rpms
/
selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity
selinux-policy/policy-rawhide-contrib-apac...

2115 lines
83 KiB
Diff
Raw Blame History

diff --git a/apache.if b/apache.if
index fac6fe5..804867a 100644
--- a/apache.if
+++ b/apache.if
@@ -14,99 +14,123 @@
template(`apache_content_template',`
gen_require(`
attribute httpd_exec_scripts, httpd_script_exec_type;
- type httpd_t, httpd_suexec_t, httpd_log_t;
- type httpd_sys_content_t;
+ type httpd_t, httpd_suexec_t;
attribute httpd_script_type, httpd_content_type;
')
#This type is for webpages
- type httpd_$1_content_t; # customizable;
- typeattribute httpd_$1_content_t httpd_content_type;
- typealias httpd_$1_content_t alias httpd_$1_script_ro_t;
- files_type(httpd_$1_content_t)
+ type $1_content_t; # customizable;
+ typeattribute $1_content_t httpd_content_type;
+ typealias $1_content_t alias httpd_$1_script_ro_t;
+ files_type($1_content_t)
# This type is used for .htaccess files
- type httpd_$1_htaccess_t, httpd_content_type; # customizable;
- typeattribute httpd_$1_htaccess_t httpd_content_type;
- files_type(httpd_$1_htaccess_t)
+ type $1_htaccess_t, httpd_content_type; # customizable;
+ typeattribute $1_htaccess_t httpd_content_type;
+ files_type($1_htaccess_t)
# Type that CGI scripts run as
- type httpd_$1_script_t, httpd_script_type;
- domain_type(httpd_$1_script_t)
- role system_r types httpd_$1_script_t;
+ type $1_script_t, httpd_script_type;
+ domain_type($1_script_t)
+ role system_r types $1_script_t;
- kernel_read_system_state(httpd_$1_script_t)
+ kernel_read_system_state($1_script_t)
# This type is used for executable scripts files
- type httpd_$1_script_exec_t, httpd_script_exec_type; # customizable;
- typeattribute httpd_$1_script_exec_t httpd_content_type;
- domain_entry_file(httpd_$1_script_t, httpd_$1_script_exec_t)
+ type $1_script_exec_t, httpd_script_exec_type; # customizable;
+ typeattribute $1_script_exec_t httpd_content_type;
+ domain_entry_file($1_script_t, $1_script_exec_t)
- type httpd_$1_rw_content_t; # customizable
- typeattribute httpd_$1_rw_content_t httpd_content_type;
- typealias httpd_$1_rw_content_t alias { httpd_$1_script_rw_t httpd_$1_content_rw_t };
- files_type(httpd_$1_rw_content_t)
+ type $1_rw_content_t; # customizable
+ typeattribute $1_rw_content_t httpd_content_type;
+ typealias $1_rw_content_t alias { $1_script_rw_t };
+ files_type($1_rw_content_t)
- type httpd_$1_ra_content_t, httpd_content_type; # customizable
- typeattribute httpd_$1_ra_content_t httpd_content_type;
- typealias httpd_$1_ra_content_t alias { httpd_$1_script_ra_t httpd_$1_content_ra_t };
- files_type(httpd_$1_ra_content_t)
+ type $1_ra_content_t, httpd_content_type; # customizable
+ typeattribute $1_ra_content_t httpd_content_type;
+ typealias $1_ra_content_t alias { $1_script_ra_t $1_content_ra_t };
+ files_type($1_ra_content_t)
# Allow the script process to search the cgi directory, and users directory
- allow httpd_$1_script_t httpd_$1_content_t:dir search_dir_perms;
+ allow $1_script_t $1_content_t:dir search_dir_perms;
- can_exec(httpd_$1_script_t, httpd_$1_script_exec_t)
- allow httpd_$1_script_t httpd_$1_script_exec_t:dir list_dir_perms;
+ can_exec($1_script_t, $1_script_exec_t)
+ allow $1_script_t $1_script_exec_t:dir list_dir_perms;
- allow httpd_$1_script_t httpd_$1_ra_content_t:dir { list_dir_perms add_entry_dir_perms };
- read_files_pattern(httpd_$1_script_t, httpd_$1_ra_content_t, httpd_$1_ra_content_t)
- append_files_pattern(httpd_$1_script_t, httpd_$1_ra_content_t, httpd_$1_ra_content_t)
- create_files_pattern(httpd_$1_script_t, httpd_$1_ra_content_t, httpd_$1_ra_content_t)
- read_lnk_files_pattern(httpd_$1_script_t, httpd_$1_ra_content_t, httpd_$1_ra_content_t)
+ allow $1_script_t $1_ra_content_t:dir { list_dir_perms add_entry_dir_perms };
+ read_files_pattern($1_script_t, $1_ra_content_t, $1_ra_content_t)
+ append_files_pattern($1_script_t, $1_ra_content_t, $1_ra_content_t)
+ create_files_pattern($1_script_t, $1_ra_content_t, $1_ra_content_t)
+ read_lnk_files_pattern($1_script_t, $1_ra_content_t, $1_ra_content_t)
- allow httpd_$1_script_t httpd_$1_content_t:dir list_dir_perms;
- read_files_pattern(httpd_$1_script_t, httpd_$1_content_t, httpd_$1_content_t)
- read_lnk_files_pattern(httpd_$1_script_t, httpd_$1_content_t, httpd_$1_content_t)
+ allow $1_script_t $1_content_t:dir list_dir_perms;
+ read_files_pattern($1_script_t, $1_content_t, $1_content_t)
+ read_lnk_files_pattern($1_script_t, $1_content_t, $1_content_t)
- manage_dirs_pattern(httpd_$1_script_t, httpd_$1_rw_content_t, httpd_$1_rw_content_t)
- manage_files_pattern(httpd_$1_script_t, httpd_$1_rw_content_t, httpd_$1_rw_content_t)
- manage_lnk_files_pattern(httpd_$1_script_t, httpd_$1_rw_content_t, httpd_$1_rw_content_t)
- manage_fifo_files_pattern(httpd_$1_script_t, httpd_$1_rw_content_t, httpd_$1_rw_content_t)
- manage_sock_files_pattern(httpd_$1_script_t, httpd_$1_rw_content_t, httpd_$1_rw_content_t)
+ manage_dirs_pattern($1_script_t, $1_rw_content_t, $1_rw_content_t)
+ manage_files_pattern($1_script_t, $1_rw_content_t, $1_rw_content_t)
+ manage_lnk_files_pattern($1_script_t, $1_rw_content_t, $1_rw_content_t)
+ manage_fifo_files_pattern($1_script_t, $1_rw_content_t, $1_rw_content_t)
+ manage_sock_files_pattern($1_script_t, $1_rw_content_t, $1_rw_content_t)
# Allow the web server to run scripts and serve pages
tunable_policy(`httpd_builtin_scripting',`
- manage_dirs_pattern(httpd_t, httpd_$1_rw_content_t, httpd_$1_rw_content_t)
- manage_files_pattern(httpd_t, httpd_$1_rw_content_t, httpd_$1_rw_content_t)
- manage_lnk_files_pattern(httpd_t, httpd_$1_rw_content_t, httpd_$1_rw_content_t)
- rw_sock_files_pattern(httpd_t, httpd_$1_rw_content_t, httpd_$1_rw_content_t)
+ manage_dirs_pattern(httpd_t, $1_rw_content_t, $1_rw_content_t)
+ manage_files_pattern(httpd_t, $1_rw_content_t, $1_rw_content_t)
+ manage_lnk_files_pattern(httpd_t, $1_rw_content_t, $1_rw_content_t)
+ rw_sock_files_pattern(httpd_t, $1_rw_content_t, $1_rw_content_t)
- allow httpd_t httpd_$1_ra_content_t:dir { add_entry_dir_perms };
- read_files_pattern(httpd_t, httpd_$1_ra_content_t, httpd_$1_ra_content_t)
- append_files_pattern(httpd_t, httpd_$1_ra_content_t, httpd_$1_ra_content_t)
- create_files_pattern(httpd_t, httpd_$1_ra_content_t, httpd_$1_ra_content_t)
- read_lnk_files_pattern(httpd_t, httpd_$1_ra_content_t, httpd_$1_ra_content_t)
+ allow httpd_t $1_ra_content_t:dir { add_entry_dir_perms };
+ read_files_pattern(httpd_t, $1_ra_content_t, $1_ra_content_t)
+ append_files_pattern(httpd_t, $1_ra_content_t, $1_ra_content_t)
+ create_files_pattern(httpd_t, $1_ra_content_t, $1_ra_content_t)
+ read_lnk_files_pattern(httpd_t, $1_ra_content_t, $1_ra_content_t)
')
tunable_policy(`httpd_enable_cgi',`
- allow httpd_$1_script_t httpd_$1_script_exec_t:file entrypoint;
+ allow $1_script_t $1_script_exec_t:file entrypoint;
- domtrans_pattern(httpd_suexec_t, httpd_$1_script_exec_t, httpd_$1_script_t)
+ domtrans_pattern(httpd_suexec_t, $1_script_exec_t, $1_script_t)
# privileged users run the script:
- domtrans_pattern(httpd_exec_scripts, httpd_$1_script_exec_t, httpd_$1_script_t)
+ domtrans_pattern(httpd_exec_scripts, $1_script_exec_t, $1_script_t)
- allow httpd_exec_scripts httpd_$1_script_exec_t:file read_file_perms;
+ allow httpd_exec_scripts $1_script_exec_t:file read_file_perms;
# apache runs the script:
- domtrans_pattern(httpd_t, httpd_$1_script_exec_t, httpd_$1_script_t)
- allow httpd_t httpd_$1_script_t:unix_dgram_socket sendto;
+ domtrans_pattern(httpd_t, $1_script_exec_t, $1_script_t)
+ allow httpd_t $1_script_t:unix_dgram_socket sendto;
')
')
########################################
## <summary>
+## Create a set of derived types for apache
+## web content.
+## </summary>
+## <param name="prefix">
+## <summary>
+## The prefix to be used for deriving new type names.
+## </summary>
+## </param>
+## <param name="oldprefix">
+## <summary>
+## The prefix to be used for deriving old type names.
+## </summary>
+## </param>
+#
+template(`apache_content_alias_template',`
+ typealias $1_htaccess_t alias httpd_$2_htaccess_t;
+ typealias $1_script_t alias httpd_$2_script_t;
+ typealias $1_script_exec_t alias httpd_$2_script_exec_t;
+ typealias $1_content_t alias httpd_$2_content_t;
+ typealias $1_rw_content_t alias httpd_$2_script_rw_content_t;
+ typealias $1_ra_content_t alias httpd_$2_script_ra_content_t;
+')
+
+########################################
+## <summary>
## Role access for apache
## </summary>
## <param name="role">
diff --git a/apache.te b/apache.te
index 0e09bca..85e992e 100644
--- a/apache.te
+++ b/apache.te
@@ -370,7 +370,7 @@ type httpd_suexec_tmp_t;
files_tmp_file(httpd_suexec_tmp_t)
# setup the system domain for system CGI scripts
-apache_content_template(sys)
+apache_content_template(httpd_sys)
typeattribute httpd_sys_content_t httpdcontent; # customizable
typeattribute httpd_sys_rw_content_t httpdcontent; # customizable
@@ -389,7 +389,7 @@ files_tmp_file(httpd_tmp_t)
type httpd_tmpfs_t;
files_tmpfs_file(httpd_tmpfs_t)
-apache_content_template(user)
+apache_content_template(httpd_user)
ubac_constrained(httpd_user_script_t)
typeattribute httpd_user_content_t httpdcontent;
@@ -1619,6 +1619,7 @@ allow httpd_t httpd_script_exec_type:dir list_dir_perms;
allow httpd_script_type self:process { setsched signal_perms };
allow httpd_script_type self:unix_stream_socket create_stream_socket_perms;
allow httpd_script_type self:unix_dgram_socket create_socket_perms;
+allow httpd_script_type httpd_t:unix_stream_socket rw_stream_socket_perms;
allow httpd_script_type httpd_t:fd use;
allow httpd_script_type httpd_t:process sigchld;
diff --git a/apcupsd.fc b/apcupsd.fc
index 1c37fe1..274704f 100644
--- a/apcupsd.fc
+++ b/apcupsd.fc
@@ -14,8 +14,8 @@
/var/run/apcupsd\.pid -- gen_context(system_u:object_r:apcupsd_var_run_t,s0)
-/var/www/apcupsd/multimon\.cgi -- gen_context(system_u:object_r:httpd_apcupsd_cgi_script_exec_t,s0)
-/var/www/apcupsd/upsfstats\.cgi -- gen_context(system_u:object_r:httpd_apcupsd_cgi_script_exec_t,s0)
-/var/www/apcupsd/upsimage\.cgi -- gen_context(system_u:object_r:httpd_apcupsd_cgi_script_exec_t,s0)
-/var/www/apcupsd/upsstats\.cgi -- gen_context(system_u:object_r:httpd_apcupsd_cgi_script_exec_t,s0)
-/var/www/cgi-bin/apcgui(/.*)? gen_context(system_u:object_r:httpd_apcupsd_cgi_script_exec_t,s0)
+/var/www/apcupsd/multimon\.cgi -- gen_context(system_u:object_r:apcupsd_cgi_script_exec_t,s0)
+/var/www/apcupsd/upsfstats\.cgi -- gen_context(system_u:object_r:apcupsd_cgi_script_exec_t,s0)
+/var/www/apcupsd/upsimage\.cgi -- gen_context(system_u:object_r:apcupsd_cgi_script_exec_t,s0)
+/var/www/apcupsd/upsstats\.cgi -- gen_context(system_u:object_r:apcupsd_cgi_script_exec_t,s0)
+/var/www/cgi-bin/apcgui(/.*)? gen_context(system_u:object_r:apcupsd_cgi_script_exec_t,s0)
diff --git a/apcupsd.if b/apcupsd.if
index b6afc90..9c06313 100644
--- a/apcupsd.if
+++ b/apcupsd.if
@@ -102,7 +102,7 @@ interface(`apcupsd_append_log',`
########################################
## <summary>
## Execute a domain transition to
-## run httpd_apcupsd_cgi_script.
