ef521e9919
Tunable, optional and if(n)def blocks go below. Tunable, optional and if(n)def blocks go below. Tunable, optional and if(n)def blocks go below. Tunable, optional and if(n)def blocks go below.
800 lines
22 KiB
Plaintext
800 lines
22 KiB
Plaintext
policy_module(cups, 1.14.0)
|
|
|
|
########################################
|
|
#
|
|
# Declarations
|
|
#
|
|
|
|
type cupsd_config_t;
|
|
type cupsd_config_exec_t;
|
|
init_daemon_domain(cupsd_config_t, cupsd_config_exec_t)
|
|
|
|
type cupsd_config_var_run_t;
|
|
files_pid_file(cupsd_config_var_run_t)
|
|
|
|
type cupsd_t;
|
|
type cupsd_exec_t;
|
|
init_daemon_domain(cupsd_t, cupsd_exec_t)
|
|
mls_trusted_object(cupsd_t)
|
|
|
|
type cupsd_etc_t;
|
|
files_config_file(cupsd_etc_t)
|
|
|
|
type cupsd_initrc_exec_t;
|
|
init_script_file(cupsd_initrc_exec_t)
|
|
|
|
type cupsd_interface_t;
|
|
files_type(cupsd_interface_t)
|
|
|
|
type cupsd_rw_etc_t;
|
|
files_config_file(cupsd_rw_etc_t)
|
|
|
|
type cupsd_lock_t;
|
|
files_lock_file(cupsd_lock_t)
|
|
|
|
type cupsd_log_t;
|
|
logging_log_file(cupsd_log_t)
|
|
|
|
type cupsd_lpd_t;
|
|
type cupsd_lpd_exec_t;
|
|
domain_type(cupsd_lpd_t)
|
|
domain_entry_file(cupsd_lpd_t, cupsd_lpd_exec_t)
|
|
role system_r types cupsd_lpd_t;
|
|
|
|
type cupsd_lpd_tmp_t;
|
|
files_tmp_file(cupsd_lpd_tmp_t)
|
|
|
|
type cupsd_lpd_var_run_t;
|
|
files_pid_file(cupsd_lpd_var_run_t)
|
|
|
|
type cups_pdf_t;
|
|
type cups_pdf_exec_t;
|
|
cups_backend(cups_pdf_t, cups_pdf_exec_t)
|
|
|
|
type cups_pdf_tmp_t;
|
|
files_tmp_file(cups_pdf_tmp_t)
|
|
|
|
type cupsd_tmp_t;
|
|
files_tmp_file(cupsd_tmp_t)
|
|
|
|
type cupsd_var_run_t;
|
|
files_pid_file(cupsd_var_run_t)
|
|
mls_trusted_object(cupsd_var_run_t)
|
|
|
|
type hplip_t;
|
|
type hplip_exec_t;
|
|
init_daemon_domain(hplip_t, hplip_exec_t)
|
|
# For CUPS to run as a backend
|
|
cups_backend(hplip_t, hplip_exec_t)
|
|
|
|
type hplip_etc_t;
|
|
files_config_file(hplip_etc_t)
|
|
|
|
type hplip_tmp_t;
|
|
files_tmp_file(hplip_tmp_t)
|
|
|
|
type hplip_var_lib_t;
|
|
files_type(hplip_var_lib_t)
|
|
|
|
type hplip_var_run_t;
|
|
files_pid_file(hplip_var_run_t)
|
|
|
|
type ptal_t;
|
|
type ptal_exec_t;
|
|
init_daemon_domain(ptal_t, ptal_exec_t)
|
|
|
|
type ptal_etc_t;
|
|
files_config_file(ptal_etc_t)
|
|
|
|
type ptal_var_run_t;
|
|
files_pid_file(ptal_var_run_t)
|
|
|
|
ifdef(`enable_mcs',`
|
|
init_ranged_daemon_domain(cupsd_t, cupsd_exec_t, s0 - mcs_systemhigh)
|
|
')
|
|
|
|
ifdef(`enable_mls',`
|
|
init_ranged_daemon_domain(cupsd_t, cupsd_exec_t, mls_systemhigh)
