selinux-refpolicy/refpolicy/policy/modules/services/nis.if

207 lines
5.0 KiB
Plaintext
Raw Normal View History

2005-06-24 19:49:46 +00:00
## <summary>Policy for NIS (YP) servers and clients</summary>
2005-09-29 20:59:00 +00:00
########################################
## <summary>
## Use the ypbind service to access NIS services
## unconditionally.
## </summary>
## <desc>
## <p>
## Use the ypbind service to access NIS services
## unconditionally.
## </p>
## <p>
## This interface was added because of apache and
## spamassassin, to fix a nested conditionals problem.
## When that support is added, this should be removed,
## and the regular interface should be used.
## </p>
## </desc>
## <param name="domain">
## The type of the process performing this action.
## </param>
#
interface(`nis_use_ypbind_uncond',`
gen_require(`
type var_yp_t;
')
dontaudit $1 self:capability net_bind_service;
allow $1 self:tcp_socket create_stream_socket_perms;
allow $1 self:udp_socket create_socket_perms;
allow $1 var_yp_t:dir r_dir_perms;
allow $1 var_yp_t:lnk_file { getattr read };
allow $1 var_yp_t:file r_file_perms;
corenet_tcp_sendrecv_all_if($1)
corenet_udp_sendrecv_all_if($1)
corenet_raw_sendrecv_all_if($1)
corenet_tcp_sendrecv_all_nodes($1)
corenet_udp_sendrecv_all_nodes($1)
corenet_raw_sendrecv_all_nodes($1)
corenet_tcp_sendrecv_all_ports($1)
corenet_udp_sendrecv_all_ports($1)
corenet_tcp_bind_all_nodes($1)
corenet_udp_bind_all_nodes($1)
corenet_tcp_bind_generic_port($1)
corenet_udp_bind_generic_port($1)
corenet_tcp_bind_reserved_port($1)
corenet_udp_bind_reserved_port($1)
corenet_dontaudit_tcp_bind_all_reserved_ports($1)
corenet_dontaudit_udp_bind_all_reserved_ports($1)
corenet_tcp_connect_portmap_port($1)
corenet_tcp_connect_reserved_port($1)
corenet_tcp_connect_generic_port($1)
corenet_dontaudit_tcp_connect_all_reserved_ports($1)
sysnet_read_config($1)
')
2005-06-24 19:49:46 +00:00
########################################
## <summary>
## Use the ypbind service to access NIS services.
## </summary>
## <param name="domain">
## The type of the process performing this action.
## </param>
#
interface(`nis_use_ypbind',`
gen_require(`
type var_yp_t;
')
tunable_policy(`allow_ypbind',`
dontaudit $1 self:capability net_bind_service;
allow $1 self:tcp_socket create_stream_socket_perms;
allow $1 self:udp_socket create_socket_perms;
2005-06-24 19:49:46 +00:00
allow $1 var_yp_t:dir r_dir_perms;
2005-09-27 19:40:44 +00:00
allow $1 var_yp_t:lnk_file { getattr read };
2005-06-24 19:49:46 +00:00
allow $1 var_yp_t:file r_file_perms;
corenet_tcp_sendrecv_all_if($1)
corenet_udp_sendrecv_all_if($1)
corenet_raw_sendrecv_all_if($1)
corenet_tcp_sendrecv_all_nodes($1)
corenet_udp_sendrecv_all_nodes($1)
corenet_raw_sendrecv_all_nodes($1)
corenet_tcp_sendrecv_all_ports($1)
corenet_udp_sendrecv_all_ports($1)
2005-09-15 21:03:29 +00:00
corenet_tcp_bind_all_nodes($1)
corenet_udp_bind_all_nodes($1)
2005-06-24 19:49:46 +00:00
corenet_tcp_bind_generic_port($1)
corenet_udp_bind_generic_port($1)
corenet_tcp_bind_reserved_port($1)
corenet_udp_bind_reserved_port($1)
corenet_dontaudit_tcp_bind_all_reserved_ports($1)
corenet_dontaudit_udp_bind_all_reserved_ports($1)
2005-09-15 21:03:29 +00:00
corenet_tcp_connect_portmap_port($1)
corenet_tcp_connect_reserved_port($1)
corenet_tcp_connect_generic_port($1)
corenet_dontaudit_tcp_connect_all_reserved_ports($1)
sysnet_read_config($1)
',`
dontaudit $1 var_yp_t:dir search;
')
optional_policy(`mount.te',`
tunable_policy(`allow_ypbind',`
mount_send_nfs_client_request($1)
')
2005-06-24 19:49:46 +00:00
')
')
2005-10-24 18:40:24 +00:00
########################################
## <summary>
## Execute ypbind in the ypbind domain.
## </summary>
## <param name="domain">
## Domain allowed access.
## </param>
#
interface(`nis_domtrans_ypbind',`
gen_require(`
type ypbind_t, ypbind_exec_t;
')
corecmd_search_bin($1)
domain_auto_trans($1,ypbind_exec_t,ypbind_t)
allow $1 ypbind_t:fd use;
allow ypbind_t $1:fd use;
allow ypbind_t $1:fifo_file rw_file_perms;
allow ypbind_t $1:process sigchld;
')
2005-10-14 17:55:40 +00:00
########################################
## <summary>
## Send generic signals to ypbind.
## </summary>
## <param name="domain">
## The type of the process performing this action.
## </param>
#
interface(`nis_signal_ypbind',`
gen_require(`
type ypbind_t;
')
allow $1 ypbind_t:process signal;
')
2005-06-24 19:49:46 +00:00
########################################
## <summary>
2005-10-22 21:09:03 +00:00
## List the contents of the NIS data directory.
2005-06-24 19:49:46 +00:00
## </summary>
## <param name="domain">
## The type of the process performing this action.
## </param>
#
interface(`nis_list_var_yp',`
gen_require(`
2005-10-14 17:55:40 +00:00
type var_yp_t;
2005-06-24 19:49:46 +00:00
')
files_search_var($1)
allow $1 var_yp_t:dir r_dir_perms;
')
########################################
## <summary>
## Send UDP network traffic to NIS clients.
## </summary>
## <param name="domain">
## The type of the process performing this action.
## </param>
#
interface(`nis_udp_sendto_ypbind',`
gen_require(`
type ypbind_t;
')
allow $1 ypbind_t:udp_socket sendto;
allow ypbind_t $1:udp_socket recvfrom;
')
2005-10-22 21:09:03 +00:00
########################################
## <summary>
## Connect to ypbind over TCP.
## </summary>
## <param name="domain">
## Domain allowed access.
## </param>
#
interface(`nis_tcp_connect_ypbind',`
gen_require(`
type ypbind_t;
')
allow $1 ypbind_t:tcp_socket { connectto recvfrom };
allow ypbind_t $1:tcp_socket { acceptfrom recvfrom };
allow $1 kernel_t:tcp_socket recvfrom;
')