Chris PeBenito a996bd
Chris PeBenito 60def6
policy_module(apache, 2.1.2)
Chris PeBenito a996bd
Chris PeBenito a996bd
#
Chris PeBenito a996bd
# NOTES: 
Chris PeBenito a996bd
#  This policy will work with SUEXEC enabled as part of the Apache
Chris PeBenito a996bd
#  configuration. However, the user CGI scripts will run under the
Chris PeBenito 296273
#  system_u:system_r:httpd_user_script_t.
Chris PeBenito a996bd
#
Chris PeBenito 296273
#  The user CGI scripts must be labeled with the httpd_user_script_exec_t
Chris PeBenito a996bd
#  type, and the directory containing the scripts should also be labeled
Chris PeBenito 296273
#  with these types. This policy allows the user role to perform that 
Chris PeBenito 296273
#  relabeling. If it is desired that only admin role should be able to relabel
Chris PeBenito 296273
#  the user CGI scripts, then relabel rule for user roles should be removed.
Chris PeBenito a996bd
#
Chris PeBenito a996bd
Chris PeBenito a996bd
########################################
Chris PeBenito a996bd
#
Chris PeBenito a996bd
# Declarations
Chris PeBenito a996bd
#
Chris PeBenito a996bd
Chris PeBenito 56e1b3
## <desc>
Chris PeBenito 56e1b3
## 

Chris PeBenito 56e1b3
## Allow Apache to modify public files
Chris PeBenito dd9e1d
## used for public file transfer services. Directories/Files must
Chris PeBenito dd9e1d
## be labeled public_content_rw_t.
Chris PeBenito 56e1b3
## 

Chris PeBenito 56e1b3
## </desc>
Chris PeBenito 0bfccd
gen_tunable(allow_httpd_anon_write, false)
Chris PeBenito 56e1b3
Chris PeBenito 56e1b3
## <desc>
Chris PeBenito 56e1b3
## 

Chris PeBenito 56e1b3
## Allow Apache to use mod_auth_pam
Chris PeBenito 56e1b3
## 

Chris PeBenito 56e1b3
## </desc>
Chris PeBenito 0bfccd
gen_tunable(allow_httpd_mod_auth_pam, false)
Chris PeBenito 56e1b3
Chris PeBenito 56e1b3
## <desc>
Chris PeBenito 56e1b3
## 

Chris PeBenito 56e1b3
## Allow httpd to use built in scripting (usually php)
Chris PeBenito 56e1b3
## 

Chris PeBenito 56e1b3
## </desc>
Chris PeBenito 0bfccd
gen_tunable(httpd_builtin_scripting, false)
Chris PeBenito 56e1b3
Chris PeBenito 56e1b3
## <desc>
Chris PeBenito 56e1b3
## 

Chris PeBenito dd9e1d
## Allow HTTPD scripts and modules to connect to the network using TCP.
Chris PeBenito 56e1b3
## 

Chris PeBenito 56e1b3
## </desc>
Chris PeBenito 0bfccd
gen_tunable(httpd_can_network_connect, false)
Chris PeBenito 56e1b3
Chris PeBenito 56e1b3
## <desc>
Chris PeBenito 56e1b3
## 

Chris PeBenito dd9e1d
## Allow HTTPD scripts and modules to connect to databases over the network.
Chris PeBenito 56e1b3
## 

Chris PeBenito 56e1b3
## </desc>
Chris PeBenito 56e1b3
gen_tunable(httpd_can_network_connect_db, false)
Chris PeBenito 56e1b3
Chris PeBenito 56e1b3
## <desc>
Chris PeBenito 56e1b3
## 

Chris PeBenito 56e1b3
## Allow httpd to act as a relay
Chris PeBenito 56e1b3
## 

Chris PeBenito 56e1b3
## </desc>
Chris PeBenito 56e1b3
gen_tunable(httpd_can_network_relay, false)
Chris PeBenito 56e1b3
Chris PeBenito 56e1b3
## <desc>
Chris PeBenito 56e1b3
## 

Chris PeBenito 60def6
## Allow http daemon to send mail
Chris PeBenito 60def6
## 

Chris PeBenito 60def6
## </desc>
Chris PeBenito 60def6
gen_tunable(httpd_can_sendmail, false)
Chris PeBenito 60def6
Chris PeBenito 60def6
## <desc>
Chris PeBenito 60def6
## 

Chris PeBenito 60def6
## Allow Apache to communicate with avahi service via dbus
Chris PeBenito 60def6
## 

Chris PeBenito 60def6
## </desc>
Chris PeBenito 60def6
gen_tunable(httpd_dbus_avahi, false)
Chris PeBenito 60def6
Chris PeBenito 60def6
## <desc>
Chris PeBenito 60def6
## 

Chris PeBenito 56e1b3
## Allow httpd cgi support
Chris PeBenito 56e1b3
## 

Chris PeBenito 56e1b3
## </desc>
Chris PeBenito 0bfccd
gen_tunable(httpd_enable_cgi, false)
Chris PeBenito 56e1b3
Chris PeBenito 56e1b3
## <desc>
Chris PeBenito 56e1b3
## 

Chris PeBenito 56e1b3
## Allow httpd to act as a FTP server by
Chris PeBenito 56e1b3
## listening on the ftp port.
Chris PeBenito 56e1b3
## 

Chris PeBenito 56e1b3
## </desc>
Chris PeBenito 0bfccd
gen_tunable(httpd_enable_ftp_server, false)
Chris PeBenito 56e1b3
Chris PeBenito 56e1b3
## <desc>
Chris PeBenito 56e1b3
## 

Chris PeBenito 56e1b3
## Allow httpd to read home directories
Chris PeBenito 56e1b3
## 

Chris PeBenito 56e1b3
## </desc>
Chris PeBenito 0bfccd
gen_tunable(httpd_enable_homedirs, false)
Chris PeBenito 56e1b3
Chris PeBenito 56e1b3
## <desc>
Chris PeBenito 56e1b3
## 

Chris PeBenito dd9e1d
## Allow HTTPD to run SSI executables in the same domain as system CGI scripts.
Chris PeBenito 56e1b3
## 

Chris PeBenito 56e1b3
## </desc>
Chris PeBenito 0bfccd
gen_tunable(httpd_ssi_exec, false)
Chris PeBenito 56e1b3
Chris PeBenito 56e1b3
## <desc>
Chris PeBenito 56e1b3
## 

Chris PeBenito dd9e1d
## Unify HTTPD to communicate with the terminal.
Chris PeBenito dd9e1d
## Needed for entering the passphrase for certificates at
Chris PeBenito dd9e1d
## the terminal.
Chris PeBenito 56e1b3
## 

Chris PeBenito 56e1b3
## </desc>
Chris PeBenito 0bfccd
gen_tunable(httpd_tty_comm, false)
Chris PeBenito 56e1b3
Chris PeBenito 56e1b3
## <desc>
Chris PeBenito 56e1b3
## 

Chris PeBenito dd9e1d
## Unify HTTPD handling of all content files.
Chris PeBenito 56e1b3
## 

Chris PeBenito 56e1b3
## </desc>
Chris PeBenito 0bfccd
gen_tunable(httpd_unified, false)
Chris PeBenito 56e1b3
Chris PeBenito 60def6
## <desc>
Chris PeBenito 60def6
## 

Chris PeBenito 60def6
## Allow httpd to access cifs file systems
Chris PeBenito 60def6
## 

Chris PeBenito 60def6
## </desc>
Chris PeBenito 60def6
gen_tunable(httpd_use_cifs, false)
Chris PeBenito 60def6
Chris PeBenito 60def6
## <desc>
Chris PeBenito 60def6
## 

