549 lines
17 KiB
Text
549 lines
17 KiB
Text
|
policy_module(hadoop, 1.3.0)
|
||
|
|
|
||
|
|
########################################
|
||
|
|
#
|
||
|
|
# Declarations
|
||
|
|
#
|
||
|
|
|
||
|
|
attribute hadoop_domain;
|
||
|
|
attribute hadoop_initrc_domain;
|
||
|
|
|
||
|
|
attribute hadoop_init_script_file;
|
||
|
|
attribute hadoop_pid_file;
|
||
|
|
attribute hadoop_lock_file;
|
||
|
|
attribute hadoop_log_file;
|
||
|
|
attribute hadoop_tmp_file;
|
||
|
|
attribute hadoop_var_lib_file;
|
||
|
|
|
||
|
|
attribute_role hadoop_roles;
|
||
|
|
attribute_role zookeeper_roles;
|
||
|
|
|
||
|
|
type hadoop_t;
|
||
|
|
type hadoop_exec_t;
|
||
|
|
userdom_user_application_domain(hadoop_t, hadoop_exec_t)
|
||
|
|
role hadoop_roles types hadoop_t;
|
||
|
|
|
||
|
|
type hadoop_etc_t;
|
||
|
|
files_config_file(hadoop_etc_t)
|
||
|
|
|
||
|
|
type hadoop_home_t;
|
||
|
|
userdom_user_home_content(hadoop_home_t)
|
||
|
|
|
||
|
|
type hadoop_lan_t;
|
||
|
|
corenet_spd_type(hadoop_lan_t)
|
||
|
|
|
||
|
|
type hadoop_log_t, hadoop_log_file;
|
||
|
|
logging_log_file(hadoop_log_t)
|
||
|
|
|
||
|
|
type hadoop_tmp_t, hadoop_tmp_file;
|
||
|
|
userdom_user_tmp_file(hadoop_tmp_t)
|
||
|
|
|
||
|
|
type hadoop_var_lib_t, hadoop_var_lib_file;
|
||
|
|
files_type(hadoop_var_lib_t)
|
||
|
|
|
||
|
|
type hadoop_var_run_t, hadoop_pid_file;
|
||
|
|
files_pid_file(hadoop_var_run_t)
|
||
|
|
|
||
|
|
type hadoop_hsperfdata_t;
|
||
|
|
userdom_user_tmp_file(hadoop_hsperfdata_t)
|
||
|
|
|
||
|
|
hadoop_domain_template(datanode)
|
||
|
|
hadoop_domain_template(jobtracker)
|
||
|
|
hadoop_domain_template(namenode)
|
||
|
|
hadoop_domain_template(secondarynamenode)
|
||
|
|
hadoop_domain_template(tasktracker)
|
||
|
|
|
||
|
|
type zookeeper_t;
|
||
|
|
type zookeeper_exec_t;
|
||
|
|
userdom_user_application_domain(zookeeper_t, zookeeper_exec_t)
|
||
|
|
role zookeeper_roles types zookeeper_t;
|
||
|
|
|
||
|
|
type zookeeper_etc_t;
|
||
|
|
files_config_file(zookeeper_etc_t)
|
||
|
|
|
||
|
|
type zookeeper_log_t, hadoop_log_file;
|
||
|
|
logging_log_file(zookeeper_log_t)
|
||
|
|
|
||
|
|
type zookeeper_server_t;
|
||
|
|
type zookeeper_server_exec_t;
|
||
|
|
init_daemon_domain(zookeeper_server_t, zookeeper_server_exec_t)
|
||
|
|
|
||
|
|
type zookeeper_server_initrc_exec_t, hadoop_init_script_file;
|
||
|
|
init_script_file(zookeeper_server_initrc_exec_t)
|
||
|
|
|
||
|
|
type zookeeper_server_tmp_t, hadoop_tmp_file;
|
||
|
|
files_tmp_file(zookeeper_server_tmp_t)
|
||
|
|
|
||
|
|
type zookeeper_server_var_t;
|
||
|
|
files_type(zookeeper_server_var_t)
|
||
|
|
|
||
|
|
type zookeeper_server_var_run_t, hadoop_pid_file;
|
||
|
|
files_pid_file(zookeeper_server_var_run_t)
|
||
|
|
|
||
|
|
type zookeeper_tmp_t, hadoop_tmp_file;
