|
Chris PeBenito |
a996bd |
## <summary>Apache web server</summary>
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
b1421d |
########################################
|
|
Chris PeBenito |
b1421d |
## <summary>
|
|
Chris PeBenito |
b1421d |
## Create a set of derived types for apache
|
|
Chris PeBenito |
b1421d |
## web content.
|
|
Chris PeBenito |
b1421d |
## </summary>
|
|
Chris PeBenito |
b1421d |
## <param name="prefix">
|
|
Chris PeBenito |
885b83 |
## <summary>
|
|
Chris PeBenito |
b1421d |
## The prefix to be used for deriving type names.
|
|
Chris PeBenito |
885b83 |
## </summary>
|
|
Chris PeBenito |
b1421d |
## </param>
|
|
Chris PeBenito |
b1421d |
#
|
|
Chris PeBenito |
a996bd |
template(`apache_content_template',`
|
|
Chris PeBenito |
a3cf80 |
gen_require(`
|
|
Chris PeBenito |
a3cf80 |
attribute httpdcontent;
|
|
Chris PeBenito |
a3cf80 |
attribute httpd_exec_scripts;
|
|
Chris PeBenito |
123a99 |
attribute httpd_script_exec_type;
|
|
Chris PeBenito |
a3cf80 |
type httpd_t, httpd_suexec_t, httpd_log_t;
|
|
Chris PeBenito |
a3cf80 |
')
|
|
Chris PeBenito |
b1421d |
# allow write access to public file transfer
|
|
Chris PeBenito |
b1421d |
# services files.
|
|
Chris PeBenito |
b1421d |
gen_tunable(allow_httpd_$1_script_anon_write,false)
|
|
Chris PeBenito |
b1421d |
|
|
Chris PeBenito |
a996bd |
#This type is for webpages
|
|
Chris PeBenito |
a996bd |
type httpd_$1_content_t, httpdcontent; # customizable
|
|
Chris PeBenito |
a996bd |
files_type(httpd_$1_content_t)
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
a996bd |
# This type is used for .htaccess files
|
|
Chris PeBenito |
a996bd |
type httpd_$1_htaccess_t; # customizable;
|
|
Chris PeBenito |
a996bd |
files_type(httpd_$1_htaccess_t)
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
a996bd |
# Type that CGI scripts run as
|
|
Chris PeBenito |
a996bd |
type httpd_$1_script_t;
|
|
Chris PeBenito |
a996bd |
domain_type(httpd_$1_script_t)
|
|
Chris PeBenito |
a996bd |
role system_r types httpd_$1_script_t;
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
a996bd |
# This type is used for executable scripts files
|
|
Chris PeBenito |
123a99 |
type httpd_$1_script_exec_t, httpd_script_exec_type; # customizable;
|
|
Chris PeBenito |
0f27d9 |
corecmd_shell_entry_type(httpd_$1_script_t)
|
|
Chris PeBenito |
a996bd |
domain_entry_file(httpd_$1_script_t,httpd_$1_script_exec_t)
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
a996bd |
# The following three are the only areas that
|
|
Chris PeBenito |
a996bd |
# scripts can read, read/write, or append to
|
|
Chris PeBenito |
a996bd |
type httpd_$1_script_ro_t, httpdcontent; # customizable
|
|
Chris PeBenito |
a996bd |
files_type(httpd_$1_script_ro_t)
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
a996bd |
type httpd_$1_script_rw_t, httpdcontent; # customizable
|
|
Chris PeBenito |
a996bd |
files_type(httpd_$1_script_rw_t)
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
a996bd |
type httpd_$1_script_ra_t, httpdcontent; # customizable
|
|
Chris PeBenito |
a996bd |
files_type(httpd_$1_script_ra_t)
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
a996bd |
allow httpd_t httpd_$1_htaccess_t:file r_file_perms;
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
a996bd |
domain_auto_trans(httpd_suexec_t, httpd_$1_script_exec_t, httpd_$1_script_t)
|
|
Chris PeBenito |
a996bd |
allow httpd_suexec_t httpd_$1_script_t:fd use;
|
|
Chris PeBenito |
a996bd |
allow httpd_$1_script_t httpd_suexec_t:fd use;
|
|
Chris PeBenito |
a996bd |
allow httpd_$1_script_t httpd_suexec_t:fifo_file rw_file_perms;
|
|
Chris PeBenito |
a996bd |
allow httpd_$1_script_t httpd_suexec_t:process sigchld;
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
a996bd |
allow httpd_suexec_t { httpd_$1_content_t httpd_$1_script_ro_t httpd_$1_script_rw_t httpd_$1_script_exec_t }:dir { getattr search };
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
a996bd |
allow httpd_$1_script_t self:fifo_file rw_file_perms;
|
|
Chris PeBenito |
2e0a88 |
allow httpd_$1_script_t self:unix_stream_socket connectto;
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
a996bd |
allow httpd_$1_script_t httpd_t:fifo_file write;
|
|
Chris PeBenito |
a996bd |
# apache should set close-on-exec
|
|
Chris PeBenito |
a996bd |
dontaudit httpd_$1_script_t httpd_t:unix_stream_socket { read write };
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
a996bd |
# Allow the script process to search the cgi directory, and users directory
|
|
Chris PeBenito |
a996bd |
allow httpd_$1_script_t httpd_$1_content_t:dir { getattr search };
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
a996bd |
allow httpd_$1_script_t httpd_log_t:file { getattr append };
|
|
Chris PeBenito |
a996bd |
allow httpd_$1_script_t httpd_log_t:dir search;
|
|
Chris PeBenito |
a996bd |
logging_search_logs(httpd_$1_script_t)
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
a996bd |
can_exec(httpd_$1_script_t, httpd_$1_script_exec_t)
|
|
Chris PeBenito |
a996bd |
allow httpd_$1_script_t httpd_$1_script_exec_t:dir { search getattr };
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
a996bd |
allow httpd_$1_script_t httpd_$1_script_ra_t:dir ra_dir_perms;
|
|
Chris PeBenito |
a996bd |
allow httpd_$1_script_t httpd_$1_script_ra_t:file ra_file_perms;
|
|
Chris PeBenito |
a996bd |
allow httpd_$1_script_t httpd_$1_script_ra_t:lnk_file { getattr read };
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
a996bd |
allow httpd_$1_script_t httpd_$1_script_ro_t:dir { getattr read search };
|
|
Chris PeBenito |
a996bd |
allow httpd_$1_script_t httpd_$1_script_ro_t:file { read getattr };
|
|
Chris PeBenito |
a996bd |
allow httpd_$1_script_t httpd_$1_script_ro_t:lnk_file { getattr read };
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
a996bd |
allow httpd_$1_script_t httpd_$1_script_rw_t:dir create_dir_perms;
|
|
Chris PeBenito |
a996bd |
allow httpd_$1_script_t httpd_$1_script_rw_t:file create_file_perms;
|
|
Chris PeBenito |
a996bd |
allow httpd_$1_script_t httpd_$1_script_rw_t:lnk_file create_lnk_perms;
|
|
Chris PeBenito |
a996bd |
allow httpd_$1_script_t httpd_$1_script_rw_t:sock_file create_file_perms;
|
|
Chris PeBenito |
a996bd |
allow httpd_$1_script_t httpd_$1_script_rw_t:fifo_file create_file_perms;
|
|
Chris PeBenito |
103fe2 |
files_tmp_filetrans(httpd_$1_script_t,httpd_$1_script_rw_t,{ dir file lnk_file sock_file fifo_file })
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
e749cd |
kernel_dontaudit_search_sysctl(httpd_$1_script_t)
|
|
Chris PeBenito |
e749cd |
kernel_dontaudit_search_kernel_sysctl(httpd_$1_script_t)
|
|
Chris PeBenito |
e749cd |
|
|
Chris PeBenito |
a996bd |
dev_read_rand(httpd_$1_script_t)
|
|
Chris PeBenito |
a996bd |
dev_read_urand(httpd_$1_script_t)
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
fb63d0 |
corecmd_exec_all_executables(httpd_$1_script_t)
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
a996bd |
files_exec_etc_files(httpd_$1_script_t)
|
|
Chris PeBenito |
a996bd |
files_read_etc_files(httpd_$1_script_t)
|
|
Chris PeBenito |
a996bd |
files_search_home(httpd_$1_script_t)
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
a996bd |
libs_use_ld_so(httpd_$1_script_t)
|
|
Chris PeBenito |
a996bd |
libs_use_shared_libs(httpd_$1_script_t)
|
|
Chris PeBenito |
a996bd |
libs_exec_ld_so(httpd_$1_script_t)
|
|
Chris PeBenito |
a996bd |
libs_exec_lib_files(httpd_$1_script_t)
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
a996bd |
miscfiles_read_fonts(httpd_$1_script_t)
|
|
Chris PeBenito |
b1421d |
miscfiles_read_public_files(httpd_$1_script_t)
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
a996bd |
seutil_dontaudit_search_config(httpd_$1_script_t)
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
e749cd |
tunable_policy(`httpd_enable_cgi && httpd_unified',`
|
|
Chris PeBenito |
522b59 |
allow httpd_$1_script_t httpdcontent:file entrypoint;
|
|
Chris PeBenito |
e749cd |
