1900668638
The latest revision of the labeled policy patches which enable both labeled and unlabeled policy support for NetLabel. This revision takes into account Chris' feedback from the first version and reduces the number of interface calls in each domain down to two at present: one for unlabeled access, one for NetLabel access. The older, transport layer specific interfaces, are still present for use by third-party modules but are not used in the default policy modules. trunk: Use netmsg initial SID for MLS-only Netlabel packets, from Paul Moore. This patch changes the policy to use the netmsg initial SID as the "base" SID/context for NetLabel packets which only have MLS security attributes. Currently we use the unlabeled initial SID which makes it very difficult to distinquish between actual unlabeled packets and those packets which have MLS security attributes.
713 lines
19 KiB
Plaintext
713 lines
19 KiB
Plaintext
|
|
policy_module(cups,1.6.2)
|
|
|
|
########################################
|
|
#
|
|
# Declarations
|
|
#
|
|
|
|
type cupsd_config_t;
|
|
type cupsd_config_exec_t;
|
|
init_daemon_domain(cupsd_config_t,cupsd_config_exec_t)
|
|
|
|
type cupsd_config_var_run_t;
|
|
files_pid_file(cupsd_config_var_run_t)
|
|
|
|
type cupsd_t;
|
|
type cupsd_exec_t;
|
|
init_daemon_domain(cupsd_t,cupsd_exec_t)
|
|
|
|
type cupsd_etc_t;
|
|
files_config_file(cupsd_etc_t)
|
|
|
|
type cupsd_rw_etc_t;
|
|
files_config_file(cupsd_rw_etc_t)
|
|
|
|
type cupsd_log_t;
|
|
logging_log_file(cupsd_log_t)
|
|
|
|
type cupsd_lpd_t;
|
|
type cupsd_lpd_exec_t;
|
|
domain_type(cupsd_lpd_t)
|
|
domain_entry_file(cupsd_lpd_t,cupsd_lpd_exec_t)
|
|
role system_r types cupsd_lpd_t;
|
|
|
|
type cupsd_lpd_tmp_t;
|
|
files_tmp_file(cupsd_lpd_tmp_t)
|
|
|
|
type cupsd_lpd_var_run_t;
|
|
files_pid_file(cupsd_lpd_var_run_t)
|
|
|
|
type cupsd_tmp_t;
|
|
files_tmp_file(cupsd_tmp_t)
|
|
|
|
type cupsd_var_run_t;
|
|
files_pid_file(cupsd_var_run_t)
|
|
mls_trusted_object(cupsd_var_run_t)
|
|
|
|
type hplip_t;
|
|
type hplip_exec_t;
|
|
init_daemon_domain(hplip_t,hplip_exec_t)
|
|
|
|
type hplip_etc_t;
|
|
files_config_file(hplip_etc_t)
|
|
|
|
type hplip_var_run_t;
|
|
files_pid_file(hplip_var_run_t)
|
|
|
|
type ptal_t;
|
|
type ptal_exec_t;
|
|
init_daemon_domain(ptal_t,ptal_exec_t)
|
|
|
|
type ptal_etc_t;
|
|
files_config_file(ptal_etc_t)
|
|
|
|
type ptal_var_run_t;
|
|
files_pid_file(ptal_var_run_t)
|
|
|
|
ifdef(`enable_mcs',`
|
|
init_ranged_daemon_domain(cupsd_t,cupsd_exec_t,s0 - mcs_systemhigh)
|
|
')
|
|
|
|
ifdef(`enable_mls',`
|
|
init_ranged_daemon_domain(cupsd_t,cupsd_exec_t,mls_systemhigh)
