|
Chris PeBenito |
17de1b |
## <summary>Policy for NIS (YP) servers and clients</summary>
|
|
Chris PeBenito |
17de1b |
|
|
Chris PeBenito |
17de1b |
########################################
|
|
Chris PeBenito |
17de1b |
## <summary>
|
|
Chris PeBenito |
17de1b |
## Use the ypbind service to access NIS services
|
|
Chris PeBenito |
17de1b |
## unconditionally.
|
|
Chris PeBenito |
17de1b |
## </summary>
|
|
Chris PeBenito |
17de1b |
## <desc>
|
|
Chris PeBenito |
17de1b |
##
|
|
Chris PeBenito |
17de1b |
## Use the ypbind service to access NIS services
|
|
Chris PeBenito |
17de1b |
## unconditionally.
|
|
Chris PeBenito |
17de1b |
##
|
|
Chris PeBenito |
17de1b |
##
|
|
Chris PeBenito |
17de1b |
## This interface was added because of apache and
|
|
Chris PeBenito |
17de1b |
## spamassassin, to fix a nested conditionals problem.
|
|
Chris PeBenito |
17de1b |
## When that support is added, this should be removed,
|
|
Chris PeBenito |
17de1b |
## and the regular interface should be used.
|
|
Chris PeBenito |
17de1b |
##
|
|
Chris PeBenito |
17de1b |
## </desc>
|
|
Chris PeBenito |
17de1b |
## <param name="domain">
|
|
Chris PeBenito |
17de1b |
## <summary>
|
|
Chris PeBenito |
17de1b |
## The type of the process performing this action.
|
|
Chris PeBenito |
17de1b |
## </summary>
|
|
Chris PeBenito |
17de1b |
## </param>
|
|
Chris PeBenito |
17de1b |
#
|
|
Chris PeBenito |
17de1b |
interface(`nis_use_ypbind_uncond',`
|
|
Chris PeBenito |
17de1b |
gen_require(`
|
|
Chris PeBenito |
17de1b |
type var_yp_t;
|
|
Chris PeBenito |
17de1b |
')
|
|
Chris PeBenito |
17de1b |
|
|
Chris PeBenito |
17de1b |
dontaudit $1 self:capability net_bind_service;
|
|
Chris PeBenito |
17de1b |
|
|
Chris PeBenito |
17de1b |
allow $1 self:tcp_socket create_stream_socket_perms;
|
|
Chris PeBenito |
17de1b |
allow $1 self:udp_socket create_socket_perms;
|
|
Chris PeBenito |
17de1b |
|
|
Chris PeBenito |
17de1b |
allow $1 var_yp_t:dir r_dir_perms;
|
|
Chris PeBenito |
17de1b |
allow $1 var_yp_t:lnk_file { getattr read };
|
|
Chris PeBenito |
17de1b |
allow $1 var_yp_t:file r_file_perms;
|
|
Chris PeBenito |
17de1b |
|
|
Chris PeBenito |
17de1b |
corenet_non_ipsec_sendrecv($1)
|
|
Chris PeBenito |
17de1b |
corenet_tcp_sendrecv_all_if($1)
|
|
Chris PeBenito |
17de1b |
corenet_udp_sendrecv_all_if($1)
|
|
Chris PeBenito |
17de1b |
corenet_tcp_sendrecv_all_nodes($1)
|
|
Chris PeBenito |
17de1b |
corenet_udp_sendrecv_all_nodes($1)
|
|
Chris PeBenito |
17de1b |
corenet_tcp_sendrecv_all_ports($1)
|
|
Chris PeBenito |
17de1b |
corenet_udp_sendrecv_all_ports($1)
|
|
Chris PeBenito |
17de1b |
corenet_tcp_bind_all_nodes($1)
|
|
Chris PeBenito |
17de1b |
corenet_udp_bind_all_nodes($1)
|
|
Chris PeBenito |
17de1b |
corenet_tcp_bind_generic_port($1)
|
|
Chris PeBenito |
17de1b |
corenet_udp_bind_generic_port($1)
|
|
Chris PeBenito |
17de1b |
corenet_tcp_bind_reserved_port($1)
|
|
Chris PeBenito |
17de1b |
corenet_udp_bind_reserved_port($1)
|
|
Chris PeBenito |
17de1b |
corenet_dontaudit_tcp_bind_all_reserved_ports($1)
|
|
Chris PeBenito |
17de1b |
corenet_dontaudit_udp_bind_all_reserved_ports($1)
|
|
Chris PeBenito |
17de1b |
corenet_tcp_connect_portmap_port($1)
|
|
Chris PeBenito |
17de1b |
corenet_tcp_connect_reserved_port($1)
|
|
Chris PeBenito |
17de1b |
corenet_tcp_connect_generic_port($1)
|
|
Chris PeBenito |
17de1b |
corenet_dontaudit_tcp_connect_all_reserved_ports($1)
|
|
Chris PeBenito |
17de1b |
corenet_sendrecv_portmap_client_packets($1)
|
|
Chris PeBenito |
17de1b |
corenet_sendrecv_generic_client_packets($1)
|
|
Chris PeBenito |
17de1b |
corenet_sendrecv_generic_server_packets($1)
|
|
Chris PeBenito |
17de1b |
|
|
Chris PeBenito |
17de1b |
sysnet_read_config($1)
|
|
Chris PeBenito |
17de1b |
')