allow httpd_$1_script_t httpdcontent:dir create_dir_perms;
|
|
Chris PeBenito |
e749cd |
allow httpd_$1_script_t httpdcontent:file create_file_perms;
|
|
Chris PeBenito |
e749cd |
allow httpd_$1_script_t httpdcontent:lnk_file create_lnk_perms;
|
|
Chris PeBenito |
e749cd |
can_exec(httpd_$1_script_t, httpdcontent)
|
|
Chris PeBenito |
a996bd |
')
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
b1421d |
tunable_policy(`allow_httpd_$1_script_anon_write',`
|
|
Chris PeBenito |
b1421d |
miscfiles_manage_public_files(httpd_$1_script_t)
|
|
Chris PeBenito |
b1421d |
')
|
|
Chris PeBenito |
b1421d |
|
|
Chris PeBenito |
a996bd |
# Allow the web server to run scripts and serve pages
|
|
Chris PeBenito |
a996bd |
tunable_policy(`httpd_builtin_scripting',`
|
|
Chris PeBenito |
a996bd |
allow httpd_t httpd_$1_script_rw_t:dir create_dir_perms;
|
|
Chris PeBenito |
a996bd |
allow httpd_t httpd_$1_script_rw_t:file create_file_perms;
|
|
Chris PeBenito |
a996bd |
allow httpd_t httpd_$1_script_rw_t:lnk_file create_lnk_perms;
|
|
Chris PeBenito |
a996bd |
allow httpd_t httpd_$1_script_rw_t:sock_file rw_file_perms;
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
a996bd |
allow httpd_t httpd_$1_script_ra_t:dir ra_dir_perms;
|
|
Chris PeBenito |
a996bd |
allow httpd_t httpd_$1_script_ra_t:file ra_file_perms;
|
|
Chris PeBenito |
a996bd |
allow httpd_t httpd_$1_script_ra_t:lnk_file { getattr read };
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
a996bd |
allow httpd_t httpd_$1_script_ro_t:dir r_dir_perms;
|
|
Chris PeBenito |
a996bd |
allow httpd_t httpd_$1_script_ro_t:file r_file_perms;
|
|
Chris PeBenito |
a996bd |
allow httpd_t httpd_$1_script_ro_t:lnk_file { getattr read };
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
a996bd |
allow httpd_t httpd_$1_content_t:dir r_dir_perms;
|
|
Chris PeBenito |
a996bd |
allow httpd_t httpd_$1_content_t:file r_file_perms;
|
|
Chris PeBenito |
a996bd |
allow httpd_t httpd_$1_content_t:lnk_file { getattr read };
|
|
Chris PeBenito |
a996bd |
')
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
a996bd |
tunable_policy(`httpd_enable_cgi',`
|
|
Chris PeBenito |
e749cd |
allow httpd_$1_script_t httpd_$1_script_exec_t:file entrypoint;
|
|
Chris PeBenito |
e749cd |
|
|
Chris PeBenito |
e749cd |
# privileged users run the script:
|
|
Chris PeBenito |
e749cd |
domain_auto_trans(httpd_exec_scripts, httpd_$1_script_exec_t, httpd_$1_script_t)
|
|
Chris PeBenito |
e749cd |
allow httpd_exec_scripts httpd_$1_script_t:fd use;
|
|
Chris PeBenito |
e749cd |
allow httpd_$1_script_t httpd_exec_scripts:fd use;
|
|
Chris PeBenito |
e749cd |
allow httpd_$1_script_t httpd_exec_scripts:fifo_file rw_file_perms;
|
|
Chris PeBenito |
e749cd |
allow httpd_$1_script_t httpd_exec_scripts:process sigchld;
|
|
Chris PeBenito |
e749cd |
|
|
Chris PeBenito |
e749cd |
# apache runs the script:
|
|
Chris PeBenito |
a996bd |
domain_auto_trans(httpd_t, httpd_$1_script_exec_t, httpd_$1_script_t)
|
|
Chris PeBenito |
a996bd |
allow httpd_t httpd_$1_script_t:fd use;
|
|
Chris PeBenito |
a996bd |
allow httpd_$1_script_t httpd_t:fd use;
|
|
Chris PeBenito |
a996bd |
allow httpd_$1_script_t httpd_t:fifo_file rw_file_perms;
|
|
Chris PeBenito |
a996bd |
allow httpd_$1_script_t httpd_t:process sigchld;
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
a996bd |
allow httpd_t httpd_$1_script_t:process { signal sigkill sigstop };
|
|
Chris PeBenito |
a996bd |
allow httpd_t httpd_$1_script_exec_t:dir r_dir_perms;
|
|
Chris PeBenito |
a996bd |
allow httpd_t httpd_$1_script_exec_t:file r_file_perms;
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
a996bd |
allow httpd_$1_script_t self:process signal_perms;
|
|
Chris PeBenito |
a996bd |
allow httpd_$1_script_t self:unix_stream_socket create_stream_socket_perms;
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
a996bd |
allow httpd_$1_script_t httpd_t:fd use;
|
|
Chris PeBenito |
a996bd |
allow httpd_$1_script_t httpd_t:process sigchld;
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
a996bd |
kernel_read_system_state(httpd_$1_script_t)
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
a996bd |
dev_read_urand(httpd_$1_script_t)
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
a996bd |
fs_getattr_xattr_fs(httpd_$1_script_t)
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
a996bd |
files_read_etc_runtime_files(httpd_$1_script_t)
|
|
Chris PeBenito |
a996bd |
files_read_usr_files(httpd_$1_script_t)
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
1815ba |
libs_read_lib_files(httpd_$1_script_t)
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
a996bd |
miscfiles_read_localization(httpd_$1_script_t)
|
|
Chris PeBenito |
a996bd |
')
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
8cfa5a |
tunable_policy(`httpd_enable_cgi && httpd_can_network_connect_db',`
|
|
Chris PeBenito |
8cfa5a |
allow httpd_$1_script_t self:tcp_socket create_stream_socket_perms;
|
|
Chris PeBenito |
8cfa5a |
allow httpd_$1_script_t self:udp_socket create_socket_perms;
|
|
Chris PeBenito |
8cfa5a |
|
|
Chris PeBenito |
8cfa5a |
corenet_non_ipsec_sendrecv(httpd_$1_script_t)
|
|
Chris PeBenito |
8cfa5a |
corenet_tcp_sendrecv_all_if(httpd_$1_script_t)
|
|
Chris PeBenito |
8cfa5a |
corenet_udp_sendrecv_all_if(httpd_$1_script_t)
|
|
Chris PeBenito |
8cfa5a |
corenet_tcp_sendrecv_all_nodes(httpd_$1_script_t)
|
|
Chris PeBenito |
8cfa5a |
corenet_udp_sendrecv_all_nodes(httpd_$1_script_t)
|
|
Chris PeBenito |
8cfa5a |
corenet_tcp_sendrecv_all_ports(httpd_$1_script_t)
|
|
Chris PeBenito |
8cfa5a |
corenet_udp_sendrecv_all_ports(httpd_$1_script_t)
|
|
Chris PeBenito |
8cfa5a |
corenet_tcp_connect_postgresql_port(httpd_$1_script_t)
|
|
Chris PeBenito |
8cfa5a |
corenet_tcp_connect_mysqld_port(httpd_$1_script_t)
|
|
Chris PeBenito |
141cff |
corenet_sendrecv_postgresql_client_packets(httpd_$1_script_t)
|
|
Chris PeBenito |
141cff |
corenet_sendrecv_mysqld_client_packets(httpd_$1_script_t)
|
|
Chris PeBenito |
8cfa5a |
|
|
Chris PeBenito |
8cfa5a |
sysnet_read_config(httpd_$1_script_t)
|
|
Chris PeBenito |
8cfa5a |
')
|
|
Chris PeBenito |
8cfa5a |
|
|
Chris PeBenito |
a996bd |
tunable_policy(`httpd_enable_cgi && httpd_can_network_connect',`
|
|
Chris PeBenito |
a996bd |
allow httpd_$1_script_t self:tcp_socket create_stream_socket_perms;
|
|
Chris PeBenito |
a996bd |
allow httpd_$1_script_t self:udp_socket create_socket_perms;
|
|
Chris PeBenito |
bd7037 |
|
|
Chris PeBenito |
e9a408 |
corenet_non_ipsec_sendrecv(httpd_$1_script_t)
|
|
Chris PeBenito |
a996bd |
corenet_tcp_sendrecv_all_if(httpd_$1_script_t)
|
|
Chris PeBenito |
a996bd |
corenet_udp_sendrecv_all_if(httpd_$1_script_t)
|
|
Chris PeBenito |
a996bd |
corenet_tcp_sendrecv_all_nodes(httpd_$1_script_t)
|
|
Chris PeBenito |
a996bd |
corenet_udp_sendrecv_all_nodes(httpd_$1_script_t)
|
|
Chris PeBenito |
a996bd |
corenet_tcp_sendrecv_all_ports(httpd_$1_script_t)
|
|
Chris PeBenito |
a996bd |
corenet_udp_sendrecv_all_ports(httpd_$1_script_t)
|
|
Chris PeBenito |
a996bd |
corenet_tcp_connect_all_ports(httpd_$1_script_t)
|
|
Chris PeBenito |
141cff |
corenet_sendrecv_all_client_packets(httpd_$1_script_t)
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
a996bd |
sysnet_read_config(httpd_$1_script_t)
|
|
Chris PeBenito |
a996bd |
')
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
bb7170 |
optional_policy(`
|
|
Chris PeBenito |
a996bd |
mta_send_mail(httpd_$1_script_t)
|
|
Chris PeBenito |
a996bd |
')
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
bb7170 |
optional_policy(`
|
|
Chris PeBenito |
a996bd |
tunable_policy(`httpd_enable_cgi && allow_ypbind',`
|
|
Chris PeBenito |
a996bd |
nis_use_ypbind_uncond(httpd_$1_script_t)
|
|
Chris PeBenito |
a996bd |
')
|
|
Chris PeBenito |
a996bd |
')
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
bb7170 |
optional_policy(`
|
|
Chris PeBenito |
1815ba |
nscd_socket_use(httpd_$1_script_t)
|
|
Chris PeBenito |
a996bd |
')
|
|
Chris PeBenito |
a996bd |
')
