policy/modules/services/apache.te

   1 policy_module(apache, 2.2.1)
   2
   3 #
   4 # NOTES:
   5 #  This policy will work with SUEXEC enabled as part of the Apache
   6 #  configuration. However, the user CGI scripts will run under the
   7 #  system_u:system_r:httpd_user_script_t.
   8 #
   9 #  The user CGI scripts must be labeled with the httpd_user_script_exec_t
  10 #  type, and the directory containing the scripts should also be labeled
  11 #  with these types. This policy allows the user role to perform that
  12 #  relabeling. If it is desired that only admin role should be able to relabel
  13 #  the user CGI scripts, then relabel rule for user roles should be removed.
  14 #
  15
  16 ########################################
  17 #
  18 # Declarations
  19 #
  20
  21 selinux_genbool(httpd_bool_t)
  22
  23 ## <desc>
  24 ##      <p>
  25 ##      Allow Apache to modify public files
  26 ##      used for public file transfer services. Directories/Files must
  27 ##      be labeled public_content_rw_t.
  28 ##      </p>
  29 ## </desc>
  30 gen_tunable(allow_httpd_anon_write, false)
  31
  32 ## <desc>
  33 ##      <p>
  34 ##      Allow Apache to use mod_auth_pam
  35 ##      </p>
  36 ## </desc>
  37 gen_tunable(allow_httpd_mod_auth_pam, false)
  38
  39 ## <desc>
  40 ##      <p>
  41 ##      Allow Apache to use mod_auth_ntlm_winbind
  42 ##      </p>
  43 ## </desc>
  44 gen_tunable(allow_httpd_mod_auth_ntlm_winbind, false)
  45
  46 ## <desc>
  47 ##      <p>
  48 ##      Allow httpd scripts and modules execmem/execstack
  49 ##      </p>
  50 ## </desc>
  51 gen_tunable(httpd_execmem, false)
  52
  53 ## <desc>
  54 ##      <p>
  55 ##      Allow httpd daemon to change system limits
  56 ##      </p>
  57 ## </desc>
  58 gen_tunable(httpd_setrlimit, false)
  59
  60 ## <desc>
  61 ##      <p>
  62 ##      Allow httpd to use built in scripting (usually php)
  63 ##      </p>
  64 ## </desc>
  65 gen_tunable(httpd_builtin_scripting, false)
  66
  67 ## <desc>
  68 ##      <p>
  69 ##      Allow HTTPD scripts and modules to connect to the network using any TCP port.
  70 ##      </p>
  71 ## </desc>
  72 gen_tunable(httpd_can_network_connect, false)
  73
  74 ## <desc>
  75 ##      <p>
  76 ##      Allow HTTPD scripts and modules to connect to cobbler over the network.
  77 ##      </p>
  78 ## </desc>
  79 gen_tunable(httpd_can_network_connect_cobbler, false)
  80
  81 ## <desc>
  82 ##      <p>
  83 ##      Allow HTTPD scripts and modules to connect to databases over the network.
  84 ##      </p>
  85 ## </desc>
  86 gen_tunable(httpd_can_network_connect_db, false)
  87
  88 ## <desc>
  89 ##      <p>
  90 ##      Allow httpd to connect to memcache server
  91 ##      </p>
  92 ## </desc>
  93 gen_tunable(httpd_can_network_memcache, false)
  94
  95 ## <desc>
  96 ##      <p>
  97 ##      Allow httpd to act as a relay
  98 ##      </p>
  99 ## </desc>
 100 gen_tunable(httpd_can_network_relay, false)
 101
 102 ## <desc>
 103 ##      <p>
 104 ##      Allow http daemon to send mail
 105 ##      </p>
 106 ## </desc>
 107 gen_tunable(httpd_can_sendmail, false)
 108
 109 ## <desc>
 110 ##      <p>
 111 ##      Allow http daemon to check spam
 112 ##      </p>
 113 ## </desc>
 114 gen_tunable(httpd_can_check_spam, false)
 115
 116 ## <desc>
 117 ##      <p>
 118 ##      Allow Apache to communicate with avahi service via dbus
 119 ##      </p>
 120 ## </desc>
 121 gen_tunable(httpd_dbus_avahi, false)
 122
 123 ## <desc>
 124 ##      <p>
 125 ##      Allow httpd to execute cgi scripts
 126 ##      </p>
 127 ## </desc>
 128 gen_tunable(httpd_enable_cgi, false)
 129
 130 ## <desc>
 131 ##      <p>
 132 ##      Allow httpd to act as a FTP server by
 133 ##      listening on the ftp port.
 134 ##      </p>
 135 ## </desc>
 136 gen_tunable(httpd_enable_ftp_server, false)
 137
 138 ## <desc>
 139 ##      <p>
 140 ##      Allow httpd to act as a FTP client
 141 ##      connecting to the ftp port and ephemeral ports
 142 ##      </p>
 143 ## </desc>
 144 gen_tunable(httpd_can_connect_ftp, false)
 145
 146 ## <desc>
 147 ##  <p>
 148 ##  Allow httpd to connect to the ldap port
 149 ##  </p>
 150 ## </desc>
 151 gen_tunable(httpd_can_connect_ldap, false)
 152
 153 ## <desc>
 154 ##      <p>
 155 ##      Allow httpd to read home directories
 156 ##      </p>
 157 ## </desc>
 158 gen_tunable(httpd_enable_homedirs, false)
 159
 160 ## <desc>
 161 ##      <p>
 162 ##      Allow httpd to read user content
 163 ##      </p>
 164 ## </desc>
 165 gen_tunable(httpd_read_user_content, false)
 166
 167 ## <desc>
 168 ##      <p>
 169 ##      Allow HTTPD to run SSI executables in the same domain as system CGI scripts.
 170 ##      </p>
 171 ## </desc>
 172 gen_tunable(httpd_ssi_exec, false)
 173
 174 ## <desc>
 175 ##      <p>
 176 ##      Allow Apache to execute tmp content.
 177 ##      </p>
 178 ## </desc>
 179 gen_tunable(httpd_tmp_exec, false)
 180
 181 ## <desc>
 182 ##      <p>
 183 ##      Unify HTTPD to communicate with the terminal.
 184 ##      Needed for entering the passphrase for certificates at
 185 ##      the terminal.
 186 ##      </p>
 187 ## </desc>
 188 gen_tunable(httpd_tty_comm, false)
 189
 190 ## <desc>
 191 ##      <p>
 192 ##      Unify HTTPD handling of all content files.
 193 ##      </p>
 194 ## </desc>
 195 gen_tunable(httpd_unified, false)
 196
 197 ## <desc>
 198 ##      <p>
 199 ##      Allow httpd to access cifs file systems
 200 ##      </p>
 201 ## </desc>
 202 gen_tunable(httpd_use_cifs, false)
 203
 204 ## <desc>
 205 ##      <p>
 206 ##      Allow httpd to run gpg in gpg-web domain
 207 ##      </p>
 208 ## </desc>
 209 gen_tunable(httpd_use_gpg, false)
 210
 211 ## <desc>
 212 ##      <p>
 213 ##      Allow httpd to access nfs file systems
 214 ##      </p>
 215 ## </desc>
 216 gen_tunable(httpd_use_nfs, false)
 217
 218 ## <desc>
 219 ##      <p>
 220 ##      Allow apache scripts to write to public content.  Directories/Files must be labeled public_rw_content_t.