|
||
|
|
userdom_user_tmp_file(zookeeper_tmp_t)
|
||
|
|
|
||
|
|
########################################
|
||
|
|
#
|
||
|
|
# Local policy
|
||
|
|
#
|
||
|
|
|
||
|
|
allow hadoop_t self:capability sys_resource;
|
||
|
|
allow hadoop_t self:process { getsched setsched signal signull setrlimit execmem };
|
||
|
|
allow hadoop_t self:fifo_file rw_fifo_file_perms;
|
||
|
|
allow hadoop_t self:key write;
|
||
|
|
allow hadoop_t self:peer recv;
|
||
|
|
allow hadoop_t self:tcp_socket { accept listen };
|
||
|
|
|
||
|
|
allow hadoop_t hadoop_domain:process signull;
|
||
|
|
|
||
|
|
read_files_pattern(hadoop_t, hadoop_etc_t, hadoop_etc_t)
|
||
|
|
read_lnk_files_pattern(hadoop_t, hadoop_etc_t, hadoop_etc_t)
|
||
|
|
can_exec(hadoop_t, hadoop_etc_t)
|
||
|
|
|
||
|
|
manage_dirs_pattern(hadoop_t, hadoop_home_t, hadoop_home_t)
|
||
|
|
manage_files_pattern(hadoop_t, hadoop_home_t, hadoop_home_t)
|
||
|
|
manage_lnk_files_pattern(hadoop_t, hadoop_home_t, hadoop_home_t)
|
||
|
|
userdom_user_home_content_filetrans(hadoop_t, hadoop_home_t, { file dir })
|
||
|
|
|
||
|
|
allow hadoop_t hadoop_hsperfdata_t:dir manage_dir_perms;
|
||
|
|
files_tmp_filetrans(hadoop_t, hadoop_hsperfdata_t, dir)
|
||
|
|
|
||
|
|
manage_dirs_pattern(hadoop_t, hadoop_log_t, hadoop_log_t)
|
||
|
|
|
||
|
|
manage_dirs_pattern(hadoop_t, hadoop_tmp_t, hadoop_tmp_t)
|
||
|
|
manage_files_pattern(hadoop_t, hadoop_tmp_t, hadoop_tmp_t)
|
||
|
|
filetrans_pattern(hadoop_t, hadoop_hsperfdata_t, hadoop_tmp_t, { dir file })
|
||
|
|
|
||
|
|
manage_dirs_pattern(hadoop_t, hadoop_var_lib_t, hadoop_var_lib_t)
|
||
|
|
manage_files_pattern(hadoop_t, hadoop_var_lib_t, hadoop_var_lib_t)
|
||
|
|
files_search_var_lib(hadoop_t)
|
||
|
|
|
||
|
|
getattr_dirs_pattern(hadoop_t, hadoop_var_run_t, hadoop_var_run_t)
|
||
|
|
|
||
|
|
kernel_read_network_state(hadoop_t)
|
||
|
|
kernel_read_system_state(hadoop_t)
|
||
|
|
|
||
|
|
corecmd_exec_bin(hadoop_t)
|
||
|
|
corecmd_exec_shell(hadoop_t)
|
||
|
|
|
||
|
|
corenet_all_recvfrom_unlabeled(hadoop_t)
|
||
|
|
corenet_all_recvfrom_netlabel(hadoop_t)
|
||
|
|
corenet_tcp_sendrecv_generic_if(hadoop_t)
|
||
|
|
corenet_tcp_sendrecv_generic_node(hadoop_t)
|
||
|
|
corenet_tcp_sendrecv_all_ports(hadoop_t)
|
||
|
|
|
||
|
|
corenet_sendrecv_hadoop_namenode_client_packets(hadoop_t)
|
||
|
|
corenet_tcp_connect_hadoop_namenode_port(hadoop_t)
|
||
|
|
|
||
|
|
corenet_sendrecv_hadoop_datanode_client_packets(hadoop_t)
|
||
|
|
corenet_tcp_connect_hadoop_datanode_port(hadoop_t)
|
||
|
|
|
||
|
|
corenet_sendrecv_portmap_client_packets(hadoop_t)
|
||
|
|
corenet_tcp_connect_portmap_port(hadoop_t)
|
||
|
|
|
||
|
|
corenet_sendrecv_zope_client_packets(hadoop_t)
|
||
|
|
corenet_tcp_connect_zope_port(hadoop_t)
|
||
|
|
|
||
|
|
