Chris PeBenito 17de1b
## <summary>MIT Kerberos admin and KDC</summary>
Chris PeBenito 17de1b
## <desc>
Chris PeBenito 17de1b
##	

Chris PeBenito 17de1b
##	This policy supports:
Chris PeBenito 17de1b
##	

Chris PeBenito 17de1b
##	

Chris PeBenito 17de1b
##	Servers:
Chris PeBenito 17de1b
##	
    Chris PeBenito 17de1b
    ##		
  • kadmind
  • Chris PeBenito 17de1b
    ##		
  • krb5kdc
  • Chris PeBenito 17de1b
    ##	
    Chris PeBenito 17de1b
    ##	

    Chris PeBenito 17de1b
    ##	

    Chris PeBenito 17de1b
    ##	Clients:
    Chris PeBenito 17de1b
    ##	
      Chris PeBenito 17de1b
      ##		
    • kinit
    • Chris PeBenito 17de1b
      ##		
    • kdestroy
    • Chris PeBenito 17de1b
      ##		
    • klist
    • Chris PeBenito 17de1b
      ##		
    • ksu (incomplete)
    • Chris PeBenito 17de1b
      ##	
      Chris PeBenito 17de1b
      ##	

      Chris PeBenito 17de1b
      ## </desc>
      Chris PeBenito 17de1b
      Chris PeBenito 17de1b
      ########################################
      Chris PeBenito 17de1b
      ## <summary>
      Chris PeBenito 04d286
      ##	Execute kadmind in the current domain
      Chris PeBenito 04d286
      ## </summary>
      Chris PeBenito 04d286
      ## <param name="domain">
      Chris PeBenito 04d286
      ## <summary>
      Chris PeBenito 04d286
      ##	Domain allowed access.
      Chris PeBenito 04d286
      ## </summary>
      Chris PeBenito 04d286
      ## </param>
      Chris PeBenito 04d286
      #
      Chris PeBenito 04d286
      interface(`kerberos_exec_kadmind',`
      Chris PeBenito 04d286
      	gen_require(`
      Chris PeBenito 04d286
                      type kadmind_exec_t;
      Chris PeBenito 04d286
      	')
      Chris PeBenito 04d286
      Chris PeBenito 04d286
      	can_exec($1, kadmind_exec_t)
      Chris PeBenito 04d286
      ')
      Chris PeBenito 04d286
      Chris PeBenito 04d286
      ########################################
      Chris PeBenito 04d286
      ## <summary>
      Chris PeBenito 04d286
      ##	Execute a domain transition to run kpropd.
      Chris PeBenito 04d286
      ## </summary>
      Chris PeBenito 04d286
      ## <param name="domain">
      Chris PeBenito 04d286
      ## <summary>
      Chris PeBenito 04d286
      ##	Domain allowed to transition.
      Chris PeBenito 04d286
      ## </summary>
      Chris PeBenito 04d286
      ## </param>
      Chris PeBenito 04d286
      #
      Chris PeBenito 04d286
      interface(`kerberos_domtrans_kpropd',`
      Chris PeBenito 04d286
      	gen_require(`
      Chris PeBenito 04d286
      		type kpropd_t, kpropd_exec_t;
      Chris PeBenito 04d286
      	')
      Chris PeBenito 04d286
      Chris PeBenito 04d286
      	domtrans_pattern($1, kpropd_exec_t, kpropd_t)
      Chris PeBenito 04d286
      ')
