policy/modules/services/rpc.if

   1 ## <summary>Remote Procedure Call Daemon for managment of network based process communication</summary>
   2
   3 ########################################
   4 ## <summary>
   5 ##      RPC stub interface.  No access allowed.
   6 ## </summary>
   7 ## <param name="domain" unused="true">
   8 ##      <summary>
   9 ##      Domain allowed access.
  10 ##      </summary>
  11 ## </param>
  12 #
  13 interface(`rpc_stub',`
  14         gen_require(`
  15                 type exports_t;
  16         ')
  17 ')
  18
  19 #######################################
  20 ## <summary>
  21 ##      The template to define a rpc domain.
  22 ## </summary>
  23 ## <desc>
  24 ##      <p>
  25 ##      This template creates a domain to be used for
  26 ##      a new rpc daemon.
  27 ##      </p>
  28 ## </desc>
  29 ## <param name="userdomain_prefix">
  30 ##      <summary>
  31 ##      The type of daemon to be used.
  32 ##      </summary>
  33 ## </param>
  34 #
  35 template(`rpc_domain_template', `
  36         ########################################
  37         #
  38         # Declarations
  39         #
  40
  41         type $1_t;
  42         type $1_exec_t;
  43         init_daemon_domain($1_t, $1_exec_t)
  44         domain_use_interactive_fds($1_t)
  45
  46         ####################################
  47         #
  48         # Local Policy
  49         #
  50
  51         dontaudit $1_t self:capability { net_admin sys_tty_config };
  52         allow $1_t self:capability net_bind_service;
  53         allow $1_t self:process signal_perms;
  54         allow $1_t self:unix_dgram_socket create_socket_perms;
  55         allow $1_t self:unix_stream_socket create_stream_socket_perms;
  56         allow $1_t self:tcp_socket create_stream_socket_perms;
  57         allow $1_t self:udp_socket create_socket_perms;
  58
  59         manage_dirs_pattern($1_t, var_lib_nfs_t, var_lib_nfs_t)
  60         manage_files_pattern($1_t, var_lib_nfs_t, var_lib_nfs_t)
  61
  62         kernel_list_proc($1_t)
  63         kernel_read_proc_symlinks($1_t)
  64         kernel_read_kernel_sysctls($1_t)
  65         # bind to arbitary unused ports
  66         kernel_rw_rpc_sysctls($1_t)
  67
  68         dev_read_sysfs($1_t)
  69         dev_read_urand($1_t)
  70         dev_read_rand($1_t)
  71
  72         corenet_all_recvfrom_unlabeled($1_t)
  73         corenet_all_recvfrom_netlabel($1_t)
  74         corenet_tcp_sendrecv_generic_if($1_t)
  75         corenet_udp_sendrecv_generic_if($1_t)
  76         corenet_tcp_sendrecv_generic_node($1_t)
  77         corenet_udp_sendrecv_generic_node($1_t)
  78         corenet_tcp_sendrecv_all_ports($1_t)
  79         corenet_udp_sendrecv_all_ports($1_t)
  80         corenet_tcp_bind_generic_node($1_t)
  81         corenet_udp_bind_generic_node($1_t)
  82         corenet_tcp_bind_reserved_port($1_t)
  83         corenet_tcp_connect_all_ports($1_t)
  84         corenet_sendrecv_portmap_client_packets($1_t)
  85         # do not log when it tries to bind to a port belonging to another domain
  86         corenet_dontaudit_tcp_bind_all_ports($1_t)
  87         corenet_dontaudit_udp_bind_all_ports($1_t)
  88         # bind to arbitary unused ports
  89         corenet_tcp_bind_generic_port($1_t)
  90         corenet_udp_bind_generic_port($1_t)
  91         corenet_tcp_bind_all_rpc_ports($1_t)
  92         corenet_udp_bind_all_rpc_ports($1_t)
  93         corenet_sendrecv_generic_server_packets($1_t)
  94
  95         fs_rw_rpc_named_pipes($1_t)
  96         fs_search_auto_mountpoints($1_t)
  97
  98         files_read_etc_files($1_t)
  99         files_read_etc_runtime_files($1_t)
 100         files_search_var($1_t)
 101         files_search_var_lib($1_t)
 102         files_list_home($1_t)
 103
 104         auth_use_nsswitch($1_t)
 105
 106         logging_send_syslog_msg($1_t)
 107
 108         miscfiles_read_localization($1_t)
 109
 110         userdom_dontaudit_use_unpriv_user_fds($1_t)
 111
 112         optional_policy(`
 113                 rpcbind_stream_connect($1_t)
 114         ')
 115
 116         optional_policy(`
 117                 seutil_sigchld_newrole($1_t)
 118         ')
 119
 120         optional_policy(`
 121                 udev_read_db($1_t)
 122         ')
 123 ')
 124
 125 ########################################
 126 ## <summary>
 127 ##      Send UDP network traffic to rpc and recieve UDP traffic from rpc.  (Deprecated)
 128 ## </summary>
 129 ## <param name="domain">
 130 ##      <summary>
 131 ##      Domain allowed access.