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# Cups local policy
|
|
#
|
|
|
|
# /usr/lib/cups/backend/serial needs sys_admin(?!)
|
|
allow cupsd_t self:capability { sys_admin dac_override dac_read_search kill setgid setuid fsetid net_bind_service fowner chown dac_override sys_resource sys_tty_config };
|
|
dontaudit cupsd_t self:capability { sys_tty_config net_admin };
|
|
allow cupsd_t self:process { setsched signal_perms };
|
|
allow cupsd_t self:fifo_file rw_file_perms;
|
|
allow cupsd_t self:unix_stream_socket { create_stream_socket_perms connectto };
|
|
allow cupsd_t self:unix_dgram_socket create_socket_perms;
|
|
allow cupsd_t self:netlink_selinux_socket create_socket_perms;
|
|
allow cupsd_t self:netlink_route_socket r_netlink_socket_perms;
|
|
allow cupsd_t self:tcp_socket create_stream_socket_perms;
|
|
allow cupsd_t self:udp_socket create_socket_perms;
|
|
allow cupsd_t self:appletalk_socket create_socket_perms;
|
|
# generic socket here until appletalk socket is available in kernels
|
|
allow cupsd_t self:socket create_socket_perms;
|
|
|
|
allow cupsd_t cupsd_etc_t:{ dir file } setattr;
|
|
read_files_pattern(cupsd_t,cupsd_etc_t,cupsd_etc_t)
|
|
read_lnk_files_pattern(cupsd_t,cupsd_etc_t,cupsd_etc_t)
|
|
files_search_etc(cupsd_t)
|
|
|
|
manage_dirs_pattern(cupsd_t,cupsd_etc_t,cupsd_rw_etc_t)
|
|
manage_files_pattern(cupsd_t,cupsd_etc_t,cupsd_rw_etc_t)
|
|
filetrans_pattern(cupsd_t,cupsd_etc_t,cupsd_rw_etc_t,file)
|
|
files_var_filetrans(cupsd_t,cupsd_rw_etc_t,{ dir file })
|
|
|
|
# allow cups to execute its backend scripts
|
|
can_exec(cupsd_t, cupsd_exec_t)
|
|
allow cupsd_t cupsd_exec_t:dir search;
|
|
allow cupsd_t cupsd_exec_t:lnk_file read;
|
|
|
|
manage_files_pattern(cupsd_t,cupsd_log_t,cupsd_log_t)
|
|
allow cupsd_t cupsd_log_t:dir setattr;
|
|
logging_log_filetrans(cupsd_t,cupsd_log_t,{ file dir })
|
|
|
|
manage_dirs_pattern(cupsd_t,cupsd_tmp_t,cupsd_tmp_t)
|
|
manage_files_pattern(cupsd_t,cupsd_tmp_t,cupsd_tmp_t)
|
|
manage_fifo_files_pattern(cupsd_t,cupsd_tmp_t,cupsd_tmp_t)
|
|
files_tmp_filetrans(cupsd_t, cupsd_tmp_t, { file dir fifo_file })
|
|
|
|
allow cupsd_t cupsd_var_run_t:dir setattr;
|
|
manage_files_pattern(cupsd_t,cupsd_var_run_t,cupsd_var_run_t)
|
|
manage_sock_files_pattern(cupsd_t,cupsd_var_run_t,cupsd_var_run_t)
|
|
files_pid_filetrans(cupsd_t,cupsd_var_run_t,file)
|
|
|
|
read_files_pattern(cupsd_t,hplip_etc_t,hplip_etc_t)
|
|
|
|
allow cupsd_t hplip_var_run_t:file { read getattr };
|
|
|
|
stream_connect_pattern(cupsd_t,ptal_var_run_t,ptal_var_run_t,ptal_t)
|
|
allow cupsd_t ptal_var_run_t : sock_file setattr;
|
|
|
|
kernel_read_system_state(cupsd_t)
|
|
kernel_read_network_state(cupsd_t)
|
|
kernel_read_all_sysctls(cupsd_t)
|
|
|
|
corenet_all_recvfrom_unlabeled(cupsd_t)
|
|
corenet_all_recvfrom_netlabel(cupsd_t)
|
|
corenet_tcp_sendrecv_all_if(cupsd_t)
|
|
corenet_udp_sendrecv_all_if(cupsd_t)
