]> git.ipfire.org Git - people/stevee/selinux-policy.git/blobdiff - policy/modules/services/setroubleshoot.te
projects / people / stevee / selinux-policy.git / blobdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | inline | side by side
Bump module versions for release.
[people/stevee/selinux-policy.git] / policy / modules / services / setroubleshoot.te
diff --git a/policy/modules/services/setroubleshoot.te b/policy/modules/services/setroubleshoot.te
index d49664bc4dff284a9feb76277e91638ded1aa28c..82e138a20a240a90f5c682ffe4135d4f6da7c41e 100644 (file)
--- a/policy/modules/services/setroubleshoot.te
+++ b/policy/modules/services/setroubleshoot.te
@@ -1,9 +1,9 @@
 
-policy_module(setroubleshoot,1.1.1)
+policy_module(setroubleshoot, 1.11.0)
 
 ########################################
 #
-# Declarations 
+# Declarations
 #
 
 type setroubleshootd_t alias setroubleshoot_t;
@@ -11,6 +11,10 @@ type setroubleshootd_exec_t;
 domain_type(setroubleshootd_t)
 init_daemon_domain(setroubleshootd_t, setroubleshootd_exec_t)
 
+type setroubleshoot_fixit_t;
+type setroubleshoot_fixit_exec_t;
+dbus_system_domain(setroubleshoot_fixit_t, setroubleshoot_fixit_exec_t)
+
 type setroubleshoot_var_lib_t;
 files_type(setroubleshoot_var_lib_t)
 
@@ -27,89 +31,148 @@ files_pid_file(setroubleshoot_var_run_t)
 # setroubleshootd local policy
 #
 
-allow setroubleshootd_t self:capability { dac_override sys_tty_config };
-allow setroubleshootd_t self:process { signal getattr getsched };
+allow setroubleshootd_t self:capability { dac_override sys_nice sys_tty_config };
+allow setroubleshootd_t self:process { getattr getsched setsched sigkill signull signal };
 allow setroubleshootd_t self:fifo_file rw_fifo_file_perms;
 allow setroubleshootd_t self:tcp_socket create_stream_socket_perms;
 allow setroubleshootd_t self:unix_stream_socket { create_stream_socket_perms connectto };
 allow setroubleshootd_t self:unix_dgram_socket create_socket_perms;
-allow setroubleshootd_t self:netlink_route_socket r_netlink_socket_perms;
 
 # database files
 allow setroubleshootd_t setroubleshoot_var_lib_t:dir setattr;
-manage_files_pattern(setroubleshootd_t,setroubleshoot_var_lib_t,setroubleshoot_var_lib_t)
-files_var_lib_filetrans(setroubleshootd_t,setroubleshoot_var_lib_t,{ file dir })
+manage_files_pattern(setroubleshootd_t, setroubleshoot_var_lib_t, setroubleshoot_var_lib_t)
+files_var_lib_filetrans(setroubleshootd_t, setroubleshoot_var_lib_t, { file dir })
 
 # log files
 allow setroubleshootd_t setroubleshoot_var_log_t:dir setattr;
-manage_files_pattern(setroubleshootd_t,setroubleshoot_var_log_t,setroubleshoot_var_log_t)
-manage_sock_files_pattern(setroubleshootd_t,setroubleshoot_var_log_t,setroubleshoot_var_log_t)
-logging_log_filetrans(setroubleshootd_t,setroubleshoot_var_log_t,{ file dir })
+manage_files_pattern(setroubleshootd_t, setroubleshoot_var_log_t, setroubleshoot_var_log_t)
+manage_sock_files_pattern(setroubleshootd_t, setroubleshoot_var_log_t, setroubleshoot_var_log_t)
+logging_log_filetrans(setroubleshootd_t, setroubleshoot_var_log_t, { file dir })
 
 # pid file
-manage_files_pattern(setroubleshootd_t,setroubleshoot_var_run_t,setroubleshoot_var_run_t)
-manage_sock_files_pattern(setroubleshootd_t,setroubleshoot_var_run_t,setroubleshoot_var_run_t)
-files_pid_filetrans(setroubleshootd_t,setroubleshoot_var_run_t, { file sock_file })
+manage_files_pattern(setroubleshootd_t, setroubleshoot_var_run_t, setroubleshoot_var_run_t)
+manage_sock_files_pattern(setroubleshootd_t, setroubleshoot_var_run_t, setroubleshoot_var_run_t)
+files_pid_filetrans(setroubleshootd_t, setroubleshoot_var_run_t, { file sock_file })
 
 kernel_read_kernel_sysctls(setroubleshootd_t)
 kernel_read_system_state(setroubleshootd_t)
+kernel_read_net_sysctls(setroubleshootd_t)
+kernel_read_network_state(setroubleshootd_t)
 
-corecmd_exec_sbin(setroubleshootd_t)
 corecmd_exec_bin(setroubleshootd_t)
 corecmd_exec_shell(setroubleshootd_t)
 
