policy/modules/services/ricci.te

   1
   2 policy_module(ricci, 1.6.1)
   3
   4 ########################################
   5 #
   6 # Declarations
   7 #
   8
   9 type ricci_t;
  10 type ricci_exec_t;
  11 domain_type(ricci_t)
  12 init_daemon_domain(ricci_t, ricci_exec_t)
  13
  14 type ricci_tmp_t;
  15 files_tmp_file(ricci_tmp_t)
  16
  17 type ricci_var_lib_t;
  18 files_type(ricci_var_lib_t)
  19
  20 type ricci_var_log_t;
  21 logging_log_file(ricci_var_log_t)
  22
  23 type ricci_var_run_t;
  24 files_pid_file(ricci_var_run_t)
  25
  26 type ricci_modcluster_t;
  27 type ricci_modcluster_exec_t;
  28 domain_type(ricci_modcluster_t)
  29 domain_entry_file(ricci_modcluster_t, ricci_modcluster_exec_t)
  30 role system_r types ricci_modcluster_t;
  31
  32 type ricci_modcluster_var_lib_t;
  33 files_type(ricci_modcluster_var_lib_t)
  34
  35 type ricci_modcluster_var_log_t;
  36 logging_log_file(ricci_modcluster_var_log_t)
  37
  38 type ricci_modcluster_var_run_t;
  39 files_pid_file(ricci_modcluster_var_run_t)
  40
  41 type ricci_modclusterd_t;
  42 type ricci_modclusterd_exec_t;
  43 domain_type(ricci_modclusterd_t)
  44 init_daemon_domain(ricci_modclusterd_t, ricci_modclusterd_exec_t)
  45
  46 type ricci_modlog_t;
  47 type ricci_modlog_exec_t;
  48 domain_type(ricci_modlog_t)
  49 domain_entry_file(ricci_modlog_t, ricci_modlog_exec_t)
  50 role system_r types ricci_modlog_t;
  51
  52 type ricci_modrpm_t;
  53 type ricci_modrpm_exec_t;
  54 domain_type(ricci_modrpm_t)
  55 domain_entry_file(ricci_modrpm_t, ricci_modrpm_exec_t)
  56 role system_r types ricci_modrpm_t;
  57
  58 type ricci_modservice_t;
  59 type ricci_modservice_exec_t;
  60 domain_type(ricci_modservice_t)
  61 domain_entry_file(ricci_modservice_t, ricci_modservice_exec_t)
  62 role system_r types ricci_modservice_t;
  63
  64 type ricci_modstorage_t;
  65 type ricci_modstorage_exec_t;
  66 domain_type(ricci_modstorage_t)
  67 domain_entry_file(ricci_modstorage_t, ricci_modstorage_exec_t)
  68 role system_r types ricci_modstorage_t;
  69
  70 type ricci_modstorage_lock_t;
  71 files_lock_file(ricci_modstorage_lock_t)
  72
  73 ########################################
  74 #
  75 # ricci local policy
  76 #
  77
  78 allow ricci_t self:capability { setuid sys_nice sys_boot };
  79 allow ricci_t self:process setsched;
  80 allow ricci_t self:fifo_file rw_fifo_file_perms;
  81 allow ricci_t self:unix_stream_socket { create_stream_socket_perms connectto };
  82 allow ricci_t self:tcp_socket create_stream_socket_perms;
  83
  84 domain_auto_trans(ricci_t, ricci_modcluster_exec_t, ricci_modcluster_t)
  85 domain_auto_trans(ricci_t, ricci_modlog_exec_t, ricci_modlog_t)
  86 domain_auto_trans(ricci_t, ricci_modrpm_exec_t, ricci_modrpm_t)
  87 domain_auto_trans(ricci_t, ricci_modservice_exec_t, ricci_modservice_t)
  88 domain_auto_trans(ricci_t, ricci_modstorage_exec_t, ricci_modstorage_t)
  89
  90 manage_dirs_pattern(ricci_t, ricci_tmp_t, ricci_tmp_t)
  91 manage_files_pattern(ricci_t, ricci_tmp_t, ricci_tmp_t)
  92 files_tmp_filetrans(ricci_t, ricci_tmp_t, { file dir })
  93
  94 manage_dirs_pattern(ricci_t, ricci_var_lib_t, ricci_var_lib_t)
