331 lines
10 KiB
Text
331 lines
10 KiB
Text
|
policy_module(afs, 1.9.0)
|
||
|
|
|
||
|
|
########################################
|
||
|
|
#
|
||
|
|
# Declarations
|
||
|
|
#
|
||
|
|
|
||
|
|
attribute afs_domain;
|
||
|
|
|
||
|
|
type afs_t, afs_domain;
|
||
|
|
type afs_exec_t;
|
||
|
|
init_daemon_domain(afs_t, afs_exec_t)
|
||
|
|
|
||
|
|
type afs_bosserver_t, afs_domain;
|
||
|
|
type afs_bosserver_exec_t;
|
||
|
|
init_daemon_domain(afs_bosserver_t, afs_bosserver_exec_t)
|
||
|
|
|
||
|
|
type afs_cache_t;
|
||
|
|
files_type(afs_cache_t)
|
||
|
|
|
||
|
|
type afs_config_t;
|
||
|
|
files_type(afs_config_t)
|
||
|
|
|
||
|
|
type afs_dbdir_t;
|
||
|
|
files_type(afs_dbdir_t)
|
||
|
|
|
||
|
|
# exported files
|
||
|
|
type afs_files_t;
|
||
|
|
files_type(afs_files_t)
|
||
|
|
|
||
|
|
type afs_fsserver_t, afs_domain;
|
||
|
|
type afs_fsserver_exec_t;
|
||
|
|
domain_type(afs_fsserver_t)
|
||
|
|
domain_entry_file(afs_fsserver_t, afs_fsserver_exec_t)
|
||
|
|
role system_r types afs_fsserver_t;
|
||
|
|
|
||
|
|
type afs_initrc_exec_t;
|
||
|
|
init_script_file(afs_initrc_exec_t)
|
||
|
|
|
||
|
|
type afs_ka_db_t;
|
||
|
|
files_type(afs_ka_db_t)
|
||
|
|
|
||
|
|
type afs_kaserver_t, afs_domain;
|
||
|
|
type afs_kaserver_exec_t;
|
||
|
|
domain_type(afs_kaserver_t)
|
||
|
|
domain_entry_file(afs_kaserver_t, afs_kaserver_exec_t)
|
||
|
|
role system_r types afs_kaserver_t;
|
||
|
|
|
||
|
|
type afs_logfile_t;
|
||
|
|
logging_log_file(afs_logfile_t)
|
||
|
|
|
||
|
|
type afs_pt_db_t;
|
||
|
|
files_type(afs_pt_db_t)
|
||
|
|
|
||
|
|
type afs_ptserver_t, afs_domain;
|
||
|
|
type afs_ptserver_exec_t;
|
||
|
|
domain_type(afs_ptserver_t)
|
||
|
|
domain_entry_file(afs_ptserver_t, afs_ptserver_exec_t)
|
||
|
|
role system_r types afs_ptserver_t;
|
||
|
|
|
||
|
|
type afs_vl_db_t;
|
||
|
|
files_type(afs_vl_db_t)
|
||
|
|
|
||
|
|
type afs_vlserver_t, afs_domain;
|
||
|
|
type afs_vlserver_exec_t;
|
||
|
|
domain_type(afs_vlserver_t)
|
||
|
|
domain_entry_file(afs_vlserver_t, afs_vlserver_exec_t)
|
||
|
|
role system_r types afs_vlserver_t;
|
||
|
|
|
||
|
|
########################################
|
||
|
|
#
|
||
|
|
# afs client local policy
|
||
|
|
#
|
||
|
|
|
||
|
|
allow afs_t self:capability { dac_read_search sys_admin sys_nice sys_tty_config };
|
||
|
|
allow afs_t self:process { setsched signal };
|
||
|
|
allow afs_t self:fifo_file rw_file_perms;
|
||
|
|
allow afs_t self:unix_stream_socket { accept listen };
|
||
|
|
|
||
|
|
manage_files_pattern(afs_t, afs_cache_t, afs_cache_t)
|
||
|
|
manage_dirs_pattern(afs_t, afs_cache_t, afs_cache_t)
|
||
|
|
files_var_filetrans(afs_t, afs_cache_t, { file dir })
