+allow cachefilesd_t cachefiles_kernel_t:kernel_service { use_as_override };
+
+#
+# (2) the label that will be assigned to new files and directories created in
+# the cache by the module, which will be the same as the label on the
+# directory pointed to by the 'dir' command.
+#
+allow cachefilesd_t cachefiles_var_t:kernel_service { create_files_as };
+
+###############################################################################
+#
+# cachefiles kernel module local policy
+#
+# This governs what the kernel module is allowed to do the contents of the
+# cache.
+#
+allow cachefiles_kernel_t self:capability { dac_override dac_read_search };
+
+manage_dirs_pattern(cachefiles_kernel_t, cachefiles_var_t, cachefiles_var_t)
+manage_files_pattern(cachefiles_kernel_t, cachefiles_var_t, cachefiles_var_t)
+
+fs_getattr_xattr_fs(cachefiles_kernel_t)
+
+dev_search_sysfs(cachefiles_kernel_t)
+
+init_sigchld_script(cachefiles_kernel_t)
diff --git a/calamaris.te b/calamaris.te
index b13fb66..bef8664 100644
--- a/calamaris.te
+++ b/calamaris.te
@@ -51,7 +51,6 @@ corenet_udp_sendrecv_all_ports(calamaris_t)
dev_read_urand(calamaris_t)
files_search_pids(calamaris_t)
-files_read_etc_files(calamaris_t)
files_read_usr_files(calamaris_t)
files_read_var_files(calamaris_t)
files_read_etc_runtime_files(calamaris_t)
diff --git a/callweaver.fc b/callweaver.fc
new file mode 100644
index 0000000..3e15c63
--- /dev/null
+++ b/callweaver.fc
@@ -0,0 +1,11 @@
+/etc/rc\.d/init\.d/callweaver -- gen_context(system_u:object_r:callweaver_initrc_exec_t,s0)
+
+/usr/sbin/callweaver -- gen_context(system_u:object_r:callweaver_exec_t,s0)
+
+/var/lib/callweaver(/.*)? gen_context(system_u:object_r:callweaver_var_lib_t,s0)
+
+/var/log/callweaver(/.*)? gen_context(system_u:object_r:callweaver_log_t,s0)
+
+/var/run/callweaver(/.*)? gen_context(system_u:object_r:callweaver_var_run_t,s0)
+
+/var/spool/callweaver(/.*)? gen_context(system_u:object_r:callweaver_spool_t,s0)
diff --git a/callweaver.if b/callweaver.if
new file mode 100644
index 0000000..e07d3b8
--- /dev/null
+++ b/callweaver.if
@@ -0,0 +1,362 @@
+## Open source PBX project.
+
+########################################
+##
+## Execute callweaver in the
+## callweaver domain.
+##
+##
+##
+## Domain allowed to transition.
+##
+##
+#
+interface(`callweaver_domtrans',`
+ gen_require(`
+ type callweaver_t, callweaver_exec_t;
+ ')
+
+ corecmd_search_bin($1)
+ domtrans_pattern($1, callweaver_exec_t, callweaver_t)
+')
+
+########################################
+##
+## Execute callweaver in the
+## callers domain.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`callweaver_exec',`
+ gen_require(`
+ type callweaver_exec_t;
+ ')
+
+ corecmd_search_bin($1)
+ can_exec($1, callweaver_exec_t)
+')
+
+########################################
+##
+## Execute callweaver in the
+## callweaver domain.
+##
+##
+##
+## Domain allowed to transition.
+##
+##
+#
+interface(`callweaver_initrc_domtrans',`
+ gen_require(`
+ type callweaver_initrc_exec_t;
+ ')
+
+ init_labeled_script_domtrans($1, callweaver_initrc_exec_t)
+')
+
+########################################
+##
+## Read callweaver log files.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`callweaver_read_log',`
+ gen_require(`
+ type callweaver_log_t;
+ ')
+
+ logging_search_logs($1)
+ read_files_pattern($1, callweaver_log_t, callweaver_log_t)
+')
+
+########################################
+##
+## Append to callweaver log files.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`callweaver_append_log',`
+ gen_require(`
+ type callweaver_log_t;
+ ')
+
+ logging_search_logs($1)
+ append_files_pattern($1, callweaver_log_t, callweaver_log_t)
+')
+
+########################################
+##
+## Manage callweaver log files
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`callweaver_manage_log',`
+ gen_require(`
+ type callweaver_log_t;
+ ')
+
+ logging_search_logs($1)
+ manage_dirs_pattern($1, callweaver_log_t, callweaver_log_t)
+ manage_files_pattern($1, callweaver_log_t, callweaver_log_t)
+ manage_lnk_files_pattern($1, callweaver_log_t, callweaver_log_t)
+')
+
+########################################
+##
+## Search callweaver lib directories.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`callweaver_search_lib',`
+ gen_require(`
+ type callweaver_var_lib_t;
+ ')
+
+ allow $1 callweaver_var_lib_t:dir search_dir_perms;
+ files_search_var_lib($1)
+')
+
+########################################
+##
+## Read callweaver lib files.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`callweaver_read_lib_files',`
+ gen_require(`
+ type callweaver_var_lib_t;
+ ')
+
+ files_search_var_lib($1)
+ read_files_pattern($1, callweaver_var_lib_t, callweaver_var_lib_t)
+')
+
+########################################
+##
+## Manage callweaver lib files.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`callweaver_manage_lib_files',`
+ gen_require(`
+ type callweaver_var_lib_t;
+ ')
+
+ files_search_var_lib($1)
+ manage_files_pattern($1, callweaver_var_lib_t, callweaver_var_lib_t)
+')
+
+########################################
+##
+## Manage callweaver lib directories.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`callweaver_manage_lib_dirs',`
+ gen_require(`
+ type callweaver_var_lib_t;
+ ')
+
+ files_search_var_lib($1)
+ manage_dirs_pattern($1, callweaver_var_lib_t, callweaver_var_lib_t)
+')
+
+
+########################################
+##
+## Read callweaver PID files.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`callweaver_read_pid_files',`
+ gen_require(`
+ type callweaver_var_run_t;
+ ')
+
+ files_search_pids($1)
+ allow $1 callweaver_var_run_t:file read_file_perms;
+')
+
+########################################
+##
+## Connect to callweaver over a unix stream socket.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`callweaver_stream_connect',`
+ gen_require(`
+ type callweaver_t, callweaver_var_run_t;
+ ')
+
+ files_search_pids($1)
+ stream_connect_pattern($1, callweaver_var_run_t, callweaver_var_run_t, callweaver_t)
+')
+
+########################################
+##
+## Search callweaver spool directories.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`callweaver_search_spool',`
+ gen_require(`
+ type callweaver_spool_t;
+ ')
+
+ allow $1 callweaver_spool_t:dir search_dir_perms;
+ files_search_spool($1)
+')
+
+########################################
+##
+## Read callweaver spool files.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`callweaver_read_spool_files',`
+ gen_require(`
+ type callweaver_spool_t;
+ ')
+
+ files_search_spool($1)
+ read_files_pattern($1, callweaver_spool_t, callweaver_spool_t)
+')
+
+########################################
+##
+## Manage callweaver spool files.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`callweaver_manage_spool_files',`
+ gen_require(`
+ type callweaver_spool_t;
+ ')
+
+ files_search_spool($1)
+ manage_files_pattern($1, callweaver_spool_t, callweaver_spool_t)
+')
+
+########################################
+##
+## Manage callweaver spool dirs.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`callweaver_manage_spool_dirs',`
+ gen_require(`
+ type callweaver_spool_t;
+ ')
+
+ files_search_spool($1)
+ manage_dirs_pattern($1, callweaver_spool_t, callweaver_spool_t)
+')
+
+########################################
+##
+## All of the rules required to administrate
+## an callweaver environment
+##
+##
+##
+## Domain allowed access.
+##
+##
+##
+##
+## Role allowed access.
+##
+##
+##
+#
+interface(`callweaver_admin',`
+ gen_require(`
+ type callweaver_t;
+ type callweaver_initrc_exec_t;
+ type callweaver_log_t;
+ type callweaver_var_lib_t;
+ type callweaver_var_run_t;
+ type callweaver_spool_t;
+ ')
+
+ allow $1 callweaver_t:process signal_perms;
+ ps_process_pattern($1, callweaver_t)
+
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 callweaver_t:process ptrace;
+ ')
+
+ callweaver_initrc_domtrans($1)
+ domain_system_change_exemption($1)
+ role_transition $2 callweaver_initrc_exec_t system_r;
+ allow $2 system_r;
+
+ logging_search_logs($1)
+ admin_pattern($1, callweaver_log_t)
+
+ files_search_var_lib($1)
+ admin_pattern($1, callweaver_var_lib_t)
+
+ files_search_pids($1)
+ admin_pattern($1, callweaver_var_run_t)
+
+ files_search_spool($1)
+ admin_pattern($1, callweaver_spool_t)
+')
diff --git a/callweaver.te b/callweaver.te
new file mode 100644
index 0000000..4129562
--- /dev/null
+++ b/callweaver.te
@@ -0,0 +1,76 @@
+policy_module(callweaver,1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type callweaver_t;
+type callweaver_exec_t;
+init_daemon_domain(callweaver_t, callweaver_exec_t)
+
+type callweaver_initrc_exec_t;
+init_script_file(callweaver_initrc_exec_t)
+
+type callweaver_log_t;
+logging_log_file(callweaver_log_t)
+
+type callweaver_var_lib_t;
+files_type(callweaver_var_lib_t)
+
+type callweaver_var_run_t;
+files_pid_file(callweaver_var_run_t)
+
+type callweaver_spool_t;
+files_spool_file(callweaver_spool_t)
+
+########################################
+#
+# callweaver local policy
+#
+
+allow callweaver_t self:capability { setuid sys_nice setgid };
+allow callweaver_t self:process { setsched signal };
+allow callweaver_t self:fifo_file rw_fifo_file_perms;
+allow callweaver_t self:unix_stream_socket create_stream_socket_perms;
+
+manage_dirs_pattern(callweaver_t, callweaver_log_t, callweaver_log_t)
+manage_files_pattern(callweaver_t, callweaver_log_t, callweaver_log_t)
+logging_log_filetrans(callweaver_t, callweaver_log_t, { dir file } )
+
+manage_dirs_pattern(callweaver_t, callweaver_var_lib_t, callweaver_var_lib_t)
+manage_files_pattern(callweaver_t, callweaver_var_lib_t, callweaver_var_lib_t)
+files_var_lib_filetrans(callweaver_t, callweaver_var_lib_t, { dir file } )
+
+manage_dirs_pattern(callweaver_t, callweaver_var_run_t, callweaver_var_run_t)
+manage_files_pattern(callweaver_t, callweaver_var_run_t, callweaver_var_run_t)
+manage_sock_files_pattern(callweaver_t, callweaver_var_run_t, callweaver_var_run_t)
+files_pid_filetrans(callweaver_t, callweaver_var_run_t, { dir file sock_file })
+
+manage_dirs_pattern(callweaver_t, callweaver_spool_t, callweaver_spool_t)
+manage_files_pattern(callweaver_t, callweaver_spool_t, callweaver_spool_t)
+manage_lnk_files_pattern(callweaver_t, callweaver_spool_t, callweaver_spool_t)
+files_spool_filetrans(callweaver_t, callweaver_spool_t, { dir file })
+
+allow callweaver_t self:tcp_socket create_stream_socket_perms;
+allow callweaver_t self:udp_socket create_socket_perms;
+
+kernel_read_sysctl(callweaver_t)
+kernel_read_kernel_sysctls(callweaver_t)
+
+corenet_udp_bind_asterisk_port(callweaver_t)
+corenet_udp_bind_generic_port(callweaver_t)
+corenet_udp_bind_sip_port(callweaver_t)
+
+dev_manage_generic_symlinks(callweaver_t)
+
+domain_use_interactive_fds(callweaver_t)
+
+
+term_getattr_pty_fs(callweaver_t)
+term_use_generic_ptys(callweaver_t)
+term_use_ptmx(callweaver_t)
+
+auth_use_nsswitch(callweaver_t)
+
+miscfiles_read_localization(callweaver_t)
diff --git a/canna.fc b/canna.fc
index 5432d0e..f77df02 100644
--- a/canna.fc
+++ b/canna.fc
@@ -20,4 +20,4 @@
/var/run/\.iroha_unix -d gen_context(system_u:object_r:canna_var_run_t,s0)
/var/run/\.iroha_unix/.* -s gen_context(system_u:object_r:canna_var_run_t,s0)
-/var/run/wnn-unix(/.*) gen_context(system_u:object_r:canna_var_run_t,s0)
+/var/run/wnn-unix(/.*)? gen_context(system_u:object_r:canna_var_run_t,s0)
diff --git a/canna.if b/canna.if
index 4a26b0c..00b64dc 100644
--- a/canna.if
+++ b/canna.if
@@ -42,9 +42,13 @@ interface(`canna_admin',`
type canna_var_run_t, canna_initrc_exec_t;
')
- allow $1 canna_t:process { ptrace signal_perms };
+ allow $1 canna_t:process signal_perms;
ps_process_pattern($1, canna_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 canna_t:process ptrace;
+ ')
+
init_labeled_script_domtrans($1, canna_initrc_exec_t)
domain_system_change_exemption($1)
role_transition $2 canna_initrc_exec_t system_r;
diff --git a/canna.te b/canna.te
index 1d25efe..1b16191 100644
--- a/canna.te
+++ b/canna.te
@@ -34,7 +34,7 @@ allow canna_t self:unix_dgram_socket create_stream_socket_perms;
allow canna_t self:tcp_socket create_stream_socket_perms;
manage_files_pattern(canna_t, canna_log_t, canna_log_t)
-allow canna_t canna_log_t:dir setattr;
+allow canna_t canna_log_t:dir setattr_dir_perms;
logging_log_filetrans(canna_t, canna_log_t, { file dir })
manage_dirs_pattern(canna_t, canna_var_lib_t, canna_var_lib_t)
diff --git a/ccs.fc b/ccs.fc
index 8a7177d..bc4f6e7 100644
--- a/ccs.fc
+++ b/ccs.fc
@@ -2,5 +2,7 @@
/sbin/ccsd -- gen_context(system_u:object_r:ccs_exec_t,s0)
+/usr/sbin/ccsd -- gen_context(system_u:object_r:ccs_exec_t,s0)
+
/var/run/cluster/ccsd\.pid -- gen_context(system_u:object_r:ccs_var_run_t,s0)
/var/run/cluster/ccsd\.sock -s gen_context(system_u:object_r:ccs_var_run_t,s0)
diff --git a/ccs.te b/ccs.te
index 4c90b57..f24cf1d 100644
--- a/ccs.te
+++ b/ccs.te
@@ -10,7 +10,7 @@ type ccs_exec_t;
init_daemon_domain(ccs_t, ccs_exec_t)
type cluster_conf_t;
-files_type(cluster_conf_t)
+files_config_file(cluster_conf_t)
type ccs_tmp_t;
files_tmp_file(ccs_tmp_t)
@@ -34,7 +34,7 @@ files_pid_file(ccs_var_run_t)
allow ccs_t self:capability { ipc_owner ipc_lock sys_nice sys_resource sys_admin };
allow ccs_t self:process { signal setrlimit setsched };
-dontaudit ccs_t self:process ptrace;
+
allow ccs_t self:fifo_file rw_fifo_file_perms;
allow ccs_t self:unix_stream_socket { connectto create_stream_socket_perms };
allow ccs_t self:unix_dgram_socket create_socket_perms;
@@ -61,7 +61,7 @@ manage_dirs_pattern(ccs_t, ccs_var_lib_t, ccs_var_lib_t)
manage_files_pattern(ccs_t, ccs_var_lib_t, ccs_var_lib_t)
files_var_lib_filetrans(ccs_t, ccs_var_lib_t, { file dir })
-allow ccs_t ccs_var_log_t:dir setattr;
+allow ccs_t ccs_var_log_t:dir setattr_dir_perms;
manage_files_pattern(ccs_t, ccs_var_log_t, ccs_var_log_t)
manage_sock_files_pattern(ccs_t, ccs_var_log_t, ccs_var_log_t)
logging_log_filetrans(ccs_t, ccs_var_log_t, { sock_file file dir })
@@ -97,6 +97,7 @@ files_read_etc_files(ccs_t)
files_read_etc_runtime_files(ccs_t)
init_rw_script_tmp_files(ccs_t)
+init_signal(ccs_t)
logging_send_syslog_msg(ccs_t)
@@ -118,5 +119,10 @@ optional_policy(`
')
optional_policy(`
+ qpidd_rw_semaphores(ccs_t)
+ qpidd_rw_shm(ccs_t)
+')
+
+optional_policy(`
unconfined_use_fds(ccs_t)
')
diff --git a/cdrecord.te b/cdrecord.te
index 4626931..1194d69 100644
--- a/cdrecord.te
+++ b/cdrecord.te
@@ -55,7 +55,7 @@ logging_send_syslog_msg(cdrecord_t)
miscfiles_read_localization(cdrecord_t)
# write to the user domain tty.
-userdom_use_user_terminals(cdrecord_t)
+userdom_use_inherited_user_terminals(cdrecord_t)
userdom_read_user_home_content_files(cdrecord_t)
# Handle nfs home dirs
@@ -108,11 +108,7 @@ tunable_policy(`cdrecord_read_content',`
userdom_dontaudit_read_user_home_content_files(cdrecord_t)
')
-tunable_policy(`use_nfs_home_dirs',`
- files_search_mnt(cdrecord_t)
- fs_read_nfs_files(cdrecord_t)
- fs_read_nfs_symlinks(cdrecord_t)
-')
+userdom_home_manager(cdrecord_t)
optional_policy(`
resmgr_stream_connect(cdrecord_t)
diff --git a/certmaster.if b/certmaster.if
index fa62787..4230c25 100644
--- a/certmaster.if
+++ b/certmaster.if
@@ -116,19 +116,23 @@ interface(`certmaster_manage_log',`
interface(`certmaster_admin',`
gen_require(`
type certmaster_t, certmaster_var_run_t, certmaster_var_lib_t;
- type certmaster_etc_rw_t, certmaster_var_log_t;
- type certmaster_initrc_exec_t;
+ type certmaster_etc_rw_t, certmaster_var_log_t, certmaster_initrc_exec_t;
')
- allow $1 certmaster_t:process { ptrace signal_perms };
+ allow $1 certmaster_t:process signal_perms;
ps_process_pattern($1, certmaster_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 certmaster_t:process ptrace;
+ ')
+
init_labeled_script_domtrans($1, certmaster_initrc_exec_t)
domain_system_change_exemption($1)
role_transition $2 certmaster_initrc_exec_t system_r;
allow $2 system_r;
files_list_etc($1)
+
miscfiles_manage_generic_cert_dirs($1)
miscfiles_manage_generic_cert_files($1)
diff --git a/certmaster.te b/certmaster.te
index 3384132..7ffa8f0 100644
--- a/certmaster.te
+++ b/certmaster.te
@@ -53,13 +53,15 @@ files_pid_filetrans(certmaster_t ,certmaster_var_run_t, { file sock_file })
# read meminfo
kernel_read_system_state(certmaster_t)
-corecmd_search_bin(certmaster_t)
-corecmd_getattr_bin_files(certmaster_t)
+corecmd_exec_bin(certmaster_t)
corenet_tcp_bind_generic_node(certmaster_t)
corenet_tcp_bind_certmaster_port(certmaster_t)
+dev_read_urand(certmaster_t)
+
files_search_etc(certmaster_t)
+files_read_usr_files(certmaster_t)
files_list_var(certmaster_t)
files_search_var_lib(certmaster_t)
diff --git a/certmonger.fc b/certmonger.fc
index 5ad1a52..e66fcf6 100644
--- a/certmonger.fc
+++ b/certmonger.fc
@@ -4,3 +4,5 @@
/var/lib/certmonger(/.*)? gen_context(system_u:object_r:certmonger_var_lib_t,s0)
/var/run/certmonger.pid -- gen_context(system_u:object_r:certmonger_var_run_t,s0)
+
+/usr/lib/ipa/certmonger(/.*)? gen_context(system_u:object_r:certmonger_unconfined_exec_t,s0)
diff --git a/certmonger.if b/certmonger.if
index 7a6e5ba..7475aa5 100644
--- a/certmonger.if
+++ b/certmonger.if
@@ -158,7 +158,11 @@ interface(`certmonger_admin',`
')
ps_process_pattern($1, certmonger_t)
- allow $1 certmonger_t:process { ptrace signal_perms };
+ allow $1 certmonger_t:process signal_perms;
+
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 certmonger_t:process ptrace;
+ ')
# Allow certmonger_t to restart the apache service
certmonger_initrc_domtrans($1)
@@ -166,9 +170,9 @@ interface(`certmonger_admin',`
role_transition $2 certmonger_initrc_exec_t system_r;
allow $2 system_r;
- files_search_var_lib($1)
+ files_list_var_lib($1)
admin_pattern($1, certmonger_var_lib_t)
- files_search_pids($1)
+ files_list_pids($1)
admin_pattern($1, certmonger_var_run_t)
')
diff --git a/certmonger.te b/certmonger.te
index c3e3f79..0b4158f 100644
--- a/certmonger.te
+++ b/certmonger.te
@@ -18,12 +18,17 @@ files_pid_file(certmonger_var_run_t)
type certmonger_var_lib_t;
files_type(certmonger_var_lib_t)
+type certmonger_unconfined_exec_t;
+application_executable_file(certmonger_unconfined_exec_t)
+
########################################
#
# certmonger local policy
#
-allow certmonger_t self:capability { kill sys_nice };
+allow certmonger_t self:capability { dac_override dac_read_search setgid setuid kill sys_nice };
+dontaudit certmonger_t self:capability sys_tty_config;
+
allow certmonger_t self:process { getsched setsched sigkill };
allow certmonger_t self:fifo_file rw_file_perms;
allow certmonger_t self:unix_stream_socket create_stream_socket_perms;
@@ -38,19 +43,31 @@ manage_dirs_pattern(certmonger_t, certmonger_var_run_t, certmonger_var_run_t)
manage_files_pattern(certmonger_t, certmonger_var_run_t, certmonger_var_run_t)
files_pid_filetrans(certmonger_t, certmonger_var_run_t, { file dir })
+kernel_read_kernel_sysctls(certmonger_t)
+kernel_read_system_state(certmonger_t)
+
+corecmd_exec_bin(certmonger_t)
+corecmd_exec_shell(certmonger_t)
+
corenet_tcp_sendrecv_generic_if(certmonger_t)
corenet_tcp_sendrecv_generic_node(certmonger_t)
corenet_tcp_sendrecv_all_ports(certmonger_t)
corenet_tcp_connect_certmaster_port(certmonger_t)
+corenet_tcp_connect_http_port(certmonger_t)
+corenet_tcp_connect_pki_ca_port(certmonger_t)
dev_read_urand(certmonger_t)
domain_use_interactive_fds(certmonger_t)
-files_read_etc_files(certmonger_t)
files_read_usr_files(certmonger_t)
files_list_tmp(certmonger_t)
+auth_use_nsswitch(certmonger_t)
+auth_rw_cache(certmonger_t)
+
+init_getattr_all_script_files(certmonger_t)
+
logging_send_syslog_msg(certmonger_t)
miscfiles_read_localization(certmonger_t)
@@ -58,15 +75,60 @@ miscfiles_manage_generic_cert_files(certmonger_t)
sysnet_dns_name_resolve(certmonger_t)
+userdom_search_user_home_content(certmonger_t)
+
+optional_policy(`
+ apache_search_config(certmonger_t)
+ apache_signal(certmonger_t)
+ apache_signull(certmonger_t)
+')
+
+optional_policy(`
+ bind_search_cache(certmonger_t)
+')
+
optional_policy(`
dbus_system_bus_client(certmonger_t)
dbus_connect_system_bus(certmonger_t)
')
optional_policy(`
+ dirsrv_manage_config(certmonger_t)
+ dirsrv_signal(certmonger_t)
+ dirsrv_signull(certmonger_t)
+')
+
+optional_policy(`
kerberos_use(certmonger_t)
+ kerberos_read_keytab(certmonger_t)
')
optional_policy(`
+ pcscd_read_pub_files(certmonger_t)
pcscd_stream_connect(certmonger_t)
')
+
+########################################
+#
+# certmonger_unconfined_script_t local policy
+#
+
+optional_policy(`
+ type certmonger_unconfined_t;
+ domain_type(certmonger_unconfined_t)
+
+ domain_entry_file(certmonger_unconfined_t, certmonger_unconfined_exec_t)
+ role system_r types certmonger_unconfined_t;
+
+ domtrans_pattern(certmonger_t, certmonger_unconfined_exec_t, certmonger_unconfined_t)
+
+ unconfined_domain(certmonger_unconfined_t)
+
+ allow certmonger_t certmonger_unconfined_exec_t:dir search_dir_perms;
+ allow certmonger_t certmonger_unconfined_exec_t:dir read_file_perms;
+ allow certmonger_t certmonger_unconfined_exec_t:file ioctl;
+
+ init_domtrans_script(certmonger_unconfined_t)
+
+ unconfined_domain(certmonger_unconfined_t)
+')
diff --git a/certwatch.te b/certwatch.te
index e07cef5..0945e02 100644
--- a/certwatch.te
+++ b/certwatch.te
@@ -27,6 +27,7 @@ files_list_tmp(certwatch_t)
fs_list_inotifyfs(certwatch_t)
auth_manage_cache(certwatch_t)
+auth_read_passwd(certwatch_t)
auth_var_filetrans_cache(certwatch_t)
logging_send_syslog_msg(certwatch_t)
@@ -34,8 +35,8 @@ logging_send_syslog_msg(certwatch_t)
miscfiles_read_all_certs(certwatch_t)
miscfiles_read_localization(certwatch_t)
-userdom_use_user_terminals(certwatch_t)
-userdom_dontaudit_list_user_home_dirs(certwatch_t)
+userdom_use_inherited_user_terminals(certwatch_t)
+userdom_dontaudit_list_admin_dir(certwatch_t)
optional_policy(`
apache_exec_modules(certwatch_t)
diff --git a/cfengine.fc b/cfengine.fc
new file mode 100644
index 0000000..4c52fa3
--- /dev/null
+++ b/cfengine.fc
@@ -0,0 +1,12 @@
+
+/usr/sbin/cf-serverd -- gen_context(system_u:object_r:cfengine_serverd_exec_t,s0)
+/usr/sbin/cf-execd -- gen_context(system_u:object_r:cfengine_execd_exec_t,s0)
+/usr/sbin/cf-monitord -- gen_context(system_u:object_r:cfengine_monitord_exec_t,s0)
+
+/etc/rc\.d/init\.d/cf-serverd -- gen_context(system_u:object_r:cfengine_initrc_exec_t,s0)
+/etc/rc\.d/init\.d/cf-monitord -- gen_context(system_u:object_r:cfengine_initrc_exec_t,s0)
+/etc/rc\.d/init\.d/cf-execd -- gen_context(system_u:object_r:cfengine_initrc_exec_t,s0)
+
+/var/cfengine(/.*)? gen_context(system_u:object_r:cfengine_var_lib_t,s0)
+/var/cfengine/outputs(/.*)? gen_context(system_u:object_r:cfengine_var_log_t,s0)
+
diff --git a/cfengine.if b/cfengine.if
new file mode 100644
index 0000000..2972c77
--- /dev/null
+++ b/cfengine.if
@@ -0,0 +1,143 @@
+
+## policy for cfengine
+
+######################################
+##
+## Creates types and rules for a basic
+## cfengine init daemon domain.
+##
+##
+##
+## Prefix for the domain.
+##
+##
+#
+template(`cfengine_domain_template',`
+ gen_require(`
+ attribute cfengine_domain;
+ ')
+
+ ##############################
+ #
+ # Declarations
+ #
+
+ type cfengine_$1_t, cfengine_domain;
+ type cfengine_$1_exec_t;
+ init_daemon_domain(cfengine_$1_t, cfengine_$1_exec_t)
+
+')
+
+########################################
+##
+## Transition to cfengine.
+##
+##
+##
+## Domain allowed to transition.
