policy/modules/system/lvm.te

   1 policy_module(lvm, 1.12.0)
   2
   3 ########################################
   4 #
   5 # Declarations
   6 #
   7
   8 type clvmd_t;
   9 type clvmd_exec_t;
  10 init_daemon_domain(clvmd_t, clvmd_exec_t)
  11
  12 type clvmd_initrc_exec_t;
  13 init_script_file(clvmd_initrc_exec_t)
  14
  15 type clvmd_var_run_t;
  16 files_pid_file(clvmd_var_run_t)
  17
  18 type lvm_t;
  19 type lvm_exec_t;
  20 init_system_domain(lvm_t, lvm_exec_t)
  21 # needs privowner because it assigns the identity system_u to device nodes
  22 # but runs as the identity of the sysadmin
  23 domain_obj_id_change_exemption(lvm_t)
  24 role system_r types lvm_t;
  25
  26 type lvm_etc_t;
  27 files_type(lvm_etc_t)
  28
  29 type lvm_lock_t;
  30 files_lock_file(lvm_lock_t)
  31
  32 type lvm_metadata_t;
  33 files_type(lvm_metadata_t)
  34
  35 type lvm_var_lib_t;
  36 files_type(lvm_var_lib_t)
  37
  38 type lvm_var_run_t;
  39 files_pid_file(lvm_var_run_t)
  40
  41 type lvm_tmp_t;
  42 files_tmp_file(lvm_tmp_t)
  43
  44 ########################################
  45 #
  46 # Cluster LVM daemon local policy
  47 #
  48
  49 allow clvmd_t self:capability { sys_nice chown ipc_lock sys_admin mknod };
  50 dontaudit clvmd_t self:capability sys_tty_config;
  51 allow clvmd_t self:process { signal_perms setsched };
  52 dontaudit clvmd_t self:process ptrace;
  53 allow clvmd_t self:socket create_socket_perms;
  54 allow clvmd_t self:fifo_file rw_fifo_file_perms;
  55 allow clvmd_t self:unix_stream_socket { connectto create_stream_socket_perms };
  56 allow clvmd_t self:tcp_socket create_stream_socket_perms;
  57 allow clvmd_t self:udp_socket create_socket_perms;
  58
  59 manage_files_pattern(clvmd_t, clvmd_var_run_t, clvmd_var_run_t)
  60 files_pid_filetrans(clvmd_t, clvmd_var_run_t, file)
  61
  62 read_files_pattern(clvmd_t, lvm_metadata_t, lvm_metadata_t)
  63
  64 kernel_read_kernel_sysctls(clvmd_t)
  65 kernel_read_system_state(clvmd_t)
  66 kernel_list_proc(clvmd_t)
  67 kernel_read_proc_symlinks(clvmd_t)
  68 kernel_search_debugfs(clvmd_t)
  69 kernel_dontaudit_getattr_core_if(clvmd_t)
  70
  71 corecmd_exec_shell(clvmd_t)
  72 corecmd_getattr_bin_files(clvmd_t)
  73
  74 corenet_all_recvfrom_unlabeled(clvmd_t)
  75 corenet_all_recvfrom_netlabel(clvmd_t)
  76 corenet_tcp_sendrecv_generic_if(clvmd_t)
  77 corenet_udp_sendrecv_generic_if(clvmd_t)
  78 corenet_raw_sendrecv_generic_if(clvmd_t)
  79 corenet_tcp_sendrecv_generic_node(clvmd_t)
  80 corenet_udp_sendrecv_generic_node(clvmd_t)
  81 corenet_raw_sendrecv_generic_node(clvmd_t)
  82 corenet_tcp_sendrecv_all_ports(clvmd_t)
  83 corenet_udp_sendrecv_all_ports(clvmd_t)
  84 corenet_tcp_bind_generic_node(clvmd_t)
