Chris PeBenito b16c6b
Chris PeBenito b16c6b
policy_module(userdomain,1.0)
Chris PeBenito b16c6b
Chris PeBenito b16c6b
########################################
Chris PeBenito b16c6b
#
Chris PeBenito b16c6b
# Declarations
Chris PeBenito b16c6b
#
Chris PeBenito b16c6b
Chris PeBenito daa0e0
# admin users terminals (tty and pty)
Chris PeBenito daa0e0
attribute admin_terminal;
Chris PeBenito daa0e0
Chris PeBenito daa0e0
# users home directory
Chris PeBenito daa0e0
attribute home_dir_type;
Chris PeBenito daa0e0
Chris PeBenito daa0e0
# users home directory contents
Chris PeBenito daa0e0
attribute home_type;
Chris PeBenito daa0e0
Chris PeBenito b16c6b
# The privhome attribute identifies every domain that can create files under
Chris PeBenito b16c6b
# regular user home directories in the regular context (IE act on behalf of
Chris PeBenito b16c6b
# a user in writing regular files)
Chris PeBenito b16c6b
attribute privhome;
Chris PeBenito b16c6b
Chris PeBenito 23ca91
# all unprivileged users home directories
Chris PeBenito 23ca91
attribute user_home_dir_type;
Chris PeBenito 23ca91
attribute user_home_type;
Chris PeBenito 23ca91
Chris PeBenito 23ca91
# all unprivileged users ptys
Chris PeBenito 23ca91
attribute user_ptynode;
Chris PeBenito 23ca91
Chris PeBenito ab940a
# all unprivileged users tmp files
Chris PeBenito ab940a
attribute user_tmpfile;
Chris PeBenito ab940a
Chris PeBenito ebdc3b
# all unprivileged users ttys
Chris PeBenito ebdc3b
attribute user_ttynode;
Chris PeBenito ebdc3b
Chris PeBenito b16c6b
# all user domains
Chris PeBenito b16c6b
attribute userdomain;
Chris PeBenito b16c6b
Chris PeBenito b16c6b
# unprivileged user domains
Chris PeBenito b16c6b
attribute unpriv_userdomain;
Chris PeBenito b16c6b
Chris PeBenito b16c6b
########################################
Chris PeBenito b16c6b
#
Chris PeBenito b16c6b
# Local policy
Chris PeBenito b16c6b
#
Chris PeBenito 76bff3
Chris PeBenito 32e53a
define(`role_change',`
Chris PeBenito 0c73cd
	allow $1_r $2_r;
Chris PeBenito 0c73cd
	type_change $2_t $1_devpts_t:chr_file $2_devpts_t;
Chris PeBenito 0c73cd
	type_change $2_t $1_tty_device_t:chr_file $2_tty_device_t;
Chris PeBenito 0c73cd
	# avoid annoying messages on terminal hangup
Chris PeBenito 0c73cd
	dontaudit $1_t { $2_devpts_t $2_tty_device_t }:chr_file ioctl;
Chris PeBenito 32e53a
')
Chris PeBenito 32e53a
Chris PeBenito c98340
ifdef(`targeted_policy',`
Chris PeBenito c98340
	# User home directory type.
Chris PeBenito 0b28a2
	type user_home_t alias { staff_home_t sysadm_home_t }, home_type;
Chris PeBenito 0b28a2
	files_type(user_home_t)
Chris PeBenito 0b28a2
Chris PeBenito c98340
	type user_home_dir_t alias { staff_home_dir_t sysadm_home_dir_t }, home_dir_type;
Chris PeBenito 0b28a2
	files_type(user_home_dir_t)
Chris PeBenito 32e53a
Chris PeBenito c98340
	unconfined_role(user_r)
Chris PeBenito c98340
	unconfined_role(sysadm_r)
Chris PeBenito 32e53a
Chris PeBenito c98340
	# dont need to use the full role_change()
Chris PeBenito c98340
	allow sysadm_r system_r;
Chris PeBenito c98340
	allow user_r system_r;
Chris PeBenito c98340
	allow user_r sysadm_r;
Chris PeBenito c98340
	allow system_r sysadm_r;
Chris PeBenito c98340
	allow system_r sysadm_r;
Chris PeBenito 32e53a
Chris PeBenito c98340
	ifdef(`TODO',`
Chris PeBenito c98340
	allow privhome home_root_t:dir { getattr search };
Chris PeBenito c98340
	file_type_auto_trans(privhome, user_home_dir_t, user_home_t)
Chris PeBenito c98340
	')
Chris PeBenito c98340
',`
Chris PeBenito c98340
	admin_user_template(sysadm)
Chris PeBenito c98340
	unpriv_user_template(staff)
Chris PeBenito c98340
	unpriv_user_template(user)
