From 4b121a5f534d93ae0451e1a2ecf5917285238541 Mon Sep 17 00:00:00 2001 From: Jeremy Solt Date: Apr 19 2010 14:19:44 +0000 Subject: nis patch from Dan Walsh Made a couple style changes. Removed unnecessary require in nis_use_ypbind interface --- diff --git a/policy/modules/services/nis.fc b/policy/modules/services/nis.fc index ee62b9d..15448d5 100644 --- a/policy/modules/services/nis.fc +++ b/policy/modules/services/nis.fc @@ -1,4 +1,7 @@ - +/etc/rc\.d/init\.d/ypbind -- gen_context(system_u:object_r:ypbind_initrc_exec_t,s0) +/etc/rc\.d/init\.d/yppasswd -- gen_context(system_u:object_r:nis_initrc_exec_t,s0) +/etc/rc\.d/init\.d/ypserv -- gen_context(system_u:object_r:nis_initrc_exec_t,s0) +/etc/rc\.d/init\.d/ypxfrd -- gen_context(system_u:object_r:nis_initrc_exec_t,s0) /etc/ypserv\.conf -- gen_context(system_u:object_r:ypserv_conf_t,s0) /sbin/ypbind -- gen_context(system_u:object_r:ypbind_exec_t,s0) @@ -11,3 +14,8 @@ /usr/sbin/ypserv -- gen_context(system_u:object_r:ypserv_exec_t,s0) /var/yp(/.*)? gen_context(system_u:object_r:var_yp_t,s0) + +/var/run/ypxfrd.* -- gen_context(system_u:object_r:ypxfr_var_run_t,s0) +/var/run/ypbind.* -- gen_context(system_u:object_r:ypbind_var_run_t,s0) +/var/run/ypserv.* -- gen_context(system_u:object_r:ypserv_var_run_t,s0) +/var/run/yppass.* -- gen_context(system_u:object_r:yppasswdd_var_run_t,s0) diff --git a/policy/modules/services/nis.if b/policy/modules/services/nis.if index c0c0267..055f002 100644 --- a/policy/modules/services/nis.if +++ b/policy/modules/services/nis.if @@ -28,7 +28,7 @@ interface(`nis_use_ypbind_uncond',` type var_yp_t; ') - dontaudit $1 self:capability net_bind_service; + allow $1 self:capability net_bind_service; allow $1 self:tcp_socket create_stream_socket_perms; allow $1 self:udp_socket create_socket_perms; @@ -133,11 +133,37 @@ interface(`nis_domtrans_ypbind',` ######################################## ## +## Execute ypbind in the ypbind domain, and +## allow the specified role the ypbind domain. +## +## +## +## Domain allowed access. +## +## +## +## +## The role to be allowed the ypbind domain. +## +## +## +# +interface(`nis_run_ypbind',` + gen_require(` + type ypbind_t; + ') + + nis_domtrans_ypbind($1) + role $2 types ypbind_t; +') + +######################################## +## ## Send generic signals to ypbind. ## ## ## -## The type of the process performing this action. +## Domain allowed access. ## ## # @@ -155,7 +181,7 @@ interface(`nis_signal_ypbind',` ## ## ## -## The type of the process performing this action. +## Domain allowed access. ## ## # @@ -174,7 +200,7 @@ interface(`nis_list_var_yp',` ## ## ## -## The type of the process performing this action. +## Domain allowed access. ## ## # @@ -274,6 +300,43 @@ interface(`nis_domtrans_ypxfr',` ######################################## ## +## Execute nis server in the nis domain. +## +## +## +## Domain allowed access. +## +## +# +# +interface(`nis_initrc_domtrans',` + gen_require(` + type nis_initrc_exec_t; + ') + + init_labeled_script_domtrans($1, nis_initrc_exec_t) +') + +######################################## +## +## Execute nis server in the nis domain. +## +## +## +## Domain allowed access. +## +## +# +interface(`nis_ypbind_initrc_domtrans',` + gen_require(` + type ypbind_initrc_exec_t; + ') + + init_labeled_script_domtrans($1, ypbind_initrc_exec_t) +') + +######################################## +## ## All of the rules required to administrate ## an nis environment ## @@ -294,6 +357,7 @@ interface(`nis_admin',` type ypbind_t, yppasswdd_t, ypserv_t, ypxfr_t; type ypbind_tmp_t, ypserv_tmp_t, ypserv_conf_t; type ypbind_var_run_t, yppasswdd_var_run_t, ypserv_var_run_t; + type ypbind_initrc_exec_t, nis_initrc_exec_t; ') allow $1 ypbind_t:process { ptrace signal_perms }; @@ -308,6 +372,13 @@ interface(`nis_admin',` allow $1 ypxfr_t:process { ptrace signal_perms }; ps_process_pattern($1, ypxfr_t) + nis_initrc_domtrans($1) + nis_ypbind_initrc_domtrans($1) + domain_system_change_exemption($1) + role_transition $2 nis_initrc_exec_t system_r; + role_transition $2 ypbind_initrc_exec_t system_r; + allow $2 system_r; + files_list_tmp($1) admin_pattern($1, ypbind_tmp_t) diff --git a/policy/modules/services/nis.te b/policy/modules/services/nis.te index 6e72bfb..775dfbe 100644 --- a/policy/modules/services/nis.te +++ b/policy/modules/services/nis.te @@ -13,6 +13,9 @@ type ypbind_t; type ypbind_exec_t; init_daemon_domain(ypbind_t, ypbind_exec_t) +type ypbind_initrc_exec_t; +init_script_file(ypbind_initrc_exec_t) + type ypbind_tmp_t; files_tmp_file(ypbind_tmp_t) @@ -44,6 +47,12 @@ type ypxfr_t; type ypxfr_exec_t; init_daemon_domain(ypxfr_t, ypxfr_exec_t) +type ypxfr_var_run_t; +files_pid_file(ypxfr_var_run_t) + +type nis_initrc_exec_t; +init_script_file(nis_initrc_exec_t) + ######################################## # # ypbind local policy @@ -65,9 +74,8 @@ files_pid_filetrans(ypbind_t, ypbind_var_run_t, file) manage_files_pattern(ypbind_t, var_yp_t, var_yp_t) +kernel_read_system_state(ypbind_t) kernel_read_kernel_sysctls(ypbind_t) -kernel_list_proc(ypbind_t) -kernel_read_proc_symlinks(ypbind_t) corenet_all_recvfrom_unlabeled(ypbind_t) corenet_all_recvfrom_netlabel(ypbind_t) @@ -136,7 +144,7 @@ optional_policy(` allow yppasswdd_t self:capability dac_override; dontaudit yppasswdd_t self:capability sys_tty_config; allow yppasswdd_t self:fifo_file rw_fifo_file_perms; -allow yppasswdd_t self:process { setfscreate signal_perms }; +allow yppasswdd_t self:process { getsched setfscreate signal_perms }; allow yppasswdd_t self:unix_dgram_socket create_socket_perms; allow yppasswdd_t self:unix_stream_socket create_stream_socket_perms; allow yppasswdd_t self:netlink_route_socket r_netlink_socket_perms; @@ -250,6 +258,8 @@ corenet_tcp_sendrecv_all_ports(ypserv_t) corenet_udp_sendrecv_all_ports(ypserv_t) corenet_tcp_bind_generic_node(ypserv_t) corenet_udp_bind_generic_node(ypserv_t) +corenet_tcp_bind_reserved_port(ypserv_t) +corenet_udp_bind_reserved_port(ypserv_t) corenet_tcp_bind_all_rpc_ports(ypserv_t) corenet_udp_bind_all_rpc_ports(ypserv_t) corenet_dontaudit_tcp_bind_all_reserved_ports(ypserv_t) @@ -305,6 +315,9 @@ allow ypxfr_t ypserv_t:udp_socket { read write }; allow ypxfr_t ypserv_conf_t:file read_file_perms; +manage_files_pattern(ypxfr_t, ypxfr_var_run_t, ypxfr_var_run_t) +files_pid_filetrans(ypxfr_t, ypxfr_var_run_t, file) + corenet_all_recvfrom_unlabeled(ypxfr_t) corenet_all_recvfrom_netlabel(ypxfr_t) corenet_tcp_sendrecv_generic_if(ypxfr_t) @@ -315,6 +328,8 @@ corenet_tcp_sendrecv_all_ports(ypxfr_t) corenet_udp_sendrecv_all_ports(ypxfr_t) corenet_tcp_bind_generic_node(ypxfr_t) corenet_udp_bind_generic_node(ypxfr_t) +corenet_tcp_bind_reserved_port(ypxfr_t) +corenet_udp_bind_reserved_port(ypxfr_t) corenet_tcp_bind_all_rpc_ports(ypxfr_t) corenet_udp_bind_all_rpc_ports(ypxfr_t) corenet_dontaudit_tcp_bind_all_reserved_ports(ypxfr_t)