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# Cups local policy
|
|
#
|
|
|
|
# /usr/lib/cups/backend/serial needs sys_admin(?!)
|
|
allow cupsd_t self:capability { ipc_lock sys_admin dac_override dac_read_search kill setgid setuid fsetid net_bind_service fowner chown dac_override sys_rawio sys_resource sys_tty_config };
|
|
dontaudit cupsd_t self:capability { sys_tty_config net_admin };
|
|
allow cupsd_t self:process { getpgid setpgid setsched signal_perms };
|
|
allow cupsd_t self:fifo_file rw_fifo_file_perms;
|
|
allow cupsd_t self:unix_stream_socket { create_stream_socket_perms connectto };
|
|
allow cupsd_t self:unix_dgram_socket create_socket_perms;
|
|
allow cupsd_t self:netlink_selinux_socket create_socket_perms;
|
|
allow cupsd_t self:shm create_shm_perms;
|
|
allow cupsd_t self:sem create_sem_perms;
|
|
allow cupsd_t self:tcp_socket create_stream_socket_perms;
|
|
allow cupsd_t self:udp_socket create_socket_perms;
|
|
allow cupsd_t self:appletalk_socket create_socket_perms;
|
|
# generic socket here until appletalk socket is available in kernels
|
|
allow cupsd_t self:socket create_socket_perms;
|
|
|
|
allow cupsd_t cupsd_etc_t:{ dir file } setattr;
|
|
read_files_pattern(cupsd_t, cupsd_etc_t, cupsd_etc_t)
|
|
read_lnk_files_pattern(cupsd_t, cupsd_etc_t, cupsd_etc_t)
|
|
files_search_etc(cupsd_t)
|
|
|
|
manage_files_pattern(cupsd_t, cupsd_interface_t, cupsd_interface_t)
|
|
can_exec(cupsd_t, cupsd_interface_t)
|
|
|
|
manage_dirs_pattern(cupsd_t, cupsd_etc_t, cupsd_rw_etc_t)
|
|
manage_files_pattern(cupsd_t, cupsd_etc_t, cupsd_rw_etc_t)
|
|
filetrans_pattern(cupsd_t, cupsd_etc_t, cupsd_rw_etc_t, file)
|
|
files_var_filetrans(cupsd_t, cupsd_rw_etc_t, { dir file })
|
|
|
|
# allow cups to execute its backend scripts
|
|
can_exec(cupsd_t, cupsd_exec_t)
|
|
allow cupsd_t cupsd_exec_t:dir search_dir_perms;
|
|
allow cupsd_t cupsd_exec_t:lnk_file read_lnk_file_perms;
|
|
|
|
allow cupsd_t cupsd_lock_t:file manage_file_perms;
|
|
files_lock_filetrans(cupsd_t, cupsd_lock_t, file)
|
|
|
|
manage_dirs_pattern(cupsd_t, cupsd_log_t, cupsd_log_t)
|
|
manage_files_pattern(cupsd_t, cupsd_log_t, cupsd_log_t)
|
|
allow cupsd_t cupsd_log_t:dir setattr;
|
|
logging_log_filetrans(cupsd_t, cupsd_log_t, { file dir })
|
|
|
|
manage_dirs_pattern(cupsd_t, cupsd_tmp_t, cupsd_tmp_t)
|
|
manage_files_pattern(cupsd_t, cupsd_tmp_t, cupsd_tmp_t)
|
|
manage_fifo_files_pattern(cupsd_t, cupsd_tmp_t, cupsd_tmp_t)
|
|
files_tmp_filetrans(cupsd_t, cupsd_tmp_t, { file dir fifo_file })
|
|
|
|
allow cupsd_t cupsd_var_run_t:dir setattr_dir_perms;
|
|
manage_dirs_pattern(cupsd_t, cupsd_var_run_t, cupsd_var_run_t)
|
|
manage_files_pattern(cupsd_t, cupsd_var_run_t, cupsd_var_run_t)
|
|
manage_sock_files_pattern(cupsd_t, cupsd_var_run_t, cupsd_var_run_t)
|
|
manage_fifo_files_pattern(cupsd_t, cupsd_var_run_t, cupsd_var_run_t)
|
|
files_pid_filetrans(cupsd_t, cupsd_var_run_t, { dir file fifo_file })
|
|
|
|
allow cupsd_t hplip_t:process { signal sigkill };
|
|
|
|
read_files_pattern(cupsd_t, hplip_etc_t, hplip_etc_t)
|
|
|
|
allow cupsd_t hplip_var_run_t:file read_file_perms;
|
|
|
|
stream_connect_pattern(cupsd_t, ptal_var_run_t, ptal_var_run_t, ptal_t)
|
|
allow cupsd_t ptal_var_run_t:sock_file setattr_sock_file_perms;
|
|
|
|
kernel_read_system_state(cupsd_t)
|
|
kernel_read_network_state(cupsd_t)
|
|
kernel_read_all_sysctls(cupsd_t)
|
|
kernel_request_load_module(cupsd_t)
|
|
|
|
corenet_all_recvfrom_unlabeled(cupsd_t)
|
|
