diff --git a/apache.fc b/apache.fc
index 3009a35..20edb22 100644
--- a/apache.fc
+++ b/apache.fc
@@ -19,6 +19,7 @@ HOME_DIR/((www)|(web)|(public_html))(/.*)?/logs(/.*)? gen_context(system_u:objec
/etc/lighttpd(/.*)? gen_context(system_u:object_r:httpd_config_t,s0)
/etc/mock/koji(/.*)? gen_context(system_u:object_r:httpd_sys_rw_content_t,s0)
/etc/nginx(/.*)? gen_context(system_u:object_r:httpd_config_t,s0)
+/etc/opt/rh/rh-nginx18/nginx(/.*)? gen_context(system_u:object_r:httpd_config_t,s0)
/etc/rc\.d/init\.d/httpd -- gen_context(system_u:object_r:httpd_initrc_exec_t,s0)
/etc/rc\.d/init\.d/lighttpd -- gen_context(system_u:object_r:httpd_initrc_exec_t,s0)
@@ -121,6 +122,7 @@ ifdef(`distro_suse', `
/var/lib/moodle(/.*)? gen_context(system_u:object_r:httpd_sys_rw_content_t,s0)
/var/lib/mod_security(/.*)? gen_context(system_u:object_r:httpd_var_lib_t,s0)
/var/lib/nginx(/.*)? gen_context(system_u:object_r:httpd_var_lib_t,s0)
+/var/opt/rh/rh-nginx18/lib/nginx(/.*)? gen_context(system_u:object_r:httpd_var_lib_t,s0)
/var/lib/php/session(/.*)? gen_context(system_u:object_r:httpd_var_run_t,s0)
/var/lib/php/wsdlcache(/.*)? gen_context(system_u:object_r:httpd_var_run_t,s0)
@@ -145,6 +147,7 @@ ifdef(`distro_suse', `
/var/log/httpd(/.*)? gen_context(system_u:object_r:httpd_log_t,s0)
/var/log/lighttpd(/.*)? gen_context(system_u:object_r:httpd_log_t,s0)
/var/log/nginx(/.*)? gen_context(system_u:object_r:httpd_log_t,s0)
+/var/opt/rh/rh-nginx18/log(/.*)? gen_context(system_u:object_r:httpd_log_t,s0)
/var/log/php-fpm(/.*)? gen_context(system_u:object_r:httpd_log_t,s0)
/var/log/roundcubemail(/.*)? gen_context(system_u:object_r:httpd_log_t,s0)
/var/log/suphp\.log.* -- gen_context(system_u:object_r:httpd_log_t,s0)
@@ -162,6 +165,7 @@ ifdef(`distro_debian', `
/var/run/lighttpd(/.*)? gen_context(system_u:object_r:httpd_var_run_t,s0)
/var/run/mod_.* gen_context(system_u:object_r:httpd_var_run_t,s0)
/var/run/nginx.* gen_context(system_u:object_r:httpd_var_run_t,s0)
+/var/opt/rh/rh-nginx18/run/nginx(/.*)? gen_context(system_u:object_r:httpd_var_run_t,s0)
/var/run/php-fpm(/.*)? gen_context(system_u:object_r:httpd_var_run_t,s0)
/var/run/thttpd\.pid -- gen_context(system_u:object_r:httpd_var_run_t,s0)
/var/run/wsgi.* -s gen_context(system_u:object_r:httpd_var_run_t,s0)
diff --git a/apache.te b/apache.te
index 3226dec..e9c7099 100644
--- a/apache.te
+++ b/apache.te
@@ -1028,6 +1028,7 @@ optional_policy(`
optional_policy(`
nagios_read_config(httpd_t)
+ nagios_read_lib(httpd_t)
nagios_read_log(httpd_t)
')
diff --git a/certmonger.te b/certmonger.te
index 7f683e5..fc5b086 100644
--- a/certmonger.te
+++ b/certmonger.te
@@ -117,6 +117,7 @@ optional_policy(`
optional_policy(`
ipa_manage_lib(certmonger_t)
+ ipa_manage_pid_files(certmonger_t)
')
optional_policy(`
diff --git a/chrome.te b/chrome.te
index f50b201..5c852ff 100644
--- a/chrome.te
+++ b/chrome.te
@@ -35,7 +35,7 @@ allow chrome_sandbox_t self:capability2 block_suspend;
allow chrome_sandbox_t self:capability { chown dac_override fsetid setgid setuid sys_admin sys_chroot sys_ptrace };
dontaudit chrome_sandbox_t self:capability sys_nice;
allow chrome_sandbox_t self:process { signal_perms setrlimit execmem execstack };
-allow chrome_sandbox_t self:process setsched;
+allow chrome_sandbox_t self:process { setcap setsched };
allow chrome_sandbox_t self:fifo_file manage_fifo_file_perms;
allow chrome_sandbox_t self:unix_stream_socket create_stream_socket_perms;
allow chrome_sandbox_t self:unix_dgram_socket { create_socket_perms sendto };
@@ -60,6 +60,8 @@ fs_tmpfs_filetrans(chrome_sandbox_t, chrome_sandbox_tmpfs_t, { file dir })
kernel_read_system_state(chrome_sandbox_t)
kernel_read_kernel_sysctls(chrome_sandbox_t)
+auth_dontaudit_read_passwd(chrome_sandbox_t)
+
fs_manage_cgroup_dirs(chrome_sandbox_t)
fs_manage_cgroup_files(chrome_sandbox_t)
fs_read_dos_files(chrome_sandbox_t)
diff --git a/cron.te b/cron.te
index 0ee059a..9d2cd2d 100644
--- a/cron.te
+++ b/cron.te
@@ -27,6 +27,14 @@ gen_tunable(cron_can_relabel, false)
gen_tunable(cron_userdomain_transition, true)
## <desc>
+## <p>
+## Allow system cronjob to be executed on
+## on NFS, CIFS or FUSE filesystem.
