policy/modules/services/abrt.te

   1 policy_module(abrt, 1.2.0)
   2
   3 ########################################
   4 #
   5 # Declarations
   6 #
   7
   8 ## <desc>
   9 ##      <p>
  10 ##      Allow ABRT to modify public files
  11 ##      used for public file transfer services.
  12 ##      </p>
  13 ## </desc>
  14 gen_tunable(abrt_anon_write, false)
  15
  16 ## <desc>
  17 ##  <p>
  18 ##  Allow ABRT to run in abrt_handle_event_t domain
  19 ##  to handle ABRT event scripts
  20 ##  </p>
  21 ## </desc>
  22 gen_tunable(abrt_handle_event, false)
  23
  24 attribute abrt_domain;
  25
  26 type abrt_t, abrt_domain;
  27 type abrt_exec_t;
  28 init_daemon_domain(abrt_t, abrt_exec_t)
  29
  30 type abrt_initrc_exec_t;
  31 init_script_file(abrt_initrc_exec_t)
  32
  33 # etc files
  34 type abrt_etc_t;
  35 files_config_file(abrt_etc_t)
  36
  37 # log files
  38 type abrt_var_log_t;
  39 logging_log_file(abrt_var_log_t)
  40
  41 # tmp files
  42 type abrt_tmp_t;
  43 files_tmp_file(abrt_tmp_t)
  44
  45 # var/cache files
  46 type abrt_var_cache_t;
  47 files_type(abrt_var_cache_t)
  48
  49 # pid files
  50 type abrt_var_run_t;
  51 files_pid_file(abrt_var_run_t)
  52
  53 type abrt_dump_oops_t, abrt_domain;
  54 type abrt_dump_oops_exec_t;
  55 init_system_domain(abrt_dump_oops_t, abrt_dump_oops_exec_t)
  56
  57 # type for abrt-handle-event to handle
  58 # ABRT event scripts
  59 type abrt_handle_event_t, abrt_domain;
  60 type abrt_handle_event_exec_t;
  61 application_domain(abrt_handle_event_t, abrt_handle_event_exec_t)
  62 role system_r types abrt_handle_event_t;
  63
  64 # type needed to allow all domains
  65 # to handle /var/cache/abrt
  66 type abrt_helper_t, abrt_domain;
  67 type abrt_helper_exec_t;
  68 application_domain(abrt_helper_t, abrt_helper_exec_t)
  69 role system_r types abrt_helper_t;
  70
  71 ifdef(`enable_mcs',`
  72         init_ranged_daemon_domain(abrt_t, abrt_exec_t, s0 - mcs_systemhigh)
  73 ')
  74
  75 #
  76 # Support for ABRT retrace server
  77 #
  78
  79 type abrt_retrace_worker_t, abrt_domain;
  80 type abrt_retrace_worker_exec_t;
  81 application_domain(abrt_retrace_worker_t, abrt_retrace_worker_exec_t)
  82 role system_r types abrt_retrace_worker_t;
  83
  84 type abrt_retrace_coredump_t, abrt_domain;
  85 type abrt_retrace_coredump_exec_t;
  86 application_domain(abrt_retrace_coredump_t, abrt_retrace_coredump_exec_t)
  87 role system_r types abrt_retrace_coredump_t;
  88
  89 type abrt_retrace_cache_t;
  90 files_type(abrt_retrace_cache_t)
  91
  92 type abrt_retrace_spool_t;
  93 files_spool_file(abrt_retrace_spool_t)
  94
  95 ########################################
  96 #
  97 # abrt local policy
  98 #
  99
 100 allow abrt_t self:capability { chown dac_override fowner fsetid kill setgid setuid sys_nice };
 101 dontaudit abrt_t self:capability sys_rawio;