  95 manage_files_pattern(ricci_t, ricci_var_lib_t, ricci_var_lib_t)
  96 manage_sock_files_pattern(ricci_t, ricci_var_lib_t, ricci_var_lib_t)
  97 files_var_lib_filetrans(ricci_t, ricci_var_lib_t, { file dir sock_file })
  98
  99 allow ricci_t ricci_var_log_t:dir setattr;
 100 manage_files_pattern(ricci_t, ricci_var_log_t, ricci_var_log_t)
 101 manage_sock_files_pattern(ricci_t, ricci_var_log_t, ricci_var_log_t)
 102 logging_log_filetrans(ricci_t, ricci_var_log_t, { sock_file file dir })
 103
 104 manage_files_pattern(ricci_t, ricci_var_run_t, ricci_var_run_t)
 105 manage_sock_files_pattern(ricci_t, ricci_var_run_t, ricci_var_run_t)
 106 files_pid_filetrans(ricci_t, ricci_var_run_t, { file sock_file })
 107
 108 kernel_read_kernel_sysctls(ricci_t)
 109
 110 corecmd_exec_bin(ricci_t)
 111
 112 corenet_all_recvfrom_unlabeled(ricci_t)
 113 corenet_all_recvfrom_netlabel(ricci_t)
 114 corenet_tcp_sendrecv_generic_if(ricci_t)
 115 corenet_tcp_sendrecv_generic_node(ricci_t)
 116 corenet_tcp_sendrecv_all_ports(ricci_t)
 117 corenet_tcp_bind_generic_node(ricci_t)
 118 corenet_udp_bind_generic_node(ricci_t)
 119 corenet_tcp_bind_ricci_port(ricci_t)
 120 corenet_udp_bind_ricci_port(ricci_t)
 121 corenet_tcp_connect_http_port(ricci_t)
 122
 123 dev_read_urand(ricci_t)
 124
 125 domain_read_all_domains_state(ricci_t)
 126
 127 files_read_etc_files(ricci_t)
 128 files_read_etc_runtime_files(ricci_t)
 129 files_create_boot_flag(ricci_t)
 130
 131 auth_domtrans_chk_passwd(ricci_t)
 132 auth_append_login_records(ricci_t)
 133
 134 init_stream_connect_script(ricci_t)
 135
 136 locallogin_dontaudit_use_fds(ricci_t)
 137
 138 logging_send_syslog_msg(ricci_t)
 139
 140 miscfiles_read_localization(ricci_t)
 141
 142 sysnet_dns_name_resolve(ricci_t)
 143
 144 optional_policy(`
 145         ccs_read_config(ricci_t)
 146 ')
 147
 148 optional_policy(`
 149         dbus_system_bus_client(ricci_t)
 150
 151         oddjob_dbus_chat(ricci_t)
 152 ')
 153
 154 optional_policy(`
 155         # Needed so oddjob can run halt/reboot on behalf of ricci
 156         corecmd_bin_entry_type(ricci_t)
 157         term_dontaudit_search_ptys(ricci_t)
 158         init_exec(ricci_t)
 159         init_telinit(ricci_t)
 160         init_rw_utmp(ricci_t)
 161
 162         oddjob_system_entry(ricci_t, ricci_exec_t)
 163 ')
 164
 165 optional_policy(`
 166         rpm_use_script_fds(ricci_t)
 167 ')
 168
 169 optional_policy(`
 170         sasl_connect(ricci_t)
 171 ')
 172
 173 optional_policy(`
 174         unconfined_use_fds(ricci_t)
 175 ')
 176
 177 optional_policy(`
 178         xen_domtrans_xm(ricci_t)
 179 ')
 180
 181 ########################################
 182 #
 183 # ricci_modcluster local policy
 184 #
 185
 186 allow ricci_modcluster_t self:capability { net_bind_service sys_nice };
 187 allow ricci_modcluster_t self:process setsched;
 188 allow ricci_modcluster_t self:fifo_file rw_fifo_file_perms;
 189
 190 kernel_read_kernel_sysctls(ricci_modcluster_t)
 191 kernel_read_system_state(ricci_modcluster_t)
 192
 193 corecmd_exec_shell(ricci_modcluster_t)
 194 corecmd_exec_bin(ricci_modcluster_t)
 195
 196 corenet_tcp_bind_cluster_port(ricci_modclusterd_t)
