policy/modules/services/abrt.te

   1 policy_module(abrt, 1.2.0)
   2
   3 ########################################
   4 #
   5 # Declarations
   6 #
   7
   8 ## <desc>
   9 ##      <p>
  10 ##      Allow ABRT to modify public files
  11 ##      used for public file transfer services.
  12 ##      </p>
  13 ## </desc>
  14 gen_tunable(abrt_anon_write, false)
  15
  16 type abrt_t;
  17 type abrt_exec_t;
  18 init_daemon_domain(abrt_t, abrt_exec_t)
  19
  20 type abrt_initrc_exec_t;
  21 init_script_file(abrt_initrc_exec_t)
  22
  23 # etc files
  24 type abrt_etc_t;
  25 files_config_file(abrt_etc_t)
  26
  27 # log files
  28 type abrt_var_log_t;
  29 logging_log_file(abrt_var_log_t)
  30
  31 # tmp files
  32 type abrt_tmp_t;
  33 files_tmp_file(abrt_tmp_t)
  34
  35 # var/cache files
  36 type abrt_var_cache_t;
  37 files_type(abrt_var_cache_t)
  38
  39 # pid files
  40 type abrt_var_run_t;
  41 files_pid_file(abrt_var_run_t)
  42
  43 # type needed to allow all domains
  44 # to handle /var/cache/abrt
  45 type abrt_helper_t;
  46 type abrt_helper_exec_t;
  47 application_domain(abrt_helper_t, abrt_helper_exec_t)
  48 role system_r types abrt_helper_t;
  49
  50 ifdef(`enable_mcs',`
  51         init_ranged_daemon_domain(abrt_t, abrt_exec_t, s0 - mcs_systemhigh)
  52 ')
  53
  54 ########################################
  55 #
  56 # abrt local policy
  57 #
  58
  59 allow abrt_t self:capability { chown kill setuid setgid sys_nice dac_override };
  60 dontaudit abrt_t self:capability sys_rawio;
  61 allow abrt_t self:process { sigkill signal signull setsched getsched };
  62
  63 allow abrt_t self:fifo_file rw_fifo_file_perms;
  64 allow abrt_t self:tcp_socket create_stream_socket_perms;
  65 allow abrt_t self:udp_socket create_socket_perms;
  66 allow abrt_t self:unix_dgram_socket create_socket_perms;
  67 allow abrt_t self:netlink_route_socket r_netlink_socket_perms;
  68
  69 # abrt etc files
  70 list_dirs_pattern(abrt_t, abrt_etc_t, abrt_etc_t)
  71 rw_files_pattern(abrt_t, abrt_etc_t, abrt_etc_t)
  72
  73 # log file
  74 manage_files_pattern(abrt_t, abrt_var_log_t, abrt_var_log_t)
  75 logging_log_filetrans(abrt_t, abrt_var_log_t, file)
  76
  77 # abrt tmp files
  78 manage_dirs_pattern(abrt_t, abrt_tmp_t, abrt_tmp_t)
  79 manage_files_pattern(abrt_t, abrt_tmp_t, abrt_tmp_t)
  80 files_tmp_filetrans(abrt_t, abrt_tmp_t, { file dir })
  81 can_exec(abrt_t, abrt_tmp_t)
  82
  83 # abrt var/cache files
  84 manage_files_pattern(abrt_t, abrt_var_cache_t, abrt_var_cache_t)
  85 manage_dirs_pattern(abrt_t, abrt_var_cache_t, abrt_var_cache_t)
  86 manage_lnk_files_pattern(abrt_t, abrt_var_cache_t, abrt_var_cache_t)
  87 files_var_filetrans(abrt_t, abrt_var_cache_t, { file dir })
  88 files_spool_filetrans(abrt_t, abrt_var_cache_t, dir)
  89
  90 # abrt pid files
  91 manage_files_pattern(abrt_t, abrt_var_run_t, abrt_var_run_t)
  92 manage_dirs_pattern(abrt_t, abrt_var_run_t, abrt_var_run_t)
