|
 |
70e052 |
diff --git a/cinder.te b/cinder.te
|
|
|
70e052 |
index 488a7a659..a05691d8f 100644
|
|
|
70e052 |
--- a/cinder.te
|
|
|
70e052 |
+++ b/cinder.te
|
|
|
70e052 |
@@ -159,6 +159,8 @@ kernel_read_kernel_sysctls(cinder_volume_t)
|
|
|
70e052 |
|
|
|
70e052 |
logging_send_syslog_msg(cinder_volume_t)
|
|
|
70e052 |
|
|
|
70e052 |
+systemd_dbus_chat_logind(cinder_volume_t)
|
|
|
70e052 |
+
|
|
|
70e052 |
optional_policy(`
|
|
|
70e052 |
lvm_domtrans(cinder_volume_t)
|
|
|
70e052 |
')
|
|
|
70e052 |
diff --git a/ganesha.fc b/ganesha.fc
|
|
|
70e052 |
new file mode 100644
|
|
|
70e052 |
index 000000000..c723bfb97
|
|
|
70e052 |
--- /dev/null
|
|
|
70e052 |
+++ b/ganesha.fc
|
|
|
70e052 |
@@ -0,0 +1,12 @@
|
|
|
70e052 |
+/usr/bin/ganesha.nfsd -- gen_context(system_u:object_r:ganesha_exec_t,s0)
|
|
|
70e052 |
+
|
|
|
70e052 |
+/usr/lib/systemd/system/nfs-ganesha-config.* -- gen_context(system_u:object_r:ganesha_unit_file_t,s0)
|
|
|
70e052 |
+
|
|
|
70e052 |
+/usr/lib/systemd/system/nfs-ganesha-lock.* -- gen_context(system_u:object_r:ganesha_unit_file_t,s0)
|
|
|
70e052 |
+
|
|
|
70e052 |
+/usr/lib/systemd/system/nfs-ganesha.*e -- gen_context(system_u:object_r:ganesha_unit_file_t,s0)
|
|
|
70e052 |
+
|
|
|
70e052 |
+/var/log/ganesha.log.* -- gen_context(system_u:object_r:ganesha_var_log_t,s0)
|
|
|
70e052 |
+/var/log/ganesha-gfapi.log.* -- gen_context(system_u:object_r:ganesha_var_log_t,s0)
|
|
|
70e052 |
+
|
|
|
70e052 |
+/var/run/ganesha(/.*)? gen_context(system_u:object_r:ganesha_var_run_t,s0)
|
|
|
70e052 |
diff --git a/ganesha.if b/ganesha.if
|
|
|
70e052 |
new file mode 100644
|
|
|
70e052 |
index 000000000..4c347e5cc
|
|
|
70e052 |
--- /dev/null
|
|
|
70e052 |
+++ b/ganesha.if
|
|
|
70e052 |
@@ -0,0 +1,146 @@
|
|
|
70e052 |
+## <summary>policy for ganesha</summary>
|
|
|
70e052 |
+
|
|
|
70e052 |
+########################################
|
|
|
70e052 |
+## <summary>
|
|
|
70e052 |
+## Execute ganesha_exec_t in the ganesha domain.
|
|
|
70e052 |
+## </summary>
|
|
|
70e052 |
+## <param name="domain">
|
|
|
70e052 |
+## <summary>
|
|
|
70e052 |
+## Domain allowed to transition.
|
|
|
70e052 |
+## </summary>
|
|
|
70e052 |
+## </param>
|
|
|
70e052 |
+#
|
|
|
70e052 |
+interface(`ganesha_domtrans',`
|
|
|
70e052 |
+ gen_require(`
|
|
|
70e052 |
+ type ganesha_t, ganesha_exec_t;
|
|
|
70e052 |
+ ')
|
|
|
70e052 |
+
|
|
|
70e052 |
+ corecmd_search_bin($1)
|
|
|
70e052 |
+ domtrans_pattern($1, ganesha_exec_t, ganesha_t)
|
|
|
70e052 |
+')
|
|
|
70e052 |
+
|
|
|
70e052 |
+######################################
|
|
|
70e052 |
+## <summary>
|
|
|
70e052 |
+## Execute ganesha in the caller domain.
|
|
|
70e052 |
+## </summary>
|
|
|
70e052 |
+## <param name="domain">
|
|
|
70e052 |
+## <summary>
|
|
|
70e052 |
+## Domain allowed access.
|
|
|
70e052 |
+## </summary>
|
|
|
70e052 |
+## </param>
|
|
|
70e052 |
+#
|
|
|
70e052 |
+interface(`ganesha_exec',`
|
|
|
70e052 |
+ gen_require(`
|
|
|
70e052 |
+ type ganesha_exec_t;
|
|
|
70e052 |
+ ')
|
|
|
70e052 |
+
|
|
|
70e052 |
+ corecmd_search_bin($1)
|
|
|
70e052 |
+ can_exec($1, ganesha_exec_t)
|
|
|
70e052 |
+')
|
|
|
70e052 |
+########################################
|
|
|
70e052 |
+## <summary>
|
|
|
70e052 |
+## Read ganesha PID files.
|
|
|
70e052 |
+## </summary>
|
|
|
70e052 |
+## <param name="domain">
|
|
|
70e052 |
+## <summary>
|
|
|
70e052 |
+## Domain allowed access.
