2 policy_module(mysql, 1.12.0)
4 ########################################
11 ## Allow mysqld to connect to all ports
14 gen_tunable(mysql_connect_any, false)
18 init_daemon_domain(mysqld_t, mysqld_exec_t)
21 type mysqld_safe_exec_t;
22 init_daemon_domain(mysqld_safe_t, mysqld_safe_exec_t)
24 type mysqld_var_run_t;
25 files_pid_file(mysqld_var_run_t)
28 files_type(mysqld_db_t)
30 type mysqld_etc_t alias etc_mysqld_t;
31 files_config_file(mysqld_etc_t)
33 type mysqld_initrc_exec_t;
34 init_script_file(mysqld_initrc_exec_t)
37 logging_log_file(mysqld_log_t)
40 files_tmp_file(mysqld_tmp_t)
43 type mysqlmanagerd_exec_t;
44 init_daemon_domain(mysqlmanagerd_t, mysqlmanagerd_exec_t)
46 type mysqlmanagerd_initrc_exec_t;
47 init_script_file(mysqlmanagerd_initrc_exec_t)
49 type mysqlmanagerd_var_run_t;
50 files_pid_file(mysqlmanagerd_var_run_t)
52 ########################################
57 allow mysqld_t self:capability { dac_override ipc_lock setgid setuid sys_resource net_bind_service };
58 dontaudit mysqld_t self:capability sys_tty_config;
59 allow mysqld_t self:process { setsched getsched setrlimit signal_perms rlimitinh };
60 allow mysqld_t self:fifo_file rw_fifo_file_perms;
61 allow mysqld_t self:shm create_shm_perms;
62 allow mysqld_t self:unix_stream_socket create_stream_socket_perms;
63 allow mysqld_t self:tcp_socket create_stream_socket_perms;
64 allow mysqld_t self:udp_socket create_socket_perms;
66 manage_dirs_pattern(mysqld_t, mysqld_db_t, mysqld_db_t)
67 manage_files_pattern(mysqld_t, mysqld_db_t, mysqld_db_t)
68 manage_lnk_files_pattern(mysqld_t, mysqld_db_t, mysqld_db_t)
69 files_var_lib_filetrans(mysqld_t, mysqld_db_t, { dir file lnk_file })
71 allow mysqld_t mysqld_etc_t:file read_file_perms;
72 allow mysqld_t mysqld_etc_t:lnk_file { getattr read };
73 allow mysqld_t mysqld_etc_t:dir list_dir_perms;
75 allow mysqld_t mysqld_log_t:file manage_file_perms;
76 logging_log_filetrans(mysqld_t, mysqld_log_t, file)
78 manage_dirs_pattern(mysqld_t, mysqld_tmp_t, mysqld_tmp_t)
79 manage_files_pattern(mysqld_t, mysqld_tmp_t, mysqld_tmp_t)
80 files_tmp_filetrans(mysqld_t, mysqld_tmp_t, { file dir })
82 manage_files_pattern(mysqld_t, mysqld_var_run_t, mysqld_var_run_t)
83 manage_sock_files_pattern(mysqld_t, mysqld_var_run_t, mysqld_var_run_t)
84 files_pid_filetrans(mysqld_t, mysqld_var_run_t, { file sock_file })
86 kernel_read_system_state(mysqld_t)
87 kernel_read_kernel_sysctls(mysqld_t)
89 corenet_all_recvfrom_unlabeled(mysqld_t)
90 corenet_all_recvfrom_netlabel(mysqld_t)
91 corenet_tcp_sendrecv_generic_if(mysqld_t)
92 corenet_udp_sendrecv_generic_if(mysqld_t)
93 corenet_tcp_sendrecv_generic_node(mysqld_t)
94 corenet_udp_sendrecv_generic_node(mysqld_t)
95 corenet_tcp_sendrecv_all_ports(mysqld_t)
96 corenet_udp_sendrecv_all_ports(mysqld_t)
97 corenet_tcp_bind_generic_node(mysqld_t)
98 corenet_tcp_bind_mysqld_port(mysqld_t)
99 corenet_tcp_connect_mysqld_port(mysqld_t)
100 corenet_sendrecv_mysqld_client_packets(mysqld_t)
101 corenet_sendrecv_mysqld_server_packets(mysqld_t)
103 dev_read_sysfs(mysqld_t)
104 dev_read_urand(mysqld_t)
106 fs_getattr_all_fs(mysqld_t)
107 fs_search_auto_mountpoints(mysqld_t)
108 fs_rw_hugetlbfs_files(mysqld_t)
110 domain_use_interactive_fds(mysqld_t)
112 files_getattr_var_lib_dirs(mysqld_t)
113 files_read_etc_runtime_files(mysqld_t)
114 files_read_etc_files(mysqld_t)
115 files_read_usr_files(mysqld_t)
116 files_search_var_lib(mysqld_t)
118 auth_use_nsswitch(mysqld_t)
120 logging_send_syslog_msg(mysqld_t)
122 miscfiles_read_localization(mysqld_t)
124 sysnet_read_config(mysqld_t)
126 userdom_dontaudit_use_unpriv_user_fds(mysqld_t)
