#

# This is the guide for converting old macros to local policy

# and new interfaces.

#

# $1, $2, etc. are replaced with and the first and second, etc.

# parameters to the old macro.

#

########################################

#

# Attributes

#

# $1 is the type this attribute is on

#

# auth: complete

#

auth_read_shadow($1)

#

# auth_chkpwd: complete

#

auth_domtrans_chk_passwd($1)

#

# auth_write: complete

#

# handled by appropriate interfaces

#

# domain: complete

#

domain_type($1)

#

# etc_writer: complete

#

# handled by appropriate interfaces

#

# file_type: complete

#

files_type($1)

#

# fs_domain: complete

#

# handled by appropriate interfaces

#

# mlsfileread: complete

#

mls_file_read_up($1)

#

# mlsfileupgrade: complete

#

mls_file_upgrade($1)

#

# mlsfilewrite: complete

#

mls_file_write_down($1)

#

# mlsprocsetsl: complete

#

mls_process_set_level($1)

#

# mlsprocwrite: complete

#

mls_process_write_down($1)

#

# mlstrustedobject: complete

#

mls_trusted_object($1)

#

# mta_delivery_agent:

#

mta_mailserver_delivery($1)

# for piping mail to a command

kernel_read_system_state($1)

corecmd_exec_shell($1)

files_read_etc_runtime_files($1)

mta_append_spool($1)

ifdef(`TODO',`

optional_policy(`arpwatch.te',`

	# why is mail delivered to a directory of type arpwatch_data_t?

	allow mta_delivery_agent arpwatch_data_t:dir search;

')

') dnl end TODO

#

# mta_user_agent:

#

mta_mailserver_user_agent($1)

domain_use_wide_inherit_fd($1)

userdom_sigchld_all_users($1)

userdom_use_all_user_fd($1)

userdom_use_sysadm_terms($1)

allow mta_user_agent privmail:fd use;

allow mta_user_agent privmail:process sigchld;

allow mta_user_agent privmail:fifo_file { read write };

allow mta_user_agent sysadm_t:fifo_file { read write };

optional_policy(`arpwatch.te',`

	# why is mail delivered to a directory of type arpwatch_data_t?

	allow mta_user_agent arpwatch_tmp_t:file rw_file_perms;

	ifdef(`hide_broken_symptoms', `

		dontaudit mta_user_agent arpwatch_t:packet_socket { read write };

	')

')

optional_policy(`cron.te',`

	cron_sigchld($1)

	cron_read_system_job_tmp_files($1)

')

optional_policy(`logrotate.te',`

	logrotate_read_tmp_files($1)

')

#

# nscd_client_domain: complete

#

optional_policy(`nscd.te',`

	nscd_use_socket($1)

')

#

# privfd: complete

#

domain_wide_inherit_fd($1)

#

# privlog: complete

#

optional_policy(`logging.te',`

	logging_send_syslog_msg($1)

')

#

# privmail: complete

#

optional_policy(`mta.te',`

	mta_send_mail($1)

')

#

# privmem: complete

#

# handled by appropriate interfaces

#

# privmodule: complete

#

modutils_domtrans_insmod($1)

#

# privowner: complete

#

domain_obj_id_change_exempt($1)

#

# privrole: complete

#

domain_role_change_exempt($1)

#

# privuser: complete

#

domain_subj_id_change_exempt($1)

#

# priv_system_role: complete

#

domain_system_change_exempt($1)

#

# secure_file_type: complete

#

files_security_file($1)

#

# sysadmfile: complete

#

files_type($1)

#

# sysctl_kernel_writer: complete

#

# handled by appropriate interfaces

#

# userspace_objmgr: complete

#

allow $1 self:process getattr;

# Receive notifications of policy reloads and enforcing status changes.

allow $1 self:netlink_selinux_socket { create bind read };

selinux_get_fs_mount($1)

selinux_validate_context($1)

selinux_compute_access_vector($1)

selinux_compute_create_context($1)

selinux_compute_relabel_context($1)

selinux_compute_user_contexts($1)

seutil_read_config($1)

seutil_read_default_contexts($1)

