RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
selinux-refpolicy/policy/modules/services/dirmngr.te

95 lines
2.8 KiB
Plaintext
Raw Normal View History

various: Module version bump. Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2020-04-21 15:03:01 +00:00
policy_module(dirmngr, 1.6.1)
Re-add policy modules from old refpolicy-contrib submodule.
2018-06-23 13:00:56 +00:00
########################################
#
# Declarations
#
type dirmngr_t;
type dirmngr_exec_t;
init_daemon_domain(dirmngr_t, dirmngr_exec_t)
type dirmngr_conf_t;
files_config_file(dirmngr_conf_t)
type dirmngr_initrc_exec_t;
init_script_file(dirmngr_initrc_exec_t)
type dirmngr_log_t;
logging_log_file(dirmngr_log_t)
Reorder declarations based on *_runtime_t renaming. Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2019-09-11 00:05:46 +00:00
type dirmngr_runtime_t alias dirmngr_var_run_t;
files_pid_file(dirmngr_runtime_t)
Re-add policy modules from old refpolicy-contrib submodule.
2018-06-23 13:00:56 +00:00
type dirmngr_tmp_t;
userdom_user_tmp_file(dirmngr_tmp_t)
userdom_user_runtime_content(dirmngr_tmp_t)
type dirmngr_var_lib_t;
files_type(dirmngr_var_lib_t)
type dirmngr_home_t;
userdom_user_home_content(dirmngr_home_t)
########################################
#
# Local policy
#
Fix mismatches between object class and permission macro. In many cases, this won't result in a change in the actual policy generated, but if the definitions of macros are changed going forward, the mismatches could cause issues. Signed-off-by: Daniel Burgener <Daniel.Burgener@microsoft.com>
2020-04-14 21:47:06 +00:00
allow dirmngr_t self:fifo_file rw_fifo_file_perms;
dirmngr: accept unix stream socket dirmngr needs to listen and accept on /run/user/1000/gnupg/S.dirmngr type=AVC msg=audit(1554175286.968:2720907): avc: denied { accept } for pid=15692 comm="dirmngr" path="/run/user/1000/gnupg/S.dirmngr" scontext=staff_u:staff_r:dirmngr_t:s0-s0:c0.c1023 tcontext=staff_u:staff_r:dirmngr_t:s0-s0:c0.c1023 tclass=unix_stream_socket permissive=0 Signed-off-by: Jason Zaman <jason@perfinion.com>
2019-12-24 10:10:39 +00:00
allow dirmngr_t self:unix_stream_socket rw_stream_socket_perms;
Re-add policy modules from old refpolicy-contrib submodule.
2018-06-23 13:00:56 +00:00
allow dirmngr_t dirmngr_conf_t:dir list_dir_perms;
allow dirmngr_t dirmngr_conf_t:file read_file_perms;
allow dirmngr_t dirmngr_conf_t:lnk_file read_lnk_file_perms;
dirmngr: ~/.gnupg/crls.d might not exist Signed-off-by: bauen1 <j2468h@gmail.com>
2020-05-10 12:06:36 +00:00
manage_files_pattern(dirmngr_t, dirmngr_home_t, dirmngr_home_t)
allow dirmngr_t dirmngr_home_t:dir { create_dir_perms add_entry_dir_perms list_dir_perms };
Re-add policy modules from old refpolicy-contrib submodule.
2018-06-23 13:00:56 +00:00
manage_dirs_pattern(dirmngr_t, dirmngr_log_t, dirmngr_log_t)
append_files_pattern(dirmngr_t, dirmngr_log_t, dirmngr_log_t)
create_files_pattern(dirmngr_t, dirmngr_log_t, dirmngr_log_t)
setattr_files_pattern(dirmngr_t, dirmngr_log_t, dirmngr_log_t)
logging_log_filetrans(dirmngr_t, dirmngr_log_t, dir)
manage_dirs_pattern(dirmngr_t, dirmngr_var_lib_t, dirmngr_var_lib_t)
manage_files_pattern(dirmngr_t, dirmngr_var_lib_t, dirmngr_var_lib_t)
manage_lnk_files_pattern(dirmngr_t, dirmngr_var_lib_t, dirmngr_var_lib_t)
files_var_lib_filetrans(dirmngr_t, dirmngr_var_lib_t, dir)
manage_sock_files_pattern(dirmngr_t, dirmngr_tmp_t, dirmngr_tmp_t)
Rename *_var_run_t types to *_runtime_t. Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2019-09-08 20:55:02 +00:00
manage_dirs_pattern(dirmngr_t, dirmngr_runtime_t, dirmngr_runtime_t)
manage_files_pattern(dirmngr_t, dirmngr_runtime_t, dirmngr_runtime_t)
manage_sock_files_pattern(dirmngr_t, dirmngr_runtime_t, dirmngr_runtime_t)
files_pid_filetrans(dirmngr_t, dirmngr_runtime_t, { dir file })
Re-add policy modules from old refpolicy-contrib submodule.
2018-06-23 13:00:56 +00:00
kernel_read_crypto_sysctls(dirmngr_t)
dev_read_rand(dirmngr_t)
dirmngr: also requires access to /dev/urandom Signed-off-by: bauen1 <j2468h@gmail.com>
2020-05-10 12:34:35 +00:00
dev_read_urand(dirmngr_t)
Re-add policy modules from old refpolicy-contrib submodule.
2018-06-23 13:00:56 +00:00
sysnet_dns_name_resolve(dirmngr_t)
corenet_tcp_connect_http_port(dirmngr_t)
corenet_tcp_connect_pgpkeyserver_port(dirmngr_t)
dirmngr: allow to probe for tor dirmngr will test if tor is running, even if it isn't and this check fails dirmngr will fail to retrieve any keys, this is the default (see https://www.gnupg.org/documentation/manuals/gnupg/Dirmngr-Options.html for --use-tor) Signed-off-by: bauen1 <j2468h@gmail.com>
2020-05-10 06:47:34 +00:00
corenet_tcp_connect_tor_port(dirmngr_t)
Re-add policy modules from old refpolicy-contrib submodule.
2018-06-23 13:00:56 +00:00
corenet_udp_bind_generic_node(dirmngr_t)
files_read_etc_files(dirmngr_t)
files_read_usr_files(dirmngr_t)
miscfiles_read_localization(dirmngr_t)
miscfiles_read_generic_certs(dirmngr_t)
userdom_search_user_home_dirs(dirmngr_t)
userdom_search_user_runtime(dirmngr_t)
userdom_user_runtime_filetrans(dirmngr_t, dirmngr_tmp_t, dir)
optional_policy(`
gpg_agent_tmp_filetrans(dirmngr_t, dirmngr_tmp_t, sock_file)
gpg_runtime_filetrans(dirmngr_t, dirmngr_tmp_t, sock_file)
gpg_secret_filetrans(dirmngr_t, dirmngr_home_t, dir)
gpg_stream_connect_agent(dirmngr_t)
')