630 lines
22 KiB
Text
630 lines
22 KiB
Text
|
policy_module(openshift,1.0.0)
|
||
|
|
|
||
|
|
gen_require(`
|
||
|
|
role system_r;
|
||
|
|
')
|
||
|
|
|
||
|
|
## <desc>
|
||
|
|
## <p>
|
||
|
|
## Allow openshift to access nfs file systems without labels
|
||
|
|
## </p>
|
||
|
|
## </desc>
|
||
|
|
gen_tunable(openshift_use_nfs, false)
|
||
|
|
|
||
|
|
|
||
|
|
########################################
|
||
|
|
#
|
||
|
|
# Declarations
|
||
|
|
#
|
||
|
|
|
||
|
|
|
||
|
|
# openshift applications that can use the network.
|
||
|
|
attribute openshift_net_domain;
|
||
|
|
# Attribute representing all openshift user processes (excludes apache processes)
|
||
|
|
attribute openshift_user_domain;
|
||
|
|
# Attribute representing all openshift processes
|
||
|
|
attribute openshift_domain;
|
||
|
|
|
||
|
|
# Attribute for all openshift content
|
||
|
|
attribute openshift_file_type;
|
||
|
|
|
||
|
|
# Type of openshift init script
|
||
|
|
type openshift_initrc_t;
|
||
|
|
type openshift_initrc_exec_t;
|
||
|
|
init_daemon_domain(openshift_initrc_t, openshift_initrc_exec_t)
|
||
|
|
init_ranged_daemon_domain(openshift_initrc_t, openshift_initrc_exec_t, s0 - mcs_systemhigh)
|
||
|
|
domain_obj_id_change_exemption(openshift_initrc_t)
|
||
|
|
optional_policy(`
|
||
|
|
oddjob_ranged_domain(openshift_initrc_t, openshift_initrc_exec_t, s0 - mcs_systemhigh)
|
||
|
|
')
|
||
|
|
|
||
|
|
type openshift_initrc_tmp_t;
|
||
|
|
files_tmp_file(openshift_initrc_tmp_t)
|
||
|
|
|
||
|
|
type openshift_tmpfs_t;
|
||
|
|
files_tmpfs_file(openshift_tmpfs_t)
|
||
|
|
|
||
|
|
type openshift_tmp_t, openshift_file_type;
|
||
|
|
files_tmp_file(openshift_tmp_t)
|
||
|
|
files_mountpoint(openshift_tmp_t)
|
||
|
|
files_poly(openshift_tmp_t)
|
||
|
|
files_poly_parent(openshift_tmp_t)
|
||
|
|
|
||
|
|
type openshift_app_tmp_t, openshift_file_type;
|
||
|
|
files_tmp_file(openshift_app_tmp_t)
|
||
|
|
files_mountpoint(openshift_app_tmp_t)
|
||
|
|
files_poly(openshift_app_tmp_t)
|
||
|
|
files_poly_parent(openshift_app_tmp_t)
|
||
|
|
|
||
|
|
type openshift_var_run_t;
|
||
|
|
files_pid_file(openshift_var_run_t)
|
||
|
|
|
||
|
|
type openshift_var_lib_t, openshift_file_type;
|
||
|
|
userdom_user_home_content(openshift_var_lib_t)
|
||
|
|
files_poly(openshift_var_lib_t)
|
||
|
|
files_poly_parent(openshift_var_lib_t)
|
||
|
|
files_mountpoint(openshift_var_lib_t)
|
||
|
|
|
||
|
|
type openshift_rw_file_t, openshift_file_type;
|
||
|
|
files_poly(openshift_rw_file_t)
|
||
|
|
files_poly_parent(openshift_rw_file_t)
|
||
|
|
|
||
|
|
type openshift_log_t;
|
||
|
|
logging_log_file(openshift_log_t)
|
||
|
|
|
||
|
|
type openshift_port_t;
|
||
|
|
corenet_port(openshift_port_t)
|
||
|
|
corenet_reserved_port(openshift_port_t)
|
||
|
|
|
||
|
|
type openshift_cgroup_read_t;
|
||
|
|
type openshift_cgroup_read_exec_t;
|
||
|
|
application_domain(openshift_cgroup_read_t, openshift_cgroup_read_exec_t)
|
||
|
|
|
||
|
|
type openshift_net_read_t;
|
||
|
|
type openshift_net_read_exec_t;
|
||
|
|
application_domain(openshift_net_read_t, openshift_net_read_exec_t)
|
||
|
|
|
||
|
|
type openshift_cgroup_read_tmp_t, openshift_file_type;
|
||
|
|
files_tmp_file(openshift_cgroup_read_tmp_t)
|
||
|
|
|
||
|
|
type openshift_cron_t;
|
||
|
|
type openshift_cron_exec_t;
|
||
|
|
domain_type(openshift_cron_t)
|
||
|
|
domain_entry_file(openshift_cron_t, openshift_cron_exec_t)
|
||
|
|
role system_r types openshift_cron_t;
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
cron_system_entry(openshift_cron_t, openshift_cron_exec_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