corenet_sendrecv_generic_client_packets(hadoop_t)
|
||
|
|
corenet_tcp_connect_generic_port(hadoop_t)
|
||
|
|
|
||
|
|
dev_read_rand(hadoop_t)
|
||
|
|
dev_read_sysfs(hadoop_t)
|
||
|
|
dev_read_urand(hadoop_t)
|
||
|
|
|
||
|
|
domain_use_interactive_fds(hadoop_t)
|
||
|
|
|
||
|
|
files_dontaudit_search_spool(hadoop_t)
|
||
|
|
|
||
|
|
fs_getattr_xattr_fs(hadoop_t)
|
||
|
|
|
||
|
|
auth_use_nsswitch(hadoop_t)
|
||
|
|
|
||
|
|
miscfiles_read_localization(hadoop_t)
|
||
|
|
|
||
|
|
userdom_use_user_terminals(hadoop_t)
|
||
|
|
|
||
|
|
hadoop_match_lan_spd(hadoop_t)
|
||
|
|
hadoop_recvfrom_datanode(hadoop_t)
|
||
|
|
hadoop_recvfrom_jobtracker(hadoop_t)
|
||
|
|
hadoop_recvfrom_namenode(hadoop_t)
|
||
|
|
hadoop_recvfrom_tasktracker(hadoop_t)
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
java_exec(hadoop_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
########################################
|
||
|
|
#
|
||
|
|
# Common hadoop_domain local policy
|
||
|
|
#
|
||
|
|
|
||
|
|
allow hadoop_domain self:capability { chown kill setgid setuid };
|
||
|
|
allow hadoop_domain self:process { execmem getsched setsched sigkill signal };
|
||
|
|
allow hadoop_domain self:fifo_file rw_fifo_file_perms;
|
||
|
|
allow hadoop_domain self:key search;
|
||
|
|
allow hadoop_domain self:peer recv;
|
||
|
|
allow hadoop_domain self:tcp_socket { accept listen };
|
||
|
|
|
||
|
|
allow hadoop_domain hadoop_domain:process signull;
|
||
|
|
|
||
|
|
allow hadoop_domain hadoop_hsperfdata_t:dir manage_dir_perms;
|
||
|
|
files_tmp_filetrans(hadoop_domain, hadoop_hsperfdata_t, dir)
|
||
|
|
|
||
|
|
hadoop_exec_config(hadoop_domain)
|
||
|
|
hadoop_match_lan_spd(hadoop_domain)
|
||
|
|
|
||
|
|
kernel_read_kernel_sysctls(hadoop_domain)
|
||
|
|
kernel_read_network_state(hadoop_domain)
|
||
|
|
kernel_read_sysctl(hadoop_domain)
|
||
|
|
kernel_read_system_state(hadoop_domain)
|
||
|
|
|
||
|
|
corecmd_exec_bin(hadoop_domain)
|
||
|
|
corecmd_exec_shell(hadoop_domain)
|
||
|
|
|
||
|
|
corenet_all_recvfrom_unlabeled(hadoop_domain)
|
||
|
|
corenet_all_recvfrom_netlabel(hadoop_domain)
|
||
|
|
corenet_tcp_bind_all_nodes(hadoop_domain)
|
||
|
|
corenet_tcp_sendrecv_generic_if(hadoop_domain)
|
||
|
|
corenet_tcp_sendrecv_generic_node(hadoop_domain)
|
||
|
|
corenet_tcp_sendrecv_all_ports(hadoop_domain)
|
||
|
|
|
||
|
|
corenet_sendrecv_generic_client_packets(hadoop_domain)
|
||
|
|
corenet_tcp_connect_generic_port(hadoop_domain)
|
||
|
|
|
||
|
|
dev_read_rand(hadoop_domain)
|
||
|
|
dev_read_urand(hadoop_domain)
|
||
|
|
dev_read_sysfs(hadoop_domain)
|
||
|
|
|
||
|
|
files_search_pids(hadoop_domain)
|
||
|
|
files_search_var_lib(hadoop_domain)
|
||
|
|
|
||
|
|
auth_domtrans_chkpwd(hadoop_domain)
|
||
|
|
|
||
|
|
init_read_utmp(hadoop_domain)
