221 lines
5 KiB
Text
221 lines
5 KiB
Text
policy_module(rhcd, 1.0.0)
|
|
|
|
########################################
|
|
#
|
|
# Declarations
|
|
#
|
|
|
|
type rhcd_t;
|
|
type rhcd_exec_t;
|
|
init_daemon_domain(rhcd_t, rhcd_exec_t)
|
|
|
|
type rhcd_unit_file_t;
|
|
systemd_unit_file(rhcd_unit_file_t)
|
|
|
|
type rhcd_tmp_t;
|
|
files_tmp_file(rhcd_tmp_t)
|
|
|
|
type rhcd_tmpfs_t;
|
|
files_tmpfs_file(rhcd_tmpfs_t)
|
|
|
|
type rhcd_var_log_t;
|
|
logging_log_file(rhcd_var_log_t)
|
|
|
|
type rhcd_var_run_t;
|
|
files_pid_file(rhcd_var_run_t)
|
|
|
|
########################################
|
|
#
|
|
# rhcd local policy
|
|
#
|
|
allow rhcd_t self:capability { audit_write dac_override fowner sys_admin sys_rawio sys_resource};
|
|
allow rhcd_t self:fifo_file rw_fifo_file_perms;
|
|
allow rhcd_t self:netlink_audit_socket { create_socket_perms nlmsg_relay };
|
|
allow rhcd_t self:netlink_generic_socket create_socket_perms;
|
|
allow rhcd_t self:netlink_route_socket create_netlink_socket_perms;
|
|
allow rhcd_t self:netlink_tcpdiag_socket create_netlink_socket_perms;
|
|
allow rhcd_t self:process setsched;
|
|
allow rhcd_t self:tcp_socket create_stream_socket_perms;
|
|
allow rhcd_t self:udp_socket create_socket_perms;
|
|
allow rhcd_t self:unix_dgram_socket create_socket_perms;
|
|
allow rhcd_t self:unix_stream_socket { connectto create_stream_socket_perms };
|
|
|
|
manage_files_pattern(rhcd_t, rhcd_var_log_t, rhcd_var_log_t)
|
|
manage_dirs_pattern(rhcd_t, rhcd_var_log_t, rhcd_var_log_t)
|
|
logging_log_filetrans(rhcd_t, rhcd_var_log_t, dir)
|
|
|
|
manage_dirs_pattern(rhcd_t, rhcd_var_run_t, rhcd_var_run_t)
|
|
manage_files_pattern(rhcd_t, rhcd_var_run_t, rhcd_var_run_t)
|
|
files_pid_filetrans(rhcd_t, rhcd_var_run_t, { dir })
|
|
|
|
manage_dirs_pattern(rhcd_t, rhcd_tmp_t, rhcd_tmp_t)
|
|
manage_files_pattern(rhcd_t, rhcd_tmp_t, rhcd_tmp_t)
|
|
files_tmp_filetrans(rhcd_t, rhcd_tmp_t, { dir file })
|
|
|
|
manage_files_pattern(rhcd_t, rhcd_tmpfs_t, rhcd_tmpfs_t)
|
|
fs_tmpfs_filetrans(rhcd_t, rhcd_tmpfs_t, file)
|
|
allow rhcd_t rhcd_tmpfs_t:file map;
|
|
|
|
kernel_list_proc(rhcd_t)
|
|
kernel_read_device_sysctls(rhcd_t)
|
|
kernel_read_fs_sysctls(rhcd_t)
|
|
kernel_read_kernel_ns_lastpid_sysctls(rhcd_t)
|
|
kernel_read_net_sysctls(rhcd_t)
|
|
kernel_read_network_state(rhcd_t)
|
|
kernel_read_proc_files(rhcd_t)
|
|
kernel_read_security_state(rhcd_t)
|
|
kernel_read_software_raid_state(rhcd_t)
|
|
kernel_read_sysctl(rhcd_t)
|
|
kernel_read_system_state(rhcd_t)
|
|
kernel_read_unix_sysctls(rhcd_t)
|
|
kernel_read_vm_sysctls(rhcd_t)
|
|
kernel_view_key(rhcd_t)
|
|
|
|
corecmd_exec_all_executables(rhcd_t)
|
|
corecmd_watch_bin_dirs(rhcd_t)
|
|
|
|
corenet_tcp_connect_http_port(rhcd_t)
|
|
corenet_tcp_connect_unreserved_ports(rhcd_t)
|
|
corenet_tcp_bind_generic_node(rhcd_t)
|
|
|
|
dev_getattr_all(rhcd_t)
|
|
dev_getattr_all_blk_files(rhcd_t)
|
|
dev_getattr_all_chr_files(rhcd_t)
|
|
dev_read_netcontrol(rhcd_t)
|
|
dev_read_sysfs(rhcd_t)
|
|
|
|
domain_getattr_all_sockets(rhcd_t)
|
|
domain_getattr_all_pipes(rhcd_t)
|
|
domain_read_all_domains_state(rhcd_t)
|
|