|
|
|
70e052 |
+## </summary>
|
|
|
70e052 |
+## </param>
|
|
|
70e052 |
+#
|
|
|
70e052 |
+interface(`ganesha_read_pid_files',`
|
|
|
70e052 |
+ gen_require(`
|
|
|
70e052 |
+ type ganesha_var_run_t;
|
|
|
70e052 |
+ ')
|
|
|
70e052 |
+
|
|
|
70e052 |
+ files_search_pids($1)
|
|
|
70e052 |
+ read_files_pattern($1, ganesha_var_run_t, ganesha_var_run_t)
|
|
|
70e052 |
+')
|
|
|
70e052 |
+
|
|
|
70e052 |
+########################################
|
|
|
70e052 |
+## <summary>
|
|
|
70e052 |
+## Execute ganesha server in the ganesha domain.
|
|
|
70e052 |
+## </summary>
|
|
|
70e052 |
+## <param name="domain">
|
|
|
70e052 |
+## <summary>
|
|
|
70e052 |
+## Domain allowed to transition.
|
|
|
70e052 |
+## </summary>
|
|
|
70e052 |
+## </param>
|
|
|
70e052 |
+#
|
|
|
70e052 |
+interface(`ganesha_systemctl',`
|
|
|
70e052 |
+ gen_require(`
|
|
|
70e052 |
+ type ganesha_t;
|
|
|
70e052 |
+ type ganesha_unit_file_t;
|
|
|
70e052 |
+ ')
|
|
|
70e052 |
+
|
|
|
70e052 |
+ systemd_exec_systemctl($1)
|
|
|
70e052 |
+ systemd_read_fifo_file_passwd_run($1)
|
|
|
70e052 |
+ allow $1 ganesha_unit_file_t:file read_file_perms;
|
|
|
70e052 |
+ allow $1 ganesha_unit_file_t:service manage_service_perms;
|
|
|
70e052 |
+
|
|
|
70e052 |
+ ps_process_pattern($1, ganesha_t)
|
|
|
70e052 |
+')
|
|
|
70e052 |
+
|
|
|
70e052 |
+
|
|
|
70e052 |
+########################################
|
|
|
70e052 |
+## <summary>
|
|
|
70e052 |
+## Send and receive messages from
|
|
|
70e052 |
+## ganesha over dbus.
|
|
|
70e052 |
+## </summary>
|
|
|
70e052 |
+## <param name="domain">
|
|
|
70e052 |
+## <summary>
|
|
|
70e052 |
+## Domain allowed access.
|
|
|
70e052 |
+## </summary>
|
|
|
70e052 |
+## </param>
|
|
|
70e052 |
+#
|
|
|
70e052 |
+interface(`ganesha_dbus_chat',`
|
|
|
70e052 |
+ gen_require(`
|
|
|
70e052 |
+ type ganesha_t;
|
|
|
70e052 |
+ class dbus send_msg;
|
|
|
70e052 |
+ ')
|
|
|
70e052 |
+
|
|
|
70e052 |
+ allow $1 ganesha_t:dbus send_msg;
|
|
|
70e052 |
+ allow ganesha_t $1:dbus send_msg;
|
|
|
70e052 |
+')
|
|
|
70e052 |
+
|
|
|
70e052 |
+########################################
|
|
|
70e052 |
+## <summary>
|
|
|
70e052 |
+## All of the rules required to administrate
|
|
|
70e052 |
+## an ganesha environment
|
|
|
70e052 |
+## </summary>
|
|
|
70e052 |
+## <param name="domain">
|
|
|
70e052 |
+## <summary>
|
|
|
70e052 |
+## Domain allowed access.
|
|
|
70e052 |
+## </summary>
|
|
|
70e052 |
+## </param>
|
|
|
70e052 |
+## <param name="role">
|
|
|
70e052 |
+## <summary>
|
|
|
70e052 |
+## Role allowed access.