|
||
|
|
init_use_fds(hadoop_domain)
|
||
|
|
init_use_script_fds(hadoop_domain)
|
||
|
|
init_use_script_ptys(hadoop_domain)
|
||
|
|
|
||
|
|
logging_search_logs(hadoop_domain)
|
||
|
|
logging_send_audit_msgs(hadoop_domain)
|
||
|
|
logging_send_syslog_msg(hadoop_domain)
|
||
|
|
|
||
|
|
miscfiles_read_localization(hadoop_domain)
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
java_exec(hadoop_domain)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
su_exec(hadoop_domain)
|
||
|
|
')
|
||
|
|
|
||
|
|
########################################
|
||
|
|
#
|
||
|
|
# Common hadoop_initrc_domain local policy
|
||
|
|
#
|
||
|
|
|
||
|
|
allow hadoop_initrc_domain self:capability { setuid setgid };
|
||
|
|
dontaudit hadoop_initrc_domain self:capability sys_tty_config;
|
||
|
|
allow hadoop_initrc_domain self:process setsched;
|
||
|
|
allow hadoop_initrc_domain self:fifo_file rw_fifo_file_perms;
|
||
|
|
|
||
|
|
manage_dirs_pattern(hadoop_initrc_domain, hadoop_var_run_t, hadoop_var_run_t)
|
||
|
|
manage_files_pattern(hadoop_initrc_domain, hadoop_var_run_t, hadoop_var_run_t)
|
||
|
|
|
||
|
|
hadoop_exec_config(hadoop_initrc_domain)
|
||
|
|
|
||
|
|
kernel_read_kernel_sysctls(hadoop_initrc_domain)
|
||
|
|
kernel_read_sysctl(hadoop_initrc_domain)
|
||
|
|
kernel_read_system_state(hadoop_initrc_domain)
|
||
|
|
|
||
|
|
corecmd_exec_bin(hadoop_initrc_domain)
|
||
|
|
corecmd_exec_shell(hadoop_initrc_domain)
|
||
|
|
|
||
|
|
files_search_locks(hadoop_initrc_domain)
|
||
|
|
files_search_pids(hadoop_initrc_domain)
|
||
|
|
|
||
|
|
fs_getattr_xattr_fs(hadoop_initrc_domain)
|
||
|
|
fs_search_cgroup_dirs(hadoop_initrc_domain)
|
||
|
|
|
||
|
|
term_use_generic_ptys(hadoop_initrc_domain)
|
||
|
|
|
||
|
|
init_rw_utmp(hadoop_initrc_domain)
|
||
|
|
init_use_fds(hadoop_initrc_domain)
|
||
|
|
init_use_script_ptys(hadoop_initrc_domain)
|
||
|
|
|
||
|
|
logging_search_logs(hadoop_initrc_domain)
|
||
|
|
logging_send_syslog_msg(hadoop_initrc_domain)
|
||
|
|
logging_send_audit_msgs(hadoop_initrc_domain)
|
||
|
|
|
||
|
|
miscfiles_read_localization(hadoop_initrc_domain)
|
||
|
|
|
||
|
|
userdom_dontaudit_search_user_home_dirs(hadoop_initrc_domain)
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
consoletype_exec(hadoop_initrc_domain)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
nscd_use(hadoop_initrc_domain)
|
||
|
|
')
|
||
|
|
|
||
|
|
########################################
|
||
|
|
#
|
||
|
|
# Datanode local policy
|
||
|
|
#
|
||
|
|
|
||
|
|
manage_dirs_pattern(hadoop_datanode_t, hadoop_var_lib_t, hadoop_var_lib_t)
|
||
|
|
|
||
|
|
corenet_sendrecv_hadoop_datanode_server_packets(hadoop_datanode_t)
|
||
|
|
corenet_tcp_bind_hadoop_datanode_port(hadoop_datanode_t)
|
||
|
|
|
||
|
|
