policy/modules/services/ricci.te

   1
   2 policy_module(ricci, 1.4.0)
   3
   4 ########################################
   5 #
   6 # Declarations
   7 #
   8
   9 type ricci_t;
  10 type ricci_exec_t;
  11 domain_type(ricci_t)
  12 init_daemon_domain(ricci_t, ricci_exec_t)
  13
  14 # tmp files
  15 type ricci_tmp_t;
  16 files_tmp_file(ricci_tmp_t)
  17
  18 # var/lib files
  19 type ricci_var_lib_t;
  20 files_type(ricci_var_lib_t)
  21
  22 # log files
  23 type ricci_var_log_t;
  24 logging_log_file(ricci_var_log_t)
  25
  26 # pid files
  27 type ricci_var_run_t;
  28 files_pid_file(ricci_var_run_t)
  29
  30 type ricci_modcluster_t;
  31 type ricci_modcluster_exec_t;
  32 domain_type(ricci_modcluster_t)
  33 domain_entry_file(ricci_modcluster_t, ricci_modcluster_exec_t)
  34 role system_r types ricci_modcluster_t;
  35
  36 # var/lib files
  37 type ricci_modcluster_var_lib_t;
  38 files_type(ricci_modcluster_var_lib_t)
  39
  40 # log files
  41 type ricci_modcluster_var_log_t;
  42 logging_log_file(ricci_modcluster_var_log_t)
  43
  44 # pid files
  45 type ricci_modcluster_var_run_t;
  46 files_pid_file(ricci_modcluster_var_run_t)
  47
  48 type ricci_modclusterd_t;
  49 type ricci_modclusterd_exec_t;
  50 domain_type(ricci_modclusterd_t)
  51 init_daemon_domain(ricci_modclusterd_t, ricci_modclusterd_exec_t)
  52
  53 type ricci_modlog_t;
  54 type ricci_modlog_exec_t;
  55 domain_type(ricci_modlog_t)
  56 domain_entry_file(ricci_modlog_t, ricci_modlog_exec_t)
  57 role system_r types ricci_modlog_t;
  58
  59 type ricci_modrpm_t;
  60 type ricci_modrpm_exec_t;
  61 domain_type(ricci_modrpm_t)
  62 domain_entry_file(ricci_modrpm_t, ricci_modrpm_exec_t)
  63 role system_r types ricci_modrpm_t;
  64
  65 type ricci_modservice_t;
  66 type ricci_modservice_exec_t;
  67 domain_type(ricci_modservice_t)
  68 domain_entry_file(ricci_modservice_t, ricci_modservice_exec_t)
  69 role system_r types ricci_modservice_t;
  70
  71 type ricci_modstorage_t;
  72 type ricci_modstorage_exec_t;
  73 domain_type(ricci_modstorage_t)
  74 domain_entry_file(ricci_modstorage_t, ricci_modstorage_exec_t)
  75 role system_r types ricci_modstorage_t;
  76
  77 type ricci_modstorage_lock_t;
  78 files_lock_file(ricci_modstorage_lock_t)
  79
  80 ########################################
  81 #
  82 # ricci local policy
  83 #
  84
  85 allow ricci_t self:capability { setuid sys_nice sys_boot };
  86 allow ricci_t self:process setsched;
  87 allow ricci_t self:fifo_file rw_fifo_file_perms;
  88 allow ricci_t self:unix_stream_socket { create_stream_socket_perms connectto };
  89 allow ricci_t self:tcp_socket create_stream_socket_perms;
  90
  91 domain_auto_trans(ricci_t, ricci_modcluster_exec_t, ricci_modcluster_t)
  92 domain_auto_trans(ricci_t, ricci_modlog_exec_t, ricci_modlog_t)
  93 domain_auto_trans(ricci_t, ricci_modrpm_exec_t, ricci_modrpm_t)
  94 domain_auto_trans(ricci_t, ricci_modservice_exec_t, ricci_modservice_t)
  95 domain_auto_trans(ricci_t, ricci_modstorage_exec_t, ricci_modstorage_t)
  96
  97 # tmp file
  98 manage_dirs_pattern(ricci_t, ricci_tmp_t, ricci_tmp_t)
  99 manage_files_pattern(ricci_t, ricci_tmp_t, ricci_tmp_t)
