diff options
Diffstat (limited to 'policy/modules/services/afs.te')
| -rw-r--r-- | policy/modules/services/afs.te | 325 |
1 files changed, 325 insertions, 0 deletions
diff --git a/policy/modules/services/afs.te b/policy/modules/services/afs.te new file mode 100644 index 00000000..9ebe863a --- /dev/null +++ b/policy/modules/services/afs.te @@ -0,0 +1,325 @@ +policy_module(afs, 1.11.0) + +######################################## +# +# Declarations +# + +attribute afs_domain; + +type afs_t, afs_domain; +type afs_exec_t; +init_daemon_domain(afs_t, afs_exec_t) + +type afs_bosserver_t, afs_domain; +type afs_bosserver_exec_t; +init_daemon_domain(afs_bosserver_t, afs_bosserver_exec_t) + +type afs_cache_t; +files_type(afs_cache_t) + +type afs_config_t; +files_type(afs_config_t) + +type afs_dbdir_t; +files_type(afs_dbdir_t) + +# exported files +type afs_files_t; +files_type(afs_files_t) + +type afs_fsserver_t, afs_domain; +type afs_fsserver_exec_t; +domain_type(afs_fsserver_t) +domain_entry_file(afs_fsserver_t, afs_fsserver_exec_t) +role system_r types afs_fsserver_t; + +type afs_initrc_exec_t; +init_script_file(afs_initrc_exec_t) + +type afs_ka_db_t; +files_type(afs_ka_db_t) + +type afs_kaserver_t, afs_domain; +type afs_kaserver_exec_t; +domain_type(afs_kaserver_t) +domain_entry_file(afs_kaserver_t, afs_kaserver_exec_t) +role system_r types afs_kaserver_t; + +type afs_logfile_t; +logging_log_file(afs_logfile_t) + +type afs_pt_db_t; +files_type(afs_pt_db_t) + +type afs_ptserver_t, afs_domain; +type afs_ptserver_exec_t; +domain_type(afs_ptserver_t) +domain_entry_file(afs_ptserver_t, afs_ptserver_exec_t) +role system_r types afs_ptserver_t; + +type afs_vl_db_t; +files_type(afs_vl_db_t) + +type afs_vlserver_t, afs_domain; +type afs_vlserver_exec_t; +domain_type(afs_vlserver_t) +domain_entry_file(afs_vlserver_t, afs_vlserver_exec_t) +role system_r types afs_vlserver_t; + +######################################## +# +# afs client local policy +# + +allow afs_t self:capability { dac_override sys_admin sys_nice sys_tty_config }; +allow afs_t self:process { setsched signal }; +allow afs_t self:fifo_file rw_fifo_file_perms; +allow afs_t self:unix_stream_socket { accept listen }; + +manage_files_pattern(afs_t, afs_cache_t, afs_cache_t) +manage_dirs_pattern(afs_t, afs_cache_t, afs_cache_t) +files_var_filetrans(afs_t, afs_cache_t, { file dir }) + +kernel_rw_afs_state(afs_t) + +files_mounton_mnt(afs_t) +files_read_usr_files(afs_t) +files_rw_etc_runtime_files(afs_t) + +fs_getattr_xattr_fs(afs_t) +fs_mount_nfs(afs_t) +fs_read_nfs_symlinks(afs_t) + +logging_send_syslog_msg(afs_t) + +######################################## +# +# AFS bossserver local policy +# + +allow afs_bosserver_t self:process { setsched signal_perms }; +allow afs_bosserver_t self:tcp_socket create_stream_socket_perms; + +can_exec(afs_bosserver_t, afs_bosserver_exec_t) + +manage_dirs_pattern(afs_bosserver_t, afs_config_t, afs_config_t) +manage_files_pattern(afs_bosserver_t, afs_config_t, afs_config_t) + +allow afs_bosserver_t afs_dbdir_t:dir list_dir_perms; + +allow afs_bosserver_t afs_fsserver_t:process signal_perms; +domtrans_pattern(afs_bosserver_t, afs_fsserver_exec_t, afs_fsserver_t) + +allow afs_bosserver_t afs_kaserver_t:process signal_perms; +domtrans_pattern(afs_bosserver_t, afs_kaserver_exec_t, afs_kaserver_t) + +allow afs_bosserver_t afs_logfile_t:file manage_file_perms; +allow afs_bosserver_t afs_logfile_t:dir manage_dir_perms; + +allow afs_bosserver_t afs_ptserver_t:process signal_perms; +domtrans_pattern(afs_bosserver_t, afs_ptserver_exec_t, afs_ptserver_t) + +allow