Changeset 2832

Show
Ignore:
Timestamp:
10/10/08 14:13:21 (2 months ago)
Author:
cpebenito
Message:

rbacsep: update to trunk 2831.

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • branches/rbacsep/Changelog

    r2820 r2832  
    1515- Added modules: 
    1616        cyphesis (Dan Walsh) 
     17        memcached (Dan Walsh) 
     18        oident (Dominick Grift) 
    1719        w3c (Dan Walsh) 
    1820 

  • branches/rbacsep/policy/modules/admin/certwatch.te

    r2782 r2832  
    1616# Local policy 
    1717# 
     18allow certwatch_t self:capability sys_nice; 
     19allow certwatch_t self:process { setsched getsched }; 
     20 
     21dev_read_urand(certwatch_t) 
    1822 
    1923files_read_etc_files(certwatch_t) 
     24files_read_usr_files(certwatch_t) 
     25files_read_usr_symlinks(certwatch_t) 
     26files_list_tmp(certwatch_t) 
     27 
     28fs_list_inotifyfs(certwatch_t) 
    2029 
    2130libs_use_ld_so(certwatch_t) 
    …… 
    2736miscfiles_read_localization(certwatch_t) 
    2837 
    29 apache_exec_modules(certwatch_t) 
     38optional_policy(` 
     39        apache_exec_modules(certwatch_t) 
     40') 
    3041 
    3142optional_policy(` 
    3243        cron_system_entry(certwatch_t, certwatch_exec_t) 
    3344') 
     45 
     46optional_policy(` 
     47        pcscd_stream_connect(certwatch_t) 
     48        pcscd_read_pub_files(certwatch_t) 
     49') 

  • branches/rbacsep/policy/modules/admin/firstboot.te

    r2820 r2832  
    11 
    2 policy_module(firstboot, 1.7.2) 
     2policy_module(firstboot, 1.7.3) 
    33 
    44gen_require(` 
    …… 
    121121optional_policy(` 
    122122        xserver_rw_shm(firstboot_t) 
     123        xserver_unconfined(firstboot_t) 
    123124') 
    124  
    125 ifdef(`TODO',` 
    126 allow firstboot_t proc_t:file write; 
    127  
    128 ifdef(`printconf.te', ` 
    129         can_exec(firstboot_t, printconf_t) 
    130 ') 
    131  
    132 ifdef(`userhelper.te', ` 
    133         role system_r types sysadm_userhelper_t; 
    134         domain_auto_trans(firstboot_t, userhelper_exec_t, sysadm_userhelper_t) 
    135 ') 
    136 ') dnl end TODO 

  • branches/rbacsep/policy/modules/admin/kismet.te

    r2782 r2832  
    11 
    2 policy_module(kismet, 1.0.2) 
     2policy_module(kismet, 1.0.3) 
    33 
    44######################################## 
    …… 
    2727 
    2828allow kismet_t self:capability { net_admin net_raw setuid setgid }; 
     29allow kismet_t self:fifo_file rw_file_perms; 
    2930allow kismet_t self:packet_socket create_socket_perms; 
     31allow kismet_t self:unix_dgram_socket create_socket_perms; 
     32allow kismet_t self:unix_stream_socket create_stream_socket_perms; 
    3033 
    3134manage_files_pattern(kismet_t, kismet_log_t, kismet_log_t) 
    …… 
    4144files_pid_filetrans(kismet_t, kismet_var_run_t, { file dir }) 
    4245 
     46kernel_search_debugfs(kismet_t) 
     47 
    4348corecmd_exec_bin(kismet_t) 
    4449 

