308 lines
9.0 KiB
Plaintext
308 lines
9.0 KiB
Plaintext
#DESC Amanda - Automated backup program
|
|
#
|
|
# This policy file sets the rigths for amanda client started by inetd_t
|
|
# and amrecover
|
|
#
|
|
# X-Debian-Packages: amanda-common amanda-server
|
|
# Depends: inetd.te
|
|
# Author : Carsten Grohmann <carstengrohmann@gmx.de>
|
|
#
|
|
# License : GPL
|
|
#
|
|
# last change: 27. August 2002
|
|
#
|
|
# state : complete and tested
|
|
#
|
|
# Hints :
|
|
# - amanda.fc is the appendant file context file
|
|
# - If you use amrecover please extract the files and directories to the
|
|
# directory speficified in amanda.fc as type amanda_recover_dir_t.
|
|
# - The type amanda_user_exec_t is defined to label the files but not used.
|
|
# This configuration works only as an client and a amanda client does not need
|
|
# this programs.
|
|
#
|
|
# Enhancements/Corrections:
|
|
# - set tighter permissions to /bin/tar instead bin_t
|
|
|
|
##############################################################################
|
|
# AMANDA CLIENT DECLARATIONS
|
|
##############################################################################
|
|
|
|
# General declarations
|
|
######################
|
|
|
|
type amanda_t, domain, privlog, auth, nscd_client_domain ;
|
|
role system_r types amanda_t;
|
|
|
|
# type for the amanda executables
|
|
type amanda_exec_t, file_type, sysadmfile, exec_type;
|
|
|
|
# type for the amanda executables started by inetd
|
|
type amanda_inetd_exec_t, file_type, sysadmfile, exec_type;
|
|
|
|
# type for amanda configurations files
|
|
type amanda_config_t, file_type, sysadmfile;
|
|
|
|
# type for files in /usr/lib/amanda
|
|
type amanda_usr_lib_t, file_type, sysadmfile;
|
|
|
|
# type for all files in /var/lib/amanda
|
|
type amanda_var_lib_t, file_type, sysadmfile;
|
|
|
|
# type for all files in /var/lib/amanda/gnutar-lists/
|
|
type amanda_gnutarlists_t, file_type, sysadmfile;
|
|
|
|
# type for user startable files
|
|
type amanda_user_exec_t, file_type, sysadmfile, exec_type;
|
|
|
|
# type for same awk and other scripts
|
|
type amanda_script_exec_t, file_type, sysadmfile, exec_type;
|
|
|
|
# type for the shell configuration files
|
|
type amanda_shellconfig_t, file_type, sysadmfile;
|
|
|
|
tmp_domain(amanda)
|
|
|
|
# type for /etc/amandates
|
|
type amanda_amandates_t, file_type, sysadmfile;
|
|
|
|
# type for /etc/dumpdates
|
|
type amanda_dumpdates_t, file_type, sysadmfile;
|
|
|
|
# type for amanda data
|
|
type amanda_data_t, file_type, sysadmfile;
|
|
|
|
# Domain transitions
|
|
####################
|
|
|
|
domain_auto_trans(inetd_t, amanda_inetd_exec_t, amanda_t)
|
|
|
|
|
|
##################
|
|
# File permissions
|
|
##################
|
|
|
|
# configuration files -> read only
|
|
allow amanda_t amanda_config_t:file { getattr read };
|
|
allow amanda_t amanda_config_t:dir search;
|
|
|
|
# access to amanda_amandates_t
|
|
allow amanda_t amanda_amandates_t:file { getattr lock read write };
|
|
|
|
# access to amanda_dumpdates_t
|
|
allow amanda_t amanda_dumpdates_t:file { getattr lock read write };
|
|
|
|
# access to amandas data structure
|
|
allow amanda_t amanda_data_t:dir { read search write };
|
|
allow amanda_t amanda_data_t:file { read write };
|
|
|
|
# access to proc_t
|
|
allow amanda_t proc_t:dir { getattr search };
|
|
allow amanda_t proc_t:file { getattr read };
|
|
|
|
# access to etc_t and similar
|
|
allow amanda_t etc_t:dir { getattr search };
