110 lines
3.1 KiB
Text
110 lines
3.1 KiB
Text
policy_module(mongodb, 1.1.0)
|
|
|
|
########################################
|
|
#
|
|
# Declarations
|
|
#
|
|
|
|
type mongod_t;
|
|
type mongod_exec_t;
|
|
init_daemon_domain(mongod_t, mongod_exec_t)
|
|
|
|
type mongod_initrc_exec_t;
|
|
init_script_file(mongod_initrc_exec_t)
|
|
|
|
type mongod_unit_file_t;
|
|
systemd_unit_file(mongod_unit_file_t)
|
|
|
|
type mongod_log_t;
|
|
logging_log_file(mongod_log_t)
|
|
|
|
type mongod_var_lib_t;
|
|
files_type(mongod_var_lib_t)
|
|
|
|
type mongod_var_run_t;
|
|
files_pid_file(mongod_var_run_t)
|
|
|
|
type mongod_tmp_t;
|
|
files_tmp_file(mongod_tmp_t)
|
|
|
|
########################################
|
|
#
|
|
# Local policy
|
|
#
|
|
|
|
|
|
allow mongod_t self:process { setsched signal execmem };
|
|
allow mongod_t self:fifo_file rw_fifo_file_perms;
|
|
|
|
allow mongod_t self:netlink_route_socket r_netlink_socket_perms;
|
|
allow mongod_t self:unix_stream_socket create_stream_socket_perms;
|
|
allow mongod_t self:unix_dgram_socket create_socket_perms;
|
|
allow mongod_t self:udp_socket create_socket_perms;
|
|
allow mongod_t self:tcp_socket { accept listen };
|
|
|
|
manage_files_pattern(mongod_t, mongod_log_t, mongod_log_t)
|
|
logging_log_filetrans(mongod_t, mongod_log_t, { dir file })
|
|
|
|
manage_dirs_pattern(mongod_t, mongod_var_lib_t, mongod_var_lib_t)
|
|
manage_files_pattern(mongod_t, mongod_var_lib_t, mongod_var_lib_t)
|
|
files_var_lib_filetrans(mongod_t, mongod_var_lib_t, dir)
|
|
allow mongod_t mongod_var_lib_t:file map;
|
|
|
|
manage_dirs_pattern(mongod_t, mongod_var_run_t, mongod_var_run_t)
|
|
manage_files_pattern(mongod_t, mongod_var_run_t, mongod_var_run_t)
|
|
manage_sock_files_pattern(mongod_t, mongod_var_run_t, mongod_var_run_t)
|
|
files_pid_filetrans(mongod_t, mongod_var_run_t, { dir file sock_file })
|
|
|
|
manage_dirs_pattern(mongod_t, mongod_tmp_t, mongod_tmp_t)
|
|
manage_files_pattern(mongod_t, mongod_tmp_t, mongod_tmp_t)
|
|
manage_sock_files_pattern(mongod_t, mongod_tmp_t, mongod_tmp_t)
|
|
files_tmp_filetrans(mongod_t, mongod_tmp_t, { file dir sock_file })
|
|
|
|
## In MongoDB 3.4.16, 3.6.6, 4.0.0 and later, mongod tries to read netstat
|
|
## info from /proc/net and store it in its diagnostic system (FTDC).
|
|
## See: https://jira.mongodb.org/browse/SERVER-31400
|
|
## This means that we need to adjust the policy so that the mongod
|
|
## process is allowed to open and read /proc/net/netstat, which
|
|
## also typically has symlinks (e.g. /proc/net/snmp).
|
|
kernel_list_proc(mongod_t)
|
|
kernel_read_proc_symlinks(mongod_t)
|
|
|
|
kernel_read_system_state(mongod_t)
|
|
kernel_read_network_state(mongod_t)
|
|
kernel_read_vm_sysctls(mongod_t)
|
|
|
|
corecmd_exec_bin(mongod_t)
|
|
corecmd_exec_shell(mongod_t)
|
|
|
|
corenet_all_recvfrom_unlabeled(mongod_t)
|
|
corenet_all_recvfrom_netlabel(mongod_t)
|
|
corenet_tcp_sendrecv_generic_if(mongod_t)
|
|
corenet_tcp_sendrecv_generic_node(mongod_t)
|
|
corenet_tcp_connect_mongod_port(mongod_t)
|
|
corenet_tcp_connect_http_port(mongod_t)
|
|
corenet_tcp_bind_mongod_port(mongod_t)
|
|
corenet_tcp_bind_generic_node(mongod_t)
|
|
|
|
dev_read_sysfs(mongod_t)
|
|
dev_read_urand(mongod_t)
|
|
|
|
fs_getattr_all_fs(mongod_t)
|
|
fs_search_cgroup_dirs(mongod_t)
|
|
fs_read_cgroup_files(mongod_t)
|
|
|
|
auth_use_nsswitch(mongod_t)
|
|
|
|
logging_send_syslog_msg(mongod_t)
|
|
|
|
optional_policy(`
|
|
mysql_stream_connect(mongod_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
postgresql_stream_connect(mongod_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
sysnet_dns_name_resolve(mongod_t)
|
|
')
|
|
|