|
|
Chris PeBenito |
17de1b |
|
|
Chris PeBenito |
17de1b |
########################################
|
|
Chris PeBenito |
17de1b |
## <summary>
|
|
Chris PeBenito |
17de1b |
## Use the ypbind service to access NIS services.
|
|
Chris PeBenito |
17de1b |
## </summary>
|
|
Chris PeBenito |
17de1b |
## <param name="domain">
|
|
Chris PeBenito |
17de1b |
## <summary>
|
|
Chris PeBenito |
17de1b |
## The type of the process performing this action.
|
|
Chris PeBenito |
17de1b |
## </summary>
|
|
Chris PeBenito |
17de1b |
## </param>
|
|
Chris PeBenito |
bbcd3c |
## <rolecap/>
|
|
Chris PeBenito |
17de1b |
#
|
|
Chris PeBenito |
17de1b |
interface(`nis_use_ypbind',`
|
|
Chris PeBenito |
17de1b |
gen_require(`
|
|
Chris PeBenito |
17de1b |
type var_yp_t;
|
|
Chris PeBenito |
17de1b |
')
|
|
Chris PeBenito |
17de1b |
|
|
Chris PeBenito |
17de1b |
tunable_policy(`allow_ypbind',`
|
|
Chris PeBenito |
17de1b |
nis_use_ypbind_uncond($1)
|
|
Chris PeBenito |
17de1b |
',`
|
|
Chris PeBenito |
17de1b |
dontaudit $1 var_yp_t:dir search;
|
|
Chris PeBenito |
17de1b |
')
|
|
Chris PeBenito |
17de1b |
')
|
|
Chris PeBenito |
17de1b |
|
|
Chris PeBenito |
17de1b |
########################################
|
|
Chris PeBenito |
17de1b |
## <summary>
|
|
Chris PeBenito |
17de1b |
## Execute ypbind in the ypbind domain.
|
|
Chris PeBenito |
17de1b |
## </summary>
|
|
Chris PeBenito |
17de1b |
## <param name="domain">
|
|
Chris PeBenito |
17de1b |
## <summary>
|
|
Chris PeBenito |
17de1b |
## Domain allowed access.
|
|
Chris PeBenito |
17de1b |
## </summary>
|
|
Chris PeBenito |
17de1b |
## </param>
|
|
Chris PeBenito |
17de1b |
#
|
|
Chris PeBenito |
17de1b |
interface(`nis_domtrans_ypbind',`
|
|
Chris PeBenito |
17de1b |
gen_require(`
|
|
Chris PeBenito |
17de1b |
type ypbind_t, ypbind_exec_t;
|
|
Chris PeBenito |
17de1b |
')
|
|
Chris PeBenito |
17de1b |
|
|
Chris PeBenito |
17de1b |
corecmd_search_bin($1)
|
|
Chris PeBenito |
17de1b |
domain_auto_trans($1,ypbind_exec_t,ypbind_t)
|
|
Chris PeBenito |
17de1b |
|
|
Chris PeBenito |
17de1b |
allow $1 ypbind_t:fd use;
|
|
Chris PeBenito |
17de1b |
allow ypbind_t $1:fd use;
|
|
Chris PeBenito |
17de1b |
allow ypbind_t $1:fifo_file rw_file_perms;
|
|
Chris PeBenito |
17de1b |
allow ypbind_t $1:process sigchld;
|
|
Chris PeBenito |
17de1b |
')
