--- /dev/null
+policy_module(nova, 1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+#
+# nova-stack daemons contain security issue with using sudo in the code
+# we make this policy as unconfined until this issue is fixed
+#
+
+attribute nova_domain;
+
+nova_domain_template(ajax)
+nova_domain_template(api)
+nova_domain_template(compute)
+nova_domain_template(direct)
+nova_domain_template(network)
+nova_domain_template(objectstore)
+nova_domain_template(scheduler)
+nova_domain_template(vncproxy)
+nova_domain_template(volume)
+
+type nova_log_t;
+logging_log_file(nova_log_t)
+
+type nova_var_lib_t;
+files_type(nova_var_lib_t)
+
+type nova_var_run_t;
+files_pid_file(nova_var_run_t)
+
+
+######################################
+#
+# nova general domain local policy
+#
+
+allow nova_domain self:fifo_file rw_fifo_file_perms;
+allow nova_domain self:tcp_socket create_stream_socket_perms;
+allow nova_domain self:unix_stream_socket create_stream_socket_perms;
+
+manage_dirs_pattern(nova_domain, nova_log_t, nova_log_t)
+manage_files_pattern(nova_domain, nova_log_t, nova_log_t)
+
+manage_dirs_pattern(nova_domain, nova_var_lib_t, nova_var_lib_t)
+manage_files_pattern(nova_domain, nova_var_lib_t, nova_var_lib_t)
+
+manage_dirs_pattern(nova_domain, nova_var_run_t, nova_var_run_t)
+manage_files_pattern(nova_domain, nova_var_run_t, nova_var_run_t)
+
+kernel_read_system_state(nova_domain)
+
+corenet_tcp_connect_amqp_port(nova_domain)
+
+corecmd_exec_bin(nova_domain)
+corecmd_exec_shell(nova_domain)
+
+dev_read_urand(nova_domain)
+
+fs_getattr_xattr_fs(nova_domain)
+
+files_read_usr_files(nova_domain)
+
+libs_exec_ldconfig(nova_domain)
+
+files_read_etc_files(nova_domain)
+
+miscfiles_read_localization(nova_domain)
+
+optional_policy(`
+ sysnet_read_config(nova_domain)
+')
+
+######################################
+#
+# nova ajax local policy
+#
+
+optional_policy(`
+ unconfined_domain(nova_ajax_t)
+')
+
+#######################################
+#
+# nova api local policy
+#
+
+allow nova_api_t self:process setfscreate;
+
+allow nova_api_t self:netlink_route_socket r_netlink_socket_perms;
+
+allow nova_api_t self:udp_socket create_socket_perms;
+
+kernel_read_kernel_sysctls(nova_api_t)
+
+corenet_tcp_bind_generic_node(nova_api_t)
+corenet_udp_bind_generic_node(nova_api_t)
+# should be add to booleans
+corenet_tcp_connect_all_ports(nova_api_t)
+corenet_tcp_bind_all_unreserved_ports(nova_api_t)
+
+logging_send_syslog_msg(nova_api_t)
+
+miscfiles_read_certs(nova_api_t)
+
+ifdef(`hide_broken_symptoms',`
+ optional_policy(`
+ sudo_exec(nova_api_t)
+ allow nova_api_t self:capability { setuid sys_resource setgid };
+ allow nova_api_t self:process { setsched setrlimit };
+ logging_send_audit_msgs(nova_api_t)
+ ')
+')
+
+optional_policy(`
+ iptables_domtrans(nova_api_t)
+')
+
+optional_policy(`
+ ssh_exec_keygen(nova_api_t)
+')
+
+optional_policy(`
+ unconfined_domain(nova_api_t)
+')
+
+#######################################
+#
+# nova compute local policy
+#
+
+# needs to be re-write since now runs as virtd_t
+
+allow nova_compute_t self:udp_socket create_socket_perms;
+
+kernel_read_network_state(nova_compute_t)
+
+dev_read_rand(nova_compute_t)
+