|
||
|
|
|
||
|
|
kernel_rw_afs_state(afs_t)
|
||
|
|
|
||
|
|
corenet_all_recvfrom_netlabel(afs_t)
|
||
|
|
corenet_tcp_sendrecv_generic_if(afs_t)
|
||
|
|
corenet_udp_sendrecv_generic_if(afs_t)
|
||
|
|
corenet_tcp_sendrecv_generic_node(afs_t)
|
||
|
|
corenet_udp_sendrecv_generic_node(afs_t)
|
||
|
|
corenet_tcp_sendrecv_all_ports(afs_t)
|
||
|
|
corenet_udp_sendrecv_all_ports(afs_t)
|
||
|
|
corenet_udp_bind_generic_node(afs_t)
|
||
|
|
|
||
|
|
files_mounton_mnt(afs_t)
|
||
|
|
files_rw_etc_runtime_files(afs_t)
|
||
|
|
|
||
|
|
fs_getattr_xattr_fs(afs_t)
|
||
|
|
fs_mount_nfs(afs_t)
|
||
|
|
fs_read_nfs_symlinks(afs_t)
|
||
|
|
|
||
|
|
logging_send_syslog_msg(afs_t)
|
||
|
|
|
||
|
|
sysnet_dns_name_resolve(afs_t)
|
||
|
|
|
||
|
|
ifdef(`hide_broken_symptoms',`
|
||
|
|
kernel_rw_unlabeled_files(afs_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
########################################
|
||
|
|
#
|
||
|
|
# AFS bossserver local policy
|
||
|
|
#
|
||
|
|
|
||
|
|
allow afs_bosserver_t self:process { setsched signal_perms };
|
||
|
|
allow afs_bosserver_t self:tcp_socket create_stream_socket_perms;
|
||
|
|
|
||
|
|
can_exec(afs_bosserver_t, afs_bosserver_exec_t)
|
||
|
|
|
||
|
|
manage_dirs_pattern(afs_bosserver_t, afs_config_t, afs_config_t)
|
||
|
|
manage_files_pattern(afs_bosserver_t, afs_config_t, afs_config_t)
|
||
|
|
filetrans_pattern(afs_bosserver_t, afs_files_t, afs_config_t, dir, "local")
|
||
|
|
|
||
|
|
manage_files_pattern(afs_bosserver_t, afs_dbdir_t, afs_dbdir_t)
|
||
|
|
manage_dirs_pattern(afs_bosserver_t, afs_dbdir_t, afs_dbdir_t)
|
||
|
|
filetrans_pattern(afs_bosserver_t, afs_files_t, afs_dbdir_t, dir, "db")
|
||
|
|
|
||
|
|
allow afs_bosserver_t afs_fsserver_t:process signal_perms;
|
||
|
|
domtrans_pattern(afs_bosserver_t, afs_fsserver_exec_t, afs_fsserver_t)
|
||
|
|
|
||
|
|
allow afs_bosserver_t afs_kaserver_t:process signal_perms;
|
||
|
|
domtrans_pattern(afs_bosserver_t, afs_kaserver_exec_t, afs_kaserver_t)
|
||
|
|
|
||
|
|
allow afs_bosserver_t afs_logfile_t:file manage_file_perms;
|
||
|
|
allow afs_bosserver_t afs_logfile_t:dir manage_dir_perms;
|
||
|
|
|
||
|
|
allow afs_bosserver_t afs_ptserver_t:process signal_perms;
|
||
|
|
domtrans_pattern(afs_bosserver_t, afs_ptserver_exec_t, afs_ptserver_t)
|
||
|
|
|
||
|
|
allow afs_bosserver_t afs_vlserver_t:process signal_perms;
|
||
|
|
domtrans_pattern(afs_bosserver_t, afs_vlserver_exec_t, afs_vlserver_t)
|
||
|
|
|
||
|
|
kernel_read_kernel_sysctls(afs_bosserver_t)
|
||
|
|
|
||
|
|
corenet_all_recvfrom_netlabel(afs_bosserver_t)
|
||
|
|
corenet_udp_sendrecv_generic_if(afs_bosserver_t)
