Bump module versions for release.

[people/stevee/selinux-policy.git] / policy / modules / services / afs.te

diff --git a/policy/modules/services/afs.te b/policy/modules/services/afs.te
index b50cafbb8ada9d478f10918757021e5639c8167e..81af7b529dce42ca90344c227756c1e413d9d669 100644 (file)
--- a/policy/modules/services/afs.te
+++ b/policy/modules/services/afs.te
@@ -1,15 +1,22 @@
 
-policy_module(afs, 1.4.0)
+policy_module(afs, 1.6.0)
 
 ########################################
 #
 # Declarations
 #
 
+type afs_t;
+type afs_exec_t;
+init_daemon_domain(afs_t, afs_exec_t)
+
 type afs_bosserver_t;
 type afs_bosserver_exec_t;
 init_daemon_domain(afs_bosserver_t, afs_bosserver_exec_t)
 
+type afs_cache_t;
+files_type(afs_cache_t)
+
 type afs_config_t;
 files_type(afs_config_t)
 
@@ -26,6 +33,9 @@ domain_type(afs_fsserver_t)
 domain_entry_file(afs_fsserver_t, afs_fsserver_exec_t)
 role system_r types afs_fsserver_t;
 
+type afs_initrc_exec_t;
+init_script_file(afs_initrc_exec_t)
+
 type afs_ka_db_t;
 files_type(afs_ka_db_t)
 
@@ -56,6 +66,47 @@ domain_type(afs_vlserver_t)
 domain_entry_file(afs_vlserver_t, afs_vlserver_exec_t)
 role system_r types afs_vlserver_t;
 
+########################################
+#
+# afs client local policy
+#
+
+allow afs_t self:capability { sys_admin sys_nice sys_tty_config };
+allow afs_t self:process { setsched signal };
+allow afs_t self:udp_socket create_socket_perms;
+allow afs_t self:fifo_file rw_file_perms;
+allow afs_t self:unix_stream_socket create_stream_socket_perms;
+
+manage_files_pattern(afs_t, afs_cache_t, afs_cache_t)
+manage_dirs_pattern(afs_t, afs_cache_t, afs_cache_t)
+files_var_filetrans(afs_t, afs_cache_t, { file dir })
+
+files_mounton_mnt(afs_t)
+files_read_etc_files(afs_t)
+files_read_usr_files(afs_t)
+files_rw_etc_runtime_files(afs_t)
+
+fs_getattr_xattr_fs(afs_t)
+fs_mount_nfs(afs_t)
+
+kernel_rw_afs_state(afs_t)
+
+corenet_all_recvfrom_unlabeled(afs_t)
+corenet_all_recvfrom_netlabel(afs_t)
+corenet_tcp_sendrecv_generic_if(afs_t)
+corenet_udp_sendrecv_generic_if(afs_t)
+corenet_tcp_sendrecv_generic_node(afs_t)
+corenet_udp_sendrecv_generic_node(afs_t)
+corenet_tcp_sendrecv_all_ports(afs_t)
+corenet_udp_sendrecv_all_ports(afs_t)
+corenet_udp_bind_generic_node(afs_t)
+
+logging_send_syslog_msg(afs_t)
+
+miscfiles_read_localization(afs_t)
+
+sysnet_dns_name_resolve(afs_t)
+
 ########################################
 #
 # AFS bossserver local policy
@@ -65,7 +116,7 @@ allow afs_bosserver_t self:process { setsched signal_perms };
 allow afs_bosserver_t self:tcp_socket create_stream_socket_perms;
 allow afs_bosserver_t self:udp_socket create_socket_perms;
 
-can_exec(afs_bosserver_t,afs_bosserver_exec_t)
+can_exec(afs_bosserver_t, afs_bosserver_exec_t)
 
 manage_dirs_pattern(afs_bosserver_t, afs_config_t, afs_config_t)
 manage_files_pattern(afs_bosserver_t, afs_config_t, afs_config_t)
@@ -93,11 +144,11 @@ corenet_all_recvfrom_unlabeled(afs_bosserver_t)
 corenet_all_recvfrom_netlabel(afs_bosserver_t)
 corenet_tcp_sendrecv_generic_if(afs_bosserver_t)
 corenet_udp_sendrecv_generic_if(afs_bosserver_t)
-corenet_tcp_sendrecv_all_nodes(afs_bosserver_t)
-corenet_udp_sendrecv_all_nodes(afs_bosserver_t)
+corenet_tcp_sendrecv_generic_node(afs_bosserver_t)
+corenet_udp_sendrecv_generic_node(afs_bosserver_t)
 corenet_tcp_sendrecv_all_ports(afs_bosserver_t)
 corenet_udp_sendrecv_all_ports(afs_bosserver_t)
-corenet_udp_bind_all_nodes(afs_bosserver_t)
+corenet_udp_bind_generic_node(afs_bosserver_t)
 corenet_udp_bind_afs_bos_port(afs_bosserver_t)
 corenet_sendrecv_afs_bos_server_packets(afs_bosserver_t)
 
