diff --git a/policy/modules/apps/passenger.fc b/policy/modules/apps/passenger.fc deleted file mode 100644 index e75adfa..0000000 --- a/policy/modules/apps/passenger.fc +++ /dev/null @@ -1,6 +0,0 @@ - -/usr/lib(64)?/ruby/gems/.*/passenger-.*/ext/apache2/ApplicationPoolServerExecutable -- gen_context(system_u:object_r:passenger_exec_t,s0) - -/var/lib/passenger(/.*)? gen_context(system_u:object_r:passenger_var_lib_t,s0) - -/var/run/passenger(/.*)? gen_context(system_u:object_r:passenger_state_t,s0) diff --git a/policy/modules/apps/passenger.if b/policy/modules/apps/passenger.if deleted file mode 100644 index e738452..0000000 --- a/policy/modules/apps/passenger.if +++ /dev/null @@ -1,68 +0,0 @@ -## Passenger policy - -###################################### -## -## Execute passenger in the passenger domain. -## -## -## -## The type of the process performing this action. -## -## -# -interface(`passenger_domtrans',` - gen_require(` - type passenger_t; - ') - - allow $1 self:capability { fowner fsetid }; - - allow $1 passenger_t:process signal; - - domtrans_pattern($1, passenger_exec_t, passenger_t) - allow $1 passenger_t:unix_stream_socket { read write shutdown }; - allow passenger_t $1:unix_stream_socket { read write }; -') - -###################################### -## -## Manage passenger state content. -## -## -## -## Domain allowed access. -## -## -# -interface(`passenger_manage_state_content',` - gen_require(` - type passenger_state_t; - ') - - files_search_pids($1) - manage_dirs_pattern($1, passenger_state_t, passenger_state_t) - manage_files_pattern($1, passenger_state_t, passenger_state_t) - manage_fifo_files_pattern($1, passenger_state_t, passenger_state_t) - manage_sock_files_pattern($1, passenger_state_t, passenger_state_t) -') - -######################################## -## -## Read passenger lib files -## -## -## -## Domain to not audit. -## -## -# -interface(`passenger_read_lib_files',` - gen_require(` - type passenger_var_lib_t; - ') - - files_search_var_lib($1) - read_files_pattern($1, passenger_var_lib_t, passenger_var_lib_t) - read_lnk_files_pattern($1, passenger_var_lib_t, passenger_var_lib_t) -') - diff --git a/policy/modules/apps/passenger.te b/policy/modules/apps/passenger.te deleted file mode 100644 index 845d90f..0000000 --- a/policy/modules/apps/passenger.te +++ /dev/null @@ -1,67 +0,0 @@ - -policy_module(passanger,1.0.0) - -######################################## -# -# Declarations -# - -type passenger_t; -type passenger_exec_t; -domain_type(passenger_t) -domain_entry_file(passenger_t, passenger_exec_t) -role system_r types passenger_t; - -type passenger_tmp_t; -files_tmp_file(passenger_tmp_t) - -type passenger_var_lib_t; -files_type(passenger_var_lib_t) - -type passenger_state_t; -files_pid_file(passenger_state_t) - -permissive passenger_t; - -######################################## -# -# passanger local policy -# - -allow passenger_t self:capability { dac_override fsetid fowner chown setuid setgid }; -allow passenger_t self:process signal; - -allow passenger_t self:fifo_file rw_fifo_file_perms; -allow passenger_t self:unix_stream_socket { create_stream_socket_perms connectto }; - -manage_dirs_pattern(passenger_t, passenger_state_t, passenger_state_t) -manage_files_pattern(passenger_t, passenger_state_t, passenger_state_t) -manage_fifo_files_pattern(passenger_t, passenger_state_t, passenger_state_t) -manage_sock_files_pattern(passenger_t, passenger_state_t, passenger_state_t) - -files_search_var_lib(passenger_t) -manage_dirs_pattern(passenger_t, passenger_var_lib_t, passenger_var_lib_t) -manage_files_pattern(passenger_t, passenger_var_lib_t, passenger_var_lib_t) - -kernel_read_system_state(passenger_t) -kernel_read_kernel_sysctls(passenger_t) - -corenet_tcp_connect_http_port(passenger_t) - -corecmd_exec_bin(passenger_t) -corecmd_exec_shell(passenger_t) - -dev_read_urand(passenger_t) - -files_read_etc_files(passenger_t) - -auth_use_nsswitch(passenger_t) - -miscfiles_read_localization(passenger_t) - -userdom_dontaudit_use_user_terminals(passenger_t) - -optional_policy(` - apache_append_log(passenger_t) - apache_read_sys_content(passenger_t) -') diff --git a/policy/modules/services/passenger.fc b/policy/modules/services/passenger.fc new file mode 100644 index 0000000..e75adfa --- /dev/null +++ b/policy/modules/services/passenger.fc @@ -0,0 +1,6 @@ + +/usr/lib(64)?