From fa45da0efd3d9ddab0f81b0e09e3b1ab51b4b21d Mon Sep 17 00:00:00 2001 From: Chris PeBenito Date: Nov 16 2006 20:56:24 +0000 Subject: add aide, ccs, and ricci --- diff --git a/Changelog b/Changelog index 5aea1d9..cf13e5b 100644 --- a/Changelog +++ b/Changelog @@ -17,7 +17,10 @@ - Patches from Dan Walsh: Tue, 24 Oct 2006 - Added modules: + aide (Matt Anderson) + ccs (Dan Walsh) iscsi (Dan Walsh) + ricci (Dan Walsh) * Wed Oct 18 2006 Chris PeBenito - 20061018 - Patch from Russell Coker Thu, 5 Oct 2006 diff --git a/policy/modules/kernel/corenetwork.te.in b/policy/modules/kernel/corenetwork.te.in index 2dd29c9..24921db 100644 --- a/policy/modules/kernel/corenetwork.te.in +++ b/policy/modules/kernel/corenetwork.te.in @@ -1,5 +1,5 @@ -policy_module(corenetwork,1.2.1) +policy_module(corenetwork,1.2.2) ######################################## # @@ -66,6 +66,7 @@ network_port(bgp, tcp,179,s0, udp,179,s0, tcp,2605,s0, udp,2605,s0) type biff_port_t, port_type, reserved_port_type; dnl network_port(biff) # no defined portcon in current strict network_port(clamd, tcp,3310,s0) network_port(clockspeed, udp,4041,s0) +network_port(cluster, tcp,5149,s0, udp,5149,s0, tcp,40040,s0, tcp,50006,s0, udp,50006,s0, tcp,50007,s0, udp,50007,s0, tcp,50008,s0, udp,50008,s0) network_port(comsat, udp,512,s0) network_port(cvs, tcp,2401,s0, udp,2401,s0) network_port(dcc, udp,6276,s0, udp,6277,s0) @@ -106,6 +107,7 @@ network_port(mail, tcp,2000,s0) network_port(monopd, tcp,1234,s0) network_port(mysqld, tcp,3306,s0) network_port(nessus, tcp,1241,s0) +network_port(netsupport, tcp,5405,s0, udp,5405,s0) network_port(nmbd, udp,137,s0, udp,138,s0, udp,139,s0) network_port(ntp, udp,123,s0) network_port(openvpn, udp,1194,s0) @@ -122,6 +124,8 @@ network_port(pyzor, udp,24441,s0) network_port(radacct, udp,1646,s0, udp,1813,s0) network_port(radius, udp,1645,s0, udp,1812,s0) network_port(razor, tcp,2703,s0) +network_port(ricci, tcp,11111,s0, udp,11111,s0) +network_port(ricci_modcluster, tcp,16851,s0, udp,16851,s0) network_port(rlogind, tcp,513,s0) network_port(rndc, tcp,953,s0) network_port(router, udp,520,s0) diff --git a/policy/modules/services/aide.fc b/policy/modules/services/aide.fc new file mode 100644 index 0000000..be41434 --- /dev/null +++ b/policy/modules/services/aide.fc @@ -0,0 +1,5 @@ +/usr/sbin/aide -- gen_context(system_u:object_r:aide_exec_t,mls_systemhigh) + +/var/lib/aide(/.*) gen_context(system_u:object_r:aide_db_t,mls_systemhigh) + +/var/log/aide.log -- gen_context(system_u:object_r:aide_log_t,mls_systemhigh) diff --git a/policy/modules/services/aide.if b/policy/modules/services/aide.if new file mode 100644 index 0000000..7723362 --- /dev/null +++ b/policy/modules/services/aide.if @@ -0,0 +1,55 @@ +## Aide filesystem integrity checker + +######################################## +## +## Execute aide in the aide domain +## +## +## +## Domain allowed access. +## +## +# +interface(`aide_domtrans',` + gen_require(` + type aide_t, aide_exec_t; + ') + + corecmd_search_sbin($1) + domain_auto_trans($1,aide_exec_t,aide_t) + + allow aide_t $1:fd use; + allow aide_t $1:fifo_file rw_file_perms; + allow aide_t $1:process sigchld; +') + + +######################################## +## +## Execute aide programs in the AIDE domain. +## +## +## +## Domain allowed access. +## +## +## +## +## The role to allow the AIDE domain. +## +## +## +## +## The type of the terminal allow the AIDE domain to use. +## +## +# +interface(`aide_run',` + gen_require(` + type aide_t; + ') + + aide_domtrans($1) + role $2 types aide_t; + allow aide_t $3:chr_file rw_file_perms; +') diff --git a/policy/modules/services/aide.te b/policy/modules/services/aide.te new file mode 100644 index 0000000..620c674 --- /dev/null +++ b/policy/modules/services/aide.te @@ -0,0 +1,45 @@ + +policy_module(aide,1.0.0) + +######################################## +# +# Declarations +# + +type aide_t; +type aide_exec_t; +domain_type(aide_t) +domain_entry_file(aide_t,aide_exec_t) + +# log files +type aide_log_t; +logging_log_file(aide_log_t) + +# aide database +type aide_db_t; +files_type(aide_db_t) + +######################################## +# +# aide local policy +# + +allow aide_t self:capability { dac_override fowner }; +# audit +allow aide_t self:capability audit_write; +allow aide_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay }; + +# database actions +allow aide_t aide_db_t:dir rw_dir_perms; +allow aide_t aide_db_t:file manage_file_perms; + +# logs +logging_log_filetrans(aide_t,aide_log_t,file) +allow aide_t aide_log_t:file manage_file_perms; + +files_read_all_files(aide_t) + +libs_use_ld_so(aide_t) +libs_use_shared_libs(aide_t) + +seutil_use_newrole_fds(aide_t) diff --git a/policy/modules/services/ccs.fc b/policy/modules/services/ccs.fc new file mode 100644 index 0000000..12ac6d7 --- /dev/null +++ b/policy/modules/services/ccs.fc @@ -0,0 +1,8 @@ +/etc/cluster(/.*)? gen_context(system_u:object_r:cluster_conf_t,s0) + +/sbin/ccsd -- gen_context(system_u:object_r:ccs_exec_t,s0) + +/usr/sbin/aisexec -- gen_context(system_u:object_r:ccs_exec_t,s0) + +/var/run/cluster(/.*)? gen_context(system_u:object_r:ccs_var_run_t,s0) +/var/run/cman_.* -s gen_context(system_u:object_r:ccs_var_run_t,s0) diff --git a/policy/modules/services/ccs.if b/policy/modules/services/ccs.if new file mode 100644 index 0000000..366e5eb --- /dev/null +++ b/policy/modules/services/ccs.if @@ -0,0 +1,81 @@ +## Cluster Configuration System + +######################################## +## +## Execute a domain transition to run ccs. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`ccs_domtrans',` + gen_require(` + type ccs_t, ccs_exec_t; + ') + + domain_auto_trans($1,ccs_exec_t,ccs_t) + allow ccs_t $1:fd use; + allow ccs_t $1:fifo_file rw_file_perms; + allow ccs_t $1:process sigchld; +') + +######################################## +## +## Connect to ccs over an unix stream socket. +## +## +## +## Domain allowed access. +## +## +# +interface(`ccs_stream_connect',` + gen_require(` + type ccs_t, ccs_var_run_t; + ') + + files_search_pids($1) + allow $1 ccs_var_run_t:dir list_dir_perms; + allow $1 ccs_var_run_t:sock_file write; + allow $1 ccs_t:unix_stream_socket connectto; +') + +######################################## +## +## Read cluster configuration files. +## +## +## +## Domain allowed access. +## +## +# +interface(`ccs_read_config',` + gen_require(` + type cluster_conf_t; + ') + + allow $1 cluster_conf_t:dir search_dir_perms; + allow $1 cluster_conf_t:file { getattr read }; +') + +######################################## +## +## Manage cluster configuration files. +## +## +## +## Domain allowed access. +## +## +# +interface(`ccs_manage_config',` + gen_require(` + type cluster_conf_t; + ') + + allow $1 cluster_conf_t:dir manage_dir_perms; + allow $1 cluster_conf_t:file manage_file_perms; +') diff --git a/policy/modules/services/ccs.te b/policy/modules/services/ccs.te new file mode 100644 index 0000000..97939d7 --- /dev/null +++ b/policy/modules/services/ccs.te @@ -0,0 +1,98 @@ + +policy_module(ccs,1.0.0) + +######################################## +# +# Declarations +# + +type ccs_t; +type ccs_exec_t; +init_daemon_domain(ccs_t, ccs_exec_t) + +# pid