+dev_read_sysfs(nova_compute_t)
+
+optional_policy(`
+ virt_getattr_exec(nova_compute_t)
+ virt_stream_connect(nova_compute_t)
+')
+
+
+#######################################
+#
+# nova direct local policy
+#
+
+optional_policy(`
+ unconfined_domain(nova_direct_t)
+')
+
+#######################################
+#
+# nova network local policy
+#
+
+allow nova_network_t self:capability { dac_override net_admin net_bind_service };
+allow nova_network_t self:process { getcap setcap };
+
+allow nova_network_t self:netlink_route_socket r_netlink_socket_perms;
+allow nova_network_t self:udp_socket create_socket_perms;
+
+kernel_read_network_state(nova_network_t)
+kernel_read_kernel_sysctls(nova_network_t)
+
+# should be added to boolean or fixed in the code
+# dnsmasq domtrans does not work since then dnsmasq_t wants
+# to do some stuff with nova_lib, nova_tmp
+# nova-dhcpbridge runs in dnsmasq domain
+corenet_all_recvfrom_unlabeled(nova_network_t)
+corenet_all_recvfrom_netlabel(nova_network_t)
+corenet_tcp_sendrecv_generic_if(nova_network_t)
+corenet_udp_sendrecv_generic_if(nova_network_t)
+corenet_raw_sendrecv_generic_if(nova_network_t)
+corenet_tcp_sendrecv_generic_node(nova_network_t)
+corenet_udp_sendrecv_generic_node(nova_network_t)
+corenet_raw_sendrecv_generic_node(nova_network_t)
+corenet_tcp_sendrecv_all_ports(nova_network_t)
+corenet_udp_sendrecv_all_ports(nova_network_t)
+corenet_tcp_bind_generic_node(nova_network_t)
+corenet_udp_bind_generic_node(nova_network_t)
+corenet_tcp_bind_dns_port(nova_network_t)
+corenet_udp_bind_all_ports(nova_network_t)
+corenet_sendrecv_dns_server_packets(nova_network_t)
+corenet_sendrecv_dhcpd_server_packets(nova_network_t)
+
+libs_exec_ldconfig(nova_network_t)
+
+logging_send_syslog_msg(nova_network_t)
+
+ifdef(`hide_broken_symptoms',`
+ optional_policy(`
+ sudo_exec(nova_network_t)
+ allow nova_network_t self:capability { setuid sys_resource setgid };
+ allow nova_network_t self:process { setsched setrlimit };
+ logging_send_audit_msgs(nova_network_t)
+ ')
+')
+
+optional_policy(`
+ brctl_domtrans(nova_network_t)
+')
+
+optional_policy(`
+ dnsmasq_exec(nova_network_t)
+# dnsmasq_domtrans(nova_network_t)
+')
+
+optional_policy(`
+ iptables_domtrans(nova_network_t)
+')
+
+optional_policy(`
+ sysnet_domtrans_ifconfig(nova_network_t)
+')
+
+optional_policy(`
+ unconfined_domain(nova_network_t)
+')
+
+#######################################
+#
+# nova object store local policy
+#
+
+allow nova_objectstore_t self:udp_socket create_socket_perms;
+
+corenet_tcp_bind_generic_node(nova_objectstore_t)
+corenet_udp_bind_generic_node(nova_objectstore_t)
+
+optional_policy(`
+ unconfined_domain(nova_objectstore_t)
+')
+
+#######################################
+#
+# nova scheduler local policy
+#
+
+allow nova_scheduler_t self:netlink_route_socket r_netlink_socket_perms;
+allow nova_scheduler_t self:udp_socket create_socket_perms;
+
+optional_policy(`
+ unconfined_domain(nova_scheduler_t)
+')
+
+#######################################
+#
+# nova vncproxy local policy
+#
+
+optional_policy(`
+ unconfined_domain(nova_vncproxy_t)
+')
+
+#######################################
+#
+# nova volume local policy
+#