 197 corenet_tcp_bind_reserved_port(ricci_modclusterd_t)
 198
 199 domain_read_all_domains_state(ricci_modcluster_t)
 200
 201 files_search_locks(ricci_modcluster_t)
 202 files_read_etc_runtime_files(ricci_modcluster_t)
 203 files_read_etc_files(ricci_modcluster_t)
 204 files_search_usr(ricci_modcluster_t)
 205
 206 init_exec(ricci_modcluster_t)
 207 init_domtrans_script(ricci_modcluster_t)
 208
 209 logging_send_syslog_msg(ricci_modcluster_t)
 210
 211 miscfiles_read_localization(ricci_modcluster_t)
 212
 213 modutils_domtrans_insmod(ricci_modcluster_t)
 214
 215 mount_domtrans(ricci_modcluster_t)
 216
 217 consoletype_exec(ricci_modcluster_t)
 218
 219 ricci_stream_connect_modclusterd(ricci_modcluster_t)
 220
 221 optional_policy(`
 222         aisexec_stream_connect(ricci_modcluster_t)
 223         corosync_stream_connect(ricci_modcluster_t)
 224 ')
 225
 226 optional_policy(`
 227         ccs_stream_connect(ricci_modcluster_t)
 228         ccs_domtrans(ricci_modcluster_t)
 229         ccs_manage_config(ricci_modcluster_t)
 230 ')
 231
 232 optional_policy(`
 233         lvm_domtrans(ricci_modcluster_t)
 234 ')
 235
 236 optional_policy(`
 237         nscd_socket_use(ricci_modcluster_t)
 238 ')
 239
 240 optional_policy(`
 241         oddjob_system_entry(ricci_modcluster_t, ricci_modcluster_exec_t)
 242 ')
 243
 244 optional_policy(`
 245         rgmanager_stream_connect(ricci_modclusterd_t)
 246 ')
 247
 248 optional_policy(`
 249         # XXX This has got to go.
 250         unconfined_domain(ricci_modcluster_t)
 251 ')
 252
 253 ########################################
 254 #
 255 # ricci_modclusterd local policy
 256 #
 257
 258 allow ricci_modclusterd_t self:capability { sys_nice sys_tty_config };
 259 allow ricci_modclusterd_t self:process { signal sigkill setsched };
 260 allow ricci_modclusterd_t self:fifo_file rw_fifo_file_perms;
 261 allow ricci_modclusterd_t self:unix_stream_socket create_stream_socket_perms;
 262 allow ricci_modclusterd_t self:tcp_socket create_stream_socket_perms;
 263 # cjp: this needs to be fixed for a specific socket type:
 264 allow ricci_modclusterd_t self:socket create_socket_perms;
 265
 266 allow ricci_modclusterd_t ricci_modcluster_t:unix_stream_socket connectto;
 267 allow ricci_modclusterd_t ricci_modcluster_t:fifo_file rw_file_perms;
 268
 269 allow ricci_modclusterd_t ricci_modcluster_var_log_t:dir setattr;
 270 manage_files_pattern(ricci_modclusterd_t, ricci_modcluster_var_log_t, ricci_modcluster_var_log_t)
 271 manage_sock_files_pattern(ricci_modclusterd_t, ricci_modcluster_var_log_t, ricci_modcluster_var_log_t)
 272 logging_log_filetrans(ricci_modclusterd_t, ricci_modcluster_var_log_t, { sock_file file dir })
 273
 274 manage_files_pattern(ricci_modclusterd_t, ricci_modcluster_var_run_t, ricci_modcluster_var_run_t)
 275 manage_sock_files_pattern(ricci_modclusterd_t, ricci_modcluster_var_run_t, ricci_modcluster_var_run_t)
 276 files_pid_filetrans(ricci_modclusterd_t, ricci_modcluster_var_run_t, { file sock_file })
 277
 278 kernel_read_kernel_sysctls(ricci_modclusterd_t)
 279 kernel_read_system_state(ricci_modclusterd_t)
 280