type openshift_cron_tmp_t, openshift_file_type;
|
||
|
|
files_tmp_file(openshift_cron_tmp_t)
|
||
|
|
|
||
|
|
########################################
|
||
|
|
#
|
||
|
|
# Template to create openshift_t and openshift_app_t
|
||
|
|
#
|
||
|
|
|
||
|
|
openshift_service_domain_template(openshift)
|
||
|
|
|
||
|
|
########################################
|
||
|
|
#
|
||
|
|
# openshift initrc local policy
|
||
|
|
#
|
||
|
|
|
||
|
|
unconfined_domain_noaudit(openshift_initrc_t)
|
||
|
|
mcs_process_set_categories(openshift_initrc_t)
|
||
|
|
|
||
|
|
virt_sandbox_domain(openshift_initrc_t)
|
||
|
|
|
||
|
|
systemd_dbus_chat_logind(openshift_initrc_t)
|
||
|
|
|
||
|
|
manage_dirs_pattern(openshift_initrc_t, openshift_initrc_tmp_t, openshift_initrc_tmp_t)
|
||
|
|
manage_files_pattern(openshift_initrc_t, openshift_initrc_tmp_t, openshift_initrc_tmp_t)
|
||
|
|
manage_lnk_files_pattern(openshift_initrc_t, openshift_initrc_tmp_t, openshift_initrc_tmp_t)
|
||
|
|
files_tmp_filetrans(openshift_initrc_t, openshift_initrc_tmp_t, { file dir })
|
||
|
|
|
||
|
|
manage_dirs_pattern(openshift_initrc_t, openshift_var_run_t, openshift_var_run_t)
|
||
|
|
manage_files_pattern(openshift_initrc_t, openshift_var_run_t, openshift_var_run_t)
|
||
|
|
manage_lnk_files_pattern(openshift_initrc_t, openshift_var_run_t, openshift_var_run_t)
|
||
|
|
files_pid_filetrans(openshift_initrc_t, openshift_var_run_t, { file dir })
|
||
|
|
|
||
|
|
manage_dirs_pattern(openshift_initrc_t, openshift_log_t, openshift_log_t)
|
||
|
|
manage_files_pattern(openshift_initrc_t, openshift_log_t, openshift_log_t)
|
||
|
|
logging_log_filetrans(openshift_initrc_t, openshift_log_t, { file dir })
|
||
|
|
|
||
|
|
allow openshift_initrc_t openshift_domain:process { getattr getsched setsched transition signal signull sigkill };
|
||
|
|
allow openshift_domain openshift_initrc_t:fd use;
|
||
|
|
allow openshift_domain openshift_initrc_t:fifo_file rw_inherited_fifo_file_perms;
|
||
|
|
allow openshift_domain openshift_initrc_t:process sigchld;
|
||
|
|
dontaudit openshift_domain openshift_initrc_t:key view;
|
||
|
|
dontaudit openshift_domain openshift_initrc_t:process signull;
|
||
|
|
dontaudit openshift_domain openshift_initrc_t:socket_class_set { read write };
|
||
|
|
|
||
|
|
init_domtrans_script(openshift_initrc_t)
|
||
|
|
init_initrc_domain(openshift_initrc_t)
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
firewalld_dbus_chat(openshift_initrc_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
#######################################################
|
||
|
|
#
|
||
|
|
# Policy for all openshift domains
|
||
|
|
#
|
||
|
|
allow openshift_domain self:process ~ptrace;
|
||
|
|
tunable_policy(`deny_ptrace',`',`
|
||
|
|
allow openshift_domain self:process ptrace;
|
||
|
|
')
|
||
|
|
|
||
|
|
allow openshift_domain self:msg all_msg_perms;
|
||
|
|
allow openshift_domain self:msgq create_msgq_perms;
|
||
|
|
allow openshift_domain self:shm create_shm_perms;
|
||
|
|
allow openshift_domain self:sem create_sem_perms;
|
||
|
|
dontaudit openshift_domain self:dir write;
|
||
|
|
dontaudit openshift_domain self:rawip_socket create_socket_perms;
|
||
|
|
|
||
|
|
dontaudit openshift_t self:unix_stream_socket recvfrom;
|
||
|
|
dontaudit openshift_domain self:netlink_tcpdiag_socket create;
|
||
|
|
dontaudit openshift_domain self:netlink_route_socket nlmsg_write;
|
||
|
|
allow openshift_domain self:tcp_socket create_stream_socket_perms;
|
||
|
|
allow openshift_domain self:fifo_file manage_fifo_file_perms;
|
||
|
