diff --git a/refpolicy/policy/modules/system/miscfiles.if b/refpolicy/policy/modules/system/miscfiles.if index 7a553a1..c0e3b3d 100644 --- a/refpolicy/policy/modules/system/miscfiles.if +++ b/refpolicy/policy/modules/system/miscfiles.if @@ -11,8 +11,6 @@ interface(`miscfiles_read_fonts',` gen_require(` type fonts_t; - class dir r_dir_perms; - class file r_file_perms; ') files_search_usr($1) @@ -25,6 +23,44 @@ interface(`miscfiles_read_fonts',` ######################################## ## +## Read public files used for file +## transfer services. +## +## +## Domain allowed access. +## +# +interface(`miscfiles_read_public_files',` + gen_require(` + type ftpd_anon_t; + ') + + allow $1 ftpd_anon_t:dir r_dir_perms; + allow $1 ftpd_anon_t:file r_file_perms; + allow $1 ftpd_anon_t:lnk_file { getattr read }; +') + +######################################## +## +## Create, read, write, and delete public files +## and directories used for file transfer services. +## +## +## Domain allowed access. +## +# +interface(`miscfiles_manage_public_files',` + gen_require(` + type ftpd_anon_rw_t; + ') + + allow $1 ftpd_anon_rw_t:dir create_dir_perms; + allow $1 ftpd_anon_rw_t:file create_file_perms; + allow $1 ftpd_anon_rw_t:lnk_file create_lnk_perms; +') + +######################################## +## ## Allow process to read localization info ## ## @@ -34,9 +70,6 @@ interface(`miscfiles_read_fonts',` interface(`miscfiles_read_localization',` gen_require(` type locale_t; - class dir r_dir_perms; - class lnk_file r_file_perms; - class file r_file_perms; ') files_search_etc($1) @@ -61,7 +94,6 @@ interface(`miscfiles_read_localization',` interface(`miscfiles_legacy_read_localization',` gen_require(` type locale_t; - class file execute; ') miscfiles_read_localization($1) @@ -79,9 +111,6 @@ interface(`miscfiles_legacy_read_localization',` interface(`miscfiles_read_man_pages',` gen_require(` type man_t; - class dir r_dir_perms; - class file r_file_perms; - class lnk_file r_file_perms; ') files_search_usr($1) @@ -102,9 +131,6 @@ interface(`miscfiles_read_man_pages',` interface(`miscfiles_delete_man_pages',` gen_require(` type man_t; - class dir { setattr rw_dir_perms rmdir }; - class file { getattr unlink }; - class lnk_file { getattr unlink }; ') files_search_usr($1) @@ -124,9 +150,6 @@ interface(`miscfiles_delete_man_pages',` interface(`miscfiles_manage_man_pages',` gen_require(` type man_t; - class dir create_dir_perms; - class file create_file_perms; - class lnk_file r_file_perms; ') files_search_usr($1) @@ -146,9 +169,6 @@ interface(`miscfiles_manage_man_pages',` interface(`miscfiles_read_tetex_data',` gen_require(` type tetex_data_t; - class dir r_dir_perms; - class file r_file_perms; - class lnk_file r_file_perms; ') files_search_var($1) @@ -171,7 +191,6 @@ interface(`miscfiles_read_tetex_data',` interface(`miscfiles_exec_tetex_data',` gen_require(` type fonts_t; - class dir r_dir_perms; ') files_search_var($1)