424 lines
12 KiB
Text
424 lines
12 KiB
Text
|
policy_module(insights_client, 1.0.0)
|
||
|
|
|
||
|
|
gen_require(`
|
||
|
|
class passwd rootok;
|
||
|
|
')
|
||
|
|
|
||
|
|
########################################
|
||
|
|
#
|
||
|
|
# Declarations
|
||
|
|
#
|
||
|
|
|
||
|
|
type insights_client_t;
|
||
|
|
type insights_client_exec_t;
|
||
|
|
init_daemon_domain(insights_client_t, insights_client_exec_t)
|
||
|
|
|
||
|
|
type insights_client_var_log_t;
|
||
|
|
logging_log_file(insights_client_var_log_t)
|
||
|
|
|
||
|
|
type insights_client_etc_t;
|
||
|
|
files_config_file(insights_client_etc_t)
|
||
|
|
|
||
|
|
type insights_client_etc_rw_t;
|
||
|
|
files_config_file(insights_client_etc_rw_t)
|
||
|
|
|
||
|
|
type insights_client_cache_t;
|
||
|
|
files_type(insights_client_cache_t)
|
||
|
|
|
||
|
|
type insights_client_var_lib_t;
|
||
|
|
files_type(insights_client_var_lib_t)
|
||
|
|
|
||
|
|
type insights_client_var_lock_t;
|
||
|
|
files_lock_file(insights_client_var_lock_t)
|
||
|
|
|
||
|
|
type insights_client_var_run_t;
|
||
|
|
files_pid_file(insights_client_var_run_t)
|
||
|
|
|
||
|
|
type insights_client_tmp_t;
|
||
|
|
files_tmp_file(insights_client_tmp_t)
|
||
|
|
|
||
|
|
type insights_client_tmpfs_t;
|
||
|
|
files_tmpfs_file(insights_client_tmpfs_t)
|
||
|
|
|
||
|
|
type insights_client_unit_file_t;
|
||
|
|
systemd_unit_file(insights_client_unit_file_t)
|
||
|
|
|
||
|
|
########################################
|
||
|
|
#
|
||
|
|
# insights_client local policy
|
||
|
|
#
|
||
|
|
allow insights_client_t self:capability { dac_override dac_read_search fowner ipc_owner kill net_admin net_raw setgid setuid sys_admin sys_nice sys_ptrace sys_rawio sys_resource };
|
||
|
|
allow insights_client_t self:cap_userns sys_ptrace;
|
||
|
|
allow insights_client_t self:fifo_file rw_fifo_file_perms;
|
||
|
|
allow insights_client_t self:netlink_generic_socket create_socket_perms;
|
||
|
|
allow insights_client_t self:netlink_netfilter_socket create_socket_perms;
|
||
|
|
allow insights_client_t self:netlink_route_socket create_netlink_socket_perms;
|
||
|
|
allow insights_client_t self:netlink_selinux_socket create_socket_perms;
|
||
|
|
allow insights_client_t self:netlink_tcpdiag_socket create_netlink_socket_perms;
|
||
|
|
allow insights_client_t self:packet_socket create_socket_perms;
|
||
|
|
allow insights_client_t self:passwd rootok;
|
||
|
|
allow insights_client_t self:process { getattr getsession setfscreate setpgid setrlimit setsched };
|
||
|
|
allow insights_client_t self:tcp_socket create_socket_perms;
|
||
|
|
allow insights_client_t self:udp_socket create_socket_perms;
|
||
|
|
allow insights_client_t self:unix_dgram_socket create_socket_perms;
|
||
|
|
allow insights_client_t self:unix_stream_socket create_stream_socket_perms;
|
||
|
|
allow insights_client_t self:vsock_socket create_socket_perms;
|
||
|
|
|
||
|
|
manage_dirs_pattern(insights_client_t, insights_client_etc_t, insights_client_etc_t)
|
||
|
|
read_files_pattern(insights_client_t, insights_client_etc_t, insights_client_etc_t)
|
||
|
|
manage_files_pattern(insights_client_t, insights_client_etc_rw_t, insights_client_etc_rw_t)
|
||
|
|
insights_client_filetrans_named_content(insights_client_t)
|
||
|
|
|
||
|
|
manage_files_pattern(insights_client_t, insights_client_cache_t, insights_client_cache_t)
|
||
|
|
|
||
|
|
manage_dirs_pattern(insights_client_t, insights_client_var_lib_t, insights_client_var_lib_t)
|
||
|
|
manage_files_pattern(insights_client_t, insights_client_var_lib_t, insights_client_var_lib_t)
|
||
|
|
files_var_lib_filetrans(insights_client_t, insights_client_var_lib_t, { dir file })
|
||
|
|
|
||
|
|
manage_dirs_pattern(insights_client_t, insights_client_var_lock_t, insights_client_var_lock_t)
|
||
|
|
manage_files_pattern(insights_client_t, insights_client_var_lock_t, insights_client_var_lock_t)
|
||
|
|
files_lock_filetrans(insights_client_t, insights_client_var_lock_t, dir)
|
||
|
|
|
||
|
|
manage_dirs_pattern(insights_client_t, insights_client_var_log_t, insights_client_var_log_t)