|
|
allow amanda_t etc_t:file { getattr read };
|
|
allow amanda_t etc_runtime_t:file { getattr read };
|
|
|
|
# access to var_t and similar
|
|
allow amanda_t var_t:dir search;
|
|
allow amanda_t var_lib_t:dir search;
|
|
allow amanda_t amanda_var_lib_t:dir search;
|
|
|
|
# access to amanda_gnutarlists_t (/var/lib/amanda/gnutar-lists)
|
|
allow amanda_t amanda_gnutarlists_t:dir { add_name read remove_name search write };
|
|
allow amanda_t amanda_gnutarlists_t:file { create getattr read rename setattr unlink write };
|
|
|
|
# access to var_run_t
|
|
allow amanda_t var_run_t:dir search;
|
|
|
|
# access to var_log_t
|
|
allow amanda_t var_log_t:dir getattr;
|
|
|
|
# access to var_spool_t
|
|
allow amanda_t var_spool_t:dir getattr;
|
|
|
|
# access to amanda_usr_lib_t
|
|
allow amanda_t amanda_usr_lib_t:dir search;
|
|
|
|
# access to device_t and similar
|
|
allow amanda_t device_t:dir search;
|
|
allow amanda_t null_device_t:chr_file { getattr read write };
|
|
allow amanda_t devpts_t:dir getattr;
|
|
allow amanda_t fixed_disk_device_t:blk_file getattr;
|
|
allow amanda_t removable_device_t:blk_file getattr;
|
|
allow amanda_t devtty_t:chr_file { read write };
|
|
|
|
# access to boot_t
|
|
allow amanda_t boot_t:dir getattr;
|
|
|
|
# access to fs_t
|
|
allow amanda_t fs_t:filesystem getattr;
|
|
|
|
# access to sysctl_kernel_t ( proc/sys/kernel/* )
|
|
read_sysctl(amanda_t)
|
|
|
|
#####################
|
|
# process permissions
|
|
#####################
|
|
|
|
# Allow to use shared libs
|
|
uses_shlib(amanda_t)
|
|
|
|
# Allow to execute a amanda executable file
|
|
allow amanda_t amanda_exec_t:file { execute execute_no_trans getattr read };
|
|
|
|
# Allow to run a shell
|
|
allow amanda_t shell_exec_t:file { execute execute_no_trans getattr read };
|
|
|
|
# access to bin_t (tar)
|
|
allow amanda_t bin_t:file { execute execute_no_trans };
|
|
|
|
allow amanda_t self:capability { chown dac_override setuid };
|
|
allow amanda_t self:process { fork sigchld };
|
|
allow amanda_t self:unix_dgram_socket create;
|
|
|
|
|
|
###################################
|
|
# Network and process communication
|
|
###################################
|
|
|
|
can_network_server(amanda_t);
|
|
can_ypbind(amanda_t);
|
|
|
|
allow amanda_t self:fifo_file { getattr read write ioctl lock };
|
|
allow amanda_t self:unix_stream_socket { connect create read write };
|
|
|
|
|
|
##########################
|
|
# Communication with inetd
|
|
##########################
|
|
|
|
allow amanda_t inetd_t:udp_socket { read write };
|
|
|
|
|
|
###################
|
|
# inetd permissions
|
|
###################
|
|
|
|
allow inetd_t amanda_usr_lib_t:dir search;
|
|
|
|
|
|
########################
|
|
# Access to to save data
|
|
########################
|
|
|
|
# access to user_home_t
|
|
allow amanda_t { user_home_dir_type user_home_type }:dir { search getattr read };
|
|
allow amanda_t user_home_type:file { getattr read };
|
|
|
|
# access to file_t ( /floppy, /cdrom )
|
|
allow amanda_t mnt_t:dir getattr;
|
|
|
|
###########
|
|
# Dontaudit
|
|
###########
|
|
dontaudit amanda_t lost_found_t:dir { getattr read };
|
|
|
|
|
|
##############################################################################
|
|
# AMANDA RECOVER DECLARATIONS
|
|
##############################################################################
|
|
|
|
|
|
# General declarations
|
|
######################
|
|
|
|
# type for amrecover
|
|