|
|
corenet_raw_sendrecv_all_if(cupsd_t)
|
|
corenet_tcp_sendrecv_all_nodes(cupsd_t)
|
|
corenet_udp_sendrecv_all_nodes(cupsd_t)
|
|
corenet_raw_sendrecv_all_nodes(cupsd_t)
|
|
corenet_tcp_sendrecv_all_ports(cupsd_t)
|
|
corenet_udp_sendrecv_all_ports(cupsd_t)
|
|
corenet_tcp_bind_all_nodes(cupsd_t)
|
|
corenet_udp_bind_all_nodes(cupsd_t)
|
|
corenet_tcp_bind_ipp_port(cupsd_t)
|
|
corenet_udp_bind_ipp_port(cupsd_t)
|
|
corenet_tcp_bind_reserved_port(cupsd_t)
|
|
corenet_dontaudit_tcp_bind_all_reserved_ports(cupsd_t)
|
|
corenet_tcp_connect_all_ports(cupsd_t)
|
|
corenet_sendrecv_hplip_client_packets(cupsd_t)
|
|
corenet_sendrecv_ipp_client_packets(cupsd_t)
|
|
corenet_sendrecv_ipp_server_packets(cupsd_t)
|
|
|
|
dev_rw_printer(cupsd_t)
|
|
dev_read_urand(cupsd_t)
|
|
dev_read_sysfs(cupsd_t)
|
|
dev_read_usbfs(cupsd_t)
|
|
dev_getattr_printer_dev(cupsd_t)
|
|
|
|
domain_read_all_domains_state(cupsd_t)
|
|
|
|
fs_getattr_all_fs(cupsd_t)
|
|
fs_search_auto_mountpoints(cupsd_t)
|
|
|
|
mls_fd_use_all_levels(cupsd_t)
|
|
mls_file_downgrade(cupsd_t)
|
|
mls_file_write_down(cupsd_t)
|
|
mls_file_read_up(cupsd_t)
|
|
mls_rangetrans_target(cupsd_t)
|
|
mls_socket_write_all_levels(cupsd_t)
|
|
|
|
term_use_unallocated_ttys(cupsd_t)
|
|
term_search_ptys(cupsd_t)
|
|
|
|
auth_domtrans_chk_passwd(cupsd_t)
|
|
auth_dontaudit_read_pam_pid(cupsd_t)
|
|
|
|
# Filter scripts may be shell scripts, and may invoke progs like /bin/mktemp
|
|
corecmd_exec_shell(cupsd_t)
|
|
corecmd_exec_bin(cupsd_t)
|
|
|
|
domain_use_interactive_fds(cupsd_t)
|
|
|
|
files_read_etc_files(cupsd_t)
|
|
files_read_etc_runtime_files(cupsd_t)
|
|
# read python modules
|
|
files_read_usr_files(cupsd_t)
|
|
# for /var/lib/defoma
|
|
files_search_var_lib(cupsd_t)
|
|
files_list_world_readable(cupsd_t)
|
|
files_read_world_readable_files(cupsd_t)
|
|
files_read_world_readable_symlinks(cupsd_t)
|
|
# Satisfy readahead
|
|
files_read_var_files(cupsd_t)
|
|
files_read_var_symlinks(cupsd_t)
|
|
# for /etc/printcap
|
|
files_dontaudit_write_etc_files(cupsd_t)
|
|
# smbspool seems to be iterating through all existing tmp files.
|
|
# redhat bug #214953
|
|
# cjp: this might be a broken behavior
|
|
files_dontaudit_getattr_all_tmp_files(cupsd_t)
|
|
|
|
selinux_compute_access_vector(cupsd_t)
|
|
|
|
init_exec_script_files(cupsd_t)
|
|
|
|
libs_use_ld_so(cupsd_t)
|
|
libs_use_shared_libs(cupsd_t)
|
|
# Read /usr/lib/gconv/gconv-modules.* and /usr/lib/python2.2/.*
|
|
libs_read_lib_files(cupsd_t)
|
|
|
|
logging_send_audit_msgs(cupsd_t)
|
|
logging_send_syslog_msg(cupsd_t)
|
|
|
|
miscfiles_read_localization(cupsd_t)
|
|
# invoking ghostscript needs to read fonts
|
|
miscfiles_read_fonts(cupsd_t)
|
|
|
|
seutil_read_config(cupsd_t)
|
|
|
|
sysnet_read_config(cupsd_t)
|
|
|
|
userdom_dontaudit_use_unpriv_user_fds(cupsd_t)
|
|
userdom_dontaudit_search_all_users_home_content(cupsd_t)
