policy/modules/services/boinc.te

   1 policy_module(boinc, 1.0.0)
   2
   3 ########################################
   4 #
   5 # Declarations
   6 #
   7
   8 attribute boinc_domain;
   9
  10 type boinc_t, boinc_domain;
  11 type boinc_exec_t;
  12 init_daemon_domain(boinc_t, boinc_exec_t)
  13
  14 type boinc_initrc_exec_t;
  15 init_script_file(boinc_initrc_exec_t)
  16
  17 type boinc_tmp_t;
  18 files_tmp_file(boinc_tmp_t)
  19
  20 type boinc_tmpfs_t;
  21 files_tmpfs_file(boinc_tmpfs_t)
  22
  23 type boinc_var_lib_t;
  24 files_type(boinc_var_lib_t)
  25
  26 type boinc_project_t;
  27 domain_type(boinc_project_t)
  28 role system_r types boinc_project_t;
  29
  30 type boinc_project_tmp_t;
  31 files_tmp_file(boinc_project_tmp_t)
  32
  33 type boinc_project_var_lib_t;
  34 files_type(boinc_project_var_lib_t)
  35
  36 #######################################
  37 #
  38 # boinc domain local policy
  39 #
  40
  41 allow boinc_domain self:fifo_file rw_fifo_file_perms;
  42 allow boinc_domain self:sem create_sem_perms;
  43
  44 # needs read /proc/interrupts
  45 kernel_read_system_state(boinc_domain)
  46
  47 corecmd_exec_bin(boinc_domain)
  48 corecmd_exec_shell(boinc_domain)
  49
  50 dev_read_rand(boinc_domain)
  51 dev_read_urand(boinc_domain)
  52 dev_read_sysfs(boinc_domain)
  53 dev_rw_xserver_misc(boinc_domain)
  54
  55 domain_read_all_domains_state(boinc_domain)
  56
  57 files_read_etc_files(boinc_domain)
  58 files_read_etc_runtime_files(boinc_domain)
  59 files_read_usr_files(boinc_domain)
  60
  61 miscfiles_read_fonts(boinc_domain)
  62 miscfiles_read_localization(boinc_domain)
  63
  64 optional_policy(`
  65         sysnet_dns_name_resolve(boinc_domain)
  66 ')
  67
  68 ########################################
  69 #
  70 # boinc local policy
  71 #
  72
  73 allow boinc_t self:process { setsched sigkill };
  74
  75 allow boinc_t self:unix_stream_socket create_stream_socket_perms;
  76 allow boinc_t self:tcp_socket create_stream_socket_perms;
  77 allow boinc_t self:shm create_shm_perms;
  78
  79 manage_dirs_pattern(boinc_t, boinc_tmp_t, boinc_tmp_t)
  80 manage_files_pattern(boinc_t, boinc_tmp_t, boinc_tmp_t)
  81 files_tmp_filetrans(boinc_t, boinc_tmp_t, { dir file })
  82
  83 manage_files_pattern(boinc_t, boinc_tmpfs_t, boinc_tmpfs_t)
  84 fs_tmpfs_filetrans(boinc_t, boinc_tmpfs_t, file)
  85
  86 exec_files_pattern(boinc_t, boinc_var_lib_t, boinc_var_lib_t)
  87 manage_dirs_pattern(boinc_t, boinc_var_lib_t, boinc_var_lib_t)
  88 manage_files_pattern(boinc_t, boinc_var_lib_t, boinc_var_lib_t)
  89 filetrans_pattern(boinc_t, boinc_var_lib_t, boinc_project_var_lib_t, dir)
  90
  91 manage_dirs_pattern(boinc_t, boinc_project_var_lib_t, boinc_project_var_lib_t)
  92 manage_files_pattern(boinc_t, boinc_project_var_lib_t, boinc_project_var_lib_t)
  93
  94 files_getattr_all_dirs(boinc_t)
  95 files_getattr_all_files(boinc_t)
