|
Chris PeBenito |
493d6c |
#
|
|
Chris PeBenito |
493d6c |
|
|
Chris PeBenito |
493d6c |
|
|
Chris PeBenito |
493d6c |
#
|
|
Chris PeBenito |
493d6c |
#
|
|
Chris PeBenito |
493d6c |
#
|
|
Chris PeBenito |
493d6c |
#
|
|
Chris PeBenito |
493d6c |
#
|
|
Chris PeBenito |
493d6c |
#
|
|
Chris PeBenito |
493d6c |
#
|
|
Chris PeBenito |
493d6c |
interface(`nscd_domtrans',`
|
|
Chris PeBenito |
493d6c |
gen_require(`
|
|
Chris PeBenito |
493d6c |
type nscd_t, nscd_exec_t;
|
|
Chris PeBenito |
493d6c |
class process sigchld;
|
|
Chris PeBenito |
493d6c |
class fd use;
|
|
Chris PeBenito |
493d6c |
class fifo_file rw_file_perms;
|
|
Chris PeBenito |
493d6c |
')
|
|
Chris PeBenito |
493d6c |
|
|
Chris PeBenito |
493d6c |
corecmd_search_sbin($1)
|
|
Chris PeBenito |
493d6c |
domain_auto_trans($1,nscd_exec_t,nscd_t)
|
|
Chris PeBenito |
493d6c |
|
|
Chris PeBenito |
493d6c |
allow $1 nscd_t:fd use;
|
|
Chris PeBenito |
493d6c |
allow nscd_t $1:fd use;
|
|
Chris PeBenito |
493d6c |
allow nscd_t $1:fifo_file rw_file_perms;
|
|
Chris PeBenito |
493d6c |
allow nscd_t $1:process sigchld;
|
|
Chris PeBenito |
493d6c |
')
|
|
Chris PeBenito |
493d6c |
|
|
Chris PeBenito |
493d6c |
|
|
Chris PeBenito |
493d6c |
#
|
|
Chris PeBenito |
493d6c |
#
|
|
Chris PeBenito |
493d6c |
#
|
|
Chris PeBenito |
493d6c |
#
|
|
Chris PeBenito |
493d6c |
#
|
|
Chris PeBenito |
493d6c |
#
|
|
Chris PeBenito |
493d6c |
#
|
|
Chris PeBenito |
493d6c |
#
|
|
Chris PeBenito |
493d6c |
interface(`nscd_use_socket',`
|
|
Chris PeBenito |
493d6c |
gen_require(`
|
|
Chris PeBenito |
493d6c |
type nscd_t, nscd_var_run_t;
|
|
Chris PeBenito |
493d6c |
class fd use;
|
|
Chris PeBenito |
493d6c |
class nscd { getpwd getgrp gethost shmempwd shmemgrp shmemhost };
|
|
Chris PeBenito |
493d6c |
class unix_stream_socket { create_stream_socket_perms connectto };
|
|
Chris PeBenito |
493d6c |
class dir { search getattr };
|
|
Chris PeBenito |
493d6c |
class sock_file rw_file_perms;
|
|
Chris PeBenito |
493d6c |
class file { getattr read };
|
|
Chris PeBenito |
493d6c |
')
|
|
Chris PeBenito |
493d6c |
|
|
Chris PeBenito |
493d6c |
allow $1 self:unix_stream_socket create_stream_socket_perms;
|
|
Chris PeBenito |
493d6c |
|
|
Chris PeBenito |
493d6c |
allow $1 nscd_t:unix_stream_socket connectto;
|
|
Chris PeBenito |
493d6c |
allow $1 nscd_t:nscd { getpwd getgrp gethost };
|
|
Chris PeBenito |
493d6c |
dontaudit $1 nscd_t:fd use;
|
|
Chris PeBenito |
493d6c |
dontaudit $1 nscd_t:nscd { shmempwd shmemgrp shmemhost };
|
|
Chris PeBenito |
493d6c |
|
|
Chris PeBenito |
493d6c |
files_search_pids($1)
|
|
Chris PeBenito |
493d6c |
allow $1 nscd_var_run_t:sock_file rw_file_perms;
|
|
Chris PeBenito |
493d6c |
dontaudit $1 nscd_var_run_t:dir { search getattr };
|
|
Chris PeBenito |
493d6c |
dontaudit $1 nscd_var_run_t:file { getattr read };
|
|
Chris PeBenito |
493d6c |
')
|
|
Chris PeBenito |
493d6c |
|
|
Chris PeBenito |
493d6c |
|
|
Chris PeBenito |
493d6c |
#
|
|
Chris PeBenito |
493d6c |
#
|
|
Chris PeBenito |
493d6c |
#
|
|
Chris PeBenito |
493d6c |
#
|
|
Chris PeBenito |
493d6c |
#
|
|
Chris PeBenito |
493d6c |
#
|