 102 allow abrt_t self:process { setpgid sigkill signal signull setsched getsched };
 103
 104 allow abrt_t self:fifo_file rw_fifo_file_perms;
 105 allow abrt_t self:tcp_socket create_stream_socket_perms;
 106 allow abrt_t self:udp_socket create_socket_perms;
 107 allow abrt_t self:unix_dgram_socket create_socket_perms;
 108
 109 # abrt etc files
 110 list_dirs_pattern(abrt_t, abrt_etc_t, abrt_etc_t)
 111 rw_files_pattern(abrt_t, abrt_etc_t, abrt_etc_t)
 112
 113 # log file
 114 manage_files_pattern(abrt_t, abrt_var_log_t, abrt_var_log_t)
 115 logging_log_filetrans(abrt_t, abrt_var_log_t, file)
 116
 117 # abrt tmp files
 118 manage_dirs_pattern(abrt_t, abrt_tmp_t, abrt_tmp_t)
 119 manage_files_pattern(abrt_t, abrt_tmp_t, abrt_tmp_t)
 120 manage_lnk_files_pattern(abrt_t, abrt_tmp_t, abrt_tmp_t)
 121 files_tmp_filetrans(abrt_t, abrt_tmp_t, { file dir })
 122 can_exec(abrt_t, abrt_tmp_t)
 123
 124 # abrt var/cache files
 125 manage_files_pattern(abrt_t, abrt_var_cache_t, abrt_var_cache_t)
 126 manage_dirs_pattern(abrt_t, abrt_var_cache_t, abrt_var_cache_t)
 127 manage_lnk_files_pattern(abrt_t, abrt_var_cache_t, abrt_var_cache_t)
 128 files_var_filetrans(abrt_t, abrt_var_cache_t, { file dir })
 129 files_spool_filetrans(abrt_t, abrt_var_cache_t, dir)
 130
 131 # abrt pid files
 132 manage_files_pattern(abrt_t, abrt_var_run_t, abrt_var_run_t)
 133 manage_dirs_pattern(abrt_t, abrt_var_run_t, abrt_var_run_t)
 134 manage_sock_files_pattern(abrt_t, abrt_var_run_t, abrt_var_run_t)
 135 manage_lnk_files_pattern(abrt_t, abrt_var_run_t, abrt_var_run_t)
 136 files_pid_filetrans(abrt_t, abrt_var_run_t, { file dir sock_file })
 137
 138 kernel_read_ring_buffer(abrt_t)
 139 kernel_rw_kernel_sysctl(abrt_t)
 140
 141 corecmd_exec_bin(abrt_t)
 142 corecmd_exec_shell(abrt_t)
 143 corecmd_read_all_executables(abrt_t)
 144
 145 corenet_all_recvfrom_netlabel(abrt_t)
 146 corenet_all_recvfrom_unlabeled(abrt_t)
 147 corenet_tcp_sendrecv_generic_if(abrt_t)
 148 corenet_tcp_sendrecv_generic_node(abrt_t)
 149 corenet_tcp_sendrecv_generic_port(abrt_t)
 150 corenet_tcp_bind_generic_node(abrt_t)
 151 corenet_tcp_connect_http_port(abrt_t)
 152 corenet_tcp_connect_ftp_port(abrt_t)
 153 corenet_tcp_connect_all_ports(abrt_t)
 154 corenet_sendrecv_http_client_packets(abrt_t)
 155
 156 dev_getattr_all_chr_files(abrt_t)
 157 dev_getattr_all_blk_files(abrt_t)
 158 dev_read_rand(abrt_t)
 159 dev_read_urand(abrt_t)
 160 dev_rw_sysfs(abrt_t)
 161 dev_dontaudit_read_raw_memory(abrt_t)
 162
 163 domain_getattr_all_domains(abrt_t)
 164 domain_read_all_domains_state(abrt_t)
 165 domain_signull_all_domains(abrt_t)
 166
 167 files_getattr_all_files(abrt_t)
 168 files_read_config_files(abrt_t)
 169 files_read_etc_runtime_files(abrt_t)
 170 files_read_var_symlinks(abrt_t)
 171 files_read_var_lib_files(abrt_t)
 172 files_read_usr_files(abrt_t)
 173 files_read_generic_tmp_files(abrt_t)
 174 files_read_kernel_modules(abrt_t)