+
+allow nova_volume_t self:netlink_route_socket r_netlink_socket_perms;
+
+allow nova_volume_t self:udp_socket create_socket_perms;
+
+kernel_read_kernel_sysctls(nova_volume_t)
+
+logging_send_syslog_msg(nova_volume_t)
+
+optional_policy(`
+ lvm_domtrans(nova_volume_t)
+')
+
+ifdef(`hide_broken_symptoms',`
+ require {
+ type sudo_exec_t;
+ }
+
+ allow nova_volume_t sudo_exec_t:file { read execute open execute_no_trans };
+
+ allow nova_volume_t self:capability { setuid sys_resource setgid audit_write };
+ allow nova_volume_t self:process { setsched setrlimit };
+
+ logging_send_audit_msgs(nova_volume_t)
+
+')
+
+optional_policy(`
+ unconfined_domain(nova_volume_t)
+')
+
--- /dev/null
+policy_module(rabbitmq, 1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type rabbitmq_epmd_t;
+type rabbitmq_epmd_exec_t;
+init_daemon_domain(rabbitmq_epmd_t, rabbitmq_epmd_exec_t)
+
+type rabbitmq_beam_t;
+type rabbitmq_beam_exec_t;
+init_daemon_domain(rabbitmq_beam_t, rabbitmq_beam_exec_t)
+
+type rabbitmq_var_lib_t;
+files_type(rabbitmq_var_lib_t)
+
+type rabbitmq_var_log_t;
+logging_log_file(rabbitmq_var_log_t)
+
+permissive rabbitmq_epmd_t;
+permissive rabbitmq_beam_t;
+
+######################################
+#
+# beam local policy
+#
+
+allow rabbitmq_beam_t self:process { setsched signal signull };
+
+allow rabbitmq_beam_t self:fifo_file rw_fifo_file_perms;
+allow rabbitmq_beam_t self:tcp_socket { accept listen };
+
+manage_dirs_pattern(rabbitmq_beam_t, rabbitmq_var_lib_t, rabbitmq_var_lib_t)
+manage_files_pattern(rabbitmq_beam_t, rabbitmq_var_lib_t, rabbitmq_var_lib_t)
+
+manage_dirs_pattern(rabbitmq_beam_t, rabbitmq_var_log_t, rabbitmq_var_log_t)
+manage_files_pattern(rabbitmq_beam_t, rabbitmq_var_log_t, rabbitmq_var_log_t)
+
+can_exec(rabbitmq_beam_t, rabbitmq_beam_exec_t)
+
+kernel_read_system_state(rabbitmq_beam_t)
+
+corecmd_exec_bin(rabbitmq_beam_t)
+corecmd_exec_shell(rabbitmq_beam_t)
+
+corenet_tcp_bind_generic_node(rabbitmq_beam_t)
+corenet_udp_bind_generic_node(rabbitmq_beam_t)
+corenet_tcp_connect_all_ephemeral_ports(rabbitmq_beam_t)
+corenet_tcp_bind_amqp_port(rabbitmq_beam_t)
+corenet_tcp_connect_epmd_port(rabbitmq_beam_t)
+
+dev_read_sysfs(rabbitmq_beam_t)
+
+files_read_etc_files(rabbitmq_beam_t)
+
+miscfiles_read_localization(rabbitmq_beam_t)
+
+optional_policy(`
+ sysnet_dns_name_resolve(rabbitmq_beam_t)
+')
+
+########################################
+#
+# epmd local policy
+#
+
+domtrans_pattern(rabbitmq_beam_t, rabbitmq_epmd_exec_t, rabbitmq_epmd_t)
+
+allow rabbitmq_epmd_t self:process { signal };
+
+allow rabbitmq_epmd_t self:fifo_file rw_fifo_file_perms;
+allow rabbitmq_epmd_t self:tcp_socket create_stream_socket_perms;
+allow rabbitmq_epmd_t self:unix_stream_socket create_stream_socket_perms;
+
+# should be append
+allow rabbitmq_epmd_t rabbitmq_var_log_t:file write_file_perms;
+
+corenet_tcp_bind_generic_node(rabbitmq_epmd_t)
+corenet_udp_bind_generic_node(rabbitmq_epmd_t)
+corenet_tcp_bind_epmd_port(rabbitmq_epmd_t)
+
+files_read_etc_files(rabbitmq_epmd_t)
+
+logging_send_syslog_msg(rabbitmq_epmd_t)
+
+miscfiles_read_localization(rabbitmq_epmd_t)
+
projects / people / stevee / selinux-policy.git / commitdiff
