[refpolicy] add policy for haproxy

Jan-Frode Myklebust janfrode at tanso.net
Wed Mar 18 17:35:22 CDT 2009


Here's a patch for adding policy for  Willy Tarreau's haproxy
http://haproxy.1wt.eu/. Please apply to subversion HEAD of reference
policy, thanks!

When building this policy on RHEL5-latest, I also needed the following
allow rule:

	allow haproxy_t unlabeled_t:packet { send recv };

This wasn't needed on fedora10, so I assume it was because of the older
policy on RHEL5.



   -jf
-------------- next part --------------
From 1c436d3ba9c98fcf2ffdefa216f63e8c7a63286c Mon Sep 17 00:00:00 2001
From: Jan-Frode Myklebust <janfrode at tanso.net>
Date: Wed, 18 Mar 2009 23:14:39 +0100
Subject: [PATCH] Add policy for haproxy:

	 http://haproxy.1wt.eu/
---
 policy/modules/services/haproxy.fc |    6 ++++
 policy/modules/services/haproxy.if |    2 +
 policy/modules/services/haproxy.te |   56 ++++++++++++++++++++++++++++++++++++
 3 files changed, 64 insertions(+), 0 deletions(-)
 create mode 100644 policy/modules/services/haproxy.fc
 create mode 100644 policy/modules/services/haproxy.if
 create mode 100644 policy/modules/services/haproxy.te

diff --git a/policy/modules/services/haproxy.fc b/policy/modules/services/haproxy.fc
new file mode 100644
index 0000000..63a0828
--- /dev/null
+++ b/policy/modules/services/haproxy.fc
@@ -0,0 +1,6 @@
+# haproxy labeling policy
+# file: haproxy.fc
+/usr/sbin/haproxy           -- gen_context(system_u:object_r:haproxy_exec_t, s0)
+/etc/haproxy/haproxy\.cfg   -- gen_context(system_u:object_r:haproxy_conf_t, s0)
+/var/run/haproxy\.pid       -- gen_context(system_u:object_r:haproxy_var_run_t, s0)
+/var/run/haproxy\.sock(.*)  -- gen_context(system_u:object_r:haproxy_var_run_t, s0)
diff --git a/policy/modules/services/haproxy.if b/policy/modules/services/haproxy.if
new file mode 100644
index 0000000..236ad38
--- /dev/null
+++ b/policy/modules/services/haproxy.if
@@ -0,0 +1,2 @@
+## <summary>selinux policy module for haproxy</summary>
+
diff --git a/policy/modules/services/haproxy.te b/policy/modules/services/haproxy.te
new file mode 100644
index 0000000..126c08d
--- /dev/null
+++ b/policy/modules/services/haproxy.te
@@ -0,0 +1,56 @@
+policy_module(haproxy,1.0.0) 
+
+########################################
+#
+# Declarations
+#
+
+type haproxy_t;
+type haproxy_exec_t;
+type haproxy_port_t;
+init_daemon_domain(haproxy_t, haproxy_exec_t)
+
+type haproxy_var_run_t;
+files_pid_file(haproxy_var_run_t)
+
+type haproxy_conf_t;
+files_config_file(haproxy_conf_t)
+
+########################################
+#
+# Local policy
+#
+
+# Configuration files - read
+allow haproxy_t haproxy_conf_t : dir list_dir_perms;
+allow haproxy_t haproxy_conf_t : file read_file_perms;
+allow haproxy_t haproxy_conf_t : lnk_file read_lnk_file_perms;
+
+# PID and socket file - create, read, and write
+files_pid_filetrans(haproxy_t, haproxy_var_run_t, { file sock_file })
+allow haproxy_t haproxy_var_run_t:file manage_file_perms;
+allow haproxy_t haproxy_var_run_t:sock_file { create rename link setattr unlink };
+
+allow haproxy_t self : tcp_socket create_stream_socket_perms;
+allow haproxy_t self: udp_socket create_socket_perms;
+allow haproxy_t self: capability { setgid setuid sys_chroot sys_resource kill };
+allow haproxy_t self: process { setrlimit signal };
+
+
+logging_send_syslog_msg(haproxy_t)
+
+corenet_tcp_bind_all_ports(haproxy_t)
+corenet_tcp_connect_all_ports(haproxy_t)
+corenet_tcp_bind_all_nodes(haproxy_t)
+corenet_tcp_sendrecv_all_ports(haproxy_t)
+corenet_tcp_recvfrom_unlabeled(haproxy_t)
+
+# use shared libraries
+libs_use_ld_so(haproxy_t)
+libs_use_shared_libs(haproxy_t)
+
+# Read /etc/localtime:
+miscfiles_read_localization(haproxy_t)
+# Read /etc/passwd and more.
+files_read_etc_files(haproxy_t)
+
-- 
1.6.0.6

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20090318/1ceaaaae/attachment.bin 


More information about the refpolicy mailing list