clogd policy from Dan Walsh

edits:
 - style and whitespace fixes
 - removed read_lnk_files_pattern from shm interface
 - removed permissive line

diff --git a/policy/modules/services/clogd.fc b/policy/modules/services/clogd.fc
new file mode 100644 (file)
index 0000000..6793948
--- /dev/null
+++ b/policy/modules/services/clogd.fc
@@ -0,0 +1,3 @@
+/usr/sbin/clogd                        --      gen_context(system_u:object_r:clogd_exec_t,s0)
+
+/var/run/clogd\.pid            --      gen_context(system_u:object_r:clogd_var_run_t,s0)

diff --git a/policy/modules/services/clogd.if b/policy/modules/services/clogd.if
new file mode 100644 (file)
index 0000000..c0a66a4
--- /dev/null
+++ b/policy/modules/services/clogd.if
@@ -0,0 +1,79 @@
+## <summary>clogd - Clustered Mirror Log Server</summary>
+
+######################################
+## <summary>
+##     Execute a domain transition to run clogd.
+## </summary>
+## <param name="domain">
+## <summary>
+##     Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`clogd_domtrans',`
+       gen_require(`
+               type clogd_t, clogd_exec_t;
+       ')
+
+       corecmd_search_bin($1)
+       domtrans_pattern($1, clogd_exec_t, clogd_t)
+')
+
+#####################################
+## <summary>
+##     Connect to clogd over a unix domain
+##     stream socket.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`clogd_stream_connect',`
+       gen_require(`
+               type clogd_t, clogd_var_run_t;
+       ')
+
+       files_search_pids($1)
+       stream_connect_pattern($1, clogd_var_run_t, clogd_var_run_t, clogd_t)
+')
+
+#####################################
+## <summary>
+##     Allow read and write access to clogd semaphores.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`clogd_rw_semaphores',`
+       gen_require(`
+               type clogd_t;
+       ')
+
+       allow $1 clogd_t:sem rw_sem_perms;
+')
+
+########################################
+## <summary>
+##     Read and write to group shared memory.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`clogd_rw_shm',`
+       gen_require(`
+               type clogd_t, clogd_tmpfs_t;
+       ')
+
+       allow $1 clogd_t:shm rw_shm_perms;
+       allow $1 clogd_tmpfs_t:dir list_dir_perms;
+       rw_files_pattern($1, clogd_tmpfs_t, clogd_tmpfs_t)
+       fs_search_tmpfs($1)
+')

diff --git a/policy/modules/services/clogd.te b/policy/modules/services/clogd.te
new file mode 100644 (file)
index 0000000..892d0c1
--- /dev/null
+++ b/policy/modules/services/clogd.te
@@ -0,0 +1,61 @@
+
+policy_module(clogd,1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type clogd_t;
+type clogd_exec_t;
+init_daemon_domain(clogd_t, clogd_exec_t)
+
+type clogd_tmpfs_t;
+files_tmpfs_file(clogd_tmpfs_t)
+
+# pid files
+type clogd_var_run_t;
+files_pid_file(clogd_var_run_t)
+
+########################################
+#
+# clogd local policy
+#
+
+allow clogd_t self:capability { net_admin mknod };
+allow clogd_t self:process signal;
+
+allow clogd_t self:sem create_sem_perms;
+allow clogd_t self:shm create_shm_perms;
+allow clogd_t self:netlink_socket create_socket_perms;
+allow clogd_t self:unix_dgram_socket create_socket_perms;
+
+manage_dirs_pattern(clogd_t, clogd_tmpfs_t, clogd_tmpfs_t)
+manage_files_pattern(clogd_t, clogd_tmpfs_t, clogd_tmpfs_t)
+fs_tmpfs_filetrans(clogd_t, clogd_tmpfs_t,{ dir file })
+
+# pid files
+manage_files_pattern(clogd_t, clogd_var_run_t, clogd_var_run_t)
+manage_sock_files_pattern(clogd_t, clogd_var_run_t, clogd_var_run_t)
+files_pid_filetrans(clogd_t, clogd_var_run_t, { file })
+
+dev_manage_generic_blk_files(clogd_t)
+
+storage_raw_read_fixed_disk(clogd_t)
+storage_raw_write_fixed_disk(clogd_t)
+
+libs_use_ld_so(clogd_t)
+libs_use_shared_libs(clogd_t)
+
+logging_send_syslog_msg(clogd_t)
+
+miscfiles_read_localization(clogd_t)
+
+optional_policy(`
+       aisexec_stream_connect(clogd_t)
+       corosync_stream_connect(clogd_t)
+')
+
+optional_policy(`
+       dev_read_lvm_control(clogd_t)
+')