 132 ##      </summary>
 133 ## </param>
 134 #
 135 interface(`rpc_udp_send',`
 136         refpolicywarn(`$0($*) has been deprecated.')
 137 ')
 138
 139 ########################################
 140 ## <summary>
 141 ##      Do not audit attempts to get the attributes
 142 ##      of the NFS export file.
 143 ## </summary>
 144 ## <param name="domain">
 145 ##      <summary>
 146 ##      Domain to not audit.
 147 ##      </summary>
 148 ## </param>
 149 #
 150 interface(`rpc_dontaudit_getattr_exports',`
 151         gen_require(`
 152                 type exports_t;
 153         ')
 154
 155         dontaudit $1 exports_t:file getattr;
 156 ')
 157
 158 ########################################
 159 ## <summary>
 160 ##      Allow read access to exports.
 161 ## </summary>
 162 ## <param name="domain">
 163 ##      <summary>
 164 ##      Domain allowed access.
 165 ##      </summary>
 166 ## </param>
 167 #
 168 interface(`rpc_read_exports',`
 169         gen_require(`
 170                 type exports_t;
 171         ')
 172
 173         allow $1 exports_t:file read_file_perms;
 174 ')
 175
 176 ########################################
 177 ## <summary>
 178 ##      Allow write access to exports.
 179 ## </summary>
 180 ## <param name="domain">
 181 ##      <summary>
 182 ##      Domain allowed access.
 183 ##      </summary>
 184 ## </param>
 185 #
 186 interface(`rpc_write_exports',`
 187         gen_require(`
 188                 type exports_t;
 189         ')
 190
 191         allow $1 exports_t:file write;
 192 ')
 193
 194 ########################################
 195 ## <summary>
 196 ##      Execute domain in nfsd domain.
 197 ## </summary>
 198 ## <param name="domain">
 199 ##      <summary>
 200 ##      Domain allowed to transition.
 201 ##      </summary>
 202 ## </param>
 203 #
 204 interface(`rpc_domtrans_nfsd',`
 205         gen_require(`
 206                 type nfsd_t, nfsd_exec_t;
 207         ')
 208
 209         domtrans_pattern($1, nfsd_exec_t, nfsd_t)
 210 ')
 211
 212 #######################################
 213 ## <summary>
 214 ##      Execute domain in nfsd domain.
 215 ## </summary>
 216 ## <param name="domain">
 217 ##      <summary>
 218 ##      Domain allowed to transition.
 219 ##      </summary>
 220 ## </param>
 221 #
 222 interface(`rpc_initrc_domtrans_nfsd',`
 223         gen_require(`
 224                 type nfsd_initrc_exec_t;
 225         ')
 226
 227         init_labeled_script_domtrans($1, nfsd_initrc_exec_t)
 228 ')
 229
 230 ########################################
 231 ## <summary>
 232 ##      Execute domain in rpcd domain.
 233 ## </summary>
 234 ## <param name="domain">
 235 ##      <summary>
 236 ##      Domain allowed to transition.
 237 ##      </summary>
 238 ## </param>
 239 #
 240 interface(`rpc_domtrans_rpcd',`
 241         gen_require(`
 242                 type rpcd_t, rpcd_exec_t;
 243         ')
 244
 245         domtrans_pattern($1, rpcd_exec_t, rpcd_t)
 246         allow rpcd_t $1:process signal;
 247 ')
 248
 249 #######################################
 250 ## <summary>
 251 ##      Execute domain in rpcd domain.
 252 ## </summary>
 253 ## <param name="domain">
 254 ##      <summary>
 255 ##      Domain allowed to transition.
 256 ##      </summary>
 257 ## </param>
 258 #
 259 interface(`rpc_initrc_domtrans_rpcd',`
 260         gen_require(`
 261                 type rpcd_initrc_exec_t;
 262         ')
 263
 264         init_labeled_script_domtrans($1, rpcd_initrc_exec_t)
 265 ')
 266
 267 ########################################
 268 ## <summary>
 269 ##      Read NFS exported content.
 270 ## </summary>
 271 ## <param name="domain">
 272 ##      <summary>
 273 ##      Domain allowed access.