|
allow openshift_domain self:unix_stream_socket { create_stream_socket_perms connectto };
|
||
|
|
allow openshift_domain self:unix_dgram_socket { create_socket_perms sendto };
|
||
|
|
dontaudit openshift_domain self:netlink_audit_socket { create_socket_perms nlmsg_relay };
|
||
|
|
|
||
|
|
manage_dirs_pattern(openshift_domain, openshift_rw_file_t, openshift_rw_file_t)
|
||
|
|
manage_files_pattern(openshift_domain, openshift_rw_file_t, openshift_rw_file_t)
|
||
|
|
manage_fifo_files_pattern(openshift_domain, openshift_rw_file_t, openshift_rw_file_t)
|
||
|
|
manage_sock_files_pattern(openshift_domain, openshift_rw_file_t, openshift_rw_file_t)
|
||
|
|
manage_lnk_files_pattern(openshift_domain, openshift_rw_file_t, openshift_rw_file_t)
|
||
|
|
allow openshift_domain openshift_rw_file_t:dir_file_class_set { relabelfrom relabelto };
|
||
|
|
|
||
|
|
list_dirs_pattern(openshift_domain, openshift_file_type, openshift_file_type)
|
||
|
|
read_files_pattern(openshift_domain, openshift_file_type, openshift_file_type)
|
||
|
|
rw_fifo_files_pattern(openshift_domain, openshift_file_type, openshift_file_type)
|
||
|
|
rw_sock_files_pattern(openshift_domain, openshift_file_type, openshift_file_type)
|
||
|
|
read_lnk_files_pattern(openshift_domain, openshift_file_type, openshift_file_type)
|
||
|
|
allow openshift_domain openshift_file_type:file execmod;
|
||
|
|
can_exec(openshift_domain, openshift_file_type)
|
||
|
|
allow openshift_domain openshift_file_type:file entrypoint;
|
||
|
|
# Allow users to execute files in their home dir
|
||
|
|
allow openshift_domain openshift_file_type:file { execute execute_no_trans };
|
||
|
|
|
||
|
|
# Dontaudit openshift domains trying to search other openshift domains directories,
|
||
|
|
# this happens just when users are probing the system
|
||
|
|
dontaudit openshift_domain openshift_file_type:dir search_dir_perms
|
||
|
|
;
|
||
|
|
|
||
|
|
manage_dirs_pattern(openshift_domain, openshift_tmpfs_t, openshift_tmpfs_t)
|
||
|
|
manage_files_pattern(openshift_domain, openshift_tmpfs_t, openshift_tmpfs_t)
|
||
|
|
manage_lnk_files_pattern(openshift_domain, openshift_tmpfs_t, openshift_tmpfs_t)
|
||
|
|
manage_sock_files_pattern(openshift_domain, openshift_tmpfs_t, openshift_tmpfs_t)
|
||
|
|
manage_fifo_files_pattern(openshift_domain, openshift_tmpfs_t, openshift_tmpfs_t)
|
||
|
|
fs_tmpfs_filetrans(openshift_domain, openshift_tmpfs_t, { dir file sock_file lnk_file fifo_file })
|
||
|
|
can_exec(openshift_domain, openshift_tmpfs_t)
|
||
|
|
|
||
|
|
manage_dirs_pattern(openshift_domain, openshift_tmp_t, openshift_tmp_t)
|
||
|
|
manage_fifo_files_pattern(openshift_domain, openshift_tmp_t, openshift_tmp_t)
|
||
|
|
manage_files_pattern(openshift_domain, openshift_tmp_t, openshift_tmp_t)
|
||
|
|
manage_lnk_files_pattern(openshift_domain, openshift_tmp_t, openshift_tmp_t)
|
||
|
|
manage_sock_files_pattern(openshift_domain, openshift_tmp_t, openshift_tmp_t)
|
||
|
|
files_tmp_filetrans(openshift_domain, openshift_tmp_t, { lnk_file file dir sock_file fifo_file })
|
||
|
|
allow openshift_domain openshift_tmp_t:dir_file_class_set { relabelfrom relabelto };
|
||
|
|
|
||
|
|
allow openshift_domain openshift_log_t:file { getattr append lock ioctl };
|
||
|
|
|
||
|
|
#lsof
|
||
|
|
allow openshift_domain openshift_initrc_t:tcp_socket getattr;
|
||
|
|
|
||
|
|
dontaudit openshift_domain openshift_initrc_tmp_t:file append;
|
||
|
|
dontaudit openshift_domain openshift_var_run_t:file append;
|
||
|
|
|
||
|
|
kernel_dontaudit_search_network_state(openshift_domain)
|
||
|
|