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
b1421d |
#######################################
|
|
Chris PeBenito |
b1421d |
## <summary>
|
|
Chris PeBenito |
bbcd3c |
## The per role template for the apache module.
|
|
Chris PeBenito |
b1421d |
## </summary>
|
|
Chris PeBenito |
b1421d |
## <desc>
|
|
Chris PeBenito |
b1421d |
##
|
|
Chris PeBenito |
b1421d |
## This template creates types used for web pages
|
|
Chris PeBenito |
b1421d |
## and web cgi to be used from the user home directory.
|
|
Chris PeBenito |
b1421d |
##
|
|
Chris PeBenito |
b1421d |
##
|
|
Chris PeBenito |
b1421d |
## This template is invoked automatically for each user, and
|
|
Chris PeBenito |
b1421d |
## generally does not need to be invoked directly
|
|
Chris PeBenito |
b1421d |
## by policy writers.
|
|
Chris PeBenito |
b1421d |
##
|
|
Chris PeBenito |
b1421d |
## </desc>
|
|
Chris PeBenito |
b1421d |
## <param name="userdomain_prefix">
|
|
Chris PeBenito |
885b83 |
## <summary>
|
|
Chris PeBenito |
b1421d |
## The prefix of the user domain (e.g., user
|
|
Chris PeBenito |
b1421d |
## is the prefix for user_t).
|
|
Chris PeBenito |
885b83 |
## </summary>
|
|
Chris PeBenito |
b1421d |
## </param>
|
|
Chris PeBenito |
b1421d |
## <param name="user_domain">
|
|
Chris PeBenito |
885b83 |
## <summary>
|
|
Chris PeBenito |
b1421d |
## The type of the user domain.
|
|
Chris PeBenito |
885b83 |
## </summary>
|
|
Chris PeBenito |
b1421d |
## </param>
|
|
Chris PeBenito |
b1421d |
## <param name="user_role">
|
|
Chris PeBenito |
885b83 |
## <summary>
|
|
Chris PeBenito |
b1421d |
## The role associated with the user domain.
|
|
Chris PeBenito |
885b83 |
## </summary>
|
|
Chris PeBenito |
b1421d |
## </param>
|
|
Chris PeBenito |
b1421d |
#
|
|
Chris PeBenito |
bbcd3c |
template(`apache_per_role_template', `
|
|
Chris PeBenito |
0efe52 |
gen_require(`
|
|
Chris PeBenito |
0efe52 |
attribute httpdcontent, httpd_script_domains;
|
|
Chris PeBenito |
0efe52 |
attribute httpd_exec_scripts;
|
|
Chris PeBenito |
0efe52 |
type httpd_t, httpd_suexec_t, httpd_log_t;
|
|
Chris PeBenito |
0efe52 |
')
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
a996bd |
apache_content_template($1)
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
e749cd |
typeattribute httpd_$1_content_t httpd_script_domains;
|
|
Chris PeBenito |
103fe2 |
userdom_user_home_content($1,httpd_$1_content_t)
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
a996bd |
role $3 types httpd_$1_script_t;
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
a996bd |
allow $2 httpd_$1_content_t:{ dir file lnk_file } { relabelto relabelfrom };
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
a996bd |
allow $2 httpd_$1_htaccess_t:file { create_file_perms relabelto relabelfrom };
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
a996bd |
allow $2 httpd_$1_script_ra_t:lnk_file { create_lnk_perms relabelto relabelfrom };
|
|
Chris PeBenito |
a996bd |
allow $2 httpd_$1_script_ra_t:dir { create_dir_perms relabelto relabelfrom };
|
|
Chris PeBenito |
a996bd |
allow $2 httpd_$1_script_ra_t:file { create_file_perms relabelto relabelfrom };
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
a996bd |
allow $2 httpd_$1_script_ro_t:lnk_file { create_lnk_perms relabelto relabelfrom };
|
|
Chris PeBenito |
a996bd |
allow $2 httpd_$1_script_ro_t:dir { create_dir_perms relabelto relabelfrom };
|
|
Chris PeBenito |
a996bd |
allow $2 httpd_$1_script_ro_t:file { create_file_perms relabelto relabelfrom };
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
a996bd |
allow $2 httpd_$1_script_rw_t:lnk_file { create_lnk_perms relabelto relabelfrom };
|
|
Chris PeBenito |
a996bd |
allow $2 httpd_$1_script_rw_t:dir { create_dir_perms relabelto relabelfrom };
|
|
Chris PeBenito |
a996bd |
allow $2 httpd_$1_script_rw_t:file { create_file_perms relabelto relabelfrom };
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
a996bd |
allow $2 httpd_$1_script_exec_t:dir create_dir_perms;
|
|
Chris PeBenito |
a996bd |
allow $2 httpd_$1_script_exec_t:file create_file_perms;
|
|
Chris PeBenito |
a996bd |
allow $2 httpd_$1_script_exec_t:lnk_file create_lnk_perms;
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
a996bd |
allow $2 httpd_$1_script_exec_t:dir { create_dir_perms relabelto relabelfrom };
|
|
Chris PeBenito |
a996bd |
allow $2 httpd_$1_script_exec_t:file { create_file_perms relabelto relabelfrom };
|
|
Chris PeBenito |
a996bd |
allow $2 httpd_$1_script_exec_t:lnk_file { create_lnk_perms relabelto relabelfrom };
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
e749cd |
tunable_policy(`httpd_enable_cgi',`
|
|
Chris PeBenito |
e749cd |
# If a user starts a script by hand it gets the proper context
|
|
Chris PeBenito |
e749cd |
domain_auto_trans($2, httpd_$1_script_exec_t, httpd_$1_script_t)
|
|
Chris PeBenito |
e749cd |
allow $2 httpd_$1_script_t:fd use;
|
|
Chris PeBenito |
e749cd |
allow httpd_$1_script_t $2:fd use;
|
|
Chris PeBenito |
e749cd |
allow httpd_$1_script_t $2:fifo_file rw_file_perms;
|
|
Chris PeBenito |
e749cd |
allow httpd_$1_script_t $2:process sigchld;
|
|
Chris PeBenito |
e749cd |
')
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
e749cd |
tunable_policy(`httpd_enable_cgi && httpd_unified',`
|
|
Chris PeBenito |
e749cd |
allow httpd_$1_script_t httpdcontent:file entrypoint;
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
e749cd |
domain_auto_trans($2, httpdcontent, httpd_$1_script_t)
|
|
Chris PeBenito |
e749cd |
allow $2 httpd_$1_script_t:fd use;
|
|
Chris PeBenito |
e749cd |
allow httpd_$1_script_t $2:fd use;
|
|
Chris PeBenito |
e749cd |
allow httpd_$1_script_t $2:fifo_file rw_file_perms;
|
|
Chris PeBenito |
e749cd |
allow httpd_$1_script_t $2:process sigchld;
|
|
Chris PeBenito |
a996bd |
')
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
a996bd |
# allow accessing files/dirs below the users home dir
|
|
Chris PeBenito |
a996bd |
tunable_policy(`httpd_enable_homedirs',`
|
|
Chris PeBenito |
103fe2 |
userdom_search_user_home_dirs($1,httpd_t)
|
|
Chris PeBenito |
103fe2 |
userdom_search_user_home_dirs($1,httpd_suexec_t)
|
|
Chris PeBenito |
103fe2 |
userdom_search_user_home_dirs($1,httpd_$1_script_t)
|
|
Chris PeBenito |
a996bd |
')
|
|
Chris PeBenito |
a996bd |
')
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
a996bd |
########################################
|
|
Chris PeBenito |
a996bd |
## <summary>
|
|
Chris PeBenito |
123a99 |
## Read httpd user scripts executables.
|
|
Chris PeBenito |
123a99 |
## </summary>
|
|
Chris PeBenito |
123a99 |
## <param name="domain_prefix">
|
|
Chris PeBenito |
123a99 |
## <summary>
|
|
Chris PeBenito |
123a99 |
## Prefix of the domain. Example, user would be
|
|
Chris PeBenito |
123a99 |
## the prefix for the uder_t domain.
|
|
Chris PeBenito |
123a99 |
## </summary>
|
|
Chris PeBenito |
123a99 |
## </param>
|
|
Chris PeBenito |
123a99 |
## <param name="domain">
|
|
Chris PeBenito |
123a99 |
## <summary>
|
|
Chris PeBenito |
123a99 |
## Domain allowed access.
|
|
Chris PeBenito |
123a99 |
## </summary>
|
|
Chris PeBenito |
123a99 |
## </param>
|
|
Chris PeBenito |
123a99 |
#
|
|
Chris PeBenito |
123a99 |
template(`apache_read_user_scripts',`
|
|
Chris PeBenito |
123a99 |
gen_require(`
|
|
Chris PeBenito |
123a99 |
type httpd_$1_script_exec_t;
|
|
Chris PeBenito |
123a99 |
')
|
|
Chris PeBenito |
123a99 |
|
|
Chris PeBenito |
123a99 |
allow $2 httpd_$1_script_exec_t:dir r_dir_perms;
|
|
Chris PeBenito |
123a99 |
allow $2 httpd_$1_script_exec_t:file r_file_perms;
|
|
Chris PeBenito |
123a99 |
allow $2 httpd_$1_script_exec_t:lnk_file { getattr read };
|
|
Chris PeBenito |
123a99 |
')
