policy/modules/services/rsync.te

   1 policy_module(rsync, 1.10.0)
   2
   3 ########################################
   4 #
   5 # Declarations
   6 #
   7
   8 ## <desc>
   9 ## <p>
  10 ## Allow rsync to run as a client
  11 ## </p>
  12 ## </desc>
  13 gen_tunable(rsync_client, false)
  14
  15 ## <desc>
  16 ## <p>
  17 ## Allow rsync to export any files/directories read only.
  18 ## </p>
  19 ## </desc>
  20 gen_tunable(rsync_export_all_ro, false)
  21
  22 ## <desc>
  23 ## <p>
  24 ## Allow rsync to modify public files
  25 ## used for public file transfer services.  Files/Directories must be
  26 ## labeled public_content_rw_t.
  27 ## </p>
  28 ## </desc>
  29 gen_tunable(allow_rsync_anon_write, false)
  30
  31 type rsync_t;
  32 type rsync_exec_t;
  33 application_executable_file(rsync_exec_t)
  34 role system_r types rsync_t;
  35
  36 type rsync_etc_t;
  37 files_config_file(rsync_etc_t)
  38
  39 type rsync_data_t;
  40 files_type(rsync_data_t)
  41
  42 type rsync_log_t;
  43 logging_log_file(rsync_log_t)
  44
  45 type rsync_tmp_t;
  46 files_tmp_file(rsync_tmp_t)
  47
  48 type rsync_var_run_t;
  49 files_pid_file(rsync_var_run_t)
  50
  51 ########################################
  52 #
  53 # Local policy
  54 #
  55
  56 allow rsync_t self:capability { chown dac_read_search dac_override fowner fsetid setuid setgid sys_chroot };
  57 allow rsync_t self:process signal_perms;
  58 allow rsync_t self:fifo_file rw_fifo_file_perms;
  59 allow rsync_t self:tcp_socket create_stream_socket_perms;
  60 allow rsync_t self:udp_socket connected_socket_perms;
  61
  62 # for identd
  63 # cjp: this should probably only be inetd_child_t rules?
  64 # search home and kerberos also.
  65 allow rsync_t self:netlink_tcpdiag_socket r_netlink_socket_perms;
  66 #end for identd
  67
  68 read_files_pattern(rsync_t, rsync_etc_t, rsync_etc_t)
  69
  70 allow rsync_t rsync_data_t:dir list_dir_perms;
  71 read_files_pattern(rsync_t, rsync_data_t, rsync_data_t)
  72 read_lnk_files_pattern(rsync_t, rsync_data_t, rsync_data_t)
  73
  74 manage_files_pattern(rsync_t, rsync_log_t, rsync_log_t)
  75 logging_log_filetrans(rsync_t, rsync_log_t, file)
  76
  77 manage_dirs_pattern(rsync_t, rsync_tmp_t, rsync_tmp_t)
  78 manage_files_pattern(rsync_t, rsync_tmp_t, rsync_tmp_t)
  79 files_tmp_filetrans(rsync_t, rsync_tmp_t, { file dir })
  80
  81 manage_files_pattern(rsync_t, rsync_var_run_t, rsync_var_run_t)
  82 files_pid_filetrans(rsync_t, rsync_var_run_t, file)
  83
  84 kernel_read_kernel_sysctls(rsync_t)
  85 kernel_read_system_state(rsync_t)
  86 kernel_read_network_state(rsync_t)
  87
  88 corenet_all_recvfrom_unlabeled(rsync_t)
  89 corenet_all_recvfrom_netlabel(rsync_t)
  90 corenet_tcp_sendrecv_generic_if(rsync_t)
  91 corenet_udp_sendrecv_generic_if(rsync_t)
  92 corenet_tcp_sendrecv_generic_node(rsync_t)
  93 corenet_udp_sendrecv_generic_node(rsync_t)
  94 corenet_tcp_sendrecv_all_ports(rsync_t)
  95 corenet_udp_sendrecv_all_ports(rsync_t)
  96 corenet_tcp_bind_generic_node(rsync_t)
  97 corenet_tcp_bind_rsync_port(rsync_t)
  98 corenet_sendrecv_rsync_server_packets(rsync_t)
  99
 100 dev_read_urand(rsync_t)
 101
 102 fs_getattr_xattr_fs(rsync_t)
 103
 104 files_read_etc_files(rsync_t)
 105 files_search_home(rsync_t)
 106
 107 auth_use_nsswitch(rsync_t)
 108
 109 logging_send_syslog_msg(rsync_t)
 110
 111 miscfiles_read_localization(rsync_t)
 112 miscfiles_read_public_files(rsync_t)
 113
 114 tunable_policy(`allow_rsync_anon_write',`
 115         miscfiles_manage_public_files(rsync_t)
 116 ')
 117
 118 optional_policy(`
 119         daemontools_service_domain(rsync_t, rsync_exec_t)
 120 ')
 121
 122 optional_policy(`
 123         kerberos_use(rsync_t)
 124 ')
 125
 126 optional_policy(`
 127         inetd_service_domain(rsync_t, rsync_exec_t)
 128 ')
 129
 130 tunable_policy(`rsync_export_all_ro',`
 131         files_getattr_all_pipes(rsync_t)
 132         fs_read_noxattr_fs_files(rsync_t)
 133         fs_read_nfs_files(rsync_t)
 134         fs_read_cifs_files(rsync_t)
 135         auth_read_all_dirs_except_shadow(rsync_t)
 136         auth_read_all_files_except_shadow(rsync_t)
 137         auth_read_all_symlinks_except_shadow(rsync_t)
 138         auth_tunable_read_shadow(rsync_t)
 139 ')
 140
 141 tunable_policy(`rsync_client',`
 142         corenet_tcp_connect_rsync_port(rsync_t)
 143         corenet_tcp_connect_ssh_port(rsync_t)
 144         manage_dirs_pattern(rsync_t, rsync_data_t, rsync_data_t)
 145         manage_files_pattern(rsync_t, rsync_data_t, rsync_data_t)
 146         manage_lnk_files_pattern(rsync_t, rsync_data_t, rsync_data_t)
 147 ')
 148
 149 optional_policy(`
 150         tunable_policy(`rsync_client',`
 151                 ssh_exec(rsync_t)
 152         ')
 153 ')
 154
 155 auth_can_read_shadow_passwords(rsync_t)