|
|
|
|
# Write to /var/spool/cups.
|
|
lpd_manage_spool(cupsd_t)
|
|
|
|
ifdef(`enable_mls',`
|
|
lpd_relabel_spool(cupsd_t)
|
|
')
|
|
|
|
ifdef(`targeted_policy',`
|
|
files_dontaudit_read_root_files(cupsd_t)
|
|
|
|
term_dontaudit_use_unallocated_ttys(cupsd_t)
|
|
term_dontaudit_use_generic_ptys(cupsd_t)
|
|
|
|
init_stream_connect_script(cupsd_t)
|
|
|
|
unconfined_rw_pipes(cupsd_t)
|
|
|
|
optional_policy(`
|
|
init_dbus_chat_script(cupsd_t)
|
|
|
|
unconfined_dbus_send(cupsd_t)
|
|
|
|
dbus_stub(cupsd_t)
|
|
')
|
|
')
|
|
|
|
optional_policy(`
|
|
apm_domtrans_client(cupsd_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
cron_system_entry(cupsd_t, cupsd_exec_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
dbus_system_bus_client_template(cupsd,cupsd_t)
|
|
dbus_send_system_bus(cupsd_t)
|
|
|
|
userdom_dbus_send_all_users(cupsd_t)
|
|
|
|
optional_policy(`
|
|
hal_dbus_chat(cupsd_t)
|
|
')
|
|
')
|
|
|
|
optional_policy(`
|
|
hostname_exec(cupsd_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
inetd_core_service_domain(cupsd_t,cupsd_exec_t,cupsd_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
logrotate_domtrans(cupsd_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
nscd_socket_use(cupsd_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
# cups execs smbtool which reads samba_etc_t files
|
|
samba_read_config(cupsd_t)
|
|
samba_rw_var_files(cupsd_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
seutil_sigchld_newrole(cupsd_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
udev_read_db(cupsd_t)
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# Cups configuration daemon local policy
|
|
#
|
|
|
|
allow cupsd_config_t self:capability { chown sys_tty_config };
|
|
dontaudit cupsd_config_t self:capability sys_tty_config;
|
|
allow cupsd_config_t self:process signal_perms;
|
|
allow cupsd_config_t self:fifo_file rw_fifo_file_perms;
|
|
allow cupsd_config_t self:unix_stream_socket create_socket_perms;
|
|
allow cupsd_config_t self:unix_dgram_socket create_socket_perms;
|
|
allow cupsd_config_t self:tcp_socket create_stream_socket_perms;
|
|
allow cupsd_config_t self:netlink_route_socket r_netlink_socket_perms;
|
|
|
|
allow cupsd_config_t cupsd_t:process signal;
|
|
ps_process_pattern(cupsd_config_t,cupsd_t)
|
|
|
|
manage_files_pattern(cupsd_config_t,cupsd_etc_t,cupsd_etc_t)
|
|
manage_lnk_files_pattern(cupsd_config_t,cupsd_etc_t,cupsd_etc_t)
|
|
filetrans_pattern(cupsd_config_t,cupsd_etc_t,cupsd_rw_etc_t,file)
|
|
|
|
manage_files_pattern(cupsd_config_t,cupsd_rw_etc_t,cupsd_rw_etc_t)
|
|
manage_lnk_files_pattern(cupsd_config_t,cupsd_rw_etc_t,cupsd_rw_etc_t)
|
|
files_var_filetrans(cupsd_config_t,cupsd_rw_etc_t,file)
|
|
|
|
can_exec(cupsd_config_t, cupsd_config_exec_t)
|
|
|
|
allow cupsd_config_t cupsd_log_t:file rw_file_perms;
|
|
|
|
allow cupsd_config_t cupsd_tmp_t:file manage_file_perms;
|
|
files_tmp_filetrans(cupsd_config_t, cupsd_tmp_t, { file dir })
|
|
|
|
allow cupsd_config_t cupsd_var_run_t:file { getattr read };
|
|
|
|
manage_files_pattern(cupsd_config_t,cupsd_config_var_run_t,cupsd_config_var_run_t)
|
|
files_pid_filetrans(cupsd_config_t,cupsd_config_var_run_t,file)
|
|
|
|
kernel_read_system_state(cupsd_config_t)
|
|
kernel_read_kernel_sysctls(cupsd_config_t)
|
|
|
|
corenet_all_recvfrom_unlabeled(cupsd_config_t)