 175 files_dontaudit_list_default(abrt_t)
 176 files_dontaudit_read_default_files(abrt_t)
 177 files_dontaudit_read_all_symlinks(abrt_t)
 178 files_dontaudit_getattr_all_sockets(abrt_t)
 179
 180 fs_list_inotifyfs(abrt_t)
 181 fs_getattr_all_fs(abrt_t)
 182 fs_getattr_all_dirs(abrt_t)
 183 fs_read_fusefs_files(abrt_t)
 184 fs_read_noxattr_fs_files(abrt_t)
 185 fs_read_nfs_files(abrt_t)
 186 fs_read_nfs_symlinks(abrt_t)
 187 fs_search_all(abrt_t)
 188
 189 logging_read_generic_logs(abrt_t)
 190
 191 auth_use_nsswitch(abrt_t)
 192
 193 miscfiles_read_generic_certs(abrt_t)
 194
 195 userdom_dontaudit_read_user_home_content_files(abrt_t)
 196 userdom_dontaudit_read_admin_home_files(abrt_t)
 197
 198 tunable_policy(`abrt_anon_write',`
 199         miscfiles_manage_public_files(abrt_t)
 200 ')
 201
 202 optional_policy(`
 203         apache_list_modules(abrt_t)
 204         apache_read_modules(abrt_t)
 205 ')
 206
 207 optional_policy(`
 208         dbus_system_domain(abrt_t, abrt_exec_t)
 209 ')
 210
 211 optional_policy(`
 212         policykit_dbus_chat(abrt_t)
 213         policykit_domtrans_auth(abrt_t)
 214         policykit_read_lib(abrt_t)
 215         policykit_read_reload(abrt_t)
 216 ')
 217
 218 optional_policy(`
 219         prelink_exec(abrt_t)
 220         libs_exec_ld_so(abrt_t)
 221         corecmd_exec_all_executables(abrt_t)
 222 ')
 223
 224 # to install debuginfo packages
 225 optional_policy(`
 226         rpm_exec(abrt_t)
 227         rpm_dontaudit_manage_db(abrt_t)
 228         rpm_manage_cache(abrt_t)
 229         rpm_manage_log(abrt_t)
 230         rpm_manage_pid_files(abrt_t)
 231         rpm_read_db(abrt_t)
 232         rpm_signull(abrt_t)
 233 ')
 234
 235 # to run mailx plugin
 236 optional_policy(`
 237         sendmail_domtrans(abrt_t)
 238 ')
 239
 240 optional_policy(`
 241         sosreport_domtrans(abrt_t)
 242         sosreport_read_tmp_files(abrt_t)
 243         sosreport_delete_tmp_files(abrt_t)
 244 ')
 245
 246 optional_policy(`
 247         sssd_stream_connect(abrt_t)
 248 ')
 249
 250 #######################################
 251 #
 252 # abrt-handle-event local policy
 253 #
 254
 255 allow abrt_handle_event_t self:fifo_file rw_fifo_file_perms;
 256
 257 tunable_policy(`abrt_handle_event',`
 258         domtrans_pattern(abrt_t, abrt_handle_event_exec_t, abrt_handle_event_t)
 259 ',`
 260         can_exec(abrt_t, abrt_handle_event_exec_t)
 261 ')
 262
 263 optional_policy(`
 264         unconfined_domain(abrt_handle_event_t)
 265 ')
 266
 267 ########################################
 268 #
 269 # abrt-helper local policy
 270 #
 271
 272 allow abrt_helper_t self:capability { chown setgid sys_nice };
 273 allow abrt_helper_t self:process signal;
 274
 275 read_files_pattern(abrt_helper_t, abrt_etc_t, abrt_etc_t)
 276
 277 files_search_spool(abrt_helper_t)
 278 manage_dirs_pattern(abrt_helper_t, abrt_var_cache_t, abrt_var_cache_t)