 221 ##      </p>
 222 ## </desc>
 223 gen_tunable(allow_httpd_sys_script_anon_write, false)
 224
 225 attribute httpdcontent;
 226 attribute httpd_user_content_type;
 227 attribute httpd_content_type;
 228
 229 # domains that can exec all users scripts
 230 attribute httpd_exec_scripts;
 231
 232 attribute httpd_script_type;
 233 attribute httpd_script_exec_type;
 234 attribute httpd_user_script_exec_type;
 235
 236 # user script domains
 237 attribute httpd_script_domains;
 238
 239 type httpd_t;
 240 type httpd_exec_t;
 241 init_daemon_domain(httpd_t, httpd_exec_t)
 242 role system_r types httpd_t;
 243
 244 # httpd_cache_t is the type given to the /var/cache/httpd
 245 # directory and the files under that directory
 246 type httpd_cache_t;
 247 files_type(httpd_cache_t)
 248
 249 # httpd_config_t is the type given to the configuration files
 250 type httpd_config_t;
 251 files_config_file(httpd_config_t)
 252
 253 type httpd_helper_t;
 254 type httpd_helper_exec_t;
 255 domain_type(httpd_helper_t)
 256 domain_entry_file(httpd_helper_t, httpd_helper_exec_t)
 257 role system_r types httpd_helper_t;
 258
 259 type httpd_initrc_exec_t;
 260 init_script_file(httpd_initrc_exec_t)
 261
 262 type httpd_unit_file_t;
 263 systemd_unit_file(httpd_unit_file_t)
 264
 265 type httpd_lock_t;
 266 files_lock_file(httpd_lock_t)
 267
 268 type httpd_log_t;
 269 logging_log_file(httpd_log_t)
 270
 271 # httpd_modules_t is the type given to module files (libraries)
 272 # that come with Apache /etc/httpd/modules and /usr/lib/apache
 273 type httpd_modules_t;
 274 files_type(httpd_modules_t)
 275
 276 type httpd_php_t;
 277 type httpd_php_exec_t;
 278 domain_type(httpd_php_t)
 279 domain_entry_file(httpd_php_t, httpd_php_exec_t)
 280 role system_r types httpd_php_t;
 281
 282 type httpd_php_tmp_t;
 283 files_tmp_file(httpd_php_tmp_t)
 284
 285 type httpd_rotatelogs_t;
 286 type httpd_rotatelogs_exec_t;
 287 init_daemon_domain(httpd_rotatelogs_t, httpd_rotatelogs_exec_t)
 288
 289 type httpd_squirrelmail_t;
 290 files_type(httpd_squirrelmail_t)
 291
 292 # SUEXEC runs user scripts as their own user ID
 293 type httpd_suexec_t; #, daemon;
 294 type httpd_suexec_exec_t;
 295 domain_type(httpd_suexec_t)
 296 domain_entry_file(httpd_suexec_t, httpd_suexec_exec_t)
 297 role system_r types httpd_suexec_t;
 298
 299 type httpd_suexec_tmp_t;
 300 files_tmp_file(httpd_suexec_tmp_t)
 301
 302 # setup the system domain for system CGI scripts
 303 apache_content_template(sys)
 304
 305 optional_policy(`
 306         postgresql_unpriv_client(httpd_sys_script_t)
 307 ')
 308
 309 typeattribute httpd_sys_content_t httpdcontent; # customizable
 310 typeattribute httpd_sys_rw_content_t httpdcontent; # customizable
 311 typeattribute httpd_sys_ra_content_t httpdcontent; # customizable
 312
 313 # Removal of fastcgi, will cause problems without the following
 314 typealias httpd_sys_script_exec_t alias httpd_fastcgi_script_exec_t;
 315 typealias httpd_sys_content_t alias { httpd_fastcgi_content_t httpd_fastcgi_script_ro_t };
 316 typealias httpd_sys_rw_content_t alias { httpd_fastcgi_rw_content_t httpd_fastcgi_script_rw_t };
 317 typealias httpd_sys_ra_content_t alias httpd_fastcgi_script_ra_t;
 318 typealias httpd_sys_script_t alias httpd_fastcgi_script_t;
 319
 320 type httpd_tmp_t;
 321 files_tmp_file(httpd_tmp_t)
 322
 323 type httpd_tmpfs_t;
 324 files_tmpfs_file(httpd_tmpfs_t)
 325
 326 apache_content_template(user)
 327 ubac_constrained(httpd_user_script_t)
 328 typeattribute httpd_user_content_t httpdcontent;
 329 typeattribute httpd_user_rw_content_t httpdcontent;
 330 typeattribute httpd_user_ra_content_t httpdcontent;
 331
 332 userdom_user_home_content(httpd_user_content_t)
 333 userdom_user_home_content(httpd_user_htaccess_t)
 334 userdom_user_home_content(httpd_user_script_exec_t)
 335 userdom_user_home_content(httpd_user_ra_content_t)
 336 userdom_user_home_content(httpd_user_rw_content_t)
 337 typeattribute httpd_user_script_t httpd_script_domains;
 338 typealias httpd_user_content_t alias { httpd_staff_content_t httpd_sysadm_content_t };
 339 typealias httpd_user_content_t alias httpd_unconfined_content_t;
 340 typealias httpd_user_content_t alias { httpd_auditadm_content_t httpd_secadm_content_t };
 341 typealias httpd_user_content_t alias { httpd_staff_script_ro_t httpd_sysadm_script_ro_t };
 342 typealias httpd_user_content_t alias { httpd_auditadm_script_ro_t httpd_secadm_script_ro_t };
 343 typealias httpd_user_htaccess_t alias { httpd_staff_htaccess_t httpd_sysadm_htaccess_t };
 344 typealias httpd_user_htaccess_t alias { httpd_auditadm_htaccess_t httpd_secadm_htaccess_t };
 345 typealias httpd_user_script_t alias { httpd_staff_script_t httpd_sysadm_script_t };
 346 typealias httpd_user_script_t alias { httpd_auditadm_script_t httpd_secadm_script_t };
 347 typealias httpd_user_script_exec_t alias { httpd_staff_script_exec_t httpd_sysadm_script_exec_t };
 348 typealias httpd_user_script_exec_t alias { httpd_auditadm_script_exec_t httpd_secadm_script_exec_t };
 349 typealias httpd_user_rw_content_t alias { httpd_staff_script_rw_t httpd_sysadm_script_rw_t };
 350 typealias httpd_user_rw_content_t alias { httpd_auditadm_script_rw_t httpd_secadm_script_rw_t };
 351 typealias httpd_user_ra_content_t alias { httpd_staff_script_ra_t httpd_sysadm_script_ra_t };
 352 typealias httpd_user_ra_content_t alias { httpd_auditadm_script_ra_t httpd_secadm_script_ra_t };
 353
 354 # for apache2 memory mapped files
 355 type httpd_var_lib_t;
 356 files_type(httpd_var_lib_t)
 357
 358 type httpd_var_run_t;
 359 files_pid_file(httpd_var_run_t)
 360
 361 # Removal of fastcgi, will cause problems without the following
 362 typealias httpd_var_run_t alias httpd_fastcgi_var_run_t;
 363
 364 # File Type of squirrelmail attachments
 365 type squirrelmail_spool_t;
 366 files_tmp_file(squirrelmail_spool_t)
 367 files_spool_file(squirrelmail_spool_t)
 368
 369 optional_policy(`
 370         prelink_object_file(httpd_modules_t)
 371 ')
 372
 373 type httpd_passwd_t;
 374 type httpd_passwd_exec_t;
 375 application_domain(httpd_passwd_t, httpd_passwd_exec_t)
 376 role system_r types httpd_passwd_t;
 377
 378 ########################################
 379 #
 380 # Apache server local policy
 381 #
 382
 383 allow httpd_t self:capability { chown dac_override kill setgid setuid sys_nice sys_tty_config };
 384 dontaudit httpd_t self:capability { net_admin sys_tty_config };
 385 allow httpd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
 386 allow httpd_t self:fd use;
 387 allow httpd_t self:sock_file read_sock_file_perms;
 388 allow httpd_t self:fifo_file rw_fifo_file_perms;
 389 allow httpd_t self:shm create_shm_perms;
 390 allow httpd_t self:sem create_sem_perms;
 391 allow httpd_t self:msgq create_msgq_perms;
 392 allow httpd_t self:msg { send receive };
 393 allow httpd_t self:unix_dgram_socket { create_socket_perms sendto };
 394 allow httpd_t self:unix_stream_socket { create_stream_socket_perms connectto };
 395 allow httpd_t self:tcp_socket create_stream_socket_perms;
 396 allow httpd_t self:udp_socket create_socket_perms;
 397 dontaudit httpd_t self:netlink_audit_socket create_socket_perms;
 398
 399 # Allow httpd_t to put files in /var/cache/httpd etc
 400 manage_dirs_pattern(httpd_t, httpd_cache_t, httpd_cache_t)
 401 manage_files_pattern(httpd_t, httpd_cache_t, httpd_cache_t)
 402 manage_lnk_files_pattern(httpd_t, httpd_cache_t, httpd_cache_t)
 403 files_var_filetrans(httpd_t, httpd_cache_t, { file dir })
 404
 405 # Allow the httpd_t to read the web servers config files
 406 allow httpd_t httpd_config_t:dir list_dir_perms;
 407 read_files_pattern(httpd_t, httpd_config_t, httpd_config_t)
 408 read_lnk_files_pattern(httpd_t, httpd_config_t, httpd_config_t)
 409
 410 can_exec(httpd_t, httpd_exec_t)
 411
 412 allow httpd_t httpd_lock_t:file manage_file_perms;
 413 files_lock_filetrans(httpd_t, httpd_lock_t, file)
 414
 415 allow httpd_t httpd_log_t:dir setattr;
 416 create_files_pattern(httpd_t, httpd_log_t, httpd_log_t)
 417 append_files_pattern(httpd_t, httpd_log_t, httpd_log_t)
 418 read_files_pattern(httpd_t, httpd_log_t, httpd_log_t)
 419 read_lnk_files_pattern(httpd_t, httpd_log_t, httpd_log_t)
 420 # cjp: need to refine create interfaces to
 421 # cut this back to add_name only
 422 logging_log_filetrans(httpd_t, httpd_log_t, file)
 423
 424 allow httpd_t httpd_modules_t:dir list_dir_perms;
 425 mmap_files_pattern(httpd_t, httpd_modules_t, httpd_modules_t)
 426 read_files_pattern(httpd_t, httpd_modules_t, httpd_modules_t)
 427 read_lnk_files_pattern(httpd_t, httpd_modules_t, httpd_modules_t)
 428
 429 apache_domtrans_rotatelogs(httpd_t)
 430 # Apache-httpd needs to be able to send signals to the log rotate procs.
