policy/modules/services/rpc.if

   1 ## <summary>Remote Procedure Call Daemon for managment of network based process communication</summary>
   2
   3 ########################################
   4 ## <summary>
   5 ##      RPC stub interface.  No access allowed.
   6 ## </summary>
   7 ## <param name="domain" unused="true">
   8 ##      <summary>
   9 ##      Domain allowed access.
  10 ##      </summary>
  11 ## </param>
  12 #
  13 interface(`rpc_stub',`
  14         gen_require(`
  15                 type exports_t;
  16         ')
  17 ')
  18
  19 #######################################
  20 ## <summary>
  21 ##      The template to define a rpc domain.
  22 ## </summary>
  23 ## <desc>
  24 ##      <p>
  25 ##      This template creates a domain to be used for
  26 ##      a new rpc daemon.
  27 ##      </p>
  28 ## </desc>
  29 ## <param name="userdomain_prefix">
  30 ##      <summary>
  31 ##      The type of daemon to be used.
  32 ##      </summary>
  33 ## </param>
  34 #
  35 template(`rpc_domain_template', `
  36         ########################################
  37         #
  38         # Declarations
  39         #
  40
  41         type $1_t;
  42         type $1_exec_t;
  43         init_daemon_domain($1_t, $1_exec_t)
  44         domain_use_interactive_fds($1_t)
  45
  46         ####################################
  47         #
  48         # Local Policy
  49         #
  50
  51         dontaudit $1_t self:capability { net_admin sys_tty_config };
  52         allow $1_t self:capability net_bind_service;
  53         allow $1_t self:process signal_perms;
  54         allow $1_t self:unix_dgram_socket create_socket_perms;
  55         allow $1_t self:unix_stream_socket create_stream_socket_perms;
  56         allow $1_t self:tcp_socket create_stream_socket_perms;
  57         allow $1_t self:udp_socket create_socket_perms;
  58
  59         manage_dirs_pattern($1_t, var_lib_nfs_t, var_lib_nfs_t)
  60         manage_files_pattern($1_t, var_lib_nfs_t, var_lib_nfs_t)
  61
  62         kernel_list_proc($1_t)
  63         kernel_read_proc_symlinks($1_t)
  64         kernel_read_kernel_sysctls($1_t)
  65         # bind to arbitary unused ports
  66         kernel_rw_rpc_sysctls($1_t)
  67
  68         dev_read_sysfs($1_t)
  69         dev_read_urand($1_t)
  70         dev_read_rand($1_t)
  71
  72         corenet_all_recvfrom_unlabeled($1_t)
  73         corenet_all_recvfrom_netlabel($1_t)
  74         corenet_tcp_sendrecv_generic_if($1_t)
  75         corenet_udp_sendrecv_generic_if($1_t)
  76         corenet_tcp_sendrecv_generic_node($1_t)
  77         corenet_udp_sendrecv_generic_node($1_t)
  78         corenet_tcp_sendrecv_all_ports($1_t)
  79         corenet_udp_sendrecv_all_ports($1_t)
  80         corenet_tcp_bind_generic_node($1_t)
  81         corenet_udp_bind_generic_node($1_t)
  82         corenet_tcp_bind_reserved_port($1_t)
  83         corenet_tcp_connect_all_ports($1_t)
  84         corenet_sendrecv_portmap_client_packets($1_t)
  85         # do not log when it tries to bind to a port belonging to another domain
  86         corenet_dontaudit_tcp_bind_all_ports($1_t)
  87         corenet_dontaudit_udp_bind_all_ports($1_t)
  88         # bind to arbitary unused ports
  89         corenet_tcp_bind_generic_port($1_t)
  90         corenet_udp_bind_generic_port($1_t)
  91         corenet_tcp_bind_all_rpc_ports($1_t)
  92         corenet_udp_bind_all_rpc_ports($1_t)
  93         corenet_sendrecv_generic_server_packets($1_t)
  94
  95         fs_rw_rpc_named_pipes($1_t)
  96         fs_search_auto_mountpoints($1_t)
  97
  98         files_read_etc_files($1_t)
  99         files_read_etc_runtime_files($1_t)
 100         files_search_var($1_t)
 101         files_search_var_lib($1_t)
 102
 103         auth_use_nsswitch($1_t)
 104
 105         logging_send_syslog_msg($1_t)
 106
 107         miscfiles_read_localization($1_t)
 108
 109         userdom_dontaudit_use_unpriv_user_fds($1_t)
 110
 111         optional_policy(`
 112                 seutil_sigchld_newrole($1_t)
 113         ')
 114
 115         optional_policy(`
 116                 udev_read_db($1_t)
 117         ')
 118 ')
 119
 120 ########################################
 121 ## <summary>
 122 ##      Send UDP network traffic to rpc and recieve UDP traffic from rpc.  (Deprecated)
 123 ## </summary>
 124 ## <param name="domain">
 125 ##      <summary>
 126 ##      The type of the process performing this action.
