policy/modules/services/puppet.te

   1 policy_module(puppet, 1.0.0)
   2
   3 ########################################
   4 #
   5 # Declarations
   6 #
   7
   8 ## <desc>
   9 ## <p>
  10 ## Allow Puppet client to manage all file
  11 ## types.
  12 ## </p>
  13 ## </desc>
  14 gen_tunable(puppet_manage_all_files, false)
  15
  16 type puppet_t;
  17 type puppet_exec_t;
  18 init_daemon_domain(puppet_t, puppet_exec_t)
  19
  20 type puppet_etc_t;
  21 files_config_file(puppet_etc_t)
  22
  23 type puppet_initrc_exec_t;
  24 init_script_file(puppet_initrc_exec_t)
  25
  26 type puppet_log_t;
  27 logging_log_file(puppet_log_t)
  28
  29 type puppet_tmp_t;
  30 files_tmp_file(puppet_tmp_t)
  31
  32 type puppet_var_lib_t;
  33 files_type(puppet_var_lib_t)
  34
  35 type puppet_var_run_t;
  36 files_pid_file(puppet_var_run_t)
  37
  38 type puppetmaster_t;
  39 type puppetmaster_exec_t;
  40 init_daemon_domain(puppetmaster_t, puppetmaster_exec_t)
  41
  42 type puppetmaster_initrc_exec_t;
  43 init_script_file(puppetmaster_initrc_exec_t)
  44
  45 type puppetmaster_tmp_t;
  46 files_tmp_file(puppetmaster_tmp_t)
  47
  48 ########################################
  49 #
  50 # Puppet personal policy
  51 #
  52
  53 allow puppet_t self:capability { fowner fsetid setuid setgid dac_override sys_nice sys_ptrace sys_tty_config };
  54 allow puppet_t self:process { signal signull getsched setsched };
  55 allow puppet_t self:fifo_file rw_fifo_file_perms;
  56 allow puppet_t self:netlink_route_socket create_netlink_socket_perms;
  57 allow puppet_t self:tcp_socket create_stream_socket_perms;
  58 allow puppet_t self:udp_socket create_socket_perms;
  59
  60 read_files_pattern(puppet_t, puppet_etc_t, puppet_etc_t)
  61
  62 manage_dirs_pattern(puppet_t, puppet_var_lib_t, puppet_var_lib_t)
  63 manage_files_pattern(puppet_t, puppet_var_lib_t, puppet_var_lib_t)
  64 files_search_var_lib(puppet_t)
  65
  66 setattr_dirs_pattern(puppet_t, puppet_var_run_t, puppet_var_run_t)
  67 manage_files_pattern(puppet_t, puppet_var_run_t, puppet_var_run_t)
  68 files_pid_filetrans(puppet_t, puppet_var_run_t, { file dir })
  69
  70 create_dirs_pattern(puppet_t, var_log_t, puppet_log_t)
  71 create_files_pattern(puppet_t, puppet_log_t, puppet_log_t)
  72 append_files_pattern(puppet_t, puppet_log_t, puppet_log_t)
  73 logging_log_filetrans(puppet_t, puppet_log_t, { file dir })
  74
  75 manage_dirs_pattern(puppet_t, puppet_tmp_t, puppet_tmp_t)
  76 manage_files_pattern(puppet_t, puppet_tmp_t, puppet_tmp_t)
  77 files_tmp_filetrans(puppet_t, puppet_tmp_t, { file dir })
  78
  79 kernel_dontaudit_search_sysctl(puppet_t)
  80 kernel_dontaudit_search_kernel_sysctl(puppet_t)
  81 kernel_read_system_state(puppet_t)
  82 kernel_read_crypto_sysctls(puppet_t)
  83
  84 corecmd_exec_bin(puppet_t)
  85 corecmd_exec_shell(puppet_t)
  86
  87 corenet_all_recvfrom_netlabel(puppet_t)
  88 corenet_all_recvfrom_unlabeled(puppet_t)
  89 corenet_tcp_sendrecv_generic_if(puppet_t)
  90 corenet_tcp_sendrecv_generic_node(puppet_t)
  91 corenet_tcp_bind_generic_node(puppet_t)
  92 corenet_tcp_connect_puppet_port(puppet_t)
  93 corenet_sendrecv_puppet_client_packets(puppet_t)
  94
  95 dev_read_rand(puppet_t)
  96 dev_read_sysfs(puppet_t)
  97 dev_read_urand(puppet_t)
  98
  99 domain_read_all_domains_state(puppet_t)
 100 domain_interactive_fd(puppet_t)
 101
 102 files_manage_config_files(puppet_t)
 103 files_manage_config_dirs(puppet_t)
 104 files_manage_etc_dirs(puppet_t)
 105 files_manage_etc_files(puppet_t)
 106 files_read_usr_symlinks(puppet_t)
 107 files_relabel_config_dirs(puppet_t)
 108 files_relabel_config_files(puppet_t)
 109
 110 selinux_search_fs(puppet_t)
 111 selinux_set_all_booleans(puppet_t)
 112 selinux_set_generic_booleans(puppet_t)
 113 selinux_validate_context(puppet_t)
 114
 115 term_dontaudit_getattr_unallocated_ttys(puppet_t)
 116 term_dontaudit_getattr_all_ttys(puppet_t)
 117
 118 init_all_labeled_script_domtrans(puppet_t)
 119 init_domtrans_script(puppet_t)
