policy/modules/services/ldap.te

   1
   2 policy_module(ldap, 1.9.0)
   3
   4 ########################################
   5 #
   6 # Declarations
   7 #
   8
   9 type slapd_t;
  10 type slapd_exec_t;
  11 init_daemon_domain(slapd_t, slapd_exec_t)
  12
  13 type slapd_cert_t;
  14 files_type(slapd_cert_t)
  15
  16 type slapd_db_t;
  17 files_type(slapd_db_t)
  18
  19 type slapd_etc_t;
  20 files_config_file(slapd_etc_t)
  21
  22 type slapd_initrc_exec_t;
  23 init_script_file(slapd_initrc_exec_t)
  24
  25 type slapd_lock_t;
  26 files_lock_file(slapd_lock_t)
  27
  28 type slapd_replog_t;
  29 files_type(slapd_replog_t)
  30
  31 type slapd_tmp_t;
  32 files_tmp_file(slapd_tmp_t)
  33
  34 type slapd_var_run_t;
  35 files_pid_file(slapd_var_run_t)
  36
  37 ########################################
  38 #
  39 # Local policy
  40 #
  41
  42 # should not need kill
  43 # cjp: why net_raw?
  44 allow slapd_t self:capability { kill setgid setuid net_raw dac_override dac_read_search };
  45 dontaudit slapd_t self:capability sys_tty_config;
  46 allow slapd_t self:process setsched;
  47 allow slapd_t self:fifo_file rw_fifo_file_perms;
  48 allow slapd_t self:udp_socket create_socket_perms;
  49 #slapd needs to listen and accept needed by ldapsearch (slapd needs to accept from ldapseach)
  50 allow slapd_t self:tcp_socket create_stream_socket_perms;
  51
  52 allow slapd_t slapd_cert_t:dir list_dir_perms;
  53 read_files_pattern(slapd_t, slapd_cert_t, slapd_cert_t)
  54 read_lnk_files_pattern(slapd_t, slapd_cert_t, slapd_cert_t)
  55
  56 # Allow access to the slapd databases
  57 manage_dirs_pattern(slapd_t, slapd_db_t, slapd_db_t)
  58 manage_files_pattern(slapd_t, slapd_db_t, slapd_db_t)
  59 manage_lnk_files_pattern(slapd_t, slapd_db_t, slapd_db_t)
  60
  61 allow slapd_t slapd_etc_t:file read_file_perms;
  62
  63 allow slapd_t slapd_lock_t:file manage_file_perms;
  64 files_lock_filetrans(slapd_t,slapd_lock_t,file)
  65
  66 # Allow access to write the replication log (should tighten this)
  67 manage_dirs_pattern(slapd_t, slapd_replog_t, slapd_replog_t)
  68 manage_files_pattern(slapd_t, slapd_replog_t, slapd_replog_t)
  69 manage_lnk_files_pattern(slapd_t, slapd_replog_t, slapd_replog_t)
  70
  71 manage_dirs_pattern(slapd_t, slapd_tmp_t, slapd_tmp_t)
  72 manage_files_pattern(slapd_t, slapd_tmp_t, slapd_tmp_t)
  73 files_tmp_filetrans(slapd_t, slapd_tmp_t, { file dir })
  74
  75 manage_files_pattern(slapd_t, slapd_var_run_t, slapd_var_run_t)
  76 manage_sock_files_pattern(slapd_t, slapd_var_run_t, slapd_var_run_t)
  77 files_pid_filetrans(slapd_t, slapd_var_run_t, { file sock_file })
  78
  79 kernel_read_system_state(slapd_t)
  80 kernel_read_kernel_sysctls(slapd_t)
  81
  82 corenet_all_recvfrom_unlabeled(slapd_t)
  83 corenet_all_recvfrom_netlabel(slapd_t)
  84 corenet_tcp_sendrecv_all_if(slapd_t)
  85 corenet_udp_sendrecv_all_if(slapd_t)
  86 corenet_tcp_sendrecv_all_nodes(slapd_t)
  87 corenet_udp_sendrecv_all_nodes(slapd_t)
  88 corenet_tcp_sendrecv_all_ports(slapd_t)
  89 corenet_udp_sendrecv_all_ports(slapd_t)
  90 corenet_tcp_bind_all_nodes(slapd_t)
  91 corenet_tcp_bind_ldap_port(slapd_t)
  92 corenet_tcp_connect_all_ports(slapd_t)
  93 corenet_sendrecv_ldap_server_packets(slapd_t)
  94 corenet_sendrecv_all_client_packets(slapd_t)
  95
  96 dev_read_urand(slapd_t)
  97 dev_read_sysfs(slapd_t)
  98
  99 fs_getattr_all_fs(slapd_t)
 100 fs_search_auto_mountpoints(slapd_t)
 101
 102 domain_use_interactive_fds(slapd_t)
 103
 104 files_read_etc_files(slapd_t)
 105 files_read_etc_runtime_files(slapd_t)
 106 files_read_usr_files(slapd_t)
 107 files_list_var_lib(slapd_t)
 108
 109 auth_use_nsswitch(slapd_t)
 110
 111 logging_send_syslog_msg(slapd_t)
 112
 113 miscfiles_read_certs(slapd_t)
 114 miscfiles_read_localization(slapd_t)
 115
 116 userdom_dontaudit_use_unpriv_user_fds(slapd_t)
 117 userdom_dontaudit_search_user_home_dirs(slapd_t)
 118
 119 optional_policy(`
 120         kerberos_use(slapd_t)
 121 ')
 122
 123 optional_policy(`
 124         seutil_sigchld_newrole(slapd_t)
 125 ')
 126
 127 optional_policy(`
 128         udev_read_db(slapd_t)
 129 ')