#

# web_client_domain:

#

optional_policy(`squid.te',`

	squid_use($1)

')

########################################

#

# Access macros

#

#

# access_terminal():

#

allow $1 $2_tty_device_t:chr_file { read write getattr ioctl };

allow $1 devtty_t:chr_file { read write getattr ioctl };

allow $1 devpts_t:dir { read search getattr };

allow $1 $2_devpts_t:chr_file { read write getattr ioctl };

#

# anonymous_domain():

#

gen_tunable(allow_$1_anon_write,false)

miscfiles_read_public_files($1_t)

tunable_policy(`allow_$1_anon_write',`

miscfiles_manage_public_files($1_t)

') 

#

# append_log_domain():

#

type $1_log_t;

logging_log_file($1_log_t)

allow $1_t var_log_t:dir ra_dir_perms;

allow $1_t $1_log_t:file  { create ra_file_perms };

type_transition $1_t var_log_t:file $1_log_t;

#

# append_logdir_domain():

#

type $1_log_t;

logging_log_file($1_log_t)

allow $1_t var_log_t:dir ra_dir_perms;

allow $1_t $1_log_t:dir { setattr ra_dir_perms };

allow $1_t $1_log_t:file  { create ra_file_perms };

type_transition $1_t var_log_t:file $1_log_t;

#

# application_domain():

#

type $1_t;

type $1_exec_t;

domain_type($1_t)

domain_entry_file($1_t,$1_exec_t)

libs_use_ld_so($1_t)

libs_use_shared_libs($1_t)

# a "run" interface needs to be

# added, and have sysadm_t use it

# in a optional_policy block.

#

# base_can_network($1,$2,$3):

#

allow $1 self:$2_socket connected_socket_perms;

corenet_$2_sendrecv_all_if($1)

corenet_raw_sendrecv_all_if($1)

corenet_$2_sendrecv_all_nodes($1)

corenet_raw_sendrecv_all_nodes($1)

corenet_$2_bind_all_nodes($1)

sysnet_read_config($1)

# if $3 is specified (remove _port_t from $3):

corenet_$2_sendrecv_$3_port($1)

# else:

corenet_$2_sendrecv_all_ports($1)

#

# base_file_read_access(): complete

#

kernel_read_kernel_sysctl($1)

corecmd_list_bin($1)

corecmd_read_bin_symlink($1)

corecmd_read_bin_file($1)

corecmd_read_bin_pipe($1)

corecmd_read_bin_socket($1)

corecmd_list_sbin($1)

corecmd_read_sbin_symlink($1)

corecmd_read_sbin_file($1)

corecmd_read_sbin_pipe($1)

corecmd_read_sbin_socket($1)

files_list_home($1)

files_read_usr_files($1)

seutil_read_config($1)

tunable_policy(`read_default_t',`

	files_list_default($1)

	files_read_default_files($1)

	files_read_default_symlinks($1)

	files_read_default_sockets($1)

	files_read_default_pipes($1)

')

#

# base_pty_perms():

#

allow $1_t ptmx_t:chr_file rw_file_perms;

allow $1_t devpts_t:filesystem getattr;

allow $1_t devpts_t:dir { getattr read search };

dontaudit $1_t bsdpty_device_t:chr_file { getattr read write };

#

# can_create($1,$2,$3): complete

#

# for each object class in $3:

# if dir:

allow $1 $2:dir create_dir_perms;

# else if lnk_file:

allow $1 $2:lnk_file create_lnk_perms;

# else:

allow $1 $2:$3 create_file_perms;

#

# can_create_other_pty(): complete

#

allow $1_t $2_devpts_t:chr_file { rw_file_perms setattr };

term_create_pty($1_t,$2_devpts_t)

#

# can_create_pty(): complete

#

# $2 may require more conversion

type $1_devpts_t $2;

term_pty($1_devpts_t)

allow $1_t $1_devpts_t:chr_file { rw_file_perms setattr };

term_create_pty($1_t,$1_devpts_t)