      Chris PeBenito 04d286
      Chris PeBenito 04d286
      ########################################
      Chris PeBenito 04d286
      ## <summary>
      Chris PeBenito 17de1b
      ##	Use kerberos services
      Chris PeBenito 17de1b
      ## </summary>
      Chris PeBenito 17de1b
      ## <param name="domain">
      Chris PeBenito 17de1b
      ##	<summary>
      Chris PeBenito 17de1b
      ##	Domain allowed access.
      Chris PeBenito 17de1b
      ##	</summary>
      Chris PeBenito 17de1b
      ## </param>
      Chris PeBenito 17de1b
      #
      Chris PeBenito 17de1b
      interface(`kerberos_use',`
      Chris PeBenito 17de1b
      	gen_require(`
      Chris PeBenito 0bfccd
      		type krb5_conf_t, krb5kdc_conf_t;
      Chris PeBenito 17de1b
      	')
      Chris PeBenito 17de1b
      Chris PeBenito 17de1b
      	files_search_etc($1)
      Chris PeBenito 82d277
      	allow $1 krb5_conf_t:file read_file_perms;
      Chris PeBenito 17de1b
      	dontaudit $1 krb5_conf_t:file write;
      Chris PeBenito 6b19be
      	dontaudit $1 krb5kdc_conf_t:dir list_dir_perms;
      Chris PeBenito 5b0647
      	dontaudit $1 krb5kdc_conf_t:file rw_file_perms;
      Chris PeBenito 17de1b
      Chris PeBenito 04d286
      	#kerberos libraries are attempting to set the correct file context
      Chris PeBenito 04d286
      	dontaudit $1 self:process setfscreate;
      Chris PeBenito 04d286
      	selinux_dontaudit_validate_context($1)
      Chris PeBenito 04d286
      	seutil_dontaudit_read_file_contexts($1)
      Chris PeBenito 04d286
      Chris PeBenito 17de1b
      	tunable_policy(`allow_kerberos',`
      Chris PeBenito 17de1b
      		allow $1 self:tcp_socket create_socket_perms;
      Chris PeBenito 17de1b
      		allow $1 self:udp_socket create_socket_perms;
      Chris PeBenito 17de1b
      Chris PeBenito 190066
      		corenet_all_recvfrom_unlabeled($1)
      Chris PeBenito 190066
      		corenet_all_recvfrom_netlabel($1)
      Chris PeBenito 17de1b
      		corenet_tcp_sendrecv_all_if($1)
      Chris PeBenito 17de1b
      		corenet_udp_sendrecv_all_if($1)
      Chris PeBenito 17de1b
      		corenet_tcp_sendrecv_all_nodes($1)
      Chris PeBenito 17de1b
      		corenet_udp_sendrecv_all_nodes($1)
      Chris PeBenito 17de1b
      		corenet_tcp_sendrecv_kerberos_port($1)
      Chris PeBenito 17de1b
      		corenet_udp_sendrecv_kerberos_port($1)
      Chris PeBenito 17de1b
      		corenet_tcp_bind_all_nodes($1)
      Chris PeBenito 17de1b
      		corenet_udp_bind_all_nodes($1)
      Chris PeBenito 17de1b
      		corenet_tcp_connect_kerberos_port($1)
      Chris PeBenito d6d16b
      		corenet_tcp_connect_ocsp_port($1)
      Chris PeBenito 17de1b
      		corenet_sendrecv_kerberos_client_packets($1)
      Chris PeBenito d6d16b
      		corenet_sendrecv_ocsp_client_packets($1)
      Chris PeBenito 17de1b
      	')
      Chris PeBenito 6b19be
      Chris PeBenito 6b19be
      	optional_policy(`
      Chris PeBenito 6b19be
      		tunable_policy(`allow_kerberos',`
      Chris PeBenito 6b19be
      			pcscd_stream_connect($1)
      Chris PeBenito 6b19be
      		')
      Chris PeBenito 6b19be
      	')
      Chris PeBenito 17de1b
      ')
      Chris PeBenito 17de1b
      Chris PeBenito 17de1b
      ########################################
      Chris PeBenito 17de1b
      ## <summary>
      Chris PeBenito 17de1b
      ##	Read the kerberos configuration file (/etc/krb5.conf).
      Chris PeBenito 17de1b
      ## </summary>
      Chris PeBenito 17de1b
      ## <param name="domain">
      Chris PeBenito 17de1b
      ##	<summary>
      Chris PeBenito 17de1b
      ##	Domain allowed access.
      Chris PeBenito 17de1b
      ##	</summary>
      Chris PeBenito 17de1b
      ## </param>
      Chris PeBenito bbcd3c
      ## <rolecap/>
      Chris PeBenito 17de1b
      #
      Chris PeBenito 17de1b
      interface(`kerberos_read_config',`
      Chris PeBenito 17de1b
      	gen_require(`
      Chris PeBenito 17de1b
      		type krb5_conf_t;
      Chris PeBenito 17de1b
      	')
      Chris PeBenito 17de1b
      Chris PeBenito 17de1b
      	files_search_etc($1)
      Chris PeBenito c0868a
      	allow $1 krb5_conf_t:file read_file_perms;
      Chris PeBenito 17de1b
      ')