kernel_dontaudit_list_all_proc(openshift_domain)
|
||
|
|
kernel_dontaudit_list_all_sysctls(openshift_domain)
|
||
|
|
kernel_dontaudit_request_load_module(openshift_domain)
|
||
|
|
kernel_get_sysvipc_info(openshift_domain)
|
||
|
|
|
||
|
|
corecmd_shell_entry_type(openshift_domain)
|
||
|
|
corecmd_bin_entry_type(openshift_domain)
|
||
|
|
corecmd_exec_all_executables(openshift_domain)
|
||
|
|
|
||
|
|
dev_read_sysfs(openshift_domain)
|
||
|
|
dev_read_rand(openshift_domain)
|
||
|
|
dev_read_urand(openshift_domain)
|
||
|
|
dev_dontaudit_append_rand(openshift_domain)
|
||
|
|
dev_dontaudit_write_urand(openshift_domain)
|
||
|
|
dev_dontaudit_getattr_all_blk_files(openshift_domain)
|
||
|
|
dev_dontaudit_getattr_all_chr_files(openshift_domain)
|
||
|
|
dev_dontaudit_all_access_check(openshift_domain)
|
||
|
|
|
||
|
|
domain_use_interactive_fds(openshift_domain)
|
||
|
|
domain_dontaudit_read_all_domains_state(openshift_domain)
|
||
|
|
|
||
|
|
files_read_var_lib_symlinks(openshift_domain)
|
||
|
|
|
||
|
|
fs_rw_hugetlbfs_files(openshift_domain)
|
||
|
|
fs_search_tmpfs(openshift_domain)
|
||
|
|
fs_getattr_all_fs(openshift_domain)
|
||
|
|
fs_dontaudit_getattr_all_fs(openshift_domain)
|
||
|
|
fs_dontaudit_list_auto_mountpoints(openshift_domain)
|
||
|
|
fs_dontaudit_list_tmpfs(openshift_domain)
|
||
|
|
storage_dontaudit_getattr_fixed_disk_dev(openshift_domain)
|
||
|
|
storage_getattr_fixed_disk_dev(openshift_domain)
|
||
|
|
fs_get_xattr_fs_quotas(openshift_domain)
|
||
|
|
fs_rw_inherited_tmpfs_files(openshift_domain)
|
||
|
|
|
||
|
|
dontaudit openshift_domain file_type:dir read;
|
||
|
|
files_dontaudit_list_home(openshift_domain)
|
||
|
|
files_dontaudit_search_all_pids(openshift_domain)
|
||
|
|
files_dontaudit_getattr_all_dirs(openshift_domain)
|
||
|
|
files_dontaudit_getattr_all_files(openshift_domain)
|
||
|
|
files_dontaudit_list_mnt(openshift_domain)
|
||
|
|
files_dontaudit_list_var(openshift_domain)
|
||
|
|
files_dontaudit_getattr_lost_found_dirs(openshift_domain)
|
||
|
|
files_dontaudit_search_all_mountpoints(openshift_domain)
|
||
|
|
files_dontaudit_search_spool(openshift_domain)
|
||
|
|
files_dontaudit_search_all_dirs(openshift_domain)
|
||
|
|
files_exec_etc_files(openshift_domain)
|
||
|
|
files_exec_usr_files(openshift_domain)
|
||
|
|
files_dontaudit_getattr_non_security_sockets(openshift_domain)
|
||
|
|
files_dontaudit_setattr_non_security_dirs(openshift_domain)
|
||
|
|
files_dontaudit_setattr_non_security_files(openshift_domain)
|
||
|
|
files_dontaudit_rw_inherited_locks(openshift_domain)
|
||
|
|
|
||
|
|
libs_exec_lib_files(openshift_domain)
|
||
|
|
libs_exec_ld_so(openshift_domain)
|
||
|
|
|
||
|
|
selinux_validate_context(openshift_domain)
|
||
|
|
|
||
|
|
logging_inherit_append_all_logs(openshift_domain)
|
||
|
|
|
||
|
|
init_dontaudit_read_utmp(openshift_domain)
|
||
|
|
|
||
|
|
miscfiles_read_fonts(openshift_domain)
|
||
|
|
miscfiles_dontaudit_setattr_fonts_cache_dirs(openshift_domain)
|
||
|
|
|
||
|
|
mta_dontaudit_read_spool_symlinks(openshift_domain)
|
||
|
|
|
||
|
|
term_dontaudit_search_ptys(openshift_domain)
|
||
|
|
term_use_generic_ptys(openshift_domain)
|
||
|
|
term_dontaudit_getattr_generic_ptys(openshift_domain)
|
||
|
|
term_use_ptmx(openshift_domain)
|
||
|
|
|
||
|
|
userdom_use_inherited_user_ptys(openshift_domain)
|
||
|
|
userdom_dontaudit_search_admin_dir(openshift_domain)
|
||
|
|
|
||
|
|
application_exec(openshift_domain)
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
apache_exec_modules(openshift_domain)
|
||
|
|
apache_list_modules(openshift_domain)
