diff options
Diffstat (limited to 'policy/modules/services/likewise.te')
| -rw-r--r-- | policy/modules/services/likewise.te | 254 |
1 files changed, 254 insertions, 0 deletions
diff --git a/policy/modules/services/likewise.te b/policy/modules/services/likewise.te new file mode 100644 index 00000000..d2a736ef --- /dev/null +++ b/policy/modules/services/likewise.te @@ -0,0 +1,254 @@ +policy_module(likewise, 1.6.0) + +################################# +# +# Declarations +# + +attribute likewise_domains; + +likewise_domain_template(dcerpcd) +likewise_domain_template(eventlogd) +likewise_domain_template(lsassd) +likewise_domain_template(lwiod) +likewise_domain_template(lwregd) +likewise_domain_template(lwsmd) +likewise_domain_template(netlogond) +likewise_domain_template(srvsvcd) + +type likewise_etc_t; +files_config_file(likewise_etc_t) + +type likewise_initrc_exec_t; +init_script_file(likewise_initrc_exec_t) + +type likewise_var_lib_t; +files_type(likewise_var_lib_t) + +type likewise_pstore_lock_t; +files_type(likewise_pstore_lock_t) + +type likewise_krb5_ad_t; +files_type(likewise_krb5_ad_t) + +type lsassd_tmp_t; +files_tmp_file(lsassd_tmp_t) + +################################# +# +# Common local policy +# + +allow likewise_domains likewise_var_lib_t:dir setattr_dir_perms; + +kernel_read_system_state(likewise_domains) + +dev_read_rand(likewise_domains) +dev_read_urand(likewise_domains) + +domain_use_interactive_fds(likewise_domains) + +files_read_etc_files(likewise_domains) +files_search_var_lib(likewise_domains) + +logging_send_syslog_msg(likewise_domains) + +miscfiles_read_localization(likewise_domains) + +################################# +# +# dcerpcd local policy +# + +stream_connect_pattern(dcerpcd_t, likewise_var_lib_t, lwregd_var_socket_t, lwregd_t) + +corenet_all_recvfrom_netlabel(dcerpcd_t) +corenet_all_recvfrom_unlabeled(dcerpcd_t) +corenet_tcp_sendrecv_generic_if(dcerpcd_t) +corenet_tcp_sendrecv_generic_node(dcerpcd_t) +corenet_tcp_sendrecv_generic_port(dcerpcd_t) +corenet_tcp_bind_generic_node(dcerpcd_t) +corenet_udp_bind_generic_node(dcerpcd_t) +corenet_udp_sendrecv_generic_if(dcerpcd_t) +corenet_udp_sendrecv_generic_node(dcerpcd_t) +corenet_udp_sendrecv_generic_port(dcerpcd_t) + +corenet_sendrecv_epmap_server_packets(dcerpcd_t) +corenet_tcp_bind_epmap_port(dcerpcd_t) +corenet_udp_bind_epmap_port(dcerpcd_t) + +corenet_sendrecv_generic_client_packets(dcerpcd_t) +corenet_tcp_connect_generic_port(dcerpcd_t) + +################################# +# +# eventlogd local policy +# + +stream_connect_pattern(eventlogd_t, likewise_var_lib_t, dcerpcd_var_socket_t, dcerpcd_t) +stream_connect_pattern(eventlogd_t, likewise_var_lib_t, lwregd_var_socket_t, lwregd_t) + +corenet_all_recvfrom_netlabel(eventlogd_t) +corenet_all_recvfrom_unlabeled(eventlogd_t) +corenet_tcp_sendrecv_generic_if(eventlogd_t) +corenet_tcp_sendrecv_generic_node(eventlogd_t) + +corenet_sendrecv_epmap_client_packets(eventlogd_t) +corenet_tcp_connect_epmap_port(eventlogd_t) +corenet_tcp_sendrecv_epmap_port(eventlogd_t) + +################################# +# +# lsassd local policy +# + +allow lsassd_t self:capability { chown dac_override fowner fsetid sys_time }; +allow lsassd_t self:unix_stream_socket { create_stream_socket_perms connectto }; +allow lsassd_t self:netlink_route_socket rw_netlink_socket_perms; + +allow lsassd_t likewise_krb5_ad_t:file read_file_perms; +allow lsassd_t netlogond_var_lib_t:file read_file_perms; + +manage_files_pattern(lsassd_t, likewise_etc_t, likewise_etc_t) + +manage_files_pattern(lsassd_t, lsassd_tmp_t, lsassd_tmp_t) +files_tmp_filetrans(lsassd_t, lsassd_tmp_t, file) + +stream_connect_pattern(lsassd_t, likewise_var_lib_t, dcerpcd_var_socket_t, dcerpcd_t) +stream_connect_pattern(lsassd_t, likewise_var_lib_t, eventlogd_var_socket_t, eventlogd_t) +stream_connect_pattern(lsassd_t, likewise_var_lib_t, lwiod_var_socket_t, lwiod_t) +stream_connect_pattern(lsassd_t, likewise_var_lib_t, lwregd_var_socket_t, lwregd_t) +stream_connect_pattern(lsassd_t, likewise_var_lib_t, netlogond_var_socket_t, netlogond_t) + +kernel_