policy/modules/services/cups.te

   1 policy_module(cups, 1.14.0)
   2
   3 ########################################
   4 #
   5 # Declarations
   6 #
   7
   8 type cupsd_config_t;
   9 type cupsd_config_exec_t;
  10 init_daemon_domain(cupsd_config_t, cupsd_config_exec_t)
  11
  12 type cupsd_config_var_run_t;
  13 files_pid_file(cupsd_config_var_run_t)
  14
  15 type cupsd_t;
  16 type cupsd_exec_t;
  17 init_daemon_domain(cupsd_t, cupsd_exec_t)
  18 mls_trusted_object(cupsd_t)
  19
  20 type cupsd_etc_t;
  21 files_config_file(cupsd_etc_t)
  22
  23 type cupsd_initrc_exec_t;
  24 init_script_file(cupsd_initrc_exec_t)
  25
  26 type cupsd_interface_t;
  27 files_type(cupsd_interface_t)
  28
  29 type cupsd_rw_etc_t;
  30 files_config_file(cupsd_rw_etc_t)
  31
  32 type cupsd_lock_t;
  33 files_lock_file(cupsd_lock_t)
  34
  35 type cupsd_log_t;
  36 logging_log_file(cupsd_log_t)
  37
  38 type cupsd_lpd_t;
  39 type cupsd_lpd_exec_t;
  40 domain_type(cupsd_lpd_t)
  41 domain_entry_file(cupsd_lpd_t, cupsd_lpd_exec_t)
  42 role system_r types cupsd_lpd_t;
  43
  44 type cupsd_lpd_tmp_t;
  45 files_tmp_file(cupsd_lpd_tmp_t)
  46
  47 type cupsd_lpd_var_run_t;
  48 files_pid_file(cupsd_lpd_var_run_t)
  49
  50 type cups_pdf_t;
  51 type cups_pdf_exec_t;
  52 cups_backend(cups_pdf_t, cups_pdf_exec_t)
  53
  54 type cups_pdf_tmp_t;
  55 files_tmp_file(cups_pdf_tmp_t)
  56
  57 type cupsd_tmp_t;
  58 files_tmp_file(cupsd_tmp_t)
  59
  60 type cupsd_var_run_t;
  61 files_pid_file(cupsd_var_run_t)
  62 mls_trusted_object(cupsd_var_run_t)
  63
  64 type hplip_t;
  65 type hplip_exec_t;
  66 init_daemon_domain(hplip_t, hplip_exec_t)
  67 # For CUPS to run as a backend
  68 cups_backend(hplip_t, hplip_exec_t)
  69
  70 type hplip_etc_t;
  71 files_config_file(hplip_etc_t)
  72
  73 type hplip_tmp_t;
  74 files_tmp_file(hplip_tmp_t)
  75
  76 type hplip_var_lib_t;
  77 files_type(hplip_var_lib_t)
  78
  79 type hplip_var_run_t;
  80 files_pid_file(hplip_var_run_t)
  81
  82 type ptal_t;
  83 type ptal_exec_t;
  84 init_daemon_domain(ptal_t, ptal_exec_t)
  85
  86 type ptal_etc_t;
  87 files_config_file(ptal_etc_t)
  88
  89 type ptal_var_run_t;
  90 files_pid_file(ptal_var_run_t)
  91
  92 ifdef(`enable_mcs',`
  93         init_ranged_daemon_domain(cupsd_t, cupsd_exec_t, s0 - mcs_systemhigh)
  94 ')
  95
  96 ifdef(`enable_mls',`
  97         init_ranged_daemon_domain(cupsd_t, cupsd_exec_t, mls_systemhigh)
  98 ')
  99
 100 ########################################
 101 #
 102 # Cups local policy
 103 #
 104
 105 # /usr/lib/cups/backend/serial needs sys_admin(?!)