files +type cluster_conf_t; +files_type(cluster_conf_t) + +# log files +type ccs_var_log_t; +logging_log_file(ccs_var_log_t) + +# pid files +type ccs_var_run_t; +files_pid_file(ccs_var_run_t) + +######################################## +# +# ccs local policy +# + +allow ccs_t self:capability { ipc_lock sys_nice sys_resource }; +allow ccs_t self:process { signal setrlimit setsched }; +allow ccs_t self:fifo_file { read write }; +allow ccs_t self:unix_stream_socket { connectto create_stream_socket_perms }; +allow ccs_t self:unix_dgram_socket create_socket_perms; +allow ccs_t self:netlink_route_socket r_netlink_socket_perms; +allow ccs_t self:tcp_socket create_stream_socket_perms; +allow ccs_t self:udp_socket { create_socket_perms listen recv_msg send_msg }; +# cjp: this needs to be fixed to be specific +allow ccs_t self:socket create_socket_perms; + +allow ccs_t cluster_conf_t:dir rw_dir_perms; +allow ccs_t cluster_conf_t:file manage_file_perms; + +# log files +allow ccs_t ccs_var_log_t:file create_file_perms; +allow ccs_t ccs_var_log_t:sock_file create_file_perms; +allow ccs_t ccs_var_log_t:dir { rw_dir_perms setattr }; +logging_log_filetrans(ccs_t,ccs_var_log_t,{ sock_file file dir }) + +# pid file +allow ccs_t ccs_var_run_t:file manage_file_perms; +allow ccs_t ccs_var_run_t:sock_file manage_file_perms; +allow ccs_t ccs_var_run_t:dir manage_dir_perms; +files_pid_filetrans(ccs_t,ccs_var_run_t, { dir file sock_file }) + +kernel_read_kernel_sysctls(ccs_t) + +corecmd_list_sbin(ccs_t) +corecmd_exec_bin(ccs_t) + +corenet_non_ipsec_sendrecv(ccs_t) +corenet_tcp_sendrecv_all_if(ccs_t) +corenet_udp_sendrecv_all_if(ccs_t) +corenet_tcp_sendrecv_all_nodes(ccs_t) +corenet_udp_sendrecv_all_nodes(ccs_t) +corenet_tcp_sendrecv_all_ports(ccs_t) +corenet_udp_sendrecv_all_ports(ccs_t) +corenet_tcp_bind_all_nodes(ccs_t) +corenet_udp_bind_all_nodes(ccs_t) +corenet_tcp_bind_cluster_port(ccs_t) +corenet_udp_bind_cluster_port(ccs_t) +corenet_udp_bind_netsupport_port(ccs_t) + +dev_read_urand(ccs_t) + +files_read_etc_files(ccs_t) +files_read_etc_runtime_files(ccs_t) + +init_dontaudit_use_fds(ccs_t) +init_rw_script_tmp_files(ccs_t) + +libs_use_ld_so(ccs_t) +libs_use_shared_libs(ccs_t) + +logging_send_syslog_msg(ccs_t) + +miscfiles_read_localization(ccs_t) + +sysnet_dns_name_resolve(ccs_t) + +ifdef(`targeted_policy',` + term_dontaudit_use_generic_ptys(ccs_t) + term_dontaudit_use_unallocated_ttys(ccs_t) +') + +optional_policy(` + unconfined_use_fds(ccs_t) +') diff --git a/policy/modules/services/ricci.fc b/policy/modules/services/ricci.fc new file mode 100644 index 0000000..3828004 --- /dev/null +++ b/policy/modules/services/ricci.fc @@ -0,0 +1,16 @@ +/usr/libexec/modcluster -- gen_context(system_u:object_r:ricci_modcluster_exec_t,s0) +/usr/libexec/ricci-modlog -- gen_context(system_u:object_r:ricci_modlog_exec_t,s0) +/usr/libexec/ricci-modrpm -- gen_context(system_u:object_r:ricci_modrpm_exec_t,s0) +/usr/libexec/ricci-modservice -- gen_context(system_u:object_r:ricci_modservice_exec_t,s0) +/usr/libexec/ricci-modstorage -- gen_context(system_u:object_r:ricci_modstorage_exec_t,s0) + +/usr/sbin/modclusterd -- gen_context(system_u:object_r:ricci_modclusterd_exec_t,s0) +/usr/sbin/ricci -- gen_context(system_u:object_r:ricci_exec_t,s0) + +/var/lib/ricci(/.