]> git.ipfire.org Git - people/stevee/selinux-policy.git/blobdiff - policy/modules/services/setroubleshoot.te
projects / people / stevee / selinux-policy.git / blobdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | inline | side by side
Bump module versions for release.
[people/stevee/selinux-policy.git] / policy / modules / services / setroubleshoot.te
diff --git a/policy/modules/services/setroubleshoot.te b/policy/modules/services/setroubleshoot.te
index 709b7a64f8beab59cf4e6b211eb79944d8281859..82e138a20a240a90f5c682ffe4135d4f6da7c41e 100644 (file)
--- a/policy/modules/services/setroubleshoot.te
+++ b/policy/modules/services/setroubleshoot.te
@@ -1,9 +1,9 @@
 
-policy_module(setroubleshoot, 1.8.0)
+policy_module(setroubleshoot, 1.11.0)
 
 ########################################
 #
-# Declarations 
+# Declarations
 #
 
 type setroubleshootd_t alias setroubleshoot_t;
@@ -11,6 +11,10 @@ type setroubleshootd_exec_t;
 domain_type(setroubleshootd_t)
 init_daemon_domain(setroubleshootd_t, setroubleshootd_exec_t)
 
+type setroubleshoot_fixit_t;
+type setroubleshoot_fixit_exec_t;
+dbus_system_domain(setroubleshoot_fixit_t, setroubleshoot_fixit_exec_t)
+
 type setroubleshoot_var_lib_t;
 files_type(setroubleshoot_var_lib_t)
 
@@ -27,8 +31,8 @@ files_pid_file(setroubleshoot_var_run_t)
 # setroubleshootd local policy
 #
 
-allow setroubleshootd_t self:capability { dac_override sys_tty_config };
-allow setroubleshootd_t self:process { signull signal getattr getsched };
+allow setroubleshootd_t self:capability { dac_override sys_nice sys_tty_config };
+allow setroubleshootd_t self:process { getattr getsched setsched sigkill signull signal };
 allow setroubleshootd_t self:fifo_file rw_fifo_file_perms;
 allow setroubleshootd_t self:tcp_socket create_stream_socket_perms;
 allow setroubleshootd_t self:unix_stream_socket { create_stream_socket_perms connectto };
@@ -48,10 +52,11 @@ logging_log_filetrans(setroubleshootd_t, setroubleshoot_var_log_t, { file dir })
 # pid file
 manage_files_pattern(setroubleshootd_t, setroubleshoot_var_run_t, setroubleshoot_var_run_t)
 manage_sock_files_pattern(setroubleshootd_t, setroubleshoot_var_run_t, setroubleshoot_var_run_t)
-files_pid_filetrans(setroubleshootd_t,setroubleshoot_var_run_t, { file sock_file })
+files_pid_filetrans(setroubleshootd_t, setroubleshoot_var_run_t, { file sock_file })
 
 kernel_read_kernel_sysctls(setroubleshootd_t)
 kernel_read_system_state(setroubleshootd_t)
+kernel_read_net_sysctls(setroubleshootd_t)
 kernel_read_network_state(setroubleshootd_t)
 
 corecmd_exec_bin(setroubleshootd_t)
@@ -60,30 +65,40 @@ corecmd_exec_shell(setroubleshootd_t)
 corenet_all_recvfrom_unlabeled(setroubleshootd_t)
 corenet_all_recvfrom_netlabel(setroubleshootd_t)
 corenet_tcp_sendrecv_generic_if(setroubleshootd_t)
-corenet_tcp_sendrecv_all_nodes(setroubleshootd_t)
+corenet_tcp_sendrecv_generic_node(setroubleshootd_t)
 corenet_tcp_sendrecv_all_ports(setroubleshootd_t)
-corenet_tcp_bind_all_nodes(setroubleshootd_t)
+corenet_tcp_bind_generic_node(setroubleshootd_t)
 corenet_tcp_connect_smtp_port(setroubleshootd_t)
 corenet_sendrecv_smtp_client_packets(setroubleshootd_t)
 
 dev_read_urand(setroubleshootd_t)
 dev_read_sysfs(setroubleshootd_t)
+dev_getattr_all_blk_files(setroubleshootd_t)
+dev_getattr_all_chr_files(setroubleshootd_t)
 
 domain_dontaudit_search_all_domains_state(setroubleshootd_t)
+domain_signull_all_domains(setroubleshootd_t)
 