Chris PeBenito 60def6
## Allow httpd to run gpg
Chris PeBenito 60def6
## 

Chris PeBenito 60def6
## </desc>
Chris PeBenito 60def6
gen_tunable(httpd_use_gpg, false)
Chris PeBenito 60def6
Chris PeBenito 60def6
## <desc>
Chris PeBenito 60def6
## 

Chris PeBenito 60def6
## Allow httpd to access nfs file systems
Chris PeBenito 60def6
## 

Chris PeBenito 60def6
## </desc>
Chris PeBenito 60def6
gen_tunable(httpd_use_nfs, false)
Chris PeBenito 60def6
Chris PeBenito a996bd
attribute httpdcontent;
Chris PeBenito a334d2
attribute httpd_user_content_type;
Chris PeBenito a996bd
Chris PeBenito e749cd
# domains that can exec all users scripts
Chris PeBenito e749cd
attribute httpd_exec_scripts;
Chris PeBenito e749cd
Chris PeBenito 123a99
attribute httpd_script_exec_type;
Chris PeBenito a334d2
attribute httpd_user_script_exec_type;
Chris PeBenito 123a99
Chris PeBenito e749cd
# user script domains
Chris PeBenito e749cd
attribute httpd_script_domains;
Chris PeBenito e749cd
Chris PeBenito a996bd
type httpd_t;
Chris PeBenito a996bd
type httpd_exec_t;
Chris PeBenito 0bfccd
init_daemon_domain(httpd_t, httpd_exec_t)
Chris PeBenito e749cd
role system_r types httpd_t;
Chris PeBenito a996bd
Chris PeBenito a996bd
# httpd_cache_t is the type given to the /var/cache/httpd
Chris PeBenito a996bd
# directory and the files under that directory
Chris PeBenito a996bd
type httpd_cache_t;
Chris PeBenito a996bd
files_type(httpd_cache_t)
Chris PeBenito a996bd
Chris PeBenito a996bd
# httpd_config_t is the type given to the configuration files
Chris PeBenito a996bd
type httpd_config_t;
Chris PeBenito a996bd
files_type(httpd_config_t)
Chris PeBenito a996bd
Chris PeBenito a996bd
type httpd_helper_t;
Chris PeBenito a996bd
type httpd_helper_exec_t;
Chris PeBenito e749cd
domain_type(httpd_helper_t)
Chris PeBenito 0bfccd
domain_entry_file(httpd_helper_t, httpd_helper_exec_t)
Chris PeBenito e749cd
role system_r types httpd_helper_t;
Chris PeBenito a996bd
Chris PeBenito 83caba
type httpd_initrc_exec_t;
Chris PeBenito 83caba
init_script_file(httpd_initrc_exec_t)
Chris PeBenito 83caba
Chris PeBenito a996bd
type httpd_lock_t;
Chris PeBenito a996bd
files_lock_file(httpd_lock_t)
Chris PeBenito a996bd
Chris PeBenito a996bd
type httpd_log_t;
Chris PeBenito a996bd
logging_log_file(httpd_log_t)
Chris PeBenito a996bd
Chris PeBenito a996bd
# httpd_modules_t is the type given to module files (libraries) 
Chris PeBenito a996bd
# that come with Apache /etc/httpd/modules and /usr/lib/apache
Chris PeBenito a996bd
type httpd_modules_t;
Chris PeBenito a996bd
files_type(httpd_modules_t)
Chris PeBenito a996bd
Chris PeBenito a996bd
type httpd_php_t;
Chris PeBenito a996bd
type httpd_php_exec_t;
Chris PeBenito e749cd
domain_type(httpd_php_t)
Chris PeBenito 0bfccd
domain_entry_file(httpd_php_t, httpd_php_exec_t)
Chris PeBenito e749cd
role system_r types httpd_php_t;
Chris PeBenito a996bd
Chris PeBenito a996bd
type httpd_php_tmp_t;
Chris PeBenito a996bd
files_tmp_file(httpd_php_tmp_t)
Chris PeBenito a996bd
Chris PeBenito 123a99
type httpd_rotatelogs_t;
Chris PeBenito 123a99
type httpd_rotatelogs_exec_t;
Chris PeBenito 123a99
init_daemon_domain(httpd_rotatelogs_t, httpd_rotatelogs_exec_t)
Chris PeBenito 123a99
Chris PeBenito a996bd
type httpd_squirrelmail_t;
Chris PeBenito a996bd
files_type(httpd_squirrelmail_t)
Chris PeBenito a996bd
Chris PeBenito a996bd
# SUEXEC runs user scripts as their own user ID
Chris PeBenito a996bd
type httpd_suexec_t; #, daemon;
Chris PeBenito a996bd
type httpd_suexec_exec_t;
Chris PeBenito e749cd
domain_type(httpd_suexec_t)
Chris PeBenito 0bfccd
domain_entry_file(httpd_suexec_t, httpd_suexec_exec_t)
Chris PeBenito e749cd
role system_r types httpd_suexec_t;
Chris PeBenito a996bd
Chris PeBenito a996bd
type httpd_suexec_tmp_t;
Chris PeBenito a996bd
files_tmp_file(httpd_suexec_tmp_t)
Chris PeBenito a996bd
Chris PeBenito c2b18f
# setup the system domain for system CGI scripts
Chris PeBenito c2b18f
apache_content_template(sys)
Chris PeBenito c2b18f
Chris PeBenito a996bd
type httpd_tmp_t;
Chris PeBenito a996bd
files_tmp_file(httpd_tmp_t)
Chris PeBenito a996bd
Chris PeBenito a996bd
type httpd_tmpfs_t;
Chris PeBenito a996bd
files_tmpfs_file(httpd_tmpfs_t)
Chris PeBenito a996bd
Chris PeBenito 296273
apache_content_template(user)
Chris PeBenito 296273
ubac_constrained(httpd_user_script_t)
Chris PeBenito 296273
userdom_user_home_content(httpd_user_content_t)
Chris PeBenito 296273
userdom_user_home_content(httpd_user_htaccess_t)
Chris PeBenito 296273
userdom_user_home_content(httpd_user_script_exec_t)
Chris PeBenito 83caba
userdom_user_home_content(httpd_user_ra_content_t)
Chris PeBenito 83caba
userdom_user_home_content(httpd_user_rw_content_t)
Chris PeBenito 296273
typeattribute httpd_user_script_t httpd_script_domains;
Chris PeBenito 296273
typealias httpd_user_content_t alias { httpd_staff_content_t httpd_sysadm_content_t };
Chris PeBenito 296273
typealias httpd_user_content_t alias { httpd_auditadm_content_t httpd_secadm_content_t };
Chris PeBenito 83caba
typealias httpd_user_content_t alias { httpd_staff_script_ro_t httpd_sysadm_script_ro_t };
Chris PeBenito 83caba
typealias httpd_user_content_t alias { httpd_auditadm_script_ro_t httpd_secadm_script_ro_t };
Chris PeBenito 296273
typealias httpd_user_htaccess_t alias { httpd_staff_htaccess_t httpd_sysadm_htaccess_t };
Chris PeBenito 296273
typealias httpd_user_htaccess_t alias { httpd_auditadm_htaccess_t httpd_secadm_htaccess_t };
Chris PeBenito 296273
typealias httpd_user_script_t alias { httpd_staff_script_t httpd_sysadm_script_t };
Chris PeBenito 296273
typealias httpd_user_script_t alias { httpd_auditadm_script_t httpd_secadm_script_t };
Chris PeBenito 296273
typealias httpd_user_script_exec_t alias { httpd_staff_script_exec_t httpd_sysadm_script_exec_t };