corenet_all_recvfrom_netlabel(cupsd_t)
|
|
corenet_tcp_sendrecv_generic_if(cupsd_t)
|
|
corenet_udp_sendrecv_generic_if(cupsd_t)
|
|
corenet_raw_sendrecv_generic_if(cupsd_t)
|
|
corenet_tcp_sendrecv_generic_node(cupsd_t)
|
|
corenet_udp_sendrecv_generic_node(cupsd_t)
|
|
corenet_raw_sendrecv_generic_node(cupsd_t)
|
|
corenet_tcp_sendrecv_all_ports(cupsd_t)
|
|
corenet_udp_sendrecv_all_ports(cupsd_t)
|
|
corenet_tcp_bind_generic_node(cupsd_t)
|
|
corenet_udp_bind_generic_node(cupsd_t)
|
|
corenet_tcp_bind_ipp_port(cupsd_t)
|
|
corenet_udp_bind_ipp_port(cupsd_t)
|
|
corenet_udp_bind_howl_port(cupsd_t)
|
|
corenet_tcp_bind_reserved_port(cupsd_t)
|
|
corenet_dontaudit_tcp_bind_all_reserved_ports(cupsd_t)
|
|
corenet_tcp_bind_all_rpc_ports(cupsd_t)
|
|
corenet_tcp_connect_all_ports(cupsd_t)
|
|
corenet_sendrecv_hplip_client_packets(cupsd_t)
|
|
corenet_sendrecv_ipp_client_packets(cupsd_t)
|
|
corenet_sendrecv_ipp_server_packets(cupsd_t)
|
|
|
|
dev_rw_printer(cupsd_t)
|
|
dev_read_urand(cupsd_t)
|
|
dev_read_sysfs(cupsd_t)
|
|
dev_rw_input_dev(cupsd_t) #447878
|
|
dev_rw_generic_usb_dev(cupsd_t)
|
|
dev_rw_usbfs(cupsd_t)
|
|
dev_getattr_printer_dev(cupsd_t)
|
|
|
|
domain_read_all_domains_state(cupsd_t)
|
|
|
|
fs_getattr_all_fs(cupsd_t)
|
|
fs_search_auto_mountpoints(cupsd_t)
|
|
fs_search_fusefs(cupsd_t)
|
|
fs_read_anon_inodefs_files(cupsd_t)
|
|
|
|
mls_file_downgrade(cupsd_t)
|
|
mls_file_write_all_levels(cupsd_t)
|
|
mls_file_read_all_levels(cupsd_t)
|
|
mls_rangetrans_target(cupsd_t)
|
|
mls_socket_write_all_levels(cupsd_t)
|
|
mls_fd_use_all_levels(cupsd_t)
|
|
|
|
term_use_unallocated_ttys(cupsd_t)
|
|
term_search_ptys(cupsd_t)
|
|
|
|
# Filter scripts may be shell scripts, and may invoke progs like /bin/mktemp
|
|
corecmd_exec_shell(cupsd_t)
|
|
corecmd_exec_bin(cupsd_t)
|
|
|
|
domain_use_interactive_fds(cupsd_t)
|
|
|
|
files_list_spool(cupsd_t)
|
|
files_read_etc_files(cupsd_t)
|
|
files_read_etc_runtime_files(cupsd_t)
|
|
# read python modules
|
|
files_read_usr_files(cupsd_t)
|
|
# for /var/lib/defoma
|
|
files_read_var_lib_files(cupsd_t)
|
|
files_list_world_readable(cupsd_t)
|
|
files_read_world_readable_files(cupsd_t)
|
|
files_read_world_readable_symlinks(cupsd_t)
|
|
# Satisfy readahead
|
|
files_read_var_files(cupsd_t)
|
|
files_read_var_symlinks(cupsd_t)
|
|
# for /etc/printcap
|
|
files_dontaudit_write_etc_files(cupsd_t)
|
|
# smbspool seems to be iterating through all existing tmp files.
|
|
# redhat bug #214953
|
|
# cjp: this might be a broken behavior
|
|
files_dontaudit_getattr_all_tmp_files(cupsd_t)
|
|
|
|
selinux_compute_access_vector(cupsd_t)
|
|
selinux_validate_context(cupsd_t)
|
|
|
|
init_exec_script_files(cupsd_t)
|
|
init_read_utmp(cupsd_t)
|
|
|
|
auth_domtrans_chk_passwd(cupsd_t)
|
|
auth_dontaudit_read_pam_pid(cupsd_t)
|
|
auth_rw_faillog(cupsd_t)
|
|
auth_use_nsswitch(cupsd_t)
|
|
|
|
# Read /usr/lib/gconv/gconv-modules.* and /usr/lib/python2.2/.*
|
|
libs_read_lib_files(cupsd_t)
|
|
libs_exec_lib_files(cupsd_t)
|
|
|
|
logging_send_audit_msgs(cupsd_t)
|
|
logging_send_syslog_msg(cupsd_t)
|
|
|
|
miscfiles_read_localization(cupsd_t)
|
|
# invoking ghostscript needs to read fonts
|
|
miscfiles_read_fonts(cupsd_t)
|
|
miscfiles_setattr_fonts_cache_dirs(cupsd_t)
|
|
|
|
seutil_read_config(cupsd_t)
|
|
sysnet_exec_ifconfig(cupsd_t)
|
|
|
|
files_dontaudit_list_home(cupsd_t)
|
|
userdom_dontaudit_use_unpriv_user_fds(cupsd_t)
|
|
userdom_dontaudit_search_user_home_content(cupsd_t)