  93 manage_sock_files_pattern(abrt_t, abrt_var_run_t, abrt_var_run_t)
  94 manage_lnk_files_pattern(abrt_t, abrt_var_run_t, abrt_var_run_t)
  95 files_pid_filetrans(abrt_t, abrt_var_run_t, { file dir sock_file })
  96
  97 kernel_read_ring_buffer(abrt_t)
  98 kernel_read_system_state(abrt_t)
  99 kernel_rw_kernel_sysctl(abrt_t)
 100
 101 corecmd_exec_bin(abrt_t)
 102 corecmd_exec_shell(abrt_t)
 103 corecmd_read_all_executables(abrt_t)
 104
 105 corenet_all_recvfrom_netlabel(abrt_t)
 106 corenet_all_recvfrom_unlabeled(abrt_t)
 107 corenet_tcp_sendrecv_generic_if(abrt_t)
 108 corenet_tcp_sendrecv_generic_node(abrt_t)
 109 corenet_tcp_sendrecv_generic_port(abrt_t)
 110 corenet_tcp_bind_generic_node(abrt_t)
 111 corenet_tcp_connect_http_port(abrt_t)
 112 corenet_tcp_connect_ftp_port(abrt_t)
 113 corenet_tcp_connect_all_ports(abrt_t)
 114 corenet_sendrecv_http_client_packets(abrt_t)
 115
 116 dev_getattr_all_chr_files(abrt_t)
 117 dev_read_urand(abrt_t)
 118 dev_rw_sysfs(abrt_t)
 119 dev_dontaudit_read_raw_memory(abrt_t)
 120
 121 domain_getattr_all_domains(abrt_t)
 122 domain_read_all_domains_state(abrt_t)
 123 domain_signull_all_domains(abrt_t)
 124
 125 files_getattr_all_files(abrt_t)
 126 files_read_config_files(abrt_t)
 127 files_read_etc_runtime_files(abrt_t)
 128 files_read_var_symlinks(abrt_t)
 129 files_read_var_lib_files(abrt_t)
 130 files_read_usr_files(abrt_t)
 131 files_read_generic_tmp_files(abrt_t)
 132 files_read_kernel_modules(abrt_t)
 133 files_dontaudit_list_default(abrt_t)
 134 files_dontaudit_read_default_files(abrt_t)
 135 files_dontaudit_read_all_symlinks(abrt_t)
 136 files_dontaudit_getattr_all_sockets(abrt_t)
 137
 138 fs_list_inotifyfs(abrt_t)
 139 fs_getattr_all_fs(abrt_t)
 140 fs_getattr_all_dirs(abrt_t)
 141 fs_read_fusefs_files(abrt_t)
 142 fs_read_noxattr_fs_files(abrt_t)
 143 fs_read_nfs_files(abrt_t)
 144 fs_read_nfs_symlinks(abrt_t)
 145 fs_search_all(abrt_t)
 146
 147 sysnet_dns_name_resolve(abrt_t)
 148
 149 logging_read_generic_logs(abrt_t)
 150 logging_send_syslog_msg(abrt_t)
 151
 152 miscfiles_read_generic_certs(abrt_t)
 153 miscfiles_read_localization(abrt_t)
 154
 155 userdom_dontaudit_read_user_home_content_files(abrt_t)
 156 userdom_dontaudit_read_admin_home_files(abrt_t)
 157
 158 tunable_policy(`abrt_anon_write',`
 159         miscfiles_manage_public_files(abrt_t)
 160 ')
 161
 162 optional_policy(`
 163         apache_read_modules(abrt_t)
 164 ')
 165
 166 optional_policy(`
 167         dbus_system_domain(abrt_t, abrt_exec_t)
 168 ')
 169
 170 optional_policy(`
 171         nis_use_ypbind(abrt_t)
 172 ')
 173
 174 optional_policy(`
 175         nsplugin_read_rw_files(abrt_t)
 176         nsplugin_read_home(abrt_t)
 177 ')
 178
 179 optional_policy(`
 180         policykit_dbus_chat(abrt_t)
 181         policykit_domtrans_auth(abrt_t)
 182         policykit_read_lib(abrt_t)
 183         policykit_read_reload(abrt_t)
 184 ')
 185
 186 optional_policy(`
 187         prelink_exec(abrt_t)