+## run apcupsd_cgi_script.
## </summary>
## <param name="domain">
## <summary>
@@ -112,11 +112,11 @@ interface(`apcupsd_append_log',`
#
interface(`apcupsd_cgi_script_domtrans',`
gen_require(`
- type httpd_apcupsd_cgi_script_t, httpd_apcupsd_cgi_script_exec_t;
+ type apcupsd_cgi_script_t, apcupsd_cgi_script_exec_t;
')
files_search_var($1)
- domtrans_pattern($1, httpd_apcupsd_cgi_script_exec_t, httpd_apcupsd_cgi_script_t)
+ domtrans_pattern($1, apcupsd_cgi_script_exec_t, apcupsd_cgi_script_t)
optional_policy(`
apache_search_sys_content($1)
diff --git a/apcupsd.te b/apcupsd.te
index b4c43c7..11c215a 100644
--- a/apcupsd.te
+++ b/apcupsd.te
@@ -116,19 +116,20 @@ optional_policy(`
optional_policy(`
apache_content_template(apcupsd_cgi)
-
- allow httpd_apcupsd_cgi_script_t self:tcp_socket create_stream_socket_perms;
- allow httpd_apcupsd_cgi_script_t self:udp_socket create_socket_perms;
-
- corenet_all_recvfrom_netlabel(httpd_apcupsd_cgi_script_t)
- corenet_tcp_sendrecv_generic_if(httpd_apcupsd_cgi_script_t)
- corenet_tcp_sendrecv_generic_node(httpd_apcupsd_cgi_script_t)
- corenet_tcp_sendrecv_all_ports(httpd_apcupsd_cgi_script_t)
- corenet_sendrecv_apcupsd_client_packets(httpd_apcupsd_cgi_script_t)
- corenet_tcp_connect_apcupsd_port(httpd_apcupsd_cgi_script_t)
- corenet_udp_sendrecv_generic_if(httpd_apcupsd_cgi_script_t)
- corenet_udp_sendrecv_generic_node(httpd_apcupsd_cgi_script_t)
- corenet_udp_sendrecv_all_ports(httpd_apcupsd_cgi_script_t)
-
- sysnet_dns_name_resolve(httpd_apcupsd_cgi_script_t)
+ apache_content_alias_template(apcupsd_cgi, apcupsd_cgi)
+
+ allow apcupsd_cgi_script_t self:tcp_socket create_stream_socket_perms;
+ allow apcupsd_cgi_script_t self:udp_socket create_socket_perms;
+
+ corenet_all_recvfrom_netlabel(apcupsd_cgi_script_t)
+ corenet_tcp_sendrecv_generic_if(apcupsd_cgi_script_t)
+ corenet_tcp_sendrecv_generic_node(apcupsd_cgi_script_t)
+ corenet_tcp_sendrecv_all_ports(apcupsd_cgi_script_t)
+ corenet_sendrecv_apcupsd_client_packets(apcupsd_cgi_script_t)
+ corenet_tcp_connect_apcupsd_port(apcupsd_cgi_script_t)
+ corenet_udp_sendrecv_generic_if(apcupsd_cgi_script_t)
+ corenet_udp_sendrecv_generic_node(apcupsd_cgi_script_t)
+ corenet_udp_sendrecv_all_ports(apcupsd_cgi_script_t)
+
+ sysnet_dns_name_resolve(apcupsd_cgi_script_t)
')
diff --git a/awstats.fc b/awstats.fc
index 11e6d5f..73b4ea4 100644
--- a/awstats.fc
+++ b/awstats.fc
@@ -1,5 +1,5 @@
/usr/share/awstats/tools/.+\.pl -- gen_context(system_u:object_r:awstats_exec_t,s0)
-/usr/share/awstats/wwwroot(/.*)? gen_context(system_u:object_r:httpd_awstats_content_t,s0)
-/usr/share/awstats/wwwroot/cgi-bin(/.*)? gen_context(system_u:object_r:httpd_awstats_script_exec_t,s0)
+/usr/share/awstats/wwwroot(/.*)? gen_context(system_u:object_r:awstats_content_t,s0)
+/usr/share/awstats/wwwroot/cgi-bin(/.*)? gen_context(system_u:object_r:awstats_script_exec_t,s0)
/var/lib/awstats(/.*)? gen_context(system_u:object_r:awstats_var_lib_t,s0)
diff --git a/awstats.te b/awstats.te
index c222135..ffbf2cb 100644
--- a/awstats.te
+++ b/awstats.te
@@ -26,6 +26,7 @@ type awstats_var_lib_t;
files_type(awstats_var_lib_t)
apache_content_template(awstats)
+apache_content_alias_template(awstats, awstats)
########################################
#
@@ -40,9 +41,9 @@ files_tmp_filetrans(awstats_t, awstats_tmp_t, { dir file })
manage_files_pattern(awstats_t, awstats_var_lib_t, awstats_var_lib_t)
-allow awstats_t { httpd_awstats_content_t httpd_awstats_script_exec_t }:dir search_dir_perms;
+allow awstats_t { awstats_content_t awstats_script_exec_t }:dir search_dir_perms;
-can_exec(awstats_t, { awstats_exec_t httpd_awstats_script_exec_t })
+can_exec(awstats_t, { awstats_exec_t awstats_script_exec_t })
kernel_dontaudit_read_system_state(awstats_t)
@@ -86,13 +87,13 @@ optional_policy(`
# CGI local policy
#
-apache_read_log(httpd_awstats_script_t)
+apache_read_log(awstats_script_t)
-manage_dirs_pattern(httpd_awstats_script_t, awstats_tmp_t, awstats_tmp_t)
-manage_files_pattern(httpd_awstats_script_t, awstats_tmp_t, awstats_tmp_t)
-files_tmp_filetrans(httpd_awstats_script_t, awstats_tmp_t, { dir file })
+manage_dirs_pattern(awstats_script_t, awstats_tmp_t, awstats_tmp_t)
+manage_files_pattern(awstats_script_t, awstats_tmp_t, awstats_tmp_t)
+files_tmp_filetrans(awstats_script_t, awstats_tmp_t, { dir file })
-allow httpd_awstats_script_t awstats_var_lib_t:dir list_dir_perms;
+allow awstats_script_t awstats_var_lib_t:dir list_dir_perms;
-read_files_pattern(httpd_awstats_script_t, awstats_var_lib_t, awstats_var_lib_t)
-files_search_var_lib(httpd_awstats_script_t)
+read_files_pattern(awstats_script_t, awstats_var_lib_t, awstats_var_lib_t)
+files_search_var_lib(awstats_script_t)
diff --git a/bugzilla.fc b/bugzilla.fc
index fb6e397..9efceac 100644
--- a/bugzilla.fc
+++ b/bugzilla.fc
@@ -1,4 +1,4 @@
-/usr/share/bugzilla(/.*)? gen_context(system_u:object_r:httpd_bugzilla_content_t,s0)
-/usr/share/bugzilla/.*\.cgi -- gen_context(system_u:object_r:httpd_bugzilla_script_exec_t,s0)
+/usr/share/bugzilla(/.*)? gen_context(system_u:object_r:bugzilla_content_t,s0)
+/usr/share/bugzilla/.*\.cgi -- gen_context(system_u:object_r:bugzilla_script_exec_t,s0)
-/var/lib/bugzilla(/.*)? gen_context(system_u:object_r:httpd_bugzilla_rw_content_t,s0)
+/var/lib/bugzilla(/.*)? gen_context(system_u:object_r:bugzilla_rw_content_t,s0)
diff --git a/bugzilla.if b/bugzilla.if
index bf0cefa..d9ea246 100644
--- a/bugzilla.if
+++ b/bugzilla.if
@@ -12,10 +12,10 @@
#
interface(`bugzilla_search_content',`
gen_require(`
- type httpd_bugzilla_content_t;
+ type bugzilla_content_t;
')
- allow $1 httpd_bugzilla_content_t:dir search_dir_perms;
+ allow $1 bugzilla_content_t:dir search_dir_perms;
')
########################################
@@ -32,10 +32,10 @@ interface(`bugzilla_search_content',`
#
interface(`bugzilla_dontaudit_rw_stream_sockets',`
gen_require(`
- type httpd_bugzilla_script_t;
+ type bugzilla_script_t;
')
- dontaudit $1 httpd_bugzilla_script_t:unix_stream_socket { read write };
+ dontaudit $1 bugzilla_script_t:unix_stream_socket { read write };
')
########################################
@@ -51,32 +51,32 @@ interface(`bugzilla_dontaudit_rw_stream_sockets',`
#
interface(`bugzilla_admin',`
gen_require(`
- type httpd_bugzilla_script_t, httpd_bugzilla_content_t, httpd_bugzilla_ra_content_t;
- type httpd_bugzilla_rw_content_t, httpd_bugzilla_script_exec_t;
- type httpd_bugzilla_htaccess_t, httpd_bugzilla_tmp_t;
+ type bugzilla_script_t, bugzilla_content_t, bugzilla_ra_content_t;
+ type bugzilla_rw_content_t, bugzilla_script_exec_t;
+ type bugzilla_htaccess_t, bugzilla_tmp_t;
')
- allow $1 httpd_bugzilla_script_t:process signal_perms;
- ps_process_pattern($1, httpd_bugzilla_script_t)
+ allow $1 bugzilla_script_t:process signal_perms;
+ ps_process_pattern($1, bugzilla_script_t)
tunable_policy(`deny_ptrace',`',`
- allow $1 httpd_bugzilla_script_t:process ptrace;
+ allow $1 bugzilla_script_t:process ptrace;
')
files_list_tmp($1)
- admin_pattern($1, httpd_bugzilla_tmp_t)
+ admin_pattern($1, bugzilla_tmp_t)
- files_list_var_lib(httpd_bugzilla_script_t)
+ files_list_var_lib(bugzilla_script_t)
- admin_pattern($1, httpd_bugzilla_script_exec_t)
- admin_pattern($1, httpd_bugzilla_script_t)
- admin_pattern($1, httpd_bugzilla_content_t)
- admin_pattern($1, httpd_bugzilla_htaccess_t)
- admin_pattern($1, httpd_bugzilla_ra_content_t)
+ admin_pattern($1, bugzilla_script_exec_t)
+ admin_pattern($1, bugzilla_script_t)
+ admin_pattern($1, bugzilla_content_t)
+ admin_pattern($1, bugzilla_htaccess_t)
+ admin_pattern($1, bugzilla_ra_content_t)
files_search_tmp($1)
files_search_var_lib($1)
- admin_pattern($1, httpd_bugzilla_rw_content_t)
+ admin_pattern($1, bugzilla_rw_content_t)
optional_policy(`
apache_list_sys_content($1)
diff --git a/bugzilla.te b/bugzilla.te
index d9f3061..c62f617 100644
--- a/bugzilla.te
+++ b/bugzilla.te
@@ -6,54 +6,55 @@ policy_module(bugzilla, 1.1.0)
#
apache_content_template(bugzilla)
+apache_content_alias_template(bugzilla, bugzilla)
-type httpd_bugzilla_tmp_t;
-files_tmp_file(httpd_bugzilla_tmp_t)
+type bugzilla_tmp_t alias httpd_bugzilla_tmp_t;
+files_tmp_file(bugzilla_tmp_t)
########################################
#
# Local policy
#
-allow httpd_bugzilla_script_t self:tcp_socket { accept listen };
+allow bugzilla_script_t self:tcp_socket { accept listen };
-corenet_all_recvfrom_netlabel(httpd_bugzilla_script_t)
-corenet_tcp_sendrecv_generic_if(httpd_bugzilla_script_t)
-corenet_tcp_sendrecv_generic_node(httpd_bugzilla_script_t)
+corenet_all_recvfrom_netlabel(bugzilla_script_t)
+corenet_tcp_sendrecv_generic_if(bugzilla_script_t)
+corenet_tcp_sendrecv_generic_node(bugzilla_script_t)
-corenet_sendrecv_http_client_packets(httpd_bugzilla_script_t)
-corenet_tcp_connect_http_port(httpd_bugzilla_script_t)
-corenet_tcp_sendrecv_http_port(httpd_bugzilla_script_t)
+corenet_sendrecv_http_client_packets(bugzilla_script_t)
+corenet_tcp_connect_http_port(bugzilla_script_t)
+corenet_tcp_sendrecv_http_port(bugzilla_script_t)
-corenet_sendrecv_smtp_client_packets(httpd_bugzilla_script_t)
-corenet_tcp_connect_smtp_port(httpd_bugzilla_script_t)
-corenet_tcp_sendrecv_smtp_port(httpd_bugzilla_script_t)
+corenet_sendrecv_smtp_client_packets(bugzilla_script_t)
+corenet_tcp_connect_smtp_port(bugzilla_script_t)
+corenet_tcp_sendrecv_smtp_port(bugzilla_script_t)
-manage_dirs_pattern(httpd_bugzilla_script_t, httpd_bugzilla_tmp_t, httpd_bugzilla_tmp_t)
-manage_files_pattern(httpd_bugzilla_script_t, httpd_bugzilla_tmp_t, httpd_bugzilla_tmp_t)
-files_tmp_filetrans(httpd_bugzilla_script_t, httpd_bugzilla_tmp_t, { file dir })
+manage_dirs_pattern(bugzilla_script_t, bugzilla_tmp_t, bugzilla_tmp_t)
+manage_files_pattern(bugzilla_script_t, bugzilla_tmp_t, bugzilla_tmp_t)
+files_tmp_filetrans(bugzilla_script_t, bugzilla_tmp_t, { file dir })
-files_search_var_lib(httpd_bugzilla_script_t)
+files_search_var_lib(bugzilla_script_t)
-auth_read_passwd(httpd_bugzilla_script_t)
+auth_read_passwd(bugzilla_script_t)
-dev_read_sysfs(httpd_bugzilla_script_t)
+dev_read_sysfs(bugzilla_script_t)
-sysnet_read_config(httpd_bugzilla_script_t)
-sysnet_use_ldap(httpd_bugzilla_script_t)
+sysnet_read_config(bugzilla_script_t)
+sysnet_use_ldap(bugzilla_script_t)
-miscfiles_read_certs(httpd_bugzilla_script_t)
+miscfiles_read_certs(bugzilla_script_t)
optional_policy(`
- mta_send_mail(httpd_bugzilla_script_t)
+ mta_send_mail(bugzilla_script_t)
')
optional_policy(`
- mysql_stream_connect(httpd_bugzilla_script_t)
- mysql_tcp_connect(httpd_bugzilla_script_t)
+ mysql_stream_connect(bugzilla_script_t)