 431 allow httpd_t httpd_rotatelogs_t:process signal_perms;
 432
 433 manage_dirs_pattern(httpd_t, httpd_squirrelmail_t, httpd_squirrelmail_t)
 434 manage_files_pattern(httpd_t, httpd_squirrelmail_t, httpd_squirrelmail_t)
 435 manage_lnk_files_pattern(httpd_t, httpd_squirrelmail_t, httpd_squirrelmail_t)
 436
 437 allow httpd_t httpd_suexec_exec_t:file read_file_perms;
 438
 439 allow httpd_t httpd_sys_content_t:dir list_dir_perms;
 440 read_files_pattern(httpd_t, httpd_sys_content_t, httpd_sys_content_t)
 441 read_lnk_files_pattern(httpd_t, httpd_sys_content_t, httpd_sys_content_t)
 442
 443 allow httpd_t httpd_sys_script_t:unix_stream_socket connectto;
 444
 445 manage_dirs_pattern(httpd_t, httpd_tmp_t, httpd_tmp_t)
 446 manage_files_pattern(httpd_t, httpd_tmp_t, httpd_tmp_t)
 447 manage_sock_files_pattern(httpd_t, httpd_tmp_t, httpd_tmp_t)
 448 manage_lnk_files_pattern(httpd_t, httpd_tmp_t, httpd_tmp_t)
 449 files_tmp_filetrans(httpd_t, httpd_tmp_t, { file dir lnk_file sock_file })
 450
 451 manage_dirs_pattern(httpd_t, httpd_tmpfs_t, httpd_tmpfs_t)
 452 manage_files_pattern(httpd_t, httpd_tmpfs_t, httpd_tmpfs_t)
 453 manage_lnk_files_pattern(httpd_t, httpd_tmpfs_t, httpd_tmpfs_t)
 454 manage_fifo_files_pattern(httpd_t, httpd_tmpfs_t, httpd_tmpfs_t)
 455 manage_sock_files_pattern(httpd_t, httpd_tmpfs_t, httpd_tmpfs_t)
 456 fs_tmpfs_filetrans(httpd_t, httpd_tmpfs_t, { dir file lnk_file sock_file fifo_file })
 457
 458 manage_files_pattern(httpd_t, httpd_var_lib_t, httpd_var_lib_t)
 459 files_var_lib_filetrans(httpd_t, httpd_var_lib_t, file)
 460
 461 setattr_dirs_pattern(httpd_t, httpd_var_run_t, httpd_var_run_t)
 462 manage_dirs_pattern(httpd_t, httpd_var_run_t, httpd_var_run_t)
 463 manage_files_pattern(httpd_t, httpd_var_run_t, httpd_var_run_t)
 464 manage_sock_files_pattern(httpd_t, httpd_var_run_t, httpd_var_run_t)
 465 files_pid_filetrans(httpd_t, httpd_var_run_t, { file sock_file dir })
 466
 467 manage_dirs_pattern(httpd_t, squirrelmail_spool_t, squirrelmail_spool_t)
 468 manage_files_pattern(httpd_t, squirrelmail_spool_t, squirrelmail_spool_t)
 469 manage_lnk_files_pattern(httpd_t, squirrelmail_spool_t, squirrelmail_spool_t)
 470
 471 kernel_read_kernel_sysctls(httpd_t)
 472 # for modules that want to access /proc/meminfo
 473 kernel_read_system_state(httpd_t)
 474 kernel_read_network_state(httpd_t)
 475 kernel_read_network_state(httpd_t)
 476 kernel_search_network_sysctl(httpd_t)
 477
 478 corenet_all_recvfrom_unlabeled(httpd_t)
 479 corenet_all_recvfrom_netlabel(httpd_t)
 480 corenet_tcp_sendrecv_generic_if(httpd_t)
 481 corenet_udp_sendrecv_generic_if(httpd_t)
 482 corenet_tcp_sendrecv_generic_node(httpd_t)
 483 corenet_udp_sendrecv_generic_node(httpd_t)
 484 corenet_tcp_sendrecv_all_ports(httpd_t)
 485 corenet_udp_sendrecv_all_ports(httpd_t)
 486 corenet_tcp_bind_generic_node(httpd_t)
 487 corenet_udp_bind_generic_node(httpd_t)
 488 corenet_tcp_bind_http_port(httpd_t)
 489 corenet_tcp_bind_http_cache_port(httpd_t)
 490 corenet_tcp_bind_ntop_port(httpd_t)
 491 corenet_tcp_bind_jboss_management_port(httpd_t)
 492 corenet_sendrecv_http_server_packets(httpd_t)
 493 corenet_tcp_bind_puppet_port(httpd_t)
 494 # Signal self for shutdown
 495 #corenet_tcp_connect_http_port(httpd_t)
 496
 497 dev_read_sysfs(httpd_t)
 498 dev_read_rand(httpd_t)
 499 dev_read_urand(httpd_t)
 500 dev_rw_crypto(httpd_t)
 501
 502 fs_getattr_all_fs(httpd_t)
 503 fs_search_auto_mountpoints(httpd_t)
 504 fs_read_iso9660_files(httpd_t)
 505 fs_read_anon_inodefs_files(httpd_t)
 506
 507 auth_use_nsswitch(httpd_t)
 508
 509 application_exec_all(httpd_t)
 510
 511 domain_use_interactive_fds(httpd_t)
 512
 513 files_dontaudit_getattr_all_pids(httpd_t)
 514 files_read_usr_files(httpd_t)
 515 files_list_mnt(httpd_t)
 516 files_search_spool(httpd_t)
 517 files_read_var_symlinks(httpd_t)
 518 files_read_var_lib_files(httpd_t)
 519 files_search_home(httpd_t)
 520 files_getattr_home_dir(httpd_t)
 521 # for modules that want to access /etc/mtab
 522 files_read_etc_runtime_files(httpd_t)
 523 # Allow httpd_t to have access to files such as nisswitch.conf
 524 files_read_etc_files(httpd_t)
 525 # for tomcat
 526 files_read_var_lib_symlinks(httpd_t)
 527
 528 fs_search_auto_mountpoints(httpd_sys_script_t)
 529 # php uploads a file to /tmp and then execs programs to acton them
 530 manage_dirs_pattern(httpd_sys_script_t, httpd_tmp_t, httpd_tmp_t)
 531 manage_files_pattern(httpd_sys_script_t, httpd_tmp_t, httpd_tmp_t)
 532 manage_sock_files_pattern(httpd_sys_script_t, httpd_tmp_t, httpd_tmp_t)
 533 manage_fifo_files_pattern(httpd_sys_script_t, httpd_tmp_t, httpd_tmp_t)
 534 manage_lnk_files_pattern(httpd_sys_script_t, httpd_tmp_t, httpd_tmp_t)
 535 files_tmp_filetrans(httpd_sys_script_t, httpd_sys_rw_content_t, { dir file lnk_file sock_file fifo_file })
 536
 537 libs_read_lib_files(httpd_t)
 538
 539 ifdef(`hide_broken_symptoms',`
 540         libs_exec_lib_files(httpd_t)
 541 ')
 542
 543 logging_send_syslog_msg(httpd_t)
 544
 545 miscfiles_read_localization(httpd_t)
 546 miscfiles_read_fonts(httpd_t)
 547 miscfiles_read_public_files(httpd_t)
 548 miscfiles_read_generic_certs(httpd_t)
 549 miscfiles_read_tetex_data(httpd_t)
 550
 551 seutil_dontaudit_search_config(httpd_t)
 552
 553 userdom_use_unpriv_users_fds(httpd_t)
 554
 555 tunable_policy(`httpd_setrlimit',`
 556         allow httpd_t self:process setrlimit;
 557         allow httpd_t self:capability sys_resource;
 558 ')
 559
 560 tunable_policy(`allow_httpd_anon_write',`
 561         miscfiles_manage_public_files(httpd_t)
 562 ')
 563
 564 #
 565 # We need optionals to be able to be within booleans to make this work
 566 #
 567 tunable_policy(`allow_httpd_mod_auth_pam',`
 568         auth_domtrans_chkpwd(httpd_t)