|
|
Chris PeBenito |
17de1b |
|
|
Chris PeBenito |
17de1b |
########################################
|
|
Chris PeBenito |
17de1b |
## <summary>
|
|
Chris PeBenito |
17de1b |
## Send generic signals to ypbind.
|
|
Chris PeBenito |
17de1b |
## </summary>
|
|
Chris PeBenito |
17de1b |
## <param name="domain">
|
|
Chris PeBenito |
17de1b |
## <summary>
|
|
Chris PeBenito |
17de1b |
## The type of the process performing this action.
|
|
Chris PeBenito |
17de1b |
## </summary>
|
|
Chris PeBenito |
17de1b |
## </param>
|
|
Chris PeBenito |
17de1b |
#
|
|
Chris PeBenito |
17de1b |
interface(`nis_signal_ypbind',`
|
|
Chris PeBenito |
17de1b |
gen_require(`
|
|
Chris PeBenito |
17de1b |
type ypbind_t;
|
|
Chris PeBenito |
17de1b |
')
|
|
Chris PeBenito |
17de1b |
|
|
Chris PeBenito |
17de1b |
allow $1 ypbind_t:process signal;
|
|
Chris PeBenito |
17de1b |
')
|
|
Chris PeBenito |
17de1b |
|
|
Chris PeBenito |
17de1b |
########################################
|
|
Chris PeBenito |
17de1b |
## <summary>
|
|
Chris PeBenito |
17de1b |
## List the contents of the NIS data directory.
|
|
Chris PeBenito |
17de1b |
## </summary>
|
|
Chris PeBenito |
17de1b |
## <param name="domain">
|
|
Chris PeBenito |
17de1b |
## <summary>
|
|
Chris PeBenito |
17de1b |
## The type of the process performing this action.
|
|
Chris PeBenito |
17de1b |
## </summary>
|
|
Chris PeBenito |
17de1b |
## </param>
|
|
Chris PeBenito |
17de1b |
#
|
|
Chris PeBenito |
17de1b |
interface(`nis_list_var_yp',`
|
|
Chris PeBenito |
17de1b |
gen_require(`
|
|
Chris PeBenito |
17de1b |
type var_yp_t;
|
|
Chris PeBenito |
17de1b |
')
|
|
Chris PeBenito |
17de1b |
|
|
Chris PeBenito |
17de1b |
files_search_var($1)
|
|
Chris PeBenito |
17de1b |
allow $1 var_yp_t:dir r_dir_perms;
|
|
Chris PeBenito |
17de1b |
')
|
|
Chris PeBenito |
17de1b |
|
|
Chris PeBenito |
17de1b |
########################################
|
|
Chris PeBenito |
17de1b |
## <summary>
|
|
Chris PeBenito |
33c7e6 |
## Send UDP network traffic to NIS clients. (Deprecated)
|
|
Chris PeBenito |
17de1b |
## </summary>
|
|
Chris PeBenito |
17de1b |
## <param name="domain">
|
|
Chris PeBenito |
17de1b |
## <summary>
|
|
Chris PeBenito |
17de1b |
## The type of the process performing this action.
|
|
Chris PeBenito |
17de1b |
## </summary>
|
|
Chris PeBenito |
17de1b |
## </param>
|
|
Chris PeBenito |
17de1b |
#
|
|
Chris PeBenito |
17de1b |
interface(`nis_udp_send_ypbind',`
|
|
Chris PeBenito |
33c7e6 |
refpolicywarn(`$0($*) has been deprecated.')
|
|
Chris PeBenito |
17de1b |
')
|
|
Chris PeBenito |
17de1b |
|
|
Chris PeBenito |
17de1b |
########################################
|
|
Chris PeBenito |
17de1b |
## <summary>
|
|
Chris PeBenito |
33c7e6 |
## Connect to ypbind over TCP. (Deprecated)
|
|
Chris PeBenito |
17de1b |
## </summary>
|
|
Chris PeBenito |
17de1b |
## <param name="domain">
|
|
Chris PeBenito |
17de1b |
## <summary>
|
|
Chris PeBenito |
17de1b |
## Domain allowed access.
|
|
Chris PeBenito |
17de1b |
## </summary>
|
|
Chris PeBenito |
17de1b |
## </param>
|
|
Chris PeBenito |
17de1b |
#
|
|
Chris PeBenito |
17de1b |
interface(`nis_tcp_connect_ypbind',`
|
|
Chris PeBenito |
33c7e6 |
refpolicywarn(`$0($*) has been deprecated.')
|
|
Chris PeBenito |
17de1b |
')