  • branches/rbacsep/policy/modules/admin/logrotate.te

    r2820 r2832  
    11 
    2 policy_module(logrotate, 1.9.2) 
     2policy_module(logrotate, 1.9.3) 
    33 
    44######################################## 
    …… 
    9898files_read_etc_runtime_files(logrotate_t) 
    9999files_read_all_pids(logrotate_t) 
     100files_search_all(logrotate_t) 
    100101# Write to /var/spool/slrnpull - should be moved into its own type. 
    101102files_manage_generic_spool(logrotate_t) 
    …… 
    168169 
    169170optional_policy(` 
    170         mailman_exec(logrotate_t) 
     171        mailman_domtrans(logrotate_t) 
    171172        mailman_search_data(logrotate_t) 
    172173        mailman_manage_log(logrotate_t) 
    …… 
    190191 
    191192optional_policy(` 
    192         # cjp: why? 
    193         squid_domtrans(logrotate_t) 
     193        squid_signal(logrotate_t) 
    194194') 

  • branches/rbacsep/policy/modules/admin/readahead.te

    r2820 r2832  
    11 
    2 policy_module(readahead, 1.6.1) 
     2policy_module(readahead, 1.6.2) 
    33 
    44######################################## 
    …… 
    2323# 
    2424 
    25 allow readahead_t self:capability { dac_override dac_read_search }; 
     25allow readahead_t self:capability { fowner dac_override dac_read_search }; 
    2626dontaudit readahead_t self:capability sys_tty_config; 
    2727allow readahead_t self:process signal_perms; 

  • branches/rbacsep/policy/modules/admin/vpn.if

    r2782 r2832  
    4949        role $2 types vpnc_t; 
    5050        allow vpnc_t $3:chr_file rw_term_perms; 
     51        sysnet_run_ifconfig(vpnc_t, $2, $3) 
    5152') 
    5253 

  • branches/rbacsep/policy/modules/admin/vpn.te

    r2782 r2832  
    11 
    2 policy_module(vpn, 1.8.0) 
     2policy_module(vpn, 1.8.1) 
    33 
    44######################################## 
    …… 
    2323# 
    2424 
    25 allow vpnc_t self:capability { dac_override net_admin ipc_lock net_raw }; 
     25allow vpnc_t self:capability { dac_read_search dac_override net_admin ipc_lock net_raw }; 
    2626allow vpnc_t self:process getsched; 
    27 allow vpnc_t self:fifo_file { getattr ioctl read write }; 
     27allow vpnc_t self:fifo_file rw_fifo_file_perms; 
     28allow vpnc_t self:netlink_route_socket rw_netlink_socket_perms; 
    2829allow vpnc_t self:tcp_socket create_stream_socket_perms; 
    2930allow vpnc_t self:udp_socket create_socket_perms; 
    …… 
    103104seutil_use_newrole_fds(vpnc_t) 
    104105 
    105 sysnet_domtrans_ifconfig(vpnc_t) 
    106106sysnet_etc_filetrans_config(vpnc_t) 
    107107sysnet_manage_config(vpnc_t) 

  • branches/rbacsep/policy/modules/kernel/corenetwork.te.in

    r2820 r2832  
    11 
    2 policy_module(corenetwork, 1.2.19) 
     2policy_module(corenetwork, 1.2.21) 
    33 
    44######################################## 
    …… 
    7676network_port(apcupsd, tcp,3551,s0, udp,3551,s0) 
    7777network_port(asterisk, tcp,1720,s0, udp,2427,s0, udp,2727,s0, udp,4569,s0, udp,5060,s0) 
     78network_port(audit, tcp,60,s0) 
    7879network_port(auth, tcp,113,s0) 
    7980network_port(bgp, tcp,179,s0, udp,179,s0, tcp,2605,s0, udp,2605,s0) 
    …… 
    122123network_port(lmtp, tcp,24,s0, udp,24,s0) 
    123124network_port(mail, tcp,2000,s0) 
     125network_port(memcache, tcp,11211,s0, udp,11211,s0) 
    124126network_port(mmcc, tcp,5050,s0, udp,5050,s0) 
    125127network_port(monopd, tcp,1234,s0) 