*)? gen_context(system_u:object_r:ricci_var_lib_t,s0) + +/var/log/clumond.log -- gen_context(system_u:object_r:ricci_modcluster_var_log_t,s0) + +/var/run/clumond.sock -s gen_context(system_u:object_r:ricci_modcluster_var_run_t,s0) +/var/run/modclusterd.pid -- gen_context(system_u:object_r:ricci_modcluster_var_run_t,s0) +/var/run/ricci.pid -- gen_context(system_u:object_r:ricci_var_run_t,s0) diff --git a/policy/modules/services/ricci.if b/policy/modules/services/ricci.if new file mode 100644 index 0000000..6355d50 --- /dev/null +++ b/policy/modules/services/ricci.if @@ -0,0 +1,185 @@ +## Ricci cluster management agent + +######################################## +## +## Execute a domain transition to run ricci. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`ricci_domtrans',` + gen_require(` + type ricci_t, ricci_exec_t; + ') + + domain_auto_trans($1,ricci_exec_t,ricci_t) + allow ricci_t $1:fd use; + allow ricci_t $1:fifo_file rw_file_perms; + allow ricci_t $1:process sigchld; +') + +######################################## +## +## Execute a domain transition to run ricci_modcluster. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`ricci_domtrans_modcluster',` + gen_require(` + type ricci_modcluster_t, ricci_modcluster_exec_t; + ') + + domain_auto_trans($1,ricci_modcluster_exec_t,ricci_modcluster_t) + allow ricci_modcluster_t $1:fd use; + allow ricci_modcluster_t $1:fifo_file rw_file_perms; + allow ricci_modcluster_t $1:process sigchld; +') + +######################################## +## +## Do not audit attempts to use +## ricci_modcluster file descriptors. +## +## +## +## The type of process not to audit. +## +## +# +interface(`ricci_dontaudit_use_modcluster_fds',` + gen_require(` + type ricci_modcluster_t; + ') + + dontaudit $1 ricci_modcluster_t:fd use; +') + +######################################## +## +## Do not audit attempts to read write +## ricci_modcluster unamed pipes. +## +## +## +## The type of process not to audit. +## +## +# +interface(`ricci_dontaudit_rw_modcluster_pipes',` + gen_require(` + type ricci_modcluster_t; + ') + + dontaudit $1 ricci_modcluster_t:fifo_file { read write }; +') + +######################################## +## +## Connect to ricci_modclusterd over an unix stream socket. +## +## +## +## Domain allowed access. +## +## +# +interface(`ricci_stream_connect_modclusterd',` + gen_require(` + type ricci_modclusterd_t, ricci_modcluster_var_run_t; + ') + + files_search_pids($1) + allow $1 ricci_modcluster_var_run_t:sock_file write; + allow $1 ricci_modclusterd_t:unix_stream_socket connectto; +') + +######################################## +## +## Execute a domain transition to run ricci_modlog. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`ricci_domtrans_modlog',` + gen_require(` + type ricci_modlog_t, ricci_modlog_exec_t; + ') + + domain_auto_trans($1,ricci_modlog_exec_t,ricci_modlog_t) + allow ricci_modlog_t $1:fd use; + allow ricci_modlog_t $1:fifo_file rw_file_perms; + allow ricci_modlog_t $1:process sigchld; +') + +######################################## +## +## Execute a domain transition to run ricci_modrpm. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`ricci_domtrans_modrpm',` + gen_require(` + type ricci_modrpm_t, ricci_modrpm_exec_t; + ') + + domain_auto_trans($1,ricci_modrpm_exec_t,ricci_modrpm_t) + allow ricci_modrpm_t $1:fd use; + allow ricci_modrpm_t $1:fifo_file rw_file_perms; + allow ricci_modrpm_t $1:process sigchld; +') + +######################################## +## +## Execute a domain transition to run ricci_modservice. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`ricci_domtrans_modservice',` + gen_require(` + type ricci_modservice_t, ricci_modservice_exec_t; + ') + + domain_auto_trans($1,ricci_modservice_exec_t,ricci_modservice_t) + allow ricci_modservice_t $1:fd use; + allow ricci_modservice_t $1:fifo_file rw_file_perms; + allow ricci_modservice_t $1:process sigchld; +') + +######################################## +## +## Execute a domain transition to run ricci_modstorage. