Bump module versions for release.

[people/stevee/selinux-policy.git] / policy / modules / services / ricci.te

diff --git a/policy/modules/services/ricci.te b/policy/modules/services/ricci.te
index e5f980d0203703d28a659df66f404434c8c7d4b8..0452a678a556466f288e59e2a4104d6f8e41aad0 100644 (file)
--- a/policy/modules/services/ricci.te
+++ b/policy/modules/services/ricci.te
@@ -1,5 +1,5 @@
 
-policy_module(ricci, 1.5.2)
+policy_module(ricci, 1.7.0)
 
 ########################################
 #
@@ -11,19 +11,15 @@ type ricci_exec_t;
 domain_type(ricci_t)
 init_daemon_domain(ricci_t, ricci_exec_t)
 
-# tmp files
 type ricci_tmp_t;
 files_tmp_file(ricci_tmp_t)
 
-# var/lib files
 type ricci_var_lib_t;
 files_type(ricci_var_lib_t)
 
-# log files
 type ricci_var_log_t;
 logging_log_file(ricci_var_log_t)
 
-# pid files
 type ricci_var_run_t;
 files_pid_file(ricci_var_run_t)
 
@@ -33,15 +29,12 @@ domain_type(ricci_modcluster_t)
 domain_entry_file(ricci_modcluster_t, ricci_modcluster_exec_t)
 role system_r types ricci_modcluster_t;
 
-# var/lib files
 type ricci_modcluster_var_lib_t;
 files_type(ricci_modcluster_var_lib_t)
 
-# log files
 type ricci_modcluster_var_log_t;
 logging_log_file(ricci_modcluster_var_log_t)
 
-# pid files
 type ricci_modcluster_var_run_t;
 files_pid_file(ricci_modcluster_var_run_t)
 
@@ -94,24 +87,20 @@ domain_auto_trans(ricci_t, ricci_modrpm_exec_t, ricci_modrpm_t)
 domain_auto_trans(ricci_t, ricci_modservice_exec_t, ricci_modservice_t)
 domain_auto_trans(ricci_t, ricci_modstorage_exec_t, ricci_modstorage_t)
 
-# tmp file
 manage_dirs_pattern(ricci_t, ricci_tmp_t, ricci_tmp_t)
 manage_files_pattern(ricci_t, ricci_tmp_t, ricci_tmp_t)
 files_tmp_filetrans(ricci_t, ricci_tmp_t, { file dir })
 
-# var/lib files for ricci
 manage_dirs_pattern(ricci_t, ricci_var_lib_t, ricci_var_lib_t)
 manage_files_pattern(ricci_t, ricci_var_lib_t, ricci_var_lib_t)
 manage_sock_files_pattern(ricci_t, ricci_var_lib_t, ricci_var_lib_t)
 files_var_lib_filetrans(ricci_t, ricci_var_lib_t, { file dir sock_file })
 
-# log files
 allow ricci_t ricci_var_log_t:dir setattr;
 manage_files_pattern(ricci_t, ricci_var_log_t, ricci_var_log_t)
 manage_sock_files_pattern(ricci_t, ricci_var_log_t, ricci_var_log_t)
 logging_log_filetrans(ricci_t, ricci_var_log_t, { sock_file file dir })
 
-# pid file
 manage_files_pattern(ricci_t, ricci_var_run_t, ricci_var_run_t)
 manage_sock_files_pattern(ricci_t, ricci_var_run_t, ricci_var_run_t)
 files_pid_filetrans(ricci_t, ricci_var_run_t, { file sock_file })
@@ -133,6 +122,8 @@ corenet_tcp_connect_http_port(ricci_t)
 
 dev_read_urand(ricci_t)
 
+domain_read_all_domains_state(ricci_t)
+
 files_read_etc_files(ricci_t)
 files_read_etc_runtime_files(ricci_t)
 files_create_boot_flag(ricci_t)
@@ -140,7 +131,7 @@ files_create_boot_flag(ricci_t)
 auth_domtrans_chk_passwd(ricci_t)
 auth_append_login_records(ricci_t)
 
-init_dontaudit_stream_connect_script(ricci_t)
+init_stream_connect_script(ricci_t)
 
 locallogin_dontaudit_use_fds(ricci_t)
 
@@ -192,7 +183,7 @@ optional_policy(`
 # ricci_modcluster local policy
 #
 
-allow ricci_modcluster_t self:capability sys_nice;
+allow ricci_modcluster_t self:capability { net_bind_service sys_nice };
 allow ricci_modcluster_t self:process setsched;
 allow ricci_modcluster_t self:fifo_file rw_fifo_file_perms;
 
@@ -202,7 +193,10 @@ kernel_read_system_state(ricci_modcluster_t)
 corecmd_exec_shell(ricci_modcluster_t)
 corecmd_exec_bin(ricci_modcluster_t)
 
-domain_dontaudit_read_all_domains_state(ricci_modcluster_t)
+corenet_tcp_bind_cluster_port(ricci_modclusterd_t)
+corenet_tcp_bind_reserved_port(ricci_modclusterd_t)
+
+domain_read_all_domains_state(ricci_modcluster_t)
 
 files_search_locks(ricci_modcluster_t)
 files_read_etc_runtime_files(ricci_modcluster_t)
@@ -220,16 +214,19 @@ modutils_domtrans_insmod(ricci_modcluster_t)
 
 mount_domtrans(ricci_modcluster_t)
 