+## </p>
+## </desc>
+gen_tunable(cron_system_cronjob_use_shares, false)
+
+## <desc>
## <p>
## Enable extra rules in the cron domain
## to support fcron.
@@ -404,6 +412,12 @@ manage_files_pattern(system_cronjob_t, system_cron_spool_t, system_cron_spool_t)
# for this purpose.
allow system_cronjob_t system_cron_spool_t:file entrypoint;
+tunable_policy(`cron_system_cronjob_use_shares',`
+ fs_fusefs_entrypoint(system_cronjob_t)
+ fs_nfs_entrypoint(system_cronjob_t)
+ fs_cifs_entrypoint(system_cronjob_t)
+')
+
# Permit a transition from the crond_t domain to this domain.
# The transition is requested explicitly by the modified crond
# via setexeccon. There is no way to set up an automatic
diff --git a/ctdb.if b/ctdb.if
index e99c5c6..ffc5497 100644
--- a/ctdb.if
+++ b/ctdb.if
@@ -38,6 +38,23 @@ interface(`ctdbd_initrc_domtrans',`
init_labeled_script_domtrans($1, ctdbd_initrc_exec_t)
')
+#######################################
+## <summary>
+## Allow domain to signal ctdbd.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`ctdbd_signal',`
+ gen_require(`
+ type ctdbd_t;
+ ')
+ allow $1 ctdbd_t:process signal;
+')
+
########################################
## <summary>
## Read ctdbd's log files.
@@ -100,26 +117,26 @@ interface(`ctdbd_manage_log',`
########################################
## <summary>
-## Search ctdbd lib directories.
+## Manage ctdbd lib files.
## </summary>
## <param name="domain">
-## <summary>
-## Domain allowed access.
-## </summary>
+## <summary>
+## Domain allowed access.
+## </summary>
## </param>
#
-interface(`ctdbd_search_lib',`
- gen_require(`
- type ctdbd_var_lib_t;
- ')
+interface(`ctdbd_manage_var_files',`
+ gen_require(`
+ type ctdbd_var_t;
+ ')
- allow $1 ctdbd_var_lib_t:dir search_dir_perms;
- files_search_var_lib($1)
+ files_search_var_lib($1)
+ manage_files_pattern($1, ctdbd_var_t, ctdbd_var_t)
')
########################################
## <summary>
-## Read ctdbd lib files.
+## Search ctdbd lib directories.
## </summary>
## <param name="domain">
## <summary>
@@ -127,18 +144,18 @@ interface(`ctdbd_search_lib',`
## </summary>
## </param>
#
-interface(`ctdbd_read_lib_files',`
+interface(`ctdbd_search_lib',`
gen_require(`
type ctdbd_var_lib_t;
')
+ allow $1 ctdbd_var_lib_t:dir search_dir_perms;
files_search_var_lib($1)
- read_files_pattern($1, ctdbd_var_lib_t, ctdbd_var_lib_t)
')
########################################
## <summary>
-## Manage ctdbd lib files.
+## Read ctdbd lib files.
## </summary>
## <param name="domain">
## <summary>
@@ -146,13 +163,13 @@ interface(`ctdbd_read_lib_files',`
## </summary>
## </param>
#
-interface(`ctdbd_manage_lib_files',`
+interface(`ctdbd_read_lib_files',`
gen_require(`
type ctdbd_var_lib_t;
')
files_search_var_lib($1)
- manage_files_pattern($1, ctdbd_var_lib_t, ctdbd_var_lib_t)
+ read_files_pattern($1, ctdbd_var_lib_t, ctdbd_var_lib_t)
')
########################################
@@ -165,13 +182,13 @@ interface(`ctdbd_manage_lib_files',`
## </summary>
## </param>
#
-interface(`ctdbd_manage_var_files',`
+interface(`ctdbd_manage_lib_files',`
gen_require(`
- type ctdbd_var_t;
+ type ctdbd_var_lib_t;
')
files_search_var_lib($1)
- manage_files_pattern($1, ctdbd_var_t, ctdbd_var_t)
+ manage_files_pattern($1, ctdbd_var_lib_t, ctdbd_var_lib_t)
')
########################################
diff --git a/ctdb.te b/ctdb.te
index 2ab29db..4a84c8b 100644
--- a/ctdb.te
+++ b/ctdb.te
@@ -44,6 +44,7 @@ allow ctdbd_t self:netlink_route_socket r_netlink_socket_perms;
allow ctdbd_t self:packet_socket create_socket_perms;
allow ctdbd_t self:tcp_socket create_stream_socket_perms;
allow ctdbd_t self:udp_socket create_socket_perms;
+allow ctdbd_t self:rawip_socket create_socket_perms;
append_files_pattern(ctdbd_t, ctdbd_log_t, ctdbd_log_t)
create_files_pattern(ctdbd_t, ctdbd_log_t, ctdbd_log_t)
@@ -75,6 +76,8 @@ manage_files_pattern(ctdbd_t, ctdbd_var_run_t, ctdbd_var_run_t)
manage_sock_files_pattern(ctdbd_t, ctdbd_var_run_t, ctdbd_var_run_t)
files_pid_filetrans(ctdbd_t, ctdbd_var_run_t, dir)
+can_exec(ctdbd_t, ctdbd_exec_t)
+
kernel_read_network_state(ctdbd_t)
kernel_read_system_state(ctdbd_t)
kernel_rw_net_sysctls(ctdbd_t)