|
|
|
70e052 |
+## </summary>
|
|
|
70e052 |
+## </param>
|
|
|
70e052 |
+## <rolecap/>
|
|
|
70e052 |
+#
|
|
|
70e052 |
+interface(`ganesha_admin',`
|
|
|
70e052 |
+ gen_require(`
|
|
|
70e052 |
+ type ganesha_t;
|
|
|
70e052 |
+ type ganesha_var_run_t;
|
|
|
70e052 |
+ type ganesha_unit_file_t;
|
|
|
70e052 |
+ ')
|
|
|
70e052 |
+
|
|
|
70e052 |
+ allow $1 ganesha_t:process { signal_perms };
|
|
|
70e052 |
+ ps_process_pattern($1, ganesha_t)
|
|
|
70e052 |
+
|
|
|
70e052 |
+ tunable_policy(`deny_ptrace',`',`
|
|
|
70e052 |
+ allow $1 ganesha_t:process ptrace;
|
|
|
70e052 |
+ ')
|
|
|
70e052 |
+
|
|
|
70e052 |
+ files_search_pids($1)
|
|
|
70e052 |
+ admin_pattern($1, ganesha_var_run_t)
|
|
|
70e052 |
+
|
|
|
70e052 |
+ ganesha_systemctl($1)
|
|
|
70e052 |
+ admin_pattern($1, ganesha_unit_file_t)
|
|
|
70e052 |
+ allow $1 ganesha_unit_file_t:service all_service_perms;
|
|
|
70e052 |
+ optional_policy(`
|
|
|
70e052 |
+ systemd_passwd_agent_exec($1)
|
|
|
70e052 |
+ systemd_read_fifo_file_passwd_run($1)
|
|
|
70e052 |
+ ')
|
|
|
70e052 |
+')
|
|
|
70e052 |
diff --git a/ganesha.te b/ganesha.te
|
|
|
70e052 |
new file mode 100644
|
|
|
70e052 |
index 000000000..f25a3f34d
|
|
|
70e052 |
--- /dev/null
|
|
|
70e052 |
+++ b/ganesha.te
|
|
|
70e052 |
@@ -0,0 +1,111 @@
|
|
|
70e052 |
+policy_module(ganesha, 1.0.0)
|
|
|
70e052 |
+
|
|
|
70e052 |
+########################################
|
|
|
70e052 |
+#
|
|
|
70e052 |
+# Declarations
|
|
|
70e052 |
+#
|
|
|
70e052 |
+
|
|
|
70e052 |
+## <desc>
|
|
|
70e052 |
+##
|
|
|
70e052 |
+## Allow ganesha to read/write fuse files
|
|
|
70e052 |
+##
|
|
|
70e052 |
+## </desc>
|
|
|
70e052 |
+gen_tunable(ganesha_use_fusefs, false)
|
|
|
70e052 |
+
|
|
|
70e052 |
+type ganesha_t;
|
|
|
70e052 |
+type ganesha_exec_t;
|
|
|
70e052 |
+init_daemon_domain(ganesha_t, ganesha_exec_t)
|
|
|
70e052 |
+
|
|
|
70e052 |
+type ganesha_var_log_t;
|
|
|
70e052 |
+logging_log_file(ganesha_var_log_t)
|
|
|
70e052 |
+
|
|
|
70e052 |
+type ganesha_var_run_t;
|
|
|
70e052 |
+files_pid_file(ganesha_var_run_t)
|
|
|
70e052 |
+
|
|
|
70e052 |
+type ganesha_tmp_t;
|
|
|
70e052 |
+files_tmp_file(ganesha_tmp_t)
|
|
|
70e052 |
+
|
|
|
70e052 |
+type ganesha_unit_file_t;
|
|
|
70e052 |
+systemd_unit_file(ganesha_unit_file_t)
|
|
|
70e052 |
+
|
|
|
70e052 |
+########################################
|
|
|
70e052 |
+#
|
|
|
70e052 |
+# ganesha local policy
|
|
|
70e052 |
+#
|
|
|
70e052 |
+dontaudit ganesha_t self:capability net_admin;
|
|
|
70e052 |
+
|
|
|
70e052 |
+allow ganesha_t self:capability { dac_read_search dac_override };
|
|
|
70e052 |
+allow ganesha_t self:capability2 block_suspend;
|
|
|
70e052 |
+allow ganesha_t self:process { setcap setrlimit };
|
|
|
70e052 |
+allow ganesha_t self:fifo_file rw_fifo_file_perms;
|
|
|
70e052 |
+allow ganesha_t self:unix_stream_socket create_stream_socket_perms;
|
|
|
70e052 |
+allow ganesha_t self:tcp_socket { accept listen };
|
|
|
70e052 |
+
|
|
|
70e052 |
+manage_dirs_pattern(ganesha_t, ganesha_var_run_t, ganesha_var_run_t)
|
|
|
70e052 |
+manage_files_pattern(ganesha_t, ganesha_var_run_t, ganesha_var_run_t)
|
|
|
70e052 |
+manage_lnk_files_pattern(ganesha_t, ganesha_var_run_t, ganesha_var_run_t)
|
|
|
70e052 |
+files_pid_filetrans(ganesha_t, ganesha_var_run_t, { dir file lnk_file })
|
|
|
70e052 |
+
|
|
|
70e052 |
+manage_dirs_pattern(ganesha_t, ganesha_var_log_t, ganesha_var_log_t)
|
|
|
70e052 |
+manage_files_pattern(ganesha_t, ganesha_var_log_t, ganesha_var_log_t)
|
|
|
70e052 |
+logging_log_filetrans(ganesha_t, ganesha_var_log_t, { file dir })
|
|
|
70e052 |
+
|
|
|
70e052 |
+manage_dirs_pattern(ganesha_t, ganesha_tmp_t, ganesha_tmp_t)