+consoletype_exec(ricci_modcluster_t)
+
 ricci_stream_connect_modclusterd(ricci_modcluster_t)
 
 optional_policy(`
-       ccs_stream_connect(ricci_modcluster_t)
-       ccs_domtrans(ricci_modcluster_t)
-       ccs_manage_config(ricci_modcluster_t)
+       aisexec_stream_connect(ricci_modcluster_t)
+       corosync_stream_connect(ricci_modcluster_t)
 ')
 
 optional_policy(`
-       consoletype_exec(ricci_modcluster_t)
+       ccs_stream_connect(ricci_modcluster_t)
+       ccs_domtrans(ricci_modcluster_t)
+       ccs_manage_config(ricci_modcluster_t)
 ')
 
 optional_policy(`
@@ -244,6 +241,10 @@ optional_policy(`
        oddjob_system_entry(ricci_modcluster_t, ricci_modcluster_exec_t)
 ')
 
+optional_policy(`
+       rgmanager_stream_connect(ricci_modclusterd_t)
+')
+
 optional_policy(`
        # XXX This has got to go.
        unconfined_domain(ricci_modcluster_t)
@@ -259,19 +260,17 @@ allow ricci_modclusterd_t self:process { signal sigkill setsched };
 allow ricci_modclusterd_t self:fifo_file rw_fifo_file_perms;
 allow ricci_modclusterd_t self:unix_stream_socket create_stream_socket_perms;
 allow ricci_modclusterd_t self:tcp_socket create_stream_socket_perms;
-allow ricci_modclusterd_t self:netlink_route_socket r_netlink_socket_perms;
 # cjp: this needs to be fixed for a specific socket type:
 allow ricci_modclusterd_t self:socket create_socket_perms;
 
 allow ricci_modclusterd_t ricci_modcluster_t:unix_stream_socket connectto;
+allow ricci_modclusterd_t ricci_modcluster_t:fifo_file rw_file_perms;
 
-# log files
 allow ricci_modclusterd_t ricci_modcluster_var_log_t:dir setattr;
 manage_files_pattern(ricci_modclusterd_t, ricci_modcluster_var_log_t, ricci_modcluster_var_log_t)
 manage_sock_files_pattern(ricci_modclusterd_t, ricci_modcluster_var_log_t, ricci_modcluster_var_log_t)
 logging_log_filetrans(ricci_modclusterd_t, ricci_modcluster_var_log_t, { sock_file file dir })
 
-# pid file
 manage_files_pattern(ricci_modclusterd_t, ricci_modcluster_var_run_t, ricci_modcluster_var_run_t)
 manage_sock_files_pattern(ricci_modclusterd_t, ricci_modcluster_var_run_t, ricci_modcluster_var_run_t)
 files_pid_filetrans(ricci_modclusterd_t, ricci_modcluster_var_run_t, { file sock_file })
@@ -287,14 +286,16 @@ corenet_tcp_bind_generic_node(ricci_modclusterd_t)
 corenet_tcp_bind_ricci_modcluster_port(ricci_modclusterd_t)
 corenet_tcp_connect_ricci_modcluster_port(ricci_modclusterd_t)
 
-domain_dontaudit_read_all_domains_state(ricci_modclusterd_t)
+domain_read_all_domains_state(ricci_modclusterd_t)
 
 files_read_etc_files(ricci_modclusterd_t)
 files_read_etc_runtime_files(ricci_modclusterd_t)
 
 fs_getattr_xattr_fs(ricci_modclusterd_t)
 
-init_dontaudit_stream_connect_script(ricci_modclusterd_t)
+auth_use_nsswitch(ricci_modclusterd_t)
+
+init_stream_connect_script(ricci_modclusterd_t)
 
 locallogin_dontaudit_use_fds(ricci_modclusterd_t)
 
@@ -303,7 +304,11 @@ logging_send_syslog_msg(ricci_modclusterd_t)
 miscfiles_read_localization(ricci_modclusterd_t)
 
 sysnet_domtrans_ifconfig(ricci_modclusterd_t)
-sysnet_dns_name_resolve(ricci_modclusterd_t)
+
+optional_policy(`
+       aisexec_stream_connect(ricci_modclusterd_t)
+       corosync_stream_connect(ricci_modclusterd_t)
+')
 
 optional_policy(`
        ccs_domtrans(ricci_modclusterd_t)
@@ -311,6 +316,10 @@ optional_policy(`
        ccs_read_config(ricci_modclusterd_t)
 ')
 
+optional_policy(`
+       rgmanager_stream_connect(ricci_modclusterd_t)
+')
+
 optional_policy(`
        unconfined_use_fds(ricci_modclusterd_t)
 ')
@@ -328,7 +337,7 @@ kernel_read_system_state(ricci_modlog_t)
 
 corecmd_exec_bin(ricci_modlog_t)
 
-domain_dontaudit_read_all_domains_state(ricci_modlog_t)
+domain_read_all_domains_state(ricci_modlog_t)
 
 files_read_etc_files(ricci_modlog_t)
 files_search_usr(ricci_modlog_t)
@@ -432,7 +441,7 @@ dev_read_sysfs(ricci_modstorage_t)
 dev_read_urand(ricci_modstorage_t)
 dev_manage_generic_blk_files(ricci_modstorage_t)
 
-domain_dontaudit_read_all_domains_state(ricci_modstorage_t)
+domain_read_all_domains_state(ricci_modstorage_t)
 
 #Needed for editing /etc/fstab
 files_manage_etc_files(ricci_modstorage_t)
@@ -452,6 +461,15 @@ miscfiles_read_localization(ricci_modstorage_t)
 
 modutils_read_module_deps(ricci_modstorage_t)
 
+consoletype_exec(ricci_modstorage_t)
+
+mount_domtrans(ricci_modstorage_t)
+
+optional_policy(`
+       aisexec_stream_connect(ricci_modstorage_t)
+       corosync_stream_connect(ricci_modstorage_t)
+')
+
 optional_policy(`
        ccs_stream_connect(ricci_modstorage_t)
        ccs_read_config(ricci_modstorage_t)