 569         logging_send_audit_msgs(httpd_t)
 570 ')
 571
 572 optional_policy(`
 573         tunable_policy(`allow_httpd_mod_auth_ntlm_winbind',`
 574                 samba_domtrans_winbind_helper(httpd_t)
 575         ')
 576 ')
 577
 578 tunable_policy(`httpd_can_network_connect',`
 579         corenet_tcp_connect_all_ports(httpd_t)
 580 ')
 581
 582 tunable_policy(`httpd_can_network_connect_db',`
 583         corenet_tcp_connect_firebird_port(httpd_t)
 584         corenet_tcp_connect_mssql_port(httpd_t)
 585         corenet_sendrecv_mssql_client_packets(httpd_t)
 586         corenet_tcp_connect_oracle_port(httpd_t)
 587         corenet_sendrecv_oracle_client_packets(httpd_t)
 588 ')
 589
 590 tunable_policy(`httpd_can_network_memcache',`
 591         corenet_tcp_connect_memcache_port(httpd_t)
 592 ')
 593
 594 tunable_policy(`httpd_can_network_relay',`
 595         # allow httpd to work as a relay
 596         corenet_tcp_connect_gopher_port(httpd_t)
 597         corenet_tcp_connect_ftp_port(httpd_t)
 598         corenet_tcp_connect_http_port(httpd_t)
 599         corenet_tcp_connect_http_cache_port(httpd_t)
 600         corenet_tcp_connect_squid_port(httpd_t)
 601         corenet_tcp_connect_memcache_port(httpd_t)
 602         corenet_sendrecv_gopher_client_packets(httpd_t)
 603         corenet_sendrecv_ftp_client_packets(httpd_t)
 604         corenet_sendrecv_http_client_packets(httpd_t)
 605         corenet_sendrecv_http_cache_client_packets(httpd_t)
 606         corenet_sendrecv_squid_client_packets(httpd_t)
 607         corenet_tcp_connect_all_ephemeral_ports(httpd_t)
 608 ')
 609
 610 tunable_policy(`httpd_execmem',`
 611         allow httpd_t self:process { execmem execstack };
 612         allow httpd_sys_script_t self:process { execmem execstack };
 613         allow httpd_suexec_t self:process { execmem execstack };
 614 ')
 615
 616 tunable_policy(`httpd_enable_cgi && httpd_unified',`
 617         allow httpd_sys_script_t httpd_sys_content_t:file entrypoint;
 618         filetrans_pattern(httpd_sys_script_t, httpd_sys_content_t, httpd_sys_rw_content_t, { file dir lnk_file })
 619         can_exec(httpd_sys_script_t, httpd_sys_content_t)
 620 ')
 621
 622 tunable_policy(`allow_httpd_sys_script_anon_write',`
 623         miscfiles_manage_public_files(httpd_sys_script_t)
 624 ')
 625
 626 tunable_policy(`httpd_enable_cgi && httpd_use_nfs',`
 627         fs_nfs_domtrans(httpd_t, httpd_sys_script_t)
 628 ')
 629
 630 tunable_policy(`httpd_enable_cgi && httpd_use_cifs',`
 631         fs_cifs_domtrans(httpd_t, httpd_sys_script_t)
 632 ')
 633
 634 tunable_policy(`httpd_enable_cgi && httpd_unified && httpd_builtin_scripting',`
 635         domtrans_pattern(httpd_t, httpdcontent, httpd_sys_script_t)
 636         filetrans_pattern(httpd_t, httpd_sys_content_t, httpd_sys_rw_content_t, { file dir lnk_file })
 637         manage_dirs_pattern(httpd_t, httpdcontent, httpd_sys_rw_content_t)
 638         manage_files_pattern(httpd_t, httpdcontent, httpd_sys_rw_content_t)
 639         manage_lnk_files_pattern(httpd_t, httpdcontent, httpd_sys_rw_content_t)
 640
 641         manage_dirs_pattern(httpd_t, httpdcontent, httpdcontent)
 642         manage_files_pattern(httpd_t, httpdcontent, httpdcontent)
 643         manage_lnk_files_pattern(httpd_t, httpdcontent, httpdcontent)
 644 ')
 645
 646 tunable_policy(`httpd_can_connect_ftp',`
 647         corenet_tcp_connect_ftp_port(httpd_t)
 648         corenet_tcp_connect_all_ephemeral_ports(httpd_t)
 649 ')
 650
 651 tunable_policy(`httpd_can_connect_ldap',`
 652     corenet_tcp_connect_ldap_port(httpd_t)
 653 ')
 654
 655 tunable_policy(`httpd_enable_ftp_server',`
 656         corenet_tcp_bind_ftp_port(httpd_t)
 657         corenet_tcp_bind_all_ephemeral_ports(httpd_t)
 658 ')
 659
 660 tunable_policy(`httpd_tmp_exec && httpd_builtin_scripting',`
 661         can_exec(httpd_t, httpd_tmp_t)
 662 ')
 663
 664 tunable_policy(`httpd_tmp_exec && httpd_enable_cgi',`
 665         can_exec(httpd_sys_script_t, httpd_tmp_t)
 666 ')
 667
 668 tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',`
 669         fs_list_auto_mountpoints(httpd_t)
 670         fs_read_nfs_files(httpd_t)
 671         fs_read_nfs_symlinks(httpd_t)
 672 ')
 673
 674 tunable_policy(`httpd_use_nfs',`
 675         fs_list_auto_mountpoints(httpd_t)
 676         fs_manage_nfs_dirs(httpd_t)
 677         fs_manage_nfs_files(httpd_t)
 678         fs_manage_nfs_symlinks(httpd_t)
 679 ')
 680
 681 tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',`
 682         fs_read_cifs_files(httpd_t)
 683         fs_read_cifs_symlinks(httpd_t)
 684 ')
 685
 686 tunable_policy(`httpd_can_sendmail',`
 687         # allow httpd to connect to mail servers
 688         corenet_tcp_connect_smtp_port(httpd_t)
 689         corenet_sendrecv_smtp_client_packets(httpd_t)
 690         corenet_tcp_connect_pop_port(httpd_t)
 691         corenet_sendrecv_pop_client_packets(httpd_t)
 692         mta_send_mail(httpd_t)
 693         mta_signal_system_mail(httpd_t)
 694 ')
 695
 696 tunable_policy(`httpd_use_cifs',`
 697         fs_manage_cifs_dirs(httpd_t)
 698         fs_manage_cifs_files(httpd_t)
 699         fs_manage_cifs_symlinks(httpd_t)
 700 ')
 701
 702 tunable_policy(`httpd_ssi_exec',`
 703         corecmd_shell_domtrans(httpd_t, httpd_sys_script_t)
 704         allow httpd_sys_script_t httpd_t:fd use;
 705         allow httpd_sys_script_t httpd_t:fifo_file rw_file_perms;
 706         allow httpd_sys_script_t httpd_t:process sigchld;
 707 ')
 708
 709 # When the admin starts the server, the server wants to access
 710 # the TTY or PTY associated with the session. The httpd appears
 711 # to run correctly without this permission, so the permission
 712 # are dontaudited here.