@@ -89,6 +92,7 @@ corenet_udp_bind_generic_node(ctdbd_t)
corenet_sendrecv_ctdb_server_packets(ctdbd_t)
corenet_tcp_bind_ctdb_port(ctdbd_t)
corenet_udp_bind_ctdb_port(ctdbd_t)
+corenet_tcp_bind_smbd_port(ctdbd_t)
corenet_tcp_connect_ctdb_port(ctdbd_t)
corenet_tcp_sendrecv_ctdb_port(ctdbd_t)
@@ -110,6 +114,8 @@ logging_send_syslog_msg(ctdbd_t)
miscfiles_read_public_files(ctdbd_t)
+userdom_home_manager(ctdbd_t)
+
optional_policy(`
consoletype_exec(ctdbd_t)
')
@@ -123,6 +129,7 @@ optional_policy(`
')
optional_policy(`
+ samba_signull_smbd(ctdbd_t)
samba_initrc_domtrans(ctdbd_t)
samba_domtrans_net(ctdbd_t)
samba_rw_var_files(ctdbd_t)
@@ -130,5 +137,10 @@ optional_policy(`
')
optional_policy(`
+ samba_signull_winbind(ctdbd_t)
+ samba_signull_unconfined_net(ctdbd_t)
+')
+
+optional_policy(`
sysnet_domtrans_ifconfig(ctdbd_t)
')
diff --git a/glusterd.if b/glusterd.if
index c62ad86..fc9bf19 100644
--- a/glusterd.if
+++ b/glusterd.if
@@ -117,7 +117,84 @@ interface(`glusterd_manage_log',`
manage_lnk_files_pattern($1, glusterd_log_t, glusterd_log_t)
')
-########################################
+######################################
+## <summary>
+## Allow the specified domain to execute gluster's lib files.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`gluster_execute_lib',`
+ gen_require(`
+ type glusterd_var_lib_t;
+ ')
+
+ files_list_var_lib($1)
+ allow $1 glusterd_var_lib_t:dir search_dir_perms;
+ can_exec($1, glusterd_var_lib_t)
+')
+
+######################################
+## <summary>
+## Read glusterd's config files.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`glusterd_read_conf',`
+ gen_require(`
+ type glusterd_conf_t;
+ ')
+
+ files_search_etc($1)
+ read_files_pattern($1, glusterd_conf_t, glusterd_conf_t)
+')
+
+######################################
+## <summary>
+## Read and write /var/lib/glusterd files.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`glusterd_rw_lib',`
+ gen_require(`
+ type glusterd_var_lib_t;
+ ')
+
+ files_search_var_lib($1)
+ rw_files_pattern($1, glusterd_var_lib_t, glusterd_var_lib_t)
+')
+
+######################################
+## <summary>
+## Read and write /var/lib/glusterd files.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`glusterd_manage_lib_files',`
+ gen_require(`
+ type glusterd_var_lib_t;
+ ')
+
+ files_search_var_lib($1)
+ manage_files_pattern($1, glusterd_var_lib_t, glusterd_var_lib_t)
+')
+
+######################################
## <summary>
## All of the rules required to administrate
## an glusterd environment
diff --git a/glusterd.te b/glusterd.te
index fbc6a67..b974353 100644
--- a/glusterd.te
+++ b/glusterd.te
@@ -31,6 +31,7 @@ gen_tunable(gluster_export_all_rw, true)
type glusterd_t;
type glusterd_exec_t;
init_daemon_domain(glusterd_t, glusterd_exec_t)
+domain_obj_id_change_exemption(glusterd_t)
type glusterd_conf_t;
files_type(glusterd_conf_t)
@@ -58,13 +59,16 @@ files_type(glusterd_brick_t)
# Local policy
#
-allow glusterd_t self:capability { sys_admin sys_resource dac_override chown dac_read_search fowner fsetid kill setgid setuid net_admin };
+allow glusterd_t self:capability { sys_admin sys_resource sys_ptrace dac_override chown dac_read_search fowner fsetid kill setgid setuid net_admin mknod net_raw };
allow glusterd_t self:capability2 block_suspend;
-allow glusterd_t self:process { getcap setcap setrlimit signal_perms };
+allow glusterd_t self:process { getcap setcap setrlimit signal_perms setsched getsched };
+allow glusterd_t self:sem create_sem_perms;
allow glusterd_t self:fifo_file rw_fifo_file_perms;
allow glusterd_t self:tcp_socket { accept listen };
allow glusterd_t self:unix_stream_socket { accept listen connectto };
+allow glusterd_t self:rawip_socket create_socket_perms;
+allow glusterd_t self:unix_stream_socket create_stream_socket_perms;
manage_dirs_pattern(glusterd_t, glusterd_conf_t, glusterd_conf_t)
manage_files_pattern(glusterd_t, glusterd_conf_t, glusterd_conf_t)
@@ -97,9 +101,13 @@ manage_dirs_pattern(glusterd_t, glusterd_brick_t, glusterd_brick_t)
manage_files_pattern(glusterd_t, glusterd_brick_t, glusterd_brick_t)