      Chris PeBenito 17de1b
      Chris PeBenito 17de1b
      ########################################
      Chris PeBenito 17de1b
      ## <summary>
      Chris PeBenito 17de1b
      ##	Do not audit attempts to write the kerberos
      Chris PeBenito 17de1b
      ##	configuration file (/etc/krb5.conf).
      Chris PeBenito 17de1b
      ## </summary>
      Chris PeBenito 17de1b
      ## <param name="domain">
      Chris PeBenito 17de1b
      ##	<summary>
      Chris PeBenito 17de1b
      ##	Domain to not audit.
      Chris PeBenito 17de1b
      ##	</summary>
      Chris PeBenito 17de1b
      ## </param>
      Chris PeBenito 17de1b
      #
      Chris PeBenito 17de1b
      interface(`kerberos_dontaudit_write_config',`
      Chris PeBenito 17de1b
      	gen_require(`
      Chris PeBenito 17de1b
      		type krb5_conf_t;
      Chris PeBenito 17de1b
      	')
      Chris PeBenito 17de1b
      Chris PeBenito 17de1b
      	dontaudit $1 krb5_conf_t:file write;
      Chris PeBenito 17de1b
      ')
      Chris PeBenito 17de1b
      Chris PeBenito 17de1b
      ########################################
      Chris PeBenito 17de1b
      ## <summary>
      Chris PeBenito 17de1b
      ##	Read and write the kerberos configuration file (/etc/krb5.conf).
      Chris PeBenito 17de1b
      ## </summary>
      Chris PeBenito 17de1b
      ## <param name="domain">
      Chris PeBenito 17de1b
      ##	<summary>
      Chris PeBenito 17de1b
      ##	Domain allowed access.
      Chris PeBenito 17de1b
      ##	</summary>
      Chris PeBenito 17de1b
      ## </param>
      Chris PeBenito bbcd3c
      ## <rolecap/>
      Chris PeBenito 17de1b
      #
      Chris PeBenito 17de1b
      interface(`kerberos_rw_config',`
      Chris PeBenito 17de1b
      	gen_require(`
      Chris PeBenito 17de1b
      		type krb5_conf_t;
      Chris PeBenito 17de1b
      	')
      Chris PeBenito 17de1b
      Chris PeBenito 17de1b
      	files_search_etc($1)
      Chris PeBenito 17de1b
      	allow $1 krb5_conf_t:file rw_file_perms;
      Chris PeBenito 17de1b
      ')
      Chris PeBenito 17de1b
      Chris PeBenito 17de1b
      ########################################
      Chris PeBenito 17de1b
      ## <summary>
      Chris PeBenito 17de1b
      ##	Read the kerberos key table.
      Chris PeBenito 17de1b
      ## </summary>
      Chris PeBenito 17de1b
      ## <param name="domain">
      Chris PeBenito 17de1b
      ##	<summary>
      Chris PeBenito 17de1b
      ##	Domain allowed access.
      Chris PeBenito 17de1b
      ##	</summary>
      Chris PeBenito 17de1b
      ## </param>
      Chris PeBenito bbcd3c
      ## <rolecap/>
      Chris PeBenito 17de1b
      #
      Chris PeBenito 17de1b
      interface(`kerberos_read_keytab',`
      Chris PeBenito 17de1b
      	gen_require(`
      Chris PeBenito 17de1b
      		type krb5_keytab_t;
      Chris PeBenito 17de1b
      	')
      Chris PeBenito 17de1b
      Chris PeBenito 17de1b
      	files_search_etc($1)
      Chris PeBenito c0868a
      	allow $1 krb5_keytab_t:file read_file_perms;
      Chris PeBenito 17de1b
      ')
      Chris PeBenito ebc1e8
      Chris PeBenito ebc1e8
      ########################################
      Chris PeBenito ebc1e8
      ## <summary>
      Chris PeBenito 04d286
      ##	Create a derived type for kerberos keytab
      Chris PeBenito 04d286
      ## </summary>
      Chris PeBenito 04d286
      ## <param name="prefix">
      Chris PeBenito 04d286
      ##	<summary>
      Chris PeBenito 04d286
      ##	The prefix to be used for deriving type names.
      Chris PeBenito 04d286
      ##	</summary>
      Chris PeBenito 04d286
      ## </param>
      Chris PeBenito 04d286
      ## <param name="domain">
      Chris PeBenito 04d286
      ##	<summary>
      Chris PeBenito 04d286
      ##	Domain allowed access.
      Chris PeBenito 04d286
      ##	</summary>
      Chris PeBenito 04d286
      ## </param>
      Chris PeBenito 04d286
      #
      Chris PeBenito 04d286
      template(`kerberos_keytab_template',`
      Chris PeBenito 04d286
      	type $1_keytab_t;
      Chris PeBenito 04d286
      	files_type($1_keytab_t)
      Chris PeBenito 04d286
      Chris PeBenito 04d286
       	allow $2 $1_keytab_t:file read_file_perms;
      Chris PeBenito 04d286
      Chris PeBenito 04d286
      	kerberos_read_keytab($2)
      Chris PeBenito 04d286
      	kerberos_use($2)
      Chris PeBenito 04d286
      ')
