# DESC yam - Yum/Apt Mirroring

#

# Author: David Hampton <hampton@employees.org>

#

#

# Yam downloads lots of files, indexes them, and makes them available

# for upload.  Define a type for these file.

#

type yam_content_t, file_type, sysadmfile, httpdcontent;

#

# Common definitions used by both the command line and the cron

# invocation of yam.

#

define(`yam_common',`

# Update the content being managed by yam.

create_dir_file($1_t, yam_content_t)

# Content can also be on ISO image files.

r_dir_file($1_t, iso9660_t)

# Need to go through /var to get to /var/yam

# Go through /var/www to get to /var/www/yam

allow $1_t var_t:dir { getattr search };

allow $1_t httpd_sys_content_t:dir { getattr search };

# Allow access to locale database,  nsswitch, and mtab

read_locale($1_t)

allow $1_t etc_t:file { getattr read };

allow $1_t etc_runtime_t:file { getattr read };

# Python seems to need things from various places

allow $1_t { bin_t sbin_t }:dir { search getattr };

allow $1_t { bin_t sbin_t lib_t usr_t }:file { getattr read };

allow $1_t bin_t:lnk_file read;

# Python works fine without reading /proc/meminfo

dontaudit $1_t proc_t:dir search;

dontaudit $1_t proc_t:file { getattr read };

# Yam wants to run rsync, lftp, mount, and a shell.  Allow the latter

# two here.  Run rsync and lftp in the yam_t context so that we dont

# have to give any other programs write access to the yam_t files.

general_domain_access($1_t)

can_exec($1_t, shell_exec_t)

can_exec($1_t, rsync_exec_t)

can_exec($1_t, bin_t)

can_exec($1_t, usr_t) #/usr/share/createrepo/genpkgmetadata.py

ifdef(`mount.te', `

domain_auto_trans($1_t, mount_exec_t, mount_t)

')

# Rsync and lftp need to network.  They also set files attributes to

# match whats on the remote server.

can_network_client($1_t)

allow $1_t { http_port_t rsync_port_t }:tcp_socket name_connect;

allow $1_t self:capability { chown fowner fsetid dac_override };

allow $1_t self:process execmem;

# access to sysctl_kernel_t ( proc/sys/kernel/* )

read_sysctl($1_t)

# Programs invoked to build package lists need various permissions.

# genpkglist creates tmp files in /var/cache/apt/genpkglist

allow $1_t var_t:file { getattr read write };

allow $1_t var_t:dir read;

# mktemp

allow $1_t urandom_device_t:chr_file read;

# mv

allow $1_t proc_t:lnk_file read;

allow $1_t selinux_config_t:dir search;

allow $1_t selinux_config_t:file { getattr read };

')

##########

##########

#

# Runnig yam from the command line

#

application_domain(yam, `, nscd_client_domain')

role system_r types yam_t;

yam_common(yam)

etc_domain(yam)

tmp_domain(yam)

# Terminal access

allow yam_t devpts_t:dir search;

allow yam_t devtty_t:chr_file { read write };

allow yam_t sshd_t:fd use;

allow yam_t sysadm_devpts_t:chr_file { getattr ioctl read write };

# Reading dotfiles...

allow yam_t sysadm_home_dir_t:dir search;		# /root

allow yam_t sysadm_home_t:dir search;			# /root/xxx

allow yam_t home_root_t:dir search;			# /home

allow yam_t user_home_dir_t:dir r_dir_perms;		# /home/user

##########

##########

#

# Running yam from cron

#

application_domain(yam_crond, `, nscd_client_domain')

role system_r types yam_crond_t;

ifdef(`crond.te', `

system_crond_entry(yam_exec_t, yam_crond_t)

')

yam_common(yam_crond)

allow yam_crond_t yam_etc_t:file r_file_perms;

file_type_auto_trans(yam_crond_t, tmp_t, yam_tmp_t, `{ file dir }')

allow yam_crond_t devtty_t:chr_file { read write };

# Reading dotfiles...

# LFTP uses a directory for its dotfiles

allow yam_crond_t default_t:dir search;

# Don't know why init tries to read this.

allow initrc_t yam_etc_t:file { getattr read };

##########

##########

# The whole point of this program is to make updates available on a

# local web server.  Allow apache access to these files.

ifdef(`apache.te', `

r_dir_file(httpd_t, yam_content_t)

')

ifdef(`webalizer.te', `

dontaudit webalizer_t yam_content_t:dir search;

')

# Mount needs access to the yam directories in order to mount the ISO

# files on a loobpack file system.

ifdef(`mount.te', `

allow mount_t yam_content_t:dir mounton;

allow mount_t yam_content_t:file { read write };

')