|
|
corenet_all_recvfrom_netlabel(cupsd_config_t)
|
|
corenet_tcp_sendrecv_all_if(cupsd_config_t)
|
|
corenet_tcp_sendrecv_all_nodes(cupsd_config_t)
|
|
corenet_tcp_sendrecv_all_ports(cupsd_config_t)
|
|
corenet_tcp_connect_all_ports(cupsd_config_t)
|
|
corenet_sendrecv_all_client_packets(cupsd_config_t)
|
|
|
|
dev_read_sysfs(cupsd_config_t)
|
|
dev_read_urand(cupsd_config_t)
|
|
dev_read_rand(cupsd_config_t)
|
|
|
|
fs_getattr_all_fs(cupsd_config_t)
|
|
fs_search_auto_mountpoints(cupsd_config_t)
|
|
|
|
corecmd_exec_bin(cupsd_config_t)
|
|
corecmd_exec_shell(cupsd_config_t)
|
|
|
|
domain_use_interactive_fds(cupsd_config_t)
|
|
# killall causes the following
|
|
domain_dontaudit_search_all_domains_state(cupsd_config_t)
|
|
|
|
files_read_usr_files(cupsd_config_t)
|
|
files_read_etc_files(cupsd_config_t)
|
|
files_read_etc_runtime_files(cupsd_config_t)
|
|
files_read_var_symlinks(cupsd_config_t)
|
|
|
|
# Alternatives asks for this
|
|
init_getattr_script_files(cupsd_config_t)
|
|
|
|
libs_use_ld_so(cupsd_config_t)
|
|
libs_use_shared_libs(cupsd_config_t)
|
|
|
|
logging_send_syslog_msg(cupsd_config_t)
|
|
|
|
miscfiles_read_localization(cupsd_config_t)
|
|
|
|
seutil_dontaudit_search_config(cupsd_config_t)
|
|
|
|
sysnet_read_config(cupsd_config_t)
|
|
|
|
userdom_dontaudit_use_unpriv_user_fds(cupsd_config_t)
|
|
userdom_dontaudit_search_sysadm_home_dirs(cupsd_config_t)
|
|
|
|
lpd_read_config(cupsd_config_t)
|
|
|
|
cups_stream_connect(cupsd_config_t)
|
|
|
|
ifdef(`distro_redhat',`
|
|
init_getattr_script_files(cupsd_config_t)
|
|
|
|
optional_policy(`
|
|
rpm_read_db(cupsd_config_t)
|
|
')
|
|
')
|
|
|
|
ifdef(`targeted_policy',`
|
|
files_dontaudit_read_root_files(cupsd_config_t)
|
|
|
|
term_dontaudit_use_unallocated_ttys(cupsd_config_t)
|
|
term_use_generic_ptys(cupsd_config_t)
|
|
|
|
unconfined_rw_pipes(cupsd_config_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
cron_system_entry(cupsd_config_t, cupsd_config_exec_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
dbus_system_bus_client_template(cupsd_config,cupsd_config_t)
|
|
dbus_connect_system_bus(cupsd_config_t)
|
|
dbus_send_system_bus(cupsd_config_t)
|
|
|
|
optional_policy(`
|
|
hal_dbus_chat(cupsd_config_t)
|
|
')
|
|
')
|
|
|
|
optional_policy(`
|
|
hal_domtrans(cupsd_config_t)
|
|
hal_read_tmp_files(cupsd_config_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
hostname_exec(cupsd_config_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
logrotate_use_fds(cupsd_config_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
nis_use_ypbind(cupsd_config_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
nscd_socket_use(cupsd_config_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
rpm_read_db(cupsd_config_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
seutil_sigchld_newrole(cupsd_config_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
udev_read_db(cupsd_config_t)
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# Cups lpd support
|
|
#
|
|
|
|
allow cupsd_lpd_t self:process signal_perms;
|
|
allow cupsd_lpd_t self:fifo_file rw_fifo_file_perms;
|
|
allow cupsd_lpd_t self:tcp_socket connected_stream_socket_perms;
|
|
allow cupsd_lpd_t self:udp_socket create_socket_perms;
|
|
allow cupsd_lpd_t self:netlink_route_socket r_netlink_socket_perms;
