RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
selinux-refpolicy/policy/modules/system/ipsec.fc

65 lines
3.6 KiB
Plaintext
Raw Normal View History

IPSEC patch from Dan Walsh.
2009-11-24 19:09:10 +00:00
/etc/rc\.d/init\.d/ipsec -- gen_context(system_u:object_r:ipsec_initrc_exec_t,s0)
/etc/rc\.d/init\.d/racoon -- gen_context(system_u:object_r:ipsec_initrc_exec_t,s0)
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/etc/ipsec\.secrets -- gen_context(system_u:object_r:ipsec_key_file_t,s0)
/etc/ipsec\.conf -- gen_context(system_u:object_r:ipsec_conf_file_t,s0)
/etc/racoon/psk\.txt -- gen_context(system_u:object_r:ipsec_key_file_t,s0)
add ipsec
2005-07-14 18:15:47 +00:00
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/etc/racoon(/.*)? gen_context(system_u:object_r:ipsec_conf_file_t,s0)
/etc/racoon/certs(/.*)? gen_context(system_u:object_r:ipsec_key_file_t,s0)
add ipsec
2005-07-14 18:15:47 +00:00
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/etc/ipsec\.d(/.*)? gen_context(system_u:object_r:ipsec_key_file_t,s0)
add ipsec
2005-07-14 18:15:47 +00:00
system/ipsec: Add policy for StrongSwan Adds an ipsec_supervisor_t domain for StrongSwan's starter. Thanks to Matthias Dahl for most of the work on this.
2015-10-11 10:37:56 +00:00
/etc/strongswan\.conf -- gen_context(system_u:object_r:ipsec_conf_file_t,s0)
/etc/strongswan\.d(/.*)? gen_context(system_u:object_r:ipsec_conf_file_t,s0)
Fix use of buggy pattern (.*)? The pattern "(.*)?" means "match anything including the nothing, or nothing": the question mark is redundant. This is likely to be a mispelling for "(/.*)?", which means "match a slash and anthing, or nothing", or for ".*", or for other patterns. Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2019-08-29 17:57:05 +00:00
/etc/swanctl/.+ gen_context(system_u:object_r:ipsec_key_file_t,s0)
system/ipsec: Add policy for StrongSwan Adds an ipsec_supervisor_t domain for StrongSwan's starter. Thanks to Matthias Dahl for most of the work on this.
2015-10-11 10:37:56 +00:00
/etc/swanctl -d gen_context(system_u:object_r:ipsec_conf_file_t,s0)
Remove unescaped single dot from the policy In a pattern, a dot can match any character, including slash. It makes sense when it is combined with ?, + or *, but makes little sense when left alone. Most of the time, the label was for file containing dots, where the dot was not escaped. A few times, the dot was really intended to match any character. In such case, [^/] better suits the intent. Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2019-08-27 21:38:09 +00:00
/etc/swanctl/swanctl\.conf -- gen_context(system_u:object_r:ipsec_conf_file_t,s0)
system/ipsec: Add policy for StrongSwan Adds an ipsec_supervisor_t domain for StrongSwan's starter. Thanks to Matthias Dahl for most of the work on this.
2015-10-11 10:37:56 +00:00
Support systems with a single /usr/bin directory On systems such as Arch Linux, all programs which are usually located in /bin, /sbin, /usr/bin and /usr/sbin are present in /usr/bin and the other locations are symbolic links to this directory. With such a configuration, the file contexts which define types for files in /bin, /sbin and /usr/sbin need to be duplicated to provide definitions for /usr/bin/... As the "/bin vs. /usr/bin" part of the needed definitions has already been done with the "usr merge" patches, the next step consists in duplicating file contexts for /usr/sbin. This is what this patch does for all modules which are not in contrib. This is the second iteration of an idea I have previously posted on http://oss.tresys.com/pipermail/refpolicy/2017-March/009176.html
2017-04-15 18:49:07 +00:00
/usr/bin/ipsec -- gen_context(system_u:object_r:ipsec_mgmt_exec_t,s0)
/usr/bin/racoon -- gen_context(system_u:object_r:racoon_exec_t,s0)
/usr/bin/setkey -- gen_context(system_u:object_r:setkey_exec_t,s0)
/usr/bin/swanctl -- gen_context(system_u:object_r:ipsec_mgmt_exec_t,s0)
Simplify .fc in light of file_contexts.subs_dist Now that we have file_contexts.subs_dist, translations that were put in the file context definition files can now be cleaned up. Differences from v1: - removes a few duplicate entries in the libraries.fc file, and - removes the contrib references Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2012-05-07 18:36:06 +00:00
/usr/lib/ipsec/_plutoload -- gen_context(system_u:object_r:ipsec_mgmt_exec_t,s0)
/usr/lib/ipsec/_plutorun -- gen_context(system_u:object_r:ipsec_mgmt_exec_t,s0)
Whitespace fixes from fc.subs changes.