 106 allow cupsd_t self:capability { ipc_lock sys_admin dac_override dac_read_search kill setgid setuid fsetid net_bind_service fowner chown dac_override sys_rawio sys_resource sys_tty_config };
 107 dontaudit cupsd_t self:capability { sys_tty_config net_admin };
 108 allow cupsd_t self:process { getpgid setpgid setsched signal_perms };
 109 allow cupsd_t self:fifo_file rw_fifo_file_perms;
 110 allow cupsd_t self:unix_stream_socket { create_stream_socket_perms connectto };
 111 allow cupsd_t self:unix_dgram_socket create_socket_perms;
 112 allow cupsd_t self:netlink_selinux_socket create_socket_perms;
 113 allow cupsd_t self:shm create_shm_perms;
 114 allow cupsd_t self:sem create_sem_perms;
 115 allow cupsd_t self:tcp_socket create_stream_socket_perms;
 116 allow cupsd_t self:udp_socket create_socket_perms;
 117 allow cupsd_t self:appletalk_socket create_socket_perms;
 118 # generic socket here until appletalk socket is available in kernels
 119 allow cupsd_t self:socket create_socket_perms;
 120
 121 allow cupsd_t cupsd_etc_t:{ dir file } setattr;
 122 read_files_pattern(cupsd_t, cupsd_etc_t, cupsd_etc_t)
 123 read_lnk_files_pattern(cupsd_t, cupsd_etc_t, cupsd_etc_t)
 124 files_search_etc(cupsd_t)
 125
 126 manage_files_pattern(cupsd_t, cupsd_interface_t, cupsd_interface_t)
 127 can_exec(cupsd_t, cupsd_interface_t)
 128
 129 manage_dirs_pattern(cupsd_t, cupsd_etc_t, cupsd_rw_etc_t)
 130 manage_files_pattern(cupsd_t, cupsd_etc_t, cupsd_rw_etc_t)
 131 filetrans_pattern(cupsd_t, cupsd_etc_t, cupsd_rw_etc_t, file)
 132 files_var_filetrans(cupsd_t, cupsd_rw_etc_t, { dir file })
 133
 134 # allow cups to execute its backend scripts
 135 can_exec(cupsd_t, cupsd_exec_t)
 136 allow cupsd_t cupsd_exec_t:dir search_dir_perms;
 137 allow cupsd_t cupsd_exec_t:lnk_file read_lnk_file_perms;
 138
 139 allow cupsd_t cupsd_lock_t:file manage_file_perms;
 140 files_lock_filetrans(cupsd_t, cupsd_lock_t, file)
 141
 142 manage_dirs_pattern(cupsd_t, cupsd_log_t, cupsd_log_t)
 143 manage_files_pattern(cupsd_t, cupsd_log_t, cupsd_log_t)
 144 allow cupsd_t cupsd_log_t:dir setattr;
 145 logging_log_filetrans(cupsd_t, cupsd_log_t, { file dir })
 146
 147 manage_dirs_pattern(cupsd_t, cupsd_tmp_t, cupsd_tmp_t)
 148 manage_files_pattern(cupsd_t, cupsd_tmp_t, cupsd_tmp_t)
 149 manage_fifo_files_pattern(cupsd_t, cupsd_tmp_t, cupsd_tmp_t)
 150 files_tmp_filetrans(cupsd_t, cupsd_tmp_t, { file dir fifo_file })
 151
 152 allow cupsd_t cupsd_var_run_t:dir setattr_dir_perms;
 153 manage_dirs_pattern(cupsd_t, cupsd_var_run_t, cupsd_var_run_t)
 154 manage_files_pattern(cupsd_t, cupsd_var_run_t, cupsd_var_run_t)
 155 manage_sock_files_pattern(cupsd_t, cupsd_var_run_t, cupsd_var_run_t)
 156 manage_fifo_files_pattern(cupsd_t, cupsd_var_run_t, cupsd_var_run_t)
 157 files_pid_filetrans(cupsd_t, cupsd_var_run_t, { dir file fifo_file })
 158
 159 allow cupsd_t hplip_t:process { signal sigkill };
 160
 161 read_files_pattern(cupsd_t, hplip_etc_t, hplip_etc_t)
 162
 163 allow cupsd_t hplip_var_run_t:file read_file_perms;
 164
 165 stream_connect_pattern(cupsd_t, ptal_var_run_t, ptal_var_run_t, ptal_t)
 166 allow cupsd_t ptal_var_run_t:sock_file setattr_sock_file_perms;
 167
 168 kernel_read_system_state(cupsd_t)
 169 kernel_read_network_state(cupsd_t)
 170 kernel_read_all_sysctls(cupsd_t)
 171 kernel_request_load_module(cupsd_t)
 172
 173 corenet_all_recvfrom_unlabeled(cupsd_t)
 174 corenet_all_recvfrom_netlabel(cupsd_t)
 175 corenet_tcp_sendrecv_generic_if(cupsd_t)
 176 corenet_udp_sendrecv_generic_if(cupsd_t)
 177 corenet_raw_sendrecv_generic_if(cupsd_t)
 178 corenet_tcp_sendrecv_generic_node(cupsd_t)
 179 corenet_udp_sendrecv_generic_node(cupsd_t)
 180 corenet_raw_sendrecv_generic_node(cupsd_t)
 181 corenet_tcp_sendrecv_all_ports(cupsd_t)
 182 corenet_udp_sendrecv_all_ports(cupsd_t)
 183 corenet_tcp_bind_generic_node(cupsd_t)
 184 corenet_udp_bind_generic_node(cupsd_t)
 185 corenet_tcp_bind_ipp_port(cupsd_t)
 186 corenet_udp_bind_ipp_port(cupsd_t)
 187 corenet_udp_bind_howl_port(cupsd_t)
 188 corenet_tcp_bind_reserved_port(cupsd_t)