+##
+##
+#
+interface(`cfengine_domtrans_server',`
+ gen_require(`
+ type cfengine_server_t, cfengine_server_exec_t;
+ ')
+
+ corecmd_search_bin($1)
+ domtrans_pattern($1, cfengine_server_exec_t, cfengine_server_t)
+')
+
+#######################################
+##
+## Search cfengine lib files.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`cfengine_search_lib_files',`
+ gen_require(`
+ type cfengine_var_lib_t;
+ ')
+
+ allow $1 cfengine_var_lib_t:dir search_dir_perms;
+')
+
+########################################
+##
+## Read cfengine lib files.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`cfengine_read_lib_files',`
+ gen_require(`
+ type cfengine_var_lib_t;
+ ')
+
+ files_search_var_lib($1)
+ read_files_pattern($1, cfengine_var_lib_t, cfengine_var_lib_t)
+')
+
+######################################
+##
+## Allow the specified domain to read cfengine's log files.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`cfengine_read_log',`
+ gen_require(`
+ type cfengine_var_log_t;
+ ')
+
+ logging_search_logs($1)
+ files_search_var_lib($1)
+ cfengine_search_lib_files($1)
+ read_files_pattern($1, cfengine_var_log_t, cfengine_var_log_t)
+')
+
+#####################################
+##
+## Allow the specified domain to append cfengine's log files.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`cfengine_append_inherited_log',`
+ gen_require(`
+ type cfengine_var_log_t;
+ ')
+
+ cfengine_search_lib_files($1)
+ allow $1 cfengine_var_log_t:file { getattr append ioctl lock };
+')
+
+####################################
+##
+## Dontaudit the specified domain to write cfengine's log files.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`cfengine_dontaudit_write_log',`
+ gen_require(`
+ type cfengine_var_log_t;
+ ')
+
+ dontaudit $1 cfengine_var_log_t:file write;
+')
diff --git a/cfengine.te b/cfengine.te
new file mode 100644
index 0000000..4a07a67
--- /dev/null
+++ b/cfengine.te
@@ -0,0 +1,100 @@
+policy_module(cfengine, 1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+attribute cfengine_domain;
+
+cfengine_domain_template(serverd)
+cfengine_domain_template(execd)
+cfengine_domain_template(monitord)
+
+type cfengine_initrc_exec_t;
+init_script_file(cfengine_initrc_exec_t)
+
+type cfengine_var_lib_t;
+files_type(cfengine_var_lib_t)
+
+type cfengine_var_log_t;
+logging_log_file(cfengine_var_log_t)
+
+#######################################
+#
+# cfengine domain local policy
+#
+
+allow cfengine_domain self:fifo_file rw_fifo_file_perms;
+allow cfengine_domain self:unix_stream_socket create_stream_socket_perms;
+
+manage_dirs_pattern(cfengine_domain, cfengine_var_lib_t, cfengine_var_lib_t)
+manage_files_pattern(cfengine_domain, cfengine_var_lib_t, cfengine_var_lib_t)
+manage_lnk_files_pattern(cfengine_domain, cfengine_var_lib_t, cfengine_var_lib_t)
+files_var_lib_filetrans(cfengine_domain, cfengine_var_lib_t, { dir file })
+
+manage_files_pattern(cfengine_domain, cfengine_var_log_t,cfengine_var_log_t)
+manage_dirs_pattern(cfengine_domain, cfengine_var_log_t,cfengine_var_log_t)
+logging_log_filetrans(cfengine_domain,cfengine_var_log_t,{ dir file })
+
+kernel_read_system_state(cfengine_domain)
+
+corecmd_exec_bin(cfengine_domain)
+corecmd_exec_shell(cfengine_domain)
+
+dev_read_urand(cfengine_domain)
+dev_read_sysfs(cfengine_domain)
+
+
+logging_send_syslog_msg(cfengine_domain)
+
+miscfiles_read_localization(cfengine_domain)
+
+sysnet_dns_name_resolve(cfengine_domain)
+sysnet_domtrans_ifconfig(cfengine_domain)
+
+
+########################################
+#
+# cfengine-server local policy
+#
+
+allow cfengine_serverd_t self:capability { chown kill setgid setuid sys_chroot };
+allow cfengine_serverd_t self:process { fork setfscreate signal };
+
+domain_use_interactive_fds(cfengine_serverd_t)
+
+auth_use_nsswitch(cfengine_serverd_t)
+
+########################################
+#
+# cfengine_exec local policy
+#
+
+allow cfengine_execd_t self:capability { chown kill setgid setuid sys_chroot };
+allow cfengine_execd_t self:process { fork setfscreate signal };
+
+kernel_read_sysctl(cfengine_execd_t)
+
+domain_read_all_domains_state(cfengine_execd_t)
+domain_use_interactive_fds(cfengine_execd_t)
+
+auth_use_nsswitch(cfengine_execd_t)
+
+########################################
+#
+# cfengine_monitord local policy
+#
+
+allow cfengine_monitord_t self:capability { chown kill setgid setuid sys_chroot };
+allow cfengine_monitord_t self:process { fork setfscreate signal };
+
+kernel_read_hotplug_sysctls(cfengine_monitord_t)
+kernel_read_network_state(cfengine_monitord_t)
+
+domain_read_all_domains_state(cfengine_monitord_t)
+domain_use_interactive_fds(cfengine_monitord_t)
+
+fs_getattr_xattr_fs(cfengine_monitord_t)
+
+auth_use_nsswitch(cfengine_monitord_t)
diff --git a/cgroup.fc b/cgroup.fc
index b6bb46c..645d203 100644
--- a/cgroup.fc
+++ b/cgroup.fc
@@ -11,5 +11,9 @@
/sbin/cgrulesengd -- gen_context(system_u:object_r:cgred_exec_t,s0)
/sbin/cgclear -- gen_context(system_u:object_r:cgclear_exec_t,s0)
+/usr/sbin/cgconfigparser -- gen_context(system_u:object_r:cgconfig_exec_t,s0)
+/usr/sbin/cgrulesengd -- gen_context(system_u:object_r:cgred_exec_t,s0)
+/usr/sbin/cgclear -- gen_context(system_u:object_r:cgclear_exec_t,s0)
+
/var/log/cgrulesengd\.log -- gen_context(system_u:object_r:cgred_log_t,s0)
/var/run/cgred.* gen_context(system_u:object_r:cgred_var_run_t,s0)
diff --git a/cgroup.if b/cgroup.if
index 33facaf..1d39797 100644
--- a/cgroup.if
+++ b/cgroup.if
@@ -171,15 +171,27 @@ interface(`cgroup_admin',`
type cgrules_etc_t, cgclear_t;
')
- allow $1 cgclear_t:process { ptrace signal_perms };
+ allow $1 cgclear_t:process signal_perms;
ps_process_pattern($1, cgclear_t)
- allow $1 cgconfig_t:process { ptrace signal_perms };
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 cglear_t:process ptrace;
+ ')
+
+ allow $1 cgconfig_t:process signal_perms;
ps_process_pattern($1, cgconfig_t)
- allow $1 cgred_t:process { ptrace signal_perms };
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 cgconfig_t:process ptrace;
+ ')
+
+ allow $1 cgred_t:process signal_perms;
ps_process_pattern($1, cgred_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 cgred_t:process ptrace;
+ ')
+
admin_pattern($1, cgconfig_etc_t)
admin_pattern($1, cgrules_etc_t)
files_list_etc($1)
diff --git a/cgroup.te b/cgroup.te
index 806191a..c577c98 100644
--- a/cgroup.te
+++ b/cgroup.te
@@ -25,8 +25,8 @@ files_pid_file(cgred_var_run_t)
type cgrules_etc_t;
files_config_file(cgrules_etc_t)
-type cgconfig_t;
-type cgconfig_exec_t;
+type cgconfig_t alias cgconfigparser_t;
+type cgconfig_exec_t alias cgconfigparser_exec_t;
init_daemon_domain(cgconfig_t, cgconfig_exec_t)
type cgconfig_initrc_exec_t;
@@ -64,7 +64,6 @@ kernel_list_unlabeled(cgconfig_t)
kernel_read_system_state(cgconfig_t)
# /etc/nsswitch.conf, /etc/passwd
-files_read_etc_files(cgconfig_t)
fs_manage_cgroup_dirs(cgconfig_t)
fs_manage_cgroup_files(cgconfig_t)
@@ -72,12 +71,15 @@ fs_mount_cgroup(cgconfig_t)
fs_mounton_cgroup(cgconfig_t)
fs_unmount_cgroup(cgconfig_t)
+auth_use_nsswitch(cgconfig_t)
+
########################################
#
# cgred personal policy.
#
-allow cgred_t self:capability { chown fsetid net_admin sys_admin sys_ptrace dac_override };
+allow cgred_t self:capability { chown fsetid net_admin sys_admin dac_override sys_ptrace };
+
allow cgred_t self:netlink_socket { write bind create read };
allow cgred_t self:unix_dgram_socket { write create connect };
@@ -86,6 +88,9 @@ logging_log_filetrans(cgred_t, cgred_log_t, file)
allow cgred_t cgrules_etc_t:file read_file_perms;
+manage_files_pattern(cgred_t, cgred_log_t, cgred_log_t)
+logging_log_filetrans(cgred_t, cgred_log_t, file)
+
# rc script creates pid file
manage_files_pattern(cgred_t, cgred_var_run_t, cgred_var_run_t)
manage_sock_files_pattern(cgred_t, cgred_var_run_t, cgred_var_run_t)
@@ -100,10 +105,11 @@ files_getattr_all_files(cgred_t)
files_getattr_all_sockets(cgred_t)
files_read_all_symlinks(cgred_t)
# /etc/group
-files_read_etc_files(cgred_t)
fs_write_cgroup_files(cgred_t)
+auth_use_nsswitch(cgred_t)
+
logging_send_syslog_msg(cgred_t)
miscfiles_read_localization(cgred_t)
diff --git a/chrome.fc b/chrome.fc
new file mode 100644
index 0000000..88107d7
--- /dev/null
+++ b/chrome.fc
@@ -0,0 +1,6 @@
+/opt/google/chrome/chrome-sandbox -- gen_context(system_u:object_r:chrome_sandbox_exec_t,s0)
+
+/usr/lib/chromium-browser/chrome-sandbox -- gen_context(system_u:object_r:chrome_sandbox_exec_t,s0)
+
+/opt/google/chrome/nacl_helper_bootstrap -- gen_context(system_u:object_r:chrome_sandbox_nacl_exec_t,s0)
+/usr/lib/chromium-browser/nacl_helper_bootstrap -- gen_context(system_u:object_r:chrome_sandbox_nacl_exec_t,s0)
diff --git a/chrome.if b/chrome.if
new file mode 100644
index 0000000..efebae7
--- /dev/null
+++ b/chrome.if
@@ -0,0 +1,134 @@
+
+## policy for chrome
+
+########################################
+##
+## Execute a domain transition to run chrome_sandbox.
+##
+##
+##
+## Domain allowed to transition.
+##
+##
+#
+interface(`chrome_domtrans_sandbox',`
+ gen_require(`
+ type chrome_sandbox_t, chrome_sandbox_exec_t;
+ ')
+
+ domtrans_pattern($1, chrome_sandbox_exec_t, chrome_sandbox_t)
+ ps_process_pattern(chrome_sandbox_t, $1)
+
+ allow $1 chrome_sandbox_t:fd use;
+
+ ifdef(`hide_broken_symptoms',`
+ fs_dontaudit_rw_anon_inodefs_files(chrome_sandbox_t)
+ ')
+')
+
+
+########################################
+##
+## Execute chrome_sandbox in the chrome_sandbox domain, and
+## allow the specified role the chrome_sandbox domain.
+##
+##
+##
+## Domain allowed access
+##
+##
+##
+##
+## The role to be allowed the chrome_sandbox domain.
+##
+##
+#
+interface(`chrome_run_sandbox',`
+ gen_require(`
+ type chrome_sandbox_t;
+ type chrome_sandbox_nacl_t;
+ ')
+
+ chrome_domtrans_sandbox($1)
+ role $2 types chrome_sandbox_t;
+ role $2 types chrome_sandbox_nacl_t;
+')
+
+########################################
+##
+## Role access for chrome sandbox
+##
+##
+##
+## Role allowed access
+##
+##
+##
+##
+## User domain for the role
+##
+##
+#
+interface(`chrome_role_notrans',`
+ gen_require(`
+ type chrome_sandbox_t;
+ type chrome_sandbox_tmpfs_t;
+ type chrome_sandbox_nacl_t;
+ ')
+
+ role $1 types chrome_sandbox_t;
+ role $1 types chrome_sandbox_nacl_t;
+
+ ps_process_pattern($2, chrome_sandbox_t)
+ allow $2 chrome_sandbox_t:process signal_perms;
+
+ allow chrome_sandbox_t $2:unix_dgram_socket { read write };
+ allow $2 chrome_sandbox_t:unix_dgram_socket { read write };
+ allow chrome_sandbox_t $2:unix_stream_socket { getattr read write };
+ dontaudit chrome_sandbox_t $2:unix_stream_socket shutdown;
+ allow chrome_sandbox_nacl_t $2:unix_stream_socket { getattr read write };
+ allow $2 chrome_sandbox_nacl_t:unix_stream_socket { getattr read write };
+ allow $2 chrome_sandbox_t:unix_stream_socket { getattr read write };
+
+ allow $2 chrome_sandbox_t:shm rw_shm_perms;
+
+ allow $2 chrome_sandbox_tmpfs_t:file rw_file_perms;
+')
+
+########################################
+##
+## Role access for chrome sandbox
+##
+##
+##
+## Role allowed access
+##
+##
+##
+##
+## User domain for the role
+##
+##
+#
+interface(`chrome_role',`
+ chrome_role_notrans($1, $2)
+ chrome_domtrans_sandbox($2)
+')
+
+########################################
+##
+## Dontaudit read/write to a chrome_sandbox leaks
+##
+##
+##
+## Domain to not audit.
+##
+##
+#
+interface(`chrome_dontaudit_sandbox_leaks',`
+ gen_require(`
+ type chrome_sandbox_t;
+ ')
+
+ dontaudit $1 chrome_sandbox_t:unix_stream_socket { read write };
+')
diff --git a/chrome.te b/chrome.te
new file mode 100644
index 0000000..da7bbf7
--- /dev/null
+++ b/chrome.te
@@ -0,0 +1,184 @@
+policy_module(chrome,1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type chrome_sandbox_t;
+type chrome_sandbox_exec_t;
+application_domain(chrome_sandbox_t, chrome_sandbox_exec_t)
+role system_r types chrome_sandbox_t;
+ubac_constrained(chrome_sandbox_t)
+
+type chrome_sandbox_tmp_t;
+files_tmp_file(chrome_sandbox_tmp_t)
+
+type chrome_sandbox_tmpfs_t;
+files_tmpfs_file(chrome_sandbox_tmpfs_t)
+ubac_constrained(chrome_sandbox_tmpfs_t)
+
+type chrome_sandbox_nacl_t;
+type chrome_sandbox_nacl_exec_t;
+application_domain(chrome_sandbox_nacl_t, chrome_sandbox_nacl_exec_t)
+role system_r types chrome_sandbox_nacl_t;
+ubac_constrained(chrome_sandbox_nacl_t)
+
+########################################
+#
+# chrome_sandbox local policy
+#
+allow chrome_sandbox_t self:capability { chown dac_override fsetid setgid setuid sys_admin sys_chroot sys_ptrace };
+allow chrome_sandbox_t self:process { signal_perms setrlimit execmem execstack };
+allow chrome_sandbox_t self:process setsched;
+allow chrome_sandbox_t self:fifo_file manage_file_perms;
+allow chrome_sandbox_t self:unix_stream_socket create_stream_socket_perms;
+allow chrome_sandbox_t self:unix_dgram_socket { create_socket_perms sendto };
+allow chrome_sandbox_t self:shm create_shm_perms;
+allow chrome_sandbox_t self:netlink_route_socket r_netlink_socket_perms;
+dontaudit chrome_sandbox_t self:memprotect mmap_zero;
+
+manage_dirs_pattern(chrome_sandbox_t, chrome_sandbox_tmp_t, chrome_sandbox_tmp_t)
+manage_files_pattern(chrome_sandbox_t, chrome_sandbox_tmp_t, chrome_sandbox_tmp_t)
+files_tmp_filetrans(chrome_sandbox_t, chrome_sandbox_tmp_t, { dir file })
+
+manage_files_pattern(chrome_sandbox_t, chrome_sandbox_tmpfs_t, chrome_sandbox_tmpfs_t)
+fs_tmpfs_filetrans(chrome_sandbox_t, chrome_sandbox_tmpfs_t, file)
+
+kernel_read_system_state(chrome_sandbox_t)
+kernel_read_kernel_sysctls(chrome_sandbox_t)
+
+fs_manage_cgroup_dirs(chrome_sandbox_t)
+fs_manage_cgroup_files(chrome_sandbox_t)
+
+corecmd_exec_bin(chrome_sandbox_t)
+
+corenet_all_recvfrom_unlabeled(chrome_sandbox_t)
+corenet_all_recvfrom_netlabel(chrome_sandbox_t)
+corenet_tcp_connect_flash_port(chrome_sandbox_t)
+corenet_tcp_connect_streaming_port(chrome_sandbox_t)
+corenet_tcp_connect_pulseaudio_port(chrome_sandbox_t)
+corenet_tcp_connect_http_port(chrome_sandbox_t)
+corenet_tcp_connect_http_cache_port(chrome_sandbox_t)
+corenet_tcp_connect_squid_port(chrome_sandbox_t)
+corenet_tcp_sendrecv_generic_if(chrome_sandbox_t)
+corenet_tcp_sendrecv_generic_node(chrome_sandbox_t)
+corenet_tcp_connect_ipp_port(chrome_sandbox_t)
+corenet_tcp_connect_speech_port(chrome_sandbox_t)
+
+domain_dontaudit_read_all_domains_state(chrome_sandbox_t)
+
+dev_read_urand(chrome_sandbox_t)
+dev_read_sysfs(chrome_sandbox_t)
+dev_rwx_zero(chrome_sandbox_t)
+dev_dontaudit_getattr_all_chr_files(chrome_sandbox_t)
+
+files_read_etc_files(chrome_sandbox_t)
+files_read_usr_files(chrome_sandbox_t)
+
+fs_dontaudit_getattr_all_fs(chrome_sandbox_t)
+
+userdom_rw_inherited_user_tmpfs_files(chrome_sandbox_t)
+userdom_execute_user_tmpfs_files(chrome_sandbox_t)
+
+userdom_use_user_ptys(chrome_sandbox_t)
+userdom_write_inherited_user_tmp_files(chrome_sandbox_t)
+userdom_read_inherited_user_home_content_files(chrome_sandbox_t)
+userdom_dontaudit_use_user_terminals(chrome_sandbox_t)
+userdom_search_user_home_content(chrome_sandbox_t)
+# This one we should figure a way to make it more secure
+userdom_manage_home_certs(chrome_sandbox_t)
+
+miscfiles_read_localization(chrome_sandbox_t)
+miscfiles_read_fonts(chrome_sandbox_t)
+
+sysnet_dns_name_resolve(chrome_sandbox_t)
+
+optional_policy(`
+ gnome_rw_inherited_config(chrome_sandbox_t)
+ gnome_read_home_config(chrome_sandbox_t)
+')
+
+optional_policy(`
+ xserver_use_user_fonts(chrome_sandbox_t)
+ xserver_user_x_domain_template(chrome_sandbox, chrome_sandbox_t, chrome_sandbox_tmpfs_t)
+')
+
+tunable_policy(`use_nfs_home_dirs',`
+ fs_search_nfs(chrome_sandbox_t)
+ fs_exec_nfs_files(chrome_sandbox_t)
+ fs_read_nfs_files(chrome_sandbox_t)
+ fs_rw_inherited_nfs_files(chrome_sandbox_t)
+ fs_read_nfs_symlinks(chrome_sandbox_t)
+ fs_dontaudit_append_nfs_files(chrome_sandbox_t)
+')
+
+tunable_policy(`use_samba_home_dirs',`
+ fs_search_cifs(chrome_sandbox_t)
+ fs_exec_cifs_files(chrome_sandbox_t)
+ fs_rw_inherited_cifs_files(chrome_sandbox_t)
+ fs_read_cifs_files(chrome_sandbox_t)
+ fs_read_cifs_symlinks(chrome_sandbox_t)
+ fs_dontaudit_append_cifs_files(chrome_sandbox_t)
+')
+
+tunable_policy(`use_fusefs_home_dirs',`
+ fs_search_fusefs(chrome_sandbox_t)
+ fs_read_fusefs_files(chrome_sandbox_t)
+ fs_exec_fusefs_files(chrome_sandbox_t)
+ fs_read_fusefs_symlinks(chrome_sandbox_t)
+')
+
+optional_policy(`
+ sandbox_use_ptys(chrome_sandbox_t)
+')
+
+
+########################################
+#
+# chrome_sandbox_nacl local policy
+#
+
+allow chrome_sandbox_nacl_t self:process { execmem setsched };
+allow chrome_sandbox_nacl_t self:fifo_file manage_fifo_file_perms;
+allow chrome_sandbox_nacl_t self:unix_stream_socket create_stream_socket_perms;
+allow chrome_sandbox_nacl_t self:shm create_shm_perms;
+allow chrome_sandbox_nacl_t self:unix_dgram_socket { create_socket_perms sendto };
+allow chrome_sandbox_nacl_t chrome_sandbox_t:unix_stream_socket { getattr write read };
+allow chrome_sandbox_t chrome_sandbox_nacl_t:unix_stream_socket { getattr write read };
+
+allow chrome_sandbox_nacl_t chrome_sandbox_t:shm rw_shm_perms;
+allow chrome_sandbox_nacl_t chrome_sandbox_tmpfs_t:file rw_inherited_file_perms;
+allow chrome_sandbox_t chrome_sandbox_nacl_t:process { sigkill sigstop signull signal share };
+
+manage_files_pattern(chrome_sandbox_nacl_t, chrome_sandbox_tmpfs_t, chrome_sandbox_tmpfs_t)
+fs_tmpfs_filetrans(chrome_sandbox_nacl_t, chrome_sandbox_tmpfs_t, file)
+
+domain_use_interactive_fds(chrome_sandbox_nacl_t)
+
+dontaudit chrome_sandbox_nacl_t self:memprotect mmap_zero;
+
+domtrans_pattern(chrome_sandbox_t, chrome_sandbox_nacl_exec_t, chrome_sandbox_nacl_t)
+ps_process_pattern(chrome_sandbox_t, chrome_sandbox_nacl_t)
+
+kernel_read_system_state(chrome_sandbox_nacl_t)
+
+dev_read_urand(chrome_sandbox_nacl_t)
+dev_read_sysfs(chrome_sandbox_nacl_t)
+
+files_read_etc_files(chrome_sandbox_nacl_t)
+
+miscfiles_read_localization(chrome_sandbox_nacl_t)
+
+corecmd_sbin_entry_type(chrome_sandbox_nacl_t)
+
+userdom_use_inherited_user_ptys(chrome_sandbox_nacl_t)
+userdom_rw_inherited_user_tmpfs_files(chrome_sandbox_nacl_t)
+userdom_execute_user_tmpfs_files(chrome_sandbox_nacl_t)
+userdom_rw_inherited_user_tmp_files(chrome_sandbox_nacl_t)
+userdom_dontaudit_read_user_home_content_files(chrome_sandbox_nacl_t)
+
+optional_policy(`
+ gnome_dontaudit_write_config_files(chrome_sandbox_nacl_t)
+')
+
diff --git a/chronyd.fc b/chronyd.fc
index fd8cd0b..f33885f 100644
--- a/chronyd.fc
+++ b/chronyd.fc
@@ -2,8 +2,12 @@
/etc/rc\.d/init\.d/chronyd -- gen_context(system_u:object_r:chronyd_initrc_exec_t,s0)
+/usr/lib/systemd/system/chrony.* -- gen_context(system_u:object_r:chronyd_unit_file_t,s0)
+
/usr/sbin/chronyd -- gen_context(system_u:object_r:chronyd_exec_t,s0)
/var/lib/chrony(/.*)? gen_context(system_u:object_r:chronyd_var_lib_t,s0)
/var/log/chrony(/.*)? gen_context(system_u:object_r:chronyd_var_log_t,s0)
/var/run/chronyd\.pid -- gen_context(system_u:object_r:chronyd_var_run_t,s0)
+/var/run/chronyd(/.*) gen_context(system_u:object_r:chronyd_var_run_t,s0)
+/var/run/chronyd\.sock gen_context(system_u:object_r:chronyd_var_run_t,s0)
diff --git a/chronyd.if b/chronyd.if
index 9a0da94..113eae2 100644
--- a/chronyd.if
+++ b/chronyd.if
@@ -19,6 +19,24 @@ interface(`chronyd_domtrans',`
domtrans_pattern($1, chronyd_exec_t, chronyd_t)
')
+########################################
+##
+## Execute chronyd server in the chronyd domain.
+##
+##
+##
+## Domain allowed to transition.
+##
+##
+#
+interface(`chronyd_initrc_domtrans',`
+ gen_require(`
+ type chronyd_initrc_exec_t;
+ ')
+
+ init_labeled_script_domtrans($1, chronyd_initrc_exec_t)
+')
+
####################################
##
## Execute chronyd
@@ -56,6 +74,125 @@ interface(`chronyd_read_log',`
read_files_pattern($1, chronyd_var_log_t, chronyd_var_log_t)
')
+########################################
+##
+## Read and write chronyd shared memory.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`chronyd_rw_shm',`
+ gen_require(`
+ type chronyd_t, chronyd_tmpfs_t;
+ ')
+
+ allow $1 chronyd_t:shm rw_shm_perms;
+ allow $1 chronyd_tmpfs_t:dir list_dir_perms;
+ rw_files_pattern($1, chronyd_tmpfs_t, chronyd_tmpfs_t)
+ read_lnk_files_pattern($1, chronyd_tmpfs_t, chronyd_tmpfs_t)
+ fs_search_tmpfs($1)
+')
+
+########################################
+##
+## Read chronyd keys files.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`chronyd_read_keys',`
+ gen_require(`
+ type chronyd_keys_t;
+ ')
+
+ read_files_pattern($1, chronyd_keys_t, chronyd_keys_t)
+')
+
+########################################
+##
+## Append chronyd keys files.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`chronyd_append_keys',`
+ gen_require(`
+ type chronyd_keys_t;
+ ')
+
+ append_files_pattern($1, chronyd_keys_t, chronyd_keys_t)
+')
+
+########################################
+##
+## Execute chronyd server in the chronyd domain.
+##
+##
+##
+## Domain allowed to transition.
+##
+##
+#
+interface(`chronyd_systemctl',`
+ gen_require(`
+ type chronyd_t;
+ type chronyd_unit_file_t;
+ ')
+
+ systemd_exec_systemctl($1)
+ allow $1 chronyd_unit_file_t:file read_file_perms;
+ allow $1 chronyd_unit_file_t:service manage_service_perms;
+
+ ps_process_pattern($1, chronyd_t)
+')
+
+########################################
+##
+## Connect to chronyd over a unix stream socket.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`chronyd_stream_connect',`
+ gen_require(`
+ type chronyd_t, chronyd_var_run_t;
+ ')
+
+ files_search_pids($1)
+ stream_connect_pattern($1, chronyd_var_run_t, chronyd_var_run_t, chronyd_t)
+')
+
+########################################
+##
+## Send to chronyd over a unix domain
+## datagram socket.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`chronyd_dgram_send',`
+ gen_require(`
+ type chronyd_t;
+ ')
+
+ allow $1 chronyd_t:unix_dgram_socket sendto;
+')
+
####################################
##
## All of the rules required to administrate
@@ -75,31 +212,38 @@ interface(`chronyd_read_log',`
#
interface(`chronyd_admin',`
gen_require(`
- type chronyd_t, chronyd_var_log_t;
- type chronyd_var_run_t, chronyd_var_lib_t;
- type chronyd_initrc_exec_t, chronyd_keys_t;
+ type chronyd_t, chronyd_var_log_t, chronyd_var_run_t;
+ type chronyd_var_lib_t, chronyd_tmpfs_t, chronyd_initrc_exec_t;
+ type chronyd_keys_t, chronyd_unit_file_t;
')
- allow $1 chronyd_t:process { ptrace signal_perms };
+ allow $1 chronyd_t:process signal_perms;
ps_process_pattern($1, chronyd_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 chronyd_t:process ptrace;
+ ')
+
init_labeled_script_domtrans($1, chronyd_initrc_exec_t)
domain_system_change_exemption($1)
role_transition $2 chronyd_initrc_exec_t system_r;
allow $2 system_r;
- files_search_etc($1)
+ files_list_etc($1)
admin_pattern($1, chronyd_keys_t)
- logging_search_logs($1)
+ logging_list_logs($1)
admin_pattern($1, chronyd_var_log_t)
- files_search_var_lib($1)
+ files_list_var_lib($1)
admin_pattern($1, chronyd_var_lib_t)
- files_search_pids($1)
+ files_list_pids($1)
admin_pattern($1, chronyd_var_run_t)
- files_search_tmp($1)
- admin_pattern($1, chronyd_tmp_t)
+ admin_pattern($1, chronyd_tmpfs_t)
+
+ admin_pattern($1, chronyd_unit_file_t)
+ chronyd_systemctl($1)
+ allow $1 chronyd_unit_file_t:service all_service_perms;
')
diff --git a/chronyd.te b/chronyd.te
index fa82327..898d0db 100644
--- a/chronyd.te
+++ b/chronyd.te
@@ -15,6 +15,12 @@ init_script_file(chronyd_initrc_exec_t)
type chronyd_keys_t;
files_type(chronyd_keys_t)
+type chronyd_tmpfs_t;
+files_tmpfs_file(chronyd_tmpfs_t)
+
+type chronyd_unit_file_t;
+systemd_unit_file(chronyd_unit_file_t)
+
type chronyd_var_lib_t;
files_type(chronyd_var_lib_t)
@@ -30,13 +36,18 @@ files_pid_file(chronyd_var_run_t)
#
allow chronyd_t self:capability { dac_override ipc_lock setuid setgid sys_resource sys_time };
-allow chronyd_t self:process { getcap setcap setrlimit };
+allow chronyd_t self:process { getcap setcap setrlimit signal };
allow chronyd_t self:shm create_shm_perms;
allow chronyd_t self:udp_socket create_socket_perms;
allow chronyd_t self:unix_dgram_socket create_socket_perms;
+allow chronyd_t self:fifo_file rw_fifo_file_perms;
allow chronyd_t chronyd_keys_t:file read_file_perms;
+manage_dirs_pattern(chronyd_t, chronyd_tmpfs_t, chronyd_tmpfs_t)
+manage_files_pattern(chronyd_t, chronyd_tmpfs_t, chronyd_tmpfs_t)
+fs_tmpfs_filetrans(chronyd_t, chronyd_tmpfs_t, { dir file })
+
manage_files_pattern(chronyd_t, chronyd_var_lib_t, chronyd_var_lib_t)
manage_dirs_pattern(chronyd_t, chronyd_var_lib_t, chronyd_var_lib_t)
manage_sock_files_pattern(chronyd_t, chronyd_var_lib_t, chronyd_var_lib_t)
@@ -48,8 +59,15 @@ logging_log_filetrans(chronyd_t, chronyd_var_log_t, { file dir })
manage_files_pattern(chronyd_t, chronyd_var_run_t, chronyd_var_run_t)
manage_dirs_pattern(chronyd_t, chronyd_var_run_t, chronyd_var_run_t)
-files_pid_filetrans(chronyd_t, chronyd_var_run_t, file)
+manage_sock_files_pattern(chronyd_t, chronyd_var_run_t, chronyd_var_run_t)
+files_pid_filetrans(chronyd_t, chronyd_var_run_t, { dir file sock_file })
+kernel_read_system_state(chronyd_t)
+kernel_read_network_state(chronyd_t)
+
+corecmd_exec_shell(chronyd_t)
+
+corenet_udp_bind_generic_node(chronyd_t)
corenet_udp_bind_ntp_port(chronyd_t)
# bind to udp/323
corenet_udp_bind_chronyd_port(chronyd_t)
@@ -63,6 +81,8 @@ logging_send_syslog_msg(chronyd_t)
miscfiles_read_localization(chronyd_t)
+mta_send_mail(chronyd_t)
+
optional_policy(`
gpsd_rw_shm(chronyd_t)
')
diff --git a/clamav.fc b/clamav.fc
index e8e9a21..22986ef 100644
--- a/clamav.fc
+++ b/clamav.fc
@@ -8,9 +8,13 @@
/usr/sbin/clamd -- gen_context(system_u:object_r:clamd_exec_t,s0)
/usr/sbin/clamav-milter -- gen_context(system_u:object_r:clamd_exec_t,s0)
+/usr/lib/systemd/system/clamd.* -- gen_context(system_u:object_r:clamd_unit_file_t,s0)
+
/var/clamav(/.*)? gen_context(system_u:object_r:clamd_var_lib_t,s0)
/var/lib/clamav(/.*)? gen_context(system_u:object_r:clamd_var_lib_t,s0)
+/var/lib/clamd.* gen_context(system_u:object_r:clamd_var_lib_t,s0)
/var/log/clamav.* gen_context(system_u:object_r:clamd_var_log_t,s0)
+/var/log/freshclam.* -- gen_context(system_u:object_r:freshclam_var_log_t,s0)
/var/log/clamav/freshclam.* -- gen_context(system_u:object_r:freshclam_var_log_t,s0)
/var/log/clamd.* gen_context(system_u:object_r:clamd_var_log_t,s0)
/var/run/amavis(d)?/clamd\.pid -- gen_context(system_u:object_r:clamd_var_run_t,s0)
diff --git a/clamav.if b/clamav.if
index bbac14a..87840b4 100644
--- a/clamav.if
+++ b/clamav.if
@@ -33,6 +33,7 @@ interface(`clamav_stream_connect',`
type clamd_t, clamd_var_run_t;
')
+ files_search_pids($1)
stream_connect_pattern($1, clamd_var_run_t, clamd_var_run_t, clamd_t)
')
@@ -133,6 +134,49 @@ interface(`clamav_exec_clamscan',`
########################################
##
+## Manage clamd pid content.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`clamav_manage_clamd_pid',`
+ gen_require(`
+ type clamd_var_run_t;
+ ')
+
+ manage_dirs_pattern($1, clamd_var_run_t, clamd_var_run_t)
+ manage_files_pattern($1, clamd_var_run_t, clamd_var_run_t)
+')
+
+#######################################
+##
+## Execute clamd server in the clamd domain.
+##
+##
+##
+## Domain allowed to transition.