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`ricci_domtrans_modstorage',` + gen_require(` + type ricci_modstorage_t, ricci_modstorage_exec_t; + ') + + domain_auto_trans($1,ricci_modstorage_exec_t,ricci_modstorage_t) + allow ricci_modstorage_t $1:fd use; + allow ricci_modstorage_t $1:fifo_file rw_file_perms; + allow ricci_modstorage_t $1:process sigchld; +') diff --git a/policy/modules/services/ricci.te b/policy/modules/services/ricci.te new file mode 100644 index 0000000..be60d82 --- /dev/null +++ b/policy/modules/services/ricci.te @@ -0,0 +1,498 @@ + +policy_module(ricci,1.0.0) + +######################################## +# +# Declarations +# + +type ricci_t; +type ricci_exec_t; +domain_type(ricci_t) +init_daemon_domain(ricci_t, ricci_exec_t) + +# tmp files +type ricci_tmp_t; +files_tmp_file(ricci_tmp_t) + +# var/lib files +type ricci_var_lib_t; +files_type(ricci_var_lib_t) + +# log files +type ricci_var_log_t; +logging_log_file(ricci_var_log_t) + +# pid files +type ricci_var_run_t; +files_pid_file(ricci_var_run_t) + +type ricci_modcluster_t; +type ricci_modcluster_exec_t; +domain_type(ricci_modcluster_t) +domain_entry_file(ricci_modcluster_t, ricci_modcluster_exec_t) +role system_r types ricci_modcluster_t; + +# var/lib files +type ricci_modcluster_var_lib_t; +files_type(ricci_modcluster_var_lib_t) + +# log files +type ricci_modcluster_var_log_t; +logging_log_file(ricci_modcluster_var_log_t) + +# pid files +type ricci_modcluster_var_run_t; +files_pid_file(ricci_modcluster_var_run_t) + +type ricci_modclusterd_t; +type ricci_modclusterd_exec_t; +domain_type(ricci_modclusterd_t) +init_daemon_domain(ricci_modclusterd_t, ricci_modclusterd_exec_t) + +type ricci_modlog_t; +type ricci_modlog_exec_t; +domain_type(ricci_modlog_t) +domain_entry_file(ricci_modlog_t, ricci_modlog_exec_t) +role system_r types ricci_modlog_t; + +type ricci_modrpm_t; +type ricci_modrpm_exec_t; +domain_type(ricci_modrpm_t) +domain_entry_file(ricci_modrpm_t, ricci_modrpm_exec_t) +role system_r types ricci_modrpm_t; + +type ricci_modservice_t; +type ricci_modservice_exec_t; +domain_type(ricci_modservice_t) +domain_entry_file(ricci_modservice_t, ricci_modservice_exec_t) +role system_r types ricci_modservice_t; + +type ricci_modstorage_t; +type ricci_modstorage_exec_t; +domain_type(ricci_modstorage_t) +domain_entry_file(ricci_modstorage_t, ricci_modstorage_exec_t) +role system_r types ricci_modstorage_t; + +######################################## +# +# ricci local policy +# + +allow ricci_t self:capability { setuid sys_nice sys_boot }; +allow ricci_t self:process setsched; +allow ricci_t self:fifo_file { read write }; +allow ricci_t self:unix_stream_socket { create_stream_socket_perms connectto }; +allow ricci_t self:tcp_socket create_stream_socket_perms; + +domain_auto_trans(ricci_t,ricci_modcluster_exec_t,ricci_modcluster_t) +domain_auto_trans(ricci_t,ricci_modlog_exec_t,ricci_modlog_t) +domain_auto_trans(ricci_t,ricci_modrpm_exec_t,ricci_modrpm_t) +domain_auto_trans(ricci_t,ricci_modservice_exec_t,ricci_modservice_t) +domain_auto_trans(ricci_t,ricci_modstorage_exec_t,ricci_modstorage_t) + +# tmp file +allow ricci_t ricci_tmp_t:dir create_dir_perms; +allow ricci_t ricci_tmp_t:file create_file_perms; +files_tmp_filetrans(ricci_t, ricci_tmp_t, { file dir }) + +# var/lib files for ricci +allow ricci_t ricci_var_lib_t:file create_file_perms; +allow ricci_t ricci_var_lib_t:sock_file