Chris PeBenito eb3cb6
Chris PeBenito eb3cb6
policy_module(portmap,1.0)
Chris PeBenito eb3cb6
Chris PeBenito eb3cb6
########################################
Chris PeBenito eb3cb6
#
Chris PeBenito eb3cb6
# Declarations
Chris PeBenito eb3cb6
#
Chris PeBenito eb3cb6
Chris PeBenito eb3cb6
type portmap_t;
Chris PeBenito eb3cb6
type portmap_exec_t;
Chris PeBenito eb3cb6
init_daemon_domain(portmap_t,portmap_exec_t)
Chris PeBenito eb3cb6
Chris PeBenito eb3cb6
type portmap_helper_t;
Chris PeBenito eb3cb6
type portmap_helper_exec_t;
Chris PeBenito eb3cb6
init_system_domain(portmap_helper_t,portmap_helper_exec_t)
Chris PeBenito eb3cb6
role system_r types portmap_helper_t;
Chris PeBenito eb3cb6
Chris PeBenito eb3cb6
type portmap_tmp_t;
Chris PeBenito eb3cb6
files_tmp_file(portmap_tmp_t)
Chris PeBenito eb3cb6
Chris PeBenito eb3cb6
type portmap_var_run_t;
Chris PeBenito eb3cb6
files_pid_file(portmap_var_run_t)
Chris PeBenito eb3cb6
Chris PeBenito eb3cb6
########################################
Chris PeBenito eb3cb6
#
Chris PeBenito eb3cb6
# Portmap local policy
Chris PeBenito eb3cb6
#
Chris PeBenito eb3cb6
Chris PeBenito eb3cb6
allow portmap_t self:capability { setuid setgid };
Chris PeBenito eb3cb6
dontaudit portmap_t self:capability sys_tty_config;
Chris PeBenito eb3cb6
allow portmap_t self:netlink_route_socket r_netlink_socket_perms;
Chris PeBenito eb3cb6
allow portmap_t self:unix_dgram_socket create_socket_perms;
Chris PeBenito eb3cb6
allow portmap_t self:unix_stream_socket create_stream_socket_perms;
Chris PeBenito eb3cb6
allow portmap_t self:tcp_socket create_stream_socket_perms;
Chris PeBenito eb3cb6
allow portmap_t self:udp_socket create_socket_perms;
Chris PeBenito eb3cb6
Chris PeBenito eb3cb6
allow portmap_t portmap_tmp_t:dir create_dir_perms;
Chris PeBenito eb3cb6
allow portmap_t portmap_tmp_t:file create_file_perms;
Chris PeBenito eb3cb6
files_create_tmp_files(portmap_t, portmap_tmp_t, { file dir })
Chris PeBenito eb3cb6
Chris PeBenito eb3cb6
allow portmap_t portmap_var_run_t:file create_file_perms;
Chris PeBenito eb3cb6
files_create_pid(portmap_t,portmap_var_run_t)
Chris PeBenito eb3cb6
Chris PeBenito eb3cb6
kernel_read_kernel_sysctl(portmap_t)
Chris PeBenito eb3cb6
kernel_list_proc(portmap_t)
Chris PeBenito eb3cb6
kernel_read_proc_symlinks(portmap_t)
Chris PeBenito 712566
kernel_udp_sendfrom(portmap_t)
Chris PeBenito eb3cb6
Chris PeBenito eb3cb6
corenet_tcp_sendrecv_all_if(portmap_t)
Chris PeBenito eb3cb6
corenet_udp_sendrecv_all_if(portmap_t)
Chris PeBenito eb3cb6
corenet_raw_sendrecv_all_if(portmap_t)
Chris PeBenito eb3cb6
corenet_tcp_sendrecv_all_nodes(portmap_t)
Chris PeBenito eb3cb6
corenet_udp_sendrecv_all_nodes(portmap_t)
Chris PeBenito eb3cb6
corenet_raw_sendrecv_all_nodes(portmap_t)
Chris PeBenito eb3cb6
corenet_tcp_sendrecv_all_ports(portmap_t)
Chris PeBenito eb3cb6
corenet_udp_sendrecv_all_ports(portmap_t)
Chris PeBenito eb3cb6
corenet_tcp_bind_all_nodes(portmap_t)
Chris PeBenito eb3cb6
corenet_udp_bind_all_nodes(portmap_t)
Chris PeBenito eb3cb6
corenet_tcp_bind_portmap_port(portmap_t)
Chris PeBenito eb3cb6
corenet_udp_bind_portmap_port(portmap_t)
Chris PeBenito 0907bd
corenet_tcp_connect_all_ports(portmap_t)
Chris PeBenito eb3cb6
# portmap binds to arbitary ports
Chris PeBenito eb3cb6
corenet_tcp_bind_generic_port(portmap_t)