      Chris PeBenito 04d286
      Chris PeBenito 04d286
      ########################################
      Chris PeBenito 04d286
      ## <summary>
      Chris PeBenito ebc1e8
      ##	Read the kerberos kdc configuration file (/etc/krb5kdc.conf).
      Chris PeBenito ebc1e8
      ## </summary>
      Chris PeBenito ebc1e8
      ## <param name="domain">
      Chris PeBenito ebc1e8
      ##	<summary>
      Chris PeBenito ebc1e8
      ##	Domain allowed access.
      Chris PeBenito ebc1e8
      ##	</summary>
      Chris PeBenito ebc1e8
      ## </param>
      Chris PeBenito ebc1e8
      ## <rolecap/>
      Chris PeBenito ebc1e8
      #
      Chris PeBenito ebc1e8
      interface(`kerberos_read_kdc_config',`
      Chris PeBenito ebc1e8
      	gen_require(`
      Chris PeBenito ebc1e8
      		type krb5kdc_conf_t;
      Chris PeBenito ebc1e8
      	')
      Chris PeBenito ebc1e8
      Chris PeBenito ebc1e8
      	files_search_etc($1)
      Chris PeBenito 04d286
      	read_files_pattern($1, krb5kdc_conf_t,  krb5kdc_conf_t)
      Chris PeBenito 04d286
      ')
      Chris PeBenito 04d286
      Chris PeBenito 04d286
      ########################################
      Chris PeBenito 04d286
      ## <summary>
      Chris PeBenito 04d286
      ##	Read the kerberos kdc configuration file (/etc/krb5kdc.conf).
      Chris PeBenito 04d286
      ## </summary>
      Chris PeBenito 04d286
      ## <param name="domain">
      Chris PeBenito 04d286
      ##	<summary>
      Chris PeBenito 04d286
      ##	Domain allowed access.
      Chris PeBenito 04d286
      ##	</summary>
      Chris PeBenito 04d286
      ## </param>
      Chris PeBenito 04d286
      ## <rolecap/>
      Chris PeBenito 04d286
      #
      Chris PeBenito 04d286
      interface(`kerberos_manage_host_rcache',`
      Chris PeBenito 04d286
      	gen_require(`
      Chris PeBenito 04d286
      		type krb5_host_rcache_t;
      Chris PeBenito 04d286
      	')
      Chris PeBenito 04d286
      Chris PeBenito 04d286
      	# creates files as system_u no matter what the selinux user
      Chris PeBenito 04d286
      	# cjp: should be in the below tunable but typeattribute
      Chris PeBenito 04d286
      	# does not work in conditionals
      Chris PeBenito 04d286
      	domain_obj_id_change_exemption($1)
      Chris PeBenito 04d286
      Chris PeBenito 04d286
      	tunable_policy(`allow_kerberos',`
      Chris PeBenito 04d286
      		allow $1 self:process setfscreate;
      Chris PeBenito 04d286
      Chris PeBenito 04d286
      		selinux_validate_context($1)
      Chris PeBenito 04d286
      Chris PeBenito 04d286
      		seutil_read_file_contexts($1)
      Chris PeBenito 04d286
      Chris PeBenito 04d286
      		allow $1 krb5_host_rcache_t:file manage_file_perms;
      Chris PeBenito 04d286
      		files_search_tmp($1)
      Chris PeBenito 04d286
      	')
      Chris PeBenito 04d286
      ')