 100 files_tmp_filetrans(ricci_t, ricci_tmp_t, { file dir })
 101
 102 # var/lib files for ricci
 103 manage_dirs_pattern(ricci_t, ricci_var_lib_t, ricci_var_lib_t)
 104 manage_files_pattern(ricci_t, ricci_var_lib_t, ricci_var_lib_t)
 105 manage_sock_files_pattern(ricci_t, ricci_var_lib_t, ricci_var_lib_t)
 106 files_var_lib_filetrans(ricci_t, ricci_var_lib_t, { file dir sock_file })
 107
 108 # log files
 109 allow ricci_t ricci_var_log_t:dir setattr;
 110 manage_files_pattern(ricci_t, ricci_var_log_t, ricci_var_log_t)
 111 manage_sock_files_pattern(ricci_t, ricci_var_log_t, ricci_var_log_t)
 112 logging_log_filetrans(ricci_t, ricci_var_log_t, { sock_file file dir })
 113
 114 # pid file
 115 manage_files_pattern(ricci_t, ricci_var_run_t, ricci_var_run_t)
 116 manage_sock_files_pattern(ricci_t, ricci_var_run_t, ricci_var_run_t)
 117 files_pid_filetrans(ricci_t, ricci_var_run_t, { file sock_file })
 118
 119 kernel_read_kernel_sysctls(ricci_t)
 120
 121 corecmd_exec_bin(ricci_t)
 122
 123 corenet_all_recvfrom_unlabeled(ricci_t)
 124 corenet_all_recvfrom_netlabel(ricci_t)
 125 corenet_tcp_sendrecv_all_if(ricci_t)
 126 corenet_tcp_sendrecv_all_nodes(ricci_t)
 127 corenet_tcp_sendrecv_all_ports(ricci_t)
 128 corenet_tcp_bind_all_nodes(ricci_t)
 129 corenet_udp_bind_all_nodes(ricci_t)
 130 corenet_tcp_bind_ricci_port(ricci_t)
 131 corenet_udp_bind_ricci_port(ricci_t)
 132 corenet_tcp_connect_http_port(ricci_t)
 133
 134 dev_read_urand(ricci_t)
 135
 136 files_read_etc_files(ricci_t)
 137 files_read_etc_runtime_files(ricci_t)
 138 files_create_boot_flag(ricci_t)
 139
 140 auth_domtrans_chk_passwd(ricci_t)
 141 auth_append_login_records(ricci_t)
 142
 143 init_dontaudit_stream_connect_script(ricci_t)
 144
 145 libs_use_ld_so(ricci_t)
 146 libs_use_shared_libs(ricci_t)
 147
 148 locallogin_dontaudit_use_fds(ricci_t)
 149
 150 logging_send_syslog_msg(ricci_t)
 151
 152 miscfiles_read_localization(ricci_t)
 153
 154 sysnet_dns_name_resolve(ricci_t)
 155
 156 optional_policy(`
 157         ccs_read_config(ricci_t)
 158 ')
 159
 160 optional_policy(`
 161         dbus_system_bus_client_template(ricci, ricci_t)
 162
 163         oddjob_dbus_chat(ricci_t)
 164 ')
 165
 166 optional_policy(`
 167         # Needed so oddjob can run halt/reboot on behalf of ricci
 168         corecmd_bin_entry_type(ricci_t)
 169         term_dontaudit_search_ptys(ricci_t)
 170         init_exec(ricci_t)
 171         init_telinit(ricci_t)
 172         init_rw_utmp(ricci_t)
 173
 174         oddjob_system_entry(ricci_t, ricci_exec_t)
 175 ')
 176
 177 optional_policy(`
 178         rpm_use_script_fds(ricci_t)
 179 ')
 180
 181 optional_policy(`
 182         sasl_connect(ricci_t)
 183 ')
 184
 185 optional_policy(`
 186         unconfined_use_fds(ricci_t)
 187 ')
 188
 189 optional_policy(`
 190         xen_domtrans_xm(ricci_t)
 191 ')
 192
 193 ########################################
 194 #
 195 # ricci_modcluster local policy
 196 #
 197
 198 allow ricci_modcluster_t self:capability sys_nice;
 199 allow ricci_modcluster_t self:process setsched;
 200 allow ricci_modcluster_t self:fifo_file rw_fifo_file_perms;
 201
 202 kernel_read_kernel_sysctls(ricci_modcluster_t)