-corenet_non_ipsec_sendrecv(setroubleshootd_t)
+corenet_all_recvfrom_unlabeled(setroubleshootd_t)
+corenet_all_recvfrom_netlabel(setroubleshootd_t)
 corenet_tcp_sendrecv_generic_if(setroubleshootd_t)
-corenet_tcp_sendrecv_all_nodes(setroubleshootd_t)
+corenet_tcp_sendrecv_generic_node(setroubleshootd_t)
 corenet_tcp_sendrecv_all_ports(setroubleshootd_t)
-corenet_tcp_bind_all_nodes(setroubleshootd_t)
+corenet_tcp_bind_generic_node(setroubleshootd_t)
 corenet_tcp_connect_smtp_port(setroubleshootd_t)
 corenet_sendrecv_smtp_client_packets(setroubleshootd_t)
 
 dev_read_urand(setroubleshootd_t)
+dev_read_sysfs(setroubleshootd_t)
+dev_getattr_all_blk_files(setroubleshootd_t)
+dev_getattr_all_chr_files(setroubleshootd_t)
 
 domain_dontaudit_search_all_domains_state(setroubleshootd_t)
+domain_signull_all_domains(setroubleshootd_t)
 
 files_read_usr_files(setroubleshootd_t)
 files_read_etc_files(setroubleshootd_t)
-files_getattr_all_dirs(setroubleshootd_t)
+files_list_all(setroubleshootd_t)
+files_getattr_all_files(setroubleshootd_t)
+files_getattr_all_pipes(setroubleshootd_t)
+files_getattr_all_sockets(setroubleshootd_t)
+files_read_all_symlinks(setroubleshootd_t)
+
+fs_getattr_all_dirs(setroubleshootd_t)
+fs_getattr_all_files(setroubleshootd_t)
+fs_read_fusefs_symlinks(setroubleshootd_t)
+fs_list_inotifyfs(setroubleshootd_t)
+fs_dontaudit_read_nfs_files(setroubleshootd_t)
+fs_dontaudit_read_cifs_files(setroubleshootd_t)
 
 selinux_get_enforce_mode(setroubleshootd_t)
+selinux_validate_context(setroubleshootd_t)
+
+term_dontaudit_use_all_ptys(setroubleshootd_t)
+term_dontaudit_use_all_ttys(setroubleshootd_t)
 
-term_dontaudit_use_console(setroubleshootd_t)
-term_dontaudit_use_all_user_ptys(setroubleshootd_t)
-term_dontaudit_use_all_user_ttys(setroubleshootd_t)
+auth_use_nsswitch(setroubleshootd_t)
 
 init_read_utmp(setroubleshootd_t)
 init_dontaudit_write_utmp(setroubleshootd_t)
-init_use_fds(setroubleshootd_t)
-init_use_script_ptys(setroubleshootd_t)
-
-libs_use_ld_so(setroubleshootd_t)
-libs_use_shared_libs(setroubleshootd_t)
 
 miscfiles_read_localization(setroubleshootd_t)
 
 locallogin_dontaudit_use_fds(setroubleshootd_t)
 
+logging_send_audit_msgs(setroubleshootd_t)
 logging_send_syslog_msg(setroubleshootd_t)
-logging_stream_connect_auditd(setroubleshootd_t)
+logging_stream_connect_dispatcher(setroubleshootd_t)
+
+modutils_read_module_config(setroubleshootd_t)
 
 seutil_read_config(setroubleshootd_t)
+seutil_read_file_contexts(setroubleshootd_t)
+seutil_read_bin_policy(setroubleshootd_t)
 
-sysnet_read_config(setroubleshootd_t)
+userdom_dontaudit_read_user_home_content_files(setroubleshootd_t)
 
-ifdef(`targeted_policy',`
-       term_dontaudit_use_generic_ptys(setroubleshootd_t)
-       term_dontaudit_use_unallocated_ttys(setroubleshootd_t)
+optional_policy(`
+       dbus_system_domain(setroubleshootd_t, setroubleshootd_exec_t)
 ')
 
 optional_policy(`
+       rpm_signull(setroubleshootd_t)
        rpm_read_db(setroubleshootd_t)
        rpm_dontaudit_manage_db(setroubleshootd_t)
-        rpm_use_script_fds(setroubleshootd_t)
+       rpm_use_script_fds(setroubleshootd_t)
+')
+
+########################################
+#
+# setroubleshoot_fixit local policy
+#
+
+allow setroubleshoot_fixit_t self:capability sys_nice;
+allow setroubleshoot_fixit_t self:process { setsched getsched };
+allow setroubleshoot_fixit_t self:fifo_file rw_fifo_file_perms;
+allow setroubleshoot_fixit_t self:unix_dgram_socket create_socket_perms;
+
+allow setroubleshoot_fixit_t setroubleshootd_t:process signull;
+
+setroubleshoot_dbus_chat(setroubleshoot_fixit_t)
+setroubleshoot_stream_connect(setroubleshoot_fixit_t)
+
+kernel_read_system_state(setroubleshoot_fixit_t)
+
+corecmd_exec_bin(setroubleshoot_fixit_t)
+corecmd_exec_shell(setroubleshoot_fixit_t)
+
+seutil_domtrans_setfiles(setroubleshoot_fixit_t)
+
+files_read_usr_files(setroubleshoot_fixit_t)
+files_read_etc_files(setroubleshoot_fixit_t)
+files_list_tmp(setroubleshoot_fixit_t)
+
+auth_use_nsswitch(setroubleshoot_fixit_t)
+
+logging_send_audit_msgs(setroubleshoot_fixit_t)
+logging_send_syslog_msg(setroubleshoot_fixit_t)
+
+miscfiles_read_localization(setroubleshoot_fixit_t)
+
+optional_policy(`
+       rpm_signull(setroubleshoot_fixit_t)
+       rpm_read_db(setroubleshoot_fixit_t)
+       rpm_dontaudit_manage_db(setroubleshoot_fixit_t)
+       rpm_use_script_fds(setroubleshoot_fixit_t)
 ')
 
 optional_policy(`
-       nis_use_ypbind(setroubleshootd_t)
+       policykit_dbus_chat(setroubleshoot_fixit_t)
+       userdom_read_all_users_state(setroubleshoot_fixit_t)
 ')
The IPFire selinux policy.