policy/modules/services/setroubleshoot.te

   1
   2 policy_module(setroubleshoot, 1.11.0)
   3
   4 ########################################
   5 #
   6 # Declarations
   7 #
   8
   9 type setroubleshootd_t alias setroubleshoot_t;
  10 type setroubleshootd_exec_t;
  11 domain_type(setroubleshootd_t)
  12 init_daemon_domain(setroubleshootd_t, setroubleshootd_exec_t)
  13
  14 type setroubleshoot_fixit_t;
  15 type setroubleshoot_fixit_exec_t;
  16 dbus_system_domain(setroubleshoot_fixit_t, setroubleshoot_fixit_exec_t)
  17
  18 type setroubleshoot_var_lib_t;
  19 files_type(setroubleshoot_var_lib_t)
  20
  21 # log files
  22 type setroubleshoot_var_log_t;
  23 logging_log_file(setroubleshoot_var_log_t)
  24
  25 # pid files
  26 type setroubleshoot_var_run_t;
  27 files_pid_file(setroubleshoot_var_run_t)
  28
  29 ########################################
  30 #
  31 # setroubleshootd local policy
  32 #
  33
  34 allow setroubleshootd_t self:capability { dac_override sys_nice sys_tty_config };
  35 allow setroubleshootd_t self:process { getattr getsched setsched sigkill signull signal };
  36 allow setroubleshootd_t self:fifo_file rw_fifo_file_perms;
  37 allow setroubleshootd_t self:tcp_socket create_stream_socket_perms;
  38 allow setroubleshootd_t self:unix_stream_socket { create_stream_socket_perms connectto };
  39 allow setroubleshootd_t self:unix_dgram_socket create_socket_perms;
  40
  41 # database files
  42 allow setroubleshootd_t setroubleshoot_var_lib_t:dir setattr;
  43 manage_files_pattern(setroubleshootd_t, setroubleshoot_var_lib_t, setroubleshoot_var_lib_t)
  44 files_var_lib_filetrans(setroubleshootd_t, setroubleshoot_var_lib_t, { file dir })
  45
  46 # log files
  47 allow setroubleshootd_t setroubleshoot_var_log_t:dir setattr;
  48 manage_files_pattern(setroubleshootd_t, setroubleshoot_var_log_t, setroubleshoot_var_log_t)
  49 manage_sock_files_pattern(setroubleshootd_t, setroubleshoot_var_log_t, setroubleshoot_var_log_t)
  50 logging_log_filetrans(setroubleshootd_t, setroubleshoot_var_log_t, { file dir })
  51
  52 # pid file
  53 manage_files_pattern(setroubleshootd_t, setroubleshoot_var_run_t, setroubleshoot_var_run_t)
  54 manage_sock_files_pattern(setroubleshootd_t, setroubleshoot_var_run_t, setroubleshoot_var_run_t)
  55 files_pid_filetrans(setroubleshootd_t, setroubleshoot_var_run_t, { file sock_file })
  56
  57 kernel_read_kernel_sysctls(setroubleshootd_t)
  58 kernel_read_system_state(setroubleshootd_t)
  59 kernel_read_net_sysctls(setroubleshootd_t)
  60 kernel_read_network_state(setroubleshootd_t)
  61
  62 corecmd_exec_bin(setroubleshootd_t)
  63 corecmd_exec_shell(setroubleshootd_t)
  64
  65 corenet_all_recvfrom_unlabeled(setroubleshootd_t)
  66 corenet_all_recvfrom_netlabel(setroubleshootd_t)
  67 corenet_tcp_sendrecv_generic_if(setroubleshootd_t)
  68 corenet_tcp_sendrecv_generic_node(setroubleshootd_t)
  69 corenet_tcp_sendrecv_all_ports(setroubleshootd_t)
  70 corenet_tcp_bind_generic_node(setroubleshootd_t)
  71 corenet_tcp_connect_smtp_port(setroubleshootd_t)
  72 corenet_sendrecv_smtp_client_packets(setroubleshootd_t)
  73
  74 dev_read_urand(setroubleshootd_t)
  75 dev_read_sysfs(setroubleshootd_t)
  76 dev_getattr_all_blk_files(setroubleshootd_t)
  77 dev_getattr_all_chr_files(setroubleshootd_t)
  78
  79 domain_dontaudit_search_all_domains_state(setroubleshootd_t)
  80 domain_signull_all_domains(setroubleshootd_t)
  81
