policy/modules/services/abrt.te

   1 policy_module(abrt, 1.2.0)
   2
   3 ########################################
   4 #
   5 # Declarations
   6 #
   7
   8 ## <desc>
   9 ##      <p>
  10 ##      Allow ABRT to modify public files
  11 ##      used for public file transfer services.
  12 ##      </p>
  13 ## </desc>
  14 gen_tunable(abrt_anon_write, false)
  15
  16 type abrt_t;
  17 type abrt_exec_t;
  18 init_daemon_domain(abrt_t, abrt_exec_t)
  19
  20 type abrt_initrc_exec_t;
  21 init_script_file(abrt_initrc_exec_t)
  22
  23 # etc files
  24 type abrt_etc_t;
  25 files_config_file(abrt_etc_t)
  26
  27 # log files
  28 type abrt_var_log_t;
  29 logging_log_file(abrt_var_log_t)
  30
  31 # tmp files
  32 type abrt_tmp_t;
  33 files_tmp_file(abrt_tmp_t)
  34
  35 # var/cache files
  36 type abrt_var_cache_t;
  37 files_type(abrt_var_cache_t)
  38
  39 # pid files
  40 type abrt_var_run_t;
  41 files_pid_file(abrt_var_run_t)
  42
  43 type abrt_dump_oops_t;
  44 type abrt_dump_oops_exec_t;
  45 init_system_domain(abrt_dump_oops_t, abrt_dump_oops_exec_t)
  46
  47 permissive abrt_dump_oops_t;
  48
  49 # type needed to allow all domains
  50 # to handle /var/cache/abrt
  51 type abrt_helper_t;
  52 type abrt_helper_exec_t;
  53 application_domain(abrt_helper_t, abrt_helper_exec_t)
  54 role system_r types abrt_helper_t;
  55
  56 ifdef(`enable_mcs',`
  57         init_ranged_daemon_domain(abrt_t, abrt_exec_t, s0 - mcs_systemhigh)
  58 ')
  59
  60 #
  61 # Support for ABRT retrace server
  62 #
  63
  64 type abrt_retrace_worker_t;
  65 type abrt_retrace_worker_exec_t;
  66 application_domain(abrt_retrace_worker_t, abrt_retrace_worker_exec_t)
  67 role system_r types abrt_retrace_worker_t;
  68
  69 type abrt_retrace_coredump_t;
  70 type abrt_retrace_coredump_exec_t;
  71 application_domain(abrt_retrace_coredump_t, abrt_retrace_coredump_exec_t)
  72 role system_r types abrt_retrace_coredump_t;
  73
  74 permissive abrt_retrace_worker_exec_t;
  75 permissive abrt_retrace_coredump_t;
  76
  77 type abrt_retrace_cache_t;
  78 files_type(abrt_retrace_cache_t)
  79
  80 type abrt_retrace_spool_t;
  81 files_spool_file(abrt_retrace_spool_t)
  82
  83 ########################################
  84 #
  85 # abrt local policy
  86 #
  87
  88 allow abrt_t self:capability { chown dac_override fowner fsetid kill setgid setuid sys_nice };
  89 dontaudit abrt_t self:capability sys_rawio;
  90 allow abrt_t self:process { sigkill signal signull setsched getsched };
  91
  92 allow abrt_t self:fifo_file rw_fifo_file_perms;
  93 allow abrt_t self:tcp_socket create_stream_socket_perms;
  94 allow abrt_t self:udp_socket create_socket_perms;
  95 allow abrt_t self:unix_dgram_socket create_socket_perms;
  96 allow abrt_t self:netlink_route_socket r_netlink_socket_perms;
  97
  98 # abrt etc files