Chris PeBenito 296273
typealias httpd_user_script_exec_t alias { httpd_auditadm_script_exec_t httpd_secadm_script_exec_t };
Chris PeBenito 83caba
typealias httpd_user_rw_content_t alias { httpd_staff_script_rw_t httpd_sysadm_script_rw_t };
Chris PeBenito 83caba
typealias httpd_user_rw_content_t alias { httpd_auditadm_script_rw_t httpd_secadm_script_rw_t };
Chris PeBenito 83caba
typealias httpd_user_ra_content_t alias { httpd_staff_script_ra_t httpd_sysadm_script_ra_t };
Chris PeBenito 83caba
typealias httpd_user_ra_content_t alias { httpd_auditadm_script_ra_t httpd_secadm_script_ra_t };
Chris PeBenito 296273
Chris PeBenito a996bd
# for apache2 memory mapped files
Chris PeBenito a996bd
type httpd_var_lib_t;
Chris PeBenito a996bd
files_type(httpd_var_lib_t)
Chris PeBenito a996bd
Chris PeBenito a996bd
type httpd_var_run_t;
Chris PeBenito a996bd
files_pid_file(httpd_var_run_t)
Chris PeBenito a996bd
Chris PeBenito a996bd
# File Type of squirrelmail attachments
Chris PeBenito a996bd
type squirrelmail_spool_t;
Chris PeBenito a996bd
files_tmp_file(squirrelmail_spool_t)
Chris PeBenito a996bd
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito 2c2435
	prelink_object_file(httpd_modules_t)
Chris PeBenito 2c2435
')
Chris PeBenito 2c2435
Chris PeBenito a996bd
########################################
Chris PeBenito a996bd
#
Chris PeBenito a996bd
# Apache server local policy
Chris PeBenito a996bd
#
Chris PeBenito a996bd
Chris PeBenito 60def6
allow httpd_t self:capability { chown dac_override kill setgid setuid sys_nice sys_tty_config };
Chris PeBenito a996bd
dontaudit httpd_t self:capability { net_admin sys_tty_config };
Chris PeBenito a996bd
allow httpd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
Chris PeBenito a996bd
allow httpd_t self:fd use;
Chris PeBenito c0868a
allow httpd_t self:sock_file read_sock_file_perms;
Chris PeBenito c0868a
allow httpd_t self:fifo_file rw_fifo_file_perms;
Chris PeBenito a996bd
allow httpd_t self:shm create_shm_perms;
Chris PeBenito a996bd
allow httpd_t self:sem create_sem_perms;
Chris PeBenito a996bd
allow httpd_t self:msgq create_msgq_perms;
Chris PeBenito a996bd
allow httpd_t self:msg { send receive };
Chris PeBenito e9a408
allow httpd_t self:unix_dgram_socket { create_socket_perms sendto };
Chris PeBenito e9a408
allow httpd_t self:unix_stream_socket { create_stream_socket_perms connectto };
Chris PeBenito 33c7e6
allow httpd_t self:tcp_socket create_stream_socket_perms;
Chris PeBenito e9a408
allow httpd_t self:udp_socket create_socket_perms;
Chris PeBenito a996bd
Chris PeBenito a996bd
# Allow httpd_t to put files in /var/cache/httpd etc
Chris PeBenito 0bfccd
manage_dirs_pattern(httpd_t, httpd_cache_t, httpd_cache_t)
Chris PeBenito 0bfccd
manage_files_pattern(httpd_t, httpd_cache_t, httpd_cache_t)
Chris PeBenito 0bfccd
manage_lnk_files_pattern(httpd_t, httpd_cache_t, httpd_cache_t)
Chris PeBenito a996bd
Chris PeBenito a996bd
# Allow the httpd_t to read the web servers config files
Chris PeBenito c0868a
allow httpd_t httpd_config_t:dir list_dir_perms;
Chris PeBenito 0bfccd
read_files_pattern(httpd_t, httpd_config_t, httpd_config_t)
Chris PeBenito 0bfccd
read_lnk_files_pattern(httpd_t, httpd_config_t, httpd_config_t)
Chris PeBenito a996bd
Chris PeBenito a996bd
can_exec(httpd_t, httpd_exec_t)
Chris PeBenito a996bd
Chris PeBenito c0868a
allow httpd_t httpd_lock_t:file manage_file_perms;
Chris PeBenito 0bfccd
files_lock_filetrans(httpd_t, httpd_lock_t, file)
Chris PeBenito a996bd
Chris PeBenito c0868a
allow httpd_t httpd_log_t:dir setattr;
Chris PeBenito 0bfccd
create_files_pattern(httpd_t, httpd_log_t, httpd_log_t)
Chris PeBenito 0bfccd
append_files_pattern(httpd_t, httpd_log_t, httpd_log_t)
Chris PeBenito 0bfccd
read_files_pattern(httpd_t, httpd_log_t, httpd_log_t)
Chris PeBenito 0bfccd
read_lnk_files_pattern(httpd_t, httpd_log_t, httpd_log_t)
Chris PeBenito c2b18f
# cjp: need to refine create interfaces to
Chris PeBenito c2b18f
# cut this back to add_name only
Chris PeBenito 0bfccd
logging_log_filetrans(httpd_t, httpd_log_t, file)
Chris PeBenito a996bd
Chris PeBenito c0868a
allow httpd_t httpd_modules_t:dir list_dir_perms;
Chris PeBenito 0bfccd
mmap_files_pattern(httpd_t, httpd_modules_t, httpd_modules_t)
Chris PeBenito 0bfccd
read_files_pattern(httpd_t, httpd_modules_t, httpd_modules_t)
Chris PeBenito 60def6
read_lnk_files_pattern(httpd_t, httpd_modules_t, httpd_modules_t)
Chris PeBenito a996bd
Chris PeBenito d6d16b
apache_domtrans_rotatelogs(httpd_t)
Chris PeBenito d6d16b
# Apache-httpd needs to be able to send signals to the log rotate procs.
Chris PeBenito d6d16b
allow httpd_t httpd_rotatelogs_t:process signal_perms;
Chris PeBenito d6d16b
Chris PeBenito 0bfccd
manage_dirs_pattern(httpd_t, httpd_squirrelmail_t, httpd_squirrelmail_t)
Chris PeBenito 0bfccd
manage_files_pattern(httpd_t, httpd_squirrelmail_t, httpd_squirrelmail_t)
Chris PeBenito 0bfccd
manage_lnk_files_pattern(httpd_t, httpd_squirrelmail_t, httpd_squirrelmail_t)
Chris PeBenito a996bd
Chris PeBenito 0b36a2
allow httpd_t httpd_suexec_exec_t:file read_file_perms;
Chris PeBenito 725926
Chris PeBenito c0868a
allow httpd_t httpd_sys_content_t:dir list_dir_perms;
Chris PeBenito 0bfccd
read_files_pattern(httpd_t, httpd_sys_content_t, httpd_sys_content_t)
Chris PeBenito 0bfccd
read_lnk_files_pattern(httpd_t, httpd_sys_content_t, httpd_sys_content_t)
Don Miner 3d37bc
Chris PeBenito 60def6
allow httpd_t httpd_sys_script_t:unix_stream_socket connectto;
Chris PeBenito 60def6
Chris PeBenito 0bfccd
manage_dirs_pattern(httpd_t, httpd_tmp_t, httpd_tmp_t)
Chris PeBenito 0bfccd
manage_files_pattern(httpd_t, httpd_tmp_t, httpd_tmp_t)
Chris PeBenito 60def6
manage_lnk_files_pattern(httpd_t, httpd_tmp_t, httpd_tmp_t)
Chris PeBenito 60def6