manage_fifo_files_pattern(glusterd_t, glusterd_brick_t, glusterd_brick_t)
manage_lnk_files_pattern(glusterd_t, glusterd_brick_t, glusterd_brick_t)
+manage_blk_files_pattern(glusterd_t, glusterd_brick_t, glusterd_brick_t)
+manage_chr_files_pattern(glusterd_t, glusterd_brick_t, glusterd_brick_t)
relabel_files_pattern(glusterd_t, glusterd_brick_t, glusterd_brick_t)
relabel_lnk_files_pattern(glusterd_t, glusterd_brick_t, glusterd_brick_t)
relabel_dirs_pattern(glusterd_t, glusterd_brick_t, glusterd_brick_t)
+relabel_chr_files_pattern(glusterd_t, glusterd_brick_t, glusterd_brick_t)
+relabel_blk_files_pattern(glusterd_t, glusterd_brick_t, glusterd_brick_t)
can_exec(glusterd_t, glusterd_exec_t)
@@ -121,6 +129,7 @@ corenet_tcp_sendrecv_all_ports(glusterd_t)
corenet_udp_sendrecv_all_ports(glusterd_t)
corenet_tcp_bind_generic_node(glusterd_t)
corenet_udp_bind_generic_node(glusterd_t)
+corenet_raw_bind_generic_node(glusterd_t)
corenet_tcp_connect_gluster_port(glusterd_t)
corenet_tcp_bind_gluster_port(glusterd_t)
@@ -141,11 +150,15 @@ corenet_tcp_bind_all_unreserved_ports(glusterd_t)
corenet_tcp_connect_all_unreserved_ports(glusterd_t)
corenet_tcp_connect_all_ephemeral_ports(glusterd_t)
corenet_tcp_connect_ssh_port(glusterd_t)
+corenet_tcp_connect_all_rpc_ports(glusterd_t)
+corenet_tcp_connect_all_ports(glusterd_t)
dev_read_sysfs(glusterd_t)
dev_read_urand(glusterd_t)
+dev_read_rand(glusterd_t)
domain_read_all_domains_state(glusterd_t)
+domain_getattr_all_sockets(glusterd_t)
domain_use_interactive_fds(glusterd_t)
@@ -155,13 +168,30 @@ fs_getattr_all_fs(glusterd_t)
files_mounton_non_security(glusterd_t)
+files_dontaudit_read_security_files(glusterd_t)
+files_dontaudit_list_security_dirs(glusterd_t)
+
storage_rw_fuse(glusterd_t)
+#needed by /usr/sbin/xfs_db
+storage_raw_read_fixed_disk(glusterd_t)
+storage_raw_write_fixed_disk(glusterd_t)
auth_use_nsswitch(glusterd_t)
fs_getattr_all_fs(glusterd_t)
+init_domtrans_script(glusterd_t)
+init_initrc_domain(glusterd_t)
+init_read_script_state(glusterd_t)
+init_rw_script_tmp_files(glusterd_t)
+init_manage_script_status_files(glusterd_t)
+
+systemd_config_systemd_services(glusterd_t)
+systemd_signal_passwd_agent(glusterd_t)
+
logging_send_syslog_msg(glusterd_t)
+logging_dontaudit_search_audit_logs(glusterd_t)
+
libs_exec_ldconfig(glusterd_t)
miscfiles_read_localization(glusterd_t)
@@ -169,8 +199,15 @@ miscfiles_read_public_files(glusterd_t)
userdom_manage_user_home_dirs(glusterd_t)
userdom_filetrans_home_content(glusterd_t)
+userdom_read_user_tmp_files(glusterd_t)
+userdom_delete_user_tmp_files(glusterd_t)
+userdom_rw_user_tmp_files(glusterd_t)
+userdom_kill_all_users(glusterd_t)
mount_domtrans(glusterd_t)
+
+fstools_domtrans(glusterd_t)
+
tunable_policy(`gluster_anon_write',`
miscfiles_manage_public_files(glusterd_t)
')
@@ -178,6 +215,8 @@ tunable_policy(`gluster_anon_write',`
tunable_policy(`gluster_export_all_ro',`
fs_read_noxattr_fs_files(glusterd_t)
files_read_non_security_files(glusterd_t)
+ files_getattr_all_pipes(glusterd_t)
+ files_getattr_all_sockets(glusterd_t)
')
tunable_policy(`gluster_export_all_rw',`
@@ -185,6 +224,45 @@ tunable_policy(`gluster_export_all_rw',`
files_manage_non_security_dirs(glusterd_t)
files_manage_non_security_files(glusterd_t)
files_relabel_base_file_types(glusterd_t)
+ files_getattr_all_pipes(glusterd_t)
+ files_getattr_all_sockets(glusterd_t)
+')
+
+optional_policy(`
+ ctdbd_domtrans(glusterd_t)
+ ctdbd_signal(glusterd_t)
+')
+
+optional_policy(`
+ dbus_system_bus_client(glusterd_t)
+ dbus_connect_system_bus(glusterd_t)
+
+ optional_policy(`
+ policykit_dbus_chat(glusterd_t)
+ ')
+')
+
+optional_policy(`
+ hostname_exec(glusterd_t)
+')
+
+optional_policy(`
+ lvm_domtrans(glusterd_t)
+')
+
+optional_policy(`
+ mount_domtrans_showmount(glusterd_t)
+')
+
+optional_policy(`
+ samba_domtrans_smbd(glusterd_t)
+ samba_systemctl(glusterd_t)
+ samba_signal_smbd(glusterd_t)
+ samba_manage_config(glusterd_t)
+')
+
+optional_policy(`
+ ssh_exec_keygen(glusterd_t)
')
optional_policy(`
@@ -197,5 +275,21 @@ optional_policy(`
')
optional_policy(`
+ rpc_systemctl_nfsd(glusterd_t)
+ rpc_systemctl_rpcd(glusterd_t)
+
+ rpc_domtrans_nfsd(glusterd_t)
