From 48b1d0b0a0cd270b9fb210dadfa4ea4e34136364 Mon Sep 17 00:00:00 2001 From: Chris PeBenito Date: May 05 2006 17:53:45 +0000 Subject: add afs, bug 1514 --- diff --git a/refpolicy/Changelog b/refpolicy/Changelog index 8b3485e..e361e59 100644 --- a/refpolicy/Changelog +++ b/refpolicy/Changelog @@ -36,6 +36,7 @@ - Fix temporary rules at the bottom of portmap. - Updated comments in mls file from Chad Hanson. - Added modules: + afs amavis (Erich Schubert) apt (Erich Schubert) asterisk diff --git a/refpolicy/policy/modules/services/afs.fc b/refpolicy/policy/modules/services/afs.fc new file mode 100644 index 0000000..1689223 --- /dev/null +++ b/refpolicy/policy/modules/services/afs.fc @@ -0,0 +1,22 @@ +/usr/afs/bin/bosserver -- gen_context(system_u:object_r:afs_bosserver_exec_t,s0) +/usr/afs/bin/fileserver -- gen_context(system_u:object_r:afs_fsserver_exec_t,s0) +/usr/afs/bin/kaserver -- gen_context(system_u:object_r:afs_kaserver_exec_t,s0) +/usr/afs/bin/ptserver -- gen_context(system_u:object_r:afs_ptserver_exec_t,s0) +/usr/afs/bin/salvager -- gen_context(system_u:object_r:afs_fsserver_exec_t,s0) +/usr/afs/bin/volserver -- gen_context(system_u:object_r:afs_fsserver_exec_t,s0) +/usr/afs/bin/vlserver -- gen_context(system_u:object_r:afs_vlserver_exec_t,s0) + +/usr/afs/db -d gen_context(system_u:object_r:afs_dbdir_t,s0) +/usr/afs/db/pr.* -- gen_context(system_u:object_r:afs_pt_db_t,s0) +/usr/afs/db/ka.* -- gen_context(system_u:object_r:afs_ka_db_t,s0) +/usr/afs/db/vl.* -- gen_context(system_u:object_r:afs_vl_db_t,s0) + +/usr/afs/etc(/.*)? gen_context(system_u:object_r:afs_config_t,s0) + +/usr/afs/local(/.*)? gen_context(system_u:object_r:afs_config_t,s0) + +/usr/afs/logs(/.*)? gen_context(system_u:object_r:afs_logfile_t,s0) + +/vicepa gen_context(system_u:object_r:afs_files_t,s0) +/vicepb gen_context(system_u:object_r:afs_files_t,s0) +/vicepc gen_context(system_u:object_r:afs_files_t,s0) diff --git a/refpolicy/policy/modules/services/afs.if b/refpolicy/policy/modules/services/afs.if new file mode 100644 index 0000000..e84153f --- /dev/null +++ b/refpolicy/policy/modules/services/afs.if @@ -0,0 +1 @@ +## Andrew Filesystem server diff --git a/refpolicy/policy/modules/services/afs.te b/refpolicy/policy/modules/services/afs.te new file mode 100644 index 0000000..ffcc7e1 --- /dev/null +++ b/refpolicy/policy/modules/services/afs.te @@ -0,0 +1,337 @@ + +policy_module(afs,1.0.0) + +######################################## +# +# Declarations +# + +type afs_bosserver_t; +type afs_bosserver_exec_t; +init_daemon_domain(afs_bosserver_t,afs_bosserver_exec_t) + +type afs_config_t; +files_type(afs_config_t) + +type afs_dbdir_t; +files_type(afs_dbdir_t) + +# exported files +type afs_files_t; +files_type(afs_files_t) + +type afs_fsserver_t; +type afs_fsserver_exec_t; +domain_type(afs_fsserver_t) +domain_entry_file(afs_fsserver_t,afs_fsserver_exec_t) +role system_r types afs_fsserver_t; + +type afs_ka_db_t; +files_type(afs_ka_db_t) + +type afs_kaserver_t; +type afs_kaserver_exec_t; +domain_type(afs_kaserver_t) +domain_entry_file(afs_kaserver_t,afs_kaserver_exec_t) +role system_r types afs_kaserver_t; + +type afs_logfile_t; +logging_log_file(afs_logfile_t) + +type afs_pt_db_t; +files_type(afs_pt_db_t) + +type afs_ptserver_t; +type afs_ptserver_exec_t; +domain_type(afs_ptserver_t) +domain_entry_file(afs_ptserver_t,afs_ptserver_exec_t) +role system_r types afs_ptserver_t; + +type