|
Chris PeBenito |
493d6c |
#
|
|
Chris PeBenito |
493d6c |
#
|
|
Chris PeBenito |
493d6c |
interface(`nscd_use_shared_mem',`
|
|
Chris PeBenito |
493d6c |
gen_require(`
|
|
Chris PeBenito |
493d6c |
type nscd_t, nscd_var_run_t;
|
|
Chris PeBenito |
493d6c |
class fd use;
|
|
Chris PeBenito |
493d6c |
class nscd { getpwd getgrp gethost shmempwd shmemgrp shmemhost };
|
|
Chris PeBenito |
493d6c |
class unix_stream_socket { create_stream_socket_perms connectto };
|
|
Chris PeBenito |
493d6c |
class dir r_dir_perms;
|
|
Chris PeBenito |
493d6c |
class sock_file rw_file_perms;
|
|
Chris PeBenito |
493d6c |
class file { getattr read };
|
|
Chris PeBenito |
493d6c |
')
|
|
Chris PeBenito |
493d6c |
|
|
Chris PeBenito |
493d6c |
allow $1 nscd_var_run_t:dir r_dir_perms;
|
|
Chris PeBenito |
493d6c |
allow $1 nscd_t:nscd { shmempwd shmemgrp shmemhost };
|
|
Chris PeBenito |
493d6c |
|
|
Chris PeBenito |
493d6c |
# Receive fd from nscd and map the backing file with read access.
|
|
Chris PeBenito |
493d6c |
allow $1 nscd_t:fd use;
|
|
Chris PeBenito |
493d6c |
|
|
Chris PeBenito |
493d6c |
|
|
Chris PeBenito |
493d6c |
# nscd_socket_domain macro. need to investigate
|
|
Chris PeBenito |
493d6c |
|
|
Chris PeBenito |
493d6c |
allow $1 self:unix_stream_socket create_stream_socket_perms;
|
|
Chris PeBenito |
493d6c |
allow $1 nscd_t:unix_stream_socket connectto;
|
|
Chris PeBenito |
493d6c |
allow $1 nscd_var_run_t:sock_file rw_file_perms;
|
|
Chris PeBenito |
493d6c |
files_search_pids($1)
|
|
Chris PeBenito |
493d6c |
allow $1 nscd_t:nscd { getpwd getgrp gethost };
|
|
Chris PeBenito |
493d6c |
dontaudit $1 nscd_var_run_t:file { getattr read };
|
|
Chris PeBenito |
493d6c |
')
|
|
Chris PeBenito |
493d6c |
|
|
Chris PeBenito |
493d6c |
|
|
Chris PeBenito |
493d6c |
#
|
|
Chris PeBenito |
689f6d |
#
|
|
Chris PeBenito |
689f6d |
#
|
|
Chris PeBenito |
689f6d |
#
|
|
Chris PeBenito |
689f6d |
#
|
|
Chris PeBenito |
689f6d |
#
|
|
Chris PeBenito |
689f6d |
#
|
|
Chris PeBenito |
689f6d |
interface(`nscd_read_pid',`
|
|
Chris PeBenito |
689f6d |
gen_require(`
|
|
Chris PeBenito |
689f6d |
type nscd_var_run_t;
|
|
Chris PeBenito |
689f6d |
class dir search;
|
|
Chris PeBenito |
689f6d |
class file { getattr read };
|
|
Chris PeBenito |
689f6d |
')
|
|
Chris PeBenito |
689f6d |
|
|
Chris PeBenito |
689f6d |
files_search_pids($1)
|
|
Chris PeBenito |
689f6d |
allow $1 nscd_var_run_t:dir search;
|
|
Chris PeBenito |
689f6d |
allow $1 nscd_var_run_t:file { getattr read };
|
|
Chris PeBenito |
689f6d |
')
|
|
Chris PeBenito |
689f6d |
|
|
Chris PeBenito |
689f6d |
|
|
Chris PeBenito |
689f6d |
#
|
|
Chris PeBenito |
493d6c |
#
|
|
Chris PeBenito |
493d6c |
#
|
|
Chris PeBenito |
493d6c |
#
|
|
Chris PeBenito |
493d6c |
#
|
|
Chris PeBenito |
493d6c |
#
|
|
Chris PeBenito |
493d6c |
#
|
|
Chris PeBenito |
493d6c |
interface(`nscd_unconfined',`
|
|
Chris PeBenito |
493d6c |
gen_require(`
|
|
Chris PeBenito |
493d6c |
type nscd_t;
|
|
Chris PeBenito |
493d6c |
')
|
|
Chris PeBenito |
493d6c |
|
|
Chris PeBenito |
493d6c |
allow $1 nscd_t:nscd *;
|
|
Chris PeBenito |
493d6c |
')
|