|
|
|
|
# Write to /var/spool/cups.
|
|
lpd_manage_spool(cupsd_t)
|
|
lpd_read_config(cupsd_t)
|
|
lpd_exec_lpr(cupsd_t)
|
|
lpd_relabel_spool(cupsd_t)
|
|
|
|
optional_policy(`
|
|
apm_domtrans_client(cupsd_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
cron_system_entry(cupsd_t, cupsd_exec_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
dbus_system_bus_client(cupsd_t)
|
|
|
|
userdom_dbus_send_all_users(cupsd_t)
|
|
|
|
optional_policy(`
|
|
avahi_dbus_chat(cupsd_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
hal_dbus_chat(cupsd_t)
|
|
')
|
|
|
|
# talk to processes that do not have policy
|
|
optional_policy(`
|
|
unconfined_dbus_chat(cupsd_t)
|
|
files_write_generic_pid_pipes(cupsd_t)
|
|
')
|
|
')
|
|
|
|
optional_policy(`
|
|
hostname_exec(cupsd_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
inetd_core_service_domain(cupsd_t, cupsd_exec_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
logrotate_domtrans(cupsd_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
mta_send_mail(cupsd_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
# cups execs smbtool which reads samba_etc_t files
|
|
samba_read_config(cupsd_t)
|
|
samba_rw_var_files(cupsd_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
seutil_sigchld_newrole(cupsd_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
snmp_read_snmp_var_lib_files(cupsd_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
udev_read_db(cupsd_t)
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# Cups configuration daemon local policy
|
|
#
|
|
|
|
allow cupsd_config_t self:capability { chown dac_override sys_tty_config };
|
|
dontaudit cupsd_config_t self:capability sys_tty_config;
|
|
allow cupsd_config_t self:process { getsched signal_perms };
|
|
allow cupsd_config_t self:fifo_file rw_fifo_file_perms;
|
|
allow cupsd_config_t self:unix_stream_socket create_socket_perms;
|
|
allow cupsd_config_t self:unix_dgram_socket create_socket_perms;
|
|
allow cupsd_config_t self:tcp_socket create_stream_socket_perms;
|
|
|
|
allow cupsd_config_t cupsd_t:process signal;
|
|
ps_process_pattern(cupsd_config_t, cupsd_t)
|
|
|
|
manage_files_pattern(cupsd_config_t, cupsd_etc_t, cupsd_etc_t)
|
|
manage_lnk_files_pattern(cupsd_config_t, cupsd_etc_t, cupsd_etc_t)
|
|
filetrans_pattern(cupsd_config_t, cupsd_etc_t, cupsd_rw_etc_t, file)
|
|
|
|
manage_files_pattern(cupsd_config_t, cupsd_rw_etc_t, cupsd_rw_etc_t)
|
|
manage_lnk_files_pattern(cupsd_config_t, cupsd_rw_etc_t, cupsd_rw_etc_t)
|
|
files_var_filetrans(cupsd_config_t, cupsd_rw_etc_t, file)
|
|
|
|
can_exec(cupsd_config_t, cupsd_config_exec_t)
|
|
|
|
allow cupsd_config_t cupsd_log_t:file rw_file_perms;
|
|
|
|
manage_lnk_files_pattern(cupsd_config_t, cupsd_tmp_t, cupsd_tmp_t)
|
|
manage_files_pattern(cupsd_config_t, cupsd_tmp_t, cupsd_tmp_t)
|
|
manage_dirs_pattern(cupsd_config_t, cupsd_tmp_t, cupsd_tmp_t)
|
|
files_tmp_filetrans(cupsd_config_t, cupsd_tmp_t, { lnk_file file dir })
|
|
|
|
allow cupsd_config_t cupsd_var_run_t:file read_file_perms;
|
|
|
|
manage_dirs_pattern(cupsd_config_t, cupsd_config_var_run_t, cupsd_config_var_run_t)
|
|
manage_files_pattern(cupsd_config_t, cupsd_config_var_run_t, cupsd_config_var_run_t)
|
|
files_pid_filetrans(cupsd_config_t, cupsd_config_var_run_t, { dir file })
|
|
|
|
domtrans_pattern(cupsd_config_t, hplip_exec_t, hplip_t)
|
|
|
|
read_files_pattern(cupsd_config_t, hplip_etc_t, hplip_etc_t)