|
|
|
70e052 |
+manage_files_pattern(ganesha_t, ganesha_tmp_t, ganesha_tmp_t)
|
|
|
70e052 |
+files_tmp_filetrans(ganesha_t, ganesha_tmp_t, { file dir })
|
|
|
70e052 |
+
|
|
|
70e052 |
+kernel_read_system_state(ganesha_t)
|
|
|
70e052 |
+kernel_search_network_sysctl(ganesha_t)
|
|
|
70e052 |
+kernel_read_net_sysctls(ganesha_t)
|
|
|
70e052 |
+
|
|
|
70e052 |
+auth_use_nsswitch(ganesha_t)
|
|
|
70e052 |
+
|
|
|
70e052 |
+corenet_tcp_bind_nfs_port(ganesha_t)
|
|
|
70e052 |
+corenet_tcp_connect_generic_port(ganesha_t)
|
|
|
70e052 |
+corenet_tcp_connect_gluster_port(ganesha_t)
|
|
|
70e052 |
+corenet_udp_bind_dey_keyneg_port(ganesha_t)
|
|
|
70e052 |
+corenet_tcp_bind_dey_keyneg_port(ganesha_t)
|
|
|
70e052 |
+corenet_udp_bind_nfs_port(ganesha_t)
|
|
|
70e052 |
+corenet_udp_bind_all_rpc_ports(ganesha_t)
|
|
|
70e052 |
+corenet_tcp_bind_all_rpc_ports(ganesha_t)
|
|
|
70e052 |
+corenet_tcp_bind_mountd_port(ganesha_t)
|
|
|
70e052 |
+corenet_udp_bind_mountd_port(ganesha_t)
|
|
|
70e052 |
+corenet_tcp_connect_virt_migration_port(ganesha_t)
|
|
|
70e052 |
+corenet_tcp_connect_all_rpc_ports(ganesha_t)
|
|
|
70e052 |
+
|
|
|
70e052 |
+dev_rw_infiniband_dev(ganesha_t)
|
|
|
70e052 |
+dev_read_gpfs(ganesha_t)
|
|
|
70e052 |
+dev_read_rand(ganesha_t)
|
|
|
70e052 |
+
|
|
|
70e052 |
+logging_send_syslog_msg(ganesha_t)
|
|
|
70e052 |
+
|
|
|
70e052 |
+sysnet_dns_name_resolve(ganesha_t)
|
|
|
70e052 |
+
|
|
|
70e052 |
+optional_policy(`
|
|
|
70e052 |
+ dbus_system_bus_client(ganesha_t)
|
|
|
70e052 |
+ dbus_connect_system_bus(ganesha_t)
|
|
|
70e052 |
+ unconfined_dbus_chat(ganesha_t)
|
|
|
70e052 |
+')
|
|
|
70e052 |
+
|
|
|
70e052 |
+optional_policy(`
|
|
|
70e052 |
+ glusterd_read_conf(ganesha_t)
|
|
|
70e052 |
+ glusterd_read_lib_files(ganesha_t)
|
|
|
70e052 |
+ glusterd_manage_pid(ganesha_t)
|
|
|
70e052 |
+')
|
|
|
70e052 |
+
|
|
|
70e052 |
+optional_policy(`
|
|
|
70e052 |
+ kerberos_read_keytab(ganesha_t)
|
|
|
70e052 |
+')
|
|
|
70e052 |
+
|
|
|
70e052 |
+optional_policy(`
|
|
|
70e052 |
+ rpc_manage_nfs_state_data_dir(ganesha_t)
|
|
|
70e052 |
+ rpc_read_nfs_state_data(ganesha_t)
|
|
|
70e052 |
+ rpcbind_stream_connect(ganesha_t)
|
|
|
70e052 |
+')
|
|
|
70e052 |
+
|
|
|
70e052 |
+tunable_policy(`ganesha_use_fusefs',`
|
|
|
70e052 |
+ fs_manage_fusefs_dirs(ganesha_t)
|
|
|
70e052 |
+ fs_manage_fusefs_files(ganesha_t)
|
|
|
70e052 |
+ fs_read_fusefs_symlinks(ganesha_t)
|
|
|
70e052 |
+ fs_getattr_fusefs(ganesha_t)
|
|
|
70e052 |
+')
|
|
|
70e052 |
diff --git a/glusterd.fc b/glusterd.fc
|
|
|
70e052 |
index e42e81f5f..9806f50ae 100644
|
|
|
70e052 |
--- a/glusterd.fc
|
|
|
70e052 |
+++ b/glusterd.fc
|
|
|
70e052 |
@@ -23,8 +23,3 @@
|
|
|
70e052 |
/var/run/glusterd(/.*)? gen_context(system_u:object_r:glusterd_var_run_t,s0)
|
|
|
70e052 |
/var/run/glusterd.* -- gen_context(system_u:object_r:glusterd_var_run_t,s0)
|
|
|
70e052 |
/var/run/glusterd.* -s gen_context(system_u:object_r:glusterd_var_run_t,s0)
|
|
|
70e052 |
-
|
|
|
70e052 |
-/var/log/ganesha(/.*)? gen_context(system_u:object_r:glusterd_log_t,s0)
|
|
|
70e052 |
-/var/log/ganesha.log -- gen_context(system_u:object_r:glusterd_log_t,s0)
|
|
|
70e052 |
-/var/log/ganesha-gfapi.log -- gen_context(system_u:object_r:glusterd_log_t,s0)
|
|
|
70e052 |
-
|
|
|
70e052 |
diff --git a/glusterd.if b/glusterd.if
|
|
|
70e052 |
index a62e355ac..291191f17 100644
|
|
|
70e052 |
--- a/glusterd.if
|
|
|
70e052 |
+++ b/glusterd.if
|
|
|
70e052 |
@@ -135,7 +135,6 @@ interface(`glusterd_manage_log',`
|
|
|
70e052 |
manage_dirs_pattern($1, glusterd_log_t, glusterd_log_t)
|
|
|
70e052 |
manage_files_pattern($1, glusterd_log_t, glusterd_log_t)
|