+ rpc_domtrans_rpcd(glusterd_t)
+ rpc_manage_nfs_state_data(glusterd_t)
+')
+
+optional_policy(`
+ rhcs_dbus_chat_cluster(glusterd_t)
+ rhcs_domtrans_cluster(glusterd_t)
+ rhcs_systemctl_cluster(glusterd_t)
+ rhcs_stream_connect_cluster(glusterd_t)
+')
+
+optional_policy(`
ssh_exec(glusterd_t)
')
diff --git a/ipa.fc b/ipa.fc
index 48d7322..5585d3b 100644
--- a/ipa.fc
+++ b/ipa.fc
@@ -4,3 +4,4 @@
/var/lib/ipa(/.*)? gen_context(system_u:object_r:ipa_var_lib_t,s0)
+/var/run/ipa(/.*)? gen_context(system_u:object_r:ipa_var_run_t,s0)
diff --git a/ipa.if b/ipa.if
index 123e906..c5a351b 100644
--- a/ipa.if
+++ b/ipa.if
@@ -92,3 +92,20 @@ interface(`ipa_read_lib',`
list_dirs_pattern($1, ipa_var_lib_t, ipa_var_lib_t)
')
+########################################
+## <summary>
+## Allow domain to manage ipa run files/dirs.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`ipa_manage_pid_files',`
+ gen_require(`
+ type ipa_var_run_t;
+ ')
+ manage_files_pattern($1, ipa_var_run_t, ipa_var_run_t)
+ manage_dirs_pattern($1, ipa_var_run_t, ipa_var_run_t)
+')
diff --git a/ipa.te b/ipa.te
index b60bc5f..a7f09d25 100644
--- a/ipa.te
+++ b/ipa.te
@@ -17,6 +17,9 @@ systemd_unit_file(ipa_otpd_unit_file_t)
type ipa_var_lib_t;
files_type(ipa_var_lib_t)
+type ipa_var_run_t;
+files_pid_file(ipa_var_run_t)
+
########################################
#
# ipa_otpd local policy
@@ -27,6 +30,10 @@ allow ipa_otpd_t self:capability2 block_suspend;
allow ipa_otpd_t self:fifo_file rw_fifo_file_perms;
allow ipa_otpd_t self:unix_stream_socket create_stream_socket_perms;
+manage_dirs_pattern(ipa_otpd_t, ipa_var_run_t, ipa_var_run_t)
+manage_files_pattern(ipa_otpd_t, ipa_var_run_t, ipa_var_run_t)
+files_pid_filetrans(ipa_otpd_t, ipa_var_run_t, file)
+
corenet_tcp_connect_radius_port(ipa_otpd_t)
dev_read_urand(ipa_otpd_t)
diff --git a/mongodb.fc b/mongodb.fc
index 91adcaf..e9e6bc5 100644
--- a/mongodb.fc
+++ b/mongodb.fc
@@ -1,9 +1,15 @@
/etc/rc\.d/init\.d/mongod -- gen_context(system_u:object_r:mongod_initrc_exec_t,s0)
+/etc/rc\.d/init\.d/mongos -- gen_context(system_u:object_r:mongod_initrc_exec_t,s0)
+
+/usr/lib/systemd/system/mongod.* -- gen_context(system_u:object_r:mongod_unit_file_t,s0)
+/usr/lib/systemd/system/mongos.* -- gen_context(system_u:object_r:mongod_unit_file_t,s0)
/usr/bin/mongod -- gen_context(system_u:object_r:mongod_exec_t,s0)
/usr/bin/mongos -- gen_context(system_u:object_r:mongod_exec_t,s0)
/usr/share/aeolus-conductor/dbomatic/dbomatic -- gen_context(system_u:object_r:mongod_exec_t,s0)
+/usr/libexec/mongodb-scl-helper -- gen_context(system_u:object_r:mongod_exec_t,s0)
+
/var/lib/mongo.* gen_context(system_u:object_r:mongod_var_lib_t,s0)
/var/log/mongo.* gen_context(system_u:object_r:mongod_log_t,s0)
diff --git a/mongodb.te b/mongodb.te
index dec8a95..d3fdae4 100644
--- a/mongodb.te
+++ b/mongodb.te
@@ -12,6 +12,9 @@ init_daemon_domain(mongod_t, mongod_exec_t)
type mongod_initrc_exec_t;
init_script_file(mongod_initrc_exec_t)
+type mongod_unit_file_t;
+systemd_unit_file(mongod_unit_file_t)
+
type mongod_log_t;
logging_log_file(mongod_log_t)
@@ -30,7 +33,7 @@ files_tmp_file(mongod_tmp_t)
#
-allow mongod_t self:process { setsched signal };
+allow mongod_t self:process { setsched signal execmem };
allow mongod_t self:fifo_file rw_fifo_file_perms;
allow mongod_t self:netlink_route_socket r_netlink_socket_perms;
@@ -69,6 +72,8 @@ corenet_tcp_connect_mongod_port(mongod_t)
corenet_tcp_bind_mongod_port(mongod_t)
corenet_tcp_bind_generic_node(mongod_t)
+auth_use_nsswitch(mongod_t)
+
dev_read_sysfs(mongod_t)
dev_read_urand(mongod_t)
diff --git a/mysql.fc b/mysql.fc
index 4a315d5..c2c13aa 100644
--- a/mysql.fc
+++ b/mysql.fc
@@ -14,6 +14,7 @@ HOME_DIR/\.my\.cnf -- gen_context(system_u:object_r:mysqld_home_t, s0)
#
/etc/my\.cnf -- gen_context(system_u:object_r:mysqld_etc_t,s0)
/etc/mysql(/.*)? gen_context(system_u:object_r:mysqld_etc_t,s0)
+/etc/my\.cnf\.d(/.*)? gen_context(system_u:object_r:mysqld_etc_t,s0)
/etc/rc\.d/init\.d/mysqld -- gen_context(system_u:object_r:mysqld_initrc_exec_t,s0)
/etc/rc\.d/init\.d/mysqlmanager -- gen_context(system_u:object_r:mysqlmanagerd_initrc_exec_t,s0)