#

# can_exec_any(): complete

#

corecmd_exec_bin($1)

corecmd_exec_sbin($1)

domain_exec_all_entry_files($1)

files_exec_etc_files($1)

libs_use_ld_so($1)

libs_use_shared_libs($1)

libs_exec_ld_so($1)

libs_exec_lib_files($1)

#

# can_getcon(): complete

#

allow $1 self:process getattr;

kernel_read_system_state($1)

#

# can_getsecurity(): complete

#

selinux_get_fs_mount($1)

selinux_validate_context($1)

selinux_compute_access_vector($1)

selinux_compute_create_context($1)

selinux_compute_relabel_context($1)

selinux_compute_user_contexts($1)

#

# can_kerberos(): complete

#

optional_policy(`kerberos.te',`

	kerberos_use($1)

')

#

# can_ldap(): complete

#

sysnet_use_ldap($1)

#

# can_loadpol(): complete

#

selinux_get_fs_mount($1)

selinux_load_policy($1)

#

# can_network($1):

#

allow $1 self:tcp_socket create_stream_socket_perms;

allow $1 self:udp_socket create_socket_perms;

corenet_tcp_sendrecv_all_if($1)

corenet_udp_sendrecv_all_if($1)

corenet_raw_sendrecv_all_if($1)

corenet_tcp_sendrecv_all_nodes($1)

corenet_udp_sendrecv_all_nodes($1)

corenet_raw_sendrecv_all_nodes($1)

corenet_tcp_sendrecv_all_ports($1)

corenet_udp_sendrecv_all_ports($1)

corenet_tcp_bind_all_nodes($1)

corenet_udp_bind_all_nodes($1)

sysnet_read_config($1)

optional_policy(`mount.te',`

	mount_send_nfs_client_request($1)

')

#

# can_network($1,$2):

#

can_network_tcp($1, `$2')

can_network_udp($1, `$2')

optional_policy(`mount.te',`

	mount_send_nfs_client_request($1)

')

#

# can_network_client():

#

can_network_client_tcp($1, `$2')

can_network_udp($1, `$2')

#

# can_network_client_tcp($1): complete

#

allow $1 self:tcp_socket create_socket_perms;

corenet_tcp_sendrecv_all_if($1)

corenet_raw_sendrecv_all_if($1)

corenet_tcp_sendrecv_all_nodes($1)

corenet_raw_sendrecv_all_nodes($1)

corenet_tcp_sendrecv_all_ports($1)

corenet_tcp_bind_all_nodes($1)

sysnet_read_config($1)

#

# can_network_client_tcp($1,$2):

#

# remove _port_t from $2

allow $1 self:tcp_socket create_socket_perms;

corenet_tcp_sendrecv_all_if($1)

corenet_raw_sendrecv_all_if($1)

corenet_tcp_sendrecv_all_nodes($1)

corenet_raw_sendrecv_all_nodes($1)

corenet_tcp_sendrecv_$2_port($1)

corenet_tcp_bind_all_nodes($1)

sysnet_read_config($1)

#

# can_network_server():

#

allow $1 self:tcp_socket create_stream_socket_perms;

allow $1 self:udp_socket { connect };

base_can_network($1, tcp, `$2')

base_can_network($1, udp, `$2')

#

# can_network_server_tcp():

#

allow $1 self:tcp_socket create_stream_socket_perms;

base_can_network($1, tcp, `$2')

#

# can_network_tcp():

#

can_network_server_tcp($1, `$2')

can_network_client_tcp($1, `$2')

#

# can_network_udp(): complete

#

base_can_network($1, udp, `$2')

allow $1 self:udp_socket { connect };

#

# can_ps():

#

allow $1 $2:dir { search getattr read };

allow $1 $2:{ file lnk_file } { read getattr };

allow $1 $2:process getattr;

# We need to suppress this denial because procps tries to access

# /proc/pid/environ and this now triggers a ptrace check in recent kernels

# (2.4 and 2.6).  Might want to change procps to not do this, or only if

# running in a privileged domain.

dontaudit $1 $2:process ptrace;