+##
+##
+#
+interface(`clamd_systemctl',`
+ gen_require(`
+ type clamd_t;
+ type clamd_unit_file_t;
+ ')
+
+ systemd_exec_systemctl($1)
+ systemd_read_fifo_file_passwd_run($1)
+ allow $1 clamd_unit_file_t:file read_file_perms;
+ allow $1 clamd_unit_file_t:service manage_service_perms;
+
+ ps_process_pattern($1, clamd_t)
+')
+
+########################################
+##
## All of the rules required to administrate
## an clamav environment
##
@@ -151,19 +195,25 @@ interface(`clamav_exec_clamscan',`
interface(`clamav_admin',`
gen_require(`
type clamd_t, clamd_etc_t, clamd_tmp_t;
- type clamd_var_log_t, clamd_var_lib_t;
- type clamd_var_run_t, clamscan_t, clamscan_tmp_t;
- type clamd_initrc_exec_t;
+ type clamd_var_log_t, clamd_var_lib_t, clamd_var_run_t;
+ type clamscan_t, clamscan_tmp_t, clamd_initrc_exec_t;
type freshclam_t, freshclam_var_log_t;
+ type clamd_unit_file_t;
')
- allow $1 clamd_t:process { ptrace signal_perms };
+ allow $1 clamd_t:process signal_perms;
ps_process_pattern($1, clamd_t)
- allow $1 clamscan_t:process { ptrace signal_perms };
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 clamd_t:process ptrace;
+ allow $1 clamscan_t:process ptrace;
+ allow $1 freshclam_t:process ptrace;
+ ')
+
+ allow $1 clamscan_t:process signal_perms;
ps_process_pattern($1, clamscan_t)
- allow $1 freshclam_t:process { ptrace signal_perms };
+ allow $1 freshclam_t:process signal_perms;
ps_process_pattern($1, freshclam_t)
init_labeled_script_domtrans($1, clamd_initrc_exec_t)
@@ -171,6 +221,10 @@ interface(`clamav_admin',`
role_transition $2 clamd_initrc_exec_t system_r;
allow $2 system_r;
+ clamd_systemctl($1)
+ admin_pattern($1, clamd_unit_file_t)
+ allow $1 clamd_unit_file_t:service all_service_perms;
+
files_list_etc($1)
admin_pattern($1, clamd_etc_t)
@@ -189,4 +243,10 @@ interface(`clamav_admin',`
admin_pattern($1, clamscan_tmp_t)
admin_pattern($1, freshclam_var_log_t)
+
+ optional_policy(`
+ systemd_passwd_agent_exec($1)
+ systemd_read_fifo_file_passwd_run($1)
+ ')
+
')
diff --git a/clamav.te b/clamav.te
index 5b7a1d7..d5c0e45 100644
--- a/clamav.te
+++ b/clamav.te
@@ -1,9 +1,23 @@
policy_module(clamav, 1.9.1)
##
-##
-## Allow clamd to use JIT compiler
-##
+##
+## Allow clamscan to read user content
+##
+##
+gen_tunable(clamscan_read_user_content, false)
+
+##
+##
+## Allow clamscan to non security files on a system
+##
+##
+gen_tunable(clamscan_can_scan_system, false)
+
+##
+##
+## Allow clamd to use JIT compiler
+##
##
gen_tunable(clamd_use_jit, false)
@@ -24,6 +38,9 @@ files_config_file(clamd_etc_t)
type clamd_initrc_exec_t;
init_script_file(clamd_initrc_exec_t)
+type clamd_unit_file_t;
+systemd_unit_file(clamd_unit_file_t)
+
# tmp files
type clamd_tmp_t;
files_tmp_file(clamd_tmp_t)
@@ -64,6 +81,8 @@ logging_log_file(freshclam_var_log_t)
allow clamd_t self:capability { kill setgid setuid dac_override };
dontaudit clamd_t self:capability sys_tty_config;
+allow clamd_t self:process signal;
+
allow clamd_t self:fifo_file rw_fifo_file_perms;
allow clamd_t self:unix_stream_socket { create_stream_socket_perms connectto };
allow clamd_t self:unix_dgram_socket create_socket_perms;
@@ -80,6 +99,7 @@ manage_files_pattern(clamd_t, clamd_tmp_t, clamd_tmp_t)
files_tmp_filetrans(clamd_t, clamd_tmp_t, { file dir })
# var/lib files for clamd
+manage_sock_files_pattern(clamd_t, clamd_var_lib_t, clamd_var_lib_t)
manage_dirs_pattern(clamd_t, clamd_var_lib_t, clamd_var_lib_t)
manage_files_pattern(clamd_t, clamd_var_lib_t, clamd_var_lib_t)
@@ -89,9 +109,10 @@ manage_files_pattern(clamd_t, clamd_var_log_t, clamd_var_log_t)
logging_log_filetrans(clamd_t, clamd_var_log_t, { dir file })
# pid file
+manage_dirs_pattern(clamd_t, clamd_var_run_t, clamd_var_run_t)
manage_files_pattern(clamd_t, clamd_var_run_t, clamd_var_run_t)
manage_sock_files_pattern(clamd_t, clamd_var_run_t, clamd_var_run_t)
-files_pid_filetrans(clamd_t, clamd_var_run_t, { file dir })
+files_pid_filetrans(clamd_t, clamd_var_run_t, { sock_file file dir })
kernel_dontaudit_list_proc(clamd_t)
kernel_read_sysctl(clamd_t)
@@ -110,6 +131,7 @@ corenet_tcp_bind_generic_node(clamd_t)
corenet_tcp_bind_clamd_port(clamd_t)
corenet_tcp_bind_generic_port(clamd_t)
corenet_tcp_connect_generic_port(clamd_t)
+corenet_tcp_connect_clamd_port(clamd_t)
corenet_sendrecv_clamd_server_packets(clamd_t)
dev_read_rand(clamd_t)
@@ -117,7 +139,6 @@ dev_read_urand(clamd_t)
domain_use_interactive_fds(clamd_t)
-files_read_etc_files(clamd_t)
files_read_etc_runtime_files(clamd_t)
files_search_spool(clamd_t)
@@ -127,13 +148,6 @@ logging_send_syslog_msg(clamd_t)
miscfiles_read_localization(clamd_t)
-cron_use_fds(clamd_t)
-cron_use_system_job_fds(clamd_t)
-cron_rw_pipes(clamd_t)
-
-mta_read_config(clamd_t)
-mta_send_mail(clamd_t)
-
optional_policy(`
amavis_read_lib_files(clamd_t)
amavis_read_spool_files(clamd_t)
@@ -142,13 +156,31 @@ optional_policy(`
')
optional_policy(`
+ cron_use_fds(clamd_t)
+ cron_use_system_job_fds(clamd_t)
+ cron_rw_pipes(clamd_t)
+')
+
+optional_policy(`
exim_read_spool_files(clamd_t)
')
+optional_policy(`
+ mta_read_config(clamd_t)
+ mta_send_mail(clamd_t)
+')
+
+optional_policy(`
+ spamd_stream_connect(clamd_t)
+ spamassassin_read_pid_files(clamd_t)
+')
+
tunable_policy(`clamd_use_jit',`
allow clamd_t self:process execmem;
-', `
+ allow clamscan_t self:process execmem;
+',`
dontaudit clamd_t self:process execmem;
+ dontaudit clamscan_t self:process execmem;
')
########################################
@@ -178,10 +210,16 @@ files_pid_filetrans(freshclam_t, clamd_var_run_t, file)
# log files (own logfiles only)
manage_files_pattern(freshclam_t, freshclam_var_log_t, freshclam_var_log_t)
-allow freshclam_t freshclam_var_log_t:dir setattr;
-allow freshclam_t clamd_var_log_t:dir search_dir_perms;
+allow freshclam_t freshclam_var_log_t:dir setattr_dir_perms;
+read_files_pattern(freshclam_t, clamd_var_log_t, clamd_var_log_t)
logging_log_filetrans(freshclam_t, freshclam_var_log_t, file)
+kernel_read_kernel_sysctls(freshclam_t)
+kernel_read_system_state(freshclam_t)
+
+corecmd_exec_shell(freshclam_t)
+corecmd_exec_bin(freshclam_t)
+
corenet_all_recvfrom_unlabeled(freshclam_t)
corenet_all_recvfrom_netlabel(freshclam_t)
corenet_tcp_sendrecv_generic_if(freshclam_t)
@@ -189,6 +227,7 @@ corenet_tcp_sendrecv_generic_node(freshclam_t)
corenet_tcp_sendrecv_all_ports(freshclam_t)
corenet_tcp_sendrecv_clamd_port(freshclam_t)
corenet_tcp_connect_http_port(freshclam_t)
+corenet_tcp_connect_clamd_port(freshclam_t)
corenet_sendrecv_http_client_packets(freshclam_t)
dev_read_rand(freshclam_t)
@@ -196,7 +235,6 @@ dev_read_urand(freshclam_t)
domain_use_interactive_fds(freshclam_t)
-files_read_etc_files(freshclam_t)
files_read_etc_runtime_files(freshclam_t)
auth_use_nsswitch(freshclam_t)
@@ -207,16 +245,22 @@ miscfiles_read_localization(freshclam_t)
clamav_stream_connect(freshclam_t)
-optional_policy(`
- cron_system_entry(freshclam_t, freshclam_exec_t)
-')
+userdom_stream_connect(freshclam_t)
tunable_policy(`clamd_use_jit',`
allow freshclam_t self:process execmem;
-', `
+',`
dontaudit freshclam_t self:process execmem;
')
+optional_policy(`
+ clamd_systemctl(freshclam_t)
+')
+
+optional_policy(`
+ cron_system_entry(freshclam_t, freshclam_exec_t)
+')
+
########################################
#
# clamscam local policy
@@ -242,17 +286,34 @@ files_tmp_filetrans(clamscan_t, clamscan_tmp_t, { file dir })
manage_files_pattern(clamscan_t, clamd_var_lib_t, clamd_var_lib_t)
allow clamscan_t clamd_var_lib_t:dir list_dir_perms;
+read_files_pattern(clamscan_t, clamd_var_run_t, clamd_var_run_t)
+allow clamscan_t clamd_var_run_t:dir list_dir_perms;
+
+kernel_read_system_state(clamscan_t)
+
corenet_all_recvfrom_unlabeled(clamscan_t)
corenet_all_recvfrom_netlabel(clamscan_t)
corenet_tcp_sendrecv_generic_if(clamscan_t)
corenet_tcp_sendrecv_generic_node(clamscan_t)
corenet_tcp_sendrecv_all_ports(clamscan_t)
corenet_tcp_sendrecv_clamd_port(clamscan_t)
+corenet_tcp_bind_generic_node(clamscan_t)
corenet_tcp_connect_clamd_port(clamscan_t)
+corecmd_read_all_executables(clamscan_t)
+
+tunable_policy(`clamscan_read_user_content',`
+ userdom_read_user_home_content_files(clamscan_t)
+ userdom_dontaudit_read_user_home_content_files(clamscan_t)
+')
+
+tunable_policy(`clamscan_can_scan_system',`
+ files_read_non_security_files(clamscan_t)
+')
+
kernel_read_kernel_sysctls(clamscan_t)
+kernel_read_system_state(clamscan_t)
-files_read_etc_files(clamscan_t)
files_read_etc_runtime_files(clamscan_t)
files_search_var_lib(clamscan_t)
@@ -264,10 +325,15 @@ miscfiles_read_public_files(clamscan_t)
clamav_stream_connect(clamscan_t)
-mta_send_mail(clamscan_t)
+sysnet_read_config(clamscan_t)
+
+optional_policy(`
+ mta_send_mail(clamscan_t)
+ mta_read_queue(clamscan_t)
+')
optional_policy(`
- amavis_read_spool_files(clamscan_t)
+ amavis_manage_spool_files(clamscan_t)
')
optional_policy(`
diff --git a/clockspeed.te b/clockspeed.te
index b40f3f7..3676ecc 100644
--- a/clockspeed.te
+++ b/clockspeed.te
@@ -38,7 +38,7 @@ files_read_etc_files(clockspeed_cli_t)
miscfiles_read_localization(clockspeed_cli_t)
-userdom_use_user_terminals(clockspeed_cli_t)
+userdom_use_inherited_user_terminals(clockspeed_cli_t)
########################################
#
diff --git a/cloudform.fc b/cloudform.fc
new file mode 100644
index 0000000..7182054
--- /dev/null
+++ b/cloudform.fc
@@ -0,0 +1,19 @@
+/etc/rc\.d/init\.d/iwhd -- gen_context(system_u:object_r:iwhd_initrc_exec_t,s0)
+/etc/rc\.d/init\.d/mongod -- gen_context(system_u:object_r:mongod_initrc_exec_t,s0)
+
+/usr/bin/deltacloudd -- gen_context(system_u:object_r:deltacloudd_exec_t,s0)
+/usr/bin/iwhd -- gen_context(system_u:object_r:iwhd_exec_t,s0)
+/usr/bin/mongod -- gen_context(system_u:object_r:mongod_exec_t,s0)
+
+/usr/share/aeolus-conductor/dbomatic/dbomatic -- gen_context(system_u:object_r:mongod_exec_t,s0)
+
+/var/lib/iwhd(/.*)? gen_context(system_u:object_r:iwhd_var_lib_t,s0)
+/var/lib/mongodb(/.*)? gen_context(system_u:object_r:mongod_var_lib_t,s0)
+
+/var/log/deltacloud-core(/.*)? gen_context(system_u:object_r:deltacloudd_log_t,s0)
+/var/log/iwhd\.log -- gen_context(system_u:object_r:iwhd_log_t,s0)
+/var/log/mongodb(/.*)? gen_context(system_u:object_r:mongod_log_t,s0)
+
+/var/run/mongodb(/.*)? gen_context(system_u:object_r:mongod_var_run_t,s0)
+/var/run/aeolus/dbomatic\.pid -- gen_context(system_u:object_r:mongod_var_run_t,s0)
+/var/run/iwhd\.pid -- gen_context(system_u:object_r:iwhd_var_run_t,s0)
diff --git a/cloudform.if b/cloudform.if
new file mode 100644
index 0000000..7f55959
--- /dev/null
+++ b/cloudform.if
@@ -0,0 +1,40 @@
+## cloudform policy
+
+#######################################
+##
+## Creates types and rules for a basic
+## cloudform daemon domain.
+##
+##
+##
+## Prefix for the domain.
+##
+##
+#
+template(`cloudform_domain_template',`
+ gen_require(`
+ attribute cloudform_domain;
+ ')
+
+ type $1_t, cloudform_domain;
+ type $1_exec_t;
+ init_daemon_domain($1_t, $1_exec_t)
+')
+
+######################################
+##
+## Execute mongod in the caller domain.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`cloudform_exec_mongod',`
+ gen_require(`
+ type mongod_exec_t;
+ ')
+
+ can_exec($1, mongod_exec_t)
+')
diff --git a/cloudform.te b/cloudform.te
new file mode 100644
index 0000000..579dff8
--- /dev/null
+++ b/cloudform.te
@@ -0,0 +1,192 @@
+policy_module(cloudform, 1.0)
+########################################
+#
+# Declarations
+#
+
+attribute cloudform_domain;
+
+cloudform_domain_template(deltacloudd)
+cloudform_domain_template(iwhd)
+cloudform_domain_template(mongod)
+
+type deltacloudd_log_t;
+logging_log_file(deltacloudd_log_t)
+
+type deltacloudd_var_run_t;
+files_pid_file(deltacloudd_var_run_t)
+
+type deltacloudd_tmp_t;
+files_tmp_file(deltacloudd_tmp_t)
+
+type iwhd_initrc_exec_t;
+init_script_file(iwhd_initrc_exec_t)
+
+type iwhd_var_lib_t;
+files_type(iwhd_var_lib_t)
+
+type iwhd_var_run_t;
+files_pid_file(iwhd_var_run_t)
+
+type mongod_initrc_exec_t;
+init_script_file(mongod_initrc_exec_t)
+
+type mongod_log_t;
+logging_log_file(mongod_log_t)
+
+type mongod_var_lib_t;
+files_type(mongod_var_lib_t)
+
+type mongod_tmp_t;
+files_tmp_file(mongod_tmp_t)
+
+type mongod_var_run_t;
+files_pid_file(mongod_var_run_t)
+
+type iwhd_log_t;
+logging_log_file(iwhd_log_t)
+
+########################################
+#
+# cloudform_domain local policy
+#
+
+allow cloudform_domain self:fifo_file rw_fifo_file_perms;
+allow cloudform_domain self:tcp_socket create_stream_socket_perms;
+
+kernel_read_system_state(cloudform_domain)
+
+dev_read_rand(cloudform_domain)
+dev_read_urand(cloudform_domain)
+
+files_read_etc_files(cloudform_domain)
+
+auth_read_passwd(cloudform_domain)
+
+miscfiles_read_certs(cloudform_domain)
+miscfiles_read_localization(cloudform_domain)
+
+########################################
+#
+# deltacloudd local policy
+#
+
+allow deltacloudd_t self:capability { dac_override setuid setgid };
+
+allow deltacloudd_t self:netlink_route_socket r_netlink_socket_perms;
+allow deltacloudd_t self:udp_socket create_socket_perms;
+
+allow deltacloudd_t self:process signal;
+
+allow deltacloudd_t self:fifo_file rw_fifo_file_perms;
+allow deltacloudd_t self:tcp_socket create_stream_socket_perms;
+allow deltacloudd_t self:unix_stream_socket create_stream_socket_perms;
+
+manage_dirs_pattern(deltacloudd_t, deltacloudd_tmp_t, deltacloudd_tmp_t)
+manage_files_pattern(deltacloudd_t, deltacloudd_tmp_t, deltacloudd_tmp_t)
+files_tmp_filetrans(deltacloudd_t, deltacloudd_tmp_t, { file dir })
+
+manage_files_pattern(deltacloudd_t, deltacloudd_var_run_t, deltacloudd_var_run_t)
+manage_dirs_pattern(deltacloudd_t, deltacloudd_var_run_t, deltacloudd_var_run_t)
+manage_lnk_files_pattern(deltacloudd_t, deltacloudd_var_run_t, deltacloudd_var_run_t)
+files_pid_filetrans(deltacloudd_t, deltacloudd_var_run_t, { file dir })
+
+manage_files_pattern(deltacloudd_t, deltacloudd_log_t, deltacloudd_log_t)
+manage_dirs_pattern(deltacloudd_t, deltacloudd_log_t, deltacloudd_log_t)
+logging_log_filetrans(deltacloudd_t, deltacloudd_log_t, { file dir })
+
+kernel_read_kernel_sysctls(deltacloudd_t)
+kernel_read_system_state(deltacloudd_t)
+
+corecmd_exec_bin(deltacloudd_t)
+
+corenet_tcp_bind_generic_node(deltacloudd_t)
+corenet_tcp_bind_generic_port(deltacloudd_t)
+
+files_read_usr_files(deltacloudd_t)
+
+logging_send_syslog_msg(deltacloudd_t)
+
+optional_policy(`
+ sysnet_read_config(deltacloudd_t)
+')
+
+########################################
+#
+# iwhd local policy
+#
+
+allow iwhd_t self:capability { chown kill };
+allow iwhd_t self:process { fork };
+
+allow iwhd_t self:netlink_route_socket r_netlink_socket_perms;
+allow iwhd_t self:unix_stream_socket create_stream_socket_perms;
+
+manage_dirs_pattern(iwhd_t, iwhd_var_lib_t, iwhd_var_lib_t)
+manage_files_pattern(iwhd_t, iwhd_var_lib_t, iwhd_var_lib_t)
+
+manage_files_pattern(iwhd_t, iwhd_log_t, iwhd_log_t)
+logging_log_filetrans(iwhd_t, iwhd_log_t, { file })
+
+manage_dirs_pattern(iwhd_t, iwhd_var_run_t, iwhd_var_run_t)
+manage_files_pattern(iwhd_t, iwhd_var_run_t, iwhd_var_run_t)
+files_pid_filetrans(iwhd_t, iwhd_var_run_t, { dir file })
+
+kernel_read_system_state(iwhd_t)
+
+corenet_tcp_bind_generic_node(iwhd_t)
+corenet_tcp_bind_websm_port(iwhd_t)
+corenet_tcp_connect_all_ports(iwhd_t)
+
+dev_read_rand(iwhd_t)
+dev_read_urand(iwhd_t)
+
+userdom_home_manager(iwhd_t)
+
+########################################
+#
+# mongod local policy
+#
+
+allow mongod_t self:process { execmem setsched signal };
+
+allow mongod_t self:netlink_route_socket r_netlink_socket_perms;
+allow mongod_t self:unix_stream_socket create_stream_socket_perms;
+allow mongod_t self:udp_socket create_socket_perms;
+
+manage_dirs_pattern(mongod_t, mongod_log_t, mongod_log_t)
+manage_files_pattern(mongod_t, mongod_log_t, mongod_log_t)
+
+manage_dirs_pattern(mongod_t, mongod_var_lib_t, mongod_var_lib_t)
+manage_files_pattern(mongod_t, mongod_var_lib_t, mongod_var_lib_t)
+
+manage_dirs_pattern(mongod_t, mongod_tmp_t, mongod_tmp_t)
+manage_files_pattern(mongod_t, mongod_tmp_t, mongod_tmp_t)
+manage_sock_files_pattern(mongod_t, mongod_tmp_t, mongod_tmp_t)
+files_tmp_filetrans(mongod_t, mongod_tmp_t, { file dir sock_file })
+
+manage_dirs_pattern(mongod_t, mongod_var_run_t, mongod_var_run_t)
+manage_files_pattern(mongod_t, mongod_var_run_t, mongod_var_run_t)
+#needed by dbomatic
+files_pid_filetrans(mongod_t, mongod_var_run_t, { file })
+
+corenet_tcp_bind_generic_node(mongod_t)
+corenet_tcp_bind_mongod_port(mongod_t)
+
+kernel_read_vm_sysctls(mongod_t)
+kernel_read_system_state(mongod_t)
+
+files_read_usr_files(mongod_t)
+
+optional_policy(`
+ mysql_stream_connect(mongod_t)
+')
+
+optional_policy(`
+ postgresql_stream_connect(mongod_t)
+')
+
+optional_policy(`
+ sysnet_dns_name_resolve(mongod_t)
+')
+
diff --git a/cmirrord.if b/cmirrord.if
index f8463c0..126b293 100644
--- a/cmirrord.if
+++ b/cmirrord.if
@@ -70,10 +70,11 @@ interface(`cmirrord_rw_shm',`
type cmirrord_t, cmirrord_tmpfs_t;
')
- allow $1 cmirrord_t:shm rw_shm_perms;
+ allow $1 cmirrord_t:shm { rw_shm_perms destroy };
allow $1 cmirrord_tmpfs_t:dir list_dir_perms;
rw_files_pattern($1, cmirrord_tmpfs_t, cmirrord_tmpfs_t)
+ delete_files_pattern($1, cmirrord_tmpfs_t, cmirrord_tmpfs_t)
read_lnk_files_pattern($1, cmirrord_tmpfs_t, cmirrord_tmpfs_t)
fs_search_tmpfs($1)
')
@@ -100,9 +101,13 @@ interface(`cmirrord_admin',`
type cmirrord_t, cmirrord_initrc_exec_t, cmirrord_var_run_t;
')
- allow $1 cmirrord_t:process { ptrace signal_perms };
+ allow $1 cmirrord_t:process signal_perms;
ps_process_pattern($1, cmirrord_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 cmorrord_t:process ptrace;
+ ')
+
cmirrord_initrc_domtrans($1)
domain_system_change_exemption($1)
role_transition $2 cmirrord_initrc_exec_t system_r;
diff --git a/cobbler.fc b/cobbler.fc
index 1cf6c4e..0858f92 100644
--- a/cobbler.fc
+++ b/cobbler.fc
@@ -1,7 +1,35 @@
-/etc/cobbler(/.*)? gen_context(system_u:object_r:cobbler_etc_t, s0)
-/etc/rc\.d/init\.d/cobblerd -- gen_context(system_u:object_r:cobblerd_initrc_exec_t, s0)
-/usr/bin/cobblerd -- gen_context(system_u:object_r:cobblerd_exec_t, s0)
+/etc/cobbler(/.*)? gen_context(system_u:object_r:cobbler_etc_t,s0)
+
+/etc/rc\.d/init\.d/cobblerd -- gen_context(system_u:object_r:cobblerd_initrc_exec_t,s0)
+
+/usr/lib/systemd/system/cobblerd.* -- gen_context(system_u:object_r:cobblerd_unit_file_t,s0)
+
+/usr/bin/cobblerd -- gen_context(system_u:object_r:cobblerd_exec_t,s0)
+
+/var/lib/cobbler(/.*)? gen_context(system_u:object_r:cobbler_var_lib_t,s0)
+
+/var/lib/tftpboot/etc(/.*)? gen_context(system_u:object_r:cobbler_var_lib_t,s0)
+/var/lib/tftpboot/grub(/.*)? gen_context(system_u:object_r:cobbler_var_lib_t,s0)
+/var/lib/tftpboot/images(/.*)? gen_context(system_u:object_r:cobbler_var_lib_t,s0)
+/var/lib/tftpboot/memdisk -- gen_context(system_u:object_r:cobbler_var_lib_t,s0)
+/var/lib/tftpboot/menu\.c32 -- gen_context(system_u:object_r:cobbler_var_lib_t,s0)
+/var/lib/tftpboot/ppc(/.*)? gen_context(system_u:object_r:cobbler_var_lib_t,s0)
+/var/lib/tftpboot/pxelinux\.0 -- gen_context(system_u:object_r:cobbler_var_lib_t,s0)
+/var/lib/tftpboot/pxelinux\.cfg(/.*)? gen_context(system_u:object_r:cobbler_var_lib_t,s0)
+/var/lib/tftpboot/s390x(/.*)? gen_context(system_u:object_r:cobbler_var_lib_t,s0)
+/var/lib/tftpboot/yaboot -- gen_context(system_u:object_r:cobbler_var_lib_t,s0)
+
+/var/log/cobbler(/.*)? gen_context(system_u:object_r:cobbler_var_log_t,s0)
+
+# This should removable when cobbler package installs /var/www/cobbler/rendered
+/var/www/cobbler(/.*)? gen_context(system_u:object_r:httpd_cobbler_content_t,s0)
+
+/var/www/cobbler/images(/.*)? gen_context(system_u:object_r:cobbler_var_lib_t,s0)
+/var/www/cobbler/ks_mirror(/.*)? gen_context(system_u:object_r:cobbler_var_lib_t,s0)
+/var/www/cobbler/links(/.*)? gen_context(system_u:object_r:cobbler_var_lib_t,s0)
+/var/www/cobbler/localmirror(/.*)? gen_context(system_u:object_r:cobbler_var_lib_t,s0)
+/var/www/cobbler/pub(/.*)? gen_context(system_u:object_r:cobbler_var_lib_t,s0)
+/var/www/cobbler/rendered(/.*)? gen_context(system_u:object_r:cobbler_var_lib_t,s0)
+/var/www/cobbler/repo_mirror(/.*)? gen_context(system_u:object_r:cobbler_var_lib_t,s0)
-/var/lib/cobbler(/.*)? gen_context(system_u:object_r:cobbler_var_lib_t, s0)
-/var/log/cobbler(/.*)? gen_context(system_u:object_r:cobbler_var_log_t, s0)
diff --git a/cobbler.if b/cobbler.if
index 116d60f..e2c6ec6 100644
--- a/cobbler.if
+++ b/cobbler.if
@@ -1,12 +1,12 @@
## Cobbler installation server.
##
##
-## Cobbler is a Linux installation server that allows for
-## rapid setup of network installation environments. It
-## glues together and automates many associated Linux
-## tasks so you do not have to hop between lots of various
-## commands and applications when rolling out new systems,
-## and, in some cases, changing existing ones.
+## Cobbler is a Linux installation server that allows for
+## rapid setup of network installation environments. It
+## glues together and automates many associated Linux
+## tasks so you do not have to hop between lots of various
+## commands and applications when rolling out new systems,
+## and, in some cases, changing existing ones.
##
##
@@ -15,9 +15,9 @@
## Execute a domain transition to run cobblerd.
##
##
-##
+##
## Domain allowed to transition.
-##
+##
##
#
interface(`cobblerd_domtrans',`
@@ -26,6 +26,7 @@ interface(`cobblerd_domtrans',`
')
domtrans_pattern($1, cobblerd_exec_t, cobblerd_t)
+ corecmd_search_bin($1)
')
########################################
@@ -48,7 +49,7 @@ interface(`cobblerd_initrc_domtrans',`
########################################
##
-## Read Cobbler content in /etc
+## List Cobbler configuration.
##
##
##
@@ -56,19 +57,18 @@ interface(`cobblerd_initrc_domtrans',`
##
##
#
-interface(`cobbler_read_config',`
+interface(`cobbler_list_config',`
gen_require(`
type cobbler_etc_t;
')
- read_files_pattern($1, cobbler_etc_t, cobbler_etc_t)
+ list_dirs_pattern($1, cobbler_etc_t, cobbler_etc_t)
files_search_etc($1)
')
########################################
##
-## Do not audit attempts to read and write
-## Cobbler log files (leaked fd).
+## Read Cobbler configuration files.
##
##
##
@@ -76,12 +76,13 @@ interface(`cobbler_read_config',`
##
##
#
-interface(`cobbler_dontaudit_rw_log',`
+interface(`cobbler_read_config',`
gen_require(`
- type cobbler_var_log_t;
+ type cobbler_etc_t;
')
- dontaudit $1 cobbler_var_log_t:file rw_file_perms;
+ read_files_pattern($1, cobbler_etc_t, cobbler_etc_t)
+ files_search_etc($1)
')
########################################
@@ -100,6 +101,7 @@ interface(`cobbler_search_lib',`
')
search_dirs_pattern($1, cobbler_var_lib_t, cobbler_var_lib_t)
+ read_lnk_files_pattern($1, cobbler_var_lib_t, cobbler_var_lib_t)
files_search_var_lib($1)
')
@@ -119,6 +121,7 @@ interface(`cobbler_read_lib_files',`
')
read_files_pattern($1, cobbler_var_lib_t, cobbler_var_lib_t)
+ read_lnk_files_pattern($1, cobbler_var_lib_t, cobbler_var_lib_t)
files_search_var_lib($1)
')
@@ -137,12 +140,56 @@ interface(`cobbler_manage_lib_files',`
type cobbler_var_lib_t;
')
+ manage_dirs_pattern($1, cobbler_var_lib_t, cobbler_var_lib_t)
manage_files_pattern($1, cobbler_var_lib_t, cobbler_var_lib_t)
+ manage_lnk_files_pattern($1, cobbler_var_lib_t, cobbler_var_lib_t)
files_search_var_lib($1)
')
########################################
##
+## Do not audit attempts to read and write
+## Cobbler log files (leaked fd).
+##
+##
+##
+## Domain to not audit.
+##
+##
+#
+interface(`cobbler_dontaudit_rw_log',`
+ gen_require(`
+ type cobbler_var_log_t;
+ ')
+
+ dontaudit $1 cobbler_var_log_t:file rw_inherited_file_perms;
+')
+
+########################################
+##
+## Execute cobblerd server in the cobblerd domain.
+##
+##
+##
+## Domain allowed to transition.