  85 corenet_tcp_bind_reserved_port(clvmd_t)
  86 corenet_dontaudit_tcp_bind_all_reserved_ports(clvmd_t)
  87 corenet_sendrecv_generic_server_packets(clvmd_t)
  88
  89 dev_read_sysfs(clvmd_t)
  90 dev_manage_generic_symlinks(clvmd_t)
  91 dev_relabel_generic_dev_dirs(clvmd_t)
  92 dev_manage_generic_blk_files(clvmd_t)
  93 dev_manage_generic_chr_files(clvmd_t)
  94 dev_rw_lvm_control(clvmd_t)
  95 dev_dontaudit_getattr_all_blk_files(clvmd_t)
  96 dev_dontaudit_getattr_all_chr_files(clvmd_t)
  97 dev_create_generic_dirs(clvmd_t)
  98 dev_delete_generic_dirs(clvmd_t)
  99
 100 files_read_etc_files(clvmd_t)
 101 files_list_usr(clvmd_t)
 102
 103 fs_getattr_all_fs(clvmd_t)
 104 fs_search_auto_mountpoints(clvmd_t)
 105 fs_dontaudit_list_tmpfs(clvmd_t)
 106 fs_dontaudit_read_removable_files(clvmd_t)
 107 fs_rw_anon_inodefs_files(clvmd_t)
 108
 109 storage_dontaudit_getattr_removable_dev(clvmd_t)
 110 storage_manage_fixed_disk(clvmd_t)
 111 storage_dev_filetrans_fixed_disk(clvmd_t)
 112 storage_relabel_fixed_disk(clvmd_t)
 113 storage_raw_read_fixed_disk(clvmd_t)
 114
 115 domain_use_interactive_fds(clvmd_t)
 116
 117 auth_use_nsswitch(clvmd_t)
 118
 119 init_dontaudit_getattr_initctl(clvmd_t)
 120
 121 logging_send_syslog_msg(clvmd_t)
 122
 123 miscfiles_read_localization(clvmd_t)
 124
 125 seutil_dontaudit_search_config(clvmd_t)
 126 seutil_sigchld_newrole(clvmd_t)
 127 seutil_read_config(clvmd_t)
 128 seutil_read_file_contexts(clvmd_t)
 129 seutil_search_default_contexts(clvmd_t)
 130
 131 userdom_dontaudit_use_unpriv_user_fds(clvmd_t)
 132 userdom_dontaudit_search_user_home_dirs(clvmd_t)
 133
 134 lvm_domtrans(clvmd_t)
 135 lvm_read_config(clvmd_t)
 136
 137 ifdef(`distro_redhat',`
 138         optional_policy(`
 139                 unconfined_domain(clvmd_t)
 140         ')
 141 ')
 142
 143 optional_policy(`
 144         ccs_stream_connect(clvmd_t)
 145 ')
 146
 147 optional_policy(`
 148         gpm_dontaudit_getattr_gpmctl(clvmd_t)
 149 ')
 150
 151 optional_policy(`
 152         ricci_dontaudit_rw_modcluster_pipes(clvmd_t)
 153         ricci_dontaudit_use_modcluster_fds(clvmd_t)
 154 ')
 155
 156 optional_policy(`
 157         udev_read_db(clvmd_t)
 158 ')
 159
 160 ########################################
 161 #
 162 # LVM Local policy
 163 #
 164
 165 # DAC overrides and mknod for modifying /dev entries (vgmknodes)
 166 # rawio needed for dmraid
 167 # net_admin for multipath
 168 allow lvm_t self:capability { dac_override fowner ipc_lock sys_admin sys_nice mknod chown sys_resource sys_rawio net_admin };
 169 dontaudit lvm_t self:capability sys_tty_config;
 170 allow lvm_t self:process { sigchld sigkill sigstop signull signal };
 171 # LVM will complain a lot if it cannot set its priority.
