## <summary>Policy for the RPM package manager.</summary> ######################################## ## <summary> ## Execute rpm programs in the rpm domain. ## </summary> ## <param name="domain"> ## <summary> ## The type of the process performing this action. ## </summary> ## </param> # interface(`rpm_domtrans',` gen_require(` type rpm_t, rpm_exec_t; ') files_search_usr($1) corecmd_search_bin($1) domain_auto_trans($1,rpm_exec_t,rpm_t) allow $1 rpm_t:fd use; allow rpm_t $1:fd use; allow rpm_t $1:fifo_file rw_file_perms; allow rpm_t $1:process sigchld; ') ######################################## ## <summary> ## Execute rpm_script programs in the rpm_script domain. ## </summary> ## <param name="domain"> ## <summary> ## Domain allowed access. ## </summary> ## </param> # interface(`rpm_domtrans_script',` gen_require(` type rpm_script_t; ') # transition to rpm script: corecmd_shell_domtrans($1,rpm_script_t) allow $1 rpm_script_t:fd use; allow rpm_script_t $1:fd use; allow rpm_script_t $1:fifo_file rw_file_perms; allow rpm_script_t $1:process sigchld; ') ######################################## ## <summary> ## Execute RPM programs in the RPM domain. ## </summary> ## <param name="domain"> ## <summary> ## The type of the process performing this action. ## </summary> ## </param> ## <param name="role"> ## <summary> ## The role to allow the RPM domain. ## </summary> ## </param> ## <param name="terminal"> ## <summary> ## The type of the terminal allow the RPM domain to use. ## </summary> ## </param> # interface(`rpm_run',` gen_require(` type rpm_t, rpm_script_t; ') rpm_domtrans($1) role $2 types rpm_t; role $2 types rpm_script_t; seutil_run_loadpolicy(rpm_script_t,$2,$3) seutil_run_semanage(rpm_script_t,$2,$3) seutil_run_setfiles(rpm_script_t,$2,$3) seutil_run_restorecon(rpm_script_t,$2,$3) allow rpm_t $3:chr_file rw_term_perms; ') ######################################## ## <summary> ## Inherit and use file descriptors from RPM. ## </summary> ## <param name="domain"> ## <summary> ## The type of the process performing this action. ## </summary> ## </param> # interface(`rpm_use_fds',` gen_require(` type rpm_t; ') allow $1 rpm_t:fd use; ') ######################################## ## <summary> ## Read from an unnamed RPM pipe. ## </summary> ## <param name="domain"> ## <summary> ## The type of the process performing this action. ## </summary> ## </param> # interface(`rpm_read_pipes',` gen_require(` type rpm_t; ') allow $1 rpm_t:fifo_file r_file_perms; ') ######################################## ## <summary> ## Read and write an unnamed RPM pipe. ## </summary> ## <param name="domain"> ## <summary> ## The type of the process performing this action. ## </summary> ## </param> # interface(`rpm_rw_pipes',` gen_require(` type rpm_t; ') allow $1 rpm_t:fifo_file rw_file_perms; ') ######################################## ## <summary> ## Create, read, write, and delete the RPM log. ## </summary> ## <param name="domain"> ## <summary> ## The type of the process performing this action. ## </summary> ## </param> # interface(`rpm_manage_log',` gen_require(` type rpm_log_t; ') logging_rw_generic_log_dirs($1) allow $1 rpm_log_t:file create_file_perms; ') ######################################## ## <summary> ## Inherit and use file descriptors from RPM scripts. ## </summary> ## <param name="domain"> ## <summary> ## The type of the process performing this action. ## </summary> ## </param> # interface(`rpm_use_script_fds',` gen_require(` type rpm_script_t; ') allow $1 rpm_script_t:fd use; ') ######################################## ## <summary> ## Read the RPM package database. ## </summary> ## <param name="domain"> ## <summary> ## The type of the process performing this action. ## </summary> ## </param> # interface(`rpm_read_db',` gen_require(` type rpm_var_lib_t; ') files_search_var_lib($1) allow $1 rpm_var_lib_t:dir r_dir_perms; allow $1 rpm_var_lib_t:file { getattr read }; allow $1 rpm_var_lib_t:lnk_file r_file_perms; ') ######################################## ## <summary> ## Create, read, write, and delete the RPM package database. ## </summary> ## <param name="domain"> ## <summary> ## The type of the process performing this action. ## </summary> ## </param> # interface(`rpm_manage_db',` gen_require(` type rpm_var_lib_t; ') files_search_var_lib($1) allow $1 rpm_var_lib_t:dir rw_dir_perms; allow $1 rpm_var_lib_t:file { getattr create read write append unlink }; allow $1 rpm_var_lib_t:lnk_file { getattr read write unlink }; ') ######################################## ## <summary> ## Do not audit attempts to create, read, ## write, and delete the RPM package database. ## </summary> ## <param name="domain"> ## <summary> ## Domain to not audit. ## </summary> ## </param> # interface(`rpm_dontaudit_manage_db',` gen_require(` type rpm_var_lib_t; ') dontaudit $1 rpm_var_lib_t:dir rw_dir_perms; dontaudit $1 rpm_var_lib_t:file create_file_perms; dontaudit $1 rpm_var_lib_t:lnk_file create_lnk_perms; ')