  99 list_dirs_pattern(abrt_t, abrt_etc_t, abrt_etc_t)
 100 rw_files_pattern(abrt_t, abrt_etc_t, abrt_etc_t)
 101
 102 # log file
 103 manage_files_pattern(abrt_t, abrt_var_log_t, abrt_var_log_t)
 104 logging_log_filetrans(abrt_t, abrt_var_log_t, file)
 105
 106 # abrt tmp files
 107 manage_dirs_pattern(abrt_t, abrt_tmp_t, abrt_tmp_t)
 108 manage_files_pattern(abrt_t, abrt_tmp_t, abrt_tmp_t)
 109 files_tmp_filetrans(abrt_t, abrt_tmp_t, { file dir })
 110 can_exec(abrt_t, abrt_tmp_t)
 111
 112 # abrt var/cache files
 113 manage_files_pattern(abrt_t, abrt_var_cache_t, abrt_var_cache_t)
 114 manage_dirs_pattern(abrt_t, abrt_var_cache_t, abrt_var_cache_t)
 115 manage_lnk_files_pattern(abrt_t, abrt_var_cache_t, abrt_var_cache_t)
 116 files_var_filetrans(abrt_t, abrt_var_cache_t, { file dir })
 117 files_spool_filetrans(abrt_t, abrt_var_cache_t, dir)
 118
 119 # abrt pid files
 120 manage_files_pattern(abrt_t, abrt_var_run_t, abrt_var_run_t)
 121 manage_dirs_pattern(abrt_t, abrt_var_run_t, abrt_var_run_t)
 122 manage_sock_files_pattern(abrt_t, abrt_var_run_t, abrt_var_run_t)
 123 manage_lnk_files_pattern(abrt_t, abrt_var_run_t, abrt_var_run_t)
 124 files_pid_filetrans(abrt_t, abrt_var_run_t, { file dir sock_file })
 125
 126 kernel_read_ring_buffer(abrt_t)
 127 kernel_read_system_state(abrt_t)
 128 kernel_rw_kernel_sysctl(abrt_t)
 129
 130 corecmd_exec_bin(abrt_t)
 131 corecmd_exec_shell(abrt_t)
 132 corecmd_read_all_executables(abrt_t)
 133
 134 corenet_all_recvfrom_netlabel(abrt_t)
 135 corenet_all_recvfrom_unlabeled(abrt_t)
 136 corenet_tcp_sendrecv_generic_if(abrt_t)
 137 corenet_tcp_sendrecv_generic_node(abrt_t)
 138 corenet_tcp_sendrecv_generic_port(abrt_t)
 139 corenet_tcp_bind_generic_node(abrt_t)
 140 corenet_tcp_connect_http_port(abrt_t)
 141 corenet_tcp_connect_ftp_port(abrt_t)
 142 corenet_tcp_connect_all_ports(abrt_t)
 143 corenet_sendrecv_http_client_packets(abrt_t)
 144
 145 dev_getattr_all_chr_files(abrt_t)
 146 dev_read_rand(abrt_t)
 147 dev_read_urand(abrt_t)
 148 dev_rw_sysfs(abrt_t)
 149 dev_dontaudit_read_raw_memory(abrt_t)
 150
 151 domain_getattr_all_domains(abrt_t)
 152 domain_read_all_domains_state(abrt_t)
 153 domain_signull_all_domains(abrt_t)
 154
 155 files_getattr_all_files(abrt_t)
 156 files_read_config_files(abrt_t)
 157 files_read_etc_runtime_files(abrt_t)
 158 files_read_var_symlinks(abrt_t)
 159 files_read_var_lib_files(abrt_t)
 160 files_read_usr_files(abrt_t)
 161 files_read_generic_tmp_files(abrt_t)
 162 files_read_kernel_modules(abrt_t)
 163 files_dontaudit_list_default(abrt_t)
 164 files_dontaudit_read_default_files(abrt_t)
 165 files_dontaudit_read_all_symlinks(abrt_t)
 166 files_dontaudit_getattr_all_sockets(abrt_t)
 167
 168 fs_list_inotifyfs(abrt_t)
 169 fs_getattr_all_fs(abrt_t)
 170 fs_getattr_all_dirs(abrt_t)
 171 fs_read_fusefs_files(abrt_t)
 172 fs_read_noxattr_fs_files(abrt_t)