#

# can_ptrace():

#

allow $1 $2:process ptrace;

allow $2 $1:process sigchld;

#

# can_portmap():

#

sysnet_use_portmap($1)

#

# can_resolve(): complete

#

sysnet_dns_name_resolve($1)

#

# can_setbool(): complete

#

selinux_get_fs_mount($1)

selinux_set_boolean($1)

#

# can_setcon(): complete

#

# get mount point is due to libselinux init

#

allow $1 self:process setcurrent;

selinux_get_fs_mount($1)

#

# can_setenforce(): complete

#

# get mount point is due to libselinux init

#

selinux_get_fs_mount($1)

selinux_set_enforce_mode($1)

#

# can_setexec(): complete

#

# get mount point is due to libselinux init

#

allow $1 self:process setexec;

selinux_get_fs_mount($1)

#

# can_setfscreate(): complete

#

# get mount point is due to libselinux init

#

allow $1 self:process setfscreate;

selinux_get_fs_mount($1)

#

# can_setsecparam(): complete

#

# get mount point is due to libselinux init

#

selinux_get_fs_mount($1)

kernel_setsecparam($1)

#

# can_sysctl(): complete

#

kernel_rw_all_sysctl($1)

#

# can_tcp_connect():

#

allow $1 $2:tcp_socket { connectto recvfrom };

allow $2 $1:tcp_socket { acceptfrom recvfrom };

allow $2 kernel_t:tcp_socket recvfrom;

allow $1 kernel_t:tcp_socket recvfrom;

#

# can_udp_send():

#

allow $1 $2:udp_socket sendto;

allow $2 $1:udp_socket recvfrom;

#

# can_unix_connect():

#

allow $1 $2:unix_stream_socket connectto;

#

# can_unix_send():

#

allow $1 $2:unix_dgram_socket sendto;

#

# can_winbind():

#

ifdef(`winbind.te', `

allow $1 winbind_var_run_t:dir { getattr search };

allow $1 winbind_t:unix_stream_socket connectto;

allow $1 winbind_var_run_t:sock_file { getattr read write };

')

#

# can_ypbind(): complete

#

optional_policy(`nis.te',`

	nis_use_ypbind($1)

')

#

# create_append_log_file():

#

allow $1 $2:dir { read getattr search add_name write };

allow $1 $2:file { create ioctl getattr setattr append link };

#

# create_dir_file():

#

allow $1 $2:dir create_dir_perms;

allow $1 $2:file create_file_perms;

allow $1 $2:lnk_file create_lnk_perms;

#

# create_dir_notdevfile():

#

allow $1 $2:dir create_dir_perms;

allow $1 $2:{ file sock_file fifo_file } create_file_perms;

allow $1 $2:lnk_file create_lnk_perms;

#

# daemon_base_domain():

#

type $1_t;

type $1_exec_t;

init_daemon_domain($1_t,$1_exec_t)

dontaudit $1_t self:capability sys_tty_config;

allow $1_t self:process signal_perms;

kernel_list_proc($1_t)

kernel_read_proc_symlinks($1_t)

kernel_read_kernel_sysctl($1_t)

dev_read_sysfs($1_t)

fs_search_auto_mountpoints($1_t)

term_dontaudit_use_console($1_t)

domain_use_wide_inherit_fd($1_t)

init_use_fd($1_t)

init_use_script_pty($1_t)

libs_use_ld_so($1_t)

libs_use_shared_libs($1_t)

logging_send_syslog_msg($1_t)

userdom_dontaudit_use_unpriv_user_fd($1_t)

ifdef(`targeted_policy',`

	term_dontaudit_use_unallocated_tty($1_t)

	term_dontaudit_use_generic_pty($1_t)

	files_dontaudit_read_root_file($1_t)

')

optional_policy(`selinuxutil.te',`

	seutil_sigchld_newrole($1_t)

')

optional_policy(`udev.te', `

	udev_read_db($1_t)