+##
+##
+#
+interface(`cobblerd_systemctl',`
+ gen_require(`
+ type cobblerd_t;
+ type cobblerd_unit_file_t;
+ ')
+
+ systemd_exec_systemctl($1)
+ allow $1 cobblerd_unit_file_t:file read_file_perms;
+ allow $1 cobblerd_unit_file_t:service manage_service_perms;
+
+ ps_process_pattern($1, cobblerd_t)
+')
+
+########################################
+##
## All of the rules required to administrate
## an cobblerd environment
##
@@ -161,25 +208,43 @@ interface(`cobbler_manage_lib_files',`
interface(`cobblerd_admin',`
gen_require(`
type cobblerd_t, cobbler_var_lib_t, cobbler_var_log_t;
- type cobbler_etc_t, cobblerd_initrc_exec_t;
+ type cobbler_etc_t, cobblerd_initrc_exec_t, httpd_cobbler_content_t;
+ type httpd_cobbler_content_ra_t, httpd_cobbler_content_rw_t;
+ type cobblerd_unit_file_t;
')
- allow $1 cobblerd_t:process { ptrace signal_perms getattr };
- read_files_pattern($1, cobblerd_t, cobblerd_t)
+ allow $1 cobblerd_t:process signal_perms;
+ ps_process_pattern($1, cobblerd_t)
- files_search_etc($1)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 cobblerd_t:process ptrace;
+ ')
+
+ files_list_etc($1)
admin_pattern($1, cobbler_etc_t)
files_list_var_lib($1)
admin_pattern($1, cobbler_var_lib_t)
- logging_search_logs($1)
+ logging_list_logs($1)
admin_pattern($1, cobbler_var_log_t)
+ apache_list_sys_content($1)
+ admin_pattern($1, httpd_cobbler_content_t)
+ admin_pattern($1, httpd_cobbler_content_ra_t)
admin_pattern($1, httpd_cobbler_content_rw_t)
cobblerd_initrc_domtrans($1)
domain_system_change_exemption($1)
role_transition $2 cobblerd_initrc_exec_t system_r;
allow $2 system_r;
+
+ optional_policy(`
+ # traverse /var/lib/tftpdir to get to cobbler_var_lib_t there.
+ tftp_search_rw_content($1)
+ ')
+
+ cobblerd_systemctl($1)
+ admin_pattern($1, cobblerd_unit_file_t)
+ allow $1 cobblerd_unit_file_t:service all_service_perms;
')
diff --git a/cobbler.te b/cobbler.te
index 0258b48..aa5daa9 100644
--- a/cobbler.te
+++ b/cobbler.te
@@ -6,13 +6,35 @@ policy_module(cobbler, 1.1.0)
#
##
-##
-## Allow Cobbler to modify public files
-## used for public file transfer services.
-##
+##
+## Allow Cobbler to modify public files
+## used for public file transfer services.
+##
##
gen_tunable(cobbler_anon_write, false)
+##
+##
+## Allow Cobbler to connect to the
+## network using TCP.
+##
+##
+gen_tunable(cobbler_can_network_connect, false)
+
+##
+##
+## Allow Cobbler to access cifs file systems.
+##
+##
+gen_tunable(cobbler_use_cifs, false)
+
+##
+##
+## Allow Cobbler to access nfs file systems.
+##
+##
+gen_tunable(cobbler_use_nfs, false)
+
type cobblerd_t;
type cobblerd_exec_t;
init_daemon_domain(cobblerd_t, cobblerd_exec_t)
@@ -26,25 +48,43 @@ files_config_file(cobbler_etc_t)
type cobbler_var_log_t;
logging_log_file(cobbler_var_log_t)
-type cobbler_var_lib_t;
+type cobbler_var_lib_t alias cobbler_content_t;
files_type(cobbler_var_lib_t)
+type cobbler_tmp_t;
+files_tmp_file(cobbler_tmp_t)
+
+type cobblerd_unit_file_t;
+systemd_unit_file(cobblerd_unit_file_t)
+
########################################
#
# Cobbler personal policy.
#
-allow cobblerd_t self:capability { chown dac_override fowner sys_nice };
+allow cobblerd_t self:capability { chown dac_override fowner fsetid sys_nice };
+dontaudit cobblerd_t self:capability sys_tty_config;
+
allow cobblerd_t self:process { getsched setsched signal };
allow cobblerd_t self:fifo_file rw_fifo_file_perms;
+allow cobblerd_t self:netlink_route_socket create_netlink_socket_perms;
allow cobblerd_t self:tcp_socket create_stream_socket_perms;
+allow cobblerd_t self:udp_socket create_socket_perms;
+allow cobblerd_t self:unix_dgram_socket create_socket_perms;
list_dirs_pattern(cobblerd_t, cobbler_etc_t, cobbler_etc_t)
read_files_pattern(cobblerd_t, cobbler_etc_t, cobbler_etc_t)
+# Something that runs in the cobberd_t domain tries to relabelfrom cobbler_var_lib_t dir to httpd_sys_content_t.
+dontaudit cobblerd_t cobbler_var_lib_t:dir relabel_dir_perms;
+
manage_dirs_pattern(cobblerd_t, cobbler_var_lib_t, cobbler_var_lib_t)
manage_files_pattern(cobblerd_t, cobbler_var_lib_t, cobbler_var_lib_t)
-files_var_lib_filetrans(cobblerd_t, cobbler_var_lib_t, { dir file })
+manage_lnk_files_pattern(cobblerd_t, cobbler_var_lib_t, cobbler_var_lib_t)
+files_var_lib_filetrans(cobblerd_t, cobbler_var_lib_t, { dir file lnk_file })
+
+# Something really needs to write to cobbler.log. Ideally this should not be happening.
+allow cobblerd_t cobbler_var_log_t:file write;
append_files_pattern(cobblerd_t, cobbler_var_log_t, cobbler_var_log_t)
create_files_pattern(cobblerd_t, cobbler_var_log_t, cobbler_var_log_t)
@@ -52,7 +92,14 @@ read_files_pattern(cobblerd_t, cobbler_var_log_t, cobbler_var_log_t)
setattr_files_pattern(cobblerd_t, cobbler_var_log_t, cobbler_var_log_t)
logging_log_filetrans(cobblerd_t, cobbler_var_log_t, file)
+manage_dirs_pattern(cobblerd_t, cobbler_tmp_t, cobbler_tmp_t)
+manage_files_pattern(cobblerd_t, cobbler_tmp_t, cobbler_tmp_t)
+files_tmp_filetrans(cobblerd_t, cobbler_tmp_t, { dir file })
+
kernel_read_system_state(cobblerd_t)
+kernel_dontaudit_search_network_state(cobblerd_t)
+
+auth_read_passwd(cobblerd_t)
corecmd_exec_bin(cobblerd_t)
corecmd_exec_shell(cobblerd_t)
@@ -65,44 +112,111 @@ corenet_tcp_bind_generic_node(cobblerd_t)
corenet_tcp_sendrecv_generic_if(cobblerd_t)
corenet_tcp_sendrecv_generic_node(cobblerd_t)
corenet_tcp_sendrecv_generic_port(cobblerd_t)
+corenet_tcp_sendrecv_cobbler_port(cobblerd_t)
+# sync and rsync to ftp and http are permitted by default, for any other media use cobbler_can_network_connect.
+corenet_tcp_connect_ftp_port(cobblerd_t)
+corenet_tcp_connect_all_ephemeral_ports(cobblerd_t)
+corenet_tcp_sendrecv_ftp_port(cobblerd_t)
+corenet_sendrecv_ftp_client_packets(cobblerd_t)
+corenet_tcp_connect_http_port(cobblerd_t)
+corenet_tcp_sendrecv_http_port(cobblerd_t)
+corenet_sendrecv_http_client_packets(cobblerd_t)
dev_read_urand(cobblerd_t)
+domain_dontaudit_exec_all_entry_files(cobblerd_t)
+domain_dontaudit_read_all_domains_state(cobblerd_t)
+
+files_read_etc_files(cobblerd_t)
+# mtab
+files_read_etc_runtime_files(cobblerd_t)
files_read_usr_files(cobblerd_t)
files_list_boot(cobblerd_t)
+files_read_boot_files(cobblerd_t)
files_list_tmp(cobblerd_t)
-# read /etc/nsswitch.conf
-files_read_etc_files(cobblerd_t)
+
+# read from mounted images (install media)
+fs_read_iso9660_files(cobblerd_t)
+
+init_dontaudit_read_all_script_files(cobblerd_t)
+
+term_use_console(cobblerd_t)
+
+logging_send_syslog_msg(cobblerd_t)
miscfiles_read_localization(cobblerd_t)
miscfiles_read_public_files(cobblerd_t)
+selinux_get_enforce_mode(cobblerd_t)
+
sysnet_read_config(cobblerd_t)
sysnet_rw_dhcp_config(cobblerd_t)
sysnet_write_config(cobblerd_t)
+userdom_dontaudit_use_user_terminals(cobblerd_t)
+userdom_dontaudit_search_user_home_dirs(cobblerd_t)
+userdom_dontaudit_search_admin_dir(cobblerd_t)
+
tunable_policy(`cobbler_anon_write',`
miscfiles_manage_public_files(cobblerd_t)
')
+tunable_policy(`cobbler_can_network_connect',`
+ corenet_tcp_connect_all_ports(cobblerd_t)
+ corenet_tcp_sendrecv_all_ports(cobblerd_t)
+ corenet_sendrecv_all_client_packets(cobblerd_t)
+')
+
+tunable_policy(`cobbler_use_cifs',`
+ fs_manage_cifs_dirs(cobblerd_t)
+ fs_manage_cifs_files(cobblerd_t)
+ fs_manage_cifs_symlinks(cobblerd_t)
+')
+
+tunable_policy(`cobbler_use_nfs',`
+ fs_manage_nfs_dirs(cobblerd_t)
+ fs_manage_nfs_files(cobblerd_t)
+ fs_manage_nfs_symlinks(cobblerd_t)
+')
+
+optional_policy(`
+ # Cobbler traverses /var/www to get to /var/www/cobbler/*
+ apache_search_sys_content(cobblerd_t)
+')
+
optional_policy(`
bind_read_config(cobblerd_t)
bind_write_config(cobblerd_t)
bind_domtrans_ndc(cobblerd_t)
bind_domtrans(cobblerd_t)
bind_initrc_domtrans(cobblerd_t)
+ bind_systemctl(cobblerd_t)
bind_manage_zone(cobblerd_t)
')
optional_policy(`
+ certmaster_exec(cobblerd_t)
+')
+
+optional_policy(`
dhcpd_domtrans(cobblerd_t)
dhcpd_initrc_domtrans(cobblerd_t)
+ dhcpd_systemctl(cobblerd_t)
')
optional_policy(`
dnsmasq_domtrans(cobblerd_t)
dnsmasq_initrc_domtrans(cobblerd_t)
dnsmasq_write_config(cobblerd_t)
+ dnsmasq_systemctl(cobblerd_t)
+')
+
+optional_policy(`
+ gnome_dontaudit_search_config(cobblerd_t)
+')
+
+optional_policy(`
+ puppet_domtrans_puppetca(cobblerd_t)
')
optional_policy(`
@@ -110,12 +224,21 @@ optional_policy(`
')
optional_policy(`
- rsync_read_config(cobblerd_t)
- rsync_write_config(cobblerd_t)
+ rsync_exec(cobblerd_t)
+ rsync_manage_config(cobblerd_t)
+ # cobbler creates /etc/rsync.conf if its not there.
+ rsync_filetrans_config(cobblerd_t, file)
')
optional_policy(`
- tftp_manage_rw_content(cobblerd_t)
+ # Cobbler puts objects in both /var/lib/tftpdir as well as /var/lib/tftpdir/images.
+ # tftp_manage_rw_content(cobblerd_t) can be used instead if:
+ # 1. cobbler package installs /var/lib/tftpdir/images.
+ # 2. no FILES in /var/lib/TFTPDIR are hard linked.
+ # Cobbler also creates other directories in /var/lib/tftpdir (etc, s390x, ppc, pxelinux.cfg)
+ # are any of those hard linked?
+ tftp_filetrans_tftpdir(cobblerd_t, cobbler_var_lib_t, { dir file })
+ tftp_manage_config(cobblerd_t)
')
########################################
@@ -124,5 +247,6 @@ optional_policy(`
#
apache_content_template(cobbler)
+list_dirs_pattern(cobblerd_t, httpd_cobbler_content_t, httpd_cobbler_content_t)
manage_dirs_pattern(cobblerd_t, httpd_cobbler_content_rw_t, httpd_cobbler_content_rw_t)
manage_files_pattern(cobblerd_t, httpd_cobbler_content_rw_t, httpd_cobbler_content_rw_t)
diff --git a/collectd.fc b/collectd.fc
new file mode 100644
index 0000000..2e1007b
--- /dev/null
+++ b/collectd.fc
@@ -0,0 +1,13 @@
+
+/etc/rc\.d/init\.d/collectd -- gen_context(system_u:object_r:collectd_initrc_exec_t,s0)
+
+/usr/lib/systemd/system/collectd.* -- gen_context(system_u:object_r:collectd_unit_file_t,s0)
+
+/usr/sbin/collectd -- gen_context(system_u:object_r:collectd_exec_t,s0)
+
+/var/lib/collectd(/.*)? gen_context(system_u:object_r:collectd_var_lib_t,s0)
+
+/var/run/collectd\.pid gen_context(system_u:object_r:collectd_var_run_t,s0)
+
+/usr/share/collectd/collection3/bin/.*\.cgi -- gen_context(system_u:object_r:httpd_collectd_script_exec_t,s0)
+
diff --git a/collectd.if b/collectd.if
new file mode 100644
index 0000000..40415f8
--- /dev/null
+++ b/collectd.if
@@ -0,0 +1,186 @@
+
+## policy for collectd
+
+########################################
+##
+## Transition to collectd.
+##
+##
+##
+## Domain allowed to transition.
+##
+##
+#
+interface(`collectd_domtrans',`
+ gen_require(`
+ type collectd_t, collectd_exec_t;
+ ')
+
+ corecmd_search_bin($1)
+ domtrans_pattern($1, collectd_exec_t, collectd_t)
+')
+
+
+########################################
+##
+## Execute collectd server in the collectd domain.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`collectd_initrc_domtrans',`
+ gen_require(`
+ type collectd_initrc_exec_t;
+ ')
+
+ init_labeled_script_domtrans($1, collectd_initrc_exec_t)
+')
+
+
+########################################
+##
+## Search collectd lib directories.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`collectd_search_lib',`
+ gen_require(`
+ type collectd_var_lib_t;
+ ')
+
+ allow $1 collectd_var_lib_t:dir search_dir_perms;
+ files_search_var_lib($1)
+')
+
+########################################
+##
+## Read collectd lib files.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`collectd_read_lib_files',`
+ gen_require(`
+ type collectd_var_lib_t;
+ ')
+
+ files_search_var_lib($1)
+ read_files_pattern($1, collectd_var_lib_t, collectd_var_lib_t)
+')
+
+########################################
+##
+## Manage collectd lib files.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`collectd_manage_lib_files',`
+ gen_require(`
+ type collectd_var_lib_t;
+ ')
+
+ files_search_var_lib($1)
+ manage_files_pattern($1, collectd_var_lib_t, collectd_var_lib_t)
+')
+
+########################################
+##
+## Manage collectd lib directories.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`collectd_manage_lib_dirs',`
+ gen_require(`
+ type collectd_var_lib_t;
+ ')
+
+ files_search_var_lib($1)
+ manage_dirs_pattern($1, collectd_var_lib_t, collectd_var_lib_t)
+')
+
+########################################
+##
+## Execute collectd server in the collectd domain.
+##
+##
+##
+## Domain allowed to transition.
+##
+##
+#
+interface(`collectd_systemctl',`
+ gen_require(`
+ type collectd_t;
+ type collectd_unit_file_t;
+ ')
+
+ systemd_exec_systemctl($1)
+ allow $1 collectd_unit_file_t:file read_file_perms;
+ allow $1 collectd_unit_file_t:service manage_service_perms;
+
+ ps_process_pattern($1, collectd_t)
+')
+
+########################################
+##
+## All of the rules required to administrate
+## an collectd environment
+##
+##
+##
+## Domain allowed access.
+##
+##
+##
+##
+## Role allowed access.
+##
+##
+##
+#
+interface(`collectd_admin',`
+ gen_require(`
+ type collectd_t;
+ type collectd_initrc_exec_t;
+ type collectd_var_lib_t;
+ type collectd_unit_file_t;
+ ')
+
+ allow $1 collectd_t:process signal_perms;
+ ps_process_pattern($1, collectd_t)
+
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 collectd_t:process ptrace;
+ ')
+
+ collectd_initrc_domtrans($1)
+ domain_system_change_exemption($1)
+ role_transition $2 collectd_initrc_exec_t system_r;
+ allow $2 system_r;
+
+ files_search_var_lib($1)
+ admin_pattern($1, collectd_var_lib_t)
+
+ collectd_systemctl($1)
+ admin_pattern($1, collectd_unit_file_t)
+ allow $1 collectd_unit_file_t:service all_service_perms;
+')
+
diff --git a/collectd.te b/collectd.te
new file mode 100644
index 0000000..6cefd75
--- /dev/null
+++ b/collectd.te
@@ -0,0 +1,91 @@
+policy_module(collectd, 1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+##
+##
+## Allow collectd to connect to the
+## network using TCP.
+##
+##
+gen_tunable(collectd_can_network_connect, false)
+
+type collectd_t;
+type collectd_exec_t;
+init_daemon_domain(collectd_t, collectd_exec_t)
+
+type collectd_initrc_exec_t;
+init_script_file(collectd_initrc_exec_t)
+
+type collectd_var_lib_t;
+files_type(collectd_var_lib_t)
+
+type collectd_var_run_t;
+files_pid_file(collectd_var_run_t)
+
+type collectd_unit_file_t;
+systemd_unit_file(collectd_unit_file_t)
+
+########################################
+#
+# collectd local policy
+#
+
+allow collectd_t self:capability { ipc_lock sys_nice };
+allow collectd_t self:process { getsched setsched signal fork };
+
+allow collectd_t self:fifo_file rw_fifo_file_perms;
+allow collectd_t self:packet_socket create_socket_perms;
+allow collectd_t self:unix_stream_socket create_stream_socket_perms;
+
+manage_dirs_pattern(collectd_t, collectd_var_lib_t, collectd_var_lib_t)
+manage_files_pattern(collectd_t, collectd_var_lib_t, collectd_var_lib_t)
+files_var_lib_filetrans(collectd_t, collectd_var_lib_t, { dir file })
+
+manage_dirs_pattern(collectd_t, collectd_var_run_t, collectd_var_run_t)
+manage_files_pattern(collectd_t, collectd_var_run_t, collectd_var_run_t)
+files_pid_filetrans(collectd_t, collectd_var_run_t, { dir file })
+
+domain_use_interactive_fds(collectd_t)
+
+kernel_read_network_state(collectd_t)
+kernel_read_net_sysctls(collectd_t)
+kernel_read_system_state(collectd_t)
+
+dev_read_sysfs(collectd_t)
+dev_read_urand(collectd_t)
+dev_read_rand(collectd_t)
+
+files_getattr_all_dirs(collectd_t)
+files_read_etc_files(collectd_t)
+files_read_usr_files(collectd_t)
+
+fs_getattr_all_fs(collectd_t)
+
+miscfiles_read_localization(collectd_t)
+
+logging_send_syslog_msg(collectd_t)
+
+sysnet_dns_name_resolve(collectd_t)
+
+tunable_policy(`collectd_can_network_connect',`
+ corenet_tcp_connect_all_ports(collectd_t)
+ corenet_tcp_sendrecv_all_ports(collectd_t)
+ corenet_sendrecv_all_client_packets(collectd_t)
+')
+
+optional_policy(`
+ apache_content_template(collectd)
+
+ files_search_var_lib(httpd_collectd_script_t)
+ read_files_pattern(httpd_collectd_script_t, collectd_var_lib_t, collectd_var_lib_t)
+ list_dirs_pattern(httpd_collectd_script_t, collectd_var_lib_t, collectd_var_lib_t)
+ miscfiles_setattr_fonts_cache_dirs(httpd_collectd_script_t)
+')
+
+optional_policy(`
+ virt_read_config(collectd_t)
+')
diff --git a/colord.fc b/colord.fc
index 78b2fea..ef975ac 100644
--- a/colord.fc
+++ b/colord.fc
@@ -1,4 +1,7 @@
/usr/libexec/colord -- gen_context(system_u:object_r:colord_exec_t,s0)
+/usr/libexec/colord-sane -- gen_context(system_u:object_r:colord_exec_t,s0)
+
+/usr/lib/systemd/system/colord.* -- gen_context(system_u:object_r:colord_unit_file_t,s0)
/var/lib/color(/.*)? gen_context(system_u:object_r:colord_var_lib_t,s0)
/var/lib/colord(/.*)? gen_context(system_u:object_r:colord_var_lib_t,s0)
diff --git a/colord.if b/colord.if
index 733e4e6..fa2c3cb 100644
--- a/colord.if
+++ b/colord.if
@@ -57,3 +57,26 @@ interface(`colord_read_lib_files',`
files_search_var_lib($1)
read_files_pattern($1, colord_var_lib_t, colord_var_lib_t)
')
+
+########################################
+##
+## Execute colord server in the colord domain.
+##
+##
+##
+## Domain allowed to transition.
+##
+##
+#
+interface(`colord_systemctl',`
+ gen_require(`
+ type colord_t;
+ type colord_unit_file_t;
+ ')
+
+ systemd_exec_systemctl($1)
+ allow $1 colord_unit_file_t:file read_file_perms;
+ allow $1 colord_unit_file_t:service manage_service_perms;
+
+ ps_process_pattern($1, colord_t)
+')
diff --git a/colord.te b/colord.te
index 74505cc..2bafa23 100644
--- a/colord.te
+++ b/colord.te
@@ -8,6 +8,7 @@ policy_module(colord, 1.0.0)
type colord_t;
type colord_exec_t;
dbus_system_domain(colord_t, colord_exec_t)
+init_daemon_domain(colord_t, colord_exec_t)
type colord_tmp_t;
files_tmp_file(colord_tmp_t)
@@ -18,14 +19,20 @@ files_tmpfs_file(colord_tmpfs_t)
type colord_var_lib_t;
files_type(colord_var_lib_t)
+type colord_unit_file_t;
+systemd_unit_file(colord_unit_file_t)
+
########################################
#
# colord local policy
#
allow colord_t self:capability { dac_read_search dac_override };
+dontaudit colord_t self:capability sys_admin;
allow colord_t self:process signal;
allow colord_t self:fifo_file rw_fifo_file_perms;
allow colord_t self:netlink_kobject_uevent_socket create_socket_perms;
+allow colord_t self:tcp_socket create_stream_socket_perms;
+allow colord_t self:shm create_shm_perms;
allow colord_t self:udp_socket create_socket_perms;
allow colord_t self:unix_dgram_socket create_socket_perms;
@@ -41,8 +48,14 @@ manage_dirs_pattern(colord_t, colord_var_lib_t, colord_var_lib_t)
manage_files_pattern(colord_t, colord_var_lib_t, colord_var_lib_t)
files_var_lib_filetrans(colord_t, colord_var_lib_t, { file dir })
-kernel_getattr_proc_files(colord_t)
+kernel_read_network_state(colord_t)
+kernel_read_system_state(colord_t)
kernel_read_device_sysctls(colord_t)
+kernel_request_load_module(colord_t)
+
+# reads *.ini files
+corecmd_exec_bin(colord_t)
+corecmd_exec_shell(colord_t)
corenet_all_recvfrom_unlabeled(colord_t)
corenet_all_recvfrom_netlabel(colord_t)
@@ -50,6 +63,8 @@ corenet_udp_bind_generic_node(colord_t)
corenet_udp_bind_ipp_port(colord_t)
corenet_tcp_connect_ipp_port(colord_t)
+dev_read_raw_memory(colord_t)
+dev_write_raw_memory(colord_t)
dev_read_video_dev(colord_t)
dev_write_video_dev(colord_t)
dev_rw_printer(colord_t)
@@ -62,22 +77,37 @@ dev_rw_generic_usb_dev(colord_t)
domain_use_interactive_fds(colord_t)
files_list_mnt(colord_t)
-files_read_etc_files(colord_t)
files_read_usr_files(colord_t)
+fs_search_all(colord_t)
+fs_getattr_noxattr_fs(colord_t)
+fs_dontaudit_getattr_all_fs(colord_t)
+fs_list_noxattr_fs(colord_t)
fs_read_noxattr_fs_files(colord_t)
+storage_getattr_fixed_disk_dev(colord_t)
+storage_getattr_removable_dev(colord_t)
+storage_read_scsi_generic(colord_t)
+storage_write_scsi_generic(colord_t)
+
+auth_use_nsswitch(colord_t)
+
logging_send_syslog_msg(colord_t)
miscfiles_read_localization(colord_t)
-sysnet_dns_name_resolve(colord_t)
+fs_getattr_tmpfs(colord_t)
+userdom_rw_user_tmpfs_files(colord_t)
+
+userdom_home_reader(colord_t)
tunable_policy(`use_nfs_home_dirs',`
+ fs_getattr_nfs(colord_t)
fs_read_nfs_files(colord_t)
')
tunable_policy(`use_samba_home_dirs',`
+ fs_getattr_cifs(colord_t)
fs_read_cifs_files(colord_t)
')
@@ -89,6 +119,12 @@ optional_policy(`
')
optional_policy(`
+ gnome_read_home_icc_data_content(colord_t)
+ # Fixes lots of breakage in F16 on upgrade
+ gnome_read_generic_data_home_files(colord_t)
+')
+
+optional_policy(`
policykit_dbus_chat(colord_t)
policykit_domtrans_auth(colord_t)
policykit_read_lib(colord_t)
@@ -96,5 +132,20 @@ optional_policy(`
')
optional_policy(`
+ sysnet_exec_ifconfig(colord_t)
+ sysnet_dns_name_resolve(colord_t)
+')
+
+optional_policy(`
udev_read_db(colord_t)
')
+
+optional_policy(`
+ xserver_dbus_chat_xdm(colord_t)
+ # /var/lib/gdm/.local/share/icc/edid-0a027915105823af34f99b1704e80336.icc
+ xserver_read_inherited_xdm_lib_files(colord_t)
+')
+
+optional_policy(`
+ zoneminder_rw_tmpfs_files(colord_t)
+')
diff --git a/comsat.te b/comsat.te
index 3d121fd..fbad020 100644
--- a/comsat.te
+++ b/comsat.te
@@ -51,7 +51,6 @@ dev_read_urand(comsat_t)
fs_getattr_xattr_fs(comsat_t)
-files_read_etc_files(comsat_t)
files_list_usr(comsat_t)
files_search_spool(comsat_t)
files_search_home(comsat_t)
diff --git a/condor.fc b/condor.fc
new file mode 100644
index 0000000..b3a5b51
--- /dev/null
+++ b/condor.fc
@@ -0,0 +1,21 @@
+/usr/lib/systemd/system/condor.* -- gen_context(system_u:object_r:condor_unit_file_t,s0)
+
+/usr/sbin/condor_master -- gen_context(system_u:object_r:condor_master_exec_t,s0)
+/usr/sbin/condor_collector -- gen_context(system_u:object_r:condor_collector_exec_t,s0)
+/usr/sbin/condor_negotiator -- gen_context(system_u:object_r:condor_negotiator_exec_t,s0)
+/usr/sbin/condor_schedd -- gen_context(system_u:object_r:condor_schedd_exec_t,s0)
+/usr/sbin/condor_startd -- gen_context(system_u:object_r:condor_startd_exec_t,s0)
+/usr/sbin/condor_starter -- gen_context(system_u:object_r:condor_startd_exec_t,s0)
+/usr/sbin/condor_procd -- gen_context(system_u:object_r:condor_procd_exec_t,s0)
+
+/var/lib/condor(/.*)? gen_context(system_u:object_r:condor_var_lib_t,s0)
+
+/var/lib/condor/execute(/.*)? gen_context(system_u:object_r:condor_var_lib_t,s0)
+
+/var/lib/condor/spool(/.*)? gen_context(system_u:object_r:condor_var_lib_t,s0)
+
+/var/lock/condor(/.*)? gen_context(system_u:object_r:condor_var_lock_t,s0)
+
+/var/log/condor(/.*)? gen_context(system_u:object_r:condor_log_t,s0)
+
+/var/run/condor(/.*)? gen_context(system_u:object_r:condor_var_run_t,s0)
diff --git a/condor.if b/condor.if
new file mode 100644
index 0000000..168f664
--- /dev/null
+++ b/condor.if
@@ -0,0 +1,327 @@
+
+## policy for condor
+
+#####################################
+##
+## Creates types and rules for a basic
+## condor init daemon domain.
+##
+##
+##
+## Prefix for the domain.
+##
+##
+#
+template(`condor_domain_template',`
+ gen_require(`
+ type condor_master_t;
+ attribute condor_domain;
+ ')
+
+ #############################
+ #
+ # Declarations
+ #
+
+ type condor_$1_t, condor_domain;
+ type condor_$1_exec_t;
+ init_daemon_domain(condor_$1_t, condor_$1_exec_t)
+ role system_r types condor_$1_t;
+
+ domtrans_pattern(condor_master_t, condor_$1_exec_t, condor_$1_t)
+ allow condor_master_t condor_$1_exec_t:file ioctl;
+')
+
+########################################
+##
+## Transition to condor.
+##
+##
+##
+## Domain allowed to transition.
+##
+##
+#
+interface(`condor_domtrans',`
+ gen_require(`
+ type condor_t, condor_exec_t;
+ ')
+
+ corecmd_search_bin($1)
+ domtrans_pattern($1, condor_exec_t, condor_t)
+')
+########################################
+##
+## Read condor's log files.
+##
+##
+##
+## Domain allowed access.
+##
+##
+##
+#
+interface(`condor_read_log',`
+ gen_require(`
+ type condor_log_t;
+ ')
+
+ logging_search_logs($1)
+ read_files_pattern($1, condor_log_t, condor_log_t)
+')
+
+########################################
+##
+## Append to condor log files.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`condor_append_log',`
+ gen_require(`
+ type condor_log_t;
+ ')
+
+ logging_search_logs($1)
+ append_files_pattern($1, condor_log_t, condor_log_t)
+')
+
+########################################
+##
+## Manage condor log files
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`condor_manage_log',`
+ gen_require(`
+ type condor_log_t;
+ ')
+
+ logging_search_logs($1)
+ manage_dirs_pattern($1, condor_log_t, condor_log_t)
+ manage_files_pattern($1, condor_log_t, condor_log_t)
+ manage_lnk_files_pattern($1, condor_log_t, condor_log_t)
+')
+
+########################################
+##
+## Search condor lib directories.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`condor_search_lib',`
+ gen_require(`
+ type condor_var_lib_t;
+ ')
+
+ allow $1 condor_var_lib_t:dir search_dir_perms;
+ files_search_var_lib($1)
+')
+
+########################################
+##
+## Read condor lib files.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`condor_read_lib_files',`
+ gen_require(`
+ type condor_var_lib_t;
+ ')
+
+ files_search_var_lib($1)
+ read_files_pattern($1, condor_var_lib_t, condor_var_lib_t)
+')
+
+######################################
+##
+## Read and write condor lib files.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`condor_rw_lib_files',`
+ gen_require(`
+ type condor_var_lib_t;
+ ')
+
+ files_search_var_lib($1)
+ rw_files_pattern($1, condor_var_lib_t, condor_var_lib_t)
+')
+
+########################################
+##
+## Manage condor lib files.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`condor_manage_lib_files',`
+ gen_require(`
+ type condor_var_lib_t;
+ ')
+
+ files_search_var_lib($1)
+ manage_files_pattern($1, condor_var_lib_t, condor_var_lib_t)
+')
+
+########################################
+##
+## Manage condor lib directories.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`condor_manage_lib_dirs',`
+ gen_require(`
+ type condor_var_lib_t;
+ ')
+
+ files_search_var_lib($1)
+ manage_dirs_pattern($1, condor_var_lib_t, condor_var_lib_t)
+')
+
+########################################
+##
+## Read condor PID files.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`condor_read_pid_files',`
+ gen_require(`
+ type condor_var_run_t;
+ ')
+
+ files_search_pids($1)
+ allow $1 condor_var_run_t:file read_file_perms;
+')
+
+########################################
+##
+## Execute condor server in the condor domain.
+##
+##
+##
+## Domain allowed to transition.