|
|
Chris PeBenito |
123a99 |
|
|
Chris PeBenito |
123a99 |
########################################
|
|
Chris PeBenito |
123a99 |
## <summary>
|
|
Chris PeBenito |
123a99 |
## Read user web content.
|
|
Chris PeBenito |
123a99 |
## </summary>
|
|
Chris PeBenito |
123a99 |
## <param name="domain_prefix">
|
|
Chris PeBenito |
123a99 |
## <summary>
|
|
Chris PeBenito |
123a99 |
## Prefix of the domain. Example, user would be
|
|
Chris PeBenito |
123a99 |
## the prefix for the uder_t domain.
|
|
Chris PeBenito |
123a99 |
## </summary>
|
|
Chris PeBenito |
123a99 |
## </param>
|
|
Chris PeBenito |
123a99 |
## <param name="domain">
|
|
Chris PeBenito |
123a99 |
## <summary>
|
|
Chris PeBenito |
123a99 |
## Domain allowed access.
|
|
Chris PeBenito |
123a99 |
## </summary>
|
|
Chris PeBenito |
123a99 |
## </param>
|
|
Chris PeBenito |
123a99 |
#
|
|
Chris PeBenito |
123a99 |
template(`apache_read_user_content',`
|
|
Chris PeBenito |
123a99 |
gen_require(`
|
|
Chris PeBenito |
123a99 |
type httpd_$1_content_t;
|
|
Chris PeBenito |
123a99 |
')
|
|
Chris PeBenito |
123a99 |
|
|
Chris PeBenito |
123a99 |
allow $2 httpd_$1_content_t:dir r_dir_perms;
|
|
Chris PeBenito |
123a99 |
allow $2 httpd_$1_content_t:file r_file_perms;
|
|
Chris PeBenito |
123a99 |
allow $2 httpd_$1_content_t:lnk_file { getattr read };
|
|
Chris PeBenito |
123a99 |
')
|
|
Chris PeBenito |
123a99 |
|
|
Chris PeBenito |
123a99 |
########################################
|
|
Chris PeBenito |
123a99 |
## <summary>
|
|
Chris PeBenito |
b1421d |
## Transition to apache.
|
|
Chris PeBenito |
a996bd |
## </summary>
|
|
Chris PeBenito |
a996bd |
## <param name="domain">
|
|
Chris PeBenito |
885b83 |
## <summary>
|
|
Chris PeBenito |
a996bd |
## Domain allowed access.
|
|
Chris PeBenito |
885b83 |
## </summary>
|
|
Chris PeBenito |
a996bd |
## </param>
|
|
Chris PeBenito |
a996bd |
#
|
|
Chris PeBenito |
a996bd |
interface(`apache_domtrans',`
|
|
Chris PeBenito |
a996bd |
gen_require(`
|
|
Chris PeBenito |
a996bd |
type httpd_t, httpd_exec_t;
|
|
Chris PeBenito |
a996bd |
')
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
a996bd |
corecmd_search_sbin($1)
|
|
Chris PeBenito |
a996bd |
domain_auto_trans($1,httpd_exec_t,httpd_t)
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
a996bd |
allow $1 httpd_t:fd use;
|
|
Chris PeBenito |
a996bd |
allow httpd_t $1:fd use;
|
|
Chris PeBenito |
a996bd |
allow httpd_t $1:fifo_file rw_file_perms;
|
|
Chris PeBenito |
a996bd |
allow httpd_t $1:process sigchld;
|
|
Chris PeBenito |
a996bd |
')
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
a996bd |
########################################
|
|
Chris PeBenito |
a996bd |
## <summary>
|
|
Chris PeBenito |
a996bd |
## Send a null signal to apache.
|
|
Chris PeBenito |
a996bd |
## </summary>
|
|
Chris PeBenito |
a996bd |
## <param name="domain">
|
|
Chris PeBenito |
885b83 |
## <summary>
|
|
Chris PeBenito |
799a0b |
## Domain allowed access.
|
|
Chris PeBenito |
885b83 |
## </summary>
|
|
Chris PeBenito |
a996bd |
## </param>
|
|
Chris PeBenito |
a996bd |
#
|
|
Chris PeBenito |
a996bd |
interface(`apache_signull',`
|
|
Chris PeBenito |
a996bd |
gen_require(`
|
|
Chris PeBenito |
a996bd |
type httpd_t;
|
|
Chris PeBenito |
a996bd |
')
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
a996bd |
allow $1 httpd_t:process signull;
|
|
Chris PeBenito |
a996bd |
')
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
a996bd |
########################################
|
|
Chris PeBenito |
a996bd |
## <summary>
|
|
Chris PeBenito |
799a0b |
## Send a SIGCHLD signal to apache.
|
|
Chris PeBenito |
799a0b |
## </summary>
|
|
Chris PeBenito |
799a0b |
## <param name="domain">
|
|
Chris PeBenito |
885b83 |
## <summary>
|
|
Chris PeBenito |
799a0b |
## Domain allowed access.
|
|
Chris PeBenito |
885b83 |
## </summary>
|
|
Chris PeBenito |
799a0b |
## </param>
|
|
Chris PeBenito |
799a0b |
#
|
|
Chris PeBenito |
799a0b |
interface(`apache_sigchld',`
|
|
Chris PeBenito |
799a0b |
gen_require(`
|
|
Chris PeBenito |
799a0b |
type httpd_t;
|
|
Chris PeBenito |
799a0b |
')
|
|
Chris PeBenito |
799a0b |
|
|
Chris PeBenito |
799a0b |
allow $1 httpd_t:process sigchld;
|
|
Chris PeBenito |
799a0b |
')
|
|
Chris PeBenito |
799a0b |
|
|
Chris PeBenito |
799a0b |
########################################
|
|
Chris PeBenito |
799a0b |
## <summary>
|
|
Chris PeBenito |
799a0b |
## Inherit and use file descriptors from Apache.
|
|
Chris PeBenito |
799a0b |
## </summary>
|
|
Chris PeBenito |
799a0b |
## <param name="domain">
|
|
Chris PeBenito |
885b83 |
## <summary>
|
|
Chris PeBenito |
799a0b |
## Domain allowed access.
|
|
Chris PeBenito |
885b83 |
## </summary>
|
|
Chris PeBenito |
799a0b |
## </param>
|
|
Chris PeBenito |
799a0b |
#
|
|
Chris PeBenito |
1c1ac6 |
interface(`apache_use_fds',`
|
|
Chris PeBenito |
799a0b |
gen_require(`
|
|
Chris PeBenito |
799a0b |
type httpd_t;
|
|
Chris PeBenito |
799a0b |
')
|
|
Chris PeBenito |
799a0b |
|
|
Chris PeBenito |
799a0b |
allow $1 httpd_t:fd use;
|
|
Chris PeBenito |
799a0b |
')
|
|
Chris PeBenito |
799a0b |
|
|
Chris PeBenito |
799a0b |
########################################
|
|
Chris PeBenito |
799a0b |
## <summary>
|
|
Chris PeBenito |
e749cd |
## Do not audit attempts to read and write Apache
|
|
Chris PeBenito |
e749cd |
## unix domain stream sockets.
|
|
Chris PeBenito |
e749cd |
## </summary>
|
|
Chris PeBenito |
e749cd |
## <param name="domain">
|
|
Chris PeBenito |
885b83 |
## <summary>
|
|
Chris PeBenito |
e749cd |
## Domain allowed access.
|
|
Chris PeBenito |
885b83 |
## </summary>
|
|
Chris PeBenito |
e749cd |
## </param>
|
|
Chris PeBenito |
e749cd |
#
|
|
Chris PeBenito |
1815ba |
interface(`apache_dontaudit_rw_stream_sockets',`
|
|
Chris PeBenito |
e749cd |
gen_require(`
|
|
Chris PeBenito |
e749cd |
type httpd_t;
|
|
Chris PeBenito |
e749cd |
')
|
|
Chris PeBenito |
e749cd |
|
|
Chris PeBenito |
e749cd |
dontaudit $1 httpd_t:unix_stream_socket { read write };
|
|
Chris PeBenito |
e749cd |
')
|
|
Chris PeBenito |
e749cd |
|
|
Chris PeBenito |
e749cd |
########################################
|
|
Chris PeBenito |
e749cd |
## <summary>
|
|
Chris PeBenito |
e749cd |
## Do not audit attempts to read and write Apache
|
|
Chris PeBenito |
e749cd |
## TCP sockets.
|
|
Chris PeBenito |
e749cd |
## </summary>
|
|
Chris PeBenito |
e749cd |
## <param name="domain">
|
|
Chris PeBenito |
885b83 |
## <summary>
|
|
Chris PeBenito |
e749cd |
## Domain allowed access.
|
|
Chris PeBenito |
885b83 |
## </summary>
|
|
Chris PeBenito |
e749cd |
## </param>
|
|
Chris PeBenito |
e749cd |
#
|
|
Chris PeBenito |
1815ba |
interface(`apache_dontaudit_rw_tcp_sockets',`
|
|
Chris PeBenito |
e749cd |
gen_require(`
|
|
Chris PeBenito |
e749cd |
type httpd_t;
|
|
Chris PeBenito |
e749cd |
')
|
|
Chris PeBenito |
e749cd |
|
|
Chris PeBenito |
e749cd |
dontaudit $1 httpd_t:tcp_socket { read write };
|
|
Chris PeBenito |
e749cd |
')