 files_read_usr_files(setroubleshootd_t)
 files_read_etc_files(setroubleshootd_t)
-files_getattr_all_dirs(setroubleshootd_t)
+files_list_all(setroubleshootd_t)
 files_getattr_all_files(setroubleshootd_t)
+files_getattr_all_pipes(setroubleshootd_t)
+files_getattr_all_sockets(setroubleshootd_t)
+files_read_all_symlinks(setroubleshootd_t)
 
 fs_getattr_all_dirs(setroubleshootd_t)
 fs_getattr_all_files(setroubleshootd_t)
+fs_read_fusefs_symlinks(setroubleshootd_t)
+fs_list_inotifyfs(setroubleshootd_t)
+fs_dontaudit_read_nfs_files(setroubleshootd_t)
+fs_dontaudit_read_cifs_files(setroubleshootd_t)
 
 selinux_get_enforce_mode(setroubleshootd_t)
 selinux_validate_context(setroubleshootd_t)
 
-term_dontaudit_use_all_user_ptys(setroubleshootd_t)
-term_dontaudit_use_all_user_ttys(setroubleshootd_t)
+term_dontaudit_use_all_ptys(setroubleshootd_t)
+term_dontaudit_use_all_ttys(setroubleshootd_t)
 
 auth_use_nsswitch(setroubleshootd_t)
 
@@ -94,23 +109,70 @@ miscfiles_read_localization(setroubleshootd_t)
 
 locallogin_dontaudit_use_fds(setroubleshootd_t)
 
+logging_send_audit_msgs(setroubleshootd_t)
 logging_send_syslog_msg(setroubleshootd_t)
 logging_stream_connect_dispatcher(setroubleshootd_t)
 
+modutils_read_module_config(setroubleshootd_t)
+
 seutil_read_config(setroubleshootd_t)
 seutil_read_file_contexts(setroubleshootd_t)
+seutil_read_bin_policy(setroubleshootd_t)
 
-sysnet_read_config(setroubleshootd_t)
-
-sysadm_dontaudit_read_home_content_files(setroubleshootd_t)
+userdom_dontaudit_read_user_home_content_files(setroubleshootd_t)
 
 optional_policy(`
-       dbus_system_bus_client_template(setroubleshootd, setroubleshootd_t)
-       dbus_connect_system_bus(setroubleshootd_t)
+       dbus_system_domain(setroubleshootd_t, setroubleshootd_exec_t)
 ')
 
 optional_policy(`
+       rpm_signull(setroubleshootd_t)
        rpm_read_db(setroubleshootd_t)
        rpm_dontaudit_manage_db(setroubleshootd_t)
-        rpm_use_script_fds(setroubleshootd_t)
+       rpm_use_script_fds(setroubleshootd_t)
+')
+
+########################################
+#
+# setroubleshoot_fixit local policy
+#
+
+allow setroubleshoot_fixit_t self:capability sys_nice;
+allow setroubleshoot_fixit_t self:process { setsched getsched };
+allow setroubleshoot_fixit_t self:fifo_file rw_fifo_file_perms;
+allow setroubleshoot_fixit_t self:unix_dgram_socket create_socket_perms;
+
+allow setroubleshoot_fixit_t setroubleshootd_t:process signull;
+
+setroubleshoot_dbus_chat(setroubleshoot_fixit_t)
+setroubleshoot_stream_connect(setroubleshoot_fixit_t)
+
+kernel_read_system_state(setroubleshoot_fixit_t)
+
+corecmd_exec_bin(setroubleshoot_fixit_t)
+corecmd_exec_shell(setroubleshoot_fixit_t)
+
+seutil_domtrans_setfiles(setroubleshoot_fixit_t)
+
+files_read_usr_files(setroubleshoot_fixit_t)
+files_read_etc_files(setroubleshoot_fixit_t)
+files_list_tmp(setroubleshoot_fixit_t)
+
+auth_use_nsswitch(setroubleshoot_fixit_t)
+
+logging_send_audit_msgs(setroubleshoot_fixit_t)
+logging_send_syslog_msg(setroubleshoot_fixit_t)
+
+miscfiles_read_localization(setroubleshoot_fixit_t)
+
+optional_policy(`
+       rpm_signull(setroubleshoot_fixit_t)
+       rpm_read_db(setroubleshoot_fixit_t)
+       rpm_dontaudit_manage_db(setroubleshoot_fixit_t)
+       rpm_use_script_fds(setroubleshoot_fixit_t)
+')
+
+optional_policy(`
+       policykit_dbus_chat(setroubleshoot_fixit_t)
+       userdom_read_all_users_state(setroubleshoot_fixit_t)
 ')
The IPFire selinux policy.