2012-05-10 14:33:54 +00:00
/usr/lib/ipsec/eroute -- gen_context(system_u:object_r:ipsec_exec_t,s0)
Simplify .fc in light of file_contexts.subs_dist Now that we have file_contexts.subs_dist, translations that were put in the file context definition files can now be cleaned up. Differences from v1: - removes a few duplicate entries in the libraries.fc file, and - removes the contrib references Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2012-05-07 18:36:06 +00:00
/usr/lib/ipsec/klipsdebug -- gen_context(system_u:object_r:ipsec_exec_t,s0)
Whitespace fixes from fc.subs changes.
2012-05-10 14:33:54 +00:00
/usr/lib/ipsec/pluto -- gen_context(system_u:object_r:ipsec_exec_t,s0)
Simplify .fc in light of file_contexts.subs_dist Now that we have file_contexts.subs_dist, translations that were put in the file context definition files can now be cleaned up. Differences from v1: - removes a few duplicate entries in the libraries.fc file, and - removes the contrib references Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2012-05-07 18:36:06 +00:00
/usr/lib/ipsec/spi -- gen_context(system_u:object_r:ipsec_exec_t,s0)
add ipsec
2005-07-14 18:15:47 +00:00
system/ipsec: Add policy for StrongSwan Adds an ipsec_supervisor_t domain for StrongSwan's starter. Thanks to Matthias Dahl for most of the work on this.
2015-10-11 10:37:56 +00:00
/usr/libexec/ipsec/_copyright -- gen_context(system_u:object_r:ipsec_exec_t,s0)
trunk: 3 patches from dan.
2009-04-03 14:14:43 +00:00
/usr/libexec/ipsec/_plutoload -- gen_context(system_u:object_r:ipsec_mgmt_exec_t,s0)
/usr/libexec/ipsec/_plutorun -- gen_context(system_u:object_r:ipsec_mgmt_exec_t,s0)
system/ipsec: Add policy for StrongSwan Adds an ipsec_supervisor_t domain for StrongSwan's starter. Thanks to Matthias Dahl for most of the work on this.
2015-10-11 10:37:56 +00:00
/usr/libexec/ipsec/_updown -- gen_context(system_u:object_r:ipsec_exec_t,s0)
/usr/libexec/ipsec/charon -- gen_context(system_u:object_r:ipsec_exec_t,s0)
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/usr/libexec/ipsec/eroute -- gen_context(system_u:object_r:ipsec_exec_t,s0)
/usr/libexec/ipsec/klipsdebug -- gen_context(system_u:object_r:ipsec_exec_t,s0)
system/ipsec: Add policy for StrongSwan Adds an ipsec_supervisor_t domain for StrongSwan's starter. Thanks to Matthias Dahl for most of the work on this.
2015-10-11 10:37:56 +00:00
/usr/libexec/ipsec/lookip -- gen_context(system_u:object_r:ipsec_exec_t,s0)
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/usr/libexec/ipsec/pluto -- gen_context(system_u:object_r:ipsec_exec_t,s0)
system/ipsec: Add policy for StrongSwan Adds an ipsec_supervisor_t domain for StrongSwan's starter. Thanks to Matthias Dahl for most of the work on this.
2015-10-11 10:37:56 +00:00
/usr/libexec/ipsec/scepclient -- gen_context(system_u:object_r:ipsec_exec_t,s0)
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/usr/libexec/ipsec/spi -- gen_context(system_u:object_r:ipsec_exec_t,s0)
system/ipsec: Add policy for StrongSwan Adds an ipsec_supervisor_t domain for StrongSwan's starter. Thanks to Matthias Dahl for most of the work on this.
2015-10-11 10:37:56 +00:00
/usr/libexec/ipsec/starter -- gen_context(system_u:object_r:ipsec_supervisor_exec_t,s0)
/usr/libexec/ipsec/stroke -- gen_context(system_u:object_r:ipsec_exec_t,s0)
Pull in some changes from Fedora policy system layer.