|
|
Chris PeBenito |
17de1b |
|
|
Chris PeBenito |
17de1b |
########################################
|
|
Chris PeBenito |
17de1b |
## <summary>
|
|
Chris PeBenito |
17de1b |
## Read ypbind pid files.
|
|
Chris PeBenito |
17de1b |
## </summary>
|
|
Chris PeBenito |
17de1b |
## <param name="domain">
|
|
Chris PeBenito |
17de1b |
## <summary>
|
|
Chris PeBenito |
17de1b |
## Domain allowed access.
|
|
Chris PeBenito |
17de1b |
## </summary>
|
|
Chris PeBenito |
17de1b |
## </param>
|
|
Chris PeBenito |
17de1b |
#
|
|
Chris PeBenito |
17de1b |
interface(`nis_read_ypbind_pid',`
|
|
Chris PeBenito |
17de1b |
gen_require(`
|
|
Chris PeBenito |
17de1b |
type ypbind_var_run_t;
|
|
Chris PeBenito |
17de1b |
')
|
|
Chris PeBenito |
17de1b |
|
|
Chris PeBenito |
17de1b |
files_search_pids($1)
|
|
Chris PeBenito |
17de1b |
allow $1 ypbind_var_run_t:file r_file_perms;
|
|
Chris PeBenito |
17de1b |
')
|
|
Chris PeBenito |
17de1b |
|
|
Chris PeBenito |
17de1b |
########################################
|
|
Chris PeBenito |
17de1b |
## <summary>
|
|
Chris PeBenito |
17de1b |
## Delete ypbind pid files.
|
|
Chris PeBenito |
17de1b |
## </summary>
|
|
Chris PeBenito |
17de1b |
## <param name="domain">
|
|
Chris PeBenito |
17de1b |
## <summary>
|
|
Chris PeBenito |
17de1b |
## Domain allowed access.
|
|
Chris PeBenito |
17de1b |
## </summary>
|
|
Chris PeBenito |
17de1b |
## </param>
|
|
Chris PeBenito |
17de1b |
#
|
|
Chris PeBenito |
17de1b |
interface(`nis_delete_ypbind_pid',`
|
|
Chris PeBenito |
17de1b |
gen_require(`
|
|
Chris PeBenito |
17de1b |
type ypbind_t;
|
|
Chris PeBenito |
17de1b |
')
|
|
Chris PeBenito |
17de1b |
|
|
Chris PeBenito |
17de1b |
# TODO: add delete pid from dir call to files
|
|
Chris PeBenito |
17de1b |
allow $1 ypbind_t:file unlink;
|
|
Chris PeBenito |
17de1b |
')
|
|
Chris PeBenito |
17de1b |
|
|
Chris PeBenito |
17de1b |
########################################
|
|
Chris PeBenito |
17de1b |
## <summary>
|
|
Chris PeBenito |
17de1b |
## Read ypserv configuration files.
|
|
Chris PeBenito |
17de1b |
## </summary>
|
|
Chris PeBenito |
17de1b |
## <param name="domain">
|
|
Chris PeBenito |
17de1b |
## <summary>
|
|
Chris PeBenito |
17de1b |
## Domain allowed access.
|
|
Chris PeBenito |
17de1b |
## </summary>
|
|
Chris PeBenito |
17de1b |
## </param>
|
|
Chris PeBenito |
17de1b |
#
|
|
Chris PeBenito |
17de1b |
interface(`nis_read_ypserv_config',`
|
|
Chris PeBenito |
17de1b |
gen_require(`
|
|
Chris PeBenito |
17de1b |
type ypserv_conf_t;
|
|
Chris PeBenito |
17de1b |
')
|
|
Chris PeBenito |
17de1b |
|
|
Chris PeBenito |
17de1b |
files_search_etc($1)
|
|
Chris PeBenito |
17de1b |
allow $1 ypserv_conf_t:file { getattr read };
|
|
Chris PeBenito |
17de1b |
')
|
|
Chris PeBenito |
17de1b |
|
|
Chris PeBenito |
17de1b |
########################################
|
|
Chris PeBenito |
17de1b |
## <summary>
|
|
Chris PeBenito |
17de1b |
## Execute ypxfr in the ypxfr domain.
|
|
Chris PeBenito |
17de1b |
## </summary>
|
|
Chris PeBenito |
17de1b |
## <param name="domain">
|
|
Chris PeBenito |
17de1b |
## <summary>
|
|
Chris PeBenito |
17de1b |
## Domain allowed access.
|
|
Chris PeBenito |
17de1b |
## </summary>
|
|
Chris PeBenito |
17de1b |
## </param>
|
|
Chris PeBenito |
17de1b |
#
|
|
Chris PeBenito |
17de1b |
interface(`nis_domtrans_ypxfr',`
|
|
Chris PeBenito |
17de1b |
gen_require(`
|
|
Chris PeBenito |
17de1b |
type ypxfr_t, ypxfr_exec_t;
|
|
Chris PeBenito |
17de1b |
')
|
|
Chris PeBenito |
17de1b |
|
|
Chris PeBenito |
17de1b |
corecmd_search_bin($1)
|
|
Chris PeBenito |
d6d16b |
corecmd_search_sbin($1)
|
|
Chris PeBenito |
17de1b |
domain_auto_trans($1,ypxfr_exec_t,ypxfr_t)
|
|
Chris PeBenito |
17de1b |
|
|
Chris PeBenito |
17de1b |
allow ypxfr_t $1:fd use;
|
|
Chris PeBenito |
17de1b |
allow ypxfr_t $1:fifo_file rw_file_perms;
|
|
Chris PeBenito |
17de1b |
allow ypxfr_t $1:process sigchld;
|
|
Chris PeBenito |
17de1b |
')
|