|
||
|
|
apache_read_config(openshift_domain)
|
||
|
|
apache_search_config(openshift_domain)
|
||
|
|
apache_read_sys_content(openshift_domain)
|
||
|
|
apache_exec_sys_script(openshift_domain)
|
||
|
|
apache_entrypoint(openshift_domain)
|
||
|
|
apache_dontaudit_read_log(openshift_domain)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
#############################################
|
||
|
|
#
|
||
|
|
# openshift cgi script policy
|
||
|
|
#
|
||
|
|
apache_content_template(openshift)
|
||
|
|
apache_content_alias_template(openshift, openshift)
|
||
|
|
domtrans_pattern(openshift_script_t, openshift_initrc_exec_t, openshift_initrc_t)
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
dbus_system_bus_client(openshift_script_t)
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
oddjob_dbus_chat(openshift_script_t)
|
||
|
|
oddjob_dontaudit_rw_fifo_file(openshift_domain)
|
||
|
|
')
|
||
|
|
')
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
gpg_entry_type(openshift_domain)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
mysql_search_db(openshift_domain)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
screen_exec(openshift_domain)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
ssh_use_ptys(openshift_domain)
|
||
|
|
ssh_getattr_user_home_dir(openshift_domain)
|
||
|
|
ssh_dontaudit_search_user_home_dir(openshift_domain)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
udev_read_pid_files(openshift_domain)
|
||
|
|
')
|
||
|
|
|
||
|
|
#######################################################
|
||
|
|
#
|
||
|
|
# Policy for openshift user domain process
|
||
|
|
#
|
||
|
|
manage_dirs_pattern(openshift_user_domain, openshift_file_type, openshift_file_type)
|
||
|
|
manage_files_pattern(openshift_user_domain, openshift_file_type, openshift_file_type)
|
||
|
|
manage_fifo_files_pattern(openshift_user_domain, openshift_file_type, openshift_file_type)
|
||
|
|
manage_sock_files_pattern(openshift_user_domain, openshift_file_type, openshift_file_type)
|
||
|
|
manage_lnk_files_pattern(openshift_user_domain, openshift_file_type, openshift_file_type)
|
||
|
|
allow openshift_user_domain openshift_file_type:dir_file_class_set { relabelfrom relabelto };
|
||
|
|
|
||
|
|
allow openshift_user_domain openshift_domain:process transition;
|
||
|
|
allow openshift_domain openshift_user_domain:fd use;
|
||
|
|
allow openshift_domain openshift_user_domain:fifo_file rw_inherited_fifo_file_perms;
|
||
|
|
allow openshift_domain openshift_user_domain:process sigchld;
|
||
|
|
dontaudit openshift_domain openshift_user_domain:key view;
|
||
|
|
dontaudit openshift_domain openshift_user_domain:process signull;
|
||
|
|
dontaudit openshift_domain openshift_user_domain:socket_class_set { read write };
|
||
|
|
|
||
|
|
tunable_policy(`deny_ptrace',`',`
|
||
|
|
allow openshift_user_domain openshift_domain:process ptrace;
|
||
|
|
')
|
||
|
|
|
||
|
|
mta_signal_user_agent(openshift_user_domain)
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
ssh_rw_tcp_sockets(openshift_user_domain)
|
||
|
|
')
|
||
|
|
|
||
|
|
############################################################################
|
||
|
|
#
|
||
|
|
# Rules specific to openshift_net_domains
|
||
|
|
#
|
||
|
|
allow openshift_net_domain openshift_port_t:tcp_socket { name_connect name_bind };
|
||
|
|
allow openshift_net_domain openshift_port_t:udp_socket name_bind;
|
||
|
|
|
||
|
|
corenet_tcp_connect_mssql_port(openshift_net_domain)
|
||
|
|
corenet_tcp_connect_mysqld_port(openshift_net_domain)
|
||
|
|
corenet_tcp_connect_postgresql_port(openshift_net_domain)