afs_bosserver_t afs_vlserver_t:process signal_perms; +domtrans_pattern(afs_bosserver_t, afs_vlserver_exec_t, afs_vlserver_t) + +kernel_read_kernel_sysctls(afs_bosserver_t) + +corenet_all_recvfrom_unlabeled(afs_bosserver_t) +corenet_all_recvfrom_netlabel(afs_bosserver_t) +corenet_udp_sendrecv_generic_if(afs_bosserver_t) +corenet_udp_sendrecv_generic_node(afs_bosserver_t) +corenet_udp_bind_generic_node(afs_bosserver_t) + +corenet_udp_bind_afs_bos_port(afs_bosserver_t) +corenet_sendrecv_afs_bos_server_packets(afs_bosserver_t) +corenet_udp_sendrecv_afs_bos_port(afs_bosserver_t) + +dev_read_urand(afs_bosserver_t) + +files_list_home(afs_bosserver_t) +files_read_usr_files(afs_bosserver_t) + +seutil_read_config(afs_bosserver_t) + +######################################## +# +# fileserver local policy +# + +allow afs_fsserver_t self:capability { chown dac_override fowner kill sys_nice }; +dontaudit afs_fsserver_t self:capability fsetid; +allow afs_fsserver_t self:process { setsched signal_perms }; +allow afs_fsserver_t self:fifo_file rw_fifo_file_perms; +allow afs_fsserver_t self:tcp_socket create_stream_socket_perms; + +manage_dirs_pattern(afs_fsserver_t, afs_config_t, afs_config_t) +manage_files_pattern(afs_fsserver_t, afs_config_t, afs_config_t) + +manage_dirs_pattern(afs_fsserver_t, afs_files_t, afs_files_t) +manage_files_pattern(afs_fsserver_t, afs_files_t, afs_files_t) +manage_lnk_files_pattern(afs_fsserver_t, afs_files_t, afs_files_t) +manage_fifo_files_pattern(afs_fsserver_t, afs_files_t, afs_files_t) +manage_sock_files_pattern(afs_fsserver_t, afs_files_t, afs_files_t) +filetrans_pattern(afs_fsserver_t, afs_config_t, afs_files_t, { file lnk_file sock_file fifo_file }) + +can_exec(afs_fsserver_t, afs_fsserver_exec_t) + +manage_dirs_pattern(afs_fsserver_t, afs_logfile_t, afs_logfile_t) +manage_files_pattern(afs_fsserver_t, afs_logfile_t, afs_logfile_t) + +kernel_read_system_state(afs_fsserver_t) +kernel_read_kernel_sysctls(afs_fsserver_t) + +corenet_all_recvfrom_unlabeled(afs_fsserver_t) +corenet_all_recvfrom_netlabel(afs_fsserver_t) +corenet_tcp_sendrecv_generic_if(afs_fsserver_t) +corenet_udp_sendrecv_generic_if(afs_fsserver_t) +corenet_tcp_sendrecv_generic_node(afs_fsserver_t) +corenet_udp_sendrecv_generic_node(afs_fsserver_t) +corenet_tcp_bind_generic_node(afs_fsserver_t) +corenet_udp_bind_generic_node(afs_fsserver_t) + +corenet_sendrecv_afs_fs_server_packets(afs_fsserver_t) +corenet_tcp_bind_afs_fs_port(afs_fsserver_t) +corenet_udp_bind_afs_fs_port(afs_fsserver_t) +corenet_tcp_sendrecv_afs_fs_port(afs_fsserver_t) +corenet_udp_sendrecv_afs_fs_port(afs_fsserver_t) + +dev_read_urand(afs_fsserver_t) + +files_read_etc_runtime_files(afs_fsserver_t) +files_list_home(afs_fsserver_t) +files_read_usr_files(afs_fsserver_t) +files_list_pids(afs_fsserver_t) +files_dontaudit_search_mnt(afs_fsserver_t) + +fs_getattr_xattr_fs(afs_fsserver_t) + +term_dontaudit_use_console(afs_fsserver_t) + +init_dontaudit_use_script_fds(afs_fsserver_t) + +logging_send_syslog_msg(afs_fsserver_t) + +seutil_read_config(afs_fsserver_t) + +userdom_dontaudit_use_user_terminals(afs_fsserver_t) + +######################################## +# +# kaserver local policy +# + +allow afs_kaserver_t self:unix_stream_socket create_stream_socket_perms; +allow afs_kaserver_t self:tcp_socket