|
|
70e052 |
manage_lnk_files_pattern($1, glusterd_log_t, glusterd_log_t)
|
|
|
70e052 |
- logging_log_named_filetrans($1, glusterd_log_t, file, "ganesha.log")
|
|
|
70e052 |
')
|
|
|
70e052 |
|
|
|
70e052 |
######################################
|
|
|
70e052 |
diff --git a/glusterd.te b/glusterd.te
|
|
|
70e052 |
index 7804cbaf4..2bcedd014 100644
|
|
|
70e052 |
--- a/glusterd.te
|
|
|
70e052 |
+++ b/glusterd.te
|
|
|
70e052 |
@@ -64,8 +64,6 @@ files_type(glusterd_var_lib_t)
|
|
|
70e052 |
type glusterd_brick_t;
|
|
|
70e052 |
files_type(glusterd_brick_t)
|
|
|
70e052 |
|
|
|
70e052 |
-typealias glusterd_log_t alias ganesha_var_log_t;
|
|
|
70e052 |
-
|
|
|
70e052 |
########################################
|
|
|
70e052 |
#
|
|
|
70e052 |
# Local policy
|
|
|
70e052 |
@@ -270,6 +268,11 @@ optional_policy(`
|
|
|
70e052 |
')
|
|
|
70e052 |
')
|
|
|
70e052 |
|
|
|
70e052 |
+optional_policy(`
|
|
|
70e052 |
+ ganesha_systemctl(glusterd_t)
|
|
|
70e052 |
+ ganesha_dbus_chat(glusterd_t)
|
|
|
70e052 |
+')
|
|
|
70e052 |
+
|
|
|
70e052 |
optional_policy(`
|
|
|
70e052 |
hostname_exec(glusterd_t)
|
|
|
70e052 |
')
|
|
|
70e052 |
@@ -310,8 +313,8 @@ optional_policy(`
|
|
|
70e052 |
optional_policy(`
|
|
|
70e052 |
rpc_systemctl_nfsd(glusterd_t)
|
|
|
70e052 |
rpc_systemctl_rpcd(glusterd_t)
|
|
|
70e052 |
+
|
|
|
70e052 |
rpc_domtrans_nfsd(glusterd_t)
|
|
|
70e052 |
- rpc_dbus_chat_nfsd(glusterd_t)
|
|
|
70e052 |
rpc_domtrans_rpcd(glusterd_t)
|
|
|
70e052 |
rpc_manage_nfs_state_data(glusterd_t)
|
|
|
70e052 |
rpc_manage_nfs_state_data_dir(glusterd_t)
|
|
|
a5bc36 |
diff --git a/modemmanager.te b/modemmanager.te
|
|
|
a5bc36 |
index 5a177cd5a..c7fd00ea0 100644
|
|
|
a5bc36 |
--- a/modemmanager.te
|
|
|
a5bc36 |
+++ b/modemmanager.te
|
|
|
a5bc36 |
@@ -29,7 +29,7 @@ kernel_read_system_state(modemmanager_t)
|
|
|
a5bc36 |
|
|
|
a5bc36 |
corecmd_exec_bin(modemmanager_t)
|
|
|
a5bc36 |
|
|
|
a5bc36 |
-dev_read_sysfs(modemmanager_t)
|
|
|
a5bc36 |
+dev_rw_sysfs(modemmanager_t)
|
|
|
a5bc36 |
dev_read_urand(modemmanager_t)
|
|
|
a5bc36 |
dev_rw_modem(modemmanager_t)
|
|
|
a5bc36 |
|
|
|
a5bc36 |
diff --git a/nagios.te b/nagios.te
|
|
|
a5bc36 |
index a5e1cfda8..4141c6374 100644
|
|
|
a5bc36 |
--- a/nagios.te
|
|
|
a5bc36 |
+++ b/nagios.te
|
|
|
a5bc36 |
@@ -217,6 +217,9 @@ tunable_policy(`nagios_run_sudo',`
|
|
|
a5bc36 |
|
|
|
a5bc36 |
selinux_compute_access_vector(nagios_t)
|
|
|
a5bc36 |
|
|
|
a5bc36 |
+ systemd_write_inherited_logind_sessions_pipes(nagios_t)
|
|
|
a5bc36 |
+ systemd_dbus_chat_logind(nagios_t)
|
|
|
a5bc36 |
+
|
|
|
a5bc36 |
logging_send_audit_msgs(nagios_t)
|
|
|
a5bc36 |
')
|
|
|
a5bc36 |
|
|
|
a5bc36 |
@@ -365,6 +368,9 @@ tunable_policy(`nagios_run_sudo',`
|
|
|
a5bc36 |
|
|
|
a5bc36 |
selinux_compute_access_vector(nrpe_t)
|
|
|
a5bc36 |
|
|
|
a5bc36 |
+ systemd_write_inherited_logind_sessions_pipes(nrpe_t)
|
|
|
a5bc36 |
+ systemd_dbus_chat_logind(nrpe_t)
|
|
|
a5bc36 |
+
|
|
|
a5bc36 |
logging_send_audit_msgs(nrpe_t)
|
|
|
a5bc36 |
')
|
|
|
a5bc36 |
|
|
|
a5bc36 |
@@ -375,6 +381,13 @@ optional_policy(`
|
|
|
a5bc36 |
')
|
|
|
a5bc36 |
')
|
|
|
a5bc36 |
|
|
|
a5bc36 |
+optional_policy(`
|
|
|
a5bc36 |
+ tunable_policy(`nagios_run_sudo',`
|
|
|
a5bc36 |
+ sssd_read_config(nrpe_t)
|
|
|
a5bc36 |
+ sssd_manage_lib_files(nrpe_t)
|
|
|
a5bc36 |
+ sssd_read_pid_files(nrpe_t)
|
|
|
a5bc36 |
+ ')
|
|
|
a5bc36 |
+')
|
|
|
a5bc36 |
|
|
|
a5bc36 |
tunable_policy(`nagios_use_nfs',`
|
|
|
a5bc36 |
fs_manage_nfs_files(nrpe_t)
|
|
|
a5bc36 |
@@ -616,3 +629,7 @@ optional_policy(`
|
|
|
a5bc36 |
optional_policy(`
|
|
|
a5bc36 |
unconfined_domain(nagios_unconfined_plugin_t)
|
|
|
a5bc36 |
')
|
