2 policy_module(ricci, 1.7.0)
4 ########################################
12 init_daemon_domain(ricci_t, ricci_exec_t)
15 files_tmp_file(ricci_tmp_t)
18 files_type(ricci_var_lib_t)
21 logging_log_file(ricci_var_log_t)
24 files_pid_file(ricci_var_run_t)
26 type ricci_modcluster_t;
27 type ricci_modcluster_exec_t;
28 domain_type(ricci_modcluster_t)
29 domain_entry_file(ricci_modcluster_t, ricci_modcluster_exec_t)
30 role system_r types ricci_modcluster_t;
32 type ricci_modcluster_var_lib_t;
33 files_type(ricci_modcluster_var_lib_t)
35 type ricci_modcluster_var_log_t;
36 logging_log_file(ricci_modcluster_var_log_t)
38 type ricci_modcluster_var_run_t;
39 files_pid_file(ricci_modcluster_var_run_t)
41 type ricci_modclusterd_t;
42 type ricci_modclusterd_exec_t;
43 domain_type(ricci_modclusterd_t)
44 init_daemon_domain(ricci_modclusterd_t, ricci_modclusterd_exec_t)
47 type ricci_modlog_exec_t;
48 domain_type(ricci_modlog_t)
49 domain_entry_file(ricci_modlog_t, ricci_modlog_exec_t)
50 role system_r types ricci_modlog_t;
53 type ricci_modrpm_exec_t;
54 domain_type(ricci_modrpm_t)
55 domain_entry_file(ricci_modrpm_t, ricci_modrpm_exec_t)
56 role system_r types ricci_modrpm_t;
58 type ricci_modservice_t;
59 type ricci_modservice_exec_t;
60 domain_type(ricci_modservice_t)
61 domain_entry_file(ricci_modservice_t, ricci_modservice_exec_t)
62 role system_r types ricci_modservice_t;
64 type ricci_modstorage_t;
65 type ricci_modstorage_exec_t;
66 domain_type(ricci_modstorage_t)
67 domain_entry_file(ricci_modstorage_t, ricci_modstorage_exec_t)
68 role system_r types ricci_modstorage_t;
70 type ricci_modstorage_lock_t;
71 files_lock_file(ricci_modstorage_lock_t)
73 ########################################
78 allow ricci_t self:capability { setuid sys_nice sys_boot };
79 allow ricci_t self:process setsched;
80 allow ricci_t self:fifo_file rw_fifo_file_perms;
81 allow ricci_t self:unix_stream_socket { create_stream_socket_perms connectto };
82 allow ricci_t self:tcp_socket create_stream_socket_perms;
84 domain_auto_trans(ricci_t, ricci_modcluster_exec_t, ricci_modcluster_t)
85 domain_auto_trans(ricci_t, ricci_modlog_exec_t, ricci_modlog_t)
86 domain_auto_trans(ricci_t, ricci_modrpm_exec_t, ricci_modrpm_t)
87 domain_auto_trans(ricci_t, ricci_modservice_exec_t, ricci_modservice_t)
88 domain_auto_trans(ricci_t, ricci_modstorage_exec_t, ricci_modstorage_t)
90 manage_dirs_pattern(ricci_t, ricci_tmp_t, ricci_tmp_t)
91 manage_files_pattern(ricci_t, ricci_tmp_t, ricci_tmp_t)
92 files_tmp_filetrans(ricci_t, ricci_tmp_t, { file dir })
94 manage_dirs_pattern(ricci_t, ricci_var_lib_t, ricci_var_lib_t)
95 manage_files_pattern(ricci_t, ricci_var_lib_t, ricci_var_lib_t)
96 manage_sock_files_pattern(ricci_t, ricci_var_lib_t, ricci_var_lib_t)
97 files_var_lib_filetrans(ricci_t, ricci_var_lib_t, { file dir sock_file })
99 allow ricci_t ricci_var_log_t:dir setattr;
100 manage_files_pattern(ricci_t, ricci_var_log_t, ricci_var_log_t)
101 manage_sock_files_pattern(ricci_t, ricci_var_log_t, ricci_var_log_t)
102 logging_log_filetrans(ricci_t, ricci_var_log_t, { sock_file file dir })
104 manage_files_pattern(ricci_t, ricci_var_run_t, ricci_var_run_t)