  • branches/rbacsep/policy/modules/kernel/selinux.if

    r2519 r2832  
    363363######################################## 
    364364## <summary> 
     365##      Do not audit attempts to validate security contexts. 
     366## </summary> 
     367## <param name="domain"> 
     368##      <summary> 
     369##      Domain to not audit. 
     370##      </summary> 
     371## </param> 
     372## <rolecap/> 
     373# 
     374interface(`selinux_dontaudit_validate_context',` 
     375        gen_require(` 
     376                type security_t; 
     377        ') 
     378 
     379        dontaudit $1 security_t:dir list_dir_perms; 
     380        dontaudit $1 security_t:file { getattr read write }; 
     381        dontaudit $1 security_t:security check_context; 
     382') 
     383 
     384######################################## 
     385## <summary> 
    365386##      Allows caller to compute an access vector. 
    366387## </summary> 

  • branches/rbacsep/policy/modules/kernel/selinux.te

    r2782 r2832  
    11 
    2 policy_module(selinux, 1.6.0) 
     2policy_module(selinux, 1.6.1) 
    33 
    44######################################## 

  • branches/rbacsep/policy/modules/kernel/storage.fc

    r2782 r2832  
    2828/dev/megadev.*          -c      gen_context(system_u:object_r:removable_device_t,s0) 
    2929/dev/mmcblk.*           -b      gen_context(system_u:object_r:removable_device_t,s0) 
     30/dev/mspblk.*           -b      gen_context(system_u:object_r:removable_device_t,s0) 
    3031/dev/nb[^/]+            -b      gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh) 
    3132/dev/optcd              -b      gen_context(system_u:object_r:removable_device_t,s0) 

  • branches/rbacsep/policy/modules/kernel/storage.te

    r2782 r2832  
    11 
    2 policy_module(storage, 1.6.1) 
     2policy_module(storage, 1.6.2) 
    33 
    44######################################## 

  • branches/rbacsep/policy/modules/roles/auditadm.te

    r2822 r2832  
    117117 
    118118optional_policy(` 
     119        oidentd_manage_user_content(auditadm_t) 
     120        oidentd_relabel_user_content(auditadm_t) 
     121') 
     122 
     123optional_policy(` 
    119124        pyzor_role(auditadm_r, auditadm_t) 
    120125') 

  • branches/rbacsep/policy/modules/roles/secadm.te

    r2822 r2832  
    130130 
    131131optional_policy(` 
     132        oidentd_manage_user_content(secadm_t) 
     133        oidentd_relabel_user_content(secadm_t) 
     134') 
     135 
     136optional_policy(` 
    132137        pyzor_role(secadm_r, secadm_t) 
    133138') 

  • branches/rbacsep/policy/modules/roles/staff.te

    r2822 r2832  
    9797 
    9898optional_policy(` 
     99        oidentd_manage_user_content(staff_t) 
     100        oidentd_relabel_user_content(staff_t) 
     101') 
     102 
     103optional_policy(` 
    99104        pyzor_role(staff_r, staff_t) 
    100105') 

  • branches/rbacsep/policy/modules/roles/sysadm.te

    r2822 r2832  
    287287 
    288288optional_policy(` 
     289        oidentd_manage_user_content(sysadm_t) 
     290        oidentd_relabel_user_content(sysadm_t) 
     291') 
     292 
     293optional_policy(` 
    289294        pcmcia_run_cardctl(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) 
    290295') 

  • branches/rbacsep/policy/modules/roles/unprivuser.te

    r2822 r2832  
    9191 
    9292optional_policy(` 
     93        oidentd_manage_user_content(user_t) 
     94        oidentd_relabel_user_content(user_t) 
     95') 
     96 
     97optional_policy(` 
    9398        pyzor_role(user_r, user_t) 
    9499') 