|
|
|
|
kernel_read_system_state(cupsd_config_t)
|
|
kernel_read_all_sysctls(cupsd_config_t)
|
|
|
|
corenet_all_recvfrom_unlabeled(cupsd_config_t)
|
|
corenet_all_recvfrom_netlabel(cupsd_config_t)
|
|
corenet_tcp_sendrecv_generic_if(cupsd_config_t)
|
|
corenet_tcp_sendrecv_generic_node(cupsd_config_t)
|
|
corenet_tcp_sendrecv_all_ports(cupsd_config_t)
|
|
corenet_tcp_connect_all_ports(cupsd_config_t)
|
|
corenet_sendrecv_all_client_packets(cupsd_config_t)
|
|
|
|
dev_read_sysfs(cupsd_config_t)
|
|
dev_read_urand(cupsd_config_t)
|
|
dev_read_rand(cupsd_config_t)
|
|
dev_rw_generic_usb_dev(cupsd_config_t)
|
|
|
|
files_search_all_mountpoints(cupsd_config_t)
|
|
|
|
fs_getattr_all_fs(cupsd_config_t)
|
|
fs_search_auto_mountpoints(cupsd_config_t)
|
|
|
|
corecmd_exec_bin(cupsd_config_t)
|
|
corecmd_exec_shell(cupsd_config_t)
|
|
|
|
domain_use_interactive_fds(cupsd_config_t)
|
|
# killall causes the following
|
|
domain_dontaudit_search_all_domains_state(cupsd_config_t)
|
|
|
|
files_read_usr_files(cupsd_config_t)
|
|
files_read_etc_files(cupsd_config_t)
|
|
files_read_etc_runtime_files(cupsd_config_t)
|
|
files_read_var_symlinks(cupsd_config_t)
|
|
|
|
# Alternatives asks for this
|
|
init_getattr_all_script_files(cupsd_config_t)
|
|
|
|
auth_use_nsswitch(cupsd_config_t)
|
|
|
|
logging_send_syslog_msg(cupsd_config_t)
|
|
|
|
miscfiles_read_localization(cupsd_config_t)
|
|
miscfiles_read_hwdata(cupsd_config_t)
|
|
|
|
seutil_dontaudit_search_config(cupsd_config_t)
|
|
|
|
userdom_dontaudit_use_unpriv_user_fds(cupsd_config_t)
|
|
userdom_dontaudit_search_user_home_dirs(cupsd_config_t)
|
|
userdom_rw_user_tmp_files(cupsd_config_t)
|
|
|
|
cups_stream_connect(cupsd_config_t)
|
|
|
|
lpd_read_config(cupsd_config_t)
|
|
|
|
ifdef(`distro_redhat',`
|
|
optional_policy(`
|
|
rpm_read_db(cupsd_config_t)
|
|
')
|
|
')
|
|
|
|
optional_policy(`
|
|
term_use_generic_ptys(cupsd_config_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
cron_system_entry(cupsd_config_t, cupsd_config_exec_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
dbus_system_domain(cupsd_config_t, cupsd_config_exec_t)
|
|
|
|
optional_policy(`
|
|
hal_dbus_chat(cupsd_config_t)
|
|
')
|
|
')
|
|
|
|
optional_policy(`
|
|
gnome_dontaudit_search_config(cupsd_config_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
hal_domtrans(cupsd_config_t)
|
|
hal_read_tmp_files(cupsd_config_t)
|
|
hal_dontaudit_use_fds(hplip_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
hostname_exec(cupsd_config_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
logrotate_use_fds(cupsd_config_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
policykit_dbus_chat(cupsd_config_t)
|
|
userdom_read_all_users_state(cupsd_config_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
rpm_read_db(cupsd_config_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
seutil_sigchld_newrole(cupsd_config_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
udev_read_db(cupsd_config_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
unconfined_stream_connect(cupsd_config_t)
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# Cups lpd support
|
|
#
|
|
|
|
allow cupsd_lpd_t self:process signal_perms;
|
|
allow cupsd_lpd_t self:fifo_file rw_fifo_file_perms;
|
|
allow cupsd_lpd_t self:tcp_socket connected_stream_socket_perms;
|
|
allow cupsd_lpd_t self:udp_socket create_socket_perms;