 189 corenet_dontaudit_tcp_bind_all_reserved_ports(cupsd_t)
 190 corenet_tcp_bind_all_rpc_ports(cupsd_t)
 191 corenet_tcp_connect_all_ports(cupsd_t)
 192 corenet_sendrecv_hplip_client_packets(cupsd_t)
 193 corenet_sendrecv_ipp_client_packets(cupsd_t)
 194 corenet_sendrecv_ipp_server_packets(cupsd_t)
 195
 196 dev_rw_printer(cupsd_t)
 197 dev_read_urand(cupsd_t)
 198 dev_read_sysfs(cupsd_t)
 199 dev_rw_input_dev(cupsd_t)       #447878
 200 dev_rw_generic_usb_dev(cupsd_t)
 201 dev_rw_usbfs(cupsd_t)
 202 dev_getattr_printer_dev(cupsd_t)
 203
 204 domain_read_all_domains_state(cupsd_t)
 205
 206 fs_getattr_all_fs(cupsd_t)
 207 fs_search_auto_mountpoints(cupsd_t)
 208 fs_search_fusefs(cupsd_t)
 209 fs_read_anon_inodefs_files(cupsd_t)
 210
 211 mls_file_downgrade(cupsd_t)
 212 mls_file_write_all_levels(cupsd_t)
 213 mls_file_read_all_levels(cupsd_t)
 214 mls_rangetrans_target(cupsd_t)
 215 mls_socket_write_all_levels(cupsd_t)
 216 mls_fd_use_all_levels(cupsd_t)
 217
 218 term_use_usb_ttys(cupsd_t)
 219 term_use_unallocated_ttys(cupsd_t)
 220 term_search_ptys(cupsd_t)
 221
 222 # Filter scripts may be shell scripts, and may invoke progs like /bin/mktemp
 223 corecmd_exec_shell(cupsd_t)
 224 corecmd_exec_bin(cupsd_t)
 225
 226 domain_use_interactive_fds(cupsd_t)
 227
 228 files_list_spool(cupsd_t)
 229 files_read_etc_files(cupsd_t)
 230 files_read_etc_runtime_files(cupsd_t)
 231 # read python modules
 232 files_read_usr_files(cupsd_t)
 233 # for /var/lib/defoma
 234 files_read_var_lib_files(cupsd_t)
 235 files_list_world_readable(cupsd_t)
 236 files_read_world_readable_files(cupsd_t)
 237 files_read_world_readable_symlinks(cupsd_t)
 238 # Satisfy readahead
 239 files_read_var_files(cupsd_t)
 240 files_read_var_symlinks(cupsd_t)
 241 # for /etc/printcap
 242 files_dontaudit_write_etc_files(cupsd_t)
 243 # smbspool seems to be iterating through all existing tmp files.
 244 # redhat bug #214953
 245 # cjp: this might be a broken behavior
 246 files_dontaudit_getattr_all_tmp_files(cupsd_t)
 247
 248 selinux_compute_access_vector(cupsd_t)
 249 selinux_validate_context(cupsd_t)
 250
 251 init_exec_script_files(cupsd_t)
 252 init_read_utmp(cupsd_t)
 253
 254 auth_domtrans_chk_passwd(cupsd_t)
 255 auth_dontaudit_read_pam_pid(cupsd_t)
 256 auth_rw_faillog(cupsd_t)
 257 auth_use_nsswitch(cupsd_t)
 258
 259 # Read /usr/lib/gconv/gconv-modules.* and /usr/lib/python2.2/.*
 260 libs_read_lib_files(cupsd_t)
 261 libs_exec_lib_files(cupsd_t)
 262
 263 logging_send_audit_msgs(cupsd_t)
 264 logging_send_syslog_msg(cupsd_t)
 265
 266 miscfiles_read_localization(cupsd_t)
 267 # invoking ghostscript needs to read fonts
 268 miscfiles_read_fonts(cupsd_t)
 269 miscfiles_setattr_fonts_cache_dirs(cupsd_t)
 270
 271 seutil_read_config(cupsd_t)
 272 sysnet_exec_ifconfig(cupsd_t)
 273
 274 files_dontaudit_list_home(cupsd_t)
 275 userdom_dontaudit_use_unpriv_user_fds(cupsd_t)
 276 userdom_dontaudit_search_user_home_content(cupsd_t)
 277
 278 optional_policy(`
 279         apm_domtrans_client(cupsd_t)
 280 ')
 281
 282 optional_policy(`
 283         cron_system_entry(cupsd_t, cupsd_exec_t)
 284 ')
 285
 286 optional_policy(`
 287         dbus_system_bus_client(cupsd_t)
 288
 289         userdom_dbus_send_all_users(cupsd_t)
 290
 291         optional_policy(`
 292                 avahi_dbus_chat(cupsd_t)
 293         ')
 294
 295         optional_policy(`
 296                 hal_dbus_chat(cupsd_t)
 297         ')
 298
 299         # talk to processes that do not have policy
 300         optional_policy(`
 301                 unconfined_dbus_chat(cupsd_t)
 302                 files_write_generic_pid_pipes(cupsd_t)
 303         ')
 304 ')
 305
 306 optional_policy(`
 307         hostname_exec(cupsd_t)
 308 ')
 309
 310 optional_policy(`
 311         inetd_core_service_domain(cupsd_t, cupsd_exec_t)
 312 ')
 313
 314 optional_policy(`
 315         kerberos_manage_host_rcache(cupsd_t)
 316 ')
 317
 318 optional_policy(`
 319         logrotate_domtrans(cupsd_t)
 320 ')
 321
 322 optional_policy(`
 323         # Write to /var/spool/cups.