 127 ##      </summary>
 128 ## </param>
 129 #
 130 interface(`rpc_udp_send',`
 131         refpolicywarn(`$0($*) has been deprecated.')
 132 ')
 133
 134 ########################################
 135 ## <summary>
 136 ##      Do not audit attempts to get the attributes
 137 ##      of the NFS export file.
 138 ## </summary>
 139 ## <param name="domain">
 140 ##      <summary>
 141 ##      The type of the process performing this action.
 142 ##      </summary>
 143 ## </param>
 144 #
 145 interface(`rpc_dontaudit_getattr_exports',`
 146         gen_require(`
 147                 type exports_t;
 148         ')
 149
 150         dontaudit $1 exports_t:file getattr;
 151 ')
 152
 153 ########################################
 154 ## <summary>
 155 ##      Allow read access to exports.
 156 ## </summary>
 157 ## <param name="domain">
 158 ##      <summary>
 159 ##      The type of the process performing this action.
 160 ##      </summary>
 161 ## </param>
 162 #
 163 interface(`rpc_read_exports',`
 164         gen_require(`
 165                 type exports_t;
 166         ')
 167
 168         allow $1 exports_t:file read_file_perms;
 169 ')
 170
 171 ########################################
 172 ## <summary>
 173 ##      Allow write access to exports.
 174 ## </summary>
 175 ## <param name="domain">
 176 ##      <summary>
 177 ##      The type of the process performing this action.
 178 ##      </summary>
 179 ## </param>
 180 #
 181 interface(`rpc_write_exports',`
 182         gen_require(`
 183                 type exports_t;
 184         ')
 185
 186         allow $1 exports_t:file write;
 187 ')
 188
 189 ########################################
 190 ## <summary>
 191 ##      Execute domain in nfsd domain.
 192 ## </summary>
 193 ## <param name="domain">
 194 ##      <summary>
 195 ##      The type of the process performing this action.
 196 ##      </summary>
 197 ## </param>
 198 #
 199 interface(`rpc_domtrans_nfsd',`
 200         gen_require(`
 201                 type nfsd_t, nfsd_exec_t;
 202         ')
 203
 204         domtrans_pattern($1, nfsd_exec_t, nfsd_t)
 205 ')
 206
 207 ########################################
 208 ## <summary>
 209 ##      Execute domain in nfsd domain.
 210 ## </summary>
 211 ## <param name="domain">
 212 ##      <summary>
 213 ##      The type of the process performing this action.
 214 ##      </summary>
 215 ## </param>
 216 #
 217 interface(`rpc_domtrans_rpcd',`
 218         gen_require(`
 219                 type rpcd_t, rpcd_exec_t;
 220         ')
 221
 222         domtrans_pattern($1, rpcd_exec_t, rpcd_t)
 223         allow rpcd_t $1:process signal;
 224 ')
 225
 226 ########################################
 227 ## <summary>
 228 ##      Read NFS exported content.
 229 ## </summary>
 230 ## <param name="domain">
 231 ##      <summary>
 232 ##      Domain allowed access.
 233 ##      </summary>
 234 ## </param>
 235 ## <rolecap/>
 236 #
 237 interface(`rpc_read_nfs_content',`
 238         gen_require(`
 239                 type nfsd_ro_t, nfsd_rw_t;
 240         ')
 241
 242         allow $1 { nfsd_ro_t nfsd_rw_t }:dir list_dir_perms;
 243         allow $1 { nfsd_ro_t nfsd_rw_t }:file read_file_perms;
 244         allow $1 { nfsd_ro_t nfsd_rw_t }:lnk_file { getattr read };
 245 ')
 246
 247 ########################################
 248 ## <summary>
 249 ##      Allow domain to create read and write NFS directories.