|
||
|
|
manage_files_pattern(insights_client_t, insights_client_var_log_t, insights_client_var_log_t)
|
||
|
|
logging_log_filetrans(insights_client_t, insights_client_var_log_t, dir)
|
||
|
|
|
||
|
|
manage_dirs_pattern(insights_client_t, insights_client_var_run_t, insights_client_var_run_t)
|
||
|
|
manage_files_pattern(insights_client_t, insights_client_var_run_t, insights_client_var_run_t)
|
||
|
|
files_pid_filetrans(insights_client_t, insights_client_var_run_t, { dir file })
|
||
|
|
|
||
|
|
manage_dirs_pattern(insights_client_t, insights_client_tmp_t, insights_client_tmp_t)
|
||
|
|
manage_files_pattern(insights_client_t, insights_client_tmp_t, insights_client_tmp_t)
|
||
|
|
manage_fifo_files_pattern(insights_client_t, insights_client_tmp_t, insights_client_tmp_t)
|
||
|
|
manage_sock_files_pattern(insights_client_t, insights_client_tmp_t, insights_client_tmp_t)
|
||
|
|
files_tmp_filetrans(insights_client_t, insights_client_tmp_t, { dir file fifo_file sock_file })
|
||
|
|
allow insights_client_t insights_client_tmp_t:dir relabel_dir_perms;
|
||
|
|
allow insights_client_t insights_client_tmp_t:file relabel_dir_perms;
|
||
|
|
|
||
|
|
manage_files_pattern(insights_client_t, insights_client_tmpfs_t, insights_client_tmpfs_t)
|
||
|
|
fs_tmpfs_filetrans(insights_client_t, insights_client_tmpfs_t, file)
|
||
|
|
can_exec(insights_client_t, insights_client_tmpfs_t)
|
||
|
|
|
||
|
|
allow insights_client_t insights_client_unit_file_t:file read_file_perms;
|
||
|
|
allow insights_client_t insights_client_unit_file_t:service manage_service_perms;
|
||
|
|
|
||
|
|
kernel_dgram_send(insights_client_t)
|
||
|
|
kernel_get_sysvipc_info(insights_client_t)
|
||
|
|
kernel_read_all_sysctls(insights_client_t)
|
||
|
|
kernel_list_all_proc(insights_client_t)
|
||
|
|
kernel_read_network_state(insights_client_t)
|
||
|
|
kernel_read_proc_files(insights_client_t)
|
||
|
|
kernel_read_ring_buffer(insights_client_t)
|
||
|
|
kernel_read_security_state(insights_client_t)
|
||
|
|
kernel_read_software_raid_state(insights_client_t)
|
||
|
|
kernel_read_system_state(insights_client_t)
|
||
|
|
kernel_request_load_module(insights_client_t)
|
||
|
|
kernel_view_key(insights_client_t)
|
||
|
|
|
||
|
|
corecmd_exec_all_executables(insights_client_t)
|
||
|
|
corenet_tcp_bind_generic_node(insights_client_t)
|
||
|
|
corenet_tcp_connect_all_ports(insights_client_t)
|
||
|
|
corenet_udp_bind_generic_node(insights_client_t)
|
||
|
|
|
||
|
|
dev_getattr_all(insights_client_t)
|
||
|
|
dev_getattr_all_blk_files(insights_client_t)
|
||
|
|
dev_getattr_all_chr_files(insights_client_t)
|
||
|
|
dev_read_cpuid(insights_client_t)
|
||
|
|
dev_read_kmsg(insights_client_t)
|
||
|
|
dev_read_netcontrol(insights_client_t)
|
||
|
|
dev_read_raw_memory(insights_client_t)
|
||
|
|
dev_read_vsock(insights_client_t)
|
||
|
|
dev_dontaudit_write_raw_memory(insights_client_t)
|
||
|
|
dev_read_sysfs(insights_client_t)
|
||
|
|
dev_rw_lvm_control(insights_client_t)
|
||
|
|
|
||
|
|
domain_connect_all_stream_sockets(insights_client_t)
|
||
|
|
domain_getattr_all_domains(insights_client_t)
|
||
|
|
domain_getattr_all_sockets(insights_client_t)
|
||
|
|
domain_getattr_all_pipes(insights_client_t)
|
||
|
|
domain_manage_all_domains_keyrings(insights_client_t)
|
||
|
|
domain_read_all_domains_state(insights_client_t)
|
||
|
|
domain_signal_all_domains(insights_client_t)
|
||
|
|
domain_signull_all_domains(insights_client_t)
|
||
|
|
domain_unix_read_all_semaphores(insights_client_t)
|
||
|
|
domain_use_interactive_fds(insights_client_t)
|
||
|
|
|
||
|
|
files_getattr_all_files(insights_client_t)
|
||
|
|
files_getattr_all_blk_files(insights_client_t)
|
||
|
|
files_getattr_all_chr_files(insights_client_t)
|
||
|
|
files_getattr_all_file_type_fs(insights_client_t)
|
||
|
|
files_getattr_all_pipes(insights_client_t)
|
||
|
|
files_getattr_all_sockets(insights_client_t)
|
||
|
|
files_manage_etc_symlinks(insights_client_t)
|
||
|
|
files_manage_generic_locks(insights_client_t)
|
||
|
|