domain_use_interactive_fds(rhcd_t)
|
|
|
|
files_getattr_all_files(rhcd_t)
|
|
files_getattr_all_blk_files(rhcd_t)
|
|
files_getattr_all_chr_files(rhcd_t)
|
|
files_getattr_all_file_type_fs(rhcd_t)
|
|
files_getattr_all_pipes(rhcd_t)
|
|
files_getattr_all_sockets(rhcd_t)
|
|
files_manage_etc_symlinks(rhcd_t)
|
|
files_read_all_symlinks(rhcd_t)
|
|
files_read_non_security_files(rhcd_t)
|
|
files_status_etc(rhcd_t)
|
|
|
|
fs_getattr_all_fs(rhcd_t)
|
|
|
|
init_view_key(rhcd_t)
|
|
|
|
libs_exec_ldconfig(rhcd_t)
|
|
|
|
miscfiles_read_generic_certs(rhcd_t)
|
|
miscfiles_read_localization(rhcd_t)
|
|
|
|
selinux_compute_access_vector(rhcd_t)
|
|
selinux_get_enforce_mode(rhcd_t)
|
|
|
|
seutil_read_config(rhcd_t)
|
|
seutil_read_file_contexts(rhcd_t)
|
|
|
|
storage_raw_read_fixed_disk(rhcd_t)
|
|
storage_raw_read_removable_device(rhcd_t)
|
|
|
|
sysnet_domtrans_ifconfig(rhcd_t)
|
|
sysnet_read_config(rhcd_t)
|
|
|
|
optional_policy(`
|
|
auth_read_passwd_file(rhcd_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
bootloader_exec(rhcd_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
chronyd_dgram_send(rhcd_t)
|
|
chronyd_domtrans_chronyc(rhcd_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
dbus_system_bus_client(rhcd_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
dmesg_domtrans(rhcd_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
gpg_manage_admin_home_content(rhcd_t)
|
|
gpg_domtrans(rhcd_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
insights_client_domtrans(rhcd_t)
|
|
insights_client_read_config(rhcd_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
logging_domtrans_auditctl(rhcd_t)
|
|
logging_send_syslog_msg(rhcd_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
lvm_domtrans(rhcd_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
modutils_domtrans_kmod(rhcd_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
mount_domtrans(rhcd_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
networkmanager_dbus_chat(rhcd_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
rhsmcertd_read_config_files(rhcd_t)
|
|
rhsmcertd_manage_pid_files(rhcd_t)
|
|
rhsmcertd_manage_lib_files(rhcd_t)
|
|
rhsmcertd_manage_log(rhcd_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
rpm_domtrans(rhcd_t)
|
|
rpm_hawkey_named_filetrans(rhcd_t)
|
|
rpm_manage_cache(rhcd_t)
|
|
rpm_manage_db(rhcd_t)
|
|
rpm_sigkill(rhcd_t)
|
|
rpm_signull(rhcd_t)
|
|
rpm_stream_connect(rhcd_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
ssh_exec(rhcd_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
sssd_read_config(rhcd_t)
|
|
sssd_search_lib(rhcd_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
systemd_dbus_chat_logind(rhcd_t)
|
|
systemd_status_all_unit_files(rhcd_t)
|
|
systemd_write_inhibit_pipes(rhcd_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
term_use_generic_ptys(rhcd_t)
|
|
term_use_ptmx(rhcd_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
udev_domtrans(rhcd_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
userdom_manage_admin_dirs(rhcd_t)
|
|
userdom_manage_admin_files(rhcd_t)
|
|
userdom_view_all_users_keys(rhcd_t)
|
|
')
|