 713 tunable_policy(`httpd_tty_comm',`
 714         userdom_use_inherited_user_terminals(httpd_t)
 715         userdom_use_inherited_user_terminals(httpd_suexec_t)
 716 ',`
 717         userdom_dontaudit_use_user_terminals(httpd_t)
 718         userdom_dontaudit_use_user_terminals(httpd_suexec_t)
 719 ')
 720
 721 optional_policy(`
 722         # Support for ABRT retrace server
 723         # mod_wsgi
 724         abrt_manage_spool_retrace(httpd_t)
 725         abrt_domtrans_retrace_worker(httpd_t)
 726         abrt_read_config(httpd_t)
 727 ')
 728
 729 optional_policy(`
 730         calamaris_read_www_files(httpd_t)
 731 ')
 732
 733 optional_policy(`
 734         ccs_read_config(httpd_t)
 735 ')
 736
 737 optional_policy(`
 738         cobbler_list_config(httpd_t)
 739         cobbler_read_config(httpd_t)
 740         cobbler_read_lib_files(httpd_t)
 741
 742         tunable_policy(`httpd_can_network_connect_cobbler',`
 743                 corenet_tcp_connect_cobbler_port(httpd_t)
 744         ')
 745 ')
 746
 747 optional_policy(`
 748         cron_system_entry(httpd_t, httpd_exec_t)
 749 ')
 750
 751 optional_policy(`
 752         cvs_read_data(httpd_t)
 753 ')
 754
 755 optional_policy(`
 756         daemontools_service_domain(httpd_t, httpd_exec_t)
 757 ')
 758
 759 optional_policy(`
 760         dirsrv_manage_config(httpd_t)
 761         dirsrv_manage_log(httpd_t)
 762         dirsrv_manage_var_run(httpd_t)
 763         dirsrv_read_share(httpd_t)
 764         dirsrv_signal(httpd_t)
 765         dirsrv_signull(httpd_t)
 766         dirsrvadmin_manage_config(httpd_t)
 767         dirsrvadmin_manage_tmp(httpd_t)
 768         dirsrvadmin_domtrans_unconfined_script_t(httpd_t)
 769 ')
 770
 771 optional_policy(`
 772         dbus_system_bus_client(httpd_t)
 773
 774         tunable_policy(`httpd_dbus_avahi',`
 775                 avahi_dbus_chat(httpd_t)
 776         ')
 777 ')
 778
 779 optional_policy(`
 780         git_read_generic_system_content_files(httpd_t)
 781         gitosis_read_lib_files(httpd_t)
 782 ')
 783
 784 optional_policy(`
 785         tunable_policy(`httpd_enable_cgi && httpd_use_gpg',`
 786                 gpg_domtrans_web(httpd_t)
 787         ')
 788 ')
 789
 790 optional_policy(`
 791         kerberos_keytab_template(httpd, httpd_t)
 792 ')
 793
 794 optional_policy(`
 795         mailman_signal_cgi(httpd_t)
 796         mailman_domtrans_cgi(httpd_t)
 797         mailman_read_data_files(httpd_t)
 798         # should have separate types for public and private archives
 799         mailman_search_data(httpd_t)
 800         mailman_read_archive(httpd_t)
 801 ')
 802
 803 optional_policy(`
 804         mediawiki_read_tmp_files(httpd_t)
 805         mediawiki_delete_tmp_files(httpd_t)
 806 ')
 807
 808 optional_policy(`
 809         # Allow httpd to work with mysql
 810         mysql_read_config(httpd_t)
 811         mysql_stream_connect(httpd_t)
 812         mysql_rw_db_sockets(httpd_t)
 813
 814         tunable_policy(`httpd_can_network_connect_db',`
 815                 mysql_tcp_connect(httpd_t)
 816         ')
 817 ')
 818
 819 optional_policy(`
 820         nagios_read_config(httpd_t)
 821         nagios_read_log(httpd_t)
 822 ')
 823
 824 optional_policy(`
 825         openca_domtrans(httpd_t)
 826         openca_signal(httpd_t)
 827         openca_sigstop(httpd_t)
 828         openca_kill(httpd_t)
 829 ')
 830
 831 optional_policy(`
 832         passenger_domtrans(httpd_t)
 833         passenger_manage_pid_content(httpd_t)
 834         passenger_read_lib_files(httpd_t)
 835 ')
 836
 837 optional_policy(`
 838         puppet_read_lib(httpd_t)
 839 ')
 840
 841 optional_policy(`
 842         rpc_search_nfs_state_data(httpd_t)
 843 ')
 844
 845 optional_policy(`
 846         # Allow httpd to work with postgresql
 847         postgresql_stream_connect(httpd_t)
 848         postgresql_unpriv_client(httpd_t)
 849
 850         tunable_policy(`httpd_can_network_connect_db',`
 851                 postgresql_tcp_connect(httpd_t)
 852         ')
 853 ')
 854
 855 optional_policy(`
 856         seutil_sigchld_newrole(httpd_t)
 857 ')
 858
 859 optional_policy(`
 860         smokeping_read_lib_files(httpd_t)
 861 ')
 862
 863 optional_policy(`
 864         files_dontaudit_rw_usr_dirs(httpd_t)
 865         snmp_dontaudit_read_snmp_var_lib_files(httpd_t)
 866         snmp_dontaudit_write_snmp_var_lib_files(httpd_t)
 867 ')
 868
 869 optional_policy(`
 870         udev_read_db(httpd_t)
 871 ')
 872
 873 optional_policy(`
 874         yam_read_content(httpd_t)
 875 ')
 876
 877 optional_policy(`
 878         zarafa_manage_lib_files(httpd_t)
 879         zarafa_stream_connect_server(httpd_t)
 880         zarafa_search_config(httpd_t)
 881 ')
 882
 883 ########################################
 884 #
 885 # Apache helper local policy
 886 #
 887
 888 domtrans_pattern(httpd_t, httpd_helper_exec_t, httpd_helper_t)
 889
 890 allow httpd_helper_t httpd_config_t:file read_file_perms;
 891
 892 allow httpd_helper_t httpd_log_t:file append_file_perms;
 893
 894 logging_send_syslog_msg(httpd_helper_t)
 895
 896 userdom_use_inherited_user_terminals(httpd_helper_t)
 897
 898 tunable_policy(`httpd_tty_comm',`
 899         userdom_use_inherited_user_terminals(httpd_helper_t)
 900 ')
 901
 902 ########################################
 903 #
 904 # Apache PHP script local policy
 905 #
 906
 907 allow httpd_php_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
 908 allow httpd_php_t self:fd use;
 909 allow httpd_php_t self:fifo_file rw_fifo_file_perms;
 910 allow httpd_php_t self:sock_file read_sock_file_perms;
 911 allow httpd_php_t self:unix_dgram_socket create_socket_perms;
 912 allow httpd_php_t self:unix_stream_socket create_stream_socket_perms;
 913 allow httpd_php_t self:unix_dgram_socket sendto;
 914 allow httpd_php_t self:unix_stream_socket connectto;
 915 allow httpd_php_t self:shm create_shm_perms;
 916 allow httpd_php_t self:sem create_sem_perms;
 917 allow httpd_php_t self:msgq create_msgq_perms;
 918 allow httpd_php_t self:msg { send receive };
 919
 920 domtrans_pattern(httpd_t, httpd_php_exec_t, httpd_php_t)
 921
 922 # allow php to read and append to apache logfiles
 923 allow httpd_php_t httpd_log_t:file { read_file_perms append_file_perms };
 924