105 manage_sock_files_pattern(ricci_t, ricci_var_run_t, ricci_var_run_t)
106 files_pid_filetrans(ricci_t, ricci_var_run_t, { file sock_file })
108 kernel_read_kernel_sysctls(ricci_t)
110 corecmd_exec_bin(ricci_t)
112 corenet_all_recvfrom_unlabeled(ricci_t)
113 corenet_all_recvfrom_netlabel(ricci_t)
114 corenet_tcp_sendrecv_generic_if(ricci_t)
115 corenet_tcp_sendrecv_generic_node(ricci_t)
116 corenet_tcp_sendrecv_all_ports(ricci_t)
117 corenet_tcp_bind_generic_node(ricci_t)
118 corenet_udp_bind_generic_node(ricci_t)
119 corenet_tcp_bind_ricci_port(ricci_t)
120 corenet_udp_bind_ricci_port(ricci_t)
121 corenet_tcp_connect_http_port(ricci_t)
123 dev_read_urand(ricci_t)
125 domain_read_all_domains_state(ricci_t)
127 files_read_etc_files(ricci_t)
128 files_read_etc_runtime_files(ricci_t)
129 files_create_boot_flag(ricci_t)
131 auth_domtrans_chk_passwd(ricci_t)
132 auth_append_login_records(ricci_t)
134 init_stream_connect_script(ricci_t)
136 locallogin_dontaudit_use_fds(ricci_t)
138 logging_send_syslog_msg(ricci_t)
140 miscfiles_read_localization(ricci_t)
142 sysnet_dns_name_resolve(ricci_t)
145 ccs_read_config(ricci_t)
149 dbus_system_bus_client(ricci_t)
151 oddjob_dbus_chat(ricci_t)
155 # Needed so oddjob can run halt/reboot on behalf of ricci
156 corecmd_bin_entry_type(ricci_t)
157 term_dontaudit_search_ptys(ricci_t)
159 init_telinit(ricci_t)
160 init_rw_utmp(ricci_t)
162 oddjob_system_entry(ricci_t, ricci_exec_t)
166 rpm_use_script_fds(ricci_t)
170 sasl_connect(ricci_t)
174 unconfined_use_fds(ricci_t)
178 xen_domtrans_xm(ricci_t)
181 ########################################
183 # ricci_modcluster local policy
186 allow ricci_modcluster_t self:capability { net_bind_service sys_nice };
187 allow ricci_modcluster_t self:process setsched;
188 allow ricci_modcluster_t self:fifo_file rw_fifo_file_perms;
190 kernel_read_kernel_sysctls(ricci_modcluster_t)
191 kernel_read_system_state(ricci_modcluster_t)
193 corecmd_exec_shell(ricci_modcluster_t)
194 corecmd_exec_bin(ricci_modcluster_t)
196 corenet_tcp_bind_cluster_port(ricci_modclusterd_t)
197 corenet_tcp_bind_reserved_port(ricci_modclusterd_t)
199 domain_read_all_domains_state(ricci_modcluster_t)
201 files_search_locks(ricci_modcluster_t)
202 files_read_etc_runtime_files(ricci_modcluster_t)
203 files_read_etc_files(ricci_modcluster_t)
204 files_search_usr(ricci_modcluster_t)
206 init_exec(ricci_modcluster_t)
207 init_domtrans_script(ricci_modcluster_t)
209 logging_send_syslog_msg(ricci_modcluster_t)
211 miscfiles_read_localization(ricci_modcluster_t)
213 modutils_domtrans_insmod(ricci_modcluster_t)
215 mount_domtrans(ricci_modcluster_t)
217 consoletype_exec(ricci_modcluster_t)
219 ricci_stream_connect_modclusterd(ricci_modcluster_t)
222 aisexec_stream_connect(ricci_modcluster_t)
223 corosync_stream_connect(ricci_modcluster_t)
227 ccs_stream_connect(ricci_modcluster_t)
228 ccs_domtrans(ricci_modcluster_t)
229 ccs_manage_config(ricci_modcluster_t)
233 lvm_domtrans(ricci_modcluster_t)
237 nscd_socket_use(ricci_modcluster_t)
241 oddjob_system_entry(ricci_modcluster_t, ricci_modcluster_exec_t)
245 rgmanager_stream_connect(ricci_modclusterd_t)
249 # XXX This has got to go.
