122 lines
3.3 KiB
Text
122 lines
3.3 KiB
Text
policy_module(lsm, 1.0.0)
|
|
|
|
########################################
|
|
#
|
|
# Declarations
|
|
#
|
|
## <desc>
|
|
## <p>
|
|
## Determine whether lsmd_plugin can
|
|
## connect to all TCP ports.
|
|
## </p>
|
|
## </desc>
|
|
gen_tunable(lsmd_plugin_connect_any, false)
|
|
|
|
type lsmd_t;
|
|
type lsmd_exec_t;
|
|
init_daemon_domain(lsmd_t, lsmd_exec_t)
|
|
|
|
type lsmd_var_run_t;
|
|
files_pid_file(lsmd_var_run_t)
|
|
|
|
type lsmd_unit_file_t;
|
|
systemd_unit_file(lsmd_unit_file_t)
|
|
|
|
type lsmd_plugin_t;
|
|
type lsmd_plugin_exec_t;
|
|
application_domain(lsmd_plugin_t, lsmd_plugin_exec_t)
|
|
role system_r types lsmd_plugin_t;
|
|
|
|
type lsmd_plugin_tmp_t;
|
|
files_tmp_file(lsmd_plugin_tmp_t)
|
|
|
|
########################################
|
|
#
|
|
# Local policy
|
|
#
|
|
|
|
allow lsmd_t self:capability { setuid setgid };
|
|
allow lsmd_t self:unix_stream_socket create_stream_socket_perms;
|
|
|
|
manage_dirs_pattern(lsmd_t, lsmd_var_run_t, lsmd_var_run_t)
|
|
manage_files_pattern(lsmd_t, lsmd_var_run_t, lsmd_var_run_t)
|
|
manage_lnk_files_pattern(lsmd_t, lsmd_var_run_t, lsmd_var_run_t)
|
|
manage_sock_files_pattern(lsmd_t, lsmd_var_run_t, lsmd_var_run_t)
|
|
files_pid_filetrans(lsmd_t, lsmd_var_run_t, { dir file sock_file })
|
|
|
|
auth_use_nsswitch(lsmd_t)
|
|
|
|
corecmd_exec_bin(lsmd_t)
|
|
corecmd_getattr_all_executables(lsmd_t)
|
|
|
|
logging_send_syslog_msg(lsmd_t)
|
|
|
|
optional_policy(`
|
|
rpm_debuginfo_domtrans(lsmd_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
sensord_domtrans(lsmd_t)
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# Local lsmd plugin policy
|
|
#
|
|
|
|
allow lsmd_plugin_t self:udp_socket create_socket_perms;
|
|
allow lsmd_plugin_t self:tcp_socket create_stream_socket_perms;
|
|
allow lsmd_plugin_t self:netlink_route_socket r_netlink_socket_perms;
|
|
allow lsmd_plugin_t self:capability { sys_admin sys_rawio } ;
|
|
|
|
domtrans_pattern(lsmd_t, lsmd_plugin_exec_t, lsmd_plugin_t)
|
|
allow lsmd_plugin_t lsmd_t:unix_stream_socket { getattr read write };
|
|
|
|
allow lsmd_t lsmd_plugin_exec_t:file { map read_file_perms };
|
|
stream_connect_pattern(lsmd_plugin_t, lsmd_var_run_t, lsmd_var_run_t, lsmd_t)
|
|
|
|
manage_files_pattern(lsmd_plugin_t, lsmd_plugin_tmp_t, lsmd_plugin_tmp_t)
|
|
manage_dirs_pattern(lsmd_plugin_t, lsmd_plugin_tmp_t, lsmd_plugin_tmp_t)
|
|
files_tmp_filetrans(lsmd_plugin_t, lsmd_plugin_tmp_t, { file dir })
|
|
|
|
tunable_policy(`lsmd_plugin_connect_any',`
|
|
corenet_tcp_connect_all_ports(lsmd_plugin_t)
|
|
corenet_sendrecv_all_packets(lsmd_plugin_t)
|
|
corenet_tcp_sendrecv_all_ports(lsmd_plugin_t)
|
|
')
|
|
|
|
kernel_read_system_state(lsmd_plugin_t)
|
|
|
|
auth_read_passwd(lsmd_plugin_t)
|
|
|
|
dev_read_urand(lsmd_plugin_t)
|
|
dev_read_sysfs(lsmd_plugin_t)
|
|
|
|
corecmd_exec_bin(lsmd_plugin_t)
|
|
|
|
corenet_tcp_connect_http_port(lsmd_plugin_t)
|
|
corenet_tcp_connect_http_cache_port(lsmd_plugin_t)
|
|
corenet_tcp_connect_lsm_plugin_port(lsmd_plugin_t)
|
|
corenet_tcp_connect_pegasus_https_port(lsmd_plugin_t)
|
|
corenet_tcp_connect_pegasus_http_port(lsmd_plugin_t)
|
|
corenet_tcp_connect_ssh_port(lsmd_plugin_t)
|
|
|
|
auth_use_nsswitch(lsmd_plugin_t)
|
|
|
|
init_stream_connect(lsmd_plugin_t)
|
|
init_dontaudit_rw_stream_socket(lsmd_plugin_t)
|
|
|
|
libs_exec_ldconfig(lsmd_plugin_t)
|
|
|
|
logging_send_syslog_msg(lsmd_plugin_t)
|
|
|
|
miscfiles_read_certs(lsmd_plugin_t)
|
|
miscfiles_read_hwdata(lsmd_plugin_t)
|
|
|
|
sysnet_read_config(lsmd_plugin_t)
|
|
|
|
storage_raw_rw_fixed_disk(lsmd_plugin_t)
|
|
storage_create_fixed_disk_dev(lsmd_plugin_t)
|
|
storage_read_scsi_generic(lsmd_plugin_t)
|
|
storage_write_scsi_generic(lsmd_plugin_t)
|
|
storage_dev_filetrans_named_fixed_disk(lsmd_plugin_t)
|