Chris PeBenito c98340
Chris PeBenito c98340
	# user role change rules:
Chris PeBenito c98340
	# sysadm_r can change to user roles
Chris PeBenito c98340
	role_change(sysadm, user)
Chris PeBenito c98340
	role_change(sysadm, staff)
Chris PeBenito c98340
Chris PeBenito c98340
	# only staff_r can change to sysadm_r
Chris PeBenito c98340
	role_change(staff, sysadm)
Chris PeBenito c98340
Chris PeBenito c98340
	# this should be tunable_policy, but
Chris PeBenito c98340
	# currently type_change and RBAC allow
Chris PeBenito c98340
	# do not work in conditionals
Chris PeBenito c98340
	ifdef(`user_canbe_sysadm',`
Chris PeBenito c98340
		role_change(user,sysadm)
Chris PeBenito c98340
	')
Chris PeBenito 76bff3
Chris PeBenito c98340
	ifdef(`TODO',`
Chris PeBenito c98340
	allow privhome home_root_t:dir { getattr search };
Chris PeBenito c98340
	')
Chris PeBenito daa0e0
Chris PeBenito c98340
	########################################
Chris PeBenito c98340
	#
Chris PeBenito c98340
	# Sysadm local policy
Chris PeBenito c98340
	#
Chris PeBenito daa0e0
Chris PeBenito c98340
	# for su
Chris PeBenito c98340
	allow sysadm_t userdomain:fd use;
Chris PeBenito 76bff3
Chris PeBenito c98340
	# Add/remove user home directories
Chris PeBenito c98340
	allow sysadm_t user_home_dir_t:dir create_dir_perms;
Chris PeBenito c98340
	files_create_home_dirs(sysadm_t,user_home_dir_t)
Chris PeBenito dc771f
Chris PeBenito e5f806
	ifdef(`direct_sysadm_daemon',`
Chris PeBenito e5f806
		optional_policy(`init.te',`
Chris PeBenito e5f806
			init_run_daemon(sysadm_t,sysadm_r,admin_terminal)
Chris PeBenito e5f806
		')
Chris PeBenito e5f806
	')
Chris PeBenito e5f806
Chris PeBenito c98340
	optional_policy(`bootloader.te',`
Chris PeBenito c98340
		bootloader_run(sysadm_t,sysadm_r,admin_terminal)
Chris PeBenito c98340
	')
Chris PeBenito 32e53a
Chris PeBenito d83fda
	optional_policy(`bind.te',`
Chris PeBenito d83fda
		bind_run_ndc(sysadm_t,sysadm_r,admin_terminal)
Chris PeBenito d83fda
	')
Chris PeBenito d83fda
Chris PeBenito c98340
	optional_policy(`clock.te',`
Chris PeBenito c98340
		clock_run(sysadm_t,sysadm_r,admin_terminal)
Chris PeBenito c98340
	')
Chris PeBenito 58c3da
Chris PeBenito 57a96c
	optional_policy(`firstboot.te',`
Chris PeBenito 57a96c
		firstboot_run(sysadm_t,sysadm_r,sysadm_tty_device_t)
Chris PeBenito 57a96c
	')
Chris PeBenito 57a96c
Chris PeBenito c98340
	optional_policy(`fstools.te',`
Chris PeBenito c98340
		fstools_run(sysadm_t,sysadm_r,admin_terminal)
Chris PeBenito c98340
	')
Chris PeBenito 32e53a
Chris PeBenito c98340
	optional_policy(`hostname.te',`
Chris PeBenito c98340
		hostname_run(sysadm_t,sysadm_r,admin_terminal)
Chris PeBenito c98340
	')
Chris PeBenito daa0e0
Chris PeBenito a5f339
	optional_policy(`ipsec.te',`
Chris PeBenito a5f339
		# allow system administrator to use the ipsec script to look
Chris PeBenito a5f339
		# at things (e.g., ipsec auto --status)
Chris PeBenito a5f339
		# probably should create an ipsec_admin role for this kind of thing
Chris PeBenito a5f339
		ipsec_exec_mgmt(sysadm_t)
Chris PeBenito 81343a
		ipsec_stream_connect(sysadm_t)
Chris PeBenito a5f339
		# for lsof
Chris PeBenito a5f339
		ipsec_getattr_key_socket(sysadm_t)
Chris PeBenito a5f339
	')
Chris PeBenito a5f339
Chris PeBenito c98340
	optional_policy(`iptables.te',`
Chris PeBenito c98340
		iptables_run(sysadm_t,sysadm_r,admin_terminal)
Chris PeBenito c98340
	')
Chris PeBenito 15a961
Chris PeBenito c98340
	optional_policy(`libraries.te',`
Chris PeBenito c98340
		libs_run_ldconfig(sysadm_t,sysadm_r,admin_terminal)
Chris PeBenito c98340
	')
Chris PeBenito daa0e0