corenet_sendrecv_hadoop_datanode_client_packets(hadoop_datanode_t)
|
||
|
|
corenet_tcp_connect_hadoop_datanode_port(hadoop_datanode_t)
|
||
|
|
|
||
|
|
corenet_sendrecv_hadoop_namenode_client_packets(hadoop_datanode_t)
|
||
|
|
corenet_tcp_connect_hadoop_namenode_port(hadoop_datanode_t)
|
||
|
|
|
||
|
|
fs_getattr_xattr_fs(hadoop_datanode_t)
|
||
|
|
|
||
|
|
hadoop_recvfrom_jobtracker(hadoop_datanode_t)
|
||
|
|
hadoop_recvfrom_namenode(hadoop_datanode_t)
|
||
|
|
hadoop_recvfrom(hadoop_datanode_t)
|
||
|
|
hadoop_recvfrom_tasktracker(hadoop_datanode_t)
|
||
|
|
|
||
|
|
########################################
|
||
|
|
#
|
||
|
|
# Jobtracker local policy
|
||
|
|
#
|
||
|
|
|
||
|
|
create_dirs_pattern(hadoop_jobtracker_t, hadoop_jobtracker_log_t, hadoop_jobtracker_log_t)
|
||
|
|
setattr_dirs_pattern(hadoop_jobtracker_t, hadoop_jobtracker_log_t, hadoop_jobtracker_log_t)
|
||
|
|
|
||
|
|
manage_dirs_pattern(hadoop_jobtracker_t, hadoop_var_lib_t, hadoop_var_lib_t)
|
||
|
|
|
||
|
|
corenet_sendrecv_zope_server_packets(hadoop_jobtracker_t)
|
||
|
|
corenet_tcp_bind_zope_port(hadoop_jobtracker_t)
|
||
|
|
|
||
|
|
corenet_sendrecv_hadoop_datanode_client_packets(hadoop_jobtracker_t)
|
||
|
|
corenet_tcp_connect_hadoop_datanode_port(hadoop_jobtracker_t)
|
||
|
|
|
||
|
|
corenet_sendrecv_hadoop_namenode_client_packets(hadoop_jobtracker_t)
|
||
|
|
corenet_tcp_connect_hadoop_namenode_port(hadoop_jobtracker_t)
|
||
|
|
|
||
|
|
hadoop_recvfrom_datanode(hadoop_jobtracker_t)
|
||
|
|
hadoop_recvfrom_namenode(hadoop_jobtracker_t)
|
||
|
|
hadoop_recvfrom(hadoop_jobtracker_t)
|
||
|
|
hadoop_recvfrom_tasktracker(hadoop_jobtracker_t)
|
||
|
|
|
||
|
|
########################################
|
||
|
|
#
|
||
|
|
# Namenode local policy
|
||
|
|
#
|
||
|
|
|
||
|
|
manage_dirs_pattern(hadoop_namenode_t, hadoop_var_lib_t, hadoop_var_lib_t)
|
||
|
|
manage_files_pattern(hadoop_namenode_t, hadoop_var_lib_t, hadoop_var_lib_t)
|
||
|
|
|
||
|
|
corenet_sendrecv_hadoop_namenode_server_packets(hadoop_namenode_t)
|
||
|
|
corenet_tcp_bind_hadoop_namenode_port(hadoop_namenode_t)
|
||
|
|
|
||
|
|
corenet_sendrecv_hadoop_namenode_client_packets(hadoop_namenode_t)
|
||
|
|
corenet_tcp_connect_hadoop_namenode_port(hadoop_namenode_t)
|
||
|
|
|
||
|
|
hadoop_recvfrom_datanode(hadoop_namenode_t)
|
||
|
|
hadoop_recvfrom_jobtracker(hadoop_namenode_t)
|
||
|
|
hadoop_recvfrom(hadoop_namenode_t)
|
||
|
|
hadoop_recvfrom_secondarynamenode(hadoop_namenode_t)
|
||
|
|
hadoop_recvfrom_tasktracker(hadoop_namenode_t)
|
||
|
|
|
||
|
|
########################################
|
||
|
|
#
|
||
|
|
# Secondary namenode local policy
|
||
|
|
#
|
||
|
|
|
||
|
|
manage_dirs_pattern(hadoop_secondarynamenode_t, hadoop_var_lib_t, hadoop_var_lib_t)
|
||
|
|
|
||
|
|
