policy/modules/services/dhcp.te

   1 policy_module(dhcp, 1.9.0)
   2
   3 ########################################
   4 #
   5 # Declarations
   6 #
   7
   8 type dhcpd_t;
   9 type dhcpd_exec_t;
  10 init_daemon_domain(dhcpd_t, dhcpd_exec_t)
  11
  12 type dhcpd_initrc_exec_t;
  13 init_script_file(dhcpd_initrc_exec_t)
  14
  15 type dhcpd_state_t;
  16 files_type(dhcpd_state_t)
  17
  18 type dhcpd_tmp_t;
  19 files_tmp_file(dhcpd_tmp_t)
  20
  21 type dhcpd_var_run_t;
  22 files_pid_file(dhcpd_var_run_t)
  23
  24 ########################################
  25 #
  26 # Local policy
  27 #
  28
  29 allow dhcpd_t self:capability { net_raw sys_resource };
  30 dontaudit dhcpd_t self:capability { net_admin sys_tty_config };
  31 allow dhcpd_t self:process signal_perms;
  32 allow dhcpd_t self:fifo_file rw_fifo_file_perms;
  33 allow dhcpd_t self:unix_dgram_socket create_socket_perms;
  34 allow dhcpd_t self:unix_stream_socket create_socket_perms;
  35 allow dhcpd_t self:tcp_socket create_stream_socket_perms;
  36 allow dhcpd_t self:udp_socket create_socket_perms;
  37 # Allow dhcpd_t to use packet sockets
  38 allow dhcpd_t self:packet_socket create_socket_perms;
  39 allow dhcpd_t self:rawip_socket create_socket_perms;
  40
  41 can_exec(dhcpd_t, dhcpd_exec_t)
  42
  43 manage_files_pattern(dhcpd_t, dhcpd_state_t, dhcpd_state_t)
  44 sysnet_dhcp_state_filetrans(dhcpd_t, dhcpd_state_t, file)
  45
  46 manage_dirs_pattern(dhcpd_t, dhcpd_tmp_t, dhcpd_tmp_t)
  47 manage_files_pattern(dhcpd_t, dhcpd_tmp_t, dhcpd_tmp_t)
  48 files_tmp_filetrans(dhcpd_t, dhcpd_tmp_t, { file dir })
  49
  50 manage_files_pattern(dhcpd_t, dhcpd_var_run_t, dhcpd_var_run_t)
  51 files_pid_filetrans(dhcpd_t, dhcpd_var_run_t, file)
  52
  53 kernel_read_system_state(dhcpd_t)
  54 kernel_read_kernel_sysctls(dhcpd_t)
  55 kernel_read_network_state(dhcpd_t)
  56
  57 corenet_all_recvfrom_unlabeled(dhcpd_t)
  58 corenet_all_recvfrom_netlabel(dhcpd_t)
  59 corenet_tcp_sendrecv_generic_if(dhcpd_t)
  60 corenet_udp_sendrecv_generic_if(dhcpd_t)
  61 corenet_raw_sendrecv_generic_if(dhcpd_t)
  62 corenet_tcp_sendrecv_generic_node(dhcpd_t)
  63 corenet_udp_sendrecv_generic_node(dhcpd_t)
  64 corenet_raw_sendrecv_generic_node(dhcpd_t)
  65 corenet_tcp_sendrecv_all_ports(dhcpd_t)
  66 corenet_udp_sendrecv_all_ports(dhcpd_t)
  67 corenet_tcp_bind_generic_node(dhcpd_t)
  68 corenet_udp_bind_generic_node(dhcpd_t)
  69 corenet_tcp_bind_dhcpd_port(dhcpd_t)
  70 corenet_udp_bind_dhcpd_port(dhcpd_t)
  71 corenet_udp_bind_pxe_port(dhcpd_t)
  72 corenet_tcp_connect_all_ports(dhcpd_t)
  73 corenet_sendrecv_dhcpd_server_packets(dhcpd_t)
  74 corenet_sendrecv_pxe_server_packets(dhcpd_t)
  75 corenet_sendrecv_all_client_packets(dhcpd_t)
  76 corenet_dontaudit_udp_bind_all_reserved_ports(dhcpd_t)
  77 corenet_udp_bind_all_unreserved_ports(dhcpd_t)
  78
  79 dev_read_sysfs(dhcpd_t)
  80 dev_read_rand(dhcpd_t)
  81 dev_read_urand(dhcpd_t)
  82
  83 fs_getattr_all_fs(dhcpd_t)
  84 fs_search_auto_mountpoints(dhcpd_t)
  85
  86 corecmd_exec_bin(dhcpd_t)
  87
  88 domain_use_interactive_fds(dhcpd_t)
  89
  90 files_read_etc_files(dhcpd_t)
  91 files_read_usr_files(dhcpd_t)
  92 files_read_etc_runtime_files(dhcpd_t)
  93 files_search_var_lib(dhcpd_t)
  94
  95 auth_use_nsswitch(dhcpd_t)
  96
  97 logging_send_syslog_msg(dhcpd_t)
  98
  99 miscfiles_read_localization(dhcpd_t)
 100
 101 sysnet_read_dhcp_config(dhcpd_t)
 102
 103 userdom_dontaudit_use_unpriv_user_fds(dhcpd_t)
 104 userdom_dontaudit_search_user_home_dirs(dhcpd_t)
 105
 106 ifdef(`distro_gentoo',`
 107         allow dhcpd_t self:capability { chown dac_override setgid setuid sys_chroot };
 108 ')
 109
 110 optional_policy(`
 111         # used for dynamic DNS
 112         bind_read_dnssec_keys(dhcpd_t)
 113 ')
 114
 115 optional_policy(`
 116         cobbler_dontaudit_rw_log(dhcpd_t)
 117 ')
 118
 119 optional_policy(`
 120         dbus_system_bus_client(dhcpd_t)
 121         dbus_connect_system_bus(dhcpd_t)
 122 ')
 123
 124 optional_policy(`
 125         seutil_sigchld_newrole(dhcpd_t)
 126 ')
 127
 128 optional_policy(`
 129         udev_read_db(dhcpd_t)
 130 ')