|
|
|
|
# for identd
|
|
# cjp: this should probably only be inetd_child rules?
|
|
allow cupsd_lpd_t self:netlink_tcpdiag_socket r_netlink_socket_perms;
|
|
allow cupsd_lpd_t self:capability { setuid setgid };
|
|
files_search_home(cupsd_lpd_t)
|
|
optional_policy(`
|
|
kerberos_use(cupsd_lpd_t)
|
|
')
|
|
#end for identd
|
|
|
|
allow cupsd_lpd_t cupsd_etc_t:dir list_dir_perms;
|
|
read_files_pattern(cupsd_lpd_t, cupsd_etc_t, cupsd_etc_t)
|
|
read_lnk_files_pattern(cupsd_lpd_t, cupsd_etc_t, cupsd_etc_t)
|
|
|
|
allow cupsd_lpd_t cupsd_rw_etc_t:dir list_dir_perms;
|
|
read_files_pattern(cupsd_lpd_t, cupsd_rw_etc_t, cupsd_rw_etc_t)
|
|
read_lnk_files_pattern(cupsd_lpd_t, cupsd_rw_etc_t, cupsd_rw_etc_t)
|
|
|
|
manage_dirs_pattern(cupsd_lpd_t, cupsd_lpd_tmp_t, cupsd_lpd_tmp_t)
|
|
manage_files_pattern(cupsd_lpd_t, cupsd_lpd_tmp_t, cupsd_lpd_tmp_t)
|
|
files_tmp_filetrans(cupsd_lpd_t, cupsd_lpd_tmp_t, { file dir })
|
|
|
|
manage_files_pattern(cupsd_lpd_t, cupsd_lpd_var_run_t, cupsd_lpd_var_run_t)
|
|
files_pid_filetrans(cupsd_lpd_t, cupsd_lpd_var_run_t, file)
|
|
|
|
kernel_read_kernel_sysctls(cupsd_lpd_t)
|
|
kernel_read_system_state(cupsd_lpd_t)
|
|
kernel_read_network_state(cupsd_lpd_t)
|
|
|
|
corenet_all_recvfrom_unlabeled(cupsd_lpd_t)
|
|
corenet_all_recvfrom_netlabel(cupsd_lpd_t)
|
|
corenet_tcp_sendrecv_generic_if(cupsd_lpd_t)
|
|
corenet_udp_sendrecv_generic_if(cupsd_lpd_t)
|
|
corenet_tcp_sendrecv_generic_node(cupsd_lpd_t)
|
|
corenet_udp_sendrecv_generic_node(cupsd_lpd_t)
|
|
corenet_tcp_sendrecv_all_ports(cupsd_lpd_t)
|
|
corenet_udp_sendrecv_all_ports(cupsd_lpd_t)
|
|
corenet_tcp_bind_generic_node(cupsd_lpd_t)
|
|
corenet_udp_bind_generic_node(cupsd_lpd_t)
|
|
corenet_tcp_connect_ipp_port(cupsd_lpd_t)
|
|
|
|
dev_read_urand(cupsd_lpd_t)
|
|
dev_read_rand(cupsd_lpd_t)
|
|
|
|
fs_getattr_xattr_fs(cupsd_lpd_t)
|
|
|
|
files_read_etc_files(cupsd_lpd_t)
|
|
|
|
auth_use_nsswitch(cupsd_lpd_t)
|
|
|
|
logging_send_syslog_msg(cupsd_lpd_t)
|
|
|
|
miscfiles_read_localization(cupsd_lpd_t)
|
|
miscfiles_setattr_fonts_cache_dirs(cupsd_lpd_t)
|
|
|
|
cups_stream_connect(cupsd_lpd_t)
|
|
|
|
optional_policy(`
|
|
inetd_service_domain(cupsd_lpd_t, cupsd_lpd_exec_t)
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# cups_pdf local policy
|
|
#
|
|
|
|
allow cups_pdf_t self:capability { chown fowner fsetid setuid setgid dac_override };
|
|
allow cups_pdf_t self:fifo_file rw_file_perms;
|
|
allow cups_pdf_t self:unix_stream_socket create_stream_socket_perms;
|
|
|
|
manage_files_pattern(cups_pdf_t, cupsd_log_t, cupsd_log_t)
|
|
|
|
manage_files_pattern(cups_pdf_t, cups_pdf_tmp_t, cups_pdf_tmp_t)
|
|
manage_dirs_pattern(cups_pdf_t, cups_pdf_tmp_t, cups_pdf_tmp_t)
|
|
files_tmp_filetrans(cups_pdf_t, cups_pdf_tmp_t, { file dir })
|
|
|
|
fs_rw_anon_inodefs_files(cups_pdf_t)
|
|
|
|
kernel_read_system_state(cups_pdf_t)
|
|
|
|
files_read_etc_files(cups_pdf_t)
|
|
files_read_usr_files(cups_pdf_t)
|
|
|
|
corecmd_exec_shell(cups_pdf_t)
|
|
corecmd_exec_bin(cups_pdf_t)
|
|
|
|
auth_use_nsswitch(cups_pdf_t)
|
|
|
|
miscfiles_read_localization(cups_pdf_t)
|
|
miscfiles_read_fonts(cups_pdf_t)
|
|
miscfiles_setattr_fonts_cache_dirs(cups_pdf_t)
|
|
|
|