list_all_proc(lsassd_t) + +corecmd_exec_bin(lsassd_t) +corecmd_exec_shell(lsassd_t) + +corenet_all_recvfrom_netlabel(lsassd_t) +corenet_all_recvfrom_unlabeled(lsassd_t) +corenet_tcp_sendrecv_generic_if(lsassd_t) +corenet_tcp_sendrecv_generic_node(lsassd_t) + +corenet_sendrecv_epmap_client_packets(lsassd_t) +corenet_tcp_connect_epmap_port(lsassd_t) +corenet_tcp_sendrecv_epmap_port(lsassd_t) + +domain_obj_id_change_exemption(lsassd_t) +domain_dontaudit_search_all_domains_state(lsassd_t) + +files_manage_etc_files(lsassd_t) +files_manage_etc_symlinks(lsassd_t) +files_manage_etc_runtime_files(lsassd_t) +files_relabelto_home(lsassd_t) + +selinux_get_fs_mount(lsassd_t) +selinux_validate_context(lsassd_t) + +seutil_read_config(lsassd_t) +seutil_read_default_contexts(lsassd_t) +seutil_read_file_contexts(lsassd_t) +seutil_run_semanage(lsassd_t, system_r) + +sysnet_use_ldap(lsassd_t) + +userdom_home_filetrans_user_home_dir(lsassd_t) +userdom_manage_user_home_content_files(lsassd_t) + +optional_policy(` + kerberos_rw_keytab(lsassd_t) + kerberos_use(lsassd_t) +') + +################################# +# +# lwiod local policy +# + +allow lwiod_t self:capability { chown dac_override fowner fsetid sys_resource }; +allow lwiod_t self:process setrlimit; +allow lwiod_t self:netlink_route_socket rw_netlink_socket_perms; + +allow lwiod_t { likewise_krb5_ad_t netlogond_var_lib_t }:file read_file_perms; + +stream_connect_pattern(lwiod_t, likewise_var_lib_t, lwregd_var_socket_t, lwregd_t) +stream_connect_pattern(lwiod_t, likewise_var_lib_t, lsassd_var_socket_t, lsassd_t) +stream_connect_pattern(lwiod_t, likewise_var_lib_t, netlogond_var_socket_t, netlogond_t) + +corenet_all_recvfrom_netlabel(lwiod_t) +corenet_all_recvfrom_unlabeled(lwiod_t) +corenet_tcp_sendrecv_generic_if(lwiod_t) +corenet_tcp_sendrecv_generic_node(lwiod_t) +corenet_tcp_bind_generic_node(lwiod_t) + +corenet_sendrecv_smbd_server_packets(lwiod_t) +corenet_tcp_bind_smbd_port(lwiod_t) +corenet_sendrecv_smbd_client_packets(lwiod_t) +corenet_tcp_connect_smbd_port(lwiod_t) +corenet_tcp_sendrecv_smbd_port(lwiod_t) + +sysnet_read_config(lwiod_t) + +optional_policy(` + kerberos_rw_config(lwiod_t) + kerberos_use(lwiod_t) +') + +################################# +# +# lwsmd local policy +# + +allow lwsmd_t self:process setpgid; + +allow lwsmd_t likewise_domains:process signal; + +allow lwsmd_t { likewise_krb5_ad_t netlogond_var_lib_t }:file read_file_perms; + +domtrans_pattern(lwsmd_t, dcerpcd_exec_t, dcerpcd_t) +domtrans_pattern(lwsmd_t, eventlogd_exec_t, eventlogd_t) +domtrans_pattern(lwsmd_t, lsassd_exec_t, lsassd_t) +domtrans_pattern(lwsmd_t, lwiod_exec_t, lwiod_t) +domtrans_pattern(lwsmd_t, lwregd_exec_t, lwregd_t) +domtrans_pattern(lwsmd_t, netlogond_exec_t, netlogond_t) +domtrans_pattern(lwsmd_t, srvsvcd_exec_t, srvsvcd_t) + +stream_connect_pattern(lwsmd_t, likewise_var_lib_t, lwiod_var_socket_t, lwiod_t) +stream_connect_pattern(lwsmd_t, likewise_var_lib_t, lwregd_var_socket_t, lwregd_t) + +################################# +# +# netlogond local policy +# + +allow netlogond_t self:capability dac_override; + +manage_files_pattern(netlogond_t, likewise_etc_t, likewise_etc_t) + +stream_connect_pattern(netlogond_t, likewise_var_lib_t, lwregd_var_socket_t, lwregd_t) + +sysnet_dns_name_resolve(netlogond_t) +sysnet_use_ldap(netlogond_t) + +################################# +# +# srvsvcd local policy +# + +allow srvsvcd_t likewise_etc_t:dir search_dir_perms; + +stream_connect_pattern(srvsvcd_t, likewise_var_lib_t, dcerpcd_var_socket_t, dcerpcd_t) +stream_connect_pattern(srvsvcd_t, likewise_var_lib_t, lwiod_var_socket_t, lwiod_t) +stream_connect_pattern(srvsvcd_t, likewise_var_lib_t, lwregd_var_socket_t, lwregd_t) + +corenet_all_recvfrom_netlabel(srvsvcd_t) +corenet_all_recvfrom_unlabeled(srvsvcd_t) +corenet_sendrecv_generic_server_packets(srvsvcd_t) +corenet_tcp_sendrecv_generic_if(srvsvcd_t) +corenet_tcp_sendrecv_generic_node(srvsvcd_t) +corenet_tcp_sendrecv_generic_port(srvsvcd_t) +corenet_tcp_bind_generic_node(srvsvcd_t) + +optional_policy(` + kerberos_use(srvsvcd_t) +') |