## Policy for NIS (YP) servers and clients ######################################## ## ## Use the ypbind service to access NIS services ## unconditionally. ## ## ##

## Use the ypbind service to access NIS services ## unconditionally. ##

##

## This interface was added because of apache and ## spamassassin, to fix a nested conditionals problem. ## When that support is added, this should be removed, ## and the regular interface should be used. ##

##
## ## The type of the process performing this action. ## # interface(`nis_use_ypbind_uncond',` gen_require(` type var_yp_t; ') dontaudit $1 self:capability net_bind_service; allow $1 self:tcp_socket create_stream_socket_perms; allow $1 self:udp_socket create_socket_perms; allow $1 var_yp_t:dir r_dir_perms; allow $1 var_yp_t:lnk_file { getattr read }; allow $1 var_yp_t:file r_file_perms; corenet_tcp_sendrecv_all_if($1) corenet_udp_sendrecv_all_if($1) corenet_raw_sendrecv_all_if($1) corenet_tcp_sendrecv_all_nodes($1) corenet_udp_sendrecv_all_nodes($1) corenet_raw_sendrecv_all_nodes($1) corenet_tcp_sendrecv_all_ports($1) corenet_udp_sendrecv_all_ports($1) corenet_tcp_bind_all_nodes($1) corenet_udp_bind_all_nodes($1) corenet_tcp_bind_generic_port($1) corenet_udp_bind_generic_port($1) corenet_tcp_bind_reserved_port($1) corenet_udp_bind_reserved_port($1) corenet_dontaudit_tcp_bind_all_reserved_ports($1) corenet_dontaudit_udp_bind_all_reserved_ports($1) corenet_tcp_connect_portmap_port($1) corenet_tcp_connect_reserved_port($1) corenet_tcp_connect_generic_port($1) corenet_dontaudit_tcp_connect_all_reserved_ports($1) sysnet_read_config($1) ') ######################################## ## ## Use the ypbind service to access NIS services. ## ## ## The type of the process performing this action. ## # interface(`nis_use_ypbind',` gen_require(` type var_yp_t; ') tunable_policy(`allow_ypbind',` dontaudit $1 self:capability net_bind_service; allow $1 self:tcp_socket create_stream_socket_perms; allow $1 self:udp_socket create_socket_perms; allow $1 var_yp_t:dir r_dir_perms; allow $1 var_yp_t:lnk_file { getattr read }; allow $1 var_yp_t:file r_file_perms; corenet_tcp_sendrecv_all_if($1) corenet_udp_sendrecv_all_if($1) corenet_raw_sendrecv_all_if($1) corenet_tcp_sendrecv_all_nodes($1) corenet_udp_sendrecv_all_nodes($1) corenet_raw_sendrecv_all_nodes($1) corenet_tcp_sendrecv_all_ports($1) corenet_udp_sendrecv_all_ports($1) corenet_tcp_bind_all_nodes($1) corenet_udp_bind_all_nodes($1) corenet_tcp_bind_generic_port($1) corenet_udp_bind_generic_port($1) corenet_tcp_bind_reserved_port($1) corenet_udp_bind_reserved_port($1) corenet_dontaudit_tcp_bind_all_reserved_ports($1) corenet_dontaudit_udp_bind_all_reserved_ports($1) corenet_tcp_connect_portmap_port($1) corenet_tcp_connect_reserved_port($1) corenet_tcp_connect_generic_port($1) corenet_dontaudit_tcp_connect_all_reserved_ports($1) sysnet_read_config($1) ',` dontaudit $1 var_yp_t:dir search; ') optional_policy(`mount.te',` tunable_policy(`allow_ypbind',` mount_send_nfs_client_request($1) ') ') ') ######################################## ## ## Send generic signals to ypbind. ## ## ## The type of the process performing this action. ## # interface(`nis_signal_ypbind',` gen_require(` type ypbind_t; ') allow $1 ypbind_t:process signal; ') ######################################## ## ## Send UDP network traffic to NIS clients. ## ## ## The type of the process performing this action. ## # interface(`nis_list_var_yp',` gen_require(` type var_yp_t; ') files_search_var($1) allow $1 var_yp_t:dir r_dir_perms; ') ######################################## ## ## Send UDP network traffic to NIS clients. ## ## ## The type of the process performing this action. ## # interface(`nis_udp_sendto_ypbind',` gen_require(` type ypbind_t; ') allow $1 ypbind_t:udp_socket sendto; allow ypbind_t $1:udp_socket recvfrom; ')