Dan Walsh 3eaa99
###############################################################################
Dan Walsh 3eaa99
#
Dan Walsh 3eaa99
# Copyright (C) 2006, 2010 Red Hat, Inc. All Rights Reserved.
Dan Walsh 3eaa99
# Written by David Howells (dhowells@redhat.com)
Dan Walsh 3eaa99
#            Karl MacMillan (kmacmill@redhat.com)
Dan Walsh 3eaa99
#
Dan Walsh 3eaa99
# This program is free software; you can redistribute it and/or
Dan Walsh 3eaa99
# modify it under the terms of the GNU General Public License
Dan Walsh 3eaa99
# as published by the Free Software Foundation; either version
Dan Walsh 3eaa99
# 2 of the License, or (at your option) any later version.
Dan Walsh 3eaa99
#
Dan Walsh 3eaa99
###############################################################################
Dan Walsh 3eaa99
Dan Walsh 3eaa99
#
Dan Walsh 3eaa99
# This security policy governs access by the CacheFiles kernel module and
Dan Walsh 3eaa99
# userspace management daemon to the files and directories in the on-disk
Dan Walsh 3eaa99
# cache, on behalf of the processes accessing the cache through a network
Dan Walsh 3eaa99
# filesystem such as NFS
Dan Walsh 3eaa99
#
Dan Walsh 3eaa99
policy_module(cachefilesd,1.0.17)
Dan Walsh 3eaa99
Dan Walsh 3eaa99
###############################################################################
Dan Walsh 3eaa99
#
Dan Walsh 3eaa99
# Declarations
Dan Walsh 3eaa99
#
Dan Walsh 3eaa99
Dan Walsh 3eaa99
#
Dan Walsh 3eaa99
# Files in the cache are created by the cachefiles module with security ID
Dan Walsh 3eaa99
# cachefiles_var_t
Dan Walsh 3eaa99
#
Dan Walsh 3eaa99
type cachefiles_var_t;
Dan Walsh 3eaa99
files_type(cachefiles_var_t)
Dan Walsh 3eaa99
Dan Walsh 3eaa99
#
Dan Walsh 3eaa99
# The /dev/cachefiles character device has security ID cachefiles_dev_t
Dan Walsh 3eaa99
#
Dan Walsh 3eaa99
type cachefiles_dev_t;
Dan Walsh 3eaa99
dev_node(cachefiles_dev_t)
Dan Walsh 3eaa99
Dan Walsh 3eaa99
#
Dan Walsh 3eaa99
# The cachefilesd daemon normally runs with security ID cachefilesd_t
Dan Walsh 3eaa99
#
Dan Walsh 3eaa99
type cachefilesd_t;
Dan Walsh 3eaa99
type cachefilesd_exec_t;
Dan Walsh 3eaa99
domain_type(cachefilesd_t)
Dan Walsh 3eaa99
init_daemon_domain(cachefilesd_t, cachefilesd_exec_t)
Dan Walsh 3eaa99
Dan Walsh 3eaa99
#
Dan Walsh 3eaa99
# The cachefilesd daemon pid file context
Dan Walsh 3eaa99
#
Dan Walsh 3eaa99
type cachefilesd_var_run_t;
Dan Walsh 3eaa99
files_pid_file(cachefilesd_var_run_t)
Dan Walsh 3eaa99
Dan Walsh 3eaa99
#
Dan Walsh 3eaa99
# The CacheFiles kernel module causes processes accessing the cache files to do
Dan Walsh 3eaa99
# so acting as security ID cachefiles_kernel_t
Dan Walsh 3eaa99
#
Dan Walsh 3eaa99
type cachefiles_kernel_t;
Dan Walsh 3eaa99
domain_type(cachefiles_kernel_t)
Dan Walsh 3eaa99
domain_obj_id_change_exemption(cachefiles_kernel_t)
Dan Walsh 3eaa99
role system_r types cachefiles_kernel_t;
Dan Walsh 3eaa99
Dan Walsh 3eaa99
###############################################################################
Dan Walsh 3eaa99
#
Dan Walsh 3eaa99
# Permit RPM to deal with files in the cache
Dan Walsh 3eaa99
#
Dan Walsh 3eaa99
rpm_use_script_fds(cachefilesd_t)
