## <summary>Policy for NIS (YP) servers and clients</summary> ######################################## ## <summary> ## Use the ypbind service to access NIS services ## unconditionally. ## </summary> ## <desc> ## <p> ## Use the ypbind service to access NIS services ## unconditionally. ## </p> ## <p> ## This interface was added because of apache and ## spamassassin, to fix a nested conditionals problem. ## When that support is added, this should be removed, ## and the regular interface should be used. ## </p> ## </desc> ## <param name="domain"> ## <summary> ## The type of the process performing this action. ## </summary> ## </param> # interface(`nis_use_ypbind_uncond',` gen_require(` type var_yp_t; ') dontaudit $1 self:capability net_bind_service; allow $1 self:tcp_socket create_stream_socket_perms; allow $1 self:udp_socket create_socket_perms; allow $1 var_yp_t:dir r_dir_perms; allow $1 var_yp_t:lnk_file { getattr read }; allow $1 var_yp_t:file r_file_perms; corenet_non_ipsec_sendrecv($1) corenet_tcp_sendrecv_all_if($1) corenet_udp_sendrecv_all_if($1) corenet_tcp_sendrecv_all_nodes($1) corenet_udp_sendrecv_all_nodes($1) corenet_tcp_sendrecv_all_ports($1) corenet_udp_sendrecv_all_ports($1) corenet_tcp_bind_all_nodes($1) corenet_udp_bind_all_nodes($1) corenet_tcp_bind_generic_port($1) corenet_udp_bind_generic_port($1) corenet_tcp_bind_reserved_port($1) corenet_udp_bind_reserved_port($1) corenet_dontaudit_tcp_bind_all_reserved_ports($1) corenet_dontaudit_udp_bind_all_reserved_ports($1) corenet_tcp_connect_portmap_port($1) corenet_tcp_connect_reserved_port($1) corenet_tcp_connect_generic_port($1) corenet_dontaudit_tcp_connect_all_reserved_ports($1) corenet_sendrecv_portmap_client_packets($1) corenet_sendrecv_generic_client_packets($1) corenet_sendrecv_generic_server_packets($1) sysnet_read_config($1) ') ######################################## ## <summary> ## Use the ypbind service to access NIS services. ## </summary> ## <param name="domain"> ## <summary> ## The type of the process performing this action. ## </summary> ## </param> # interface(`nis_use_ypbind',` gen_require(` type var_yp_t; ') tunable_policy(`allow_ypbind',` nis_use_ypbind_uncond($1) ',` dontaudit $1 var_yp_t:dir search; ') ') ######################################## ## <summary> ## Execute ypbind in the ypbind domain. ## </summary> ## <param name="domain"> ## <summary> ## Domain allowed access. ## </summary> ## </param> # interface(`nis_domtrans_ypbind',` gen_require(` type ypbind_t, ypbind_exec_t; ') corecmd_search_bin($1) domain_auto_trans($1,ypbind_exec_t,ypbind_t) allow $1 ypbind_t:fd use; allow ypbind_t $1:fd use; allow ypbind_t $1:fifo_file rw_file_perms; allow ypbind_t $1:process sigchld; ') ######################################## ## <summary> ## Send generic signals to ypbind. ## </summary> ## <param name="domain"> ## <summary> ## The type of the process performing this action. ## </summary> ## </param> # interface(`nis_signal_ypbind',` gen_require(` type ypbind_t; ') allow $1 ypbind_t:process signal; ') ######################################## ## <summary> ## List the contents of the NIS data directory. ## </summary> ## <param name="domain"> ## <summary> ## The type of the process performing this action. ## </summary> ## </param> # interface(`nis_list_var_yp',` gen_require(` type var_yp_t; ') files_search_var($1) allow $1 var_yp_t:dir r_dir_perms; ') ######################################## ## <summary> ## Send UDP network traffic to NIS clients. ## </summary> ## <param name="domain"> ## <summary> ## The type of the process performing this action. ## </summary> ## </param> # interface(`nis_udp_send_ypbind',` gen_require(` type ypbind_t; ') allow $1 ypbind_t:udp_socket sendto; allow ypbind_t $1:udp_socket recvfrom; ') ######################################## ## <summary> ## Connect to ypbind over TCP. ## </summary> ## <param name="domain"> ## <summary> ## Domain allowed access. ## </summary> ## </param> # interface(`nis_tcp_connect_ypbind',` gen_require(` type ypbind_t; ') allow $1 ypbind_t:tcp_socket { connectto recvfrom }; allow ypbind_t $1:tcp_socket { acceptfrom recvfrom }; kernel_tcp_recvfrom($1) ') ######################################## ## <summary> ## Read ypbind pid files. ## </summary> ## <param name="domain"> ## <summary> ## Domain allowed access. ## </summary> ## </param> # interface(`nis_read_ypbind_pid',` gen_require(` type ypbind_var_run_t; ') files_search_pids($1) allow $1 ypbind_var_run_t:file r_file_perms; ') ######################################## ## <summary> ## Delete ypbind pid files. ## </summary> ## <param name="domain"> ## <summary> ## Domain allowed access. ## </summary> ## </param> # interface(`nis_delete_ypbind_pid',` gen_require(` type ypbind_t; ') # TODO: add delete pid from dir call to files allow $1 ypbind_t:file unlink; ') ######################################## ## <summary> ## Read ypserv configuration files. ## </summary> ## <param name="domain"> ## <summary> ## Domain allowed access. ## </summary> ## </param> # interface(`nis_read_ypserv_config',` gen_require(` type ypserv_conf_t; ') files_search_etc($1) allow $1 ypserv_conf_t:file { getattr read }; ') ######################################## ## <summary> ## Execute ypxfr in the ypxfr domain. ## </summary> ## <param name="domain"> ## <summary> ## Domain allowed access. ## </summary> ## </param> # interface(`nis_domtrans_ypxfr',` gen_require(` type ypxfr_t, ypxfr_exec_t; ') corecmd_search_bin($1) domain_auto_trans($1,ypxfr_exec_t,ypxfr_t) allow $1 ypxfr_t:fd use; allow ypxfr_t $1:fd use; allow ypxfr_t $1:fifo_file rw_file_perms; allow ypxfr_t $1:process sigchld; ')