 324         lpd_manage_spool(cupsd_t)
 325         lpd_read_config(cupsd_t)
 326         lpd_exec_lpr(cupsd_t)
 327         lpd_relabel_spool(cupsd_t)
 328 ')
 329
 330 optional_policy(`
 331         mta_send_mail(cupsd_t)
 332 ')
 333
 334 optional_policy(`
 335         # cups execs smbtool which reads samba_etc_t files
 336         samba_read_config(cupsd_t)
 337         samba_rw_var_files(cupsd_t)
 338 ')
 339
 340 optional_policy(`
 341         seutil_sigchld_newrole(cupsd_t)
 342 ')
 343
 344 optional_policy(`
 345         snmp_read_snmp_var_lib_files(cupsd_t)
 346 ')
 347
 348 optional_policy(`
 349         udev_read_db(cupsd_t)
 350 ')
 351
 352 ########################################
 353 #
 354 # Cups configuration daemon local policy
 355 #
 356
 357 allow cupsd_config_t self:capability { chown dac_override sys_tty_config };
 358 dontaudit cupsd_config_t self:capability sys_tty_config;
 359 allow cupsd_config_t self:process { getsched signal_perms };
 360 allow cupsd_config_t self:fifo_file rw_fifo_file_perms;
 361 allow cupsd_config_t self:unix_stream_socket create_socket_perms;
 362 allow cupsd_config_t self:unix_dgram_socket create_socket_perms;
 363 allow cupsd_config_t self:tcp_socket create_stream_socket_perms;
 364
 365 allow cupsd_config_t cupsd_t:process signal;
 366 ps_process_pattern(cupsd_config_t, cupsd_t)
 367
 368 manage_files_pattern(cupsd_config_t, cupsd_etc_t, cupsd_etc_t)
 369 manage_lnk_files_pattern(cupsd_config_t, cupsd_etc_t, cupsd_etc_t)
 370 filetrans_pattern(cupsd_config_t, cupsd_etc_t, cupsd_rw_etc_t, file)
 371
 372 manage_files_pattern(cupsd_config_t, cupsd_rw_etc_t, cupsd_rw_etc_t)
 373 manage_lnk_files_pattern(cupsd_config_t, cupsd_rw_etc_t, cupsd_rw_etc_t)
 374 files_var_filetrans(cupsd_config_t, cupsd_rw_etc_t, file)
 375
 376 can_exec(cupsd_config_t, cupsd_config_exec_t)
 377
 378 allow cupsd_config_t cupsd_log_t:file rw_file_perms;
 379
 380 manage_lnk_files_pattern(cupsd_config_t, cupsd_tmp_t, cupsd_tmp_t)
 381 manage_files_pattern(cupsd_config_t, cupsd_tmp_t, cupsd_tmp_t)
 382 manage_dirs_pattern(cupsd_config_t, cupsd_tmp_t, cupsd_tmp_t)
 383 files_tmp_filetrans(cupsd_config_t, cupsd_tmp_t, { lnk_file file dir })
 384
 385 allow cupsd_config_t cupsd_var_run_t:file read_file_perms;
 386
 387 manage_dirs_pattern(cupsd_config_t, cupsd_config_var_run_t, cupsd_config_var_run_t)
 388 manage_files_pattern(cupsd_config_t, cupsd_config_var_run_t, cupsd_config_var_run_t)
 389 files_pid_filetrans(cupsd_config_t, cupsd_config_var_run_t, { dir file })
 390
 391 domtrans_pattern(cupsd_config_t, hplip_exec_t, hplip_t)
 392
 393 read_files_pattern(cupsd_config_t, hplip_etc_t, hplip_etc_t)
 394
 395 kernel_read_system_state(cupsd_config_t)
 396 kernel_read_all_sysctls(cupsd_config_t)
 397
 398 corenet_all_recvfrom_unlabeled(cupsd_config_t)
 399 corenet_all_recvfrom_netlabel(cupsd_config_t)
 400 corenet_tcp_sendrecv_generic_if(cupsd_config_t)
 401 corenet_tcp_sendrecv_generic_node(cupsd_config_t)
 402 corenet_tcp_sendrecv_all_ports(cupsd_config_t)
 403 corenet_tcp_connect_all_ports(cupsd_config_t)
 404 corenet_sendrecv_all_client_packets(cupsd_config_t)
 405
 406 dev_read_sysfs(cupsd_config_t)
 407 dev_read_urand(cupsd_config_t)
