policy/modules/admin/usermanage.te

   1 policy_module(usermanage, 1.16.0)
   2
   3 ########################################
   4 #
   5 # Declarations
   6 #
   7
   8 type admin_passwd_exec_t;
   9 files_type(admin_passwd_exec_t)
  10
  11 type chfn_t;
  12 type chfn_exec_t;
  13 domain_obj_id_change_exemption(chfn_t)
  14 application_domain(chfn_t, chfn_exec_t)
  15 role system_r types chfn_t;
  16
  17 type crack_t;
  18 type crack_exec_t;
  19 application_domain(crack_t, crack_exec_t)
  20 role system_r types crack_t;
  21
  22 type crack_db_t;
  23 files_type(crack_db_t)
  24
  25 type crack_tmp_t;
  26 files_tmp_file(crack_tmp_t)
  27
  28 type groupadd_t;
  29 type groupadd_exec_t;
  30 domain_obj_id_change_exemption(groupadd_t)
  31 init_system_domain(groupadd_t, groupadd_exec_t)
  32
  33 type passwd_t;
  34 type passwd_exec_t;
  35 domain_obj_id_change_exemption(passwd_t)
  36 application_domain(passwd_t, passwd_exec_t)
  37 role system_r types passwd_t;
  38
  39 type sysadm_passwd_t;
  40 domain_obj_id_change_exemption(sysadm_passwd_t)
  41 application_domain(sysadm_passwd_t, admin_passwd_exec_t)
  42 role system_r types sysadm_passwd_t;
  43
  44 type sysadm_passwd_tmp_t;
  45 files_tmp_file(sysadm_passwd_tmp_t)
  46
  47 type useradd_t;
  48 type useradd_exec_t;
  49 domain_obj_id_change_exemption(useradd_t)
  50 init_system_domain(useradd_t, useradd_exec_t)
  51
  52 ########################################
  53 #
  54 # Chfn local policy
  55 #
  56
  57 allow chfn_t self:capability { chown dac_override fsetid setuid setgid sys_resource };
  58 allow chfn_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execheap execstack };
  59 allow chfn_t self:process { setrlimit setfscreate };
  60 allow chfn_t self:fd use;
  61 allow chfn_t self:fifo_file rw_fifo_file_perms;
  62 allow chfn_t self:sock_file read_sock_file_perms;
  63 allow chfn_t self:shm create_shm_perms;
  64 allow chfn_t self:sem create_sem_perms;
  65 allow chfn_t self:msgq create_msgq_perms;
  66 allow chfn_t self:msg { send receive };
  67 allow chfn_t self:unix_dgram_socket create_socket_perms;
  68 allow chfn_t self:unix_stream_socket create_stream_socket_perms;
  69 allow chfn_t self:unix_dgram_socket sendto;
  70 allow chfn_t self:unix_stream_socket connectto;
  71
  72 kernel_read_system_state(chfn_t)
  73 kernel_read_kernel_sysctls(chfn_t)
  74 kernel_dontaudit_getattr_core_if(chfn_t)
  75
  76 selinux_get_fs_mount(chfn_t)
  77 selinux_validate_context(chfn_t)
  78 selinux_compute_access_vector(chfn_t)
  79 selinux_compute_create_context(chfn_t)
  80 selinux_compute_relabel_context(chfn_t)
  81 selinux_compute_user_contexts(chfn_t)
  82
  83 term_use_all_inherited_ttys(chfn_t)
  84 term_use_all_inherited_ptys(chfn_t)
  85 term_getattr_all_ptys(chfn_t)
  86
  87 fs_getattr_xattr_fs(chfn_t)
  88 fs_search_auto_mountpoints(chfn_t)
  89
  90 # for SSP
  91 dev_read_urand(chfn_t)
  92 dev_dontaudit_getattr_all(chfn_t)
  93
  94 auth_use_pam(chfn_t)
  95
  96 # allow checking if a shell is executable
  97 corecmd_check_exec_shell(chfn_t)
  98
  99 domain_use_interactive_fds(chfn_t)
 100
 101 files_manage_etc_files(chfn_t)
 102 files_read_etc_runtime_files(chfn_t)
 103 files_dontaudit_search_var(chfn_t)
 104 files_dontaudit_search_home(chfn_t)
 105
 106 # /usr/bin/passwd asks for w access to utmp, but it will operate
 107 # correctly without it.  Do not audit write denials to utmp.