 172 allow lvm_t self:process setsched;
 173 allow lvm_t self:file rw_file_perms;
 174 allow lvm_t self:fifo_file manage_fifo_file_perms;
 175 allow lvm_t self:unix_dgram_socket create_socket_perms;
 176 allow lvm_t self:netlink_kobject_uevent_socket create_socket_perms;
 177
 178 allow lvm_t self:unix_stream_socket { connectto create_stream_socket_perms };
 179 allow lvm_t clvmd_t:unix_stream_socket { connectto rw_socket_perms };
 180
 181 manage_dirs_pattern(lvm_t, lvm_tmp_t, lvm_tmp_t)
 182 manage_files_pattern(lvm_t, lvm_tmp_t, lvm_tmp_t)
 183 files_tmp_filetrans(lvm_t, lvm_tmp_t, { file dir })
 184
 185 # /lib/lvm-<version> holds the actual LVM binaries (and symlinks)
 186 read_files_pattern(lvm_t, lvm_exec_t, lvm_exec_t)
 187 read_lnk_files_pattern(lvm_t, lvm_exec_t, lvm_exec_t)
 188
 189 # LVM is split into many individual binaries
 190 can_exec(lvm_t, lvm_exec_t)
 191
 192 # Creating lock files
 193 manage_files_pattern(lvm_t, lvm_lock_t, lvm_lock_t)
 194 files_lock_filetrans(lvm_t, lvm_lock_t, file)
 195
 196 manage_dirs_pattern(lvm_t, lvm_var_lib_t, lvm_var_lib_t)
 197 manage_files_pattern(lvm_t, lvm_var_lib_t, lvm_var_lib_t)
 198 files_var_lib_filetrans(lvm_t, lvm_var_lib_t, { dir file })
 199
 200 manage_dirs_pattern(lvm_t, lvm_var_run_t, lvm_var_run_t)
 201 manage_files_pattern(lvm_t, lvm_var_run_t, lvm_var_run_t)
 202 manage_sock_files_pattern(lvm_t, lvm_var_run_t, lvm_var_run_t)
 203 files_pid_filetrans(lvm_t, lvm_var_run_t, { file sock_file })
 204
 205 read_files_pattern(lvm_t, lvm_etc_t, lvm_etc_t)
 206 read_lnk_files_pattern(lvm_t, lvm_etc_t, lvm_etc_t)
 207 # Write to /etc/lvm, /etc/lvmtab, /etc/lvmtab.d
 208 manage_files_pattern(lvm_t, lvm_metadata_t, lvm_metadata_t)
 209 filetrans_pattern(lvm_t, lvm_etc_t, lvm_metadata_t, file)
 210 files_etc_filetrans(lvm_t, lvm_metadata_t, file)
 211 files_search_mnt(lvm_t)
 212
 213 kernel_read_system_state(lvm_t)
 214 # Read system variables in /proc/sys
 215 kernel_read_kernel_sysctls(lvm_t)
 216 # it has no reason to need this
 217 kernel_dontaudit_getattr_core_if(lvm_t)
 218 kernel_use_fds(lvm_t)
 219 kernel_search_debugfs(lvm_t)
 220
 221 corecmd_exec_bin(lvm_t)
 222 corecmd_exec_shell(lvm_t)
 223
 224 dev_create_generic_chr_files(lvm_t)
 225 dev_delete_generic_dirs(lvm_t)
 226 dev_read_rand(lvm_t)
 227 dev_read_urand(lvm_t)
 228 dev_rw_lvm_control(lvm_t)
 229 dev_manage_generic_symlinks(lvm_t)
 230 dev_relabel_generic_dev_dirs(lvm_t)
 231 dev_manage_generic_blk_files(lvm_t)
 232 # Read /sys/block. Device mapper metadata is kept there.
 233 dev_read_sysfs(lvm_t)
 234 # cjp: this has no effect since LVM does not
 235 # have lnk_file relabelto for anything else.
 236 # perhaps this should be blk_files?
 237 dev_relabel_generic_symlinks(lvm_t)
 238 # LVM (vgscan) scans for devices by stating every file in /dev and applying a regex...