 203 kernel_read_system_state(ricci_modcluster_t)
 204
 205 corecmd_exec_shell(ricci_modcluster_t)
 206 corecmd_exec_bin(ricci_modcluster_t)
 207
 208 domain_dontaudit_read_all_domains_state(ricci_modcluster_t)
 209
 210 files_search_locks(ricci_modcluster_t)
 211 files_read_etc_runtime_files(ricci_modcluster_t)
 212 files_read_etc_files(ricci_modcluster_t)
 213 files_search_usr(ricci_modcluster_t)
 214
 215 init_exec(ricci_modcluster_t)
 216 init_domtrans_script(ricci_modcluster_t)
 217
 218 libs_use_ld_so(ricci_modcluster_t)
 219 libs_use_shared_libs(ricci_modcluster_t)
 220
 221 logging_send_syslog_msg(ricci_modcluster_t)
 222
 223 miscfiles_read_localization(ricci_modcluster_t)
 224
 225 modutils_domtrans_insmod(ricci_modcluster_t)
 226
 227 mount_domtrans(ricci_modcluster_t)
 228
 229 ricci_stream_connect_modclusterd(ricci_modcluster_t)
 230
 231 optional_policy(`
 232         ccs_stream_connect(ricci_modcluster_t)
 233         ccs_domtrans(ricci_modcluster_t)
 234         ccs_manage_config(ricci_modcluster_t)
 235 ')
 236
 237 optional_policy(`
 238         consoletype_exec(ricci_modcluster_t)
 239 ')
 240
 241 optional_policy(`
 242         lvm_domtrans(ricci_modcluster_t)
 243 ')
 244
 245 optional_policy(`
 246         nscd_socket_use(ricci_modcluster_t)
 247 ')
 248
 249 optional_policy(`
 250         oddjob_system_entry(ricci_modcluster_t, ricci_modcluster_exec_t)
 251 ')
 252
 253 optional_policy(`
 254         # XXX This has got to go.
 255         unconfined_domain(ricci_modcluster_t)
 256 ')
 257
 258 ########################################
 259 #
 260 # ricci_modclusterd local policy
 261 #
 262
 263 allow ricci_modclusterd_t self:capability { sys_nice sys_tty_config };
 264 allow ricci_modclusterd_t self:process { signal sigkill setsched };
 265 allow ricci_modclusterd_t self:fifo_file rw_fifo_file_perms;
 266 allow ricci_modclusterd_t self:unix_stream_socket create_stream_socket_perms;
 267 allow ricci_modclusterd_t self:tcp_socket create_stream_socket_perms;
 268 allow ricci_modclusterd_t self:netlink_route_socket r_netlink_socket_perms;
 269 # cjp: this needs to be fixed for a specific socket type:
 270 allow ricci_modclusterd_t self:socket create_socket_perms;
 271
 272 allow ricci_modclusterd_t ricci_modcluster_t:unix_stream_socket connectto;
 273
 274 # log files
 275 allow ricci_modclusterd_t ricci_modcluster_var_log_t:dir setattr;
 276 manage_files_pattern(ricci_modclusterd_t, ricci_modcluster_var_log_t, ricci_modcluster_var_log_t)
 277 manage_sock_files_pattern(ricci_modclusterd_t, ricci_modcluster_var_log_t, ricci_modcluster_var_log_t)
 278 logging_log_filetrans(ricci_modclusterd_t, ricci_modcluster_var_log_t, { sock_file file dir })
 279
 280 # pid file
 281 manage_files_pattern(ricci_modclusterd_t, ricci_modcluster_var_run_t, ricci_modcluster_var_run_t)
 282 manage_sock_files_pattern(ricci_modclusterd_t, ricci_modcluster_var_run_t, ricci_modcluster_var_run_t)
 283 files_pid_filetrans(ricci_modclusterd_t, ricci_modcluster_var_run_t, { file sock_file })
 284
 285 kernel_read_kernel_sysctls(ricci_modclusterd_t)
 286 kernel_read_system_state(ricci_modclusterd_t)
 287