+##
+##
+#
+interface(`condor_systemctl',`
+ gen_require(`
+ type condor_t;
+ type condor_unit_file_t;
+ ')
+
+ systemd_exec_systemctl($1)
+ systemd_read_fifo_file_passwd_run($1)
+ allow $1 condor_unit_file_t:file read_file_perms;
+ allow $1 condor_unit_file_t:service manage_service_perms;
+
+ ps_process_pattern($1, condor_t)
+')
+
+
+#######################################
+##
+## Read and write condor_startd server TCP sockets.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`condor_rw_tcp_sockets_startd',`
+ gen_require(`
+ type condor_startd_t;
+ ')
+
+ allow $1 condor_startd_t:tcp_socket rw_socket_perms;
+')
+
+######################################
+##
+## Read and write condor_schedd server TCP sockets.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`condor_rw_tcp_sockets_schedd',`
+ gen_require(`
+ type condor_schedd_t;
+ ')
+
+ allow $1 condor_schedd_t:tcp_socket rw_socket_perms;
+')
+
+########################################
+##
+## All of the rules required to administrate
+## an condor environment
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`condor_admin',`
+ gen_require(`
+ type condor_t;
+ type condor_log_t;
+ type condor_var_lib_t;
+ type condor_var_run_t;
+ type condor_unit_file_t;
+ ')
+
+ allow $1 condor_t:process { ptrace signal_perms };
+ ps_process_pattern($1, condor_t)
+
+ logging_search_logs($1)
+ admin_pattern($1, condor_log_t)
+
+ files_search_var_lib($1)
+ admin_pattern($1, condor_var_lib_t)
+
+ files_search_pids($1)
+ admin_pattern($1, condor_var_run_t)
+
+ condor_systemctl($1)
+ admin_pattern($1, condor_unit_file_t)
+ allow $1 condor_unit_file_t:service all_service_perms;
+ optional_policy(`
+ systemd_passwd_agent_exec($1)
+ systemd_read_fifo_file_passwd_run($1)
+ ')
+')
diff --git a/condor.te b/condor.te
new file mode 100644
index 0000000..206443e
--- /dev/null
+++ b/condor.te
@@ -0,0 +1,231 @@
+policy_module(condor, 1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+##
+##
+## Allow codnor domain to connect to the network using TCP.
+##
+##
+gen_tunable(condor_domain_can_network_connect, false)
+
+attribute condor_domain;
+
+type condor_master_t, condor_domain;
+type condor_master_exec_t;
+init_daemon_domain(condor_master_t, condor_master_exec_t)
+
+condor_domain_template(collector)
+condor_domain_template(negotiator)
+condor_domain_template(schedd)
+condor_domain_template(startd)
+condor_domain_template(procd)
+
+type condor_schedd_tmp_t;
+files_tmp_file(condor_schedd_tmp_t)
+
+type condor_startd_tmp_t;
+files_tmp_file(condor_startd_tmp_t)
+
+type condor_startd_tmpfs_t;
+files_tmpfs_file(condor_startd_tmpfs_t)
+
+type condor_log_t;
+logging_log_file(condor_log_t)
+
+type condor_var_lib_t;
+files_type(condor_var_lib_t)
+
+type condor_var_lock_t;
+files_lock_file(condor_var_lock_t)
+
+type condor_var_run_t;
+files_pid_file(condor_var_run_t)
+
+type condor_unit_file_t;
+systemd_unit_file(condor_unit_file_t)
+
+########################################
+#
+# condor domain local policy
+#
+
+allow condor_domain self:process signal_perms;
+allow condor_domain self:fifo_file rw_fifo_file_perms;
+
+allow condor_domain self:tcp_socket create_stream_socket_perms;
+allow condor_domain self:udp_socket create_socket_perms;
+allow condor_domain self:unix_stream_socket create_stream_socket_perms;
+
+allow condor_domain condor_master_t:process signull;
+allow condor_domain condor_master_t:tcp_socket getattr;
+
+manage_dirs_pattern(condor_domain, condor_log_t, condor_log_t)
+manage_files_pattern(condor_domain, condor_log_t, condor_log_t)
+logging_log_filetrans(condor_domain, condor_log_t, { dir file })
+
+manage_dirs_pattern(condor_domain, condor_var_lib_t, condor_var_lib_t)
+manage_files_pattern(condor_domain, condor_var_lib_t, condor_var_lib_t)
+files_var_lib_filetrans(condor_domain, condor_var_lib_t, { dir file })
+
+manage_files_pattern(condor_domain, condor_var_lock_t, condor_var_lock_t)
+files_lock_filetrans(condor_domain, condor_var_lock_t, file)
+
+manage_dirs_pattern(condor_domain, condor_var_run_t, condor_var_run_t)
+manage_files_pattern(condor_domain, condor_var_run_t, condor_var_run_t)
+manage_fifo_files_pattern(condor_domain, condor_var_run_t, condor_var_run_t)
+files_pid_filetrans(condor_domain, condor_var_run_t, { dir file fifo_file })
+
+kernel_read_system_state(condor_domain)
+kernel_read_network_state(condor_domain)
+
+corecmd_exec_bin(condor_domain)
+corecmd_exec_shell(condor_domain)
+
+corenet_tcp_connect_condor_port(condor_domain)
+corenet_tcp_connect_all_ephemeral_ports(condor_domain)
+
+domain_use_interactive_fds(condor_domain)
+
+dev_read_rand(condor_domain)
+dev_read_urand(condor_domain)
+dev_read_sysfs(condor_domain)
+
+
+logging_send_syslog_msg(condor_domain)
+
+miscfiles_read_localization(condor_domain)
+
+tunable_policy(`condor_domain_can_network_connect',`
+ corenet_tcp_connect_all_ports(condor_domain)
+')
+
+optional_policy(`
+ rhcs_stream_connect_cluster(condor_domain)
+')
+
+optional_policy(`
+ sysnet_dns_name_resolve(condor_domain)
+')
+
+#####################################
+#
+# condor master local policy
+#
+
+allow condor_master_t self:capability { setuid setgid dac_override sys_ptrace };
+
+allow condor_master_t condor_domain:process signal;
+
+corenet_tcp_bind_condor_port(condor_master_t)
+corenet_udp_bind_condor_port(condor_master_t)
+
+domain_read_all_domains_state(condor_master_t)
+
+auth_use_nsswitch(condor_master_t)
+
+######################################
+#
+# condor collector local policy
+#
+
+allow condor_collector_t self:capability { setuid setgid };
+
+allow condor_collector_t condor_master_t:tcp_socket rw_stream_socket_perms;
+allow condor_collector_t condor_master_t:udp_socket rw_socket_perms;
+
+kernel_read_network_state(condor_collector_t)
+
+auth_use_nsswitch(condor_collector_t)
+
+#####################################
+#
+# condor negotiator local policy
+#
+allow condor_negotiator_t self:capability { setuid setgid };
+allow condor_negotiator_t condor_master_t:tcp_socket rw_stream_socket_perms;
+allow condor_negotiator_t condor_master_t:udp_socket getattr;
+
+corenet_tcp_connect_all_ephemeral_ports(condor_negotiator_t)
+
+auth_use_nsswitch(condor_negotiator_t)
+
+######################################
+#
+# condor procd local policy
+#
+
+allow condor_procd_t self:capability { fowner chown dac_override sys_ptrace };
+
+domain_read_all_domains_state(condor_procd_t)
+
+#######################################
+#
+# condor schedd local policy
+#
+
+domtrans_pattern(condor_schedd_t, condor_procd_exec_t, condor_procd_t)
+domtrans_pattern(condor_schedd_t, condor_startd_exec_t, condor_startd_t)
+
+# dac_override because of /var/log/condor
+allow condor_schedd_t self:capability { setuid chown setgid dac_override };
+allow condor_schedd_t condor_master_t:tcp_socket rw_stream_socket_perms;
+allow condor_schedd_t condor_master_t:udp_socket getattr;
+
+allow condor_schedd_t condor_var_lock_t:dir manage_file_perms;
+
+manage_dirs_pattern(condor_schedd_t, condor_schedd_tmp_t, condor_schedd_tmp_t)
+manage_files_pattern(condor_schedd_t, condor_schedd_tmp_t, condor_schedd_tmp_t)
+files_tmp_filetrans(condor_schedd_t, condor_schedd_tmp_t, { file dir })
+allow condor_schedd_t condor_schedd_tmp_t:file { relabelfrom relabelto };
+
+kernel_read_kernel_sysctls(condor_schedd_t)
+
+corenet_tcp_connect_all_ephemeral_ports(condor_schedd_t)
+
+auth_use_nsswitch(condor_schedd_t)
+
+#####################################
+#
+# condor startd local policy
+#
+
+# also needed by java
+allow condor_startd_t self:capability { setuid net_admin setgid dac_override };
+allow condor_startd_t self:process execmem;
+
+manage_dirs_pattern(condor_startd_t, condor_startd_tmp_t, condor_startd_tmp_t)
+manage_files_pattern(condor_startd_t, condor_startd_tmp_t, condor_startd_tmp_t)
+files_tmp_filetrans(condor_startd_t, condor_startd_tmp_t, { file dir })
+allow condor_startd_t condor_startd_tmp_t:file { relabelfrom relabelto };
+
+manage_dirs_pattern(condor_startd_t, condor_startd_tmpfs_t, condor_startd_tmpfs_t)
+manage_files_pattern(condor_startd_t, condor_startd_tmpfs_t, condor_startd_tmpfs_t)
+fs_tmpfs_filetrans(condor_startd_t, condor_startd_tmpfs_t, { dir file })
+
+can_exec(condor_startd_t, condor_startd_exec_t)
+
+kernel_read_kernel_sysctls(condor_startd_t)
+
+domain_read_all_domains_state(condor_startd_t)
+
+auth_use_nsswitch(condor_startd_t)
+
+init_domtrans_script(condor_startd_t)
+init_initrc_domain(condor_startd_t)
+
+libs_exec_lib_files(condor_startd_t)
+
+files_read_usr_files(condor_startd_t)
+
+optional_policy(`
+ ssh_basic_client_template(condor_startd, condor_startd_t, system_r)
+ ssh_domtrans(condor_startd_t)
+')
+
+optional_policy(`
+ unconfined_domain(condor_startd_t)
+')
diff --git a/consolekit.fc b/consolekit.fc
index 32233ab..7058d21 100644
--- a/consolekit.fc
+++ b/consolekit.fc
@@ -1,3 +1,5 @@
+/usr/lib/systemd/system/console-kit.* -- gen_context(system_u:object_r:consolekit_unit_file_t,s0)
+
/usr/sbin/console-kit-daemon -- gen_context(system_u:object_r:consolekit_exec_t,s0)
/var/log/ConsoleKit(/.*)? gen_context(system_u:object_r:consolekit_log_t,s0)
diff --git a/consolekit.if b/consolekit.if
index fd15dfe..aac1e5d 100644
--- a/consolekit.if
+++ b/consolekit.if
@@ -20,6 +20,27 @@ interface(`consolekit_domtrans',`
########################################
##
+## dontaudit Send and receive messages from
+## consolekit over dbus.
+##
+##
+##
+## Domain to not audit.
+##
+##
+#
+interface(`consolekit_dontaudit_dbus_chat',`
+ gen_require(`
+ type consolekit_t;
+ class dbus send_msg;
+ ')
+
+ dontaudit $1 consolekit_t:dbus send_msg;
+ dontaudit consolekit_t $1:dbus send_msg;
+')
+
+########################################
+##
## Send and receive messages from
## consolekit over dbus.
##
@@ -41,6 +62,24 @@ interface(`consolekit_dbus_chat',`
########################################
##
+## Dontaudit attempts to read consolekit log files.
+##
+##
+##
+## Domain to not audit.
+##
+##
+#
+interface(`consolekit_dontaudit_read_log',`
+ gen_require(`
+ type consolekit_log_t;
+ ')
+
+ dontaudit $1 consolekit_log_t:file read_file_perms;
+')
+
+########################################
+##
## Read consolekit log files.
##
##
@@ -96,3 +135,64 @@ interface(`consolekit_read_pid_files',`
allow $1 consolekit_var_run_t:dir list_dir_perms;
read_files_pattern($1, consolekit_var_run_t, consolekit_var_run_t)
')
+
+########################################
+##
+## List consolekit PID files.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`consolekit_list_pid_files',`
+ gen_require(`
+ type consolekit_var_run_t;
+ ')
+
+ files_search_pids($1)
+ list_dirs_pattern($1, consolekit_var_run_t, consolekit_var_run_t)
+')
+
+########################################
+##
+## Allow the domain to read consolekit state files in /proc.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`consolekit_read_state',`
+ gen_require(`
+ type consolekit_t;
+ ')
+
+ kernel_search_proc($1)
+ ps_process_pattern($1, consolekit_t)
+')
+
+########################################
+##
+## Execute consolekit server in the consolekit domain.
+##
+##
+##
+## Domain allowed to transition.
+##
+##
+#
+interface(`consolekit_systemctl',`
+ gen_require(`
+ type consolekit_t;
+ type consolekit_unit_file_t;
+ ')
+
+ systemd_exec_systemctl($1)
+ allow $1 consolekit_unit_file_t:file read_file_perms;
+ allow $1 consolekit_unit_file_t:service manage_service_perms;
+
+ ps_process_pattern($1, consolekit_t)
+')
diff --git a/consolekit.te b/consolekit.te
index 6f2896d..5a5a3bb 100644
--- a/consolekit.te
+++ b/consolekit.te
@@ -15,12 +15,19 @@ logging_log_file(consolekit_log_t)
type consolekit_var_run_t;
files_pid_file(consolekit_var_run_t)
+type consolekit_tmpfs_t;
+files_tmpfs_file(consolekit_tmpfs_t)
+
+type consolekit_unit_file_t;
+systemd_unit_file(consolekit_unit_file_t)
+
########################################
#
# consolekit local policy
#
allow consolekit_t self:capability { chown setuid setgid sys_tty_config dac_override sys_nice sys_ptrace };
+
allow consolekit_t self:process { getsched signal };
allow consolekit_t self:fifo_file rw_fifo_file_perms;
allow consolekit_t self:unix_stream_socket create_stream_socket_perms;
@@ -43,9 +50,7 @@ dev_read_sysfs(consolekit_t)
domain_read_all_domains_state(consolekit_t)
domain_use_interactive_fds(consolekit_t)
-domain_dontaudit_ptrace_all_domains(consolekit_t)
-files_read_etc_files(consolekit_t)
files_read_usr_files(consolekit_t)
# needs to read /var/lib/dbus/machine-id
files_read_var_lib_files(consolekit_t)
@@ -69,15 +74,17 @@ logging_send_audit_msgs(consolekit_t)
miscfiles_read_localization(consolekit_t)
+systemd_exec_systemctl(consolekit_t)
+
+userdom_read_all_users_state(consolekit_t)
userdom_dontaudit_read_user_home_content_files(consolekit_t)
+userdom_dontaudit_getattr_admin_home_files(consolekit_t)
userdom_read_user_tmp_files(consolekit_t)
-tunable_policy(`use_nfs_home_dirs',`
- fs_read_nfs_files(consolekit_t)
-')
+userdom_home_reader(consolekit_t)
-tunable_policy(`use_samba_home_dirs',`
- fs_read_cifs_files(consolekit_t)
+optional_policy(`
+ cron_read_system_job_lib_files(consolekit_t)
')
optional_policy(`
@@ -97,7 +104,7 @@ optional_policy(`
')
optional_policy(`
- hal_ptrace(consolekit_t)
+ networkmanager_append_log(consolekit_t)
')
optional_policy(`
@@ -108,9 +115,10 @@ optional_policy(`
')
optional_policy(`
- type consolekit_tmpfs_t;
- files_tmpfs_file(consolekit_tmpfs_t)
+ shutdown_domtrans(consolekit_t)
+')
+optional_policy(`
xserver_read_xdm_pid(consolekit_t)
xserver_read_user_xauth(consolekit_t)
xserver_non_drawing_client(consolekit_t)
@@ -126,6 +134,5 @@ optional_policy(`
')
optional_policy(`
- #reading .Xauthity
unconfined_stream_connect(consolekit_t)
')
diff --git a/corosync.fc b/corosync.fc
index 3a6d7eb..bb32bf0 100644
--- a/corosync.fc
+++ b/corosync.fc
@@ -1,12 +1,22 @@
/etc/rc\.d/init\.d/corosync -- gen_context(system_u:object_r:corosync_initrc_exec_t,s0)
+/etc/rc\.d/init\.d/heartbeat -- gen_context(system_u:object_r:corosync_initrc_exec_t,s0)
+
+/usr/lib/systemd/system/corosync.* -- gen_context(system_u:object_r:corosync_unit_file_t,s0)
/usr/sbin/corosync -- gen_context(system_u:object_r:corosync_exec_t,s0)
+/usr/sbin/corosync-notifyd -- gen_context(system_u:object_r:corosync_exec_t,s0)
/usr/sbin/ccs_tool -- gen_context(system_u:object_r:corosync_exec_t,s0)
+/usr/sbin/cman_tool -- gen_context(system_u:object_r:corosync_exec_t,s0)
+
+/usr/lib(64)?/heartbeat/heartbeat -- gen_context(system_u:object_r:corosync_exec_t,s0)
/var/lib/corosync(/.*)? gen_context(system_u:object_r:corosync_var_lib_t,s0)
+/var/lib/heartbeat(/.*)? gen_context(system_u:object_r:corosync_var_lib_t,s0)
/var/log/cluster/corosync\.log -- gen_context(system_u:object_r:corosync_var_log_t,s0)
/var/run/cman_.* -s gen_context(system_u:object_r:corosync_var_run_t,s0)
/var/run/corosync\.pid -- gen_context(system_u:object_r:corosync_var_run_t,s0)
+/var/run/heartbeat(/.*)? gen_context(system_u:object_r:corosync_var_run_t,s0)
+/var/run/rsctmp(/.*)? gen_context(system_u:object_r:corosync_var_run_t,s0)
diff --git a/corosync.if b/corosync.if
index 5220c9d..25babd6 100644
--- a/corosync.if
+++ b/corosync.if
@@ -18,6 +18,25 @@ interface(`corosync_domtrans',`
domtrans_pattern($1, corosync_exec_t, corosync_t)
')
+######################################
+##
+## Execute corosync in the caller domain.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`corosync_exec',`
+ gen_require(`
+ type corosync_exec_t;
+ ')
+
+ corecmd_search_bin($1)
+ can_exec($1, corosync_exec_t)
+')
+
#######################################
##
## Allow the specified domain to read corosync's log files.
@@ -52,12 +71,37 @@ interface(`corosync_read_log',`
interface(`corosync_stream_connect',`
gen_require(`
type corosync_t, corosync_var_run_t;
+ type corosync_var_lib_t;
')
files_search_pids($1)
+ stream_connect_pattern($1, corosync_var_lib_t, corosync_var_lib_t, corosync_t)
stream_connect_pattern($1, corosync_var_run_t, corosync_var_run_t, corosync_t)
')
+########################################
+##
+## Execute corosync server in the corosync domain.
+##
+##
+##
+## Domain allowed to transition.
+##
+##
+#
+interface(`corosync_systemctl',`
+ gen_require(`
+ type corosync_t;
+ type corosync_unit_file_t;
+ ')
+
+ systemd_exec_systemctl($1)
+ allow $1 corosync_unit_file_t:file read_file_perms;
+ allow $1 corosync_unit_file_t:service manage_service_perms;
+
+ ps_process_pattern($1, corosync_t)
+')
+
######################################
##
## All of the rules required to administrate
@@ -80,11 +124,16 @@ interface(`corosyncd_admin',`
type corosync_t, corosync_var_lib_t, corosync_var_log_t;
type corosync_var_run_t, corosync_tmp_t, corosync_tmpfs_t;
type corosync_initrc_exec_t;
+ type corosync_unit_file_t;
')
- allow $1 corosync_t:process { ptrace signal_perms };
+ allow $1 corosync_t:process signal_perms;
ps_process_pattern($1, corosync_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 corosync_t:process ptrace;
+ ')
+
init_labeled_script_domtrans($1, corosync_initrc_exec_t)
domain_system_change_exemption($1)
role_transition $2 corosync_initrc_exec_t system_r;
@@ -103,4 +152,8 @@ interface(`corosyncd_admin',`
files_list_pids($1)
admin_pattern($1, corosync_var_run_t)
+
+ corosync_systemctl($1)
+ admin_pattern($1, corosync_unit_file_t)
+ allow $1 corosync_unit_file_t:service all_service_perms;
')
diff --git a/corosync.te b/corosync.te
index 04969e5..628bbf2 100644
--- a/corosync.te
+++ b/corosync.te
@@ -8,6 +8,7 @@ policy_module(corosync, 1.0.0)
type corosync_t;
type corosync_exec_t;
init_daemon_domain(corosync_t, corosync_exec_t)
+domain_obj_id_change_exemption(corosync_t)
type corosync_initrc_exec_t;
init_script_file(corosync_initrc_exec_t)
@@ -27,23 +28,32 @@ logging_log_file(corosync_var_log_t)
type corosync_var_run_t;
files_pid_file(corosync_var_run_t)
+type corosync_unit_file_t;
+systemd_unit_file(corosync_unit_file_t)
+
########################################
#
# corosync local policy
#
-allow corosync_t self:capability { sys_nice sys_resource ipc_lock };
-allow corosync_t self:process { setrlimit setsched signal };
+allow corosync_t self:capability { dac_override setuid setgid sys_nice sys_admin sys_resource ipc_lock };
+# for hearbeat
+allow corosync_t self:capability { net_raw chown };
+allow corosync_t self:process { setpgid setrlimit setsched signal signull };
allow corosync_t self:fifo_file rw_fifo_file_perms;
allow corosync_t self:sem create_sem_perms;
+allow corosync_t self:shm create_shm_perms;
allow corosync_t self:unix_stream_socket { create_stream_socket_perms connectto };
allow corosync_t self:unix_dgram_socket create_socket_perms;
allow corosync_t self:udp_socket create_socket_perms;
+can_exec(corosync_t, corosync_exec_t)
+
manage_dirs_pattern(corosync_t, corosync_tmp_t, corosync_tmp_t)
manage_files_pattern(corosync_t, corosync_tmp_t, corosync_tmp_t)
files_tmp_filetrans(corosync_t, corosync_tmp_t, { file dir })
+allow corosync_t corosync_tmp_t:file { relabelfrom relabelto };
manage_dirs_pattern(corosync_t, corosync_tmpfs_t, corosync_tmpfs_t)
manage_files_pattern(corosync_t, corosync_tmpfs_t, corosync_tmpfs_t)
@@ -52,7 +62,8 @@ fs_tmpfs_filetrans(corosync_t, corosync_tmpfs_t, { dir file })
manage_files_pattern(corosync_t, corosync_var_lib_t, corosync_var_lib_t)
manage_dirs_pattern(corosync_t, corosync_var_lib_t, corosync_var_lib_t)
manage_sock_files_pattern(corosync_t, corosync_var_lib_t, corosync_var_lib_t)
-files_var_lib_filetrans(corosync_t, corosync_var_lib_t, { file dir sock_file })
+manage_fifo_files_pattern(corosync_t, corosync_var_lib_t,corosync_var_lib_t)
+files_var_lib_filetrans(corosync_t,corosync_var_lib_t, { file dir fifo_file sock_file })
manage_files_pattern(corosync_t, corosync_var_log_t, corosync_var_log_t)
manage_sock_files_pattern(corosync_t, corosync_var_log_t, corosync_var_log_t)
@@ -60,11 +71,16 @@ logging_log_filetrans(corosync_t, corosync_var_log_t, { sock_file file })
manage_files_pattern(corosync_t, corosync_var_run_t, corosync_var_run_t)
manage_sock_files_pattern(corosync_t, corosync_var_run_t, corosync_var_run_t)
-files_pid_filetrans(corosync_t, corosync_var_run_t, { file sock_file })
+manage_dirs_pattern(corosync_t, corosync_var_run_t,corosync_var_run_t)
+files_pid_filetrans(corosync_t, corosync_var_run_t, { file sock_file dir })
kernel_read_system_state(corosync_t)
+kernel_read_network_state(corosync_t)
+kernel_read_net_sysctls(corosync_t)
+kernel_read_kernel_sysctls(corosync_t)
corecmd_exec_bin(corosync_t)
+corecmd_exec_shell(corosync_t)
corenet_udp_bind_netsupport_port(corosync_t)
@@ -73,9 +89,11 @@ dev_read_urand(corosync_t)
domain_read_all_domains_state(corosync_t)
files_manage_mounttab(corosync_t)
+files_read_usr_files(corosync_t)
auth_use_nsswitch(corosync_t)
+init_domtrans_script(corosync_t)
init_read_script_state(corosync_t)
init_rw_script_tmp_files(corosync_t)
@@ -83,19 +101,49 @@ logging_send_syslog_msg(corosync_t)
miscfiles_read_localization(corosync_t)
+userdom_read_user_tmp_files(corosync_t)
+userdom_delete_user_tmpfs_files(corosync_t)
userdom_rw_user_tmpfs_files(corosync_t)
optional_policy(`
+ fs_manage_tmpfs_files(corosync_t)
+ init_manage_script_status_files(corosync_t)
+')
+
+optional_policy(`
ccs_read_config(corosync_t)
')
optional_policy(`
- # to communication with RHCS
- rhcs_rw_dlm_controld_semaphores(corosync_t)
+ cmirrord_rw_shm(corosync_t)
+')
+
+optional_policy(`
+ dbus_system_bus_client(corosync_t)
+')
- rhcs_rw_fenced_semaphores(corosync_t)
+optional_policy(`
+ drbd_domtrans(corosync_t)
+')
+
+optional_policy(`
+ lvm_rw_clvmd_tmpfs_files(corosync_t)
+ lvm_delete_clvmd_tmpfs_files(corosync_t)
+')
- rhcs_rw_gfs_controld_semaphores(corosync_t)
+optional_policy(`
+ qpidd_rw_shm(corosync_t)
+')
+
+optional_policy(`
+ rhcs_getattr_fenced(corosync_t)
+ # to communication with RHCS
+ rhcs_rw_cluster_shm(corosync_t)
+ rhcs_rw_cluster_semaphores(corosync_t)
+ rhcs_stream_connect_cluster(corosync_t)
+ rhcs_read_cluster_lib_files(corosync_t)
+ rhcs_manage_cluster_lib_files(corosync_t)
+ rhcs_relabel_cluster_lib_files(corosync_t)
')
optional_policy(`
diff --git a/couchdb.fc b/couchdb.fc
new file mode 100644
index 0000000..196461b
--- /dev/null
+++ b/couchdb.fc
@@ -0,0 +1,11 @@
+/etc/couchdb(/.*)? gen_context(system_u:object_r:couchdb_etc_t,s0)
+
+/usr/bin/couchdb -- gen_context(system_u:object_r:couchdb_exec_t,s0)
+
+/usr/lib/systemd/system/couchdb.* -- gen_context(system_u:object_r:couchdb_unit_file_t,s0)
+
+/var/lib/couchdb(/.*)? gen_context(system_u:object_r:couchdb_var_lib_t,s0)
+
+/var/log/couchdb(/.*)? gen_context(system_u:object_r:couchdb_log_t,s0)
+
+/var/run/couchdb(/.*)? gen_context(system_u:object_r:couchdb_var_run_t,s0)
diff --git a/couchdb.if b/couchdb.if
new file mode 100644
index 0000000..3e17383
--- /dev/null
+++ b/couchdb.if
@@ -0,0 +1,244 @@
+
+## policy for couchdb
+
+########################################
+##
+## Transition to couchdb.
+##
+##
+##
+## Domain allowed to transition.
+##
+##
+#
+interface(`couchdb_domtrans',`
+ gen_require(`
+ type couchdb_t, couchdb_exec_t;
+ ')
+
+ corecmd_search_bin($1)
+ domtrans_pattern($1, couchdb_exec_t, couchdb_t)
+')
+########################################
+##
+## Read couchdb's log files.
+##
+##
+##
+## Domain allowed access.
+##
+##
+##
+#
+interface(`couchdb_read_log',`
+ gen_require(`
+ type couchdb_log_t;
+ ')
+
+ logging_search_logs($1)
+ read_files_pattern($1, couchdb_log_t, couchdb_log_t)
+')
+
+########################################
+##
+## Append to couchdb log files.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`couchdb_append_log',`
+ gen_require(`
+ type couchdb_log_t;
+ ')
+
+ logging_search_logs($1)
+ append_files_pattern($1, couchdb_log_t, couchdb_log_t)
+')
+
+########################################
+##
+## Manage couchdb log files
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`couchdb_manage_log',`
+ gen_require(`
+ type couchdb_log_t;
+ ')
+
+ logging_search_logs($1)
+ manage_dirs_pattern($1, couchdb_log_t, couchdb_log_t)
+ manage_files_pattern($1, couchdb_log_t, couchdb_log_t)
+ manage_lnk_files_pattern($1, couchdb_log_t, couchdb_log_t)
+')
+
+########################################
+##
+## Search couchdb lib directories.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`couchdb_search_lib',`
+ gen_require(`
+ type couchdb_var_lib_t;
+ ')
+
+ allow $1 couchdb_var_lib_t:dir search_dir_perms;
+ files_search_var_lib($1)
+')
+
+########################################
+##
+## Read couchdb lib files.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`couchdb_read_lib_files',`
+ gen_require(`
+ type couchdb_var_lib_t;
+ ')
+
+ files_search_var_lib($1)
+ read_files_pattern($1, couchdb_var_lib_t, couchdb_var_lib_t)
+')
+
+########################################
+##
+## Manage couchdb lib files.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`couchdb_manage_lib_files',`
+ gen_require(`
+ type couchdb_var_lib_t;
+ ')
+
+ files_search_var_lib($1)
+ manage_files_pattern($1, couchdb_var_lib_t, couchdb_var_lib_t)
+')
+
+########################################
+##
+## Manage couchdb lib directories.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`couchdb_manage_lib_dirs',`
+ gen_require(`
+ type couchdb_var_lib_t;
+ ')
+
+ files_search_var_lib($1)
+ manage_dirs_pattern($1, couchdb_var_lib_t, couchdb_var_lib_t)
+')
+
+########################################
+##
+## Read couchdb PID files.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`couchdb_read_pid_files',`
+ gen_require(`
+ type couchdb_var_run_t;
+ ')
+
+ files_search_pids($1)
+ allow $1 couchdb_var_run_t:file read_file_perms;
+')
+
+########################################
+##
+## Execute couchdb server in the couchdb domain.
+##
+##
+##
+## Domain allowed to transition.
+##
+##
+#
+interface(`couchdb_systemctl',`
+ gen_require(`
+ type couchdb_t;
+ type couchdb_unit_file_t;
+ ')
+
+ systemd_exec_systemctl($1)
+ systemd_read_fifo_file_passwd_run($1)
+ allow $1 couchdb_unit_file_t:file read_file_perms;
+ allow $1 couchdb_unit_file_t:service manage_service_perms;
+
+ ps_process_pattern($1, couchdb_t)
+')
+
+
+########################################
+##
+## All of the rules required to administrate
+## an couchdb environment
+##
+##
+##
+## Domain allowed access.