afs_vl_db_t; +files_type(afs_vl_db_t) + +type afs_vlserver_t; +type afs_vlserver_exec_t; +domain_type(afs_vlserver_t) +domain_entry_file(afs_vlserver_t,afs_vlserver_exec_t) +role system_r types afs_vlserver_t; + +######################################## +# +# AFS bossserver local policy +# + +allow afs_bosserver_t self:process { setsched signal_perms }; +allow afs_bosserver_t self:tcp_socket create_stream_socket_perms; +allow afs_bosserver_t self:udp_socket create_socket_perms; + +can_exec(afs_bosserver_t,afs_bosserver_exec_t) + +allow afs_bosserver_t afs_config_t:file manage_file_perms; +allow afs_bosserver_t afs_config_t:dir manage_dir_perms; + +allow afs_bosserver_t afs_dbdir_t:dir { search read getattr }; + +allow afs_bosserver_t afs_fsserver_t:process signal_perms; +domain_auto_trans(afs_bosserver_t, afs_fsserver_exec_t, afs_fsserver_t) +allow afs_fsserver_t afs_bosserver_t:fd use; +allow afs_fsserver_t afs_bosserver_t:fifo_file rw_file_perms; +allow afs_fsserver_t afs_bosserver_t:process sigchld; + +allow afs_bosserver_t afs_kaserver_t:process signal_perms; +domain_auto_trans(afs_bosserver_t, afs_kaserver_exec_t, afs_kaserver_t) +allow afs_kaserver_t afs_bosserver_t:fd use; +allow afs_kaserver_t afs_bosserver_t:fifo_file rw_file_perms; +allow afs_kaserver_t afs_bosserver_t:process sigchld; + +allow afs_bosserver_t afs_logfile_t:file create_file_perms; +allow afs_bosserver_t afs_logfile_t:dir create_dir_perms; + +allow afs_bosserver_t afs_ptserver_t:process signal_perms; +domain_auto_trans(afs_bosserver_t, afs_ptserver_exec_t, afs_ptserver_t) +allow afs_ptserver_t afs_bosserver_t:fd use; +allow afs_ptserver_t afs_bosserver_t:fifo_file rw_file_perms; +allow afs_ptserver_t afs_bosserver_t:process sigchld; + +allow afs_bosserver_t afs_vlserver_t:process signal_perms; +domain_auto_trans(afs_bosserver_t, afs_vlserver_exec_t, afs_vlserver_t) +allow afs_vlserver_t afs_bosserver_t:fd use; +allow afs_vlserver_t afs_bosserver_t:fifo_file rw_file_perms; +allow afs_vlserver_t afs_bosserver_t:process sigchld; + +kernel_read_kernel_sysctls(afs_bosserver_t) + +corenet_non_ipsec_sendrecv(afs_bosserver_t) +corenet_tcp_sendrecv_generic_if(afs_bosserver_t) +corenet_udp_sendrecv_generic_if(afs_bosserver_t) +corenet_tcp_sendrecv_all_nodes(afs_bosserver_t) +corenet_udp_sendrecv_all_nodes(afs_bosserver_t) +corenet_tcp_sendrecv_all_ports(afs_bosserver_t) +corenet_udp_sendrecv_all_ports(afs_bosserver_t) +corenet_udp_bind_all_nodes(afs_bosserver_t) +corenet_udp_bind_afs_bos_port(afs_bosserver_t) + +files_read_etc_files(afs_bosserver_t) +files_list_home(afs_bosserver_t) +files_read_usr_files(afs_bosserver_t) + +libs_use_ld_so(afs_bosserver_t) +libs_use_shared_libs(afs_bosserver_t) + +miscfiles_read_localization(afs_bosserver_t) + +seutil_read_config(afs_bosserver_t) + +sysnet_read_config(afs_bosserver_t) + +######################################## +# +# fileserver local policy +# + +allow afs_fsserver_t self:capability { kill dac_override chown fowner sys_nice }; +dontaudit afs_fsserver_t self:capability fsetid; +allow afs_fsserver_t self:process { setsched signal_perms }; +allow afs_fsserver_t self:fifo_file rw_file_perms; +allow afs_fsserver_t self:tcp_socket { create_stream_socket_perms connectto acceptfrom recvfrom }; +allow afs_fsserver_t self:udp_socket { create_socket_perms sendto recvfrom }; + +allow afs_fsserver_t afs_config_t:file r_file_perms; +allow