Dan Walsh 3eaa99
Dan Walsh 3eaa99
###############################################################################
Dan Walsh 3eaa99
#
Dan Walsh 3eaa99
# cachefilesd local policy
Dan Walsh 3eaa99
#
Dan Walsh 3eaa99
# These define what cachefilesd is permitted to do.  This doesn't include very
Dan Walsh 3eaa99
# much: startup stuff, logging, pid file, scanning the cache superstructure and
Dan Walsh 3eaa99
# deleting files from the cache.  It is not permitted to read/write files in
Dan Walsh 3eaa99
# the cache.
Dan Walsh 3eaa99
#
Dan Walsh 3eaa99
# Check in /usr/share/selinux/devel/include/ for macros to use instead of allow
Dan Walsh 3eaa99
# rules.
Dan Walsh 3eaa99
#
Dan Walsh 3eaa99
allow cachefilesd_t self : capability { setuid setgid sys_admin dac_override };
Dan Walsh 3eaa99
Dan Walsh 3eaa99
# Basic access
Dan Walsh 3eaa99
files_read_etc_files(cachefilesd_t)
Dan Walsh 3eaa99
libs_use_ld_so(cachefilesd_t)
Dan Walsh 3eaa99
libs_use_shared_libs(cachefilesd_t)
Dan Walsh 3eaa99
miscfiles_read_localization(cachefilesd_t)
Dan Walsh 3eaa99
logging_send_syslog_msg(cachefilesd_t)
Dan Walsh 3eaa99
init_dontaudit_use_script_ptys(cachefilesd_t)
Dan Walsh 3eaa99
term_dontaudit_use_generic_ptys(cachefilesd_t)
Dan Walsh 3eaa99
term_dontaudit_getattr_unallocated_ttys(cachefilesd_t)
Dan Walsh 3eaa99
Dan Walsh 3eaa99
# Allow manipulation of pid file
Dan Walsh 3eaa99
allow cachefilesd_t cachefilesd_var_run_t:file create_file_perms;
Dan Walsh 3eaa99
manage_files_pattern(cachefilesd_t,cachefilesd_var_run_t, cachefilesd_var_run_t)
Dan Walsh 3eaa99
manage_dirs_pattern(cachefilesd_t,cachefilesd_var_run_t, cachefilesd_var_run_t)
Dan Walsh 3eaa99
files_pid_file(cachefilesd_var_run_t)
Dan Walsh 3eaa99
files_pid_filetrans(cachefilesd_t,cachefilesd_var_run_t,file)
Dan Walsh 3eaa99
files_create_as_is_all_files(cachefilesd_t)
Dan Walsh 3eaa99
Dan Walsh 3eaa99
# Allow access to cachefiles device file
Dan Walsh 3eaa99
allow cachefilesd_t cachefiles_dev_t : chr_file rw_file_perms;
Dan Walsh 3eaa99
Dan Walsh 3eaa99
# Allow access to cache superstructure
Dan Walsh 3eaa99
allow cachefilesd_t cachefiles_var_t : dir { rw_dir_perms rmdir };
Dan Walsh 3eaa99
allow cachefilesd_t cachefiles_var_t : file { getattr rename unlink };
Dan Walsh 3eaa99
Dan Walsh 3eaa99
# Permit statfs on the backing filesystem
Dan Walsh 3eaa99
fs_getattr_xattr_fs(cachefilesd_t)
Dan Walsh 3eaa99
Dan Walsh 3eaa99
###############################################################################
Dan Walsh 3eaa99
#
Dan Walsh 3eaa99
# When cachefilesd invokes the kernel module to begin caching, it has to tell
Dan Walsh 3eaa99
# the kernel module the security context in which it should act, and this
Dan Walsh 3eaa99
# policy has to approve that.
Dan Walsh 3eaa99
#
Dan Walsh 3eaa99
# There are two parts to this:
Dan Walsh 3eaa99
#
Dan Walsh 3eaa99
#   (1) the security context used by the module to access files in the cache,
Dan Walsh 3eaa99
#       as set by the 'secctx' command in /etc/cachefilesd.conf, and
Dan Walsh 3eaa99
#
Dan Walsh 3eaa99
allow cachefilesd_t cachefiles_kernel_t : kernel_service { use_as_override };
Dan Walsh 3eaa99
Dan Walsh 3eaa99
#
Dan Walsh 3eaa99
#   (2) the label that will be assigned to new files and directories created in
Dan Walsh 3eaa99
#       the cache by the module, which will be the same as the label on the
Dan Walsh 3eaa99
#       directory pointed to by the 'dir' command.
Dan Walsh 3eaa99
#
Dan Walsh 3eaa99
allow cachefilesd_t cachefiles_var_t : kernel_service { create_files_as };
Dan Walsh 3eaa99
Dan Walsh 3eaa99
###############################################################################
Dan Walsh 3eaa99
#
Dan Walsh 3eaa99
# cachefiles kernel module local policy
Dan Walsh 3eaa99
#
Dan Walsh 3eaa99
# This governs what the kernel module is allowed to do the contents of the
Dan Walsh 3eaa99
# cache.
Dan Walsh 3eaa99
#
Dan Walsh 3eaa99
allow cachefiles_kernel_t self:capability { dac_override dac_read_search };
Dan Walsh 3eaa99
allow cachefiles_kernel_t initrc_t:process sigchld;
Dan Walsh 3eaa99
Dan Walsh 3eaa99
manage_dirs_pattern(cachefiles_kernel_t,cachefiles_var_t, cachefiles_var_t)
Dan Walsh 3eaa99
manage_files_pattern(cachefiles_kernel_t,cachefiles_var_t, cachefiles_var_t)
Dan Walsh 3eaa99
Dan Walsh 3eaa99
fs_getattr_xattr_fs(cachefiles_kernel_t)
Dan Walsh 3eaa99
Dan Walsh 3eaa99
dev_search_sysfs(cachefiles_kernel_t)