+ mysql_tcp_connect(bugzilla_script_t)
')
optional_policy(`
- postgresql_stream_connect(httpd_bugzilla_script_t)
- postgresql_tcp_connect(httpd_bugzilla_script_t)
+ postgresql_stream_connect(bugzilla_script_t)
+ postgresql_tcp_connect(bugzilla_script_t)
')
diff --git a/collectd.fc b/collectd.fc
index 2e7d7ed..8d70290 100644
--- a/collectd.fc
+++ b/collectd.fc
@@ -8,4 +8,4 @@
/var/run/collectd\.pid -- gen_context(system_u:object_r:collectd_var_run_t,s0)
-/usr/share/collectd/collection3/bin/.*\.cgi -- gen_context(system_u:object_r:httpd_collectd_script_exec_t,s0)
+/usr/share/collectd/collection3/bin/.*\.cgi -- gen_context(system_u:object_r:collectd_script_exec_t,s0)
diff --git a/collectd.te b/collectd.te
index dc0423c..d078b96 100644
--- a/collectd.te
+++ b/collectd.te
@@ -30,9 +30,10 @@ type collectd_unit_file_t;
systemd_unit_file(collectd_unit_file_t)
apache_content_template(collectd)
+apache_content_alias_template(collectd, collectd)
-type httpd_collectd_script_tmp_t;
-files_tmp_file(httpd_collectd_script_tmp_t)
+type collectd_script_tmp_t alias httpd_collectd_script_tmp_t;
+files_tmp_file(collectd_script_tmp_t)
########################################
#
@@ -102,13 +103,13 @@ optional_policy(`
#
-files_search_var_lib(httpd_collectd_script_t)
-read_files_pattern(httpd_collectd_script_t, collectd_var_lib_t, collectd_var_lib_t)
-list_dirs_pattern(httpd_collectd_script_t, collectd_var_lib_t, collectd_var_lib_t)
-miscfiles_setattr_fonts_cache_dirs(httpd_collectd_script_t)
+files_search_var_lib(collectd_script_t)
+read_files_pattern(collectd_script_t, collectd_var_lib_t, collectd_var_lib_t)
+list_dirs_pattern(collectd_script_t, collectd_var_lib_t, collectd_var_lib_t)
+miscfiles_setattr_fonts_cache_dirs(collectd_script_t)
-manage_dirs_pattern(httpd_collectd_script_t, httpd_collectd_script_tmp_t, httpd_collectd_script_tmp_t)
-manage_files_pattern(httpd_collectd_script_t, httpd_collectd_script_tmp_t, httpd_collectd_script_tmp_t)
-files_tmp_filetrans(httpd_collectd_script_t, httpd_collectd_script_tmp_t, { file dir })
+manage_dirs_pattern(collectd_script_t, collectd_script_tmp_t, collectd_script_tmp_t)
+manage_files_pattern(collectd_script_t, collectd_script_tmp_t, collectd_script_tmp_t)
+files_tmp_filetrans(collectd_script_t, collectd_script_tmp_t, { file dir })
-auth_read_passwd(httpd_collectd_script_t)
+auth_read_passwd(collectd_script_t)
diff --git a/cvs.fc b/cvs.fc
index 75c8be9..e07e602 100644
--- a/cvs.fc
+++ b/cvs.fc
@@ -4,10 +4,10 @@
/usr/bin/cvs -- gen_context(system_u:object_r:cvs_exec_t,s0)
-/usr/share/cvsweb/cvsweb\.cgi -- gen_context(system_u:object_r:httpd_cvs_script_exec_t,s0)
+/usr/share/cvsweb/cvsweb\.cgi -- gen_context(system_u:object_r:cvs_script_exec_t,s0)
/var/cvs(/.*)? gen_context(system_u:object_r:cvs_data_t,s0)
/var/run/cvs\.pid -- gen_context(system_u:object_r:cvs_var_run_t,s0)
-/var/www/cgi-bin/cvsweb\.cgi -- gen_context(system_u:object_r:httpd_cvs_script_exec_t,s0)
+/var/www/cgi-bin/cvsweb\.cgi -- gen_context(system_u:object_r:cvs_script_exec_t,s0)
diff --git a/cvs.te b/cvs.te
index f98a932..c3502c3 100644
--- a/cvs.te
+++ b/cvs.te
@@ -125,9 +125,10 @@ optional_policy(`
optional_policy(`
apache_content_template(cvs)
+ apache_content_alias_template(cvs, cvs)
- read_files_pattern(httpd_cvs_script_t, cvs_data_t, cvs_data_t)
- manage_dirs_pattern(httpd_cvs_script_t, cvs_tmp_t, cvs_tmp_t)
- manage_files_pattern(httpd_cvs_script_t, cvs_tmp_t, cvs_tmp_t)
- files_tmp_filetrans(httpd_cvs_script_t, cvs_tmp_t, { file dir })
+ read_files_pattern(cvs_script_t, cvs_data_t, cvs_data_t)
+ manage_dirs_pattern(cvs_script_t, cvs_tmp_t, cvs_tmp_t)
+ manage_files_pattern(cvs_script_t, cvs_tmp_t, cvs_tmp_t)
+ files_tmp_filetrans(cvs_script_t, cvs_tmp_t, { file dir })
')
diff --git a/dirsrv-admin.fc b/dirsrv-admin.fc
index 8c44697..5e44c5e 100644
--- a/dirsrv-admin.fc
+++ b/dirsrv-admin.fc
@@ -6,8 +6,8 @@
/usr/sbin/start-ds-admin -- gen_context(system_u:object_r:dirsrvadmin_exec_t,s0)
/usr/sbin/stop-ds-admin -- gen_context(system_u:object_r:dirsrvadmin_exec_t,s0)
-/usr/lib/dirsrv/cgi-bin(/.*)? gen_context(system_u:object_r:httpd_dirsrvadmin_script_exec_t,s0)
-/usr/lib/dirsrv/dsgw-cgi-bin(/.*)? gen_context(system_u:object_r:httpd_dirsrvadmin_script_exec_t,s0)
+/usr/lib/dirsrv/cgi-bin(/.*)? gen_context(system_u:object_r:dirsrvadmin_script_exec_t,s0)
+/usr/lib/dirsrv/dsgw-cgi-bin(/.*)? gen_context(system_u:object_r:dirsrvadmin_script_exec_t,s0)
/usr/lib/dirsrv/cgi-bin/ds_create -- gen_context(system_u:object_r:dirsrvadmin_unconfined_script_exec_t,s0)
/usr/lib/dirsrv/cgi-bin/ds_remove -- gen_context(system_u:object_r:dirsrvadmin_unconfined_script_exec_t,s0)
diff --git a/dirsrv-admin.if b/dirsrv-admin.if
index 30416f2..e360d38 100644
--- a/dirsrv-admin.if
+++ b/dirsrv-admin.if
@@ -29,13 +29,13 @@ interface(`dirsrvadmin_run_exec',`
## </summary>
## </param>
#
-interface(`dirsrvadmin_run_httpd_script_exec',`
+interface(`dirsrvadmin_run_script_exec',`
gen_require(`
- type httpd_dirsrvadmin_script_exec_t;
+ type dirsrvadmin_script_exec_t;
')
- allow $1 httpd_dirsrvadmin_script_exec_t:dir search_dir_perms;
- can_exec($1, httpd_dirsrvadmin_script_exec_t)
+ allow $1 dirsrvadmin_script_exec_t:dir search_dir_perms;
+ can_exec($1, dirsrvadmin_script_exec_t)
')
########################################
diff --git a/dirsrv-admin.te b/dirsrv-admin.te
index 021c5ae..37afbd4 100644
--- a/dirsrv-admin.te
+++ b/dirsrv-admin.te
@@ -70,59 +70,60 @@ optional_policy(`
optional_policy(`
apache_content_template(dirsrvadmin)
+ apache_content_alias_template(dirsrvadmin, dirsrvadmin)
- allow httpd_dirsrvadmin_script_t self:process { getsched getpgid };
- allow httpd_dirsrvadmin_script_t self:capability { fowner fsetid setuid net_bind_service setgid chown sys_nice kill dac_read_search dac_override };
- allow httpd_dirsrvadmin_script_t self:tcp_socket create_stream_socket_perms;
- allow httpd_dirsrvadmin_script_t self:udp_socket create_socket_perms;
- allow httpd_dirsrvadmin_script_t self:unix_dgram_socket create_socket_perms;
- allow httpd_dirsrvadmin_script_t self:netlink_route_socket r_netlink_socket_perms;
- allow httpd_dirsrvadmin_script_t self:sem create_sem_perms;
+ allow dirsrvadmin_script_t self:process { getsched getpgid };
+ allow dirsrvadmin_script_t self:capability { fowner fsetid setuid net_bind_service setgid chown sys_nice kill dac_read_search dac_override };
+ allow dirsrvadmin_script_t self:tcp_socket create_stream_socket_perms;
+ allow dirsrvadmin_script_t self:udp_socket create_socket_perms;
+ allow dirsrvadmin_script_t self:unix_dgram_socket create_socket_perms;
+ allow dirsrvadmin_script_t self:netlink_route_socket r_netlink_socket_perms;
+ allow dirsrvadmin_script_t self:sem create_sem_perms;
- manage_files_pattern(httpd_dirsrvadmin_script_t, dirsrvadmin_lock_t, dirsrvadmin_lock_t)
- files_lock_filetrans(httpd_dirsrvadmin_script_t, dirsrvadmin_lock_t, { file })
+ manage_files_pattern(dirsrvadmin_script_t, dirsrvadmin_lock_t, dirsrvadmin_lock_t)
+ files_lock_filetrans(dirsrvadmin_script_t, dirsrvadmin_lock_t, { file })
- kernel_read_kernel_sysctls(httpd_dirsrvadmin_script_t)
+ kernel_read_kernel_sysctls(dirsrvadmin_script_t)
- corenet_tcp_bind_generic_node(httpd_dirsrvadmin_script_t)
- corenet_udp_bind_generic_node(httpd_dirsrvadmin_script_t)
- corenet_all_recvfrom_netlabel(httpd_dirsrvadmin_script_t)
+ corenet_tcp_bind_generic_node(dirsrvadmin_script_t)
+ corenet_udp_bind_generic_node(dirsrvadmin_script_t)
+ corenet_all_recvfrom_netlabel(dirsrvadmin_script_t)
- corenet_tcp_bind_http_port(httpd_dirsrvadmin_script_t)
- corenet_tcp_connect_generic_port(httpd_dirsrvadmin_script_t)
- corenet_tcp_connect_ldap_port(httpd_dirsrvadmin_script_t)
- corenet_tcp_connect_http_port(httpd_dirsrvadmin_script_t)
+ corenet_tcp_bind_http_port(dirsrvadmin_script_t)
+ corenet_tcp_connect_generic_port(dirsrvadmin_script_t)
+ corenet_tcp_connect_ldap_port(dirsrvadmin_script_t)
+ corenet_tcp_connect_http_port(dirsrvadmin_script_t)
- files_search_var_lib(httpd_dirsrvadmin_script_t)
+ files_search_var_lib(dirsrvadmin_script_t)
- sysnet_read_config(httpd_dirsrvadmin_script_t)
+ sysnet_read_config(dirsrvadmin_script_t)
- manage_files_pattern(httpd_dirsrvadmin_script_t, dirsrvadmin_tmp_t, dirsrvadmin_tmp_t)
- manage_dirs_pattern(httpd_dirsrvadmin_script_t, dirsrvadmin_tmp_t, dirsrvadmin_tmp_t)
- files_tmp_filetrans(httpd_dirsrvadmin_script_t, dirsrvadmin_tmp_t, { file dir })
+ manage_files_pattern(dirsrvadmin_script_t, dirsrvadmin_tmp_t, dirsrvadmin_tmp_t)
+ manage_dirs_pattern(dirsrvadmin_script_t, dirsrvadmin_tmp_t, dirsrvadmin_tmp_t)
+ files_tmp_filetrans(dirsrvadmin_script_t, dirsrvadmin_tmp_t, { file dir })
optional_policy(`
- apache_read_modules(httpd_dirsrvadmin_script_t)
- apache_read_config(httpd_dirsrvadmin_script_t)
- apache_signal(httpd_dirsrvadmin_script_t)
- apache_signull(httpd_dirsrvadmin_script_t)
+ apache_read_modules(dirsrvadmin_script_t)
+ apache_read_config(dirsrvadmin_script_t)
+ apache_signal(dirsrvadmin_script_t)
+ apache_signull(dirsrvadmin_script_t)
')
optional_policy(`
# The CGI scripts must be able to manage dirsrv-admin
- dirsrvadmin_run_exec(httpd_dirsrvadmin_script_t)
- dirsrvadmin_manage_config(httpd_dirsrvadmin_script_t)
- dirsrv_domtrans(httpd_dirsrvadmin_script_t)
- dirsrv_signal(httpd_dirsrvadmin_script_t)
- dirsrv_signull(httpd_dirsrvadmin_script_t)
- dirsrv_manage_log(httpd_dirsrvadmin_script_t)
- dirsrv_manage_var_lib(httpd_dirsrvadmin_script_t)
- dirsrv_pid_filetrans(httpd_dirsrvadmin_script_t)
- dirsrv_manage_var_run(httpd_dirsrvadmin_script_t)
- dirsrv_manage_config(httpd_dirsrvadmin_script_t)
- dirsrv_read_share(httpd_dirsrvadmin_script_t)
+ dirsrvadmin_run_exec(dirsrvadmin_script_t)
+ dirsrvadmin_manage_config(dirsrvadmin_script_t)
+ dirsrv_domtrans(dirsrvadmin_script_t)
+ dirsrv_signal(dirsrvadmin_script_t)
+ dirsrv_signull(dirsrvadmin_script_t)
+ dirsrv_manage_log(dirsrvadmin_script_t)
+ dirsrv_manage_var_lib(dirsrvadmin_script_t)
+ dirsrv_pid_filetrans(dirsrvadmin_script_t)
+ dirsrv_manage_var_run(dirsrvadmin_script_t)
+ dirsrv_manage_config(dirsrvadmin_script_t)
+ dirsrv_read_share(dirsrvadmin_script_t)
')
')
diff --git a/dspam.fc b/dspam.fc
index 3ea0423..b5fcb77 100644
--- a/dspam.fc
+++ b/dspam.fc
@@ -2,7 +2,7 @@
/usr/bin/dspam -- gen_context(system_u:object_r:dspam_exec_t,s0)
-/usr/share/dspam-web/dspam\.cgi -- gen_context(system_u:object_r:httpd_dspam_script_exec_t,s0)
+/usr/share/dspam-web/dspam\.cgi -- gen_context(system_u:object_r:dspam_script_exec_t,s0)
/var/lib/dspam(/.*)? gen_context(system_u:object_r:dspam_var_lib_t,s0)
@@ -11,7 +11,7 @@