files_tmp_filetrans(httpd_t, httpd_tmp_t, { file dir lnk_file })
Chris PeBenito a996bd
Chris PeBenito 0bfccd
manage_dirs_pattern(httpd_t, httpd_tmpfs_t, httpd_tmpfs_t)
Chris PeBenito 0bfccd
manage_files_pattern(httpd_t, httpd_tmpfs_t, httpd_tmpfs_t)
Chris PeBenito 0bfccd
manage_lnk_files_pattern(httpd_t, httpd_tmpfs_t, httpd_tmpfs_t)
Chris PeBenito 0bfccd
manage_fifo_files_pattern(httpd_t, httpd_tmpfs_t, httpd_tmpfs_t)
Chris PeBenito 0bfccd
manage_sock_files_pattern(httpd_t, httpd_tmpfs_t, httpd_tmpfs_t)
Chris PeBenito 0bfccd
fs_tmpfs_filetrans(httpd_t, httpd_tmpfs_t,{ dir file lnk_file sock_file fifo_file })
Chris PeBenito a996bd
Chris PeBenito 0bfccd
manage_files_pattern(httpd_t, httpd_var_lib_t, httpd_var_lib_t)
Chris PeBenito 0bfccd
files_var_lib_filetrans(httpd_t, httpd_var_lib_t, file)
Chris PeBenito a996bd
Chris PeBenito 60def6
setattr_dirs_pattern(httpd_t, httpd_var_run_t, httpd_var_run_t)
Chris PeBenito 60def6
manage_dirs_pattern(httpd_t, httpd_var_run_t, httpd_var_run_t)
Chris PeBenito 0bfccd
manage_files_pattern(httpd_t, httpd_var_run_t, httpd_var_run_t)
Chris PeBenito 0bfccd
manage_sock_files_pattern(httpd_t, httpd_var_run_t, httpd_var_run_t)
Chris PeBenito 60def6
files_pid_filetrans(httpd_t, httpd_var_run_t, { file sock_file dir })
Chris PeBenito a996bd
Chris PeBenito 0bfccd
manage_dirs_pattern(httpd_t, squirrelmail_spool_t, squirrelmail_spool_t)
Chris PeBenito 0bfccd
manage_files_pattern(httpd_t, squirrelmail_spool_t, squirrelmail_spool_t)
Chris PeBenito 0bfccd
manage_lnk_files_pattern(httpd_t, squirrelmail_spool_t, squirrelmail_spool_t)
Chris PeBenito a996bd
Chris PeBenito 445522
kernel_read_kernel_sysctls(httpd_t)
Chris PeBenito a996bd
# for modules that want to access /proc/meminfo
Chris PeBenito a996bd
kernel_read_system_state(httpd_t)
Chris PeBenito a996bd
Chris PeBenito 190066
corenet_all_recvfrom_unlabeled(httpd_t)
Chris PeBenito 190066
corenet_all_recvfrom_netlabel(httpd_t)
Chris PeBenito 668b30
corenet_tcp_sendrecv_generic_if(httpd_t)
Chris PeBenito 668b30
corenet_udp_sendrecv_generic_if(httpd_t)
Chris PeBenito c12621
corenet_tcp_sendrecv_generic_node(httpd_t)
Chris PeBenito c12621
corenet_udp_sendrecv_generic_node(httpd_t)
Chris PeBenito a996bd
corenet_tcp_sendrecv_all_ports(httpd_t)
Chris PeBenito a996bd
corenet_udp_sendrecv_all_ports(httpd_t)
Chris PeBenito c12621
corenet_tcp_bind_generic_node(httpd_t)
Chris PeBenito a996bd
corenet_tcp_bind_http_port(httpd_t)
Chris PeBenito a996bd
corenet_tcp_bind_http_cache_port(httpd_t)
Chris PeBenito 968ace
corenet_sendrecv_http_server_packets(httpd_t)
Chris PeBenito d6d16b
# Signal self for shutdown
Chris PeBenito d6d16b
corenet_tcp_connect_http_port(httpd_t)
Chris PeBenito a996bd
Chris PeBenito a996bd
dev_read_sysfs(httpd_t)
Chris PeBenito a996bd
dev_read_rand(httpd_t)
Chris PeBenito a996bd
dev_read_urand(httpd_t)
Chris PeBenito c2b18f
dev_rw_crypto(httpd_t)
Chris PeBenito a996bd
Chris PeBenito a996bd
fs_getattr_all_fs(httpd_t)
Chris PeBenito a996bd
fs_search_auto_mountpoints(httpd_t)
Chris PeBenito a996bd
Chris PeBenito 77f6e2
auth_use_nsswitch(httpd_t)
Chris PeBenito 77f6e2
Chris PeBenito a996bd
# execute perl
Chris PeBenito a996bd
corecmd_exec_bin(httpd_t)
Chris PeBenito d6d16b
corecmd_exec_shell(httpd_t)
Chris PeBenito a996bd
Chris PeBenito 15722e
domain_use_interactive_fds(httpd_t)
Chris PeBenito a996bd
Chris PeBenito 60def6
files_dontaudit_getattr_all_pids(httpd_t)
Chris PeBenito a996bd
files_read_usr_files(httpd_t)
Chris PeBenito a996bd
files_list_mnt(httpd_t)
Chris PeBenito a996bd
files_search_spool(httpd_t)
Chris PeBenito a996bd
files_read_var_lib_files(httpd_t)
Chris PeBenito a996bd
files_search_home(httpd_t)
Chris PeBenito a996bd
files_getattr_home_dir(httpd_t)
Chris PeBenito a996bd
# for modules that want to access /etc/mtab
Chris PeBenito a996bd
files_read_etc_runtime_files(httpd_t)
Chris PeBenito a996bd
# Allow httpd_t to have access to files such as nisswitch.conf
Chris PeBenito a996bd
files_read_etc_files(httpd_t)
Chris PeBenito 6e99a6
# for tomcat
Chris PeBenito 6e99a6
files_read_var_lib_symlinks(httpd_t)
Chris PeBenito a996bd
Chris PeBenito d6d16b
fs_search_auto_mountpoints(httpd_sys_script_t)
Chris PeBenito d6d16b
Chris PeBenito 1815ba
libs_read_lib_files(httpd_t)
Chris PeBenito a996bd
Chris PeBenito a996bd
logging_send_syslog_msg(httpd_t)
Chris PeBenito a996bd
Chris PeBenito a996bd
miscfiles_read_localization(httpd_t)
Chris PeBenito a996bd
miscfiles_read_fonts(httpd_t)
Chris PeBenito 6e99a6
miscfiles_read_public_files(httpd_t)
Chris PeBenito 6e99a6
miscfiles_read_certs(httpd_t)
Chris PeBenito a996bd
Chris PeBenito a996bd
seutil_dontaudit_search_config(httpd_t)
Chris PeBenito a996bd
Chris PeBenito 103fe2
userdom_use_unpriv_users_fds(httpd_t)
Chris PeBenito a996bd
Chris PeBenito 6e99a6
tunable_policy(`allow_httpd_anon_write',`
Chris PeBenito 6e99a6
	miscfiles_manage_public_files(httpd_t)
Chris PeBenito 6e99a6
') 
Chris PeBenito 6e99a6
Chris PeBenito 123a99
ifdef(`TODO', `
Chris PeBenito 123a99
#
Chris PeBenito 123a99
# We need optionals to be able to be within booleans to make this work
Chris PeBenito 123a99
#
Chris PeBenito 123a99
tunable_policy(`allow_httpd_mod_auth_pam',`
Chris PeBenito 123a99
	auth_domtrans_chk_passwd(httpd_t)
Chris PeBenito 123a99
')
Chris PeBenito 123a99
')
Chris PeBenito 123a99
Chris PeBenito 6e99a6
tunable_policy(`httpd_can_network_connect',`
Chris PeBenito 6e99a6
	corenet_tcp_connect_all_ports(httpd_t)
Chris PeBenito 6e99a6
')
Chris PeBenito 6e99a6
Chris PeBenito bb4372
tunable_policy(`httpd_can_network_relay',`
Chris PeBenito bb4372
	# allow httpd to work as a relay
Chris PeBenito bb4372
	corenet_tcp_connect_gopher_port(httpd_t)
Chris PeBenito bb4372
	corenet_tcp_connect_ftp_port(httpd_t)
Chris PeBenito bb4372
	corenet_tcp_connect_http_port(httpd_t)