 279 manage_files_pattern(abrt_helper_t, abrt_var_cache_t, abrt_var_cache_t)
 280 manage_lnk_files_pattern(abrt_helper_t, abrt_var_cache_t, abrt_var_cache_t)
 281 files_var_filetrans(abrt_helper_t, abrt_var_cache_t, { file dir })
 282
 283 read_files_pattern(abrt_helper_t, abrt_var_run_t, abrt_var_run_t)
 284 read_lnk_files_pattern(abrt_helper_t, abrt_var_run_t, abrt_var_run_t)
 285
 286 corecmd_read_all_executables(abrt_helper_t)
 287
 288 domain_read_all_domains_state(abrt_helper_t)
 289
 290 files_dontaudit_all_non_security_leaks(abrt_helper_t)
 291
 292 fs_list_inotifyfs(abrt_helper_t)
 293 fs_getattr_all_fs(abrt_helper_t)
 294
 295 auth_use_nsswitch(abrt_helper_t)
 296
 297 term_dontaudit_use_all_ttys(abrt_helper_t)
 298 term_dontaudit_use_all_ptys(abrt_helper_t)
 299
 300 ifdef(`hide_broken_symptoms',`
 301         domain_dontaudit_leaks(abrt_helper_t)
 302         userdom_dontaudit_read_user_home_content_files(abrt_helper_t)
 303         userdom_dontaudit_read_user_tmp_files(abrt_helper_t)
 304         dev_dontaudit_read_all_blk_files(abrt_helper_t)
 305         dev_dontaudit_read_all_chr_files(abrt_helper_t)
 306         dev_dontaudit_write_all_chr_files(abrt_helper_t)
 307         dev_dontaudit_write_all_blk_files(abrt_helper_t)
 308         fs_dontaudit_rw_anon_inodefs_files(abrt_helper_t)
 309
 310         optional_policy(`
 311                 rpm_dontaudit_leaks(abrt_helper_t)
 312         ')
 313 ')
 314
 315 ifdef(`hide_broken_symptoms',`
 316         gen_require(`
 317                 attribute domain;
 318         ')
 319
 320         allow abrt_t self:capability sys_resource;
 321         allow abrt_t domain:file write;
 322         allow abrt_t domain:process setrlimit;
 323 ')
 324
 325 #######################################
 326 #
 327 # abrt retrace coredump policy
 328 #
 329
 330 allow abrt_retrace_coredump_t self:fifo_file rw_fifo_file_perms;
 331
 332 list_dirs_pattern(abrt_retrace_coredump_t, abrt_retrace_cache_t, abrt_retrace_cache_t)
 333 read_files_pattern(abrt_retrace_coredump_t, abrt_retrace_cache_t, abrt_retrace_cache_t)
 334 read_lnk_files_pattern(abrt_retrace_coredump_t, abrt_retrace_cache_t, abrt_retrace_cache_t)
 335
 336 list_dirs_pattern(abrt_retrace_coredump_t, abrt_retrace_spool_t, abrt_retrace_spool_t)
 337 read_files_pattern(abrt_retrace_coredump_t, abrt_retrace_spool_t, abrt_retrace_spool_t)
 338 read_lnk_files_pattern(abrt_retrace_coredump_t, abrt_retrace_spool_t, abrt_retrace_spool_t)
 339
 340 corecmd_exec_bin(abrt_retrace_coredump_t)
 341 corecmd_exec_shell(abrt_retrace_coredump_t)
 342
 343 dev_read_urand(abrt_retrace_coredump_t)
 344
 345 files_read_usr_files(abrt_retrace_coredump_t)
 346
 347 sysnet_dns_name_resolve(abrt_retrace_coredump_t)
 348
 349 # to install debuginfo packages
 350 optional_policy(`
 351         rpm_exec(abrt_retrace_coredump_t)
 352         rpm_dontaudit_manage_db(abrt_retrace_coredump_t)