')

ifdef(`TODO',`

optional_policy(`rhgb.te',`

	rhgb_domain($1_t)

')

') dnl end TODO

#

# daemon_domain():

#

type $1_t;

type $1_exec_t;

init_daemon_domain($1_t,$1_exec_t)

type $1_var_run_t;

files_pid_file($1_var_run_t)

dontaudit $1_t self:capability sys_tty_config;

allow $1_t $1_var_run_t:file create_file_perms;

allow $1_t $1_var_run_t:dir rw_dir_perms;

files_create_pid($1_t,$1_var_run_t)

kernel_read_kernel_sysctl($1_t)

kernel_list_proc($1_t)

kernel_read_proc_symlinks($1_t)

dev_read_sysfs($1_t)

fs_getattr_all_fs($1_t)

fs_search_auto_mountpoints($1_t)

term_dontaudit_use_console($1_t)

domain_use_wide_inherit_fd($1_t)

init_use_fd($1_t)

init_use_script_pty($1_t)

libs_use_ld_so($1_t)

libs_use_shared_libs($1_t)

logging_send_syslog_msg($1_t)

miscfiles_read_localization($1_t)

userdom_dontaudit_use_unpriv_user_fd($1_t)

userdom_dontaudit_search_sysadm_home_dir($1_t)

ifdef(`targeted_policy', `

	term_dontaudit_use_unallocated_tty($1_t)

	term_dontaudit_use_generic_pty($1_t)

	files_dontaudit_read_root_file($1_t)

')

optional_policy(`selinuxutil.te',`

	seutil_sigchld_newrole($1_t)

')

optional_policy(`udev.te', `

	udev_read_db($1_t)

')

ifdef(`TODO',`

optional_policy(`rhgb.te',`

	rhgb_domain($1_t)

')

') dnl end TODO

#

# daemon_sub_domain():

#

# $3 may need more work

type $2_t; #, daemon $3;

domain_type($2_t)

type $2_exec_t;

domain_entry_file($2_t,$2_exec_t)

role system_r types $2_t;

allow $2_t self:process signal_perms;

domain_auto_trans($1, $2_exec_t, $2_t)

logging_send_syslog_msg($1_t)

libs_use_ld_so($2_t)

libs_use_shared_libs($2_t)

kernel_list_proc($1_t)

kernel_read_proc_symlinks($1_t)

#

# etc_domain(): complete

#

type $1_etc_t; #, usercanread;

files_type($1_etc_t)

allow $1_t $1_etc_t:file { getattr read };

files_search_etc($1_t)

#

# etcdir_domain(): complete

#

type $1_etc_t; #, usercanread;

files_type($1_etc_t)

allow $1_t $1_etc_t:file r_file_perms;

allow $1_t $1_etc_t:dir r_dir_perms;

allow $1_t $1_etc_t:lnk_file { getattr read };

files_search_etc($1_t)

#

# file_type_auto_trans($1,$2,$3): complete

#

allow $1 $2:dir rw_dir_perms;

allow $1 $3:dir create_dir_perms;

allow $1 $3:file create_file_perms;

allow $1 $3:lnk_file create_lnk_perms;

allow $1 $3:sock_file create_file_perms;

allow $1 $3:fifo_file create_file_perms;

type_transition $1 $2:{ file lnk_file sock_file fifo_file } $3;

#

# file_type_auto_trans($1,$2,$3,$4): complete

#

allow $1 $2:dir rw_dir_perms;

# for each i in $4:

can_create_internal($1,$3,$i)

type_transition $1 $2:$i $3;

#

# general_domain_access(): complete

#

allow $1 self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };

allow $1 self:fd use;

allow $1 self:fifo_file rw_file_perms;

allow $1 self:unix_dgram_socket create_socket_perms;

allow $1 self:unix_stream_socket create_stream_socket_perms;

allow $1 self:unix_dgram_socket sendto;

allow $1 self:unix_stream_socket connectto;

allow $1 self:shm create_shm_perms;

allow $1 self:sem create_sem_perms;

allow $1 self:msgq create_msgq_perms;

allow $1 self:msg { send receive };

fs_search_auto_mountpoints($1)

userdom_use_unpriv_users_fd($1)

optional_policy(`nis.te',`

	nis_use_ypbind($1)