corenet_sendrecv_hadoop_namenode_client_packets(hadoop_secondarynamenode_t)
|
||
|
|
corenet_tcp_connect_hadoop_namenode_port(hadoop_secondarynamenode_t)
|
||
|
|
|
||
|
|
hadoop_recvfrom_namenode(hadoop_secondarynamenode_t)
|
||
|
|
|
||
|
|
########################################
|
||
|
|
#
|
||
|
|
# Tasktracker local policy
|
||
|
|
#
|
||
|
|
|
||
|
|
manage_dirs_pattern(hadoop_tasktracker_t, hadoop_tasktracker_log_t, hadoop_tasktracker_log_t)
|
||
|
|
setattr_dirs_pattern(hadoop_tasktracker_t, hadoop_log_t, hadoop_log_t)
|
||
|
|
filetrans_pattern(hadoop_tasktracker_t, hadoop_log_t, hadoop_tasktracker_log_t, dir)
|
||
|
|
|
||
|
|
manage_lnk_files_pattern(hadoop_tasktracker_t, hadoop_tasktracker_var_lib_t, hadoop_tasktracker_var_lib_t)
|
||
|
|
filetrans_pattern(hadoop_tasktracker_t, hadoop_var_lib_t, hadoop_tasktracker_var_lib_t, lnk_file)
|
||
|
|
|
||
|
|
manage_dirs_pattern(hadoop_tasktracker_t, hadoop_var_lib_t, hadoop_var_lib_t)
|
||
|
|
|
||
|
|
corenet_sendrecv_hadoop_datanode_client_packets(hadoop_tasktracker_t)
|
||
|
|
corenet_tcp_connect_hadoop_datanode_port(hadoop_tasktracker_t)
|
||
|
|
|
||
|
|
corenet_sendrecv_hadoop_namenode_client_packets(hadoop_tasktracker_t)
|
||
|
|
corenet_tcp_connect_hadoop_namenode_port(hadoop_tasktracker_t)
|
||
|
|
|
||
|
|
corenet_sendrecv_zope_client_packets(hadoop_tasktracker_t)
|
||
|
|
corenet_tcp_connect_zope_port(hadoop_tasktracker_t)
|
||
|
|
|
||
|
|
fs_getattr_xattr_fs(hadoop_tasktracker_t)
|
||
|
|
|
||
|
|
hadoop_recvfrom_datanode(hadoop_tasktracker_t)
|
||
|
|
hadoop_recvfrom_jobtracker(hadoop_tasktracker_t)
|
||
|
|
hadoop_recvfrom(hadoop_tasktracker_t)
|
||
|
|
hadoop_recvfrom_namenode(hadoop_tasktracker_t)
|
||
|
|
|
||
|
|
########################################
|
||
|
|
#
|
||
|
|
# Zookeeper client local policy
|
||
|
|
#
|
||
|
|
|
||
|
|
allow zookeeper_t self:process { getsched sigkill signal signull execmem };
|
||
|
|
allow zookeeper_t self:fifo_file rw_fifo_file_perms;
|
||
|
|
allow zookeeper_t self:tcp_socket { accept listen };
|
||
|
|
|
||
|
|
read_files_pattern(zookeeper_t, zookeeper_etc_t, zookeeper_etc_t)
|
||
|
|
read_lnk_files_pattern(zookeeper_t, zookeeper_etc_t, zookeeper_etc_t)
|
||
|
|
|
||
|
|
can_exec(zookeeper_t, zookeeper_exec_t)
|
||
|
|
|
||
|
|
allow zookeeper_t hadoop_hsperfdata_t:dir manage_dir_perms;
|
||
|
|
files_tmp_filetrans(zookeeper_t, hadoop_hsperfdata_t, dir)
|
||
|
|
|
||
|
|
allow zookeeper_t zookeeper_log_t:dir { rw_dir_perms setattr_dir_perms };
|
||
|
|
allow zookeeper_t zookeeper_log_t:file { create_file_perms append_file_perms read_file_perms setattr_file_perms };
|
||
|
|
append_files_pattern(zookeeper_t, zookeeper_log_t, zookeeper_log_t)
|
||
|
|
logging_log_filetrans(zookeeper_t, zookeeper_log_t, file)
|