 353         rpm_manage_cache(abrt_retrace_coredump_t)
 354         rpm_manage_log(abrt_retrace_coredump_t)
 355         rpm_manage_pid_files(abrt_retrace_coredump_t)
 356         rpm_read_db(abrt_retrace_coredump_t)
 357         rpm_signull(abrt_retrace_coredump_t)
 358 ')
 359
 360 #######################################
 361 #
 362 # abrt retrace worker policy
 363 #
 364
 365 allow abrt_retrace_worker_t self:capability { setuid };
 366
 367 allow abrt_retrace_worker_t self:fifo_file rw_fifo_file_perms;
 368
 369 domtrans_pattern(abrt_retrace_worker_t, abrt_retrace_coredump_exec_t, abrt_retrace_coredump_t)
 370 allow abrt_retrace_worker_t abrt_retrace_coredump_exec_t:file ioctl;
 371
 372 manage_dirs_pattern(abrt_retrace_worker_t, abrt_retrace_spool_t, abrt_retrace_spool_t)
 373 manage_files_pattern(abrt_retrace_worker_t, abrt_retrace_spool_t, abrt_retrace_spool_t)
 374 manage_lnk_files_pattern(abrt_retrace_worker_t, abrt_retrace_spool_t, abrt_retrace_spool_t)
 375
 376 allow abrt_retrace_worker_t abrt_etc_t:file read_file_perms;
 377
 378 can_exec(abrt_retrace_worker_t, abrt_retrace_worker_exec_t)
 379
 380 corecmd_exec_bin(abrt_retrace_worker_t)
 381 corecmd_exec_shell(abrt_retrace_worker_t)
 382
 383 dev_read_urand(abrt_retrace_worker_t)
 384
 385 files_read_usr_files(abrt_retrace_worker_t)
 386
 387 sysnet_dns_name_resolve(abrt_retrace_worker_t)
 388
 389 optional_policy(`
 390         mock_domtrans(abrt_retrace_worker_t)
 391 ')
 392
 393 ########################################
 394 #
 395 # abrt_dump_oops local policy
 396 #
 397
 398 allow abrt_dump_oops_t self:capability dac_override;
 399 allow abrt_dump_oops_t self:fifo_file rw_fifo_file_perms;
 400 allow abrt_dump_oops_t self:unix_stream_socket create_stream_socket_perms;
 401
 402 files_search_spool(abrt_dump_oops_t)
 403 manage_dirs_pattern(abrt_dump_oops_t, abrt_var_cache_t, abrt_var_cache_t)
 404 manage_files_pattern(abrt_dump_oops_t, abrt_var_cache_t, abrt_var_cache_t)
 405 manage_lnk_files_pattern(abrt_dump_oops_t, abrt_var_cache_t, abrt_var_cache_t)
 406 files_var_filetrans(abrt_dump_oops_t, abrt_var_cache_t, { file dir })
 407
 408 read_files_pattern(abrt_dump_oops_t, abrt_var_run_t, abrt_var_run_t)
 409 read_lnk_files_pattern(abrt_dump_oops_t, abrt_var_run_t, abrt_var_run_t)
 410
 411 allow abrt_dump_oops_t abrt_etc_t:file read_file_perms;
 412
 413 kernel_read_kernel_sysctls(abrt_dump_oops_t)
 414 kernel_read_ring_buffer(abrt_dump_oops_t)
 415
 416 domain_use_interactive_fds(abrt_dump_oops_t)
 417
 418 fs_list_inotifyfs(abrt_dump_oops_t)
 419
 420 logging_read_generic_logs(abrt_dump_oops_t)
 421
 422 #######################################
 423 #
 424 # Local policy for all abrt domain
 425 #
 426
 427 kernel_read_system_state(abrt_domain)
 428
 429 files_read_etc_files(abrt_domain)
 430
 431 logging_send_syslog_msg(abrt_domain)
 432
 433 miscfiles_read_localization(abrt_domain)