afs_fsserver_t afs_config_t:dir r_dir_perms; + +allow afs_fsserver_t afs_config_t:file manage_file_perms; +allow afs_fsserver_t afs_config_t:dir manage_dir_perms; + +allow afs_fsserver_t afs_files_t:filesystem getattr; +allow afs_fsserver_t afs_files_t:dir manage_dir_perms; +allow afs_fsserver_t afs_files_t:file manage_file_perms; +allow afs_fsserver_t afs_files_t:lnk_file create_lnk_perms; +allow afs_fsserver_t afs_files_t:sock_file manage_file_perms; +allow afs_fsserver_t afs_files_t:fifo_file manage_file_perms; +type_transition afs_fsserver_t afs_config_t:{ file lnk_file sock_file fifo_file } afs_files_t; +allow afs_fsserver_t afs_config_t:dir rw_dir_perms; + +can_exec(afs_fsserver_t, afs_fsserver_exec_t) + +allow afs_fsserver_t afs_logfile_t:file create_file_perms; +allow afs_fsserver_t afs_logfile_t:dir create_dir_perms; + +allow afs_fsserver_t afs_ptserver_t:udp_socket recvfrom; + +allow afs_fsserver_t afs_vlserver_t:udp_socket recvfrom; + +kernel_read_system_state(afs_fsserver_t) +kernel_read_kernel_sysctls(afs_fsserver_t) + +corenet_tcp_sendrecv_generic_if(afs_fsserver_t) +corenet_udp_sendrecv_generic_if(afs_fsserver_t) +corenet_tcp_sendrecv_all_nodes(afs_fsserver_t) +corenet_udp_sendrecv_all_nodes(afs_fsserver_t) +corenet_tcp_sendrecv_all_ports(afs_fsserver_t) +corenet_udp_sendrecv_all_ports(afs_fsserver_t) +corenet_non_ipsec_sendrecv(afs_fsserver_t) +corenet_tcp_bind_all_nodes(afs_fsserver_t) +corenet_udp_bind_all_nodes(afs_fsserver_t) +corenet_tcp_bind_afs_fs_port(afs_fsserver_t) +corenet_udp_bind_afs_fs_port(afs_fsserver_t) + +files_read_etc_files(afs_fsserver_t) +files_read_etc_runtime_files(afs_fsserver_t) +files_list_home(afs_fsserver_t) +files_read_usr_files(afs_fsserver_t) +files_list_pids(afs_fsserver_t) +files_dontaudit_search_mnt(afs_fsserver_t) + +fs_getattr_xattr_fs(afs_fsserver_t) + +term_dontaudit_use_console(afs_fsserver_t) + +init_dontaudit_use_script_fds(afs_fsserver_t) + +libs_use_ld_so(afs_fsserver_t) +libs_use_shared_libs(afs_fsserver_t) + +logging_send_syslog_msg(afs_fsserver_t) + +miscfiles_read_localization(afs_fsserver_t) + +seutil_read_config(afs_fsserver_t) + +sysnet_read_config(afs_fsserver_t) + +userdom_dontaudit_use_sysadm_ttys(afs_fsserver_t) +userdom_dontaudit_use_sysadm_ptys(afs_fsserver_t) + +######################################## +# +# kaserver local policy +# + +allow afs_kaserver_t self:unix_stream_socket create_stream_socket_perms; +allow afs_kaserver_t self:tcp_socket create_stream_socket_perms; +allow afs_kaserver_t self:udp_socket create_socket_perms; + +allow afs_kaserver_t afs_config_t:file manage_file_perms; +allow afs_kaserver_t afs_config_t:dir rw_dir_perms; + +allow afs_kaserver_t afs_ka_db_t:file manage_file_perms; +allow afs_kaserver_t afs_dbdir_t:dir rw_dir_perms; +type_transition afs_kaserver_t afs_dbdir_t:file afs_ka_db_t; + +allow afs_kaserver_t afs_logfile_t:file manage_file_perms; +allow afs_kaserver_t afs_logfile_t:dir