+##
+##
+##
+#
+interface(`couchdb_admin',`
+ gen_require(`
+ type couchdb_t, couchdb_etc_t, couchdb_log_t;
+ type couchdb_var_lib_t, couchdb_var_run_t;
+ type couchdb_unit_file_t;
+ ')
+
+ allow $1 couchdb_t:process { ptrace signal_perms };
+ ps_process_pattern($1, couchdb_t)
+
+ logging_search_logs($1)
+ admin_pattern($1, couchdb_log_t)
+
+ files_search_etc($1)
+ admin_pattern($1, couchdb_etc_t)
+
+ files_search_var_lib($1)
+ admin_pattern($1, couchdb_var_lib_t)
+
+ files_search_pids($1)
+ admin_pattern($1, couchdb_var_run_t)
+
+ admin_pattern($1, couchdb_unit_file_t)
+ couchdb_systemctl($1)
+ allow $1 couchdb_unit_file_t:service all_service_perms;
+
+ optional_policy(`
+ systemd_passwd_agent_exec($1)
+ systemd_read_fifo_file_passwd_run($1)
+ ')
+')
diff --git a/couchdb.te b/couchdb.te
new file mode 100644
index 0000000..7fa117a
--- /dev/null
+++ b/couchdb.te
@@ -0,0 +1,84 @@
+policy_module(couchdb, 1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type couchdb_t;
+type couchdb_exec_t;
+init_daemon_domain(couchdb_t, couchdb_exec_t)
+
+type couchdb_etc_t;
+files_config_file(couchdb_etc_t)
+
+type couchdb_tmp_t;
+files_tmp_file(couchdb_tmp_t)
+
+type couchdb_log_t;
+logging_log_file(couchdb_log_t)
+
+type couchdb_var_lib_t;
+files_type(couchdb_var_lib_t)
+
+type couchdb_var_run_t;
+files_pid_file(couchdb_var_run_t)
+
+type couchdb_unit_file_t;
+systemd_unit_file(couchdb_unit_file_t)
+
+########################################
+#
+# couchdb local policy
+#
+allow couchdb_t self:process { setsched signal signull sigkill };
+allow couchdb_t self:fifo_file rw_fifo_file_perms;
+allow couchdb_t self:unix_stream_socket create_stream_socket_perms;
+allow couchdb_t self:tcp_socket create_stream_socket_perms;
+allow couchdb_t self:udp_socket create_socket_perms;
+
+allow couchdb_t couchdb_etc_t:dir list_dir_perms;
+read_files_pattern(couchdb_t, couchdb_etc_t, couchdb_etc_t)
+
+manage_dirs_pattern(couchdb_t, couchdb_log_t, couchdb_log_t)
+manage_files_pattern(couchdb_t, couchdb_log_t, couchdb_log_t)
+logging_log_filetrans(couchdb_t, couchdb_log_t, { dir file })
+
+manage_dirs_pattern(couchdb_t, couchdb_tmp_t, couchdb_tmp_t)
+manage_files_pattern(couchdb_t, couchdb_tmp_t, couchdb_tmp_t)
+files_tmp_filetrans(couchdb_t, couchdb_tmp_t, { dir file })
+
+manage_dirs_pattern(couchdb_t, couchdb_var_lib_t, couchdb_var_lib_t)
+manage_files_pattern(couchdb_t, couchdb_var_lib_t, couchdb_var_lib_t)
+files_var_lib_filetrans(couchdb_t, couchdb_var_lib_t, { dir file })
+
+manage_dirs_pattern(couchdb_t, couchdb_var_run_t, couchdb_var_run_t)
+manage_files_pattern(couchdb_t, couchdb_var_run_t, couchdb_var_run_t)
+files_pid_filetrans(couchdb_t, couchdb_var_run_t, { dir file })
+
+can_exec(couchdb_t, couchdb_exec_t)
+
+kernel_read_system_state(couchdb_t)
+
+corecmd_exec_bin(couchdb_t)
+corecmd_exec_shell(couchdb_t)
+
+corenet_tcp_bind_generic_node(couchdb_t)
+corenet_udp_bind_generic_node(couchdb_t)
+corenet_tcp_bind_couchdb_port(couchdb_t)
+
+dev_list_sysfs(couchdb_t)
+dev_read_sysfs(couchdb_t)
+dev_read_urand(couchdb_t)
+
+domain_use_interactive_fds(couchdb_t)
+
+files_read_usr_files(couchdb_t)
+
+fs_getattr_xattr_fs(couchdb_t)
+
+auth_use_nsswitch(couchdb_t)
+
+libs_exec_lib_files(couchdb_t)
+
+miscfiles_read_localization(couchdb_t)
diff --git a/courier.fc b/courier.fc
index 47dfa07..1beadbd 100644
--- a/courier.fc
+++ b/courier.fc
@@ -8,15 +8,15 @@
/usr/sbin/courierldapaliasd -- gen_context(system_u:object_r:courier_exec_t,s0)
/usr/sbin/couriertcpd -- gen_context(system_u:object_r:courier_tcpd_exec_t,s0)
-/usr/lib/courier/(courier-)?authlib/.* -- gen_context(system_u:object_r:courier_authdaemon_exec_t,s0)
-/usr/lib/courier/courier/.* -- gen_context(system_u:object_r:courier_exec_t,s0)
-/usr/lib/courier/courier/courierpop.* -- gen_context(system_u:object_r:courier_pop_exec_t,s0)
-/usr/lib/courier/courier/imaplogin -- gen_context(system_u:object_r:courier_pop_exec_t,s0)
-/usr/lib/courier/courier/pcpd -- gen_context(system_u:object_r:courier_pcp_exec_t,s0)
-/usr/lib/courier/imapd -- gen_context(system_u:object_r:courier_pop_exec_t,s0)
-/usr/lib/courier/pop3d -- gen_context(system_u:object_r:courier_pop_exec_t,s0)
+/usr/lib/courier/authlib/.* -- gen_context(system_u:object_r:courier_authdaemon_exec_t,s0)
+/usr/lib/courier/courier/.* -- gen_context(system_u:object_r:courier_exec_t,s0)
+/usr/lib/courier/courier/courierpop.* -- gen_context(system_u:object_r:courier_pop_exec_t,s0)
+/usr/lib/courier/courier/imaplogin -- gen_context(system_u:object_r:courier_pop_exec_t,s0)
+/usr/lib/courier/courier/pcpd -- gen_context(system_u:object_r:courier_pcp_exec_t,s0)
+/usr/lib/courier/imapd -- gen_context(system_u:object_r:courier_pop_exec_t,s0)
+/usr/lib/courier/pop3d -- gen_context(system_u:object_r:courier_pop_exec_t,s0)
/usr/lib/courier/rootcerts(/.*)? gen_context(system_u:object_r:courier_etc_t,s0)
-/usr/lib/courier/sqwebmail/cleancache\.pl -- gen_context(system_u:object_r:sqwebmail_cron_exec_t,s0)
+/usr/lib/courier/sqwebmail/cleancache\.pl -- gen_context(system_u:object_r:sqwebmail_cron_exec_t,s0)
ifdef(`distro_gentoo',`
/usr/lib/courier-imap/couriertcpd -- gen_context(system_u:object_r:courier_tcpd_exec_t,s0)
diff --git a/courier.if b/courier.if
index 9971337..180e704 100644
--- a/courier.if
+++ b/courier.if
@@ -104,6 +104,25 @@ interface(`courier_domtrans_authdaemon',`
domtrans_pattern($1, courier_authdaemon_exec_t, courier_authdaemon_t)
')
+#######################################
+##
+## Connect to courier-authdaemon over a unix stream socket.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`courier_stream_connect_authdaemon',`
+ gen_require(`
+ type courier_authdaemon_t, courier_spool_t;
+ ')
+
+ files_search_spool($1)
+ stream_connect_pattern($1, courier_spool_t, courier_spool_t, courier_authdaemon_t)
+')
+
########################################
##
## Execute the courier POP3 and IMAP server with
@@ -138,6 +157,7 @@ interface(`courier_read_config',`
type courier_etc_t;
')
+ files_search_etc($1)
read_files_pattern($1, courier_etc_t, courier_etc_t)
')
@@ -157,6 +177,7 @@ interface(`courier_manage_spool_dirs',`
type courier_spool_t;
')
+ files_search_spool($1)
manage_dirs_pattern($1, courier_spool_t, courier_spool_t)
')
@@ -176,6 +197,7 @@ interface(`courier_manage_spool_files',`
type courier_spool_t;
')
+ files_search_spool($1)
manage_files_pattern($1, courier_spool_t, courier_spool_t)
')
@@ -183,7 +205,7 @@ interface(`courier_manage_spool_files',`
##
## Read courier spool files.
##
-##
+##
##
## Domain allowed access.
##
@@ -194,6 +216,7 @@ interface(`courier_read_spool',`
type courier_spool_t;
')
+ files_search_spool($1)
read_files_pattern($1, courier_spool_t, courier_spool_t)
')
diff --git a/courier.te b/courier.te
index 785088b..b6e2895 100644
--- a/courier.te
+++ b/courier.te
@@ -15,7 +15,7 @@ courier_domain_template(pcp)
courier_domain_template(pop)
type courier_spool_t;
-files_type(courier_spool_t)
+files_spool_file(courier_spool_t)
courier_domain_template(tcpd)
@@ -95,7 +95,7 @@ allow courier_pop_t courier_authdaemon_t:process sigchld;
allow courier_pop_t courier_tcpd_t:{ unix_stream_socket tcp_socket } rw_stream_socket_perms;
# inherits file handle - should it?
-allow courier_pop_t courier_var_lib_t:file { read write };
+allow courier_pop_t courier_var_lib_t:file rw_inherited_file_perms;
miscfiles_read_localization(courier_pop_t)
diff --git a/cpucontrol.fc b/cpucontrol.fc
index 789c8c7..d1723f5 100644
--- a/cpucontrol.fc
+++ b/cpucontrol.fc
@@ -3,6 +3,7 @@
/sbin/microcode_ctl -- gen_context(system_u:object_r:cpucontrol_exec_t,s0)
+/usr/sbin/microcode_ctl -- gen_context(system_u:object_r:cpucontrol_exec_t,s0)
/usr/sbin/cpufreqd -- gen_context(system_u:object_r:cpuspeed_exec_t,s0)
/usr/sbin/cpuspeed -- gen_context(system_u:object_r:cpuspeed_exec_t,s0)
/usr/sbin/powernowd -- gen_context(system_u:object_r:cpuspeed_exec_t,s0)
diff --git a/cpucontrol.te b/cpucontrol.te
index 13d2f63..a048c53 100644
--- a/cpucontrol.te
+++ b/cpucontrol.te
@@ -10,7 +10,7 @@ type cpucontrol_exec_t;
init_system_domain(cpucontrol_t, cpucontrol_exec_t)
type cpucontrol_conf_t;
-files_type(cpucontrol_conf_t)
+files_config_file(cpucontrol_conf_t)
type cpuspeed_t;
type cpuspeed_exec_t;
diff --git a/cpufreqselector.te b/cpufreqselector.te
index f77d58a..3d78ee8 100644
--- a/cpufreqselector.te
+++ b/cpufreqselector.te
@@ -14,9 +14,10 @@ application_domain(cpufreqselector_t, cpufreqselector_exec_t)
# cpufreq-selector local policy
#
-allow cpufreqselector_t self:capability { sys_nice sys_ptrace };
+allow cpufreqselector_t self:capability sys_nice;
allow cpufreqselector_t self:process getsched;
allow cpufreqselector_t self:fifo_file rw_fifo_file_perms;
+allow cpufreqselector_t self:process getsched;
kernel_read_system_state(cpufreqselector_t)
@@ -27,13 +28,16 @@ corecmd_search_bin(cpufreqselector_t)
dev_rw_sysfs(cpufreqselector_t)
+kernel_read_system_state(cpufreqselector_t)
+
miscfiles_read_localization(cpufreqselector_t)
userdom_read_all_users_state(cpufreqselector_t)
-userdom_dontaudit_search_user_home_dirs(cpufreqselector_t)
+userdom_dontaudit_search_admin_dir(cpufreqselector_t)
optional_policy(`
dbus_system_domain(cpufreqselector_t, cpufreqselector_exec_t)
+ init_daemon_domain(cpufreqselector_t, cpufreqselector_exec_t)
optional_policy(`
consolekit_dbus_chat(cpufreqselector_t)
@@ -53,3 +57,7 @@ optional_policy(`
policykit_read_lib(cpufreqselector_t)
policykit_read_reload(cpufreqselector_t)
')
+
+optional_policy(`
+ xserver_dbus_chat_xdm(cpufreqselector_t)
+')
diff --git a/cron.fc b/cron.fc
index 3559a05..50c8036 100644
--- a/cron.fc
+++ b/cron.fc
@@ -3,6 +3,9 @@
/etc/cron\.d(/.*)? gen_context(system_u:object_r:system_cron_spool_t,s0)
/etc/crontab -- gen_context(system_u:object_r:system_cron_spool_t,s0)
+/usr/lib/systemd/system/atd.* -- gen_context(system_u:object_r:crond_unit_file_t,s0)
+/usr/lib/systemd/system/crond.* -- gen_context(system_u:object_r:crond_unit_file_t,s0)
+
/usr/bin/at -- gen_context(system_u:object_r:crontab_exec_t,s0)
/usr/bin/(f)?crontab -- gen_context(system_u:object_r:crontab_exec_t,s0)
@@ -12,20 +15,34 @@
/usr/sbin/fcron -- gen_context(system_u:object_r:crond_exec_t,s0)
/usr/sbin/fcronsighup -- gen_context(system_u:object_r:crontab_exec_t,s0)
+/var/log/rpmpkgs.* -- gen_context(system_u:object_r:cron_log_t,s0)
+
/var/run/anacron\.pid -- gen_context(system_u:object_r:crond_var_run_t,s0)
/var/run/atd\.pid -- gen_context(system_u:object_r:crond_var_run_t,s0)
/var/run/crond?\.pid -- gen_context(system_u:object_r:crond_var_run_t,s0)
-/var/run/crond\.reboot -- gen_context(system_u:object_r:crond_var_run_t,s0)
+/var/run/crond?\.reboot -- gen_context(system_u:object_r:crond_var_run_t,s0)
/var/run/fcron\.fifo -s gen_context(system_u:object_r:crond_var_run_t,s0)
/var/run/fcron\.pid -- gen_context(system_u:object_r:crond_var_run_t,s0)
+/var/run/.*cron.* -- gen_context(system_u:object_r:crond_var_run_t,s0)
/var/spool/anacron(/.*)? gen_context(system_u:object_r:system_cron_spool_t,s0)
/var/spool/at(/.*)? gen_context(system_u:object_r:user_cron_spool_t,s0)
-/var/spool/cron -d gen_context(system_u:object_r:cron_spool_t,s0)
+/var/spool/cron -d gen_context(system_u:object_r:user_cron_spool_t,s0)
#/var/spool/cron/root -- gen_context(system_u:object_r:sysadm_cron_spool_t,s0)
/var/spool/cron/[^/]* -- <>
+ifdef(`distro_gentoo',`
+/var/spool/cron/lastrun -d gen_context(system_u:object_r:crond_tmp_t,s0)
+/var/spool/cron/lastrun/[^/]* -- <>
+')
+
+ifdef(`distro_suse', `
+/var/spool/cron/lastrun -d gen_context(system_u:object_r:crond_tmp_t,s0)
+/var/spool/cron/lastrun/[^/]* -- <>
+/var/spool/cron/tabs -d gen_context(system_u:object_r:cron_spool_t,s0)
+')
+
/var/spool/cron/crontabs -d gen_context(system_u:object_r:cron_spool_t,s0)
/var/spool/cron/crontabs/.* -- <>
#/var/spool/cron/crontabs/root -- gen_context(system_u:object_r:sysadm_cron_spool_t,s0)
@@ -36,6 +53,8 @@
/var/spool/fcron/systab -- gen_context(system_u:object_r:system_cron_spool_t,s0)
/var/spool/fcron/new\.systab -- gen_context(system_u:object_r:system_cron_spool_t,s0)
+/var/lib/glpi/files(/.*)? gen_context(system_u:object_r:cron_var_lib_t,s0)
+
ifdef(`distro_debian',`
/var/log/prelink.log -- gen_context(system_u:object_r:cron_log_t,s0)
diff --git a/cron.if b/cron.if
index 6e12dc7..38dac8e 100644
--- a/cron.if
+++ b/cron.if
@@ -12,6 +12,11 @@
##
#
template(`cron_common_crontab_template',`
+ gen_require(`
+ type crond_t, crond_var_run_t, crontab_exec_t;
+ type cron_spool_t, user_cron_spool_t;
+ ')
+
##############################
#
# Declarations
@@ -30,11 +35,15 @@ template(`cron_common_crontab_template',`
# dac_override is to create the file in the directory under /tmp
allow $1_t self:capability { fowner setuid setgid chown dac_override };
- allow $1_t self:process { setsched signal_perms };
+ allow $1_t self:process { getcap setsched signal_perms };
allow $1_t self:fifo_file rw_fifo_file_perms;
- allow $1_t $1_tmp_t:file manage_file_perms;
- files_tmp_filetrans($1_t, $1_tmp_t, file)
+ allow $1_t crond_t:process signal;
+ allow $1_t crond_var_run_t:file read_file_perms;
+
+ manage_dirs_pattern($1_t, $1_tmp_t, $1_tmp_t)
+ manage_files_pattern($1_t, $1_tmp_t, $1_tmp_t)
+ files_tmp_filetrans($1_t, $1_tmp_t, { dir file })
# create files in /var/spool/cron
manage_files_pattern($1_t, { cron_spool_t user_cron_spool_t }, user_cron_spool_t)
@@ -42,7 +51,7 @@ template(`cron_common_crontab_template',`
files_list_spool($1_t)
# crontab signals crond by updating the mtime on the spooldir
- allow $1_t cron_spool_t:dir setattr;
+ allow $1_t cron_spool_t:dir setattr_dir_perms;
kernel_read_system_state($1_t)
@@ -50,20 +59,25 @@ template(`cron_common_crontab_template',`
selinux_dontaudit_search_fs($1_t)
fs_getattr_xattr_fs($1_t)
+ fs_manage_cgroup_dirs($1_t)
+ fs_manage_cgroup_files($1_t)
domain_use_interactive_fds($1_t)
- files_read_etc_files($1_t)
files_read_usr_files($1_t)
files_dontaudit_search_pids($1_t)
auth_domtrans_chk_passwd($1_t)
+ auth_rw_var_auth($1_t)
+ auth_use_nsswitch($1_t)
logging_send_syslog_msg($1_t)
logging_send_audit_msgs($1_t)
+ logging_set_loginuid($1_t)
init_dontaudit_write_utmp($1_t)
init_read_utmp($1_t)
+ init_read_state($1_t)
miscfiles_read_localization($1_t)
@@ -72,9 +86,10 @@ template(`cron_common_crontab_template',`
userdom_manage_user_tmp_dirs($1_t)
userdom_manage_user_tmp_files($1_t)
# Access terminals.
- userdom_use_user_terminals($1_t)
+ userdom_use_inherited_user_terminals($1_t)
# Read user crontabs
userdom_read_user_home_content_files($1_t)
+ userdom_read_user_home_content_symlinks($1_t)
tunable_policy(`fcron_crond',`
# fcron wants an instant update of a crontab change for the administrator
@@ -101,10 +116,12 @@ template(`cron_common_crontab_template',`
## User domain for the role
##
##
+##
#
interface(`cron_role',`
gen_require(`
type cronjob_t, crontab_t, crontab_exec_t;
+ type user_cron_spool_t, crond_t;
')
role $1 types { cronjob_t crontab_t };
@@ -115,9 +132,20 @@ interface(`cron_role',`
# Transition from the user domain to the derived domain.
domtrans_pattern($2, crontab_exec_t, crontab_t)
+ allow crond_t $2:process transition;
+ dontaudit crond_t $2:process { noatsecure siginh rlimitinh };
+ allow $2 crond_t:process sigchld;
+
+ # needs to be authorized SELinux context for cron
+ allow $2 user_cron_spool_t:file { getattr read write ioctl entrypoint };
+
# crontab shows up in user ps
ps_process_pattern($2, crontab_t)
- allow $2 crontab_t:process signal;
+ allow $2 crontab_t:process signal_perms;
+
+ tunable_policy(`deny_ptrace',`',`
+ allow $2 crontab_t:process ptrace;
+ ')
# Run helper programs as the user domain
#corecmd_bin_domtrans(crontab_t, $2)
@@ -150,29 +178,21 @@ interface(`cron_role',`
## User domain for the role
##
##
+##
#
interface(`cron_unconfined_role',`
gen_require(`
- type unconfined_cronjob_t, crontab_t, crontab_tmp_t, crontab_exec_t;
+ type unconfined_cronjob_t;
')
- role $1 types { unconfined_cronjob_t crontab_t };
+ role $1 types unconfined_cronjob_t;
# cronjob shows up in user ps
ps_process_pattern($2, unconfined_cronjob_t)
-
- # Transition from the user domain to the derived domain.
- domtrans_pattern($2, crontab_exec_t, crontab_t)
-
- # crontab shows up in user ps
- ps_process_pattern($2, crontab_t)
- allow $2 crontab_t:process signal;
-
- # Run helper programs as the user domain
- #corecmd_bin_domtrans(crontab_t, $2)
- #corecmd_shell_domtrans(crontab_t, $2)
- corecmd_exec_bin(crontab_t)
- corecmd_exec_shell(crontab_t)
+ allow $2 unconfined_cronjob_t:process signal_perms;
+ tunable_policy(`deny_ptrace',`',`
+ allow $2 unconfined_cronjob_t:process ptrace;
+ ')
optional_policy(`
gen_require(`
@@ -180,9 +200,8 @@ interface(`cron_unconfined_role',`
')
dbus_stub(unconfined_cronjob_t)
-
allow unconfined_cronjob_t $2:dbus send_msg;
- ')
+ ')
')
########################################
@@ -199,6 +218,7 @@ interface(`cron_unconfined_role',`
## User domain for the role
##
##
+##
#
interface(`cron_admin_role',`
gen_require(`
@@ -219,7 +239,10 @@ interface(`cron_admin_role',`
# crontab shows up in user ps
ps_process_pattern($2, admin_crontab_t)
- allow $2 admin_crontab_t:process signal;
+ allow $2 admin_crontab_t:process signal_perms;
+ tunable_policy(`deny_ptrace',`',`
+ allow $2 admin_crontab_t:process ptrace;
+ ')
# Run helper programs as the user domain
#corecmd_bin_domtrans(admin_crontab_t, $2)
@@ -263,6 +286,9 @@ interface(`cron_system_entry',`
domtrans_pattern(crond_t, $2, $1)
role system_r types $1;
+
+ allow $1 crond_t:fifo_file rw_fifo_file_perms;
+ allow $1 system_cronjob_t:fifo_file rw_fifo_file_perms;
')
########################################
@@ -303,7 +329,7 @@ interface(`cron_exec',`
########################################
##
-## Execute crond server in the nscd domain.
+## Execute crond server in the crond domain.
##
##
##
@@ -321,6 +347,29 @@ interface(`cron_initrc_domtrans',`
########################################
##
+## Execute crond server in the crond domain.
+##
+##
+##
+## Domain allowed to transition.
+##
+##
+#
+interface(`cron_systemctl',`
+ gen_require(`
+ type crond_unit_file_t;
+ type crond_t;
+ ')
+
+ systemd_exec_systemctl($1)
+ allow $1 crond_unit_file_t:file read_file_perms;
+ allow $1 crond_unit_file_t:service manage_service_perms;
+
+ ps_process_pattern($1, crond_t)
+')
+
+########################################
+##
## Inherit and use a file descriptor
## from the cron daemon.
##
@@ -358,6 +407,24 @@ interface(`cron_sigchld',`
########################################
##
+## Send a generic signal to cron daemon.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`cron_signal',`
+ gen_require(`
+ type crond_t;
+ ')
+
+ allow $1 crond_t:process signal;
+')
+
+########################################
+##
## Read a cron daemon unnamed pipe.
##
##
@@ -376,6 +443,47 @@ interface(`cron_read_pipes',`
########################################
##
+## Read crond state files.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`cron_read_state_crond',`
+ gen_require(`
+ type crond_t;
+ ')
+
+ kernel_search_proc($1)
+ ps_process_pattern($1, crond_t)
+')
+
+
+########################################
+##
+## Send and receive messages from
+## crond over dbus.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`cron_dbus_chat_crond',`
+ gen_require(`
+ type crond_t;
+ class dbus send_msg;
+ ')
+
+ allow $1 crond_t:dbus send_msg;
+ allow crond_t $1:dbus send_msg;
+')
+
+########################################
+##
## Do not audit attempts to write cron daemon unnamed pipes.
##
##
@@ -407,7 +515,43 @@ interface(`cron_rw_pipes',`
type crond_t;
')
- allow $1 crond_t:fifo_file { getattr read write };
+ allow $1 crond_t:fifo_file rw_inherited_fifo_file_perms;
+')
+
+########################################
+##
+## Read and write inherited user spool files.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`cron_rw_inherited_user_spool_files',`
+ gen_require(`
+ type user_cron_spool_t;
+ ')
+
+ allow $1 user_cron_spool_t:file rw_inherited_file_perms;
+')
+
+########################################
+##
+## Read and write inherited spool files.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`cron_rw_inherited_spool_files',`
+ gen_require(`
+ type cron_spool_t;
+ ')
+
+ allow $1 cron_spool_t:file rw_inherited_file_perms;
')
########################################
@@ -467,6 +611,25 @@ interface(`cron_search_spool',`
########################################
##
+## Search the directory containing user cron tables.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`cron_manage_system_spool',`
+ gen_require(`
+ type cron_system_spool_t;
+ ')
+
+ files_search_spool($1)
+ manage_files_pattern($1, cron_system_spool_t, cron_system_spool_t)
+')
+
+########################################
+##
## Manage pid files used by cron
##
##
@@ -480,6 +643,7 @@ interface(`cron_manage_pid_files',`
type crond_var_run_t;
')
+ files_search_pids($1)
manage_files_pattern($1, crond_var_run_t, crond_var_run_t)
')
@@ -535,7 +699,7 @@ interface(`cron_write_system_job_pipes',`
type system_cronjob_t;
')
- allow $1 system_cronjob_t:file write;
+ allow $1 system_cronjob_t:fifo_file write;
')
########################################
@@ -553,7 +717,7 @@ interface(`cron_rw_system_job_pipes',`
type system_cronjob_t;
')
- allow $1 system_cronjob_t:fifo_file rw_fifo_file_perms;
+ allow $1 system_cronjob_t:fifo_file rw_inherited_fifo_file_perms;
')
########################################
@@ -586,11 +750,14 @@ interface(`cron_rw_system_job_stream_sockets',`
#
interface(`cron_read_system_job_tmp_files',`
gen_require(`
- type system_cronjob_tmp_t;
+ type system_cronjob_tmp_t, cron_var_run_t;
')
files_search_tmp($1)
allow $1 system_cronjob_tmp_t:file read_file_perms;
+
+ files_search_pids($1)
+ allow $1 cron_var_run_t:file read_file_perms;
')
########################################
@@ -626,7 +793,47 @@ interface(`cron_dontaudit_append_system_job_tmp_files',`
interface(`cron_dontaudit_write_system_job_tmp_files',`
gen_require(`
type system_cronjob_tmp_t;
+ type cron_var_run_t;
')
dontaudit $1 system_cronjob_tmp_t:file write_file_perms;
+ dontaudit $1 cron_var_run_t:file write_file_perms;
+')
+
+########################################
+##
+## Read temporary files from the system cron jobs.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`cron_read_system_job_lib_files',`
+ gen_require(`
+ type system_cronjob_var_lib_t;
+ ')
+
+ files_search_var_lib($1)
+ read_files_pattern($1, system_cronjob_var_lib_t, system_cronjob_var_lib_t)
+')
+
+########################################
+##
+## Manage files from the system cron jobs.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`cron_manage_system_job_lib_files',`
+ gen_require(`
+ type system_cronjob_var_lib_t;
+ ')
+
+ files_search_var_lib($1)
+ manage_files_pattern($1, system_cronjob_var_lib_t, system_cronjob_var_lib_t)
')
diff --git a/cron.te b/cron.te
index b357856..3155d2a 100644
--- a/cron.te
+++ b/cron.te
@@ -1,4 +1,4 @@
-policy_module(cron, 2.4.0)
+policy_module(cron, 2.2.1)
gen_require(`
class passwd rootok;
@@ -10,18 +10,18 @@ gen_require(`
#
##
-##
-## Allow system cron jobs to relabel filesystem
-## for restoring file contexts.
-##
+##
+## Allow system cron jobs to relabel filesystem
+## for restoring file contexts.
+##
##
gen_tunable(cron_can_relabel, false)
##
-##
-## Enable extra rules in the cron domain
-## to support fcron.
-##
+##
+## Enable extra rules in the cron domain
+## to support fcron.