/var/run/dspam(/.*)? gen_context(system_u:object_r:dspam_var_run_t,s0)
# web
-/var/www/dspam/.*\.cgi -- gen_context(system_u:object_r:httpd_dspam_script_exec_t,s0)
-/var/www/dspam(/.*?) gen_context(system_u:object_r:httpd_dspam_content_t,s0)
+/var/www/dspam/.*\.cgi -- gen_context(system_u:object_r:dspam_script_exec_t,s0)
+/var/www/dspam(/.*?) gen_context(system_u:object_r:dspam_content_t,s0)
-/var/lib/dspam/data(/.*)? gen_context(system_u:object_r:httpd_dspam_rw_content_t,s0)
+/var/lib/dspam/data(/.*)? gen_context(system_u:object_r:dspam_rw_content_t,s0)
diff --git a/dspam.te b/dspam.te
index 37c844b..1ec4d89 100644
--- a/dspam.te
+++ b/dspam.te
@@ -75,29 +75,27 @@ logging_send_syslog_msg(dspam_t)
optional_policy(`
apache_content_template(dspam)
+ apache_content_alias_template(dspam, dspam)
- read_files_pattern(httpd_dspam_script_t, dspam_var_lib_t, dspam_var_lib_t)
+ read_files_pattern(dspam_script_t, dspam_var_lib_t, dspam_var_lib_t)
- files_search_var_lib(httpd_dspam_script_t)
- list_dirs_pattern(dspam_t, httpd_dspam_content_t, httpd_dspam_content_t)
- manage_dirs_pattern(dspam_t, httpd_dspam_content_rw_t, httpd_dspam_content_rw_t)
- manage_files_pattern(dspam_t, httpd_dspam_content_rw_t, httpd_dspam_content_rw_t)
+ files_search_var_lib(dspam_script_t)
- domain_dontaudit_read_all_domains_state(httpd_dspam_script_t)
+ domain_dontaudit_read_all_domains_state(dspam_script_t)
- term_dontaudit_search_ptys(httpd_dspam_script_t)
- term_dontaudit_getattr_all_ttys(httpd_dspam_script_t)
- term_dontaudit_getattr_all_ptys(httpd_dspam_script_t)
+ term_dontaudit_search_ptys(dspam_script_t)
+ term_dontaudit_getattr_all_ttys(dspam_script_t)
+ term_dontaudit_getattr_all_ptys(dspam_script_t)
- init_read_utmp(httpd_dspam_script_t)
+ init_read_utmp(dspam_script_t)
- logging_send_syslog_msg(httpd_dspam_script_t)
+ logging_send_syslog_msg(dspam_script_t)
- mta_send_mail(httpd_dspam_script_t)
+ mta_send_mail(dspam_script_t)
optional_policy(`
- mysql_tcp_connect(httpd_dspam_script_t)
- mysql_stream_connect(httpd_dspam_script_t)
+ mysql_tcp_connect(dspam_script_t)
+ mysql_stream_connect(dspam_script_t)
')
')
diff --git a/git.fc b/git.fc
index 24700f8..6561d56 100644
--- a/git.fc
+++ b/git.fc
@@ -2,12 +2,12 @@ HOME_DIR/public_git(/.*)? gen_context(system_u:object_r:git_user_content_t,s0)
/usr/libexec/git-core/git-daemon -- gen_context(system_u:object_r:gitd_exec_t,s0)
-/var/cache/cgit(/.*)? gen_context(system_u:object_r:httpd_git_rw_content_t,s0)
-/var/cache/gitweb-caching(/.*)? gen_context(system_u:object_r:httpd_git_rw_content_t,s0)
+/var/cache/cgit(/.*)? gen_context(system_u:object_r:git_rw_content_t,s0)
+/var/cache/gitweb-caching(/.*)? gen_context(system_u:object_r:git_rw_content_t,s0)
/var/lib/git(/.*)? gen_context(system_u:object_r:git_sys_content_t,s0)
-/var/www/cgi-bin/cgit -- gen_context(system_u:object_r:httpd_git_script_exec_t,s0)
-/var/www/git(/.*)? gen_context(system_u:object_r:httpd_git_content_t,s0)
-/var/www/git/gitweb\.cgi -- gen_context(system_u:object_r:httpd_git_script_exec_t,s0)
-/var/www/gitweb-caching/gitweb\.cgi -- gen_context(system_u:object_r:httpd_git_script_exec_t,s0)
+/var/www/cgi-bin/cgit -- gen_context(system_u:object_r:git_script_exec_t,s0)
+/var/www/git(/.*)? gen_context(system_u:object_r:git_content_t,s0)
+/var/www/git/gitweb\.cgi -- gen_context(system_u:object_r:git_script_exec_t,s0)
+/var/www/gitweb-caching/gitweb\.cgi -- gen_context(system_u:object_r:git_script_exec_t,s0)
diff --git a/git.te b/git.te
index 2609364..d3caffa 100644
--- a/git.te
+++ b/git.te
@@ -75,6 +75,7 @@ attribute git_daemon;
attribute_role git_session_roles;
apache_content_template(git)
+apache_content_alias_template(git, git)
type git_system_t, git_daemon;
type gitd_exec_t;
@@ -210,48 +211,48 @@ tunable_policy(`git_system_use_nfs',`
# CGI policy
#
-list_dirs_pattern(httpd_git_script_t, { git_sys_content_t git_user_content_t }, { git_sys_content_t git_user_content_t })
-read_files_pattern(httpd_git_script_t, { git_sys_content_t git_user_content_t }, { git_sys_content_t git_user_content_t })
-files_search_var_lib(httpd_git_script_t)
+list_dirs_pattern(git_script_t, { git_sys_content_t git_user_content_t }, { git_sys_content_t git_user_content_t })
+read_files_pattern(git_script_t, { git_sys_content_t git_user_content_t }, { git_sys_content_t git_user_content_t })
+files_search_var_lib(git_script_t)
-files_dontaudit_getattr_tmp_dirs(httpd_git_script_t)
+files_dontaudit_getattr_tmp_dirs(git_script_t)
-auth_use_nsswitch(httpd_git_script_t)
+auth_use_nsswitch(git_script_t)
tunable_policy(`git_cgi_enable_homedirs',`
- userdom_search_user_home_dirs(httpd_git_script_t)
+ userdom_search_user_home_dirs(git_script_t)
')
tunable_policy(`git_cgi_enable_homedirs && use_nfs_home_dirs',`
- fs_getattr_nfs(httpd_git_script_t)
- fs_list_nfs(httpd_git_script_t)
- fs_read_nfs_files(httpd_git_script_t)
+ fs_getattr_nfs(git_script_t)
+ fs_list_nfs(git_script_t)
+ fs_read_nfs_files(git_script_t)
',`
- fs_dontaudit_read_nfs_files(httpd_git_script_t)
+ fs_dontaudit_read_nfs_files(git_script_t)
')
tunable_policy(`git_cgi_enable_homedirs && use_samba_home_dirs',`
- fs_getattr_cifs(httpd_git_script_t)
- fs_list_cifs(httpd_git_script_t)
- fs_read_cifs_files(httpd_git_script_t)
+ fs_getattr_cifs(git_script_t)
+ fs_list_cifs(git_script_t)
+ fs_read_cifs_files(git_script_t)
',`
- fs_dontaudit_read_cifs_files(httpd_git_script_t)
+ fs_dontaudit_read_cifs_files(git_script_t)
')
tunable_policy(`git_cgi_use_cifs',`
- fs_getattr_cifs(httpd_git_script_t)
- fs_list_cifs(httpd_git_script_t)
- fs_read_cifs_files(httpd_git_script_t)
+ fs_getattr_cifs(git_script_t)
+ fs_list_cifs(git_script_t)
+ fs_read_cifs_files(git_script_t)
',`
- fs_dontaudit_read_cifs_files(httpd_git_script_t)
+ fs_dontaudit_read_cifs_files(git_script_t)
')
tunable_policy(`git_cgi_use_nfs',`
- fs_getattr_nfs(httpd_git_script_t)
- fs_list_nfs(httpd_git_script_t)
- fs_read_nfs_files(httpd_git_script_t)
+ fs_getattr_nfs(git_script_t)
+ fs_list_nfs(git_script_t)
+ fs_read_nfs_files(git_script_t)
',`
- fs_dontaudit_read_nfs_files(httpd_git_script_t)
+ fs_dontaudit_read_nfs_files(git_script_t)
')
########################################
diff --git a/lightsquid.fc b/lightsquid.fc
index 044390c..63e2058 100644
--- a/lightsquid.fc
+++ b/lightsquid.fc
@@ -1,11 +1,11 @@
/etc/cron\.daily/lightsquid -- gen_context(system_u:object_r:lightsquid_exec_t,s0)
-/usr/lib/cgi-bin/lightsquid/.*\.cfg -- gen_context(system_u:object_r:httpd_lightsquid_content_t,s0)
-/usr/lib/cgi-bin/lightsquid/.*\.cgi -- gen_context(system_u:object_r:httpd_lightsquid_script_exec_t,s0)
+/usr/lib/cgi-bin/lightsquid/.*\.cfg -- gen_context(system_u:object_r:lightsquid_content_t,s0)
+/usr/lib/cgi-bin/lightsquid/.*\.cgi -- gen_context(system_u:object_r:lightsquid_script_exec_t,s0)
-/usr/share/lightsquid/cgi/.*\.cgi -- gen_context(system_u:object_r:httpd_lightsquid_script_exec_t,s0)
+/usr/share/lightsquid/cgi/.*\.cgi -- gen_context(system_u:object_r:lightsquid_script_exec_t,s0)
/var/lightsquid(/.*)? gen_context(system_u:object_r:lightsquid_rw_content_t,s0)
-/var/www/html/lightsquid(/.*)? gen_context(system_u:object_r:httpd_lightsquid_content_t,s0)
-/var/www/html/lightsquid/report(/.*)? gen_context(system_u:object_r:lightsquid_rw_content_t,s0)
+/var/www/html/lightsquid(/.*)? gen_context(system_u:object_r:lightsquid_content_t,s0)
+/var/www/html/lightsquid/report(/.*)? gen_context(system_u:object_r:lightsquid_report_content_t,s0)
diff --git a/lightsquid.te b/lightsquid.te
index 75854ed..6c7855e 100644
--- a/lightsquid.te
+++ b/lightsquid.te
@@ -13,18 +13,18 @@ type lightsquid_exec_t;
application_domain(lightsquid_t, lightsquid_exec_t)
role lightsquid_roles types lightsquid_t;
-type lightsquid_rw_content_t;
-files_type(lightsquid_rw_content_t)
+type lightsquid_report_content_t;
+files_type(lightsquid_report_content_t)
########################################
#
# Local policy
#
-manage_dirs_pattern(lightsquid_t, lightsquid_rw_content_t, lightsquid_rw_content_t)
-manage_files_pattern(lightsquid_t, lightsquid_rw_content_t, lightsquid_rw_content_t)
-manage_lnk_files_pattern(lightsquid_t, lightsquid_rw_content_t, lightsquid_rw_content_t)
-files_var_filetrans(lightsquid_t, lightsquid_rw_content_t, dir)
+manage_dirs_pattern(lightsquid_t, lightsquid_report_content_t, lightsquid_report_content_t)
+manage_files_pattern(lightsquid_t, lightsquid_report_content_t, lightsquid_report_content_t)
+manage_lnk_files_pattern(lightsquid_t, lightsquid_report_content_t, lightsquid_report_content_t)
+files_var_filetrans(lightsquid_t, lightsquid_report_content_t, dir)
corecmd_exec_bin(lightsquid_t)
corecmd_exec_shell(lightsquid_t)
@@ -36,10 +36,11 @@ squid_read_log(lightsquid_t)
optional_policy(`
apache_content_template(lightsquid)
+ apache_content_alias_template(lightsquid, lightsquid)
- list_dirs_pattern(httpd_lightsquid_script_t, lightsquid_rw_content_t, lightsquid_rw_content_t)
- read_files_pattern(httpd_lightsquid_script_t, lightsquid_rw_content_t, lightsquid_rw_content_t)
- read_lnk_files_pattern(httpd_lightsquid_script_t, lightsquid_rw_content_t, lightsquid_rw_content_t)
+ list_dirs_pattern(lightsquid_script_t, lightsquid_report_content_t, lightsquid_report_content_t)
+ read_files_pattern(lightsquid_script_t, lightsquid_report_content_t, lightsquid_report_content_t)
+ read_lnk_files_pattern(lightsquid_script_t, lightsquid_report_content_t, lightsquid_report_content_t)
')
optional_policy(`
diff --git a/man2html.fc b/man2html.fc
index 82f6255..3686732 100644
--- a/man2html.fc
+++ b/man2html.fc
@@ -1,5 +1,5 @@
-/usr/lib/man2html/cgi-bin/man/man2html -- gen_context(system_u:object_r:httpd_man2html_script_exec_t,s0)
-/usr/lib/man2html/cgi-bin/man/mansec -- gen_context(system_u:object_r:httpd_man2html_script_exec_t,s0)
-/usr/lib/man2html/cgi-bin/man/manwhatis -- gen_context(system_u:object_r:httpd_man2html_script_exec_t,s0)
+/usr/lib/man2html/cgi-bin/man/man2html -- gen_context(system_u:object_r:man2html_script_exec_t,s0)
+/usr/lib/man2html/cgi-bin/man/mansec -- gen_context(system_u:object_r:man2html_script_exec_t,s0)
+/usr/lib/man2html/cgi-bin/man/manwhatis -- gen_context(system_u:object_r:man2html_script_exec_t,s0)
-/var/cache/man2html(/.*)? gen_context(system_u:object_r:httpd_man2html_script_cache_t,s0)
+/var/cache/man2html(/.*)? gen_context(system_u:object_r:man2html_rw_content_t,s0)
diff --git a/man2html.if b/man2html.if
index fe43dea..53eaf61 100644
--- a/man2html.if
+++ b/man2html.if
@@ -2,7 +2,7 @@
########################################
## <summary>
-## Transition to httpd_man2html_script.
