From 73fbc771d17cc804144190f289742a0e6581925b Mon Sep 17 00:00:00 2001 From: Chris PeBenito Date: Jun 24 2005 19:49:46 +0000 Subject: initial commit --- diff --git a/refpolicy/policy/modules/services/nis.fc b/refpolicy/policy/modules/services/nis.fc new file mode 100644 index 0000000..82cfe93 --- /dev/null +++ b/refpolicy/policy/modules/services/nis.fc @@ -0,0 +1,6 @@ + +/etc/ypserv\.conf -- system_u:object_r:ypserv_conf_t + +/sbin/ypbind -- system_u:object_r:ypbind_exec_t + +/usr/sbin/ypserv -- system_u:object_r:ypserv_exec_t diff --git a/refpolicy/policy/modules/services/nis.if b/refpolicy/policy/modules/services/nis.if new file mode 100644 index 0000000..bb12358 --- /dev/null +++ b/refpolicy/policy/modules/services/nis.if @@ -0,0 +1,89 @@ +## Policy for NIS (YP) servers and clients + +######################################## +## +## Use the ypbind service to access NIS services. +## +## +## The type of the process performing this action. +## +# +interface(`nis_use_ypbind',` + gen_require(` + type var_yp_t; + class dir r_dir_perms; + class lnk_file r_file_perms; + class file r_file_perms; + class capability net_bind_service; + class tcp_socket create_stream_socket_perms; + class udp_socket create_socket_perms; + ') + + tunable_policy(`allow_ypbind',` + dontaudit $1 self:capability net_bind_service; + + allow $1 self:tcp_socket { listen accept }; + allow $1 self:tcp_socket { create connect ioctl read getattr write setattr append bind getopt setopt shutdown }; + allow $1 self:udp_socket { create ioctl read getattr write setattr append bind getopt setopt shutdown }; + + allow $1 var_yp_t:dir r_dir_perms; + allow $1 var_yp_t:lnk_file r_file_perms; + allow $1 var_yp_t:file r_file_perms; + + corenet_tcp_sendrecv_all_if($1) + corenet_udp_sendrecv_all_if($1) + corenet_raw_sendrecv_all_if($1) + corenet_tcp_sendrecv_all_nodes($1) + corenet_udp_sendrecv_all_nodes($1) + corenet_raw_sendrecv_all_nodes($1) + corenet_tcp_bind_all_nodes($1) + corenet_udp_bind_all_nodes($1) + corenet_tcp_sendrecv_all_ports($1) + corenet_udp_sendrecv_all_ports($1) + corenet_tcp_bind_generic_port($1) + corenet_udp_bind_generic_port($1) + corenet_tcp_bind_reserved_port($1) + corenet_udp_bind_reserved_port($1) + corenet_dontaudit_tcp_bind_all_reserved_ports($1) + corenet_dontaudit_udp_bind_all_reserved_ports($1) + + ',` + dontaudit $1 var_yp_t:dir search; + ') +') + +######################################## +## +## Send UDP network traffic to NIS clients. +## +## +## The type of the process performing this action. +## +# +interface(`nis_list_var_yp',` + gen_require(` + type ypbind_t; + class dir r_dir_perms; + ') + + files_search_var($1) + allow $1 var_yp_t:dir r_dir_perms; +') + +######################################## +## +## Send UDP network traffic to NIS clients. +## +## +## The type of the process performing this action. +## +# +interface(`nis_udp_sendto_ypbind',` + gen_require(` + type ypbind_t; + class udp_socket { sendto recvfrom }; + ') + + allow $1 ypbind_t:udp_socket sendto; + allow ypbind_t $1:udp_socket recvfrom; +') diff --git a/refpolicy/policy/modules/services/nis.te