@@ -24,6 +25,8 @@ HOME_DIR/\.my\.cnf -- gen_context(system_u:object_r:mysqld_home_t, s0)
/usr/bin/mysql_upgrade -- gen_context(system_u:object_r:mysqld_exec_t,s0)
/usr/libexec/mysqld -- gen_context(system_u:object_r:mysqld_exec_t,s0)
+/usr/libexec/mysqld_safe-scl-helper -- gen_context(system_u:object_r:mysqld_safe_exec_t,s0)
+
/usr/sbin/mysqld(-max)? -- gen_context(system_u:object_r:mysqld_exec_t,s0)
/usr/sbin/mysqlmanager -- gen_context(system_u:object_r:mysqlmanagerd_exec_t,s0)
diff --git a/mysql.te b/mysql.te
index e14423d..976d57e 100644
--- a/mysql.te
+++ b/mysql.te
@@ -132,7 +132,7 @@ files_search_var_lib(mysqld_t)
files_search_pids(mysqld_t)
files_getattr_all_sockets(mysqld_t)
-auth_use_nsswitch(mysqld_t)
+auth_use_pam(mysqld_t)
logging_send_syslog_msg(mysqld_t)
diff --git a/nagios.if b/nagios.if
index cad402c..438eeb3 100644
--- a/nagios.if
+++ b/nagios.if
@@ -34,6 +34,26 @@ template(`nagios_plugin_template',`
########################################
## <summary>
+## Execute the nagios unconfined plugins with
+## a domain transition.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`nagios_domtrans_unconfined_plugins',`
+ gen_require(`
+ type nagios_unconfined_plugin_t;
+ type nagios_unconfined_plugin_exec_t;
+ ')
+
+ domtrans_pattern($1, nagios_unconfined_plugin_exec_t, nagios_unconfined_plugin_t)
+')
+
+########################################
+## <summary>
## Do not audit attempts to read or write nagios
## unnamed pipes.
## </summary>
@@ -72,6 +92,25 @@ interface(`nagios_read_config',`
allow $1 nagios_etc_t:file read_file_perms;
files_search_etc($1)
')
+######################################
+## <summary>
+## Read nagios lib files.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`nagios_read_lib',`
+ gen_require(`
+ type nagios_var_lib_t;
+ ')
+
+ files_search_var($1)
+ list_dirs_pattern($1, nagios_var_lib_t, nagios_var_lib_t)
+ read_files_pattern($1, nagios_var_lib_t, nagios_var_lib_t)
+')
######################################
## <summary>
diff --git a/nagios.te b/nagios.te
index 75ed416..e4b8c8a 100644
--- a/nagios.te
+++ b/nagios.te
@@ -5,6 +5,25 @@ policy_module(nagios, 1.13.0)
# Declarations
#
+## <desc>
+## <p>
+## Allow nagios/nrpe to call sudo from NRPE utils scripts.
+## </p>
+## </desc>
+gen_tunable(nagios_run_sudo, false)
+
+## <desc>
+## <p>
+## Allow nagios run in conjunction with PNP4Nagios.
+## </p>
+## </desc>
+gen_tunable(nagios_run_pnp4nagios, false)
+
+gen_require(`
+ class passwd rootok;
+ class passwd passwd;
+')
+
attribute nagios_plugin_domain;
type nagios_t;
@@ -124,7 +143,8 @@ files_spool_filetrans(nagios_t, nagios_spool_t, { file fifo_file })
manage_files_pattern(nagios_t, nagios_var_lib_t, nagios_var_lib_t)
manage_fifo_files_pattern(nagios_t, nagios_var_lib_t, nagios_var_lib_t)
-files_var_lib_filetrans(nagios_t, nagios_var_lib_t, { file fifo_file })
+manage_dirs_pattern(nagios_t, nagios_var_lib_t, nagios_var_lib_t)
+files_var_lib_filetrans(nagios_t, nagios_var_lib_t, { dir file fifo_file })
kernel_read_system_state(nagios_t)
kernel_read_kernel_sysctls(nagios_t)
@@ -168,6 +188,35 @@ mta_send_mail(nagios_t)
mta_signal_system_mail(nagios_t)
mta_kill_system_mail(nagios_t)
+tunable_policy(`nagios_run_sudo',`
+ allow nagios_t self:capability { setuid setgid sys_resource sys_ptrace };
+ allow nagios_t self:process { setrlimit setsched };
+
+ allow nagios_t self:key write;
+
+ allow nagios_t self:passwd { passwd rootok };
+
+ auth_rw_lastlog(nagios_t)
+ auth_rw_faillog(nagios_t)
+
+ auth_domtrans_chkpwd(nagios_t)
+
+ selinux_compute_access_vector(nagios_t)
+
+ logging_send_audit_msgs(nagios_t)
+')
+
+optional_policy(`
+ tunable_policy(`nagios_run_sudo',`
+ sudo_exec(nagios_t)
+ sudo_manage_db(nagios_t)
+ ')
+')
+
+tunable_policy(`nagios_run_pnp4nagios',`
+ allow nagios_t nagios_log_t:file execute;
+')
+
optional_policy(`
netutils_kill_ping(nagios_t)
')
@@ -222,7 +271,7 @@ optional_policy(`
# Nrpe local policy
#
-allow nrpe_t self:capability { setuid setgid };
+allow nrpe_t self:capability { setuid setgid kill };
dontaudit nrpe_t self:capability { sys_tty_config sys_resource };
allow nrpe_t self:process { setpgid signal_perms setsched setrlimit };