 108 init_dontaudit_rw_utmp(chfn_t)
 109 init_dontaudit_getattr_initctl(chfn_t)
 110
 111 miscfiles_read_localization(chfn_t)
 112
 113 logging_send_syslog_msg(chfn_t)
 114
 115 # uses unix_chkpwd for checking passwords
 116 seutil_dontaudit_search_config(chfn_t)
 117
 118 userdom_use_unpriv_users_fds(chfn_t)
 119 # user generally runs this from their home directory, so do not audit a search
 120 # on user home dir
 121 userdom_dontaudit_search_user_home_content(chfn_t)
 122
 123 optional_policy(`
 124         rssh_exec(chfn_t)
 125 ')
 126
 127 ########################################
 128 #
 129 # Crack local policy
 130 #
 131
 132 allow crack_t self:process signal_perms;
 133 allow crack_t self:fifo_file rw_fifo_file_perms;
 134
 135 manage_files_pattern(crack_t, crack_db_t, crack_db_t)
 136 manage_lnk_files_pattern(crack_t, crack_db_t, crack_db_t)
 137 files_search_var(crack_t)
 138
 139 manage_dirs_pattern(crack_t, crack_tmp_t, crack_tmp_t)
 140 manage_files_pattern(crack_t, crack_tmp_t, crack_tmp_t)
 141 files_tmp_filetrans(crack_t, crack_tmp_t, { file dir })
 142
 143 kernel_read_system_state(crack_t)
 144
 145 # for SSP
 146 dev_read_urand(crack_t)
 147
 148 fs_getattr_xattr_fs(crack_t)
 149
 150 files_read_etc_files(crack_t)
 151 files_read_etc_runtime_files(crack_t)
 152 # for dictionaries
 153 files_read_usr_files(crack_t)
 154
 155 corecmd_exec_bin(crack_t)
 156
 157 logging_send_syslog_msg(crack_t)
 158
 159 userdom_dontaudit_search_user_home_dirs(crack_t)
 160
 161 ifdef(`distro_debian',`
 162         # the package cracklib-runtime on Debian contains a daily maintenance
 163         # script /etc/cron.daily/cracklib-runtime, that calls
 164         # update-cracklib and that calls crack_mkdict, which is a shell script.
 165         corecmd_exec_shell(crack_t)
 166 ')
 167
 168 optional_policy(`
 169         cron_system_entry(crack_t, crack_exec_t)
 170 ')
 171
 172 ########################################
 173 #
 174 # Groupadd local policy
 175 #
 176
 177 allow groupadd_t self:capability { dac_override chown kill setuid sys_resource audit_write };
 178 dontaudit groupadd_t self:capability { fsetid sys_tty_config };
 179 allow groupadd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execheap execstack };
 180 allow groupadd_t self:process { setrlimit setfscreate };
 181 allow groupadd_t self:fd use;
 182 allow groupadd_t self:fifo_file rw_fifo_file_perms;
 183 allow groupadd_t self:shm create_shm_perms;
 184 allow groupadd_t self:sem create_sem_perms;
 185 allow groupadd_t self:msgq create_msgq_perms;
 186 allow groupadd_t self:msg { send receive };
 187 allow groupadd_t self:unix_dgram_socket create_socket_perms;
 188 allow groupadd_t self:unix_stream_socket create_stream_socket_perms;
 189 allow groupadd_t self:unix_dgram_socket sendto;
 190 allow groupadd_t self:unix_stream_socket connectto;
 191
 192 fs_getattr_xattr_fs(groupadd_t)
 193 fs_search_auto_mountpoints(groupadd_t)
 194
 195 # Allow access to context for shadow file
 196 selinux_get_fs_mount(groupadd_t)
 197 selinux_validate_context(groupadd_t)
 198 selinux_compute_access_vector(groupadd_t)
 199 selinux_compute_create_context(groupadd_t)
 200 selinux_compute_relabel_context(groupadd_t)
 201 selinux_compute_user_contexts(groupadd_t)
 202
 203 term_use_all_inherited_terms(groupadd_t)
 204 term_getattr_all_ptys(groupadd_t)
 205
 206 init_use_fds(groupadd_t)
 207 init_read_utmp(groupadd_t)
 208 init_dontaudit_write_utmp(groupadd_t)
 209
 210 domain_use_interactive_fds(groupadd_t)
 211
 212 files_manage_etc_files(groupadd_t)
 213 files_relabel_etc_files(groupadd_t)
 214 files_read_etc_runtime_files(groupadd_t)
 215 files_read_usr_symlinks(groupadd_t)
 216
 217 # Execute /usr/bin/{passwd, chfn, chsh} and /usr/sbin/{useradd, vipw}.
