policy/modules/admin/kudzu.te

   1
   2 policy_module(kudzu, 1.8.0)
   3
   4 ########################################
   5 #
   6 # Declarations
   7 #
   8
   9 type kudzu_t;
  10 type kudzu_exec_t;
  11 init_system_domain(kudzu_t, kudzu_exec_t)
  12
  13 type kudzu_tmp_t;
  14 files_tmp_file(kudzu_tmp_t)
  15
  16 type kudzu_var_run_t;
  17 files_pid_file(kudzu_var_run_t)
  18
  19 ########################################
  20 #
  21 # Local policy
  22 #
  23
  24 allow kudzu_t self:capability { dac_override sys_admin sys_ptrace sys_rawio net_admin sys_tty_config mknod };
  25 dontaudit kudzu_t self:capability sys_tty_config;
  26 allow kudzu_t self:process { signal_perms execmem };
  27 allow kudzu_t self:fifo_file rw_fifo_file_perms;
  28 allow kudzu_t self:unix_stream_socket { connectto create_stream_socket_perms };
  29 allow kudzu_t self:unix_dgram_socket create_socket_perms;
  30 allow kudzu_t self:udp_socket { create ioctl };
  31
  32 manage_dirs_pattern(kudzu_t, kudzu_tmp_t, kudzu_tmp_t)
  33 manage_files_pattern(kudzu_t, kudzu_tmp_t, kudzu_tmp_t)
  34 manage_chr_files_pattern(kudzu_t, kudzu_tmp_t, kudzu_tmp_t)
  35 files_tmp_filetrans(kudzu_t, kudzu_tmp_t, { file dir chr_file })
  36
  37 manage_dirs_pattern(kudzu_t, kudzu_var_run_t, kudzu_var_run_t)
  38 manage_files_pattern(kudzu_t, kudzu_var_run_t, kudzu_var_run_t)
  39 files_pid_filetrans(kudzu_t, kudzu_var_run_t, file)
  40
  41 kernel_change_ring_buffer_level(kudzu_t)
  42 kernel_list_proc(kudzu_t)
  43 kernel_read_device_sysctls(kudzu_t)
  44 kernel_read_kernel_sysctls(kudzu_t)
  45 kernel_read_proc_symlinks(kudzu_t)
  46 kernel_read_network_state(kudzu_t)
  47 kernel_read_system_state(kudzu_t)
  48 kernel_rw_hotplug_sysctls(kudzu_t)
  49 kernel_rw_kernel_sysctl(kudzu_t)
  50
  51 files_read_kernel_modules(kudzu_t)
  52
  53 dev_list_sysfs(kudzu_t)
  54 dev_read_usbfs(kudzu_t)
  55 dev_read_sysfs(kudzu_t)
  56 dev_rx_raw_memory(kudzu_t)
  57 dev_wx_raw_memory(kudzu_t)
  58 dev_rw_mouse(kudzu_t)
  59 dev_rwx_zero(kudzu_t)
  60
  61 fs_search_auto_mountpoints(kudzu_t)
  62 fs_search_ramfs(kudzu_t)
  63 fs_write_ramfs_sockets(kudzu_t)
  64
  65 mls_file_read_all_levels(kudzu_t)
  66 mls_file_write_all_levels(kudzu_t)
  67
  68 modutils_read_module_deps(kudzu_t)
  69 modutils_read_module_config(kudzu_t)
  70 modutils_rename_module_config(kudzu_t)
  71 modutils_delete_module_config(kudzu_t)
  72
  73 storage_read_scsi_generic(kudzu_t)
  74 storage_read_tape(kudzu_t)
  75 storage_raw_write_fixed_disk(kudzu_t)
  76 storage_raw_write_removable_device(kudzu_t)
  77 storage_raw_read_fixed_disk(kudzu_t)
  78 storage_raw_read_removable_device(kudzu_t)
  79
  80 term_dontaudit_use_console(kudzu_t)
  81 # so it can write messages to the console
  82 term_use_unallocated_ttys(kudzu_t)
  83
  84 corecmd_exec_all_executables(kudzu_t)
  85
  86 domain_use_interactive_fds(kudzu_t)
  87
  88 files_search_var(kudzu_t)
  89 files_search_locks(kudzu_t)
  90 files_manage_etc_files(kudzu_t)
  91 files_manage_etc_runtime_files(kudzu_t)
  92 files_etc_filetrans_etc_runtime(kudzu_t, file)
  93 files_manage_mnt_files(kudzu_t)
  94 files_manage_mnt_symlinks(kudzu_t)
  95 files_dontaudit_search_src(kudzu_t)
  96 # Read /usr/share/hwdata/.* and /usr/share/terminfo/l/linux
  97 files_read_usr_files(kudzu_t)
  98 # for /etc/sysconfig/hwconf - probably need a new type
  99 files_rw_etc_runtime_files(kudzu_t)
 100 # for file systems that are not yet mounted
 101 files_dontaudit_search_isid_type_dirs(kudzu_t)
 102
 103 init_use_fds(kudzu_t)
 104 init_use_script_ptys(kudzu_t)
 105 init_stream_connect_script(kudzu_t)
 106 init_read_state(kudzu_t)
 107 init_ptrace(kudzu_t)
 108 # kudzu will telinit to make init re-read
 109 # the inittab after configuring serial consoles
 110 init_telinit(kudzu_t)
 111
 112 # Read /usr/lib/gconv/gconv-modules.*
 113 libs_read_lib_files(kudzu_t)
 114
 115 logging_send_syslog_msg(kudzu_t)
 116
 117 miscfiles_read_hwdata(kudzu_t)
 118 miscfiles_read_localization(kudzu_t)
 119
 120 modutils_read_module_config(kudzu_t)
 121 modutils_domtrans_insmod(kudzu_t)
 122
 123 sysnet_read_config(kudzu_t)
 124
 125 userdom_use_user_terminals(kudzu_t)
 126 userdom_dontaudit_use_unpriv_user_fds(kudzu_t)
 127 userdom_search_user_home_dirs(kudzu_t)
 128
 129 optional_policy(`
 130         gpm_getattr_gpmctl(kudzu_t)
 131 ')
 132
 133 optional_policy(`
 134         nscd_socket_use(kudzu_t)
 135 ')
 136
 137 optional_policy(`
 138         seutil_sigchld_newrole(kudzu_t)
 139 ')
 140
 141 optional_policy(`
 142         udev_read_db(kudzu_t)
 143 ')
 144
 145 optional_policy(`
 146         unconfined_domtrans(kudzu_t)
 147         unconfined_domain(kudzu_t)
 148 ')