b/refpolicy/policy/modules/services/nis.te new file mode 100644 index 0000000..3f5d3fb --- /dev/null +++ b/refpolicy/policy/modules/services/nis.te @@ -0,0 +1,227 @@ + +policy_module(nis,1.0) + +######################################## +# +# Declarations +# + +type var_yp_t; +files_file_type(var_yp_t) + +type ypbind_t; +type ypbind_exec_t; +init_daemon_domain(ypbind_t,ypbind_exec_t) + +type ypbind_tmp_t; +files_tmp_file(ypbind_tmp_t) + +type ypbind_var_run_t; +files_pid_file(ypbind_var_run_t) + +type ypserv_t; +type ypserv_exec_t; +init_daemon_domain(ypserv_t,ypserv_exec_t) + +type ypserv_conf_t; +files_file_type(ypserv_conf_t) + +type ypserv_tmp_t; +files_tmp_file(ypserv_tmp_t) + +type ypserv_var_run_t; +files_pid_file(ypserv_var_run_t) + +######################################## +# +# ypbind local policy + +dontaudit ypbind_t self:capability { net_admin sys_tty_config }; +allow ypbind_t self:fifo_file rw_file_perms; +allow ypbind_t self:{ unix_dgram_socket unix_stream_socket } create_socket_perms; +allow ypbind_t self:netlink_route_socket r_netlink_socket_perms; + +allow ypbind_t self:tcp_socket { listen accept }; +allow ypbind_t self:tcp_socket { create connect ioctl read getattr write setattr append bind getopt setopt shutdown }; +allow ypbind_t self:udp_socket { create ioctl read getattr write setattr append bind getopt setopt shutdown }; + +allow ypbind_t ypbind_tmp_t:dir create_dir_perms; +allow ypbind_t ypbind_tmp_t:file create_file_perms; +files_create_tmp_files(ypbind_t, ypbind_tmp_t, { file dir }) + +allow ypbind_t ypbind_var_run_t:file { getattr create read write append setattr unlink }; +files_create_pid(ypbind_t,ypbind_var_run_t) + +allow ypbind_t var_yp_t:dir rw_dir_perms; +allow ypbind_t var_yp_t:file create_file_perms; + +kernel_read_kernel_sysctl(ypbind_t) + +corenet_tcp_sendrecv_all_if(ypbind_t) +corenet_udp_sendrecv_all_if(ypbind_t) +corenet_raw_sendrecv_all_if(ypbind_t) +corenet_tcp_sendrecv_all_nodes(ypbind_t) +corenet_udp_sendrecv_all_nodes(ypbind_t) +corenet_raw_sendrecv_all_nodes(ypbind_t) +corenet_tcp_bind_all_nodes(ypbind_t) +corenet_udp_bind_all_nodes(ypbind_t) +corenet_tcp_sendrecv_all_ports(ypbind_t) +corenet_udp_sendrecv_all_ports(ypbind_t) +corenet_tcp_bind_generic_port(ypbind_t) +corenet_udp_bind_generic_port(ypbind_t) +corenet_tcp_bind_reserved_port(ypbind_t) +corenet_udp_bind_reserved_port(ypbind_t) +corenet_dontaudit_tcp_bind_all_reserved_ports(ypbind_t) +corenet_dontaudit_udp_bind_all_reserved_ports(ypbind_t) + +dev_read_sysfs(ypbind_t) + +fs_getattr_all_fs(ypbind_t) + +term_dontaudit_use_console(ypbind_t) + +domain_use_wide_inherit_fd(ypbind_t) + +files_read_generic_etc_files(ypbind_t) + +init_use_fd(ypbind_t) +init_use_script_pty(ypbind_t) +init_udp_sendto_script(ypbind_t) + +libs_use_ld_so(ypbind_t) +libs_use_shared_libs(ypbind_t) + +logging_send_syslog_msg(ypbind_t) + +miscfiles_read_localization(ypbind_t) + +sysnet_read_config(ypbind_t) + +userdom_dontaudit_use_unpriv_user_fd(ypbind_t) + +ifdef(`targeted_policy', ` + term_dontaudit_use_unallocated_tty(ypbind_t) + term_dontaudit_use_generic_pty(ypbind_t) + files_dontaudit_read_root_file(ypbind_t) +') + +optional_policy(`mount.te',` + mount_send_nfs_client_request(ypbind_t) +') + +optional_policy(`selinux.te',` + seutil_newrole_sigchld(ypbind_t) +') + +optional_policy(`udev.te', ` + udev_read_db(ypbind_t) +') + +ifdef(`TODO',` +allow