 288 corecmd_exec_bin(ricci_modclusterd_t)
 289
 290 corenet_tcp_sendrecv_all_if(ricci_modclusterd_t)
 291 corenet_tcp_sendrecv_all_ports(ricci_modclusterd_t)
 292 corenet_tcp_bind_all_nodes(ricci_modclusterd_t)
 293 corenet_tcp_bind_ricci_modcluster_port(ricci_modclusterd_t)
 294 corenet_tcp_connect_ricci_modcluster_port(ricci_modclusterd_t)
 295
 296 domain_dontaudit_read_all_domains_state(ricci_modclusterd_t)
 297
 298 files_read_etc_files(ricci_modclusterd_t)
 299 files_read_etc_runtime_files(ricci_modclusterd_t)
 300
 301 fs_getattr_xattr_fs(ricci_modclusterd_t)
 302
 303 init_dontaudit_stream_connect_script(ricci_modclusterd_t)
 304
 305 libs_use_ld_so(ricci_modclusterd_t)
 306 libs_use_shared_libs(ricci_modclusterd_t)
 307
 308 locallogin_dontaudit_use_fds(ricci_modclusterd_t)
 309
 310 logging_send_syslog_msg(ricci_modclusterd_t)
 311
 312 miscfiles_read_localization(ricci_modclusterd_t)
 313
 314 sysnet_domtrans_ifconfig(ricci_modclusterd_t)
 315 sysnet_dns_name_resolve(ricci_modclusterd_t)
 316
 317 optional_policy(`
 318         ccs_domtrans(ricci_modclusterd_t)
 319         ccs_stream_connect(ricci_modclusterd_t)
 320         ccs_read_config(ricci_modclusterd_t)
 321 ')
 322
 323 optional_policy(`
 324         unconfined_use_fds(ricci_modclusterd_t)
 325 ')
 326
 327 ########################################
 328 #
 329 # ricci_modlog local policy
 330 #
 331
 332 allow ricci_modlog_t self:capability sys_nice;
 333 allow ricci_modlog_t self:process setsched;
 334
 335 kernel_read_kernel_sysctls(ricci_modlog_t)
 336 kernel_read_system_state(ricci_modlog_t)
 337
 338 corecmd_exec_bin(ricci_modlog_t)
 339
 340 domain_dontaudit_read_all_domains_state(ricci_modlog_t)
 341
 342 files_read_etc_files(ricci_modlog_t)
 343 files_search_usr(ricci_modlog_t)
 344
 345 libs_use_ld_so(ricci_modlog_t)
 346 libs_use_shared_libs(ricci_modlog_t)
 347
 348 logging_read_generic_logs(ricci_modlog_t)
 349
 350 miscfiles_read_localization(ricci_modlog_t)
 351
 352 optional_policy(`
 353         nscd_dontaudit_search_pid(ricci_modlog_t)
 354 ')
 355
 356 optional_policy(`
 357         oddjob_system_entry(ricci_modlog_t, ricci_modlog_exec_t)
 358 ')
 359
 360 ########################################
 361 #
 362 # ricci_modrpm local policy
 363 #
 364
 365 allow ricci_modrpm_t self:fifo_file read_fifo_file_perms;
 366
 367 kernel_read_kernel_sysctls(ricci_modrpm_t)
 368
 369 corecmd_exec_bin(ricci_modrpm_t)
 370
 371 libs_use_ld_so(ricci_modrpm_t)
 372 libs_use_shared_libs(ricci_modrpm_t)
 373
 374 files_search_usr(ricci_modrpm_t)
 375 files_read_etc_files(ricci_modrpm_t)
 376
 377 miscfiles_read_localization(ricci_modrpm_t)
 378
 379 optional_policy(`
 380         oddjob_system_entry(ricci_modrpm_t, ricci_modrpm_exec_t)
 381 ')
 382
 383 optional_policy(`
 384         rpm_domtrans(ricci_modrpm_t)
 385 ')
 386
 387 ########################################
 388 #
 389 # ricci_modservice local policy
 390 #
 391
 392 allow ricci_modservice_t self:capability { dac_override sys_nice };
 393 allow ricci_modservice_t self:fifo_file rw_fifo_file_perms;
 394 allow ricci_modservice_t self:process setsched;
 395
 396 kernel_read_kernel_sysctls(ricci_modservice_t)