 408 dev_read_rand(cupsd_config_t)
 409 dev_rw_generic_usb_dev(cupsd_config_t)
 410 ifdef(`hide_broken_symptoms', `
 411       dev_rw_generic_chr_files(cupsd_config_t)
 412 ')
 413
 414
 415 files_search_all_mountpoints(cupsd_config_t)
 416
 417 fs_getattr_all_fs(cupsd_config_t)
 418 fs_search_auto_mountpoints(cupsd_config_t)
 419
 420 corecmd_exec_bin(cupsd_config_t)
 421 corecmd_exec_shell(cupsd_config_t)
 422
 423 domain_use_interactive_fds(cupsd_config_t)
 424 # killall causes the following
 425 domain_dontaudit_search_all_domains_state(cupsd_config_t)
 426
 427 files_read_usr_files(cupsd_config_t)
 428 files_read_etc_files(cupsd_config_t)
 429 files_read_etc_runtime_files(cupsd_config_t)
 430 files_read_var_symlinks(cupsd_config_t)
 431
 432 # Alternatives asks for this
 433 init_getattr_all_script_files(cupsd_config_t)
 434
 435 auth_use_nsswitch(cupsd_config_t)
 436
 437 logging_send_syslog_msg(cupsd_config_t)
 438
 439 miscfiles_read_localization(cupsd_config_t)
 440 miscfiles_read_hwdata(cupsd_config_t)
 441
 442 seutil_dontaudit_search_config(cupsd_config_t)
 443
 444 userdom_dontaudit_use_unpriv_user_fds(cupsd_config_t)
 445 userdom_dontaudit_search_user_home_dirs(cupsd_config_t)
 446 userdom_rw_user_tmp_files(cupsd_config_t)
 447 userdom_read_user_tmp_symlinks(cupsd_config_t)
 448
 449 cups_stream_connect(cupsd_config_t)
 450
 451 ifdef(`distro_redhat',`
 452         optional_policy(`
 453                 rpm_read_db(cupsd_config_t)
 454         ')
 455 ')
 456
 457 optional_policy(`
 458         term_use_generic_ptys(cupsd_config_t)
 459 ')
 460
 461 optional_policy(`
 462         cron_system_entry(cupsd_config_t, cupsd_config_exec_t)
 463 ')
 464
 465 optional_policy(`
 466         dbus_system_domain(cupsd_config_t, cupsd_config_exec_t)
 467
 468         optional_policy(`
 469                 hal_dbus_chat(cupsd_config_t)
 470         ')
 471 ')
 472
 473 optional_policy(`
 474         hal_domtrans(cupsd_config_t)
 475         hal_read_tmp_files(cupsd_config_t)
 476         hal_dontaudit_use_fds(hplip_t)
 477 ')
 478
 479 optional_policy(`
 480         hostname_exec(cupsd_config_t)
 481 ')
 482
 483 optional_policy(`
 484         logrotate_use_fds(cupsd_config_t)
 485 ')
 486
 487 optional_policy(`
 488         lpd_read_config(cupsd_config_t)
 489 ')
 490
 491 optional_policy(`
 492         policykit_dbus_chat(cupsd_config_t)
 493         userdom_read_all_users_state(cupsd_config_t)
 494 ')
 495
 496 optional_policy(`
 497         rpm_read_db(cupsd_config_t)
 498 ')
 499
 500 optional_policy(`
 501         seutil_sigchld_newrole(cupsd_config_t)
 502 ')
 503
 504 optional_policy(`
 505         udev_read_db(cupsd_config_t)
 506 ')
 507
 508 optional_policy(`
 509         unconfined_stream_connect(cupsd_config_t)
 510 ')
 511
 512 ########################################
 513 #
 514 # Cups lpd support
 515 #
 516
 517 allow cupsd_lpd_t self:process signal_perms;
 518 allow cupsd_lpd_t self:fifo_file rw_fifo_file_perms;
 519 allow cupsd_lpd_t self:tcp_socket connected_stream_socket_perms;
 520 allow cupsd_lpd_t self:udp_socket create_socket_perms;
 521
 522 # for identd
 523 # cjp: this should probably only be inetd_child rules?