allow nrpe_t self:fifo_file rw_fifo_file_perms;
@@ -272,6 +321,32 @@ logging_send_syslog_msg(nrpe_t)
userdom_dontaudit_use_unpriv_user_fds(nrpe_t)
+tunable_policy(`nagios_run_sudo',`
+ allow nrpe_t self:capability { setuid setgid sys_resource sys_ptrace };
+ allow nrpe_t self:process { setrlimit setsched };
+
+ allow nrpe_t self:key write;
+
+ allow nrpe_t self:passwd { passwd rootok };
+
+ auth_rw_lastlog(nrpe_t)
+ auth_rw_faillog(nrpe_t)
+
+ auth_domtrans_chkpwd(nrpe_t)
+
+ selinux_compute_access_vector(nrpe_t)
+
+ logging_send_audit_msgs(nrpe_t)
+')
+
+optional_policy(`
+ tunable_policy(`nagios_run_sudo',`
+ sudo_exec(nrpe_t)
+ sudo_manage_db(nrpe_t)
+ ')
+')
+
+
optional_policy(`
inetd_tcp_service_domain(nrpe_t, nrpe_exec_t)
')
@@ -434,6 +509,7 @@ kernel_read_kernel_sysctls(nagios_system_plugin_t)
corecmd_exec_bin(nagios_system_plugin_t)
corecmd_exec_shell(nagios_system_plugin_t)
+corecmd_getattr_all_executables(nagios_system_plugin_t)
dev_read_sysfs(nagios_system_plugin_t)
diff --git a/passenger.te b/passenger.te
index 231f2e2..56fba2e 100644
--- a/passenger.te
+++ b/passenger.te
@@ -32,7 +32,7 @@ allow passenger_t self:capability { chown dac_override fsetid fowner kill setuid
allow passenger_t self:capability2 block_suspend;
allow passenger_t self:process { setpgid setsched getsession signal_perms };
allow passenger_t self:fifo_file rw_fifo_file_perms;
-allow passenger_t self:tcp_socket listen;
+allow passenger_t self:tcp_socket { accept listen };
allow passenger_t self:unix_stream_socket { create_stream_socket_perms connectto };
can_exec(passenger_t, passenger_exec_t)
diff --git a/qpid.te b/qpid.te
index fc17eee..8f641fc 100644
--- a/qpid.te
+++ b/qpid.te
@@ -46,13 +46,15 @@ fs_tmpfs_filetrans(qpidd_t, qpidd_tmpfs_t, { dir file })
manage_dirs_pattern(qpidd_t, qpidd_var_lib_t, qpidd_var_lib_t)
manage_files_pattern(qpidd_t, qpidd_var_lib_t, qpidd_var_lib_t)
-files_var_lib_filetrans(qpidd_t, qpidd_var_lib_t, { file dir })
+manage_lnk_files_pattern(qpidd_t, qpidd_var_lib_t, qpidd_var_lib_t)
+files_var_lib_filetrans(qpidd_t, qpidd_var_lib_t, { file dir lnk_file })
manage_dirs_pattern(qpidd_t, qpidd_var_run_t, qpidd_var_run_t)
manage_files_pattern(qpidd_t, qpidd_var_run_t, qpidd_var_run_t)
files_pid_filetrans(qpidd_t, qpidd_var_run_t, { file dir })
kernel_read_system_state(qpidd_t)
+kernel_read_network_state(qpidd_t)
auth_read_passwd(qpidd_t)
@@ -64,6 +66,7 @@ corenet_tcp_sendrecv_generic_node(qpidd_t)
corenet_sendrecv_amqp_server_packets(qpidd_t)
corenet_tcp_bind_amqp_port(qpidd_t)
corenet_tcp_sendrecv_amqp_port(qpidd_t)
+corenet_tcp_connect_amqp_port(qpidd_t)
corenet_tcp_bind_matahari_port(qpidd_t)
corenet_tcp_connect_matahari_port(qpidd_t)
diff --git a/rhcs.if b/rhcs.if
index bf60580..29df561 100644
--- a/rhcs.if
+++ b/rhcs.if
@@ -864,6 +864,29 @@ interface(`rhcs_systemctl_cluster',`
ps_process_pattern($1, cluster_t)
')
+########################################
+## <summary>
+## Send and receive messages from
+## a cluster service over dbus.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`rhcs_dbus_chat_cluster',`
+ gen_require(`
+ type cluster_t;
+ class dbus send_msg;
+ ')
+
+ allow $1 cluster_t:dbus send_msg;
+ allow cluster_t $1:dbus send_msg;
+')
+
+
+
#####################################
## <summary>
## All of the rules required to administrate
diff --git a/rhcs.te b/rhcs.te
index 25c0f70..0706417 100644
--- a/rhcs.te
+++ b/rhcs.te
@@ -218,6 +218,8 @@ init_read_script_state(cluster_t)
init_rw_script_tmp_files(cluster_t)
init_manage_script_status_files(cluster_t)
+systemd_dbus_chat_logind(cluster_t)
+
userdom_delete_user_tmp_files(cluster_t)
userdom_rw_user_tmp_files(cluster_t)
userdom_kill_all_users(cluster_t)
diff --git a/samba.if b/samba.if
index 59296a2..7662d37 100644
--- a/samba.if
+++ b/samba.if
@@ -622,6 +622,23 @@ interface(`samba_signal_smbd',`
allow $1 smbd_t:process signal;
')
+######################################
+## <summary>
+## Allow domain to signull samba
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`samba_signull_smbd',`
+ gen_require(`
+ type smbd_t;
+ ')
+ allow $1 smbd_t:process signull;
+')