|
|
Chris PeBenito |
e749cd |
|
|
Chris PeBenito |
e749cd |
########################################
|
|
Chris PeBenito |
013d74 |
## <summary>
|
|
Chris PeBenito |
013d74 |
## Create, read, write, and delete all web content.
|
|
Chris PeBenito |
013d74 |
## </summary>
|
|
Chris PeBenito |
013d74 |
## <param name="domain">
|
|
Chris PeBenito |
013d74 |
## <summary>
|
|
Chris PeBenito |
013d74 |
## Domain allowed access.
|
|
Chris PeBenito |
013d74 |
## </summary>
|
|
Chris PeBenito |
013d74 |
## </param>
|
|
Chris PeBenito |
bbcd3c |
## <rolecap/>
|
|
Chris PeBenito |
013d74 |
#
|
|
Chris PeBenito |
013d74 |
interface(`apache_manage_all_content',`
|
|
Chris PeBenito |
013d74 |
gen_require(`
|
|
Chris PeBenito |
123a99 |
attribute httpdcontent, httpd_script_exec_type;
|
|
Chris PeBenito |
013d74 |
')
|
|
Chris PeBenito |
013d74 |
|
|
Chris PeBenito |
013d74 |
allow $1 httpdcontent:dir manage_dir_perms;
|
|
Chris PeBenito |
013d74 |
allow $1 httpdcontent:file manage_file_perms;
|
|
Chris PeBenito |
013d74 |
allow $1 httpdcontent:lnk_file create_lnk_perms;
|
|
Chris PeBenito |
123a99 |
|
|
Chris PeBenito |
123a99 |
allow $1 httpd_script_exec_type:dir manage_dir_perms;
|
|
Chris PeBenito |
123a99 |
allow $1 httpd_script_exec_type:file manage_file_perms;
|
|
Chris PeBenito |
123a99 |
allow $1 httpd_script_exec_type:lnk_file create_lnk_perms;
|
|
Chris PeBenito |
123a99 |
|
|
Chris PeBenito |
013d74 |
')
|
|
Chris PeBenito |
013d74 |
|
|
Chris PeBenito |
013d74 |
########################################
|
|
Chris PeBenito |
e749cd |
## <summary>
|
|
Chris PeBenito |
a996bd |
## Allow the specified domain to read
|
|
Chris PeBenito |
5bd9fd |
## and write Apache cache files.
|
|
Chris PeBenito |
5bd9fd |
## </summary>
|
|
Chris PeBenito |
5bd9fd |
## <param name="domain">
|
|
Chris PeBenito |
5bd9fd |
## <summary>
|
|
Chris PeBenito |
5bd9fd |
## Domain allowed access.
|
|
Chris PeBenito |
5bd9fd |
## </summary>
|
|
Chris PeBenito |
5bd9fd |
## </param>
|
|
Chris PeBenito |
5bd9fd |
#
|
|
Chris PeBenito |
5bd9fd |
interface(`apache_rw_cache_files',`
|
|
Chris PeBenito |
5bd9fd |
gen_require(`
|
|
Chris PeBenito |
5bd9fd |
type httpd_cache_t;
|
|
Chris PeBenito |
5bd9fd |
')
|
|
Chris PeBenito |
5bd9fd |
|
|
Chris PeBenito |
5bd9fd |
allow $1 httpd_cache_t:file rw_file_perms;
|
|
Chris PeBenito |
5bd9fd |
')
|
|
Chris PeBenito |
5bd9fd |
|
|
Chris PeBenito |
5bd9fd |
########################################
|
|
Chris PeBenito |
5bd9fd |
## <summary>
|
|
Chris PeBenito |
5bd9fd |
## Allow the specified domain to read
|
|
Chris PeBenito |
a996bd |
## apache configuration files.
|
|
Chris PeBenito |
a996bd |
## </summary>
|
|
Chris PeBenito |
a996bd |
## <param name="domain">
|
|
Chris PeBenito |
885b83 |
## <summary>
|
|
Chris PeBenito |
a996bd |
## Domain allowed access.
|
|
Chris PeBenito |
885b83 |
## </summary>
|
|
Chris PeBenito |
a996bd |
## </param>
|
|
Chris PeBenito |
bbcd3c |
## <rolecap/>
|
|
Chris PeBenito |
a996bd |
#
|
|
Chris PeBenito |
a996bd |
interface(`apache_read_config',`
|
|
Chris PeBenito |
a996bd |
gen_require(`
|
|
Chris PeBenito |
a996bd |
type httpd_config_t;
|
|
Chris PeBenito |
a996bd |
')
|
|
Chris PeBenito |
a996bd |
|
|
Chris PeBenito |
a996bd |
files_search_etc($1)
|
|
Chris PeBenito |
a996bd |
allow $1 httpd_config_t:dir r_dir_perms;
|
|
Chris PeBenito |
a996bd |
allow $1 httpd_config_t:file r_file_perms;
|
|
Chris PeBenito |
a996bd |
allow $1 httpd_config_t:lnk_file { getattr read };
|
|
Chris PeBenito |
a996bd |
')
|
|
Chris PeBenito |
6e99a6 |
|
|
Chris PeBenito |
6e99a6 |
########################################
|
|
Chris PeBenito |
6e99a6 |
## <summary>
|
|
Chris PeBenito |
123a99 |
## Allow the specified domain to manage
|
|
Chris PeBenito |
123a99 |
## apache configuration files.
|
|
Chris PeBenito |
123a99 |
## </summary>
|
|
Chris PeBenito |
123a99 |
## <param name="domain">
|
|
Chris PeBenito |
123a99 |
## <summary>
|
|
Chris PeBenito |
123a99 |
## Domain allowed access.
|
|
Chris PeBenito |
123a99 |
## </summary>
|
|
Chris PeBenito |
123a99 |
## </param>
|
|
Chris PeBenito |
123a99 |
#
|
|
Chris PeBenito |
123a99 |
interface(`apache_manage_config',`
|
|
Chris PeBenito |
123a99 |
gen_require(`
|
|
Chris PeBenito |
123a99 |
type httpd_config_t;
|
|
Chris PeBenito |
123a99 |
')
|
|
Chris PeBenito |
123a99 |
|
|
Chris PeBenito |
123a99 |
files_search_etc($1)
|
|
Chris PeBenito |
123a99 |
allow $1 httpd_config_t:dir manage_dir_perms;
|
|
Chris PeBenito |
123a99 |
allow $1 httpd_config_t:file manage_file_perms;
|
|
Chris PeBenito |
123a99 |
allow $1 httpd_config_t:lnk_file { getattr read };
|
|
Chris PeBenito |
123a99 |
')
|
|
Chris PeBenito |
123a99 |
|
|
Chris PeBenito |
123a99 |
########################################
|
|
Chris PeBenito |
123a99 |
## <summary>
|
|
Chris PeBenito |
c2b18f |
## Execute the Apache helper program with
|
|
Chris PeBenito |
c2b18f |
## a domain transition.
|
|
Chris PeBenito |
6e99a6 |
## </summary>
|
|
Chris PeBenito |
6e99a6 |
## <param name="domain">
|
|
Chris PeBenito |
885b83 |
## <summary>
|
|
Chris PeBenito |
6e99a6 |
## Domain allowed access.
|
|
Chris PeBenito |
885b83 |
## </summary>
|
|
Chris PeBenito |
6e99a6 |
## </param>
|
|
Chris PeBenito |
6e99a6 |
#
|
|
Chris PeBenito |
c2b18f |
interface(`apache_domtrans_helper',`
|
|
Chris PeBenito |
6e99a6 |
gen_require(`
|
|
Chris PeBenito |
c2b18f |
type httpd_helper_t, httpd_helper_exec_t;
|
|
Chris PeBenito |
6e99a6 |
')
|
|
Chris PeBenito |
6e99a6 |
|
|
Chris PeBenito |
c2b18f |
corecmd_search_sbin($1)
|
|
Chris PeBenito |
c2b18f |
domain_auto_trans($1,httpd_helper_exec_t,httpd_helper_t)
|
|
Chris PeBenito |
c2b18f |
|
|
Chris PeBenito |
c2b18f |
allow $1 httpd_helper_t:fd use;
|
|
Chris PeBenito |
c2b18f |
allow httpd_helper_t $1:fd use;
|
|
Chris PeBenito |
c2b18f |
allow httpd_helper_t $1:fifo_file rw_file_perms;
|
|
Chris PeBenito |
c2b18f |
allow httpd_helper_t $1:process sigchld;
|
|
Chris PeBenito |
c2b18f |
')