 524 allow cupsd_lpd_t self:netlink_tcpdiag_socket r_netlink_socket_perms;
 525 allow cupsd_lpd_t self:capability { setuid setgid };
 526 files_search_home(cupsd_lpd_t)
 527 optional_policy(`
 528         kerberos_use(cupsd_lpd_t)
 529 ')
 530 #end for identd
 531
 532 allow cupsd_lpd_t cupsd_etc_t:dir list_dir_perms;
 533 read_files_pattern(cupsd_lpd_t, cupsd_etc_t, cupsd_etc_t)
 534 read_lnk_files_pattern(cupsd_lpd_t, cupsd_etc_t, cupsd_etc_t)
 535
 536 allow cupsd_lpd_t cupsd_rw_etc_t:dir list_dir_perms;
 537 read_files_pattern(cupsd_lpd_t, cupsd_rw_etc_t, cupsd_rw_etc_t)
 538 read_lnk_files_pattern(cupsd_lpd_t, cupsd_rw_etc_t, cupsd_rw_etc_t)
 539
 540 manage_dirs_pattern(cupsd_lpd_t, cupsd_lpd_tmp_t, cupsd_lpd_tmp_t)
 541 manage_files_pattern(cupsd_lpd_t, cupsd_lpd_tmp_t, cupsd_lpd_tmp_t)
 542 files_tmp_filetrans(cupsd_lpd_t, cupsd_lpd_tmp_t, { file dir })
 543
 544 manage_files_pattern(cupsd_lpd_t, cupsd_lpd_var_run_t, cupsd_lpd_var_run_t)
 545 files_pid_filetrans(cupsd_lpd_t, cupsd_lpd_var_run_t, file)
 546
 547 kernel_read_kernel_sysctls(cupsd_lpd_t)
 548 kernel_read_system_state(cupsd_lpd_t)
 549 kernel_read_network_state(cupsd_lpd_t)
 550
 551 corenet_all_recvfrom_unlabeled(cupsd_lpd_t)
 552 corenet_all_recvfrom_netlabel(cupsd_lpd_t)
 553 corenet_tcp_sendrecv_generic_if(cupsd_lpd_t)
 554 corenet_udp_sendrecv_generic_if(cupsd_lpd_t)
 555 corenet_tcp_sendrecv_generic_node(cupsd_lpd_t)
 556 corenet_udp_sendrecv_generic_node(cupsd_lpd_t)
 557 corenet_tcp_sendrecv_all_ports(cupsd_lpd_t)
 558 corenet_udp_sendrecv_all_ports(cupsd_lpd_t)
 559 corenet_tcp_bind_generic_node(cupsd_lpd_t)
 560 corenet_udp_bind_generic_node(cupsd_lpd_t)
 561 corenet_tcp_connect_ipp_port(cupsd_lpd_t)
 562
 563 dev_read_urand(cupsd_lpd_t)
 564 dev_read_rand(cupsd_lpd_t)
 565
 566 fs_getattr_xattr_fs(cupsd_lpd_t)
 567
 568 files_read_etc_files(cupsd_lpd_t)
 569
 570 auth_use_nsswitch(cupsd_lpd_t)
 571
 572 logging_send_syslog_msg(cupsd_lpd_t)
 573
 574 miscfiles_read_localization(cupsd_lpd_t)
 575 miscfiles_setattr_fonts_cache_dirs(cupsd_lpd_t)
 576
 577 cups_stream_connect(cupsd_lpd_t)
 578
 579 optional_policy(`
 580         inetd_service_domain(cupsd_lpd_t, cupsd_lpd_exec_t)
 581 ')
 582
 583 ########################################
 584 #
 585 # cups_pdf local policy
 586 #
 587
 588 allow cups_pdf_t self:capability { chown fowner fsetid setuid setgid dac_override };
 589 allow cups_pdf_t self:fifo_file rw_file_perms;
 590 allow cups_pdf_t self:unix_stream_socket create_stream_socket_perms;
 591
 592 manage_files_pattern(cups_pdf_t, cupsd_log_t, cupsd_log_t)
 593
 594 manage_files_pattern(cups_pdf_t, cups_pdf_tmp_t, cups_pdf_tmp_t)
 595 manage_dirs_pattern(cups_pdf_t, cups_pdf_tmp_t, cups_pdf_tmp_t)
 596 files_tmp_filetrans(cups_pdf_t, cups_pdf_tmp_t, { file dir })
 597
 598 fs_rw_anon_inodefs_files(cups_pdf_t)
 599
 600 kernel_read_system_state(cups_pdf_t)
 601
 602 files_read_etc_files(cups_pdf_t)
 603 files_read_usr_files(cups_pdf_t)
 604
 605 corecmd_exec_shell(cups_pdf_t)
 606 corecmd_exec_bin(cups_pdf_t)
 607
 608 auth_use_nsswitch(cups_pdf_t)
 609
 610 miscfiles_read_localization(cups_pdf_t)
 611 miscfiles_read_fonts(cups_pdf_t)
 612 miscfiles_setattr_fonts_cache_dirs(cups_pdf_t)