type amanda_recover_t, domain;
|
|
role sysadm_r types { amanda_recover_t amanda_recover_dir_t };
|
|
|
|
# exec types for amrecover
|
|
type amanda_recover_exec_t, file_type, sysadmfile, exec_type;
|
|
|
|
# type for recover files ( restored data )
|
|
type amanda_recover_dir_t, file_type, sysadmfile;
|
|
file_type_auto_trans(amanda_recover_t, sysadm_home_dir_t, amanda_recover_dir_t)
|
|
|
|
# domain transsition
|
|
domain_auto_trans(sysadm_t, amanda_recover_exec_t, amanda_recover_t)
|
|
|
|
# file type auto trans to write debug messages
|
|
file_type_auto_trans(amanda_recover_t, tmp_t, amanda_tmp_t)
|
|
|
|
|
|
# amanda recover process permissions
|
|
####################################
|
|
|
|
uses_shlib(amanda_recover_t)
|
|
allow amanda_recover_t self:process { fork sigkill sigstop sigchld signal };
|
|
allow amanda_recover_t self:capability { fowner fsetid setgid setuid chown dac_override net_bind_service };
|
|
allow amanda_recover_t shell_exec_t:file { execute execute_no_trans getattr read };
|
|
allow amanda_recover_t privfd:fd use;
|
|
|
|
|
|
# amrecover network and process communication
|
|
#############################################
|
|
|
|
can_network_server(amanda_recover_t);
|
|
can_ypbind(amanda_recover_t);
|
|
|
|
allow amanda_recover_t self:fifo_file { getattr ioctl read write };
|
|
allow amanda_recover_t self:unix_stream_socket { connect create read write };
|
|
|
|
|
|
# amrecover file permissions
|
|
############################
|
|
|
|
# access to etc_t and similar
|
|
allow amanda_recover_t etc_t:dir search;
|
|
allow amanda_recover_t etc_t:file { getattr read };
|
|
allow amanda_recover_t etc_runtime_t:file { getattr read };
|
|
|
|
# access to amanda_recover_dir_t
|
|
allow amanda_recover_t amanda_recover_dir_t:dir { add_name remove_name search write };
|
|
allow amanda_recover_t amanda_recover_dir_t:file { append create getattr setattr unlink };
|
|
|
|
# access to var_t and var_run_t
|
|
allow amanda_recover_t var_t:dir search;
|
|
allow amanda_recover_t var_run_t:dir search;
|
|
|
|
# access to proc_t
|
|
allow amanda_recover_t proc_t:dir search;
|
|
allow amanda_recover_t proc_t:file { getattr read };
|
|
|
|
# access to sysctl_kernel_t
|
|
read_sysctl(amanda_recover_t)
|
|
|
|
# access to dev_t and similar
|
|
allow amanda_recover_t device_t:dir search;
|
|
allow amanda_recover_t devtty_t:chr_file { read write };
|
|
allow amanda_recover_t null_device_t:chr_file { getattr write };
|
|
|
|
# access to bin_t
|
|
allow amanda_recover_t bin_t:file { execute execute_no_trans };
|
|
|
|
# access to sysadm_home_t and sysadm_home_dir_t to start amrecover
|
|
# in the sysadm home directory
|
|
allow amanda_recover_t { sysadm_home_dir_t sysadm_home_t }:dir { search getattr };
|
|
|
|
# access to use sysadm_tty_device_t (/dev/tty?)
|
|
allow amanda_recover_t sysadm_tty_device_t:chr_file { getattr ioctl read write };
|
|
|
|
# access to amanda_tmp_t and tmp_t
|
|
allow amanda_recover_t amanda_tmp_t:dir { add_name remove_name search write };
|
|
allow amanda_recover_t amanda_tmp_t:file { append create getattr setattr unlink };
|
|
allow amanda_recover_t tmp_t:dir search;
|
|
|
|
#
|
|
# Rules to allow amanda to be run as a service in xinetd
|
|
#
|
|
type amanda_port_t, port_type;
|
|
allow inetd_t amanda_port_t:{ tcp_socket udp_socket } name_bind;
|
|
|
|
allow amanda_t file_type:dir {getattr read search };
|
|
allow amanda_t file_type:file {getattr read };
|
|
logdir_domain(amanda)
|
|
|