|
|
a5bc36 |
+
|
|
|
a5bc36 |
+optional_policy(`
|
|
|
a5bc36 |
+ systemd_dbus_chat_logind(nagios_unconfined_plugin_t)
|
|
|
a5bc36 |
+')
|
|
|
15f807 |
diff --git a/nova.te b/nova.te
|
|
|
15f807 |
index 2259a5192..af8dd5527 100644
|
|
|
15f807 |
--- a/nova.te
|
|
|
15f807 |
+++ b/nova.te
|
|
|
15f807 |
@@ -124,6 +124,7 @@ corenet_sendrecv_dns_server_packets(nova_domain)
|
|
|
15f807 |
corenet_sendrecv_dhcpd_server_packets(nova_domain)
|
|
|
15f807 |
|
|
|
15f807 |
auth_use_nsswitch(nova_t)
|
|
|
15f807 |
+auth_use_pam(nova_t)
|
|
|
15f807 |
auth_read_passwd(nova_domain)
|
|
|
15f807 |
|
|
|
15f807 |
dev_read_sysfs(nova_domain)
|
|
|
15f807 |
@@ -132,7 +133,7 @@ dev_read_rand(nova_domain)
|
|
|
15f807 |
|
|
|
15f807 |
fs_getattr_all_fs(nova_domain)
|
|
|
15f807 |
|
|
|
15f807 |
-init_read_utmp(nova_domain)
|
|
|
15f807 |
+init_rw_utmp(nova_domain)
|
|
|
15f807 |
|
|
|
15f807 |
libs_exec_ldconfig(nova_domain)
|
|
|
15f807 |
|
|
|
70e052 |
diff --git a/rhcs.te b/rhcs.te
|
|
|
70e052 |
index 0e8b031bb..c029ccd71 100644
|
|
|
70e052 |
--- a/rhcs.te
|
|
|
70e052 |
+++ b/rhcs.te
|
|
|
70e052 |
@@ -265,7 +265,7 @@ optional_policy(`
|
|
|
70e052 |
')
|
|
|
70e052 |
|
|
|
70e052 |
optional_policy(`
|
|
|
70e052 |
- rpc_dbus_chat_nfsd(cluster_t)
|
|
|
70e052 |
+ ganesha_dbus_chat(cluster_t)
|
|
|
70e052 |
')
|
|
|
70e052 |
|
|
|
70e052 |
optional_policy(`
|
|
|
70e052 |
diff --git a/rpc.fc b/rpc.fc
|
|
|
70e052 |
index b08ec8d2d..38a2f0911 100644
|
|
|
70e052 |
--- a/rpc.fc
|
|
|
70e052 |
+++ b/rpc.fc
|
|
|
70e052 |
@@ -1,5 +1,3 @@
|
|
|
70e052 |
-
|
|
|
70e052 |
-
|
|
|
70e052 |
#
|
|
|
70e052 |
# /etc
|
|
|
70e052 |
#
|
|
|
70e052 |
@@ -11,10 +9,6 @@
|
|
|
70e052 |
/usr/lib/systemd/system/nfs.* -- gen_context(system_u:object_r:nfsd_unit_file_t,s0)
|
|
|
70e052 |
/usr/lib/systemd/system/rpc.* -- gen_context(system_u:object_r:rpcd_unit_file_t,s0)
|
|
|
70e052 |
|
|
|
70e052 |
-/usr/lib/systemd/system/nfs-ganesha-config.* -- gen_context(system_u:object_r:nfsd_unit_file_t,s0)
|
|
|
70e052 |
-/usr/lib/systemd/system/nfs-ganesha-lock.* -- gen_context(system_u:object_r:nfsd_unit_file_t,s0)
|
|
|
70e052 |
-/usr/lib/systemd/system/nfs-ganesha.*e -- gen_context(system_u:object_r:nfsd_unit_file_t,s0)
|
|
|
70e052 |
-
|
|
|
70e052 |
#
|
|
|
70e052 |
# /sbin
|
|
|
70e052 |
#
|
|
|
70e052 |
@@ -33,15 +27,12 @@
|
|
|
70e052 |
/usr/sbin/rpc\.svcgssd -- gen_context(system_u:object_r:gssd_exec_t,s0)
|
|
|
70e052 |
/usr/sbin/sm-notify -- gen_context(system_u:object_r:rpcd_exec_t,s0)
|
|
|
70e052 |
|
|
|
70e052 |
-/usr/bin/ganesha\.nfsd -- gen_context(system_u:object_r:nfsd_exec_t,s0)
|
|
|
70e052 |
-
|
|
|
70e052 |
#
|
|
|
70e052 |
# /var
|
|
|
70e052 |
#
|
|
|
70e052 |
/var/lib/nfs(/.*)? gen_context(system_u:object_r:var_lib_nfs_t,s0)
|
|
|
70e052 |
|
|
|
70e052 |
/var/run/sm-notify.* gen_context(system_u:object_r:rpcd_var_run_t,s0)
|
|
|
70e052 |
-/var/run/ganesha.* gen_context(system_u:object_r:rpcd_var_run_t,s0)
|
|
|
70e052 |
/var/run/rpc\.statd(/.*)? gen_context(system_u:object_r:rpcd_var_run_t,s0)
|
|
|
70e052 |
/var/run/rpc\.statd\.pid -- gen_context(system_u:object_r:rpcd_var_run_t,s0)
|
|
|
70e052 |
|
|
|
70e052 |
diff --git a/rpc.if b/rpc.if
|
|
|
70e052 |
index 2ee527f2a..79a2a9c48 100644
|
|
|
70e052 |
--- a/rpc.if
|
|
|
70e052 |
+++ b/rpc.if
|
|
|
70e052 |
@@ -530,24 +530,3 @@ interface(`rpc_gssd_noatsecure',`
|
|
|
70e052 |
|
|
|
70e052 |
allow $1 gssd_t:process { noatsecure rlimitinh };
|
|
|
70e052 |
')
|
|
|
70e052 |
-
|
|
|
70e052 |
-########################################
|
|
|
70e052 |
-## <summary>
|
|
|
70e052 |
-## Send and receive messages from
|
|
|
70e052 |
-## ganesha over dbus.