||
|
|
|
||
|
|
allow zookeeper_t zookeeper_server_t:process signull;
|
||
|
|
|
||
|
|
manage_files_pattern(zookeeper_t, zookeeper_tmp_t, zookeeper_tmp_t)
|
||
|
|
filetrans_pattern(zookeeper_t, hadoop_hsperfdata_t, zookeeper_tmp_t, file)
|
||
|
|
|
||
|
|
kernel_read_network_state(zookeeper_t)
|
||
|
|
kernel_read_system_state(zookeeper_t)
|
||
|
|
|
||
|
|
corecmd_exec_bin(zookeeper_t)
|
||
|
|
corecmd_exec_shell(zookeeper_t)
|
||
|
|
|
||
|
|
corenet_all_recvfrom_unlabeled(zookeeper_t)
|
||
|
|
corenet_all_recvfrom_netlabel(zookeeper_t)
|
||
|
|
corenet_tcp_sendrecv_generic_if(zookeeper_t)
|
||
|
|
corenet_tcp_sendrecv_generic_node(zookeeper_t)
|
||
|
|
corenet_tcp_sendrecv_all_ports(zookeeper_t)
|
||
|
|
|
||
|
|
corenet_sendrecv_zookeeper_client_client_packets(zookeeper_t)
|
||
|
|
corenet_tcp_connect_zookeeper_client_port(zookeeper_t)
|
||
|
|
|
||
|
|
corenet_sendrecv_generic_client_packets(zookeeper_t)
|
||
|
|
corenet_tcp_connect_generic_port(zookeeper_t)
|
||
|
|
|
||
|
|
dev_read_rand(zookeeper_t)
|
||
|
|
dev_read_sysfs(zookeeper_t)
|
||
|
|
dev_read_urand(zookeeper_t)
|
||
|
|
|
||
|
|
domain_use_interactive_fds(zookeeper_t)
|
||
|
|
|
||
|
|
|
||
|
|
auth_use_nsswitch(zookeeper_t)
|
||
|
|
|
||
|
|
miscfiles_read_localization(zookeeper_t)
|
||
|
|
|
||
|
|
userdom_use_user_terminals(zookeeper_t)
|
||
|
|
userdom_dontaudit_search_user_home_dirs(zookeeper_t)
|
||
|
|
|
||
|
|
hadoop_match_lan_spd(zookeeper_t)
|
||
|
|
hadoop_recvfrom_zookeeper_server(zookeeper_t)
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
java_exec(zookeeper_t)
|
||
|
|
')
|
||
|
|
|
||
|
|
########################################
|
||
|
|
#
|
||
|
|
# Zookeeper server local policy
|
||
|
|
#
|
||
|
|
|
||
|
|
allow zookeeper_server_t self:capability kill;
|
||
|
|
allow zookeeper_server_t self:process { execmem getsched sigkill signal signull };
|
||
|
|
allow zookeeper_server_t self:fifo_file rw_fifo_file_perms;
|
||
|
|
allow zookeeper_server_t self:peer recv;
|
||
|
|
allow zookeeper_server_t self:tcp_socket { accept listen };
|
||
|
|
|
||
|
|
allow zookeeper_server_t hadoop_hsperfdata_t:dir manage_dir_perms;
|
||
|
|
files_tmp_filetrans(zookeeper_server_t, hadoop_hsperfdata_t, dir)
|
||
|
|
|
||
|
|
read_files_pattern(zookeeper_server_t, zookeeper_etc_t, zookeeper_etc_t)
|
||
|
|
read_lnk_files_pattern(zookeeper_server_t, zookeeper_etc_t, zookeeper_etc_t)
|
||
|
|
|
||
|
|
manage_dirs_pattern(zookeeper_server_t, zookeeper_server_var_t, zookeeper_server_var_t)
|
||
|
|
manage_files_pattern(zookeeper_server_t, zookeeper_server_var_t, zookeeper_server_var_t)
|
||
|
|
files_var_lib_filetrans(zookeeper_server_t, zookeeper_server_var_t, { dir file })
|
||
|
|
|
||
|
|
allow zookeeper_server_t zookeeper_log_t:dir { rw_dir_perms setattr_dir_perms };