      Chris PeBenito 04d286
      Chris PeBenito 04d286
      ########################################
      Chris PeBenito 04d286
      ## <summary>
      Chris PeBenito 04d286
      ##	Connect to krb524 service
      Chris PeBenito 04d286
      ## </summary>
      Chris PeBenito 04d286
      ## <param name="domain">
      Chris PeBenito 04d286
      ##	<summary>
      Chris PeBenito 04d286
      ##	Domain allowed access.
      Chris PeBenito 04d286
      ##	</summary>
      Chris PeBenito 04d286
      ## </param>
      Chris PeBenito 04d286
      #
      Chris PeBenito 04d286
      interface(`kerberos_connect_524',`
      Chris PeBenito 04d286
      	tunable_policy(`allow_kerberos',`
      Chris PeBenito 04d286
      		allow $1 self:udp_socket create_socket_perms;
      Chris PeBenito 04d286
      Chris PeBenito 04d286
                      corenet_all_recvfrom_unlabeled($1)
      Chris PeBenito 04d286
      		corenet_udp_sendrecv_generic_if($1)
      Chris PeBenito 04d286
      		corenet_udp_sendrecv_all_nodes($1)
      Chris PeBenito 04d286
      		corenet_udp_sendrecv_kerberos_master_port($1)
      Chris PeBenito 04d286
      		corenet_sendrecv_kerberos_master_client_packets($1)
      Chris PeBenito 04d286
      	')
      Chris PeBenito 04d286
      ')
      Chris PeBenito 04d286
      Chris PeBenito 04d286
      ########################################
      Chris PeBenito 04d286
      ## <summary>
      Chris PeBenito 04d286
      ##	All of the rules required to administrate 
      Chris PeBenito 04d286
      ##	an kerberos environment
      Chris PeBenito 04d286
      ## </summary>
      Chris PeBenito 04d286
      ## <param name="domain">
      Chris PeBenito 04d286
      ##	<summary>
      Chris PeBenito 04d286
      ##	Domain allowed access.
      Chris PeBenito 04d286
      ##	</summary>
      Chris PeBenito 04d286
      ## </param>
      Chris PeBenito 04d286
      ## <param name="role">
      Chris PeBenito 04d286
      ##	<summary>
      Chris PeBenito 04d286
      ##	The role to be allowed to manage the kerberos domain.
      Chris PeBenito 04d286
      ##	</summary>
      Chris PeBenito 04d286
      ## </param>
      Chris PeBenito 04d286
      ## <rolecap/>
      Chris PeBenito 04d286
      #
      Chris PeBenito 04d286
      interface(`kerberos_admin',`
      Chris PeBenito 04d286
      	gen_require(`
      Chris PeBenito 04d286
      		type kadmind_t, krb5kdc_t, kerberos_initrc_exec_t;
      Chris PeBenito 04d286
      		type kadmind_log_t, kadmind_tmp_t, kadmind_var_run_t;
      Chris PeBenito 04d286
      		type krb5_conf_t, krb5_keytab_t, krb5kdc_conf_t;
      Chris PeBenito 04d286
      		type krb5kdc_principal_t, krb5kdc_tmp_t;
      Chris PeBenito 04d286
      		type krb5kdc_var_run_t, krb5_host_rcache_t;
      Chris PeBenito 06099d
      		type kpropd_t;
      Chris PeBenito 04d286
      	')
      Chris PeBenito 04d286
      Chris PeBenito 04d286
      	allow $1 kadmind_t:process { ptrace signal_perms };
      Chris PeBenito 04d286
      	ps_process_pattern($1, kadmind_t)
      Chris PeBenito 04d286
      Chris PeBenito 04d286
      	allow $1 krb5kdc_t:process { ptrace signal_perms };
      Chris PeBenito 04d286
      	ps_process_pattern($1, krb5kdc_t)
      Chris PeBenito 04d286
      Chris PeBenito 04d286
      	allow $1 kpropd_t:process { ptrace signal_perms };
      Chris PeBenito 04d286
      	ps_process_pattern($1, kpropd_t)
      Chris PeBenito 04d286
      Chris PeBenito 04d286
      	init_labeled_script_domtrans($1, kerberos_initrc_exec_t)
      Chris PeBenito 04d286
      	domain_system_change_exemption($1)
      Chris PeBenito 04d286
      	role_transition $2 kerberos_initrc_exec_t system_r;
      Chris PeBenito 04d286
      	allow $2 system_r;
      Chris PeBenito 04d286
      Chris PeBenito 04d286
      	logging_list_logs($1)
      Chris PeBenito 04d286
      	admin_pattern($1, kadmind_log_t)
      Chris PeBenito 04d286
      Chris PeBenito 04d286
      	files_list_tmp($1)
      Chris PeBenito 04d286
      	admin_pattern($1, kadmind_tmp_t)
      Chris PeBenito 04d286
      Chris PeBenito 04d286
      	files_list_pids($1)
      Chris PeBenito 04d286
      	admin_pattern($1, kadmind_var_run_t)
      Chris PeBenito 04d286
      Chris PeBenito 04d286
      	admin_pattern($1, krb5_conf_t)
      Chris PeBenito 04d286
      Chris PeBenito 04d286
      	admin_pattern($1, krb5_host_rcache_t)
      Chris PeBenito 04d286
      Chris PeBenito 04d286
      	admin_pattern($1, krb5_keytab_t)
      Chris PeBenito 04d286
      Chris PeBenito 04d286
      	admin_pattern($1, krb5kdc_principal_t)
      Chris PeBenito 04d286
      Chris PeBenito 04d286
      	admin_pattern($1, krb5kdc_tmp_t)
      Chris PeBenito ebc1e8
      Chris PeBenito 04d286
      	admin_pattern($1, krb5kdc_var_run_t)
      Chris PeBenito ebc1e8
      ')