|
|
Chris PeBenito |
c2b18f |
|
|
Chris PeBenito |
c2b18f |
########################################
|
|
Chris PeBenito |
c2b18f |
## <summary>
|
|
Chris PeBenito |
c2b18f |
## Execute the Apache helper program with
|
|
Chris PeBenito |
c2b18f |
## a domain transition, and allow the
|
|
Chris PeBenito |
c2b18f |
## specified role the dmidecode domain.
|
|
Chris PeBenito |
c2b18f |
## </summary>
|
|
Chris PeBenito |
c2b18f |
## <param name="domain">
|
|
Chris PeBenito |
885b83 |
## <summary>
|
|
Chris PeBenito |
c2b18f |
## Domain allowed access.
|
|
Chris PeBenito |
885b83 |
## </summary>
|
|
Chris PeBenito |
c2b18f |
## </param>
|
|
Chris PeBenito |
c2b18f |
## <param name="role">
|
|
Chris PeBenito |
885b83 |
## <summary>
|
|
Chris PeBenito |
c2b18f |
## The role to be allowed the dmidecode domain.
|
|
Chris PeBenito |
885b83 |
## </summary>
|
|
Chris PeBenito |
c2b18f |
## </param>
|
|
Chris PeBenito |
c2b18f |
## <param name="terminal">
|
|
Chris PeBenito |
885b83 |
## <summary>
|
|
Chris PeBenito |
c2b18f |
## The type of the terminal allow the dmidecode domain to use.
|
|
Chris PeBenito |
885b83 |
## </summary>
|
|
Chris PeBenito |
c2b18f |
## </param>
|
|
Chris PeBenito |
bbcd3c |
## <rolecap/>
|
|
Chris PeBenito |
c2b18f |
#
|
|
Chris PeBenito |
c2b18f |
interface(`apache_run_helper',`
|
|
Chris PeBenito |
c2b18f |
gen_require(`
|
|
Chris PeBenito |
c2b18f |
type httpd_helper_t;
|
|
Chris PeBenito |
c2b18f |
')
|
|
Chris PeBenito |
c2b18f |
|
|
Chris PeBenito |
c2b18f |
apache_domtrans_helper($1)
|
|
Chris PeBenito |
c2b18f |
role $2 types httpd_helper_t;
|
|
Chris PeBenito |
c2b18f |
allow httpd_helper_t $3:chr_file rw_term_perms;
|
|
Chris PeBenito |
6e99a6 |
')
|
|
Chris PeBenito |
799a0b |
|
|
Chris PeBenito |
799a0b |
########################################
|
|
Chris PeBenito |
799a0b |
## <summary>
|
|
Chris PeBenito |
be4690 |
## Allow the specified domain to read
|
|
Chris PeBenito |
be4690 |
## apache log files.
|
|
Chris PeBenito |
be4690 |
## </summary>
|
|
Chris PeBenito |
be4690 |
## <param name="domain">
|
|
Chris PeBenito |
885b83 |
## <summary>
|
|
Chris PeBenito |
be4690 |
## Domain allowed access.
|
|
Chris PeBenito |
885b83 |
## </summary>
|
|
Chris PeBenito |
be4690 |
## </param>
|
|
Chris PeBenito |
bbcd3c |
## <rolecap/>
|
|
Chris PeBenito |
be4690 |
#
|
|
Chris PeBenito |
be4690 |
interface(`apache_read_log',`
|
|
Chris PeBenito |
be4690 |
gen_require(`
|
|
Chris PeBenito |
be4690 |
type httpd_log_t;
|
|
Chris PeBenito |
be4690 |
')
|
|
Chris PeBenito |
be4690 |
|
|
Chris PeBenito |
f1e604 |
logging_search_logs($1)
|
|
Chris PeBenito |
be4690 |
allow $1 httpd_log_t:dir r_dir_perms;
|
|
Chris PeBenito |
be4690 |
allow $1 httpd_log_t:file r_file_perms;
|
|
Chris PeBenito |
be4690 |
allow $1 httpd_log_t:lnk_file { getattr read };
|
|
Chris PeBenito |
be4690 |
')
|
|
Chris PeBenito |
be4690 |
|
|
Chris PeBenito |
be4690 |
########################################
|
|
Chris PeBenito |
be4690 |
## <summary>
|
|
Chris PeBenito |
f1e604 |
## Allow the specified domain to append
|
|
Chris PeBenito |
f1e604 |
## to apache log files.
|
|
Chris PeBenito |
f1e604 |
## </summary>
|
|
Chris PeBenito |
f1e604 |
## <param name="domain">
|
|
Chris PeBenito |
f1e604 |
## <summary>
|
|
Chris PeBenito |
f1e604 |
## Domain allowed access.
|
|
Chris PeBenito |
f1e604 |
## </summary>
|
|
Chris PeBenito |
f1e604 |
## </param>
|
|
Chris PeBenito |
f1e604 |
#
|
|
Chris PeBenito |
f1e604 |
interface(`apache_append_log',`
|
|
Chris PeBenito |
f1e604 |
gen_require(`
|
|
Chris PeBenito |
f1e604 |
type httpd_log_t;
|
|
Chris PeBenito |
f1e604 |
')
|
|
Chris PeBenito |
f1e604 |
|
|
Chris PeBenito |
f1e604 |
logging_search_logs($1)
|
|
Chris PeBenito |
f1e604 |
allow $1 httpd_log_t:dir r_dir_perms;
|
|
Chris PeBenito |
f1e604 |
allow $1 httpd_log_t:file append;
|
|
Chris PeBenito |
f1e604 |
')
|
|
Chris PeBenito |
f1e604 |
|
|
Chris PeBenito |
f1e604 |
########################################
|
|
Chris PeBenito |
f1e604 |
## <summary>
|
|
Chris PeBenito |
799a0b |
## Do not audit attempts to append to the
|
|
Chris PeBenito |
799a0b |
## Apache logs.
|
|
Chris PeBenito |
799a0b |
## </summary>
|
|
Chris PeBenito |
799a0b |
## <param name="domain">
|
|
Chris PeBenito |
885b83 |
## <summary>
|
|
Chris PeBenito |
799a0b |
## Domain to not audit.
|
|
Chris PeBenito |
885b83 |
## </summary>
|
|
Chris PeBenito |
799a0b |
## </param>
|
|
Chris PeBenito |
799a0b |
#
|
|
Chris PeBenito |
799a0b |
interface(`apache_dontaudit_append_log',`
|
|
Chris PeBenito |
799a0b |
gen_require(`
|
|
Chris PeBenito |
799a0b |
type httpd_log_t;
|
|
Chris PeBenito |
799a0b |
')
|
|
Chris PeBenito |
799a0b |
|
|
Chris PeBenito |
e749cd |
dontaudit $1 httpd_log_t:file { getattr append };
|
|
Chris PeBenito |
799a0b |
')
|
|
Chris PeBenito |
c2b18f |
|
|
Chris PeBenito |
c2b18f |
########################################
|
|
Chris PeBenito |
c2b18f |
## <summary>
|
|
Chris PeBenito |
123a99 |
## Allow the specified domain to manage
|
|
Chris PeBenito |
123a99 |
## to apache log files.
|
|
Chris PeBenito |
123a99 |
## </summary>
|
|
Chris PeBenito |
123a99 |
## <param name="domain">
|
|
Chris PeBenito |
123a99 |
## <summary>
|
|
Chris PeBenito |
123a99 |
## Domain allowed access.
|
|
Chris PeBenito |
123a99 |
## </summary>
|
|
Chris PeBenito |
123a99 |
## </param>
|
|
Chris PeBenito |
123a99 |
#
|
|
Chris PeBenito |
123a99 |
interface(`apache_manage_log',`
|
|
Chris PeBenito |
123a99 |
gen_require(`
|
|
Chris PeBenito |
123a99 |
type httpd_log_t;
|
|
Chris PeBenito |
123a99 |
')
|
|
Chris PeBenito |
123a99 |
|
|
Chris PeBenito |
123a99 |
logging_search_logs($1)
|
|
Chris PeBenito |
123a99 |
allow $1 httpd_log_t:dir manage_dir_perms;
|
|
Chris PeBenito |
123a99 |
allow $1 httpd_log_t:file manage_file_perms;
|
|
Chris PeBenito |
123a99 |
allow $1 httpd_log_t:lnk_file { getattr read };
|
|
Chris PeBenito |
123a99 |
')
|
|
Chris PeBenito |
123a99 |
|
|
Chris PeBenito |
123a99 |
########################################
|
|
Chris PeBenito |
123a99 |
## <summary>
|
|
Chris PeBenito |
c6d4c8 |
## Do not audit attempts to search Apache
|
|
Chris PeBenito |
c6d4c8 |
## module directories.
|
|
Chris PeBenito |
c6d4c8 |
## </summary>
|
|
Chris PeBenito |
c6d4c8 |
## <param name="domain">
|
|
Chris PeBenito |
885b83 |
## <summary>
|
|
Chris PeBenito |
c6d4c8 |
## Domain to not audit.
|
|
Chris PeBenito |
885b83 |
## </summary>
|
|
Chris PeBenito |
c6d4c8 |
## </param>
|
|
Chris PeBenito |
c6d4c8 |
#
|
|
Chris PeBenito |
c6d4c8 |
interface(`apache_dontaudit_search_modules',`
|
|
Chris PeBenito |
c6d4c8 |
gen_require(`
|
|
Chris PeBenito |
c6d4c8 |
type httpd_modules_t;
|
|
Chris PeBenito |
c6d4c8 |
')
|
|
Chris PeBenito |
c6d4c8 |
|
|
Chris PeBenito |
c6d4c8 |
allow $1 httpd_modules_t:dir r_dir_perms;
|
|
Chris PeBenito |
c6d4c8 |
')