create_file_perms; +allow ricci_t ricci_var_lib_t:dir create_dir_perms; +files_var_lib_filetrans(ricci_t,ricci_var_lib_t, { file dir sock_file }) + +# log files +allow ricci_t ricci_var_log_t:file create_file_perms; +allow ricci_t ricci_var_log_t:sock_file create_file_perms; +allow ricci_t ricci_var_log_t:dir { rw_dir_perms setattr }; +logging_log_filetrans(ricci_t,ricci_var_log_t,{ sock_file file dir }) + +# pid file +allow ricci_t ricci_var_run_t:file manage_file_perms; +allow ricci_t ricci_var_run_t:sock_file manage_file_perms; +allow ricci_t ricci_var_run_t:dir rw_dir_perms; +files_pid_filetrans(ricci_t,ricci_var_run_t, { file sock_file }) + +kernel_read_kernel_sysctls(ricci_t) + +corecmd_exec_bin(ricci_t) +corecmd_exec_sbin(ricci_t) + +corenet_non_ipsec_sendrecv(ricci_t) +corenet_tcp_sendrecv_all_if(ricci_t) +corenet_tcp_sendrecv_all_nodes(ricci_t) +corenet_tcp_sendrecv_all_ports(ricci_t) +corenet_tcp_bind_all_nodes(ricci_t) +corenet_udp_bind_all_nodes(ricci_t) +corenet_tcp_bind_ricci_port(ricci_t) +corenet_udp_bind_ricci_port(ricci_t) +corenet_tcp_connect_http_port(ricci_t) + +dev_read_urand(ricci_t) + +files_read_etc_files(ricci_t) +files_read_etc_runtime_files(ricci_t) +files_create_boot_flag(ricci_t) + +auth_domtrans_chk_passwd(ricci_t) +auth_append_login_records(ricci_t) + +init_dontaudit_use_fds(ricci_t) +init_dontaudit_stream_connect_script(ricci_t) + +libs_use_ld_so(ricci_t) +libs_use_shared_libs(ricci_t) + +locallogin_dontaudit_use_fds(ricci_t) + +logging_send_syslog_msg(ricci_t) + +miscfiles_read_localization(ricci_t) + +sysnet_dns_name_resolve(ricci_t) + +ifdef(`targeted_policy', ` + term_dontaudit_use_console(ricci_t) + term_dontaudit_use_generic_ptys(ricci_t) + term_dontaudit_use_unallocated_ttys(ricci_t) +') + +optional_policy(` + ccs_read_config(ricci_t) +') + +optional_policy(` + dbus_system_bus_client_template(ricci,ricci_t) + dbus_send_system_bus(ricci_t) + oddjob_dbus_chat(ricci_t) +') + +optional_policy(` + # Needed so oddjob can run halt/reboot on behalf of ricci + corecmd_sbin_entry_type(ricci_t) + term_dontaudit_search_ptys(ricci_t) + init_exec(ricci_t) + init_telinit(ricci_t) + init_rw_utmp(ricci_t) + + oddjob_system_entry(ricci_t, ricci_exec_t) +') + +optional_policy(` + rpm_use_script_fds(ricci_t) +') + +optional_policy(` + sasl_connect(ricci_t) +') + +optional_policy(` + unconfined_use_fds(ricci_t) +') + +optional_policy(` + xen_domtrans_xm(ricci_t) +') + +######################################## +# +# ricci_modcluster local policy +# + +allow ricci_modcluster_t self:capability sys_nice; +allow ricci_modcluster_t self:process setsched; +allow ricci_modcluster_t self:fifo_file rw_file_perms; + +kernel_read_kernel_sysctls(ricci_modcluster_t) +kernel_read_system_state(ricci_modcluster_t) + +corecmd_exec_shell(ricci_modcluster_t) +corecmd_exec_sbin(ricci_modcluster_t) +corecmd_exec_bin(ricci_modcluster_t) + +domain_dontaudit_read_all_domains_state(ricci_modcluster_t) + +files_search_locks(ricci_modcluster_t) +files_read_etc_runtime_files(ricci_modcluster_t) +files_read_etc_files(ricci_modcluster_t) +files_search_usr(ricci_modcluster_t) + +init_exec(ricci_modcluster_t) +init_domtrans_script(ricci_modcluster_t) + +libs_use_ld_so(ricci_modcluster_t) +libs_use_shared_libs(ricci_modcluster_t) + +logging_send_syslog_msg(ricci_modcluster_t) + +miscfiles_read_localization(ricci_modcluster_t) + +modutils_domtrans_insmod(ricci_modcluster_t) + +mount_domtrans(ricci_modcluster_t) + +ricci_stream_connect_modclusterd(ricci_modcluster_t) + +optional_policy(` + ccs_stream_connect(ricci_modcluster_t) + ccs_domtrans(ricci_modcluster_t) + ccs_manage_config(ricci_modcluster_t) +') + +optional_policy(` + consoletype_exec(ricci_modcluster_t) +') + +optional_policy(` + lvm_domtrans(ricci_modcluster_t) +') + +optional_policy(` + nscd_socket_use(ricci_modcluster_t) +') + +optional_policy(` + oddjob_system_entry(ricci_modcluster_t, ricci_modcluster_exec_t) +') + +# XXX