 188         libs_exec_ld_so(abrt_t)
 189         corecmd_exec_all_executables(abrt_t)
 190 ')
 191
 192 # to install debuginfo packages
 193 optional_policy(`
 194         rpm_exec(abrt_t)
 195         rpm_dontaudit_manage_db(abrt_t)
 196         rpm_manage_cache(abrt_t)
 197         rpm_manage_pid_files(abrt_t)
 198         rpm_read_db(abrt_t)
 199         rpm_signull(abrt_t)
 200 ')
 201
 202 # to run mailx plugin
 203 optional_policy(`
 204         sendmail_domtrans(abrt_t)
 205 ')
 206
 207 optional_policy(`
 208         sosreport_domtrans(abrt_t)
 209         sosreport_read_tmp_files(abrt_t)
 210         sosreport_delete_tmp_files(abrt_t)
 211 ')
 212
 213 optional_policy(`
 214         sssd_stream_connect(abrt_t)
 215 ')
 216
 217 ########################################
 218 #
 219 # abrt-helper local policy
 220 #
 221
 222 allow abrt_helper_t self:capability { chown setgid sys_nice };
 223 allow abrt_helper_t self:process signal;
 224
 225 read_files_pattern(abrt_helper_t, abrt_etc_t, abrt_etc_t)
 226
 227 files_search_spool(abrt_helper_t)
 228 manage_dirs_pattern(abrt_helper_t, abrt_var_cache_t, abrt_var_cache_t)
 229 manage_files_pattern(abrt_helper_t, abrt_var_cache_t, abrt_var_cache_t)
 230 manage_lnk_files_pattern(abrt_helper_t, abrt_var_cache_t, abrt_var_cache_t)
 231 files_var_filetrans(abrt_helper_t, abrt_var_cache_t, { file dir })
 232
 233 read_files_pattern(abrt_helper_t, abrt_var_run_t, abrt_var_run_t)
 234 read_lnk_files_pattern(abrt_helper_t, abrt_var_run_t, abrt_var_run_t)
 235
 236 domain_read_all_domains_state(abrt_helper_t)
 237
 238 files_read_etc_files(abrt_helper_t)
 239 files_dontaudit_all_non_security_leaks(abrt_helper_t)
 240
 241 fs_list_inotifyfs(abrt_helper_t)
 242 fs_getattr_all_fs(abrt_helper_t)
 243
 244 auth_use_nsswitch(abrt_helper_t)
 245
 246 logging_send_syslog_msg(abrt_helper_t)
 247
 248 miscfiles_read_localization(abrt_helper_t)
 249
 250 term_dontaudit_use_all_ttys(abrt_helper_t)
 251 term_dontaudit_use_all_ptys(abrt_helper_t)
 252
 253 ifdef(`hide_broken_symptoms',`
 254         domain_dontaudit_leaks(abrt_helper_t)
 255         userdom_dontaudit_read_user_home_content_files(abrt_helper_t)
 256         userdom_dontaudit_read_user_tmp_files(abrt_helper_t)
 257         dev_dontaudit_read_all_blk_files(abrt_helper_t)
 258         dev_dontaudit_read_all_chr_files(abrt_helper_t)
 259         dev_dontaudit_write_all_chr_files(abrt_helper_t)
 260         dev_dontaudit_write_all_blk_files(abrt_helper_t)
 261         fs_dontaudit_rw_anon_inodefs_files(abrt_helper_t)
 262
 263         optional_policy(`
 264                 rpm_dontaudit_leaks(abrt_helper_t)
 265         ')
 266 ')
 267
 268 ifdef(`hide_broken_symptoms',`
 269         gen_require(`
 270                 attribute domain;
 271         ')
 272
 273         allow abrt_t self:capability sys_resource;
 274         allow abrt_t domain:file write;
 275         allow abrt_t domain:process setrlimit;
 276 ')