policy/modules/services/nscd.te

   1 policy_module(nscd, 1.10.0)
   2
   3 gen_require(`
   4         class nscd all_nscd_perms;
   5 ')
   6
   7 ########################################
   8 #
   9 # Declarations
  10 #
  11
  12 # cjp: this is out of order because of an
  13 # ordering problem with loadable modules
  14 type nscd_var_run_t;
  15 files_pid_file(nscd_var_run_t)
  16
  17 # nscd is both the client program and the daemon.
  18 type nscd_t;
  19 type nscd_exec_t;
  20 init_daemon_domain(nscd_t, nscd_exec_t)
  21
  22 type nscd_initrc_exec_t;
  23 init_script_file(nscd_initrc_exec_t)
  24
  25 type nscd_log_t;
  26 logging_log_file(nscd_log_t)
  27
  28 ########################################
  29 #
  30 # Local policy
  31 #
  32
  33 allow nscd_t self:capability { kill setgid setuid };
  34 dontaudit nscd_t self:capability sys_tty_config;
  35 allow nscd_t self:process { getattr getcap setcap setsched signal_perms };
  36 allow nscd_t self:fifo_file read_fifo_file_perms;
  37 allow nscd_t self:unix_stream_socket create_stream_socket_perms;
  38 allow nscd_t self:unix_dgram_socket create_socket_perms;
  39 allow nscd_t self:netlink_selinux_socket create_socket_perms;
  40 allow nscd_t self:tcp_socket create_socket_perms;
  41 allow nscd_t self:udp_socket create_socket_perms;
  42
  43 # For client program operation, invoked from sysadm_t.
  44 # Transition occurs to nscd_t due to direct_sysadm_daemon.
  45 allow nscd_t self:nscd { admin getstat };
  46
  47 allow nscd_t nscd_log_t:file manage_file_perms;
  48 logging_log_filetrans(nscd_t, nscd_log_t, file)
  49
  50 manage_files_pattern(nscd_t, nscd_var_run_t, nscd_var_run_t)
  51 manage_sock_files_pattern(nscd_t, nscd_var_run_t, nscd_var_run_t)
  52 files_pid_filetrans(nscd_t, nscd_var_run_t, { file sock_file })
  53
  54 corecmd_search_bin(nscd_t)
  55 can_exec(nscd_t, nscd_exec_t)
  56
  57 kernel_read_kernel_sysctls(nscd_t)
  58 kernel_list_proc(nscd_t)
  59 kernel_read_proc_symlinks(nscd_t)
  60
  61 dev_read_sysfs(nscd_t)
  62 dev_read_rand(nscd_t)
  63 dev_read_urand(nscd_t)
  64
  65 fs_getattr_all_fs(nscd_t)
  66 fs_search_auto_mountpoints(nscd_t)
  67 fs_list_inotifyfs(nscd_t)
  68
  69 # for when /etc/passwd has just been updated and has the wrong type
  70 auth_getattr_shadow(nscd_t)
  71 auth_use_nsswitch(nscd_t)
  72
  73 corenet_all_recvfrom_unlabeled(nscd_t)
  74 corenet_all_recvfrom_netlabel(nscd_t)
  75 corenet_tcp_sendrecv_generic_if(nscd_t)
  76 corenet_udp_sendrecv_generic_if(nscd_t)
  77 corenet_tcp_sendrecv_generic_node(nscd_t)
  78 corenet_udp_sendrecv_generic_node(nscd_t)
  79 corenet_tcp_sendrecv_all_ports(nscd_t)
  80 corenet_udp_sendrecv_all_ports(nscd_t)
  81 corenet_udp_bind_generic_node(nscd_t)
  82 corenet_tcp_connect_all_ports(nscd_t)
  83 corenet_sendrecv_all_client_packets(nscd_t)
  84 corenet_rw_tun_tap_dev(nscd_t)
  85
  86 selinux_get_fs_mount(nscd_t)
  87 selinux_validate_context(nscd_t)
  88 selinux_compute_access_vector(nscd_t)
  89 selinux_compute_create_context(nscd_t)
  90 selinux_compute_relabel_context(nscd_t)
  91 selinux_compute_user_contexts(nscd_t)
  92 domain_use_interactive_fds(nscd_t)
  93
  94 files_read_etc_files(nscd_t)
  95 files_read_generic_tmp_symlinks(nscd_t)
  96 # Needed to read files created by firstboot "/etc/hesiod.conf"
  97 files_read_etc_runtime_files(nscd_t)
  98
  99 logging_send_audit_msgs(nscd_t)
 100 logging_send_syslog_msg(nscd_t)
 101
 102 miscfiles_read_localization(nscd_t)
 103
 104 seutil_read_config(nscd_t)
 105 seutil_read_default_contexts(nscd_t)
 106 seutil_sigchld_newrole(nscd_t)
 107
 108 sysnet_read_config(nscd_t)
 109
 110 userdom_dontaudit_use_user_terminals(nscd_t)
 111 userdom_dontaudit_use_unpriv_user_fds(nscd_t)
 112 userdom_dontaudit_search_user_home_dirs(nscd_t)
 113
 114 optional_policy(`
 115         cron_read_system_job_tmp_files(nscd_t)
 116 ')
 117
 118 optional_policy(`
 119         kerberos_use(nscd_t)
 120 ')
 121
 122 optional_policy(`
 123         udev_read_db(nscd_t)
 124 ')
 125
 126 optional_policy(`
 127         xen_dontaudit_rw_unix_stream_sockets(nscd_t)
 128         xen_append_log(nscd_t)
 129 ')