+##
##
gen_tunable(fcron_crond, false)
@@ -31,14 +31,14 @@ type anacron_exec_t;
application_executable_file(anacron_exec_t)
type cron_spool_t;
-files_type(cron_spool_t)
+files_spool_file(cron_spool_t)
# var/lib files
type cron_var_lib_t;
files_type(cron_var_lib_t)
type cron_var_run_t;
-files_type(cron_var_run_t)
+files_pid_file(cron_var_run_t)
# var/log files
type cron_log_t;
@@ -61,11 +61,17 @@ domain_cron_exemption_source(crond_t)
type crond_initrc_exec_t;
init_script_file(crond_initrc_exec_t)
+type crond_unit_file_t;
+systemd_unit_file(crond_unit_file_t)
+
type crond_tmp_t;
files_tmp_file(crond_tmp_t)
+files_poly_parent(crond_tmp_t)
+mta_system_content(crond_tmp_t)
type crond_var_run_t;
files_pid_file(crond_var_run_t)
+mta_system_content(crond_var_run_t)
type crontab_exec_t;
application_executable_file(crontab_exec_t)
@@ -79,14 +85,16 @@ typealias crontab_t alias { user_crontab_t staff_crontab_t };
typealias crontab_t alias { auditadm_crontab_t secadm_crontab_t };
typealias crontab_tmp_t alias { user_crontab_tmp_t staff_crontab_tmp_t };
typealias crontab_tmp_t alias { auditadm_crontab_tmp_t secadm_crontab_tmp_t };
+allow admin_crontab_t crond_t:process signal;
type system_cron_spool_t, cron_spool_type;
-files_type(system_cron_spool_t)
+files_spool_file(system_cron_spool_t)
type system_cronjob_t alias system_crond_t;
init_daemon_domain(system_cronjob_t, anacron_exec_t)
corecmd_shell_entry_type(system_cronjob_t)
role system_r types system_cronjob_t;
+domtrans_pattern(crond_t, anacron_exec_t, system_cronjob_t)
type system_cronjob_lock_t alias system_crond_lock_t;
files_lock_file(system_cronjob_lock_t)
@@ -94,10 +102,6 @@ files_lock_file(system_cronjob_lock_t)
type system_cronjob_tmp_t alias system_crond_tmp_t;
files_tmp_file(system_cronjob_tmp_t)
-ifdef(`enable_mcs',`
- init_ranged_daemon_domain(crond_t, crond_exec_t, s0 - mcs_systemhigh)
-')
-
type unconfined_cronjob_t;
domain_type(unconfined_cronjob_t)
domain_cron_exemption_target(unconfined_cronjob_t)
@@ -106,8 +110,20 @@ domain_cron_exemption_target(unconfined_cronjob_t)
type user_cron_spool_t, cron_spool_type;
typealias user_cron_spool_t alias { staff_cron_spool_t sysadm_cron_spool_t unconfined_cron_spool_t };
typealias user_cron_spool_t alias { auditadm_cron_spool_t secadm_cron_spool_t };
-files_type(user_cron_spool_t)
+files_spool_file(user_cron_spool_t)
ubac_constrained(user_cron_spool_t)
+mta_system_content(user_cron_spool_t)
+
+type system_cronjob_var_lib_t;
+files_type(system_cronjob_var_lib_t)
+typealias system_cronjob_var_lib_t alias system_crond_var_lib_t;
+
+type system_cronjob_var_run_t;
+files_pid_file(system_cronjob_var_run_t)
+
+ifdef(`enable_mcs',`
+ init_ranged_daemon_domain(crond_t, crond_exec_t, s0 - mcs_systemhigh)
+')
########################################
#
@@ -115,7 +131,7 @@ ubac_constrained(user_cron_spool_t)
#
# Allow our crontab domain to unlink a user cron spool file.
-allow admin_crontab_t user_cron_spool_t:file { getattr read unlink };
+allow admin_crontab_t user_cron_spool_t:file { read_file_perms delete_file_perms };
# Manipulate other users crontab.
selinux_get_fs_mount(admin_crontab_t)
@@ -125,7 +141,7 @@ selinux_compute_create_context(admin_crontab_t)
selinux_compute_relabel_context(admin_crontab_t)
selinux_compute_user_contexts(admin_crontab_t)
-tunable_policy(`fcron_crond', `
+tunable_policy(`fcron_crond',`
# fcron wants an instant update of a crontab change for the administrator
# also crontab does a security check for crontab -u
allow admin_crontab_t self:process setfscreate;
@@ -136,9 +152,9 @@ tunable_policy(`fcron_crond', `
# Cron daemon local policy
#
-allow crond_t self:capability { dac_override setgid setuid sys_nice dac_read_search };
+allow crond_t self:capability { dac_override chown fowner setgid setuid sys_nice dac_read_search };
dontaudit crond_t self:capability { sys_resource sys_tty_config };
-allow crond_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
+allow crond_t self:process ~{ ptrace setcurrent setexec setfscreate execmem execstack execheap };
allow crond_t self:process { setexec setfscreate };
allow crond_t self:fd use;
allow crond_t self:fifo_file rw_fifo_file_perms;
@@ -151,6 +167,7 @@ allow crond_t self:sem create_sem_perms;
allow crond_t self:msgq create_msgq_perms;
allow crond_t self:msg { send receive };
allow crond_t self:key { search write link };
+dontaudit crond_t self:netlink_audit_socket nlmsg_tty_audit;
manage_files_pattern(crond_t, cron_log_t, cron_log_t)
logging_log_filetrans(crond_t, cron_log_t, file)
@@ -187,27 +204,47 @@ fs_list_inotifyfs(crond_t)
# need auth_chkpwd to check for locked accounts.
auth_domtrans_chk_passwd(crond_t)
+auth_manage_var_auth(crond_t)
corecmd_exec_shell(crond_t)
corecmd_list_bin(crond_t)
+corecmd_exec_bin(crond_t)
corecmd_read_bin_symlinks(crond_t)
domain_use_interactive_fds(crond_t)
+domain_subj_id_change_exemption(crond_t)
+domain_role_change_exemption(crond_t)
files_read_usr_files(crond_t)
files_read_etc_runtime_files(crond_t)
-files_read_etc_files(crond_t)
files_read_generic_spool(crond_t)
files_list_usr(crond_t)
# Read from /var/spool/cron.
files_search_var_lib(crond_t)
files_search_default(crond_t)
+fs_manage_cgroup_dirs(crond_t)
+fs_manage_cgroup_files(crond_t)
+
+# needed by "crontab -e"
+mls_file_read_all_levels(crond_t)
+mls_file_write_all_levels(crond_t)
+
+# needed because of kernel check of transition
+mls_process_set_level(crond_t)
+
+# to make cronjob working
+mls_fd_share_all_levels(crond_t)
+mls_trusted_object(crond_t)
+
+init_read_state(crond_t)
init_rw_utmp(crond_t)
init_spec_domtrans_script(crond_t)
+auth_manage_var_auth(crond_t)
auth_use_nsswitch(crond_t)
+logging_send_audit_msgs(crond_t)
logging_send_syslog_msg(crond_t)
logging_set_loginuid(crond_t)
@@ -220,20 +257,23 @@ miscfiles_read_localization(crond_t)
userdom_use_unpriv_users_fds(crond_t)
# Not sure why this is needed
userdom_list_user_home_dirs(crond_t)
+userdom_list_admin_dir(crond_t)
+userdom_manage_all_users_keys(crond_t)
mta_send_mail(crond_t)
+mta_system_content(cron_spool_t)
ifdef(`distro_debian',`
# pam_limits is used
allow crond_t self:process setrlimit;
- optional_policy(`
- # Debian logcheck has the home dir set to its cache
- logwatch_search_cache_dir(crond_t)
- ')
')
-ifdef(`distro_redhat', `
+optional_policy(`
+ logwatch_search_cache_dir(crond_t)
+')
+
+ifdef(`distro_redhat',`
# Run the rpm program in the rpm_t domain. Allow creation of RPM log files
# via redirection of standard out.
optional_policy(`
@@ -241,7 +281,7 @@ ifdef(`distro_redhat', `
')
')
-tunable_policy(`allow_polyinstantiation',`
+tunable_policy(`polyinstantiation_enabled',`
files_polyinstantiate_all(crond_t)
')
@@ -250,11 +290,27 @@ tunable_policy(`fcron_crond', `
')
optional_policy(`
+ apache_search_sys_content(crond_t)
+')
+
+optional_policy(`
+ djbdns_search_tinydns_keys(crond_t)
+ djbdns_link_tinydns_keys(crond_t)
+')
+
+optional_policy(`
locallogin_search_keys(crond_t)
locallogin_link_keys(crond_t)
')
optional_policy(`
+ # these should probably be unconfined_crond_t
+ dbus_system_bus_client(crond_t)
+ init_dbus_send_script(crond_t)
+ init_dbus_chat(crond_t)
+')
+
+optional_policy(`
amanda_search_var_lib(crond_t)
')
@@ -264,6 +320,8 @@ optional_policy(`
optional_policy(`
hal_dbus_chat(crond_t)
+ hal_write_log(crond_t)
+ hal_dbus_chat(system_cronjob_t)
')
optional_policy(`
@@ -286,15 +344,25 @@ optional_policy(`
')
optional_policy(`
+ systemd_use_fds_logind(crond_t)
+ systemd_write_inherited_logind_sessions_pipes(crond_t)
+')
+
+optional_policy(`
udev_read_db(crond_t)
')
+optional_policy(`
+ vnstatd_search_lib(crond_t)
+')
+
########################################
#
# System cron process domain
#
allow system_cronjob_t self:capability { dac_override dac_read_search chown setgid setuid fowner net_bind_service fsetid sys_nice };
+
allow system_cronjob_t self:process { signal_perms getsched setsched };
allow system_cronjob_t self:fifo_file rw_fifo_file_perms;
allow system_cronjob_t self:passwd rootok;
@@ -306,10 +374,19 @@ logging_log_filetrans(system_cronjob_t, cron_log_t, file)
# This is to handle /var/lib/misc directory. Used currently
# by prelink var/lib files for cron
-allow system_cronjob_t cron_var_lib_t:file manage_file_perms;
+allow system_cronjob_t cron_var_lib_t:file { manage_file_perms relabel_file_perms };
files_var_lib_filetrans(system_cronjob_t, cron_var_lib_t, file)
+allow system_cronjob_t cron_var_run_t:file manage_file_perms;
+files_pid_filetrans(system_cronjob_t, cron_var_run_t, file)
+
allow system_cronjob_t system_cron_spool_t:file read_file_perms;
+
+mls_file_read_to_clearance(system_cronjob_t)
+
+# anacron forces the following
+manage_files_pattern(system_cronjob_t, system_cron_spool_t, system_cron_spool_t)
+
# The entrypoint interface is not used as this is not
# a regular entrypoint. Since crontab files are
# not directly executed, crond must ensure that
@@ -329,6 +406,7 @@ allow crond_t system_cronjob_t:fd use;
allow system_cronjob_t crond_t:fd use;
allow system_cronjob_t crond_t:fifo_file rw_file_perms;
allow system_cronjob_t crond_t:process sigchld;
+allow crond_t system_cronjob_t:key manage_key_perms;
# Write /var/lock/makewhatis.lock.
allow system_cronjob_t system_cronjob_lock_t:file manage_file_perms;
@@ -340,11 +418,16 @@ manage_lnk_files_pattern(system_cronjob_t, crond_tmp_t, system_cronjob_tmp_t)
filetrans_pattern(system_cronjob_t, crond_tmp_t, system_cronjob_tmp_t, { file lnk_file })
files_tmp_filetrans(system_cronjob_t, system_cronjob_tmp_t, file)
+# var/lib files for system_crond
+files_search_var_lib(system_cronjob_t)
+manage_files_pattern(system_cronjob_t, system_cronjob_var_lib_t, system_cronjob_var_lib_t)
+
# Read from /var/spool/cron.
allow system_cronjob_t cron_spool_t:dir list_dir_perms;
-allow system_cronjob_t cron_spool_t:file read_file_perms;
+allow system_cronjob_t cron_spool_t:file rw_file_perms;
kernel_read_kernel_sysctls(system_cronjob_t)
+kernel_read_network_state(system_cronjob_t)
kernel_read_system_state(system_cronjob_t)
kernel_read_software_raid_state(system_cronjob_t)
@@ -365,6 +448,7 @@ corenet_udp_sendrecv_all_ports(system_cronjob_t)
dev_getattr_all_blk_files(system_cronjob_t)
dev_getattr_all_chr_files(system_cronjob_t)
dev_read_urand(system_cronjob_t)
+dev_read_sysfs(system_cronjob_t)
fs_getattr_all_fs(system_cronjob_t)
fs_getattr_all_files(system_cronjob_t)
@@ -376,7 +460,6 @@ fs_getattr_all_sockets(system_cronjob_t)
domain_dontaudit_read_all_domains_state(system_cronjob_t)
files_exec_etc_files(system_cronjob_t)
-files_read_etc_files(system_cronjob_t)
files_read_etc_runtime_files(system_cronjob_t)
files_list_all(system_cronjob_t)
files_getattr_all_dirs(system_cronjob_t)
@@ -391,6 +474,7 @@ files_dontaudit_search_pids(system_cronjob_t)
# Access other spool directories like
# /var/spool/anacron and /var/spool/slrnpull.
files_manage_generic_spool(system_cronjob_t)
+files_create_boot_flag(system_cronjob_t)
init_use_script_fds(system_cronjob_t)
init_read_utmp(system_cronjob_t)
@@ -413,8 +497,10 @@ miscfiles_manage_man_pages(system_cronjob_t)
seutil_read_config(system_cronjob_t)
-ifdef(`distro_redhat', `
+ifdef(`distro_redhat',`
# Run the rpm program in the rpm_t domain. Allow creation of RPM log files
+ allow crond_t system_cron_spool_t:file manage_file_perms;
+
# via redirection of standard out.
optional_policy(`
rpm_manage_log(system_cronjob_t)
@@ -439,6 +525,8 @@ optional_policy(`
apache_read_config(system_cronjob_t)
apache_read_log(system_cronjob_t)
apache_read_sys_content(system_cronjob_t)
+ apache_delete_cache_dirs(system_cronjob_t)
+ apache_delete_cache_files(system_cronjob_t)
')
optional_policy(`
@@ -446,6 +534,14 @@ optional_policy(`
')
optional_policy(`
+ dbus_system_bus_client(system_cronjob_t)
+')
+
+optional_policy(`
+ exim_read_spool_files(system_cronjob_t)
+')
+
+optional_policy(`
ftp_read_log(system_cronjob_t)
')
@@ -456,6 +552,10 @@ optional_policy(`
')
optional_policy(`
+ livecd_read_tmp_files(system_cronjob_t)
+')
+
+optional_policy(`
lpd_list_spool(system_cronjob_t)
')
@@ -464,7 +564,9 @@ optional_policy(`
')
optional_policy(`
+ mta_read_config(system_cronjob_t)
mta_send_mail(system_cronjob_t)
+ mta_system_content(system_cron_spool_t)
')
optional_policy(`
@@ -472,6 +574,10 @@ optional_policy(`
')
optional_policy(`
+ networkmanager_dbus_chat(system_cronjob_t)
+')
+
+optional_policy(`
postfix_read_config(system_cronjob_t)
')
@@ -480,7 +586,7 @@ optional_policy(`
prelink_manage_lib(system_cronjob_t)
prelink_manage_log(system_cronjob_t)
prelink_read_cache(system_cronjob_t)
- prelink_relabelfrom_lib(system_cronjob_t)
+ prelink_relabel_lib(system_cronjob_t)
')
optional_policy(`
@@ -495,6 +601,7 @@ optional_policy(`
optional_policy(`
spamassassin_manage_lib_files(system_cronjob_t)
+ spamassassin_manage_home_client(system_cronjob_t)
')
optional_policy(`
@@ -502,7 +609,18 @@ optional_policy(`
')
optional_policy(`
+ systemd_dbus_chat_logind(system_cronjob_t)
+ systemd_write_inherited_logind_sessions_pipes(system_cronjob_t)
+')
+
+optional_policy(`
+ unconfined_domain(crond_t)
unconfined_domain(system_cronjob_t)
+')
+
+optional_policy(`
+ unconfined_shell_domtrans(crond_t)
+ unconfined_dbus_send(crond_t)
userdom_user_home_dir_filetrans_user_home_content(system_cronjob_t, { dir file lnk_file fifo_file sock_file })
')
@@ -595,9 +713,12 @@ userdom_manage_user_home_content_sockets(cronjob_t)
#userdom_user_home_dir_filetrans_user_home_content(cronjob_t, notdevfile_class_set)
list_dirs_pattern(crond_t, user_cron_spool_t, user_cron_spool_t)
+rw_dirs_pattern(crond_t, user_cron_spool_t, user_cron_spool_t)
read_files_pattern(crond_t, user_cron_spool_t, user_cron_spool_t)
+read_lnk_files_pattern(crond_t, user_cron_spool_t, user_cron_spool_t)
+allow crond_t user_cron_spool_t:file manage_lnk_file_perms;
-tunable_policy(`fcron_crond', `
+tunable_policy(`fcron_crond',`
allow crond_t user_cron_spool_t:file manage_file_perms;
')
diff --git a/ctdbd.fc b/ctdbd.fc
new file mode 100644
index 0000000..2db6b61
--- /dev/null
+++ b/ctdbd.fc
@@ -0,0 +1,18 @@
+
+/etc/rc\.d/init\.d/ctdb -- gen_context(system_u:object_r:ctdbd_initrc_exec_t,s0)
+
+/etc/ctdb(/.*)? gen_context(system_u:object_r:ctdbd_var_lib_t,s0)
+
+/usr/sbin/ctdbd -- gen_context(system_u:object_r:ctdbd_exec_t,s0)
+
+/var/log/log\.ctdb -- gen_context(system_u:object_r:ctdbd_log_t,s0)
+
+/var/spool/ctdb(/.*)? gen_context(system_u:object_r:ctdbd_spool_t,s0)
+
+/var/run/ctdbd(/.*)? gen_context(system_u:object_r:ctdbd_var_run_t,s0)
+
+
+/var/ctdbd(/.*)? gen_context(system_u:object_r:ctdbd_var_lib_t,s0)
+/var/ctdb(/.*)? gen_context(system_u:object_r:ctdbd_var_lib_t,s0)
+/var/lib/ctdbd(/.*)? gen_context(system_u:object_r:ctdbd_var_lib_t,s0)
+
diff --git a/ctdbd.if b/ctdbd.if
new file mode 100644
index 0000000..4f7d237
--- /dev/null
+++ b/ctdbd.if
@@ -0,0 +1,259 @@
+
+## policy for ctdbd
+
+########################################
+##
+## Transition to ctdbd.
+##
+##
+##
+## Domain allowed to transition.
+##
+##
+#
+interface(`ctdbd_domtrans',`
+ gen_require(`
+ type ctdbd_t, ctdbd_exec_t;
+ ')
+
+ corecmd_search_bin($1)
+ domtrans_pattern($1, ctdbd_exec_t, ctdbd_t)
+')
+
+########################################
+##
+## Execute ctdbd server in the ctdbd domain.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`ctdbd_initrc_domtrans',`
+ gen_require(`
+ type ctdbd_initrc_exec_t;
+ ')
+
+ init_labeled_script_domtrans($1, ctdbd_initrc_exec_t)
+')
+
+########################################
+##
+## Read ctdbd's log files.
+##
+##
+##
+## Domain allowed access.
+##
+##
+##
+#
+interface(`ctdbd_read_log',`
+ gen_require(`
+ type ctdbd_log_t;
+ ')
+
+ logging_search_logs($1)
+ read_files_pattern($1, ctdbd_log_t, ctdbd_log_t)
+')
+
+########################################
+##
+## Append to ctdbd log files.
+##
+##
+##
+## Domain allowed to transition.
+##
+##
+#
+interface(`ctdbd_append_log',`
+ gen_require(`
+ type ctdbd_log_t;
+ ')
+
+ logging_search_logs($1)
+ append_files_pattern($1, ctdbd_log_t, ctdbd_log_t)
+')
+
+########################################
+##
+## Manage ctdbd log files
+##
+##
+##
+## Domain to not audit.
+##
+##
+#
+interface(`ctdbd_manage_log',`
+ gen_require(`
+ type ctdbd_log_t;
+ ')
+
+ logging_search_logs($1)
+ manage_dirs_pattern($1, ctdbd_log_t, ctdbd_log_t)
+ manage_files_pattern($1, ctdbd_log_t, ctdbd_log_t)
+ manage_lnk_files_pattern($1, ctdbd_log_t, ctdbd_log_t)
+')
+
+########################################
+##
+## Search ctdbd lib directories.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`ctdbd_search_lib',`
+ gen_require(`
+ type ctdbd_var_lib_t;
+ ')
+
+ allow $1 ctdbd_var_lib_t:dir search_dir_perms;
+ files_search_var_lib($1)
+')
+
+########################################
+##
+## Read ctdbd lib files.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`ctdbd_read_lib_files',`
+ gen_require(`
+ type ctdbd_var_lib_t;
+ ')
+
+ files_search_var_lib($1)
+ read_files_pattern($1, ctdbd_var_lib_t, ctdbd_var_lib_t)
+')
+
+########################################
+##
+## Manage ctdbd lib files.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`ctdbd_manage_lib_files',`
+ gen_require(`
+ type ctdbd_var_lib_t;
+ ')
+
+ files_search_var_lib($1)
+ manage_files_pattern($1, ctdbd_var_lib_t, ctdbd_var_lib_t)
+')
+
+########################################
+##
+## Manage ctdbd lib directories.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`ctdbd_manage_lib_dirs',`
+ gen_require(`
+ type ctdbd_var_lib_t;
+ ')
+
+ files_search_var_lib($1)
+ manage_dirs_pattern($1, ctdbd_var_lib_t, ctdbd_var_lib_t)
+')
+
+########################################
+##
+## Read ctdbd PID files.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`ctdbd_read_pid_files',`
+ gen_require(`
+ type ctdbd_var_run_t;
+ ')
+
+ files_search_pids($1)
+ allow $1 ctdbd_var_run_t:file read_file_perms;
+')
+
+#######################################
+##
+## Connect to ctdbd over a unix stream socket.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`ctdbd_stream_connect',`
+ gen_require(`
+ type ctdbd_t, ctdbd_var_run_t, ctdbd_tmp_t;
+ ')
+
+ files_search_pids($1)
+ stream_connect_pattern($1, ctdbd_var_run_t, ctdbd_var_run_t, ctdbd_t)
+ stream_connect_pattern($1, ctdbd_tmp_t, ctdbd_tmp_t, ctdbd_t)
+')
+
+########################################
+##
+## All of the rules required to administrate
+## an ctdbd environment
+##
+##
+##
+## Domain allowed access.
+##
+##
+##
+##
+## Role allowed access.
+##
+##
+##
+#
+interface(`ctdbd_admin',`
+ gen_require(`
+ type ctdbd_t, ctdbd_initrc_exec_t;
+ type ctdbd_log_t, ctdbd_var_lib_t, ctdbd_var_run_t;
+ ')
+
+ allow $1 ctdbd_t:process signal_perms;
+ ps_process_pattern($1, ctdbd_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 ctdbd_t:process ptrace;
+ ')
+
+ ctdbd_initrc_domtrans($1)
+ domain_system_change_exemption($1)
+ role_transition $2 ctdbd_initrc_exec_t system_r;
+ allow $2 system_r;
+
+ logging_search_logs($1)
+ admin_pattern($1, ctdbd_log_t)
+
+ files_search_var_lib($1)
+ admin_pattern($1, ctdbd_var_lib_t)
+
+ files_search_pids($1)
+ admin_pattern($1, ctdbd_var_run_t)
+')
+
diff --git a/ctdbd.te b/ctdbd.te
new file mode 100644
index 0000000..284fbae
--- /dev/null
+++ b/ctdbd.te
@@ -0,0 +1,114 @@
+policy_module(ctdbd, 1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type ctdbd_t;
+type ctdbd_exec_t;
+init_daemon_domain(ctdbd_t, ctdbd_exec_t)
+
+type ctdbd_initrc_exec_t;
+init_script_file(ctdbd_initrc_exec_t)
+
+type ctdbd_log_t;
+logging_log_file(ctdbd_log_t)
+
+type ctdbd_spool_t;
+files_type(ctdbd_spool_t)
+#files_spool_file(ctdbd_spool_t)
+
+type ctdbd_tmp_t;
+files_tmp_file(ctdbd_tmp_t)
+
+type ctdbd_var_lib_t;
+files_type(ctdbd_var_lib_t)
+
+type ctdbd_var_run_t;
+files_pid_file(ctdbd_var_run_t)
+
+########################################
+#
+# ctdbd local policy
+#
+
+allow ctdbd_t self:capability { chown ipc_lock net_admin net_raw sys_nice };
+allow ctdbd_t self:process { setpgid signal_perms setsched };
+
+allow ctdbd_t self:fifo_file rw_fifo_file_perms;
+allow ctdbd_t self:unix_stream_socket { connectto create_stream_socket_perms };
+allow ctdbd_t self:netlink_route_socket r_netlink_socket_perms;
+allow ctdbd_t self:packet_socket create_socket_perms;
+allow ctdbd_t self:tcp_socket create_stream_socket_perms;
+
+manage_dirs_pattern(ctdbd_t, ctdbd_log_t, ctdbd_log_t)
+manage_files_pattern(ctdbd_t, ctdbd_log_t, ctdbd_log_t)
+logging_log_filetrans(ctdbd_t, ctdbd_log_t, { dir file } )
+
+manage_files_pattern(ctdbd_t, ctdbd_tmp_t, ctdbd_tmp_t)
+manage_sock_files_pattern(ctdbd_t, ctdbd_tmp_t, ctdbd_tmp_t)
+files_tmp_filetrans(ctdbd_t, ctdbd_tmp_t, { file sock_file})
+
+manage_dirs_pattern(ctdbd_t, ctdbd_spool_t, ctdbd_spool_t)
+manage_files_pattern(ctdbd_t, ctdbd_spool_t, ctdbd_spool_t)
+manage_lnk_files_pattern(ctdbd_t, ctdbd_spool_t, ctdbd_spool_t)
+files_spool_filetrans(ctdbd_t, ctdbd_spool_t, { dir file })
+
+exec_files_pattern(ctdbd_t, ctdbd_var_lib_t, ctdbd_var_lib_t)
+manage_dirs_pattern(ctdbd_t, ctdbd_var_lib_t, ctdbd_var_lib_t)
+manage_files_pattern(ctdbd_t, ctdbd_var_lib_t, ctdbd_var_lib_t)
+files_var_lib_filetrans(ctdbd_t, ctdbd_var_lib_t, { dir file } )
+
+manage_dirs_pattern(ctdbd_t, ctdbd_var_run_t, ctdbd_var_run_t)
+manage_files_pattern(ctdbd_t, ctdbd_var_run_t, ctdbd_var_run_t)
+files_pid_filetrans(ctdbd_t, ctdbd_var_run_t, { dir file })
+
+kernel_read_network_state(ctdbd_t)
+kernel_rw_net_sysctls(ctdbd_t)
+kernel_read_system_state(ctdbd_t)
+
+corenet_tcp_bind_generic_node(ctdbd_t)
+corenet_tcp_bind_ctdb_port(ctdbd_t)
+corenet_tcp_connect_ctdb_port(ctdbd_t)
+
+corecmd_exec_bin(ctdbd_t)
+corecmd_exec_shell(ctdbd_t)
+
+dev_read_sysfs(ctdbd_t)
+dev_read_urand(ctdbd_t)
+
+domain_use_interactive_fds(ctdbd_t)
+domain_dontaudit_read_all_domains_state(ctdbd_t)
+
+files_read_etc_files(ctdbd_t)
+files_search_all_mountpoints(ctdbd_t)
+
+logging_send_syslog_msg(ctdbd_t)
+
+miscfiles_read_localization(ctdbd_t)
+miscfiles_read_public_files(ctdbd_t)
+
+
+optional_policy(`
+ consoletype_exec(ctdbd_t)
+')
+
+optional_policy(`
+ hostname_exec(ctdbd_t)
+')
+
+optional_policy(`
+ iptables_domtrans(ctdbd_t)
+')
+
+optional_policy(`
+ samba_initrc_domtrans(ctdbd_t)
+ samba_domtrans_net(ctdbd_t)
+ samba_rw_var_files(ctdbd_t)
+ samba_systemctl(ctdbd_t)
+')
+
+optional_policy(`
+ sysnet_domtrans_ifconfig(ctdbd_t)
+')
diff --git a/cups.fc b/cups.fc
index 848bb92..25c56f7 100644
--- a/cups.fc
+++ b/cups.fc
@@ -19,7 +19,10 @@
/etc/printcap.* -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
+/usr/lib/systemd/system/cups.* -- gen_context(system_u:object_r:cupsd_unit_file_t,s0)
+
/lib/udev/udev-configure-printer -- gen_context(system_u:object_r:cupsd_config_exec_t,s0)
+/usr/lib/udev/udev-configure-printer -- gen_context(system_u:object_r:cupsd_config_exec_t,s0)
/opt/gutenprint/ppds(/.*)? gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
@@ -52,6 +55,7 @@
/var/lib/cups/certs -d gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
/var/lib/cups/certs/.* -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
+/usr/lib/bjlib(/.*)? gen_context(system_u:object_r:cupsd_rw_etc_t,mls_systemhigh)
/var/lib/hp(/.*)? gen_context(system_u:object_r:hplip_var_lib_t,s0)
@@ -60,10 +64,16 @@
/var/ccpd(/.*)? gen_context(system_u:object_r:cupsd_var_run_t,s0)
/var/ekpd(/.*)? gen_context(system_u:object_r:cupsd_var_run_t,s0)
-/var/run/cups(/.*)? gen_context(system_u:object_r:cupsd_var_run_t,s0)
+/var/run/cups(/.*)? gen_context(system_u:object_r:cupsd_var_run_t,mls_systemhigh)
/var/run/hp.*\.pid -- gen_context(system_u:object_r:hplip_var_run_t,s0)
/var/run/hp.*\.port -- gen_context(system_u:object_r:hplip_var_run_t,s0)
/var/run/ptal-printd(/.*)? gen_context(system_u:object_r:ptal_var_run_t,s0)
/var/run/ptal-mlcd(/.*)? gen_context(system_u:object_r:ptal_var_run_t,s0)
/var/run/udev-configure-printer(/.*)? gen_context(system_u:object_r:cupsd_config_var_run_t,s0)
/var/turboprint(/.*)? gen_context(system_u:object_r:cupsd_var_run_t,s0)
+
+/usr/local/Brother/fax/.*\.log gen_context(system_u:object_r:cupsd_log_t,s0)
+/usr/local/Brother/(.*/)?inf(/.*)? gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
+/usr/local/Printer/(.*/)?inf(/.*)? gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
+
+/usr/local/linuxprinter/ppd(/.*)? gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
diff --git a/cups.if b/cups.if
index 305ddf4..11d010a 100644
--- a/cups.if
+++ b/cups.if
@@ -9,6 +9,11 @@
## Domain allowed access.
##
##
+##
+##
+## Domain allowed access.
+##
+##
#
interface(`cups_backend',`
gen_require(`
@@ -190,10 +195,12 @@ interface(`cups_dbus_chat_config',`
interface(`cups_read_config',`
gen_require(`
type cupsd_etc_t, cupsd_rw_etc_t;
+ type hplip_etc_t;
')
files_search_etc($1)
read_files_pattern($1, cupsd_etc_t, cupsd_etc_t)
+ read_files_pattern($1, hplip_etc_t, hplip_etc_t)
read_files_pattern($1, cupsd_etc_t, cupsd_rw_etc_t)
')
@@ -296,6 +303,29 @@ interface(`cups_stream_connect_ptal',`
########################################
##
+## Execute cupsd server in the cupsd domain.
+##
+##
+##
+## Domain allowed to transition.
