## <summary>Policy for NIS (YP) servers and clients</summary>

########################################

## <summary>

##	Use the ypbind service to access NIS services

##	unconditionally.

## </summary>

## <desc>

##	

##	Use the ypbind service to access NIS services

##	unconditionally.

##	

##	

##	This interface was added because of apache and

##	spamassassin, to fix a nested conditionals problem.

##	When that support is added, this should be removed,

##	and the regular	interface should be used.

##	

## </desc>

## <param name="domain">

##	The type of the process performing this action.

## </param>

#

interface(`nis_use_ypbind_uncond',`

	gen_require(`

		type var_yp_t;

	')

	dontaudit $1 self:capability net_bind_service;

	allow $1 self:tcp_socket create_stream_socket_perms;

	allow $1 self:udp_socket create_socket_perms;

	allow $1 var_yp_t:dir r_dir_perms;

	allow $1 var_yp_t:lnk_file { getattr read };

	allow $1 var_yp_t:file r_file_perms;

	corenet_tcp_sendrecv_all_if($1)

	corenet_udp_sendrecv_all_if($1)

	corenet_raw_sendrecv_all_if($1)

	corenet_tcp_sendrecv_all_nodes($1)

	corenet_udp_sendrecv_all_nodes($1)

	corenet_raw_sendrecv_all_nodes($1)

	corenet_tcp_sendrecv_all_ports($1)

	corenet_udp_sendrecv_all_ports($1)

	corenet_non_ipsec_sendrecv($1)

	corenet_tcp_bind_all_nodes($1)

	corenet_udp_bind_all_nodes($1)

	corenet_tcp_bind_generic_port($1)

	corenet_udp_bind_generic_port($1)

	corenet_tcp_bind_reserved_port($1)

	corenet_udp_bind_reserved_port($1)

	corenet_dontaudit_tcp_bind_all_reserved_ports($1)

	corenet_dontaudit_udp_bind_all_reserved_ports($1)

	corenet_tcp_connect_portmap_port($1)

	corenet_tcp_connect_reserved_port($1)

	corenet_tcp_connect_generic_port($1)

	corenet_dontaudit_tcp_connect_all_reserved_ports($1)

	sysnet_read_config($1)

')

########################################

## <summary>

##	Use the ypbind service to access NIS services.

## </summary>

## <param name="domain">

##	The type of the process performing this action.

## </param>

#

interface(`nis_use_ypbind',`

	gen_require(`

		type var_yp_t;

	')

	tunable_policy(`allow_ypbind',`

		dontaudit $1 self:capability net_bind_service;

		allow $1 self:tcp_socket create_stream_socket_perms;

		allow $1 self:udp_socket create_socket_perms;

		allow $1 var_yp_t:dir r_dir_perms;

		allow $1 var_yp_t:lnk_file { getattr read };

		allow $1 var_yp_t:file r_file_perms;

		corenet_tcp_sendrecv_all_if($1)

		corenet_udp_sendrecv_all_if($1)

		corenet_raw_sendrecv_all_if($1)

		corenet_tcp_sendrecv_all_nodes($1)

		corenet_udp_sendrecv_all_nodes($1)

		corenet_raw_sendrecv_all_nodes($1)

		corenet_tcp_sendrecv_all_ports($1)

		corenet_udp_sendrecv_all_ports($1)

		corenet_non_ipsec_sendrecv($1)

		corenet_tcp_bind_all_nodes($1)

		corenet_udp_bind_all_nodes($1)

		corenet_tcp_bind_generic_port($1)

		corenet_udp_bind_generic_port($1)

		corenet_tcp_bind_reserved_port($1)

		corenet_udp_bind_reserved_port($1)

		corenet_dontaudit_tcp_bind_all_reserved_ports($1)

		corenet_dontaudit_udp_bind_all_reserved_ports($1)

		corenet_tcp_connect_portmap_port($1)

		corenet_tcp_connect_reserved_port($1)

		corenet_tcp_connect_generic_port($1)

		corenet_dontaudit_tcp_connect_all_reserved_ports($1)

		sysnet_read_config($1)

	',`

		dontaudit $1 var_yp_t:dir search;

	')

	optional_policy(`mount',`

		tunable_policy(`allow_ypbind',`

			mount_send_nfs_client_request($1)

		')

	')

')

########################################

## <summary>

##	Execute ypbind in the ypbind domain.

## </summary>

## <param name="domain">

##	Domain allowed access.

## </param>

#

interface(`nis_domtrans_ypbind',`

	gen_require(`

		type ypbind_t, ypbind_exec_t;

	')

	corecmd_search_bin($1)

	domain_auto_trans($1,ypbind_exec_t,ypbind_t)

	allow $1 ypbind_t:fd use;

	allow ypbind_t $1:fd use;

	allow ypbind_t $1:fifo_file rw_file_perms;

	allow ypbind_t $1:process sigchld;

')

########################################

## <summary>

##	Send generic signals to ypbind.

## </summary>

## <param name="domain">

##	The type of the process performing this action.

## </param>

#

interface(`nis_signal_ypbind',`

	gen_require(`

		type ypbind_t;

	')

	allow $1 ypbind_t:process signal;

')

########################################

## <summary>

##	List the contents of the NIS data directory.

## </summary>

## <param name="domain">

##	The type of the process performing this action.

## </param>

#

interface(`nis_list_var_yp',`

	gen_require(`

		type var_yp_t;

	')

	files_search_var($1)

	allow $1 var_yp_t:dir r_dir_perms;

')

########################################

## <summary>

##	Send UDP network traffic to NIS clients.

## </summary>

## <param name="domain">

##	The type of the process performing this action.

## </param>

#

interface(`nis_udp_sendto_ypbind',`

	gen_require(`

		type ypbind_t;

	')

	allow $1 ypbind_t:udp_socket sendto;

	allow ypbind_t $1:udp_socket recvfrom;

')

########################################

## <summary>

##	Connect to ypbind over TCP.

## </summary>

## <param name="domain">

##	Domain allowed access.

## </param>

#

interface(`nis_tcp_connect_ypbind',`

	gen_require(`

		type ypbind_t;

	')

	allow $1 ypbind_t:tcp_socket { connectto recvfrom };

	allow ypbind_t $1:tcp_socket { acceptfrom recvfrom };

	kernel_tcp_recvfrom($1)

')

########################################

## <summary>

##	Read ypbind pid files.

## </summary>

## <param name="domain">

##	Domain allowed access.

## </param>

#

interface(`nis_read_ypbind_pid',`

	gen_require(`

		type ypbind_var_run_t;

	')

	files_search_pids($1)

	allow $1 ypbind_var_run_t:file r_file_perms;

')

########################################

## <summary>

##	Delete ypbind pid files.

## </summary>

## <param name="domain">

##	Domain allowed access.

## </param>

#

interface(`nis_delete_ypbind_pid',`

	gen_require(`

		type ypbind_t;

	')

	# TODO: add delete pid from dir call to files

	allow $1 ypbind_t:file unlink;

')

########################################

## <summary>

##	Read ypserv configuration files.

## </summary>

## <param name="domain">

##	Domain allowed access.

## </param>

#

interface(`nis_read_ypserv_config',`

	gen_require(`

		type ypserv_conf_t;

	')

	files_search_etc($1)

	allow $1 ypserv_conf_t:file { getattr read };

')