|
||
|
|
corenet_tcp_connect_git_port(openshift_net_domain)
|
||
|
|
corenet_tcp_connect_oracle_port(openshift_net_domain)
|
||
|
|
corenet_tcp_connect_flash_port(openshift_net_domain)
|
||
|
|
corenet_tcp_connect_http_port(openshift_net_domain)
|
||
|
|
corenet_tcp_connect_ftp_port(openshift_net_domain)
|
||
|
|
#/* These ports are the ephemeral ports needed for ftp */
|
||
|
|
corenet_tcp_connect_virt_migration_port(openshift_net_domain)
|
||
|
|
corenet_tcp_connect_ssh_port(openshift_net_domain)
|
||
|
|
corenet_tcp_connect_jacorb_port(openshift_net_domain)
|
||
|
|
corenet_tcp_connect_jboss_management_port(openshift_net_domain)
|
||
|
|
corenet_tcp_connect_jboss_debug_port(openshift_net_domain)
|
||
|
|
corenet_tcp_connect_jboss_messaging_port(openshift_net_domain)
|
||
|
|
corenet_tcp_connect_memcache_port(openshift_net_domain)
|
||
|
|
corenet_tcp_connect_http_cache_port(openshift_net_domain)
|
||
|
|
corenet_tcp_connect_amqp_port(openshift_net_domain)
|
||
|
|
corenet_tcp_connect_generic_port(openshift_net_domain)
|
||
|
|
corenet_tcp_connect_mongod_port(openshift_net_domain)
|
||
|
|
corenet_tcp_connect_munin_port(openshift_net_domain)
|
||
|
|
corenet_tcp_connect_pop_port(openshift_net_domain)
|
||
|
|
corenet_tcp_connect_pulseaudio_port(openshift_net_domain)
|
||
|
|
corenet_tcp_connect_smtp_port(openshift_net_domain)
|
||
|
|
corenet_tcp_connect_whois_port(openshift_net_domain)
|
||
|
|
corenet_udp_bind_generic_port(openshift_net_domain)
|
||
|
|
corenet_tcp_bind_http_cache_port(openshift_domain)
|
||
|
|
corenet_tcp_bind_jacorb_port(openshift_net_domain)
|
||
|
|
corenet_tcp_bind_jboss_management_port(openshift_net_domain)
|
||
|
|
corenet_tcp_bind_jboss_messaging_port(openshift_net_domain)
|
||
|
|
corenet_tcp_bind_jboss_debug_port(openshift_net_domain)
|
||
|
|
corenet_tcp_bind_mongod_port(openshift_net_domain)
|
||
|
|
corenet_tcp_bind_mysqld_port(openshift_domain)
|
||
|
|
corenet_tcp_bind_pulseaudio_port(openshift_net_domain)
|
||
|
|
corenet_tcp_bind_postgresql_port(openshift_net_domain)
|
||
|
|
|
||
|
|
############################################################################
|
||
|
|
#
|
||
|
|
# Rules specific to openshift and openshift_app_t
|
||
|
|
#
|
||
|
|
kernel_read_vm_sysctls(openshift_t)
|
||
|
|
kernel_read_vm_sysctls(openshift_app_t)
|
||
|
|
kernel_search_vm_sysctl(openshift_t)
|
||
|
|
kernel_search_vm_sysctl(openshift_app_t)
|
||
|
|
netutils_domtrans_ping(openshift_t)
|
||
|
|
netutils_kill_ping(openshift_t)
|
||
|
|
netutils_signal_ping(openshift_t)
|
||
|
|
|
||
|
|
openshift_net_type(openshift_app_t)
|
||
|
|
openshift_net_type(openshift_t)
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
cron_role(system_r, openshift)
|
||
|
|
cron_role(system_r, openshift_app)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
postfix_rw_public_pipes(openshift_t)
|
||
|
|
postfix_manage_spool_maildrop_files(openshift_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
########################################
|
||
|
|
#
|
||
|
|
# openshift_cgroup_read local policy
|
||
|
|
#
|
||
|
|
|
||
|
|
allow openshift_cgroup_read_t self:process { getattr signal_perms };
|
||
|
|
allow openshift_cgroup_read_t self:fifo_file rw_fifo_file_perms;
|
||
|
|
allow openshift_cgroup_read_t self:unix_stream_socket create_stream_socket_perms;
|
||
|
|
allow openshift_cgroup_read_t openshift_initrc_t:fifo_file rw_inherited_fifo_file_perms;
|
||
|
|
|
||
|
|
allow openshift_cgroup_read_t openshift_file_type:file rw_inherited_file_perms;
|
||
|
|
|
||
|
|
