#DESC Rpcd - RPC daemon

#

# Authors:  Stephen Smalley <sds@epoch.ncsc.mil> and Timothy Fraser  

#           Russell Coker <russell@coker.com.au>

# Depends: portmap.te

# X-Debian-Packages: nfs-common

#

#################################

#

# Rules for the rpcd_t and nfsd_t domain.

#

define(`rpc_domain', `

ifdef(`targeted_policy', `

daemon_base_domain($1, `, transitionbool')

', `

daemon_base_domain($1)

')

can_network($1_t)

allow $1_t port_type:tcp_socket name_connect;

can_ypbind($1_t)

allow $1_t { etc_runtime_t etc_t }:file { getattr read };

read_locale($1_t)

allow $1_t self:capability net_bind_service;

dontaudit $1_t self:capability net_admin;

allow $1_t var_t:dir { getattr search };

allow $1_t var_lib_t:dir search;

allow $1_t var_lib_nfs_t:dir create_dir_perms;

allow $1_t var_lib_nfs_t:file create_file_perms;

# do not log when it tries to bind to a port belonging to another domain

dontaudit $1_t reserved_port_type:{ tcp_socket udp_socket } name_bind;

allow $1_t reserved_port_t:{ udp_socket tcp_socket } name_bind;

allow $1_t self:netlink_route_socket r_netlink_socket_perms;

allow $1_t self:unix_dgram_socket create_socket_perms;

allow $1_t self:unix_stream_socket create_stream_socket_perms;

# bind to arbitary unused ports

allow $1_t port_t:{ tcp_socket udp_socket } name_bind;

allow $1_t sysctl_rpc_t:dir search;

allow $1_t sysctl_rpc_t:file rw_file_perms;

')

type exports_t, file_type, sysadmfile;

dontaudit userdomain exports_t:file getattr;

# rpcd_t is the domain of rpc daemons.

# rpcd_exec_t is the type of rpc daemon programs.

#

rpc_domain(rpcd)

var_run_domain(rpcd)

allow rpcd_t rpcd_var_run_t:dir setattr;

# for rpc.rquotad

allow rpcd_t sysctl_t:dir r_dir_perms;

allow rpcd_t self:fifo_file rw_file_perms;

# rpcd_t needs to talk to the portmap_t domain

can_udp_send(rpcd_t, portmap_t)

allow initrc_t exports_t:file r_file_perms;

ifdef(`distro_redhat', `

allow rpcd_t self:capability { chown dac_override setgid setuid };

# for /etc/rc.d/init.d/nfs to create /etc/exports

allow initrc_t exports_t:file write;

')

allow rpcd_t self:file { getattr read };

# nfs kernel server needs kernel UDP access.  It is less risky and painful

# to just give it everything.

can_network_server(kernel_t)

#can_udp_send(kernel_t, rpcd_t)

#can_udp_send(rpcd_t, kernel_t)

rpc_domain(nfsd)

domain_auto_trans(sysadm_t, nfsd_exec_t, nfsd_t)

role sysadm_r types nfsd_t;

# for /proc/fs/nfs/exports - should we have a new type?

allow nfsd_t proc_t:file r_file_perms;

allow nfsd_t proc_net_t:dir search;

allow nfsd_t exports_t:file { getattr read };

allow nfsd_t nfsd_fs_t:filesystem mount;

allow nfsd_t nfsd_fs_t:dir search;

allow nfsd_t nfsd_fs_t:file rw_file_perms;

allow initrc_t sysctl_rpc_t:dir search;

allow initrc_t sysctl_rpc_t:file rw_file_perms;

type nfsd_rw_t, file_type, sysadmfile, usercanread;

type nfsd_ro_t, file_type, sysadmfile, usercanread;

bool nfs_export_all_rw false;

if(nfs_export_all_rw) {

allow nfsd_t { noexattrfile file_type -shadow_t }:dir r_dir_perms;

r_dir_file(kernel_t, noexattrfile)

create_dir_file(kernel_t,{ file_type -shadow_t })

}

dontaudit kernel_t shadow_t:file getattr;

bool nfs_export_all_ro false;

if(nfs_export_all_ro) {

allow nfsd_t { noexattrfile file_type -shadow_t }:dir r_dir_perms;

r_dir_file(kernel_t,{ noexattrfile file_type -shadow_t })

}

allow nfsd_t { nfsd_rw_t nfsd_ro_t }:dir r_dir_perms;

create_dir_file(kernel_t, nfsd_rw_t);

r_dir_file(kernel_t, nfsd_ro_t);

allow kernel_t nfsd_t:udp_socket rw_socket_perms;

can_udp_send(kernel_t, nfsd_t)

can_udp_send(nfsd_t, kernel_t)

# does not really need this, but it is easier to just allow it

allow nfsd_t var_run_t:dir search;

allow nfsd_t self:capability { sys_admin sys_resource };

allow nfsd_t fs_type:filesystem getattr;

can_udp_send(nfsd_t, portmap_t)

can_udp_send(portmap_t, nfsd_t)

can_tcp_connect(nfsd_t, portmap_t)

# for exportfs and rpc.mountd

allow nfsd_t tmp_t:dir getattr;

r_dir_file(rpcd_t, rpc_pipefs_t)

allow rpcd_t rpc_pipefs_t:sock_file { read write };

dontaudit rpcd_t selinux_config_t:dir { search };

allow rpcd_t proc_net_t:dir search;

rpc_domain(gssd)

can_kerberos(gssd_t)

ifdef(`kerberos.te', `

allow gssd_t krb5_keytab_t:file r_file_perms;

')

allow gssd_t urandom_device_t:chr_file { getattr read };

r_dir_file(gssd_t, tmp_t)

tmp_domain(gssd)

allow gssd_t self:fifo_file { read write };

r_dir_file(gssd_t, proc_net_t)

allow gssd_t rpc_pipefs_t:dir r_dir_perms;

allow gssd_t rpc_pipefs_t:sock_file { read write };

allow gssd_t rpc_pipefs_t:file r_file_perms;

allow gssd_t self:capability { dac_override dac_read_search setuid };

allow nfsd_t devtty_t:chr_file rw_file_perms;

allow rpcd_t devtty_t:chr_file rw_file_perms;

bool allow_gssd_read_tmp true;

if (allow_gssd_read_tmp) {

#

#needs to be able to udpate the kerberos ticket file

#

ifdef(`targeted_policy', `

r_dir_file(gssd_t, tmp_t)

allow gssd_t tmp_t:file write;

', `

r_dir_file(gssd_t, user_tmpfile)

allow gssd_t user_tmpfile:file write;

')

}