Chris PeBenito 31b7c0
#DESC DHCPD - DHCP server
Chris PeBenito 31b7c0
#
Chris PeBenito 31b7c0
# Author: Russell Coker <russell@coker.com.au> 
Chris PeBenito 31b7c0
# based on the dhcpc_t policy from:
Chris PeBenito 31b7c0
#          Wayne Salamon (NAI Labs) <wsalamon@tislabs.com>
Chris PeBenito 31b7c0
# X-Debian-Packages: dhcp dhcp3-server 
Chris PeBenito 31b7c0
#
Chris PeBenito 31b7c0
Chris PeBenito 31b7c0
#################################
Chris PeBenito 31b7c0
#
Chris PeBenito 31b7c0
# Rules for the dhcpd_t domain.
Chris PeBenito 31b7c0
#
Chris PeBenito 31b7c0
# dhcpd_t is the domain for the server side of DHCP. dhcpd, the DHCP 
Chris PeBenito 31b7c0
# server daemon rc scripts, runs in this domain.
Chris PeBenito 31b7c0
# dhcpd_exec_t is the type of the dhcpdd executable.
Chris PeBenito 31b7c0
# The dhcpd_t can be used for other DHCPC related files as well.
Chris PeBenito 31b7c0
#
Chris PeBenito 31b7c0
daemon_domain(dhcpd, `, nscd_client_domain')
Chris PeBenito 31b7c0
Chris PeBenito 31b7c0
# for UDP port 4011
Chris PeBenito 31b7c0
allow dhcpd_t pxe_port_t:udp_socket name_bind;
Chris PeBenito 31b7c0
Chris PeBenito 31b7c0
type dhcp_etc_t, file_type, sysadmfile, usercanread;
Chris PeBenito 31b7c0
Chris PeBenito 31b7c0
# Use the network.
Chris PeBenito 31b7c0
can_network(dhcpd_t)
Chris PeBenito 31b7c0
allow dhcpd_t port_type:tcp_socket name_connect;
Chris PeBenito 31b7c0
allow dhcpd_t dhcpd_port_t:{ tcp_socket udp_socket } name_bind;
Chris PeBenito 31b7c0
can_ypbind(dhcpd_t)
Chris PeBenito 31b7c0
allow dhcpd_t self:unix_dgram_socket create_socket_perms;
Chris PeBenito 31b7c0
allow dhcpd_t self:unix_stream_socket create_socket_perms;
Chris PeBenito 31b7c0
allow dhcpd_t self:netlink_route_socket r_netlink_socket_perms;
Chris PeBenito 31b7c0
Chris PeBenito 31b7c0
allow dhcpd_t var_lib_t:dir search;
Chris PeBenito 31b7c0
Chris PeBenito 31b7c0
allow dhcpd_t devtty_t:chr_file { read write };
Chris PeBenito 31b7c0
Chris PeBenito 31b7c0
# Use capabilities
Chris PeBenito 31b7c0
allow dhcpd_t self:capability { net_raw net_bind_service };
Chris PeBenito 31b7c0
dontaudit dhcpd_t self:capability  net_admin;
Chris PeBenito 31b7c0
Chris PeBenito 31b7c0
# Allow access to the dhcpd file types
Chris PeBenito 31b7c0
type dhcp_state_t, file_type, sysadmfile;
Chris PeBenito 31b7c0
type dhcpd_state_t, file_type, sysadmfile;
Chris PeBenito 31b7c0
allow dhcpd_t dhcp_etc_t:file { read getattr };
Chris PeBenito 31b7c0
allow dhcpd_t dhcp_etc_t:dir search;
Chris PeBenito 31b7c0
file_type_auto_trans(dhcpd_t, dhcp_state_t, dhcpd_state_t, file)
Chris PeBenito 31b7c0
rw_dir_create_file(dhcpd_t, dhcpd_state_t)
Chris PeBenito 31b7c0
Chris PeBenito 31b7c0
allow dhcpd_t etc_t:lnk_file read;
Chris PeBenito 31b7c0
allow dhcpd_t { etc_t etc_runtime_t }:file r_file_perms;
Chris PeBenito 31b7c0
Chris PeBenito 31b7c0
# Allow dhcpd_t programs to execute themselves and bin_t (uname etc)
Chris PeBenito 31b7c0
can_exec(dhcpd_t, { dhcpd_exec_t bin_t })
Chris PeBenito 31b7c0
Chris PeBenito 31b7c0
# Allow dhcpd_t to use packet sockets
Chris PeBenito 31b7c0
allow dhcpd_t self:packet_socket create_socket_perms;
Chris PeBenito 31b7c0
allow dhcpd_t self:rawip_socket create_socket_perms;
Chris PeBenito 31b7c0
Chris PeBenito 31b7c0
# allow to run utilities and scripts
Chris PeBenito 31b7c0
allow dhcpd_t { bin_t sbin_t }:dir r_dir_perms;
Chris PeBenito 31b7c0
allow dhcpd_t { bin_t sbin_t }:{ file lnk_file } rx_file_perms;
Chris PeBenito 31b7c0
allow dhcpd_t self:fifo_file { read write getattr };
Chris PeBenito 31b7c0
Chris PeBenito 31b7c0
# allow reading /proc
Chris PeBenito 31b7c0
allow dhcpd_t proc_t:{ file lnk_file } r_file_perms;
Chris PeBenito 31b7c0
tmp_domain(dhcpd)
Chris PeBenito 31b7c0
Chris PeBenito 31b7c0
ifdef(`distro_gentoo', `
Chris PeBenito 31b7c0
allow dhcpd_t self:capability { chown dac_override setgid setuid sys_chroot };
Chris PeBenito 31b7c0
allow initrc_t dhcpd_state_t:file setattr;
Chris PeBenito 31b7c0
')
Chris PeBenito 31b7c0
r_dir_file(dhcpd_t, usr_t)
Chris PeBenito 31b7c0
allow dhcpd_t { urandom_device_t random_device_t }:chr_file r_file_perms;
Chris PeBenito 31b7c0
Chris PeBenito 31b7c0
ifdef(`named.te', `
Chris PeBenito 31b7c0
allow dhcpd_t { named_conf_t named_zone_t }:dir search;
Chris PeBenito 31b7c0
allow dhcpd_t dnssec_t:file { getattr read };
Chris PeBenito 31b7c0
')