 613
 614 userdom_home_filetrans_user_home_dir(cups_pdf_t)
 615 userdom_user_home_dir_filetrans_pattern(cups_pdf_t, { file dir })
 616 userdom_manage_user_home_content_dirs(cups_pdf_t)
 617 userdom_manage_user_home_content_files(cups_pdf_t)
 618 userdom_dontaudit_search_admin_dir(cups_pdf_t)
 619
 620 optional_policy(`
 621         lpd_manage_spool(cups_pdf_t)
 622 ')
 623
 624 userdom_home_manager(cups_pdf_t)
 625
 626 ########################################
 627 #
 628 # HPLIP local policy
 629 #
 630
 631 # Needed for USB Scanneer and xsane
 632 allow hplip_t self:capability { dac_override dac_read_search net_raw };
 633 dontaudit hplip_t self:capability sys_tty_config;
 634 allow hplip_t self:fifo_file rw_fifo_file_perms;
 635 allow hplip_t self:process signal_perms;
 636 allow hplip_t self:unix_dgram_socket create_socket_perms;
 637 allow hplip_t self:unix_stream_socket create_socket_perms;
 638 allow hplip_t self:netlink_route_socket r_netlink_socket_perms;
 639 allow hplip_t self:tcp_socket create_stream_socket_perms;
 640 allow hplip_t self:udp_socket create_socket_perms;
 641 allow hplip_t self:rawip_socket create_socket_perms;
 642
 643 allow hplip_t cupsd_etc_t:dir search_dir_perms;
 644 manage_dirs_pattern(hplip_t, cupsd_tmp_t, cupsd_tmp_t)
 645 manage_files_pattern(hplip_t, cupsd_tmp_t, cupsd_tmp_t)
 646 files_tmp_filetrans(hplip_t, cupsd_tmp_t, { file dir })
 647
 648 cups_stream_connect(hplip_t)
 649
 650 allow hplip_t hplip_etc_t:dir list_dir_perms;
 651 read_files_pattern(hplip_t, hplip_etc_t, hplip_etc_t)
 652 read_lnk_files_pattern(hplip_t, hplip_etc_t, hplip_etc_t)
 653 files_search_etc(hplip_t)
 654
 655 manage_files_pattern(hplip_t, hplip_var_lib_t, hplip_var_lib_t)
 656 manage_lnk_files_pattern(hplip_t, hplip_var_lib_t, hplip_var_lib_t)
 657
 658 manage_fifo_files_pattern(hplip_t, hplip_tmp_t, hplip_tmp_t)
 659 files_tmp_filetrans(hplip_t, hplip_tmp_t, fifo_file)
 660
 661 manage_files_pattern(hplip_t, hplip_var_run_t, hplip_var_run_t)
 662 files_pid_filetrans(hplip_t, hplip_var_run_t, file)
 663
 664 kernel_read_system_state(hplip_t)
 665 kernel_read_kernel_sysctls(hplip_t)
 666
 667 corenet_all_recvfrom_unlabeled(hplip_t)
 668 corenet_all_recvfrom_netlabel(hplip_t)
 669 corenet_tcp_sendrecv_generic_if(hplip_t)
 670 corenet_udp_sendrecv_generic_if(hplip_t)
 671 corenet_raw_sendrecv_generic_if(hplip_t)
 672 corenet_tcp_sendrecv_generic_node(hplip_t)
 673 corenet_udp_sendrecv_generic_node(hplip_t)
 674 corenet_raw_sendrecv_generic_node(hplip_t)
 675 corenet_tcp_sendrecv_all_ports(hplip_t)
 676 corenet_udp_sendrecv_all_ports(hplip_t)
 677 corenet_tcp_bind_generic_node(hplip_t)
 678 corenet_udp_bind_generic_node(hplip_t)
 679 corenet_tcp_bind_hplip_port(hplip_t)
 680 corenet_tcp_connect_hplip_port(hplip_t)
 681 corenet_tcp_connect_ipp_port(hplip_t)
 682 corenet_sendrecv_hplip_client_packets(hplip_t)
 683 corenet_receive_hplip_server_packets(hplip_t)
 684 corenet_udp_bind_howl_port(hplip_t)
 685
 686 dev_read_sysfs(hplip_t)
 687 dev_rw_printer(hplip_t)
 688 dev_read_urand(hplip_t)
 689 dev_read_rand(hplip_t)
 690 dev_rw_generic_usb_dev(hplip_t)
 691 dev_rw_usbfs(hplip_t)
 692
 693 fs_getattr_all_fs(hplip_t)
 694 fs_search_auto_mountpoints(hplip_t)