+##
+##
+#
+interface(`cupsd_systemctl',`
+ gen_require(`
+ type cupsd_t;
+ type cupsd_unit_file_t;
+ ')
+
+ systemd_exec_systemctl($1)
+ allow $1 cupsd_unit_file_t:file read_file_perms;
+ allow $1 cupsd_unit_file_t:service manage_service_perms;
+
+ ps_process_pattern($1, cupsd_t)
+')
+
+########################################
+##
## All of the rules required to administrate
## an cups environment
##
@@ -314,16 +344,20 @@ interface(`cups_stream_connect_ptal',`
interface(`cups_admin',`
gen_require(`
type cupsd_t, cupsd_tmp_t, cupsd_lpd_tmp_t;
- type cupsd_etc_t, cupsd_log_t, cupsd_spool_t;
- type cupsd_config_var_run_t, cupsd_lpd_var_run_t;
- type cupsd_var_run_t, ptal_etc_t;
- type ptal_var_run_t, hplip_var_run_t;
- type cupsd_initrc_exec_t;
+ type cupsd_etc_t, cupsd_log_t, hplip_etc_t;
+ type cupsd_config_var_run_t, cupsd_lpd_var_run_t, cupsd_initrc_exec_t;
+ type cupsd_var_run_t, ptal_etc_t, hplip_var_run_t;
+ type ptal_var_run_t;
+ type cupsd_unit_file_t;
')
- allow $1 cupsd_t:process { ptrace signal_perms };
+ allow $1 cupsd_t:process signal_perms;
ps_process_pattern($1, cupsd_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 cupsd_t:process ptrace;
+ ')
+
init_labeled_script_domtrans($1, cupsd_initrc_exec_t)
domain_system_change_exemption($1)
role_transition $2 cupsd_initrc_exec_t system_r;
@@ -350,9 +384,42 @@ interface(`cups_admin',`
admin_pattern($1, cupsd_var_run_t)
files_list_pids($1)
+ admin_pattern($1, hplip_etc_t)
+
admin_pattern($1, hplip_var_run_t)
admin_pattern($1, ptal_etc_t)
admin_pattern($1, ptal_var_run_t)
+
+ cupsd_systemctl($1)
+ admin_pattern($1, cupsd_unit_file_t)
+ allow $1 cupsd_unit_file_t:service all_service_perms;
+')
+
+########################################
+##
+## Transition to cups named content
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`cups_filetrans_named_content',`
+ gen_require(`
+ type cups_rw_etc_t;
+ type cups_etc_t;
+ ')
+
+ filetrans_pattern($1, cups_etc_t, cups_rw_etc_t, file, "classes.conf")
+ filetrans_pattern($1, cups_etc_t, cups_rw_etc_t, file, "printers.conf")
+ filetrans_pattern($1, cups_etc_t, cups_rw_etc_t, file, "printers.conf.O")
+ filetrans_pattern($1, cups_etc_t, cups_rw_etc_t, file, "cupsd.conf")
+ filetrans_pattern($1, cups_etc_t, cups_rw_etc_t, file, "cupsd.conf.default")
+ filetrans_pattern($1, cups_etc_t, cups_rw_etc_t, file, "lpoptions")
+ filetrans_pattern($1, cups_etc_t, cups_rw_etc_t, file, "subscriptions.conf")
+ filetrans_pattern($1, cups_etc_t, cups_rw_etc_t, file, "subscriptions.conf.O")
+ filetrans_pattern($1, cups_etc_t, cups_rw_etc_t, file, "ppds.dat")
')
diff --git a/cups.te b/cups.te
index 6e7f1b6..f8cf711 100644
--- a/cups.te
+++ b/cups.te
@@ -15,6 +15,7 @@ files_pid_file(cupsd_config_var_run_t)
type cupsd_t;
type cupsd_exec_t;
init_daemon_domain(cupsd_t, cupsd_exec_t)
+mls_trusted_object(cupsd_t)
type cupsd_etc_t;
files_config_file(cupsd_etc_t)
@@ -60,6 +61,9 @@ type cupsd_var_run_t;
files_pid_file(cupsd_var_run_t)
mls_trusted_object(cupsd_var_run_t)
+type cupsd_unit_file_t;
+systemd_unit_file(cupsd_unit_file_t)
+
type hplip_t;
type hplip_exec_t;
init_daemon_domain(hplip_t, hplip_exec_t)
@@ -123,6 +127,7 @@ read_lnk_files_pattern(cupsd_t, cupsd_etc_t, cupsd_etc_t)
files_search_etc(cupsd_t)
manage_files_pattern(cupsd_t, cupsd_interface_t, cupsd_interface_t)
+can_exec(cupsd_t, cupsd_interface_t)
manage_dirs_pattern(cupsd_t, cupsd_etc_t, cupsd_rw_etc_t)
manage_files_pattern(cupsd_t, cupsd_etc_t, cupsd_rw_etc_t)
@@ -137,6 +142,7 @@ allow cupsd_t cupsd_exec_t:lnk_file read_lnk_file_perms;
allow cupsd_t cupsd_lock_t:file manage_file_perms;
files_lock_filetrans(cupsd_t, cupsd_lock_t, file)
+manage_dirs_pattern(cupsd_t, cupsd_log_t, cupsd_log_t)
manage_files_pattern(cupsd_t, cupsd_log_t, cupsd_log_t)
allow cupsd_t cupsd_log_t:dir setattr;
logging_log_filetrans(cupsd_t, cupsd_log_t, { file dir })
@@ -146,11 +152,12 @@ manage_files_pattern(cupsd_t, cupsd_tmp_t, cupsd_tmp_t)
manage_fifo_files_pattern(cupsd_t, cupsd_tmp_t, cupsd_tmp_t)
files_tmp_filetrans(cupsd_t, cupsd_tmp_t, { file dir fifo_file })
-allow cupsd_t cupsd_var_run_t:dir setattr;
+allow cupsd_t cupsd_var_run_t:dir setattr_dir_perms;
+manage_dirs_pattern(cupsd_t, cupsd_var_run_t, cupsd_var_run_t)
manage_files_pattern(cupsd_t, cupsd_var_run_t, cupsd_var_run_t)
manage_sock_files_pattern(cupsd_t, cupsd_var_run_t, cupsd_var_run_t)
manage_fifo_files_pattern(cupsd_t, cupsd_var_run_t, cupsd_var_run_t)
-files_pid_filetrans(cupsd_t, cupsd_var_run_t, { file fifo_file })
+files_pid_filetrans(cupsd_t, cupsd_var_run_t, { dir file fifo_file })
allow cupsd_t hplip_t:process { signal sigkill };
@@ -159,7 +166,7 @@ read_files_pattern(cupsd_t, hplip_etc_t, hplip_etc_t)
allow cupsd_t hplip_var_run_t:file read_file_perms;
stream_connect_pattern(cupsd_t, ptal_var_run_t, ptal_var_run_t, ptal_t)
-allow cupsd_t ptal_var_run_t : sock_file setattr;
+allow cupsd_t ptal_var_run_t:sock_file setattr_sock_file_perms;
kernel_read_system_state(cupsd_t)
kernel_read_network_state(cupsd_t)
@@ -211,6 +218,7 @@ mls_rangetrans_target(cupsd_t)
mls_socket_write_all_levels(cupsd_t)
mls_fd_use_all_levels(cupsd_t)
+term_use_usb_ttys(cupsd_t)
term_use_unallocated_ttys(cupsd_t)
term_search_ptys(cupsd_t)
@@ -220,11 +228,12 @@ corecmd_exec_bin(cupsd_t)
domain_use_interactive_fds(cupsd_t)
+files_getattr_boot_dirs(cupsd_t)
files_list_spool(cupsd_t)
-files_read_etc_files(cupsd_t)
files_read_etc_runtime_files(cupsd_t)
# read python modules
files_read_usr_files(cupsd_t)
+files_exec_usr_files(cupsd_t)
# for /var/lib/defoma
files_read_var_lib_files(cupsd_t)
files_list_world_readable(cupsd_t)
@@ -270,12 +279,6 @@ files_dontaudit_list_home(cupsd_t)
userdom_dontaudit_use_unpriv_user_fds(cupsd_t)
userdom_dontaudit_search_user_home_content(cupsd_t)
-# Write to /var/spool/cups.
-lpd_manage_spool(cupsd_t)
-lpd_read_config(cupsd_t)
-lpd_exec_lpr(cupsd_t)
-lpd_relabel_spool(cupsd_t)
-
optional_policy(`
apm_domtrans_client(cupsd_t)
')
@@ -287,6 +290,8 @@ optional_policy(`
optional_policy(`
dbus_system_bus_client(cupsd_t)
+ init_dbus_chat(cupsd_t)
+
userdom_dbus_send_all_users(cupsd_t)
optional_policy(`
@@ -297,8 +302,10 @@ optional_policy(`
hal_dbus_chat(cupsd_t)
')
+ # talk to processes that do not have policy
optional_policy(`
unconfined_dbus_chat(cupsd_t)
+ files_write_generic_pid_pipes(cupsd_t)
')
')
@@ -311,10 +318,23 @@ optional_policy(`
')
optional_policy(`
+ kerberos_tmp_filetrans_host_rcache(cupsd_t, "host_0")
+ kerberos_manage_host_rcache(cupsd_t)
+')
+
+optional_policy(`
logrotate_domtrans(cupsd_t)
')
optional_policy(`
+ # Write to /var/spool/cups.
+ lpd_manage_spool(cupsd_t)
+ lpd_read_config(cupsd_t)
+ lpd_exec_lpr(cupsd_t)
+ lpd_relabel_spool(cupsd_t)
+')
+
+optional_policy(`
mta_send_mail(cupsd_t)
')
@@ -322,6 +342,8 @@ optional_policy(`
# cups execs smbtool which reads samba_etc_t files
samba_read_config(cupsd_t)
samba_rw_var_files(cupsd_t)
+ # needed by smbspool
+ samba_stream_connect_nmbd(cupsd_t)
')
optional_policy(`
@@ -371,8 +393,9 @@ files_tmp_filetrans(cupsd_config_t, cupsd_tmp_t, { lnk_file file dir })
allow cupsd_config_t cupsd_var_run_t:file read_file_perms;
+manage_dirs_pattern(cupsd_config_t, cupsd_config_var_run_t, cupsd_config_var_run_t)
manage_files_pattern(cupsd_config_t, cupsd_config_var_run_t, cupsd_config_var_run_t)
-files_pid_filetrans(cupsd_config_t, cupsd_config_var_run_t, file)
+files_pid_filetrans(cupsd_config_t, cupsd_config_var_run_t, { dir file })
domtrans_pattern(cupsd_config_t, hplip_exec_t, hplip_t)
@@ -407,7 +430,6 @@ domain_use_interactive_fds(cupsd_config_t)
domain_dontaudit_search_all_domains_state(cupsd_config_t)
files_read_usr_files(cupsd_config_t)
-files_read_etc_files(cupsd_config_t)
files_read_etc_runtime_files(cupsd_config_t)
files_read_var_symlinks(cupsd_config_t)
@@ -425,11 +447,11 @@ seutil_dontaudit_search_config(cupsd_config_t)
userdom_dontaudit_use_unpriv_user_fds(cupsd_config_t)
userdom_dontaudit_search_user_home_dirs(cupsd_config_t)
+userdom_rw_user_tmp_files(cupsd_config_t)
+userdom_read_user_tmp_symlinks(cupsd_config_t)
cups_stream_connect(cupsd_config_t)
-lpd_read_config(cupsd_config_t)
-
ifdef(`distro_redhat',`
optional_policy(`
rpm_read_db(cupsd_config_t)
@@ -453,6 +475,10 @@ optional_policy(`
')
optional_policy(`
+ gnome_dontaudit_search_config(cupsd_config_t)
+')
+
+optional_policy(`
hal_domtrans(cupsd_config_t)
hal_read_tmp_files(cupsd_config_t)
hal_dontaudit_use_fds(hplip_t)
@@ -467,6 +493,10 @@ optional_policy(`
')
optional_policy(`
+ lpd_read_config(cupsd_config_t)
+')
+
+optional_policy(`
policykit_dbus_chat(cupsd_config_t)
userdom_read_all_users_state(cupsd_config_t)
')
@@ -537,13 +567,13 @@ corenet_udp_sendrecv_all_ports(cupsd_lpd_t)
corenet_tcp_bind_generic_node(cupsd_lpd_t)
corenet_udp_bind_generic_node(cupsd_lpd_t)
corenet_tcp_connect_ipp_port(cupsd_lpd_t)
+corenet_tcp_connect_printer_port(cupsd_lpd_t)
dev_read_urand(cupsd_lpd_t)
dev_read_rand(cupsd_lpd_t)
fs_getattr_xattr_fs(cupsd_lpd_t)
-files_read_etc_files(cupsd_lpd_t)
auth_use_nsswitch(cupsd_lpd_t)
@@ -577,7 +607,6 @@ fs_rw_anon_inodefs_files(cups_pdf_t)
kernel_read_system_state(cups_pdf_t)
-files_read_etc_files(cups_pdf_t)
files_read_usr_files(cups_pdf_t)
corecmd_exec_shell(cups_pdf_t)
@@ -587,23 +616,22 @@ auth_use_nsswitch(cups_pdf_t)
miscfiles_read_localization(cups_pdf_t)
miscfiles_read_fonts(cups_pdf_t)
+miscfiles_setattr_fonts_cache_dirs(cups_pdf_t)
userdom_home_filetrans_user_home_dir(cups_pdf_t)
+userdom_user_home_dir_filetrans_pattern(cups_pdf_t, { file dir })
userdom_manage_user_home_content_dirs(cups_pdf_t)
userdom_manage_user_home_content_files(cups_pdf_t)
+userdom_dontaudit_search_admin_dir(cups_pdf_t)
-lpd_manage_spool(cups_pdf_t)
-
-
-tunable_policy(`use_nfs_home_dirs',`
- fs_search_auto_mountpoints(cups_pdf_t)
- fs_manage_nfs_dirs(cups_pdf_t)
- fs_manage_nfs_files(cups_pdf_t)
+optional_policy(`
+ lpd_manage_spool(cups_pdf_t)
')
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(cups_pdf_t)
- fs_manage_cifs_files(cups_pdf_t)
+userdom_home_manager(cups_pdf_t)
+
+optional_policy(`
+ gnome_read_config(cups_pdf_t)
')
########################################
@@ -661,10 +689,10 @@ corenet_tcp_bind_generic_node(hplip_t)
corenet_udp_bind_generic_node(hplip_t)
corenet_tcp_bind_hplip_port(hplip_t)
corenet_tcp_connect_hplip_port(hplip_t)
-corenet_tcp_connect_ipp_port(hplip_t)
-corenet_sendrecv_hplip_client_packets(hplip_t)
-corenet_receive_hplip_server_packets(hplip_t)
+corenet_tcp_bind_glance_port(hplip_t)
+corenet_tcp_connect_glance_port(hplip_t)
corenet_udp_bind_howl_port(hplip_t)
+corenet_tcp_connect_ipp_port(hplip_t)
dev_read_sysfs(hplip_t)
dev_rw_printer(hplip_t)
@@ -682,9 +710,11 @@ corecmd_exec_bin(hplip_t)
domain_use_interactive_fds(hplip_t)
-files_read_etc_files(hplip_t)
files_read_etc_runtime_files(hplip_t)
files_read_usr_files(hplip_t)
+files_dontaudit_write_usr_dirs(hplip_t)
+
+auth_read_passwd(hplip_t)
logging_send_syslog_msg(hplip_t)
@@ -696,8 +726,10 @@ userdom_dontaudit_use_unpriv_user_fds(hplip_t)
userdom_dontaudit_search_user_home_dirs(hplip_t)
userdom_dontaudit_search_user_home_content(hplip_t)
-lpd_read_config(hplip_t)
-lpd_manage_spool(hplip_t)
+optional_policy(`
+ lpd_read_config(hplip_t)
+ lpd_manage_spool(hplip_t)
+')
optional_policy(`
dbus_system_bus_client(hplip_t)
@@ -760,7 +792,6 @@ fs_search_auto_mountpoints(ptal_t)
domain_use_interactive_fds(ptal_t)
-files_read_etc_files(ptal_t)
files_read_etc_runtime_files(ptal_t)
logging_send_syslog_msg(ptal_t)
diff --git a/cvs.if b/cvs.if
index c43ff4c..5da88b5 100644
--- a/cvs.if
+++ b/cvs.if
@@ -1,5 +1,23 @@
## Concurrent versions system
+######################################
+##
+## Dontaudit Attempts to list the CVS data and metadata.
+##
+##
+##
+## Domain to not audit.
+##
+##
+#
+interface(`cvs_dontaudit_list_data',`
+ gen_require(`
+ type cvs_data_t;
+ ')
+
+ dontaudit $1 cvs_data_t:dir list_dir_perms;
+')
+
########################################
##
## Read the CVS data and metadata.
@@ -58,14 +76,17 @@ interface(`cvs_exec',`
#
interface(`cvs_admin',`
gen_require(`
- type cvs_t, cvs_tmp_t;
+ type cvs_t, cvs_tmp_t, cvs_initrc_exec_t;
type cvs_data_t, cvs_var_run_t;
- type cvs_initrc_exec_t;
')
- allow $1 cvs_t:process { ptrace signal_perms };
+ allow $1 cvs_t:process signal_perms;
ps_process_pattern($1, cvs_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 cvs_t:process ptrace;
+ ')
+
# Allow cvs_t to restart the apache service
init_labeled_script_domtrans($1, cvs_initrc_exec_t)
domain_system_change_exemption($1)
diff --git a/cvs.te b/cvs.te
index 88e7e97..4742d3a 100644
--- a/cvs.te
+++ b/cvs.te
@@ -10,7 +10,7 @@ policy_module(cvs, 1.9.0)
## Allow cvs daemon to read shadow
##
##
-gen_tunable(allow_cvs_read_shadow, false)
+gen_tunable(cvs_read_shadow, false)
type cvs_t;
type cvs_exec_t;
@@ -35,12 +35,12 @@ files_pid_file(cvs_var_run_t)
# Local policy
#
+allow cvs_t self:capability { setuid setgid };
allow cvs_t self:process signal_perms;
allow cvs_t self:fifo_file rw_fifo_file_perms;
allow cvs_t self:tcp_socket connected_stream_socket_perms;
# for identd; cjp: this should probably only be inetd_child rules?
allow cvs_t self:netlink_tcpdiag_socket r_netlink_socket_perms;
-allow cvs_t self:capability { setuid setgid };
manage_dirs_pattern(cvs_t, cvs_data_t, cvs_data_t)
manage_files_pattern(cvs_t, cvs_data_t, cvs_data_t)
@@ -76,11 +76,12 @@ auth_use_nsswitch(cvs_t)
corecmd_exec_bin(cvs_t)
corecmd_exec_shell(cvs_t)
-files_read_etc_files(cvs_t)
files_read_etc_runtime_files(cvs_t)
# for identd; cjp: this should probably only be inetd_child rules?
files_search_home(cvs_t)
+init_dontaudit_read_utmp(cvs_t)
+
logging_send_syslog_msg(cvs_t)
logging_send_audit_msgs(cvs_t)
@@ -88,9 +89,11 @@ miscfiles_read_localization(cvs_t)
mta_send_mail(cvs_t)
+userdom_dontaudit_search_user_home_dirs(cvs_t)
+
# cjp: typeattribute doesnt work in conditionals yet
auth_can_read_shadow_passwords(cvs_t)
-tunable_policy(`allow_cvs_read_shadow',`
+tunable_policy(`cvs_read_shadow',`
allow cvs_t self:capability dac_override;
auth_tunable_read_shadow(cvs_t)
')
@@ -112,4 +115,5 @@ optional_policy(`
read_files_pattern(httpd_cvs_script_t, cvs_data_t, cvs_data_t)
manage_dirs_pattern(httpd_cvs_script_t, cvs_tmp_t, cvs_tmp_t)
manage_files_pattern(httpd_cvs_script_t, cvs_tmp_t, cvs_tmp_t)
+ files_tmp_filetrans(httpd_cvs_script_t, cvs_tmp_t, { file dir })
')
diff --git a/cyrus.if b/cyrus.if
index e4e86d0..7c30655 100644
--- a/cyrus.if
+++ b/cyrus.if
@@ -62,9 +62,13 @@ interface(`cyrus_admin',`
type cyrus_var_run_t, cyrus_initrc_exec_t;
')
- allow $1 cyrus_t:process { ptrace signal_perms };
+ allow $1 cyrus_t:process signal_perms;
ps_process_pattern($1, cyrus_t)
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 cyrus_t:process ptrace;
+ ')
+
init_labeled_script_domtrans($1, cyrus_initrc_exec_t)
domain_system_change_exemption($1)
role_transition $2 cyrus_initrc_exec_t system_r;
diff --git a/cyrus.te b/cyrus.te
index a531e6f..ec075b8 100644
--- a/cyrus.te
+++ b/cyrus.te
@@ -26,7 +26,7 @@ files_pid_file(cyrus_var_run_t)
# Local policy
#
-allow cyrus_t self:capability { dac_override net_bind_service setgid setuid sys_resource };
+allow cyrus_t self:capability { fsetid dac_override net_bind_service setgid setuid sys_resource };
dontaudit cyrus_t self:capability sys_tty_config;
allow cyrus_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
allow cyrus_t self:process setrlimit;
@@ -73,6 +73,7 @@ corenet_udp_sendrecv_all_ports(cyrus_t)
corenet_tcp_bind_generic_node(cyrus_t)
corenet_tcp_bind_mail_port(cyrus_t)
corenet_tcp_bind_lmtp_port(cyrus_t)
+corenet_tcp_bind_innd_port(cyrus_t)
corenet_tcp_bind_pop_port(cyrus_t)
corenet_tcp_bind_sieve_port(cyrus_t)
corenet_tcp_connect_all_ports(cyrus_t)
@@ -93,7 +94,6 @@ corecmd_exec_bin(cyrus_t)
domain_use_interactive_fds(cyrus_t)
files_list_var_lib(cyrus_t)
-files_read_etc_files(cyrus_t)
files_read_etc_runtime_files(cyrus_t)
files_read_usr_files(cyrus_t)
@@ -119,6 +119,10 @@ optional_policy(`
')
optional_policy(`
+ dirsrv_stream_connect(cyrus_t)
+')
+
+optional_policy(`
kerberos_keytab_template(cyrus, cyrus_t)
')
@@ -135,6 +139,7 @@ optional_policy(`
')
optional_policy(`
+ files_dontaudit_write_usr_dirs(cyrus_t)
snmp_read_snmp_var_lib_files(cyrus_t)
snmp_dontaudit_write_snmp_var_lib_files(cyrus_t)
snmp_stream_connect(cyrus_t)
diff --git a/daemontools.if b/daemontools.if
index ce3e676..0158314 100644
--- a/daemontools.if
+++ b/daemontools.if
@@ -210,3 +210,4 @@ interface(`daemontools_manage_svc',`
allow $1 svc_svc_t:file manage_file_perms;
allow $1 svc_svc_t:lnk_file { read create };
')
+
diff --git a/daemontools.te b/daemontools.te
index dcc5f1c..18c3048 100644
--- a/daemontools.te
+++ b/daemontools.te
@@ -38,7 +38,10 @@ files_type(svc_svc_t)
# multilog creates /service/*/log/status
manage_files_pattern(svc_multilog_t, svc_svc_t, svc_svc_t)
+term_write_console(svc_multilog_t)
+
init_use_fds(svc_multilog_t)
+init_dontaudit_use_script_fds(svc_multilog_t)
# writes to /var/log/*/*
logging_manage_generic_logs(svc_multilog_t)
@@ -69,6 +72,8 @@ dev_read_urand(svc_run_t)
corecmd_exec_bin(svc_run_t)
corecmd_exec_shell(svc_run_t)
+term_write_console(svc_run_t)
+
files_read_etc_files(svc_run_t)
files_read_etc_runtime_files(svc_run_t)
files_search_pids(svc_run_t)
@@ -99,12 +104,19 @@ allow svc_start_t self:unix_stream_socket create_socket_perms;
can_exec(svc_start_t, svc_start_exec_t)
+mmap_files_pattern(svc_start_t, svc_svc_t, svc_svc_t)
+
kernel_read_kernel_sysctls(svc_start_t)
kernel_read_system_state(svc_start_t)
corecmd_exec_bin(svc_start_t)
corecmd_exec_shell(svc_start_t)
+corenet_tcp_bind_generic_node(svc_start_t)
+corenet_tcp_bind_generic_port(svc_start_t)
+
+term_write_console(svc_start_t)
+
files_read_etc_files(svc_start_t)
files_read_etc_runtime_files(svc_start_t)
files_search_var(svc_start_t)
diff --git a/dante.te b/dante.te
index 9636326..a29dcaa 100644
--- a/dante.te
+++ b/dante.te
@@ -10,7 +10,7 @@ type dante_exec_t;
init_daemon_domain(dante_t, dante_exec_t)
type dante_conf_t;
-files_type(dante_conf_t)
+files_config_file(dante_conf_t)
type dante_var_run_t;
files_pid_file(dante_var_run_t)
@@ -46,7 +46,6 @@ corenet_udp_sendrecv_generic_node(dante_t)
corenet_tcp_sendrecv_all_ports(dante_t)
corenet_udp_sendrecv_all_ports(dante_t)
corenet_tcp_bind_generic_node(dante_t)
-corenet_tcp_bind_socks_port(dante_t)
dev_read_sysfs(dante_t)
diff --git a/dbadm.te b/dbadm.te
index 1875064..2adc35f 100644
--- a/dbadm.te
+++ b/dbadm.te
@@ -28,7 +28,7 @@ userdom_base_user_template(dbadm)
# database admin local policy
#
-allow dbadm_t self:capability { dac_override dac_read_search sys_ptrace };
+allow dbadm_t self:capability { dac_override dac_read_search };
files_dontaudit_search_all_dirs(dbadm_t)
files_delete_generic_locks(dbadm_t)
@@ -37,6 +37,7 @@ files_list_var(dbadm_t)
selinux_get_enforce_mode(dbadm_t)
logging_send_syslog_msg(dbadm_t)
+logging_send_audit_msgs(dbadm_t)
userdom_dontaudit_search_user_home_dirs(dbadm_t)
@@ -58,3 +59,7 @@ optional_policy(`
optional_policy(`
postgresql_admin(dbadm_t, dbadm_r)
')
+
+optional_policy(`
+ sudo_role_template(dbadm, dbadm_r, dbadm_t)
+')
diff --git a/dbskk.te b/dbskk.te
index 1445f97..f874b4d 100644
--- a/dbskk.te
+++ b/dbskk.te
@@ -60,7 +60,6 @@ dev_read_urand(dbskkd_t)
fs_getattr_xattr_fs(dbskkd_t)
-files_read_etc_files(dbskkd_t)
auth_use_nsswitch(dbskkd_t)
diff --git a/dbus.fc b/dbus.fc
index e6345ce..31f269b 100644
--- a/dbus.fc
+++ b/dbus.fc
@@ -4,6 +4,7 @@
ifdef(`distro_redhat',`
/lib/dbus-1/dbus-daemon-launch-helper -- gen_context(system_u:object_r:dbusd_exec_t,s0)
+/usr/lib/dbus-1/dbus-daemon-launch-helper -- gen_context(system_u:object_r:dbusd_exec_t,s0)
')
/usr/bin/dbus-daemon(-1)? -- gen_context(system_u:object_r:dbusd_exec_t,s0)
diff --git a/dbus.if b/dbus.if
index fb4bf82..115133d 100644
--- a/dbus.if
+++ b/dbus.if
@@ -41,9 +41,9 @@ interface(`dbus_stub',`
template(`dbus_role_template',`
gen_require(`
class dbus { send_msg acquire_svc };
-
- attribute session_bus_type;
+ attribute dbusd_unconfined, session_bus_type;
type system_dbusd_t, session_dbusd_tmp_t, dbusd_exec_t, dbusd_etc_t;
+ type $1_t;
')
##############################
@@ -52,117 +52,41 @@ template(`dbus_role_template',`
#
type $1_dbusd_t, session_bus_type;
- domain_type($1_dbusd_t)
- domain_entry_file($1_dbusd_t, dbusd_exec_t)
+ application_domain($1_dbusd_t, dbusd_exec_t)
ubac_constrained($1_dbusd_t)
role $2 types $1_dbusd_t;
+ userdom_home_manager($1_dbusd_t)
+
##############################
#
# Local policy
#
- allow $1_dbusd_t self:process { getattr sigkill signal };
- dontaudit $1_dbusd_t self:process ptrace;
- allow $1_dbusd_t self:file { getattr read write };
- allow $1_dbusd_t self:fifo_file rw_fifo_file_perms;
- allow $1_dbusd_t self:dbus { send_msg acquire_svc };
- allow $1_dbusd_t self:unix_stream_socket create_stream_socket_perms;
- allow $1_dbusd_t self:unix_dgram_socket create_socket_perms;
- allow $1_dbusd_t self:tcp_socket create_stream_socket_perms;
- allow $1_dbusd_t self:netlink_selinux_socket create_socket_perms;
-
# For connecting to the bus
allow $3 $1_dbusd_t:unix_stream_socket connectto;
# SE-DBus specific permissions
- allow $3 $1_dbusd_t:dbus { send_msg acquire_svc };
+ allow { dbusd_unconfined $3 } $1_dbusd_t:dbus { send_msg acquire_svc };
allow $3 system_dbusd_t:dbus { send_msg acquire_svc };
- allow $1_dbusd_t dbusd_etc_t:dir list_dir_perms;
- read_files_pattern($1_dbusd_t, dbusd_etc_t, dbusd_etc_t)
- read_lnk_files_pattern($1_dbusd_t, dbusd_etc_t, dbusd_etc_t)
+ domtrans_pattern($3, dbusd_exec_t, $1_dbusd_t)
- manage_dirs_pattern($1_dbusd_t, session_dbusd_tmp_t, session_dbusd_tmp_t)
- manage_files_pattern($1_dbusd_t, session_dbusd_tmp_t, session_dbusd_tmp_t)
- files_tmp_filetrans($1_dbusd_t, session_dbusd_tmp_t, { file dir })
+ ps_process_pattern($3, $1_dbusd_t)
+ allow $3 $1_dbusd_t:process signal_perms;
- domtrans_pattern($3, dbusd_exec_t, $1_dbusd_t)
- allow $3 $1_dbusd_t:process { signull sigkill signal };
+ tunable_policy(`deny_ptrace',`',`
+ allow $3 $1_dbusd_t:process ptrace;
+ ')
# cjp: this seems very broken
- corecmd_bin_domtrans($1_dbusd_t, $3)
+ corecmd_bin_domtrans($1_dbusd_t, $1_t)
+ corecmd_shell_domtrans($1_dbusd_t, $1_t)
allow $1_dbusd_t $3:process sigkill;
allow $3 $1_dbusd_t:fd use;
allow $3 $1_dbusd_t:fifo_file rw_fifo_file_perms;
- allow $3 $1_dbusd_t:process sigchld;
-
- kernel_read_system_state($1_dbusd_t)
- kernel_read_kernel_sysctls($1_dbusd_t)
-
- corecmd_list_bin($1_dbusd_t)
- corecmd_read_bin_symlinks($1_dbusd_t)
- corecmd_read_bin_files($1_dbusd_t)
- corecmd_read_bin_pipes($1_dbusd_t)
- corecmd_read_bin_sockets($1_dbusd_t)
-
- corenet_all_recvfrom_unlabeled($1_dbusd_t)
- corenet_all_recvfrom_netlabel($1_dbusd_t)
- corenet_tcp_sendrecv_generic_if($1_dbusd_t)
- corenet_tcp_sendrecv_generic_node($1_dbusd_t)
- corenet_tcp_sendrecv_all_ports($1_dbusd_t)
- corenet_tcp_bind_generic_node($1_dbusd_t)
- corenet_tcp_bind_reserved_port($1_dbusd_t)
-
- dev_read_urand($1_dbusd_t)
-
- domain_use_interactive_fds($1_dbusd_t)
- domain_read_all_domains_state($1_dbusd_t)
-
- files_read_etc_files($1_dbusd_t)
- files_list_home($1_dbusd_t)
- files_read_usr_files($1_dbusd_t)
- files_dontaudit_search_var($1_dbusd_t)
-
- fs_getattr_romfs($1_dbusd_t)
- fs_getattr_xattr_fs($1_dbusd_t)
- fs_list_inotifyfs($1_dbusd_t)
- fs_dontaudit_list_nfs($1_dbusd_t)
-
- selinux_get_fs_mount($1_dbusd_t)
- selinux_validate_context($1_dbusd_t)
- selinux_compute_access_vector($1_dbusd_t)
- selinux_compute_create_context($1_dbusd_t)
- selinux_compute_relabel_context($1_dbusd_t)
- selinux_compute_user_contexts($1_dbusd_t)
-
- auth_read_pam_console_data($1_dbusd_t)
- auth_use_nsswitch($1_dbusd_t)
-
- logging_send_audit_msgs($1_dbusd_t)
- logging_send_syslog_msg($1_dbusd_t)
-
- miscfiles_read_localization($1_dbusd_t)
-
- seutil_read_config($1_dbusd_t)
- seutil_read_default_contexts($1_dbusd_t)
-
- term_use_all_terms($1_dbusd_t)
- userdom_read_user_home_content_files($1_dbusd_t)
-
- ifdef(`hide_broken_symptoms', `
- dontaudit $3 $1_dbusd_t:netlink_selinux_socket { read write };
- ')
-
- optional_policy(`
- hal_dbus_chat($1_dbusd_t)
- ')
-
- optional_policy(`
- xserver_use_xdm_fds($1_dbusd_t)
- xserver_rw_xdm_pipes($1_dbusd_t)
- ')
+ auth_use_nsswitch($1_dbusd_t)
')
#######################################
@@ -181,11 +105,12 @@ interface(`dbus_system_bus_client',`
type system_dbusd_t, system_dbusd_t;
type system_dbusd_var_run_t, system_dbusd_var_lib_t;
class dbus send_msg;
+ attribute dbusd_unconfined;
')
# SE-DBus specific permissions
allow $1 { system_dbusd_t self }:dbus send_msg;
- allow system_dbusd_t $1:dbus send_msg;
+ allow { system_dbusd_t dbusd_unconfined } $1:dbus send_msg;
read_files_pattern($1, system_dbusd_var_lib_t, system_dbusd_var_lib_t)
files_search_var_lib($1)
@@ -198,6 +123,34 @@ interface(`dbus_system_bus_client',`
#######################################
##