From c989807d4aff7b9493f7abe876625141b1f90ff4 Mon Sep 17 00:00:00 2001 From: Chris PeBenito Date: Jun 25 2009 15:16:29 +0000 Subject: trunk: nis patch from dan. --- diff --git a/policy/modules/services/nis.fc b/policy/modules/services/nis.fc index cc23fb5..ee62b9d 100644 --- a/policy/modules/services/nis.fc +++ b/policy/modules/services/nis.fc @@ -4,6 +4,7 @@ /sbin/ypbind -- gen_context(system_u:object_r:ypbind_exec_t,s0) /usr/lib/yp/ypxfr -- gen_context(system_u:object_r:ypxfr_exec_t,s0) +/usr/lib64/yp/ypxfr -- gen_context(system_u:object_r:ypxfr_exec_t,s0) /usr/sbin/rpc\.yppasswdd -- gen_context(system_u:object_r:yppasswdd_exec_t,s0) /usr/sbin/rpc\.ypxfrd -- gen_context(system_u:object_r:ypxfr_exec_t,s0) diff --git a/policy/modules/services/nis.if b/policy/modules/services/nis.if index ff85c8d..df608e9 100644 --- a/policy/modules/services/nis.if +++ b/policy/modules/services/nis.if @@ -49,8 +49,8 @@ interface(`nis_use_ypbind_uncond',` corenet_udp_bind_generic_node($1) corenet_tcp_bind_generic_port($1) corenet_udp_bind_generic_port($1) - corenet_tcp_bind_reserved_port($1) - corenet_udp_bind_reserved_port($1) + corenet_dontaudit_tcp_bind_all_reserved_ports($1) + corenet_dontaudit_udp_bind_all_reserved_ports($1) corenet_dontaudit_tcp_bind_all_ports($1) corenet_dontaudit_udp_bind_all_ports($1) corenet_tcp_connect_portmap_port($1) @@ -76,12 +76,27 @@ interface(`nis_use_ypbind_uncond',` ## # interface(`nis_use_ypbind',` - gen_require(` - type var_yp_t; + tunable_policy(`allow_ypbind',` + nis_use_ypbind_uncond($1) ') +') +######################################## +## +## Use the nis to authenticate passwords +## +## +## +## Domain allowed access. +## +## +## +# +interface(`nis_authenticate',` tunable_policy(`allow_ypbind',` nis_use_ypbind_uncond($1) + corenet_tcp_bind_all_rpc_ports($1) + corenet_udp_bind_all_rpc_ports($1) ') ') @@ -244,3 +259,55 @@ interface(`nis_domtrans_ypxfr',` corecmd_search_bin($1) domtrans_pattern($1, ypxfr_exec_t, ypxfr_t) ') + +######################################## +## +## All of the rules required to administrate +## an nis environment +## +## +## +## Domain allowed access. +## +## +## +## +## Role allowed access. +## +## +## +# +interface(`nis_admin',` + gen_require(` + type ypbind_t, yppasswdd_t, ypserv_t, ypxfr_t; + type ypbind_tmp_t, ypserv_tmp_t, ypserv_conf_t; + type ypbind_var_run_t, yppasswdd_var_run_t, ypserv_var_run_t; + ') + + allow $1 ypbind_t:process { ptrace signal_perms }; + ps_process_pattern($1, ypbind_t) + + allow $1 yppasswdd_t:process { ptrace signal_perms }; + ps_process_pattern($1, yppasswdd_t) + + allow $1 ypserv_t:process { ptrace signal_perms }; + ps_process_pattern($1, ypserv_t) + + allow $1 ypxfr_t:process { ptrace signal_perms }; + ps_process_pattern($1, ypxfr_t) + + files_list_tmp($1) + admin_pattern($1, ypbind_tmp_t) + + files_list_pids($1) + admin_pattern($1, ypbind_var_run_t) + + admin_pattern($1, yppasswdd_var_run_t) + + files_list_etc($1) + admin_pattern($1, ypserv_conf_t) + + admin_pattern($1, ypserv_tmp_t) + + admin_pattern($1, ypserv_var_run_t) +') diff --git a/policy/modules/services/nis.te b/policy/modules/services/nis.te index 3fd2ae2..fbc6609 100644 --- a/policy/modules/services/nis.te +++ b/policy/modules/services/nis.te @@ -1,5 +1,5 @@ -policy_module(nis, 1.8.2) +policy_module(nis, 1.8.3) ######################################## # @@ -111,6 +111,16 @@ userdom_dontaudit_use_unpriv_user_fds(ypbind_t) userdom_dontaudit_search_user_home_dirs(ypbind_t) optional_policy(` + dbus_system_bus_client(ypbind_t) + dbus_connect_system_bus(ypbind_t) + init_dbus_chat_script(ypbind_t) + + optional_policy(` + networkmanager_dbus_chat(ypbind_t) + ') +') + +optional_policy(` seutil_sigchld_newrole(ypbind_t) ') @@ -123,6 +133,7 @@ optional_policy(` # yppasswdd local policy # +allow yppasswdd_t self:capability dac_override; dontaudit yppasswdd_t self:capability sys_tty_config; allow yppasswdd_t self:fifo_file rw_fifo_file_perms; allow yppasswdd_t self:process { setfscreate signal_perms }; @@ -153,8 +164,8 @@ corenet_tcp_sendrecv_all_ports(yppasswdd_t) corenet_udp_sendrecv_all_ports(yppasswdd_t) corenet_tcp_bind_generic_node(yppasswdd_t) corenet_udp_bind_generic_node(yppasswdd_t) -corenet_tcp_bind_reserved_port(yppasswdd_t) -corenet_udp_bind_reserved_port(yppasswdd_t) +corenet_tcp_bind_all_rpc_ports(yppasswdd_t) +corenet_udp_bind_all_rpc_ports(yppasswdd_t) corenet_dontaudit_tcp_bind_all_reserved_ports(yppasswdd_t) corenet_dontaudit_udp_bind_all_reserved_ports(yppasswdd_t) corenet_sendrecv_generic_server_packets(yppasswdd_t) @@ -239,8 +250,8 @@ corenet_tcp_sendrecv_all_ports(ypserv_t) corenet_udp_sendrecv_all_ports(ypserv_t) corenet_tcp_bind_generic_node(ypserv_t) corenet_udp_bind_generic_node(ypserv_t) -corenet_tcp_bind_reserved_port(ypserv_t) -corenet_udp_bind_reserved_port(ypserv_t) +corenet_tcp_bind_all_rpc_ports(ypserv_t) +corenet_udp_bind_all_rpc_ports(ypserv_t) corenet_dontaudit_tcp_bind_all_reserved_ports(ypserv_t) corenet_dontaudit_udp_bind_all_reserved_ports(ypserv_t) corenet_sendrecv_generic_server_packets(ypserv_t) @@ -304,8 +315,8 @@ corenet_tcp_sendrecv_all_ports(ypxfr_t) corenet_udp_sendrecv_all_ports(ypxfr_t) corenet_tcp_bind_generic_node(ypxfr_t) corenet_udp_bind_generic_node(ypxfr_t) -corenet_tcp_bind_reserved_port(ypxfr_t) -corenet_udp_bind_reserved_port(ypxfr_t) +corenet_tcp_bind_all_rpc_ports(ypxfr_t) +corenet_udp_bind_all_rpc_ports(ypxfr_t) corenet_dontaudit_tcp_bind_all_reserved_ports(ypxfr_t) corenet_dontaudit_udp_bind_all_reserved_ports(ypxfr_t) corenet_tcp_connect_all_ports(ypxfr_t)