policy/modules/services/ccs.te

   1 policy_module(ccs, 1.5.0)
   2
   3 ########################################
   4 #
   5 # Declarations
   6 #
   7
   8 type ccs_t;
   9 type ccs_exec_t;
  10 init_daemon_domain(ccs_t, ccs_exec_t)
  11
  12 type cluster_conf_t;
  13 files_type(cluster_conf_t)
  14
  15 type ccs_tmp_t;
  16 files_tmp_file(ccs_tmp_t)
  17
  18 type ccs_tmpfs_t;
  19 files_tmpfs_file(ccs_tmpfs_t)
  20
  21 type ccs_var_lib_t;
  22 logging_log_file(ccs_var_lib_t)
  23
  24 type ccs_var_log_t;
  25 logging_log_file(ccs_var_log_t)
  26
  27 type ccs_var_run_t;
  28 files_pid_file(ccs_var_run_t)
  29
  30 ########################################
  31 #
  32 # ccs local policy
  33 #
  34
  35 allow ccs_t self:capability { ipc_owner ipc_lock sys_nice sys_resource sys_admin };
  36 allow ccs_t self:process { signal setrlimit setsched };
  37 dontaudit ccs_t self:process ptrace;
  38 allow ccs_t self:fifo_file rw_fifo_file_perms;
  39 allow ccs_t self:unix_stream_socket { connectto create_stream_socket_perms };
  40 allow ccs_t self:unix_dgram_socket create_socket_perms;
  41 allow ccs_t self:netlink_route_socket r_netlink_socket_perms;
  42 allow ccs_t self:tcp_socket create_stream_socket_perms;
  43 allow ccs_t self:udp_socket { create_socket_perms listen recv_msg send_msg };
  44 # cjp: this needs to be fixed to be specific
  45 allow ccs_t self:socket create_socket_perms;
  46
  47 manage_files_pattern(ccs_t, cluster_conf_t, cluster_conf_t)
  48
  49 # tmp file
  50 allow ccs_t ccs_tmp_t:dir manage_dir_perms;
  51 manage_dirs_pattern(ccs_t, ccs_tmp_t, ccs_tmp_t)
  52 manage_files_pattern(ccs_t, ccs_tmp_t, ccs_tmp_t)
  53 files_tmp_filetrans(ccs_t, ccs_tmp_t, { file dir })
  54
  55 manage_dirs_pattern(ccs_t, ccs_tmpfs_t, ccs_tmpfs_t)
  56 manage_files_pattern(ccs_t, ccs_tmpfs_t, ccs_tmpfs_t)
  57 fs_tmpfs_filetrans(ccs_t, ccs_tmpfs_t, { dir file })
  58
  59 # var lib files
  60 manage_dirs_pattern(ccs_t, ccs_var_lib_t, ccs_var_lib_t)
  61 manage_files_pattern(ccs_t, ccs_var_lib_t, ccs_var_lib_t)
  62 files_var_lib_filetrans(ccs_t, ccs_var_lib_t, { file dir })
  63
  64 allow ccs_t ccs_var_log_t:dir setattr;
  65 manage_files_pattern(ccs_t, ccs_var_log_t, ccs_var_log_t)
  66 manage_sock_files_pattern(ccs_t, ccs_var_log_t, ccs_var_log_t)
  67 logging_log_filetrans(ccs_t, ccs_var_log_t, { sock_file file dir })
  68
  69 # pid file
  70 manage_dirs_pattern(ccs_t, ccs_var_run_t, ccs_var_run_t)
  71 manage_files_pattern(ccs_t, ccs_var_run_t, ccs_var_run_t)
  72 manage_sock_files_pattern(ccs_t, ccs_var_run_t, ccs_var_run_t)
  73 files_pid_filetrans(ccs_t, ccs_var_run_t, { dir file sock_file })
  74
  75 kernel_read_kernel_sysctls(ccs_t)
  76
  77 corecmd_list_bin(ccs_t)
  78 corecmd_exec_bin(ccs_t)
  79
  80 corenet_all_recvfrom_unlabeled(ccs_t)
  81 corenet_all_recvfrom_netlabel(ccs_t)
  82 corenet_tcp_sendrecv_generic_if(ccs_t)
  83 corenet_udp_sendrecv_generic_if(ccs_t)
  84 corenet_tcp_sendrecv_generic_node(ccs_t)
  85 corenet_udp_sendrecv_generic_node(ccs_t)
  86 corenet_tcp_sendrecv_all_ports(ccs_t)
  87 corenet_udp_sendrecv_all_ports(ccs_t)
  88 corenet_tcp_bind_generic_node(ccs_t)
  89 corenet_udp_bind_generic_node(ccs_t)
  90 corenet_tcp_bind_cluster_port(ccs_t)
  91 corenet_udp_bind_cluster_port(ccs_t)
  92 corenet_udp_bind_netsupport_port(ccs_t)
  93
  94 dev_read_urand(ccs_t)
  95
  96 files_read_etc_files(ccs_t)
  97 files_read_etc_runtime_files(ccs_t)
  98
  99 init_rw_script_tmp_files(ccs_t)
 100
 101 logging_send_syslog_msg(ccs_t)
 102
 103 miscfiles_read_localization(ccs_t)
 104
 105 sysnet_dns_name_resolve(ccs_t)
 106
 107 userdom_manage_unpriv_user_shared_mem(ccs_t)
 108 userdom_manage_unpriv_user_semaphores(ccs_t)
 109
 110 ifdef(`hide_broken_symptoms', `
 111         corecmd_dontaudit_write_bin_dirs(ccs_t)
 112         files_manage_isid_type_files(ccs_t)
 113 ')
 114
 115 optional_policy(`
 116         aisexec_stream_connect(ccs_t)
 117         corosync_stream_connect(ccs_t)
 118 ')
 119
 120 optional_policy(`
 121         unconfined_use_fds(ccs_t)
 122 ')