+## Transition to man2html_script.
## </summary>
## <param name="domain">
## <summary>
@@ -10,18 +10,18 @@
## </summary>
## </param>
#
-interface(`httpd_man2html_script_domtrans',`
+interface(`man2html_script_domtrans',`
gen_require(`
- type httpd_man2html_script_t, httpd_man2html_script_exec_t;
+ type man2html_script_t, man2html_script_exec_t;
')
corecmd_search_bin($1)
- domtrans_pattern($1, httpd_man2html_script_exec_t, httpd_man2html_script_t)
+ domtrans_pattern($1, man2html_script_exec_t, man2html_script_t)
')
########################################
## <summary>
-## Search httpd_man2html_script cache directories.
+## Search man2html_script content directories.
## </summary>
## <param name="domain">
## <summary>
@@ -29,18 +29,19 @@ interface(`httpd_man2html_script_domtrans',`
## </summary>
## </param>
#
-interface(`httpd_man2html_script_search_cache',`
+interface(`man2html_search_content',`
gen_require(`
- type httpd_man2html_script_cache_t;
+ type man2html_content_t;
+ type man2html_rw_content_t;
')
- allow $1 httpd_man2html_script_cache_t:dir search_dir_perms;
+ allow $1 { man2html_rw_content_t man2html_content_t }:dir search_dir_perms;
files_search_var($1)
')
########################################
## <summary>
-## Read httpd_man2html_script cache files.
+## Read man2html cache files.
## </summary>
## <param name="domain">
## <summary>
@@ -48,19 +49,22 @@ interface(`httpd_man2html_script_search_cache',`
## </summary>
## </param>
#
-interface(`httpd_man2html_script_read_cache_files',`
+interface(`man2html_read_content_files',`
gen_require(`
- type httpd_man2html_script_cache_t;
+ type man2html_content_t;
+ type man2html_rw_content_t;
')
files_search_var($1)
- read_files_pattern($1, httpd_man2html_script_cache_t, httpd_man2html_script_cache_t)
+ allow $1 { man2html_rw_content_t man2html_content_t }:dir search_dir_perms;
+ read_files_pattern($1, man2html_rw_content_t, man2html_rw_content_t)
+ read_files_pattern($1, man2html_content_t, man2html_content_t)
')
########################################
## <summary>
## Create, read, write, and delete
-## httpd_man2html_script cache files.
+## man2html content files.
## </summary>
## <param name="domain">
## <summary>
@@ -68,18 +72,21 @@ interface(`httpd_man2html_script_read_cache_files',`
## </summary>
## </param>
#
-interface(`httpd_man2html_script_manage_cache_files',`
+interface(`man2html_manage_content_files',`
gen_require(`
- type httpd_man2html_script_cache_t;
+ type man2html_content_t;
+ type man2html_rw_content_t;
')
files_search_var($1)
- manage_files_pattern($1, httpd_man2html_script_cache_t, httpd_man2html_script_cache_t)
+ manage_files_pattern($1, man2html_rw_content_t, man2html_rw_content_t)
+ manage_files_pattern($1, man2html_content_t, man2html_content_t)
')
########################################
## <summary>
-## Manage httpd_man2html_script cache dirs.
+## Create, read, write, and delete
+## man2html content dirs.
## </summary>
## <param name="domain">
## <summary>
@@ -87,20 +94,21 @@ interface(`httpd_man2html_script_manage_cache_files',`
## </summary>
## </param>
#
-interface(`httpd_man2html_script_manage_cache_dirs',`
+interface(`man2html_manage_content_dirs',`
gen_require(`
- type httpd_man2html_script_cache_t;
+ type man2html_content_t;
+ type man2html_rw_content_t;
')
files_search_var($1)
- manage_dirs_pattern($1, httpd_man2html_script_cache_t, httpd_man2html_script_cache_t)
+ manage_dirs_pattern($1, man2html_rw_content_t, man2html_rw_content_t)
+ manage_dirs_pattern($1, man2html_content_t, man2html_content_t)
')
-
########################################
## <summary>
## All of the rules required to administrate
-## an httpd_man2html_script environment
+## an man2html environment
## </summary>
## <param name="domain">
## <summary>
@@ -108,17 +116,19 @@ interface(`httpd_man2html_script_manage_cache_dirs',`
## </summary>
## </param>
#
-interface(`httpd_man2html_script_admin',`
+interface(`man2html_admin',`
gen_require(`
- type httpd_man2html_script_t;
- type httpd_man2html_script_cache_t;
+ type man2html_script_t;
+ type man2html_rw_content_t;
+ type man2html_content_t;
')
- allow $1 httpd_man2html_script_t:process { ptrace signal_perms };
- ps_process_pattern($1, httpd_man2html_script_t)
+ allow $1 man2html_script_t:process { ptrace signal_perms };
+ ps_process_pattern($1, man2html_script_t)
files_search_var($1)
- admin_pattern($1, httpd_man2html_script_cache_t)
+ admin_pattern($1, man2html_content_t)
+ admin_pattern($1, man2html_rw_content_t)
optional_policy(`
systemd_passwd_agent_exec($1)
diff --git a/man2html.te b/man2html.te
index 9e634bd..24b56e9 100644
--- a/man2html.te
+++ b/man2html.te
@@ -6,23 +6,17 @@ policy_module(man2html, 1.0.0)
#
-type httpd_man2html_script_cache_t;
-files_type(httpd_man2html_script_cache_t)
-
########################################
#
-# httpd_man2html_script local policy
+# man2html_script local policy
#
optional_policy(`
-
apache_content_template(man2html)
+ apache_content_alias_template(man2html, man2html)
- allow httpd_man2html_script_t self:process { fork };
-
- manage_dirs_pattern(httpd_man2html_script_t, httpd_man2html_script_cache_t, httpd_man2html_script_cache_t)
- manage_files_pattern(httpd_man2html_script_t, httpd_man2html_script_cache_t, httpd_man2html_script_cache_t)
- manage_lnk_files_pattern(httpd_man2html_script_t, httpd_man2html_script_cache_t, httpd_man2html_script_cache_t)
- files_var_filetrans(httpd_man2html_script_t, httpd_man2html_script_cache_t, { dir file })
+ allow man2html_script_t self:process fork;
+ typealias man2html_rw_content_t alias man2html_script_cache_t;
+ files_var_filetrans(man2html_script_t, man2html_rw_content_t, { dir file })
')
diff --git a/mediawiki.fc b/mediawiki.fc
index 99f7c41..93ec6db 100644
--- a/mediawiki.fc
+++ b/mediawiki.fc
@@ -1,8 +1,8 @@
-/usr/lib/mediawiki/math/texvc -- gen_context(system_u:object_r:httpd_mediawiki_script_exec_t,s0)
-/usr/lib/mediawiki/math/texvc_tex -- gen_context(system_u:object_r:httpd_mediawiki_script_exec_t,s0)
-/usr/lib/mediawiki/math/texvc_tes -- gen_context(system_u:object_r:httpd_mediawiki_script_exec_t,s0)
+/usr/lib/mediawiki/math/texvc -- gen_context(system_u:object_r:mediawiki_script_exec_t,s0)
+/usr/lib/mediawiki/math/texvc_tex -- gen_context(system_u:object_r:mediawiki_script_exec_t,s0)
+/usr/lib/mediawiki/math/texvc_tes -- gen_context(system_u:object_r:mediawiki_script_exec_t,s0)
-/usr/share/mediawiki(/.*)? gen_context(system_u:object_r:httpd_mediawiki_content_t,s0)
+/usr/share/mediawiki(/.*)? gen_context(system_u:object_r:mediawiki_content_t,s0)
-/var/www/wiki(/.*)? gen_context(system_u:object_r:httpd_mediawiki_rw_content_t,s0)
-/var/www/wiki/.*\.php -- gen_context(system_u:object_r:httpd_mediawiki_content_t,s0)
+/var/www/wiki(/.*)? gen_context(system_u:object_r:mediawiki_rw_content_t,s0)
+/var/www/wiki/.*\.php -- gen_context(system_u:object_r:mediawiki_content_t,s0)
diff --git a/mediawiki.if b/mediawiki.if
index 1c1d012..9b183e6 100644
--- a/mediawiki.if
+++ b/mediawiki.if
@@ -13,12 +13,12 @@
#
interface(`mediawiki_read_tmp_files',`
gen_require(`
- type httpd_mediawiki_tmp_t;
+ type mediawiki_tmp_t;
')
files_search_tmp($1)
- read_files_pattern($1, httpd_mediawiki_tmp_t, httpd_mediawiki_tmp_t)
- read_lnk_files_pattern($1, httpd_mediawiki_tmp_t, httpd_mediawiki_tmp_t)
+ read_files_pattern($1, mediawiki_tmp_t, mediawiki_tmp_t)
+ read_lnk_files_pattern($1, mediawiki_tmp_t, mediawiki_tmp_t)
')
#######################################
@@ -33,8 +33,8 @@ interface(`mediawiki_read_tmp_files',`
#
interface(`mediawiki_delete_tmp_files',`
gen_require(`
- type httpd_mediawiki_tmp_t;
+ type mediawiki_tmp_t;
')
- delete_files_pattern($1, httpd_mediawiki_tmp_t, httpd_mediawiki_tmp_t)
+ delete_files_pattern($1, mediawiki_tmp_t, mediawiki_tmp_t)
')
diff --git a/mediawiki.te b/mediawiki.te
index 212712c..fcbc191 100644
--- a/mediawiki.te
+++ b/mediawiki.te
@@ -5,16 +5,26 @@ policy_module(mediawiki, 1.0.0)
# Declarations
#
-optional_policy(`
-
- apache_content_template(mediawiki)
+type mediawiki_tmp_t;
+files_tmp_file(mediawiki_tmp_t)
########################################
#
# Local policy
#
- files_search_var_lib(httpd_mediawiki_script_t)
+optional_policy(`
+
+ apache_content_template(mediawiki)
+ apache_content_alias_template(mediawiki, mediawiki)
+
+ manage_dirs_pattern(mediawiki_script_t, mediawiki_tmp_t, mediawiki_tmp_t)
+ manage_files_pattern(mediawiki_script_t, mediawiki_tmp_t, mediawiki_tmp_t)
+ manage_sock_files_pattern(mediawiki_script_t, mediawiki_tmp_t, mediawiki_tmp_t)
+ manage_lnk_files_pattern(mediawiki_script_t, mediawiki_tmp_t, mediawiki_tmp_t)
+ files_tmp_filetrans(mediawiki_script_t, mediawiki_tmp_t, { file dir lnk_file })
+
+ files_search_var_lib(mediawiki_script_t)
- miscfiles_read_tetex_data(httpd_mediawiki_script_t)
+ miscfiles_read_tetex_data(mediawiki_script_t)
')
diff --git a/mojomojo.fc b/mojomojo.fc
index 7b827ca..5ee8a0f 100644
--- a/mojomojo.fc
+++ b/mojomojo.fc
@@ -1,5 +1,5 @@
-/usr/bin/mojomojo_fastcgi\.pl -- gen_context(system_u:object_r:httpd_mojomojo_script_exec_t,s0)
+/usr/bin/mojomojo_fastcgi\.pl -- gen_context(system_u:object_r:mojomojo_script_exec_t,s0)
-/usr/share/mojomojo/root(/.*)? gen_context(system_u:object_r:httpd_mojomojo_content_t,s0)
+/usr/share/mojomojo/root(/.*)? gen_context(system_u:object_r:mojomojo_content_t,s0)
-/var/lib/mojomojo(/.*)? gen_context(system_u:object_r:httpd_mojomojo_rw_content_t,s0)
+/var/lib/mojomojo(/.*)? gen_context(system_u:object_r:mojomojo_rw_content_t,s0)
diff --git a/mojomojo.te b/mojomojo.te
index 9556487..25d1d33 100644