|
|
Chris PeBenito |
c6d4c8 |
|
|
Chris PeBenito |
c6d4c8 |
########################################
|
|
Chris PeBenito |
c6d4c8 |
## <summary>
|
|
Chris PeBenito |
c2b18f |
## Allow the specified domain to list
|
|
Chris PeBenito |
c2b18f |
## the contents of the apache modules
|
|
Chris PeBenito |
c2b18f |
## directory.
|
|
Chris PeBenito |
c2b18f |
## </summary>
|
|
Chris PeBenito |
c2b18f |
## <param name="domain">
|
|
Chris PeBenito |
885b83 |
## <summary>
|
|
Chris PeBenito |
c2b18f |
## Domain allowed access.
|
|
Chris PeBenito |
885b83 |
## </summary>
|
|
Chris PeBenito |
c2b18f |
## </param>
|
|
Chris PeBenito |
c2b18f |
#
|
|
Chris PeBenito |
c2b18f |
interface(`apache_list_modules',`
|
|
Chris PeBenito |
c2b18f |
gen_require(`
|
|
Chris PeBenito |
c2b18f |
type httpd_modules_t;
|
|
Chris PeBenito |
c2b18f |
')
|
|
Chris PeBenito |
c2b18f |
|
|
Chris PeBenito |
c2b18f |
allow $1 httpd_modules_t:dir r_dir_perms;
|
|
Chris PeBenito |
c2b18f |
')
|
|
Chris PeBenito |
c2b18f |
|
|
Chris PeBenito |
c2b18f |
########################################
|
|
Chris PeBenito |
c2b18f |
## <summary>
|
|
Chris PeBenito |
2bcdbd |
## Allow the specified domain to execute
|
|
Chris PeBenito |
2bcdbd |
## apache modules.
|
|
Chris PeBenito |
2bcdbd |
## </summary>
|
|
Chris PeBenito |
2bcdbd |
## <param name="domain">
|
|
Chris PeBenito |
885b83 |
## <summary>
|
|
Chris PeBenito |
2bcdbd |
## Domain allowed access.
|
|
Chris PeBenito |
885b83 |
## </summary>
|
|
Chris PeBenito |
2bcdbd |
## </param>
|
|
Chris PeBenito |
2bcdbd |
#
|
|
Chris PeBenito |
2bcdbd |
interface(`apache_exec_modules',`
|
|
Chris PeBenito |
2bcdbd |
gen_require(`
|
|
Chris PeBenito |
2bcdbd |
type httpd_modules_t;
|
|
Chris PeBenito |
2bcdbd |
')
|
|
Chris PeBenito |
2bcdbd |
|
|
Chris PeBenito |
2bcdbd |
allow $1 httpd_modules_t:dir r_dir_perms;
|
|
Chris PeBenito |
2bcdbd |
allow $1 httpd_modules_t:lnk_file r_file_perms;
|
|
Chris PeBenito |
2bcdbd |
can_exec($1,httpd_modules_t)
|
|
Chris PeBenito |
2bcdbd |
')
|
|
Chris PeBenito |
2bcdbd |
|
|
Chris PeBenito |
2bcdbd |
########################################
|
|
Chris PeBenito |
2bcdbd |
## <summary>
|
|
Chris PeBenito |
123a99 |
## Execute a domain transition to run httpd_rotatelogs.
|
|
Chris PeBenito |
123a99 |
## </summary>
|
|
Chris PeBenito |
123a99 |
## <param name="domain">
|
|
Chris PeBenito |
123a99 |
## <summary>
|
|
Chris PeBenito |
123a99 |
## Domain allowed access.
|
|
Chris PeBenito |
123a99 |
## </summary>
|
|
Chris PeBenito |
123a99 |
## </param>
|
|
Chris PeBenito |
123a99 |
#
|
|
Chris PeBenito |
123a99 |
interface(`apache_domtrans_rotatelogs',`
|
|
Chris PeBenito |
123a99 |
gen_require(`
|
|
Chris PeBenito |
123a99 |
type httpd_rotatelogs_t, httpd_rotatelogs_exec_t;
|
|
Chris PeBenito |
123a99 |
')
|
|
Chris PeBenito |
123a99 |
|
|
Chris PeBenito |
123a99 |
domain_auto_trans($1,httpd_rotatelogs_exec_t,httpd_rotatelogs_t)
|
|
Chris PeBenito |
123a99 |
|
|
Chris PeBenito |
123a99 |
allow httpd_rotatelogs_t $1:fd use;
|
|
Chris PeBenito |
123a99 |
allow httpd_rotatelogs_t $1:fifo_file rw_file_perms;
|
|
Chris PeBenito |
123a99 |
allow httpd_rotatelogs_t $1:process sigchld;
|
|
Chris PeBenito |
123a99 |
')
|
|
Chris PeBenito |
123a99 |
|
|
Chris PeBenito |
123a99 |
########################################
|
|
Chris PeBenito |
123a99 |
## <summary>
|
|
Chris PeBenito |
be4690 |
## Allow the specified domain to manage
|
|
Chris PeBenito |
be4690 |
## apache system content files.
|
|
Chris PeBenito |
be4690 |
## </summary>
|
|
Chris PeBenito |
be4690 |
## <param name="domain">
|
|
Chris PeBenito |
885b83 |
## <summary>
|
|
Chris PeBenito |
be4690 |
## Domain allowed access.
|
|
Chris PeBenito |
885b83 |
## </summary>
|
|
Chris PeBenito |
be4690 |
## </param>
|
|
Chris PeBenito |
bbcd3c |
## <rolecap/>
|
|
Chris PeBenito |
be4690 |
#
|
|
Chris PeBenito |
be4690 |
# Note that httpd_sys_content_t is found in /var, /etc, /srv and /usr
|
|
Chris PeBenito |
be4690 |
interface(`apache_manage_sys_content',`
|
|
Chris PeBenito |
be4690 |
gen_require(`
|
|
Chris PeBenito |
77f6e2 |
type httpd_sys_content_t;
|
|
Chris PeBenito |
be4690 |
')
|
|
Chris PeBenito |
be4690 |
|
|
Chris PeBenito |
be4690 |
files_search_var($1)
|
|
Chris PeBenito |
be4690 |
allow $1 httpd_sys_content_t:dir create_dir_perms;
|
|
Chris PeBenito |
be4690 |
allow $1 httpd_sys_content_t:file create_file_perms;
|
|
Chris PeBenito |
be4690 |
allow $1 httpd_sys_content_t:lnk_file create_lnk_perms;
|
|
Chris PeBenito |
be4690 |
')
|
|
Chris PeBenito |
be4690 |
|
|
Chris PeBenito |
be4690 |
########################################
|
|
Chris PeBenito |
be4690 |
## <summary>
|
|
Chris PeBenito |
c2b18f |
## Execute all web scripts in the system
|
|
Chris PeBenito |
c2b18f |
## script domain.
|
|
Chris PeBenito |
c2b18f |
## </summary>
|
|
Chris PeBenito |
c2b18f |
## <param name="domain">
|
|
Chris PeBenito |
885b83 |
## <summary>
|
|
Chris PeBenito |
c2b18f |
## Domain allowed access.
|
|
Chris PeBenito |
885b83 |
## </summary>
|
|
Chris PeBenito |
c2b18f |
## </param>
|
|
Chris PeBenito |
c2b18f |
#
|
|
Chris PeBenito |
c2b18f |
# cjp: this interface specifically added to allow
|
|
Chris PeBenito |
c2b18f |
# sysadm_t to run scripts
|
|
Chris PeBenito |
c2b18f |
interface(`apache_domtrans_sys_script',`
|
|
Chris PeBenito |
c2b18f |
gen_require(`
|
|
Chris PeBenito |
c2b18f |
attribute httpdcontent;
|
|
Chris PeBenito |
c2b18f |
type httpd_sys_script_t;
|
|
Chris PeBenito |
c2b18f |
')
|
|
Chris PeBenito |
c2b18f |
|
|
Chris PeBenito |
c2b18f |
tunable_policy(`httpd_enable_cgi && httpd_unified',`
|
|
Chris PeBenito |
c2b18f |
domain_auto_trans($1, httpdcontent, httpd_sys_script_t)
|
|
Chris PeBenito |
c2b18f |
|
|
Chris PeBenito |
c2b18f |
allow $1 httpd_sys_script_t:fd use;
|
|
Chris PeBenito |
c2b18f |
allow httpd_sys_script_t $1:fd use;
|
|
Chris PeBenito |
c2b18f |
allow httpd_sys_script_t $1:fifo_file rw_file_perms;
|
|
Chris PeBenito |
c2b18f |
allow httpd_sys_script_t $1:process sigchld;
|
|
Chris PeBenito |
c2b18f |
')
|
|
Chris PeBenito |
c2b18f |
')
|
|
Chris PeBenito |
e749cd |
|
|
Chris PeBenito |
e749cd |
########################################
|
|
Chris PeBenito |
e749cd |
## <summary>
|
|
Chris PeBenito |
e749cd |
## Do not audit attempts to read and write Apache
|
|
Chris PeBenito |
e749cd |
## system script unix domain stream sockets.
|
|
Chris PeBenito |
e749cd |
## </summary>
|
|
Chris PeBenito |
e749cd |
## <param name="domain">
|
|
Chris PeBenito |
885b83 |
## <summary>
|
|
Chris PeBenito |
e749cd |
## Domain allowed access.
|
|
Chris PeBenito |
885b83 |
## </summary>
|
|
Chris PeBenito |
e749cd |
## </param>
|
|
Chris PeBenito |
e749cd |
#
|
|
Chris PeBenito |
1815ba |
interface(`apache_dontaudit_rw_sys_script_stream_sockets',`
|
|
Chris PeBenito |
e749cd |
gen_require(`
|
|
Chris PeBenito |
e749cd |
type httpd_sys_script_t;
|
|
Chris PeBenito |
e749cd |
')
|
|
Chris PeBenito |
e749cd |
|
|
Chris PeBenito |
e749cd |
dontaudit $1 httpd_sys_script_t:unix_stream_socket { read write };
|
|
Chris PeBenito |
e749cd |
')