 218 corecmd_exec_bin(groupadd_t)
 219
 220 logging_send_audit_msgs(groupadd_t)
 221 logging_send_syslog_msg(groupadd_t)
 222
 223 miscfiles_read_localization(groupadd_t)
 224
 225 auth_domtrans_chk_passwd(groupadd_t)
 226 auth_rw_lastlog(groupadd_t)
 227 auth_use_nsswitch(groupadd_t)
 228 # these may be unnecessary due to the above
 229 # domtrans_chk_passwd() call.
 230 auth_manage_shadow(groupadd_t)
 231 auth_relabel_shadow(groupadd_t)
 232 auth_etc_filetrans_shadow(groupadd_t)
 233
 234 seutil_read_config(groupadd_t)
 235
 236 userdom_use_unpriv_users_fds(groupadd_t)
 237 # for when /root is the cwd
 238 userdom_dontaudit_search_user_home_dirs(groupadd_t)
 239
 240 optional_policy(`
 241         dpkg_use_fds(groupadd_t)
 242         dpkg_rw_pipes(groupadd_t)
 243 ')
 244
 245 optional_policy(`
 246         nscd_domtrans(groupadd_t)
 247 ')
 248
 249 optional_policy(`
 250         puppet_rw_tmp(groupadd_t)
 251 ')
 252
 253 optional_policy(`
 254         rpm_use_fds(groupadd_t)
 255         rpm_rw_pipes(groupadd_t)
 256 ')
 257
 258 ########################################
 259 #
 260 # Passwd local policy
 261 #
 262
 263 allow passwd_t self:capability { chown dac_override fsetid setuid setgid sys_nice sys_resource };
 264 dontaudit passwd_t self:capability sys_tty_config;
 265 allow passwd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
 266 allow passwd_t self:process { setrlimit setfscreate };
 267 allow passwd_t self:fd use;
 268 allow passwd_t self:fifo_file rw_fifo_file_perms;
 269 allow passwd_t self:sock_file read_sock_file_perms;
 270 allow passwd_t self:unix_dgram_socket create_socket_perms;
 271 allow passwd_t self:unix_stream_socket create_stream_socket_perms;
 272 allow passwd_t self:unix_dgram_socket sendto;
 273 allow passwd_t self:unix_stream_socket connectto;
 274 allow passwd_t self:shm create_shm_perms;
 275 allow passwd_t self:sem create_sem_perms;
 276 allow passwd_t self:msgq create_msgq_perms;
 277 allow passwd_t self:msg { send receive };
 278
 279 allow passwd_t crack_db_t:dir list_dir_perms;
 280 read_files_pattern(passwd_t, crack_db_t, crack_db_t)
 281
 282 kernel_read_kernel_sysctls(passwd_t)
 283
 284 # for SSP
 285 dev_read_urand(passwd_t)
 286 dev_dontaudit_getattr_all(passwd_t)
 287
 288 fs_getattr_xattr_fs(passwd_t)
 289 fs_search_auto_mountpoints(passwd_t)
 290
 291 mls_file_write_all_levels(passwd_t)
 292 mls_file_downgrade(passwd_t)
 293
 294 selinux_get_fs_mount(passwd_t)
 295 selinux_validate_context(passwd_t)
 296 selinux_compute_access_vector(passwd_t)
 297 selinux_compute_create_context(passwd_t)
 298 selinux_compute_relabel_context(passwd_t)
 299 selinux_compute_user_contexts(passwd_t)
 300
 301 term_use_all_inherited_terms(passwd_t)
 302 term_getattr_all_ptys(passwd_t)
 303
 304 auth_manage_shadow(passwd_t)
 305 auth_relabel_shadow(passwd_t)
 306 auth_etc_filetrans_shadow(passwd_t)
 307 auth_use_pam(passwd_t)
 308
