policy/modules/services/sssd.te

   1 policy_module(sssd, 1.1.0)
   2
   3 ########################################
   4 #
   5 # Declarations
   6 #
   7
   8 type sssd_t;
   9 type sssd_exec_t;
  10 init_daemon_domain(sssd_t, sssd_exec_t)
  11
  12 type sssd_initrc_exec_t;
  13 init_script_file(sssd_initrc_exec_t)
  14
  15 type sssd_public_t;
  16 files_pid_file(sssd_public_t)
  17
  18 type sssd_var_lib_t;
  19 files_type(sssd_var_lib_t)
  20 mls_trusted_object(sssd_var_lib_t)
  21
  22 type sssd_var_log_t;
  23 logging_log_file(sssd_var_log_t)
  24
  25 type sssd_var_run_t;
  26 files_pid_file(sssd_var_run_t)
  27
  28 ########################################
  29 #
  30 # sssd local policy
  31 #
  32
  33 allow sssd_t self:capability { chown dac_read_search dac_override kill net_admin sys_nice setgid setuid sys_admin };
  34 allow sssd_t self:process { setfscreate setsched sigkill signal getsched };
  35 allow sssd_t self:fifo_file rw_fifo_file_perms;
  36 allow sssd_t self:key manage_key_perms;
  37 allow sssd_t self:unix_stream_socket { create_stream_socket_perms connectto };
  38
  39 manage_dirs_pattern(sssd_t, sssd_public_t, sssd_public_t)
  40 manage_files_pattern(sssd_t, sssd_public_t, sssd_public_t)
  41
  42 manage_dirs_pattern(sssd_t, sssd_var_lib_t, sssd_var_lib_t)
  43 manage_files_pattern(sssd_t, sssd_var_lib_t, sssd_var_lib_t)
  44 manage_lnk_files_pattern(sssd_t, sssd_var_lib_t, sssd_var_lib_t)
  45 manage_sock_files_pattern(sssd_t, sssd_var_lib_t, sssd_var_lib_t)
  46 files_var_lib_filetrans(sssd_t, sssd_var_lib_t, { file dir })
  47
  48 manage_files_pattern(sssd_t, sssd_var_log_t, sssd_var_log_t)
  49 logging_log_filetrans(sssd_t, sssd_var_log_t, file)
  50
  51 manage_dirs_pattern(sssd_t, sssd_var_run_t, sssd_var_run_t)
  52 manage_files_pattern(sssd_t, sssd_var_run_t, sssd_var_run_t)
  53 files_pid_filetrans(sssd_t, sssd_var_run_t, { file dir })
  54
  55 kernel_read_network_state(sssd_t)
  56 kernel_read_system_state(sssd_t)
  57
  58 corenet_udp_bind_generic_port(sssd_t)
  59 corenet_dontaudit_udp_bind_all_ports(sssd_t)
  60
  61 corecmd_exec_bin(sssd_t)
  62
  63 dev_read_urand(sssd_t)
  64 dev_read_sysfs(sssd_t)
  65
  66 domain_read_all_domains_state(sssd_t)
  67 domain_obj_id_change_exemption(sssd_t)
  68
  69 files_list_tmp(sssd_t)
  70 files_read_etc_files(sssd_t)
  71 files_read_usr_files(sssd_t)
  72 files_list_var_lib(sssd_t)
  73
  74 fs_list_inotifyfs(sssd_t)
  75
  76 selinux_validate_context(sssd_t)
  77
  78 seutil_read_file_contexts(sssd_t)
  79
  80 mls_file_read_to_clearance(sssd_t)
  81 mls_socket_read_to_clearance(sssd_t)
  82 mls_socket_write_to_clearance(sssd_t)
  83 mls_trusted_object(sssd_t)
  84
  85 # auth_use_nsswitch(sssd_t)
  86 auth_domtrans_chk_passwd(sssd_t)
  87 auth_domtrans_upd_passwd(sssd_t)
  88
  89 init_read_utmp(sssd_t)
  90
  91 logging_send_syslog_msg(sssd_t)
  92 logging_send_audit_msgs(sssd_t)
  93
  94 miscfiles_read_localization(sssd_t)
  95 miscfiles_read_generic_certs(sssd_t)
  96
  97 sysnet_dns_name_resolve(sssd_t)
  98 sysnet_use_ldap(sssd_t)
  99
 100 userdom_manage_tmp_role(system_r, sssd_t)
 101
 102 optional_policy(`
 103         dbus_system_bus_client(sssd_t)
 104         dbus_connect_system_bus(sssd_t)
 105 ')
 106
 107 optional_policy(`
 108         kerberos_manage_host_rcache(sssd_t)
 109         kerberos_read_home_content(sssd_t)
 110 ')
 111
 112 optional_policy(`
 113         dirsrv_stream_connect(sssd_t)
 114 ')
 115
 116 optional_policy(`
 117         ldap_stream_connect(sssd_t)
 118 ')
 119
 120 userdom_home_reader(sssd_t)
 121
 122
 123