Chris PeBenito eb3cb6
corenet_udp_bind_generic_port(portmap_t)
Chris PeBenito eb3cb6
corenet_tcp_bind_reserved_port(portmap_t)
Chris PeBenito eb3cb6
corenet_udp_bind_reserved_port(portmap_t)
Chris PeBenito eb3cb6
corenet_dontaudit_tcp_bind_all_reserved_ports(portmap_t)
Chris PeBenito eb3cb6
corenet_dontaudit_udp_bind_all_reserved_ports(portmap_t)
Chris PeBenito eb3cb6
Chris PeBenito eb3cb6
dev_read_sysfs(portmap_t)
Chris PeBenito eb3cb6
Chris PeBenito eb3cb6
fs_getattr_all_fs(portmap_t)
Chris PeBenito eb3cb6
fs_search_auto_mountpoints(portmap_t)
Chris PeBenito eb3cb6
Chris PeBenito eb3cb6
term_dontaudit_use_console(portmap_t)
Chris PeBenito eb3cb6
Chris PeBenito eb3cb6
domain_use_wide_inherit_fd(portmap_t)
Chris PeBenito eb3cb6
Chris PeBenito eb3cb6
files_read_etc_files(portmap_t)
Chris PeBenito eb3cb6
Chris PeBenito eb3cb6
init_use_fd(portmap_t)
Chris PeBenito eb3cb6
init_use_script_pty(portmap_t)
Chris PeBenito eb3cb6
init_udp_sendto(portmap_t)
Chris PeBenito eb3cb6
init_udp_sendto_script(portmap_t)
Chris PeBenito eb3cb6
Chris PeBenito eb3cb6
libs_use_ld_so(portmap_t)
Chris PeBenito eb3cb6
libs_use_shared_libs(portmap_t)
Chris PeBenito eb3cb6
Chris PeBenito eb3cb6
logging_send_syslog_msg(portmap_t)
Chris PeBenito eb3cb6
Chris PeBenito eb3cb6
miscfiles_read_localization(portmap_t)
Chris PeBenito eb3cb6
Chris PeBenito eb3cb6
sysnet_read_config(portmap_t)
Chris PeBenito eb3cb6
Chris PeBenito eb3cb6
userdom_dontaudit_use_unpriv_user_fd(portmap_t)
Chris PeBenito eb3cb6
userdom_dontaudit_search_sysadm_home_dir(portmap_t)
Chris PeBenito eb3cb6
Chris PeBenito eb3cb6
ifdef(`targeted_policy', `
Chris PeBenito eb3cb6
	term_dontaudit_use_unallocated_tty(portmap_t)
Chris PeBenito eb3cb6
	term_dontaudit_use_generic_pty(portmap_t)
Chris PeBenito eb3cb6
	files_dontaudit_read_root_file(portmap_t)
Chris PeBenito eb3cb6
')
Chris PeBenito eb3cb6
Chris PeBenito eb3cb6
optional_policy(`inetd.te',`
Chris PeBenito eb3cb6
	inetd_udp_sendto(portmap_t)
Chris PeBenito eb3cb6
')
Chris PeBenito eb3cb6
Chris PeBenito eb3cb6
optional_policy(`mount.te',`
Chris PeBenito eb3cb6
	mount_send_nfs_client_request(portmap_t)
Chris PeBenito eb3cb6
')
Chris PeBenito eb3cb6
Chris PeBenito eb3cb6
optional_policy(`nis.te',`
Chris PeBenito eb3cb6
	nis_use_ypbind(portmap_t)
Chris PeBenito eb3cb6
	nis_udp_sendto_ypbind(portmap_t)
Chris PeBenito eb3cb6
')
Chris PeBenito eb3cb6
Chris PeBenito eb3cb6
optional_policy(`nscd.te',`
Chris PeBenito eb3cb6
	nscd_use_socket(portmap_t)
Chris PeBenito eb3cb6
')
Chris PeBenito eb3cb6
Chris PeBenito eb3cb6
optional_policy(`selinuxutil.te',`
Chris PeBenito eb3cb6
	seutil_sigchld_newrole(portmap_t)
Chris PeBenito eb3cb6
')
Chris PeBenito eb3cb6
Chris PeBenito eb3cb6
optional_policy(`udev.te', `
Chris PeBenito eb3cb6
	udev_read_db(portmap_t)
Chris PeBenito eb3cb6
')
Chris PeBenito eb3cb6
Chris PeBenito eb3cb6
ifdef(`TODO',`
Chris PeBenito eb3cb6
optional_policy(`rhgb.te',`
Chris PeBenito eb3cb6
	rhgb_domain(portmap_t)
Chris PeBenito eb3cb6
')
Chris PeBenito eb3cb6
Chris PeBenito eb3cb6
ifdef(`rpcd.te',`can_udp_send(portmap_t, rpcd_t)')
Chris PeBenito eb3cb6
allow portmap_t rpcd_t:udp_socket sendto;
Chris PeBenito eb3cb6
allow rpcd_t portmap_t:udp_socket recvfrom;
Chris PeBenito eb3cb6
Chris PeBenito eb3cb6
ifdef(`lpd.te',`can_udp_send(portmap_t, lpd_t)')