 925 manage_dirs_pattern(httpd_php_t, httpd_php_tmp_t, httpd_php_tmp_t)
 926 manage_files_pattern(httpd_php_t, httpd_php_tmp_t, httpd_php_tmp_t)
 927 files_tmp_filetrans(httpd_php_t, httpd_php_tmp_t, { file dir })
 928
 929 fs_search_auto_mountpoints(httpd_php_t)
 930
 931 auth_use_nsswitch(httpd_php_t)
 932
 933 libs_exec_lib_files(httpd_php_t)
 934
 935 userdom_use_unpriv_users_fds(httpd_php_t)
 936
 937 tunable_policy(`httpd_can_network_connect_db',`
 938         corenet_tcp_connect_firebird_port(httpd_php_t)
 939         corenet_tcp_connect_mssql_port(httpd_php_t)
 940         corenet_sendrecv_mssql_client_packets(httpd_php_t)
 941         corenet_tcp_connect_oracle_port(httpd_php_t)
 942         corenet_sendrecv_oracle_client_packets(httpd_php_t)
 943 ')
 944
 945 optional_policy(`
 946         mysql_stream_connect(httpd_php_t)
 947         mysql_rw_db_sockets(httpd_php_t)
 948         mysql_read_config(httpd_php_t)
 949
 950         tunable_policy(`httpd_can_network_connect_db',`
 951                 mysql_tcp_connect(httpd_php_t)
 952         ')
 953 ')
 954
 955 optional_policy(`
 956         postgresql_stream_connect(httpd_php_t)
 957         postgresql_unpriv_client(httpd_php_t)
 958
 959         tunable_policy(`httpd_can_network_connect_db',`
 960                 postgresql_tcp_connect(httpd_php_t)
 961         ')
 962 ')
 963
 964 ########################################
 965 #
 966 # Apache suexec local policy
 967 #
 968
 969 allow httpd_suexec_t self:capability { setuid setgid };
 970 allow httpd_suexec_t self:process signal_perms;
 971
 972 allow httpd_suexec_t self:fifo_file rw_fifo_file_perms;
 973 allow httpd_suexec_t self:unix_stream_socket create_stream_socket_perms;
 974
 975 domtrans_pattern(httpd_t, httpd_suexec_exec_t, httpd_suexec_t)
 976
 977 create_files_pattern(httpd_suexec_t, httpd_log_t, httpd_log_t)
 978 append_files_pattern(httpd_suexec_t, httpd_log_t, httpd_log_t)
 979 read_files_pattern(httpd_suexec_t, httpd_log_t, httpd_log_t)
 980
 981 allow httpd_suexec_t httpd_t:fifo_file read_fifo_file_perms;
 982
 983 manage_dirs_pattern(httpd_suexec_t, httpd_suexec_tmp_t, httpd_suexec_tmp_t)
 984 manage_files_pattern(httpd_suexec_t, httpd_suexec_tmp_t, httpd_suexec_tmp_t)
 985 files_tmp_filetrans(httpd_suexec_t, httpd_suexec_tmp_t, { file dir })
 986
 987 can_exec(httpd_suexec_t, httpd_sys_script_exec_t)
 988
 989 read_files_pattern(httpd_suexec_t, httpd_user_content_t, httpd_user_content_t)
 990 read_files_pattern(httpd_suexec_t, httpd_user_rw_content_t, httpd_user_rw_content_t)
 991 read_files_pattern(httpd_suexec_t, httpd_user_ra_content_t, httpd_user_ra_content_t)
 992
 993 kernel_read_kernel_sysctls(httpd_suexec_t)
 994 kernel_list_proc(httpd_suexec_t)
 995 kernel_read_proc_symlinks(httpd_suexec_t)
 996
 997 dev_read_urand(httpd_suexec_t)
 998
 999 fs_read_iso9660_files(httpd_suexec_t)
1000 fs_search_auto_mountpoints(httpd_suexec_t)
1001
1002 application_exec_all(httpd_suexec_t)
1003
1004 files_read_etc_files(httpd_suexec_t)
1005 files_read_usr_files(httpd_suexec_t)
1006 files_dontaudit_search_pids(httpd_suexec_t)
1007 files_search_home(httpd_suexec_t)
1008
1009 auth_use_nsswitch(httpd_suexec_t)
1010
1011 logging_search_logs(httpd_suexec_t)
1012 logging_send_syslog_msg(httpd_suexec_t)
1013
1014 miscfiles_read_localization(httpd_suexec_t)
1015 miscfiles_read_public_files(httpd_suexec_t)
1016
1017 tunable_policy(`httpd_can_network_connect',`
1018         allow httpd_suexec_t self:tcp_socket create_stream_socket_perms;
1019         allow httpd_suexec_t self:udp_socket create_socket_perms;
1020
1021         corenet_all_recvfrom_unlabeled(httpd_suexec_t)
1022         corenet_all_recvfrom_netlabel(httpd_suexec_t)
1023         corenet_tcp_sendrecv_generic_if(httpd_suexec_t)
1024         corenet_udp_sendrecv_generic_if(httpd_suexec_t)
1025         corenet_tcp_sendrecv_generic_node(httpd_suexec_t)
1026         corenet_udp_sendrecv_generic_node(httpd_suexec_t)
1027         corenet_tcp_sendrecv_all_ports(httpd_suexec_t)
1028         corenet_udp_sendrecv_all_ports(httpd_suexec_t)
1029         corenet_tcp_connect_all_ports(httpd_suexec_t)
1030         corenet_sendrecv_all_client_packets(httpd_suexec_t)
1031 ')
1032
1033 tunable_policy(`httpd_can_network_connect_db',`
1034         corenet_tcp_connect_firebird_port(httpd_suexec_t)
1035         corenet_tcp_connect_mssql_port(httpd_suexec_t)
1036         corenet_sendrecv_mssql_client_packets(httpd_suexec_t)
1037         corenet_tcp_connect_oracle_port(httpd_suexec_t)
1038         corenet_sendrecv_oracle_client_packets(httpd_suexec_t)
1039 ')
1040
1041 domain_entry_file(httpd_sys_script_t, httpd_sys_content_t)
1042
1043 tunable_policy(`httpd_can_sendmail',`
1044         mta_send_mail(httpd_suexec_t)
1045 ')
1046
1047 tunable_policy(`httpd_enable_cgi && httpd_unified',`
1048         allow httpd_sys_script_t httpdcontent:file entrypoint;
1049         domtrans_pattern(httpd_suexec_t, httpdcontent, httpd_sys_script_t)
1050         manage_dirs_pattern(httpd_sys_script_t, httpdcontent, httpdcontent)
1051         manage_files_pattern(httpd_sys_script_t, httpdcontent, httpdcontent)
1052         manage_sock_files_pattern(httpd_sys_script_t, httpdcontent, httpdcontent)
1053         manage_lnk_files_pattern(httpd_sys_script_t, httpdcontent, httpdcontent)
1054 ')
1055
1056 tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',`
1057         fs_list_auto_mountpoints(httpd_suexec_t)
1058         fs_read_nfs_files(httpd_suexec_t)
1059         fs_read_nfs_symlinks(httpd_suexec_t)
1060         fs_exec_nfs_files(httpd_suexec_t)
1061 ')
1062
1063 tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',`
1064         fs_read_cifs_files(httpd_suexec_t)
1065         fs_read_cifs_symlinks(httpd_suexec_t)
1066         fs_exec_cifs_files(httpd_suexec_t)
1067 ')
1068
1069 optional_policy(`
1070         mailman_domtrans_cgi(httpd_suexec_t)
1071 ')
1072
1073 optional_policy(`
1074         mta_stub(httpd_suexec_t)
1075
1076         # apache should set close-on-exec
1077         dontaudit httpd_suexec_t httpd_t:unix_stream_socket { read write };
1078 ')
1079
1080 optional_policy(`
1081         mysql_stream_connect(httpd_suexec_t)
1082         mysql_rw_db_sockets(httpd_suexec_t)
1083         mysql_read_config(httpd_suexec_t)
1084