 309 # allow checking if a shell is executable
 310 corecmd_check_exec_shell(passwd_t)
 311 corecmd_exec_bin(passwd_t)
 312
 313 corenet_tcp_connect_kerberos_password_port(passwd_t)
 314
 315 domain_use_interactive_fds(passwd_t)
 316
 317 files_read_etc_runtime_files(passwd_t)
 318 files_manage_etc_files(passwd_t)
 319 files_search_var(passwd_t)
 320 files_dontaudit_search_pids(passwd_t)
 321 files_relabel_etc_files(passwd_t)
 322
 323 term_search_ptys(passwd_t)
 324
 325 # /usr/bin/passwd asks for w access to utmp, but it will operate
 326 # correctly without it.  Do not audit write denials to utmp.
 327 init_dontaudit_rw_utmp(passwd_t)
 328 init_use_fds(passwd_t)
 329
 330 logging_send_audit_msgs(passwd_t)
 331 logging_send_syslog_msg(passwd_t)
 332
 333 miscfiles_read_localization(passwd_t)
 334
 335 seutil_dontaudit_search_config(passwd_t)
 336
 337 userdom_use_inherited_user_terminals(passwd_t)
 338 userdom_use_unpriv_users_fds(passwd_t)
 339 # make sure that getcon succeeds
 340 userdom_getattr_all_users(passwd_t)
 341 userdom_read_all_users_state(passwd_t)
 342 userdom_read_user_tmp_files(passwd_t)
 343 # user generally runs this from their home directory, so do not audit a search
 344 # on user home dir
 345 userdom_dontaudit_search_user_home_content(passwd_t)
 346 userdom_stream_connect(passwd_t)
 347
 348 optional_policy(`
 349         nscd_domtrans(passwd_t)
 350 ')
 351
 352 ########################################
 353 #
 354 # Password admin local policy
 355 #
 356
 357 allow sysadm_passwd_t self:capability { chown dac_override fsetid setuid setgid sys_resource };
 358 allow sysadm_passwd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
 359 allow sysadm_passwd_t self:process { setrlimit setfscreate };
 360 allow sysadm_passwd_t self:fd use;
 361 allow sysadm_passwd_t self:fifo_file rw_fifo_file_perms;
 362 allow sysadm_passwd_t self:sock_file read_sock_file_perms;
 363 allow sysadm_passwd_t self:unix_dgram_socket create_socket_perms;
 364 allow sysadm_passwd_t self:unix_stream_socket create_stream_socket_perms;
 365 allow sysadm_passwd_t self:unix_dgram_socket sendto;
 366 allow sysadm_passwd_t self:unix_stream_socket connectto;
 367 allow sysadm_passwd_t self:shm create_shm_perms;
 368 allow sysadm_passwd_t self:sem create_sem_perms;
 369 allow sysadm_passwd_t self:msgq create_msgq_perms;
 370 allow sysadm_passwd_t self:msg { send receive };
 371
 372 # allow vipw to create temporary files under /var/tmp/vi.recover
 373 manage_dirs_pattern(sysadm_passwd_t, sysadm_passwd_tmp_t, sysadm_passwd_tmp_t)
 374 manage_files_pattern(sysadm_passwd_t, sysadm_passwd_tmp_t, sysadm_passwd_tmp_t)
 375 files_tmp_filetrans(sysadm_passwd_t, sysadm_passwd_tmp_t, { file dir })
 376 files_search_var(sysadm_passwd_t)
 377 files_dontaudit_search_home(sysadm_passwd_t)
 378
 379 kernel_read_kernel_sysctls(sysadm_passwd_t)
 380 # for /proc/meminfo
 381 kernel_read_system_state(sysadm_passwd_t)
 382