  • branches/rbacsep/policy/modules/services/amavis.fc

    r1977 r2832  
    11 
    22/etc/amavis\.conf               --      gen_context(system_u:object_r:amavis_etc_t,s0) 
    3 /etc/amavisd(/.*)?              --      gen_context(system_u:object_r:amavis_etc_t,s0) 
     3/etc/amavisd(/.*)?                      gen_context(system_u:object_r:amavis_etc_t,s0) 
     4/etc/rc\.d/init\.d/amavis       --      gen_context(system_u:object_r:amavis_initrc_exec_t,s0) 
    45 
    56/usr/sbin/amavisd.*             --      gen_context(system_u:object_r:amavis_exec_t,s0) 
     7/usr/lib(64)?/AntiVir/antivir   --      gen_context(system_u:object_r:amavis_exec_t,s0) 
    68 
    79ifdef(`distro_debian',` 

  • branches/rbacsep/policy/modules/services/amavis.if

    r2782 r2832  
    198198##      </summary> 
    199199## </param> 
     200## <param name="role"> 
     201##      <summary> 
     202##      Role allowed access. 
     203##      </summary> 
     204## </param> 
    200205## <rolecap/> 
    201206# 
    …… 
    205210                type amavis_spool_t, amavis_var_lib_t, amavis_var_run_t; 
    206211                type amavis_etc_t, amavis_quarantine_t; 
     212                type amavis_initrc_exec_t; 
    207213        ') 
    208214 
    209215        allow $1 amavis_t:process { ptrace signal_perms }; 
    210216        ps_process_pattern($1, amavis_t) 
    211          
     217 
     218        init_labeled_script_domtrans($1, amavis_initrc_exec_t) 
     219        domain_system_change_exemption($1) 
     220        role_transition $2 amavis_initrc_exec_t system_r; 
     221        allow $2 system_r; 
     222 
     223        files_list_etc($1) 
     224        admin_pattern($1, amavis_etc_t) 
     225 
     226        admin_pattern($1, amavis_quarantine_t) 
     227 
     228        files_list_spool($1) 
     229        admin_pattern($1, amavis_spool_t) 
     230 
    212231        files_list_tmp($1) 
    213         manage_files_pattern($1, amavis_tmp_t, amavis_tmp_t) 
    214  
    215         manage_files_pattern($1, amavis_quarantine_t, amavis_quarantine_t) 
    216  
    217         files_list_etc($1) 
    218         manage_files_pattern($1, amavis_etc_t, amavis_etc_t) 
     232        admin_pattern($1, amavis_tmp_t) 
     233 
     234        files_list_var_lib($1) 
     235        admin_pattern($1, amavis_var_lib_t) 
    219236 
    220237        logging_list_logs($1) 
    221         manage_files_pattern($1, amavis_var_log_t, amavis_var_log_t) 
    222  
    223         files_list_spool($1) 
    224         manage_files_pattern($1, amavis_spool_t, amavis_spool_t) 
    225  
    226         files_list_var_lib($1) 
    227         manage_files_pattern($1, amavis_var_lib_t, amavis_var_lib_t) 
     238        admin_pattern($1, amavis_var_log_t) 
    228239 
    229240        files_list_pids($1) 
    230         manage_files_pattern($1, amavis_var_run_t, amavis_var_run_t) 
    231 ') 
     241        admin_pattern($1, amavis_var_run_t) 
     242') 

  • branches/rbacsep/policy/modules/services/amavis.te

    r2782 r2832  
    11 
    2 policy_module(amavis, 1.7.0) 
     2policy_module(amavis, 1.7.1) 
    33 
    44######################################## 
    …… 
    1414# configuration files 
    1515type amavis_etc_t; 
    16 files_type(amavis_etc_t) 
     16files_config_file(amavis_etc_t) 
     17 
     18type amavis_initrc_exec_t; 
     19init_script_file(amavis_initrc_exec_t) 
    1720 
    1821# pid files 
    …… 
    5760read_files_pattern(amavis_t, amavis_etc_t, amavis_etc_t) 
    5861read_lnk_files_pattern(amavis_t, amavis_etc_t, amavis_etc_t) 
     62 
     63can_exec(amavis_t, amavis_exec_t) 
    5964 
    6065# mail quarantine 