127 # for /root/.my.cnf - should not be needed:
128 userdom_read_user_home_content_files(mysqld_t)
130 ifdef(`distro_redhat',`
131 # because Fedora has the sock_file in the database directory
132 type_transition mysqld_t mysqld_db_t:sock_file mysqld_var_run_t;
135 tunable_policy(`mysql_connect_any',`
136 corenet_tcp_connect_all_ports(mysqld_t)
137 corenet_sendrecv_all_client_packets(mysqld_t)
141 daemontools_service_domain(mysqld_t, mysqld_exec_t)
145 seutil_sigchld_newrole(mysqld_t)
149 udev_read_db(mysqld_t)
152 #######################################
154 # Local mysqld_safe policy
157 allow mysqld_safe_t self:capability { chown dac_override fowner kill };
158 dontaudit mysqld_safe_t self:capability sys_ptrace;
159 allow mysqld_safe_t self:fifo_file rw_fifo_file_perms;
161 read_lnk_files_pattern(mysqld_safe_t, mysqld_db_t, mysqld_db_t)
163 domtrans_pattern(mysqld_safe_t, mysqld_exec_t, mysqld_t)
165 allow mysqld_safe_t mysqld_log_t:file manage_file_perms;
167 manage_files_pattern(mysqld_safe_t, mysqld_var_run_t, mysqld_var_run_t)
168 delete_sock_files_pattern(mysqld_safe_t, mysqld_var_run_t, mysqld_var_run_t)
170 kernel_read_system_state(mysqld_safe_t)
171 kernel_read_kernel_sysctls(mysqld_safe_t)
173 corecmd_exec_bin(mysqld_safe_t)
175 dev_list_sysfs(mysqld_safe_t)
177 domain_read_all_domains_state(mysqld_safe_t)
179 files_read_etc_files(mysqld_safe_t)
180 files_read_usr_files(mysqld_safe_t)
181 files_dontaudit_getattr_all_dirs(mysqld_safe_t)
183 logging_log_filetrans(mysqld_safe_t, mysqld_log_t, file)
185 hostname_exec(mysqld_safe_t)
187 miscfiles_read_localization(mysqld_safe_t)
189 mysql_manage_db_files(mysqld_safe_t)
190 mysql_read_config(mysqld_safe_t)
191 mysql_search_pid_files(mysqld_safe_t)
192 mysql_write_log(mysqld_safe_t)
194 ########################################
196 # MySQL Manager Policy
199 allow mysqlmanagerd_t self:capability { dac_override kill };
200 allow mysqlmanagerd_t self:process signal;
201 allow mysqlmanagerd_t self:fifo_file rw_fifo_file_perms;
202 allow mysqlmanagerd_t self:tcp_socket create_stream_socket_perms;
203 allow mysqlmanagerd_t self:unix_stream_socket create_stream_socket_perms;
205 mysql_read_config(initrc_t)
206 mysql_read_config(mysqlmanagerd_t)
207 mysql_read_pid_files(mysqlmanagerd_t)
208 mysql_search_db(mysqlmanagerd_t)
209 mysql_signal(mysqlmanagerd_t)
210 mysql_stream_connect(mysqlmanagerd_t)
212 domtrans_pattern(mysqlmanagerd_t, mysqld_exec_t, mysqld_t)
214 manage_files_pattern(mysqlmanagerd_t, mysqld_var_run_t, mysqlmanagerd_var_run_t)
215 manage_sock_files_pattern(mysqlmanagerd_t, mysqld_var_run_t, mysqlmanagerd_var_run_t)
216 filetrans_pattern(mysqlmanagerd_t, mysqld_var_run_t, mysqlmanagerd_var_run_t, { file sock_file })
218 kernel_read_system_state(mysqlmanagerd_t)
220 corecmd_exec_shell(mysqlmanagerd_t)
222 corenet_all_recvfrom_unlabeled(mysqlmanagerd_t)
223 corenet_all_recvfrom_netlabel(mysqlmanagerd_t)
224 corenet_tcp_sendrecv_generic_if(mysqlmanagerd_t)
225 corenet_tcp_sendrecv_generic_node(mysqlmanagerd_t)
226 corenet_tcp_sendrecv_all_ports(mysqlmanagerd_t)
227 corenet_tcp_bind_generic_node(mysqlmanagerd_t)
228 corenet_tcp_bind_mysqlmanagerd_port(mysqlmanagerd_t)
229 corenet_tcp_connect_mysqlmanagerd_port(mysqlmanagerd_t)
230 corenet_sendrecv_mysqlmanagerd_server_packets(mysqlmanagerd_t)
231 corenet_sendrecv_mysqlmanagerd_client_packets(mysqlmanagerd_t)
233 dev_read_urand(mysqlmanagerd_t)
235 files_read_etc_files(mysqlmanagerd_t)
236 files_read_usr_files(mysqlmanagerd_t)
238 miscfiles_read_localization(mysqlmanagerd_t)
240 userdom_getattr_user_home_dirs(mysqlmanagerd_t)