manage_dirs_pattern(openshift_cgroup_read_t, openshift_cgroup_read_tmp_t, openshift_cgroup_read_tmp_t)
|
||
|
|
manage_files_pattern(openshift_cgroup_read_t, openshift_cgroup_read_tmp_t, openshift_cgroup_read_tmp_t)
|
||
|
|
files_tmp_filetrans(openshift_cgroup_read_t, openshift_cgroup_read_tmp_t, { file dir })
|
||
|
|
|
||
|
|
kernel_read_system_state(openshift_cgroup_read_t)
|
||
|
|
|
||
|
|
term_dontaudit_use_generic_ptys(openshift_cgroup_read_t)
|
||
|
|
|
||
|
|
auth_read_passwd(openshift_cgroup_read_t)
|
||
|
|
|
||
|
|
miscfiles_read_localization(openshift_cgroup_read_t)
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
ssh_use_ptys(openshift_cgroup_read_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
corecmd_exec_bin(openshift_cgroup_read_t)
|
||
|
|
corecmd_exec_shell(openshift_cgroup_read_t)
|
||
|
|
|
||
|
|
dev_read_urand(openshift_cgroup_read_t)
|
||
|
|
|
||
|
|
domain_use_interactive_fds(openshift_cgroup_read_t)
|
||
|
|
|
||
|
|
userdom_use_inherited_user_ptys(openshift_cgroup_read_t)
|
||
|
|
|
||
|
|
miscfiles_read_generic_certs(openshift_cgroup_read_t)
|
||
|
|
|
||
|
|
domtrans_pattern(openshift_domain, openshift_cgroup_read_exec_t, openshift_cgroup_read_t)
|
||
|
|
role system_r types openshift_cgroup_read_t;
|
||
|
|
|
||
|
|
allow openshift_domain openshift_cgroup_read_t:process { getattr signal signull sigkill };
|
||
|
|
|
||
|
|
fs_list_cgroup_dirs(openshift_cgroup_read_t)
|
||
|
|
fs_read_cgroup_files(openshift_cgroup_read_t)
|
||
|
|
|
||
|
|
allow openshift_cgroup_read_t openshift_var_lib_t:dir list_dir_perms;
|
||
|
|
manage_files_pattern(openshift_cgroup_read_t, openshift_var_lib_t, openshift_var_lib_t)
|
||
|
|
allow openshift_cgroup_read_t openshift_file_type:file rw_inherited_file_perms;
|
||
|
|
|
||
|
|
########################################
|
||
|
|
#
|
||
|
|
# openshift_net_read local policy
|
||
|
|
#
|
||
|
|
|
||
|
|
allow openshift_net_read_t self:process { getattr signal_perms };
|
||
|
|
allow openshift_net_read_t self:fifo_file rw_fifo_file_perms;
|
||
|
|
allow openshift_net_read_t self:unix_stream_socket create_stream_socket_perms;
|
||
|
|
allow openshift_net_read_t openshift_initrc_t:fifo_file rw_inherited_fifo_file_perms;
|
||
|
|
|
||
|
|
allow openshift_net_read_t openshift_file_type:file rw_inherited_file_perms;
|
||
|
|
|
||
|
|
kernel_read_network_state(openshift_net_read_t)
|
||
|
|
kernel_read_system_state(openshift_net_read_t)
|
||
|
|
|
||
|
|
corecmd_exec_bin(openshift_net_read_t)
|
||
|
|
corecmd_exec_shell(openshift_net_read_t)
|
||
|
|
|
||
|
|
dev_read_urand(openshift_net_read_t)
|
||
|
|
|
||
|
|
domain_use_interactive_fds(openshift_net_read_t)
|
||
|
|
|
||
|
|
term_dontaudit_use_generic_ptys(openshift_net_read_t)
|
||
|
|
|
||
|
|
auth_read_passwd(openshift_net_read_t)
|
||
|
|
|
||
|
|
userdom_use_inherited_user_ptys(openshift_net_read_t)
|
||
|
|
|
||
|
|
miscfiles_read_generic_certs(openshift_net_read_t)
|
||
|
|
miscfiles_read_localization(openshift_net_read_t)
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
ssh_use_ptys(openshift_net_read_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
domtrans_pattern(openshift_domain, openshift_net_read_exec_t, openshift_net_read_t)
|
||
|
|
role system_r types openshift_net_read_t;
|
||
|
|
|
||
|
|
allow openshift_domain openshift_net_read_t:process { getattr signal signull sigkill };
|
||
|
|
|
||
|
|
allow openshift_net_read_t openshift_var_lib_t:dir list_dir_perms;
|
||
|
|
manage_files_pattern(openshift_net_read_t, openshift_var_lib_t, openshift_var_lib_t)
|
||
|
|
allow openshift_net_read_t openshift_file_type:file rw_inherited_file_perms;