250 unconfined_domain(ricci_modcluster_t)
253 ########################################
255 # ricci_modclusterd local policy
258 allow ricci_modclusterd_t self:capability { sys_nice sys_tty_config };
259 allow ricci_modclusterd_t self:process { signal sigkill setsched };
260 allow ricci_modclusterd_t self:fifo_file rw_fifo_file_perms;
261 allow ricci_modclusterd_t self:unix_stream_socket create_stream_socket_perms;
262 allow ricci_modclusterd_t self:tcp_socket create_stream_socket_perms;
263 # cjp: this needs to be fixed for a specific socket type:
264 allow ricci_modclusterd_t self:socket create_socket_perms;
266 allow ricci_modclusterd_t ricci_modcluster_t:unix_stream_socket connectto;
267 allow ricci_modclusterd_t ricci_modcluster_t:fifo_file rw_file_perms;
269 allow ricci_modclusterd_t ricci_modcluster_var_log_t:dir setattr;
270 manage_files_pattern(ricci_modclusterd_t, ricci_modcluster_var_log_t, ricci_modcluster_var_log_t)
271 manage_sock_files_pattern(ricci_modclusterd_t, ricci_modcluster_var_log_t, ricci_modcluster_var_log_t)
272 logging_log_filetrans(ricci_modclusterd_t, ricci_modcluster_var_log_t, { sock_file file dir })
274 manage_files_pattern(ricci_modclusterd_t, ricci_modcluster_var_run_t, ricci_modcluster_var_run_t)
275 manage_sock_files_pattern(ricci_modclusterd_t, ricci_modcluster_var_run_t, ricci_modcluster_var_run_t)
276 files_pid_filetrans(ricci_modclusterd_t, ricci_modcluster_var_run_t, { file sock_file })
278 kernel_read_kernel_sysctls(ricci_modclusterd_t)
279 kernel_read_system_state(ricci_modclusterd_t)
281 corecmd_exec_bin(ricci_modclusterd_t)
283 corenet_tcp_sendrecv_generic_if(ricci_modclusterd_t)
284 corenet_tcp_sendrecv_all_ports(ricci_modclusterd_t)
285 corenet_tcp_bind_generic_node(ricci_modclusterd_t)
286 corenet_tcp_bind_ricci_modcluster_port(ricci_modclusterd_t)
287 corenet_tcp_connect_ricci_modcluster_port(ricci_modclusterd_t)
289 domain_read_all_domains_state(ricci_modclusterd_t)
291 files_read_etc_files(ricci_modclusterd_t)
292 files_read_etc_runtime_files(ricci_modclusterd_t)
294 fs_getattr_xattr_fs(ricci_modclusterd_t)
296 auth_use_nsswitch(ricci_modclusterd_t)
298 init_stream_connect_script(ricci_modclusterd_t)
300 locallogin_dontaudit_use_fds(ricci_modclusterd_t)
302 logging_send_syslog_msg(ricci_modclusterd_t)
304 miscfiles_read_localization(ricci_modclusterd_t)
306 sysnet_domtrans_ifconfig(ricci_modclusterd_t)
309 aisexec_stream_connect(ricci_modclusterd_t)
310 corosync_stream_connect(ricci_modclusterd_t)
314 ccs_domtrans(ricci_modclusterd_t)
315 ccs_stream_connect(ricci_modclusterd_t)
316 ccs_read_config(ricci_modclusterd_t)
320 rgmanager_stream_connect(ricci_modclusterd_t)
324 unconfined_use_fds(ricci_modclusterd_t)
327 ########################################
329 # ricci_modlog local policy
332 allow ricci_modlog_t self:capability sys_nice;
333 allow ricci_modlog_t self:process setsched;
335 kernel_read_kernel_sysctls(ricci_modlog_t)
336 kernel_read_system_state(ricci_modlog_t)
338 corecmd_exec_bin(ricci_modlog_t)
340 domain_read_all_domains_state(ricci_modlog_t)
342 files_read_etc_files(ricci_modlog_t)
343 files_search_usr(ricci_modlog_t)
345 logging_read_generic_logs(ricci_modlog_t)
347 miscfiles_read_localization(ricci_modlog_t)
350 nscd_dontaudit_search_pid(ricci_modlog_t)
354 oddjob_system_entry(ricci_modlog_t, ricci_modlog_exec_t)