create_stream_socket_perms; + +manage_files_pattern(afs_kaserver_t, afs_config_t, afs_config_t) + +manage_files_pattern(afs_kaserver_t, afs_dbdir_t, afs_ka_db_t) +filetrans_pattern(afs_kaserver_t, afs_dbdir_t, afs_ka_db_t, file) + +manage_dirs_pattern(afs_kaserver_t, afs_logfile_t, afs_logfile_t) +manage_files_pattern(afs_kaserver_t, afs_logfile_t, afs_logfile_t) + +kernel_read_kernel_sysctls(afs_kaserver_t) + +corenet_all_recvfrom_unlabeled(afs_kaserver_t) +corenet_all_recvfrom_netlabel(afs_kaserver_t) +corenet_udp_sendrecv_generic_if(afs_kaserver_t) +corenet_udp_sendrecv_generic_node(afs_kaserver_t) +corenet_udp_bind_generic_node(afs_kaserver_t) + +corenet_sendrecv_afs_ka_server_packets(afs_kaserver_t) +corenet_udp_bind_afs_ka_port(afs_kaserver_t) +corenet_udp_sendrecv_afs_ka_port(afs_kaserver_t) + +corenet_sendrecv_kerberos_server_packets(afs_kaserver_t) +corenet_udp_bind_kerberos_port(afs_kaserver_t) +corenet_udp_sendrecv_kerberos_port(afs_kaserver_t) + +files_list_home(afs_kaserver_t) +files_read_usr_files(afs_kaserver_t) + +seutil_read_config(afs_kaserver_t) + +userdom_dontaudit_use_user_terminals(afs_kaserver_t) + +######################################## +# +# ptserver local policy +# + +allow afs_ptserver_t self:unix_stream_socket create_stream_socket_perms; +allow afs_ptserver_t self:tcp_socket create_stream_socket_perms; + +read_files_pattern(afs_ptserver_t, afs_config_t, afs_config_t) +allow afs_ptserver_t afs_config_t:dir list_dir_perms; + +manage_dirs_pattern(afs_ptserver_t, afs_logfile_t, afs_logfile_t) +manage_files_pattern(afs_ptserver_t, afs_logfile_t, afs_logfile_t) + +manage_files_pattern(afs_ptserver_t, afs_dbdir_t, afs_pt_db_t) +filetrans_pattern(afs_ptserver_t, afs_dbdir_t, afs_pt_db_t, file) + +corenet_all_recvfrom_unlabeled(afs_ptserver_t) +corenet_all_recvfrom_netlabel(afs_ptserver_t) +corenet_tcp_sendrecv_generic_if(afs_ptserver_t) +corenet_udp_sendrecv_generic_if(afs_ptserver_t) +corenet_tcp_sendrecv_generic_node(afs_ptserver_t) +corenet_udp_sendrecv_generic_node(afs_ptserver_t) +corenet_tcp_sendrecv_all_ports(afs_ptserver_t) +corenet_udp_sendrecv_all_ports(afs_ptserver_t) +corenet_udp_bind_generic_node(afs_ptserver_t) +corenet_udp_bind_afs_pt_port(afs_ptserver_t) +corenet_sendrecv_afs_pt_server_packets(afs_ptserver_t) + +dev_read_urand(afs_ptserver_t) + +userdom_dontaudit_use_user_terminals(afs_ptserver_t) + +######################################## +# +# vlserver local policy +# + +allow afs_vlserver_t self:unix_stream_socket create_stream_socket_perms; +allow afs_vlserver_t self:tcp_socket create_stream_socket_perms; + +read_files_pattern(afs_vlserver_t, afs_config_t, afs_config_t) +allow afs_vlserver_t afs_config_t:dir list_dir_perms; + +manage_dirs_pattern(afs_vlserver_t, afs_logfile_t, afs_logfile_t) +manage_files_pattern(afs_vlserver_t, afs_logfile_t, afs_logfile_t) + +manage_files_pattern(afs_vlserver_t, afs_dbdir_t, afs_vl_db_t) +filetrans_pattern(afs_vlserver_t, afs_dbdir_t, afs_vl_db_t, file) + +corenet_all_recvfrom_unlabeled(afs_vlserver_t) +corenet_all_recvfrom_netlabel(afs_vlserver_t) +corenet_tcp_sendrecv_generic_if(afs_vlserver_t) +corenet_udp_sendrecv_generic_if(afs_vlserver_t) +corenet_tcp_sendrecv_generic_node(afs_vlserver_t) +corenet_udp_sendrecv_generic_node(afs_vlserver_t) +corenet_tcp_sendrecv_all_ports(afs_vlserver_t) +corenet_udp_sendrecv_all_ports(afs_vlserver_t) +corenet_udp_bind_generic_node(afs_vlserver_t) +corenet_udp_bind_afs_vl_port(afs_vlserver_t) +corenet_sendrecv_afs_vl_server_packets(afs_vlserver_t) + +dev_read_urand(afs_vlserver_t) + +userdom_dontaudit_use_user_terminals(afs_vlserver_t) + +######################################## +# +# Global local policy +# + +allow afs_domain self:udp_socket create_socket_perms; + +files_read_etc_files(afs_domain) + +miscfiles_read_localization(afs_domain) + +sysnet_read_config(afs_domain) |