 173 fs_read_nfs_files(abrt_t)
 174 fs_read_nfs_symlinks(abrt_t)
 175 fs_search_all(abrt_t)
 176
 177 sysnet_dns_name_resolve(abrt_t)
 178
 179 logging_read_generic_logs(abrt_t)
 180 logging_send_syslog_msg(abrt_t)
 181
 182 miscfiles_read_generic_certs(abrt_t)
 183 miscfiles_read_localization(abrt_t)
 184
 185 userdom_dontaudit_read_user_home_content_files(abrt_t)
 186 userdom_dontaudit_read_admin_home_files(abrt_t)
 187
 188 tunable_policy(`abrt_anon_write',`
 189         miscfiles_manage_public_files(abrt_t)
 190 ')
 191
 192 optional_policy(`
 193         apache_list_modules(abrt_t)
 194         apache_read_modules(abrt_t)
 195 ')
 196
 197 optional_policy(`
 198         dbus_system_domain(abrt_t, abrt_exec_t)
 199 ')
 200
 201 optional_policy(`
 202         nis_use_ypbind(abrt_t)
 203 ')
 204
 205 optional_policy(`
 206         nsplugin_read_rw_files(abrt_t)
 207         nsplugin_read_home(abrt_t)
 208 ')
 209
 210 optional_policy(`
 211         policykit_dbus_chat(abrt_t)
 212         policykit_domtrans_auth(abrt_t)
 213         policykit_read_lib(abrt_t)
 214         policykit_read_reload(abrt_t)
 215 ')
 216
 217 optional_policy(`
 218         prelink_exec(abrt_t)
 219         libs_exec_ld_so(abrt_t)
 220         corecmd_exec_all_executables(abrt_t)
 221 ')
 222
 223 # to install debuginfo packages
 224 optional_policy(`
 225         rpm_exec(abrt_t)
 226         rpm_dontaudit_manage_db(abrt_t)
 227         rpm_manage_cache(abrt_t)
 228         rpm_manage_log(abrt_t)
 229         rpm_manage_pid_files(abrt_t)
 230         rpm_read_db(abrt_t)
 231         rpm_signull(abrt_t)
 232 ')
 233
 234 # to run mailx plugin
 235 optional_policy(`
 236         sendmail_domtrans(abrt_t)
 237 ')
 238
 239 optional_policy(`
 240         sosreport_domtrans(abrt_t)
 241         sosreport_read_tmp_files(abrt_t)
 242         sosreport_delete_tmp_files(abrt_t)
 243 ')
 244
 245 optional_policy(`
 246         sssd_stream_connect(abrt_t)
 247 ')
 248
 249 ########################################
 250 #
 251 # abrt-helper local policy
 252 #
 253
 254 allow abrt_helper_t self:capability { chown setgid sys_nice };
 255 allow abrt_helper_t self:process signal;
 256
 257 read_files_pattern(abrt_helper_t, abrt_etc_t, abrt_etc_t)
 258
 259 files_search_spool(abrt_helper_t)
 260 manage_dirs_pattern(abrt_helper_t, abrt_var_cache_t, abrt_var_cache_t)
 261 manage_files_pattern(abrt_helper_t, abrt_var_cache_t, abrt_var_cache_t)
 262 manage_lnk_files_pattern(abrt_helper_t, abrt_var_cache_t, abrt_var_cache_t)
 263 files_var_filetrans(abrt_helper_t, abrt_var_cache_t, { file dir })
 264
 265 read_files_pattern(abrt_helper_t, abrt_var_run_t, abrt_var_run_t)
 266 read_lnk_files_pattern(abrt_helper_t, abrt_var_run_t, abrt_var_run_t)
 267
 268 corecmd_read_all_executables(abrt_helper_t)
 269
 270 domain_read_all_domains_state(abrt_helper_t)