  82 files_read_usr_files(setroubleshootd_t)
  83 files_read_etc_files(setroubleshootd_t)
  84 files_list_all(setroubleshootd_t)
  85 files_getattr_all_files(setroubleshootd_t)
  86 files_getattr_all_pipes(setroubleshootd_t)
  87 files_getattr_all_sockets(setroubleshootd_t)
  88 files_read_all_symlinks(setroubleshootd_t)
  89
  90 fs_getattr_all_dirs(setroubleshootd_t)
  91 fs_getattr_all_files(setroubleshootd_t)
  92 fs_read_fusefs_symlinks(setroubleshootd_t)
  93 fs_list_inotifyfs(setroubleshootd_t)
  94 fs_dontaudit_read_nfs_files(setroubleshootd_t)
  95 fs_dontaudit_read_cifs_files(setroubleshootd_t)
  96
  97 selinux_get_enforce_mode(setroubleshootd_t)
  98 selinux_validate_context(setroubleshootd_t)
  99
 100 term_dontaudit_use_all_ptys(setroubleshootd_t)
 101 term_dontaudit_use_all_ttys(setroubleshootd_t)
 102
 103 auth_use_nsswitch(setroubleshootd_t)
 104
 105 init_read_utmp(setroubleshootd_t)
 106 init_dontaudit_write_utmp(setroubleshootd_t)
 107
 108 miscfiles_read_localization(setroubleshootd_t)
 109
 110 locallogin_dontaudit_use_fds(setroubleshootd_t)
 111
 112 logging_send_audit_msgs(setroubleshootd_t)
 113 logging_send_syslog_msg(setroubleshootd_t)
 114 logging_stream_connect_dispatcher(setroubleshootd_t)
 115
 116 modutils_read_module_config(setroubleshootd_t)
 117
 118 seutil_read_config(setroubleshootd_t)
 119 seutil_read_file_contexts(setroubleshootd_t)
 120 seutil_read_bin_policy(setroubleshootd_t)
 121
 122 userdom_dontaudit_read_user_home_content_files(setroubleshootd_t)
 123
 124 optional_policy(`
 125         dbus_system_domain(setroubleshootd_t, setroubleshootd_exec_t)
 126 ')
 127
 128 optional_policy(`
 129         rpm_signull(setroubleshootd_t)
 130         rpm_read_db(setroubleshootd_t)
 131         rpm_dontaudit_manage_db(setroubleshootd_t)
 132         rpm_use_script_fds(setroubleshootd_t)
 133 ')
 134
 135 ########################################
 136 #
 137 # setroubleshoot_fixit local policy
 138 #
 139
 140 allow setroubleshoot_fixit_t self:capability sys_nice;
 141 allow setroubleshoot_fixit_t self:process { setsched getsched };
 142 allow setroubleshoot_fixit_t self:fifo_file rw_fifo_file_perms;
 143 allow setroubleshoot_fixit_t self:unix_dgram_socket create_socket_perms;
 144
 145 allow setroubleshoot_fixit_t setroubleshootd_t:process signull;
 146
 147 setroubleshoot_dbus_chat(setroubleshoot_fixit_t)
 148 setroubleshoot_stream_connect(setroubleshoot_fixit_t)
 149
 150 kernel_read_system_state(setroubleshoot_fixit_t)
 151
 152 corecmd_exec_bin(setroubleshoot_fixit_t)
 153 corecmd_exec_shell(setroubleshoot_fixit_t)
 154
 155 seutil_domtrans_setfiles(setroubleshoot_fixit_t)
 156
 157 files_read_usr_files(setroubleshoot_fixit_t)
 158 files_read_etc_files(setroubleshoot_fixit_t)
 159 files_list_tmp(setroubleshoot_fixit_t)
 160
 161 auth_use_nsswitch(setroubleshoot_fixit_t)
 162
 163 logging_send_audit_msgs(setroubleshoot_fixit_t)
 164 logging_send_syslog_msg(setroubleshoot_fixit_t)
 165
 166 miscfiles_read_localization(setroubleshoot_fixit_t)
 167
 168 optional_policy(`
 169         rpm_signull(setroubleshoot_fixit_t)
 170         rpm_read_db(setroubleshoot_fixit_t)
 171         rpm_dontaudit_manage_db(setroubleshoot_fixit_t)
 172         rpm_use_script_fds(setroubleshoot_fixit_t)
 173 ')
 174
 175 optional_policy(`
 176         policykit_dbus_chat(setroubleshoot_fixit_t)
 177         userdom_read_all_users_state(setroubleshoot_fixit_t)
 178 ')