')

#

# general_proc_read_access(): complete

#

kernel_read_system_state($1)

kernel_read_network_state($1)

kernel_read_software_raid_state($1)

kernel_getattr_core($1)

kernel_getattr_message_if($1)

kernel_read_kernel_sysctl($1)

#

# in_user_role():

#

# this is replaced by run interfaces

#

# init_service_domain(): complete

#

type $1_t;

type $1_exec_t;

init_domain($1_t,$1_exec_t)

dontaudit $1_t self:capability sys_tty_config;

allow self:process signal_perms;

kernel_list_proc($1_t)

kernel_read_proc_symlinks($1_t)

dev_read_sysfs($1_t)

term_dontaudit_use_console($1_t)

libs_use_ld_so($1_t)

libs_use_shared_libs($1_t)

logging_send_syslog_msg($1_t)

userdom_dontaudit_use_unpriv_user_fd($1_t)

ifdef(`targeted_policy',`

	term_dontaudit_use_unallocated_tty($1_t)

	term_dontaudit_use_generic_pty($1_t)

	files_dontaudit_read_root_file($1_t)

')

optional_policy(`udev.te',`

	udev_read_db($1_t)

')

#

# inetd_child_domain():

#

type $1_t;

type $1_exec_t;

inetd_(udp_|tcp_)?service_domain($1_t,$1_exec_t)

role system_r types $1_t;

type $1_tmp_t;

files_tmp_file($1_tmp_t)

type $1_var_run_t;

files_pid_file($1_var_run_t)

allow $1_t self:process signal_perms;

allow $1_t self:fifo_file rw_file_perms;

allow $1_t self:tcp_socket connected_stream_socket_perms;

# for identd

# cjp: this should probably only be inetd_child rules?

allow $1_t self:netlink_tcpdiag_socket r_netlink_socket_perms;

allow $1_t self:capability { setuid setgid };

files_search_home($1_t)

optional_policy(`kerberos.te',`

	kerberos_use($1_t)

')

#end for identd

allow $1_t $1_tmp_t:dir create_dir_perms;

allow $1_t $1_tmp_t:file create_file_perms;

files_create_tmp_files($1_t, $1_tmp_t, { file dir })

allow $1_t $1_var_run_t:file create_file_perms;

allow $1_t $1_var_run_t:dir rw_dir_perms;

files_create_pid($1_t,$1_var_run_t)

kernel_read_kernel_sysctl($1_t)

kernel_read_system_state($1_t)

kernel_read_network_state($1_t)

corenet_tcp_sendrecv_all_if($1_t)

corenet_udp_sendrecv_all_if($1_t)

corenet_raw_sendrecv_all_if($1_t)

corenet_tcp_sendrecv_all_nodes($1_t)

corenet_udp_sendrecv_all_nodes($1_t)

corenet_raw_sendrecv_all_nodes($1_t)

corenet_tcp_sendrecv_all_ports($1_t)

corenet_udp_sendrecv_all_ports($1_t)

corenet_tcp_bind_all_nodes($1_t)

corenet_udp_bind_all_nodes($1_t)

dev_read_urand($1_t)

fs_getattr_xattr_fs($1_t)

files_read_etc_files($1_t)

libs_use_ld_so($1_t)

libs_use_shared_libs($1_t)

logging_send_syslog_msg($1_t)

miscfiles_read_localization($1_t)

sysnet_read_config($1_t)

optional_policy(`nis.te',`

	nis_use_ypbind($1_t)

')

optional_policy(`nscd.te',`

	nscd_use_socket($1_t)

')

#

# legacy_domain(): complete

#

allow $1_t self:process { execmem execstack };

libs_legacy_use_shared_libs($1_t)

libs_legacy_use_ld_so($1_t)

#

# lock_domain(): complete

#