manage_dir_perms; + +kernel_read_kernel_sysctls(afs_kaserver_t) + +corenet_non_ipsec_sendrecv(afs_kaserver_t) +corenet_tcp_sendrecv_generic_if(afs_kaserver_t) +corenet_udp_sendrecv_generic_if(afs_kaserver_t) +corenet_tcp_sendrecv_all_nodes(afs_kaserver_t) +corenet_udp_sendrecv_all_nodes(afs_kaserver_t) +corenet_tcp_sendrecv_all_ports(afs_kaserver_t) +corenet_udp_sendrecv_all_ports(afs_kaserver_t) +corenet_udp_bind_all_nodes(afs_kaserver_t) +corenet_udp_bind_afs_ka_port(afs_kaserver_t) +corenet_udp_bind_kerberos_port(afs_kaserver_t) + +files_read_etc_files(afs_kaserver_t) +files_list_home(afs_kaserver_t) +files_read_usr_files(afs_kaserver_t) + +libs_use_ld_so(afs_kaserver_t) +libs_use_shared_libs(afs_kaserver_t) + +miscfiles_read_localization(afs_kaserver_t) + +seutil_read_config(afs_kaserver_t) + +sysnet_read_config(afs_kaserver_t) + +userdom_dontaudit_use_sysadm_ttys(afs_kaserver_t) +userdom_dontaudit_use_sysadm_ptys(afs_kaserver_t) + +######################################## +# +# ptserver local policy +# + +allow afs_ptserver_t self:unix_stream_socket create_stream_socket_perms; +allow afs_ptserver_t self:tcp_socket create_stream_socket_perms; +allow afs_ptserver_t self:udp_socket create_socket_perms; + +allow afs_ptserver_t afs_config_t:file r_file_perms; +allow afs_ptserver_t afs_config_t:dir r_dir_perms; + +allow afs_ptserver_t afs_logfile_t:file create_file_perms; +allow afs_ptserver_t afs_logfile_t:dir create_dir_perms; + +allow afs_ptserver_t afs_fsserver_t:udp_socket recvfrom; + +allow afs_ptserver_t afs_pt_db_t:file manage_file_perms; +allow afs_ptserver_t afs_dbdir_t:dir rw_dir_perms; +type_transition afs_ptserver_t afs_dbdir_t:file afs_pt_db_t; + +corenet_non_ipsec_sendrecv(afs_ptserver_t) +corenet_tcp_sendrecv_generic_if(afs_ptserver_t) +corenet_udp_sendrecv_generic_if(afs_ptserver_t) +corenet_tcp_sendrecv_all_nodes(afs_ptserver_t) +corenet_udp_sendrecv_all_nodes(afs_ptserver_t) +corenet_tcp_sendrecv_all_ports(afs_ptserver_t) +corenet_udp_sendrecv_all_ports(afs_ptserver_t) +corenet_udp_bind_all_nodes(afs_ptserver_t) +corenet_udp_bind_afs_pt_port(afs_ptserver_t) + +files_read_etc_files(afs_ptserver_t) + +libs_use_ld_so(afs_ptserver_t) +libs_use_shared_libs(afs_ptserver_t) + +miscfiles_read_localization(afs_ptserver_t) + +sysnet_read_config(afs_ptserver_t) + +userdom_dontaudit_use_sysadm_ttys(afs_ptserver_t) +userdom_dontaudit_use_sysadm_ptys(afs_ptserver_t) + +######################################## +# +# vlserver local policy +# + +allow afs_vlserver_t self:unix_stream_socket create_stream_socket_perms; +allow afs_vlserver_t self:tcp_socket create_stream_socket_perms; +allow afs_vlserver_t self:udp_socket create_socket_perms; + +allow afs_vlserver_t afs_config_t:file r_file_perms; +allow afs_vlserver_t afs_config_t:dir r_dir_perms; + +allow afs_vlserver_t afs_fsserver_t:udp_socket recvfrom; + +allow afs_vlserver_t afs_logfile_t:file create_file_perms; +allow afs_vlserver_t afs_logfile_t:dir create_dir_perms; + +allow afs_vlserver_t afs_vl_db_t:file manage_file_perms; +allow afs_vlserver_t afs_dbdir_t:dir rw_dir_perms; +type_transition afs_vlserver_t afs_dbdir_t:file afs_vl_db_t; + +corenet_non_ipsec_sendrecv(afs_vlserver_t) +corenet_tcp_sendrecv_generic_if(afs_vlserver_t) +corenet_udp_sendrecv_generic_if(afs_vlserver_t) +corenet_tcp_sendrecv_all_nodes(afs_vlserver_t) +corenet_udp_sendrecv_all_nodes(afs_vlserver_t) +corenet_tcp_sendrecv_all_ports(afs_vlserver_t) +corenet_udp_sendrecv_all_ports(afs_vlserver_t) +corenet_udp_bind_all_nodes(afs_vlserver_t) +corenet_udp_bind_afs_vl_port(afs_vlserver_t) + +files_read_etc_files(afs_vlserver_t) + +libs_use_ld_so(afs_vlserver_t) +libs_use_shared_libs(afs_vlserver_t) + +miscfiles_read_localization(afs_vlserver_t) + +sysnet_read_config(afs_vlserver_t) + +userdom_dontaudit_use_sysadm_ttys(afs_vlserver_t) +userdom_dontaudit_use_sysadm_ptys(afs_vlserver_t)