Chris PeBenito eb3cb6
allow portmap_t lpd_t:udp_socket sendto;
Chris PeBenito eb3cb6
allow lpd_t portmap_t:udp_socket recvfrom;
Chris PeBenito eb3cb6
Chris PeBenito eb3cb6
can_udp_send(portmap_t, kernel_t)
Chris PeBenito eb3cb6
allow portmap_t kernel_t:udp_socket sendto;
Chris PeBenito eb3cb6
allow kernel_t portmap_t:udp_socket recvfrom;
Chris PeBenito eb3cb6
Chris PeBenito eb3cb6
can_udp_send(kernel_t, portmap_t)
Chris PeBenito eb3cb6
allow kernel_t portmap_t:udp_socket sendto;
Chris PeBenito eb3cb6
allow portmap_t kernel_t:udp_socket recvfrom;
Chris PeBenito eb3cb6
Chris PeBenito eb3cb6
') dnl end TODO
Chris PeBenito eb3cb6
Chris PeBenito eb3cb6
########################################
Chris PeBenito eb3cb6
#
Chris PeBenito eb3cb6
# Portmap helper local policy
Chris PeBenito eb3cb6
#
Chris PeBenito eb3cb6
Chris PeBenito eb3cb6
dontaudit portmap_helper_t self:capability net_admin;
Chris PeBenito eb3cb6
allow portmap_helper_t self:netlink_route_socket r_netlink_socket_perms;
Chris PeBenito eb3cb6
allow portmap_helper_t self:tcp_socket create_stream_socket_perms;
Chris PeBenito eb3cb6
allow portmap_helper_t self:udp_socket create_socket_perms;
Chris PeBenito eb3cb6
Chris PeBenito 0907bd
allow portmap_helper_t portmap_var_run_t:file create_file_perms;
Chris PeBenito 0907bd
files_create_pid(portmap_helper_t,portmap_var_run_t)
Chris PeBenito 0907bd
Chris PeBenito eb3cb6
corenet_tcp_sendrecv_all_if(portmap_helper_t)
Chris PeBenito eb3cb6
corenet_udp_sendrecv_all_if(portmap_helper_t)
Chris PeBenito eb3cb6
corenet_raw_sendrecv_all_if(portmap_helper_t)
Chris PeBenito eb3cb6
corenet_tcp_sendrecv_all_nodes(portmap_helper_t)
Chris PeBenito eb3cb6
corenet_udp_sendrecv_all_nodes(portmap_helper_t)
Chris PeBenito eb3cb6
corenet_raw_sendrecv_all_nodes(portmap_helper_t)
Chris PeBenito eb3cb6
corenet_tcp_sendrecv_all_ports(portmap_helper_t)
Chris PeBenito eb3cb6
corenet_udp_sendrecv_all_ports(portmap_helper_t)
Chris PeBenito eb3cb6
corenet_tcp_bind_all_nodes(portmap_helper_t)
Chris PeBenito eb3cb6
corenet_udp_bind_all_nodes(portmap_helper_t)
Chris PeBenito eb3cb6
corenet_tcp_bind_reserved_port(portmap_helper_t)
Chris PeBenito eb3cb6
corenet_udp_bind_reserved_port(portmap_helper_t)
Chris PeBenito eb3cb6
corenet_dontaudit_tcp_bind_all_reserved_ports(portmap_helper_t)
Chris PeBenito eb3cb6
corenet_dontaudit_udp_bind_all_reserved_ports(portmap_helper_t)
Chris PeBenito 0907bd
corenet_tcp_connect_all_ports(portmap_helper_t)
Chris PeBenito eb3cb6
Chris PeBenito eb3cb6
files_read_etc_files(portmap_helper_t)
Chris PeBenito eb3cb6
files_rw_generic_pids(portmap_helper_t)
Chris PeBenito eb3cb6
Chris PeBenito eb3cb6
init_rw_script_pid(portmap_helper_t)
Chris PeBenito eb3cb6
Chris PeBenito eb3cb6
libs_use_ld_so(portmap_helper_t)
Chris PeBenito eb3cb6
libs_use_shared_libs(portmap_helper_t)
Chris PeBenito eb3cb6
Chris PeBenito eb3cb6
sysnet_read_config(portmap_helper_t)
Chris PeBenito eb3cb6
Chris PeBenito eb3cb6
userdom_dontaudit_use_all_user_fd(portmap_helper_t)
Chris PeBenito eb3cb6
Chris PeBenito eb3cb6
optional_policy(`mount.te',`
Chris PeBenito eb3cb6
	mount_send_nfs_client_request(portmap_helper_t)
Chris PeBenito eb3cb6
')
Chris PeBenito eb3cb6
Chris PeBenito eb3cb6
optional_policy(`nis.te',`
Chris PeBenito eb3cb6
	nis_use_ypbind(portmap_helper_t)
Chris PeBenito eb3cb6
')