This has got to go. +unconfined_domain(ricci_modcluster_t) + +######################################## +# +# ricci_modclusterd local policy +# + +allow ricci_modclusterd_t self:capability sys_nice; +allow ricci_modclusterd_t self:process { signal sigkill setsched }; +allow ricci_modclusterd_t self:fifo_file rw_file_perms; +allow ricci_modclusterd_t self:unix_stream_socket create_stream_socket_perms; +allow ricci_modclusterd_t self:tcp_socket create_stream_socket_perms; +allow ricci_modclusterd_t self:netlink_route_socket r_netlink_socket_perms; +# cjp: this needs to be fixed for a specific socket type: +allow ricci_modclusterd_t self:socket create_socket_perms; + +allow ricci_modclusterd_t ricci_modcluster_t:unix_stream_socket connectto; + +# log files +allow ricci_modclusterd_t ricci_modcluster_var_log_t:file create_file_perms; +allow ricci_modclusterd_t ricci_modcluster_var_log_t:sock_file create_file_perms; +allow ricci_modclusterd_t ricci_modcluster_var_log_t:dir { rw_dir_perms setattr }; +logging_log_filetrans(ricci_modclusterd_t,ricci_modcluster_var_log_t,{ sock_file file dir }) + +# pid file +allow ricci_modclusterd_t ricci_modcluster_var_run_t:file manage_file_perms; +allow ricci_modclusterd_t ricci_modcluster_var_run_t:sock_file manage_file_perms; +allow ricci_modclusterd_t ricci_modcluster_var_run_t:dir rw_dir_perms; +files_pid_filetrans(ricci_modclusterd_t,ricci_modcluster_var_run_t, { file sock_file }) + +kernel_read_kernel_sysctls(ricci_modclusterd_t) +kernel_read_system_state(ricci_modclusterd_t) + +corecmd_exec_bin(ricci_modclusterd_t) +corecmd_exec_sbin(ricci_modclusterd_t) + +corenet_tcp_sendrecv_all_if(ricci_modclusterd_t) +corenet_tcp_sendrecv_all_ports(ricci_modclusterd_t) +corenet_tcp_bind_all_nodes(ricci_modclusterd_t) +corenet_tcp_bind_ricci_modcluster_port(ricci_modclusterd_t) +corenet_tcp_connect_ricci_modcluster_port(ricci_modclusterd_t) + +domain_dontaudit_read_all_domains_state(ricci_modclusterd_t) + +files_read_etc_files(ricci_modclusterd_t) +files_read_etc_runtime_files(ricci_modclusterd_t) + +fs_getattr_xattr_fs(ricci_modclusterd_t) + +init_dontaudit_use_fds(ricci_modclusterd_t) +init_dontaudit_stream_connect_script(ricci_modclusterd_t) + +libs_use_ld_so(ricci_modclusterd_t) +libs_use_shared_libs(ricci_modclusterd_t) + +locallogin_dontaudit_use_fds(ricci_modclusterd_t) + +logging_send_syslog_msg(ricci_modclusterd_t) + +miscfiles_read_localization(ricci_modclusterd_t) + +sysnet_domtrans_ifconfig(ricci_modclusterd_t) +sysnet_dns_name_resolve(ricci_modclusterd_t) + +ifdef(`targeted_policy', ` + term_dontaudit_use_console(ricci_modclusterd_t) + term_dontaudit_use_generic_ptys(ricci_modclusterd_t) + term_dontaudit_use_unallocated_ttys(ricci_modclusterd_t) +') + +optional_policy(` + ccs_domtrans(ricci_modclusterd_t) + ccs_stream_connect(ricci_modclusterd_t) + ccs_read_config(ricci_modclusterd_t) +') + +optional_policy(` + unconfined_use_fds(ricci_modclusterd_t) +') + +######################################## +# +# ricci_modlog local policy +# + +allow ricci_modlog_t self:capability sys_nice; +allow ricci_modlog_t self:process