Chris PeBenito bb4372
	corenet_tcp_connect_http_cache_port(httpd_t)
Chris PeBenito 60def6
	corenet_tcp_connect_memcache_port(httpd_t)
Chris PeBenito 141cff
	corenet_sendrecv_gopher_client_packets(httpd_t)
Chris PeBenito 141cff
	corenet_sendrecv_ftp_client_packets(httpd_t)
Chris PeBenito 141cff
	corenet_sendrecv_http_client_packets(httpd_t)
Chris PeBenito 141cff
	corenet_sendrecv_http_cache_client_packets(httpd_t)
Chris PeBenito bb4372
')
Chris PeBenito bb4372
Chris PeBenito 60def6
tunable_policy(`httpd_enable_cgi && httpd_use_nfs',`
Chris PeBenito 60def6
	fs_nfs_domtrans(httpd_t, httpd_sys_script_t)
Chris PeBenito 60def6
')
Chris PeBenito 60def6
Chris PeBenito 60def6
tunable_policy(`httpd_enable_cgi && httpd_use_cifs',`
Chris PeBenito 60def6
	fs_cifs_domtrans(httpd_t, httpd_sys_script_t)
Chris PeBenito 60def6
')
Chris PeBenito 60def6
Chris PeBenito 6e99a6
tunable_policy(`httpd_enable_cgi && httpd_unified && httpd_builtin_scripting',`
Chris PeBenito c0868a
	domtrans_pattern(httpd_t, httpdcontent, httpd_sys_script_t)
Chris PeBenito 6e99a6
Chris PeBenito 0bfccd
	manage_dirs_pattern(httpd_t, httpdcontent, httpdcontent)
Chris PeBenito 0bfccd
	manage_files_pattern(httpd_t, httpdcontent, httpdcontent)
Chris PeBenito 0bfccd
	manage_lnk_files_pattern(httpd_t, httpdcontent, httpdcontent)
Chris PeBenito 6e99a6
')
Chris PeBenito 6e99a6
Chris PeBenito bea7b4
tunable_policy(`httpd_enable_ftp_server',`
Chris PeBenito bea7b4
	corenet_tcp_bind_ftp_port(httpd_t)
Chris PeBenito bea7b4
')
Chris PeBenito bea7b4
Chris PeBenito e311e2
tunable_policy(`httpd_enable_homedirs',`
Chris PeBenito 296273
	userdom_read_user_home_content_files(httpd_t)
Chris PeBenito e311e2
')
Chris PeBenito e311e2
Chris PeBenito a996bd
tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',`
Chris PeBenito a996bd
	fs_read_nfs_files(httpd_t)
Chris PeBenito a996bd
	fs_read_nfs_symlinks(httpd_t)
Chris PeBenito a996bd
')
Chris PeBenito a996bd
Chris PeBenito a996bd
tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',`
Chris PeBenito a996bd
	fs_read_cifs_files(httpd_t)
Chris PeBenito a996bd
	fs_read_cifs_symlinks(httpd_t)
Chris PeBenito a996bd
')
Chris PeBenito a996bd
Chris PeBenito 60def6
tunable_policy(`httpd_can_sendmail',`
Chris PeBenito 60def6
	# allow httpd to connect to mail servers
Chris PeBenito 60def6
	corenet_tcp_connect_smtp_port(httpd_t)
Chris PeBenito 60def6
	corenet_sendrecv_smtp_client_packets(httpd_t)
Chris PeBenito 60def6
	mta_send_mail(httpd_t)
Chris PeBenito 60def6
')
Chris PeBenito 60def6
Chris PeBenito e749cd
tunable_policy(`httpd_ssi_exec',`
Chris PeBenito 3f67f7
	corecmd_shell_domtrans(httpd_t, httpd_sys_script_t)
Chris PeBenito e749cd
	allow httpd_sys_script_t httpd_t:fd use;
Chris PeBenito e749cd
	allow httpd_sys_script_t httpd_t:fifo_file rw_file_perms;
Chris PeBenito e749cd
	allow httpd_sys_script_t httpd_t:process sigchld;
Chris PeBenito e749cd
')
Chris PeBenito e749cd
Chris PeBenito 6e99a6
# When the admin starts the server, the server wants to access
Chris PeBenito 6e99a6
# the TTY or PTY associated with the session. The httpd appears
Chris PeBenito 6e99a6
# to run correctly without this permission, so the permission
Chris PeBenito 6e99a6
# are dontaudited here. 
Chris PeBenito 6e99a6
tunable_policy(`httpd_tty_comm',`
Chris PeBenito 296273
	userdom_use_user_terminals(httpd_t)
Chris PeBenito 6e99a6
',`
Chris PeBenito 296273
	userdom_dontaudit_use_user_terminals(httpd_t)
Chris PeBenito a996bd
')
Chris PeBenito a996bd
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito 99c902
	calamaris_read_www_files(httpd_t)
Chris PeBenito 99c902
')
Chris PeBenito 99c902
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito 60def6
	ccs_read_config(httpd_t)
Chris PeBenito 60def6
')
Chris PeBenito 60def6
Chris PeBenito 60def6
optional_policy(`
Chris PeBenito 27eab8
	cobbler_search_lib(httpd_t)
Dominick Grift 1031ee
')
Dominick Grift 1031ee
Dominick Grift 1031ee
optional_policy(`
Chris PeBenito 350b6a
	cron_system_entry(httpd_t, httpd_exec_t)
Chris PeBenito 350b6a
')
Chris PeBenito 350b6a
Chris PeBenito 350b6a
optional_policy(`
Chris PeBenito 60def6
	cvs_read_data(httpd_t)
Chris PeBenito 60def6
')
Chris PeBenito 60def6
Chris PeBenito 60def6
optional_policy(`
Chris PeBenito 44d5d9
	daemontools_service_domain(httpd_t, httpd_exec_t)
Chris PeBenito 44d5d9
')
Chris PeBenito 44d5d9
Chris PeBenito 60def6
 optional_policy(`
Chris PeBenito 60def6
	dbus_system_bus_client(httpd_t)
Chris PeBenito 60def6
Chris PeBenito 60def6
	tunable_policy(`httpd_dbus_avahi',`
Chris PeBenito 60def6
		avahi_dbus_chat(httpd_t)
Chris PeBenito 60def6
	')
Chris PeBenito 60def6
')
Chris PeBenito 60def6
Chris PeBenito 60def6
optional_policy(`
Chris PeBenito 60def6
	tunable_policy(`httpd_enable_cgi && httpd_use_gpg',`
Chris PeBenito 60def6
		gpg_domtrans(httpd_t)
Chris PeBenito 60def6
	')
Chris PeBenito 60def6
')
Chris PeBenito 60def6
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito 83caba
	kerberos_keytab_template(httpd, httpd_t)
Chris PeBenito a996bd
')
Chris PeBenito a996bd
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito 799a0b
	mailman_signal_cgi(httpd_t)
Chris PeBenito 799a0b
	mailman_domtrans_cgi(httpd_t)
Chris PeBenito 60def6
	mailman_read_data_files(httpd_t)
Chris PeBenito 799a0b
	# should have separate types for public and private archives
Chris PeBenito 0500e0
	mailman_search_data(httpd_t)
Chris PeBenito 799a0b
	mailman_read_archive(httpd_t)
Chris PeBenito 799a0b
')
Chris PeBenito 799a0b
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito 0b6aca
	# Allow httpd to work with mysql
Chris PeBenito a996bd
	mysql_stream_connect(httpd_t)
Chris PeBenito 1815ba
	mysql_rw_db_sockets(httpd_t)
Chris PeBenito 0b6aca
Chris PeBenito 0b6aca
	tunable_policy(`httpd_can_network_connect_db',`
