[refpolicy] [PATCH] Update couchdb policy

Luis Ressel aranea at aixah.de
Sat Jan 25 18:18:08 EST 2014


* Add separate db for couchjs, as it needs execmem
* Add several dontaudits to hide noise caused by Erlang's disksup
---
 couchdb.fc | 16 +++++++---------
 couchdb.te | 26 ++++++++++++++++++++++++--
 2 files changed, 31 insertions(+), 11 deletions(-)

diff --git a/couchdb.fc b/couchdb.fc
index c086302..5c1388a 100644
--- a/couchdb.fc
+++ b/couchdb.fc
@@ -1,11 +1,9 @@
-/etc/couchdb(/.*)?	gen_context(system_u:object_r:couchdb_conf_t,s0)
+/etc/couchdb(/.*)?			gen_context(system_u:object_r:couchdb_conf_t,s0)
 
-/etc/rc\.d/init\.d/couchdb	--	gen_context(system_u:object_r:couchdb_initrc_exec_t,s0)
+/usr/bin/couchdb		--	gen_context(system_u:object_r:couchdb_exec_t,s0)
+/usr/lib/couchdb/bin/couchjs	--	gen_context(system_u:object_r:couchdb_js_exec_t,s0)
+/usr/lib/couchdb/erlang/lib/couch-[0-9.]+/priv/couchspawnkillable	--	gen_context(system_u:object_r:bin_t,s0)
 
-/usr/bin/couchdb	--	gen_context(system_u:object_r:couchdb_exec_t,s0)
-
-/var/lib/couchdb(/.*)?	gen_context(system_u:object_r:couchdb_var_lib_t,s0)
-
-/var/log/couchdb(/.*)?	gen_context(system_u:object_r:couchdb_log_t,s0)
-
-/var/run/couchdb(/.*)?	gen_context(system_u:object_r:couchdb_var_run_t,s0)
+/var/lib/couchdb(/.*)?			gen_context(system_u:object_r:couchdb_var_lib_t,s0)
+/var/log/couchdb(/.*)?			gen_context(system_u:object_r:couchdb_log_t,s0)
+/var/run/couchdb(/.*)?			gen_context(system_u:object_r:couchdb_var_run_t,s0)
diff --git a/couchdb.te b/couchdb.te
index ae1c1b1..1bf163e 100644
--- a/couchdb.te
+++ b/couchdb.te
@@ -9,6 +9,10 @@ type couchdb_t;
 type couchdb_exec_t;
 init_daemon_domain(couchdb_t, couchdb_exec_t)
 
+type couchdb_js_t;
+type couchdb_js_exec_t;
+init_daemon_domain(couchdb_js_t, couchdb_js_exec_t)
+
 type couchdb_initrc_exec_t;
 init_script_file(couchdb_initrc_exec_t)
 
@@ -29,10 +33,10 @@ files_pid_file(couchdb_var_run_t)
 
 ########################################
 #
-# Local policy
+# couchdb policy
 #
 
-allow couchdb_t self:process { setsched signal signull sigkill };
+allow couchdb_t self:process { getsched setsched signal signull sigkill };
 allow couchdb_t self:fifo_file rw_fifo_file_perms;
 allow couchdb_t self:unix_stream_socket create_stream_socket_perms;
 allow couchdb_t self:tcp_socket { accept listen };
@@ -70,6 +74,7 @@ corenet_all_recvfrom_netlabel(couchdb_t)
 corenet_tcp_sendrecv_generic_if(couchdb_t)
 corenet_tcp_sendrecv_generic_node(couchdb_t)
 corenet_tcp_bind_generic_node(couchdb_t)
+corenet_udp_bind_generic_node(couchdb_t)
 
 corenet_sendrecv_couchdb_server_packets(couchdb_t)
 corenet_tcp_bind_couchdb_port(couchdb_t)
@@ -81,8 +86,25 @@ dev_read_urand(couchdb_t)
 
 files_read_usr_files(couchdb_t)
 
+# disksup tries to monitor the local disks
 fs_getattr_xattr_fs(couchdb_t)
+fs_dontaudit_getattr_all_fs(couchdb_t)
+files_dontaudit_search_all_mountpoints(couchdb_t)
+files_dontaudit_getattr_lost_found_dirs(couchdb_t)
+dontaudit couchdb_t var_t:dir list_dir_perms;
 
 auth_use_nsswitch(couchdb_t)
 
 miscfiles_read_localization(couchdb_t)
+
+domtrans_pattern(couchdb_t, couchdb_js_exec_t, couchdb_js_t)
+
+########################################
+#
+# couchdb_js policy
+#
+
+allow couchdb_js_t self:process { execmem getsched setsched };
+
+files_read_usr_files(couchdb_js_t)
+miscfiles_read_localization(couchdb_js_t)
-- 
1.8.5.3



More information about the refpolicy mailing list