userdom_home_filetrans_user_home_dir(cups_pdf_t)
|
|
userdom_user_home_dir_filetrans_pattern(cups_pdf_t, { file dir })
|
|
userdom_manage_user_home_content_dirs(cups_pdf_t)
|
|
userdom_manage_user_home_content_files(cups_pdf_t)
|
|
userdom_dontaudit_search_admin_dir(cups_pdf_t)
|
|
|
|
lpd_manage_spool(cups_pdf_t)
|
|
|
|
tunable_policy(`use_nfs_home_dirs',`
|
|
fs_search_auto_mountpoints(cups_pdf_t)
|
|
fs_manage_nfs_dirs(cups_pdf_t)
|
|
fs_manage_nfs_files(cups_pdf_t)
|
|
')
|
|
|
|
tunable_policy(`use_samba_home_dirs',`
|
|
fs_manage_cifs_dirs(cups_pdf_t)
|
|
fs_manage_cifs_files(cups_pdf_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
gnome_read_config(cups_pdf_t)
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# HPLIP local policy
|
|
#
|
|
|
|
# Needed for USB Scanneer and xsane
|
|
allow hplip_t self:capability { dac_override dac_read_search net_raw };
|
|
dontaudit hplip_t self:capability sys_tty_config;
|
|
allow hplip_t self:fifo_file rw_fifo_file_perms;
|
|
allow hplip_t self:process signal_perms;
|
|
allow hplip_t self:unix_dgram_socket create_socket_perms;
|
|
allow hplip_t self:unix_stream_socket create_socket_perms;
|
|
allow hplip_t self:netlink_route_socket r_netlink_socket_perms;
|
|
allow hplip_t self:tcp_socket create_stream_socket_perms;
|
|
allow hplip_t self:udp_socket create_socket_perms;
|
|
allow hplip_t self:rawip_socket create_socket_perms;
|
|
|
|
allow hplip_t cupsd_etc_t:dir search_dir_perms;
|
|
manage_dirs_pattern(hplip_t, cupsd_tmp_t, cupsd_tmp_t)
|
|
manage_files_pattern(hplip_t, cupsd_tmp_t, cupsd_tmp_t)
|
|
files_tmp_filetrans(hplip_t, cupsd_tmp_t, { file dir })
|
|
|
|
cups_stream_connect(hplip_t)
|
|
|
|
allow hplip_t hplip_etc_t:dir list_dir_perms;
|
|
read_files_pattern(hplip_t, hplip_etc_t, hplip_etc_t)
|
|
read_lnk_files_pattern(hplip_t, hplip_etc_t, hplip_etc_t)
|
|
files_search_etc(hplip_t)
|
|
|
|
manage_files_pattern(hplip_t, hplip_var_lib_t, hplip_var_lib_t)
|
|
manage_lnk_files_pattern(hplip_t, hplip_var_lib_t, hplip_var_lib_t)
|
|
|
|
manage_fifo_files_pattern(hplip_t, hplip_tmp_t, hplip_tmp_t)
|
|
files_tmp_filetrans(hplip_t, hplip_tmp_t, fifo_file)
|
|
|
|
manage_files_pattern(hplip_t, hplip_var_run_t, hplip_var_run_t)
|
|
files_pid_filetrans(hplip_t, hplip_var_run_t, file)
|
|
|
|
kernel_read_system_state(hplip_t)
|
|
kernel_read_kernel_sysctls(hplip_t)
|
|
|
|
corenet_all_recvfrom_unlabeled(hplip_t)
|
|
corenet_all_recvfrom_netlabel(hplip_t)
|
|
corenet_tcp_sendrecv_generic_if(hplip_t)
|
|
corenet_udp_sendrecv_generic_if(hplip_t)
|
|
corenet_raw_sendrecv_generic_if(hplip_t)
|
|
corenet_tcp_sendrecv_generic_node(hplip_t)
|
|
corenet_udp_sendrecv_generic_node(hplip_t)
|
|
corenet_raw_sendrecv_generic_node(hplip_t)
|
|
corenet_tcp_sendrecv_all_ports(hplip_t)
|
|
corenet_udp_sendrecv_all_ports(hplip_t)
|
|
corenet_tcp_bind_generic_node(hplip_t)
|
|
corenet_udp_bind_generic_node(hplip_t)
|
|
corenet_tcp_bind_hplip_port(hplip_t)
|
|
corenet_tcp_connect_hplip_port(hplip_t)
|
|
corenet_tcp_connect_ipp_port(hplip_t)
|
|
corenet_sendrecv_hplip_client_packets(hplip_t)
|
|
corenet_receive_hplip_server_packets(hplip_t)
|
|
corenet_udp_bind_howl_port(hplip_t)
|
|
|
|
dev_read_sysfs(hplip_t)
|
|
dev_rw_printer(hplip_t)
|
|