Chris PeBenito dc1920
		mysql_tcp_connect(httpd_t)
Chris PeBenito 0b6aca
	')
Chris PeBenito a996bd
')
Chris PeBenito a996bd
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito f1e604
	nagios_read_config(httpd_t)
Chris PeBenito f1e604
')
Chris PeBenito f1e604
Chris PeBenito f1e604
optional_policy(`
Chris PeBenito 5bd9fd
	openca_domtrans(httpd_t)
Chris PeBenito 5bd9fd
	openca_signal(httpd_t)
Chris PeBenito 5bd9fd
	openca_sigstop(httpd_t)
Chris PeBenito 5bd9fd
	openca_kill(httpd_t)
Chris PeBenito 5bd9fd
')
Chris PeBenito 5bd9fd
Chris PeBenito 5bd9fd
optional_policy(`
Chris PeBenito 725926
	# Allow httpd to work with postgresql
Chris PeBenito 1815ba
	postgresql_stream_connect(httpd_t)
Chris PeBenito e8cb08
	postgresql_unpriv_client(httpd_t)
Chris PeBenito 0b6aca
Chris PeBenito 0b6aca
	tunable_policy(`httpd_can_network_connect_db',`
Chris PeBenito 0b6aca
		postgresql_tcp_connect(httpd_t)
Chris PeBenito 0b6aca
	')
Chris PeBenito 725926
')
Chris PeBenito 725926
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito a996bd
	seutil_sigchld_newrole(httpd_t)
Chris PeBenito a996bd
')
Chris PeBenito a996bd
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito 6b19be
	snmp_dontaudit_read_snmp_var_lib_files(httpd_t)
Chris PeBenito 6b19be
	snmp_dontaudit_write_snmp_var_lib_files(httpd_t)
Chris PeBenito 6b19be
')
Chris PeBenito 6b19be
Chris PeBenito 6b19be
optional_policy(`
Chris PeBenito a996bd
	udev_read_db(httpd_t)
Chris PeBenito a996bd
')
Chris PeBenito a996bd
Chris PeBenito f30e6e
optional_policy(`
Chris PeBenito f30e6e
	yam_read_content(httpd_t)
Chris PeBenito f30e6e
')
Chris PeBenito f30e6e
Chris PeBenito a996bd
########################################
Chris PeBenito a996bd
#
Chris PeBenito a996bd
# Apache helper local policy
Chris PeBenito a996bd
#
Chris PeBenito a996bd
Chris PeBenito c0868a
domtrans_pattern(httpd_t, httpd_helper_exec_t, httpd_helper_t)
Chris PeBenito a996bd
Chris PeBenito 0b36a2
allow httpd_helper_t httpd_config_t:file read_file_perms;
Chris PeBenito a996bd
Chris PeBenito 0b36a2
allow httpd_helper_t httpd_log_t:file append_file_perms;
Chris PeBenito a996bd
Chris PeBenito e749cd
logging_send_syslog_msg(httpd_helper_t)
Chris PeBenito e749cd
Chris PeBenito 296273
userdom_use_user_terminals(httpd_helper_t)
Chris PeBenito aba9c7
Chris PeBenito a996bd
########################################
Chris PeBenito a996bd
#
Chris PeBenito a996bd
# Apache PHP script local policy
Chris PeBenito a996bd
#
Chris PeBenito a996bd
Chris PeBenito a996bd
allow httpd_php_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
Chris PeBenito a996bd
allow httpd_php_t self:fd use;
Chris PeBenito c0868a
allow httpd_php_t self:fifo_file rw_fifo_file_perms;
Chris PeBenito c0868a
allow httpd_php_t self:sock_file read_sock_file_perms;
Chris PeBenito a996bd
allow httpd_php_t self:unix_dgram_socket create_socket_perms;
Chris PeBenito a996bd
allow httpd_php_t self:unix_stream_socket create_stream_socket_perms;
Chris PeBenito a996bd
allow httpd_php_t self:unix_dgram_socket sendto;
Chris PeBenito a996bd
allow httpd_php_t self:unix_stream_socket connectto;
Chris PeBenito a996bd
allow httpd_php_t self:shm create_shm_perms;
Chris PeBenito a996bd
allow httpd_php_t self:sem create_sem_perms;
Chris PeBenito a996bd
allow httpd_php_t self:msgq create_msgq_perms;
Chris PeBenito a996bd
allow httpd_php_t self:msg { send receive };
Chris PeBenito a996bd
Chris PeBenito c0868a
domtrans_pattern(httpd_t, httpd_php_exec_t, httpd_php_t)
Chris PeBenito a996bd
Chris PeBenito a996bd
# allow php to read and append to apache logfiles
Chris PeBenito c0868a
allow httpd_php_t httpd_log_t:file { read_file_perms append_file_perms };
Chris PeBenito a996bd
Chris PeBenito 0bfccd
manage_dirs_pattern(httpd_php_t, httpd_php_tmp_t, httpd_php_tmp_t)
Chris PeBenito 0bfccd
manage_files_pattern(httpd_php_t, httpd_php_tmp_t, httpd_php_tmp_t)
Chris PeBenito 103fe2
files_tmp_filetrans(httpd_php_t, httpd_php_tmp_t, { file dir })
Chris PeBenito a996bd
Chris PeBenito a996bd
fs_search_auto_mountpoints(httpd_php_t)
Chris PeBenito a996bd
Chris PeBenito 60def6
auth_use_nsswitch(httpd_php_t)
Chris PeBenito 60def6
Chris PeBenito a996bd
libs_exec_lib_files(httpd_php_t)
Chris PeBenito a996bd
Chris PeBenito 103fe2
userdom_use_unpriv_users_fds(httpd_php_t)
Chris PeBenito a996bd
Chris PeBenito 60def6
tunable_policy(`httpd_can_network_connect_db',`
Chris PeBenito 60def6
	corenet_tcp_connect_mysqld_port(httpd_t)
Chris PeBenito 60def6
	corenet_sendrecv_mysqld_client_packets(httpd_t)
Chris PeBenito 60def6
	corenet_tcp_connect_mysqld_port(httpd_sys_script_t)
Chris PeBenito 60def6
	corenet_sendrecv_mysqld_client_packets(httpd_sys_script_t)
Chris PeBenito 60def6
	corenet_tcp_connect_mysqld_port(httpd_suexec_t)
Chris PeBenito 60def6
	corenet_sendrecv_mysqld_client_packets(httpd_suexec_t)
Chris PeBenito 60def6
Chris PeBenito 60def6
	corenet_tcp_connect_mssql_port(httpd_t)
Chris PeBenito 60def6
	corenet_sendrecv_mssql_client_packets(httpd_t)
Chris PeBenito 60def6
	corenet_tcp_connect_mssql_port(httpd_sys_script_t)
Chris PeBenito 60def6
	corenet_sendrecv_mssql_client_packets(httpd_sys_script_t)
Chris PeBenito 60def6
	corenet_tcp_connect_mssql_port(httpd_suexec_t)
Chris PeBenito 60def6
	corenet_sendrecv_mssql_client_packets(httpd_suexec_t)
Chris PeBenito a996bd
')
Chris PeBenito a996bd
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito 60def6
	mysql_stream_connect(httpd_php_t)
Chris PeBenito 60def6
	mysql_read_config(httpd_php_t)
Chris PeBenito a996bd
')
Chris PeBenito a996bd
Chris PeBenito 5fe7de
optional_policy(`
Chris PeBenito 5fe7de
	postgresql_stream_connect(httpd_php_t)
Chris PeBenito 5fe7de
')
Chris PeBenito 5fe7de
Chris PeBenito a996bd
########################################
Chris PeBenito a996bd
