185 lines
4.6 KiB
Plaintext
185 lines
4.6 KiB
Plaintext
## <summary>Policy for NIS (YP) servers and clients</summary>
|
|
|
|
########################################
|
|
## <summary>
|
|
## Use the ypbind service to access NIS services
|
|
## unconditionally.
|
|
## </summary>
|
|
## <desc>
|
|
## <p>
|
|
## Use the ypbind service to access NIS services
|
|
## unconditionally.
|
|
## </p>
|
|
## <p>
|
|
## This interface was added because of apache and
|
|
## spamassassin, to fix a nested conditionals problem.
|
|
## When that support is added, this should be removed,
|
|
## and the regular interface should be used.
|
|
## </p>
|
|
## </desc>
|
|
## <param name="domain">
|
|
## The type of the process performing this action.
|
|
## </param>
|
|
#
|
|
interface(`nis_use_ypbind_uncond',`
|
|
gen_require(`
|
|
type var_yp_t;
|
|
')
|
|
|
|
dontaudit $1 self:capability net_bind_service;
|
|
|
|
allow $1 self:tcp_socket create_stream_socket_perms;
|
|
allow $1 self:udp_socket create_socket_perms;
|
|
|
|
allow $1 var_yp_t:dir r_dir_perms;
|
|
allow $1 var_yp_t:lnk_file { getattr read };
|
|
allow $1 var_yp_t:file r_file_perms;
|
|
|
|
corenet_tcp_sendrecv_all_if($1)
|
|
corenet_udp_sendrecv_all_if($1)
|
|
corenet_raw_sendrecv_all_if($1)
|
|
corenet_tcp_sendrecv_all_nodes($1)
|
|
corenet_udp_sendrecv_all_nodes($1)
|
|
corenet_raw_sendrecv_all_nodes($1)
|
|
corenet_tcp_sendrecv_all_ports($1)
|
|
corenet_udp_sendrecv_all_ports($1)
|
|
corenet_tcp_bind_all_nodes($1)
|
|
corenet_udp_bind_all_nodes($1)
|
|
corenet_tcp_bind_generic_port($1)
|
|
corenet_udp_bind_generic_port($1)
|
|
corenet_tcp_bind_reserved_port($1)
|
|
corenet_udp_bind_reserved_port($1)
|
|
corenet_dontaudit_tcp_bind_all_reserved_ports($1)
|
|
corenet_dontaudit_udp_bind_all_reserved_ports($1)
|
|
corenet_tcp_connect_portmap_port($1)
|
|
corenet_tcp_connect_reserved_port($1)
|
|
corenet_tcp_connect_generic_port($1)
|
|
corenet_dontaudit_tcp_connect_all_reserved_ports($1)
|
|
|
|
sysnet_read_config($1)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Use the ypbind service to access NIS services.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## The type of the process performing this action.
|
|
## </param>
|
|
#
|
|
interface(`nis_use_ypbind',`
|
|
gen_require(`
|
|
type var_yp_t;
|
|
')
|
|
|
|
tunable_policy(`allow_ypbind',`
|
|
dontaudit $1 self:capability net_bind_service;
|
|
|
|
allow $1 self:tcp_socket create_stream_socket_perms;
|
|
allow $1 self:udp_socket create_socket_perms;
|
|
|
|
allow $1 var_yp_t:dir r_dir_perms;
|
|
allow $1 var_yp_t:lnk_file { getattr read };
|
|
allow $1 var_yp_t:file r_file_perms;
|
|
|
|
corenet_tcp_sendrecv_all_if($1)
|
|
corenet_udp_sendrecv_all_if($1)
|
|
corenet_raw_sendrecv_all_if($1)
|
|
corenet_tcp_sendrecv_all_nodes($1)
|
|
corenet_udp_sendrecv_all_nodes($1)
|
|
corenet_raw_sendrecv_all_nodes($1)
|
|
corenet_tcp_sendrecv_all_ports($1)
|
|
corenet_udp_sendrecv_all_ports($1)
|
|
corenet_tcp_bind_all_nodes($1)
|
|
corenet_udp_bind_all_nodes($1)
|
|
corenet_tcp_bind_generic_port($1)
|
|
corenet_udp_bind_generic_port($1)
|
|
corenet_tcp_bind_reserved_port($1)
|
|
corenet_udp_bind_reserved_port($1)
|
|
corenet_dontaudit_tcp_bind_all_reserved_ports($1)
|
|
corenet_dontaudit_udp_bind_all_reserved_ports($1)
|
|
corenet_tcp_connect_portmap_port($1)
|
|
corenet_tcp_connect_reserved_port($1)
|
|
corenet_tcp_connect_generic_port($1)
|
|
corenet_dontaudit_tcp_connect_all_reserved_ports($1)
|
|
|
|
sysnet_read_config($1)
|
|
',`
|
|
dontaudit $1 var_yp_t:dir search;
|
|
')
|
|
|
|
optional_policy(`mount.te',`
|
|
tunable_policy(`allow_ypbind',`
|
|
mount_send_nfs_client_request($1)
|
|
')
|
|
')
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Send generic signals to ypbind.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## The type of the process performing this action.
|
|
## </param>
|
|
#
|
|
interface(`nis_signal_ypbind',`
|
|
gen_require(`
|
|
type ypbind_t;
|
|
')
|
|
|
|
allow $1 ypbind_t:process signal;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## List the contents of the NIS data directory.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## The type of the process performing this action.
|
|
## </param>
|
|
#
|
|
interface(`nis_list_var_yp',`
|
|
gen_require(`
|
|
type var_yp_t;
|
|
')
|
|
|
|
files_search_var($1)
|
|
allow $1 var_yp_t:dir r_dir_perms;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Send UDP network traffic to NIS clients.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## The type of the process performing this action.
|
|
## </param>
|
|
#
|
|
interface(`nis_udp_sendto_ypbind',`
|
|
gen_require(`
|
|
type ypbind_t;
|
|
')
|
|
|
|
allow $1 ypbind_t:udp_socket sendto;
|
|
allow ypbind_t $1:udp_socket recvfrom;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Connect to ypbind over TCP.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## Domain allowed access.
|
|
## </param>
|
|
#
|
|
interface(`nis_tcp_connect_ypbind',`
|
|
gen_require(`
|
|
type ypbind_t;
|
|
')
|
|
|
|
allow $1 ypbind_t:tcp_socket { connectto recvfrom };
|
|
allow ypbind_t $1:tcp_socket { acceptfrom recvfrom };
|
|
allow $1 kernel_t:tcp_socket recvfrom;
|
|
')
|