--- a/mojomojo.te
+++ b/mojomojo.te
@@ -5,8 +5,8 @@ policy_module(mojomojo, 1.1.0)
# Declarations
#
-type httpd_mojomojo_tmp_t;
-files_tmp_file(httpd_mojomojo_tmp_t)
+type mojomojo_tmp_t alias httpd_mojomojo_tmp_t;
+files_tmp_file(mojomojo_tmp_t)
########################################
#
@@ -15,31 +15,30 @@ files_tmp_file(httpd_mojomojo_tmp_t)
optional_policy(`
apache_content_template(mojomojo)
+ apache_content_alias_template(mojomojo, mojomojo)
- allow httpd_mojomojo_script_t httpd_t:unix_stream_socket rw_stream_socket_perms;
+ manage_dirs_pattern(mojomojo_script_t, mojomojo_tmp_t, mojomojo_tmp_t)
+ manage_files_pattern(mojomojo_script_t, mojomojo_tmp_t, mojomojo_tmp_t)
+ files_tmp_filetrans(mojomojo_script_t, mojomojo_tmp_t, { file dir })
- manage_dirs_pattern(httpd_mojomojo_script_t, httpd_mojomojo_tmp_t, httpd_mojomojo_tmp_t)
- manage_files_pattern(httpd_mojomojo_script_t, httpd_mojomojo_tmp_t, httpd_mojomojo_tmp_t)
- files_tmp_filetrans(httpd_mojomojo_script_t, httpd_mojomojo_tmp_t, { file dir })
+ corenet_tcp_connect_postgresql_port(mojomojo_script_t)
+ corenet_tcp_connect_mysqld_port(mojomojo_script_t)
+ corenet_tcp_connect_smtp_port(mojomojo_script_t)
+ corenet_sendrecv_postgresql_client_packets(mojomojo_script_t)
+ corenet_sendrecv_mysqld_client_packets(mojomojo_script_t)
+ corenet_sendrecv_smtp_client_packets(mojomojo_script_t)
- corenet_tcp_connect_postgresql_port(httpd_mojomojo_script_t)
- corenet_tcp_connect_mysqld_port(httpd_mojomojo_script_t)
- corenet_tcp_connect_smtp_port(httpd_mojomojo_script_t)
- corenet_sendrecv_postgresql_client_packets(httpd_mojomojo_script_t)
- corenet_sendrecv_mysqld_client_packets(httpd_mojomojo_script_t)
- corenet_sendrecv_smtp_client_packets(httpd_mojomojo_script_t)
+ files_search_var_lib(mojomojo_script_t)
- files_search_var_lib(httpd_mojomojo_script_t)
+ sysnet_dns_name_resolve(mojomojo_script_t)
- sysnet_dns_name_resolve(httpd_mojomojo_script_t)
-
- mta_send_mail(httpd_mojomojo_script_t)
+ mta_send_mail(mojomojo_script_t)
optional_policy(`
- mysql_stream_connect(httpd_mojomojo_script_t)
+ mysql_stream_connect(mojomojo_script_t)
')
optional_policy(`
- postgresql_stream_connect(httpd_mojomojo_script_t)
+ postgresql_stream_connect(mojomojo_script_t)
')
')
diff --git a/munin.fc b/munin.fc
index 4968324..af28bb5 100644
--- a/munin.fc
+++ b/munin.fc
@@ -73,7 +73,7 @@
/var/lib/munin/plugin-state(/.*)? gen_context(system_u:object_r:munin_plugin_state_t,s0)
/var/log/munin.* gen_context(system_u:object_r:munin_log_t,s0)
/var/run/munin(/.*)? gen_context(system_u:object_r:munin_var_run_t,s0)
-/var/www/html/munin(/.*)? gen_context(system_u:object_r:httpd_munin_content_t,s0)
-/var/www/html/munin/cgi(/.*)? gen_context(system_u:object_r:httpd_munin_script_exec_t,s0)
-/var/www/html/cgi/munin.* gen_context(system_u:object_r:httpd_munin_script_exec_t,s0)
-/var/www/cgi-bin/munin.* gen_context(system_u:object_r:httpd_munin_script_exec_t,s0)
+/var/www/html/munin(/.*)? gen_context(system_u:object_r:munin_content_t,s0)
+/var/www/html/munin/cgi(/.*)? gen_context(system_u:object_r:munin_script_exec_t,s0)
+/var/www/html/cgi/munin.* gen_context(system_u:object_r:munin_script_exec_t,s0)
+/var/www/cgi-bin/munin.* gen_context(system_u:object_r:munin_script_exec_t,s0)
diff --git a/munin.if b/munin.if
index 4c1b6a8..900d083 100644
--- a/munin.if
+++ b/munin.if
@@ -209,7 +209,7 @@ interface(`munin_admin',`
attribute munin_plugin_domain, munin_plugin_tmp_content;
type munin_t, munin_etc_t, munin_tmp_t;
type munin_log_t, munin_var_lib_t, munin_var_run_t;
- type httpd_munin_content_t, munin_plugin_state_t, munin_initrc_exec_t;
+ type munin_content_t, munin_plugin_state_t, munin_initrc_exec_t;
')
allow $1 munin_t:process signal_perms;
@@ -239,5 +239,5 @@ interface(`munin_admin',`
files_list_pids($1)
admin_pattern($1, munin_var_run_t)
- admin_pattern($1, httpd_munin_content_t)
+ admin_pattern($1, munin_content_t)
')
diff --git a/munin.te b/munin.te
index cead88c..16b96d0 100644
--- a/munin.te
+++ b/munin.te
@@ -44,8 +44,8 @@ files_tmpfs_file(services_munin_plugin_tmpfs_t)
munin_plugin_template(system)
munin_plugin_template(unconfined)
-type httpd_munin_script_tmp_t;
-files_tmp_file(httpd_munin_script_tmp_t)
+type munin_script_tmp_t alias httpd_munin_script_tmp_t;
+files_tmp_file(munin_script_tmp_t)
################################
#
@@ -435,22 +435,23 @@ optional_policy(`
#
apache_content_template(munin)
+apache_content_alias_template(munin, munin)
-manage_dirs_pattern(munin_t, httpd_munin_content_t, httpd_munin_content_t)
-manage_files_pattern(munin_t, httpd_munin_content_t, httpd_munin_content_t)
+manage_dirs_pattern(munin_t, munin_content_t, munin_content_t)
+manage_files_pattern(munin_t, munin_content_t, munin_content_t)
-manage_dirs_pattern(httpd_munin_script_t, httpd_munin_script_tmp_t, httpd_munin_script_tmp_t)
-manage_files_pattern(httpd_munin_script_t, httpd_munin_script_tmp_t,httpd_munin_script_tmp_t)
+manage_dirs_pattern(munin_script_t, munin_script_tmp_t, munin_script_tmp_t)
+manage_files_pattern(munin_script_t, munin_script_tmp_t,munin_script_tmp_t)
-read_files_pattern(httpd_munin_script_t, munin_var_lib_t, munin_var_lib_t)
-read_files_pattern(httpd_munin_script_t, munin_etc_t, munin_etc_t)
+read_files_pattern(munin_script_t, munin_var_lib_t, munin_var_lib_t)
+read_files_pattern(munin_script_t, munin_etc_t, munin_etc_t)
-read_files_pattern(httpd_munin_script_t, munin_log_t, munin_log_t)
-append_files_pattern(httpd_munin_script_t, munin_log_t, munin_log_t)
+read_files_pattern(munin_script_t, munin_log_t, munin_log_t)
+append_files_pattern(munin_script_t, munin_log_t, munin_log_t)
-files_search_var_lib(httpd_munin_script_t)
+files_search_var_lib(munin_script_t)
-auth_read_passwd(httpd_munin_script_t)
+auth_read_passwd(munin_script_t)
optional_policy(`
apache_search_sys_content(munin_t)
diff --git a/mythtv.fc b/mythtv.fc
index 3a1c423..d62cf88 100644
--- a/mythtv.fc
+++ b/mythtv.fc
@@ -1,9 +1,9 @@
-/usr/share/mythweb/mythweb\.pl -- gen_context(system_u:object_r:httpd_mythtv_script_exec_t,s0)
+/usr/share/mythweb/mythweb\.pl -- gen_context(system_u:object_r:mythtv_script_exec_t,s0)
/var/lib/mythtv(/.*)? gen_context(system_u:object_r:mythtv_var_lib_t,s0)
/var/log/mythtv(/.*)? gen_context(system_u:object_r:mythtv_var_log_t,s0)
-/usr/share/mythtv(/.*)? gen_context(system_u:object_r:httpd_mythtv_content_t,s0)
-/usr/share/mythweb(/.*)? gen_context(system_u:object_r:httpd_mythtv_content_t,s0)
-/usr/share/mythtv/mythweather/scripts(/.*)? gen_context(system_u:object_r:httpd_mythtv_script_exec_t,s0)
+/usr/share/mythtv(/.*)? gen_context(system_u:object_r:mythtv_content_t,s0)
+/usr/share/mythweb(/.*)? gen_context(system_u:object_r:mythtv_content_t,s0)
+/usr/share/mythtv/mythweather/scripts(/.*)? gen_context(system_u:object_r:mythtv_script_exec_t,s0)
diff --git a/mythtv.if b/mythtv.if
index 171f666..e2403dd 100644
--- a/mythtv.if
+++ b/mythtv.if
@@ -1,9 +1,9 @@
-## <summary>policy for httpd_mythtv_script</summary>
+## <summary>policy for mythtv_script</summary>
########################################
## <summary>
-## Execute TEMPLATE in the httpd_mythtv_script domin.
+## Execute TEMPLATE in the mythtv_script domin.
## </summary>
## <param name="domain">
## <summary>
@@ -11,13 +11,13 @@
## </summary>
## </param>
#
-interface(`httpd_mythtv_script_domtrans',`
+interface(`mythtv_script_domtrans',`
gen_require(`
- type httpd_mythtv_script_t, httpd_mythtv_script_exec_t;
+ type mythtv_script_t, mythtv_script_exec_t;
')
corecmd_search_bin($1)
- domtrans_pattern($1, httpd_mythtv_script_exec_t, httpd_mythtv_script_t)
+ domtrans_pattern($1, mythtv_script_exec_t, mythtv_script_t)
')
#######################################
@@ -133,15 +133,15 @@ interface(`mythtv_manage_log',`
#
interface(`mythtv_admin',`
gen_require(`
- type httpd_mythtv_script_t, mythtv_var_lib_t;
+ type mythtv_script_t, mythtv_var_lib_t;
type mythtv_var_log_t;
')
- allow $1 httpd_mythtv_script_t:process signal_perms;
- ps_process_pattern($1, httpd_mythtv_script_t)
+ allow $1 mythtv_script_t:process signal_perms;
+ ps_process_pattern($1, mythtv_script_t)
tunable_policy(`deny_ptrace',`',`
- allow $1 httpd_mythtv_script_t:process ptrace;
+ allow $1 mythtv_script_t:process ptrace;
')
logging_list_logs($1)
diff --git a/mythtv.te b/mythtv.te
index 90129ac..7a4910c 100644
--- a/mythtv.te
+++ b/mythtv.te
@@ -6,6 +6,7 @@ policy_module(mythtv, 1.0.0)
#
apache_content_template(mythtv)
+apache_content_alias_template(mythtv, mythtv)
type mythtv_var_lib_t;
files_type(mythtv_var_lib_t)
@@ -15,27 +16,27 @@ logging_log_file(mythtv_var_log_t)
########################################
#
-# httpd_mythtv_script local policy
+# mythtv_script local policy
#
-manage_files_pattern(httpd_mythtv_script_t, mythtv_var_lib_t, mythtv_var_lib_t)
-manage_dirs_pattern(httpd_mythtv_script_t, mythtv_var_lib_t, mythtv_var_lib_t)
-files_var_lib_filetrans(httpd_mythtv_script_t, mythtv_var_lib_t, { dir file })
+manage_files_pattern(mythtv_script_t, mythtv_var_lib_t, mythtv_var_lib_t)
+manage_dirs_pattern(mythtv_script_t, mythtv_var_lib_t, mythtv_var_lib_t)
+files_var_lib_filetrans(mythtv_script_t, mythtv_var_lib_t, { dir file })
-manage_files_pattern(httpd_mythtv_script_t, mythtv_var_log_t, mythtv_var_log_t)
-manage_dirs_pattern(httpd_mythtv_script_t, mythtv_var_log_t, mythtv_var_log_t)
-logging_log_filetrans(httpd_mythtv_script_t, mythtv_var_log_t, file )
+manage_files_pattern(mythtv_script_t, mythtv_var_log_t, mythtv_var_log_t)
+manage_dirs_pattern(mythtv_script_t, mythtv_var_log_t, mythtv_var_log_t)