  • branches/rbacsep/policy/modules/services/apache.fc

    r2754 r2832  
    1717/usr/lib/apache-ssl/.+          --      gen_context(system_u:object_r:httpd_exec_t,s0) 
    1818/usr/lib/cgi-bin(/.*)?                  gen_context(system_u:object_r:httpd_sys_script_exec_t,s0) 
    19 /usr/lib/squid/cachemgr\.cgi    --      gen_context(system_u:object_r:httpd_exec_t,s0) 
    2019/usr/lib(64)?/apache(/.*)?              gen_context(system_u:object_r:httpd_modules_t,s0) 
    2120/usr/lib(64)?/apache2/modules(/.*)?     gen_context(system_u:object_r:httpd_modules_t,s0) 

  • branches/rbacsep/policy/modules/services/apcupsd.fc

    r2441 r2832  
     1/etc/rc\.d/init\.d/apcupsd      --      gen_context(system_u:object_r:apcupsd_initrc_exec_t,s0) 
     2 
    13ifdef(`distro_debian',` 
    24/sbin/apcupsd                   --      gen_context(system_u:object_r:apcupsd_exec_t,s0) 

  • branches/rbacsep/policy/modules/services/apcupsd.if

    r2820 r2832  
    9898        domtrans_pattern($1, httpd_apcupsd_cgi_script_exec_t, httpd_apcupsd_cgi_script_t) 
    9999') 
     100 
     101######################################## 
     102## <summary> 
     103##      All of the rules required to administrate  
     104##      an apcupsd environment 
     105## </summary> 
     106## <param name="domain"> 
     107##      <summary> 
     108##      Domain allowed access. 
     109##      </summary> 
     110## </param> 
     111## <param name="role"> 
     112##      <summary> 
     113##      The role to be allowed to manage the apcupsd domain. 
     114##      </summary> 
     115## </param> 
     116## <rolecap/> 
     117# 
     118interface(`apcupsd_admin',` 
     119        gen_require(` 
     120                type apcupsd_t,  apcupsd_tmp_t; 
     121                type apcupsd_log_t, apcupsd_lock_t; 
     122                type apcupsd_var_run_t, apcupsd_initrc_exec_t; 
     123        ') 
     124 
     125        allow $1 apcupsd_t:process { ptrace signal_perms }; 
     126        ps_process_pattern($1, apcupsd_t) 
     127 
     128        init_labeled_script_domtrans($1, apcupsd_initrc_exec_t) 
     129        domain_system_change_exemption($1) 
     130        role_transition $2 apcupsd_initrc_exec_t system_r; 
     131        allow $2 system_r; 
     132 
     133        files_list_var($1) 
     134        admin_pattern($1, apcupsd_lock_t) 
     135 
     136        logging_list_logs($1) 
     137        admin_pattern($1, apcupsd_log_t) 
     138 
     139        files_list_tmp($1) 
     140        admin_pattern($1, apcupsd_tmp_t) 
     141 
     142        files_list_pids($1) 
     143        admin_pattern($1, apcupsd_var_run_t) 
     144') 

  • branches/rbacsep/policy/modules/services/apcupsd.te

    r2820 r2832  
    11 
    2 policy_module(apcupsd, 1.3.1) 
     2policy_module(apcupsd, 1.3.2) 
    33 
    44######################################## 
    …… 
    1313type apcupsd_lock_t; 
    1414files_lock_file(apcupsd_lock_t) 
     15 
     16type apcupsd_initrc_exec_t; 
     17init_script_file(apcupsd_initrc_exec_t) 
    1518 
    1619type apcupsd_log_t; 
    …… 
    8790miscfiles_read_localization(apcupsd_t) 
    8891 
     92sysnet_dns_name_resolve(apcupsd_t) 
     93 
     94userdom_use_user_ttys(apcupsd_t) 
     95 
    8996optional_policy(` 
    9097        hostname_exec(apcupsd_t) 
    …… 
    93100optional_policy(` 
    94101        mta_send_mail(apcupsd_t) 
     102        mta_system_content(apcupsd_tmp_t) 
    95103') 
    96104 