+
########################################
## <summary>
## Do not audit attempts to use file descriptors from samba.
@@ -758,6 +775,40 @@ interface(`samba_read_winbind_pid',`
allow $1 winbind_var_run_t:file read_file_perms;
')
+######################################
+## <summary>
+## Allow domain to signull winbind
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`samba_signull_winbind',`
+ gen_require(`
+ type winbind_t;
+ ')
+ allow $1 winbind_t:process signull;
+')
+
+######################################
+## <summary>
+## Allow domain to signull samba_unconfined_net
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`samba_signull_unconfined_net',`
+ gen_require(`
+ type samba_unconfined_net_t;
+ ')
+ allow $1 samba_unconfined_net_t:process signull;
+')
+
########################################
## <summary>
## Connect to winbind.
diff --git a/samba.te b/samba.te
index 13c975b..9249311 100644
--- a/samba.te
+++ b/samba.te
@@ -80,6 +80,13 @@ gen_tunable(samba_share_nfs, false)
## </desc>
gen_tunable(samba_share_fusefs, false)
+## <desc>
+## <p>
+## Allow smbd to load libgfapi from gluster.
+## </p>
+## </desc>
+gen_tunable(samba_load_libgfapi, false)
+
type nmbd_t;
type nmbd_exec_t;
init_daemon_domain(nmbd_t, nmbd_exec_t)
@@ -237,6 +244,13 @@ userdom_use_inherited_user_terminals(samba_net_t)
userdom_list_user_home_dirs(samba_net_t)
optional_policy(`
+ ctdbd_stream_connect(samba_net_t)
+ ctdbd_manage_var_files(samba_net_t)
+ ctdbd_manage_lib_dirs(samba_net_t)
+ ctdbd_manage_lib_files(samba_net_t)
+')
+
+optional_policy(`
ldap_stream_connect(samba_net_t)
dirsrv_stream_connect(samba_net_t)
')
@@ -260,8 +274,9 @@ optional_policy(`
# smbd Local policy
#
-allow smbd_t self:capability { chown fowner kill fsetid setgid setuid sys_chroot sys_nice sys_admin sys_resource lease dac_override dac_read_search };
+allow smbd_t self:capability { chown fowner kill fsetid setgid setuid sys_chroot sys_nice sys_admin sys_resource lease dac_override dac_read_search net_admin };
dontaudit smbd_t self:capability sys_tty_config;
+dontaudit smbd_t self:capability2 block_suspend;
allow smbd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
allow smbd_t self:process setrlimit;
allow smbd_t self:fd use;
@@ -338,6 +353,7 @@ allow smbd_t winbind_t:process { signal signull };
kernel_getattr_core_if(smbd_t)
kernel_getattr_message_if(smbd_t)
kernel_read_network_state(smbd_t)
+kernel_read_net_sysctls(smbd_t)
kernel_read_fs_sysctls(smbd_t)
kernel_read_kernel_sysctls(smbd_t)
kernel_read_usermodehelper_state(smbd_t)
@@ -463,14 +479,21 @@ tunable_policy(`samba_share_fusefs',`
fs_search_fusefs(smbd_t)
')
+tunable_policy(`samba_load_libgfapi',`
+ corenet_tcp_connect_all_ports(smbd_t)
+ corenet_tcp_bind_all_ports(smbd_t)
+ corenet_sendrecv_all_packets(smbd_t)
+')
+
optional_policy(`
ccs_read_config(smbd_t)
')
optional_policy(`
ctdbd_stream_connect(smbd_t)
- ctdbd_manage_lib_files(smbd_t)
ctdbd_manage_var_files(smbd_t)
+ ctdbd_manage_lib_files(smbd_t)
+ ctdbd_manage_lib_dirs(smbd_t)
')
optional_policy(`
@@ -488,6 +511,11 @@ optional_policy(`
')
optional_policy(`
+ glusterd_read_conf(smbd_t)
+ glusterd_rw_lib(smbd_t)
+')
+
+optional_policy(`
kerberos_read_keytab(smbd_t)
kerberos_use(smbd_t)
')
@@ -643,6 +671,7 @@ userdom_dontaudit_search_user_home_dirs(nmbd_t)
optional_policy(`
ctdbd_stream_connect(nmbd_t)
ctdbd_manage_var_files(nmbd_t)
+ ctdbd_manage_lib_dirs(nmbd_t)
ctdbd_manage_lib_files(nmbd_t)
')
@@ -900,7 +929,7 @@ allow winbind_t self:capability2 block_suspend;
dontaudit winbind_t self:capability sys_tty_config;
allow winbind_t self:process { signal_perms getsched setsched };
allow winbind_t self:fifo_file rw_fifo_file_perms;
-allow winbind_t self:unix_dgram_socket create_socket_perms;
+allow winbind_t self:unix_dgram_socket { create_socket_perms sendto };
allow winbind_t self:unix_stream_socket create_stream_socket_perms;
allow winbind_t self:tcp_socket create_stream_socket_perms;
allow winbind_t self:udp_socket create_socket_perms;
@@ -1001,8 +1030,9 @@ userdom_filetrans_home_content(winbind_t)
optional_policy(`
ctdbd_stream_connect(winbind_t)
+ ctdbd_manage_var_files(winbind_t)
ctdbd_manage_lib_files(winbind_t)
- ctdbd_manage_var_files(winbind_t)
+ ctdbd_manage_lib_dirs(winbind_t)
')
diff --git a/virt.if b/virt.if
index 01641f5..90e8a28 100644
--- a/virt.if
+++ b/virt.if
@@ -357,6 +357,7 @@ interface(`virt_read_pid_files',`
files_search_pids($1)
read_files_pattern($1, virt_var_run_t, virt_var_run_t)
+ read_lnk_files_pattern($1, virt_var_run_t, virt_var_run_t)
')
########################################