|
||
|
|
corenet_udp_sendrecv_generic_node(afs_bosserver_t)
|
||
|
|
corenet_udp_bind_generic_node(afs_bosserver_t)
|
||
|
|
|
||
|
|
corenet_udp_bind_afs_bos_port(afs_bosserver_t)
|
||
|
|
corenet_sendrecv_afs_bos_server_packets(afs_bosserver_t)
|
||
|
|
corenet_udp_sendrecv_afs_bos_port(afs_bosserver_t)
|
||
|
|
|
||
|
|
files_list_home(afs_bosserver_t)
|
||
|
|
|
||
|
|
seutil_read_config(afs_bosserver_t)
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
kerberos_read_config(afs_bosserver_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
########################################
|
||
|
|
#
|
||
|
|
# fileserver local policy
|
||
|
|
#
|
||
|
|
|
||
|
|
allow afs_fsserver_t self:capability { kill dac_read_search chown fowner sys_nice };
|
||
|
|
dontaudit afs_fsserver_t self:capability fsetid;
|
||
|
|
allow afs_fsserver_t self:process { setsched signal_perms };
|
||
|
|
allow afs_fsserver_t self:fifo_file rw_fifo_file_perms;
|
||
|
|
allow afs_fsserver_t self:tcp_socket create_stream_socket_perms;
|
||
|
|
|
||
|
|
manage_dirs_pattern(afs_fsserver_t, afs_config_t, afs_config_t)
|
||
|
|
manage_files_pattern(afs_fsserver_t, afs_config_t, afs_config_t)
|
||
|
|
|
||
|
|
allow afs_fsserver_t afs_files_t:filesystem getattr;
|
||
|
|
manage_dirs_pattern(afs_fsserver_t, afs_files_t, afs_files_t)
|
||
|
|
manage_files_pattern(afs_fsserver_t, afs_files_t, afs_files_t)
|
||
|
|
manage_lnk_files_pattern(afs_fsserver_t, afs_files_t, afs_files_t)
|
||
|
|
manage_fifo_files_pattern(afs_fsserver_t, afs_files_t, afs_files_t)
|
||
|
|
manage_sock_files_pattern(afs_fsserver_t, afs_files_t, afs_files_t)
|
||
|
|
filetrans_pattern(afs_fsserver_t, afs_config_t, afs_files_t, { file lnk_file sock_file fifo_file })
|
||
|
|
|
||
|
|
can_exec(afs_fsserver_t, afs_fsserver_exec_t)
|
||
|
|
|
||
|
|
manage_dirs_pattern(afs_fsserver_t, afs_logfile_t, afs_logfile_t)
|
||
|
|
manage_files_pattern(afs_fsserver_t, afs_logfile_t, afs_logfile_t)
|
||
|
|
|
||
|
|
kernel_read_system_state(afs_fsserver_t)
|
||
|
|
kernel_read_kernel_sysctls(afs_fsserver_t)
|
||
|
|
|
||
|
|
corenet_all_recvfrom_unlabeled(afs_fsserver_t)
|
||
|
|
corenet_all_recvfrom_netlabel(afs_fsserver_t)
|
||
|
|
corenet_tcp_bind_generic_node(afs_fsserver_t)
|
||
|
|
corenet_udp_bind_generic_node(afs_fsserver_t)
|
||
|
|
corenet_tcp_sendrecv_generic_if(afs_fsserver_t)
|
||
|
|
corenet_udp_sendrecv_generic_if(afs_fsserver_t)
|
||
|
|
corenet_tcp_sendrecv_generic_node(afs_fsserver_t)
|
||
|
|
corenet_udp_sendrecv_generic_node(afs_fsserver_t)
|
||
|
|
corenet_tcp_sendrecv_all_ports(afs_fsserver_t)
|
||
|
|
corenet_udp_sendrecv_all_ports(afs_fsserver_t)
|