 120 init_read_utmp(puppet_t)
 121 init_signull_script(puppet_t)
 122
 123 logging_send_syslog_msg(puppet_t)
 124
 125 miscfiles_read_hwdata(puppet_t)
 126 miscfiles_read_localization(puppet_t)
 127
 128 seutil_domtrans_setfiles(puppet_t)
 129 seutil_domtrans_semanage(puppet_t)
 130
 131 sysnet_dns_name_resolve(puppet_t)
 132 sysnet_run_ifconfig(puppet_t, system_r)
 133
 134 tunable_policy(`puppet_manage_all_files',`
 135         auth_manage_all_files_except_shadow(puppet_t)
 136 ')
 137
 138 optional_policy(`
 139         consoletype_domtrans(puppet_t)
 140 ')
 141
 142 optional_policy(`
 143         hostname_exec(puppet_t)
 144 ')
 145
 146 optional_policy(`
 147         files_rw_var_files(puppet_t)
 148
 149         rpm_domtrans(puppet_t)
 150         rpm_manage_db(puppet_t)
 151         rpm_manage_log(puppet_t)
 152 ')
 153
 154 optional_policy(`
 155         unconfined_domain(puppet_t)
 156 ')
 157
 158 optional_policy(`
 159         usermanage_domtrans_groupadd(puppet_t)
 160         usermanage_domtrans_useradd(puppet_t)
 161 ')
 162
 163 ########################################
 164 #
 165 # Pupper master personal policy
 166 #
 167
 168 allow puppetmaster_t self:capability { dac_read_search dac_override setuid setgid fowner chown fsetid sys_tty_config };
 169 allow puppetmaster_t self:process { signal_perms getsched setsched };
 170 allow puppetmaster_t self:fifo_file rw_fifo_file_perms;
 171 allow puppetmaster_t self:netlink_route_socket create_netlink_socket_perms;
 172 allow puppetmaster_t self:socket create;
 173 allow puppetmaster_t self:tcp_socket create_stream_socket_perms;
 174 allow puppetmaster_t self:udp_socket create_socket_perms;
 175
 176 list_dirs_pattern(puppetmaster_t, puppet_etc_t, puppet_etc_t)
 177 read_files_pattern(puppetmaster_t, puppet_etc_t, puppet_etc_t)
 178
 179 allow puppetmaster_t puppet_log_t:dir { rw_dir_perms setattr };
 180 allow puppetmaster_t puppet_log_t:file { rw_file_perms create setattr };
 181 logging_log_filetrans(puppetmaster_t, puppet_log_t, { file dir })
 182
 183 manage_dirs_pattern(puppetmaster_t, puppet_var_lib_t, puppet_var_lib_t)
 184 manage_files_pattern(puppetmaster_t, puppet_var_lib_t, puppet_var_lib_t)
 185
 186 setattr_dirs_pattern(puppetmaster_t, puppet_var_run_t, puppet_var_run_t)
 187 manage_files_pattern(puppetmaster_t, puppet_var_run_t, puppet_var_run_t)
 188 files_pid_filetrans(puppetmaster_t, puppet_var_run_t, { file dir })
 189
 190 manage_dirs_pattern(puppetmaster_t, puppetmaster_tmp_t, puppetmaster_tmp_t)
 191 manage_files_pattern(puppetmaster_t, puppetmaster_tmp_t, puppetmaster_tmp_t)
 192 files_tmp_filetrans(puppetmaster_t, puppetmaster_tmp_t, { file dir })
 193
 194 kernel_dontaudit_search_kernel_sysctl(puppetmaster_t)
 195 kernel_read_system_state(puppetmaster_t)
 196 kernel_read_crypto_sysctls(puppetmaster_t)
 197
 198 corecmd_exec_bin(puppetmaster_t)
 199 corecmd_exec_shell(puppetmaster_t)
 200
 201 corenet_all_recvfrom_netlabel(puppetmaster_t)
 202 corenet_all_recvfrom_unlabeled(puppetmaster_t)
 203 corenet_tcp_sendrecv_generic_if(puppetmaster_t)
 204 corenet_tcp_sendrecv_generic_node(puppetmaster_t)
 205 corenet_tcp_bind_generic_node(puppetmaster_t)
 206 corenet_tcp_bind_puppet_port(puppetmaster_t)
 207 corenet_sendrecv_puppet_server_packets(puppetmaster_t)
 208
 209 dev_read_rand(puppetmaster_t)
 210 dev_read_urand(puppetmaster_t)
 211
 212 domain_read_all_domains_state(puppetmaster_t)
 213
 214 files_read_etc_files(puppetmaster_t)
 215 files_search_var_lib(puppetmaster_t)
 216
 217 logging_send_syslog_msg(puppetmaster_t)
 218
 219 miscfiles_read_localization(puppetmaster_t)
 220
 221 sysnet_dns_name_resolve(puppetmaster_t)
 222 sysnet_run_ifconfig(puppetmaster_t, system_r)
 223
 224 optional_policy(`
 225         hostname_exec(puppetmaster_t)
 226 ')
 227
 228 optional_policy(`
 229         files_read_usr_symlinks(puppetmaster_t)
 230
 231         rpm_exec(puppetmaster_t)
 232         rpm_read_db(puppetmaster_t)
 233 ')