/ruby/gems/.*/passenger-.*/ext/apache2/ApplicationPoolServerExecutable -- gen_context(system_u:object_r:passenger_exec_t,s0) + +/var/lib/passenger(/.*)? gen_context(system_u:object_r:passenger_var_lib_t,s0) + +/var/run/passenger(/.*)? gen_context(system_u:object_r:passenger_state_t,s0) diff --git a/policy/modules/services/passenger.if b/policy/modules/services/passenger.if new file mode 100644 index 0000000..e738452 --- /dev/null +++ b/policy/modules/services/passenger.if @@ -0,0 +1,68 @@ +## Passenger policy + +###################################### +## +## Execute passenger in the passenger domain. +## +## +## +## The type of the process performing this action. +## +## +# +interface(`passenger_domtrans',` + gen_require(` + type passenger_t; + ') + + allow $1 self:capability { fowner fsetid }; + + allow $1 passenger_t:process signal; + + domtrans_pattern($1, passenger_exec_t, passenger_t) + allow $1 passenger_t:unix_stream_socket { read write shutdown }; + allow passenger_t $1:unix_stream_socket { read write }; +') + +###################################### +## +## Manage passenger state content. +## +## +## +## Domain allowed access. +## +## +# +interface(`passenger_manage_state_content',` + gen_require(` + type passenger_state_t; + ') + + files_search_pids($1) + manage_dirs_pattern($1, passenger_state_t, passenger_state_t) + manage_files_pattern($1, passenger_state_t, passenger_state_t) + manage_fifo_files_pattern($1, passenger_state_t, passenger_state_t) + manage_sock_files_pattern($1, passenger_state_t, passenger_state_t) +') + +######################################## +## +## Read passenger lib files +## +## +## +## Domain to not audit. +## +## +# +interface(`passenger_read_lib_files',` + gen_require(` + type passenger_var_lib_t; + ') + + files_search_var_lib($1) + read_files_pattern($1, passenger_var_lib_t, passenger_var_lib_t) + read_lnk_files_pattern($1, passenger_var_lib_t, passenger_var_lib_t) +') + diff --git a/policy/modules/services/passenger.te b/policy/modules/services/passenger.te new file mode 100644 index 0000000..845d90f --- /dev/null +++ b/policy/modules/services/passenger.te @@ -0,0 +1,67 @@ + +policy_module(passanger,1.0.0) + +######################################## +# +# Declarations +# + +type passenger_t; +type passenger_exec_t; +domain_type(passenger_t) +domain_entry_file(passenger_t, passenger_exec_t) +role system_r types passenger_t; + +type passenger_tmp_t; +files_tmp_file(passenger_tmp_t) + +type passenger_var_lib_t; +files_type(passenger_var_lib_t) + +type passenger_state_t; +files_pid_file(passenger_state_t) + +permissive passenger_t; + +######################################## +# +# passanger local policy +# + +allow passenger_t self:capability { dac_override fsetid fowner chown setuid setgid }; +allow passenger_t self:process signal; + +allow passenger_t self:fifo_file rw_fifo_file_perms; +allow passenger_t self:unix_stream_socket { create_stream_socket_perms connectto }; + +manage_dirs_pattern(passenger_t, passenger_state_t, passenger_state_t) +manage_files_pattern(passenger_t, passenger_state_t, passenger_state_t) +manage_fifo_files_pattern(passenger_t, passenger_state_t, passenger_state_t) +manage_sock_files_pattern(passenger_t, passenger_state_t, passenger_state_t) + +files_search_var_lib(passenger_t) +manage_dirs_pattern(passenger_t, passenger_var_lib_t, passenger_var_lib_t) +manage_files_pattern(passenger_t, passenger_var_lib_t, passenger_var_lib_t) + +kernel_read_system_state(passenger_t) +kernel_read_kernel_sysctls(passenger_t) + +corenet_tcp_connect_http_port(passenger_t) + +corecmd_exec_bin(passenger_t) +corecmd_exec_shell(passenger_t) + +dev_read_urand(passenger_t) + +files_read_etc_files(passenger_t) + +auth_use_nsswitch(passenger_t) + +miscfiles_read_localization(passenger_t) + +userdom_dontaudit_use_user_terminals(passenger_t) + +optional_policy(` + apache_append_log(passenger_t) + apache_read_sys_content(passenger_t) +')