#
Chris PeBenito a996bd
# Apache suexec local policy
Chris PeBenito a996bd
#
Chris PeBenito a996bd
Chris PeBenito a996bd
allow httpd_suexec_t self:capability { setuid setgid };
Chris PeBenito a996bd
allow httpd_suexec_t self:process signal_perms;
Chris PeBenito a996bd
allow httpd_suexec_t self:unix_stream_socket create_stream_socket_perms;
Chris PeBenito a996bd
Chris PeBenito 56e1b3
domtrans_pattern(httpd_t, httpd_suexec_exec_t, httpd_suexec_t)
Chris PeBenito a996bd
Chris PeBenito 0bfccd
create_files_pattern(httpd_suexec_t, httpd_log_t, httpd_log_t)
Chris PeBenito 0bfccd
append_files_pattern(httpd_suexec_t, httpd_log_t, httpd_log_t)
Chris PeBenito 0bfccd
read_files_pattern(httpd_suexec_t, httpd_log_t, httpd_log_t)
Chris PeBenito c0868a
Chris PeBenito 60def6
allow httpd_suexec_t httpd_t:fifo_file read_fifo_file_perms;
Chris PeBenito a996bd
Chris PeBenito 0bfccd
manage_dirs_pattern(httpd_suexec_t, httpd_suexec_tmp_t, httpd_suexec_tmp_t)
Chris PeBenito 0bfccd
manage_files_pattern(httpd_suexec_t, httpd_suexec_tmp_t, httpd_suexec_tmp_t)
Chris PeBenito 103fe2
files_tmp_filetrans(httpd_suexec_t, httpd_suexec_tmp_t, { file dir })
Chris PeBenito a996bd
Chris PeBenito 445522
kernel_read_kernel_sysctls(httpd_suexec_t)
Chris PeBenito a996bd
kernel_list_proc(httpd_suexec_t)
Chris PeBenito a996bd
kernel_read_proc_symlinks(httpd_suexec_t)
Chris PeBenito a996bd
Chris PeBenito a996bd
dev_read_urand(httpd_suexec_t)
Chris PeBenito a996bd
Chris PeBenito a996bd
fs_search_auto_mountpoints(httpd_suexec_t)
Chris PeBenito a996bd
Chris PeBenito a996bd
# for shell scripts
Chris PeBenito a996bd
corecmd_exec_bin(httpd_suexec_t)
Chris PeBenito a996bd
corecmd_exec_shell(httpd_suexec_t)
Chris PeBenito a996bd
Chris PeBenito a996bd
files_read_etc_files(httpd_suexec_t)
Chris PeBenito a996bd
files_read_usr_files(httpd_suexec_t)
Chris PeBenito 6e99a6
files_dontaudit_search_pids(httpd_suexec_t)
Chris PeBenito 725926
files_search_home(httpd_suexec_t)
Chris PeBenito a996bd
Chris PeBenito c0cf6e
auth_use_nsswitch(httpd_suexec_t)
Chris PeBenito c0cf6e
Chris PeBenito a996bd
logging_search_logs(httpd_suexec_t)
Chris PeBenito a996bd
logging_send_syslog_msg(httpd_suexec_t)
Chris PeBenito a996bd
Chris PeBenito a996bd
miscfiles_read_localization(httpd_suexec_t)
Chris PeBenito 60def6
miscfiles_read_public_files(httpd_suexec_t)
Chris PeBenito a996bd
Chris PeBenito a996bd
tunable_policy(`httpd_can_network_connect',`
Chris PeBenito a996bd
	allow httpd_suexec_t self:tcp_socket create_stream_socket_perms;
Chris PeBenito a996bd
	allow httpd_suexec_t self:udp_socket create_socket_perms;
Chris PeBenito a996bd
Chris PeBenito 190066
	corenet_all_recvfrom_unlabeled(httpd_suexec_t)
Chris PeBenito 190066
	corenet_all_recvfrom_netlabel(httpd_suexec_t)
Chris PeBenito 668b30
	corenet_tcp_sendrecv_generic_if(httpd_suexec_t)
Chris PeBenito 668b30
	corenet_udp_sendrecv_generic_if(httpd_suexec_t)
Chris PeBenito c12621
	corenet_tcp_sendrecv_generic_node(httpd_suexec_t)
Chris PeBenito c12621
	corenet_udp_sendrecv_generic_node(httpd_suexec_t)
Chris PeBenito a996bd
	corenet_tcp_sendrecv_all_ports(httpd_suexec_t)
Chris PeBenito a996bd
	corenet_udp_sendrecv_all_ports(httpd_suexec_t)
Chris PeBenito a996bd
	corenet_tcp_connect_all_ports(httpd_suexec_t)
Chris PeBenito 141cff
	corenet_sendrecv_all_client_packets(httpd_suexec_t)
Chris PeBenito a996bd
')
Chris PeBenito a996bd
Chris PeBenito 6e99a6
tunable_policy(`httpd_enable_cgi && httpd_unified',`
Chris PeBenito 60def6
	allow httpd_sys_script_t httpdcontent:file entrypoint;
Chris PeBenito c0868a
	domtrans_pattern(httpd_suexec_t, httpdcontent, httpd_sys_script_t)
Chris PeBenito 6e99a6
Chris PeBenito e311e2
')
Chris PeBenito e311e2
Chris PeBenito a996bd
tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',`
Chris PeBenito a996bd
	fs_read_nfs_files(httpd_suexec_t)
Chris PeBenito a996bd
	fs_read_nfs_symlinks(httpd_suexec_t)
Chris PeBenito 4d851f
	fs_exec_nfs_files(httpd_suexec_t)
Chris PeBenito a996bd
')
Chris PeBenito a996bd
Chris PeBenito a996bd
tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',`
Chris PeBenito a996bd
	fs_read_cifs_files(httpd_suexec_t)
Chris PeBenito a996bd
	fs_read_cifs_symlinks(httpd_suexec_t)
Chris PeBenito 4d851f
	fs_exec_cifs_files(httpd_suexec_t)
Chris PeBenito a996bd
')
Chris PeBenito a996bd
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito 799a0b
	mailman_domtrans_cgi(httpd_suexec_t)
Chris PeBenito 799a0b
')
Chris PeBenito 799a0b
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito 725926
	mta_stub(httpd_suexec_t)
Chris PeBenito 725926
Chris PeBenito 725926
	# apache should set close-on-exec
Chris PeBenito 725926
	dontaudit httpd_suexec_t httpd_t:unix_stream_socket { read write };
Chris PeBenito 725926
')
Chris PeBenito 725926
Chris PeBenito a996bd
########################################
Chris PeBenito a996bd
#
Chris PeBenito a996bd
# Apache system script local policy
Chris PeBenito a996bd
#
Chris PeBenito a996bd
Chris PeBenito 60def6
allow httpd_sys_script_t self:process getsched;
Chris PeBenito 60def6
Chris PeBenito 60def6
allow httpd_sys_script_t httpd_t:unix_stream_socket rw_stream_socket_perms;
Chris PeBenito 6e99a6
allow httpd_sys_script_t httpd_t:tcp_socket { read write };
Chris PeBenito 6e99a6
Chris PeBenito 6e99a6
dontaudit httpd_sys_script_t httpd_config_t:dir search;
Chris PeBenito 6e99a6
Chris PeBenito 0b36a2
allow httpd_sys_script_t httpd_squirrelmail_t:file { append_file_perms read_file_perms };
Chris PeBenito 6e99a6
Chris PeBenito c0868a
allow httpd_sys_script_t squirrelmail_spool_t:dir list_dir_perms;
Chris PeBenito 0bfccd
read_files_pattern(httpd_sys_script_t, squirrelmail_spool_t, squirrelmail_spool_t)
Chris PeBenito 0bfccd
read_lnk_files_pattern(httpd_sys_script_t, squirrelmail_spool_t, squirrelmail_spool_t)