2011-04-14 15:36:56 +00:00
/usr/libexec/nm-openswan-service -- gen_context(system_u:object_r:ipsec_mgmt_exec_t,s0)
add ipsec
2005-07-14 18:15:47 +00:00
ipsec: fixes for strongswan * Add fcontext for charon-systemd * Allow ipsec_mgmt_t to list ipsec_conf_file_t dir * Allow ipsec_mgmt_t to read cert files Fixes: avc: denied { search } for pid=372 comm="swanctl" name="strongswan.d" dev="vda" ino=1461 scontext=system_u:system_r:ipsec_mgmt_t:s0-s15:c0.c1023 tcontext=system_u:object_r:ipsec_conf_file_t:s0 tclass=dir permissive=0 avc: denied { read } for pid=372 comm="swanctl" name="strongswan.d" dev="vda" ino=1461 scontext=system_u:system_r:ipsec_mgmt_t:s0-s15:c0.c1023 tcontext=system_u:object_r:ipsec_conf_file_t:s0 tclass=dir permissive=0 avc: denied { getattr } for pid=323 comm="swanctl" path="/etc/ssl/openssl.cnf" dev="vda" ino=1463 scontext=system_u:system_r:ipsec_mgmt_t tcontext=system_u:object_r:cert_t tclass=file permissive=0 avc: denied { open } for pid=323 comm="swanctl" path="/etc/ssl/openssl.cnf" dev="vda" ino=1463 scontext=system_u:system_r:ipsec_mgmt_t tcontext=system_u:object_r:cert_t tclass=file permissive=0 avc: denied { read } for pid=323 comm="swanctl" name="openssl.cnf" dev="vda" ino=1463 scontext=system_u:system_r:ipsec_mgmt_t tcontext=system_u:object_r:cert_t tclass=file permissive=0 avc: denied { search } for pid=323 comm="swanctl" name="ssl" dev="vda" ino=1202 scontext=system_u:system_r:ipsec_mgmt_t tcontext=system_u:object_r:cert_t tclass=dir permissive=0 Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
2021-01-25 06:42:11 +00:00
/usr/sbin/charon-systemd -- gen_context(system_u:object_r:ipsec_exec_t,s0)
trunk: 3 patches from dan.
2009-04-03 14:14:43 +00:00
/usr/sbin/ipsec -- gen_context(system_u:object_r:ipsec_mgmt_exec_t,s0)
patch from dan, Thu, 2007-01-25 at 08:12 -0500
2007-02-16 23:01:42 +00:00
/usr/sbin/racoon -- gen_context(system_u:object_r:racoon_exec_t,s0)
/usr/sbin/setkey -- gen_context(system_u:object_r:setkey_exec_t,s0)
system/ipsec: Add policy for StrongSwan Adds an ipsec_supervisor_t domain for StrongSwan's starter. Thanks to Matthias Dahl for most of the work on this.
2015-10-11 10:37:56 +00:00
/usr/sbin/swanctl -- gen_context(system_u:object_r:ipsec_mgmt_exec_t,s0)
add ipsec
2005-07-14 18:15:47 +00:00
Rename *_var_run_t types to *_runtime_t. Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2019-09-08 20:55:02 +00:00
/var/lib/racoon(/.*)? gen_context(system_u:object_r:ipsec_runtime_t,s0)
Add /var/lib/racoon as runtime directory for ipsec
2014-11-22 21:16:41 +00:00
Pull in some changes from Fedora policy system layer.
2011-04-14 15:36:56 +00:00
/var/lock/subsys/ipsec -- gen_context(system_u:object_r:ipsec_mgmt_lock_t,s0)
Ipsec patch from Dan Walsh.
2010-03-17 17:52:07 +00:00
/var/log/pluto\.log -- gen_context(system_u:object_r:ipsec_log_t,s0)
Rename *_var_run_t types to *_runtime_t. Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2019-09-08 20:55:02 +00:00
/var/racoon(/.*)? gen_context(system_u:object_r:ipsec_runtime_t,s0)
more merging from 1.27.1-15
2005-10-14 17:55:40 +00:00
Rename *_var_run_t types to *_runtime_t. Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2019-09-08 20:55:02 +00:00
/run/charon\.[^/]+ -- gen_context(system_u:object_r:ipsec_runtime_t,s0)
/run/pluto(/.*)? gen_context(system_u:object_r:ipsec_runtime_t,s0)
/run/racoon\.pid -- gen_context(system_u:object_r:ipsec_runtime_t,s0)