|
|
|
|
# for identd
|
|
# cjp: this should probably only be inetd_child rules?
|
|
allow cupsd_lpd_t self:netlink_tcpdiag_socket r_netlink_socket_perms;
|
|
allow cupsd_lpd_t self:capability { setuid setgid };
|
|
files_search_home(cupsd_lpd_t)
|
|
optional_policy(`
|
|
kerberos_use(cupsd_lpd_t)
|
|
')
|
|
#end for identd
|
|
|
|
allow cupsd_lpd_t cupsd_etc_t:dir list_dir_perms;
|
|
read_files_pattern(cupsd_lpd_t,cupsd_etc_t,cupsd_etc_t)
|
|
read_lnk_files_pattern(cupsd_lpd_t,cupsd_etc_t,cupsd_etc_t)
|
|
|
|
allow cupsd_lpd_t cupsd_rw_etc_t:dir list_dir_perms;
|
|
read_files_pattern(cupsd_lpd_t,cupsd_rw_etc_t,cupsd_rw_etc_t)
|
|
read_lnk_files_pattern(cupsd_lpd_t,cupsd_rw_etc_t,cupsd_rw_etc_t)
|
|
|
|
manage_dirs_pattern(cupsd_lpd_t,cupsd_lpd_tmp_t,cupsd_lpd_tmp_t)
|
|
manage_files_pattern(cupsd_lpd_t,cupsd_lpd_tmp_t,cupsd_lpd_tmp_t)
|
|
files_tmp_filetrans(cupsd_lpd_t, cupsd_lpd_tmp_t, { file dir })
|
|
|
|
manage_files_pattern(cupsd_lpd_t,cupsd_lpd_var_run_t,cupsd_lpd_var_run_t)
|
|
files_pid_filetrans(cupsd_lpd_t,cupsd_lpd_var_run_t,file)
|
|
|
|
kernel_read_kernel_sysctls(cupsd_lpd_t)
|
|
kernel_read_system_state(cupsd_lpd_t)
|
|
kernel_read_network_state(cupsd_lpd_t)
|
|
|
|
corenet_all_recvfrom_unlabeled(cupsd_lpd_t)
|
|
corenet_all_recvfrom_netlabel(cupsd_lpd_t)
|
|
corenet_tcp_sendrecv_all_if(cupsd_lpd_t)
|
|
corenet_udp_sendrecv_all_if(cupsd_lpd_t)
|
|
corenet_tcp_sendrecv_all_nodes(cupsd_lpd_t)
|
|
corenet_udp_sendrecv_all_nodes(cupsd_lpd_t)
|
|
corenet_tcp_sendrecv_all_ports(cupsd_lpd_t)
|
|
corenet_udp_sendrecv_all_ports(cupsd_lpd_t)
|
|
corenet_tcp_bind_all_nodes(cupsd_lpd_t)
|
|
corenet_udp_bind_all_nodes(cupsd_lpd_t)
|
|
corenet_tcp_connect_ipp_port(cupsd_lpd_t)
|
|
|
|
dev_read_urand(cupsd_lpd_t)
|
|
dev_read_rand(cupsd_lpd_t)
|
|
|
|
fs_getattr_xattr_fs(cupsd_lpd_t)
|
|
|
|
files_read_etc_files(cupsd_lpd_t)
|
|
|
|
libs_use_ld_so(cupsd_lpd_t)
|
|
libs_use_shared_libs(cupsd_lpd_t)
|
|
|
|
logging_send_syslog_msg(cupsd_lpd_t)
|
|
|
|
miscfiles_read_localization(cupsd_lpd_t)
|
|
|
|
sysnet_read_config(cupsd_lpd_t)
|
|
|
|
cups_stream_connect(cupsd_lpd_t)
|
|
|
|
optional_policy(`
|
|
inetd_service_domain(cupsd_lpd_t,cupsd_lpd_exec_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
nis_use_ypbind(cupsd_lpd_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
nscd_socket_use(cupsd_lpd_t)
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# HPLIP local policy
|
|
#
|
|
|
|
# Needed for USB Scanneer and xsane
|
|
allow hplip_t self:capability { dac_override dac_read_search net_raw };
|
|
dontaudit hplip_t self:capability sys_tty_config;
|
|
allow hplip_t self:fifo_file rw_fifo_file_perms;