ypbind_t proc_t:dir r_dir_perms; +allow ypbind_t proc_t:lnk_file read; + +allow ypbind_t autofs_t:dir { search getattr }; +dontaudit ypbind_t sysadm_home_dir_t:dir search; + +can_udp_send(ypbind_t, portmap_t) + +optional_policy(`rhgb.te', ` + rhgb_domain(ypbind_t) +') + +') dnl end TODO + +######################################## +# +# ypserv local policy +# + +dontaudit ypserv_t self:capability sys_tty_config; +allow ypserv_t self:fifo_file rw_file_perms; +allow ypserv_t self:unix_dgram_socket create_socket_perms; +allow ypserv_t self:netlink_route_socket r_netlink_socket_perms; + +allow ypserv_t self:tcp_socket { listen accept connected_socket_perms }; + +allow ypserv_t var_yp_t:dir rw_dir_perms; +allow ypserv_t var_yp_t:file create_file_perms; + +allow ypserv_t ypserv_conf_t:file { getattr read }; + +allow ypserv_t ypserv_tmp_t:dir create_dir_perms; +allow ypserv_t ypserv_tmp_t:file create_file_perms; +files_create_tmp_files(ypserv_t, ypserv_tmp_t, { file dir }) + +allow ypserv_t ypserv_var_run_t:file { getattr create read write append setattr unlink }; +files_create_pid(ypserv_t,ypserv_var_run_t) + +kernel_read_kernel_sysctl(ypserv_t) + +corenet_tcp_sendrecv_all_if(ypserv_t) +corenet_raw_sendrecv_all_if(ypserv_t) +corenet_tcp_sendrecv_all_nodes(ypserv_t) +corenet_raw_sendrecv_all_nodes(ypserv_t) +corenet_tcp_sendrecv_all_ports(ypserv_t) +corenet_tcp_bind_all_nodes(ypserv_t) +corenet_tcp_bind_reserved_port(ypserv_t) +corenet_udp_bind_reserved_port(ypserv_t) +corenet_dontaudit_tcp_bind_all_reserved_ports(ypserv_t) +corenet_dontaudit_udp_bind_all_reserved_ports(ypserv_t) + +dev_read_sysfs(ypserv_t) + +fs_getattr_all_fs(ypserv_t) + +term_dontaudit_use_console(ypserv_t) + +domain_use_wide_inherit_fd(ypserv_t) + +init_use_fd(ypserv_t) +init_use_script_pty(ypserv_t) +init_udp_sendto_script(ypserv_t) + +libs_use_ld_so(ypserv_t) +libs_use_shared_libs(ypserv_t) + +logging_send_syslog_msg(ypserv_t) + +miscfiles_read_localization(ypserv_t) + +sysnet_read_config(ypserv_t) + +userdom_dontaudit_use_unpriv_user_fd(ypserv_t) + +ifdef(`targeted_policy', ` + term_dontaudit_use_unallocated_tty(ypserv_t) + term_dontaudit_use_generic_pty(ypserv_t) + files_dontaudit_read_root_file(ypserv_t) +') + +optional_policy(`selinux.te',` + seutil_newrole_sigchld(ypserv_t) +') + +optional_policy(`udev.te', ` + udev_read_db(ypserv_t) +') + +ifdef(`TODO',` +optional_policy(`rhgb.te', ` +rhgb_domain(ypserv_t) +') + +allow ypserv_t proc_t:dir r_dir_perms; +allow ypserv_t proc_t:lnk_file read; + +allow ypserv_t autofs_t:dir { search getattr }; +dontaudit ypserv_t sysadm_home_dir_t:dir search; + +# Send to portmap and initrc. +can_udp_send(ypserv_t, portmap_t) + +# Read and write /var/yp. +ifdef(`rpcd.te', ` +allow rpcd_t ypserv_conf_t:file { getattr read }; +') +') dnl end TODO