 271
 272 files_read_etc_files(abrt_helper_t)
 273 files_dontaudit_all_non_security_leaks(abrt_helper_t)
 274
 275 fs_list_inotifyfs(abrt_helper_t)
 276 fs_getattr_all_fs(abrt_helper_t)
 277
 278 auth_use_nsswitch(abrt_helper_t)
 279
 280 logging_send_syslog_msg(abrt_helper_t)
 281
 282 miscfiles_read_localization(abrt_helper_t)
 283
 284 term_dontaudit_use_all_ttys(abrt_helper_t)
 285 term_dontaudit_use_all_ptys(abrt_helper_t)
 286
 287 ifdef(`hide_broken_symptoms',`
 288         domain_dontaudit_leaks(abrt_helper_t)
 289         userdom_dontaudit_read_user_home_content_files(abrt_helper_t)
 290         userdom_dontaudit_read_user_tmp_files(abrt_helper_t)
 291         dev_dontaudit_read_all_blk_files(abrt_helper_t)
 292         dev_dontaudit_read_all_chr_files(abrt_helper_t)
 293         dev_dontaudit_write_all_chr_files(abrt_helper_t)
 294         dev_dontaudit_write_all_blk_files(abrt_helper_t)
 295         fs_dontaudit_rw_anon_inodefs_files(abrt_helper_t)
 296
 297         optional_policy(`
 298                 rpm_dontaudit_leaks(abrt_helper_t)
 299         ')
 300 ')
 301
 302 ifdef(`hide_broken_symptoms',`
 303         gen_require(`
 304                 attribute domain;
 305         ')
 306
 307         allow abrt_t self:capability sys_resource;
 308         allow abrt_t domain:file write;
 309         allow abrt_t domain:process setrlimit;
 310 ')
 311
 312 #######################################
 313 #
 314 # abrt retrace coredump policy
 315 #
 316
 317 allow abrt_retrace_coredump_t self:fifo_file rw_fifo_file_perms;
 318
 319 list_dirs_pattern(abrt_retrace_coredump_t, abrt_retrace_cache_t, abrt_retrace_cache_t)
 320 read_files_pattern(abrt_retrace_coredump_t, abrt_retrace_cache_t, abrt_retrace_cache_t)
 321 read_lnk_files_pattern(abrt_retrace_coredump_t, abrt_retrace_cache_t, abrt_retrace_cache_t)
 322
 323 list_dirs_pattern(abrt_retrace_coredump_t, abrt_retrace_spool_t, abrt_retrace_spool_t)
 324 read_files_pattern(abrt_retrace_coredump_t, abrt_retrace_spool_t, abrt_retrace_spool_t)
 325 read_lnk_files_pattern(abrt_retrace_coredump_t, abrt_retrace_spool_t, abrt_retrace_spool_t)
 326
 327 kernel_read_system_state(abrt_retrace_coredump_t)
 328
 329 corecmd_exec_bin(abrt_retrace_coredump_t)
 330 corecmd_exec_shell(abrt_retrace_coredump_t)
 331
 332 dev_read_urand(abrt_retrace_coredump_t)
 333
 334 files_read_etc_files(abrt_retrace_coredump_t)
 335 files_read_usr_files(abrt_retrace_coredump_t)
 336
 337 logging_send_syslog_msg(abrt_retrace_coredump_t)
 338
 339 miscfiles_read_localization(abrt_retrace_coredump_t)
 340
 341 sysnet_dns_name_resolve(abrt_retrace_coredump_t)
 342
 343 # to install debuginfo packages
 344 optional_policy(`
 345         rpm_exec(abrt_retrace_coredump_t)
 346         rpm_dontaudit_manage_db(abrt_retrace_coredump_t)
 347         rpm_manage_cache(abrt_retrace_coredump_t)
