policy/modules/services/setroubleshoot.te

   1 policy_module(setroubleshoot, 1.11.0)
   2
   3 ########################################
   4 #
   5 # Declarations
   6 #
   7
   8 type setroubleshootd_t alias setroubleshoot_t;
   9 type setroubleshootd_exec_t;
  10 domain_type(setroubleshootd_t)
  11 init_daemon_domain(setroubleshootd_t, setroubleshootd_exec_t)
  12
  13 type setroubleshoot_fixit_t;
  14 type setroubleshoot_fixit_exec_t;
  15 dbus_system_domain(setroubleshoot_fixit_t, setroubleshoot_fixit_exec_t)
  16
  17 type setroubleshoot_var_lib_t;
  18 files_type(setroubleshoot_var_lib_t)
  19
  20 # log files
  21 type setroubleshoot_var_log_t;
  22 logging_log_file(setroubleshoot_var_log_t)
  23
  24 # pid files
  25 type setroubleshoot_var_run_t;
  26 files_pid_file(setroubleshoot_var_run_t)
  27
  28 ########################################
  29 #
  30 # setroubleshootd local policy
  31 #
  32
  33 allow setroubleshootd_t self:capability { dac_override sys_nice sys_tty_config };
  34 allow setroubleshootd_t self:process { getattr getsched setsched sigkill signull signal };
  35 allow setroubleshootd_t self:fifo_file rw_fifo_file_perms;
  36 allow setroubleshootd_t self:tcp_socket create_stream_socket_perms;
  37 allow setroubleshootd_t self:unix_stream_socket { create_stream_socket_perms connectto };
  38 allow setroubleshootd_t self:unix_dgram_socket create_socket_perms;
  39
  40 # database files
  41 allow setroubleshootd_t setroubleshoot_var_lib_t:dir setattr;
  42 manage_files_pattern(setroubleshootd_t, setroubleshoot_var_lib_t, setroubleshoot_var_lib_t)
  43 files_var_lib_filetrans(setroubleshootd_t, setroubleshoot_var_lib_t, { file dir })
  44
  45 # log files
  46 allow setroubleshootd_t setroubleshoot_var_log_t:dir setattr;
  47 manage_files_pattern(setroubleshootd_t, setroubleshoot_var_log_t, setroubleshoot_var_log_t)
  48 manage_sock_files_pattern(setroubleshootd_t, setroubleshoot_var_log_t, setroubleshoot_var_log_t)
  49 logging_log_filetrans(setroubleshootd_t, setroubleshoot_var_log_t, { file dir })
  50
  51 # pid file
  52 manage_files_pattern(setroubleshootd_t, setroubleshoot_var_run_t, setroubleshoot_var_run_t)
  53 manage_sock_files_pattern(setroubleshootd_t, setroubleshoot_var_run_t, setroubleshoot_var_run_t)
  54 files_pid_filetrans(setroubleshootd_t, setroubleshoot_var_run_t, { file sock_file })
  55
  56 kernel_read_kernel_sysctls(setroubleshootd_t)
  57 kernel_read_system_state(setroubleshootd_t)
  58 kernel_read_net_sysctls(setroubleshootd_t)
  59 kernel_read_network_state(setroubleshootd_t)
  60
  61 corecmd_exec_bin(setroubleshootd_t)
  62 corecmd_exec_shell(setroubleshootd_t)
  63
  64 corenet_all_recvfrom_unlabeled(setroubleshootd_t)
  65 corenet_all_recvfrom_netlabel(setroubleshootd_t)
  66 corenet_tcp_sendrecv_generic_if(setroubleshootd_t)
  67 corenet_tcp_sendrecv_generic_node(setroubleshootd_t)
  68 corenet_tcp_sendrecv_all_ports(setroubleshootd_t)
  69 corenet_tcp_bind_generic_node(setroubleshootd_t)
  70 corenet_tcp_connect_smtp_port(setroubleshootd_t)
  71 corenet_sendrecv_smtp_client_packets(setroubleshootd_t)
  72
  73 dev_read_urand(setroubleshootd_t)
  74 dev_read_sysfs(setroubleshootd_t)
  75 dev_getattr_all_blk_files(setroubleshootd_t)
  76 dev_getattr_all_chr_files(setroubleshootd_t)
  77
  78 domain_dontaudit_search_all_domains_state(setroubleshootd_t)
  79 domain_signull_all_domains(setroubleshootd_t)
  80
