Changeset 79 for selinux/build

Timestamp:

Jan 19, 2007, 6:58:44 AM (17 years ago)

Author:

presbrey

Message:

vixie-cron executes as the user under SELinux
SELinux policy for afsd and afsagent

Location:

selinux/build

Files:

• afsagent.fc (added)
• afsagent.if (added)
• afsagent.te (added)
• afsd.fc (modified) (1 diff)
• afsd.if (modified) (1 diff)
• afsd.te (modified) (4 diffs)
• misc.fc (modified) (1 diff)
• misc.te (modified) (1 diff)

selinux/build/afsd.fc

@@ -4 +4 @@
 # MCS categories: <none>
 
+/afs                    -d      gen_context(system_u:object_r:default_t,s0)
+/etc/openafs(/.*)?              gen_context(system_u:object_r:afsd_etc_t,s0)
+/usr/vice/etc(/.*)?             gen_context(system_u:object_r:afsd_etc_t,s0)
 /usr/vice/etc/afsd      --      gen_context(system_u:object_r:afsd_exec_t,s0)
-/usr/vice/etc(/.*)?             gen_context(system_u:object_r:afsd_etc_t,s0)
 /usr/vice/cache(/.*)?           gen_context(system_u:object_r:afsd_cache_t,s0)
-/afs                    -d      gen_context(system_u:object_r:default_t,s0)

selinux/build/afsd.if

@@ -32 +32 @@
         allow $1 afsd_etc_t:dir r_dir_perms;
         allow $1 afsd_etc_t:file r_file_perms;
+        allow $1 afsd_etc_t:lnk_file r_file_perms;
         allow $1 autofs_t:dir r_dir_perms;
         allow $1 autofs_t:lnk_file r_file_perms;

selinux/build/afsd.te

@@ -14 +14 @@
 type afsd_etc_t;
 type afsd_cache_t;
+#files_type(afsd_etc_t)
 files_type(afsd_etc_t)
 files_type(afsd_cache_t)
@@ -35 +36 @@
 init_use_script_ptys(afsd_t)
 domain_use_interactive_fds(afsd_t)
+term_use_console(afsd_t)
 
 files_mounton_default(afsd_t)
@@ -53 +55 @@
 allow afsd_t self:capability { sys_admin sys_nice sys_tty_config};
 
+#allow afsd_t lo_node_t:node all_node_perms;
+#allow afsd_t net_conf_t:file read;
+sysnet_dns_name_resolve(afsd_t)
+corenet_tcp_sendrecv_all_nodes(afsd_t)
+corenet_udp_sendrecv_all_nodes(afsd_t)
+
+
 require {
         type afs_bos_port_t,afs_fs_port_t,afs_fs_port_t,afs_ka_port_t,afs_pt_port_t,afs_vl_port_t;
         type netif_t, node_t;
+        type kernel_t;
 }
 allow afsd_t { self afs_bos_port_t afs_fs_port_t afs_fs_port_t afs_ka_port_t afs_pt_port_t afs_vl_port_t }:tcp_socket all_tcp_socket_perms;
@@ -62 +72 @@
 allow afsd_t node_t:node { udp_recv udp_send };
 
-require {
-        type crond_t, kernel_t, sshd_t, user_t;
-}
-afs_access(afsd_t);
-afs_access(crond_t);
-afs_access(kernel_t);
-afs_access(sshd_t);
-afs_access(user_t);
-
-require {
-        type initrc_t;
-}
-# init.d script sets up cell files:
-allow initrc_t afsd_etc_t:file { setattr write };
-# permit aklog:
-allow user_t proc_t:file write;
+allow afsd_t kernel_t:key all_key_perms;

selinux/build/misc.fc

@@ -1 @@
-/var/empty/sshd(.*)                             gen_context(system_u:object_r:sshd_t,s0)
-/var/empty/sshd/etc/localtime           --      gen_context(system_u:object_r:locale_t,s0)
+#/var/empty/sshd(.*)                            gen_context(system_u:object_r:sshd_t,s0)
+#/var/empty/sshd/etc/localtime          --      gen_context(system_u:object_r:locale_t,s0)

selinux/build/misc.te

@@ -1 +1 @@
 policy_module(misc,1.0.0)
 
+### AFS ###
+
+require {
+        type crond_t, kernel_t, sshd_t, user_t, httpd_t;
+        type proc_t;
+}
+afs_access(afsd_t);
+afs_access(crond_t);
+afs_access(httpd_t);
+afs_access(kernel_t);
+afs_access(sshd_t);
+afs_access(user_t);
+
+require {
+        type initrc_t;
+}
+# init.d script sets up cell files:
+allow initrc_t afsd_etc_t:file { setattr write };
+# permit aklog:
+allow user_t proc_t:file write;
+
+### CRON ###
+
+require {
+        type crond_t, user_cron_spool_t;
+        type user_t;
+};
+
+### crond can switch to user_t rather than user_crond_t
+### (we have pam_env set SELINUX_ROLE_TYPE to accomplish this)
+domain_cron_exemption_target(user_t)
+allow user_t user_cron_spool_t:file entrypoint;
+allow crond_t user_t:process transition;
+dontaudit crond_t user_t:process { noatsecure siginh rlimitinh };
+allow crond_t user_t:fd use;
+allow user_t crond_t:fd use;
+allow user_t crond_t:fifo_file rw_file_perms;
+allow user_t crond_t:process sigchld;
+
+### KRB ###
+
+require {
+        type sshd_t;
+};
+
+### sshd GSSAPI authentication
+kerberos_read_keytab(sshd_t)
+allow user_t kernel_t:key search;
+
+### MAIL ###
+mta_sendmail_exec(user_t)
+can_exec(user_t, sendmail_exec_t)
+
+
+### HTTPD ###
+allow httpd_t self:key all_key_perms;