+logging_log_filetrans(mythtv_script_t, mythtv_var_log_t, file )
-domain_use_interactive_fds(httpd_mythtv_script_t)
+domain_use_interactive_fds(mythtv_script_t)
-files_read_etc_files(httpd_mythtv_script_t)
+files_read_etc_files(mythtv_script_t)
-fs_read_nfs_files(httpd_mythtv_script_t)
+fs_read_nfs_files(mythtv_script_t)
-miscfiles_read_localization(httpd_mythtv_script_t)
+miscfiles_read_localization(mythtv_script_t)
optional_policy(`
- mysql_read_config(httpd_mythtv_script_t)
- mysql_stream_connect(httpd_mythtv_script_t)
- mysql_tcp_connect(httpd_mythtv_script_t)
+ mysql_read_config(mythtv_script_t)
+ mysql_stream_connect(mythtv_script_t)
+ mysql_tcp_connect(mythtv_script_t)
')
diff --git a/nagios.fc b/nagios.fc
index a00cc2d..24a2dec 100644
--- a/nagios.fc
+++ b/nagios.fc
@@ -6,8 +6,8 @@
/usr/s?bin/nagios -- gen_context(system_u:object_r:nagios_exec_t,s0)
/usr/s?bin/nrpe -- gen_context(system_u:object_r:nrpe_exec_t,s0)
-/usr/lib/cgi-bin/netsaint(/.*)? gen_context(system_u:object_r:httpd_nagios_script_exec_t,s0)
-/usr/lib/nagios/cgi(/.*)? gen_context(system_u:object_r:httpd_nagios_script_exec_t,s0)
+/usr/lib/cgi-bin/netsaint(/.*)? gen_context(system_u:object_r:nagios_script_exec_t,s0)
+/usr/lib/nagios/cgi(/.*)? gen_context(system_u:object_r:nagios_script_exec_t,s0)
/var/log/nagios(/.*)? gen_context(system_u:object_r:nagios_log_t,s0)
/var/log/netsaint(/.*)? gen_context(system_u:object_r:nagios_log_t,s0)
@@ -19,8 +19,8 @@
ifdef(`distro_debian',`
/usr/sbin/nagios -- gen_context(system_u:object_r:nagios_exec_t,s0)
')
-/usr/lib/cgi-bin/nagios(/.+)? gen_context(system_u:object_r:httpd_nagios_script_exec_t,s0)
-/usr/lib/nagios/cgi-bin(/.*)? gen_context(system_u:object_r:httpd_nagios_script_exec_t,s0)
+/usr/lib/cgi-bin/nagios(/.+)? gen_context(system_u:object_r:nagios_script_exec_t,s0)
+/usr/lib/nagios/cgi-bin(/.*)? gen_context(system_u:object_r:nagios_script_exec_t,s0)
# admin plugins
/usr/lib/nagios/plugins/check_file_age -- gen_context(system_u:object_r:nagios_admin_plugin_exec_t,s0)
diff --git a/nagios.te b/nagios.te
index f565a0e..1726e88 100644
--- a/nagios.te
+++ b/nagios.te
@@ -186,33 +186,34 @@ optional_policy(`
optional_policy(`
apache_content_template(nagios)
- typealias httpd_nagios_script_t alias nagios_cgi_t;
- typealias httpd_nagios_script_exec_t alias nagios_cgi_exec_t;
+ apache_content_alias_template(nagios, nagios)
+ typealias nagios_script_t alias nagios_cgi_t;
+ typealias nagios_script_exec_t alias nagios_cgi_exec_t;
- allow httpd_nagios_script_t self:process signal_perms;
+ allow nagios_script_t self:process signal_perms;
- read_files_pattern(httpd_nagios_script_t, nagios_t, nagios_t)
- read_lnk_files_pattern(httpd_nagios_script_t, nagios_t, nagios_t)
+ read_files_pattern(nagios_script_t, nagios_t, nagios_t)
+ read_lnk_files_pattern(nagios_script_t, nagios_t, nagios_t)
- allow httpd_nagios_script_t nagios_etc_t:dir list_dir_perms;
- allow httpd_nagios_script_t nagios_etc_t:file read_file_perms;
- allow httpd_nagios_script_t nagios_etc_t:lnk_file read_lnk_file_perms;
+ allow nagios_script_t nagios_etc_t:dir list_dir_perms;
+ allow nagios_script_t nagios_etc_t:file read_file_perms;
+ allow nagios_script_t nagios_etc_t:lnk_file read_lnk_file_perms;
- files_search_spool(httpd_nagios_script_t)
- rw_fifo_files_pattern(httpd_nagios_script_t, nagios_spool_t, nagios_spool_t)
+ files_search_spool(nagios_script_t)
+ rw_fifo_files_pattern(nagios_script_t, nagios_spool_t, nagios_spool_t)
- allow httpd_nagios_script_t nagios_log_t:dir list_dir_perms;
- read_files_pattern(httpd_nagios_script_t, nagios_etc_t, nagios_log_t)
- read_lnk_files_pattern(httpd_nagios_script_t, nagios_etc_t, nagios_log_t)
+ allow nagios_script_t nagios_log_t:dir list_dir_perms;
+ read_files_pattern(nagios_script_t, nagios_etc_t, nagios_log_t)
+ read_lnk_files_pattern(nagios_script_t, nagios_etc_t, nagios_log_t)
- kernel_read_system_state(httpd_nagios_script_t)
+ kernel_read_system_state(nagios_script_t)
- domain_dontaudit_read_all_domains_state(httpd_nagios_script_t)
+ domain_dontaudit_read_all_domains_state(nagios_script_t)
- files_read_etc_runtime_files(httpd_nagios_script_t)
- files_read_kernel_symbol_table(httpd_nagios_script_t)
+ files_read_etc_runtime_files(nagios_script_t)
+ files_read_kernel_symbol_table(nagios_script_t)
- logging_send_syslog_msg(httpd_nagios_script_t)
+ logging_send_syslog_msg(nagios_script_t)
')
########################################
diff --git a/nut.fc b/nut.fc
index 41ff159..fac7d7b 100644
--- a/nut.fc
+++ b/nut.fc
@@ -11,6 +11,6 @@
/var/run/nut(/.*)? gen_context(system_u:object_r:nut_var_run_t,s0)
-/var/www/nut-cgi-bin/upsimage\.cgi -- gen_context(system_u:object_r:httpd_nutups_cgi_script_exec_t,s0)
-/var/www/nut-cgi-bin/upsset\.cgi -- gen_context(system_u:object_r:httpd_nutups_cgi_script_exec_t,s0)
-/var/www/nut-cgi-bin/upsstats\.cgi -- gen_context(system_u:object_r:httpd_nutups_cgi_script_exec_t,s0)
+/var/www/nut-cgi-bin/upsimage\.cgi -- gen_context(system_u:object_r:nutups_cgi_script_exec_t,s0)
+/var/www/nut-cgi-bin/upsset\.cgi -- gen_context(system_u:object_r:nutups_cgi_script_exec_t,s0)
+/var/www/nut-cgi-bin/upsstats\.cgi -- gen_context(system_u:object_r:nutups_cgi_script_exec_t,s0)
diff --git a/nut.te b/nut.te
index 1701352..249224e 100644
--- a/nut.te
+++ b/nut.te
@@ -166,17 +166,18 @@ logging_send_syslog_msg(nut_upsdrvctl_t)
optional_policy(`
apache_content_template(nutups_cgi)
+ apache_content_alias_template(nutups_cgi,nutups_cgi)
- read_files_pattern(httpd_nutups_cgi_script_t, nut_conf_t, nut_conf_t)
+ read_files_pattern(nutups_cgi_script_t, nut_conf_t, nut_conf_t)
- corenet_all_recvfrom_netlabel(httpd_nutups_cgi_script_t)
- corenet_tcp_sendrecv_generic_if(httpd_nutups_cgi_script_t)
- corenet_tcp_sendrecv_generic_node(httpd_nutups_cgi_script_t)
- corenet_tcp_sendrecv_all_ports(httpd_nutups_cgi_script_t)
- corenet_tcp_connect_ups_port(httpd_nutups_cgi_script_t)
- corenet_udp_sendrecv_generic_if(httpd_nutups_cgi_script_t)
- corenet_udp_sendrecv_generic_node(httpd_nutups_cgi_script_t)
- corenet_udp_sendrecv_all_ports(httpd_nutups_cgi_script_t)
+ corenet_all_recvfrom_netlabel(nutups_cgi_script_t)
+ corenet_tcp_sendrecv_generic_if(nutups_cgi_script_t)
+ corenet_tcp_sendrecv_generic_node(nutups_cgi_script_t)
+ corenet_tcp_sendrecv_all_ports(nutups_cgi_script_t)
+ corenet_tcp_connect_ups_port(nutups_cgi_script_t)
+ corenet_udp_sendrecv_generic_if(nutups_cgi_script_t)
+ corenet_udp_sendrecv_generic_node(nutups_cgi_script_t)
+ corenet_udp_sendrecv_all_ports(nutups_cgi_script_t)
- sysnet_dns_name_resolve(httpd_nutups_cgi_script_t)
+ sysnet_dns_name_resolve(nutups_cgi_script_t)
')
diff --git a/openshift.fc b/openshift.fc
index f2d6119..71ba1bd 100644
--- a/openshift.fc
+++ b/openshift.fc
@@ -18,7 +18,7 @@
/usr/s?bin/(oo|rhc)-cgroup-read -- gen_context(system_u:object_r:openshift_cgroup_read_exec_t,s0)
/usr/s?bin/(oo|rhc)-restorer -- gen_context(system_u:object_r:openshift_initrc_exec_t,s0)
-/usr/s?bin/(oo|rhc)-restorer-wrapper.sh -- gen_context(system_u:object_r:httpd_openshift_script_exec_t,s0)
+/usr/s?bin/(oo|rhc)-restorer-wrapper.sh -- gen_context(system_u:object_r:openshift_script_exec_t,s0)
/usr/s?bin/oo-admin-ctl-gears -- gen_context(system_u:object_r:openshift_initrc_exec_t,s0)
/usr/s?bin/mcollectived -- gen_context(system_u:object_r:openshift_initrc_exec_t,s0)
diff --git a/openshift.te b/openshift.te
index cd25e8e..7965e82 100644
--- a/openshift.te
+++ b/openshift.te
@@ -294,13 +294,14 @@ optional_policy(`
# openshift cgi script policy
#
apache_content_template(openshift)
- domtrans_pattern(httpd_openshift_script_t, openshift_initrc_exec_t, openshift_initrc_t)
+ apache_content_alias_template(openshift, openshift)
+ domtrans_pattern(openshift_script_t, openshift_initrc_exec_t, openshift_initrc_t)
optional_policy(`
- dbus_system_bus_client(httpd_openshift_script_t)
+ dbus_system_bus_client(openshift_script_t)
optional_policy(`
- oddjob_dbus_chat(httpd_openshift_script_t)
+ oddjob_dbus_chat(openshift_script_t)
oddjob_dontaudit_rw_fifo_file(openshift_domain)
')
')
diff --git a/pki.if b/pki.if
index b975b85..798efb6 100644
--- a/pki.if
+++ b/pki.if
@@ -134,13 +134,6 @@ template(`pki_apache_template',`
# need to resolve addresses?
auth_use_nsswitch($1_t)
-
- #pki_apache_domain_signal(httpd_t)
- #pki_apache_domain_signal(httpd_t)
- #pki_manage_apache_run(httpd_t)
- #pki_manage_apache_config_files(httpd_t)
- #pki_manage_apache_log_files(httpd_t)
- #pki_manage_apache_lib(httpd_t)
')
#######################################
diff --git a/pki.te b/pki.te
index 17f5d18..d656f71 100644
--- a/pki.te
+++ b/pki.te
@@ -43,7 +43,6 @@ typealias pki_tomcat_etc_rw_t alias { pki_ca_etc_rw_t pki_kra_etc_rw_t pki_ocsp_
typealias pki_tomcat_var_lib_t alias { pki_ca_var_lib_t pki_kra_var_lib_t pki_ocsp_var_lib_t pki_tks_var_lib_t };
typealias pki_tomcat_var_run_t alias { pki_ca_var_run_t pki_kra_var_run_t pki_ocsp_var_run_t pki_tks_var_run_t };
typealias pki_tomcat_log_t alias { pki_ca_log_t pki_kra_log_t pki_ocsp_log_t pki_tks_log_t };
-# typealias http_port_t alias { pki_ca_port_t pki_kra_port_t pki_ocsp_port_t pki_tks_port_t };
# pki policy types
@@ -126,10 +125,6 @@ miscfiles_read_hwdata(pki_tomcat_t)
userdom_manage_user_tmp_dirs(pki_tomcat_t)
userdom_manage_user_tmp_files(pki_tomcat_t)
-# forward proxy
-# need to define ports to fix this
-#corenet_tcp_connect_pki_tomcat_port(httpd_t)
-
# for crl publishing
allow pki_tomcat_t pki_tomcat_var_lib_t:lnk_file { rename create unlink };
@@ -166,9 +161,6 @@ corenet_tcp_connect_pki_tks_port(pki_tps_t)
files_exec_usr_files(pki_tps_t)
-# why do I need to add this?