 397 kernel_read_system_state(ricci_modservice_t)
 398
 399 corecmd_exec_bin(ricci_modservice_t)
 400 corecmd_exec_shell(ricci_modservice_t)
 401
 402 files_read_etc_files(ricci_modservice_t)
 403 files_read_etc_runtime_files(ricci_modservice_t)
 404 files_search_usr(ricci_modservice_t)
 405 # Needed for running chkconfig
 406 files_manage_etc_symlinks(ricci_modservice_t)
 407
 408 consoletype_exec(ricci_modservice_t)
 409
 410 init_domtrans_script(ricci_modservice_t)
 411
 412 libs_use_ld_so(ricci_modservice_t)
 413 libs_use_shared_libs(ricci_modservice_t)
 414
 415 miscfiles_read_localization(ricci_modservice_t)
 416
 417 optional_policy(`
 418         ccs_read_config(ricci_modservice_t)
 419 ')
 420
 421 optional_policy(`
 422         nscd_dontaudit_search_pid(ricci_modservice_t)
 423 ')
 424
 425 optional_policy(`
 426         oddjob_system_entry(ricci_modservice_t, ricci_modservice_exec_t)
 427 ')
 428
 429 ########################################
 430 #
 431 # ricci_modstorage local policy
 432 #
 433
 434 allow ricci_modstorage_t self:process { setsched signal };
 435 dontaudit ricci_modstorage_t self:process ptrace;
 436 allow ricci_modstorage_t self:capability { mknod sys_nice };
 437 allow ricci_modstorage_t self:fifo_file rw_fifo_file_perms;
 438 allow ricci_modstorage_t self:unix_dgram_socket create_socket_perms;
 439
 440 kernel_read_kernel_sysctls(ricci_modstorage_t)
 441 kernel_read_system_state(ricci_modstorage_t)
 442
 443 create_files_pattern(ricci_modstorage_t, ricci_modstorage_lock_t, ricci_modstorage_lock_t)
 444 files_lock_filetrans(ricci_modstorage_t, ricci_modstorage_lock_t, file)
 445
 446 corecmd_exec_shell(ricci_modstorage_t)
 447 corecmd_exec_bin(ricci_modstorage_t)
 448
 449 dev_read_sysfs(ricci_modstorage_t)
 450 dev_read_urand(ricci_modstorage_t)
 451 dev_manage_generic_blk_files(ricci_modstorage_t)
 452
 453 domain_dontaudit_read_all_domains_state(ricci_modstorage_t)
 454
 455 #Needed for editing /etc/fstab
 456 files_manage_etc_files(ricci_modstorage_t)
 457 files_read_etc_runtime_files(ricci_modstorage_t)
 458 files_read_usr_files(ricci_modstorage_t)
 459 files_read_kernel_modules(ricci_modstorage_t)
 460
 461 storage_raw_read_fixed_disk(ricci_modstorage_t)
 462
 463 term_dontaudit_use_console(ricci_modstorage_t)
 464
 465 fstools_domtrans(ricci_modstorage_t)
 466
 467 libs_use_ld_so(ricci_modstorage_t)
 468 libs_use_shared_libs(ricci_modstorage_t)
 469
 470 logging_send_syslog_msg(ricci_modstorage_t)
 471
 472 miscfiles_read_localization(ricci_modstorage_t)
 473
 474 modutils_read_module_deps(ricci_modstorage_t)
 475
 476 optional_policy(`
 477         ccs_stream_connect(ricci_modstorage_t)
 478         ccs_read_config(ricci_modstorage_t)
 479 ')
 480
 481 optional_policy(`
 482         lvm_domtrans(ricci_modstorage_t)
 483         lvm_manage_config(ricci_modstorage_t)
 484 ')
 485
 486 optional_policy(`
 487         nscd_socket_use(ricci_modstorage_t)
 488 ')
 489
 490 optional_policy(`
 491         oddjob_system_entry(ricci_modstorage_t, ricci_modstorage_exec_t)
 492 ')
 493
 494 optional_policy(`
 495         raid_domtrans_mdadm(ricci_modstorage_t)
 496 ')