Chris PeBenito c98340
	optional_policy(`lvm.te',`
Chris PeBenito c98340
		lvm_run(sysadm_t,sysadm_r,admin_terminal)
Chris PeBenito c98340
	')
Chris PeBenito daa0e0
Chris PeBenito c98340
	optional_policy(`modutils.te',`
Chris PeBenito c98340
		modutils_run_depmod(sysadm_t,sysadm_r,admin_terminal)
Chris PeBenito c98340
		modutils_run_insmod(sysadm_t,sysadm_r,admin_terminal)
Chris PeBenito c98340
		modutils_run_update_mods(sysadm_t,sysadm_r,admin_terminal)
Chris PeBenito c98340
	')
Chris PeBenito 96ce00
Chris PeBenito c98340
	optional_policy(`logrotate.te',`
Chris PeBenito c98340
		logrotate_run(sysadm_t,sysadm_r,admin_terminal)
Chris PeBenito c98340
	')
Chris PeBenito daa0e0
Chris PeBenito c98340
	optional_policy(`mount.te',`
Chris PeBenito c98340
		mount_run(sysadm_t,sysadm_r,admin_terminal)
Chris PeBenito c98340
	')
Chris PeBenito ab940a
Chris PeBenito 42be7c
	optional_policy(`mysql.te',`
Chris PeBenito 42be7c
		mysql_stream_connect(sysadm_t)
Chris PeBenito 42be7c
	')
Chris PeBenito 42be7c
Chris PeBenito c98340
	optional_policy(`netutils.te',`
Chris PeBenito c98340
		netutils_run(sysadm_t,sysadm_r,admin_terminal)
Chris PeBenito c98340
		netutils_run_ping(sysadm_t,sysadm_r,admin_terminal)
Chris PeBenito c98340
		netutils_run_traceroute(sysadm_t,sysadm_r,admin_terminal)
Chris PeBenito c98340
	')
Chris PeBenito 15a961
Chris PeBenito 98a8ea
	optional_policy(`ntp.te',`
Chris PeBenito 98a8ea
		ntp_stub()
Chris PeBenito 98a8ea
		corenet_udp_bind_ntp_port(sysadm_t)
Chris PeBenito 98a8ea
	')
Chris PeBenito 98a8ea
Chris PeBenito e0d57f
	optional_policy(`pcmcia.te',`
Chris PeBenito e0d57f
		pcmcia_run_cardctl(sysadm_t,sysadm_r,admin_terminal)
Chris PeBenito e0d57f
	')
Chris PeBenito e0d57f
Chris PeBenito eb3cb6
	optional_policy(`portmap.te',`
Chris PeBenito eb3cb6
		portmap_run_helper(sysadm_t,sysadm_r,admin_terminal)
Chris PeBenito eb3cb6
	')
Chris PeBenito eb3cb6
Chris PeBenito 052c95
	optional_policy(`quota.te',`
Chris PeBenito 052c95
		quota_run(sysadm_t,sysadm_r,admin_terminal)
Chris PeBenito 052c95
	')
Chris PeBenito 052c95
Chris PeBenito c98340
	optional_policy(`rpm.te',`
Chris PeBenito c98340
		rpm_run(sysadm_t,sysadm_r,admin_terminal)
Chris PeBenito 0c73cd
	')
Chris PeBenito daa0e0
Chris PeBenito 84c922
	optional_policy(`samba.te',`
Chris PeBenito 84c922
		samba_run_net(sysadm_t,sysadm_r,admin_terminal)
Chris PeBenito 84c922
	')
Chris PeBenito 84c922
Chris PeBenito ae9e27
	optional_policy(`selinuxutil.te',`
Chris PeBenito c98340
		seutil_run_checkpol(sysadm_t,sysadm_r,admin_terminal)
Chris PeBenito c98340
		seutil_run_loadpol(sysadm_t,sysadm_r,admin_terminal)
Chris PeBenito c98340
		seutil_run_restorecon(sysadm_t,sysadm_r,admin_terminal)
Chris PeBenito c98340
		seutil_run_setfiles(sysadm_t,sysadm_r,admin_terminal)
Chris PeBenito c98340
		optional_policy(`targeted_policy',`',`
Chris PeBenito c98340
			seutil_run_runinit(sysadm_t,sysadm_r,admin_terminal)
Chris PeBenito c98340
		')
Chris PeBenito c98340
	')
Chris PeBenito c98340
Chris PeBenito c98340
	optional_policy(`sysnetwork.te',`
Chris PeBenito c98340
		sysnet_run_ifconfig(sysadm_t,sysadm_r,admin_terminal)
Chris PeBenito c98340
	')
Chris PeBenito daa0e0
Chris PeBenito a5f339
	optional_policy(`unconfined.te',`
Chris PeBenito a5f339
		unconfined_domtrans(sysadm_t,sysadm_r,admin_terminal)
Chris PeBenito a5f339
	')
Chris PeBenito a5f339
Chris PeBenito c98340
	optional_policy(`usermanage.te',`
Chris PeBenito c98340
		usermanage_run_groupadd(sysadm_t,sysadm_r,admin_terminal)
Chris PeBenito c98340
		usermanage_run_useradd(sysadm_t,sysadm_r,admin_terminal)
Chris PeBenito c98340
	')
Chris PeBenito daa0e0
')