refpolicy/policy/modules/services/finger.te

   1
   2 policy_module(finger,1.0)
   3
   4 ########################################
   5 #
   6 # Declarations
   7 #
   8 type fingerd_t;
   9 type fingerd_exec_t;
  10 init_daemon_domain(fingerd_t,fingerd_exec_t)
  11 inetd_tcp_service_domain(fingerd_t,fingerd_exec_t)
  12
  13 type fingerd_etc_t; #, usercanread;
  14 files_type(fingerd_etc_t)
  15
  16 type fingerd_log_t;
  17 logging_log_file(fingerd_log_t)
  18
  19 type fingerd_var_run_t;
  20 files_pid_file(fingerd_var_run_t)
  21
  22 ########################################
  23 #
  24 # Local policy
  25 #
  26 allow fingerd_t self:capability { setgid setuid };
  27 dontaudit fingerd_t self:capability { sys_tty_config fsetid };
  28 allow fingerd_t self:process signal_perms;
  29 allow fingerd_t self:fifo_file { read write getattr };
  30 allow fingerd_t self:tcp_socket connected_stream_socket_perms;
  31 allow fingerd_t self:udp_socket create_socket_perms;
  32 allow fingerd_t self:unix_dgram_socket create_socket_perms;
  33 allow fingerd_t self:unix_stream_socket create_socket_perms;
  34
  35 allow fingerd_t fingerd_var_run_t:file create_file_perms;
  36 allow fingerd_t fingerd_var_run_t:dir rw_dir_perms;
  37 files_create_pid(fingerd_t,fingerd_var_run_t)
  38
  39 allow fingerd_t fingerd_etc_t:file r_file_perms;
  40 allow fingerd_t fingerd_etc_t:dir r_dir_perms;
  41 allow fingerd_t fingerd_etc_t:lnk_file { getattr read };
  42
  43 allow fingerd_t fingerd_log_t:file create_file_perms;
  44 logging_create_log(fingerd_t,fingerd_log_t)
  45
  46 kernel_read_kernel_sysctl(fingerd_t)
  47 kernel_read_system_state(fingerd_t)
  48 kernel_tcp_recvfrom(fingerd_t)
  49
  50 corenet_tcp_sendrecv_all_if(fingerd_t)
  51 corenet_udp_sendrecv_all_if(fingerd_t)
  52 corenet_raw_sendrecv_all_if(fingerd_t)
  53 corenet_tcp_sendrecv_all_nodes(fingerd_t)
  54 corenet_udp_sendrecv_all_nodes(fingerd_t)
  55 corenet_raw_sendrecv_all_nodes(fingerd_t)
  56 corenet_tcp_sendrecv_all_ports(fingerd_t)
  57 corenet_udp_sendrecv_all_ports(fingerd_t)
  58 corenet_tcp_bind_all_nodes(fingerd_t)
  59 corenet_udp_bind_all_nodes(fingerd_t)
  60 corenet_tcp_bind_fingerd_port(fingerd_t)
  61
  62 dev_read_sysfs(fingerd_t)
  63
  64 fs_getattr_all_fs(fingerd_t)
  65 fs_search_auto_mountpoints(fingerd_t)
  66
  67 term_search_ptys(fingerd_t)
  68 term_dontaudit_use_console(fingerd_t)
  69 term_getattr_all_user_ttys(fingerd_t)
  70 term_getattr_all_user_ptys(fingerd_t)
  71
  72 auth_read_lastlog(fingerd_t)
  73
  74 corecmd_exec_bin(fingerd_t)
  75 corecmd_exec_sbin(fingerd_t)
  76 corecmd_exec_shell(fingerd_t)
  77
  78 domain_use_wide_inherit_fd(fingerd_t)
  79
  80 files_getattr_home_dir(fingerd_t)
  81 files_read_etc_files(fingerd_t)
  82 files_read_etc_runtime_files(fingerd_t)
  83
  84 init_read_script_pid(fingerd_t)
  85 init_dontaudit_write_script_pid(fingerd_t)
  86 init_use_fd(fingerd_t)
  87 init_use_script_pty(fingerd_t)
  88
  89 libs_use_ld_so(fingerd_t)
  90 libs_use_shared_libs(fingerd_t)
  91
  92 logging_send_syslog_msg(fingerd_t)
  93
  94 mta_getattr_spool(fingerd_t)
  95
  96 sysnet_read_config(fingerd_t)
  97
  98 miscfiles_read_localization(fingerd_t)
  99
 100 userdom_read_unpriv_user_home_files(fingerd_t)
 101 userdom_dontaudit_use_unpriv_user_fd(fingerd_t)
 102 userdom_dontaudit_search_sysadm_home_dir(fingerd_t)
 103
 104 ifdef(`targeted_policy',`
 105         term_dontaudit_use_unallocated_tty(fingerd_t)
 106         term_dontaudit_use_generic_pty(fingerd_t)
 107         files_dontaudit_read_root_file(fingerd_t)
 108 ')
 109
 110 optional_policy(`cron.te',`
 111         cron_system_entry(fingerd_t,fingerd_exec_t)
 112 ')
 113
 114 optional_policy(`logrotate.te',`
 115         logrotate_exec(fingerd_t)
 116 ')
 117
 118 optional_policy(`nis.te',`
 119         nis_use_ypbind(fingerd_t)
 120 ')
 121
 122 optional_policy(`selinuxutil.te',`
 123         seutil_sigchld_newrole(fingerd_t)
 124 ')
 125
 126 optional_policy(`udev.te',`
 127         udev_read_db(fingerd_t)
 128 ')
 129
 130 ifdef(`TODO',`
 131 optional_policy(`rhgb.te',`
 132         rhgb_domain(fingerd_t)
 133 ')
 134 ')