1085         tunable_policy(`httpd_can_network_connect_db',`
1086                 mysql_tcp_connect(httpd_suexec_t)
1087         ')
1088 ')
1089
1090 optional_policy(`
1091         postgresql_stream_connect(httpd_suexec_t)
1092         postgresql_unpriv_client(httpd_suexec_t)
1093
1094         tunable_policy(`httpd_can_network_connect_db',`
1095                 postgresql_tcp_connect(httpd_suexec_t)
1096         ')
1097 ')
1098
1099 ########################################
1100 #
1101 # Apache system script local policy
1102 #
1103
1104 allow httpd_sys_script_t self:process getsched;
1105
1106 allow httpd_sys_script_t httpd_t:unix_stream_socket rw_stream_socket_perms;
1107 allow httpd_sys_script_t httpd_t:tcp_socket { read write };
1108
1109 dontaudit httpd_sys_script_t httpd_config_t:dir search;
1110
1111 allow httpd_sys_script_t httpd_squirrelmail_t:file { append_file_perms read_file_perms };
1112
1113 allow httpd_sys_script_t squirrelmail_spool_t:dir list_dir_perms;
1114 read_files_pattern(httpd_sys_script_t, squirrelmail_spool_t, squirrelmail_spool_t)
1115 read_lnk_files_pattern(httpd_sys_script_t, squirrelmail_spool_t, squirrelmail_spool_t)
1116
1117 kernel_read_kernel_sysctls(httpd_sys_script_t)
1118
1119 files_read_var_symlinks(httpd_sys_script_t)
1120 files_search_var_lib(httpd_sys_script_t)
1121 files_search_spool(httpd_sys_script_t)
1122
1123 logging_inherit_append_all_logs(httpd_sys_script_t)
1124
1125 # Should we add a boolean?
1126 apache_domtrans_rotatelogs(httpd_sys_script_t)
1127
1128 auth_use_nsswitch(httpd_sys_script_t)
1129
1130 ifdef(`distro_redhat',`
1131         allow httpd_sys_script_t httpd_log_t:file append_file_perms;
1132 ')
1133
1134 tunable_policy(`httpd_can_sendmail',`
1135         mta_send_mail(httpd_sys_script_t)
1136 ')
1137
1138 optional_policy(`
1139         tunable_policy(`httpd_can_sendmail && httpd_can_check_spam',`
1140                 spamassassin_domtrans_client(httpd_t)
1141         ')
1142 ')
1143
1144 tunable_policy(`httpd_can_network_connect_db',`
1145         corenet_tcp_connect_firebird_port(httpd_sys_script_t)
1146         corenet_tcp_connect_mssql_port(httpd_sys_script_t)
1147         corenet_sendrecv_mssql_client_packets(httpd_sys_script_t)
1148         corenet_tcp_connect_oracle_port(httpd_sys_script_t)
1149         corenet_sendrecv_oracle_client_packets(httpd_sys_script_t)
1150 ')
1151
1152 fs_cifs_entry_type(httpd_sys_script_t)
1153 fs_read_iso9660_files(httpd_sys_script_t)
1154 fs_nfs_entry_type(httpd_sys_script_t)
1155
1156 tunable_policy(`httpd_use_nfs',`
1157         fs_list_auto_mountpoints(httpd_sys_script_t)
1158         fs_manage_nfs_dirs(httpd_sys_script_t)
1159         fs_manage_nfs_files(httpd_sys_script_t)
1160         fs_manage_nfs_symlinks(httpd_sys_script_t)
1161         fs_exec_nfs_files(httpd_sys_script_t)
1162
1163         fs_list_auto_mountpoints(httpd_suexec_t)
1164         fs_manage_nfs_dirs(httpd_suexec_t)
1165         fs_manage_nfs_files(httpd_suexec_t)
1166         fs_manage_nfs_symlinks(httpd_suexec_t)
1167         fs_exec_nfs_files(httpd_suexec_t)
1168 ')
1169
1170 tunable_policy(`httpd_enable_cgi && httpd_can_network_connect',`
1171         allow httpd_sys_script_t self:tcp_socket create_stream_socket_perms;
1172         allow httpd_sys_script_t self:udp_socket create_socket_perms;
1173
1174         corenet_tcp_bind_generic_node(httpd_sys_script_t)
1175         corenet_udp_bind_generic_node(httpd_sys_script_t)
1176         corenet_all_recvfrom_unlabeled(httpd_sys_script_t)
1177         corenet_all_recvfrom_netlabel(httpd_sys_script_t)
1178         corenet_tcp_sendrecv_generic_if(httpd_sys_script_t)
1179         corenet_udp_sendrecv_generic_if(httpd_sys_script_t)
1180         corenet_tcp_sendrecv_generic_node(httpd_sys_script_t)
1181         corenet_udp_sendrecv_generic_node(httpd_sys_script_t)
1182         corenet_tcp_sendrecv_all_ports(httpd_sys_script_t)
1183         corenet_udp_sendrecv_all_ports(httpd_sys_script_t)
1184         corenet_tcp_connect_all_ports(httpd_sys_script_t)
1185         corenet_sendrecv_all_client_packets(httpd_sys_script_t)
1186 ')
1187
1188 tunable_policy(`httpd_enable_homedirs',`
1189         userdom_search_user_home_dirs(httpd_sys_script_t)
1190 ')
1191
1192 tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',`
1193         fs_list_auto_mountpoints(httpd_sys_script_t)
1194         fs_read_nfs_files(httpd_sys_script_t)
1195         fs_read_nfs_symlinks(httpd_sys_script_t)
1196 ')
1197
1198 tunable_policy(`httpd_read_user_content',`
1199         userdom_read_user_home_content_files(httpd_sys_script_t)
1200 ')
1201
1202 tunable_policy(`httpd_use_cifs',`
1203         fs_manage_cifs_dirs(httpd_sys_script_t)
1204         fs_manage_cifs_files(httpd_sys_script_t)
1205         fs_manage_cifs_symlinks(httpd_sys_script_t)
1206         fs_manage_cifs_dirs(httpd_suexec_t)
1207         fs_manage_cifs_files(httpd_suexec_t)
1208         fs_manage_cifs_symlinks(httpd_suexec_t)
1209         fs_exec_cifs_files(httpd_suexec_t)
1210 ')
1211
1212 tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',`
1213         fs_read_cifs_files(httpd_sys_script_t)
1214         fs_read_cifs_symlinks(httpd_sys_script_t)
1215 ')
1216
1217 optional_policy(`
1218         clamav_domtrans_clamscan(httpd_sys_script_t)
1219 ')
1220
1221 optional_policy(`
1222         mysql_stream_connect(httpd_sys_script_t)
1223         mysql_rw_db_sockets(httpd_sys_script_t)
1224         mysql_read_config(httpd_sys_script_t)
1225
1226         tunable_policy(`httpd_can_network_connect_db',`
1227                 mysql_tcp_connect(httpd_sys_script_t)
1228         ')
1229 ')
1230
1231 optional_policy(`
1232         postgresql_stream_connect(httpd_sys_script_t)
1233         postgresql_unpriv_client(httpd_sys_script_t)
1234
1235         tunable_policy(`httpd_can_network_connect_db',`
1236                 postgresql_tcp_connect(httpd_sys_script_t)
1237         ')
1238 ')
1239
1240 ########################################
1241 #
1242 # httpd_rotatelogs local policy
1243 #
1244
1245 allow httpd_rotatelogs_t self:capability dac_override;
1246
1247 manage_files_pattern(httpd_rotatelogs_t, httpd_log_t, httpd_log_t)
1248
1249 kernel_read_kernel_sysctls(httpd_rotatelogs_t)
1250 kernel_dontaudit_list_proc(httpd_rotatelogs_t)