|
|
Chris PeBenito |
e749cd |
|
|
Chris PeBenito |
e749cd |
########################################
|
|
Chris PeBenito |
e749cd |
## <summary>
|
|
Chris PeBenito |
e749cd |
## Execute all user scripts in the user
|
|
Chris PeBenito |
e749cd |
## script domain.
|
|
Chris PeBenito |
e749cd |
## </summary>
|
|
Chris PeBenito |
e749cd |
## <param name="domain">
|
|
Chris PeBenito |
885b83 |
## <summary>
|
|
Chris PeBenito |
e749cd |
## Domain allowed access.
|
|
Chris PeBenito |
885b83 |
## </summary>
|
|
Chris PeBenito |
e749cd |
## </param>
|
|
Chris PeBenito |
e749cd |
#
|
|
Chris PeBenito |
e749cd |
interface(`apache_domtrans_all_scripts',`
|
|
Chris PeBenito |
e749cd |
gen_require(`
|
|
Chris PeBenito |
e749cd |
attribute httpd_exec_scripts;
|
|
Chris PeBenito |
e749cd |
')
|
|
Chris PeBenito |
e749cd |
|
|
Chris PeBenito |
e749cd |
typeattribute $1 httpd_exec_scripts;
|
|
Chris PeBenito |
e749cd |
')
|
|
Chris PeBenito |
e749cd |
|
|
Chris PeBenito |
e749cd |
########################################
|
|
Chris PeBenito |
e749cd |
## <summary>
|
|
Chris PeBenito |
e749cd |
## Execute all user scripts in the user
|
|
Chris PeBenito |
e749cd |
## script domain. Add user script domains
|
|
Chris PeBenito |
e749cd |
## to the specified role.
|
|
Chris PeBenito |
e749cd |
## </summary>
|
|
Chris PeBenito |
e749cd |
## <param name="domain">
|
|
Chris PeBenito |
885b83 |
## <summary>
|
|
Chris PeBenito |
e749cd |
## Domain allowed access.
|
|
Chris PeBenito |
885b83 |
## </summary>
|
|
Chris PeBenito |
e749cd |
## </param>
|
|
Chris PeBenito |
e749cd |
## <param name="role">
|
|
Chris PeBenito |
885b83 |
## <summary>
|
|
Chris PeBenito |
e749cd |
## The role to be allowed the script domains.
|
|
Chris PeBenito |
885b83 |
## </summary>
|
|
Chris PeBenito |
e749cd |
## </param>
|
|
Chris PeBenito |
e749cd |
#
|
|
Chris PeBenito |
e749cd |
# cjp: this is missing the terminal since scripts
|
|
Chris PeBenito |
e749cd |
# do not output to the terminal
|
|
Chris PeBenito |
e749cd |
interface(`apache_run_all_scripts',`
|
|
Chris PeBenito |
e749cd |
gen_require(`
|
|
Chris PeBenito |
e749cd |
attribute httpd_exec_scripts, httpd_script_domains;
|
|
Chris PeBenito |
e749cd |
')
|
|
Chris PeBenito |
e749cd |
|
|
Chris PeBenito |
e749cd |
role $2 types httpd_script_domains;
|
|
Chris PeBenito |
e749cd |
apache_domtrans_all_scripts($1)
|
|
Chris PeBenito |
e749cd |
')
|
|
Chris PeBenito |
e749cd |
|
|
Chris PeBenito |
e749cd |
########################################
|
|
Chris PeBenito |
e749cd |
## <summary>
|
|
Chris PeBenito |
e749cd |
## Allow the specified domain to read
|
|
Chris PeBenito |
e749cd |
## apache squirrelmail data.
|
|
Chris PeBenito |
e749cd |
## </summary>
|
|
Chris PeBenito |
e749cd |
## <param name="domain">
|
|
Chris PeBenito |
885b83 |
## <summary>
|
|
Chris PeBenito |
e749cd |
## Domain allowed access.
|
|
Chris PeBenito |
885b83 |
## </summary>
|
|
Chris PeBenito |
e749cd |
## </param>
|
|
Chris PeBenito |
e749cd |
#
|
|
Chris PeBenito |
e749cd |
interface(`apache_read_squirrelmail_data',`
|
|
Chris PeBenito |
e749cd |
gen_require(`
|
|
Chris PeBenito |
e749cd |
type httpd_squirrelmail_t;
|
|
Chris PeBenito |
e749cd |
')
|
|
Chris PeBenito |
e749cd |
|
|
Chris PeBenito |
e749cd |
allow $1 httpd_squirrelmail_t:file { getattr read };
|
|
Chris PeBenito |
e749cd |
')
|
|
Chris PeBenito |
e749cd |
|
|
Chris PeBenito |
e749cd |
########################################
|
|
Chris PeBenito |
e749cd |
## <summary>
|
|
Chris PeBenito |
e749cd |
## Allow the specified domain to append
|
|
Chris PeBenito |
e749cd |
## apache squirrelmail data.
|
|
Chris PeBenito |
e749cd |
## </summary>
|
|
Chris PeBenito |
e749cd |
## <param name="domain">
|
|
Chris PeBenito |
885b83 |
## <summary>
|
|
Chris PeBenito |
e749cd |
## Domain allowed access.
|
|
Chris PeBenito |
885b83 |
## </summary>
|
|
Chris PeBenito |
e749cd |
## </param>
|
|
Chris PeBenito |
e749cd |
#
|
|
Chris PeBenito |
e749cd |
interface(`apache_append_squirrelmail_data',`
|
|
Chris PeBenito |
e749cd |
gen_require(`
|
|
Chris PeBenito |
e749cd |
type httpd_squirrelmail_t;
|
|
Chris PeBenito |
e749cd |
')
|
|
Chris PeBenito |
e749cd |
|
|
Chris PeBenito |
e749cd |
allow $1 httpd_squirrelmail_t:file { getattr append };
|
|
Chris PeBenito |
e749cd |
')
|
|
Chris PeBenito |
9fd4b8 |
|
|
Chris PeBenito |
9fd4b8 |
########################################
|
|
Chris PeBenito |
9fd4b8 |
## <summary>
|
|
Chris PeBenito |
99c902 |
## Search apache system content.
|
|
Chris PeBenito |
99c902 |
## </summary>
|
|
Chris PeBenito |
99c902 |
## <param name="domain">
|
|
Chris PeBenito |
99c902 |
## <summary>
|
|
Chris PeBenito |
99c902 |
## Domain allowed access.
|
|
Chris PeBenito |
99c902 |
## </summary>
|
|
Chris PeBenito |
99c902 |
## </param>
|
|
Chris PeBenito |
99c902 |
#
|
|
Chris PeBenito |
99c902 |
interface(`apache_search_sys_content',`
|
|
Chris PeBenito |
99c902 |
gen_require(`
|
|
Chris PeBenito |
99c902 |
type httpd_sys_content_t;
|
|
Chris PeBenito |
99c902 |
')
|
|
Chris PeBenito |
99c902 |
|
|
Chris PeBenito |
99c902 |
allow $1 httpd_sys_content_t:dir search_dir_perms;
|
|
Chris PeBenito |
99c902 |
')
|
|
Chris PeBenito |
99c902 |
|
|
Chris PeBenito |
99c902 |
########################################
|
|
Chris PeBenito |
99c902 |
## <summary>
|
|
Chris PeBenito |
99c902 |
## Read apache system content.
|
|
Chris PeBenito |
0f27d9 |
## </summary>
|
|
Chris PeBenito |
0f27d9 |
## <param name="domain">
|
|
Chris PeBenito |
0f27d9 |
## <summary>
|
|
Chris PeBenito |
0f27d9 |
## Domain to not audit.
|
|
Chris PeBenito |
0f27d9 |
## </summary>
|
|
Chris PeBenito |
0f27d9 |
## </param>
|
|
Chris PeBenito |
0f27d9 |
#
|
|
Chris PeBenito |
0f27d9 |
interface(`apache_read_sys_content',`
|
|
Chris PeBenito |
0f27d9 |
gen_require(`
|
|
Chris PeBenito |
0f27d9 |
type httpd_sys_content_t;
|
|
Chris PeBenito |
0f27d9 |
')
|
|
Chris PeBenito |
0f27d9 |
|
|
Chris PeBenito |
0f27d9 |
allow $1 httpd_sys_content_t:dir r_dir_perms;
|
|
Chris PeBenito |
0f27d9 |
allow $1 httpd_sys_content_t:file { getattr read };
|
|
Chris PeBenito |
0c54fc |
allow $1 httpd_sys_content_t:lnk_file { getattr read };
|
|
Chris PeBenito |
0f27d9 |
')
|
|
Chris PeBenito |
0f27d9 |
|
|
Chris PeBenito |
0f27d9 |
########################################
|
|
Chris PeBenito |
0f27d9 |
## <summary>
|
|
Chris PeBenito |
9fd4b8 |
## Search system script state directory.
|
|
Chris PeBenito |
9fd4b8 |
## </summary>
|
|
Chris PeBenito |
9fd4b8 |
## <param name="domain">
|
|
Chris PeBenito |
885b83 |
## <summary>
|
|
Chris PeBenito |
9fd4b8 |
## Domain to not audit.
|
|
Chris PeBenito |
885b83 |
## </summary>
|
|
Chris PeBenito |
9fd4b8 |
## </param>
|
|
Chris PeBenito |
9fd4b8 |
#
|
|
Chris PeBenito |
9fd4b8 |
interface(`apache_search_sys_script_state',`
|
|
Chris PeBenito |
9fd4b8 |
gen_require(`
|
|
Chris PeBenito |
9fd4b8 |
type httpd_sys_script_t;
|
|
Chris PeBenito |
9fd4b8 |
')
|
|
Chris PeBenito |
9fd4b8 |
|
|
Chris PeBenito |
9fd4b8 |
allow $1 httpd_sys_script_t:dir search;
|
|
Chris PeBenito |
9fd4b8 |
')
|