  96
  97 corenet_all_recvfrom_unlabeled(boinc_t)
  98 corenet_all_recvfrom_netlabel(boinc_t)
  99 corenet_tcp_sendrecv_generic_if(boinc_t)
 100 corenet_udp_sendrecv_generic_if(boinc_t)
 101 corenet_tcp_sendrecv_generic_node(boinc_t)
 102 corenet_udp_sendrecv_generic_node(boinc_t)
 103 corenet_tcp_sendrecv_all_ports(boinc_t)
 104 corenet_udp_sendrecv_all_ports(boinc_t)
 105 corenet_tcp_bind_generic_node(boinc_t)
 106 corenet_udp_bind_generic_node(boinc_t)
 107 corenet_tcp_bind_boinc_port(boinc_t)
 108 corenet_tcp_bind_boinc_client_ctrl_port(boinc_t)
 109 corenet_tcp_connect_boinc_port(boinc_t)
 110 corenet_tcp_connect_http_port(boinc_t)
 111 corenet_tcp_connect_http_cache_port(boinc_t)
 112
 113 files_dontaudit_getattr_boot_dirs(boinc_t)
 114
 115 fs_getattr_all_fs(boinc_t)
 116
 117 term_getattr_all_ptys(boinc_t)
 118 term_getattr_unallocated_ttys(boinc_t)
 119
 120 init_read_utmp(boinc_t)
 121
 122 logging_send_syslog_msg(boinc_t)
 123
 124 optional_policy(`
 125         mta_send_mail(boinc_t)
 126 ')
 127
 128 ########################################
 129 #
 130 # boinc-projects local policy
 131 #
 132
 133 domtrans_pattern(boinc_t, boinc_project_var_lib_t, boinc_project_t)
 134 allow boinc_t boinc_project_t:process sigkill;
 135
 136 allow boinc_project_t self:process { setpgid setsched signal signull sigkill sigstop };
 137 allow boinc_project_t self:process { execmem execstack };
 138
 139 tunable_policy(`deny_ptrace',`',`
 140         allow boinc_project_t self:process ptrace;
 141 ')
 142
 143 manage_dirs_pattern(boinc_project_t, boinc_project_tmp_t, boinc_project_tmp_t)
 144 manage_files_pattern(boinc_project_t, boinc_project_tmp_t, boinc_project_tmp_t)
 145 files_tmp_filetrans(boinc_project_t, boinc_project_tmp_t, { dir file })
 146
 147 allow boinc_project_t boinc_project_var_lib_t:file entrypoint;
 148 exec_files_pattern(boinc_project_t, boinc_project_var_lib_t, boinc_project_var_lib_t)
 149 manage_dirs_pattern(boinc_project_t, boinc_project_var_lib_t, boinc_project_var_lib_t)
 150 manage_files_pattern(boinc_project_t, boinc_project_var_lib_t, boinc_project_var_lib_t)
 151 files_var_lib_filetrans(boinc_project_t, boinc_project_var_lib_t, { file dir })
 152
 153 allow boinc_project_t boinc_project_var_lib_t:file execmod;
 154
 155 allow boinc_project_t boinc_t:shm rw_shm_perms;
 156 allow boinc_project_t boinc_tmpfs_t:file rw_inherited_file_perms;
 157
 158 list_dirs_pattern(boinc_project_t, boinc_var_lib_t, boinc_var_lib_t)
 159 rw_files_pattern(boinc_project_t, boinc_var_lib_t, boinc_var_lib_t)
 160
 161 kernel_read_kernel_sysctls(boinc_project_t)
 162 kernel_search_vm_sysctl(boinc_project_t)
 163 kernel_read_network_state(boinc_project_t)
 164
 165 corenet_tcp_connect_boinc_port(boinc_project_t)
 166
 167 files_dontaudit_search_home(boinc_project_t)
 168
 169 optional_policy(`
 170         java_exec(boinc_project_t)
 171 ')