@@ -147,14 +198,14 @@ kernel_read_kernel_sysctls(afs_fsserver_t)
 
 corenet_tcp_sendrecv_generic_if(afs_fsserver_t)
 corenet_udp_sendrecv_generic_if(afs_fsserver_t)
-corenet_tcp_sendrecv_all_nodes(afs_fsserver_t)
-corenet_udp_sendrecv_all_nodes(afs_fsserver_t)
+corenet_tcp_sendrecv_generic_node(afs_fsserver_t)
+corenet_udp_sendrecv_generic_node(afs_fsserver_t)
 corenet_tcp_sendrecv_all_ports(afs_fsserver_t)
 corenet_udp_sendrecv_all_ports(afs_fsserver_t)
 corenet_all_recvfrom_unlabeled(afs_fsserver_t)
 corenet_all_recvfrom_netlabel(afs_fsserver_t)
-corenet_tcp_bind_all_nodes(afs_fsserver_t)
-corenet_udp_bind_all_nodes(afs_fsserver_t)
+corenet_tcp_bind_generic_node(afs_fsserver_t)
+corenet_udp_bind_generic_node(afs_fsserver_t)
 corenet_tcp_bind_afs_fs_port(afs_fsserver_t)
 corenet_udp_bind_afs_fs_port(afs_fsserver_t)
 corenet_sendrecv_afs_fs_server_packets(afs_fsserver_t)
@@ -205,11 +256,11 @@ corenet_all_recvfrom_unlabeled(afs_kaserver_t)
 corenet_all_recvfrom_netlabel(afs_kaserver_t)
 corenet_tcp_sendrecv_generic_if(afs_kaserver_t)
 corenet_udp_sendrecv_generic_if(afs_kaserver_t)
-corenet_tcp_sendrecv_all_nodes(afs_kaserver_t)
-corenet_udp_sendrecv_all_nodes(afs_kaserver_t)
+corenet_tcp_sendrecv_generic_node(afs_kaserver_t)
+corenet_udp_sendrecv_generic_node(afs_kaserver_t)
 corenet_tcp_sendrecv_all_ports(afs_kaserver_t)
 corenet_udp_sendrecv_all_ports(afs_kaserver_t)
-corenet_udp_bind_all_nodes(afs_kaserver_t)
+corenet_udp_bind_generic_node(afs_kaserver_t)
 corenet_udp_bind_afs_ka_port(afs_kaserver_t)
 corenet_udp_bind_kerberos_port(afs_kaserver_t)
 corenet_sendrecv_afs_ka_server_packets(afs_kaserver_t)
@@ -236,7 +287,7 @@ allow afs_ptserver_t self:unix_stream_socket create_stream_socket_perms;
 allow afs_ptserver_t self:tcp_socket create_stream_socket_perms;
 allow afs_ptserver_t self:udp_socket create_socket_perms;
 
-read_files_pattern(afs_ptserver_t,afs_config_t,afs_config_t)
+read_files_pattern(afs_ptserver_t, afs_config_t, afs_config_t)
 allow afs_ptserver_t afs_config_t:dir list_dir_perms;
 
 manage_dirs_pattern(afs_ptserver_t, afs_logfile_t, afs_logfile_t)
@@ -249,11 +300,11 @@ corenet_all_recvfrom_unlabeled(afs_ptserver_t)
 corenet_all_recvfrom_netlabel(afs_ptserver_t)
 corenet_tcp_sendrecv_generic_if(afs_ptserver_t)
 corenet_udp_sendrecv_generic_if(afs_ptserver_t)
-corenet_tcp_sendrecv_all_nodes(afs_ptserver_t)
-corenet_udp_sendrecv_all_nodes(afs_ptserver_t)
+corenet_tcp_sendrecv_generic_node(afs_ptserver_t)
+corenet_udp_sendrecv_generic_node(afs_ptserver_t)
 corenet_tcp_sendrecv_all_ports(afs_ptserver_t)
 corenet_udp_sendrecv_all_ports(afs_ptserver_t)
-corenet_udp_bind_all_nodes(afs_ptserver_t)
+corenet_udp_bind_generic_node(afs_ptserver_t)
 corenet_udp_bind_afs_pt_port(afs_ptserver_t)
 corenet_sendrecv_afs_pt_server_packets(afs_ptserver_t)
 
@@ -274,24 +325,24 @@ allow afs_vlserver_t self:unix_stream_socket create_stream_socket_perms;
 allow afs_vlserver_t self:tcp_socket create_stream_socket_perms;
 allow afs_vlserver_t self:udp_socket create_socket_perms;
 
-read_files_pattern(afs_vlserver_t,afs_config_t,afs_config_t)
+read_files_pattern(afs_vlserver_t, afs_config_t, afs_config_t)
 allow afs_vlserver_t afs_config_t:dir list_dir_perms;
 
 manage_dirs_pattern(afs_vlserver_t, afs_logfile_t, afs_logfile_t)
 manage_files_pattern(afs_vlserver_t, afs_logfile_t, afs_logfile_t)
 
 manage_files_pattern(afs_vlserver_t, afs_dbdir_t, afs_vl_db_t)
-filetrans_pattern(afs_vlserver_t, afs_dbdir_t,afs_vl_db_t, file)
+filetrans_pattern(afs_vlserver_t, afs_dbdir_t, afs_vl_db_t, file)
 
 corenet_all_recvfrom_unlabeled(afs_vlserver_t)
 corenet_all_recvfrom_netlabel(afs_vlserver_t)
 corenet_tcp_sendrecv_generic_if(afs_vlserver_t)
 corenet_udp_sendrecv_generic_if(afs_vlserver_t)
-corenet_tcp_sendrecv_all_nodes(afs_vlserver_t)
-corenet_udp_sendrecv_all_nodes(afs_vlserver_t)
+corenet_tcp_sendrecv_generic_node(afs_vlserver_t)
+corenet_udp_sendrecv_generic_node(afs_vlserver_t)
 corenet_tcp_sendrecv_all_ports(afs_vlserver_t)
 corenet_udp_sendrecv_all_ports(afs_vlserver_t)
-corenet_udp_bind_all_nodes(afs_vlserver_t)
+corenet_udp_bind_generic_node(afs_vlserver_t)
 corenet_udp_bind_afs_vl_port(afs_vlserver_t)
 corenet_sendrecv_afs_vl_server_packets(afs_vlserver_t)