diff --git a/Changelog b/Changelog index 2290890..5aadec5 100644 --- a/Changelog +++ b/Changelog @@ -16,6 +16,7 @@ - Fix clockspeed_run_cli() declaration, it was incorrectly defined as a template instead of an interface. - Added modules: + apcupsd (Dan Walsh) rwho (Nalin Dahyabhai) * Tue Apr 17 2007 Chris PeBenito - 20070417 diff --git a/policy/modules/services/apcupsd.fc b/policy/modules/services/apcupsd.fc new file mode 100644 index 0000000..1df86bb --- /dev/null +++ b/policy/modules/services/apcupsd.fc @@ -0,0 +1,5 @@ +/usr/sbin/apcupsd -- gen_context(system_u:object_r:apcupsd_exec_t,s0) + +/var/log/apcupsd\.events.* -- gen_context(system_u:object_r:apcupsd_log_t,s0) + +/var/run/apcupsd\.pid -- gen_context(system_u:object_r:apcupsd_var_run_t,s0) diff --git a/policy/modules/services/apcupsd.if b/policy/modules/services/apcupsd.if new file mode 100644 index 0000000..26e6137 --- /dev/null +++ b/policy/modules/services/apcupsd.if @@ -0,0 +1,81 @@ +## APC UPS monitoring daemon + +######################################## +## +## Execute a domain transition to run apcupsd. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`apcupsd_domtrans',` + gen_require(` + type apcupsd_t, apcupsd_exec_t; + ') + + domtrans_pattern($1,apcupsd_exec_t,apcupsd_t) +') + +######################################## +## +## Read apcupsd PID files. +## +## +## +## Domain allowed access. +## +## +# +interface(`apcupsd_read_pid_files',` + gen_require(` + type apcupsd_var_run_t; + ') + + files_search_pids($1) + allow $1 apcupsd_var_run_t:file read_file_perms; +') + + +######################################## +## +## Allow the specified domain to read apcupsd's log files. +## +## +## +## Domain allowed access. +## +## +## +# +interface(`apcupsd_read_log',` + gen_require(` + type apcupsd_log_t; + ') + + logging_search_logs($1) + allow $1 apcupsd_log_t:dir list_dir_perms; + allow $1 apcupsd_log_t:file { read getattr lock }; +') + +######################################## +## +## Allow the specified domain to append +## apcupsd log files. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`apcupsd_append_log',` + gen_require(` + type var_log_t, apcupsd_log_t; + ') + + logging_search_logs($1) + allow $1 apcupsd_log_t:dir list_dir_perms; + allow $1 apcupsd_log_t:file { getattr append }; +') diff --git a/policy/modules/services/apcupsd.te b/policy/modules/services/apcupsd.te new file mode 100644 index 0000000..e73a5f9 --- /dev/null +++ b/policy/modules/services/apcupsd.te @@ -0,0 +1,67 @@ + +policy_module(apcupsd,1.0.0) + +######################################## +# +# Declarations +# + +type apcupsd_t; +type apcupsd_exec_t; +init_daemon_domain(apcupsd_t, apcupsd_exec_t) + +type apcupsd_lock_t; +files_lock_file(apcupsd_lock_t) + +type apcupsd_log_t; +logging_log_file(apcupsd_log_t) + +type apcupsd_var_run_t; +files_pid_file(apcupsd_var_run_t) + +######################################## +# +# apcupsd local policy +# + +allow apcupsd_t self:fifo_file rw_file_perms; +allow apcupsd_t self:unix_stream_socket create_stream_socket_perms; +allow apcupsd_t self:tcp_socket create_stream_socket_perms; + +allow apcupsd_t apcupsd_lock_t:file manage_file_perms; +files_lock_filetrans(apcupsd_t,apcupsd_lock_t,file) + +allow apcupsd_t apcupsd_log_t:dir setattr; +manage_files_pattern(apcupsd_t,apcupsd_log_t,apcupsd_log_t) +logging_log_filetrans(apcupsd_t,apcupsd_log_t,{ file dir }) + +manage_files_pattern(apcupsd_t,apcupsd_var_run_t,apcupsd_var_run_t) +files_pid_filetrans(apcupsd_t,apcupsd_var_run_t, file) + +corenet_non_ipsec_sendrecv(apcupsd_t) +corenet_tcp_sendrecv_generic_if(apcupsd_t) +corenet_tcp_sendrecv_all_nodes(apcupsd_t) +corenet_tcp_sendrecv_all_ports(apcupsd_t) +corenet_tcp_bind_all_nodes(apcupsd_t) +#corenet_tcp_bind_apcupsd_port(apcupsd_t) +#corenet_sendrecv_apcupsd_server_packets(apcupsd_t) + +dev_rw_generic_usb_dev(apcupsd_t) + +# Init script handling +domain_use_interactive_fds(apcupsd_t) + +files_read_etc_files(apcupsd_t) +files_search_locks(apcupsd_t) + +libs_use_ld_so(apcupsd_t) +libs_use_shared_libs(apcupsd_t) + +logging_send_syslog_msg(apcupsd_t) + +miscfiles_read_localization(apcupsd_t) + +ifdef(`targeted_policy',` + term_dontaudit_use_unallocated_ttys(apcupsd_t) + term_dontaudit_use_generic_ptys(apcupsd_t) +')