  81 files_read_usr_files(setroubleshootd_t)
  82 files_read_etc_files(setroubleshootd_t)
  83 files_list_all(setroubleshootd_t)
  84 files_getattr_all_files(setroubleshootd_t)
  85 files_getattr_all_pipes(setroubleshootd_t)
  86 files_getattr_all_sockets(setroubleshootd_t)
  87 files_read_all_symlinks(setroubleshootd_t)
  88
  89 fs_getattr_all_dirs(setroubleshootd_t)
  90 fs_getattr_all_files(setroubleshootd_t)
  91 fs_read_fusefs_symlinks(setroubleshootd_t)
  92 fs_list_inotifyfs(setroubleshootd_t)
  93 fs_dontaudit_read_nfs_files(setroubleshootd_t)
  94 fs_dontaudit_read_cifs_files(setroubleshootd_t)
  95
  96 selinux_get_enforce_mode(setroubleshootd_t)
  97 selinux_validate_context(setroubleshootd_t)
  98
  99 term_dontaudit_use_all_ptys(setroubleshootd_t)
 100 term_dontaudit_use_all_ttys(setroubleshootd_t)
 101
 102 auth_use_nsswitch(setroubleshootd_t)
 103
 104 init_read_utmp(setroubleshootd_t)
 105 init_dontaudit_write_utmp(setroubleshootd_t)
 106
 107 miscfiles_read_localization(setroubleshootd_t)
 108
 109 locallogin_dontaudit_use_fds(setroubleshootd_t)
 110
 111 logging_send_audit_msgs(setroubleshootd_t)
 112 logging_send_syslog_msg(setroubleshootd_t)
 113 logging_stream_connect_dispatcher(setroubleshootd_t)
 114
 115 modutils_read_module_config(setroubleshootd_t)
 116
 117 seutil_read_config(setroubleshootd_t)
 118 seutil_read_file_contexts(setroubleshootd_t)
 119 seutil_read_bin_policy(setroubleshootd_t)
 120
 121 userdom_dontaudit_read_user_home_content_files(setroubleshootd_t)
 122
 123 optional_policy(`
 124         dbus_system_domain(setroubleshootd_t, setroubleshootd_exec_t)
 125 ')
 126
 127 optional_policy(`
 128         rpm_signull(setroubleshootd_t)
 129         rpm_read_db(setroubleshootd_t)
 130         rpm_dontaudit_manage_db(setroubleshootd_t)
 131         rpm_use_script_fds(setroubleshootd_t)
 132 ')
 133
 134 ########################################
 135 #
 136 # setroubleshoot_fixit local policy
 137 #
 138
 139 allow setroubleshoot_fixit_t self:capability sys_nice;
 140 allow setroubleshoot_fixit_t self:process { setsched getsched };
 141 allow setroubleshoot_fixit_t self:fifo_file rw_fifo_file_perms;
 142 allow setroubleshoot_fixit_t self:unix_dgram_socket create_socket_perms;
 143
 144 allow setroubleshoot_fixit_t setroubleshootd_t:process signull;
 145
 146 setroubleshoot_dbus_chat(setroubleshoot_fixit_t)
 147 setroubleshoot_stream_connect(setroubleshoot_fixit_t)
 148
 149 kernel_read_system_state(setroubleshoot_fixit_t)
 150
 151 corecmd_exec_bin(setroubleshoot_fixit_t)
 152 corecmd_exec_shell(setroubleshoot_fixit_t)
 153
 154 seutil_domtrans_setfiles(setroubleshoot_fixit_t)
 155
 156 files_read_usr_files(setroubleshoot_fixit_t)
 157 files_read_etc_files(setroubleshoot_fixit_t)
 158 files_list_tmp(setroubleshoot_fixit_t)
 159
 160 auth_use_nsswitch(setroubleshoot_fixit_t)
 161
 162 logging_send_audit_msgs(setroubleshoot_fixit_t)
 163 logging_send_syslog_msg(setroubleshoot_fixit_t)
 164
 165 miscfiles_read_localization(setroubleshoot_fixit_t)
 166
 167 optional_policy(`
 168         rpm_signull(setroubleshoot_fixit_t)
 169         rpm_read_db(setroubleshoot_fixit_t)
 170         rpm_dontaudit_manage_db(setroubleshoot_fixit_t)
 171         rpm_use_script_fds(setroubleshoot_fixit_t)
 172 ')
 173
 174 optional_policy(`
 175         policykit_dbus_chat(setroubleshoot_fixit_t)
 176         userdom_read_all_users_state(setroubleshoot_fixit_t)
 177 ')