 281 corecmd_exec_bin(ricci_modclusterd_t)
 282
 283 corenet_tcp_sendrecv_generic_if(ricci_modclusterd_t)
 284 corenet_tcp_sendrecv_all_ports(ricci_modclusterd_t)
 285 corenet_tcp_bind_generic_node(ricci_modclusterd_t)
 286 corenet_tcp_bind_ricci_modcluster_port(ricci_modclusterd_t)
 287 corenet_tcp_connect_ricci_modcluster_port(ricci_modclusterd_t)
 288
 289 domain_read_all_domains_state(ricci_modclusterd_t)
 290
 291 files_read_etc_files(ricci_modclusterd_t)
 292 files_read_etc_runtime_files(ricci_modclusterd_t)
 293
 294 fs_getattr_xattr_fs(ricci_modclusterd_t)
 295
 296 auth_use_nsswitch(ricci_modclusterd_t)
 297
 298 init_stream_connect_script(ricci_modclusterd_t)
 299
 300 locallogin_dontaudit_use_fds(ricci_modclusterd_t)
 301
 302 logging_send_syslog_msg(ricci_modclusterd_t)
 303
 304 miscfiles_read_localization(ricci_modclusterd_t)
 305
 306 sysnet_domtrans_ifconfig(ricci_modclusterd_t)
 307
 308 optional_policy(`
 309         aisexec_stream_connect(ricci_modclusterd_t)
 310         corosync_stream_connect(ricci_modclusterd_t)
 311 ')
 312
 313 optional_policy(`
 314         ccs_domtrans(ricci_modclusterd_t)
 315         ccs_stream_connect(ricci_modclusterd_t)
 316         ccs_read_config(ricci_modclusterd_t)
 317 ')
 318
 319 optional_policy(`
 320         rgmanager_stream_connect(ricci_modclusterd_t)
 321 ')
 322
 323 optional_policy(`
 324         unconfined_use_fds(ricci_modclusterd_t)
 325 ')
 326
 327 ########################################
 328 #
 329 # ricci_modlog local policy
 330 #
 331
 332 allow ricci_modlog_t self:capability sys_nice;
 333 allow ricci_modlog_t self:process setsched;
 334
 335 kernel_read_kernel_sysctls(ricci_modlog_t)
 336 kernel_read_system_state(ricci_modlog_t)
 337
 338 corecmd_exec_bin(ricci_modlog_t)
 339
 340 domain_read_all_domains_state(ricci_modlog_t)
 341
 342 files_read_etc_files(ricci_modlog_t)
 343 files_search_usr(ricci_modlog_t)
 344
 345 logging_read_generic_logs(ricci_modlog_t)
 346
 347 miscfiles_read_localization(ricci_modlog_t)
 348
 349 optional_policy(`
 350         nscd_dontaudit_search_pid(ricci_modlog_t)
 351 ')
 352
 353 optional_policy(`
 354         oddjob_system_entry(ricci_modlog_t, ricci_modlog_exec_t)
 355 ')
 356
 357 ########################################
 358 #
 359 # ricci_modrpm local policy
 360 #
 361
 362 allow ricci_modrpm_t self:fifo_file read_fifo_file_perms;
 363
 364 kernel_read_kernel_sysctls(ricci_modrpm_t)
 365
 366 corecmd_exec_bin(ricci_modrpm_t)
 367
 368 files_search_usr(ricci_modrpm_t)
 369 files_read_etc_files(ricci_modrpm_t)
 370
 371 miscfiles_read_localization(ricci_modrpm_t)
 372
 373 optional_policy(`
 374         oddjob_system_entry(ricci_modrpm_t, ricci_modrpm_exec_t)
 375 ')
 376
 377 optional_policy(`
 378         rpm_domtrans(ricci_modrpm_t)
 379 ')
 380
 381 ########################################
 382 #
 383 # ricci_modservice local policy
 384 #
 385
 386 allow ricci_modservice_t self:capability { dac_override sys_nice };
 387 allow ricci_modservice_t self:fifo_file rw_fifo_file_perms;
 388 allow ricci_modservice_t self:process setsched;
 389
 390 kernel_read_kernel_sysctls(ricci_modservice_t)
 391 kernel_read_system_state(ricci_modservice_t)