|
||
|
|
|
||
|
|
########################################
|
||
|
|
#
|
||
|
|
# openshift_cron local policy
|
||
|
|
#
|
||
|
|
allow openshift_cron_t self:capability { dac_read_search net_admin sys_admin };
|
||
|
|
allow openshift_cron_t self:process signal_perms;
|
||
|
|
allow openshift_cron_t self:tcp_socket create_stream_socket_perms;
|
||
|
|
allow openshift_cron_t self:udp_socket create_socket_perms;
|
||
|
|
allow openshift_cron_t self:unix_dgram_socket create_socket_perms;
|
||
|
|
allow openshift_cron_t self:netlink_route_socket rw_netlink_socket_perms;
|
||
|
|
|
||
|
|
append_files_pattern(openshift_cron_t, openshift_log_t, openshift_log_t)
|
||
|
|
manage_dirs_pattern(openshift_cron_t, openshift_cron_tmp_t, openshift_cron_tmp_t)
|
||
|
|
manage_fifo_files_pattern(openshift_cron_t, openshift_cron_tmp_t, openshift_cron_tmp_t)
|
||
|
|
manage_files_pattern(openshift_cron_t, openshift_cron_tmp_t, openshift_cron_tmp_t)
|
||
|
|
manage_lnk_files_pattern(openshift_cron_t, openshift_cron_tmp_t, openshift_cron_tmp_t)
|
||
|
|
manage_sock_files_pattern(openshift_cron_t, openshift_cron_tmp_t, openshift_cron_tmp_t)
|
||
|
|
files_tmp_filetrans(openshift_cron_t, openshift_cron_tmp_t, { lnk_file file dir sock_file fifo_file })
|
||
|
|
|
||
|
|
openshift_manage_lib_dirs(openshift_cron_t)
|
||
|
|
openshift_manage_lib_files(openshift_cron_t)
|
||
|
|
|
||
|
|
kernel_search_network_sysctl(openshift_cron_t)
|
||
|
|
kernel_read_network_state(openshift_cron_t)
|
||
|
|
kernel_read_system_state(openshift_cron_t)
|
||
|
|
|
||
|
|
files_dontaudit_search_all_mountpoints(openshift_cron_t)
|
||
|
|
|
||
|
|
corecmd_exec_bin(openshift_cron_t)
|
||
|
|
corecmd_exec_shell(openshift_cron_t)
|
||
|
|
|
||
|
|
dev_read_raw_memory(openshift_cron_t)
|
||
|
|
dev_read_urand(openshift_cron_t)
|
||
|
|
|
||
|
|
corenet_udp_bind_generic_node(openshift_cron_t)
|
||
|
|
corenet_udp_bind_generic_port(openshift_cron_t)
|
||
|
|
|
||
|
|
dev_getattr_fs(openshift_cron_t)
|
||
|
|
dev_list_sysfs(openshift_cron_t)
|
||
|
|
dev_read_sysfs(openshift_cron_t)
|
||
|
|
|
||
|
|
files_getattr_home_dir(openshift_cron_t)
|
||
|
|
files_manage_etc_files(openshift_cron_t)
|
||
|
|
|
||
|
|
fs_getattr_tmpfs_dirs(openshift_cron_t)
|
||
|
|
fs_getattr_all_fs(openshift_cron_t)
|
||
|
|
fs_list_hugetlbfs(openshift_cron_t)
|
||
|
|
fs_search_cgroup_dirs(openshift_cron_t)
|
||
|
|
|
||
|
|
seutil_domtrans_setfiles(openshift_cron_t)
|
||
|
|
|
||
|
|
term_getattr_pty_fs(openshift_cron_t)
|
||
|
|
term_search_ptys(openshift_cron_t)
|
||
|
|
|
||
|
|
auth_use_nsswitch(openshift_cron_t)
|
||
|
|
|
||
|
|
miscfiles_read_generic_certs(openshift_cron_t)
|
||
|
|
miscfiles_read_hwdata(openshift_cron_t)
|
||
|
|
|
||
|
|
sysnet_exec_ifconfig(openshift_cron_t)
|
||
|
|
sysnet_read_config(openshift_cron_t)
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
dmidecode_exec(openshift_cron_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
hostname_exec(openshift_cron_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
quota_read_db(openshift_cron_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
ssh_domtrans_keygen(openshift_cron_t)
|
||
|
|
ssh_dontaudit_read_server_keys(openshift_cron_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
tunable_policy(`openshift_use_nfs',`
|
||
|
|
fs_list_auto_mountpoints(openshift_domain)
|
||
|
|
fs_manage_nfs_dirs(openshift_domain)
|
||
|
|
fs_manage_nfs_files(openshift_domain)
|
||
|
|
fs_manage_nfs_symlinks(openshift_domain)
|
||
|
|
fs_exec_nfs_files(openshift_domain)
|
||
|
|
')
|