|
||
|
|
allow zookeeper_server_t zookeeper_log_t:file { create_file_perms append_file_perms read_file_perms setattr_file_perms };
|
||
|
|
logging_log_filetrans(zookeeper_server_t, zookeeper_log_t, file)
|
||
|
|
|
||
|
|
manage_files_pattern(zookeeper_server_t, zookeeper_server_tmp_t, zookeeper_server_tmp_t)
|
||
|
|
filetrans_pattern(zookeeper_server_t, hadoop_hsperfdata_t, zookeeper_server_tmp_t, file)
|
||
|
|
|
||
|
|
manage_files_pattern(zookeeper_server_t, zookeeper_server_var_run_t, zookeeper_server_var_run_t)
|
||
|
|
files_pid_filetrans(zookeeper_server_t, zookeeper_server_var_run_t, file)
|
||
|
|
|
||
|
|
can_exec(zookeeper_server_t, zookeeper_server_exec_t)
|
||
|
|
|
||
|
|
kernel_read_network_state(zookeeper_server_t)
|
||
|
|
kernel_read_system_state(zookeeper_server_t)
|
||
|
|
|
||
|
|
corecmd_exec_bin(zookeeper_server_t)
|
||
|
|
corecmd_exec_shell(zookeeper_server_t)
|
||
|
|
|
||
|
|
corenet_all_recvfrom_unlabeled(zookeeper_server_t)
|
||
|
|
corenet_all_recvfrom_netlabel(zookeeper_server_t)
|
||
|
|
corenet_tcp_sendrecv_generic_if(zookeeper_server_t)
|
||
|
|
corenet_tcp_sendrecv_generic_node(zookeeper_server_t)
|
||
|
|
corenet_tcp_sendrecv_all_ports(zookeeper_server_t)
|
||
|
|
corenet_tcp_bind_generic_node(zookeeper_server_t)
|
||
|
|
|
||
|
|
corenet_sendrecv_zookeeper_client_server_packets(zookeeper_server_t)
|
||
|
|
corenet_tcp_bind_zookeeper_client_port(zookeeper_server_t)
|
||
|
|
|
||
|
|
corenet_sendrecv_zookeeper_election_server_packets(zookeeper_server_t)
|
||
|
|
corenet_tcp_bind_zookeeper_election_port(zookeeper_server_t)
|
||
|
|
|
||
|
|
corenet_sendrecv_zookeeper_leader_server_packets(zookeeper_server_t)
|
||
|
|
corenet_tcp_bind_zookeeper_leader_port(zookeeper_server_t)
|
||
|
|
|
||
|
|
corenet_sendrecv_zookeeper_election_client_packets(zookeeper_server_t)
|
||
|
|
corenet_tcp_connect_zookeeper_election_port(zookeeper_server_t)
|
||
|
|
|
||
|
|
corenet_tcp_connect_zookeeper_leader_port(zookeeper_server_t)
|
||
|
|
corenet_sendrecv_zookeeper_leader_client_packets(zookeeper_server_t)
|
||
|
|
|
||
|
|
corenet_sendrecv_generic_client_packets(zookeeper_server_t)
|
||
|
|
corenet_tcp_connect_generic_port(zookeeper_server_t)
|
||
|
|
|
||
|
|
dev_read_rand(zookeeper_server_t)
|
||
|
|
dev_read_sysfs(zookeeper_server_t)
|
||
|
|
dev_read_urand(zookeeper_server_t)
|
||
|
|
|
||
|
|
|
||
|
|
fs_getattr_xattr_fs(zookeeper_server_t)
|
||
|
|
|
||
|
|
logging_send_syslog_msg(zookeeper_server_t)
|
||
|
|
|
||
|
|
miscfiles_read_localization(zookeeper_server_t)
|
||
|
|
|
||
|
|
hadoop_match_lan_spd(zookeeper_server_t)
|
||
|
|
hadoop_recvfrom_zookeeper_client(zookeeper_server_t)
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
java_exec(zookeeper_server_t)
|
||
|
|
')
|