-#allow httpd_t httpd_config_t:file execute;
-
######################################
#
# ra local policy
@@ -268,13 +260,8 @@ optional_policy(`
apache_list_modules(pki_apache_domain)
apache_read_config(pki_apache_domain)
apache_exec(pki_apache_domain)
- apache_exec_suexec(pki_apache_domain)
+ apache_exec_suexec(pki_apache_domain)
apache_entrypoint(pki_apache_domain)
-
- # should be started using a script which will execute httpd
- # start up httpd in pki_apache_domain mode
- #can_exec(pki_apache_domain, httpd_config_t)
- #can_exec(pki_apache_domain, httpd_suexec_exec_t)
')
# allow rpm -q in init scripts
diff --git a/prelude.fc b/prelude.fc
index 8dbc763..b580f85 100644
--- a/prelude.fc
+++ b/prelude.fc
@@ -12,7 +12,7 @@
/usr/sbin/audisp-prelude -- gen_context(system_u:object_r:prelude_audisp_exec_t,s0)
-/usr/share/prewikka/cgi-bin(/.*)? gen_context(system_u:object_r:httpd_prewikka_script_exec_t,s0)
+/usr/share/prewikka/cgi-bin(/.*)? gen_context(system_u:object_r:prewikka_script_exec_t,s0)
/var/lib/prelude-lml(/.*)? gen_context(system_u:object_r:prelude_var_lib_t,s0)
diff --git a/prelude.te b/prelude.te
index 509fd0a..e1f4f70 100644
--- a/prelude.te
+++ b/prelude.te
@@ -265,27 +265,28 @@ optional_policy(`
optional_policy(`
apache_content_template(prewikka)
+ apache_content_alias_template(prewikka, prewikka)
- can_exec(httpd_prewikka_script_t, httpd_prewikka_script_exec_t)
+ can_exec(prewikka_script_t, prewikka_script_exec_t)
- files_search_tmp(httpd_prewikka_script_t)
+ files_search_tmp(prewikka_script_t)
- kernel_read_sysctl(httpd_prewikka_script_t)
- kernel_search_network_sysctl(httpd_prewikka_script_t)
+ kernel_read_sysctl(prewikka_script_t)
+ kernel_search_network_sysctl(prewikka_script_t)
- auth_use_nsswitch(httpd_prewikka_script_t)
+ auth_use_nsswitch(prewikka_script_t)
- logging_send_syslog_msg(httpd_prewikka_script_t)
+ logging_send_syslog_msg(prewikka_script_t)
- apache_search_sys_content(httpd_prewikka_script_t)
+ apache_search_sys_content(prewikka_script_t)
optional_policy(`
- mysql_stream_connect(httpd_prewikka_script_t)
- mysql_tcp_connect(httpd_prewikka_script_t)
+ mysql_stream_connect(prewikka_script_t)
+ mysql_tcp_connect(prewikka_script_t)
')
optional_policy(`
- postgresql_stream_connect(httpd_prewikka_script_t)
- postgresql_tcp_connect(httpd_prewikka_script_t)
+ postgresql_stream_connect(prewikka_script_t)
+ postgresql_tcp_connect(prewikka_script_t)
')
')
diff --git a/smokeping.fc b/smokeping.fc
index 3359819..a231ecb 100644
--- a/smokeping.fc
+++ b/smokeping.fc
@@ -2,7 +2,7 @@
/usr/sbin/smokeping -- gen_context(system_u:object_r:smokeping_exec_t,s0)
-/usr/share/smokeping/cgi(/.*)? gen_context(system_u:object_r:httpd_smokeping_cgi_script_exec_t,s0)
+/usr/share/smokeping/cgi(/.*)? gen_context(system_u:object_r:smokeping_cgi_script_exec_t,s0)
/var/lib/smokeping(/.*)? gen_context(system_u:object_r:smokeping_var_lib_t,s0)
diff --git a/smokeping.te b/smokeping.te
index ebf575f..26b6da1 100644
--- a/smokeping.te
+++ b/smokeping.te
@@ -58,19 +58,20 @@ netutils_domtrans_ping(smokeping_t)
optional_policy(`
apache_content_template(smokeping_cgi)
+ apache_content_alias_template(smokeping_cgi, smokeping_cgi)
- manage_dirs_pattern(httpd_smokeping_cgi_script_t, smokeping_var_lib_t, smokeping_var_lib_t)
- manage_files_pattern(httpd_smokeping_cgi_script_t, smokeping_var_lib_t, smokeping_var_lib_t)
+ manage_dirs_pattern(smokeping_cgi_script_t, smokeping_var_lib_t, smokeping_var_lib_t)
+ manage_files_pattern(smokeping_cgi_script_t, smokeping_var_lib_t, smokeping_var_lib_t)
- getattr_files_pattern(httpd_smokeping_cgi_script_t, smokeping_var_run_t, smokeping_var_run_t)
+ getattr_files_pattern(smokeping_cgi_script_t, smokeping_var_run_t, smokeping_var_run_t)
- files_read_etc_files(httpd_smokeping_cgi_script_t)
- files_search_tmp(httpd_smokeping_cgi_script_t)
- files_search_var_lib(httpd_smokeping_cgi_script_t)
+ files_read_etc_files(smokeping_cgi_script_t)
+ files_search_tmp(smokeping_cgi_script_t)
+ files_search_var_lib(smokeping_cgi_script_t)
- auth_read_passwd(httpd_smokeping_cgi_script_t)
+ auth_read_passwd(smokeping_cgi_script_t)
- sysnet_dns_name_resolve(httpd_smokeping_cgi_script_t)
+ sysnet_dns_name_resolve(smokeping_cgi_script_t)
- netutils_domtrans_ping(httpd_smokeping_cgi_script_t)
+ netutils_domtrans_ping(smokeping_cgi_script_t)
')
diff --git a/squid.fc b/squid.fc
index ebbec17..5b066d3 100644
--- a/squid.fc
+++ b/squid.fc
@@ -2,14 +2,14 @@
/etc/squid(/.*)? gen_context(system_u:object_r:squid_conf_t,s0)
/etc/lightsquid(/.*)? gen_context(system_u:object_r:squid_conf_t,s0)
-/usr/lib/squid/cachemgr\.cgi -- gen_context(system_u:object_r:httpd_squid_script_exec_t,s0)
+/usr/lib/squid/cachemgr\.cgi -- gen_context(system_u:object_r:squid_script_exec_t,s0)
/usr/sbin/lightparser.pl -- gen_context(system_u:object_r:squid_cron_exec_t,s0)
/usr/sbin/squid -- gen_context(system_u:object_r:squid_exec_t,s0)
/usr/share/squid(/.*)? gen_context(system_u:object_r:squid_conf_t,s0)
-/usr/share/lightsquid/cgi(/.*)? gen_context(system_u:object_r:httpd_squid_script_exec_t,s0)
+/usr/share/lightsquid/cgi(/.*)? gen_context(system_u:object_r:squid_script_exec_t,s0)
/var/cache/squid(/.*)? gen_context(system_u:object_r:squid_cache_t,s0)
diff --git a/squid.te b/squid.te
index 7cb8bec..4ade5f1 100644
--- a/squid.te
+++ b/squid.te
@@ -201,24 +201,25 @@ tunable_policy(`squid_use_tproxy',`
optional_policy(`
apache_content_template(squid)
+ apache_content_alias_template(squid, squid)
- allow httpd_squid_script_t self:tcp_socket create_socket_perms;
+ allow squid_script_t self:tcp_socket create_socket_perms;
- corenet_all_recvfrom_unlabeled(httpd_squid_script_t)
- corenet_all_recvfrom_netlabel(httpd_squid_script_t)
- corenet_tcp_sendrecv_generic_if(httpd_squid_script_t)
- corenet_tcp_sendrecv_generic_node(httpd_squid_script_t)
+ corenet_all_recvfrom_unlabeled(squid_script_t)
+ corenet_all_recvfrom_netlabel(squid_script_t)
+ corenet_tcp_sendrecv_generic_if(squid_script_t)
+ corenet_tcp_sendrecv_generic_node(squid_script_t)
- corenet_sendrecv_http_cache_client_packets(httpd_squid_script_t)
- corenet_tcp_connect_http_cache_port(httpd_squid_script_t)
- corenet_tcp_sendrecv_http_cache_port(httpd_squid_script_t)
+ corenet_sendrecv_http_cache_client_packets(squid_script_t)
+ corenet_tcp_connect_http_cache_port(squid_script_t)
+ corenet_tcp_sendrecv_http_cache_port(squid_script_t)
- corenet_tcp_connect_squid_port(httpd_squid_script_t)
+ corenet_tcp_connect_squid_port(squid_script_t)
- sysnet_dns_name_resolve(httpd_squid_script_t)
+ sysnet_dns_name_resolve(squid_script_t)
optional_policy(`
- squid_read_config(httpd_squid_script_t)
+ squid_read_config(squid_script_t)
')
')
diff --git a/w3c.fc b/w3c.fc
index 463c799..227feaf 100644
--- a/w3c.fc
+++ b/w3c.fc
@@ -1,4 +1,4 @@
-/usr/lib/cgi-bin/check -- gen_context(system_u:object_r:httpd_w3c_validator_script_exec_t,s0)
+/usr/lib/cgi-bin/check -- gen_context(system_u:object_r:w3c_validator_script_exec_t,s0)
-/usr/share/w3c-markup-validator(/.*)? gen_context(system_u:object_r:httpd_w3c_validator_content_t,s0)
-/usr/share/w3c-markup-validator/cgi-bin(/.*)? gen_context(system_u:object_r:httpd_w3c_validator_script_exec_t,s0)
+/usr/share/w3c-markup-validator(/.*)? gen_context(system_u:object_r:w3c_validator_content_t,s0)
+/usr/share/w3c-markup-validator/cgi-bin(/.*)? gen_context(system_u:object_r:w3c_validator_script_exec_t,s0)
diff --git a/w3c.te b/w3c.te
index b14d6a9..ac1944e 100644
--- a/w3c.te
+++ b/w3c.te
@@ -6,29 +6,30 @@ policy_module(w3c, 1.1.0)
#
apache_content_template(w3c_validator)
+apache_content_alias_template(w3c_validator, w3c_validator)
########################################
#
# Local policy
#
-corenet_all_recvfrom_unlabeled(httpd_w3c_validator_script_t)
-corenet_all_recvfrom_netlabel(httpd_w3c_validator_script_t)
-corenet_tcp_sendrecv_generic_if(httpd_w3c_validator_script_t)
-corenet_tcp_sendrecv_generic_node(httpd_w3c_validator_script_t)
+corenet_all_recvfrom_unlabeled(w3c_validator_script_t)
+corenet_all_recvfrom_netlabel(w3c_validator_script_t)
+corenet_tcp_sendrecv_generic_if(w3c_validator_script_t)
+corenet_tcp_sendrecv_generic_node(w3c_validator_script_t)
-corenet_sendrecv_ftp_client_packets(httpd_w3c_validator_script_t)
-corenet_tcp_connect_ftp_port(httpd_w3c_validator_script_t)
-corenet_tcp_sendrecv_ftp_port(httpd_w3c_validator_script_t)
+corenet_sendrecv_ftp_client_packets(w3c_validator_script_t)
+corenet_tcp_connect_ftp_port(w3c_validator_script_t)
+corenet_tcp_sendrecv_ftp_port(w3c_validator_script_t)
-corenet_sendrecv_http_client_packets(httpd_w3c_validator_script_t)
-corenet_tcp_connect_http_port(httpd_w3c_validator_script_t)
-corenet_tcp_sendrecv_http_port(httpd_w3c_validator_script_t)
+corenet_sendrecv_http_client_packets(w3c_validator_script_t)
+corenet_tcp_connect_http_port(w3c_validator_script_t)
+corenet_tcp_sendrecv_http_port(w3c_validator_script_t)
-corenet_sendrecv_http_cache_client_packets(httpd_w3c_validator_script_t)
-corenet_tcp_connect_http_cache_port(httpd_w3c_validator_script_t)
-corenet_tcp_sendrecv_http_cache_port(httpd_w3c_validator_script_t)
+corenet_sendrecv_http_cache_client_packets(w3c_validator_script_t)
+corenet_tcp_connect_http_cache_port(w3c_validator_script_t)
+corenet_tcp_sendrecv_http_cache_port(w3c_validator_script_t)
-miscfiles_read_generic_certs(httpd_w3c_validator_script_t)
+miscfiles_read_generic_certs(w3c_validator_script_t)
-sysnet_dns_name_resolve(httpd_w3c_validator_script_t)
+sysnet_dns_name_resolve(w3c_validator_script_t)
diff --git a/webalizer.fc b/webalizer.fc
index 64baf67..76c753b 100644
--- a/webalizer.fc
+++ b/webalizer.fc
@@ -6,4 +6,4 @@
/var/lib/webalizer(/.*)? gen_context(system_u:object_r:webalizer_var_lib_t,s0)
-/var/www/usage(/.*)? gen_context(system_u:object_r:httpd_webalizer_content_t,s0)
+/var/www/usage(/.*)? gen_context(system_u:object_r:webalizer_rw_content_t,s0)
diff --git a/webalizer.te b/webalizer.te
index e0b1983..32cbf8c 100644
--- a/webalizer.te
+++ b/webalizer.te
@@ -83,9 +83,8 @@ userdom_dontaudit_search_user_home_content(webalizer_t)
optional_policy(`
apache_read_log(webalizer_t)
apache_content_template(webalizer)
+ apache_content_alias_template(webalizer, webalizer)
apache_manage_sys_content(webalizer_t)
- manage_dirs_pattern(webalizer_t, httpd_webalizer_content_t, httpd_webalizer_content_t)
- manage_files_pattern(webalizer_t, httpd_webalizer_content_t, httpd_webalizer_content_t)
')
optional_policy(`
diff --git a/zoneminder.fc b/zoneminder.fc
index 8c61505..ceaa219 100644
--- a/zoneminder.fc
+++ b/zoneminder.fc
@@ -4,7 +4,7 @@
/usr/lib/systemd/system/zoneminder.* -- gen_context(system_u:object_r:zoneminder_unit_file_t,s0)
-/usr/libexec/zoneminder/cgi-bin(/.*)? gen_context(system_u:object_r:httpd_zoneminder_script_exec_t,s0)
+/usr/libexec/zoneminder/cgi-bin(/.*)? gen_context(system_u:object_r:zoneminder_script_exec_t,s0)
/var/lib/zoneminder(/.*)? gen_context(system_u:object_r:zoneminder_var_lib_t,s0)
diff --git a/zoneminder.te b/zoneminder.te
index add28f7..b66e76d 100644
--- a/zoneminder.te
+++ b/zoneminder.te
@@ -164,24 +164,24 @@ optional_policy(`
optional_policy(`
apache_content_template(zoneminder)
+ apache_content_alias_template(zoneminder, zoneminder)
# need more testing
- #allow httpd_zoneminder_script_t self:shm create_shm_perms;
+ #allow zoneminder_script_t self:shm create_shm_perms;
- manage_sock_files_pattern(httpd_zoneminder_script_t, zoneminder_var_lib_t, zoneminder_var_lib_t)
+ manage_sock_files_pattern(zoneminder_script_t, zoneminder_var_lib_t, zoneminder_var_lib_t)
- rw_files_pattern(httpd_zoneminder_script_t, zoneminder_tmpfs_t, zoneminder_tmpfs_t)
+ rw_files_pattern(zoneminder_script_t, zoneminder_tmpfs_t, zoneminder_tmpfs_t)
- zoneminder_stream_connect(httpd_zoneminder_script_t)
+ zoneminder_stream_connect(zoneminder_script_t)
- can_exec(zoneminder_t, httpd_zoneminder_script_exec_t)
+ can_exec(zoneminder_t, zoneminder_script_exec_t)
- files_search_var_lib(httpd_zoneminder_script_t)
+ files_search_var_lib(zoneminder_script_t)
- logging_send_syslog_msg(httpd_zoneminder_script_t)
+ logging_send_syslog_msg(zoneminder_script_t)
optional_policy(`
- mysql_stream_connect(httpd_zoneminder_script_t)
+ mysql_stream_connect(zoneminder_script_t)
')
-
')
Reference in New Issue View Git Blame Copy Permalink