|
|
|
70e052 |
-## </summary>
|
|
|
70e052 |
-## <param name="domain">
|
|
|
70e052 |
-## <summary>
|
|
|
70e052 |
-## Domain allowed access.
|
|
|
70e052 |
-## </summary>
|
|
|
70e052 |
-## </param>
|
|
|
70e052 |
-#
|
|
|
70e052 |
-interface(`rpc_dbus_chat_nfsd',`
|
|
|
70e052 |
- gen_require(`
|
|
|
70e052 |
- type nfsd_t;
|
|
|
70e052 |
- class dbus send_msg;
|
|
|
70e052 |
- ')
|
|
|
70e052 |
-
|
|
|
70e052 |
- allow $1 nfsd_t:dbus send_msg;
|
|
|
70e052 |
- allow nfsd_t $1:dbus send_msg;
|
|
|
70e052 |
-')
|
|
|
70e052 |
diff --git a/rpc.te b/rpc.te
|
|
|
304846 |
index f4df4fda2..b9665f773 100644
|
|
|
70e052 |
--- a/rpc.te
|
|
|
70e052 |
+++ b/rpc.te
|
|
|
70e052 |
@@ -65,13 +65,6 @@ systemd_unit_file(nfsd_unit_file_t)
|
|
|
70e052 |
type var_lib_nfs_t;
|
|
|
70e052 |
files_mountpoint(var_lib_nfs_t)
|
|
|
70e052 |
|
|
|
70e052 |
-type nfsd_tmp_t;
|
|
|
70e052 |
-files_tmp_file(nfsd_tmp_t)
|
|
|
70e052 |
-
|
|
|
70e052 |
-typealias nfsd_t alias ganesha_t;
|
|
|
70e052 |
-typealias nfsd_exec_t alias ganesha_exec_t;
|
|
|
70e052 |
-typealias nfsd_unit_file_t alias ganesha_unit_file_t;
|
|
|
70e052 |
-
|
|
|
70e052 |
########################################
|
|
|
70e052 |
#
|
|
|
70e052 |
# Common rpc domain local policy
|
|
|
70e052 |
@@ -234,17 +227,8 @@ optional_policy(`
|
|
|
70e052 |
|
|
|
70e052 |
allow nfsd_t self:capability { dac_read_search dac_override sys_admin sys_rawio sys_resource };
|
|
|
70e052 |
|
|
|
70e052 |
-allow nfsd_t self:process { setcap };
|
|
|
70e052 |
-
|
|
|
70e052 |
allow nfsd_t exports_t:file read_file_perms;
|
|
|
70e052 |
|
|
|
70e052 |
-manage_dirs_pattern(nfsd_t, nfsd_tmp_t, nfsd_tmp_t)
|
|
|
70e052 |
-manage_files_pattern(nfsd_t, nfsd_tmp_t, nfsd_tmp_t)
|
|
|
70e052 |
-files_tmp_filetrans(nfsd_t, nfsd_tmp_t, { file dir })
|
|
|
70e052 |
-
|
|
|
70e052 |
-manage_files_pattern(nfsd_t, rpcd_var_run_t, rpcd_var_run_t)
|
|
|
70e052 |
-files_pid_filetrans(nfsd_t, rpcd_var_run_t, { file })