 348         rpm_manage_log(abrt_retrace_coredump_t)
 349         rpm_manage_pid_files(abrt_retrace_coredump_t)
 350         rpm_read_db(abrt_retrace_coredump_t)
 351         rpm_signull(abrt_retrace_coredump_t)
 352 ')
 353
 354 #######################################
 355 #
 356 # abrt retrace worker policy
 357 #
 358
 359 allow abrt_retrace_worker_t self:capability { setuid };
 360
 361 allow abrt_retrace_worker_t self:fifo_file rw_fifo_file_perms;
 362
 363 domtrans_pattern(abrt_retrace_worker_t, abrt_retrace_coredump_exec_t, abrt_retrace_coredump_t)
 364 allow abrt_retrace_worker_t abrt_retrace_coredump_exec_t:file ioctl;
 365
 366 manage_dirs_pattern(abrt_retrace_worker_t, abrt_retrace_spool_t, abrt_retrace_spool_t)
 367 manage_files_pattern(abrt_retrace_worker_t, abrt_retrace_spool_t, abrt_retrace_spool_t)
 368 manage_lnk_files_pattern(abrt_retrace_worker_t, abrt_retrace_spool_t, abrt_retrace_spool_t)
 369
 370 allow abrt_retrace_worker_t abrt_etc_t:file read_file_perms;
 371
 372 can_exec(abrt_retrace_worker_t, abrt_retrace_worker_exec_t)
 373
 374 kernel_read_system_state(abrt_retrace_worker_t)
 375
 376 corecmd_exec_bin(abrt_retrace_worker_t)
 377 corecmd_exec_shell(abrt_retrace_worker_t)
 378
 379 dev_read_urand(abrt_retrace_worker_t)
 380
 381 files_read_etc_files(abrt_retrace_worker_t)
 382 files_read_usr_files(abrt_retrace_worker_t)
 383
 384 logging_send_syslog_msg(abrt_retrace_worker_t)
 385
 386 miscfiles_read_localization(abrt_retrace_worker_t)
 387
 388 sysnet_dns_name_resolve(abrt_retrace_worker_t)
 389
 390 optional_policy(`
 391         mock_domtrans(abrt_retrace_worker_t)
 392 ')
 393
 394 ########################################
 395 #
 396 # abrt_dump_oops local policy
 397 #
 398
 399 allow abrt_dump_oops_t self:capability dac_override;
 400 allow abrt_dump_oops_t self:fifo_file rw_fifo_file_perms;
 401 allow abrt_dump_oops_t self:unix_stream_socket create_stream_socket_perms;
 402
 403 files_search_spool(abrt_dump_oops_t)
 404 manage_dirs_pattern(abrt_dump_oops_t, abrt_var_cache_t, abrt_var_cache_t)
 405 manage_files_pattern(abrt_dump_oops_t, abrt_var_cache_t, abrt_var_cache_t)
 406 manage_lnk_files_pattern(abrt_dump_oops_t, abrt_var_cache_t, abrt_var_cache_t)
 407 files_var_filetrans(abrt_dump_oops_t, abrt_var_cache_t, { file dir })
 408
 409 read_files_pattern(abrt_dump_oops_t, abrt_var_run_t, abrt_var_run_t)
 410 read_lnk_files_pattern(abrt_dump_oops_t, abrt_var_run_t, abrt_var_run_t)
 411
 412 kernel_read_kernel_sysctls(abrt_dump_oops_t)
 413 kernel_read_ring_buffer(abrt_dump_oops_t)
 414
 415 domain_use_interactive_fds(abrt_dump_oops_t)
 416
 417 files_read_etc_files(abrt_dump_oops_t)
 418
 419 logging_read_generic_logs(abrt_dump_oops_t)
 420 logging_send_syslog_msg(abrt_dump_oops_t)
 421
 422 miscfiles_read_localization(abrt_dump_oops_t)