 250 ## </summary>
 251 ## <param name="domain">
 252 ##      <summary>
 253 ##      Domain allowed access.
 254 ##      </summary>
 255 ## </param>
 256 ## <rolecap/>
 257 #
 258 interface(`rpc_manage_nfs_rw_content',`
 259         gen_require(`
 260                 type nfsd_rw_t;
 261         ')
 262
 263         manage_dirs_pattern($1, nfsd_rw_t, nfsd_rw_t)
 264         manage_files_pattern($1, nfsd_rw_t, nfsd_rw_t)
 265         manage_lnk_files_pattern($1, nfsd_rw_t, nfsd_rw_t)
 266 ')
 267
 268 ########################################
 269 ## <summary>
 270 ##      Allow domain to create read and write NFS directories.
 271 ## </summary>
 272 ## <param name="domain">
 273 ##      <summary>
 274 ##      Domain allowed access.
 275 ##      </summary>
 276 ## </param>
 277 ## <rolecap/>
 278 #
 279 interface(`rpc_manage_nfs_ro_content',`
 280         gen_require(`
 281                 type nfsd_ro_t;
 282         ')
 283
 284         manage_dirs_pattern($1, nfsd_ro_t, nfsd_ro_t)
 285         manage_files_pattern($1, nfsd_ro_t, nfsd_ro_t)
 286         manage_lnk_files_pattern($1, nfsd_ro_t, nfsd_ro_t)
 287 ')
 288
 289 ########################################
 290 ## <summary>
 291 ##      Allow domain to read and write to an NFS UDP socket.
 292 ## </summary>
 293 ## <param name="domain">
 294 ##      <summary>
 295 ##      Domain allowed access.
 296 ##      </summary>
 297 ## </param>
 298 #
 299 interface(`rpc_udp_rw_nfs_sockets',`
 300         gen_require(`
 301                 type nfsd_t;
 302         ')
 303
 304         allow $1 nfsd_t:udp_socket rw_socket_perms;
 305 ')
 306
 307 ########################################
 308 ## <summary>
 309 ##      Send UDP traffic to NFSd.  (Deprecated)
 310 ## </summary>
 311 ## <param name="domain">
 312 ##      <summary>
 313 ##      Domain allowed access.
 314 ##      </summary>
 315 ## </param>
 316 #
 317 interface(`rpc_udp_send_nfs',`
 318         refpolicywarn(`$0($*) has been deprecated.')
 319 ')
 320
 321 ########################################
 322 ## <summary>
 323 ##      Search NFS state data in /var/lib/nfs.
 324 ## </summary>
 325 ## <param name="domain">
 326 ##      <summary>
 327 ##      Domain allowed access.
 328 ##      </summary>
 329 ## </param>
 330 #
 331 interface(`rpc_search_nfs_state_data',`
 332         gen_require(`
 333                 type var_lib_nfs_t;
 334         ')
 335
 336         files_search_var_lib($1)
 337         allow $1 var_lib_nfs_t:dir search;
 338 ')
 339
 340 ########################################
 341 ## <summary>
 342 ##      Read NFS state data in /var/lib/nfs.
 343 ## </summary>
 344 ## <param name="domain">
 345 ##      <summary>
 346 ##      Domain allowed access.
 347 ##      </summary>
 348 ## </param>
 349 #
 350 interface(`rpc_read_nfs_state_data',`
 351         gen_require(`
 352                 type var_lib_nfs_t;
 353         ')
 354
 355         files_search_var_lib($1)
 356         read_files_pattern($1, var_lib_nfs_t, var_lib_nfs_t)
 357 ')
 358
 359 ########################################
 360 ## <summary>
 361 ##      Manage NFS state data in /var/lib/nfs.
 362 ## </summary>
 363 ## <param name="domain">
 364 ##      <summary>
 365 ##      Domain allowed access.
 366 ##      </summary>
 367 ## </param>
 368 #
 369 interface(`rpc_manage_nfs_state_data',`
 370         gen_require(`
 371                 type var_lib_nfs_t;
 372         ')
 373
 374         files_search_var_lib($1)
 375         manage_files_pattern($1, var_lib_nfs_t, var_lib_nfs_t)
 376 ')