 239 dev_dontaudit_read_all_chr_files(lvm_t)
 240 dev_dontaudit_read_all_blk_files(lvm_t)
 241 dev_dontaudit_getattr_generic_chr_files(lvm_t)
 242 dev_dontaudit_getattr_generic_blk_files(lvm_t)
 243 dev_dontaudit_getattr_generic_pipes(lvm_t)
 244 dev_create_generic_dirs(lvm_t)
 245
 246 domain_use_interactive_fds(lvm_t)
 247 domain_read_all_domains_state(lvm_t)
 248
 249 files_read_usr_files(lvm_t)
 250 files_read_etc_files(lvm_t)
 251 files_read_etc_runtime_files(lvm_t)
 252 # for when /usr is not mounted:
 253 files_dontaudit_search_isid_type_dirs(lvm_t)
 254
 255 fs_getattr_xattr_fs(lvm_t)
 256 fs_search_auto_mountpoints(lvm_t)
 257 fs_list_tmpfs(lvm_t)
 258 fs_read_tmpfs_symlinks(lvm_t)
 259 fs_dontaudit_read_removable_files(lvm_t)
 260 fs_dontaudit_getattr_tmpfs_files(lvm_t)
 261 fs_rw_anon_inodefs_files(lvm_t)
 262
 263 mls_file_read_all_levels(lvm_t)
 264 mls_file_write_to_clearance(lvm_t)
 265
 266 selinux_get_fs_mount(lvm_t)
 267 selinux_validate_context(lvm_t)
 268 selinux_compute_access_vector(lvm_t)
 269 selinux_compute_create_context(lvm_t)
 270 selinux_compute_relabel_context(lvm_t)
 271 selinux_compute_user_contexts(lvm_t)
 272
 273 storage_relabel_fixed_disk(lvm_t)
 274 storage_dontaudit_read_removable_device(lvm_t)
 275 # LVM creates block devices in /dev/mapper or /dev/<vg>
 276 # depending on its version
 277 # LVM(2) needs to create directores (/dev/mapper, /dev/<vg>)
 278 # and links from /dev/<vg> to /dev/mapper/<vg>-<lv>
 279 # cjp: need create interface here for fixed disk create
 280 storage_dev_filetrans_fixed_disk(lvm_t)
 281 # Access raw devices and old /dev/lvm (c 109,0).  Is this needed?
 282 storage_manage_fixed_disk(lvm_t)
 283
 284 term_use_all_terms(lvm_t)
 285
 286 init_use_fds(lvm_t)
 287 init_dontaudit_getattr_initctl(lvm_t)
 288 init_use_script_ptys(lvm_t)
 289 init_read_script_state(lvm_t)
 290
 291 logging_send_syslog_msg(lvm_t)
 292
 293 miscfiles_read_localization(lvm_t)
 294
 295 seutil_read_config(lvm_t)
 296 seutil_read_file_contexts(lvm_t)
 297 seutil_search_default_contexts(lvm_t)
 298 seutil_sigchld_newrole(lvm_t)
 299
 300 userdom_use_user_terminals(lvm_t)
 301
 302 ifdef(`distro_redhat',`
 303         # this is from the initrd:
 304         files_rw_isid_type_dirs(lvm_t)
 305
 306         optional_policy(`
 307                 unconfined_domain(lvm_t)
 308         ')
 309 ')
 310
 311 optional_policy(`
 312         bootloader_rw_tmp_files(lvm_t)
 313 ')
 314
 315 optional_policy(`
 316         ccs_stream_connect(lvm_t)
 317 ')
 318
 319 optional_policy(`
 320         gpm_dontaudit_getattr_gpmctl(lvm_t)
 321 ')
 322
 323 optional_policy(`
 324         dbus_system_bus_client(lvm_t)
 325
 326         optional_policy(`
 327                 hal_dbus_chat(lvm_t)
 328         ')
 329 ')
 330
 331 optional_policy(`
 332         modutils_domtrans_insmod(lvm_t)
 333 ')
 334
 335 optional_policy(`
 336         rpm_manage_script_tmp_files(lvm_t)
 337 ')
 338
 339 optional_policy(`
 340         udev_read_db(lvm_t)
 341 ')
 342
 343 optional_policy(`
 344         virt_manage_images(lvm_t)
 345 ')
 346
 347 optional_policy(`
 348         xen_append_log(lvm_t)
 349         xen_dontaudit_rw_unix_stream_sockets(lvm_t)
 350 ')