  • branches/rbacsep/policy/modules/services/automount.fc

    r2181 r2832  
    33# 
    44/etc/apm/event\.d/autofs --     gen_context(system_u:object_r:automount_exec_t,s0) 
     5/etc/rc\.d/init\.d/autofs       --      gen_context(system_u:object_r:automount_initrc_exec_t,s0) 
    56 
    67# 
    …… 
    1314# 
    1415 
    15 /var/run/autofs(/.*)?         gen_context(system_u:object_r:automount_var_run_t,s0) 
     16/var/run/autofs.*             gen_context(system_u:object_r:automount_var_run_t,s0) 

  • branches/rbacsep/policy/modules/services/automount.if

    r2782 r2832  
    5959######################################## 
    6060## <summary> 
     61##      Do not audit attempts to file descriptors for automount. 
     62## </summary> 
     63## <param name="domain"> 
     64##      <summary> 
     65##      Domain to not audit. 
     66##      </summary> 
     67## </param> 
     68# 
     69interface(`automount_dontaudit_use_fds',` 
     70        gen_require(` 
     71                type automount_t; 
     72        ') 
     73 
     74        dontaudit $1 automount_t:fd use; 
     75') 
     76 
     77######################################## 
     78## <summary> 
     79##      Do not audit attempts to write automount daemon unnamed pipes. 
     80## </summary> 
     81## <param name="domain"> 
     82##      <summary> 
     83##      Domain allowed access. 
     84##      </summary> 
     85## </param> 
     86# 
     87interface(`automount_dontaudit_write_pipes',` 
     88        gen_require(` 
     89                type automount_t; 
     90        ') 
     91 
     92        dontaudit $1 automount_t:fifo_file write; 
     93') 
     94 
     95######################################## 
     96## <summary> 
    6197##      Do not audit attempts to get the attributes 
    6298##      of automount temporary directories. 
    …… 
    75111        dontaudit $1 automount_tmp_t:dir getattr; 
    76112') 
     113 
     114######################################## 
     115## <summary> 
     116##      All of the rules required to administrate  
     117##      an automount environment 
     118## </summary> 
     119## <param name="domain"> 
     120##      <summary> 
     121##      Domain allowed access. 
     122##      </summary> 
     123## </param> 
     124## <param name="role"> 
     125##      <summary> 
     126##      The role to be allowed to manage the automount domain. 
     127##      </summary> 
     128## </param> 
     129## <rolecap/> 
     130# 
     131interface(`automount_admin',` 
     132        gen_require(` 
     133                type automount_t, automount_lock_t, automount_tmp_t; 
     134                type automount_var_run_t, automount_initrc_exec_t; 
     135        ') 
     136 
     137        allow $1 automount_t:process { ptrace signal_perms getattr }; 
     138        ps_process_pattern($1, automount_t) 
     139 
     140        init_labeled_script_domtrans($1, automount_initrc_exec_t) 
     141        domain_system_change_exemption($1) 
     142        role_transition $2 automount_initrc_exec_t system_r; 
     143        allow $2 system_r; 
     144 
     145        files_list_var($1) 
     146        admin_pattern($1, automount_lock_t) 
     147 
     148        files_list_tmp($1) 
     149        admin_pattern($1, automount_tmp_t) 
     150 
     151        files_list_pids($1) 
     152        admin_pattern($1, automount_var_run_t) 
     153') 

  • branches/rbacsep/policy/modules/services/automount.te

    r2782