||
|
|
|
||
|
|
corenet_sendrecv_afs_fs_server_packets(afs_fsserver_t)
|
||
|
|
corenet_tcp_bind_afs_fs_port(afs_fsserver_t)
|
||
|
|
corenet_udp_bind_afs_fs_port(afs_fsserver_t)
|
||
|
|
corenet_tcp_sendrecv_afs_fs_port(afs_fsserver_t)
|
||
|
|
corenet_udp_sendrecv_afs_fs_port(afs_fsserver_t)
|
||
|
|
|
||
|
|
files_read_etc_runtime_files(afs_fsserver_t)
|
||
|
|
files_list_home(afs_fsserver_t)
|
||
|
|
files_list_pids(afs_fsserver_t)
|
||
|
|
files_dontaudit_search_mnt(afs_fsserver_t)
|
||
|
|
|
||
|
|
fs_getattr_xattr_fs(afs_fsserver_t)
|
||
|
|
|
||
|
|
term_dontaudit_use_console(afs_fsserver_t)
|
||
|
|
|
||
|
|
init_dontaudit_use_script_fds(afs_fsserver_t)
|
||
|
|
|
||
|
|
logging_send_syslog_msg(afs_fsserver_t)
|
||
|
|
|
||
|
|
seutil_read_config(afs_fsserver_t)
|
||
|
|
|
||
|
|
userdom_dontaudit_use_user_terminals(afs_fsserver_t)
|
||
|
|
|
||
|
|
########################################
|
||
|
|
#
|
||
|
|
# kaserver local policy
|
||
|
|
#
|
||
|
|
|
||
|
|
allow afs_kaserver_t self:unix_stream_socket create_stream_socket_perms;
|
||
|
|
allow afs_kaserver_t self:tcp_socket create_stream_socket_perms;
|
||
|
|
|
||
|
|
manage_files_pattern(afs_kaserver_t, afs_config_t, afs_config_t)
|
||
|
|
|
||
|
|
manage_files_pattern(afs_kaserver_t, afs_dbdir_t, afs_ka_db_t)
|
||
|
|
filetrans_pattern(afs_kaserver_t, afs_dbdir_t, afs_ka_db_t, file)
|
||
|
|
|
||
|
|
manage_dirs_pattern(afs_kaserver_t, afs_logfile_t, afs_logfile_t)
|
||
|
|
manage_files_pattern(afs_kaserver_t, afs_logfile_t, afs_logfile_t)
|
||
|
|
|
||
|
|
kernel_read_kernel_sysctls(afs_kaserver_t)
|
||
|
|
|
||
|
|
corenet_all_recvfrom_netlabel(afs_kaserver_t)
|
||
|
|
corenet_udp_sendrecv_generic_if(afs_kaserver_t)
|
||
|
|
corenet_udp_sendrecv_generic_node(afs_kaserver_t)
|
||
|
|
corenet_udp_bind_generic_node(afs_kaserver_t)
|
||
|
|
|
||
|
|
corenet_sendrecv_afs_ka_server_packets(afs_kaserver_t)
|
||
|
|
corenet_udp_bind_afs_ka_port(afs_kaserver_t)
|
||
|
|
corenet_udp_sendrecv_afs_ka_port(afs_kaserver_t)
|
||
|
|
|
||
|
|
corenet_sendrecv_kerberos_server_packets(afs_kaserver_t)
|
||
|
|
corenet_udp_bind_kerberos_port(afs_kaserver_t)
|
||
|
|
corenet_udp_sendrecv_kerberos_port(afs_kaserver_t)
|
||
|
|
|
||
|
|
files_list_home(afs_kaserver_t)
|
||
|
|
|
||
|
|
seutil_read_config(afs_kaserver_t)
|
||
|
|
|
||
|
|
userdom_dontaudit_use_user_terminals(afs_kaserver_t)
|
||
|
|
|
||
|
|
########################################
|
||
|
|
#
|
||
|
|
# ptserver local policy
|
||
|
|
#
|
||
|
|
|
||
|
|
allow afs_ptserver_t self:unix_stream_socket create_stream_socket_perms;
|
||
|
|
allow afs_ptserver_t self:tcp_socket create_stream_socket_perms;