|
|
allow hplip_t self:process signal_perms;
|
|
allow hplip_t self:unix_dgram_socket create_socket_perms;
|
|
allow hplip_t self:unix_stream_socket create_socket_perms;
|
|
allow hplip_t self:netlink_route_socket r_netlink_socket_perms;
|
|
allow hplip_t self:tcp_socket create_stream_socket_perms;
|
|
allow hplip_t self:udp_socket create_socket_perms;
|
|
allow hplip_t self:rawip_socket create_socket_perms;
|
|
|
|
allow hplip_t cupsd_etc_t:dir search;
|
|
|
|
cups_stream_connect(hplip_t)
|
|
|
|
allow hplip_t hplip_etc_t:dir list_dir_perms;
|
|
read_files_pattern(hplip_t,hplip_etc_t,hplip_etc_t)
|
|
read_lnk_files_pattern(hplip_t,hplip_etc_t,hplip_etc_t)
|
|
files_search_etc(hplip_t)
|
|
|
|
manage_files_pattern(hplip_t,hplip_var_run_t,hplip_var_run_t)
|
|
files_pid_filetrans(hplip_t,hplip_var_run_t,file)
|
|
|
|
kernel_read_system_state(hplip_t)
|
|
kernel_read_kernel_sysctls(hplip_t)
|
|
|
|
corenet_all_recvfrom_unlabeled(hplip_t)
|
|
corenet_all_recvfrom_netlabel(hplip_t)
|
|
corenet_tcp_sendrecv_all_if(hplip_t)
|
|
corenet_udp_sendrecv_all_if(hplip_t)
|
|
corenet_raw_sendrecv_all_if(hplip_t)
|
|
corenet_tcp_sendrecv_all_nodes(hplip_t)
|
|
corenet_udp_sendrecv_all_nodes(hplip_t)
|
|
corenet_raw_sendrecv_all_nodes(hplip_t)
|
|
corenet_tcp_sendrecv_all_ports(hplip_t)
|
|
corenet_udp_sendrecv_all_ports(hplip_t)
|
|
corenet_tcp_bind_all_nodes(hplip_t)
|
|
corenet_udp_bind_all_nodes(hplip_t)
|
|
corenet_tcp_bind_hplip_port(hplip_t)
|
|
corenet_tcp_connect_hplip_port(hplip_t)
|
|
corenet_tcp_connect_ipp_port(hplip_t)
|
|
corenet_sendrecv_hplip_client_packets(hplip_t)
|
|
corenet_receive_hplip_server_packets(hplip_t)
|
|
|
|
dev_read_sysfs(hplip_t)
|
|
dev_rw_printer(hplip_t)
|
|
dev_read_urand(hplip_t)
|
|
dev_read_rand(hplip_t)
|
|
dev_rw_generic_usb_dev(hplip_t)
|
|
dev_read_usbfs(hplip_t)
|
|
|
|
fs_getattr_all_fs(hplip_t)
|
|
fs_search_auto_mountpoints(hplip_t)
|
|
|
|
# for python
|
|
corecmd_exec_bin(hplip_t)
|
|
|
|
domain_use_interactive_fds(hplip_t)
|
|
|
|
files_read_etc_files(hplip_t)
|
|
files_read_etc_runtime_files(hplip_t)
|
|
files_read_usr_files(hplip_t)
|
|
|
|
libs_use_ld_so(hplip_t)
|
|
libs_use_shared_libs(hplip_t)
|
|
|
|
logging_send_syslog_msg(hplip_t)
|
|
|
|
miscfiles_read_localization(hplip_t)
|
|
|
|
sysnet_read_config(hplip_t)
|
|
|
|
userdom_dontaudit_use_unpriv_user_fds(hplip_t)
|
|
userdom_dontaudit_search_sysadm_home_dirs(hplip_t)
|
|
userdom_dontaudit_search_all_users_home_content(hplip_t)
|
|
|
|
lpd_read_config(cupsd_t)
|
|
|
|
ifdef(`targeted_policy', `
|
|
term_dontaudit_use_unallocated_ttys(hplip_t)
|
|
term_dontaudit_use_generic_ptys(hplip_t)
|
|