Chris PeBenito 6e99a6
Chris PeBenito 445522
kernel_read_kernel_sysctls(httpd_sys_script_t)
Chris PeBenito 6e99a6
Chris PeBenito 6e99a6
files_search_var_lib(httpd_sys_script_t)
Chris PeBenito 6e99a6
files_search_spool(httpd_sys_script_t)
Chris PeBenito 6e99a6
Chris PeBenito 123a99
# Should we add a boolean?
Chris PeBenito 123a99
apache_domtrans_rotatelogs(httpd_sys_script_t)
Chris PeBenito 123a99
Chris PeBenito 6e99a6
ifdef(`distro_redhat',`
Chris PeBenito 0b36a2
	allow httpd_sys_script_t httpd_log_t:file append_file_perms;
Chris PeBenito 6e99a6
')
Chris PeBenito 6e99a6
Chris PeBenito 60def6
tunable_policy(`httpd_can_sendmail',`
Chris PeBenito 60def6
	mta_send_mail(httpd_sys_script_t)
Chris PeBenito 60def6
')
Chris PeBenito 60def6
Chris PeBenito 60def6
tunable_policy(`httpd_enable_cgi && httpd_can_network_connect',`
Chris PeBenito 60def6
	allow httpd_sys_script_t self:tcp_socket create_stream_socket_perms;
Chris PeBenito 60def6
	allow httpd_sys_script_t self:udp_socket create_socket_perms;
Chris PeBenito 60def6
Chris PeBenito 60def6
	corenet_tcp_bind_all_nodes(httpd_sys_script_t)
Chris PeBenito 60def6
	corenet_udp_bind_all_nodes(httpd_sys_script_t)
Chris PeBenito 60def6
	corenet_all_recvfrom_unlabeled(httpd_sys_script_t)
Chris PeBenito 60def6
	corenet_all_recvfrom_netlabel(httpd_sys_script_t)
Chris PeBenito 60def6
	corenet_tcp_sendrecv_all_if(httpd_sys_script_t)
Chris PeBenito 60def6
	corenet_udp_sendrecv_all_if(httpd_sys_script_t)
Chris PeBenito 60def6
	corenet_tcp_sendrecv_all_nodes(httpd_sys_script_t)
Chris PeBenito 60def6
	corenet_udp_sendrecv_all_nodes(httpd_sys_script_t)
Chris PeBenito 60def6
	corenet_tcp_sendrecv_all_ports(httpd_sys_script_t)
Chris PeBenito 60def6
	corenet_udp_sendrecv_all_ports(httpd_sys_script_t)
Chris PeBenito 60def6
	corenet_tcp_connect_all_ports(httpd_sys_script_t)
Chris PeBenito 60def6
	corenet_sendrecv_all_client_packets(httpd_sys_script_t)
Chris PeBenito 60def6
')
Chris PeBenito 60def6
Chris PeBenito e311e2
tunable_policy(`httpd_enable_homedirs',`
Chris PeBenito 296273
	userdom_read_user_home_content_files(httpd_sys_script_t)
Chris PeBenito e311e2
')
Chris PeBenito e311e2
Chris PeBenito d6d16b
tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',`
Chris PeBenito d6d16b
	fs_read_nfs_files(httpd_sys_script_t)
Chris PeBenito d6d16b
	fs_read_nfs_symlinks(httpd_sys_script_t)
Chris PeBenito d6d16b
')
Chris PeBenito d6d16b
Chris PeBenito d6d16b
tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',`
Chris PeBenito d6d16b
	fs_read_cifs_files(httpd_sys_script_t)
Chris PeBenito d6d16b
	fs_read_cifs_symlinks(httpd_sys_script_t)
Chris PeBenito d6d16b
')
Chris PeBenito d6d16b
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito 165b42
	clamav_domtrans_clamscan(httpd_sys_script_t)
Chris PeBenito 165b42
')
Chris PeBenito 165b42
Chris PeBenito 165b42
optional_policy(`
Chris PeBenito 6e99a6
	mysql_stream_connect(httpd_sys_script_t)
Chris PeBenito 1815ba
	mysql_rw_db_sockets(httpd_sys_script_t)
Chris PeBenito 6e99a6
')
Chris PeBenito 6e99a6
Chris PeBenito 5fe7de
optional_policy(`
Chris PeBenito 5fe7de
	postgresql_stream_connect(httpd_sys_script_t)
Chris PeBenito 5fe7de
')
Chris PeBenito 5fe7de
Chris PeBenito a996bd
########################################
Chris PeBenito a996bd
#
Chris PeBenito 123a99
# httpd_rotatelogs local policy
Chris PeBenito 123a99
#
Chris PeBenito 123a99
Chris PeBenito 60def6
allow httpd_rotatelogs_t self:capability dac_override;
Chris PeBenito 60def6
Chris PeBenito 0bfccd
manage_files_pattern(httpd_rotatelogs_t, httpd_log_t, httpd_log_t)
Chris PeBenito 123a99
Chris PeBenito 123a99
kernel_read_kernel_sysctls(httpd_rotatelogs_t)
Chris PeBenito 123a99
kernel_dontaudit_list_proc(httpd_rotatelogs_t)
Chris PeBenito 123a99
kernel_dontaudit_read_proc_symlinks(httpd_rotatelogs_t)
Chris PeBenito 123a99
Chris PeBenito 123a99
files_read_etc_files(httpd_rotatelogs_t)
Chris PeBenito 123a99
Chris PeBenito d6d16b
logging_search_logs(httpd_rotatelogs_t)
Chris PeBenito d6d16b
Chris PeBenito 123a99
miscfiles_read_localization(httpd_rotatelogs_t)
Chris PeBenito 296273
Chris PeBenito 296273
########################################
Chris PeBenito 296273
#
Chris PeBenito 60def6
# Unconfined script local policy
Chris PeBenito 60def6
#
Chris PeBenito 60def6
Chris PeBenito 60def6
optional_policy(`
Chris PeBenito 60def6
	type httpd_unconfined_script_t;
Chris PeBenito 60def6
	type httpd_unconfined_script_exec_t;
Chris PeBenito 60def6
	domain_type(httpd_unconfined_script_t)
Chris PeBenito 60def6
	domain_entry_file(httpd_unconfined_script_t, httpd_unconfined_script_exec_t)
Chris PeBenito 60def6
	domtrans_pattern(httpd_t, httpd_unconfined_script_exec_t, httpd_unconfined_script_t)
Chris PeBenito 60def6
	unconfined_domain(httpd_unconfined_script_t)
Chris PeBenito 60def6
Chris PeBenito 60def6
	role system_r types httpd_unconfined_script_t;
Chris PeBenito 60def6
	allow httpd_t httpd_unconfined_script_t:process signal_perms;
Chris PeBenito 60def6
')
Chris PeBenito 60def6
Chris PeBenito 60def6
########################################
Chris PeBenito 60def6
#
Chris PeBenito 296273
# User content local policy
Chris PeBenito 296273
#
Chris PeBenito 296273
Chris PeBenito 296273
tunable_policy(`httpd_enable_cgi && httpd_unified',`
Chris PeBenito 296273
	allow httpd_user_script_t httpdcontent:file entrypoint;
Chris PeBenito 296273
')
Chris PeBenito 296273
Chris PeBenito 296273
# allow accessing files/dirs below the users home dir
Chris PeBenito 296273
tunable_policy(`httpd_enable_homedirs',`
Chris PeBenito 296273
	userdom_search_user_home_dirs(httpd_t)
Chris PeBenito 296273
	userdom_search_user_home_dirs(httpd_suexec_t)
Chris PeBenito 296273
	userdom_search_user_home_dirs(httpd_user_script_t)
Chris PeBenito 296273
')