 383 selinux_get_fs_mount(sysadm_passwd_t)
 384 selinux_validate_context(sysadm_passwd_t)
 385 selinux_compute_access_vector(sysadm_passwd_t)
 386 selinux_compute_create_context(sysadm_passwd_t)
 387 selinux_compute_relabel_context(sysadm_passwd_t)
 388 selinux_compute_user_contexts(sysadm_passwd_t)
 389
 390 # for SSP
 391 dev_read_urand(sysadm_passwd_t)
 392
 393 fs_getattr_xattr_fs(sysadm_passwd_t)
 394 fs_search_auto_mountpoints(sysadm_passwd_t)
 395
 396 term_use_all_inherited_terms(sysadm_passwd_t)
 397 term_getattr_all_ptys(sysadm_passwd_t)
 398
 399 auth_manage_shadow(sysadm_passwd_t)
 400 auth_relabel_shadow(sysadm_passwd_t)
 401 auth_etc_filetrans_shadow(sysadm_passwd_t)
 402 auth_use_nsswitch(sysadm_passwd_t)
 403
 404 # allow vipw to exec the editor
 405 corecmd_exec_bin(sysadm_passwd_t)
 406 corecmd_exec_shell(sysadm_passwd_t)
 407 files_read_usr_files(sysadm_passwd_t)
 408
 409 domain_use_interactive_fds(sysadm_passwd_t)
 410
 411 files_manage_etc_files(sysadm_passwd_t)
 412 files_relabel_etc_files(sysadm_passwd_t)
 413 files_read_etc_runtime_files(sysadm_passwd_t)
 414 # for nscd lookups
 415 files_dontaudit_search_pids(sysadm_passwd_t)
 416
 417 # /usr/bin/passwd asks for w access to utmp, but it will operate
 418 # correctly without it.  Do not audit write denials to utmp.
 419 init_dontaudit_rw_utmp(sysadm_passwd_t)
 420
 421 miscfiles_read_localization(sysadm_passwd_t)
 422
 423 logging_send_syslog_msg(sysadm_passwd_t)
 424
 425 seutil_dontaudit_search_config(sysadm_passwd_t)
 426
 427 userdom_use_unpriv_users_fds(sysadm_passwd_t)
 428 # user generally runs this from their home directory, so do not audit a search
 429 # on user home dir
 430 userdom_dontaudit_search_user_home_content(sysadm_passwd_t)
 431
 432 optional_policy(`
 433         nscd_domtrans(sysadm_passwd_t)
 434 ')
 435
 436 ########################################
 437 #
 438 # Useradd local policy
 439 #
 440
 441 allow useradd_t self:capability { dac_override chown kill fowner fsetid setuid sys_resource sys_ptrace };
 442 dontaudit useradd_t self:capability sys_tty_config;
 443 allow useradd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
 444 allow useradd_t self:process setfscreate;
 445 allow useradd_t self:fd use;
 446 allow useradd_t self:fifo_file rw_fifo_file_perms;
 447 allow useradd_t self:shm create_shm_perms;
 448 allow useradd_t self:sem create_sem_perms;
 449 allow useradd_t self:msgq create_msgq_perms;
 450 allow useradd_t self:msg { send receive };
 451 allow useradd_t self:unix_dgram_socket create_socket_perms;
 452 allow useradd_t self:unix_stream_socket create_stream_socket_perms;
 453 allow useradd_t self:unix_dgram_socket sendto;
 454 allow useradd_t self:unix_stream_socket connectto;
 455
 456 # for getting the number of groups
 457 kernel_read_kernel_sysctls(useradd_t)
 458
 459 corecmd_exec_shell(useradd_t)
 460 # Execute /usr/bin/{passwd,chfn,chsh} and /usr/sbin/{useradd,vipw}.