 392
 393 corecmd_exec_bin(ricci_modservice_t)
 394 corecmd_exec_shell(ricci_modservice_t)
 395
 396 files_read_etc_files(ricci_modservice_t)
 397 files_read_etc_runtime_files(ricci_modservice_t)
 398 files_search_usr(ricci_modservice_t)
 399 # Needed for running chkconfig
 400 files_manage_etc_symlinks(ricci_modservice_t)
 401
 402 consoletype_exec(ricci_modservice_t)
 403
 404 init_domtrans_script(ricci_modservice_t)
 405
 406 miscfiles_read_localization(ricci_modservice_t)
 407
 408 optional_policy(`
 409         ccs_read_config(ricci_modservice_t)
 410 ')
 411
 412 optional_policy(`
 413         nscd_dontaudit_search_pid(ricci_modservice_t)
 414 ')
 415
 416 optional_policy(`
 417         oddjob_system_entry(ricci_modservice_t, ricci_modservice_exec_t)
 418 ')
 419
 420 ########################################
 421 #
 422 # ricci_modstorage local policy
 423 #
 424
 425 allow ricci_modstorage_t self:process { setsched signal };
 426 dontaudit ricci_modstorage_t self:process ptrace;
 427 allow ricci_modstorage_t self:capability { mknod sys_nice };
 428 allow ricci_modstorage_t self:fifo_file rw_fifo_file_perms;
 429 allow ricci_modstorage_t self:unix_dgram_socket create_socket_perms;
 430
 431 kernel_read_kernel_sysctls(ricci_modstorage_t)
 432 kernel_read_system_state(ricci_modstorage_t)
 433
 434 create_files_pattern(ricci_modstorage_t, ricci_modstorage_lock_t, ricci_modstorage_lock_t)
 435 files_lock_filetrans(ricci_modstorage_t, ricci_modstorage_lock_t, file)
 436
 437 corecmd_exec_shell(ricci_modstorage_t)
 438 corecmd_exec_bin(ricci_modstorage_t)
 439
 440 dev_read_sysfs(ricci_modstorage_t)
 441 dev_read_urand(ricci_modstorage_t)
 442 dev_manage_generic_blk_files(ricci_modstorage_t)
 443
 444 domain_read_all_domains_state(ricci_modstorage_t)
 445
 446 #Needed for editing /etc/fstab
 447 files_manage_etc_files(ricci_modstorage_t)
 448 files_read_etc_runtime_files(ricci_modstorage_t)
 449 files_read_usr_files(ricci_modstorage_t)
 450 files_read_kernel_modules(ricci_modstorage_t)
 451
 452 storage_raw_read_fixed_disk(ricci_modstorage_t)
 453
 454 term_dontaudit_use_console(ricci_modstorage_t)
 455
 456 fstools_domtrans(ricci_modstorage_t)
 457
 458 logging_send_syslog_msg(ricci_modstorage_t)
 459
 460 miscfiles_read_localization(ricci_modstorage_t)
 461
 462 modutils_read_module_deps(ricci_modstorage_t)
 463
 464 consoletype_exec(ricci_modstorage_t)
 465
 466 mount_domtrans(ricci_modstorage_t)
 467
 468 optional_policy(`
 469         aisexec_stream_connect(ricci_modstorage_t)
 470         corosync_stream_connect(ricci_modstorage_t)
 471 ')
 472
 473 optional_policy(`
 474         ccs_stream_connect(ricci_modstorage_t)
 475         ccs_read_config(ricci_modstorage_t)
 476 ')
 477
 478 optional_policy(`
 479         lvm_domtrans(ricci_modstorage_t)
 480         lvm_manage_config(ricci_modstorage_t)
 481 ')
 482
 483 optional_policy(`
 484         nscd_socket_use(ricci_modstorage_t)
 485 ')
 486
 487 optional_policy(`
 488         oddjob_system_entry(ricci_modstorage_t, ricci_modstorage_exec_t)
 489 ')
 490
 491 optional_policy(`
 492         raid_domtrans_mdadm(ricci_modstorage_t)
 493 ')