dev_read_urand(hplip_t)
|
|
dev_read_rand(hplip_t)
|
|
dev_rw_generic_usb_dev(hplip_t)
|
|
dev_rw_usbfs(hplip_t)
|
|
|
|
fs_getattr_all_fs(hplip_t)
|
|
fs_search_auto_mountpoints(hplip_t)
|
|
fs_rw_anon_inodefs_files(hplip_t)
|
|
|
|
# for python
|
|
corecmd_exec_bin(hplip_t)
|
|
|
|
domain_use_interactive_fds(hplip_t)
|
|
|
|
files_read_etc_files(hplip_t)
|
|
files_read_etc_runtime_files(hplip_t)
|
|
files_read_usr_files(hplip_t)
|
|
|
|
logging_send_syslog_msg(hplip_t)
|
|
|
|
miscfiles_read_localization(hplip_t)
|
|
|
|
sysnet_read_config(hplip_t)
|
|
|
|
userdom_dontaudit_use_unpriv_user_fds(hplip_t)
|
|
userdom_dontaudit_search_user_home_dirs(hplip_t)
|
|
userdom_dontaudit_search_user_home_content(hplip_t)
|
|
|
|
lpd_read_config(hplip_t)
|
|
lpd_manage_spool(hplip_t)
|
|
|
|
optional_policy(`
|
|
dbus_system_bus_client(hplip_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
seutil_sigchld_newrole(hplip_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
snmp_read_snmp_var_lib_files(hplip_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
udev_read_db(hplip_t)
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# PTAL local policy
|
|
#
|
|
|
|
allow ptal_t self:capability { chown sys_rawio };
|
|
dontaudit ptal_t self:capability sys_tty_config;
|
|
allow ptal_t self:fifo_file rw_fifo_file_perms;
|
|
allow ptal_t self:unix_dgram_socket create_socket_perms;
|
|
allow ptal_t self:unix_stream_socket create_stream_socket_perms;
|
|
allow ptal_t self:tcp_socket create_stream_socket_perms;
|
|
|
|
allow ptal_t ptal_etc_t:dir list_dir_perms;
|
|
read_files_pattern(ptal_t, ptal_etc_t, ptal_etc_t)
|
|
read_lnk_files_pattern(ptal_t, ptal_etc_t, ptal_etc_t)
|
|
files_search_etc(ptal_t)
|
|
|
|
manage_dirs_pattern(ptal_t, ptal_var_run_t, ptal_var_run_t)
|
|
manage_files_pattern(ptal_t, ptal_var_run_t, ptal_var_run_t)
|
|
manage_lnk_files_pattern(ptal_t, ptal_var_run_t, ptal_var_run_t)
|
|
manage_fifo_files_pattern(ptal_t, ptal_var_run_t, ptal_var_run_t)
|
|
manage_sock_files_pattern(ptal_t, ptal_var_run_t, ptal_var_run_t)
|
|
files_pid_filetrans(ptal_t, ptal_var_run_t, { dir file lnk_file sock_file fifo_file })
|
|
|
|
kernel_read_kernel_sysctls(ptal_t)
|
|
kernel_list_proc(ptal_t)
|
|
kernel_read_proc_symlinks(ptal_t)
|
|
|
|
corenet_all_recvfrom_unlabeled(ptal_t)
|
|
corenet_all_recvfrom_netlabel(ptal_t)
|
|
corenet_tcp_sendrecv_generic_if(ptal_t)
|
|
corenet_tcp_sendrecv_generic_node(ptal_t)
|
|
corenet_tcp_sendrecv_all_ports(ptal_t)
|
|
corenet_tcp_bind_generic_node(ptal_t)
|
|
corenet_tcp_bind_ptal_port(ptal_t)
|
|
|
|
dev_read_sysfs(ptal_t)
|
|
dev_read_usbfs(ptal_t)
|
|
dev_rw_printer(ptal_t)
|
|
|
|
fs_getattr_all_fs(ptal_t)
|
|
fs_search_auto_mountpoints(ptal_t)
|
|
|
|
domain_use_interactive_fds(ptal_t)
|
|
|
|
files_read_etc_files(ptal_t)
|
|
files_read_etc_runtime_files(ptal_t)
|
|
|
|
logging_send_syslog_msg(ptal_t)
|
|
|
|
miscfiles_read_localization(ptal_t)
|
|
|
|
sysnet_read_config(ptal_t)
|
|
|
|
userdom_dontaudit_use_unpriv_user_fds(ptal_t)
|
|
userdom_dontaudit_search_user_home_content(ptal_t)
|
|
|
|
optional_policy(`
|
|
seutil_sigchld_newrole(ptal_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
udev_read_db(ptal_t)
|
|
')
|