#DESC LOCATE - Security Enhanced version of the GNU Locate

#

# Author:  Dan Walsh <dwalsh@redhat.com>

#

#################################

#

# Rules for the locate_t domain.

#

# locate_exec_t is the type of the locate executable.

#

daemon_base_domain(locate)

role system_r types locate_t;

role sysadm_r types locate_t;

allow locate_t fs_t:filesystem getattr;

ifdef(`crond.te', `

system_crond_entry(locate_exec_t, locate_t)

allow system_crond_t locate_log_t:dir rw_dir_perms;

allow system_crond_t locate_log_t:file { create append getattr };

allow system_crond_t locate_etc_t:file { getattr read };

')

allow locate_t { userpty_type admin_tty_type }:chr_file rw_file_perms;

allow locate_t { fs_type file_type }:dir r_dir_perms;

dontaudit locate_t sysctl_t:dir getattr;

allow locate_t file_type:lnk_file r_file_perms;

allow locate_t { file_type -shadow_t }:{ lnk_file sock_file fifo_file file } getattr;

dontaudit locate_t { file_type -shadow_t }:{ lnk_file sock_file fifo_file file } read;

dontaudit locate_t security_t:dir getattr;

dontaudit locate_t shadow_t:file getattr;

allow locate_t { ttyfile device_type device_t }:{ chr_file blk_file } getattr;

allow locate_t unlabeled_t:dir_file_class_set getattr;

allow locate_t unlabeled_t:dir read;

logdir_domain(locate)

etcdir_domain(locate)

type locate_var_lib_t, file_type, sysadmfile;

typealias locate_var_lib_t alias var_lib_locate_t;

create_dir_file(locate_t, locate_var_lib_t)

dontaudit locate_t sysadmfile:file getattr;

allow locate_t proc_t:file { getattr read };

allow locate_t self:unix_stream_socket create_socket_perms;

#

# Need to be able to exec renice

#

can_exec(locate_t, bin_t)

dontaudit locate_t rpc_pipefs_t:dir r_dir_perms;

dontaudit locate_t rpc_pipefs_t:file getattr;

#

# Read Mtab file

#

allow locate_t etc_runtime_t:file { getattr read };

#

# Read nsswitch file

#

allow locate_t etc_t:file { getattr read };

dontaudit locate_t self:capability dac_override;

allow locate_t self:capability dac_read_search;

# sysadm_t runs locate in his own domain.

# We use a type alias to simplify the rest of the policy,

# which often refers to $1_locate_t for the user domains.

typealias sysadm_t alias sysadm_locate_t;

allow locate_t userdomain:fd use;

ifdef(`cardmgr.te', `

allow locate_t cardmgr_var_run_t:chr_file getattr;

')