 695 fs_rw_anon_inodefs_files(hplip_t)
 696
 697 # for python
 698 corecmd_exec_bin(hplip_t)
 699
 700 domain_use_interactive_fds(hplip_t)
 701
 702 files_read_etc_files(hplip_t)
 703 files_read_etc_runtime_files(hplip_t)
 704 files_read_usr_files(hplip_t)
 705 files_dontaudit_write_usr_dirs(hplip_t)
 706
 707 logging_send_syslog_msg(hplip_t)
 708
 709 miscfiles_read_localization(hplip_t)
 710
 711 sysnet_read_config(hplip_t)
 712
 713 userdom_dontaudit_use_unpriv_user_fds(hplip_t)
 714 userdom_dontaudit_search_user_home_dirs(hplip_t)
 715 userdom_dontaudit_search_user_home_content(hplip_t)
 716
 717 optional_policy(`
 718         lpd_read_config(hplip_t)
 719         lpd_manage_spool(hplip_t)
 720 ')
 721
 722 optional_policy(`
 723         dbus_system_bus_client(hplip_t)
 724 ')
 725
 726 optional_policy(`
 727         seutil_sigchld_newrole(hplip_t)
 728 ')
 729
 730 optional_policy(`
 731         snmp_read_snmp_var_lib_files(hplip_t)
 732 ')
 733
 734 optional_policy(`
 735         udev_read_db(hplip_t)
 736 ')
 737
 738 ########################################
 739 #
 740 # PTAL local policy
 741 #
 742
 743 allow ptal_t self:capability { chown sys_rawio };
 744 dontaudit ptal_t self:capability sys_tty_config;
 745 allow ptal_t self:fifo_file rw_fifo_file_perms;
 746 allow ptal_t self:unix_dgram_socket create_socket_perms;
 747 allow ptal_t self:unix_stream_socket create_stream_socket_perms;
 748 allow ptal_t self:tcp_socket create_stream_socket_perms;
 749
 750 allow ptal_t ptal_etc_t:dir list_dir_perms;
 751 read_files_pattern(ptal_t, ptal_etc_t, ptal_etc_t)
 752 read_lnk_files_pattern(ptal_t, ptal_etc_t, ptal_etc_t)
 753 files_search_etc(ptal_t)
 754
 755 manage_dirs_pattern(ptal_t, ptal_var_run_t, ptal_var_run_t)
 756 manage_files_pattern(ptal_t, ptal_var_run_t, ptal_var_run_t)
 757 manage_lnk_files_pattern(ptal_t, ptal_var_run_t, ptal_var_run_t)
 758 manage_fifo_files_pattern(ptal_t, ptal_var_run_t, ptal_var_run_t)
 759 manage_sock_files_pattern(ptal_t, ptal_var_run_t, ptal_var_run_t)
 760 files_pid_filetrans(ptal_t, ptal_var_run_t, { dir file lnk_file sock_file fifo_file })
 761
 762 kernel_read_kernel_sysctls(ptal_t)
 763 kernel_list_proc(ptal_t)
 764 kernel_read_proc_symlinks(ptal_t)
 765
 766 corenet_all_recvfrom_unlabeled(ptal_t)
 767 corenet_all_recvfrom_netlabel(ptal_t)
 768 corenet_tcp_sendrecv_generic_if(ptal_t)
 769 corenet_tcp_sendrecv_generic_node(ptal_t)
 770 corenet_tcp_sendrecv_all_ports(ptal_t)
 771 corenet_tcp_bind_generic_node(ptal_t)
 772 corenet_tcp_bind_ptal_port(ptal_t)
 773
 774 dev_read_sysfs(ptal_t)
 775 dev_read_usbfs(ptal_t)
 776 dev_rw_printer(ptal_t)
 777
 778 fs_getattr_all_fs(ptal_t)
 779 fs_search_auto_mountpoints(ptal_t)
 780
 781 domain_use_interactive_fds(ptal_t)
 782
 783 files_read_etc_files(ptal_t)
 784 files_read_etc_runtime_files(ptal_t)
 785
 786 logging_send_syslog_msg(ptal_t)
 787
 788 miscfiles_read_localization(ptal_t)
 789
 790 sysnet_read_config(ptal_t)
 791
 792 userdom_dontaudit_use_unpriv_user_fds(ptal_t)
 793 userdom_dontaudit_search_user_home_content(ptal_t)
 794
 795 optional_policy(`
 796         seutil_sigchld_newrole(ptal_t)
 797 ')
 798
 799 optional_policy(`
 800         udev_read_db(ptal_t)
 801 ')