policy/modules/services/sssd.te

   1 policy_module(sssd, 1.1.0)
   2
   3 ########################################
   4 #
   5 # Declarations
   6 #
   7
   8 type sssd_t;
   9 type sssd_exec_t;
  10 init_daemon_domain(sssd_t, sssd_exec_t)
  11
  12 type sssd_initrc_exec_t;
  13 init_script_file(sssd_initrc_exec_t)
  14
  15 type sssd_public_t;
  16 files_pid_file(sssd_public_t)
  17
  18 type sssd_var_lib_t;
  19 files_type(sssd_var_lib_t)
  20
  21 type sssd_var_log_t;
  22 logging_log_file(sssd_var_log_t)
  23
  24 type sssd_var_run_t;
  25 files_pid_file(sssd_var_run_t)
  26
  27 ########################################
  28 #
  29 # sssd local policy
  30 #
  31
  32 allow sssd_t self:capability { chown dac_read_search dac_override kill sys_nice setgid setuid };
  33 allow sssd_t self:process { setfscreate setsched sigkill signal getsched };
  34 allow sssd_t self:fifo_file rw_file_perms;
  35 allow sssd_t self:key manage_key_perms;
  36 allow sssd_t self:unix_stream_socket { create_stream_socket_perms connectto };
  37
  38 manage_dirs_pattern(sssd_t, sssd_public_t, sssd_public_t)
  39 manage_files_pattern(sssd_t, sssd_public_t, sssd_public_t)
  40
  41 manage_dirs_pattern(sssd_t, sssd_var_lib_t, sssd_var_lib_t)
  42 manage_files_pattern(sssd_t, sssd_var_lib_t, sssd_var_lib_t)
  43 manage_sock_files_pattern(sssd_t, sssd_var_lib_t, sssd_var_lib_t)
  44 files_var_lib_filetrans(sssd_t, sssd_var_lib_t, { file dir })
  45
  46 manage_files_pattern(sssd_t, sssd_var_log_t, sssd_var_log_t)
  47 logging_log_filetrans(sssd_t, sssd_var_log_t, file)
  48
  49 manage_dirs_pattern(sssd_t, sssd_var_run_t, sssd_var_run_t)
  50 manage_files_pattern(sssd_t, sssd_var_run_t, sssd_var_run_t)
  51 files_pid_filetrans(sssd_t, sssd_var_run_t, { file dir })
  52
  53 kernel_read_network_state(sssd_t)
  54 kernel_read_system_state(sssd_t)
  55
  56 corecmd_exec_bin(sssd_t)
  57
  58 dev_read_urand(sssd_t)
  59
  60 domain_read_all_domains_state(sssd_t)
  61 domain_obj_id_change_exemption(sssd_t)
  62
  63 files_list_tmp(sssd_t)
  64 files_read_etc_files(sssd_t)
  65 files_read_usr_files(sssd_t)
  66
  67 fs_list_inotifyfs(sssd_t)
  68
  69 selinux_validate_context(sssd_t)
  70
  71 seutil_read_file_contexts(sssd_t)
  72
  73 mls_file_read_to_clearance(sssd_t)
  74
  75 auth_use_nsswitch(sssd_t)
  76 auth_domtrans_chk_passwd(sssd_t)
  77 auth_domtrans_upd_passwd(sssd_t)
  78
  79 init_read_utmp(sssd_t)
  80
  81 logging_send_syslog_msg(sssd_t)
  82 logging_send_audit_msgs(sssd_t)
  83
  84 miscfiles_read_localization(sssd_t)
  85
  86 userdom_manage_tmp_role(system_r, sssd_t)
  87
  88 optional_policy(`
  89         dbus_system_bus_client(sssd_t)
  90         dbus_connect_system_bus(sssd_t)
  91 ')
  92
  93 optional_policy(`
  94         kerberos_manage_host_rcache(sssd_t)
  95 ')