files_dontaudit_read_root_files(hplip_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
seutil_sigchld_newrole(hplip_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
snmp_read_snmp_var_lib_files(hplip_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
udev_read_db(hplip_t)
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# PTAL local policy
|
|
#
|
|
|
|
allow ptal_t self:capability { chown sys_rawio };
|
|
dontaudit ptal_t self:capability sys_tty_config;
|
|
allow ptal_t self:fifo_file rw_fifo_file_perms;
|
|
allow ptal_t self:unix_dgram_socket create_socket_perms;
|
|
allow ptal_t self:unix_stream_socket create_stream_socket_perms;
|
|
allow ptal_t self:tcp_socket create_stream_socket_perms;
|
|
|
|
allow ptal_t ptal_etc_t:dir list_dir_perms;
|
|
read_files_pattern(ptal_t,ptal_etc_t,ptal_etc_t)
|
|
read_lnk_files_pattern(ptal_t,ptal_etc_t,ptal_etc_t)
|
|
files_search_etc(ptal_t)
|
|
|
|
manage_dirs_pattern(ptal_t,ptal_var_run_t,ptal_var_run_t)
|
|
manage_files_pattern(ptal_t,ptal_var_run_t,ptal_var_run_t)
|
|
manage_lnk_files_pattern(ptal_t,ptal_var_run_t,ptal_var_run_t)
|
|
manage_fifo_files_pattern(ptal_t,ptal_var_run_t,ptal_var_run_t)
|
|
manage_sock_files_pattern(ptal_t,ptal_var_run_t,ptal_var_run_t)
|
|
files_pid_filetrans(ptal_t,ptal_var_run_t,{ dir file lnk_file sock_file fifo_file })
|
|
|
|
kernel_read_kernel_sysctls(ptal_t)
|
|
kernel_list_proc(ptal_t)
|
|
kernel_read_proc_symlinks(ptal_t)
|
|
|
|
corenet_all_recvfrom_unlabeled(ptal_t)
|
|
corenet_all_recvfrom_netlabel(ptal_t)
|
|
corenet_tcp_sendrecv_all_if(ptal_t)
|
|
corenet_tcp_sendrecv_all_nodes(ptal_t)
|
|
corenet_tcp_sendrecv_all_ports(ptal_t)
|
|
corenet_tcp_bind_all_nodes(ptal_t)
|
|
corenet_tcp_bind_ptal_port(ptal_t)
|
|
|
|
dev_read_sysfs(ptal_t)
|
|
dev_read_usbfs(ptal_t)
|
|
dev_rw_printer(ptal_t)
|
|
|
|
fs_getattr_all_fs(ptal_t)
|
|
fs_search_auto_mountpoints(ptal_t)
|
|
|
|
domain_use_interactive_fds(ptal_t)
|
|
|
|
files_read_etc_files(ptal_t)
|
|
files_read_etc_runtime_files(ptal_t)
|
|
|
|
libs_use_ld_so(ptal_t)
|
|
libs_use_shared_libs(ptal_t)
|
|
|
|
logging_send_syslog_msg(ptal_t)
|
|
|
|
miscfiles_read_localization(ptal_t)
|
|
|
|
sysnet_read_config(ptal_t)
|
|
|
|
userdom_dontaudit_use_unpriv_user_fds(ptal_t)
|
|
userdom_dontaudit_search_all_users_home_content(ptal_t)
|
|
|
|
ifdef(`targeted_policy', `
|
|
term_dontaudit_use_unallocated_ttys(ptal_t)
|
|
term_dontaudit_use_generic_ptys(ptal_t)
|
|
files_dontaudit_read_root_files(ptal_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
seutil_sigchld_newrole(ptal_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
udev_read_db(ptal_t)
|
|
')
|