 461 corecmd_exec_bin(useradd_t)
 462
 463 kernel_getattr_core_if(useradd_t)
 464 dev_dontaudit_getattr_all(useradd_t)
 465
 466 domain_use_interactive_fds(useradd_t)
 467 domain_read_all_domains_state(useradd_t)
 468 domain_dontaudit_read_all_domains_state(useradd_t)
 469
 470 files_manage_etc_files(useradd_t)
 471 files_search_var_lib(useradd_t)
 472 files_relabel_etc_files(useradd_t)
 473 files_read_etc_runtime_files(useradd_t)
 474
 475 fs_search_auto_mountpoints(useradd_t)
 476 fs_getattr_xattr_fs(useradd_t)
 477
 478 mls_file_upgrade(useradd_t)
 479 mls_process_read_to_clearance(useradd_t)
 480
 481 # Allow access to context for shadow file
 482 selinux_get_fs_mount(useradd_t)
 483 selinux_validate_context(useradd_t)
 484 selinux_compute_access_vector(useradd_t)
 485 selinux_compute_create_context(useradd_t)
 486 selinux_compute_relabel_context(useradd_t)
 487 selinux_compute_user_contexts(useradd_t)
 488
 489 term_use_all_inherited_terms(useradd_t)
 490 term_getattr_all_ptys(useradd_t)
 491
 492 auth_domtrans_chk_passwd(useradd_t)
 493 auth_rw_lastlog(useradd_t)
 494 auth_rw_faillog(useradd_t)
 495 auth_use_nsswitch(useradd_t)
 496 # these may be unnecessary due to the above
 497 # domtrans_chk_passwd() call.
 498 auth_manage_shadow(useradd_t)
 499 auth_relabel_shadow(useradd_t)
 500 auth_etc_filetrans_shadow(useradd_t)
 501
 502 init_use_fds(useradd_t)
 503 init_rw_utmp(useradd_t)
 504
 505 logging_send_audit_msgs(useradd_t)
 506 logging_send_syslog_msg(useradd_t)
 507
 508 miscfiles_read_localization(useradd_t)
 509
 510 seutil_read_config(useradd_t)
 511 seutil_read_file_contexts(useradd_t)
 512 seutil_read_default_contexts(useradd_t)
 513 seutil_domtrans_semanage(useradd_t)
 514 seutil_domtrans_setfiles(useradd_t)
 515
 516 userdom_use_unpriv_users_fds(useradd_t)
 517 # Add/remove user home directories
 518 userdom_home_filetrans_user_home_dir(useradd_t)
 519 userdom_manage_home_role(system_r, useradd_t)
 520
 521 mta_manage_spool(useradd_t)
 522
 523 optional_policy(`
 524         apache_manage_all_user_content(useradd_t)
 525 ')
 526
 527 optional_policy(`
 528         dpkg_use_fds(useradd_t)
 529         dpkg_rw_pipes(useradd_t)
 530 ')
 531
 532 optional_policy(`
 533         nscd_domtrans(useradd_t)
 534 ')
 535
 536 optional_policy(`
 537         puppet_rw_tmp(useradd_t)
 538 ')
 539
 540 optional_policy(`
 541         tunable_policy(`samba_domain_controller',`
 542                 samba_append_log(useradd_t)
 543         ')
 544 ')
 545
 546 optional_policy(`
 547         rpm_use_fds(useradd_t)
 548         rpm_rw_pipes(useradd_t)
 549 ')