files_map_non_security_files(insights_client_t)
|
||
|
|
files_map_read_etc_files(insights_client_t)
|
||
|
|
files_read_non_security_files(insights_client_t)
|
||
|
|
files_read_all_symlinks(insights_client_t)
|
||
|
|
files_status_etc(insights_client_t)
|
||
|
|
files_write_generic_tmp_sock_files(insights_client_t)
|
||
|
|
|
||
|
|
fs_get_all_fs_quotas(insights_client_t)
|
||
|
|
fs_getattr_all_fs(insights_client_t)
|
||
|
|
fs_getattr_all_files(insights_client_t)
|
||
|
|
fs_read_configfs_dirs(insights_client_t)
|
||
|
|
|
||
|
|
init_dontaudit_read_state(insights_client_t)
|
||
|
|
init_reload_services(insights_client_t)
|
||
|
|
init_status(insights_client_t)
|
||
|
|
init_status_all_script_files(insights_client_t)
|
||
|
|
init_view_key(insights_client_t)
|
||
|
|
|
||
|
|
libs_exec_ldconfig(insights_client_t)
|
||
|
|
|
||
|
|
miscfiles_read_generic_certs(insights_client_t)
|
||
|
|
miscfiles_read_localization(insights_client_t)
|
||
|
|
|
||
|
|
selinux_compute_access_vector(insights_client_t)
|
||
|
|
|
||
|
|
seutil_domtrans_semanage(insights_client_t)
|
||
|
|
seutil_read_config(insights_client_t)
|
||
|
|
seutil_read_module_store(insights_client_t)
|
||
|
|
|
||
|
|
storage_raw_read_fixed_disk(insights_client_t)
|
||
|
|
|
||
|
|
tunable_policy(`deny_execmem',`',`
|
||
|
|
allow insights_client_t self:process execmem;
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
abrt_dbus_chat(insights_client_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
apache_exec_modules(insights_client_t)
|
||
|
|
apache_read_semaphores(insights_client_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
auth_domtrans_chk_passwd(insights_client_t)
|
||
|
|
auth_read_passwd(insights_client_t)
|
||
|
|
auth_rw_lastlog(insights_client_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
bind_domtrans_ndc(insights_client_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
bootloader_exec(insights_client_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
certmonger_dbus_chat(insights_client_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
chronyd_dgram_send(insights_client_t)
|
||
|
|
chronyd_domtrans_chronyc(insights_client_t)
|
||
|
|
chronyd_manage_pid(insights_client_t)
|
||
|
|
chronyd_stream_connect(insights_client_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
container_runtime_domtrans(insights_client_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
cron_signull_system_job(insights_client_t)
|
||
|
|
cron_system_entry(insights_client_t, insights_client_exec_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
dbus_system_bus_client(insights_client_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
dmesg_exec(insights_client_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
dmidecode_exec(insights_client_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
fstools_domtrans(insights_client_t)
|
||
|
|
fsadm_manage_pid(insights_client_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
firewalld_dbus_chat(insights_client_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
fwupd_dbus_chat(insights_client_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
gen_require(`
|
||
|
|
type glusterd_log_t;
|
||
|
|
')
|
||
|
|
|
||
|
|
logging_log_filetrans(insights_client_t, glusterd_log_t, dir, "gluster")
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
gnome_search_gconf(insights_client_t)
|
||
|
|
gnome_manage_generic_cache_files(insights_client_t)
|
||
|
|
gnome_manage_home_config(insights_client_t)
|
||
|
|
gnome_manage_home_config_dirs(insights_client_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
gpg_domtrans(insights_client_t)
|
||
|
|
gpg_manage_admin_home_content(insights_client_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
hostname_exec(insights_client_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
init_stream_connect(insights_client_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
iptables_domtrans(insights_client_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