|
||
|
|
|
||
|
|
manage_dirs_pattern(afs_ptserver_t, afs_logfile_t, afs_logfile_t)
|
||
|
|
manage_files_pattern(afs_ptserver_t, afs_logfile_t, afs_logfile_t)
|
||
|
|
|
||
|
|
manage_files_pattern(afs_ptserver_t, afs_dbdir_t, afs_pt_db_t)
|
||
|
|
filetrans_pattern(afs_ptserver_t, afs_dbdir_t, afs_pt_db_t, file)
|
||
|
|
|
||
|
|
corenet_all_recvfrom_netlabel(afs_ptserver_t)
|
||
|
|
corenet_tcp_sendrecv_generic_if(afs_ptserver_t)
|
||
|
|
corenet_udp_sendrecv_generic_if(afs_ptserver_t)
|
||
|
|
corenet_tcp_sendrecv_generic_node(afs_ptserver_t)
|
||
|
|
corenet_udp_sendrecv_generic_node(afs_ptserver_t)
|
||
|
|
corenet_tcp_sendrecv_all_ports(afs_ptserver_t)
|
||
|
|
corenet_udp_sendrecv_all_ports(afs_ptserver_t)
|
||
|
|
corenet_udp_bind_generic_node(afs_ptserver_t)
|
||
|
|
corenet_udp_bind_afs_pt_port(afs_ptserver_t)
|
||
|
|
corenet_sendrecv_afs_pt_server_packets(afs_ptserver_t)
|
||
|
|
|
||
|
|
sysnet_read_config(afs_ptserver_t)
|
||
|
|
|
||
|
|
userdom_dontaudit_use_user_terminals(afs_ptserver_t)
|
||
|
|
|
||
|
|
########################################
|
||
|
|
#
|
||
|
|
# vlserver local policy
|
||
|
|
#
|
||
|
|
|
||
|
|
allow afs_vlserver_t self:unix_stream_socket create_stream_socket_perms;
|
||
|
|
allow afs_vlserver_t self:tcp_socket create_stream_socket_perms;
|
||
|
|
|
||
|
|
manage_dirs_pattern(afs_vlserver_t, afs_logfile_t, afs_logfile_t)
|
||
|
|
manage_files_pattern(afs_vlserver_t, afs_logfile_t, afs_logfile_t)
|
||
|
|
|
||
|
|
manage_files_pattern(afs_vlserver_t, afs_dbdir_t, afs_vl_db_t)
|
||
|
|
filetrans_pattern(afs_vlserver_t, afs_dbdir_t, afs_vl_db_t, file)
|
||
|
|
|
||
|
|
corenet_all_recvfrom_netlabel(afs_vlserver_t)
|
||
|
|
corenet_tcp_sendrecv_generic_if(afs_vlserver_t)
|
||
|
|
corenet_udp_sendrecv_generic_if(afs_vlserver_t)
|
||
|
|
corenet_tcp_sendrecv_generic_node(afs_vlserver_t)
|
||
|
|
corenet_udp_sendrecv_generic_node(afs_vlserver_t)
|
||
|
|
corenet_tcp_sendrecv_all_ports(afs_vlserver_t)
|
||
|
|
corenet_udp_sendrecv_all_ports(afs_vlserver_t)
|
||
|
|
corenet_udp_bind_generic_node(afs_vlserver_t)
|
||
|
|
corenet_udp_bind_afs_vl_port(afs_vlserver_t)
|
||
|
|
corenet_sendrecv_afs_vl_server_packets(afs_vlserver_t)
|
||
|
|
|
||
|
|
userdom_dontaudit_use_user_terminals(afs_vlserver_t)
|
||
|
|
|
||
|
|
########################################
|
||
|
|
#
|
||
|
|
# Global local policy
|
||
|
|
#
|
||
|
|
|
||
|
|
allow afs_domain self:udp_socket create_socket_perms;
|
||
|
|
|
||
|
|
read_files_pattern(afs_domain, afs_config_t, afs_config_t)
|
||
|
|
allow afs_domain afs_config_t:dir list_dir_perms;
|
||
|
|
|
||
|
|
sysnet_read_config(afs_domain)
|
||
|
|
|