|
|
|
70e052 |
-
|
|
|
70e052 |
# for /proc/fs/nfs/exports - should we have a new type?
|
|
|
70e052 |
kernel_read_system_state(nfsd_t)
|
|
|
70e052 |
kernel_read_network_state(nfsd_t)
|
|
|
70e052 |
@@ -318,16 +302,6 @@ tunable_policy(`nfs_export_all_ro',`
|
|
|
70e052 |
files_read_non_security_files(nfsd_t)
|
|
|
70e052 |
')
|
|
|
70e052 |
|
|
|
70e052 |
-optional_policy(`
|
|
|
70e052 |
- glusterd_manage_log(nfsd_t)
|
|
|
70e052 |
- glusterd_manage_pid(nfsd_t)
|
|
|
70e052 |
-')
|
|
|
70e052 |
-
|
|
|
70e052 |
-optional_policy(`
|
|
|
70e052 |
- dbus_system_bus_client(nfsd_t)
|
|
|
70e052 |
- dbus_acquire_svc_system_dbusd(nfsd_t)
|
|
|
70e052 |
-')
|
|
|
70e052 |
-
|
|
|
70e052 |
optional_policy(`
|
|
|
70e052 |
mount_exec(nfsd_t)
|
|
|
70e052 |
mount_manage_pid_files(nfsd_t)
|
|
|
304846 |
@@ -357,6 +331,8 @@ kernel_signal(gssd_t)
|
|
|
304846 |
|
|
|
304846 |
corecmd_exec_bin(gssd_t)
|
|
|
304846 |
|
|
|
304846 |
+domain_manage_all_domains_keyrings(gssd_t)
|
|
|
304846 |
+
|
|
|
304846 |
fs_list_rpc(gssd_t)
|
|
|
304846 |
fs_rw_rpc_sockets(gssd_t)
|
|
|
304846 |
fs_read_rpc_files(gssd_t)
|
|
|
304846 |
diff --git a/rpm.te b/rpm.te
|
|
|
304846 |
index 7394a0dfc..4402cbe09 100644
|
|
|
304846 |
--- a/rpm.te
|
|
|
304846 |
+++ b/rpm.te
|
|
|
304846 |
@@ -34,6 +34,7 @@ logging_log_file(rpm_log_t)
|
|
|
304846 |
|
|
|
304846 |
type rpm_var_lib_t;
|
|
|
304846 |
files_type(rpm_var_lib_t)
|
|
|
304846 |
+files_mountpoint(rpm_var_lib_t)
|
|
|
304846 |
typealias rpm_var_lib_t alias var_lib_rpm_t;
|
|
|
304846 |
|
|
|
304846 |
type rpm_var_cache_t;
|
|
|
304846 |
diff --git a/snapper.fc b/snapper.fc
|
|
|
304846 |
index 4f4bdb397..0a43846a8 100644
|
|
|
304846 |
--- a/snapper.fc
|
|
|
304846 |
+++ b/snapper.fc
|
|
|
304846 |
@@ -7,6 +7,7 @@
|
|
|
304846 |
|
|
|
304846 |
/mnt/(.*/)?\.snapshots(/.*)? gen_context(system_u:object_r:snapperd_data_t,s0)
|
|
|
304846 |
/\.snapshots(/.*)? gen_context(system_u:object_r:snapperd_data_t,s0)
|
|
|
304846 |
+
|
|
|
304846 |
/usr/\.snapshots(/.*)? gen_context(system_u:object_r:snapperd_data_t,s0)
|
|
|
304846 |
/var/\.snapshots(/.*)? gen_context(system_u:object_r:snapperd_data_t,s0)
|
|
|
304846 |
/etc/\.snapshots(/.*)? gen_context(system_u:object_r:snapperd_data_t,s0)
|
|
|
304846 |
diff --git a/snapper.te b/snapper.te
|
|
|
304846 |
index 8c9e4a200..5be6d3542 100644
|
|
|
304846 |
--- a/snapper.te
|
|
|
304846 |
+++ b/snapper.te
|
|
|
304846 |
@@ -22,7 +22,7 @@ files_type(snapperd_data_t)
|
|
|
304846 |
#
|
|
|
304846 |
# snapperd local policy
|
|
|
304846 |
#
|
|
|
304846 |
-allow snapperd_t self:capability { dac_read_search fowner sys_admin };
|
|
|
304846 |
+allow snapperd_t self:capability { dac_read_search dac_override fowner sys_admin };
|
|
|
304846 |
allow snapperd_t self:process setsched;
|
|
|
304846 |
|
|
|
304846 |
allow snapperd_t self:fifo_file rw_fifo_file_perms;
|
|
|
304846 |
@@ -57,6 +57,8 @@ files_read_all_files(snapperd_t)
|
|
|
304846 |
files_read_all_symlinks(snapperd_t)
|
|
|
304846 |
files_list_all(snapperd_t)
|
|
|
304846 |
files_manage_isid_type_dirs(snapperd_t)
|
|
|
304846 |
+files_manage_non_security_dirs(snapperd_t)
|
|
|
304846 |
+files_relabel_non_security_files(snapperd_t)
|
|
|
304846 |
|
|
|
304846 |
fs_getattr_all_fs(snapperd_t)
|
|
|
304846 |
fs_mount_xattr_fs(snapperd_t)
|
|
|
15f807 |
diff --git a/sysstat.te b/sysstat.te
|
|
|
15f807 |
index a2690e315..efb2f855c 100644
|
|
|
15f807 |
--- a/sysstat.te
|
|
|
15f807 |
+++ b/sysstat.te
|
|
|
15f807 |
@@ -44,6 +44,7 @@ dev_read_urand(sysstat_t)
|
|
|
15f807 |
|
|
|
15f807 |
files_search_var(sysstat_t)
|
|
|
15f807 |
files_read_etc_runtime_files(sysstat_t)
|
|
|
15f807 |
+files_search_all_mountpoints(sysstat_t)
|
|
|
15f807 |
|
|
|
15f807 |
fs_getattr_all_fs(sysstat_t)
|
|
|
15f807 |
fs_list_inotifyfs(sysstat_t)
|