357 ########################################
359 # ricci_modrpm local policy
362 allow ricci_modrpm_t self:fifo_file read_fifo_file_perms;
364 kernel_read_kernel_sysctls(ricci_modrpm_t)
366 corecmd_exec_bin(ricci_modrpm_t)
368 files_search_usr(ricci_modrpm_t)
369 files_read_etc_files(ricci_modrpm_t)
371 miscfiles_read_localization(ricci_modrpm_t)
374 oddjob_system_entry(ricci_modrpm_t, ricci_modrpm_exec_t)
378 rpm_domtrans(ricci_modrpm_t)
381 ########################################
383 # ricci_modservice local policy
386 allow ricci_modservice_t self:capability { dac_override sys_nice };
387 allow ricci_modservice_t self:fifo_file rw_fifo_file_perms;
388 allow ricci_modservice_t self:process setsched;
390 kernel_read_kernel_sysctls(ricci_modservice_t)
391 kernel_read_system_state(ricci_modservice_t)
393 corecmd_exec_bin(ricci_modservice_t)
394 corecmd_exec_shell(ricci_modservice_t)
396 files_read_etc_files(ricci_modservice_t)
397 files_read_etc_runtime_files(ricci_modservice_t)
398 files_search_usr(ricci_modservice_t)
399 # Needed for running chkconfig
400 files_manage_etc_symlinks(ricci_modservice_t)
402 consoletype_exec(ricci_modservice_t)
404 init_domtrans_script(ricci_modservice_t)
406 miscfiles_read_localization(ricci_modservice_t)
409 ccs_read_config(ricci_modservice_t)
413 nscd_dontaudit_search_pid(ricci_modservice_t)
417 oddjob_system_entry(ricci_modservice_t, ricci_modservice_exec_t)
420 ########################################
422 # ricci_modstorage local policy
425 allow ricci_modstorage_t self:process { setsched signal };
426 dontaudit ricci_modstorage_t self:process ptrace;
427 allow ricci_modstorage_t self:capability { mknod sys_nice };
428 allow ricci_modstorage_t self:fifo_file rw_fifo_file_perms;
429 allow ricci_modstorage_t self:unix_dgram_socket create_socket_perms;
431 kernel_read_kernel_sysctls(ricci_modstorage_t)
432 kernel_read_system_state(ricci_modstorage_t)
434 create_files_pattern(ricci_modstorage_t, ricci_modstorage_lock_t, ricci_modstorage_lock_t)
435 files_lock_filetrans(ricci_modstorage_t, ricci_modstorage_lock_t, file)
437 corecmd_exec_shell(ricci_modstorage_t)
438 corecmd_exec_bin(ricci_modstorage_t)
440 dev_read_sysfs(ricci_modstorage_t)
441 dev_read_urand(ricci_modstorage_t)
442 dev_manage_generic_blk_files(ricci_modstorage_t)
444 domain_read_all_domains_state(ricci_modstorage_t)
446 #Needed for editing /etc/fstab
447 files_manage_etc_files(ricci_modstorage_t)
448 files_read_etc_runtime_files(ricci_modstorage_t)
449 files_read_usr_files(ricci_modstorage_t)
450 files_read_kernel_modules(ricci_modstorage_t)
452 storage_raw_read_fixed_disk(ricci_modstorage_t)
454 term_dontaudit_use_console(ricci_modstorage_t)
456 fstools_domtrans(ricci_modstorage_t)
458 logging_send_syslog_msg(ricci_modstorage_t)
460 miscfiles_read_localization(ricci_modstorage_t)
462 modutils_read_module_deps(ricci_modstorage_t)
464 consoletype_exec(ricci_modstorage_t)
466 mount_domtrans(ricci_modstorage_t)
469 aisexec_stream_connect(ricci_modstorage_t)
470 corosync_stream_connect(ricci_modstorage_t)
474 ccs_stream_connect(ricci_modstorage_t)
475 ccs_read_config(ricci_modstorage_t)
479 lvm_domtrans(ricci_modstorage_t)
480 lvm_manage_config(ricci_modstorage_t)
484 nscd_socket_use(ricci_modstorage_t)
488 oddjob_system_entry(ricci_modstorage_t, ricci_modstorage_exec_t)
492 raid_domtrans_mdadm(ricci_modstorage_t)