setsched; + +kernel_read_kernel_sysctls(ricci_modlog_t) +kernel_read_system_state(ricci_modlog_t) + +corecmd_exec_bin(ricci_modlog_t) +corecmd_exec_sbin(ricci_modlog_t) + +domain_dontaudit_read_all_domains_state(ricci_modlog_t) + +files_read_etc_files(ricci_modlog_t) +files_search_usr(ricci_modlog_t) + +libs_use_ld_so(ricci_modlog_t) +libs_use_shared_libs(ricci_modlog_t) + +logging_read_generic_logs(ricci_modlog_t) + +miscfiles_read_localization(ricci_modlog_t) + + +optional_policy(` + nscd_dontaudit_search_pid(ricci_modlog_t) +') + +optional_policy(` + oddjob_system_entry(ricci_modlog_t, ricci_modlog_exec_t) +') + +######################################## +# +# ricci_modrpm local policy +# + +allow ricci_modrpm_t self:fifo_file { getattr read }; + +corecmd_exec_bin(ricci_modrpm_t) + +libs_use_ld_so(ricci_modrpm_t) +libs_use_shared_libs(ricci_modrpm_t) + +files_search_usr(ricci_modrpm_t) +files_read_etc_files(ricci_modrpm_t) + +miscfiles_read_localization(ricci_modrpm_t) + +optional_policy(` + oddjob_system_entry(ricci_modrpm_t, ricci_modrpm_exec_t) +') + +optional_policy(` + rpm_domtrans(ricci_modrpm_t) +') + +######################################## +# +# ricci_modservice local policy +# + +allow ricci_modservice_t self:capability { dac_override sys_nice }; +allow ricci_modservice_t self:fifo_file { getattr read write }; +allow ricci_modservice_t self:process setsched; + +kernel_read_kernel_sysctls(ricci_modservice_t) +kernel_read_system_state(ricci_modservice_t) + +corecmd_exec_sbin(ricci_modservice_t) +corecmd_exec_bin(ricci_modservice_t) +corecmd_exec_shell(ricci_modservice_t) + +files_read_etc_files(ricci_modservice_t) +files_read_etc_runtime_files(ricci_modservice_t) +files_search_usr(ricci_modservice_t) + +consoletype_exec(ricci_modservice_t) + +init_domtrans_script(ricci_modservice_t) + +libs_use_ld_so(ricci_modservice_t) +libs_use_shared_libs(ricci_modservice_t) + +miscfiles_read_localization(ricci_modservice_t) + +optional_policy(` + ccs_read_config(ricci_modservice_t) +') + +optional_policy(` + nscd_dontaudit_search_pid(ricci_modservice_t) +') + +optional_policy(` + oddjob_system_entry(ricci_modservice_t, ricci_modservice_exec_t) +') + +######################################## +# +# ricci_modstorage local policy +# + +allow ricci_modstorage_t self:process { setsched signal }; +allow ricci_modstorage_t self:capability { mknod sys_nice }; +allow ricci_modstorage_t self:fifo_file rw_file_perms; +allow ricci_modstorage_t self:unix_dgram_socket create_socket_perms; + +kernel_read_kernel_sysctls(ricci_modstorage_t) +kernel_read_system_state(ricci_modstorage_t) + +corecmd_exec_bin(ricci_modstorage_t) +corecmd_exec_sbin(ricci_modstorage_t) + +dev_read_sysfs(ricci_modstorage_t) +dev_read_urand(ricci_modstorage_t) +dev_manage_generic_blk_files(ricci_modstorage_t) + +#Needed for editing /etc/fstab +files_manage_etc_files(ricci_modstorage_t) +files_read_etc_runtime_files(ricci_modstorage_t) +files_read_usr_files(ricci_modstorage_t) + +storage_raw_read_fixed_disk(ricci_modstorage_t) + +term_dontaudit_use_console(ricci_modstorage_t) + +fstools_domtrans(ricci_modstorage_t) + +libs_use_ld_so(ricci_modstorage_t) +libs_use_shared_libs(ricci_modstorage_t) + +logging_send_syslog_msg(ricci_modstorage_t) + +lvm_domtrans(ricci_modstorage_t) +lvm_read_config(ricci_modstorage_t) + +miscfiles_read_localization(ricci_modstorage_t) + +modutils_read_module_deps(ricci_modstorage_t) + +optional_policy(` + ccs_read_config(ricci_modstorage_t) +') + +optional_policy(` + lvm_domtrans(ricci_modstorage_t) +') + +optional_policy(` + oddjob_system_entry(ricci_modstorage_t, ricci_modstorage_exec_t) +') + +optional_policy(` + raid_domtrans_mdadm(ricci_modstorage_t) +')