journalctl_domtrans(insights_client_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
logging_domtrans_auditctl(insights_client_t)
|
||
|
|
logging_manage_generic_logs(insights_client_t)
|
||
|
|
logging_mmap_generic_logs(insights_client_t)
|
||
|
|
logging_mmap_journal(insights_client_t)
|
||
|
|
logging_read_audit_config(insights_client_t)
|
||
|
|
logging_read_audit_log(insights_client_t)
|
||
|
|
logging_send_syslog_msg(insights_client_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
lpd_domtrans_lpr(insights_client_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
lvm_domtrans(insights_client_t)
|
||
|
|
lvm_manage_metadata(insights_client_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
mount_domtrans(insights_client_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
mysql_stream_connect(insights_client_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
modutils_domtrans_kmod(insights_client_t)
|
||
|
|
modutils_read_module_deps_files(insights_client_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
networkmanager_dbus_chat(insights_client_t)
|
||
|
|
networkmanager_stream_connect(insights_client_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
openvswitch_stream_connect(insights_client_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
pcp_filetrans_named_content(insights_client_t)
|
||
|
|
pcp_write_pid_sock_file(insights_client_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
postgresql_stream_connect(insights_client_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
redis_stream_connect(insights_client_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
rhcs_rw_cluster_tmpfs(insights_client_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
rhnsd_read_config(insights_client_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
rhsmcertd_manage_config_files(insights_client_t)
|
||
|
|
rhsmcertd_manage_pid_files(insights_client_t)
|
||
|
|
rhsmcertd_manage_lib_files(insights_client_t)
|
||
|
|
rhsmcertd_manage_log(insights_client_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
rpm_domtrans(insights_client_t)
|
||
|
|
rpm_manage_db(insights_client_t)
|
||
|
|
rpm_manage_cache(insights_client_t)
|
||
|
|
rpm_named_filetrans(insights_client_t)
|
||
|
|
rpm_read_db(insights_client_t)
|
||
|
|
rpm_signull(insights_client_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
rtas_errd_dontaudit_write_lock(insights_client_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
samba_manage_var_dirs(insights_client_t)
|
||
|
|
samba_manage_var_files(insights_client_t)
|
||
|
|
samba_manage_var_sock_files(insights_client_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
setroubleshoot_dbus_chat(insights_client_t)
|
||
|
|
setroubleshoot_stream_connect(insights_client_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
sysnet_exec_ifconfig(insights_client_t)
|
||
|
|
sysnet_read_config(insights_client_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
systemd_dbus_chat_logind(insights_client_t)
|
||
|
|
systemd_dbus_chat_timedated(insights_client_t)
|
||
|
|
systemd_start_all_unit_files(insights_client_t)
|
||
|
|
systemd_status_all_unit_files(insights_client_t)
|
||
|
|
systemd_machined_stream_connect(insights_client_t)
|
||
|
|
systemd_userdbd_stream_connect(insights_client_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
timedatex_dbus_chat(insights_client_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
tuned_dbus_chat(insights_client_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
unconfined_domain(insights_client_t)
|
||
|
|
unconfined_server_create_shm(insights_client_t)
|
||
|
|
unconfined_server_read_semaphores(insights_client_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
userdom_manage_admin_files(insights_client_t)
|
||
|
|
userdom_manage_user_tmp_files(insights_client_t)
|
||
|
|
userdom_user_tmp_filetrans(insights_client_t, insights_client_tmp_t, { dir file })
|
||
|
|
userdom_view_all_users_keys(insights_client_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
virt_stream_connect(insights_client_t)
|
||
|
|
')
|