1251 kernel_dontaudit_read_proc_symlinks(httpd_rotatelogs_t)
1252
1253 files_read_etc_files(httpd_rotatelogs_t)
1254
1255 logging_search_logs(httpd_rotatelogs_t)
1256
1257 miscfiles_read_localization(httpd_rotatelogs_t)
1258
1259 ########################################
1260 #
1261 # Unconfined script local policy
1262 #
1263
1264 optional_policy(`
1265         type httpd_unconfined_script_t;
1266         type httpd_unconfined_script_exec_t;
1267         domain_type(httpd_unconfined_script_t)
1268         domain_entry_file(httpd_unconfined_script_t, httpd_unconfined_script_exec_t)
1269         domtrans_pattern(httpd_t, httpd_unconfined_script_exec_t, httpd_unconfined_script_t)
1270         unconfined_domain(httpd_unconfined_script_t)
1271
1272         role system_r types httpd_unconfined_script_t;
1273         allow httpd_t httpd_unconfined_script_t:process signal_perms;
1274 ')
1275
1276 ########################################
1277 #
1278 # User content local policy
1279 #
1280
1281 tunable_policy(`httpd_enable_cgi && httpd_unified',`
1282         allow httpd_user_script_t httpdcontent:file entrypoint;
1283         manage_dirs_pattern(httpd_user_script_t, httpd_user_content_t, httpd_user_content_t)
1284         manage_files_pattern(httpd_user_script_t, httpd_user_content_t, httpd_user_content_t)
1285         manage_dirs_pattern(httpd_user_script_t, httpd_user_ra_content_t, httpd_user_ra_content_t)
1286         manage_files_pattern(httpd_user_script_t, httpd_user_ra_content_t, httpd_user_ra_content_t)
1287 ')
1288
1289 # allow accessing files/dirs below the users home dir
1290 tunable_policy(`httpd_enable_homedirs',`
1291         userdom_search_user_home_content(httpd_t)
1292         userdom_search_user_home_content(httpd_suexec_t)
1293         userdom_search_user_home_content(httpd_user_script_t)
1294 ')
1295
1296 tunable_policy(`httpd_read_user_content',`
1297         userdom_read_user_home_content_files(httpd_t)
1298         userdom_read_user_home_content_files(httpd_suexec_t)
1299         userdom_read_user_home_content_files(httpd_user_script_t)
1300 ')
1301
1302 ########################################
1303 #
1304 # httpd_passwd local policy
1305 #
1306
1307 allow httpd_passwd_t self:fifo_file manage_fifo_file_perms;
1308 allow httpd_passwd_t self:unix_stream_socket create_stream_socket_perms;
1309 allow httpd_passwd_t self:unix_dgram_socket create_socket_perms;
1310
1311 domain_use_interactive_fds(httpd_passwd_t)
1312
1313 files_read_etc_files(httpd_passwd_t)
1314
1315 miscfiles_read_localization(httpd_passwd_t)
1316
1317 corecmd_exec_bin(httpd_passwd_t)
1318
1319 kernel_read_system_state(httpd_passwd_t)
1320
1321 dev_read_urand(httpd_passwd_t)
1322
1323 systemd_manage_passwd_run(httpd_t)
1324 #systemd_passwd_agent_dev_template(httpd)
1325
1326 domtrans_pattern(httpd_t, httpd_passwd_exec_t, httpd_passwd_t)
1327 dontaudit httpd_passwd_t httpd_config_t:file read;
1328
1329
1330 search_dirs_pattern(httpd_script_type, httpd_sys_content_t, httpd_script_exec_type)
1331 corecmd_shell_entry_type(httpd_script_type)
1332
1333 allow httpd_script_type self:fifo_file rw_file_perms;
1334 allow httpd_script_type self:unix_stream_socket connectto;
1335
1336 allow httpd_script_type httpd_t:fifo_file write;
1337 # apache should set close-on-exec
1338 apache_dontaudit_leaks(httpd_script_type)
1339
1340 append_files_pattern(httpd_script_type, httpd_log_t, httpd_log_t)
1341 logging_search_logs(httpd_script_type)
1342
1343 kernel_dontaudit_search_sysctl(httpd_script_type)
1344 kernel_dontaudit_search_kernel_sysctl(httpd_script_type)
1345
1346 dev_read_rand(httpd_script_type)
1347 dev_read_urand(httpd_script_type)
1348
1349 corecmd_exec_all_executables(httpd_script_type)
1350 application_exec_all(httpd_script_type)
1351
1352 files_exec_etc_files(httpd_script_type)
1353 files_read_etc_files(httpd_script_type)
1354 files_search_home(httpd_script_type)
1355
1356 libs_exec_ld_so(httpd_script_type)
1357 libs_exec_lib_files(httpd_script_type)
1358
1359 miscfiles_read_fonts(httpd_script_type)
1360 miscfiles_read_public_files(httpd_script_type)
1361
1362 seutil_dontaudit_search_config(httpd_script_type)
1363 allow httpd_t httpd_script_type:unix_stream_socket connectto;
1364
1365 allow httpd_t httpd_script_exec_type:file read_file_perms;
1366 allow httpd_t httpd_script_exec_type:lnk_file read_lnk_file_perms;
1367 allow httpd_t httpd_script_type:process { signal sigkill sigstop };
1368 allow httpd_t httpd_script_exec_type:dir list_dir_perms;
1369
1370 allow httpd_script_type self:process { setsched signal_perms };
1371 allow httpd_script_type self:unix_stream_socket create_stream_socket_perms;
1372 allow httpd_script_type self:unix_dgram_socket create_socket_perms;
1373
1374 allow httpd_script_type httpd_t:fd use;
1375 allow httpd_script_type httpd_t:process sigchld;
1376
1377 dontaudit httpd_script_type httpd_t:tcp_socket { read write };
1378
1379 kernel_read_system_state(httpd_script_type)
1380
1381 dev_read_urand(httpd_script_type)
1382
1383 fs_getattr_xattr_fs(httpd_script_type)
1384
1385 files_read_etc_runtime_files(httpd_script_type)
1386 files_read_usr_files(httpd_script_type)
1387
1388 libs_read_lib_files(httpd_script_type)
1389
1390 miscfiles_read_localization(httpd_script_type)
1391 allow httpd_script_type httpd_sys_content_t:dir search_dir_perms;
1392
1393 tunable_policy(`httpd_enable_cgi && allow_ypbind',`
1394         nis_use_ypbind_uncond(httpd_script_type)
1395 ')
1396
1397 optional_policy(`
1398         nscd_socket_use(httpd_script_type)
1399 ')
1400
1401 read_files_pattern(httpd_t, httpd_content_type, httpd_content_type)
1402
1403 tunable_policy(`httpd_builtin_scripting',`
1404         allow httpd_t httpd_content_type:dir search_dir_perms;
1405         allow httpd_suexec_t httpd_content_type:dir search_dir_perms;
1406
1407         allow httpd_t httpd_content_type:dir list_dir_perms;
1408         read_files_pattern(httpd_t, httpd_content_type, httpd_content_type)
1409         read_lnk_files_pattern(httpd_t, httpd_content_type, httpd_content_type)
1410
1411         allow httpd_t httpd_content_type:dir list_dir_perms;
1412         read_files_pattern(httpd_t, httpd_content_type, httpd_content_type)
1413         read_lnk_files_pattern(httpd_t, httpd_content_type, httpd_content_type)
1414 ')