[28] | 1 | policy_module(misc,1.0.0) |
---|
| 2 | |
---|
[79] | 3 | ### AFS ### |
---|
| 4 | |
---|
| 5 | require { |
---|
| 6 | type crond_t, kernel_t, sshd_t, user_t, httpd_t; |
---|
[81] | 7 | type postfix_local_t, procmail_t; |
---|
[79] | 8 | type proc_t; |
---|
| 9 | } |
---|
| 10 | afs_access(afsd_t); |
---|
| 11 | afs_access(crond_t); |
---|
| 12 | afs_access(httpd_t); |
---|
| 13 | afs_access(kernel_t); |
---|
[81] | 14 | afs_access(postfix_local_t); |
---|
| 15 | afs_access(procmail_t); |
---|
[79] | 16 | afs_access(sshd_t); |
---|
| 17 | afs_access(user_t); |
---|
| 18 | |
---|
| 19 | require { |
---|
| 20 | type initrc_t; |
---|
| 21 | } |
---|
| 22 | # init.d script sets up cell files: |
---|
| 23 | allow initrc_t afsd_etc_t:file { setattr write }; |
---|
| 24 | # permit aklog: |
---|
| 25 | allow user_t proc_t:file write; |
---|
| 26 | |
---|
| 27 | ### CRON ### |
---|
| 28 | |
---|
| 29 | require { |
---|
| 30 | type crond_t, user_cron_spool_t; |
---|
| 31 | type user_t; |
---|
| 32 | }; |
---|
| 33 | |
---|
| 34 | ### crond can switch to user_t rather than user_crond_t |
---|
| 35 | ### (we have pam_env set SELINUX_ROLE_TYPE to accomplish this) |
---|
| 36 | domain_cron_exemption_target(user_t) |
---|
| 37 | allow user_t user_cron_spool_t:file entrypoint; |
---|
| 38 | allow crond_t user_t:process transition; |
---|
| 39 | dontaudit crond_t user_t:process { noatsecure siginh rlimitinh }; |
---|
| 40 | allow crond_t user_t:fd use; |
---|
| 41 | allow user_t crond_t:fd use; |
---|
| 42 | allow user_t crond_t:fifo_file rw_file_perms; |
---|
| 43 | allow user_t crond_t:process sigchld; |
---|
| 44 | |
---|
| 45 | ### KRB ### |
---|
| 46 | |
---|
| 47 | require { |
---|
[81] | 48 | type sendmail_t, sshd_t; |
---|
[79] | 49 | }; |
---|
| 50 | |
---|
| 51 | ### sshd GSSAPI authentication |
---|
| 52 | kerberos_read_keytab(sshd_t) |
---|
| 53 | allow user_t kernel_t:key search; |
---|
| 54 | |
---|
| 55 | ### MAIL ### |
---|
| 56 | mta_sendmail_exec(user_t) |
---|
| 57 | can_exec(user_t, sendmail_exec_t) |
---|
[81] | 58 | allow sendmail_t postfix_local_t:fd use; |
---|
| 59 | allow sendmail_t postfix_local_t:fifo_file { getattr write }; |
---|
| 60 | corecmd_exec_bin(procmail_t) |
---|
| 61 | corecmd_exec_sbin(procmail_t) |
---|
[79] | 62 | |
---|
| 63 | ### HTTPD ### |
---|
| 64 | allow httpd_t self:key all_key_perms; |
---|