 274 ##      </summary>
 275 ## </param>
 276 ## <rolecap/>
 277 #
 278 interface(`rpc_read_nfs_content',`
 279         gen_require(`
 280                 type nfsd_ro_t, nfsd_rw_t;
 281         ')
 282
 283         allow $1 { nfsd_ro_t nfsd_rw_t }:dir list_dir_perms;
 284         allow $1 { nfsd_ro_t nfsd_rw_t }:file read_file_perms;
 285         allow $1 { nfsd_ro_t nfsd_rw_t }:lnk_file { getattr read };
 286 ')
 287
 288 ########################################
 289 ## <summary>
 290 ##      Allow domain to create read and write NFS directories.
 291 ## </summary>
 292 ## <param name="domain">
 293 ##      <summary>
 294 ##      Domain allowed access.
 295 ##      </summary>
 296 ## </param>
 297 ## <rolecap/>
 298 #
 299 interface(`rpc_manage_nfs_rw_content',`
 300         gen_require(`
 301                 type nfsd_rw_t;
 302         ')
 303
 304         manage_dirs_pattern($1, nfsd_rw_t, nfsd_rw_t)
 305         manage_files_pattern($1, nfsd_rw_t, nfsd_rw_t)
 306         manage_lnk_files_pattern($1, nfsd_rw_t, nfsd_rw_t)
 307 ')
 308
 309 ########################################
 310 ## <summary>
 311 ##      Allow domain to create read and write NFS directories.
 312 ## </summary>
 313 ## <param name="domain">
 314 ##      <summary>
 315 ##      Domain allowed access.
 316 ##      </summary>
 317 ## </param>
 318 ## <rolecap/>
 319 #
 320 interface(`rpc_manage_nfs_ro_content',`
 321         gen_require(`
 322                 type nfsd_ro_t;
 323         ')
 324
 325         manage_dirs_pattern($1, nfsd_ro_t, nfsd_ro_t)
 326         manage_files_pattern($1, nfsd_ro_t, nfsd_ro_t)
 327         manage_lnk_files_pattern($1, nfsd_ro_t, nfsd_ro_t)
 328 ')
 329
 330 ########################################
 331 ## <summary>
 332 ##      Allow domain to read and write to an NFS UDP socket.
 333 ## </summary>
 334 ## <param name="domain">
 335 ##      <summary>
 336 ##      Domain allowed access.
 337 ##      </summary>
 338 ## </param>
 339 #
 340 interface(`rpc_udp_rw_nfs_sockets',`
 341         gen_require(`
 342                 type nfsd_t;
 343         ')
 344
 345         allow $1 nfsd_t:udp_socket rw_socket_perms;
 346 ')
 347
 348 ########################################
 349 ## <summary>
 350 ##      Send UDP traffic to NFSd.  (Deprecated)
 351 ## </summary>
 352 ## <param name="domain">
 353 ##      <summary>
 354 ##      Domain allowed access.
 355 ##      </summary>
 356 ## </param>
 357 #
 358 interface(`rpc_udp_send_nfs',`
 359         refpolicywarn(`$0($*) has been deprecated.')
 360 ')
 361
 362 ########################################
 363 ## <summary>
 364 ##      Search NFS state data in /var/lib/nfs.
 365 ## </summary>
 366 ## <param name="domain">
 367 ##      <summary>
 368 ##      Domain allowed access.
 369 ##      </summary>
 370 ## </param>
 371 #
 372 interface(`rpc_search_nfs_state_data',`
 373         gen_require(`
 374                 type var_lib_nfs_t;
 375         ')
 376
 377         files_search_var_lib($1)
 378         allow $1 var_lib_nfs_t:dir search;
 379 ')
 380
 381 ########################################
 382 ## <summary>
 383 ##      Read NFS state data in /var/lib/nfs.
 384 ## </summary>
 385 ## <param name="domain">
 386 ##      <summary>
 387 ##      Domain allowed access.
 388 ##      </summary>
 389 ## </param>
 390 #
 391 interface(`rpc_read_nfs_state_data',`
 392         gen_require(`
 393                 type var_lib_nfs_t;
 394         ')
 395
 396         files_search_var_lib($1)
 397         read_files_pattern($1, var_lib_nfs_t, var_lib_nfs_t)
 398 ')
 399
 400 ########################################
 401 ## <summary>
 402 ##      Manage NFS state data in /var/lib/nfs.
 403 ## </summary>
 404 ## <param name="domain">
 405 ##      <summary>
 406 ##      Domain allowed access.
 407 ##      </summary>
 408 ## </param>
 409 #
 410 interface(`rpc_manage_nfs_state_data',`
 411         gen_require(`
 412                 type var_lib_nfs_t;
 413         ')
 414
 415         files_search_var_lib($1)
 416         manage_files_pattern($1, var_lib_nfs_t, var_lib_nfs_t)
 417 ')